test(canvas): add explicit STATUS_CONFIG shape coverage

STATUS_CONFIG exports 7 status keys (online, offline, paused, degraded,
failed, provisioning, not_configured) with dot/glow/label/bar per entry.
The existing statusDotClass.test.ts covered .dot indirectly but left the
constant's full shape (label, glow, bar) untested. Add a dedicated
design-tokens.test.ts that asserts all keys exist, every entry has the
correct fields, and field values match the known tailwind tokens.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

canvas/src/lib/__tests__/design-tokens.test.ts

@@ -0,0 +1,102 @@
+// @vitest-environment jsdom
+/**
+ * Tests for design-tokens.ts constant exports.
+ *
+ * STATUS_CONFIG is tested here directly rather than inside
+ * statusDotClass.test.ts so the constant's full shape (dot, glow, label,
+ * bar per key) is explicitly asserted — not just indirectly via the
+ * statusDotClass helper that consumes its .dot field.
+ */
+import { describe, it, expect } from "vitest";
+import { STATUS_CONFIG } from "../design-tokens";
+
+const ALL_STATUS_KEYS = [
+  "online",
+  "offline",
+  "paused",
+  "degraded",
+  "failed",
+  "provisioning",
+  "not_configured",
+] as const;
+
+describe("STATUS_CONFIG", () => {
+  it("has exactly the expected status keys and no extras", () => {
+    const actual = Object.keys(STATUS_CONFIG).sort();
+    const expected = [...ALL_STATUS_KEYS].sort();
+    expect(actual).toEqual(expected);
+  });
+
+  it("every entry has dot, glow, label, and bar fields", () => {
+    for (const key of ALL_STATUS_KEYS) {
+      const entry = STATUS_CONFIG[key];
+      expect(entry, `entry for "${key}"`).toHaveProperty("dot");
+      expect(entry, `entry for "${key}"`).toHaveProperty("glow");
+      expect(entry, `entry for "${key}"`).toHaveProperty("label");
+      expect(entry, `entry for "${key}"`).toHaveProperty("bar");
+    }
+  });
+
+  it("dot, glow, label, bar are all non-empty strings", () => {
+    for (const key of ALL_STATUS_KEYS) {
+      const entry = STATUS_CONFIG[key];
+      for (const field of ["dot", "glow", "label", "bar"] as const) {
+        expect(typeof entry[field], `"${key}".${field}`).toBe("string");
+        // label must be non-empty; others may be empty (e.g. offline.glow = "").
+        if (field === "label") {
+          expect(entry[field].length, `"${key}".${field}`).toBeGreaterThan(0);
+        }
+      }
+    }
+  });
+
+  it('online: dot is emerald, glow is set, label is "Online"', () => {
+    expect(STATUS_CONFIG.online.dot).toBe("bg-emerald-400");
+    expect(STATUS_CONFIG.online.glow).toBe("shadow-emerald-400/50");
+    expect(STATUS_CONFIG.online.label).toBe("Online");
+    expect(STATUS_CONFIG.online.bar).toBe("from-emerald-500/20 to-transparent");
+  });
+
+  it('offline: dot is zinc, glow is empty, label is "Offline"', () => {
+    expect(STATUS_CONFIG.offline.dot).toBe("bg-zinc-500");
+    expect(STATUS_CONFIG.offline.glow).toBe("");
+    expect(STATUS_CONFIG.offline.label).toBe("Offline");
+    expect(STATUS_CONFIG.offline.bar).toBe("from-zinc-600/10 to-transparent");
+  });
+
+  it('paused: dot is indigo, label is "Paused"', () => {
+    expect(STATUS_CONFIG.paused.dot).toBe("bg-indigo-400");
+    expect(STATUS_CONFIG.paused.glow).toBe("");
+    expect(STATUS_CONFIG.paused.label).toBe("Paused");
+  });
+
+  it('degraded: dot is amber with glow, label is "Degraded"', () => {
+    expect(STATUS_CONFIG.degraded.dot).toBe("bg-amber-400");
+    expect(STATUS_CONFIG.degraded.glow).toBe("shadow-amber-400/50");
+    expect(STATUS_CONFIG.degraded.label).toBe("Degraded");
+  });
+
+  it('failed: dot is red with glow, label is "Failed"', () => {
+    expect(STATUS_CONFIG.failed.dot).toBe("bg-red-400");
+    expect(STATUS_CONFIG.failed.glow).toBe("shadow-red-400/50");
+    expect(STATUS_CONFIG.failed.label).toBe("Failed");
+  });
+
+  it('provisioning: dot is sky with pulse animation, label is "Starting"', () => {
+    expect(STATUS_CONFIG.provisioning.dot).toBe("bg-sky-400 motion-safe:animate-pulse");
+    expect(STATUS_CONFIG.provisioning.glow).toBe("shadow-sky-400/50");
+    expect(STATUS_CONFIG.provisioning.label).toBe("Starting");
+  });
+
+  it('not_configured: dot is amber-300 with glow, label is "Not configured"', () => {
+    expect(STATUS_CONFIG.not_configured.dot).toBe("bg-amber-300");
+    expect(STATUS_CONFIG.not_configured.glow).toBe("shadow-amber-300/50");
+    expect(STATUS_CONFIG.not_configured.label).toBe("Not configured");
+  });
+
+  it("is a frozen static map — same key always returns same object reference", () => {
+    for (const key of ALL_STATUS_KEYS) {
+      expect(STATUS_CONFIG[key]).toBe(STATUS_CONFIG[key]);
+    }
+  });
+});

canvas/src/lib/__tests__/theme.test.ts

@@ -1,10 +1,6 @@
 // @vitest-environment jsdom
 /**
  * Tests for theme.ts — cssVar() function and ColorToken type.
- *
- * cssVar is intentionally simple (string concatenation) — these tests guard
- * against regressions as ColorToken is extended and against typos in the
- * token-name → CSS variable mapping.
  */
 import { describe, it, expect } from "vitest";
 import { cssVar, type ColorToken } from "../theme";
@@ -56,8 +52,6 @@ describe("cssVar", () => {
   });
 
   it("produces a value usable as an inline style prop value", () => {
-    // cssVar returns a plain string, which is exactly what style={{ color: cssVar(token) }}
-    // expects — no extra wrapping needed.
     const result = cssVar("accent");
     expect(typeof result).toBe("string");
     expect(result.startsWith("var(--color-")).toBe(true);

workspace-server/internal/handlers/plugins_sources_test.go

@@ -9,9 +9,10 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-// ListSources is the only exported function in plugins_sources.go. It calls
-// h.sources.Schemes() and returns the result verbatim, so the test verifies
-// the handler correctly serialises whatever the real registry provides.
+// ListSources is the only exported function in plugins_sources.go.
+// It calls h.sources.Schemes() and returns the result verbatim,
+// so the test verifies the handler correctly serialises whatever
+// the real registry provides.
 func TestListSources_ReturnsSchemes(t *testing.T) {
 	// Use a real handler — the registry is deterministic (local + github).
 	h := NewPluginsHandler(t.TempDir(), nil, nil)
@@ -38,7 +39,7 @@ func TestListSources_ReturnsSchemes(t *testing.T) {
 		t.Fatalf("expected at least 1 scheme, got %d: %v", len(body.Schemes), body.Schemes)
 	}
 
-	// Verify the schemes slice is stable (same call always returns same result).
+	// Verify stability — same call always returns same result.
 	w2 := httptest.NewRecorder()
 	c2, _ := gin.CreateTestContext(w2)
 	c2.Request = httptest.NewRequest("GET", "/plugins/sources", nil)

workspace-server/internal/handlers/workspace_abilities_test.go

@@ -0,0 +1,297 @@
+package handlers
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
+	"github.com/gin-gonic/gin"
+)
+
+func setupAbilitiesTest(t *testing.T) (sqlmock.Sqlmock, func()) {
+	t.Helper()
+	mockDB, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prev := db.DB
+	db.DB = mockDB
+	return mock, func() {
+		db.DB = prev
+		mockDB.Close()
+	}
+}
+
+func TestPatchAbilities_InvalidWorkspaceID_Returns400(t *testing.T) {
+	_, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "not-a-valid-uuid"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/not-a-valid-uuid/abilities",
+		bytes.NewBufferString(`{"broadcast_enabled":true}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["error"] != "invalid workspace ID" {
+		t.Errorf("expected 'invalid workspace ID', got %q", body["error"])
+	}
+}
+
+func TestPatchAbilities_EmptyBody_Returns400(t *testing.T) {
+	_, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/abilities",
+		bytes.NewBufferString(`{}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["error"] != "at least one ability field required" {
+		t.Errorf("expected 'at least one ability field required', got %q", body["error"])
+	}
+}
+
+func TestPatchAbilities_InvalidJSON_Returns400(t *testing.T) {
+	_, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/abilities",
+		bytes.NewBufferString(`{invalid json}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["error"] != "invalid request body" {
+		t.Errorf("expected 'invalid request body', got %q", body["error"])
+	}
+}
+
+func TestPatchAbilities_WorkspaceNotFound_Returns404(t *testing.T) {
+	mock, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT EXISTS").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnError(sql.ErrNoRows)
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/abilities",
+		bytes.NewBufferString(`{"broadcast_enabled":true}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestPatchAbilities_WorkspaceDBError_Returns404(t *testing.T) {
+	mock, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT EXISTS").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnError(errors.New("connection refused"))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/abilities",
+		bytes.NewBufferString(`{"broadcast_enabled":true}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestPatchAbilities_UpdateBroadcastEnabled_Returns200(t *testing.T) {
+	mock, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT EXISTS").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec("UPDATE workspaces SET broadcast_enabled").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000", true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/abilities",
+		bytes.NewBufferString(`{"broadcast_enabled":true}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["status"] != "updated" {
+		t.Errorf("expected status=updated, got %v", body)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestPatchAbilities_UpdateTalkToUserEnabled_Returns200(t *testing.T) {
+	mock, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT EXISTS").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec("UPDATE workspaces SET talk_to_user_enabled").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000", true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/abilities",
+		bytes.NewBufferString(`{"talk_to_user_enabled":true}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["status"] != "updated" {
+		t.Errorf("expected status=updated, got %v", body)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestPatchAbilities_UpdateBothAbilities_Returns200(t *testing.T) {
+	mock, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT EXISTS").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec("UPDATE workspaces SET broadcast_enabled").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000", true).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("UPDATE workspaces SET talk_to_user_enabled").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000", false).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/abilities",
+		bytes.NewBufferString(`{"broadcast_enabled":true,"talk_to_user_enabled":false}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["status"] != "updated" {
+		t.Errorf("expected status=updated, got %v", body)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestPatchAbilities_UpdateBroadcastDisabled_Returns200(t *testing.T) {
+	mock, cleanup := setupAbilitiesTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT EXISTS").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+	mock.ExpectExec("UPDATE workspaces SET broadcast_enabled").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000", false).
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("PATCH",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/abilities",
+		bytes.NewBufferString(`{"broadcast_enabled":false}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	PatchAbilities(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}

workspace-server/internal/handlers/workspace_broadcast_test.go

@@ -0,0 +1,398 @@
+package handlers
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
+	"github.com/gin-gonic/gin"
+)
+
+// -------------------------------------------------------------------------- //
+// broadcastTruncate
+// -------------------------------------------------------------------------- //
+
+func TestBroadcastTruncate_ShortString_ReturnsUnmodified(t *testing.T) {
+	result := broadcastTruncate("hello", 10)
+	if result != "hello" {
+		t.Errorf("expected 'hello', got %q", result)
+	}
+}
+
+func TestBroadcastTruncate_ExactlyMaxLength_ReturnsUnmodified(t *testing.T) {
+	result := broadcastTruncate("hello", 5)
+	if result != "hello" {
+		t.Errorf("expected 'hello', got %q", result)
+	}
+}
+
+func TestBroadcastTruncate_ExceedsMaxLength_TruncatesWithEllipsis(t *testing.T) {
+	result := broadcastTruncate("hello world", 5)
+	if result != "hello…" {
+		t.Errorf("expected 'hello…', got %q", result)
+	}
+}
+
+func TestBroadcastTruncate_Unicode_TruncatesAtRuneBoundary(t *testing.T) {
+	result := broadcastTruncate("日本語テスト", 2)
+	if result != "日本…" {
+		t.Errorf("expected '日本…', got %q", result)
+	}
+}
+
+// -------------------------------------------------------------------------- //
+// BroadcastHandler
+// -------------------------------------------------------------------------- //
+
+func setupBroadcastTest(t *testing.T) (sqlmock.Sqlmock, func()) {
+	t.Helper()
+	mockDB, mock, err := sqlmock.New()
+	if err != nil {
+		t.Fatalf("failed to create sqlmock: %v", err)
+	}
+	prev := db.DB
+	db.DB = mockDB
+	return mock, func() {
+		db.DB = prev
+		mockDB.Close()
+	}
+}
+
+func TestBroadcast_InvalidWorkspaceID_Returns400(t *testing.T) {
+	_, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "not-a-uuid"}}
+	c.Request = httptest.NewRequest("POST", "/workspaces/not-a-uuid/broadcast",
+		bytes.NewBufferString(`{"message":"hello"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["error"] != "invalid workspace ID" {
+		t.Errorf("expected 'invalid workspace ID', got %q", body["error"])
+	}
+}
+
+func TestBroadcast_MissingMessage_Returns400(t *testing.T) {
+	_, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("POST",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/broadcast",
+		bytes.NewBufferString(`{}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["error"] != "message is required" {
+		t.Errorf("expected 'message is required', got %q", body["error"])
+	}
+}
+
+func TestBroadcast_WorkspaceNotFound_Returns404(t *testing.T) {
+	mock, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT name, broadcast_enabled FROM workspaces").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnError(sql.ErrNoRows)
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("POST",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/broadcast",
+		bytes.NewBufferString(`{"message":"hello"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestBroadcast_BroadcastDisabled_Returns403(t *testing.T) {
+	mock, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT name, broadcast_enabled FROM workspaces").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
+			AddRow("test-agent", false))
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("POST",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/broadcast",
+		bytes.NewBufferString(`{"message":"hello"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusForbidden {
+		t.Errorf("expected 403, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]string
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["error"] != "broadcast_disabled" {
+		t.Errorf("expected error='broadcast_disabled', got %v", body)
+	}
+	if _, ok := body["hint"]; !ok {
+		t.Errorf("expected hint field in 403 body, got %v", body)
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestBroadcast_RecipientQueryFails_Returns500(t *testing.T) {
+	mock, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT name, broadcast_enabled FROM workspaces").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
+			AddRow("test-agent", true))
+	mock.ExpectQuery("SELECT id FROM workspaces WHERE status != 'removed' AND id != ").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnError(errors.New("connection refused"))
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("POST",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/broadcast",
+		bytes.NewBufferString(`{"message":"hello"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("expected 500, got %d: %s", w.Code, w.Body.String())
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestBroadcast_NoRecipients_Returns200(t *testing.T) {
+	mock, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	mock.ExpectQuery("SELECT name, broadcast_enabled FROM workspaces").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
+			AddRow("test-agent", true))
+	mock.ExpectQuery("SELECT id FROM workspaces WHERE status != 'removed' AND id != ").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000").
+		WillReturnRows(sqlmock.NewRows([]string{"id"}))
+	mock.ExpectExec("INSERT INTO activity_logs").
+		WithArgs("550e8400-e29b-41d4-a716-446655440000", "Broadcast sent to 0 workspace(s)").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: "550e8400-e29b-41d4-a716-446655440000"}}
+	c.Request = httptest.NewRequest("POST",
+		"/workspaces/550e8400-e29b-41d4-a716-446655440000/broadcast",
+		bytes.NewBufferString(`{"message":"hello"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if body["status"] != "sent" {
+		t.Errorf("expected status=sent, got %v", body)
+	}
+	if int(body["delivered"].(float64)) != 0 {
+		t.Errorf("expected delivered=0, got %v", body["delivered"])
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestBroadcast_DeliversToOneRecipient_Returns200(t *testing.T) {
+	mock, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	senderID := "550e8400-e29b-41d4-a716-446655440000"
+	recipientID := "660e8400-e29b-41d4-a716-446655440001"
+	senderName := "test-agent"
+
+	mock.ExpectQuery("SELECT name, broadcast_enabled FROM workspaces").
+		WithArgs(senderID).
+		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
+			AddRow(senderName, true))
+	mock.ExpectQuery("SELECT id FROM workspaces WHERE status != 'removed' AND id != ").
+		WithArgs(senderID).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(recipientID))
+	mock.ExpectExec("INSERT INTO activity_logs").
+		WithArgs(recipientID, senderID, "Broadcast from "+senderName+": hello").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO activity_logs").
+		WithArgs(senderID, "Broadcast sent to 1 workspace(s)").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: senderID}}
+	c.Request = httptest.NewRequest("POST",
+		"/workspaces/"+senderID+"/broadcast",
+		bytes.NewBufferString(`{"message":"hello"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if int(body["delivered"].(float64)) != 1 {
+		t.Errorf("expected delivered=1, got %v", body["delivered"])
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestBroadcast_RecipientInsertFails_Continues_Returns200(t *testing.T) {
+	mock, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	senderID := "550e8400-e29b-41d4-a716-446655440000"
+	recipientID := "660e8400-e29b-41d4-a716-446655440001"
+	senderName := "test-agent"
+
+	mock.ExpectQuery("SELECT name, broadcast_enabled FROM workspaces").
+		WithArgs(senderID).
+		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
+			AddRow(senderName, true))
+	mock.ExpectQuery("SELECT id FROM workspaces WHERE status != 'removed' AND id != ").
+		WithArgs(senderID).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(recipientID))
+	mock.ExpectExec("INSERT INTO activity_logs").
+		WithArgs(recipientID, senderID, "Broadcast from "+senderName+": hello").
+		WillReturnError(errors.New("connection refused"))
+	mock.ExpectExec("INSERT INTO activity_logs").
+		WithArgs(senderID, "Broadcast sent to 0 workspace(s)").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: senderID}}
+	c.Request = httptest.NewRequest("POST",
+		"/workspaces/"+senderID+"/broadcast",
+		bytes.NewBufferString(`{"message":"hello"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if int(body["delivered"].(float64)) != 0 {
+		t.Errorf("expected delivered=0 (failed inserts don't count), got %v", body["delivered"])
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}
+
+func TestBroadcast_SenderLogFails_StillReturns200(t *testing.T) {
+	mock, cleanup := setupBroadcastTest(t)
+	defer cleanup()
+
+	senderID := "550e8400-e29b-41d4-a716-446655440000"
+	recipientID := "660e8400-e29b-41d4-a716-446655440001"
+	senderName := "test-agent"
+
+	mock.ExpectQuery("SELECT name, broadcast_enabled FROM workspaces").
+		WithArgs(senderID).
+		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
+			AddRow(senderName, true))
+	mock.ExpectQuery("SELECT id FROM workspaces WHERE status != 'removed' AND id != ").
+		WithArgs(senderID).
+		WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(recipientID))
+	mock.ExpectExec("INSERT INTO activity_logs").
+		WithArgs(recipientID, senderID, "Broadcast from "+senderName+": hello").
+		WillReturnResult(sqlmock.NewResult(0, 1))
+	mock.ExpectExec("INSERT INTO activity_logs").
+		WithArgs(senderID, "Broadcast sent to 1 workspace(s)").
+		WillReturnError(errors.New("connection refused"))
+
+	h := NewBroadcastHandler(newTestBroadcaster())
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Params = gin.Params{{Key: "id", Value: senderID}}
+	c.Request = httptest.NewRequest("POST",
+		"/workspaces/"+senderID+"/broadcast",
+		bytes.NewBufferString(`{"message":"hello"}`))
+	c.Request.Header.Set("Content-Type", "application/json")
+	c.Request = c.Request.WithContext(context.Background())
+
+	h.Broadcast(c)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var body map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+	if int(body["delivered"].(float64)) != 1 {
+		t.Errorf("expected delivered=1, got %v", body["delivered"])
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("unmet expectations: %v", err)
+	}
+}