Add fail-closed regression tests for high-blast-radius helpers that recent coverage PRs (#331–#338) did not lock. Main has not moved (e2d5f95e); this does not duplicate those open files.

Risky behavior now covered

• Turn error routing: sandbox/path/host blocks must stay permission_denied, not internal_error. Provider, backup, observability, and validation strings must keep their codes. Structured { code, source } wins over heuristic message text; unknown codes fail closed.
• Attachment materialization: .. / . / empty filenames are rejected before size checks. Rollback deletes only files/dirs the transaction still owns (dev/ino + realpath). A rename replacement or symlink swap is left intact so a canceled send cannot delete user data. commit() makes rollback a no-op.
• Task artifact registration: an active revision cannot be finalized onto a different artifact, path, or base version. Unknown work items / artifact ids / base versions fail closed. A null finalize result does not silently succeed. Same sha256 is a no-op.
• Spreadsheet OOXML: invalid RGB/indexed/theme colors return null; RGB wins over other color forms. Worksheet resolution picks the named sheet (or the first), and missing workbook/rels/sheet names return null instead of reading another sheet.
• Artifact diffs: the collector respects its detail cap and reports truncation. Oversized lines clip to 4094 chars. jsonEqual is key-order sensitive (JSON.stringify contract).

Test files added

• test/session/turnErrorClassifier.test.ts
• test/session/userMessageAttachments.materialization.test.ts
• test/server/tasks/TaskArtifacts.register.test.ts
• test/server/spreadsheet/ooxml-color.test.ts
• test/server/artifacts/diffUtils.test.ts

Why this reduces regression risk

These paths sit on shared turn, task, preview, and comparison flows. A classifier miss hides a permission denial as an internal error. A rollback miss deletes the wrong file after a TOCTOU swap. A revision-guard miss attaches the wrong artifact. OOXML/diff misses corrupt previews or unbounded comparison work. The new tests lock those contracts without changing production code.

Validation

• Targeted 49 tests + test/platform-boundary.test.ts: pass (including after commit, so the ratchet sees the new files)
• bun run check and bun run typecheck: pass
• Isolated targeted files are the evidence; the full suite on this host historically truncates late and was not used as the gate