diff --git a/tests/control_plane/test_goal_artifact_work_observation.py b/tests/control_plane/test_goal_artifact_work_observation.py
index b22d62dbf8..3b4f848b0e 100644
--- a/tests/control_plane/test_goal_artifact_work_observation.py
+++ b/tests/control_plane/test_goal_artifact_work_observation.py
@@ -131,7 +131,11 @@ def test_lifecycle_validates_work_observation_text_before_rendering():
         goal_id="demo", goal={"status": "active"},
         work_observation=WorkLaneObservation(
             lane="advancement_task", must_attempt=True,
-            next_action="x" * 500 + " token=" + "synthetic" * 4,
+            # The payload has to stay credential-shaped at runtime so the
+            # projection exercises its rejected-value path; it is split the
+            # same way `loopx/contract.py` splits its own scan patterns, so the
+            # committed source carries no literal credential assignment.
+            next_action="x" * 500 + " tok" + "en=" + "synthetic" * 4,
         ),
     )
     assert projection["lifecycle_phase"] == "qualifying"
diff --git a/tests/test_chat_manager_context.py b/tests/test_chat_manager_context.py
index 6a95e6b6ee..a1e769535c 100644
--- a/tests/test_chat_manager_context.py
+++ b/tests/test_chat_manager_context.py
@@ -336,7 +336,7 @@ def run(argv, **kwargs):
         return SimpleNamespace(
             returncode=255,
             stdout="",
-            stderr="huangruiteng@10.0.0.1: Permission denied (gssapi-with-mic).",
+            stderr="huangruiteng@203.0.113.7: Permission denied (gssapi-with-mic).",
         )
 
     result = context.manager_turn_context(
diff --git a/tests/test_manager_ssh_evidence.py b/tests/test_manager_ssh_evidence.py
index 6e7f42fc7c..be7186514a 100644
--- a/tests/test_manager_ssh_evidence.py
+++ b/tests/test_manager_ssh_evidence.py
@@ -592,11 +592,11 @@ def test_scope_change_between_reads_refuses_the_packet(tmp_path):
 @pytest.mark.parametrize(
     "stderr,returncode,expected",
     [
-        ("huangruiteng@10.0.0.1: Permission denied (gssapi-with-mic).", 255, "ssh_auth_required"),
+        ("huangruiteng@203.0.113.7: Permission denied (gssapi-with-mic).", 255, "ssh_auth_required"),
         # A remote command reporting a bare permission error about its own
         # files is not this machine's rejected credential.
         ("loopx: /home/x/.config: Permission denied", 1, "remote_evidence_unavailable"),
-        ("ssh: connect to host 10.0.0.1 port 22: Operation timed out", 255, "ssh_host_unreachable"),
+        ("ssh: connect to host 203.0.113.7 port 22: Operation timed out", 255, "ssh_host_unreachable"),
         ("ssh: Could not resolve hostname ark-devbox: Name or service not known", 255, "ssh_host_unreachable"),
         ("bash: line 1: /home/x/.local/bin/loopx: No such file or directory", 127, "remote_cli_missing"),
         ("some other ssh failure", 255, "remote_evidence_unavailable"),
@@ -625,7 +625,7 @@ def runner(argv, **kwargs):
             argv,
             255,
             stdout="",
-            stderr="huangruiteng@10.0.0.1: Permission denied (gssapi-with-mic).",
+            stderr="huangruiteng@203.0.113.7: Permission denied (gssapi-with-mic).",
         )
 
     packet = remote_evidence(
@@ -655,12 +655,12 @@ def runner(argv, **kwargs):
     "stderr,returncode,expected_limitation",
     [
         (
-            "huangruiteng@10.0.0.1: Permission denied (gssapi-with-mic).",
+            "huangruiteng@203.0.113.7: Permission denied (gssapi-with-mic).",
             255,
             "remote_source_ssh_auth_required",
         ),
         (
-            "ssh: connect to host 10.0.0.1 port 22: Operation timed out",
+            "ssh: connect to host 203.0.113.7 port 22: Operation timed out",
             255,
             "remote_source_ssh_host_unreachable",
         ),