Risky behavior now covered

• Task review material fingerprints — inactive/superseded requirements, decisions, questions, and blockers are excluded; work-item deps/outputs and question options are sorted; live-file SHA evidence is included. Reordering inputs cannot change the fingerprint, but an objective or live SHA change must.
• Artifact content-addressed store — invalid SHA keys never touch the object tree; tampered blobs fail closed on read and rewrite; missing files fingerprint as null; directories are rejected; restore refuses fingerprint conflicts (including missing expected files) and only writes stored bytes when the expected fingerprint matches; concurrent putBytes of the same digest stays idempotent.
• User-message turn helpers — attachment display names are basename-only (../secret/notes.md → notes.md); . / .. / empty names are dropped; branded task-lock abort errors round-trip with their session payload and are distinct from a plain ABORT_ERR; aborted signals count as abort-like.
• H3 trusted-device permission mapping — default pairings get no task read, task mutation, or workspace-control flags; conversations alone enables reads, not mutations; mutation requires both conversations and turns; workspaceSettings toggles control events independently.
• Bearer token parsing — only Bearer credentials yield a token; missing, empty, Basic, and token-less headers fail closed.

Test files added

• test/server/tasks/taskReviewPolicy.material.test.ts
• test/server/tasks/ArtifactVersionStore.test.ts
• test/session/userMessageTurnHelpers.test.ts
• test/server/transport/h3.permissions.connection.test.ts
• test/server/transport/parse-bearer-token.test.ts

Why this reduces regression risk

These helpers sit on review completion, artifact restore, turn cancellation, and mobile/H3 auth paths. A fingerprint miss can pass a stale review; a CAS integrity miss can restore or accept the wrong bytes; a permission-mapping miss can let a default-paired device mutate tasks. Open coverage PRs #331–#343 do not cover them. Coordinator tests already exercise artifact restore rollback through TaskCoordinator; this run locks the extracted store/policy/permission helpers instead of duplicating that integration.

Production code is unchanged.

Validation

• Targeted 21 tests + test/platform-boundary.test.ts: green
• bun run check and bun run typecheck: clean
• Isolated targeted files are the evidence for this run (full suite historically truncates late on this host)