diff --git a/README.md b/README.md
index 8685431a..8f8b2493 100644
--- a/README.md
+++ b/README.md
@@ -290,7 +290,7 @@ All entry points read `~/.config/turnstone/config.toml`. CLI flags override conf
 [api]
 base_url = "http://localhost:8000/v1"
 api_key = ""
-tavily_key = ""        # only needed for local/vLLM models without native search
+# tavily_key = ""      # only needed for local/vLLM models without native search
 
 [model]
 name = ""              # empty = auto-detect
diff --git a/tests/test_bridge_stress.py b/tests/test_bridge_stress.py
index f9d02130..aef920a5 100644
--- a/tests/test_bridge_stress.py
+++ b/tests/test_bridge_stress.py
@@ -39,7 +39,13 @@ def _make_bridge(**overrides) -> Bridge:
         approval_timeout=1,
     )
     defaults.update(overrides)
-    return Bridge(**defaults)
+    bridge = Bridge(**defaults)
+    # Replace real httpx client with a mock so daemon threads spawned by
+    # _handle_approval / _handle_plan_review don't make real HTTP calls
+    # after the test's patch context exits.
+    bridge._http.close()
+    bridge._http = MagicMock()
+    return bridge
 
 
 def _approval_items(tool_name: str = "bash") -> list[dict]:
diff --git a/tests/test_channel_discord.py b/tests/test_channel_discord.py
index 32186c1a..896fe733 100644
--- a/tests/test_channel_discord.py
+++ b/tests/test_channel_discord.py
@@ -390,6 +390,7 @@ class TestApprovalVerdictDisplay:
         bot.config.streaming_edit_interval = 1.5
         bot.config.auto_approve = False
         bot.config.auto_approve_tools = []
+        bot.storage = None
         bot._streaming = {}
         bot._pending_approval_msgs = {}
         bot._notify_reply_channels = {}
diff --git a/tests/test_sessions.py b/tests/test_sessions.py
index e707af2c..de543613 100644
--- a/tests/test_sessions.py
+++ b/tests/test_sessions.py
@@ -699,6 +699,7 @@ class TestWebSearchGating:
         with (
             patch.object(session, "_get_capabilities", return_value=caps),
             patch("turnstone.core.session.get_tavily_key", return_value=None),
+            patch("turnstone.core.web_search._ddg_available", return_value=False),
         ):
             tools = session._get_active_tools()
 
diff --git a/turnstone/console/tls.py b/turnstone/console/tls.py
index fbb97855..efe8a3ed 100644
--- a/turnstone/console/tls.py
+++ b/turnstone/console/tls.py
@@ -80,7 +80,12 @@ class TLSManager:
 
             setup_metrics(self._event_dispatcher)
         except ImportError:
-            pass  # prometheus_client not installed
+            pass  # prometheus_client or lacme.metrics missing
+        except ValueError as exc:
+            if "Duplicated timeseries" in str(exc):
+                log.debug("tls_metrics_already_registered")
+            else:
+                raise
 
     def _subscribe_events(self) -> None:
         """Subscribe structlog handlers to lacme lifecycle events."""
@@ -322,7 +327,7 @@ class TLSManager:
         _require_lacme()
         from lacme.mtls import server_ssl_context
 
-        return server_ssl_context(  # type: ignore[no-any-return]
+        return server_ssl_context(  # type: ignore[no-any-return,unused-ignore]
             cert_pem=self._frontend_bundle.fullchain_pem,
             key_pem=self._frontend_bundle.key_pem,
             ca_cert_pem=self.get_root_cert_pem(),
@@ -339,7 +344,7 @@ class TLSManager:
         _require_lacme()
         from lacme.mtls import client_ssl_context
 
-        return client_ssl_context(  # type: ignore[no-any-return]
+        return client_ssl_context(  # type: ignore[no-any-return,unused-ignore]
             cert_pem=self._internal_bundle.cert_pem,
             key_pem=self._internal_bundle.key_pem,
             ca_cert_pem=self.get_root_cert_pem(),
diff --git a/turnstone/core/tls.py b/turnstone/core/tls.py
index 5f5c22be..fa2ca20f 100644
--- a/turnstone/core/tls.py
+++ b/turnstone/core/tls.py
@@ -79,7 +79,12 @@ class TLSClient:
 
             setup_metrics(self._event_dispatcher)
         except ImportError:
-            pass
+            pass  # prometheus_client or lacme.metrics missing
+        except ValueError as exc:
+            if "Duplicated timeseries" in str(exc):
+                log.debug("tls_metrics_already_registered")
+            else:
+                raise
 
     async def init(self) -> None:
         """Fetch CA root cert and request a service certificate.
@@ -220,7 +225,7 @@ class TLSClient:
         _require_lacme()
         from lacme.mtls import server_ssl_context
 
-        return server_ssl_context(  # type: ignore[no-any-return]
+        return server_ssl_context(  # type: ignore[no-any-return,unused-ignore]
             cert_pem=self._bundle.fullchain_pem,
             key_pem=self._bundle.key_pem,
             ca_cert_pem=self._ca_pem,
@@ -233,7 +238,7 @@ class TLSClient:
         _require_lacme()
         from lacme.mtls import client_ssl_context
 
-        return client_ssl_context(  # type: ignore[no-any-return]
+        return client_ssl_context(  # type: ignore[no-any-return,unused-ignore]
             cert_pem=self._bundle.cert_pem,
             key_pem=self._bundle.key_pem,
             ca_cert_pem=self._ca_pem,