Each removed test re-asserts a contract a stronger test already owns at
the real boundary; the keeper is named per group.
- api_server CORS: `_origin_allowed` for an allowlisted origin and for an
Origin-less client -> the configured-origin preflight test and every
Origin-less /health request. The Idempotency-Key allow-header assertion
moves into the preflight test instead of running a second identical
preflight.
- api_server room grants: the execution-policy predicate's two outcomes ->
test_api_server_runs' HTTP grant-refresh tests (403 on drift, 200 on the
authorized digest).
- api_server multimodal: the pure input_image canonicalization -> the
/v1/responses test that sends the same parts and asserts the same shape.
- credential pool: matched-hint rotation (401) and second-429 rotation ->
test_credential_pool_routing's real-pool hint test and TestPoolRotationCycle,
which assert the same steps plus the exact rotate kwargs and swap.
- shared metrics: two runtime cases that replay the send resolver's truth
table -> TestSendRequiresCollection; the e2e gzip-retry test (both
attempts compress in the same second, so it cannot see mtime) ->
TestCompression::test_gzip_is_deterministic_across_time; e2e outbox
untouched -> TestOutboxIsNotAQueue.
- mcp oauth: provider reuse across reconnects -> the manager restore test;
the non-tty private predicate -> build_oauth_auth's fail-fast test; the
manager disk-watch test -> the integration test, which gains its one
unique assertion (an unchanged file returns False).
- startup watchdog: disarm-without-arm -> test_disarm_is_idempotent, whose
second disarm runs in the same state and branch.
93a7267b10