@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/telemetry/collect.test.mjs

@@ -1,1274 +0,0 @@
-/**
- * collect.test.mjs — the SHARED STATUS SNAPSHOT collector (collectStatus).
- *
- * Hermetic: injects node:os, a child-process count, an execFile fake (so no real
- * powermetrics/df fork), and log text — asserts the snapshot shape, the
- * state/activity/session derivation, machine stats, sub-agent count, and
- * claudeAuth detection. Also unit-tests the pure parsers.
- *
- * Run: node --test lib/telemetry/collect.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, utimesSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  collectStatus,
-  resolveActivity,
-  detectClaudeAuth,
-  countSubAgents,
-  parsePowermetrics,
-  parseDf,
-  collectMachine,
-  collectPowermetrics,
-  collectThermal,
-  parseThermalProbe,
-  parseThermalPressure,
-  powermetricsSamplers,
-  parseSystemProfilerHardware,
-  ramLabel,
-  collectSpend24h,
-  collectInventory,
-  sessionLiveness,
-  SESSION_STALE_MS,
-  _internals,
-} from "./collect.mjs";
-
-const NOW = Date.parse("2026-06-12T12:00:00Z");
-
-/** A node:os fake with controllable load/mem/cpus. */
-function fakeOs(opts = {}) {
-  return {
-    loadavg: () => opts.loadavg || [1.5, 1.2, 1.0],
-    totalmem: () => opts.totalmem ?? 16 * 1024 * 1024 * 1024,
-    freemem: () => opts.freemem ?? 8 * 1024 * 1024 * 1024,
-    cpus: () => new Array(opts.cpus ?? 8).fill({ model: "x" }),
-    platform: () => opts.platform || "darwin",
-  };
-}
-
-/** An execFile fake that returns canned stdout per binary. Never forks. */
-function fakeExecFile(map = {}) {
-  return (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    const out = map[cmd] ?? "";
-    queueMicrotask(() => cb(null, out, ""));
-    return { on() {} };
-  };
-}
-
-// ---------------------------------------------------------------------------
-
-test("collectStatus builds a well-formed snapshot (mocked os/powermetrics/df)", async () => {
-  const status = await collectStatus({
-    agentRoot: "/nonexistent-root", // no logs → claudeAuth unknown
-    now: NOW,
-    os: fakeOs({ loadavg: [2, 1, 1], totalmem: 16e9, freemem: 4e9, cpus: 8 }),
-    execFile: fakeExecFile({
-      "/usr/bin/powermetrics": "CPU die temperature: 61.4 C\nCPU idle residency: 78.0 %\n",
-      "/bin/df": "Filesystem 1024-blocks Used Available Capacity Mounted\n/dev/disk1 1000 600 400 60% /\n",
-    }),
-    subAgentsRunning: 2,
-  });
-
-  // shape
-  assert.equal(typeof status.state, "string");
-  assert.equal(typeof status.activity, "string");
-  assert.equal(typeof status.subAgentsRunning, "number");
-  assert.ok(Array.isArray(status.alerts));
-  assert.ok(Array.isArray(status.machine.loadavg));
-  assert.equal(status.machine.loadavg.length, 3);
-  assert.match(status.ts, /^2026-06-12T12:00:00/);
-
-  // machine
-  assert.equal(status.machine.memUsedPct, 75); // 1 - 4/16 = 0.75
-  assert.equal(status.machine.tempC, 61.4);
-  assert.equal(status.machine.diskUsedPct, 60);
-  assert.equal(status.machine.cpuPct, 22); // 100 - 78 idle
-
-  // sub-agents + idle→busy promotion
-  assert.equal(status.subAgentsRunning, 2);
-  assert.equal(status.state, "busy"); // idle but children running → busy
-  assert.equal(status.claudeAuth, "unknown");
-});
-
-test("collectStatus: relogin in logs → state error + claudeAuth relogin_required + critical alert", async () => {
-  const status = await collectStatus({
-    agentRoot: "/x",
-    now: NOW,
-    os: fakeOs(),
-    execFile: fakeExecFile({ "/usr/bin/powermetrics": "", "/bin/df": "" }),
-    subAgentsRunning: 0,
-    logText: "ERROR authentication_error: please run /login\n",
-  });
-  assert.equal(status.claudeAuth, "relogin_required");
-  assert.equal(status.state, "error");
-  const relogin = status.alerts.find((a) => a.id === "claude_relogin_required");
-  assert.ok(relogin, "a critical re-login alert is attached");
-  assert.equal(relogin.severity, "critical");
-});
-
-test("resolveActivity: a running work session → busy + session{taskClass,model}", () => {
-  const sessions = [
-    { sessionId: "s1", kind: "interactive", intent: "session: inbox", model: "sonnet", lastBeat: "2026-06-12T11:59:50Z" },
-    { sessionId: "d1", kind: "daemon", intent: "daemon", lastBeat: "2026-06-12T11:59:55Z" },
-  ];
-  const act = resolveActivity({ sessions, now: NOW });
-  assert.equal(act.state, "busy");
-  assert.equal(act.session.id, "s1");
-  assert.equal(act.session.taskClass, "inbox");
-  assert.equal(act.session.model, "sonnet");
-  assert.match(act.activity, /inbox/);
-});
-
-test("resolveActivity: only a daemon present → idle, no session", () => {
-  const act = resolveActivity({ sessions: [{ sessionId: "d1", kind: "daemon", intent: "daemon", lastBeat: "2026-06-12T11:59:55Z" }], now: NOW });
-  assert.equal(act.state, "idle");
-  assert.equal(act.session, null);
-  assert.equal(act.activity, "idle");
-});
-
-test("resolveActivity: nothing running → idle", () => {
-  const act = resolveActivity({ sessions: [], now: NOW });
-  assert.equal(act.state, "idle");
-  assert.equal(act.activity, "idle");
-  assert.equal(act.session, null);
-});
-
-test("countSubAgents: explicit override wins; injected liveClaudeStats used otherwise", () => {
-  assert.equal(countSubAgents({ subAgentsRunning: 3 }), 3);
-  assert.equal(countSubAgents({ liveClaudeStats: () => ({ count: 4, rssMB: 100 }) }), 4);
-  assert.equal(countSubAgents({ liveClaudeStats: () => { throw new Error("boom"); } }), 0);
-});
-
-test("detectClaudeAuth: logText override paths", () => {
-  assert.equal(detectClaudeAuth({ logText: "all good, session complete" }), "ok");
-  assert.equal(detectClaudeAuth({ logText: "Invalid API key provided" }), "relogin_required");
-  assert.equal(detectClaudeAuth({ logText: "" }), "unknown");
-});
-
-test("detectClaudeAuth: scans recent log files under agentRoot", () => {
-  const root = mkdtempSync(join(tmpdir(), "tel-auth-"));
-  try {
-    mkdirSync(join(root, "logs", "sessions"), { recursive: true });
-    writeFileSync(join(root, "logs", "sessions", "2026-06-12-sessions.jsonl"),
-      '{"msg":"oauth token has expired, please run claude login"}\n');
-    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW }), "relogin_required");
-
-    // A clean recent log → ok.
-    const root2 = mkdtempSync(join(tmpdir(), "tel-auth2-"));
-    mkdirSync(join(root2, "logs", "sessions"), { recursive: true });
-    writeFileSync(join(root2, "logs", "sessions", "2026-06-12-sessions.jsonl"), '{"msg":"ok"}\n');
-    assert.equal(detectClaudeAuth({ agentRoot: root2, now: NOW }), "ok");
-    rmSync(root2, { recursive: true, force: true });
-
-    // No logs at all → unknown.
-    const root3 = mkdtempSync(join(tmpdir(), "tel-auth3-"));
-    assert.equal(detectClaudeAuth({ agentRoot: root3, now: NOW }), "unknown");
-    rmSync(root3, { recursive: true, force: true });
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("collectMachine: derives memUsedPct + loadavg without powermetrics/df", async () => {
-  // memUsedPct now prefers macOS's memory_pressure, so "no external tools" has
-  // to include that one too — otherwise this test reads the REAL machine and
-  // asserts against the fake os, which is how it started failing.
-  const noTools = (cmd, args, opts, cb) => { cb(new Error("ENOENT")); return { on() {} }; };
-  const m = await collectMachine({ os: fakeOs({ totalmem: 10e9, freemem: 2e9, loadavg: [4, 2, 1], cpus: 4 }), execFile: noTools, powermetrics: false, disk: false });
-  assert.equal(m.memUsedPct, 80);
-  assert.deepEqual(m.loadavg, [4, 2, 1]);
-  assert.equal(m.cpuPct, 100); // load 4 / 4 cpus = 100%
-  assert.equal(m.tempC, undefined);
-  assert.equal(m.diskUsedPct, undefined);
-});
-
-test("parsePowermetrics + parseDf are tolerant pure parsers", () => {
-  const pm = parsePowermetrics("GPU die temperature: 45 C\nCPU die temperature: 72.5 C\nCPU idle residency: 90.0 %\n");
-  assert.equal(pm.tempC, 72.5);
-  assert.equal(pm.cpuPct, 10);
-  assert.deepEqual(parsePowermetrics("nonsense"), {});
-
-  assert.equal(parseDf("Filesystem blocks Used Avail Capacity Mounted\n/dev/x 100 88 12 88% /\n"), 88);
-  assert.equal(parseDf(""), undefined);
-});
-
-test("collectStatus never throws on a broken execFile / os", async () => {
-  const status = await collectStatus({
-    agentRoot: "/x",
-    now: NOW,
-    os: { loadavg: () => { throw new Error("x"); }, totalmem: () => { throw new Error("x"); }, freemem: () => 0, cpus: () => { throw new Error("x"); }, platform: () => "darwin" },
-    execFile: () => { throw new Error("exec boom"); },
-    subAgentsRunning: 0,
-  });
-  assert.ok(status && typeof status === "object");
-  assert.deepEqual(status.machine.loadavg, [0, 0, 0]);
-  assert.equal(status.machine.memUsedPct, 0);
-});
-
-test("execFileSafe resolves '' on a throwing exec impl (no reject)", async () => {
-  const out = await _internals.execFileSafe(() => { throw new Error("nope"); }, "x", [], 50);
-  assert.equal(out, "");
-});
-
-// ---------------------------------------------------------------------------
-// The Fleet telemetry vocabulary — the fields the hq Fleet row reads by name.
-//
-// These four (device / ram / uptimeDays / spend24h) were READ by
-// hq/src/components/fleet/machine.ts#buildFleetMachine and emitted by NOTHING,
-// while four others (loadavg / memUsedPct / cpuPct / diskUsedPct) were emitted
-// here and read by nothing. The intersection in production was EMPTY, so the
-// Fleet view em-dashed every hardware column on the one machine that was
-// genuinely alive. These tests pin the producer half of that contract.
-// ---------------------------------------------------------------------------
-
-const SP_HARDWARE = [
-  "Hardware:",
-  "    Hardware Overview:",
-  "      Model Name: Mac mini",
-  "      Model Identifier: Mac16,11",
-  "      Chip: Apple M4 Pro",
-  "      Total Number of Cores: 12 (8 performance and 4 efficiency)",
-  "      Memory: 24 GB",
-  "",
-].join("\n");
-
-test("collectMachine emits the INVENTORY the Fleet row reads: device, ram, cores", async () => {
-  const m = await collectMachine({
-    os: fakeOs({ totalmem: 24 * 1024 ** 3, freemem: 2e9, cpus: 12 }),
-    execFile: fakeExecFile({ "/usr/sbin/system_profiler": SP_HARDWARE }),
-    powermetrics: false,
-    disk: false,
-    spend: false,
-  });
-  assert.equal(m.device, "Mac mini M4 Pro");
-  assert.equal(m.ram, "24 GB");
-  assert.equal(m.cores, 12);
-});
-
-test("collectMachine falls back to node:os inventory when system_profiler yields nothing", async () => {
-  const m = await collectMachine({
-    os: {
-      loadavg: () => [1, 1, 1],
-      totalmem: () => 24 * 1024 ** 3,
-      freemem: () => 12 * 1024 ** 3,
-      cpus: () => new Array(12).fill({ model: "Apple M4 Pro" }),
-      platform: () => "darwin",
-      uptime: () => 0,
-    },
-    execFile: fakeExecFile({}), // system_profiler returns ""
-    powermetrics: false,
-    disk: false,
-    spend: false,
-  });
-  // Never nothing: node:os alone still proves the chip, the RAM and the cores.
-  assert.equal(m.device, "Apple M4 Pro");
-  assert.equal(m.ram, "24 GB");
-  assert.equal(m.cores, 12);
-});
-
-test("collectMachine emits uptimeDays", async () => {
-  const osImpl = fakeOs({});
-  osImpl.uptime = () => 5756923; // ~66.6 days
-  const m = await collectMachine({
-    os: osImpl, powermetrics: false, disk: false, inventory: false, spend: false,
-  });
-  assert.equal(m.uptimeDays, 66.6);
-});
-
-test("ramLabel renders binary GB the way the spec sheet does", () => {
-  assert.equal(ramLabel(24 * 1024 ** 3), "24 GB");
-  assert.equal(ramLabel(192 * 1024 ** 3), "192 GB");
-  assert.equal(ramLabel(8 * 1024 ** 3), "8 GB");
-  assert.equal(ramLabel(0), "");
-  assert.equal(ramLabel("nonsense"), "");
-});
-
-test("parseSystemProfilerHardware is a tolerant pure parser", () => {
-  assert.deepEqual(parseSystemProfilerHardware(SP_HARDWARE), {
-    device: "Mac mini M4 Pro",
-    ram: "24 GB",
-    cores: 12,
-  });
-  // Partial output degrades field-by-field rather than throwing.
-  assert.deepEqual(parseSystemProfilerHardware("      Memory: 16 GB\n"), { ram: "16 GB" });
-  assert.deepEqual(parseSystemProfilerHardware(""), {});
-  assert.deepEqual(parseSystemProfilerHardware(null), {});
-});
-
-// ---------------------------------------------------------------------------
-// tempC — the sampler bug, and the rule that a failure is never silent
-// ---------------------------------------------------------------------------
-
-test("powermetricsSamplers uses the arm64 spelling — 'smc' is Intel-only", () => {
-  // The shipped constant was "smc,cpu_power" unconditionally. On Apple Silicon
-  // powermetrics rejects that argument list outright and exits non-zero BEFORE
-  // the root check, so the probe was unreachable on every machine in the fleet.
-  assert.equal(powermetricsSamplers("arm64"), "thermal,cpu_power");
-  assert.equal(powermetricsSamplers("x64"), "smc,cpu_power");
-});
-
-test("collectPowermetrics passes the arch-correct sampler to the binary", async () => {
-  const seen = [];
-  const spy = (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    seen.push({ cmd, args });
-    queueMicrotask(() => cb(null, "CPU die temperature: 54.2 C\n", ""));
-    return { on() {} };
-  };
-  const pm = await collectPowermetrics({ execFile: spy, platform: "darwin", arch: "arm64" });
-  assert.equal(pm.tempC, 54.2);
-  assert.equal(pm.source, "powermetrics");
-  const samplerArg = seen[0].args[seen[0].args.indexOf("--samplers") + 1];
-  assert.equal(samplerArg, "thermal,cpu_power");
-  assert.ok(!samplerArg.includes("smc"), "must not send the Intel-only sampler to arm64");
-});
-
-test("collectPowermetrics ALWAYS says why it has no answer (fail-open, never silent)", async () => {
-  // The unprivileged reality on every seat: the probe yields nothing.
-  const pm = await collectPowermetrics({
-    execFile: fakeExecFile({}), platform: "darwin", arch: "arm64", sudoPowermetrics: false,
-  });
-  assert.equal(pm.tempC, undefined);
-  assert.match(pm.detail, /requires root/);
-  // It no longer tells the operator to edit sudoers to get a temperature. That
-  // advice was futile: powermetrics has no die temperature on Apple Silicon at
-  // ANY privilege level, so following it to the letter still yielded nothing.
-  assert.ok(!/TELEMETRY_SUDO_POWERMETRICS/.test(pm.detail));
-  assert.ok(!/sudoers/.test(pm.detail));
-
-  // A non-darwin host is a DIFFERENT absence and says so.
-  const linux = await collectPowermetrics({ platform: "linux" });
-  assert.match(linux.detail, /platform linux/);
-});
-
-test("collectMachine surfaces a thermal failure as a NOTE, never as the value", async () => {
-  const m = await collectMachine({
-    os: fakeOs({}),
-    execFile: fakeExecFile({}),
-    platform: "darwin",
-    arch: "arm64",
-    sudoPowermetrics: false,
-    disk: false,
-    inventory: false,
-    spend: false,
-  });
-  assert.equal(m.tempC, undefined);
-  assert.equal(m.tempSource, undefined);
-  assert.equal(m.thermalState, undefined);
-  assert.equal(typeof m.tempDetail, "string");
-  // The note must not blame the operator's sudoers file for a limitation of the
-  // hardware — that is the message this whole rewrite exists to delete.
-  assert.ok(!/sudoers/.test(m.tempDetail));
-  // And the cpuPct it DOES have is labelled as the estimate it is.
-  assert.equal(m.cpuSource, "loadavg");
-});
-
-test("collectPowermetrics tries the opt-in sudo path only when enabled", async () => {
-  const seen = [];
-  const spy = (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    seen.push(cmd);
-    // Only the sudo invocation yields.
-    const out = cmd === "/usr/bin/sudo" ? "CPU die temperature: 61.0 C\n" : "";
-    queueMicrotask(() => cb(null, out, ""));
-    return { on() {} };
-  };
-  const off = await collectPowermetrics({
-    execFile: spy, platform: "darwin", arch: "arm64", sudoPowermetrics: false,
-  });
-  assert.equal(off.tempC, undefined, "must not shell out to sudo unless asked");
-  assert.ok(!seen.includes("/usr/bin/sudo"));
-
-  seen.length = 0;
-  const on = await collectPowermetrics({
-    execFile: spy, platform: "darwin", arch: "arm64", sudoPowermetrics: true,
-  });
-  assert.equal(on.tempC, 61);
-  assert.equal(on.source, "sudo-powermetrics");
-  assert.ok(seen.includes("/usr/bin/sudo"));
-  // `-n` so a machine with no NOPASSWD rule fails instantly instead of hanging
-  // the beat on a password prompt nobody will ever see.
-  const sudoCall = seen.indexOf("/usr/bin/sudo");
-  assert.ok(sudoCall >= 0);
-});
-
-// ---------------------------------------------------------------------------
-// Thermal — real °C without root, and a coarse state word that never fails.
-//
-// Every test here stubs the exec seam. NOTHING in this file forks `swift`,
-// `powermetrics` or `pmset`; the probe's real output is pinned as fixture text.
-// ---------------------------------------------------------------------------
-
-/** Verbatim stdout of `swift lib/telemetry/thermal-probe.swift` on a Mac16,11. */
-const PROBE_OK = "thermalState=nominal\ntempC=60.76\ntempSensors=42\n";
-
-/** Verbatim `sudo powermetrics --samplers thermal` — note: NO temperature line. */
-const PM_THERMAL = [
-  "Machine model: Mac16,11",
-  "",
-  "**** Thermal pressure ****",
-  "",
-  "Current pressure level: Nominal",
-  "",
-].join("\n");
-
-/** Route stdout by binary, so a test can say which rung of the ladder answers. */
-const SWIFT = "/usr/bin/swift";
-const SUDO = "/usr/bin/sudo";
-const PMSET = "/usr/bin/pmset";
-
-test("collectThermal reads a REAL °C unprivileged, via the IOHID probe", async () => {
-  // The headline fix. powermetrics cannot produce a die temperature on Apple
-  // Silicon even as root; IOHIDEventSystem hands it over to any uid.
-  const seen = [];
-  const spy = (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    seen.push(cmd);
-    queueMicrotask(() => cb(null, cmd === SWIFT ? PROBE_OK : "", ""));
-    return { on() {} };
-  };
-  const th = await collectThermal({ execFile: spy, platform: "darwin", arch: "arm64" });
-  assert.equal(th.tempC, 60.76);
-  assert.equal(th.tempSource, "iohid");
-  assert.equal(th.thermalState, "nominal");
-  assert.equal(th.thermalSource, "processinfo");
-  // No root, no sudo, on the happy path.
-  assert.ok(!seen.includes(SUDO), "the °C path must never need sudo");
-  // The detail is an EXPLANATION riding alongside a real reading, not a
-  // substitute for one — the drawer prints the number and demotes this.
-  assert.equal(typeof th.detail, "string");
-  assert.match(th.detail, /IOHIDEventSystem/);
-});
-
-test("collectThermal falls back to the coarse STATE when there is no °C", async () => {
-  // The probe ran but the sensors gave nothing: state alone is still a useful,
-  // honest answer, and the field semantics say so rather than faking a number.
-  const spy = (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    queueMicrotask(() => cb(null, cmd === SWIFT ? "thermalState=serious\n" : "", ""));
-    return { on() {} };
-  };
-  const th = await collectThermal({ execFile: spy, platform: "darwin", arch: "arm64" });
-  assert.equal(th.tempC, undefined);
-  assert.equal(th.thermalState, "serious");
-  assert.equal(th.thermalSource, "processinfo");
-  assert.match(th.detail, /no numeric °C/);
-});
-
-test("collectThermal uses sudo powermetrics for PRESSURE only, and only when opted in", async () => {
-  const seen = [];
-  const spy = (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    seen.push(cmd);
-    // swift is absent on this host; sudo powermetrics answers.
-    queueMicrotask(() => cb(null, cmd === SUDO ? PM_THERMAL : "", ""));
-    return { on() {} };
-  };
-  const off = await collectThermal({
-    execFile: spy, platform: "darwin", arch: "arm64", sudoPowermetrics: false,
-  });
-  assert.ok(!seen.includes(SUDO), "must not shell out to sudo unless asked");
-  assert.equal(off.thermalState, undefined);
-
-  seen.length = 0;
-  const on = await collectThermal({
-    execFile: spy, platform: "darwin", arch: "arm64", sudoPowermetrics: true,
-  });
-  assert.ok(seen.includes(SUDO));
-  assert.equal(on.thermalState, "nominal");
-  assert.equal(on.thermalSource, "sudo-powermetrics");
-  // Root buys a pressure LEVEL and nothing more. If this ever starts asserting a
-  // tempC from powermetrics on arm64, the fixture is lying.
-  assert.equal(on.tempC, undefined);
-  assert.match(on.detail, /pressure/i);
-});
-
-test("collectThermal will NOT dress 'no thermal events on record' up as a live reading", async () => {
-  // `pmset -g therm` on a healthy Mac reports history, not temperature. Calling
-  // that "nominal" would be inventing a measurement nobody took.
-  const spy = (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    const out = cmd === PMSET ? "Note: No thermal warning level has been recorded\n" : "";
-    queueMicrotask(() => cb(null, out, ""));
-    return { on() {} };
-  };
-  const th = await collectThermal({ execFile: spy, platform: "darwin", arch: "arm64" });
-  assert.equal(th.thermalState, undefined);
-  assert.equal(th.tempC, undefined);
-  assert.match(th.detail, /xcode-select --install/);
-
-  // But a REAL throttle event — a speed limit below 100 — is a live signal.
-  const throttling = (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    const out = cmd === PMSET ? "CPU_Speed_Limit \t= 60\n" : "";
-    queueMicrotask(() => cb(null, out, ""));
-    return { on() {} };
-  };
-  const hot = await collectThermal({ execFile: throttling, platform: "darwin", arch: "arm64" });
-  assert.equal(hot.thermalState, "serious");
-  assert.equal(hot.thermalSource, "pmset");
-});
-
-test("parseThermalProbe rejects the sensor that lies (-9201.14 °C)", () => {
-  // `PMU tdev2` returns garbage on real hardware. The probe filters it, and the
-  // collector band-checks AGAIN — trusting a subprocess's arithmetic is how an
-  // absurd number reaches a dashboard.
-  assert.deepEqual(parseThermalProbe("thermalState=nominal\ntempC=-9201.14\n"), {
-    thermalState: "nominal",
-  });
-  assert.equal(parseThermalProbe("tempC=900\n").tempC, undefined);
-  assert.equal(parseThermalProbe("tempC=61.2\n").tempC, 61.2);
-  // Unknown keys are ignored so the probe can grow a field without breaking us.
-  assert.equal(parseThermalProbe("tempC=61.2\nfuture=x\n").tempC, 61.2);
-  assert.deepEqual(parseThermalProbe(""), {});
-  assert.deepEqual(parseThermalProbe(null), {});
-  // Only the four real levels are accepted.
-  assert.equal(parseThermalProbe("thermalState=toasty\n").thermalState, undefined);
-});
-
-test("parseThermalPressure reads the only thermal fact powermetrics has on arm64", () => {
-  assert.equal(parseThermalPressure(PM_THERMAL), "nominal");
-  assert.equal(parseThermalPressure("Current pressure level: Critical"), "critical");
-  assert.equal(parseThermalPressure("no such block"), undefined);
-  assert.equal(parseThermalPressure(""), undefined);
-});
-
-test("parsePowermetrics computes CPU% from the PER-CLUSTER arm64 shape", () => {
-  // The old regex wanted a bare `CPU idle residency:` line. Apple Silicon never
-  // prints one — only per-core and per-cluster lines — so on every seat in the
-  // fleet this silently fell through and then blamed the operator's sudoers.
-  const arm = [
-    "**** Processor usage ****",
-    "E-Cluster idle residency:  78.34%",
-    "CPU 0 idle residency:  90.00%",
-    "CPU 1 idle residency:  80.00%",
-    "CPU 2 idle residency:  70.00%",
-    "CPU 3 idle residency:  60.00%",
-  ].join("\n");
-  const parsed = parsePowermetrics(arm);
-  assert.equal(parsed.cpuPct, 25); // 100 - mean(90,80,70,60)
-  // The Intel/total shape still wins outright where it exists.
-  assert.equal(parsePowermetrics("CPU Average idle residency: 78.0 %").cpuPct, 22);
-});
-
-test("collectMachine ships tempC + thermalState + the note TOGETHER", async () => {
-  // The old collector made the reading and the explanation MUTUALLY EXCLUSIVE
-  // (`else if`), which left hq with nothing to put in the value slot — so it
-  // printed a 118-character sudoers sentence in a column of "62°C" and "41%".
-  const spy = (cmd, args, optsOrCb, maybeCb) => {
-    const cb = typeof optsOrCb === "function" ? optsOrCb : maybeCb;
-    queueMicrotask(() => cb(null, cmd === SWIFT ? PROBE_OK : "", ""));
-    return { on() {} };
-  };
-  const m = await collectMachine({
-    os: fakeOs({}),
-    execFile: spy,
-    platform: "darwin",
-    arch: "arm64",
-    sudoPowermetrics: false,
-    disk: false,
-    inventory: false,
-    spend: false,
-  });
-  assert.equal(m.tempC, 60.8); // round1
-  assert.equal(m.tempSource, "iohid");
-  assert.equal(m.thermalState, "nominal");
-  assert.equal(m.thermalSource, "processinfo");
-  assert.equal(typeof m.tempDetail, "string");
-});
-
-// ---------------------------------------------------------------------------
-// spend24h
-// ---------------------------------------------------------------------------
-
-test("collectSpend24h sums BILLABLE rows in a true rolling 24h window", () => {
-  const root = mkdtempSync(join(tmpdir(), "spend-"));
-  try {
-    const dir = join(root, "state", "cost-tracking");
-    mkdirSync(dir, { recursive: true });
-    const now = Date.parse("2026-08-13T06:00:00Z");
-    const row = (ts, cost) => JSON.stringify({
-      ts, model: "claude-opus-4-5", input_tokens: 10, output_tokens: 5, total_cost_usd: cost,
-    });
-    // Yesterday's file: one row inside the window, one outside it.
-    writeFileSync(join(dir, "2026-08-12.jsonl"), [
-      row("2026-08-12T05:00:00Z", 1.5),  // 25h ago — OUTSIDE
-      row("2026-08-12T07:00:00Z", 2.25), // 23h ago — inside
-    ].join("\n") + "\n");
-    writeFileSync(join(dir, "2026-08-13.jsonl"), [
-      row("2026-08-13T01:00:00Z", 0.75),
-      // A non-LLM attribution row: $0 is a FACT (no model ran), not an absence.
-      JSON.stringify({ ts: "2026-08-13T02:00:00Z", model: null, task_class: "messaging.send", total_cost_usd: null, estimated_usd: 0 }),
-    ].join("\n") + "\n");
-
-    assert.equal(collectSpend24h({ agentRoot: root, now }), 3);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("collectSpend24h: no ledger is UNDEFINED, not a confident zero", () => {
-  assert.equal(collectSpend24h({ agentRoot: "/nonexistent-root-xyz" }), undefined);
-  assert.equal(collectSpend24h({}), undefined);
-});
-
-test("collectSpend24h does not count an UNMEASURED row as free", () => {
-  const root = mkdtempSync(join(tmpdir(), "spend2-"));
-  try {
-    const dir = join(root, "state", "cost-tracking");
-    mkdirSync(dir, { recursive: true });
-    const now = Date.parse("2026-08-13T06:00:00Z");
-    writeFileSync(join(dir, "2026-08-13.jsonl"), [
-      // measurement:"unknown" → billableUsd().usd === null. Skipped, not zeroed.
-      JSON.stringify({ ts: "2026-08-13T01:00:00Z", model: "claude-opus-4-5", measurement: "unknown", input_tokens: null, output_tokens: null, total_cost_usd: null }),
-      JSON.stringify({ ts: "2026-08-13T02:00:00Z", model: "claude-opus-4-5", input_tokens: 1, output_tokens: 1, total_cost_usd: 4.5 }),
-      "{ not json",
-    ].join("\n") + "\n");
-    assert.equal(collectSpend24h({ agentRoot: root, now }), 4.5);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("collectStatus ships the FULL machine vocabulary the Fleet row reads", async () => {
-  const root = mkdtempSync(join(tmpdir(), "vocab-"));
-  try {
-    const osImpl = fakeOs({ totalmem: 24 * 1024 ** 3, freemem: 1e9, loadavg: [1.26, 1.2, 1.08], cpus: 12 });
-    osImpl.uptime = () => 5756923;
-    const status = await collectStatus({
-      agentRoot: root,
-      now: Date.parse("2026-08-13T06:00:00Z"),
-      os: osImpl,
-      arch: "arm64",
-      sudoPowermetrics: false,
-      execFile: fakeExecFile({
-        "/usr/sbin/system_profiler": SP_HARDWARE,
-        "/bin/df": "Filesystem 1024-blocks Used Available Capacity Mounted\n/dev/disk1 100 47 53 47% /\n",
-      }),
-      subAgentsRunning: 0,
-    });
-    const m = status.machine;
-    // The five keys hq reads that this collector used to emit NONE of.
-    assert.equal(m.device, "Mac mini M4 Pro");
-    assert.equal(m.ram, "24 GB");
-    assert.equal(m.uptimeDays, 66.6);
-    assert.equal(typeof m.tempDetail, "string"); // tempC needs root; the REASON ships
-    // The four it emitted that hq used to read NONE of.
-    assert.deepEqual(m.loadavg, [1.26, 1.2, 1.08]);
-    assert.ok(m.memUsedPct > 90);
-    assert.equal(typeof m.cpuPct, "number");
-    assert.equal(m.diskUsedPct, 47);
-    assert.equal(m.cpuSource, "loadavg");
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// memUsedPct — pressure, not occupancy
-//
-// This was `1 - os.freemem()/os.totalmem()`, which is not a pressure measure on
-// macOS: os.freemem() counts only entirely-free pages, and macOS keeps nearly
-// all RAM occupied with file cache, purgeable and compressed pages that are
-// reclaimable on demand. Measured on a healthy idle Mac mini M4 Pro at one
-// instant: os.freemem() → 99.2% "used", memory_pressure → 68% free. The seat
-// showed a standing CRITICAL while the watchdog, reading memory_pressure,
-// correctly did nothing.
-// ---------------------------------------------------------------------------
-
-test("memUsedPct comes from memory_pressure, not from free/total", async () => {
-  const seen = [];
-  const execFile = (cmd, args, opts, cb) => {
-    seen.push(cmd);
-    if (cmd === "/usr/bin/memory_pressure") {
-      cb(null, "System-wide memory free percentage: 68%\n");
-    } else {
-      cb(new Error("not stubbed"));
-    }
-    return { on() {} };
-  };
-  // An os whose free/total ratio would say 99% used — the old, wrong answer.
-  const osImpl = {
-    loadavg: () => [1, 1, 1],
-    totalmem: () => 24 * 1024 ** 3,
-    freemem: () => 0.2 * 1024 ** 3,
-    cpus: () => [],
-    uptime: () => 3600,
-  };
-
-  const m = await collectMachine({ execFile, os: osImpl, platform: "darwin" });
-
-  assert.equal(m.memUsedPct, 32, "100 - 68 free, i.e. what the watchdog thresholds on");
-  assert.notEqual(m.memUsedPct, 99, "the free/total ratio must not be the answer on darwin");
-  assert.ok(seen.includes("/usr/bin/memory_pressure"), "memory_pressure is consulted");
-});
-
-test("memUsedPct falls back to free/total when memory_pressure yields nothing", async () => {
-  // Linux, or a macOS where the binary is missing/erroring. There the ratio
-  // does mean what it says, so a fallback is right — silence is not.
-  const execFile = (cmd, args, opts, cb) => { cb(new Error("ENOENT")); return { on() {} }; };
-  const osImpl = {
-    loadavg: () => [0, 0, 0],
-    totalmem: () => 1000,
-    freemem: () => 250,
-    cpus: () => [],
-    uptime: () => 1,
-  };
-
-  const m = await collectMachine({ execFile, os: osImpl, platform: "darwin" });
-  assert.equal(m.memUsedPct, 75, "1 - 250/1000");
-});
-
-test("memUsedPct ignores an out-of-range memory_pressure reading", async () => {
-  const execFile = (cmd, args, opts, cb) => {
-    cb(null, "System-wide memory free percentage: 8000%\n");
-    return { on() {} };
-  };
-  const osImpl = {
-    loadavg: () => [0, 0, 0],
-    totalmem: () => 1000,
-    freemem: () => 400,
-    cpus: () => [],
-    uptime: () => 1,
-  };
-
-  const m = await collectMachine({ execFile, os: osImpl, platform: "darwin" });
-  assert.equal(m.memUsedPct, 60, "a nonsense percentage falls back rather than propagating");
-});
-
-// ---------------------------------------------------------------------------
-// Fleet identity + front door (§3.8): hostname / tailnetIp / sdkVersion ride
-// the inventory; machine.frontDoor + machine.sessionLive come off the main
-// session's heartbeat file. This is how a fleet-wide upgrade is verified.
-//
-// WHY `machine` and not `session`: hq's presence.beat validator is
-// `session: z.object({id,taskClass,model}).strict()` — an unknown key there
-// rejects the WHOLE beat (BAD_REQUEST before any write) and the seat drops out
-// of the mesh. `machine` is `z.record(z.unknown())` by design, so a new field
-// lands the moment the daemon emits it. `session` stays `null` when no work
-// session runs — consumers read null as "no work session", and that contract
-// is pinned here.
-// ---------------------------------------------------------------------------
-
-test("collectInventory emits hostname, tailnetIp (tailscale ip -4) and sdkVersion", async () => {
-  const osImpl = fakeOs({ cpus: 12, totalmem: 24 * 1024 ** 3 });
-  osImpl.hostname = () => "ethans-mac-mini.local";
-  const inv = await collectInventory({
-    os: osImpl,
-    execFile: fakeExecFile({ "/usr/sbin/system_profiler": SP_HARDWARE, tailscale: "100.95.116.68\n" }),
-    sdkVersion: "2.12.0",
-  });
-  assert.equal(inv.hostname, "ethans-mac-mini.local");
-  assert.equal(inv.tailnetIp, "100.95.116.68");
-  assert.equal(inv.sdkVersion, "2.12.0");
-  assert.equal(inv.device, "Mac mini M4 Pro");
-});
-
-test("collectInventory falls back to the Tailscale.app binary and is fail-open without any", async () => {
-  const osImpl = fakeOs({});
-  osImpl.hostname = () => "h";
-  const appBin = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
-  const viaApp = await collectInventory({
-    os: osImpl, sdkVersion: "x",
-    execFile: fakeExecFile({ [appBin]: "100.68.98.127\nfd7a::1\n" }),
-    inventoryCache: false,
-  });
-  assert.equal(viaApp.tailnetIp, "100.68.98.127");
-  const none = await collectInventory({ os: osImpl, sdkVersion: "x", execFile: fakeExecFile({}), inventoryCache: false });
-  assert.equal(none.tailnetIp, undefined, "no tailscale → the field drops out, nothing throws");
-  assert.equal(none.hostname, "h");
-});
-
-test("sdkVersion is read from the installed @cohortapp/agent-sdk package.json, not from the cache", async () => {
-  const root = mkdtempSync(join(tmpdir(), "inv-sdk-"));
-  try {
-    const osImpl = fakeOs({});
-    osImpl.hostname = () => "h";
-    const first = await collectInventory({ agentRoot: root, os: osImpl, execFile: fakeExecFile({}), sdkVersion: "2.11.17" });
-    assert.equal(first.sdkVersion, "2.11.17");
-    // Same chip/RAM key → the device inventory is served from the cache, but the
-    // version (which an autoupdate changes without touching the hardware) and
-    // the tailnet IP are re-read every time.
-    const second = await collectInventory({ agentRoot: root, os: osImpl, execFile: fakeExecFile({ tailscale: "100.1.1.1\n" }), sdkVersion: "2.12.0" });
-    assert.equal(second.sdkVersion, "2.12.0");
-    assert.equal(second.tailnetIp, "100.1.1.1");
-    assert.equal(second.hostname, "h");
-    // The real resolver: this checkout IS the SDK, so it reports its own version.
-    const real = _internals.readSdkVersion();
-    assert.match(real, /^\d+\.\d+\.\d+/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("sessionLiveness: a heartbeat younger than 90 s is live; older, missing or malformed is not", () => {
-  const { sessionLiveness } = _internals;
-  const now = Date.parse("2026-09-08T12:00:00Z");
-  assert.deepEqual(sessionLiveness({ ts: "2026-09-08T11:59:30Z", pid: 1, sessionId: "s" }, now), { frontDoor: "session", sessionLive: true });
-  assert.deepEqual(sessionLiveness({ ts: "2026-09-08T11:58:29Z" }, now), { frontDoor: "session", sessionLive: false });
-  assert.deepEqual(sessionLiveness({ ts: now - 89_000 }, now), { frontDoor: "session", sessionLive: true });
-  assert.deepEqual(sessionLiveness(null, now), { frontDoor: "daemon", sessionLive: false });
-  assert.deepEqual(sessionLiveness({ ts: "not a date" }, now), { frontDoor: "session", sessionLive: false });
-  assert.deepEqual(sessionLiveness({ ts: "2026-09-08T11:59:30Z" }, now, { staleMs: 10_000 }), { frontDoor: "session", sessionLive: false });
-});
-
-test("collectStatus: machine carries frontDoor + sessionLive from state/session/heartbeat.json; session stays null when idle", async () => {
-  const root = mkdtempSync(join(tmpdir(), "front-door-"));
-  try {
-    const now = Date.parse("2026-09-08T12:00:00Z");
-    const osImpl = fakeOs({});
-    osImpl.hostname = () => "seat.local";
-    const base = { agentRoot: root, now, os: osImpl, execFile: fakeExecFile({}), subAgentsRunning: 0, powermetrics: false, disk: false, spend: false };
-    // No heartbeat file: the daemon is the front door. No work session → null.
-    const noHb = await collectStatus(base);
-    assert.equal(noHb.machine.frontDoor, "daemon");
-    assert.equal(noHb.machine.sessionLive, false);
-    assert.equal(noHb.session, null, "an idle seat beats session: null (hq's strict session schema; activity.mjs reads null as 'no work session')");
-    // Fresh heartbeat → live main session.
-    mkdirSync(join(root, "state", "session"), { recursive: true });
-    writeFileSync(join(root, "state", "session", "heartbeat.json"), JSON.stringify({ pid: 4242, sessionId: "abc", name: "ethan-main", ts: "2026-09-08T11:59:50Z" }));
-    const live = await collectStatus(base);
-    assert.equal(live.machine.frontDoor, "session");
-    assert.equal(live.machine.sessionLive, true);
-    assert.equal(live.session, null);
-    // Stale (> 90 s) → not live, but the front door is still the session job.
-    writeFileSync(join(root, "state", "session", "heartbeat.json"), JSON.stringify({ pid: 4242, ts: "2026-09-08T11:50:00Z" }));
-    const stale = await collectStatus(base);
-    assert.equal(stale.machine.frontDoor, "session");
-    assert.equal(stale.machine.sessionLive, false);
-    // A running work session keeps EXACTLY the keys hq's strict validator knows.
-    const busy = await collectStatus({ ...base, sessions: [{ sessionId: "s1", kind: "interactive", intent: "session: inbox", model: "sonnet", lastBeat: "2026-09-08T11:59:55Z" }] });
-    assert.equal(busy.session.id, "s1");
-    assert.equal(busy.session.taskClass, "inbox");
-    const allowed = new Set(["id", "taskClass", "model"]);
-    for (const k of Object.keys(busy.session)) assert.ok(allowed.has(k), `session.${k} would be rejected by hq's strict presence.beat schema`);
-    assert.equal(busy.machine.frontDoor, "session");
-    // Inventory identity rides machine.
-    assert.equal(typeof live.machine.hostname, "string");
-    assert.match(live.machine.sdkVersion, /^\d+\.\d+\.\d+/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("detectClaudeAuth: in subscription mode the shared probe decides; logs still win for relogin", () => {
-  const root = mkdtempSync(join(tmpdir(), "auth-probe-"));
-  try {
-    writeFileSync(join(root, ".env"), "CLAUDE_CODE_OAUTH_TOKEN=t\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n");
-    const calls = [];
-    // An UNVERIFIED "ok" (the CLI merely reports a login — it says loggedIn for
-    // any token value) must not flip the beat from unknown to ok: that is the
-    // one state claudeAuth exists to catch. Only a verified ok is an ok.
-    const probeClaude = (agentRoot) => { calls.push(agentRoot); return { ok: true, mode: "subscription", auth: "ok", verified: false, name: "x" }; };
-    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: {} }), "unknown", "reported-not-verified ok + no logs → unknown, as before the probe existed");
-    assert.deepEqual(calls, [root]);
-    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, env: {}, probeClaude: () => ({ ok: true, auth: "ok", verified: true }) }), "ok");
-    // The probe says relogin → relogin, even with no logs at all.
-    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, env: {}, probeClaude: () => ({ ok: false, auth: "relogin_required" }) }), "relogin_required");
-    // Probe unknown → fall back to what the logs say (nothing here → unknown).
-    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, env: {}, probeClaude: () => ({ ok: true, auth: "unknown" }) }), "unknown");
-    // Clean recent logs + an unverified ok → ok (the logs are the evidence, as before).
-    mkdirSync(join(root, "logs", "sessions"), { recursive: true });
-    const p = join(root, "logs", "sessions", "s.log");
-    writeFileSync(p, "spawn ok, 3 turns, done");
-    const t = new Date(NOW - 60_000);
-    utimesSync(p, t, t);
-    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: {} }), "ok");
-    // A recent relogin fingerprint in the logs wins over a probe that says ok.
-    writeFileSync(p, "… OAuth token has expired …");
-    utimesSync(p, t, t);
-    assert.equal(detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: {} }), "relogin_required");
-    // Not in subscription mode → the probe is never forked from the beat.
-    writeFileSync(join(root, ".env"), "ANTHROPIC_API_KEY=sk\n");
-    const before = calls.length;
-    detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: {} });
-    assert.equal(calls.length, before);
-    // A token only in the daemon's ambient env (launchd) is subscription mode too
-    // (clean logs first — a relogin fingerprint decides before any probe runs).
-    writeFileSync(p, "spawn ok"); utimesSync(p, t, t);
-    writeFileSync(join(root, ".env"), "");
-    detectClaudeAuth({ agentRoot: root, now: NOW, probeClaude, env: { CLAUDE_CODE_OAUTH_TOKEN: "t" } });
-    assert.equal(calls.length, before + 1);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-// ---------------------------------------------------------------------------
-// Last upgrade outcome (WP-M6): machine.upgrade = {at, from, to, ok} from
-// state/autoupdate/last.json — fail-open, absent until a first attempt.
-// ---------------------------------------------------------------------------
-
-test("upgradeSummary: the four fleet-view fields from autoupdate's last.json; malformed → null", () => {
-  const { upgradeSummary } = _internals;
-  assert.deepEqual(
-    upgradeSummary({ from: "2.11.17", to: "2.12.0", at: "2026-09-08T12:00:00Z", ok: true, healthy: true, reason: "" }),
-    { at: "2026-09-08T12:00:00Z", from: "2.11.17", to: "2.12.0", ok: true },
-  );
-  assert.deepEqual(
-    upgradeSummary({ from: "2.11.17", to: "2.12.0", at: "2026-09-08T12:00:00Z", ok: false, healthy: true, reason: "unhealthy-rolled-back" }),
-    { at: "2026-09-08T12:00:00Z", from: "2.11.17", to: "2.12.0", ok: false },
-  );
-  assert.equal(upgradeSummary(null), null);
-  assert.equal(upgradeSummary({ ok: true }), null, "no at/to → nothing to report");
-  assert.equal(upgradeSummary("2.12.0"), null);
-});
-
-test("collectStatus: machine.upgrade rides the beat when state/autoupdate/last.json exists, and is absent (not null) when it does not or is corrupt", async () => {
-  const root = mkdtempSync(join(tmpdir(), "tel-upgrade-"));
-  try {
-    const base = { agentRoot: root, os: fakeOs(), execFile: fakeExecFile({}), powermetrics: false, disk: false, spend: false, inventory: false, tailnet: false, sdkVersion: "2.12.0", withAlerts: false, now: Date.parse("2026-09-08T12:00:00Z") };
-    const none = await collectStatus(base);
-    assert.ok(!("upgrade" in none.machine), "absent until a first autoupdate attempt");
-
-    mkdirSync(join(root, "state", "autoupdate"), { recursive: true });
-    writeFileSync(join(root, "state", "autoupdate", "last.json"), JSON.stringify({ from: "2.11.17", to: "2.12.0", at: "2026-09-08T11:30:00Z", ok: true, healthy: true, reason: "" }));
-    const some = await collectStatus(base);
-    assert.deepEqual(some.machine.upgrade, { at: "2026-09-08T11:30:00Z", from: "2.11.17", to: "2.12.0", ok: true });
-    assert.equal(some.session, null, "nothing new lands on the strictly-validated session object");
-
-    writeFileSync(join(root, "state", "autoupdate", "last.json"), "{not json");
-    const corrupt = await collectStatus(base);
-    assert.ok(!("upgrade" in corrupt.machine));
-
-    const injected = await collectStatus({ ...base, autoupdateLast: { from: "1", to: "2", at: "2026-09-08T00:00:00Z", ok: false } });
-    assert.equal(injected.machine.upgrade.ok, false);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-// ---------------------------------------------------------------------------
-// machine.sessionNote (WP-M8) — WHY the front door is not live
-// ---------------------------------------------------------------------------
-
-const M8_NOW = Date.parse("2026-09-11T12:00:00Z");
-/** The record scripts/session/supervisor.mjs writes via first-run#attentionRecord. */
-const attention = (over = {}) => ({
-  reason: "no-heartbeat",
-  since: "2026-09-11T11:57:00.000Z",
-  runMs: 180_000,
-  attach: "tmux attach -t =maestro-maya",
-  hint: "The session has been up 180 s without a heartbeat — it is probably waiting on a first-run dialog or a permission prompt. Attach with `tmux attach -t =maestro-maya` and answer it.",
-  ...over,
-});
-
-test("sessionNote: a live front door says nothing at all", () => {
-  const { sessionNote } = _internals;
-  assert.equal(sessionNote({ heartbeat: { ts: M8_NOW - 1_000 }, now: M8_NOW }), null);
-  assert.equal(sessionNote({ heartbeat: { ts: M8_NOW - 89_000 }, jobInstalled: false, attention: attention(), now: M8_NOW }), null,
-    "liveness wins over every other input — the note exists only to explain a door that is NOT open");
-  // A shorter staleness bound makes the same beat stale, and then it does speak.
-  assert.equal(sessionNote({ heartbeat: { ts: M8_NOW - 30_000 }, jobInstalled: true, now: M8_NOW, staleMs: 10_000 }).reason, "heartbeat-stale");
-});
-
-test("sessionNote: job-absent — no plist for this seat, and only ever from a hard false", () => {
-  const { sessionNote } = _internals;
-  const n = sessionNote({ jobInstalled: false, label: "ai.maestro.maya-session", now: M8_NOW });
-  assert.equal(n.reason, "job-absent");
-  assert.match(n.detail, /ai\.maestro\.maya-session/);
-  assert.equal(n.since, undefined, "there is no moment to date — the job was never there");
-  // It outranks a stale attention record left behind by a previous install.
-  assert.equal(sessionNote({ jobInstalled: false, attention: attention(), heartbeat: { ts: M8_NOW - 600_000 }, now: M8_NOW }).reason, "job-absent");
-  // UNKNOWN is not absent: a home we could not read must never accuse the seat.
-  assert.equal(sessionNote({ jobInstalled: null, now: M8_NOW }).reason, "never-beaten");
-  assert.equal(sessionNote({ now: M8_NOW }).reason, "never-beaten");
-  // No label still yields a usable line.
-  assert.match(sessionNote({ jobInstalled: false, now: M8_NOW }).detail, /main-session launchd job/);
-  // …and it does not call a deliberate daemon-front-door seat broken: this seat
-  // reports job-absent on EVERY beat forever, so the line states a configuration.
-  assert.match(n.detail, /the daemon --print lane is the front door/);
-  assert.match(n.detail, /by configuration, or the session job was never installed/);
-});
-
-test("sessionNote: awaiting-input passes the supervisor's own reason, since and hint through", () => {
-  const { sessionNote } = _internals;
-  const n = sessionNote({ jobInstalled: true, attention: attention(), now: M8_NOW });
-  assert.equal(n.reason, "awaiting-input", "the beat's vocabulary — the record's own reason rides in detail");
-  assert.equal(n.since, "2026-09-11T11:57:00.000Z", "attentionRecord.since, normalised to canonical ISO");
-  assert.match(n.detail, /^up, never beaten: /, "the record's own reason survives, rendered out of the watchdog's vocabulary");
-  assert.match(n.detail, /tmux attach -t =maestro-maya/, "the attach command is the actionable part");
-  assert.ok(n.detail.length <= 200);
-  // screen seats say screen.
-  assert.match(sessionNote({ attention: attention({ attach: "screen -r maestro-isla", hint: "… Attach with `screen -r maestro-isla` and answer it." }), now: M8_NOW }).detail, /screen -r maestro-isla/);
-  // It outranks a stale heartbeat: "waiting on a human" is the actionable fact.
-  assert.equal(sessionNote({ jobInstalled: true, attention: attention(), heartbeat: { ts: M8_NOW - 600_000 }, now: M8_NOW }).reason, "awaiting-input");
-});
-
-test("sessionNote: a heartbeat LATER than the attention record supersedes it", () => {
-  const { sessionNote } = _internals;
-  // supervisor.mjs clears attention.json only at the START of the next launch —
-  // never when the human answers the dialog — so the record outlives its truth.
-  // Answered at 11:57, beat until 3 days later, then the session died.
-  const beat = M8_NOW + 3 * 86_400_000;
-  const n = sessionNote({ jobInstalled: true, attention: attention(), heartbeat: { ts: beat }, now: beat + 86_400_000 });
-  assert.equal(n.reason, "heartbeat-stale", "a days-old attach command for a mux session that ended is worse than no note");
-  assert.equal(n.since, new Date(beat).toISOString());
-  // A record with no orderable `since` loses to a heartbeat that has one.
-  assert.equal(sessionNote({ jobInstalled: true, attention: attention({ since: "not a date" }), heartbeat: { ts: M8_NOW - 600_000 }, now: M8_NOW }).reason, "heartbeat-stale");
-  // But the record still wins while it is the LATER fact — the ordinary case:
-  // the session came up, never beat, and the watchdog flagged it.
-  assert.equal(sessionNote({ jobInstalled: true, attention: attention(), heartbeat: { ts: M8_NOW - 600_000 }, now: M8_NOW }).reason, "awaiting-input");
-  // …and with no heartbeat at all there is nothing to supersede it.
-  assert.equal(sessionNote({ jobInstalled: true, attention: attention(), heartbeat: { pid: 7 }, now: M8_NOW }).reason, "awaiting-input");
-});
-
-test("sessionNote: `since` is re-formatted from a parsed instant, never passed through", () => {
-  const { sessionNote } = _internals;
-  // V8's legacy date parser accepts trailing prose, so a bare Date.parse check
-  // let a home path and a token-shaped run ride the one field the detail
-  // sanitiser does not cover. `since` is canonical ISO or it is absent.
-  const evil = "Thu, 01 Jan 2026 00:00:00 GMT (token sk-ant-supersecretvalue1234567890 /Users/maya/x)";
-  assert.ok(Number.isFinite(Date.parse(evil)), "the hostile string really does parse — that is the hazard");
-  const n = sessionNote({ jobInstalled: true, attention: attention({ since: evil }), now: M8_NOW });
-  assert.equal(n.since, "2026-01-01T00:00:00.000Z");
-  assert.ok(!/Users|sk-ant/.test(n.since));
-  // Non-ISO spellings are normalised rather than echoed.
-  assert.equal(sessionNote({ jobInstalled: true, attention: attention({ since: "2026-09-11T11:57:00+00:00" }), now: M8_NOW }).since, "2026-09-11T11:57:00.000Z");
-});
-
-test("sessionNote: the attention record's own vocabulary is rendered, not collided with", () => {
-  const { sessionNote } = _internals;
-  // first-run#heartbeatSilence's "no-heartbeat" means "up, never beaten" — the
-  // opposite of what a beat reason of nearly that spelling would mean. Rendering
-  // it keeps `{reason, detail}` from reading as a contradiction side by side.
-  assert.match(sessionNote({ jobInstalled: true, attention: attention(), now: M8_NOW }).detail, /^up, never beaten: /);
-  assert.match(sessionNote({ jobInstalled: true, attention: attention({ reason: "stale-heartbeat" }), now: M8_NOW }).detail, /^no beat since this launch: /);
-  // A word we do not know passes through verbatim rather than being invented.
-  assert.match(sessionNote({ jobInstalled: true, attention: attention({ reason: "wedged-mcp" }), now: M8_NOW }).detail, /^wedged-mcp: /);
-  // And no beat reason collides with a watchdog reason any more.
-  const beatReasons = new Set(["job-absent", "awaiting-input", "heartbeat-stale", "heartbeat-unreadable", "never-beaten"]);
-  for (const r of ["no-heartbeat", "stale-heartbeat", "within-grace", "beating"]) assert.ok(!beatReasons.has(r), `${r} is the watchdog's word, not the beat's`);
-});
-
-test("sessionNote: heartbeat-stale carries the last beat and its age", () => {
-  const { sessionNote } = _internals;
-  const n = sessionNote({ jobInstalled: true, heartbeat: { ts: M8_NOW - 600_000, pid: 4242 }, now: M8_NOW });
-  assert.deepEqual(n, { reason: "heartbeat-stale", since: "2026-09-11T11:50:00.000Z", detail: "no beat for 600 s" });
-  // ISO timestamps are the shape the feed actually writes.
-  assert.equal(sessionNote({ jobInstalled: true, heartbeat: { ts: "2026-09-11T11:50:00Z" }, now: M8_NOW }).since, "2026-09-11T11:50:00.000Z");
-  // A beat from the future is clock skew, not a negative age.
-  assert.equal(sessionNote({ jobInstalled: true, heartbeat: { ts: M8_NOW + 600_000 }, now: M8_NOW }).detail, "last beat is in the future (clock skew)");
-});
-
-test("sessionNote: every malformed input degrades to a coarser note or to null, and nothing throws", () => {
-  const { sessionNote } = _internals;
-  // No `now` at all → no note (a note with no clock behind it would be a guess).
-  assert.equal(sessionNote({ heartbeat: { ts: 1 } }), null);
-  assert.equal(sessionNote({ now: NaN, jobInstalled: false }), null);
-  assert.equal(sessionNote(), null);
-  assert.equal(sessionNote(null), null);
-  assert.equal(sessionNote("nonsense"), null);
-  // Absent files (the reader's null) → the installed-but-silent note.
-  assert.deepEqual(sessionNote({ heartbeat: null, attention: null, jobInstalled: true, now: M8_NOW }),
-    { reason: "never-beaten", detail: "the session job is installed but has never written a heartbeat" });
-  // …and when job presence was never established, the note says THAT rather
-  // than affirming an installation nobody checked.
-  assert.deepEqual(sessionNote({ jobInstalled: null, now: M8_NOW }),
-    { reason: "never-beaten", detail: "no heartbeat from the session job, and its presence on this seat could not be checked" });
-  assert.equal(sessionNote({ now: M8_NOW }).detail, "no heartbeat from the session job, and its presence on this seat could not be checked");
-  // A parsed-but-wrong SHAPE must not throw.
-  assert.equal(sessionNote({ heartbeat: "{}", attention: "{}", now: M8_NOW }).reason, "never-beaten");
-  assert.equal(sessionNote({ heartbeat: [], attention: [], jobInstalled: true, now: M8_NOW }).reason, "never-beaten", "arrays are not records");
-  // A heartbeat file that is THERE but says nothing usable is its own fault —
-  // the job may well have beaten, so it is never called "never beaten".
-  assert.deepEqual(sessionNote({ heartbeat: { pid: 7 }, jobInstalled: true, now: M8_NOW }),
-    { reason: "heartbeat-unreadable", detail: "the heartbeat file is present but carries no readable timestamp" });
-  assert.equal(sessionNote({ heartbeat: { ts: "not a date" }, jobInstalled: true, now: M8_NOW }).reason, "heartbeat-unreadable");
-  assert.deepEqual(sessionNote({ heartbeatUnreadable: true, jobInstalled: true, now: M8_NOW }),
-    { reason: "heartbeat-unreadable", detail: "the heartbeat file is present but could not be parsed" });
-  // An attention record missing every field is still the right REASON — it is
-  // the file's existence that says "the supervisor flagged this seat".
-  assert.deepEqual(sessionNote({ attention: {}, jobInstalled: true, now: M8_NOW }), { reason: "awaiting-input" });
-  assert.deepEqual(sessionNote({ attention: { since: 12345, reason: 7, hint: null }, jobInstalled: true, now: M8_NOW }), { reason: "awaiting-input" });
-  assert.equal(sessionNote({ attention: { since: "not a date", reason: "no-heartbeat" }, jobInstalled: true, now: M8_NOW }).since, undefined);
-});
-
-test("sanitizeNoteDetail: no home paths, no ids, no control characters, never past the cap", () => {
-  const { sanitizeNoteDetail } = _internals;
-  assert.equal(sanitizeNoteDetail("attach with `tmux attach -t =maestro-maya`"), "attach with `tmux attach -t =maestro-maya`");
-  // Home directories name a person and leak the seat's layout.
-  assert.equal(sanitizeNoteDetail("blocked in /Users/maya/maya-ai/state"), "blocked in <path>");
-  // A home directory with a space in it is ordinary on macOS, and its tail
-  // carries the person's surname — the match may not stop at the whitespace.
-  assert.equal(sanitizeNoteDetail("blocked in /Users/olivia chen/maya-ai/state/session"), "blocked in <path>");
-  assert.equal(sanitizeNoteDetail("blocked in /Users/Olivia Chen/Library/Application Support/x"), "blocked in <path>");
-  // …but ordinary prose after a path is not swallowed with it.
-  assert.equal(sanitizeNoteDetail("blocked in /Users/maya and then retry"), "blocked in <path> and then retry");
-  assert.equal(sanitizeNoteDetail("attach to /Users/maya/x and answer it"), "attach to <path> and answer it");
-  assert.equal(sanitizeNoteDetail("blocked in ~/maya-ai and /home/maya/x and /private/var/folders/t/x"), "blocked in <path> and <path> and <path>");
-  // Session ids and token-shaped runs.
-  assert.equal(sanitizeNoteDetail("resume 3f2a1c94-7b0e-4a11-9c3d-0b7e2f8a6d51 failed"), "resume <redacted> failed");
-  assert.equal(sanitizeNoteDetail("token sk-ant-0123456789abcdef rejected"), "token <redacted> rejected");
-  // Newlines and control characters collapse; the note is one line.
-  assert.equal(sanitizeNoteDetail("a\nb\tc\r\nd"), "a b c d");
-  // The cap holds, with an ellipsis so a reader knows it was cut.
-  const long = sanitizeNoteDetail("lorem ipsum ".repeat(50));
-  assert.equal(long.length, 200);
-  assert.ok(long.endsWith("…"));
-  assert.ok(sanitizeNoteDetail("ab ".repeat(20), 10).length <= 10, "the cap is a ceiling, never exceeded (a word boundary can land under it)");
-  // Nothing to say → "", and the caller then omits the field entirely.
-  assert.equal(sanitizeNoteDetail(""), "");
-  assert.equal(sanitizeNoteDetail(null), "");
-  assert.equal(sanitizeNoteDetail(undefined), "");
-  assert.equal(sanitizeNoteDetail(42), "");
-  assert.equal(sanitizeNoteDetail("   \n  "), "");
-  // A hint long enough to overflow is truncated, not dropped.
-  const hint = sanitizeNoteDetail(`no-heartbeat: The session has been up 1800 s without a heartbeat — it is probably waiting on a first-run dialog or a permission prompt. Attach with \`tmux attach -t =maestro-maya\` and answer it. ${"tail ".repeat(20)}`);
-  assert.ok(hint.length <= 200 && hint.endsWith("…"), "an over-long hint is truncated, not dropped");
-});
-
-test("sessionJobInstalled: a readdir of ~/Library/LaunchAgents, and 'unknown' whenever it cannot be read", () => {
-  const { sessionJobInstalled, sessionJobLabel } = _internals;
-  const label = "ai.maestro.maya-session";
-  assert.equal(sessionJobInstalled({ launchAgents: ["ai.maestro.maya.plist", "ai.maestro.maya-session.plist"] }, label), true);
-  assert.equal(sessionJobInstalled({ launchAgents: ["ai.maestro.maya-session"] }, label), true, "bare labels count too");
-  assert.equal(sessionJobInstalled({ launchAgents: ["ai.maestro.maya.plist"] }, label), false);
-  assert.equal(sessionJobInstalled({ launchAgents: [] }, label), false);
-  // Unknowns: no label, an unreadable home, a home that is not there.
-  assert.equal(sessionJobInstalled({ launchAgents: ["ai.maestro.maya-session.plist"] }, ""), null);
-  assert.equal(sessionJobInstalled({ os: { homedir: () => "" } }, label), null);
-  assert.equal(sessionJobInstalled({ os: { homedir: () => { throw new Error("nope"); } } }, label), null);
-  assert.equal(sessionJobInstalled({ os: { homedir: () => join(tmpdir(), "no-such-home-xyz") } }, label), null);
-  // An explicit override wins (the daemon may already know).
-  assert.equal(sessionJobInstalled({ sessionJobInstalled: true, launchAgents: [] }, label), true);
-  // A case difference is not an absence: agentFirstName leaves its directory
-  // fallback as-is (`~/Maya-ai` -> `Maya`), and the volume is case-insensitive.
-  assert.equal(sessionJobInstalled({ launchAgents: ["ai.maestro.Maya-session.plist"] }, "ai.maestro.maya-session"), true);
-  assert.equal(sessionJobInstalled({ launchAgents: ["ai.maestro.maya-session.plist"] }, "ai.maestro.Maya-session"), true);
-  // The label matches what generate-plists.sh and `maestro session` spell —
-  // including its casing, which the generator does not lower-case either.
-  assert.equal(sessionJobLabel("/x/maya-ai", "maya"), "ai.maestro.maya-session");
-  assert.equal(sessionJobLabel("/x/Maya-ai", "Maya"), "ai.maestro.Maya-session");
-  assert.equal(sessionJobLabel("", ""), "");
-});
-
-test("collectStatus: machine.sessionNote appears ONLY when the front door is down, and rides machine (never session)", async () => {
-  const root = mkdtempSync(join(tmpdir(), "session-note-"));
-  try {
-    const now = Date.parse("2026-09-11T12:00:00Z");
-    const osImpl = fakeOs({});
-    osImpl.hostname = () => "seat.local";
-    const base = {
-      agentRoot: root, now, os: osImpl, execFile: fakeExecFile({}), subAgentsRunning: 0,
-      powermetrics: false, disk: false, spend: false, agentFirst: "maya", launchAgents: [],
-    };
-    const sess = join(root, "state", "session");
-    mkdirSync(sess, { recursive: true });
-
-    // 1. No job on the seat — the case A010/A016 could not tell apart.
-    const absent = await collectStatus(base);
-    assert.equal(absent.machine.sessionLive, false);
-    assert.equal(absent.machine.sessionNote.reason, "job-absent");
-    assert.match(absent.machine.sessionNote.detail, /ai\.maestro\.maya-session/);
-    assert.equal(absent.session, null, "the note NEVER touches session — hq validates that object strictly");
-    assert.ok(!("sessionNote" in (absent.session || {})));
-
-    // 2. Job installed, session up, waiting on a first-run dialog.
-    const installed = { ...base, launchAgents: ["ai.maestro.maya-session.plist"] };
-    writeFileSync(join(sess, "attention.json"), JSON.stringify(attention()));
-    const waiting = await collectStatus(installed);
-    assert.equal(waiting.machine.sessionNote.reason, "awaiting-input");
-    assert.equal(waiting.machine.sessionNote.since, "2026-09-11T11:57:00.000Z");
-    assert.match(waiting.machine.sessionNote.detail, /tmux attach -t =maestro-maya/);
-
-    // 3. The supervisor cleared attention.json and the beat then went stale.
-    rmSync(join(sess, "attention.json"));
-    writeFileSync(join(sess, "heartbeat.json"), JSON.stringify({ pid: 4242, ts: "2026-09-11T11:50:00Z" }));
-    const stale = await collectStatus(installed);
-    assert.equal(stale.machine.frontDoor, "session");
-    assert.deepEqual(stale.machine.sessionNote, { reason: "heartbeat-stale", since: "2026-09-11T11:50:00.000Z", detail: "no beat for 600 s" });
-
-    // 4. A live front door carries NO note — the key is absent, not null.
-    writeFileSync(join(sess, "heartbeat.json"), JSON.stringify({ pid: 4242, ts: "2026-09-11T11:59:50Z" }));
-    const live = await collectStatus(installed);
-    assert.equal(live.machine.sessionLive, true);
-    assert.ok(!("sessionNote" in live.machine), "a healthy seat must not pay for a field it has nothing to say in");
-
-    // 5. Corrupt state files never break the beat — and a heartbeat file that
-    //    is THERE and will not parse is reported as such, not as "never beaten".
-    writeFileSync(join(sess, "heartbeat.json"), "{not json");
-    writeFileSync(join(sess, "attention.json"), "{not json");
-    const corrupt = await collectStatus(installed);
-    assert.equal(corrupt.machine.sessionLive, false);
-    assert.deepEqual(corrupt.machine.sessionNote,
-      { reason: "heartbeat-unreadable", detail: "the heartbeat file is present but could not be parsed" });
-    assert.equal(typeof corrupt.ts, "string", "the snapshot is intact");
-
-    // 5b. No heartbeat file at all, job installed → never-beaten.
-    rmSync(join(sess, "heartbeat.json"));
-    rmSync(join(sess, "attention.json"));
-    const silent = await collectStatus(installed);
-    assert.deepEqual(silent.machine.sessionNote,
-      { reason: "never-beaten", detail: "the session job is installed but has never written a heartbeat" });
-
-    // 6. The whole note is a best-effort extra: a throwing os.homedir drops the
-    //    launchd read, never the beat — and an unknown job presence is reported
-    //    as neither an absence nor a presence.
-    const hostile = await collectStatus({ ...base, launchAgents: undefined, os: { ...osImpl, homedir: () => { throw new Error("no home"); } } });
-    assert.equal(hostile.machine.sessionNote.reason, "never-beaten", "unknown job presence is not an absence");
-    assert.equal(hostile.machine.sessionNote.detail, "no heartbeat from the session job, and its presence on this seat could not be checked",
-      "…and it is not reported as a presence either");
-    assert.equal(hostile.machine.sessionLive, false);
-
-    // 7. The emitted shape is exactly {reason, since?, detail?} — nothing else,
-    //    and nothing unbounded.
-    for (const s of [absent, waiting, stale, corrupt, silent, hostile]) {
-      const note = s.machine.sessionNote;
-      assert.equal(typeof note.reason, "string");
-      for (const k of Object.keys(note)) assert.ok(["reason", "since", "detail"].includes(k), `sessionNote.${k} is not in the contract`);
-      if (note.since !== undefined) assert.ok(Number.isFinite(Date.parse(note.since)), "since is ISO 8601");
-      if (note.detail !== undefined) assert.ok(note.detail.length <= 200 && !/\/Users\//.test(note.detail));
-    }
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-/**
- * The front-door signal must not flicker while the session is running.
- *
- * This function and `lib/session/liveness.mjs#heartbeatLiveness` answer one
- * question — "is the main session alive" — and they used to disagree: the
- * runtime accepted a heartbeat up to `staleMs` either side of now, this one
- * demanded `age >= 0`. So a heartbeat written microseconds before the wall
- * clock stepped back read as future-dated and flipped the seat to DOWN, while
- * the session carried on. A039 did exactly that across consecutive beats on
- * 2026-09-10/11 with its session healthy and its clock within 30 s of the
- * server. Symmetric now, and pinned here because the asymmetry was invisible:
- * every test used a past-dated heartbeat.
- */
-test("sessionLiveness tolerates clock skew symmetrically, and reports a far-future beat as not live", () => {
-  const now = Date.parse("2026-09-11T12:00:00Z");
-  const at = (ms) => ({ ts: new Date(now - ms).toISOString() });
-
-  // Fresh, and a beat from the recent past: live, as before.
-  assert.equal(sessionLiveness(at(0), now).sessionLive, true);
-  assert.equal(sessionLiveness(at(30_000), now).sessionLive, true);
-
-  // THE REGRESSION: a beat dated slightly in the FUTURE is the clock moving,
-  // not the session dying. Both of these used to return false.
-  assert.equal(sessionLiveness(at(-1), now).sessionLive, true, "1 ms ahead is not a dead session");
-  assert.equal(sessionLiveness(at(-30_000), now).sessionLive, true, "30 s ahead is ordinary clock motion");
-
-  // The window is symmetric and OPEN at both edges — the runtime's rule.
-  assert.equal(sessionLiveness(at(SESSION_STALE_MS - 1), now).sessionLive, true);
-  assert.equal(sessionLiveness(at(-(SESSION_STALE_MS - 1)), now).sessionLive, true);
-  assert.equal(sessionLiveness(at(SESSION_STALE_MS), now).sessionLive, false, "too old");
-  assert.equal(sessionLiveness(at(-SESSION_STALE_MS), now).sessionLive, false, "too far ahead to believe");
-
-  // The front door is still named in every case a heartbeat exists.
-  assert.equal(sessionLiveness(at(10 * SESSION_STALE_MS), now).frontDoor, "session");
-  // No heartbeat at all remains the daemon's lane.
-  assert.deepEqual(sessionLiveness(null, now), { frontDoor: "daemon", sessionLive: false });
-});
-
-test("sessionLiveness agrees with the session runtime's own window", async () => {
-  const { heartbeatLiveness, STALE_MS } = await import("../session/liveness.mjs");
-  assert.equal(STALE_MS, SESSION_STALE_MS, "one window, two readers");
-  const now = Date.parse("2026-09-11T12:00:00Z");
-  for (const offset of [0, 1_000, -1_000, 45_000, -45_000, STALE_MS, -STALE_MS, STALE_MS + 1, -(STALE_MS + 1)]) {
-    const hb = { ts: new Date(now - offset).toISOString(), pid: 0 };
-    assert.equal(
-      sessionLiveness(hb, now).sessionLive,
-      heartbeatLiveness(hb, { now }).live,
-      `the two readers disagree at offset ${offset} ms`
-    );
-  }
-});