Risky behavior now covered

• Session DB hydration — SQLite JSON/timestamp/integer/boolean parsers fail closed, and only real disk-image corruption messages trigger recovery.
• JSON-RPC handshake — every WebSocket/H3/HTTP client must complete initialize then initialized before methods run; missing connection state, double-init, and pre-handshake calls stay rejected.
• Turn failure classification — malformed tool-call detection only fires after repeated classified errors (or a formatting complaint) and never after a successful tool result.
• Persisted usage/cost — session usage snapshots reject extras, blank ids, negatives, and invalid timestamps so corrupt cost/budget rows cannot hydrate.
• Conversation projection — feed item IDs, transcript normalization, and tool-arg JSON merge/strip stay stable across replay.
• Citation extraction — structured and text cite markers require http(s) URLs and turnN<kind>N reference ids; javascript: and malformed refs are dropped.
• Continuation invalidation — only OpenAI/Google/Codex stale-handle errors reset provider-managed continuation state.

Main is still at e2d5f95e. This does not duplicate open coverage PRs #331–#339.

Test files added

• test/session-db-normalizers.test.ts
• test/jsonrpc.dispatch-message.test.ts
• test/session/turnResponseParsing.test.ts
• test/session/sessionUsageSchema.test.ts
• test/server/projection/shared.test.ts
• test/shared/providerCitationSources.test.ts
• test/session/continuationPolicy.test.ts

Why this reduces regression risk

These are shared fail-closed gates on persistence, transport handshake, turn recovery, cost hydration, live feed projection, citations, and continuation reset. A silent accept here corrupts sessions, leaks methods before init, mis-fails turns, or drops/keeps the wrong citations. Dedicated unit tests lock the contract without changing production behavior.

Validation

• Targeted 26 tests + test/platform-boundary.test.ts: green
• bun run typecheck and bun run check: clean
• Isolated targeted files are the evidence (full suite on this host historically truncates late)

Out of scope

Did not lock known residuals that still need production fixes: canvas ino === 0, reconnect 15s timeout, startup {ready:true, error}, Codex resolveRolloutPath absolute-path hole, createSessionEventCapture sync throw. Did not re-lock connector setEnabled extras, continuation accountId matching, availability uppercase ids, or empty task/updateGraph workItems.