Risky behavior now covered

• H3 per-device connections: mobile HTTP/SSE reuse one connection per device id. Close must tear down the connection and event-stream owner so reconnect cannot send on a dead stream; closeAll must close every live connection; clearing a stream owner must not close the RPC connection.
• Persisted session snapshots: SQLite hydration, conversation import, and thread/hydrate reject extras, blank identities, unknown enums, negative/fractional counters, padded ISO timestamps, malformed feed items (blank ids, unknown kinds, invalid tool states, blank retryOf, unknown error codes, terminal-lock data with a non-terminal status), and invalid workflow runs (blank runId, extras, live outcome, oversize errors, negative agent index).
• Agent target paths: spawn, AgentControl, and session-db mapping trim and first-seen-dedupe paths; blank entries fail closed instead of being dropped.

Test files added/updated

• Added test/h3.device-connections.test.ts
• Added test/shared/session-snapshot-schema-rejects.test.ts
• Added test/shared/agent-target-paths.test.ts

Why these tests materially reduce regression risk

Recent main commits extracted the H3 connection registry from the server. A reuse/close miss would leak SSE owners or serve a closed connection after re-pair. Snapshot schema is the last gate before SQLite, import, and hydrate; a loosened feed/error/workflow union would persist corrupt state across desktop, mobile, and CLI. Target-path normalization is shared by spawn RPC, the spawn tool, and session-db mappers — dropping a blank path would silently change the child's workspace scope.

Does not duplicate open coverage PRs #331–#336.

Validation

• Targeted coverage + test/platform-boundary.test.ts: 12 tests green
• bun run check, bun run typecheck, bun run docs:check: clean
• biome check --write on touched files
• Did not run the full suite on this host (historically truncates late). Isolated targeted files are the evidence for this run.