@remnic/core 9.4.2 → 9.6.0

package/src/cli-wearables-fuse.test.ts

@@ -0,0 +1,197 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  registerCli,
+  type CliApi,
+  type CliCommand,
+  type CliProgram,
+} from "./cli.js";
+import type { WearablesService } from "./wearables/service.js";
+
+/**
+ * Host-CLI registration test for the wearables `fuse`/`fused` subcommands.
+ *
+ * The shared runner (`runWearablesCliCommand`) already handles fuse/fused, but
+ * the host CLI must ALSO register forwarders under `wearablesCmd` — otherwise
+ * commander rejects `remnic wearables fuse <date>` / `remnic wearables fused
+ * <date>` as unknown subcommands before the runner is ever reached (issue
+ * #1849). This drives `registerCli` with a recording program mock plus a stub
+ * orchestrator and asserts both that the subcommands are registered and that
+ * their actions dispatch into the runner (which calls the wearables service).
+ */
+
+/** Recording commander stand-in: records the command tree + action callbacks. */
+class RecCmd implements CliCommand {
+  readonly children = new Map<string, RecCmd>();
+  readonly options: string[] = [];
+  readonly args: string[] = [];
+  actionFn?: (...args: unknown[]) => unknown;
+  constructor(readonly rawName: string) {}
+  description(): CliCommand {
+    return this;
+  }
+  option(flags: string): CliCommand {
+    this.options.push(flags);
+    return this;
+  }
+  requiredOption(flags: string): CliCommand {
+    this.options.push(flags);
+    return this;
+  }
+  argument(name: string): CliCommand {
+    this.args.push(name);
+    return this;
+  }
+  action(fn: (...args: unknown[]) => Promise<void> | void): CliCommand {
+    this.actionFn = fn;
+    return this;
+  }
+  command(name: string): CliCommand {
+    const key = name.split(/\s+/)[0]!;
+    const child = new RecCmd(name);
+    this.children.set(key, child);
+    return child;
+  }
+}
+
+class RecProgram implements CliProgram {
+  readonly root = new RecCmd("__program__");
+  command(name: string): CliCommand {
+    return this.root.command(name);
+  }
+}
+
+/**
+ * Deterministic orchestrator stub. registerCli only reads `config.*` while
+ * building the command tree (feature flags gate subcommand registration;
+ * memoryDir is an option default), so every accessed field returns a real
+ * primitive — no Proxy ever reaches a string/number call site. The wearables
+ * forwarder is the only action that touches the stub, via getWearablesService.
+ */
+function makeOrchestratorStub(
+  service: WearablesService,
+): Parameters<typeof registerCli>[1] {
+  const config = new Proxy(
+    { memoryDir: "/tmp/cli-wearables-fuse-test" } as Record<string, unknown>,
+    {
+      get(target, prop) {
+        if (typeof prop === "symbol") return undefined;
+        if (prop in target) return target[prop as string];
+        const key = prop as string;
+        if (
+          key.endsWith("WindowMs") ||
+          key.endsWith("SoftLimit") ||
+          key.endsWith("HardLimit")
+        ) {
+          return 0;
+        }
+        return true; // feature flags -> enabled (every subcommand registers)
+      },
+    },
+  );
+  return { config, getWearablesService: () => service } as unknown as Parameters<
+    typeof registerCli
+  >[1];
+}
+
+/** Spy service recording fuseDay/fusedConversations dispatch. */
+function spyService(): WearablesService & {
+  calls: Array<[string, string]>;
+} {
+  const calls: Array<[string, string]> = [];
+  const svc = {
+    fuseDay: async (date: string) => {
+      calls.push(["fuseDay", date]);
+      return {
+        date,
+        sources: ["limitless", "bee"],
+        conversationCount: 2,
+        contentHash: "h",
+        written: true,
+      };
+    },
+    fusedConversations: async (date: string) => {
+      calls.push(["fusedConversations", date]);
+      return [];
+    },
+  };
+  return { ...svc, calls } as unknown as WearablesService & {
+    calls: Array<[string, string]>;
+  };
+}
+
+function buildRegisteredTree(): {
+  program: RecProgram;
+  wearables: RecCmd;
+  service: WearablesService & { calls: Array<[string, string]> };
+} {
+  const program = new RecProgram();
+  const service = spyService();
+  const api: CliApi = {
+    registerCli: (handler) => handler({ program }),
+  };
+  registerCli(api, makeOrchestratorStub(service));
+  const wearables = program.root.children.get("engram")?.children.get("wearables");
+  assert.ok(wearables, "wearables command registered under engram");
+  return { program, wearables: wearables!, service };
+}
+
+test("wearablesCmd registers fuse and fused subcommands (#1849)", () => {
+  const { wearables } = buildRegisteredTree();
+  // fuse/fused must be present alongside the previously-registered forwarders.
+  const subcommands = [...wearables.children.keys()];
+  for (const expected of [
+    "status",
+    "check",
+    "sync",
+    "transcript",
+    "search",
+    "memories",
+    "speakers",
+    "corrections",
+    "fuse",
+    "fused",
+  ]) {
+    assert.ok(
+      subcommands.includes(expected),
+      `wearables ${expected} subcommand registered`,
+    );
+  }
+
+  const fuse = wearables.children.get("fuse")!;
+  assert.ok(
+    fuse.rawName.includes("<date>"),
+    "fuse declares a <date> argument",
+  );
+  assert.ok(fuse.options.includes("--json"), "fuse forwards --json");
+
+  const fused = wearables.children.get("fused")!;
+  assert.ok(
+    fused.rawName.includes("<date>"),
+    "fused declares a <date> argument",
+  );
+  assert.ok(fused.options.includes("--json"), "fused forwards --json");
+});
+
+test("wearables fuse/fused forwarders dispatch to the runner, not rejected (#1849)", async () => {
+  const { wearables, service } = buildRegisteredTree();
+  const fuse = wearables.children.get("fuse")!;
+  const fused = wearables.children.get("fused")!;
+
+  // commander passes the <date> positional as arg[0] and the options object
+  // as the trailing arg — the same shape the `search <query>` forwarder uses.
+  await fuse.actionFn!("2026-06-10", { json: false });
+  assert.deepEqual(
+    service.calls[0],
+    ["fuseDay", "2026-06-10"],
+    "wearables fuse <date> dispatches into the runner -> service.fuseDay",
+  );
+
+  await fused.actionFn!("2026-06-10", { json: true });
+  assert.deepEqual(
+    service.calls[1],
+    ["fusedConversations", "2026-06-10"],
+    "wearables fused <date> dispatches into the runner -> service.fusedConversations",
+  );
+});

package/src/cli.ts

@@ -5376,6 +5376,31 @@ export function registerCli(
           .action(async (...args: unknown[]) =>
             forwardWearables(["corrections", "remove", String(args[0] ?? "")]),
           );
+        wearablesCmd
+          .command("fuse <date>")
+          .description("Fuse (cross-source merge) wearable transcripts for a day")
+          .option("--json", "JSON output")
+          .action(async (...args: unknown[]) => {
+            const options = (args[1] ?? {}) as Record<string, unknown>;
+            await forwardWearables([
+              "fuse",
+              String(args[0] ?? ""),
+              ...(options.json === true ? ["--json"] : []),
+            ]);
+          });
+
+        wearablesCmd
+          .command("fused <date>")
+          .description("List fused conversations for a day")
+          .option("--json", "JSON output")
+          .action(async (...args: unknown[]) => {
+            const options = (args[1] ?? {}) as Record<string, unknown>;
+            await forwardWearables([
+              "fused",
+              String(args[0] ?? ""),
+              ...(options.json === true ? ["--json"] : []),
+            ]);
+          });
       }
 
       cmd

package/src/index.ts

@@ -992,6 +992,20 @@ export {
   type TokenStore,
 } from "./tokens.js";
 
+export {
+  TOKEN_CAPABILITIES_VERSION,
+  capabilityAllowsNamespace,
+  capabilityAllowsOp,
+  isCapabilityRestricted,
+  isValidNamespaceValue,
+  normalizeCapabilities,
+  tokenCapabilityStore,
+  validateCapabilitiesForMint,
+  type TokenCapabilities,
+} from "./access-token-capabilities.js";
+
+export { OPERATION_NAMES, type OperationName } from "./access-boundary.js";
+
 // ---------------------------------------------------------------------------
 // Codex materializer (#378)
 // ---------------------------------------------------------------------------

package/src/mcp-read-only-tools.ts

@@ -0,0 +1,61 @@
+/**
+ * Conservative allowlist of canonical MCP tool suffixes that are
+ * unambiguously read-only. Tools in this set are tagged with
+ * `annotations: { readOnlyHint: true }` so ChatGPT (and other MCP
+ * clients that honor the hint) can skip per-call confirmation.
+ *
+ * The list is suffix-based so it covers both the `remnic.*` and
+ * `engram.*` naming forms. Anything not on it stays unannotated:
+ * uncertainty is resolved as "might mutate".
+ *
+ * Excluded by construction: anything that writes, runs a pipeline,
+ * flushes, applies, records, imports, or destructively deletes.
+ */
+export const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {
+  recall: true,
+  recall_explain: true,
+  recall_tier_explain: true,
+  recall_xray: true,
+  briefing: true,
+  wearables_status: true,
+  transcript_day: true,
+  transcript_search: true,
+  transcript_memories: true,
+  action_confidence: true,
+  capsule_list: true,
+  procedural_stats: true,
+  memory_get: true,
+  memory_timeline: true,
+  entity_get: true,
+  review_queue_list: true,
+  lcm_search: true,
+  continuity_incident_list: true,
+  identity_anchor_get: true,
+  memory_identity: true,
+  memory_search: true,
+  memory_profile: true,
+  memory_entities_list: true,
+  memory_questions: true,
+  memory_last_recall: true,
+  memory_intent_debug: true,
+  memory_qmd_debug: true,
+  memory_graph_explain: true,
+  graph_snapshot: true,
+  review_list: true,
+  profiling_report: true,
+  peer_list: true,
+  peer_get: true,
+  peer_profile_get: true,
+  console_state: true,
+  dreams_status: true,
+  codegraph_list_projects: true,
+  codegraph_index_status: true,
+  codegraph_search_graph: true,
+  codegraph_trace_path: true,
+  codegraph_detect_changes: true,
+  codegraph_query_graph: true,
+  codegraph_get_schema: true,
+  codegraph_get_snippet: true,
+  codegraph_get_architecture: true,
+  codegraph_search_code: true,
+};

package/src/storage.ts

@@ -23,6 +23,7 @@ import { serializeProvenanceFields, parseProvenanceSources, parseProvenanceTag,
 import { serializeFaithfulnessFields, parseFaithfulnessField } from "./extraction-faithfulness.js";
 import { createVersion as createPageVersion, type VersioningConfig, type VersionTrigger } from "./page-versioning.js";
 import { isValidTranscriptDate, WEARABLES_DIR_NAME } from "./wearables/day-store.js";
+import { FusionArtifactStore } from "./wearables/fusion/index.js";
 import {
   SecureStoreLockedError,
   MAGIC_HEADER_SIZE,
@@ -2709,6 +2710,21 @@ export class StorageManager {
     );
   }
 
+  private _fusionStore?: FusionArtifactStore;
+
+  /** Derived fusion-day IO; file IO lives in wearables/fusion (#1810). */
+  fusionArtifactStore(): FusionArtifactStore {
+    if (this._fusionStore) return this._fusionStore;
+    return (this._fusionStore = new FusionArtifactStore(this.wearablesDir, this.baseDir, {
+      writeFile: (p, c) => this.writeStorageSecureFile(p, c),
+      readFile: (p) => readMaybeEncryptedFile(p, this._secureStoreKey, this.baseDir),
+      readDir: (d) => readdir(d),
+      deleteFile: (p) => unlink(p),
+      realpath: (p) => realpath(p),
+      lstat: (p) => lstat(p).then((st) => ({ isSymbolicLink: st.isSymbolicLink() })),
+    }));
+  }
+
   /**
    * Locate a wearable-sourced memory by exact (trimmed) content,
    * ignoring the "[Attributes: ...]" suffix writeMemory appends for

package/src/tokens.ts

@@ -9,11 +9,27 @@ import fs from "node:fs";
 import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { resolveHomeDir } from "./runtime/env.js";
+import {
+  TOKEN_CAPABILITIES_VERSION,
+  normalizeCapabilities,
+  type TokenCapabilities,
+} from "./access-token-capabilities.js";
 
 export interface TokenEntry {
   token: string;
   connector: string;
   createdAt: string;
+  /**
+   * Versioned capabilities record (issue #1837). PRESENT ⇒ the token was
+   * minted by the capability-aware path; its ops/namespaces axes are
+   * enforced (absent axis ⇒ unrestricted on that axis; empty array ⇒ deny
+   * all; non-empty ⇒ allow-list). ABSENT ⇒ a pre-feature legacy entry ⇒
+   * unrestricted (full access), purely for backward compatibility — this is
+   * the ONLY path by which full access is granted by omission. Every new
+   * token carries an explicit record (even `{ version: 1 }` for a deliberate
+   * unrestricted mint), so a new token can never silently gain full access.
+   */
+  capabilities?: TokenCapabilities;
 }
 
 export interface TokenStore {
@@ -75,6 +91,9 @@ function validateTokenEntry(raw: unknown, index: number): TokenEntry {
   if (typeof entry.connector !== "string" || entry.connector.length === 0) {
     throw new Error(`invalid token entry at index ${index}: connector must be a non-empty string`);
   }
+  const capabilities = entry.capabilities !== undefined
+    ? normalizeCapabilities(entry.capabilities)
+    : undefined;
   return {
     token: entry.token,
     connector: entry.connector,
@@ -82,6 +101,7 @@ function validateTokenEntry(raw: unknown, index: number): TokenEntry {
       typeof entry.createdAt === "string" && entry.createdAt.length > 0
         ? entry.createdAt
         : new Date(0).toISOString(),
+    ...(capabilities ? { capabilities } : {}),
   };
 }
 
@@ -201,13 +221,18 @@ export function saveTokenStore(store: TokenStore, tokensPath?: string): void {
  * dependent write (e.g. Hermes config.yaml) succeeds — see
  * commitTokenEntry() to persist the candidate.
  */
-export function buildTokenEntry(connector: string): TokenEntry {
+export function buildTokenEntry(connector: string, capabilities?: TokenCapabilities): TokenEntry {
   const prefix = TOKEN_PREFIXES[connector] ?? "remnic_xx_";
   const token = prefix + randomBytes(24).toString("hex");
+  // Every newly-built entry carries an EXPLICIT capabilities record (issue
+  // #1837). When none is requested, record a deliberate unrestricted
+  // `{ version: 1 }` — never an omitted field — so "full access via omission"
+  // is reachable only by pre-feature legacy entries lacking the marker.
   return {
     token,
     connector,
     createdAt: new Date().toISOString(),
+    capabilities: capabilities ?? { version: TOKEN_CAPABILITIES_VERSION },
   };
 }
 
@@ -230,13 +255,17 @@ export function commitTokenEntry(entry: TokenEntry, tokensPath?: string): void {
   saveTokenStore(store, tokensPath);
 }
 
-export function generateToken(connector: string, tokensPath?: string): TokenEntry {
+export function generateToken(
+  connector: string,
+  tokensPath?: string,
+  capabilities?: TokenCapabilities,
+): TokenEntry {
   const store = loadTokenStore(tokensPath);
 
   // Remove existing token for this connector
   store.tokens = store.tokens.filter((t) => t.connector !== connector);
 
-  const entry = buildTokenEntry(connector);
+  const entry = buildTokenEntry(connector, capabilities);
   store.tokens.push(entry);
   saveTokenStore(store, tokensPath);
   return entry;

package/src/wearables/cli.test.ts

@@ -198,3 +198,105 @@ test("backend faults propagate instead of being swallowed as exit codes", async
     /disk exploded/,
   );
 });
+
+test("fuse command requires a date and renders the fuseDay result", async () => {
+  const { io, out, err } = makeIo();
+  const service = stubService({
+    fuseDay: async () => ({
+      date: "2026-06-10",
+      sources: ["bee", "limitless"],
+      conversationCount: 2,
+      contentHash: "abc123",
+      written: true,
+    }),
+  });
+  assert.equal(await runWearablesCliCommand(service, ["fuse"], io), 1);
+  assert.match(err.join(""), /fuse requires a date/);
+
+  // Success path needs its own captured stdout.
+  const okIo = makeIo();
+  assert.equal(
+    await runWearablesCliCommand(service, ["fuse", "2026-06-10"], okIo.io),
+    0,
+  );
+  assert.match(
+    okIo.out.join(""),
+    /Fused 2026-06-10: 2 conversations from 2 sources/,
+  );
+});
+
+test("fuse command prints a distinct skip line when fusion is skipped, not '(unchanged)'", async () => {
+  // written:false has two meanings (issue #1849): a skip (e.g. conflicting
+  // source timezones, which also clears any existing fused artifact) must
+  // NOT be mislabeled as an idempotent "(unchanged)" no-op.
+  const { io, out } = makeIo();
+  const service = stubService({
+    fuseDay: async () => ({
+      date: "2026-06-10",
+      sources: [],
+      conversationCount: 0,
+      contentHash: "",
+      written: false,
+      skipped: { reason: "conflicting-timezones" },
+    }),
+  });
+  assert.equal(await runWearablesCliCommand(service, ["fuse", "2026-06-10"], io), 0);
+  const text = out.join("");
+  assert.match(text, /Skipped fusing 2026-06-10: conflicting-timezones/);
+  assert.match(text, /cleared/);
+  assert.doesNotMatch(text, /unchanged/, "a skip must not look idempotent");
+});
+
+test("fuse command keeps '(unchanged)' for written:false without a skip reason", async () => {
+  const { io, out } = makeIo();
+  const service = stubService({
+    fuseDay: async () => ({
+      date: "2026-06-10",
+      sources: ["bee", "limitless"],
+      conversationCount: 2,
+      contentHash: "abc123",
+      written: false,
+    }),
+  });
+  assert.equal(await runWearablesCliCommand(service, ["fuse", "2026-06-10"], io), 0);
+  assert.match(out.join(""), /\(unchanged\)/);
+});
+
+test("fused command lists conversations and surfaces disagreements (--json)", async () => {
+  const { io, out } = makeIo();
+  const service = stubService({
+    fusedConversations: async () => [
+      {
+        id: "fusion-1",
+        date: "2026-06-10",
+        startIso: "2026-06-10T09:00:00.000Z",
+        sources: ["bee", "limitless"],
+        speakers: [],
+        segments: [
+          { speaker: "Me (you)", isSelf: true, text: "hi", confidence: 0.8, provenance: { source: "limitless", conversationId: "c1", sourceTrust: 0.8, reason: "only-source", alternatives: [] } },
+        ],
+        disagreements: [
+          { kind: "asr-text", subject: "2026-06-10T09:00:00.000Z", candidates: [{ source: "bee", value: "x" }, { source: "limitless", value: "y" }] },
+        ],
+        provenance: { contributions: [], proximityGapMs: 300000, windowToleranceMs: 30000, method: "time-proximity" },
+      },
+    ],
+  });
+  assert.equal(await runWearablesCliCommand(service, ["fused", "2026-06-10", "--json"], io), 0);
+  const parsed = JSON.parse(out.join(""));
+  assert.equal(parsed.date, "2026-06-10");
+  assert.equal(parsed.conversations.length, 1);
+  assert.equal(parsed.conversations[0].disagreements.length, 1);
+
+  // Plain-text path surfaces the disagreement count.
+  const text = makeIo();
+  assert.equal(await runWearablesCliCommand(service, ["fused", "2026-06-10"], text.io), 0);
+  assert.match(text.out.join(""), /disagreement \[asr-text\]/);
+});
+
+test("fused command reports nothing-fused gracefully", async () => {
+  const { io, out } = makeIo();
+  const service = stubService({ fusedConversations: async () => [] });
+  assert.equal(await runWearablesCliCommand(service, ["fused", "2026-06-10"], io), 0);
+  assert.match(out.join(""), /No fused conversations for 2026-06-10/);
+});

package/src/wearables/cli.ts

@@ -33,6 +33,8 @@ Commands:
     --source <id>  --from <date>  --to <date>  --limit <n>
   memories [options]             List memories created from transcripts
     --source <id>  --date <date>  --limit <n>
+  fuse <YYYY-MM-DD>              Fuse enabled sources' transcripts for a day
+  fused <YYYY-MM-DD>             List fused conversations for a day
   speakers list                  Show the speaker registry
   speakers self <name>           Set the wearer's display name
   speakers set <source> <key> <name> [--self]
@@ -419,6 +421,69 @@ export async function runWearablesCliCommand(
           `unknown corrections action '${action}' — expected list, add, or remove`,
         );
       }
+      case "fuse": {
+        const parsed = parseFlags(rest);
+        const date = flagString(parsed, "--date") ?? parsed.positional[0];
+        if (!date) {
+          throw new WearablesInputError(
+            "fuse requires a date (e.g. wearables fuse 2026-06-10)",
+          );
+        }
+        const result = await service.fuseDay(date);
+        if (parsed.flags.has("--json")) {
+          io.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+          return 0;
+        }
+        // `written:false` has two distinct meanings (issue #1849): a genuine
+        // idempotent no-op (inputs unchanged) OR a deliberate SKIP — e.g.
+        // mixed source timezones — where fusion was refused and any
+        // previously-fused artifact for the day was cleared. The JSON path
+        // carries `skipped`, but the text path collapsed both into
+        // "(unchanged)", hiding a skip (and a possible artifact deletion)
+        // behind an idempotent-looking label. Check `skipped` first and emit
+        // a distinct skip line; reserve "(unchanged)" for written:false
+        // WITHOUT a skip reason. Mirrors the `skipped` field the JSON path
+        // serializes.
+        if (result.skipped) {
+          io.stdout.write(
+            `Skipped fusing ${date}: ${result.skipped.reason} — no fused artifact written; any existing fused artifact for the day was cleared.\n`,
+          );
+        } else {
+          io.stdout.write(
+            `Fused ${date}: ${result.conversationCount} conversation${result.conversationCount === 1 ? "" : "s"} from ${result.sources.length} source${result.sources.length === 1 ? "" : "s"}.${result.written ? "" : " (unchanged)"}\n`,
+          );
+        }
+        return 0;
+      }
+      case "fused": {
+        const parsed = parseFlags(rest);
+        const date = flagString(parsed, "--date") ?? parsed.positional[0];
+        if (!date) {
+          throw new WearablesInputError(
+            "fused requires a date (e.g. wearables fused 2026-06-10)",
+          );
+        }
+        const conversations = await service.fusedConversations(date);
+        if (parsed.flags.has("--json")) {
+          io.stdout.write(`${JSON.stringify({ date, conversations }, null, 2)}\n`);
+          return 0;
+        }
+        if (conversations.length === 0) {
+          io.stdout.write(`No fused conversations for ${date}.\n`);
+          return 0;
+        }
+        for (const conv of conversations) {
+          io.stdout.write(
+            `${conv.id} ${conv.startIso}${conv.endIso ? ` \u2013 ${conv.endIso}` : ""} (${conv.sources.join(", ")}, ${conv.segments.length} segment${conv.segments.length === 1 ? "" : "s"})\n`,
+          );
+          for (const disagreement of conv.disagreements) {
+            io.stdout.write(
+              `  disagreement [${disagreement.kind}] @ ${disagreement.subject}: ${disagreement.candidates.length} candidate${disagreement.candidates.length === 1 ? "" : "s"}\n`,
+            );
+          }
+        }
+        return 0;
+      }
       default:
         throw new WearablesInputError(
           `unknown wearables command '${command}'\n\n${USAGE}`,

package/src/wearables/config.test.ts

@@ -245,3 +245,35 @@ test("a deep window narrower than the tick window is rejected, 0 disables", () =
     5,
   );
 });
+
+
+test("fusion defaults to disabled with documented knobs", () => {
+  const parsed = parseWearablesConfig({});
+  assert.equal(parsed.fusion.enabled, false);
+  assert.equal(parsed.fusion.proximityGapMs, 300_000);
+  assert.equal(parsed.fusion.windowToleranceMs, 30_000);
+});
+
+test("fusion enabled flag and knobs parse and validate", () => {
+  const parsed = parseWearablesConfig({
+    fusion: { enabled: true, proximityGapMs: 120_000, windowToleranceMs: 15_000 },
+  });
+  assert.equal(parsed.fusion.enabled, true);
+  assert.equal(parsed.fusion.proximityGapMs, 120_000);
+  assert.equal(parsed.fusion.windowToleranceMs, 15_000);
+});
+
+test("fusion knobs reject non-positive integers", () => {
+  assert.throws(
+    () => parseWearablesConfig({ fusion: { proximityGapMs: 0 } }),
+    /proximityGapMs must be a positive integer/,
+  );
+  assert.throws(
+    () => parseWearablesConfig({ fusion: { windowToleranceMs: -5 } }),
+    /windowToleranceMs must be a positive integer/,
+  );
+});
+
+test("fusion block must be an object when present", () => {
+  assert.throws(() => parseWearablesConfig({ fusion: "on" }), /must be an object/);
+});