Risky behavior now covered

• MCP validation short-circuits — blank or whitespace-only names fail before lookup or spawn; unknown servers report not-found; missing / oauth_pending / error auth never hydrates or starts the server; a disabled layer reports not_active; overlapping validation emits busy; resolver exceptions are classified without spawn. Successful loads map tools (non-string descriptions dropped) and always close the client, including load_failed.
• MCP registry fail-closed gates — a running agent cannot flip enableMcp; an unchanged flag is a no-op; persist failure keeps the in-session flag and reports internal_error; blank names, system toggles, and plugin toggles without metadata are validation_failed and write nothing; malformed workspace mcp-servers.json is ignored with a warning instead of loading servers.
• Plugin lookup targeting — mcpServerLookupFromServer drops a blank pluginId so post-auth validation cannot target an empty plugin bucket.

Test files added/updated

• test/session/mcp-validation-flow.test.ts
• test/session/mcp-registry-flow.test.ts
• test/session/mcp-server-lookup.test.ts
• src/server/session/mcp/McpValidationFlow.ts (optional deps, same pattern as McpAuthFlow; default wiring unchanged)

Why these tests materially reduce regression risk

Validation is the user-initiated path that is allowed to start an otherwise untrusted workspace MCP server. A missed auth or not-found short-circuit can spawn stdio or open an outbound HTTP connection. Registry misclassification can persist a bad config or treat a schema error as an internal failure. Open coverage PRs #331–#344 do not cover these extracted helpers. Existing session tests only exercise concurrency and happy-path upsert.

Validation

• Targeted 18 new tests + existing MCP auth/session suites + test/platform-boundary.test.ts: green
• bun run check and bun run typecheck: clean
• Isolated targeted files are the evidence for this run (full suite historically truncates late on this host)