docs: define strict dry-run contract

.env.example

@@ -50,11 +50,7 @@ XMPP_HOST=example.com
 XMPP_PORT=5222
 XMPP_TO=parent@example.com
 XMPP_RESOURCE=pronote-sync
-# Mode TLS : "starttls" (port 5222, défaut), "direct" (port 5223) ou "disabled" (localhost uniquement)
-XMPP_TLS_MODE=starttls
-# XMPP_USE_TLS=true/false est obsolète mais encore supporté (alias de XMPP_TLS_MODE)
-XMPP_CONNECT_TIMEOUT=15
-XMPP_CLEANUP_TIMEOUT=10
+XMPP_USE_TLS=true
 XMPP_TIMEOUT=30
 
 # --- IA (optionnelle) ---

.gitignore

@@ -50,7 +50,6 @@ Thumbs.db
 .caldav_sync_state.json
 # État d'authentification pronotepy (QR code / token rotation)
 .pronote_auth_state.json
-.pronote_auth_state.json.lock
 *.state.json
 
 # --- Local scratch / WIP files ---

.secrets.baseline

@@ -139,8 +139,9 @@
         "type": "Hex High Entropy String",
         "filename": "GUIDE_DEV_PYTHON.md",
         "hashed_secret": "90bd1b48e958257948487b90bee080ba5ed00caa",
-        "is_verified": false,
-        "line_number": 5103
+        "is_verified": true,
+        "line_number": 5065,
+        "is_secret": false
       }
     ],
     "tests/unit/test_caldav_gateway.py": [
@@ -174,16 +175,7 @@
         "is_verified": false,
         "line_number": 28
       }
-    ],
-    "tests/unit/test_xmpp_channel.py": [
-      {
-        "type": "Secret Keyword",
-        "filename": "tests/unit/test_xmpp_channel.py",
-        "hashed_secret": "b01bcded8826562355b3e32a8b31e214ff533511",
-        "is_verified": false,
-        "line_number": 1011
-      }
     ]
   },
-  "generated_at": "2026-09-11T14:59:15Z"
+  "generated_at": "2026-09-11T05:17:54Z"
 }

GUIDE_DEV_PYTHON.md

@@ -275,8 +275,7 @@ Le projet utilise **`pydantic-settings`** pour valider et charger la configurati
 
 > ⚠️ **Décision d'implémentation** :
 > `XMPP_RECIPIENT` a été renommé en `XMPP_TO` dans l'implémentation (aligné avec §10.2.1).
-> Des variables XMPP supplémentaires ont été ajoutées : `XMPP_ENABLED`, `XMPP_HOST`, `XMPP_PORT`, `XMPP_RESOURCE`, `XMPP_TLS_MODE`, `XMPP_TIMEOUT`, `XMPP_CONNECT_TIMEOUT`, `XMPP_CLEANUP_TIMEOUT`.
-> `XMPP_USE_TLS` reste supporté mais est **obsolète** (remplacé par `XMPP_TLS_MODE`).
+> Des variables XMPP supplémentaires ont été ajoutées : `XMPP_ENABLED`, `XMPP_HOST`, `XMPP_PORT`, `XMPP_RESOURCE`, `XMPP_USE_TLS`, `XMPP_TIMEOUT`.
 > Une section `BLOG_ENABLED` et `BLOG_RSS_URL` a été ajoutée dans `.env.example`.
 
 Les variables Pronote sont obligatoires selon les sources activées :
@@ -2260,27 +2259,7 @@ d'informations sont non critiques et peuvent retourner une liste vide avec un wa
 Les objets renvoyés par `client.homework(start, end)` couvrent une fenêtre. Le résultat destiné à
 un jour cible est donc filtré explicitement sur `homework.date == target_date`.
 
-#### 5.1.8 Verrou du cycle d'authentification QR/token
-
-En mode `qr_token`, le token Pronote est un état partagé et rotatif. Afin d'éviter que deux
-exécutions ne réutilisent ou n'écrasent cet état simultanément, le client protège chaque cycle
-d'authentification et de récupération par un verrou POSIX local non bloquant, situé dans
-`.pronote_auth_state.json.lock`, à côté de `.pronote_auth_state.json`.
-
-Le verrou couvre l'ensemble du cycle QR/token : chargement de l'état, connexion par token ou
-enrôlement QR initial, opération de données (agenda, devoirs, messages ou informations), puis
-persistance des credentials actualisées. Une tentative concurrente échoue immédiatement avec une
-erreur d'état d'authentification expurgée ; elle ne patiente pas et ne relance pas
-l'authentification. Le contenu du token, le PIN et les autres credentials ne sont jamais inclus
-dans les logs ni dans ce message d'erreur.
-
-Ce mécanisme est un contrat **local** : il coordonne des processus sur le même hôte Linux et un
-filesystem local. Pour des déploiements conteneurisés, les conteneurs qui partagent le même compte
-Pronote doivent également partager le fichier d'état et son fichier de verrou. Le verrou ne fournit
-aucune exclusion fiable entre plusieurs hôtes ou via NFS ; dans ces cas, l'opérateur doit prévoir
-une exclusion externe ou utiliser un token distinct par instance.
-
-#### 5.1.9 Logique de repli (`sources/pronote/fallback.py`)
+#### 5.1.8 Logique de repli (`sources/pronote/fallback.py`)
 
 Le `PronoteFetcher` dépend de `Settings` et d'un protocole de client injecté ; il ne construit pas
 de singleton et ne contient pas d'identifiants dupliqués.
@@ -4067,9 +4046,7 @@ Si le besoin évolue (ex: **plusieurs destinataires**), les étapes suivantes so
 | `XMPP_PORT`                | Port XMPP (5222 pour STARTTLS, 5223 pour TLS direct).                           | `5222`               | `int`             | ❌ Non           |
 | `XMPP_TO`                  | Destinataire unique (ex: `parent@exemple.org`).                             | `None`                | `str`             | ✅ Oui           |
 | `XMPP_RESOURCE`            | Ressource XMPP (ex: `pronote-sync`).                                         | `"pronote-sync"`     | `str`             | ❌ Non           |
-| `XMPP_TLS_MODE`            | Mode TLS : `starttls` (défaut), `direct` ou `disabled` (localhost uniquement). | `"starttls"`          | `Literal`         | ❌ Non           |
-| `XMPP_CONNECT_TIMEOUT`     | Timeout de connexion (secondes).                                              | `15`                  | `float`           | ❌ Non           |
-| `XMPP_CLEANUP_TIMEOUT`     | Timeout de nettoyage (secondes).                                              | `10`                  | `float`           | ❌ Non           |
+| `XMPP_USE_TLS`             | Utiliser TLS pour la connexion.                                              | `True`                | `bool`            | ❌ Non           |
 | `XMPP_TIMEOUT`             | Timeout de connexion (secondes).                                             | `30`                 | `int`             | ❌ Non           |
 
 **⚠️ Notes** :
@@ -4077,7 +4054,6 @@ Si le besoin évolue (ex: **plusieurs destinataires**), les étapes suivantes so
 - **Pas de variables PubSub** : `XMPP_PUBSUB_NODE`, `XMPP_ROOM`, `XMPP_SUBSCRIBERS` **ne doivent pas être introduites** pour l'instant.
 - **Sécurité** : `XMPP_JID`, `XMPP_PASSWORD` et `XMPP_TO` **ne doivent jamais apparaître** dans les logs, erreurs ou fixtures.
 - **Standardisation** : `XMPP_TO` est mappé sur le champ `to` dans le modèle Pydantic.
-- **`XMPP_USE_TLS` obsolète** : remplacée par `XMPP_TLS_MODE` (`starttls`, `direct` ou `disabled`) ; `XMPP_USE_TLS=true` → `direct` et `XMPP_USE_TLS=false` → `starttls`, avec un `DeprecationWarning`.
 
 #### 10.2.2 Exemple de configuration dans `.env`
 
@@ -4090,19 +4066,13 @@ XMPP_HOST=exemple.org
 XMPP_PORT=5222
 XMPP_TO=parent@exemple.org
 XMPP_RESOURCE=pronote-digest
-# XMPP_TLS_MODE : "starttls" (défaut), "direct" (port 5223) ou "disabled" (localhost uniquement)
-XMPP_TLS_MODE=starttls
-# XMPP_USE_TLS=true/false est obsolète mais encore supporté (alias de XMPP_TLS_MODE)
-XMPP_CONNECT_TIMEOUT=15
-XMPP_CLEANUP_TIMEOUT=10
+XMPP_USE_TLS=true
 XMPP_TIMEOUT=30
 ```
 
 #### 10.2.3 Modèle Pydantic pour la configuration XMPP
 
 ```python
-from typing import Literal
-
 from pydantic import SecretStr, Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -4128,22 +4098,14 @@ class XmppSettings(BaseSettings):
     port: int = Field(default=5222, ge=1, le=65535)
     to: str | None = None
     resource: str = "pronote-sync"
-    tls_mode: Literal["direct", "starttls", "disabled"] = "starttls"
-    use_tls: bool | None = Field(
-        default=None,
-        deprecated="Utiliser tls_mode à la place (XMPP_USE_TLS obsolète).",
-    )
-    timeout: float = Field(default=30, gt=0)
-    connect_timeout: float = Field(default=15, gt=0)
-    cleanup_timeout: float = Field(default=10, gt=0)
+    use_tls: bool = True
+    timeout: int = Field(default=30, gt=0)
 ```
 
 > **⚠️ Mapping TLS** :
-> - `tls_mode="starttls"` (défaut) → **STARTTLS** (port 5222, `enable_starttls=True`, `enable_direct_tls=False`).
-> - `tls_mode="direct"` → **TLS direct** (port 5223, `enable_direct_tls=True`, `enable_starttls=False`).
-> - `tls_mode="disabled"` → TLS désactivé ; **uniquement** autorisé sur un hôte de boucle locale (`localhost`, `127.0.0.1`, `::1`).
-> - `XMPP_USE_TLS` (`use_tls`) est **obsolète** : `use_tls=True` → `tls_mode="direct"` et
->   `use_tls=False` → `tls_mode="starttls"` (avec `DeprecationWarning`).
+> - `use_tls=True` → **TLS direct** (port 5223, `enable_direct_tls=True`, `enable_starttls=False`).
+> - `use_tls=False` → **STARTTLS** (port 5222, `enable_starttls=True`, `enable_direct_tls=False`).
+> La validation refuse `use_tls=False` si `host` n'est pas un hôte de boucle locale (`localhost`, `127.0.0.1`, `::1`).
 
 ---
 

README.LLM.md

@@ -71,8 +71,7 @@ The following variables can be safely pre-configured in `/etc/pronote-sync/prono
   - `THEORETICAL_WEEK_ANCHOR_DATE`, `THEORETICAL_WEEK_ANCHOR_TYPE`
 
 - **XMPP:**
-  - `XMPP_ENABLED`, `XMPP_HOST`, `XMPP_PORT`, `XMPP_TLS_MODE`, `XMPP_TIMEOUT`, `XMPP_CONNECT_TIMEOUT`, `XMPP_CLEANUP_TIMEOUT`, `XMPP_RESOURCE`
-  - `XMPP_USE_TLS` is deprecated but still supported (aliased to `XMPP_TLS_MODE`)
+  - `XMPP_ENABLED`, `XMPP_HOST`, `XMPP_PORT`, `XMPP_USE_TLS`, `XMPP_TIMEOUT`, `XMPP_RESOURCE`
 
 - **AI:**
   - `AI_ENABLED`, `AI_PROVIDER`, `AI_BASE_URL`, `AI_MODEL`, `AI_ALLOW_INSECURE_HTTP`

pronote_sync/channels/xmpp.py

@@ -36,24 +36,6 @@ logger = logging.getLogger(__name__)
 __all__ = ["XmppChannel", "SyncXmppChannel", "XmppMessage"]
 
 
-async def _cancel_pending(
-    *futures: asyncio.Future[bool],
-) -> None:
-    """Annule les futures/tâches encore en attente et supprime le bruit.
-
-    À appeler avant chaque retour anticipé de :meth:`XmppChannel.send_async`
-    afin qu'aucune tentative de connexion ne survive au retour de la méthode.
-
-    :param futures: Futures ou tâches à annuler (les déjà terminées sont
-        ignorées pour la cancellation mais attendues pour purger l'attente).
-    :rtype: None
-    """
-    for future in futures:
-        if not future.done():
-            future.cancel()
-    await asyncio.gather(*futures, return_exceptions=True)
-
-
 def _secret_values(settings: XmppSettings) -> tuple[SecretStr | str, ...]:
     """Rassemble les secrets du canal XMPP pour le masquage des logs.
 
@@ -238,14 +220,11 @@ class XmppChannel:
         """Exécute le flux asynchrone d'envoi XMPP (U2).
 
         Connecte le client ``slixmpp`` avec un hôte et un port explicites,
-        configure TLS avant la connexion selon ``tls_mode`` (``direct``,
-        ``starttls`` ou ``disabled``), attend la connexion sous
-        ``connect_timeout`` puis l'un des événements ``session_start``,
-        ``failed_auth``, ``connection_failed`` ou ``disconnected`` sous
-        ``timeout`` avant d'envoyer un message direct ``chat`` au
+        configure TLS avant la connexion, puis attend l'un des événements
+        ``session_start``, ``failed_auth`` ou ``disconnected`` sous un
+        timeout unique avant d'envoyer un message direct ``chat`` au
         destinataire configuré. La déconnexion est garantie par un bloc
-        ``try/finally`` borné par ``cleanup_timeout``. Aucun secret n'est
-        journalisé (SEC-XMPP-02).
+        ``try/finally``. Aucun secret n'est journalisé (SEC-XMPP-02).
 
         :param message: Message final à envoyer.
         :return: ``True`` si l'envoi a réussi (ou a été simulé en dry-run),
@@ -265,132 +244,55 @@ class XmppChannel:
             logger.warning("Destinataire XMPP manquant.")
             return False
 
-        # Client typed lazily: the construction is done inside the try block so that
-        # any error is caught and converted to ``False`` (channel contract: never raise)
-        client: ClientXMPP | None = None
+        # Create typed client
+        client = ClientXMPP(
+            jid_str,
+            self.settings.password.get_secret_value() if self.settings.password else "",
+        )
+
+        # Configure TLS BEFORE connect
+        if self.settings.use_tls:
+            # TLS direct (port 5223 typically)
+            client.enable_direct_tls = True
+            client.enable_starttls = False
+        else:
+            # STARTTLS (port 5222 typically)
+            client.enable_starttls = True
+            client.enable_direct_tls = False
+
+        # Register handlers
         session_future: asyncio.Future[bool] = asyncio.get_event_loop().create_future()
-        failure_kind = "disconnected"
-        # Declared before the ``try`` so the exception handlers (CancelledError and
-        # Exception) can cancel any task still pending from ``asyncio.wait()``
-        connect_future: asyncio.Future[bool] | None = None
-        session_task: asyncio.Future[bool] | None = None
 
         def on_session_start(event: object) -> None:
             if not session_future.done():
                 session_future.set_result(True)
 
         def on_failed_auth(event: object) -> None:
-            nonlocal failure_kind
             if not session_future.done():
-                failure_kind = "failed_auth"
-                session_future.set_result(False)
-
-        def on_connection_failed(event: object) -> None:
-            nonlocal failure_kind
-            if not session_future.done():
-                failure_kind = "connection_failed"
                 session_future.set_result(False)
 
         def on_disconnected(event: object) -> None:
             if not session_future.done():
                 session_future.set_result(False)
 
+        client.add_event_handler("session_start", on_session_start)
+        client.add_event_handler("failed_auth", on_failed_auth)
+        client.add_event_handler("disconnected", on_disconnected)
+
         try:
-            # Create typed client
-            client = ClientXMPP(
-                jid_str,
-                self.settings.password.get_secret_value() if self.settings.password else "",
-            )
-
-            # Configure TLS BEFORE connect (canonical tls_mode)
-            match self.settings.tls_mode:
-                case "direct":
-                    client.enable_direct_tls = True
-                    client.enable_starttls = False
-                case "starttls":
-                    client.enable_direct_tls = False
-                    client.enable_starttls = True
-                case "disabled":
-                    client.enable_direct_tls = False
-                    client.enable_starttls = False
-
-            # Register handlers
-            client.add_event_handler("session_start", on_session_start)
-            client.add_event_handler("failed_auth", on_failed_auth)
-            client.add_event_handler("connection_failed", on_connection_failed)
-            client.add_event_handler("disconnected", on_disconnected)
-
             # Connect with explicit host and port
-            connect_future = asyncio.ensure_future(
-                client.connect(self.settings.host, self.settings.port)
-            )
+            connect_future = client.connect(self.settings.host, self.settings.port)
+            await connect_future  # connect() returns a Future, not a coroutine
 
-            # Wrap the session future in a task so that cancelling pending tasks
-            # during the concurrent wait never cancels ``session_future`` itself
-            async def _await_session() -> bool:
-                return await session_future
+            # Wait for one of the three events under a single timeout
+            try:
+                success = await asyncio.wait_for(session_future, timeout=self.settings.timeout)
+            except TimeoutError:
+                logger.warning("Délai d'attente de session XMPP dépassé.")
+                return False
 
-            session_task = asyncio.ensure_future(_await_session())
-
-            # Wait for the connection and the session event concurrently, bounded by
-            # connect_timeout as the global time limit: a ``connection_failed`` event
-            # can thus trigger an early return before the connect timeout expires
-            done, _pending = await asyncio.wait(
-                {connect_future, session_task},
-                timeout=self.settings.connect_timeout,
-                return_when=asyncio.FIRST_COMPLETED,
-            )
-
-            if session_task in done:
-                if not session_future.result():
-                    # ``connection_failed``/``failed_auth``/``disconnected`` fired
-                    # before the connection was resolved: immediate failure (fail fast)
-                    if failure_kind == "connection_failed":
-                        logger.warning("Échec de connexion réseau XMPP.")
-                    else:
-                        logger.warning("Échec d'authentification ou déconnexion XMPP.")
-                    await _cancel_pending(connect_future, session_task)
-                    return False
-                # ``session_start`` fired: the connection succeeded even if the
-                # connect future is still pending; proceed to send the message
-                await _cancel_pending(connect_future, session_task)
-            elif connect_future in done:
-                # The connection resolved: surface a connect error (redacted) if any
-                if not connect_future.cancelled():
-                    connect_exc = connect_future.exception()
-                    if connect_exc is not None and isinstance(connect_exc, Exception):
-                        logger.warning(
-                            "Échec de connexion XMPP : %s",
-                            redact_exception(
-                                connect_exc,
-                                extra_secrets=_secret_values(self.settings),
-                            ),
-                        )
-                        await _cancel_pending(connect_future, session_task)
-                        return False
-
-                # Connection established: wait for a session event under ``timeout``
-                try:
-                    success = await asyncio.wait_for(
-                        asyncio.shield(session_future), timeout=self.settings.timeout
-                    )
-                except TimeoutError:
-                    logger.warning("Délai d'attente de session XMPP dépassé.")
-                    await _cancel_pending(connect_future, session_task)
-                    return False
-                if not success:
-                    if failure_kind == "connection_failed":
-                        logger.warning("Échec de connexion réseau XMPP.")
-                    else:
-                        logger.warning("Échec d'authentification ou déconnexion XMPP.")
-                    await _cancel_pending(connect_future, session_task)
-                    return False
-            else:
-                # connect_timeout expired: cancel everything and fail fast
-                logger.warning(
-                    "Délai de connexion XMPP dépassé (%ss).", self.settings.connect_timeout
-                )
-                await _cancel_pending(connect_future, session_task)
+            if not success:
+                logger.warning("Échec d'authentification ou déconnexion XMPP.")
                 return False
 
             # Send the message
@@ -398,39 +300,19 @@ class XmppChannel:
             client.send_message(mto=JID(self.settings.to), mbody=formatted, mtype="chat")
             return True
 
-        except asyncio.CancelledError:
-            # Contrat du canal : toujours retourner un booléen, même en cas
-            # d'annulation de la tâche appelante (cleanup exécuté par le finally).
-            logger.debug("Envoi XMPP annulé avant la fin de l'opération.")
-            pending = [f for f in (connect_future, session_task) if f is not None]
-            if pending:
-                await _cancel_pending(*pending)
-            return False
         except Exception as exc:
-            redacted = redact_exception(exc, extra_secrets=_secret_values(self.settings))
+            redacted = redact_exception(exc)
             extra = _secret_values(self.settings)
             logger.warning("Erreur XMPP: %s", redact_secrets(redacted, extra_secrets=extra))
-            pending = [f for f in (connect_future, session_task) if f is not None]
-            if pending:
-                await _cancel_pending(*pending)
             return False
         finally:
-            if client is not None:
-                try:
-                    disconnect_future = client.disconnect()
-                    await asyncio.wait_for(disconnect_future, timeout=self.settings.cleanup_timeout)
-                except asyncio.CancelledError:
-                    logger.debug("Déconnexion XMPP annulée.")
-                except TimeoutError:
-                    logger.debug(
-                        "Délai de déconnexion XMPP dépassé (%ss), abandon.",
-                        self.settings.cleanup_timeout,
-                    )
-                except Exception as cleanup_exc:
-                    logger.debug(
-                        "Erreur lors de la déconnexion XMPP : %s",
-                        redact_exception(cleanup_exc, extra_secrets=_secret_values(self.settings)),
-                    )
+            try:
+                disconnect_future = client.disconnect()
+                await disconnect_future
+            except Exception as cleanup_exc:
+                logger.debug(
+                    "Erreur lors de la déconnexion XMPP: %s", redact_exception(cleanup_exc)
+                )
 
 
 class SyncXmppChannel:
@@ -481,7 +363,7 @@ class SyncXmppChannel:
         try:
             return asyncio.run(self._channel.send_async(message))
         except Exception as exc:
-            redacted = redact_exception(exc, extra_secrets=_secret_values(self.settings))
+            redacted = redact_exception(exc)
             redacted = redact_secrets(redacted, extra_secrets=_secret_values(self.settings))
             logger.warning("XMPP : erreur lors de l'envoi synchrone : %s", redacted)
             return False

pronote_sync/config/settings.py

@@ -8,7 +8,6 @@ depuis les variables d'environnement (préfixées par groupe) et le fichier
 
 from __future__ import annotations
 
-import warnings
 from datetime import date
 from typing import Literal
 from urllib.parse import urlparse
@@ -19,7 +18,6 @@ from pydantic import (
     ValidationInfo,
     field_serializer,
     field_validator,
-    model_validator,
 )
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -160,16 +158,10 @@ class XmppSettings(BaseSettings):
     Contraintes de champs : ``port`` est borné entre 1 et 65535 et ``timeout``
     doit être strictement positif.
 
-    Politique TLS : le mode ``tls_mode`` détermine la négociation TLS
-    (``direct``, ``starttls`` ou ``disabled``). Le mode ``disabled`` n'est
-    autorisé que sur un hôte de boucle locale (``localhost``, ``127.0.0.1``,
-    ``::1``) ; ``starttls`` et ``direct`` sont permis pour tous les hôtes.
-
-    Compatibilité : le champ historique ``use_tls`` (booléen) est un alias
-    obsolète ; ``use_tls=True`` mappe vers ``tls_mode="direct"`` et
-    ``use_tls=False`` vers ``tls_mode="starttls"``, avec un
-    :pyexc:`DeprecationWarning`. La valeur brute fournie reste lisible via
-    ``use_tls`` (``None`` si non fournie).
+    Politique TLS : la désactivation de TLS (``use_tls`` à ``False``) n'est
+    autorisée que sur un hôte de boucle locale (``localhost``, ``127.0.0.1``,
+    ``::1``). Dans tout autre cas, une erreur de validation est levée,
+    indépendamment de l'état du champ ``enabled``.
     """
 
     model_config = SettingsConfigDict(
@@ -186,61 +178,33 @@ class XmppSettings(BaseSettings):
     port: int = Field(default=5222, ge=1, le=65535)
     to: str | None = None
     resource: str = "pronote-sync"
-    tls_mode: Literal["direct", "starttls", "disabled"] = "starttls"
-    use_tls: bool | None = Field(
-        default=None,
-        deprecated="Utiliser tls_mode à la place (XMPP_USE_TLS obsolète).",
-    )
-    timeout: float = Field(default=30, gt=0)
-    connect_timeout: float = Field(default=15, gt=0)
-    cleanup_timeout: float = Field(default=10, gt=0)
+    use_tls: bool = True
+    timeout: int = Field(default=30, gt=0)
 
-    @model_validator(mode="before")
+    @field_validator("use_tls")
     @classmethod
-    def _migrate_use_tls(cls, data: object) -> object:
-        """Mappe l'alias obsolète ``use_tls`` vers le mode canonique ``tls_mode``.
+    def _validate_tls_policy(cls, v: bool, info: ValidationInfo) -> bool:
+        """Refuse la désactivation de TLS hors des hôtes de boucle locale.
 
-        ``use_tls=True`` devient ``tls_mode="direct"`` et ``use_tls=False``
-        devient ``tls_mode="starttls"`` ; un :pyexc:`DeprecationWarning` est
-        émis à chaque usage explicite de l'alias. ``tls_mode`` fourni
-        explicitement prend le pas sur l'alias.
-
-        :param data: Données d'entrée du modèle (dict ou autre).
-        :return: Données d'entrée avec ``tls_mode`` dérivé de ``use_tls``.
-        :rtype: object
-        """
-        if not isinstance(data, dict) or "use_tls" not in data:
-            return data
-        warnings.warn(
-            "XMPP_USE_TLS est obsolète : utiliser XMPP_TLS_MODE "
-            "('direct', 'starttls' ou 'disabled').",
-            DeprecationWarning,
-            stacklevel=2,
-        )
-        if data.get("tls_mode") is None:
-            data["tls_mode"] = "direct" if data["use_tls"] else "starttls"
-        return data
-
-    @model_validator(mode="after")
-    def _validate_tls_policy(self) -> XmppSettings:
-        """Refuse le mode ``disabled`` hors des hôtes de boucle locale.
-
-        La règle s'applique quel que soit l'état du champ ``enabled``. Les
-        modes ``starttls`` et ``direct`` sont autorisés pour tous les hôtes.
-        Le message d'erreur ne contient aucune valeur sensible (``jid``,
+        La règle s'applique quel que soit l'état du champ ``enabled``. Le
+        message d'erreur ne contient aucune valeur sensible (``jid``,
         ``password``, ``to``).
 
-        :return: L'instance validée inchangée.
-        :rtype: XmppSettings
-        :raises ValueError: Si ``tls_mode`` est ``disabled`` et que ``host``
+        :param v: Valeur du champ ``use_tls`` à valider.
+        :param info: Contexte de validation (accès aux autres champs).
+        :return: La valeur validée inchangée.
+        :rtype: bool
+        :raises ValueError: Si ``use_tls`` est ``False`` et que ``host``
             n'est pas un hôte de boucle locale.
         """
-        if self.tls_mode == "disabled" and self.host not in _XMPP_LOOPBACK_HOSTS:
-            raise ValueError(
-                "TLS désactivé n'est autorisé que sur les hôtes de loopback "
-                "(localhost, 127.0.0.1, ::1)."
-            ) from None
-        return self
+        if v is False:
+            host = info.data.get("host", "")
+            if host not in _XMPP_LOOPBACK_HOSTS:
+                raise ValueError(
+                    "TLS désactivé n'est autorisé que sur les hôtes de loopback "
+                    "(localhost, 127.0.0.1, ::1)."
+                ) from None
+        return v
 
 
 class AISettings(BaseSettings):

pronote_sync/errors.py

@@ -38,21 +38,6 @@ class PronoteAuthRotationError(PronoteSyncError):
         super().__init__(message)
 
 
-class PronoteAuthStateLockError(PronoteSyncError):
-    """Erreur levée lorsqu'un autre processus détient l'état d'authentification.
-
-    Cette erreur indique qu'une opération QR code / token concurrente est en
-    cours. Son message ne contient ni chemin local sensible ni credential.
-    """
-
-    def __init__(self, message: str) -> None:
-        """Initialise l'erreur de contention du verrou d'état.
-
-        :param message: Message actionnable expurgé décrivant la contention.
-        """
-        super().__init__(message)
-
-
 class ErrorSeverity(StrEnum):
     """Niveau de gravité d'une erreur produite par le pipeline."""
 

pronote_sync/sources/pronote/auth_state.py

@@ -14,13 +14,10 @@ from __future__ import annotations
 import json
 import logging
 import os
-from collections.abc import Generator
-from contextlib import contextmanager
-from fcntl import LOCK_EX, LOCK_NB, LOCK_UN, flock
 from pathlib import Path
 from typing import Any
 
-from pronote_sync.errors import PronoteAuthStateLockError, PronoteSyncError
+from pronote_sync.errors import PronoteSyncError
 from pronote_sync.utils.redaction import redact_exception, redact_secrets
 
 logger = logging.getLogger(__name__)
@@ -127,69 +124,6 @@ class PronoteAuthState:
             credentials[key] = value
         return credentials
 
-    @contextmanager
-    def lock(self) -> Generator[None]:
-        """Protège une opération d'état par un verrou POSIX non bloquant.
-
-        Le verrou est conservé dans le fichier frère ``<state_file>.lock`` afin
-        de survivre à l'écriture atomique du fichier d'état. Le fichier de
-        verrou reste présent après libération et est créé en ``0600`` pour ne
-        pas élargir l'accès aux métadonnées de l'état sensible.
-
-        :return: Un gestionnaire de contexte qui tient le verrou exclusif.
-        :rtype: collections.abc.Generator[None, None, None]
-        :raises PronoteAuthStateLockError: Si un autre processus détient déjà
-            le verrou ou si son acquisition échoue.
-        """
-        lock_file = self._state_file.with_name(f"{self._state_file.name}.lock")
-        descriptor: int | None = None
-        try:
-            descriptor = os.open(
-                str(lock_file),
-                os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW,
-                0o600,
-            )
-            os.fchmod(descriptor, 0o600)
-        except OSError:
-            logger.error("Impossible d'ouvrir le verrou d'état d'authentification Pronote.")
-            if descriptor is not None:
-                os.close(descriptor)
-
-        if descriptor is None:
-            raise PronoteAuthStateLockError(
-                "Impossible d'acquérir le verrou d'état d'authentification Pronote."
-            ) from None
-
-        is_contended = False
-        lock_acquisition_failed = False
-        try:
-            flock(descriptor, LOCK_EX | LOCK_NB)
-        except BlockingIOError:
-            is_contended = True
-        except OSError:
-            logger.error("Impossible d'acquérir le verrou d'état d'authentification Pronote.")
-            os.close(descriptor)
-            lock_acquisition_failed = True
-
-        if lock_acquisition_failed:
-            raise PronoteAuthStateLockError(
-                "Impossible d'acquérir le verrou d'état d'authentification Pronote."
-            ) from None
-
-        if is_contended:
-            os.close(descriptor)
-            raise PronoteAuthStateLockError(
-                "Une autre opération d'authentification Pronote est déjà en cours."
-            )
-
-        try:
-            yield
-        finally:
-            try:
-                flock(descriptor, LOCK_UN)
-            finally:
-                os.close(descriptor)
-
     def save(self, credentials: dict[str, str]) -> None:
         """Sauvegarde les credentials dans le fichier d'état, de manière atomique.
 

pronote_sync/sources/pronote/client.py

@@ -12,8 +12,6 @@ from __future__ import annotations
 
 import json
 import logging
-from collections.abc import Generator
-from contextlib import contextmanager
 from datetime import date
 from pathlib import Path
 from typing import Any, Protocol
@@ -254,26 +252,6 @@ class PronoteClient:
         except Exception as exc:
             logger.debug("Échec de la persistance des credentials : %s", redact_exception(exc))
 
-    @contextmanager
-    def _qr_token_operation_lock(self) -> Generator[None]:
-        """Verrouille un cycle d'authentification et de récupération QR/token.
-
-        Le verrou englobe le chargement du token, le login, l'opération de
-        données et la persistance qui suit. Il est volontairement absent du
-        mode ``password``, qui ne partage pas de fichier d'état de token.
-
-        :return: Un gestionnaire de contexte protégeant le cycle QR/token.
-        :rtype: collections.abc.Generator[None, None, None]
-        :raises PronoteAuthStateLockError: Si l'état QR/token est déjà utilisé
-            par une autre opération.
-        """
-        if self._settings.auth_mode != "qr_token" or self._auth_state is None:
-            yield
-            return
-
-        with self._auth_state.lock():
-            yield
-
     def _connect_password(self) -> pronotepy.Client:
         """Connecte le client ``pronotepy`` en mode ``password``.
 
@@ -448,38 +426,37 @@ class PronoteClient:
         :return: Liste des messages des professeurs ; vide en cas d'erreur.
         :rtype: list[Message]
         """
-        with self._qr_token_operation_lock():
-            try:
-                client = self._connect()
-                messages: list[Message] = []
-                for discussion in client.discussions():
-                    for message in discussion.messages:
-                        messages.append(
-                            Message(
-                                id=message.id,
-                                type=MessageType.DISCUSSION,
-                                title=discussion.subject,
-                                content=message.content,
-                                author=message.author or "",
-                                date=message.created,
-                                read=message.seen,
-                            )
+        try:
+            client = self._connect()
+            messages: list[Message] = []
+            for discussion in client.discussions():
+                for message in discussion.messages:
+                    messages.append(
+                        Message(
+                            id=message.id,
+                            type=MessageType.DISCUSSION,
+                            title=discussion.subject,
+                            content=message.content,
+                            author=message.author or "",
+                            date=message.created,
+                            read=message.seen,
                         )
-                self._persist_credentials()
-                return messages
-            except (
-                pronotepy.PronoteAPIError,
-                ValueError,
-                requests.RequestException,
-                ConnectionError,
-                TimeoutError,
-            ) as exc:
-                logger.error(
-                    "Échec de la récupération des messages Pronote : %s",
-                    redact_exception(exc),
-                )
-                self._persist_credentials()
-                return []
+                    )
+            self._persist_credentials()
+            return messages
+        except (
+            pronotepy.PronoteAPIError,
+            ValueError,
+            requests.RequestException,
+            ConnectionError,
+            TimeoutError,
+        ) as exc:
+            logger.error(
+                "Échec de la récupération des messages Pronote : %s",
+                redact_exception(exc),
+            )
+            self._persist_credentials()
+            return []
 
     def get_informations(self) -> list[Message]:
         """Récupère les informations et sondages Pronote.
@@ -490,37 +467,36 @@ class PronoteClient:
         :return: Liste des informations et sondages ; vide en cas d'erreur.
         :rtype: list[Message]
         """
-        with self._qr_token_operation_lock():
-            try:
-                client = self._connect()
-                messages: list[Message] = []
-                for info in client.information_and_surveys():
-                    messages.append(
-                        Message(
-                            id=info.id,
-                            type=MessageType.SURVEY if info.survey else MessageType.INFORMATION,
-                            title=info.title or "",
-                            content=info.content(),
-                            author=info.author,
-                            date=info.creation_date,
-                            read=info.read,
-                        )
+        try:
+            client = self._connect()
+            messages: list[Message] = []
+            for info in client.information_and_surveys():
+                messages.append(
+                    Message(
+                        id=info.id,
+                        type=MessageType.SURVEY if info.survey else MessageType.INFORMATION,
+                        title=info.title or "",
+                        content=info.content(),
+                        author=info.author,
+                        date=info.creation_date,
+                        read=info.read,
                     )
-                self._persist_credentials()
-                return messages
-            except (
-                pronotepy.PronoteAPIError,
-                ValueError,
-                requests.RequestException,
-                ConnectionError,
-                TimeoutError,
-            ) as exc:
-                logger.error(
-                    "Échec de la récupération des informations Pronote : %s",
-                    redact_exception(exc),
                 )
-                self._persist_credentials()
-                return []
+            self._persist_credentials()
+            return messages
+        except (
+            pronotepy.PronoteAPIError,
+            ValueError,
+            requests.RequestException,
+            ConnectionError,
+            TimeoutError,
+        ) as exc:
+            logger.error(
+                "Échec de la récupération des informations Pronote : %s",
+                redact_exception(exc),
+            )
+            self._persist_credentials()
+            return []
 
     def get_lessons(self, start: date, end: date) -> list[Lesson]:
         """Récupère les cours via ``pronotepy`` (repli iCal).
@@ -547,38 +523,37 @@ class PronoteClient:
         :raises ConnectionError: Si la connexion réseau échoue.
         :raises TimeoutError: Si la requête réseau expire.
         """
-        with self._qr_token_operation_lock():
-            client = self._connect()
-            lessons: list[Lesson] = []
-            for lesson in client.lessons(start, end):
-                content = lesson.content
-                raw_uid = lesson.id
-                if raw_uid:
-                    uid = normalize_pronote_uid(raw_uid)
-                else:
-                    uid = generate_deterministic_uid(
-                        start=lesson.start,
-                        end=lesson.end,
-                        subject=lesson.subject.name if lesson.subject is not None else "",
-                        teachers=list(lesson.teacher_names or ()),
-                        rooms=list(lesson.classrooms or ()),
-                        group=lesson.group_name,
-                    )
-                lessons.append(
-                    Lesson(
-                        id=uid,
-                        start=lesson.start,
-                        end=lesson.end,
-                        subject=lesson.subject.name if lesson.subject is not None else "",
-                        teachers=tuple(lesson.teacher_names or ()),
-                        rooms=tuple(lesson.classrooms or ()),
-                        group=lesson.group_name,
-                        status=(LessonStatus.CANCELLED if lesson.canceled else LessonStatus.NORMAL),
-                        content=content.description if content is not None else None,
-                    )
+        client = self._connect()
+        lessons: list[Lesson] = []
+        for lesson in client.lessons(start, end):
+            content = lesson.content
+            raw_uid = lesson.id
+            if raw_uid:
+                uid = normalize_pronote_uid(raw_uid)
+            else:
+                uid = generate_deterministic_uid(
+                    start=lesson.start,
+                    end=lesson.end,
+                    subject=lesson.subject.name if lesson.subject is not None else "",
+                    teachers=list(lesson.teacher_names or ()),
+                    rooms=list(lesson.classrooms or ()),
+                    group=lesson.group_name,
                 )
-            self._persist_credentials()
-            return lessons
+            lessons.append(
+                Lesson(
+                    id=uid,
+                    start=lesson.start,
+                    end=lesson.end,
+                    subject=lesson.subject.name if lesson.subject is not None else "",
+                    teachers=tuple(lesson.teacher_names or ()),
+                    rooms=tuple(lesson.classrooms or ()),
+                    group=lesson.group_name,
+                    status=(LessonStatus.CANCELLED if lesson.canceled else LessonStatus.NORMAL),
+                    content=content.description if content is not None else None,
+                )
+            )
+        self._persist_credentials()
+        return lessons
 
     def get_homeworks(self, start: date, end: date) -> list[Homework]:
         """Récupère les devoirs via ``pronotepy``.
@@ -601,20 +576,19 @@ class PronoteClient:
         :raises ConnectionError: Si la connexion réseau échoue.
         :raises TimeoutError: Si la requête réseau expire.
         """
-        with self._qr_token_operation_lock():
-            client = self._connect()
-            homeworks: list[Homework] = []
-            for hw in client.homework(start, end):
-                homeworks.append(
-                    Homework(
-                        id=hw.id,
-                        subject=hw.subject.name,
-                        teachers=(),
-                        assigned_on=None,
-                        due_on=hw.date,
-                        text=hw.description,
-                        html=hw.description,
-                    )
+        client = self._connect()
+        homeworks: list[Homework] = []
+        for hw in client.homework(start, end):
+            homeworks.append(
+                Homework(
+                    id=hw.id,
+                    subject=hw.subject.name,
+                    teachers=(),
+                    assigned_on=None,
+                    due_on=hw.date,
+                    text=hw.description,
+                    html=hw.description,
                 )
-            self._persist_credentials()
-            return homeworks
+            )
+        self._persist_credentials()
+        return homeworks

tests/integration/test_xmpp_integration.py

@@ -67,7 +67,7 @@ class FakeClientXMPP:
         :param handler: Fonction gestionnaire.
         :raises: AssertionError si l'événement n'est pas supporté.
         """
-        if name not in ("session_start", "failed_auth", "connection_failed", "disconnected"):
+        if name not in ("session_start", "failed_auth", "disconnected"):
             raise AssertionError(f"Unsupported event: {name}")
         self.handlers.setdefault(name, []).append(handler)
 

tests/unit/test_pronote_auth_state.py

@@ -17,12 +17,10 @@ from __future__ import annotations
 import json
 import logging
 import os
-from fcntl import LOCK_EX, LOCK_NB, LOCK_UN, flock
 from pathlib import Path
 
 import pytest
 
-from pronote_sync.errors import PronoteAuthStateLockError
 from pronote_sync.sources.pronote.auth_state import PronoteAuthState
 
 
@@ -292,76 +290,3 @@ def test_no_credentials_in_logs(tmp_path: Path, caplog: pytest.LogCaptureFixture
     assert "SENTINEL_USER_ZZZ" not in caplog.text
     assert "SENTINEL_PASSWORD_ZZZ" not in caplog.text
     assert "SENTINEL_UUID_ZZZ" not in caplog.text
-
-
-def test_lock_rejects_concurrent_access_with_a_redacted_dedicated_error(tmp_path: Path) -> None:
-    """Vérifie qu'un verrou concurrent échoue immédiatement sans fuite interne.
-
-    :param tmp_path: Fixture pytest pour un répertoire temporaire.
-    :return: None
-    """
-    state_file = tmp_path / ".pronote_auth_state.json"
-    state = PronoteAuthState(state_file)
-    competing_state = PronoteAuthState(state_file)
-
-    with state.lock():
-        assert state_file.with_name(f"{state_file.name}.lock").exists()
-        with pytest.raises(PronoteAuthStateLockError) as exc_info:
-            with competing_state.lock():
-                pass
-
-    assert "BlockingIOError" not in str(exc_info.value)
-    assert exc_info.value.__cause__ is None
-    assert exc_info.value.__context__ is None
-
-
-def test_lock_open_failure_does_not_log_sensitive_lock_path(
-    tmp_path: Path, caplog: pytest.LogCaptureFixture, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Vérifie qu'un échec d'ouverture du verrou ne divulgue pas son chemin.
-
-    :param tmp_path: Fixture pytest pour un répertoire temporaire.
-    :param caplog: Fixture pytest pour capturer les logs.
-    :param monkeypatch: Fixture pytest pour remplacer l'ouverture du verrou.
-    :return: None
-    """
-    sentinel_path = "/SENTINEL_LOCK_PATH_ZZZ/.pronote_auth_state.json.lock"
-
-    def raise_lock_open_error(*args: object, **kwargs: object) -> int:
-        """Simule un refus d'ouverture portant un chemin sensible."""
-        del args, kwargs
-        raise OSError(13, "Permission denied", sentinel_path)
-
-    monkeypatch.setattr(os, "open", raise_lock_open_error)
-
-    with caplog.at_level(logging.ERROR):
-        with pytest.raises(PronoteAuthStateLockError) as exc_info:
-            with PronoteAuthState(tmp_path / ".pronote_auth_state.json").lock():
-                pass
-
-    assert "Impossible d'ouvrir le verrou d'état d'authentification Pronote" in caplog.text
-    assert "SENTINEL_LOCK_PATH_ZZZ" not in caplog.text
-    assert exc_info.value.__cause__ is None
-    assert exc_info.value.__context__ is None
-
-
-def test_lock_is_released_when_the_protected_operation_raises(tmp_path: Path) -> None:
-    """Vérifie que le verrou est libéré même si le bloc protégé échoue.
-
-    :param tmp_path: Fixture pytest pour un répertoire temporaire.
-    :return: None
-    """
-    state_file = tmp_path / ".pronote_auth_state.json"
-    lock_file = state_file.with_name(f"{state_file.name}.lock")
-    state = PronoteAuthState(state_file)
-
-    with pytest.raises(RuntimeError, match="échec simulé"):
-        with state.lock():
-            raise RuntimeError("échec simulé")
-
-    descriptor = os.open(lock_file, os.O_RDWR)
-    try:
-        flock(descriptor, LOCK_EX | LOCK_NB)
-        flock(descriptor, LOCK_UN)
-    finally:
-        os.close(descriptor)

tests/unit/test_pronote_client.py

@@ -9,8 +9,6 @@ from __future__ import annotations
 
 import json
 import logging
-from collections.abc import Generator
-from contextlib import contextmanager
 from datetime import date, datetime
 from pathlib import Path
 from unittest.mock import MagicMock
@@ -1205,91 +1203,6 @@ def test_no_raw_secrets_in_logs(
 # --- Persistence of credentials after data operations ---
 
 
-def test_qr_token_lock_covers_login_retrieval_and_credential_persistence(
-    mocker: pytest_mock.MockerFixture,
-) -> None:
-    """Vérifie que le verrou d'état couvre tout le cycle QR/token des cours.
-
-    :param mocker: Fixture pytest-mock pour le mocking.
-    :return: None
-    """
-    events: list[str] = []
-    credentials = {
-        "pronote_url": "https://pronote.example.com",
-        "username": "testuser",
-        "password": "persisted-token",  # pragma: allowlist secret
-        "uuid": "persisted-uuid",
-    }
-    auth_state = mocker.MagicMock(spec=PronoteAuthState)
-
-    @contextmanager
-    def record_lock() -> Generator[None]:
-        events.append("lock_acquired")
-        try:
-            yield
-        finally:
-            events.append("lock_released")
-
-    def load_credentials() -> dict[str, str]:
-        """Simule le chargement des credentials persistés."""
-        events.append("load")
-        return credentials
-
-    def get_no_lessons(*_: object) -> list[object]:
-        """Simule une récupération de cours vide."""
-        events.append("lessons")
-        return []
-
-    def export_credentials() -> dict[str, str]:
-        """Simule l'export des credentials courantes."""
-        events.append("export")
-        return credentials
-
-    def token_login(**_: object) -> MagicMock:
-        """Simule le login par token."""
-        events.append("token_login")
-        return mock_client
-
-    auth_state.lock.side_effect = record_lock
-    auth_state.load.side_effect = load_credentials
-    auth_state.save.side_effect = lambda _: events.append("save")
-
-    mock_client = _make_lessons_mock_client(mocker)
-    mock_client.logged_in = True
-    mock_client.lessons.side_effect = get_no_lessons
-    mock_client.export_credentials.side_effect = export_credentials
-    mocker.patch(
-        "pronotepy.ParentClient.token_login",
-        side_effect=token_login,
-    )
-
-    settings = PronoteSettings(
-        url="https://pronote.example.com",
-        username="testuser",
-        password=SecretStr("testpass"),
-        ent=None,
-        account_type="parent",
-        auth_mode="qr_token",
-    )
-
-    lessons = PronoteClient(settings, auth_state=auth_state).get_lessons(
-        date(2024, 9, 1), date(2024, 9, 30)
-    )
-
-    assert lessons == []
-    assert events == [
-        "lock_acquired",
-        "load",
-        "token_login",
-        "export",
-        "save",
-        "lessons",
-        "export",
-        "save",
-        "lock_released",
-    ]
-
-
 def _make_auth_state_mock(mocker: pytest_mock.MockerFixture) -> MagicMock:
     """Retourne un mock de PronoteAuthState sans credentials persistés.
 

tests/unit/test_xmpp_channel.py

@@ -17,7 +17,7 @@ from unittest.mock import patch
 import pytest
 from pydantic import SecretStr
 
-from pronote_sync.channels.xmpp import SyncXmppChannel, XmppChannel, XmppMessage
+from pronote_sync.channels.xmpp import XmppChannel, XmppMessage
 from pronote_sync.config.settings import XmppSettings
 from pronote_sync.models.agenda import Lesson, TheoreticalLesson
 from pronote_sync.models.blog import BlogArticle, ExternalInfo
@@ -48,15 +48,11 @@ class FakeClientXMPP:
         self._should_disconnect_early = False
         self._host_used: str | None = None
         self._port_used: int | None = None
-        # New modes for realistic failure simulation
-        self._connect_mode: str = "ok"  # "ok", "pending", "connection_failed"
-        self._disconnect_mode: str = "ok"  # "ok", "pending"
-        self._fire_connection_failed: bool = False
 
     def add_event_handler(
         self, name: str, pointer: Callable[..., object], disposable: bool = False
     ) -> None:
-        if name not in ("session_start", "failed_auth", "connection_failed", "disconnected"):
+        if name not in ("session_start", "failed_auth", "disconnected"):
             raise AssertionError(f"Unsupported event: {name}")
         self.handlers.setdefault(name, []).append(pointer)
 
@@ -67,24 +63,10 @@ class FakeClientXMPP:
         self.connected = True
         self._host_used = host
         self._port_used = port
-
-        if self._connect_mode == "pending":
-            # Never resolves - simulates connection timeout
-            return future
-        elif self._connect_mode == "connection_failed":
-            # Resolves connect future but fires connection_failed event
-            loop.call_soon(self._fire_connection_failed_event)
-            future.set_result(True)
-            return future
-        else:
-            # Schedule event handlers to fire after connect returns
-            loop.call_soon(self._fire_events)
-            future.set_result(True)
-            return future
-
-    def _fire_connection_failed_event(self) -> None:
-        """Fire connection_failed event for testing."""
-        self._fire("connection_failed")
+        # Schedule event handlers to fire after connect returns
+        loop.call_soon(self._fire_events)
+        future.set_result(True)
+        return future
 
     def _fire_events(self) -> None:
         if self._should_disconnect_early:
@@ -104,13 +86,8 @@ class FakeClientXMPP:
         loop = asyncio.get_event_loop()
         future: asyncio.Future[bool] = loop.create_future()
         self.disconnected = True
-
-        if self._disconnect_mode == "pending":
-            # Never resolves - simulates cleanup timeout
-            return future
-        else:
-            future.set_result(True)
-            return future
+        future.set_result(True)
+        return future
 
     def send_message(
         self, mto: object, mbody: str | None = None, mtype: str | None = None, **kwargs: object
@@ -704,339 +681,6 @@ class TestXmppChannelSend:
             jid_arg = call_args.args[0]
             assert jid_arg == "bot@example.com/myresource"
 
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_connect_timeout_returns_false(self, caplog: pytest.LogCaptureFixture) -> None:
-        """Test que connect_timeout retourne False quand connect() ne résout pas.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            connect_timeout=0.05,
-            timeout=30,
-            cleanup_timeout=0.01,
-        )
-
-        class PendingConnectClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-                self._connect_mode = "pending"
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=PendingConnectClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            result = await channel.send_async(msg)
-            assert result is False
-            # Vérifier que le log contient "connexion"
-            logs = caplog.text
-            assert "connexion" in logs.lower()
-
-    @pytest.mark.asyncio
-    async def test_cancelled_error_cancels_pending_tasks(self) -> None:
-        """Test que l'annulation de send_async annule les tâches encore en attente.
-
-        Un ``connect()`` qui ne résout jamais et une annulation de la tâche
-        appelante doivent entraîner la cancellation de la future de connexion
-        (idempotence de ``_cancel_pending`` sur les chemins d'exception).
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            connect_timeout=15,
-            timeout=30,
-            cleanup_timeout=0.01,
-        )
-
-        class PendingConnectClient(FakeClientXMPP):
-            """Client dont ``connect()`` retourne une future jamais résolue."""
-
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-                self._connect_mode = "pending"
-                self.connect_future: asyncio.Future[bool] | None = None
-
-            def connect(
-                self, host: str | None = None, port: int | None = None
-            ) -> asyncio.Future[bool]:
-                future = super().connect(host, port)
-                self.connect_future = future
-                return future
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=PendingConnectClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            client = PendingConnectClient("bot@example.com", "secret123")
-            with patch("pronote_sync.channels.xmpp.ClientXMPP", new=lambda j, p: client):
-                task = asyncio.ensure_future(channel.send_async(msg))
-                # Laisse asyncio.wait démarrer et la future de connexion rester en attente
-                await asyncio.sleep(0.05)
-                task.cancel()
-                result = await task
-                assert result is False
-                assert client.connect_future is not None
-                assert client.connect_future.cancelled()
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_connection_failed_event_returns_false(
-        self, caplog: pytest.LogCaptureFixture
-    ) -> None:
-        """Test que connection_failed event retourne False rapidement.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            connect_timeout=15,
-            timeout=30,
-            cleanup_timeout=0.01,
-        )
-
-        class ConnectionFailedClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-                self._connect_mode = "connection_failed"
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ConnectionFailedClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            result = await channel.send_async(msg)
-            assert result is False
-            # Vérifier que le log contient une mention d'échec réseau
-            logs = caplog.text
-            assert "réseau" in logs.lower() or "connexion" in logs.lower()
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_cleanup_timeout_does_not_hang(self, caplog: pytest.LogCaptureFixture) -> None:
-        """Test que cleanup_timeout ne bloque pas quand disconnect() ne résout pas.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        import logging
-
-        caplog.set_level(logging.DEBUG)
-
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            connect_timeout=0.05,
-            timeout=30,
-            cleanup_timeout=0.01,
-        )
-
-        class HangingDisconnectClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-                self._disconnect_mode = "pending"
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=HangingDisconnectClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            # Should complete quickly despite hanging disconnect
-            result = await asyncio.wait_for(channel.send_async(msg), timeout=0.5)
-            assert result is True
-            # Vérifier que le log contient une mention de timeout de nettoyage
-            logs = caplog.text
-            assert "déconnexion" in logs.lower()
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_tls_mode_direct_config(self) -> None:
-        """Test que tls_mode='direct' configure enable_direct_tls=True et enable_starttls=False.
-
-        :return: None
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="direct",
-            timeout=30,
-        )
-
-        class InspectClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP") as mock_cls:
-            mock_cls.return_value = InspectClient("bot@example.com", "secret123")
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            await channel.send_async(msg)
-            client_instance = mock_cls.return_value
-            assert client_instance.enable_direct_tls is True
-            assert client_instance.enable_starttls is False
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_tls_mode_starttls_config(self) -> None:
-        """Test que tls_mode='starttls' configure enable_starttls=True et enable_direct_tls=False.
-
-        :return: None
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            timeout=30,
-        )
-
-        class InspectClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP") as mock_cls:
-            mock_cls.return_value = InspectClient("bot@example.com", "secret123")
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            await channel.send_async(msg)
-            client_instance = mock_cls.return_value
-            assert client_instance.enable_starttls is True
-            assert client_instance.enable_direct_tls is False
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_tls_mode_disabled_config(self) -> None:
-        """Test que tls_mode='disabled' avec host='127.0.0.1' configure TLS désactivé.
-
-        :return: None
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="127.0.0.1",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="disabled",
-            timeout=30,
-        )
-
-        class InspectClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP") as mock_cls:
-            mock_cls.return_value = InspectClient("bot@example.com", "secret123")
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            await channel.send_async(msg)
-            client_instance = mock_cls.return_value
-            assert client_instance.enable_direct_tls is False
-            assert client_instance.enable_starttls is False
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_no_secret_leak_in_connection_failure_log(
-        self, caplog: pytest.LogCaptureFixture
-    ) -> None:
-        """Test qu'aucun secret ne fuit dans les logs en cas d'échec de connexion.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        sentinel_password = "SECRET_PASSWORD_XMPP_12345"  # pragma: allowlist secret
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr(sentinel_password),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            timeout=30,
-        )
-
-        class ConnectionFailedClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-                self._connect_mode = "connection_failed"
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ConnectionFailedClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            await channel.send_async(msg)
-
-        # Vérifier que le mot de passe sentinelle n'apparaît pas dans les logs
-        logs = caplog.text
-        assert sentinel_password not in logs
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_no_secret_leak_in_connect_timeout_log(
-        self, caplog: pytest.LogCaptureFixture
-    ) -> None:
-        """Test qu'aucun secret ne fuit dans les logs en cas de timeout de connexion.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        sentinel_password = "SECRET_PASSWORD_XMPP_12345"
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr(sentinel_password),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            connect_timeout=0.05,
-            timeout=30,
-            cleanup_timeout=0.01,
-        )
-
-        class PendingConnectClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-                self._connect_mode = "pending"
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=PendingConnectClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            await channel.send_async(msg)
-
-        # Vérifier que le mot de passe sentinelle n'apparaît pas dans les logs
-        logs = caplog.text
-        assert sentinel_password not in logs
-
     @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
     @pytest.mark.asyncio
     async def test_send_async_tls_direct_config(self) -> None:
@@ -1172,328 +816,6 @@ class TestXmppChannelSend:
             result = await channel.send_async(msg)
             assert result is True
 
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_send_async_connect_raises_exception_returns_false(self) -> None:
-        """Test que connect() levant une exception retourne False.
-
-        :return: None
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            timeout=30,
-        )
-
-        class ConnectExceptionClient(FakeClientXMPP):
-            def connect(
-                self, host: str | None = None, port: int | None = None
-            ) -> asyncio.Future[bool]:
-                raise ConnectionError("Network unreachable")
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ConnectExceptionClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            result = await channel.send_async(msg)
-            assert result is False
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_send_async_connect_future_error_returns_false(
-        self, caplog: pytest.LogCaptureFixture
-    ) -> None:
-        """Test que la future de connect() résolue avec une exception retourne False.
-
-        Le message d'erreur doit être expurgé et ne pas contenir les secrets.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        sentinel_password = "SECRET_PASSWORD_XMPP_CONNECT_FUT"  # pragma: allowlist secret
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr(sentinel_password),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            timeout=30,
-        )
-
-        class ConnectFutureErrorClient(FakeClientXMPP):
-            def connect(
-                self, host: str | None = None, port: int | None = None
-            ) -> asyncio.Future[bool]:
-                loop = asyncio.get_event_loop()
-                future: asyncio.Future[bool] = loop.create_future()
-                future.set_exception(ConnectionError("Network unreachable"))
-                return future
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ConnectFutureErrorClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            result = await channel.send_async(msg)
-            assert result is False
-            assert "Échec de connexion XMPP" in caplog.text
-            assert sentinel_password not in caplog.text
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_send_async_session_failure_after_connect_returns_false(
-        self, caplog: pytest.LogCaptureFixture
-    ) -> None:
-        """Test qu'un échec de session après connexion résolue retourne False.
-
-        Le connect future est résolu avec succès, puis l'événement
-        ``failed_auth`` arrive pendant l'attente de session.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            timeout=5,
-            cleanup_timeout=0.01,
-        )
-
-        class LateAuthFailClient(FakeClientXMPP):
-            def connect(
-                self, host: str | None = None, port: int | None = None
-            ) -> asyncio.Future[bool]:
-                loop = asyncio.get_event_loop()
-                future: asyncio.Future[bool] = loop.create_future()
-                self.connected = True
-                self._host_used = host
-                self._port_used = port
-                loop.call_later(0.01, lambda: self._fire("failed_auth"))
-                future.set_result(True)
-                return future
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=LateAuthFailClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            result = await channel.send_async(msg)
-            assert result is False
-            assert "authentification" in caplog.text.lower()
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    @pytest.mark.asyncio
-    async def test_send_async_cancelled_returns_false(
-        self, caplog: pytest.LogCaptureFixture
-    ) -> None:
-        """Test que l'annulation de la tâche retourne False sans lever.
-
-        Le contrat du canal impose un retour booléen : ``CancelledError`` doit
-        être interceptée et convertie en ``False``.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        import logging
-
-        caplog.set_level(logging.DEBUG)
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            tls_mode="starttls",
-            connect_timeout=15,
-            timeout=30,
-            cleanup_timeout=0.01,
-        )
-
-        class PendingConnectClient(FakeClientXMPP):
-            def __init__(self, jid: str, password: str) -> None:
-                super().__init__(jid, password)
-                self._connect_mode = "pending"
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=PendingConnectClient):
-            channel = XmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            task = asyncio.ensure_future(channel.send_async(msg))
-            await asyncio.sleep(0.001)
-            task.cancel()
-            result = await asyncio.wait_for(task, timeout=1.0)
-            assert result is False
-            assert "annulé" in caplog.text.lower()
-
-
-class TestSecretValues:
-    """Tests pour la fonction _secret_values."""
-
-    def test_secret_values_with_all_secrets(self) -> None:
-        """Test que _secret_values retourne tous les secrets.
-
-        :return: None
-        """
-        from pronote_sync.channels.xmpp import _secret_values
-
-        settings = XmppSettings(
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            to="parent@example.com",
-        )
-        secrets = _secret_values(settings)
-        assert len(secrets) == 3
-        assert "bot@example.com" in secrets
-        assert settings.password in secrets
-        assert "parent@example.com" in secrets
-
-    def test_secret_values_with_none_values(self) -> None:
-        """Test que _secret_values filtre les valeurs None.
-
-        :return: None
-        """
-        from pronote_sync.channels.xmpp import _secret_values
-
-        settings = XmppSettings(
-            jid=None,
-            password=None,
-            to=None,
-        )
-        secrets = _secret_values(settings)
-        assert len(secrets) == 0
-
-    def test_secret_values_with_some_none(self) -> None:
-        """Test que _secret_values gère les valeurs partiellement None.
-
-        :return: None
-        """
-        from pronote_sync.channels.xmpp import _secret_values
-
-        settings = XmppSettings(
-            jid="bot@example.com",
-            password=None,
-            to="parent@example.com",
-        )
-        secrets = _secret_values(settings)
-        assert len(secrets) == 2
-        assert "bot@example.com" in secrets
-        assert "parent@example.com" in secrets
-
-
-class TestSyncXmppChannel:
-    """Tests unitaires pour la classe SyncXmppChannel."""
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    def test_sync_send_dry_run_returns_true(self) -> None:
-        """Test que SyncXmppChannel en dry_run retourne True.
-
-        :return: None
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            use_tls=True,
-            timeout=30,
-        )
-        channel = SyncXmppChannel(settings, dry_run=True)
-        msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-        result = channel.send(msg)
-        assert result is True
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    def test_sync_send_success_returns_true(self) -> None:
-        """Test que SyncXmppChannel.send retourne True en cas de succès.
-
-        :return: None
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            use_tls=True,
-            timeout=30,
-        )
-        channel = SyncXmppChannel(settings, dry_run=False)
-        msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-        result = channel.send(msg)
-        assert result is True
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    def test_sync_send_exception_returns_false(self) -> None:
-        """Test que SyncXmppChannel.send retourne False en cas d'exception.
-
-        :return: None
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            use_tls=True,
-            timeout=30,
-        )
-
-        class ErrorClient(FakeClientXMPP):
-            def connect(
-                self, host: str | None = None, port: int | None = None
-            ) -> asyncio.Future[bool]:
-                raise RuntimeError("Connection failed")
-
-        with patch("pronote_sync.channels.xmpp.ClientXMPP", new=ErrorClient):
-            channel = SyncXmppChannel(settings, dry_run=False)
-            msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-            result = channel.send(msg)
-            assert result is False
-
-    @patch("pronote_sync.channels.xmpp.ClientXMPP", new=FakeClientXMPP)
-    def test_sync_send_asyncio_run_error_returns_false(
-        self, caplog: pytest.LogCaptureFixture
-    ) -> None:
-        """Test que send retourne False si asyncio.run lève une exception.
-
-        :param caplog: Fixture pytest pour capturer les logs.
-        """
-        settings = XmppSettings(
-            enabled=True,
-            jid="bot@example.com",
-            password=SecretStr("secret123"),
-            host="xmpp.example.com",
-            port=5222,
-            to="parent@example.com",
-            resource="pronote-sync",
-            use_tls=True,
-            timeout=30,
-        )
-        channel = SyncXmppChannel(settings, dry_run=False)
-        msg = XmppMessage(target_date=date(2025, 9, 7), synthesis=None, external_info=None)
-        with patch(
-            "pronote_sync.channels.xmpp.asyncio.run",
-            side_effect=RuntimeError("Boucle événementielle indisponible"),
-        ):
-            result = channel.send(msg)
-        assert result is False
-        assert "erreur" in caplog.text.lower()
-
 
 class TestXmppChannelSecurity:
     """Tests de sécurité pour XmppChannel (non-fuite de secrets).

tests/unit/test_xmpp_settings.py

@@ -99,52 +99,19 @@ class TestTimeoutConstraints:
 class TestTlsPolicy:
     """Tests de la politique TLS pour le champ use_tls."""
 
-    def test_tls_disabled_with_remote_host_rejected(self) -> None:
-        """Vérifie que tls_mode="disabled" avec un hôte distant est rejeté.
+    def test_use_tls_false_with_remote_host_rejected(self) -> None:
+        """Vérifie que use_tls=False avec un hôte distant est rejeté.
 
-        :raises ValidationError: Si tls_mode="disabled" et host n'est pas une boucle locale.
+        :raises ValidationError: Si use_tls=False et host n'est pas une boucle locale.
         """
         with pytest.raises(ValidationError) as exc_info:
-            XmppSettings(tls_mode="disabled", host="talk.example.com")
-        assert "tls" in str(exc_info.value).lower()
+            XmppSettings(use_tls=False, host="talk.example.com")
+        assert "use_tls" in str(exc_info.value).lower() or "tls" in str(exc_info.value).lower()
 
-    def test_tls_disabled_with_remote_host_rejected_when_enabled(self) -> None:
+    def test_use_tls_false_with_remote_host_rejected_when_enabled(self) -> None:
         """Vérifie que la politique TLS s'applique même quand le canal est activé."""
         with pytest.raises(ValidationError):
-            XmppSettings(enabled=True, tls_mode="disabled", host="talk.example.com")
-
-    def test_use_tls_false_maps_to_starttls(self) -> None:
-        """Vérifie que l'alias obsolète use_tls=False mappe vers tls_mode='starttls'.
-
-        :return: Vérifie le mapping et l'émission d'un DeprecationWarning.
-        :rtype: None
-        """
-        with pytest.warns(DeprecationWarning):
-            settings = XmppSettings(use_tls=False, host="talk.example.com")
-        assert settings.tls_mode == "starttls"
-        assert settings.host == "talk.example.com"
-
-    def test_use_tls_true_maps_to_direct(self) -> None:
-        """Vérifie que l'alias obsolète use_tls=True mappe vers tls_mode='direct'.
-
-        :return: Vérifie le mapping et l'émission d'un DeprecationWarning.
-        :rtype: None
-        """
-        with pytest.warns(DeprecationWarning):
-            settings = XmppSettings(use_tls=True, host="talk.example.com")
-        assert settings.tls_mode == "direct"
-        assert settings.host == "talk.example.com"
-
-    def test_default_tls_mode_is_starttls(self) -> None:
-        """Vérifie que tls_mode vaut 'starttls' par défaut avec les timeouts par défaut.
-
-        :return: Vérifie tls_mode='starttls', connect_timeout=15, cleanup_timeout=10.
-        :rtype: None
-        """
-        settings = XmppSettings()
-        assert settings.tls_mode == "starttls"
-        assert settings.connect_timeout == 15
-        assert settings.cleanup_timeout == 10
+            XmppSettings(enabled=True, use_tls=False, host="talk.example.com")
 
     def test_use_tls_false_with_localhost_allowed(self) -> None:
         """Vérifie que use_tls=False avec localhost est autorisé.
@@ -153,7 +120,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=False, host="localhost")
-        assert settings.tls_mode == "starttls"
+        assert settings.use_tls is False
         assert settings.host == "localhost"
 
     def test_use_tls_false_with_127_allowed(self) -> None:
@@ -163,7 +130,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=False, host="127.0.0.1")
-        assert settings.tls_mode == "starttls"
+        assert settings.use_tls is False
         assert settings.host == "127.0.0.1"
 
     def test_use_tls_false_with_ipv6_loopback_allowed(self) -> None:
@@ -173,7 +140,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=False, host="::1")
-        assert settings.tls_mode == "starttls"
+        assert settings.use_tls is False
         assert settings.host == "::1"
 
     def test_use_tls_true_with_remote_host_allowed(self) -> None:
@@ -183,7 +150,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=True, host="talk.example.com")
-        assert settings.tls_mode == "direct"
+        assert settings.use_tls is True
         assert settings.host == "talk.example.com"
 
     def test_use_tls_true_with_empty_host_allowed(self) -> None:
@@ -193,7 +160,7 @@ class TestTlsPolicy:
         :rtype: None
         """
         settings = XmppSettings(use_tls=True, host="")
-        assert settings.tls_mode == "direct"
+        assert settings.use_tls is True
         assert settings.host == ""
 
 
@@ -206,7 +173,7 @@ class TestNoSecretInErrorMessages:
         Crée une instance avec des valeurs sensibles et vérifie que l'erreur de validation
         ne contient pas ces valeurs dans son message.
 
-        :raises ValidationError: Si tls_mode="disabled" avec un hôte non-local.
+        :raises ValidationError: Si use_tls=False avec un hôte non-local.
         :return: Vérifie que le message d'erreur ne contient pas les secrets.
         :rtype: None
         """
@@ -217,7 +184,7 @@ class TestNoSecretInErrorMessages:
 
         with pytest.raises(ValidationError) as exc_info:
             XmppSettings(
-                tls_mode="disabled",
+                use_tls=False,
                 host="talk.example.com",
                 jid=sentinel_jid,
                 password=sentinel_password,
@@ -230,72 +197,3 @@ class TestNoSecretInErrorMessages:
         assert "test_password_123" not in error_message
         assert "test_to@example.com" not in error_message
         assert "secret" not in error_message
-
-
-class TestXmppSettingsTlsMode:
-    """Tests supplémentaires pour les validateurs de XmppSettings."""
-
-    def test_use_tls_true_maps_to_direct_with_warning(self) -> None:
-        """Vérifie que use_tls=True mappe vers tls_mode='direct' avec DeprecationWarning.
-
-        :return: Vérifie le mapping et l'émission d'un DeprecationWarning.
-        :rtype: None
-        """
-        with pytest.warns(DeprecationWarning):
-            settings = XmppSettings(use_tls=True, host="talk.example.com")
-        assert settings.tls_mode == "direct"
-
-    def test_use_tls_false_maps_to_starttls_with_warning(self) -> None:
-        """Vérifie que use_tls=False mappe vers tls_mode='starttls' avec DeprecationWarning.
-
-        :return: Vérifie le mapping et l'émission d'un DeprecationWarning.
-        :rtype: None
-        """
-        with pytest.warns(DeprecationWarning):
-            settings = XmppSettings(use_tls=False, host="talk.example.com")
-        assert settings.tls_mode == "starttls"
-
-    def test_tls_mode_disabled_rejected_for_remote(self) -> None:
-        """Vérifie que tls_mode='disabled' avec un hôte distant est rejeté.
-
-        :raises ValidationError: Si tls_mode="disabled" et host n'est pas une boucle locale.
-        """
-        with pytest.raises(ValidationError) as exc_info:
-            XmppSettings(tls_mode="disabled", host="example.com")
-        assert "tls" in str(exc_info.value).lower()
-
-    def test_tls_mode_disabled_allowed_for_loopback(self) -> None:
-        """Vérifie que tls_mode='disabled' avec host='127.0.0.1' est valide.
-
-        :return: Vérifie que XmppSettings(tls_mode='disabled', host='127.0.0.1') est valide.
-        :rtype: None
-        """
-        settings = XmppSettings(tls_mode="disabled", host="127.0.0.1")
-        assert settings.tls_mode == "disabled"
-        assert settings.host == "127.0.0.1"
-
-    def test_connect_timeout_must_be_positive(self) -> None:
-        """Vérifie que connect_timeout doit être strictement positif.
-
-        :raises ValidationError: Si connect_timeout <= 0.
-        """
-        with pytest.raises(ValidationError) as exc_info:
-            XmppSettings(connect_timeout=0)
-        assert "connect_timeout" in str(exc_info.value).lower()
-
-        with pytest.raises(ValidationError) as exc_info:
-            XmppSettings(connect_timeout=-1)
-        assert "connect_timeout" in str(exc_info.value).lower()
-
-    def test_cleanup_timeout_must_be_positive(self) -> None:
-        """Vérifie que cleanup_timeout doit être strictement positif.
-
-        :raises ValidationError: Si cleanup_timeout <= 0.
-        """
-        with pytest.raises(ValidationError) as exc_info:
-            XmppSettings(cleanup_timeout=0)
-        assert "cleanup_timeout" in str(exc_info.value).lower()
-
-        with pytest.raises(ValidationError) as exc_info:
-            XmppSettings(cleanup_timeout=-1)
-        assert "cleanup_timeout" in str(exc_info.value).lower()