diff --git a/tests/Integration/Infrastructure/Adapter/In/Api/Controllers/AccountFile/UploadControllerTest.php b/tests/Integration/Infrastructure/Adapter/In/Api/Controllers/AccountFile/UploadControllerTest.php
index 88f2df73a..bd6350e1a 100644
--- a/tests/Integration/Infrastructure/Adapter/In/Api/Controllers/AccountFile/UploadControllerTest.php
+++ b/tests/Integration/Infrastructure/Adapter/In/Api/Controllers/AccountFile/UploadControllerTest.php
@@ -196,6 +196,41 @@ public function testAnExtensionTheCallerGivesIsKept(): void
         $this->assertSame('LOG', $this->extensionStoredFor($r->body->itemId));
     }
 
+    /**
+     * No MIME types configured at all must refuse the upload up front, before any of the content
+     * checks that assume there is an allow-list to compare against.
+     *
+     * The config here is rewritten to drop the `<filesAllowedMime>` element entirely (not merely
+     * empty its contents) *before* the first API call of the test, so the very first config load
+     * — the one that populates the file cache — already sees the absent element and
+     * `getFilesAllowedMime()` falls back to `[]`. Rewriting it after a call would race the file
+     * cache's mtime-based invalidation, which only has one-second resolution.
+     */
+    public function testNoAllowedMimeTypesConfiguredIsRejected(): void
+    {
+        $configFile = $this->configPath . DIRECTORY_SEPARATOR . 'config.xml';
+        $config = file_get_contents($configFile);
+
+        // getFilesAllowedMime() only falls back to [] when the key is absent from the loaded
+        // config array; an empty-but-present <filesAllowedMime></filesAllowedMime> node instead
+        // deserializes to '' and is cast to a one-element array, which is not empty().
+        $config = preg_replace('#<filesAllowedMime>.*?</filesAllowedMime>#s', '', $config);
+
+        file_put_contents($configFile, $config);
+
+        $accountId = $this->createAccount();
+
+        $r = $this->upload($accountId, [
+            'name'      => 'hello.txt',
+            'content'   => base64_encode(self::PLAIN_TEXT_CONTENT),
+            'type'      => 'text/plain',
+            'extension' => 'TXT',
+        ]);
+
+        $this->assertSame(400, $r->status);
+        $this->assertSame("There aren't any allowed MIME types", $r->body->error->message);
+    }
+
     public function testOversizedUploadIsRejected(): void
     {
         $accountId = $this->createAccount();
diff --git a/tests/Integration/Infrastructure/Adapter/In/Api/Controllers/ClientControllerTest.php b/tests/Integration/Infrastructure/Adapter/In/Api/Controllers/ClientControllerTest.php
index eb3c31c5c..c91e40d98 100644
--- a/tests/Integration/Infrastructure/Adapter/In/Api/Controllers/ClientControllerTest.php
+++ b/tests/Integration/Infrastructure/Adapter/In/Api/Controllers/ClientControllerTest.php
@@ -105,6 +105,27 @@ public function testViewActionNonExistant(): void
         $this->assertSame('Client not found', $r->body->error->message);
     }
 
+    /**
+     * `customFields=1` is the only parameter that changes what the controller does, not merely
+     * what it returns: `CLIENT_VIEW` carries a vault (it is one of the `CAN_USE_SECURE_TOKEN_ACTIONS`
+     * that mint a token holding the master password), and asking for custom fields is what makes
+     * the controller call `requireMasterPass()` to open it before including them. Without a test
+     * that actually sets the flag, that branch — and the vault it depends on — never runs, even
+     * though `testViewAction()` above already proves the flag defaults to off.
+     */
+    public function testViewActionWithCustomFields(): void
+    {
+        $id = $this->createClient(self::PARAMS)->body->itemId;
+
+        $r = $this->callApi(AclActionsInterface::CLIENT_VIEW, ['id' => $id, 'customFields' => '1']);
+
+        $this->assertSame(200, $r->status);
+
+        $item = $r->body->data->data;
+        $this->assertObjectHasProperty('data', $item->customFields, 'the include must actually run');
+        $this->assertIsArray($item->customFields->data);
+    }
+
     public function testEditAction(): void
     {
         $id = $this->createClient(self::PARAMS)->body->itemId;
diff --git a/tests/Unit/Infrastructure/Adapter/In/Api/Controllers/Help/HelpTest.php b/tests/Unit/Infrastructure/Adapter/In/Api/Controllers/Help/HelpTest.php
index b3a14e64e..045cbfc66 100644
--- a/tests/Unit/Infrastructure/Adapter/In/Api/Controllers/Help/HelpTest.php
+++ b/tests/Unit/Infrastructure/Adapter/In/Api/Controllers/Help/HelpTest.php
@@ -32,6 +32,7 @@
 use SP\Infrastructure\Adapter\In\Api\Controllers\Help\CategoryHelp;
 use SP\Infrastructure\Adapter\In\Api\Controllers\Help\ClientHelp;
 use SP\Infrastructure\Adapter\In\Api\Controllers\Help\ConfigHelp;
+use SP\Infrastructure\Adapter\In\Api\Controllers\Help\EventlogHelp;
 use SP\Infrastructure\Adapter\In\Api\Controllers\Help\TagHelp;
 use SP\Infrastructure\Adapter\In\Api\Controllers\Help\UserGroupHelp;
 use SP\Tests\Support\UnitaryTestCase;
@@ -142,4 +143,15 @@ public function testTheConfigHelpDocumentsItsOwnActions(): void
 
         self::assertArrayHasKey('help', $help);
     }
+
+    /**
+     * Clearing the event log takes no parameters, and the empty list is a documented fact rather
+     * than a missing method: an action nobody wrote a method for answers with nothing at all (see
+     * testAnUndocumentedActionYieldsNoHelp()), while `clear()` exists and deliberately says there
+     * is nothing to pass.
+     */
+    public function testTheEventlogClearActionDocumentsNoParameters(): void
+    {
+        self::assertSame(['help' => []], EventlogHelp::getHelpFor('clear'));
+    }
 }