diff --git a/tests/test_persimmons_shared_cutover.py b/tests/test_persimmons_shared_cutover.py
new file mode 100644
index 0000000..7bc7eeb
--- /dev/null
+++ b/tests/test_persimmons_shared_cutover.py
@@ -0,0 +1,67 @@
+from pathlib import Path
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class SharedPersimmonsCutoverTests(unittest.TestCase):
+    def test_canonical_front_door_reuses_composed_source_owned_bytes(self):
+        nginx = (ROOT / "gitea/teahub-nginx.conf").read_text()
+        fly = (ROOT / "gitea/fly.toml").read_text()
+        self.assertIn("server_name persimmons.app;", nginx)
+        self.assertIn("root /data/pages/matcha/greentea/current/🍊;", nginx)
+        self.assertIn('"https://persimmons.app" $http_origin;', nginx)
+        self.assertIn('GITEA__session__SAME_SITE = "none"', fly)
+
+    def test_default_server_explicitly_dispatches_pages_hosts(self):
+        nginx = (ROOT / "gitea/teahub-nginx.conf").read_text()
+        default = nginx.split("listen 3000 default_server;", 1)[1].split(
+            "\n  server {", 1
+        )[0]
+
+        self.assertIn("if ($host = persimmons.app) { return 418; }", default)
+        self.assertIn("error_page 418 = @persimmons_host;", default)
+        self.assertIn("location @persimmons_host {", default)
+        self.assertIn("root /data/pages/matcha/greentea/current/🍊;", default)
+        self.assertIn("try_files $uri $uri/ =404;", default)
+
+        self.assertIn("if ($host = xn--sj8h.teahub.xyz) { return 419; }", default)
+        self.assertIn("error_page 419 = @greentea_host;", default)
+        self.assertIn("root $greentea_host_root;", default)
+        self.assertIn("if ($uri = /oracle) { return 308 /oracle/; }", default)
+        self.assertIn("proxy_pass http://127.0.0.1:3001;", default)
+        self.assertIn("location = /tea {", default)
+
+    def test_extension_keeps_product_origin_but_uses_shared_authority(self):
+        manifest = (ROOT / "persimmons-extension/manifest.json").read_text()
+        human_api = (ROOT / "persimmons-extension/human-api.mjs").read_text()
+        juice = (ROOT / "persimmons-extension/juice.mjs").read_text()
+        self.assertIn('"https://persimmons.app/*"', manifest)
+        self.assertIn("https://teahub.xyz/tea/site/chat/persimmons", human_api)
+        self.assertIn("https://teahub.xyz/tea/site/chat/persimmons/juice/", juice)
+        self.assertNotIn("git.persimmons.app", manifest + human_api + juice)
+
+    def test_retired_standalone_deploy_entrypoints_are_absent(self):
+        retired = [
+            ".gitea/workflows/persimmons-launch.yml",
+            ".gitea/workflows/persimmons-preflight.yml",
+            "ops/persimmons-launch.py",
+            "ops/persimmons-preflight.py",
+            "ops/persimmons_gitea.py",
+            "persimmons/fly.toml",
+            "persimmons/Dockerfile",
+            "persimmons-gitea/fly.toml",
+            "persimmons-gitea/Dockerfile",
+        ]
+        self.assertFalse([path for path in retired if (ROOT / path).exists()])
+
+        operator = (ROOT / "tea_mcp/operator_tools.py").read_text()
+        workflow = (ROOT / ".gitea/workflows/test-persimmons.yml").read_text()
+        self.assertNotIn('"persimmons-launch.yml"', operator)
+        self.assertNotIn("persimmons-host-browser.cjs", workflow)
+        self.assertNotIn("tests.test_persimmons_host", workflow)
+
+
+if __name__ == "__main__":
+    unittest.main()