diff --git a/packages/sdk/tests/authored-use-loader.test.ts b/packages/sdk/tests/authored-use-loader.test.ts
index 4f083417b..e9009774a 100644
--- a/packages/sdk/tests/authored-use-loader.test.ts
+++ b/packages/sdk/tests/authored-use-loader.test.ts
@@ -19,7 +19,14 @@ function fixture(files: Record<string, string[]>): string {
     writeFileSync(join(directory, `${name}.flow.ts`), `
       import { flow } from '@relayflows/surface';
       export default flow(${JSON.stringify(name)}, { use: ${JSON.stringify(use)} }, async f => {
-        throw new Error('loader must never execute authored bodies');
+        // The authored body must NEVER run during use: resolution — the loader
+        // only walks the header. If you see this thrown by a test in
+        // packages/sdk/tests/authored-use-loader.test.ts, some loader code path
+        // is invoking the body when it should be inspecting the header only.
+        // Track the invocation site and gate it on the same signal that
+        // execute-authored-flow uses (see 'preflightHelpers' or the compile
+        // pass, not the body).
+        throw new Error('loader-invoked-body: use: resolution must not execute authored bodies (see authored-use-loader.test.ts)');
       });
     `);
   }
diff --git a/packages/sdk/tests/webhook.test.ts b/packages/sdk/tests/webhook.test.ts
index be0073189..57ccded87 100644
--- a/packages/sdk/tests/webhook.test.ts
+++ b/packages/sdk/tests/webhook.test.ts
@@ -26,7 +26,18 @@ async function receiver(dir: string): Promise<string> {
   const server = await startWebhookServer(dir, 0);
   servers.push(server);
   const address = server.address();
-  if (!address || typeof address === 'string') throw new Error('missing HTTP address');
+  if (!address || typeof address === 'string') {
+    // startWebhookServer returned before the TCP socket bound (address()===null)
+    // or bound to a UNIX socket path (typeof 'string'). Neither shape is usable
+    // for the http:// URL these tests hand to the receiver. If you hit this:
+    //   - Verify startWebhookServer is awaited before receiver() returns.
+    //   - Confirm the second arg (port) is a number, not a socket path.
+    //   - Check that a prior test didn't hold onto port 0 or exhaust ephemeral ports.
+    throw new Error(
+      'webhook receiver: server.address() returned a non-TCP address; '
+      + `see packages/sdk/tests/webhook.test.ts:${28}`,
+    );
+  }
   return `http://127.0.0.1:${address.port}`;
 }
 
diff --git a/scripts/schema-metaschemas.mjs b/scripts/schema-metaschemas.mjs
index 504c44cd1..5952a968e 100644
--- a/scripts/schema-metaschemas.mjs
+++ b/scripts/schema-metaschemas.mjs
@@ -42,7 +42,17 @@ export function outputMetaschemas(require) {
         const fragment = target.hash;
         target.hash = '';
         const name = ids.get(target.href);
-        if (!name) throw new Error(`Unbundled meta-schema reference ${target.href}`);
+        if (!name) {
+          throw new Error(
+            `Unbundled meta-schema reference ${target.href}.\n`
+            + `Add the referenced schema's $id to the bundled roots list in\n`
+            + `scripts/schema-metaschemas.mjs so this generator can inline it under\n`
+            + `#/$defs/<name>. Bundled roots are the entries fed to \`ids\`. This pin\n`
+            + `exists so a new schema can't silently produce a JSON Schema file with\n`
+            + `an unresolvable external $ref — Ajv would then throw at load time and\n`
+            + `every consumer would see a runtime failure with no context.`,
+          );
+        }
         result.$ref = `#/$defs/${name}${fragment.startsWith('#/') ? fragment.slice(1) : ''}`;
       } else if (key === 'dependencies') {
         result.dependentRequired = child;