6 cases against real startServer via ws client: ①bad-origin 401 ②wrong-path destroy ③oversized-frame 1009 ④spawn-fail exit(-1) — all pass in sandbox; ⑤attach->output ⑥reconnect-replay gated by PTY_AVAILABLE (auto-skip where posix_spawn is blocked). Orchestrator verified ⑤⑥ sandbox-off: 6/6 pass with real shell — F5/F6 confirmed (replay incl CJK/ANSI intact).