Risky behavior now covered

• Pi / MiniMax stream mapping — tool-call IDs, reasoning mode, unknown-event drops, and MiniMax <think> splits that can corrupt every Pi-backed turn if they regress.
• Google stream event aliases — lifecycle vs content classification; malformed event_type / index fail closed instead of being treated as content.
• MCP operation lock — overlapping MCP setup on the same session is rejected (busy) while independent sessions stay concurrent.
• Conversation import helpers — preview preference/limit bucketing and JSONL parse_partial tolerance so import does not hide preferred chats or abort on one bad line.
• Spreadsheet zip / path / worksheet resolution — non-zip bytes, workspace escapes (including symlinks), and missing workbook/rel targets fail closed before parse.
• Desktop platform vocabulary — win32/darwin/linux map to windows/macos/linux; unknown hosts stay other.

Test files added

• test/runtime.pi-stream-parts.test.ts
• test/runtime/google-native/unit.stream-normalize.test.ts
• test/session/mcp-operation-lock.test.ts
• test/import/conversations.adapters-common.test.ts
• test/spreadsheet.validation.test.ts
• test/platform/host.test.ts

Why this reduces regression risk

These helpers sit on shared stream, import, MCP, and spreadsheet paths with no dedicated tests on main. Open coverage PRs #331–#342 do not cover them. The new cases lock fail-closed ID/path/event contracts that would otherwise show up as dropped tool calls, leaked paths, or overlapping MCP setup.

Production code is unchanged.

Validation

• Targeted 30 tests + test/platform-boundary.test.ts: green
• bun run check and bun run typecheck: clean
• Isolated targeted files are the evidence for this run (full suite historically truncates late on this host)