diff --git a/src/channels/plugins/contracts/channel-import-guardrails.test.ts b/src/channels/plugins/contracts/channel-import-guardrails.test.ts
index 3d3d3c5ac945..e6708a06cbee 100644
--- a/src/channels/plugins/contracts/channel-import-guardrails.test.ts
+++ b/src/channels/plugins/contracts/channel-import-guardrails.test.ts
@@ -422,6 +422,7 @@ function collectCoreSourceFiles(): string[] {
       normalizedFullPath.includes(".test-utils.") ||
       normalizedFullPath.includes(".test-harness.") ||
       normalizedFullPath.includes(".test-helpers.") ||
+      normalizedFullPath.includes(".test-support.") ||
       entryName.endsWith("-test-helpers.ts") ||
       entryName === "test-manager-helpers.ts" ||
       normalizedFullPath.includes(".mock-harness.") ||
diff --git a/src/plugins/contracts/memory-authorization.contract.test.ts b/src/plugins/contracts/memory-authorization.contract.test.ts
index 5a20920513d5..f8cbc2f6addd 100644
--- a/src/plugins/contracts/memory-authorization.contract.test.ts
+++ b/src/plugins/contracts/memory-authorization.contract.test.ts
@@ -268,28 +268,28 @@ describe("memory authorization SDK contract", () => {
         runtime.readAuthorized({ context: deriveContext, plan, handle }),
       );
 
-      // @ts-expect-error retrieve only permits broker-internal candidate selection.
       void runtime.searchAuthorized({
+        // @ts-expect-error retrieve only permits broker-internal candidate selection.
         context: retrieveContext,
-        plan: retrievePlan,
+        plan: derivePlan,
         query: "query",
         limit: 1,
       });
       // @ts-expect-error retrieve only permits broker-internal candidate selection.
       void runtime.readAuthorized({ context: retrieveContext, plan: retrievePlan, handle });
-      // @ts-expect-error the context and plan must name the same content operation.
       void runtime.searchAuthorized({
-        context: readContext,
-        plan: derivePlan,
+        context: deriveContext,
+        // @ts-expect-error the context and plan must name the same content operation.
+        plan: readPlan,
         query: "query",
         limit: 1,
       });
 
       const retrievePlanFromAuthorize = runtime.authorize(retrieveContext);
       void retrievePlanFromAuthorize.then((plan) => {
-        // @ts-expect-error retrieve only permits broker-internal candidate selection.
         return runtime.searchAuthorized({
-          context: retrieveContext,
+          context: deriveContext,
+          // @ts-expect-error retrieve only permits broker-internal candidate selection.
           plan,
           query: "query",
           limit: 1,
@@ -344,10 +344,10 @@ describe("memory authorization SDK contract", () => {
       );
       void runtime.statusAuthorized({ context: statusContext, plan: statusPlan });
 
-      // @ts-expect-error retrieve may select candidates only inside the broker.
       void runtime.writeAuthorized({
+        // @ts-expect-error retrieve may select candidates only inside the broker.
         context: retrieveContext,
-        plan: retrievePlan,
+        plan: appendPlan,
         mutation: appendMutation,
       });
       // @ts-expect-error the mutation kind must match the context and plan operation.
@@ -356,18 +356,18 @@ describe("memory authorization SDK contract", () => {
         plan: appendPlan,
         mutation: importMutation,
       });
-      // @ts-expect-error retrieve may not invoke an import action.
       void runtime.importAuthorized({
+        // @ts-expect-error retrieve may not invoke an import action.
         context: retrieveContext,
-        plan: retrievePlan,
+        plan: importPlan,
         mutation: importMutation,
       });
       // @ts-expect-error retrieve may not invoke a sync action.
       void runtime.syncAuthorized({ context: retrieveContext, plan: retrievePlan });
-      // @ts-expect-error retrieve may not produce a content-bearing export payload.
       void runtime.exportAuthorized({
+        // @ts-expect-error retrieve may not produce a content-bearing export payload.
         context: retrieveContext,
-        plan: retrievePlan,
+        plan: exportPlan,
         handles: [handle],
       });
       // @ts-expect-error retrieve may not invoke a status action.
diff --git a/src/plugins/memory-authorization-path-inventory.ts b/src/plugins/memory-authorization-path-inventory.test-support.ts
similarity index 99%
rename from src/plugins/memory-authorization-path-inventory.ts
rename to src/plugins/memory-authorization-path-inventory.test-support.ts
index 00b330d717d7..905165c6448c 100644
--- a/src/plugins/memory-authorization-path-inventory.ts
+++ b/src/plugins/memory-authorization-path-inventory.test-support.ts
@@ -1,4 +1,4 @@
-/** Phase-0 inventory of every known path that can ingest, expose, or derive memory. */
+/** Test-only Phase-0 inventory of every known path that can ingest, expose, or derive memory. */
 export const MEMORY_AUTHORIZATION_PATH_DISPOSITIONS = [
   "authorized",
   "blocked-in-enforced-mode",
diff --git a/src/plugins/memory-authorization-path-inventory.test.ts b/src/plugins/memory-authorization-path-inventory.test.ts
index d9ace6807ea3..1aaf730c4869 100644
--- a/src/plugins/memory-authorization-path-inventory.test.ts
+++ b/src/plugins/memory-authorization-path-inventory.test.ts
@@ -8,7 +8,7 @@ import {
   MEMORY_AUTHORIZATION_PATH_DISPOSITIONS,
   MEMORY_AUTHORIZATION_PATH_INVENTORY,
   type MemoryAuthorizationPathInventoryEntry,
-} from "./memory-authorization-path-inventory.js";
+} from "./memory-authorization-path-inventory.test-support.js";
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 
diff --git a/test/scripts/type-suppression-inventory.test.ts b/test/scripts/type-suppression-inventory.test.ts
index b371ca68019a..76cd99233b8a 100644
--- a/test/scripts/type-suppression-inventory.test.ts
+++ b/test/scripts/type-suppression-inventory.test.ts
@@ -78,15 +78,15 @@ describe("type suppression inventory", () => {
       "src/infra/kysely-sync.types.test.ts:61:@ts-expect-error Kysely checks order references and selected aliases.",
       "src/plugin-sdk/plugin-entry.reply-trigger.test.ts:8:@ts-expect-error Trigger eligibility is only supported for before_agent_reply.",
       "src/plugin-sdk/plugin-entry.reply-trigger.test.ts:10:@ts-expect-error An empty trigger list cannot prove that a hook is inactive.",
-      "src/plugins/contracts/memory-authorization.contract.test.ts:271:@ts-expect-error retrieve only permits broker-internal candidate selection.",
+      "src/plugins/contracts/memory-authorization.contract.test.ts:273:@ts-expect-error retrieve only permits broker-internal candidate selection.",
       "src/plugins/contracts/memory-authorization.contract.test.ts:278:@ts-expect-error retrieve only permits broker-internal candidate selection.",
-      "src/plugins/contracts/memory-authorization.contract.test.ts:280:@ts-expect-error the context and plan must name the same content operation.",
-      "src/plugins/contracts/memory-authorization.contract.test.ts:290:@ts-expect-error retrieve only permits broker-internal candidate selection.",
-      "src/plugins/contracts/memory-authorization.contract.test.ts:347:@ts-expect-error retrieve may select candidates only inside the broker.",
+      "src/plugins/contracts/memory-authorization.contract.test.ts:283:@ts-expect-error the context and plan must name the same content operation.",
+      "src/plugins/contracts/memory-authorization.contract.test.ts:293:@ts-expect-error retrieve only permits broker-internal candidate selection.",
+      "src/plugins/contracts/memory-authorization.contract.test.ts:349:@ts-expect-error retrieve may select candidates only inside the broker.",
       "src/plugins/contracts/memory-authorization.contract.test.ts:353:@ts-expect-error the mutation kind must match the context and plan operation.",
-      "src/plugins/contracts/memory-authorization.contract.test.ts:359:@ts-expect-error retrieve may not invoke an import action.",
+      "src/plugins/contracts/memory-authorization.contract.test.ts:361:@ts-expect-error retrieve may not invoke an import action.",
       "src/plugins/contracts/memory-authorization.contract.test.ts:365:@ts-expect-error retrieve may not invoke a sync action.",
-      "src/plugins/contracts/memory-authorization.contract.test.ts:367:@ts-expect-error retrieve may not produce a content-bearing export payload.",
+      "src/plugins/contracts/memory-authorization.contract.test.ts:369:@ts-expect-error retrieve may not produce a content-bearing export payload.",
       "src/plugins/contracts/memory-authorization.contract.test.ts:373:@ts-expect-error retrieve may not invoke a status action.",
     ]);
   });