Summary

Adds focused regression coverage for residual high-risk paths that are still untested on main and not claimed by open coverage PRs #298–#304.

Risky behavior now covered

• MCP auto-OAuth idle timeout: when a captured OAuth code is consumed but the session stays busy past expiresAt, completion abandons without token exchange (pending remains; no success event).
• MCP auto-OAuth exchange failure: token exchange errors emit mcp_server_auth_result ok:false / mode:"error" and clear connecting so later auth is not stuck.
• Provider auth busy gate: authorize / callback / logout / copyApiKey emit busy and skip side effects while a turn is running.
• JSON-RPC cowork/provider/auth/copyApiKey wire gate: missing provider or sourceProvider returns invalidParams before session work.
• Desktop setPerWorkspaceSettings(false) fan-out: switching shared→per-workspace off copies settings into other workspaces and applies defaults to their active threads.

Test files added/updated

• test/mcp.auth-flow.test.ts (+ scratchRoots migration / platform-boundary baseline shrink)
• test/session/agentSession.provider.test.ts
• test/jsonrpc.routes.review-fixes.test.ts
• apps/desktop/test/workspace-settings-sync.defaults.test.ts
• CI stabilizers: apps/desktop/test/research-readiness.test.tsx, apps/mobile/bun.lock, test/platform-boundary.baseline.json

Why this reduces regression risk

These paths sit on auth completion, busy/permission gating, JSON-RPC validation, and cross-workspace settings propagation. Failures here strand OAuth (single-use codes), leave connecting stuck, accept invalid copy-key requests, or leave other-workspace threads on stale config — all high blast-radius without needing UI snapshots.

Validation

• Targeted suites green
• bunx biome check on touched files
• bun run lint / bun run typecheck / bun run docs:check green
• Full bun run test: all 672 files passed (Bun canary)