diff --git a/cli/src/__tests__/secrets.test.ts b/cli/src/__tests__/secrets.test.ts
index 295a8e5e036..a0c31147649 100644
--- a/cli/src/__tests__/secrets.test.ts
+++ b/cli/src/__tests__/secrets.test.ts
@@ -137,6 +137,9 @@ describe("secrets CLI helpers", () => {
     delete process.env.PAPERCLIP_SECRETS_AWS_REGION;
     delete process.env.AWS_REGION;
     delete process.env.AWS_DEFAULT_REGION;
+    delete process.env.AWS_ACCESS_KEY_ID;
+    delete process.env.AWS_SECRET_ACCESS_KEY;
+    delete process.env.AWS_SESSION_TOKEN;
     delete process.env.PAPERCLIP_SECRETS_AWS_DEPLOYMENT_ID;
     delete process.env.PAPERCLIP_SECRETS_AWS_KMS_KEY_ID;
   });
diff --git a/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts b/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts
index bf7baafcbe6..045e6428b69 100644
--- a/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts
+++ b/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts
@@ -113,6 +113,7 @@ describe("claude_local ACP startup fallback", () => {
 
   it("trusts the Paperclip API URL when network access is allowlisted", async () => {
     const paperclipApiUrl = "http://127.0.0.1:4310";
+    vi.stubEnv("PAPERCLIP_API_URL", paperclipApiUrl);
     vi.stubEnv("PAPERCLIP_RUNTIME_API_URL", paperclipApiUrl);
     const ctx = buildContext({ networkScope: "allowlist" });
 
diff --git a/server/src/__tests__/app-hmr-port.test.ts b/server/src/__tests__/app-hmr-port.test.ts
index f6e6ac1cf6d..e59c7aac746 100644
--- a/server/src/__tests__/app-hmr-port.test.ts
+++ b/server/src/__tests__/app-hmr-port.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { resolveViteHmrHost, resolveViteHmrPort } from "../app.ts";
+import { resolveViteHmrHost, resolveViteHmrPort, resolveViteHmrProtocol } from "../app.ts";
 
 describe("resolveViteHmrPort", () => {
   it("uses serverPort + 10000 when the result stays in range", () => {
@@ -19,13 +19,29 @@ describe("resolveViteHmrPort", () => {
 });
 
 describe("resolveViteHmrHost", () => {
-  it("omits wildcard bind hosts so Vite uses the browser hostname", () => {
+  it("omits wildcard and loopback bind hosts so Vite uses the browser hostname", () => {
     expect(resolveViteHmrHost("0.0.0.0")).toBeUndefined();
     expect(resolveViteHmrHost("::")).toBeUndefined();
+    expect(resolveViteHmrHost("127.0.0.1")).toBeUndefined();
+    expect(resolveViteHmrHost("::1")).toBeUndefined();
+    expect(resolveViteHmrHost("localhost")).toBeUndefined();
   });
 
-  it("keeps concrete bind hosts", () => {
-    expect(resolveViteHmrHost("127.0.0.1")).toBe("127.0.0.1");
+  it("keeps externally addressable concrete bind hosts", () => {
     expect(resolveViteHmrHost("paperclip-dev")).toBe("paperclip-dev");
   });
 });
+
+describe("resolveViteHmrProtocol", () => {
+  it("accepts supported websocket protocols", () => {
+    expect(resolveViteHmrProtocol(undefined)).toBeUndefined();
+    expect(resolveViteHmrProtocol("ws")).toBe("ws");
+    expect(resolveViteHmrProtocol("wss")).toBe("wss");
+  });
+
+  it("rejects unsupported websocket protocols", () => {
+    expect(() => resolveViteHmrProtocol("https")).toThrow(
+      "PAPERCLIP_VITE_HMR_PROTOCOL must be ws or wss",
+    );
+  });
+});
diff --git a/server/src/__tests__/heartbeat-accepted-plan-workspace-refresh.test.ts b/server/src/__tests__/heartbeat-accepted-plan-workspace-refresh.test.ts
index 416577e4db5..d485192a652 100644
--- a/server/src/__tests__/heartbeat-accepted-plan-workspace-refresh.test.ts
+++ b/server/src/__tests__/heartbeat-accepted-plan-workspace-refresh.test.ts
@@ -359,7 +359,6 @@ describeEmbeddedPostgres("accepted plan workspace refresh", () => {
       responsibleUserId: "responsible-user",
       assigneeAgentId: agentId,
       identifier: "PAP-9122",
-      executionWorkspaceId: sharedExecutionWorkspaceId,
       executionWorkspaceSettings: {
         mode: "isolated_workspace",
       },
diff --git a/server/src/__tests__/heartbeat-workspace-branch-containment.test.ts b/server/src/__tests__/heartbeat-workspace-branch-containment.test.ts
index 38394581ea4..2c9aba9b56c 100644
--- a/server/src/__tests__/heartbeat-workspace-branch-containment.test.ts
+++ b/server/src/__tests__/heartbeat-workspace-branch-containment.test.ts
@@ -1039,7 +1039,7 @@ describeEmbeddedPostgres("heartbeat workspace branch containment", () => {
   });
 
   it.each([
-    ["workspace-runtime fresh worktree reuse", "fresh_realize" as const, null],
+    ["workspace-runtime fresh worktree reuse", "fresh_realize" as const, "source-workspace"],
     ["workspace-runtime persisted restore", "persisted_restore" as const, "source-workspace"],
   ])("contains mid-change branch divergence at %s", async (_name, callSite, expectedWorkspaceId) => {
     const repoRoot = await createGitRepo();