@indigoai-us/hq-cloud 6.14.50 → 6.15.1

package/src/telemetry.test.ts

@@ -1,1280 +0,0 @@
-/**
- * Tests for the usage telemetry collector. Mirrors the Rust test matrix at
- * `hq-workspace/apps/hq-sync/src-tauri/src/commands/telemetry.rs::tests` so a
- * behavioral regression in either implementation surfaces in both suites.
- *
- * The vault client is stubbed structurally rather than via fetch-mock so the
- * tests stay deterministic without spinning up wiremock — the production
- * boundary is `TelemetryClientSurface`, not the HTTP layer.
- */
-
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import * as fs from "fs";
-import { promises as fsp } from "fs";
-import * as os from "os";
-import * as path from "path";
-import {
-  collectAndSendTelemetry,
-  sanitizeRow,
-  extractServices,
-  type CollectTelemetryOptions,
-  type TelemetryClientSurface,
-} from "./telemetry.js";
-import type {
-  TelemetryOptInResponse,
-  UsageBatch,
-  UsageIngestResult,
-} from "./vault-client.js";
-
-// ── Test stubs ────────────────────────────────────────────────────────────────
-
-interface StubClient extends TelemetryClientSurface {
-  /** Every UsageBatch handed to `postUsage`, in arrival order. */
-  posts: UsageBatch[];
-  /** Number of times `getTelemetryOptIn` was called. */
-  optInCalls: number;
-  /** Every value handed to `setTelemetryOptIn`, in arrival order. */
-  optInSets: boolean[];
-  /** The options object passed alongside each `setTelemetryOptIn` call. */
-  optInSetOpts: Array<{ onlyIfUnset?: boolean } | undefined>;
-}
-
-function makeClient(opts: {
-  optInResponse?: TelemetryOptInResponse | Error;
-  postResponse?: UsageIngestResult | Error;
-  /** When set, `setTelemetryOptIn` rejects with this error. */
-  setOptInError?: Error;
-  /** `applied` value the conditional write reports back (default true). */
-  setOptInApplied?: boolean;
-} = {}): StubClient {
-  const optInResponse = opts.optInResponse ?? { enabled: true, updatedAt: null };
-  const postResponse = opts.postResponse ?? { ok: true, written: 0, skipped: [] };
-
-  const posts: UsageBatch[] = [];
-  const optInSets: boolean[] = [];
-  const optInSetOpts: Array<{ onlyIfUnset?: boolean } | undefined> = [];
-  const stub: StubClient = {
-    posts,
-    optInCalls: 0,
-    optInSets,
-    optInSetOpts,
-    async getTelemetryOptIn() {
-      this.optInCalls++;
-      if (optInResponse instanceof Error) throw optInResponse;
-      return optInResponse;
-    },
-    async setTelemetryOptIn(enabled: boolean, setOpts?: { onlyIfUnset?: boolean }) {
-      optInSets.push(enabled);
-      optInSetOpts.push(setOpts);
-      if (opts.setOptInError) throw opts.setOptInError;
-      return { applied: opts.setOptInApplied ?? true };
-    },
-    async postUsage(batch: UsageBatch) {
-      posts.push(batch);
-      if (postResponse instanceof Error) throw postResponse;
-      return postResponse;
-    },
-  };
-  return stub;
-}
-
-interface TestEnv {
-  root: string;
-  claudeProjects: string;
-  codexRoot: string;
-  cursorPath: string;
-  menubarPath: string;
-}
-
-function setupEnv(): TestEnv {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-telemetry-test-"));
-  const claudeProjects = path.join(root, ".claude", "projects");
-  const codexRoot = path.join(root, ".codex");
-  fs.mkdirSync(claudeProjects, { recursive: true });
-  fs.mkdirSync(path.join(codexRoot, "sessions"), { recursive: true });
-  fs.mkdirSync(path.join(codexRoot, "archived_sessions"), { recursive: true });
-  fs.mkdirSync(path.join(root, ".hq"), { recursive: true });
-  return {
-    root,
-    claudeProjects,
-    codexRoot,
-    cursorPath: path.join(root, ".hq", "telemetry-cursor.json"),
-    menubarPath: path.join(root, ".hq", "menubar.json"),
-  };
-}
-
-function teardownEnv(env: TestEnv): void {
-  fs.rmSync(env.root, { recursive: true, force: true });
-}
-
-function writeJsonl(env: TestEnv, sub: string, name: string, lines: string[]): string {
-  const dir = path.join(env.claudeProjects, sub);
-  fs.mkdirSync(dir, { recursive: true });
-  const p = path.join(dir, name);
-  fs.writeFileSync(p, lines.map((l) => `${l}\n`).join(""));
-  return p;
-}
-
-function readCursor(env: TestEnv): { version: string; files: Record<string, { offset: number; mtime: number }> } {
-  return JSON.parse(fs.readFileSync(env.cursorPath, "utf-8"));
-}
-
-function makeOpts(env: TestEnv, client: TelemetryClientSurface): CollectTelemetryOptions {
-  return {
-    client,
-    machineId: "test-machine",
-    installerVersion: "test-version",
-    claudeProjectsRoot: env.claudeProjects,
-    codexRoot: env.codexRoot,
-    maxScanBytesPerSource: Number.MAX_SAFE_INTEGER,
-    maxBatchesPerRun: Number.MAX_SAFE_INTEGER,
-    cursorPath: env.cursorPath,
-    menubarPath: env.menubarPath,
-  };
-}
-
-// Representative Claude Code session rows. Mirror the Rust fixtures exactly so
-// drift between implementations is detectable.
-const USER_ROW = JSON.stringify({
-  type: "user",
-  timestamp: "2026-04-25T10:00:00Z",
-  sessionId: "s1",
-  uuid: "u1",
-  parentUuid: null,
-  userType: "human",
-  entrypoint: "cli",
-  cwd: "/Users/x/proj",
-  gitBranch: "main",
-  version: "1.0",
-  message: { role: "user", content: [{ type: "text", text: "hello world" }], id: "msg_1" },
-});
-
-const ASST_ROW = JSON.stringify({
-  type: "assistant",
-  timestamp: "2026-04-25T10:00:01Z",
-  sessionId: "s1",
-  uuid: "u2",
-  parentUuid: "u1",
-  message: {
-    role: "assistant",
-    model: "claude-opus",
-    content: [{ type: "text", text: "hi" }, { type: "thinking", thinking: "hmm" }],
-    stop_sequence: "</end>",
-    usage: { input_tokens: 42, output_tokens: 7, cache_read_input_tokens: 100 },
-    id: "msg_2",
-  },
-  toolUseIds: ["t1"],
-  toolResults: [{ id: "t1", output: "x" }],
-  requestId: "req_1",
-});
-
-// ── sanitizeRow ───────────────────────────────────────────────────────────────
-
-describe("sanitizeRow", () => {
-  it("returns null for non-objects", () => {
-    expect(sanitizeRow(null)).toBeNull();
-    expect(sanitizeRow("string")).toBeNull();
-    expect(sanitizeRow(42)).toBeNull();
-    expect(sanitizeRow([])).toBeNull();
-  });
-
-  it("keeps only top-level allowlist fields", () => {
-    const row = JSON.parse(USER_ROW);
-    const out = sanitizeRow(row);
-    expect(out).not.toBeNull();
-    const keys = new Set(Object.keys(out!));
-    // KEEP: sessionId, timestamp, uuid, cwd, gitBranch, userType
-    for (const expected of ["sessionId", "timestamp", "uuid", "cwd", "gitBranch", "userType"]) {
-      expect(keys.has(expected)).toBe(true);
-    }
-    // Sensitive / unknown fields must be absent:
-    for (const removed of ["type", "parentUuid", "entrypoint", "version", "message", "content", "thinking", "text", "toolUseIds", "toolResults"]) {
-      expect(keys.has(removed)).toBe(false);
-    }
-  });
-
-  it("promotes message.model and flattens message.usage to camelCase", () => {
-    const row = JSON.parse(ASST_ROW);
-    const out = sanitizeRow(row);
-    expect(out).not.toBeNull();
-    expect(out!.model).toBe("claude-opus");
-    expect(out!.inputTokens).toBe(42);
-    expect(out!.outputTokens).toBe(7);
-    expect(out!.cacheReadInputTokens).toBe(100);
-    // cacheCreationInputTokens not present in fixture; must be absent (not 0/null).
-    expect("cacheCreationInputTokens" in out!).toBe(false);
-    // `message` must not survive — its prompt/thinking/tools are exactly what
-    // we're trying to keep off the wire.
-    expect("message" in out!).toBe(false);
-  });
-
-  it("rejects every field outside the server KEEP allowlist", () => {
-    const out = sanitizeRow(JSON.parse(ASST_ROW))!;
-    const allowed = new Set([
-      "sessionId", "timestamp", "uuid", "cwd", "gitBranch", "userType",
-      "model", "inputTokens", "outputTokens",
-      "cacheCreationInputTokens", "cacheReadInputTokens",
-      "companyUid",
-    ]);
-    for (const key of Object.keys(out)) {
-      expect(allowed.has(key), `field "${key}" must be in server allowlist`).toBe(true);
-    }
-  });
-
-  it("(US-002) stamps companyUid when provided, omits it when not", () => {
-    const withUid = sanitizeRow(JSON.parse(USER_ROW), "cmp_01INDIGO")!;
-    expect(withUid.companyUid).toBe("cmp_01INDIGO");
-
-    const withoutUid = sanitizeRow(JSON.parse(USER_ROW))!;
-    expect("companyUid" in withoutUid).toBe(false);
-  });
-});
-
-// ── extractServices + sanitizeRow services emission (US-007) ─────────────────
-
-// An assistant row that invoked the Slack + Figma MCP servers. The tool_use
-// block `input` deliberately carries a URL + secret so the redaction assertions
-// have something dangerous to prove is dropped.
-const MCP_ROW = JSON.stringify({
-  type: "assistant",
-  timestamp: "2026-04-25T10:00:02Z",
-  sessionId: "s1",
-  uuid: "u3",
-  message: {
-    role: "assistant",
-    model: "claude-opus",
-    usage: { input_tokens: 10, output_tokens: 5 },
-    content: [
-      { type: "text", text: "calling tools" },
-      {
-        type: "tool_use",
-        id: "t1",
-        name: "mcp__slack__slack_send_message",
-        input: { channel: "#secret-ops", token: "xoxb-SECRET-TOKEN", text: "hi" },
-      },
-      {
-        type: "tool_use",
-        id: "t2",
-        name: "mcp__slack__slack_read_channel",
-        input: { url: "https://hooks.slack.com/leak", channel: "C123" },
-      },
-      {
-        type: "tool_use",
-        id: "t3",
-        name: "mcp__figma__get_screenshot",
-        input: { fileKey: "https://figma.com/file/PRIVATE" },
-      },
-      // A non-MCP builtin tool must NOT count as a service.
-      { type: "tool_use", id: "t4", name: "Bash", input: { command: "rm -rf /" } },
-    ],
-    id: "msg_3",
-  },
-});
-
-describe("extractServices (US-007)", () => {
-  it("counts MCP servers by name from tool_use block names", () => {
-    const services = extractServices(JSON.parse(MCP_ROW).message);
-    // Slack invoked twice, Figma once; Bash (builtin) excluded.
-    expect(services).toEqual({ slack: 2, figma: 1 });
-  });
-
-  it("returns undefined when the row touched no MCP server", () => {
-    expect(extractServices(JSON.parse(ASST_ROW).message)).toBeUndefined();
-    expect(extractServices(JSON.parse(USER_ROW).message)).toBeUndefined();
-    expect(extractServices(undefined)).toBeUndefined();
-    expect(extractServices({ content: "not an array" })).toBeUndefined();
-  });
-
-  it("preserves multi-underscore server names (mcp__claude_ai_Slack__…)", () => {
-    const msg = {
-      content: [
-        { type: "tool_use", id: "a", name: "mcp__claude_ai_Slack__slack_send_message", input: {} },
-        { type: "tool_use", id: "b", name: "mcp__claude_ai_Figma__get_screenshot", input: {} },
-      ],
-    };
-    // The server segment is everything between the first and the LAST `__`.
-    expect(extractServices(msg)).toEqual({
-      claude_ai_Slack: 1,
-      claude_ai_Figma: 1,
-    });
-  });
-
-  it("preserves a double-underscore in the server name (mcp__foo__bar__run)", () => {
-    const msg = {
-      content: [
-        { type: "tool_use", id: "a", name: "mcp__foo__bar__run", input: {} },
-      ],
-    };
-    // Delimiter is the LAST `__`, so server = `foo__bar`, tool = `run`.
-    expect(extractServices(msg)).toEqual({ "foo__bar": 1 });
-  });
-
-  it("counts servers whose names collide with Object.prototype members", () => {
-    const msg = {
-      content: [
-        { type: "tool_use", id: "a", name: "mcp__constructor__x", input: {} },
-        { type: "tool_use", id: "b", name: "mcp__constructor__y", input: {} },
-        { type: "tool_use", id: "c", name: "mcp__toString__z", input: {} },
-      ],
-    };
-    // A plain-object counter would read these off the prototype and produce a
-    // non-numeric count; the null-prototype map keeps them honest integers.
-    const out = extractServices(msg)!;
-    expect(out).toEqual({ constructor: 2, toString: 1 });
-    expect(typeof out.constructor).toBe("number");
-  });
-
-  // SECURITY-CRITICAL: names + counts ONLY. No args / URLs / payloads / secrets.
-  it("emits NAMES + COUNTS only — no args, URLs, payloads, or secrets", () => {
-    const out = sanitizeRow(JSON.parse(MCP_ROW))!;
-    expect(out.services).toEqual({ slack: 2, figma: 1 });
-
-    // The full serialized wire row must contain NONE of the dangerous input data.
-    const serialized = JSON.stringify(out);
-    expect(serialized).not.toContain("xoxb-SECRET-TOKEN");
-    expect(serialized).not.toContain("hooks.slack.com");
-    expect(serialized).not.toContain("figma.com/file/PRIVATE");
-    expect(serialized).not.toContain("#secret-ops");
-    expect(serialized).not.toContain("rm -rf");
-    // No tool names or input keys leaked — only the server names + counts.
-    expect(serialized).not.toContain("slack_send_message");
-    expect(serialized).not.toContain("get_screenshot");
-    expect(serialized).not.toContain("channel");
-    expect(serialized).not.toContain("token");
-    expect(serialized).not.toContain("url");
-
-    // The services VALUE is a map of string → number (counts) — never objects
-    // or strings that could smuggle structured data.
-    for (const [name, count] of Object.entries(out.services as Record<string, unknown>)) {
-      expect(typeof name).toBe("string");
-      expect(typeof count).toBe("number");
-    }
-  });
-
-  it("omits services entirely for a row with no MCP calls (backward-compatible)", () => {
-    const out = sanitizeRow(JSON.parse(ASST_ROW))!;
-    expect("services" in out).toBe(false);
-  });
-});
-
-// ── collectAndSendTelemetry ───────────────────────────────────────────────────
-
-describe("collectAndSendTelemetry", () => {
-  let env: TestEnv;
-  beforeEach(() => { env = setupEnv(); });
-  afterEach(() => { teardownEnv(env); });
-
-  it("(a) opt-in=false → sends nothing and does not write cursor", async () => {
-    const client = makeClient({ optInResponse: { enabled: false, updatedAt: null } });
-    writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW]);
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.enabled).toBe(false);
-    expect(result.optInSource).toBe("server");
-    expect(client.posts).toHaveLength(0);
-    expect(fs.existsSync(env.cursorPath)).toBe(false);
-  });
-
-  it("(b) missing cursor → reads all rows from offset 0, advances to EOF", async () => {
-    const client = makeClient();
-    const jsonlPath = writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW]);
-    const fileSize = fs.statSync(jsonlPath).size;
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.enabled).toBe(true);
-    expect(result.eventsSent).toBe(2);
-    expect(client.posts).toHaveLength(1);
-    expect(client.posts[0].events).toHaveLength(2);
-    expect(client.posts[0].machineId).toBe("test-machine");
-    expect(client.posts[0].installerVersion).toBe("test-version");
-
-    const cursor = readCursor(env);
-    expect(cursor.files[jsonlPath].offset).toBe(fileSize);
-  });
-
-  it("(c) sanitizer strips REMOVE fields — only allowlisted fields reach wire", async () => {
-    const client = makeClient();
-    writeJsonl(env, "proj", "full.jsonl", [USER_ROW, ASST_ROW]);
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-    expect(client.posts).toHaveLength(1);
-
-    const allowed = new Set([
-      "sessionId", "timestamp", "uuid", "cwd", "gitBranch", "userType",
-      "model", "inputTokens", "outputTokens",
-      "cacheCreationInputTokens", "cacheReadInputTokens",
-    ]);
-    for (const ev of client.posts[0].events) {
-      for (const key of Object.keys(ev)) {
-        expect(allowed.has(key), `field "${key}" must be in allowlist`).toBe(true);
-      }
-      expect("message" in ev).toBe(false);
-      for (const banned of ["content", "thinking", "text", "toolUseIds", "toolResults"]) {
-        expect(banned in ev).toBe(false);
-      }
-    }
-  });
-
-  it("(d) 1 MiB cap forces ≥2 batches when rows are large", async () => {
-    const client = makeClient();
-    // ~25 KiB per row × 50 rows ≈ 1.25 MiB → ≥2 batches.
-    const longBranch = "x".repeat(25_000);
-    const lines: string[] = [];
-    for (let i = 0; i < 50; i++) {
-      lines.push(JSON.stringify({
-        type: "user",
-        timestamp: `2026-04-25T10:00:${String(i % 60).padStart(2, "0")}Z`,
-        sessionId: "s1",
-        uuid: `u${i}`,
-        cwd: "/Users/x",
-        gitBranch: longBranch,
-        userType: "human",
-        message: { role: "user", content: [{ type: "text", text: "hi" }], id: "m" },
-      }));
-    }
-    writeJsonl(env, "proj", "large.jsonl", lines);
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.batchesSent).toBeGreaterThanOrEqual(2);
-    expect(result.eventsSent).toBe(50);
-
-    // Final batch must be < 1 MiB on the wire.
-    const lastWire = Buffer.byteLength(JSON.stringify(client.posts.at(-1)), "utf-8");
-    expect(lastWire).toBeLessThan(1_000_000);
-  });
-
-  it("F19: caps usage telemetry batches at 100 events", async () => {
-    const client = makeClient();
-    const lines = Array.from({ length: 101 }, (_, i) => JSON.stringify({
-      type: "user",
-      timestamp: `2026-04-25T10:${String(Math.floor(i / 60)).padStart(2, "0")}:${String(i % 60).padStart(2, "0")}Z`,
-      sessionId: "s-f19-row-cap",
-      uuid: `u-f19-row-${i}`,
-      cwd: "/Users/x",
-      gitBranch: "main",
-      userType: "human",
-      message: { role: "user", content: [{ type: "text", text: "hi" }], id: `m${i}` },
-    }));
-    writeJsonl(env, "proj", "f19-row-cap.jsonl", lines);
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.eventsSent).toBe(101);
-    expect(result.batchesSent).toBe(2);
-    expect(client.posts.map((post) => post.events.length)).toEqual([100, 1]);
-    for (const post of client.posts) {
-      expect(post.events.length).toBeLessThanOrEqual(100);
-    }
-  });
-
-  it("F19: caps usage telemetry POST bodies at 240 KiB", async () => {
-    const client = makeClient();
-    const branch = "x".repeat(9_000);
-    const lines = Array.from({ length: 30 }, (_, i) => JSON.stringify({
-      type: "user",
-      timestamp: `2026-04-25T11:${String(Math.floor(i / 60)).padStart(2, "0")}:${String(i % 60).padStart(2, "0")}Z`,
-      sessionId: "s-f19-byte-cap",
-      uuid: `u-f19-byte-${i}`,
-      cwd: "/Users/x",
-      gitBranch: branch,
-      userType: "human",
-      message: { role: "user", content: [{ type: "text", text: "hi" }], id: `m${i}` },
-    }));
-    writeJsonl(env, "proj", "f19-byte-cap.jsonl", lines);
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-    const wireSizes = client.posts.map((post) => Buffer.byteLength(JSON.stringify(post), "utf-8"));
-
-    expect(result.eventsSent).toBe(30);
-    expect(result.batchesSent).toBeGreaterThan(1);
-    for (const wireSize of wireSizes) {
-      expect(wireSize).toBeLessThanOrEqual(240 * 1024);
-    }
-  });
-
-  it("R-F19: bounds a single oversized sanitized usage row before POST", async () => {
-    const client = makeClient();
-    const logs: string[] = [];
-    const hugeBranch = "x".repeat(400_000);
-    writeJsonl(env, "proj", "r-f19-singleton.jsonl", [
-      JSON.stringify({
-        type: "user",
-        timestamp: "2026-06-19T10:00:00.000Z",
-        sessionId: "s-r-f19-singleton",
-        uuid: "u-r-f19-singleton",
-        cwd: "/Users/x",
-        gitBranch: hugeBranch,
-        userType: "human",
-        message: {
-          role: "user",
-          content: [{ type: "text", text: "hi" }],
-          id: "m-r-f19-singleton",
-        },
-      }),
-    ]);
-
-    const result = await collectAndSendTelemetry({
-      ...makeOpts(env, client),
-      log: (msg) => logs.push(msg),
-    });
-
-    expect(result.eventsSent).toBe(1);
-    expect(client.posts).toHaveLength(1);
-    const wireSize = Buffer.byteLength(JSON.stringify(client.posts[0]), "utf-8");
-    expect(wireSize).toBeLessThanOrEqual(240 * 1024);
-    expect(client.posts[0].events[0].gitBranch).not.toBe(hugeBranch);
-    expect(logs.some((line) => line.includes("oversized row truncated"))).toBe(
-      true,
-    );
-  });
-
-  it("(e) POST 500 → cursor NOT advanced", async () => {
-    const client = makeClient({ postResponse: new Error("server 500") });
-    writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW, USER_ROW]);
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.eventsSent).toBe(0);
-    expect(result.batchesSent).toBe(0);
-    expect(client.posts).toHaveLength(1); // we still tried
-
-    // Cursor file is written (with rotation/empty resets), but the file's
-    // entry must NOT carry a non-zero offset.
-    if (fs.existsSync(env.cursorPath)) {
-      const cursor = readCursor(env);
-      const allOffsets = Object.values(cursor.files).map((e) => e.offset);
-      expect(allOffsets.every((off) => off === 0)).toBe(true);
-    }
-  });
-
-  it("(f) atomic cursor write — no .tmp leftover", async () => {
-    const client = makeClient();
-    writeJsonl(env, "proj", "s.jsonl", [USER_ROW]);
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(fs.existsSync(env.cursorPath)).toBe(true);
-    expect(fs.existsSync(`${env.cursorPath}.tmp`)).toBe(false);
-  });
-
-  it("(g) new file between runs starts at offset 0", async () => {
-    const client = makeClient();
-    writeJsonl(env, "proj-a", "a.jsonl", [USER_ROW]);
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-    const postsAfterRun1 = client.posts.length;
-    expect(postsAfterRun1).toBeGreaterThanOrEqual(1);
-
-    // Add a new fixture between runs.
-    const pathB = writeJsonl(env, "proj-b", "b.jsonl", [ASST_ROW]);
-    await collectAndSendTelemetry(makeOpts(env, client));
-
-    const cursor = readCursor(env);
-    const sizeB = fs.statSync(pathB).size;
-    expect(cursor.files[pathB].offset).toBe(sizeB);
-  });
-
-  it("(h) truncated/rotated file resets cursor to 0", async () => {
-    const client = makeClient();
-    const pathA = writeJsonl(env, "proj", "a.jsonl", [USER_ROW, ASST_ROW, USER_ROW]);
-    const originalSize = fs.statSync(pathA).size;
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-    let cursor = readCursor(env);
-    expect(cursor.files[pathA].offset).toBe(originalSize);
-
-    // Truncate to 0 → next run must detect rotation and reset.
-    fs.truncateSync(pathA, 0);
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-
-    cursor = readCursor(env);
-    expect(cursor.files[pathA].offset).toBe(0);
-  });
-
-  it("(i) opt-in GET fails → falls back to menubar.json (telemetryEnabled=true → runs)", async () => {
-    const client = makeClient({ optInResponse: new Error("server 500") });
-    fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true }));
-    writeJsonl(env, "proj", "s.jsonl", [USER_ROW]);
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.enabled).toBe(true);
-    expect(result.optInSource).toBe("menubar-fallback");
-    expect(client.posts).toHaveLength(1);
-  });
-
-  it("(i') opt-in GET fails AND menubar.json says false → skips", async () => {
-    const client = makeClient({ optInResponse: new Error("server 500") });
-    fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: false }));
-    writeJsonl(env, "proj", "s.jsonl", [USER_ROW]);
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.enabled).toBe(false);
-    expect(result.optInSource).toBe("menubar-fallback");
-    expect(client.posts).toHaveLength(0);
-  });
-
-  it("(j) missing claude/projects directory → no crash, no posts", async () => {
-    fs.rmSync(env.claudeProjects, { recursive: true });
-    const client = makeClient();
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.enabled).toBe(true);
-    expect(result.filesScanned).toBe(0);
-    expect(client.posts).toHaveLength(0);
-  });
-
-  it("(k) second run with no new content sends nothing", async () => {
-    const client = makeClient();
-    writeJsonl(env, "proj", "s.jsonl", [USER_ROW, ASST_ROW]);
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-    expect(client.posts).toHaveLength(1);
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-    expect(client.posts).toHaveLength(1); // no second POST
-  });
-});
-
-// ── Codex rollout collection ────────────────────────────────────────────────
-
-function codexLine(value: Record<string, unknown>): string {
-  return JSON.stringify(value);
-}
-
-function writeCodexRollout(
-  env: TestEnv,
-  location: "sessions" | "archived_sessions",
-  name: string,
-  lines: Array<Record<string, unknown>>,
-): string {
-  const dir =
-    location === "sessions"
-      ? path.join(env.codexRoot, location, "2026", "07", "30")
-      : path.join(env.codexRoot, location);
-  fs.mkdirSync(dir, { recursive: true });
-  const file = path.join(dir, name);
-  fs.writeFileSync(file, lines.map(codexLine).join("\n") + "\n", "utf-8");
-  return file;
-}
-
-function codexToken(
-  timestamp: string,
-  uuid: string,
-  input: number,
-  output: number,
-  reasoning = 0,
-  cached = 0,
-): Record<string, unknown> {
-  return {
-    timestamp,
-    uuid,
-    type: "event_msg",
-    payload: {
-      type: "token_count",
-      info: {
-        last_token_usage: {
-          input_tokens: input,
-          output_tokens: output,
-          reasoning_output_tokens: reasoning,
-          cached_input_tokens: cached,
-        },
-        total_token_usage: {
-          input_tokens: 999_999,
-          output_tokens: 999_999,
-        },
-      },
-      raw_content: "must never leave the machine",
-    },
-  };
-}
-
-describe("collectAndSendTelemetry — Codex rollouts", () => {
-  let env: TestEnv;
-  beforeEach(() => {
-    env = setupEnv();
-  });
-  afterEach(() => teardownEnv(env));
-
-  it("collects token deltas from live and archived Linux rollouts", async () => {
-    writeCodexRollout(env, "sessions", "rollout-live.jsonl", [
-      {
-        timestamp: "2026-07-30T10:00:00Z",
-        type: "session_meta",
-        payload: {
-          id: "codex-live",
-          cwd: "/home/yousuf/hq/repos/private/hq-cloud",
-          git: { branch: "feature/live" },
-          model: "session-model",
-          instructions: "private prompt",
-        },
-      },
-      {
-        timestamp: "2026-07-30T10:00:01Z",
-        type: "turn_context",
-        payload: { model: "codex-auto-review" },
-      },
-      codexToken("2026-07-30T10:00:02Z", "codex-event-live", 11, 7, 5, 3),
-    ]);
-    writeCodexRollout(env, "archived_sessions", "rollout-archived.jsonl", [
-      {
-        timestamp: "2026-07-29T10:00:00Z",
-        type: "session_meta",
-        payload: { id: "codex-archived", cwd: "/repo", model: "gpt-5-codex" },
-      },
-      codexToken("2026-07-29T10:00:01Z", "codex-event-archived", 2, 3, 1, 1),
-    ]);
-
-    const client = makeClient();
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-    const events = client.posts.flatMap((post) => post.events);
-
-    expect(result.filesScanned).toBe(2);
-    expect(result.eventsSent).toBe(2);
-    expect(events).toEqual(
-      expect.arrayContaining([
-        {
-          sessionId: "codex-live",
-          timestamp: "2026-07-30T10:00:02Z",
-          uuid: "codex-event-live",
-          cwd: "/home/yousuf/hq/repos/private/hq-cloud",
-          gitBranch: "feature/live",
-          model: "codex-auto-review",
-          inputTokens: 11,
-          outputTokens: 12,
-          cacheReadInputTokens: 3,
-        },
-        expect.objectContaining({
-          sessionId: "codex-archived",
-          model: "gpt-5-codex",
-          inputTokens: 2,
-          outputTokens: 4,
-          cacheReadInputTokens: 1,
-        }),
-      ]),
-    );
-    expect(JSON.stringify(events)).not.toContain("private prompt");
-    expect(JSON.stringify(events)).not.toContain("raw_content");
-    expect(JSON.stringify(events)).not.toContain("999999");
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-    expect(client.posts.flatMap((post) => post.events)).toHaveLength(2);
-  });
-
-  it("persists model context for incremental rollouts and generates stable IDs", async () => {
-    const file = writeCodexRollout(env, "sessions", "rollout-incremental.jsonl", [
-      {
-        type: "session_meta",
-        payload: { id: "incremental", cwd: "/repo", model: "session-model" },
-      },
-      { type: "turn_context", payload: { model: "model-a" } },
-      codexToken("2026-07-30T13:00:00Z", "first-event", 1, 2),
-    ]);
-    fs.writeFileSync(
-      env.cursorPath,
-      JSON.stringify({ version: "1", files: {}, codex_next_rollout: file }),
-    );
-    const client = makeClient();
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-    fs.appendFileSync(
-      file,
-      [
-        codexLine({ type: "turn_context", payload: { model: "model-b" } }),
-        codexLine({
-          ...codexToken("2026-07-30T13:01:00Z", "temporary", 3, 4),
-          uuid: undefined,
-        }),
-      ].join("\n") + "\n",
-    );
-    await collectAndSendTelemetry(makeOpts(env, client));
-
-    const events = client.posts.flatMap((post) => post.events);
-    expect(events).toHaveLength(2);
-    expect(events[1]).toMatchObject({
-      sessionId: "incremental",
-      cwd: "/repo",
-      model: "model-b",
-      inputTokens: 3,
-      outputTokens: 4,
-    });
-    expect(events[1].uuid).toMatch(/^codex-[a-f0-9]{64}$/);
-    const cursor = JSON.parse(fs.readFileSync(env.cursorPath, "utf-8"));
-    expect(cursor.files[file].context).toMatchObject({
-      session_id: "incremental",
-      cwd: "/repo",
-      session_model: "session-model",
-      turn_model: "model-b",
-    });
-    expect(cursor.codex_next_rollout).toBe(file);
-  });
-
-  it("bounds a quiet first backfill and resumes until the token event", async () => {
-    const file = writeCodexRollout(env, "sessions", "rollout-bounded.jsonl", [
-      { type: "session_meta", payload: { id: "bounded", model: "gpt-5-codex" } },
-      ...Array.from({ length: 8 }, (_, index) => ({
-        type: "response_item",
-        payload: { type: "message", content: "x".repeat(140), index },
-      })),
-      codexToken("2026-07-30T14:00:00Z", "bounded-event", 5, 7),
-    ]);
-    const client = makeClient();
-    const opts = {
-      ...makeOpts(env, client),
-      maxScanBytesPerSource: 350,
-    };
-
-    const first = await collectAndSendTelemetry(opts);
-
-    expect(first.eventsSent).toBe(0);
-    const firstOffset = readCursor(env).files[file]?.offset ?? 0;
-    expect(firstOffset).toBeGreaterThan(0);
-    expect(firstOffset).toBeLessThan(fs.statSync(file).size);
-
-    for (let run = 0; run < 10 && client.posts.length === 0; run++) {
-      await collectAndSendTelemetry(opts);
-    }
-    expect(client.posts.flatMap((post) => post.events)).toEqual([
-      expect.objectContaining({
-        sessionId: "bounded",
-        uuid: "bounded-event",
-        model: "gpt-5-codex",
-      }),
-    ]);
-  });
-
-  it("discards an oversized UTF-8 row without corrupting resume offsets", async () => {
-    const file = writeCodexRollout(env, "sessions", "rollout-utf8.jsonl", [
-      { type: "session_meta", payload: { id: "utf8", model: "gpt-5-codex" } },
-      {
-        type: "response_item",
-        payload: { type: "message", content: "😀".repeat(20_000) },
-      },
-      codexToken("2026-07-30T14:00:01Z", "utf8-event", 2, 3),
-    ]);
-    const client = makeClient();
-    const opts = {
-      ...makeOpts(env, client),
-      maxScanBytesPerSource: 64 * 1024,
-    };
-
-    for (let run = 0; run < 5 && client.posts.length === 0; run++) {
-      await collectAndSendTelemetry(opts);
-    }
-
-    const events = client.posts.flatMap((post) => post.events);
-    expect(events).toEqual([
-      expect.objectContaining({ uuid: "utf8-event", sessionId: "utf8" }),
-    ]);
-    expect(readCursor(env).files[file].offset).toBeLessThanOrEqual(
-      fs.statSync(file).size,
-    );
-  });
-
-  it("caps upload batches and resumes remaining token events", async () => {
-    writeCodexRollout(env, "sessions", "rollout-batch-cap.jsonl", [
-      { type: "session_meta", payload: { id: "batch-cap", model: "gpt-5-codex" } },
-      ...Array.from({ length: 201 }, (_, index) =>
-        codexToken(
-          "2026-07-30T14:01:" + String(index % 60).padStart(2, "0") + "Z",
-          "batch-cap-" + index,
-          1,
-          1,
-        ),
-      ),
-    ]);
-    const client = makeClient();
-    const opts = {
-      ...makeOpts(env, client),
-      maxScanBytesPerSource: 1_000_000,
-      maxBatchesPerRun: 2,
-    };
-
-    const first = await collectAndSendTelemetry(opts);
-    expect(first.batchesSent).toBe(2);
-    expect(first.eventsSent).toBe(200);
-
-    const second = await collectAndSendTelemetry(opts);
-    expect(second.eventsSent).toBe(1);
-    expect(client.posts.flatMap((post) => post.events)).toHaveLength(201);
-  });
-
-  it("does not advance a Codex rollout cursor when upload fails", async () => {
-    const file = writeCodexRollout(env, "sessions", "rollout-retry.jsonl", [
-      { type: "session_meta", payload: { id: "retry", model: "gpt-5-codex" } },
-      codexToken("2026-07-30T12:00:00Z", "retry-event", 1, 2),
-    ]);
-    const client = makeClient({ postResponse: new Error("server 500") });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(result.eventsSent).toBe(0);
-    const cursor = readCursor(env);
-    expect(cursor.files[file]?.offset ?? 0).toBe(0);
-  });
-});
-
-// ── companyUid edge attribution (US-002) ────────────────────────────────────────
-
-describe("collectAndSendTelemetry — companyUid attribution", () => {
-  const COMPANY_UID = "cmp_01INDIGOTEST";
-  let env: TestEnv;
-  let hqRoot: string;
-
-  // The manifest lives at <hqRoot>/companies/manifest.yaml; the repo it maps is
-  // a real subdir of hqRoot so the resolver's absolute-path math lines up.
-  function writeManifest(): void {
-    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
-    fs.writeFileSync(
-      path.join(hqRoot, "companies", "manifest.yaml"),
-      `companies:\n  indigo:\n    repos:\n      - repos/private/hq-cloud\n    cloud_uid: ${COMPANY_UID}\n`,
-    );
-  }
-
-  function rowWithCwd(uuid: string, cwd: string): string {
-    return JSON.stringify({
-      type: "user",
-      timestamp: "2026-06-10T10:00:00Z",
-      sessionId: "s1",
-      uuid,
-      userType: "human",
-      cwd,
-      message: { role: "user", content: [{ type: "text", text: "hi" }] },
-    });
-  }
-
-  beforeEach(() => {
-    env = setupEnv();
-    // Use the same tmp root as hqRoot so the repo path resolves under it.
-    hqRoot = env.root;
-    writeManifest();
-  });
-  afterEach(() => { teardownEnv(env); });
-
-  it("stamps companyUid on events whose cwd is inside a company repo", async () => {
-    const client = makeClient();
-    const inRepo = path.join(hqRoot, "repos/private/hq-cloud/src");
-    writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", inRepo)]);
-
-    await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
-
-    expect(client.posts).toHaveLength(1);
-    expect(client.posts[0].events[0].companyUid).toBe(COMPANY_UID);
-  });
-
-  it("omits companyUid when the cwd maps to no company repo", async () => {
-    const client = makeClient();
-    writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", "/Users/x/some-other-repo")]);
-
-    await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
-
-    expect(client.posts).toHaveLength(1);
-    expect("companyUid" in client.posts[0].events[0]).toBe(false);
-  });
-
-  it("uses the explicit single-company fallback when cwd is the shared HQ root", async () => {
-    const client = makeClient();
-    writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", hqRoot)]);
-
-    await collectAndSendTelemetry({
-      ...makeOpts(env, client),
-      hqRoot,
-      fallbackCompany: "indigo",
-    });
-
-    expect(client.posts).toHaveLength(1);
-    expect(client.posts[0].events[0].companyUid).toBe(COMPANY_UID);
-  });
-
-  it("prefers the cwd-resolved company over the single-company fallback", async () => {
-    const client = makeClient();
-    const inRepo = path.join(hqRoot, "repos/private/hq-cloud");
-    writeJsonl(env, "proj", "s.jsonl", [rowWithCwd("u1", inRepo)]);
-
-    await collectAndSendTelemetry({
-      ...makeOpts(env, client),
-      hqRoot,
-      fallbackCompany: "cmp_01OTHER",
-    });
-
-    expect(client.posts).toHaveLength(1);
-    expect(client.posts[0].events[0].companyUid).toBe(COMPANY_UID);
-  });
-
-  it("never sends the reserved 'unattributed' value", async () => {
-    const client = makeClient();
-    writeJsonl(env, "proj", "s.jsonl", [
-      rowWithCwd("u1", path.join(hqRoot, "repos/private/hq-cloud")),
-      rowWithCwd("u2", "/elsewhere"),
-    ]);
-
-    await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
-
-    for (const ev of client.posts.flatMap((p) => p.events)) {
-      expect(ev.companyUid).not.toBe("unattributed");
-    }
-  });
-
-  it("parses the manifest once per run (cache), not per event", async () => {
-    const client = makeClient();
-    const inRepo = path.join(hqRoot, "repos/private/hq-cloud");
-    // 5 events in one run; assert the manifest file is read exactly once.
-    writeJsonl(
-      env,
-      "proj",
-      "s.jsonl",
-      Array.from({ length: 5 }, (_, i) => rowWithCwd(`u${i}`, inRepo)),
-    );
-
-    const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
-    const realReadFile = fsp.readFile;
-    let manifestReads = 0;
-    const spy = vi
-      .spyOn(fsp, "readFile")
-      .mockImplementation((async (p: Parameters<typeof realReadFile>[0], ...rest: unknown[]) => {
-        if (typeof p === "string" && p === manifestPath) manifestReads++;
-        // @ts-expect-error pass-through to the real implementation
-        return realReadFile(p, ...rest);
-      }) as typeof realReadFile);
-
-    try {
-      await collectAndSendTelemetry({ ...makeOpts(env, client), hqRoot });
-    } finally {
-      spy.mockRestore();
-    }
-
-    expect(manifestReads).toBe(1); // one parse for all 5 events
-    const events = client.posts.flatMap((p) => p.events);
-    expect(events).toHaveLength(5);
-    for (const ev of events) expect(ev.companyUid).toBe(COMPANY_UID);
-  });
-});
-
-const CALLER = "prs_01CALLER";
-
-// ── Consent self-heal ────────────────────────────────────────────────────────
-//
-// Regression for the opt-in race: the installer writes the user's answer to
-// `~/.hq/menubar.json` (always succeeds) AND posts it to `/v1/usage/opt-in` —
-// but that post fires before the person entity exists, so it 404s and the
-// server attribute is never written. Absence read as `false`, the emitter went
-// silent, and the person showed as "not opted in" forever. Measured in prod:
-// 22 of 33 active Indigo members had NO attribute at all, against 2 genuine
-// opt-outs.
-//
-// The heal replays the answer the user already gave. It must fire ONLY on the
-// server's `unset` state, and must never invent or overwrite consent.
-
-describe("collectAndSendTelemetry — consent self-heal", () => {
-  let env: TestEnv;
-  beforeEach(() => {
-    env = setupEnv();
-  });
-  afterEach(() => teardownEnv(env));
-
-  // The cached answer must name the account it belongs to; an unbound record is
-  // deliberately not replayable (see the cross-account test below).
-  function writeMenubar(value: unknown, personUid: string | undefined = CALLER): void {
-    fs.writeFileSync(
-      env.menubarPath,
-      JSON.stringify({
-        telemetryEnabled: value,
-        ...(personUid ? { telemetryOptInPersonUid: personUid } : {}),
-      }),
-    );
-  }
-
-  it("re-asserts a local opt-IN when the server has no recorded consent", async () => {
-    writeMenubar(true);
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([true]);
-    expect(result.enabled).toBe(true);
-    expect(result.optInSource).toBe("menubar-reasserted");
-  });
-
-  it("re-asserts a local opt-OUT so the server records the real answer", async () => {
-    writeMenubar(false);
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([false]);
-    expect(result.enabled).toBe(false);
-  });
-
-  it("NEVER overwrites an explicit server opt-out", async () => {
-    // The user opted in on this machine at some point, then explicitly opted
-    // out account-wide. The account-wide answer must win.
-    writeMenubar(true);
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: "2026-06-19T16:11:09.939Z", unset: false },
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([]);
-    expect(result.enabled).toBe(false);
-    expect(result.optInSource).toBe("server");
-  });
-
-  it("does not invent consent when no local answer exists", async () => {
-    // No menubar.json at all — we hold no answer, so we assert nothing.
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([]);
-    expect(result.enabled).toBe(false);
-  });
-
-  it("does not invent consent when the local value is not a boolean", async () => {
-    writeMenubar("yes");
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([]);
-    expect(result.enabled).toBe(false);
-  });
-
-  it("falls back to the server answer when the re-assert POST fails", async () => {
-    writeMenubar(true);
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-      setOptInError: new Error("network down"),
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([true]);
-    // Non-fatal: the run completes on the server's answer and retries next time.
-    expect(result.enabled).toBe(false);
-    expect(result.optInSource).toBe("server");
-  });
-
-  it("skips the heal entirely against an older server that omits `unset`", async () => {
-    writeMenubar(true);
-    const client = makeClient({ optInResponse: { enabled: false, updatedAt: null } });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([]);
-    expect(result.optInSource).toBe("server");
-  });
-});
-
-// The self-heal must be ATOMIC. Reading `unset` and replaying the local answer
-// are two requests; without a server-side condition another device could record
-// a real opt-out in between and the replay would clobber it.
-describe("collectAndSendTelemetry — self-heal is conditional", () => {
-  let env: TestEnv;
-  beforeEach(() => {
-    env = setupEnv();
-  });
-  afterEach(() => teardownEnv(env));
-
-  it("asks the server to write ONLY if the consent is still unset", async () => {
-    fs.writeFileSync(
-      env.menubarPath,
-      JSON.stringify({ telemetryEnabled: true, telemetryOptInPersonUid: CALLER }),
-    );
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-    });
-
-    await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSetOpts[0]).toMatchObject({ onlyIfUnset: true });
-  });
-
-  it("defers to the server when the conditional write loses the race", async () => {
-    // A real answer was recorded elsewhere between our GET and our POST.
-    fs.writeFileSync(
-      env.menubarPath,
-      JSON.stringify({ telemetryEnabled: true, telemetryOptInPersonUid: CALLER }),
-    );
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-      setOptInApplied: false,
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    // The stale local `true` must NOT win over the answer that landed first.
-    expect(result.enabled).toBe(false);
-    expect(result.optInSource).toBe("server");
-  });
-});
-
-// The cached consent lives in a per-MACHINE file. If two people sign in under
-// the same OS user it holds whoever answered LAST, so replaying it for a
-// different account would opt in someone who never consented.
-describe("collectAndSendTelemetry — consent replay is account-scoped", () => {
-  let env: TestEnv;
-  beforeEach(() => {
-    env = setupEnv();
-  });
-  afterEach(() => teardownEnv(env));
-
-  it("does NOT replay a cached answer belonging to a different account", async () => {
-    fs.writeFileSync(
-      env.menubarPath,
-      JSON.stringify({ telemetryEnabled: true, telemetryOptInPersonUid: "prs_01SOMEONE_ELSE" }),
-    );
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([]);
-    expect(result.enabled).toBe(false);
-  });
-
-  it("does NOT replay a legacy record with no account binding", async () => {
-    // Written before consent was bound to an account — we cannot prove whose
-    // answer it is, so the installer's post-sign-in upload is the recovery path.
-    fs.writeFileSync(env.menubarPath, JSON.stringify({ telemetryEnabled: true }));
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true, personUid: CALLER },
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([]);
-    expect(result.enabled).toBe(false);
-  });
-
-  it("does NOT replay when the server cannot say who the caller is", async () => {
-    fs.writeFileSync(
-      env.menubarPath,
-      JSON.stringify({ telemetryEnabled: true, telemetryOptInPersonUid: CALLER }),
-    );
-    // Older server: no `personUid`, so the match cannot be proven.
-    const client = makeClient({
-      optInResponse: { enabled: false, updatedAt: null, unset: true },
-    });
-
-    const result = await collectAndSendTelemetry(makeOpts(env, client));
-
-    expect(client.optInSets).toEqual([]);
-    expect(result.enabled).toBe(false);
-  });
-});