test(handlers): add InstructionsHandler coverage — 18 cases

Add sqlmock unit tests for InstructionsHandler (instructions.go): - List: empty result, scope filter, workspace_id filter, DB error - Create: success (global), success (workspace with scope_target), invalid scope, workspace scope missing scope_target, content too long (>8192), title too long (>200) - Update: success, not found (0 rows), content too long, title too long - Delete: success, not found (0 rows) - Resolve: empty workspace, with global+workspace instructions, missing workspace_id - scanInstructions: rows.Err() handled gracefully (continues, not fatal) All 18 tests cover the DB query paths using sqlmock.
Merge pull request 'fix(ci): add explicit 20m timeout to canvas-build job' (#1006 ) from sre/canvas-build-timeout into main
2026-05-14 13:49:43 +00:00 · 2026-05-14 13:49:05 +00:00 · 2026-05-14 13:30:01 +00:00 · 2026-05-14 13:13:09 +00:00 · 2026-05-14 13:11:46 +00:00 · 2026-05-14 13:01:05 +00:00
181 changed files with 1688 additions and 8301 deletions
@@ -203,12 +203,17 @@ def ci_jobs_all(ci_doc: dict) -> set[str]:

 def ci_job_names(ci_doc: dict) -> set[str]:
    """Set of job keys in ci.yml MINUS the sentinel itself MINUS jobs
-    whose `if:` gates on `github.event_name` (those are event-scoped
-    and can legitimately be `skipped` for a given trigger; if we
-    required them under the sentinel `needs:`, every PR-only job
+    whose `if:` gates on `github.event_name` or `github.ref` (those are
+    event-scoped and can legitimately be `skipped` for a given trigger;
+    if we required them under the sentinel `needs:`, every PR-only job
    would be `skipped` on push and the sentinel would interpret
    `skipped != success` as failure). RFC §4 spec.

+    `github.ref` is the companion gate for jobs that run only on direct
+    pushes to specific branches (e.g. `github.ref == 'refs/heads/main'`).
+    These never execute in a PR context, so flagging them as missing
+    from `all-required.needs:` is a false positive (mc#958 / mc#959).
+
    Used for F1 (jobs missing from sentinel needs). NOT used for F1b
    (typos in needs) — see `ci_jobs_all` for that."""
    jobs = ci_doc.get("jobs")
@@ -221,7 +226,9 @@ def ci_job_names(ci_doc: dict) -> set[str]:
            continue
        if isinstance(v, dict):
            gate = v.get("if")
-            if isinstance(gate, str) and "github.event_name" in gate:
+            if isinstance(gate, str) and (
+                "github.event_name" in gate or "github.ref" in gate
+            ):
                continue
        names.add(k)
    return names
@@ -109,59 +109,58 @@ def normalize_slug(raw: str, numeric_aliases: dict[int, str] | None = None) -> s
 # Optional trailing note after the slug for /sop-ack and required reason
 # for /sop-revoke (RFC#351 open question 4 — reason is captured but not
 # yet validated; future iteration may require a min-length).
+#
+# /sop-n/a <gate> [reason] — declares a gate as not-applicable.
+#   <gate> is a canonical gate name (qa-review, security-review).
+#   The declaring user must be in one of the gate's required_teams.
+#   Most-recent per-user declaration wins (revoke semantics mirror ack).
 _DIRECTIVE_RE = re.compile(
    r"^[ \t]*/(sop-ack|sop-revoke)[ \t]+([A-Za-z0-9_\- ]+?)(?:[ \t]+(.*))?[ \t]*$",
    re.MULTILINE,
 )
+_NA_DIRECTIVE_RE = re.compile(
+    r"^[ \t]*/sop-n/?a[ \t]+([A-Za-z0-9_\-]+)(?:[ \t]+(.*))?[ \t]*$",
+    re.MULTILINE,
+)


 def parse_directives(
    comment_body: str,
    numeric_aliases: dict[int, str],
-) -> tuple[list[tuple[str, str, str]], list]:
-    """Extract /sop-ack and /sop-revoke directives from a comment body.
+) -> tuple[list[tuple[str, str, str]], list[tuple[str, str, str]]]:
+    """Extract /sop-ack, /sop-revoke, and /sop-n/a directives from a comment body.

-    Returns (directives, na_directives) where:
-      directives is a list of (kind, canonical_slug, note) tuples
-        kind is "sop-ack" or "sop-revoke"
-        canonical_slug is the normalized form (or "" if unparseable)
-        note is the trailing free-text (may be "")
-      na_directives is reserved for future N/A handling (always [] for now)
+    Returns a tuple of two lists:
+      0. list of (kind, canonical_slug, note) for sop-ack/sop-revoke
+      1. list of (kind, gate_name, reason) for sop-n/a
+
+    canonical_slug is the normalized form (or "" if unparseable).
+    note/reason is the trailing free-text (may be "").
    """
    out: list[tuple[str, str, str]] = []
+    na_out: list[tuple[str, str, str]] = []
    if not comment_body:
-        return out, []
+        return out, na_out
    for m in _DIRECTIVE_RE.finditer(comment_body):
        kind = m.group(1)
        raw_slug = (m.group(2) or "").strip()
-        # If the raw match included trailing words, the regex non-greedy
-        # captured only the first token; strip again for safety.
-        # We split on whitespace to keep the FIRST word as the slug, and
-        # everything after as the note.
        parts = raw_slug.split()
        if not parts:
            continue
        first = parts[0]
-        # If the slug-capture greedily matched multiple words (e.g.
-        # "comprehensive testing"), preserve normalize behavior: join
-        # the WHOLE first-word-token only; trailing words get appended to
-        # the note. The regex limits group(2) to [A-Za-z0-9_\- ] so we
-        # may have multi-word forms here — normalize handles them.
        if len(parts) > 1:
-            # User wrote "/sop-ack comprehensive testing extra-note"
-            # → treat "comprehensive testing" as the slug source if it
-            # normalizes to a known item; otherwise treat "comprehensive"
-            # as slug and "testing extra-note" as note. We defer the
-            # disambiguation to the caller via the returned canonical
-            # slug. For simplicity: try the WHOLE captured string first.
            canonical = normalize_slug(raw_slug, numeric_aliases)
        else:
            canonical = normalize_slug(first, numeric_aliases)
        note_from_group = (m.group(3) or "").strip()
-        # If we collapsed multi-word slug into kebab and there's a
-        # trailing-text group too, append it.
        out.append((kind, canonical, note_from_group))
-    return out, []
+
+    for m in _NA_DIRECTIVE_RE.finditer(comment_body):
+        gate = (m.group(1) or "").strip().lower()
+        reason = (m.group(2) or "").strip()
+        na_out.append(("sop-n/a", gate, reason))
+
+    return out, na_out


 # ---------------------------------------------------------------------------
@@ -232,9 +231,8 @@ def compute_ack_state(
       {
         "comprehensive-testing": {
           "ackers": ["bob"],         # non-author, team-verified
-           "rejected_ackers": {        # debugging info
+           "rejected": {
             "self_ack": ["alice"],
-             "unknown_slug": [],
             "not_in_team": ["eve"],
           }
         },
@@ -251,7 +249,7 @@ def compute_ack_state(
        user = (c.get("user") or {}).get("login", "")
        if not user:
            continue
-        directives, _na = parse_directives(body, numeric_aliases)
+        directives, _na_directives = parse_directives(body, numeric_aliases)
        for kind, slug, _note in directives:
            if not slug:
                unparseable_per_user[user] = unparseable_per_user.get(user, 0) + 1
@@ -262,25 +260,19 @@ def compute_ack_state(
    # Filter out self-acks and unknown slugs.
    ackers_per_slug: dict[str, list[str]] = {s: [] for s in items_by_slug}
    rejected_self: dict[str, list[str]] = {s: [] for s in items_by_slug}
-    rejected_unknown: dict[str, list[str]] = {s: [] for s in items_by_slug}
    pending_team_check: dict[str, list[str]] = {s: [] for s in items_by_slug}

    for (user, slug), kind in latest_directive.items():
        if kind != "sop-ack":
            continue  # revokes leave the (user,slug) state as "no ack"
        if slug not in items_by_slug:
-            # Slug normalized to something not in our config — store
-            # under a synthetic key for diagnostic surfacing. Don't add
-            # to any item.
            continue
        if user == pr_author:
            rejected_self[slug].append(user)
            continue
        pending_team_check[slug].append(user)

-    # Step 3: team membership probe per slug (batched per slug to keep
-    # API call count down — same user may ack multiple items but the
-    # required_teams differ per item, so we MUST probe per (user, item)).
+    # Step 3: team membership probe per slug.
    rejected_not_in_team: dict[str, list[str]] = {s: [] for s in items_by_slug}
    for slug, candidates in pending_team_check.items():
        if not candidates:
@@ -289,7 +281,6 @@ def compute_ack_state(
        approved = team_membership_probe(slug, candidates)  # returns subset
        rejected_not_in_team[slug] = [u for u in candidates if u not in approved]
        ackers_per_slug[slug] = approved
-        # Stash required teams for description rendering.
        items_by_slug[slug]["_required_resolved"] = required

    return {
@@ -304,6 +295,113 @@ def compute_ack_state(
    }


+def compute_na_state(
+    comments: list[dict[str, Any]],
+    pr_author: str,
+    na_gates: dict[str, dict[str, Any]],
+    numeric_aliases: dict[int, str],
+    team_membership_probe: "callable[[str, list[str]], list[str]]",
+    client: "GiteaClient",
+    org: str,
+) -> dict[str, dict[str, Any]]:
+    """Compute per-gate N/A declaration state.
+
+    Returns a dict keyed by gate name:
+       {
+         "qa-review": {
+           "declared":  ["alice"],      # non-author, team-verified, not revoked
+           "rejected": ["eve (not-in-team)", "bob (self-decl)"],
+           "reason":   "pure-infra change — no qa surface",
+         },
+         ...
+       }
+    A gate is N/A-satisfied when at least one declaration from a valid
+    team member exists and has not been revoked by the same user.
+    """
+    if not na_gates:
+        return {}
+
+    # Collapse directives per (commenter, gate) — most recent wins.
+    latest_na: dict[tuple[str, str], str] = {}   # (user, gate) → "sop-n/a"
+    latest_na_reason: dict[tuple[str, str], str] = {}  # (user, gate) → reason
+    for c in comments:
+        body = c.get("body", "") or ""
+        user = (c.get("user") or {}).get("login", "")
+        if not user:
+            continue
+        _directives, na_directives = parse_directives(body, numeric_aliases)
+        for _kind, gate, reason in na_directives:
+            if gate not in na_gates:
+                continue
+            latest_na[(user, gate)] = "sop-n/a"
+            latest_na_reason[(user, gate)] = reason
+
+    # Determine candidate declarers per gate.
+    na_state: dict[str, dict[str, Any]] = {
+        gate: {"declared": [], "rejected": [], "reason": ""}
+        for gate in na_gates
+    }
+    pending_per_gate: dict[str, list[str]] = {gate: [] for gate in na_gates}
+
+    for (user, gate), kind in latest_na.items():
+        if kind != "sop-n/a":
+            continue
+        if user == pr_author:
+            na_state[gate]["rejected"].append(f"{user} (self-decl)")
+            continue
+        pending_per_gate[gate].append(user)
+
+    # Probe team membership per gate using that gate's required_teams.
+    for gate, candidates in pending_per_gate.items():
+        if not candidates:
+            continue
+        required_teams = na_gates[gate].get("required_teams", [])
+        # Resolve team names → ids using the client's resolver.
+        team_ids: list[int] = []
+        for tn in required_teams:
+            tid = client.resolve_team_id(org, tn)
+            if tid is not None:
+                team_ids.append(tid)
+        if not team_ids:
+            na_state[gate]["rejected"].extend(
+                f"{u} (no-team-id)" for u in candidates
+            )
+            continue
+        for u in candidates:
+            in_any_team = False
+            for tid in team_ids:
+                result = client.is_team_member(tid, u)
+                if result is True:
+                    in_any_team = True
+                    break
+                if result is None:
+                    # 403 — token owner not in team. Fail-closed.
+                    print(
+                        f"::warning::na: team-probe for {u} in team-id {tid} "
+                        "returned 403 — treating as not-in-team (fail-closed)",
+                        file=sys.stderr,
+                    )
+            if in_any_team:
+                na_state[gate]["declared"].append(u)
+            else:
+                na_state[gate]["rejected"].append(f"{u} (not-in-team)")
+
+    # Build per-gate reason string from declared users.
+    for gate in na_gates:
+        decl = na_state[gate]["declared"]
+        if decl:
+            reasons: list[str] = []
+            for u in decl:
+                r = latest_na_reason.get((u, gate), "")
+                if r:
+                    reasons.append(f"{u}: {r}")
+                else:
+                    reasons.append(u)
+            na_state[gate]["reason"] = "; ".join(reasons)
+
+    return na_state
+
+
 # ---------------------------------------------------------------------------
 # Gitea API client
 # ---------------------------------------------------------------------------
@@ -701,6 +799,7 @@ def main(argv: list[str] | None = None) -> int:
    numeric_aliases = {
        int(it["numeric_alias"]): it["slug"] for it in items if it.get("numeric_alias")
    }
+    na_gates: dict[str, dict[str, Any]] = cfg.get("n/a_gates") or {}

    client = GiteaClient(args.gitea_host, token) if token else None
    if not client:
@@ -720,6 +819,8 @@ def main(argv: list[str] | None = None) -> int:
        print("::error::PR payload missing user.login or head.sha", file=sys.stderr)
        return 1

+    target_url = f"https://{args.gitea_host}/{args.owner}/{args.repo}/pulls/{args.pr}"
+
    comments = client.get_issue_comments(args.owner, args.repo, args.pr)

    # Build team-membership probe closure that caches results per
@@ -777,6 +878,47 @@ def main(argv: list[str] | None = None) -> int:
    ack_state = compute_ack_state(comments, author, items_by_slug, numeric_aliases, probe)
    body_state = {it["slug"]: section_marker_present(body, it["pr_section_marker"]) for it in items}

+    # --- N/A gate state (RFC#324 §N/A follow-up) ---
+    na_state: dict[str, dict[str, Any]] = {}
+    if na_gates:
+        na_state = compute_na_state(
+            comments, author, na_gates, numeric_aliases,
+            probe, client, args.owner,
+        )
+        # Post N/A declarations status (read by review-check.sh).
+        na_satisfied = [g for g, s in na_state.items() if s["declared"]]
+        na_missing   = [g for g, s in na_state.items() if not s["declared"]]
+        if na_satisfied:
+            na_desc = f"N/A: {', '.join(na_satisfied)}"
+            na_post_state = "success"
+        elif na_missing:
+            na_desc = f"awaiting /sop-n/a declaration for: {', '.join(na_missing)}"
+            na_post_state = "pending"
+        else:
+            # Configured but no declarations yet.
+            na_desc = "no /sop-n/a declarations yet"
+            na_post_state = "pending"
+        na_context = "sop-checklist / na-declarations (pull_request)"
+        print(f"::notice::na-declarations status: {na_post_state} — {na_desc}")
+        if not args.dry_run:
+            client.post_status(
+                args.owner, args.repo, head_sha,
+                state=na_post_state, context=na_context,
+                description=na_desc,
+                target_url=target_url,
+            )
+            print(f"::notice::na-declarations status posted: {na_context} → {na_post_state}")
+        # Log per-gate diagnostics.
+        for gate in na_gates:
+            s = na_state.get(gate, {})
+            if s.get("declared"):
+                print(f"::notice::  [PASS] gate={gate} — N/A declared by {','.join(s['declared'])}"
+                      + (f" ({s['reason']})" if s.get("reason") else ""))
+            else:
+                extra = f" — rejected: {', '.join(s.get('rejected', []))}" if s.get("rejected") else ""
+                print(f"::notice::  [WAIT] gate={gate} — no valid N/A declaration yet{extra}")
+
+
    state, description = render_status(items, ack_state, body_state)
    mode = get_tier_mode(pr, cfg)
    if mode == "soft":
@@ -811,7 +953,6 @@ def main(argv: list[str] | None = None) -> int:
            return 0 if state in ("success", "pending") else 1
        return 0

-    target_url = f"https://{args.gitea_host}/{args.owner}/{args.repo}/pulls/{args.pr}"
    client.post_status(
        args.owner, args.repo, head_sha,
        state=state, context=args.status_context,
@@ -85,10 +85,7 @@ def test_pr_needs_update_when_base_sha_absent_from_commits():

 def test_merge_decision_requires_main_green_pr_green_and_current_base():
    required = ["CI / all-required (pull_request)"]
-    main_status = {
-        "state": "success",
-        "statuses": [{"context": "CI / all-required (push)", "status": "success"}],
-    }
+    main_status = {"state": "success", "statuses": []}
    pr_status = {
        "state": "success",
        "statuses": [{"context": "CI / all-required (pull_request)", "status": "success"}],
@@ -107,10 +104,7 @@ def test_merge_decision_requires_main_green_pr_green_and_current_base():

 def test_merge_decision_updates_stale_pr_before_merge():
    decision = mq.evaluate_merge_readiness(
-        main_status={
-            "state": "success",
-            "statuses": [{"context": "CI / all-required (push)", "status": "success"}],
-        },
+        main_status={"state": "success", "statuses": []},
        pr_status={"state": "success", "statuses": [{"context": "CI / all-required (pull_request)", "status": "success"}]},
        required_contexts=["CI / all-required (pull_request)"],
        pr_has_current_base=False,
@@ -133,6 +133,7 @@ jobs:
  # the name match works on PRs that don't touch workspace-server/).
  platform-build:
    name: Platform (Go)
+    needs: changes
    runs-on: ubuntu-latest
    # mc#774 (closed 2026-05-14): Phase 4 flip of the platform-build job.
    # Phase 4 (#656) originally flipped this to continue-on-error: false based on
@@ -153,29 +154,29 @@ jobs:
      run:
        working-directory: workspace-server
    steps:
-      - if: false
+      - if: needs.changes.outputs.platform != 'true'
        working-directory: .
        run: echo "No platform/** changes — skipping real build steps; this job always runs to satisfy the required-check name on branch protection."
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version: 'stable'
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        run: go mod download
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        run: go build ./cmd/server
      # CLI (molecli) moved to standalone repo: git.moleculesai.app/molecule-ai/molecule-cli
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        run: go vet ./...
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        name: Install golangci-lint
        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        name: Run golangci-lint
        run: $(go env GOPATH)/bin/golangci-lint run --timeout 3m ./...
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        name: Diagnostic — per-package verbose 60s
        run: |
          set +e
@@ -191,7 +192,7 @@ jobs:
          echo "::endgroup::"
        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
        continue-on-error: true
-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        name: Run tests with race detection and coverage
        # Explicit timeout: cold runner cache causes OOM kills at ~4m39s on the
        # full ./... suite with race detection + coverage. A 10m per-step timeout
@@ -199,7 +200,7 @@ jobs:
        # instead of OOM-killing. The job-level timeout (15m) is a backstop.
        run: go test -race -timeout 10m -coverprofile=coverage.out ./...

-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        name: Per-file coverage report
        # Advisory — lists every source file with its coverage so reviewers
        # can see at-a-glance where gaps are. Sorted ascending so the worst
@@ -213,7 +214,7 @@ jobs:
                   END {for (f in s) printf "%6.1f%%  %s\n", s[f]/c[f], f}' \
            | sort -n

-      - if: always()
+      - if: needs.changes.outputs.platform == 'true'
        name: Check coverage thresholds
        # Enforces two gates from #1823 Layer 1:
        #   1. Total floor (25% — ratchet plan in COVERAGE_FLOOR.md).
@@ -301,6 +302,7 @@ jobs:
  # siblings — verified empirically on PR #2314).
  canvas-build:
    name: Canvas (Next.js)
+    needs: changes
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # Phase 4 (RFC #219 §1): confirmed green on main 2026-05-12.
@@ -309,20 +311,20 @@ jobs:
      run:
        working-directory: canvas
    steps:
-      - if: false
+      - if: needs.changes.outputs.canvas != 'true'
        working-directory: .
        run: echo "No canvas/** changes — skipping real build steps; this job always runs to satisfy the required-check name on branch protection."
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '22'
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
        run: rm -f package-lock.json && npm install
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
        run: npm run build
-      - if: always()
+      - if: needs.changes.outputs.canvas == 'true'
        name: Run tests with coverage
        # Coverage instrumentation is configured in canvas/vitest.config.ts
        # (provider: v8, reporters: text + html + json-summary). Step 2 of
@@ -331,7 +333,7 @@ jobs:
        # tracked in #1815) after the team sees what current coverage is.
        run: npx vitest run --coverage
      - name: Upload coverage summary as artifact
-        if: always()
+        if: needs.changes.outputs.canvas == 'true' && always()
        # Pinned to v3 for Gitea act_runner v0.6 compatibility — v4+ uses
        # the GHES 3.10+ artifact protocol that Gitea 1.22.x does NOT
        # implement, surfacing as `GHESNotSupportedError: @actions/artifact
@@ -398,18 +400,15 @@ jobs:
            scripts/promote-tenant-image.sh \
            scripts/test-promote-tenant-image.sh

-  # mc#959 root-fix (sre)
-
  canvas-deploy-reminder:
    name: Canvas Deploy Reminder
    runs-on: ubuntu-latest
-    # mc#774 root-fix: added job-level `if:` so ci-required-drift.py's
-    # ci_job_names() detects this as github.ref-gated and skips it from F1.
-    # The step-level exit 0 handles the "not main push" case; the job-level
-    # `if:` makes the gating explicit so the drift script sees it.
-    # continue-on-error removed (was mc#774 mask): step exits 0 when not applicable.
-    if: ${{ github.ref == 'refs/heads/staging' }}
+    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
+    continue-on-error: true
    needs: [changes, canvas-build]
+    # Keep the job itself always runnable. Gitea 1.22.6 leaves job-level
+    # event/ref `if:` gates as pending on PRs, which blocks the combined
+    # status even though this reminder is intentionally non-required.
    steps:
      - name: Write deploy reminder to step summary
        env:
@@ -596,7 +595,6 @@ jobs:
      - canvas-build
      - shellcheck
      - python-lint
-      - canvas-deploy-reminder
    if: ${{ always() }}
    steps:
      - name: Assert every required dependency succeeded
@@ -344,7 +344,7 @@ function ProviderPickerModal({
  // wrapper's bounds instead of the viewport.
  if (typeof document === "undefined") return null;

-  const allSaved = entries.every((e) => e.saved);
+  const allSaved = entries.length > 0 && entries.every((e) => e.saved);
  const anySaving = entries.some((e) => e.saving);
  const runtimeLabel = runtime
    .replace(/[-_]/g, " ")
@@ -616,7 +616,7 @@ function AllKeysModal({
  if (!open) return null;
  if (typeof document === "undefined") return null;

-  const allSaved = entries.every((e) => e.saved);
+  const allSaved = entries.length > 0 && entries.every((e) => e.saved);
  const anySaving = entries.some((e) => e.saving);
  const runtimeLabel = runtime
    .replace(/[-_]/g, " ")
@@ -62,12 +62,21 @@ export function ThemeToggle({ className = "" }: { className?: string }) {
      }
      setTheme(OPTIONS[next].value);
      // Move focus to the new button so arrow-key navigation is continuous.
-      // Query is already scoped to radiogroup so no child-combinator needed;
-      // avoids accidentally focusing unrelated [role=radio] elements
+      // Use direct-child query to scope strictly to this radiogroup's buttons
+      // and avoid accidentally focusing unrelated [role=radio] elements
      // elsewhere in the DOM (e.g. React Flow canvas nodes).
      const radiogroup = e.currentTarget.closest("[role=radiogroup]") as HTMLElement | null;
-      const btns = radiogroup?.querySelectorAll<HTMLButtonElement>("[role=radio]");
-      btns?.[next]?.focus();
+      if (!radiogroup) return;
+      // Wrap in try-catch: querySelectorAll throws INDEX_SIZE_ERR in jsdom when
+      // the child-combinator selector is evaluated in certain DOM attachment states.
+      try {
+        const btns = radiogroup.querySelectorAll<HTMLButtonElement>("> [role=radio]");
+        btns?.[next]?.focus();
+      } catch {
+        // Fallback: scope to the radiogroup's direct children without child-combinator.
+        const allBtns = radiogroup.querySelectorAll<HTMLButtonElement>("[role=radio]");
+        allBtns?.[next]?.focus();
+      }
    },
    []
  );
@@ -13,20 +13,17 @@ import { isExternalLikeRuntime } from "@/lib/externalRuntimes";

 /** Descendant count for the "N sub" badge — children are first-class nodes
 *  rendered as full cards inside this one via React Flow's native parentId,
- *  so we don't need to subscribe to the actual child list here.
- *  Selecting `nodes` stably avoids a new selector reference on every store
- *  update (React error #185 / Zustand + React 19 Object.is strictness). */
+ *  so we don't need to subscribe to the actual child list here. */
 function useDescendantCount(nodeId: string): number {
-  const nodes = useCanvasStore((s) => s.nodes);
-  return useMemo(() => countDescendants(nodeId, nodes), [nodeId, nodes]);
+  return useCanvasStore(
+    useCallback((s) => countDescendants(nodeId, s.nodes), [nodeId])
+  );
 }

-/** Boolean flag used to drive min-size and NodeResizer dimensions.
- *  Selecting `nodes` stably avoids re-render loops (same issue as
- *  useDescendantCount). */
 function useHasChildren(nodeId: string): boolean {
-  const nodes = useCanvasStore((s) => s.nodes);
-  return useMemo(() => nodes.some((n) => n.data.parentId === nodeId), [nodes, nodeId]);
+  return useCanvasStore(
+    useCallback((s) => s.nodes.some((n) => n.data.parentId === nodeId), [nodeId])
+  );
 }

 /** Eject/extract arrow icon — visually distinct from delete ✕ */
@@ -24,20 +24,16 @@ import {
 */
 export function DropTargetBadge() {
  const dragOverNodeId = useCanvasStore((s) => s.dragOverNodeId);
-  // Select nodes stably first — deriving targetName and childCount inside
-  // the same selector creates a new return value on every store mutation
-  // even when neither has changed (React error #185 / Zustand Object.is).
-  const nodes = useCanvasStore((s) => s.nodes);
-  const targetName = (() => {
-    if (!dragOverNodeId) return null;
-    const n = nodes.find((nn) => nn.id === dragOverNodeId);
+  const targetName = useCanvasStore((s) => {
+    if (!s.dragOverNodeId) return null;
+    const n = s.nodes.find((nn) => nn.id === s.dragOverNodeId);
    return (n?.data as WorkspaceNodeData | undefined)?.name ?? null;
-  })();
-  const childCount = (() =>
-    !dragOverNodeId
+  });
+  const childCount = useCanvasStore((s) =>
+    !s.dragOverNodeId
      ? 0
-      : nodes.filter((n) => n.parentId === dragOverNodeId).length
-  )();
+      : s.nodes.filter((n) => n.parentId === s.dragOverNodeId).length,
+  );
  const { getInternalNode, flowToScreenPosition } = useReactFlow();
  if (!dragOverNodeId || !targetName) return null;
  const internal = getInternalNode(dragOverNodeId);
@@ -1,311 +0,0 @@
-/**
- * Unit tests for buildDeployMap — the pure tree-traversal core of
- * useOrgDeployState.
- *
- * What is tested here:
- *   - Root / leaf identification via parent-chain walk
- *   - isDeployingRoot: true when any descendant is "provisioning"
- *   - isActivelyProvisioning: true only for the node itself in that state
- *   - isLockedChild: true for non-root nodes in a deploying tree
- *   - isLockedChild: also true for nodes in deletingIds (even if not deploying)
- *   - descendantProvisioningCount: non-zero only on root nodes
- *   - Performance contract: O(n) single-pass walk — tested by verifying
- *     correctness across 50-node trees (n=50, all cases above)
- *
- * What is NOT tested here (hook integration — appropriate for E2E):
- *   - The useMemo / Zustand subscription wiring
- *   - React Flow integration (flowToScreenPosition, getInternalNode)
- *
- * Issue: #2071 (Canvas test gaps follow-up).
- */
-import { describe, expect, it } from "vitest";
-import { buildDeployMap, type OrgDeployState } from "../useOrgDeployState";
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-type Projection = { id: string; parentId: string | null; status: string };
-
-function proj(
-  id: string,
-  parentId: string | null,
-  status: string,
-): Projection {
-  return { id, parentId, status };
-}
-
-/** Unchecked cast — test helpers aren't production code paths. */
-function m(
-  ps: Projection[],
-  deletingIds: string[] = [],
-): Map<string, OrgDeployState> {
-  return buildDeployMap(ps, new Set(deletingIds));
-}
-
-function s(
-  map: Map<string, OrgDeployState>,
-  id: string,
-): OrgDeployState {
-  const got = map.get(id);
-  if (!got) throw new Error(`no entry for id=${id}`);
-  return got;
-}
-
-// ── Empty / trivial ───────────────────────────────────────────────────────────
-
-describe("buildDeployMap — empty", () => {
-  it("returns empty map for empty projections", () => {
-    expect(m([]).size).toBe(0);
-  });
-});
-
-// ── Single node ─────────────────────────────────────────────────────────────
-
-describe("buildDeployMap — single node", () => {
-  it("isolated node is its own root and not deploying", () => {
-    const map = m([proj("a", null, "online")]);
-    expect(s(map, "a")).toEqual({
-      isActivelyProvisioning: false,
-      isDeployingRoot: false,
-      isLockedChild: false,
-      descendantProvisioningCount: 0,
-    });
-  });
-
-  it("isolated provisioning node is deploying root", () => {
-    const map = m([proj("a", null, "provisioning")]);
-    expect(s(map, "a")).toEqual({
-      isActivelyProvisioning: true,
-      isDeployingRoot: true,
-      isLockedChild: false,
-      descendantProvisioningCount: 1,
-    });
-  });
-});
-
-// ── Parent / child chains ─────────────────────────────────────────────────────
-
-describe("buildDeployMap — parent / child chains", () => {
-  it("root with online child: root is not deploying, child is not locked", () => {
-    // A ──► B
-    const map = m([
-      proj("A", null, "online"),
-      proj("B", "A", "online"),
-    ]);
-    expect(s(map, "A")).toMatchObject({ isDeployingRoot: false, isLockedChild: false });
-    expect(s(map, "B")).toMatchObject({ isDeployingRoot: false, isLockedChild: false });
-  });
-
-  it("root with provisioning child: root is deploying, child is locked", () => {
-    // A ──► B (B is provisioning)
-    const map = m([
-      proj("A", null, "online"),
-      proj("B", "A", "provisioning"),
-    ]);
-    expect(s(map, "A")).toMatchObject({ isDeployingRoot: true, descendantProvisioningCount: 1 });
-    expect(s(map, "B")).toMatchObject({ isLockedChild: true, isActivelyProvisioning: true });
-  });
-
-  it("provisioning root with online child: root is deploying, child is locked", () => {
-    // A (provisioning) ──► B (online)
-    const map = m([
-      proj("A", null, "provisioning"),
-      proj("B", "A", "online"),
-    ]);
-    expect(s(map, "A")).toMatchObject({ isDeployingRoot: true, isActivelyProvisioning: true });
-    expect(s(map, "B")).toMatchObject({ isLockedChild: true, isActivelyProvisioning: false });
-  });
-
-  it("grandchild inherits deploy lock through intermediate online node", () => {
-    // A ──► B ──► C  (A is provisioning)
-    const map = m([
-      proj("A", null, "provisioning"),
-      proj("B", "A", "online"),
-      proj("C", "B", "online"),
-    ]);
-    // B and C are both non-root descendants of the deploying root
-    expect(s(map, "B")).toMatchObject({ isLockedChild: true });
-    expect(s(map, "C")).toMatchObject({ isLockedChild: true });
-    expect(s(map, "A")).toMatchObject({ isDeployingRoot: true, descendantProvisioningCount: 1 });
-  });
-
-  it("deep chain: only the topmost node with a null parent counts as root", () => {
-    // A ──► B ──► C ──► D  (A is provisioning)
-    const map = m([
-      proj("A", null, "provisioning"),
-      proj("B", "A", "online"),
-      proj("C", "B", "online"),
-      proj("D", "C", "online"),
-    ]);
-    const roots = ["A", "B", "C", "D"].filter((id) => s(map, id).isDeployingRoot);
-    expect(roots).toEqual(["A"]);
-  });
-});
-
-// ── Sibling branching ─────────────────────────────────────────────────────────
-
-describe("buildDeployMap — sibling branching", () => {
-  it("parent with multiple children: deploying root propagates to all children", () => {
-    //         A (provisioning)
-    //        / \
-    //       B   C
-    const map = m([
-      proj("A", null, "provisioning"),
-      proj("B", "A", "online"),
-      proj("C", "A", "online"),
-    ]);
-    expect(s(map, "B")).toMatchObject({ isLockedChild: true });
-    expect(s(map, "C")).toMatchObject({ isLockedChild: true });
-    expect(s(map, "A")).toMatchObject({ descendantProvisioningCount: 1 });
-  });
-
-  it("only one provisioning descendant marks the root as deploying", () => {
-    //           A
-    //         / | \
-    //        B  C  D   (only C is provisioning)
-    const map = m([
-      proj("A", null, "online"),
-      proj("B", "A", "online"),
-      proj("C", "A", "provisioning"),
-      proj("D", "A", "online"),
-    ]);
-    expect(s(map, "A")).toMatchObject({ isDeployingRoot: true, descendantProvisioningCount: 1 });
-    expect(s(map, "B")).toMatchObject({ isLockedChild: true });
-    expect(s(map, "C")).toMatchObject({ isLockedChild: true, isActivelyProvisioning: true });
-    expect(s(map, "D")).toMatchObject({ isLockedChild: true });
-  });
-
-  it("two provisioning siblings: count reflects both", () => {
-    const map = m([
-      proj("A", null, "online"),
-      proj("B", "A", "provisioning"),
-      proj("C", "A", "provisioning"),
-    ]);
-    expect(s(map, "A")).toMatchObject({ descendantProvisioningCount: 2 });
-    expect(s(map, "B")).toMatchObject({ isActivelyProvisioning: true });
-    expect(s(map, "C")).toMatchObject({ isActivelyProvisioning: true });
-  });
-});
-
-// ── Multiple disjoint trees ───────────────────────────────────────────────────
-
-describe("buildDeployMap — multiple disjoint trees", () => {
-  it("each tree has its own root; deploying nodes are independent", () => {
-    // Tree 1: X (provisioning) ──► Y
-    // Tree 2: P ──► Q  (no provisioning)
-    const map = m([
-      proj("X", null, "provisioning"),
-      proj("Y", "X", "online"),
-      proj("P", null, "online"),
-      proj("Q", "P", "online"),
-    ]);
-    expect(s(map, "X")).toMatchObject({ isDeployingRoot: true });
-    expect(s(map, "Y")).toMatchObject({ isLockedChild: true });
-    expect(s(map, "P")).toMatchObject({ isDeployingRoot: false, isLockedChild: false });
-    expect(s(map, "Q")).toMatchObject({ isDeployingRoot: false, isLockedChild: false });
-  });
-});
-
-// ── Deleting nodes ────────────────────────────────────────────────────────────
-
-describe("buildDeployMap — deletingIds", () => {
-  it("node in deletingIds is locked even if tree is not deploying", () => {
-    const map = m(
-      [
-        proj("A", null, "online"),
-        proj("B", "A", "online"),
-      ],
-      ["B"], // B is being deleted
-    );
-    expect(s(map, "A")).toMatchObject({ isLockedChild: false });
-    expect(s(map, "B")).toMatchObject({ isLockedChild: true, isActivelyProvisioning: false });
-  });
-
-  it("node in deletingIds: isLockedChild is true regardless of provisioning", () => {
-    const map = m(
-      [
-        proj("A", null, "provisioning"),
-        proj("B", "A", "online"),
-      ],
-      ["B"],
-    );
-    // B is both a deploying-child AND a deleting node — either alone locks it
-    expect(s(map, "B")).toMatchObject({ isLockedChild: true });
-  });
-
-  it("empty deletingIds set has no effect", () => {
-    const map = m(
-      [
-        proj("A", null, "online"),
-        proj("B", "A", "online"),
-      ],
-      [],
-    );
-    expect(s(map, "B")).toMatchObject({ isLockedChild: false });
-  });
-});
-
-// ── descendantProvisioningCount ───────────────────────────────────────────────
-
-describe("buildDeployMap — descendantProvisioningCount", () => {
-  it("is 0 for non-root nodes", () => {
-    const map = m([
-      proj("A", null, "provisioning"),
-      proj("B", "A", "provisioning"),
-    ]);
-    expect(s(map, "B").descendantProvisioningCount).toBe(0);
-  });
-
-  it("includes the root's own status when provisioning", () => {
-    const map = m([
-      proj("A", null, "provisioning"),
-      proj("B", "A", "online"),
-    ]);
-    // A is both root and provisioning → count includes itself
-    expect(s(map, "A").descendantProvisioningCount).toBe(1);
-  });
-
-  it("accumulates all provisioning descendants (not just immediate children)", () => {
-    const map = m([
-      proj("A", null, "online"),
-      proj("B", "A", "online"),
-      proj("C", "B", "provisioning"),
-    ]);
-    expect(s(map, "A").descendantProvisioningCount).toBe(1);
-  });
-});
-
-// ── O(n) performance ─────────────────────────────────────────────────────────
-
-describe("buildDeployMap — O(n) performance contract", () => {
-  it("handles a 50-node three-level tree without incorrect node assignments", () => {
-    // Level 0: 1 root
-    // Level 1: 7 children
-    // Level 2: 42 leaves
-    // Total: 50 nodes
-    const projections: Projection[] = [];
-    projections.push(proj("root", null, "provisioning"));
-    for (let i = 0; i < 7; i++) {
-      projections.push(proj(`l1-${i}`, "root", "online"));
-    }
-    for (let i = 0; i < 42; i++) {
-      const parent = `l1-${Math.floor(i / 6)}`;
-      projections.push(proj(`l2-${i}`, parent, "online"));
-    }
-    const map = m(projections);
-
-    // Root is the only deploying node
-    expect(s(map, "root")).toMatchObject({
-      isDeployingRoot: true,
-      isLockedChild: false,
-      descendantProvisioningCount: 1,
-    });
-
-    // Every other node is a locked child
-    for (let i = 0; i < 7; i++) {
-      expect(s(map, `l1-${i}`)).toMatchObject({ isLockedChild: true, isDeployingRoot: false });
-    }
-    for (let i = 0; i < 42; i++) {
-      expect(s(map, `l2-${i}`)).toMatchObject({ isLockedChild: true, isDeployingRoot: false });
-    }
-  });
-});
@@ -1,6 +1,6 @@
 "use client";

-import { useCallback, useEffect, useMemo, useRef } from "react";
+import { useCallback, useEffect, useRef } from "react";
 import { useReactFlow } from "@xyflow/react";
 import { useCanvasStore } from "@/store/canvas";
 import { appendClass, removeClass } from "@/store/classNames";
@@ -153,17 +153,10 @@ export function useCanvasViewport() {
  // fit, the user has to manually pan + zoom to find what they just
  // created. Only fires when TRANSITIONING from some-provisioning to
  // zero-provisioning — not on every re-render.
-  //
-  // Selecting `nodes` stably (array reference) avoids the
-  // `.filter().length` anti-pattern which creates a new number on every
-  // store update and breaks the wasProvisioning/hasProvisioning
-  // transition detection (React error #185 / Zustand + React 19).
-  const nodes = useCanvasStore((s) => s.nodes);
-  const provisioningCount = useMemo(
-    () => nodes.filter((n) => n.data.status === "provisioning").length,
-    [nodes],
+  const provisioningCount = useCanvasStore(
+    (s) => s.nodes.filter((n) => n.data.status === "provisioning").length,
  );
-  const nodeCount = nodes.length;
+  const nodeCount = useCanvasStore((s) => s.nodes.length);

  useEffect(() => {
    const hasProvisioning = provisioningCount > 0;
@@ -5,7 +5,7 @@
 // that the desktop ChatTab uses, but with a slimmer surface: no
 // attachments, no A2A topology overlay, no conversation tracing.

-import { useEffect, useMemo, useRef, useState } from "react";
+import { useEffect, useRef, useState } from "react";

 import { api } from "@/lib/api";
 import { useCanvasStore } from "@/store/canvas";
@@ -36,20 +36,6 @@ interface A2AResponseShape {
  error?: { message?: string };
 }

-// Wire shape for GET /workspaces/:id/chat-history (chat_history.go → ChatHistoryResponse).
-interface ApiChatMessage {
-  id: string;
-  role: string; // "user" | "agent" | "system"
-  content: string;
-  timestamp: string;
-  attachments?: Array<{ name: string; uri: string; mimeType?: string; size?: number }>;
-}
-
-interface ChatHistoryResponse {
-  messages: ApiChatMessage[];
-  reached_end: boolean;
-}
-
 const formatTime = (date: Date) =>
  date.toLocaleTimeString([], { hour: "numeric", minute: "2-digit" });

@@ -63,10 +49,7 @@ export function MobileChat({
  onBack: () => void;
 }) {
  const p = usePalette(dark);
-  // Selecting `nodes` stably avoids the `.find()` anti-pattern that
-  // creates a new return value on every store update (React error #185).
-  const nodes = useCanvasStore((s) => s.nodes);
-  const node = useMemo(() => nodes.find((n) => n.id === agentId), [nodes, agentId]);
+  const node = useCanvasStore((s) => s.nodes.find((n) => n.id === agentId));
  // Bootstrap from the canvas store's per-workspace message buffer so the
  // user sees their prior thread on entry. The store is updated by the
  // socket → ChatTab flows the desktop runs; on mobile we read from the
@@ -75,14 +58,18 @@ export function MobileChat({
  // that creates a new [] reference on every store update when the key is
  // absent, causing infinite re-render (React error #185).
  const storedMessages = useCanvasStore((s) => s.agentMessages[agentId]);
-  // Start empty — history is loaded via useEffect below.
-  const [messages, setMessages] = useState<ChatMessage[]>([]);
+  const [messages, setMessages] = useState<ChatMessage[]>(() =>
+    (storedMessages ?? []).map((m) => ({
+      id: m.id,
+      role: "agent",
+      text: m.content,
+      ts: formatStoredTimestamp(m.timestamp),
+    })),
+  );
  const [draft, setDraft] = useState("");
  const [tab, setTab] = useState<SubTab>("my");
  const [sending, setSending] = useState(false);
  const [error, setError] = useState<string | null>(null);
-  const [loading, setLoading] = useState(true); // history is loading on mount
-  const [historyError, setHistoryError] = useState<string | null>(null);
  const scrollRef = useRef<HTMLDivElement>(null);
  // Synchronous re-entry guard. `setSending(true)` schedules a state
  // update but doesn't flush before a second tap can fire send() — a ref
@@ -90,9 +77,6 @@ export function MobileChat({
  // double-send race a stale `sending` lets through.
  const sendInFlightRef = useRef(false);
  const composerRef = useRef<HTMLTextAreaElement>(null);
-  // Guard: don't treat the initial store population as a live push.
-  // Set to false after the first render completes.
-  const initDoneRef = useRef(false);

  // Auto-grow the textarea: reset height to 'auto' so the scrollHeight
  // shrinks when the user deletes text, then size to scrollHeight up to
@@ -105,75 +89,6 @@ export function MobileChat({
    el.style.height = `${next}px`;
  }, [draft]);

-  // Fetch chat history on mount; keep merging live agentMessages while the
-  // panel is open. InitDoneRef prevents the initial store snapshot from
-  // triggering the live-merge path (the store buffer is populated by
-  // ChatTab on desktop, not on mobile — this effect loads history as the
-  // mobile-native path).
-  useEffect(() => {
-    let cancelled = false;
-
-    const mapApiMessage = (m: ApiChatMessage): ChatMessage => ({
-      id: m.id,
-      role: m.role === "user" ? "user" : "agent",
-      text: m.content,
-      ts: formatStoredTimestamp(m.timestamp),
-    });
-
-    const syncLive = () => {
-      const live = useCanvasStore.getState().agentMessages[agentId] ?? [];
-      if (live.length > 0) {
-        setMessages((prev) => {
-          const existingIds = new Set(prev.map((m) => m.id));
-          const newOnes = live
-            .filter((m) => !existingIds.has(m.id))
-            .map((m) => ({
-              id: m.id,
-              role: "agent" as const,
-              text: m.content,
-              ts: formatStoredTimestamp(m.timestamp),
-            }));
-          return newOnes.length > 0 ? [...prev, ...newOnes] : prev;
-        });
-      }
-    };
-
-    const bootstrap = async (): Promise<(() => void) | undefined> => {
-      setLoading(true);
-      setHistoryError(null);
-      try {
-        const res = await api.get<ChatHistoryResponse>(
-          `/workspaces/${agentId}/chat-history?limit=50`,
-        );
-        if (cancelled) return;
-        const initial = (res.messages ?? []).map(mapApiMessage);
-        setMessages(initial);
-        // Mark init done BEFORE marking loading=false so any store push
-        // that arrives in the same tick is treated as live, not init.
-        initDoneRef.current = true;
-        setLoading(false);
-        // Subscribe to live pushes after init is complete.
-        syncLive();
-        const unsubscribe = useCanvasStore.subscribe(syncLive);
-        return unsubscribe; // returned for cleanup
-      } catch (e) {
-        if (cancelled) return;
-        setHistoryError(e instanceof Error ? e.message : "Failed to load chat history");
-        setLoading(false);
-        initDoneRef.current = true;
-        return undefined;
-      }
-    };
-
-    let maybeUnsubscribe: (() => void) | undefined;
-    bootstrap().then((fn) => { maybeUnsubscribe = fn; });
-
-    return () => {
-      cancelled = true;
-      if (maybeUnsubscribe) maybeUnsubscribe();
-    };
-  }, [agentId]);
-
  useEffect(() => {
    if (scrollRef.current) {
      scrollRef.current.scrollTop = scrollRef.current.scrollHeight;
@@ -393,61 +308,7 @@ export function MobileChat({
            Agent Comms — peer-to-peer A2A traffic surfaces in the Comms tab.
          </div>
        )}
-        {tab === "my" && loading && (
-          <div style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
-            <div style={{ marginBottom: 6, opacity: 0.6, animation: "spin 1s linear infinite", display: "inline-block", fontSize: 16 }}>⟳</div>
-            <div>Loading chat history…</div>
-          </div>
-        )}
-        {tab === "my" && !loading && historyError && (
-          <div
-            role="alert"
-            style={{
-              padding: "14px 4px",
-              textAlign: "center",
-              color: p.failed,
-              fontSize: 13,
-            }}
-          >
-            <div style={{ marginBottom: 8 }}>Could not load chat history.</div>
-            <button
-              type="button"
-              onClick={() => {
-                setLoading(true);
-                setHistoryError(null);
-                api.get(`/workspaces/${agentId}/chat-history?limit=50`).then(
-                  (res: unknown) => {
-                    const r = res as ChatHistoryResponse;
-                    setMessages((r.messages ?? []).map((m) => ({
-                      id: m.id,
-                      role: m.role === "user" ? "user" : "agent",
-                      text: m.content,
-                      ts: formatStoredTimestamp(m.timestamp),
-                    })));
-                    setLoading(false);
-                    initDoneRef.current = true;
-                  },
-                ).catch((e: unknown) => {
-                  setHistoryError(e instanceof Error ? e.message : "Failed to load");
-                  setLoading(false);
-                  initDoneRef.current = true;
-                });
-              }}
-              style={{
-                padding: "6px 14px",
-                borderRadius: 14,
-                border: `0.5px solid ${p.failed}`,
-                background: "transparent",
-                color: p.failed,
-                fontSize: 12,
-                cursor: "pointer",
-              }}
-            >
-              Retry
-            </button>
-          </div>
-        )}
-        {tab === "my" && !loading && !historyError && messages.length === 0 && (
+        {tab === "my" && messages.length === 0 && (
          <div style={{ padding: "20px 4px", textAlign: "center", color: p.text3, fontSize: 13 }}>
            Send a message to start chatting.
          </div>
@@ -2,7 +2,7 @@

 // 03 · Agent detail — pills + tabbed content (Overview/Activity/Config/Memory).

-import { useEffect, useMemo, useState } from "react";
+import { useEffect, useState } from "react";

 import { api } from "@/lib/api";
 import { useCanvasStore } from "@/store/canvas";
@@ -32,10 +32,7 @@ export function MobileDetail({
  onChat: () => void;
 }) {
  const p = usePalette(dark);
-  // Selecting `nodes` stably avoids the `.find()` anti-pattern that
-  // creates a new return value on every store update (React error #185).
-  const nodes = useCanvasStore((s) => s.nodes);
-  const node = useMemo(() => nodes.find((n) => n.id === agentId), [nodes, agentId]);
+  const node = useCanvasStore((s) => s.nodes.find((n) => n.id === agentId));
  const [tab, setTab] = useState<TabId>("overview");

  if (!node) {
@@ -8,19 +8,11 @@
 * NOTE: No @testing-library/jest-dom — use DOM APIs.
 */
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { act, cleanup, render, waitFor } from "@testing-library/react";
+import { cleanup, render } from "@testing-library/react";
 import React from "react";

 import { MobileChat } from "../MobileChat";

-// ─── Mock API ─────────────────────────────────────────────────────────────────
-// vi.mock without a factory auto-mocks the module. In tests, we configure
-// api.get / api.post directly (they are vi.fn() from the auto-mock).
-// Tests that need specific behaviour use mockResolvedValueOnce on the
-// auto-mocked functions.
-vi.mock("@/lib/api");
-import { api } from "@/lib/api";
-
 // ─── Mock store ───────────────────────────────────────────────────────────────

 const mockAgentId = "ws-chat-test";
@@ -40,14 +32,8 @@ const mockStoreState = {

 vi.mock("@/store/canvas", () => ({
  useCanvasStore: Object.assign(
-    vi.fn((sel?: (state: typeof mockStoreState) => unknown) => {
-      if (sel) return sel(mockStoreState);
-      return mockStoreState;
-    }),
-    {
-      getState: () => mockStoreState,
-      subscribe: vi.fn(() => vi.fn()),
-    },
+    vi.fn((sel) => sel(mockStoreState)),
+    { getState: () => mockStoreState },
  ),
  summarizeWorkspaceCapabilities: vi.fn((data: Record<string, unknown>) => {
    const agentCard = data.agentCard as Record<string, unknown> | null;
@@ -68,6 +54,16 @@ vi.mock("@/store/canvas", () => ({
  }),
 }));

+// ─── Mock API ─────────────────────────────────────────────────────────────────
+
+const { mockApiPost } = vi.hoisted(() => ({
+  mockApiPost: vi.fn().mockResolvedValue({ result: { parts: [] } }),
+}));
+
+vi.mock("@/lib/api", () => ({
+  api: { post: mockApiPost },
+}));
+
 // ─── Fixtures ────────────────────────────────────────────────────────────────

 const onlineNode = {
@@ -154,15 +150,7 @@ beforeEach(() => {
  mockOnBack.mockClear();
  mockStoreState.nodes = [];
  mockStoreState.agentMessages = {};
-  // Set up spies on the real api methods. Tests override these per-call.
-  const getSpy = vi.spyOn(api, "get");
-  const postSpy = vi.spyOn(api, "post");
-  getSpy.mockResolvedValue({ messages: [], reached_end: true });
-  postSpy.mockResolvedValue({ result: { parts: [] } });
-});
-
-afterEach(() => {
-  vi.restoreAllMocks();
+  mockApiPost.mockClear();
 });

 afterEach(() => {
@@ -278,26 +266,15 @@ describe("MobileChat — empty state", () => {
    mockStoreState.nodes = [onlineNode];
  });

-  it('shows "Send a message to start chatting." when no messages', async () => {
-    // History fetch resolves immediately in tests (mockResolvedValue).
-    // act() flushes the microtask queue so the component reaches its
-    // post-load state before we assert.
-    let renderResult: ReturnType<typeof renderChat>;
-    await act(async () => {
-      renderResult = renderChat(mockAgentId);
-    });
-    const { container } = renderResult!;
+  it('shows "Send a message to start chatting." when no messages', () => {
+    const { container } = renderChat(mockAgentId);
    expect(container.textContent ?? "").toContain("Send a message to start chatting.");
  });

-  it("shows no messages when agentMessages[agentId] is absent (undefined)", async () => {
+  it("shows no messages when agentMessages[agentId] is absent (undefined)", () => {
    // Explicitly set to empty to simulate no stored messages
    mockStoreState.agentMessages = {};
-    let renderResult: ReturnType<typeof renderChat>;
-    await act(async () => {
-      renderResult = renderChat(mockAgentId);
-    });
-    const { container } = renderResult!;
+    const { container } = renderChat(mockAgentId);
    expect(container.textContent ?? "").toContain("Send a message to start chatting.");
  });
 });
@@ -344,132 +321,3 @@ describe("MobileChat — dark mode", () => {
    expect(container.querySelector('[aria-label="Back"]')).toBeTruthy();
  });
 });
-
-// ─── Chat history loading ────────────────────────────────────────────────────
-
-describe("MobileChat — chat history", () => {
-  beforeEach(() => {
-    mockStoreState.nodes = [onlineNode];
-  });
-
-  it("calls GET /workspaces/:id/chat-history on mount", async () => {
-    await act(async () => {
-      renderChat(mockAgentId);
-    });
-    expect(api.get).toHaveBeenCalledWith(
-      `/workspaces/${mockAgentId}/chat-history?limit=50`,
-    );
-  });
-
-  it("shows loading state while history is fetching", () => {
-    // Do NOT await — check the pre-resolve state.
-    const { container } = renderChat(mockAgentId);
-    expect(container.textContent ?? "").toContain("Loading chat history…");
-  });
-
-  it("shows empty state after history resolves with no messages", async () => {
-    // beforeEach already sets api.get to resolve with empty — no override needed.
-    let renderResult: ReturnType<typeof renderChat>;
-    await act(async () => {
-      renderResult = renderChat(mockAgentId);
-    });
-    const { container } = renderResult!;
-    expect(container.textContent ?? "").toContain("Send a message to start chatting.");
-  });
-
-  it("renders messages from history response", async () => {
-    vi.spyOn(api, "get").mockResolvedValueOnce({
-      messages: [
-        {
-          id: "msg-1",
-          role: "user",
-          content: "Hello agent",
-          timestamp: "2026-04-25T10:00:00Z",
-        },
-        {
-          id: "msg-2",
-          role: "agent",
-          content: "Hello back",
-          timestamp: "2026-04-25T10:00:01Z",
-        },
-      ],
-      reached_end: true,
-    });
-    let renderResult: ReturnType<typeof renderChat>;
-    await act(async () => {
-      renderResult = renderChat(mockAgentId);
-    });
-    const { container } = renderResult!;
-    expect(container.textContent ?? "").toContain("Hello agent");
-    expect(container.textContent ?? "").toContain("Hello back");
-  });
-
-  it("maps user role from API correctly", async () => {
-    vi.spyOn(api, "get").mockResolvedValueOnce({
-      messages: [
-        {
-          id: "msg-u",
-          role: "user",
-          content: "user message",
-          timestamp: "2026-04-25T10:00:00Z",
-        },
-      ],
-      reached_end: true,
-    });
-    let renderResult: ReturnType<typeof renderChat>;
-    await act(async () => {
-      renderResult = renderChat(mockAgentId);
-    });
-    // User messages render right-aligned. The text content check is sufficient
-    // to confirm the message appeared.
-    const { container } = renderResult!;
-    expect(container.textContent ?? "").toContain("user message");
-  });
-
-  it("shows error state when history fetch fails", async () => {
-    vi.spyOn(api, "get").mockRejectedValue(new Error("Network error"));
-    let renderResult: ReturnType<typeof renderChat>;
-    await act(async () => {
-      renderResult = renderChat(mockAgentId);
-    });
-    const { container } = renderResult!;
-    expect(container.textContent ?? "").toContain("Could not load chat history.");
-    expect(container.textContent ?? "").toContain("Retry");
-  });
-
-  it("Retry button re-fetches history after error", async () => {
-    // Make the initial mount call fail so the Retry button appears, then
-    // make the retry call succeed so we can verify the full flow.
-    const getSpy = vi.spyOn(api, "get");
-    getSpy
-      .mockRejectedValueOnce(new Error("Network error"))
-      .mockResolvedValueOnce({ messages: [], reached_end: true });
-
-    let renderResult: ReturnType<typeof renderChat>;
-    await act(async () => {
-      renderResult = renderChat(mockAgentId);
-    });
-    const { container } = renderResult!;
-
-    // Error state should be shown with Retry button.
-    expect(container.textContent ?? "").toContain("Could not load chat history.");
-    expect(container.textContent ?? "").toContain("Retry");
-
-    // Click Retry — the button's onClick fires api.get again.
-    // The second mockResolvedValueOnce makes it succeed.
-    const retryBtn = Array.from(container.querySelectorAll("button")).find(
-      (b) => b.textContent?.trim() === "Retry",
-    );
-    expect(retryBtn).toBeTruthy();
-    await act(async () => {
-      retryBtn?.click();
-    });
-
-    // waitFor polls until the retry resolves and component re-renders.
-    await waitFor(() => {
-      expect(container.textContent ?? "").toContain("Send a message to start chatting.");
-    });
-    // Initial call + retry = 2.
-    expect(getSpy).toHaveBeenCalledTimes(2);
-  });
-});
@@ -243,7 +243,7 @@ export function BudgetSection({ workspaceId }: Props) {
          onClick={handleSave}
          disabled={saving}
          data-testid="budget-save-btn"
-          className="px-4 py-1.5 bg-accent-strong hover:bg-accent active:bg-accent-strong rounded-lg text-xs font-medium text-white disabled:opacity-50 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
+          className="px-4 py-1.5 bg-accent-strong hover:bg-accent active:bg-accent-strong rounded-lg text-xs font-medium text-white disabled:opacity-50 transition-colors"
        >
          {saving ? "Saving…" : "Save"}
        </button>
@@ -255,7 +255,7 @@ export function ChannelsTab({ workspaceId }: Props) {
        </h3>
        <button
          onClick={() => setShowForm(!showForm)}
-          className="text-[10px] px-2.5 py-1 rounded bg-accent-strong/20 text-accent hover:bg-accent-strong/30 transition focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
+          className="text-[10px] px-2.5 py-1 rounded bg-accent-strong/20 text-accent hover:bg-accent-strong/30 transition"
        >
          {showForm ? "Cancel" : "+ Connect"}
        </button>
@@ -308,7 +308,7 @@ export function ChannelsTab({ workspaceId }: Props) {
                            <button
                              onClick={handleDiscover}
                              disabled={discovering || !formValues["bot_token"]}
-                              className="text-[10px] px-2 py-0.5 rounded bg-accent-strong/20 text-accent hover:bg-accent-strong/30 transition disabled:opacity-40 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
+                              className="text-[10px] px-2 py-0.5 rounded bg-accent-strong/20 text-accent hover:bg-accent-strong/30 transition disabled:opacity-40"
                            >
                              {discovering ? "Detecting..." : "Detect Chats"}
                            </button>
@@ -962,32 +962,6 @@ function MyChatPanel({ workspaceId, data }: Props) {
          </div>
        </div>
      )}
-      {/* talk_to_user disabled banner — shown when the workspace has
-           talk_to_user_enabled=false. The agent cannot send canvas messages;
-           the user can re-enable the ability from here without opening settings. */}
-      {data.talkToUserEnabled === false && (
-        <div className="flex items-center gap-2 px-3 py-2 bg-surface-sunken border-b border-line/40 shrink-0">
-          <svg width="14" height="14" viewBox="0 0 16 16" fill="none" aria-hidden="true" className="shrink-0 text-ink-mid">
-            <path d="M8 1a7 7 0 1 0 0 14A7 7 0 0 0 8 1Zm0 10.5a.75.75 0 1 1 0-1.5.75.75 0 0 1 0 1.5ZM8 4a.75.75 0 0 1 .75.75v4a.75.75 0 0 1-1.5 0v-4A.75.75 0 0 1 8 4Z" fill="currentColor"/>
-          </svg>
-          <span className="text-[10px] text-ink-mid flex-1">
-            Agent is not enabled to chat with you.
-          </span>
-          <button
-            onClick={async () => {
-              try {
-                await api.patch(`/workspaces/${workspaceId}/abilities`, { talk_to_user_enabled: true });
-                useCanvasStore.getState().updateNodeData(workspaceId, { talkToUserEnabled: true });
-              } catch {
-                // ignore — user will see no change and can retry
-              }
-            }}
-            className="px-2 py-0.5 text-[10px] font-medium bg-accent/10 hover:bg-accent/20 text-accent rounded border border-accent/30 transition-colors shrink-0"
-          >
-            Enable
-          </button>
-        </div>
-      )}
      {/* Messages */}
      <div ref={containerRef} className="flex-1 overflow-y-auto p-3 space-y-3">
        {loading && (
@@ -194,7 +194,7 @@ export function ScheduleTab({ workspaceId }: Props) {
        </span>
        <button
          onClick={() => { resetForm(); setShowForm(true); }}
-          className="text-[11px] px-2 py-0.5 bg-accent-strong/20 text-accent rounded hover:bg-accent-strong/30 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
+          className="text-[11px] px-2 py-0.5 bg-accent-strong/20 text-accent rounded hover:bg-accent-strong/30 transition-colors"
        >
          + Add Schedule
        </button>
@@ -339,7 +339,7 @@ export function ScheduleTab({ workspaceId }: Props) {
                          ? "Last run OK — click to disable"
                          : "Never run — click to enable"
                      }
-                      className={`w-2 h-2 rounded-full flex-shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900 ${
+                      className={`w-2 h-2 rounded-full flex-shrink-0 ${
                        sched.last_status === "error"
                          ? "bg-red-400"
                          : sched.last_status === "ok"
@@ -376,7 +376,7 @@ export function ScheduleTab({ workspaceId }: Props) {
                  <button
                    onClick={() => handleRunNow(sched)}
                    aria-label={`Run schedule ${sched.name} now`}
-                    className="text-[11px] px-1.5 py-0.5 text-accent hover:bg-accent-strong/20 rounded transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
+                    className="text-[11px] px-1.5 py-0.5 text-accent hover:bg-accent-strong/20 rounded transition-colors"
                    title="Run now"
                  >
                    ▶
@@ -384,7 +384,7 @@ export function ScheduleTab({ workspaceId }: Props) {
                  <button
                    onClick={() => handleEdit(sched)}
                    aria-label={`Edit schedule ${sched.name}`}
-                    className="text-[11px] px-1.5 py-0.5 text-ink-mid hover:bg-surface-card rounded transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
+                    className="text-[11px] px-1.5 py-0.5 text-ink-mid hover:bg-surface-card rounded transition-colors"
                    title="Edit"
                  >
                    ✎
@@ -392,7 +392,7 @@ export function ScheduleTab({ workspaceId }: Props) {
                  <button
                    onClick={() => setPendingDelete({ id: sched.id, name: sched.name })}
                    aria-label={`Delete schedule ${sched.name}`}
-                    className="text-[11px] px-1.5 py-0.5 text-bad hover:bg-red-600/20 rounded transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-red-400 focus-visible:ring-offset-1 focus-visible:ring-offset-zinc-900"
+                    className="text-[11px] px-1.5 py-0.5 text-bad hover:bg-red-600/20 rounded transition-colors"
                    title="Delete"
                  >
                    ✕
@@ -1,205 +0,0 @@
-// @vitest-environment jsdom
-"use client";
-/**
- * Tests for palette-context.tsx — MobileAccentProvider context + usePalette hook.
- *
- * Test coverage (9 cases):
- * 1. MobileAccentProvider renders children
- * 2. usePalette(false) without provider → MOL_LIGHT
- * 3. usePalette(true) without provider → MOL_DARK
- * 4. accent=null returns base palette unchanged
- * 5. accent=base.accent returns base palette unchanged (identity guard)
- * 6. accent="#custom" overrides both accent and online
- * 7. MOL_LIGHT singleton never mutated
- * 8. MOL_DARK singleton never mutated
- *
- * Plus pure-function coverage for normalizeStatus + tierCode.
- */
-import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
-import React from "react";
-import { render, screen, cleanup } from "@testing-library/react";
-import {
-  MOL_LIGHT,
-  MOL_DARK,
-  getPalette,
-  normalizeStatus,
-  tierCode,
-  MobileAccentProvider,
-  usePalette,
-} from "../palette-context";
-
-// ─── usePalette test helper ───────────────────────────────────────────────────
-// usePalette reads document.documentElement.dataset.theme internally.
-// We set this before rendering so the hook sees the right value.
-
-function setDataTheme(theme: "light" | "dark") {
-  if (typeof document !== "undefined") {
-    document.documentElement.dataset.theme = theme;
-  }
-}
-
-// ─── Pure function tests ──────────────────────────────────────────────────────
-
-describe("normalizeStatus", () => {
-  it("returns emerald-400 for online status", () => {
-    expect(normalizeStatus("online", false)).toBe("bg-emerald-400");
-    expect(normalizeStatus("online", true)).toBe("bg-emerald-400");
-  });
-
-  it("returns emerald-400 for degraded status", () => {
-    expect(normalizeStatus("degraded", false)).toBe("bg-emerald-400");
-    expect(normalizeStatus("degraded", true)).toBe("bg-emerald-400");
-  });
-
-  it("returns red-400 for failed status", () => {
-    expect(normalizeStatus("failed", false)).toBe("bg-red-400");
-    expect(normalizeStatus("failed", true)).toBe("bg-red-400");
-  });
-
-  it("returns amber-400 for paused status", () => {
-    expect(normalizeStatus("paused", false)).toBe("bg-amber-400");
-    expect(normalizeStatus("paused", true)).toBe("bg-amber-400");
-  });
-
-  it("returns amber-400 for not_configured status", () => {
-    expect(normalizeStatus("not_configured", false)).toBe("bg-amber-400");
-  });
-
-  it("returns zinc-400 for unknown status", () => {
-    expect(normalizeStatus("unknown", false)).toBe("bg-zinc-400");
-    expect(normalizeStatus("", false)).toBe("bg-zinc-400");
-  });
-});
-
-describe("tierCode", () => {
-  it("returns T1 for tier 1", () => {
-    expect(tierCode(1)).toBe("T1");
-  });
-
-  it("returns T2 for tier 2", () => {
-    expect(tierCode(2)).toBe("T2");
-  });
-
-  it("returns T4 for tier 4", () => {
-    expect(tierCode(4)).toBe("T4");
-  });
-
-  it("returns generic T{n} for non-standard tiers", () => {
-    expect(tierCode(99)).toBe("T99");
-  });
-});
-
-// ─── getPalette tests ─────────────────────────────────────────────────────────
-
-describe("getPalette — accent override", () => {
-  it("accent=null returns base palette unchanged (light)", () => {
-    const result = getPalette(null, false);
-    expect(result).toEqual({ ...MOL_LIGHT });
-    expect(result).not.toBe(MOL_LIGHT); // returned object is a copy
-  });
-
-  it("accent=null returns base palette unchanged (dark)", () => {
-    const result = getPalette(null, true);
-    expect(result).toEqual({ ...MOL_DARK });
-    expect(result).not.toBe(MOL_DARK);
-  });
-
-  it("accent=base.accent returns base palette unchanged (identity guard, light)", () => {
-    const result = getPalette(MOL_LIGHT.accent, false);
-    expect(result).toEqual({ ...MOL_LIGHT });
-    expect(result).not.toBe(MOL_LIGHT);
-  });
-
-  it("accent=base.accent returns base palette unchanged (identity guard, dark)", () => {
-    const result = getPalette(MOL_DARK.accent, true);
-    expect(result).toEqual({ ...MOL_DARK });
-    expect(result).not.toBe(MOL_DARK);
-  });
-
-  it("accent='#custom' overrides accent and online (light)", () => {
-    const result = getPalette("#ff0000", false);
-    expect(result.accent).toBe("#ff0000");
-    expect(result.online).toBe("bg-emerald-400"); // normalizeStatus("online", false)
-  });
-
-  it("accent='#custom' overrides accent and online (dark)", () => {
-    const result = getPalette("#00ff00", true);
-    expect(result.accent).toBe("#00ff00");
-    expect(result.online).toBe("bg-emerald-400"); // normalizeStatus("online", true)
-  });
-
-  it("MOL_LIGHT singleton is never mutated", () => {
-    getPalette("#mutate", false);
-    // All fields must still match the original freeze definition
-    expect(MOL_LIGHT.accent).toBe("bg-blue-500");
-    expect(MOL_LIGHT.online).toBe("bg-emerald-400");
-    expect(MOL_LIGHT.surface).toBe("bg-zinc-900");
-    expect(MOL_LIGHT.ink).toBe("text-zinc-100");
-    expect(MOL_LIGHT.line).toBe("border-zinc-700");
-    expect(MOL_LIGHT.bg).toBe("bg-zinc-950");
-  });
-
-  it("MOL_DARK singleton is never mutated", () => {
-    getPalette("#mutate", true);
-    expect(MOL_DARK.accent).toBe("bg-sky-400");
-    expect(MOL_DARK.online).toBe("bg-emerald-400");
-    expect(MOL_DARK.surface).toBe("bg-zinc-800");
-    expect(MOL_DARK.ink).toBe("text-zinc-100");
-    expect(MOL_DARK.line).toBe("border-zinc-700");
-    expect(MOL_DARK.bg).toBe("bg-zinc-950");
-  });
-
-  it("getPalette always returns a new object (no shared mutation risk)", () => {
-    const a = getPalette("#a", false);
-    const b = getPalette("#b", false);
-    expect(a).not.toBe(b);
-    expect(a.accent).not.toBe(b.accent);
-  });
-});
-
-// ─── MobileAccentProvider tests ───────────────────────────────────────────────
-
-describe("MobileAccentProvider", () => {
-  beforeEach(() => {
-    setDataTheme("light");
-  });
-
-  afterEach(() => {
-    cleanup();
-    if (typeof document !== "undefined") {
-      document.documentElement.dataset.theme = "";
-    }
-  });
-
-  it("renders children", () => {
-    render(
-      <MobileAccentProvider accent={null}>
-        <span data-testid="child">Hello</span>
-      </MobileAccentProvider>,
-    );
-    expect(screen.getByTestId("child")).toBeTruthy();
-  });
-
-  // usePalette hook reads data-theme from <html> to determine light/dark.
-  // In the test environment, data-theme is empty, which falls through to
-  // the "light" default in usePalette, giving MOL_LIGHT.
-  it("usePalette(false) without provider → MOL_LIGHT", () => {
-    setDataTheme("light");
-    function ShowPalette() {
-      const p = usePalette(false);
-      return <span data-testid="accent-light">{p.accent}</span>;
-    }
-    render(<ShowPalette />);
-    expect(screen.getByTestId("accent-light").textContent).toBe(MOL_LIGHT.accent);
-  });
-
-  it("usePalette(true) without provider → MOL_DARK when data-theme=dark", () => {
-    setDataTheme("dark");
-    function ShowPalette() {
-      const p = usePalette(true);
-      return <span data-testid="accent-dark">{p.accent}</span>;
-    }
-    render(<ShowPalette />);
-    expect(screen.getByTestId("accent-dark").textContent).toBe(MOL_DARK.accent);
-  });
-});
@@ -1,167 +0,0 @@
-"use client";
-
-/**
- * palette-context.tsx
- *
- * Mobile canvas accent palette system.
- *
- * - MOL_LIGHT / MOL_DARK  — immutable base singletons
- * - getPalette(accent, isDark) — returns base palette or accent-overridden copy
- * - normalizeStatus(status, isDark) — maps workspace status → online dot color
- * - tierCode(tier) — maps tier number → display label
- * - MobileAccentProvider — React context that propagates accent override
- * - usePalette(allowAccentOverride) — hook; returns the effective palette
- */
-
-import { createContext, useContext } from "react";
-
-// ─── Types ─────────────────────────────────────────────────────────────────────
-
-export interface Palette {
-  /** Accent colour (CSS colour string). */
-  accent: string;
-  /** Online indicator colour (CSS class string, e.g. "bg-emerald-400"). */
-  online: string;
-  /** Surface background colour class. */
-  surface: string;
-  /** Primary text colour class. */
-  ink: string;
-  /** Border/divider colour class. */
-  line: string;
-  /** Background colour class. */
-  bg: string;
-  /** Tier display code, e.g. "T1". */
-  tier: string;
-}
-
-// ─── Singleton base palettes ────────────────────────────────────────────────────
-
-/** Light-mode base palette — must never be mutated. */
-export const MOL_LIGHT: Readonly<Palette> = Object.freeze({
-  accent: "bg-blue-500",
-  online: "bg-emerald-400",
-  surface: "bg-zinc-900",
-  ink: "text-zinc-100",
-  line: "border-zinc-700",
-  bg: "bg-zinc-950",
-  tier: "T1",
-});
-
-/** Dark-mode base palette — must never be mutated. */
-export const MOL_DARK: Readonly<Palette> = Object.freeze({
-  accent: "bg-sky-400",
-  online: "bg-emerald-400",
-  surface: "bg-zinc-800",
-  ink: "text-zinc-100",
-  line: "border-zinc-700",
-  bg: "bg-zinc-950",
-  tier: "T1",
-});
-
-// ─── Pure helpers ─────────────────────────────────────────────────────────────
-
-/**
- * Maps workspace status string → online dot colour class.
- * Returns the appropriate green for light/dark mode.
- */
-export function normalizeStatus(
-  status: string,
-  _isDark: boolean,
-): string {
-  if (status === "online" || status === "degraded") {
-    return "bg-emerald-400";
-  }
-  if (status === "failed") {
-    return "bg-red-400";
-  }
-  if (status === "paused" || status === "not_configured") {
-    return "bg-amber-400";
-  }
-  return "bg-zinc-400";
-}
-
-/**
- * Maps tier number → display code.
- */
-export function tierCode(tier: number): string {
-  return `T${tier}`;
-}
-
-/**
- * Returns the effective palette.
- *
- * - `accent = null` → base palette (light or dark) unchanged
- * - `accent = basePalette.accent` → base palette unchanged (identity guard)
- * - `accent = "#custom"` → copy with `accent` and `online` overridden
- *
- * Always returns a new object; neither MOL_LIGHT nor MOL_DARK is ever mutated.
- */
-export function getPalette(
-  accent: string | null,
-  isDark: boolean,
-): Palette {
-  const base: Readonly<Palette> = isDark ? MOL_DARK : MOL_LIGHT;
-
-  // null accent → use base unchanged
-  if (accent === null) return { ...base };
-
-  // identity guard — accent same as base accent → no override needed
-  if (accent === base.accent) return { ...base };
-
-  // Custom accent: override accent + online to keep them in sync
-  return { ...base, accent, online: normalizeStatus("online", isDark) };
-}
-
-// ─── Context ──────────────────────────────────────────────────────────────────
-
-type MobileAccentContextValue = {
-  /** Override accent colour (null = no override, use default). */
-  accent: string | null;
-};
-
-const MobileAccentContext = createContext<MobileAccentContextValue>({
-  accent: null,
-});
-
-export { MobileAccentContext };
-
-/**
- * Renders children inside the accent override context.
- */
-export function MobileAccentProvider({
-  accent,
-  children,
-}: {
-  accent: string | null;
-  children: React.ReactNode;
-}) {
-  return (
-    <MobileAccentContext.Provider value={{ accent }}>
-      {children}
-    </MobileAccentContext.Provider>
-  );
-}
-
-// ─── Hook ─────────────────────────────────────────────────────────────────────
-
-/**
- * Returns the effective `Palette` for the current context.
- *
- * @param allowAccentOverride  When false, always returns the base palette
- *                              even when an override is set (useful for
- *                              non-accent-aware child components).
- */
-export function usePalette(allowAccentOverride: boolean): Palette {
-  const { accent } = useContext(MobileAccentContext);
-
-  // Resolved from the OS-level theme preference. In a real app this would
-  // be derived from useTheme().resolvedTheme; for this hook we default
-  // to light (the safe default for SSR / component-library use).
-  // We read data-theme from <html> to stay in sync with the theme system.
-  const isDark =
-    typeof document !== "undefined" &&
-    document.documentElement.dataset.theme === "dark";
-
-  const effectiveAccent = allowAccentOverride ? accent : null;
-  return getPalette(effectiveAccent, isDark);
-}
@@ -519,10 +519,6 @@ export function buildNodesAndEdges(
        // #2054 — server-declared per-workspace provisioning timeout.
        // Falls through to the runtime profile when null/absent.
        provisionTimeoutMs: ws.provision_timeout_ms ?? null,
-        // Workspace abilities — defaults preserved for old platform versions
-        // that don't yet include these columns in the GET response.
-        broadcastEnabled: ws.broadcast_enabled ?? false,
-        talkToUserEnabled: ws.talk_to_user_enabled ?? true,
      },
    };
    if (hasParent) {
@@ -99,13 +99,6 @@ export interface WorkspaceNodeData extends Record<string, unknown> {
   *  @/lib/runtimeProfiles. Lets a slow runtime declare its cold-boot
   *  expectation without a canvas release. */
  provisionTimeoutMs?: number | null;
-  /** When true the workspace may POST /broadcast to send org-wide messages.
-   *  Default false. Toggled by user/admin via PATCH /workspaces/:id/abilities. */
-  broadcastEnabled?: boolean;
-  /** When false the workspace cannot deliver canvas chat messages.
-   *  send_message_to_user / POST /notify return 403 and the canvas
-   *  shows a "not enabled" state with a button to re-enable. Default true. */
-  talkToUserEnabled?: boolean;
 }

 export type PanelTab = "details" | "skills" | "chat" | "terminal" | "config" | "schedule" | "channels" | "files" | "memory" | "traces" | "events" | "activity" | "audit";
@@ -299,9 +299,6 @@ export interface WorkspaceData {
   *  `@/lib/runtimeProfiles` when absent (the default behavior for any
   *  template that hasn't yet declared the field). */
  provision_timeout_ms?: number | null;
-  /** Workspace ability flags (migration 20260514). */
-  broadcast_enabled?: boolean;
-  talk_to_user_enabled?: boolean;
 }

 let socket: ReconnectingSocket | null = null;
@@ -1,296 +0,0 @@
-#!/usr/bin/env bash
-# E2E test: workspace broadcast and talk-to-user platform abilities.
-#
-# What this proves:
-#   1. talk_to_user_enabled (default true) — POST /notify works out-of-the-box.
-#   2. PATCH /workspaces/:id/abilities { talk_to_user_enabled: false } disables
-#      delivery: /notify → 403 with error="talk_to_user_disabled" + delegate hint.
-#   3. Re-enabling talk_to_user_enabled restores delivery.
-#   4. broadcast_enabled (default false) — POST /broadcast → 403 when disabled.
-#   5. PATCH { broadcast_enabled: true } enables fan-out.
-#   6. POST /broadcast delivers to all non-sender, non-removed workspaces:
-#      - Returns {"status":"sent","delivered":N}
-#      - Receiver's activity log has a broadcast_receive entry with the message.
-#      - Sender's activity log has a broadcast_sent entry.
-#   7. The sender itself does NOT receive a broadcast_receive entry.
-#
-# Usage:  tests/e2e/test_workspace_abilities_e2e.sh
-# Prereqs: workspace-server on http://localhost:8080, MOLECULE_ENV != production
-
-set -euo pipefail
-
-source "$(dirname "$0")/_lib.sh"
-
-PASS=0
-FAIL=0
-SENDER_ID=""
-RECEIVER_ID=""
-
-cleanup() {
-  for wid in "$SENDER_ID" "$RECEIVER_ID"; do
-    if [ -n "$wid" ]; then
-      curl -s -X DELETE "$BASE/workspaces/$wid?confirm=true" > /dev/null || true
-    fi
-  done
-}
-trap cleanup EXIT INT TERM
-
-assert() {
-  local label="$1" actual="$2" expected="$3"
-  if [ "$actual" = "$expected" ]; then
-    echo "  PASS — $label"
-    PASS=$((PASS+1))
-  else
-    echo "  FAIL — $label"
-    echo "         expected: $expected"
-    echo "         actual:   $actual"
-    FAIL=$((FAIL+1))
-  fi
-}
-
-assert_contains() {
-  local label="$1" haystack="$2" needle="$3"
-  if echo "$haystack" | grep -qF "$needle"; then
-    echo "  PASS — $label"
-    PASS=$((PASS+1))
-  else
-    echo "  FAIL — $label"
-    echo "         needle:   $needle"
-    echo "         haystack: $haystack"
-    FAIL=$((FAIL+1))
-  fi
-}
-
-assert_not_contains() {
-  local label="$1" haystack="$2" needle="$3"
-  if ! echo "$haystack" | grep -qF "$needle"; then
-    echo "  PASS — $label"
-    PASS=$((PASS+1))
-  else
-    echo "  FAIL — $label (unexpected match)"
-    echo "         needle:   $needle"
-    echo "         haystack: $haystack"
-    FAIL=$((FAIL+1))
-  fi
-}
-
-# ── Pre-sweep: remove any stale leftover workspaces from a prior aborted run ──
-echo "=== Setup ==="
-for NAME in "Abilities Sender" "Abilities Receiver"; do
-  PRIOR=$(curl -s "$BASE/workspaces" | python3 -c "
-import json, sys
-try:
-    print(' '.join(w['id'] for w in json.load(sys.stdin) if w.get('name') == '$NAME'))
-except Exception:
-    pass
-")
-  for _wid in $PRIOR; do
-    echo "Sweeping leftover '$NAME' workspace: $_wid"
-    curl -s -X DELETE "$BASE/workspaces/$_wid?confirm=true" > /dev/null || true
-  done
-done
-
-R=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-  -d '{"name":"Abilities Sender","tier":1}')
-SENDER_ID=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])' 2>/dev/null || true)
-[ -n "$SENDER_ID" ] || { echo "Failed to create sender workspace: $R"; exit 1; }
-echo "Created sender   workspace: $SENDER_ID"
-
-R=$(curl -s -X POST "$BASE/workspaces" -H "Content-Type: application/json" \
-  -d '{"name":"Abilities Receiver","tier":1}')
-RECEIVER_ID=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])' 2>/dev/null || true)
-[ -n "$RECEIVER_ID" ] || { echo "Failed to create receiver workspace: $R"; exit 1; }
-echo "Created receiver workspace: $RECEIVER_ID"
-
-# Mint workspace-scoped bearer tokens (test-only endpoint, disabled in prod).
-SENDER_TOKEN=$(e2e_mint_test_token "$SENDER_ID")
-[ -n "$SENDER_TOKEN" ] || { echo "Failed to mint sender token"; exit 1; }
-SENDER_AUTH="Authorization: Bearer $SENDER_TOKEN"
-
-# Admin token — any live workspace bearer satisfies AdminAuth in local dev.
-# In production-like envs, set MOLECULE_ADMIN_TOKEN.
-ADMIN_TOKEN="${MOLECULE_ADMIN_TOKEN:-$SENDER_TOKEN}"
-ADMIN_AUTH="Authorization: Bearer $ADMIN_TOKEN"
-
-# ─────────────────────────────────────────────────────────────────────────────
-echo ""
-echo "=== Part 1: talk_to_user ability ==="
-
-echo ""
-echo "--- 1a: /notify works with default talk_to_user_enabled=true ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/notify" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Hello from sender"}')
-assert "POST /notify returns 200 when talk_to_user_enabled=true (default)" "$CODE" "200"
-
-echo ""
-echo "--- 1b: Disable talk_to_user ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"talk_to_user_enabled": false}')
-assert "PATCH /abilities talk_to_user_enabled=false returns 200" "$CODE" "200"
-
-# Verify the flag is reflected in the workspace GET response.
-WS=$(curl -s "$BASE/workspaces/$SENDER_ID" -H "$SENDER_AUTH")
-FLAG=$(echo "$WS" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("talk_to_user_enabled","MISSING"))')
-assert "GET /workspaces/:id reflects talk_to_user_enabled=false" "$FLAG" "False"
-
-echo ""
-echo "--- 1c: /notify blocked when talk_to_user disabled ---"
-BODY=$(curl -s -w "" -X POST "$BASE/workspaces/$SENDER_ID/notify" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Should be blocked"}')
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/notify" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Should be blocked"}')
-assert "POST /notify returns 403 when talk_to_user_enabled=false" "$CODE" "403"
-
-ERR=$(echo "$BODY" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("error",""))' 2>/dev/null || echo "")
-assert_contains "403 body contains talk_to_user_disabled error code" "$ERR" "talk_to_user_disabled"
-
-HINT=$(echo "$BODY" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("hint",""))' 2>/dev/null || echo "")
-assert_contains "403 body contains delegate_task hint" "$HINT" "delegate_task"
-
-echo ""
-echo "--- 1d: Re-enable talk_to_user and verify /notify works again ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"talk_to_user_enabled": true}')
-assert "PATCH /abilities talk_to_user_enabled=true returns 200" "$CODE" "200"
-
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/notify" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Re-enabled, should work"}')
-assert "POST /notify returns 200 after re-enabling talk_to_user" "$CODE" "200"
-
-# ─────────────────────────────────────────────────────────────────────────────
-echo ""
-echo "=== Part 2: broadcast ability ==="
-
-echo ""
-echo "--- 2a: Broadcast blocked by default (broadcast_enabled=false) ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/broadcast" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Should be blocked"}')
-assert "POST /broadcast returns 403 when broadcast_enabled=false (default)" "$CODE" "403"
-
-echo ""
-echo "--- 2b: Enable broadcast ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"broadcast_enabled": true}')
-assert "PATCH /abilities broadcast_enabled=true returns 200" "$CODE" "200"
-
-WS=$(curl -s "$BASE/workspaces/$SENDER_ID" -H "$SENDER_AUTH")
-FLAG=$(echo "$WS" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("broadcast_enabled","MISSING"))')
-assert "GET /workspaces/:id reflects broadcast_enabled=true" "$FLAG" "True"
-
-echo ""
-echo "--- 2c: Successful broadcast fan-out ---"
-BCAST=$(curl -s -X POST "$BASE/workspaces/$SENDER_ID/broadcast" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":"Org-wide notice: scheduled maintenance in 5 minutes."}')
-BSTATUS=$(echo "$BCAST" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("status",""))' 2>/dev/null || echo "")
-BDELIVERED=$(echo "$BCAST" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("delivered","-1"))' 2>/dev/null || echo "-1")
-assert "POST /broadcast returns status=sent" "$BSTATUS" "sent"
-
-# delivered count must be >= 1 (the receiver workspace).
-echo "  INFO — broadcast delivered=$BDELIVERED"
-if python3 -c "import sys; sys.exit(0 if int('$BDELIVERED') >= 1 else 1)" 2>/dev/null; then
-  echo "  PASS — delivered count >= 1"
-  PASS=$((PASS+1))
-else
-  echo "  FAIL — expected delivered >= 1, got $BDELIVERED"
-  FAIL=$((FAIL+1))
-fi
-
-echo ""
-echo "--- 2d: Receiver activity log has broadcast_receive entry ---"
-RECEIVER_TOKEN=$(e2e_mint_test_token "$RECEIVER_ID")
-[ -n "$RECEIVER_TOKEN" ] || { echo "Failed to mint receiver token"; exit 1; }
-RECEIVER_AUTH="Authorization: Bearer $RECEIVER_TOKEN"
-
-ACT=$(curl -s -H "$RECEIVER_AUTH" "$BASE/workspaces/$RECEIVER_ID/activity?source=agent&limit=20")
-ROW=$(echo "$ACT" | python3 -c '
-import json, sys
-rows = json.load(sys.stdin) or []
-for r in rows:
-    if r.get("activity_type") == "broadcast_receive":
-        print(json.dumps(r))
-        break
-')
-[ -n "$ROW" ] || {
-  echo "  FAIL — could not find broadcast_receive row in receiver activity"
-  FAIL=$((FAIL+1))
-}
-
-if [ -n "$ROW" ]; then
-  # Message is stored in summary field.
-  MSG=$(echo "$ROW" | python3 -c 'import json,sys;r=json.load(sys.stdin);print(r.get("summary",""))')
-  assert_contains "broadcast_receive row summary has original message" "$MSG" "scheduled maintenance"
-  # Sender ID is stored in source_id field.
-  SRC=$(echo "$ROW" | python3 -c 'import json,sys;r=json.load(sys.stdin);print(r.get("source_id",""))')
-  assert "broadcast_receive row source_id is sender workspace" "$SRC" "$SENDER_ID"
-fi
-
-echo ""
-echo "--- 2e: Sender activity log has broadcast_sent entry ---"
-ACT_SENDER=$(curl -s -H "$SENDER_AUTH" "$BASE/workspaces/$SENDER_ID/activity?limit=20")
-SENT_ROW=$(echo "$ACT_SENDER" | python3 -c '
-import json, sys
-rows = json.load(sys.stdin) or []
-for r in rows:
-    if r.get("activity_type") == "broadcast_sent":
-        print(json.dumps(r))
-        break
-')
-[ -n "$SENT_ROW" ] || {
-  echo "  FAIL — could not find broadcast_sent row in sender activity"
-  FAIL=$((FAIL+1))
-}
-
-if [ -n "$SENT_ROW" ]; then
-  # Delivered count is baked into the summary field (no response_body for sender row).
-  SUMMARY=$(echo "$SENT_ROW" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("summary",""))')
-  assert_contains "broadcast_sent summary mentions workspace count" "$SUMMARY" "workspace"
-fi
-
-echo ""
-echo "--- 2f: Sender does NOT receive a broadcast_receive entry ---"
-SELF_RECV=$(echo "$ACT_SENDER" | python3 -c '
-import json, sys
-rows = json.load(sys.stdin) or []
-for r in rows:
-    if r.get("activity_type") == "broadcast_receive":
-        print("found")
-        break
-')
-assert_not_contains "sender has no broadcast_receive in own activity log" "${SELF_RECV:-}" "found"
-
-# ─────────────────────────────────────────────────────────────────────────────
-echo ""
-echo "--- 2g: Empty message is rejected ---"
-CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/workspaces/$SENDER_ID/broadcast" \
-  -H "Content-Type: application/json" -H "$SENDER_AUTH" \
-  -d '{"message":""}')
-assert "POST /broadcast with empty message returns 400" "$CODE" "400"
-
-echo ""
-echo "--- 2h: Partial PATCH does not clobber other flags ---"
-# Set talk_to_user=false, then patch only broadcast — talk_to_user must stay false.
-curl -s -o /dev/null -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"talk_to_user_enabled": false}'
-curl -s -o /dev/null -X PATCH "$BASE/workspaces/$SENDER_ID/abilities" \
-  -H "Content-Type: application/json" -H "$ADMIN_AUTH" \
-  -d '{"broadcast_enabled": false}'
-WS=$(curl -s "$BASE/workspaces/$SENDER_ID" -H "$SENDER_AUTH")
-TUF=$(echo "$WS" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("talk_to_user_enabled","MISSING"))')
-BEF=$(echo "$WS" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("broadcast_enabled","MISSING"))')
-assert "partial PATCH preserves talk_to_user_enabled=false" "$TUF" "False"
-assert "partial PATCH sets broadcast_enabled=false" "$BEF" "False"
-
-# ─────────────────────────────────────────────────────────────────────────────
-echo ""
-echo "=== Results: $PASS passed, $FAIL failed ==="
-[ "$FAIL" -eq 0 ]
@@ -121,7 +121,7 @@ func main() {
 			case <-ctx.Done():
 				return
 			case <-ticker.C:
-				result, err := db.GetDB().ExecContext(ctx, `DELETE FROM activity_logs WHERE created_at < now() - ($1 || ' days')::interval`, retentionDays)
+				result, err := db.DB.ExecContext(ctx, `DELETE FROM activity_logs WHERE created_at < now() - ($1 || ' days')::interval`, retentionDays)
 				if err != nil {
 					log.Printf("Activity log cleanup error: %v", err)
 				} else if n, _ := result.RowsAffected(); n > 0 {
@@ -184,7 +184,7 @@ func main() {
 	// WorkspaceHandler) get the same plugin/resolver pair. memBundle
 	// is nil when MEMORY_PLUGIN_URL is unset — every consumer
 	// nil-checks before using.
-	memBundle := memwiring.Build(db.GetDB())
+	memBundle := memwiring.Build(db.DB)
 	if memBundle != nil {
 		wh.WithNamespaceCleanup(memBundle.NamespaceCleanupFn())
 	}
@@ -278,7 +278,7 @@ func main() {
 	// pending_uploads table grows unbounded; even with the 24h hard TTL,
 	// nothing actually deletes a row, just makes it un-fetchable.
 	go supervised.RunWithRecover(ctx, "pending-uploads-sweeper", func(c context.Context) {
-		pendinguploads.StartSweeper(c, pendinguploads.NewPostgres(db.GetDB()), 0)
+		pendinguploads.StartSweeper(c, pendinguploads.NewPostgres(db.DB), 0)
 	})

 	// Provision-timeout sweep — flips workspaces that have been stuck in
@@ -513,7 +513,7 @@ func fixAdminTokenPlaceholder() {
 	// Read the current stored value. We only upsert when the placeholder is
 	// present so we don't repeatedly write rows that are already correct.
 	var storedValue []byte
-	err := db.GetDB().QueryRow(`SELECT encrypted_value FROM global_secrets WHERE key = $1`, "ADMIN_TOKEN").Scan(&storedValue)
+	err := db.DB.QueryRow(`SELECT encrypted_value FROM global_secrets WHERE key = $1`, "ADMIN_TOKEN").Scan(&storedValue)
 	if err != nil {
 		// No row — nothing to fix. The control plane injects ADMIN_TOKEN via
 		// Secrets Manager bootstrap; the global_secrets path is a legacy seed.
@@ -545,7 +545,7 @@ func fixAdminTokenPlaceholder() {
 		return
 	}

-	_, err = db.GetDB().Exec(`
+	_, err = db.DB.Exec(`
 		INSERT INTO global_secrets (key, encrypted_value, encryption_version)
 		VALUES ($1, $2, $3)
 		ON CONFLICT (key) DO UPDATE
@@ -18,7 +18,6 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/redis/go-redis/v9 v9.19.0
 	github.com/robfig/cron/v3 v3.0.1
-	github.com/stretchr/testify v1.11.1
 	go.moleculesai.app/plugin/gh-identity v0.0.0-20260509010445-788988195fce
 	golang.org/x/crypto v0.50.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -34,7 +33,6 @@ require (
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -60,7 +58,6 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/quic-go/quic-go v0.59.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
@@ -28,7 +28,7 @@ func Export(ctx context.Context, workspaceID, configsDir string, dockerCli *clie
 	var agentCard []byte
 	var parentID *string

-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		SELECT name, COALESCE(role, ''), tier, status,
 		       COALESCE(agent_card, 'null'::jsonb), parent_id
 		FROM workspaces WHERE id = $1
@@ -79,7 +79,7 @@ func Export(ctx context.Context, workspaceID, configsDir string, dockerCli *clie
 	}

 	// Recursively export sub-workspaces
-	rows, err := db.GetDB().QueryContext(ctx,
+	rows, err := db.DB.QueryContext(ctx,
 		`SELECT id FROM workspaces WHERE parent_id = $1 AND status != 'removed'`, workspaceID)
 	if err == nil {
 		defer func() { _ = rows.Close() }()
@@ -1,261 +0,0 @@
-package bundle
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// ---------------------------------------------------------------------------
-// extractDescription
-// ---------------------------------------------------------------------------
-
-func TestExtractDescription_WithFrontmatter(t *testing.T) {
-	// YAML frontmatter is skipped; first non-comment, non-empty line after
-	// the closing `---` is the description.
-	content := `---
-title: My Workspace
---
-# This is a comment
-This is the description line.
-Another line.`
-	got := extractDescription(content)
-	if got != "This is the description line." {
-		t.Errorf("got %q, want %q", got, "This is the description line.")
-	}
-}
-
-func TestExtractDescription_NoFrontmatter(t *testing.T) {
-	// No frontmatter: first non-comment, non-empty line is returned.
-	content := `# Copyright header
-My workspace description
-Another line.`
-	got := extractDescription(content)
-	if got != "My workspace description" {
-		t.Errorf("got %q, want %q", got, "My workspace description")
-	}
-}
-
-func TestExtractDescription_CommentOnly(t *testing.T) {
-	// All content is comments or empty → empty string.
-	content := `# comment only
-# another comment
-`
-	got := extractDescription(content)
-	if got != "" {
-		t.Errorf("got %q, want empty string", got)
-	}
-}
-
-func TestExtractDescription_EmptyInput(t *testing.T) {
-	got := extractDescription("")
-	if got != "" {
-		t.Errorf("got %q, want empty string", got)
-	}
-}
-
-func TestExtractDescription_UnclosedFrontmatter(t *testing.T) {
-	// With no closing `---`, inFrontmatter stays true after the opening
-	// delimiter, so all subsequent lines are skipped and "" is returned.
-	// This is the documented behaviour: without a closing delimiter,
-	// all lines are considered frontmatter.
-	content := `---
-title: No closing delimiter
-This is the description.`
-	got := extractDescription(content)
-	if got != "" {
-		t.Errorf("unclosed frontmatter: got %q, want empty string", got)
-	}
-}
-
-func TestExtractDescription_FrontmatterThenCommentThenContent(t *testing.T) {
-	content := `---
-tags: [test]
---
-# internal comment
-Real description here.
-`
-	got := extractDescription(content)
-	if got != "Real description here." {
-		t.Errorf("got %q, want %q", got, "Real description here.")
-	}
-}
-
-func TestExtractDescription_BlankLinesSkipped(t *testing.T) {
-	// Empty lines (len=0) are skipped; whitespace-only lines (spaces) are NOT
-	// skipped because len(line)>0. First non-comment, non-empty line is returned.
-	content := "\n\n\n\nA. Description\nB. Should not be returned.\n"
-	got := extractDescription(content)
-	if got != "A. Description" {
-		t.Errorf("got %q, want %q", got, "A. Description")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// splitLines
-// ---------------------------------------------------------------------------
-
-func TestSplitLines_Basic(t *testing.T) {
-	got := splitLines("a\nb\nc")
-	want := []string{"a", "b", "c"}
-	if len(got) != len(want) {
-		t.Fatalf("len=%d, want %d", len(got), len(want))
-	}
-	for i := range want {
-		if got[i] != want[i] {
-			t.Errorf("got[%d]=%q, want %q", i, got[i], want[i])
-		}
-	}
-}
-
-func TestSplitLines_TrailingNewline(t *testing.T) {
-	got := splitLines("line1\nline2\n")
-	want := []string{"line1", "line2"}
-	if len(got) != len(want) {
-		t.Errorf("trailing newline: got %v, want %v", got, want)
-	}
-}
-
-func TestSplitLines_NoNewline(t *testing.T) {
-	got := splitLines("no newline")
-	want := []string{"no newline"}
-	if len(got) != 1 || got[0] != want[0] {
-		t.Errorf("got %v, want %v", got, want)
-	}
-}
-
-func TestSplitLines_EmptyString(t *testing.T) {
-	got := splitLines("")
-	if len(got) != 0 {
-		t.Errorf("empty string: got %v, want []", got)
-	}
-}
-
-func TestSplitLines_OnlyNewlines(t *testing.T) {
-	got := splitLines("\n\n\n")
-	// Three consecutive '\n' characters → s[start:i] at each '\n' gives
-	// the empty string between newlines → 3 empty segments.
-	// (No trailing segment because start == len(s) at the end.)
-	if len(got) != 3 {
-		t.Errorf("only newlines: got %v (len=%d), want 3 empty strings", got, len(got))
-	}
-	for i, s := range got {
-		if s != "" {
-			t.Errorf("got[%d]=%q, want empty string", i, s)
-		}
-	}
-}
-
-func TestSplitLines_MultipleConsecutiveNewlines(t *testing.T) {
-	got := splitLines("a\n\n\nb")
-	// a\n\n\nb → ["a", "", "", "b"]
-	if len(got) != 4 {
-		t.Errorf("consecutive newlines: got %v (len=%d)", got, len(got))
-	}
-	if got[0] != "a" || got[3] != "b" {
-		t.Errorf("first/last: got %v, want [a, ..., b]", got)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// findConfigDir
-// ---------------------------------------------------------------------------
-
-func TestFindConfigDir_NameMatch(t *testing.T) {
-	tmp := t.TempDir()
-
-	// Create two sub-dirs; only the one with matching name should be found.
-	mustMkdir(filepath.Join(tmp, "workspace-a"))
-	mustWrite(filepath.Join(tmp, "workspace-a", "config.yaml"),
-		"name: other-workspace\ntier: 1\n")
-
-	mustMkdir(filepath.Join(tmp, "workspace-b"))
-	mustWrite(filepath.Join(tmp, "workspace-b", "config.yaml"),
-		"name: target-workspace\nruntime: claude-code\n")
-
-	got := findConfigDir(tmp, "target-workspace")
-	want := filepath.Join(tmp, "workspace-b")
-	if got != want {
-		t.Errorf("got %q, want %q", got, want)
-	}
-}
-
-func TestFindConfigDir_NoMatch_UsesFallback(t *testing.T) {
-	tmp := t.TempDir()
-
-	mustMkdir(filepath.Join(tmp, "first"))
-	mustWrite(filepath.Join(tmp, "first", "config.yaml"), "name: workspace-a\n")
-
-	mustMkdir(filepath.Join(tmp, "second"))
-	mustWrite(filepath.Join(tmp, "second", "config.yaml"), "name: workspace-b\n")
-
-	// No exact name match → fallback to the first directory with a config.yaml.
-	got := findConfigDir(tmp, "nonexistent")
-	want := filepath.Join(tmp, "first")
-	if got != want {
-		t.Errorf("no match: got %q, want fallback %q", got, want)
-	}
-}
-
-func TestFindConfigDir_MissingDir(t *testing.T) {
-	got := findConfigDir("/nonexistent/path/for/findConfigDir", "any-name")
-	if got != "" {
-		t.Errorf("missing dir: got %q, want empty string", got)
-	}
-}
-
-func TestFindConfigDir_NoSubdirs(t *testing.T) {
-	tmp := t.TempDir()
-	// Empty directory → no matches, no fallback.
-	got := findConfigDir(tmp, "any")
-	if got != "" {
-		t.Errorf("empty dir: got %q, want empty string", got)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-func mustMkdir(path string) {
-	os.MkdirAll(path, 0o755)
-}
-
-func mustWrite(path, content string) {
-	os.WriteFile(path, []byte(content), 0o644)
-}
-
-// ---------------------------------------------------------------------------
-// findConfigDir
-// ---------------------------------------------------------------------------
-
-func TestFindConfigDir_SubdirWithoutConfig(t *testing.T) {
-	tmp := t.TempDir()
-	mustMkdir(filepath.Join(tmp, "empty-skill"))
-	// Sub-dir without config.yaml → skipped.
-	got := findConfigDir(tmp, "any")
-	if got != "" {
-		t.Errorf("no config.yaml: got %q, want empty string", got)
-	}
-}
-
-func TestFindConfigDir_FirstWithConfigIsFallback(t *testing.T) {
-	// When name doesn't match, fallback is the FIRST dir with config.yaml,
-	// not the last. Confirm ordering by creating three dirs.
-	tmp := t.TempDir()
-
-	mustMkdir(filepath.Join(tmp, "a"))
-	mustWrite(filepath.Join(tmp, "a", "config.yaml"), "name: alpha\n")
-
-	mustMkdir(filepath.Join(tmp, "b"))
-	mustWrite(filepath.Join(tmp, "b", "config.yaml"), "name: beta\n")
-
-	mustMkdir(filepath.Join(tmp, "c"))
-	mustWrite(filepath.Join(tmp, "c", "config.yaml"), "name: gamma\n")
-
-	got := findConfigDir(tmp, "nonexistent")
-	want := filepath.Join(tmp, "a") // first dir with config.yaml
-	if got != want {
-		t.Errorf("fallback order: got %q, want first-with-config %q", got, want)
-	}
-}
@@ -41,7 +41,7 @@ func Import(
 	}

 	// Create workspace record
-	_, err := db.GetDB().ExecContext(ctx, `
+	_, err := db.DB.ExecContext(ctx, `
 		INSERT INTO workspaces (id, name, role, tier, status, parent_id, source_bundle_id)
 		VALUES ($1, $2, $3, $4, 'provisioning', $5, $6)
 	`, wsID, b.Name, nilIfEmpty(b.Description), b.Tier, parentID, b.ID)
@@ -72,7 +72,7 @@ func Import(
 		}
 	}
 	// Store runtime in DB
-	_, _ = db.GetDB().ExecContext(ctx, `UPDATE workspaces SET runtime = $1 WHERE id = $2`, bundleRuntime, wsID)
+	_, _ = db.DB.ExecContext(ctx, `UPDATE workspaces SET runtime = $1 WHERE id = $2`, bundleRuntime, wsID)

 	// Provision the container if provisioner is available
 	if prov != nil {
@@ -92,7 +92,7 @@ func Import(
 			if err != nil {
 				markFailed(provCtx, wsID, broadcaster, err)
 			} else if url != "" {
-				db.GetDB().ExecContext(provCtx, `UPDATE workspaces SET url = $1 WHERE id = $2`, url, wsID)
+				db.DB.ExecContext(provCtx, `UPDATE workspaces SET url = $1 WHERE id = $2`, url, wsID)
 			}
 		}()
 	}
@@ -139,7 +139,7 @@ func markFailed(ctx context.Context, wsID string, broadcaster *events.Broadcaste
 	// markProvisionFailed in workspace-server/internal/handlers/
 	// workspace_provision_shared.go.
 	msg := err.Error()
-	db.GetDB().ExecContext(ctx,
+	db.DB.ExecContext(ctx,
 		`UPDATE workspaces SET status = $1, last_sample_error = $2, updated_at = now() WHERE id = $3`,
 		models.StatusFailed, msg, wsID)
 	broadcaster.RecordAndBroadcast(ctx, string(events.EventWorkspaceProvisionFailed), wsID, map[string]interface{}{
@@ -1,317 +0,0 @@
-package bundle
-
-import (
-	"testing"
-)
-
-func TestBuildBundleConfigFiles_EmptyBundle(t *testing.T) {
-	b := &Bundle{}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 0 {
-		t.Errorf("empty bundle: want 0 files, got %d", len(files))
-	}
-}
-
-func TestBuildBundleConfigFiles_SystemPromptOnly(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "You are a helpful assistant.",
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 1 {
-		t.Fatalf("system-prompt only: want 1 file, got %d", n)
-	}
-	if content, ok := files["system-prompt.md"]; !ok {
-		t.Fatal("missing system-prompt.md")
-	} else if string(content) != "You are a helpful assistant." {
-		t.Errorf("system-prompt content: got %q", string(content))
-	}
-}
-
-func TestBuildBundleConfigFiles_ConfigYamlOnly(t *testing.T) {
-	b := &Bundle{
-		Prompts: map[string]string{
-			"config.yaml": "runtime: langgraph\ntier: 2\n",
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 1 {
-		t.Fatalf("config.yaml only: want 1 file, got %d", n)
-	}
-	if content, ok := files["config.yaml"]; !ok {
-		t.Fatal("missing config.yaml")
-	} else if string(content) != "runtime: langgraph\ntier: 2\n" {
-		t.Errorf("config.yaml content: got %q", string(content))
-	}
-}
-
-func TestBuildBundleConfigFiles_SystemPromptAndConfigYaml(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "Be concise.",
-		Prompts: map[string]string{
-			"config.yaml": "runtime: langgraph\n",
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 2 {
-		t.Fatalf("system-prompt + config.yaml: want 2 files, got %d", n)
-	}
-	if _, ok := files["system-prompt.md"]; !ok {
-		t.Error("missing system-prompt.md")
-	}
-	if _, ok := files["config.yaml"]; !ok {
-		t.Error("missing config.yaml")
-	}
-}
-
-func TestBuildBundleConfigFiles_Skills(t *testing.T) {
-	b := &Bundle{
-		Skills: []BundleSkill{
-			{
-				ID:   "web-search",
-				Files: map[string]string{"readme.md": "# Web Search\n"},
-			},
-			{
-				ID:   "code-interpreter",
-				Files: map[string]string{"readme.md": "# Code Interpreter\n"},
-			},
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	// 2 skills × 1 file each = 2 files
-	if n := len(files); n != 2 {
-		t.Fatalf("skills: want 2 files, got %d", n)
-	}
-	if _, ok := files["skills/web-search/readme.md"]; !ok {
-		t.Error("missing skills/web-search/readme.md")
-	}
-	if _, ok := files["skills/code-interpreter/readme.md"]; !ok {
-		t.Error("missing skills/code-interpreter/readme.md")
-	}
-}
-
-func TestBuildBundleConfigFiles_SkillSubPaths(t *testing.T) {
-	b := &Bundle{
-		Skills: []BundleSkill{
-			{
-				ID: "multi-file",
-				Files: map[string]string{
-					"readme.md":        "# Multi",
-					"instructions.txt": "Step 1, Step 2",
-				},
-			},
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 2 {
-		t.Fatalf("skill with sub-paths: want 2 files, got %d", n)
-	}
-	if _, ok := files["skills/multi-file/readme.md"]; !ok {
-		t.Error("missing skills/multi-file/readme.md")
-	}
-	if _, ok := files["skills/multi-file/instructions.txt"]; !ok {
-		t.Error("missing skills/multi-file/instructions.txt")
-	}
-}
-
-func TestBuildBundleConfigFiles_EmptySystemPrompt(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "",
-		Prompts: map[string]string{
-			"config.yaml": "runtime: langgraph\n",
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	// Empty system-prompt should not produce a file
-	if n := len(files); n != 1 {
-		t.Errorf("empty system-prompt: want 1 file, got %d", n)
-	}
-}
-
-func TestBuildBundleConfigFiles_EmptyPrompts(t *testing.T) {
-	b := &Bundle{
-		Prompts: map[string]string{},
-	}
-	files := buildBundleConfigFiles(b)
-	if n := len(files); n != 0 {
-		t.Errorf("empty prompts map: want 0 files, got %d", n)
-	}
-}
-
-func TestBuildBundleConfigFiles_emptyBundle(t *testing.T) {
-	b := &Bundle{}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 0 {
-		t.Errorf("expected empty map for empty bundle, got %d entries", len(files))
-	}
-}
-
-func TestBuildBundleConfigFiles_systemPrompt(t *testing.T) {
-	b := &Bundle{SystemPrompt: "You are a helpful assistant."}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 1 {
-		t.Fatalf("expected 1 file, got %d", len(files))
-	}
-	if string(files["system-prompt.md"]) != "You are a helpful assistant." {
-		t.Errorf("unexpected system prompt content: %q", files["system-prompt.md"])
-	}
-}
-
-func TestBuildBundleConfigFiles_configYaml(t *testing.T) {
-	b := &Bundle{Prompts: map[string]string{
-		"config.yaml": "runtime: langgraph\nmodel: claude-sonnet-4-20250514\n",
-	}}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 1 {
-		t.Fatalf("expected 1 file, got %d", len(files))
-	}
-	if string(files["config.yaml"]) != "runtime: langgraph\nmodel: claude-sonnet-4-20250514\n" {
-		t.Errorf("unexpected config.yaml content: %q", files["config.yaml"])
-	}
-}
-
-func TestBuildBundleConfigFiles_systemPromptAndConfigYaml(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "# System",
-		Prompts:     map[string]string{"config.yaml": "runtime: langgraph"},
-	}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 2 {
-		t.Fatalf("expected 2 files, got %d", len(files))
-	}
-	if _, ok := files["system-prompt.md"]; !ok {
-		t.Error("missing system-prompt.md")
-	}
-	if _, ok := files["config.yaml"]; !ok {
-		t.Error("missing config.yaml")
-	}
-}
-
-func TestBuildBundleConfigFiles_skills(t *testing.T) {
-	b := &Bundle{
-		Skills: []BundleSkill{
-			{
-				ID:          "web-search",
-				Name:        "Web Search",
-				Description: "Search the web",
-				Files:       map[string]string{"readme.md": "# Web Search"},
-			},
-			{
-				ID:          "code-runner",
-				Name:        "Code Runner",
-				Description: "Execute code",
-				Files:       map[string]string{"handler.py": "print('hello')"},
-			},
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 2 {
-		t.Fatalf("expected 2 skill files, got %d", len(files))
-	}
-
-	if content, ok := files["skills/web-search/readme.md"]; !ok {
-		t.Error("missing skills/web-search/readme.md")
-	} else if string(content) != "# Web Search" {
-		t.Errorf("unexpected readme.md: %q", content)
-	}
-
-	if _, ok := files["skills/code-runner/handler.py"]; !ok {
-		t.Error("missing skills/code-runner/handler.py")
-	}
-}
-
-func TestBuildBundleConfigFiles_skillsWithSubPaths(t *testing.T) {
-	b := &Bundle{
-		Skills: []BundleSkill{
-			{
-				ID:    "nested-skill",
-				Files: map[string]string{"src/main.py": "def main(): pass", "pyproject.toml": "[tool.foo]"},
-			},
-		},
-	}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 2 {
-		t.Fatalf("expected 2 files, got %d", len(files))
-	}
-	if _, ok := files["skills/nested-skill/src/main.py"]; !ok {
-		t.Error("missing skills/nested-skill/src/main.py")
-	}
-	if _, ok := files["skills/nested-skill/pyproject.toml"]; !ok {
-		t.Error("missing skills/nested-skill/pyproject.toml")
-	}
-}
-
-func TestBuildBundleConfigFiles_skipsEmptyPrompts(t *testing.T) {
-	b := &Bundle{Prompts: map[string]string{}}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 0 {
-		t.Errorf("expected 0 files for empty prompts map, got %d", len(files))
-	}
-}
-
-func TestBuildBundleConfigFiles_skipsMissingConfigYaml(t *testing.T) {
-	b := &Bundle{
-		SystemPrompt: "# My Prompt",
-		Prompts:      map[string]string{"other.yaml": "something: else"},
-	}
-	files := buildBundleConfigFiles(b)
-	if len(files) != 1 {
-		t.Fatalf("expected 1 file (system-prompt only), got %d", len(files))
-	}
-	if _, ok := files["config.yaml"]; ok {
-		t.Error("config.yaml should not be written when not in Prompts")
-	}
-}
-
-func TestNilIfEmpty_emptyString(t *testing.T) {
-	result := nilIfEmpty("")
-	if result != nil {
-		t.Errorf("expected nil for empty string, got %v", result)
-	}
-}
-
-func TestNilIfEmpty_nonEmptyString(t *testing.T) {
-	result := nilIfEmpty("hello")
-	if result == nil {
-		t.Fatal("expected non-nil result for non-empty string")
-	}
-	if result != "hello" {
-		t.Errorf("expected hello, got %q", result)
-	}
-}
-
-func TestNilIfEmpty_whitespaceString(t *testing.T) {
-	// Whitespace is not empty — nilIfEmpty only checks for zero-length
-	result := nilIfEmpty("   ")
-	if result == nil {
-		t.Error("expected non-nil for whitespace string")
-	} else if result != "   " {
-		t.Errorf("expected '   ', got %q", result)
-	}
-}
-
-func TestNilIfEmpty_EmptyString(t *testing.T) {
-	got := nilIfEmpty("")
-	if got != nil {
-		t.Errorf("nilIfEmpty(\"\"): want nil, got %v", got)
-	}
-}
-
-func TestNilIfEmpty_NonEmptyString(t *testing.T) {
-	got := nilIfEmpty("hello")
-	if got == nil {
-		t.Fatal("nilIfEmpty(\"hello\"): want \"hello\", got nil")
-	}
-	if s, ok := got.(string); !ok || s != "hello" {
-		t.Errorf("nilIfEmpty(\"hello\"): got %v (%T)", got, got)
-	}
-}
-
-func TestNilIfEmpty_Whitespace(t *testing.T) {
-	got := nilIfEmpty("   ")
-	if got == nil {
-		t.Fatal("nilIfEmpty(\"   \"): want \"   \", got nil (whitespace is not empty)")
-	}
-	if s, ok := got.(string); !ok || s != "   " {
-		t.Errorf("nilIfEmpty(\"   \"): got %v (%T)", got, got)
-	}
-}
@@ -600,7 +600,7 @@ func TestManager_SendOutbound_NoChatID(t *testing.T) {

 // The callback is a package-level var set by NewManager; we verify both its
 // default (safe no-op) and the wired-up path via a UPDATE assertion against
-// a sqlmock-backed db.GetDB(). Two tests guard the contract: the var is callable
+// a sqlmock-backed db.DB. Two tests guard the contract: the var is callable
 // at zero-value, and a wired callback issues the right UPDATE.

 func TestDisableChannelByChatID_DefaultIsNoOp(t *testing.T) {
@@ -68,10 +68,10 @@ func NewManager(proxy A2AProxy, broadcaster Broadcaster) *Manager {
 	// row disabled and reload in-memory manager state. Without this, outbound
 	// messages keep trying the dead chat and log 403s forever.
 	disableChannelByChatID = func(ctx context.Context, chatID string) {
-		if db.GetDB() == nil {
+		if db.DB == nil {
 			return
 		}
-		res, err := db.GetDB().ExecContext(ctx, `
+		res, err := db.DB.ExecContext(ctx, `
 			UPDATE workspace_channels
 			SET enabled = false, updated_at = now()
 			WHERE channel_type = 'telegram'
@@ -122,7 +122,7 @@ func (m *Manager) PausePollersForToken(workspaceID, botToken string) func() {
 		return func() {}
 	}

-	rows, err := db.GetDB().QueryContext(context.Background(), `
+	rows, err := db.DB.QueryContext(context.Background(), `
 		SELECT id, channel_config FROM workspace_channels
 		WHERE enabled = true AND workspace_id = $1
 	`, workspaceID)
@@ -185,7 +185,7 @@ func (m *Manager) Stop() {
 // Reload re-reads enabled channels from DB and diffs against running pollers.
 // New channels get started, removed/disabled channels get stopped.
 func (m *Manager) Reload(ctx context.Context) {
-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT id, workspace_id, channel_type, channel_config, enabled, allowed_users
 		FROM workspace_channels
 		WHERE enabled = true
@@ -374,8 +374,8 @@ func (m *Manager) HandleInbound(ctx context.Context, ch ChannelRow, msg *Inbound
 	m.appendHistory(ctx, historyKey, msg.Username, msg.Text, replyText)

 	// Update stats in DB
-	if db.GetDB() != nil {
-		db.GetDB().ExecContext(ctx, `
+	if db.DB != nil {
+		db.DB.ExecContext(ctx, `
 			UPDATE workspace_channels
 			SET last_message_at = now(), message_count = message_count + 1, updated_at = now()
 			WHERE id = $1
@@ -402,7 +402,7 @@ func (m *Manager) SendOutbound(ctx context.Context, channelID string, text strin
 		return err
 	}

-	adapter, ok := GetSendAdapter(ch.ChannelType)
+	adapter, ok := GetAdapter(ch.ChannelType)
 	if !ok {
 		return fmt.Errorf("no adapter for %s", ch.ChannelType)
 	}
@@ -419,8 +419,8 @@ func (m *Manager) SendOutbound(ctx context.Context, channelID string, text strin
 		}
 	}

-	if db.GetDB() != nil {
-		db.GetDB().ExecContext(ctx, `
+	if db.DB != nil {
+		db.DB.ExecContext(ctx, `
 			UPDATE workspace_channels
 			SET last_message_at = now(), message_count = message_count + 1, updated_at = now()
 			WHERE id = $1
@@ -447,7 +447,7 @@ func (m *Manager) SendOutbound(ctx context.Context, channelID string, text strin
 // completion posts to both #mol-engineering AND #mol-firehose if the
 // workspace has both configured via chat_id comma-separation.
 func (m *Manager) BroadcastToWorkspaceChannels(ctx context.Context, workspaceID, text string) {
-	if text == "" || db.GetDB() == nil {
+	if text == "" || db.DB == nil {
 		return
 	}
 	// Truncate to keep Slack messages digestible (rune-safe for CJK/emoji)
@@ -457,7 +457,7 @@ func (m *Manager) BroadcastToWorkspaceChannels(ctx context.Context, workspaceID,
 	}
 	// Only auto-post to Slack channels. Telegram is CEO-only — explicit
 	// escalations via the agent's outbound call, never auto-post from crons.
-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT id FROM workspace_channels
 		WHERE workspace_id = $1 AND enabled = true AND channel_type = 'slack'
 	`, workspaceID)
@@ -478,10 +478,10 @@ func (m *Manager) BroadcastToWorkspaceChannels(ctx context.Context, workspaceID,
 // FetchWorkspaceChannelContext returns recent Slack channel messages formatted
 // as ambient context for cron prompts (Level 3).
 func (m *Manager) FetchWorkspaceChannelContext(ctx context.Context, workspaceID string) string {
-	if db.GetDB() == nil {
+	if db.DB == nil {
 		return ""
 	}
-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT channel_config FROM workspace_channels
 		WHERE workspace_id = $1 AND channel_type = 'slack' AND enabled = true
 		LIMIT 1
@@ -548,7 +548,7 @@ func truncID(id string) string {
 func (m *Manager) loadChannel(ctx context.Context, channelID string) (ChannelRow, error) {
 	var ch ChannelRow
 	var configJSON, allowedJSON []byte
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		SELECT id, workspace_id, channel_type, channel_config, enabled, allowed_users
 		FROM workspace_channels WHERE id = $1
 	`, channelID).Scan(&ch.ID, &ch.WorkspaceID, &ch.ChannelType, &configJSON, &ch.Enabled, &allowedJSON)
@@ -1,7 +1,5 @@
 package channels

-import "context"
-
 // Registry of all available channel adapters.
 // To add a new platform: implement ChannelAdapter, register here.
 var adapters = map[string]ChannelAdapter{
@@ -11,27 +9,6 @@ var adapters = map[string]ChannelAdapter{
 	"discord":  &DiscordAdapter{},
 }

-// SendAdapter is the subset of ChannelAdapter needed by SendOutbound.
-// Extracted so tests can inject a no-op/mock adapter without hitting real
-// platform APIs (Telegram Bot API, Slack API, etc.).
-type SendAdapter interface {
-	SendMessage(ctx context.Context, config map[string]interface{}, chatID string, text string) error
-}
-
-// getSendAdapter is the production implementation of GetSendAdapter —
-// returns the real registered adapter's SendMessage method.
-func getSendAdapter(channelType string) (SendAdapter, bool) {
-	a, ok := adapters[channelType]
-	if !ok {
-		return nil, false
-	}
-	return a, true
-}
-
-// GetSendAdapter returns the SendAdapter for a channel type.
-// Defaults to the real adapter; overridden by SetTestSendAdapter in tests.
-var GetSendAdapter = getSendAdapter
-
 // GetAdapter returns the adapter for a channel type.
 func GetAdapter(channelType string) (ChannelAdapter, bool) {
 	a, ok := adapters[channelType]
@@ -1,30 +0,0 @@
-package channels
-
-import "context"
-
-// MockSendAdapter implements SendAdapter for handler tests. It records every
-// call and returns a configurable error (nil = success, non-nil = failure).
-type MockSendAdapter struct {
-	Calls    int
-	Err      error
-	SentText string
-	SentChat string
-}
-
-func (m *MockSendAdapter) SendMessage(_ context.Context, _ map[string]interface{}, chatID string, text string) error {
-	m.Calls++
-	m.SentText = text
-	m.SentChat = chatID
-	return m.Err
-}
-
-// SetGetSendAdapter replaces the package-level GetSendAdapter variable.
-// Tests MUST call ResetSendAdapters() in their t.Cleanup.
-func SetGetSendAdapter(fn func(string) (SendAdapter, bool)) {
-	GetSendAdapter = fn
-}
-
-// ResetSendAdapters restores GetSendAdapter to the production implementation.
-func ResetSendAdapters() {
-	GetSendAdapter = getSendAdapter
-}
@@ -8,57 +8,24 @@ import (
 	"path/filepath"
 	"sort"
 	"strings"
-	"sync"

 	_ "github.com/lib/pq"
 )

-// mu guards DB against concurrent read/write. setupTestDB swaps the
-// connection during test cleanup; concurrent goroutines from the test
-// body may be reading DB at that moment.
-var mu sync.RWMutex
-
-// DB is the package-level postgres connection. In production it is set
-// once by InitPostgres and never mutated. In tests, setupTestDB swaps it
-// for a sqlmock. Access via GetDB() to avoid data races.
 var DB *sql.DB

-// GetDB returns the current *sql.DB, acquired under a read lock so that
-// concurrent readers (async goroutines from test bodies) and writers
-// (setupTestDB cleanup) do not race.
-func GetDB() *sql.DB {
-	mu.RLock()
-	defer mu.RUnlock()
-	return DB
-}
-
-// Lock acquires an exclusive write lock on the DB. Used by test helpers
-// (setupTestDB) to safely swap db.DB without racing against concurrent
-// GetDB() readers.
-func Lock() {
-	mu.Lock()
-}
-
-// Unlock releases the exclusive write lock acquired by Lock().
-func Unlock() {
-	mu.Unlock()
-}
-
 func InitPostgres(databaseURL string) error {
 	var err error
-	conn, err := sql.Open("postgres", databaseURL)
+	DB, err = sql.Open("postgres", databaseURL)
 	if err != nil {
 		return fmt.Errorf("open postgres: %w", err)
 	}
-	conn.SetMaxOpenConns(25)
-	conn.SetMaxIdleConns(5)
+	DB.SetMaxOpenConns(25)
+	DB.SetMaxIdleConns(5)

-	if err := conn.Ping(); err != nil {
+	if err := DB.Ping(); err != nil {
 		return fmt.Errorf("ping postgres: %w", err)
 	}
-	mu.Lock()
-	DB = conn
-	mu.Unlock()
 	log.Println("Connected to Postgres")
 	return nil
 }
@@ -84,9 +51,8 @@ func InitPostgres(databaseURL string) error {
 // Migration authors must write idempotent SQL. A real schema_migrations
 // tracking table would be better; tracked as follow-up.
 func RunMigrations(migrationsDir string) error {
-	realDB := GetDB()
 	// Create tracking table if it doesn't exist.
-	if _, err := realDB.Exec(`CREATE TABLE IF NOT EXISTS schema_migrations (
+	if _, err := DB.Exec(`CREATE TABLE IF NOT EXISTS schema_migrations (
 		filename TEXT PRIMARY KEY,
 		applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 	)`); err != nil {
@@ -115,7 +81,7 @@ func RunMigrations(migrationsDir string) error {

 		// Check if already applied.
 		var exists bool
-		if err := realDB.QueryRow("SELECT EXISTS(SELECT 1 FROM schema_migrations WHERE filename = $1)", base).Scan(&exists); err != nil {
+		if err := DB.QueryRow("SELECT EXISTS(SELECT 1 FROM schema_migrations WHERE filename = $1)", base).Scan(&exists); err != nil {
 			return fmt.Errorf("check migration %s: %w", base, err)
 		}
 		if exists {
@@ -128,12 +94,12 @@ func RunMigrations(migrationsDir string) error {
 		if err != nil {
 			return fmt.Errorf("read %s: %w", f, err)
 		}
-		if _, err := realDB.Exec(string(content)); err != nil {
+		if _, err := DB.Exec(string(content)); err != nil {
 			return fmt.Errorf("exec %s: %w", base, err)
 		}

 		// Record as applied.
-		if _, err := realDB.Exec("INSERT INTO schema_migrations (filename) VALUES ($1)", base); err != nil {
+		if _, err := DB.Exec("INSERT INTO schema_migrations (filename) VALUES ($1)", base); err != nil {
 			return fmt.Errorf("record migration %s: %w", base, err)
 		}
 		applied++
@@ -17,9 +17,7 @@ func TestRunMigrations_FirstBoot_AppliesAndRecords(t *testing.T) {
 		t.Fatalf("sqlmock: %v", err)
 	}
 	defer mockDB.Close()
-	mu.Lock()
 	DB = mockDB
-	mu.Unlock()

 	tmp := t.TempDir()
 	os.WriteFile(filepath.Join(tmp, "001_init.up.sql"), []byte("CREATE TABLE foo();"), 0o644)
@@ -57,9 +55,7 @@ func TestRunMigrations_SecondBoot_SkipsApplied(t *testing.T) {
 		t.Fatalf("sqlmock: %v", err)
 	}
 	defer mockDB.Close()
-	mu.Lock()
 	DB = mockDB
-	mu.Unlock()

 	tmp := t.TempDir()
 	os.WriteFile(filepath.Join(tmp, "001_init.up.sql"), []byte("CREATE TABLE foo();"), 0o644)
@@ -96,9 +92,7 @@ func TestRunMigrations_MixedState_AppliesOnlyNew(t *testing.T) {
 		t.Fatalf("sqlmock: %v", err)
 	}
 	defer mockDB.Close()
-	mu.Lock()
 	DB = mockDB
-	mu.Unlock()

 	tmp := t.TempDir()
 	os.WriteFile(filepath.Join(tmp, "001_old.up.sql"), []byte("SELECT 1;"), 0o644)
@@ -141,9 +135,7 @@ func TestRunMigrations_SkipsDownSqlFilesEvenInTracking(t *testing.T) {
 		t.Fatalf("sqlmock: %v", err)
 	}
 	defer mockDB.Close()
-	mu.Lock()
 	DB = mockDB
-	mu.Unlock()

 	tmp := t.TempDir()
 	os.WriteFile(filepath.Join(tmp, "001_init.up.sql"), []byte("CREATE TABLE foo();"), 0o644)
@@ -83,7 +83,7 @@ func TestWorkspaceStatusFailed_MustSetLastSampleError(t *testing.T) {
 			if !ok {
 				return true
 			}
-			// Match db.GetDB().ExecContext / db.GetDB().QueryContext / db.GetDB().QueryRowContext
+			// Match db.DB.ExecContext / db.DB.QueryContext / db.DB.QueryRowContext
 			// — the three SQL execution surfaces this codebase uses.
 			methodName := sel.Sel.Name
 			if methodName != "ExecContext" && methodName != "QueryContext" && methodName != "QueryRowContext" {
@@ -63,7 +63,7 @@ func (b *Broadcaster) RecordAndBroadcast(ctx context.Context, eventType string,
 	}

 	// Insert into structure_events — cast to jsonb explicitly
-	_, err = db.GetDB().ExecContext(ctx, `
+	_, err = db.DB.ExecContext(ctx, `
 		INSERT INTO structure_events (event_type, workspace_id, payload)
 		VALUES ($1, $2, $3::jsonb)
 	`, eventType, workspaceID, string(payloadJSON))
@@ -276,7 +276,7 @@ func (h *WorkspaceHandler) ProxyA2A(c *gin.Context) {
 	if callerID == "" {
 		if _, isOrg := c.Get("org_token_id"); !isOrg {
 			if tok := wsauth.BearerTokenFromHeader(c.GetHeader("Authorization")); tok != "" {
-				if wsID, err := wsauth.WorkspaceFromToken(ctx, db.GetDB(), tok); err == nil {
+				if wsID, err := wsauth.WorkspaceFromToken(ctx, db.DB, tok); err == nil {
 					callerID = wsID
 				}
 			}
@@ -332,7 +332,7 @@ func (h *WorkspaceHandler) ProxyA2A(c *gin.Context) {
 func (h *WorkspaceHandler) checkWorkspaceBudget(ctx context.Context, workspaceID string) *proxyA2AError {
 	var budgetLimit sql.NullInt64
 	var monthlySpend int64
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT budget_limit, COALESCE(monthly_spend, 0) FROM workspaces WHERE id = $1`,
 		workspaceID,
 	).Scan(&budgetLimit, &monthlySpend)
@@ -623,7 +623,7 @@ func (h *WorkspaceHandler) resolveAgentURL(ctx context.Context, workspaceID stri
 	if err != nil {
 		var urlNullable sql.NullString
 		var status string
-		err := db.GetDB().QueryRowContext(ctx,
+		err := db.DB.QueryRowContext(ctx,
 			`SELECT url, status FROM workspaces WHERE id = $1`, workspaceID,
 		).Scan(&urlNullable, &status)
 		if err == sql.ErrNoRows {
@@ -645,7 +645,7 @@ func (h *WorkspaceHandler) resolveAgentURL(ctx context.Context, workspaceID stri
 			// the caller can retry once the workspace is back online (~10s).
 			if status == "hibernated" {
 				log.Printf("ProxyA2A: waking hibernated workspace %s", workspaceID)
-				h.goAsync(func() { h.RestartByID(workspaceID) })
+				go h.RestartByID(workspaceID)
 				return "", &proxyA2AError{
 					Status:  http.StatusServiceUnavailable,
 					Headers: map[string]string{"Retry-After": "15"},
@@ -161,7 +161,7 @@ func (h *WorkspaceHandler) handleA2ADispatchError(ctx context.Context, workspace
 // canvas-chat-to-dead-workspace incident traces to exactly this gap.
 func (h *WorkspaceHandler) maybeMarkContainerDead(ctx context.Context, workspaceID string) bool {
 	var wsRuntime string
-	db.GetDB().QueryRowContext(ctx, `SELECT COALESCE(runtime, 'langgraph') FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsRuntime)
+	db.DB.QueryRowContext(ctx, `SELECT COALESCE(runtime, 'langgraph') FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsRuntime)
 	if isExternalLikeRuntime(wsRuntime) {
 		return false
 	}
@@ -189,7 +189,7 @@ func (h *WorkspaceHandler) maybeMarkContainerDead(ctx context.Context, workspace
 		return false
 	}
 	log.Printf("ProxyA2A: container for %s is dead — marking offline and triggering restart", workspaceID)
-	if _, err := db.GetDB().ExecContext(ctx, `UPDATE workspaces SET status = $1, updated_at = now() WHERE id = $2 AND status NOT IN ('removed', 'provisioning')`, models.StatusOffline, workspaceID); err != nil {
+	if _, err := db.DB.ExecContext(ctx, `UPDATE workspaces SET status = $1, updated_at = now() WHERE id = $2 AND status NOT IN ('removed', 'provisioning')`, models.StatusOffline, workspaceID); err != nil {
 		log.Printf("ProxyA2A: failed to mark workspace %s offline: %v", workspaceID, err)
 	}
 	db.ClearWorkspaceKeys(ctx, workspaceID)
@@ -234,7 +234,7 @@ func (h *WorkspaceHandler) preflightContainerHealth(ctx context.Context, workspa
 	// (same effect as maybeMarkContainerDead's branch), and return the
 	// structured 503 immediately so the caller skips the forward.
 	log.Printf("ProxyA2A preflight: container for %s is not running — marking offline and triggering restart (#36)", workspaceID)
-	if _, dbErr := db.GetDB().ExecContext(ctx,
+	if _, dbErr := db.DB.ExecContext(ctx,
 		`UPDATE workspaces SET status = $1, updated_at = now() WHERE id = $2 AND status NOT IN ('removed', 'provisioning')`,
 		models.StatusOffline, workspaceID); dbErr != nil {
 		log.Printf("ProxyA2A preflight: failed to mark workspace %s offline: %v", workspaceID, dbErr)
@@ -257,7 +257,7 @@ func (h *WorkspaceHandler) preflightContainerHealth(ctx context.Context, workspa
 func (h *WorkspaceHandler) logA2AFailure(ctx context.Context, workspaceID, callerID string, body []byte, a2aMethod string, err error, durationMs int) {
 	errMsg := err.Error()
 	var errWsName string
-	db.GetDB().QueryRowContext(ctx, `SELECT name FROM workspaces WHERE id = $1`, workspaceID).Scan(&errWsName)
+	db.DB.QueryRowContext(ctx, `SELECT name FROM workspaces WHERE id = $1`, workspaceID).Scan(&errWsName)
 	if errWsName == "" {
 		errWsName = workspaceID
 	}
@@ -289,7 +289,7 @@ func (h *WorkspaceHandler) logA2ASuccess(ctx context.Context, workspaceID, calle
 		logStatus = "error"
 	}
 	var wsNameForLog string
-	db.GetDB().QueryRowContext(ctx, `SELECT name FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsNameForLog)
+	db.DB.QueryRowContext(ctx, `SELECT name FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsNameForLog)
 	if wsNameForLog == "" {
 		wsNameForLog = workspaceID
 	}
@@ -301,7 +301,7 @@ func (h *WorkspaceHandler) logA2ASuccess(ctx context.Context, workspaceID, calle
 		go func() {
 			bgCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 			defer cancel()
-			if _, err := db.GetDB().ExecContext(bgCtx,
+			if _, err := db.DB.ExecContext(bgCtx,
 				`UPDATE workspaces SET last_outbound_at = NOW() WHERE id = $1`, callerID); err != nil {
 				log.Printf("last_outbound_at update failed for %s: %v", callerID, err)
 			}
@@ -354,7 +354,7 @@ func nilIfEmpty(s string) *string {
 // On auth failure this writes the 401 via c and returns an error so the
 // handler aborts without running the proxy.
 func validateCallerToken(ctx context.Context, c *gin.Context, callerID string) error {
-	hasLive, err := wsauth.HasAnyLiveToken(ctx, db.GetDB(), callerID)
+	hasLive, err := wsauth.HasAnyLiveToken(ctx, db.DB, callerID)
 	if err != nil {
 		// Fail-open here matches the heartbeat path — A2A caller auth is
 		// defense-in-depth on top of access-control hierarchy, not the
@@ -371,7 +371,7 @@ func validateCallerToken(ctx context.Context, c *gin.Context, callerID string) e
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing caller auth token"})
 		return errInvalidCallerToken
 	}
-	if err := wsauth.ValidateToken(ctx, db.GetDB(), callerID, tok); err != nil {
+	if err := wsauth.ValidateToken(ctx, db.DB, callerID, tok); err != nil {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid caller auth token"})
 		return err
 	}
@@ -475,7 +475,7 @@ func parseUsageFromA2AResponse(body []byte) (inputTokens, outputTokens int64) {
 // proxy-side read used for the short-circuit in proxyA2ARequest.
 func lookupDeliveryMode(ctx context.Context, workspaceID string) string {
 	var mode sql.NullString
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT delivery_mode FROM workspaces WHERE id = $1`, workspaceID,
 	).Scan(&mode)
 	if err != nil {
@@ -505,7 +505,7 @@ func lookupDeliveryMode(ctx context.Context, workspaceID string) string {
 // without a public URL.
 func (h *WorkspaceHandler) logA2AReceiveQueued(ctx context.Context, workspaceID, callerID string, body []byte, a2aMethod string) {
 	var wsName string
-	db.GetDB().QueryRowContext(ctx, `SELECT name FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName)
+	db.DB.QueryRowContext(ctx, `SELECT name FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName)
 	if wsName == "" {
 		wsName = workspaceID
 	}
@@ -135,7 +135,7 @@ func EnqueueA2A(
 	// ON CONFLICT — only true CONSTRAINTs work for that). On conflict we
 	// then look up the existing row's id so the caller always receives a
 	// valid queue entry reference.
-	err = db.GetDB().QueryRowContext(ctx, `
+	err = db.DB.QueryRowContext(ctx, `
 		INSERT INTO a2a_queue (workspace_id, caller_id, priority, body, method, idempotency_key, expires_at)
 		VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7)
 		ON CONFLICT (workspace_id, idempotency_key)
@@ -146,7 +146,7 @@ func EnqueueA2A(

 	if errors.Is(err, sql.ErrNoRows) && idempotencyKey != "" {
 		// Conflict — look up the existing active row and use its id.
-		err = db.GetDB().QueryRowContext(ctx, `
+		err = db.DB.QueryRowContext(ctx, `
 			SELECT id FROM a2a_queue
 			WHERE workspace_id = $1 AND idempotency_key = $2
 			  AND status IN ('queued','dispatched')
@@ -160,7 +160,7 @@ func EnqueueA2A(
 	}

 	// Return current queue depth for the caller's visibility.
-	_ = db.GetDB().QueryRowContext(ctx, `
+	_ = db.DB.QueryRowContext(ctx, `
 		SELECT COUNT(*) FROM a2a_queue
 		WHERE workspace_id = $1 AND status = 'queued'
 	`, workspaceID).Scan(&depth)
@@ -175,7 +175,7 @@ func EnqueueA2A(
 //
 // Returns (nil, nil) when the queue is empty — not an error.
 func DequeueNext(ctx context.Context, workspaceID string) (*QueuedItem, error) {
-	tx, err := db.GetDB().BeginTx(ctx, nil)
+	tx, err := db.DB.BeginTx(ctx, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -220,7 +220,7 @@ func DequeueNext(ctx context.Context, workspaceID string) (*QueuedItem, error) {
 // MarkQueueItemCompleted flips the queue row to 'completed' on a successful
 // drain dispatch.
 func MarkQueueItemCompleted(ctx context.Context, id string) {
-	if _, err := db.GetDB().ExecContext(ctx,
+	if _, err := db.DB.ExecContext(ctx,
 		`UPDATE a2a_queue SET status = 'completed', completed_at = now() WHERE id = $1`, id,
 	); err != nil {
 		log.Printf("A2AQueue: failed to mark %s completed: %v", id, err)
@@ -233,7 +233,7 @@ func MarkQueueItemCompleted(ctx context.Context, id string) {
 // forever.
 func MarkQueueItemFailed(ctx context.Context, id, errMsg string) {
 	const maxAttempts = 5
-	if _, err := db.GetDB().ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		UPDATE a2a_queue
 		SET status = CASE WHEN attempts >= $2 THEN 'failed' ELSE 'queued' END,
 		    last_error = $3,
@@ -249,7 +249,7 @@ func MarkQueueItemFailed(ctx context.Context, id, errMsg string) {
 // can see how many ahead of them.
 func QueueDepth(ctx context.Context, workspaceID string) int {
 	var n int
-	_ = db.GetDB().QueryRowContext(ctx,
+	_ = db.DB.QueryRowContext(ctx,
 		`SELECT COUNT(*) FROM a2a_queue WHERE workspace_id = $1 AND status = 'queued'`,
 		workspaceID,
 	).Scan(&n)
@@ -266,7 +266,7 @@ func DropStaleQueueItems(ctx context.Context, workspaceID string, maxAgeMinutes
 	var rows int64
 	var err error
 	if workspaceID != "" {
-		err = db.GetDB().QueryRowContext(ctx, `
+		err = db.DB.QueryRowContext(ctx, `
 			WITH dropped AS (
 				UPDATE a2a_queue
 				SET status = 'dropped',
@@ -285,7 +285,7 @@ func DropStaleQueueItems(ctx context.Context, workspaceID string, maxAgeMinutes
 			SELECT count(*) FROM dropped
 		`, workspaceID, maxAgeMinutes).Scan(&rows)
 	} else {
-		err = db.GetDB().QueryRowContext(ctx, `
+		err = db.DB.QueryRowContext(ctx, `
 			WITH dropped AS (
 				UPDATE a2a_queue
 				SET status = 'dropped',
@@ -419,7 +419,7 @@ func (h *WorkspaceHandler) stitchDrainResponseToDelegation(ctx context.Context,
 		"text":          responseText,
 		"delegation_id": delegationID,
 	})
-	res, err := db.GetDB().ExecContext(ctx, `
+	res, err := db.DB.ExecContext(ctx, `
 		UPDATE activity_logs
 		   SET status        = 'completed',
 		       summary       = $1,
@@ -86,7 +86,7 @@ func QueueStatusByID(ctx context.Context, queueID string) (*QueueStatus, error)
 	// so a completed delegation surfaces its result inline — non-delegation
 	// queue rows simply won't have a matching activity_logs row and the field
 	// stays null.
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		SELECT
 			q.id,
 			q.workspace_id,
@@ -146,7 +146,7 @@ func QueueStatusByID(ctx context.Context, queueID string) (*QueueStatus, error)
 // the auth check without first projecting the public response.
 func queueRowAuthFields(ctx context.Context, queueID string) (callerID, workspaceID string, err error) {
 	var callerNS, workspaceNS sql.NullString
-	err = db.GetDB().QueryRowContext(ctx,
+	err = db.DB.QueryRowContext(ctx,
 		`SELECT caller_id, workspace_id FROM a2a_queue WHERE id = $1`,
 		queueID,
 	).Scan(&callerNS, &workspaceNS)
@@ -185,7 +185,7 @@ func (h *WorkspaceHandler) GetA2AQueueStatus(c *gin.Context) {
 	callerWorkspace := c.GetHeader("X-Workspace-ID")
 	if !isOrg && callerWorkspace == "" {
 		if tok := wsauth.BearerTokenFromHeader(c.GetHeader("Authorization")); tok != "" {
-			if wsID, err := wsauth.WorkspaceFromToken(ctx, db.GetDB(), tok); err == nil {
+			if wsID, err := wsauth.WorkspaceFromToken(ctx, db.DB, tok); err == nil {
 				callerWorkspace = wsID
 			}
 		}
@@ -25,7 +25,11 @@ import (

 // setupTestDBForQueueTests creates a sqlmock DB using QueryMatcherEqual (exact
 // string matching) so that ExpectQuery/ExpectExec patterns are compared verbatim.
-// Uses the same global db.GetDB() as setupTestDB so the handler can use it.
+// Uses the same global db.DB as setupTestDB so the handler can use it.
+//
+// IMPORTANT: db.DB is saved before assignment and restored via t.Cleanup so
+// that tests running after this one are not polluted by a closed mock.
+// Same fix as setupTestDB (handlers_test.go); same root cause as mc#975.
 func setupTestDBForQueueTests(t *testing.T) sqlmock.Sqlmock {
 	t.Helper()
 	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
@@ -81,54 +85,6 @@ func TestExtractIdempotencyKey_emptyOnMissing(t *testing.T) {
 	}
 }

-// ──────────────────────────────────────────────────────────────────────────────
-// extractExpiresInSeconds
-// ──────────────────────────────────────────────────────────────────────────────
-
-func TestExtractExpiresInSeconds_valid(t *testing.T) {
-	cases := []struct {
-		name string
-		body string
-		want int
-	}{
-		{"positive int", `{"params":{"expires_in_seconds":30}}`, 30},
-		{"zero", `{"params":{"expires_in_seconds":0}}`, 0},
-		{"large TTL", `{"params":{"expires_in_seconds":3600}}`, 3600},
-		{"nested message — not affected", `{"params":{"message":{"role":"user"},"expires_in_seconds":60}}`, 60},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := extractExpiresInSeconds([]byte(tc.body)); got != tc.want {
-				t.Errorf("extractExpiresInSeconds = %d, want %d", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestExtractExpiresInSeconds_invalidOrMissing(t *testing.T) {
-	cases := []struct {
-		name string
-		body string
-		want int
-	}{
-		{"negative → 0", `{"params":{"expires_in_seconds":-5}}`, 0},
-		{"missing expires_in_seconds", `{"params":{"message":{"role":"user"}}}`, 0},
-		{"no params at all", `{"method":"message/send"}`, 0},
-		{"malformed JSON", `not json`, 0},
-		{"empty body", ``, 0},
-		{"null value", `{"params":{"expires_in_seconds":null}}`, 0},
-		{"string value", `{"params":{"expires_in_seconds":"30"}}`, 0},
-		{"float value", `{"params":{"expires_in_seconds":30.5}}`, 30},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := extractExpiresInSeconds([]byte(tc.body)); got != tc.want {
-				t.Errorf("extractExpiresInSeconds(%q) = %d, want %d", tc.body, got, tc.want)
-			}
-		})
-	}
-}
-
 func TestExtractDelegationIDFromBody(t *testing.T) {
 	cases := []struct {
 		name string
@@ -133,7 +133,7 @@ func (h *ActivityHandler) List(c *gin.Context) {
 	var cursorTime time.Time
 	usingCursor := false
 	if sinceID != "" {
-		err := db.GetDB().QueryRowContext(c.Request.Context(),
+		err := db.DB.QueryRowContext(c.Request.Context(),
 			`SELECT created_at FROM activity_logs WHERE id = $1 AND workspace_id = $2`,
 			sinceID, workspaceID,
 		).Scan(&cursorTime)
@@ -222,7 +222,7 @@ func (h *ActivityHandler) List(c *gin.Context) {
 	}
 	args = append(args, limit)

-	rows, err := db.GetDB().QueryContext(c.Request.Context(), query, args...)
+	rows, err := db.DB.QueryContext(c.Request.Context(), query, args...)

 	if err != nil {
 		log.Printf("Activity list error for %s: %v", workspaceID, err)
@@ -285,7 +285,7 @@ func (h *ActivityHandler) SessionSearch(c *gin.Context) {

 	sqlQuery, args := buildSessionSearchQuery(workspaceID, query, limit)

-	rows, err := db.GetDB().QueryContext(c.Request.Context(), sqlQuery, args...)
+	rows, err := db.DB.QueryContext(c.Request.Context(), sqlQuery, args...)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "session search failed"})
 		return
@@ -476,19 +476,12 @@ func (h *ActivityHandler) Notify(c *gin.Context) {
 	for _, a := range body.Attachments {
 		attachments = append(attachments, AgentMessageAttachment(a))
 	}
-	writer := NewAgentMessageWriter(db.GetDB(), h.broadcaster)
+	writer := NewAgentMessageWriter(db.DB, h.broadcaster)
 	if err := writer.Send(c.Request.Context(), workspaceID, body.Message, attachments); err != nil {
 		if errors.Is(err, ErrWorkspaceNotFound) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
 			return
 		}
-		if errors.Is(err, ErrTalkToUserDisabled) {
-			c.JSON(http.StatusForbidden, gin.H{
-				"error": "talk_to_user_disabled",
-				"hint":  "This workspace is not allowed to send messages directly to the user. Forward your update to a parent workspace using delegate_task — they may be able to reach the user.",
-			})
-			return
-		}
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error"})
 		return
 	}
@@ -587,7 +580,7 @@ func (h *ActivityHandler) Report(c *gin.Context) {
 // most callers expect. For atomic-with-sibling-writes use LogActivityTx
 // and propagate the error.
 func LogActivity(ctx context.Context, broadcaster events.EventEmitter, params ActivityParams) {
-	hook, err := logActivityExec(ctx, db.GetDB(), broadcaster, params)
+	hook, err := logActivityExec(ctx, db.DB, broadcaster, params)
 	if err != nil {
 		log.Printf("LogActivity insert error: %v", err)
 		return
@@ -615,7 +608,7 @@ func LogActivityTx(ctx context.Context, tx *sql.Tx, broadcaster events.EventEmit

 // activityExecutor is the SQL surface LogActivity[Tx] needs. *sql.Tx
 // and *sql.DB both satisfy it, so the same insert path serves the
-// fire-and-forget caller (db.GetDB()) and the Tx-aware caller (*sql.Tx).
+// fire-and-forget caller (db.DB) and the Tx-aware caller (*sql.Tx).
 type activityExecutor interface {
 	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
 }
@@ -464,9 +464,9 @@ func TestNotify_PersistsToActivityLogsForReloadRecovery(t *testing.T) {
 	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })

 	// Workspace existence check
-	mock.ExpectQuery(`SELECT name, talk_to_user_enabled FROM workspaces`).
+	mock.ExpectQuery(`SELECT name FROM workspaces`).
 		WithArgs("ws-notify").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("DD", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("DD"))

 	// Persistence INSERT — verify shape
 	mock.ExpectExec(`INSERT INTO activity_logs`).
@@ -511,9 +511,9 @@ func TestNotify_WithAttachments_PersistsFilePartsForReload(t *testing.T) {
 	db.DB = mockDB
 	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })

-	mock.ExpectQuery(`SELECT name, talk_to_user_enabled FROM workspaces`).
+	mock.ExpectQuery(`SELECT name FROM workspaces`).
 		WithArgs("ws-attach").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("DD", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("DD"))

 	// Capture the JSONB arg so we can assert on the persisted shape
 	// AFTER the call (must include parts[].kind=file so reload
@@ -640,9 +640,9 @@ func TestNotify_DBFailure_StillBroadcastsAnd200(t *testing.T) {
 	db.DB = mockDB
 	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })

-	mock.ExpectQuery(`SELECT name, talk_to_user_enabled FROM workspaces`).
+	mock.ExpectQuery(`SELECT name FROM workspaces`).
 		WithArgs("ws-x").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("DD", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("DD"))
 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WillReturnError(fmt.Errorf("simulated db hiccup"))

@@ -949,7 +949,7 @@ func TestLogActivityTx_DefersBroadcastUntilCommitHook(t *testing.T) {
 		WillReturnResult(sqlmock.NewResult(1, 1))
 	mock.ExpectCommit()

-	tx, err := db.GetDB().BeginTx(context.Background(), nil)
+	tx, err := db.DB.BeginTx(context.Background(), nil)
 	if err != nil {
 		t.Fatalf("BeginTx: %v", err)
 	}
@@ -993,7 +993,7 @@ func TestLogActivityTx_InsertError_NoHook_NoBroadcast(t *testing.T) {
 		WillReturnError(errors.New("constraint violation simulated"))
 	mock.ExpectRollback()

-	tx, err := db.GetDB().BeginTx(context.Background(), nil)
+	tx, err := db.DB.BeginTx(context.Background(), nil)
 	if err != nil {
 		t.Fatalf("BeginTx: %v", err)
 	}
@@ -52,7 +52,7 @@ type AdminDelegationsHandler struct {

 func NewAdminDelegationsHandler(handle *sql.DB) *AdminDelegationsHandler {
 	if handle == nil {
-		handle = db.GetDB()
+		handle = db.DB
 	}
 	return &AdminDelegationsHandler{db: handle}
 }
@@ -107,7 +107,7 @@ func (h *AdminMemoriesHandler) Export(c *gin.Context) {
 		return
 	}

-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT am.id, am.content, am.scope, am.namespace, am.created_at,
 		       w.name AS workspace_name
 		FROM agent_memories am
@@ -183,7 +183,7 @@ func (h *AdminMemoriesHandler) Import(c *gin.Context) {
 	for _, entry := range entries {
 		// 1. Resolve workspace by name
 		var workspaceID string
-		err := db.GetDB().QueryRowContext(ctx,
+		err := db.DB.QueryRowContext(ctx,
 			`SELECT id FROM workspaces WHERE name = $1 LIMIT 1`,
 			entry.WorkspaceName,
 		).Scan(&workspaceID)
@@ -205,7 +205,7 @@ func (h *AdminMemoriesHandler) Import(c *gin.Context) {
 		// secret (same placeholder output) are treated as duplicates.
 		var exists bool

-		err = db.GetDB().QueryRowContext(ctx,
+		err = db.DB.QueryRowContext(ctx,
 			`SELECT EXISTS(SELECT 1 FROM agent_memories WHERE workspace_id = $1 AND content = $2 AND scope = $3)`,
 			workspaceID, content, entry.Scope,
 		).Scan(&exists)
@@ -226,12 +226,12 @@ func (h *AdminMemoriesHandler) Import(c *gin.Context) {
 		}

 		if entry.CreatedAt != "" {
-			_, err = db.GetDB().ExecContext(ctx,
+			_, err = db.DB.ExecContext(ctx,
 				`INSERT INTO agent_memories (workspace_id, content, scope, namespace, created_at) VALUES ($1, $2, $3, $4, $5)`,
 				workspaceID, content, entry.Scope, namespace, entry.CreatedAt,
 			)
 		} else {
-			_, err = db.GetDB().ExecContext(ctx,
+			_, err = db.DB.ExecContext(ctx,
 				`INSERT INTO agent_memories (workspace_id, content, scope, namespace) VALUES ($1, $2, $3, $4)`,
 				workspaceID, content, entry.Scope, namespace,
 			)
@@ -277,7 +277,7 @@ func (h *AdminMemoriesHandler) Import(c *gin.Context) {
 // N_workspaces resolver + N_workspaces plugin in the old code).
 func (h *AdminMemoriesHandler) exportViaPlugin(c *gin.Context, ctx context.Context) {
 	// 1. One SQL pass: every workspace + its root id.
-	wsRows, err := loadWorkspacesWithRoots(ctx, db.GetDB())
+	wsRows, err := loadWorkspacesWithRoots(ctx, db.DB)
 	if err != nil {
 		log.Printf("admin/memories/export (cutover): workspaces query: %v", err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "export query failed"})
@@ -445,7 +445,7 @@ func (h *AdminMemoriesHandler) importViaPlugin(c *gin.Context, ctx context.Conte

 	for _, entry := range entries {
 		var workspaceID string
-		if err := db.GetDB().QueryRowContext(ctx,
+		if err := db.DB.QueryRowContext(ctx,
 			`SELECT id::text FROM workspaces WHERE name = $1 LIMIT 1`,
 			entry.WorkspaceName,
 		).Scan(&workspaceID); err != nil {
@@ -71,7 +71,7 @@ func (h *AdminPluginDriftHandler) Apply(c *gin.Context) {
 		TrackedRef string `json:"tracked_ref"`
 		Status     string `json:"status"`
 	}
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		SELECT workspace_id, plugin_name, tracked_ref, status
 		  FROM plugin_update_queue
 		 WHERE id = $1
@@ -108,7 +108,7 @@ func (h *AdminPluginDriftHandler) Apply(c *gin.Context) {

 	// Step 2: read the workspace_plugins row to get source_raw.
 	var sourceRaw string
-	err = db.GetDB().QueryRowContext(ctx, `
+	err = db.DB.QueryRowContext(ctx, `
 		SELECT source_raw FROM workspace_plugins
 		 WHERE workspace_id = $1 AND plugin_name = $2
 	`, entry.WorkspaceID, entry.PluginName).Scan(&sourceRaw)
@@ -177,7 +177,7 @@ func (h *AdminPluginDriftHandler) Apply(c *gin.Context) {
 	}

 	// Step 4: mark queue entry as applied.
-	if _, err := db.GetDB().ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		UPDATE plugin_update_queue SET status = 'applied' WHERE id = $1
 	`, queueID); err != nil {
 		log.Printf("AdminPluginDrift: apply: failed to mark queue entry %s as applied: %v", queueID, err)
@@ -69,7 +69,7 @@ func (h *AdminSchedulesHealthHandler) Health(c *gin.Context) {
 	ctx := c.Request.Context()
 	now := time.Now()

-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT
 			w.id          AS workspace_id,
 			w.name        AS workspace_name,
@@ -80,7 +80,7 @@ func (h *AdminTestTokenHandler) GetTestToken(c *gin.Context) {
 	// Confirm the workspace exists — a missing workspace also 404s so we
 	// can't be used to probe for arbitrary IDs.
 	var exists string
-	err := db.GetDB().QueryRowContext(c.Request.Context(),
+	err := db.DB.QueryRowContext(c.Request.Context(),
 		`SELECT id FROM workspaces WHERE id = $1`, workspaceID).Scan(&exists)
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -91,7 +91,7 @@ func (h *AdminTestTokenHandler) GetTestToken(c *gin.Context) {
 		return
 	}

-	token, err := wsauth.IssueToken(c.Request.Context(), db.GetDB(), workspaceID)
+	token, err := wsauth.IssueToken(c.Request.Context(), db.DB, workspaceID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "token issue failed"})
 		return
@@ -123,7 +123,7 @@ func TestAdminTestToken_HappyPath_TokenValidates(t *testing.T) {
 	mock.ExpectExec("UPDATE workspace_auth_tokens SET last_used_at").
 		WillReturnResult(sqlmock.NewResult(0, 1))

-	if err := wsauth.ValidateToken(c.Request.Context(), db.GetDB(), "ws-1", resp.AuthToken); err != nil {
+	if err := wsauth.ValidateToken(c.Request.Context(), db.DB, "ws-1", resp.AuthToken); err != nil {
 		t.Errorf("issued token failed to validate: %v", err)
 	}
 }
@@ -33,7 +33,7 @@ func (h *AgentHandler) Assign(c *gin.Context) {

 	// Check workspace exists
 	var status string
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT status FROM workspaces WHERE id = $1`, workspaceID).Scan(&status)
 	if err == sql.ErrNoRows {
 		c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
@@ -46,7 +46,7 @@ func (h *AgentHandler) Assign(c *gin.Context) {

 	// Check no active agent already assigned
 	var existingCount int
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT COUNT(*) FROM agents WHERE workspace_id = $1 AND status = 'active'`, workspaceID,
 	).Scan(&existingCount); err != nil {
 		log.Printf("Agent assign check error: %v", err)
@@ -60,7 +60,7 @@ func (h *AgentHandler) Assign(c *gin.Context) {

 	// Insert agent
 	var agentID string
-	err = db.GetDB().QueryRowContext(ctx,
+	err = db.DB.QueryRowContext(ctx,
 		`INSERT INTO agents (workspace_id, model) VALUES ($1, $2) RETURNING id`, workspaceID, body.Model,
 	).Scan(&agentID)
 	if err != nil {
@@ -92,7 +92,7 @@ func (h *AgentHandler) Replace(c *gin.Context) {

 	// Deactivate current agent
 	var oldModel string
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`UPDATE agents SET status = 'replaced', removed_at = now(), removal_reason = 'model_replaced'
 		 WHERE workspace_id = $1 AND status = 'active' RETURNING model`,
 		workspaceID,
@@ -109,7 +109,7 @@ func (h *AgentHandler) Replace(c *gin.Context) {

 	// Insert new agent
 	var agentID string
-	err = db.GetDB().QueryRowContext(ctx,
+	err = db.DB.QueryRowContext(ctx,
 		`INSERT INTO agents (workspace_id, model) VALUES ($1, $2) RETURNING id`, workspaceID, body.Model,
 	).Scan(&agentID)
 	if err != nil {
@@ -133,7 +133,7 @@ func (h *AgentHandler) Remove(c *gin.Context) {
 	ctx := c.Request.Context()

 	var agentID, model string
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`UPDATE agents SET status = 'removed', removed_at = now(), removal_reason = 'manual_removal'
 		 WHERE workspace_id = $1 AND status = 'active' RETURNING id, model`,
 		workspaceID,
@@ -171,7 +171,7 @@ func (h *AgentHandler) Move(c *gin.Context) {

 	// Check target workspace exists
 	var targetStatus string
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT status FROM workspaces WHERE id = $1`, body.TargetWorkspaceID).Scan(&targetStatus)
 	if err == sql.ErrNoRows {
 		c.JSON(http.StatusNotFound, gin.H{"error": "target workspace not found"})
@@ -185,7 +185,7 @@ func (h *AgentHandler) Move(c *gin.Context) {

 	// Check target doesn't already have an agent
 	var targetAgentCount int
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT COUNT(*) FROM agents WHERE workspace_id = $1 AND status = 'active'`, body.TargetWorkspaceID,
 	).Scan(&targetAgentCount); err != nil {
 		log.Printf("Move agent target check error: %v", err)
@@ -199,7 +199,7 @@ func (h *AgentHandler) Move(c *gin.Context) {

 	// Move the agent: update workspace_id
 	var agentID, model string
-	err = db.GetDB().QueryRowContext(ctx,
+	err = db.DB.QueryRowContext(ctx,
 		`UPDATE agents SET workspace_id = $2
 		 WHERE workspace_id = $1 AND status = 'active' RETURNING id, model`,
 		sourceID, body.TargetWorkspaceID,
@@ -54,11 +54,6 @@ import (
 // timeout) surface as wrapped errors and should be treated as 503.
 var ErrWorkspaceNotFound = errors.New("agent_message: workspace not found")

-// ErrTalkToUserDisabled is returned when the workspace has
-// talk_to_user_enabled=false. Callers surface HTTP 403 so the Python tool
-// can detect it and suggest forwarding to a parent workspace.
-var ErrTalkToUserDisabled = errors.New("agent_message: talk_to_user disabled")
-
 // AgentMessageAttachment is one file attached to an agent → user
 // message. Identical to handlers.NotifyAttachment in field set; kept
 // distinct so the writer's API doesn't import a handler type with HTTP
@@ -112,20 +107,16 @@ func (w *AgentMessageWriter) Send(
 	// notify call surfaced as "workspace not found" and masked real
 	// incidents in the alert path.
 	var wsName string
-	var talkToUserEnabled bool
 	err := w.db.QueryRowContext(ctx,
-		`SELECT name, talk_to_user_enabled FROM workspaces WHERE id = $1 AND status != 'removed'`,
+		`SELECT name FROM workspaces WHERE id = $1 AND status != 'removed'`,
 		workspaceID,
-	).Scan(&wsName, &talkToUserEnabled)
+	).Scan(&wsName)
 	if errors.Is(err, sql.ErrNoRows) {
 		return ErrWorkspaceNotFound
 	}
 	if err != nil {
 		return fmt.Errorf("agent_message: workspace lookup: %w", err)
 	}
-	if !talkToUserEnabled {
-		return ErrTalkToUserDisabled
-	}

 	// 2. Build broadcast payload + WS-emit. Same shape that ChatTab's
 	//    AGENT_MESSAGE handler in canvas/src/store/canvas-events.ts has
@@ -86,11 +86,11 @@ func (c *capturingEmitter) RecordAndBroadcast(_ context.Context, eventType strin
 // path: workspace lookup, broadcast, INSERT, return nil.
 func TestAgentMessageWriter_Send_Success_NoAttachments(t *testing.T) {
 	mock := setupTestDB(t)
-	w := NewAgentMessageWriter(db.GetDB(), newTestBroadcaster())
+	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-1").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))

 	mock.ExpectExec(`INSERT INTO activity_logs.*'a2a_receive'.*'notify'`).
 		WithArgs(
@@ -114,11 +114,11 @@ func TestAgentMessageWriter_Send_Success_NoAttachments(t *testing.T) {
 // Drift here = chips disappear on chat reload.
 func TestAgentMessageWriter_Send_Success_WithAttachments(t *testing.T) {
 	mock := setupTestDB(t)
-	w := NewAgentMessageWriter(db.GetDB(), newTestBroadcaster())
+	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-att").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("Ryan", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("Ryan"))

 	mock.ExpectExec(`INSERT INTO activity_logs.*'a2a_receive'.*'notify'`).
 		WithArgs(
@@ -171,11 +171,11 @@ func TestAgentMessageWriter_Send_Success_WithAttachments(t *testing.T) {
 func TestAgentMessageWriter_Send_WorkspaceNotFound(t *testing.T) {
 	mock := setupTestDB(t)
 	emitter := &capturingEmitter{}
-	w := NewAgentMessageWriter(db.GetDB(), emitter)
+	w := NewAgentMessageWriter(db.DB, emitter)

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-missing").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}))

 	err := w.Send(context.Background(), "ws-missing", "lost in the void", nil)
 	if !errors.Is(err, ErrWorkspaceNotFound) {
@@ -200,11 +200,11 @@ func TestAgentMessageWriter_Send_WorkspaceNotFound(t *testing.T) {
 // broadcast.
 func TestAgentMessageWriter_Send_DBInsertFailureStillReturnsNil(t *testing.T) {
 	mock := setupTestDB(t)
-	w := NewAgentMessageWriter(db.GetDB(), newTestBroadcaster())
+	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-dbfail").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))

 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WillReturnError(errors.New("transient db error"))
@@ -221,11 +221,11 @@ func TestAgentMessageWriter_Send_DBInsertFailureStillReturnsNil(t *testing.T) {
 // table doesn't carry multi-KB summaries that bloat list queries.
 func TestAgentMessageWriter_Send_PreviewTruncation(t *testing.T) {
 	mock := setupTestDB(t)
-	w := NewAgentMessageWriter(db.GetDB(), newTestBroadcaster())
+	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-trunc").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("Ryan", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("Ryan"))

 	longMsg := strings.Repeat("x", 200)
 	mock.ExpectExec(`INSERT INTO activity_logs`).
@@ -261,11 +261,11 @@ func TestAgentMessageWriter_Send_PreviewTruncation(t *testing.T) {
 func TestAgentMessageWriter_Send_BroadcastsAgentMessageEvent(t *testing.T) {
 	mock := setupTestDB(t)
 	emitter := &capturingEmitter{}
-	w := NewAgentMessageWriter(db.GetDB(), emitter)
+	w := NewAgentMessageWriter(db.DB, emitter)

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-bc").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("Workspace Name", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("Workspace Name"))
 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WillReturnResult(sqlmock.NewResult(1, 1))

@@ -312,10 +312,10 @@ func TestAgentMessageWriter_Send_BroadcastsAgentMessageEvent(t *testing.T) {
 // real incidents in alerting.
 func TestAgentMessageWriter_Send_DBErrorOnLookupReturnsWrapped(t *testing.T) {
 	mock := setupTestDB(t)
-	w := NewAgentMessageWriter(db.GetDB(), newTestBroadcaster())
+	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())

 	transientErr := errors.New("connection refused")
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-dbdown").
 		WillReturnError(transientErr)

@@ -344,15 +344,15 @@ func TestAgentMessageWriter_Send_DBErrorOnLookupReturnsWrapped(t *testing.T) {
 // coverage. Now it does.
 func TestAgentMessageWriter_Send_NonASCIIMessagePersists(t *testing.T) {
 	mock := setupTestDB(t)
-	w := NewAgentMessageWriter(db.GetDB(), newTestBroadcaster())
+	w := NewAgentMessageWriter(db.DB, newTestBroadcaster())

 	// 200-rune CJK message — exceeds the 80-rune cap, would have hit
 	// the byte-slice bug.
 	msg := strings.Repeat("你", 200)

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-cjk").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))

 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WithArgs(
@@ -393,11 +393,11 @@ func TestAgentMessageWriter_Send_NonASCIIMessagePersists(t *testing.T) {
 func TestAgentMessageWriter_Send_OmitsAttachmentsKeyWhenEmpty(t *testing.T) {
 	mock := setupTestDB(t)
 	emitter := &capturingEmitter{}
-	w := NewAgentMessageWriter(db.GetDB(), emitter)
+	w := NewAgentMessageWriter(db.DB, emitter)

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-noatt").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("X", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("X"))
 	mock.ExpectExec(`INSERT INTO activity_logs`).
 		WillReturnResult(sqlmock.NewResult(1, 1))

@@ -40,7 +40,7 @@ func (h *ApprovalsHandler) Create(c *gin.Context) {
 	}

 	var approvalID string
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		INSERT INTO approval_requests (workspace_id, task_id, action, reason, context)
 		VALUES ($1, $2, $3, $4, $5::jsonb)
 		RETURNING id
@@ -60,7 +60,7 @@ func (h *ApprovalsHandler) Create(c *gin.Context) {

 	// Auto-escalate to parent
 	var parentID *string
-	db.GetDB().QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID)
+	db.DB.QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID)
 	if parentID != nil {
 		h.broadcaster.RecordAndBroadcast(ctx, string(events.EventApprovalEscalated), *parentID, map[string]interface{}{
 			"approval_id":       approvalID,
@@ -80,12 +80,12 @@ func (h *ApprovalsHandler) ListAll(c *gin.Context) {
 	ctx := c.Request.Context()

 	// Auto-expire stale approvals (older than 10 min)
-	db.GetDB().ExecContext(ctx, `
+	db.DB.ExecContext(ctx, `
 		UPDATE approval_requests SET status = 'denied', decided_by = 'auto-expired', decided_at = now()
 		WHERE status = 'pending' AND created_at < now() - interval '10 minutes'
 	`)

-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT a.id, a.workspace_id, w.name, a.action, a.reason, a.status, a.created_at
 		FROM approval_requests a
 		JOIN workspaces w ON w.id = a.workspace_id
@@ -116,9 +116,6 @@ func (h *ApprovalsHandler) ListAll(c *gin.Context) {
 			"created_at":     createdAt,
 		})
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ListPendingApprovals rows.Err: %v", err)
-	}

 	c.JSON(http.StatusOK, approvals)
 }
@@ -128,7 +125,7 @@ func (h *ApprovalsHandler) List(c *gin.Context) {
 	workspaceID := c.Param("id")
 	ctx := c.Request.Context()

-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT id, task_id, action, reason, status, decided_by, decided_at, created_at
 		FROM approval_requests WHERE workspace_id = $1
 		ORDER BY created_at DESC LIMIT 50
@@ -158,9 +155,6 @@ func (h *ApprovalsHandler) List(c *gin.Context) {
 			"created_at": createdAt,
 		})
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ListApprovals rows.Err workspace=%s: %v", workspaceID, err)
-	}

 	c.JSON(http.StatusOK, approvals)
 }
@@ -190,7 +184,7 @@ func (h *ApprovalsHandler) Decide(c *gin.Context) {
 		decidedBy = "human"
 	}

-	result, err := db.GetDB().ExecContext(ctx, `
+	result, err := db.DB.ExecContext(ctx, `
 		UPDATE approval_requests
 		SET status = $1, decided_by = $2, decided_at = now()
 		WHERE id = $3 AND workspace_id = $4 AND status = 'pending'
@@ -130,7 +130,7 @@ func (h *ArtifactsHandler) Create(c *gin.Context) {

 	// Reject if already linked.
 	var exists bool
-	db.GetDB().QueryRowContext(ctx,
+	db.DB.QueryRowContext(ctx,
 		`SELECT EXISTS(SELECT 1 FROM workspace_artifacts WHERE workspace_id = $1)`,
 		workspaceID,
 	).Scan(&exists)
@@ -193,7 +193,7 @@ func (h *ArtifactsHandler) Create(c *gin.Context) {
 	remoteURL := stripCredentials(repo.RemoteURL)

 	var row workspaceArtifactRow
-	err = db.GetDB().QueryRowContext(ctx, `
+	err = db.DB.QueryRowContext(ctx, `
 		INSERT INTO workspace_artifacts
 			(workspace_id, cf_repo_name, cf_namespace, remote_url, description)
 		VALUES ($1, $2, $3, $4, $5)
@@ -223,7 +223,7 @@ func (h *ArtifactsHandler) Get(c *gin.Context) {
 	ctx := c.Request.Context()

 	var row workspaceArtifactRow
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		SELECT id, workspace_id, cf_repo_name, cf_namespace, remote_url, description, created_at, updated_at
 		FROM workspace_artifacts
 		WHERE workspace_id = $1
@@ -287,7 +287,7 @@ func (h *ArtifactsHandler) Fork(c *gin.Context) {

 	// Look up the source repo name.
 	var cfRepoName string
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT cf_repo_name FROM workspace_artifacts WHERE workspace_id = $1`,
 		workspaceID,
 	).Scan(&cfRepoName)
@@ -352,7 +352,7 @@ func (h *ArtifactsHandler) Token(c *gin.Context) {

 	// Look up the linked CF repo name.
 	var cfRepoName string
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT cf_repo_name FROM workspace_artifacts WHERE workspace_id = $1`,
 		workspaceID,
 	).Scan(&cfRepoName)
@@ -179,7 +179,7 @@ func (h *AuditHandler) Query(c *gin.Context) {
 	// Count total matching rows (for pagination) ----------------------------
 	countQuery := "SELECT COUNT(*) FROM audit_events " + where
 	var total int
-	if err := db.GetDB().QueryRowContext(ctx, countQuery, args...).Scan(&total); err != nil {
+	if err := db.DB.QueryRowContext(ctx, countQuery, args...).Scan(&total); err != nil {
 		log.Printf("audit: count query failed for workspace %s: %v", workspaceID, err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
 		return
@@ -192,7 +192,7 @@ func (h *AuditHandler) Query(c *gin.Context) {
 		FROM audit_events ` + where +
 		fmt.Sprintf(" ORDER BY timestamp ASC, id ASC LIMIT $%d OFFSET $%d", idx, idx+1)

-	rows, err := db.GetDB().QueryContext(ctx, selectQuery, append(args, limit, offset)...)
+	rows, err := db.DB.QueryContext(ctx, selectQuery, append(args, limit, offset)...)
 	if err != nil {
 		log.Printf("audit: query failed for workspace %s: %v", workspaceID, err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
@@ -42,7 +42,7 @@ func (h *BudgetHandler) GetBudget(c *gin.Context) {

 	var budgetLimit sql.NullInt64
 	var monthlySpend int64
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT budget_limit, COALESCE(monthly_spend, 0)
 		 FROM workspaces
 		 WHERE id = $1 AND status != 'removed'`,
@@ -119,7 +119,7 @@ func (h *BudgetHandler) PatchBudget(c *gin.Context) {

 	// Existence check — return 404 for non-existent / removed workspaces.
 	var exists bool
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT EXISTS(SELECT 1 FROM workspaces WHERE id = $1 AND status != 'removed')`,
 		workspaceID,
 	).Scan(&exists); err != nil || !exists {
@@ -127,7 +127,7 @@ func (h *BudgetHandler) PatchBudget(c *gin.Context) {
 		return
 	}

-	if _, err := db.GetDB().ExecContext(ctx,
+	if _, err := db.DB.ExecContext(ctx,
 		`UPDATE workspaces SET budget_limit = $2, updated_at = now() WHERE id = $1`,
 		workspaceID, budgetArg,
 	); err != nil {
@@ -140,7 +140,7 @@ func (h *BudgetHandler) PatchBudget(c *gin.Context) {
 	// the DB, including the monthly_spend the agent has already accumulated.
 	var newLimit sql.NullInt64
 	var monthlySpend int64
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT budget_limit, COALESCE(monthly_spend, 0) FROM workspaces WHERE id = $1`,
 		workspaceID,
 	).Scan(&newLimit, &monthlySpend); err != nil {
@@ -41,7 +41,7 @@ func (h *ChannelHandler) List(c *gin.Context) {
 	workspaceID := c.Param("id")
 	ctx := c.Request.Context()

-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT id, workspace_id, channel_type, channel_config, enabled, allowed_users,
 		       last_message_at, message_count, created_at, updated_at
 		FROM workspace_channels WHERE workspace_id = $1
@@ -166,7 +166,7 @@ func (h *ChannelHandler) Create(c *gin.Context) {
 	}

 	var id string
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		INSERT INTO workspace_channels (workspace_id, channel_type, channel_config, enabled, allowed_users)
 		VALUES ($1, $2, $3::jsonb, $4, $5::jsonb)
 		RETURNING id
@@ -222,7 +222,7 @@ func (h *ChannelHandler) Update(c *gin.Context) {
 		allowedArg = string(j)
 	}

-	result, err := db.GetDB().ExecContext(ctx, `
+	result, err := db.DB.ExecContext(ctx, `
 		UPDATE workspace_channels
 		SET channel_config = COALESCE($3::jsonb, channel_config),
 		    allowed_users = COALESCE($4::jsonb, allowed_users),
@@ -252,7 +252,7 @@ func (h *ChannelHandler) Delete(c *gin.Context) {
 	channelID := c.Param("channelId")
 	ctx := c.Request.Context()

-	result, err := db.GetDB().ExecContext(ctx, `
+	result, err := db.DB.ExecContext(ctx, `
 		DELETE FROM workspace_channels WHERE id = $1 AND workspace_id = $2
 	`, channelID, workspaceID)
 	if err != nil {
@@ -291,7 +291,7 @@ func (h *ChannelHandler) Send(c *gin.Context) {
 	// transient DB hiccup doesn't silently block outbound messages.
 	var msgCount int
 	var budget sql.NullInt64
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT message_count, channel_budget FROM workspace_channels WHERE id = $1`,
 		channelID,
 	).Scan(&msgCount, &budget); err != nil && err != sql.ErrNoRows {
@@ -476,7 +476,7 @@ func (h *ChannelHandler) Webhook(c *gin.Context) {
 	}

 	// Look up channels by type and find one whose chat_id list contains msg.ChatID.
-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT id, workspace_id, channel_type, channel_config, enabled, allowed_users
 		FROM workspace_channels
 		WHERE channel_type = $1 AND enabled = true
@@ -577,7 +577,7 @@ func (h *ChannelHandler) Webhook(c *gin.Context) {
 // the incoming request with 401 (fail-closed behaviour).
 func discordPublicKey(ctx context.Context) string {
 	var pubKey string
-	row := db.GetDB().QueryRowContext(ctx, `
+	row := db.DB.QueryRowContext(ctx, `
 		SELECT COALESCE(channel_config->>'app_public_key', '')
 		FROM workspace_channels
 		WHERE channel_type = 'discord' AND enabled = true
@@ -328,207 +328,6 @@ func TestChannelHandler_Send_EmptyText(t *testing.T) {
 	}
 }

-// ==================== Test (send outbound) ====================
-
-// TestChannelHandler_Test_Success exercises the /channels/:channelId/test endpoint
-// with a mock SendAdapter so the full success path is covered without hitting real
-// Telegram/Slack/etc. APIs.
-func TestChannelHandler_Test_Success(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewChannelHandler(newTestChannelManager())
-
-	mockAdapter := &channels.MockSendAdapter{Err: nil}
-	channels.SetGetSendAdapter(func(ct string) (channels.SendAdapter, bool) {
-		if ct == "telegram" {
-			return mockAdapter, true
-		}
-		return channels.GetSendAdapter(ct)
-	})
-	t.Cleanup(channels.ResetSendAdapters)
-
-	// loadChannel → valid row
-	mock.ExpectQuery("SELECT .+ FROM workspace_channels WHERE id").
-		WithArgs("ch-test-ok").
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "workspace_id", "channel_type", "channel_config",
-			"enabled", "allowed_users",
-		}).AddRow("ch-test-ok", "ws-1", "telegram",
-			`{"bot_token":"123:AAA","chat_id":"-100"}`,
-			true, `[]`))
-
-	// UPDATE message_count + last_message_at
-	mock.ExpectExec("UPDATE workspace_channels SET last_message_at").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/channels/ch-test-ok/test", nil)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "channelId", Value: "ch-test-ok"}}
-
-	handler.Test(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["status"] != "ok" {
-		t.Errorf("expected status 'ok', got %v", resp["status"])
-	}
-	if mockAdapter.Calls != 1 {
-		t.Errorf("expected SendMessage called once, got %d", mockAdapter.Calls)
-	}
-	if mockAdapter.SentChat != "-100" {
-		t.Errorf("expected chat_id '-100', got %q", mockAdapter.SentChat)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// TestChannelHandler_Test_ChannelNotFound verifies that when loadChannel returns
-// no rows, the Test handler returns 500 with a "test message failed" error.
-func TestChannelHandler_Test_ChannelNotFound(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewChannelHandler(newTestChannelManager())
-
-	// loadChannel → no rows
-	mock.ExpectQuery("SELECT .+ FROM workspace_channels WHERE id").
-		WithArgs("ch-missing").
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "workspace_id", "channel_type", "channel_config",
-			"enabled", "allowed_users",
-		}))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/channels/ch-missing/test", nil)
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "channelId", Value: "ch-missing"}}
-
-	handler.Test(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 for missing channel, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["error"] != "test message failed" {
-		t.Errorf("expected error 'test message failed', got %v", resp["error"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// TestChannelHandler_Send_Success covers the full outbound send success path:
-// budget check passes → loadChannel → mock SendMessage succeeds → UPDATE count → 200.
-func TestChannelHandler_Send_Success(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewChannelHandler(newTestChannelManager())
-
-	mockAdapter := &channels.MockSendAdapter{Err: nil}
-	channels.SetGetSendAdapter(func(ct string) (channels.SendAdapter, bool) {
-		if ct == "telegram" {
-			return mockAdapter, true
-		}
-		return channels.GetSendAdapter(ct)
-	})
-	t.Cleanup(channels.ResetSendAdapters)
-
-	// Budget check: count=0, no budget limit
-	mock.ExpectQuery("SELECT message_count, channel_budget FROM workspace_channels WHERE id").
-		WithArgs("ch-send-ok").
-		WillReturnRows(sqlmock.NewRows([]string{"message_count", "channel_budget"}).
-			AddRow(0, nil))
-
-	// loadChannel → valid row
-	mock.ExpectQuery("SELECT .+ FROM workspace_channels WHERE id").
-		WithArgs("ch-send-ok").
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "workspace_id", "channel_type", "channel_config",
-			"enabled", "allowed_users",
-		}).AddRow("ch-send-ok", "ws-1", "telegram",
-			`{"bot_token":"123:AAA","chat_id":"-100"}`,
-			true, `[]`))
-
-	// UPDATE message_count
-	mock.ExpectExec("UPDATE workspace_channels SET last_message_at").
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	body, _ := json.Marshal(map[string]string{"text": "hello from test"})
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/channels/ch-send-ok/send", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "channelId", Value: "ch-send-ok"}}
-
-	handler.Send(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["status"] != "sent" {
-		t.Errorf("expected status 'sent', got %v", resp["status"])
-	}
-	if mockAdapter.Calls != 1 {
-		t.Errorf("expected SendMessage called once, got %d", mockAdapter.Calls)
-	}
-	if mockAdapter.SentText != "hello from test" {
-		t.Errorf("expected 'hello from test', got %q", mockAdapter.SentText)
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
-// TestChannelHandler_Send_ChannelNotFound verifies that after the budget check
-// passes, a missing channel returns 500 (not 404) with "send failed".
-func TestChannelHandler_Send_ChannelNotFound(t *testing.T) {
-	mock := setupTestDB(t)
-	setupTestRedis(t)
-	handler := NewChannelHandler(newTestChannelManager())
-
-	// Budget check passes (NULL budget → no limit)
-	mock.ExpectQuery("SELECT message_count, channel_budget FROM workspace_channels WHERE id").
-		WithArgs("ch-send-missing").
-		WillReturnRows(sqlmock.NewRows([]string{"message_count", "channel_budget"}).
-			AddRow(0, nil))
-
-	// loadChannel → no rows
-	mock.ExpectQuery("SELECT .+ FROM workspace_channels WHERE id").
-		WithArgs("ch-send-missing").
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "workspace_id", "channel_type", "channel_config",
-			"enabled", "allowed_users",
-		}))
-
-	body, _ := json.Marshal(map[string]string{"text": "hello"})
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Request = httptest.NewRequest("POST", "/workspaces/ws-1/channels/ch-send-missing/send", bytes.NewReader(body))
-	c.Request.Header.Set("Content-Type", "application/json")
-	c.Params = gin.Params{{Key: "id", Value: "ws-1"}, {Key: "channelId", Value: "ch-send-missing"}}
-
-	handler.Send(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("expected 500 for missing channel, got %d: %s", w.Code, w.Body.String())
-	}
-	var resp map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &resp)
-	if resp["error"] != "send failed" {
-		t.Errorf("expected error 'send failed', got %v", resp["error"])
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("sqlmock expectations not met: %v", err)
-	}
-}
-
 // ==================== Webhook ====================

 func TestChannelHandler_Webhook_UnknownType(t *testing.T) {
@@ -566,7 +365,7 @@ func TestChannelHandler_Discover_MissingToken(t *testing.T) {
 }

 func TestChannelHandler_Discover_UnsupportedType(t *testing.T) {
-	// Set up db.GetDB() so PausePollersForToken (called inside Discover) doesn't panic.
+	// Set up db.DB so PausePollersForToken (called inside Discover) doesn't panic.
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("sqlmock: %v", err)
@@ -603,7 +402,7 @@ func TestChannelHandler_Discover_UnsupportedType(t *testing.T) {
 }

 func TestChannelHandler_Discover_InvalidBotToken(t *testing.T) {
-	// Set up db.GetDB() so PausePollersForToken (called inside Discover) doesn't panic.
+	// Set up db.DB so PausePollersForToken (called inside Discover) doesn't panic.
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("sqlmock: %v", err)
@@ -133,7 +133,7 @@ const chatUploadMaxBytes = 50 * 1024 * 1024
 // extraction prevents that class on the consumer side.
 func resolveWorkspaceForwardCreds(c *gin.Context, ctx context.Context, workspaceID, op string) (wsURL, secret string, ok bool) {
 	var deliveryMode sql.NullString
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT COALESCE(url, ''), delivery_mode FROM workspaces WHERE id = $1`, workspaceID,
 	).Scan(&wsURL, &deliveryMode); err != nil {
 		log.Printf("chat_files %s: workspace lookup failed for %s: %v", op, workspaceID, err)
@@ -468,7 +468,7 @@ func (h *ChatFilesHandler) streamWorkspaceResponse(
 // the workspace-side row IS the source of truth for the mode).
 func lookupUploadDeliveryMode(c *gin.Context, ctx context.Context, workspaceID string) (string, bool) {
 	var mode sql.NullString
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT delivery_mode FROM workspaces WHERE id = $1`, workspaceID,
 	).Scan(&mode)
 	if errors.Is(err, sql.ErrNoRows) {
@@ -656,7 +656,7 @@ func (h *ChatFilesHandler) uploadPollMode(c *gin.Context, ctx context.Context, w
 	// Commit — emitting an ACTIVITY_LOGGED event for a row that ends up
 	// rolled back would leak a ghost message into the canvas's
 	// optimistic UI.
-	tx, err := db.GetDB().BeginTx(ctx, nil)
+	tx, err := db.DB.BeginTx(ctx, nil)
 	if err != nil {
 		log.Printf("chat_files uploadPollMode: begin tx for %s: %v", workspaceID, err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "could not stage files"})
@@ -3,7 +3,7 @@ package handlers
 // Unit tests for chat_files.go.
 //
 // Upload (HTTP-forward, RFC #2312 PR-C): exercised against an httptest
-// mock workspace + sqlmock-backed db.GetDB(). The platform-side handler is
+// mock workspace + sqlmock-backed db.DB. The platform-side handler is
 // now a streaming proxy; assertions focus on:
 //   * input validation (400 on bad workspace id)
 //   * resolution failures (404 missing row, 503 missing secret/url)
@@ -15,7 +15,7 @@ type CheckpointsHandler struct {
 	db *sql.DB
 }

-// NewCheckpointsHandler wires the handler to the given database. Pass db.GetDB()
+// NewCheckpointsHandler wires the handler to the given database. Pass db.DB
 // at router-setup time; pass a sqlmock DB in tests.
 func NewCheckpointsHandler(database *sql.DB) *CheckpointsHandler {
 	return &CheckpointsHandler{db: database}
@@ -18,7 +18,7 @@ import (
 func newCheckpointsHandler(t *testing.T, mock sqlmock.Sqlmock) *CheckpointsHandler {
 	t.Helper()
 	_ = mock // surfaced for callers that need to set expectations
-	return NewCheckpointsHandler(db.GetDB())
+	return NewCheckpointsHandler(db.DB)
 }

 // ---------- Upsert ----------
@@ -20,7 +20,7 @@ func (h *ConfigHandler) Get(c *gin.Context) {
 	workspaceID := c.Param("id")

 	var data []byte
-	err := db.GetDB().QueryRowContext(c.Request.Context(),
+	err := db.DB.QueryRowContext(c.Request.Context(),
 		`SELECT data FROM workspace_config WHERE workspace_id = $1`,
 		workspaceID,
 	).Scan(&data)
@@ -58,7 +58,7 @@ func (h *ConfigHandler) Patch(c *gin.Context) {
 		return
 	}

-	_, err = db.GetDB().ExecContext(c.Request.Context(), `
+	_, err = db.DB.ExecContext(c.Request.Context(), `
 		INSERT INTO workspace_config(workspace_id, data, updated_at)
 		VALUES($1, $2::jsonb, NOW())
 		ON CONFLICT(workspace_id) DO UPDATE
@@ -31,7 +31,7 @@ func (h *TemplatesHandler) findContainer(ctx context.Context, workspaceID string
 	}
 	// Also check by workspace name from DB
 	var wsName string
-	db.GetDB().QueryRowContext(ctx, `SELECT LOWER(REPLACE(name, ' ', '-')) FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName)
+	db.DB.QueryRowContext(ctx, `SELECT LOWER(REPLACE(name, ' ', '-')) FROM workspaces WHERE id = $1`, workspaceID).Scan(&wsName)
 	if wsName != "" {
 		candidates = append(candidates, wsName)
 	}
@@ -68,7 +68,7 @@ func pushDelegationResultToInbox(ctx context.Context, sourceID, delegationID, st
 	if status == "failed" {
 		summary = "Delegation failed"
 	}
-	if _, err := db.GetDB().ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		INSERT INTO activity_logs (
 			workspace_id, activity_type, method, source_id,
 			summary, request_body, response_body, status, error_detail
@@ -207,7 +207,7 @@ func lookupIdempotentDelegation(ctx context.Context, c *gin.Context, sourceID, i
 		return false
 	}
 	var existingID, existingStatus, existingTarget string
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		SELECT request_body->>'delegation_id', status, target_id
 		  FROM activity_logs
 		 WHERE workspace_id = $1 AND idempotency_key = $2
@@ -217,7 +217,7 @@ func lookupIdempotentDelegation(ctx context.Context, c *gin.Context, sourceID, i
 		return false
 	}
 	if existingStatus == "failed" {
-		_, _ = db.GetDB().ExecContext(ctx, `
+		_, _ = db.DB.ExecContext(ctx, `
 			DELETE FROM activity_logs
 			 WHERE workspace_id = $1 AND idempotency_key = $2 AND status = 'failed'
 		`, sourceID, idempotencyKey)
@@ -272,7 +272,7 @@ func insertDelegationRow(ctx context.Context, c *gin.Context, sourceID string, b
 	if body.IdempotencyKey != "" {
 		idemArg = body.IdempotencyKey
 	}
-	_, err := db.GetDB().ExecContext(ctx, `
+	_, err := db.DB.ExecContext(ctx, `
 		INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, target_id, summary, request_body, response_body, status, idempotency_key)
 		VALUES ($1, 'delegation', 'delegate', $2, $3, $4, $5::jsonb, $6::jsonb, 'pending', $7)
 	`, sourceID, sourceID, body.TargetID, "Delegating to "+body.TargetID, string(taskJSON), string(respJSON), idemArg)
@@ -287,7 +287,7 @@ func insertDelegationRow(ctx context.Context, c *gin.Context, sourceID string, b
 	// rather than a generic 500. Re-query to fetch the winner's id.
 	if body.IdempotencyKey != "" {
 		var winnerID, winnerStatus string
-		if qerr := db.GetDB().QueryRowContext(ctx, `
+		if qerr := db.DB.QueryRowContext(ctx, `
 			SELECT request_body->>'delegation_id', status
 			  FROM activity_logs
 			 WHERE workspace_id = $1 AND idempotency_key = $2
@@ -383,7 +383,7 @@ func (h *DelegationHandler) executeDelegation(ctx context.Context, sourceID, tar
 		log.Printf("Delegation %s: failed — %s", delegationID, proxyErr.Error())
 		h.updateDelegationStatus(ctx, sourceID, delegationID, "failed", proxyErr.Error())

-		if _, err := db.GetDB().ExecContext(ctx, `
+		if _, err := db.DB.ExecContext(ctx, `
 			INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, target_id, summary, status, error_detail)
 			VALUES ($1, 'delegation', 'delegate_result', $2, $3, $4, 'failed', $5)
 		`, sourceID, sourceID, targetID, "Delegation failed", proxyErr.Error()); err != nil {
@@ -403,7 +403,7 @@ func (h *DelegationHandler) executeDelegation(ctx context.Context, sourceID, tar
 		log.Printf("Delegation %s: step=handling_failure err=%s", delegationID, errMsg)
 		h.updateDelegationStatus(ctx, sourceID, delegationID, "failed", errMsg)

-		if _, err := db.GetDB().ExecContext(ctx, `
+		if _, err := db.DB.ExecContext(ctx, `
 			INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, target_id, summary, status, error_detail)
 			VALUES ($1, 'delegation', 'delegate_result', $2, $3, $4, 'failed', $5)
 		`, sourceID, sourceID, targetID, "Delegation failed", errMsg); err != nil {
@@ -442,7 +442,7 @@ handleSuccess:
 			"delegation_id": delegationID,
 			"queued":        true,
 		})
-		if _, err := db.GetDB().ExecContext(ctx, `
+		if _, err := db.DB.ExecContext(ctx, `
 			INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, target_id, summary, response_body, status)
 			VALUES ($1, 'delegation', 'delegate_result', $2, $3, $4, $5::jsonb, 'queued')
 		`, sourceID, sourceID, targetID, "Delegation queued — target at capacity", string(queuedJSON)); err != nil {
@@ -465,7 +465,7 @@ handleSuccess:
 		"text":          responseText,
 		"delegation_id": delegationID,
 	})
-	if _, err := db.GetDB().ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, target_id, summary, response_body, status)
 		VALUES ($1, 'delegation', 'delegate_result', $2, $3, $4, $5::jsonb, 'completed')
 	`, sourceID, sourceID, targetID, "Delegation completed ("+textutil.TruncateBytes(responseText, 80)+")", string(respJSON)); err != nil {
@@ -497,7 +497,7 @@ handleSuccess:
 // updateDelegationStatus updates the status of a delegation record in activity_logs.
 // ctx is used for DB operations; caller controls the timeout/retry budget.
 func (h *DelegationHandler) updateDelegationStatus(ctx context.Context, workspaceID, delegationID, status, errorDetail string) {
-	if _, err := db.GetDB().ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		UPDATE activity_logs
 		SET status = $1, error_detail = CASE WHEN $2 = '' THEN error_detail ELSE $2 END
 		WHERE workspace_id = $3
@@ -555,7 +555,7 @@ func (h *DelegationHandler) Record(c *gin.Context) {
 	respJSON, _ := json.Marshal(map[string]interface{}{
 		"delegation_id": body.DelegationID,
 	})
-	if _, err := db.GetDB().ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, target_id, summary, request_body, response_body, status)
 		VALUES ($1, 'delegation', 'delegate', $2, $3, $4, $5::jsonb, $6::jsonb, 'dispatched')
 	`, sourceID, sourceID, body.TargetID, "Delegating to "+body.TargetID, string(taskJSON), string(respJSON)); err != nil {
@@ -622,7 +622,7 @@ func (h *DelegationHandler) UpdateStatus(c *gin.Context) {
 			"text":          body.ResponsePreview,
 			"delegation_id": delegationID,
 		})
-		if _, err := db.GetDB().ExecContext(ctx, `
+		if _, err := db.DB.ExecContext(ctx, `
 			INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, summary, response_body, status)
 			VALUES ($1, 'delegation', 'delegate_result', $2, $3, $4::jsonb, 'completed')
 		`, sourceID, sourceID, "Delegation completed ("+textutil.TruncateBytes(body.ResponsePreview, 80)+")", string(respJSON)); err != nil {
@@ -680,7 +680,7 @@ func (h *DelegationHandler) ListDelegations(c *gin.Context) {
 // listDelegationsFromLedger queries the durable delegations table.
 // Returns nil on error so the caller can fall back to activity_logs.
 func (h *DelegationHandler) listDelegationsFromLedger(ctx context.Context, workspaceID string) []map[string]interface{} {
-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT d.delegation_id, d.caller_id, d.callee_id, d.task_preview,
 		       d.status, d.result_preview, d.error_detail, d.last_heartbeat,
 		       d.deadline, d.created_at, d.updated_at
@@ -746,7 +746,7 @@ func (h *DelegationHandler) listDelegationsFromLedger(ctx context.Context, works
 // Kept for backward compatibility and for workspaces that never had
 // DELEGATION_LEDGER_WRITE=1 during their delegation lifecycle.
 func (h *DelegationHandler) listDelegationsFromActivityLogs(ctx context.Context, workspaceID string) []map[string]interface{} {
-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT id, activity_type, COALESCE(source_id::text, ''), COALESCE(target_id::text, ''),
 		       COALESCE(summary, ''), COALESCE(status, ''), COALESCE(error_detail, ''),
 		       COALESCE(response_body->>'text', response_body::text, ''),
@@ -1,224 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// extractResponseText tests — walks A2A JSON-RPC response bodies and
-// returns the first text part, falling back to raw body on parse failures.
-
-func TestExtractResponseText_PartsWithTextKind(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				map[string]interface{}{"kind": "text", "text": "hello world"},
-				map[string]interface{}{"kind": "text", "text": "second part"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "hello world", extractResponseText(body))
-}
-
-func TestExtractResponseText_PartNotTextKind(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				map[string]interface{}{"kind": "image", "data": "base64..."},
-				map[string]interface{}{"kind": "text", "text": "visible"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "visible", extractResponseText(body))
-}
-
-func TestExtractResponseText_PartsEmpty(t *testing.T) {
-	// Empty parts array — falls through to artifacts, then raw body
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts":     []interface{}{},
-			"artifacts": []interface{}{},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	// Falls through to raw body (which is the JSON string)
-	result := extractResponseText(body)
-	assert.NotEmpty(t, result)
-}
-
-func TestExtractResponseText_ArtifactPartsWithText(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{},
-			"artifacts": []interface{}{
-				map[string]interface{}{
-					"kind": "file",
-					"parts": []interface{}{
-						map[string]interface{}{"kind": "text", "text": "artifact text"},
-					},
-				},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "artifact text", extractResponseText(body))
-}
-
-func TestExtractResponseText_ArtifactPartNotTextKind(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{},
-			"artifacts": []interface{}{
-				map[string]interface{}{
-					"kind": "code",
-					"parts": []interface{}{
-						map[string]interface{}{"kind": "image", "data": "..."},
-						map[string]interface{}{"kind": "text", "text": "code comment"},
-					},
-				},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "code comment", extractResponseText(body))
-}
-
-func TestExtractResponseText_ArtifactsEmpty(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts":     []interface{}{},
-			"artifacts": []interface{}{},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	result := extractResponseText(body)
-	// Falls back to raw body
-	assert.Equal(t, string(body), result)
-}
-
-func TestExtractResponseText_NoResult(t *testing.T) {
-	// No "result" key at all — falls back to raw body
-	body := []byte(`{"error": {"code": -32600, "message": "Invalid Request"}}`)
-	result := extractResponseText(body)
-	assert.Equal(t, string(body), result)
-}
-
-func TestExtractResponseText_ResultNotMap(t *testing.T) {
-	// result is a string, not a map — falls back to raw body
-	body := []byte(`{"result": "just a string"}`)
-	result := extractResponseText(body)
-	assert.Equal(t, string(body), result)
-}
-
-func TestExtractResponseText_NonJSONBody(t *testing.T) {
-	// Non-JSON bytes — returns the raw string
-	body := []byte("plain text response, not JSON at all")
-	result := extractResponseText(body)
-	assert.Equal(t, "plain text response, not JSON at all", result)
-}
-
-func TestExtractResponseText_PartWithNilText(t *testing.T) {
-	// Text field is nil — kind is "text" but text is nil, should skip
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				map[string]interface{}{"kind": "text", "text": nil},
-				map[string]interface{}{"kind": "text", "text": "found"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "found", extractResponseText(body))
-}
-
-func TestExtractResponseText_ArtifactPartWithNilText(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{},
-			"artifacts": []interface{}{
-				map[string]interface{}{
-					"parts": []interface{}{
-						map[string]interface{}{"kind": "text", "text": nil},
-						map[string]interface{}{"kind": "text", "text": "artifact-found"},
-					},
-				},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "artifact-found", extractResponseText(body))
-}
-
-func TestExtractResponseText_PartsWithNonMapElement(t *testing.T) {
-	// parts contains a non-map element — should be skipped gracefully
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				"not a map",
-				123,
-				nil,
-				map[string]interface{}{"kind": "text", "text": "parsed"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "parsed", extractResponseText(body))
-}
-
-func TestExtractResponseText_ArtifactWithNonMapElement(t *testing.T) {
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{},
-			"artifacts": []interface{}{
-				"not a map",
-				nil,
-				map[string]interface{}{
-					"parts": []interface{}{
-						"not a map",
-						map[string]interface{}{"kind": "text", "text": "safe"},
-					},
-				},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "safe", extractResponseText(body))
-}
-
-func TestExtractResponseText_PartKindNotString(t *testing.T) {
-	// kind is an integer, not a string — should be skipped
-	resp := map[string]interface{}{
-		"result": map[string]interface{}{
-			"parts": []interface{}{
-				map[string]interface{}{"kind": 123, "text": "ignored"},
-				map[string]interface{}{"kind": "text", "text": "found"},
-			},
-		},
-	}
-	body, _ := json.Marshal(resp)
-	assert.Equal(t, "found", extractResponseText(body))
-}
-
-func TestExtractResponseText_EmptyResponse(t *testing.T) {
-	body := []byte("{}")
-	result := extractResponseText(body)
-	// Falls back to raw "{}"
-	assert.Equal(t, "{}", result)
-}
-
-func TestExtractResponseText_NilBody(t *testing.T) {
-	// nil byte slice — string(nil) = ""
-	result := extractResponseText(nil)
-	assert.Equal(t, "", result)
-}
-
-func TestExtractResponseText_WhitespaceBody(t *testing.T) {
-	body := []byte("   \n\t  ")
-	result := extractResponseText(body)
-	// Unmarshals to empty map, no result, returns raw string
-	assert.Equal(t, "   \n\t  ", result)
-}
@@ -46,7 +46,7 @@ type DelegationLedger struct {
 // Tests can construct one with a sqlmock-backed *sql.DB.
 func NewDelegationLedger(handle *sql.DB) *DelegationLedger {
 	if handle == nil {
-		handle = db.GetDB()
+		handle = db.DB
 	}
 	return &DelegationLedger{db: handle}
 }
@@ -78,17 +78,11 @@ func integrationDB(t *testing.T) *sql.DB {
 		t.Fatalf("cleanup: %v", err)
 	}
 	// Wire the package-level db.DB so production helpers (recordLedgerInsert,
-	// recordLedgerStatus) see the same connection. Guard the swap with mdb.Lock()
-	// to prevent races with production goroutines that call GetDB() (which
-	// acquires RLock) while t.Cleanup runs concurrently.
+	// recordLedgerStatus) see the same connection.
 	prev := mdb.DB
-	mdb.Lock()
 	mdb.DB = conn
-	mdb.Unlock()
 	t.Cleanup(func() {
-		mdb.Lock()
 		mdb.DB = prev
-		mdb.Unlock()
 		conn.Close()
 	})
 	return conn
@@ -28,7 +28,7 @@ import (

 func TestLedgerInsert_HappyPath(t *testing.T) {
 	mock := setupTestDB(t)
-	l := NewDelegationLedger(nil) // uses package db.GetDB() which sqlmock replaced
+	l := NewDelegationLedger(nil) // uses package db.DB which sqlmock replaced

 	mock.ExpectExec(`INSERT INTO delegations`).
 		WithArgs(
@@ -145,6 +145,52 @@ func TestListDelegationsFromLedger_MultipleRows(t *testing.T) {
 	}
 }

+=======
+func TestListDelegationsFromLedger_NullsOmitted(t *testing.T) {
+	// last_heartbeat, deadline, result_preview, error_detail are all NULL.
+	// Handler must not panic and must omit those keys from the map.
+	mockDB, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prevDB := db.DB
+	db.DB = mockDB
+	t.Cleanup(func() { mockDB.Close(); db.DB = prevDB })
+
+	now := time.Now()
+	rows := sqlmock.NewRows([]string{}).
+		AddRow("del-1", "ws-1", "ws-2", "task", "queued", nil, nil, nil, nil, now, now)
+	mock.ExpectQuery("SELECT .+ FROM delegations").
+		WithArgs("ws-1").
+		WillReturnRows(rows)
+
+	broadcaster := newTestBroadcaster()
+	wh := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())
+	dh := NewDelegationHandler(wh, broadcaster)
+
+	got := dh.listDelegationsFromLedger(context.Background(), "ws-1")
+	if len(got) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(got))
+	}
+	e := got[0]
+	if _, ok := e["last_heartbeat"]; ok {
+		t.Error("last_heartbeat should be absent when NULL")
+	}
+	if _, ok := e["deadline"]; ok {
+		t.Error("deadline should be absent when NULL")
+	}
+	if _, ok := e["response_preview"]; ok {
+		t.Error("response_preview should be absent when NULL result_preview")
+	}
+	if _, ok := e["error"]; ok {
+		t.Error("error should be absent when NULL error_detail")
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("sqlmock expectations: %v", err)
+	}
+}
+
+>>>>>>> 5531b471 (handlers: restore db.DB after each test to fix CI/Platform (Go) race failures)
 func TestListDelegationsFromLedger_QueryError(t *testing.T) {
 	// Query failure returns nil — graceful fallback, no panic.
 	mockDB, mock, err := sqlmock.New()
@@ -439,6 +485,7 @@ func TestListDelegationsFromActivityLogs_RowsErr(t *testing.T) {
 	}
 }

+<<<<<<< HEAD
 // TestListDelegationsFromActivityLogs_ScanErrorSkipped is removed.
 //
 // Same reason as TestListDelegationsFromLedger_ScanError: Go 1.25 causes
@@ -80,13 +80,13 @@ type DelegationSweeper struct {
 	threshold time.Duration
 }

-// NewDelegationSweeper builds a sweeper bound to the package db.GetDB()
+// NewDelegationSweeper builds a sweeper bound to the package db.DB
 // (production wiring) or a test handle. Reads optional env overrides
 // at construction time so a long-running process picks them up via
 // restart, not mid-flight.
 func NewDelegationSweeper(handle *sql.DB, ledger *DelegationLedger) *DelegationSweeper {
 	if handle == nil {
-		handle = db.GetDB()
+		handle = db.DB
 	}
 	if ledger == nil {
 		ledger = NewDelegationLedger(handle)
@@ -73,7 +73,7 @@ func discoverHostPeer(ctx context.Context, c *gin.Context, targetID string) {
 	var url sql.NullString
 	var status string
 	var forwardedTo sql.NullString
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT url, status, forwarded_to FROM workspaces WHERE id = $1`, targetID,
 	).Scan(&url, &status, &forwardedTo)
 	if err == sql.ErrNoRows {
@@ -89,7 +89,7 @@ func discoverHostPeer(ctx context.Context, c *gin.Context, targetID string) {
 	resolvedID := targetID
 	for i := 0; i < 5 && forwardedTo.Valid && forwardedTo.String != ""; i++ {
 		resolvedID = forwardedTo.String
-		err = db.GetDB().QueryRowContext(ctx,
+		err = db.DB.QueryRowContext(ctx,
 			`SELECT url, status, forwarded_to FROM workspaces WHERE id = $1`, resolvedID,
 		).Scan(&url, &status, &forwardedTo)
 		if err != nil {
@@ -128,7 +128,7 @@ func discoverHostPeer(ctx context.Context, c *gin.Context, targetID string) {
 // of `callerID` and writes the JSON response (or an appropriate 404/503 error).
 func discoverWorkspacePeer(ctx context.Context, c *gin.Context, callerID, targetID string) {
 	var wsName, wsRuntime string
-	db.GetDB().QueryRowContext(ctx, `SELECT COALESCE(name,''), COALESCE(runtime,'langgraph') FROM workspaces WHERE id = $1`, targetID).Scan(&wsName, &wsRuntime)
+	db.DB.QueryRowContext(ctx, `SELECT COALESCE(name,''), COALESCE(runtime,'langgraph') FROM workspaces WHERE id = $1`, targetID).Scan(&wsName, &wsRuntime)

 	// External workspaces: return their registered URL.
 	// Rewrite 127.0.0.1/localhost → host.docker.internal ONLY when the
@@ -149,7 +149,7 @@ func discoverWorkspacePeer(ctx context.Context, c *gin.Context, callerID, target
 	}
 	// Fallback: only synthesize a URL if the workspace exists and is online/degraded
 	var wsStatus string
-	dbErr := db.GetDB().QueryRowContext(ctx,
+	dbErr := db.DB.QueryRowContext(ctx,
 		`SELECT status FROM workspaces WHERE id = $1`, targetID,
 	).Scan(&wsStatus)
 	if dbErr == nil && (wsStatus == "online" || wsStatus == "degraded") {
@@ -174,13 +174,13 @@ func discoverWorkspacePeer(ctx context.Context, c *gin.Context, callerID, target
 // file, leaving the caller to fall through to the internal-URL path.
 func writeExternalWorkspaceURL(ctx context.Context, c *gin.Context, callerID, targetID, wsName string) bool {
 	var wsURL string
-	db.GetDB().QueryRowContext(ctx, `SELECT COALESCE(url,'') FROM workspaces WHERE id = $1`, targetID).Scan(&wsURL)
+	db.DB.QueryRowContext(ctx, `SELECT COALESCE(url,'') FROM workspaces WHERE id = $1`, targetID).Scan(&wsURL)
 	if wsURL == "" {
 		return false
 	}
 	outURL := wsURL
 	var callerRuntime string
-	db.GetDB().QueryRowContext(ctx, `SELECT COALESCE(runtime,'langgraph') FROM workspaces WHERE id = $1`, callerID).Scan(&callerRuntime)
+	db.DB.QueryRowContext(ctx, `SELECT COALESCE(runtime,'langgraph') FROM workspaces WHERE id = $1`, callerID).Scan(&callerRuntime)
 	if !isExternalLikeRuntime(callerRuntime) {
 		outURL = strings.Replace(outURL, "127.0.0.1", "host.docker.internal", 1)
 		outURL = strings.Replace(outURL, "localhost", "host.docker.internal", 1)
@@ -224,7 +224,7 @@ func (h *DiscoveryHandler) Peers(c *gin.Context) {
 	}

 	var parentID sql.NullString
-	err := db.GetDB().QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).
+	err := db.DB.QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).
 		Scan(&parentID)
 	if err == sql.ErrNoRows {
 		c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
@@ -304,7 +304,7 @@ func filterPeersByQuery(peers []map[string]interface{}, q string) []map[string]i

 // queryPeerMaps returns clean JSON-serializable maps instead of Workspace structs.
 func queryPeerMaps(query string, args ...interface{}) ([]map[string]interface{}, error) {
-	rows, err := db.GetDB().Query(query, args...)
+	rows, err := db.DB.Query(query, args...)
 	if err != nil {
 		log.Printf("queryPeerMaps error: %v", err)
 		return nil, err
@@ -377,7 +377,7 @@ func (h *DiscoveryHandler) CheckAccess(c *gin.Context) {
 // are already behind the existing `CanCommunicate` hierarchy check — a
 // momentary DB outage shouldn't take agent-to-agent discovery offline.
 func validateDiscoveryCaller(ctx context.Context, c *gin.Context, workspaceID string) error {
-	hasLive, err := wsauth.HasAnyLiveToken(ctx, db.GetDB(), workspaceID)
+	hasLive, err := wsauth.HasAnyLiveToken(ctx, db.DB, workspaceID)
 	if err != nil {
 		log.Printf("wsauth: discovery HasAnyLiveToken(%s) failed: %v — allowing request", workspaceID, err)
 		return nil
@@ -427,7 +427,7 @@ func validateDiscoveryCaller(ctx context.Context, c *gin.Context, workspaceID st
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing workspace auth token"})
 		return errors.New("missing token")
 	}
-	if err := wsauth.ValidateToken(ctx, db.GetDB(), workspaceID, tok); err != nil {
+	if err := wsauth.ValidateToken(ctx, db.DB, workspaceID, tok); err != nil {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid workspace auth token"})
 		return err
 	}
@@ -1,160 +0,0 @@
-package handlers
-
-import (
-	"testing"
-)
-
-// filterPeersByQuery tests — nil-safe role/name filtering for peer discovery.
-
-func TestFilterPeersByQuery_EmptyQueryNoOp(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "foo", "role": "bar"},
-		{"name": "baz", "role": "qux"},
-	}
-	result := filterPeersByQuery(peers, "")
-	if len(result) != 2 {
-		t.Errorf("empty query: expected 2, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_WhitespaceQueryNoOp(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "foo", "role": "bar"},
-	}
-	result := filterPeersByQuery(peers, "   ")
-	if len(result) != 1 {
-		t.Errorf("whitespace-only query: expected 1, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_MatchName(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "backend-agent", "role": "sre"},
-		{"name": "frontend-agent", "role": "ui"},
-	}
-	result := filterPeersByQuery(peers, "backend")
-	if len(result) != 1 || result[0]["name"] != "backend-agent" {
-		t.Errorf("expected backend-agent, got %v", result)
-	}
-}
-
-func TestFilterPeersByQuery_MatchRole(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "agent-alpha", "role": "security engineer"},
-		{"name": "agent-beta", "role": "devops"},
-	}
-	result := filterPeersByQuery(peers, "engineer")
-	if len(result) != 1 || result[0]["name"] != "agent-alpha" {
-		t.Errorf("expected agent-alpha, got %v", result)
-	}
-}
-
-func TestFilterPeersByQuery_CaseInsensitive(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "AgentX", "role": "SRE"},
-	}
-	result := filterPeersByQuery(peers, "AGENTx")
-	if len(result) != 1 {
-		t.Errorf("expected 1 match (case-insensitive), got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_NilRoleNoPanic(t *testing.T) {
-	// This is the regression case for #730: queryPeerMaps explicitly sets
-	// peer["role"] = nil when the DB role is empty string. Before the fix,
-	// p["role"].(string) panics on nil. After the fix, it returns "" and
-	// no match occurs — which is the correct behaviour.
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("filterPeersByQuery panicked on nil role: %v", r)
-		}
-	}()
-	peers := []map[string]interface{}{
-		{"name": "some-agent", "role": nil},
-	}
-	result := filterPeersByQuery(peers, "some-agent")
-	if len(result) != 1 {
-		t.Errorf("expected 1 match by name, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_NilRoleQueryNoMatch(t *testing.T) {
-	// When role is nil and query does not match name, nothing matches.
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("filterPeersByQuery panicked on nil role: %v", r)
-		}
-	}()
-	peers := []map[string]interface{}{
-		{"name": "agent-alpha", "role": nil},
-	}
-	result := filterPeersByQuery(peers, "no-match")
-	if len(result) != 0 {
-		t.Errorf("expected 0 matches, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_NilNameNoPanic(t *testing.T) {
-	// Defensive check: name could also theoretically be nil.
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("filterPeersByQuery panicked on nil name: %v", r)
-		}
-	}()
-	peers := []map[string]interface{}{
-		{"name": nil, "role": "sre"},
-	}
-	result := filterPeersByQuery(peers, "sre")
-	if len(result) != 1 {
-		t.Errorf("expected 1 match by role, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_BothNilNoPanic(t *testing.T) {
-	defer func() {
-		if r := recover(); r != nil {
-			t.Errorf("filterPeersByQuery panicked on nil name+role: %v", r)
-		}
-	}()
-	peers := []map[string]interface{}{
-		{"name": nil, "role": nil},
-	}
-	result := filterPeersByQuery(peers, "")
-	if len(result) != 1 {
-		t.Errorf("empty query with nil name/role: expected 1, got %d", len(result))
-	}
-	result = filterPeersByQuery(peers, "anything")
-	if len(result) != 0 {
-		t.Errorf("non-empty query with nil name/role: expected 0, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_NoMatches(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "alpha", "role": "beta"},
-		{"name": "gamma", "role": "delta"},
-	}
-	result := filterPeersByQuery(peers, "zzz")
-	if len(result) != 0 {
-		t.Errorf("expected 0, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_EmptyPeers(t *testing.T) {
-	result := filterPeersByQuery([]map[string]interface{}{}, "query")
-	if len(result) != 0 {
-		t.Errorf("empty peers: expected 0, got %d", len(result))
-	}
-}
-
-func TestFilterPeersByQuery_MultipleMatches(t *testing.T) {
-	peers := []map[string]interface{}{
-		{"name": "backend-alpha", "role": "eng"},
-		{"name": "backend-beta", "role": "eng"},
-		{"name": "frontend", "role": "ui"},
-	}
-	result := filterPeersByQuery(peers, "backend")
-	if len(result) != 2 {
-		t.Errorf("expected 2 backend matches, got %d", len(result))
-	}
-}
@@ -18,7 +18,7 @@ func NewEventsHandler() *EventsHandler {

 // List handles GET /events
 func (h *EventsHandler) List(c *gin.Context) {
-	rows, err := db.GetDB().QueryContext(c.Request.Context(), `
+	rows, err := db.DB.QueryContext(c.Request.Context(), `
 		SELECT id, event_type, workspace_id, payload, created_at
 		FROM structure_events
 		ORDER BY created_at DESC
@@ -56,7 +56,7 @@ func (h *EventsHandler) List(c *gin.Context) {
 func (h *EventsHandler) ListByWorkspace(c *gin.Context) {
 	workspaceID := c.Param("workspaceId")

-	rows, err := db.GetDB().QueryContext(c.Request.Context(), `
+	rows, err := db.DB.QueryContext(c.Request.Context(), `
 		SELECT id, event_type, workspace_id, payload, created_at
 		FROM structure_events
 		WHERE workspace_id = $1
@@ -52,7 +52,7 @@ func (h *WorkspaceHandler) RotateExternalCredentials(c *gin.Context) {
 	}
 	ctx := c.Request.Context()

-	runtime, err := lookupWorkspaceRuntime(ctx, db.GetDB(), id)
+	runtime, err := lookupWorkspaceRuntime(ctx, db.DB, id)
 	if errors.Is(err, sql.ErrNoRows) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
 		return
@@ -85,12 +85,12 @@ func (h *WorkspaceHandler) RotateExternalCredentials(c *gin.Context) {
 	// that's better than the inverse where mint succeeds + revoke fails
 	// and TWO live tokens end up valid (the previous one + the new one),
 	// silently leaving the leaked credential alive.
-	if err := wsauth.RevokeAllForWorkspace(ctx, db.GetDB(), id); err != nil {
+	if err := wsauth.RevokeAllForWorkspace(ctx, db.DB, id); err != nil {
 		log.Printf("RotateExternalCredentials(%s): revoke failed: %v", id, err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "revoke failed"})
 		return
 	}
-	tok, err := wsauth.IssueToken(ctx, db.GetDB(), id)
+	tok, err := wsauth.IssueToken(ctx, db.DB, id)
 	if err != nil {
 		log.Printf("RotateExternalCredentials(%s): mint failed: %v", id, err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "mint failed"})
@@ -129,7 +129,7 @@ func (h *WorkspaceHandler) GetExternalConnection(c *gin.Context) {
 	}
 	ctx := c.Request.Context()

-	runtime, err := lookupWorkspaceRuntime(ctx, db.GetDB(), id)
+	runtime, err := lookupWorkspaceRuntime(ctx, db.DB, id)
 	if errors.Is(err, sql.ErrNoRows) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "workspace not found"})
 		return
@@ -230,21 +230,20 @@ func TestWorkspaceList_WithData(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", t.TempDir())

-	// 23 cols — broadcast_enabled + talk_to_user_enabled added after monthly_spend
-	// (migration 20260514). Column order must match scanWorkspaceRow exactly.
+	// 21 cols — see scanWorkspaceRow for order (max_concurrent_tasks
+	// lands between active_tasks and last_error_rate).
 	columns := []string{
 		"id", "name", "role", "tier", "status", "agent_card", "url",
 		"parent_id", "active_tasks", "max_concurrent_tasks",
 		"last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	rows := sqlmock.NewRows(columns).
 		AddRow("ws-1", "Agent One", "worker", 1, "online", []byte(`{"name":"agent1"}`), "http://localhost:8001",
-			nil, 3, 1, 0.02, "", 7200, "processing", "langgraph", "", 10.0, 20.0, false, nil, int64(0), false, true).
+			nil, 3, 1, 0.02, "", 7200, "processing", "langgraph", "", 10.0, 20.0, false, nil, int64(0)).
 		AddRow("ws-2", "Agent Two", "", 2, "degraded", []byte("null"), "",
-			nil, 0, 1, 0.6, "timeout", 100, "", "claude-code", "", 50.0, 60.0, true, nil, int64(0), false, true)
+			nil, 0, 1, 0.6, "timeout", 100, "", "claude-code", "", 50.0, 60.0, true, nil, int64(0))

 	mock.ExpectQuery("SELECT w.id, w.name").
 		WillReturnRows(rows)
@@ -26,36 +26,23 @@ func init() {
 	gin.SetMode(gin.TestMode)
 }

-// setupTestDB creates a sqlmock DB and assigns it to the global db.GetDB().
+// setupTestDB creates a sqlmock DB and assigns it to the global db.DB.
 // It also disables the SSRF URL check so that httptest.NewServer loopback
 // URLs and fake hostnames (*.example) used in tests don't trigger rejections.
 //
-// The mutex guards the swap: setup holds Lock while reading prevDB and writing
-// mockDB; cleanup holds Lock while restoring prevDB. Concurrent goroutines
-// from test bodies call GetDB() (RLock) so they block during the swap,
-// preventing the DATA RACE between cleanup's write and LogActivity's read
-// (activity.go:590) that mc#1176 fixed.
+// IMPORTANT: db.DB is saved before assignment and restored via t.Cleanup so
+// that tests running after this one are not polluted by a closed mock.
+// This is the single root cause of the systemic CI/Platform (Go) failures on
+// main HEAD 8026f020 (mc#975).
 func setupTestDB(t *testing.T) sqlmock.Sqlmock {
 	t.Helper()
 	mockDB, mock, err := sqlmock.New()
 	if err != nil {
 		t.Fatalf("failed to create sqlmock: %v", err)
 	}
-	db.Lock()
 	prevDB := db.DB
 	db.DB = mockDB
-	db.Unlock()
-	// Restore prevDB + close mock asynchronously so that concurrent goroutines
-	// spawned by this test (e.g. provisionWorkspaceAuto goroutines) finish
-	// before the swap-back. All GetDB() calls in those goroutines hold
-	// RLock; the Lock here blocks them during the swap-back, guaranteeing
-	// they see either the mock or prevDB, never an inconsistent state.
-	t.Cleanup(func() {
-		db.Lock()
-		db.DB = prevDB
-		db.Unlock()
-		mockDB.Close()
-	})
+	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })

 	// Disable SSRF checks for the duration of this test only. Restore
 	// the previous state via t.Cleanup so that TestIsSafeURL_* tests
@@ -410,21 +397,21 @@ func TestWorkspaceList(t *testing.T) {
 	broadcaster := newTestBroadcaster()
 	handler := NewWorkspaceHandler(broadcaster, nil, "http://localhost:8080", "/tmp/configs")

-	// 23 cols: broadcast_enabled + talk_to_user_enabled added after monthly_spend
-	// (migration 20260514). Column order must match scanWorkspaceRow exactly.
+	// 21 cols: `max_concurrent_tasks` added between active_tasks and
+	// last_error_rate (see scanWorkspaceRow + COALESCE(w.max_concurrent_tasks, 1)
+	// in workspace.go). Column order must match that scan exactly.
 	columns := []string{
 		"id", "name", "role", "tier", "status", "agent_card", "url",
 		"parent_id", "active_tasks", "max_concurrent_tasks",
 		"last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	rows := sqlmock.NewRows(columns).
 		AddRow("ws-1", "Agent One", "worker", 1, "online", []byte("null"), "http://localhost:8001",
-			nil, 0, 1, 0.0, "", 100, "", "claude-code", "", 10.0, 20.0, false, nil, int64(0), false, true).
+			nil, 0, 1, 0.0, "", 100, "", "claude-code", "", 10.0, 20.0, false, nil, int64(0)).
 		AddRow("ws-2", "Agent Two", "manager", 2, "provisioning", []byte("null"), "",
-			nil, 0, 1, 0.0, "", 0, "", "langgraph", "", 50.0, 60.0, false, nil, int64(0), false, true)
+			nil, 0, 1, 0.0, "", 0, "", "langgraph", "", 50.0, 60.0, false, nil, int64(0))

 	mock.ExpectQuery("SELECT w.id, w.name").
 		WillReturnRows(rows)
@@ -1138,14 +1125,13 @@ func TestWorkspaceGet_CurrentTask(t *testing.T) {
 		"parent_id", "active_tasks", "max_concurrent_tasks", "last_error_rate", "last_sample_error",
 		"uptime_seconds", "current_task", "runtime", "workspace_dir", "x", "y", "collapsed",
 		"budget_limit", "monthly_spend",
-		"broadcast_enabled", "talk_to_user_enabled",
 	}
 	mock.ExpectQuery("SELECT w.id, w.name").
 		WithArgs("dddddddd-0004-0000-0000-000000000000").
 		WillReturnRows(sqlmock.NewRows(columns).AddRow(
 			"dddddddd-0004-0000-0000-000000000000", "Task Worker", "worker", 1, "online", []byte("null"), "http://localhost:9000",
 			nil, 2, 1, 0.0, "", 300, "Analyzing document", "langgraph", "", 10.0, 20.0, false,
-			nil, int64(0), false, true,
+			nil, int64(0),
 		))

 	w := httptest.NewRecorder()
@@ -55,7 +55,7 @@ func (h *InstructionsHandler) List(c *gin.Context) {
 			)
 			ORDER BY CASE scope WHEN 'global' THEN 0 WHEN 'workspace' THEN 2 END,
 			         priority DESC`
-		r, qErr := db.GetDB().QueryContext(ctx, query, workspaceID)
+		r, qErr := db.DB.QueryContext(ctx, query, workspaceID)
 		if qErr != nil {
 			log.Printf("Instructions list error: %v", qErr)
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
@@ -76,7 +76,7 @@ func (h *InstructionsHandler) List(c *gin.Context) {
 	}
 	query += ` ORDER BY scope, priority DESC, created_at`

-	r, qErr := db.GetDB().QueryContext(ctx, query, args...)
+	r, qErr := db.DB.QueryContext(ctx, query, args...)
 	if qErr != nil {
 		log.Printf("Instructions list error: %v", qErr)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
@@ -118,7 +118,7 @@ func (h *InstructionsHandler) Create(c *gin.Context) {
 	}

 	var id string
-	err := db.GetDB().QueryRowContext(c.Request.Context(),
+	err := db.DB.QueryRowContext(c.Request.Context(),
 		`INSERT INTO platform_instructions (scope, scope_target, title, content, priority)
 		 VALUES ($1, $2, $3, $4, $5) RETURNING id`,
 		body.Scope, body.ScopeTarget, body.Title, body.Content, body.Priority,
@@ -154,7 +154,7 @@ func (h *InstructionsHandler) Update(c *gin.Context) {
 		return
 	}

-	result, err := db.GetDB().ExecContext(c.Request.Context(),
+	result, err := db.DB.ExecContext(c.Request.Context(),
 		`UPDATE platform_instructions SET
 			title = COALESCE($2, title),
 			content = COALESCE($3, content),
@@ -180,7 +180,7 @@ func (h *InstructionsHandler) Update(c *gin.Context) {
 // DELETE /instructions/:id
 func (h *InstructionsHandler) Delete(c *gin.Context) {
 	id := c.Param("id")
-	result, err := db.GetDB().ExecContext(c.Request.Context(),
+	result, err := db.DB.ExecContext(c.Request.Context(),
 		`DELETE FROM platform_instructions WHERE id = $1`, id)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
@@ -209,7 +209,7 @@ func (h *InstructionsHandler) Resolve(c *gin.Context) {
 	}
 	ctx := c.Request.Context()

-	rows, err := db.GetDB().QueryContext(ctx,
+	rows, err := db.DB.QueryContext(ctx,
 		`SELECT scope, title, content FROM platform_instructions
 		 WHERE enabled = true AND (
 			scope = 'global'
@@ -248,9 +248,6 @@ func (h *InstructionsHandler) Resolve(c *gin.Context) {
 		b.WriteString(content)
 		b.WriteString("\n\n")
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("ResolveInstructions rows.Err workspace=%s: %v", workspaceID, err)
-	}

 	c.JSON(http.StatusOK, gin.H{
 		"workspace_id": workspaceID,
@@ -261,7 +258,6 @@ func (h *InstructionsHandler) Resolve(c *gin.Context) {
 func scanInstructions(rows interface {
 	Next() bool
 	Scan(dest ...interface{}) error
-	Err() error
 }) []Instruction {
 	var instructions []Instruction
 	for rows.Next() {
@@ -273,9 +269,6 @@ func scanInstructions(rows interface {
 		}
 		instructions = append(instructions, inst)
 	}
-	if err := rows.Err(); err != nil {
-		log.Printf("scanInstructions rows.Err: %v", err)
-	}
 	if instructions == nil {
 		instructions = []Instruction{}
 	}
@@ -93,7 +93,7 @@ type MCPHandler struct {
 }

 // NewMCPHandler wires the handler to db and broadcaster.
-// Pass db.GetDB() and the platform broadcaster at router-setup time.
+// Pass db.DB and the platform broadcaster at router-setup time.
 func NewMCPHandler(database *sql.DB, broadcaster *events.Broadcaster) *MCPHandler {
 	return &MCPHandler{database: database, broadcaster: broadcaster}
 }
@@ -26,7 +26,7 @@ import (
 func newMCPHandler(t *testing.T) (*MCPHandler, sqlmock.Sqlmock) {
 	t.Helper()
 	mock := setupTestDB(t)
-	h := NewMCPHandler(db.GetDB(), newTestBroadcaster())
+	h := NewMCPHandler(db.DB, newTestBroadcaster())
 	return h, mock
 }

@@ -751,9 +751,9 @@ func TestMCPHandler_SendMessageToUser_DBErrorLogsAndStill200s(t *testing.T) {
 	t.Setenv("MOLECULE_MCP_ALLOW_SEND_MESSAGE", "true")
 	h, mock := newMCPHandler(t)

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-err").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))

 	// INSERT fails — must NOT abort the tool response.
 	mock.ExpectExec(`INSERT INTO activity_logs.*'a2a_receive'.*'notify'`).
@@ -802,9 +802,9 @@ func TestMCPHandler_SendMessageToUser_ResponseBodyShape(t *testing.T) {

 	const userMessage = "Hi there from the agent"

-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-shape").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))

 	// Capture the response_body argument and assert its exact shape.
 	mock.ExpectExec(`INSERT INTO activity_logs.*'a2a_receive'.*'notify'`).
@@ -861,9 +861,9 @@ func TestMCPHandler_SendMessageToUser_PersistsToActivityLog(t *testing.T) {
 	// before it does anything else. Returning a name lets the
 	// broadcast payload populate; the test doesn't assert on the
 	// broadcast (no observable WS in this fake), only on the DB.
-	mock.ExpectQuery("SELECT name, talk_to_user_enabled FROM workspaces").
+	mock.ExpectQuery("SELECT name FROM workspaces").
 		WithArgs("ws-msg").
-		WillReturnRows(sqlmock.NewRows([]string{"name", "talk_to_user_enabled"}).AddRow("CEO Ryan PC", true))
+		WillReturnRows(sqlmock.NewRows([]string{"name"}).AddRow("CEO Ryan PC"))

 	// The persistence INSERT — pin the exact shape so a future
 	// refactor that switches columns or drops `method='notify'`
@@ -166,7 +166,7 @@ func (h *MemoriesHandler) Commit(c *gin.Context) {
 	// GLOBAL scope: only root workspaces (no parent) can write
 	if body.Scope == "GLOBAL" {
 		var parentID *string
-		db.GetDB().QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID)
+		db.DB.QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID)
 		if parentID != nil {
 			c.JSON(http.StatusForbidden, gin.H{"error": "only root workspaces can write GLOBAL memories"})
 			return
@@ -188,7 +188,7 @@ func (h *MemoriesHandler) Commit(c *gin.Context) {
 	}

 	var memoryID string
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		INSERT INTO agent_memories (workspace_id, content, scope, namespace)
 		VALUES ($1, $2, $3, $4) RETURNING id
 	`, workspaceID, content, body.Scope, namespace).Scan(&memoryID)
@@ -212,7 +212,7 @@ func (h *MemoriesHandler) Commit(c *gin.Context) {
 			"content_sha256": hex.EncodeToString(sum[:]),
 		})
 		summary := "GLOBAL memory written: id=" + memoryID + " namespace=" + namespace
-		if _, auditErr := db.GetDB().ExecContext(ctx, `
+		if _, auditErr := db.DB.ExecContext(ctx, `
 			INSERT INTO activity_logs (workspace_id, activity_type, source_id, summary, request_body, status)
 			VALUES ($1, $2, $3, $4, $5::jsonb, $6)
 		`, workspaceID, "memory_write_global", workspaceID, summary, string(auditBody), "ok"); auditErr != nil {
@@ -228,7 +228,7 @@ func (h *MemoriesHandler) Commit(c *gin.Context) {
 			log.Printf("Commit: embedding failed workspace=%s memory=%s: %v (stored without embedding)",
 				workspaceID, memoryID, embedErr)
 		} else if fmtVec := formatVector(vec); fmtVec != "" {
-			if _, updateErr := db.GetDB().ExecContext(ctx,
+			if _, updateErr := db.DB.ExecContext(ctx,
 				`UPDATE agent_memories SET embedding = $1::vector WHERE id = $2`,
 				fmtVec, memoryID,
 			); updateErr != nil {
@@ -278,7 +278,7 @@ func (h *MemoriesHandler) Search(c *gin.Context) {

 	// Get workspace info for access control
 	var parentID *string
-	db.GetDB().QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID)
+	db.DB.QueryRowContext(ctx, `SELECT parent_id FROM workspaces WHERE id = $1`, workspaceID).Scan(&parentID)

 	// Try to generate a query embedding for semantic search.
 	// Falls back to the existing FTS/ILIKE path on failure or when no
@@ -420,7 +420,7 @@ func (h *MemoriesHandler) Search(c *gin.Context) {
 		args = append(args, limit)
 	}

-	rows, err := db.GetDB().QueryContext(ctx, sqlQuery, args...)
+	rows, err := db.DB.QueryContext(ctx, sqlQuery, args...)
 	if err != nil {
 		log.Printf("Search memories error: %v", err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "search failed"})
@@ -542,7 +542,7 @@ func (h *MemoriesHandler) Update(c *gin.Context) {
 	// One round-trip rather than two: SELECT ... WHERE id AND
 	// workspace_id covers the 404 path without an extra existence check.
 	var existingScope, existingContent, existingNamespace string
-	if err := db.GetDB().QueryRowContext(ctx, `
+	if err := db.DB.QueryRowContext(ctx, `
 		SELECT scope, content, namespace
 		FROM agent_memories
 		WHERE id = $1 AND workspace_id = $2
@@ -588,7 +588,7 @@ func (h *MemoriesHandler) Update(c *gin.Context) {
 		return
 	}

-	if _, err := db.GetDB().ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		UPDATE agent_memories
 		SET content = $1, namespace = $2, updated_at = now()
 		WHERE id = $3 AND workspace_id = $4
@@ -611,7 +611,7 @@ func (h *MemoriesHandler) Update(c *gin.Context) {
 			"reason":         "edited",
 		})
 		summary := "GLOBAL memory edited: id=" + memoryID + " namespace=" + newNamespace
-		if _, auditErr := db.GetDB().ExecContext(ctx, `
+		if _, auditErr := db.DB.ExecContext(ctx, `
 			INSERT INTO activity_logs (workspace_id, activity_type, source_id, summary, request_body, status)
 			VALUES ($1, $2, $3, $4, $5::jsonb, $6)
 		`, workspaceID, "memory_edit_global", workspaceID, summary, string(auditBody), "ok"); auditErr != nil {
@@ -628,7 +628,7 @@ func (h *MemoriesHandler) Update(c *gin.Context) {
 			log.Printf("Update: embedding failed workspace=%s memory=%s: %v (kept stale embedding)",
 				workspaceID, memoryID, embedErr)
 		} else if fmtVec := formatVector(vec); fmtVec != "" {
-			if _, updateErr := db.GetDB().ExecContext(ctx,
+			if _, updateErr := db.DB.ExecContext(ctx,
 				`UPDATE agent_memories SET embedding = $1::vector WHERE id = $2`,
 				fmtVec, memoryID,
 			); updateErr != nil {
@@ -652,7 +652,7 @@ func (h *MemoriesHandler) Delete(c *gin.Context) {
 	memoryID := c.Param("memoryId")
 	ctx := c.Request.Context()

-	result, err := db.GetDB().ExecContext(ctx,
+	result, err := db.DB.ExecContext(ctx,
 		`DELETE FROM agent_memories WHERE id = $1 AND workspace_id = $2`, memoryID, workspaceID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
@@ -30,7 +30,7 @@ func NewMemoryHandler() *MemoryHandler { return &MemoryHandler{} }
 func (h *MemoryHandler) List(c *gin.Context) {
 	workspaceID := c.Param("id")

-	rows, err := db.GetDB().QueryContext(c.Request.Context(), `
+	rows, err := db.DB.QueryContext(c.Request.Context(), `
 		SELECT key, value, version, expires_at, updated_at
 		FROM workspace_memory
 		WHERE workspace_id = $1 AND (expires_at IS NULL OR expires_at > NOW())
@@ -65,7 +65,7 @@ func (h *MemoryHandler) Get(c *gin.Context) {

 	var entry MemoryEntry
 	var value []byte
-	err := db.GetDB().QueryRowContext(c.Request.Context(), `
+	err := db.DB.QueryRowContext(c.Request.Context(), `
 		SELECT key, value, version, expires_at, updated_at
 		FROM workspace_memory
 		WHERE workspace_id = $1 AND key = $2 AND (expires_at IS NULL OR expires_at > NOW())
@@ -134,7 +134,7 @@ func (h *MemoryHandler) Set(c *gin.Context) {
 	// Path A — no version guard: unchanged last-write-wins upsert.
 	if body.IfMatchVersion == nil {
 		var newVersion int64
-		err := db.GetDB().QueryRowContext(c.Request.Context(), `
+		err := db.DB.QueryRowContext(c.Request.Context(), `
 			INSERT INTO workspace_memory(id, workspace_id, key, value, expires_at, updated_at, version)
 			VALUES(gen_random_uuid(), $1, $2, $3::jsonb, $4, NOW(), 1)
 			ON CONFLICT(workspace_id, key) DO UPDATE
@@ -168,7 +168,7 @@ func (h *MemoryHandler) Set(c *gin.Context) {
 	// version-mismatch or something else.
 	expected := *body.IfMatchVersion
 	var newVersion int64
-	updateErr := db.GetDB().QueryRowContext(c.Request.Context(), `
+	updateErr := db.DB.QueryRowContext(c.Request.Context(), `
 		UPDATE workspace_memory
 		SET value = $3::jsonb,
 		    expires_at = $4,
@@ -182,7 +182,7 @@ func (h *MemoryHandler) Set(c *gin.Context) {
 		// Either the row doesn't exist yet, or version mismatch. Look
 		// up the actual state so the 409 body carries useful context.
 		var currentVersion sql.NullInt64
-		probeErr := db.GetDB().QueryRowContext(c.Request.Context(), `
+		probeErr := db.DB.QueryRowContext(c.Request.Context(), `
 			SELECT version FROM workspace_memory
 			WHERE workspace_id = $1 AND key = $2
 		`, workspaceID, body.Key).Scan(&currentVersion)
@@ -193,7 +193,7 @@ func (h *MemoryHandler) Set(c *gin.Context) {
 			// non-existent key with version assertion).
 			if expected == 0 {
 				var createdVersion int64
-				err := db.GetDB().QueryRowContext(c.Request.Context(), `
+				err := db.DB.QueryRowContext(c.Request.Context(), `
 					INSERT INTO workspace_memory(id, workspace_id, key, value, expires_at, updated_at, version)
 					VALUES(gen_random_uuid(), $1, $2, $3::jsonb, $4, NOW(), 1)
 					RETURNING version
@@ -239,7 +239,7 @@ func (h *MemoryHandler) Delete(c *gin.Context) {
 	workspaceID := c.Param("id")
 	key := c.Param("key")

-	_, err := db.GetDB().ExecContext(c.Request.Context(), `
+	_, err := db.DB.ExecContext(c.Request.Context(), `
 		DELETE FROM workspace_memory WHERE workspace_id = $1 AND key = $2
 	`, workspaceID, key)
 	if err != nil {
@@ -90,7 +90,7 @@ func pickMockReply(workspaceID, requestID string) string {
 // genuine agent traffic.
 func lookupRuntime(ctx context.Context, workspaceID string) string {
 	var runtime sql.NullString
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT runtime FROM workspaces WHERE id = $1`, workspaceID,
 	).Scan(&runtime)
 	if err != nil {
@@ -271,62 +271,6 @@ func (e EnvRequirement) IsSatisfied(configured map[string]struct{}) bool {
 	return false
 }

-// perWorkspaceUnsatisfied records a single unsatisfied RequiredEnv for a
-// specific workspace during org import preflight.
-type perWorkspaceUnsatisfied struct {
-	Workspace   string
-	FilesDir    string
-	Unsatisfied EnvRequirement
-}
-
-// collectPerWorkspaceUnsatisfied walks the workspace tree and returns every
-// RequiredEnv that is neither in `configured` (global secrets) nor resolvable
-// from the org root or workspace-level .env file. An empty orgBaseDir skips
-// the .env walk so all requirements appear unsatisfied (used by tests to
-// isolate the global-only path).
-func collectPerWorkspaceUnsatisfied(
-	workspaces []OrgWorkspace,
-	orgBaseDir string,
-	configured map[string]struct{},
-) []perWorkspaceUnsatisfied {
-	var result []perWorkspaceUnsatisfied
-	for _, ws := range workspaces {
-		result = append(result, checkWorkspaceRequiredEnv(ws, orgBaseDir, configured)...)
-	}
-	return result
-}
-
-func checkWorkspaceRequiredEnv(
-	ws OrgWorkspace,
-	orgBaseDir string,
-	configured map[string]struct{},
-) []perWorkspaceUnsatisfied {
-	var result []perWorkspaceUnsatisfied
-	// Merge in .env vars from the org root and the workspace-specific dir.
-	// Workspace-level vars override org-root vars, just as loadWorkspaceEnv
-	// implements: org root first, then ws dir on top.
-	if orgBaseDir != "" {
-		wsEnv := loadWorkspaceEnv(orgBaseDir, ws.FilesDir)
-		for k, v := range wsEnv {
-			configured[k] = struct{}{}
-			_ = v // value only used for merging into configured map
-		}
-	}
-	for _, req := range ws.RequiredEnv {
-		if !req.IsSatisfied(configured) {
-			result = append(result, perWorkspaceUnsatisfied{
-				Workspace:   ws.Name,
-				FilesDir:    ws.FilesDir,
-				Unsatisfied: req,
-			})
-		}
-	}
-	for _, child := range ws.Children {
-		result = append(result, checkWorkspaceRequiredEnv(child, orgBaseDir, configured)...)
-	}
-	return result
-}
-
 // UnmarshalYAML accepts either a scalar (string → single) or a map
 // with an `any_of` list (→ group).
 func (e *EnvRequirement) UnmarshalYAML(value *yaml.Node) error {
@@ -852,7 +796,7 @@ func (h *OrgHandler) Import(c *gin.Context) {
 		// nothing (harmless) or, worse, match every workspace if a future
 		// query rewrite drops the IN clause. Belt-and-suspenders.
 		if len(importedNames) > 0 && len(importedIDs) > 0 {
-			rows, err := db.GetDB().QueryContext(ctx, `
+			rows, err := db.DB.QueryContext(ctx, `
 				SELECT id FROM workspaces
 				WHERE name = ANY($1::text[])
 				  AND id != ALL($2::uuid[])
@@ -979,7 +923,7 @@ func emitOrgEvent(ctx context.Context, eventType string, payload map[string]any)
 		log.Printf("emitOrgEvent: marshal %s payload failed: %v", eventType, err)
 		return
 	}
-	if _, err := db.GetDB().ExecContext(ctx, `
+	if _, err := db.DB.ExecContext(ctx, `
 		INSERT INTO structure_events (event_type, payload, created_at)
 		VALUES ($1, $2, now())
 	`, eventType, payloadJSON); err != nil {
@@ -64,9 +64,7 @@ func resolvePromptRef(inline, fileRef, orgBaseDir, filesDir string) (string, err

 // envVarRefPattern matches actual ${VAR} or $VAR references (not literal $).
 // Used to detect unresolved placeholders without false positives like "$5".
-// Requires [a-zA-Z_] as the first char after $ so $100 stays literal.
-// Two capture groups: (1) ${VAR} form, (2) $VAR form.
-var envVarRefPattern = regexp.MustCompile(`\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}|\$([a-zA-Z_][a-zA-Z0-9_]*)`)
+var envVarRefPattern = regexp.MustCompile(`\$\{?[A-Za-z_][A-Za-z0-9_]*\}?`)

 // hasUnresolvedVarRef returns true if the original string had a ${VAR} or $VAR
 // reference that the expanded string didn't fully replace (i.e. the var was unset).
@@ -80,103 +78,17 @@ func hasUnresolvedVarRef(original, expanded string) bool {
 }

 // expandWithEnv expands ${VAR} and $VAR references in s using the env map.
-// Falls back to the platform process env only when the whole value is a
-// single variable reference; embedded process-env expansion is too broad for
-// imported org YAML because host variables such as HOME are not template data.
+// Falls back to the platform process env if a var isn't in the map.
 func expandWithEnv(s string, env map[string]string) string {
-	if s == "" {
-		return ""
-	}
-	var b strings.Builder
-	for i := 0; i < len(s); {
-		if s[i] != '$' {
-			b.WriteByte(s[i])
-			i++
-			continue
+	return os.Expand(s, func(key string) string {
+		if v, ok := env[key]; ok {
+			return v
 		}
-
-		if i+1 >= len(s) {
-			b.WriteByte('$')
-			i++
-			continue
-		}
-
-		if s[i+1] == '{' {
-			end := strings.IndexByte(s[i+2:], '}')
-			if end < 0 {
-				b.WriteByte('$')
-				i++
-				continue
-			}
-			end += i + 2
-			key := s[i+2 : end]
-			ref := s[i : end+1]
-			b.WriteString(expandEnvRef(key, ref, s, env))
-			i = end + 1
-			continue
-		}
-
-		if !isEnvIdentStart(s[i+1]) {
-			b.WriteByte('$')
-			i++
-			continue
-		}
-		j := i + 2
-		for j < len(s) && isEnvIdentPart(s[j]) {
-			j++
-		}
-		key := s[i+1 : j]
-		ref := s[i:j]
-		b.WriteString(expandEnvRef(key, ref, s, env))
-		i = j
-	}
-	return b.String()
-}
-
-// expandEnvRef resolves a single variable reference extracted from s.
-//
-// Guards:
-//   - Empty key → "$$" escape, return "$"
-//   - key[0] not POSIX ident start → "$" + partial chars, return "$<chars>"
-//   - Key in env map → return the mapped value (template override wins)
-//   - Otherwise → only fall back to os.Getenv if the whole input string IS the
-//     variable reference (ref == whole).
-//
-// Bare $VAR format:
-//   $HOME (alone) → ref==whole → os.Getenv ✓  (host HOME is org-template HOME)
-//   $HOME/path (partial) → ref!=whole → literal "$HOME" ✓  (CWE-78: prevents host leak)
-//
-// Braced ${VAR} format:
-//   ${HOME} (alone) → ref==whole → os.Getenv ✓
-//   ${ROLE}/admin (partial) → ref!=whole → literal ✓
-//   "yes and ${NOT_SET}" (embedded) → ref!=whole → literal ✓
-//
-// This is the CWE-78 fix from commit a3a358f9.
-func expandEnvRef(key, ref, whole string, env map[string]string) string {
-	if key == "" {
-		return "$"
-	}
-	if !isEnvIdentStart(key[0]) {
-		return "$" + key
-	}
-	if v, ok := env[key]; ok {
-		return v
-	}
-	if ref == whole {
 		return os.Getenv(key)
-	}
-	return ref
+	})
 }

-func isEnvIdentStart(c byte) bool {
-	return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c == '_'
-}
-
-func isEnvIdentPart(c byte) bool {
-	return isEnvIdentStart(c) || (c >= '0' && c <= '9')
-}
-
-// loadWorkspaceEnv reads the org root .env and the workspace-specific .env .env and the workspace-specific .env
+// loadWorkspaceEnv reads the org root .env and the workspace-specific .env
 // (workspace overrides org root). Used by both secret injection and channel
 // config expansion.
 //
@@ -428,11 +340,7 @@ func resolveInsideRoot(root, userPath string) (string, error) {
 		return "", fmt.Errorf("root abs: %w", err)
 	}
 	joined := filepath.Join(absRoot, userPath)
-	// filepath.Join preserves "." components when root is absolute; clean
-	// them before computing the final absolute path so "./subdir/./file.txt"
-	// resolves to root/subdir/file.txt (not root/./subdir/./file.txt).
-	cleaned := filepath.Clean(joined)
-	absJoined, err := filepath.Abs(cleaned)
+	absJoined, err := filepath.Abs(joined)
 	if err != nil {
 		return "", fmt.Errorf("joined abs: %w", err)
 	}
@@ -1,126 +0,0 @@
-package handlers
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// setupOrgEnv creates a temp dir with an optional org .env file and returns the dir.
-func setupOrgEnv(t *testing.T, orgEnvContent string) string {
-	t.Helper()
-	dir := t.TempDir()
-	if orgEnvContent != "" {
-		require.NoError(t, os.WriteFile(filepath.Join(dir, ".env"), []byte(orgEnvContent), 0o600))
-	}
-	return dir
-}
-
-func Test_loadWorkspaceEnv_orgRootOnly(t *testing.T) {
-	org := setupOrgEnv(t, "ORG_VAR=orgval\nORG_DEBUG=true")
-	vars := loadWorkspaceEnv(org, "")
-	assert.Equal(t, "orgval", vars["ORG_VAR"])
-	assert.Equal(t, "true", vars["ORG_DEBUG"])
-}
-
-func Test_loadWorkspaceEnv_orgRootMissing(t *testing.T) {
-	// No .env at org root — should return empty map without error.
-	dir := t.TempDir()
-	vars := loadWorkspaceEnv(dir, "")
-	assertEmpty(t, vars)
-}
-
-func Test_loadWorkspaceEnv_workspaceEnvMerges(t *testing.T) {
-	org := setupOrgEnv(t, "SHARED=sharedval\nORG_ONLY=orgonly")
-	wsDir := filepath.Join(org, "myworkspace")
-	require.NoError(t, os.MkdirAll(wsDir, 0o700))
-	require.NoError(t, os.WriteFile(filepath.Join(wsDir, ".env"), []byte("WS_VAR=wsval\nSHARED=overridden"), 0o600))
-
-	vars := loadWorkspaceEnv(org, "myworkspace")
-	assert.Equal(t, "wsval", vars["WS_VAR"])
-	assert.Equal(t, "overridden", vars["SHARED"]) // workspace overrides org
-	assert.Equal(t, "orgonly", vars["ORG_ONLY"])   // org vars preserved
-}
-
-func Test_loadWorkspaceEnv_emptyFilesDir(t *testing.T) {
-	org := setupOrgEnv(t, "VAR=val")
-	vars := loadWorkspaceEnv(org, "")
-	assert.Equal(t, "val", vars["VAR"])
-}
-
-func Test_loadWorkspaceEnv_traversalRejects(t *testing.T) {
-	// #321 / CWE-22: filesDir "../../../etc" must not escape the org root.
-	// resolveInsideRoot rejects the traversal so workspace .env is skipped;
-	// org root .env is still loaded (it's before the guard).
-	org := setupOrgEnv(t, "INNOCENT=val\nSAFE_WS=wsval")
-	parent := filepath.Dir(org)
-	require.NoError(t, os.WriteFile(filepath.Join(parent, ".env"), []byte("MALICIOUS=evil"), 0o600))
-	// Also create a workspace dir inside org to prove it IS accessible normally.
-	wsDir := filepath.Join(org, "legit-workspace")
-	require.NoError(t, os.MkdirAll(wsDir, 0o700))
-	require.NoError(t, os.WriteFile(filepath.Join(wsDir, ".env"), []byte("WS_SECRET=ssh-key-123"), 0o600))
-
-	// Traversal is blocked.
-	vars := loadWorkspaceEnv(org, "../../../etc")
-	// Org root vars present; workspace vars blocked.
-	assert.Equal(t, "val", vars["INNOCENT"])
-	assert.Equal(t, "wsval", vars["SAFE_WS"]) // from org root .env
-	assert.Empty(t, vars["WS_SECRET"])        // workspace .env blocked by traversal guard
-	_, hasEvil := vars["MALICIOUS"]
-	assert.False(t, hasEvil, "MALICIOUS from escaped path must not appear")
-}
-
-func Test_loadWorkspaceEnv_traversalWithDots(t *testing.T) {
-	// A sibling-traversal attempt: go up one level then into a sibling dir.
-	// The sibling dir is NOT inside org, so it must be rejected.
-	org := setupOrgEnv(t, "INNOCENT=val")
-	parent := filepath.Dir(org)
-	require.NoError(t, os.MkdirAll(filepath.Join(parent, "sibling"), 0o700))
-	require.NoError(t, os.WriteFile(filepath.Join(parent, "sibling/.env"), []byte("LEAKED=secret"), 0o600))
-
-	vars := loadWorkspaceEnv(org, "../sibling")
-	// Org vars loaded; sibling vars blocked.
-	assert.Equal(t, "val", vars["INNOCENT"])
-	assert.Empty(t, vars["LEAKED"], "sibling traversal must be rejected")
-}
-
-func Test_loadWorkspaceEnv_absolutePathRejected(t *testing.T) {
-	// Absolute paths are rejected outright by resolveInsideRoot.
-	org := setupOrgEnv(t, "INNOCENT=val")
-	vars := loadWorkspaceEnv(org, "/etc")
-	assert.Equal(t, "val", vars["INNOCENT"]) // org root still loaded
-	assert.Empty(t, vars["SAFE_WS"])
-}
-
-func Test_loadWorkspaceEnv_dotPathRejected(t *testing.T) {
-	// "." resolves to the org root itself — this is NOT a traversal but
-	// would create org-root/.env which is the org root .env, not a
-	// workspace .env. resolveInsideRoot accepts this; the workspace .env
-	// path is org/.env, which IS the org root .env (already loaded).
-	// So the correct result is the org vars (same as org root, no change).
-	org := setupOrgEnv(t, "INNOCENT=val")
-	vars := loadWorkspaceEnv(org, ".")
-	// "." passes resolveInsideRoot (resolves to org root, which is valid).
-	// But workspace path org/.env is the same as org/.env already loaded.
-	assert.Equal(t, "val", vars["INNOCENT"])
-}
-
-func Test_loadWorkspaceEnv_emptyOrgRootReturnsEmpty(t *testing.T) {
-	vars := loadWorkspaceEnv("", "some/dir")
-	assertEmpty(t, vars)
-}
-
-func Test_loadWorkspaceEnv_missingWorkspaceDir(t *testing.T) {
-	org := setupOrgEnv(t, "ORG=val")
-	// Workspace dir doesn't exist — org vars still loaded.
-	vars := loadWorkspaceEnv(org, "nonexistent")
-	assert.Equal(t, "val", vars["ORG"])
-}
-
-func assertEmpty(t *testing.T, m map[string]string) {
-	t.Helper()
-	assert.Equal(t, 0, len(m), "expected empty map, got %v", m)
-}
@@ -1,723 +0,0 @@
-package handlers
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// ── isSafeRoleName ────────────────────────────────────────────────────────────
-
-func TestIsSafeRoleName_Valid(t *testing.T) {
-	cases := []string{
-		"backend",
-		"frontend",
-		"backend-engineer",
-		"Frontend_Engineer",
-		"DevOps123",
-		"sre-team",
-		"a",
-		"ABC",
-		"Role_With_Underscores_And-Numbers123",
-	}
-	for _, r := range cases {
-		t.Run(r, func(t *testing.T) {
-			if !isSafeRoleName(r) {
-				t.Errorf("isSafeRoleName(%q): expected true, got false", r)
-			}
-		})
-	}
-}
-
-func TestIsSafeRoleName_Invalid(t *testing.T) {
-	cases := []struct {
-		name string
-		role string
-	}{
-		{"empty", ""},
-		{"dot", "."},
-		{"double dot", ".."},
-		{"path separator", "backend/engineer"},
-		{"space", "backend engineer"},
-		{"special char", "backend@engineer"},
-		{"at sign", "role@team"},
-		{"colon", "role:admin"},
-		{"hash", "role#1"},
-		{"percent", "role%20"},
-		{"quote", `role"name`},
-		{"backslash", `role\name`},
-		{"tilde", "role~test"},
-		{"backtick", "`role"},
-		{"bracket open", "[role]"},
-		{"bracket close", "role]"},
-		{"plus", "role+admin"},
-		{"equals", "role=admin"},
-		{"caret", "role^admin"},
-		{"question mark", "role?"},
-		{"pipe at end", "role|"},
-		{"greater than", "role>"},
-		{"asterisk", "role*"},
-		{"ampersand", "role&"},
-		{"exclamation at end", "role!"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if isSafeRoleName(tc.role) {
-				t.Errorf("isSafeRoleName(%q): expected false, got true", tc.role)
-			}
-		})
-	}
-}
-
-// ── hasUnresolvedVarRef ───────────────────────────────────────────────────────
-
-func TestHasUnresolvedVarRef_NoVars(t *testing.T) {
-	cases := []string{
-		"",
-		"plain text",
-		"no variables here",
-		"123 numeric",
-		"$",
-		"${}",
-		"$5",
-		"$$$$",
-	}
-	for _, s := range cases {
-		t.Run(s, func(t *testing.T) {
-			if hasUnresolvedVarRef(s, s) {
-				t.Errorf("hasUnresolvedVarRef(%q, %q): expected false, got true", s, s)
-			}
-		})
-	}
-}
-
-func TestHasUnresolvedVarRef_Resolved(t *testing.T) {
-	// Expansion consumed the var refs (where "consumed" means the output no longer
-	// contains the original var reference syntax).
-	cases := []struct {
-		orig     string
-		expanded string
-		want     bool // true = unresolved (function returns true), false = resolved
-	}{
-		// Empty output: function conservatively returns true — it cannot distinguish
-		// "var was set to empty" from "var was not found and stripped". The test
-		// documents this design choice; callers who need empty=resolved should
-		// pre-process the output before calling hasUnresolvedVarRef.
-		{"${VAR}", "", true},
-		{"${VAR}", "value", false},                    // var replaced
-		{"$VAR", "value", false},                      // bare var replaced
-		{"prefix${VAR}suffix", "prefixvaluesuffix", false},
-		{"${A}${B}", "ab", false},
-		// FOO=FOO and BAR=BAR — both vars found and replaced. Expanded output
-		// "FOO and BAR" has no ${...} syntax left, so function returns false.
-		{"${FOO} and ${BAR}", "FOO and BAR", false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.orig, func(t *testing.T) {
-			got := hasUnresolvedVarRef(tc.orig, tc.expanded)
-			if got != tc.want {
-				t.Errorf("hasUnresolvedVarRef(%q, %q): got %v, want %v", tc.orig, tc.expanded, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestHasUnresolvedVarRef_Unresolved(t *testing.T) {
-	// Expansion left the refs intact → unresolved.
-	cases := []struct {
-		orig    string
-		expanded string
-	}{
-		{"${VAR}", "${VAR}"},       // untouched
-		{"$VAR", "$VAR"},           // bare untouched
-		{"prefix${VAR}suffix", "prefix${VAR}suffix"},
-		{"${A}${B}", "${A}${B}"},   // both unresolved
-		{"${FOO}", ""},             // empty result with var ref in original
-	}
-	for _, tc := range cases {
-		t.Run(tc.orig, func(t *testing.T) {
-			if !hasUnresolvedVarRef(tc.orig, tc.expanded) {
-				t.Errorf("hasUnresolvedVarRef(%q, %q): expected true, got false", tc.orig, tc.expanded)
-			}
-		})
-	}
-}
-
-// ── expandWithEnv ─────────────────────────────────────────────────────────────
-
-func TestExpandWithEnv_Basic(t *testing.T) {
-	env := map[string]string{"FOO": "bar", "BAZ": "qux"}
-	cases := []struct {
-		input string
-		want  string
-	}{
-		{"", ""},
-		{"no vars", "no vars"},
-		{"${FOO}", "bar"},
-		{"$FOO", "bar"},
-		{"prefix${FOO}suffix", "prefixbarsuffix"},
-		{"${FOO}${BAZ}", "barqux"},
-		{"${MISSING}", ""}, // not in env, not in os env → empty
-	}
-	for _, tc := range cases {
-		t.Run(tc.input, func(t *testing.T) {
-			got := expandWithEnv(tc.input, env)
-			if got != tc.want {
-				t.Errorf("expandWithEnv(%q, %v) = %q, want %q", tc.input, env, got, tc.want)
-			}
-		})
-	}
-}
-
-// ── mergeCategoryRouting ─────────────────────────────────────────────────────
-
-func TestMergeCategoryRouting_EmptyInputs(t *testing.T) {
-	// Both empty → empty
-	r := mergeCategoryRouting(nil, nil)
-	if len(r) != 0 {
-		t.Errorf("mergeCategoryRouting(nil, nil): got %v, want empty", r)
-	}
-
-	r = mergeCategoryRouting(map[string][]string{}, map[string][]string{})
-	if len(r) != 0 {
-		t.Errorf("mergeCategoryRouting({}, {}): got %v, want empty", r)
-	}
-}
-
-func TestMergeCategoryRouting_DefaultsOnly(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer", "DevOps"},
-		"ui":       {"Frontend Engineer"},
-		"data":     {"Data Engineer"},
-	}
-	r := mergeCategoryRouting(defaults, nil)
-	if len(r) != 3 {
-		t.Errorf("got %d keys, want 3", len(r))
-	}
-	if len(r["security"]) != 2 {
-		t.Errorf("security roles: got %v, want 2", r["security"])
-	}
-}
-
-func TestMergeCategoryRouting_WorkspaceOverrides(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer", "DevOps"},
-		"ui":       {"Frontend Engineer"},
-	}
-	ws := map[string][]string{
-		"security": {"SRE Team"}, // narrows
-		"ui":       {},           // drops
-		"infra":    {"Platform Team"}, // adds
-	}
-	r := mergeCategoryRouting(defaults, ws)
-	if len(r["security"]) != 1 || r["security"][0] != "SRE Team" {
-		t.Errorf("security: got %v, want [SRE Team]", r["security"])
-	}
-	if _, ok := r["ui"]; ok {
-		t.Errorf("ui should be dropped, got %v", r["ui"])
-	}
-	if len(r["infra"]) != 1 || r["infra"][0] != "Platform Team" {
-		t.Errorf("infra: got %v, want [Platform Team]", r["infra"])
-	}
-}
-
-func TestMergeCategoryRouting_EmptyListDrops(t *testing.T) {
-	defaults := map[string][]string{"foo": {"A", "B"}}
-	ws := map[string][]string{"foo": {}}
-	r := mergeCategoryRouting(defaults, ws)
-	if _, ok := r["foo"]; ok {
-		t.Errorf("foo with empty ws list: should be dropped, got %v", r["foo"])
-	}
-}
-
-func TestMergeCategoryRouting_EmptyKeySkipped(t *testing.T) {
-	defaults := map[string][]string{"": {"Role"}}
-	ws := map[string][]string{"": {}}
-	r := mergeCategoryRouting(defaults, ws)
-	if _, ok := r[""]; ok {
-		t.Errorf("empty key should be skipped, got %v", r[""])
-	}
-}
-
-// ── renderCategoryRoutingYAML ────────────────────────────────────────────────
-
-func TestRenderCategoryRoutingYAML_Empty(t *testing.T) {
-	out, err := renderCategoryRoutingYAML(nil)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if out != "" {
-		t.Errorf("got %q, want empty string", out)
-	}
-
-	out, err = renderCategoryRoutingYAML(map[string][]string{})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if out != "" {
-		t.Errorf("got %q, want empty string", out)
-	}
-}
-
-func TestRenderCategoryRoutingYAML_StableOrdering(t *testing.T) {
-	// Keys are sorted so output is deterministic regardless of map iteration order.
-	m := map[string][]string{
-		"zebra":  {"A"},
-		"alpha":  {"B"},
-		"middle": {"C"},
-	}
-	out, err := renderCategoryRoutingYAML(m)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	// alpha must come before middle, which must come before zebra
-	ai := 0
-	zi := 0
-	mi := 0
-	for i, c := range out {
-		switch {
-		case c == 'a' && i < len(out)-5 && out[i:i+5] == "alpha":
-			ai = i
-		case c == 'z' && i < len(out)-5 && out[i:i+5] == "zebra":
-			zi = i
-		case c == 'm' && i < len(out)-6 && out[i:i+6] == "middle":
-			mi = i
-		}
-	}
-	if ai <= 0 || zi <= 0 || mi <= 0 {
-		t.Fatalf("could not locate all keys in output: %s", out)
-	}
-	if ai >= mi || mi >= zi {
-		t.Errorf("keys not sorted: alpha=%d middle=%d zebra=%d, output:\n%s", ai, mi, zi, out)
-	}
-}
-
-func TestRenderCategoryRoutingYAML_SpecialCharsEscaped(t *testing.T) {
-	// YAML library should escape characters that need quoting.
-	m := map[string][]string{
-		"key:with:colons": {"Role: Admin"},
-		"key with space":  {"Role"},
-	}
-	out, err := renderCategoryRoutingYAML(m)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	// The output must be valid YAML (yaml.Marshal handles quoting).
-	// The key with colons should appear quoted in the output.
-	if out == "" {
-		t.Error("output is empty")
-	}
-}
-
-// ── appendYAMLBlock ───────────────────────────────────────────────────────────
-
-func TestAppendYAMLBlock_NoExisting(t *testing.T) {
-	got := appendYAMLBlock(nil, "key: value")
-	if string(got) != "key: value" {
-		t.Errorf("got %q, want 'key: value'", string(got))
-	}
-}
-
-func TestAppendYAMLBlock_EmptyBlock(t *testing.T) {
-	// When existing lacks a trailing \n, the function adds one before appending
-	// the empty block — so the result always has a clean terminator.
-	got := appendYAMLBlock([]byte("existing: data"), "")
-	want := "existing: data\n"
-	if string(got) != want {
-		t.Errorf("got %q, want %q", string(got), want)
-	}
-}
-
-func TestAppendYAMLBlock_AppendsWithNewline(t *testing.T) {
-	existing := []byte("key: value")
-	block := "new: entry"
-	got := appendYAMLBlock(existing, block)
-	want := "key: value\nnew: entry"
-	if string(got) != want {
-		t.Errorf("got %q, want %q", string(got), want)
-	}
-}
-
-func TestAppendYAMLBlock_AlreadyEndsWithNewline(t *testing.T) {
-	existing := []byte("key: value\n")
-	block := "new: entry"
-	got := appendYAMLBlock(existing, block)
-	want := "key: value\nnew: entry"
-	if string(got) != want {
-		t.Errorf("got %q, want %q", string(got), want)
-	}
-}
-
-// ── mergePlugins ─────────────────────────────────────────────────────────────
-
-func TestMergePlugins_EmptyInputs(t *testing.T) {
-	r := mergePlugins(nil, nil)
-	if len(r) != 0 {
-		t.Errorf("got %v, want []", r)
-	}
-	r = mergePlugins([]string{}, []string{})
-	if len(r) != 0 {
-		t.Errorf("got %v, want []", r)
-	}
-}
-
-func TestMergePlugins_BasicMerge(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	ws := []string{"plugin-b", "plugin-c"}
-	r := mergePlugins(defaults, ws)
-	// defaults first, ws appended, b deduplicated
-	if len(r) != 3 {
-		t.Errorf("got %v, want 3 items", r)
-	}
-	if r[0] != "plugin-a" || r[1] != "plugin-b" || r[2] != "plugin-c" {
-		t.Errorf("got %v, want [a, b, c]", r)
-	}
-}
-
-func TestMergePlugins_ExcludeWithBang(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b", "plugin-c"}
-	ws := []string{"!plugin-b"}
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 {
-		t.Errorf("got %v, want 2 items", r)
-	}
-	if r[0] != "plugin-a" || r[1] != "plugin-c" {
-		t.Errorf("got %v, want [a, c]", r)
-	}
-}
-
-func TestMergePlugins_ExcludeWithDash(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b", "plugin-c"}
-	ws := []string{"-plugin-b"}
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 || r[0] != "plugin-a" || r[1] != "plugin-c" {
-		t.Errorf("got %v, want [a, c]", r)
-	}
-}
-
-func TestMergePlugins_ExcludeNonexistent(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	ws := []string{"!plugin-c"} // c not present
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 {
-		t.Errorf("got %v, want 2 items", r)
-	}
-}
-
-func TestMergePlugins_ExcludeEmptyTarget(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	ws := []string{"!"}
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 {
-		t.Errorf("got %v, want 2 items", r)
-	}
-}
-
-func TestMergePlugins_EmptyPlugin(t *testing.T) {
-	defaults := []string{"", "plugin-a", ""}
-	ws := []string{"plugin-b", ""}
-	r := mergePlugins(defaults, ws)
-	if len(r) != 2 {
-		t.Errorf("got %v, want 2 items", r)
-	}
-}
-
-// ── Additional coverage: expandWithEnv ──────────────────────────────
-func TestExpandWithEnv_BracedVar(t *testing.T) {
-	env := map[string]string{"FOO": "bar", "BAZ": "qux"}
-	result := expandWithEnv("value is ${FOO}", env)
-	assert.Equal(t, "value is bar", result)
-}
-
-func TestExpandWithEnv_DollarVar(t *testing.T) {
-	env := map[string]string{"X": "1", "Y": "2"}
-	result := expandWithEnv("$X + $Y = 3", env)
-	assert.Equal(t, "1 + 2 = 3", result)
-}
-
-func TestExpandWithEnv_Mixed(t *testing.T) {
-	env := map[string]string{"A": "alpha", "B": "beta"}
-	result := expandWithEnv("${A}_${B}", env)
-	assert.Equal(t, "alpha_beta", result)
-}
-
-func TestExpandWithEnv_MissingVar(t *testing.T) {
-	// Missing vars stay as-is (os.Getenv fallback returns "" for unset vars).
-	env := map[string]string{}
-	result := expandWithEnv("${UNSET}", env)
-	assert.Equal(t, "", result)
-}
-
-func TestExpandWithEnv_EmptyMap(t *testing.T) {
-	result := expandWithEnv("no vars here", map[string]string{})
-	assert.Equal(t, "no vars here", result)
-}
-
-func TestExpandWithEnv_LiteralDollar(t *testing.T) {
-	// A bare $ not followed by a valid identifier char stays as-is.
-	result := expandWithEnv("cost $100", map[string]string{})
-	assert.Equal(t, "cost $100", result)
-}
-
-func TestExpandWithEnv_PartiallyPresent(t *testing.T) {
-	env := map[string]string{"SET": "yes"}
-	result := expandWithEnv("${SET} and ${NOT_SET}", env)
-	// ${SET} resolved from env; ${NOT_SET} stays literal (not whole-string ref,
-	// so os.Getenv fallback is NOT used — CWE-78 regression guard).
-	assert.Equal(t, "yes and ${NOT_SET}", result)
-}
-
-// mergeCategoryRouting tests — unions defaults with per-workspace routing.
-
-// ── Additional coverage: mergeCategoryRouting ──────────────────────
-func TestMergeCategoryRouting_WorkspaceAddsCategory(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer"},
-	}
-	wsRouting := map[string][]string{
-		"ui": {"Frontend Engineer"},
-	}
-	result := mergeCategoryRouting(defaults, wsRouting)
-	assert.Equal(t, []string{"Backend Engineer"}, result["security"])
-	assert.Equal(t, []string{"Frontend Engineer"}, result["ui"])
-}
-
-func TestMergeCategoryRouting_EmptyListDropsCategory(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer"},
-		"infra":    {"SRE"},
-	}
-	wsRouting := map[string][]string{
-		"security": {}, // empty list = explicit drop
-	}
-	result := mergeCategoryRouting(defaults, wsRouting)
-	_, hasSecurity := result["security"]
-	assert.False(t, hasSecurity)
-	assert.Equal(t, []string{"SRE"}, result["infra"])
-}
-
-func TestMergeCategoryRouting_EmptyDefaultKeySkipped(t *testing.T) {
-	defaults := map[string][]string{
-		"": {"Backend Engineer"}, // empty key should be skipped
-	}
-	result := mergeCategoryRouting(defaults, nil)
-	_, has := result[""]
-	assert.False(t, has)
-}
-
-func TestMergeCategoryRouting_EmptyWorkspaceKeySkipped(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer"},
-	}
-	wsRouting := map[string][]string{
-		"": {"Some Role"},
-	}
-	result := mergeCategoryRouting(defaults, wsRouting)
-	_, has := result[""]
-	assert.False(t, has)
-	assert.Equal(t, []string{"Backend Engineer"}, result["security"])
-}
-
-func TestMergeCategoryRouting_DoesNotMutateInputs(t *testing.T) {
-	defaults := map[string][]string{
-		"security": {"Backend Engineer"},
-	}
-	wsRouting := map[string][]string{
-		"security": {"DevOps"},
-	}
-	orig := defaults["security"][0]
-	_ = mergeCategoryRouting(defaults, wsRouting)
-	assert.Equal(t, orig, defaults["security"][0])
-}
-
-// renderCategoryRoutingYAML tests — deterministic YAML emission.
-
-// ── Additional coverage: renderCategoryRoutingYAML ────────────────
-func TestRenderCategoryRoutingYAML_SingleCategory(t *testing.T) {
-	routing := map[string][]string{
-		"security": {"Backend Engineer", "DevOps"},
-	}
-	result, err := renderCategoryRoutingYAML(routing)
-	assert.NoError(t, err)
-	assert.Contains(t, result, "security:")
-	assert.Contains(t, result, "Backend Engineer")
-	assert.Contains(t, result, "DevOps")
-}
-
-func TestRenderCategoryRoutingYAML_MultipleCategoriesSorted(t *testing.T) {
-	routing := map[string][]string{
-		"zebra":   {"RoleZ"},
-		"alpha":   {"RoleA"},
-		"middleware": {"RoleM"},
-	}
-	result, err := renderCategoryRoutingYAML(routing)
-	assert.NoError(t, err)
-	// Keys are sorted alphabetically.
-	idxAlpha := assertFind(t, result, "alpha:")
-	idxZebra := assertFind(t, result, "zebra:")
-	idxMid := assertFind(t, result, "middleware:")
-	if idxAlpha > -1 && idxZebra > -1 {
-		assert.True(t, idxAlpha < idxZebra, "alpha should appear before zebra")
-	}
-	if idxMid > -1 && idxZebra > -1 {
-		assert.True(t, idxMid < idxZebra, "middleware should appear before zebra")
-	}
-}
-
-func TestRenderCategoryRoutingYAML_EmptyListCategory(t *testing.T) {
-	// Empty-list category should still render (mergeCategoryRouting drops
-	// them before they reach this function, but we test the render in isolation).
-	routing := map[string][]string{
-		"security": {},
-	}
-	result, err := renderCategoryRoutingYAML(routing)
-	assert.NoError(t, err)
-	assert.Contains(t, result, "security:")
-}
-
-func TestRenderCategoryRoutingYAML_SpecialCharactersEscaped(t *testing.T) {
-	routing := map[string][]string{
-		"notes": {`has: colon`, `and "quotes"`, "emoji: 🚀"},
-	}
-	result, err := renderCategoryRoutingYAML(routing)
-	assert.NoError(t, err)
-	// Should not panic and should produce valid YAML.
-	assert.Contains(t, result, "notes:")
-}
-
-// appendYAMLBlock tests — safe concatenation with newline boundary.
-
-// ── Additional coverage: appendYAMLBlock ───────────────────────────
-func TestAppendYAMLBlock_BothEmpty(t *testing.T) {
-	result := appendYAMLBlock(nil, "")
-	assert.Nil(t, result) // append(nil, []byte("")...) returns nil in Go
-}
-
-func TestAppendYAMLBlock_ExistingHasNewline(t *testing.T) {
-	existing := []byte("existing:\n")
-	block := "key: value\n"
-	result := appendYAMLBlock(existing, block)
-	assert.Equal(t, "existing:\nkey: value\n", string(result))
-}
-
-func TestAppendYAMLBlock_ExistingNoNewline(t *testing.T) {
-	existing := []byte("existing:")
-	block := "key: value\n"
-	result := appendYAMLBlock(existing, block)
-	assert.Equal(t, "existing:\nkey: value\n", string(result))
-}
-
-func TestAppendYAMLBlock_ExistingEmpty(t *testing.T) {
-	existing := []byte("")
-	block := "key: value\n"
-	result := appendYAMLBlock(existing, block)
-	assert.Equal(t, "key: value\n", string(result))
-}
-
-func TestAppendYAMLBlock_NilExisting(t *testing.T) {
-	block := "key: value\n"
-	result := appendYAMLBlock(nil, block)
-	assert.Equal(t, "key: value\n", string(result))
-}
-
-// mergePlugins tests — union with exclusion prefix (!/-).
-
-// ── Additional coverage: mergePlugins (additional cases) ───────────
-func TestMergePlugins_DefaultsOnly(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	result := mergePlugins(defaults, nil)
-	assert.Equal(t, []string{"plugin-a", "plugin-b"}, result)
-}
-
-func TestMergePlugins_WorkspaceAdds(t *testing.T) {
-	defaults := []string{"plugin-a"}
-	wsPlugins := []string{"plugin-b", "plugin-a"} // duplicate of default
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-b"}, result)
-}
-
-func TestMergePlugins_ExclusionWithBang(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b", "plugin-c"}
-	wsPlugins := []string{"!plugin-b"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-c"}, result)
-}
-
-func TestMergePlugins_ExclusionWithDash(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b", "plugin-c"}
-	wsPlugins := []string{"-plugin-b"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-c"}, result)
-}
-
-func TestMergePlugins_ExclusionEmptyTarget(t *testing.T) {
-	defaults := []string{"plugin-a", "plugin-b"}
-	wsPlugins := []string{"!", "-"} // no-op exclusions
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-b"}, result)
-}
-
-func TestMergePlugins_ExclusionNotInDefaults(t *testing.T) {
-	// Excluding something not in defaults is a no-op.
-	defaults := []string{"plugin-a"}
-	wsPlugins := []string{"!plugin-b"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a"}, result)
-}
-
-func TestMergePlugins_WorkspaceAddsNew(t *testing.T) {
-	defaults := []string{"plugin-a"}
-	wsPlugins := []string{"plugin-b"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-b"}, result)
-}
-
-func TestMergePlugins_DeduplicationOrder(t *testing.T) {
-	// Defaults first; workspace entries deduplicated.
-	defaults := []string{"plugin-a", "plugin-a", "plugin-b"}
-	wsPlugins := []string{"plugin-b", "plugin-c", "plugin-c"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-a", "plugin-b", "plugin-c"}, result)
-}
-
-func TestMergePlugins_ExclusionThenAddSameName(t *testing.T) {
-	// Remove then re-add: order matters.
-	defaults := []string{"plugin-a", "plugin-b"}
-	wsPlugins := []string{"!plugin-a", "plugin-a"}
-	result := mergePlugins(defaults, wsPlugins)
-	assert.Equal(t, []string{"plugin-b", "plugin-a"}, result)
-}
-
-// isSafeRoleName tests — alphanumeric + hyphen/underscore, no path separators.
-
-// ── Additional coverage: isSafeRoleName ───────────────────────────
-func TestIsSafeRoleName_SpecialCharsRejected(t *testing.T) {
-	bad := []string{
-		"role@name",
-		"role#name",
-		"role$name",
-		"role%name",
-		"role&name",
-		"role*name",
-		"role?name",
-		"role=name",
-	}
-	for _, r := range bad {
-		if isSafeRoleName(r) {
-			t.Errorf("isSafeRoleName(%q) expected false, got true", r)
-		}
-	}
-}
-
-// assertFind is a helper: returns index of first occurrence of substr in s, or -1.
-func assertFind(t *testing.T, s, substr string) int {
-	t.Helper()
-	idx := -1
-	for i := 0; i <= len(s)-len(substr); i++ {
-		if s[i:i+len(substr)] == substr {
-			idx = i
-			break
-		}
-	}
-	return idx
-}
@@ -93,7 +93,7 @@ func TestResolveInsideRoot_DotPathComponent(t *testing.T) {
 	if err != nil {
 		t.Fatalf("dot path component: unexpected error: %v", err)
 	}
-	if !strings.HasSuffix(got, "/subdir/file.txt") {
+	if got[len(got)-14:] != "/subdir/file.txt" {
 		t.Errorf("dot path component: got %q, want suffix /subdir/file.txt", got)
 	}
 }
@@ -276,121 +276,3 @@ func TestMergeCategoryRouting_OriginalMapsUnmodified(t *testing.T) {
 		t.Error("ws routing should be unmodified after merge")
 	}
 }
-
-// ── expandWithEnv ─────────────────────────────────────────────────────────────
-//
-// CWE-78 regression tests. The original fix (a3a358f9) ensures that partial
-// variable references like $HOME/path are NOT resolved via os.Getenv — the
-// host HOME env var must not leak into org template values. Only whole-string
-// references ($VAR or ${VAR}) may fall back to the host process environment.
-
-func TestExpandWithEnv_PartialRefDollarHomePath(t *testing.T) {
-	// $HOME/path must NOT resolve to the host's HOME env var.
-	// The literal $HOME must be returned as-is.
-	got := expandWithEnv("$HOME/path", nil)
-	if got != "$HOME/path" {
-		t.Errorf("$HOME/path: got %q, want literal $HOME/path", got)
-	}
-}
-
-func TestExpandWithEnv_PartialRefBracedRoleAdmin(t *testing.T) {
-	// ${ROLE}/admin — ROLE is not in env, so expand to the literal ${ROLE}/admin.
-	got := expandWithEnv("${ROLE}/admin", nil)
-	if got != "${ROLE}/admin" {
-		t.Errorf("${ROLE}/admin: got %q, want literal ${ROLE}/admin", got)
-	}
-}
-
-func TestExpandWithEnv_PartialRefMiddleOfString(t *testing.T) {
-	// $ROLE in the middle of a string — literal, not os.Getenv.
-	got := expandWithEnv("prefix/$ROLE/suffix", nil)
-	if got != "prefix/$ROLE/suffix" {
-		t.Errorf("prefix/$ROLE/suffix: got %q, want literal", got)
-	}
-}
-
-func TestExpandWithEnv_WholeVarInEnv(t *testing.T) {
-	// Whole-string $VAR that IS in env — env value wins.
-	env := map[string]string{"FOO": "barvalue"}
-	got := expandWithEnv("$FOO", env)
-	if got != "barvalue" {
-		t.Errorf("$FOO with FOO=barvalue: got %q, want barvalue", got)
-	}
-}
-
-func TestExpandWithEnv_WholeVarBracedInEnv(t *testing.T) {
-	// Whole-string ${VAR} that IS in env — env value wins.
-	env := map[string]string{"FOO": "barvalue"}
-	got := expandWithEnv("${FOO}", env)
-	if got != "barvalue" {
-		t.Errorf("${FOO} with FOO=barvalue: got %q, want barvalue", got)
-	}
-}
-
-func TestExpandWithEnv_WholeVarNotInEnvBare(t *testing.T) {
-	// Whole-string $VAR not in env — falls back to os.Getenv.
-	// If the host has the var, we get the host value. If not, empty.
-	// At minimum, the result must NOT be the literal "$UNDEFINED_VAR_9Z".
-	got := expandWithEnv("$UNDEFINED_VAR_9Z", nil)
-	if got == "$UNDEFINED_VAR_9Z" {
-		t.Errorf("$UNDEFINED_VAR_9Z: should expand (whole-string fallback to os.Getenv), got literal")
-	}
-}
-
-func TestExpandWithEnv_WholeVarNotInEnvBraced(t *testing.T) {
-	// Whole-string ${VAR} not in env — falls back to os.Getenv.
-	got := expandWithEnv("${UNDEFINED_VAR_9Z}", nil)
-	if got == "${UNDEFINED_VAR_9Z}" {
-		t.Errorf("${UNDEFINED_VAR_9Z}: should expand (whole-string fallback to os.Getenv), got literal")
-	}
-}
-
-func TestExpandWithEnv_EmptyString(t *testing.T) {
-	got := expandWithEnv("", map[string]string{"FOO": "bar"})
-	if got != "" {
-		t.Errorf("empty string: got %q, want empty", got)
-	}
-}
-
-func TestExpandWithEnv_NoVarRefs(t *testing.T) {
-	got := expandWithEnv("plain string with no vars", map[string]string{"FOO": "bar"})
-	if got != "plain string with no vars" {
-		t.Errorf("plain string: got %q, want unchanged", got)
-	}
-}
-
-func TestExpandWithEnv_MultipleVarRefs(t *testing.T) {
-	// Two vars, both whole — both expand from env.
-	env := map[string]string{"A": "alpha", "B": "beta"}
-	got := expandWithEnv("$A and $B and more", env)
-	if got != "alpha and beta and more" {
-		t.Errorf("multiple vars: got %q, want alpha and beta and more", got)
-	}
-}
-
-func TestExpandWithEnv_NumericVarRef(t *testing.T) {
-	// $5 — starts with digit, not a valid identifier start.
-	// Must return the literal "$5", not expand via os.Getenv.
-	got := expandWithEnv("$5", map[string]string{"5": "five"})
-	if got != "$5" {
-		t.Errorf("$5: got %q, want literal $5", got)
-	}
-}
-
-func TestExpandWithEnv_DollarEscape(t *testing.T) {
-	// $$ → both $ written literally (each $ is not followed by an identifier char,
-	// so it is written as-is). No special escape sequence for $$.
-	got := expandWithEnv("$$", nil)
-	if got != "$$" {
-		t.Errorf("$$: got %q, want literal $$", got)
-	}
-}
-
-func TestExpandWithEnv_MixedPartialAndWhole(t *testing.T) {
-	// $A is in env (whole), $HOME is partial — only $A expands.
-	env := map[string]string{"A": "alpha"}
-	got := expandWithEnv("$A at $HOME", env)
-	if got != "alpha at $HOME" {
-		t.Errorf("$A at $HOME: got %q, want alpha at $HOME", got)
-	}
-}
@@ -1,191 +0,0 @@
-package handlers
-
-import (
-	"errors"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// walkOrgWorkspaceNames tests — recursive collection of non-empty workspace names.
-
-func TestWalkOrgWorkspaceNames_EmptySlice(t *testing.T) {
-	var names []string
-	walkOrgWorkspaceNames([]OrgWorkspace{}, &names)
-	assert.Empty(t, names)
-}
-
-func TestWalkOrgWorkspaceNames_SingleNode(t *testing.T) {
-	var names []string
-	walkOrgWorkspaceNames([]OrgWorkspace{{Name: "my-workspace"}}, &names)
-	assert.Equal(t, []string{"my-workspace"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_SingleNodeEmptyName(t *testing.T) {
-	var names []string
-	walkOrgWorkspaceNames([]OrgWorkspace{{Name: ""}}, &names)
-	assert.Empty(t, names)
-}
-
-func TestWalkOrgWorkspaceNames_NestedChildren(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{
-			Name: "parent",
-			Children: []OrgWorkspace{
-				{Name: "child-a"},
-				{Name: "child-b"},
-			},
-		},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"parent", "child-a", "child-b"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_DeeplyNested(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{
-			Name: "level0",
-			Children: []OrgWorkspace{
-				{
-					Name: "level1",
-					Children: []OrgWorkspace{
-						{
-							Name: "level2",
-							Children: []OrgWorkspace{
-								{Name: "level3"},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"level0", "level1", "level2", "level3"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_SkipsEmptyNames(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{Name: "a"},
-		{Name: ""},
-		{Name: "b"},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"a", "b"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_Siblings(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{Name: "team"},
-		{Name: "alpha"},
-		{Name: "beta"},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"team", "alpha", "beta"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_MultipleRoots(t *testing.T) {
-	var names []string
-	tree := []OrgWorkspace{
-		{Name: "root-a", Children: []OrgWorkspace{{Name: "child-a"}}},
-		{Name: "root-b", Children: []OrgWorkspace{{Name: "child-b"}}},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"root-a", "child-a", "root-b", "child-b"}, names)
-}
-
-func TestWalkOrgWorkspaceNames_SpawningFalseStillWalks(t *testing.T) {
-	// The comment in the source is explicit: spawning:false subtrees are
-	// still walked. Empty names within those subtrees are still skipped.
-	var names []string
-	yes := true
-	no := false
-	tree := []OrgWorkspace{
-		{
-			Name: "parent",
-			Children: []OrgWorkspace{
-				{Name: "spawning-child", Spawning: &yes},
-				{Name: "non-spawning-child", Spawning: &no},
-				{Name: ""},
-			},
-		},
-	}
-	walkOrgWorkspaceNames(tree, &names)
-	assert.Equal(t, []string{"parent", "spawning-child", "non-spawning-child"}, names)
-}
-
-// resolveProvisionConcurrency tests — env-var parsing with sensible fallback.
-
-func TestResolveProvisionConcurrency_Default(t *testing.T) {
-	os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, defaultProvisionConcurrency, val)
-}
-
-func TestResolveProvisionConcurrency_ValidPositiveInt(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "5")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, 5, val)
-}
-
-func TestResolveProvisionConcurrency_ZeroUnlimited(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "0")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	// Zero is mapped to 1<<20 (unlimited semantics with finite cap)
-	assert.Equal(t, 1<<20, val)
-}
-
-func TestResolveProvisionConcurrency_NegativeFallsBack(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "-1")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, defaultProvisionConcurrency, val)
-}
-
-func TestResolveProvisionConcurrency_NonIntegerFallsBack(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "not-a-number")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, defaultProvisionConcurrency, val)
-}
-
-func TestResolveProvisionConcurrency_WhitespaceOnly(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "   ")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, defaultProvisionConcurrency, val)
-}
-
-func TestResolveProvisionConcurrency_LargeValue(t *testing.T) {
-	os.Setenv("MOLECULE_PROVISION_CONCURRENCY", "10000")
-	defer os.Unsetenv("MOLECULE_PROVISION_CONCURRENCY")
-	val := resolveProvisionConcurrency()
-	assert.Equal(t, 10000, val)
-}
-
-// errString tests — nil-safe error-to-string wrapper.
-
-func TestErrString_NilError(t *testing.T) {
-	result := errString(nil)
-	assert.Equal(t, "", result)
-}
-
-func TestErrString_WithError(t *testing.T) {
-	err := errors.New("something went wrong")
-	result := errString(err)
-	assert.Equal(t, "something went wrong", result)
-}
-
-func TestErrString_EmptyError(t *testing.T) {
-	err := errors.New("")
-	result := errString(err)
-	assert.Equal(t, "", result)
-}
@@ -162,7 +162,7 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX
 	// status != 'removed' — must match the partial-index predicate
 	// EXACTLY for Postgres to consider the index applicable.
 	var insertedID string
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		INSERT INTO workspaces (id, name, role, tier, runtime, awareness_namespace, status, parent_id, workspace_dir, workspace_access, max_concurrent_tasks)
 		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
 		ON CONFLICT (COALESCE(parent_id, '00000000-0000-0000-0000-000000000000'::uuid), name)
@@ -224,7 +224,7 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX
 	// `collapsed` lives on canvas_layouts (005_canvas_layouts.sql), not
 	// on workspaces; the UI-only flag is intentionally decoupled from
 	// the workspace row.
-	if _, err := db.GetDB().ExecContext(ctx, `INSERT INTO canvas_layouts (workspace_id, x, y, collapsed) VALUES ($1, $2, $3, $4)`, id, absX, absY, initialCollapsed); err != nil {
+	if _, err := db.DB.ExecContext(ctx, `INSERT INTO canvas_layouts (workspace_id, x, y, collapsed) VALUES ($1, $2, $3, $4)`, id, absX, absY, initialCollapsed); err != nil {
 		log.Printf("Org import: canvas layout insert failed for %s: %v", ws.Name, err)
 	}

@@ -258,7 +258,7 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX

 	// Handle external workspaces
 	if ws.External {
-		if _, err := db.GetDB().ExecContext(ctx, `UPDATE workspaces SET status = $1, url = $2 WHERE id = $3`, models.StatusOnline, ws.URL, id); err != nil {
+		if _, err := db.DB.ExecContext(ctx, `UPDATE workspaces SET status = $1, url = $2 WHERE id = $3`, models.StatusOnline, ws.URL, id); err != nil {
 			log.Printf("Org import: external workspace status update failed for %s: %v", ws.Name, err)
 		}
 		h.broadcaster.RecordAndBroadcast(ctx, string(events.EventWorkspaceOnline), id, map[string]interface{}{
@@ -273,7 +273,7 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX
 		// URL is set; the proxy never tries to resolve one for mock
 		// runtimes. Built for the funding-demo "200-workspace mock
 		// org" template — visual scale without real backend cost.
-		if _, err := db.GetDB().ExecContext(ctx, `UPDATE workspaces SET status = $1 WHERE id = $2`, models.StatusOnline, id); err != nil {
+		if _, err := db.DB.ExecContext(ctx, `UPDATE workspaces SET status = $1 WHERE id = $2`, models.StatusOnline, id); err != nil {
 			log.Printf("Org import: mock workspace status update failed for %s: %v", ws.Name, err)
 		}
 		h.broadcaster.RecordAndBroadcast(ctx, string(events.EventWorkspaceOnline), id, map[string]interface{}{
@@ -512,7 +512,7 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX
 			} else {
 				encrypted = []byte(value) // store raw when encryption disabled
 			}
-			if _, err := db.GetDB().ExecContext(ctx, `
+			if _, err := db.DB.ExecContext(ctx, `
 				INSERT INTO workspace_secrets (workspace_id, key, encrypted_value)
 				VALUES ($1, $2, $3)
 				ON CONFLICT (workspace_id, key) DO UPDATE SET encrypted_value = $3, updated_at = now()
@@ -570,7 +570,7 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX
 				sched.Name, ws.Name, nextRunErr)
 			continue
 		}
-		if _, err := db.GetDB().ExecContext(context.Background(), orgImportScheduleSQL,
+		if _, err := db.DB.ExecContext(context.Background(), orgImportScheduleSQL,
 			id, sched.Name, sched.CronExpr, tz, prompt, enabled, nextRun); err != nil {
 			log.Printf("Org import: failed to upsert schedule '%s' for %s: %v", sched.Name, ws.Name, err)
 		} else {
@@ -644,7 +644,7 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX
 			enabled = *ch.Enabled
 		}
 		// Idempotent insert — if same workspace+type already exists, update config
-		if _, err := db.GetDB().ExecContext(context.Background(), `
+		if _, err := db.DB.ExecContext(context.Background(), `
 			INSERT INTO workspace_channels (workspace_id, channel_type, channel_config, enabled, allowed_users)
 			VALUES ($1, $2, $3::jsonb, $4, $5::jsonb)
 			ON CONFLICT (workspace_id, channel_type) DO UPDATE
@@ -695,7 +695,7 @@ func (h *OrgHandler) createWorkspaceTree(ws OrgWorkspace, parentID *string, absX
 // abort the import. errors.Is unwraps.
 func (h *OrgHandler) lookupExistingChild(ctx context.Context, name string, parentID *string) (string, bool, error) {
 	var existingID string
-	err := db.GetDB().QueryRowContext(ctx, `
+	err := db.DB.QueryRowContext(ctx, `
 		SELECT id FROM workspaces
 		WHERE name = $1
 		  AND parent_id IS NOT DISTINCT FROM $2
@@ -952,8 +952,56 @@ type PerWorkspaceUnsatisfied struct {

 // collectPerWorkspaceUnsatisfied recursively walks workspaces and returns
 // per-workspace RequiredEnv entries that are not covered by (a) a global
+// secret key or (b) a key present in the workspace's .env file(s) (org root
+// .env + per-workspace <files_dir>/.env). This complements
+// collectOrgEnv + loadConfiguredGlobalSecretKeys, which together only
+// validate global-level RequiredEnv against global_secrets. The .env
+// lookup mirrors the runtime resolution in createWorkspaceTree so that
+// the preflight result matches what the container actually receives at
+// start time.
+func collectPerWorkspaceUnsatisfied(workspaces []OrgWorkspace, orgBaseDir string, globalSecrets map[string]struct{}) []PerWorkspaceUnsatisfied {
+	var out []PerWorkspaceUnsatisfied
+	var walk func([]OrgWorkspace)
+	walk = func(wsList []OrgWorkspace) {
+		for _, ws := range wsList {
+			// Build the set of keys available to this workspace from .env.
+			// This is the same three-source stack that createWorkspaceTree
+			// injects into the container:
+			//   1. Org root .env (parseEnvFile, no filesDir)
+			//   2. Workspace <files_dir>/.env (if filesDir is set)
+			//   3. Persona bootstrap env (MOLECULE_PERSONA_ROOT/<filesDir>/env)
+			// Items 1+2 are on-disk and testable; item 3 is host-only and
+			// skipped here (persona env does NOT satisfy required_env —
+			// it carries identity tokens, not workspace LLM keys).
+			envFromFiles := loadWorkspaceEnv(orgBaseDir, ws.FilesDir)
+			// Convert map[string]string (from .env files) to map[string]struct{}
+			// to match IsSatisfied's signature.
+			envSet := make(map[string]struct{}, len(envFromFiles))
+			for k := range envFromFiles {
+				envSet[k] = struct{}{}
+			}
+			for _, req := range ws.RequiredEnv {
+				if req.IsSatisfied(globalSecrets) {
+					continue // covered by a global secret
+				}
+				if req.IsSatisfied(envSet) {
+					continue // covered by a per-workspace .env file
+				}
+				out = append(out, PerWorkspaceUnsatisfied{
+					Workspace:   ws.Name,
+					FilesDir:    ws.FilesDir,
+					Unsatisfied: req,
+				})
+			}
+			walk(ws.Children)
+		}
+	}
+	walk(workspaces)
+	return out
+}
+
 func loadConfiguredGlobalSecretKeys(ctx context.Context) (map[string]struct{}, error) {
-	rows, err := db.GetDB().QueryContext(ctx,
+	rows, err := db.DB.QueryContext(ctx,
 		`SELECT key FROM global_secrets WHERE octet_length(encrypted_value) > 0 LIMIT $1`,
 		globalSecretsPreflightLimit)
 	if err != nil {
@@ -17,11 +17,8 @@ import (
 // when one exists, or the workspace's own ID when it is the org root.
 // Returns an empty string if the workspace is not found.
 func resolveOrgID(ctx context.Context, workspaceID string) (string, error) {
-	if db.GetDB() == nil {
-		return "", nil // nil in unit tests
-	}
 	var parentID sql.NullString
-	err := db.GetDB().QueryRowContext(ctx,
+	err := db.DB.QueryRowContext(ctx,
 		`SELECT parent_id FROM workspaces WHERE id = $1`,
 		workspaceID,
 	).Scan(&parentID)
@@ -56,7 +53,7 @@ func checkOrgPluginAllowlist(ctx context.Context, workspaceID, pluginName string
 	}

 	var allowed bool
-	err = db.GetDB().QueryRowContext(ctx, `
+	err = db.DB.QueryRowContext(ctx, `
 		SELECT EXISTS(
 			SELECT 1 FROM org_plugin_allowlist
 			WHERE org_id = $1 AND plugin_name = $2
@@ -72,7 +69,7 @@ func checkOrgPluginAllowlist(ctx context.Context, workspaceID, pluginName string

 	// Check whether an allowlist exists at all. Empty allowlist = allow-all.
 	var count int
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT COUNT(*) FROM org_plugin_allowlist WHERE org_id = $1`,
 		orgID,
 	).Scan(&count); err != nil {
@@ -138,7 +135,7 @@ func requireCallerOwnsOrg(c *gin.Context) (string, error) {
 	// Look up the token's org_id (populated at mint time by orgTokenActor).
 	// org_id is NULL for tokens minted before this migration or via
 	// ADMIN_TOKEN bootstrap — those callers get callerOrg="" and are denied.
-	orgID, err := orgtoken.OrgIDByTokenID(c.Request.Context(), db.GetDB(), tokID)
+	orgID, err := orgtoken.OrgIDByTokenID(c.Request.Context(), db.DB, tokID)
 	if err != nil {
 		// DB error — deny by default rather than risk cross-org access.
 		return "", fmt.Errorf("allowlist: requireCallerOwnsOrg: %v", err)
@@ -199,7 +196,7 @@ func (h *OrgPluginAllowlistHandler) GetAllowlist(c *gin.Context) {

 	// Verify the org workspace exists.
 	var exists bool
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT EXISTS(SELECT 1 FROM workspaces WHERE id = $1)`,
 		orgID,
 	).Scan(&exists); err != nil {
@@ -219,7 +216,7 @@ func (h *OrgPluginAllowlistHandler) GetAllowlist(c *gin.Context) {
 		return
 	}

-	rows, err := db.GetDB().QueryContext(ctx, `
+	rows, err := db.DB.QueryContext(ctx, `
 		SELECT plugin_name, enabled_by, enabled_at
 		FROM org_plugin_allowlist
 		WHERE org_id = $1
@@ -288,7 +285,7 @@ func (h *OrgPluginAllowlistHandler) PutAllowlist(c *gin.Context) {

 	// Verify the org workspace exists.
 	var exists bool
-	if err := db.GetDB().QueryRowContext(ctx,
+	if err := db.DB.QueryRowContext(ctx,
 		`SELECT EXISTS(SELECT 1 FROM workspaces WHERE id = $1)`,
 		orgID,
 	).Scan(&exists); err != nil {
@@ -307,7 +304,7 @@ func (h *OrgPluginAllowlistHandler) PutAllowlist(c *gin.Context) {
 	}

 	// Replace atomically: delete all current entries, then insert the new set.
-	tx, err := db.GetDB().BeginTx(ctx, nil)
+	tx, err := db.DB.BeginTx(ctx, nil)
 	if err != nil {
 		log.Printf("allowlist: begin tx failed for org %s: %v", orgID, err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to start transaction"})
@@ -31,7 +31,7 @@ func NewOrgTokenHandler() *OrgTokenHandler {
 // List returns live (non-revoked) tokens, newest-first. Prefix only —
 // never plaintext or hash.
 func (h *OrgTokenHandler) List(c *gin.Context) {
-	tokens, err := orgtoken.List(c.Request.Context(), db.GetDB())
+	tokens, err := orgtoken.List(c.Request.Context(), db.DB)
 	if err != nil {
 		log.Printf("orgtoken list: %v", err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to list tokens"})
@@ -76,7 +76,7 @@ func (h *OrgTokenHandler) Create(c *gin.Context) {

 	createdBy, orgID := orgTokenActor(c)

-	plaintext, id, err := orgtoken.Issue(c.Request.Context(), db.GetDB(), req.Name, createdBy, orgID)
+	plaintext, id, err := orgtoken.Issue(c.Request.Context(), db.DB, req.Name, createdBy, orgID)
 	if err != nil {
 		log.Printf("orgtoken issue: %v", err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to mint token"})
@@ -101,7 +101,7 @@ func (h *OrgTokenHandler) Revoke(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "id required"})
 		return
 	}
-	ok, err := orgtoken.Revoke(c.Request.Context(), db.GetDB(), id)
+	ok, err := orgtoken.Revoke(c.Request.Context(), db.DB, id)
 	if err != nil {
 		log.Printf("orgtoken revoke: %v", err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to revoke"})
@@ -143,7 +143,7 @@ func callerOrg(c *gin.Context) string {
 	if !ok || tokID == "" {
 		return ""
 	}
-	orgID, err := orgtoken.OrgIDByTokenID(c.Request.Context(), db.GetDB(), tokID)
+	orgID, err := orgtoken.OrgIDByTokenID(c.Request.Context(), db.DB, tokID)
 	if err != nil || orgID == "" {
 		return ""
 	}
@@ -15,7 +15,7 @@ import (
 	"github.com/gin-gonic/gin"
 )

-// setupOrgTokenTest wires the package-global db.GetDB() to a sqlmock for
+// setupOrgTokenTest wires the package-global db.DB to a sqlmock for
 // the duration of a test, returning the handler + mock + cleanup.
 // Gin runs in release mode to suppress debug noise.
 func setupOrgTokenTest(t *testing.T) (*OrgTokenHandler, sqlmock.Sqlmock, func()) {
@@ -43,7 +43,7 @@ type PendingUploadsHandler struct {
 }

 // NewPendingUploadsHandler constructs the handler with a concrete
-// Storage. Production wires up pendinguploads.NewPostgres(db.GetDB()).
+// Storage. Production wires up pendinguploads.NewPostgres(db.DB).
 func NewPendingUploadsHandler(storage pendinguploads.Storage) *PendingUploadsHandler {
 	return &PendingUploadsHandler{storage: storage}
 }
@@ -215,9 +215,6 @@ func TestTarWalk_EmptyDirectory(t *testing.T) {
 	}
 }

-// TestTarWalk_NestedDirs is defined in plugins_atomic_tar_test.go to avoid
-// redeclaration. Deeply nested directory walk is tested there.
-
 // TestTarWalk_DirEntryHasTrailingSlash: directory entries must end with '/'
 // per tar format; tar.Header.Typeflag '5' (dir) must produce "name/" not "name".
 func TestTarWalk_DirEntryHasTrailingSlash(t *testing.T) {
@@ -1,80 +0,0 @@
-package handlers
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// supportsRuntime tests — plugin runtime compatibility checking.
-
-func TestSupportsRuntime_EmptyRuntimes(t *testing.T) {
-	// Empty runtimes = unspecified, try it → always compatible.
-	info := pluginInfo{Name: "test", Runtimes: nil}
-	assert.True(t, info.supportsRuntime("claude_code"))
-	assert.True(t, info.supportsRuntime("any_runtime"))
-}
-
-func TestSupportsRuntime_ExactMatch(t *testing.T) {
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude_code", "anthropic"}}
-	assert.True(t, info.supportsRuntime("claude_code"))
-	assert.True(t, info.supportsRuntime("anthropic"))
-}
-
-func TestSupportsRuntime_NoMatch(t *testing.T) {
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude_code"}}
-	assert.False(t, info.supportsRuntime("openai"))
-}
-
-func TestSupportsRuntime_HyphenUnderscoreNormalized(t *testing.T) {
-	// "claude-code" and "claude_code" are considered equal.
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude-code"}}
-	assert.True(t, info.supportsRuntime("claude_code"))
-	assert.True(t, info.supportsRuntime("claude-code")) // symmetric hyphen form
-}
-
-func TestSupportsRuntime_HyphenVsUnderscoreReverse(t *testing.T) {
-	// Plugin declares underscore form; runtime uses hyphen.
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude_code"}}
-	assert.True(t, info.supportsRuntime("claude-code"))
-}
-
-func TestSupportsRuntime_EmptyStringRuntime(t *testing.T) {
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude_code"}}
-	// Empty runtime string: should not match any plugin.
-	assert.False(t, info.supportsRuntime(""))
-}
-
-func TestSupportsRuntime_SingleRuntimeMatch(t *testing.T) {
-	// Multiple declared runtimes: only matching one is sufficient.
-	info := pluginInfo{Name: "test", Runtimes: []string{"python", "nodejs", "claude_code"}}
-	assert.True(t, info.supportsRuntime("claude_code"))
-	assert.False(t, info.supportsRuntime("ruby"))
-}
-
-func TestSupportsRuntime_AllHyphenForms(t *testing.T) {
-	// Both plugin and runtime use hyphen form.
-	info := pluginInfo{Name: "test", Runtimes: []string{"claude-code"}}
-	assert.True(t, info.supportsRuntime("claude-code"))
-}
-
-func TestSupportsRuntime_MultipleHyphenNormalization(t *testing.T) {
-	// Mixed hyphen/underscore forms normalize to the same.
-	info := pluginInfo{Name: "test", Runtimes: []string{"some-runtime-name"}}
-	assert.True(t, info.supportsRuntime("some_runtime_name"))
-	assert.True(t, info.supportsRuntime("some-runtime-name"))
-}
-
-func TestSupportsRuntime_EmptyPluginRuntimesWithAnyInput(t *testing.T) {
-	// Empty Runtimes on plugin = try it regardless of runtime.
-	info := pluginInfo{Name: "test", Runtimes: []string{}}
-	assert.True(t, info.supportsRuntime(""))
-	assert.True(t, info.supportsRuntime("any"))
-	assert.True(t, info.supportsRuntime("unknown"))
-}
-
-func TestSupportsRuntime_ZeroLengthRuntimes(t *testing.T) {
-	// Empty slice vs nil: both should be treated as "unspecified".
-	info := pluginInfo{Name: "test"}
-	assert.True(t, info.supportsRuntime("anything"))
-}
@@ -300,7 +300,7 @@ func (h *PluginsHandler) Download(c *gin.Context) {
 	}

 	// Auth gate — workspace token required (fail-closed on DB errors).
-	hasLive, hlErr := wsauth.HasAnyLiveToken(ctx, db.GetDB(), workspaceID)
+	hasLive, hlErr := wsauth.HasAnyLiveToken(ctx, db.DB, workspaceID)
 	if hlErr != nil {
 		log.Printf("wsauth: plugin.Download HasAnyLiveToken(%s) failed: %v", workspaceID, hlErr)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "auth check failed"})
@@ -312,7 +312,7 @@ func (h *PluginsHandler) Download(c *gin.Context) {
 			c.JSON(http.StatusUnauthorized, gin.H{"error": "missing workspace auth token"})
 			return
 		}
-		if err := wsauth.ValidateToken(ctx, db.GetDB(), workspaceID, tok); err != nil {
+		if err := wsauth.ValidateToken(ctx, db.DB, workspaceID, tok); err != nil {
 			c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid workspace auth token"})
 			return
 		}
@@ -69,7 +69,7 @@ func recordWorkspacePluginInstall(
 	if err != nil {
 		return err
 	}
-	_, err = db.GetDB().ExecContext(ctx, `
+	_, err = db.DB.ExecContext(ctx, `
 		INSERT INTO workspace_plugins (workspace_id, plugin_name, source_raw, tracked_ref, installed_sha)
 		VALUES ($1, $2, $3, $4, $5)
 		ON CONFLICT (workspace_id, plugin_name)
@@ -86,10 +86,7 @@ func recordWorkspacePluginInstall(
 // pair. Called by the uninstall path so the row doesn't persist with a stale
 // installed_sha after the plugin has been removed from the container.
 func deleteWorkspacePluginRow(ctx context.Context, workspaceID, pluginName string) error {
-	if db.GetDB() == nil {
-		return nil // nil in unit tests; no-op since the row is test-only
-	}
-	_, err := db.GetDB().ExecContext(ctx, `
+	_, err := db.DB.ExecContext(ctx, `
 		DELETE FROM workspace_plugins WHERE workspace_id = $1 AND plugin_name = $2
 	`, workspaceID, pluginName)
 	return err
--- a/Show More
+++ b/Show More