Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/tools/database/config.py`:
- Around line 44-51: Add validation to ensure the default_connection value
exists in the connections mapping: implement a pydantic root_validator (or
`@validator` that accesses other fields) for the model that checks that the
'default_connection' string is one of the keys of the 'connections' dict and
raises a ValueError if not (handle the case where connections is empty
appropriately). Use the existing field names 'connections' and
'default_connection' in the validator so misconfiguration is caught at model
creation rather than later in tool resolution.

In `@src/synthorg/tools/database/schema_inspect.py`:
- Around line 112-125: Change the broad "except Exception" in the schema
inspection block to catch database-specific errors only (use "except
aiosqlite.Error as exc") so only SQLite-related failures are handled; update
imports to include aiosqlite if missing, keep the existing logger.warning call
(DB_SCHEMA_INSPECT_FAILED, action=action, error=str(exc)) and the
ToolExecutionResult return unchanged, and do not swallow system exceptions like
KeyboardInterrupt or SystemExit.

In `@src/synthorg/tools/database/sql_query.py`:
- Around line 254-262: Remove the redundant list() wrapping around await
cursor.fetchall() in the async function that assigns to rows; change the
assignment to use rows = await cursor.fetchall() so rows is directly the list
returned by cursor.fetchall(), leaving the subsequent logger.info and
ToolExecutionResult code (keyword, row_count handling) unchanged and referencing
the same rows variable.

In `@src/synthorg/tools/factory.py`:
- Around line 298-318: The code rebuilds sandbox backends multiple times when
sandbox_backends is None (calls to build_sandbox_backends before resolving
different categories); refactor by computing a single local backends variable
once (e.g., compute resolved_backends = sandbox_backends or
build_sandbox_backends(config=config.sandboxing, workspace=workspace)) and then
pass resolved_backends into resolve_sandbox_for_category for both the version
control and terminal resolution paths (references: sandbox_backends,
build_sandbox_backends, resolve_sandbox_for_category, config.sandboxing,
terminal_sandbox) so backends are built at most once per call.

In `@src/synthorg/tools/invoker.py`:
- Around line 199-204: The call to
self._permission_checker.check_sub_constraints passes dict(tool_call.arguments)
which is only a shallow copy and may allow nested mutable values to be mutated
by sub-constraint evaluation; replace the shallow copy with a deep copy (use
copy.deepcopy) of tool_call.arguments before passing it to
_permission_checker.check_sub_constraints so mutations cannot leak into later
validation/execution, keeping the call signature and arguments (tool.name,
tool.category, tool.action_type) unchanged.

In `@src/synthorg/tools/sub_constraint_enforcer.py`:
- Around line 124-138: The current tuple eagerly evaluates all checks by calling
self._check_network, self._check_terminal, self._check_git, and
self._check_requires_approval up front; change this to lazy evaluation so each
check is invoked only as you iterate. Replace the tuple of direct calls with a
generator/iterable of callables or a generator expression that calls each check
(e.g., yield or call each lambda) and iterate over it, invoking each check in
turn and returning the first non-None violation; refer to the methods
_check_network, _check_terminal, _check_git, and _check_requires_approval and
the local variable checks/violation to locate and update the code.

In `@src/synthorg/tools/sub_constraints.py`:
- Around line 236-241: The code directly indexes _LEVEL_SUB_CONSTRAINTS with
access_level which can raise a KeyError if a new ToolAccessLevel isn't present;
change this to fetch with a safe default (e.g.,
_LEVEL_SUB_CONSTRAINTS.get(access_level, DEFAULT_SUB_CONSTRAINTS or an empty
list)) and add a defensive logger.warning or logger.debug indicating an unknown
access_level before falling back, then continue to call
logger.debug(SUB_CONSTRAINT_RESOLVED, access_level=access_level.value,
source="level_default") as before; update references to _LEVEL_SUB_CONSTRAINTS,
access_level, and SUB_CONSTRAINT_RESOLVED in the same block.

In `@src/synthorg/tools/terminal/base_terminal_tool.py`:
- Around line 66-85: The command blocklist currently uses substring matching via
the _is_command_blocked method (it checks if pattern.lower() in normalized), so
update the docstring for the command_blocklist field in the terminal config (the
command_blocklist declaration) to explicitly state patterns are matched as
substrings anywhere in the command (not just as prefixes), note this differs
from the allowlist's prefix matching, and add a brief example and warning about
single-word patterns like "halt"/"shutdown"/"reboot" potentially matching
unintended strings; keep the wording concise and include guidance to use more
specific patterns if exact command matching is desired.

In `@src/synthorg/tools/terminal/config.py`:
- Around line 27-40: Update the command_blocklist in config.py (symbol:
command_blocklist) to include broader/regex-safe patterns and additional
dangerous commands: replace simple substrings like "rm -rf /" with regex
patterns that account for flags (e.g.,
r"\\brm\\s+(-[\\w-\\s]+\\s*)*/?\\s*/\\b"), add patterns for recursive
chmod/chown (e.g., r"\\bchmod\\s+-R\\b", r"\\bchown\\s+-R\\b"), mv to /dev/null
(e.g., r"\\bmv\\s+/.+\\s+/dev/null\\b"), and other dangerous variants (mkfs, dd,
fork bomb, shutdown/reboot/poweroff variants); ensure the Field default uses
these regex strings and update any matching/validation code to use re.search on
each pattern rather than simple substring checks so the new patterns are
effective, and keep in mind to adopt an allowlist approach for production
deployments.

In `@src/synthorg/tools/terminal/shell_command.py`:
- Around line 198-206: The truncation currently slices output to
self._config.max_output_bytes then appends a marker, which can push the result
past the limit; fix by precomputing the truncation marker string (e.g.,
trunc_marker = f"\n\n[Truncated: output exceeded
{self._config.max_output_bytes:,} bytes]"), then when len(output) >
self._config.max_output_bytes set truncated = True and slice the original output
to self._config.max_output_bytes - len(trunc_marker) (use max(0, ...) to avoid
negative slice lengths) and append trunc_marker so the final output length never
exceeds self._config.max_output_bytes; update references to output, truncated,
and self._config.max_output_bytes accordingly.

In `@src/synthorg/tools/web/html_parser.py`:
- Around line 169-179: HtmlParserTool.__init__ currently doesn't accept or
forward network_policy and request_timeout to BaseWebTool; add optional
parameters network_policy=None and request_timeout=None to
HtmlParserTool.__init__ and pass them through in the super().__init__ call (or
alternatively change the base class to a simpler BaseTool and update the
docstring to state this tool makes no HTTP requests) so the behavior is
explicit; update the constructor signature and the super call referencing
HtmlParserTool.__init__ and BaseWebTool to reflect the chosen approach and
adjust the docstring to note whether network settings are ignored.

In `@src/synthorg/tools/web/http_request.py`:
- Around line 209-227: The code currently uses response.text and len(content)
which counts characters and decodes the entire body into memory, so change the
logic in the HTTP request handling to read and truncate by bytes: stream the
response bytes (e.g., using response.iter_content(chunk_size=4096) or access
response.content up to _max_response_bytes) accumulate at most
self._max_response_bytes bytes, set truncated=True if more bytes exist, then
decode only the collected bytes to a string (use errors='replace' or 'ignore')
for logging and use the byte length for content_length; update uses of
response.text, content, truncated, and the logger.info(WEB_REQUEST_SUCCESS, ...)
call accordingly so truncation and the "[Truncated: response exceeded ...
bytes]" message reflect bytes not characters and avoid loading the full body
into memory.

In `@src/synthorg/tools/web/web_search.py`:
- Line 119: Replace the shallow copy used when constructing parameters_schema
with a deep, read-only copy: use copy.deepcopy(_PARAMETERS_SCHEMA) and wrap the
result with types.MappingProxyType so nested dicts like "properties" aren't
shared or mutable; update the import to include copy and MappingProxyType and
change the construction site where parameters_schema=dict(_PARAMETERS_SCHEMA) is
used (referencing _PARAMETERS_SCHEMA and the parameters_schema argument) to
create MappingProxyType(copy.deepcopy(_PARAMETERS_SCHEMA)).

In `@tests/unit/tools/database/test_sql_query.py`:
- Around line 34-35: Add the missing pytest unit marker to the test by
decorating the test_classify method with `@pytest.mark.unit` (and ensure pytest is
imported if not already); this mirrors other tests in the file and keeps the
test suite markers consistent while the test still asserts
_classify_statement(query) == expected.

In `@tests/unit/tools/test_factory_new_categories.py`:
- Around line 48-60: The test test_custom_network_policy builds a custom
NetworkPolicy and passes it to build_default_tools but never asserts the policy
was applied; update the test to fetch the http_request tool (as done via
next(...) and HttpRequestTool) and add an assertion that the tool's
network_policy (or the appropriate property on the HttpRequestTool instance)
equals the policy instance or has the same settings (e.g.,
block_private_ips=False) to verify build_default_tools applied the custom
NetworkPolicy.

In `@tests/unit/tools/test_network_validator.py`:
- Around line 36-39: Replace the broad pytest.raises(Exception) in test_frozen
with the specific pydantic ValidationError: update the test case (test_frozen)
to expect ValidationError from pydantic when attempting to mutate
NetworkPolicy.block_private_ips, import ValidationError from pydantic at the top
of the test module, and make the same replacement for the similar assertions
around lines 57-60 so all Pydantic field validation checks use
pytest.raises(ValidationError) instead of Exception.

In `@tests/unit/tools/test_sub_constraint_enforcer.py`:
- Around line 40-44: The test_frozen currently expects a generic Exception when
mutating the frozen Pydantic model; update test_frozen to expect
pydantic.errors.ValidationError specifically by replacing
pytest.raises(Exception) with pytest.raises(ValidationError) and add the
appropriate import for ValidationError from pydantic at the top of the test
file; keep the test target SubConstraintViolation and the mutation line
unchanged so the failure still arises from the frozen behavior.
- Around line 161-174: The test test_local_only_blocks_clone currently calls
enforcer.check with ActionType.VCS_COMMIT which is incorrect for a clone/read
operation; update the enforcer.check invocation in test_local_only_blocks_clone
to use ActionType.VCS_READ (or add a concise inline comment explaining why
VCS_COMMIT is intentionally used) so the action type matches the semantic intent
for a clone, keeping references to SubConstraintEnforcer,
ToolSubConstraints(git=GitAccess.LOCAL_ONLY), and the "git_clone" call
consistent.

---

Outside diff comments:
In `@tests/unit/tools/test_factory.py`:
- Line 45: Update the docstring in tests/unit/tools/test_factory.py to match the
current expected tool count: change the phrase "Factory returns all 11 built-in
tools sorted by name." to reflect 14 built-in tools (or use a count derived from
_EXPECTED_TOOL_NAMES); locate the test function or module containing that
docstring and update it to "14 built-in tools" or make it dynamic by referencing
_EXPECTED_TOOL_NAMES so the docstring remains accurate when the list changes.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/tools/database/config.py`:
- Around line 46-49: The connections mapping currently allows blank/whitespace
keys; update its type to use NotBlankStr for keys so invalid names are rejected
at model creation: change the annotated type from dict[str,
DatabaseConnectionConfig] to dict[NotBlankStr, DatabaseConnectionConfig] and
import NotBlankStr from core.types, keeping the Field(...) as-is; ensure this
aligns with the existing default_connection constraint and run validations to
confirm blank keys are now rejected.

In `@src/synthorg/tools/database/schema_inspect.py`:
- Around line 127-177: Both _list_tables and _describe_table open and query the
DB without honoring DatabaseConnectionConfig.query_timeout, so slow/locked DBs
can hang; modify these methods to wrap the async DB operations (the
aiosqlite.connect + execute + fetchall sequence) in an asyncio.wait_for using
the configured query_timeout (same pattern used by SqlQueryTool) and log/return
a ToolExecutionResult error on timeout; ensure you reference
self._config.query_timeout and keep the URI construction and safety check
(_SAFE_IDENTIFIER_RE) but move the actual DB calls into the timed block and
handle asyncio.TimeoutError similarly to other DB errors.

In `@src/synthorg/tools/database/sql_query.py`:
- Around line 39-53: The current _WRITE_PREFIXES tuple permits file-affecting
SQLite statements (e.g., ATTACH, DETACH, VACUUM) whenever read_only=False, which
allows arbitrary DB files to be touched; create a separate blacklist constant
(e.g., _FILE_AFFECTING_PREFIXES) containing "ATTACH", "DETACH", and "VACUUM"
(and any variants like "VACUUM INTO") and update the validation logic that
inspects SQL prefixes (the code paths that currently consult _WRITE_PREFIXES) to
always reject statements starting with any _FILE_AFFECTING_PREFIXES regardless
of the read_only flag; ensure both places where prefix checks occur (the
_WRITE_PREFIXES definition and the other occurrence around lines 158-175) are
updated to reference the new blacklist so file-oriented statements remain
blocked even when writable.

In `@src/synthorg/tools/factory.py`:
- Around line 120-142: The factory _build_database_tools currently builds tools
only for DatabaseConfig.default_connection (or the first entry), ignoring other
entries in DatabaseConfig.connections; update it to iterate over all
config.connections items and instantiate a SqlQueryTool and SchemaInspectTool
for each connection (using each connection's DatabaseConnectionConfig) so every
configured connection is exposed as tools; ensure returned tuple includes one
pair per connection (optionally include the connection name in tool construction
or wrapping if the tools support/need it) rather than only the default.
- Around line 270-274: The current assignment uses truthiness so an explicitly
provided empty mapping for sandbox_backends gets ignored; change the logic to
honor any supplied sandbox_backends (including {} or MappingProxyType({})) by
checking if sandbox_backends is not None and only calling
build_sandbox_backends(config.sandboxing, workspace) when sandbox_backends is
None; update the assignment that sets resolved_backends (and any related uses)
to prefer the provided sandbox_backends when sandbox_backends is not None,
otherwise call build_sandbox_backends.

In `@src/synthorg/tools/invoker.py`:
- Around line 207-221: The code treats requires_approval like a hard deny by
returning early instead of parking the escalation and letting the normal
security flow run; change the branch handling violation.requires_approval to
append a structured record to self._pending_escalations (including tool_call,
violation, tool_call.id/name and any correlation id) and produce a non-fatal
ToolResult (e.g., is_error=False or a special pending flag) or otherwise avoid
returning early so that _check_security() still executes; keep the existing
logger.warning(TOOL_SECURITY_ESCALATED, ...) but remove the immediate return and
ensure whatever caller logic expects a pending escalation can resume the tool
call from the entry points that inspect _pending_escalations and call
_check_security().
- Around line 199-204: Replace the direct copy.deepcopy call used when calling
_permission_checker.check_sub_constraints with the guarded helper
_safe_deepcopy_args so deepcopy failures are handled consistently; specifically,
before invoking _permission_checker.check_sub_constraints(tool.name,
tool.category, tool.action_type, ...), call self._safe_deepcopy_args(tool_call)
(or otherwise obtain the safely-copied arguments via that helper), check for a
ToolResult indicating TOOL_INVOKE_DEEPCOPY_ERROR and return it if present, and
only pass the successful deep-copied dict to
_permission_checker.check_sub_constraints to avoid raising on non-copyable
values.

In `@src/synthorg/tools/network_validator.py`:
- Around line 103-109: The current model_validator method _normalize_allowlist
mutates a frozen instance with object.__setattr__; instead implement
normalization before instance construction by changing the validator to run in
"before" mode and operate on the input mapping: replace
`@model_validator`(mode="after") _normalize_allowlist with a
`@model_validator`(mode="before") function that accepts the incoming values dict,
lowercases and deduplicates values from the "hostname_allowlist" key into a
tuple, sets that tuple back into the values dict, and returns the modified
values; remove any use of object.__setattr__ so no mutation of the constructed
object occurs.
- Around line 350-441: validate_url_host is too large and mixes parsing, port
normalization, allowlist/master-switch checks, literal-IP handling, and DNS
resolution; split it into small helpers to keep the main function under 50
lines. Extract responsibilities into helper functions such as
parse_and_normalize_hostname(url) that calls extract_hostname and determines
is_https, determine_port(url, is_https) that validates and returns port or an
error string, check_allowlist_and_master_switch(normalized, policy, is_https,
port) that returns _ok or an error as appropriate, handle_literal_ip(normalized,
is_https, port) that uses ipaddress.ip_address and is_blocked_ip, and
perform_dns_check(normalized, timeout) that wraps resolve_and_check and returns
either the resolved IPs or an error string; then rewrite validate_url_host to
call those helpers in sequence and return early based on their results,
preserving uses of _ok, resolve_and_check, is_blocked_ip, extract_hostname, and
policy.hostname_allowlist / policy.block_private_ips /
policy.dns_resolution_timeout.
- Around line 408-410: The allowlist branch returns early without performing DNS
resolution, leaving resolved_ips empty and bypassing the module's
TOCTOU/rebinding protections; change the early-return logic in the block that
checks if normalized is in policy.hostname_allowlist to perform the same
hostname resolution used elsewhere in this module (populate resolved_ips using
the existing resolver code/path and apply any canonicalization the function
uses), then call _ok with the normalized name, port, is_https flag and the
populated resolved_ips (i.e., preserve the same resolved_ips handling as the
non-allowlist path) so allowlisted hostnames are still pinned to their resolved
IPs before returning.

In `@src/synthorg/tools/sub_constraint_enforcer.py`:
- Around line 102-129: The check() method only evaluates network, terminal, git,
and requires_approval and ignores ToolSubConstraints.file_system,
.code_execution, and .network_allowlist as well as the arguments param; fix by
reading the ToolSubConstraints for the invoked tool (use the existing tool_name
lookup that returns ToolSubConstraints), add/ call new helper methods (e.g.,
_check_filesystem(tool_name, category, arguments),
_enforce_code_execution(tool_name, category),
_enforce_network_allowlist(tool_name, category)) or extend check() to: (1)
enforce FileSystemScope by validating paths from arguments with PathValidator
and rejecting accesses outside WORKSPACE_ONLY/PROJECT_DIRECTORY/FULL semantics,
(2) enforce code_execution by selecting/forcing the appropriate runner or
rejecting non-containerized runs when code_execution == CONTAINERIZED, and (3)
enforce per-agent network_allowlist by passing the allowlist into the network
transport or rejecting disallowed destinations; update check() to include these
checks (and return SubConstraintViolation on failure) and remove the unused noqa
on arguments once implemented.

In `@src/synthorg/tools/sub_constraints.py`:
- Around line 193-222: When get_sub_constraints receives custom_constraints for
a built-in access_level, do not return it verbatim; instead load the built-in
defaults for that access_level (the existing spec defaults used for
SANDBOXED/PROJECT/ETC) and merge only the explicitly provided override fields
from custom_constraints into those defaults so unspecified fields keep the
built-in values. Update get_sub_constraints to detect when access_level !=
ToolAccessLevel.CUSTOM, perform a field-wise merge/copy from the default
ToolSubConstraints for that access_level with non-None/custom values overriding,
and adjust the logger call (e.g., use source="merged" or similar) before
returning the resulting ToolSubConstraints.

In `@src/synthorg/tools/terminal/shell_command.py`:
- Around line 205-221: The code currently truncates the combined `output` string
by character count instead of bytes; change the truncation to operate on UTF-8
encoded bytes: after combining `result.stdout` and `result.stderr` into
`output`, encode it to `out_bytes = output.encode("utf-8")`, compute `marker =
f"\n\n[Truncated: output exceeded {self._config.max_output_bytes:,} bytes]"` and
`marker_bytes = marker.encode("utf-8")`, check `if len(out_bytes) >
self._config.max_output_bytes:` then slice `out_bytes = out_bytes[: max(0,
self._config.max_output_bytes - len(marker_bytes))]`, decode back with `output =
out_bytes.decode("utf-8", errors="replace")`, append `marker` and set `truncated
= True`; update references to `output`, `marker`, `truncated`, and keep using
`self._config.max_output_bytes`.
- Around line 113-121: Allowlist check currently inspects the raw shell string,
which is bypassable via shell chaining; modify the validation in the execution
path that calls bash -c so it either (A) parses the command into argv (e.g., via
shlex.split) and validates the parsed executable/first argument against
self._config.command_allowlist (use the same logic as _is_command_allowed but
applied to the first token), or (B) if you must keep passing through a shell,
explicitly reject any shell metacharacters (like ;, &&, |, $, `, >, <, \\n) when
a command_allowlist is set; update the code paths around _is_command_allowed and
where the subprocess is invoked so ToolExecutionResult is returned with
is_error=True when validation fails.
- Around line 162-180: The code currently only rejects absolute
working_directory values but lets relative paths like "../../" through; update
the validation where working_dir is converted to cwd (the Path(working_dir)
block) to resolve the path against the workspace root and ensure it stays inside
the workspace before calling self._sandbox.execute. Concretely, compute resolved
= (workspace_root / working_dir).resolve() and compare to
workspace_root.resolve() using resolved.is_relative_to(workspace_root.resolve())
(or equivalent containment check) and return a ToolExecutionResult with
is_error=True and a clear message if the resolved path is outside the workspace;
keep the existing error for absolute paths, and then pass the validated cwd into
self._sandbox.execute.

In `@src/synthorg/tools/web/http_request.py`:
- Around line 272-278: In _pin_url, avoid emitting malformed IPv6 netlocs and
stop mutating the caller's headers: when building pinned_netloc, detect IPv6
literals (e.g., pinned_ip contains ':') and wrap them in brackets (use
f"[{pinned_ip}]" when needed) before appending port_suffix; do not modify the
incoming headers dict — create a new_headers = dict(headers) (or {} if headers
is None), set new_headers["Host"] = parsed.hostname or "" if missing, and return
the rewritten URL together with the new_headers (adjust the function
return/signature accordingly) so callers receive a fresh headers mapping.

In `@src/synthorg/tools/web/web_search.py`:
- Around line 144-151: The current broad "except Exception" around the call to
self._provider.search in the web search routine swallows system errors; change
it to explicitly handle provider-level errors and re-raise system-level
exceptions. Replace the bare except with either an except catching the
provider-specific exception type(s) raised by WebSearchProvider.search (e.g.,
ProviderError) or, if unknown, keep except Exception as exc but immediately
re-raise for critical system exceptions (MemoryError, RecursionError,
KeyboardInterrupt, SystemExit) before logging and returning the
ToolExecutionResult; reference self._provider.search, WEB_SEARCH_FAILED,
logger.warning and ToolExecutionResult when making the change.

In `@tests/unit/tools/database/test_sql_query.py`:
- Around line 15-36: Remove the duplicate pytest marker on the test method: keep
a single `@pytest.mark.unit` and delete the other one so the decorator list for
test_classify only contains one `@pytest.mark.unit` plus the existing
`@pytest.mark.parametrize`; ensure the test still calls _classify_statement(query)
== expected and that `@pytest.mark.parametrize` remains immediately above the def
test_classify definition.

---

Duplicate comments:
In `@src/synthorg/tools/web/http_request.py`:
- Around line 200-227: The current implementation uses httpx.AsyncClient.request
which buffers the entire response before you truncate, risking OOM; replace the
request call with httpx.AsyncClient.stream and iterate response.aiter_bytes()
(or aiter_raw() chunks) inside the same async with, accumulate up to
self._max_response_bytes and stop reading further once the budget is hit, then
decode the accumulated bytes to produce content; keep the same exception
handling (TimeoutException/HTTPError) and return ToolExecutionResult as before,
and ensure the stream/response is properly closed when you break early.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/tools/database/config.py`:
- Around line 66-67: Replace the literal event name
"database_config_default_missing" with the domain event constant (e.g.,
DATABASE_CONFIG_DEFAULT_MISSING) from synthorg.observability.events.database:
import the constant at top of src/synthorg/tools/database/config.py and pass
that constant to logger.warning in place of the raw string; ensure the import
uses the exact constant name (DATABASE_CONFIG_DEFAULT_MISSING) and update the
logger call in the same function where logger.warning currently uses the
literal.

---

Duplicate comments:
In `@src/synthorg/tools/database/config.py`:
- Around line 49-52: Change the type for the connections mapping to use
NotBlankStr for keys so blank/whitespace connection names are rejected: replace
dict[str, DatabaseConnectionConfig] with dict[NotBlankStr,
DatabaseConnectionConfig] on the connections Field (and add/import NotBlankStr
from core.types at top of the module) to ensure validation uses the canonical
identifier type.
- Around line 58-70: The current _validate_default_connection (decorated with
`@model_validator`(mode="after")) only logs a warning when default_connection is
missing from connections, but this allows downstream KeyError; change the
validator to reject the model by raising a validation error (e.g., ValueError or
pydantic.ValidationError) when self.connections is set and
self.default_connection is not present, including the invalid default_connection
and available connections in the error message so model construction fails fast;
update any tests/consumers expecting a warning accordingly.