fix(github-token): add HTTP client timeout to prevent indefinite blocking

http.DefaultClient has no timeout, so a slow/unresponsive GitHub API could block the handler goroutine forever. Use an http.Client with a 30-second timeout in generateAppInstallationToken. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(migrations): renumber workspace_compute to avoid collision with main
2026-05-23 05:08:29 +00:00 · 2026-05-23 04:53:14 +00:00 · 2026-05-23 04:11:01 +00:00 · 2026-05-23 04:04:18 +00:00 · 2026-05-23 01:05:10 +00:00 · 2026-05-23 00:33:15 +00:00
92 changed files with 893 additions and 5411 deletions
@@ -128,7 +128,6 @@ fi
 PR_AUTHOR=$(jq -r '.user.login // ""' "$PR_JSON")
 PR_HEAD_SHA=$(jq -r '.head.sha // ""' "$PR_JSON")
 PR_BASE_REF=$(jq -r '.base.ref // ""' "$PR_JSON")
-PR_BASE_SHA=$(jq -r '.base.sha // ""' "$PR_JSON")
 PR_STATE=$(jq -r '.state // ""' "$PR_JSON")
 DEFAULT_BRANCH="${DEFAULT_BRANCH:-main}"
 debug "pr_author=${PR_AUTHOR} pr_head=${PR_HEAD_SHA:0:7} pr_base=${PR_BASE_REF} pr_state=${PR_STATE}"
@@ -137,10 +136,6 @@ if [ "$PR_STATE" != "open" ]; then
  echo "::notice::PR ${PR_NUMBER} is ${PR_STATE} — exiting 0 (closed PRs do not gate)"
  exit 0
 fi
-if [ "$PR_HEAD_SHA" = "$PR_BASE_SHA" ]; then
-  echo "::notice::PR ${PR_NUMBER} has no diff (head == base) — exiting 0 (empty PRs do not gate)"
-  exit 0
-fi
 if [ "$PR_BASE_REF" != "$DEFAULT_BRANCH" ]; then
  echo "::notice::PR ${PR_NUMBER} targets ${PR_BASE_REF:-<unknown>} not ${DEFAULT_BRANCH} — ${TEAM}-review gate not applicable"
  exit 0
@@ -1,187 +0,0 @@
-# ci-arm64-advisory — Mac arm64 self-hosted ADVISORY fast-check lane.
-#
-# === WHY ===
-#
-# The amd64 Gitea runner pool (molecule-runner-1..20) is queue-contended
-# (internal#418). This lane offloads the *genuinely container-independent*
-# fast checks (Go build/vet/lint, shellcheck, Python lint) onto the Mac
-# arm64 self-hosted runner so developers get a fast arm64 signal WITHOUT
-# adding load to the starved amd64 pool — capability-honestly, as an
-# additive pilot. Pilot ② of the Mac-CI strategy (CTO-delegated 2026-05-17).
-#
-# === NON-NEGOTIABLE SAFETY CONTRACT (the prime directive) ===
-#
-# This lane is **ADVISORY ONLY**. It is provably incapable of hanging a
-# merge. Concretely:
-#
-#   1. It is a SEPARATE workflow file. `ci.yml` is byte-for-byte
-#      untouched by this PR. The `CI / all-required` aggregator sentinel
-#      and the five contexts it polls
-#      (`CI / Detect changes|Platform (Go)|Canvas (Next.js)|
-#      Shellcheck (E2E scripts)|Python Lint & Test (pull_request)`)
-#      are unchanged. The canonical required gate stays 100% on the
-#      existing amd64 pool.
-#
-#   2. The context this workflow emits is
-#      `ci-arm64-advisory / fast-checks (pull_request)`. That string is
-#      DELIBERATELY NOT present in, and this PR does NOT add it to:
-#        - branch_protections/{main,staging}.status_check_contexts
-#          (DB-verified pb 86/75 = exactly
-#           ["CI / all-required (pull_request)",
-#            "sop-checklist / all-items-acked (pull_request)"])
-#        - audit-force-merge.yml REQUIRED_CHECKS env
-#        - ci.yml `all-required` sentinel's hardcoded `required[]` list
-#      Branch protection therefore never waits on this context. If the
-#      Mac runner is absent / offline / removed, this workflow's status
-#      simply never appears — and because nothing requires it, every
-#      merge proceeds exactly as it does today. There is no path by
-#      which a missing/red arm64 status blocks a merge.
-#
-#   3. `continue-on-error: true` on the job — even a genuine arm64-only
-#      failure (toolchain drift, arch-specific test flake) is surfaced
-#      as information, never as a merge blocker, for the duration of
-#      the pilot.
-#
-#   4. The job carries a `github.event_name` `if:` gate. Beyond its
-#      functional purpose this also keeps the job OUT of
-#      `ci-required-drift.py:ci_job_names()` (which excludes
-#      `github.event_name`/`github.ref`-gated jobs), so the hourly
-#      ci-required-drift sentinel's F1 ("job not under sentinel needs")
-#      cannot ever flag this advisory job. F2/F3 are untouched because
-#      this context is absent from BP and from REQUIRED_CHECKS.
-#      `lint-bp-context-emit-match` only fails on BP→emitter gaps; an
-#      emitter without a BP context is explicitly informational there.
-#
-# === RUNNER TARGETING ===
-#
-# The Mac runner is `hongming-pc-runner-1`. The bare `self-hosted`
-# label is POLLUTED in this Gitea instance: molecule-runner-1..20
-# (the contended amd64 pool) also advertise `self-hosted`. Targeting
-# bare `self-hosted` would route back onto the very pool we are trying
-# to relieve — and onto amd64 hardware. We therefore require an
-# AND-set of labels that ONLY the Mac satisfies. `macos-self-hosted`
-# is Mac-exclusive (the amd64 pool does not carry it). Until the
-# label-install burst (a10862b2) lands `self-hosted`+`macos-self-hosted`
-# on the Mac, the runner's current unique label `hongming-pc-laptop`
-# is also listed; AND-semantics over the labels a runner advertises
-# means a job requiring [self-hosted, macos-self-hosted] can ONLY be
-# claimed once the Mac advertises both. If neither label set is yet
-# present on the Mac, the workflow stays queued harmlessly and is
-# garbage-collected by the normal stale-run reaper — it blocks nothing
-# (see safety contract point 2).
-#
-# === ROLLBACK ===
-#
-# Delete this single file (`git rm .gitea/workflows/ci-arm64-advisory.yml`)
-# and merge. No branch-protection edit, no ci.yml edit, no
-# REQUIRED_CHECKS edit is required to roll back, because none were made
-# to roll forward. Zero blast radius either direction.
-
-name: ci-arm64-advisory
-
-on:
-  push:
-    branches: [main, staging]
-  pull_request:
-    branches: [main, staging]
-
-# Per-ref cancel: a newer commit on the same ref supersedes the older
-# advisory run. Distinct from ci.yml's `ci-${ref}` group so this lane
-# never cancels (or is cancelled by) the canonical required CI.
-concurrency:
-  group: ci-arm64-advisory-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  GITHUB_SERVER_URL: https://git.moleculesai.app
-
-jobs:
-  fast-checks:
-    name: fast-checks
-    # AND-set: only the Mac arm64 runner advertises macos-self-hosted.
-    # See "RUNNER TARGETING" header note for why bare self-hosted is unsafe.
-    runs-on: [self-hosted, macos-self-hosted]
-    # ADVISORY: never blocks. See safety contract point 3. mc#774
-    # internal#418 — tracked: arm64 advisory pilot, non-gating by design.
-    continue-on-error: true
-    # event_name gate: functional (only meaningful on push/PR) AND keeps
-    # this job out of ci-required-drift.py:ci_job_names() so F1 can never
-    # flag it. See safety contract point 4.
-    if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
-    timeout-minutes: 20
-    steps:
-      - name: Provenance — advisory lane, non-gating
-        run: |
-          echo "This is the arm64 ADVISORY fast-check lane."
-          echo "It does NOT gate merges. Canonical required CI is ci.yml"
-          echo "on the amd64 pool. Arch: $(uname -m) on $(uname -s)."
-
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      # ---- Go: build + vet + lint (container-independent: needs only the
-      # Go toolchain; no amd64 ECR image, no docker-in-job). Race-detector
-      # unit-test + coverage gates are deliberately NOT duplicated here —
-      # those stay authoritative on amd64 ci.yml `Platform (Go)`. This lane
-      # is fast-feedback for the compile/vet/lint surface only. ----
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
-        with:
-          go-version: 'stable'
-      - name: Go build + vet (workspace-server)
-        working-directory: workspace-server
-        run: |
-          go mod download
-          go build ./cmd/server
-          go vet ./...
-      - name: golangci-lint (workspace-server)
-        working-directory: workspace-server
-        run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
-          "$(go env GOPATH)/bin/golangci-lint" run --timeout 3m ./...
-
-      # ---- Shellcheck (container-independent: shellcheck binary only).
-      # Mirrors ci.yml `Shellcheck (E2E scripts)` bulk pass scope. ----
-      - name: Install shellcheck (arm64)
-        run: |
-          if ! command -v shellcheck >/dev/null 2>&1; then
-            echo "shellcheck not preinstalled on this self-hosted runner."
-            echo "Attempting Homebrew install (Mac arm64)."
-            brew install shellcheck || {
-              echo "::warning::shellcheck unavailable on runner; advisory shellcheck skipped."
-              exit 0
-            }
-          fi
-          shellcheck --version
-      - name: Shellcheck tests/e2e + infra/scripts
-        run: |
-          command -v shellcheck >/dev/null 2>&1 || { echo "skip"; exit 0; }
-          find tests/e2e infra/scripts -type f -name '*.sh' -print0 \
-            | xargs -0 shellcheck --severity=warning
-
-      # ---- Python lint/compile (container-independent: CPython only).
-      # Lint + import-compile surface; the authoritative pytest + coverage
-      # floors stay on amd64 ci.yml `Python Lint & Test`. ----
-      - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: '3.11'
-      - name: Python byte-compile (workspace)
-        working-directory: workspace
-        run: |
-          python -m pip install --quiet ruff || true
-          python -m compileall -q .
-          if command -v ruff >/dev/null 2>&1; then
-            ruff check . || echo "::warning::ruff findings (advisory only)"
-          fi
-
-      - name: Advisory summary
-        if: always()
-        run: |
-          {
-            echo "## arm64 advisory fast-checks complete"
-            echo ""
-            echo "This lane is **advisory** — it does not gate merges."
-            echo "Authoritative required CI remains \`CI / all-required\`"
-            echo "on the amd64 pool (\`ci.yml\`, unchanged by this PR)."
-          } >> "$GITHUB_STEP_SUMMARY"
@@ -25,7 +25,7 @@ permissions:
 jobs:
  shellcheck-arm64:
    name: shellcheck-arm64 (pilot)
-    runs-on: [self-hosted, arm64-darwin]
+    runs-on: [self-hosted, arm64]
    # NOT a required check; safe to sit pending until Mac runner is up.
    # If the Mac runner has trouble pulling actions/checkout we fall
    # back to a plain git clone (see step 'fallback clone').
@@ -52,7 +52,6 @@ jobs:
          fetch-depth: 1

      - name: Install shellcheck (arm64)
-        continue-on-error: true
        run: |
          set -eu
          if command -v shellcheck >/dev/null 2>&1; then
@@ -72,16 +71,11 @@ jobs:
          shellcheck --version | head -2

      - name: Run shellcheck on .gitea/scripts/*.sh
-        continue-on-error: true
        run: |
          set -eu
          # Only the scripts we control under .gitea/scripts. Pilot
          # scope is intentionally narrow — broaden in a follow-up
          # once the lane is proven.
-          if ! command -v shellcheck >/dev/null 2>&1; then
-            echo "WARN: shellcheck binary not found — skipping (pilot mode)"
-            exit 0
-          fi
          mapfile -t TARGETS < <(find .gitea/scripts -maxdepth 2 -type f -name '*.sh' | sort)
          if [ "${#TARGETS[@]}" -eq 0 ]; then
            echo "No .sh files found under .gitea/scripts — nothing to check"
@@ -73,17 +73,6 @@ jobs:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      # Keep Docker auth/buildx state inside the job temp dir. Publish
-      # runners can inherit a HOME/DOCKER_CONFIG path that is host-owned
-      # and not writable from the job container; docker login otherwise
-      # fails before the image build starts.
-      - name: Prepare writable Docker config
-        run: |
-          set -euo pipefail
-          export DOCKER_CONFIG="$RUNNER_TEMP/docker-config"
-          mkdir -p "$DOCKER_CONFIG/buildx/certs"
-          echo "DOCKER_CONFIG=$DOCKER_CONFIG" >> "$GITHUB_ENV"
-
      - name: Log in to ECR
        env:
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
@@ -4,7 +4,7 @@
 # use this Makefile; CI calls docker compose / go test directly so the
 # Makefile can evolve without breaking the build.

-.PHONY: help dev up down logs build test e2e-peer-visibility openapi-spec openapi-spec-check
+.PHONY: help dev up down logs build test e2e-peer-visibility

 help: ## Show this help.
 	@grep -E '^[a-zA-Z0-9_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-22s\033[0m %s\n", $$1, $$2}'
@@ -36,23 +36,3 @@ test: ## Run Go unit tests in workspace-server/.
 # env contract (CLAUDE_CODE_OAUTH_TOKEN / E2E_MINIMAX_API_KEY / etc).
 e2e-peer-visibility: ## Run the LOCAL peer-visibility MCP gate vs the running stack (needs `make up` first).
 	bash tests/e2e/test_peer_visibility_mcp_local.sh
-
-# ─── OpenAPI spec generation (RFC #1706, Phase 1) ─────────────────────
-# Regenerate workspace-server/docs/openapi/swagger.{yaml,json} from
-# swaggo annotations on the gin handlers. Commit the output. CI runs
-# `make openapi-spec-check` to assert no drift between annotations and
-# the committed file — if a PR changes a handler but forgets to
-# regenerate, CI fails with a diff.
-openapi-spec: ## Regenerate OpenAPI spec from workspace-server handler annotations.
-	@command -v swag >/dev/null 2>&1 || go install github.com/swaggo/swag/cmd/swag@v1.16.4
-	cd workspace-server && swag init \
-	  --generalInfo cmd/server/main.go \
-	  --output docs/openapi \
-	  --outputTypes yaml,json \
-	  --dir . \
-	  --parseDependency=false \
-	  --parseInternal=true
-
-openapi-spec-check: openapi-spec ## CI gate — fail if openapi-spec produces a diff vs the committed file.
-	@git diff --exit-code -- workspace-server/docs/openapi/ \
-	  || (echo "openapi-spec is stale — run 'make openapi-spec' and commit the result" && exit 1)
@@ -33,8 +33,6 @@ interface HermesProvider {
  models: string[];
 }

-const DEFAULT_CREATE_MODEL = "anthropic:claude-opus-4-7";
-
 // All providers supported by Hermes runtime via providers.resolve_provider().
 // `defaultModel` is the slug injected into the workspace provision request
 // when the user picks this provider — template-hermes's derive-provider.sh
@@ -70,10 +68,6 @@ export function CreateWorkspaceButton() {
  const [creating, setCreating] = useState(false);
  const [error, setError] = useState<string | null>(null);
  const [workspaces, setWorkspaces] = useState<WorkspaceOption[]>([]);
-  const [displayEnabled, setDisplayEnabled] = useState(false);
-  const [displayInstanceType, setDisplayInstanceType] = useState("t3.xlarge");
-  const [displayRootGB, setDisplayRootGB] = useState("80");
-  const [displayResolution, setDisplayResolution] = useState("1920x1080");
  // Templates fetched from /api/templates — drives the dynamic provider
  // filter below. Same data source ConfigTab uses (PR #2454). When the
  // selected template declares `runtime_config.providers` in its
@@ -229,10 +223,6 @@ export function CreateWorkspaceButton() {
    setParentId("");
    setBudgetLimit("");
    setError(null);
-    setDisplayEnabled(false);
-    setDisplayInstanceType("t3.xlarge");
-    setDisplayRootGB("80");
-    setDisplayResolution("1920x1080");
    setHermesProvider("anthropic");
    setExternalRuntime("external");
    setHermesApiKey("");
@@ -274,8 +264,6 @@ export function CreateWorkspaceButton() {
      const parsedBudget = budgetLimit.trim()
        ? parseFloat(budgetLimit)
        : null;
-      const [displayWidth, displayHeight] = displayResolution.split("x").map((v) => parseInt(v, 10));
-      const parsedRootGB = parseInt(displayRootGB, 10);

      const createResp = await api.post<{
        id: string;
@@ -292,21 +280,6 @@ export function CreateWorkspaceButton() {
        tier,
        parent_id: parentId || undefined,
        budget_limit: parsedBudget,
-        ...(!isExternal && !isHermes ? { model: DEFAULT_CREATE_MODEL } : {}),
-        ...(displayEnabled
-          ? {
-              compute: {
-                instance_type: displayInstanceType,
-                volume: { root_gb: Number.isFinite(parsedRootGB) ? parsedRootGB : 80 },
-                display: {
-                  mode: "desktop-control",
-                  protocol: "novnc",
-                  width: Number.isFinite(displayWidth) ? displayWidth : 1920,
-                  height: Number.isFinite(displayHeight) ? displayHeight : 1080,
-                },
-              },
-            }
-          : {}),
        canvas: { x: Math.random() * 400 + 100, y: Math.random() * 300 + 100 },
        // Runtime=external flips the backend into awaiting-agent mode:
        // no container provisioning, token minted, connection payload
@@ -474,73 +447,6 @@ export function CreateWorkspaceButton() {
              </div>
            </div>

-            {!isExternal && (
-              <div className="rounded-lg border border-line/50 bg-surface-card/40 p-3">
-                <div className="mb-2 text-[11px] font-medium text-ink-mid">
-                  Container Config
-                </div>
-                <label className="flex items-center justify-between gap-3">
-                  <span className="text-xs font-medium text-ink">Display</span>
-                  <input
-                    type="checkbox"
-                    checked={displayEnabled}
-                    onChange={(e) => setDisplayEnabled(e.target.checked)}
-                    aria-label="Enable display"
-                    className="h-4 w-4"
-                  />
-                </label>
-                {displayEnabled && (
-                  <div className="mt-3 grid grid-cols-2 gap-2">
-                    <div>
-                      <label htmlFor="display-instance-type" className="mb-1 block text-[11px] text-ink-mid">
-                        Instance
-                      </label>
-                      <select
-                        id="display-instance-type"
-                        value={displayInstanceType}
-                        onChange={(e) => setDisplayInstanceType(e.target.value)}
-                        className="w-full bg-surface-card/60 border border-line/50 rounded-lg px-2 py-2 text-xs text-ink focus:outline-none focus:border-accent/60 focus:ring-1 focus:ring-accent/20 transition-colors"
-                      >
-                        <option value="t3.large">t3.large</option>
-                        <option value="t3.xlarge">t3.xlarge</option>
-                        <option value="m6i.xlarge">m6i.xlarge</option>
-                        <option value="c6i.xlarge">c6i.xlarge</option>
-                      </select>
-                    </div>
-                    <div>
-                      <label htmlFor="display-root-gb" className="mb-1 block text-[11px] text-ink-mid">
-                        Disk GB
-                      </label>
-                      <input
-                        id="display-root-gb"
-                        type="number"
-                        min="30"
-                        max="500"
-                        value={displayRootGB}
-                        onChange={(e) => setDisplayRootGB(e.target.value)}
-                        className="w-full bg-surface-card/60 border border-line/50 rounded-lg px-2 py-2 text-xs text-ink focus:outline-none focus:border-accent/60 focus:ring-1 focus:ring-accent/20 transition-colors"
-                      />
-                    </div>
-                    <div className="col-span-2">
-                      <label htmlFor="display-resolution" className="mb-1 block text-[11px] text-ink-mid">
-                        Resolution
-                      </label>
-                      <select
-                        id="display-resolution"
-                        value={displayResolution}
-                        onChange={(e) => setDisplayResolution(e.target.value)}
-                        className="w-full bg-surface-card/60 border border-line/50 rounded-lg px-2 py-2 text-xs text-ink focus:outline-none focus:border-accent/60 focus:ring-1 focus:ring-accent/20 transition-colors"
-                      >
-                        <option value="1920x1080">1920 x 1080</option>
-                        <option value="1600x900">1600 x 900</option>
-                        <option value="1280x720">1280 x 720</option>
-                      </select>
-                    </div>
-                  </div>
-                )}
-              </div>
-            )}
-
            <div>
              <label className="text-[11px] text-ink-mid block mb-1">
                Parent Workspace
@@ -9,8 +9,6 @@ import { DetailsTab } from "./tabs/DetailsTab";
 import { SkillsTab } from "./tabs/SkillsTab";
 import { ChatTab } from "./tabs/ChatTab";
 import { ConfigTab } from "./tabs/ConfigTab";
-import { ContainerConfigTab } from "./tabs/ContainerConfigTab";
-import { DisplayTab } from "./tabs/DisplayTab";
 import { TerminalTab } from "./tabs/TerminalTab";
 import { FilesTab } from "./tabs/FilesTab";
 import { MemoryInspectorPanel } from "./MemoryInspectorPanel";
@@ -33,8 +31,6 @@ const TABS: { id: PanelTab; label: string; icon: string }[] = [
  { id: "details", label: "Details", icon: "◉" },
  { id: "skills", label: "Plugins", icon: "✦" },
  { id: "terminal", label: "Terminal", icon: "▸" },
-  { id: "display", label: "Display", icon: "▣" },
-  { id: "container-config", label: "Container", icon: "▤" },
  { id: "config", label: "Config", icon: "⚙" },
  { id: "schedule", label: "Schedule", icon: "⏲" },
  { id: "channels", label: "Channels", icon: "⇌" },
@@ -304,8 +300,6 @@ export function SidePanel() {
        {panelTab === "activity" && <ActivityTab key={selectedNodeId} workspaceId={selectedNodeId} />}
        {panelTab === "chat" && <ChatTab key={selectedNodeId} workspaceId={selectedNodeId} data={node.data} />}
        {panelTab === "terminal" && <TerminalTab key={selectedNodeId} workspaceId={selectedNodeId} data={node.data} />}
-        {panelTab === "display" && <DisplayTab key={selectedNodeId} workspaceId={selectedNodeId} />}
-        {panelTab === "container-config" && <ContainerConfigTab key={selectedNodeId} data={node.data} />}
        {panelTab === "config" && <ConfigTab key={selectedNodeId} workspaceId={selectedNodeId} />}
        {panelTab === "schedule" && <ScheduleTab key={selectedNodeId} workspaceId={selectedNodeId} />}
        {panelTab === "channels" && <ChannelsTab key={selectedNodeId} workspaceId={selectedNodeId} />}
@@ -123,46 +123,6 @@ describe("CreateWorkspaceDialog", () => {
    expect(body.parent_id).toBeUndefined();
  });

-  it("omits compute config by default", async () => {
-    await openDialog();
-    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
-      target: { value: "Plain Agent" },
-    });
-
-    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
-    fireEvent.click(createBtn!);
-
-    await waitFor(() => expect(mockPost).toHaveBeenCalled());
-    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
-    expect(body.compute).toBeUndefined();
-    expect(body.model).toBe("anthropic:claude-opus-4-7");
-  });
-
-  it("sends display compute profile when desktop display is enabled", async () => {
-    await openDialog();
-    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
-      target: { value: "Desktop Agent" },
-    });
-    fireEvent.click(screen.getByLabelText("Enable display"));
-
-    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
-    fireEvent.click(createBtn!);
-
-    await waitFor(() => expect(mockPost).toHaveBeenCalled());
-    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
-    expect(body.model).toBe("anthropic:claude-opus-4-7");
-    expect(body.compute).toEqual({
-      instance_type: "t3.xlarge",
-      volume: { root_gb: 80 },
-      display: {
-        mode: "desktop-control",
-        protocol: "novnc",
-        width: 1920,
-        height: 1080,
-      },
-    });
-  });
-
  it("renders gracefully when GET /workspaces fails", async () => {
    mockGet.mockRejectedValueOnce(new Error("Network error"));
    await openDialog();
@@ -11,8 +11,6 @@ vi.mock("../tabs/DetailsTab", () => ({ DetailsTab: () => null }));
 vi.mock("../tabs/SkillsTab", () => ({ SkillsTab: () => null }));
 vi.mock("../tabs/ChatTab", () => ({ ChatTab: () => null }));
 vi.mock("../tabs/ConfigTab", () => ({ ConfigTab: () => null }));
-vi.mock("../tabs/ContainerConfigTab", () => ({ ContainerConfigTab: () => null }));
-vi.mock("../tabs/DisplayTab", () => ({ DisplayTab: () => null }));
 vi.mock("../tabs/TerminalTab", () => ({ TerminalTab: () => null }));
 vi.mock("../tabs/FilesTab", () => ({ FilesTab: () => null }));
 vi.mock("../MemoryInspectorPanel", () => ({ MemoryInspectorPanel: () => null }));
@@ -76,7 +74,7 @@ import { SidePanel } from "../SidePanel";

 const TABS = [
  "chat", "activity", "details", "skills", "terminal",
-  "display", "container-config", "config", "schedule", "channels", "files", "memory", "traces", "events", "audit",
+  "config", "schedule", "channels", "files", "memory", "traces", "events", "audit",
 ];

 describe("SidePanel — ARIA tablist pattern", () => {
@@ -87,20 +85,10 @@ describe("SidePanel — ARIA tablist pattern", () => {
    expect(tablist.getAttribute("aria-label")).toBe("Workspace panel tabs");
  });

-  it("renders exactly 15 tab buttons", () => {
+  it("renders exactly 13 tab buttons", () => {
    render(<SidePanel />);
    const tabs = screen.getAllByRole("tab");
-    expect(tabs.length).toBe(15);
-  });
-
-  it("renders the Display tab", () => {
-    render(<SidePanel />);
-    expect(document.getElementById("tab-display")).toBeTruthy();
-  });
-
-  it("renders the Container Config tab", () => {
-    render(<SidePanel />);
-    expect(document.getElementById("tab-container-config")).toBeTruthy();
+    expect(tabs.length).toBe(13);
  });

  it("active tab (chat) has aria-selected='true'", () => {
@@ -111,11 +99,11 @@ describe("SidePanel — ARIA tablist pattern", () => {
    expect(chatTab?.getAttribute("aria-selected")).toBe("true");
  });

-  it("all other 14 tabs have aria-selected='false'", () => {
+  it("all other 12 tabs have aria-selected='false'", () => {
    render(<SidePanel />);
    const tabs = screen.getAllByRole("tab");
    const inactive = tabs.filter((t) => t.id !== "tab-chat");
-    expect(inactive.length).toBe(14);
+    expect(inactive.length).toBe(12);
    for (const tab of inactive) {
      expect(tab.getAttribute("aria-selected")).toBe("false");
    }
@@ -128,7 +116,7 @@ describe("SidePanel — ARIA tablist pattern", () => {
    const minusOnes = tabs.filter((t) => t.getAttribute("tabindex") === "-1");
    expect(zeros.length).toBe(1);
    expect(zeros[0].id).toBe("tab-chat");
-    expect(minusOnes.length).toBe(14);
+    expect(minusOnes.length).toBe(12);
  });

  it("active tab has aria-controls='panel-chat' and id='tab-chat'", () => {
@@ -1,96 +0,0 @@
-"use client";
-
-import { runtimeDisplayName } from "@/lib/runtime-names";
-import type { WorkspaceNodeData } from "@/store/canvas";
-
-type Props = {
-  data: Pick<
-    WorkspaceNodeData,
-    "runtime" | "status" | "needsRestart" | "activeTasks" | "deliveryMode"
-    | "workspaceAccess" | "maxConcurrentTasks"
-  >;
-};
-
-export function ContainerConfigTab({ data }: Props) {
-  const runtime = data.runtime || "unknown";
-  const workspaceAccess = formatAccess(data.workspaceAccess);
-  const maxConcurrentTasks = data.maxConcurrentTasks ? String(data.maxConcurrentTasks) : "platform-managed";
-  const mountedPath = "/workspace";
-  const privilegeStatus = "standard";
-  const deliveryMode = data.deliveryMode || "push";
-
-  return (
-    <div className="p-4 space-y-4">
-      <section className="rounded-lg border border-line/50 bg-surface-card/40 p-4">
-        <div className="mb-3">
-          <h3 className="text-sm font-semibold text-ink">Container Config</h3>
-        </div>
-
-        <dl className="grid grid-cols-1 gap-2 text-[11px]">
-          <ConfigRow label="Runtime image" value={runtimeDisplayName(runtime)} detail={runtime} />
-          <ConfigRow label="Workspace access" value={workspaceAccess} />
-          <ConfigRow label="Max concurrent tasks" value={maxConcurrentTasks} />
-          <ConfigRow label="Mounted workspace path" value={mountedPath} />
-          <ConfigRow label="Container privileges" value={privilegeStatus} />
-          <ConfigRow label="Delivery mode" value={deliveryMode} />
-        </dl>
-      </section>
-
-      <section className="rounded-lg border border-line/50 bg-surface-card/40 p-4">
-        <h3 className="mb-3 text-sm font-semibold text-ink">Session Controls</h3>
-        <div className="grid grid-cols-2 gap-2">
-          <ReadOnlyAction label={data.needsRestart ? "Restart required" : "Restart"} />
-          <ReadOnlyAction label="Reset session" />
-        </div>
-      </section>
-
-      <section className="rounded-lg border border-line/50 bg-surface-card/40 p-4">
-        <h3 className="mb-3 text-sm font-semibold text-ink">Status</h3>
-        <dl className="grid grid-cols-1 gap-2 text-[11px]">
-          <ConfigRow label="Container status" value={data.status} />
-          <ConfigRow label="Active tasks" value={String(data.activeTasks ?? 0)} />
-          <ConfigRow label="Mounted path access" value="available" />
-        </dl>
-      </section>
-    </div>
-  );
-}
-
-function formatAccess(value: string | null | undefined): string {
-  if (!value) return "none";
-  return value.replace(/_/g, "-");
-}
-
-function ConfigRow({
-  label,
-  value,
-  detail,
-}: {
-  label: string;
-  value: string;
-  detail?: string;
-}) {
-  return (
-    <div className="flex items-start justify-between gap-3 rounded-md bg-surface-sunken/40 px-3 py-2">
-      <dt className="text-ink-mid">{label}</dt>
-      <dd className="min-w-0 text-right">
-        <div className="font-mono text-ink break-words">{value}</div>
-        {detail && detail !== value && (
-          <div className="mt-0.5 font-mono text-[10px] text-ink-mid break-words">{detail}</div>
-        )}
-      </dd>
-    </div>
-  );
-}
-
-function ReadOnlyAction({ label }: { label: string }) {
-  return (
-    <button
-      type="button"
-      disabled
-      className="rounded-md border border-line/50 bg-surface-sunken/40 px-3 py-2 text-[11px] text-ink-mid disabled:cursor-not-allowed disabled:opacity-70"
-    >
-      {label}
-    </button>
-  );
-}
@@ -1,312 +0,0 @@
-"use client";
-
-import { useEffect, useRef, useState } from "react";
-import { api } from "@/lib/api";
-
-interface DisplayStatus {
-  available: boolean;
-  reason?: string;
-  mode?: string;
-  status?: string;
-  protocol?: string;
-  width?: number;
-  height?: number;
-  viewer_url?: string;
-}
-
-interface DisplayControlStatus {
-  controller: "none" | "user" | "agent";
-  controlled_by?: string;
-  expires_at?: string;
-}
-
-interface Props {
-  workspaceId: string;
-}
-
-export function DisplayTab({ workspaceId }: Props) {
-  const [status, setStatus] = useState<DisplayStatus | null>(null);
-  const [control, setControl] = useState<DisplayControlStatus | null>(null);
-  const [error, setError] = useState<string | null>(null);
-  const [controlError, setControlError] = useState<string | null>(null);
-  const [controlBusy, setControlBusy] = useState(false);
-  const requestGeneration = useRef(0);
-
-  useEffect(() => {
-    const generation = requestGeneration.current + 1;
-    requestGeneration.current = generation;
-    let cancelled = false;
-    setStatus(null);
-    setControl(null);
-    setError(null);
-    setControlError(null);
-    setControlBusy(false);
-    async function load() {
-      try {
-        const displayStatus = await api.get<DisplayStatus>(`/workspaces/${workspaceId}/display`);
-        if (cancelled || requestGeneration.current !== generation) return;
-        setStatus(displayStatus);
-        if (displayStatus.reason === "display_not_enabled") return;
-        try {
-          const displayControl = await api.get<DisplayControlStatus>(`/workspaces/${workspaceId}/display/control`);
-          if (!cancelled && requestGeneration.current === generation) setControl(displayControl);
-        } catch (err) {
-          if (!cancelled && requestGeneration.current === generation) {
-            setControl(null);
-            setControlError("Display control unavailable");
-          }
-        }
-      } catch (err) {
-        if (!cancelled && requestGeneration.current === generation) setError("The display status could not be loaded.");
-      }
-    }
-    load();
-    return () => {
-      cancelled = true;
-    };
-  }, [workspaceId]);
-
-  const acquireControl = async () => {
-    const generation = requestGeneration.current;
-    const controlPath = `/workspaces/${workspaceId}/display/control`;
-    setControlBusy(true);
-    setControlError(null);
-    try {
-      const next = await api.post<DisplayControlStatus>(`${controlPath}/acquire`, {
-        controller: "user",
-        ttl_seconds: 300,
-      });
-      if (requestGeneration.current !== generation) return;
-      setControl(next);
-    } catch (err) {
-      if (requestGeneration.current !== generation) return;
-      setControlError("Failed to take control");
-      try {
-        const latest = await api.get<DisplayControlStatus>(controlPath);
-        if (requestGeneration.current !== generation) return;
-        setControl(latest);
-      } catch {
-        if (requestGeneration.current !== generation) return;
-        setControl(null);
-      }
-    } finally {
-      if (requestGeneration.current === generation) setControlBusy(false);
-    }
-  };
-
-  const releaseControl = async () => {
-    const generation = requestGeneration.current;
-    const controlPath = `/workspaces/${workspaceId}/display/control`;
-    setControlBusy(true);
-    setControlError(null);
-    try {
-      const next = await api.post<DisplayControlStatus>(`${controlPath}/release`, {});
-      if (requestGeneration.current !== generation) return;
-      setControl(next);
-    } catch (err) {
-      if (requestGeneration.current !== generation) return;
-      setControlError("Failed to release control");
-      try {
-        const latest = await api.get<DisplayControlStatus>(controlPath);
-        if (requestGeneration.current !== generation) return;
-        setControl(latest);
-      } catch {
-        if (requestGeneration.current !== generation) return;
-        setControl(null);
-      }
-    } finally {
-      if (requestGeneration.current === generation) setControlBusy(false);
-    }
-  };
-
-  if (error) {
-    return (
-      <div className="p-5">
-        <div className="rounded-lg border border-red-500/20 bg-red-950/20 p-4">
-          <h3 className="text-sm font-medium text-red-200">Display status unavailable</h3>
-          <p className="mt-2 text-[11px] leading-relaxed text-red-200/75">{error}</p>
-        </div>
-      </div>
-    );
-  }
-
-  if (!status) {
-    return (
-      <div className="p-5">
-        <div className="h-24 rounded-lg border border-line/40 bg-surface-sunken/30 motion-safe:animate-pulse" />
-      </div>
-    );
-  }
-
-  if (!status.available) {
-    const isNotEnabled = status.reason === "display_not_enabled";
-    return (
-      <div className="flex min-h-full flex-col items-center justify-center bg-surface-sunken/30 p-8 text-center">
-        <svg
-          width="72"
-          height="72"
-          viewBox="0 0 72 72"
-          fill="none"
-          aria-hidden="true"
-          className="mb-4 text-ink-mid"
-        >
-          <rect x="12" y="14" width="48" height="36" rx="4" stroke="currentColor" strokeWidth="2.5" opacity="0.65" />
-          <path d="M28 58h16M36 50v8M16 16l40 40" stroke="currentColor" strokeWidth="3" strokeLinecap="round" />
-        </svg>
-        <h3 className="mb-1.5 text-sm font-medium text-ink">
-          {isNotEnabled ? "Display is not enabled for this workspace." : "Display session is not ready."}
-        </h3>
-        <p className="max-w-xs text-[11px] leading-relaxed text-ink-mid">
-          {isNotEnabled
-            ? "Recreate this workspace with display enabled to view and take over its desktop."
-            : "This workspace has display configuration, but the desktop session infrastructure is not configured yet."}
-        </p>
-        {!isNotEnabled && (
-          <>
-            <dl className="mt-5 grid grid-cols-2 gap-x-4 gap-y-2 text-left text-[11px]">
-              <dt className="text-ink-mid">Mode</dt>
-              <dd className="font-mono text-ink">{status.mode || "unknown"}</dd>
-              <dt className="text-ink-mid">Status</dt>
-              <dd className="font-mono text-ink">{status.status || "unknown"}</dd>
-            </dl>
-            <div className="mt-5 w-full max-w-xs border-t border-line/50 pt-4">
-              {control ? (
-                <div className="flex items-center justify-between gap-3 text-left">
-                  <div className="min-w-0">
-                    <p className="text-[11px] font-medium text-ink">
-                      {control.controller === "none"
-                        ? "No active controller"
-                        : `Controlled by ${displayControlActorLabel(control)}`}
-                    </p>
-                    {control.expires_at && (
-                      <p className="mt-1 truncate font-mono text-[10px] text-ink-mid">
-                        Until {new Date(control.expires_at).toLocaleTimeString()}
-                      </p>
-                    )}
-                    {controlError && <p className="mt-1 text-[10px] leading-snug text-red-200">{controlError}</p>}
-                  </div>
-                  {control.controller === "none" && (
-                    <button
-                      type="button"
-                      onClick={acquireControl}
-                      disabled={controlBusy}
-                      className="h-8 shrink-0 rounded border border-line bg-surface px-3 text-[11px] font-medium text-ink hover:bg-surface-elevated disabled:cursor-not-allowed disabled:opacity-60"
-                    >
-                      Take control
-                    </button>
-                  )}
-                </div>
-              ) : (
-                <div className="text-left">
-                  {!controlError && (
-                    <div className="h-8 rounded border border-line/40 bg-surface-sunken/30 motion-safe:animate-pulse" />
-                  )}
-                  {controlError && <p className="mt-2 text-[10px] leading-snug text-red-200">{controlError}</p>}
-                </div>
-              )}
-            </div>
-          </>
-        )}
-      </div>
-    );
-  }
-
-  return (
-    <div className="flex h-full min-h-[360px] flex-col bg-surface-sunken/30">
-      <div className="flex items-center justify-between gap-3 border-b border-line/50 px-4 py-3">
-        <div className="min-w-0">
-          <h3 className="text-sm font-medium text-ink">Desktop</h3>
-          <p className="mt-0.5 font-mono text-[10px] text-ink-mid">
-            {status.mode || "desktop-control"} · {status.protocol || "display"}
-          </p>
-        </div>
-        <DisplayControlBar
-          control={control}
-          controlBusy={controlBusy}
-          controlError={controlError}
-          onAcquire={acquireControl}
-          onRelease={releaseControl}
-        />
-      </div>
-      {status.viewer_url ? (
-        <iframe
-          title="Workspace desktop"
-          src={status.viewer_url}
-          className="min-h-0 flex-1 border-0 bg-black"
-          allow="clipboard-read; clipboard-write; fullscreen; pointer-lock"
-          referrerPolicy="no-referrer"
-        />
-      ) : (
-        <div className="flex flex-1 items-center justify-center p-8 text-center">
-          <div>
-            <h3 className="mb-1.5 text-sm font-medium text-ink">Display session is not ready.</h3>
-            <p className="max-w-xs text-[11px] leading-relaxed text-ink-mid">
-              This workspace has display configuration, but the desktop session URL is not available yet.
-            </p>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
-
-function DisplayControlBar({
-  control,
-  controlBusy,
-  controlError,
-  onAcquire,
-  onRelease,
-}: {
-  control: DisplayControlStatus | null;
-  controlBusy: boolean;
-  controlError: string | null;
-  onAcquire: () => void;
-  onRelease: () => void;
-}) {
-  return (
-    <div className="flex min-w-0 items-center gap-3">
-      {control && (
-        <div className="min-w-0 text-right">
-          <p className="truncate text-[11px] font-medium text-ink">
-            {control.controller === "none"
-              ? "No active controller"
-              : `Controlled by ${displayControlActorLabel(control)}`}
-          </p>
-          {control.expires_at && (
-            <p className="mt-0.5 truncate font-mono text-[10px] text-ink-mid">
-              Until {new Date(control.expires_at).toLocaleTimeString()}
-            </p>
-          )}
-          {controlError && <p className="mt-0.5 text-[10px] text-red-200">{controlError}</p>}
-        </div>
-      )}
-      {control?.controller === "none" && (
-        <button
-          type="button"
-          onClick={onAcquire}
-          disabled={controlBusy}
-          className="h-8 shrink-0 rounded border border-line bg-surface px-3 text-[11px] font-medium text-ink hover:bg-surface-elevated disabled:cursor-not-allowed disabled:opacity-60"
-        >
-          Take control
-        </button>
-      )}
-      {control?.controller === "user" && control.controlled_by === "admin-token" && (
-        <button
-          type="button"
-          onClick={onRelease}
-          disabled={controlBusy}
-          className="h-8 shrink-0 rounded border border-line bg-surface px-3 text-[11px] font-medium text-ink hover:bg-surface-elevated disabled:cursor-not-allowed disabled:opacity-60"
-        >
-          Release
-        </button>
-      )}
-    </div>
-  );
-}
-
-function displayControlActorLabel(control: DisplayControlStatus): string {
-  if (control.controller === "agent") return "Agent";
-  if (control.controlled_by === "admin-token") return "Admin";
-  if (control.controlled_by?.startsWith("org-token:")) return "Automation";
-  return "User";
-}
@@ -1,42 +0,0 @@
-// @vitest-environment jsdom
-import { cleanup, render, screen } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-vi.mock("@/lib/runtime-names", () => ({
-  runtimeDisplayName: (runtime: string) => runtime,
-}));
-
-import { ContainerConfigTab } from "../ContainerConfigTab";
-
-afterEach(() => {
-  cleanup();
-});
-
-describe("ContainerConfigTab", () => {
-  it("renders read-only runtime and container settings separate from compute shape", () => {
-    render(
-      <ContainerConfigTab
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: false,
-          activeTasks: 2,
-          maxConcurrentTasks: 3,
-          workspaceAccess: "read_write",
-          deliveryMode: "poll",
-        }}
-      />,
-    );
-
-    expect(screen.getByText("Runtime image")).toBeTruthy();
-    expect(screen.getByText("claude-code")).toBeTruthy();
-    expect(screen.getByText("Workspace access")).toBeTruthy();
-    expect(screen.getByText("read-write")).toBeTruthy();
-    expect(screen.getByText("Max concurrent tasks")).toBeTruthy();
-    expect(screen.getByText("3")).toBeTruthy();
-    expect(screen.getByText("/workspace")).toBeTruthy();
-    expect(screen.getByText("Container privileges")).toBeTruthy();
-    expect(screen.queryByText("Instance type")).toBeNull();
-    expect(screen.queryByText("Root volume")).toBeNull();
-  });
-});
@@ -1,305 +0,0 @@
-// @vitest-environment jsdom
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
-
-const { mockGet, mockPost } = vi.hoisted(() => ({ mockGet: vi.fn(), mockPost: vi.fn() }));
-
-vi.mock("@/lib/api", () => ({
-  api: {
-    get: mockGet,
-    post: mockPost,
-  },
-}));
-
-import { DisplayTab } from "../DisplayTab";
-
-describe("DisplayTab", () => {
-  beforeEach(() => {
-    cleanup();
-    mockGet.mockReset();
-    mockPost.mockReset();
-  });
-
-  it("renders unavailable state for non-display workspaces", async () => {
-    mockGet.mockResolvedValueOnce({
-      available: false,
-      reason: "display_not_enabled",
-    });
-
-    render(<DisplayTab workspaceId="ws-no-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByText("Display is not enabled for this workspace.")).toBeTruthy();
-    });
-    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-no-display/display");
-    expect(mockGet).not.toHaveBeenCalledWith("/workspaces/ws-no-display/display/control");
-  });
-
-  it("renders control acquisition for display-configured workspaces", async () => {
-    mockGet
-      .mockResolvedValueOnce({
-        available: false,
-        reason: "display_session_unavailable",
-        mode: "desktop-control",
-        status: "not_configured",
-      })
-      .mockResolvedValueOnce({
-        controller: "none",
-      });
-    mockPost.mockResolvedValueOnce({
-      controller: "user",
-      controlled_by: "admin-token",
-      expires_at: "2026-05-23T08:48:27Z",
-    });
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-    });
-    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-display/display");
-    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-display/display/control");
-
-    fireEvent.click(screen.getByRole("button", { name: "Take control" }));
-
-    await waitFor(() => {
-      expect(screen.getByText("Controlled by Admin")).toBeTruthy();
-    });
-    expect(mockPost).toHaveBeenCalledWith("/workspaces/ws-display/display/control/acquire", {
-      controller: "user",
-      ttl_seconds: 300,
-    });
-  });
-
-  it("renders the desktop stream when a display session is available", async () => {
-    mockGet
-      .mockResolvedValueOnce({
-        available: true,
-        mode: "desktop-control",
-        protocol: "dcv",
-        width: 1920,
-        height: 1080,
-        viewer_url: "https://display.example.test/session/ws-display",
-      })
-      .mockResolvedValueOnce({
-        controller: "none",
-      });
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByTitle("Workspace desktop")).toBeTruthy();
-    });
-    const frame = screen.getByTitle("Workspace desktop") as HTMLIFrameElement;
-    expect(frame.src).toBe("https://display.example.test/session/ws-display");
-    expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-  });
-
-  it("releases user display control", async () => {
-    mockGet
-      .mockResolvedValueOnce({
-        available: true,
-        mode: "desktop-control",
-        protocol: "dcv",
-        viewer_url: "https://display.example.test/session/ws-display",
-      })
-      .mockResolvedValueOnce({
-        controller: "user",
-        controlled_by: "admin-token",
-        expires_at: "2026-05-23T08:48:27Z",
-      });
-    mockPost.mockResolvedValueOnce({
-      controller: "none",
-    });
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: "Release" })).toBeTruthy();
-    });
-
-    fireEvent.click(screen.getByRole("button", { name: "Release" }));
-
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-    });
-    expect(mockPost).toHaveBeenCalledWith("/workspaces/ws-display/display/control/release", {});
-  });
-
-  it("renders active display control locks as observe-only", async () => {
-    mockGet
-      .mockResolvedValueOnce({
-        available: false,
-        reason: "display_session_unavailable",
-        mode: "desktop-control",
-        status: "not_configured",
-      })
-      .mockResolvedValueOnce({
-        controller: "agent",
-        controlled_by: "sidecar",
-        expires_at: "2026-05-23T08:48:27Z",
-      });
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByText("Controlled by Agent")).toBeTruthy();
-    });
-    expect(screen.queryByRole("button", { name: "Release" })).toBeNull();
-    expect(screen.queryByRole("button", { name: "Take control" })).toBeNull();
-    expect(mockPost).not.toHaveBeenCalled();
-  });
-
-  it("labels org-token display control locks as automation", async () => {
-    mockGet
-      .mockResolvedValueOnce({
-        available: false,
-        reason: "display_session_unavailable",
-        mode: "desktop-control",
-        status: "not_configured",
-      })
-      .mockResolvedValueOnce({
-        controller: "user",
-        controlled_by: "org-token:abc123",
-        expires_at: "2026-05-23T08:48:27Z",
-      });
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByText("Controlled by Automation")).toBeTruthy();
-    });
-    expect(screen.queryByText("org-token:abc123")).toBeNull();
-    expect(screen.queryByRole("button", { name: "Take control" })).toBeNull();
-  });
-
-  it("refreshes display control state after failed acquisition", async () => {
-    mockGet
-      .mockResolvedValueOnce({
-        available: false,
-        reason: "display_session_unavailable",
-        mode: "desktop-control",
-        status: "not_configured",
-      })
-      .mockResolvedValueOnce({
-        controller: "none",
-      })
-      .mockResolvedValueOnce({
-        controller: "agent",
-        controlled_by: "sidecar",
-        expires_at: "2026-05-23T08:48:27Z",
-      });
-    mockPost.mockRejectedValueOnce(new Error("API POST /workspaces/ws-display/display/control/acquire: 409 conflict"));
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-    });
-
-    fireEvent.click(screen.getByRole("button", { name: "Take control" }));
-
-    await waitFor(() => {
-      expect(screen.getByText("Controlled by Agent")).toBeTruthy();
-    });
-    expect(screen.getByText("Failed to take control")).toBeTruthy();
-    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-display/display/control");
-    expect(mockGet).toHaveBeenCalledTimes(3);
-    expect(mockPost).toHaveBeenCalledWith("/workspaces/ws-display/display/control/acquire", {
-      controller: "user",
-      ttl_seconds: 300,
-    });
-  });
-
-  it("keeps display status visible without takeover actions when control status fails", async () => {
-    mockGet
-      .mockResolvedValueOnce({
-        available: false,
-        reason: "display_session_unavailable",
-        mode: "desktop-control",
-        status: "not_configured",
-      })
-      .mockRejectedValueOnce(new Error("API GET /workspaces/ws-display/display/control: 401 unauthorized"));
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByText("Display session is not ready.")).toBeTruthy();
-    });
-    expect(screen.queryByRole("button", { name: "Take control" })).toBeNull();
-    expect(screen.getByText("Display control unavailable")).toBeTruthy();
-  });
-
-  it("does not render raw display status errors", async () => {
-    mockGet.mockRejectedValueOnce(new Error("API GET /workspaces/ws-display/display: 500 secret backend details"));
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByText("Display status unavailable")).toBeTruthy();
-    });
-    expect(screen.queryByText(/secret backend details/)).toBeNull();
-  });
-
-  it("ignores stale acquire responses after workspace changes", async () => {
-    const acquire = deferred<{ controller: "user"; controlled_by: string; expires_at: string }>();
-    mockGet
-      .mockResolvedValueOnce({
-        available: false,
-        reason: "display_session_unavailable",
-        mode: "desktop-control",
-        status: "not_configured",
-      })
-      .mockResolvedValueOnce({
-        controller: "none",
-      })
-      .mockResolvedValueOnce({
-        available: false,
-        reason: "display_session_unavailable",
-        mode: "desktop-control",
-        status: "not_configured",
-      })
-      .mockResolvedValueOnce({
-        controller: "none",
-      });
-    mockPost.mockReturnValueOnce(acquire.promise);
-
-    const { rerender } = render(<DisplayTab workspaceId="ws-a" />);
-
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: "Take control" }));
-
-    rerender(<DisplayTab workspaceId="ws-b" />);
-
-    await waitFor(() => {
-      expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-b/display/control");
-    });
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-    });
-
-    acquire.resolve({
-      controller: "user",
-      controlled_by: "admin-token",
-      expires_at: "2026-05-23T08:48:27Z",
-    });
-    await acquire.promise;
-
-    await waitFor(() => {
-      expect(screen.queryByText("Controlled by Admin")).toBeNull();
-    });
-    expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-  });
-});
-
-function deferred<T>() {
-  let resolve!: (value: T) => void;
-  let reject!: (reason?: unknown) => void;
-  const promise = new Promise<T>((res, rej) => {
-    resolve = res;
-    reject = rej;
-  });
-  return { promise, resolve, reject };
-}
@@ -513,8 +513,6 @@ export function buildNodesAndEdges(
        parentId: ws.parent_id,
        currentTask: ws.current_task || "",
        runtime: ws.runtime || "",
-        workspaceAccess: ws.workspace_access,
-        maxConcurrentTasks: ws.max_concurrent_tasks ?? null,
        needsRestart: false,
        budgetLimit: ws.budget_limit ?? null,
        budgetUsed: ws.budget_used ?? null,
@@ -88,8 +88,6 @@ export interface WorkspaceNodeData extends Record<string, unknown> {
  parentId: string | null;
  currentTask: string;
  runtime: string;
-  workspaceAccess?: string | null;
-  maxConcurrentTasks?: number | null;
  needsRestart: boolean;
  /** USD spend ceiling set by the user; null = unlimited. Added by issue #541. */
  budgetLimit: number | null;
@@ -132,7 +130,7 @@ export interface WorkspaceNodeData extends Record<string, unknown> {
  deliveryMode?: string;
 }

-export type PanelTab = "details" | "skills" | "chat" | "terminal" | "display" | "container-config" | "config" | "schedule" | "channels" | "files" | "memory" | "traces" | "events" | "activity" | "audit";
+export type PanelTab = "details" | "skills" | "chat" | "terminal" | "config" | "schedule" | "channels" | "files" | "memory" | "traces" | "events" | "activity" | "audit";

 export interface ContextMenuState {
  x: number;
@@ -320,13 +320,11 @@ export interface WorkspaceData {
  url: string;
  parent_id: string | null;
  active_tasks: number;
-  max_concurrent_tasks?: number | null;
  last_error_rate: number;
  last_sample_error: string;
  uptime_seconds: number;
  current_task: string;
  runtime: string;
-  workspace_access?: string | null;
  x: number;
  y: number;
  collapsed: boolean;
@@ -50,16 +50,13 @@ docker rm $(docker ps -aq --filter "name=ws-") 2>/dev/null || true
 echo ""
 echo "--- Create Workspaces ---"

-# model is required at the Create boundary (CTO 2026-05-22 SSOT —
-# feedback_workspace_model_required_no_platform_default_dynamic_credential_intake).
-# Pass the same value the deleted DefaultModel("claude-code") returned.
 ROOT=$(curl -s -X POST $PLATFORM/workspaces -H "Content-Type: application/json" \
-  -d '{"name":"Root Agent","role":"Company coordinator","runtime":"claude-code","model":"sonnet","tier":3}' \
+  -d '{"name":"Root Agent","role":"Company coordinator","runtime":"claude-code","tier":3}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
 check_contains "Create root workspace" "-" "$ROOT"

 CHILD=$(curl -s -X POST $PLATFORM/workspaces -H "Content-Type: application/json" \
-  -d "{\"name\":\"Child Agent\",\"role\":\"Sub-team member\",\"runtime\":\"claude-code\",\"model\":\"sonnet\",\"tier\":2,\"parent_id\":\"$ROOT\"}" \
+  -d "{\"name\":\"Child Agent\",\"role\":\"Sub-team member\",\"runtime\":\"claude-code\",\"tier\":2,\"parent_id\":\"$ROOT\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
 check_contains "Create child workspace" "-" "$CHILD"

@@ -92,12 +92,8 @@ for _wid in $PRIOR; do
  curl -s -X DELETE "$BASE/workspaces/$_wid?confirm=true" > /dev/null || true
 done

-# model is required at the Create boundary (CTO 2026-05-22 SSOT — see
-# feedback_workspace_model_required_no_platform_default_dynamic_credential_intake).
-# Body had no runtime → defaults to langgraph; pass the langgraph-compatible
-# default that the deleted DefaultModel("") would have returned.
 R=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-  -d '{"name":"Notify E2E","tier":1,"model":"anthropic:claude-opus-4-7"}')
+  -d '{"name":"Notify E2E","tier":1}')
 WSID=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])' 2>/dev/null || true)
 [ -n "$WSID" ] || { echo "Failed to create workspace: $R"; exit 1; }
 echo "Created workspace $WSID"
@@ -24,12 +24,14 @@
 #
 # Only PROVISIONING differs from staging:
 #   - staging: POST /cp/admin/orgs (cold EC2 tenant) + per-tenant admin
-#     token + each workspace's MCP bearer from the POST /workspaces
-#     create response.
+#     token + each workspace's MCP bearer from create response or an admin
+#     token-mint fallback.
 #   - local:   POST /workspaces directly against the local stack
-#     (BASE, default http://localhost:8080), MCP bearer consumed inline
-#     from the create response (auth_token field). Same model every
-#     other local E2E uses; no new credential/provision flow.
+#     (BASE, default http://localhost:8080), MCP bearer minted via
+#     GET /admin/workspaces/:id/test-token (e2e_mint_test_token —
+#     deterministic, gated by MOLECULE_ENV != production). Same model
+#     every other local E2E (test_priority_runtimes_e2e.sh,
+#     test_api.sh) already uses; no new credential/provision flow.
 #
 # By default the local backend creates external-mode workspace rows and
 # drives the literal MCP path directly. That keeps the local peer-visibility
@@ -79,17 +81,6 @@ NAME_PREFIX="PV-Local-$$-$(date +%H%M%S)"
 log()  { echo "[$(date +%H:%M:%S)] $*"; }
 ok()   { echo "[$(date +%H:%M:%S)] ✅ $*"; }

-extract_auth_token() {
-  python3 -c "
-import sys, json
-try:
-    d = json.load(sys.stdin)
-except Exception:
-    print(''); sys.exit(0)
-print(d.get('auth_token') or d.get('connection', {}).get('auth_token') or '')
-" 2>/dev/null
-}
-
 CREATED_WSIDS=()
 ADMIN_BEARER="${MOLECULE_ADMIN_TOKEN:-${ADMIN_TOKEN:-}}"
 ADMIN_AUTH=()
@@ -140,6 +131,17 @@ if ! curl -fsS "$BASE/health" -m 5 >/dev/null 2>&1; then
  echo "::error::Local stack not healthy at $BASE/health — bring it up (make up) before this gate. Infra, not a workspace bug (feedback_fix_root_not_symptom)." >&2
  exit 1
 fi
+# admin/test-token is the local MCP-bearer mint path; it 404s in
+# production. If it is off, this gate cannot drive the literal call.
+if ! curl -fsS "$BASE/admin/workspaces/preflight-probe/test-token" ${ADMIN_AUTH[@]+"${ADMIN_AUTH[@]}"} -m 5 >/dev/null 2>&1; then
+  # A 404 here is EITHER "no such ws" (fine — endpoint is enabled) OR the
+  # endpoint is disabled (MOLECULE_ENV=production). Distinguish by body.
+  PROBE=$(curl -s "$BASE/admin/workspaces/preflight-probe/test-token" ${ADMIN_AUTH[@]+"${ADMIN_AUTH[@]}"} -m 5 2>/dev/null)
+  if echo "$PROBE" | grep -qi 'production\|disabled\|not found.*endpoint'; then
+    echo "::error::GET /admin/workspaces/:id/test-token disabled (MOLECULE_ENV=production?). Cannot mint a local MCP bearer." >&2
+    exit 1
+  fi
+fi
 ok "    local stack healthy"

 # ─── Resolve per-runtime provisioning secrets ──────────────────────────
@@ -239,31 +241,9 @@ else
 fi
 log "1/5 provisioning parent ($PARENT_RUNTIME, mode=$PV_LOCAL_PROVISION_MODE) + one sibling per runtime under test..."

-# Map runtime → model per the CTO 2026-05-22 SSOT directive (model is
-# required, no platform default). External runtimes are exempt by the
-# Create-handler gate — for them the URL is the contract — but we still
-# pass model="external:custom" defensively in case a downstream consumer
-# of the create body asserts presence.
-_model_for_runtime() {
-  case "$1" in
-    claude-code) echo "sonnet" ;;
-    codex)       echo "gpt-5.5" ;;
-    kimi)        echo "kimi-coding/kimi-k2-coding-6" ;;
-    minimax)     echo "minimax/MiniMax-M2.7" ;;
-    external)    echo "external:custom" ;;
-    *)           echo "anthropic:claude-opus-4-7" ;;
-  esac
-}
-PARENT_MODEL=$(_model_for_runtime "$PARENT_RUNTIME")
 P_RESP=$(curl -s -X POST "$BASE/workspaces" ${ADMIN_AUTH[@]+"${ADMIN_AUTH[@]}"} -H "Content-Type: application/json" \
-  -d "{\"name\":\"${NAME_PREFIX}-parent\",\"runtime\":\"$PARENT_RUNTIME\",\"model\":\"$PARENT_MODEL\",\"tier\":3$PARENT_EXTRA,\"secrets\":$PARENT_SECRETS}")
+  -d "{\"name\":\"${NAME_PREFIX}-parent\",\"runtime\":\"$PARENT_RUNTIME\",\"tier\":3$PARENT_EXTRA,\"secrets\":$PARENT_SECRETS}")
 PARENT_ID=$(echo "$P_RESP" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))' 2>/dev/null)
-# PARENT_TOKEN captured for symmetry with the per-sibling auth-token
-# capture in the runtime loop below + reserved for follow-up steps
-# that need parent-side auth. Current downstream steps reach the parent
-# via admin token, so the variable isn't dereferenced — SC2034.
-# shellcheck disable=SC2034 # captured for downstream parent-auth use; see #1644 follow-up
-PARENT_TOKEN=$(echo "$P_RESP" | extract_auth_token)
 if [ -z "$PARENT_ID" ]; then
  echo "::error::parent create failed: $(echo "$P_RESP" | head -c 300)" >&2
  exit 1
@@ -279,8 +259,6 @@ log "    PARENT_ID=$PARENT_ID runtime=$PARENT_RUNTIME"
 WS_IDS_MAP=""
 # shellcheck disable=SC2034 # map values are updated through portable eval-based helpers.
 VERDICT_MAP=""
-# shellcheck disable=SC2034 # map values are updated through portable eval-based helpers.
-WS_TOKENS_MAP=""
 _map_set() { # _map_set <mapvarname> <key> <value>
  local __m="$1" __k="$2" __v="$3" __cur
  eval "__cur=\$$__m"
@@ -313,21 +291,14 @@ for rt in $PV_RUNTIMES; do
    CREATE_RUNTIME="$rt"
    CREATE_EXTRA=""
  fi
-  CREATE_MODEL=$(_model_for_runtime "$CREATE_RUNTIME")
  R=$(curl -s -X POST "$BASE/workspaces" ${ADMIN_AUTH[@]+"${ADMIN_AUTH[@]}"} -H "Content-Type: application/json" \
-    -d "{\"name\":\"${NAME_PREFIX}-$rt\",\"runtime\":\"$CREATE_RUNTIME\",\"model\":\"$CREATE_MODEL\",\"tier\":2,\"parent_id\":\"$PARENT_ID\"$CREATE_EXTRA,\"secrets\":$SEC}")
+    -d "{\"name\":\"${NAME_PREFIX}-$rt\",\"runtime\":\"$CREATE_RUNTIME\",\"tier\":2,\"parent_id\":\"$PARENT_ID\"$CREATE_EXTRA,\"secrets\":$SEC}")
  WID=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))' 2>/dev/null)
-  WTOK=$(echo "$R" | extract_auth_token)
  if [ -z "$WID" ]; then
    echo "::error::$rt workspace create failed: $(echo "$R" | head -c 300)" >&2
    exit 1
  fi
-  if [ -z "$WTOK" ]; then
-    echo "::error::$rt workspace create did not return an auth_token — cannot drive the literal MCP call" >&2
-    exit 1
-  fi
  _map_set WS_IDS_MAP "$rt" "$WID"
-  _map_set WS_TOKENS_MAP "$rt" "$WTOK"
  CREATED_WSIDS+=("$WID")
  ALL_WS_IDS="$ALL_WS_IDS $WID"
  ACTIVE_RUNTIMES="$ACTIVE_RUNTIMES $rt"
@@ -385,10 +356,10 @@ log "4/5 driving the LITERAL list_peers MCP call per online runtime..."
 echo ""
 for rt in $ONLINE_RUNTIMES; do
  wid="$(_map_get WS_IDS_MAP "$rt")"
-  WTOK="$(_map_get WS_TOKENS_MAP "$rt")"
+  WTOK=$(e2e_mint_test_token "$wid" 2>/dev/null || true)
  if [ -z "$WTOK" ]; then
    echo "--- $rt (ws=$wid) ---"
-    echo "  ✗ $rt: workspace create did not return an auth_token — cannot drive the literal call"
+    echo "  ✗ $rt: could not mint a local MCP bearer (admin/test-token) — cannot drive the literal call"
    _map_set VERDICT_MAP "$rt" "FAIL(no-bearer)"
    REGRESSED=1
    echo ""
@@ -40,10 +40,10 @@
 #   drives: POST /cp/admin/orgs (provision), GET
 #   /cp/admin/orgs/:slug/admin-token (per-tenant token), DELETE
 #   /cp/admin/tenants/:slug (teardown). The per-tenant admin token drives
-#   tenant workspace creation; each workspace's OWN auth_token is consumed
-#   inline from the POST /workspaces 201 response to drive its MCP call.
-#   No dev-only admin token-mint routes are used in this E2E
-#   (feedback_no_dev_only_routes_in_e2e).
+#   tenant workspace creation; each workspace's OWN auth_token drives its
+#   MCP call. External-like runtimes may return the token in POST
+#   /workspaces; managed container runtimes usually require the admin token
+#   mint fallback below.
 #
 # Required env:
 #   MOLECULE_ADMIN_TOKEN   CP admin bearer — Railway staging CP_ADMIN_API_TOKEN
@@ -265,19 +265,44 @@ log "    PARENT_ID=$PARENT_ID"
 # WS_IDS[runtime]=id ; WS_TOKENS[runtime]=auth_token (the MCP bearer)
 declare -A WS_IDS WS_TOKENS
 ALL_WS_IDS="$PARENT_ID"
+TOKEN_ERRORS=0
+TOKEN_ERROR_SUMMARY=""
 for rt in $PV_RUNTIMES; do
  R=$(tenant_call POST /workspaces \
    -d "{\"name\":\"pv-$rt\",\"runtime\":\"$rt\",\"tier\":2,\"parent_id\":\"$PARENT_ID\",\"secrets\":$SECRETS_JSON}")
  WID=$(echo "$R" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null)
+  # External-like runtimes may return connection.auth_token on create.
+  # Managed container runtimes usually return only id/status here, then
+  # receive their bearer through registry/bootstrap; for this literal MCP
+  # driver we mint through the production-safe admin token route below.
  WTOK=$(echo "$R" | extract_auth_token)
-  [ -n "$WID" ] || fail "$rt workspace create failed: $(echo \"$R\" | head -c 300)"
-  [ -n "$WTOK" ] || fail "$rt workspace create did not return an auth_token — cannot drive its MCP call (workspace_id=$WID; create_resp: $(echo \"$R\" | redact_token_body))"
+  [ -n "$WID" ] || fail "$rt workspace create failed: $(echo "$R" | head -c 300)"
+  TOKEN_DIAG=""
+  if [ -z "$WTOK" ]; then
+    TTOK_FILE=$(mktemp)
+    TTOK_CODE=$(tenant_call_capture POST "/admin/workspaces/$WID/tokens" "$TTOK_FILE" 2>/dev/null || echo "curl_error")
+    TTOK_RESP=$(cat "$TTOK_FILE" 2>/dev/null || true)
+    WTOK=$(echo "$TTOK_RESP" | extract_auth_token)
+    TOKEN_DIAG="POST /admin/workspaces/$WID/tokens -> HTTP $TTOK_CODE body: $(echo "$TTOK_RESP" | redact_token_body)"
+    rm -f "$TTOK_FILE"
+  fi
  WS_IDS[$rt]="$WID"
+  if [ -z "$WTOK" ]; then
+    TOKEN_ERRORS=$((TOKEN_ERRORS + 1))
+    TOKEN_ERROR_SUMMARY="${TOKEN_ERROR_SUMMARY}
+[$rt] workspace did not return or mint an auth_token — cannot drive its MCP call (workspace_id=$WID; create_resp: $(echo "$R" | redact_token_body); token_fallbacks: $TOKEN_DIAG)"
+    log "    $rt → $WID (token acquisition failed; continuing to classify other runtimes)"
+    continue
+  fi
  WS_TOKENS[$rt]="$WTOK"
  ALL_WS_IDS="$ALL_WS_IDS $WID"
  log "    $rt → $WID"
 done

+if [ "$TOKEN_ERRORS" -gt 0 ]; then
+  fail "token acquisition failed for $TOKEN_ERRORS runtime(s):$TOKEN_ERROR_SUMMARY"
+fi
+
 if [ "${PV_TOKEN_DIAGNOSTIC_ONLY:-0}" = "1" ]; then
  ok "token diagnostic passed for runtimes: $PV_RUNTIMES"
  exit 0
@@ -188,9 +188,8 @@ import json, os
 print(json.dumps({'CLAUDE_CODE_OAUTH_TOKEN': os.environ['CLAUDE_CODE_OAUTH_TOKEN']}))
 ")
  local resp wsid
-  # model required (CTO 2026-05-22 SSOT) — pass the deleted DefaultModel("claude-code") value.
  resp=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-    -d "{\"name\":\"Priority E2E (claude-code)\",\"runtime\":\"claude-code\",\"model\":\"sonnet\",\"tier\":1,\"secrets\":$secrets}")
+    -d "{\"name\":\"Priority E2E (claude-code)\",\"runtime\":\"claude-code\",\"tier\":1,\"secrets\":$secrets}")
  wsid=$(echo "$resp" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))') || true
  if [ -z "$wsid" ]; then
    fail "create claude-code workspace" "$resp"
@@ -381,9 +380,8 @@ import json, os
 print(json.dumps({'GEMINI_API_KEY': os.environ['E2E_GEMINI_API_KEY']}))
 ")
  local resp wsid
-  # model required (CTO 2026-05-22 SSOT) — gemini-cli routes via the gemini provider.
  resp=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-    -d "{\"name\":\"Priority E2E (gemini-cli)\",\"runtime\":\"gemini-cli\",\"model\":\"gemini-2.0-flash\",\"tier\":1,\"secrets\":$secrets}")
+    -d "{\"name\":\"Priority E2E (gemini-cli)\",\"runtime\":\"gemini-cli\",\"tier\":1,\"secrets\":$secrets}")
  wsid=$(echo "$resp" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))') || true
  if [ -z "$wsid" ]; then fail "create gemini-cli workspace" "$resp"; return 0; fi
  CREATED_WSIDS+=("$wsid")
@@ -1,26 +1,3 @@
-// Package main runs the per-tenant workspace-server.
-//
-//	@title			Molecule AI Workspace Server API
-//	@version		1.0
-//	@description	The per-tenant workspace-server HTTP API. Single source of truth for workspace/schedule/agent/secrets/files/memory CRUD. Hand-written clients (canvas, molecule-mcp-server, molecule-cli, molecule-sdk-python) should be replaced by clients generated from this spec — see RFC #1706.
-//	@host			api.moleculesai.app
-//	@BasePath		/
-//	@schemes		https
-//
-//	@securityDefinitions.apikey	BearerAuth
-//	@in							header
-//	@name						Authorization
-//	@description				Bearer token issued by Gitea (org-admin or persona PAT) or by the platform's signup/SSO flow.
-//
-//	@securityDefinitions.apikey	OrgSlugAuth
-//	@in							header
-//	@name						X-Molecule-Org-Slug
-//	@description				Tenant routing header — required on every /workspaces/{id}/* request so the platform edge can route to the correct per-tenant workspace-server. Either X-Molecule-Org-Slug (human-readable, e.g. "agents-team") or X-Molecule-Org-Id (UUID) must be sent; slug is preferred for client code.
-//
-//	@securityDefinitions.apikey	OrgIdAuth
-//	@in							header
-//	@name						X-Molecule-Org-Id
-//	@description				Tenant routing header (UUID form). Alternative to X-Molecule-Org-Slug. At least one of OrgSlugAuth or OrgIdAuth must be sent alongside BearerAuth.
 package main

 import (
@@ -393,9 +370,8 @@ func main() {
 	// See molecule-core#7.
 	bindHost := resolveBindHost()
 	srv := &http.Server{
-		Addr:              fmt.Sprintf("%s:%s", bindHost, port),
-		Handler:           r,
-		ReadHeaderTimeout: 5 * time.Second,
+		Addr:    fmt.Sprintf("%s:%s", bindHost, port),
+		Handler: r,
 	}

 	// Start server in goroutine
@@ -1,521 +0,0 @@
-{
-    "schemes": [
-        "https"
-    ],
-    "swagger": "2.0",
-    "info": {
-        "description": "The per-tenant workspace-server HTTP API. Single source of truth for workspace/schedule/agent/secrets/files/memory CRUD. Hand-written clients (canvas, molecule-mcp-server, molecule-cli, molecule-sdk-python) should be replaced by clients generated from this spec — see RFC #1706.",
-        "title": "Molecule AI Workspace Server API",
-        "contact": {},
-        "version": "1.0"
-    },
-    "host": "api.moleculesai.app",
-    "basePath": "/",
-    "paths": {
-        "/workspaces/{id}/schedules": {
-            "get": {
-                "security": [
-                    {
-                        "BearerAuth": [],
-                        "OrgSlugAuth": []
-                    }
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "schedules"
-                ],
-                "summary": "List schedules for a workspace",
-                "parameters": [
-                    {
-                        "type": "string",
-                        "description": "Workspace ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "type": "array",
-                            "items": {
-                                "$ref": "#/definitions/handlers.ScheduleResponse"
-                            }
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    }
-                }
-            },
-            "post": {
-                "security": [
-                    {
-                        "BearerAuth": [],
-                        "OrgSlugAuth": []
-                    }
-                ],
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "schedules"
-                ],
-                "summary": "Create a schedule",
-                "parameters": [
-                    {
-                        "type": "string",
-                        "description": "Workspace ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
-                    },
-                    {
-                        "description": "Schedule fields",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/handlers.CreateScheduleRequest"
-                        }
-                    }
-                ],
-                "responses": {
-                    "201": {
-                        "description": "Created",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.CreateScheduleResponse"
-                        }
-                    },
-                    "400": {
-                        "description": "Bad Request",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    }
-                }
-            }
-        },
-        "/workspaces/{id}/schedules/{scheduleId}": {
-            "delete": {
-                "security": [
-                    {
-                        "BearerAuth": [],
-                        "OrgSlugAuth": []
-                    }
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "schedules"
-                ],
-                "summary": "Delete a schedule",
-                "parameters": [
-                    {
-                        "type": "string",
-                        "description": "Workspace ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
-                    },
-                    {
-                        "type": "string",
-                        "description": "Schedule ID",
-                        "name": "scheduleId",
-                        "in": "path",
-                        "required": true
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.StatusResponse"
-                        }
-                    },
-                    "404": {
-                        "description": "Not Found",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    }
-                }
-            },
-            "patch": {
-                "security": [
-                    {
-                        "BearerAuth": [],
-                        "OrgSlugAuth": []
-                    }
-                ],
-                "consumes": [
-                    "application/json"
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "schedules"
-                ],
-                "summary": "Update a schedule",
-                "parameters": [
-                    {
-                        "type": "string",
-                        "description": "Workspace ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
-                    },
-                    {
-                        "type": "string",
-                        "description": "Schedule ID",
-                        "name": "scheduleId",
-                        "in": "path",
-                        "required": true
-                    },
-                    {
-                        "description": "Partial schedule fields (only provided keys are updated)",
-                        "name": "body",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/handlers.UpdateScheduleRequest"
-                        }
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ScheduleResponse"
-                        }
-                    },
-                    "400": {
-                        "description": "Bad Request",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    },
-                    "404": {
-                        "description": "Not Found",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    }
-                }
-            }
-        },
-        "/workspaces/{id}/schedules/{scheduleId}/history": {
-            "get": {
-                "security": [
-                    {
-                        "BearerAuth": [],
-                        "OrgSlugAuth": []
-                    }
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "schedules"
-                ],
-                "summary": "Get past runs of a schedule",
-                "parameters": [
-                    {
-                        "type": "string",
-                        "description": "Workspace ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
-                    },
-                    {
-                        "type": "string",
-                        "description": "Schedule ID",
-                        "name": "scheduleId",
-                        "in": "path",
-                        "required": true
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "type": "array",
-                            "items": {
-                                "$ref": "#/definitions/handlers.HistoryEntry"
-                            }
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    }
-                }
-            }
-        },
-        "/workspaces/{id}/schedules/{scheduleId}/run": {
-            "post": {
-                "security": [
-                    {
-                        "BearerAuth": [],
-                        "OrgSlugAuth": []
-                    }
-                ],
-                "produces": [
-                    "application/json"
-                ],
-                "tags": [
-                    "schedules"
-                ],
-                "summary": "Fire a schedule manually",
-                "parameters": [
-                    {
-                        "type": "string",
-                        "description": "Workspace ID",
-                        "name": "id",
-                        "in": "path",
-                        "required": true
-                    },
-                    {
-                        "type": "string",
-                        "description": "Schedule ID",
-                        "name": "scheduleId",
-                        "in": "path",
-                        "required": true
-                    }
-                ],
-                "responses": {
-                    "200": {
-                        "description": "OK",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.RunNowResponse"
-                        }
-                    },
-                    "404": {
-                        "description": "Not Found",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    },
-                    "500": {
-                        "description": "Internal Server Error",
-                        "schema": {
-                            "$ref": "#/definitions/handlers.ErrorResponse"
-                        }
-                    }
-                }
-            }
-        }
-    },
-    "definitions": {
-        "handlers.CreateScheduleRequest": {
-            "type": "object",
-            "required": [
-                "cron_expr",
-                "prompt"
-            ],
-            "properties": {
-                "cron_expr": {
-                    "type": "string"
-                },
-                "enabled": {
-                    "type": "boolean"
-                },
-                "name": {
-                    "type": "string"
-                },
-                "prompt": {
-                    "type": "string"
-                },
-                "timezone": {
-                    "type": "string"
-                }
-            }
-        },
-        "handlers.CreateScheduleResponse": {
-            "type": "object",
-            "properties": {
-                "id": {
-                    "type": "string"
-                },
-                "next_run_at": {
-                    "type": "string"
-                },
-                "status": {
-                    "type": "string"
-                }
-            }
-        },
-        "handlers.ErrorResponse": {
-            "type": "object",
-            "properties": {
-                "error": {
-                    "type": "string"
-                }
-            }
-        },
-        "handlers.HistoryEntry": {
-            "type": "object",
-            "properties": {
-                "duration_ms": {
-                    "type": "integer"
-                },
-                "error_detail": {
-                    "type": "string"
-                },
-                "request": {
-                    "type": "object"
-                },
-                "status": {
-                    "type": "string"
-                },
-                "timestamp": {
-                    "type": "string"
-                }
-            }
-        },
-        "handlers.RunNowResponse": {
-            "type": "object",
-            "properties": {
-                "prompt": {
-                    "type": "string"
-                },
-                "status": {
-                    "type": "string"
-                },
-                "workspace_id": {
-                    "type": "string"
-                }
-            }
-        },
-        "handlers.ScheduleResponse": {
-            "type": "object",
-            "properties": {
-                "created_at": {
-                    "type": "string"
-                },
-                "cron_expr": {
-                    "type": "string"
-                },
-                "enabled": {
-                    "type": "boolean"
-                },
-                "id": {
-                    "type": "string"
-                },
-                "last_error": {
-                    "type": "string"
-                },
-                "last_run_at": {
-                    "type": "string"
-                },
-                "last_status": {
-                    "type": "string"
-                },
-                "name": {
-                    "type": "string"
-                },
-                "next_run_at": {
-                    "type": "string"
-                },
-                "prompt": {
-                    "type": "string"
-                },
-                "run_count": {
-                    "type": "integer"
-                },
-                "source": {
-                    "description": "'template' (seeded by org/import) | 'runtime' (created via Canvas/API). Issue #24.",
-                    "type": "string"
-                },
-                "timezone": {
-                    "type": "string"
-                },
-                "updated_at": {
-                    "type": "string"
-                },
-                "workspace_id": {
-                    "type": "string"
-                }
-            }
-        },
-        "handlers.StatusResponse": {
-            "type": "object",
-            "properties": {
-                "status": {
-                    "type": "string"
-                }
-            }
-        },
-        "handlers.UpdateScheduleRequest": {
-            "type": "object",
-            "properties": {
-                "cron_expr": {
-                    "type": "string"
-                },
-                "enabled": {
-                    "type": "boolean"
-                },
-                "name": {
-                    "type": "string"
-                },
-                "prompt": {
-                    "type": "string"
-                },
-                "timezone": {
-                    "type": "string"
-                }
-            }
-        }
-    },
-    "securityDefinitions": {
-        "BearerAuth": {
-            "description": "Bearer token issued by Gitea (org-admin or persona PAT) or by the platform's signup/SSO flow.",
-            "type": "apiKey",
-            "name": "Authorization",
-            "in": "header"
-        },
-        "OrgIdAuth": {
-            "description": "Tenant routing header (UUID form). Alternative to X-Molecule-Org-Slug. At least one of OrgSlugAuth or OrgIdAuth must be sent alongside BearerAuth.",
-            "type": "apiKey",
-            "name": "X-Molecule-Org-Id",
-            "in": "header"
-        },
-        "OrgSlugAuth": {
-            "description": "Tenant routing header — required on every /workspaces/{id}/* request so the platform edge can route to the correct per-tenant workspace-server. Either X-Molecule-Org-Slug (human-readable, e.g. \"agents-team\") or X-Molecule-Org-Id (UUID) must be sent; slug is preferred for client code.",
-            "type": "apiKey",
-            "name": "X-Molecule-Org-Slug",
-            "in": "header"
-        }
-    }
-}
@@ -1,349 +0,0 @@
-basePath: /
-definitions:
-  handlers.CreateScheduleRequest:
-    properties:
-      cron_expr:
-        type: string
-      enabled:
-        type: boolean
-      name:
-        type: string
-      prompt:
-        type: string
-      timezone:
-        type: string
-    required:
-    - cron_expr
-    - prompt
-    type: object
-  handlers.CreateScheduleResponse:
-    properties:
-      id:
-        type: string
-      next_run_at:
-        type: string
-      status:
-        type: string
-    type: object
-  handlers.ErrorResponse:
-    properties:
-      error:
-        type: string
-    type: object
-  handlers.HistoryEntry:
-    properties:
-      duration_ms:
-        type: integer
-      error_detail:
-        type: string
-      request:
-        type: object
-      status:
-        type: string
-      timestamp:
-        type: string
-    type: object
-  handlers.RunNowResponse:
-    properties:
-      prompt:
-        type: string
-      status:
-        type: string
-      workspace_id:
-        type: string
-    type: object
-  handlers.ScheduleResponse:
-    properties:
-      created_at:
-        type: string
-      cron_expr:
-        type: string
-      enabled:
-        type: boolean
-      id:
-        type: string
-      last_error:
-        type: string
-      last_run_at:
-        type: string
-      last_status:
-        type: string
-      name:
-        type: string
-      next_run_at:
-        type: string
-      prompt:
-        type: string
-      run_count:
-        type: integer
-      source:
-        description: '''template'' (seeded by org/import) | ''runtime'' (created via
-          Canvas/API). Issue #24.'
-        type: string
-      timezone:
-        type: string
-      updated_at:
-        type: string
-      workspace_id:
-        type: string
-    type: object
-  handlers.StatusResponse:
-    properties:
-      status:
-        type: string
-    type: object
-  handlers.UpdateScheduleRequest:
-    properties:
-      cron_expr:
-        type: string
-      enabled:
-        type: boolean
-      name:
-        type: string
-      prompt:
-        type: string
-      timezone:
-        type: string
-    type: object
-host: api.moleculesai.app
-info:
-  contact: {}
-  description: 'The per-tenant workspace-server HTTP API. Single source of truth for
-    workspace/schedule/agent/secrets/files/memory CRUD. Hand-written clients (canvas,
-    molecule-mcp-server, molecule-cli, molecule-sdk-python) should be replaced by
-    clients generated from this spec — see RFC #1706.'
-  title: Molecule AI Workspace Server API
-  version: "1.0"
-paths:
-  /workspaces/{id}/schedules:
-    get:
-      parameters:
-      - description: Workspace ID
-        in: path
-        name: id
-        required: true
-        type: string
-      produces:
-      - application/json
-      responses:
-        "200":
-          description: OK
-          schema:
-            items:
-              $ref: '#/definitions/handlers.ScheduleResponse'
-            type: array
-        "500":
-          description: Internal Server Error
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-      security:
-      - BearerAuth: []
-        OrgSlugAuth: []
-      summary: List schedules for a workspace
-      tags:
-      - schedules
-    post:
-      consumes:
-      - application/json
-      parameters:
-      - description: Workspace ID
-        in: path
-        name: id
-        required: true
-        type: string
-      - description: Schedule fields
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/handlers.CreateScheduleRequest'
-      produces:
-      - application/json
-      responses:
-        "201":
-          description: Created
-          schema:
-            $ref: '#/definitions/handlers.CreateScheduleResponse'
-        "400":
-          description: Bad Request
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-        "500":
-          description: Internal Server Error
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-      security:
-      - BearerAuth: []
-        OrgSlugAuth: []
-      summary: Create a schedule
-      tags:
-      - schedules
-  /workspaces/{id}/schedules/{scheduleId}:
-    delete:
-      parameters:
-      - description: Workspace ID
-        in: path
-        name: id
-        required: true
-        type: string
-      - description: Schedule ID
-        in: path
-        name: scheduleId
-        required: true
-        type: string
-      produces:
-      - application/json
-      responses:
-        "200":
-          description: OK
-          schema:
-            $ref: '#/definitions/handlers.StatusResponse'
-        "404":
-          description: Not Found
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-        "500":
-          description: Internal Server Error
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-      security:
-      - BearerAuth: []
-        OrgSlugAuth: []
-      summary: Delete a schedule
-      tags:
-      - schedules
-    patch:
-      consumes:
-      - application/json
-      parameters:
-      - description: Workspace ID
-        in: path
-        name: id
-        required: true
-        type: string
-      - description: Schedule ID
-        in: path
-        name: scheduleId
-        required: true
-        type: string
-      - description: Partial schedule fields (only provided keys are updated)
-        in: body
-        name: body
-        required: true
-        schema:
-          $ref: '#/definitions/handlers.UpdateScheduleRequest'
-      produces:
-      - application/json
-      responses:
-        "200":
-          description: OK
-          schema:
-            $ref: '#/definitions/handlers.ScheduleResponse'
-        "400":
-          description: Bad Request
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-        "404":
-          description: Not Found
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-        "500":
-          description: Internal Server Error
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-      security:
-      - BearerAuth: []
-        OrgSlugAuth: []
-      summary: Update a schedule
-      tags:
-      - schedules
-  /workspaces/{id}/schedules/{scheduleId}/history:
-    get:
-      parameters:
-      - description: Workspace ID
-        in: path
-        name: id
-        required: true
-        type: string
-      - description: Schedule ID
-        in: path
-        name: scheduleId
-        required: true
-        type: string
-      produces:
-      - application/json
-      responses:
-        "200":
-          description: OK
-          schema:
-            items:
-              $ref: '#/definitions/handlers.HistoryEntry'
-            type: array
-        "500":
-          description: Internal Server Error
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-      security:
-      - BearerAuth: []
-        OrgSlugAuth: []
-      summary: Get past runs of a schedule
-      tags:
-      - schedules
-  /workspaces/{id}/schedules/{scheduleId}/run:
-    post:
-      parameters:
-      - description: Workspace ID
-        in: path
-        name: id
-        required: true
-        type: string
-      - description: Schedule ID
-        in: path
-        name: scheduleId
-        required: true
-        type: string
-      produces:
-      - application/json
-      responses:
-        "200":
-          description: OK
-          schema:
-            $ref: '#/definitions/handlers.RunNowResponse'
-        "404":
-          description: Not Found
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-        "500":
-          description: Internal Server Error
-          schema:
-            $ref: '#/definitions/handlers.ErrorResponse'
-      security:
-      - BearerAuth: []
-        OrgSlugAuth: []
-      summary: Fire a schedule manually
-      tags:
-      - schedules
-schemes:
- https
-securityDefinitions:
-  BearerAuth:
-    description: Bearer token issued by Gitea (org-admin or persona PAT) or by the
-      platform's signup/SSO flow.
-    in: header
-    name: Authorization
-    type: apiKey
-  OrgIdAuth:
-    description: Tenant routing header (UUID form). Alternative to X-Molecule-Org-Slug.
-      At least one of OrgSlugAuth or OrgIdAuth must be sent alongside BearerAuth.
-    in: header
-    name: X-Molecule-Org-Id
-    type: apiKey
-  OrgSlugAuth:
-    description: Tenant routing header — required on every /workspaces/{id}/* request
-      so the platform edge can route to the correct per-tenant workspace-server. Either
-      X-Molecule-Org-Slug (human-readable, e.g. "agents-team") or X-Molecule-Org-Id
-      (UUID) must be sent; slug is preferred for client code.
-    in: header
-    name: X-Molecule-Org-Slug
-    type: apiKey
-swagger: "2.0"
@@ -116,11 +116,8 @@ func (d *DiscordAdapter) SendMessage(ctx context.Context, config map[string]inte
 			// would propagate that token into logs and error responses (#659).
 			return fmt.Errorf("discord: HTTP request failed")
 		}
-		body, readErr := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
 		_ = resp.Body.Close()
-		if readErr != nil {
-			return fmt.Errorf("discord: read response body: %w", readErr)
-		}

 		// Discord returns 204 No Content on success.
 		if resp.StatusCode != http.StatusNoContent && resp.StatusCode != http.StatusOK {
@@ -119,10 +119,7 @@ func (l *LarkAdapter) SendMessage(ctx context.Context, config map[string]interfa
 	}
 	defer func() { _ = resp.Body.Close() }()

-	body, readErr := io.ReadAll(resp.Body)
-	if readErr != nil {
-		return fmt.Errorf("lark: read response body: %w", readErr)
-	}
+	body, _ := io.ReadAll(resp.Body)
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("lark: webhook returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
 	}
@@ -156,9 +156,6 @@ func (m *Manager) PausePollersForToken(workspaceID, botToken string) func() {
 			}
 		}
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Channels: pause-pollers rows.Err: %v", err)
-	}
 	m.mu.Unlock()

 	if len(pausedIDs) == 0 {
@@ -207,16 +204,8 @@ func (m *Manager) Reload(ctx context.Context) {
 			log.Printf("Channels: reload scan error: %v", err)
 			continue
 		}
-		if err := json.Unmarshal(configJSON, &ch.Config); err != nil {
-			log.Printf("Channels: reload config unmarshal error for %s: %v", truncID(ch.ID), err)
-			continue
-		}
-		if len(allowedJSON) > 0 {
-			if err := json.Unmarshal(allowedJSON, &ch.AllowedUsers); err != nil {
-				log.Printf("Channels: reload allowed_users unmarshal error for %s: %v", truncID(ch.ID), err)
-				continue
-			}
-		}
+		_ = json.Unmarshal(configJSON, &ch.Config)
+		_ = json.Unmarshal(allowedJSON, &ch.AllowedUsers)
 		// #319: decrypt at the boundary between DB (ciphertext) and the
 		// in-memory config adapters consume. A decrypt failure logs and
 		// skips the channel — downstream getUpdates would fail anyway
@@ -227,9 +216,6 @@ func (m *Manager) Reload(ctx context.Context) {
 		}
 		desired[ch.ID] = ch
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Channels: reload rows.Err: %v", err)
-	}

 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -487,9 +473,6 @@ func (m *Manager) BroadcastToWorkspaceChannels(ctx context.Context, workspaceID,
 			}
 		}
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Channels: broadcast rows.Err: %v", err)
-	}
 }

 // FetchWorkspaceChannelContext returns recent Slack channel messages formatted
@@ -572,14 +555,8 @@ func (m *Manager) loadChannel(ctx context.Context, channelID string) (ChannelRow
 	if err != nil {
 		return ch, fmt.Errorf("channel %s not found: %w", channelID, err)
 	}
-	if err := json.Unmarshal(configJSON, &ch.Config); err != nil {
-		return ch, fmt.Errorf("channel %s config unmarshal: %w", channelID, err)
-	}
-	if len(allowedJSON) > 0 {
-		if err := json.Unmarshal(allowedJSON, &ch.AllowedUsers); err != nil {
-			return ch, fmt.Errorf("channel %s allowed_users unmarshal: %w", channelID, err)
-		}
-	}
+	json.Unmarshal(configJSON, &ch.Config)
+	json.Unmarshal(allowedJSON, &ch.AllowedUsers)
 	// #319: decrypt bot_token / webhook_secret — SendOutbound and adapter
 	// methods downstream read them as plaintext strings.
 	if err := DecryptSensitiveFields(ch.Config); err != nil {
@@ -171,11 +171,8 @@ func (s *SlackAdapter) sendBotMessage(ctx context.Context, config map[string]int
 		if err != nil {
 			return fmt.Errorf("slack: send: %w", err)
 		}
-		respBody, readErr := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
 		_ = resp.Body.Close()
-		if readErr != nil {
-			return fmt.Errorf("slack: read response body: %w", readErr)
-		}
 		var result struct {
 			OK    bool   `json:"ok"`
 			Error string `json:"error"`
@@ -211,13 +208,9 @@ func (s *SlackAdapter) sendWebhookMessage(ctx context.Context, config map[string
 	if err != nil {
 		return fmt.Errorf("slack: send: %w", err)
 	}
-	defer func() { _ = resp.Body.Close() }()

 	if resp.StatusCode != http.StatusOK {
-		body, readErr := io.ReadAll(resp.Body)
-		if readErr != nil {
-			return fmt.Errorf("slack: webhook returned %d (read body failed: %v)", resp.StatusCode, readErr)
-		}
+		body, _ := io.ReadAll(resp.Body)
 		return fmt.Errorf("slack: webhook returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
 	}
 	return nil
@@ -531,11 +524,8 @@ func FetchChannelHistory(ctx context.Context, botToken, channelID string, limit
 	if err != nil {
 		return nil, err
 	}
-	body, readErr := io.ReadAll(io.LimitReader(resp.Body, 65536))
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 65536))
 	_ = resp.Body.Close()
-	if readErr != nil {
-		return nil, fmt.Errorf("slack: read history response: %w", readErr)
-	}

 	var result struct {
 		OK       bool                  `json:"ok"`
@@ -228,7 +228,7 @@ func (e *proxyA2AError) Error() string {
 // cron scheduler and other internal callers that need to send A2A messages
 // to workspaces programmatically (not from an HTTP handler).
 func (h *WorkspaceHandler) ProxyA2ARequest(ctx context.Context, workspaceID string, body []byte, callerID string, logActivity bool) (int, []byte, error) {
-	status, resp, proxyErr := h.proxyA2ARequest(ctx, workspaceID, body, callerID, logActivity, false)
+	status, resp, proxyErr := h.proxyA2ARequest(ctx, workspaceID, body, callerID, logActivity)
 	if proxyErr != nil {
 		return status, resp, proxyErr
 	}
@@ -307,21 +307,13 @@ func (h *WorkspaceHandler) ProxyA2A(c *gin.Context) {
 	// The bind is strict: the token must match `callerID`, not
 	// `workspaceID` (the target). A compromised token from workspace A
 	// must never authenticate calls from A pretending to be B.
-	//
-	// Post-RFC#637: canvas users now send X-Workspace-ID (their identity
-	// workspace). validateCallerToken detects canvas/admin auth on a
-	// tokenless workspace and returns isCanvasUser=true so the proxy can
-	// bypass CanCommunicate (human users sit outside the hierarchy).
-	isCanvasUser := false
-	if callerID != "" && callerID != workspaceID && !isSystemCaller(callerID) {
-		var err error
-		isCanvasUser, err = validateCallerToken(ctx, c, callerID)
-		if err != nil {
+	if callerID != "" && callerID != workspaceID {
+		if err := validateCallerToken(ctx, c, callerID); err != nil {
 			return // response already written with 401
 		}
 	}

-	status, respBody, proxyErr := h.proxyA2ARequest(ctx, workspaceID, body, callerID, true, isCanvasUser)
+	status, respBody, proxyErr := h.proxyA2ARequest(ctx, workspaceID, body, callerID, true)
 	if proxyErr != nil {
 		for k, v := range proxyErr.Headers {
 			c.Header(k, v)
@@ -360,13 +352,11 @@ func (h *WorkspaceHandler) checkWorkspaceBudget(ctx context.Context, workspaceID
 	return nil
 }

-func (h *WorkspaceHandler) proxyA2ARequest(ctx context.Context, workspaceID string, body []byte, callerID string, logActivity bool, isCanvasUser bool) (int, []byte, *proxyA2AError) {
+func (h *WorkspaceHandler) proxyA2ARequest(ctx context.Context, workspaceID string, body []byte, callerID string, logActivity bool) (int, []byte, *proxyA2AError) {
 	// Access control: workspace-to-workspace requests must pass CanCommunicate check.
 	// Canvas requests (callerID == "") and system callers (webhook:*, system:*, test:*)
 	// are trusted. Self-calls (callerID == workspaceID) are always allowed.
-	// Post-RFC#637: canvas-user identity workspaces also bypass CanCommunicate
-	// because human users sit outside the org hierarchy.
-	if callerID != "" && callerID != workspaceID && !isSystemCaller(callerID) && !isCanvasUser {
+	if callerID != "" && callerID != workspaceID && !isSystemCaller(callerID) {
 		if !registry.CanCommunicate(callerID, workspaceID) {
 			log.Printf("ProxyA2A: access denied %s → %s", callerID, workspaceID)
 			return 0, nil, &proxyA2AError{
@@ -5,21 +5,17 @@ package handlers

 import (
 	"context"
-	"crypto/subtle"
 	"database/sql"
 	"encoding/json"
 	"errors"
 	"log"
 	"net/http"
-	"os"
 	"strconv"
 	"time"

 	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
 	"github.com/Molecule-AI/molecule-monorepo/platform/internal/events"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/middleware"
 	"github.com/Molecule-AI/molecule-monorepo/platform/internal/models"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/orgtoken"
 	"github.com/Molecule-AI/molecule-monorepo/platform/internal/wsauth"
 	"github.com/gin-gonic/gin"
 )
@@ -75,30 +71,35 @@ func (h *WorkspaceHandler) handleA2ADispatchError(ctx context.Context, workspace
 	// with 202 status here was the original cycle 53 bug — callers saw
 	// proxyErr != nil and logged "delegation failed: proxy a2a error".
 	if isUpstreamBusyError(err) {
-		// #1684 / Reno Stars: native_session adapters previously took a
-		// 503-no-enqueue path here, on the assumption that the SDK owned
-		// an inbound queue and the platform a2a_queue would double-buffer.
-		// In practice, the common native_session SDKs (claude-agent-sdk,
-		// codex app-server, hermes-agent) do NOT have an inbound queue —
-		// new turns can only be pushed via the same HTTP POST that just
-		// returned busy. So cron fires (and any A2A retry) bounce 503
-		// every tick until the SDK voluntarily yields. Reno Stars #1684
-		// observed 12 consecutive `*/30` cron fires lost over 6h while a
-		// single native_session held the slot.
+		// Capability primitive #5 — see project memory
+		// `project_runtime_native_pluggable.md`. When the target workspace's
+		// adapter has declared provides_native_session=True, the SDK
+		// owns its own queue/session state (claude-agent-sdk's streaming
+		// session, hermes-agent's in-container event log, etc.). Adding
+		// the platform's a2a_queue layer on top would double-buffer the
+		// same in-flight state — and worse, the platform queue's drain
+		// timing has no relationship to the SDK's actual readiness, so
+		// the queued request might dispatch while the SDK is STILL busy.
 		//
-		// The original concern — "drain timing has no relationship to SDK
-		// readiness" — turns out to be unfounded: heartbeat→drain is
-		// gated by `payload.ActiveTasks < maxConcurrent` in
-		// registry.go:Heartbeat, so drain only fires when the workspace
-		// itself reports spare capacity. That IS the session-ended
-		// signal. The native_session SDK reports ActiveTasks=1 while in a
-		// turn, ActiveTasks=0 when idle, and the next heartbeat after
-		// idle triggers DrainQueueForWorkspace.
-		//
-		// So we collapse the two branches: both native_session and
-		// non-native callers enqueue here. The native_session SDK's own
-		// in-flight POST stays unaffected; the queued item drains on the
-		// next post-idle heartbeat.
+		// For native_session targets, return 503 + Retry-After directly.
+		// The caller's adapter handles retry on its own schedule, and
+		// the SDK's own queue absorbs the in-flight request when it does.
+		// Observability is preserved: logA2AFailure already ran above;
+		// activity_logs records the busy event; the broadcaster fires.
+		if runtimeOverrides.HasCapability(workspaceID, "session") {
+			log.Printf("ProxyA2A: target %s busy and declares native_session — skip enqueue, return 503", workspaceID)
+			return 0, nil, &proxyA2AError{
+				Status:  http.StatusServiceUnavailable,
+				Headers: map[string]string{"Retry-After": strconv.Itoa(busyRetryAfterSeconds)},
+				Response: gin.H{
+					"error":          "workspace agent busy — adapter handles retry (native_session)",
+					"busy":           true,
+					"retry_after":    busyRetryAfterSeconds,
+					"native_session": true,
+				},
+			}
+		}
+
 		idempotencyKey := extractIdempotencyKey(body)
 		// Honor params.expires_in_seconds when the caller specifies one. Zero
 		// (the unset default) → expiresAt = nil → infinite TTL preserved by
@@ -387,53 +388,31 @@ func nilIfEmpty(s string) *string {
 // (their next /registry/register will mint their first token, after
 // which this branch never fires again for them).
 //
-// Post-RFC#637 addition: when the tokenless workspace is accompanied by
-// canvas or admin auth (same-origin request, admin bearer, or org-level
-// token), the caller is identified as a canvas-user identity rather than
-// a legacy peer agent. The returned isCanvasUser flag lets the A2A proxy
-// bypass CanCommunicate for human users, who sit outside the workspace
-// hierarchy.
-//
 // On auth failure this writes the 401 via c and returns an error so the
 // handler aborts without running the proxy.
-func validateCallerToken(ctx context.Context, c *gin.Context, callerID string) (isCanvasUser bool, err error) {
-	hasLive, dbErr := wsauth.HasAnyLiveToken(ctx, db.DB, callerID)
-	if dbErr != nil {
+func validateCallerToken(ctx context.Context, c *gin.Context, callerID string) error {
+	hasLive, err := wsauth.HasAnyLiveToken(ctx, db.DB, callerID)
+	if err != nil {
 		// Fail-open here matches the heartbeat path — A2A caller auth is
 		// defense-in-depth on top of access-control hierarchy, not the
 		// sole gate on the secret material. A DB hiccup shouldn't take
 		// the whole A2A path down.
-		log.Printf("wsauth: caller HasAnyLiveToken(%s) failed: %v — allowing A2A", callerID, dbErr)
-		return false, nil
+		log.Printf("wsauth: caller HasAnyLiveToken(%s) failed: %v — allowing A2A", callerID, err)
+		return nil
 	}
 	if !hasLive {
-		// Tokenless workspace — could be legacy/pre-upgrade caller or
-		// canvas-user identity. Distinguish by request auth signals.
-		if middleware.IsSameOriginCanvas(c) {
-			return true, nil
-		}
-		tok := wsauth.BearerTokenFromHeader(c.GetHeader("Authorization"))
-		if tok != "" {
-			adminSecret := os.Getenv("ADMIN_TOKEN")
-			if adminSecret != "" && subtle.ConstantTimeCompare([]byte(tok), []byte(adminSecret)) == 1 {
-				return true, nil
-			}
-			if _, _, _, err := orgtoken.Validate(ctx, db.DB, tok); err == nil {
-				return true, nil
-			}
-		}
-		return false, nil // legacy / pre-upgrade caller
+		return nil // legacy / pre-upgrade caller
 	}
 	tok := wsauth.BearerTokenFromHeader(c.GetHeader("Authorization"))
 	if tok == "" {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing caller auth token"})
-		return false, errInvalidCallerToken
+		return errInvalidCallerToken
 	}
 	if err := wsauth.ValidateToken(ctx, db.DB, callerID, tok); err != nil {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid caller auth token"})
-		return false, err
+		return err
 	}
-	return false, nil
+	return nil
 }

 // errInvalidCallerToken is a sentinel for validateCallerToken's "missing
@@ -1112,13 +1112,9 @@ func TestValidateCallerToken_LegacyCallerGrandfathered(t *testing.T) {
 	c, _ := gin.CreateTestContext(w)
 	c.Request = httptest.NewRequest("POST", "/workspaces/x/a2a", bytes.NewBufferString("{}"))

-	isCanvasUser, err := validateCallerToken(context.Background(), c, "ws-legacy")
-	if err != nil {
+	if err := validateCallerToken(context.Background(), c, "ws-legacy"); err != nil {
 		t.Errorf("legacy caller should grandfather through; got %v", err)
 	}
-	if isCanvasUser {
-		t.Errorf("legacy caller should NOT be identified as canvas user")
-	}
 	if w.Code != 200 {
 		// gin default before c.JSON is 200; we want no error response written
 		if w.Body.Len() != 0 {
@@ -1140,13 +1136,10 @@ func TestValidateCallerToken_MissingTokenWhenOnFile(t *testing.T) {
 	c.Request = httptest.NewRequest("POST", "/workspaces/x/a2a", bytes.NewBufferString("{}"))
 	// No Authorization header set

-	isCanvasUser, err := validateCallerToken(context.Background(), c, "ws-authed")
+	err := validateCallerToken(context.Background(), c, "ws-authed")
 	if err == nil {
 		t.Fatal("expected error for missing token")
 	}
-	if isCanvasUser {
-		t.Errorf("authed workspace with missing token should NOT be canvas user")
-	}
 	if w.Code != http.StatusUnauthorized {
 		t.Errorf("expected 401, got %d", w.Code)
 	}
@@ -1171,13 +1164,9 @@ func TestValidateCallerToken_InvalidToken(t *testing.T) {
 	req.Header.Set("Authorization", "Bearer wrong")
 	c.Request = req

-	isCanvasUser, err := validateCallerToken(context.Background(), c, "ws-authed")
-	if err == nil {
+	if err := validateCallerToken(context.Background(), c, "ws-authed"); err == nil {
 		t.Fatal("expected error for bad token")
 	}
-	if isCanvasUser {
-		t.Errorf("authed workspace with bad token should NOT be canvas user")
-	}
 	if w.Code != http.StatusUnauthorized {
 		t.Errorf("expected 401, got %d", w.Code)
 	}
@@ -1203,13 +1192,9 @@ func TestValidateCallerToken_ValidToken(t *testing.T) {
 	req.Header.Set("Authorization", "Bearer goodtok")
 	c.Request = req

-	isCanvasUser, err := validateCallerToken(context.Background(), c, "ws-authed")
-	if err != nil {
+	if err := validateCallerToken(context.Background(), c, "ws-authed"); err != nil {
 		t.Errorf("valid token should pass; got %v", err)
 	}
-	if isCanvasUser {
-		t.Errorf("authed workspace with valid token should NOT be canvas user")
-	}
 }

 func TestValidateCallerToken_WrongWorkspaceBindingRejected(t *testing.T) {
@@ -1231,86 +1216,14 @@ func TestValidateCallerToken_WrongWorkspaceBindingRejected(t *testing.T) {
 	req.Header.Set("Authorization", "Bearer tok-for-A")
 	c.Request = req

-	isCanvasUser, err := validateCallerToken(context.Background(), c, "ws-b-attacker")
-	if err == nil {
+	if err := validateCallerToken(context.Background(), c, "ws-b-attacker"); err == nil {
 		t.Fatal("token from A must not authenticate caller B")
 	}
-	if isCanvasUser {
-		t.Errorf("cross-workspace token replay should NOT be identified as canvas user")
-	}
 	if w.Code != http.StatusUnauthorized {
 		t.Errorf("expected 401, got %d", w.Code)
 	}
 }

-func TestValidateCallerToken_CanvasUser_AdminToken(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-
-	// Tokenless workspace
-	mock.ExpectQuery(`SELECT COUNT\(\*\) FROM workspace_auth_tokens`).
-		WithArgs("ws-canvas-admin").
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
-
-	t.Setenv("ADMIN_TOKEN", "admin-secret-42")
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	req := httptest.NewRequest("POST", "/workspaces/x/a2a", bytes.NewBufferString("{}"))
-	req.Header.Set("Authorization", "Bearer admin-secret-42")
-	c.Request = req
-
-	isCanvasUser, err := validateCallerToken(context.Background(), c, "ws-canvas-admin")
-	if err != nil {
-		t.Errorf("admin token should identify canvas user; got error: %v", err)
-	}
-	if !isCanvasUser {
-		t.Errorf("admin token bearer should be identified as canvas user")
-	}
-	if w.Code != 200 || w.Body.Len() != 0 {
-		t.Errorf("admin token path should not write a response body; got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestValidateCallerToken_CanvasUser_OrgToken(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-
-	// Tokenless workspace
-	mock.ExpectQuery(`SELECT COUNT\(\*\) FROM workspace_auth_tokens`).
-		WithArgs("ws-canvas-org").
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
-
-	// orgtoken.Validate lookup
-	mock.ExpectQuery(`SELECT id, prefix, org_id FROM org_api_tokens WHERE token_hash = .* AND revoked_at IS NULL`).
-		WithArgs(sqlmock.AnyArg()).
-		WillReturnRows(sqlmock.NewRows([]string{"id", "prefix", "org_id"}).AddRow("orgtok-1", "pref1234", "org-1"))
-	mock.ExpectExec(`UPDATE org_api_tokens SET last_used_at`).
-		WithArgs("orgtok-1").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	req := httptest.NewRequest("POST", "/workspaces/x/a2a", bytes.NewBufferString("{}"))
-	req.Header.Set("Authorization", "Bearer org-token-plaintext-xyz")
-	c.Request = req
-
-	isCanvasUser, err := validateCallerToken(context.Background(), c, "ws-canvas-org")
-	if err != nil {
-		t.Errorf("org token should identify canvas user; got error: %v", err)
-	}
-	if !isCanvasUser {
-		t.Errorf("org token bearer should be identified as canvas user")
-	}
-	if w.Code != 200 || w.Body.Len() != 0 {
-		t.Errorf("org token path should not write a response body; got %d: %s", w.Code, w.Body.String())
-	}
-
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
 // --- Direct unit tests for normalizeA2APayload (extracted from proxyA2ARequest) ---

 func TestNormalizeA2APayload_InvalidJSON(t *testing.T) {
@@ -333,7 +333,7 @@ func (h *WorkspaceHandler) DrainQueueForWorkspace(ctx context.Context, workspace
 	}
 	// logActivity=false: the original EnqueueA2A callsite already logged
 	// the dispatch attempt; re-logging here would double-count events.
-	status, respBody, proxyErr := h.proxyA2ARequest(ctx, workspaceID, item.Body, callerID, false, false)
+	status, respBody, proxyErr := h.proxyA2ARequest(ctx, workspaceID, item.Body, callerID, false)

 	// 202 Accepted = the dispatch was itself queued again (target still busy).
 	// That's not a failure — the queued item just stays queued naturally on
@@ -39,7 +39,6 @@ func TestAdminTestToken_EnabledViaFlagEvenInProd(t *testing.T) {
 	mock := setupTestDB(t)
 	t.Setenv("MOLECULE_ENV", "production")
 	t.Setenv("MOLECULE_ENABLE_TEST_TOKENS", "1")
-	t.Setenv("ADMIN_TOKEN", "")

 	mock.ExpectQuery("SELECT id FROM workspaces WHERE id =").
 		WithArgs("ws-1").
@@ -59,7 +58,6 @@ func TestAdminTestToken_EnabledViaFlagEvenInProd(t *testing.T) {
 func TestAdminTestToken_WorkspaceNotFound(t *testing.T) {
 	mock := setupTestDB(t)
 	t.Setenv("MOLECULE_ENV", "development")
-	t.Setenv("ADMIN_TOKEN", "")

 	mock.ExpectQuery("SELECT id FROM workspaces WHERE id =").
 		WithArgs("missing").
@@ -77,7 +75,6 @@ func TestAdminTestToken_WorkspaceNotFound(t *testing.T) {
 func TestAdminTestToken_HappyPath_TokenValidates(t *testing.T) {
 	mock := setupTestDB(t)
 	t.Setenv("MOLECULE_ENV", "development")
-	t.Setenv("ADMIN_TOKEN", "")

 	mock.ExpectQuery("SELECT id FROM workspaces WHERE id =").
 		WithArgs("ws-1").
@@ -104,9 +104,6 @@ func (h *ChannelHandler) List(c *gin.Context) {
 		}
 		result = append(result, entry)
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Channels: list rows.Err: %v", err)
-	}

 	c.JSON(http.StatusOK, result)
 }
@@ -517,9 +514,6 @@ func (h *ChannelHandler) Webhook(c *gin.Context) {
 			candidates = append(candidates, row)
 		}
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Channels: telegram webhook rows.Err: %v", err)
-	}

 	if targetSlug != "" {
 		// [slug] routing — match against config username (lowercased)
@@ -389,7 +389,7 @@ func (h *DelegationHandler) executeDelegation(ctx context.Context, sourceID, tar
 	})
 	log.Printf("Delegation %s: step=proxying_a2a_request", delegationID)

-	status, respBody, proxyErr := h.workspace.proxyA2ARequest(ctx, targetID, a2aBody, sourceID, true, false)
+	status, respBody, proxyErr := h.workspace.proxyA2ARequest(ctx, targetID, a2aBody, sourceID, true)
 	log.Printf("Delegation %s: step=proxy_done status=%d bodyLen=%d err=%v", delegationID, status, len(respBody), proxyErr)

 	// When proxyA2ARequest returns an error but we have a non-empty response body
@@ -418,7 +418,7 @@ func (h *DelegationHandler) executeDelegation(ctx context.Context, sourceID, tar
 		case <-ctx.Done():
 			// outer timeout hit before retry window elapsed
 		case <-time.After(delegationRetryDelay):
-			status, respBody, proxyErr = h.workspace.proxyA2ARequest(ctx, targetID, a2aBody, sourceID, true, false)
+			status, respBody, proxyErr = h.workspace.proxyA2ARequest(ctx, targetID, a2aBody, sourceID, true)
 		}
 	}

@@ -393,9 +393,6 @@ func queryPeerMaps(query string, args ...interface{}) ([]map[string]interface{},

 		result = append(result, peer)
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("queryPeerMaps rows.Err: %v", err)
-	}
 	return result, nil
 }

@@ -49,9 +49,6 @@ func (h *EventsHandler) List(c *gin.Context) {
 			"created_at":   createdAt,
 		})
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Events list rows error: %v", err)
-	}
 	c.JSON(http.StatusOK, events)
 }

@@ -90,8 +87,5 @@ func (h *EventsHandler) ListByWorkspace(c *gin.Context) {
 			"created_at":   createdAt,
 		})
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("WorkspaceEvents list rows error: %v", err)
-	}
 	c.JSON(http.StatusOK, events)
 }
@@ -33,7 +33,7 @@ func TestWorkspaceCreate_WithParentID(t *testing.T) {
 	// Default tier is 3 (Privileged) — see workspace.go create-handler comment.
 	// delivery_mode defaults to "push" when payload omits it (#2339).
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Child Agent", nil, 3, "langgraph", sqlmock.AnyArg(), &parentID, nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "Child Agent", nil, 3, "langgraph", sqlmock.AnyArg(), &parentID, nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
@@ -44,7 +44,7 @@ func TestWorkspaceCreate_WithParentID(t *testing.T) {

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	body := `{"name":"Child Agent","model":"anthropic:claude-opus-4-7","parent_id":"parent-ws-123"}`
+	body := `{"name":"Child Agent","parent_id":"parent-ws-123"}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -69,7 +69,7 @@ func TestWorkspaceCreate_ExplicitClaudeCodeRuntime(t *testing.T) {
 	mock.ExpectBegin()
 	// delivery_mode defaults to "push" when payload omits it (#2339).
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "CC Agent", nil, 2, "claude-code", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "CC Agent", nil, 2, "claude-code", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
@@ -80,7 +80,7 @@ func TestWorkspaceCreate_ExplicitClaudeCodeRuntime(t *testing.T) {

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	body := `{"name":"CC Agent","tier":2,"runtime":"claude-code","model":"sonnet","canvas":{"x":10,"y":20}}`
+	body := `{"name":"CC Agent","tier":2,"runtime":"claude-code","canvas":{"x":10,"y":20}}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -230,7 +230,7 @@ func TestWorkspaceList_WithData(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())

-	// 24 cols — compute added after talk_to_user_enabled.
+	// 23 cols — broadcast_enabled + talk_to_user_enabled added after monthly_spend
 	// (migration 20260514). Column order must match scanWorkspaceRow exactly.
 	columns := []string{
 		"id", "name", "role", "tier", "status", "agent_card", "url",
@@ -238,13 +238,13 @@ func TestWorkspaceList_WithData(t *testing.T) {
 		"last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	rows := sqlmock.NewRows(columns).
 		AddRow("ws-1", "Agent One", "worker", 1, "online", []byte(`{"name":"agent1"}`), "http://localhost:8001",
-			nil, 3, 1, 0.02, "", 7200, "processing", "langgraph", "", 10.0, 20.0, false, nil, int64(0), false, true, []byte(`{}`)).
+			nil, 3, 1, 0.02, "", 7200, "processing", "langgraph", "", 10.0, 20.0, false, nil, int64(0), false, true).
 		AddRow("ws-2", "Agent Two", "", 2, "degraded", []byte("null"), "",
-			nil, 0, 1, 0.6, "timeout", 100, "", "claude-code", "", 50.0, 60.0, true, nil, int64(0), false, true, []byte(`{}`))
+			nil, 0, 1, 0.6, "timeout", 100, "", "claude-code", "", 50.0, 60.0, true, nil, int64(0), false, true)

 	mock.ExpectQuery("SELECT w.id, w.name").
 		WillReturnRows(rows)
@@ -291,7 +291,7 @@ func TestWorkspaceCreate_MaxConcurrentTasksOverride(t *testing.T) {

 	mock.ExpectBegin()
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Leader Agent", nil, 3, "claude-code", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), 3, "push").
+		WithArgs(sqlmock.AnyArg(), "Leader Agent", nil, 3, "claude-code", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), 3, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
@@ -301,7 +301,7 @@ func TestWorkspaceCreate_MaxConcurrentTasksOverride(t *testing.T) {

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	body := `{"name":"Leader Agent","runtime":"claude-code","model":"sonnet","max_concurrent_tasks":3}`
+	body := `{"name":"Leader Agent","runtime":"claude-code","max_concurrent_tasks":3}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -777,103 +777,6 @@ func TestCreate_FieldValidation_Returns400(t *testing.T) {
 	}
 }

-// TestCreate_ModelRequired_Returns422 pins the CTO 2026-05-22 SSOT
-// directive (feedback_workspace_model_required_no_platform_default_dynamic_credential_intake):
-// model is required user input; the platform must not supply a default,
-// the runtime must not fall back. Empirical trigger: Code Reviewer
-// 5ba15d7e was created with `{"name":..., "runtime":"codex", ...}` (no
-// model). The legacy DefaultModel fallback returned "anthropic:claude-opus-4-7"
-// and codex adapter wedged forever — `picks provider='anthropic' but it
-// is not in the providers registry`. The gate at the Create boundary
-// turns that silent stuck-workspace failure into an immediate 422 the
-// caller can react to.
-//
-// Three shapes covered:
-//  1. bare name (no template, no runtime, no model) — formerly defaulted
-//     to langgraph + anthropic; now 422 because model is unspecified.
-//  2. explicit runtime, no model — the Code Reviewer repro shape.
-//  3. explicit runtime+template path, but template (when missing on
-//     disk or unreadable) would leave model empty — exercised here by
-//     pointing at a non-existent template under /tmp/configs.
-func TestCreate_ModelRequired_Returns422(t *testing.T) {
-	setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", "/tmp/configs")
-
-	cases := []struct{ label, body string }{
-		{"bare_name_no_runtime_no_model", `{"name":"x"}`},
-		{"explicit_codex_no_model", `{"name":"Code Reviewer","role":"code reviewer","runtime":"codex","tier":4,"max_concurrent_tasks":1}`},
-		{"explicit_hermes_no_model", `{"name":"researcher","runtime":"hermes"}`},
-	}
-	for _, tc := range cases {
-		t.Run(tc.label, func(t *testing.T) {
-			w := httptest.NewRecorder()
-			c, _ := gin.CreateTestContext(w)
-			c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(tc.body))
-			c.Request.Header.Set("Content-Type", "application/json")
-			handler.Create(c)
-			if w.Code != http.StatusUnprocessableEntity {
-				t.Errorf("Create(%s): want 422 MODEL_REQUIRED, got %d: %s", tc.label, w.Code, w.Body.String())
-				return
-			}
-			if !bytes.Contains(w.Body.Bytes(), []byte(`"code":"MODEL_REQUIRED"`)) {
-				t.Errorf("Create(%s): want body containing code=MODEL_REQUIRED, got %s", tc.label, w.Body.String())
-			}
-		})
-	}
-}
-
-// TestCreate_ExternalRuntime_NoModel_OK pins the external-runtime
-// exemption from the MODEL_REQUIRED gate. External workspaces
-// intentionally do not spawn a Docker container or run an adapter;
-// they delegate to a registered URL (workspace_provision.go:497-498:
-// "external is a first-class runtime that intentionally does NOT
-// spawn a Docker container"). The model field has no meaning for
-// them — the URL is the contract, and the gate would 422 every
-// legitimate "register my agent at https://..." flow.
-//
-// Both spellings count as external:
-//   1. payload.External == true (the canonical flag, e.g. with any runtime)
-//   2. payload.Runtime == "external" (legacy shape some E2E scripts still use)
-//
-// The isExternalLikeRuntime() helper catches both "external" and any
-// future external-like runtime alias.
-func TestCreate_ExternalRuntime_NoModel_OK(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	// External=true with explicit runtime — the test_api.sh / Echo Agent shape.
-	mock.ExpectBegin()
-	mock.ExpectExec("INSERT INTO workspaces").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-	mock.ExpectCommit()
-	mock.ExpectExec("INSERT INTO canvas_layouts").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-	mock.ExpectExec("INSERT INTO structure_events").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-	mock.ExpectExec(`UPDATE workspaces SET status =`).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-	mock.ExpectExec("INSERT INTO structure_events").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	body := `{"name":"Echo Agent","tier":1,"runtime":"external","external":true}`
-	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-	handler.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Fatalf("external workspace without model: want 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
 func TestUpdate_FieldValidation_Returns400(t *testing.T) {
 	setupTestDB(t)
 	setupTestRedis(t)
@@ -368,7 +368,7 @@ func TestWorkspaceCreate(t *testing.T) {
 	// Default tier is 3 (Privileged) — see workspace.go create-handler comment.
 	// delivery_mode defaults to "push" when payload omits it (#2339).
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Test Agent", nil, 3, "langgraph", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "Test Agent", nil, 3, "langgraph", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))

 	// Expect transaction commit (no secrets in this payload)
@@ -386,13 +386,7 @@ func TestWorkspaceCreate(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	// Note: model is now required at the Create boundary (CTO 2026-05-22
-	// SSOT directive — see feedback_workspace_model_required_no_platform_default_dynamic_credential_intake
-	// and TestCreate_ModelRequired_Returns422). This test happens to take
-	// the bare-defaults path (no template, no runtime → langgraph), so
-	// the body must declare an explicit model. Using a langgraph-compatible
-	// id; the test doesn't exercise model semantics beyond presence.
-	body := `{"name":"Test Agent","model":"anthropic:claude-opus-4-7","canvas":{"x":100,"y":200}}`
+	body := `{"name":"Test Agent","canvas":{"x":100,"y":200}}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -462,7 +456,7 @@ func TestWorkspaceList(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", "/tmp/configs")

-	// 24 cols: compute added after talk_to_user_enabled.
+	// 23 cols: broadcast_enabled + talk_to_user_enabled added after monthly_spend
 	// (migration 20260514). Column order must match scanWorkspaceRow exactly.
 	columns := []string{
 		"id", "name", "role", "tier", "status", "agent_card", "url",
@@ -470,13 +464,13 @@ func TestWorkspaceList(t *testing.T) {
 		"last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	rows := sqlmock.NewRows(columns).
 		AddRow("ws-1", "Agent One", "worker", 1, "online", []byte("null"), "http://localhost:8001",
-			nil, 0, 1, 0.0, "", 100, "", "claude-code", "", 10.0, 20.0, false, nil, int64(0), false, true, []byte(`{}`)).
+			nil, 0, 1, 0.0, "", 100, "", "claude-code", "", 10.0, 20.0, false, nil, int64(0), false, true).
 		AddRow("ws-2", "Agent Two", "manager", 2, "provisioning", []byte("null"), "",
-			nil, 0, 1, 0.0, "", 0, "", "langgraph", "", 50.0, 60.0, false, nil, int64(0), false, true, []byte(`{}`))
+			nil, 0, 1, 0.0, "", 0, "", "langgraph", "", 50.0, 60.0, false, nil, int64(0), false, true)

 	mock.ExpectQuery("SELECT w.id, w.name").
 		WillReturnRows(rows)
@@ -1190,14 +1184,14 @@ func TestWorkspaceGet_CurrentTask(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs("dddddddd-0004-0000-0000-000000000000").
 		WillReturnRows(sqlmock.NewRows(columns).AddRow(
 			"dddddddd-0004-0000-0000-000000000000", "Task Worker", "worker", 1, "online", []byte("null"), "http://localhost:9000",
 			nil, 2, 1, 0.0, "", 300, "Analyzing document", "langgraph", "", 10.0, 20.0, false,
-			nil, int64(0), false, true, []byte(`{}`),
+			nil, int64(0), false, true,
 		))

 	w := httptest.NewRecorder()
@@ -1141,8 +1141,6 @@ func TestIsSafeURL_Blocks169_254_Metadata(t *testing.T) {
 }

 func TestIsSafeURL_Blocks10xPrivate(t *testing.T) {
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")
 	err := isSafeURL("http://10.0.0.1/agent")
 	if err == nil {
 		t.Errorf("isSafeURL: expected 10.x.x.x to be blocked, got nil")
@@ -1150,8 +1148,6 @@ func TestIsSafeURL_Blocks10xPrivate(t *testing.T) {
 }

 func TestIsSafeURL_Blocks172Private(t *testing.T) {
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")
 	err := isSafeURL("http://172.16.0.1/agent")
 	if err == nil {
 		t.Errorf("isSafeURL: expected 172.16.0.0/12 to be blocked, got nil")
@@ -1159,8 +1155,6 @@ func TestIsSafeURL_Blocks172Private(t *testing.T) {
 }

 func TestIsSafeURL_Blocks192_168Private(t *testing.T) {
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")
 	err := isSafeURL("http://192.168.1.100/agent")
 	if err == nil {
 		t.Errorf("isSafeURL: expected 192.168.x.x to be blocked, got nil")
@@ -1184,8 +1178,6 @@ func TestIsSafeURL_BlocksInvalidURL(t *testing.T) {
 // ==================== SSRF Defence — isPrivateOrMetadataIP ====================

 func TestIsPrivateOrMetadataIP_10Range(t *testing.T) {
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")
 	tests := []string{"10.0.0.0", "10.255.255.255", "10.1.2.3"}
 	for _, ip := range tests {
 		if !isPrivateOrMetadataIP(net.ParseIP(ip)) {
@@ -1195,8 +1187,6 @@ func TestIsPrivateOrMetadataIP_10Range(t *testing.T) {
 }

 func TestIsPrivateOrMetadataIP_172Range(t *testing.T) {
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")
 	tests := []string{"172.16.0.0", "172.31.255.255", "172.20.1.1"}
 	for _, ip := range tests {
 		if !isPrivateOrMetadataIP(net.ParseIP(ip)) {
@@ -1206,8 +1196,6 @@ func TestIsPrivateOrMetadataIP_172Range(t *testing.T) {
 }

 func TestIsPrivateOrMetadataIP_192_168Range(t *testing.T) {
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")
 	tests := []string{"192.168.0.0", "192.168.255.255", "192.168.1.1"}
 	for _, ip := range tests {
 		if !isPrivateOrMetadataIP(net.ParseIP(ip)) {
@@ -95,18 +95,14 @@ func (h *MCPHandler) toolListPeers(ctx context.Context, workspaceID string) (str
 			cols+` FROM workspaces w WHERE w.parent_id = $1 AND w.id != $2 AND w.status != 'removed'`,
 			parentID.String, workspaceID)
 		if err == nil {
-			if scanErr := scanPeers(rows); scanErr != nil {
-				log.Printf("MCP toolListPeers: sibling scan error: %v", scanErr)
-			}
+			_ = scanPeers(rows)
 		}
 	} else {
 		rows, err := h.database.QueryContext(ctx,
 			cols+` FROM workspaces w WHERE w.parent_id IS NULL AND w.id != $1 AND w.status != 'removed'`,
 			workspaceID)
 		if err == nil {
-			if scanErr := scanPeers(rows); scanErr != nil {
-				log.Printf("MCP toolListPeers: sibling scan error: %v", scanErr)
-			}
+			_ = scanPeers(rows)
 		}
 	}

@@ -116,9 +112,7 @@ func (h *MCPHandler) toolListPeers(ctx context.Context, workspaceID string) (str
 			cols+` FROM workspaces w WHERE w.parent_id = $1 AND w.status != 'removed'`,
 			workspaceID)
 		if err == nil {
-			if scanErr := scanPeers(rows); scanErr != nil {
-				log.Printf("MCP toolListPeers: children scan error: %v", scanErr)
-			}
+			_ = scanPeers(rows)
 		}
 	}

@@ -128,9 +122,7 @@ func (h *MCPHandler) toolListPeers(ctx context.Context, workspaceID string) (str
 			cols+` FROM workspaces w WHERE w.id = $1 AND w.status != 'removed'`,
 			parentID.String)
 		if err == nil {
-			if scanErr := scanPeers(rows); scanErr != nil {
-				log.Printf("MCP toolListPeers: parent scan error: %v", scanErr)
-			}
+			_ = scanPeers(rows)
 		}
 	}

@@ -54,11 +54,6 @@ func (h *MemoryHandler) List(c *gin.Context) {
 		entry.Value = json.RawMessage(value)
 		entries = append(entries, entry)
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Memory list iteration error: %v", err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "query iteration failed"})
-		return
-	}

 	c.JSON(http.StatusOK, entries)
 }
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"database/sql"
 	"encoding/json"
-	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -75,34 +74,6 @@ func TestMemoryList_DBError(t *testing.T) {
 	}
 }

-// TestMemoryList_RowsErr_Returns500 verifies that a rows.Err() set during
-// iteration causes the handler to return 500 rather than partial results.
-func TestMemoryList_RowsErr_Returns500(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewMemoryHandler()
-
-	cols := []string{"key", "value", "version", "expires_at", "updated_at"}
-	mock.ExpectQuery("SELECT key, value, version, expires_at, updated_at").
-		WithArgs("ws-rowerr").
-		WillReturnRows(sqlmock.NewRows(cols).
-			AddRow("ok-key", []byte(`"val"`), int64(1), nil, time.Now()).
-			RowError(0, errors.New("storage engine fault")))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-rowerr"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-rowerr/memory", nil)
-	handler.List(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("rows.Err() must yield 500, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
 // ==================== GET /workspaces/:id/memory/:key (Get) ====================

 func TestMemoryGet_Success(t *testing.T) {
@@ -6,26 +6,18 @@ import (
 	"testing"
 )

-// TestHandleA2ADispatchError_NativeSession_NowEnqueues validates the #1684
-// fix: native_session adapters used to short-circuit to 503-no-queue here,
-// on the assumption that the SDK owned an inbound queue. In practice the
-// common native_session SDKs (claude-agent-sdk, codex app-server, hermes)
-// don't — new turns arrive only via the same HTTP POST that returns busy.
-// So cron fires bounced 503 every tick until the SDK voluntarily yielded;
-// Reno Stars #1684 observed 12 consecutive `*/30` cron fires lost over 6h.
+// TestHandleA2ADispatchError_NativeSession_SkipsEnqueue validates capability
+// primitive #5: when the target workspace has declared
+// provides_native_session=True, a busy-shaped dispatch error MUST short-
+// circuit straight to 503 + Retry-After. The platform's a2a_queue is
+// skipped because the SDK owns its own queue/session state — double-
+// buffering would cause spurious dispatches when the SDK is still busy.
 //
-// Post-fix: native_session and non-native both enqueue. Drain timing is
-// gated by registry.go:Heartbeat (`payload.ActiveTasks < maxConcurrent`)
-// so the queued item only dispatches when the SDK reports spare capacity
-// — i.e. the next heartbeat after the in-flight turn returns.
-//
-// This test pins the new behavior: native_session capability DOES NOT
-// bypass EnqueueA2A. We expect the INSERT INTO a2a_queue query to fire,
-// here arranged to fail so we can observe the legacy 503 fallback (and
-// thereby confirm the INSERT was attempted; sqlmock fails the test if
-// the expected query never runs).
-func TestHandleA2ADispatchError_NativeSession_NowEnqueues(t *testing.T) {
-	mock := setupTestDB(t)
+// Pin via sqlmock: we deliberately do NOT expect any INSERT INTO a2a_queue.
+// If a future refactor re-introduces enqueueing under native_session,
+// sqlmock fails the test on the unexpected query.
+func TestHandleA2ADispatchError_NativeSession_SkipsEnqueue(t *testing.T) {
+	setupTestDB(t)
 	setupTestRedis(t)
 	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())

@@ -33,15 +25,10 @@ func TestHandleA2ADispatchError_NativeSession_NowEnqueues(t *testing.T) {
 	runtimeOverrides.SetCapabilities("ws-native", map[string]bool{"session": true})
 	defer runtimeOverrides.Reset()

-	// We now EXPECT the INSERT to fire even with native_session=true. Make
-	// it fail so the handler falls through to the legacy 503 path — that
-	// lets us assert (1) enqueue was attempted, (2) the response on
-	// queue-failure does NOT carry native_session=true marker (that field
-	// was removed alongside the gate).
-	mock.ExpectQuery(`INSERT INTO a2a_queue`).
-		WithArgs("ws-native", nil, PriorityTask, "{}", "message/send", nil).
-		WillReturnError(errTestQueueUnavailable)
-
+	// DeadlineExceeded triggers isUpstreamBusyError. Without the native
+	// gate, this would fire EnqueueA2A → INSERT INTO a2a_queue. With
+	// the gate, it short-circuits to 503. We expect ZERO queue queries;
+	// sqlmock's ExpectationsWereMet implicitly enforces that on teardown.
 	_, _, perr := handler.handleA2ADispatchError(
 		context.Background(), "ws-native", "", []byte("{}"), "message/send",
 		context.DeadlineExceeded, 1, false,
@@ -50,27 +37,28 @@ func TestHandleA2ADispatchError_NativeSession_NowEnqueues(t *testing.T) {
 		t.Fatal("expected proxy error, got nil")
 	}
 	if perr.Status != http.StatusServiceUnavailable {
-		t.Errorf("got status %d, want 503 (enqueue failed → legacy 503 fallback)", perr.Status)
+		t.Errorf("got status %d, want 503 (native_session bypasses queue but still 503s)", perr.Status)
 	}
 	if perr.Headers["Retry-After"] == "" {
-		t.Error("expected Retry-After header on busy-503")
+		t.Error("expected Retry-After header on native-session 503")
 	}
-	// The native_session marker was removed from the response body — the
-	// platform queues both kinds now, callers no longer distinguish. Pin
-	// its absence so a future revert is caught.
-	if got, ok := perr.Response["native_session"].(bool); ok && got {
-		t.Errorf("native_session marker should be gone after #1684 fix; got %+v", perr.Response)
+	// Pin the marker so callers' adapters can distinguish this from a
+	// queue-failure 503: the body has native_session=true.
+	if got, _ := perr.Response["native_session"].(bool); !got {
+		t.Errorf("expected native_session=true in response body; got %+v", perr.Response)
 	}
+	// And busy=true stays so existing busy-handling code paths still trigger.
 	if got, _ := perr.Response["busy"].(bool); !got {
-		t.Errorf("expected busy=true; got %+v", perr.Response)
+		t.Errorf("expected busy=true in response body; got %+v", perr.Response)
 	}
 }

-// TestHandleA2ADispatchError_NoNativeSession_StillEnqueues — non-native
-// behavior is unchanged: enqueue is attempted, fail-fallback to 503. This
-// negative pin guards against accidentally reverting the unification by
-// re-introducing a `if HasCapability(...)` gate that would short-circuit
-// the enqueue path.
+// TestHandleA2ADispatchError_NoNativeSession_StillEnqueues is the negative
+// pin: a workspace WITHOUT the capability flag falls through to the
+// existing EnqueueA2A path (and 503 if that fails). Same shape as
+// TestHandleA2ADispatchError_ContextDeadline; we duplicate it here so
+// the native_session gate change is bracketed by both positive and
+// negative tests in the same file.
 func TestHandleA2ADispatchError_NoNativeSession_StillEnqueues(t *testing.T) {
 	mock := setupTestDB(t)
 	setupTestRedis(t)
@@ -91,11 +79,13 @@ func TestHandleA2ADispatchError_NoNativeSession_StillEnqueues(t *testing.T) {
 	if perr == nil {
 		t.Fatal("expected proxy error, got nil")
 	}
+	// Queue insert failed → falls through to legacy 503 (without
+	// native_session marker).
 	if perr.Status != http.StatusServiceUnavailable {
 		t.Errorf("got status %d, want 503", perr.Status)
 	}
 	if got, _ := perr.Response["native_session"].(bool); got {
-		t.Errorf("non-native workspace should NOT carry native_session=true; got %+v", perr.Response)
+		t.Errorf("non-native workspace should NOT carry native_session=true in response; got %+v", perr.Response)
 	}
 }

@@ -69,15 +69,10 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX
 		model = defaults.Model
 	}
 	if model == "" {
-		// SSOT (CTO 2026-05-22, feedback_workspace_model_required_no_platform_default_dynamic_credential_intake):
-		// model is REQUIRED. The org-import template MUST declare a
-		// model — either per-workspace (`ws.Model`) or via the org
-		// defaults block (`defaults.Model`). If neither is present
-		// the template is malformed and the import must fail-closed
-		// rather than silently provisioning a workspace with a
-		// runtime-incompatible default (the prior `anthropic:claude-opus-4-7`
-		// fallback wedged every codex workspace at adapter init).
-		return fmt.Errorf("org import: workspace %q has no model and the org defaults block does not provide one (runtime=%s) — model is a required field per the workspace-creation contract; either set `model:` on the workspace or under `defaults:`", ws.Name, runtime)
+		// SSOT: per-runtime defaults live in models/runtime_defaults.go
+		// (see RFC #2873). Consolidated from a duplicate of the same
+		// branch in workspace_provision.go.
+		model = models.DefaultModel(runtime)
 	}
 	tier := ws.Tier
 	if tier == 0 {
@@ -712,8 +712,6 @@ func TestHeartbeat_SkipsRemovedRows(t *testing.T) {
 // ------------------------------------------------------------

 func TestValidateAgentURL(t *testing.T) {
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")
 	cases := []struct {
 		name    string
 		url     string
@@ -133,30 +133,24 @@ func loadRestartContextData(ctx context.Context, workspaceID string) restartCont
 	// message bus.
 	keySet := map[string]struct{}{}
 	if rows, err := db.DB.QueryContext(ctx, `SELECT key FROM global_secrets`); err == nil {
-		defer rows.Close()
 		for rows.Next() {
 			var k string
 			if rows.Scan(&k) == nil {
 				keySet[k] = struct{}{}
 			}
 		}
-		if err := rows.Err(); err != nil {
-			log.Printf("loadRestartContextData: global_secrets rows.Err: %v", err)
-		}
+		rows.Close()
 	}
 	if rows, err := db.DB.QueryContext(ctx,
 		`SELECT key FROM workspace_secrets WHERE workspace_id = $1`, workspaceID,
 	); err == nil {
-		defer rows.Close()
 		for rows.Next() {
 			var k string
 			if rows.Scan(&k) == nil {
 				keySet[k] = struct{}{}
 			}
 		}
-		if err := rows.Err(); err != nil {
-			log.Printf("loadRestartContextData: workspace_secrets rows.Err: %v", err)
-		}
+		rows.Close()
 	}
 	for k := range keySet {
 		d.EnvKeys = append(d.EnvKeys, k)
@@ -15,46 +15,13 @@ import (
 	"github.com/Molecule-AI/molecule-monorepo/platform/internal/scheduler"
 )

-// ErrorResponse is returned for 4xx/5xx errors. (OpenAPI doc shape — used by swaggo.)
-type ErrorResponse struct {
-	Error string `json:"error"`
-}
-
-// StatusResponse is returned by mutating endpoints that only echo a status verb.
-type StatusResponse struct {
-	Status string `json:"status"`
-}
-
-// CreateScheduleResponse is returned by POST /workspaces/{id}/schedules.
-type CreateScheduleResponse struct {
-	ID        string    `json:"id"`
-	Status    string    `json:"status"`
-	NextRunAt time.Time `json:"next_run_at"`
-}
-
-// RunNowResponse is returned by POST /workspaces/{id}/schedules/{scheduleId}/run.
-type RunNowResponse struct {
-	Status      string `json:"status"`
-	WorkspaceID string `json:"workspace_id"`
-	Prompt      string `json:"prompt"`
-}
-
-// HistoryEntry is one row of /workspaces/{id}/schedules/{scheduleId}/history.
-type HistoryEntry struct {
-	Timestamp   time.Time       `json:"timestamp"`
-	DurationMs  *int            `json:"duration_ms"`
-	Status      *string         `json:"status"`
-	ErrorDetail string          `json:"error_detail"`
-	Request     json.RawMessage `json:"request" swaggertype:"object"`
-}
-
 type ScheduleHandler struct{}

 func NewScheduleHandler() *ScheduleHandler {
 	return &ScheduleHandler{}
 }

-type ScheduleResponse struct {
+type scheduleResponse struct {
 	ID          string     `json:"id"`
 	WorkspaceID string     `json:"workspace_id"`
 	Name        string     `json:"name"`
@@ -73,15 +40,6 @@ type ScheduleResponse struct {
 }

 // List returns all schedules for a workspace.
-//
-//	@Summary	List schedules for a workspace
-//	@Tags		schedules
-//	@Produce	json
-//	@Param		id	path		string	true	"Workspace ID"
-//	@Success	200	{array}		ScheduleResponse
-//	@Failure	500	{object}	ErrorResponse
-//	@Router		/workspaces/{id}/schedules [get]
-//	@Security	BearerAuth && OrgSlugAuth
 func (h *ScheduleHandler) List(c *gin.Context) {
 	workspaceID := c.Param("id")
 	ctx := c.Request.Context()
@@ -100,9 +58,9 @@ func (h *ScheduleHandler) List(c *gin.Context) {
 	}
 	defer rows.Close()

-	schedules := make([]ScheduleResponse, 0)
+	schedules := make([]scheduleResponse, 0)
 	for rows.Next() {
-		var s ScheduleResponse
+		var s scheduleResponse
 		if err := rows.Scan(
 			&s.ID, &s.WorkspaceID, &s.Name, &s.CronExpr, &s.Timezone,
 			&s.Prompt, &s.Enabled, &s.LastRunAt, &s.NextRunAt, &s.RunCount,
@@ -120,7 +78,7 @@ func (h *ScheduleHandler) List(c *gin.Context) {
 	c.JSON(http.StatusOK, schedules)
 }

-type CreateScheduleRequest struct {
+type createScheduleRequest struct {
 	Name     string `json:"name"`
 	CronExpr string `json:"cron_expr" binding:"required"`
 	Timezone string `json:"timezone"`
@@ -129,23 +87,11 @@ type CreateScheduleRequest struct {
 }

 // Create adds a new schedule for a workspace.
-//
-//	@Summary	Create a schedule
-//	@Tags		schedules
-//	@Accept		json
-//	@Produce	json
-//	@Param		id		path		string					true	"Workspace ID"
-//	@Param		body	body		CreateScheduleRequest	true	"Schedule fields"
-//	@Success	201		{object}	CreateScheduleResponse
-//	@Failure	400		{object}	ErrorResponse
-//	@Failure	500		{object}	ErrorResponse
-//	@Router		/workspaces/{id}/schedules [post]
-//	@Security	BearerAuth && OrgSlugAuth
 func (h *ScheduleHandler) Create(c *gin.Context) {
 	workspaceID := c.Param("id")
 	ctx := c.Request.Context()

-	var body CreateScheduleRequest
+	var body createScheduleRequest
 	if err := c.ShouldBindJSON(&body); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "cron_expr and prompt are required"})
 		return
@@ -199,7 +145,7 @@ func (h *ScheduleHandler) Create(c *gin.Context) {
 	})
 }

-type UpdateScheduleRequest struct {
+type updateScheduleRequest struct {
 	Name     *string `json:"name"`
 	CronExpr *string `json:"cron_expr"`
 	Timezone *string `json:"timezone"`
@@ -209,26 +155,12 @@ type UpdateScheduleRequest struct {

 // Update modifies a schedule. Uses a fixed UPDATE with COALESCE so only
 // provided fields are changed — no dynamic SQL construction.
-//
-//	@Summary	Update a schedule
-//	@Tags		schedules
-//	@Accept		json
-//	@Produce	json
-//	@Param		id			path		string					true	"Workspace ID"
-//	@Param		scheduleId	path		string					true	"Schedule ID"
-//	@Param		body		body		UpdateScheduleRequest	true	"Partial schedule fields (only provided keys are updated)"
-//	@Success	200			{object}	ScheduleResponse
-//	@Failure	400			{object}	ErrorResponse
-//	@Failure	404			{object}	ErrorResponse
-//	@Failure	500			{object}	ErrorResponse
-//	@Router		/workspaces/{id}/schedules/{scheduleId} [patch]
-//	@Security	BearerAuth && OrgSlugAuth
 func (h *ScheduleHandler) Update(c *gin.Context) {
 	scheduleID := c.Param("scheduleId")
 	workspaceID := c.Param("id") // #113: bind to owning workspace to prevent IDOR
 	ctx := c.Request.Context()

-	var body UpdateScheduleRequest
+	var body updateScheduleRequest
 	if err := c.ShouldBindJSON(&body); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid JSON"})
 		return
@@ -298,17 +230,6 @@ func (h *ScheduleHandler) Update(c *gin.Context) {
 }

 // Delete removes a schedule.
-//
-//	@Summary	Delete a schedule
-//	@Tags		schedules
-//	@Produce	json
-//	@Param		id			path		string	true	"Workspace ID"
-//	@Param		scheduleId	path		string	true	"Schedule ID"
-//	@Success	200			{object}	StatusResponse
-//	@Failure	404			{object}	ErrorResponse
-//	@Failure	500			{object}	ErrorResponse
-//	@Router		/workspaces/{id}/schedules/{scheduleId} [delete]
-//	@Security	BearerAuth && OrgSlugAuth
 func (h *ScheduleHandler) Delete(c *gin.Context) {
 	scheduleID := c.Param("scheduleId")
 	workspaceID := c.Param("id") // #113: bind to owning workspace to prevent IDOR
@@ -331,17 +252,6 @@ func (h *ScheduleHandler) Delete(c *gin.Context) {
 }

 // RunNow manually fires a schedule immediately.
-//
-//	@Summary	Fire a schedule manually
-//	@Tags		schedules
-//	@Produce	json
-//	@Param		id			path		string	true	"Workspace ID"
-//	@Param		scheduleId	path		string	true	"Schedule ID"
-//	@Success	200			{object}	RunNowResponse
-//	@Failure	404			{object}	ErrorResponse
-//	@Failure	500			{object}	ErrorResponse
-//	@Router		/workspaces/{id}/schedules/{scheduleId}/run [post]
-//	@Security	BearerAuth && OrgSlugAuth
 func (h *ScheduleHandler) RunNow(c *gin.Context) {
 	scheduleID := c.Param("scheduleId")
 	workspaceID := c.Param("id")
@@ -372,16 +282,6 @@ func (h *ScheduleHandler) RunNow(c *gin.Context) {
 }

 // History returns recent runs for a schedule from activity_logs.
-//
-//	@Summary	Get past runs of a schedule
-//	@Tags		schedules
-//	@Produce	json
-//	@Param		id			path		string	true	"Workspace ID"
-//	@Param		scheduleId	path		string	true	"Schedule ID"
-//	@Success	200			{array}		HistoryEntry
-//	@Failure	500			{object}	ErrorResponse
-//	@Router		/workspaces/{id}/schedules/{scheduleId}/history [get]
-//	@Security	BearerAuth && OrgSlugAuth
 func (h *ScheduleHandler) History(c *gin.Context) {
 	scheduleID := c.Param("scheduleId")
 	workspaceID := c.Param("id")
@@ -407,9 +307,17 @@ func (h *ScheduleHandler) History(c *gin.Context) {
 	}
 	defer rows.Close()

-	entries := make([]HistoryEntry, 0)
+	type historyEntry struct {
+		Timestamp   time.Time       `json:"timestamp"`
+		DurationMs  *int            `json:"duration_ms"`
+		Status      *string         `json:"status"`
+		ErrorDetail string          `json:"error_detail"`
+		Request     json.RawMessage `json:"request"`
+	}
+
+	entries := make([]historyEntry, 0)
 	for rows.Next() {
-		var e HistoryEntry
+		var e historyEntry
 		var reqStr string
 		if err := rows.Scan(&e.Timestamp, &e.DurationMs, &e.Status, &e.ErrorDetail, &reqStr); err != nil {
 			continue
@@ -417,18 +325,15 @@ func (h *ScheduleHandler) History(c *gin.Context) {
 		e.Request = json.RawMessage(reqStr)
 		entries = append(entries, e)
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ScheduleHistory: rows error: %v", err)
-	}

 	c.JSON(http.StatusOK, entries)
 }

-// ScheduleHealthResponse is the read-only health view of a schedule.
+// scheduleHealthResponse is the read-only health view of a schedule.
 // It deliberately omits prompt and cron_expr so sensitive task content is
 // never exposed to peer workspaces — only execution-state fields needed to
 // detect silent cron failures are returned (issue #249).
-type ScheduleHealthResponse struct {
+type scheduleHealthResponse struct {
 	ID         string     `json:"id"`
 	Name       string     `json:"name"`
 	Enabled    bool       `json:"enabled"`
@@ -470,19 +375,14 @@ func (h *ScheduleHandler) Health(c *gin.Context) {

 	// Validate the caller's own bearer token (Phase 30.5 contract).
 	// Skip for system callers and self-calls, same as the A2A proxy.
-	// Post-RFC#637: canvas users may read schedule health too.
-	isCanvasUser := false
 	if !isSystemCaller(callerID) && callerID != workspaceID {
-		var err error
-		isCanvasUser, err = validateCallerToken(ctx, c, callerID)
-		if err != nil {
+		if err := validateCallerToken(ctx, c, callerID); err != nil {
 			return // response already written with 401
 		}
 	}

 	// CanCommunicate gate — only peers in the org hierarchy may read health.
-	// Canvas users (human operators) bypass this gate.
-	if callerID != workspaceID && !isSystemCaller(callerID) && !isCanvasUser {
+	if callerID != workspaceID && !isSystemCaller(callerID) {
 		if !registry.CanCommunicate(callerID, workspaceID) {
 			log.Printf("ScheduleHealth: access denied %s → %s", callerID, workspaceID)
 			c.JSON(http.StatusForbidden, gin.H{"error": "access denied"})
@@ -502,9 +402,9 @@ func (h *ScheduleHandler) Health(c *gin.Context) {
 	}
 	defer rows.Close()

-	schedules := make([]ScheduleHealthResponse, 0)
+	schedules := make([]scheduleHealthResponse, 0)
 	for rows.Next() {
-		var s ScheduleHealthResponse
+		var s scheduleHealthResponse
 		if err := rows.Scan(
 			&s.ID, &s.Name, &s.Enabled, &s.LastRunAt, &s.NextRunAt,
 			&s.RunCount, &s.LastStatus, &s.LastError,
@@ -234,7 +234,7 @@ func TestScheduleHealth_SelfCall_Allowed(t *testing.T) {
 		t.Fatalf("expected 200 for self-call, got %d: %s", w.Code, w.Body.String())
 	}

-	var resp []ScheduleHealthResponse
+	var resp []scheduleHealthResponse
 	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
 		t.Fatalf("failed to parse response: %v", err)
 	}
@@ -284,7 +284,7 @@ func TestScheduleHealth_CanCommunicatePeer_LegacyNoToken(t *testing.T) {
 		t.Fatalf("expected 200 for peer with no tokens, got %d: %s", w.Code, w.Body.String())
 	}

-	var resp []ScheduleHealthResponse
+	var resp []scheduleHealthResponse
 	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
 		t.Fatalf("failed to parse response: %v", err)
 	}
@@ -95,7 +95,6 @@ func TestSecurity_GetTemplates_NoAuth_Returns401(t *testing.T) {
 func TestSecurity_GetTemplates_FreshInstall_FailsOpen(t *testing.T) {
 	setupTestDB(t)
 	setupTestRedis(t)
-	t.Setenv("ADMIN_TOKEN", "")
 	authDB, authMock := newFreshInstallAuthDB(t)

 	tmpDir := t.TempDir()
@@ -153,7 +152,6 @@ func TestSecurity_GetOrgTemplates_NoAuth_Returns401(t *testing.T) {
 func TestSecurity_GetOrgTemplates_FreshInstall_FailsOpen(t *testing.T) {
 	setupTestDB(t)
 	setupTestRedis(t)
-	t.Setenv("ADMIN_TOKEN", "")
 	authDB, authMock := newFreshInstallAuthDB(t)

 	tmpDir := t.TempDir()
@@ -51,10 +51,6 @@ func (h *TracesHandler) List(c *gin.Context) {
 	}
 	defer func() { _ = resp.Body.Close() }()

-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to read response body"})
-		return
-	}
+	body, _ := io.ReadAll(resp.Body)
 	c.Data(resp.StatusCode, "application/json", body)
 }
@@ -107,7 +107,6 @@ func (h *WebhookHandler) GitHub(c *gin.Context) {
 		forwardBody,
 		"webhook:github",
 		true,
-		false,
 	)
 	if proxyErr != nil {
 		c.JSON(proxyErr.Status, proxyErr.Response)
@@ -214,6 +214,11 @@ func (h *WorkspaceHandler) Create(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace fields"})
 		return
 	}
+	// #1686 Phase 1: validate per-workspace compute overrides.
+	if err := models.ValidateComputeConfig(payload.Compute); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}

 	id := uuid.New().String()
 	awarenessNamespace := workspaceAwarenessNamespace(id)
@@ -321,51 +326,6 @@ func (h *WorkspaceHandler) Create(c *gin.Context) {
 		payload.Runtime = "langgraph"
 	}

-	// SSOT (CTO 2026-05-22, feedback_workspace_model_required_no_platform_default_dynamic_credential_intake):
-	// model is REQUIRED user input for SPAWNED-runtime workspaces. The
-	// platform must not provide a default; the runtime must not fall back.
-	// The decision belongs to the user (or to the agent acting on the
-	// user's behalf), never to the platform.
-	//
-	// Empirical trigger: Code Reviewer 5ba15d7e was created with
-	// `{"name":"Code Reviewer","role":"...","runtime":"codex",...}` (no
-	// model). The legacy `DefaultModel(runtime)` fallback in
-	// provisionWorkspace returned `"anthropic:claude-opus-4-7"`. Codex
-	// adapter only supports openai-* providers — it wedged forever with
-	// `codex adapter: workspace config picks provider='anthropic' but
-	// it is not in the providers registry`. PATCH /workspaces/:id
-	// explicitly disallows updating model (the comment literally reads
-	// `model not patchable`), so the only recovery path was SQL UPDATE
-	// or delete+recreate.
-	//
-	// External workspaces are EXEMPT — they intentionally do not spawn
-	// a Docker container or run an adapter; they delegate to a registered
-	// URL (see provision.go: "external is a first-class runtime that
-	// intentionally does NOT spawn a Docker container"). The MODEL_REQUIRED
-	// gate is meaningful for spawned-runtime workspaces where the model
-	// id drives provider selection at adapter init. For external workspaces
-	// the contract is the URL, not the model — requiring it would be
-	// ceremony with no payoff, and would 422 every legitimate "register
-	// my agent at https://..." flow. The SSOT directive concerns
-	// platform-side defaults; an external workspace genuinely has no
-	// "model decision" for the user to make.
-	//
-	// Fail-closed at the Create boundary so the caller learns the
-	// contract immediately — same shape as the controlplane#188
-	// runtime-unresolved gate above. Caller fixes the request, no
-	// EC2 launched, no stuck workspace, no operator paging.
-	isExternal := payload.External || isExternalLikeRuntime(payload.Runtime)
-	if payload.Model == "" && !isExternal {
-		log.Printf("Create: FAIL-CLOSED — model is required (runtime=%q template=%q); refusing the silent DefaultModel fallback per CTO 2026-05-22 SSOT directive", payload.Runtime, payload.Template)
-		c.JSON(http.StatusUnprocessableEntity, gin.H{
-			"error":    "model is required and has no platform-side default — pass an explicit \"model\" in the request body, or use a \"template\" whose config.yaml declares one. See feedback_workspace_model_required_no_platform_default_dynamic_credential_intake for the contract.",
-			"runtime":  payload.Runtime,
-			"template": payload.Template,
-			"code":     "MODEL_REQUIRED",
-		})
-		return
-	}
-
 	ctx := c.Request.Context()

 	// Convert empty role to NULL
@@ -393,10 +353,6 @@ func (h *WorkspaceHandler) Create(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid workspace access"})
 		return
 	}
-	if err := validateWorkspaceCompute(payload.Compute); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}

 	// Begin a transaction so the workspace row and any initial secrets are
 	// committed atomically.  A secret-encrypt or DB error rolls back the
@@ -447,11 +403,22 @@ func (h *WorkspaceHandler) Create(c *gin.Context) {
 	// double-click. Helper retries with " (2)", " (3)", … up to maxNameSuffix,
 	// returns the actually-persisted name (which we MUST thread back into
 	// payload + broadcast so the canvas displays what the DB has).
+	var computeInstanceType *string
+	var computeVolumeRootGB *int
+	if payload.Compute != nil {
+		if payload.Compute.InstanceType != "" {
+			computeInstanceType = &payload.Compute.InstanceType
+		}
+		if payload.Compute.Volume.RootGB != 0 {
+			computeVolumeRootGB = &payload.Compute.Volume.RootGB
+		}
+	}
+
 	const insertWorkspaceSQL = `
-		INSERT INTO workspaces (id, name, role, tier, runtime, awareness_namespace, status, parent_id, workspace_dir, workspace_access, budget_limit, max_concurrent_tasks, delivery_mode)
-		VALUES ($1, $2, $3, $4, $5, $6, 'provisioning', $7, $8, $9, $10, $11, $12)
+		INSERT INTO workspaces (id, name, role, tier, runtime, awareness_namespace, status, parent_id, workspace_dir, workspace_access, budget_limit, max_concurrent_tasks, delivery_mode, compute_instance_type, compute_volume_root_gb)
+		VALUES ($1, $2, $3, $4, $5, $6, 'provisioning', $7, $8, $9, $10, $11, $12, $13, $14)
 	`
-	insertArgs := []any{id, payload.Name, role, payload.Tier, payload.Runtime, awarenessNamespace, payload.ParentID, workspaceDir, workspaceAccess, payload.BudgetLimit, maxConcurrent, deliveryMode}
+	insertArgs := []any{id, payload.Name, role, payload.Tier, payload.Runtime, awarenessNamespace, payload.ParentID, workspaceDir, workspaceAccess, payload.BudgetLimit, maxConcurrent, deliveryMode, computeInstanceType, computeVolumeRootGB}
 	persistedName, currentTx, err := insertWorkspaceWithNameRetry(
 		ctx,
 		tx,
@@ -484,24 +451,6 @@ func (h *WorkspaceHandler) Create(c *gin.Context) {
 		payload.Name = persistedName
 	}

-	if !workspaceComputeIsZero(payload.Compute) {
-		computeJSON, encErr := workspaceComputeJSON(payload.Compute)
-		if encErr != nil {
-			tx.Rollback() //nolint:errcheck
-			log.Printf("Create workspace %s: failed to encode compute config: %v", id, encErr)
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to encode compute config"})
-			return
-		}
-		if _, dbErr := tx.ExecContext(ctx,
-			`UPDATE workspaces SET compute = $2::jsonb, updated_at = now() WHERE id = $1`,
-			id, computeJSON); dbErr != nil {
-			tx.Rollback() //nolint:errcheck
-			log.Printf("Create workspace %s: failed to persist compute config: %v", id, dbErr)
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to save compute config"})
-			return
-		}
-	}
-
 	// Persist initial secrets from the create payload (inside same transaction).
 	// nil/empty map is a no-op.  Any failure rolls back the workspace insert
 	// so we never have a workspace row without its intended secrets.
@@ -746,7 +695,6 @@ func scanWorkspaceRow(rows interface {
 	Scan(dest ...interface{}) error
 }) (map[string]interface{}, error) {
 	var id, name, role, status, url, sampleError, currentTask, runtime, workspaceDir string
-	var computeRaw []byte
 	var tier, activeTasks, maxConcurrentTasks, uptimeSeconds int
 	var errorRate, x, y float64
 	var collapsed, broadcastEnabled, talkToUserEnabled bool
@@ -758,7 +706,7 @@ func scanWorkspaceRow(rows interface {
 	err := rows.Scan(&id, &name, &role, &tier, &status, &agentCard, &url,
 		&parentID, &activeTasks, &maxConcurrentTasks, &errorRate, &sampleError, &uptimeSeconds,
 		&currentTask, &runtime, &workspaceDir, &x, &y, &collapsed,
-		&budgetLimit, &monthlySpend, &broadcastEnabled, &talkToUserEnabled, &computeRaw)
+		&budgetLimit, &monthlySpend, &broadcastEnabled, &talkToUserEnabled)
 	if err != nil {
 		return nil, err
 	}
@@ -785,11 +733,6 @@ func scanWorkspaceRow(rows interface {
 		"broadcast_enabled":    broadcastEnabled,
 		"talk_to_user_enabled": talkToUserEnabled,
 	}
-	if len(computeRaw) > 0 && string(computeRaw) != "null" {
-		ws["compute"] = json.RawMessage(computeRaw)
-	} else {
-		ws["compute"] = json.RawMessage(`{}`)
-	}

 	// budget_limit: nil when no limit set, int64 otherwise
 	if budgetLimit.Valid {
@@ -825,8 +768,7 @@ const workspaceListQuery = `
 		   COALESCE(w.workspace_dir, ''),
 		   COALESCE(cl.x, 0), COALESCE(cl.y, 0), COALESCE(cl.collapsed, false),
 		   w.budget_limit, COALESCE(w.monthly_spend, 0),
-		   w.broadcast_enabled, w.talk_to_user_enabled,
-		   COALESCE(w.compute, '{}'::jsonb)
+		   w.broadcast_enabled, w.talk_to_user_enabled
 	FROM workspaces w
 	LEFT JOIN canvas_layouts cl ON cl.workspace_id = w.id
 	WHERE w.status != 'removed'
@@ -887,8 +829,7 @@ func (h *WorkspaceHandler) Get(c *gin.Context) {
 			   COALESCE(w.workspace_dir, ''),
 			   COALESCE(cl.x, 0), COALESCE(cl.y, 0), COALESCE(cl.collapsed, false),
 			   w.budget_limit, COALESCE(w.monthly_spend, 0),
-			   w.broadcast_enabled, w.talk_to_user_enabled,
-			   COALESCE(w.compute, '{}'::jsonb)
+			   w.broadcast_enabled, w.talk_to_user_enabled
 		FROM workspaces w
 		LEFT JOIN canvas_layouts cl ON cl.workspace_id = w.id
 		WHERE w.id = $1
@@ -33,7 +33,7 @@ var wsColumns = []string{
 	"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 	"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 	"budget_limit", "monthly_spend",
-	"broadcast_enabled", "talk_to_user_enabled", "compute",
+	"broadcast_enabled", "talk_to_user_enabled",
 }

 // ==================== GET — financial fields stripped from open endpoint ====================
@@ -56,8 +56,7 @@ func TestWorkspaceBudget_Get_NilLimit(t *testing.T) {
 				nil,   // budget_limit NULL
 				0,     // monthly_spend 0
 				false, // broadcast_enabled
-				true,  // talk_to_user_enabled
-				[]byte(`{}`)))
+				true)) // talk_to_user_enabled

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -101,8 +100,7 @@ func TestWorkspaceBudget_Get_WithLimit(t *testing.T) {
 				0.0, 0.0, false,
 				int64(500),  // budget_limit = $5.00 in DB
 				int64(123),  // monthly_spend = $1.23 in DB
-				false, true, // broadcast_enabled, talk_to_user_enabled
-				[]byte(`{}`)))
+				false, true)) // broadcast_enabled, talk_to_user_enabled

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -147,18 +145,20 @@ func TestWorkspaceBudget_Create_WithLimit(t *testing.T) {
 	mock.ExpectBegin()
 	mock.ExpectExec("INSERT INTO workspaces").
 		WithArgs(
-			sqlmock.AnyArg(),                 // id
-			"Budgeted Agent",                 // name
-			nil,                              // role
-			3,                                // tier (default, workspace.go create-handler)
-			"langgraph",                      // runtime
-			sqlmock.AnyArg(),                 // awareness_namespace
-			(*string)(nil),                   // parent_id
-			nil,                              // workspace_dir
-			"none",                           // workspace_access
-			&budgetVal,                       // budget_limit ($10)
+			sqlmock.AnyArg(), // id
+			"Budgeted Agent", // name
+			nil,              // role
+			3,                // tier (default, workspace.go create-handler)
+			"langgraph",      // runtime
+			sqlmock.AnyArg(), // awareness_namespace
+			(*string)(nil),   // parent_id
+			nil,              // workspace_dir
+			"none",           // workspace_access
+			&budgetVal,       // budget_limit ($10)
 			models.DefaultMaxConcurrentTasks, // max_concurrent_tasks default
-			"push",                           // delivery_mode default (#2339)
+			"push",           // delivery_mode default (#2339)
+			(*string)(nil),   // compute_instance_type default
+			(*int)(nil),      // compute_volume_root_gb default
 		).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
@@ -170,7 +170,7 @@ func TestWorkspaceBudget_Create_WithLimit(t *testing.T) {

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	body := `{"name":"Budgeted Agent","model":"anthropic:claude-opus-4-7","budget_limit":1000}`
+	body := `{"name":"Budgeted Agent","budget_limit":1000}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")
 	handler.Create(c)
@@ -1,253 +0,0 @@
-package handlers
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/url"
-	"os"
-	"strings"
-
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/models"
-	"github.com/gin-gonic/gin"
-)
-
-const (
-	workspaceComputeDiskFloorGB   = 30
-	workspaceComputeDiskCeilingGB = 500
-	workspaceDisplayMinWidth      = 800
-	workspaceDisplayMaxWidth      = 3840
-	workspaceDisplayMinHeight     = 600
-	workspaceDisplayMaxHeight     = 2160
-)
-
-type workspaceDisplayResponse struct {
-	Available bool   `json:"available"`
-	Reason    string `json:"reason,omitempty"`
-	Mode      string `json:"mode,omitempty"`
-	Protocol  string `json:"protocol,omitempty"`
-	Width     int    `json:"width,omitempty"`
-	Height    int    `json:"height,omitempty"`
-	Status    string `json:"status,omitempty"`
-	ViewerURL string `json:"viewer_url,omitempty"`
-}
-
-var workspaceComputeInstanceAllowlist = map[string]struct{}{
-	"t3.medium":  {},
-	"t3.large":   {},
-	"t3.xlarge":  {},
-	"t3.2xlarge": {},
-	"m6i.large":  {},
-	"m6i.xlarge": {},
-	"c6i.xlarge": {},
-}
-
-func validateWorkspaceCompute(compute models.WorkspaceCompute) error {
-	if compute.InstanceType != "" {
-		if _, ok := workspaceComputeInstanceAllowlist[compute.InstanceType]; !ok {
-			return fmt.Errorf("unsupported compute.instance_type")
-		}
-	}
-	if compute.Volume.RootGB != 0 {
-		if compute.Volume.RootGB < workspaceComputeDiskFloorGB || compute.Volume.RootGB > workspaceComputeDiskCeilingGB {
-			return fmt.Errorf("compute.volume.root_gb must be between %d and %d", workspaceComputeDiskFloorGB, workspaceComputeDiskCeilingGB)
-		}
-	}
-	switch compute.Display.Mode {
-	case "", "none", "desktop-control", "gpu-desktop-control":
-	default:
-		return fmt.Errorf("unsupported compute.display.mode")
-	}
-	switch compute.Display.Protocol {
-	case "", "dcv", "novnc":
-	default:
-		return fmt.Errorf("unsupported compute.display.protocol")
-	}
-	if err := validateWorkspaceDisplayDimensions(compute.Display.Width, compute.Display.Height); err != nil {
-		return err
-	}
-	return nil
-}
-
-func validateWorkspaceDisplayConfig(display models.WorkspaceComputeDisplay) error {
-	switch display.Mode {
-	case "", "none", "desktop-control", "gpu-desktop-control":
-	default:
-		return fmt.Errorf("unsupported compute.display.mode")
-	}
-	switch display.Protocol {
-	case "", "dcv", "novnc":
-	default:
-		return fmt.Errorf("unsupported compute.display.protocol")
-	}
-	if err := validateWorkspaceDisplayDimensions(display.Width, display.Height); err != nil {
-		return err
-	}
-	return nil
-}
-
-func validateWorkspaceDisplayDimensions(width, height int) error {
-	if width < 0 || height < 0 {
-		return fmt.Errorf("compute.display width/height must be non-negative")
-	}
-	if width != 0 && (width < workspaceDisplayMinWidth || width > workspaceDisplayMaxWidth) {
-		return fmt.Errorf("compute.display.width must be between %d and %d", workspaceDisplayMinWidth, workspaceDisplayMaxWidth)
-	}
-	if height != 0 && (height < workspaceDisplayMinHeight || height > workspaceDisplayMaxHeight) {
-		return fmt.Errorf("compute.display.height must be between %d and %d", workspaceDisplayMinHeight, workspaceDisplayMaxHeight)
-	}
-	return nil
-}
-
-func workspaceComputeIsZero(compute models.WorkspaceCompute) bool {
-	return compute.InstanceType == "" &&
-		compute.Volume.RootGB == 0 &&
-		compute.Display.Mode == "" &&
-		compute.Display.Width == 0 &&
-		compute.Display.Height == 0 &&
-		compute.Display.Protocol == ""
-}
-
-func workspaceComputeJSON(compute models.WorkspaceCompute) (string, error) {
-	if workspaceComputeIsZero(compute) {
-		return "{}", nil
-	}
-	out := map[string]interface{}{}
-	if compute.InstanceType != "" {
-		out["instance_type"] = compute.InstanceType
-	}
-	if compute.Volume.RootGB != 0 {
-		out["volume"] = map[string]interface{}{"root_gb": compute.Volume.RootGB}
-	}
-	display := map[string]interface{}{}
-	if compute.Display.Mode != "" {
-		display["mode"] = compute.Display.Mode
-	}
-	if compute.Display.Width != 0 {
-		display["width"] = compute.Display.Width
-	}
-	if compute.Display.Height != 0 {
-		display["height"] = compute.Display.Height
-	}
-	if compute.Display.Protocol != "" {
-		display["protocol"] = compute.Display.Protocol
-	}
-	if len(display) > 0 {
-		out["display"] = display
-	}
-	b, err := json.Marshal(out)
-	if err != nil {
-		return "", err
-	}
-	return string(b), nil
-}
-
-func withStoredCompute(ctx context.Context, workspaceID string, payload models.CreateWorkspacePayload) models.CreateWorkspacePayload {
-	if !workspaceComputeIsZero(payload.Compute) || db.DB == nil {
-		return payload
-	}
-	var raw string
-	err := db.DB.QueryRowContext(ctx,
-		`SELECT COALESCE(compute, '{}'::jsonb) FROM workspaces WHERE id = $1`,
-		workspaceID,
-	).Scan(&raw)
-	if err != nil {
-		if err != sql.ErrNoRows {
-			log.Printf("withStoredCompute: load compute for %s failed: %v", workspaceID, err)
-		}
-		return payload
-	}
-	if raw == "" || raw == "{}" {
-		return payload
-	}
-	var compute models.WorkspaceCompute
-	if err := json.Unmarshal([]byte(raw), &compute); err != nil {
-		log.Printf("withStoredCompute: invalid compute JSON for %s: %v", workspaceID, err)
-		return payload
-	}
-	if err := validateWorkspaceCompute(compute); err != nil {
-		log.Printf("withStoredCompute: stored compute for %s failed validation: %v", workspaceID, err)
-		return payload
-	}
-	payload.Compute = compute
-	return payload
-}
-
-// Display handles GET /workspaces/:id/display.
-//
-// Phase 1 only exposes the product contract and the non-display unavailable
-// state. Future desktop-control work will replace the display-enabled branch
-// with short-lived proxied DCV session details.
-func (h *WorkspaceHandler) Display(c *gin.Context) {
-	workspaceID := c.Param("id")
-	var raw string
-	err := db.DB.QueryRowContext(c.Request.Context(),
-		`SELECT COALESCE(compute, '{}'::jsonb) FROM workspaces WHERE id = $1`,
-		workspaceID,
-	).Scan(&raw)
-	if err != nil {
-		if err == sql.ErrNoRows {
-			c.JSON(404, gin.H{"error": "workspace not found"})
-			return
-		}
-		log.Printf("Display: load compute for %s failed: %v", workspaceID, err)
-		c.JSON(500, gin.H{"error": "failed to load display config"})
-		return
-	}
-	var compute models.WorkspaceCompute
-	if raw != "" && raw != "{}" {
-		if err := json.Unmarshal([]byte(raw), &compute); err != nil {
-			log.Printf("Display: invalid compute JSON for %s: %v", workspaceID, err)
-			c.JSON(500, gin.H{"error": "invalid display config"})
-			return
-		}
-		if err := validateWorkspaceDisplayConfig(compute.Display); err != nil {
-			log.Printf("Display: invalid stored compute for %s: %v", workspaceID, err)
-			c.JSON(500, gin.H{"error": "invalid display config"})
-			return
-		}
-	}
-	if compute.Display.Mode == "" || compute.Display.Mode == "none" {
-		c.JSON(200, workspaceDisplayResponse{
-			Available: false,
-			Reason:    "display_not_enabled",
-		})
-		return
-	}
-	if viewerURL := workspaceDisplayViewerURL(workspaceID); viewerURL != "" {
-		c.JSON(200, workspaceDisplayResponse{
-			Available: true,
-			Mode:      compute.Display.Mode,
-			Protocol:  compute.Display.Protocol,
-			Width:     compute.Display.Width,
-			Height:    compute.Display.Height,
-			Status:    "ready",
-			ViewerURL: viewerURL,
-		})
-		return
-	}
-	c.JSON(200, workspaceDisplayResponse{
-		Available: false,
-		Reason:    "display_session_unavailable",
-		Mode:      compute.Display.Mode,
-		Protocol:  compute.Display.Protocol,
-		Width:     compute.Display.Width,
-		Height:    compute.Display.Height,
-		Status:    "not_configured",
-	})
-}
-
-func workspaceDisplayViewerURL(workspaceID string) string {
-	base := strings.TrimRight(os.Getenv("DISPLAY_VIEWER_BASE_URL"), "/")
-	if base == "" {
-		return ""
-	}
-	parsed, err := url.Parse(base)
-	if err != nil || parsed.Scheme != "https" || parsed.Host == "" {
-		return ""
-	}
-	return base + "/" + url.PathEscape(workspaceID)
-}
@@ -1,417 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/models"
-	"github.com/gin-gonic/gin"
-)
-
-func TestValidateWorkspaceCompute_AcceptsPhase1SizingAndDisplayNone(t *testing.T) {
-	compute := models.WorkspaceCompute{
-		InstanceType: "m6i.xlarge",
-		Volume:       models.WorkspaceComputeVolume{RootGB: 100},
-		Display:      models.WorkspaceComputeDisplay{Mode: "none"},
-	}
-
-	if err := validateWorkspaceCompute(compute); err != nil {
-		t.Fatalf("validateWorkspaceCompute returned error for valid compute: %v", err)
-	}
-}
-
-func TestValidateWorkspaceCompute_RejectsUnknownInstanceType(t *testing.T) {
-	compute := models.WorkspaceCompute{InstanceType: "p4d.24xlarge"}
-
-	if err := validateWorkspaceCompute(compute); err == nil {
-		t.Fatal("validateWorkspaceCompute accepted unsupported instance type")
-	}
-}
-
-func TestValidateWorkspaceCompute_RejectsOutOfRangeRootVolume(t *testing.T) {
-	for _, rootGB := range []int{29, 501} {
-		compute := models.WorkspaceCompute{Volume: models.WorkspaceComputeVolume{RootGB: rootGB}}
-		if err := validateWorkspaceCompute(compute); err == nil {
-			t.Fatalf("validateWorkspaceCompute accepted root_gb=%d", rootGB)
-		}
-	}
-}
-
-func TestValidateWorkspaceCompute_RejectsOutOfRangeDisplayDimensions(t *testing.T) {
-	for _, display := range []models.WorkspaceComputeDisplay{
-		{Mode: "desktop-control", Protocol: "novnc", Width: 799, Height: 1080},
-		{Mode: "desktop-control", Protocol: "novnc", Width: 3841, Height: 1080},
-		{Mode: "desktop-control", Protocol: "novnc", Width: 1920, Height: 599},
-		{Mode: "desktop-control", Protocol: "novnc", Width: 1920, Height: 2161},
-	} {
-		compute := models.WorkspaceCompute{Display: display}
-		if err := validateWorkspaceCompute(compute); err == nil {
-			t.Fatalf("validateWorkspaceCompute accepted display size %dx%d", display.Width, display.Height)
-		}
-	}
-}
-
-func TestWorkspaceComputeJSON_OmitsEmptyNestedSections(t *testing.T) {
-	got, err := workspaceComputeJSON(models.WorkspaceCompute{
-		InstanceType: "m6i.xlarge",
-		Volume:       models.WorkspaceComputeVolume{RootGB: 100},
-	})
-	if err != nil {
-		t.Fatalf("workspaceComputeJSON returned error: %v", err)
-	}
-
-	if strings.Contains(got, `"display"`) {
-		t.Fatalf("workspaceComputeJSON included empty display section: %s", got)
-	}
-	if got != `{"instance_type":"m6i.xlarge","volume":{"root_gb":100}}` {
-		t.Fatalf("workspaceComputeJSON = %s", got)
-	}
-}
-
-func TestWorkspaceCreate_WithCompute_PersistsComputeJSON(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	broadcaster := newTestBroadcaster()
-	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectBegin()
-	mock.ExpectExec("INSERT INTO workspaces").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-	mock.ExpectExec(`UPDATE workspaces SET compute = \$2::jsonb`).
-		WithArgs(sqlmock.AnyArg(), sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-	mock.ExpectCommit()
-	mock.ExpectExec("INSERT INTO canvas_layouts").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	body := `{
-		"name":"Sized Agent",
-		"external":true,
-		"runtime":"external",
-		"compute":{
-			"instance_type":"m6i.xlarge",
-			"volume":{"root_gb":100},
-			"display":{"mode":"none"}
-		}
-	}`
-	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusCreated {
-		t.Fatalf("expected status 201, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceCreate_WithInvalidCompute_ReturnsBadRequest(t *testing.T) {
-	setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	body := `{
-		"name":"Oversized Agent",
-		"model":"gpt-4",
-		"compute":{"instance_type":"p4d.24xlarge"}
-	}`
-	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.Create(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected status 400, got %d: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestBuildProvisionerConfig_CopiesComputeSizingFromPayload(t *testing.T) {
-	mock := setupTestDB(t)
-	mock.ExpectQuery(`SELECT COALESCE\(workspace_dir`).
-		WithArgs("ws-compute").
-		WillReturnRows(sqlmock.NewRows([]string{"workspace_dir", "workspace_access"}).AddRow("", "none"))
-
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-	cfg := handler.buildProvisionerConfig(
-		context.Background(),
-		"ws-compute",
-		"",
-		nil,
-		models.CreateWorkspacePayload{
-			Tier:    4,
-			Runtime: "claude-code",
-			Compute: models.WorkspaceCompute{
-				InstanceType: "m6i.xlarge",
-				Volume:       models.WorkspaceComputeVolume{RootGB: 100},
-				Display:      models.WorkspaceComputeDisplay{Mode: "desktop-control", Protocol: "novnc", Width: 1920, Height: 1080},
-			},
-		},
-		nil,
-		t.TempDir(),
-		"workspace:ws-compute",
-	)
-
-	if cfg.InstanceType != "m6i.xlarge" {
-		t.Errorf("cfg.InstanceType = %q, want m6i.xlarge", cfg.InstanceType)
-	}
-	if cfg.DiskGB != 100 {
-		t.Errorf("cfg.DiskGB = %d, want 100", cfg.DiskGB)
-	}
-	if cfg.Display.Mode != "desktop-control" || cfg.Display.Protocol != "novnc" {
-		t.Errorf("cfg.Display mode/protocol = %q/%q, want desktop-control/novnc", cfg.Display.Mode, cfg.Display.Protocol)
-	}
-	if cfg.Display.Width != 1920 || cfg.Display.Height != 1080 {
-		t.Errorf("cfg.Display size = %dx%d, want 1920x1080", cfg.Display.Width, cfg.Display.Height)
-	}
-}
-
-func TestWithStoredCompute_LoadsComputeForRestartPayloads(t *testing.T) {
-	mock := setupTestDB(t)
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-restart-compute").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"instance_type":"m6i.xlarge","volume":{"root_gb":100}}`))
-
-	payload := models.CreateWorkspacePayload{Name: "Restart Me", Tier: 4, Runtime: "claude-code"}
-	got := withStoredCompute(context.Background(), "ws-restart-compute", payload)
-
-	if got.Compute.InstanceType != "m6i.xlarge" {
-		t.Errorf("stored compute instance_type = %q, want m6i.xlarge", got.Compute.InstanceType)
-	}
-	if got.Compute.Volume.RootGB != 100 {
-		t.Errorf("stored compute root_gb = %d, want 100", got.Compute.Volume.RootGB)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplay_NonDisplayWorkspaceReturnsUnavailable(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-no-display").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-no-display"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-no-display/display", nil)
-
-	handler.Display(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse display response: %v", err)
-	}
-	if resp["available"] != false {
-		t.Fatalf("available = %v, want false", resp["available"])
-	}
-	if resp["reason"] != "display_not_enabled" {
-		t.Fatalf("reason = %v, want display_not_enabled", resp["reason"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplay_DisplayConfiguredReturnsSessionUnavailableContract(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-display").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"display":{"mode":"desktop-control","protocol":"novnc","width":1920,"height":1080}}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-display/display", nil)
-
-	handler.Display(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse display response: %v", err)
-	}
-	if resp["available"] != false {
-		t.Fatalf("available = %v, want false", resp["available"])
-	}
-	if resp["reason"] != "display_session_unavailable" {
-		t.Fatalf("reason = %v, want display_session_unavailable", resp["reason"])
-	}
-	if resp["status"] != "not_configured" {
-		t.Fatalf("status = %v, want not_configured", resp["status"])
-	}
-	if resp["mode"] != "desktop-control" || resp["protocol"] != "novnc" {
-		t.Fatalf("mode/protocol = %v/%v, want desktop-control/novnc", resp["mode"], resp["protocol"])
-	}
-	if resp["width"] != float64(1920) || resp["height"] != float64(1080) {
-		t.Fatalf("width/height = %v/%v, want 1920/1080", resp["width"], resp["height"])
-	}
-	if _, ok := resp["url"]; ok {
-		t.Fatalf("display response exposed url before session infra exists: %v", resp["url"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplay_DisplayConfiguredWithViewerBaseReturnsAvailableSession(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	t.Setenv("DISPLAY_VIEWER_BASE_URL", "https://display.example.test/sessions")
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-display").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"display":{"mode":"desktop-control","protocol":"novnc","width":1920,"height":1080}}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-display/display", nil)
-
-	handler.Display(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse display response: %v", err)
-	}
-	if resp["available"] != true {
-		t.Fatalf("available = %v, want true", resp["available"])
-	}
-	if resp["viewer_url"] != "https://display.example.test/sessions/ws-display" {
-		t.Fatalf("viewer_url = %v, want workspace viewer URL", resp["viewer_url"])
-	}
-	if resp["reason"] != nil {
-		t.Fatalf("reason = %v, want omitted", resp["reason"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplay_DisplayConfiguredWithInvalidViewerBaseReturnsUnavailable(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	t.Setenv("DISPLAY_VIEWER_BASE_URL", "http://display.example.test/sessions")
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	workspaceID := "ws-display"
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs(workspaceID).
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"display":{"mode":"desktop-control","protocol":"novnc","width":1920,"height":1080}}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: workspaceID}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/"+workspaceID+"/display", nil)
-
-	handler.Display(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse display response: %v", err)
-	}
-	if resp["available"] != false {
-		t.Fatalf("available = %v, want false", resp["available"])
-	}
-	if resp["viewer_url"] != nil {
-		t.Fatalf("viewer_url = %v, want omitted for invalid viewer base", resp["viewer_url"])
-	}
-	if resp["reason"] != "display_session_unavailable" {
-		t.Fatalf("reason = %v, want display_session_unavailable", resp["reason"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplay_IgnoresUnrelatedStoredComputeSizingDrift(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-display-sizing-drift").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"instance_type":"old.large","display":{"mode":"desktop-control","protocol":"novnc","width":1920,"height":1080}}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display-sizing-drift"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-display-sizing-drift/display", nil)
-
-	handler.Display(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse display response: %v", err)
-	}
-	if resp["reason"] != "display_session_unavailable" {
-		t.Fatalf("reason = %v, want display_session_unavailable", resp["reason"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplay_InvalidStoredDisplayConfigReturnsServerError(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-invalid-display").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"display":{"mode":"desktop-control","protocol":"vnc"}}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-invalid-display"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-invalid-display/display", nil)
-
-	handler.Display(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Fatalf("expected status 500, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse display response: %v", err)
-	}
-	if resp["error"] != "invalid display config" {
-		t.Fatalf("error = %v, want invalid display config", resp["error"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
@@ -435,16 +435,13 @@ func (h *WorkspaceHandler) CascadeDelete(ctx context.Context, id string) ([]stri
 	if err != nil {
 		return nil, nil, fmt.Errorf("descendant query: %w", err)
 	}
-	defer descRows.Close()
 	for descRows.Next() {
 		var descID string
 		if descRows.Scan(&descID) == nil {
 			descendantIDs = append(descendantIDs, descID)
 		}
 	}
-	if err := descRows.Err(); err != nil {
-		return nil, nil, fmt.Errorf("CascadeDelete: failed iterating descendants: %w", err)
-	}
+	descRows.Close()

 	allIDs := append([]string{id}, descendantIDs...)

@@ -503,32 +503,6 @@ func TestCascadeDelete_DescendantQueryError(t *testing.T) {
 	// sqlmock verifies all expected queries were executed
 }

-func TestCascadeDelete_DescendantRowsError(t *testing.T) {
-	mock, _ := setupWorkspaceCrudTest(t)
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	// RowError(0, ...) requires a real row at index 0 to be reachable —
-	// sqlmock only invokes nextErr[N] when r.pos-1 == N and the row exists.
-	// AddRow ensures Next() attempts the first row, triggers the error,
-	// and rows.Err() returns the injected error.
-	h := &WorkspaceHandler{}
-	rows := sqlmock.NewRows([]string{"id"}).AddRow("desc-1").RowError(0, sql.ErrConnDone)
-	mock.ExpectQuery(`WITH RECURSIVE descendants AS`).
-		WithArgs(wsID).
-		WillReturnRows(rows)
-
-	deleted, stopErrs, err := h.CascadeDelete(context.Background(), wsID)
-	if err == nil {
-		t.Fatal("CascadeDelete returned nil error; want descendant rows error")
-	}
-	if deleted != nil {
-		t.Errorf("deleted = %v; want nil", deleted)
-	}
-	if stopErrs != nil {
-		t.Errorf("stopErrs = %v; want nil", stopErrs)
-	}
-}
-
 // Note: Full CascadeDelete testing requires mocking StopWorkspace, RemoveVolume,
 // and provisioner calls — covered in integration tests. Unit tests here focus on
 // the validation and pre-condition paths.
@@ -1,360 +0,0 @@
-package handlers
-
-import (
-	"context"
-	"crypto/subtle"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"time"
-
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/models"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/wsauth"
-	"github.com/gin-gonic/gin"
-)
-
-const (
-	displayControlDefaultTTLSeconds = 300
-	displayControlMinTTLSeconds     = 30
-	displayControlMaxTTLSeconds     = 3600
-)
-
-type workspaceDisplayControlResponse struct {
-	Controller   string    `json:"controller"`
-	ControlledBy string    `json:"controlled_by,omitempty"`
-	ExpiresAt    time.Time `json:"expires_at"`
-}
-
-type workspaceDisplayControlNoneResponse struct {
-	Controller string `json:"controller"`
-}
-
-type acquireDisplayControlRequest struct {
-	Controller string `json:"controller"`
-	TTLSeconds int    `json:"ttl_seconds"`
-}
-
-type releaseDisplayControlRequest struct {
-	Force bool `json:"force"`
-}
-
-// DisplayControl handles GET /workspaces/:id/display/control.
-func (h *WorkspaceHandler) DisplayControl(c *gin.Context) {
-	lock, found, err := h.loadActiveDisplayControl(c, c.Param("id"))
-	if err != nil {
-		log.Printf("DisplayControl: load lock for %s failed: %v", c.Param("id"), err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load display control"})
-		return
-	}
-	if !found {
-		c.JSON(http.StatusOK, workspaceDisplayControlNoneResponse{Controller: "none"})
-		return
-	}
-	c.JSON(http.StatusOK, lock)
-}
-
-// AcquireDisplayControl handles POST /workspaces/:id/display/control/acquire.
-func (h *WorkspaceHandler) AcquireDisplayControl(c *gin.Context) {
-	var req acquireDisplayControlRequest
-	if c.Request.Body != nil && c.Request.ContentLength != 0 {
-		if err := c.ShouldBindJSON(&req); err != nil {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid display control request"})
-			return
-		}
-	}
-	if req.Controller == "" {
-		req.Controller = "user"
-	}
-	if req.Controller != "user" {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "browser callers may only acquire user display control"})
-		return
-	}
-	if req.TTLSeconds == 0 {
-		req.TTLSeconds = displayControlDefaultTTLSeconds
-	}
-	if req.TTLSeconds < displayControlMinTTLSeconds || req.TTLSeconds > displayControlMaxTTLSeconds {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "ttl_seconds must be between 30 and 3600"})
-		return
-	}
-	if ok := h.displayControlEnabled(c, c.Param("id")); !ok {
-		return
-	}
-
-	controlledBy, ok := displayControlActor(c)
-	if !ok {
-		c.JSON(http.StatusForbidden, gin.H{"error": "display control requires admin-token or org-token auth"})
-		return
-	}
-	workspaceID := c.Param("id")
-	startedAt := time.Now()
-	emitDisplayControlEvent(c.Request.Context(), "display.control.acquire.started", workspaceID, map[string]any{
-		"controller":    req.Controller,
-		"controlled_by": controlledBy,
-		"ttl_seconds":   req.TTLSeconds,
-	})
-	var lock workspaceDisplayControlResponse
-	err := db.DB.QueryRowContext(c.Request.Context(), `
-INSERT INTO workspace_display_control_locks
-    (workspace_id, controller, controlled_by, expires_at)
-VALUES
-    ($1, $2, $3, now() + ($4 * interval '1 second'))
-ON CONFLICT (workspace_id) DO UPDATE
-SET controller = EXCLUDED.controller,
-    controlled_by = EXCLUDED.controlled_by,
-    expires_at = EXCLUDED.expires_at,
-    updated_at = now()
-WHERE workspace_display_control_locks.expires_at <= now()
-   OR workspace_display_control_locks.controlled_by = EXCLUDED.controlled_by
-RETURNING controller, controlled_by, expires_at`,
-		workspaceID, req.Controller, controlledBy, req.TTLSeconds,
-	).Scan(&lock.Controller, &lock.ControlledBy, &lock.ExpiresAt)
-	if err == nil {
-		emitDisplayControlEvent(c.Request.Context(), "display.control.acquire.completed", workspaceID, map[string]any{
-			"controller":    lock.Controller,
-			"controlled_by": lock.ControlledBy,
-			"ttl_seconds":   req.TTLSeconds,
-			"duration_ms":   time.Since(startedAt).Milliseconds(),
-		})
-		c.JSON(http.StatusOK, lock)
-		return
-	}
-	if err == sql.ErrNoRows {
-		current, found, loadErr := h.loadActiveDisplayControl(c, workspaceID)
-		if loadErr != nil {
-			log.Printf("AcquireDisplayControl: load active lock for %s failed: %v", workspaceID, loadErr)
-			emitDisplayControlEvent(c.Request.Context(), "display.control.acquire.failed", workspaceID, map[string]any{
-				"controlled_by": controlledBy,
-				"duration_ms":   time.Since(startedAt).Milliseconds(),
-				"error":         loadErr.Error(),
-			})
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load display control"})
-			return
-		}
-		emitDisplayControlEvent(c.Request.Context(), "display.control.acquire.failed", workspaceID, map[string]any{
-			"controlled_by": controlledBy,
-			"duration_ms":   time.Since(startedAt).Milliseconds(),
-			"error":         "display control already held",
-		})
-		if !found {
-			c.JSON(http.StatusConflict, gin.H{
-				"error":   "display control already held",
-				"current": workspaceDisplayControlNoneResponse{Controller: "none"},
-			})
-			return
-		}
-		c.JSON(http.StatusConflict, gin.H{
-			"error":   "display control already held",
-			"current": current,
-		})
-		return
-	}
-	log.Printf("AcquireDisplayControl: acquire lock for %s failed: %v", workspaceID, err)
-	emitDisplayControlEvent(c.Request.Context(), "display.control.acquire.failed", workspaceID, map[string]any{
-		"controlled_by": controlledBy,
-		"duration_ms":   time.Since(startedAt).Milliseconds(),
-		"error":         err.Error(),
-	})
-	c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to acquire display control"})
-}
-
-// ReleaseDisplayControl handles POST /workspaces/:id/display/control/release.
-func (h *WorkspaceHandler) ReleaseDisplayControl(c *gin.Context) {
-	var req releaseDisplayControlRequest
-	if c.Request.Body != nil && c.Request.ContentLength != 0 {
-		if err := c.ShouldBindJSON(&req); err != nil {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid display control release request"})
-			return
-		}
-	}
-	if req.Force {
-		if !displayControlIsAdminToken(c) {
-			c.JSON(http.StatusForbidden, gin.H{"error": "force release requires admin-token auth"})
-			return
-		}
-	}
-
-	controlledBy, ok := displayControlActor(c)
-	if !ok {
-		c.JSON(http.StatusForbidden, gin.H{"error": "display control requires admin-token or org-token auth"})
-		return
-	}
-	workspaceID := c.Param("id")
-	startedAt := time.Now()
-	emitDisplayControlEvent(c.Request.Context(), "display.control.release.started", workspaceID, map[string]any{
-		"controlled_by": controlledBy,
-		"force":         req.Force,
-	})
-	query := `DELETE FROM workspace_display_control_locks WHERE workspace_id = $1 AND controlled_by = $2`
-	args := []interface{}{workspaceID, controlledBy}
-	if req.Force {
-		query = `DELETE FROM workspace_display_control_locks WHERE workspace_id = $1`
-		args = []interface{}{workspaceID}
-	}
-	result, err := db.DB.ExecContext(c.Request.Context(), query, args...)
-	if err != nil {
-		log.Printf("ReleaseDisplayControl: release lock for %s failed: %v", workspaceID, err)
-		emitDisplayControlEvent(c.Request.Context(), "display.control.release.failed", workspaceID, map[string]any{
-			"controlled_by": controlledBy,
-			"duration_ms":   time.Since(startedAt).Milliseconds(),
-			"error":         err.Error(),
-			"force":         req.Force,
-		})
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to release display control"})
-		return
-	}
-	rowsAffected, err := result.RowsAffected()
-	if err != nil {
-		log.Printf("ReleaseDisplayControl: rows affected for %s failed: %v", workspaceID, err)
-		emitDisplayControlEvent(c.Request.Context(), "display.control.release.failed", workspaceID, map[string]any{
-			"controlled_by": controlledBy,
-			"duration_ms":   time.Since(startedAt).Milliseconds(),
-			"error":         err.Error(),
-			"force":         req.Force,
-		})
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to release display control"})
-		return
-	}
-	if rowsAffected == 0 {
-		current, found, loadErr := h.loadActiveDisplayControl(c, workspaceID)
-		if loadErr != nil {
-			log.Printf("ReleaseDisplayControl: load active lock for %s failed: %v", workspaceID, loadErr)
-			emitDisplayControlEvent(c.Request.Context(), "display.control.release.failed", workspaceID, map[string]any{
-				"controlled_by": controlledBy,
-				"duration_ms":   time.Since(startedAt).Milliseconds(),
-				"error":         loadErr.Error(),
-				"force":         req.Force,
-			})
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load display control"})
-			return
-		}
-		if !found {
-			emitDisplayControlEvent(c.Request.Context(), "display.control.release.completed", workspaceID, map[string]any{
-				"controlled_by": controlledBy,
-				"duration_ms":   time.Since(startedAt).Milliseconds(),
-				"force":         req.Force,
-				"rows_affected": rowsAffected,
-			})
-			c.JSON(http.StatusOK, workspaceDisplayControlNoneResponse{Controller: "none"})
-			return
-		}
-		emitDisplayControlEvent(c.Request.Context(), "display.control.release.failed", workspaceID, map[string]any{
-			"controlled_by": controlledBy,
-			"duration_ms":   time.Since(startedAt).Milliseconds(),
-			"error":         "display control held by another caller",
-			"force":         req.Force,
-		})
-		c.JSON(http.StatusConflict, gin.H{
-			"error":   "display control held by another caller",
-			"current": current,
-		})
-		return
-	}
-	emitDisplayControlEvent(c.Request.Context(), "display.control.release.completed", workspaceID, map[string]any{
-		"controlled_by": controlledBy,
-		"duration_ms":   time.Since(startedAt).Milliseconds(),
-		"force":         req.Force,
-		"rows_affected": rowsAffected,
-	})
-	c.JSON(http.StatusOK, workspaceDisplayControlNoneResponse{Controller: "none"})
-}
-
-func (h *WorkspaceHandler) loadActiveDisplayControl(c *gin.Context, workspaceID string) (workspaceDisplayControlResponse, bool, error) {
-	var lock workspaceDisplayControlResponse
-	err := db.DB.QueryRowContext(c.Request.Context(),
-		`SELECT controller, controlled_by, expires_at FROM workspace_display_control_locks WHERE workspace_id = $1 AND expires_at > now()`,
-		workspaceID,
-	).Scan(&lock.Controller, &lock.ControlledBy, &lock.ExpiresAt)
-	if err == nil {
-		return lock, true, nil
-	}
-	if err == sql.ErrNoRows {
-		return workspaceDisplayControlResponse{}, false, nil
-	}
-	return workspaceDisplayControlResponse{}, false, err
-}
-
-func (h *WorkspaceHandler) displayControlEnabled(c *gin.Context, workspaceID string) bool {
-	var raw string
-	err := db.DB.QueryRowContext(c.Request.Context(),
-		`SELECT COALESCE(compute, '{}'::jsonb) FROM workspaces WHERE id = $1`,
-		workspaceID,
-	).Scan(&raw)
-	if err != nil {
-		if err == sql.ErrNoRows {
-			c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
-			return false
-		}
-		log.Printf("displayControlEnabled: load compute for %s failed: %v", workspaceID, err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load display config"})
-		return false
-	}
-	compute, err := parseWorkspaceDisplayCompute(workspaceID, raw)
-	if err != nil {
-		log.Printf("displayControlEnabled: invalid display config for %s: %v", workspaceID, err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "invalid display config"})
-		return false
-	}
-	if compute.Display.Mode == "" || compute.Display.Mode == "none" {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "display not enabled"})
-		return false
-	}
-	return true
-}
-
-func parseWorkspaceDisplayCompute(workspaceID, raw string) (models.WorkspaceCompute, error) {
-	var compute models.WorkspaceCompute
-	if raw == "" || raw == "{}" {
-		return compute, nil
-	}
-	if err := json.Unmarshal([]byte(raw), &compute); err != nil {
-		return models.WorkspaceCompute{}, fmt.Errorf("invalid compute JSON for %s: %w", workspaceID, err)
-	}
-	if err := validateWorkspaceDisplayConfig(compute.Display); err != nil {
-		return models.WorkspaceCompute{}, err
-	}
-	return compute, nil
-}
-
-func displayControlActor(c *gin.Context) (string, bool) {
-	if v, ok := c.Get("org_token_prefix"); ok {
-		if s, ok := v.(string); ok && s != "" {
-			return actorOrgTokenPrefix + s, true
-		}
-	}
-	if displayControlIsAdminToken(c) {
-		return actorAdminToken, true
-	}
-	// Browser session auth is intentionally observe-only until AdminAuth
-	// exposes a stable per-user or per-session identity in gin.Context.
-	return "", false
-}
-
-func displayControlIsAdminToken(c *gin.Context) bool {
-	adminSecret := os.Getenv("ADMIN_TOKEN")
-	if adminSecret == "" {
-		return false
-	}
-	tok := wsauth.BearerTokenFromHeader(c.GetHeader("Authorization"))
-	return subtle.ConstantTimeCompare([]byte(tok), []byte(adminSecret)) == 1
-}
-
-func emitDisplayControlEvent(ctx context.Context, eventType string, workspaceID string, payload map[string]any) {
-	if payload == nil {
-		payload = map[string]any{}
-	}
-	payloadJSON, err := json.Marshal(payload)
-	if err != nil {
-		log.Printf("emitDisplayControlEvent: marshal %s payload failed: %v", eventType, err)
-		return
-	}
-	if _, err := db.DB.ExecContext(ctx, `
-		INSERT INTO structure_events (event_type, workspace_id, payload, created_at)
-		VALUES ($1, $2, $3::jsonb, now())
-	`, eventType, workspaceID, string(payloadJSON)); err != nil {
-		log.Printf("emitDisplayControlEvent: insert %s failed: %v", eventType, err)
-	}
-}
@@ -1,321 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"database/sql"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/gin-gonic/gin"
-)
-
-func attachDisplayControlAdminToken(t *testing.T, c *gin.Context) {
-	t.Helper()
-	t.Setenv("ADMIN_TOKEN", "test-admin-secret")
-	c.Request.Header.Set("Authorization", "Bearer test-admin-secret")
-}
-
-func TestWorkspaceDisplayControl_NoActiveLockReturnsNone(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectQuery(`SELECT controller, controlled_by, expires_at FROM workspace_display_control_locks WHERE workspace_id = \$1 AND expires_at > now\(\)`).
-		WithArgs("ws-display").
-		WillReturnError(sql.ErrNoRows)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("GET", "/workspaces/ws-display/display/control", nil)
-
-	handler.DisplayControl(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["controller"] != "none" {
-		t.Fatalf("controller = %v, want none", resp["controller"])
-	}
-	if _, ok := resp["expires_at"]; ok {
-		t.Fatalf("none response included expires_at: %#v", resp)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplayControlAcquire_ClaimsUnlockedDisplay(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-	expiresAt := time.Date(2026, 5, 23, 18, 30, 0, 0, time.UTC)
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-display").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"display":{"mode":"desktop-control","protocol":"dcv","width":1920,"height":1080}}`))
-	mock.ExpectQuery(`INSERT INTO workspace_display_control_locks`).
-		WithArgs("ws-display", "user", "admin-token", 300).
-		WillReturnRows(sqlmock.NewRows([]string{"controller", "controlled_by", "expires_at"}).
-			AddRow("user", "admin-token", expiresAt))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-display/display/control/acquire", bytes.NewBufferString(`{"controller":"user","ttl_seconds":300}`))
-	c.Request.Header.Set("Content-Type", "application/json")
-	attachDisplayControlAdminToken(t, c)
-
-	handler.AcquireDisplayControl(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["controller"] != "user" || resp["controlled_by"] != "admin-token" {
-		t.Fatalf("lock response = %#v, want user/admin-token", resp)
-	}
-	if resp["expires_at"] == "" {
-		t.Fatalf("expires_at missing in response: %#v", resp)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplayControlAcquire_ActiveLockReturnsConflict(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-	expiresAt := time.Date(2026, 5, 23, 18, 30, 0, 0, time.UTC)
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-display").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"display":{"mode":"desktop-control","protocol":"dcv","width":1920,"height":1080}}`))
-	mock.ExpectQuery(`INSERT INTO workspace_display_control_locks`).
-		WithArgs("ws-display", "user", "admin-token", 300).
-		WillReturnError(sql.ErrNoRows)
-	mock.ExpectQuery(`SELECT controller, controlled_by, expires_at FROM workspace_display_control_locks WHERE workspace_id = \$1 AND expires_at > now\(\)`).
-		WithArgs("ws-display").
-		WillReturnRows(sqlmock.NewRows([]string{"controller", "controlled_by", "expires_at"}).
-			AddRow("agent", "sidecar", expiresAt))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-display/display/control/acquire", bytes.NewBufferString(`{"controller":"user","ttl_seconds":300}`))
-	c.Request.Header.Set("Content-Type", "application/json")
-	attachDisplayControlAdminToken(t, c)
-
-	handler.AcquireDisplayControl(c)
-
-	if w.Code != http.StatusConflict {
-		t.Fatalf("expected status 409, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["error"] != "display control already held" {
-		t.Fatalf("error = %v, want display control already held", resp["error"])
-	}
-	current, ok := resp["current"].(map[string]interface{})
-	if !ok || current["controller"] != "agent" || current["controlled_by"] != "sidecar" {
-		t.Fatalf("current lock = %#v, want agent/sidecar", resp["current"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplayControlAcquire_RejectsDisplayDisabledWorkspace(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-no-display").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-no-display"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-no-display/display/control/acquire", bytes.NewBufferString(`{"controller":"user","ttl_seconds":300}`))
-	c.Request.Header.Set("Content-Type", "application/json")
-	attachDisplayControlAdminToken(t, c)
-
-	handler.AcquireDisplayControl(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected status 400, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["error"] != "display not enabled" {
-		t.Fatalf("error = %v, want display not enabled", resp["error"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplayControlAcquire_RejectsCoarseSessionActor(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectQuery(`SELECT COALESCE\(compute, '\{\}'::jsonb\) FROM workspaces WHERE id = \$1`).
-		WithArgs("ws-display").
-		WillReturnRows(sqlmock.NewRows([]string{"compute"}).AddRow(`{"display":{"mode":"desktop-control","protocol":"dcv","width":1920,"height":1080}}`))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-display/display/control/acquire", bytes.NewBufferString(`{"controller":"user","ttl_seconds":300}`))
-	c.Request.Header.Set("Content-Type", "application/json")
-	c.Request.Header.Set("Cookie", "molecule_session=present")
-
-	handler.AcquireDisplayControl(c)
-
-	if w.Code != http.StatusForbidden {
-		t.Fatalf("expected status 403, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["error"] != "display control requires admin-token or org-token auth" {
-		t.Fatalf("error = %v, want display control requires admin-token or org-token auth", resp["error"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplayControlRelease_RemovesCallerLock(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	mock.ExpectExec(`DELETE FROM workspace_display_control_locks WHERE workspace_id = \$1 AND controlled_by = \$2`).
-		WithArgs("ws-display", "admin-token").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-display/display/control/release", nil)
-	attachDisplayControlAdminToken(t, c)
-
-	handler.ReleaseDisplayControl(c)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["controller"] != "none" {
-		t.Fatalf("controller = %v, want none", resp["controller"])
-	}
-	if _, ok := resp["expires_at"]; ok {
-		t.Fatalf("none response included expires_at: %#v", resp)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplayControlRelease_ConflictWhenCallerDoesNotOwnLock(t *testing.T) {
-	mock := setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-	expiresAt := time.Date(2026, 5, 23, 18, 30, 0, 0, time.UTC)
-
-	mock.ExpectExec(`DELETE FROM workspace_display_control_locks WHERE workspace_id = \$1 AND controlled_by = \$2`).
-		WithArgs("ws-display", "admin-token").
-		WillReturnResult(sqlmock.NewResult(0, 0))
-	mock.ExpectQuery(`SELECT controller, controlled_by, expires_at FROM workspace_display_control_locks WHERE workspace_id = \$1 AND expires_at > now\(\)`).
-		WithArgs("ws-display").
-		WillReturnRows(sqlmock.NewRows([]string{"controller", "controlled_by", "expires_at"}).
-			AddRow("user", "org-token:abcd1234", expiresAt))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-display/display/control/release", nil)
-	attachDisplayControlAdminToken(t, c)
-
-	handler.ReleaseDisplayControl(c)
-
-	if w.Code != http.StatusConflict {
-		t.Fatalf("expected status 409, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["error"] != "display control held by another caller" {
-		t.Fatalf("error = %v, want display control held by another caller", resp["error"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestWorkspaceDisplayControlRelease_RejectsOrgTokenForceRelease(t *testing.T) {
-	setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Set("org_token_prefix", "abcd1234")
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-display/display/control/release", bytes.NewBufferString(`{"force":true}`))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	handler.ReleaseDisplayControl(c)
-
-	if w.Code != http.StatusForbidden {
-		t.Fatalf("expected status 403, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["error"] != "force release requires admin-token auth" {
-		t.Fatalf("error = %v, want force release requires admin-token auth", resp["error"])
-	}
-}
-
-func TestWorkspaceDisplayControlAcquire_RejectsAgentImpersonation(t *testing.T) {
-	setupTestDB(t)
-	handler := NewWorkspaceHandler(newTestBroadcaster(), nil, "http://localhost:8080", t.TempDir())
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "ws-display"}}
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-display/display/control/acquire", bytes.NewBufferString(`{"controller":"agent","ttl_seconds":300}`))
-	c.Request.Header.Set("Content-Type", "application/json")
-	attachDisplayControlAdminToken(t, c)
-
-	handler.AcquireDisplayControl(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Fatalf("expected status 400, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("failed to parse response: %v", err)
-	}
-	if resp["error"] != "browser callers may only acquire user display control" {
-		t.Fatalf("error = %v, want browser callers may only acquire user display control", resp["error"])
-	}
-}
@@ -288,22 +288,14 @@ func (h *WorkspaceHandler) buildProvisionerConfig(
 	}

 	return provisioner.WorkspaceConfig{
-		WorkspaceID:     workspaceID,
-		TemplatePath:    templatePath,
-		ConfigFiles:     configFiles,
-		PluginsPath:     pluginsPath,
-		WorkspacePath:   workspacePath,
-		WorkspaceAccess: workspaceAccess,
-		Tier:            payload.Tier,
-		Runtime:         payload.Runtime,
-		InstanceType:    payload.Compute.InstanceType,
-		DiskGB:          int32(payload.Compute.Volume.RootGB),
-		Display: provisioner.WorkspaceDisplayConfig{
-			Mode:     payload.Compute.Display.Mode,
-			Width:    payload.Compute.Display.Width,
-			Height:   payload.Compute.Display.Height,
-			Protocol: payload.Compute.Display.Protocol,
-		},
+		WorkspaceID:        workspaceID,
+		TemplatePath:       templatePath,
+		ConfigFiles:        configFiles,
+		PluginsPath:        pluginsPath,
+		WorkspacePath:      workspacePath,
+		WorkspaceAccess:    workspaceAccess,
+		Tier:               payload.Tier,
+		Runtime:            payload.Runtime,
 		EnvVars:            envVars,
 		PlatformURL:        h.platformURL,
 		AwarenessURL:       os.Getenv("AWARENESS_URL"),
@@ -317,9 +309,31 @@ func (h *WorkspaceHandler) buildProvisionerConfig(
 		// RuntimeImages[Runtime] :latest lookup, which is what the dead
 		// reader's sql.ErrNoRows path was producing already.
 		Image: "",
+		// Compute overrides (nullable — omitted = platform-managed default).
+		// Issue #1686 Phase 1.
+		InstanceType: extractComputeInstanceType(payload.Compute),
+		VolumeRootGB: extractComputeVolumeRootGB(payload.Compute),
 	}
 }

+// extractComputeInstanceType returns the instance type from a ComputeConfig,
+// or nil when cfg is nil or the field is empty.
+func extractComputeInstanceType(cfg *models.ComputeConfig) *string {
+	if cfg != nil && cfg.InstanceType != "" {
+		return &cfg.InstanceType
+	}
+	return nil
+}
+
+// extractComputeVolumeRootGB returns the root volume size from a ComputeConfig,
+// or nil when cfg is nil or the field is zero.
+func extractComputeVolumeRootGB(cfg *models.ComputeConfig) *int {
+	if cfg != nil && cfg.Volume.RootGB != 0 {
+		return &cfg.Volume.RootGB
+	}
+	return nil
+}
+
 // issueAndInjectToken rotates the workspace auth token and injects the
 // plaintext into cfg.ConfigFiles[".auth_token"] so it is written into the
 // /configs volume by WriteFilesToContainer immediately after the container
@@ -556,22 +570,13 @@ func (h *WorkspaceHandler) ensureDefaultConfig(workspaceID string, payload model
 	// via a crafted runtime string (#241).
 	runtime := sanitizeRuntime(payload.Runtime)

-	// Generate a minimal config.yaml.
-	//
-	// SSOT (CTO 2026-05-22): model is REQUIRED user input. The platform
-	// must not provide a default; the runtime must not fall back. The
-	// Create handler is responsible for rejecting empty model BEFORE
-	// reaching provisionWorkspace; this is a defence-in-depth assertion.
-	// If we hit here with an empty model the YAML below would still
-	// render a `model: ""` line — which renders all downstream provider
-	// derivation undefined. Log loudly and let the workspace boot into
-	// not_configured rather than masking the contract violation with a
-	// silently-broken default (the prior `anthropic:claude-opus-4-7`
-	// fallback was the canonical example — every codex workspace
-	// created without an explicit model wedged).
+	// Generate a minimal config.yaml
 	model := payload.Model
 	if model == "" {
-		log.Printf("ensureDefaultConfig: workspace %s reached provisioning with empty model — Create handler should have rejected this; rendering empty model: \"\" in config.yaml (workspace will boot not_configured)", workspaceID)
+		// SSOT: per-runtime defaults live in models/runtime_defaults.go
+		// (see RFC #2873). Was previously duplicated here AND in
+		// org_import.go; consolidating prevents silent drift.
+		model = models.DefaultModel(runtime)
 	}
 	if runtime == "claude-code" {
 		model = normalizeClaudeCodeModel(model)
@@ -1026,3 +1031,4 @@ func (h *WorkspaceHandler) provisionWorkspaceCP(workspaceID, templatePath string

 	log.Printf("CPProvisioner: workspace %s started as machine %s via control plane", workspaceID, machineID)
 }
+
@@ -756,55 +756,47 @@ func TestWorkspaceCreate_FirstDeploy_PersistsModelAndProvider(t *testing.T) {
 	}
 }

-// TestWorkspaceCreate_FirstDeploy_NoModel_Returns422 inverts the prior
-// premise (CTO 2026-05-22 SSOT directive — see
-// feedback_workspace_model_required_no_platform_default_dynamic_credential_intake
-// and TestCreate_ModelRequired_Returns422 in handlers_extended_test.go).
-//
-// Pre-2026-05-22 the canvas was allowed to omit `model` and the workspace
-// would 201 with no workspace_secrets rows for MODEL/LLM_PROVIDER (the
-// thinking being that templates inherit the runtime default later). That
-// "soft fallback" was the load-bearing bug magnet — `DefaultModel(runtime)`
-// would later return `anthropic:claude-opus-4-7`, and codex workspaces
-// wedged forever at adapter init.
-//
-// New contract: empty model is a 422 MODEL_REQUIRED, with NO DB writes
-// at all. The gate fires at the Create boundary before INSERT INTO
-// workspaces. The follow-on workspace_secrets gate (which the original
-// test pinned) is therefore unreachable on the empty-model path — there
-// is no row to mint secrets for.
-func TestWorkspaceCreate_FirstDeploy_NoModel_Returns422(t *testing.T) {
+// TestWorkspaceCreate_FirstDeploy_NoModel_NoSecretWritten asserts that
+// when payload.Model is empty, NEITHER MODEL nor LLM_PROVIDER is
+// written. Important: the canvas can omit `model` (template inherits
+// the runtime default later); we must not poison workspace_secrets with
+// empty rows in that case.
+func TestWorkspaceCreate_FirstDeploy_NoModel_NoSecretWritten(t *testing.T) {
 	mock := setupTestDB(t)
 	setupTestRedis(t)
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())

-	// NO mock.ExpectBegin / INSERT INTO workspaces — the Create gate
-	// MUST fire before any DB write. If the gate fires late, sqlmock
-	// will surface "call to ExecQuery 'INSERT INTO workspaces' was not
-	// expected" — which is exactly the failure mode we want to flag.
+	mock.ExpectBegin()
+	mock.ExpectExec("INSERT INTO workspaces").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectCommit()
+	// NO INSERT INTO workspace_secrets here — the gate is payload.Model != "".
+
+	mock.ExpectExec("INSERT INTO canvas_layouts").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO structure_events").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec(`UPDATE workspaces SET status =`).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_auth_tokens").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO structure_events").
+		WillReturnResult(sqlmock.NewResult(0, 1))

-	// Body: hermes runtime WITHOUT external:true (the external-runtime
-	// exemption — see TestCreate_ExternalRuntime_NoModel_OK — does NOT
-	// apply here; hermes spawns a real adapter and model selection
-	// matters at adapter init). This is exactly the shape the old
-	// "no-model-no-secret-write" test pinned, minus the external flag.
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	body := `{"name":"No Model Agent","runtime":"hermes"}`
+	body := `{"name":"No Model Agent","runtime":"hermes","external":true}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

 	handler.Create(c)

-	if w.Code != http.StatusUnprocessableEntity {
-		t.Fatalf("expected 422 MODEL_REQUIRED for empty model, got %d: %s", w.Code, w.Body.String())
-	}
-	if !bytes.Contains(w.Body.Bytes(), []byte(`"code":"MODEL_REQUIRED"`)) {
-		t.Errorf("expected code=MODEL_REQUIRED in body, got %s", w.Body.String())
+	if w.Code != http.StatusCreated {
+		t.Fatalf("expected status 201, got %d: %s", w.Code, w.Body.String())
 	}
 	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock saw an unexpected DB write — the MODEL_REQUIRED gate fired too late: %v", err)
+		t.Errorf("sqlmock expectations not met — empty payload.Model should NOT trigger workspace_secrets writes: %v", err)
 	}
 }

@@ -193,17 +193,10 @@ func TestEnsureDefaultConfig_Hermes(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())

-	// Post-CTO-SSOT-directive (2026-05-22): model is required user input;
-	// ensureDefaultConfig no longer fills in a runtime default. The Create
-	// handler gates on empty model and 422s before reaching here, so this
-	// test now passes the model explicitly to exercise the YAML rendering
-	// path — same model value the prior implicit DefaultModel("hermes")
-	// returned.
 	payload := models.CreateWorkspacePayload{
 		Name:    "Test Agent",
 		Tier:    1,
 		Runtime: "hermes",
-		Model:   "anthropic:claude-opus-4-7",
 	}

 	files := handler.ensureDefaultConfig("ws-test-123", payload)
@@ -226,7 +219,7 @@ func TestEnsureDefaultConfig_Hermes(t *testing.T) {
 		t.Errorf("config.yaml missing tier, got:\n%s", content)
 	}
 	if !contains(content, `model: "anthropic:claude-opus-4-7"`) {
-		t.Errorf("config.yaml should render the supplied model, got:\n%s", content)
+		t.Errorf("config.yaml should use default non-claude model, got:\n%s", content)
 	}
 }

@@ -234,14 +227,10 @@ func TestEnsureDefaultConfig_ClaudeCode(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())

-	// Post-CTO-SSOT-directive (2026-05-22): model is supplied explicitly
-	// instead of relying on the deleted DefaultModel("claude-code") =
-	// "sonnet" fallback. The Create handler 422s on empty model upstream.
 	payload := models.CreateWorkspacePayload{
 		Name:    "Code Agent",
 		Tier:    2,
 		Runtime: "claude-code",
-		Model:   "sonnet",
 	}

 	files := handler.ensureDefaultConfig("ws-code-123", payload)
@@ -418,16 +407,9 @@ func TestEnsureDefaultConfig_EmptyRuntimeDefaultsToClaudeCode(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())

-	// Post-CTO-SSOT-directive (2026-05-22): ensureDefaultConfig is no
-	// longer the source of the model default — it just renders whatever
-	// the Create handler decided. The "empty runtime → claude-code"
-	// fallback inside sanitizeRuntime() is still in effect; this test
-	// continues to pin that behaviour by supplying the explicit
-	// claude-code model that the Create handler would have required.
 	payload := models.CreateWorkspacePayload{
-		Name:  "Default Agent",
-		Tier:  1,
-		Model: "sonnet",
+		Name: "Default Agent",
+		Tier: 1,
 	}

 	files := handler.ensureDefaultConfig("ws-empty-rt", payload)
@@ -436,7 +418,7 @@ func TestEnsureDefaultConfig_EmptyRuntimeDefaultsToClaudeCode(t *testing.T) {
 		t.Errorf("empty runtime should default to claude-code, got:\n%s", configYAML)
 	}
 	if !contains(configYAML, `model: "sonnet"`) {
-		t.Errorf("claude-code workspace should render the supplied model (quoted), got:\n%s", configYAML)
+		t.Errorf("claude-code default model should be sonnet (quoted), got:\n%s", configYAML)
 	}
 }

@@ -797,6 +779,75 @@ func TestBuildProvisionerConfig_WorkspacePathFromEnv(t *testing.T) {
 	}
 }

+// TestBuildProvisionerConfig_ComputeOverrides verifies that #1686 Phase 1
+// compute fields (instance_type + volume.root_gb) are threaded from the
+// create payload into the provisioner config.
+func TestBuildProvisionerConfig_ComputeOverrides(t *testing.T) {
+	mock := setupTestDB(t)
+	mock.ExpectQuery(`SELECT COALESCE\(workspace_dir`).
+		WithArgs("ws-compute").
+		WillReturnRows(sqlmock.NewRows([]string{"workspace_dir", "workspace_access"}).AddRow("", "none"))
+
+	broadcaster := newTestBroadcaster()
+	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
+
+	cfg := handler.buildProvisionerConfig(
+		context.Background(),
+		"ws-compute",
+		"",
+		nil,
+		models.CreateWorkspacePayload{
+			Tier:    2,
+			Runtime: "python",
+			Compute: &models.ComputeConfig{
+				InstanceType: "g4dn.xlarge",
+				Volume:       models.ComputeVolume{RootGB: 256},
+			},
+		},
+		nil,
+		"",
+		"workspace:ws-compute",
+	)
+
+	if cfg.InstanceType == nil || *cfg.InstanceType != "g4dn.xlarge" {
+		t.Errorf("InstanceType = %v, want g4dn.xlarge", cfg.InstanceType)
+	}
+	if cfg.VolumeRootGB == nil || *cfg.VolumeRootGB != 256 {
+		t.Errorf("VolumeRootGB = %v, want 256", cfg.VolumeRootGB)
+	}
+}
+
+// TestBuildProvisionerConfig_ComputeNil verifies backward compat: when the
+// payload omits compute, the provisioner config fields are nil so the CP
+// applies its own defaults.
+func TestBuildProvisionerConfig_ComputeNil(t *testing.T) {
+	mock := setupTestDB(t)
+	mock.ExpectQuery(`SELECT COALESCE\(workspace_dir`).
+		WithArgs("ws-no-compute").
+		WillReturnRows(sqlmock.NewRows([]string{"workspace_dir", "workspace_access"}).AddRow("", "none"))
+
+	broadcaster := newTestBroadcaster()
+	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
+
+	cfg := handler.buildProvisionerConfig(
+		context.Background(),
+		"ws-no-compute",
+		"",
+		nil,
+		models.CreateWorkspacePayload{Tier: 1, Runtime: "python"},
+		nil,
+		"",
+		"workspace:ws-no-compute",
+	)
+
+	if cfg.InstanceType != nil {
+		t.Errorf("InstanceType = %v, want nil", cfg.InstanceType)
+	}
+	if cfg.VolumeRootGB != nil {
+		t.Errorf("VolumeRootGB = %v, want nil", cfg.VolumeRootGB)
+	}
+}
+
 // ==================== issueAndInjectToken (issue #418) ====================

 // TestIssueAndInjectToken_HappyPath verifies that on a normal (re)provision the
@@ -806,8 +857,6 @@ func TestIssueAndInjectToken_HappyPath(t *testing.T) {
 	mock := setupTestDB(t)
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")

 	// RevokeAllForWorkspace UPDATE (0 rows — no prior tokens, still succeeds)
 	mock.ExpectExec(`UPDATE workspace_auth_tokens SET revoked_at`).
@@ -845,8 +894,6 @@ func TestIssueAndInjectToken_RotatesExistingToken(t *testing.T) {
 	mock := setupTestDB(t)
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")

 	// RevokeAllForWorkspace: 1 existing token revoked
 	mock.ExpectExec(`UPDATE workspace_auth_tokens SET revoked_at`).
@@ -913,8 +960,6 @@ func TestIssueAndInjectToken_IssueFailSkipsInjection(t *testing.T) {
 	mock := setupTestDB(t)
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")

 	mock.ExpectExec(`UPDATE workspace_auth_tokens SET revoked_at`).
 		WithArgs("ws-418-issue-fail").
@@ -941,8 +986,6 @@ func TestIssueAndInjectToken_NilConfigFilesAllocated(t *testing.T) {
 	mock := setupTestDB(t)
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
-	t.Setenv("MOLECULE_ORG_ID", "")
-	t.Setenv("MOLECULE_DEPLOY_MODE", "self-hosted")

 	mock.ExpectExec(`UPDATE workspace_auth_tokens SET revoked_at`).
 		WithArgs("ws-418-nil-cfg").
@@ -164,7 +164,7 @@ func (h *WorkspaceHandler) maybeRestartAfterFileWrite(workspaceID string) {
 // isRestarting reports whether a restart cycle is currently in flight for
 // the workspace. Callers that have their own "container looks dead" probe
 // MUST consult this before triggering a restart, because during the
-// 20-30s EC2-pending window the workspace's url=” and IsRunning()=false
+// 20-30s EC2-pending window the workspace's url='' and IsRunning()=false
 // looks identical to a dead container — and any restart-triggering probe
 // (maybeMarkContainerDead from canvas /delegations poll, or the trailing
 // restart-context probe at the end of runRestartCycle) will set
@@ -337,7 +337,7 @@ func (h *WorkspaceHandler) Restart(c *gin.Context) {
 	}

 	var configFiles map[string][]byte
-	payload := withStoredCompute(ctx, id, models.CreateWorkspacePayload{Name: wsName, Tier: tier, Runtime: containerRuntime})
+	payload := models.CreateWorkspacePayload{Name: wsName, Tier: tier, Runtime: containerRuntime}
 	log.Printf("Restart: workspace %s (%s) runtime=%q", wsName, id, containerRuntime)

 	// #12: ?reset=true (or body.Reset) discards the claude-sessions volume
@@ -791,7 +791,7 @@ func (h *WorkspaceHandler) runRestartCycle(workspaceID string) {
 	})

 	// Runtime from DB — no more config file parsing
-	payload := withStoredCompute(ctx, workspaceID, models.CreateWorkspacePayload{Name: wsName, Tier: tier, Runtime: dbRuntime})
+	payload := models.CreateWorkspacePayload{Name: wsName, Tier: tier, Runtime: dbRuntime}

 	// Snapshot restart-context data before the new session overwrites
 	// last_heartbeat_at. Issue #19 Layer 1.
@@ -858,9 +858,6 @@ func (h *WorkspaceHandler) Pause(c *gin.Context) {
 				toPause = append(toPause, struct{ id, name string }{cid, cname})
 			}
 		}
-		if err := rows.Err(); err != nil {
-			log.Printf("Pause: descendant query rows.Err: %v", err)
-		}
 	}

 	// Stop containers and mark all as paused. StopWorkspaceAuto routes
@@ -942,9 +939,6 @@ func (h *WorkspaceHandler) Resume(c *gin.Context) {
 				toResume = append(toResume, ws)
 			}
 		}
-		if err := rows.Err(); err != nil {
-			log.Printf("Resume: descendant query rows.Err: %v", err)
-		}
 	}

 	// Re-provision all
@@ -954,7 +948,7 @@ func (h *WorkspaceHandler) Resume(c *gin.Context) {
 		h.broadcaster.RecordAndBroadcast(ctx, string(events.EventWorkspaceProvisioning), ws.id, map[string]interface{}{
 			"name": ws.name, "tier": ws.tier, "runtime": ws.runtime,
 		})
-		payload := withStoredCompute(ctx, ws.id, models.CreateWorkspacePayload{Name: ws.name, Tier: ws.tier, Runtime: ws.runtime})
+		payload := models.CreateWorkspacePayload{Name: ws.name, Tier: ws.tier, Runtime: ws.runtime}
 		// Resume is provision-only (workspace is paused, no live container
 		// to stop). provisionWorkspaceAuto handles backend routing and the
 		// no-backend mark-failed fallback identically to Create. Pre-
@@ -8,6 +8,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"

@@ -29,7 +30,7 @@ func TestWorkspaceGet_Success(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs("cccccccc-0001-0000-0000-000000000000").
@@ -37,7 +38,7 @@ func TestWorkspaceGet_Success(t *testing.T) {
 			AddRow("cccccccc-0001-0000-0000-000000000000", "My Agent", "worker", 1, "online", []byte(`{"name":"test"}`),
 				"http://localhost:8001", nil, 2, 1, 0.05, "", 3600, "working", "langgraph",
 				"", 10.0, 20.0, false,
-				nil, 0, false, true, []byte(`{}`)))
+				nil, 0, false, true))

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -119,7 +120,7 @@ func TestWorkspaceGet_RemovedReturns410(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs(id).
@@ -127,7 +128,7 @@ func TestWorkspaceGet_RemovedReturns410(t *testing.T) {
 			AddRow(id, "Old Agent", "worker", 1, string(models.StatusRemoved), []byte(`null`),
 				"", nil, 0, 1, 0.0, "", 0, "", "langgraph",
 				"", 0.0, 0.0, false,
-				nil, 0, false, true, []byte(`{}`)))
+				nil, 0, false, true))
 	mock.ExpectQuery(`SELECT updated_at FROM workspaces`).
 		WithArgs(id).
 		WillReturnRows(sqlmock.NewRows([]string{"updated_at"}).AddRow(removedAt))
@@ -183,7 +184,7 @@ func TestWorkspaceGet_RemovedReturns410WithNullRemovedAtOnTimestampFetchFailure(
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs(id).
@@ -191,7 +192,7 @@ func TestWorkspaceGet_RemovedReturns410WithNullRemovedAtOnTimestampFetchFailure(
 			AddRow(id, "Vanished", "worker", 1, string(models.StatusRemoved), []byte(`null`),
 				"", nil, 0, 1, 0.0, "", 0, "", "langgraph",
 				"", 0.0, 0.0, false,
-				nil, 0, false, true, []byte(`{}`)))
+				nil, 0, false, true))
 	// Simulate the row vanishing between the two queries.
 	mock.ExpectQuery(`SELECT updated_at FROM workspaces`).
 		WithArgs(id).
@@ -246,7 +247,7 @@ func TestWorkspaceGet_RemovedWithIncludeQueryReturns200(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs(id).
@@ -254,7 +255,7 @@ func TestWorkspaceGet_RemovedWithIncludeQueryReturns200(t *testing.T) {
 			AddRow(id, "Audit Agent", "worker", 1, string(models.StatusRemoved), []byte(`null`),
 				"", nil, 0, 1, 0.0, "", 0, "", "langgraph",
 				"", 0.0, 0.0, false,
-				nil, 0, false, true, []byte(`{}`)))
+				nil, 0, false, true))
 	// last_outbound_at follow-up query (existing path)
 	mock.ExpectQuery(`SELECT last_outbound_at FROM workspaces`).
 		WithArgs(id).
@@ -342,14 +343,14 @@ func TestWorkspaceCreate_DBInsertError(t *testing.T) {
 	// Transaction begins, workspace INSERT fails, transaction is rolled back.
 	mock.ExpectBegin()
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Failing Agent", nil, 3, "langgraph", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "Failing Agent", nil, 3, "langgraph", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnError(sql.ErrConnDone)
 	mock.ExpectRollback()

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"Failing Agent","model":"anthropic:claude-opus-4-7"}`
+	body := `{"name":"Failing Agent"}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -364,6 +365,94 @@ func TestWorkspaceCreate_DBInsertError(t *testing.T) {
 	}
 }

+// TestWorkspaceCreate_InvalidCompute verifies #1686 Phase 1 create-time
+// validation: bad instance_type or volume.root_gb returns 400 before any
+// DB call.
+func TestWorkspaceCreate_InvalidCompute(t *testing.T) {
+	broadcaster := newTestBroadcaster()
+	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
+
+	cases := []struct {
+		name string
+		body string
+		want string
+	}{
+		{
+			name: "instance_type too long",
+			body: `{"name":"Bad Type","compute":{"instance_type":"` + strings.Repeat("x", 65) + `"}}`,
+			want: "compute.instance_type too long",
+		},
+		{
+			name: "root_gb too small",
+			body: `{"name":"Small Disk","compute":{"volume":{"root_gb":16}}}`,
+			want: "compute.volume.root_gb must be at least 32",
+		},
+		{
+			name: "root_gb too large",
+			body: `{"name":"Big Disk","compute":{"volume":{"root_gb":4096}}}`,
+			want: "compute.volume.root_gb exceeds maximum 2048",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			c, _ := gin.CreateTestContext(w)
+			c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(tc.body))
+			c.Request.Header.Set("Content-Type", "application/json")
+
+			handler.Create(c)
+			if w.Code != http.StatusBadRequest {
+				t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+			}
+			if !strings.Contains(w.Body.String(), tc.want) {
+				t.Errorf("body %q should contain %q", w.Body.String(), tc.want)
+			}
+		})
+	}
+}
+
+// TestWorkspaceCreate_WithComputeOverrides verifies that valid #1686 Phase 1
+// compute fields are persisted into the workspaces table.
+func TestWorkspaceCreate_WithComputeOverrides(t *testing.T) {
+	mock := setupTestDB(t)
+	setupTestRedis(t)
+	broadcaster := newTestBroadcaster()
+	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
+
+	mock.ExpectBegin()
+	instanceType := "g4dn.xlarge"
+	rootGB := 256
+	mock.ExpectExec("INSERT INTO workspaces").
+		WithArgs(sqlmock.AnyArg(), "GPU Agent", nil, 3, "python", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", &instanceType, &rootGB).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectCommit()
+
+	mock.ExpectExec("INSERT INTO canvas_layouts").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO structure_events").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO structure_events").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec(`UPDATE workspaces SET status =`).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO workspace_config").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	body := `{"name":"GPU Agent","runtime":"python","compute":{"instance_type":"g4dn.xlarge","volume":{"root_gb":256}}}`
+	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	handler.Create(c)
+	if w.Code != http.StatusCreated {
+		t.Errorf("expected 201, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
+	}
+}
+
 func TestWorkspaceCreate_DefaultsApplied(t *testing.T) {
 	mock := setupTestDB(t)
 	setupTestRedis(t)
@@ -375,7 +464,7 @@ func TestWorkspaceCreate_DefaultsApplied(t *testing.T) {
 	// Expect workspace INSERT with defaulted tier=3 (Privileged — the
 	// handler default in workspace.go), runtime="langgraph"
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Default Agent", nil, 3, "langgraph", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "Default Agent", nil, 3, "langgraph", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()

@@ -391,7 +480,7 @@ func TestWorkspaceCreate_DefaultsApplied(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"Default Agent","model":"anthropic:claude-opus-4-7"}`
+	body := `{"name":"Default Agent"}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -423,7 +512,7 @@ func TestWorkspaceCreate_SaaSHardForcesTier4(t *testing.T) {

 	mock.ExpectBegin()
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "SaaS External Agent", nil, 4, "external", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "SaaS External Agent", nil, 4, "external", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
@@ -438,7 +527,7 @@ func TestWorkspaceCreate_SaaSHardForcesTier4(t *testing.T) {

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	body := `{"name":"SaaS External Agent","runtime":"external","model":"external:custom","external":true,"url":"https://example.com/agent","tier":2}`
+	body := `{"name":"SaaS External Agent","runtime":"external","external":true,"url":"https://example.com/agent","tier":2}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -464,7 +553,7 @@ func TestWorkspaceCreate_WithSecrets_Persists(t *testing.T) {

 	mock.ExpectBegin()
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Hermes Agent", nil, 3, "hermes", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "Hermes Agent", nil, 3, "hermes", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	// Secret inserted inside the same transaction.
 	mock.ExpectExec("INSERT INTO workspace_secrets").
@@ -479,7 +568,7 @@ func TestWorkspaceCreate_WithSecrets_Persists(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"Hermes Agent","runtime":"hermes","model":"anthropic:claude-opus-4-7","external":true,"secrets":{"HERMES_API_KEY":"sk-test-123"}}`
+	body := `{"name":"Hermes Agent","runtime":"hermes","external":true,"secrets":{"HERMES_API_KEY":"sk-test-123"}}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -513,7 +602,7 @@ func TestWorkspaceCreate_SecretPersistFails_RollsBack(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"Rollback Agent","model":"anthropic:claude-opus-4-7","secrets":{"OPENAI_API_KEY":"sk-fail"}}`
+	body := `{"name":"Rollback Agent","secrets":{"OPENAI_API_KEY":"sk-fail"}}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -548,7 +637,7 @@ func TestWorkspaceCreate_EmptySecrets_OK(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"No Secrets Agent","model":"anthropic:claude-opus-4-7","external":true,"secrets":{}}`
+	body := `{"name":"No Secrets Agent","external":true,"secrets":{}}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -576,7 +665,7 @@ func TestWorkspaceCreate_ExternalURL_SSRFSafe(t *testing.T) {

 	mock.ExpectBegin()
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Ext Agent", nil, 3, "external", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "Ext Agent", nil, 3, "external", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	// External URL update (localhost is explicitly allowed by validateAgentURL).
@@ -587,7 +676,7 @@ func TestWorkspaceCreate_ExternalURL_SSRFSafe(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"Ext Agent","runtime":"external","model":"external:custom","external":true,"url":"http://localhost:8000"}`
+	body := `{"name":"Ext Agent","runtime":"external","external":true,"url":"http://localhost:8000"}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -615,7 +704,7 @@ func TestWorkspaceCreate_KimiRuntime_PreservesLabel(t *testing.T) {

 	mock.ExpectBegin()
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Kimi Agent", nil, 3, "kimi", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "Kimi Agent", nil, 3, "kimi", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	// Pre-register flow: awaiting_agent + runtime preserved as "kimi"
@@ -629,7 +718,7 @@ func TestWorkspaceCreate_KimiRuntime_PreservesLabel(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"Kimi Agent","runtime":"kimi","model":"kimi-coding/kimi-k2-coding-6","tier":3,"canvas":{"x":100,"y":100}}`
+	body := `{"name":"Kimi Agent","runtime":"kimi","tier":3,"canvas":{"x":100,"y":100}}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -659,7 +748,7 @@ func TestWorkspaceCreate_ExternalURL_SSRFMetadataBlocked(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"Bad Agent","runtime":"external","model":"external:custom","external":true,"url":"http://169.254.169.254/latest/meta-data/"}`
+	body := `{"name":"Bad Agent","runtime":"external","external":true,"url":"http://169.254.169.254/latest/meta-data/"}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -690,7 +779,7 @@ func TestWorkspaceCreate_ExternalURL_SSRFLoopbackBlocked(t *testing.T) {
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)

-	body := `{"name":"Bad Loopback","runtime":"external","model":"external:custom","external":true,"url":"http://127.0.0.1:9000/a2a"}`
+	body := `{"name":"Bad Loopback","runtime":"external","external":true,"url":"http://127.0.0.1:9000/a2a"}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -718,7 +807,7 @@ func TestWorkspaceList_Empty(t *testing.T) {
 			"parent_id", "active_tasks", "last_error_rate", "last_sample_error",
 			"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 			"budget_limit", "monthly_spend",
-			"broadcast_enabled", "talk_to_user_enabled", "compute",
+			"broadcast_enabled", "talk_to_user_enabled",
 		}))

 	w := httptest.NewRecorder()
@@ -1422,7 +1511,7 @@ func TestWorkspaceGet_FinancialFieldsStripped(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	// Populate with non-zero financial values to confirm they are stripped.
 	mock.ExpectQuery("SELECT w.id, w.name").
@@ -1431,7 +1520,7 @@ func TestWorkspaceGet_FinancialFieldsStripped(t *testing.T) {
 			AddRow("cccccccc-0010-0000-0000-000000000000", "Finance Test", "worker", 1, "online", []byte(`{}`),
 				"http://localhost:9001", nil, 0, 1, 0.0, "", 0, "", "langgraph",
 				"", 0.0, 0.0, false,
-				int64(50000), int64(12500), false, true, []byte(`{}`))) // budget_limit=500 USD, spend=125 USD
+				int64(50000), int64(12500), false, true)) // budget_limit=500 USD, spend=125 USD

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -1479,7 +1568,7 @@ func TestWorkspaceGet_SensitiveFieldsStripped(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled", "compute",
+		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs("cccccccc-0955-0000-0000-000000000000").
@@ -1492,7 +1581,7 @@ func TestWorkspaceGet_SensitiveFieldsStripped(t *testing.T) {
 				"langgraph",
 				"/home/user/secret-projects/client-work",
 				0.0, 0.0, false,
-				nil, 0, false, true, []byte(`{}`)))
+				nil, 0, false, true))

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
@@ -1639,7 +1728,7 @@ runtime_config:
 	mock.ExpectExec("INSERT INTO workspaces").
 		WithArgs(
 			sqlmock.AnyArg(), "Hermes Agent", nil, 3, "hermes",
-			sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+			sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
@@ -1696,7 +1785,7 @@ model: anthropic:claude-sonnet-4-5
 	mock.ExpectExec("INSERT INTO workspaces").
 		WithArgs(
 			sqlmock.AnyArg(), "Legacy Agent", nil, 3, "langgraph",
-			sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+			sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
@@ -1749,7 +1838,7 @@ runtime_config:
 	mock.ExpectExec("INSERT INTO workspaces").
 		WithArgs(
 			sqlmock.AnyArg(), "Custom Hermes", nil, 3, "hermes",
-			sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+			sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
@@ -1844,43 +1933,39 @@ func TestWorkspaceCreate_188_TemplateConfigNoRuntimeKey_FailsClosed(t *testing.T
 	}
 }

-// Pre-2026-05-22 this test guarded "bare {name} → langgraph 201" — the
-// regression check for controlplane#188 (where an explicit runtime that
-// failed to resolve must NOT silently substitute langgraph) had a sibling
-// to ensure the LEGITIMATE bare default still landed on langgraph.
-//
-// Post-CTO-SSOT-directive (2026-05-22) bare body is 422 MODEL_REQUIRED
-// before reaching the langgraph branch — the gate runs AFTER the
-// langgraph-default assignment so the error body still surfaces
-// runtime=langgraph (helps the caller see "ok, langgraph WOULD have
-// been the runtime, but you still owe me a model"). The bare-body
-// langgraph 201 path no longer exists; what we guard now is the
-// 422-shape diagnostic.
-//
-// Bare-body-with-explicit-model 201 (the new "legitimate default" path)
-// is covered by TestWorkspaceCreate in handlers_test.go — no need to
-// duplicate the mock dance here.
-func TestWorkspaceCreate_188_NoTemplateNoRuntime_NowMODEL_REQUIRED(t *testing.T) {
-	setupTestDB(t)
+// Regression guard: the legitimate default path (no template, no runtime —
+// bare {"name":...}) MUST still default to langgraph and return 201. The
+// #188 fix must not break this.
+func TestWorkspaceCreate_188_NoTemplateNoRuntime_StillDefaultsLanggraph(t *testing.T) {
+	mock := setupTestDB(t)
 	setupTestRedis(t)
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())

+	mock.ExpectBegin()
+	mock.ExpectExec("INSERT INTO workspaces").
+		WithArgs(sqlmock.AnyArg(), "Plain Default", nil, 3, "langgraph", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectCommit()
+	mock.ExpectExec("INSERT INTO canvas_layouts").
+		WithArgs(sqlmock.AnyArg(), float64(0), float64(0)).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO structure_events").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	body := `{"name":"Plain Default"}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")
+
 	handler.Create(c)

-	if w.Code != http.StatusUnprocessableEntity {
-		t.Fatalf("bare-body create: expected 422 MODEL_REQUIRED, got %d: %s", w.Code, w.Body.String())
+	if w.Code != http.StatusCreated {
+		t.Fatalf("expected 201 (legitimate default path), got %d: %s", w.Code, w.Body.String())
 	}
-	if !bytes.Contains(w.Body.Bytes(), []byte(`"code":"MODEL_REQUIRED"`)) {
-		t.Errorf("bare-body create: expected code=MODEL_REQUIRED in body, got %s", w.Body.String())
-	}
-	if !bytes.Contains(w.Body.Bytes(), []byte(`"runtime":"langgraph"`)) {
-		t.Errorf("bare-body create: expected runtime=\"langgraph\" in 422 body (the gate runs AFTER the langgraph-default assignment so the diagnostic surfaces what runtime WOULD have been used), got %s", w.Body.String())
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet sqlmock expectations: %v", err)
 	}
 }

@@ -1894,7 +1979,7 @@ func TestWorkspaceCreate_188_ExplicitRuntimeNoTemplate_OK(t *testing.T) {

 	mock.ExpectBegin()
 	mock.ExpectExec("INSERT INTO workspaces").
-		WithArgs(sqlmock.AnyArg(), "Explicit Codex", nil, 3, "codex", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push").
+		WithArgs(sqlmock.AnyArg(), "Explicit Codex", nil, 3, "codex", sqlmock.AnyArg(), (*string)(nil), nil, "none", (*int64)(nil), models.DefaultMaxConcurrentTasks, "push", (*string)(nil), (*int)(nil)).
 		WillReturnResult(sqlmock.NewResult(0, 1))
 	mock.ExpectCommit()
 	mock.ExpectExec("INSERT INTO canvas_layouts").
@@ -1905,7 +1990,7 @@ func TestWorkspaceCreate_188_ExplicitRuntimeNoTemplate_OK(t *testing.T) {

 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
-	body := `{"name":"Explicit Codex","runtime":"codex","model":"gpt-5.5"}`
+	body := `{"name":"Explicit Codex","runtime":"codex"}`
 	c.Request = httptest.NewRequest("POST", "/workspaces", bytes.NewBufferString(body))
 	c.Request.Header.Set("Content-Type", "application/json")

@@ -329,13 +329,7 @@ func (c *Client) doJSON(ctx context.Context, method, path string, reqBody interf

 func decodeError(resp *http.Response) error {
 	var e contract.Error
-	body, readErr := io.ReadAll(resp.Body)
-	if readErr != nil {
-		return &contract.Error{
-			Code:    httpStatusToCode(resp.StatusCode),
-			Message: fmt.Sprintf("status %d (read body failed: %v)", resp.StatusCode, readErr),
-		}
-	}
+	body, _ := io.ReadAll(resp.Body)
 	if len(body) == 0 {
 		return &contract.Error{
 			Code:    httpStatusToCode(resp.StatusCode),
@@ -3,7 +3,6 @@ package pgplugin
 import (
 	"encoding/json"
 	"errors"
-	"log"
 	"net/http"
 	"strings"

@@ -247,9 +246,7 @@ func (h *Handler) forget(w http.ResponseWriter, r *http.Request, id string) {
 func writeJSON(w http.ResponseWriter, status int, body interface{}) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)
-	if err := json.NewEncoder(w).Encode(body); err != nil {
-		log.Printf("pgplugin: JSON encode error: %v", err)
-	}
+	_ = json.NewEncoder(w).Encode(body)
 }

 func writeError(w http.ResponseWriter, status int, code contract.ErrorCode, message string, details map[string]interface{}) {
@@ -256,7 +256,6 @@ func TestWorkspaceAuth_WrongWorkspace_Returns401(t *testing.T) {
 // live tokens anywhere) the middleware must let the request through so existing
 // deployments keep working during the Phase-30 rollout.
 func TestAdminAuth_FailOpen_NoTokensGlobally(t *testing.T) {
-	t.Setenv("ADMIN_TOKEN", "")
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("sqlmock.New: %v", err)
@@ -376,7 +375,6 @@ func TestAdminAuth_C11_DeleteNoBearer_Returns401(t *testing.T) {
 // TestAdminAuth_ValidBearer_Passes — a valid bearer token (from any workspace)
 // must be accepted for admin routes.
 func TestAdminAuth_ValidBearer_Passes(t *testing.T) {
-	t.Setenv("ADMIN_TOKEN", "")
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("sqlmock.New: %v", err)
@@ -420,7 +418,6 @@ func TestAdminAuth_ValidBearer_Passes(t *testing.T) {

 // TestAdminAuth_InvalidBearer_Returns401 — wrong token must not grant admin access.
 func TestAdminAuth_InvalidBearer_Returns401(t *testing.T) {
-	t.Setenv("ADMIN_TOKEN", "")
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("sqlmock.New: %v", err)
@@ -703,7 +700,6 @@ func TestAdminAuth_Issue180_ApprovalsListing_NoBearer_Returns401(t *testing.T) {
 // fail-open contract: on a fresh install (no tokens anywhere), the middleware
 // must not block the canvas from polling /approvals/pending.
 func TestAdminAuth_Issue180_ApprovalsListing_FailOpen_NoTokens(t *testing.T) {
-	t.Setenv("ADMIN_TOKEN", "")
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("sqlmock.New: %v", err)
@@ -1102,7 +1098,6 @@ func TestCanvasOrBearer_TokensExist_CanvasOrigin_Passes(t *testing.T) {
 // issuing workspace has status='removed' must not grant admin access.
 // The JOIN in ValidateAnyToken filters the row out, resulting in ErrNoRows.
 func TestAdminAuth_RemovedWorkspaceToken_Returns401(t *testing.T) {
-	t.Setenv("ADMIN_TOKEN", "")
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("sqlmock.New: %v", err)
@@ -1256,7 +1251,6 @@ func TestAdminAuth_623_ForgedCORSOrigin_Returns401(t *testing.T) {
 // TestAdminAuth_623_ValidBearer_WithOrigin_Passes — bearer + matching Origin
 // should still work (the Origin is irrelevant once the bearer validates).
 func TestAdminAuth_623_ValidBearer_WithOrigin_Passes(t *testing.T) {
-	t.Setenv("ADMIN_TOKEN", "")
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("sqlmock: %v", err)
@@ -1,31 +1,39 @@
 package models

-// runtime_defaults.go — DELETED helper. Intentionally empty.
+// runtime_defaults.go — single source of truth for per-runtime defaults
+// the platform applies when the operator/agent didn't supply a value.
 //
-// Previously held `DefaultModel(runtime string) string` which returned
-// "sonnet" for claude-code and "anthropic:claude-opus-4-7" for everything
-// else. That function was a SOFT-FALLBACK bug magnet:
+// Why this lives in models/ (not handlers/): default selection is a
+// pure data fact about the runtime, not handler logic. Multiple
+// callers (Create-workspace handler, org-import handler, future
+// auto-provision paths) need the same answer; concentrating the
+// rule here means one edit when a runtime's default changes.
 //
-//   - codex workspaces created without an explicit `model` silently
-//     received `anthropic:claude-opus-4-7`. Codex adapter only supports
-//     openai-* providers, so they wedged in `not_configured` with
-//     `codex adapter: workspace config picks provider='anthropic' but
-//     it is not in the providers registry`. The fallback never matched
-//     a runtime that could actually use it (only langgraph + hermes
-//     could even partially execute anthropic:claude-opus-4-7 without
-//     extra credential plumbing). It existed as a "must return
-//     something" placeholder that turned every silent miss into a
-//     prod incident.
+// Related work (RFC #2873): this is the seed for a future
+// `RuntimeConfig` interface that will also expose `ProvisioningTimeout()`,
+// `CapabilitiesSupported()`, and other per-runtime facts. For now the
+// surface is one helper — extracted from the duplicate branch in
+// workspace_provision.go:537 and org_import.go:54 that diverged silently
+// during refactors before this consolidation.
+
+// DefaultModel returns the model slug to use when a workspace is
+// created without an explicit model and the runtime can't infer one
+// from its own config.
 //
-//   - The fallback hid the contract bug at every callsite: Create
-//     handler, org_import, anywhere a stale CreateWorkspacePayload
-//     bubbled through to provisionWorkspace.
+//   - claude-code: "sonnet" — Anthropic's CLI accepts the short
+//     name and resolves it via the operator's anthropic-oauth or
+//     ANTHROPIC_API_KEY chain.
+//   - everything else (hermes, langgraph, autogen, codex, openclaw,
+//     external, ""): a fully-qualified
+//     vendor:model slug that the universal MODEL_PROVIDER chain in
+//     molecule-core PR #247 can route via per-vendor required_env.
 //
-// SSOT principle (CTO 2026-05-22T03:42Z, feedback_workspace_model_required_no_platform_default_dynamic_credential_intake):
-// model / provider / provider-credential are REQUIRED user input at
-// create time. The platform must not provide a default. The runtime
-// must not fall back. Decision belongs to the user (or to the agent
-// acting on the user's behalf), never to the platform.
-//
-// Callers that previously fell back to DefaultModel must now fail-closed
-// when model is empty after template-resolution.
+// The function never returns an empty string; an unknown runtime
+// gets the universal default rather than failing closed (matches the
+// pre-refactor behavior — both call sites used the same fallback).
+func DefaultModel(runtime string) string {
+	if runtime == "claude-code" {
+		return "sonnet"
+	}
+	return "anthropic:claude-opus-4-7"
+}
@@ -1,11 +1,59 @@
 package models

-// runtime_defaults_test.go — previously pinned DefaultModel's contract
-// (claude-code → "sonnet", everything else → "anthropic:claude-opus-4-7").
-//
-// DefaultModel was removed as a soft-fallback bug magnet (CTO 2026-05-22):
-// model is REQUIRED user input; the platform must not provide a default.
-// See runtime_defaults.go for the deletion rationale, and the new
-// fail-closed gate in `handlers.WorkspaceHandler.Create` for the boundary
-// enforcement. No test stub here — the contract is "this function does
-// not exist", which the type-checker enforces at compile time.
+import "testing"
+
+// TestDefaultModel pins the contract: known runtimes return their
+// expected default; unknowns and the empty string fall through to the
+// universal default. Add new runtimes here as `case` entries — pre-fix
+// adding a runtime required two source edits + an audit; post-SSOT it
+// requires one entry in DefaultModel + one assertion here.
+func TestDefaultModel(t *testing.T) {
+	cases := []struct {
+		runtime string
+		want    string
+	}{
+		// Known runtimes.
+		{"claude-code", "sonnet"},
+
+		// Universal fallback for everything else. Each runtime is named
+		// explicitly so a future drift (e.g., adding a hermes-specific
+		// branch) shows up as a failure on the runtime that drifted, not
+		// as a generic "unknown" failure.
+		{"hermes", "anthropic:claude-opus-4-7"},
+		{"langgraph", "anthropic:claude-opus-4-7"},
+		{"autogen", "anthropic:claude-opus-4-7"},
+		{"codex", "anthropic:claude-opus-4-7"},
+		{"openclaw", "anthropic:claude-opus-4-7"},
+		{"external", "anthropic:claude-opus-4-7"},
+
+		// Unknown / empty — fall through to universal default rather
+		// than failing closed. Pre-refactor both call sites also fell
+		// through; pinning the existing behavior, not changing it.
+		{"", "anthropic:claude-opus-4-7"},
+		{"some-future-runtime", "anthropic:claude-opus-4-7"},
+		{"CLAUDE-CODE", "anthropic:claude-opus-4-7"}, // case-sensitive — matches prior behavior
+	}
+	for _, tc := range cases {
+		t.Run(tc.runtime, func(t *testing.T) {
+			got := DefaultModel(tc.runtime)
+			if got != tc.want {
+				t.Errorf("DefaultModel(%q) = %q, want %q", tc.runtime, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestDefaultModel_NeverEmpty — invariant: no input produces an empty
+// string. The handlers that consume this would write empty into
+// config.yaml, which the runtime then can't dispatch — pinning the
+// non-empty contract here protects against a future "return early on
+// unknown runtime" change that would silently break workspace creation.
+func TestDefaultModel_NeverEmpty(t *testing.T) {
+	for _, runtime := range []string{
+		"", "claude-code", "hermes", "unknown-runtime",
+	} {
+		if got := DefaultModel(runtime); got == "" {
+			t.Errorf("DefaultModel(%q) returned empty string", runtime)
+		}
+	}
+}
@@ -3,6 +3,7 @@ package models
 import (
 	"database/sql"
 	"encoding/json"
+	"fmt"
 	"time"
 )

@@ -35,16 +36,20 @@ type Workspace struct {
 	// DeliveryMode: "push" (synchronous to URL — default) or "poll" (logged
 	// to activity_logs, agent reads via GET /activity?since_id=). See
 	// migration 045 + RFC #2339.
-	DeliveryMode string `json:"delivery_mode" db:"delivery_mode"`
+	DeliveryMode       string          `json:"delivery_mode" db:"delivery_mode"`
 	// BroadcastEnabled: when true the workspace may call POST /broadcast to
 	// deliver a message to all non-removed agent workspaces in the org.
 	// Default false — only privileged orchestrators should hold this ability.
-	BroadcastEnabled bool `json:"broadcast_enabled" db:"broadcast_enabled"`
+	BroadcastEnabled   bool            `json:"broadcast_enabled" db:"broadcast_enabled"`
 	// TalkToUserEnabled: when false the workspace's send_message_to_user calls
 	// and POST /notify requests are rejected with HTTP 403 so the agent is
 	// forced to route updates through a parent workspace. Default true
 	// (preserves existing behaviour for all workspaces).
-	TalkToUserEnabled bool `json:"talk_to_user_enabled" db:"talk_to_user_enabled"`
+	TalkToUserEnabled  bool            `json:"talk_to_user_enabled" db:"talk_to_user_enabled"`
+	// Compute overrides (nullable — omitted = platform-managed default).
+	// Issue #1686 Phase 1.
+	ComputeInstanceType *string `json:"compute_instance_type,omitempty" db:"compute_instance_type"`
+	ComputeVolumeRootGB *int    `json:"compute_volume_root_gb,omitempty" db:"compute_volume_root_gb"`
 	// Canvas layout fields (from JOIN)
 	X         float64 `json:"x"`
 	Y         float64 `json:"y"`
@@ -71,12 +76,12 @@ type RegisterPayload struct {
 	// enforces the conditional requirement based on the resolved
 	// delivery mode (payload value, falling back to the row's existing
 	// value, falling back to "push").
-	URL       string          `json:"url"`
-	AgentCard json.RawMessage `json:"agent_card" binding:"required"`
+	URL          string          `json:"url"`
+	AgentCard    json.RawMessage `json:"agent_card" binding:"required"`
 	// DeliveryMode is optional. Empty string means "keep the existing
 	// value on the workspace row, or default to push for new rows".
 	// When set, must be one of DeliveryModePush / DeliveryModePoll.
-	DeliveryMode string `json:"delivery_mode,omitempty"`
+	DeliveryMode string          `json:"delivery_mode,omitempty"`
 }

 type HeartbeatPayload struct {
@@ -154,36 +159,53 @@ type MemorySeed struct {
 	Scope   string `json:"scope" yaml:"scope"` // LOCAL, TEAM, GLOBAL
 }

-type WorkspaceComputeVolume struct {
-	RootGB int `json:"root_gb,omitempty"`
+// ComputeVolume holds per-workspace disk configuration.
+type ComputeVolume struct {
+	RootGB int `json:"root_gb"`
 }

-type WorkspaceComputeDisplay struct {
-	Mode     string `json:"mode,omitempty"`
-	Width    int    `json:"width,omitempty"`
-	Height   int    `json:"height,omitempty"`
-	Protocol string `json:"protocol,omitempty"`
+// ComputeConfig holds per-workspace EC2 compute overrides.
+// Omitted at create time means "use platform-managed defaults".
+type ComputeConfig struct {
+	InstanceType string        `json:"instance_type"`
+	Volume       ComputeVolume `json:"volume"`
 }

-type WorkspaceCompute struct {
-	InstanceType string                  `json:"instance_type,omitempty"`
-	Volume       WorkspaceComputeVolume  `json:"volume,omitempty"`
-	Display      WorkspaceComputeDisplay `json:"display,omitempty"`
+// ValidateComputeConfig performs create-time validation on compute overrides.
+// Returns nil when cfg is nil (omitted = platform-managed default).
+func ValidateComputeConfig(cfg *ComputeConfig) error {
+	if cfg == nil {
+		return nil
+	}
+	if cfg.InstanceType != "" {
+		if len(cfg.InstanceType) > 64 {
+			return fmt.Errorf("compute.instance_type too long (max 64 chars)")
+		}
+	}
+	if cfg.Volume.RootGB != 0 {
+		if cfg.Volume.RootGB < 32 {
+			return fmt.Errorf("compute.volume.root_gb must be at least 32")
+		}
+		if cfg.Volume.RootGB > 2048 {
+			return fmt.Errorf("compute.volume.root_gb exceeds maximum 2048")
+		}
+	}
+	return nil
 }

 type CreateWorkspacePayload struct {
-	Name     string `json:"name" binding:"required"`
-	Role     string `json:"role"`
-	Template string `json:"template"` // workspace-configs-templates folder name
-	Tier     int    `json:"tier"`
-	Model    string `json:"model"`
-	Runtime  string `json:"runtime"`  // "langgraph" (default), "claude-code", etc.
-	External bool   `json:"external"` // true = no Docker container, just a registered URL
-	URL      string `json:"url"`      // for external workspaces: the A2A endpoint URL (push mode only — omit for poll)
+	Name     string  `json:"name" binding:"required"`
+	Role     string  `json:"role"`
+	Template string  `json:"template"` // workspace-configs-templates folder name
+	Tier     int     `json:"tier"`
+	Model    string  `json:"model"`
+	Runtime      string  `json:"runtime"`       // "langgraph" (default), "claude-code", etc.
+	External     bool    `json:"external"`      // true = no Docker container, just a registered URL
+	URL          string  `json:"url"`           // for external workspaces: the A2A endpoint URL (push mode only — omit for poll)
 	// DeliveryMode: "push" (default) sends inbound A2A to URL synchronously;
 	// "poll" records inbound to activity_logs for the agent to consume via
 	// GET /activity?since_id=. Poll mode does not require a URL. See #2339.
-	DeliveryMode    string  `json:"delivery_mode,omitempty"`
+	DeliveryMode string  `json:"delivery_mode,omitempty"`
 	WorkspaceDir    string  `json:"workspace_dir"`    // host path to mount as /workspace (empty = isolated volume)
 	WorkspaceAccess string  `json:"workspace_access"` // "none" (default), "read_only", or "read_write" — see #65
 	ParentID        *string `json:"parent_id"`
@@ -197,11 +219,10 @@ type CreateWorkspacePayload struct {
 	// MaxConcurrentTasks caps parallel A2A + cron dispatch. 0 means use
 	// DefaultMaxConcurrentTasks. Leaders typically set 3.
 	MaxConcurrentTasks int `json:"max_concurrent_tasks"`
-	// Compute is the product-facing per-workspace EC2 shape/display
-	// contract. Phase 1 uses instance_type + volume.root_gb and persists
-	// display for future desktop-control workspaces.
-	Compute WorkspaceCompute `json:"compute,omitempty"`
-	Canvas  struct {
+	// Compute is an optional per-workspace EC2 shape override.
+	// Omitted = platform-managed default (current behaviour).
+	Compute *ComputeConfig `json:"compute,omitempty"`
+	Canvas   struct {
 		X float64 `json:"x"`
 		Y float64 `json:"y"`
 	} `json:"canvas"`
@@ -0,0 +1,90 @@
+package models
+
+import "testing"
+
+func TestValidateComputeConfig_NilIsValid(t *testing.T) {
+	if err := ValidateComputeConfig(nil); err != nil {
+		t.Errorf("nil compute config should be valid, got: %v", err)
+	}
+}
+
+func TestValidateComputeConfig_EmptyIsValid(t *testing.T) {
+	cfg := &ComputeConfig{}
+	if err := ValidateComputeConfig(cfg); err != nil {
+		t.Errorf("empty compute config should be valid, got: %v", err)
+	}
+}
+
+func TestValidateComputeConfig_ValidOverrides(t *testing.T) {
+	cfg := &ComputeConfig{
+		InstanceType: "g4dn.xlarge",
+		Volume:       ComputeVolume{RootGB: 256},
+	}
+	if err := ValidateComputeConfig(cfg); err != nil {
+		t.Errorf("valid overrides should pass, got: %v", err)
+	}
+}
+
+func TestValidateComputeConfig_InstanceTypeTooLong(t *testing.T) {
+	longName := string(make([]byte, 65))
+	for i := range longName {
+		longName = longName[:i] + "x" + longName[i+1:]
+	}
+	cfg := &ComputeConfig{InstanceType: longName}
+	if err := ValidateComputeConfig(cfg); err == nil {
+		t.Error("expected error for instance_type > 64 chars")
+	} else if err.Error() != "compute.instance_type too long (max 64 chars)" {
+		t.Errorf("unexpected error message: %q", err.Error())
+	}
+}
+
+func TestValidateComputeConfig_RootGBTooSmall(t *testing.T) {
+	cfg := &ComputeConfig{Volume: ComputeVolume{RootGB: 31}}
+	if err := ValidateComputeConfig(cfg); err == nil {
+		t.Error("expected error for root_gb < 32")
+	} else if err.Error() != "compute.volume.root_gb must be at least 32" {
+		t.Errorf("unexpected error message: %q", err.Error())
+	}
+}
+
+func TestValidateComputeConfig_RootGBTooLarge(t *testing.T) {
+	cfg := &ComputeConfig{Volume: ComputeVolume{RootGB: 2049}}
+	if err := ValidateComputeConfig(cfg); err == nil {
+		t.Error("expected error for root_gb > 2048")
+	} else if err.Error() != "compute.volume.root_gb exceeds maximum 2048" {
+		t.Errorf("unexpected error message: %q", err.Error())
+	}
+}
+
+func TestValidateComputeConfig_BoundaryValues(t *testing.T) {
+	cases := []struct {
+		name string
+		cfg  ComputeConfig
+		ok   bool
+	}{
+		{"min root_gb", ComputeConfig{Volume: ComputeVolume{RootGB: 32}}, true},
+		{"max root_gb", ComputeConfig{Volume: ComputeVolume{RootGB: 2048}}, true},
+		{"just under min", ComputeConfig{Volume: ComputeVolume{RootGB: 31}}, false},
+		{"just over max", ComputeConfig{Volume: ComputeVolume{RootGB: 2049}}, false},
+		{"exactly 64 char type", ComputeConfig{InstanceType: string(make([]byte, 64))}, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			// fill the 64-char case with 'x'
+			if tc.cfg.InstanceType != "" {
+				b := make([]byte, len(tc.cfg.InstanceType))
+				for i := range b {
+					b[i] = 'x'
+				}
+				tc.cfg.InstanceType = string(b)
+			}
+			err := ValidateComputeConfig(&tc.cfg)
+			if tc.ok && err != nil {
+				t.Errorf("expected valid, got: %v", err)
+			}
+			if !tc.ok && err == nil {
+				t.Error("expected invalid, got nil")
+			}
+		})
+	}
+}
@@ -152,20 +152,21 @@ func (p *CPProvisioner) adminAuthHeaders(req *http.Request) {
 }

 type cpProvisionRequest struct {
-	OrgID        string                 `json:"org_id"`
-	WorkspaceID  string                 `json:"workspace_id"`
-	Runtime      string                 `json:"runtime"`
-	Tier         int                    `json:"tier"`
-	InstanceType string                 `json:"instance_type,omitempty"`
-	DiskGB       int32                  `json:"disk_gb,omitempty"`
-	Display      WorkspaceDisplayConfig `json:"display,omitempty"`
-	PlatformURL  string                 `json:"platform_url"`
-	Env          map[string]string      `json:"env"`
+	OrgID       string            `json:"org_id"`
+	WorkspaceID string            `json:"workspace_id"`
+	Runtime     string            `json:"runtime"`
+	Tier        int               `json:"tier"`
+	PlatformURL string            `json:"platform_url"`
+	Env         map[string]string `json:"env"`
 	// ConfigFiles are template + generated config files to write into the
 	// EC2 instance's /configs directory. OFFSEC-010: collected by
 	// collectCPConfigFiles which rejects symlinks and non-regular files
 	// before including them. Serialised as base64 to avoid JSON escaping.
 	ConfigFiles map[string]string `json:"config_files,omitempty"`
+	// Compute overrides (nullable — omitted = platform-managed default).
+	// Issue #1686 Phase 1.
+	InstanceType *string `json:"instance_type,omitempty"`
+	VolumeRootGB *int    `json:"volume_root_gb,omitempty"`
 }

 type cpProvisionResponse struct {
@@ -213,12 +214,11 @@ func (p *CPProvisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string,
 		WorkspaceID:  cfg.WorkspaceID,
 		Runtime:      cfg.Runtime,
 		Tier:         cfg.Tier,
-		InstanceType: cfg.InstanceType,
-		DiskGB:       cfg.DiskGB,
-		Display:      cfg.Display,
 		PlatformURL:  cfg.PlatformURL,
 		Env:          env,
 		ConfigFiles:  configFiles,
+		InstanceType: cfg.InstanceType,
+		VolumeRootGB: cfg.VolumeRootGB,
 	}

 	body, err := json.Marshal(req)
@@ -243,12 +243,9 @@ func (p *CPProvisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string,
 	// Cap body read at 64 KiB — the CP only ever returns small JSON
 	// responses; an unbounded read could be weaponized into log-flood
 	// DoS by a compromised upstream.
-	respBody, readErr := io.ReadAll(io.LimitReader(resp.Body, 64<<10))
-	if readErr != nil {
-		return "", fmt.Errorf("cp provisioner: read response body: %w", readErr)
-	}
+	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 64<<10))
 	var result cpProvisionResponse
-	unmarshalErr := json.Unmarshal(respBody, &result)
+	json.Unmarshal(respBody, &result)

 	if resp.StatusCode != http.StatusCreated {
 		// Prefer the structured {"error":"..."} field. Do NOT fall back
@@ -262,10 +259,6 @@ func (p *CPProvisioner) Start(ctx context.Context, cfg WorkspaceConfig) (string,
 		return "", fmt.Errorf("cp provisioner: provision failed (%d): %s", resp.StatusCode, errMsg)
 	}

-	if unmarshalErr != nil {
-		return "", fmt.Errorf("cp provisioner: decode 201 response: %w", unmarshalErr)
-	}
-
 	log.Printf("CP provisioner: workspace %s → EC2 instance %s (%s)", cfg.WorkspaceID, result.InstanceID, result.State)
 	provlog.Event("provision.ec2_started", map[string]any{
 		"workspace_id": cfg.WorkspaceID,
@@ -418,11 +411,7 @@ func (p *CPProvisioner) Stop(ctx context.Context, workspaceID string) error {
 		// Read a bounded slice of the body so the error message gives ops
 		// enough to triage without risking a multi-MB log line on a
 		// pathological response. 512 bytes covers any sane error envelope.
-		body, readErr := io.ReadAll(io.LimitReader(resp.Body, 512))
-		if readErr != nil {
-			return fmt.Errorf("cp provisioner: stop %s: unexpected %d (read body failed: %w)",
-				workspaceID, resp.StatusCode, readErr)
-		}
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
 		return fmt.Errorf("cp provisioner: stop %s: unexpected %d: %s",
 			workspaceID, resp.StatusCode, strings.TrimSpace(string(body)))
 	}
@@ -191,18 +191,6 @@ func TestStart_HappyPath(t *testing.T) {
 		if body.WorkspaceID != "ws-1" || body.Runtime != "python" {
 			t.Errorf("body mismatch: %+v", body)
 		}
-		if body.InstanceType != "m6i.xlarge" {
-			t.Errorf("instance_type = %q, want m6i.xlarge", body.InstanceType)
-		}
-		if body.DiskGB != 100 {
-			t.Errorf("disk_gb = %d, want 100", body.DiskGB)
-		}
-		if body.Display.Mode != "desktop-control" || body.Display.Protocol != "novnc" {
-			t.Errorf("display mode/protocol = %q/%q, want desktop-control/novnc", body.Display.Mode, body.Display.Protocol)
-		}
-		if body.Display.Width != 1920 || body.Display.Height != 1080 {
-			t.Errorf("display size = %dx%d, want 1920x1080", body.Display.Width, body.Display.Height)
-		}
 		w.WriteHeader(http.StatusCreated)
 		_, _ = io.WriteString(w, `{"instance_id":"i-abc123","state":"pending"}`)
 	}))
@@ -217,8 +205,6 @@ func TestStart_HappyPath(t *testing.T) {

 	id, err := p.Start(context.Background(), WorkspaceConfig{
 		WorkspaceID: "ws-1", Runtime: "python", Tier: 1, PlatformURL: "http://tenant",
-		InstanceType: "m6i.xlarge", DiskGB: 100,
-		Display: WorkspaceDisplayConfig{Mode: "desktop-control", Protocol: "novnc", Width: 1920, Height: 1080},
 	})
 	if err != nil {
 		t.Fatalf("Start: %v", err)
@@ -376,7 +362,7 @@ func TestStart_CollectsConfigFiles(t *testing.T) {
 	p := &CPProvisioner{baseURL: srv.URL, orgID: "org-1", httpClient: srv.Client()}
 	_, err := p.Start(context.Background(), WorkspaceConfig{
 		WorkspaceID:  "ws-1",
-		Runtime:      "python",
+		Runtime:     "python",
 		Tier:         1,
 		PlatformURL:  "http://tenant",
 		TemplatePath: tmpl,
@@ -438,7 +424,7 @@ func TestStart_SymlinkTemplatePathError(t *testing.T) {
 	p := &CPProvisioner{baseURL: "http://unused", orgID: "org-1", httpClient: &http.Client{Timeout: time.Second}}
 	_, err := p.Start(context.Background(), WorkspaceConfig{
 		WorkspaceID:  "ws-1",
-		Runtime:      "python",
+		Runtime:     "python",
 		TemplatePath: symlink, // symlink root → OFFSEC-010 guard should fire
 	})
 	if err == nil {
@@ -449,26 +435,6 @@ func TestStart_SymlinkTemplatePathError(t *testing.T) {
 	}
 }

-// TestStart_Malformed201SurfacesError — when CP returns 201 Created with
-// unparseable JSON, Start must return an error instead of silently
-// returning an empty instance_id. CR2 blocker from review #5552.
-func TestStart_Malformed201SurfacesError(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusCreated)
-		_, _ = io.WriteString(w, `{"instance_id": broken-json`)
-	}))
-	defer srv.Close()
-
-	p := &CPProvisioner{baseURL: srv.URL, orgID: "org-1", httpClient: srv.Client()}
-	_, err := p.Start(context.Background(), WorkspaceConfig{WorkspaceID: "ws-1", Runtime: "py"})
-	if err == nil {
-		t.Fatal("expected error on malformed 201, got nil")
-	}
-	if !strings.Contains(err.Error(), "decode 201 response") {
-		t.Errorf("error should mention decode 201 response, got %q", err.Error())
-	}
-}
-
 // TestStop_SendsBothAuthHeaders — verify #118/#130 compliance on the
 // teardown path. Any call to /cp/workspaces/:id must carry both the
 // platform-wide shared secret AND the per-tenant admin token, or the
@@ -1096,3 +1062,75 @@ func TestCollectCPConfigFiles_RejectsRootSymlink(t *testing.T) {
 		t.Errorf("expected symlink-related error, got: %v", err)
 	}
 }
+
+// TestStart_ComputeOverrides — when WorkspaceConfig carries InstanceType and
+// VolumeRootGB, they must be forwarded in the cpProvisionRequest body so the
+// CP can pass them to EC2 RunInstances. Regression guard for #1686 Phase 1.
+func TestStart_ComputeOverrides(t *testing.T) {
+	var gotBody cpProvisionRequest
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := json.NewDecoder(r.Body).Decode(&gotBody); err != nil {
+			t.Errorf("decode request: %v", err)
+		}
+		w.WriteHeader(http.StatusCreated)
+		_, _ = io.WriteString(w, `{"instance_id":"i-compute","state":"pending"}`)
+	}))
+	defer srv.Close()
+
+	p := &CPProvisioner{baseURL: srv.URL, orgID: "org-1", httpClient: srv.Client()}
+	instanceType := "g4dn.xlarge"
+	volumeRootGB := 256
+	_, err := p.Start(context.Background(), WorkspaceConfig{
+		WorkspaceID:  "ws-1",
+		Runtime:      "python",
+		Tier:         2,
+		PlatformURL:  "http://tenant",
+		InstanceType: &instanceType,
+		VolumeRootGB: &volumeRootGB,
+	})
+	if err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	if gotBody.InstanceType == nil || *gotBody.InstanceType != "g4dn.xlarge" {
+		t.Errorf("instance_type = %v, want g4dn.xlarge", gotBody.InstanceType)
+	}
+	if gotBody.VolumeRootGB == nil || *gotBody.VolumeRootGB != 256 {
+		t.Errorf("volume_root_gb = %v, want 256", gotBody.VolumeRootGB)
+	}
+}
+
+// TestStart_ComputeOmittedWhenNil — when WorkspaceConfig has no compute
+// overrides, the JSON body must omit the keys entirely (omitempty) so CP
+// applies its own defaults rather than empty/zero values.
+func TestStart_ComputeOmittedWhenNil(t *testing.T) {
+	var raw json.RawMessage
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := json.NewDecoder(r.Body).Decode(&raw); err != nil {
+			t.Errorf("decode request: %v", err)
+		}
+		w.WriteHeader(http.StatusCreated)
+		_, _ = io.WriteString(w, `{"instance_id":"i-default","state":"pending"}`)
+	}))
+	defer srv.Close()
+
+	p := &CPProvisioner{baseURL: srv.URL, orgID: "org-1", httpClient: srv.Client()}
+	_, err := p.Start(context.Background(), WorkspaceConfig{
+		WorkspaceID: "ws-1",
+		Runtime:     "python",
+		Tier:        1,
+		PlatformURL: "http://tenant",
+	})
+	if err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	var decoded map[string]interface{}
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		t.Fatalf("unmarshal raw body: %v", err)
+	}
+	if _, ok := decoded["instance_type"]; ok {
+		t.Errorf("instance_type should be omitted when nil")
+	}
+	if _, ok := decoded["volume_root_gb"]; ok {
+		t.Errorf("volume_root_gb should be omitted when nil")
+	}
+}
@@ -97,10 +97,7 @@ type WorkspaceConfig struct {
 	PluginsPath        string            // Host path to plugins directory (mounted at /plugins)
 	WorkspacePath      string            // Host path to bind-mount as /workspace (if empty, uses Docker named volume)
 	Tier               int
-	Runtime            string // "langgraph" (default) or "claude-code", "codex", "ollama", "custom"
-	InstanceType       string // Optional CP EC2 instance type override (SaaS only)
-	DiskGB             int32  // Optional CP root volume size override in GiB (SaaS only)
-	Display            WorkspaceDisplayConfig
+	Runtime            string            // "langgraph" (default) or "claude-code", "codex", "ollama", "custom"
 	EnvVars            map[string]string // Additional env vars (API keys, etc.)
 	PlatformURL        string
 	AwarenessURL       string
@@ -108,6 +105,11 @@ type WorkspaceConfig struct {
 	WorkspaceAccess    string // #65: "none" (default), "read_only", or "read_write"
 	ResetClaudeSession bool   // #12: if true, discard the claude-sessions volume before start (fresh session dir)

+	// Compute overrides (nullable — omitted = platform-managed default).
+	// Issue #1686 Phase 1.
+	InstanceType *string `json:"instance_type,omitempty"`
+	VolumeRootGB *int    `json:"volume_root_gb,omitempty"`
+
 	// Image, when non-empty, overrides the runtime→image lookup. CP
 	// (molecule-controlplane) is the single SSOT for runtime image digest
 	// pins via its migrations/027_runtime_image_pins table — the pin is
@@ -123,13 +125,6 @@ type WorkspaceConfig struct {
 	Image string
 }

-type WorkspaceDisplayConfig struct {
-	Mode     string `json:"mode,omitempty"`
-	Width    int    `json:"width,omitempty"`
-	Height   int    `json:"height,omitempty"`
-	Protocol string `json:"protocol,omitempty"`
-}
-
 // selectImage resolves the final Docker image ref for a workspace. The handler
 // layer is the source of truth — if it set cfg.Image (the digest-pinned form
 // supplied by CP, the SSOT for runtime image pins; molecule-core's own
@@ -718,19 +713,7 @@ func buildContainerEnv(cfg WorkspaceConfig) []string {
 		env = append(env, fmt.Sprintf("AWARENESS_NAMESPACE=%s", cfg.AwarenessNamespace))
 		env = append(env, fmt.Sprintf("AWARENESS_URL=%s", cfg.AwarenessURL))
 	}
-	// #1687: track explicit GH_TOKEN / GITHUB_TOKEN so they win over GH_PAT
-	// alias. These are normally stripped by the SCM-write guard below, but
-	// when a user explicitly sets them we preserve the value.
-	var explicitGHToken, explicitGitHubToken string
 	for k, v := range cfg.EnvVars {
-		if k == "GH_TOKEN" {
-			explicitGHToken = v
-			continue
-		}
-		if k == "GITHUB_TOKEN" {
-			explicitGitHubToken = v
-			continue
-		}
 		// Forensic #145 hardening: tenant workspace containers run
 		// agent-controlled code and must NEVER receive a Git SCM *write*
 		// credential. Without merge/approve creds in-container the
@@ -749,16 +732,13 @@ func buildContainerEnv(cfg WorkspaceConfig) []string {
 		env = append(env, fmt.Sprintf("%s=%s", k, v))
 	}
 	// #1687: alias GH_PAT → GH_TOKEN / GITHUB_TOKEN on the READ side
-	// (container env assembly). Explicit values win: only alias when the
-	// key was not set in workspace secrets.
-	if explicitGHToken != "" {
-		env = append(env, fmt.Sprintf("GH_TOKEN=%s", explicitGHToken))
-	} else if pat, hasPAT := cfg.EnvVars["GH_PAT"]; hasPAT && pat != "" {
+	// (container env assembly). gh CLI and git credential helpers look
+	// for these standard names; by aliasing here we avoid writing the
+	// forbidden keys into tenant-writer surfaces (workspace_secrets,
+	// envVars map, etc.). GH_PAT itself is not an SCM-write credential
+	// and passes through cfg.EnvVars untouched.
+	if pat, hasPAT := cfg.EnvVars["GH_PAT"]; hasPAT && pat != "" {
 		env = append(env, fmt.Sprintf("GH_TOKEN=%s", pat))
-	}
-	if explicitGitHubToken != "" {
-		env = append(env, fmt.Sprintf("GITHUB_TOKEN=%s", explicitGitHubToken))
-	} else if pat, hasPAT := cfg.EnvVars["GH_PAT"]; hasPAT && pat != "" {
 		env = append(env, fmt.Sprintf("GITHUB_TOKEN=%s", pat))
 	}
 	// Inject ADMIN_TOKEN from the platform server's environment so workspace
@@ -1640,3 +1620,4 @@ func parseOCIPlatform(s string) *ocispec.Platform {
 	}
 	return &ocispec.Platform{OS: parts[0], Architecture: parts[1]}
 }
+
@@ -770,12 +770,9 @@ func TestBuildContainerEnv_CustomEnvVarsAppended(t *testing.T) {
 // place — i.e. the guard is proven by construction, not by environment
 // accident.
 func TestBuildContainerEnv_StripsSCMWriteTokens(t *testing.T) {
-	// GH_TOKEN and GITHUB_TOKEN are preserved when explicitly set (#1687)
-	// because they win over the GH_PAT alias. The unconditional strip list
-	// therefore excludes them; see TestBuildContainerEnv_GHPATAliasPrecedence
-	// for the positive assertion.
 	scmTokens := []string{
-		"GITEA_TOKEN", "GITLAB_TOKEN", "GL_TOKEN", "BITBUCKET_TOKEN",
+		"GITEA_TOKEN", "GITHUB_TOKEN", "GH_TOKEN",
+		"GITLAB_TOKEN", "GL_TOKEN", "BITBUCKET_TOKEN",
 	}

 	t.Run("normal path — SCM tokens explicitly set in EnvVars", func(t *testing.T) {
@@ -783,9 +780,6 @@ func TestBuildContainerEnv_StripsSCMWriteTokens(t *testing.T) {
 		for _, k := range scmTokens {
 			envVars[k] = "leaked-write-credential-" + k
 		}
-		// Explicit GH_TOKEN / GITHUB_TOKEN are now preserved (#1687).
-		envVars["GH_TOKEN"] = "explicit-gh-token"
-		envVars["GITHUB_TOKEN"] = "explicit-github-token"
 		cfg := WorkspaceConfig{
 			WorkspaceID: "ws-tenant",
 			PlatformURL: "http://localhost:8080",
@@ -801,13 +795,6 @@ func TestBuildContainerEnv_StripsSCMWriteTokens(t *testing.T) {
 		if !envContains(buildContainerEnv(cfg), "ANTHROPIC_API_KEY=sk-keep") {
 			t.Errorf("filter must not strip non-SCM API keys")
 		}
-		// Explicit GH tokens must be preserved (not stripped).
-		if !envContains(buildContainerEnv(cfg), "GH_TOKEN=explicit-gh-token") {
-			t.Errorf("explicit GH_TOKEN must be preserved")
-		}
-		if !envContains(buildContainerEnv(cfg), "GITHUB_TOKEN=explicit-github-token") {
-			t.Errorf("explicit GITHUB_TOKEN must be preserved")
-		}
 	})

 	t.Run("persona-file path — simulates loadPersonaEnvFile merge", func(t *testing.T) {
@@ -868,106 +855,6 @@ func TestCPProvisionerEnv_StripsSCMWriteTokens(t *testing.T) {
 	}
 }

-// TestBuildContainerEnv_GHPATAliasPrecedence asserts that explicit GH_TOKEN /
-// GITHUB_TOKEN in workspace secrets win over the GH_PAT alias (#1687 CR2
-// review_id=5646). The alias must only inject a key when it was NOT explicitly
-// set.
-func TestBuildContainerEnv_GHPATAliasPrecedence(t *testing.T) {
-	pat := "ghp_pat_from_secrets"
-	explicitGH := "gh_explicit_token"
-	explicitGitHub := "github_explicit_token"
-
-	t.Run("GH_PAT alone → alias both", func(t *testing.T) {
-		cfg := WorkspaceConfig{
-			WorkspaceID: "ws-x",
-			PlatformURL: "http://localhost:8080",
-			EnvVars:     map[string]string{"GH_PAT": pat},
-		}
-		env := buildContainerEnv(cfg)
-		if !envContains(env, "GH_TOKEN="+pat) {
-			t.Errorf("GH_PAT alias must set GH_TOKEN, got %v", env)
-		}
-		if !envContains(env, "GITHUB_TOKEN="+pat) {
-			t.Errorf("GH_PAT alias must set GITHUB_TOKEN, got %v", env)
-		}
-	})
-
-	t.Run("explicit GH_TOKEN wins over GH_PAT alias", func(t *testing.T) {
-		cfg := WorkspaceConfig{
-			WorkspaceID: "ws-x",
-			PlatformURL: "http://localhost:8080",
-			EnvVars: map[string]string{
-				"GH_PAT":   pat,
-				"GH_TOKEN": explicitGH,
-			},
-		}
-		env := buildContainerEnv(cfg)
-		if envContains(env, "GH_TOKEN="+pat) {
-			t.Errorf("explicit GH_TOKEN must win over GH_PAT alias, got GH_TOKEN=%q", pat)
-		}
-		if !envContains(env, "GH_TOKEN="+explicitGH) {
-			t.Errorf("explicit GH_TOKEN must be preserved, got %v", env)
-		}
-	})
-
-	t.Run("explicit GITHUB_TOKEN wins over GH_PAT alias", func(t *testing.T) {
-		cfg := WorkspaceConfig{
-			WorkspaceID: "ws-x",
-			PlatformURL: "http://localhost:8080",
-			EnvVars: map[string]string{
-				"GH_PAT":       pat,
-				"GITHUB_TOKEN": explicitGitHub,
-			},
-		}
-		env := buildContainerEnv(cfg)
-		if envContains(env, "GITHUB_TOKEN="+pat) {
-			t.Errorf("explicit GITHUB_TOKEN must win over GH_PAT alias, got GITHUB_TOKEN=%q", pat)
-		}
-		if !envContains(env, "GITHUB_TOKEN="+explicitGitHub) {
-			t.Errorf("explicit GITHUB_TOKEN must be preserved, got %v", env)
-		}
-	})
-
-	t.Run("explicit both → both preserved, no alias", func(t *testing.T) {
-		cfg := WorkspaceConfig{
-			WorkspaceID: "ws-x",
-			PlatformURL: "http://localhost:8080",
-			EnvVars: map[string]string{
-				"GH_PAT":       pat,
-				"GH_TOKEN":     explicitGH,
-				"GITHUB_TOKEN": explicitGitHub,
-			},
-		}
-		env := buildContainerEnv(cfg)
-		if envContains(env, "GH_TOKEN="+pat) {
-			t.Errorf("explicit GH_TOKEN must win, got alias value %q", pat)
-		}
-		if envContains(env, "GITHUB_TOKEN="+pat) {
-			t.Errorf("explicit GITHUB_TOKEN must win, got alias value %q", pat)
-		}
-		if !envContains(env, "GH_TOKEN="+explicitGH) {
-			t.Errorf("explicit GH_TOKEN must be preserved, got %v", env)
-		}
-		if !envContains(env, "GITHUB_TOKEN="+explicitGitHub) {
-			t.Errorf("explicit GITHUB_TOKEN must be preserved, got %v", env)
-		}
-	})
-
-	t.Run("no GH_PAT → no alias injected", func(t *testing.T) {
-		cfg := WorkspaceConfig{
-			WorkspaceID: "ws-x",
-			PlatformURL: "http://localhost:8080",
-			EnvVars:     map[string]string{"OTHER": "ok"},
-		}
-		env := buildContainerEnv(cfg)
-		for _, e := range env {
-			if strings.HasPrefix(e, "GH_TOKEN=") || strings.HasPrefix(e, "GITHUB_TOKEN=") {
-				t.Errorf("no GH_PAT present → no alias should be injected, got %q", e)
-			}
-		}
-	})
-}
-
 func assertNoSCMWriteToken(t *testing.T, env []string, scmTokens []string) {
 	t.Helper()
 	for _, e := range env {
@@ -93,9 +93,6 @@ func sweepOnlineWorkspaces(ctx context.Context, checker ContainerChecker, onOffl
 			ids = append(ids, id)
 		}
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Health sweep: rows error: %v", err)
-	}

 	for _, id := range ids {
 		running, err := checker.IsRunning(ctx, id)
@@ -162,9 +159,6 @@ func sweepStaleRemoteWorkspaces(ctx context.Context, onOffline OfflineHandler) {
 			ids = append(ids, id)
 		}
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Health sweep: rows error: %v", err)
-	}

 	for _, id := range ids {
 		// External workspaces flip to 'awaiting_agent' (re-registrable
@@ -166,9 +166,6 @@ func sweepStuckProvisioning(ctx context.Context, emitter ProvisionTimeoutEmitter
 			ids = append(ids, c)
 		}
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("Provision-timeout sweep: rows error: %v", err)
-	}

 	for _, c := range ids {
 		timeout := provisioningTimeoutFor(c.runtime, lookup)
@@ -81,7 +81,6 @@ func TestTestTokenRoute_RequiresAdminAuth_WhenTokensExist(t *testing.T) {
 // bootstrap path still works before the first workspace has registered.
 func TestTestTokenRoute_FailOpenOnFreshInstall(t *testing.T) {
 	t.Setenv("MOLECULE_ENV", "development")
-	t.Setenv("ADMIN_TOKEN", "")
 	mock := setupRouterTestDB(t)

 	// HasAnyLiveTokenGlobal: no tokens yet — fresh install.
@@ -178,13 +178,6 @@ func Setup(hub *ws.Hub, broadcaster *events.Broadcaster, prov *provisioner.Provi
 		// the tenant AWS credentials. Admin-gated because console output
 		// can include user-data snippets we treat as semi-sensitive.
 		wsAdmin.GET("/workspaces/:id/console", wh.Console)
-		// Display sessions will eventually return short-lived proxied DCV
-		// URLs, so keep the endpoint admin-gated from the first unavailable
-		// state rather than widening it later.
-		wsAdmin.GET("/workspaces/:id/display", wh.Display)
-		wsAdmin.GET("/workspaces/:id/display/control", wh.DisplayControl)
-		wsAdmin.POST("/workspaces/:id/display/control/acquire", wh.AcquireDisplayControl)
-		wsAdmin.POST("/workspaces/:id/display/control/release", wh.ReleaseDisplayControl)

 		// Admin memory backup/restore (#1051) — bulk export/import of agent
 		// memories for safe Docker rebuilds. Matches workspaces by name on import.
@@ -1,61 +0,0 @@
-package router
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/handlers"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/middleware"
-	"github.com/gin-gonic/gin"
-)
-
-func buildWorkspaceDisplayEngine(t *testing.T) *gin.Engine {
-	t.Helper()
-	gin.SetMode(gin.TestMode)
-	r := gin.New()
-	wh := handlers.NewWorkspaceHandler(nil, nil, "http://localhost:8080", t.TempDir())
-	r.GET("/workspaces/:id/display", middleware.AdminAuth(db.DB), wh.Display)
-	r.POST("/workspaces/:id/display/control/acquire", middleware.AdminAuth(db.DB), wh.AcquireDisplayControl)
-	return r
-}
-
-func TestWorkspaceDisplayRoute_RequiresAdminAuth(t *testing.T) {
-	t.Setenv("ADMIN_TOKEN", "test-admin-secret-not-presented-by-caller")
-	mock := setupRouterTestDB(t)
-	mock.ExpectQuery("SELECT COUNT.*FROM workspace_auth_tokens").
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(1))
-
-	r := buildWorkspaceDisplayEngine(t)
-	w := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodGet, "/workspaces/ws-display/display", nil)
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusUnauthorized {
-		t.Errorf("expected 401 for unauthenticated request, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock unmet: %v", err)
-	}
-}
-
-func TestWorkspaceDisplayControlRoute_RequiresAdminAuth(t *testing.T) {
-	t.Setenv("ADMIN_TOKEN", "test-admin-secret-not-presented-by-caller")
-	mock := setupRouterTestDB(t)
-	mock.ExpectQuery("SELECT COUNT.*FROM workspace_auth_tokens").
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(1))
-
-	r := buildWorkspaceDisplayEngine(t)
-	w := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPost, "/workspaces/ws-display/display/control/acquire", nil)
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusUnauthorized {
-		t.Errorf("expected 401 for unauthenticated request, got %d: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock unmet: %v", err)
-	}
-}
@@ -425,7 +425,6 @@ func (s *Scheduler) fireSchedule(ctx context.Context, sched scheduleRow) {

 	lastStatus := "ok"
 	lastError := ""
-	resultKind := ""
 	if proxyErr != nil {
 		lastStatus = "error"
 		lastError = fmt.Sprintf("%v", proxyErr)
@@ -434,26 +433,8 @@ func (s *Scheduler) fireSchedule(ctx context.Context, sched scheduleRow) {
 		lastStatus = "error"
 		lastError = fmt.Sprintf("HTTP %d", statusCode)
 		log.Printf("Scheduler: '%s' non-2xx: %d", sched.Name, statusCode)
-	} else if a2aErr := a2aErrorFromBody(respBody); a2aErr != "" {
-		lastStatus = "error"
-		lastError = fmt.Sprintf("A2A adapter error: %s", a2aErr)
-		log.Printf("Scheduler: '%s' A2A adapter error (HTTP %d): %s", sched.Name, statusCode, a2aErr)
 	} else {
-		// HTTP 200 — inspect response body for SDK-layer errors.
-		// The claude-code-sdk adapter returns HTTP 200 even when the inner
-		// LLM call throws (e.g. Max-plan rate-limit, quota exhaustion, SDK
-		// internal errors). Without this check those failures surface as
-		// "completed (HTTP 200)" in last_status while the agent chat shows
-		// errors — a silent failure that hides schedule outages.
-		// See: #1696.
-		resultKind = detectResultKind(respBody)
-		if resultKind != "" && resultKind != "ok" {
-			lastStatus = resultKind
-			lastError = fmt.Sprintf("SDK error: result_kind=%s", resultKind)
-			log.Printf("Scheduler: '%s' SDK error detected — result_kind=%s", sched.Name, resultKind)
-		} else {
-			log.Printf("Scheduler: '%s' completed (HTTP %d)", sched.Name, statusCode)
-		}
+		log.Printf("Scheduler: '%s' completed (HTTP %d)", sched.Name, statusCode)
 	}

 	// #795: detect phantom-producing schedules — cron fires successfully
@@ -498,54 +479,6 @@ func (s *Scheduler) fireSchedule(ctx context.Context, sched scheduleRow) {
 		resetCancel()
 	}

-	// #1696: track consecutive SDK errors. When the adapter returns HTTP 200
-	// but the response body signals a non-ok result_kind (rate_limited,
-	// sdk_error, quota_exhausted), we increment a counter. After 3 consecutive
-	// SDK errors we auto-disable the schedule and log it — the schedule is
-	// suffering a persistent LLM-layer failure and firing it again will keep
-	// producing the same errors while burning tokens.
-	//
-	// Only apply when the current lastStatus is a non-ok resultKind (not when
-	// we already have 'error' from proxyErr or non-2xx HTTP status — those have
-	// their own failure semantics). Also skip when lastStatus is 'stale' (the
-	// empty-response escalation path takes priority).
-	var consecSDK int
-	if resultKind != "" && resultKind != "ok" {
-		sdkCtx, sdkCancel := context.WithTimeout(context.Background(), dbQueryTimeout)
-		if err := db.DB.QueryRowContext(sdkCtx, `
-			UPDATE workspace_schedules
-			SET consecutive_sdk_errors = consecutive_sdk_errors + 1,
-			    updated_at = now()
-			WHERE id = $1
-			RETURNING consecutive_sdk_errors`, sched.ID).Scan(&consecSDK); err != nil {
-			log.Printf("Scheduler: '%s' SDK-error bump failed: %v", sched.Name, err)
-		}
-		sdkCancel()
-		if consecSDK >= 3 {
-			log.Printf("Scheduler: '%s' AUTO-DISABLING after %d consecutive SDK errors (workspace %s)",
-				sched.Name, consecSDK, short(sched.WorkspaceID, 12))
-			autoDisableCtx, autoDisableCancel := context.WithTimeout(context.Background(), dbQueryTimeout)
-			_, _ = db.DB.ExecContext(autoDisableCtx, `
-				UPDATE workspace_schedules SET enabled = false, updated_at = now() WHERE id = $1 AND enabled = true`,
-				sched.ID)
-			autoDisableCancel()
-		}
-	} else {
-		// Non-SDK-error run — reset the counter.
-		// Guard: only reset when lastStatus is a clean ok (not 'stale', not
-		// 'error', not resultKind). An 'ok' resultKind means the SDK is fine
-		// and we should clear the streak.
-		if lastStatus == "ok" {
-			resetCtx, resetCancel := context.WithTimeout(context.Background(), dbQueryTimeout)
-			_, _ = db.DB.ExecContext(resetCtx, `
-				UPDATE workspace_schedules
-				SET consecutive_sdk_errors = 0,
-				    updated_at = now()
-				WHERE id = $1`, sched.ID)
-			resetCancel()
-		}
-	}
-
 	nextRun, nextErr := ComputeNextRun(sched.CronExpr, sched.Timezone, time.Now())
 	var nextRunPtr *time.Time
 	if nextErr == nil {
@@ -826,149 +759,6 @@ func (s *Scheduler) sweepPhantomBusy(ctx context.Context) {
 	}
 }

-// detectResultKind inspects an A2A response body for SDK-layer error signals
-// that are invisible at the HTTP level. The claude-code-sdk adapter returns
-// HTTP 200 even when the inner LLM call throws (Max-plan rate-limit, quota
-// exhaustion, SDK internal errors) — the error surfaces only in the response
-// body under result.kind or result.result_kind.
-//
-// Returns an empty string when the response is clean (result_kind is "ok",
-// "message" — the A2A-SDK canonical successful Message envelope — or absent).
-// Returns the result_kind value when it is a non-ok signal, so callers can
-// propagate it as the schedule's last_status.
-//
-// Known successful (= treat-as-ok) kinds (resultOKKinds):
-//   - "ok" — explicit success signal
-//   - "message" — A2A-SDK Message envelope (`{"result":{"kind":"message","parts":[...]}}`),
-//     emitted by every successful agent reply. Fix: #1696 originally allow-listed only
-//     "ok" / empty, which mis-flagged every successful agent response as an SDK error
-//     (PM scheduler observed 21 consecutive false-failure ticks before auto-disable;
-//     screenshot 2026-05-23). See [#1696 follow-up].
-//
-// Known non-ok kinds:
-//   - "rate_limited" — LLM API rate-limit hit (Max-plan, etc.)
-//   - "quota_exhausted" — quota / budget exhausted
-//   - "sdk_error" — SDK threw an internal error
-//
-// See #1696.
-//
-// resultOKKinds is the allowlist of `result.kind` values that are
-// UNCONDITIONALLY successful (no further parsing needed). Anything
-// outside this set is treated as a non-ok SDK signal, EXCEPT `task`
-// which is gated separately on `result.status.state` (see
-// classifyTaskState — A2A Task can be either in-progress or terminally
-// failed, depending on its status).
-//
-// Add to this list when new always-success envelope kinds are introduced
-// upstream. NEVER add an envelope that can carry a failure sub-state.
-var resultOKKinds = map[string]struct{}{
-	"":        {}, // absent / empty → treat as ok (no signal)
-	"ok":      {}, // explicit success
-	"message": {}, // A2A-SDK Message envelope (always a successful agent reply)
-}
-
-// taskOKStates is the A2A Task `status.state` allowlist for results that
-// have `kind: "task"`. Tasks can be in-progress (submitted/working) or
-// terminally successful (completed) — those are clean signals to the
-// scheduler. Terminal failure states (failed/canceled/rejected) are
-// surfaced as the scheduler's last_status so operators can see the real
-// state. Cf. CR2 review feedback on #1716.
-var taskOKStates = map[string]struct{}{
-	"":          {}, // status.state absent → conservative: don't fire false-failure
-	"submitted": {}, // task accepted, not yet running
-	"working":   {}, // task in progress
-	"completed": {}, // task finished successfully
-}
-
-// classifyTaskState inspects `result.status.state` (or `result.status_state`
-// legacy variant) and returns "" when the state is in taskOKStates (success
-// or in-progress) or the state string when it is a terminal failure that
-// should propagate as last_status.
-func classifyTaskState(result map[string]json.RawMessage) string {
-	rawStatus, ok := result["status"]
-	if !ok {
-		return "" // no status block → no signal, leave clean
-	}
-	var status map[string]json.RawMessage
-	if err := json.Unmarshal(rawStatus, &status); err != nil {
-		return ""
-	}
-	if rawState, ok := status["state"]; ok {
-		var s string
-		if json.Unmarshal(rawState, &s) == nil {
-			if _, isOK := taskOKStates[s]; !isOK {
-				return s
-			}
-		}
-	}
-	return ""
-}
-
-func detectResultKind(body []byte) string {
-	if len(body) == 0 {
-		return ""
-	}
-	var top map[string]json.RawMessage
-	if err := json.Unmarshal(body, &top); err != nil {
-		return ""
-	}
-	// Check result.kind first (canonical JSON-RPC shape).
-	if rawResult, ok := top["result"]; ok {
-		var result map[string]json.RawMessage
-		if err := json.Unmarshal(rawResult, &result); err == nil {
-			// result.kind (canonical JSON-RPC envelope field).
-			if rawKind, ok := result["kind"]; ok {
-				var k string
-				if json.Unmarshal(rawKind, &k) == nil {
-					// Special-case task: success or failure depends on status.state.
-					if k == "task" {
-						if bad := classifyTaskState(result); bad != "" {
-							return bad
-						}
-						// task with ok / in-progress state → clean
-					} else if _, isOK := resultOKKinds[k]; !isOK {
-						return k
-					}
-				}
-			}
-			// result.result_kind (legacy / alternative field name).
-			if rawKind, ok := result["result_kind"]; ok {
-				var k string
-				if json.Unmarshal(rawKind, &k) == nil {
-					if k == "task" {
-						if bad := classifyTaskState(result); bad != "" {
-							return bad
-						}
-					} else if _, isOK := resultOKKinds[k]; !isOK {
-						return k
-					}
-				}
-			}
-		}
-	}
-	// Top-level error: non-ok HTTP 200 with a structured error in the body.
-	if rawErr, ok := top["error"]; ok {
-		var errMsg string
-		if err := json.Unmarshal(rawErr, &errMsg); err == nil && errMsg != "" {
-			// Distinguish SDK errors from other errors. SDK-layer errors from the
-			// Claude Code runtime include specific markers.
-			lower := strings.ToLower(errMsg)
-			// Check more specific patterns first (max-plan quota > general rate).
-			if strings.Contains(lower, "max-plan") || strings.Contains(lower, "quota") || strings.Contains(lower, "budget") {
-				return "quota_exhausted"
-			}
-			if strings.Contains(lower, "rate limit") || strings.Contains(lower, "rate_limit") {
-				return "rate_limited"
-			}
-			if strings.Contains(lower, "claude code returned an error") || strings.Contains(lower, "sdk error") ||
-				strings.Contains(lower, "api key") || strings.Contains(lower, "authentication") {
-				return "sdk_error"
-			}
-		}
-	}
-	return ""
-}
-
 // isEmptyResponse checks if an A2A response body indicates the agent
 // produced no meaningful output. Catches "(no response generated)" from
 // the workspace runtime + genuinely empty/null responses. Used by the
@@ -1018,32 +808,6 @@ func isEmptyResponse(body []byte) bool {
 	return false
 }

-// a2aErrorFromBody extracts an A2A/JSON-RPC error message from a 2xx
-// response body. The adapter SDK may return HTTP 200 with an error
-// payload when it throws internally; this prevents the scheduler from
-// falsely recording last_status='ok'.
-// Issue #1696.
-func a2aErrorFromBody(body []byte) string {
-	if len(body) == 0 {
-		return ""
-	}
-	var resp map[string]interface{}
-	if json.Unmarshal(body, &resp) != nil {
-		return ""
-	}
-	// JSON-RPC style: {"error":{"code":-32603,"message":"..."}}
-	if errObj, ok := resp["error"].(map[string]interface{}); ok {
-		if msg, ok := errObj["message"].(string); ok {
-			return msg
-		}
-	}
-	// Plain style: {"error":"..."}
-	if errStr, ok := resp["error"].(string); ok {
-		return errStr
-	}
-	return ""
-}
-
 // truncation moved to internal/textutil.TruncateBytes (#2962 SSOT).
 // The original #2026 fix lives in textutil's package docs as canonical
 // prior art. Ellipsis was previously "..." (3 ASCII bytes); the SSOT
@@ -3,7 +3,6 @@ package scheduler
 import (
 	"context"
 	"database/sql"
-	"encoding/json"
 	"testing"
 	"time"
 	"unicode/utf8"
@@ -257,58 +256,6 @@ func (p *successProxy) ProxyA2ARequest(
 	return 200, []byte(`{"ok":true}`), nil
 }

-// ── adapterErrorProxy ─────────────────────────────────────────────────────────
-
-// adapterErrorProxy is a test double whose ProxyA2ARequest returns HTTP 200
-// with a JSON-RPC error body, simulating an adapter SDK that throws internally
-// but still completes the HTTP round-trip. Issue #1696.
-type adapterErrorProxy struct{}
-
-func (p *adapterErrorProxy) ProxyA2ARequest(
-	_ context.Context, _ string, _ []byte, _ string, _ bool,
-) (int, []byte, error) {
-	return 200, []byte(`{"jsonrpc":"2.0","id":"cron-test-123","error":{"code":-32603,"message":"adapter SDK internal error"}}`), nil
-}
-
-// ── TestFireSchedule_AdapterSDKError (#1696) ──────────────────────────────────
-//
-// When the adapter SDK throws internally and returns HTTP 200 with an error
-// payload, fireSchedule must record last_status='error', not 'ok'.
-
-func TestFireSchedule_AdapterSDKError(t *testing.T) {
-	mock := setupTestDB(t)
-
-	sched := scheduleRow{
-		ID:          "55555555-dead-beef-0000-000000000005",
-		WorkspaceID: "66666666-dead-beef-0000-000000000006",
-		Name:        "adapter-err-job",
-		CronExpr:    "0 * * * *",
-		Timezone:    "UTC",
-		Prompt:      "do something",
-	}
-
-	// active_tasks check → 0 (workspace is idle; proceed to fire)
-	mock.ExpectQuery(`SELECT COALESCE`).
-		WillReturnRows(sqlmock.NewRows([]string{"coalesce"}).AddRow(0))
-
-	// Post-fire UPDATE must record last_status='error' with the adapter error message.
-	mock.ExpectExec(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID, sqlmock.AnyArg(), "error", "A2A adapter error: adapter SDK internal error").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	// activity_logs INSERT must carry status='error' and the error detail.
-	mock.ExpectExec(`INSERT INTO activity_logs`).
-		WithArgs(sched.WorkspaceID, sqlmock.AnyArg(), sqlmock.AnyArg(), "error", "A2A adapter error: adapter SDK internal error").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	s := New(&adapterErrorProxy{}, nil)
-	s.fireSchedule(context.Background(), sched)
-
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet DB expectations — adapter error not recorded correctly: %v", err)
-	}
-}
-
 // ── TestFireSchedule_ComputeNextRunError (#722 Bug 1) ─────────────────────────
 //
 // When ComputeNextRun fails (bad cron expression), fireSchedule must NOT write
@@ -338,12 +285,6 @@ func TestFireSchedule_ComputeNextRunError(t *testing.T) {
 		WithArgs(sched.ID).
 		WillReturnResult(sqlmock.NewResult(0, 1))

-	// #1696 consecutive_sdk_errors reset — successProxy has no result_kind,
-	// so detectResultKind returns "" and lastStatus="ok" → reset.
-	mock.ExpectExec(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
 	// UPDATE must fire — COALESCE($2, next_run_at) keeps existing value when $2 is nil.
 	// AnyArg for $2 because it will be nil (ComputeNextRun failed).
 	mock.ExpectExec(`UPDATE workspace_schedules`).
@@ -599,14 +540,7 @@ func TestFireSchedule_NormalSuccess_AdvancesNextRunAt(t *testing.T) {
 		WithArgs(sched.ID).
 		WillReturnResult(sqlmock.NewResult(0, 1))

-	// 3. #1696 consecutive_sdk_errors reset — successProxy response has no
-	//    result_kind in the body, so detectResultKind returns "" and lastStatus
-	//    is "ok" → we hit the SDK-error counter reset branch.
-	mock.ExpectExec(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	// 4. Normal UPDATE after successful proxy call.
+	// 3. Normal UPDATE after successful proxy call.
 	//    Args: $1=sched.ID, $2=nextRunPtr (computed time), $3=lastStatus, $4=lastError
 	mock.ExpectExec(`UPDATE workspace_schedules`).
 		WithArgs(sched.ID, sqlmock.AnyArg(), "ok", "").
@@ -669,336 +603,6 @@ func TestRecordSkipped_AdvancesNextRunAt(t *testing.T) {
 }
 // trigger CI

-// ── TestDetectResultKind ───────────────────────────────────────────────────────
-
-// TestDetectResultKind covers the SDK error detection path: HTTP 200 responses
-// with non-ok result_kind in the body must be recognised and returned as the
-// kind string, not silently treated as ok.
-func TestDetectResultKind(t *testing.T) {
-	// The test exercises detectResultKind directly so we don't need a full
-	// fireSchedule mock for this unit-test level.
-	tests := []struct {
-		name     string
-		body     string
-		wantKind string
-	}{
-		{
-			name:     "clean ok response — empty body",
-			body:     `{}`,
-			wantKind: "",
-		},
-		{
-			name:     "clean ok response — result.kind absent",
-			body:     `{"result":{"parts":[{"text":"hello"}]}}`,
-			wantKind: "",
-		},
-		{
-			name:     "clean ok response — result.kind=ok",
-			body:     `{"result":{"kind":"ok","parts":[{"text":"hello"}]}}`,
-			wantKind: "",
-		},
-		{
-			name:     "clean ok response — result.result_kind=ok",
-			body:     `{"result":{"result_kind":"ok","parts":[{"text":"hello"}]}}`,
-			wantKind: "",
-		},
-		{
-			// REGRESSION GUARD: A2A-SDK canonical Message envelope.
-			// Pre-fix, every successful agent reply was mis-flagged as an SDK
-			// error (PM scheduler hit 21 consecutive false-failure ticks before
-			// auto-disable; canvas screenshot 2026-05-23).
-			name:     "clean ok response — result.kind=message (A2A Message envelope)",
-			body:     `{"jsonrpc":"2.0","result":{"kind":"message","parts":[{"kind":"text","text":"hello"}]},"id":"1"}`,
-			wantKind: "",
-		},
-		{
-			name:     "clean ok response — result.result_kind=message",
-			body:     `{"result":{"result_kind":"message","parts":[{"text":"hello"}]}}`,
-			wantKind: "",
-		},
-		{
-			// A2A Task envelope, in-progress — `status.state` discriminator is
-			// `submitted` or `working` → treat as clean (not an SDK error).
-			name:     "clean ok — task envelope state=working",
-			body:     `{"result":{"kind":"task","task_id":"abc","status":{"state":"working"}}}`,
-			wantKind: "",
-		},
-		{
-			name:     "clean ok — task envelope state=submitted",
-			body:     `{"result":{"kind":"task","status":{"state":"submitted"}}}`,
-			wantKind: "",
-		},
-		{
-			name:     "clean ok — task envelope state=completed",
-			body:     `{"result":{"kind":"task","status":{"state":"completed"}}}`,
-			wantKind: "",
-		},
-		{
-			// Conservative: missing status.state → don't fire false-failure.
-			name:     "clean ok — task envelope no status block",
-			body:     `{"result":{"kind":"task","task_id":"abc"}}`,
-			wantKind: "",
-		},
-		{
-			// REGRESSION GUARD: terminal failure states MUST propagate as last_status.
-			// Without taskOKStates gating, the blanket "task" allowlist would have
-			// masked these — CR2 review feedback on #1716.
-			name:     "SDK error — task envelope state=failed",
-			body:     `{"result":{"kind":"task","status":{"state":"failed"}}}`,
-			wantKind: "failed",
-		},
-		{
-			name:     "SDK error — task envelope state=canceled",
-			body:     `{"result":{"kind":"task","status":{"state":"canceled"}}}`,
-			wantKind: "canceled",
-		},
-		{
-			name:     "SDK error — task envelope state=rejected",
-			body:     `{"result":{"kind":"task","status":{"state":"rejected"}}}`,
-			wantKind: "rejected",
-		},
-		{
-			name:     "SDK error — result.kind=rate_limited",
-			body:     `{"result":{"kind":"rate_limited","parts":[{"text":"error"}]}}`,
-			wantKind: "rate_limited",
-		},
-		{
-			name:     "SDK error — result.kind=quota_exhausted",
-			body:     `{"result":{"kind":"quota_exhausted"}}`,
-			wantKind: "quota_exhausted",
-		},
-		{
-			name:     "SDK error — result.kind=sdk_error",
-			body:     `{"result":{"kind":"sdk_error"}}`,
-			wantKind: "sdk_error",
-		},
-		{
-			name:     "SDK error — result.result_kind=rate_limited",
-			body:     `{"result":{"result_kind":"rate_limited"}}`,
-			wantKind: "rate_limited",
-		},
-		{
-			name:     "SDK error — error string with rate limit",
-			body:     `{"result":{"parts":[]},"error":"An error occurred: rate limit exceeded"}`,
-			wantKind: "rate_limited",
-		},
-		{
-			name:     "SDK error — error string with max-plan",
-			body:     `{"error":"Max-plan rate limit reached"}`,
-			wantKind: "quota_exhausted",
-		},
-		{
-			name:     "SDK error — error string with quota",
-			body:     `{"error":"quota exhausted for model"}`,
-			wantKind: "quota_exhausted",
-		},
-		{
-			name:     "SDK error — error string with sdk error",
-			body:     `{"error":"Claude Code returned an error result: success"}`,
-			wantKind: "sdk_error",
-		},
-		{
-			name:     "SDK error — error string with api key",
-			body:     `{"error":"invalid API key"}`,
-			wantKind: "sdk_error",
-		},
-		{
-			name:     "unknown error string — not an SDK error",
-			body:     `{"error":"something went wrong"}`,
-			wantKind: "",
-		},
-		{
-			name:     "empty response body",
-			body:     ``,
-			wantKind: "",
-		},
-		{
-			name:     "malformed JSON",
-			body:     `not valid json`,
-			wantKind: "",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := detectResultKind([]byte(tc.body))
-			if got != tc.wantKind {
-				t.Errorf("detectResultKind(%q) = %q, want %q", tc.body, got, tc.wantKind)
-			}
-		})
-	}
-}
-
-// ── TestFireSchedule_SDKError_RateLimited (#1696) ───────────────────────────────
-//
-// When ProxyA2ARequest returns HTTP 200 but the response body contains a
-// non-ok result_kind, fireSchedule must:
-//   1. Set last_status to the result_kind (not 'ok').
-//   2. Set last_error to describe the SDK error.
-//   3. Increment consecutive_sdk_errors.
-//   4. NOT auto-disable on first occurrence (threshold is 3).
-//
-// This test uses an sdkErrorProxy that returns a rate-limited body and asserts
-// the first run is recorded as 'rate_limited' with consecutive_sdk_errors=1
-// and enabled=true.
-func TestFireSchedule_SDKError_RateLimited(t *testing.T) {
-	mock := setupTestDB(t)
-
-	sched := scheduleRow{
-		ID:          "sdk1-test-sched-0001",
-		WorkspaceID: "sdk1-test-workspace1",
-		Name:        "rate-limited-job",
-		CronExpr:    "0 * * * *",
-		Timezone:    "UTC",
-		Prompt:      "do work",
-	}
-
-	// 1. active_tasks check → workspace idle
-	mock.ExpectQuery(`SELECT COALESCE`).
-		WillReturnRows(sqlmock.NewRows([]string{"coalesce"}).AddRow(0))
-
-	// 2. #1696 consecutive_sdk_errors bump — RETURNING gives us count=1.
-	//    Use ExpectQuery (not Exec) because QueryRowContext + RETURNING
-	//    produces a result set consumed via .Scan().
-	mock.ExpectQuery(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID).
-		WillReturnRows(sqlmock.NewRows([]string{"consecutive_sdk_errors"}).AddRow(1))
-
-	// 3. Post-fire UPDATE — last_status='rate_limited', last_error='SDK error: result_kind=rate_limited'
-	mock.ExpectExec(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID, sqlmock.AnyArg(), "rate_limited", sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	// 4. activity_logs INSERT
-	mock.ExpectExec(`INSERT INTO activity_logs`).
-		WithArgs(sched.WorkspaceID, sqlmock.AnyArg(), sqlmock.AnyArg(), "rate_limited", sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	s := New(&sdkErrorProxy{kind: "rate_limited"}, nil)
-	s.fireSchedule(context.Background(), sched)
-
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet DB expectations for SDK-error first run: %v", err)
-	}
-}
-
-// ── TestFireSchedule_SDKError_AutoDisableOnThirdConsecutive (#1696) ───────────
-//
-// On the 3rd consecutive SDK error, fireSchedule must auto-disable the
-// schedule (enabled=false) in addition to recording the error status.
-// Threshold is 3 per #1696 requirement.
-func TestFireSchedule_SDKError_AutoDisableOnThirdConsecutive(t *testing.T) {
-	mock := setupTestDB(t)
-
-	sched := scheduleRow{
-		ID:          "sdk2-test-sched-0002",
-		WorkspaceID: "sdk2-test-workspace2",
-		Name:        "auto-disable-job",
-		CronExpr:    "0 * * * *",
-		Timezone:    "UTC",
-		Prompt:      "do work",
-	}
-
-	// 1. active_tasks check → workspace idle
-	mock.ExpectQuery(`SELECT COALESCE`).
-		WillReturnRows(sqlmock.NewRows([]string{"coalesce"}).AddRow(0))
-
-	// 2. #1696 consecutive_sdk_errors bump — RETURNING gives count=3 (threshold met).
-	//    Use ExpectQuery (not Exec) because QueryRowContext + RETURNING
-	//    produces a result set consumed via .Scan().
-	mock.ExpectQuery(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID).
-		WillReturnRows(sqlmock.NewRows([]string{"consecutive_sdk_errors"}).AddRow(3))
-
-	// 3. Auto-disable UPDATE — sets enabled=false (schedule has hit 3rd SDK error)
-	mock.ExpectExec(`UPDATE workspace_schedules SET enabled`).
-		WithArgs(sched.ID).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	// 4. Post-fire UPDATE
-	mock.ExpectExec(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID, sqlmock.AnyArg(), "rate_limited", sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	// 5. activity_logs INSERT
-	mock.ExpectExec(`INSERT INTO activity_logs`).
-		WithArgs(sched.WorkspaceID, sqlmock.AnyArg(), sqlmock.AnyArg(), "rate_limited", sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	s := New(&sdkErrorProxy{kind: "rate_limited"}, nil)
-	s.fireSchedule(context.Background(), sched)
-
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet DB expectations for SDK-error auto-disable: %v", err)
-	}
-}
-
-// ── TestFireSchedule_SDKError_CounterResetOnCleanRun (#1696) ──────────────────
-//
-// A clean HTTP-200 run (no SDK error) must reset consecutive_sdk_errors to 0.
-// This prevents false auto-disable after intermittent SDK blips.
-func TestFireSchedule_SDKError_CounterResetOnCleanRun(t *testing.T) {
-	mock := setupTestDB(t)
-
-	sched := scheduleRow{
-		ID:          "sdk3-test-sched-0003",
-		WorkspaceID: "sdk3-test-workspace3",
-		Name:        "clean-reset-job",
-		CronExpr:    "30 * * * *",
-		Timezone:    "UTC",
-		Prompt:      "do work",
-	}
-
-	// 1. active_tasks check → workspace idle
-	mock.ExpectQuery(`SELECT COALESCE`).
-		WillReturnRows(sqlmock.NewRows([]string{"coalesce"}).AddRow(0))
-
-	// 2. No SDK error — #1696 counter is reset to 0
-	//    (lastStatus is 'ok', resultKind is empty, so we go to the reset branch)
-	mock.ExpectExec(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	// 3. Post-fire UPDATE
-	mock.ExpectExec(`UPDATE workspace_schedules`).
-		WithArgs(sched.ID, sqlmock.AnyArg(), "ok", "").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	// 4. activity_logs INSERT
-	mock.ExpectExec(`INSERT INTO activity_logs`).
-		WithArgs(sched.WorkspaceID, sqlmock.AnyArg(), sqlmock.AnyArg(), "ok", "").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	s := New(&successProxy{}, nil)
-	s.fireSchedule(context.Background(), sched)
-
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet DB expectations for SDK-error counter reset: %v", err)
-	}
-}
-
-// ── sdkErrorProxy ──────────────────────────────────────────────────────────────
-//
-// sdkErrorProxy is a test double whose ProxyA2ARequest returns HTTP 200 but
-// embeds a non-ok result_kind in the response body, simulating a Claude Code
-// SDK that returned 200 but the inner LLM call threw a rate-limit / quota error.
-// Used by TestFireSchedule_SDKError_* to cover #1696 SDK error detection.
-type sdkErrorProxy struct {
-	kind string // result_kind value to embed in the response body
-}
-
-func (p *sdkErrorProxy) ProxyA2ARequest(
-	_ context.Context, _ string, _ []byte, _ string, _ bool,
-) (int, []byte, error) {
-	body, _ := json.Marshal(map[string]interface{}{
-		"result": map[string]interface{}{
-			"kind":  p.kind,
-			"parts": []map[string]interface{}{{"kind": "text", "text": "(no response generated)"}},
-		},
-	})
-	return 200, body, nil
-}
-
 // ── TestTruncate_utf8Safe_regression2026 ──────────────────────────────────────

 // TestTruncate_utf8Safe_regression2026 locks in the #2026 fix: truncate must
@@ -1 +0,0 @@
-ALTER TABLE workspaces DROP COLUMN IF EXISTS compute;
@@ -1,2 +0,0 @@
-ALTER TABLE workspaces
-    ADD COLUMN IF NOT EXISTS compute JSONB NOT NULL DEFAULT '{}'::jsonb;
@@ -1,4 +0,0 @@
-- migration: 20260523000000_schedule_consecutive_sdk_errors.down.sql
-- Reverts #1696 fix for #1696 (consecutive_sdk_errors column)
-
-ALTER TABLE workspace_schedules DROP COLUMN IF EXISTS consecutive_sdk_errors;
@@ -1,20 +0,0 @@
-- migration: 20260523000000_schedule_consecutive_sdk_errors.up.sql
-- Fixes #1696: Add consecutive_sdk_errors counter to track SDK errors (HTTP 200
-- responses where the Claude Code runtime returned a non-ok result_kind).
-- When this counter reaches 3, the scheduler sets last_status='rate_limited'
-- and auto-disables the schedule.
--
-- The core issue: the claude-code-sdk adapter returns HTTP 200 even when the
-- inner LLM call throws (e.g. Max-plan rate-limit). All 3 observed runs logged
-- "completed (HTTP 200)" yet surfaced agent errors in the workspace chat.
-- This counter lets us detect that pattern and escalate appropriately.
-
-ALTER TABLE workspace_schedules
-    ADD COLUMN IF NOT EXISTS consecutive_sdk_errors INTEGER NOT NULL DEFAULT 0;
-
-COMMENT ON COLUMN workspace_schedules.consecutive_sdk_errors IS
-    'Count of consecutive scheduler fires where ProxyA2ARequest returned HTTP 200
-     but the response body contained a non-ok result_kind (e.g. rate_limited,
-     sdk_error, quota_exhausted). Reset to 0 on any non-SDK-error status.
-     After 3 consecutive SDK errors the schedule is auto-disabled with
-     status rate_limited. Fixes #1696.';
@@ -0,0 +1,5 @@
+ALTER TABLE workspaces
+    DROP COLUMN IF EXISTS compute_instance_type;
+
+ALTER TABLE workspaces
+    DROP COLUMN IF EXISTS compute_volume_root_gb;
@@ -0,0 +1,10 @@
+-- Per-workspace EC2 compute configuration (#1686 Phase 1).
+-- Allows callers to override instance_type and root volume size
+-- at workspace creation time. Omitted/null values preserve the
+-- platform-managed default (current behaviour), so this is fully
+-- backwards-compatible.
+ALTER TABLE workspaces
+    ADD COLUMN IF NOT EXISTS compute_instance_type TEXT;
+
+ALTER TABLE workspaces
+    ADD COLUMN IF NOT EXISTS compute_volume_root_gb INTEGER;
@@ -1,2 +0,0 @@
-DROP INDEX IF EXISTS idx_workspace_display_control_locks_expires;
-DROP TABLE IF EXISTS workspace_display_control_locks;
@@ -1,11 +0,0 @@
-CREATE TABLE IF NOT EXISTS workspace_display_control_locks (
-    workspace_id uuid PRIMARY KEY REFERENCES workspaces(id) ON DELETE CASCADE,
-    controller text NOT NULL CHECK (controller IN ('user', 'agent')),
-    controlled_by text NOT NULL CHECK (length(controlled_by) > 0 AND length(controlled_by) <= 200),
-    expires_at timestamptz NOT NULL,
-    created_at timestamptz NOT NULL DEFAULT now(),
-    updated_at timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS idx_workspace_display_control_locks_expires
-    ON workspace_display_control_locks (expires_at);
				`@@ -1 +0,0 @@`
				`ALTER TABLE workspaces DROP COLUMN IF EXISTS compute;`