3f29c10a80
Keep the production-entry test (every sender shape from a logged-in client still runs its turn, authored by the principal, never the claimed sender), the root-cause pin (a ws-ticket identity is a login identity, so the Desktop is one) and the one Honcho routing invariant (a principal-authored turn lands in its own a2a session, never the human's). The author-shape, write-refusal and counterfactual tests restated those.