Summary

Daily coverage pass for residual high-risk seams that are not already claimed by open PRs #298–#308. The only new production merge since yesterday is #309 (semantic transcript copy), which already shipped core tests; this PR covers leftover parse/copy edges plus older untested fail-closed paths.

Risky behavior now covered

• Creation preflight provider reachability — an unreachable catalog entry, a missing provider, or a non-Error catalog throw must block ready and emit the correct repair action instead of letting turn/start proceed.
• Control-socket mid-bootstrap reconnect — a socket reopen while the first bootstrap pass is still in flight must queue exactly one second catalog refresh after the first pass completes (not drop the refresh, and not stack a third).
• One-off chat abort / start-failure cleanup — cancelling newThread while createOneOffChatWorkspace is in flight, or failing workspace-server start after the one-off record exists, must trash the chat directory and leave no workspace/thread behind.
• Transcript copy parse edges from #309 — empty spreadsheet range falls back to the active cell; malformed spreadsheet envelopes degrade to a readable chip; canvas + attachments copy without XML/bracket markup; . / .. names stay literal; leading whitespace still parses as a canvas envelope.

Test files added/updated

• test/creation-preflight.provider-reachability.test.ts (added)
• apps/desktop/test/control-socket-bootstrap-rerun.test.ts (added)
• apps/desktop/test/new-thread-oneoff-abort.test.ts (added)
• apps/desktop/test/feed-message-parsing-edges.test.ts (added)
• apps/desktop/test/composer-draft-thread-switch.test.ts (updated: Date.now()-relative prune fixtures so persistence re-prune stays inside the 30-day max age)

Why these tests materially reduce regression risk

These are fail-closed / cleanup / parse paths with a large blast radius: a false ready starts a turn against a dead provider; a skipped bootstrap rerun leaves stale provider/MCP/session state after a cold-start reconnect; a missed trashPath leaks one-off chat dirs under ~/.cowork/chats; a copy-path regression pastes raw canvas XML or attachment serialization into the clipboard. Dedicated new files avoid overlapping the hot suites already claimed by #298–#308.

Validation

• Targeted coverage suites: 34 tests passed (including the unflaked prune test)
• Touched files Biome-clean
• bun run typecheck, bun run lint, bun run docs:check clean
• Full bun run test: the only failure on main fixtures was the aged composer-draft prune test; after the Date.now() unflake that file is green. The rest of the suite had already completed with no other failures.

Out of scope

• Codex preflight / catalog-throw+runtime checks already on #302
• Deferred control-sync timeout silent !ready (still needs #298 helper on main)
• Canvas soft-identity live atomic-commit conflict (still needs #298 helpers)
• reconnectThreadWithFeedback 15s timeout (slow without a test hook; #308 covers cannot-start + chat-removed)