[dolho]

Summary

/ws/events (Trinity Connect) authenticates its MCP key itself and never runs get_current_user, so every check that function makes has to be repeated in the handler. This adds the one that was missing: the #995 account-state check, which get_current_user and /ws already apply.

• dependencies.owner_is_suspended(owner_row) is called on the owner row the handler already resolves, before accept().
• The refusal is the same close as an inactive key (4001), so the key holder learns nothing more than "this key does not work".

Changes

• src/backend/dependencies.py: owner_is_suspended.
• src/backend/main.py: the guard in websocket_events_endpoint.
• tests/unit/test_ent858_event_stream_owner_state.py, plus its tests/registry.json entry.

Test Plan

• cd tests && pytest unit/test_ent858_event_stream_owner_state.py: 8 pass. The owner check runs for real against a table of cases. The handler's placement is checked by reading its code, because main.py can't be imported in the unit tests; ent#837's owner floor is tested the same way.
• Mutation: removing the guard turns both placement tests red.
• Related suites pass: test_837_workspace_only_floor, test_2323_machine_identities, test_ent872_fleet_reach, test_ent467_ws_agent_scope.

Fixes abilityai/trinity-enterprise#858

🤖 Generated with Claude Code

[vybe]

merge-train: validated at 407934e (lane C). Suspended-owner refusal matches get_current_user and /ws, no legitimate principal newly refused. Follow-ups (non-blocking): the placement tests are source-text — a TestClient handshake test like test_ent872_fleet_reach.py:535 would pin behaviour; an already-open socket is not cut on suspension (same as /ws).