@taskforcehq/taskforce 0.3.303 → 0.3.305

package/dist/server/routes.test.js

@@ -10,6 +10,7 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import * as mcpRuntime from '../mcp/runtime';
 import { createDatabaseAdapter } from '../storage/createDatabaseAdapter.js';
 import { ensureDocumentReferenceSchema, ensureTaskAssetsSchema, ensureWorkspaceAssetsSchema } from '../migrations/taskSchemaMigrations.js';
+import { ObjectStorageClient } from '../storage/objectStorageClient.js';
 import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 // Mock TaskforceCore
 vi.mock('../core/Taskforce', () => {
@@ -159,10 +160,13 @@ vi.mock('../core/Taskforce', () => {
             listDocumentReviewSessionsForSync = vi.fn().mockReturnValue([]);
             listDocumentReviewCommentsForSync = vi.fn().mockReturnValue([]);
             listAnnotatedAttachmentSessionsForSync = vi.fn().mockReturnValue([]);
+            listTaskEventsForSync = vi.fn().mockReturnValue([]);
+            listTaskEvents = vi.fn().mockReturnValue([]);
             getDocumentReviewSession = vi.fn().mockReturnValue(null);
             upsertAiProfileForSync = vi.fn();
             upsertDocumentReviewSessionForSync = vi.fn();
             upsertDocumentReviewCommentForSync = vi.fn();
+            upsertTaskEventForSync = vi.fn();
             deleteDocumentReviewSessionForSync = vi.fn().mockReturnValue(true);
             deleteDocumentReviewCommentForSync = vi.fn().mockReturnValue(true);
             deleteAnnotatedAttachmentSessionForSync = vi.fn().mockReturnValue(true);
@@ -434,6 +438,7 @@ vi.mock('../core/Taskforce', () => {
             ]);
             hasWorkspaceAdmin = vi.fn().mockReturnValue(true);
             registerPasswordUser = vi.fn();
+            isEmailVerified = vi.fn().mockReturnValue(false);
             requestEmailVerification = vi.fn().mockReturnValue({});
             verifyEmailWithToken = vi.fn().mockReturnValue(false);
             markEmailVerified = vi.fn().mockReturnValue(true);
@@ -679,6 +684,22 @@ describe('Server Routes', () => {
             res.__getBody = () => Buffer.concat(bodyChunks).toString('utf8');
             return res;
         };
+        const withDevAuthTokenExposure = async (value, run) => {
+            const previous = process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS;
+            if (value === undefined)
+                delete process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS;
+            else
+                process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS = value;
+            try {
+                await run();
+            }
+            finally {
+                if (previous === undefined)
+                    delete process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS;
+                else
+                    process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS = previous;
+            }
+        };
         it('GET /api/taskforce/tasks should return tasks', async () => {
             const mockTasks = { tasks: [], config: {} };
             core.listTasks.mockReturnValue(mockTasks);
@@ -892,6 +913,8 @@ describe('Server Routes', () => {
                 auth: expect.objectContaining({
                     aiProfileName: 'Automation Codex',
                     aiProfileToken: 'tfp_automation_codex',
+                    aiProfileIcon: 'Code2',
+                    aiProfileColor: '#10a37f',
                     aiProfileDescription: 'OpenAI Codex coding agent connected through MCP.',
                     aiProfileRole: 'Coding Agent',
                     aiProfileProvider: 'OpenAI',
@@ -1600,6 +1623,17 @@ describe('Server Routes', () => {
             });
             expect(core.updateUiState).not.toHaveBeenCalledWith('workspace-denied', expect.anything(), expect.anything());
         });
+        it('POST /api/taskforce/ui-state should stamp debug response headers', async () => {
+            const match = matchRoute('POST', '/api/taskforce/ui-state', routes);
+            const req = createMockReq('POST', '/api/taskforce/ui-state', {
+                stateKey: 'app',
+                patch: { activeWorkspaceModule: 'tasks' }
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.setHeader).toHaveBeenCalledWith('x-taskforce-ui-state-route', 'tasks');
+            expect(res.setHeader).toHaveBeenCalledWith('x-taskforce-ui-state-request-id', expect.stringMatching(/^ui-/));
+        });
         it('POST /api/taskforce/workspace-profile should persist workspace name and description', async () => {
             const match = matchRoute('POST', '/api/taskforce/workspace-profile', routes);
             const req = createMockReq('POST', '/api/taskforce/workspace-profile', { workspaceId: 'default', name: 'Acme Project', description: 'Customer onboarding' }, { 'x-taskforce-workspace-id': 'default' });
@@ -1896,6 +1930,20 @@ describe('Server Routes', () => {
             });
         });
         it('POST /api/taskforce/settings/mcp/test-connection should validate the token against workspace and scopes', async () => {
+            const previousCloudEnvironment = process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+            process.env.TASKFORCE_CLOUD_ENVIRONMENT = 'performance';
+            const fetchMock = vi.fn(async () => new Response(JSON.stringify({
+                jsonrpc: '2.0',
+                id: 'mcp-connection-test',
+                result: {
+                    protocolVersion: '2025-03-26',
+                    serverInfo: { name: 'taskforce-cloud' }
+                }
+            }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' }
+            }));
+            vi.stubGlobal('fetch', fetchMock);
             core.inspectMcpAccessToken.mockReturnValue({
                 tokenId: 'mcp-token-1',
                 tokenPrefix: 'tfmcp_abc123',
@@ -1922,12 +1970,136 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             res.req = req;
-            await match?.handler(req, res, {});
+            try {
+                await match?.handler(req, res, {});
+            }
+            finally {
+                vi.unstubAllGlobals();
+                if (previousCloudEnvironment === undefined)
+                    delete process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+                else
+                    process.env.TASKFORCE_CLOUD_ENVIRONMENT = previousCloudEnvironment;
+            }
             expect(core.inspectMcpAccessToken).toHaveBeenCalledWith('tfmcp_abc123_secret');
+            expect(fetchMock).toHaveBeenCalledWith('https://performance-mcp.taskforcehq.ai/mcp', expect.objectContaining({
+                method: 'POST',
+                headers: expect.objectContaining({
+                    Authorization: 'Bearer tfmcp_abc123_secret'
+                })
+            }));
             const payload = JSON.parse(res.end.mock.calls[0][0]);
             expect(payload.success).toBe(true);
             expect(payload.result.workspaceName).toBe('Workspace One');
             expect(payload.result.scopes).toEqual(['tasks:read', 'tasks:write']);
+            expect(payload.result.endpoint).toBe('https://performance-mcp.taskforcehq.ai/mcp');
+            expect(payload.result.serverName).toBe('taskforce-cloud');
+            expect(payload.result.protocolVersion).toBe('2025-03-26');
+        });
+        it('POST /api/taskforce/settings/mcp/test-connection should return a clear error when the dedicated MCP host returns a gateway failure', async () => {
+            const previousCloudEnvironment = process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+            process.env.TASKFORCE_CLOUD_ENVIRONMENT = 'performance';
+            const fetchMock = vi.fn(async () => new Response('Bad gateway', {
+                status: 502,
+                headers: { 'Content-Type': 'text/plain' }
+            }));
+            vi.stubGlobal('fetch', fetchMock);
+            core.inspectMcpAccessToken.mockReturnValue({
+                tokenId: 'mcp-token-1',
+                tokenPrefix: 'tfmcp_abc123',
+                workspaceId: 'workspace-1',
+                userId: 'user-1',
+                name: 'Workspace MCP',
+                scopes: ['tasks:read', 'tasks:write'],
+                status: 'active'
+            });
+            const match = matchRoute('POST', '/api/taskforce/settings/mcp/test-connection', routes);
+            const req = createMockReq('POST', '/api/taskforce/settings/mcp/test-connection', {
+                token: 'tfmcp_abc123_secret',
+                requiredScopes: ['tasks:read', 'tasks:write']
+            }, {
+                'x-taskforce-runtime-mode': 'cloud',
+                'x-taskforce-user-id': 'user-1',
+                'x-taskforce-workspace-id': 'workspace-1'
+            });
+            const res = createMockRes();
+            res.req = req;
+            try {
+                await match?.handler(req, res, {});
+            }
+            finally {
+                vi.unstubAllGlobals();
+                if (previousCloudEnvironment === undefined)
+                    delete process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+                else
+                    process.env.TASKFORCE_CLOUD_ENVIRONMENT = previousCloudEnvironment;
+            }
+            expect(res.writeHead).toHaveBeenCalledWith(502, { 'Content-Type': 'application/json' });
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.success).toBe(false);
+            expect(payload.code).toBe('MCP_ENDPOINT_GATEWAY_ERROR');
+            expect(payload.error).toContain('https://performance-mcp.taskforcehq.ai/mcp');
+            expect(payload.details).toEqual(expect.objectContaining({
+                endpoint: 'https://performance-mcp.taskforcehq.ai/mcp',
+                upstreamStatus: 502
+            }));
+        });
+        it('POST /api/taskforce/settings/mcp/test-connection should prefer the dedicated MCP hostname when cloudMcpBaseUrl points at the app host', async () => {
+            const previousCloudEnvironment = process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+            const previousCloudMcpBaseUrl = process.env.VITE_TASKFORCE_CLOUD_MCP_BASE_URL;
+            process.env.TASKFORCE_CLOUD_ENVIRONMENT = 'performance';
+            process.env.VITE_TASKFORCE_CLOUD_MCP_BASE_URL = 'https://performance-app.taskforcehq.ai';
+            const fetchMock = vi.fn(async () => new Response(JSON.stringify({
+                jsonrpc: '2.0',
+                id: 'mcp-connection-test',
+                result: {
+                    serverInfo: { name: 'taskforce-cloud' }
+                }
+            }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' }
+            }));
+            vi.stubGlobal('fetch', fetchMock);
+            core.inspectMcpAccessToken.mockReturnValue({
+                tokenId: 'mcp-token-1',
+                tokenPrefix: 'tfmcp_abc123',
+                workspaceId: 'workspace-1',
+                userId: 'user-1',
+                name: 'Workspace MCP',
+                scopes: ['tasks:read', 'tasks:write'],
+                status: 'active'
+            });
+            core.getWorkspaceProfile.mockReturnValue({
+                id: 'workspace-1',
+                slug: 'workspace-1',
+                name: 'Workspace One',
+                description: null
+            });
+            const match = matchRoute('POST', '/api/taskforce/settings/mcp/test-connection', routes);
+            const req = createMockReq('POST', '/api/taskforce/settings/mcp/test-connection', {
+                token: 'tfmcp_abc123_secret',
+                requiredScopes: ['tasks:read']
+            }, {
+                'x-taskforce-runtime-mode': 'cloud',
+                'x-taskforce-user-id': 'user-1',
+                'x-taskforce-workspace-id': 'workspace-1'
+            });
+            const res = createMockRes();
+            res.req = req;
+            try {
+                await match?.handler(req, res, {});
+            }
+            finally {
+                vi.unstubAllGlobals();
+                if (previousCloudEnvironment === undefined)
+                    delete process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+                else
+                    process.env.TASKFORCE_CLOUD_ENVIRONMENT = previousCloudEnvironment;
+                if (previousCloudMcpBaseUrl === undefined)
+                    delete process.env.VITE_TASKFORCE_CLOUD_MCP_BASE_URL;
+                else
+                    process.env.VITE_TASKFORCE_CLOUD_MCP_BASE_URL = previousCloudMcpBaseUrl;
+            }
+            expect(fetchMock).toHaveBeenCalledWith('https://performance-mcp.taskforcehq.ai/mcp', expect.any(Object));
         });
         it('POST /api/taskforce/settings/mcp/test-connection should report missing scopes', async () => {
             core.inspectMcpAccessToken.mockReturnValue({
@@ -2212,6 +2384,63 @@ describe('Server Routes', () => {
             expect(fetchMock).not.toHaveBeenCalled();
             vi.unstubAllGlobals();
         });
+        it('GET /api/taskforce/documents/:assetId/content should fall back to object storage when local canonical metadata points at a missing file', async () => {
+            const fetchMock = vi.fn().mockResolvedValue({
+                status: 200,
+                ok: true,
+                headers: new Headers({ 'content-type': 'text/markdown' }),
+                arrayBuffer: async () => Buffer.from('# Recovered canonical doc\n').buffer,
+            });
+            vi.stubGlobal('fetch', fetchMock);
+            const routesWithStorage = createRoutes(core, {
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'acct-1',
+                        bucket: 'taskforce-docs',
+                        endpoint: 'https://example.r2.cloudflarestorage.com',
+                        accessKeyId: 'access-key-1',
+                        secretAccessKey: 'secret-key-1',
+                        keyPrefix: 'taskforce',
+                        signedUploadTtlSeconds: 600,
+                        signedDownloadTtlSeconds: 300
+                    }
+                }
+            });
+            const store = new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId());
+            store.upsertAsset({
+                assetId: 'asset-doc-content-fallback-1',
+                workspaceId: 'default',
+                kind: 'document',
+                logicalName: 'Recovered canonical doc',
+                originalFilename: 'recovered-canonical-doc.md',
+                mimeType: 'text/markdown',
+                storageProvider: 'local',
+                storageKey: 'workspaces/default/assets/documents/asset-doc-content-fallback-1-recovered-canonical-doc.md',
+                contentSha256: 'sha-canonical-doc-fallback-1',
+                sizeBytes: 25,
+                documentId: 'doc-content-fallback-1',
+                version: 1,
+                isLatest: true,
+                scanStatus: 'clean',
+                scanEngine: null,
+                scanDetails: null,
+                deletedAt: null,
+                purgeAfter: null
+            });
+            const req = createMockReq('GET', '/api/taskforce/documents/asset-doc-content-fallback-1/content');
+            const res = createMockRes();
+            await matchRoute('GET', '/api/taskforce/documents/asset-doc-content-fallback-1/content', routesWithStorage)?.handler(req, res, {
+                assetId: 'asset-doc-content-fallback-1'
+            });
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.objectContaining({
+                'Content-Type': 'text/markdown',
+                'Content-Disposition': 'inline'
+            }));
+            expect(res.end).toHaveBeenCalledWith(expect.any(Buffer));
+            expect(fetchMock).toHaveBeenCalled();
+            vi.unstubAllGlobals();
+        });
         it('GET /api/taskforce/documents/:assetId/content should reject non-document assets', async () => {
             const routesWithStorage = createRoutes(core, {
                 objectStorage: {
@@ -3467,10 +3696,106 @@ describe('Server Routes', () => {
             const res = createMockRes();
             await match?.handler(req, res, { assetId: 'asset-doc-attached-1' });
             expect(res.writeHead).toHaveBeenCalledWith(409, { 'Content-Type': 'application/json' });
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toEqual(expect.objectContaining({
+                error: 'Document is still attached to one or more tasks.',
+                activeAttachmentCount: 1,
+                requiresForceDetach: true
+            }));
             expect(store.get('asset-doc-attached-1', 'default')?.deletedAt).toBeNull();
             fs.rmSync(dbRoot, { recursive: true, force: true });
             fs.rmSync(tmpRoot, { recursive: true, force: true });
         });
+        it('DELETE /api/taskforce/documents/:assetId should unlink attached canonical documents when forceDetach is true', async () => {
+            const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-documents-delete-force-attached-'));
+            const basePath = path.join(tmpRoot, '.taskforce');
+            const documentPath = path.join(basePath, 'workspaces', 'default', 'assets', 'documents', 'asset-doc-force-delete-1-notes.md');
+            fs.mkdirSync(path.dirname(documentPath), { recursive: true });
+            fs.writeFileSync(documentPath, '# attached\n', 'utf8');
+            core.getPaths.mockReturnValue({
+                projectRoot: tmpRoot,
+                basePath,
+            });
+            const { tmpRoot: dbRoot, db, store } = createWorkspaceAssetTestStore();
+            core.getDatabaseAdapter = vi.fn().mockReturnValue(db);
+            core.getTenantId = vi.fn().mockReturnValue('default');
+            store.upsertAsset({
+                assetId: 'asset-doc-force-delete-1',
+                workspaceId: 'default',
+                kind: 'document',
+                originalFilename: 'notes.md',
+                mimeType: 'text/markdown',
+                storageProvider: 'local',
+                storageKey: 'workspaces/default/assets/documents/asset-doc-force-delete-1-notes.md',
+                contentSha256: 'sha-doc-force-delete-1',
+                sizeBytes: 16,
+                documentId: 'doc-force-delete-1',
+                version: 1,
+                updatedAt: '2026-03-18T14:00:00.000Z'
+            });
+            store.upsertLink({
+                workspaceId: 'default',
+                assetId: 'asset-doc-force-delete-1',
+                taskId: 'task-keep',
+                role: 'attachment'
+            });
+            core.getTask.mockImplementation((id) => id === 'task-keep'
+                ? {
+                    id: 'task-keep',
+                    title: 'Task Keep',
+                    attachments: [{
+                            path: '/api/taskforce/documents/asset-doc-force-delete-1/content',
+                            fsPath: 'workspaces/default/assets/documents/asset-doc-force-delete-1-notes.md',
+                            caption: 'notes.md',
+                            assetId: 'asset-doc-force-delete-1'
+                        }, {
+                            path: '/api/taskforce/context/other-file.md',
+                            fsPath: 'workspaces/default/assets/files/other-file.md',
+                            caption: 'other-file.md'
+                        }]
+                }
+                : null);
+            core.updateTask.mockImplementation((_id, patch) => ({
+                id: 'task-keep',
+                attachments: patch.attachments
+            }));
+            const routesWithDb = createRoutes(core);
+            const match = matchRoute('DELETE', '/api/taskforce/documents/asset-doc-force-delete-1', routesWithDb);
+            const req = createMockReq('DELETE', '/api/taskforce/documents/asset-doc-force-delete-1', {
+                forceDetach: true
+            }, {
+                'x-taskforce-workspace-id': 'default'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, { assetId: 'asset-doc-force-delete-1' });
+            expect(core.updateTask).toHaveBeenCalledWith('task-keep', {
+                attachments: [{
+                        path: '/api/taskforce/context/other-file.md',
+                        fsPath: 'workspaces/default/assets/files/other-file.md',
+                        caption: 'other-file.md'
+                    }]
+            }, 'default', expect.objectContaining({ actorRef: 'user', saveSource: 'manual' }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, { 'Content-Type': 'application/json' });
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toEqual(expect.objectContaining({
+                success: true,
+                softDeleted: true,
+                detachedTaskCount: 1
+            }));
+            expect(store.get('asset-doc-force-delete-1', 'default')).toEqual(expect.objectContaining({
+                deletedAt: expect.any(String),
+                purgeAfter: expect.any(String)
+            }));
+            expect(store.listLinksForAsset('asset-doc-force-delete-1', 'default', { includeDeleted: true })).toEqual([
+                expect.objectContaining({
+                    taskId: 'task-keep',
+                    role: 'attachment',
+                    deletedAt: expect.any(String)
+                })
+            ]);
+            fs.rmSync(dbRoot, { recursive: true, force: true });
+            fs.rmSync(tmpRoot, { recursive: true, force: true });
+        });
         it('PATCH /api/taskforce/documents/:assetId should update the shared display name without changing storage identity', async () => {
             const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-documents-rename-'));
             core.getPaths.mockReturnValue({
@@ -3708,7 +4033,85 @@ describe('Server Routes', () => {
             }));
             expect(res.setHeader).not.toHaveBeenCalledWith('Set-Cookie', expect.any(String));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
-            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"verificationRequired":true'));
+            const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+            expect(payload).toEqual(expect.objectContaining({
+                success: true,
+                verificationRequired: true
+            }));
+            expect(payload.verificationToken).toBeUndefined();
+        });
+        it('POST /api/taskforce/auth/register should not depend on onboarding policy lookups', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            core.getOnboardingPolicy.mockImplementationOnce(() => {
+                throw new Error('for SELECT DISTINCT, ORDER BY expressions must appear in select list');
+            });
+            core.getGlobalSettings.mockReturnValue({
+                auth: {
+                    allowSelfRegistration: true,
+                    requireVerifiedEmail: false
+                }
+            });
+            routes = createRoutes(core, { authConfig });
+            core.registerPasswordUser.mockReturnValueOnce({
+                userId: 'u-new',
+                workspaceId: 'default',
+                role: 'member',
+                planSelectionRequired: false
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                email: 'newuser@example.com',
+                password: 'password123'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.registerPasswordUser).toHaveBeenCalledWith(expect.objectContaining({
+                email: 'newuser@example.com'
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
+        });
+        it('POST /api/taskforce/auth/register should only expose verificationToken when explicitly enabled', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            await withDevAuthTokenExposure('true', async () => {
+                routes = createRoutes(core, { authConfig });
+                core.registerPasswordUser.mockReturnValueOnce({
+                    userId: 'user-opt-in',
+                    workspaceId: null,
+                    role: 'member',
+                    planSelectionRequired: false
+                });
+                core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-opt-in' });
+                const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                    email: 'opt-in@example.com',
+                    password: 'password123'
+                });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.verificationToken).toBe('verify-token-opt-in');
+            });
         });
         it('POST /api/taskforce/auth/register should allow first-time registration without workspaceId', async () => {
             const authConfig = {
@@ -3821,7 +4224,51 @@ describe('Server Routes', () => {
             }));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
         });
-        it('POST /api/taskforce/auth/register should return conflict when email exists', async () => {
+        it('POST /api/taskforce/auth/register should route duplicate unverified email into verification recovery', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            await withDevAuthTokenExposure('true', async () => {
+                routes = createRoutes(core, { authConfig });
+                core.hasWorkspaceAdmin.mockReturnValueOnce(true);
+                core.isEmailVerified.mockReturnValueOnce(false);
+                core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-existing' });
+                const error = new Error('Email is already registered');
+                error.statusCode = 409;
+                error.code = 'EMAIL_ALREADY_EXISTS';
+                core.registerPasswordUser.mockImplementationOnce(() => {
+                    throw error;
+                });
+                const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                    email: 'owner@example.com',
+                    password: 'password123',
+                    workspaceId: 'workspace-1'
+                });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                expect(core.isEmailVerified).toHaveBeenCalledWith('owner@example.com');
+                expect(core.requestEmailVerification).toHaveBeenCalledWith({ email: 'owner@example.com' });
+                expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
+                const responsePayload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(responsePayload).toEqual(expect.objectContaining({
+                    success: false,
+                    code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                    verificationRequired: true,
+                    emailSent: true,
+                    verificationToken: 'verify-token-existing'
+                }));
+            });
+        });
+        it('POST /api/taskforce/auth/register should return conflict when verified email exists', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3835,6 +4282,7 @@ describe('Server Routes', () => {
             };
             routes = createRoutes(core, { authConfig });
             core.hasWorkspaceAdmin.mockReturnValueOnce(true);
+            core.isEmailVerified.mockReturnValueOnce(true);
             const error = new Error('Email is already registered');
             error.statusCode = 409;
             error.code = 'EMAIL_ALREADY_EXISTS';
@@ -3849,14 +4297,134 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
-            expect(res.end).toHaveBeenCalledWith(JSON.stringify({
-                success: false,
-                error: 'Email is already registered',
-                code: 'EMAIL_ALREADY_EXISTS'
-            }));
+            expect(core.isEmailVerified).toHaveBeenCalledWith('owner@example.com');
+            expect(core.requestEmailVerification).not.toHaveBeenCalled();
+            expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(JSON.stringify({
+                success: false,
+                error: 'Email is already registered',
+                code: 'EMAIL_ALREADY_EXISTS'
+            }));
+        });
+        it('POST /api/taskforce/auth/register should fail when the onboarding policy is misconfigured', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            const error = new Error('Configured onboarding plan version "missing-v9" was not found.');
+            error.statusCode = 500;
+            error.code = 'SIGNUP_PLAN_VERSION_NOT_FOUND';
+            core.registerPasswordUser.mockImplementationOnce(() => {
+                throw error;
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                email: 'misconfigured@example.com',
+                password: 'password123'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(500, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(JSON.stringify({
+                success: false,
+                error: 'Configured onboarding plan version "missing-v9" was not found.',
+                code: 'SIGNUP_PLAN_VERSION_NOT_FOUND'
+            }));
+        });
+        it('POST /api/taskforce/auth/verify-email/request should report no-send cases without claiming delivery', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.requestEmailVerification.mockReturnValueOnce({});
+            const match = matchRoute('POST', '/api/taskforce/auth/verify-email/request', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/verify-email/request', { email: 'nobody@example.com' });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+            expect(payload).toMatchObject({
+                success: true,
+                emailSent: false,
+                deliveryAttempted: false
+            });
+            expect(payload.emailError).toBeUndefined();
+        });
+        it('POST /api/taskforce/auth/verify-email/request should only expose verificationToken when explicitly enabled', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            await withDevAuthTokenExposure(undefined, async () => {
+                routes = createRoutes(core, { authConfig });
+                core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-hidden' });
+                const match = matchRoute('POST', '/api/taskforce/auth/verify-email/request', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/verify-email/request', { email: 'owner@example.com' });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.verificationToken).toBeUndefined();
+            });
+            await withDevAuthTokenExposure('true', async () => {
+                routes = createRoutes(core, { authConfig });
+                core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-visible' });
+                const match = matchRoute('POST', '/api/taskforce/auth/verify-email/request', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/verify-email/request', { email: 'owner@example.com' });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.verificationToken).toBe('verify-token-visible');
+            });
+        });
+        it('POST /api/taskforce/auth/password-reset/request should report no-send cases without claiming delivery', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.requestPasswordReset.mockReturnValueOnce({});
+            const match = matchRoute('POST', '/api/taskforce/auth/password-reset/request', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/password-reset/request', { email: 'nobody@example.com' });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+            expect(payload).toMatchObject({
+                success: true,
+                emailSent: false,
+                deliveryAttempted: false
+            });
+            expect(payload.emailError).toBeUndefined();
         });
-        it('POST /api/taskforce/auth/register should fail when the onboarding policy is misconfigured', async () => {
+        it('POST /api/taskforce/auth/password-reset/request should only expose resetToken when explicitly enabled', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3868,26 +4436,26 @@ describe('Server Routes', () => {
                 sessionSecret: 'test-secret',
                 sessionTtlSeconds: 3600
             };
-            routes = createRoutes(core, { authConfig });
-            const error = new Error('Configured onboarding plan version "missing-v9" was not found.');
-            error.statusCode = 500;
-            error.code = 'SIGNUP_PLAN_VERSION_NOT_FOUND';
-            core.registerPasswordUser.mockImplementationOnce(() => {
-                throw error;
+            await withDevAuthTokenExposure(undefined, async () => {
+                routes = createRoutes(core, { authConfig });
+                core.requestPasswordReset.mockReturnValueOnce({ token: 'reset-token-hidden' });
+                const match = matchRoute('POST', '/api/taskforce/auth/password-reset/request', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/password-reset/request', { email: 'owner@example.com' });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.resetToken).toBeUndefined();
             });
-            const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
-            const req = createMockReq('POST', '/api/taskforce/auth/register', {
-                email: 'misconfigured@example.com',
-                password: 'password123'
+            await withDevAuthTokenExposure('true', async () => {
+                routes = createRoutes(core, { authConfig });
+                core.requestPasswordReset.mockReturnValueOnce({ token: 'reset-token-visible' });
+                const match = matchRoute('POST', '/api/taskforce/auth/password-reset/request', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/password-reset/request', { email: 'owner@example.com' });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.resetToken).toBe('reset-token-visible');
             });
-            const res = createMockRes();
-            await match?.handler(req, res, {});
-            expect(res.writeHead).toHaveBeenCalledWith(500, expect.any(Object));
-            expect(res.end).toHaveBeenCalledWith(JSON.stringify({
-                success: false,
-                error: 'Configured onboarding plan version "missing-v9" was not found.',
-                code: 'SIGNUP_PLAN_VERSION_NOT_FOUND'
-            }));
         });
         it('POST /api/taskforce/auth/verify-email/confirm should verify token', async () => {
             const authConfig = {
@@ -4344,6 +4912,40 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
         });
+        it('POST /api/taskforce/auth/login should not depend on onboarding policy lookups', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            core.getOnboardingPolicy.mockImplementationOnce(() => {
+                throw new Error('for SELECT DISTINCT, ORDER BY expressions must appear in select list');
+            });
+            routes = createRoutes(core, { authConfig });
+            core.authenticatePasswordUserDetailed.mockReturnValueOnce({
+                ok: false,
+                code: 'INVALID_CREDENTIALS'
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/login', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/login', {
+                email: 'user@example.com',
+                password: 'wrongpass'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(401, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('Invalid email/password.'));
+            expect(core.authenticatePasswordUserDetailed).toHaveBeenCalledWith(expect.objectContaining({
+                email: 'user@example.com',
+                requireVerifiedEmail: true
+            }));
+        });
         it('GET /api/taskforce/workspaces should list authenticated user workspaces', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -5663,6 +6265,109 @@ describe('Server Routes', () => {
             ]));
             fs.rmSync(dbRoot, { recursive: true, force: true });
         });
+        it('GET /api/taskforce/sync/workspace/pull should hydrate canonical markdown documents from object storage', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const fetchMock = vi.fn().mockResolvedValue({
+                status: 200,
+                ok: true,
+                headers: new Headers({ 'content-type': 'text/markdown' }),
+                arrayBuffer: async () => Uint8Array.from(Buffer.from('# Canonical R2 doc\n')).buffer,
+            });
+            vi.stubGlobal('fetch', fetchMock);
+            const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-sync-pull-doc-r2-'));
+            const basePath = path.join(tmpRoot, '.taskforce');
+            fs.mkdirSync(basePath, { recursive: true });
+            const { tmpRoot: dbRoot, db, store } = createWorkspaceAssetTestStore();
+            store.upsertAsset({
+                assetId: 'asset-doc-r2-1',
+                workspaceId: 'workspace-1',
+                kind: 'document',
+                originalFilename: 'canonical-r2-doc.md',
+                mimeType: 'text/markdown',
+                storageProvider: 'r2',
+                storageKey: 'workspaces/workspace-1/assets/documents/asset-doc-r2-1-canonical-r2-doc.md',
+                contentSha256: 'sha-doc-r2-1',
+                sizeBytes: 19,
+                documentId: 'doc-r2-1',
+                referenceNumber: 201,
+                version: 2,
+                isLatest: true,
+                createdAt: '2026-03-17T09:00:00.000Z',
+                updatedAt: '2026-03-17T10:00:00.000Z'
+            });
+            store.upsertLink({
+                workspaceId: 'workspace-1',
+                assetId: 'asset-doc-r2-1',
+                taskId: 'task-1',
+                role: 'attachment',
+                createdAt: '2026-03-17T10:00:00.000Z',
+                updatedAt: '2026-03-17T10:00:00.000Z'
+            });
+            core.getPaths.mockReturnValue({
+                projectRoot: tmpRoot,
+                basePath,
+            });
+            core.getDatabaseAdapter = vi.fn().mockReturnValue(db);
+            core.getTenantId = vi.fn().mockReturnValue('default');
+            routes = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'acct-1',
+                        bucket: 'taskforce-docs',
+                        endpoint: 'https://example.r2.cloudflarestorage.com',
+                        accessKeyId: 'access-key-1',
+                        secretAccessKey: 'secret-key-1',
+                        keyPrefix: 'taskforce',
+                        signedUploadTtlSeconds: 600,
+                        signedDownloadTtlSeconds: 300
+                    }
+                }
+            });
+            core.listUserWorkspaces.mockReturnValueOnce([{ id: 'workspace-1', slug: 'workspace-1', name: 'Workspace 1', description: null, role: 'owner', status: 'active', betaAccess: true }]);
+            const cookie = createSessionTokenCookie('session-sync-pull-doc-r2', authConfig, {
+                role: 'owner',
+                workspaceId: 'workspace-1',
+                userId: 'user-1'
+            });
+            core.listTasks.mockReturnValueOnce({ tasks: [] });
+            core.listArchive.mockReturnValueOnce({ archived: [] });
+            const match = matchRoute('GET', '/api/taskforce/sync/workspace/pull', routes);
+            const req = createMockReq('GET', '/api/taskforce/sync/workspace/pull?workspaceId=workspace-1&limit=20', undefined, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payloadRaw = res.end.mock.calls[0]?.[0];
+            const payload = JSON.parse(String(payloadRaw || '{}'));
+            expect(payload.changes).toEqual(expect.arrayContaining([
+                expect.objectContaining({
+                    op: 'document-upsert',
+                    path: 'workspaces/workspace-1/assets/documents/asset-doc-r2-1-canonical-r2-doc.md',
+                    content: '# Canonical R2 doc\n',
+                    assetId: 'asset-doc-r2-1',
+                    documentId: 'doc-r2-1',
+                    referenceNumber: 201,
+                    version: 2,
+                    taskId: 'task-1',
+                    originalFilename: 'canonical-r2-doc.md',
+                    linkRole: 'attachment'
+                })
+            ]));
+            expect(fetchMock).toHaveBeenCalled();
+            vi.unstubAllGlobals();
+            fs.rmSync(dbRoot, { recursive: true, force: true });
+            fs.rmSync(tmpRoot, { recursive: true, force: true });
+        });
         it('GET /api/taskforce/sync/workspace/pull should include document review session upserts and deletes', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -6531,6 +7236,77 @@ describe('Server Routes', () => {
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
+        it('POST /api/taskforce/sync/workspace/apply-local should apply task event upserts after task snapshots', async () => {
+            core.resolvePreferredWorkspaceId.mockReturnValue('workspace-local');
+            core.getTask.mockImplementation((taskId) => (taskId === 'task-sync-activity-1'
+                ? {
+                    id: 'task-sync-activity-1',
+                    title: 'Synced task',
+                    status: 'done',
+                    category: 'general',
+                    type: 'task',
+                    createdAt: '2026-03-24T10:00:00.000Z',
+                    updatedAt: '2026-03-24T10:05:00.000Z',
+                    taskEvents: []
+                }
+                : null));
+            routes = createRoutes(core, { authConfig: { runtimeMode: 'local', enabled: false } });
+            const match = matchRoute('POST', '/api/taskforce/sync/workspace/apply-local', routes);
+            const req = createMockReq('POST', '/api/taskforce/sync/workspace/apply-local', {
+                changes: [
+                    {
+                        op: 'upsert',
+                        archived: false,
+                        task: {
+                            id: 'task-sync-activity-1',
+                            title: 'Synced task',
+                            status: 'done',
+                            category: 'general',
+                            type: 'task',
+                            updatedAt: '2026-03-24T10:05:00.000Z'
+                        }
+                    },
+                    {
+                        op: 'task-event-upsert',
+                        event: {
+                            id: 'task-event-sync-1',
+                            taskId: 'task-sync-activity-1',
+                            workspaceId: 'workspace-local',
+                            action: 'task-status-changed',
+                            actor: 'ai-profile-1',
+                            actorType: 'ai',
+                            createdAt: '2026-03-24T10:05:00.000Z',
+                            details: {
+                                changes: {
+                                    status: {
+                                        from: 'in-progress',
+                                        to: 'done'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                ]
+            }, {
+                'x-taskforce-workspace-id': 'workspace-local'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-sync-activity-1' })],
+                archived: []
+            }), 'workspace-local');
+            expect(core.upsertTaskEventForSync).toHaveBeenCalledWith(expect.objectContaining({
+                id: 'task-event-sync-1',
+                taskId: 'task-sync-activity-1',
+                workspaceId: 'workspace-local',
+                action: 'task-status-changed',
+                actor: 'ai-profile-1',
+                actorType: 'ai',
+                createdAt: '2026-03-24T10:05:00.000Z'
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        });
         it('POST /api/taskforce/sync/workspace/apply-local should fail when document review session persistence fails', async () => {
             core.resolvePreferredWorkspaceId.mockReturnValue('workspace-local');
             const error = new Error('document review session write failed');
@@ -8771,6 +9547,73 @@ describe('Server Routes', () => {
             expect(payload.authenticated).toBe(true);
             expect(payload.avatarUrl).toBe('/api/taskforce/context/users%2Fu-avatar%2Fprofile%2Favatar%2Fdraft.png');
         });
+        it('GET /api/taskforce/auth/session should not wait for avatar cleanup before responding', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const deleteObjectCompletion = { resolve: null };
+            const deleteObjectSpy = vi.spyOn(ObjectStorageClient.prototype, 'deleteObject').mockImplementation(() => new Promise((resolve) => {
+                deleteObjectCompletion.resolve = resolve;
+            }));
+            routes = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'test-account',
+                        bucket: 'taskforce-test',
+                        endpoint: 'https://example.com',
+                        accessKeyId: 'test-key',
+                        secretAccessKey: 'test-secret',
+                        keyPrefix: '',
+                        signedUploadTtlSeconds: 60,
+                        signedDownloadTtlSeconds: 60
+                    }
+                }
+            });
+            core.cleanupStaleUserAvatarUploadDrafts.mockReturnValueOnce([{
+                    draftId: 'avatar-draft-stale',
+                    userId: 'u-avatar',
+                    storageKey: 'users/u-avatar/profile/avatar/avatar-draft-stale.png',
+                    discardedAt: null,
+                    consumedAt: null,
+                    finalizedAt: null,
+                    createdAt: '2026-04-14T00:00:00.000Z',
+                    updatedAt: '2026-04-14T00:00:00.000Z'
+                }]);
+            const cookie = createSessionTokenCookie('session-avatar-cleanup', authConfig, {
+                userId: 'u-avatar',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('GET', '/api/taskforce/auth/session', routes);
+            const req = createMockReq('GET', '/api/taskforce/auth/session', undefined, { cookie });
+            const res = createMockRes();
+            try {
+                const outcome = await Promise.race([
+                    match?.handler(req, res, {}).then(() => 'completed'),
+                    new Promise((resolve) => setTimeout(() => resolve('timeout'), 25))
+                ]);
+                expect(outcome).toBe('completed');
+                const payload = JSON.parse(res.end.mock.calls[0][0]);
+                expect(payload.authenticated).toBe(true);
+                expect(deleteObjectSpy).toHaveBeenCalledWith('users/u-avatar/profile/avatar/avatar-draft-stale.png');
+            }
+            finally {
+                if (deleteObjectCompletion.resolve) {
+                    deleteObjectCompletion.resolve(true);
+                }
+                deleteObjectSpy.mockRestore();
+            }
+        });
         it('POST /api/taskforce/auth/profile should save avatar by validated draft id', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -10300,6 +11143,43 @@ describe('Server Routes', () => {
                 }
             });
         });
+        it('POST /api/taskforce/admin/system-settings should preserve onboarding policy when onboarding fields are omitted', async () => {
+            core.getOnboardingPolicy.mockReturnValue({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
+            const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
+                allowSelfRegistration: false,
+                requireVerifiedEmail: true,
+                defaultNewUserBetaAccess: false,
+                authRateLimitEnabled: true,
+                authRateLimitMaxRequests: 10,
+                authRateLimitWindowMs: 900000
+            }, { 'x-taskforce-role': 'admin' });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.validateOnboardingPolicy).toHaveBeenCalledWith({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
+            });
+            expect(core.updateGlobalSettings).toHaveBeenCalledWith({
+                auth: {
+                    allowSelfRegistration: false,
+                    requireVerifiedEmail: true,
+                    defaultNewUserBetaAccess: false,
+                    authRateLimitEnabled: true,
+                    authRateLimitMaxRequests: 10,
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
+                }
+            });
+        });
         it('GET /api/taskforce/admin/site-settings should expose effective website settings', async () => {
             core.getGlobalSettings.mockReturnValue({
                 site: {
@@ -11571,7 +12451,7 @@ describe('Server Routes', () => {
                 errors: []
             }));
         });
-        it('PATCH /api/taskforce/task/:id should pass autosave updates through as non-audited route metadata', async () => {
+        it('PATCH /api/taskforce/task/:id should pass autosave metadata through to core.updateTask', async () => {
             const updatedTask = { id: '123', description: 'Draft body' };
             core.updateTask.mockReturnValue(updatedTask);
             const url = '/api/taskforce/task/123';
@@ -11581,12 +12461,12 @@ describe('Server Routes', () => {
             await match?.handler(req, res, { id: '123' });
             expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Draft body' }, 'default', {
                 actorRef: 'user',
-                skipTaskEvents: true
+                saveSource: 'autosave'
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));
         });
-        it('PATCH /api/taskforce/task/:id should keep manual updates on the audited path', async () => {
+        it('PATCH /api/taskforce/task/:id should pass manual save metadata through to core.updateTask', async () => {
             const updatedTask = { id: '123', description: 'Manual body' };
             core.updateTask.mockReturnValue(updatedTask);
             const url = '/api/taskforce/task/123';
@@ -11596,7 +12476,7 @@ describe('Server Routes', () => {
             await match?.handler(req, res, { id: '123' });
             expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Manual body' }, 'default', {
                 actorRef: 'user',
-                skipTaskEvents: false
+                saveSource: 'manual'
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));