- Simplify the OCS status guard to `if status and status != "ok"` — falsy (missing/None/"") is tolerated more naturally than the explicit tuple. - Add `test_value_error_from_ocs_failure_returns_none`, covering the OCS-failure ValueError flowing through `_get_enabled_apps_or_none` to the scan-all fallback. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>