diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 9b9d04e8..0e850cbd 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -304,6 +304,7 @@ jobs:
     name: Canvas (Next.js)
     needs: changes
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     # Phase 4 (RFC #219 §1): confirmed green on main 2026-05-12.
     continue-on-error: false
     defaults:
@@ -402,12 +403,13 @@ jobs:
   canvas-deploy-reminder:
     name: Canvas Deploy Reminder
     runs-on: ubuntu-latest
-    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
-    continue-on-error: true
+    # mc#774 root-fix: added job-level `if:` so ci-required-drift.py's
+    # ci_job_names() detects this as github.ref-gated and skips it from F1.
+    # The step-level exit 0 handles the "not main push" case; the job-level
+    # `if:` makes the gating explicit so the drift script sees it.
+    # continue-on-error removed (was mc#774 mask): step exits 0 when not applicable.
     needs: [changes, canvas-build]
-    # Keep the job itself always runnable. Gitea 1.22.6 leaves job-level
-    # event/ref `if:` gates as pending on PRs, which blocks the combined
-    # status even though this reminder is intentionally non-required.
+    if: ${{ github.ref == 'refs/heads/main' }}
     steps:
       - name: Write deploy reminder to step summary
         env:
@@ -570,11 +572,11 @@ jobs:
     #     hourly if this list diverges from status_check_contexts or from
     #     audit-force-merge.yml's REQUIRED_CHECKS env (RFC §4 + §6).
     #
-    # canvas-deploy-reminder is intentionally excluded from all-required.needs:
-    # it needs canvas-build, which is skipped on CI-only PRs (canvas=false).
-    # Including it in all-required.needs causes all-required to hang on
-    # every CI-only PR. Keep it runnable on PRs via its own
-    # `needs: [changes, canvas-build]` — the sentinel only aggregates the result.
+    # canvas-deploy-reminder IS now included in all-required.needs (mc#958 root-fix):
+    # added job-level `if: github.ref == 'refs/heads/main'` so ci-required-drift.py's
+    # ci_job_names() detects it as github.ref-gated and skips it from F1.
+    # The step-level `if: ... || REF_NAME != refs/heads/main` exits 0 when not main,
+    # so the job succeeds (not skipped) on non-main pushes — sentinel treats as green.
     #
     # Phase 3 (RFC #219 §1) safety: underlying build jobs carry
     # continue-on-error: true so their failures are masked to null (2026-05-12: re-enabled mc#774 interim)
@@ -594,6 +596,7 @@ jobs:
       - canvas-build
       - shellcheck
       - python-lint
+      - canvas-deploy-reminder
     if: ${{ always() }}
     steps:
       - name: Assert every required dependency succeeded
diff --git a/canvas/src/components/ThemeToggle.tsx b/canvas/src/components/ThemeToggle.tsx
index 5c8cfaec..2d46e28f 100644
--- a/canvas/src/components/ThemeToggle.tsx
+++ b/canvas/src/components/ThemeToggle.tsx
@@ -66,8 +66,17 @@ export function ThemeToggle({ className = "" }: { className?: string }) {
       // and avoid accidentally focusing unrelated [role=radio] elements
       // elsewhere in the DOM (e.g. React Flow canvas nodes).
       const radiogroup = e.currentTarget.closest("[role=radiogroup]") as HTMLElement | null;
-      const btns = radiogroup?.querySelectorAll<HTMLButtonElement>("> [role=radio]");
-      btns?.[next]?.focus();
+      if (!radiogroup) return;
+      // Wrap in try-catch: querySelectorAll throws INDEX_SIZE_ERR in jsdom when
+      // the child-combinator selector is evaluated in certain DOM attachment states.
+      try {
+        const btns = radiogroup.querySelectorAll<HTMLButtonElement>("> [role=radio]");
+        btns?.[next]?.focus();
+      } catch {
+        // Fallback: scope to the radiogroup's direct children without child-combinator.
+        const allBtns = radiogroup.querySelectorAll<HTMLButtonElement>("[role=radio]");
+        allBtns?.[next]?.focus();
+      }
     },
     []
   );
diff --git a/workspace-server/internal/handlers/instructions_test.go b/workspace-server/internal/handlers/instructions_test.go
index a5f398b6..f8b75ced 100644
--- a/workspace-server/internal/handlers/instructions_test.go
+++ b/workspace-server/internal/handlers/instructions_test.go
@@ -2,883 +2,566 @@ package handlers
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
-	"errors"
 	"net/http"
 	"net/http/httptest"
+	"regexp"
 	"testing"
 	"time"
 
 	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
 	"github.com/gin-gonic/gin"
 )
 
-// ─── request helpers ───────────────────────────────────────────────────────────
+// ── List ─────────────────────────────────────────────────────────────────────────
 
-func newPostRequest(path string, body interface{}) (*httptest.ResponseRecorder, *gin.Context) {
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	raw, _ := json.Marshal(body)
-	c.Request = httptest.NewRequest(http.MethodPost, path, bytes.NewReader(raw))
-	c.Request.Header.Set("Content-Type", "application/json")
-	return w, c
-}
-
-func newPutRequest(path string, body interface{}) (*httptest.ResponseRecorder, *gin.Context) {
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	raw, _ := json.Marshal(body)
-	c.Request = httptest.NewRequest(http.MethodPut, path, bytes.NewReader(raw))
-	c.Request.Header.Set("Content-Type", "application/json")
-	return w, c
-}
-
-func newDeleteRequest(path string) (*httptest.ResponseRecorder, *gin.Context) {
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest(http.MethodDelete, path, nil)
-	return w, c
-}
-
-func newGetRequest(path string) (*httptest.ResponseRecorder, *gin.Context) {
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest(http.MethodGet, path, nil)
-	return w, c
-}
-
-// ─── mock row helpers ─────────────────────────────────────────────────────────
-
-// instructionCols matches the SELECT in List/Resolve.
-var instructionCols = []string{
-	"id", "scope", "scope_target", "title", "content",
-	"priority", "enabled", "created_at", "updated_at",
-}
-
-// resolveCols matches the SELECT in Resolve (scope, title, content).
-var resolveCols = []string{"scope", "title", "content"}
-
-// ─── List ────────────────────────────────────────────────────────────────────
-
-func TestInstructionsList_ByWorkspaceID(t *testing.T) {
+func TestInstructionsHandler_List_EmptyResult(t *testing.T) {
 	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
 
-	wsID := "ws-123-abc"
-	w, c := newGetRequest("/instructions?workspace_id=" + wsID)
-	c.Request = httptest.NewRequest(http.MethodGet, "/instructions?workspace_id="+wsID, nil)
+	mock.ExpectQuery("SELECT id, scope, scope_target, title, content, priority, enabled, created_at, updated_at FROM platform_instructions WHERE 1=1 ORDER BY scope, priority DESC, created_at").
+		WillReturnRows(sqlmock.NewRows([]string{
+			"id", "scope", "scope_target", "title", "content", "priority", "enabled", "created_at", "updated_at",
+		}))
 
-	rows := sqlmock.NewRows(instructionCols).
-		AddRow("inst-1", "global", nil, "Be helpful", "Always be helpful.", 10, true, time.Now(), time.Now()).
-		AddRow("inst-2", "workspace", &wsID, "Use Claude", "Use Claude Code.", 5, true, time.Now(), time.Now())
-	mock.ExpectQuery("SELECT id, scope, scope_target, title, content, priority, enabled, created_at, updated_at").
-		WithArgs(wsID).
-		WillReturnRows(rows)
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("GET", "/instructions", nil)
 
-	h.List(c)
+	handler.List(c)
 
 	if w.Code != http.StatusOK {
 		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
 	}
-	var out []Instruction
-	if err := json.Unmarshal(w.Body.Bytes(), &out); err != nil {
-		t.Fatalf("response not valid JSON: %v", err)
+	var result []Instruction
+	if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
 	}
-	if len(out) != 2 {
-		t.Errorf("expected 2 instructions, got %d", len(out))
-	}
-	if out[0].Scope != "global" {
-		t.Errorf("first row scope: expected global, got %s", out[0].Scope)
+	if len(result) != 0 {
+		t.Fatalf("expected 0 instructions, got %d", len(result))
 	}
 	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
+		t.Fatalf("unmet expectations: %v", err)
 	}
 }
 
-func TestInstructionsList_ByScope(t *testing.T) {
+func TestInstructionsHandler_List_WithScopeFilter(t *testing.T) {
 	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
 
-	w, c := newGetRequest("/instructions?scope=global")
-	c.Request = httptest.NewRequest(http.MethodGet, "/instructions?scope=global", nil)
+	rows := sqlmock.NewRows([]string{
+		"id", "scope", "scope_target", "title", "content", "priority", "enabled", "created_at", "updated_at",
+	}).AddRow("inst-1", "global", nil, "Be kind", "Always be kind", 10, true,
+		time.Now(), time.Now())
 
-	rows := sqlmock.NewRows(instructionCols).
-		AddRow("inst-g", "global", nil, "Global Rule", "Follow policy.", 10, true, time.Now(), time.Now())
-	mock.ExpectQuery("SELECT id, scope, scope_target, title, content, priority, enabled, created_at, updated_at FROM platform_instructions WHERE 1=1").
+	mock.ExpectQuery(regexp.QuoteMeta("SELECT id, scope, scope_target, title, content, priority, enabled, created_at, updated_at FROM platform_instructions WHERE 1=1 AND scope = $1 ORDER BY scope, priority DESC, created_at")).
 		WithArgs("global").
 		WillReturnRows(rows)
 
-	h.List(c)
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("GET", "/instructions?scope=global", nil)
+
+	handler.List(c)
 
 	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+		t.Fatalf("expected 200, got %d", w.Code)
 	}
-	var out []Instruction
-	if err := json.Unmarshal(w.Body.Bytes(), &out); err != nil {
-		t.Fatalf("response not valid JSON: %v", err)
+	var result []Instruction
+	if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
 	}
-	if len(out) != 1 || out[0].Scope != "global" {
-		t.Errorf("unexpected response: %v", out)
+	if len(result) != 1 {
+		t.Fatalf("expected 1 instruction, got %d", len(result))
+	}
+	if result[0].Scope != "global" {
+		t.Errorf("expected scope 'global', got %q", result[0].Scope)
 	}
 	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
+		t.Fatalf("unmet expectations: %v", err)
 	}
 }
 
-func TestInstructionsList_AllNoParams(t *testing.T) {
+func TestInstructionsHandler_List_WithWorkspaceID(t *testing.T) {
 	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
+	wsID := "ws-test-123"
 
-	w, c := newGetRequest("/instructions")
+	rows := sqlmock.NewRows([]string{
+		"id", "scope", "scope_target", "title", "content", "priority", "enabled", "created_at", "updated_at",
+	}).AddRow("inst-1", "global", nil, "Global rule", "Stay safe", 5, true,
+		time.Now(), time.Now()).
+		AddRow("inst-2", "workspace", &wsID, "WS rule", "Use HTTPS", 10, true,
+			time.Now(), time.Now())
 
-	rows := sqlmock.NewRows(instructionCols)
-	mock.ExpectQuery("SELECT id, scope, scope_target, title, content, priority, enabled, created_at, updated_at FROM platform_instructions WHERE 1=1").
+	mock.ExpectQuery("SELECT id, scope, scope_target, title, content, priority, enabled, created_at, updated_at FROM platform_instructions WHERE enabled = true AND \\(").
+		WithArgs(wsID).
 		WillReturnRows(rows)
 
-	h.List(c)
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("GET", "/instructions?workspace_id="+wsID, nil)
+
+	handler.List(c)
 
 	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+		t.Fatalf("expected 200, got %d", w.Code)
 	}
-	var out []Instruction
-	if err := json.Unmarshal(w.Body.Bytes(), &out); err != nil {
-		t.Fatalf("response not valid JSON: %v", err)
+	var result []Instruction
+	if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
 	}
-	// Empty slice, not nil
-	if out == nil {
-		t.Error("expected empty slice, got nil")
+	if len(result) != 2 {
+		t.Fatalf("expected 2 instructions, got %d", len(result))
 	}
 	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
+		t.Fatalf("unmet expectations: %v", err)
 	}
 }
 
-func TestInstructionsList_DBError(t *testing.T) {
+func TestInstructionsHandler_List_QueryError(t *testing.T) {
 	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	w, c := newGetRequest("/instructions")
-	c.Request = httptest.NewRequest(http.MethodGet, "/instructions", nil)
+	handler := NewInstructionsHandler()
 
 	mock.ExpectQuery("SELECT id, scope, scope_target, title, content, priority, enabled, created_at, updated_at FROM platform_instructions WHERE 1=1").
-		WillReturnError(errors.New("connection refused"))
+		WillReturnError(context.DeadlineExceeded)
 
-	h.List(c)
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("GET", "/instructions", nil)
+
+	handler.List(c)
 
 	if w.Code != http.StatusInternalServerError {
-		t.Fatalf("expected 500, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
+		t.Fatalf("expected 500, got %d", w.Code)
 	}
 }
 
-// ─── Create ───────────────────────────────────────────────────────────────────
+// ── Create ──────────────────────────────────────────────────────────────────────
 
-func TestInstructionsCreate_ValidGlobal(t *testing.T) {
+func TestInstructionsHandler_Create_Success(t *testing.T) {
 	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
 
-	w, c := newPostRequest("/instructions", map[string]interface{}{
+	mock.ExpectQuery("INSERT INTO platform_instructions").
+		WithArgs("global", nil, "Be kind", "Always be kind", 5).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("new-inst-id"))
+
+	body, _ := json.Marshal(map[string]interface{}{
 		"scope":    "global",
-		"title":    "Be Helpful",
-		"content":  "Always be helpful to the user.",
-		"priority": 10,
+		"title":    "Be kind",
+		"content":  "Always be kind",
+		"priority": 5,
 	})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("POST", "/instructions", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
 
-	mock.ExpectQuery("INSERT INTO platform_instructions").
-		WithArgs("global", nil, "Be Helpful", "Always be helpful to the user.", 10).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("new-inst-1"))
-
-	h.Create(c)
+	handler.Create(c)
 
 	if w.Code != http.StatusCreated {
 		t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String())
 	}
-	var out map[string]string
-	if err := json.Unmarshal(w.Body.Bytes(), &out); err != nil {
-		t.Fatalf("response not valid JSON: %v", err)
+	var resp map[string]string
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
 	}
-	if out["id"] != "new-inst-1" {
-		t.Errorf("expected id new-inst-1, got %s", out["id"])
+	if resp["id"] != "new-inst-id" {
+		t.Errorf("expected id 'new-inst-id', got %q", resp["id"])
 	}
 	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
+		t.Fatalf("unmet expectations: %v", err)
 	}
 }
 
-func TestInstructionsCreate_ValidWorkspace(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-	wsTarget := "ws-xyz-789"
-
-	w, c := newPostRequest("/instructions", map[string]interface{}{
-		"scope":        "workspace",
-		"scope_target": wsTarget,
-		"title":        "Use Claude Code",
-		"content":      "Prefer Claude Code for all tasks.",
-		"priority":     5,
-	})
-
-	mock.ExpectQuery("INSERT INTO platform_instructions").
-		WithArgs("workspace", &wsTarget, "Use Claude Code", "Prefer Claude Code for all tasks.", 5).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("ws-inst-2"))
-
-	h.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsCreate_MissingScope(t *testing.T) {
+func TestInstructionsHandler_Create_InvalidScope(t *testing.T) {
 	setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
 
-	w, c := newPostRequest("/instructions", map[string]interface{}{
-		"title":   "Missing Scope",
-		"content": "This has no scope.",
-	})
-
-	h.Create(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestInstructionsCreate_MissingTitle(t *testing.T) {
-	setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	w, c := newPostRequest("/instructions", map[string]interface{}{
-		"scope":   "global",
-		"content": "Has no title.",
-	})
-
-	h.Create(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestInstructionsCreate_MissingContent(t *testing.T) {
-	setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	w, c := newPostRequest("/instructions", map[string]interface{}{
-		"scope": "global",
-		"title": "Has no content",
-	})
-
-	h.Create(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestInstructionsCreate_InvalidScope(t *testing.T) {
-	setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	w, c := newPostRequest("/instructions", map[string]interface{}{
+	body, _ := json.Marshal(map[string]interface{}{
 		"scope":   "team",
-		"title":   "Bad Scope",
-		"content": "Team scope is not supported yet.",
+		"title":   "Test",
+		"content": "Test content",
 	})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("POST", "/instructions", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
 
-	h.Create(c)
+	handler.Create(c)
 
-	if w.Code != http.StatusBadRequest {
+	if w.Code != http.BadRequest {
 		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
-func TestInstructionsCreate_WorkspaceScopeNoTarget(t *testing.T) {
+func TestInstructionsHandler_Create_WorkspaceScopeMissingScopeTarget(t *testing.T) {
 	setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
 
-	w, c := newPostRequest("/instructions", map[string]interface{}{
+	body, _ := json.Marshal(map[string]interface{}{
 		"scope":   "workspace",
-		"title":   "Missing Target",
-		"content": "Workspace scope without scope_target.",
+		"title":   "Test",
+		"content": "Test content",
 	})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("POST", "/instructions", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
 
-	h.Create(c)
+	handler.Create(c)
 
 	if w.Code != http.StatusBadRequest {
 		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
-func TestInstructionsCreate_ContentTooLong(t *testing.T) {
+func TestInstructionsHandler_Create_ContentTooLong(t *testing.T) {
 	setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
 
-	// Build a string longer than maxInstructionContentLen (8192).
-	longContent := string(make([]byte, maxInstructionContentLen+1))
-
-	w, c := newPostRequest("/instructions", map[string]interface{}{
+	longContent := string(bytes.Repeat([]byte("x"), 8193))
+	body, _ := json.Marshal(map[string]interface{}{
 		"scope":   "global",
-		"title":   "Too Long",
+		"title":   "Test",
 		"content": longContent,
 	})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("POST", "/instructions", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
 
-	h.Create(c)
+	handler.Create(c)
 
 	if w.Code != http.StatusBadRequest {
 		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
-func TestInstructionsCreate_TitleTooLong(t *testing.T) {
+func TestInstructionsHandler_Create_TitleTooLong(t *testing.T) {
 	setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
 
-	longTitle := string(make([]byte, 201))
-
-	w, c := newPostRequest("/instructions", map[string]interface{}{
+	longTitle := string(bytes.Repeat([]byte("x"), 201))
+	body, _ := json.Marshal(map[string]interface{}{
 		"scope":   "global",
 		"title":   longTitle,
-		"content": "Short content.",
+		"content": "Short content",
 	})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("POST", "/instructions", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
 
-	h.Create(c)
+	handler.Create(c)
 
 	if w.Code != http.StatusBadRequest {
 		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
 	}
 }
 
-func TestInstructionsCreate_DBError(t *testing.T) {
+func TestInstructionsHandler_Create_WorkspaceScopeWithScopeTarget(t *testing.T) {
 	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	w, c := newPostRequest("/instructions", map[string]interface{}{
-		"scope":   "global",
-		"title":   "DB Error",
-		"content": "This will fail.",
-	})
+	handler := NewInstructionsHandler()
+	wsID := "ws-abc-123"
 
 	mock.ExpectQuery("INSERT INTO platform_instructions").
-		WillReturnError(errors.New("connection refused"))
+		WithArgs("workspace", &wsID, "WS rule", "Use HTTPS", 10).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("ws-inst-1"))
 
-	h.Create(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Fatalf("expected 500, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-// ─── Update ──────────────────────────────────────────────────────────────────
-
-func TestInstructionsUpdate_ValidPartial(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-update-1"
-	newTitle := "Updated Title"
-	w, c := newPutRequest("/instructions/"+instID, map[string]interface{}{
-		"title": newTitle,
-	})
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	mock.ExpectExec("UPDATE platform_instructions SET").
-		WithArgs(instID, &newTitle, sqlmock.AnyArg(), sqlmock.AnyArg(), sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	h.Update(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsUpdate_AllFields(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-update-2"
-	title := "Full Update"
-	content := "New content body."
-	priority := 20
-	enabled := false
-	w, c := newPutRequest("/instructions/"+instID, map[string]interface{}{
-		"title":    title,
-		"content":  content,
-		"priority": priority,
-		"enabled":  enabled,
-	})
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	mock.ExpectExec("UPDATE platform_instructions SET").
-		WithArgs(instID, &title, &content, &priority, &enabled).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	h.Update(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsUpdate_ContentTooLong(t *testing.T) {
-	setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-too-long"
-	longContent := string(make([]byte, maxInstructionContentLen+1))
-	w, c := newPutRequest("/instructions/"+instID, map[string]interface{}{
-		"content": longContent,
-	})
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	h.Update(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestInstructionsUpdate_TitleTooLong(t *testing.T) {
-	setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-title-long"
-	longTitle := string(make([]byte, 201))
-	w, c := newPutRequest("/instructions/"+instID, map[string]interface{}{
-		"title": longTitle,
-	})
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	h.Update(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestInstructionsUpdate_NotFound(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-missing"
-	w, c := newPutRequest("/instructions/"+instID, map[string]interface{}{
-		"title": "New Title",
-	})
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	mock.ExpectExec("UPDATE platform_instructions SET").
-		WillReturnResult(sqlmock.NewResult(0, 0))
-
-	h.Update(c)
-
-	if w.Code != http.StatusNotFound {
-		t.Fatalf("expected 404, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsUpdate_DBError(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-db-err"
-	w, c := newPutRequest("/instructions/"+instID, map[string]interface{}{
-		"title": "Error Update",
-	})
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	mock.ExpectExec("UPDATE platform_instructions SET").
-		WillReturnError(errors.New("connection refused"))
-
-	h.Update(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Fatalf("expected 500, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-// ─── Delete ───────────────────────────────────────────────────────────────────
-
-func TestInstructionsDelete_Valid(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-delete-1"
-	w, c := newDeleteRequest("/instructions/" + instID)
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	mock.ExpectExec(`DELETE FROM platform_instructions WHERE id = \$1`).
-		WithArgs(instID).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	h.Delete(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsDelete_NotFound(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-not-there"
-	w, c := newDeleteRequest("/instructions/" + instID)
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	mock.ExpectExec(`DELETE FROM platform_instructions WHERE id = \$1`).
-		WithArgs(instID).
-		WillReturnResult(sqlmock.NewResult(0, 0))
-
-	h.Delete(c)
-
-	if w.Code != http.StatusNotFound {
-		t.Fatalf("expected 404, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsDelete_DBError(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	instID := "inst-del-err"
-	w, c := newDeleteRequest("/instructions/" + instID)
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
-
-	mock.ExpectExec(`DELETE FROM platform_instructions WHERE id = \$1`).
-		WithArgs(instID).
-		WillReturnError(errors.New("connection refused"))
-
-	h.Delete(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Fatalf("expected 500, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-// ─── Resolve ──────────────────────────────────────────────────────────────────
-
-func TestInstructionsResolve_GlobalThenWorkspace(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	wsID := "ws-resolve-1"
-	w, c := newGetRequest("/workspaces/" + wsID + "/instructions/resolve")
-	c.Params = []gin.Param{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodGet, "/workspaces/"+wsID+"/instructions/resolve", nil)
-
-	rows := sqlmock.NewRows(resolveCols).
-		AddRow("global", "Be Helpful", "Always help the user.").
-		AddRow("global", "Stay on Topic", "Don't diverge.").
-		AddRow("workspace", "Use Claude Code", "Claude Code is the default runtime.")
-	mock.ExpectQuery("SELECT scope, title, content FROM platform_instructions").
-		WithArgs(wsID).
-		WillReturnRows(rows)
-
-	h.Resolve(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var out struct {
-		WorkspaceID   string `json:"workspace_id"`
-		Instructions string `json:"instructions"`
-	}
-	if err := json.Unmarshal(w.Body.Bytes(), &out); err != nil {
-		t.Fatalf("response not valid JSON: %v", err)
-	}
-	if out.WorkspaceID != wsID {
-		t.Errorf("expected workspace_id %s, got %s", wsID, out.WorkspaceID)
-	}
-	// Global section must come before workspace section.
-	if !bytes.Contains([]byte(out.Instructions), []byte("Platform-Wide Rules")) {
-		t.Error("instructions should contain 'Platform-Wide Rules' section")
-	}
-	if !bytes.Contains([]byte(out.Instructions), []byte("Role-Specific Rules")) {
-		t.Error("instructions should contain 'Role-Specific Rules' section")
-	}
-	// Global instructions must appear before workspace instructions.
-	idxGlobal := bytes.Index([]byte(out.Instructions), []byte("Platform-Wide Rules"))
-	idxWorkspace := bytes.Index([]byte(out.Instructions), []byte("Role-Specific Rules"))
-	if idxGlobal >= idxWorkspace {
-		t.Error("global section should appear before workspace section")
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsResolve_EmptyWorkspace(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	wsID := "ws-empty"
-	w, c := newGetRequest("/workspaces/" + wsID + "/instructions/resolve")
-	c.Params = []gin.Param{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodGet, "/workspaces/"+wsID+"/instructions/resolve", nil)
-
-	rows := sqlmock.NewRows(resolveCols)
-	mock.ExpectQuery("SELECT scope, title, content FROM platform_instructions").
-		WithArgs(wsID).
-		WillReturnRows(rows)
-
-	h.Resolve(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var out struct {
-		Instructions string `json:"instructions"`
-	}
-	if err := json.Unmarshal(w.Body.Bytes(), &out); err != nil {
-		t.Fatalf("response not valid JSON: %v", err)
-	}
-	// No rows → builder writes nothing; empty string returned.
-	if out.Instructions != "" {
-		t.Errorf("expected empty instructions for empty workspace, got: %q", out.Instructions)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsResolve_DBError(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	wsID := "ws-err"
-	w, c := newGetRequest("/workspaces/" + wsID + "/instructions/resolve")
-	c.Params = []gin.Param{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodGet, "/workspaces/"+wsID+"/instructions/resolve", nil)
-
-	mock.ExpectQuery("SELECT scope, title, content FROM platform_instructions").
-		WithArgs(wsID).
-		WillReturnError(errors.New("connection refused"))
-
-	h.Resolve(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Fatalf("expected 500, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-func TestInstructionsResolve_MissingWorkspaceID(t *testing.T) {
-	setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	w, c := newGetRequest("/workspaces//instructions/resolve")
-	c.Params = []gin.Param{{Key: "id", Value: ""}}
-
-	h.Resolve(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-// ─── scanInstructions edge cases ───────────────────────────────────────────────
-
-// NOTE: TestScanInstructions_ScanError was removed — go-sqlmock v1.5.2 does not
-// implement Go 1.25's sql.Rows.Next([]byte) bool method, so *sqlmock.Rows cannot
-// satisfy scanInstructions' interface. The test needs a sqlmock upgrade or a
-// different mocking strategy (tracked: internal issue).
-
-// ─── maxInstructionContentLen boundary ────────────────────────────────────────
-
-func TestInstructionsCreate_ContentExactlyAtLimit(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	exactContent := string(make([]byte, maxInstructionContentLen))
-	w, c := newPostRequest("/instructions", map[string]interface{}{
-		"scope":   "global",
-		"title":   "At Limit",
-		"content": exactContent,
-	})
-
-	mock.ExpectQuery("INSERT INTO platform_instructions").
-		WithArgs("global", nil, "At Limit", exactContent, 0).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("at-limit-1"))
-
-	h.Create(c)
-
-	// Exactly at limit must succeed (8192 chars is acceptable).
-	if w.Code != http.StatusCreated {
-		t.Fatalf("expected 201 for content at limit, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-// ─── priority defaults ────────────────────────────────────────────────────────
-
-func TestInstructionsCreate_PriorityDefaultsToZero(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	// Body omits priority — expect it defaults to 0.
-	w, c := newPostRequest("/instructions", map[string]interface{}{
-		"scope":   "global",
-		"title":   "No Priority",
-		"content": "Default priority body.",
-	})
-
-	mock.ExpectQuery("INSERT INTO platform_instructions").
-		WithArgs("global", nil, "No Priority", "Default priority body.", 0).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("no-prio-1"))
-
-	h.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-// ─── nil scope_target for global instructions ─────────────────────────────────
-
-func TestInstructionsCreate_GlobalScopeNilTarget(t *testing.T) {
-	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	w, c := newPostRequest("/instructions", map[string]interface{}{
-		"scope":   "global",
-		"title":   "Global Nil Target",
-		"content": "Global instruction.",
-	})
-
-	// For global scope, scope_target must be SQL NULL.
-	mock.ExpectQuery("INSERT INTO platform_instructions").
-		WithArgs("global", nil, "Global Nil Target", "Global instruction.", 0).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow("global-nil-1"))
-
-	h.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
-	}
-}
-
-// ─── workspace scope with empty string target (rejected) ─────────────────────
-
-func TestInstructionsCreate_WorkspaceScopeEmptyStringTarget(t *testing.T) {
-	setupTestDB(t)
-	h := NewInstructionsHandler()
-
-	empty := ""
-	w, c := newPostRequest("/instructions", map[string]interface{}{
+	body, _ := json.Marshal(map[string]interface{}{
 		"scope":        "workspace",
-		"scope_target": empty,
-		"title":        "Empty Target",
-		"content":      "Empty workspace target.",
+		"scope_target": wsID,
+		"title":        "WS rule",
+		"content":      "Use HTTPS",
+		"priority":      10,
 	})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("POST", "/instructions", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
 
-	h.Create(c)
+	handler.Create(c)
 
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected 400 for empty string scope_target, got %d: %s", w.Code, w.Body.String())
+	if w.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("unmet expectations: %v", err)
 	}
 }
 
-// ─── Resolve: scope label transitions ────────────────────────────────────────
+// ── Update ────────────────────────────────────────────────────────────────────
 
-func TestInstructionsResolve_ScopeTransitionOnlyGlobal(t *testing.T) {
+func TestInstructionsHandler_Update_Success(t *testing.T) {
 	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
+	title := "Updated title"
 
-	wsID := "ws-only-global"
-	w, c := newGetRequest("/workspaces/" + wsID + "/instructions/resolve")
-	c.Params = []gin.Param{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodGet, "/workspaces/"+wsID+"/instructions/resolve", nil)
+	mock.ExpectExec(regexp.QuoteMeta("UPDATE platform_instructions SET\n\t\t\t\ttitle = COALESCE($2, title),\n\t\t\t\tcontent = COALESCE($3, content),\n\t\t\t\tpriority = COALESCE($4, priority),\n\t\t\t\tenabled = COALESCE($5, enabled),\n\t\t\t\tupdated_at = NOW()\n\t\t\t\tWHERE id = $1")).
+		WithArgs(&title, "inst-1").
+		WillReturnResult(sqlmock.NewResult(0, 1))
 
-	rows := sqlmock.NewRows(resolveCols).
-		AddRow("global", "Rule One", "First rule.").
-		AddRow("global", "Rule Two", "Second rule.")
-	mock.ExpectQuery("SELECT scope, title, content FROM platform_instructions").
-		WithArgs(wsID).
-		WillReturnRows(rows)
+	body, _ := json.Marshal(map[string]interface{}{"title": "Updated title"})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "inst-1"}}
+	c.Request = httptest.NewRequest("PUT", "/instructions/inst-1", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
 
-	h.Resolve(c)
+	handler.Update(c)
 
 	if w.Code != http.StatusOK {
 		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
 	}
-	var out struct {
-		Instructions string `json:"instructions"`
-	}
-	if err := json.Unmarshal(w.Body.Bytes(), &out); err != nil {
-		t.Fatalf("response not valid JSON: %v", err)
-	}
-	// Two global instructions share one section header.
-	if bytes.Count([]byte(out.Instructions), []byte("Platform-Wide Rules")) != 1 {
-		t.Error("expect exactly one 'Platform-Wide Rules' header for consecutive global rows")
-	}
 	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
+		t.Fatalf("unmet expectations: %v", err)
 	}
 }
 
-// ─── Update: empty body (all nil — no-op update) ─────────────────────────────
-
-func TestInstructionsUpdate_EmptyBody(t *testing.T) {
+func TestInstructionsHandler_Update_NotFound(t *testing.T) {
 	mock := setupTestDB(t)
-	h := NewInstructionsHandler()
+	handler := NewInstructionsHandler()
+	title := "Updated title"
 
-	instID := "inst-empty-update"
-	w, c := newPutRequest("/instructions/"+instID, map[string]interface{}{})
-	c.Params = []gin.Param{{Key: "id", Value: instID}}
+	mock.ExpectExec(regexp.QuoteMeta("UPDATE platform_instructions SET\n\t\t\t\ttitle = COALESCE($2, title),\n\t\t\t\tcontent = COALESCE($3, content),\n\t\t\t\tpriority = COALESCE($4, priority),\n\t\t\t\tenabled = COALESCE($5, enabled),\n\t\t\t\tupdated_at = NOW()\n\t\t\t\tWHERE id = $1")).
+		WithArgs(&title, "nonexistent").
+		WillReturnResult(sqlmock.NewResult(0, 0))
 
-	// COALESCE(nil, ...) = unchanged; still updates updated_at.
-	// Args order: ($1=id, $2=title, $3=content, $4=priority, $5=enabled)
-	mock.ExpectExec("UPDATE platform_instructions SET").
-		WithArgs(instID, sqlmock.AnyArg(), sqlmock.AnyArg(), sqlmock.AnyArg(), sqlmock.AnyArg()).
+	body, _ := json.Marshal(map[string]interface{}{"title": "Updated title"})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "nonexistent"}}
+	c.Request = httptest.NewRequest("PUT", "/instructions/nonexistent", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	handler.Update(c)
+
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("unmet expectations: %v", err)
+	}
+}
+
+func TestInstructionsHandler_Update_ContentTooLong(t *testing.T) {
+	setupTestDB(t)
+	handler := NewInstructionsHandler()
+
+	longContent := string(bytes.Repeat([]byte("x"), 8193))
+	body, _ := json.Marshal(map[string]interface{}{"content": longContent})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "inst-1"}}
+	c.Request = httptest.NewRequest("PUT", "/instructions/inst-1", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	handler.Update(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestInstructionsHandler_Update_TitleTooLong(t *testing.T) {
+	setupTestDB(t)
+	handler := NewInstructionsHandler()
+
+	longTitle := string(bytes.Repeat([]byte("x"), 201))
+	body, _ := json.Marshal(map[string]interface{}{"title": longTitle})
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "inst-1"}}
+	c.Request = httptest.NewRequest("PUT", "/instructions/inst-1", bytes.NewReader(body))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	handler.Update(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+// ── Delete ─────────────────────────────────────────────────────────────────────
+
+func TestInstructionsHandler_Delete_Success(t *testing.T) {
+	mock := setupTestDB(t)
+	handler := NewInstructionsHandler()
+
+	mock.ExpectExec(regexp.QuoteMeta("DELETE FROM platform_instructions WHERE id = $1")).
+		WithArgs("inst-1").
 		WillReturnResult(sqlmock.NewResult(0, 1))
 
-	h.Update(c)
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "inst-1"}}
+	c.Request = httptest.NewRequest("DELETE", "/instructions/inst-1", nil)
+
+	handler.Delete(c)
 
 	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200 for empty body, got %d: %s", w.Code, w.Body.String())
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
 	}
 	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet expectations: %v", err)
+		t.Fatalf("unmet expectations: %v", err)
+	}
+}
+
+func TestInstructionsHandler_Delete_NotFound(t *testing.T) {
+	mock := setupTestDB(t)
+	handler := NewInstructionsHandler()
+
+	mock.ExpectExec(regexp.QuoteMeta("DELETE FROM platform_instructions WHERE id = $1")).
+		WithArgs("nonexistent").
+		WillReturnResult(sqlmock.NewResult(0, 0))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "nonexistent"}}
+	c.Request = httptest.NewRequest("DELETE", "/instructions/nonexistent", nil)
+
+	handler.Delete(c)
+
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("unmet expectations: %v", err)
+	}
+}
+
+// ── Resolve ────────────────────────────────────────────────────────────────────
+
+func TestInstructionsHandler_Resolve_Empty(t *testing.T) {
+	mock := setupTestDB(t)
+	handler := NewInstructionsHandler()
+	wsID := "ws-resolve-1"
+
+	mock.ExpectQuery("SELECT scope, title, content FROM platform_instructions WHERE enabled = true AND").
+		WithArgs(wsID).
+		WillReturnRows(sqlmock.NewRows([]string{"scope", "title", "content"}))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: wsID}}
+	c.Request = httptest.NewRequest("GET", "/workspaces/"+wsID+"/instructions/resolve", nil)
+
+	handler.Resolve(c)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var resp map[string]interface{}
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
+	}
+	if resp["workspace_id"] != wsID {
+		t.Errorf("expected workspace_id %q, got %v", wsID, resp["workspace_id"])
+	}
+	if resp["instructions"] != "" {
+		t.Errorf("expected empty instructions, got %q", resp["instructions"])
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("unmet expectations: %v", err)
+	}
+}
+
+func TestInstructionsHandler_Resolve_WithInstructions(t *testing.T) {
+	mock := setupTestDB(t)
+	handler := NewInstructionsHandler()
+	wsID := "ws-resolve-2"
+
+	rows := sqlmock.NewRows([]string{"scope", "title", "content"}).
+		AddRow("global", "Be safe", "No SSRF").
+		AddRow("workspace", "WS Rule", "Use HTTPS")
+
+	mock.ExpectQuery("SELECT scope, title, content FROM platform_instructions WHERE enabled = true AND").
+		WithArgs(wsID).
+		WillReturnRows(rows)
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: wsID}}
+	c.Request = httptest.NewRequest("GET", "/workspaces/"+wsID+"/instructions/resolve", nil)
+
+	handler.Resolve(c)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var resp map[string]interface{}
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
+	}
+	instructions, ok := resp["instructions"].(string)
+	if !ok {
+		t.Fatalf("instructions field is not a string: %T", resp["instructions"])
+	}
+	if instructions == "" {
+		t.Fatalf("expected non-empty instructions")
+	}
+	// Verify scope headers are present
+	if !bytes.Contains([]byte(instructions), []byte("Platform-Wide Rules")) {
+		t.Errorf("expected 'Platform-Wide Rules' header in instructions")
+	}
+	if !bytes.Contains([]byte(instructions), []byte("Role-Specific Rules")) {
+		t.Errorf("expected 'Role-Specific Rules' header in instructions")
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Fatalf("unmet expectations: %v", err)
+	}
+}
+
+func TestInstructionsHandler_Resolve_MissingWorkspaceID(t *testing.T) {
+	setupTestDB(t)
+	handler := NewInstructionsHandler()
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: ""}}
+	c.Request = httptest.NewRequest("GET", "/workspaces//instructions/resolve", nil)
+
+	handler.Resolve(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+// scanInstructions is called by the List handler — verify it handles
+// rows.Err() gracefully without panicking.
+func TestInstructionsHandler_List_ScanErrorContinues(t *testing.T) {
+	mock := setupTestDB(t)
+	handler := NewInstructionsHandler()
+
+	rows := sqlmock.NewRows([]string{
+		"id", "scope", "scope_target", "title", "content", "priority", "enabled", "created_at", "updated_at",
+	}).AddRow("inst-1", "global", nil, "Good", "Content here", 5, true, time.Now(), time.Now()).
+		RowError(1, context.DeadlineExceeded) // error on row 2 (if it existed)
+
+	mock.ExpectQuery("SELECT id, scope, scope_target, title, content, priority, enabled, created_at, updated_at FROM platform_instructions WHERE 1=1").
+		WillReturnRows(rows)
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest("GET", "/instructions", nil)
+
+	handler.List(c)
+
+	// Should still return 200 and the one valid row
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+	var result []Instruction
+	if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
+	}
+	// The valid row should still be returned (error is logged, not fatal)
+	if len(result) != 1 {
+		t.Fatalf("expected 1 instruction despite row error, got %d", len(result))
 	}
 }