Risky behavior now covered

• WebSocket JSON-RPC decode: decodeJsonRpcMessage accepts string, Uint8Array, ArrayBuffer, and Buffer frames, rejects non-frame payloads before JSON parse, maps malformed text/bytes to parse errors, and keeps the request id on invalid envelopes.
• Task RPC permissions: only task/list, task/read, task/artifact/version/compare, and task/artifact/version/preview are conversations-only. Every other registered task method and unknown task/* methods require conversations + turns, so a loosened allowlist cannot silently grant mutation access.
• Session request schemas: title/model/budget/harness/upload/delete trim ids and reject blanks or extras. Model set requires a model; harness context is a strict payload with string metadata.
• Thread/turn request schemas: start/resume reject blanks, extras, and fractional afterSeq. Turn start rejects missing input, extras, more than 32 skill/plugin references, unknown reference kinds, empty or oversized retry target lists, and more than 8 attachments (shared with steer).
• Restored agent execution: a closed lifecycle stays closed; running / pending_init restore as errored so a restart cannot resurrect an in-flight child; settled states are preserved and missing state defaults to completed.
• Spreadsheet helpers shared by read and write: path kind is csv/xlsx only (case-insensitive); CSV dialect honors BOM + sep= preambles, ignores quoted delimiters, and only inspects the first 1024 characters; column widths encode and decode through the stable 7px digit-width formula.

Test files added

• test/jsonrpc.decode-message.test.ts
• test/jsonrpc.task-rpc-permissions.test.ts
• test/jsonrpc.session-request-schema-rejects.test.ts
• test/jsonrpc.thread-turn-schema-rejects.test.ts
• test/shared/agent-restore-execution-state.test.ts
• test/spreadsheet.util.test.ts

Why these tests reduce regression risk

These are shared fail-closed gates with a large blast radius. Every client message goes through decodeJsonRpcMessage; a loosened frame check would accept non-JSON payloads or drop request ids. Task permissions are enforced on desktop, H3, and ServerRuntime — classifying a mutating method as read-only would let a conversations-only mobile device change tasks. Session and turn schemas are the first line of defense for title/model/budget/harness/upload/delete and attachment/retry/reference caps; those paths previously had integration happy paths only. Agent restore is used from hydration, session-db mapping, and AgentControl; resurrecting running after a restart would show a live child that no longer exists. Spreadsheet kind and CSV dialect were recently shared between read and write, so a delimiter or extension miss would corrupt files on save.

This run does not duplicate open coverage PRs #331, #332, #333, or #334.

Validation

• Targeted new files + platform-boundary: 24 tests green
• Related existing JSON-RPC schema/protocol tests: 56 green
• bun run typecheck, bun run check, bun run docs:check, and Biome on touched files: clean
• Full bun run test: new files that reached the runner passed in-suite (decode-message, session-request-schema-rejects, task-rpc-permissions, thread-turn-schema-rejects). spreadsheet.util and agent-restore-execution-state passed isolated; the host suite truncated before those later files (same pattern as recent coverage runs). Reproduced the known ipc-files rewritten-mtime reauth failure; not introduced by this change.