Main is still at e2d5f95e (unchanged since 2026-09-11). This run adds fail-closed coverage for extracted session collaborators that #331–#345 did not claim.

Risky behavior now covered

• Child-session authority: agent sessions cannot list/hydrate/delete/spawn or use workspace backups.
• Snapshot isolation: live children, foreign workspaces, unknown ids, and missing snapshots fail closed; the active session cannot delete itself.
• Busy reset: a running session cannot wipe history, todos, or provider state.
• Config conflicts: setting a value and its clear flag together is rejected and not persisted; blank titles do not rename.
• Slash commands / extension ids: blank, unknown, and empty-expand commands never become user messages; blank skill/plugin/marketplace ids fail before lookup; busy or mutation-blocked sessions do not mutate.
• Persistence queue: disabled persistence never writes; a queued flush projects lastEventSeq + 1; exhausted sqlite locks emit persist + lock telemetry after 3 attempts.

Test files added/updated

• test/session/sessionAdmin.fail-closed.test.ts (added)
• test/session/sessionMetadata.fail-closed.test.ts (added)
• test/session/skillManager.fail-closed.test.ts (added)
• test/server/persistenceManager.test.ts (updated)

Why these tests materially reduce regression risk

These paths are permission, validation, and persistence gates on shared session collaborators. A regression would leak child-session control, apply contradictory config clears, turn invalid slash commands into user turns, or drop/mis-sequence snapshot writes. The tests prove the reject/no-op contract without changing production behavior.

Validation

• Targeted 15 new tests + existing PersistenceManager suite + test/platform-boundary.test.ts: 22 passed
• bun run typecheck and Biome on the repo: clean
• Isolated targeted files are the evidence (full suite historically truncates late)
• No os.tmpdir() in new tests (platform-boundary ratchet)