diff --git a/canvas/src/components/MissingKeysModal.tsx b/canvas/src/components/MissingKeysModal.tsx
index 2c2a648e..f2a390e4 100644
--- a/canvas/src/components/MissingKeysModal.tsx
+++ b/canvas/src/components/MissingKeysModal.tsx
@@ -387,7 +387,6 @@ function AllKeysModal({
 }) {
   const [entries, setEntries] = useState<KeyEntry[]>([]);
   const [globalError, setGlobalError] = useState<string | null>(null);
-  const firstInputRef = useRef<HTMLInputElement>(null);
 
   useEffect(() => {
     if (!open) return;
@@ -471,6 +470,15 @@ function AllKeysModal({
     onKeysAdded();
   }, [entries, onKeysAdded]);
 
+  // Focus trap: auto-focus first input when modal opens
+  useEffect(() => {
+    if (!open) return;
+    const timer = requestAnimationFrame(() => {
+      document.getElementById("missing-keys-title")?.focus();
+    });
+    return () => cancelAnimationFrame(timer);
+  }, [open]);
+
   if (!open) return null;
 
   const allSaved = entries.length > 0 && entries.every((e) => e.saved);
@@ -482,8 +490,8 @@ function AllKeysModal({
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center">
       <div
-        aria-hidden="true"
         className="absolute inset-0 bg-black/70 backdrop-blur-sm"
+        aria-hidden="true"
         onClick={onCancel}
       />
 
@@ -530,7 +538,7 @@ function AllKeysModal({
                 </div>
                 {entry.saved && (
                   <span className="text-[9px] text-emerald-400 bg-emerald-900/30 px-1.5 py-0.5 rounded flex items-center gap-1">
-                    <svg width="8" height="8" viewBox="0 0 8 8" fill="none" aria-hidden="true">
+                    <svg width="8" height="8" viewBox="0 0 8 8" fill="none">
                       <path d="M1.5 4L3.5 6L6.5 2" stroke="currentColor" strokeWidth="1.2" strokeLinecap="round" strokeLinejoin="round" />
                     </svg>
                     Saved
@@ -545,7 +553,7 @@ function AllKeysModal({
                     onChange={(e) => updateEntry(index, { value: e.target.value.trimStart() })}
                     placeholder={entry.key.includes("API_KEY") ? "sk-..." : "Enter value"}
                     type="password"
-                    ref={index === 0 ? firstInputRef : undefined}
+                    autoFocus={index === 0}
                     onKeyDown={(e) => {
                       if (e.key === "Enter" && entry.value.trim()) {
                         handleSaveKey(index);
diff --git a/canvas/src/components/__tests__/ContextMenu.keyboard.test.tsx b/canvas/src/components/__tests__/ContextMenu.keyboard.test.tsx
index cc7a65df..4a6412b5 100644
--- a/canvas/src/components/__tests__/ContextMenu.keyboard.test.tsx
+++ b/canvas/src/components/__tests__/ContextMenu.keyboard.test.tsx
@@ -48,20 +48,12 @@ const mockStore = {
   nodes: [] as Array<{ id: string; data: { parentId: string | null } }>,
 };
 
-// useCanvasStore.getState() is called directly by ContextMenu to read `nodes`
-// for parent-filtering (see ContextMenu.tsx childNodes computation). The mock
-// must expose both the selector-calling function form AND the .getState()
-// form so production code using either pattern doesn't hit "not a function".
-// Factory body runs under vi.mock's hoist — cannot reference outer scope,
-// so we build the mock function inside and reach `mockStore` via `globalThis`.
-vi.mock("@/store/canvas", () => {
-  const fn = vi.fn((selector: (s: typeof mockStore) => unknown) =>
-    selector(mockStore),
-  );
-  return {
-    useCanvasStore: Object.assign(fn, { getState: () => mockStore }),
-  };
-});
+vi.mock("@/store/canvas", () => ({
+  useCanvasStore: Object.assign(
+    vi.fn((selector: (s: typeof mockStore) => unknown) => selector(mockStore)),
+    { getState: () => mockStore }
+  ),
+}));
 
 // ── Component under test — imported AFTER mocks ───────────────────────────────
 import { ContextMenu } from "../ContextMenu";
@@ -231,9 +223,12 @@ describe("ContextMenu — keyboard accessibility", () => {
     const items = screen.getAllByRole("menuitem");
     const deleteItem = items.find((el) => el.textContent?.includes("Delete"))!;
     fireEvent.click(deleteItem);
-    expect(mockStore.setPendingDelete).toHaveBeenCalledWith(
-      expect.objectContaining({ id: "ws-1", name: "Alpha Workspace" })
-    );
+    expect(mockStore.setPendingDelete).toHaveBeenCalledWith({
+      id: "ws-1",
+      name: "Alpha Workspace",
+      hasChildren: false,
+      children: [],
+    });
     expect(closeContextMenu).toHaveBeenCalled();
   });
 });
diff --git a/canvas/src/components/__tests__/MissingKeysModal.a11y.test.tsx b/canvas/src/components/__tests__/MissingKeysModal.a11y.test.tsx
index a6fb1504..83a5072c 100644
--- a/canvas/src/components/__tests__/MissingKeysModal.a11y.test.tsx
+++ b/canvas/src/components/__tests__/MissingKeysModal.a11y.test.tsx
@@ -85,7 +85,7 @@ describe("MissingKeysModal — WCAG 2.1 dialog accessibility", () => {
     const backdrop = document.querySelector('[aria-hidden="true"]');
     expect(backdrop).toBeTruthy();
     // Verify the backdrop is the full-screen overlay (has bg-black/70)
-    expect(backdrop?.className).toContain("bg-black");
+    expect(backdrop?.className).toContain("bg-black/70");
   });
 
   it("decorative warning SVG in header has aria-hidden='true'", () => {
diff --git a/workspace-server/internal/handlers/discovery.go b/workspace-server/internal/handlers/discovery.go
index bf55cc7d..c221bc50 100644
--- a/workspace-server/internal/handlers/discovery.go
+++ b/workspace-server/internal/handlers/discovery.go
@@ -348,6 +348,17 @@ func validateDiscoveryCaller(ctx context.Context, c *gin.Context, workspaceID st
 
 	tok := wsauth.BearerTokenFromHeader(c.GetHeader("Authorization"))
 	if tok == "" {
+		// Canvas hits this endpoint via session cookie, not bearer token.
+		// Add verifiedCPSession() as a fallback after the bearer check so
+		// SaaS canvas Peers tab doesn't 401. Self-hosted workspaces are
+		// unaffected — they have no CP session cookie.
+		if ok, presented := middleware.VerifiedCPSession(c.GetHeader("Cookie")); ok {
+			return nil
+		}
+		if presented {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid session"})
+			return errors.New("invalid session")
+		}
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing workspace auth token"})
 		return errors.New("missing token")
 	}
diff --git a/workspace-server/internal/middleware/session_auth.go b/workspace-server/internal/middleware/session_auth.go
index 359e540d..225a8b23 100644
--- a/workspace-server/internal/middleware/session_auth.go
+++ b/workspace-server/internal/middleware/session_auth.go
@@ -157,7 +157,7 @@ func tenantSlug() string {
 	return strings.TrimSpace(os.Getenv("MOLECULE_ORG_SLUG"))
 }
 
-// verifiedCPSession returns true when the request carries a cookie
+// VerifiedCPSession returns true when the request carries a cookie
 // that the CP confirms belongs to a MEMBER of THIS tenant's org (not
 // just "someone is logged in"). The difference is the authz boundary:
 // any WorkOS-authed user could hit /cp/auth/me successfully; only
@@ -171,7 +171,7 @@ func tenantSlug() string {
 // — fail-safe: better to refuse session auth than to accept it
 // without knowing which tenant we ARE. Deployments that want session
 // auth MUST set both CP_UPSTREAM_URL and MOLECULE_ORG_SLUG.
-func verifiedCPSession(cookieHeader string) (valid, presented bool) {
+func VerifiedCPSession(cookieHeader string) (valid, presented bool) {
 	if cookieHeader == "" {
 		return false, false
 	}
@@ -193,7 +193,7 @@ func verifiedCPSession(cookieHeader string) (valid, presented bool) {
 	client := &http.Client{Timeout: 3 * time.Second}
 	req, err := http.NewRequest("GET", verifyURL, nil)
 	if err != nil {
-		log.Printf("verifiedCPSession: build req: %v", err)
+		log.Printf("VerifiedCPSession: build req: %v", err)
 		return false, true
 	}
 	req.Header.Set("Cookie", cookieHeader)
@@ -201,7 +201,7 @@ func verifiedCPSession(cookieHeader string) (valid, presented bool) {
 
 	resp, err := client.Do(req)
 	if err != nil {
-		log.Printf("verifiedCPSession: upstream: %v", err)
+		log.Printf("VerifiedCPSession: upstream: %v", err)
 		// NOTE: we deliberately do NOT cache transport failures.
 		// Caching them would mean a 3s CP blip locks out all users
 		// for the negative-TTL window. Next request retries.
diff --git a/workspace-server/internal/middleware/session_auth_test.go b/workspace-server/internal/middleware/session_auth_test.go
index b60cc7f7..6e6e9a08 100644
--- a/workspace-server/internal/middleware/session_auth_test.go
+++ b/workspace-server/internal/middleware/session_auth_test.go
@@ -37,7 +37,7 @@ func mockCPServer(t *testing.T, status int, body string) (*httptest.Server, *ato
 
 func TestVerifiedCPSession_EmptyCookie(t *testing.T) {
 	resetSessionCache()
-	ok, presented := verifiedCPSession("")
+	ok, presented := VerifiedCPSession("")
 	if ok || presented {
 		t.Errorf("empty cookie should be (false, false); got (%v, %v)", ok, presented)
 	}
@@ -47,7 +47,7 @@ func TestVerifiedCPSession_NoSlugConfigured(t *testing.T) {
 	resetSessionCache()
 	t.Setenv("CP_UPSTREAM_URL", "https://cp.test")
 	t.Setenv("MOLECULE_ORG_SLUG", "")
-	ok, presented := verifiedCPSession("session=foo")
+	ok, presented := VerifiedCPSession("session=foo")
 	// Without a slug we can't ask about tenant membership. Must
 	// refuse (false, false) — caller falls through to bearer tier.
 	if ok || presented {
@@ -59,7 +59,7 @@ func TestVerifiedCPSession_NoCPConfigured(t *testing.T) {
 	resetSessionCache()
 	t.Setenv("CP_UPSTREAM_URL", "")
 	t.Setenv("MOLECULE_ORG_SLUG", "acme")
-	ok, presented := verifiedCPSession("session=foo")
+	ok, presented := VerifiedCPSession("session=foo")
 	// Self-hosted path: CP not configured, but cookie WAS presented.
 	// Presented=true lets the caller know not to fall through to
 	// bearer as if no credential arrived.
@@ -74,7 +74,7 @@ func TestVerifiedCPSession_MemberTrue(t *testing.T) {
 	t.Setenv("CP_UPSTREAM_URL", srv.URL)
 	t.Setenv("MOLECULE_ORG_SLUG", "acme")
 
-	ok, presented := verifiedCPSession("session=valid")
+	ok, presented := VerifiedCPSession("session=valid")
 	if !ok || !presented {
 		t.Errorf("valid member should be (true, true); got (%v, %v)", ok, presented)
 	}
@@ -83,7 +83,7 @@ func TestVerifiedCPSession_MemberTrue(t *testing.T) {
 	}
 
 	// Second call must be served from cache.
-	ok, _ = verifiedCPSession("session=valid")
+	ok, _ = VerifiedCPSession("session=valid")
 	if !ok {
 		t.Errorf("cached call should still be true")
 	}
@@ -99,7 +99,7 @@ func TestVerifiedCPSession_MemberFalse(t *testing.T) {
 	t.Setenv("CP_UPSTREAM_URL", srv.URL)
 	t.Setenv("MOLECULE_ORG_SLUG", "acme")
 
-	ok, presented := verifiedCPSession("session=wrong-tenant")
+	ok, presented := VerifiedCPSession("session=wrong-tenant")
 	if ok || !presented {
 		t.Errorf("non-member should be (false, true); got (%v, %v)", ok, presented)
 	}
@@ -107,7 +107,7 @@ func TestVerifiedCPSession_MemberFalse(t *testing.T) {
 		t.Fatalf("expected 1 upstream hit")
 	}
 	// Cached negatively.
-	_, _ = verifiedCPSession("session=wrong-tenant")
+	_, _ = VerifiedCPSession("session=wrong-tenant")
 	if hits.Load() != 1 {
 		t.Errorf("negative result should cache too; got %d hits", hits.Load())
 	}
@@ -119,7 +119,7 @@ func TestVerifiedCPSession_Upstream401(t *testing.T) {
 	t.Setenv("CP_UPSTREAM_URL", srv.URL)
 	t.Setenv("MOLECULE_ORG_SLUG", "acme")
 
-	ok, presented := verifiedCPSession("session=expired")
+	ok, presented := VerifiedCPSession("session=expired")
 	if ok || !presented {
 		t.Errorf("401 upstream should be (false, true); got (%v, %v)", ok, presented)
 	}
@@ -131,7 +131,7 @@ func TestVerifiedCPSession_MalformedJSON(t *testing.T) {
 	t.Setenv("CP_UPSTREAM_URL", srv.URL)
 	t.Setenv("MOLECULE_ORG_SLUG", "acme")
 
-	ok, presented := verifiedCPSession("session=broken")
+	ok, presented := VerifiedCPSession("session=broken")
 	if ok || !presented {
 		t.Errorf("malformed body should be (false, true); got (%v, %v)", ok, presented)
 	}
@@ -143,7 +143,7 @@ func TestVerifiedCPSession_TransportErrorNotCached(t *testing.T) {
 	t.Setenv("CP_UPSTREAM_URL", "http://127.0.0.1:1")
 	t.Setenv("MOLECULE_ORG_SLUG", "acme")
 
-	ok, presented := verifiedCPSession("session=whatever")
+	ok, presented := VerifiedCPSession("session=whatever")
 	if ok || !presented {
 		t.Errorf("transport error should be (false, true); got (%v, %v)", ok, presented)
 	}
@@ -178,12 +178,12 @@ func TestVerifiedCPSession_CrossTenantIsolation(t *testing.T) {
 	cookie := "session=shared-auth"
 
 	t.Setenv("MOLECULE_ORG_SLUG", "acme")
-	if ok, _ := verifiedCPSession(cookie); !ok {
+	if ok, _ := VerifiedCPSession(cookie); !ok {
 		t.Errorf("acme should say member=true")
 	}
 
 	t.Setenv("MOLECULE_ORG_SLUG", "bob")
-	if ok, _ := verifiedCPSession(cookie); ok {
+	if ok, _ := VerifiedCPSession(cookie); ok {
 		t.Errorf("bob tenant must NOT accept acme cookie despite same session bytes")
 	}
 	if len(reqs) != 2 {
diff --git a/workspace-server/internal/middleware/wsauth_middleware.go b/workspace-server/internal/middleware/wsauth_middleware.go
index 66b8f261..a391fda3 100644
--- a/workspace-server/internal/middleware/wsauth_middleware.go
+++ b/workspace-server/internal/middleware/wsauth_middleware.go
@@ -174,7 +174,7 @@ func AdminAuth(database *sql.DB) gin.HandlerFunc {
 		// hosted / dev deploys without a CP fall through to the
 		// bearer-only path unchanged.
 		if cookieHeader := c.GetHeader("Cookie"); cookieHeader != "" {
-			if ok, _ := verifiedCPSession(cookieHeader); ok {
+			if ok, _ := VerifiedCPSession(cookieHeader); ok {
 				c.Next()
 				return
 			}