diff --git a/tests/test_cli.py b/tests/cli/test_cli.py
similarity index 100%
rename from tests/test_cli.py
rename to tests/cli/test_cli.py
diff --git a/tests/test_cli_db_reset.py b/tests/cli/test_cli_db_reset.py
similarity index 100%
rename from tests/test_cli_db_reset.py
rename to tests/cli/test_cli_db_reset.py
diff --git a/tests/test_cli_service_pool.py b/tests/cli/test_cli_service_pool.py
similarity index 100%
rename from tests/test_cli_service_pool.py
rename to tests/cli/test_cli_service_pool.py
diff --git a/tests/test_embedded_workers.py b/tests/cli/test_embedded_workers.py
similarity index 100%
rename from tests/test_embedded_workers.py
rename to tests/cli/test_embedded_workers.py
diff --git a/tests/test_mode_gating.py b/tests/cli/test_mode_gating.py
similarity index 98%
rename from tests/test_mode_gating.py
rename to tests/cli/test_mode_gating.py
index 32060d4d..1b18b8a5 100644
--- a/tests/test_mode_gating.py
+++ b/tests/cli/test_mode_gating.py
@@ -10,7 +10,7 @@ from pathlib import Path
 import pytest
 
 
-REPO = pathlib.Path(__file__).resolve().parent.parent
+REPO = pathlib.Path(__file__).resolve().parent.parent.parent
 #DECNET_BIN = REPO / ".venv" / "bin" / "decnet"
 DECNET_BIN = Path(sys.executable).parent / "decnet"
 
diff --git a/tests/test_collector.py b/tests/collector/test_collector.py
similarity index 100%
rename from tests/test_collector.py
rename to tests/collector/test_collector.py
diff --git a/tests/test_collector_thread_pool.py b/tests/collector/test_collector_thread_pool.py
similarity index 100%
rename from tests/test_collector_thread_pool.py
rename to tests/collector/test_collector_thread_pool.py
diff --git a/tests/config/__init__.py b/tests/config/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/test_config.py b/tests/config/test_config.py
similarity index 100%
rename from tests/test_config.py
rename to tests/config/test_config.py
diff --git a/tests/test_config_ini.py b/tests/config/test_config_ini.py
similarity index 100%
rename from tests/test_config_ini.py
rename to tests/config/test_config_ini.py
diff --git a/tests/test_ini_loader.py b/tests/config/test_ini_loader.py
similarity index 100%
rename from tests/test_ini_loader.py
rename to tests/config/test_ini_loader.py
diff --git a/tests/test_ini_spaces.py b/tests/config/test_ini_spaces.py
similarity index 100%
rename from tests/test_ini_spaces.py
rename to tests/config/test_ini_spaces.py
diff --git a/tests/test_ini_validation.py b/tests/config/test_ini_validation.py
similarity index 100%
rename from tests/test_ini_validation.py
rename to tests/config/test_ini_validation.py
diff --git a/tests/core/__init__.py b/tests/core/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/test_build.py b/tests/core/test_build.py
similarity index 100%
rename from tests/test_build.py
rename to tests/core/test_build.py
diff --git a/tests/test_fingerprinting.py b/tests/core/test_fingerprinting.py
similarity index 100%
rename from tests/test_fingerprinting.py
rename to tests/core/test_fingerprinting.py
diff --git a/tests/test_network.py b/tests/core/test_network.py
similarity index 100%
rename from tests/test_network.py
rename to tests/core/test_network.py
diff --git a/tests/test_os_fingerprint.py b/tests/core/test_os_fingerprint.py
similarity index 100%
rename from tests/test_os_fingerprint.py
rename to tests/core/test_os_fingerprint.py
diff --git a/tests/test_privdrop.py b/tests/core/test_privdrop.py
similarity index 100%
rename from tests/test_privdrop.py
rename to tests/core/test_privdrop.py
diff --git a/tests/test_bounty_dedup.py b/tests/correlation/test_bounty_dedup.py
similarity index 100%
rename from tests/test_bounty_dedup.py
rename to tests/correlation/test_bounty_dedup.py
diff --git a/tests/test_correlation.py b/tests/correlation/test_correlation.py
similarity index 100%
rename from tests/test_correlation.py
rename to tests/correlation/test_correlation.py
diff --git a/tests/db/__init__.py b/tests/db/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/db/mysql/__init__.py b/tests/db/mysql/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/test_mysql_histogram_sql.py b/tests/db/mysql/test_mysql_histogram_sql.py
similarity index 100%
rename from tests/test_mysql_histogram_sql.py
rename to tests/db/mysql/test_mysql_histogram_sql.py
diff --git a/tests/test_mysql_migration.py b/tests/db/mysql/test_mysql_migration.py
similarity index 100%
rename from tests/test_mysql_migration.py
rename to tests/db/mysql/test_mysql_migration.py
diff --git a/tests/test_mysql_url_builder.py b/tests/db/mysql/test_mysql_url_builder.py
similarity index 100%
rename from tests/test_mysql_url_builder.py
rename to tests/db/mysql/test_mysql_url_builder.py
diff --git a/tests/test_base_repo.py b/tests/db/test_base_repo.py
similarity index 100%
rename from tests/test_base_repo.py
rename to tests/db/test_base_repo.py
diff --git a/tests/test_factory.py b/tests/db/test_factory.py
similarity index 100%
rename from tests/test_factory.py
rename to tests/db/test_factory.py
diff --git a/tests/fleet/__init__.py b/tests/fleet/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/test_archetypes.py b/tests/fleet/test_archetypes.py
similarity index 100%
rename from tests/test_archetypes.py
rename to tests/fleet/test_archetypes.py
diff --git a/tests/test_auto_spawn.py b/tests/fleet/test_auto_spawn.py
similarity index 100%
rename from tests/test_auto_spawn.py
rename to tests/fleet/test_auto_spawn.py
diff --git a/tests/test_composer.py b/tests/fleet/test_composer.py
similarity index 100%
rename from tests/test_composer.py
rename to tests/fleet/test_composer.py
diff --git a/tests/test_deployer.py b/tests/fleet/test_deployer.py
similarity index 100%
rename from tests/test_deployer.py
rename to tests/fleet/test_deployer.py
diff --git a/tests/test_fleet.py b/tests/fleet/test_fleet.py
similarity index 100%
rename from tests/test_fleet.py
rename to tests/fleet/test_fleet.py
diff --git a/tests/test_fleet_singleton.py b/tests/fleet/test_fleet_singleton.py
similarity index 100%
rename from tests/test_fleet_singleton.py
rename to tests/fleet/test_fleet_singleton.py
diff --git a/tests/logging/__init__.py b/tests/logging/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/test_file_handler.py b/tests/logging/test_file_handler.py
similarity index 100%
rename from tests/test_file_handler.py
rename to tests/logging/test_file_handler.py
diff --git a/tests/test_inode_aware_handler.py b/tests/logging/test_inode_aware_handler.py
similarity index 100%
rename from tests/test_inode_aware_handler.py
rename to tests/logging/test_inode_aware_handler.py
diff --git a/tests/test_log_file_mount.py b/tests/logging/test_log_file_mount.py
similarity index 100%
rename from tests/test_log_file_mount.py
rename to tests/logging/test_log_file_mount.py
diff --git a/tests/test_logging.py b/tests/logging/test_logging.py
similarity index 100%
rename from tests/test_logging.py
rename to tests/logging/test_logging.py
diff --git a/tests/test_logging_forwarder.py b/tests/logging/test_logging_forwarder.py
similarity index 100%
rename from tests/test_logging_forwarder.py
rename to tests/logging/test_logging_forwarder.py
diff --git a/tests/test_syslog_formatter.py b/tests/logging/test_syslog_formatter.py
similarity index 100%
rename from tests/test_syslog_formatter.py
rename to tests/logging/test_syslog_formatter.py
diff --git a/tests/mutator/__init__.py b/tests/mutator/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/test_mutator.py b/tests/mutator/test_mutator.py
similarity index 100%
rename from tests/test_mutator.py
rename to tests/mutator/test_mutator.py
diff --git a/tests/test_prober_bounty.py b/tests/prober/test_prober_bounty.py
similarity index 100%
rename from tests/test_prober_bounty.py
rename to tests/prober/test_prober_bounty.py
diff --git a/tests/test_prober_hassh.py b/tests/prober/test_prober_hassh.py
similarity index 100%
rename from tests/test_prober_hassh.py
rename to tests/prober/test_prober_hassh.py
diff --git a/tests/test_prober_jarm.py b/tests/prober/test_prober_jarm.py
similarity index 100%
rename from tests/test_prober_jarm.py
rename to tests/prober/test_prober_jarm.py
diff --git a/tests/test_prober_tcpfp.py b/tests/prober/test_prober_tcpfp.py
similarity index 100%
rename from tests/test_prober_tcpfp.py
rename to tests/prober/test_prober_tcpfp.py
diff --git a/tests/test_prober_worker.py b/tests/prober/test_prober_worker.py
similarity index 100%
rename from tests/test_prober_worker.py
rename to tests/prober/test_prober_worker.py
diff --git a/tests/test_attacker_worker.py b/tests/profiler/test_attacker_worker.py
similarity index 100%
rename from tests/test_attacker_worker.py
rename to tests/profiler/test_attacker_worker.py
diff --git a/tests/test_profiler_behavioral.py b/tests/profiler/test_profiler_behavioral.py
similarity index 100%
rename from tests/test_profiler_behavioral.py
rename to tests/profiler/test_profiler_behavioral.py
diff --git a/tests/test_session_profile.py b/tests/profiler/test_session_profile.py
similarity index 100%
rename from tests/test_session_profile.py
rename to tests/profiler/test_session_profile.py
diff --git a/tests/services/__init__.py b/tests/services/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/test_custom_service.py b/tests/services/test_custom_service.py
similarity index 100%
rename from tests/test_custom_service.py
rename to tests/services/test_custom_service.py
diff --git a/tests/test_service_isolation.py b/tests/services/test_service_isolation.py
similarity index 96%
rename from tests/test_service_isolation.py
rename to tests/services/test_service_isolation.py
index d0092cc2..d82f125b 100644
--- a/tests/test_service_isolation.py
+++ b/tests/services/test_service_isolation.py
@@ -202,15 +202,19 @@ class TestAttackerWorkerIsolation:
         mock_repo.set_state = AsyncMock()
 
         iterations = 0
+        real_wait_for = asyncio.wait_for
 
-        async def _controlled_sleep(seconds):
+        async def _controlled_wait_for(awaitable, timeout):
             nonlocal iterations
             iterations += 1
             if iterations >= 3:
+                if asyncio.iscoroutine(awaitable):
+                    awaitable.close()
                 raise asyncio.CancelledError()
+            return await real_wait_for(awaitable, timeout)
 
-        with patch("decnet.profiler.worker.asyncio.sleep", side_effect=_controlled_sleep):
-            task = asyncio.create_task(attacker_profile_worker(mock_repo))
+        with patch("decnet.profiler.worker.asyncio.wait_for", side_effect=_controlled_wait_for):
+            task = asyncio.create_task(attacker_profile_worker(mock_repo, interval=0))
             with pytest.raises(asyncio.CancelledError):
                 await task
         # Worker should have retried at least twice before we cancelled
@@ -454,15 +458,19 @@ class TestCascadeIsolation:
         mock_repo.get_logs_after_id = AsyncMock(return_value=[])
 
         iterations = 0
+        real_wait_for = asyncio.wait_for
 
-        async def _controlled_sleep(seconds):
+        async def _controlled_wait_for(awaitable, timeout):
             nonlocal iterations
             iterations += 1
             if iterations >= 3:
+                if asyncio.iscoroutine(awaitable):
+                    awaitable.close()
                 raise asyncio.CancelledError()
+            return await real_wait_for(awaitable, timeout)
 
-        with patch("decnet.profiler.worker.asyncio.sleep", side_effect=_controlled_sleep):
-            task = asyncio.create_task(attacker_profile_worker(mock_repo))
+        with patch("decnet.profiler.worker.asyncio.wait_for", side_effect=_controlled_wait_for):
+            task = asyncio.create_task(attacker_profile_worker(mock_repo, interval=0))
             with pytest.raises(asyncio.CancelledError):
                 await task
         # Attacker should have run independently
diff --git a/tests/test_services.py b/tests/services/test_services.py
similarity index 100%
rename from tests/test_services.py
rename to tests/services/test_services.py
diff --git a/tests/test_smtp_relay.py b/tests/services/test_smtp_relay.py
similarity index 100%
rename from tests/test_smtp_relay.py
rename to tests/services/test_smtp_relay.py
diff --git a/tests/test_smtp_targets.py b/tests/services/test_smtp_targets.py
similarity index 100%
rename from tests/test_smtp_targets.py
rename to tests/services/test_smtp_targets.py
diff --git a/tests/test_ssh.py b/tests/services/test_ssh.py
similarity index 100%
rename from tests/test_ssh.py
rename to tests/services/test_ssh.py
diff --git a/tests/test_ssh_capture_emit.py b/tests/services/test_ssh_capture_emit.py
similarity index 98%
rename from tests/test_ssh_capture_emit.py
rename to tests/services/test_ssh_capture_emit.py
index 1059d35a..979a1320 100644
--- a/tests/test_ssh_capture_emit.py
+++ b/tests/services/test_ssh_capture_emit.py
@@ -19,7 +19,7 @@ import pytest
 
 from decnet.collector.worker import parse_rfc5424
 
-_TEMPLATE_DIR = Path(__file__).resolve().parent.parent / "decnet" / "templates" / "ssh"
+_TEMPLATE_DIR = Path(__file__).resolve().parent.parent.parent / "decnet" / "templates" / "ssh"
 _EMIT_SCRIPT = _TEMPLATE_DIR / "emit_capture.py"
 
 
diff --git a/tests/test_ssh_stealth.py b/tests/services/test_ssh_stealth.py
similarity index 100%
rename from tests/test_ssh_stealth.py
rename to tests/services/test_ssh_stealth.py
diff --git a/tests/test_sniffer_ja3.py b/tests/sniffer/test_sniffer_ja3.py
similarity index 99%
rename from tests/test_sniffer_ja3.py
rename to tests/sniffer/test_sniffer_ja3.py
index 7f5b2250..2cfa4cd1 100644
--- a/tests/test_sniffer_ja3.py
+++ b/tests/sniffer/test_sniffer_ja3.py
@@ -18,7 +18,7 @@ import pytest
 
 # ─── Import sniffer module with mocked syslog_bridge ─────────────────────────
 
-_SNIFFER_DIR = str(Path(__file__).parent.parent / "decnet" / "templates" / "sniffer")
+_SNIFFER_DIR = str(Path(__file__).parent.parent.parent / "decnet" / "templates" / "sniffer")
 
 def _load_sniffer():
     """Load decnet/templates/sniffer/server.py with syslog_bridge stubbed out."""
diff --git a/tests/test_sniffer_p0f.py b/tests/sniffer/test_sniffer_p0f.py
similarity index 100%
rename from tests/test_sniffer_p0f.py
rename to tests/sniffer/test_sniffer_p0f.py
diff --git a/tests/test_sniffer_retransmit.py b/tests/sniffer/test_sniffer_retransmit.py
similarity index 100%
rename from tests/test_sniffer_retransmit.py
rename to tests/sniffer/test_sniffer_retransmit.py
diff --git a/tests/test_sniffer_tcp_fingerprint.py b/tests/sniffer/test_sniffer_tcp_fingerprint.py
similarity index 100%
rename from tests/test_sniffer_tcp_fingerprint.py
rename to tests/sniffer/test_sniffer_tcp_fingerprint.py
diff --git a/tests/test_sniffer_worker.py b/tests/sniffer/test_sniffer_worker.py
similarity index 100%
rename from tests/test_sniffer_worker.py
rename to tests/sniffer/test_sniffer_worker.py
diff --git a/tests/telemetry/__init__.py b/tests/telemetry/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/test_telemetry.py b/tests/telemetry/test_telemetry.py
similarity index 100%
rename from tests/test_telemetry.py
rename to tests/telemetry/test_telemetry.py
diff --git a/tests/test_decnet.db-shm b/tests/test_decnet.db-shm
deleted file mode 100644
index 7f851873..00000000
Binary files a/tests/test_decnet.db-shm and /dev/null differ
diff --git a/tests/test_decnet.db-wal b/tests/test_decnet.db-wal
deleted file mode 100644
index 49d62023..00000000
Binary files a/tests/test_decnet.db-wal and /dev/null differ
diff --git a/tests/test_admin_seed.py b/tests/web/test_admin_seed.py
similarity index 100%
rename from tests/test_admin_seed.py
rename to tests/web/test_admin_seed.py
diff --git a/tests/test_api_attackers.py b/tests/web/test_api_attackers.py
similarity index 100%
rename from tests/test_api_attackers.py
rename to tests/web/test_api_attackers.py
diff --git a/tests/test_auth_async.py b/tests/web/test_auth_async.py
similarity index 100%
rename from tests/test_auth_async.py
rename to tests/web/test_auth_async.py
diff --git a/tests/test_env_lazy_jwt.py b/tests/web/test_env_lazy_jwt.py
similarity index 96%
rename from tests/test_env_lazy_jwt.py
rename to tests/web/test_env_lazy_jwt.py
index 55179041..04833a20 100644
--- a/tests/test_env_lazy_jwt.py
+++ b/tests/web/test_env_lazy_jwt.py
@@ -41,7 +41,7 @@ def test_agent_cli_imports_without_jwt_secret(monkeypatch, tmp_path):
     }
     clean_env["PATH"] = os.environ["PATH"]
     clean_env["HOME"] = str(tmp_path)
-    repo = pathlib.Path(__file__).resolve().parent.parent
+    repo = pathlib.Path(__file__).resolve().parent.parent.parent
     # binary = repo / ".venv" / "bin" / "decnet"
     binary = Path(sys.executable).parent / "decnet"
     result = subprocess.run(
diff --git a/tests/test_health_config_cache.py b/tests/web/test_health_config_cache.py
similarity index 100%
rename from tests/test_health_config_cache.py
rename to tests/web/test_health_config_cache.py
diff --git a/tests/test_ingester.py b/tests/web/test_ingester.py
similarity index 100%
rename from tests/test_ingester.py
rename to tests/web/test_ingester.py
diff --git a/tests/test_router_cache.py b/tests/web/test_router_cache.py
similarity index 100%
rename from tests/test_router_cache.py
rename to tests/web/test_router_cache.py
diff --git a/tests/test_web_api.py b/tests/web/test_web_api.py
similarity index 100%
rename from tests/test_web_api.py
rename to tests/web/test_web_api.py