diff --git a/.husky/commit-msg b/.husky/commit-msg
index 5ade170..2e6b87e 100644
--- a/.husky/commit-msg
+++ b/.husky/commit-msg
@@ -1 +1 @@
-node node_modules/.bin/commitlint --edit "$1"
+pnpm exec commitlint --edit "$1"
diff --git a/.husky/pre-commit b/.husky/pre-commit
index 3b17df7..bb3f578 100644
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,4 +1,4 @@
 STAGED=$(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' || true)
 if [ -n "$STAGED" ]; then
-  node node_modules/.bin/eslint --fix $STAGED 2>&1
+  pnpm exec eslint --fix $STAGED 2>&1
 fi
diff --git a/.husky/pre-push b/.husky/pre-push
index 32e961f..67aa132 100644
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -1 +1 @@
-node node_modules/.bin/eslint . 2>&1 && node node_modules/.bin/tsc --noEmit 2>&1 && node node_modules/.bin/vitest run 2>&1
+pnpm exec eslint . 2>&1 && pnpm exec tsc --noEmit 2>&1 && pnpm exec vitest run 2>&1
diff --git a/.npmrc b/.npmrc
index aafbf83..98d78df 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,4 +1,2 @@
-minimum-release-age=10080
-minimum-release-age-exclude[]=@mariozechner/*
-minimum-release-age-exclude[]=wire-mesh-core
-minimum-release-age-exclude[]=cddl.js
+save-exact=true
+minimum-release-age-exclude[]=@exadev/eslint-config
diff --git a/eslint.config.ts b/eslint.config.ts
index d6bf5bf..5b2f798 100644
--- a/eslint.config.ts
+++ b/eslint.config.ts
@@ -1,62 +1,14 @@
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { defineConfig } from "eslint/config";
-import type { Rule } from "eslint";
 import json from "@eslint/json";
 import markdown from "@eslint/markdown";
 import eslintConfigPrettier from "eslint-config-prettier/flat";
 import eslintPluginPrettier from "eslint-plugin-prettier";
-import tseslint from "typescript-eslint";
+import exadev from "@exadev/eslint-config";
 
 const tsconfigRootDir = dirname(fileURLToPath(import.meta.url));
 
-// ─── Custom rules ────────────────────────────────────────────────────────────
-
-const noPointlessReassignments: Rule.RuleModule = {
-  meta: {
-    type: "problem",
-    messages: {
-      pointlessReassignment:
-        "Pointless reassignment. {{ name }} is just an alias for {{ value }}. Use the original directly instead.",
-    },
-  },
-  create(context) {
-    return {
-      VariableDeclarator(node) {
-        if (node.id.type !== "Identifier" || node.init?.type !== "Identifier") {
-          return;
-        }
-        if (node.id.name.startsWith("_")) {
-          return;
-        }
-        // A `let`/`var` binding can be legitimately reassigned later (e.g. a loop-mutated value initialised from a starting constant, then updated each iteration) -- only `const` genuinely guarantees the binding is nothing but a permanent alias for its initializer, since a `const` can never be written to again. Without this check the rule fired on exactly that pattern (`let delayMs = INITIAL_RETRY_DELAY_MS` ahead of a loop that reassigns `delayMs` every iteration), which is not a pointless reassignment at all.
-        if (
-          node.parent.type === "VariableDeclaration" &&
-          node.parent.kind !== "const"
-        ) {
-          return;
-        }
-        context.report({
-          node,
-          messageId: "pointlessReassignment",
-          data: {
-            name: node.id.name,
-            value: node.init.name,
-          },
-        });
-      },
-    };
-  },
-};
-
-const customPlugin = {
-  rules: {
-    "no-pointless-reassignments": noPointlessReassignments,
-  },
-};
-
-// ─── Config ──────────────────────────────────────────────────────────────────
-
 export default defineConfig(
   {
     // .stryker-tmp holds Stryker's own instrumented sandbox copies of the source (each mutant gets a full copy, deliberately carrying a @ts-nocheck pragma Stryker injects itself) -- linting them produces thousands of irrelevant errors against generated, throwaway code, not anything committed. reports/ is Stryker's own output (HTML/JSON), same reasoning.
@@ -68,13 +20,14 @@ export default defineConfig(
       "reports/**",
     ],
   },
+  ...exadev,
+  // Several directories under src/ use index.ts as a real module (interfaces, functions, a default export), not a re-export barrel -- barrel-policy only restricts files that actually contain re-exports, so this override is scoped to permitting the pattern, not to exempting those files from anything they weren't already going to pass. src/core/index.ts is a genuine re-export barrel and the package's own entry point; every one of its re-exports comes from a direct sibling (confirmed directly), so 'siblings' -- not 'single', which only ever recognises the literal path src/index.ts -- is the mode that actually matches this repo's real layout. Scoped to TS/TSX: the exadev plugin namespace is only registered on the JS/TS-scoped config objects @exadev/eslint-config's own array contributes, so an unscoped override here would fail to resolve "exadev/barrel-policy" while linting a JSON or Markdown file.
+  {
+    files: ["**/*.{ts,tsx}"],
+    rules: { "exadev/barrel-policy": ["error", { mode: "siblings" }] },
+  },
   {
     files: ["**/*.{ts,tsx}"],
-    extends: [
-      ...tseslint.configs.recommendedTypeChecked,
-      ...tseslint.configs.strictTypeChecked,
-      ...tseslint.configs.stylisticTypeChecked,
-    ],
     languageOptions: {
       parserOptions: {
         projectService: {
@@ -98,18 +51,12 @@ export default defineConfig(
     },
     plugins: {
       prettier: eslintPluginPrettier,
-      custom: customPlugin,
     },
     rules: {
       "@typescript-eslint/no-unused-vars": [
         "error",
         { argsIgnorePattern: "^_" },
       ],
-      "@typescript-eslint/consistent-type-assertions": [
-        "error",
-        { assertionStyle: "never" },
-      ],
-      "custom/no-pointless-reassignments": "error",
       "no-restricted-syntax": [
         "error",
         {
@@ -125,10 +72,6 @@ export default defineConfig(
       ],
       "prettier/prettier": "error",
       "@typescript-eslint/require-await": "warn",
-      "max-lines": [
-        "error",
-        { max: 800, skipBlankLines: true, skipComments: true },
-      ],
     },
   },
   eslintConfigPrettier,
diff --git a/package.json b/package.json
index 2bbe338..e00976f 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
   "version": "2.21.6",
   "description": "Cross-harness communication mesh for LLM agents — rooms, DMs, presence, and real-time push delivery over TCP",
   "type": "module",
-  "packageManager": "pnpm@10.33.0",
+  "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ExaDev/agent-comms.git"
@@ -66,6 +66,7 @@
     "@commitlint/types": "21.2.0",
     "@eslint/json": "2.0.1",
     "@eslint/markdown": "8.0.3",
+    "@exadev/eslint-config": "2.12.3",
     "@mariozechner/pi-ai": "0.73.1",
     "@mariozechner/pi-coding-agent": "0.73.1",
     "@playwright/test": "1.61.1",
@@ -112,7 +113,7 @@
   },
   "pi": {
     "extensions": [
-      "./src/bridges/pi/index.ts"
+      "./src/bridges/pi/extension.ts"
     ]
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8e4dcf0..b438ae1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1,3 +1,161 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      pnpm:
+        specifier: 12.4.1
+        version: 12.4.1
+
+packages:
+
+  '@pnpm/exe.android-arm64@12.4.1':
+    resolution: {integrity: sha512-/HwsqXMSmlOfgtV9+O0ratzjV6Vd/8n1hh4rGHpCGmDURvt52MwZxdbhyxP4K03ZfvgSDvotFPr8O+RzE5Eu8A==}
+    cpu: [arm64]
+    os: [android]
+
+  '@pnpm/exe.android-x64@12.4.1':
+    resolution: {integrity: sha512-+l74Qb4c2YjOzNKHXJLg+1wr8xHM1ckkUhnU5KRUK9TJqiiczt6yeTZqqzHIlJ8i6pAoj5V0OJevDRwnQKLgrQ==}
+    cpu: [x64]
+    os: [android]
+
+  '@pnpm/exe.darwin-arm64@12.4.1':
+    resolution: {integrity: sha512-6rkZkT3iGfaxknUdGHraqSWFvTa6N0ajAHluv9Ax0GRWs0sIcGNiFhDopv6xSZCsJZmG483aNS/b6UEDy3blfw==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/exe.darwin-x64@12.4.1':
+    resolution: {integrity: sha512-Vb1CHlR88HghC1qUxjxjs82zQSXnXacPD+btG2CmG8Q/hBU7Q0/b2YWJKSQqZXicunV5khFtfTlAwJddV9RkYA==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/exe.freebsd-x64@12.4.1':
+    resolution: {integrity: sha512-iT3iHz3Nl0Sxxj7UPOtZ/aQ81AFsQhjoeWMAlPkSRO04gsgDGAXv3UYxOFaesMWsfNxaGn0A+CITbuCHFF66FA==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@pnpm/exe.linux-arm64-musl@12.4.1':
+    resolution: {integrity: sha512-aBooZfNXM5f+OGUgCAMFWpE/kAhsWfvmqIyMtHy6zl3aNxyInWrcY/Saln/UElzo7lZWMC0Yktroxd/2J26lNQ==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-arm64@12.4.1':
+    resolution: {integrity: sha512-TlOdacTTP09BgcMvwWBFRsu8VAjfwqwnslBj+XSq1JFM3ck4f3k+1O/747EuctxZxs3/o785b6Q3s7Pd92Ptsg==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-ppc64@12.4.1':
+    resolution: {integrity: sha512-r/ab/MlIBo75oizUP5ITiziCCrnXz4SJwfErLQ+603AshB+Yq7xTMCoMtzTSCAMu6aaymIKkAFtZvd2J75Wq0w==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-riscv64@12.4.1':
+    resolution: {integrity: sha512-C/D1QWdKMiB8+wv/spl1rGITFUuqC+aI/fb6h8NB5sqxsOaGXeYc/g891oCuzggHn6SODk9p+I09hI76x/cMNw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-s390x@12.4.1':
+    resolution: {integrity: sha512-nxz5zD4yXt94uzbStDk0QTPKW+aE92hH1b5tFXK9ctB1HE9Xcq1vjTiA2LsZMFC6p4gdu5OwQeFqYNAVGa6QlA==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-x64-musl@12.4.1':
+    resolution: {integrity: sha512-5AwgFdGhVUg2kIweYGfxzSLEHiIG77PQhZAkXC3TwofQHsu1Wr+TrV5/rNX2PopFnHRzuE581zoB8F6Wle32yg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-x64@12.4.1':
+    resolution: {integrity: sha512-FJOZuuuQMhp0oLzBtcKkLXknBI92hfkmSnlKc47vfin4HrmfID5khY2lGekL9tCzk1cpR+HShEw/meFl+nHtzQ==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.win32-arm64@12.4.1':
+    resolution: {integrity: sha512-OO7eKBL9S+xk5hRy+JUUZSNJknGuGe3GEUffsrlC2LbqKF02g+VX1anGIzSbJDvkkdnpJhSlxF5AUz2JzJu2Jw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/exe.win32-x64@12.4.1':
+    resolution: {integrity: sha512-x7gJHZgHo6hp354xCYA2NvoFzYJkHwovt2kVsUBK5EmXULLcP51JGMq09CX+5FRFJUZFKoXjLu3mZWmfP7o6PQ==}
+    cpu: [x64]
+    os: [win32]
+
+  pnpm@12.4.1:
+    resolution: {integrity: sha512-LoHjmdc/6DkNqyXgaqeIq3pZCCSNL1o3D4K0gRR6ano2e/gEj5pv22Rg8hpm8FQt7bi5TKLIcjWWdBkgsWVtTA==}
+    engines: {node: '>=18.*'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/exe.android-arm64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.android-x64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.darwin-arm64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.darwin-x64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.freebsd-x64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.linux-arm64-musl@12.4.1':
+    optional: true
+
+  '@pnpm/exe.linux-arm64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.linux-ppc64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.linux-riscv64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.linux-s390x@12.4.1':
+    optional: true
+
+  '@pnpm/exe.linux-x64-musl@12.4.1':
+    optional: true
+
+  '@pnpm/exe.linux-x64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.win32-arm64@12.4.1':
+    optional: true
+
+  '@pnpm/exe.win32-x64@12.4.1':
+    optional: true
+
+  pnpm@12.4.1:
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.4.1
+      '@pnpm/exe.android-x64': 12.4.1
+      '@pnpm/exe.darwin-arm64': 12.4.1
+      '@pnpm/exe.darwin-x64': 12.4.1
+      '@pnpm/exe.freebsd-x64': 12.4.1
+      '@pnpm/exe.linux-arm64': 12.4.1
+      '@pnpm/exe.linux-arm64-musl': 12.4.1
+      '@pnpm/exe.linux-ppc64': 12.4.1
+      '@pnpm/exe.linux-riscv64': 12.4.1
+      '@pnpm/exe.linux-s390x': 12.4.1
+      '@pnpm/exe.linux-x64': 12.4.1
+      '@pnpm/exe.linux-x64-musl': 12.4.1
+      '@pnpm/exe.win32-arm64': 12.4.1
+      '@pnpm/exe.win32-x64': 12.4.1
+
+---
 lockfileVersion: '9.0'
 
 settings:
@@ -5,16 +163,16 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  '@anthropic-ai/sdk': '>=0.91.1'
+  basic-ftp: '>=6.0.1'
+  brace-expansion: '>=5.0.6'
+  conventional-changelog-writer: ^9.2.0
   fast-uri: '>=3.1.2'
-  protobufjs: ^7.6.1
   fast-xml-parser: '>=5.8.0'
-  ip-address: '>=10.2.0'
   hono: ^4.12.18
-  brace-expansion: '>=5.0.6'
+  ip-address: '>=10.2.0'
+  protobufjs: ^7.6.1
   qs: '>=6.15.2'
-  basic-ftp: '>=6.0.1'
-  '@anthropic-ai/sdk': '>=0.91.1'
-  conventional-changelog-writer: ^9.2.0
 
 importers:
 
@@ -22,7 +180,7 @@ importers:
     dependencies:
       '@modelcontextprotocol/sdk':
         specifier: 1.30.0
-        version: 1.30.0(zod@4.4.3)
+        version: 1.30.0(supports-color@7.2.0)(zod@4.4.3)
       '@sinclair/typebox':
         specifier: '*'
         version: 0.34.49
@@ -59,34 +217,37 @@ importers:
         version: 2.0.1
       '@eslint/markdown':
         specifier: 8.0.3
-        version: 8.0.3
+        version: 8.0.3(supports-color@7.2.0)
+      '@exadev/eslint-config':
+        specifier: 2.12.3
+        version: 2.12.3(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript-eslint@8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(typescript@6.0.3)
       '@mariozechner/pi-ai':
         specifier: 0.73.1
-        version: 0.73.1(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))(ws@8.21.1)(zod@4.4.3)
+        version: 0.73.1(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)(ws@8.21.1)(zod@4.4.3)
       '@mariozechner/pi-coding-agent':
         specifier: 0.73.1
-        version: 0.73.1(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))(ws@8.21.1)(zod@4.4.3)
+        version: 0.73.1(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)(ws@8.21.1)(zod@4.4.3)
       '@playwright/test':
         specifier: 1.61.1
         version: 1.61.1
       '@semantic-release/changelog':
         specifier: 6.0.3
-        version: 6.0.3(semantic-release@25.0.7(typescript@6.0.3))
+        version: 6.0.3(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))
       '@semantic-release/commit-analyzer':
         specifier: 13.0.1
-        version: 13.0.1(semantic-release@25.0.7(typescript@6.0.3))
+        version: 13.0.1(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@semantic-release/exec':
         specifier: 7.1.0
-        version: 7.1.0(semantic-release@25.0.7(typescript@6.0.3))
+        version: 7.1.0(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@semantic-release/git':
         specifier: 10.0.1
-        version: 10.0.1(semantic-release@25.0.7(typescript@6.0.3))
+        version: 10.0.1(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@semantic-release/github':
         specifier: 12.0.9
-        version: 12.0.9(semantic-release@25.0.7(typescript@6.0.3))
+        version: 12.0.9(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@semantic-release/release-notes-generator':
         specifier: 14.1.1
-        version: 14.1.1(semantic-release@25.0.7(typescript@6.0.3))
+        version: 14.1.1(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@stryker-mutator/api':
         specifier: 10.0.0
         version: 10.0.0
@@ -113,13 +274,13 @@ importers:
         version: 0.28.1
       eslint:
         specifier: 10.7.0
-        version: 10.7.0(jiti@2.7.0)
+        version: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       eslint-config-prettier:
         specifier: 10.1.8
-        version: 10.1.8(eslint@10.7.0(jiti@2.7.0))
+        version: 10.1.8(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))
       eslint-plugin-prettier:
         specifier: 5.5.6
-        version: 5.5.6(eslint-config-prettier@10.1.8(eslint@10.7.0(jiti@2.7.0)))(eslint@10.7.0(jiti@2.7.0))(prettier@3.9.5)
+        version: 5.5.6(eslint-config-prettier@10.1.8(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(prettier@3.9.5)
       happy-dom:
         specifier: 20.10.6
         version: 20.10.6
@@ -134,7 +295,7 @@ importers:
         version: 3.9.5
       semantic-release:
         specifier: 25.0.7
-        version: 25.0.7(typescript@6.0.3)
+        version: 25.0.7(supports-color@7.2.0)(typescript@6.0.3)
       tsx:
         specifier: ^4.23.1
         version: 4.23.1
@@ -143,7 +304,7 @@ importers:
         version: 6.0.3
       typescript-eslint:
         specifier: 8.69.0
-        version: 8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
+        version: 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
       vitest:
         specifier: 5.0.0
         version: 5.0.0(@types/node@26.1.1)(happy-dom@20.10.6)(vite@8.2.2(@types/node@26.1.1)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.1)(yaml@2.9.0))
@@ -540,6 +701,14 @@ packages:
     resolution: {integrity: sha512-LfUFi+Vv4eDzj+XAtR89e3wwjXA/NZjUSwU5NhwbBrLecxPaBYFy3exCuc1j+D4UZeOVdqlsl8G7LmOt18V0tg==}
     engines: {node: '>=20'}
 
+  '@es-joy/jsdoccomment@0.97.0':
+    resolution: {integrity: sha512-EP8uoFfh6+GsdGCduYtmWAW0h7AO+Ayik9Vh5YbA2r/3N6lmJKkCNZX+q3QBXC1K6ixjQ/9igF2b7WVvLm063g==}
+    engines: {node: ^22.22.2 || >=24.15.0}
+
+  '@es-joy/resolve.exports@1.2.0':
+    resolution: {integrity: sha512-Q9hjxWI5xBM+qW2enxfe8wDKdFWMfd0Z29k5ZJnuBqD/CasY5Zryj09aCA6owbGATWz+39p5uIdaHXpopOcG8g==}
+    engines: {node: '>=10'}
+
   '@esbuild/aix-ppc64@0.28.1':
     resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
     engines: {node: '>=18'}
@@ -724,6 +893,15 @@ packages:
     resolution: {integrity: sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
+  '@eslint/js@10.0.1':
+    resolution: {integrity: sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+    peerDependencies:
+      eslint: ^10.0.0
+    peerDependenciesMeta:
+      eslint:
+        optional: true
+
   '@eslint/json@2.0.1':
     resolution: {integrity: sha512-Thz2j92ceUF3Bq/0TuWb3MWn3Z+Cwc8k5ptF0fakl2D4Mp8mSx07Xr1aQM4R5NoihzarWUdxfOmQ8DesGy4jOg==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
@@ -740,6 +918,27 @@ packages:
     resolution: {integrity: sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
+  '@exadev/eslint-config@2.12.3':
+    resolution: {integrity: sha512-gs6yKJhngCnC8AJtthvr8Tq0pNzmNzIKnFEJLaoh24sw8PK0WntpLUB+0Fxv53Soos4Ju0pSBNCufmYljGwaVg==}
+    engines: {node: '>=20'}
+    peerDependencies:
+      '@next/eslint-plugin-next': ^16.3.2
+      eslint: '>=10.0.0'
+      eslint-plugin-jsx-a11y: ^6.10.2
+      eslint-plugin-react: ^7.37.5
+      eslint-plugin-react-hooks: ^7.1.1
+      typescript: '>=4.8.4'
+      typescript-eslint: '>=8.0.0'
+    peerDependenciesMeta:
+      '@next/eslint-plugin-next':
+        optional: true
+      eslint-plugin-jsx-a11y:
+        optional: true
+      eslint-plugin-react:
+        optional: true
+      eslint-plugin-react-hooks:
+        optional: true
+
   '@google/genai@1.52.0':
     resolution: {integrity: sha512-gwSvbpiN/17O9TbsqSsE/OzZcpv5Fo4RQjdngGgogtuB9RsyJ8ZHhX5KjHj1bp5N9snN2eK8LDGXSaWW2hof8Q==}
     engines: {node: '>=20.0.0'}
@@ -1016,6 +1215,12 @@ packages:
     engines: {node: '>=20.0.0'}
     deprecated: please use @earendil-works/pi-tui instead going forward
 
+  '@microsoft/tsdoc-config@0.18.1':
+    resolution: {integrity: sha512-9brPoVdfN9k9g0dcWkFeA7IH9bbcttzDJlXvkf8b2OBzd5MueR1V2wkKBL0abn0otvmkHJC6aapBOTJDDeMCZg==}
+
+  '@microsoft/tsdoc@0.16.0':
+    resolution: {integrity: sha512-xgAyonlVVS+q7Vc7qLW0UrJU7rSFcETRWsqdXZtjzRU8dF+6CkozTK4V4y1LwOX7j8r/vHphjDeMeGI4tNGeGA==}
+
   '@mistralai/mistralai@2.4.1':
     resolution: {integrity: sha512-vNpR2GR76aW7fK8Dcu1NRx3fdSPO1QruRDo4GbfXfkro2mvp194xIAvJ2BP4ZykzyWtJoDmBe+Qsk9D443aqlg==}
     peerDependencies:
@@ -1307,6 +1512,10 @@ packages:
   '@sinclair/typebox@0.34.49':
     resolution: {integrity: sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==}
 
+  '@sindresorhus/base62@1.0.0':
+    resolution: {integrity: sha512-TeheYy0ILzBEI/CO55CP6zJCSdSWeRtGnHy8U8dWSUH4I68iqTsy7HkMktR4xakThc9jotkPQUXT4ITdbV7cHA==}
+    engines: {node: '>=18'}
+
   '@sindresorhus/is@4.6.0':
     resolution: {integrity: sha512-t09vSN3MdfsyCHoFcTRCH/iUtG7OJ0CsjzB8cjAmKc/va/kIgeDI/TxsigdncE/4be734m0cvIYwNaV4i2XqAw==}
     engines: {node: '>=10'}
@@ -1420,6 +1629,9 @@ packages:
   '@types/node@26.1.1':
     resolution: {integrity: sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==}
 
+  '@types/node@26.5.1':
+    resolution: {integrity: sha512-CzNm2FezW4VR/LjG6yUdiEgLE/rAQ9Slj5gCu/C2VrdcW7I0ahNZ8DRbHT7zOZ6r3ONgd/bsQIeSaoDGrd1C6g==}
+
   '@types/normalize-package-data@2.4.4':
     resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==}
 
@@ -1453,16 +1665,48 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/project-service@8.56.1':
+    resolution: {integrity: sha512-TAdqQTzHNNvlVFfR+hu2PDJrURiwKsUvxFn1M0h95BB8ah5jejas08jUWG4dBA68jDMI988IvtfdAI53JzEHOQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/project-service@8.67.0':
+    resolution: {integrity: sha512-cvE8c7ulYeXN9fYuszhCeCsbzyVEXuhrRCybnBre7TUmqb5nRmBfQAwCj0O3WJFDeyAZt4VYv51vMCC9LHSdYw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/project-service@8.69.0':
     resolution: {integrity: sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/scope-manager@8.56.1':
+    resolution: {integrity: sha512-YAi4VDKcIZp0O4tz/haYKhmIDZFEUPOreKbfdAN3SzUDMcPhJ8QI99xQXqX+HoUVq8cs85eRKnD+rne2UAnj2w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/scope-manager@8.67.0':
+    resolution: {integrity: sha512-EgvsleTwS4E+WzzSvem8fAUubLwatMNF1B5hHSLQxcvs7q2dtRhGyujHwLJSYlG41niJ7GP24Aha2+0mb1b2kg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@typescript-eslint/scope-manager@8.69.0':
     resolution: {integrity: sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@typescript-eslint/tsconfig-utils@8.56.1':
+    resolution: {integrity: sha512-qOtCYzKEeyr3aR9f28mPJqBty7+DBqsdd63eO0yyDwc6vgThj2UjWfJIcsFeSucYydqcuudMOprZ+x1SpF3ZuQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/tsconfig-utils@8.67.0':
+    resolution: {integrity: sha512-vV+LUSv5njUWsknE71fqKTlXUva+R76SaeORd6Zojcunk/6DvKFXONU3BrAs2H49mbygUXt6gbYunzwqNwlhdg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/tsconfig-utils@8.69.0':
     resolution: {integrity: sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1476,16 +1720,50 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/types@8.56.1':
+    resolution: {integrity: sha512-dbMkdIUkIkchgGDIv7KLUpa0Mda4IYjo4IAMJUZ+3xNoUXxMsk9YtKpTHSChRS85o+H9ftm51gsK1dZReY9CVw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/types@8.67.0':
+    resolution: {integrity: sha512-sBtgslww8nsMYUjhdPBiSyUqSzT8uR6g93A2QXnQC8+cGdjz0CyaOdqHDRJb1AtORbZCNUJBBeFA/tNR2uQmww==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@typescript-eslint/types@8.69.0':
     resolution: {integrity: sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@typescript-eslint/typescript-estree@8.56.1':
+    resolution: {integrity: sha512-qzUL1qgalIvKWAf9C1HpvBjif+Vm6rcT5wZd4VoMb9+Km3iS3Cv9DY6dMRMDtPnwRAFyAi7YXJpTIEXLvdfPxg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/typescript-estree@8.67.0':
+    resolution: {integrity: sha512-EKQBCE9yNlRJYm7jdTW5AhDacDUmSwQb0FAJAmK2EKYrNXIsa2vxcSZx6PvJ/dEdI6lS+Y9W+EXckLj0iPFGcw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/typescript-estree@8.69.0':
     resolution: {integrity: sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/utils@8.56.1':
+    resolution: {integrity: sha512-HPAVNIME3tABJ61siYlHzSWCGtOoeP2RTIaHXFMPqjrQKCGB9OgUVdiNgH7TJS2JNIQ5qQ4RsAUDuGaGme/KOA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.0.0'
+
+  '@typescript-eslint/utils@8.67.0':
+    resolution: {integrity: sha512-U9D1FdwEWBwok3hxxSdhclMb0twvt9QnjIQ0VfQ1AiX2epnpSgv2ubVDsayOFyY8K6FX+AQ7E0FKWVG3iKsj1A==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/utils@8.69.0':
     resolution: {integrity: sha512-tUbx60BBqQa31kXF5MCsOOLL5E/WzUuxIn7YpAvq+eaUlqvk8/NXnXMBNAdLCr0icjkzem7iUA5QqWHe/hJ1aw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1493,6 +1771,14 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/visitor-keys@8.56.1':
+    resolution: {integrity: sha512-KiROIzYdEV85YygXw6BI/Dx4fnBlFQu6Mq4QE4MOH9fFnhohw6wX/OAvDY2/C+ut0I3RSPKenvZJIVYqJNkhEw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/visitor-keys@8.67.0':
+    resolution: {integrity: sha512-fkv8dHRDqfGtTHuJeebdrQ7cX6Ad4WAS00rgHh9UGvMycF1mjBfsxry1XsLIFhWZ6Judlh6UdzK+TYlbpCXgnA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@typescript-eslint/visitor-keys@8.69.0':
     resolution: {integrity: sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1552,6 +1838,9 @@ packages:
   ajv@6.15.0:
     resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
 
+  ajv@8.18.0:
+    resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==}
+
   ajv@8.20.0:
     resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
 
@@ -1586,6 +1875,10 @@ packages:
   any-promise@1.3.0:
     resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
 
+  are-docs-informative@0.1.1:
+    resolution: {integrity: sha512-sqRsNQBwbKLRX0jV5Cu5uzmtflf892n4Vukz7T659ebL4pz3mpOqCMU7lxMoBTFwnp10E3YB5ZcyHM41W5bcDA==}
+    engines: {node: '>=18'}
+
   argparse@2.0.1:
     resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
 
@@ -1785,6 +2078,10 @@ packages:
     resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==}
     engines: {node: '>= 12'}
 
+  comment-parser@1.4.8:
+    resolution: {integrity: sha512-rKZTGo4fzKYna8UcL0isTg5wkBNla7bxTypLwZQXjIdi++IdP1OJ41rI5Mti3/jltkPujbu4i9LIARYA+zpotQ==}
+    engines: {node: '>= 12.0.0'}
+
   compare-func@2.0.0:
     resolution: {integrity: sha512-zHig5N+tPWARooBnb0Zx1MFcdfpyJrfTJ3Y5L+IFvUm8rM74hHz66z0gw0x4tijh5CorKkKUCnW82R2vmpeCRA==}
 
@@ -2057,6 +2354,12 @@ packages:
     peerDependencies:
       eslint: '>=7.0.0'
 
+  eslint-plugin-jsdoc@64.3.6:
+    resolution: {integrity: sha512-lo7IXmgUUNy88SxW7KnJmmD2iPQBIRMomfCFPHidW1M3zNNVuzxlB2uoNrNyE1g4v2/L+RtYmiROPwQhSNzL8Q==}
+    engines: {node: ^22.22.2 || >=24.15.0}
+    peerDependencies:
+      eslint: ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0
+
   eslint-plugin-prettier@5.5.6:
     resolution: {integrity: sha512-ifetmTcxWfz+4qRW3pH/ujdTq2jQIj59AxJMIN26K5avYgU8dxycUETQonWiW+wPrYXA0j3Try0l1CnwVQtDqQ==}
     engines: {node: ^14.18.0 || >=16.0.0}
@@ -2071,6 +2374,9 @@ packages:
       eslint-config-prettier:
         optional: true
 
+  eslint-plugin-tsdoc@0.5.2:
+    resolution: {integrity: sha512-BlvqjWZdBJDIPO/YU3zcPCF23CvjYT3gyu63yo6b609NNV3D1b6zceAREy2xnweuBoDpZcLNuPyAUq9cvx6bbQ==}
+
   eslint-scope@9.1.2:
     resolution: {integrity: sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
@@ -2423,6 +2729,9 @@ packages:
     resolution: {integrity: sha512-Hc+ghLoSt6QaYZUv0WBiIvmMDZuZZ7oaDvdH8MbfOO4lOsxdXLEvuC6ePoGs9H1X9oCLyq6+NVN0MKqD+ydxyg==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
+  html-entities@2.6.0:
+    resolution: {integrity: sha512-kig+rMn/QOVRvr7c86gQ8lWXq+Hkv6CbAH1hLu+RG338StTpE8Z0b44SDVaqVu7HGKf27frdmUYEs9hTUX/cLQ==}
+
   http-errors@2.0.1:
     resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
     engines: {node: '>= 0.8'}
@@ -2527,6 +2836,10 @@ packages:
   is-arrayish@0.2.1:
     resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
 
+  is-core-module@2.16.2:
+    resolution: {integrity: sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==}
+    engines: {node: '>= 0.4'}
+
   is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
@@ -2596,6 +2909,9 @@ packages:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
+  jju@1.4.0:
+    resolution: {integrity: sha512-8wb9Yw966OSxApiCt0K3yNJL8pnNeIv+OEq2YMidz4FKP6nonSRoOXc80iXY4JaN2FC11B9qsNmDsm+ZOfMROA==}
+
   jose@6.2.10:
     resolution: {integrity: sha512-iiW7J9qRFlGxvCOIBDBDxFePQSn7ZMAnrYGhrrOo6siO/MIqwfyilLR27pkfDgUk+raLuzADS8A3S/KLBisc0g==}
 
@@ -2612,6 +2928,10 @@ packages:
     resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
     hasBin: true
 
+  jsdoc-type-pratt-parser@9.2.1:
+    resolution: {integrity: sha512-V4Ww4EHnTcTLSOMoB0FsF72JhQvcAsriCm/LWnxJeGWoxIjEL2l9na11abQok5SYShq8m0Gl02el/xAbTCulvQ==}
+    engines: {node: ^22.22.2 || >=24.15.0}
+
   jsesc@3.1.0:
     resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
     engines: {node: '>=6'}
@@ -3196,6 +3516,9 @@ packages:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
     engines: {node: '>=0.10.0'}
 
+  object-deep-merge@2.0.1:
+    resolution: {integrity: sha512-aKttDKcU3pyZqKcCkDhsMn70WmZFG2JGDQLP9EcLyTSIFQRCPWLAmBZRLJnrVUrhPG1jETEEbfdgbNtJf1LyMg==}
+
   object-inspect@1.13.4:
     resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
     engines: {node: '>= 0.4'}
@@ -3303,6 +3626,9 @@ packages:
     resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
     engines: {node: '>=6'}
 
+  parse-imports-exports@0.2.4:
+    resolution: {integrity: sha512-4s6vd6dx1AotCx/RCI2m7t7GCh5bDRUtGNvRfHSP2wbBQdMi67pPe7mtzmgwcaQ8VKK/6IB7Glfyu3qdZJPybQ==}
+
   parse-json@4.0.0:
     resolution: {integrity: sha512-aOIos8bujGN93/8Ox/jPLh7RwVnPEysynVFE+fQZyg6jKELEHwzgKdLRFHUgXJL6kylijVSBC4BvN9OmsB48Rw==}
     engines: {node: '>=4'}
@@ -3319,6 +3645,9 @@ packages:
     resolution: {integrity: sha512-TXfryirbmq34y8QBwgqCVLi+8oA3oWx2eAnSn62ITyEhEYaWRlVZ2DvMM9eZbMs/RfxPu/PK/aBLyGj4IrqMHw==}
     engines: {node: '>=18'}
 
+  parse-statements@1.0.11:
+    resolution: {integrity: sha512-HlsyYdMBnbPQ9Jr/VgJ1YF4scnldvJpJxCVx6KgqPL4dxppsWrJHCIIxQXMJrqGnsRkNPATbeMJ8Yxu7JMsYcA==}
+
   parse5-htmlparser2-tree-adapter@6.0.1:
     resolution: {integrity: sha512-qPuWvbLgvDGilKc5BoicRovlT4MtYT6JfJyBOMDsKoiT+GiuP5qyrPCnR9HcPECIJJmZh5jRndyNThnhhb/vlA==}
 
@@ -3351,6 +3680,9 @@ packages:
     resolution: {integrity: sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==}
     engines: {node: '>=12'}
 
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
   path-scurry@2.0.2:
     resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
     engines: {node: 18 || 20 || >=22}
@@ -3522,6 +3854,10 @@ packages:
     resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
     engines: {node: '>=0.10.0'}
 
+  reserved-identifiers@1.2.0:
+    resolution: {integrity: sha512-yE7KUfFvaBFzGPs5H3Ops1RevfUEsDc5Iz65rOwWg4lE8HJSYtle77uul3+573457oHvBKuHYDl/xqUkKpEEdw==}
+    engines: {node: '>=18'}
+
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
@@ -3530,6 +3866,11 @@ packages:
     resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
     engines: {node: '>=8'}
 
+  resolve@1.22.12:
+    resolution: {integrity: sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
   restore-cursor@5.1.0:
     resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
     engines: {node: '>=18'}
@@ -3677,6 +4018,9 @@ packages:
   spdx-expression-parse@3.0.1:
     resolution: {integrity: sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==}
 
+  spdx-expression-parse@5.0.0:
+    resolution: {integrity: sha512-vngmw3Rgn+o2arXNbnZaj5UtOEBuWBfvaI+Wc8GFfykIhA5/vdK9/Sp/XkLv63dykz2rxKDvKEHupF5P0FORcQ==}
+
   spdx-license-ids@3.0.23:
     resolution: {integrity: sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==}
 
@@ -3766,6 +4110,10 @@ packages:
     resolution: {integrity: sha512-zFObLMyZeEwzAoKCyu1B91U79K2t7ApXuQfo8OuxwXLDgcKxuwM+YvcbIhm6QWqz7mHUH1TVytR1PwVVjEuMig==}
     engines: {node: '>=14.18'}
 
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
   synckit@0.11.13:
     resolution: {integrity: sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==}
     engines: {node: ^14.18.0 || >=16.0.0}
@@ -3816,6 +4164,10 @@ packages:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
     engines: {node: '>=8.0'}
 
+  to-valid-identifier@1.0.0:
+    resolution: {integrity: sha512-41wJyvKep3yT2tyPqX/4blcfybknGB4D+oETKLs7Q76UiPqRpUJK3hr1nxelyYO0PHKVzJwlu0aCeEAsGI6rpw==}
+    engines: {node: '>=20'}
+
   toidentifier@1.0.1:
     resolution: {integrity: sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
     engines: {node: '>=0.6'}
@@ -3910,6 +4262,9 @@ packages:
   undici-types@8.3.0:
     resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
 
+  undici-types@8.9.0:
+    resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==}
+
   undici@6.27.0:
     resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==}
     engines: {node: '>=18.17'}
@@ -4746,6 +5101,16 @@ snapshots:
 
   '@cto.af/wtf8@0.0.5': {}
 
+  '@es-joy/jsdoccomment@0.97.0':
+    dependencies:
+      '@types/estree': 1.0.9
+      '@typescript-eslint/types': 8.69.0
+      comment-parser: 1.4.8
+      esquery: 1.7.0
+      jsdoc-type-pratt-parser: 9.2.1
+
+  '@es-joy/resolve.exports@1.2.0': {}
+
   '@esbuild/aix-ppc64@0.28.1':
     optional: true
 
@@ -4824,22 +5189,22 @@ snapshots:
   '@esbuild/win32-x64@0.28.1':
     optional: true
 
-  '@eslint-community/eslint-utils@4.10.1(eslint@10.7.0(jiti@2.7.0))':
+  '@eslint-community/eslint-utils@4.10.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))':
     dependencies:
-      eslint: 10.7.0(jiti@2.7.0)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       eslint-visitor-keys: 3.4.3
 
-  '@eslint-community/eslint-utils@4.9.1(eslint@10.7.0(jiti@2.7.0))':
+  '@eslint-community/eslint-utils@4.9.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))':
     dependencies:
-      eslint: 10.7.0(jiti@2.7.0)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/regexpp@4.12.2': {}
 
-  '@eslint/config-array@0.23.5':
+  '@eslint/config-array@0.23.5(supports-color@7.2.0)':
     dependencies:
       '@eslint/object-schema': 3.0.5
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       minimatch: 10.2.5
     transitivePeerDependencies:
       - supports-color
@@ -4852,6 +5217,10 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
+  '@eslint/js@10.0.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))':
+    optionalDependencies:
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
+
   '@eslint/json@2.0.1':
     dependencies:
       '@eslint/core': 1.2.1
@@ -4859,15 +5228,15 @@ snapshots:
       '@humanwhocodes/momoa': 3.3.10
       natural-compare: 1.4.0
 
-  '@eslint/markdown@8.0.3':
+  '@eslint/markdown@8.0.3(supports-color@7.2.0)':
     dependencies:
       '@eslint/core': 1.2.1
       '@eslint/plugin-kit': 0.7.2
       github-slugger: 2.0.0
-      mdast-util-from-markdown: 2.0.3
-      mdast-util-frontmatter: 2.0.1
-      mdast-util-gfm: 3.1.0
-      mdast-util-math: 3.0.0
+      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
+      mdast-util-frontmatter: 2.0.1(supports-color@7.2.0)
+      mdast-util-gfm: 3.1.0(supports-color@7.2.0)
+      mdast-util-math: 3.0.0(supports-color@7.2.0)
       micromark-extension-frontmatter: 2.0.0
       micromark-extension-gfm: 3.0.0
       micromark-extension-math: 3.1.0
@@ -4882,14 +5251,27 @@ snapshots:
       '@eslint/core': 1.2.1
       levn: 0.4.1
 
-  '@google/genai@1.52.0(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))':
+  '@exadev/eslint-config@2.12.3(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript-eslint@8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(typescript@6.0.3)':
     dependencies:
-      google-auth-library: 10.9.0
+      '@eslint/js': 10.0.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))
+      '@typescript-eslint/utils': 8.67.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
+      eslint-plugin-jsdoc: 64.3.6(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      eslint-plugin-tsdoc: 0.5.2(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+      typescript-eslint: 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@google/genai@1.52.0(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)':
+    dependencies:
+      google-auth-library: 10.9.0(supports-color@7.2.0)
       p-retry: 4.6.2
       protobufjs: 7.6.5
       ws: 8.21.1
     optionalDependencies:
-      '@modelcontextprotocol/sdk': 1.30.0(zod@4.4.3)
+      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.4.3)
     transitivePeerDependencies:
       - bufferutil
       - supports-color
@@ -5094,9 +5476,9 @@ snapshots:
       '@mariozechner/clipboard-win32-x64-msvc': 0.3.9
     optional: true
 
-  '@mariozechner/pi-agent-core@0.73.1(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))(ws@8.21.1)(zod@4.4.3)':
+  '@mariozechner/pi-agent-core@0.73.1(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)(ws@8.21.1)(zod@4.4.3)':
     dependencies:
-      '@mariozechner/pi-ai': 0.73.1(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))(ws@8.21.1)(zod@4.4.3)
+      '@mariozechner/pi-ai': 0.73.1(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)(ws@8.21.1)(zod@4.4.3)
       typebox: 1.3.6
     transitivePeerDependencies:
       - '@modelcontextprotocol/sdk'
@@ -5107,16 +5489,16 @@ snapshots:
       - ws
       - zod
 
-  '@mariozechner/pi-ai@0.73.1(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))(ws@8.21.1)(zod@4.4.3)':
+  '@mariozechner/pi-ai@0.73.1(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)(ws@8.21.1)(zod@4.4.3)':
     dependencies:
       '@anthropic-ai/sdk': 0.111.0(zod@4.4.3)
       '@aws-sdk/client-bedrock-runtime': 3.1088.0
-      '@google/genai': 1.52.0(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))
+      '@google/genai': 1.52.0(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)
       '@mistralai/mistralai': 2.4.1
       chalk: 5.6.2
       openai: 6.26.0(ws@8.21.1)(zod@4.4.3)
       partial-json: 0.1.7
-      proxy-agent: 6.5.0
+      proxy-agent: 6.5.0(supports-color@7.2.0)
       typebox: 1.3.6
       undici: 7.28.0
       zod-to-json-schema: 3.25.2(zod@4.4.3)
@@ -5129,17 +5511,17 @@ snapshots:
       - ws
       - zod
 
-  '@mariozechner/pi-coding-agent@0.73.1(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))(ws@8.21.1)(zod@4.4.3)':
+  '@mariozechner/pi-coding-agent@0.73.1(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)(ws@8.21.1)(zod@4.4.3)':
     dependencies:
-      '@mariozechner/pi-agent-core': 0.73.1(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))(ws@8.21.1)(zod@4.4.3)
-      '@mariozechner/pi-ai': 0.73.1(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3))(ws@8.21.1)(zod@4.4.3)
+      '@mariozechner/pi-agent-core': 0.73.1(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)(ws@8.21.1)(zod@4.4.3)
+      '@mariozechner/pi-ai': 0.73.1(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@7.2.0)(ws@8.21.1)(zod@4.4.3)
       '@mariozechner/pi-tui': 0.73.1
       '@silvia-odwyer/photon-node': 0.3.4
       chalk: 5.6.2
       cli-highlight: 2.1.11
       diff: 8.0.4
-      extract-zip: 2.0.1
-      file-type: 21.3.4
+      extract-zip: 2.0.1(supports-color@7.2.0)
+      file-type: 21.3.4(supports-color@7.2.0)
       glob: 13.0.6
       hosted-git-info: 9.0.3
       ignore: 7.0.6
@@ -5173,6 +5555,15 @@ snapshots:
     optionalDependencies:
       koffi: 2.16.2
 
+  '@microsoft/tsdoc-config@0.18.1':
+    dependencies:
+      '@microsoft/tsdoc': 0.16.0
+      ajv: 8.18.0
+      jju: 1.4.0
+      resolve: 1.22.12
+
+  '@microsoft/tsdoc@0.16.0': {}
+
   '@mistralai/mistralai@2.4.1':
     dependencies:
       '@opentelemetry/semantic-conventions': 1.43.0
@@ -5183,7 +5574,7 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  '@modelcontextprotocol/sdk@1.30.0(zod@4.4.3)':
+  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.4.3)':
     dependencies:
       '@hono/node-server': 2.1.1(hono@4.13.5)
       ajv: 8.20.0
@@ -5193,8 +5584,8 @@ snapshots:
       cross-spawn: 7.0.6
       eventsource: 3.0.7
       eventsource-parser: 3.1.1
-      express: 5.2.1
-      express-rate-limit: 8.7.0(express@5.2.1)
+      express: 5.2.1(supports-color@7.2.0)
+      express-rate-limit: 8.7.0(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0)
       hono: 4.13.5
       jose: 6.2.10
       json-schema-typed: 8.0.2
@@ -5356,25 +5747,25 @@ snapshots:
 
   '@sec-ant/readable-stream@0.4.1': {}
 
-  '@semantic-release/changelog@6.0.3(semantic-release@25.0.7(typescript@6.0.3))':
+  '@semantic-release/changelog@6.0.3(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))':
     dependencies:
       '@semantic-release/error': 3.0.0
       aggregate-error: 3.1.0
       fs-extra: 11.3.6
       lodash: 4.18.1
-      semantic-release: 25.0.7(typescript@6.0.3)
+      semantic-release: 25.0.7(supports-color@7.2.0)(typescript@6.0.3)
 
-  '@semantic-release/commit-analyzer@13.0.1(semantic-release@25.0.7(typescript@6.0.3))':
+  '@semantic-release/commit-analyzer@13.0.1(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)':
     dependencies:
       conventional-changelog-angular: 8.3.1
       conventional-changelog-writer: 9.2.0
       conventional-commits-filter: 5.0.0
       conventional-commits-parser: 6.4.0
-      debug: 4.4.3
-      import-from-esm: 2.0.0
+      debug: 4.4.3(supports-color@7.2.0)
+      import-from-esm: 2.0.0(supports-color@7.2.0)
       lodash-es: 4.18.1
       micromatch: 4.0.8
-      semantic-release: 25.0.7(typescript@6.0.3)
+      semantic-release: 25.0.7(supports-color@7.2.0)(typescript@6.0.3)
     transitivePeerDependencies:
       - supports-color
 
@@ -5382,33 +5773,33 @@ snapshots:
 
   '@semantic-release/error@4.0.0': {}
 
-  '@semantic-release/exec@7.1.0(semantic-release@25.0.7(typescript@6.0.3))':
+  '@semantic-release/exec@7.1.0(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)':
     dependencies:
       '@semantic-release/error': 4.0.0
       aggregate-error: 3.1.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       execa: 9.6.1
       lodash-es: 4.18.1
       parse-json: 8.3.0
-      semantic-release: 25.0.7(typescript@6.0.3)
+      semantic-release: 25.0.7(supports-color@7.2.0)(typescript@6.0.3)
     transitivePeerDependencies:
       - supports-color
 
-  '@semantic-release/git@10.0.1(semantic-release@25.0.7(typescript@6.0.3))':
+  '@semantic-release/git@10.0.1(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)':
     dependencies:
       '@semantic-release/error': 3.0.0
       aggregate-error: 3.1.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       dir-glob: 3.0.1
       execa: 5.1.1
       lodash: 4.18.1
       micromatch: 4.0.8
       p-reduce: 2.1.0
-      semantic-release: 25.0.7(typescript@6.0.3)
+      semantic-release: 25.0.7(supports-color@7.2.0)(typescript@6.0.3)
     transitivePeerDependencies:
       - supports-color
 
-  '@semantic-release/github@12.0.9(semantic-release@25.0.7(typescript@6.0.3))':
+  '@semantic-release/github@12.0.9(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)':
     dependencies:
       '@octokit/core': 7.0.6
       '@octokit/plugin-paginate-rest': 14.0.0(@octokit/core@7.0.6)
@@ -5416,15 +5807,15 @@ snapshots:
       '@octokit/plugin-throttling': 11.0.3(@octokit/core@7.0.6)
       '@semantic-release/error': 4.0.0
       aggregate-error: 5.0.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       dir-glob: 3.0.1
-      http-proxy-agent: 9.1.0
-      https-proxy-agent: 9.1.0
+      http-proxy-agent: 9.1.0(supports-color@7.2.0)
+      https-proxy-agent: 9.1.0(supports-color@7.2.0)
       issue-parser: 7.0.2
       lodash-es: 4.18.1
       mime: 4.1.0
       p-filter: 4.1.0
-      semantic-release: 25.0.7(typescript@6.0.3)
+      semantic-release: 25.0.7(supports-color@7.2.0)(typescript@6.0.3)
       tinyglobby: 0.2.17
       undici: 7.28.0
       url-join: 5.0.0
@@ -5432,7 +5823,7 @@ snapshots:
       - kerberos
       - supports-color
 
-  '@semantic-release/npm@13.1.5(semantic-release@25.0.7(typescript@6.0.3))':
+  '@semantic-release/npm@13.1.5(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))':
     dependencies:
       '@actions/core': 3.0.1
       '@semantic-release/error': 4.0.0
@@ -5447,21 +5838,21 @@ snapshots:
       rc: 1.2.8
       read-pkg: 10.1.0
       registry-auth-token: 5.1.1
-      semantic-release: 25.0.7(typescript@6.0.3)
+      semantic-release: 25.0.7(supports-color@7.2.0)(typescript@6.0.3)
       semver: 7.8.5
       tempy: 3.2.0
 
-  '@semantic-release/release-notes-generator@14.1.1(semantic-release@25.0.7(typescript@6.0.3))':
+  '@semantic-release/release-notes-generator@14.1.1(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)':
     dependencies:
       conventional-changelog-angular: 8.3.1
       conventional-changelog-writer: 9.2.0
       conventional-commits-filter: 5.0.0
       conventional-commits-parser: 6.4.0
-      debug: 4.4.3
-      import-from-esm: 2.0.0
+      debug: 4.4.3(supports-color@7.2.0)
+      import-from-esm: 2.0.0(supports-color@7.2.0)
       lodash-es: 4.18.1
       read-package-up: 11.0.0
-      semantic-release: 25.0.7(typescript@6.0.3)
+      semantic-release: 25.0.7(supports-color@7.2.0)(typescript@6.0.3)
     transitivePeerDependencies:
       - supports-color
 
@@ -5477,6 +5868,8 @@ snapshots:
 
   '@sinclair/typebox@0.34.49': {}
 
+  '@sindresorhus/base62@1.0.0': {}
+
   '@sindresorhus/is@4.6.0': {}
 
   '@sindresorhus/merge-streams@4.0.0': {}
@@ -5581,9 +5974,9 @@ snapshots:
 
   '@stryker-mutator/util@10.0.0': {}
 
-  '@tokenizer/inflate@0.4.1':
+  '@tokenizer/inflate@0.4.1(supports-color@7.2.0)':
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       token-types: 6.1.2
     transitivePeerDependencies:
       - supports-color
@@ -5635,6 +6028,10 @@ snapshots:
     dependencies:
       undici-types: 8.3.0
 
+  '@types/node@26.5.1':
+    dependencies:
+      undici-types: 8.9.0
+
   '@types/normalize-package-data@2.4.4': {}
 
   '@types/retry@0.12.0': {}
@@ -5652,15 +6049,15 @@ snapshots:
       '@types/node': 26.1.1
     optional: true
 
-  '@typescript-eslint/eslint-plugin@8.69.0(@typescript-eslint/parser@8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
+  '@typescript-eslint/eslint-plugin@8.69.0(@typescript-eslint/parser@8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
       '@typescript-eslint/scope-manager': 8.69.0
-      '@typescript-eslint/type-utils': 8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/type-utils': 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
       '@typescript-eslint/visitor-keys': 8.69.0
-      eslint: 10.7.0(jiti@2.7.0)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       ignore: 7.0.8
       natural-compare: 1.4.0
       ts-api-utils: 2.5.0(typescript@6.0.3)
@@ -5668,57 +6065,127 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
+  '@typescript-eslint/parser@8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/scope-manager': 8.69.0
       '@typescript-eslint/types': 8.69.0
-      '@typescript-eslint/typescript-estree': 8.69.0(typescript@6.0.3)
+      '@typescript-eslint/typescript-estree': 8.69.0(supports-color@7.2.0)(typescript@6.0.3)
       '@typescript-eslint/visitor-keys': 8.69.0
-      debug: 4.4.3
-      eslint: 10.7.0(jiti@2.7.0)
+      debug: 4.4.3(supports-color@7.2.0)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/project-service@8.69.0(typescript@6.0.3)':
+  '@typescript-eslint/project-service@8.56.1(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/tsconfig-utils': 8.69.0(typescript@6.0.3)
       '@typescript-eslint/types': 8.69.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
+  '@typescript-eslint/project-service@8.67.0(supports-color@7.2.0)(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.69.0(typescript@6.0.3)
+      '@typescript-eslint/types': 8.69.0
+      debug: 4.4.3(supports-color@7.2.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.69.0(supports-color@7.2.0)(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.69.0(typescript@6.0.3)
+      '@typescript-eslint/types': 8.69.0
+      debug: 4.4.3(supports-color@7.2.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/scope-manager@8.56.1':
+    dependencies:
+      '@typescript-eslint/types': 8.56.1
+      '@typescript-eslint/visitor-keys': 8.56.1
+
+  '@typescript-eslint/scope-manager@8.67.0':
+    dependencies:
+      '@typescript-eslint/types': 8.67.0
+      '@typescript-eslint/visitor-keys': 8.67.0
+
   '@typescript-eslint/scope-manager@8.69.0':
     dependencies:
       '@typescript-eslint/types': 8.69.0
       '@typescript-eslint/visitor-keys': 8.69.0
 
+  '@typescript-eslint/tsconfig-utils@8.56.1(typescript@6.0.3)':
+    dependencies:
+      typescript: 6.0.3
+
+  '@typescript-eslint/tsconfig-utils@8.67.0(typescript@6.0.3)':
+    dependencies:
+      typescript: 6.0.3
+
   '@typescript-eslint/tsconfig-utils@8.69.0(typescript@6.0.3)':
     dependencies:
       typescript: 6.0.3
 
-  '@typescript-eslint/type-utils@8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
+  '@typescript-eslint/type-utils@8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/types': 8.69.0
-      '@typescript-eslint/typescript-estree': 8.69.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
-      debug: 4.4.3
-      eslint: 10.7.0(jiti@2.7.0)
+      '@typescript-eslint/typescript-estree': 8.69.0(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      debug: 4.4.3(supports-color@7.2.0)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
+  '@typescript-eslint/types@8.56.1': {}
+
+  '@typescript-eslint/types@8.67.0': {}
+
   '@typescript-eslint/types@8.69.0': {}
 
-  '@typescript-eslint/typescript-estree@8.69.0(typescript@6.0.3)':
+  '@typescript-eslint/typescript-estree@8.56.1(supports-color@7.2.0)(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.56.1(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/tsconfig-utils': 8.56.1(typescript@6.0.3)
+      '@typescript-eslint/types': 8.56.1
+      '@typescript-eslint/visitor-keys': 8.56.1
+      debug: 4.4.3(supports-color@7.2.0)
+      minimatch: 10.2.6
+      semver: 7.8.5
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/typescript-estree@8.67.0(supports-color@7.2.0)(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.67.0(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/tsconfig-utils': 8.67.0(typescript@6.0.3)
+      '@typescript-eslint/types': 8.67.0
+      '@typescript-eslint/visitor-keys': 8.67.0
+      debug: 4.4.3(supports-color@7.2.0)
+      minimatch: 10.2.6
+      semver: 7.8.5
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/typescript-estree@8.69.0(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/project-service': 8.69.0(typescript@6.0.3)
+      '@typescript-eslint/project-service': 8.69.0(supports-color@7.2.0)(typescript@6.0.3)
       '@typescript-eslint/tsconfig-utils': 8.69.0(typescript@6.0.3)
       '@typescript-eslint/types': 8.69.0
       '@typescript-eslint/visitor-keys': 8.69.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       minimatch: 10.2.6
       semver: 7.8.5
       tinyglobby: 0.2.17
@@ -5727,17 +6194,49 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)':
+  '@typescript-eslint/utils@8.56.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.10.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))
+      '@typescript-eslint/scope-manager': 8.56.1
+      '@typescript-eslint/types': 8.56.1
+      '@typescript-eslint/typescript-estree': 8.56.1(supports-color@7.2.0)(typescript@6.0.3)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.67.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.10.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))
+      '@typescript-eslint/scope-manager': 8.67.0
+      '@typescript-eslint/types': 8.67.0
+      '@typescript-eslint/typescript-estree': 8.67.0(supports-color@7.2.0)(typescript@6.0.3)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
-      '@eslint-community/eslint-utils': 4.10.1(eslint@10.7.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.10.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))
       '@typescript-eslint/scope-manager': 8.69.0
       '@typescript-eslint/types': 8.69.0
-      '@typescript-eslint/typescript-estree': 8.69.0(typescript@6.0.3)
-      eslint: 10.7.0(jiti@2.7.0)
+      '@typescript-eslint/typescript-estree': 8.69.0(supports-color@7.2.0)(typescript@6.0.3)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
+  '@typescript-eslint/visitor-keys@8.56.1':
+    dependencies:
+      '@typescript-eslint/types': 8.56.1
+      eslint-visitor-keys: 5.0.1
+
+  '@typescript-eslint/visitor-keys@8.67.0':
+    dependencies:
+      '@typescript-eslint/types': 8.67.0
+      eslint-visitor-keys: 5.0.1
+
   '@typescript-eslint/visitor-keys@8.69.0':
     dependencies:
       '@typescript-eslint/types': 8.69.0
@@ -5790,6 +6289,13 @@ snapshots:
       json-schema-traverse: 0.4.1
       uri-js: 4.4.1
 
+  ajv@8.18.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 4.1.3
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -5819,6 +6325,8 @@ snapshots:
 
   any-promise@1.3.0: {}
 
+  are-docs-informative@0.1.1: {}
+
   argparse@2.0.1: {}
 
   argue-cli@3.1.0: {}
@@ -5845,11 +6353,11 @@ snapshots:
 
   bignumber.js@9.3.1: {}
 
-  body-parser@2.3.0:
+  body-parser@2.3.0(supports-color@7.2.0):
     dependencies:
       bytes: 3.1.2
       content-type: 2.1.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       http-errors: 2.0.1
       iconv-lite: 0.7.3
       on-finished: 2.4.1
@@ -6006,6 +6514,8 @@ snapshots:
 
   commander@8.3.0: {}
 
+  comment-parser@1.4.8: {}
+
   compare-func@2.0.0:
     dependencies:
       array-ify: 1.0.0
@@ -6101,9 +6611,11 @@ snapshots:
 
   data-uri-to-buffer@6.0.2: {}
 
-  debug@4.4.3:
+  debug@4.4.3(supports-color@7.2.0):
     dependencies:
       ms: 2.1.3
+    optionalDependencies:
+      supports-color: 7.2.0
 
   decode-named-character-reference@1.3.0:
     dependencies:
@@ -6252,18 +6764,50 @@ snapshots:
     optionalDependencies:
       source-map: 0.6.1
 
-  eslint-config-prettier@10.1.8(eslint@10.7.0(jiti@2.7.0)):
+  eslint-config-prettier@10.1.8(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0)):
     dependencies:
-      eslint: 10.7.0(jiti@2.7.0)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
 
-  eslint-plugin-prettier@5.5.6(eslint-config-prettier@10.1.8(eslint@10.7.0(jiti@2.7.0)))(eslint@10.7.0(jiti@2.7.0))(prettier@3.9.5):
+  eslint-plugin-jsdoc@64.3.6(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3):
     dependencies:
-      eslint: 10.7.0(jiti@2.7.0)
+      '@es-joy/jsdoccomment': 0.97.0
+      '@es-joy/resolve.exports': 1.2.0
+      '@typescript-eslint/utils': 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      are-docs-informative: 0.1.1
+      comment-parser: 1.4.8
+      debug: 4.4.3(supports-color@7.2.0)
+      escape-string-regexp: 5.0.0
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
+      espree: 11.2.0
+      esquery: 1.7.0
+      html-entities: 2.6.0
+      object-deep-merge: 2.0.1
+      parse-imports-exports: 0.2.4
+      semver: 7.8.5
+      spdx-expression-parse: 5.0.0
+      to-valid-identifier: 1.0.0
+    transitivePeerDependencies:
+      - supports-color
+      - typescript
+
+  eslint-plugin-prettier@5.5.6(eslint-config-prettier@10.1.8(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(prettier@3.9.5):
+    dependencies:
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       prettier: 3.9.5
       prettier-linter-helpers: 1.0.1
       synckit: 0.11.13
     optionalDependencies:
-      eslint-config-prettier: 10.1.8(eslint@10.7.0(jiti@2.7.0))
+      eslint-config-prettier: 10.1.8(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))
+
+  eslint-plugin-tsdoc@0.5.2(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3):
+    dependencies:
+      '@microsoft/tsdoc': 0.16.0
+      '@microsoft/tsdoc-config': 0.18.1
+      '@typescript-eslint/utils': 8.56.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+    transitivePeerDependencies:
+      - eslint
+      - supports-color
+      - typescript
 
   eslint-scope@9.1.2:
     dependencies:
@@ -6276,11 +6820,11 @@ snapshots:
 
   eslint-visitor-keys@5.0.1: {}
 
-  eslint@10.7.0(jiti@2.7.0):
+  eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.7.0(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))
       '@eslint-community/regexpp': 4.12.2
-      '@eslint/config-array': 0.23.5
+      '@eslint/config-array': 0.23.5(supports-color@7.2.0)
       '@eslint/config-helpers': 0.6.0
       '@eslint/core': 1.2.1
       '@eslint/plugin-kit': 0.7.2
@@ -6290,7 +6834,7 @@ snapshots:
       '@types/estree': 1.0.9
       ajv: 6.15.0
       cross-spawn: 7.0.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       escape-string-regexp: 4.0.0
       eslint-scope: 9.1.2
       eslint-visitor-keys: 5.0.1
@@ -6388,28 +6932,28 @@ snapshots:
 
   expect-type@1.4.0: {}
 
-  express-rate-limit@8.7.0(express@5.2.1):
+  express-rate-limit@8.7.0(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0):
     dependencies:
-      debug: 4.4.3
-      express: 5.2.1
+      debug: 4.4.3(supports-color@7.2.0)
+      express: 5.2.1(supports-color@7.2.0)
       ip-address: 10.7.0
     transitivePeerDependencies:
       - supports-color
 
-  express@5.2.1:
+  express@5.2.1(supports-color@7.2.0):
     dependencies:
       accepts: 2.0.0
-      body-parser: 2.3.0
+      body-parser: 2.3.0(supports-color@7.2.0)
       content-disposition: 1.1.0
       content-type: 1.0.5
       cookie: 0.7.2
       cookie-signature: 1.2.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       depd: 2.0.0
       encodeurl: 2.0.0
       escape-html: 1.0.3
       etag: 1.8.1
-      finalhandler: 2.1.1
+      finalhandler: 2.1.1(supports-color@7.2.0)
       fresh: 2.0.0
       http-errors: 2.0.1
       merge-descriptors: 2.0.0
@@ -6420,9 +6964,9 @@ snapshots:
       proxy-addr: 2.0.7
       qs: 6.16.0
       range-parser: 1.3.0
-      router: 2.2.0
-      send: 1.2.1
-      serve-static: 2.2.1
+      router: 2.2.0(supports-color@7.2.0)
+      send: 1.2.1(supports-color@7.2.0)
+      serve-static: 2.2.1(supports-color@7.2.0)
       statuses: 2.0.2
       type-is: 2.1.0
       vary: 1.1.2
@@ -6431,9 +6975,9 @@ snapshots:
 
   extend@3.0.2: {}
 
-  extract-zip@2.0.1:
+  extract-zip@2.0.1(supports-color@7.2.0):
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       get-stream: 5.2.0
       yauzl: 2.10.0
     optionalDependencies:
@@ -6492,9 +7036,9 @@ snapshots:
     dependencies:
       flat-cache: 4.0.1
 
-  file-type@21.3.4:
+  file-type@21.3.4(supports-color@7.2.0):
     dependencies:
-      '@tokenizer/inflate': 0.4.1
+      '@tokenizer/inflate': 0.4.1(supports-color@7.2.0)
       strtok3: 10.3.5
       token-types: 6.1.2
       uint8array-extras: 1.5.0
@@ -6505,9 +7049,9 @@ snapshots:
     dependencies:
       to-regex-range: 5.0.1
 
-  finalhandler@2.1.1:
+  finalhandler@2.1.1(supports-color@7.2.0):
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       encodeurl: 2.0.0
       escape-html: 1.0.3
       on-finished: 2.4.1
@@ -6565,17 +7109,17 @@ snapshots:
 
   function-timeout@1.0.2: {}
 
-  gaxios@7.2.0:
+  gaxios@7.2.0(supports-color@7.2.0):
     dependencies:
       extend: 3.0.2
-      https-proxy-agent: 7.0.6
+      https-proxy-agent: 7.0.6(supports-color@7.2.0)
       node-fetch: 3.3.2
     transitivePeerDependencies:
       - supports-color
 
-  gcp-metadata@8.1.2:
+  gcp-metadata@8.1.2(supports-color@7.2.0):
     dependencies:
-      gaxios: 7.2.0
+      gaxios: 7.2.0(supports-color@7.2.0)
       google-logging-utils: 1.1.3
       json-bigint: 1.0.0
     transitivePeerDependencies:
@@ -6618,11 +7162,11 @@ snapshots:
       '@sec-ant/readable-stream': 0.4.1
       is-stream: 4.0.1
 
-  get-uri@6.0.5:
+  get-uri@6.0.5(supports-color@7.2.0):
     dependencies:
       basic-ftp: 6.0.1
       data-uri-to-buffer: 6.0.2
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -6651,12 +7195,12 @@ snapshots:
     dependencies:
       ini: 6.0.0
 
-  google-auth-library@10.9.0:
+  google-auth-library@10.9.0(supports-color@7.2.0):
     dependencies:
       base64-js: 1.5.1
       ecdsa-sig-formatter: 1.0.11
-      gaxios: 7.2.0
-      gcp-metadata: 8.1.2
+      gaxios: 7.2.0(supports-color@7.2.0)
+      gcp-metadata: 8.1.2(supports-color@7.2.0)
       google-logging-utils: 1.1.3
       jws: 4.0.1
     transitivePeerDependencies:
@@ -6707,6 +7251,8 @@ snapshots:
     dependencies:
       lru-cache: 11.5.2
 
+  html-entities@2.6.0: {}
+
   http-errors@2.0.1:
     dependencies:
       depd: 2.0.0
@@ -6715,33 +7261,33 @@ snapshots:
       statuses: 2.0.2
       toidentifier: 1.0.1
 
-  http-proxy-agent@7.0.2:
+  http-proxy-agent@7.0.2(supports-color@7.2.0):
     dependencies:
       agent-base: 7.1.4
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
-  http-proxy-agent@9.1.0:
+  http-proxy-agent@9.1.0(supports-color@7.2.0):
     dependencies:
       agent-base: 9.0.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       proxy-agent-negotiate: 1.1.0
     transitivePeerDependencies:
       - kerberos
       - supports-color
 
-  https-proxy-agent@7.0.6:
+  https-proxy-agent@7.0.6(supports-color@7.2.0):
     dependencies:
       agent-base: 7.1.4
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
-  https-proxy-agent@9.1.0:
+  https-proxy-agent@9.1.0(supports-color@7.2.0):
     dependencies:
       agent-base: 9.0.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       proxy-agent-negotiate: 1.1.0
     transitivePeerDependencies:
       - kerberos
@@ -6772,9 +7318,9 @@ snapshots:
       parent-module: 1.0.1
       resolve-from: 4.0.0
 
-  import-from-esm@2.0.0:
+  import-from-esm@2.0.0(supports-color@7.2.0):
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       import-meta-resolve: 4.2.0
     transitivePeerDependencies:
       - supports-color
@@ -6801,6 +7347,10 @@ snapshots:
 
   is-arrayish@0.2.1: {}
 
+  is-core-module@2.16.2:
+    dependencies:
+      hasown: 2.0.4
+
   is-extglob@2.1.1: {}
 
   is-fullwidth-code-point@3.0.0: {}
@@ -6847,6 +7397,8 @@ snapshots:
 
   jiti@2.7.0: {}
 
+  jju@1.4.0: {}
+
   jose@6.2.10: {}
 
   js-md4@0.3.2: {}
@@ -6859,6 +7411,11 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
+  jsdoc-type-pratt-parser@9.2.1:
+    dependencies:
+      '@types/estree': 1.0.9
+      '@types/node': 26.5.1
+
   jsesc@3.1.0: {}
 
   json-bigint@1.0.0:
@@ -7075,14 +7632,14 @@ snapshots:
       unist-util-is: 6.0.1
       unist-util-visit-parents: 6.0.2
 
-  mdast-util-from-markdown@2.0.3:
+  mdast-util-from-markdown@2.0.3(supports-color@7.2.0):
     dependencies:
       '@types/mdast': 4.0.4
       '@types/unist': 3.0.3
       decode-named-character-reference: 1.3.0
       devlop: 1.1.0
       mdast-util-to-string: 4.0.0
-      micromark: 4.0.2
+      micromark: 4.0.2(supports-color@7.2.0)
       micromark-util-decode-numeric-character-reference: 2.0.2
       micromark-util-decode-string: 2.0.1
       micromark-util-normalize-identifier: 2.0.1
@@ -7092,12 +7649,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-frontmatter@2.0.1:
+  mdast-util-frontmatter@2.0.1(supports-color@7.2.0):
     dependencies:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       escape-string-regexp: 5.0.0
-      mdast-util-from-markdown: 2.0.3
+      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
       mdast-util-to-markdown: 2.1.2
       micromark-extension-frontmatter: 2.0.0
     transitivePeerDependencies:
@@ -7111,62 +7668,62 @@ snapshots:
       mdast-util-find-and-replace: 3.0.2
       micromark-util-character: 2.1.1
 
-  mdast-util-gfm-footnote@2.1.0:
+  mdast-util-gfm-footnote@2.1.0(supports-color@7.2.0):
     dependencies:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
-      mdast-util-from-markdown: 2.0.3
+      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
       mdast-util-to-markdown: 2.1.2
       micromark-util-normalize-identifier: 2.0.1
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-gfm-strikethrough@2.0.0:
+  mdast-util-gfm-strikethrough@2.0.0(supports-color@7.2.0):
     dependencies:
       '@types/mdast': 4.0.4
-      mdast-util-from-markdown: 2.0.3
+      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
       mdast-util-to-markdown: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-gfm-table@2.0.0:
+  mdast-util-gfm-table@2.0.0(supports-color@7.2.0):
     dependencies:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       markdown-table: 3.0.4
-      mdast-util-from-markdown: 2.0.3
+      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
       mdast-util-to-markdown: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-gfm-task-list-item@2.0.0:
+  mdast-util-gfm-task-list-item@2.0.0(supports-color@7.2.0):
     dependencies:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
-      mdast-util-from-markdown: 2.0.3
+      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
       mdast-util-to-markdown: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-gfm@3.1.0:
+  mdast-util-gfm@3.1.0(supports-color@7.2.0):
     dependencies:
-      mdast-util-from-markdown: 2.0.3
+      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
       mdast-util-gfm-autolink-literal: 2.0.1
-      mdast-util-gfm-footnote: 2.1.0
-      mdast-util-gfm-strikethrough: 2.0.0
-      mdast-util-gfm-table: 2.0.0
-      mdast-util-gfm-task-list-item: 2.0.0
+      mdast-util-gfm-footnote: 2.1.0(supports-color@7.2.0)
+      mdast-util-gfm-strikethrough: 2.0.0(supports-color@7.2.0)
+      mdast-util-gfm-table: 2.0.0(supports-color@7.2.0)
+      mdast-util-gfm-task-list-item: 2.0.0(supports-color@7.2.0)
       mdast-util-to-markdown: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-math@3.0.0:
+  mdast-util-math@3.0.0(supports-color@7.2.0):
     dependencies:
       '@types/hast': 3.0.5
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       longest-streak: 3.1.0
-      mdast-util-from-markdown: 2.0.3
+      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
       mdast-util-to-markdown: 2.1.2
       unist-util-remove-position: 5.0.0
     transitivePeerDependencies:
@@ -7387,10 +7944,10 @@ snapshots:
 
   micromark-util-types@2.0.2: {}
 
-  micromark@4.0.2:
+  micromark@4.0.2(supports-color@7.2.0):
     dependencies:
       '@types/debug': 4.1.13
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       decode-named-character-reference: 1.3.0
       devlop: 1.1.0
       micromark-core-commonmark: 2.0.3
@@ -7524,6 +8081,8 @@ snapshots:
 
   object-assign@4.1.1: {}
 
+  object-deep-merge@2.0.1: {}
+
   object-inspect@1.13.4: {}
 
   obug@2.1.4: {}
@@ -7603,16 +8162,16 @@ snapshots:
 
   p-try@1.0.0: {}
 
-  pac-proxy-agent@7.2.0:
+  pac-proxy-agent@7.2.0(supports-color@7.2.0):
     dependencies:
       '@tootallnate/quickjs-emscripten': 0.23.0
       agent-base: 7.1.4
-      debug: 4.4.3
-      get-uri: 6.0.5
-      http-proxy-agent: 7.0.2
-      https-proxy-agent: 7.0.6
+      debug: 4.4.3(supports-color@7.2.0)
+      get-uri: 6.0.5(supports-color@7.2.0)
+      http-proxy-agent: 7.0.2(supports-color@7.2.0)
+      https-proxy-agent: 7.0.6(supports-color@7.2.0)
       pac-resolver: 7.0.1
-      socks-proxy-agent: 8.0.5
+      socks-proxy-agent: 8.0.5(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -7625,6 +8184,10 @@ snapshots:
     dependencies:
       callsites: 3.1.0
 
+  parse-imports-exports@0.2.4:
+    dependencies:
+      parse-statements: 1.0.11
+
   parse-json@4.0.0:
     dependencies:
       error-ex: 1.3.4
@@ -7645,6 +8208,8 @@ snapshots:
 
   parse-ms@4.0.0: {}
 
+  parse-statements@1.0.11: {}
+
   parse5-htmlparser2-tree-adapter@6.0.1:
     dependencies:
       parse5: 6.0.1
@@ -7665,6 +8230,8 @@ snapshots:
 
   path-key@4.0.0: {}
 
+  path-parse@1.0.7: {}
+
   path-scurry@2.0.2:
     dependencies:
       lru-cache: 11.5.2
@@ -7754,16 +8321,16 @@ snapshots:
 
   proxy-agent-negotiate@1.1.0: {}
 
-  proxy-agent@6.5.0:
+  proxy-agent@6.5.0(supports-color@7.2.0):
     dependencies:
       agent-base: 7.1.4
-      debug: 4.4.3
-      http-proxy-agent: 7.0.2
-      https-proxy-agent: 7.0.6
+      debug: 4.4.3(supports-color@7.2.0)
+      http-proxy-agent: 7.0.2(supports-color@7.2.0)
+      https-proxy-agent: 7.0.6(supports-color@7.2.0)
       lru-cache: 7.18.3
-      pac-proxy-agent: 7.2.0
+      pac-proxy-agent: 7.2.0(supports-color@7.2.0)
       proxy-from-env: 1.1.0
-      socks-proxy-agent: 8.0.5
+      socks-proxy-agent: 8.0.5(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -7843,10 +8410,19 @@ snapshots:
 
   require-from-string@2.0.2: {}
 
+  reserved-identifiers@1.2.0: {}
+
   resolve-from@4.0.0: {}
 
   resolve-from@5.0.0: {}
 
+  resolve@1.22.12:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.16.2
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
   restore-cursor@5.1.0:
     dependencies:
       onetime: 7.0.0
@@ -7879,9 +8455,9 @@ snapshots:
       '@rolldown/binding-win32-arm64-msvc': 1.2.7
       '@rolldown/binding-win32-x64-msvc': 1.2.7
 
-  router@2.2.0:
+  router@2.2.0(supports-color@7.2.0):
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       depd: 2.0.0
       is-promise: 4.0.0
       parseurl: 1.3.3
@@ -7899,16 +8475,16 @@ snapshots:
 
   safer-buffer@2.1.2: {}
 
-  semantic-release@25.0.7(typescript@6.0.3):
+  semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3):
     dependencies:
-      '@semantic-release/commit-analyzer': 13.0.1(semantic-release@25.0.7(typescript@6.0.3))
+      '@semantic-release/commit-analyzer': 13.0.1(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@semantic-release/error': 4.0.0
-      '@semantic-release/github': 12.0.9(semantic-release@25.0.7(typescript@6.0.3))
-      '@semantic-release/npm': 13.1.5(semantic-release@25.0.7(typescript@6.0.3))
-      '@semantic-release/release-notes-generator': 14.1.1(semantic-release@25.0.7(typescript@6.0.3))
+      '@semantic-release/github': 12.0.9(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
+      '@semantic-release/npm': 13.1.5(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))
+      '@semantic-release/release-notes-generator': 14.1.1(semantic-release@25.0.7(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       aggregate-error: 5.0.0
       cosmiconfig: 9.0.2(typescript@6.0.3)
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       env-ci: 11.2.0
       execa: 9.6.1
       figures: 6.1.0
@@ -7917,7 +8493,7 @@ snapshots:
       git-log-parser: 1.2.1
       hook-std: 4.0.0
       hosted-git-info: 9.0.3
-      import-from-esm: 2.0.0
+      import-from-esm: 2.0.0(supports-color@7.2.0)
       lodash-es: 4.18.1
       marked: 15.0.12
       marked-terminal: 7.3.0(marked@15.0.12)
@@ -7938,9 +8514,9 @@ snapshots:
 
   semver@7.8.5: {}
 
-  send@1.2.1:
+  send@1.2.1(supports-color@7.2.0):
     dependencies:
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       encodeurl: 2.0.0
       escape-html: 1.0.3
       etag: 1.8.1
@@ -7954,12 +8530,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  serve-static@2.2.1:
+  serve-static@2.2.1(supports-color@7.2.0):
     dependencies:
       encodeurl: 2.0.0
       escape-html: 1.0.3
       parseurl: 1.3.3
-      send: 1.2.1
+      send: 1.2.1(supports-color@7.2.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -8027,10 +8603,10 @@ snapshots:
 
   smart-buffer@4.2.0: {}
 
-  socks-proxy-agent@8.0.5:
+  socks-proxy-agent@8.0.5(supports-color@7.2.0):
     dependencies:
       agent-base: 7.1.4
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@7.2.0)
       socks: 2.8.9
     transitivePeerDependencies:
       - supports-color
@@ -8061,6 +8637,11 @@ snapshots:
       spdx-exceptions: 2.5.0
       spdx-license-ids: 3.0.23
 
+  spdx-expression-parse@5.0.0:
+    dependencies:
+      spdx-exceptions: 2.5.0
+      spdx-license-ids: 3.0.23
+
   spdx-license-ids@3.0.23: {}
 
   split2@1.0.0:
@@ -8147,6 +8728,8 @@ snapshots:
       has-flag: 4.0.0
       supports-color: 7.2.0
 
+  supports-preserve-symlinks-flag@1.0.0: {}
+
   synckit@0.11.13:
     dependencies:
       '@pkgr/core': 0.3.6
@@ -8194,6 +8777,11 @@ snapshots:
     dependencies:
       is-number: 7.0.0
 
+  to-valid-identifier@1.0.0:
+    dependencies:
+      '@sindresorhus/base62': 1.0.0
+      reserved-identifiers: 1.2.0
+
   toidentifier@1.0.1: {}
 
   token-types@6.1.2:
@@ -8254,13 +8842,13 @@ snapshots:
       tunnel: 0.0.6
       underscore: 1.13.8
 
-  typescript-eslint@8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3):
+  typescript-eslint@8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.69.0(@typescript-eslint/parser@8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/parser': 8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/typescript-estree': 8.69.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.69.0(eslint@10.7.0(jiti@2.7.0))(typescript@6.0.3)
-      eslint: 10.7.0(jiti@2.7.0)
+      '@typescript-eslint/eslint-plugin': 8.69.0(@typescript-eslint/parser@8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/typescript-estree': 8.69.0(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.69.0(eslint@10.7.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      eslint: 10.7.0(jiti@2.7.0)(supports-color@7.2.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
@@ -8273,6 +8861,8 @@ snapshots:
 
   undici-types@8.3.0: {}
 
+  undici-types@8.9.0: {}
+
   undici@6.27.0: {}
 
   undici@7.28.0: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index a314305..ea1d90c 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,13 +1,25 @@
+allowBuilds:
+  # Its own published scripts (preinstall, prepack) are no-ops, and the "prepare" script's target file isn't present in the published tarball -- nothing to run for a consumer.
+  '@google/genai': false
+  # postinstall downloads the platform-specific binary esbuild needs to run at all.
+  esbuild: true
+  # install prebuilds/fetches the native binary koffi's FFI calls depend on.
+  koffi: true
+  # No preinstall/install/postinstall script -- only dev-only build/bench scripts a consumer never runs.
+  protobufjs: false
+minimumReleaseAgeExclude:
+  - '@exadev/eslint-config'
 overrides:
-  fast-uri: ">=3.1.2"
-  protobufjs: "^7.6.1"
-  fast-xml-parser: ">=5.8.0"
-  ip-address: ">=10.2.0"
-  hono: "^4.12.18"
-  brace-expansion: ">=5.0.6"
-  qs: ">=6.15.2"
-  basic-ftp: ">=6.0.1"
   "@anthropic-ai/sdk": ">=0.91.1"
+  basic-ftp: ">=6.0.1"
+  brace-expansion: ">=5.0.6"
   # @semantic-release/release-notes-generator pins conventional-changelog-writer to
   # ^8.0.0, which predates the breaking Handlebars-to-render-function template rewrite that conventional-changelog-conventionalcommits@10.x now requires -- without this override, generateNotes silently produces an empty changelog body (just the version header, no Features/Bug Fixes sections), which is what happened to v1.24.1's entry. Confirmed upstream: https://github.com/semantic-release/release-notes-generator/issues/992
   conventional-changelog-writer: ^9.2.0
+  fast-uri: ">=3.1.2"
+  fast-xml-parser: ">=5.8.0"
+  hono: "^4.12.18"
+  ip-address: ">=10.2.0"
+  protobufjs: "^7.6.1"
+  qs: ">=6.15.2"
+saveExact: true
diff --git a/scripts/publish-mcp-registry.ts b/scripts/publish-mcp-registry.ts
index b9251fa..552db7f 100644
--- a/scripts/publish-mcp-registry.ts
+++ b/scripts/publish-mcp-registry.ts
@@ -9,7 +9,9 @@ import {
   nextRetryDelayMs,
 } from "../src/core/mcp-registry-retry.js";
 
-function run(command: string, args: string[]): void {
+const MS_PER_SECOND = 1000;
+
+function run(command: string, args: readonly string[]): void {
   const result = spawnSync(command, args, { stdio: "inherit" });
   if (result.status !== 0) {
     throw new Error(`Command failed: ${command} ${args.join(" ")}`);
@@ -17,10 +19,10 @@ function run(command: string, args: string[]): void {
 }
 
 function sleepSync(ms: number): void {
-  spawnSync("sleep", [String(ms / 1000)]);
+  spawnSync("sleep", [String(ms / MS_PER_SECOND)]);
 }
 
-function runPublishWithRetry(command: string, args: string[]): void {
+function runPublishWithRetry(command: string, args: readonly string[]): void {
   const deadline = Date.now() + MAX_TOTAL_RETRY_MS;
   let delayMs = INITIAL_RETRY_DELAY_MS;
   for (let attempt = 1; ; attempt++) {
@@ -34,7 +36,7 @@ function runPublishWithRetry(command: string, args: string[]): void {
       isRetryablePublishFailure(output) && Date.now() + delayMs < deadline;
     if (canRetry) {
       console.error(
-        `mcp-publisher publish hit a retryable failure (attempt ${String(attempt)}), retrying in ${String(delayMs / 1000)}s`,
+        `mcp-publisher publish hit a retryable failure (attempt ${String(attempt)}), retrying in ${String(delayMs / MS_PER_SECOND)}s`,
       );
       sleepSync(delayMs);
       delayMs = nextRetryDelayMs(delayMs);
diff --git a/src/bridges/claude-code/channel.ts b/src/bridges/claude-code/channel.ts
index 78d25a1..cb51867 100644
--- a/src/bridges/claude-code/channel.ts
+++ b/src/bridges/claude-code/channel.ts
@@ -48,6 +48,12 @@ function cwdSlug(cwd: string): string {
   return cwd.replace(/[^a-zA-Z0-9]/g, "_");
 }
 
+/** Maximum number of process-tree ancestors to walk when hunting for the Claude Code CLI PID. */
+const MAX_PID_WALK_HOPS = 10;
+
+/** Length of the random suffix appended to an auto-generated agent display name. */
+const AUTO_NAME_SUFFIX_LENGTH = 4;
+
 function pendingDir(): string {
   return path.join(os.homedir(), ".agents", "bus", "pending");
 }
@@ -66,7 +72,7 @@ function pendingDir(): string {
  */
 function findClaudeCodePid(): number | undefined {
   let pid = process.ppid;
-  for (let i = 0; i < 10 && pid > 1; i++) {
+  for (let i = 0; i < MAX_PID_WALK_HOPS && pid > 1; i++) {
     let out: string;
     try {
       out = execFileSync("ps", ["-o", "ppid=,comm=", "-p", String(pid)], {
@@ -219,11 +225,11 @@ export async function run(): Promise<void> {
     async (rawParams: unknown) => {
       const params = isRecord(rawParams) ? rawParams : {};
       const actionParam = params.action;
-      if (!agentId) {
+      if (agentId === undefined) {
         const name =
           actionParam === "register" && typeof params.name === "string"
             ? params.name
-            : `claude-code-${nanoid(4)}`;
+            : `claude-code-${nanoid(AUTO_NAME_SUFFIX_LENGTH)}`;
         const reg = await ensureRegistered({
           cwd: process.cwd(),
           store,
@@ -269,7 +275,7 @@ export async function run(): Promise<void> {
     cwd: process.cwd(),
     store,
     harness: "claude-code",
-    defaultName: `claude-code-${nanoid(4)}`,
+    defaultName: `claude-code-${nanoid(AUTO_NAME_SUFFIX_LENGTH)}`,
   });
   agentId = reg.agentId;
 
diff --git a/src/bridges/codex/tool.ts b/src/bridges/codex/tool.ts
index d25c5c2..dec3513 100644
--- a/src/bridges/codex/tool.ts
+++ b/src/bridges/codex/tool.ts
@@ -26,6 +26,9 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+/** Length of the random suffix appended to an auto-generated `codex-<suffix>` agent name. */
+const CODEX_AGENT_NAME_SUFFIX_LENGTH = 4;
+
 export async function run(): Promise<void> {
   // Persistent identity for this slot: a stable device-id means the agent ID survives restarts, so peers can keep targeting us. The stdio server has no graceful shutdown hook; a stale lock self-heals via the pid probe.
   const identitySlot: IdentitySlot = { harness: "codex", cwd: process.cwd() };
@@ -55,11 +58,11 @@ export async function run(): Promise<void> {
     async (rawParams: unknown) => {
       const params = isRecord(rawParams) ? rawParams : {};
       const actionParam = params.action;
-      if (!agentId) {
+      if (agentId === undefined) {
         const name =
           actionParam === "register" && typeof params.name === "string"
             ? params.name
-            : `codex-${nanoid(4)}`;
+            : `codex-${nanoid(CODEX_AGENT_NAME_SUFFIX_LENGTH)}`;
         const reg = await ensureRegistered({
           cwd: process.cwd(),
           store,
@@ -104,7 +107,7 @@ export async function run(): Promise<void> {
     cwd: process.cwd(),
     store,
     harness: "codex",
-    defaultName: `codex-${nanoid(4)}`,
+    defaultName: `codex-${nanoid(CODEX_AGENT_NAME_SUFFIX_LENGTH)}`,
   });
   agentId = reg.agentId;
 }
diff --git a/src/bridges/mcp/index.ts b/src/bridges/mcp/server.ts
similarity index 91%
rename from src/bridges/mcp/index.ts
rename to src/bridges/mcp/server.ts
index c7ab95e..04f5bcf 100644
--- a/src/bridges/mcp/index.ts
+++ b/src/bridges/mcp/server.ts
@@ -22,6 +22,9 @@ import type { IdentitySlot } from "../../core/identity-store.js";
 import { tryStartWebServer } from "../user/web/server.js";
 import { nanoid } from "../../core/nanoid.js";
 
+/** Length of the random suffix appended to a default `mcp-<suffix>` agent name when no explicit name is registered. */
+const DEFAULT_AGENT_NAME_SUFFIX_LENGTH = 4;
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -56,11 +59,11 @@ export async function run(): Promise<void> {
       const params = isRecord(rawParams) ? rawParams : {};
       const actionParam = params.action;
 
-      if (!agentId) {
+      if (agentId === undefined) {
         const name =
           actionParam === "register" && typeof params.name === "string"
             ? params.name
-            : `mcp-${nanoid(4)}`;
+            : `mcp-${nanoid(DEFAULT_AGENT_NAME_SUFFIX_LENGTH)}`;
         const reg = await ensureRegistered({
           cwd: process.cwd(),
           store,
@@ -105,7 +108,7 @@ export async function run(): Promise<void> {
     cwd: process.cwd(),
     store,
     harness: "mcp",
-    defaultName: `mcp-${nanoid(4)}`,
+    defaultName: `mcp-${nanoid(DEFAULT_AGENT_NAME_SUFFIX_LENGTH)}`,
   });
   agentId = reg.agentId;
 }
diff --git a/src/bridges/opencode/plugin.ts b/src/bridges/opencode/plugin.ts
index 53527b6..548b321 100644
--- a/src/bridges/opencode/plugin.ts
+++ b/src/bridges/opencode/plugin.ts
@@ -20,18 +20,23 @@ import { nanoid } from "../../core/nanoid.js";
 // Persistent identity for this slot: a stable device-id means the agent ID survives restarts, so peers can keep targeting us. A plugin unload has no hook here; a stale lock self-heals via the pid probe.
 const identitySlot: IdentitySlot = { harness: "opencode", cwd: process.cwd() };
 
+// Length (in characters) of the random suffix appended to the default auto-generated agent name.
+const DEFAULT_NAME_SUFFIX_LENGTH = 4;
+
 // Minimal interface for the OpenCode SDK client we actually use
 interface OpenCodeClient {
   tui: {
-    appendPrompt(body: { text: string }): Promise<unknown>;
-    submitPrompt(): Promise<unknown>;
+    appendPrompt: (body: Readonly<{ text: string }>) => Promise<unknown>;
+    submitPrompt: () => Promise<unknown>;
   };
   session: {
-    list(): Promise<{ data: { id: string }[] }>;
-    prompt(opts: {
-      path: { id: string };
-      body: { parts: { type: string; text: string }[] };
-    }): Promise<unknown>;
+    list: () => Promise<{ data: { id: string }[] }>;
+    prompt: (
+      opts: Readonly<{
+        path: { id: string };
+        body: { parts: { type: string; text: string }[] };
+      }>,
+    ) => Promise<unknown>;
   };
 }
 
@@ -62,7 +67,7 @@ export const AgentCommsPlugin = async (opts: {
     cwd: process.cwd(),
     store,
     harness: "opencode",
-    defaultName: `opencode-${nanoid(4)}`,
+    defaultName: `opencode-${nanoid(DEFAULT_NAME_SUFFIX_LENGTH)}`,
   });
   const agentId = reg.agentId;
 
diff --git a/src/bridges/pi/index.ts b/src/bridges/pi/extension.ts
similarity index 95%
rename from src/bridges/pi/index.ts
rename to src/bridges/pi/extension.ts
index b4bcf5e..f367e3a 100644
--- a/src/bridges/pi/index.ts
+++ b/src/bridges/pi/extension.ts
@@ -55,14 +55,16 @@ export default function (pi: ExtensionAPI) {
   // LRU-style dedup for delivery events
   const recentDeliveries = new Set<string>();
   const MAX_DEDUP_ENTRIES = 100;
+  const AUTO_NAME_SUFFIX_LENGTH = 4;
 
   function refreshStatus(): void {
     if (!uiCtx) return;
     const parts: string[] = [];
-    if (projectRoom) parts.push(`💬 ${projectRoom}`);
+    if (projectRoom !== undefined) parts.push(`💬 ${projectRoom}`);
     if (webHandle) {
       const port = getWebPort(webHandle);
-      if (port) parts.push(`http://127.0.0.1:${String(port)}`);
+      if (port !== undefined && port !== 0)
+        parts.push(`http://127.0.0.1:${String(port)}`);
     }
     if (informationalBuffer.length > 0) {
       parts.push(`📬 ${String(informationalBuffer.length)}`);
@@ -138,7 +140,7 @@ export default function (pi: ExtensionAPI) {
         store,
         cwd: process.cwd(),
         harness: "pi",
-        defaultName: `pi-${nanoid(4)}`,
+        defaultName: `pi-${nanoid(AUTO_NAME_SUFFIX_LENGTH)}`,
       });
       agentId = reg.agentId;
 
@@ -173,7 +175,7 @@ export default function (pi: ExtensionAPI) {
       webHandle.server.close();
       webHandle = undefined;
     }
-    if (agentId) {
+    if (agentId !== undefined) {
       await store.setAgentOffline(agentId);
     }
     releaseIdentityLock(identitySlot);
@@ -186,18 +188,18 @@ export default function (pi: ExtensionAPI) {
 
   pi.registerCommand("comms-url", {
     description: "Show the Agent Comms web UI URL",
-    // eslint-disable-next-line @typescript-eslint/require-await -- SDK requires Promise<void> return
     handler: async (_args, ctx) => {
       if (!webHandle) {
         ctx.ui.notify("Web UI is not running.", "error");
-        return;
+        return Promise.resolve();
       }
       const port = getWebPort(webHandle);
-      if (!port) {
+      if (port === undefined || port === 0) {
         ctx.ui.notify("Web UI port not yet assigned.", "error");
-        return;
+        return Promise.resolve();
       }
       ctx.ui.notify(`http://127.0.0.1:${String(port)}`, "info");
+      return Promise.resolve();
     },
   });
 
@@ -305,7 +307,7 @@ export default function (pi: ExtensionAPI) {
           };
         }
         const port = getWebPort(webHandle);
-        if (!port) {
+        if (port === undefined || port === 0) {
           return {
             content: [{ type: "text", text: "Web UI port not yet assigned." }],
             details: { action: "web_url" },
@@ -319,7 +321,7 @@ export default function (pi: ExtensionAPI) {
         };
       }
 
-      if (!agentId) {
+      if (agentId === undefined) {
         return {
           content: [{ type: "text", text: "Error: not registered" }],
           details: {},
diff --git a/src/bridges/index.ts b/src/bridges/registry.ts
similarity index 86%
rename from src/bridges/index.ts
rename to src/bridges/registry.ts
index c649b9a..141141b 100644
--- a/src/bridges/index.ts
+++ b/src/bridges/registry.ts
@@ -1,6 +1,6 @@
 import * as claudeCode from "./claude-code/channel.js";
 import * as codex from "./codex/tool.js";
-import * as mcp from "./mcp/index.js";
+import * as mcp from "./mcp/server.js";
 
 export interface Bridge {
   run: () => void | Promise<void>;
diff --git a/src/bridges/user/cli.ts b/src/bridges/user/cli.ts
index 99c9691..a9c5bc4 100644
--- a/src/bridges/user/cli.ts
+++ b/src/bridges/user/cli.ts
@@ -13,7 +13,7 @@ import { ChatController } from "./controller.js";
 
 export async function runCli(
   command: string,
-  args: string[],
+  args: readonly string[],
   userName: string,
 ): Promise<void> {
   const controller = new ChatController(userName);
@@ -37,13 +37,13 @@ export async function runCli(
 async function dispatch(
   controller: ChatController,
   command: string,
-  args: string[],
+  args: readonly string[],
 ): Promise<{ content: string; isError: boolean }> {
   switch (command) {
     case "send": {
       const room = args[0];
       const content = args.slice(1).join(" ");
-      if (!room || !content) {
+      if (room === undefined || room === "" || !content) {
         return {
           content: "Usage: agent-comms send <room> <message>",
           isError: true,
@@ -57,7 +57,7 @@ async function dispatch(
     case "dm": {
       const agent = args[0];
       const content = args.slice(1).join(" ");
-      if (!agent || !content) {
+      if (agent === undefined || agent === "" || !content) {
         return {
           content: "Usage: agent-comms dm <agent-id> <message>",
           isError: true,
@@ -71,7 +71,7 @@ async function dispatch(
       return controller.listAgents();
     case "read": {
       const room = args[0];
-      if (!room) {
+      if (room === undefined || room === "") {
         return {
           content: "Usage: agent-comms read <room> [--since <iso>]",
           isError: true,
diff --git a/src/bridges/user/controller.ts b/src/bridges/user/controller.ts
index 30df888..14d5f21 100644
--- a/src/bridges/user/controller.ts
+++ b/src/bridges/user/controller.ts
@@ -6,8 +6,8 @@
  */
 
 import { EventEmitter } from "node:events";
+import type { MeshStore } from "../../core/index.js";
 import {
-  MeshStore,
   CommsTool,
   createBridgeMesh,
   ensureRegistered,
@@ -44,8 +44,8 @@ export class ChatController extends EventEmitter {
   private currentRoom: string | undefined;
 
   constructor(
-    private userName: string,
-    private coordinatorPort?: number,
+    private readonly userName: string,
+    private readonly coordinatorPort?: number,
   ) {
     super();
   }
@@ -57,7 +57,10 @@ export class ChatController extends EventEmitter {
    * (e.g. pi, Claude Code) so the web UI shares the same mesh peer
    * instead of creating a redundant one.
    */
-  static fromExisting(store: MeshStore, ctx: CommsContext): ChatController {
+  static fromExisting(
+    store: MeshStore,
+    ctx: Readonly<CommsContext>,
+  ): ChatController {
     const ctrl = new ChatController("");
     // Replace the store with the existing one
     ctrl.store = store;
@@ -154,7 +157,7 @@ export class ChatController extends EventEmitter {
 
   async leaveRoom(roomId?: string): Promise<CommsResult> {
     const target = roomId ?? this.currentRoom;
-    if (!target) {
+    if (target === undefined || target === "") {
       return { content: "No room to leave. Join a room first.", isError: true };
     }
     const result = await this.tool.handle(this.ctx, {
@@ -172,7 +175,7 @@ export class ChatController extends EventEmitter {
   }
 
   async sendToCurrentRoom(content: string): Promise<CommsResult> {
-    if (!this.currentRoom) {
+    if (this.currentRoom === undefined || this.currentRoom === "") {
       return { content: "No active room. Join a room first.", isError: true };
     }
     return this.send(this.currentRoom, content);
@@ -188,13 +191,13 @@ export class ChatController extends EventEmitter {
 
   async readRoom(roomId?: string, since?: string): Promise<CommsResult> {
     const target = roomId ?? this.currentRoom;
-    if (!target) {
+    if (target === undefined || target === "") {
       return { content: "No room to read. Join a room first.", isError: true };
     }
     return this.tool.handle(this.ctx, {
       action: "read_room",
       room: target,
-      ...(since && { since }),
+      ...(since !== undefined && since !== "" && { since }),
     });
   }
 
diff --git a/src/bridges/user/tui.ts b/src/bridges/user/tui.ts
index 3b39b36..33d0fd3 100644
--- a/src/bridges/user/tui.ts
+++ b/src/bridges/user/tui.ts
@@ -36,7 +36,7 @@ const CLEAR_LINE = "\r\x1b[2K";
 
 function prompt(controller: ChatController): string {
   const room = controller.activeRoom;
-  return room ? `${GREEN}${room}${RESET} > ` : `${DIM}>${RESET} `;
+  return room !== undefined ? `${GREEN}${room}${RESET} > ` : `${DIM}>${RESET} `;
 }
 
 export async function runTui(userName: string): Promise<void> {
@@ -76,7 +76,7 @@ export async function runTui(userName: string): Promise<void> {
 
     if (trimmed.startsWith("/")) {
       await handleCommand(trimmed, controller);
-    } else if (controller.activeRoom) {
+    } else if (controller.activeRoom !== undefined) {
       const result = await controller.sendToCurrentRoom(trimmed);
       if (result.isError) {
         process.stdout.write(`${RED}${result.content}${RESET}\n`);
@@ -118,7 +118,7 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
 
   switch (cmd) {
     case "join": {
-      if (!arg1) {
+      if (arg1 === undefined) {
         process.stdout.write(`${YELLOW}Usage: /join <room>${RESET}\n`);
         return;
       }
@@ -153,7 +153,7 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
       return;
     }
     case "dm": {
-      if (!arg1 || !arg2) {
+      if (arg1 === undefined || !arg2) {
         process.stdout.write(`${YELLOW}Usage: /dm <agent> <message>${RESET}\n`);
         return;
       }
@@ -162,7 +162,7 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
       return;
     }
     case "create": {
-      if (!arg1) {
+      if (arg1 === undefined) {
         process.stdout.write(`${YELLOW}Usage: /create <name>${RESET}\n`);
         return;
       }
@@ -172,7 +172,7 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
     }
     case "invite": {
       const agentId = parts[2];
-      if (!arg1 || !agentId) {
+      if (arg1 === undefined || agentId === undefined) {
         process.stdout.write(
           `${YELLOW}Usage: /invite <room> <agent>${RESET}\n`,
         );
@@ -184,7 +184,7 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
     }
     case "decline": {
       const reason = parts.slice(2).join(" ");
-      if (!arg1 || !reason) {
+      if (arg1 === undefined || !reason) {
         process.stdout.write(
           `${YELLOW}Usage: /decline <room> <reason>${RESET}\n`,
         );
@@ -196,7 +196,7 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
     }
     case "kick": {
       const agentId = parts[2];
-      if (!arg1 || !agentId) {
+      if (arg1 === undefined || agentId === undefined) {
         process.stdout.write(`${YELLOW}Usage: /kick <room> <agent>${RESET}\n`);
         return;
       }
@@ -205,7 +205,7 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
       return;
     }
     case "destroy": {
-      if (!arg1) {
+      if (arg1 === undefined) {
         process.stdout.write(`${YELLOW}Usage: /destroy <room>${RESET}\n`);
         return;
       }
@@ -233,6 +233,8 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
     case "quit":
       process.stdout.write(`${DIM}Goodbye!${RESET}\n`);
       process.exit(0);
+      return;
+    case undefined:
     default:
       process.stdout.write(
         `${YELLOW}Unknown command: /${String(cmd)}. Type /help for commands.${RESET}\n`,
@@ -244,7 +246,9 @@ async function handleCommand(input: string, c: ChatController): Promise<void> {
 // Formatting
 // ---------------------------------------------------------------------------
 
-function printResult(result: { content: string; isError: boolean }): void {
+function printResult(
+  result: Readonly<{ content: string; isError: boolean }>,
+): void {
   if (result.isError) {
     process.stdout.write(`${RED}${result.content}${RESET}\n`);
   } else {
@@ -282,5 +286,7 @@ function formatForTerminal(event: DeliveryEvent): string {
       return `${CYAN}✎ ${event.oldName} is now ${event.newName}${RESET}`;
     case "connection_request":
       return `${CYAN}🔗 Connection request from ${event.peerId} (${event.name})${RESET}`;
+    default:
+      return event satisfies never;
   }
 }
diff --git a/src/bridges/user/web/e2e/connect-prompt.e2e.test.ts b/src/bridges/user/web/e2e/connect-prompt.e2e.test.ts
index 69bcf65..6eb9d7f 100644
--- a/src/bridges/user/web/e2e/connect-prompt.e2e.test.ts
+++ b/src/bridges/user/web/e2e/connect-prompt.e2e.test.ts
@@ -12,7 +12,8 @@
  */
 
 import type { Page } from "@playwright/test";
-import { test, expect } from "./fixtures.js";
+import { expect } from "@playwright/test";
+import { test } from "./fixtures.js";
 
 /**
  * Injects stub WebSocket and SharedWorker constructors that never connect.
@@ -25,7 +26,7 @@ async function blockNetworkConnections(page: Page): Promise<void> {
       static CONNECTING = 0;
       static OPEN = 1;
       static CLOSING = 2;
-      static CLOSED = 3;
+      static readonly CLOSED = 3;
       readyState = 0;
       bufferedAmount = 0;
       protocol = "";
diff --git a/src/bridges/user/web/e2e/deep-link.e2e.test.ts b/src/bridges/user/web/e2e/deep-link.e2e.test.ts
index 3431071..b00dccd 100644
--- a/src/bridges/user/web/e2e/deep-link.e2e.test.ts
+++ b/src/bridges/user/web/e2e/deep-link.e2e.test.ts
@@ -5,7 +5,8 @@
  * correct room or DM target.
  */
 
-import { test, expect } from "./fixtures.js";
+import { expect } from "@playwright/test";
+import { test } from "./fixtures.js";
 
 let testCounter = 0;
 function uniqueName(prefix: string): string {
diff --git a/src/bridges/user/web/e2e/fixtures.ts b/src/bridges/user/web/e2e/fixtures.ts
index 1a57ff2..bb7c122 100644
--- a/src/bridges/user/web/e2e/fixtures.ts
+++ b/src/bridges/user/web/e2e/fixtures.ts
@@ -5,12 +5,12 @@
  * Imports from source (tsx resolves at runtime).
  */
 
-import { test as base, expect } from "@playwright/test";
+import { test as base } from "@playwright/test";
 import { createWebServer, type WebServerHandle } from "../server.js";
 import net from "node:net";
 
 /** Allocate a random free port by binding to port 0. */
-function allocFreePort(): Promise<number> {
+async function allocFreePort(): Promise<number> {
   return new Promise((resolve, reject) => {
     const srv = net.createServer();
     srv.listen(0, "127.0.0.1", () => {
@@ -30,7 +30,10 @@ interface Fixtures {
 }
 
 export const test = base.extend<Fixtures>({
-  server: async ({}, use: (handle: WebServerHandle) => Promise<void>) => {
+  server: async (
+    _fixtures,
+    use: (handle: WebServerHandle) => Promise<void>,
+  ) => {
     // Each test gets its own coordinator port to avoid EADDRINUSE races
     // when the previous test's TLS transport hasn't released 19876 yet.
     const coordinatorPort = await allocFreePort();
@@ -57,5 +60,3 @@ export const test = base.extend<Fixtures>({
     await use(port);
   },
 });
-
-export { expect };
diff --git a/src/bridges/user/web/e2e/pwa.e2e.test.ts b/src/bridges/user/web/e2e/pwa.e2e.test.ts
index edf8ea8..73a4f3a 100644
--- a/src/bridges/user/web/e2e/pwa.e2e.test.ts
+++ b/src/bridges/user/web/e2e/pwa.e2e.test.ts
@@ -9,7 +9,11 @@
  * is present.
  */
 
-import { test, expect } from "./fixtures.js";
+import { expect } from "@playwright/test";
+import { test } from "./fixtures.js";
+
+const CACHE_POPULATE_WAIT_MS = 2000;
+const HTTP_OK = 200;
 
 function hasSizes(value: unknown): value is { sizes: string } {
   return (
@@ -68,7 +72,7 @@ test.describe("PWA features", () => {
           const link = document.querySelector('link[rel="manifest"]');
           if (!link) return null;
           const href = link.getAttribute("href");
-          if (!href) return null;
+          if (href === null) return null;
           const res = await fetch(href);
           return res.json();
         },
@@ -147,7 +151,7 @@ test.describe("PWA features", () => {
 
       // Give the service worker time to populate the cache via its
       // install handler (cache.addAll happens in waitUntil).
-      await page.waitForTimeout(2000);
+      await page.waitForTimeout(CACHE_POPULATE_WAIT_MS);
 
       // Check that the agent-comms cache exists and has app shell entries
       const cacheEntries = await page.evaluate<{
@@ -156,7 +160,7 @@ test.describe("PWA features", () => {
       }>(async () => {
         const names = await caches.keys();
         const commsCache = names.find((n) => n.startsWith("agent-comms"));
-        if (!commsCache) return { found: false, entries: [] };
+        if (commsCache === undefined) return { found: false, entries: [] };
 
         const cache = await caches.open(commsCache);
         const requests = await cache.keys();
@@ -184,7 +188,7 @@ test.describe("PWA features", () => {
         },
         { timeout: 15000 },
       );
-      await page.waitForTimeout(2000);
+      await page.waitForTimeout(CACHE_POPULATE_WAIT_MS);
 
       // Reload so the SW controls the page
       await page.reload();
@@ -218,7 +222,7 @@ test.describe("PWA features", () => {
         },
         { timeout: 15000 },
       );
-      await page.waitForTimeout(2000);
+      await page.waitForTimeout(CACHE_POPULATE_WAIT_MS);
 
       // Reload so the SW controls the page
       await page.reload();
@@ -241,7 +245,7 @@ test.describe("PWA features", () => {
       });
 
       expect(bundleStatus.ok).toBe(true);
-      expect(bundleStatus.status).toBe(200);
+      expect(bundleStatus.status).toBe(HTTP_OK);
 
       await context.setOffline(false);
     });
@@ -265,7 +269,7 @@ test.describe("PWA features", () => {
         async () => {
           const link = document.querySelector('link[rel="manifest"]');
           const href = link?.getAttribute("href");
-          if (!href) return null;
+          if (href === null || href === undefined || href === "") return null;
           const res = await fetch(href);
           return res.json();
         },
diff --git a/src/bridges/user/web/e2e/standalone.e2e.test.ts b/src/bridges/user/web/e2e/standalone.e2e.test.ts
index 24259f9..d88ecfc 100644
--- a/src/bridges/user/web/e2e/standalone.e2e.test.ts
+++ b/src/bridges/user/web/e2e/standalone.e2e.test.ts
@@ -6,7 +6,8 @@
  * and attempt localhost port probing on connect.
  */
 
-import { test, expect } from "./fixtures.js";
+import { expect } from "@playwright/test";
+import { test } from "./fixtures.js";
 
 test.describe("Standalone PWA mode", () => {
   test("page loads and shows connect prompt", async ({ page, port }) => {
@@ -101,7 +102,7 @@ test.describe("Standalone PWA mode", () => {
 
     // Now intercept all fetch requests and abort them to simulate
     // the standalone PWA scenario where there's no backend.
-    await page.route("**/api/**", (route) => route.abort());
+    await page.route("**/api/**", async (route) => route.abort());
 
     // Reload — page should still render without crashing
     await page.reload();
diff --git a/src/bridges/user/web/e2e/ui-interactions.e2e.test.ts b/src/bridges/user/web/e2e/ui-interactions.e2e.test.ts
index 15e87fb..efee385 100644
--- a/src/bridges/user/web/e2e/ui-interactions.e2e.test.ts
+++ b/src/bridges/user/web/e2e/ui-interactions.e2e.test.ts
@@ -5,7 +5,8 @@
  * /leave, /rename, /dm, and agent list presence in the sidebar.
  */
 
-import { test, expect } from "./fixtures.js";
+import { expect } from "@playwright/test";
+import { test } from "./fixtures.js";
 
 let testCounter = 0;
 function uniqueName(prefix: string): string {
diff --git a/src/bridges/user/web/e2e/web-ui.e2e.test.ts b/src/bridges/user/web/e2e/web-ui.e2e.test.ts
index 1db774a..6408136 100644
--- a/src/bridges/user/web/e2e/web-ui.e2e.test.ts
+++ b/src/bridges/user/web/e2e/web-ui.e2e.test.ts
@@ -7,7 +7,8 @@
  * Each test uses a unique room name to avoid collisions.
  */
 
-import { test, expect } from "./fixtures.js";
+import { expect } from "@playwright/test";
+import { test } from "./fixtures.js";
 import WS from "ws";
 
 let testCounter = 0;
@@ -285,8 +286,8 @@ test.describe("Web UI", () => {
 
     // Connect WebSocket and collect frames
     const ws = await new Promise<WS>((resolve) => {
-      const ws = new WS(`ws://127.0.0.1:${port}`);
-      ws.on("open", () => resolve(ws));
+      const socket = new WS(`ws://127.0.0.1:${port}`);
+      socket.on("open", () => resolve(socket));
     });
 
     const frames: Record<string, unknown>[] = [];
@@ -305,7 +306,10 @@ test.describe("Web UI", () => {
     );
 
     // Wait for frames to accumulate
-    await new Promise((r) => setTimeout(r, 500));
+    const FRAME_ACCUMULATION_WAIT_MS = 500;
+    await new Promise((r) => {
+      setTimeout(r, FRAME_ACCUMULATION_WAIT_MS);
+    });
 
     const results = frames.filter(
       (f) =>
diff --git a/src/bridges/user/web/frontend/api.ts b/src/bridges/user/web/frontend/api.ts
index 8bd52e8..843828d 100644
--- a/src/bridges/user/web/frontend/api.ts
+++ b/src/bridges/user/web/frontend/api.ts
@@ -69,9 +69,10 @@ export async function fetchRoomMessages(
   roomId: string,
   since?: string,
 ): Promise<MessagesResponse> {
-  const url = since
-    ? `/api/rooms/${encodeURIComponent(roomId)}/messages?since=${encodeURIComponent(since)}`
-    : `/api/rooms/${encodeURIComponent(roomId)}/messages`;
+  const url =
+    since !== undefined
+      ? `/api/rooms/${encodeURIComponent(roomId)}/messages?since=${encodeURIComponent(since)}`
+      : `/api/rooms/${encodeURIComponent(roomId)}/messages`;
   const res = await fetch(url);
   const body: unknown = await res.json();
   if (!isMessagesResponse(body)) throw new Error("Invalid messages response");
@@ -93,6 +94,9 @@ export async function postAction(action: Action): Promise<ActionResult> {
 // WebSocket client
 // ---------------------------------------------------------------------------
 
+/** Delay before attempting to reconnect a dropped WebSocket connection. */
+const RECONNECT_DELAY_MS = 3000;
+
 export interface WsEventHandler {
   onOpen?: () => void;
   onClose?: () => void;
@@ -104,7 +108,7 @@ export class CommsWs {
   private reconnectTimer: ReturnType<typeof setTimeout> | undefined;
   private readonly handler: WsEventHandler;
 
-  constructor(handler: WsEventHandler) {
+  constructor(handler: Readonly<WsEventHandler>) {
     this.handler = handler;
   }
 
@@ -157,6 +161,6 @@ export class CommsWs {
   private scheduleReconnect(): void {
     this.reconnectTimer = setTimeout(() => {
       this.connect();
-    }, 3000);
+    }, RECONNECT_DELAY_MS);
   }
 }
diff --git a/src/bridges/user/web/frontend/components/App.tsx b/src/bridges/user/web/frontend/components/App.tsx
index bdc0f2d..f4215f1 100644
--- a/src/bridges/user/web/frontend/components/App.tsx
+++ b/src/bridges/user/web/frontend/components/App.tsx
@@ -11,11 +11,11 @@ import { ChatArea } from "./ChatArea.js";
 import { Sidebar } from "./Sidebar.js";
 
 export interface AppProps {
-  rooms: Room[];
-  agents: Agent[];
+  rooms: readonly Room[];
+  agents: readonly Agent[];
   currentRoom: string | undefined;
   dmTarget: string | undefined;
-  messages: DisplayMessage[];
+  messages: readonly DisplayMessage[];
   connected: boolean;
   onJoinRoom: (roomId: string) => void;
   onSelectAgent: (agentId: string) => void;
diff --git a/src/bridges/user/web/frontend/components/ChatArea.tsx b/src/bridges/user/web/frontend/components/ChatArea.tsx
index 61c028a..fd1373f 100644
--- a/src/bridges/user/web/frontend/components/ChatArea.tsx
+++ b/src/bridges/user/web/frontend/components/ChatArea.tsx
@@ -9,7 +9,7 @@ import { parseInput } from "../input.js";
 import { MessageList } from "./MessageList.js";
 
 interface ChatAreaProps {
-  messages: DisplayMessage[];
+  messages: readonly DisplayMessage[];
   currentRoom: string | undefined;
   dmTarget: string | undefined;
   connected: boolean;
@@ -30,7 +30,8 @@ export function ChatArea({
   const [inputText, setInputText] = useState("");
 
   const headerText =
-    currentRoom ?? (dmTarget ? `DM with ${dmTarget}` : "Select a room");
+    currentRoom ??
+    (dmTarget !== undefined ? `DM with ${dmTarget}` : "Select a room");
 
   const handleSend = () => {
     const trimmed = inputText.trim();
@@ -58,7 +59,7 @@ export function ChatArea({
     <div id="main">
       <div id="header">
         {headerText}
-        {currentRoom && (
+        {currentRoom !== undefined && (
           <button class="leave-btn" onClick={onLeaveRoom}>
             Leave
           </button>
diff --git a/src/bridges/user/web/frontend/components/MessageList.tsx b/src/bridges/user/web/frontend/components/MessageList.tsx
index 365b8ea..e84a1dc 100644
--- a/src/bridges/user/web/frontend/components/MessageList.tsx
+++ b/src/bridges/user/web/frontend/components/MessageList.tsx
@@ -6,7 +6,11 @@ import { useRef, useEffect } from "preact/hooks";
 import type { DisplayMessage } from "../types.js";
 import { Message } from "./Message.js";
 
-export function MessageList({ messages }: { messages: DisplayMessage[] }) {
+export function MessageList({
+  messages,
+}: {
+  messages: readonly DisplayMessage[];
+}) {
   const ref = useRef<HTMLDivElement>(null);
 
   useEffect(() => {
diff --git a/src/bridges/user/web/frontend/components/ProjectTree.tsx b/src/bridges/user/web/frontend/components/ProjectTree.tsx
index 7a8285c..7016d9d 100644
--- a/src/bridges/user/web/frontend/components/ProjectTree.tsx
+++ b/src/bridges/user/web/frontend/components/ProjectTree.tsx
@@ -141,7 +141,7 @@ function DirectoryView({
         <span
           class={`tree-directory-label${isCurrentRoom ? " active" : ""}${hasRoom ? " clickable" : ""}`}
           onClick={() => {
-            if (node.roomId) onJoinRoom(node.roomId);
+            if (node.roomId !== undefined) onJoinRoom(node.roomId);
           }}
         >
           {node.name}
diff --git a/src/bridges/user/web/frontend/components/Sidebar.tsx b/src/bridges/user/web/frontend/components/Sidebar.tsx
index c783a39..a7d02d3 100644
--- a/src/bridges/user/web/frontend/components/Sidebar.tsx
+++ b/src/bridges/user/web/frontend/components/Sidebar.tsx
@@ -10,8 +10,8 @@ import { JoinForm } from "./JoinForm.js";
 import { ProjectTree } from "./ProjectTree.js";
 
 interface SidebarProps {
-  rooms: Room[];
-  agents: Agent[];
+  rooms: readonly Room[];
+  agents: readonly Agent[];
   currentRoom: string | undefined;
   collapsed: boolean;
   onJoinRoom: (roomId: string) => void;
diff --git a/src/bridges/user/web/frontend/dom.ts b/src/bridges/user/web/frontend/dom.ts
index f1902a5..5a6c7bf 100644
--- a/src/bridges/user/web/frontend/dom.ts
+++ b/src/bridges/user/web/frontend/dom.ts
@@ -22,7 +22,7 @@ export function requireElement(
 ): HTMLElement {
   const el = root.querySelector<HTMLElement>(selector);
   if (!el) throw new Error(`Required element not found: ${selector}`);
-  if (tag && el.tagName.toLowerCase() !== tag) {
+  if (tag !== undefined && el.tagName.toLowerCase() !== tag) {
     throw new Error(
       `Element ${selector} must be <${tag}>, got <${el.tagName.toLowerCase()}>`,
     );
@@ -46,8 +46,11 @@ export function escapeHtml(text: string): string {
 /**
  * Format an ISO timestamp to HH:MM:SS for display.
  */
+const ISO_TIME_OF_DAY_START = 11;
+const ISO_TIME_OF_DAY_END = 19;
+
 export function formatTime(timestamp: string): string {
-  return timestamp.slice(11, 19);
+  return timestamp.slice(ISO_TIME_OF_DAY_START, ISO_TIME_OF_DAY_END);
 }
 
 /**
diff --git a/src/bridges/user/web/frontend/input.ts b/src/bridges/user/web/frontend/input.ts
index 2c434b6..727af0c 100644
--- a/src/bridges/user/web/frontend/input.ts
+++ b/src/bridges/user/web/frontend/input.ts
@@ -64,14 +64,14 @@ export function parseInput(
     return parseCommand(trimmed, currentRoom);
   }
 
-  if (currentRoom) {
+  if (currentRoom !== undefined && currentRoom !== "") {
     return {
       kind: "action",
       action: { action: "send", target: currentRoom, content: trimmed },
     };
   }
 
-  if (dmTarget) {
+  if (dmTarget !== undefined && dmTarget !== "") {
     return {
       kind: "action",
       action: { action: "dm", target: dmTarget, content: trimmed },
@@ -96,7 +96,7 @@ function parseCommand(
 
   switch (cmd) {
     case "join":
-      if (!parts[1]) {
+      if (parts[1] === undefined || parts[1] === "") {
         return {
           kind: "local",
           result: { type: "error", text: "Usage: /join <room>" },
@@ -129,7 +129,12 @@ function parseCommand(
       };
 
     case "dm":
-      if (!parts[1] || !parts[2]) {
+      if (
+        parts[1] === undefined ||
+        parts[1] === "" ||
+        parts[2] === undefined ||
+        parts[2] === ""
+      ) {
         return {
           kind: "local",
           result: {
@@ -148,7 +153,7 @@ function parseCommand(
       };
 
     case "create":
-      if (!parts[1]) {
+      if (parts[1] === undefined || parts[1] === "") {
         return {
           kind: "local",
           result: { type: "error", text: "Usage: /create <name>" },
@@ -164,7 +169,7 @@ function parseCommand(
       };
 
     case "destroy":
-      if (!parts[1]) {
+      if (parts[1] === undefined || parts[1] === "") {
         return {
           kind: "local",
           result: { type: "error", text: "Usage: /destroy <room>" },
@@ -176,7 +181,12 @@ function parseCommand(
       };
 
     case "rename":
-      if (!parts[1] || !parts[2]) {
+      if (
+        parts[1] === undefined ||
+        parts[1] === "" ||
+        parts[2] === undefined ||
+        parts[2] === ""
+      ) {
         return {
           kind: "local",
           result: {
diff --git a/src/bridges/user/web/frontend/main.tsx b/src/bridges/user/web/frontend/main.tsx
index 9ca570a..2a2a45e 100644
--- a/src/bridges/user/web/frontend/main.tsx
+++ b/src/bridges/user/web/frontend/main.tsx
@@ -106,7 +106,11 @@ function handleFrame(frame: WsFrame): void {
     case "result":
       addMessage({ type: "system", text: frame.result.content });
       if (!frame.result.isError) {
-        if (pendingAction?.action === "join_room" && !state.get().currentRoom) {
+        if (
+          pendingAction?.action === "join_room" &&
+          (state.get().currentRoom === undefined ||
+            state.get().currentRoom === "")
+        ) {
           const roomId = pendingAction.room;
           state.setDmTarget(undefined);
           state.setCurrentRoom(roomId);
@@ -165,7 +169,7 @@ function onSelectAgent(agentId: string): void {
 
 function onLeaveRoom(): void {
   const currentRoom = state.get().currentRoom;
-  if (currentRoom) {
+  if (currentRoom !== undefined && currentRoom !== "") {
     sendAction({ action: "leave_room", room: currentRoom });
     state.setCurrentRoom(undefined);
     state.clearMessages();
diff --git a/src/bridges/user/web/frontend/mesh-client.ts b/src/bridges/user/web/frontend/mesh-client.ts
index df640fd..4ef38f4 100644
--- a/src/bridges/user/web/frontend/mesh-client.ts
+++ b/src/bridges/user/web/frontend/mesh-client.ts
@@ -29,6 +29,11 @@ export interface MeshClientState {
   connected: boolean;
 }
 
+/** The web server's default port when standalone (coordinator default 19876 + 1), the base port `probeLocalMesh` starts walking up from. */
+const DEFAULT_WEB_SERVER_PORT = 19877;
+/** How many ports above `DEFAULT_WEB_SERVER_PORT` to probe before giving up, matching the server's own port-discovery walk-up range. */
+const MESH_PROBE_MAX_ATTEMPTS = 10;
+
 // ---------------------------------------------------------------------------
 // MeshClient
 // ---------------------------------------------------------------------------
@@ -45,7 +50,9 @@ export class MeshClient {
   private readonly pendingActions = new Map<
     string,
     {
-      resolve: (result: { content: string; isError: boolean }) => void;
+      resolve: (
+        result: Readonly<{ content: string; isError: boolean }>,
+      ) => void;
       reject: (error: Error) => void;
     }
   >();
@@ -73,19 +80,13 @@ export class MeshClient {
             break;
           if (!("agents" in raw.state) || !("rooms" in raw.state)) break;
           const state = raw.state;
-          // State from mesh SharedWorker is SerialisedState where agents/rooms
-          // are Record<string, T>. Object.values on object returns any[], which
-          // is the actual runtime shape.
-          // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-          const agents: AgentIdentity[] =
-            typeof state.agents === "object" && state.agents !== null
-              ? Object.values(state.agents)
-              : [];
-          // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-          const rooms: RoomLike[] =
-            typeof state.rooms === "object" && state.rooms !== null
-              ? Object.values(state.rooms)
-              : [];
+          // State from mesh SharedWorker is SerialisedState where agents/rooms are Record<string, T>. isAgentLike/isRoomLike validate at the same shallow depth as isOutboundMessage above, matching this file's "no Zod, just interfaces" convention -- filtering with a type predicate narrows Object.values' result to the declared element type without an unsafe assignment.
+          const agents: AgentIdentity[] = isRecord(state.agents)
+            ? Object.values(state.agents).filter(isAgentLike)
+            : [];
+          const rooms: RoomLike[] = isRecord(state.rooms)
+            ? Object.values(state.rooms).filter(isRoomLike)
+            : [];
           this.state = {
             ...this.state,
             agents,
@@ -132,7 +133,7 @@ export class MeshClient {
       // Standalone PWA (e.g. GitHub Pages) — probe localhost ports.
       // The web server binds at coordinatorPort + 1, walking up if taken.
       // Coordinator defaults to 19876, so web server starts at 19877.
-      this.probeLocalMesh(19877, 10);
+      this.probeLocalMesh(DEFAULT_WEB_SERVER_PORT, MESH_PROBE_MAX_ATTEMPTS);
     }
   }
 
@@ -219,3 +220,23 @@ interface OutboundMessage {
 function isOutboundMessage(value: unknown): value is OutboundMessage {
   return typeof value === "object" && value !== null && "type" in value;
 }
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isAgentLike(value: unknown): value is AgentIdentity {
+  return (
+    isRecord(value) &&
+    typeof value.id === "string" &&
+    typeof value.name === "string"
+  );
+}
+
+function isRoomLike(value: unknown): value is RoomLike {
+  return (
+    isRecord(value) &&
+    typeof value.id === "string" &&
+    typeof value.name === "string"
+  );
+}
diff --git a/src/bridges/user/web/frontend/mesh-worker.ts b/src/bridges/user/web/frontend/mesh-worker.ts
index 46f1870..5479b11 100644
--- a/src/bridges/user/web/frontend/mesh-worker.ts
+++ b/src/bridges/user/web/frontend/mesh-worker.ts
@@ -16,16 +16,16 @@
 // ---------------------------------------------------------------------------
 
 interface SharedWorkerGlobalScope {
-  addEventListener(
+  addEventListener: (
     type: "connect",
     listener: (event: MessageEvent) => void,
-  ): void;
-  close(): void;
+  ) => void;
+  close: () => void;
 }
 
 interface MessagePortLike {
-  postMessage(message: unknown): void;
-  close(): void;
+  postMessage: (message: unknown) => void;
+  close: () => void;
   onmessage: ((event: MessageEvent) => void) | null;
 }
 
@@ -207,7 +207,7 @@ function applyPatch(patch: MeshStatePatch): void {
       // Delivery events are forwarded to the main thread as patches.
       break;
     case "message_read": {
-      if (patch.room) {
+      if (patch.room !== undefined) {
         const msgs = messages.get(patch.room);
         if (msgs) {
           const msg = msgs.find((m) => m.id === patch.messageId);
@@ -275,11 +275,14 @@ function connect(url: string): void {
   };
 }
 
+/** Delay before retrying a dropped mesh WebSocket connection. */
+const RECONNECT_DELAY_MS = 3000;
+
 function scheduleReconnect(): void {
-  if (!wsUrl) return;
+  if (wsUrl === undefined) return;
   reconnectTimer = setTimeout(() => {
-    if (wsUrl) connect(wsUrl);
-  }, 3000);
+    if (wsUrl !== undefined) connect(wsUrl);
+  }, RECONNECT_DELAY_MS);
 }
 
 function handleServerMessage(raw: unknown): void {
diff --git a/src/bridges/user/web/frontend/messages.ts b/src/bridges/user/web/frontend/messages.ts
index 781896b..480fe43 100644
--- a/src/bridges/user/web/frontend/messages.ts
+++ b/src/bridges/user/web/frontend/messages.ts
@@ -81,6 +81,9 @@ export function deliveryEventToMessage(
         type: "system",
         text: `${event.oldName} is now known as ${event.newName}`,
       };
+
+    default:
+      return event satisfies never;
   }
 }
 
diff --git a/src/bridges/user/web/frontend/project-tree.ts b/src/bridges/user/web/frontend/project-tree.ts
index 3ba7d52..62e44c5 100644
--- a/src/bridges/user/web/frontend/project-tree.ts
+++ b/src/bridges/user/web/frontend/project-tree.ts
@@ -16,7 +16,11 @@ interface Branch {
   agents: Agent[];
 }
 
-function insertIntoTrie(node: Branch, segments: string[], agent: Agent): void {
+function insertIntoTrie(
+  node: Branch,
+  segments: readonly string[],
+  agent: Agent,
+): void {
   const [seg, ...rest] = segments;
   if (seg === undefined) {
     node.agents.push(agent);
@@ -31,7 +35,7 @@ function insertIntoTrie(node: Branch, segments: string[], agent: Agent): void {
 }
 
 /** Ensure a branch path exists in the trie (creates intermediate nodes). */
-function ensureBranch(node: Branch, segments: string[]): void {
+function ensureBranch(node: Branch, segments: readonly string[]): void {
   const [seg, ...rest] = segments;
   if (seg === undefined) return;
   let child = node.children.get(seg);
@@ -63,7 +67,10 @@ function projectRoomCwd(room: Room): string {
   return room.description.slice(PROJECT_ROOM_PREFIX.length);
 }
 
-export function buildProjectTree(agents: Agent[], rooms: Room[]): ProjectTree {
+export function buildProjectTree(
+  agents: readonly Agent[],
+  rooms: readonly Room[],
+): ProjectTree {
   const manualRooms = rooms.filter((r) => !isProjectRoom(r));
 
   // Index project rooms by their cwd path
@@ -120,7 +127,7 @@ function splitPath(p: string): string[] {
   return p.split("/").filter((s) => s.length > 0);
 }
 
-function joinPath(...segments: string[]): string {
+function joinPath(...segments: readonly string[]): string {
   return "/" + segments.join("/");
 }
 
@@ -128,7 +135,7 @@ function joinPath(...segments: string[]): string {
  * Find the longest common parent directory among all paths.
  * Returns "/" if there's no common prefix beyond root.
  */
-function commonPathPrefix(paths: string[]): string {
+function commonPathPrefix(paths: readonly string[]): string {
   if (paths.length === 0) return "/";
 
   const split = paths.map(splitPath);
@@ -206,7 +213,7 @@ function branchToNodesWithRooms(
   return nodes;
 }
 
-function sortChildren(nodes: TreeNode[]): TreeNode[] {
+function sortChildren(nodes: readonly TreeNode[]): TreeNode[] {
   return [...nodes].sort((a, b) => {
     // Directories first, then agents
     if (a.type !== b.type) {
diff --git a/src/bridges/user/web/frontend/state.ts b/src/bridges/user/web/frontend/state.ts
index 12ab0b1..2058d6e 100644
--- a/src/bridges/user/web/frontend/state.ts
+++ b/src/bridges/user/web/frontend/state.ts
@@ -12,9 +12,9 @@ export type StateChangeListener = (state: Readonly<ClientState>) => void;
 export interface ClientState {
   currentRoom: string | undefined;
   dmTarget: string | undefined;
-  agents: Agent[];
-  rooms: Room[];
-  messages: DisplayMessage[];
+  agents: readonly Agent[];
+  rooms: readonly Room[];
+  messages: readonly DisplayMessage[];
   connected: boolean;
 }
 
@@ -58,12 +58,12 @@ export class State {
     this.notify();
   }
 
-  setAgents(agents: Agent[]): void {
+  setAgents(agents: readonly Agent[]): void {
     this.state = { ...this.state, agents };
     this.notify();
   }
 
-  setRooms(rooms: Room[]): void {
+  setRooms(rooms: readonly Room[]): void {
     this.state = { ...this.state, rooms };
     this.notify();
   }
@@ -80,7 +80,7 @@ export class State {
   }
 
   /** Replace all messages (e.g. when loading history). */
-  setMessages(messages: DisplayMessage[]): void {
+  setMessages(messages: readonly DisplayMessage[]): void {
     this.state = { ...this.state, messages };
     this.notify();
   }
@@ -92,7 +92,7 @@ export class State {
   }
 
   /** Bulk update from a state frame (initial WS connection). */
-  applyState(agents: Agent[], rooms: Room[]): void {
+  applyState(agents: readonly Agent[], rooms: readonly Room[]): void {
     this.state = { ...this.state, agents, rooms };
     this.notify();
   }
diff --git a/src/bridges/user/web/frontend/sw.ts b/src/bridges/user/web/frontend/sw.ts
index 7b43261..fb96d6b 100644
--- a/src/bridges/user/web/frontend/sw.ts
+++ b/src/bridges/user/web/frontend/sw.ts
@@ -18,12 +18,12 @@
 // ---------------------------------------------------------------------------
 
 interface ExtendableEvent extends Event {
-  waitUntil(promise: Promise<unknown>): void;
+  waitUntil: (promise: Readonly<Promise<unknown>>) => void;
 }
 
 interface PushMessageData {
-  json(): Record<string, unknown>;
-  text(): string;
+  json: () => Record<string, unknown>;
+  text: () => string;
 }
 
 interface PushEvent extends ExtendableEvent {
@@ -39,39 +39,41 @@ interface NotificationEvent extends ExtendableEvent {
 
 interface FetchEvent extends ExtendableEvent {
   readonly request: Request;
-  respondWith(response: Promise<Response>): void;
+  respondWith: (response: Readonly<Promise<Response>>) => void;
 }
 
 interface Client {
   url: string;
-  focus(): Promise<Client>;
+  focus: () => Promise<Client>;
 }
 
 interface Clients {
-  matchAll(opts: {
-    type: "window";
-    includeUncontrolled: boolean;
-  }): Promise<Client[]>;
-  openWindow(url: string): Promise<Client>;
+  matchAll: (
+    opts: Readonly<{
+      type: "window";
+      includeUncontrolled: boolean;
+    }>,
+  ) => Promise<Client[]>;
+  openWindow: (url: string) => Promise<Client>;
 }
 
 interface CacheStorage {
-  open(name: string): Promise<Cache>;
-  delete(name: string): Promise<boolean>;
-  keys(): Promise<string[]>;
+  open: (name: string) => Promise<Cache>;
+  delete: (name: string) => Promise<boolean>;
+  keys: () => Promise<string[]>;
 }
 
 interface Cache {
-  addAll(requests: string[]): Promise<void>;
-  match(request: Request): Promise<Response | undefined>;
-  put(request: Request, response: Response): Promise<void>;
+  addAll: (requests: readonly string[]) => Promise<void>;
+  match: (request: Request) => Promise<Response | undefined>;
+  put: (request: Request, response: Response) => Promise<void>;
 }
 
 interface ServiceWorkerRegistration {
-  showNotification(
+  showNotification: (
     title: string,
     options?: NotificationOptions & { data?: Record<string, unknown> },
-  ): Promise<void>;
+  ) => Promise<void>;
 }
 
 interface ServiceWorkerGlobalScope {
@@ -79,17 +81,20 @@ interface ServiceWorkerGlobalScope {
   registration: ServiceWorkerRegistration;
   clients: Clients;
   caches: CacheStorage;
-  addEventListener(type: "push", listener: (event: PushEvent) => void): void;
-  addEventListener(
-    type: "notificationclick",
-    listener: (event: NotificationEvent) => void,
-  ): void;
-  addEventListener(
-    type: "install" | "activate",
-    listener: (event: ExtendableEvent) => void,
-  ): void;
-  addEventListener(type: "fetch", listener: (event: FetchEvent) => void): void;
-  skipWaiting(): Promise<void>;
+  addEventListener: ((
+    type: "push",
+    listener: (event: PushEvent) => void,
+  ) => void) &
+    ((
+      type: "notificationclick",
+      listener: (event: NotificationEvent) => void,
+    ) => void) &
+    ((
+      type: "install" | "activate",
+      listener: (event: ExtendableEvent) => void,
+    ) => void) &
+    ((type: "fetch", listener: (event: FetchEvent) => void) => void);
+  skipWaiting: () => Promise<void>;
 }
 
 declare const self: ServiceWorkerGlobalScope;
@@ -118,8 +123,8 @@ self.addEventListener("install", (event: ExtendableEvent) => {
   event.waitUntil(
     self.caches
       .open(CACHE_NAME)
-      .then((cache) => cache.addAll(APP_SHELL))
-      .then(() => self.skipWaiting()),
+      .then(async (cache) => cache.addAll(APP_SHELL))
+      .then(async () => self.skipWaiting()),
   );
 });
 
@@ -131,11 +136,11 @@ self.addEventListener("activate", (event: ExtendableEvent) => {
   event.waitUntil(
     self.caches
       .keys()
-      .then((names) =>
+      .then(async (names) =>
         Promise.all(
           names
             .filter((name) => name !== CACHE_NAME)
-            .map((name) => self.caches.delete(name)),
+            .map(async (name) => self.caches.delete(name)),
         ),
       ),
   );
@@ -145,6 +150,24 @@ self.addEventListener("activate", (event: ExtendableEvent) => {
 // Fetch — network-first for API, cache-first for everything else
 // ---------------------------------------------------------------------------
 
+/** Lower bound (inclusive) of the HTTP success status range worth caching. */
+const HTTP_STATUS_OK_MIN = 200;
+
+/** Upper bound (exclusive) of the HTTP success status range worth caching. */
+const HTTP_STATUS_OK_MAX_EXCLUSIVE = 300;
+
+/** True for a GET response whose status falls in the cacheable success range. */
+function isCacheableGetResponse(
+  request: Readonly<Request>,
+  response: Readonly<Response>,
+): boolean {
+  return (
+    request.method === "GET" &&
+    response.status >= HTTP_STATUS_OK_MIN &&
+    response.status < HTTP_STATUS_OK_MAX_EXCLUSIVE
+  );
+}
+
 self.addEventListener("fetch", (event: FetchEvent) => {
   const url = new URL(event.request.url);
 
@@ -154,22 +177,18 @@ self.addEventListener("fetch", (event: FetchEvent) => {
       fetch(event.request)
         .then((response) => {
           // Only cache successful GET responses
-          if (
-            event.request.method === "GET" &&
-            response.status >= 200 &&
-            response.status < 300
-          ) {
+          if (isCacheableGetResponse(event.request, response)) {
             const cloned = response.clone();
             void self.caches
               .open(CACHE_NAME)
-              .then((cache) => cache.put(event.request, cloned));
+              .then(async (cache) => cache.put(event.request, cloned));
           }
           return response;
         })
-        .catch(() =>
+        .catch(async () =>
           self.caches
             .open(CACHE_NAME)
-            .then((cache) => cache.match(event.request))
+            .then(async (cache) => cache.match(event.request))
             .then(
               (cached) => cached ?? new Response("Offline", { status: 503 }),
             ),
@@ -182,20 +201,16 @@ self.addEventListener("fetch", (event: FetchEvent) => {
   event.respondWith(
     self.caches
       .open(CACHE_NAME)
-      .then((cache) => cache.match(event.request))
-      .then((cached) => {
+      .then(async (cache) => cache.match(event.request))
+      .then(async (cached) => {
         if (cached) return cached;
         return fetch(event.request).then((response) => {
           // Cache successful GET responses for future offline use
-          if (
-            event.request.method === "GET" &&
-            response.status >= 200 &&
-            response.status < 300
-          ) {
+          if (isCacheableGetResponse(event.request, response)) {
             const cloned = response.clone();
             void self.caches
               .open(CACHE_NAME)
-              .then((cache) => cache.put(event.request, cloned));
+              .then(async (cache) => cache.put(event.request, cloned));
           }
           return response;
         });
@@ -251,7 +266,7 @@ self.addEventListener("notificationclick", (event: NotificationEvent) => {
   event.waitUntil(
     self.clients
       .matchAll({ type: "window", includeUncontrolled: true })
-      .then((clientList: Client[]) => {
+      .then(async (clientList: readonly Client[]) => {
         for (const client of clientList) {
           if (client.url === targetUrl && "focus" in client) {
             return client.focus();
diff --git a/src/bridges/user/web/frontend/test/create-room.unit.test.tsx b/src/bridges/user/web/frontend/test/create-room.unit.test.tsx
index 6400c9a..a7f982d 100644
--- a/src/bridges/user/web/frontend/test/create-room.unit.test.tsx
+++ b/src/bridges/user/web/frontend/test/create-room.unit.test.tsx
@@ -7,6 +7,9 @@ import { render as preactRender } from "preact";
 import { Window } from "happy-dom";
 import { CreateRoomForm } from "../components/CreateRoomForm.js";
 
+/** Number of room-type `<option>`s the form renders: public, private, secret. */
+const ROOM_TYPE_OPTION_COUNT = 3;
+
 let windowRef: Window | undefined;
 
 function setup(): { container: HTMLElement; cleanup: () => void } {
@@ -85,7 +88,7 @@ describe("CreateRoomForm", () => {
       );
 
       const options = container.querySelectorAll("select option");
-      expect(options.length).toBe(3);
+      expect(options.length).toBe(ROOM_TYPE_OPTION_COUNT);
       expect(options[0].getAttribute("value")).toBe("public");
       expect(options[1].getAttribute("value")).toBe("private");
       expect(options[2].getAttribute("value")).toBe("secret");
diff --git a/src/bridges/user/web/frontend/test/messages.unit.test.ts b/src/bridges/user/web/frontend/test/messages.unit.test.ts
index 27a5029..e0cff67 100644
--- a/src/bridges/user/web/frontend/test/messages.unit.test.ts
+++ b/src/bridges/user/web/frontend/test/messages.unit.test.ts
@@ -187,7 +187,9 @@ describe("deliveryEventToMessage", () => {
       const result = deliveryEventToMessage(event, undefined);
       expect(result?.type).toBe("system");
       expect(result?.text?.includes("Alice")).toBeTruthy();
-      expect(!result?.text?.includes(" — ")).toBeTruthy();
+      expect(
+        result?.type === "system" && !result.text.includes(" — "),
+      ).toBeTruthy();
     });
   });
 
diff --git a/src/bridges/user/web/frontend/test/project-tree.unit.test.tsx b/src/bridges/user/web/frontend/test/project-tree.unit.test.tsx
index c148fbc..c94e79c 100644
--- a/src/bridges/user/web/frontend/test/project-tree.unit.test.tsx
+++ b/src/bridges/user/web/frontend/test/project-tree.unit.test.tsx
@@ -21,6 +21,8 @@ function makeAgent(overrides: Partial<Agent> & { id: string }): Agent {
   };
 }
 
+const EXPECTED_DIRECTORY_AND_AGENT_CHILD_COUNT = 4;
+
 function makeRoom(overrides: Partial<Room> & { id: string }): Room {
   return {
     id: overrides.id,
@@ -155,8 +157,8 @@ describe("buildProjectTree", () => {
     expect(dev?.type).toBe("directory");
     if (dev?.type !== "directory") return;
 
-    // 2 directories + 2 agents = 4 children
-    expect(dev.children.length).toBe(4);
+    // 2 directories + 2 agents
+    expect(dev.children.length).toBe(EXPECTED_DIRECTORY_AND_AGENT_CHILD_COUNT);
 
     // First two should be directories, sorted alphabetically
     expect(dev.children[0]?.type).toBe("directory");
diff --git a/src/bridges/user/web/frontend/test/render.unit.test.tsx b/src/bridges/user/web/frontend/test/render.unit.test.tsx
index c714dc3..dba56aa 100644
--- a/src/bridges/user/web/frontend/test/render.unit.test.tsx
+++ b/src/bridges/user/web/frontend/test/render.unit.test.tsx
@@ -130,6 +130,8 @@ describe("Message component", () => {
   });
 });
 
+const MOCK_MESSAGE_COUNT = 3;
+
 describe("MessageList component", () => {
   it("renders multiple messages", () => {
     const { container, cleanup } = setup();
@@ -139,7 +141,7 @@ describe("MessageList component", () => {
         container,
       );
       const msgs = container.querySelectorAll(".msg");
-      expect(msgs.length).toBe(3);
+      expect(msgs.length).toBe(MOCK_MESSAGE_COUNT);
     } finally {
       cleanup();
     }
diff --git a/src/bridges/user/web/frontend/test/sidebar.component.test.tsx b/src/bridges/user/web/frontend/test/sidebar.component.test.tsx
index 4a3e359..36e0002 100644
--- a/src/bridges/user/web/frontend/test/sidebar.component.test.tsx
+++ b/src/bridges/user/web/frontend/test/sidebar.component.test.tsx
@@ -243,7 +243,9 @@ describe("Sidebar interactions", () => {
         />,
         container,
       );
-      expect(container.querySelectorAll(".room-item").length).toBe(3);
+      expect(container.querySelectorAll(".room-item").length).toBe(
+        rooms.length,
+      );
     } finally {
       cleanup();
     }
diff --git a/src/bridges/user/web/frontend/test/state.unit.test.tsx b/src/bridges/user/web/frontend/test/state.unit.test.tsx
index 96d0058..6e78ca2 100644
--- a/src/bridges/user/web/frontend/test/state.unit.test.tsx
+++ b/src/bridges/user/web/frontend/test/state.unit.test.tsx
@@ -44,7 +44,9 @@ describe("state", () => {
   it("sets current room and notifies", () => {
     const state = new State();
     const notified: ReturnType<State["get"]>[] = [];
-    state.subscribe((s) => notified.push(s));
+    state.subscribe((s) => {
+      notified.push(s);
+    });
 
     state.setCurrentRoom("room-1");
     expect(state.get().currentRoom).toBe("room-1");
@@ -73,7 +75,9 @@ describe("state", () => {
   it("applyState sets agents and rooms atomically", () => {
     const state = new State();
     const notified = Array<boolean>();
-    state.subscribe(() => notified.push(true));
+    state.subscribe(() => {
+      notified.push(true);
+    });
 
     state.applyState([MOCK_AGENT], [MOCK_ROOM]);
     expect(state.get().agents).toEqual([MOCK_AGENT]);
@@ -84,7 +88,9 @@ describe("state", () => {
   it("sets dmTarget and notifies", () => {
     const state = new State();
     const notified: ReturnType<State["get"]>[] = [];
-    state.subscribe((s) => notified.push(s));
+    state.subscribe((s) => {
+      notified.push(s);
+    });
 
     state.setDmTarget("agent-42");
     expect(state.get().dmTarget).toBe("agent-42");
@@ -95,7 +101,9 @@ describe("state", () => {
   it("sets dmTarget and notifies", () => {
     const state = new State();
     const notified: ReturnType<State["get"]>[] = [];
-    state.subscribe((s) => notified.push(s));
+    state.subscribe((s) => {
+      notified.push(s);
+    });
 
     state.setDmTarget("agent-42");
     expect(state.get().dmTarget).toBe("agent-42");
diff --git a/src/bridges/user/web/frontend/url-sync.ts b/src/bridges/user/web/frontend/url-sync.ts
index 20254b7..d85029f 100644
--- a/src/bridges/user/web/frontend/url-sync.ts
+++ b/src/bridges/user/web/frontend/url-sync.ts
@@ -44,13 +44,13 @@ export function parseDeepLink(search: string): DeepLink | undefined {
   const params = new URLSearchParams(search);
 
   const room = params.get("room");
-  if (room) return { kind: "room", roomId: room };
+  if (room !== null && room !== "") return { kind: "room", roomId: room };
 
   const dm = params.get("dm");
-  if (dm) return { kind: "dm", agentId: dm };
+  if (dm !== null && dm !== "") return { kind: "dm", agentId: dm };
 
   const cwd = params.get("cwd");
-  if (cwd) return { kind: "cwd", path: cwd };
+  if (cwd !== null && cwd !== "") return { kind: "cwd", path: cwd };
 
   return undefined;
 }
@@ -73,7 +73,7 @@ export interface ResolvedNav {
  */
 export function resolveDeepLink(
   link: DeepLink,
-  rooms: Room[],
+  rooms: readonly Room[],
 ): ResolvedNav | undefined {
   switch (link.kind) {
     case "room":
@@ -94,6 +94,9 @@ export function resolveDeepLink(
       }
       return undefined;
     }
+
+    default:
+      return link satisfies never;
   }
 }
 
@@ -101,10 +104,12 @@ export function resolveDeepLink(
 // URL sync — keep the address bar reflecting the current view
 // ---------------------------------------------------------------------------
 
-export function syncUrl(params: {
-  currentRoom: string | undefined;
-  dmTarget: string | undefined;
-}): void {
+export function syncUrl(
+  params: Readonly<{
+    currentRoom: string | undefined;
+    dmTarget: string | undefined;
+  }>,
+): void {
   const url = new URL(location.href);
 
   // Clear previous nav params
@@ -112,9 +117,9 @@ export function syncUrl(params: {
   url.searchParams.delete("dm");
   url.searchParams.delete("cwd");
 
-  if (params.currentRoom) {
+  if (params.currentRoom !== undefined && params.currentRoom !== "") {
     url.searchParams.set("room", params.currentRoom);
-  } else if (params.dmTarget) {
+  } else if (params.dmTarget !== undefined && params.dmTarget !== "") {
     url.searchParams.set("dm", params.dmTarget);
   }
 
diff --git a/src/bridges/user/web/generated-html.ts b/src/bridges/user/web/generated-html.ts
index e8b9861..090f533 100644
--- a/src/bridges/user/web/generated-html.ts
+++ b/src/bridges/user/web/generated-html.ts
@@ -171,7 +171,7 @@ body {
   color: var(--dim);
   font-size: 14px;
 }
-\`}));function q(e){return typeof e=="object"&&e!==null}function K(e){return Array.isArray(e)}function J(e){return Array.isArray(e)}function B(e){return Array.isArray(e)}function G(e){return q(e)&&typeof e.type=="string"}async function M(){let n=await(await fetch("/api/agents")).json();if(!K(n))throw new Error("Invalid agents response");return n}async function A(){let n=await(await fetch("/api/rooms")).json();if(!J(n))throw new Error("Invalid rooms response");return n}async function C(e,n){let t=n?\`/api/rooms/\${encodeURIComponent(e)}/messages?since=\${encodeURIComponent(n)}\`:\`/api/rooms/\${encodeURIComponent(e)}/messages\`,s=await(await fetch(t)).json();if(!B(s))throw new Error("Invalid messages response");return s}var f=class{constructor(n){m(this,"ws");m(this,"reconnectTimer");m(this,"handler");this.handler=n}connect(){let n=location.protocol==="https:"?"wss:":"ws:",t=new WebSocket(\`\${n}//\${location.host}\`);this.ws=t,t.onopen=()=>{this.handler.onOpen?.()},t.onclose=()=>{this.handler.onClose?.(),this.scheduleReconnect()},t.onerror=()=>{},t.onmessage=o=>{let s=JSON.parse(typeof o.data=="string"?o.data:String(o.data));G(s)&&this.handler.onFrame?.(s)}}sendAction(n){let t=this.ws;t?.readyState===WebSocket.OPEN&&t.send(JSON.stringify(n))}disconnect(){this.reconnectTimer!==void 0&&(clearTimeout(this.reconnectTimer),this.reconnectTimer=void 0);let n=this.ws;n&&n.close(),this.ws=void 0}scheduleReconnect(){this.reconnectTimer=setTimeout(()=>{this.connect()},3e3)}};function l(e,n,t){let o=e.querySelector(n);if(!o)throw new Error(\`Required element not found: \${n}\`);if(t&&o.tagName.toLowerCase()!==t)throw new Error(\`Element \${n} must be <\${t}>, got <\${o.tagName.toLowerCase()}>\`);return o}function p(e,n){let t=e.createElement("div");return t.textContent=n,t.innerHTML}function \$(e,n,t,...o){let s=e.createElement(n);if(t)for(let[r,a]of Object.entries(t))s.setAttribute(r,a);for(let r of o)typeof r=="string"?s.appendChild(e.createTextNode(r)):s.appendChild(r);return s}function h(e){e.innerHTML=""}function k(e){return e.slice(11,19)}function L(e,n,t){let o=e.trim();return o.length===0?{kind:"ignored"}:o.startsWith("/")?Q(o,n):n?{kind:"action",action:{action:"send",target:n,content:o}}:t?{kind:"action",action:{action:"dm",target:t,content:o}}:{kind:"local",result:{type:"error",text:"Join a room or select an agent first"}}}function Q(e,n){let t=e.slice(1).split(/\\s+/),o=(t[0]??"").toLowerCase();switch(o){case"join":return t[1]?{kind:"action",action:{action:"join_room",room:t[1]}}:{kind:"local",result:{type:"error",text:"Usage: /join <room>"}};case"leave":return{kind:"action",action:{action:"leave_room",room:t[1]??n??""}};case"rooms":return{kind:"action",action:{action:"list_rooms"}};case"agents":return{kind:"action",action:{action:"list_agents"}};case"dm":return!t[1]||!t[2]?{kind:"local",result:{type:"error",text:"Usage: /dm <agent> <message>"}}:{kind:"action",action:{action:"dm",target:t[1],content:t.slice(2).join(" ")}};case"create":return t[1]?{kind:"action",action:{action:"create_room",name:t[1],type:"public"}}:{kind:"local",result:{type:"error",text:"Usage: /create <name>"}};case"destroy":return t[1]?{kind:"action",action:{action:"destroy_room",room:t[1]}}:{kind:"local",result:{type:"error",text:"Usage: /destroy <room>"}};case"help":return{kind:"local",result:{type:"help",text:"Commands: /join, /leave, /rooms, /agents, /dm, /create, /destroy, /help"}};default:return{kind:"local",result:{type:"unknown",text:\`Unknown command: /\${o}\`}}}}function S(e,n,t,o,s){let r=k(s),a=e.createElement("div");a.className="msg",a.innerHTML=\`<span class="sender">\${p(e,t)}</span><span class="time">\${r}</span>: \${p(e,o)}\`,n.messagesEl.appendChild(a),n.messagesEl.scrollTop=n.messagesEl.scrollHeight}function V(e,n,t,o,s){let r=k(s),a=e.createElement("div");a.className="msg dm",a.innerHTML=\`<span class="dm-badge">DM</span> <span class="sender">\${p(e,t)}</span><span class="time">\${r}</span>: \${p(e,o)}\`,n.messagesEl.appendChild(a),n.messagesEl.scrollTop=n.messagesEl.scrollHeight}function c(e,n,t){let o=e.createElement("div");o.className="msg system",o.textContent=t,n.messagesEl.appendChild(o),n.messagesEl.scrollTop=n.messagesEl.scrollHeight}function y(e,n,t){let o=e.createElement("div");o.className="msg status",o.textContent=t,n.messagesEl.appendChild(o),n.messagesEl.scrollTop=n.messagesEl.scrollHeight}function w(e){h(e.messagesEl)}function H(e,n,t,o){switch(t.type){case"room_message":o===t.message.room&&S(e,n,t.message.from,t.message.content,t.message.timestamp);break;case"dm":V(e,n,t.message.from,t.message.content,t.message.timestamp);break;case"member_joined":c(e,n,\`\${t.agent} joined \${t.room}\`);break;case"member_left":c(e,n,\`\${t.agent} left \${t.room}\`);break;case"member_status":y(e,n,\`\${t.agent} is now \${t.status} in \${t.room}\`);break;case"delivery_status":y(e,n,\`Message \${t.messageId} \${t.status} by \${t.agent}\`);break;case"room_members":if(o===t.room){let s=t.members.map(r=>\`\${r.name} (\${r.status})\`).join(", ");c(e,n,\`Members: \${s}\`)}break;case"room_invite":{let s=t.roomDescription?\` \\u2014 \${t.roomDescription}\`:"";c(e,n,\`\${t.fromName} invited you to "\${t.room}"\${s}\`);break}case"invite_declined":c(e,n,\`\${t.agentName} declined invite to \${t.room}: "\${t.reason}"\`);break}}function N(e,n,t,o,s){h(n.roomListEl);for(let r of t){let a=o===r.id,E=r.type.charAt(0).toUpperCase(),F=r.members.length,g=e.createElement("div");g.className=\`room-item\${a?" active":""}\`,g.innerHTML=\`\${E} \${p(e,r.name)} <span style="color:var(--dim)">(\${String(F)})</span>\`,g.onclick=()=>{s(r.id)},n.roomListEl.appendChild(g)}}function j(e,n,t,o){h(n.agentListEl);for(let s of t){let r=e.createElement("div");r.className="agent-item";let a=\$(e,"span",{class:\`status-dot \${s.status}\`}),E=e.createTextNode(\` \${s.name}\`);r.appendChild(a),r.appendChild(E),o&&(r.onclick=()=>{o(s.id)}),n.agentListEl.appendChild(r)}}function x(e,n){e.headerEl.textContent=n}function D(e,n,t){for(let o of t)S(e,n,o.from,o.content,o.timestamp)}var _={currentRoom:void 0,dmTarget:void 0,agents:[],rooms:[],connected:!1},b=class{constructor(){m(this,"state",{..._});m(this,"listeners",new Set)}subscribe(n){return this.listeners.add(n),()=>{this.listeners.delete(n)}}get(){return this.state}setCurrentRoom(n){this.state={...this.state,currentRoom:n},this.notify()}setDmTarget(n){this.state={...this.state,dmTarget:n},this.notify()}setAgents(n){this.state={...this.state,agents:n},this.notify()}setRooms(n){this.state={...this.state,rooms:n},this.notify()}setConnected(n){this.state={...this.state,connected:n},this.notify()}applyState(n,t){this.state={...this.state,agents:n,rooms:t},this.notify()}reset(){this.state={..._},this.notify()}notify(){let n=this.state;for(let t of this.listeners)t(n)}};var X=l(document,"#messages"),u=l(document,"#input","input"),R=l(document,"#header"),Y=l(document,"#room-list"),Z=l(document,"#agent-list"),d={messagesEl:X},I={roomListEl:Y,agentListEl:Z},i=new b;i.subscribe(e=>{N(document,I,e.rooms,e.currentRoom,ne),j(document,I,e.agents,te)});var P=new f({onOpen:()=>{i.setConnected(!0),c(document,d,"Connected to mesh")},onClose:()=>{i.setConnected(!1),c(document,d,"Disconnected \\u2014 reconnecting...")},onFrame:ee});function ee(e){switch(e.type){case"delivery":H(document,d,e.event,i.get().currentRoom),(e.event.type==="member_joined"||e.event.type==="member_left"||e.event.type==="member_status")&&T();break;case"result":if(c(document,d,e.result.content),!e.result.isError){if(v?.action==="join_room"&&!i.get().currentRoom){let n=v.room;i.setDmTarget(void 0),i.setCurrentRoom(n),x({headerEl:R},n)}T()}v=void 0;break;case"error":y(document,d,\`Error: \${e.message}\`);break;case"state":i.applyState(e.agents,e.rooms);break}}var v;function W(e){v=e,P.sendAction(e)}async function T(){let[e,n]=await Promise.all([M(),A()]);i.setAgents(e),i.setRooms(n)}async function ne(e){i.setDmTarget(void 0),i.setCurrentRoom(e),x({headerEl:R},e),w(d),W({action:"join_room",room:e});let n=await C(e);D(document,d,n),c(document,d,\`Joined \${e}\`),u.focus()}function te(e){i.setCurrentRoom(void 0),i.setDmTarget(e),w(d),x({headerEl:R},\`DM with \${e}\`),u.focus()}function z(){let e=u.value;u.value="";let n=L(e,i.get().currentRoom,i.get().dmTarget);switch(n.kind){case"action":W(n.action);break;case"local":c(document,d,n.result.text);break;case"ignored":break}}var oe=l(document,"#send-btn");oe.onclick=z;u.addEventListener("keydown",e=>{e.key==="Enter"&&z()});P.connect();T();u.focus();})();
+\`}));function q(e){return typeof e=="object"&&e!==null}function K(e){return Array.isArray(e)}function J(e){return Array.isArray(e)}function B(e){return Array.isArray(e)}function G(e){return q(e)&&typeof e.type=="string"}async function M(){let n=await(await fetch("/api/agents")).json();if(!K(n))throw new Error("Invalid agents response");return n}async function A(){let n=await(await fetch("/api/rooms")).json();if(!J(n))throw new Error("Invalid rooms response");return n}async function C(e,n){let t=n?\`/api/rooms/\${encodeURIComponent(e)}/messages?since=\${encodeURIComponent(n)}\`:\`/api/rooms/\${encodeURIComponent(e)}/messages\`,s=await(await fetch(t)).json();if(!B(s))throw new Error("Invalid messages response");return s}var f=class{constructor(n){m(this,"ws");m(this,"reconnectTimer");m(this,"handler");this.handler=n}connect(){let n=location.protocol==="https:"?"wss:":"ws:",t=new WebSocket(\`\${n}//\${location.host}\`);this.ws=t,t.onopen=()=>{this.handler.onOpen?.()},t.onclose=()=>{this.handler.onClose?.(),this.scheduleReconnect()},t.onerror=()=>{},t.onmessage=o=>{let s=JSON.parse(typeof o.data=="string"?o.data:String(o.data));G(s)&&this.handler.onFrame?.(s)}}sendAction(n){let t=this.ws;t?.readyState===WebSocket.OPEN&&t.send(JSON.stringify(n))}disconnect(){this.reconnectTimer!==void 0&&(clearTimeout(this.reconnectTimer),this.reconnectTimer=void 0);let n=this.ws;n&&n.close(),this.ws=void 0}scheduleReconnect(){this.reconnectTimer=setTimeout(()=>{this.connect()},3e3)}};function l(e,n,t){let o=e.querySelector(n);if(!o)throw new Error(\`Required element not found: \${n}\`);if(t&&o.tagName.toLowerCase()!==t)throw new Error(\`Element \${n} must be <\${t}>, got <\${o.tagName.toLowerCase()}>\`);return o}function p(e,n){let t=e.createElement("div");return t.textContent=n,t.innerHTML}function $(e,n,t,...o){let s=e.createElement(n);if(t)for(let[r,a]of Object.entries(t))s.setAttribute(r,a);for(let r of o)typeof r=="string"?s.appendChild(e.createTextNode(r)):s.appendChild(r);return s}function h(e){e.innerHTML=""}function k(e){return e.slice(11,19)}function L(e,n,t){let o=e.trim();return o.length===0?{kind:"ignored"}:o.startsWith("/")?Q(o,n):n?{kind:"action",action:{action:"send",target:n,content:o}}:t?{kind:"action",action:{action:"dm",target:t,content:o}}:{kind:"local",result:{type:"error",text:"Join a room or select an agent first"}}}function Q(e,n){let t=e.slice(1).split(/\\s+/),o=(t[0]??"").toLowerCase();switch(o){case"join":return t[1]?{kind:"action",action:{action:"join_room",room:t[1]}}:{kind:"local",result:{type:"error",text:"Usage: /join <room>"}};case"leave":return{kind:"action",action:{action:"leave_room",room:t[1]??n??""}};case"rooms":return{kind:"action",action:{action:"list_rooms"}};case"agents":return{kind:"action",action:{action:"list_agents"}};case"dm":return!t[1]||!t[2]?{kind:"local",result:{type:"error",text:"Usage: /dm <agent> <message>"}}:{kind:"action",action:{action:"dm",target:t[1],content:t.slice(2).join(" ")}};case"create":return t[1]?{kind:"action",action:{action:"create_room",name:t[1],type:"public"}}:{kind:"local",result:{type:"error",text:"Usage: /create <name>"}};case"destroy":return t[1]?{kind:"action",action:{action:"destroy_room",room:t[1]}}:{kind:"local",result:{type:"error",text:"Usage: /destroy <room>"}};case"help":return{kind:"local",result:{type:"help",text:"Commands: /join, /leave, /rooms, /agents, /dm, /create, /destroy, /help"}};default:return{kind:"local",result:{type:"unknown",text:\`Unknown command: /\${o}\`}}}}function S(e,n,t,o,s){let r=k(s),a=e.createElement("div");a.className="msg",a.innerHTML=\`<span class="sender">\${p(e,t)}</span><span class="time">\${r}</span>: \${p(e,o)}\`,n.messagesEl.appendChild(a),n.messagesEl.scrollTop=n.messagesEl.scrollHeight}function V(e,n,t,o,s){let r=k(s),a=e.createElement("div");a.className="msg dm",a.innerHTML=\`<span class="dm-badge">DM</span> <span class="sender">\${p(e,t)}</span><span class="time">\${r}</span>: \${p(e,o)}\`,n.messagesEl.appendChild(a),n.messagesEl.scrollTop=n.messagesEl.scrollHeight}function c(e,n,t){let o=e.createElement("div");o.className="msg system",o.textContent=t,n.messagesEl.appendChild(o),n.messagesEl.scrollTop=n.messagesEl.scrollHeight}function y(e,n,t){let o=e.createElement("div");o.className="msg status",o.textContent=t,n.messagesEl.appendChild(o),n.messagesEl.scrollTop=n.messagesEl.scrollHeight}function w(e){h(e.messagesEl)}function H(e,n,t,o){switch(t.type){case"room_message":o===t.message.room&&S(e,n,t.message.from,t.message.content,t.message.timestamp);break;case"dm":V(e,n,t.message.from,t.message.content,t.message.timestamp);break;case"member_joined":c(e,n,\`\${t.agent} joined \${t.room}\`);break;case"member_left":c(e,n,\`\${t.agent} left \${t.room}\`);break;case"member_status":y(e,n,\`\${t.agent} is now \${t.status} in \${t.room}\`);break;case"delivery_status":y(e,n,\`Message \${t.messageId} \${t.status} by \${t.agent}\`);break;case"room_members":if(o===t.room){let s=t.members.map(r=>\`\${r.name} (\${r.status})\`).join(", ");c(e,n,\`Members: \${s}\`)}break;case"room_invite":{let s=t.roomDescription?\` \\u2014 \${t.roomDescription}\`:"";c(e,n,\`\${t.fromName} invited you to "\${t.room}"\${s}\`);break}case"invite_declined":c(e,n,\`\${t.agentName} declined invite to \${t.room}: "\${t.reason}"\`);break}}function N(e,n,t,o,s){h(n.roomListEl);for(let r of t){let a=o===r.id,E=r.type.charAt(0).toUpperCase(),F=r.members.length,g=e.createElement("div");g.className=\`room-item\${a?" active":""}\`,g.innerHTML=\`\${E} \${p(e,r.name)} <span style="color:var(--dim)">(\${String(F)})</span>\`,g.onclick=()=>{s(r.id)},n.roomListEl.appendChild(g)}}function j(e,n,t,o){h(n.agentListEl);for(let s of t){let r=e.createElement("div");r.className="agent-item";let a=$(e,"span",{class:\`status-dot \${s.status}\`}),E=e.createTextNode(\` \${s.name}\`);r.appendChild(a),r.appendChild(E),o&&(r.onclick=()=>{o(s.id)}),n.agentListEl.appendChild(r)}}function x(e,n){e.headerEl.textContent=n}function D(e,n,t){for(let o of t)S(e,n,o.from,o.content,o.timestamp)}var _={currentRoom:void 0,dmTarget:void 0,agents:[],rooms:[],connected:!1},b=class{constructor(){m(this,"state",{..._});m(this,"listeners",new Set)}subscribe(n){return this.listeners.add(n),()=>{this.listeners.delete(n)}}get(){return this.state}setCurrentRoom(n){this.state={...this.state,currentRoom:n},this.notify()}setDmTarget(n){this.state={...this.state,dmTarget:n},this.notify()}setAgents(n){this.state={...this.state,agents:n},this.notify()}setRooms(n){this.state={...this.state,rooms:n},this.notify()}setConnected(n){this.state={...this.state,connected:n},this.notify()}applyState(n,t){this.state={...this.state,agents:n,rooms:t},this.notify()}reset(){this.state={..._},this.notify()}notify(){let n=this.state;for(let t of this.listeners)t(n)}};var X=l(document,"#messages"),u=l(document,"#input","input"),R=l(document,"#header"),Y=l(document,"#room-list"),Z=l(document,"#agent-list"),d={messagesEl:X},I={roomListEl:Y,agentListEl:Z},i=new b;i.subscribe(e=>{N(document,I,e.rooms,e.currentRoom,ne),j(document,I,e.agents,te)});var P=new f({onOpen:()=>{i.setConnected(!0),c(document,d,"Connected to mesh")},onClose:()=>{i.setConnected(!1),c(document,d,"Disconnected \\u2014 reconnecting...")},onFrame:ee});function ee(e){switch(e.type){case"delivery":H(document,d,e.event,i.get().currentRoom),(e.event.type==="member_joined"||e.event.type==="member_left"||e.event.type==="member_status")&&T();break;case"result":if(c(document,d,e.result.content),!e.result.isError){if(v?.action==="join_room"&&!i.get().currentRoom){let n=v.room;i.setDmTarget(void 0),i.setCurrentRoom(n),x({headerEl:R},n)}T()}v=void 0;break;case"error":y(document,d,\`Error: \${e.message}\`);break;case"state":i.applyState(e.agents,e.rooms);break}}var v;function W(e){v=e,P.sendAction(e)}async function T(){let[e,n]=await Promise.all([M(),A()]);i.setAgents(e),i.setRooms(n)}async function ne(e){i.setDmTarget(void 0),i.setCurrentRoom(e),x({headerEl:R},e),w(d),W({action:"join_room",room:e});let n=await C(e);D(document,d,n),c(document,d,\`Joined \${e}\`),u.focus()}function te(e){i.setCurrentRoom(void 0),i.setDmTarget(e),w(d),x({headerEl:R},\`DM with \${e}\`),u.focus()}function z(){let e=u.value;u.value="";let n=L(e,i.get().currentRoom,i.get().dmTarget);switch(n.kind){case"action":W(n.action);break;case"local":c(document,d,n.result.text);break;case"ignored":break}}var oe=l(document,"#send-btn");oe.onclick=z;u.addEventListener("keydown",e=>{e.key==="Enter"&&z()});P.connect();T();u.focus();})();
 
   </script>
 </body>
diff --git a/src/bridges/user/web/port-discovery.ts b/src/bridges/user/web/port-discovery.ts
index c5cd37b..3ef5bfd 100644
--- a/src/bridges/user/web/port-discovery.ts
+++ b/src/bridges/user/web/port-discovery.ts
@@ -16,7 +16,7 @@ export const DEFAULT_MAX_ATTEMPTS = 10;
  * Try binding sequentially from `base`.
  * Returns the first port that succeeds, or undefined if all are taken.
  */
-export function findFreePort(
+export async function findFreePort(
   base: number,
   maxAttempts: number = DEFAULT_MAX_ATTEMPTS,
 ): Promise<number | undefined> {
diff --git a/src/bridges/user/web/server.ts b/src/bridges/user/web/server.ts
index 55a8768..a2749c3 100644
--- a/src/bridges/user/web/server.ts
+++ b/src/bridges/user/web/server.ts
@@ -22,7 +22,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { WebSocketServer, WebSocket } from "ws";
 import { PushManager } from "../../../core/push-manager.js";
-import type { PushSubscription } from "../../../core/push-manager.js";
+import type { PushSubscription } from "../../../core/web-push.js";
 import { ChatController } from "../controller.js";
 import type { MeshStore } from "../../../core/mesh-store.js";
 import type {
@@ -32,6 +32,11 @@ import type {
 
 const WEB_HOST = "127.0.0.1";
 
+const HTTP_NO_CONTENT = 204;
+const HTTP_OK = 200;
+const HTTP_BAD_REQUEST = 400;
+const HTTP_NOT_FOUND = 404;
+
 // ---------------------------------------------------------------------------
 // Static assets — loaded into memory at module load
 // ---------------------------------------------------------------------------
@@ -237,21 +242,21 @@ function handleRequest(
   res.setHeader("Access-Control-Allow-Headers", "Content-Type");
 
   if (req.method === "OPTIONS") {
-    res.writeHead(204);
+    res.writeHead(HTTP_NO_CONTENT);
     res.end();
     return;
   }
 
   // Frontend HTML
   if (url.pathname === "/" && req.method === "GET") {
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.writeHead(HTTP_OK, { "Content-Type": "text/html; charset=utf-8" });
     res.end(INDEX_HTML);
     return;
   }
 
   // Frontend JS bundle
   if (url.pathname === "/bundle.js" && req.method === "GET") {
-    res.writeHead(200, {
+    res.writeHead(HTTP_OK, {
       "Content-Type": "application/javascript; charset=utf-8",
     });
     res.end(BUNDLE_JS);
@@ -260,7 +265,7 @@ function handleRequest(
 
   // Mesh SharedWorker bundle
   if (url.pathname === "/mesh-worker.js" && req.method === "GET") {
-    res.writeHead(200, {
+    res.writeHead(HTTP_OK, {
       "Content-Type": "application/javascript; charset=utf-8",
     });
     res.end(MESH_WORKER_JS);
@@ -269,7 +274,7 @@ function handleRequest(
 
   // Service worker bundle
   if (url.pathname === "/sw.js" && req.method === "GET") {
-    res.writeHead(200, {
+    res.writeHead(HTTP_OK, {
       "Content-Type": "application/javascript; charset=utf-8",
       "Service-Worker-Allowed": "/",
     });
@@ -279,7 +284,7 @@ function handleRequest(
 
   // Web App Manifest
   if (url.pathname === "/manifest.json" && req.method === "GET") {
-    res.writeHead(200, {
+    res.writeHead(HTTP_OK, {
       "Content-Type": "application/manifest+json; charset=utf-8",
     });
     res.end(MANIFEST_JSON);
@@ -291,7 +296,7 @@ function handleRequest(
     const filename = url.pathname.slice("/icons/".length);
     const icon = ICONS[filename];
     if (icon) {
-      res.writeHead(200, {
+      res.writeHead(HTTP_OK, {
         "Content-Type": "image/svg+xml",
         "Cache-Control": "public, max-age=604800",
       });
@@ -334,8 +339,8 @@ function handleRequest(
   ) {
     void (async () => {
       const roomId = url.pathname.split("/")[3];
-      if (!roomId) {
-        jsonError(res, "Room ID required", 400);
+      if (roomId === undefined || roomId === "") {
+        jsonError(res, "Room ID required", HTTP_BAD_REQUEST);
         return;
       }
       const since = url.searchParams.get("since") ?? undefined;
@@ -350,7 +355,7 @@ function handleRequest(
       const body = await readBody(req);
       const parsed: unknown = JSON.parse(body);
       if (typeof parsed !== "object" || parsed === null) {
-        jsonError(res, "Invalid JSON", 400);
+        jsonError(res, "Invalid JSON", HTTP_BAD_REQUEST);
         return;
       }
       const params = Object.fromEntries(Object.entries(parsed));
@@ -361,7 +366,7 @@ function handleRequest(
     return;
   }
 
-  res.writeHead(404);
+  res.writeHead(HTTP_NOT_FOUND);
   res.end("Not found");
 }
 
@@ -575,7 +580,12 @@ async function executeAction(
     case "send": {
       const target = getString(params, "target");
       const content = getString(params, "content");
-      if (!target || !content) {
+      if (
+        target === undefined ||
+        target === "" ||
+        content === undefined ||
+        content === ""
+      ) {
         return { content: "Missing target or content", isError: true };
       }
       return controller.send(target, content);
@@ -583,14 +593,20 @@ async function executeAction(
     case "dm": {
       const target = getString(params, "target");
       const content = getString(params, "content");
-      if (!target || !content) {
+      if (
+        target === undefined ||
+        target === "" ||
+        content === undefined ||
+        content === ""
+      ) {
         return { content: "Missing target or content", isError: true };
       }
       return controller.dm(target, content);
     }
     case "join_room": {
       const room = getString(params, "room");
-      if (!room) return { content: "Missing room", isError: true };
+      if (room === undefined || room === "")
+        return { content: "Missing room", isError: true };
       const result = await controller.switchRoom(room);
       if (!result.isError) {
         const msgs = await controller.readRoom();
@@ -609,7 +625,8 @@ async function executeAction(
       const name = getString(params, "name");
       const type = getRoomType(params, "type") ?? "public";
       const description = getString(params, "description") ?? "";
-      if (!name) return { content: "Missing name", isError: true };
+      if (name === undefined || name === "")
+        return { content: "Missing name", isError: true };
       return controller.createRoom(name, type, description);
     }
     case "list_rooms":
@@ -622,34 +639,55 @@ async function executeAction(
     }
     case "destroy_room": {
       const room = getString(params, "room");
-      if (!room) return { content: "Missing room", isError: true };
+      if (room === undefined || room === "")
+        return { content: "Missing room", isError: true };
       return controller.destroyRoom(room);
     }
     case "invite": {
       const room = getString(params, "room");
       const agent = getString(params, "agent");
-      if (!room || !agent)
+      if (
+        room === undefined ||
+        room === "" ||
+        agent === undefined ||
+        agent === ""
+      )
         return { content: "Missing room or agent", isError: true };
       return controller.invite(room, agent);
     }
     case "decline_invite": {
       const room = getString(params, "room");
       const reason = getString(params, "reason");
-      if (!room || !reason)
+      if (
+        room === undefined ||
+        room === "" ||
+        reason === undefined ||
+        reason === ""
+      )
         return { content: "Missing room or reason", isError: true };
       return controller.declineInvite(room, reason);
     }
     case "kick": {
       const room = getString(params, "room");
       const agent = getString(params, "agent");
-      if (!room || !agent)
+      if (
+        room === undefined ||
+        room === "" ||
+        agent === undefined ||
+        agent === ""
+      )
         return { content: "Missing room or agent", isError: true };
       return controller.kick(room, agent);
     }
     case "rename_agent": {
       const agent = getString(params, "agent");
       const name = getString(params, "name");
-      if (!agent || !name)
+      if (
+        agent === undefined ||
+        agent === "" ||
+        name === undefined ||
+        name === ""
+      )
         return { content: "Missing agent or name", isError: true };
       return controller.renameAgent(agent, name);
     }
@@ -701,7 +739,7 @@ function parsePushSubscription(value: unknown): PushSubscription | undefined {
 // ---------------------------------------------------------------------------
 
 function json(res: http.ServerResponse, data: unknown): void {
-  res.writeHead(200, { "Content-Type": "application/json" });
+  res.writeHead(HTTP_OK, { "Content-Type": "application/json" });
   res.end(JSON.stringify(data));
 }
 
@@ -714,10 +752,12 @@ function jsonError(
   res.end(JSON.stringify({ error: message }));
 }
 
-function readBody(req: http.IncomingMessage): Promise<string> {
+async function readBody(req: http.IncomingMessage): Promise<string> {
   return new Promise((resolve, reject) => {
     const chunks: Buffer[] = [];
-    req.on("data", (chunk: Buffer) => chunks.push(chunk));
+    req.on("data", (chunk: Buffer) => {
+      chunks.push(chunk);
+    });
     req.on("end", () => {
       resolve(Buffer.concat(chunks).toString());
     });
diff --git a/src/bridges/user/web/test/port-discovery.unit.test.ts b/src/bridges/user/web/test/port-discovery.unit.test.ts
index cb23630..4126e90 100644
--- a/src/bridges/user/web/test/port-discovery.unit.test.ts
+++ b/src/bridges/user/web/test/port-discovery.unit.test.ts
@@ -15,7 +15,7 @@ function isErrnoException(error: unknown): error is NodeJS.ErrnoException {
   return error instanceof Error && "code" in error;
 }
 
-function delay(ms: number): Promise<void> {
+async function delay(ms: number): Promise<void> {
   return new Promise((resolve) => {
     setTimeout(resolve, ms);
   });
@@ -51,33 +51,60 @@ async function blockPort(port: number): Promise<() => Promise<void>> {
   }
 }
 
+/** Base port for the "base port is free" scenario. */
+const TEST_PORT_AVAILABLE_BASE = 49000;
+/** Base port for the "single port taken" scenario. */
+const TEST_PORT_SINGLE_TAKEN_BASE = 49100;
+/** The port findFreePort should land on once TEST_PORT_SINGLE_TAKEN_BASE is blocked. */
+const TEST_PORT_SINGLE_TAKEN_RESULT = 49101;
+/** Base port for the "multiple consecutive ports taken" scenario. */
+const TEST_PORT_MULTIPLE_TAKEN_BASE = 49200;
+/** Second port blocked in the "multiple consecutive ports taken" scenario. */
+const TEST_PORT_MULTIPLE_TAKEN_SECOND = 49201;
+/** Third port blocked in the "multiple consecutive ports taken" scenario. */
+const TEST_PORT_MULTIPLE_TAKEN_THIRD = 49202;
+/** The port findFreePort should land on once all three ports above are blocked. */
+const TEST_PORT_MULTIPLE_TAKEN_RESULT = 49203;
+/** Base port for the "every port in range is taken" scenario. */
+const TEST_PORT_ALL_TAKEN_BASE = 49300;
+/** How many consecutive ports get blocked, and the maxAttempts passed to findFreePort, in the "every port in range is taken" scenario -- both are the same number by design so the scan exhausts exactly the blocked range. */
+const TEST_ALL_TAKEN_PORT_COUNT = 3;
+/** Base port for the "maxAttempts allows walking past taken ports" scenario. */
+const TEST_PORT_MAX_ATTEMPTS_BASE = 49400;
+/** Second port blocked in the "maxAttempts allows walking past taken ports" scenario. */
+const TEST_PORT_MAX_ATTEMPTS_SECOND = 49401;
+/** maxAttempts passed to findFreePort in the "maxAttempts allows walking past taken ports" scenario -- deliberately larger than the number of blocked ports so the scan walks past them. */
+const TEST_MAX_ATTEMPTS_LIMIT = 5;
+/** The port findFreePort should land on once both ports above are blocked. */
+const TEST_PORT_MAX_ATTEMPTS_RESULT = 49402;
+
 describe("findFreePort", () => {
   it("returns the base port when it is available", async () => {
     // Use a high port that's very unlikely to be in use
-    const port = await findFreePort(49000);
+    const port = await findFreePort(TEST_PORT_AVAILABLE_BASE);
     expect(typeof port).toBe("number");
-    expect(port).toBe(49000);
+    expect(port).toBe(TEST_PORT_AVAILABLE_BASE);
   });
 
   it("walks to the next port when the base is taken", async () => {
-    const unblock = await blockPort(49100);
+    const unblock = await blockPort(TEST_PORT_SINGLE_TAKEN_BASE);
     try {
-      const port = await findFreePort(49100);
+      const port = await findFreePort(TEST_PORT_SINGLE_TAKEN_BASE);
       expect(typeof port).toBe("number");
-      expect(port).toBe(49101);
+      expect(port).toBe(TEST_PORT_SINGLE_TAKEN_RESULT);
     } finally {
       await unblock();
     }
   });
 
   it("skips multiple taken ports", async () => {
-    const unblock1 = await blockPort(49200);
-    const unblock2 = await blockPort(49201);
-    const unblock3 = await blockPort(49202);
+    const unblock1 = await blockPort(TEST_PORT_MULTIPLE_TAKEN_BASE);
+    const unblock2 = await blockPort(TEST_PORT_MULTIPLE_TAKEN_SECOND);
+    const unblock3 = await blockPort(TEST_PORT_MULTIPLE_TAKEN_THIRD);
     try {
-      const port = await findFreePort(49200);
+      const port = await findFreePort(TEST_PORT_MULTIPLE_TAKEN_BASE);
       expect(typeof port).toBe("number");
-      expect(port).toBe(49203);
+      expect(port).toBe(TEST_PORT_MULTIPLE_TAKEN_RESULT);
     } finally {
       await unblock1();
       await unblock2();
@@ -86,13 +113,16 @@ describe("findFreePort", () => {
   });
 
   it("returns undefined when all ports in range are taken", async () => {
-    // Block 3 ports with maxAttempts=3
+    // Block TEST_ALL_TAKEN_PORT_COUNT ports with maxAttempts=TEST_ALL_TAKEN_PORT_COUNT
     const blockers: (() => Promise<void>)[] = [];
-    for (let i = 0; i < 3; i++) {
-      blockers.push(await blockPort(49300 + i));
+    for (let i = 0; i < TEST_ALL_TAKEN_PORT_COUNT; i++) {
+      blockers.push(await blockPort(TEST_PORT_ALL_TAKEN_BASE + i));
     }
     try {
-      const port = await findFreePort(49300, 3);
+      const port = await findFreePort(
+        TEST_PORT_ALL_TAKEN_BASE,
+        TEST_ALL_TAKEN_PORT_COUNT,
+      );
       expect(port).toBe(undefined);
     } finally {
       for (const unblock of blockers) {
@@ -102,13 +132,16 @@ describe("findFreePort", () => {
   });
 
   it("respects the maxAttempts parameter", async () => {
-    // Block 2 ports but allow 5 attempts — should walk past them
-    const unblock1 = await blockPort(49400);
-    const unblock2 = await blockPort(49401);
+    // Block 2 ports but allow TEST_MAX_ATTEMPTS_LIMIT attempts — should walk past them
+    const unblock1 = await blockPort(TEST_PORT_MAX_ATTEMPTS_BASE);
+    const unblock2 = await blockPort(TEST_PORT_MAX_ATTEMPTS_SECOND);
     try {
-      const port = await findFreePort(49400, 5);
+      const port = await findFreePort(
+        TEST_PORT_MAX_ATTEMPTS_BASE,
+        TEST_MAX_ATTEMPTS_LIMIT,
+      );
       expect(typeof port).toBe("number");
-      expect(port).toBe(49402);
+      expect(port).toBe(TEST_PORT_MAX_ATTEMPTS_RESULT);
     } finally {
       await unblock1();
       await unblock2();
diff --git a/src/bridges/user/web/test/web-server.integration.test.ts b/src/bridges/user/web/test/web-server.integration.test.ts
index bfb4f48..2d19817 100644
--- a/src/bridges/user/web/test/web-server.integration.test.ts
+++ b/src/bridges/user/web/test/web-server.integration.test.ts
@@ -6,20 +6,40 @@
 
 import { describe, it, expect } from "vitest";
 import http from "node:http";
+import net from "node:net";
 import { createWebServer, type WebServerHandle } from "../server.js";
 import WS from "ws";
 
+/** HTTP 200 OK. */
+const HTTP_OK = 200;
+/** HTTP 404 Not Found. */
+const HTTP_NOT_FOUND = 404;
+
+/** Find a free port on localhost by binding to port 0, matching the pattern used by the mesh core's own integration tests -- an isolated coordinator port keeps this suite from colliding with a real agent-comms mesh already running on the developer's machine (the default coordinator port, 19876, is a well-known constant every real bridge instance binds). */
+async function findFreePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr !== null ? addr.port : 0;
+      server.close(() => resolve(port));
+    });
+    server.on("error", reject);
+  });
+}
+
 let handle: WebServerHandle | undefined;
 
 async function setup(): Promise<{
   port: number;
   cleanup: () => Promise<void>;
 }> {
-  handle = await createWebServer(0);
+  const coordinatorPort = await findFreePort();
+  handle = await createWebServer(0, undefined, coordinatorPort);
 
   // Wait for the server to actually be listening
   await new Promise<void>((resolve) => {
-    if (handle?.server.listening) {
+    if (handle?.server.listening === true) {
       resolve();
       return;
     }
@@ -41,7 +61,7 @@ async function setup(): Promise<{
   };
 }
 
-function fetchJson(
+async function fetchJson(
   port: number,
   path: string,
 ): Promise<{ status: number; body: unknown }> {
@@ -69,9 +89,9 @@ function fetchJson(
   });
 }
 
-function postAction(
+async function postAction(
   port: number,
-  action: Record<string, string>,
+  action: Readonly<Record<string, string>>,
 ): Promise<{ status: number; body: unknown }> {
   return new Promise((resolve, reject) => {
     const body = JSON.stringify(action);
@@ -113,7 +133,7 @@ describe("Web server integration", () => {
     const { port, cleanup } = await setup();
     try {
       const { status, body } = await fetchJson(port, "/");
-      expect(status).toBe(200);
+      expect(status).toBe(HTTP_OK);
       expect(
         typeof body === "string" && body.includes("Agent Comms"),
         "HTML should contain 'Agent Comms'",
@@ -127,7 +147,7 @@ describe("Web server integration", () => {
     const { port, cleanup } = await setup();
     try {
       const { status, body } = await fetchJson(port, "/api/agents");
-      expect(status).toBe(200);
+      expect(status).toBe(HTTP_OK);
       expect(Array.isArray(body)).toBeTruthy();
     } finally {
       await cleanup();
@@ -138,7 +158,7 @@ describe("Web server integration", () => {
     const { port, cleanup } = await setup();
     try {
       const { status, body } = await fetchJson(port, "/api/rooms");
-      expect(status).toBe(200);
+      expect(status).toBe(HTTP_OK);
       expect(Array.isArray(body)).toBeTruthy();
     } finally {
       await cleanup();
@@ -153,7 +173,7 @@ describe("Web server integration", () => {
         name: "integration-test-room",
         type: "public",
       });
-      expect(status).toBe(200);
+      expect(status).toBe(HTTP_OK);
       expect(
         typeof body === "object" && body !== null && "content" in body,
         "should return a result object",
@@ -206,7 +226,7 @@ describe("Web server integration", () => {
     const { port, cleanup } = await setup();
     try {
       const { status } = await fetchJson(port, "/nonexistent");
-      expect(status).toBe(404);
+      expect(status).toBe(HTTP_NOT_FOUND);
     } finally {
       await cleanup();
     }
diff --git a/src/cli.ts b/src/cli.ts
index b1263e1..2aba8d8 100755
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -15,7 +15,7 @@
  *   npx agent-comms read <room>               # read room messages
  *
  * The bridge subcommand lets harnesses invoke the bridge via npx:
- *   .mcp.json:  { "command": "npx", "args": ["agent-comms", "bridge", "claude-code"] }
+ *   .mcp.json:  \{ "command": "npx", "args": ["agent-comms", "bridge", "claude-code"] \}
  *   config.toml: command = "npx", args = ["agent-comms", "bridge", "codex"]
  */
 
@@ -24,7 +24,7 @@ import * as path from "node:path";
 import * as os from "node:os";
 import { execSync } from "node:child_process";
 import { z } from "zod";
-import { bridges } from "./bridges/index.js";
+import { bridges } from "./bridges/registry.js";
 import { runTui } from "./bridges/user/tui.js";
 import { runCli } from "./bridges/user/cli.js";
 
@@ -181,6 +181,9 @@ const harnesses: HarnessDef[] = [
 // Main
 // ---------------------------------------------------------------------------
 
+// process.argv[0] is the node binary, [1] the script path, [2] the subcommand -- everything from here on is the subcommand's own args.
+const CLI_ARGS_START_INDEX = 3;
+
 const command = process.argv[2] ?? "setup";
 
 switch (command) {
@@ -195,7 +198,7 @@ switch (command) {
     break;
   case "bridge": {
     const bridgeId = process.argv[3];
-    if (!bridgeId) {
+    if (bridgeId === undefined) {
       console.error("Usage: agent-comms bridge <id>");
       process.exit(1);
     }
@@ -203,7 +206,7 @@ switch (command) {
     break;
   }
   case "chat": {
-    const chatArgs = process.argv.slice(3);
+    const chatArgs = process.argv.slice(CLI_ARGS_START_INDEX);
     runChat(chatArgs);
     break;
   }
@@ -212,7 +215,7 @@ switch (command) {
   case "rooms":
   case "agents":
   case "read": {
-    const cliArgs = process.argv.slice(3);
+    const cliArgs = process.argv.slice(CLI_ARGS_START_INDEX);
     runUserCli(command, cliArgs);
     break;
   }
@@ -241,7 +244,10 @@ function runBridge(id: string): void {
   });
 }
 
-function parseNameArg(args: string[]): { name: string; rest: string[] } {
+function parseNameArg(args: readonly string[]): {
+  name: string;
+  rest: readonly string[];
+} {
   const nameIdx = args.indexOf("--name");
   if (nameIdx !== -1) {
     const val = args[nameIdx + 1];
@@ -255,7 +261,7 @@ function parseNameArg(args: string[]): { name: string; rest: string[] } {
   return { name: "Joe", rest: args };
 }
 
-function runChat(args: string[]): void {
+function runChat(args: readonly string[]): void {
   const { name } = parseNameArg(args);
   runTui(name).catch((err: unknown) => {
     console.error(err);
@@ -263,9 +269,9 @@ function runChat(args: string[]): void {
   });
 }
 
-function runUserCli(command: string, args: string[]): void {
+function runUserCli(cliCommand: string, args: readonly string[]): void {
   const { name, rest } = parseNameArg(args);
-  runCli(command, rest, name).catch((err: unknown) => {
+  runCli(cliCommand, rest, name).catch((err: unknown) => {
     console.error(err);
     process.exit(1);
   });
diff --git a/src/core/agent-registry.ts b/src/core/agent-registry.ts
index 0811c2c..4197815 100644
--- a/src/core/agent-registry.ts
+++ b/src/core/agent-registry.ts
@@ -114,12 +114,12 @@ export class AgentRegistry {
 
     const oldStatus = agent.status;
     const oldName = agent.name;
-    Object.assign(agent, patch);
-    this.deps.deliveryEngine.bump(agent);
-    this.deps.agents.set(id, agent);
+    const updatedAgent: AgentIdentity = { ...agent, ...patch };
+    this.deps.deliveryEngine.bump(updatedAgent);
+    this.deps.agents.set(id, updatedAgent);
     await this.deps.deliveryEngine.broadcastPatch({
       type: "agent_upsert",
-      agent,
+      agent: updatedAgent,
     });
 
     if (patch.name !== undefined && patch.name !== oldName) {
@@ -134,7 +134,7 @@ export class AgentRegistry {
       await this.deps.deliveryEngine.notifyRoomsOfStatus(id, patch.status);
     }
 
-    return agent;
+    return updatedAgent;
   }
 
   async listAgents(requesterId: string): Promise<AgentIdentity[]> {
diff --git a/src/core/bridge.ts b/src/core/bridge.ts
index 32554e1..7d8456e 100644
--- a/src/core/bridge.ts
+++ b/src/core/bridge.ts
@@ -365,6 +365,8 @@ export function buildAction(params: Record<string, unknown>): CommsAction {
       return { action: "mesh_fed_disconnect", linkId: p.id };
     case "mesh_fed_links":
       return { action: "mesh_fed_links" };
+    default:
+      return p.action satisfies never;
   }
 }
 
@@ -414,13 +416,15 @@ export function formatDeliveryEvent(event: DeliveryEvent): string {
     case "member_status":
       return `${event.agent} is now ${event.status} in ${event.room}`;
     case "delivery_status":
-      return `Message ${event.messageId} ${event.status} by ${event.agent}${event.room ? ` in ${event.room}` : ""}`;
+      return `Message ${event.messageId} ${event.status} by ${event.agent}${event.room !== undefined ? ` in ${event.room}` : ""}`;
     case "invite_declined":
       return `${event.agentName} declined invite to ${event.room}: "${event.reason}"`;
     case "name_changed":
       return `${event.oldName} is now known as ${event.newName}`;
     case "connection_request":
       return `Connection request from ${event.peerId} (${event.name}) fingerprint ${event.fingerprint}`;
+    default:
+      return event satisfies never;
   }
 }
 
@@ -451,6 +455,8 @@ export function isActionableEvent(event: DeliveryEvent): boolean {
     case "name_changed":
     case "connection_request":
       return false;
+    default:
+      return event satisfies never;
   }
 }
 
@@ -510,7 +516,7 @@ export async function ensureRegistered(opts: {
  * Every agent computes an owner-rooted path with itself as owner, so two agents in the same cwd do not currently converge on one shared room -- a real, deliberately deferred regression from the pre-core/room behaviour (see the design doc's OQ-2: deterministic lowest-device-id ownership is P3.4's own responsibility, once gossiped presence data is wired up here).
  */
 export async function ensureProjectRoom(
-  store: CommsStore,
+  store: Readonly<CommsStore>,
   agentId: string,
   cwd: string,
 ): Promise<string> {
@@ -543,7 +549,7 @@ export async function ensureProjectRoom(
 // ---------------------------------------------------------------------------
 
 export async function drainAndFormat(
-  store: CommsStore,
+  store: Readonly<CommsStore>,
   agentId: string,
 ): Promise<string[]> {
   const events = await store.drainDelivery(agentId);
diff --git a/src/core/comms-store.ts b/src/core/comms-store.ts
index 19a7466..3e4dee1 100644
--- a/src/core/comms-store.ts
+++ b/src/core/comms-store.ts
@@ -21,77 +21,85 @@ import type {
 
 export interface CommsStore {
   // -- Identity --
-  readIdentity(
+  readIdentity: (
     harness: string,
     cwd: string,
-  ): Promise<{ id: string } | undefined>;
-  writeIdentity(harness: string, cwd: string, id: string): Promise<void>;
+  ) => Promise<{ id: string } | undefined>;
+  writeIdentity: (harness: string, cwd: string, id: string) => Promise<void>;
 
   // -- Agent registry --
-  registerAgent(opts: {
-    name: string;
-    harness: string;
-    cwd: string;
-    pid: number;
-    visibility: Visibility;
-    tags: string[];
-  }): Promise<AgentIdentity>;
-  getAgent(id: string): Promise<AgentIdentity | undefined>;
-  updateAgent(
+  registerAgent: (
+    opts: Readonly<{
+      name: string;
+      harness: string;
+      cwd: string;
+      pid: number;
+      visibility: Visibility;
+      tags: string[];
+    }>,
+  ) => Promise<AgentIdentity>;
+  getAgent: (id: string) => Promise<AgentIdentity | undefined>;
+  updateAgent: (
     id: string,
     patch: Partial<
       Pick<AgentIdentity, "name" | "visibility" | "status" | "tags" | "pid">
     >,
-  ): Promise<AgentIdentity>;
-  listAgents(requesterId: string): Promise<AgentIdentity[]>;
-  setAgentOffline(id: string): Promise<void>;
+  ) => Promise<AgentIdentity>;
+  listAgents: (requesterId: string) => Promise<AgentIdentity[]>;
+  setAgentOffline: (id: string) => Promise<void>;
 
   // -- Rooms --
-  createRoom(opts: {
-    name: string;
-    type: RoomType;
-    owner: string;
-    description: string;
-  }): Promise<Room>;
-  getRoom(id: string): Promise<Room | undefined>;
-  listRooms(requesterId: string): Promise<Room[]>;
-  joinRoom(roomId: string, agentId: string): Promise<Room>;
-  leaveRoom(roomId: string, agentId: string): Promise<void>;
-  inviteToRoom(
+  createRoom: (
+    opts: Readonly<{
+      name: string;
+      type: RoomType;
+      owner: string;
+      description: string;
+    }>,
+  ) => Promise<Room>;
+  getRoom: (id: string) => Promise<Room | undefined>;
+  listRooms: (requesterId: string) => Promise<Room[]>;
+  joinRoom: (roomId: string, agentId: string) => Promise<Room>;
+  leaveRoom: (roomId: string, agentId: string) => Promise<void>;
+  inviteToRoom: (
     roomId: string,
     targetId: string,
     inviterId: string,
-  ): Promise<void>;
-  declineInvite(roomId: string, agentId: string, reason: string): Promise<void>;
-  kickFromRoom(
+  ) => Promise<void>;
+  declineInvite: (
+    roomId: string,
+    agentId: string,
+    reason: string,
+  ) => Promise<void>;
+  kickFromRoom: (
     roomId: string,
     targetId: string,
     kickerId: string,
-  ): Promise<void>;
-  destroyRoom(roomId: string, agentId: string): Promise<void>;
+  ) => Promise<void>;
+  destroyRoom: (roomId: string, agentId: string) => Promise<void>;
 
   // -- Messages --
-  sendRoomMessage(
+  sendRoomMessage: (
     roomId: string,
     from: string,
     content: string,
     replyTo?: string,
     streamingBehavior?: StreamingBehavior,
-  ): Promise<RoomMessage>;
-  readRoomMessages(roomId: string, since?: string): Promise<RoomMessage[]>;
+  ) => Promise<RoomMessage>;
+  readRoomMessages: (roomId: string, since?: string) => Promise<RoomMessage[]>;
 
   // -- DMs --
-  sendDm(
+  sendDm: (
     from: string,
     to: string,
     content: string,
     streamingBehavior?: StreamingBehavior,
-  ): Promise<DmMessage>;
+  ) => Promise<DmMessage>;
 
   // -- Delivery --
-  deliver(agentId: string, event: DeliveryEvent): Promise<void>;
-  drainDelivery(agentId: string): Promise<DeliveryEvent[]>;
+  deliver: (agentId: string, event: DeliveryEvent) => Promise<void>;
+  drainDelivery: (agentId: string) => Promise<DeliveryEvent[]>;
 
   // -- Lifecycle --
-  init(): Promise<void>;
+  init: () => Promise<void>;
 }
diff --git a/src/core/connection-approval.ts b/src/core/connection-approval.ts
index e19b22d..f6c7eff 100644
--- a/src/core/connection-approval.ts
+++ b/src/core/connection-approval.ts
@@ -29,13 +29,13 @@ export class ConnectionApproval {
   constructor(private readonly deps: ConnectionApprovalDeps) {}
 
   handleConnectionRequest(
-    handle: ConnectionHandle,
-    request: {
+    handle: Readonly<ConnectionHandle>,
+    request: Readonly<{
       peerId: string;
       dataPort: number;
       name: string;
       fingerprint: string;
-    },
+    }>,
   ): void {
     this.pendingInboundConnections.set(handle.id, {
       peerId: request.peerId,
@@ -98,10 +98,8 @@ export class ConnectionApproval {
     }));
   }
 
-  /** Initiate an outbound connection to a remote coordinator requiring approval.
-   *  Fires the connect_request and returns immediately. The connection
-   *  completes asynchronously when the coordinator accepts or rejects. */
-  connectToRemote(host: string, port: number): Promise<void> {
+  /** Initiate an outbound connection to a remote coordinator requiring approval. Fires the connect_request and returns immediately. The connection completes asynchronously when the coordinator accepts or rejects. */
+  async connectToRemote(host: string, port: number): Promise<void> {
     const peerId = this.deps.getPeerId();
     const agent = this.deps.agents.get(peerId);
     // Fire-and-forget: don't await the full approval handshake. The coordinator will either accept (triggering normal introduction flow) or reject (closing the socket). Handle rejection to avoid unhandled rejection.
@@ -122,8 +120,7 @@ export class ConnectionApproval {
     return Promise.resolve();
   }
 
-  /** Start only the data server without connecting to a coordinator.
-   *  Used for testing scenarios where the peer connects via connectToRemote. */
+  /** Start only the data server without connecting to a coordinator. Used for testing scenarios where the peer connects via connectToRemote. */
   async startDataServerOnly(): Promise<void> {
     await this.deps.requireTransport().startDataServer();
     const peerId = this.deps.getPeerId();
diff --git a/src/core/delivery-engine.ts b/src/core/delivery-engine.ts
index fca1cb7..44c3103 100644
--- a/src/core/delivery-engine.ts
+++ b/src/core/delivery-engine.ts
@@ -44,7 +44,7 @@ export interface DeliveryEngineDeps {
     ((patch: MeshStatePatch) => void | Promise<void>) | undefined;
   isShutDown: () => boolean;
   /**
-   * Sends one directed room-domain request to a single member, queuing it for retry when unreachable -- RoomProtocol's own method. Deferred: RoomProtocol doesn't exist yet when DeliveryEngine is constructed (construction order: discovery -> deliveryEngine -> ... -> roomProtocol), so MeshStore wires this as `(...) => this.roomProtocol.sendRoomRequestToMember(...)`, a closure over `this` that only resolves `this.roomProtocol` when markRead actually calls it at runtime, well after the constructor has finished -- the same lazy-`this`-capture pattern the constructor already uses to wire FederationManager's own callbacks before `this.federation` exists.
+   * Sends one directed room-domain request to a single member, queuing it for retry when unreachable -- RoomProtocol's own method. Deferred: RoomProtocol doesn't exist yet when DeliveryEngine is constructed (construction order: discovery -\> deliveryEngine -\> ... -\> roomProtocol), so MeshStore wires this as `(...) => this.roomProtocol.sendRoomRequestToMember(...)`, a closure over `this` that only resolves `this.roomProtocol` when markRead actually calls it at runtime, well after the constructor has finished -- the same lazy-`this`-capture pattern the constructor already uses to wire FederationManager's own callbacks before `this.federation` exists.
    */
   sendRoomRequestToMember: (
     memberId: string,
@@ -54,6 +54,9 @@ export interface DeliveryEngineDeps {
   ) => Promise<void>;
 }
 
+/** Cap on `localDeliveryKeys`, the dedup set of already-delivered event keys kept per process; oldest entries are evicted once this is exceeded. */
+const MAX_LOCAL_DELIVERY_DEDUP_KEYS = 50;
+
 export class DeliveryEngine {
   constructor(private readonly deps: DeliveryEngineDeps) {}
 
@@ -155,8 +158,8 @@ export class DeliveryEngine {
 
   /** Merge per-agent operation maps by highest revision per agent. */
   private static mergeMemberOps(
-    local: Record<string, number>,
-    incoming: Record<string, number>,
+    local: Readonly<Record<string, number>>,
+    incoming: Readonly<Record<string, number>>,
   ): Record<string, number> {
     const merged: Record<string, number> = { ...local };
     for (const [id, stamp] of Object.entries(incoming)) {
@@ -214,7 +217,7 @@ export class DeliveryEngine {
         this.deps.messages.set(id, msgs);
         continue;
       }
-      mergeMessageHistories(existing, msgs);
+      this.deps.messages.set(id, mergeMessageHistories(existing, msgs));
     }
     for (const [id, dmMsgs] of incoming.dms) {
       const existing = this.deps.dms.get(id);
@@ -222,7 +225,7 @@ export class DeliveryEngine {
         this.deps.dms.set(id, dmMsgs);
         continue;
       }
-      mergeMessageHistories(existing, dmMsgs);
+      this.deps.dms.set(id, mergeMessageHistories(existing, dmMsgs));
     }
     for (const [agentId, events] of Object.entries(state.deliveryQueues)) {
       const seen = new Set(
@@ -310,7 +313,9 @@ export class DeliveryEngine {
           const eventKey = JSON.stringify(patch.event);
           if (this.deps.localDeliveryKeys.has(eventKey)) break;
           this.deps.localDeliveryKeys.add(eventKey);
-          if (this.deps.localDeliveryKeys.size > 50) {
+          if (
+            this.deps.localDeliveryKeys.size > MAX_LOCAL_DELIVERY_DEDUP_KEYS
+          ) {
             const oldest = this.deps.localDeliveryKeys.values().next().value;
             if (oldest !== undefined)
               this.deps.localDeliveryKeys.delete(oldest);
@@ -400,7 +405,7 @@ export class DeliveryEngine {
     if (this.deps.localDeliveryKeys.has(eventKey)) return;
     this.deps.localDeliveryKeys.add(eventKey);
     // Prevent unbounded growth — evict oldest when cap reached
-    if (this.deps.localDeliveryKeys.size > 50) {
+    if (this.deps.localDeliveryKeys.size > MAX_LOCAL_DELIVERY_DEDUP_KEYS) {
       const oldest = this.deps.localDeliveryKeys.values().next().value;
       if (oldest !== undefined) this.deps.localDeliveryKeys.delete(oldest);
     }
@@ -480,7 +485,7 @@ export class DeliveryEngine {
   ): Promise<void> {
     // Find the sender for this message
     const senderId = this.findMessageSender(messageId, room);
-    if (!senderId) return;
+    if (senderId === undefined) return;
     await this.deliverLocallyAndBroadcast(senderId, {
       type: "delivery_status",
       messageId,
@@ -494,7 +499,7 @@ export class DeliveryEngine {
     messageId: string,
     room?: string,
   ): string | undefined {
-    if (room) {
+    if (room !== undefined) {
       const msgs = this.deps.messages.get(room);
       if (msgs) {
         const msg = msgs.find((m) => m.id === messageId);
diff --git a/src/core/discovery-mdns.ts b/src/core/discovery-mdns.ts
index af88ad7..f475766 100644
--- a/src/core/discovery-mdns.ts
+++ b/src/core/discovery-mdns.ts
@@ -47,7 +47,7 @@ export class MdnsDiscoveryBackend implements DiscoveryBackend {
   private currentPayload: BeaconPayload | undefined;
   private isListening = false;
 
-  async startAdvertising(opts: AdvertiseOptions): Promise<string> {
+  async startAdvertising(opts: Readonly<AdvertiseOptions>): Promise<string> {
     const id = `mdns-${String(opts.port)}`;
 
     this.currentPayload = {
@@ -63,7 +63,7 @@ export class MdnsDiscoveryBackend implements DiscoveryBackend {
     return id;
   }
 
-  stopAdvertising(): Promise<void> {
+  async stopAdvertising(): Promise<void> {
     if (this.beaconTimer !== undefined) {
       clearInterval(this.beaconTimer);
       this.beaconTimer = undefined;
@@ -73,16 +73,12 @@ export class MdnsDiscoveryBackend implements DiscoveryBackend {
 
     // Only close the socket if we're not also discovering
     if (this.socket && !this.hasActiveListeners()) {
-      this.socket.close();
-      this.socket = undefined;
-      this.isListening = false;
+      await this.closeSocket();
     }
-
-    return Promise.resolve();
   }
 
   /** Stop all beacon activity and close the socket. */
-  stop(): Promise<void> {
+  async stop(): Promise<void> {
     if (this.beaconTimer !== undefined) {
       clearInterval(this.beaconTimer);
       this.beaconTimer = undefined;
@@ -91,12 +87,23 @@ export class MdnsDiscoveryBackend implements DiscoveryBackend {
     this.currentPayload = undefined;
 
     if (this.socket) {
-      this.socket.close();
-      this.socket = undefined;
-      this.isListening = false;
+      await this.closeSocket();
     }
+  }
+
+  /** Close the UDP socket and wait for the underlying handle to actually release before resolving. */
+  private async closeSocket(): Promise<void> {
+    const socket = this.socket;
+    if (!socket) return;
+
+    await new Promise<void>((resolve) => {
+      socket.close(() => {
+        resolve();
+      });
+    });
 
-    return Promise.resolve();
+    this.socket = undefined;
+    this.isListening = false;
   }
 
   async discover(
diff --git a/src/core/discovery-tailscale.ts b/src/core/discovery-tailscale.ts
index 3bbb138..3f818e2 100644
--- a/src/core/discovery-tailscale.ts
+++ b/src/core/discovery-tailscale.ts
@@ -12,15 +12,34 @@
 
 import * as http from "node:http";
 import * as net from "node:net";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import { execFile, type ExecException } from "node:child_process";
 import type {
   DiscoveredMesh,
   DiscoveryBackend,
   AdvertiseOptions,
 } from "./discovery.js";
 
-const execFileAsync = promisify(execFile);
+/** Runs `execFile` as a promise, resolving with its stdout/stderr rather than invoking a callback. */
+async function execFileAsync(
+  file: string,
+  args: readonly string[],
+): Promise<{ stdout: string; stderr: string }> {
+  const mutableArgs: string[] = [...args];
+  return new Promise((resolve, reject) => {
+    execFile(
+      file,
+      mutableArgs,
+      (error: ExecException | null, stdout: string, stderr: string) => {
+        if (error) {
+          reject(error instanceof Error ? error : new Error(error.message));
+          return;
+        }
+        resolve({ stdout, stderr });
+      },
+    );
+  });
+}
+
 const TCP_PROBE_TIMEOUT_MS = 500;
 const DEFAULT_DISCOVER_TIMEOUT_MS = 5_000;
 const COORDINATOR_PORT = 19876;
@@ -58,19 +77,18 @@ export class TailscaleDiscoveryBackend implements DiscoveryBackend {
   readonly name = "tailscale";
 
   /** No-op — the coordinator already listens on the Tailscale IP. */
-  startAdvertising(opts: AdvertiseOptions): Promise<string> {
+  async startAdvertising(opts: Readonly<AdvertiseOptions>): Promise<string> {
     return Promise.resolve(`tailscale-${String(opts.port)}`);
   }
 
   /** No-op — nothing to stop. */
-  stopAdvertising(): Promise<void> {
+  async stopAdvertising(): Promise<void> {
     return Promise.resolve();
   }
 
   /** Stop discovery — no-op since Tailscale has no persistent state to clean up. */
-  stop(): Promise<void> {
-    // Tailscale discovery is stateless — each discover() call probes peers fresh.
-    // No persistent connections or timers to tear down.
+  async stop(): Promise<void> {
+    // Tailscale discovery is stateless — each discover() call probes peers fresh. No persistent connections or timers to tear down.
     return Promise.resolve();
   }
 
@@ -82,7 +100,7 @@ export class TailscaleDiscoveryBackend implements DiscoveryBackend {
     const peers = await this.getPeers();
     if (peers.length === 0) return [];
 
-    const probes = peers.map((peer) => this.probePeer(peer));
+    const probes = peers.map(async (peer) => this.probePeer(peer));
     const results = await Promise.allSettled(probes);
 
     const discovered: DiscoveredMesh[] = [];
@@ -109,12 +127,12 @@ export class TailscaleDiscoveryBackend implements DiscoveryBackend {
 
     const peers: { ip: string; hostname: string }[] = [];
     for (const [, peer] of Object.entries(status.Peer)) {
-      if (!peer.Online) continue;
+      if (peer.Online !== true) continue;
       const ips = peer.TailscaleIPs;
       if (!ips || ips.length === 0) continue;
       // Use the first IPv4 address
       const ip = ips.find((addr) => addr.includes(".")) ?? ips[0];
-      if (!ip) continue;
+      if (ip === undefined || ip === "") continue;
       const hostname =
         peer.HostName ?? peer.DNSName?.replace(/\.tailnet.*$/, "") ?? ip;
       peers.push({ ip, hostname });
@@ -144,14 +162,16 @@ export class TailscaleDiscoveryBackend implements DiscoveryBackend {
   }
 
   /** Query the Tailscale local API at localhost:49156. */
-  private fetchLocalApi(): Promise<TailscaleStatus> {
+  private async fetchLocalApi(): Promise<TailscaleStatus> {
     return new Promise((resolve, reject) => {
       const req = http.get(
         `http://localhost:${String(TAILSCALE_API_PORT)}/localapi/v0/status`,
         { timeout: DEFAULT_DISCOVER_TIMEOUT_MS },
         (res) => {
           const chunks: Buffer[] = [];
-          res.on("data", (chunk: Buffer) => chunks.push(chunk));
+          res.on("data", (chunk: Buffer) => {
+            chunks.push(chunk);
+          });
           res.on("end", () => {
             try {
               resolve(
@@ -174,10 +194,9 @@ export class TailscaleDiscoveryBackend implements DiscoveryBackend {
   }
 
   /** Probe a single Tailscale peer for a listening mesh coordinator. */
-  private probePeer(peer: {
-    ip: string;
-    hostname: string;
-  }): Promise<DiscoveredMesh | undefined> {
+  private async probePeer(
+    peer: Readonly<{ ip: string; hostname: string }>,
+  ): Promise<DiscoveredMesh | undefined> {
     return new Promise((resolve) => {
       const socket = new net.Socket();
       const timer = setTimeout(() => {
diff --git a/src/core/discovery.ts b/src/core/discovery.ts
index 373850d..b57763b 100644
--- a/src/core/discovery.ts
+++ b/src/core/discovery.ts
@@ -47,11 +47,11 @@ export interface AdvertiseOptions {
 
 export interface DiscoveryBackend {
   readonly name: string;
-  startAdvertising(opts: AdvertiseOptions): Promise<string>;
-  stopAdvertising(id: string): Promise<void>;
-  discover(timeout?: number): Promise<DiscoveredMesh[]>;
+  startAdvertising: (opts: Readonly<AdvertiseOptions>) => Promise<string>;
+  stopAdvertising: (id: string) => Promise<void>;
+  discover: (timeout?: number) => Promise<DiscoveredMesh[]>;
   /** Stop all activity (timers, sockets) for this backend. */
-  stop(): Promise<void>;
+  stop: () => Promise<void>;
 }
 
 // ---------------------------------------------------------------------------
@@ -59,25 +59,25 @@ export interface DiscoveryBackend {
 // ---------------------------------------------------------------------------
 
 export class DiscoveryManager {
-  private backends = new Map<string, DiscoveryBackend>();
-  private activeAdvertisements = new Map<string, string>();
+  private readonly backends = new Map<string, DiscoveryBackend>();
+  private readonly activeAdvertisements = new Map<string, string>();
   private meshVisibility: MeshVisibility = "discoverable";
-  private perAdapterVisibility = new Map<string, MeshVisibility>();
+  private readonly perAdapterVisibility = new Map<string, MeshVisibility>();
   /** Advertisements that were paused due to visibility changes. */
-  private pausedAdvertisements = new Map<
+  private readonly pausedAdvertisements = new Map<
     string,
     { backendName: string; opts: AdvertiseOptions }
   >();
 
   /** Register a discovery backend. */
-  registerBackend(backend: DiscoveryBackend): void {
+  registerBackend(backend: Readonly<DiscoveryBackend>): void {
     this.backends.set(backend.name, backend);
   }
 
   /** Start advertising on a specific backend. Returns an advertisement ID. */
   async advertise(
     backendName: string,
-    opts: AdvertiseOptions,
+    opts: Readonly<AdvertiseOptions>,
   ): Promise<string> {
     const backend = this.backends.get(backendName);
     if (!backend) {
@@ -199,18 +199,18 @@ export class DiscoveryManager {
     }
   }
 
-  private resumeAllAdvertisements(): Promise<void> {
-    // Restart backends first (they may have been stopped in "dark" mode)
-    // Note: backends reinitialise their sockets on next startAdvertising/discover call.
+  private async resumeAllAdvertisements(): Promise<void> {
+    // Restart backends first (they may have been stopped in "dark" mode) Note: backends reinitialise their sockets on next startAdvertising/discover call.
     for (const [id] of this.pausedAdvertisements) {
       this.pausedAdvertisements.delete(id);
-      // We can't fully resume without original opts — the caller must
-      // re-advertise. Mark as not paused so new advertise calls work.
+      // We can't fully resume without original opts — the caller must re-advertise. Mark as not paused so new advertise calls work.
     }
     return Promise.resolve();
   }
 
-  private resumeAdvertisementsForBackend(backendName: string): Promise<void> {
+  private async resumeAdvertisementsForBackend(
+    backendName: string,
+  ): Promise<void> {
     for (const [id, entry] of this.pausedAdvertisements) {
       if (entry.backendName === backendName) {
         this.pausedAdvertisements.delete(id);
@@ -222,7 +222,7 @@ export class DiscoveryManager {
   /** Stop a previously started advertisement. */
   async stopAdvertising(id: string): Promise<void> {
     const backendName = this.activeAdvertisements.get(id);
-    if (!backendName) return;
+    if (backendName === undefined) return;
     const backend = this.backends.get(backendName);
     if (!backend) return;
     await backend.stopAdvertising(id);
@@ -258,7 +258,7 @@ export class DiscoveryManager {
     });
 
     const results = await Promise.all(
-      activeTargets.map((b) => b.discover(timeout)),
+      activeTargets.map(async (b) => b.discover(timeout)),
     );
 
     // Deduplicate by host+port
diff --git a/src/core/federation-bridge.ts b/src/core/federation-bridge.ts
index 609d91b..2dfb6f5 100644
--- a/src/core/federation-bridge.ts
+++ b/src/core/federation-bridge.ts
@@ -6,7 +6,7 @@ import type { FedCallbacks } from "./federation.js";
 import type { DeliveryEngine } from "./delivery-engine.js";
 import type { AgentIdentity, Room, RoomMessage } from "./types.js";
 
-/** The state and DeliveryEngine operations FederationBridge needs from MeshStore -- the core agents/rooms/messages Maps are direct references into MeshStore's own fields, and deliveryEngine is the already-constructed instance (construction order: ... -> deliveryEngine -> federationBridge -> federation), narrowed to only the membership/broadcast/delivery operations a federation callback ever needs. */
+/** The state and DeliveryEngine operations FederationBridge needs from MeshStore -- the core agents/rooms/messages Maps are direct references into MeshStore's own fields, and deliveryEngine is the already-constructed instance (construction order: ... -\> deliveryEngine -\> federationBridge -\> federation), narrowed to only the membership/broadcast/delivery operations a federation callback ever needs. */
 export interface FederationBridgeDeps {
   agents: Map<string, AgentIdentity>;
   rooms: Map<string, Room>;
@@ -59,7 +59,7 @@ export class FederationBridge implements FedCallbacks {
   /** Called when a message arrives for a federated room -- stores it locally and delivers to all local room members. */
   async onRoomMessage(roomId: string, message: RoomMessage): Promise<void> {
     const room = this.deps.rooms.get(roomId);
-    if (!room?.federated) return;
+    if (room?.federated !== true) return;
 
     const arr = this.deps.messages.get(roomId) ?? [];
     arr.push(message);
@@ -80,7 +80,7 @@ export class FederationBridge implements FedCallbacks {
     _agentName: string,
   ): Promise<void> {
     const room = this.deps.rooms.get(roomId);
-    if (!room?.federated) return;
+    if (room?.federated !== true) return;
 
     const remoteId = `fed:${agentId}`;
 
@@ -105,7 +105,7 @@ export class FederationBridge implements FedCallbacks {
   /** Called when a remote agent leaves a federated room. */
   async onRoomLeave(roomId: string, agentId: string): Promise<void> {
     const room = this.deps.rooms.get(roomId);
-    if (!room?.federated) return;
+    if (room?.federated !== true) return;
 
     const remoteId = `fed:${agentId}`;
     this.deps.deliveryEngine.bump(room);
@@ -139,7 +139,7 @@ export class FederationBridge implements FedCallbacks {
   getFederatedRoomMemberships(): Map<string, string[]> {
     const result = new Map<string, string[]>();
     for (const [roomId, room] of this.deps.rooms) {
-      if (room.federated) {
+      if (room.federated === true) {
         const localMembers = room.members.filter((m) => !m.startsWith("fed:"));
         result.set(roomId, localMembers);
       }
diff --git a/src/core/federation.ts b/src/core/federation.ts
index b0562a8..556f331 100644
--- a/src/core/federation.ts
+++ b/src/core/federation.ts
@@ -42,19 +42,23 @@ export interface FedLink {
 /** Callbacks the FederationManager uses to interact with local mesh state. */
 export interface FedCallbacks {
   /** Called when a remote agent becomes visible over a federation link. */
-  onAgentVisible(agent: AgentIdentity): Promise<void>;
+  onAgentVisible: (agent: AgentIdentity) => Promise<void>;
   /** Called when a remote agent goes offline/disappears. */
-  onAgentGone(agentId: string): Promise<void>;
+  onAgentGone: (agentId: string) => Promise<void>;
   /** Called when a message arrives for a federated room. */
-  onRoomMessage(roomId: string, message: RoomMessage): Promise<void>;
+  onRoomMessage: (roomId: string, message: RoomMessage) => Promise<void>;
   /** Called when a remote agent joins a federated room. */
-  onRoomJoin(roomId: string, agentId: string, agentName: string): Promise<void>;
+  onRoomJoin: (
+    roomId: string,
+    agentId: string,
+    agentName: string,
+  ) => Promise<void>;
   /** Called when a remote agent leaves a federated room. */
-  onRoomLeave(roomId: string, agentId: string): Promise<void>;
+  onRoomLeave: (roomId: string, agentId: string) => Promise<void>;
   /** Get all visible agents in the local mesh (for syncing to new links). */
-  getVisibleAgents(): AgentIdentity[];
+  getVisibleAgents: () => AgentIdentity[];
   /** Get all federated rooms and their member lists (for syncing to new links). */
-  getFederatedRoomMemberships(): Map<string, string[]>;
+  getFederatedRoomMemberships: () => Map<string, string[]>;
 }
 
 // ---------------------------------------------------------------------------
@@ -64,27 +68,45 @@ export interface FedCallbacks {
 const FED_PING_INTERVAL_MS = 30_000;
 const FED_PING_TIMEOUT_MS = 10_000;
 const FED_VERSION = "1.0.0";
+/** Length (in bytes of entropy) of a locally-assigned federation link ID. */
+const FED_LINK_ID_LENGTH = 8;
+/** How long to wait for the remote side to complete the fed_handshake/fed_ack exchange before giving up. */
+const FED_HANDSHAKE_TIMEOUT_MS = 5000;
+/** How long to wait for the underlying TLS socket itself to connect before giving up. */
+const FED_CONNECT_TIMEOUT_MS = 5000;
+/** How often {@link FederationManager.waitForHandshake} polls link readiness. */
+const FED_HANDSHAKE_POLL_INTERVAL_MS = 50;
 
 // ---------------------------------------------------------------------------
 // FederationManager
 // ---------------------------------------------------------------------------
 
 export class FederationManager {
-  private links = new Map<string, FedLink>();
-  private identity: PeerIdentity;
-  private meshId: string;
-  private meshName: string;
-  private callbacks: FedCallbacks;
-  private pingTimers = new Map<string, ReturnType<typeof setInterval>>();
+  private readonly links = new Map<string, FedLink>();
+  private readonly identity: PeerIdentity;
+  private readonly meshId: string;
+  private readonly meshName: string;
+  private readonly callbacks: FedCallbacks;
+  private readonly pingTimers = new Map<
+    string,
+    ReturnType<typeof setInterval>
+  >();
   private shutDown = false;
-  private pendingPongs = new Map<string, ReturnType<typeof setTimeout>>();
+  private readonly pendingPongs = new Map<
+    string,
+    ReturnType<typeof setTimeout>
+  >();
   /**
    * Certificate fingerprints this instance will federate with, inbound or outbound. Empty by default — federation trusts nobody until an operator explicitly pins a remote mesh's fingerprint, the same no-CA, pin-the-key trust model ordinary peer connections already use.
    */
-  private trustedFingerprints = new Set<string>();
+  private readonly trustedFingerprints = new Set<string>();
   private listener: tls.Server | undefined;
 
-  constructor(meshId: string, meshName: string, callbacks: FedCallbacks) {
+  constructor(
+    meshId: string,
+    meshName: string,
+    callbacks: Readonly<FedCallbacks>,
+  ) {
     this.meshId = meshId;
     this.meshName = meshName;
     this.callbacks = callbacks;
@@ -146,7 +168,7 @@ export class FederationManager {
   async connect(host: string, port: number, name?: string): Promise<string> {
     if (this.shutDown) throw new Error("FederationManager is shut down");
 
-    const linkId = nanoid(8);
+    const linkId = nanoid(FED_LINK_ID_LENGTH);
 
     const socket = await this.tlsConnect(host, port);
     if (this.verifyPeerOrDestroy(socket) === undefined) {
@@ -179,7 +201,7 @@ export class FederationManager {
     this.wireSocket(linkId, socket);
 
     // Wait for fed_ack (with timeout)
-    await this.waitForHandshake(linkId, 5000);
+    await this.waitForHandshake(linkId, FED_HANDSHAKE_TIMEOUT_MS);
 
     return linkId;
   }
@@ -205,7 +227,7 @@ export class FederationManager {
       );
     }
 
-    const linkId = nanoid(8);
+    const linkId = nanoid(FED_LINK_ID_LENGTH);
     const link: FedLink = {
       id: linkId,
       remoteMeshId: "",
@@ -219,7 +241,7 @@ export class FederationManager {
     this.wireSocket(linkId, socket);
 
     // Wait for the remote side's handshake
-    await this.waitForHandshake(linkId, 5000);
+    await this.waitForHandshake(linkId, FED_HANDSHAKE_TIMEOUT_MS);
 
     return linkId;
   }
@@ -229,7 +251,7 @@ export class FederationManager {
   // -----------------------------------------------------------------------
 
   /** Disconnect a specific federation link. */
-  disconnect(linkId: string): Promise<void> {
+  async disconnect(linkId: string): Promise<void> {
     const link = this.links.get(linkId);
     if (!link) return Promise.resolve();
 
@@ -302,7 +324,7 @@ export class FederationManager {
    *
    * Previously nothing in the shipped product called `handleInbound()` at all: it existed only as a function the integration test invoked directly against a hand-rolled `tls.createServer`. This is that server, promoted to real code.
    */
-  listen(host: string, port: number): Promise<void> {
+  async listen(host: string, port: number): Promise<void> {
     if (this.listener) {
       throw new Error("FederationManager is already listening");
     }
@@ -331,7 +353,7 @@ export class FederationManager {
   }
 
   /** Stop accepting new inbound federation connections. Existing links are unaffected. */
-  stopListening(): Promise<void> {
+  async stopListening(): Promise<void> {
     const server = this.listener;
     if (!server) return Promise.resolve();
     this.listener = undefined;
@@ -358,7 +380,7 @@ export class FederationManager {
   // Internal — TLS connection
   // -----------------------------------------------------------------------
 
-  private tlsConnect(host: string, port: number): Promise<tls.TLSSocket> {
+  private async tlsConnect(host: string, port: number): Promise<tls.TLSSocket> {
     return new Promise((resolve, reject) => {
       const socket = tls.connect(
         {
@@ -379,7 +401,7 @@ export class FederationManager {
         reject(
           new Error(`Federation connection timeout to ${host}:${String(port)}`),
         );
-      }, 5000);
+      }, FED_CONNECT_TIMEOUT_MS);
 
       socket.on("error", (err) => {
         clearTimeout(timer);
@@ -489,6 +511,17 @@ export class FederationManager {
         }
         break;
       }
+      case "state_sync":
+      case "state_update":
+      case "introduce":
+      case "connect_request":
+      case "peer_list":
+      case "peer_joined":
+      case "peer_left":
+      case "become_coordinator": {
+        // Local-mesh-only message kinds — never sent over a federation link; ignore rather than throw so an unexpected wire message can't tear down the link.
+        break;
+      }
     }
   }
 
@@ -502,7 +535,7 @@ export class FederationManager {
    */
   private async syncStateToLink(linkId: string): Promise<void> {
     const link = this.links.get(linkId);
-    if (!link?.ready) return;
+    if (link?.ready !== true) return;
 
     // Sync visible agents
     const agents = this.callbacks.getVisibleAgents();
@@ -534,13 +567,16 @@ export class FederationManager {
   // Internal — handshake waiting
   // -----------------------------------------------------------------------
 
-  private waitForHandshake(linkId: string, timeoutMs: number): Promise<void> {
+  private async waitForHandshake(
+    linkId: string,
+    timeoutMs: number,
+  ): Promise<void> {
     return new Promise((resolve, reject) => {
       const startTime = Date.now();
 
       const check = (): void => {
         const link = this.links.get(linkId);
-        if (link?.ready) {
+        if (link?.ready === true) {
           resolve();
           return;
         }
@@ -549,7 +585,7 @@ export class FederationManager {
           reject(new Error(`Federation handshake timeout for link ${linkId}`));
           return;
         }
-        setTimeout(check, 50);
+        setTimeout(check, FED_HANDSHAKE_POLL_INTERVAL_MS);
       };
 
       check();
@@ -572,7 +608,7 @@ export class FederationManager {
 
   private async sendPing(linkId: string): Promise<void> {
     const link = this.links.get(linkId);
-    if (!link?.ready) return;
+    if (link?.ready !== true) return;
 
     const msg: MeshMessage = { method: "fed_ping" };
     await this.writeToSocket(link.socket, msg);
diff --git a/src/core/handshake.ts b/src/core/handshake.ts
index 25c8199..0bc0cd4 100644
--- a/src/core/handshake.ts
+++ b/src/core/handshake.ts
@@ -28,12 +28,18 @@ export const AGENT_COMMS_DOMAIN = "dev.exadev.agent-comms/mesh";
 /** Handshake frames are tiny; anything larger than this is not a frame, it is garbage. */
 const MAX_HANDSHAKE_BYTES = 1024;
 
-/** CBOR map head byte range (0xa0–0xbf); JSON always starts with '{' (0x7b). */
+/** CBOR map head first byte, inclusive. */
+const CBOR_MAP_HEAD_MIN = 0xa0;
+/** CBOR map head last byte, inclusive. */
+const CBOR_MAP_HEAD_MAX = 0xbf;
+
+/** CBOR map head byte range (0xa0-0xbf); JSON always starts with the byte 0x7b. */
 function isCborMapHead(byte: number): boolean {
-  return byte >= 0xa0 && byte <= 0xbf;
+  return byte >= CBOR_MAP_HEAD_MIN && byte <= CBOR_MAP_HEAD_MAX;
 }
 
 const JSON_OBJECT_START = 0x7b; // '{'
+const HEX_RADIX = 16;
 
 interface HandshakeShape {
   type: "handshake";
@@ -81,11 +87,11 @@ export type HandshakeOutcome =
   | { kind: "refused"; reason: string };
 
 /**
- * Per-connection gate fed the incoming byte stream. Consumes the (optional) leading handshake frame and classifies the connection: negotiated (a version was agreed — for a server, the caller replies with `encodeHandshakeFrame()`), legacy (first byte was '{' — a pre-handshake peer, proceed exactly as before), or refused (a handshake we cannot speak: destroy the connection loudly rather than desync — the #31 enforcement point). After the first classification every subsequent feed passes the bytes through unchanged.
+ * Per-connection gate fed the incoming byte stream. Consumes the (optional) leading handshake frame and classifies the connection: negotiated (a version was agreed — for a server, the caller replies with `encodeHandshakeFrame()`), legacy (first byte was the JSON object-start byte — a pre-handshake peer, proceed exactly as before), or refused (a handshake we cannot speak: destroy the connection loudly rather than desync — the #31 enforcement point). After the first classification every subsequent feed passes the bytes through unchanged.
  */
 export class ConnectionHandshake {
   private decided: "legacy" | "negotiated" | null = null;
-  private pending: Buffer[] = [];
+  private readonly pending: Buffer[] = [];
   private pendingLength = 0;
 
   constructor(private readonly role: "client" | "server") {}
@@ -114,7 +120,7 @@ export class ConnectionHandshake {
       if (!isCborMapHead(first)) {
         return {
           kind: "refused",
-          reason: `unexpected first byte 0x${first.toString(16)} — not a handshake frame or JSON message`,
+          reason: `unexpected first byte 0x${first.toString(HEX_RADIX)} — not a handshake frame or JSON message`,
         };
       }
     }
@@ -181,9 +187,9 @@ export class ConnectionHandshake {
 
 /** The slice of the Node socket surface the handshake needs — satisfied by net.Socket and tls.TLSSocket alike. */
 export interface HandshakeSocket {
-  write(data: Uint8Array | string): unknown;
-  destroy(): void;
-  on(event: "data", listener: (data: Buffer) => void): unknown;
+  write: (data: Uint8Array | string) => unknown;
+  destroy: () => void;
+  on: (event: "data", listener: (data: Buffer) => void) => unknown;
 }
 
 /**
@@ -196,7 +202,7 @@ export interface HandshakeSocket {
  * replacing silent desync.
  */
 export function attachSocketHandshake(
-  socket: HandshakeSocket,
+  socket: Readonly<HandshakeSocket>,
   role: "client" | "server",
   onPayload: (data: Buffer) => void,
   onError?: (error: Error) => void,
@@ -307,13 +313,13 @@ export class WsHandshakeGate {
 
 /** The slice of the WebSocket surface the handshake needs. */
 export interface HandshakeWs {
-  send(data: string | Uint8Array): unknown;
-  terminate(): void;
+  send: (data: string | Uint8Array) => unknown;
+  terminate: () => void;
   // isBinary is the `ws` library's own frame-type flag (its `message` event always passes it as the second argument) -- the only reliable way to tell a text frame from a binary one, since `data` itself arrives as a Buffer in Node either way.
-  on(
+  on: (
     event: "message",
     listener: (raw: unknown, isBinary: boolean) => void,
-  ): unknown;
+  ) => unknown;
 }
 
 /**
@@ -324,7 +330,7 @@ export interface HandshakeWs {
  * connection and reports the reason.
  */
 export function attachWsHandshake(
-  ws: HandshakeWs,
+  ws: Readonly<HandshakeWs>,
   role: "client" | "server",
   onText: (raw: unknown) => void,
   onError?: (error: Error) => void,
diff --git a/src/core/identity-store.ts b/src/core/identity-store.ts
index e0f05b9..b85eff9 100644
--- a/src/core/identity-store.ts
+++ b/src/core/identity-store.ts
@@ -27,8 +27,10 @@ export interface IdentitySlot {
   dir?: string;
 }
 
+/** Renewal margin is one twelfth of the certificate's total validity period. */
+const RENEWAL_MARGIN_FRACTION = 12;
 /** Renew during the final twelfth of the certificate's validity. */
-const RENEWAL_MARGIN_MS = CERTIFICATE_VALIDITY_MS / 12;
+const RENEWAL_MARGIN_MS = CERTIFICATE_VALIDITY_MS / RENEWAL_MARGIN_FRACTION;
 
 /** A CapabilityToken (COSE_Sign1: [protected header bytes, unprotected header map, payload bytes or null, signature bytes]) with every byte-string field base64-encoded for JSON storage. Only the two named unprotected-header fields (alg, kid) are round-tripped -- every token minted by wire-mesh-core today leaves the unprotected header empty (alg/kid live in the protected header instead), so the schema's own open catchall for arbitrary extra keys is left unhandled until a real caller actually needs one preserved. */
 type SerializedCapabilityToken = [
@@ -47,10 +49,14 @@ interface StoredIdentity {
   issuedGrants?: Record<string, string>;
 }
 
+/** A COSE_Sign1 tuple always has exactly 4 elements: protected header, unprotected header, payload, signature. */
+const COSE_SIGN1_TUPLE_LENGTH = 4;
+
 function isSerializedCapabilityToken(
   value: unknown,
 ): value is SerializedCapabilityToken {
-  if (!Array.isArray(value) || value.length !== 4) return false;
+  if (!Array.isArray(value) || value.length !== COSE_SIGN1_TUPLE_LENGTH)
+    return false;
   const protectedHeader: unknown = value[0];
   const unprotectedHeader: unknown = value[1];
   const payload: unknown = value[2];
@@ -136,7 +142,7 @@ function slugifyCwd(cwd: string): string {
   return cwd.replace(/[\\/:*?"<>|]/g, "_");
 }
 
-function slotPaths(slot: IdentitySlot): {
+function slotPaths(slot: Readonly<IdentitySlot>): {
   dir: string;
   identityFile: string;
   lockFile: string;
@@ -190,7 +196,9 @@ function persistIdentity(identityFile: string, identity: PeerIdentity): void {
 /**
  * Load the persisted identity for the slot, creating it on first use, and take the slot lock. Returns an ephemeral identity when the slot is already held by another live process.
  */
-export function loadOrCreateIdentity(slot: IdentitySlot): PeerIdentity {
+export function loadOrCreateIdentity(
+  slot: Readonly<IdentitySlot>,
+): PeerIdentity {
   const { dir, identityFile, lockFile } = slotPaths(slot);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
 
@@ -259,7 +267,7 @@ function createIdentity(identityFile: string): PeerIdentity {
 /**
  * Release the slot lock on graceful shutdown. A lock held by another PID (taken over after this process crashed and restarted) is left alone.
  */
-export function releaseIdentityLock(slot: IdentitySlot): void {
+export function releaseIdentityLock(slot: Readonly<IdentitySlot>): void {
   const { lockFile } = slotPaths(slot);
   if (readLockPid(lockFile) === process.pid) {
     fs.rmSync(lockFile, { force: true });
@@ -291,7 +299,7 @@ function writeStoredIdentity(
  * Every room-membership capability token persisted for this slot, keyed by room path. Empty if the slot has never had one saved (or the identity file doesn't exist yet -- call loadOrCreateIdentity first).
  */
 export function loadRoomTokens(
-  slot: IdentitySlot,
+  slot: Readonly<IdentitySlot>,
 ): Record<string, CapabilityToken> {
   const { identityFile } = slotPaths(slot);
   const stored = readStoredIdentity(identityFile);
@@ -307,7 +315,7 @@ export function loadRoomTokens(
  * Persists a capability token for the given room path, surviving a restart the same way the identity it was minted against does. Overwrites any token already saved for that room; leaves every other room's token and the identity's own key material untouched.
  */
 export function saveRoomToken(
-  slot: IdentitySlot,
+  slot: Readonly<IdentitySlot>,
   roomPath: string,
   token: CapabilityToken,
 ): void {
@@ -326,12 +334,17 @@ export function saveRoomToken(
 }
 
 /** Removes the persisted token for one room path, if any. A no-op if none was saved for that path. */
-export function deleteRoomToken(slot: IdentitySlot, roomPath: string): void {
+export function deleteRoomToken(
+  slot: Readonly<IdentitySlot>,
+  roomPath: string,
+): void {
   const { identityFile } = slotPaths(slot);
   const stored = readStoredIdentity(identityFile);
   if (stored?.roomTokens === undefined) return;
   const roomTokens = Object.fromEntries(
-    Object.entries(stored.roomTokens).filter(([path]) => path !== roomPath),
+    Object.entries(stored.roomTokens).filter(
+      ([storedRoomPath]) => storedRoomPath !== roomPath,
+    ),
   );
   writeStoredIdentity(identityFile, { ...stored, roomTokens });
 }
@@ -344,7 +357,7 @@ function issuedGrantKey(roomPath: string, memberDeviceHex: string): string {
  * The token-id this identity itself minted for the given member's room:member grant, or undefined if none is on record (the slot has never admitted this member, or the record predates this bookkeeping). A room owner consults this to revoke a specific member's own grant later -- a token-id, unlike the token itself, is never presented on the wire and so is never obtainable except from this identity's own memory of having minted it.
  */
 export function loadIssuedRoomGrant(
-  slot: IdentitySlot,
+  slot: Readonly<IdentitySlot>,
   roomPath: string,
   memberDeviceHex: string,
 ): Uint8Array<ArrayBuffer> | undefined {
@@ -361,7 +374,7 @@ export function loadIssuedRoomGrant(
  * Records the token-id of a room:member grant this identity has just minted for memberDeviceHex in roomPath, surviving a restart the same way roomTokens does. Overwrites any earlier record for the same (roomPath, member) pair -- a fresh join/invite always supersedes the grant it replaces, so only the current token-id is ever worth revoking.
  */
 export function saveIssuedRoomGrant(
-  slot: IdentitySlot,
+  slot: Readonly<IdentitySlot>,
   roomPath: string,
   memberDeviceHex: string,
   tokenId: Uint8Array,
@@ -383,7 +396,7 @@ export function saveIssuedRoomGrant(
 
 /** Removes the recorded token-id for one (roomPath, member) grant, if any -- called once a kick has revoked it, so a later re-join mints and records a genuinely fresh one rather than leaving a stale entry alongside it. A no-op if none was recorded. */
 export function deleteIssuedRoomGrant(
-  slot: IdentitySlot,
+  slot: Readonly<IdentitySlot>,
   roomPath: string,
   memberDeviceHex: string,
 ): void {
diff --git a/src/core/identity.ts b/src/core/identity.ts
index 0856742..424d6df 100644
--- a/src/core/identity.ts
+++ b/src/core/identity.ts
@@ -22,10 +22,26 @@ import {
 /** The uncompressed SEC1 point tag byte (RFC 5480 §2.2): 0x04 marks what follows as raw X||Y, never compressed or hybrid encoding. */
 const UNCOMPRESSED_POINT_TAG = 0x04;
 
+/** Days in the certificate validity period. */
+const CERTIFICATE_VALIDITY_DAYS = 365;
+/** Hours per day, used to convert the certificate validity period to milliseconds. */
+const HOURS_PER_DAY = 24;
+/** Minutes per hour, used to convert the certificate validity period to milliseconds. */
+const MINUTES_PER_HOUR = 60;
+/** Seconds per minute, used to convert the certificate validity period to milliseconds. */
+const SECONDS_PER_MINUTE = 60;
+/** Milliseconds per second, used to convert the certificate validity period to milliseconds. */
+const MS_PER_SECOND = 1000;
+
 // ─── Types ──────────────────────────────────────────────────────────────────
 
 /** Self-signed certificate validity. Exported so identity persistence can derive its renewal margin. */
-export const CERTIFICATE_VALIDITY_MS = 365 * 24 * 60 * 60 * 1000;
+export const CERTIFICATE_VALIDITY_MS =
+  CERTIFICATE_VALIDITY_DAYS *
+  HOURS_PER_DAY *
+  MINUTES_PER_HOUR *
+  SECONDS_PER_MINUTE *
+  MS_PER_SECOND;
 
 export interface PeerIdentity {
   /** PEM-encoded PKCS#8 private key. */
@@ -42,11 +58,35 @@ export interface PeerIdentity {
 
 // ─── ASN.1 DER helpers ─────────────────────────────────────────────────────
 
+/** The high (0x80) bit of a byte -- the DER long-form length marker, the OID base-128 continuation bit, and the DER INTEGER sign bit all key off this same bit. */
+const HIGH_BIT = 0x80;
+/** Mask for the low 7 bits of a byte -- the payload bits in a DER long-form length prefix and in a base-128 OID subidentifier byte. */
+const LOW_7_BITS_MASK = 0x7f;
+/** Bits in a byte, used to split a DER length into its high and low bytes. */
+const BITS_PER_BYTE = 8;
+/** Mask for a single byte. */
+const BYTE_MASK = 0xff;
+/** Smallest length that needs a second DER long-form length byte (i.e. no longer fits in one byte). */
+const DER_LENGTH_TWO_BYTE_MIN = 0x100;
+/** DER long-form length prefix: one length byte follows. */
+const DER_LENGTH_PREFIX_1_BYTE = 0x81;
+/** DER long-form length prefix: two length bytes follow. */
+const DER_LENGTH_PREFIX_2_BYTES = 0x82;
+/** ASN.1 universal SEQUENCE tag. */
+const DER_TAG_SEQUENCE = 0x30;
+/** ASN.1 universal SET tag. */
+const DER_TAG_SET = 0x31;
+
 /** Encode a DER length field. */
 function derLength(length: number): Buffer {
-  if (length < 0x80) return Buffer.from([length]);
-  if (length < 0x100) return Buffer.from([0x81, length]);
-  return Buffer.from([0x82, (length >> 8) & 0xff, length & 0xff]);
+  if (length < HIGH_BIT) return Buffer.from([length]);
+  if (length < DER_LENGTH_TWO_BYTE_MIN)
+    return Buffer.from([DER_LENGTH_PREFIX_1_BYTE, length]);
+  return Buffer.from([
+    DER_LENGTH_PREFIX_2_BYTES,
+    (length >> BITS_PER_BYTE) & BYTE_MASK,
+    length & BYTE_MASK,
+  ]);
 }
 
 /** Wrap content bytes in a DER tag. */
@@ -59,15 +99,44 @@ function derWrap(tag: number, content: Buffer): Buffer {
 }
 
 /** DER SEQUENCE. */
-function derSequence(...items: Buffer[]): Buffer {
-  return derWrap(0x30, Buffer.concat(items));
+function derSequence(...items: readonly Buffer[]): Buffer {
+  return derWrap(DER_TAG_SEQUENCE, Buffer.concat(items));
 }
 
 /** DER SET. */
-function derSet(...items: Buffer[]): Buffer {
-  return derWrap(0x31, Buffer.concat(items));
+function derSet(...items: readonly Buffer[]): Buffer {
+  return derWrap(DER_TAG_SET, Buffer.concat(items));
 }
 
+/** X.690 rule for encoding an OID's first two arcs into a single byte: 40 * first-arc + second-arc. */
+const OID_FIRST_ARC_MULTIPLIER = 40;
+/** Bits carried per byte in an OID subidentifier's base-128 (7-bit group) varint encoding. */
+const BITS_PER_OID_GROUP = 7;
+/** ASN.1 universal OBJECT IDENTIFIER tag. */
+const DER_TAG_OID = 0x06;
+/** ASN.1 universal UTF8String tag. */
+const DER_TAG_UTF8_STRING = 0x0c;
+/** ASN.1 universal INTEGER tag. */
+const DER_TAG_INTEGER = 0x02;
+/** Leading zero byte prepended to a DER INTEGER whose first content byte has its sign bit set, so it is not misread as negative. */
+const DER_INTEGER_PADDING_BYTE = 0x00;
+/** ASN.1 universal BIT STRING tag. */
+const DER_TAG_BIT_STRING = 0x03;
+/** BIT STRING unused-bits prefix: this codec never leaves trailing unused bits. */
+const DER_BIT_STRING_NO_UNUSED_BITS = 0x00;
+/** ASN.1 universal OCTET STRING tag. */
+const DER_TAG_OCTET_STRING = 0x04;
+/** ASN.1 universal BOOLEAN tag. */
+const DER_TAG_BOOLEAN = 0x01;
+/** DER encodes a BOOLEAN true as an all-ones byte (X.690 §8.2.2 in DER mode). */
+const DER_BOOLEAN_TRUE_BYTE = 0xff;
+/** DER encodes a BOOLEAN false as an all-zeros byte. */
+const DER_BOOLEAN_FALSE_BYTE = 0x00;
+/** ASN.1 universal UTCTime tag. */
+const DER_TAG_UTCTIME = 0x17;
+/** UTCTime encodes the year as two digits, so the full year is taken modulo this. */
+const UTCTIME_YEAR_MODULUS = 100;
+
 /** DER OBJECT IDENTIFIER from dotted-decimal string. */
 function derOID(oid: string): Buffer {
   const parts = oid.split(".").map(Number);
@@ -76,59 +145,68 @@ function derOID(oid: string): Buffer {
   if (first === undefined || second === undefined) {
     throw new Error(`Invalid OID: ${oid}`);
   }
-  const bytes: number[] = [40 * first + second];
+  const bytes: number[] = [OID_FIRST_ARC_MULTIPLIER * first + second];
   for (let i = 2; i < parts.length; i++) {
     let value = parts[i];
     if (value === undefined) continue;
-    if (value < 128) {
+    if (value < HIGH_BIT) {
       bytes.push(value);
       continue;
     }
     const encoded: number[] = [];
-    encoded.push(value & 0x7f);
-    value >>= 7;
+    encoded.push(value & LOW_7_BITS_MASK);
+    value >>= BITS_PER_OID_GROUP;
     while (value > 0) {
-      encoded.push(0x80 | (value & 0x7f));
-      value >>= 7;
+      encoded.push(HIGH_BIT | (value & LOW_7_BITS_MASK));
+      value >>= BITS_PER_OID_GROUP;
     }
     bytes.push(...encoded.reverse());
   }
-  return derWrap(0x06, Buffer.from(bytes));
+  return derWrap(DER_TAG_OID, Buffer.from(bytes));
 }
 
 /** DER UTF8String. */
 function derUTF8String(value: string): Buffer {
-  return derWrap(0x0c, Buffer.from(value, "utf8"));
+  return derWrap(DER_TAG_UTF8_STRING, Buffer.from(value, "utf8"));
 }
 
 /** DER INTEGER from a raw byte buffer (adds leading zero if high bit set). */
 function derIntegerBytes(value: Buffer): Buffer {
   const firstByte = value[0];
-  if (firstByte === undefined || firstByte & 0x80) {
-    return derWrap(0x02, Buffer.concat([Buffer.from([0x00]), value]));
+  if (firstByte === undefined || firstByte & HIGH_BIT) {
+    return derWrap(
+      DER_TAG_INTEGER,
+      Buffer.concat([Buffer.from([DER_INTEGER_PADDING_BYTE]), value]),
+    );
   }
-  return derWrap(0x02, value);
+  return derWrap(DER_TAG_INTEGER, value);
 }
 
 /** DER BIT STRING (with zero unused-bits prefix). */
 function derBitString(content: Buffer): Buffer {
-  return derWrap(0x03, Buffer.concat([Buffer.from([0x00]), content]));
+  return derWrap(
+    DER_TAG_BIT_STRING,
+    Buffer.concat([Buffer.from([DER_BIT_STRING_NO_UNUSED_BITS]), content]),
+  );
 }
 
 /** DER OCTET STRING. */
 function derOctetString(content: Buffer): Buffer {
-  return derWrap(0x04, content);
+  return derWrap(DER_TAG_OCTET_STRING, content);
 }
 
 /** DER BOOLEAN. */
 function derBoolean(value: boolean): Buffer {
-  return derWrap(0x01, Buffer.from([value ? 0xff : 0x00]));
+  return derWrap(
+    DER_TAG_BOOLEAN,
+    Buffer.from([value ? DER_BOOLEAN_TRUE_BYTE : DER_BOOLEAN_FALSE_BYTE]),
+  );
 }
 
 /** DER UTCTime from a Date. Format: YYMMDDHHMMSSZ */
-function derUTCTime(date: Date): Buffer {
+function derUTCTime(date: Readonly<Date>): Buffer {
   const str = [
-    String(date.getUTCFullYear() % 100).padStart(2, "0"),
+    String(date.getUTCFullYear() % UTCTIME_YEAR_MODULUS).padStart(2, "0"),
     String(date.getUTCMonth() + 1).padStart(2, "0"),
     String(date.getUTCDate()).padStart(2, "0"),
     String(date.getUTCHours()).padStart(2, "0"),
@@ -136,7 +214,7 @@ function derUTCTime(date: Date): Buffer {
     String(date.getUTCSeconds()).padStart(2, "0"),
     "Z",
   ].join("");
-  return derWrap(0x17, Buffer.from(str, "ascii"));
+  return derWrap(DER_TAG_UTCTIME, Buffer.from(str, "ascii"));
 }
 
 // ─── OID constants ──────────────────────────────────────────────────────────
@@ -152,13 +230,27 @@ const OID_SAN = "2.5.29.17";
 /** Basic Constraints extension. */
 const OID_BASIC_CONSTRAINTS = "2.5.29.19";
 
+/** X.509 TBSCertificate `version` field's context-specific tag: `[0] EXPLICIT`. */
+const CONTEXT_TAG_VERSION = 0xa0;
+/** X.509 TBSCertificate `extensions` field's context-specific tag: `[3] EXPLICIT`. */
+const CONTEXT_TAG_EXTENSIONS = 0xa3;
+/** SAN GeneralName `dNSName` choice's context-specific tag: `[2] IMPLICIT`. */
+const SAN_TAG_DNS_NAME = 0x82;
+/** SAN GeneralName `iPAddress` choice's context-specific tag: `[7] IMPLICIT`. */
+const SAN_TAG_IP_ADDRESS = 0x87;
+/** First octet of the IPv4 loopback address (127.0.0.1) encoded into the SAN `iPAddress` extension. */
+const LOCALHOST_IPV4_FIRST_OCTET = 127;
+/** Random bytes hashed to seed the certificate serial number. */
+const SERIAL_SEED_BYTES = 16;
+/** Certificate serial number length in bytes (RFC 5280 recommends no more than 20 octets). */
+const SERIAL_LENGTH_BYTES = 20;
+
 // ─── Certificate building ───────────────────────────────────────────────────
 
 /**
  * Build a self-signed X.509 v3 certificate in DER format.
  *
- * Structure (RFC 5280 §4.1):
- *   Certificate ::= SEQUENCE { tbsCertificate, signatureAlgorithm, signatureValue }
+ * Structure (RFC 5280 §4.1): `Certificate ::= SEQUENCE { tbsCertificate, signatureAlgorithm, signatureValue }`
  */
 function buildCertificateDer(
   tbsCertificate: Buffer,
@@ -175,15 +267,7 @@ function buildCertificateDer(
 /**
  * Build the TBSCertificate DER structure.
  *
- * Structure (RFC 5280 §4.1.2):
- *   version [0] EXPLICIT INTEGER (v3 = 2),
- *   serialNumber INTEGER,
- *   signature AlgorithmIdentifier,
- *   issuer Name,
- *   validity { notBefore, notAfter },
- *   subject Name,
- *   subjectPublicKeyInfo SubjectPublicKeyInfo,
- *   extensions [3] EXPLICIT Extensions OPTIONAL
+ * Structure (RFC 5280 §4.1.2): `version [0] EXPLICIT INTEGER (v3 = 2), serialNumber INTEGER, signature AlgorithmIdentifier, issuer Name, validity { notBefore, notAfter }, subject Name, subjectPublicKeyInfo SubjectPublicKeyInfo, extensions [3] EXPLICIT Extensions OPTIONAL`
  */
 function buildTbsCertificate(
   serial: Buffer,
@@ -194,7 +278,10 @@ function buildTbsCertificate(
   extensions: Buffer,
 ): Buffer {
   // version: [0] EXPLICIT { INTEGER 2 } → a0 03 02 01 02
-  const version = derWrap(0xa0, derIntegerBytes(Buffer.from([2])));
+  const version = derWrap(
+    CONTEXT_TAG_VERSION,
+    derIntegerBytes(Buffer.from([2])),
+  );
 
   return derSequence(
     version,
@@ -204,7 +291,7 @@ function buildTbsCertificate(
     validity,
     issuerSubject, // subject (same as issuer for self-signed)
     subjectPublicKeyInfoDer,
-    derWrap(0xa3, derSequence(extensions)), // [3] EXPLICIT
+    derWrap(CONTEXT_TAG_EXTENSIONS, derSequence(extensions)), // [3] EXPLICIT
   );
 }
 
@@ -226,8 +313,11 @@ function buildExtensions(publicKeyDer: Buffer): Buffer {
 
   // Subject Alternative Name
   const sanValue = derSequence(
-    derWrap(0x82, Buffer.from("localhost", "ascii")), // dNSName
-    derWrap(0x87, Buffer.from([127, 0, 0, 1])), // iPAddress
+    derWrap(SAN_TAG_DNS_NAME, Buffer.from("localhost", "ascii")), // dNSName
+    derWrap(
+      SAN_TAG_IP_ADDRESS,
+      Buffer.from([LOCALHOST_IPV4_FIRST_OCTET, 0, 0, 1]),
+    ), // iPAddress
   );
   const sanExtension = derSequence(derOID(OID_SAN), derOctetString(sanValue));
 
@@ -268,14 +358,15 @@ export function certifyKeyPair(privateKeyPem: string): PeerIdentity {
     format: "der",
   });
 
-  // Random serial number (20 bytes). Clear the high bit to ensure positive.
+  // Random serial number (SERIAL_LENGTH_BYTES bytes). Clear the high bit to ensure positive.
   const serialBytes = createHash("sha256")
-    .update(randomBytes(16))
+    .update(randomBytes(SERIAL_SEED_BYTES))
     .digest()
-    .subarray(0, 20);
+    .subarray(0, SERIAL_LENGTH_BYTES);
   const serial = Buffer.from(serialBytes);
   const firstSerialByte = serial[0];
-  if (firstSerialByte !== undefined) serial[0] = firstSerialByte & 0x7f;
+  if (firstSerialByte !== undefined)
+    serial[0] = firstSerialByte & LOW_7_BITS_MASK;
   // DER INTEGERs are minimally encoded: a leading zero byte is only legal when the following byte's high bit is set. Clearing the sign bit above can leave 0x00 here, which OpenSSL rejects as illegal padding when the certificate is loaded (tls.createServer then fails despite retries), so pin it to a minimal non-zero value.
   if (serial[0] === 0) serial[0] = 1;
 
diff --git a/src/core/index.ts b/src/core/index.ts
index c8e9059..9a2328c 100644
--- a/src/core/index.ts
+++ b/src/core/index.ts
@@ -26,7 +26,7 @@ export type { RegistrationResult } from "./bridge.js";
 export { generateVapidKeys } from "./vapid.js";
 export type { VapidKeys } from "./vapid.js";
 export { PushManager } from "./push-manager.js";
-export type { PushSubscription, PushPayload } from "./push-manager.js";
+export type { PushSubscription, PushPayload } from "./web-push.js";
 export { DiscoveryManager } from "./discovery.js";
 export type {
   DiscoveredMesh,
diff --git a/src/core/mcp-registry-retry.ts b/src/core/mcp-registry-retry.ts
index e51b431..ab5f881 100644
--- a/src/core/mcp-registry-retry.ts
+++ b/src/core/mcp-registry-retry.ts
@@ -6,7 +6,11 @@
 export const INITIAL_RETRY_DELAY_MS = 15_000;
 export const MAX_RETRY_DELAY_MS = 120_000;
 export const RETRY_BACKOFF_MULTIPLIER = 2;
-export const MAX_TOTAL_RETRY_MS = 15 * 60 * 1000;
+const MAX_TOTAL_RETRY_MINUTES = 15;
+const SECONDS_PER_MINUTE = 60;
+const MS_PER_SECOND = 1000;
+export const MAX_TOTAL_RETRY_MS =
+  MAX_TOTAL_RETRY_MINUTES * SECONDS_PER_MINUTE * MS_PER_SECOND;
 
 /** The next delay in the doubling-with-cap backoff schedule, given the delay just used. */
 export function nextRetryDelayMs(previousDelayMs: number): number {
diff --git a/src/core/mesh-store-shared.ts b/src/core/mesh-store-shared.ts
index 12fed13..2c502cb 100644
--- a/src/core/mesh-store-shared.ts
+++ b/src/core/mesh-store-shared.ts
@@ -18,7 +18,17 @@ export interface MeshStoreIdentity {
 /**
  * Lifetime of a freshly minted room:member grant (owner root grant or member join/invite grant alike). Deliberately generous rather than the "short expires, periodic re-issue" pattern the design calls for to bound kick-convergence to gossip-independent expiry -- that re-issue mechanism is P3.7's own deliverable (riding room.members refreshes), and shipping a short expiry before it exists would let ordinary grants go stale with nothing to renew them. 30 days comfortably outlives any realistic room lifetime for now; P3.7 tightens this once re-issue-on-refresh lands.
  */
-export const ROOM_TOKEN_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
+const ROOM_TOKEN_LIFETIME_DAYS = 30;
+const HOURS_PER_DAY = 24;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const MS_PER_SECOND = 1000;
+export const ROOM_TOKEN_LIFETIME_MS =
+  ROOM_TOKEN_LIFETIME_DAYS *
+  HOURS_PER_DAY *
+  MINUTES_PER_HOUR *
+  SECONDS_PER_MINUTE *
+  MS_PER_SECOND;
 
 /** A human's decision on a pending room.join request -- reject carries an optional reason, mirroring rejectConnection's own equivalent room-independent decision. */
 export type RoomJoinDecision =
@@ -32,22 +42,30 @@ export const MAX_QUEUED_DELIVERIES_PER_AGENT = 100;
 /** The coordinator's own bind host -- always loopback, since the mesh coordinator role only ever needs to be reachable from other local peers on this machine. Shared between mesh-store.ts's own init() and PeerLifecycle's handleBecomeCoordinator. */
 export const COORDINATOR_HOST = "127.0.0.1";
 
+/** Shallow-clones an entry together with its own `readBy` array, so a merged history never shares mutable array references with either input it was built from. */
+function cloneWithReadBy<T extends { readBy: string[] }>(entry: T): T {
+  return { ...entry, readBy: [...entry.readBy] };
+}
+
 /**
- * Merge an incoming append-only message history into the local one: add entries the local list does not have and union read receipts on the ones it does. Local ordering is preserved; unseen entries are appended.
+ * Merge an incoming append-only message history with the local one, returning a new array: entries the local list does not have are appended, and read receipts are unioned on the ones it does. Local ordering is preserved; unseen entries are appended. Neither input array (nor its entries) is mutated -- the caller is responsible for storing the returned array back wherever the local history is kept.
  */
 export function mergeMessageHistories<
   T extends { id: string; readBy: string[] },
->(local: T[], incoming: T[]): void {
-  const byId = new Map(local.map((m) => [m.id, m]));
+>(local: readonly T[], incoming: readonly T[]): T[] {
+  const merged = local.map((m) => cloneWithReadBy(m));
+  const byId = new Map(merged.map((m) => [m.id, m]));
   for (const msg of incoming) {
     const existing = byId.get(msg.id);
     if (existing === undefined) {
-      local.push(msg);
-      byId.set(msg.id, msg);
+      const copy = cloneWithReadBy(msg);
+      merged.push(copy);
+      byId.set(msg.id, copy);
       continue;
     }
     for (const reader of msg.readBy) {
       if (!existing.readBy.includes(reader)) existing.readBy.push(reader);
     }
   }
+  return merged;
 }
diff --git a/src/core/mesh-store.ts b/src/core/mesh-store.ts
index 8bcc74b..d417e7a 100644
--- a/src/core/mesh-store.ts
+++ b/src/core/mesh-store.ts
@@ -19,7 +19,6 @@ import type { FedLink } from "./federation.js";
 import { getCertificateFingerprint } from "./identity.js";
 import { COORDINATOR_HOST } from "./mesh-store-shared.js";
 import type { MeshStoreIdentity } from "./mesh-store-shared.js";
-export type { MeshStoreIdentity } from "./mesh-store-shared.js";
 import { DeliveryEngine } from "./delivery-engine.js";
 import { FederationBridge } from "./federation-bridge.js";
 import { RoomProtocol } from "./room-protocol.js";
@@ -61,6 +60,8 @@ import type {
 // ---------------------------------------------------------------------------
 
 const DEFAULT_COORDINATOR_PORT = 19876;
+/** Length of the randomly generated peer ID. */
+const PEER_ID_LENGTH = 8;
 
 // ---------------------------------------------------------------------------
 // MeshStore
@@ -138,7 +139,7 @@ export class MeshStore implements CommsStore {
   }
 
   constructor(coordinatorPort: number = DEFAULT_COORDINATOR_PORT) {
-    this.peerId = nanoid(8);
+    this.peerId = nanoid(PEER_ID_LENGTH);
     this.startedAt = new Date().toISOString();
     this.coordinatorPort = coordinatorPort;
 
@@ -162,7 +163,7 @@ export class MeshStore implements CommsStore {
       getOnPatch: () => this.onPatch,
       isShutDown: () => this.isShutDown,
       // RoomProtocol doesn't exist yet at this point in the constructor -- this closure resolves `this.roomProtocol` lazily, only once markRead actually calls it at runtime, well after the constructor has finished. Mirrors the lazy-`this`-capture pattern FederationManager's own callbacks use below.
-      sendRoomRequestToMember: (memberId, roomPath, token, params) =>
+      sendRoomRequestToMember: async (memberId, roomPath, token, params) =>
         this.roomProtocol.sendRoomRequestToMember(
           memberId,
           roomPath,
@@ -196,7 +197,7 @@ export class MeshStore implements CommsStore {
       requireTransport: () => this.requireTransport(),
       deliveryEngine: this.deliveryEngine,
       // RoomLifecycle doesn't exist yet at this point -- deferred the same way DeliveryEngine's sendRoomRequestToMember closure above is.
-      revokeMemberGrant: (roomId, memberId) =>
+      revokeMemberGrant: async (roomId, memberId) =>
         this.roomLifecycle.revokeMemberGrant(roomId, memberId),
     });
 
@@ -248,9 +249,10 @@ export class MeshStore implements CommsStore {
       deliveryQueues: this.deliveryQueues,
       identityCache: this.identityCache,
       peerInfo: this.peerInfo,
-      notifyRoomsOfStatus: (agentId, status) =>
+      notifyRoomsOfStatus: async (agentId, status) =>
         this.deliveryEngine.notifyRoomsOfStatus(agentId, status),
-      broadcastPatch: (patch) => this.deliveryEngine.broadcastPatch(patch),
+      broadcastPatch: async (patch) =>
+        this.deliveryEngine.broadcastPatch(patch),
     });
 
     this.peerLifecycle = new PeerLifecycle({
@@ -267,7 +269,7 @@ export class MeshStore implements CommsStore {
   }
 
   /** Sets the transport (e.g. WireMeshTransport for encrypted connections). Must be called before init() or any other transport-using method. */
-  setTransport(transport: MeshTransport): void {
+  setTransport(transport: Readonly<MeshTransport>): void {
     this.transport = transport;
   }
 
@@ -461,13 +463,15 @@ export class MeshStore implements CommsStore {
   // CommsStore — Rooms
   // -----------------------------------------------------------------------
 
-  async createRoom(opts: {
-    name: string;
-    type: RoomType;
-    owner: string;
-    description: string;
-    federated?: boolean;
-  }): Promise<Room> {
+  async createRoom(
+    opts: Readonly<{
+      name: string;
+      type: RoomType;
+      owner: string;
+      description: string;
+      federated?: boolean;
+    }>,
+  ): Promise<Room> {
     return this.roomLifecycle.createRoom(opts);
   }
 
@@ -626,7 +630,7 @@ export class MeshStore implements CommsStore {
   }
 
   /** Initiate an outbound connection to a remote coordinator requiring approval. */
-  connectToRemote(host: string, port: number): Promise<void> {
+  async connectToRemote(host: string, port: number): Promise<void> {
     return this.connectionApproval.connectToRemote(host, port);
   }
 
@@ -728,12 +732,12 @@ export class MeshStore implements CommsStore {
     return getCertificateFingerprint(this.federation.tlsIdentity.certificate);
   }
 
-  fedTrust(fingerprint: string): Promise<void> {
+  async fedTrust(fingerprint: string): Promise<void> {
     this.federation.addTrustedFingerprint(fingerprint);
     return Promise.resolve();
   }
 
-  fedUntrust(fingerprint: string): Promise<void> {
+  async fedUntrust(fingerprint: string): Promise<void> {
     this.federation.removeTrustedFingerprint(fingerprint);
     return Promise.resolve();
   }
@@ -742,11 +746,11 @@ export class MeshStore implements CommsStore {
     return this.federation.listTrustedFingerprints();
   }
 
-  fedListen(host: string, port: number): Promise<void> {
+  async fedListen(host: string, port: number): Promise<void> {
     return this.federation.listen(host, port);
   }
 
-  fedStopListening(): Promise<void> {
+  async fedStopListening(): Promise<void> {
     return this.federation.stopListening();
   }
 
diff --git a/src/core/peer-lifecycle.ts b/src/core/peer-lifecycle.ts
index 013250c..d43878c 100644
--- a/src/core/peer-lifecycle.ts
+++ b/src/core/peer-lifecycle.ts
@@ -15,7 +15,7 @@ import type { StaleAgentChecker } from "./stale-agent-checker.js";
 import type { ConnectionHandle, MeshTransport } from "./transport.js";
 import type { AgentIdentity } from "./types.js";
 
-/** The state and collaborators PeerLifecycle needs from MeshStore. peerInfo/agents are direct references into MeshStore's own fields; coordinatorPort is a readonly value copied once; serialise is MeshStore's own retained method (constraint: it must stay directly on MeshStore.prototype, so PeerLifecycle calls it through this closure rather than owning it); roomProtocol/deliveryEngine/staleAgentChecker are the already-constructed instances (construction order: ... -> roomProtocol -> ... -> staleAgentChecker -> peerLifecycle), narrowed to what peer-lifecycle bookkeeping ever needs. */
+/** The state and collaborators PeerLifecycle needs from MeshStore. peerInfo/agents are direct references into MeshStore's own fields; coordinatorPort is a readonly value copied once; serialise is MeshStore's own retained method (constraint: it must stay directly on MeshStore.prototype, so PeerLifecycle calls it through this closure rather than owning it); roomProtocol/deliveryEngine/staleAgentChecker are the already-constructed instances (construction order: ... -\> roomProtocol -\> ... -\> staleAgentChecker -\> peerLifecycle), narrowed to what peer-lifecycle bookkeeping ever needs. */
 export interface PeerLifecycleDeps {
   peerInfo: Map<string, PeerInfo>;
   agents: Map<string, AgentIdentity>;
@@ -31,7 +31,7 @@ export interface PeerLifecycleDeps {
 export class PeerLifecycle {
   constructor(private readonly deps: PeerLifecycleDeps) {}
 
-  handlePeerList(peers: PeerInfo[]): void {
+  handlePeerList(peers: readonly PeerInfo[]): void {
     const peerId = this.deps.getPeerId();
     for (const peer of peers) {
       this.deps.peerInfo.set(peer.id, peer);
@@ -41,7 +41,7 @@ export class PeerLifecycle {
     }
   }
 
-  handlePeerJoined(peer: PeerInfo): void {
+  handlePeerJoined(peer: Readonly<PeerInfo>): void {
     this.deps.peerInfo.set(peer.id, peer);
     const peerId = this.deps.getPeerId();
     if (peer.id === peerId) return;
@@ -49,8 +49,8 @@ export class PeerLifecycle {
   }
 
   async handleIntroduction(
-    handle: ConnectionHandle,
-    msg: { peerId: string; dataPort: number },
+    handle: Readonly<ConnectionHandle>,
+    msg: Readonly<{ peerId: string; dataPort: number }>,
   ): Promise<void> {
     const newPeer: PeerInfo = {
       id: msg.peerId,
@@ -77,8 +77,8 @@ export class PeerLifecycle {
   }
 
   async handlePeerConnected(
-    handle: ConnectionHandle,
-    _info: PeerInfo,
+    handle: Readonly<ConnectionHandle>,
+    _info: Readonly<PeerInfo>,
   ): Promise<void> {
     // If we have state and the peer doesn't, send state sync
     if (this.deps.agents.size > 0) {
@@ -92,7 +92,7 @@ export class PeerLifecycle {
   }
 
   async handleDataMessage(
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
     msg: MeshMessage,
   ): Promise<void> {
     if (msg.method === "state_sync") {
@@ -102,7 +102,7 @@ export class PeerLifecycle {
     }
   }
 
-  async handleBecomeCoordinator(peerList: PeerInfo[]): Promise<void> {
+  async handleBecomeCoordinator(peerList: readonly PeerInfo[]): Promise<void> {
     // Take over as coordinator using the data server we already have
     await this.deps
       .requireTransport()
@@ -116,7 +116,7 @@ export class PeerLifecycle {
     this.deps.staleAgentChecker.start();
   }
 
-  handlePeerDisconnected(handle: ConnectionHandle): void {
+  handlePeerDisconnected(handle: Readonly<ConnectionHandle>): void {
     this.deps.peerInfo.delete(handle.id);
   }
 }
diff --git a/src/core/push-manager.ts b/src/core/push-manager.ts
index 1f9251e..e5df5b6 100644
--- a/src/core/push-manager.ts
+++ b/src/core/push-manager.ts
@@ -15,12 +15,6 @@ import {
   type PushPayload,
 } from "./web-push.js";
 
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-export type { PushSubscription, PushPayload };
-
 // ---------------------------------------------------------------------------
 // PushManager
 // ---------------------------------------------------------------------------
@@ -63,7 +57,10 @@ export class PushManager {
    * No-ops silently if no subscription exists — callers should check
    * hasSubscription() first if they need to distinguish the two cases.
    */
-  async sendPush(agentId: string, payload: PushPayload): Promise<void> {
+  async sendPush(
+    agentId: string,
+    payload: Readonly<PushPayload>,
+  ): Promise<void> {
     const subscription = this.subscriptions.get(agentId);
     if (!subscription) return;
 
diff --git a/src/core/random-id.ts b/src/core/random-id.ts
index 4824052..f89be4c 100644
--- a/src/core/random-id.ts
+++ b/src/core/random-id.ts
@@ -1,6 +1,9 @@
-/** Generates a random identifier: several of core/room's own fields (token-id, message-id) are defined as an arbitrary-length bstr, and 16 random bytes (128 bits) is the conventional size for an unguessable identifier, matching a UUIDv4's own random payload. */
+/** 16 random bytes (128 bits) is the conventional size for an unguessable identifier, matching a UUIDv4's own random payload. */
+const RANDOM_ID_BYTE_LENGTH = 16;
+
+/** Generates a random identifier: several of core/room's own fields (token-id, message-id) are defined as an arbitrary-length bstr, and {@link RANDOM_ID_BYTE_LENGTH} random bytes is the conventional size for an unguessable identifier, matching a UUIDv4's own random payload. */
 export function randomId(): Uint8Array<ArrayBuffer> {
-  const bytes = new Uint8Array(16);
+  const bytes = new Uint8Array(RANDOM_ID_BYTE_LENGTH);
   crypto.getRandomValues(bytes);
   return bytes;
 }
diff --git a/src/core/room-lifecycle.ts b/src/core/room-lifecycle.ts
index 0574cb5..5d82e22 100644
--- a/src/core/room-lifecycle.ts
+++ b/src/core/room-lifecycle.ts
@@ -102,13 +102,15 @@ export class RoomLifecycle {
     saveRoomToken(slot, roomPath, verdict.token);
   }
 
-  async createRoom(opts: {
-    name: string;
-    type: RoomType;
-    owner: string;
-    description: string;
-    federated?: boolean;
-  }): Promise<Room> {
+  async createRoom(
+    opts: Readonly<{
+      name: string;
+      type: RoomType;
+      owner: string;
+      description: string;
+      federated?: boolean;
+    }>,
+  ): Promise<Room> {
     // slugRoomName sanitises an arbitrary caller-supplied name (e.g. from a live create_room tool call, not just an internal cwd basename) into the room-path grammar's [A-Za-z0-9_-]+ charset -- createRoom is the one choke point every room creation goes through, so this is the right place to do it rather than trusting every caller to have pre-slugged, the way the old bare-name id never required at all.
     const slugName = slugRoomName(opts.name);
     const localName = opts.type === "secret" ? `_${slugName}` : slugName;
@@ -401,7 +403,7 @@ export class RoomLifecycle {
     );
 
     // Notify federated links if the room is federated
-    if (room.federated) {
+    if (room.federated === true) {
       const agentName = agent?.name ?? agentId;
       await this.deps.federation.broadcastRoomJoin(roomId, agentId, agentName);
     }
@@ -418,7 +420,8 @@ export class RoomLifecycle {
       throw new CommsError(`Room ${roomId} not found`, "ROOM_NOT_FOUND");
     const peerId = this.deps.getPeerId();
     if (agentId === peerId && room.owner !== peerId) {
-      return this.leaveRemoteRoom(roomId, room.owner);
+      await this.leaveRemoteRoom(roomId, room.owner);
+      return;
     }
 
     this.deps.deliveryEngine.bump(room);
@@ -449,7 +452,7 @@ export class RoomLifecycle {
     });
 
     // Notify federated links if the room is federated
-    if (room.federated) {
+    if (room.federated === true) {
       await this.deps.federation.broadcastRoomLeave(roomId, agentId);
     }
 
diff --git a/src/core/room-messaging.ts b/src/core/room-messaging.ts
index 5aac7c7..aafcb09 100644
--- a/src/core/room-messaging.ts
+++ b/src/core/room-messaging.ts
@@ -18,7 +18,7 @@ import type {
   StreamingBehavior,
 } from "./types.js";
 
-/** The state and collaborators RoomMessaging needs from MeshStore. rooms/messages/dms/agents are direct references into MeshStore's own fields; roomProtocol and federation are the already-constructed instances (construction order: ... -> roomProtocol -> roomMessaging -> ...), narrowed to what sending a message or DM ever needs. */
+/** The state and collaborators RoomMessaging needs from MeshStore. rooms/messages/dms/agents are direct references into MeshStore's own fields; roomProtocol and federation are the already-constructed instances (construction order: ... -\> roomProtocol -\> roomMessaging -\> ...), narrowed to what sending a message or DM ever needs. */
 export interface RoomMessagingDeps {
   rooms: Map<string, Room>;
   messages: Map<string, RoomMessage[]>;
@@ -72,7 +72,7 @@ export class RoomMessaging {
     this.deps.messages.set(roomId, arr);
 
     // Forward to federated links if the room is federated
-    if (room.federated) {
+    if (room.federated === true) {
       await this.deps.federation.forwardRoomMessage(roomId, message);
     }
 
@@ -109,7 +109,7 @@ export class RoomMessaging {
   ): Promise<RoomMessage[]> {
     await Promise.resolve();
     const arr = this.deps.messages.get(roomId) ?? [];
-    if (!since) return [...arr];
+    if (since === undefined || since === "") return [...arr];
     return arr.filter((m) => m.timestamp > since);
   }
 
diff --git a/src/core/room-protocol.ts b/src/core/room-protocol.ts
index d4d41d0..31653ad 100644
--- a/src/core/room-protocol.ts
+++ b/src/core/room-protocol.ts
@@ -55,7 +55,7 @@ import type {
   RoomMessage,
 } from "./types.js";
 
-/** The state and collaborators RoomProtocol needs from MeshStore. rooms/messages/dms/agents/dmRequestsInitiatedByMe are direct references into MeshStore's own fields; deliveryEngine is the already-constructed instance, narrowed to what a room-verb handler ever needs; revokeMemberGrant is deferred (RoomLifecycle, which owns it, doesn't exist yet when RoomProtocol is constructed -- construction order: ... -> roomProtocol -> roomMessaging -> roomLifecycle -> ...), wired the same lazy-`this`-capture way DeliveryEngine's own sendRoomRequestToMember closure is. */
+/** The state and collaborators RoomProtocol needs from MeshStore. rooms/messages/dms/agents/dmRequestsInitiatedByMe are direct references into MeshStore's own fields; deliveryEngine is the already-constructed instance, narrowed to what a room-verb handler ever needs; revokeMemberGrant is deferred (RoomLifecycle, which owns it, doesn't exist yet when RoomProtocol is constructed -- construction order: ... -\> roomProtocol -\> roomMessaging -\> roomLifecycle -\> ...), wired the same lazy-`this`-capture way DeliveryEngine's own sendRoomRequestToMember closure is. */
 export interface RoomProtocolDeps {
   rooms: Map<string, Room>;
   messages: Map<string, RoomMessage[]>;
@@ -101,13 +101,17 @@ export class RoomProtocol {
   /** Room verb handlers this store registers with its own WireMeshTransport, keyed by params.verb per room-router.ts's own dispatch discipline. */
   get roomVerbHandlers(): Partial<Record<string, RoomVerbHandler>> {
     return {
-      "room.join": (request, handle) => this.handleRoomJoin(request, handle),
-      "room.send": (request, handle) => this.handleRoomSend(request, handle),
-      "room.read": (request, handle) => this.handleRoomRead(request, handle),
-      "room.members": (request, handle) =>
+      "room.join": async (request, handle) =>
+        this.handleRoomJoin(request, handle),
+      "room.send": async (request, handle) =>
+        this.handleRoomSend(request, handle),
+      "room.read": async (request, handle) =>
+        this.handleRoomRead(request, handle),
+      "room.members": async (request, handle) =>
         this.handleRoomMembers(request, handle),
-      "room.invite": (request) => this.handleRoomInvite(request),
-      "room.leave": (request, handle) => this.handleRoomLeave(request, handle),
+      "room.invite": async (request) => this.handleRoomInvite(request),
+      "room.leave": async (request, handle) =>
+        this.handleRoomLeave(request, handle),
     };
   }
 
@@ -134,7 +138,7 @@ export class RoomProtocol {
    */
   private async handleRoomSend(
     request: IncomingManageRequest,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ): Promise<ManageOutcome> {
     const roomPath = request.scope.path;
     if (roomPath === undefined) {
@@ -210,7 +214,7 @@ export class RoomProtocol {
    */
   private async handleRoomRead(
     request: IncomingManageRequest,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ): Promise<ManageOutcome> {
     const roomPath = request.scope.path;
     if (roomPath === undefined) {
@@ -268,7 +272,7 @@ export class RoomProtocol {
    */
   private async handleRoomMembers(
     request: IncomingManageRequest,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ): Promise<ManageOutcome> {
     const roomPath = request.scope.path;
     if (roomPath === undefined) {
@@ -411,7 +415,7 @@ export class RoomProtocol {
    */
   private async handleRoomJoin(
     request: IncomingManageRequest,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ): Promise<ManageOutcome> {
     const roomPath = request.scope.path;
     if (roomPath === undefined) {
@@ -438,7 +442,7 @@ export class RoomProtocol {
   /** Shared admission continuation for both room.join branches above: waits for a human decision (unless auto-approved), then mints and returns the requester's own independent, parent-less room:member grant. */
   private async admitRoomJoin(
     roomPath: string,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
     autoApprove: boolean,
   ): Promise<ManageOutcome> {
     const decision: RoomJoinDecision = autoApprove
@@ -556,7 +560,7 @@ export class RoomProtocol {
    */
   private async handleRoomLeave(
     request: IncomingManageRequest,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ): Promise<ManageOutcome> {
     const roomPath = request.scope.path;
     if (roomPath === undefined) {
diff --git a/src/core/room-router.ts b/src/core/room-router.ts
index b36f9d1..e0919df 100644
--- a/src/core/room-router.ts
+++ b/src/core/room-router.ts
@@ -30,9 +30,9 @@ export function extractMessage(
 
 /** Routes an already-decoded legacy MeshMessage to the matching TransportEvents callback -- moved verbatim from WireMeshTransport's own former route() method. */
 function routeLegacyMessage(
-  handle: ConnectionHandle,
+  handle: Readonly<ConnectionHandle>,
   message: MeshMessage,
-  events: TransportEvents,
+  events: Readonly<TransportEvents>,
 ): void {
   switch (message.method) {
     case "introduce": {
@@ -55,11 +55,29 @@ function routeLegacyMessage(
       return;
     }
     case "connect_request": {
-      // Only ever reaches here if a session was somehow promoted without going through WireMeshTransport's own consumeQuarantined handling of it -- can't happen given every requiresApproval accept path routes through consumeQuarantined first, kept here only so an unrecognised-in-context method fails closed rather than falling to the default onMessage case below.
+      // Only ever reaches here if a session was somehow promoted without going through WireMeshTransport's own consumeQuarantined handling of it -- can't happen given every requiresApproval accept path routes through consumeQuarantined first, kept here only so an unrecognised-in-context method fails closed rather than falling to the onMessage case below.
+      return;
+    }
+    // Every other wire method -- mesh-state gossip (state_sync/state_update/peer_left) and the coordinator-to-coordinator federation methods -- has no dedicated TransportEvents callback and falls to the generic onMessage handler, exactly as the old unconditional default case did.
+    case "state_sync":
+    case "state_update":
+    case "peer_left":
+    case "fed_handshake":
+    case "fed_ack":
+    case "fed_agent_visible":
+    case "fed_agent_gone":
+    case "fed_room_message":
+    case "fed_room_join":
+    case "fed_room_leave":
+    case "fed_ping":
+    case "fed_pong": {
+      events.onMessage(handle, message);
       return;
     }
     default: {
+      // A peer running a newer build can send a wire method this closed union doesn't know about yet -- isMeshMessage's own runtime check only requires a string method field, deliberately looser than MeshMessage's compile-time type, so this branch is reachable at runtime even though every known case above is already covered.
       events.onMessage(handle, message);
+      return;
     }
   }
 }
@@ -74,7 +92,7 @@ function extractParamsVerb(params: unknown): string | undefined {
 /** Handles one already-verified-and-approved incoming request, given its authenticated connection handle. Registered per params.verb (room.send, room.join, ...), never per command.verb (the shared room:member capability every ordinary membership verb rides under) -- see this file's own header comment. */
 export type RoomVerbHandler = (
   request: IncomingManageRequest,
-  handle: ConnectionHandle,
+  handle: Readonly<ConnectionHandle>,
 ) => Promise<ManageOutcome>;
 
 export interface RoomRouterOptions {
@@ -88,19 +106,19 @@ export interface RoomRouter {
   /** Handles one already-received request. Exported for direct unit testing; drainSession below is the thin per-session loop wrapper real callers use. */
   handleRequest: (
     request: IncomingManageRequest,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ) => Promise<void>;
   /** Consumes one session's incomingManageRequests until it ends, dispatching each request via handleRequest. Becomes the single consumer of that iterable from this point on -- the caller must not also iterate the same session's incomingManageRequests itself once this is called. */
   drainSession: (
     session: AcceptedMeshSession,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ) => void;
 }
 
 export function createRoomRouter(options: RoomRouterOptions): RoomRouter {
   async function handleRequest(
     request: IncomingManageRequest,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ): Promise<void> {
     if (request.command.verb === FRAME_VERB) {
       const message = extractMessage(request.command);
diff --git a/src/core/stale-agent-checker.ts b/src/core/stale-agent-checker.ts
index dab0f66..8a64f05 100644
--- a/src/core/stale-agent-checker.ts
+++ b/src/core/stale-agent-checker.ts
@@ -19,7 +19,11 @@ export interface StaleAgentCheckerDeps {
 const PROBE_INTERVAL_MS = 5000;
 
 /** How long an agent may sit "offline" before its record is purged entirely, to prevent indefinite accumulation. */
-const OFFLINE_PURGE_THRESHOLD_MS = 30 * 60 * 1000;
+const OFFLINE_PURGE_THRESHOLD_MINUTES = 30;
+const SECONDS_PER_MINUTE = 60;
+const MS_PER_SECOND = 1000;
+const OFFLINE_PURGE_THRESHOLD_MS =
+  OFFLINE_PURGE_THRESHOLD_MINUTES * SECONDS_PER_MINUTE * MS_PER_SECOND;
 
 export class StaleAgentChecker {
   private timer: ReturnType<typeof setInterval> | undefined;
diff --git a/src/core/store.ts b/src/core/store.ts
index 15bff04..cb144a2 100644
--- a/src/core/store.ts
+++ b/src/core/store.ts
@@ -38,6 +38,12 @@ import type { CommsStore } from "./comms-store.js";
 // CommsError
 // ---------------------------------------------------------------------------
 
+/** Length of the random suffix used for a freshly minted agent id. */
+const AGENT_ID_LENGTH = 8;
+
+/** Length of the random suffix appended to a `<timestamp>-<suffix>` message/event id, to disambiguate ids minted within the same millisecond. */
+const MESSAGE_ID_SUFFIX_LENGTH = 6;
+
 export class CommsError extends Error {
   constructor(
     message: string,
@@ -150,7 +156,7 @@ export class FileStore implements CommsStore {
       });
     }
 
-    const id = nanoid(8);
+    const id = nanoid(AGENT_ID_LENGTH);
     const agent: AgentIdentity = {
       id,
       version: 1,
@@ -190,10 +196,13 @@ export class FileStore implements CommsStore {
     if (!agent)
       throw new CommsError(`Agent ${id} not found`, "AGENT_NOT_FOUND");
 
-    Object.assign(agent, patch);
-    agent.version += 1;
-    await this.writeJsonFile(this.agentPath(id), agent);
-    return agent;
+    const updated: AgentIdentity = {
+      ...agent,
+      ...patch,
+      version: agent.version + 1,
+    };
+    await this.writeJsonFile(this.agentPath(id), updated);
+    return updated;
   }
 
   async listAgents(requesterId: string): Promise<AgentIdentity[]> {
@@ -234,12 +243,14 @@ export class FileStore implements CommsStore {
   // Rooms
   // -------------------------------------------------------------------------
 
-  async createRoom(opts: {
-    name: string;
-    type: RoomType;
-    owner: string;
-    description: string;
-  }): Promise<Room> {
+  async createRoom(
+    opts: Readonly<{
+      name: string;
+      type: RoomType;
+      owner: string;
+      description: string;
+    }>,
+  ): Promise<Room> {
     const id = opts.type === "secret" ? `_${opts.name}` : opts.name;
     const existing = await this.getRoom(id);
     if (existing)
@@ -493,7 +504,7 @@ export class FileStore implements CommsStore {
     if (!room.members.includes(from))
       throw new CommsError(`Not a member of ${roomId}`, "NOT_MEMBER");
 
-    const id = `${String(Date.now())}-${nanoid(6)}`;
+    const id = `${String(Date.now())}-${nanoid(MESSAGE_ID_SUFFIX_LENGTH)}`;
     const message: RoomMessage = {
       id,
       from,
@@ -533,7 +544,7 @@ export class FileStore implements CommsStore {
         const msg = RoomMessageSchema.parse(
           await this.readJsonFile(path.join(dir, file)),
         );
-        if (!since || msg.timestamp > since) {
+        if (since === undefined || msg.timestamp > since) {
           messages.push(msg);
         }
       }
@@ -562,7 +573,7 @@ export class FileStore implements CommsStore {
         throw new CommsError(`Cannot DM agent ${to}`, "AGENT_NOT_FOUND");
     }
 
-    const id = `${String(Date.now())}-${nanoid(6)}`;
+    const id = `${String(Date.now())}-${nanoid(MESSAGE_ID_SUFFIX_LENGTH)}`;
     const message: DmMessage = {
       id,
       from,
@@ -589,7 +600,7 @@ export class FileStore implements CommsStore {
   async deliver(agentId: string, event: DeliveryEvent): Promise<void> {
     const dir = this.deliveryDir(agentId);
     await fs.mkdir(dir, { recursive: true });
-    const id = `${String(Date.now())}-${nanoid(6)}`;
+    const id = `${String(Date.now())}-${nanoid(MESSAGE_ID_SUFFIX_LENGTH)}`;
     await this.writeJsonFile(path.join(dir, `${id}.json`), event);
   }
 
diff --git a/src/core/test/identity.unit.test.ts b/src/core/test/identity.unit.test.ts
index 3a4998d..82271fd 100644
--- a/src/core/test/identity.unit.test.ts
+++ b/src/core/test/identity.unit.test.ts
@@ -11,6 +11,25 @@ import {
   rawPublicKeyFromPrivateKey,
 } from "../identity.js";
 
+/** PEM's own base64 body wrap width (RFC 7468). */
+const PEM_LINE_LENGTH = 64;
+/** SHA-256 = 32 bytes = 64 hex chars + 31 colons = 95 chars. */
+const SHA256_COLON_FINGERPRINT_LENGTH = 95;
+/** The ASN.1 context-specific constructor tag [0] that wraps an X.509 certificate's version field. */
+const X509_VERSION_CONTEXT_TAG = 0xa0;
+/** Length in bytes of the version field's own DER-encoded INTEGER (tag + length + value). */
+const X509_VERSION_FIELD_LENGTH = 0x03;
+/** DER BOOLEAN TRUE. */
+const DER_BOOLEAN_TRUE = 0xff;
+/** How many identities to sample when checking serial numbers aren't collapsing onto one leading byte. */
+const SERIAL_NUMBER_SAMPLE_COUNT = 20;
+/** Days in the certificate validity period. */
+const CERTIFICATE_VALIDITY_DAYS = 365;
+const HOURS_PER_DAY = 24;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const MS_PER_SECOND = 1000;
+
 describe("generateIdentity", () => {
   it("returns a valid PeerIdentity with all required fields", () => {
     const identity = generateIdentity();
@@ -55,16 +74,15 @@ describe("generateIdentity", () => {
 
     expect(bodyLines.length).toBeGreaterThan(1);
     for (const line of bodyLines.slice(0, -1)) {
-      expect(line.length).toBe(64);
+      expect(line.length).toBe(PEM_LINE_LENGTH);
     }
-    expect(bodyLines.at(-1)?.length).toBeLessThanOrEqual(64);
+    expect(bodyLines.at(-1)?.length).toBeLessThanOrEqual(PEM_LINE_LENGTH);
   });
 
   it("produces a fingerprint that is a 95-character SHA-256 hex string with colons", () => {
     const { fingerprint } = generateIdentity();
 
-    // SHA-256 = 32 bytes = 64 hex chars + 31 colons = 95 chars
-    expect(fingerprint.length).toBe(95);
+    expect(fingerprint.length).toBe(SHA256_COLON_FINGERPRINT_LENGTH);
     expect(
       fingerprint,
       "fingerprint should be hex pairs separated by colons",
@@ -115,7 +133,13 @@ describe("generateIdentity", () => {
     const { certificate } = generateIdentity();
     const x509 = new X509Certificate(certificate);
 
-    const versionField = Buffer.from([0xa0, 0x03, 0x02, 0x01, 0x02]);
+    const versionField = Buffer.from([
+      X509_VERSION_CONTEXT_TAG,
+      X509_VERSION_FIELD_LENGTH,
+      0x02,
+      0x01,
+      0x02,
+    ]);
     expect(x509.raw.indexOf(versionField)).toBeGreaterThanOrEqual(0);
   });
 
@@ -123,14 +147,14 @@ describe("generateIdentity", () => {
     // RFC 5280 requires Basic Constraints to be marked critical; a non-critical CA:FALSE constraint is a spec violation that some strict X.509 validators reject outright, even though tls.createServer tolerates it.
     const { certificate } = generateIdentity();
     const x509 = new X509Certificate(certificate);
-    const criticalTrue = Buffer.from([0x01, 0x01, 0xff]);
+    const criticalTrue = Buffer.from([0x01, 0x01, DER_BOOLEAN_TRUE]);
 
     expect(x509.raw.indexOf(criticalTrue)).toBeGreaterThanOrEqual(0);
   });
 
   it("does not systematically force the serial number's leading byte to a fixed value", () => {
     const firstBytes = new Set<string>();
-    for (let i = 0; i < 20; i++) {
+    for (let i = 0; i < SERIAL_NUMBER_SAMPLE_COUNT; i++) {
       const { certificate } = generateIdentity();
       const x509 = new X509Certificate(certificate);
       firstBytes.add(x509.serialNumber.slice(0, 2));
@@ -149,7 +173,22 @@ describe("generateIdentity", () => {
 
     it("encodes notBefore/notAfter as exact zero-padded UTCTime, CERTIFICATE_VALIDITY_MS apart", () => {
       // 2005-03-05T07:08:09Z: every date component below 10 (year%100, month, day, minute) so a missing zero-pad or an off-by-one in month arithmetic shifts the parsed date.
-      const fixedNow = new Date(Date.UTC(2005, 2, 5, 7, 8, 9));
+      const fixedYear = 2005;
+      const fixedMonthIndex = 2; // March (Date.UTC months are 0-indexed)
+      const fixedDay = 5;
+      const fixedHour = 7;
+      const fixedMinute = 8;
+      const fixedSecond = 9;
+      const fixedNow = new Date(
+        Date.UTC(
+          fixedYear,
+          fixedMonthIndex,
+          fixedDay,
+          fixedHour,
+          fixedMinute,
+          fixedSecond,
+        ),
+      );
       vi.useFakeTimers();
       vi.setSystemTime(fixedNow);
 
@@ -166,7 +205,13 @@ describe("generateIdentity", () => {
 
 describe("CERTIFICATE_VALIDITY_MS", () => {
   it("is exactly 365 days in milliseconds", () => {
-    expect(CERTIFICATE_VALIDITY_MS).toBe(365 * 24 * 60 * 60 * 1000);
+    expect(CERTIFICATE_VALIDITY_MS).toBe(
+      CERTIFICATE_VALIDITY_DAYS *
+        HOURS_PER_DAY *
+        MINUTES_PER_HOUR *
+        SECONDS_PER_MINUTE *
+        MS_PER_SECOND,
+    );
   });
 });
 
diff --git a/src/core/tool.ts b/src/core/tool.ts
index 92f8451..a5ca7f2 100644
--- a/src/core/tool.ts
+++ b/src/core/tool.ts
@@ -22,6 +22,28 @@ import type { DiscoveryManager } from "./discovery.js";
 import type { FedLink } from "./federation.js";
 import { CommsError } from "./store.js";
 
+/** Table column widths for the plain-text listing helpers below, chosen to line up with the existing aligned output. */
+const ROOM_TYPE_COLUMN_WIDTH = 7;
+const AGENT_NAME_COLUMN_WIDTH = 25;
+const AGENT_HARNESS_COLUMN_WIDTH = 12;
+const AGENT_STATUS_COLUMN_WIDTH = 7;
+const AGENT_VISIBILITY_COLUMN_WIDTH = 9;
+const INTERFACE_NAME_COLUMN_WIDTH = 12;
+const INTERFACE_FAMILY_COLUMN_WIDTH = 4;
+const LISTENER_HOST_COLUMN_WIDTH = 15;
+const LISTENER_PORT_COLUMN_WIDTH = 6;
+const LISTENER_POLICY_COLUMN_WIDTH = 11;
+
+/** Start/end indices into an ISO-8601 timestamp string ("YYYY-MM-DDTHH:MM:SS.sssZ") that slice out the "HH:MM:SS" portion. */
+const ISO_TIME_START_INDEX = 11;
+const ISO_TIME_END_INDEX = 19;
+
+/** Maximum length of the JSON preview shown for an unrecognised action. */
+const UNKNOWN_ACTION_PREVIEW_LENGTH = 100;
+
+/** Default port the mesh coordinator listens on when advertising with no explicit port given. */
+const DEFAULT_MESH_COORDINATOR_PORT = 19876;
+
 export interface CommsContext {
   agentId: AgentId;
   harness: AgentIdentity["harness"];
@@ -39,34 +61,38 @@ export interface CommsResult {
  * Listener management, federation, and connection approval: transport concerns CommsStore deliberately excludes (see comms-store.ts's own header) since only MeshStore, never FileStore, can support them. Every method here is optional for exactly that reason -- a CommsTool backed by a FileStore simply doesn't have them, and each call site below reports that as an ordinary CommsResult error rather than assuming they exist.
  */
 export interface MeshOnlyFeatures {
-  addListener?(host: string, port: number, policy: string): Promise<string>;
-  removeListener?(id: string): Promise<void>;
-  listListeners?(): ListenerInfo[];
-  getNetworkInterfaces?(): NetworkInterface[];
-  fedConnect?(host: string, port: number, name?: string): Promise<string>;
-  fedDisconnect?(linkId: string): Promise<void>;
-  fedLinks?(): FedLink[];
-  getFederationFingerprint?(): string;
-  fedTrust?(fingerprint: string): Promise<void>;
-  fedUntrust?(fingerprint: string): Promise<void>;
-  fedTrustedFingerprints?(): string[];
-  fedListen?(host: string, port: number): Promise<void>;
-  fedStopListening?(): Promise<void>;
-  acceptConnection?(connectionId: string): Promise<void>;
-  rejectConnection?(connectionId: string, reason: string): Promise<void>;
-  listPendingConnections?(): {
+  addListener?: (host: string, port: number, policy: string) => Promise<string>;
+  removeListener?: (id: string) => Promise<void>;
+  listListeners?: () => ListenerInfo[];
+  getNetworkInterfaces?: () => NetworkInterface[];
+  fedConnect?: (host: string, port: number, name?: string) => Promise<string>;
+  fedDisconnect?: (linkId: string) => Promise<void>;
+  fedLinks?: () => FedLink[];
+  getFederationFingerprint?: () => string;
+  fedTrust?: (fingerprint: string) => Promise<void>;
+  fedUntrust?: (fingerprint: string) => Promise<void>;
+  fedTrustedFingerprints?: () => string[];
+  fedListen?: (host: string, port: number) => Promise<void>;
+  fedStopListening?: () => Promise<void>;
+  acceptConnection?: (connectionId: string) => Promise<void>;
+  rejectConnection?: (connectionId: string, reason: string) => Promise<void>;
+  listPendingConnections?: () => {
     connectionId: string;
     peerId: string;
     dataPort: number;
     name: string;
     fingerprint: string;
   }[];
-  acceptRoomJoin?(roomPath: string, requesterId: string): void;
-  rejectRoomJoin?(roomPath: string, requesterId: string, reason?: string): void;
-  listPendingRoomJoins?(): { roomPath: string; requesterId: string }[];
-  connectToRemote?(host: string, port: number): Promise<void>;
-  setVisibility?(level: MeshVisibility, adapter?: string): Promise<void>;
-  getVisibility?(adapter?: string): MeshVisibility;
+  acceptRoomJoin?: (roomPath: string, requesterId: string) => void;
+  rejectRoomJoin?: (
+    roomPath: string,
+    requesterId: string,
+    reason?: string,
+  ) => void;
+  listPendingRoomJoins?: () => { roomPath: string; requesterId: string }[];
+  connectToRemote?: (host: string, port: number) => Promise<void>;
+  setVisibility?: (level: MeshVisibility, adapter?: string) => Promise<void>;
+  getVisibility?: (adapter?: string) => MeshVisibility;
 }
 
 /** Uniform "this bridge isn't backed by a mesh transport" result for a MeshOnlyFeatures method that isn't present on the current store. */
@@ -77,13 +103,43 @@ function notMeshBacked(action: string): CommsResult {
   };
 }
 
+/** Runs a mesh/federation store call that may throw, converting a thrown error into a CommsResult instead of repeating the same try/catch at every call site. `action` performs the call and returns the success message directly. */
+async function tryMeshAction(
+  verb: string,
+  action: () => Promise<string>,
+): Promise<CommsResult> {
+  try {
+    return { content: await action(), isError: false };
+  } catch (err) {
+    return {
+      content: `Failed to ${verb}: ${err instanceof Error ? err.message : String(err)}`,
+      isError: true,
+    };
+  }
+}
+
+/** Synchronous counterpart to tryMeshAction, for the room-join accept/reject calls, which aren't promise-returning. */
+function trySyncAction(verb: string, action: () => string): CommsResult {
+  try {
+    return { content: action(), isError: false };
+  } catch (err) {
+    return {
+      content: `Failed to ${verb}: ${err instanceof Error ? err.message : String(err)}`,
+      isError: true,
+    };
+  }
+}
+
 export class CommsTool {
   constructor(
     private readonly store: CommsStore & MeshOnlyFeatures,
     private readonly discovery?: DiscoveryManager,
   ) {}
 
-  async handle(ctx: CommsContext, action: CommsAction): Promise<CommsResult> {
+  async handle(
+    ctx: Readonly<CommsContext>,
+    action: CommsAction,
+  ): Promise<CommsResult> {
     try {
       switch (action.action) {
         case "register":
@@ -168,7 +224,7 @@ export class CommsTool {
           return await this.meshFedStopListening(ctx);
         default:
           return {
-            content: `Unknown action: ${JSON.stringify(action).slice(0, 100)}`,
+            content: `Unknown action: ${JSON.stringify(action).slice(0, UNKNOWN_ACTION_PREVIEW_LENGTH)}`,
             isError: true,
           };
       }
@@ -187,7 +243,7 @@ export class CommsTool {
   }
 
   private async register(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "register" },
   ): Promise<CommsResult> {
     const agent = await this.store.registerAgent({
@@ -205,7 +261,7 @@ export class CommsTool {
   }
 
   private async update(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "update" },
   ): Promise<CommsResult> {
     const patch: Partial<
@@ -222,7 +278,7 @@ export class CommsTool {
     };
   }
 
-  private async whoami(ctx: CommsContext): Promise<CommsResult> {
+  private async whoami(ctx: Readonly<CommsContext>): Promise<CommsResult> {
     const agent = await this.store.getAgent(ctx.agentId);
     if (!agent) return { content: "Not registered.", isError: true };
     return {
@@ -240,7 +296,7 @@ export class CommsTool {
   }
 
   private async createRoom(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "create_room" },
   ): Promise<CommsResult> {
     const room = await this.store.createRoom({
@@ -257,14 +313,14 @@ export class CommsTool {
     };
   }
 
-  private async listRooms(ctx: CommsContext): Promise<CommsResult> {
+  private async listRooms(ctx: Readonly<CommsContext>): Promise<CommsResult> {
     const rooms = await this.store.listRooms(ctx.agentId);
     if (rooms.length === 0)
       return { content: "No rooms found.", isError: false };
 
     const lines = rooms.map((r: Room) => {
       const memberFlag = r.members.includes(ctx.agentId) ? "✓" : " ";
-      return `[${memberFlag}] ${r.type.padEnd(7)} ${r.name} (${String(r.members.length)} members) — ${r.description}`;
+      return `[${memberFlag}] ${r.type.padEnd(ROOM_TYPE_COLUMN_WIDTH)} ${r.name} (${String(r.members.length)} members) — ${r.description}`;
     });
     return {
       content: `Rooms ([✓] = joined):\n${lines.join("\n")}`,
@@ -273,7 +329,7 @@ export class CommsTool {
   }
 
   private async joinRoom(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "join_room" },
   ): Promise<CommsResult> {
     const roomId = action.room;
@@ -285,7 +341,7 @@ export class CommsTool {
   }
 
   private async leaveRoom(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "leave_room" },
   ): Promise<CommsResult> {
     await this.store.leaveRoom(action.room, ctx.agentId);
@@ -293,7 +349,7 @@ export class CommsTool {
   }
 
   private async send(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "send" },
   ): Promise<CommsResult> {
     const roomId = action.target;
@@ -311,7 +367,7 @@ export class CommsTool {
   }
 
   private async dm(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "dm" },
   ): Promise<CommsResult> {
     const targetId = action.target;
@@ -327,7 +383,7 @@ export class CommsTool {
     };
   }
 
-  private async listAgents(ctx: CommsContext): Promise<CommsResult> {
+  private async listAgents(ctx: Readonly<CommsContext>): Promise<CommsResult> {
     const agents = await this.store.listAgents(ctx.agentId);
     if (agents.length === 0)
       return { content: "No other agents online.", isError: false };
@@ -343,7 +399,7 @@ export class CommsTool {
       const cwd = abbreviateCwd(a.cwd);
       const rooms =
         a.subscribedRooms.length > 0 ? a.subscribedRooms.join(", ") : "none";
-      return `${a.id}  ${a.name.padEnd(25)} ${a.harness.padEnd(12)} ${a.status.padEnd(7)} ${a.visibility.padEnd(9)} ${cwd}${self}\n        Rooms: ${rooms}`;
+      return `${a.id}  ${a.name.padEnd(AGENT_NAME_COLUMN_WIDTH)} ${a.harness.padEnd(AGENT_HARNESS_COLUMN_WIDTH)} ${a.status.padEnd(AGENT_STATUS_COLUMN_WIDTH)} ${a.visibility.padEnd(AGENT_VISIBILITY_COLUMN_WIDTH)} ${cwd}${self}\n        Rooms: ${rooms}`;
     });
     return {
       content: `Agents:\n  ID      Name                      Harness      Status  Visibility  CWD\n${lines.map((l) => `  ${l}`).join("\n")}`,
@@ -352,7 +408,7 @@ export class CommsTool {
   }
 
   private async readRoom(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "read_room" },
   ): Promise<CommsResult> {
     const roomId = action.room;
@@ -361,14 +417,14 @@ export class CommsTool {
       return { content: "No messages.", isError: false };
 
     const lines = messages.map((m: RoomMessage) => {
-      const time = m.timestamp.slice(11, 19);
+      const time = m.timestamp.slice(ISO_TIME_START_INDEX, ISO_TIME_END_INDEX);
       return `[${time}] ${m.from}: ${m.content}`;
     });
     return { content: lines.join("\n"), isError: false };
   }
 
   private async invite(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "invite" },
   ): Promise<CommsResult> {
     await this.store.inviteToRoom(action.room, action.agent, ctx.agentId);
@@ -379,7 +435,7 @@ export class CommsTool {
   }
 
   private async declineInvite(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "decline_invite" },
   ): Promise<CommsResult> {
     await this.store.declineInvite(action.room, ctx.agentId, action.reason);
@@ -390,7 +446,7 @@ export class CommsTool {
   }
 
   private async kick(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "kick" },
   ): Promise<CommsResult> {
     await this.store.kickFromRoom(action.room, action.agent, ctx.agentId);
@@ -401,7 +457,7 @@ export class CommsTool {
   }
 
   private async destroyRoom(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "destroy_room" },
   ): Promise<CommsResult> {
     await this.store.destroyRoom(action.room, ctx.agentId);
@@ -432,7 +488,7 @@ export class CommsTool {
   }
 
   private async meshAdvertise(
-    ctx: CommsContext,
+    ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_advertise" },
   ): Promise<CommsResult> {
     if (!this.discovery) {
@@ -442,7 +498,7 @@ export class CommsTool {
       };
     }
     // Default to the mesh coordinator port if not specified
-    const port = action.port ?? 19876;
+    const port = action.port ?? DEFAULT_MESH_COORDINATOR_PORT;
     const opts: { name: string; port: number; adapter?: string } = {
       name: action.name,
       port,
@@ -462,9 +518,9 @@ export class CommsTool {
     if (interfaces.length === 0)
       return { content: "No network interfaces found.", isError: false };
 
-    const lines = interfaces.map((iface: NetworkInterface) => {
+    const lines = interfaces.map((iface: Readonly<NetworkInterface>) => {
       const internal = iface.internal ? " (internal)" : "";
-      return `${iface.name.padEnd(12)} ${iface.family.padEnd(4)} ${iface.address}${internal}`;
+      return `${iface.name.padEnd(INTERFACE_NAME_COLUMN_WIDTH)} ${iface.family.padEnd(INTERFACE_FAMILY_COLUMN_WIDTH)} ${iface.address}${internal}`;
     });
     return {
       content: `Interfaces:\n${lines.join("\n")}`,
@@ -486,7 +542,7 @@ export class CommsTool {
   }
 
   private async meshListen(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_listen" },
   ): Promise<CommsResult> {
     const policy = action.policy ?? "full";
@@ -498,49 +554,34 @@ export class CommsTool {
       };
     }
     if (!this.store.addListener) return notMeshBacked("mesh_listen");
-    try {
-      const id = await this.store.addListener(
-        action.host,
-        action.port ?? 0,
-        policy,
-      );
-      return {
-        content: `Listener added: ${id} on ${action.host}${String(action.port ?? "auto")} with policy ${policy}.`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to add listener: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const addListener = this.store.addListener.bind(this.store);
+    return tryMeshAction("add listener", async () => {
+      const id = await addListener(action.host, action.port ?? 0, policy);
+      return `Listener added: ${id} on ${action.host}${String(action.port ?? "auto")} with policy ${policy}.`;
+    });
   }
 
   private async meshUnlisten(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_unlisten" },
   ): Promise<CommsResult> {
     if (!this.store.removeListener) return notMeshBacked("mesh_unlisten");
-    try {
-      await this.store.removeListener(action.id);
-      return { content: `Listener ${action.id} removed.`, isError: false };
-    } catch (err) {
-      return {
-        content: `Failed to remove listener: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const removeListener = this.store.removeListener.bind(this.store);
+    return tryMeshAction("remove listener", async () => {
+      await removeListener(action.id);
+      return `Listener ${action.id} removed.`;
+    });
   }
 
-  private meshListeners(_ctx: CommsContext): CommsResult {
+  private meshListeners(_ctx: Readonly<CommsContext>): CommsResult {
     if (!this.store.listListeners) return notMeshBacked("mesh_listeners");
     const listeners = this.store.listListeners();
     if (listeners.length === 0)
       return { content: "No listeners (not coordinator).", isError: false };
 
-    const lines = listeners.map((l: ListenerInfo) => {
+    const lines = listeners.map((l: Readonly<ListenerInfo>) => {
       const flag = l.isDefault ? " (default)" : "";
-      return `${l.id}  ${l.host.padEnd(15)} ${String(l.port).padEnd(6)} ${l.policy.padEnd(11)}${flag}`;
+      return `${l.id}  ${l.host.padEnd(LISTENER_HOST_COLUMN_WIDTH)} ${String(l.port).padEnd(LISTENER_PORT_COLUMN_WIDTH)} ${l.policy.padEnd(LISTENER_POLICY_COLUMN_WIDTH)}${flag}`;
     });
     return {
       content: `Listeners:\n  ID      Host             Port   Policy      \n${lines.map((l) => `  ${l}`).join("\n")}`,
@@ -558,7 +599,8 @@ export class CommsTool {
       };
     }
     await this.store.setVisibility(action.visibility, action.adapter);
-    const adapter = action.adapter ? ` on adapter "${action.adapter}"` : "";
+    const adapter =
+      action.adapter !== undefined ? ` on adapter "${action.adapter}"` : "";
     return {
       content: `Mesh visibility set to "${action.visibility}"${adapter}.`,
       isError: false,
@@ -582,86 +624,54 @@ export class CommsTool {
   }
 
   private async meshFedConnect(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_fed_connect" },
   ): Promise<CommsResult> {
     if (!this.store.fedConnect) return notMeshBacked("mesh_fed_connect");
-    try {
-      const linkId = await this.store.fedConnect(
-        action.host,
-        action.port,
-        action.name,
-      );
-      return {
-        content: `Federation link established: ${linkId} to ${action.host}:${String(action.port)}`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to establish federation link: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const fedConnect = this.store.fedConnect.bind(this.store);
+    return tryMeshAction("establish federation link", async () => {
+      const linkId = await fedConnect(action.host, action.port, action.name);
+      return `Federation link established: ${linkId} to ${action.host}:${String(action.port)}`;
+    });
   }
 
   private async meshConnect(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_connect" },
   ): Promise<CommsResult> {
     if (!this.store.connectToRemote) return notMeshBacked("mesh_connect");
-    try {
-      await this.store.connectToRemote(action.host, action.port);
-      return {
-        content: `Connection request sent to ${action.host}:${String(action.port)}.`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to connect: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const connectToRemote = this.store.connectToRemote.bind(this.store);
+    return tryMeshAction("connect", async () => {
+      await connectToRemote(action.host, action.port);
+      return `Connection request sent to ${action.host}:${String(action.port)}.`;
+    });
   }
 
   private async meshFedDisconnect(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_fed_disconnect" },
   ): Promise<CommsResult> {
     if (!this.store.fedDisconnect) return notMeshBacked("mesh_fed_disconnect");
-    try {
-      await this.store.fedDisconnect(action.linkId);
-      return {
-        content: `Federation link ${action.linkId} closed.`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to close federation link: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const fedDisconnect = this.store.fedDisconnect.bind(this.store);
+    return tryMeshAction("close federation link", async () => {
+      await fedDisconnect(action.linkId);
+      return `Federation link ${action.linkId} closed.`;
+    });
   }
 
   private async meshAccept(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_accept" },
   ): Promise<CommsResult> {
     if (!this.store.acceptConnection) return notMeshBacked("mesh_accept");
-    try {
-      await this.store.acceptConnection(action.connectionId);
-      return {
-        content: `Accepted connection ${action.connectionId}.`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to accept: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const acceptConnection = this.store.acceptConnection.bind(this.store);
+    return tryMeshAction("accept", async () => {
+      await acceptConnection(action.connectionId);
+      return `Accepted connection ${action.connectionId}.`;
+    });
   }
 
-  private meshFedLinks(_ctx: CommsContext): CommsResult {
+  private meshFedLinks(_ctx: Readonly<CommsContext>): CommsResult {
     if (!this.store.fedLinks) return notMeshBacked("mesh_fed_links");
     const links = this.store.fedLinks();
     if (links.length === 0)
@@ -677,7 +687,7 @@ export class CommsTool {
     };
   }
 
-  private meshFedFingerprint(_ctx: CommsContext): CommsResult {
+  private meshFedFingerprint(_ctx: Readonly<CommsContext>): CommsResult {
     if (!this.store.getFederationFingerprint)
       return notMeshBacked("mesh_fed_fingerprint");
     const fingerprint = this.store.getFederationFingerprint();
@@ -688,44 +698,30 @@ export class CommsTool {
   }
 
   private async meshFedTrust(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_fed_trust" },
   ): Promise<CommsResult> {
     if (!this.store.fedTrust) return notMeshBacked("mesh_fed_trust");
-    try {
-      await this.store.fedTrust(action.fingerprint);
-      return {
-        content: `Trusted federation fingerprint: ${action.fingerprint}`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to trust fingerprint: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const fedTrust = this.store.fedTrust.bind(this.store);
+    return tryMeshAction("trust fingerprint", async () => {
+      await fedTrust(action.fingerprint);
+      return `Trusted federation fingerprint: ${action.fingerprint}`;
+    });
   }
 
   private async meshFedUntrust(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_fed_untrust" },
   ): Promise<CommsResult> {
     if (!this.store.fedUntrust) return notMeshBacked("mesh_fed_untrust");
-    try {
-      await this.store.fedUntrust(action.fingerprint);
-      return {
-        content: `Untrusted federation fingerprint: ${action.fingerprint}`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to untrust fingerprint: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const fedUntrust = this.store.fedUntrust.bind(this.store);
+    return tryMeshAction("untrust fingerprint", async () => {
+      await fedUntrust(action.fingerprint);
+      return `Untrusted federation fingerprint: ${action.fingerprint}`;
+    });
   }
 
-  private meshFedTrusted(_ctx: CommsContext): CommsResult {
+  private meshFedTrusted(_ctx: Readonly<CommsContext>): CommsResult {
     if (!this.store.fedTrustedFingerprints)
       return notMeshBacked("mesh_fed_trusted");
     const fingerprints = this.store.fedTrustedFingerprints();
@@ -738,61 +734,42 @@ export class CommsTool {
   }
 
   private async meshFedListen(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_fed_listen" },
   ): Promise<CommsResult> {
     if (!this.store.fedListen) return notMeshBacked("mesh_fed_listen");
-    try {
-      await this.store.fedListen(action.host, action.port);
-      return {
-        content: `Listening for inbound federation links on ${action.host}:${String(action.port)}. Only connections presenting a trusted fingerprint (mesh_fed_trust) will be accepted.`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to start federation listener: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const fedListen = this.store.fedListen.bind(this.store);
+    return tryMeshAction("start federation listener", async () => {
+      await fedListen(action.host, action.port);
+      return `Listening for inbound federation links on ${action.host}:${String(action.port)}. Only connections presenting a trusted fingerprint (mesh_fed_trust) will be accepted.`;
+    });
   }
 
-  private async meshFedStopListening(_ctx: CommsContext): Promise<CommsResult> {
+  private async meshFedStopListening(
+    _ctx: Readonly<CommsContext>,
+  ): Promise<CommsResult> {
     if (!this.store.fedStopListening)
       return notMeshBacked("mesh_fed_stop_listening");
-    try {
-      await this.store.fedStopListening();
-      return {
-        content: "Stopped accepting inbound federation connections.",
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to stop federation listener: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const fedStopListening = this.store.fedStopListening.bind(this.store);
+    return tryMeshAction("stop federation listener", async () => {
+      await fedStopListening();
+      return "Stopped accepting inbound federation connections.";
+    });
   }
 
   private async meshReject(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "mesh_reject" },
   ): Promise<CommsResult> {
     if (!this.store.rejectConnection) return notMeshBacked("mesh_reject");
-    try {
-      await this.store.rejectConnection(action.connectionId, action.reason);
-      return {
-        content: `Rejected connection ${action.connectionId}: ${action.reason}`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to reject: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const rejectConnection = this.store.rejectConnection.bind(this.store);
+    return tryMeshAction("reject", async () => {
+      await rejectConnection(action.connectionId, action.reason);
+      return `Rejected connection ${action.connectionId}: ${action.reason}`;
+    });
   }
 
-  private meshPending(_ctx: CommsContext): CommsResult {
+  private meshPending(_ctx: Readonly<CommsContext>): CommsResult {
     if (!this.store.listPendingConnections)
       return notMeshBacked("mesh_pending");
     const pending = this.store.listPendingConnections();
@@ -810,44 +787,30 @@ export class CommsTool {
   }
 
   private roomAccept(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "room_accept" },
   ): CommsResult {
     if (!this.store.acceptRoomJoin) return notMeshBacked("room_accept");
-    try {
-      this.store.acceptRoomJoin(action.room, action.requesterId);
-      return {
-        content: `Accepted ${action.requesterId}'s request to join ${action.room}.`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to accept: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const acceptRoomJoin = this.store.acceptRoomJoin.bind(this.store);
+    return trySyncAction("accept", () => {
+      acceptRoomJoin(action.room, action.requesterId);
+      return `Accepted ${action.requesterId}'s request to join ${action.room}.`;
+    });
   }
 
   private roomReject(
-    _ctx: CommsContext,
+    _ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "room_reject" },
   ): CommsResult {
     if (!this.store.rejectRoomJoin) return notMeshBacked("room_reject");
-    try {
-      this.store.rejectRoomJoin(action.room, action.requesterId, action.reason);
-      return {
-        content: `Rejected ${action.requesterId}'s request to join ${action.room}.`,
-        isError: false,
-      };
-    } catch (err) {
-      return {
-        content: `Failed to reject: ${err instanceof Error ? err.message : String(err)}`,
-        isError: true,
-      };
-    }
+    const rejectRoomJoin = this.store.rejectRoomJoin.bind(this.store);
+    return trySyncAction("reject", () => {
+      rejectRoomJoin(action.room, action.requesterId, action.reason);
+      return `Rejected ${action.requesterId}'s request to join ${action.room}.`;
+    });
   }
 
-  private roomPending(_ctx: CommsContext): CommsResult {
+  private roomPending(_ctx: Readonly<CommsContext>): CommsResult {
     if (!this.store.listPendingRoomJoins) return notMeshBacked("room_pending");
     const pending = this.store.listPendingRoomJoins();
     if (pending.length === 0)
diff --git a/src/core/transport.ts b/src/core/transport.ts
index 2ae57bf..f284171 100644
--- a/src/core/transport.ts
+++ b/src/core/transport.ts
@@ -60,79 +60,76 @@ export interface ConnectionHandle {
 
 export interface TransportEvents {
   /**
-   * A wire message was received from a peer.
-   * Called for every complete message after framing.
+   * A wire message was received from a peer. Called for every complete message after framing.
    */
-  onMessage(handle: ConnectionHandle, message: MeshMessage): void;
+  onMessage: (handle: Readonly<ConnectionHandle>, message: MeshMessage) => void;
 
   /**
-   * A new data connection was established and the peer identified itself
-   * via a pong message. MeshStore should wire up state handling for this peer.
+   * A new data connection was established and the peer identified itself via a pong message. MeshStore should wire up state handling for this peer.
    */
-  onPeerConnected(handle: ConnectionHandle, info: PeerInfo): void;
+  onPeerConnected: (
+    handle: Readonly<ConnectionHandle>,
+    info: Readonly<PeerInfo>,
+  ) => void;
 
   /**
    * A peer connection was lost (close, error, or timeout).
    */
-  onPeerDisconnected(handle: ConnectionHandle): void;
+  onPeerDisconnected: (handle: Readonly<ConnectionHandle>) => void;
 
   /**
    * A non-fatal error occurred that consumers should know about.
    */
-  onError?(error: Error): void;
+  onError?: (error: Error) => void;
 
   /**
-   * A peer introduced itself to the coordinator.
-   * Only fires on the coordinator instance.
-   * MeshStore should send the peer list and broadcast the arrival.
+   * A peer introduced itself to the coordinator. Only fires on the coordinator instance. MeshStore should send the peer list and broadcast the arrival.
    */
-  onIntroduction(
-    handle: ConnectionHandle,
-    msg: { peerId: string; dataPort: number },
-  ): void;
+  onIntroduction: (
+    handle: Readonly<ConnectionHandle>,
+    msg: Readonly<{ peerId: string; dataPort: number }>,
+  ) => void;
 
   /**
-   * A new peer introduced itself and is awaiting approval.
-   * Replaces onIntroduction when connection approval is active.
-   * Only fires on the coordinator instance.
-   * MeshStore should queue the request and deliver a connection_request
-   * event to the owning agent.
+   * A new peer introduced itself and is awaiting approval. Replaces onIntroduction when connection approval is active. Only fires on the coordinator instance. MeshStore should queue the request and deliver a connection_request event to the owning agent.
    */
-  onConnectionRequest(
-    handle: ConnectionHandle,
-    info: {
+  onConnectionRequest: (
+    handle: Readonly<ConnectionHandle>,
+    info: Readonly<{
       peerId: string;
       dataPort: number;
       name: string;
       fingerprint: string;
-    },
-  ): void;
+    }>,
+  ) => void;
 
   /**
-   * The coordinator sent us a peer list (received during initial connection).
-   * MeshStore should connect to each peer's data server.
+   * The coordinator sent us a peer list (received during initial connection). MeshStore should connect to each peer's data server.
    */
-  onPeerList(peers: PeerInfo[]): void;
+  onPeerList: (peers: readonly PeerInfo[]) => void;
 
   /**
    * The coordinator told us a new peer joined.
    */
-  onPeerJoined(peer: PeerInfo): void;
+  onPeerJoined: (peer: Readonly<PeerInfo>) => void;
 
   /**
    * We received a become_coordinator message — take over as coordinator.
    */
-  onBecomeCoordinator(peerList: PeerInfo[]): void;
+  onBecomeCoordinator: (peerList: readonly PeerInfo[]) => void;
 
   /**
    * A peer announced one already-minted revocation-entry over an established session (management.cddl's revocation-announce, flattened to one call per entry). MeshStore should verify it and, if it verifies, record it in its own RevocationView -- a bearer's already-issued token stays valid to every peer that never received this until it does, per the design's own honest "detection with propagation delay" limit.
    */
-  onRevocationAnnounce(entry: RevocationEntry): void;
+  onRevocationAnnounce: (entry: RevocationEntry) => void;
 
   /**
    * A peer's gossiped self-advert carried a `presence/status` extension (wire-mesh-core's peer-advert open extension tail, re-sent periodically via sendGossipUpdate). Fires only when that key is present and a recognised AgentStatus value -- an advert with no presence extension, or an unrecognised value, is a peer that simply isn't advertising presence over this mechanism, not an error.
    */
-  onPresenceAdvert(handle: ConnectionHandle, status: AgentStatus): void;
+  onPresenceAdvert: (
+    handle: Readonly<ConnectionHandle>,
+    status: AgentStatus,
+  ) => void;
 }
 
 // ---------------------------------------------------------------------------
@@ -153,113 +150,105 @@ export interface MeshTransport {
    * Start the data server on an OS-assigned port.
    * Resolves when the server is listening.
    */
-  startDataServer(): Promise<void>;
+  startDataServer: () => Promise<void>;
 
   /**
-   * Connect to the coordinator at the given host:port and send an
-   * introduction message. Resolves when the connection is established
-   * and the introduction has been sent.
-   * Rejects if no coordinator is reachable (caller should becomeCoordinator).
+   * Connect to the coordinator at the given host:port and send an introduction message. Resolves when the connection is established and the introduction has been sent. Rejects if no coordinator is reachable (caller should becomeCoordinator).
    */
-  connectToCoordinator(
+  connectToCoordinator: (
     host: string,
     port: number,
     peerId: string,
     dataPort: number,
-  ): Promise<void>;
+  ) => Promise<void>;
 
   /**
-   * Start listening as the coordinator on the given host:port.
-   * Resolves when the coordinator server is listening.
+   * Start listening as the coordinator on the given host:port. Resolves when the coordinator server is listening.
    */
-  becomeCoordinator(host: string, port: number): Promise<void>;
+  becomeCoordinator: (host: string, port: number) => Promise<void>;
 
   /**
-   * Connect to a peer's data server and send a pong identification.
-   * Resolves when the connection is established and pong sent.
-   * No-op if already connected to this peer.
+   * Connect to a peer's data server and send a pong identification. Resolves when the connection is established and pong sent. No-op if already connected to this peer.
    */
-  connectToPeer(peer: PeerInfo, ownPeerId: string): Promise<void>;
+  connectToPeer: (peer: Readonly<PeerInfo>, ownPeerId: string) => Promise<void>;
 
   /**
    * Send a wire message to a specific peer connection.
    */
-  send(handle: ConnectionHandle, message: MeshMessage): Promise<void>;
+  send: (
+    handle: Readonly<ConnectionHandle>,
+    message: MeshMessage,
+  ) => Promise<void>;
 
   /**
-   * Accept a pending connection. Sends connect_accepted and processes
-   * the introduction as normal (peer_list, peer_joined broadcast).
+   * Accept a pending connection. Sends connect_accepted and processes the introduction as normal (peer_list, peer_joined broadcast).
    */
-  acceptConnection(handle: ConnectionHandle): Promise<void>;
+  acceptConnection: (handle: Readonly<ConnectionHandle>) => Promise<void>;
 
   /**
    * Reject a pending connection. Sends connect_rejected and closes the socket.
    */
-  rejectConnection(handle: ConnectionHandle, reason: string): Promise<void>;
+  rejectConnection: (
+    handle: Readonly<ConnectionHandle>,
+    reason: string,
+  ) => Promise<void>;
 
   /**
-   * Initiate an outbound connection that requires approval.
-   * Sends connect_request instead of introduce and waits for
-   * connect_accepted or connect_rejected from the remote coordinator.
+   * Initiate an outbound connection that requires approval. Sends connect_request instead of introduce and waits for connect_accepted or connect_rejected from the remote coordinator.
    */
-  connectToRemote(
+  connectToRemote: (
     host: string,
     port: number,
     peerId: string,
     dataPort: number,
     name: string,
     fingerprint: string,
-  ): Promise<void>;
+  ) => Promise<void>;
 
   /**
    * Broadcast a wire message to all connected peer data connections.
    */
-  broadcast(message: MeshMessage): Promise<void>;
+  broadcast: (message: MeshMessage) => Promise<void>;
 
   /**
    * Announces one or more already-minted revocation-entries to every connected peer session, best-effort (an unreachable peer misses it and learns of the revocation later, if ever -- the same honest gossip-propagation-delay limit every other broadcast in this codebase already accepts).
    */
-  broadcastRevocation(entries: readonly RevocationEntry[]): Promise<void>;
+  broadcastRevocation: (entries: readonly RevocationEntry[]) => Promise<void>;
 
   /**
    * Sends a real core/room manage-request to a specific member's own established session, returning its outcome (e.g. a room.join request's granted-token, or a room.send's delivery receipt) rather than swallowing it the way send() does for the legacy opaque-frame path. Resolves to a not_connected error outcome if no live session to that member exists, rather than throwing -- the caller (currently room-join, and P3.5's directed fan-out once it lands) decides how to react to an unreachable member.
    */
-  sendRoomRequest(
+  sendRoomRequest: (
     memberId: string,
     command: ManageCommand,
     scope: Readonly<CapabilityScope>,
     token?: CapabilityToken,
-  ): Promise<ManageOutcome>;
+  ) => Promise<ManageOutcome>;
 
   /**
-   * Add a coordinator listener on a specific adapter.
-   * Only valid when this instance is the coordinator.
-   * Returns listener ID.
+   * Add a coordinator listener on a specific adapter. Only valid when this instance is the coordinator. Returns listener ID.
    */
-  addListener(
+  addListener: (
     host: string,
     port: number,
     policy: ListenerPolicy,
-  ): Promise<string>;
+  ) => Promise<string>;
 
   /**
    * Remove a listener by ID. Cannot remove the default localhost listener.
    */
-  removeListener(id: string): Promise<void>;
+  removeListener: (id: string) => Promise<void>;
 
   /** List all active listeners. */
-  listListeners(): ListenerInfo[];
+  listListeners: () => ListenerInfo[];
 
   /**
-   * Gracefully shut down all servers and connections.
-   * After shutdown, no further callbacks will fire.
+   * Gracefully shut down all servers and connections. After shutdown, no further callbacks will fire.
    */
-  shutdown(): Promise<void>;
+  shutdown: () => Promise<void>;
 
   /**
-   * Unref all root handles so the event loop can exit when the
-   * agent process shuts down. Sockets still function for I/O but
-   * don't keep the process alive.
+   * Unref all root handles so the event loop can exit when the agent process shuts down. Sockets still function for I/O but don't keep the process alive.
    */
-  unref(): void;
+  unref: () => void;
 }
diff --git a/src/core/types.ts b/src/core/types.ts
index 3de34a6..724dd7d 100644
--- a/src/core/types.ts
+++ b/src/core/types.ts
@@ -12,12 +12,27 @@ import { z } from "zod";
 // Schema-attached type guard helper
 // ---------------------------------------------------------------------------
 
-function defineSchema<T extends z.ZodType>(schema: T) {
-  return Object.assign(schema, {
-    is(value: unknown): value is z.infer<T> {
-      return schema.safeParse(value).success;
-    },
+/** Narrows `value` to a schema already carrying an `is` guard -- used only to recover the type Object.defineProperty's own signature can't express, immediately after defineSchema has just added that exact property below. */
+function hasIsGuard<T extends z.ZodType>(
+  value: T,
+): value is T & { is: (v: unknown) => v is z.infer<T> } {
+  if (!("is" in value)) return false;
+  return typeof value.is === "function";
+}
+
+/** Attaches a type-guard `.is` method directly onto the given schema (mutating it in place, never copying it) and returns that same reference. Mutation in place is load-bearing: Zod v4 schemas carry their `.parse`/`.safeParse`/internal brand as own instance properties rather than prototype methods, so spreading into a fresh object (`{ ...schema, is }`) silently strips the brand `z.object()` checks for when this schema is nested as another schema's property value -- confirmed directly: a spread-built schema is rejected with "expected a Zod schema" the moment it's used as a nested property. */
+function defineSchema<T extends z.ZodType>(
+  schema: T,
+): T & { is: (value: unknown) => value is z.infer<T> } {
+  Object.defineProperty(schema, "is", {
+    value: (value: unknown): value is z.infer<T> =>
+      schema.safeParse(value).success,
+    enumerable: true,
   });
+  if (!hasIsGuard(schema)) {
+    throw new Error("unreachable: is was just defined above");
+  }
+  return schema;
 }
 
 // ---------------------------------------------------------------------------
@@ -34,17 +49,20 @@ export type RoomId = string;
 // Enums
 // ---------------------------------------------------------------------------
 
-export const MeshVisibility = defineSchema(
+// Each enum's schema is declared under a `Schema` suffix and re-exported under its bare name (matching this file's own object-schema convention) rather than sharing one identifier between the const and the inferred type -- @typescript-eslint/no-redeclare's `ignoreDeclarationMerge` allowlist covers interface/namespace/class/function/enum merges but not a value binding and a type alias sharing a name, so the two need genuinely distinct local identifiers. The re-export alias keeps the public name (and therefore every existing `import { X }` / `import type { X }` call site across the codebase) completely unchanged.
+const MeshVisibilitySchema = defineSchema(
   z.union([z.literal("discoverable"), z.literal("quiet"), z.literal("dark")]),
 );
-export type MeshVisibility = z.infer<typeof MeshVisibility>;
+export type MeshVisibility = z.infer<typeof MeshVisibilitySchema>;
+export { MeshVisibilitySchema as MeshVisibility };
 
-export const Visibility = defineSchema(
+const VisibilitySchema = defineSchema(
   z.union([z.literal("visible"), z.literal("hidden"), z.literal("ghost")]),
 );
-export type Visibility = z.infer<typeof Visibility>;
+export type Visibility = z.infer<typeof VisibilitySchema>;
+export { VisibilitySchema as Visibility };
 
-export const AgentStatus = defineSchema(
+const AgentStatusSchema = defineSchema(
   z.union([
     z.literal("active"),
     z.literal("idle"),
@@ -52,17 +70,20 @@ export const AgentStatus = defineSchema(
     z.literal("offline"),
   ]),
 );
-export type AgentStatus = z.infer<typeof AgentStatus>;
+export type AgentStatus = z.infer<typeof AgentStatusSchema>;
+export { AgentStatusSchema as AgentStatus };
 
-export const RoomType = defineSchema(
+const RoomTypeSchema = defineSchema(
   z.union([z.literal("public"), z.literal("private"), z.literal("secret")]),
 );
-export type RoomType = z.infer<typeof RoomType>;
+export type RoomType = z.infer<typeof RoomTypeSchema>;
+export { RoomTypeSchema as RoomType };
 
-export const StreamingBehavior = defineSchema(
+const StreamingBehaviorSchema = defineSchema(
   z.union([z.literal("steer"), z.literal("followUp"), z.literal("info")]),
 );
-export type StreamingBehavior = z.infer<typeof StreamingBehavior>;
+export type StreamingBehavior = z.infer<typeof StreamingBehaviorSchema>;
+export { StreamingBehaviorSchema as StreamingBehavior };
 
 // ---------------------------------------------------------------------------
 // AgentIdentity
@@ -78,8 +99,8 @@ export const AgentIdentitySchema = defineSchema(
     cwd: z.string(),
     pid: z.number(),
     startedAt: z.string(),
-    visibility: Visibility,
-    status: AgentStatus,
+    visibility: VisibilitySchema,
+    status: AgentStatusSchema,
     tags: z.array(z.string()),
     subscribedRooms: z.array(z.string()),
   }),
@@ -96,7 +117,7 @@ export const RoomSchema = defineSchema(
     /** Monotonic revision, bumped by the mutating store; sync merges take the higher value. */
     version: z.number(),
     name: z.string(),
-    type: RoomType,
+    type: RoomTypeSchema,
     owner: z.string(),
     createdAt: z.string(),
     description: z.string(),
@@ -132,7 +153,7 @@ export const RoomMessageSchema = defineSchema(
     timestamp: z.string(),
     replyTo: z.string().optional(),
     readBy: z.array(z.string()),
-    streamingBehavior: StreamingBehavior.optional(),
+    streamingBehavior: StreamingBehaviorSchema.optional(),
   }),
 );
 export type RoomMessage = z.infer<typeof RoomMessageSchema>;
@@ -145,15 +166,16 @@ export const DmMessageSchema = defineSchema(
     content: z.string(),
     timestamp: z.string(),
     readBy: z.array(z.string()),
-    streamingBehavior: StreamingBehavior.optional(),
+    streamingBehavior: StreamingBehaviorSchema.optional(),
   }),
 );
 export type DmMessage = z.infer<typeof DmMessageSchema>;
 
-export const DeliveryStatus = defineSchema(
+const DeliveryStatusSchema = defineSchema(
   z.union([z.literal("delivered"), z.literal("read")]),
 );
-export type DeliveryStatus = z.infer<typeof DeliveryStatus>;
+export type DeliveryStatus = z.infer<typeof DeliveryStatusSchema>;
+export { DeliveryStatusSchema as DeliveryStatus };
 
 // ---------------------------------------------------------------------------
 // Delivery events
@@ -163,7 +185,7 @@ export const RoomMemberSchema = defineSchema(
   z.object({
     id: z.string(),
     name: z.string(),
-    status: AgentStatus,
+    status: AgentStatusSchema,
   }),
 );
 export type RoomMember = z.infer<typeof RoomMemberSchema>;
@@ -205,13 +227,13 @@ export const DeliveryEventSchema = defineSchema(
       type: z.literal("member_status"),
       room: z.string(),
       agent: z.string(),
-      status: AgentStatus,
+      status: AgentStatusSchema,
     }),
     z.object({
       type: z.literal("delivery_status"),
       messageId: z.string(),
       agent: z.string(),
-      status: DeliveryStatus,
+      status: DeliveryStatusSchema,
       room: z.string().optional(),
     }),
     z.object({
@@ -259,13 +281,13 @@ export const CommsActionSchema = defineSchema(
     z.object({
       action: z.literal("register"),
       name: z.string(),
-      visibility: Visibility,
+      visibility: VisibilitySchema,
       tags: z.array(z.string()),
     }),
     z.object({
       action: z.literal("update"),
-      visibility: Visibility.optional(),
-      status: AgentStatus.optional(),
+      visibility: VisibilitySchema.optional(),
+      status: AgentStatusSchema.optional(),
       name: z.string().optional(),
       tags: z.array(z.string()).optional(),
     }),
@@ -273,7 +295,7 @@ export const CommsActionSchema = defineSchema(
     z.object({
       action: z.literal("create_room"),
       name: z.string(),
-      type: RoomType,
+      type: RoomTypeSchema,
       description: z.string(),
     }),
     z.object({ action: z.literal("list_rooms") }),
@@ -290,13 +312,13 @@ export const CommsActionSchema = defineSchema(
       target: z.string(),
       content: z.string(),
       replyTo: z.string().optional(),
-      streamingBehavior: StreamingBehavior.optional(),
+      streamingBehavior: StreamingBehaviorSchema.optional(),
     }),
     z.object({
       action: z.literal("dm"),
       target: z.string(),
       content: z.string(),
-      streamingBehavior: StreamingBehavior.optional(),
+      streamingBehavior: StreamingBehaviorSchema.optional(),
     }),
     z.object({ action: z.literal("list_agents") }),
     z.object({
@@ -380,7 +402,7 @@ export const CommsActionSchema = defineSchema(
     z.object({ action: z.literal("mesh_listeners") }),
     z.object({
       action: z.literal("mesh_set_visibility"),
-      visibility: MeshVisibility,
+      visibility: MeshVisibilitySchema,
       adapter: z.string().optional(),
     }),
     z.object({ action: z.literal("mesh_get_visibility") }),
diff --git a/src/core/vapid.ts b/src/core/vapid.ts
index c6e8a4a..6443e0c 100644
--- a/src/core/vapid.ts
+++ b/src/core/vapid.ts
@@ -25,6 +25,12 @@ export interface VapidKeys {
 
 let cachedKeys: VapidKeys | undefined;
 
+/** Length in bytes of an uncompressed P-256 public key point (0x04 prefix + 32-byte X + 32-byte Y). */
+const P256_PUBLIC_KEY_BYTES = 65;
+
+/** Length in bytes of a P-256 private scalar. */
+const P256_PRIVATE_KEY_BYTES = 32;
+
 // ---------------------------------------------------------------------------
 // Implementation
 // ---------------------------------------------------------------------------
@@ -46,13 +52,17 @@ export function generateVapidKeys(): VapidKeys {
   // Export public key as raw DER, extract the 65-byte uncompressed point.
   // SPKI DER for P-256 has a 26-byte header before the 65-byte point.
   const pubDer = publicKey.export({ type: "spki", format: "der" });
-  const publicKeyBuffer = pubDer.subarray(pubDer.length - 65);
+  const publicKeyBuffer = pubDer.subarray(
+    pubDer.length - P256_PUBLIC_KEY_BYTES,
+  );
 
   // Export private key as PKCS8 DER, extract the 32-byte private scalar.
   // PKCS8 DER for P-256 has a 39-byte header before the 32-byte scalar.
   // The scalar is the last 32 bytes (after the leading zero pad byte).
   const privDer = privateKey.export({ type: "pkcs8", format: "der" });
-  const privateKeyBuffer = privDer.subarray(privDer.length - 32);
+  const privateKeyBuffer = privDer.subarray(
+    privDer.length - P256_PRIVATE_KEY_BYTES,
+  );
 
   cachedKeys = {
     publicKey: base64url(publicKeyBuffer),
diff --git a/src/core/web-push.ts b/src/core/web-push.ts
index c57113e..12002ee 100644
--- a/src/core/web-push.ts
+++ b/src/core/web-push.ts
@@ -11,7 +11,7 @@
  *   4. Prepend the sender's public key (65 bytes) to the ciphertext
  *
  * VAPID signing (RFC 8292):
- *   1. Build a JWT with { sub, exp, aud } claims
+ *   1. Build a JWT with sub, exp, and aud claims
  *   2. Sign with ES256 (ECDSA + P-256 + SHA-256)
  *   3. Append the public key and token to the Crypto-Key header
  */
@@ -45,6 +45,17 @@ const KEY_LENGTH = 16;
 const NONCE_LENGTH = 12;
 const SALT_LENGTH = 16;
 const MAX_PAYLOAD_SIZE = 4078;
+const EC_UNCOMPRESSED_POINT_LENGTH = 65;
+const RECORD_SIZE = 4096;
+const RECORD_SIZE_FIELD_LENGTH = 4;
+const VAPID_JWT_EXPIRY_HOURS = 12;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const MS_PER_SECOND = 1000;
+const HTTPS_DEFAULT_PORT = 443;
+const HTTP_DEFAULT_PORT = 80;
+const HTTP_STATUS_OK_MIN = 200;
+const HTTP_STATUS_OK_MAX = 299;
 
 // ---------------------------------------------------------------------------
 // Public API
@@ -58,8 +69,8 @@ const MAX_PAYLOAD_SIZE = 4078;
  */
 export async function sendWebPush(
   subscription: PushSubscription,
-  payload: PushPayload,
-  vapidKeys: VapidKeys,
+  payload: Readonly<PushPayload>,
+  vapidKeys: Readonly<VapidKeys>,
   subject: string,
 ): Promise<void> {
   const plaintext = JSON.stringify(payload);
@@ -102,7 +113,9 @@ function encrypt(plaintext: Buffer, keys: PushSubscription["keys"]): Buffer {
     type: "spki",
     format: "der",
   });
-  const senderPublicKey = senderPublicDer.subarray(senderPublicDer.length - 65);
+  const senderPublicKey = senderPublicDer.subarray(
+    senderPublicDer.length - EC_UNCOMPRESSED_POINT_LENGTH,
+  );
 
   // Derive the shared secret via ECDH
   const sharedSecret = crypto.diffieHellman({
@@ -146,8 +159,8 @@ function encrypt(plaintext: Buffer, keys: PushSubscription["keys"]): Buffer {
   const authTag = cipher.getAuthTag();
 
   // RFC 8291 §4: salt (16) || rs (4, big-endian, 4096) || sender pubkey (65) || ciphertext || tag
-  const rs = Buffer.alloc(4);
-  rs.writeUInt32BE(4096);
+  const rs = Buffer.alloc(RECORD_SIZE_FIELD_LENGTH);
+  rs.writeUInt32BE(RECORD_SIZE);
 
   return concat(salt, rs, senderPublicKey, ciphertext, authTag);
 }
@@ -175,12 +188,14 @@ function hkdfExpand(prk: Buffer, info: Buffer, length: number): Buffer {
 
 function buildVapidJwt(
   audience: string,
-  vapidKeys: VapidKeys,
+  vapidKeys: Readonly<VapidKeys>,
   subject: string,
 ): string {
   const header = base64url(Buffer.from('{"alg":"ES256","typ":"JWT"}', "utf-8"));
 
-  const exp = Math.floor(Date.now() / 1000) + 12 * 60 * 60; // 12 hours
+  const exp =
+    Math.floor(Date.now() / MS_PER_SECOND) +
+    VAPID_JWT_EXPIRY_HOURS * MINUTES_PER_HOUR * SECONDS_PER_MINUTE;
   const claims = JSON.stringify({ aud: audience, exp, sub: subject });
   const payload = base64url(Buffer.from(claims, "utf-8"));
 
@@ -217,7 +232,7 @@ function buildVapidJwt(
 function buildHeaders(
   encrypted: Buffer,
   endpoint: string,
-  vapidKeys: VapidKeys,
+  vapidKeys: Readonly<VapidKeys>,
   subject: string,
 ): Record<string, string> {
   const audience = new URL(endpoint).origin;
@@ -237,20 +252,24 @@ function buildHeaders(
 // HTTP POST
 // ---------------------------------------------------------------------------
 
-function post(
+async function post(
   endpoint: string,
-  headers: Record<string, string>,
+  headers: Readonly<Record<string, string>>,
   body: Buffer,
 ): Promise<void> {
   return new Promise((resolve, reject) => {
     const url = new URL(endpoint);
     const isHttps = url.protocol === "https:";
     const mod = isHttps ? https : http;
+    const port =
+      url.port !== ""
+        ? url.port
+        : String(isHttps ? HTTPS_DEFAULT_PORT : HTTP_DEFAULT_PORT);
 
     const req = mod.request(
       {
         hostname: url.hostname,
-        port: url.port || (isHttps ? 443 : 80),
+        port,
         path: url.pathname + url.search,
         method: "POST",
         headers,
@@ -258,16 +277,19 @@ function post(
       (res) => {
         // Drain the response body
         const chunks: Buffer[] = [];
-        res.on("data", (chunk: Buffer) => chunks.push(chunk));
+        res.on("data", (chunk: Buffer) => {
+          chunks.push(chunk);
+        });
         res.on("end", () => {
           if (
             res.statusCode !== undefined &&
-            (res.statusCode < 200 || res.statusCode > 299)
+            (res.statusCode < HTTP_STATUS_OK_MIN ||
+              res.statusCode > HTTP_STATUS_OK_MAX)
           ) {
-            const body = Buffer.concat(chunks).toString("utf-8");
+            const responseBody = Buffer.concat(chunks).toString("utf-8");
             reject(
               new Error(
-                `Push service returned ${String(res.statusCode)}: ${body}`,
+                `Push service returned ${String(res.statusCode)}: ${responseBody}`,
               ),
             );
           } else {
@@ -295,6 +317,6 @@ function base64url(input: Buffer): string {
   return input.toString("base64url");
 }
 
-function concat(...buffers: Buffer[]): Buffer {
+function concat(...buffers: readonly Buffer[]): Buffer {
   return Buffer.concat(buffers);
 }
diff --git a/src/core/wire-mesh-transport.ts b/src/core/wire-mesh-transport.ts
index 1e355aa..9ba9f35 100644
--- a/src/core/wire-mesh-transport.ts
+++ b/src/core/wire-mesh-transport.ts
@@ -60,11 +60,14 @@ const MS_PER_SECOND = 1000;
 const DEFAULT_PENDING_CONNECTION_TIMEOUT_MS =
   PENDING_CONNECTION_TIMEOUT_MINUTES * SECONDS_PER_MINUTE * MS_PER_SECOND;
 
-/** How often this side re-sends its own presence status onto every live session's gossip self-advert. wire-mesh-core's own sendGossipUpdate deliberately owns no cadence of its own (a MeshSession only sends what it's told, when it's told) -- this is that cadence, chosen generously enough to avoid chattiness on an idle mesh while still keeping a remote peer's own picture of this agent's status fresh well within the tens-of-minutes staleness window a status change (active -> idle -> offline) is actually meaningful over. */
+/** How often this side re-sends its own presence status onto every live session's gossip self-advert. wire-mesh-core's own sendGossipUpdate deliberately owns no cadence of its own (a MeshSession only sends what it's told, when it's told) -- this is that cadence, chosen generously enough to avoid chattiness on an idle mesh while still keeping a remote peer's own picture of this agent's status fresh well within the tens-of-minutes staleness window a status change (active -\> idle -\> offline) is actually meaningful over. */
 const PRESENCE_READVERTISE_INTERVAL_SECONDS = 20;
 const PRESENCE_READVERTISE_INTERVAL_MS =
   PRESENCE_READVERTISE_INTERVAL_SECONDS * MS_PER_SECOND;
 
+/** Length of the random id minted for a tracked listener (the coordinator's own bootstrap listener, or one registered via addListener). */
+const LISTENER_ID_LENGTH = 8;
+
 /** The domain-qualified gossip extension key this transport reads/writes presence under, per wire-mesh's own gossip-extension-namespacing convention (spec/CONVENTIONS.md): `<domain>/<field>`, never a bare name a second application's own extension could collide with. */
 const PRESENCE_GOSSIP_KEY = "presence/status";
 
@@ -146,17 +149,17 @@ export class WireMeshTransport implements MeshTransport {
   private dataListener: Listener | undefined;
 
   // -- Coordinator listeners (the well-known bootstrap port, plus any additional adapters addListener creates) --
-  private coordinatorListeners = new Map<string, TrackedListener>();
+  private readonly coordinatorListeners = new Map<string, TrackedListener>();
   private defaultListenerId: string | undefined;
 
   // -- The session dialled via connectToCoordinator, when this instance is not itself the coordinator --
   private coordinatorSession: AcceptedMeshSession | undefined;
 
   // -- Every live session, keyed by the peer's authenticated device-id hex (== ConnectionHandle.id) -- covers coordinator-client, coordinator-accepted, and peer data sessions alike, since send()/broadcast() must reach whichever kind of session a peer happens to be reachable through. A single-slot-per-key map by construction: mesh formation genuinely establishes TWO independent sessions to the same peer (see the dataDials comment below), and the second one registered here simply overwrites the first as far as addressing goes -- fine for send()/broadcast() (either socket reaches the same peer), but NOT fine for shutdown, which must close every live session regardless of whether it's still reachable through this map. allSessions below exists specifically so shutdown never leaks the one this map's overwrite silently stopped tracking.
-  private peerSessions = new Map<string, AcceptedMeshSession>();
+  private readonly peerSessions = new Map<string, AcceptedMeshSession>();
 
   // -- Every live session this transport has ever created, accepted or dialled, for shutdown's own use only -- never used for addressing (peerSessions is), so it never loses track of one session to another sharing the same peer id.
-  private allSessions = new Set<AcceptedMeshSession>();
+  private readonly allSessions = new Set<AcceptedMeshSession>();
 
   /** Registers a session in both peerSessions (addressing -- last one in for a given peer wins) and allSessions (shutdown -- every session, always). */
   private trackSession(key: string, session: AcceptedMeshSession): void {
@@ -165,10 +168,10 @@ export class WireMeshTransport implements MeshTransport {
   }
 
   // -- Peers this side has dialled via connectToPeer specifically (in flight or established) -- deliberately separate from peerSessions, which also holds sessions this side reached the SAME peer through for an unrelated reason (most concretely, the coordinator-client session connectToCoordinator opens to the coordinator's own device-id). Mesh formation deliberately establishes a second, independent connection in each direction so each side's own acceptor can push its own state (see mesh-store.ts's own handlePeerConnected), so connectToPeer's "don't dial twice" guard must not be satisfied by an unrelated session that merely happens to share the same peer ID.
-  private dataDials = new Set<string>();
+  private readonly dataDials = new Set<string>();
 
   // -- connect_request frames awaiting a human accept/reject decision, keyed by the requester's device-id hex --
-  private pendingConnections = new Map<string, PendingConnection>();
+  private readonly pendingConnections = new Map<string, PendingConnection>();
 
   // -- The single consumer of every approved session's incomingManageRequests, once quarantine (if any) is past. Owns verb dispatch (the legacy opaque frame, plus whichever real core/room verbs later phases register handlers for) -- this transport itself no longer decodes or routes a MeshMessage at all beyond handing a session off here.
   private readonly roomRouter: RoomRouter;
@@ -181,7 +184,7 @@ export class WireMeshTransport implements MeshTransport {
   private presenceInterval: ReturnType<typeof setInterval> | undefined;
 
   constructor(
-    events: TransportEvents,
+    events: Readonly<TransportEvents>,
     identity: Readonly<PeerIdentity>,
     roomVerbHandlers?: Partial<Record<string, RoomVerbHandler>>,
     pendingConnectionTimeoutMs: number = DEFAULT_PENDING_CONNECTION_TIMEOUT_MS,
@@ -295,7 +298,7 @@ export class WireMeshTransport implements MeshTransport {
   /** Reads a not-yet-trusted session's requests until it's promoted (an `introduce`, handled and trusted immediately, matching the pre-existing coordinator-handoff trust boundary) or a `connect_request` arrives, at which point this same loop iteration blocks on the human decision Promise stored in pendingConnections -- resumed in place by acceptConnection/rejectConnection (or by watchForDisconnect, if the requester disconnects first) -- rather than ever stopping and later re-entering the session's incomingManageRequests from a second call, which would require assuming a fresh access yields a distinct, independently-advancing iterator rather than resuming the one already in progress. Anything else arriving before introduce/connect_request is a protocol violation from an unapproved peer and is refused and closed rather than routed. */
   private consumeQuarantined(
     session: AcceptedMeshSession,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ): void {
     void (async () => {
       let approved = false;
@@ -365,7 +368,7 @@ export class WireMeshTransport implements MeshTransport {
   /** Delegates the whole post-approval drain loop to roomRouter -- this transport no longer decodes or routes a MeshMessage itself, only hands the session off. Also starts this session's own independent revocationAnnouncements drain, since a gossiped revocation is not a manage-request and has no verb for roomRouter to dispatch. */
   private consumeIncoming(
     session: AcceptedMeshSession,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
   ): void {
     this.roomRouter.drainSession(session, handle);
     this.drainRevocationAnnouncements(session);
@@ -382,7 +385,7 @@ export class WireMeshTransport implements MeshTransport {
 
   /** Surfaces a presence extension from the remote peer's own gossiped self-advert, if this event's directory carries a fresh one for exactly this session's peer -- never for any other device-id a multi-hop directory might mention, since only the session's own authenticated peer's advert is this session's business to report. A missing presence/status key, or a value that isn't a recognised AgentStatus, is silently ignored: an advert simply not participating in this convention, not an error (the same verifier obligation peer-advert's own open extension tail is documented under). */
   private reportPresenceAdvert(
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
     deviceIdHex: string,
     directory: readonly DirectoryEntry[],
   ): void {
@@ -397,7 +400,7 @@ export class WireMeshTransport implements MeshTransport {
 
   private watchForDisconnect(
     session: AcceptedMeshSession,
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
     deviceIdHex: string,
   ): void {
     void (async () => {
@@ -495,7 +498,7 @@ export class WireMeshTransport implements MeshTransport {
   // -----------------------------------------------------------------------
 
   async becomeCoordinator(host: string, port: number): Promise<void> {
-    const id = nanoid(8);
+    const id = nanoid(LISTENER_ID_LENGTH);
     const listener = await this.wireTransport.listen(
       `${host}:${String(port)}`,
       (connection) => {
@@ -523,7 +526,10 @@ export class WireMeshTransport implements MeshTransport {
   // MeshTransport -- Peer-to-peer data connections
   // -----------------------------------------------------------------------
 
-  async connectToPeer(peer: PeerInfo, _ownPeerId: string): Promise<void> {
+  async connectToPeer(
+    peer: Readonly<PeerInfo>,
+    _ownPeerId: string,
+  ): Promise<void> {
     if (this.shutDown || this.dataDials.has(peer.id)) return;
     this.dataDials.add(peer.id);
     const connection = await this.wireTransport
@@ -579,7 +585,10 @@ export class WireMeshTransport implements MeshTransport {
   // MeshTransport -- Send / broadcast
   // -----------------------------------------------------------------------
 
-  async send(handle: ConnectionHandle, message: MeshMessage): Promise<void> {
+  async send(
+    handle: Readonly<ConnectionHandle>,
+    message: MeshMessage,
+  ): Promise<void> {
     const session = this.peerSessions.get(handle.id);
     if (session === undefined) return;
     await session
@@ -596,7 +605,7 @@ export class WireMeshTransport implements MeshTransport {
   async broadcast(message: MeshMessage): Promise<void> {
     const command = buildCommand(message);
     await Promise.all(
-      [...this.peerSessions.values()].map((session) =>
+      [...this.peerSessions.values()].map(async (session) =>
         session.sendManageRequest(command, FRAME_SCOPE).catch(() => undefined),
       ),
     );
@@ -606,7 +615,7 @@ export class WireMeshTransport implements MeshTransport {
     entries: readonly RevocationEntry[],
   ): Promise<void> {
     await Promise.all(
-      [...this.peerSessions.values()].map((session) =>
+      [...this.peerSessions.values()].map(async (session) =>
         session.sendRevocationAnnounce(entries).catch(() => undefined),
       ),
     );
@@ -667,7 +676,7 @@ export class WireMeshTransport implements MeshTransport {
     }
   }
 
-  async acceptConnection(handle: ConnectionHandle): Promise<void> {
+  async acceptConnection(handle: Readonly<ConnectionHandle>): Promise<void> {
     const pending = this.pendingConnections.get(handle.id);
     if (pending === undefined) {
       throw new Error(`No pending connection for handle ${handle.id}`);
@@ -690,7 +699,7 @@ export class WireMeshTransport implements MeshTransport {
   }
 
   async rejectConnection(
-    handle: ConnectionHandle,
+    handle: Readonly<ConnectionHandle>,
     reason: string,
   ): Promise<void> {
     const pending = this.pendingConnections.get(handle.id);
@@ -717,7 +726,7 @@ export class WireMeshTransport implements MeshTransport {
     port: number,
     policy: ListenerPolicy,
   ): Promise<string> {
-    const id = nanoid(8);
+    const id = nanoid(LISTENER_ID_LENGTH);
     const listener = await this.wireTransport.listen(
       `${host}:${String(port)}`,
       (connection) => {
diff --git a/src/test/approval.integration.test.ts b/src/test/approval.integration.test.ts
index bad355d..54b0906 100644
--- a/src/test/approval.integration.test.ts
+++ b/src/test/approval.integration.test.ts
@@ -23,8 +23,17 @@ import {
 import type { DeliveryEvent, AgentIdentity } from "../core/types.js";
 import { waitFor, wireTestTransport } from "./test-transport.js";
 
+/** How long to let the coordinator settle (bind its listener, finish registering its agent) before a connecting peer dials in. */
+const COORDINATOR_SETTLE_DELAY_MS = 100;
+/** How long to wait for a reject to propagate when there is no positive event to poll for (the assertion proves an absence). */
+const REJECTION_PROPAGATION_WAIT_MS = 200;
+/** How long to let the coordinator settle before driving the mesh_connect/mesh_accept/mesh_reject/mesh_pending flow through the tool layer. */
+const TOOL_FLOW_SETTLE_DELAY_MS = 200;
+/** Extra margin past a pending connection's own configured timeout, to be sure it has actually expired before asserting on that. */
+const PENDING_CONNECTION_EXPIRY_BUFFER_MS = 500;
+
 /** Find a free port on localhost by binding to port 0. */
-function findFreePort(): Promise<number> {
+async function findFreePort(): Promise<number> {
   return new Promise((resolve, reject) => {
     const server = net.createServer();
     server.listen(0, "127.0.0.1", () => {
@@ -37,12 +46,14 @@ function findFreePort(): Promise<number> {
 }
 
 /** Find a free port for a single test's use. An alias for findFreePort(): asking the OS for a fresh ephemeral port each call already guarantees distinctness from any other currently-bound port, so no arithmetic offset is layered on top -- a prior +offset scheme could push an already-high OS-assigned port past 65535 and fail with ERR_SOCKET_BAD_PORT. */
-function uniquePort(): Promise<number> {
+async function uniquePort(): Promise<number> {
   return findFreePort();
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+async function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
 }
 
 describe("connection approval", () => {
@@ -75,7 +86,7 @@ describe("connection approval", () => {
         tags: [],
       });
 
-      await sleep(100);
+      await sleep(COORDINATOR_SETTLE_DELAY_MS);
 
       // Set up connecting peer (store B) that uses connectToRemote
       await storeB.startDataServerOnly();
@@ -149,7 +160,7 @@ describe("connection approval", () => {
         tags: [],
       });
 
-      await sleep(100);
+      await sleep(COORDINATOR_SETTLE_DELAY_MS);
 
       await storeB.startDataServerOnly();
       await storeB.registerAgent({
@@ -230,7 +241,7 @@ describe("connection approval", () => {
         tags: [],
       });
 
-      await sleep(100);
+      await sleep(COORDINATOR_SETTLE_DELAY_MS);
 
       await storeB.startDataServerOnly();
       await storeB.registerAgent({
@@ -262,7 +273,7 @@ describe("connection approval", () => {
       await storeA.rejectConnection(request.connectionId, "unauthorised");
 
       // Give the rejection time to propagate -- there is no positive event to poll for here (the assertion below proves an absence), so a fixed wait is the right shape, unlike the accept-flow tests above.
-      await sleep(200);
+      await sleep(REJECTION_PROPAGATION_WAIT_MS);
 
       // Verify the coordinator no longer sees the connector agent
       const agentsA = await storeA.listAgents(storeA.peerId);
@@ -305,7 +316,7 @@ describe("connection approval", () => {
         tags: [],
       });
 
-      await sleep(100);
+      await sleep(COORDINATOR_SETTLE_DELAY_MS);
 
       await storeB.startDataServerOnly();
       await storeB.registerAgent({
@@ -329,7 +340,10 @@ describe("connection approval", () => {
         throw new Error("expected a pending connection request");
 
       // No accept/reject call at all -- wait past the configured timeout with the request left untouched.
-      await sleep(SHORT_PENDING_CONNECTION_TIMEOUT_MS + 500);
+      await sleep(
+        SHORT_PENDING_CONNECTION_TIMEOUT_MS +
+          PENDING_CONNECTION_EXPIRY_BUFFER_MS,
+      );
 
       // The strongest available proof the entry actually expired (not merely "still pending, not yet an agent," which would be equally true before any decision): acceptConnection on an expired request must fail exactly the way it fails for any other unknown handle, since expirePendingConnection has already deleted it.
       await expect(
@@ -368,7 +382,7 @@ describe("connection approval", () => {
         tags: [],
       });
 
-      await sleep(100);
+      await sleep(COORDINATOR_SETTLE_DELAY_MS);
 
       await storeB.startDataServerOnly();
       await storeB.registerAgent({
@@ -452,7 +466,7 @@ describe("connection approval", () => {
       });
       const toolA = new CommsTool(storeA);
 
-      await sleep(100);
+      await sleep(COORDINATOR_SETTLE_DELAY_MS);
 
       await storeB.startDataServerOnly();
       await storeB.registerAgent({
@@ -473,7 +487,7 @@ describe("connection approval", () => {
       });
 
       // Give coordinator time to settle
-      await sleep(200);
+      await sleep(TOOL_FLOW_SETTLE_DELAY_MS);
 
       // Verify coordinator is listening
       const listeners = storeA.listListeners();
@@ -598,7 +612,7 @@ describe("connection approval", () => {
       });
       const toolA = new CommsTool(storeA);
 
-      await sleep(100);
+      await sleep(COORDINATOR_SETTLE_DELAY_MS);
 
       await storeB.startDataServerOnly();
       await storeB.registerAgent({
diff --git a/src/test/bridge-mesh.test.ts b/src/test/bridge-mesh.test.ts
index 486e204..bdab387 100644
--- a/src/test/bridge-mesh.test.ts
+++ b/src/test/bridge-mesh.test.ts
@@ -14,6 +14,11 @@ import {
 } from "../core/identity-store.js";
 import { waitFor } from "./test-transport.js";
 
+// Base of the ephemeral coordinator-port range used to avoid colliding with the mesh's real well-known port.
+const TEST_COORDINATOR_PORT_BASE = 20_900;
+// Width of the randomised offset added to TEST_COORDINATOR_PORT_BASE so concurrent test runs don't collide on the same port.
+const TEST_COORDINATOR_PORT_RANGE = 100;
+
 function tempSlot(harness: string): IdentitySlot {
   const dir = fs.mkdtempSync(
     path.join(tmpdir(), "agent-comms-bridge-mesh-test-"),
@@ -50,7 +55,9 @@ test("createBridgeMesh wires a WireMeshTransport", async () => {
 test("createBridgeMesh passes an explicit coordinatorPort through to MeshStore, forming one shared mesh", async () => {
   const slotA = tempSlot("test-harness-a");
   const slotB = tempSlot("test-harness-b");
-  const port = 20_900 + Math.floor(Math.random() * 100);
+  const port =
+    TEST_COORDINATOR_PORT_BASE +
+    Math.floor(Math.random() * TEST_COORDINATOR_PORT_RANGE);
   const a = await createBridgeMesh(slotA, port);
   const b = await createBridgeMesh(slotB, port);
   try {
diff --git a/src/test/broadcast-window.integration.test.ts b/src/test/broadcast-window.integration.test.ts
index a831a32..a77024b 100644
--- a/src/test/broadcast-window.integration.test.ts
+++ b/src/test/broadcast-window.integration.test.ts
@@ -12,7 +12,12 @@ import { generateIdentity } from "../core/identity.js";
 import type { PeerIdentity } from "../core/identity.js";
 
 const TEST_PORT = 19890;
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+const POLL_ATTEMPTS = 20;
+const POLL_INTERVAL_MS = 100;
+const sleep = async (ms: number): Promise<void> =>
+  new Promise<void>((resolve) => {
+    setTimeout(resolve, ms);
+  });
 
 /** A peer wired like a real bridge: WireMeshTransport, device-id peer ID. */
 function makePeer(identity: PeerIdentity): MeshStore {
@@ -27,9 +32,9 @@ async function waitFor(
   what: string,
   check: () => Promise<boolean>,
 ): Promise<void> {
-  for (let i = 0; i < 20; i++) {
+  for (let i = 0; i < POLL_ATTEMPTS; i++) {
     if (await check()) return;
-    await sleep(100);
+    await sleep(POLL_INTERVAL_MS);
   }
   expect(false, `timed out waiting for ${what}`).toBeTruthy();
 }
diff --git a/src/test/coordinator-socket-error.integration.test.ts b/src/test/coordinator-socket-error.integration.test.ts
index 961e15c..a0d5b29 100644
--- a/src/test/coordinator-socket-error.integration.test.ts
+++ b/src/test/coordinator-socket-error.integration.test.ts
@@ -12,6 +12,9 @@ import { wireTestTransport } from "./test-transport.js";
 
 const TEST_PORT = 19879;
 
+// Time to let the coordinator's event loop process the ECONNRESET error event before asserting the process survived it.
+const ERROR_PROCESSING_DELAY_MS = 300;
+
 /**
  * When a peer connects to the coordinator and then abruptly resets
  * the connection (ECONNRESET), the coordinator process must not crash.
@@ -39,7 +42,9 @@ test("coordinator survives ECONNRESET on accepted socket", async () => {
   socket.resetAndDestroy();
 
   // Give the server time to process the error event
-  await new Promise((resolve) => setTimeout(resolve, 300));
+  await new Promise((resolve) => {
+    setTimeout(resolve, ERROR_PROCESSING_DELAY_MS);
+  });
 
   // If we reach here, the process didn't crash from the unhandled error.
   // Verify the store is still functional.
diff --git a/src/test/delivery-receipt.helper.ts b/src/test/delivery-receipt.helper.ts
index 0832071..1a446b9 100644
--- a/src/test/delivery-receipt.helper.ts
+++ b/src/test/delivery-receipt.helper.ts
@@ -25,8 +25,31 @@ if (testName === undefined) {
   process.exit(1);
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+// ---------------------------------------------------------------------------
+// Timing constants — settle windows for asynchronous mesh propagation. The mesh has no "operation complete" signal for these steps, so tests wait a fixed budget rather than polling; values were picked empirically to be comfortably longer than the real round trip on a local TCP loopback.
+// ---------------------------------------------------------------------------
+
+/** Milliseconds to wait for a newly registered peer's own local state to settle before a second peer registers. */
+const REGISTER_SETTLE_MS = 100;
+/** Milliseconds to wait for two mesh peers to complete bidirectional registration sync after the second peer registers. */
+const PEER_SYNC_SETTLE_MS = 300;
+/** Milliseconds to wait for a created room to propagate across the mesh before members join it. */
+const ROOM_CREATE_SETTLE_MS = 200;
+/** Milliseconds to wait for a sent message (or a drained delivery's resulting read receipt) to propagate across the mesh. */
+const MESH_PROPAGATION_SETTLE_MS = 300;
+/** Milliseconds to wait for a push-delivered message's read receipt to round-trip back to the sender. */
+const READ_RECEIPT_SETTLE_MS = 500;
+/** Milliseconds to wait for a sent message's readBy array to be updated. */
+const READBY_SETTLE_MS = 800;
+/** Total budget pollUntil waits before giving up and throwing. */
+const POLL_TIMEOUT_MS = 5000;
+/** Interval between pollUntil predicate re-checks. */
+const POLL_INTERVAL_MS = 50;
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise<void>((resolve) => {
+    setTimeout(resolve, ms);
+  });
 }
 
 /**
@@ -41,7 +64,7 @@ async function allocFreePort(): Promise<number> {
     // SO_REUSEADDR avoids TIME_WAIT on close
     server.listen(0, "127.0.0.1", () => {
       const addr = server.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
+      const port = addr !== null && typeof addr === "object" ? addr.port : 0;
       server.close(() => {
         resolve(port);
       });
@@ -50,7 +73,7 @@ async function allocFreePort(): Promise<number> {
   });
 }
 
-async function cleanup(...stores: MeshStore[]): Promise<void> {
+async function cleanup(...stores: readonly MeshStore[]): Promise<void> {
   for (const s of stores) {
     await s.shutdown();
   }
@@ -61,12 +84,12 @@ async function pollUntil(
   predicate: () => boolean | Promise<boolean>,
   what: string,
 ): Promise<void> {
-  const deadline = Date.now() + 5000;
+  const deadline = Date.now() + POLL_TIMEOUT_MS;
   while (!(await predicate())) {
     if (Date.now() >= deadline) {
       throw new Error(`timed out waiting for ${what}`);
     }
-    await sleep(50);
+    await sleep(POLL_INTERVAL_MS);
   }
 }
 
@@ -130,7 +153,7 @@ async function testPushRoom(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(100);
+  await sleep(REGISTER_SETTLE_MS);
 
   const b = new MeshStore(port);
   await wireTestTransport(b);
@@ -147,7 +170,7 @@ async function testPushRoom(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(300);
+  await sleep(PEER_SYNC_SETTLE_MS);
 
   const room = await a.createRoom({
     name: `push-room-${String(port)}`,
@@ -155,12 +178,12 @@ async function testPushRoom(): Promise<void> {
     owner: a.peerId,
     description: "Push delivery test",
   });
-  await sleep(200);
+  await sleep(ROOM_CREATE_SETTLE_MS);
   await joinAndAccept(a, b, room.id);
 
   deliveriesB.length = 0;
   await a.sendRoomMessage(room.id, a.peerId, "Hello push!");
-  await sleep(300);
+  await sleep(MESH_PROPAGATION_SETTLE_MS);
 
   assert.ok(
     deliveriesB.length >= 1,
@@ -194,7 +217,7 @@ async function testPushDm(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(100);
+  await sleep(REGISTER_SETTLE_MS);
 
   const b = new MeshStore(port);
   await wireTestTransport(b);
@@ -211,13 +234,13 @@ async function testPushDm(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(300);
+  await sleep(PEER_SYNC_SETTLE_MS);
 
   await dmConsent(a, b);
 
   deliveriesB.length = 0;
   await a.sendDm(a.peerId, b.peerId, "Direct push!");
-  await sleep(300);
+  await sleep(MESH_PROPAGATION_SETTLE_MS);
 
   assert.ok(
     deliveriesB.length >= 1,
@@ -244,7 +267,7 @@ async function testDrainRoom(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(100);
+  await sleep(REGISTER_SETTLE_MS);
 
   // B has NO onDelivery — events queue for drain
   const b = new MeshStore(port);
@@ -258,7 +281,7 @@ async function testDrainRoom(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(300);
+  await sleep(PEER_SYNC_SETTLE_MS);
 
   const room = await a.createRoom({
     name: `drain-room-${String(port)}`,
@@ -266,11 +289,11 @@ async function testDrainRoom(): Promise<void> {
     owner: a.peerId,
     description: "Drain delivery test",
   });
-  await sleep(200);
+  await sleep(ROOM_CREATE_SETTLE_MS);
   await joinAndAccept(a, b, room.id);
 
   await a.sendRoomMessage(room.id, a.peerId, "Hello drain!");
-  await sleep(300);
+  await sleep(MESH_PROPAGATION_SETTLE_MS);
 
   const drained = await b.drainDelivery(b.peerId);
   assert.ok(
@@ -307,7 +330,7 @@ async function testDrainDm(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(100);
+  await sleep(REGISTER_SETTLE_MS);
 
   const b = new MeshStore(port);
   await wireTestTransport(b);
@@ -320,11 +343,11 @@ async function testDrainDm(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(300);
+  await sleep(PEER_SYNC_SETTLE_MS);
 
   await dmConsent(a, b);
   await a.sendDm(a.peerId, b.peerId, "Direct drain!");
-  await sleep(300);
+  await sleep(MESH_PROPAGATION_SETTLE_MS);
 
   const drained = await b.drainDelivery(b.peerId);
   assert.ok(
@@ -356,7 +379,7 @@ async function testReadReceiptPush(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(100);
+  await sleep(REGISTER_SETTLE_MS);
 
   const b = new MeshStore(port);
   await wireTestTransport(b);
@@ -372,7 +395,7 @@ async function testReadReceiptPush(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(300);
+  await sleep(PEER_SYNC_SETTLE_MS);
 
   const room = await a.createRoom({
     name: `read-push-${String(port)}`,
@@ -380,12 +403,12 @@ async function testReadReceiptPush(): Promise<void> {
     owner: a.peerId,
     description: "Read receipt push test",
   });
-  await sleep(200);
+  await sleep(ROOM_CREATE_SETTLE_MS);
   await joinAndAccept(a, b, room.id);
 
   deliveriesA.length = 0;
   await a.sendRoomMessage(room.id, a.peerId, "Read me");
-  await sleep(500);
+  await sleep(READ_RECEIPT_SETTLE_MS);
 
   const readReceipt = deliveriesA.find(
     (ev): ev is Extract<DeliveryEvent, { type: "delivery_status" }> =>
@@ -414,7 +437,7 @@ async function testReadReceiptDrain(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(100);
+  await sleep(REGISTER_SETTLE_MS);
 
   // B has NO onDelivery — drain triggers markRead
   const b = new MeshStore(port);
@@ -428,7 +451,7 @@ async function testReadReceiptDrain(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(300);
+  await sleep(PEER_SYNC_SETTLE_MS);
 
   const room = await a.createRoom({
     name: `read-drain-${String(port)}`,
@@ -436,16 +459,16 @@ async function testReadReceiptDrain(): Promise<void> {
     owner: a.peerId,
     description: "Read receipt drain test",
   });
-  await sleep(200);
+  await sleep(ROOM_CREATE_SETTLE_MS);
   await joinAndAccept(a, b, room.id);
 
   deliveriesA.length = 0;
   await a.sendRoomMessage(room.id, a.peerId, "Drain then read");
-  await sleep(300);
+  await sleep(MESH_PROPAGATION_SETTLE_MS);
 
   const drained = await b.drainDelivery(b.peerId);
   assert.ok(drained.length >= 1, "Drain should return the message");
-  await sleep(300);
+  await sleep(MESH_PROPAGATION_SETTLE_MS);
 
   const readReceipt = deliveriesA.find(
     (ev) => ev.type === "delivery_status" && ev.status === "read",
@@ -474,7 +497,7 @@ async function testReadbyArray(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(100);
+  await sleep(REGISTER_SETTLE_MS);
 
   const b = new MeshStore(port);
   await wireTestTransport(b);
@@ -490,7 +513,7 @@ async function testReadbyArray(): Promise<void> {
     visibility: "visible",
     tags: [],
   });
-  await sleep(300);
+  await sleep(PEER_SYNC_SETTLE_MS);
 
   const room = await a.createRoom({
     name: `readby-${String(port)}`,
@@ -498,11 +521,11 @@ async function testReadbyArray(): Promise<void> {
     owner: a.peerId,
     description: "readBy test",
   });
-  await sleep(200);
+  await sleep(ROOM_CREATE_SETTLE_MS);
   await joinAndAccept(a, b, room.id);
 
   const msg = await a.sendRoomMessage(room.id, a.peerId, "Check readBy");
-  await sleep(800);
+  await sleep(READBY_SETTLE_MS);
 
   const messages = await a.readRoomMessages(room.id);
   const sent = messages.find((m) => m.id === msg.id);
@@ -549,7 +572,9 @@ fn()
         ._getActiveHandles ?? (() => []);
     const handles: unknown[] = getHandles();
     while (handles.length > 0 && Date.now() - start < maxWait) {
-      await new Promise<void>((resolve) => setTimeout(resolve, 50));
+      await new Promise<void>((resolve) => {
+        setTimeout(resolve, POLL_INTERVAL_MS);
+      });
     }
     process.exit(0);
   })
diff --git a/src/test/federation.integration.test.ts b/src/test/federation.integration.test.ts
index 50d4cd0..3cdd1d6 100644
--- a/src/test/federation.integration.test.ts
+++ b/src/test/federation.integration.test.ts
@@ -23,8 +23,29 @@ import { wireTestTransport } from "./test-transport.js";
 const MESH_A_PORT = 28876;
 const MESH_B_PORT = 28877;
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+// ---------------------------------------------------------------------------
+// Timing constants — settle windows for asynchronous mesh/federation propagation. There is no "operation complete" signal for these steps, so the test waits a fixed budget rather than polling.
+// ---------------------------------------------------------------------------
+
+/** Milliseconds to wait after a mesh-setup step (creating a mesh, starting the federation listener) for local state to settle. */
+const MESH_SETUP_SETTLE_MS = 100;
+/** Milliseconds to wait for a freshly established federation link to settle before exercising it. */
+const FED_LINK_SETTLE_MS = 200;
+/** Milliseconds to wait for a federated room (or a join against its mirror) to propagate across the federation link. */
+const FED_ROOM_SETTLE_MS = 200;
+/** Milliseconds to wait for a room message to propagate across an established federation link. */
+const FED_MESSAGE_PROPAGATION_MS = 500;
+/** Milliseconds to wait for a non-federated (local-only) room to settle after creation. */
+const LOCAL_ROOM_SETTLE_MS = 100;
+/** Milliseconds to wait for a local-only message to settle, confirming it does not leak across federation. */
+const LOCAL_MESSAGE_SETTLE_MS = 100;
+/** Milliseconds to wait for a federation link disconnect to propagate. */
+const FED_DISCONNECT_SETTLE_MS = 200;
+
+async function sleep(ms: number): Promise<void> {
+  await new Promise<void>((resolve) => {
+    setTimeout(resolve, ms);
+  });
 }
 
 // ---------------------------------------------------------------------------
@@ -59,8 +80,8 @@ async function createMesh(
 }
 
 /** Find a free port on localhost. */
-function findFreePort(): Promise<number> {
-  return new Promise((resolve, reject) => {
+async function findFreePort(): Promise<number> {
+  return await new Promise((resolve, reject) => {
     const server = net.createServer();
     server.listen(0, "127.0.0.1", () => {
       const addr = server.address();
@@ -84,18 +105,18 @@ async function main(): Promise<void> {
 
   console.log("Creating mesh A (coordinator)...");
   const a = await createMesh("mesh-a-agent", MESH_A_PORT);
-  await sleep(100);
+  await sleep(MESH_SETUP_SETTLE_MS);
 
   console.log("Creating mesh B (coordinator)...");
   const b = await createMesh("mesh-b-agent", MESH_B_PORT);
-  await sleep(100);
+  await sleep(MESH_SETUP_SETTLE_MS);
 
   const fedPort = await findFreePort();
   console.log(`Using federation port ${String(fedPort)}`);
 
   // Start A's real production federation listener (fedListen -> FederationManager.listen -> handleInbound, the same path a deployed coordinator uses — not a hand-rolled test-only TLS server).
   await a.store.fedListen("127.0.0.1", fedPort);
-  await sleep(100);
+  await sleep(MESH_SETUP_SETTLE_MS);
 
   // --- Test 0: untrusted inbound connection is rejected ---
   console.log("\nTest 0: untrusted connection is rejected...");
@@ -142,7 +163,7 @@ async function main(): Promise<void> {
     "Remote mesh ID should be present",
   ).toBeTruthy();
 
-  await sleep(200);
+  await sleep(FED_LINK_SETTLE_MS);
 
   // --- Test 2: Agent presence propagates ---
   console.log("Test 2: Agent presence propagates...");
@@ -174,7 +195,7 @@ async function main(): Promise<void> {
     federated: true,
   });
   console.log(`  Created federated room: ${fedRoom.id}`);
-  await sleep(200);
+  await sleep(FED_ROOM_SETTLE_MS);
 
   // Federation matches a room across the two separate meshes by literal id equality (handleFedRoomMessage/Join/Leave all key off the incoming roomId string directly) -- an owner-rooted path only coincides on both sides when both sides construct it from the same owner, so B's mirror of A's room is created with A's own peerId as owner, not B's.
   const fedRoomB = await b.store.createRoom({
@@ -187,7 +208,7 @@ async function main(): Promise<void> {
   console.log(`  Created matching federated room on B: ${fedRoomB.id}`);
   // createRoom's default members is [owner] -- since owner is A's peerId (to make the id match), B's own local agent must explicitly join its mirror for handleFedRoomMessage's local-delivery loop to reach it.
   await b.store.joinRoom(fedRoomB.id, b.store.peerId);
-  await sleep(200);
+  await sleep(FED_ROOM_SETTLE_MS);
 
   a.deliveries.length = 0;
   b.deliveries.length = 0;
@@ -198,7 +219,7 @@ async function main(): Promise<void> {
     "Hello from mesh A!",
   );
   console.log(`  A sent: "${msg.content}"`);
-  await sleep(500);
+  await sleep(FED_MESSAGE_PROPAGATION_MS);
 
   const fedMsgs = b.deliveries.filter(
     (e) =>
@@ -225,7 +246,7 @@ async function main(): Promise<void> {
   console.log(
     `  Created non-federated room: ${localRoom.id}, federated=${String(localRoom.federated)}`,
   );
-  await sleep(100);
+  await sleep(LOCAL_ROOM_SETTLE_MS);
 
   b.deliveries.length = 0;
 
@@ -236,7 +257,7 @@ async function main(): Promise<void> {
     "Secret local message",
   );
   console.log("  Message sent.");
-  await sleep(100);
+  await sleep(LOCAL_MESSAGE_SETTLE_MS);
 
   const leakedMsgs = b.deliveries.filter(
     (e) =>
@@ -257,7 +278,7 @@ async function main(): Promise<void> {
   // --- Test 6: Disconnect federation link ---
   console.log("Test 6: Disconnect federation link...");
   await b.store.fedDisconnect(linkId);
-  await sleep(200);
+  await sleep(FED_DISCONNECT_SETTLE_MS);
 
   const linksAfter = b.store.fedLinks();
   expect(
diff --git a/src/test/handshake.test.ts b/src/test/handshake.test.ts
index efddb7a..0028be3 100644
--- a/src/test/handshake.test.ts
+++ b/src/test/handshake.test.ts
@@ -95,13 +95,19 @@ describe("ConnectionHandshake", () => {
 
   it("refuses undecodable leading bytes that are neither CBOR maps nor JSON", () => {
     const gate = new ConnectionHandshake("server");
-    const outcome = gate.feed(Buffer.from([0xff, 0x00, 0x01]));
+    /** Lead byte that is neither a valid CBOR map head nor a JSON opening brace. */
+    const UNDECODABLE_LEAD_BYTE = 0xff;
+    const outcome = gate.feed(Buffer.from([UNDECODABLE_LEAD_BYTE, 0x00, 0x01]));
     expect(outcome.kind).toBe("refused");
   });
 
   it("refuses a binary blob far beyond any handshake frame size", () => {
     const gate = new ConnectionHandshake("server");
-    const big = Buffer.alloc(2048, 0x61); // 'a' — neither CBOR map head nor '{'
+    /** Length of the oversized test blob, comfortably beyond any real handshake frame. */
+    const OVERSIZED_BLOB_LENGTH = 2048;
+    /** ASCII 'a' — neither a CBOR map head nor a JSON opening brace. */
+    const ASCII_LOWERCASE_A = 0x61;
+    const big = Buffer.alloc(OVERSIZED_BLOB_LENGTH, ASCII_LOWERCASE_A);
     expect(gate.feed(big).kind).toBe("refused");
   });
 });
@@ -138,9 +144,9 @@ describe("normaliseWireState (#31 direction 2)", () => {
 describe("ConnectionHandshake over a real socket pair", () => {
   it("client sends frame first; both sides reach negotiated", async () => {
     const server = net.createServer();
-    await new Promise<void>((resolve) =>
-      server.listen(0, "127.0.0.1", resolve),
-    );
+    await new Promise<void>((resolve) => {
+      server.listen(0, "127.0.0.1", resolve);
+    });
     const port = (server.address() as net.AddressInfo).port;
 
     const serverOutcome = new Promise<"negotiated" | "legacy" | "refused">(
@@ -181,9 +187,9 @@ describe("ConnectionHandshake over a real socket pair", () => {
 
   it("a legacy peer (no handshake frame) is tolerated: JSON bytes pass straight through both sides", async () => {
     const server = net.createServer();
-    await new Promise<void>((resolve) =>
-      server.listen(0, "127.0.0.1", resolve),
-    );
+    await new Promise<void>((resolve) => {
+      server.listen(0, "127.0.0.1", resolve);
+    });
     const port = (server.address() as net.AddressInfo).port;
 
     const serverReceived = new Promise<string>((resolve, reject) => {
@@ -199,7 +205,9 @@ describe("ConnectionHandshake over a real socket pair", () => {
 
     // A pre-#31 peer: writes its JSON line directly, sends no handshake frame at all.
     const client = net.createConnection({ port, host: "127.0.0.1" });
-    await new Promise<void>((resolve) => client.on("connect", resolve));
+    await new Promise<void>((resolve) => {
+      client.on("connect", resolve);
+    });
     client.write('{"method":"introduce"}\n');
 
     expect(await serverReceived).toMatch(/introduce/);
@@ -210,9 +218,9 @@ describe("ConnectionHandshake over a real socket pair", () => {
 
   it("an incompatible handshake (no shared domain) is refused loudly: the connection is destroyed rather than desynced", async () => {
     const server = net.createServer();
-    await new Promise<void>((resolve) =>
-      server.listen(0, "127.0.0.1", resolve),
-    );
+    await new Promise<void>((resolve) => {
+      server.listen(0, "127.0.0.1", resolve);
+    });
     const port = (server.address() as net.AddressInfo).port;
 
     const serverError = new Promise<Error>((resolve) => {
@@ -231,7 +239,9 @@ describe("ConnectionHandshake over a real socket pair", () => {
     });
 
     const client = net.createConnection({ port, host: "127.0.0.1" });
-    await new Promise<void>((resolve) => client.on("connect", resolve));
+    await new Promise<void>((resolve) => {
+      client.on("connect", resolve);
+    });
     const foreignFrame = cborEncode(
       {
         type: "handshake",
diff --git a/src/test/identity-restart.integration.test.ts b/src/test/identity-restart.integration.test.ts
index 2be9bdc..7b8565f 100644
--- a/src/test/identity-restart.integration.test.ts
+++ b/src/test/identity-restart.integration.test.ts
@@ -24,7 +24,16 @@ import type { DeliveryEvent } from "../core/types.js";
 import { ownerNamedRoomPath } from "../core/room-path.js";
 
 const TEST_PORT = 19889;
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+/** Attempts {@link waitFor} polls before giving up. */
+const MAX_WAIT_ATTEMPTS = 20;
+/** Delay between {@link waitFor} poll attempts, in milliseconds. */
+const WAIT_POLL_INTERVAL_MS = 100;
+/** Delay allowing mesh state to settle across peers before the next step, in milliseconds. */
+const SETTLE_DELAY_MS = 200;
+const sleep = async (ms: number): Promise<void> =>
+  new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
 
 interface Peer {
   store: MeshStore;
@@ -34,7 +43,7 @@ interface Peer {
 /** A peer wired like a real bridge: WireMeshTransport, device-id peer ID, and a persisted identity slot so createRoom can mint and persist the owner's own room:member grant. */
 async function makePeer(
   identity: PeerIdentity,
-  slot: IdentitySlot,
+  slot: Readonly<IdentitySlot>,
 ): Promise<Peer> {
   const store = new MeshStore(TEST_PORT);
   store.peerId = deviceIdToHex(Uint8Array.from(identity.deviceId));
@@ -56,9 +65,9 @@ async function waitFor(
   what: string,
   check: () => Promise<boolean>,
 ): Promise<void> {
-  for (let i = 0; i < 20; i++) {
+  for (let i = 0; i < MAX_WAIT_ATTEMPTS; i++) {
     if (await check()) return;
-    await sleep(100);
+    await sleep(WAIT_POLL_INTERVAL_MS);
   }
   expect(false, `timed out waiting for ${what}`).toBeTruthy();
 }
@@ -86,7 +95,7 @@ async function main(): Promise<void> {
   b.store.onDelivery = (_id, ev) => {
     b.deliveries.push(ev);
   };
-  await sleep(200);
+  await sleep(SETTLE_DELAY_MS);
 
   // First lifecycle of peer A: persistent identity, registers and creates a room.
   const identityA = loadOrCreateIdentity(slot);
@@ -107,7 +116,7 @@ async function main(): Promise<void> {
     owner: a1.store.peerId,
     description: "issue 14 acceptance",
   });
-  await sleep(200);
+  await sleep(SETTLE_DELAY_MS);
   // The room already replicated to B via legacy full-state-sync, but knowing about a room is not the same as holding a room:member token for it -- B's own join still goes through real wire-level admission, held open until A approves it.
   const joinPromise = b.store.joinRoom(roomId, b.store.peerId);
   await waitFor("A to see B's pending join request", async () =>
@@ -119,12 +128,12 @@ async function main(): Promise<void> {
   );
   a1.store.acceptRoomJoin(roomId, b.store.peerId);
   await joinPromise;
-  await sleep(200);
+  await sleep(SETTLE_DELAY_MS);
   const agentIdA = a1.store.peerId;
 
   // A goes away without marking its agent offline (crash simulation).
   await a1.store.shutdown();
-  await sleep(200);
+  await sleep(SETTLE_DELAY_MS);
 
   // A restarts in the same slot: same key material, same agent ID.
   const identityA2 = loadOrCreateIdentity(slot);
diff --git a/src/test/identity-store.test.ts b/src/test/identity-store.test.ts
index 857663b..b912825 100644
--- a/src/test/identity-store.test.ts
+++ b/src/test/identity-store.test.ts
@@ -42,10 +42,12 @@ function spawnLiveProcess(): { pid: number; exit: () => Promise<void> } {
     throw new Error("expected the spawned child to have a pid");
   return {
     pid: child.pid,
-    exit: () =>
+    exit: async () =>
       new Promise((resolve) => {
         child.kill("SIGKILL");
-        child.on("exit", () => resolve());
+        child.on("exit", () => {
+          resolve();
+        });
       }),
   };
 }
@@ -65,11 +67,19 @@ test("loadOrCreateIdentity persists and reloads the same key material", () => {
   expect(fs.existsSync(lockFile)).toBe(false);
 });
 
+// Offset (in milliseconds) from now used to write a stored identity's expiresAt just inside the renewal window, without it having already expired outright.
+const NEAR_EXPIRY_OFFSET_MS = 1000;
+
+// Mask isolating the permission bits from a stat mode's file-type bits.
+const PERMISSION_BITS_MASK = 0o777;
+// Expected owner-only read/write permission bits for a persisted identity file.
+const OWNER_ONLY_RW_PERMISSIONS = 0o600;
+
 test("identity file is created with owner-only permissions", () => {
   const { slot, dir } = tempSlot("claude-code");
   loadOrCreateIdentity(slot);
-  const mode = fs.statSync(slotFile(dir, ".json")).mode & 0o777;
-  expect(mode).toBe(0o600);
+  const mode = fs.statSync(slotFile(dir, ".json")).mode & PERMISSION_BITS_MASK;
+  expect(mode).toBe(OWNER_ONLY_RW_PERMISSIONS);
   releaseIdentityLock(slot);
 });
 
@@ -112,7 +122,7 @@ test("a near-expiry identity is renewed", () => {
   const stored = JSON.parse(fs.readFileSync(identityFile, "utf-8")) as {
     expiresAt: string;
   };
-  stored.expiresAt = new Date(Date.now() + 1000).toISOString();
+  stored.expiresAt = new Date(Date.now() + NEAR_EXPIRY_OFFSET_MS).toISOString();
   fs.writeFileSync(identityFile, JSON.stringify(stored));
 
   const renewed = loadOrCreateIdentity(slot);
@@ -128,7 +138,7 @@ test("a near-expiry identity is renewed without rotating the device-id", () => {
   const stored = JSON.parse(fs.readFileSync(identityFile, "utf-8")) as {
     expiresAt: string;
   };
-  stored.expiresAt = new Date(Date.now() + 1000).toISOString();
+  stored.expiresAt = new Date(Date.now() + NEAR_EXPIRY_OFFSET_MS).toISOString();
   fs.writeFileSync(identityFile, JSON.stringify(stored));
 
   const renewed = loadOrCreateIdentity(slot);
diff --git a/src/test/listener-policy.integration.test.ts b/src/test/listener-policy.integration.test.ts
index 8f0431a..b85a0b3 100644
--- a/src/test/listener-policy.integration.test.ts
+++ b/src/test/listener-policy.integration.test.ts
@@ -25,6 +25,7 @@ import { test, describe, expect } from "vitest";
 import { wireTestTransport } from "./test-transport.js";
 
 const TEST_PORT = 19880;
+const PARSED_ACTION_TEST_PORT = 9999;
 
 describe("listener policy", () => {
   test("coordinator starts with a single default localhost listener", async () => {
@@ -306,13 +307,13 @@ describe("listener policy", () => {
     const action = buildAction({
       action: "mesh_listen",
       host: "192.168.1.1",
-      port: 9999,
+      port: PARSED_ACTION_TEST_PORT,
       policy: "observe",
     });
     expect(action.action).toBe("mesh_listen");
     if (action.action === "mesh_listen") {
       expect(action.host).toBe("192.168.1.1");
-      expect(action.port).toBe(9999);
+      expect(action.port).toBe(PARSED_ACTION_TEST_PORT);
       expect(action.policy).toBe("observe");
     }
   });
diff --git a/src/test/mcp-registry-retry.test.ts b/src/test/mcp-registry-retry.test.ts
index f4c2722..73424e4 100644
--- a/src/test/mcp-registry-retry.test.ts
+++ b/src/test/mcp-registry-retry.test.ts
@@ -7,20 +7,35 @@ import {
   nextRetryDelayMs,
 } from "../core/mcp-registry-retry.js";
 
+const DELAY_DOUBLING_FACTOR = 2;
+const MULTIPLIER_WELL_BEYOND_MAX_DELAY = 10;
+const MS_PER_SECOND = 1000;
+const LEGACY_SCHEDULE_STEP_1_SECONDS = 15;
+const LEGACY_SCHEDULE_STEP_2_SECONDS = 30;
+const LEGACY_SCHEDULE_STEP_3_SECONDS = 60;
+const LEGACY_SCHEDULE_STEP_4_SECONDS = 120;
+
 describe("nextRetryDelayMs", () => {
   it("doubles the previous delay", () => {
     expect(nextRetryDelayMs(INITIAL_RETRY_DELAY_MS)).toBe(
-      INITIAL_RETRY_DELAY_MS * 2,
+      INITIAL_RETRY_DELAY_MS * DELAY_DOUBLING_FACTOR,
     );
   });
 
   it("caps at MAX_RETRY_DELAY_MS", () => {
     expect(nextRetryDelayMs(MAX_RETRY_DELAY_MS)).toBe(MAX_RETRY_DELAY_MS);
-    expect(nextRetryDelayMs(MAX_RETRY_DELAY_MS * 10)).toBe(MAX_RETRY_DELAY_MS);
+    expect(
+      nextRetryDelayMs(MAX_RETRY_DELAY_MS * MULTIPLIER_WELL_BEYOND_MAX_DELAY),
+    ).toBe(MAX_RETRY_DELAY_MS);
   });
 
   it("accumulates to comfortably exceed the previous, confirmed-insufficient 225-second retry budget (agent-comms v2.18.0's release job exhausted a fixed [15, 30, 60, 120] schedule while npm's own CDN still hadn't propagated the just-published version)", () => {
-    const previousBudgetMs = (15 + 30 + 60 + 120) * 1000;
+    const previousBudgetMs =
+      (LEGACY_SCHEDULE_STEP_1_SECONDS +
+        LEGACY_SCHEDULE_STEP_2_SECONDS +
+        LEGACY_SCHEDULE_STEP_3_SECONDS +
+        LEGACY_SCHEDULE_STEP_4_SECONDS) *
+      MS_PER_SECOND;
     let delayMs = INITIAL_RETRY_DELAY_MS;
     let totalMs = 0;
     while (totalMs < MAX_TOTAL_RETRY_MS) {
diff --git a/src/test/mesh-e2e.integration.test.ts b/src/test/mesh-e2e.integration.test.ts
index 3f952f5..ab5e7cf 100644
--- a/src/test/mesh-e2e.integration.test.ts
+++ b/src/test/mesh-e2e.integration.test.ts
@@ -14,6 +14,23 @@ import { waitFor, wireTestTransport } from "./test-transport.js";
 
 const E2E_PORT = 19878;
 
+// ---------------------------------------------------------------------------
+// Timing constants — settle windows for asynchronous mesh propagation. There is no "operation complete" signal for these steps, so the test waits a fixed budget rather than polling.
+// ---------------------------------------------------------------------------
+
+/** Milliseconds to give the coordinator time to bind its listening port. */
+const COORDINATOR_BIND_SETTLE_MS = 100;
+/** Milliseconds to give a newly joined peer time to connect and sync with the coordinator. */
+const PEER_SYNC_SETTLE_MS = 300;
+/** Milliseconds to wait for agent-list state to sync across the mesh. */
+const STATE_SYNC_SETTLE_MS = 200;
+/** Milliseconds to wait for a created room to propagate to other peers. */
+const ROOM_CREATE_SETTLE_MS = 200;
+/** Milliseconds to wait for an accepted room join to settle on both sides. */
+const ROOM_JOIN_SETTLE_MS = 200;
+/** Milliseconds to wait for a sent message (room message, DM, or tool-driven send) to be delivered. */
+const MESSAGE_DELIVERY_SETTLE_MS = 300;
+
 async function createStore(
   name: string,
   harness: string,
@@ -46,13 +63,13 @@ async function main(): Promise<void> {
   const a = await createStore("peer-a", "test-a");
 
   // Give coordinator time to bind
-  await sleep(100);
+  await sleep(COORDINATOR_BIND_SETTLE_MS);
 
   console.log("Creating peer B (joins mesh)...");
   const b = await createStore("peer-b", "test-b");
 
   // Give peer B time to connect and sync
-  await sleep(300);
+  await sleep(PEER_SYNC_SETTLE_MS);
 
   // --- Test: list agents ---
   console.log("Test: list agents from A...");
@@ -61,7 +78,7 @@ async function main(): Promise<void> {
   expect(agentsA.length >= 2, "A should see both agents").toBeTruthy();
 
   // Wait for state sync
-  await sleep(200);
+  await sleep(STATE_SYNC_SETTLE_MS);
 
   console.log("Test: list agents from B...");
   const agentsB = await b.store.listAgents(b.store.peerId);
@@ -79,7 +96,7 @@ async function main(): Promise<void> {
   });
   console.log(`  Created room: ${room.id}`);
 
-  await sleep(200);
+  await sleep(ROOM_CREATE_SETTLE_MS);
 
   // --- Test: B sees the room ---
   console.log("Test: B lists rooms...");
@@ -102,7 +119,7 @@ async function main(): Promise<void> {
   a.store.acceptRoomJoin(room.id, b.store.peerId);
   await joinPromise;
 
-  await sleep(200);
+  await sleep(ROOM_JOIN_SETTLE_MS);
 
   // --- Test: room membership visible on both sides ---
   console.log("Test: room membership on A and B...");
@@ -118,7 +135,7 @@ async function main(): Promise<void> {
   b.deliveries.length = 0;
   await a.store.sendRoomMessage(room.id, a.store.peerId, "Hello from A!");
 
-  await sleep(300);
+  await sleep(MESSAGE_DELIVERY_SETTLE_MS);
 
   console.log(`  B received ${String(b.deliveries.length)} delivery event(s)`);
   expect(
@@ -155,7 +172,7 @@ async function main(): Promise<void> {
   b.deliveries.length = 0;
   await a.store.sendDm(a.store.peerId, b.store.peerId, "Hey B!");
 
-  await sleep(300);
+  await sleep(MESSAGE_DELIVERY_SETTLE_MS);
 
   console.log(`  B received ${String(b.deliveries.length)} DM event(s)`);
   expect(b.deliveries.length >= 1, "B should receive the DM").toBeTruthy();
@@ -188,7 +205,7 @@ async function main(): Promise<void> {
     action,
   );
 
-  await sleep(300);
+  await sleep(MESSAGE_DELIVERY_SETTLE_MS);
 
   console.log(`  A received ${String(a.deliveries.length)} delivery event(s)`);
   expect(a.deliveries.length >= 1, "A should receive B's message").toBeTruthy();
@@ -201,8 +218,10 @@ async function main(): Promise<void> {
   console.log("\n✓ All tests passed!");
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+async function sleep(ms: number): Promise<void> {
+  await new Promise<void>((resolve) => {
+    setTimeout(resolve, ms);
+  });
 }
 
 test("two MeshStore instances discover each other, create a shared room, message, and push-deliver over a real TCP peer mesh", async () => {
diff --git a/src/test/mesh-smoke.runner.ts b/src/test/mesh-smoke.runner.ts
index 9511d0a..5131e34 100644
--- a/src/test/mesh-smoke.runner.ts
+++ b/src/test/mesh-smoke.runner.ts
@@ -161,7 +161,7 @@ const WAIT_FOR_PORT_TIMEOUT_MS = 15_000;
 const WAIT_FOR_PORT_RETRY_MS = 50;
 
 /** Retries a single connection attempt until the port accepts one or the deadline passes, rather than a single attempt after a flat sleep -- binding the port now waits on real, load-dependent work (identity load/generation, then an async WebCrypto key import for the room-token identity) before the coordinator listener opens, so a fixed pre-sleep is exactly the fragile pattern this codebase's own waitFor helpers already avoid elsewhere. */
-function waitForPort(port: number, host: string): Promise<void> {
+async function waitForPort(port: number, host: string): Promise<void> {
   const deadline = Date.now() + WAIT_FOR_PORT_TIMEOUT_MS;
   return new Promise((resolve, reject) => {
     function attempt(): void {
@@ -188,7 +188,7 @@ function waitForPort(port: number, host: string): Promise<void> {
 }
 
 function findMsg(
-  messages: TestMessage[],
+  messages: readonly TestMessage[],
   type: string,
 ): TestMessage | undefined {
   return messages.find((m) => m.type === type);
diff --git a/src/test/presence-readvertise.integration.test.ts b/src/test/presence-readvertise.integration.test.ts
index 6adabd6..664fac8 100644
--- a/src/test/presence-readvertise.integration.test.ts
+++ b/src/test/presence-readvertise.integration.test.ts
@@ -1,5 +1,5 @@
 /**
- * P4 presence: WireMeshTransport's periodic self-advert re-send (readvertisePresence) and its counterpart on the receiving side (reportPresenceAdvert -> TransportEvents.onPresenceAdvert). Constructed directly against two real WireMeshTransport instances joined by a genuine data connection, deliberately bypassing MeshStore -- MeshStore's own updateAgent already propagates a status change via the pre-existing broadcastPatch/broadcast() path (P3.8 has not retired that yet), which would make a MeshStore-level test unable to tell whether presence gossip specifically worked, as opposed to the older mechanism that still runs alongside it.
+ * P4 presence: WireMeshTransport's periodic self-advert re-send (readvertisePresence) and its counterpart on the receiving side (reportPresenceAdvert, surfaced via TransportEvents.onPresenceAdvert). Constructed directly against two real WireMeshTransport instances joined by a genuine data connection, deliberately bypassing MeshStore -- MeshStore's own updateAgent already propagates a status change via the pre-existing broadcastPatch/broadcast() path (P3.8 has not retired that yet), which would make a MeshStore-level test unable to tell whether presence gossip specifically worked, as opposed to the older mechanism that still runs alongside it.
  */
 
 import { test, describe, expect } from "vitest";
@@ -12,9 +12,10 @@ import type { AgentStatus } from "../core/types.js";
 import { waitFor } from "./test-transport.js";
 
 const SHORT_PRESENCE_INTERVAL_MS = 50;
+const PRESENCE_INTERVAL_TICKS_TO_SPAN = 3;
 
 function eventsRecordingPresence(
-  onPresence: (handle: ConnectionHandle, status: AgentStatus) => void,
+  onPresence: (handle: Readonly<ConnectionHandle>, status: AgentStatus) => void,
 ): TransportEvents {
   return {
     onMessage: () => undefined,
@@ -130,9 +131,12 @@ describe("WireMeshTransport presence re-advertisement", () => {
       );
 
       // Long enough to comfortably span several presence-readvertise ticks were one wired up (SHORT_PRESENCE_INTERVAL_MS above), short enough to keep the test fast -- the assertion below is a genuine "nothing happened", not a race against a real event we're waiting to observe.
-      await new Promise((resolve) =>
-        setTimeout(resolve, SHORT_PRESENCE_INTERVAL_MS * 3),
-      );
+      await new Promise((resolve) => {
+        setTimeout(
+          resolve,
+          SHORT_PRESENCE_INTERVAL_MS * PRESENCE_INTERVAL_TICKS_TO_SPAN,
+        );
+      });
       expect(presenceSeenByB.length).toBe(0);
     } finally {
       await transportB.shutdown();
diff --git a/src/test/random-id.test.ts b/src/test/random-id.test.ts
index d3a556e..305efe8 100644
--- a/src/test/random-id.test.ts
+++ b/src/test/random-id.test.ts
@@ -1,10 +1,13 @@
 import { describe, it, expect } from "vitest";
 import { randomId } from "../core/random-id.js";
 
+/** 128-bit (16-byte) random payload, matching a UUIDv4's own random length -- see random-id.ts's RANDOM_ID_BYTE_LENGTH. */
+const EXPECTED_RANDOM_ID_BYTE_LENGTH = 16;
+
 describe("randomId", () => {
   it("returns 16 bytes", () => {
     const id = randomId();
-    expect(id.length).toBe(16);
+    expect(id.length).toBe(EXPECTED_RANDOM_ID_BYTE_LENGTH);
   });
 
   it("returns a different value on each call", () => {
diff --git a/src/test/room-admission-tool-actions.test.ts b/src/test/room-admission-tool-actions.test.ts
index 9635c3b..0dc36c3 100644
--- a/src/test/room-admission-tool-actions.test.ts
+++ b/src/test/room-admission-tool-actions.test.ts
@@ -9,7 +9,8 @@ import { CommsTool } from "../core/tool.js";
 import { buildAction } from "../core/bridge.js";
 import { wireTestTransport } from "./test-transport.js";
 
-const REQUESTER_ID = "b".repeat(64);
+const DEVICE_ID_HEX_LENGTH = 64;
+const REQUESTER_ID = "b".repeat(DEVICE_ID_HEX_LENGTH);
 
 function fakeJoinRequest(roomPath: string): IncomingManageRequest {
   return {
diff --git a/src/test/room-destroy-revocation.integration.test.ts b/src/test/room-destroy-revocation.integration.test.ts
index d28b21a..479a8d3 100644
--- a/src/test/room-destroy-revocation.integration.test.ts
+++ b/src/test/room-destroy-revocation.integration.test.ts
@@ -6,6 +6,8 @@ import { test, expect } from "vitest";
 import { MeshStore } from "../core/mesh-store.js";
 import { waitFor, wireTestTransport } from "./test-transport.js";
 
+const REVOCATION_DRAIN_SETTLE_MS = 300;
+
 let nextPort = 21_410;
 function freshPort(): number {
   nextPort += 1;
@@ -74,7 +76,9 @@ test("destroying a room revokes every member's own grant for every peer, not jus
 
     await owner.destroyRoom(room.id, owner.peerId);
     // Settles the revocation-announce destroyRoom just broadcast for every member: B's own drain loop processes it asynchronously off the wire, with no observable side effect from outside B's own store to wait on affirmatively.
-    await new Promise((resolve) => setTimeout(resolve, 300));
+    await new Promise((resolve) => {
+      setTimeout(resolve, REVOCATION_DRAIN_SETTLE_MS);
+    });
 
     await expect(
       memberA.sendRoomMessageDirected(room.id, memberB.peerId, "still here?"),
diff --git a/src/test/room-invite-directed.integration.test.ts b/src/test/room-invite-directed.integration.test.ts
index 1969ccc..651d8b8 100644
--- a/src/test/room-invite-directed.integration.test.ts
+++ b/src/test/room-invite-directed.integration.test.ts
@@ -113,7 +113,8 @@ test("inviting an unreachable target throws rather than silently dropping the in
       owner: owner.peerId,
       description: "",
     });
-    const strangerId = "b".repeat(64);
+    const DEVICE_ID_HEX_LENGTH = 64;
+    const strangerId = "b".repeat(DEVICE_ID_HEX_LENGTH);
     await expect(
       owner.inviteToRoom(room.id, strangerId, owner.peerId),
     ).rejects.toMatchObject({ code: "INVITE_FAILED" });
diff --git a/src/test/room-join-admission.test.ts b/src/test/room-join-admission.test.ts
index b5c1052..3136052 100644
--- a/src/test/room-join-admission.test.ts
+++ b/src/test/room-join-admission.test.ts
@@ -30,7 +30,9 @@ import { toIdentityPort } from "../core/wire-mesh-identity.js";
 import type { ConnectionHandle, MeshTransport } from "../core/transport.js";
 import { wireTestTransport } from "./test-transport.js";
 
-const REQUESTER_ID = "b".repeat(64);
+const DEVICE_ID_HEX_LENGTH = 64;
+const TOKEN_TTL_MS = 60_000;
+const REQUESTER_ID = "b".repeat(DEVICE_ID_HEX_LENGTH);
 
 function fakeRequest(scopePath: string): {
   request: IncomingManageRequest;
@@ -132,7 +134,7 @@ describe("handleRoomJoin (owner side)", () => {
     const store = new MeshStore();
     await wireTestTransport(store);
     // Neither "c"x64 nor "d"x64 is this store's own peerId, so this DM path names a conversation the store has no part in -- the dm-admission integration tests cover the genuinely-a-participant case end to end.
-    const dmPath = `${deviceIdToHex(deviceIdFromHex("c".repeat(64)))}+${deviceIdToHex(deviceIdFromHex("d".repeat(64)))}`;
+    const dmPath = `${deviceIdToHex(deviceIdFromHex("c".repeat(DEVICE_ID_HEX_LENGTH)))}+${deviceIdToHex(deviceIdFromHex("d".repeat(DEVICE_ID_HEX_LENGTH)))}`;
 
     const handler = store.roomVerbHandlers["room.join"];
     expect(handler).toBeTruthy();
@@ -150,7 +152,7 @@ describe("handleRoomJoin (owner side)", () => {
   it("refuses a named room this store doesn't own", async () => {
     const store = new MeshStore();
     await wireTestTransport(store);
-    const someoneElse = "e".repeat(64);
+    const someoneElse = "e".repeat(DEVICE_ID_HEX_LENGTH);
     const roomPath = ownerNamedRoomPath(someoneElse, "general");
 
     const handler = store.roomVerbHandlers["room.join"];
@@ -185,7 +187,7 @@ describe("joinRoom (requester side, remote path)", () => {
       revocation: createRevocationView(),
     });
 
-    const ownerId = "f".repeat(64);
+    const ownerId = "f".repeat(DEVICE_ID_HEX_LENGTH);
     const roomPath = ownerNamedRoomPath(ownerId, "general");
     // A real, validly-minted token -- roomJoinOkSchema validates the wire response's own granted-token shape against the real CapabilityToken schema, so a hand-rolled fixture would just fail that validation. Minted here by the requester's own identity purely as a stand-in for "any real token the owner could have sent"; who actually signed it plays no part in this test, only that saveRoomToken's own CapabilityToken contract is satisfied.
     const grantedTokenVerdict = await mintCapabilityToken({
@@ -195,7 +197,7 @@ describe("joinRoom (requester side, remote path)", () => {
       bearer: deviceIdFromHex(store.peerId),
       capability: "room:member",
       scope: { kind: "room", path: roomPath },
-      expires: Date.now() + 60_000,
+      expires: Date.now() + TOKEN_TTL_MS,
       delegationsRemaining: 0,
     });
     expect(
diff --git a/src/test/room-kick-revocation.integration.test.ts b/src/test/room-kick-revocation.integration.test.ts
index 1b1e07a..79255f9 100644
--- a/src/test/room-kick-revocation.integration.test.ts
+++ b/src/test/room-kick-revocation.integration.test.ts
@@ -15,6 +15,9 @@ function freshPort(): number {
   return nextPort;
 }
 
+/** How long to wait for B's own drain loop to have processed the kick's revocation-announce off the wire, since there's no observable side effect from outside B's own store to wait on affirmatively instead. */
+const REVOCATION_ANNOUNCE_SETTLE_DELAY_MS = 300;
+
 async function makeRegisteredStore(
   port: number,
   name: string,
@@ -96,7 +99,9 @@ test("kicking a member revokes their room:member token for every peer, not just
 
     await owner.kickFromRoom(room.id, memberA.peerId, owner.peerId);
     // Settles the revocation-announce this kick just broadcast: B's own drain loop processes it asynchronously off the wire, with no observable side effect from outside B's own store to wait on affirmatively.
-    await new Promise((resolve) => setTimeout(resolve, 300));
+    await new Promise((resolve) => {
+      setTimeout(resolve, REVOCATION_ANNOUNCE_SETTLE_DELAY_MS);
+    });
 
     // sendRoomMessage (not used here) re-checks this store's own local CRDT room.members list, which the kick's own legacy room_upsert patch has by now also reached A through -- that would mask exactly what this test needs to isolate. sendRoomMessageDirected instead only ever consults A's own persisted bearer token (never revoked by kickFromRoom, which revokes the OWNER's own record of having issued it, not A's own copy), so it genuinely simulates a still-token-holding A trying to reach B directly -- the real scenario a token-side revocation exists to stop, independent of whatever A's own CRDT view happens to already know. B's own handleRoomSend rejects it with "unauthorized" (the announced revocation now verifies as revoked on B's own independent check), which sendRoomMessageDirected surfaces as a thrown error rather than swallowing it the way the fan-out path does.
     await expect(
diff --git a/src/test/room-path.test.ts b/src/test/room-path.test.ts
index a7204de..1b61903 100644
--- a/src/test/room-path.test.ts
+++ b/src/test/room-path.test.ts
@@ -6,8 +6,9 @@ import {
   slugRoomName,
 } from "../core/room-path.js";
 
-const OWNER = "1".repeat(64);
-const OTHER = "2".repeat(64);
+const DEVICE_ID_HEX_LENGTH = 64;
+const OWNER = "1".repeat(DEVICE_ID_HEX_LENGTH);
+const OTHER = "2".repeat(DEVICE_ID_HEX_LENGTH);
 
 test("ownerNamedRoomPath joins the owner and local name with a slash", () => {
   expect(ownerNamedRoomPath(OWNER, "general")).toBe(`${OWNER}/general`);
diff --git a/src/test/room-read-directed.integration.test.ts b/src/test/room-read-directed.integration.test.ts
index b3b3093..3bd01e6 100644
--- a/src/test/room-read-directed.integration.test.ts
+++ b/src/test/room-read-directed.integration.test.ts
@@ -59,9 +59,11 @@ async function makeConnectedPair(port: number): Promise<{
 }
 
 /** Mints a member grant directly under the owner's own persisted identity, for both directions: memberDeviceHex needs a persisted token in bearerSlot to authorise its own future sends (room.send or room.read) for roomPath. */
+const GRANT_EXPIRY_MS = 60_000;
+
 async function grantMembership(
-  ownerSlot: IdentitySlot,
-  bearerSlot: IdentitySlot,
+  ownerSlot: Readonly<IdentitySlot>,
+  bearerSlot: Readonly<IdentitySlot>,
   roomPath: string,
   bearerDeviceHex: string,
 ): Promise<void> {
@@ -74,7 +76,7 @@ async function grantMembership(
     bearer: deviceIdFromHex(bearerDeviceHex),
     capability: "room:member",
     scope: { kind: "room", path: roomPath },
-    expires: clock.now() + 60_000,
+    expires: clock.now() + GRANT_EXPIRY_MS,
     delegationsRemaining: 0,
   });
   expect(
@@ -174,7 +176,10 @@ test("reading a message from a peer with no room:member token for it does nothin
     );
 
     // Give the auto-mark-read timer a real chance to fire and (incorrectly) notify owner before asserting it never did.
-    await new Promise((resolve) => setTimeout(resolve, 300));
+    const AUTO_MARK_READ_GRACE_MS = 300;
+    await new Promise((resolve) => {
+      setTimeout(resolve, AUTO_MARK_READ_GRACE_MS);
+    });
     expect(
       ownerDeliveries.some((event) => event.type === "delivery_status"),
     ).toBe(false);
diff --git a/src/test/room-router.test.ts b/src/test/room-router.test.ts
index ab0301d..b8f3632 100644
--- a/src/test/room-router.test.ts
+++ b/src/test/room-router.test.ts
@@ -5,21 +5,23 @@ import { FRAME_VERB, buildCommand } from "../core/wire-mesh-transport.js";
 import { createRoomRouter } from "../core/room-router.js";
 import type { ConnectionHandle, TransportEvents } from "../core/transport.js";
 
-const TEST_HANDLE: ConnectionHandle = { id: "a".repeat(64) };
+// Matches the real 32-byte device-id's hex encoding length.
+const DEVICE_ID_HEX_LENGTH = 64;
+const TEST_HANDLE: ConnectionHandle = { id: "a".repeat(DEVICE_ID_HEX_LENGTH) };
 
 function fakeEvents(): TransportEvents {
   return {
-    onMessage: vi.fn(),
-    onIntroduction: vi.fn(),
-    onConnectionRequest: vi.fn(),
-    onPeerConnected: vi.fn(),
-    onPeerDisconnected: vi.fn(),
-    onPeerList: vi.fn(),
-    onPeerJoined: vi.fn(),
-    onBecomeCoordinator: vi.fn(),
-    onError: vi.fn(),
-    onRevocationAnnounce: vi.fn(),
-    onPresenceAdvert: vi.fn(),
+    onMessage: vi.fn<() => void>(),
+    onIntroduction: vi.fn<() => void>(),
+    onConnectionRequest: vi.fn<() => void>(),
+    onPeerConnected: vi.fn<() => void>(),
+    onPeerDisconnected: vi.fn<() => void>(),
+    onPeerList: vi.fn<() => void>(),
+    onPeerJoined: vi.fn<() => void>(),
+    onBecomeCoordinator: vi.fn<() => void>(),
+    onError: vi.fn<() => void>(),
+    onRevocationAnnounce: vi.fn<() => void>(),
+    onPresenceAdvert: vi.fn<() => void>(),
   };
 }
 
diff --git a/src/test/room-send-directed.integration.test.ts b/src/test/room-send-directed.integration.test.ts
index 17ea5aa..cb4d30b 100644
--- a/src/test/room-send-directed.integration.test.ts
+++ b/src/test/room-send-directed.integration.test.ts
@@ -15,6 +15,7 @@ import type { IdentitySlot } from "../core/identity-store.js";
 import { toIdentityPort } from "../core/wire-mesh-identity.js";
 import { waitFor, wireTestTransport } from "./test-transport.js";
 
+const TOKEN_TTL_MS = 60_000;
 let nextPort = 20_970;
 function freshPort(): number {
   nextPort += 1;
@@ -60,8 +61,8 @@ async function makeConnectedPair(port: number): Promise<{
 
 /** Mints a member grant directly, under the owner's own persisted identity, and persists it into the member's own slot -- bypassing the wire-level room.join round trip entirely, per this file's own header comment on why that round trip can't be exercised in a live two-peer test here. */
 async function grantMembership(
-  ownerSlot: IdentitySlot,
-  memberSlot: IdentitySlot,
+  ownerSlot: Readonly<IdentitySlot>,
+  memberSlot: Readonly<IdentitySlot>,
   roomPath: string,
   memberDeviceHex: string,
 ): Promise<void> {
@@ -74,7 +75,7 @@ async function grantMembership(
     bearer: deviceIdFromHex(memberDeviceHex),
     capability: "room:member",
     scope: { kind: "room", path: roomPath },
-    expires: clock.now() + 60_000,
+    expires: clock.now() + TOKEN_TTL_MS,
     delegationsRemaining: 0,
   });
   expect(
diff --git a/src/test/room-send-retry-queue.test.ts b/src/test/room-send-retry-queue.test.ts
index b364e04..0486b5a 100644
--- a/src/test/room-send-retry-queue.test.ts
+++ b/src/test/room-send-retry-queue.test.ts
@@ -9,7 +9,8 @@ import type { MeshTransport } from "../core/transport.js";
 import { deleteRoomToken } from "../core/identity-store.js";
 import { waitFor, wireTestTransport } from "./test-transport.js";
 
-const MEMBER_ID = "b".repeat(64);
+const DEVICE_ID_HEX_LENGTH = 64;
+const MEMBER_ID = "b".repeat(DEVICE_ID_HEX_LENGTH);
 const QUEUE_CAP = 100;
 
 /** A MeshTransport whose sendRoomRequest always fails until told otherwise -- flippable mid-test to simulate the member becoming reachable, and recording every attempt made against it (including retries) so a test can assert exactly which sends were retried. */
@@ -176,6 +177,9 @@ test("a flush drops (not re-queues) a send whose room this store no longer holds
     { id: MEMBER_ID, port: 0, startedAt: new Date().toISOString() },
   );
   // No token to present -- give the flush a moment to run, then confirm it made no further attempt.
-  await new Promise((resolve) => setTimeout(resolve, 50));
+  const FLUSH_GRACE_MS = 50;
+  await new Promise((resolve) => {
+    setTimeout(resolve, FLUSH_GRACE_MS);
+  });
   expect(attempts.length).toBe(1);
 });
diff --git a/src/test/room-send-retry.integration.test.ts b/src/test/room-send-retry.integration.test.ts
index 28b0529..ca878dd 100644
--- a/src/test/room-send-retry.integration.test.ts
+++ b/src/test/room-send-retry.integration.test.ts
@@ -22,7 +22,22 @@ import type { PeerIdentity } from "../core/identity.js";
 import { ownerNamedRoomPath } from "../core/room-path.js";
 
 const TEST_PORT = 19897;
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+/** How many polling attempts {@link waitFor} makes before failing. */
+const WAIT_FOR_MAX_ATTEMPTS = 20;
+/** Delay between each {@link waitFor} polling attempt. */
+const WAIT_FOR_POLL_INTERVAL_MS = 100;
+/** Settle time after creating the room, before B attempts to join it. */
+const ROOM_CREATE_SETTLE_MS = 200;
+/** Registration must wait for the TLS data connections to establish (#23). */
+const TLS_CONNECT_SETTLE_MS = 300;
+/** Settle time after B's bridge shuts down, before A sends the downtime message. */
+const MEMBER_SHUTDOWN_SETTLE_MS = 200;
+/** Settle time after A sends the downtime message, before B restarts. */
+const ROOM_SEND_SETTLE_MS = 200;
+const sleep = async (ms: number) =>
+  new Promise((r) => {
+    setTimeout(r, ms);
+  });
 
 interface Peer {
   store: MeshStore;
@@ -32,7 +47,7 @@ interface Peer {
 /** A peer wired like a real bridge: WireMeshTransport, device-id peer ID, and a persisted identity slot so createRoom can mint and persist the owner's own room:member grant. */
 async function makePeer(
   identity: PeerIdentity,
-  slot: IdentitySlot,
+  slot: Readonly<IdentitySlot>,
 ): Promise<Peer> {
   const store = new MeshStore(TEST_PORT);
   store.peerId = deviceIdToHex(Uint8Array.from(identity.deviceId));
@@ -54,9 +69,9 @@ async function waitFor(
   what: string,
   check: () => Promise<boolean>,
 ): Promise<void> {
-  for (let i = 0; i < 20; i++) {
+  for (let i = 0; i < WAIT_FOR_MAX_ATTEMPTS; i++) {
     if (await check()) return;
-    await sleep(100);
+    await sleep(WAIT_FOR_POLL_INTERVAL_MS);
   }
   expect(false, `timed out waiting for ${what}`).toBeTruthy();
 }
@@ -88,14 +103,14 @@ async function main(): Promise<void> {
     owner: a.store.peerId,
     description: "issue 28 acceptance",
   });
-  await sleep(200);
+  await sleep(ROOM_CREATE_SETTLE_MS);
 
   // B joins with a persisted identity and becomes a room member -- a real admitted join, since the room already replicating to B via legacy full-state-sync says nothing about B holding a room:member token for it.
   const identityB = loadOrCreateIdentity(slot);
   const b1 = await makePeer(identityB, slot);
   await b1.store.init();
   // Registration must wait for the TLS data connections to establish (#23).
-  await sleep(300);
+  await sleep(TLS_CONNECT_SETTLE_MS);
   await b1.store.registerAgent({
     name: "peer-b",
     harness: "pi",
@@ -119,11 +134,11 @@ async function main(): Promise<void> {
 
   // B goes down.
   await b1.store.shutdown();
-  await sleep(200);
+  await sleep(MEMBER_SHUTDOWN_SETTLE_MS);
 
   // A sends a room message while B is down: the directed send to B fails immediately (B isn't connected), so it's queued for retry rather than thrown or silently dropped.
   await a.store.sendRoomMessage(roomId, a.store.peerId, "while you were down");
-  await sleep(200);
+  await sleep(ROOM_SEND_SETTLE_MS);
 
   // B restarts in the same slot: same identity, same agent ID, same persisted room:member token -- the queued send retries the moment the reconnection to A completes.
   const identityB2 = loadOrCreateIdentity(slot);
diff --git a/src/test/room-token-store.test.ts b/src/test/room-token-store.test.ts
index 0221f7a..badf250 100644
--- a/src/test/room-token-store.test.ts
+++ b/src/test/room-token-store.test.ts
@@ -23,24 +23,49 @@ function tempSlot(harness: string): { slot: IdentitySlot; dir: string } {
   return { slot: { harness, cwd: "/tmp/project", dir }, dir };
 }
 
-function buf(bytes: number[]): Uint8Array<ArrayBuffer> {
+function buf(bytes: readonly number[]): Uint8Array<ArrayBuffer> {
   return Uint8Array.from(bytes);
 }
 
+// Arbitrary distinct byte values distinguishing each COSE_Sign1 segment across TOKEN_A/TOKEN_B in round-trip assertions -- the values themselves carry no meaning beyond being distinguishable.
+const TOKEN_A_PROTECTED_HEADER_BYTE_3 = 3;
+const TOKEN_A_PAYLOAD_BYTE_1 = 4;
+const TOKEN_A_PAYLOAD_BYTE_2 = 5;
+const TOKEN_A_PAYLOAD_BYTE_3 = 6;
+const TOKEN_A_SIGNATURE_BYTE_1 = 7;
+const TOKEN_A_SIGNATURE_BYTE_2 = 8;
+const TOKEN_A_SIGNATURE_BYTE_3 = 9;
+const TOKEN_B_PROTECTED_HEADER_BYTE_1 = 10;
+const TOKEN_B_PROTECTED_HEADER_BYTE_2 = 11;
+const TOKEN_B_SIGNATURE_BYTE_1 = 12;
+const TOKEN_B_SIGNATURE_BYTE_2 = 13;
+const TOKEN_B_SIGNATURE_BYTE_3 = 14;
+
 const TOKEN_A: CapabilityToken = [
-  buf([1, 2, 3]),
+  buf([1, 2, TOKEN_A_PROTECTED_HEADER_BYTE_3]),
   {},
-  buf([4, 5, 6]),
-  buf([7, 8, 9]),
+  buf([TOKEN_A_PAYLOAD_BYTE_1, TOKEN_A_PAYLOAD_BYTE_2, TOKEN_A_PAYLOAD_BYTE_3]),
+  buf([
+    TOKEN_A_SIGNATURE_BYTE_1,
+    TOKEN_A_SIGNATURE_BYTE_2,
+    TOKEN_A_SIGNATURE_BYTE_3,
+  ]),
 ];
 const TOKEN_B: CapabilityToken = [
-  buf([10, 11]),
+  buf([TOKEN_B_PROTECTED_HEADER_BYTE_1, TOKEN_B_PROTECTED_HEADER_BYTE_2]),
   { 1: -7 },
   null,
-  buf([12, 13, 14]),
+  buf([
+    TOKEN_B_SIGNATURE_BYTE_1,
+    TOKEN_B_SIGNATURE_BYTE_2,
+    TOKEN_B_SIGNATURE_BYTE_3,
+  ]),
 ];
-const ROOM_A = "aa".repeat(32) + "/general";
-const ROOM_B = "bb".repeat(32) + "/other-room";
+
+// Length of each synthetic room-ID's hex-device-id prefix, matching the real 32-byte device-id's hex encoding.
+const ROOM_ID_HEX_PAIR_COUNT = 32;
+const ROOM_A = "aa".repeat(ROOM_ID_HEX_PAIR_COUNT) + "/general";
+const ROOM_B = "bb".repeat(ROOM_ID_HEX_PAIR_COUNT) + "/other-room";
 
 test("loadRoomTokens returns an empty map before anything is saved", () => {
   const { slot } = tempSlot("pi");
diff --git a/src/test/state-sync-convergence.test.ts b/src/test/state-sync-convergence.test.ts
index 4fa3bec..afac24d 100644
--- a/src/test/state-sync-convergence.test.ts
+++ b/src/test/state-sync-convergence.test.ts
@@ -15,6 +15,8 @@ import { loadOrCreateIdentity, saveRoomToken } from "../core/identity-store.js";
 import { toIdentityPort } from "../core/wire-mesh-identity.js";
 import { wireTestTransport } from "./test-transport.js";
 
+const GRANT_EXPIRY_MS = 60_000;
+
 /** A local-only store: transport is set (registerAgent's own broadcastPatch needs one) but never started, so no ports and no flake -- the stores in these tests never actually connect. */
 async function makeStore(): Promise<MeshStore> {
   const store = new MeshStore();
@@ -118,7 +120,7 @@ test("room membership changes converge and stale member lists are rejected", asy
     bearer: deviceIdFromHex(joiner.id),
     capability: "room:member",
     scope: { kind: "room", path: roomId },
-    expires: bClock.now() + 60_000,
+    expires: bClock.now() + GRANT_EXPIRY_MS,
     delegationsRemaining: 0,
   });
   expect(
diff --git a/src/test/test-transport.ts b/src/test/test-transport.ts
index 53ec731..06181ec 100644
--- a/src/test/test-transport.ts
+++ b/src/test/test-transport.ts
@@ -13,6 +13,9 @@ import { toIdentityPort } from "../core/wire-mesh-identity.js";
 import { nanoid } from "../core/nanoid.js";
 import type { MeshStore } from "../core/mesh-store.js";
 
+/** Short enough to keep generated test identity slots readable, long enough that two concurrent test runs won't collide on the same throwaway cwd. */
+const TEST_IDENTITY_CWD_ID_LENGTH = 8;
+
 /** Wires store onto a fresh WireMeshTransport and a persisted identity slot, returning the slot so a test can inspect (or reuse) the persisted room tokens directly via loadRoomTokens(). Defaults to a throwaway temp-dir slot per call -- pass an explicit slot when a test needs the same identity to survive across more than one wireTestTransport call (e.g. simulating a restart). pendingConnectionTimeoutMs overrides WireMeshTransport's own default 5-minute connect_request expiry -- a test proving that expiry behaviour needs it far shorter than any real approval window. presenceReadvertiseIntervalMs likewise overrides the default 20s presence re-advertisement cadence -- a test proving that behaviour needs it far shorter too, or a test that doesn't care about presence at all wants it long enough to never fire spuriously mid-test. */
 export async function wireTestTransport(
   store: MeshStore,
@@ -22,7 +25,7 @@ export async function wireTestTransport(
 ): Promise<IdentitySlot> {
   const resolvedSlot: IdentitySlot = slot ?? {
     harness: "test",
-    cwd: nanoid(8),
+    cwd: nanoid(TEST_IDENTITY_CWD_ID_LENGTH),
     dir: fs.mkdtempSync(path.join(tmpdir(), "agent-comms-test-identity-")),
   };
   const identity = loadOrCreateIdentity(resolvedSlot);
@@ -56,7 +59,7 @@ const DEFAULT_WAIT_FOR_TIMEOUT_MS = 20_000;
 const WAIT_FOR_POLL_INTERVAL_MS = 20;
 
 /**
- * Polls condition() until it returns true or timeoutMs elapses, rather than a fixed sleep() before a single check. A real TLS handshake plus the peer_list -> connectToPeer -> state_sync -> handlePeerConnected round trip genuinely takes variable, load-dependent wall-clock time -- comfortably inside a fixed sleep on a fast local machine, not reliably so under a throttled CI runner. Throws with a descriptive message on timeout rather than letting the caller's own assertion fail with a less specific one.
+ * Polls condition() until it returns true or timeoutMs elapses, rather than a fixed sleep() before a single check. A real TLS handshake plus the peer_list -\> connectToPeer -\> state_sync -\> handlePeerConnected round trip genuinely takes variable, load-dependent wall-clock time -- comfortably inside a fixed sleep on a fast local machine, not reliably so under a throttled CI runner. Throws with a descriptive message on timeout rather than letting the caller's own assertion fail with a less specific one.
  */
 export async function waitFor(
   condition: () => boolean,
@@ -70,8 +73,8 @@ export async function waitFor(
         `waitFor timed out after ${String(timeoutMs)}ms: ${description}`,
       );
     }
-    await new Promise((resolve) =>
-      setTimeout(resolve, WAIT_FOR_POLL_INTERVAL_MS),
-    );
+    await new Promise((resolve) => {
+      setTimeout(resolve, WAIT_FOR_POLL_INTERVAL_MS);
+    });
   }
 }
diff --git a/src/test/wire-mesh-transport.test.ts b/src/test/wire-mesh-transport.test.ts
index dd75cf4..5bc0791 100644
--- a/src/test/wire-mesh-transport.test.ts
+++ b/src/test/wire-mesh-transport.test.ts
@@ -25,7 +25,9 @@ import type { MeshMessage } from "../core/wire-protocol.js";
 import type { AgentStatus } from "../core/types.js";
 import { waitFor } from "./test-transport.js";
 
-function noopEvents(overrides: Partial<TransportEvents> = {}): TransportEvents {
+function noopEvents(
+  overrides: Readonly<Partial<TransportEvents>> = {},
+): TransportEvents {
   return {
     onMessage: () => undefined,
     onPeerConnected: () => undefined,
@@ -42,7 +44,7 @@ function noopEvents(overrides: Partial<TransportEvents> = {}): TransportEvents {
 }
 
 /** Finds a free localhost port by binding to port 0 and immediately releasing it -- used both for uniquePort()-style allocation and, when nothing is subsequently listened on it, as a guaranteed-refused dial target. */
-function findFreePort(): Promise<number> {
+async function findFreePort(): Promise<number> {
   return new Promise((resolve, reject) => {
     const server = net.createServer();
     server.listen(0, "127.0.0.1", () => {
@@ -59,6 +61,11 @@ async function peerId(identity: { deviceId: Uint8Array }): Promise<string> {
   return deviceIdToHex(Uint8Array.from(identity.deviceId));
 }
 
+/** Waits `ms` milliseconds -- shared boilerplate for this file's fixed settle-time waits, so each one only needs a named constant at the call site rather than its own Promise/setTimeout shape. */
+async function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => void setTimeout(resolve, ms));
+}
+
 describe("WireMeshTransport wire-level constants", () => {
   test("DOMAIN and FRAME_SCOPE carry the documented, registered namespaced values", () => {
     // These are the values this transport actually authenticates and scopes every manage-request against -- not implementation detail, but the wire contract itself (see this file's own header comment and registry/core-domains.md's "<registrant>/<local-name>" convention). A test importing them and asserting their literal value catches drift that a test which merely re-imports the same binding on both sides of a handshake cannot: both sides of such a test would agree on a mutated value symmetrically and never notice.
@@ -103,8 +110,10 @@ describe("WireMeshTransport presence-interval construction", () => {
         () => "active",
         // Deliberately omitted: relying on the constructor's own default presenceReadvertiseIntervalMs argument is the point of this test -- it proves PRESENCE_READVERTISE_INTERVAL_SECONDS * MS_PER_SECOND actually computes 20_000, not merely that *some* interval gets scheduled.
       );
+      // Mirrors WireMeshTransport's own default cadence (PRESENCE_READVERTISE_INTERVAL_SECONDS * MS_PER_SECOND).
+      const READVERTISE_MS = 20_000;
       expect(setIntervalSpy).toHaveBeenCalledTimes(1);
-      expect(setIntervalSpy.mock.calls[0]?.[1]).toBe(20_000);
+      expect(setIntervalSpy.mock.calls[0]?.[1]).toBe(READVERTISE_MS);
       expect(unrefSpy).toHaveBeenCalledTimes(1);
     } finally {
       setIntervalSpy.mockRestore();
@@ -134,7 +143,7 @@ describe("WireMeshTransport coordinator/getter state", () => {
     const transportA = new WireMeshTransport(noopEvents(), identityA);
     const disconnects: ConnectionHandle[] = [];
     const transportB = new WireMeshTransport(
-      noopEvents({ onPeerDisconnected: (h) => disconnects.push(h) }),
+      noopEvents({ onPeerDisconnected: (h) => void disconnects.push(h) }),
       identityB,
     );
     try {
@@ -168,8 +177,8 @@ describe("WireMeshTransport connect_request quarantine and disconnect handling",
     const requestsSeenByA: ConnectionHandle[] = [];
     const transportA = new WireMeshTransport(
       noopEvents({
-        onConnectionRequest: (handle) => requestsSeenByA.push(handle),
-        onPeerDisconnected: (handle) => disconnectsSeenByA.push(handle),
+        onConnectionRequest: (handle) => void requestsSeenByA.push(handle),
+        onPeerDisconnected: (handle) => void disconnectsSeenByA.push(handle),
       }),
       identityA,
     );
@@ -214,7 +223,8 @@ describe("WireMeshTransport connect_request quarantine and disconnect handling",
       await session.close();
 
       // No positive event to poll for here (the assertion below proves an absence), so a fixed wait is the right shape, matching approval.integration.test.ts's own "reject closes with reason" convention -- long enough for A's watchForDisconnect handler to have processed the closed session event.
-      await new Promise((resolve) => setTimeout(resolve, 300));
+      const DISCONNECT_SETTLE_MS = 300;
+      await delay(DISCONNECT_SETTLE_MS);
 
       // The strongest available proof the pending entry was actually cleaned up (not merely "not yet decided", which would be equally true before disconnect too): a decision made afterwards must fail exactly like it does for any other unknown handle.
       await expect(
@@ -237,7 +247,7 @@ describe("WireMeshTransport connect_request quarantine and disconnect handling",
 
     const requests: ConnectionHandle[] = [];
     const transportA = new WireMeshTransport(
-      noopEvents({ onConnectionRequest: (h) => requests.push(h) }),
+      noopEvents({ onConnectionRequest: (h) => void requests.push(h) }),
       identityA,
     );
     const transportB = new WireMeshTransport(noopEvents(), identityB);
@@ -292,8 +302,8 @@ describe("WireMeshTransport connect_request quarantine and disconnect handling",
     const messagesSeenByA: MeshMessage[] = [];
     const transportA = new WireMeshTransport(
       noopEvents({
-        onConnectionRequest: (h) => requests.push(h),
-        onMessage: (_h, m) => messagesSeenByA.push(m),
+        onConnectionRequest: (h) => void requests.push(h),
+        onMessage: (_h, m) => void messagesSeenByA.push(m),
       }),
       identityA,
     );
@@ -327,7 +337,8 @@ describe("WireMeshTransport connect_request quarantine and disconnect handling",
       await transportB
         .send({ id: idA }, { method: "peer_left", peerId: "nobody" })
         .catch(() => undefined);
-      await new Promise((resolve) => setTimeout(resolve, 200));
+      const SEND_SETTLE_MS = 200;
+      await delay(SEND_SETTLE_MS);
       expect(messagesSeenByA.length).toBe(0);
     } finally {
       await transportB.shutdown();
@@ -346,13 +357,13 @@ describe("WireMeshTransport connect_request quarantine and disconnect handling",
     const messagesSeenByB: MeshMessage[] = [];
     const transportA = new WireMeshTransport(
       noopEvents({
-        onConnectionRequest: (h) => requests.push(h),
-        onMessage: (_h, m) => messagesSeenByA.push(m),
+        onConnectionRequest: (h) => void requests.push(h),
+        onMessage: (_h, m) => void messagesSeenByA.push(m),
       }),
       identityA,
     );
     const transportB = new WireMeshTransport(
-      noopEvents({ onMessage: (_h, m) => messagesSeenByB.push(m) }),
+      noopEvents({ onMessage: (_h, m) => void messagesSeenByB.push(m) }),
       identityB,
     );
     try {
@@ -419,11 +430,11 @@ describe("WireMeshTransport connectToPeer", () => {
     const messagesSeenByA: MeshMessage[] = [];
     const messagesSeenByB: MeshMessage[] = [];
     const transportA = new WireMeshTransport(
-      noopEvents({ onMessage: (_h, m) => messagesSeenByA.push(m) }),
+      noopEvents({ onMessage: (_h, m) => void messagesSeenByA.push(m) }),
       identityA,
     );
     const transportB = new WireMeshTransport(
-      noopEvents({ onMessage: (_h, m) => messagesSeenByB.push(m) }),
+      noopEvents({ onMessage: (_h, m) => void messagesSeenByB.push(m) }),
       identityB,
     );
     try {
@@ -474,7 +485,7 @@ describe("WireMeshTransport connectToPeer", () => {
     const errors: Error[] = [];
     const transportA = new WireMeshTransport(noopEvents(), identityA);
     const transportB = new WireMeshTransport(
-      noopEvents({ onError: (e) => errors.push(e) }),
+      noopEvents({ onError: (e) => void errors.push(e) }),
       identityB,
     );
     try {
@@ -506,7 +517,7 @@ describe("WireMeshTransport connectToPeer", () => {
     const identityB = generateIdentity();
     const errors: Error[] = [];
     const transportB = new WireMeshTransport(
-      noopEvents({ onError: (e) => errors.push(e) }),
+      noopEvents({ onError: (e) => void errors.push(e) }),
       identityB,
     );
     try {
@@ -541,7 +552,7 @@ describe("WireMeshTransport shutdown", () => {
 
     const requests: ConnectionHandle[] = [];
     const transportA = new WireMeshTransport(
-      noopEvents({ onConnectionRequest: (h) => requests.push(h) }),
+      noopEvents({ onConnectionRequest: (h) => void requests.push(h) }),
       identityA,
       undefined,
       undefined,
@@ -592,7 +603,9 @@ describe("WireMeshTransport shutdown", () => {
     const disconnectsSeenByB: ConnectionHandle[] = [];
     const transportA = new WireMeshTransport(noopEvents(), identityA);
     const transportB = new WireMeshTransport(
-      noopEvents({ onPeerDisconnected: (h) => disconnectsSeenByB.push(h) }),
+      noopEvents({
+        onPeerDisconnected: (h) => void disconnectsSeenByB.push(h),
+      }),
       identityB,
     );
     try {
@@ -627,8 +640,8 @@ describe("WireMeshTransport listener policy propagation into quarantine", () =>
     const requests: ConnectionHandle[] = [];
     const transportA = new WireMeshTransport(
       noopEvents({
-        onConnectionRequest: (h) => requests.push(h),
-        onIntroduction: (handle) => introductions.push({ handle }),
+        onConnectionRequest: (h) => void requests.push(h),
+        onIntroduction: (handle) => void introductions.push({ handle }),
       }),
       identityA,
     );
@@ -691,7 +704,7 @@ describe("WireMeshTransport readvertisePresence body", () => {
     );
     const transportB = new WireMeshTransport(
       noopEvents({
-        onPresenceAdvert: (_h, status) => presenceSeenByB.push(status),
+        onPresenceAdvert: (_h, status) => void presenceSeenByB.push(status),
       }),
       identityB,
     );
@@ -707,9 +720,8 @@ describe("WireMeshTransport readvertisePresence body", () => {
       );
 
       // Several ticks with getCurrentPresence returning undefined: the early return must skip sendGossipUpdate entirely, so B must never observe a presence advert from A.
-      await new Promise((resolve) =>
-        setTimeout(resolve, SHORT_INTERVAL_MS * 4),
-      );
+      const PRESENCE_TICKS_TO_SKIP = 4;
+      await delay(SHORT_INTERVAL_MS * PRESENCE_TICKS_TO_SKIP);
       expect(presenceSeenByB.length).toBe(0);
 
       // Flipping to a real status proves the same interval, and the same early-return branch, genuinely does send once status is defined -- ruling out "the interval simply never fired at all" as an alternative explanation for the assertion above.
@@ -807,7 +819,9 @@ describe("WireMeshTransport accepting side's own disconnect wiring and dial dedu
 
     const disconnectsSeenByA: ConnectionHandle[] = [];
     const transportA = new WireMeshTransport(
-      noopEvents({ onPeerDisconnected: (h) => disconnectsSeenByA.push(h) }),
+      noopEvents({
+        onPeerDisconnected: (h) => void disconnectsSeenByA.push(h),
+      }),
       identityA,
     );
     const transportB = new WireMeshTransport(noopEvents(), identityB);
@@ -841,7 +855,7 @@ describe("WireMeshTransport accepting side's own disconnect wiring and dial dedu
     // transportA1 and transportA2 both hold identityA -- the same peer id -- but are two separate transport instances so the first can go through shutdown() (a terminal, one-way state for whichever transport calls it) while a genuinely fresh listener stands in for "the same peer, reachable again" for the second dial. transportB itself is never shut down: it's the one whose own dataDials bookkeeping this test is about.
     const connectsSeenByA: ConnectionHandle[] = [];
     const transportA1 = new WireMeshTransport(
-      noopEvents({ onPeerConnected: (h) => connectsSeenByA.push(h) }),
+      noopEvents({ onPeerConnected: (h) => void connectsSeenByA.push(h) }),
       identityA,
     );
     const transportB = new WireMeshTransport(noopEvents(), identityB);
@@ -863,10 +877,11 @@ describe("WireMeshTransport accepting side's own disconnect wiring and dial dedu
 
       // The first A instance goes away; B's own watchForDisconnect must clear idA out of its dataDials so a second connectToPeer for the same peer id is not silently treated as "already dialled" and skipped.
       await transportA1.shutdown();
-      await new Promise((resolve) => setTimeout(resolve, 200));
+      const DEDUP_SETTLE_MS = 200;
+      await delay(DEDUP_SETTLE_MS);
 
       transportA2 = new WireMeshTransport(
-        noopEvents({ onPeerConnected: (h) => connectsSeenByA.push(h) }),
+        noopEvents({ onPeerConnected: (h) => void connectsSeenByA.push(h) }),
         identityA,
       );
       await transportA2.startDataServer();