Summary

Adds focused regression coverage for residual high-risk gaps beyond open coverage PR #298, plus a small idle-eviction correctness fix for journal-backed sessions.

Risky behavior now covered

• Session idle eviction with permanent journal sinks — disconnecting the last live client now arms idle clocks and evicts after timeout even when a journal: sink remains (busy sessions stay live; reattach clears idle).
• Concurrent MCP tool-name collisions — servers whose names normalize to the same id remaps tools in config order (mcp__Foo_Bar__ping then mcp__Foo_Bar__ping_2) even when completion order is reversed.
• Session-scoped MCP cache on sibling cold-start failure — when sessionId is set, otel/tool-env failure must not close cached workspace MCP connections used by other turns.
• Runtime integrity path hardening — hard-linked runtime files and escaping symlinks fail closed on the fingerprint/verify path.

Test files added/updated

• test/server/runtime/sessionRegistry.idleEviction.test.ts (new)
• test/mcp.test.ts
• test/agent.test.ts
• test/coworkRuntime.test.ts
• src/server/runtime/SessionRegistry.ts (tiny production fix: key idle remove/evict off countLiveConnectionSinks)

Why this reduces regression risk

These paths sit on shared concurrency/trust seams: session lifecycle memory leaks, unstable MCP tool ids across concurrent loads, accidental teardown of shared MCP caches mid-session, and signed-runtime bypass via hardlinks/symlinks. Unit coverage is deterministic and avoids UI snapshots.

Validation

• Targeted: 114 pass
• Touched files Biome-clean
• bun run lint / typecheck / docs:check clean
• Full bun run test: all 673 files passed

Notes

• Leaves open PR #298 alone (deferred defaults, optimistic new-chat cleanup, integrity mid-verify race, etc.).
• Residual still open after #298: integrity mid-hash tree mutation seam (needs after-verifyExactTree test hook distinct from #298’s wrap).