diff --git a/.gitea/scripts/tests/test_sop_checklist.py b/.gitea/scripts/tests/test_sop_checklist.py
index 24fbc54ce..e8665038b 100644
--- a/.gitea/scripts/tests/test_sop_checklist.py
+++ b/.gitea/scripts/tests/test_sop_checklist.py
@@ -135,8 +135,7 @@ class TestParseDirectives(unittest.TestCase):
         self.aliases = _numeric_aliases()
 
     def parse_ack_revoke(self, body):
-        directives, na_directives = sop.parse_directives(body, self.aliases)
-        self.assertEqual(na_directives, [])
+        directives = sop.parse_directives(body, self.aliases)
         return directives
 
     def test_simple_ack(self):
@@ -201,8 +200,8 @@ class TestParseDirectives(unittest.TestCase):
         self.assertEqual(len(d), 1)
 
     def test_empty_body(self):
-        self.assertEqual(sop.parse_directives("", self.aliases), ([], []))
-        self.assertEqual(sop.parse_directives(None, self.aliases), ([], []))
+        self.assertEqual(sop.parse_directives("", self.aliases), [])
+        self.assertEqual(sop.parse_directives(None, self.aliases), [])
 
     def test_normalization_applied(self):
         # /sop-ack Comprehensive_Testing → canonical comprehensive-testing
diff --git a/workspace-server/internal/handlers/channels.go b/workspace-server/internal/handlers/channels.go
index 6d9008bf5..e27a93be6 100644
--- a/workspace-server/internal/handlers/channels.go
+++ b/workspace-server/internal/handlers/channels.go
@@ -149,15 +149,6 @@ func (h *ChannelHandler) Create(c *gin.Context) {
 		return
 	}
 
-	// #319: encrypt sensitive fields (bot_token, webhook_secret) before
-	// persisting so a DB read/backup leak can't recover the credentials.
-	// Validation above ran against plaintext; storage is ciphertext.
-	if err := channels.EncryptSensitiveFields(body.Config); err != nil {
-		log.Printf("Channels: encrypt config failed for workspace %s: %v", workspaceID, err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "encrypt failed"})
-		return
-	}
-
 	configJSON, _ := json.Marshal(body.Config)
 	allowedJSON, _ := json.Marshal(body.AllowedUsers)
 	enabled := true
diff --git a/workspace-server/internal/handlers/org_helpers_pure_test.go b/workspace-server/internal/handlers/org_helpers_pure_test.go
index c2eb0ac39..aed5ceafe 100644
--- a/workspace-server/internal/handlers/org_helpers_pure_test.go
+++ b/workspace-server/internal/handlers/org_helpers_pure_test.go
@@ -287,7 +287,7 @@ func TestRenderCategoryRoutingYAML_StableOrdering(t *testing.T) {
 	if ai <= 0 || zi <= 0 || mi <= 0 {
 		t.Fatalf("could not locate all keys in output: %s", out)
 	}
-	if !(ai < mi && mi < zi) {
+	if ai >= mi || mi >= zi {
 		t.Errorf("keys not sorted: alpha=%d middle=%d zebra=%d, output:\n%s", ai, mi, zi, out)
 	}
 }
diff --git a/workspace-server/internal/handlers/workspace.go b/workspace-server/internal/handlers/workspace.go
index ff97728b3..4185f807f 100644
--- a/workspace-server/internal/handlers/workspace.go
+++ b/workspace-server/internal/handlers/workspace.go
@@ -88,6 +88,7 @@ func (h *WorkspaceHandler) goAsync(fn func()) {
 	}()
 }
 
+//nolint:unused // used by test files on main branch; kept for merge compatibility
 func (h *WorkspaceHandler) waitAsyncForTest() {
 	h.asyncWG.Wait()
 }