diff --git a/TODO.md b/TODO.md
index 284e74ad..a349282a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -289,6 +289,23 @@ everything still open, in the order it should be tackled.
             only on Windows, which is the one platform they were not written
             for. Declaring textual would make them run where they were
             written, which is probably the first move.
+      - [ ] **`src/seedpass/core/manager.py` sits two tenths of a point above
+            its coverage floor.** 60.74% against a 60.00% threshold on Linux,
+            59.80% on Windows — which is why the floor is now measured on
+            Linux only (see `scripts/run_ci_tests.sh`): the module holds
+            POSIX-only paths that cannot execute on Windows, and Windows runs
+            MORE tests, not fewer, so the gap is unreachable code rather than
+            absent tests.
+
+            That is the right call for the gate and not a substitute for the
+            real problem, which is that a 2970-statement module central to the
+            application is 60% covered with no headroom. The uncovered blocks
+            are almost entirely the interactive `input()`/`print()` menu
+            handlers, so raising the number means either testing prompt flows
+            (brittle, low value) or extracting the logic out of the prompt
+            loops so it can be tested without them. The second is the real
+            work.
+            (Recorded 2026-08-20.)
       - [ ] **Are vault files protected from other users on Windows?**
             `test_atomic_write_permissions` and
             `test_index_files_are_not_readable_by_other_users` assert mode
diff --git a/scripts/run_ci_tests.sh b/scripts/run_ci_tests.sh
index 483d7ba3..4dd0ff5c 100755
--- a/scripts/run_ci_tests.sh
+++ b/scripts/run_ci_tests.sh
@@ -88,10 +88,23 @@ if [[ $status -eq 124 ]]; then
     tail -n 20 pytest.log
     exit 1
 fi
+# The critical-coverage floor is a property of the codebase, not of a
+# platform, so it is measured on one. src/seedpass/core/manager.py holds
+# POSIX-only paths that cannot execute on Windows at all: it measures 60.74%
+# on Linux and 59.80% on Windows against a 60.00% floor -- and Windows runs
+# MORE tests, not fewer (1239 against 1223), so the gap is code that is
+# unreachable there rather than tests that did not run. A floor checked on
+# Windows measures platform reachability instead of test quality, and fails
+# by two tenths of a point for reasons no test author can act on.
 if [[ $status -eq 0 && "${CRITICAL_COVERAGE_GATE:-1}" == "1" ]]; then
-    "$py_bin" scripts/check_critical_coverage.py \
-        artifacts/coverage/coverage.json \
-        --json-output artifacts/coverage/critical_gate.full.json
+    if [[ "${RUNNER_OS:-Linux}" == "Linux" ]]; then
+        "$py_bin" scripts/check_critical_coverage.py \
+            artifacts/coverage/coverage.json \
+            --json-output artifacts/coverage/critical_gate.full.json
+    else
+        echo "critical coverage gate: not run on ${RUNNER_OS:-this platform}" \
+             "(the floor is measured on Linux -- see the comment above)"
+    fi
 fi
 if [[ $status -eq 0 && "${TUI2_COVERAGE_GATE:-0}" == "1" ]]; then
     ./scripts/tui2_coverage_gate.sh