@vellumai/assistant 0.10.2-dev.202606250318.5e7cfb0 → 0.10.2

package/src/runtime/routes/surface-action-routes.ts

@@ -9,17 +9,23 @@
  */
 import { z } from "zod";
 
+import type { ChannelId } from "../../channels/types.js";
 import { isHttpAuthDisabled } from "../../config/env.js";
-import type { TrustContext } from "../../daemon/trust-context.js";
+import { findGuardianForChannel } from "../../contacts/contact-store.js";
 import { getLogger } from "../../util/logger.js";
+import type { TrustClass } from "../actor-trust-resolver.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { processGuardianDecision } from "../guardian-action-service.js";
-import { reResolveTrustOnResetDrift } from "../guardian-vellum-migration.js";
+import { healGuardianBindingDrift } from "../guardian-vellum-migration.js";
 import {
-  findLocalGuardianPrincipalId,
   resolveActorPrincipalIdForLocalGuardian,
+  resolveLocalTrustContext,
 } from "../local-actor-identity.js";
-import { resolveLocalPrincipalTrustContext } from "../local-principal-trust.js";
+import {
+  resolveTrustContext,
+  withSourceChannel,
+} from "../trust-context-resolver.js";
 import { parseCallbackData } from "./channel-route-shared.js";
 import {
   BadRequestError,
@@ -37,51 +43,58 @@ const log = getLogger("surface-action-routes");
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve trust context for the actor principal from the gateway guardian
- * binding and set it on the conversation. A vellum principal is the guardian or
- * nobody, so the mapper yields guardian or unknown.
+ * Resolve trust context from the actor principal ID and set it on the
+ * conversation, following the same pattern as POST /v1/messages. This ensures
+ * surface actions inherit the correct trust class (guardian vs trusted_contact)
+ * rather than defaulting to unknown.
  */
-async function applyTrustContext(
+function applyTrustContext(
   conversation: {
-    setTrustContext?(ctx: TrustContext): void;
+    setTrustContext?(ctx: {
+      trustClass: TrustClass;
+      sourceChannel: ChannelId;
+    }): void;
   },
   actorPrincipalId: string | undefined,
-): Promise<void> {
+): void {
   if (!conversation.setTrustContext) return;
 
   const sourceChannel = "vellum";
 
-  if (!actorPrincipalId) {
-    conversation.setTrustContext({ trustClass: "guardian", sourceChannel });
-    return;
-  }
-
-  // Dev-bypass injects a synthetic principal that won't match the real
-  // guardian binding, so resolve the actual guardian principalId (gateway
-  // first, local store fallback) before mapping trust.
-  let principalId = actorPrincipalId;
-  if (isHttpAuthDisabled() && actorPrincipalId === "dev-bypass") {
-    principalId = (await findLocalGuardianPrincipalId()) ?? actorPrincipalId;
-  }
-
-  let trustCtx = await resolveLocalPrincipalTrustContext({
-    actorPrincipalId: principalId,
-    sourceChannel,
-    conversationExternalId: "local",
-  });
-  if (trustCtx.trustClass === "unknown") {
-    const healed = await reResolveTrustOnResetDrift(principalId, sourceChannel);
-    if (healed) {
-      trustCtx = healed;
-      if (healed.trustClass !== "unknown") {
-        log.info(
-          { actorPrincipalId: principalId, trustClass: trustCtx.trustClass },
-          "Trust re-resolved from local mirror after gateway reset drift (surface action)",
-        );
+  if (actorPrincipalId) {
+    if (isHttpAuthDisabled() && actorPrincipalId === "dev-bypass") {
+      conversation.setTrustContext(resolveLocalTrustContext(sourceChannel));
+    } else {
+      const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
+      let trustCtx = resolveTrustContext({
+        assistantId,
+        sourceChannel,
+        conversationExternalId: "local",
+        actorExternalId: actorPrincipalId,
+      });
+      if (trustCtx.trustClass === "unknown") {
+        const healed = healGuardianBindingDrift(actorPrincipalId);
+        if (healed) {
+          trustCtx = resolveTrustContext({
+            assistantId,
+            sourceChannel,
+            conversationExternalId: "local",
+            actorExternalId: actorPrincipalId,
+          });
+          log.info(
+            {
+              actorPrincipalId,
+              trustClass: trustCtx.trustClass,
+            },
+            "Trust re-resolved after guardian binding drift heal (surface action)",
+          );
+        }
       }
+      conversation.setTrustContext(withSourceChannel(sourceChannel, trustCtx));
     }
+  } else {
+    conversation.setTrustContext({ trustClass: "guardian", sourceChannel });
   }
-  conversation.setTrustContext(trustCtx);
 }
 
 // ---------------------------------------------------------------------------
@@ -119,15 +132,16 @@ async function handleSurfaceAction({
   const aprDecision = parseCallbackData(actionId, "vellum");
   if (aprDecision) {
     // Resolve the actor's guardian principal ID. In dev mode the synthetic
-    // "dev-bypass" principal won't match the real guardian binding, so resolve
-    // the local guardian principal — mirrors guardian-action-routes.ts.
+    // "dev-bypass" principal won't match the real guardian binding, so fall
+    // back to the local guardian binding — mirrors guardian-action-routes.ts.
     let guardianPrincipalId: string | undefined =
       headers?.["x-vellum-actor-principal-id"] ?? undefined;
     if (
       isHttpAuthDisabled() &&
       headers?.["x-vellum-actor-principal-id"] === "dev-bypass"
     ) {
-      guardianPrincipalId = (await findLocalGuardianPrincipalId()) ?? undefined;
+      const binding = findGuardianForChannel("vellum");
+      guardianPrincipalId = binding?.contact.principalId ?? undefined;
     }
 
     const result = await processGuardianDecision({
@@ -175,7 +189,7 @@ async function handleSurfaceAction({
   }
 
   const actorPrincipalId = headers?.["x-vellum-actor-principal-id"];
-  await applyTrustContext(conversation, actorPrincipalId);
+  applyTrustContext(conversation, actorPrincipalId);
 
   // Translate dev-bypass → real guardian so the surface turn's principal matches
   // the SSE host-proxy client's registered principal; otherwise CU/app-control

package/src/runtime/services/__tests__/conversation-serializer.test.ts

@@ -48,7 +48,6 @@ function makeConversationRow(
     inferenceProfileSessionId: null,
     inferenceProfileExpiresAt: null,
     lastNotifiedInferenceProfile: null,
-    processingStartedAt: null,
     ...overrides,
   };
 }

package/src/runtime/services/conversation-serializer.ts

@@ -9,6 +9,7 @@
 
 import { parseChannelId } from "../../channels/types.js";
 import { getConfig } from "../../config/loader.js";
+import { findConversation } from "../../daemon/conversation-registry.js";
 import { normalizeConversationType } from "../../daemon/message-types/shared.js";
 import {
   type AttentionState,
@@ -20,7 +21,6 @@ import {
   type ConversationRow,
   getConversation,
   getDisplayMetaForConversations,
-  isConversationProcessing,
 } from "../../memory/conversation-crud.js";
 import type { ExternalConversationBinding } from "../../memory/external-conversation-store.js";
 import { getBindingsForConversations } from "../../memory/external-conversation-store.js";
@@ -196,9 +196,9 @@ export function serializeConversationSummary(params: {
   parentCache: Map<string, ConversationRow | null>;
   /**
    * Whether the agent loop is currently mid-turn for this conversation.
-   * Resolved by `isConversationProcessing(id)`, which checks the in-memory
-   * daemon flag first and falls back to the persisted
-   * `processing_started_at` column for cold conversations. Plumbed in
+   * Sourced from the in-memory daemon `Conversation.isProcessing()` flag
+   * — callers resolve via `findConversation(id)?.isProcessing() ?? false`
+   * so cold (evicted / never-loaded) rows report `false`. Plumbed in
    * rather than read here so the serializer stays a pure shape mapper
    * with no daemon-store coupling.
    */
@@ -286,9 +286,11 @@ export function buildConversationDetailResponse(
       attentionState: attentionStates.get(conversation.id),
       displayMeta: displayMeta.get(conversation.id),
       parentCache,
-      // Checks in-memory flag first (hot path), falls back to the
-      // persisted `processing_started_at` column for cold conversations.
-      isProcessing: isConversationProcessing(conversation.id),
+      // Cold (evicted / never-loaded) rows aren't in the in-memory
+      // store, so `findConversation` returns `undefined` and they
+      // report `isProcessing: false` — by definition they aren't
+      // mid-turn since the agent loop only runs on resident convs.
+      isProcessing: findConversation(conversation.id)?.isProcessing() ?? false,
     }),
   };
 }

package/src/runtime/tool-grant-request-helper.ts

@@ -59,9 +59,9 @@ export type ToolGrantRequestResult =
  * Returns a result indicating whether a new request was created, an existing
  * one was deduped, or the escalation failed (no binding, missing identity).
  */
-export async function createOrReuseToolGrantRequest(
+export function createOrReuseToolGrantRequest(
   params: ToolGrantRequestParams,
-): Promise<ToolGrantRequestResult> {
+): ToolGrantRequestResult {
   const {
     assistantId,
     sourceChannel,
@@ -78,7 +78,7 @@ export async function createOrReuseToolGrantRequest(
     return { failed: true, reason: "missing_identity" };
   }
 
-  const binding = await getGuardianBinding(assistantId, sourceChannel);
+  const binding = getGuardianBinding(assistantId, sourceChannel);
   if (!binding) {
     log.debug(
       { sourceChannel, assistantId },

package/src/runtime/trust-verdict-consumer.ts

@@ -33,17 +33,16 @@ export interface TrustVerdictTransport {
 }
 
 /**
- * Reassemble an {@link ActorTrustContext} from a gateway verdict + transport
- * identity (mirroring `resolveActorTrust`), without any local DB/IPC reads.
+ * Build a {@link TrustContext} from a gateway verdict + transport identity.
  *
- * Pure: the voice path consumes this directly for routing on
- * `actorTrust.trustClass`; {@link trustContextFromVerdict} routes it through
- * {@link toTrustContext}.
+ * Reassembles an {@link ActorTrustContext} (mirroring `resolveActorTrust`) and
+ * routes it through {@link toTrustContext}, so the output is byte-identical to
+ * the local resolution path.
  */
-export function actorTrustContextFromVerdict(
+export function trustContextFromVerdict(
   verdict: TrustVerdict,
   input: TrustVerdictTransport,
-): ActorTrustContext {
+): TrustContext {
   const canonicalSenderId = verdict.canonicalSenderId;
   const memberDisplayName = verdict.memberDisplayName;
   const senderDisplayName = input.actorDisplayName;
@@ -52,7 +51,7 @@ export function actorTrustContextFromVerdict(
     ? `@${username}`
     : (canonicalSenderId ?? undefined);
 
-  return {
+  const actorTrustContext: ActorTrustContext = {
     canonicalSenderId,
     guardianBindingMatch: verdict.guardianExternalUserId
       ? {
@@ -61,12 +60,7 @@ export function actorTrustContextFromVerdict(
         }
       : null,
     guardianPrincipalId: verdict.guardianPrincipalId,
-    // Populate from the verdict so the voice path's ACL gates (which read
-    // actorTrust.memberRecord.channel status/policy) enforce blocked/revoked/
-    // deny/escalate. Null for memberless verdicts. Text path is unaffected:
-    // toTrustContext derives the same member fields trustContextFromVerdict
-    // already stamps.
-    memberRecord: resolvedMemberFromVerdict(verdict),
+    memberRecord: null,
     trustClass: verdict.trustClass,
     actorMetadata: {
       identifier,
@@ -78,21 +72,9 @@ export function actorTrustContextFromVerdict(
       trustStatus: verdict.trustClass,
     },
   };
-}
 
-/**
- * Build a {@link TrustContext} from a gateway verdict + transport identity.
- *
- * Reassembles an {@link ActorTrustContext} (mirroring `resolveActorTrust`) and
- * routes it through {@link toTrustContext}, so the output is byte-identical to
- * the local resolution path.
- */
-export function trustContextFromVerdict(
-  verdict: TrustVerdict,
-  input: TrustVerdictTransport,
-): TrustContext {
   const context = toTrustContext(
-    actorTrustContextFromVerdict(verdict, input),
+    actorTrustContext,
     input.conversationExternalId,
   );
 
@@ -109,26 +91,6 @@ export function trustContextFromVerdict(
   return context;
 }
 
-/**
- * True when the verdict carries a member identity (contactId or channelId),
- * regardless of whether that member resolves to a usable {@link ResolvedMember}.
- */
-export function verdictHasMemberIdentity(verdict: TrustVerdict): boolean {
-  return !!(verdict.contactId || verdict.channelId);
-}
-
-/**
- * True when the verdict claims a member identity but that member can't be
- * synthesized (partial/mixed-version verdict). Such a verdict is unusable —
- * callers fall back to local resolution.
- */
-export function verdictMemberUnresolvable(verdict: TrustVerdict): boolean {
-  return (
-    verdictHasMemberIdentity(verdict) &&
-    resolvedMemberFromVerdict(verdict) === null
-  );
-}
-
 // Allowed ACL enum values, kept in sync with the ContactChannel union types.
 const CHANNEL_STATUS_VALUES: readonly ChannelStatus[] = [
   "active",
@@ -151,44 +113,6 @@ function isChannelPolicy(value: string): value is ChannelPolicy {
   return (CHANNEL_POLICY_VALUES as readonly string[]).includes(value);
 }
 
-/**
- * The ACL fields a gateway verdict carries for a resolved member, decoupled
- * from the schema-derived {@link ContactChannel}.
- */
-export interface VerdictMember {
-  contactId: string;
-  channelId: string;
-  status: ChannelStatus;
-  policy: ChannelPolicy;
-  verifiedAt: number | null;
-  displayName: string | null;
-}
-
-/**
- * Extract the narrow {@link VerdictMember} ACL view from a gateway verdict.
- *
- * Mirrors {@link resolvedMemberFromVerdict}'s guards (contactId/channelId
- * present + known status/policy enums), failing closed to null otherwise.
- */
-export function verdictMemberFromVerdict(
-  verdict: TrustVerdict,
-): VerdictMember | null {
-  if (!verdict.contactId || !verdict.channelId) return null;
-  if (!verdict.status || !verdict.policy) return null;
-  if (!isChannelStatus(verdict.status) || !isChannelPolicy(verdict.policy)) {
-    return null;
-  }
-
-  return {
-    contactId: verdict.contactId,
-    channelId: verdict.channelId,
-    status: verdict.status,
-    policy: verdict.policy,
-    verifiedAt: verdict.verifiedAt ?? null,
-    displayName: verdict.memberDisplayName ?? null,
-  };
-}
-
 /**
  * Build a synthetic {@link ResolvedMember} from a gateway verdict.
  *

package/src/runtime/verification-outbound-actions.ts

@@ -21,7 +21,7 @@ import {
   countRecentSendsToDestination,
   createOutboundSession,
   findActiveSession,
-  isGuardianBoundForChannel,
+  getGuardianBinding,
   updateSessionDelivery,
   updateSessionStatus,
 } from "./channel-verification-service.js";
@@ -224,7 +224,7 @@ export async function startOutbound(
       originConversationId,
     );
   } else if (channel === "phone") {
-    return await startOutboundVoice(
+    return startOutboundVoice(
       params.destination,
       assistantId,
       channel,
@@ -232,7 +232,7 @@ export async function startOutbound(
       originConversationId,
     );
   } else if (channel === "slack") {
-    return await startOutboundSlack(
+    return startOutboundSlack(
       params.destination,
       assistantId,
       channel,
@@ -240,7 +240,7 @@ export async function startOutbound(
       originConversationId,
     );
   } else if (channel === "email") {
-    return await startOutboundEmail(
+    return startOutboundEmail(
       params.destination,
       assistantId,
       channel,
@@ -274,8 +274,8 @@ async function startOutboundTelegram(
     };
   }
 
-  const alreadyBound = await isGuardianBoundForChannel(channel);
-  if (alreadyBound && !rebind) {
+  const existingBinding = getGuardianBinding(assistantId, channel);
+  if (existingBinding && !rebind) {
     return {
       success: false,
       error: "already_bound",
@@ -394,13 +394,13 @@ async function startOutboundTelegram(
   };
 }
 
-async function startOutboundVoice(
+function startOutboundVoice(
   rawDestination: string | undefined,
   assistantId: string,
   channel: ChannelId,
   rebind?: boolean,
   originConversationId?: string,
-): Promise<OutboundActionResult> {
+): OutboundActionResult {
   if (!rawDestination) {
     return {
       success: false,
@@ -422,8 +422,8 @@ async function startOutboundVoice(
     };
   }
 
-  const alreadyBound = await isGuardianBoundForChannel(channel);
-  if (alreadyBound && !rebind) {
+  const existingBinding = getGuardianBinding(assistantId, channel);
+  if (existingBinding && !rebind) {
     return {
       success: false,
       error: "already_bound",
@@ -591,13 +591,13 @@ export function deliverVerificationEmail(
   })();
 }
 
-async function startOutboundSlack(
+function startOutboundSlack(
   destination: string | undefined,
   assistantId: string,
   channel: ChannelId,
   rebind?: boolean,
   originConversationId?: string,
-): Promise<OutboundActionResult> {
+): OutboundActionResult {
   if (!destination) {
     return {
       success: false,
@@ -607,8 +607,8 @@ async function startOutboundSlack(
     };
   }
 
-  const alreadyBound = await isGuardianBoundForChannel(channel);
-  if (alreadyBound && !rebind) {
+  const existingBinding = getGuardianBinding(assistantId, channel);
+  if (existingBinding && !rebind) {
     return {
       success: false,
       error: "already_bound",
@@ -669,13 +669,13 @@ async function startOutboundSlack(
   };
 }
 
-async function startOutboundEmail(
+function startOutboundEmail(
   destination: string | undefined,
   assistantId: string,
   channel: ChannelId,
   rebind?: boolean,
   originConversationId?: string,
-): Promise<OutboundActionResult> {
+): OutboundActionResult {
   if (!destination) {
     return {
       success: false,
@@ -688,8 +688,8 @@ async function startOutboundEmail(
 
   const normalizedEmail = destination.trim().toLowerCase();
 
-  const alreadyBound = await isGuardianBoundForChannel(channel);
-  if (alreadyBound && !rebind) {
+  const existingBinding = getGuardianBinding(assistantId, channel);
+  if (existingBinding && !rebind) {
     return {
       success: false,
       error: "already_bound",

package/src/signals/user-message.ts

@@ -15,7 +15,6 @@ import { readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { getOrCreateConversation } from "../daemon/conversation-store.js";
-import { supersedePendingInteractionsOnEnqueue } from "../daemon/handlers/conversations.js";
 import type { UserMessageAttachment } from "../daemon/message-types/shared.js";
 import {
   processMessageInBackground,
@@ -132,21 +131,6 @@ async function dispatchUserMessage(params: {
         assistantMessageInterface: resolvedInterface,
       },
     });
-    if (!result.rejected) {
-      // Mirror the HTTP send path: a follow-up enqueued while the turn is busy
-      // auto-denies pending confirmations and supersedes a parked ask_question
-      // so it isn't stranded behind the prompt until the response backstop.
-      // Best-effort — the message is already queued, so a cleanup failure must
-      // not surface as an error that makes the CLI retry and enqueue a duplicate.
-      try {
-        supersedePendingInteractionsOnEnqueue(conversationId, requestId);
-      } catch (err) {
-        log.warn(
-          { err, conversationId },
-          "Post-enqueue supersession failed — queued message unaffected",
-        );
-      }
-    }
     return { accepted: !result.rejected };
   }
 

package/src/subagent/manager.ts

@@ -553,15 +553,6 @@ export class SubagentManager {
       ),
     );
     managed.state.completedAt = Date.now();
-    // Capture the conversation's latest usage before emitting the terminal
-    // status. `subagent_status_changed` ships `state.usage`, and the abort path
-    // (unlike the completion/failure paths, which sync at agent-loop exit) would
-    // otherwise send the {0,0,0} init usage — zeroing the client's token counts
-    // even though those tokens were already spent. `usageStats` accrues per LLM
-    // turn (see conversation-usage.ts), so this is the most recent total.
-    if (managed.conversation) {
-      managed.state.usage = { ...managed.conversation.usageStats };
-    }
     if (parentSendToClient) {
       // Route the status update through the stored parent sender so the
       // owning conversation's UI chip updates, even when the abort comes from a

package/src/subagent/types.ts

@@ -180,7 +180,7 @@ export const SUBAGENT_ROLE_REGISTRY: Record<SubagentRole, SubagentRoleConfig> =
     },
     investigator: {
       allowedTools: [
-        "code_search",
+        "bash",
         "file_read",
         "file_list",
         "web_search",
@@ -191,8 +191,8 @@ export const SUBAGENT_ROLE_REGISTRY: Record<SubagentRole, SubagentRoleConfig> =
       skillIds: [],
       systemPromptPreamble: [
         "You are an investigation-focused subagent for root-cause analysis: debugging, log forensics, and tracing behavior across code.",
-        "You have read-only investigation tools only — there is no shell. Use code_search to search file contents across directories, file_list to enumerate paths, and file_read to read whole files and logs. You cannot modify files or system state.",
-        "Working method: read whole files instead of many small line-range slices; prefer broad code_search queries across a directory over one-symbol-at-a-time queries.",
+        "Your shell access is for read-only investigation (grep, find, reading files and logs) — do not modify files or system state.",
+        "Working method: read whole files instead of many small line-range slices; prefer broad searches (e.g. grep -rn across a directory) over one-symbol-at-a-time queries.",
         "Send notify_parent (urgency 'important') as soon as each finding is confirmed, so progress survives interruption.",
         "Your final message must be a compact root-cause report with these sections: Symptom, Root cause, Evidence (file:line references), Suggested fix, Open questions.",
         "If you approach context limits, stop investigating and produce the report from what you have — a partial report delivered is worth more than a complete investigation lost.",

package/src/telemetry/types.ts

@@ -391,38 +391,6 @@ export interface SkillLoadedTelemetryEvent extends ModelTelemetryEventBase {
   conversation_id: string | null;
 }
 
-/**
- * Watchdog health event — one per watchdog check firing. The daemon's
- * watchdog observes liveness/health signals (event-loop block, stream-idle
- * stalls, restarts, ...) and emits one event per check firing.
- *
- * Deliberately minimal and forward-compatible, mirroring the platform
- * `WatchdogTelemetryEventSerializer`:
- *
- *   - `check_name` — which watchdog check fired. Open string set (not a
- *     closed enum) so the daemon can introduce a new check without a
- *     coordinated serializer release; it is the primary group-by dimension
- *     downstream. The infrastructure admin chart filters this to
- *     `event_loop_blocked`.
- *   - `value` — the single measured magnitude for the check (block ms, idle
- *     ms, ...). Nullable: not every check carries a scalar. The platform
- *     coerces ints to float, so the daemon need not distinguish.
- *   - `detail` — open JSON bag for any extra fields the daemon attaches
- *     (reason codes, secondary numbers, a human message) without a
- *     platform-coordinated schema change. Null when the daemon attaches
- *     nothing. Bounded server-side (4096 bytes serialized); an oversize bag
- *     rejects only the single event, never the batch.
- *
- * Metadata only — no conversation content. Dedupe downstream on
- * `daemon_event_id` (the daemon retries a batch on transient POST failure).
- */
-export interface WatchdogTelemetryEvent extends TelemetryEventBase {
-  type: "watchdog";
-  check_name: string;
-  value: number | null;
-  detail: Record<string, unknown> | null;
-}
-
 /** Discriminated union of all telemetry event types. */
 export type TelemetryEvent =
   | LlmUsageTelemetryEvent
@@ -431,5 +399,4 @@ export type TelemetryEvent =
   | OnboardingTelemetryEvent
   | AuthFallbackTelemetryEvent
   | ToolExecutedTelemetryEvent
-  | SkillLoadedTelemetryEvent
-  | WatchdogTelemetryEvent;
+  | SkillLoadedTelemetryEvent;

package/src/telemetry/usage-telemetry-reporter.test.ts

@@ -1547,11 +1547,11 @@ describe("UsageTelemetryReporter", () => {
     // No HTTP call should have been made
     expect(mockFetch).not.toHaveBeenCalled();
 
-    // All 8 timestamp watermarks should have been advanced, and all 8 ID
+    // All 7 timestamp watermarks should have been advanced, and all 7 ID
     // watermarks pinned to the high-sorting sentinel (a truthy value keeps
     // the compound-cursor branch active while closing its same-millisecond
     // arm against opt-out rows).
-    expect(mockSetMemoryCheckpoint).toHaveBeenCalledTimes(16);
+    expect(mockSetMemoryCheckpoint).toHaveBeenCalledTimes(14);
 
     const calls = mockSetMemoryCheckpoint.mock.calls;
     const keys = calls.map((c) => c[0]);
@@ -1563,7 +1563,6 @@ describe("UsageTelemetryReporter", () => {
       "auth_fallback",
       "tool_executed",
       "skill_loaded",
-      "watchdog",
     ];
     for (const eventType of eventTypes) {
       expect(keys).toContain(`telemetry:${eventType}:last_reported_at`);