release-2.9.1 (#1557)

* fix(sso): send the PKCE verifier for GitHub login (#1534)

* fix(remote-desktop): clip cursor overflow without disabling zoom (#1535)

* test(remote-desktop): preserve sessions beyond one hour (#1536)

* fix(hosts): expose controls for overflowing editor tabs (#1537)

* fix(hosts): expose controls for overflowing editor tabs

* test(hosts): mock resize observation in admin panel tests

* fix(status): skip TCP probes while host sessions are active (#1538)

* fix(database): batch session activity persistence (#1539)

* docs(api): describe cookie and API key authentication (#1540)

* fix(snippets): repair missing note column on SQLite upgrades (#1541)

* fix(docker): retain stored SSH credential association (#1543)

* fix(file-manager): render transfer toasts without plugin hooks (#1546)

* feat(hosts): keep compact row actions inline (#1547)

* fix(auth): allow retrying unavailable second-factor interfaces (#1549)

* fix(auth): reject unresolved legacy identity provisioning (#1550)

* fix(desktop): ship the plugin SDK inside Mac App Store builds (#1551)

* fix(tmux): pass full session info to the terminal's session picker (#1552)

The tmux.sessions service reduced detected sessions to bare names, but the
picker reads session.name, so every entry rendered blank and selecting one
sent an empty name, which created a new session instead of attaching.

* fix(ssh): read force keyboard-interactive as a boolean when resolving hosts (#1553)

The column holds the text "true"/"false", and the resolver passed it
through as-is. The string "false" is truthy, so the password provider
treated every saved host as forced keyboard-interactive and left the
password out. Jump hops are built straight from the resolved host, so a
password hop whose server doesn't offer keyboard-interactive failed with
"All configured authentication methods failed".

* fix(database): batch database saves for bulk host writes (#1554)

* fix(database): yield to the event loop between database saves

Each SQLite save serializes and encrypts the whole database into new
buffers, which V8 only releases once the event loop turns. Boot
migrations and bulk host import write plugin settings per host and per
key in an awaited loop, so hundreds of full copies piled up and the
container ran out of memory.

* fix(database): save once per bulk host write instead of once per row

On SQLite every repository write force-saves the whole database. Boot
plugin data migrations, host defaults materialization and the bulk
host routes write one row per host per setting, so they serialized and
encrypted the full database hundreds of times in a row.

DatabaseSaveTrigger.batched wraps a function so force saves made while
it runs collapse into a single save when it finishes. Nested scopes fold
into the outer one, and work that outlives its scope saves normally.

* feat(hosts): add instance-wide predefined tag suggestions (#1548)

* feat(hosts): add shared predefined tag suggestions

* style(hosts): format tag catalog routes

* test(database): advance fake timers past the save yield (#1555)

* fix(i18n): complete Simplified Chinese core and plugin translations (#1542)

* fix(i18n): complete Chinese onboarding and navigation labels

* fix(i18n): translate remaining Chinese core and plugin interfaces

* fix(i18n): translate host editor tab overflow controls

* fix(i18n): use consistent Chinese fleet terminology

* fix(i18n): localize hardcoded controls and plugin views

* fix(i18n): translate built-in homepage widget catalog

* test(homepage): follow translated timezone placeholder

* fix(i18n): translate plugin-provided homepage widgets

* fix(i18n): localize feature settings section titles

* fix: 2.8 oidc accounts unable to sign in after upgrading (#1381)

* fix: plugins losing the saved ssh login when copying a host (#1391)

* fix: fleets, proxmox and automations not getting the host sudo password

* fix: host imports running a defaults pass and metrics restart per host (#1384)

* fix: high cpu from status probes and full database saves on every sample (#1300)

* fix: user data export freezing the server (#1393)

* fix: op:// secret references rejected as ssh keys on credentials (#1394)

* fix: slow file deletes from the trash lookups on every delete (#1390)

* fix: add openapi docs and error handling to host tag routes

* test: compare download stream buffers directly so it stops timing out

* chore: drop em dash from host row comment

* chore: update release notes for 2.9.1

* fix: restore space to add host tags and redesign predefined tags editor

* fix: host key silently accepted when the host is missing from the database (#1397)

* fix: clearer host login failed status label and fix its translations (#1396)

* chore: add host key and status label fixes to release notes

* fix: sso and ldap provider dialogs overflowing the screen and using mismatched toggles

* chore: increment ver

* fix(audit): store plugin entries with no acting user as a null user_id (#1556)

Plugin audit entries written outside a request used the literal "system"
as user_id. That column references users.id, so the insert was refused
(Postgres logs it as an FK violation) and the entry was silently dropped.
Write null instead and keep "system" / plugin:<id> in username.

* chore: add sso/ldap dialog and audit log fixes to release notes

* fix: tunnels and host settings missing from shared hosts on desktop

* fix: remote desktop logins missing from shared hosts on desktop

* fix: simplify host status to online/offline and keep it live without a refresh

* chore: sync Crowdin translations for 2.9.1

---------

Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>

src/backend/tests/auth/login-pipeline.test.ts

@@ -521,6 +521,89 @@ describe("external identities", () => {
     ).rejects.toMatchObject({ code: "user_not_allowed" });
   });
 
+  it.each(["true", "false"])(
+    "does not duplicate an unscoped migrated account with provisioning %s",
+    async (enabled) => {
+      addUser({
+        id: "old",
+        username: "Alice",
+        isOidc: true,
+        passwordHash: "",
+        oidcIdentifier: "sub-1",
+        ssoProviderId: null,
+      });
+      const { runExternalIdentityMigration } =
+        await import("../../upgrade/external-identity-migration.js");
+      await runExternalIdentityMigration();
+      h.state.settings.set("oidc_auto_provision", enabled);
+      await expect(
+        runLogin(fakeRequest() as never, external, {
+          methodId: "oidc",
+          rememberMe: false,
+        }),
+      ).rejects.toMatchObject({ code: "legacy_identity_conflict" });
+      expect([...h.state.users.keys()]).toEqual(["old"]);
+      expect(h.state.identities).toHaveLength(1);
+      expect(h.state.identities[0]).toMatchObject({
+        userId: "old",
+        providerId: "legacy-oidc",
+        subject: "sub-1",
+      });
+    },
+  );
+
+  it("keeps equal subjects on explicitly different providers separate", async () => {
+    addUser({
+      id: "other",
+      username: "Other Alice",
+      isOidc: true,
+      passwordHash: "",
+      oidcIdentifier: "sub-1",
+      ssoProviderId: 9,
+    });
+    h.state.identities.push({
+      id: 1,
+      userId: "other",
+      providerId: "9",
+      subject: "sub-1",
+      email: null,
+    });
+    h.state.settings.set("oidc_auto_provision", "true");
+    const result = await runLogin(fakeRequest() as never, external, {
+      methodId: "oidc",
+      rememberMe: false,
+    });
+    expect(result.kind).toBe("session");
+    expect(h.state.users.size).toBe(2);
+    expect(
+      h.state.identities.find((link) => link.providerId === "3")?.userId,
+    ).not.toBe("other");
+  });
+
+  it("uses a verified provider link even when the old provider column is empty", async () => {
+    addUser({
+      id: "old",
+      username: "Alice",
+      isOidc: true,
+      passwordHash: "",
+      oidcIdentifier: "sub-1",
+      ssoProviderId: null,
+    });
+    h.state.identities.push({
+      id: 1,
+      userId: "old",
+      providerId: "3",
+      subject: "sub-1",
+      email: null,
+    });
+    const result = await runLogin(fakeRequest() as never, external, {
+      methodId: "oidc",
+      rememberMe: false,
+    });
+    expect(result.kind).toBe("session");
+    expect(h.state.users.size).toBe(1);
+  });
+
   it("re-checks the allowed list for existing users", async () => {
     addUser({ id: "u9", username: "Alice", isOidc: true, passwordHash: "" });
     h.state.identities.push({

src/backend/tests/database/repositories/audit-log-repository.test.ts

@@ -77,6 +77,34 @@ describe("AuditLogRepository", () => {
     ]);
   });
 
+  it("stores entries with no acting user, and refuses ids that are not users", async () => {
+    const repo = await createRepository();
+
+    await repo.create({
+      userId: null,
+      username: "plugin:example",
+      action: "plugin_http_public_routes",
+      resourceType: "plugin",
+      success: true,
+    });
+    await expect(
+      repo.create({
+        userId: "system",
+        username: "system",
+        action: "cleanup",
+        resourceType: "plugin",
+        success: true,
+      }),
+    ).rejects.toThrow();
+
+    const page = await repo.listPage({ filters: {}, limit: 10, offset: 0 });
+    expect(page.logs).toHaveLength(1);
+    expect(page.logs[0]).toMatchObject({
+      userId: null,
+      username: "plugin:example",
+    });
+  });
+
   it("deletes logs by user id and only runs write hook for deleted rows", async () => {
     let writeCount = 0;
     const repo = await createRepository(() => {

src/backend/tests/database/repositories/factory-context.test.ts

@@ -4,12 +4,13 @@ import { DATABASE_DIALECT_ENV } from "../../../database/db/dialect.js";
 // getDb() throws unless a database was initialized; the context's handle is
 // not what this file is about.
 vi.mock("../../../database/db/index.js", () => ({
-  getDb: () => ({}),
+  getDb: vi.fn(() => ({})),
   getSqlite: () => ({}),
   DatabaseSaveTrigger: { forceSave: vi.fn(), triggerSave: vi.fn() },
 }));
 
 const {
+  createCurrentSessionRepository,
   createCurrentRepositoryContext,
   createCurrentRepositoryWriteHook,
   createCurrentRepositoryLazyWriteHook,
@@ -86,3 +87,35 @@ describe("createCurrentRepositoryLazyWriteHook", () => {
     }
   });
 });
+
+it("wires SQLite activity to the periodic flush and token changes to immediate persistence", async () => {
+  const saved = process.env[DATABASE_DIALECT_ENV];
+  process.env[DATABASE_DIALECT_ENV] = "sqlite";
+  const { getDb } = await import("../../../database/db/index.js");
+  const { DatabaseSaveTrigger } =
+    await import("../../../utils/database-save-trigger.js");
+  const dirty = vi
+    .spyOn(DatabaseSaveTrigger, "markDirty")
+    .mockImplementation(() => {});
+  const force = vi.spyOn(DatabaseSaveTrigger, "forceSave").mockResolvedValue();
+  const query = {
+    update: () => query,
+    set: () => query,
+    where: async () => ({ changes: 1 }),
+  };
+  vi.mocked(getDb).mockReturnValue(
+    query as unknown as ReturnType<typeof getDb>,
+  );
+  try {
+    const repo = createCurrentSessionRepository();
+    await repo.touch("session-1");
+    expect(dirty).toHaveBeenCalledOnce();
+    expect(force).not.toHaveBeenCalled();
+    await repo.updateToken("session-1", "new-token");
+    expect(force).toHaveBeenCalledOnce();
+  } finally {
+    vi.restoreAllMocks();
+    if (saved === undefined) delete process.env[DATABASE_DIALECT_ENV];
+    else process.env[DATABASE_DIALECT_ENV] = saved;
+  }
+});

src/backend/tests/database/repositories/user-session-repositories.test.ts

@@ -20,6 +20,7 @@ describe("UserRepository and SessionRepository", () => {
   async function createRepositories(options: {
     onUserWrite?: () => void | Promise<void>;
     onSessionWrite?: () => void | Promise<void>;
+    onSessionActivity?: () => void | Promise<void>;
   }): Promise<{
     users: UserRepository;
     sessions: SessionRepository;
@@ -28,6 +29,7 @@ describe("UserRepository and SessionRepository", () => {
     options: {
       onUserWrite?: () => void | Promise<void>;
       onSessionWrite?: () => void | Promise<void>;
+      onSessionActivity?: () => void | Promise<void>;
     } = {},
   ): Promise<{
     users: UserRepository;
@@ -38,7 +40,11 @@ describe("UserRepository and SessionRepository", () => {
 
     return {
       users: new UserRepository(context, options.onUserWrite),
-      sessions: new SessionRepository(context, options.onSessionWrite),
+      sessions: new SessionRepository(
+        context,
+        options.onSessionWrite,
+        options.onSessionActivity,
+      ),
     };
   }
 
@@ -228,6 +234,46 @@ describe("UserRepository and SessionRepository", () => {
     );
   });
 
+  it("separates activity persistence from security-critical session writes", async () => {
+    let writes = 0,
+      activity = 0;
+    const repo = await createRepositories({
+      onSessionWrite: () => {
+        writes++;
+      },
+      onSessionActivity: () => {
+        activity++;
+      },
+    });
+    await repo.users.create({
+      id: "user-1",
+      username: "user",
+      passwordHash: "hash",
+      isAdmin: false,
+      isOidc: false,
+    });
+    await repo.sessions.create({
+      id: "session-1",
+      userId: "user-1",
+      jwtToken: "token",
+      deviceType: "desktop",
+      deviceInfo: "Firefox",
+      createdAt: "2026-06-26T00:00:00.000Z",
+      expiresAt: "2026-06-27T00:00:00.000Z",
+      lastActiveAt: "2026-06-26T00:00:00.000Z",
+    });
+    expect(writes).toBe(1);
+    await repo.sessions.touch("session-1", "2026-06-26T00:01:00.000Z");
+    expect(activity).toBe(1);
+    expect(writes).toBe(1);
+    await repo.sessions.touch("session-1", "2026-06-26T00:01:10.000Z");
+    expect(activity).toBe(1);
+    await repo.sessions.updateToken("session-1", "renewed");
+    expect(writes).toBe(2);
+    await repo.sessions.revoke("session-1");
+    expect(writes).toBe(3);
+  });
+
   it("revokes all user sessions except an optional current session", async () => {
     const repo = await createRepositories();
     await repo.users.create({

src/backend/tests/database/routes/credentials-secret-reference.test.ts

@@ -0,0 +1,193 @@
+/**
+ * A key credential whose private key is a secret reference (op://...) is
+ * saved as given and resolved when connecting (#1394). Parsing the reference
+ * as a key used to reject it, and an update kept the old private key.
+ */
+
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+import express from "express";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const h = vi.hoisted(() => ({
+  created: [] as Array<Record<string, unknown>>,
+  updated: [] as Array<Record<string, unknown>>,
+  existing: null as Record<string, unknown> | null,
+}));
+
+const pass = (_req: unknown, _res: unknown, next: () => void) => next();
+
+vi.mock("../../../utils/auth-manager.js", () => ({
+  AuthManager: {
+    getInstance: () => ({
+      createAuthMiddleware:
+        () => (req: { userId?: string }, _res: unknown, next: () => void) => {
+          req.userId = "u1";
+          next();
+        },
+      createDataAccessMiddleware: () => pass,
+    }),
+  },
+}));
+vi.mock("../../../utils/permission-manager.js", () => ({
+  PermissionManager: {
+    getInstance: () => ({ requirePermission: () => pass }),
+  },
+}));
+vi.mock("../../../sync/shared-copy-guard.js", () => ({
+  rejectSharedCopyWrites: () => pass,
+}));
+vi.mock("../../../utils/audit-logger.js", () => ({
+  logAudit: async () => {},
+  getAuditUsername: async () => "u1",
+  getRequestMeta: () => ({ ipAddress: null, userAgent: null }),
+}));
+vi.mock("../../../utils/logger.js", () => {
+  const log = {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+    debug: vi.fn(),
+  };
+  return { authLogger: log, sshLogger: log, databaseLogger: log };
+});
+vi.mock("../../../database/routes/credential-key-routes.js", () => ({
+  registerCredentialKeyRoutes: () => {},
+}));
+vi.mock("../../../database/routes/credential-deploy-routes.js", () => ({
+  registerCredentialDeployRoutes: () => {},
+}));
+vi.mock("../../../database/routes/credential-bulk-routes.js", () => ({
+  registerCredentialBulkRoutes: () => {},
+}));
+vi.mock("../../../hosts/delete-credential.js", () => ({
+  deleteOwnedCredential: async () => {},
+}));
+vi.mock("../../../hosts/connect/core-providers.js", () => ({
+  ensureCoreSshAuthProviders: () => {},
+}));
+vi.mock("../../../hosts/connect/auth-provider-registry.js", () => ({
+  listCredentialTypes: () => ["password", "key"],
+}));
+vi.mock("../../../utils/shared-host-secrets-manager.js", () => ({
+  SharedHostSecretsManager: {
+    getInstance: () => ({ resyncHostsForCredential: async () => {} }),
+  },
+}));
+vi.mock("../../../utils/shared-credential-secrets-manager.js", () => ({
+  SharedCredentialSecretsManager: {
+    getInstance: () => ({ resyncCredential: async () => {} }),
+  },
+}));
+vi.mock("../../../database/repositories/factory.js", () => ({
+  createCurrentCredentialRepository: () => ({
+    createEncryptedForUser: async (
+      userId: string,
+      data: Record<string, unknown>,
+    ) => {
+      h.created.push(data);
+      return { id: 1, userId, ...data };
+    },
+    findById: async () => (h.existing ? { id: 1, userId: "u1" } : null),
+    findDecryptedByIdForUser: async () => h.existing,
+    updateEncryptedForUser: async (
+      _userId: string,
+      _id: number,
+      fields: Record<string, unknown>,
+    ) => {
+      h.updated.push(fields);
+      return { ...h.existing, ...fields };
+    },
+  }),
+  createCurrentUserRepository: () => ({}),
+  createCurrentCredentialAccessRepository: () => ({}),
+  createCurrentRoleRepository: () => ({}),
+  createCurrentHostResolutionRepository: () => ({}),
+  createCurrentHostRepository: () => ({}),
+}));
+
+const { default: router } =
+  await import("../../../database/routes/credentials.js");
+
+// Never parsed here: only the update replacing it matters.
+const REAL_KEY = "stored-key-material";
+
+let server: http.Server;
+let base: string;
+
+beforeEach(async () => {
+  h.created = [];
+  h.updated = [];
+  h.existing = null;
+  const app = express();
+  app.use(express.json());
+  app.use("/credentials", router);
+  server = http.createServer(app);
+  await new Promise<void>((resolve) => server.listen(0, resolve));
+  base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+});
+
+afterEach(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+});
+
+function send(method: string, path: string, body: unknown) {
+  return fetch(`${base}/credentials${path}`, {
+    method,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("credentials with a secret reference key", () => {
+  it("saves an op:// private key as given", async () => {
+    const response = await send("POST", "", {
+      name: "vault key",
+      authType: "key",
+      username: "root",
+      key: "op://vault/item/private_key",
+    });
+
+    expect(response.status).toBe(201);
+    expect(h.created[0]).toMatchObject({
+      key: "op://vault/item/private_key",
+      privateKey: "op://vault/item/private_key",
+      publicKey: null,
+      detectedKeyType: null,
+    });
+  });
+
+  it("still rejects a key that is neither a key nor a reference", async () => {
+    const response = await send("POST", "", {
+      name: "bad",
+      authType: "key",
+      key: "not a key",
+    });
+    expect(response.status).toBe(400);
+  });
+
+  it("replaces the stored private key when updating to a reference", async () => {
+    h.existing = {
+      id: 1,
+      userId: "u1",
+      name: "k",
+      authType: "key",
+      key: REAL_KEY,
+      privateKey: REAL_KEY,
+      publicKey: "ssh-ed25519 AAAA old",
+    };
+
+    const response = await send("PUT", "/1", {
+      key: "op://vault/item/private_key",
+    });
+
+    expect(response.status).toBe(200);
+    expect(h.updated[0]).toMatchObject({
+      key: "op://vault/item/private_key",
+      privateKey: "op://vault/item/private_key",
+      publicKey: null,
+      detectedKeyType: null,
+    });
+  });
+});

src/backend/tests/database/routes/host-import-terminal-settings.test.ts

@@ -6,6 +6,7 @@ const mocks = vi.hoisted(() => ({
   update: vi.fn(),
   list: vi.fn(),
   applyPluginSettings: vi.fn(),
+  applyDefaults: vi.fn(async () => {}),
 }));
 vi.mock("../../../database/routes/host-plugin-settings.js", () => ({
   applyPluginHostImportSettings: mocks.applyPluginSettings,
@@ -14,6 +15,7 @@ vi.mock("../../../database/routes/host-plugin-settings.js", () => ({
 vi.mock("../../../hosts/defaults/index.js", () => ({
   applyHostDefaultsToWrite: async () => ({ core: [] }),
   applyDefaultsAfterHostWrite: async () => {},
+  applyDefaultsAfterHostWrites: mocks.applyDefaults,
 }));
 vi.mock("../../../hosts/defaults/overrides.js", () => ({
   changeHostOverrides: async () => {},
@@ -141,6 +143,9 @@ it.each([20, "20"])(
     ]);
     expect(mocks.create.mock.calls[1][1]).not.toHaveProperty("exportId");
     expect(mocks.create.mock.calls[1][1]).not.toHaveProperty("id");
+    // One defaults pass for the whole import, not one per host.
+    expect(mocks.applyDefaults).toHaveBeenCalledTimes(1);
+    expect(mocks.applyDefaults).toHaveBeenCalledWith([501, 502]);
   },
 );
 

src/backend/tests/database/routes/host-status-routes.test.ts

@@ -88,7 +88,7 @@ beforeEach(() => {
   state.statuses = new Map([
     [1, { status: "online", lastChecked: "t" }],
     [2, { status: "offline", lastChecked: "t" }],
-    [3, { status: "reachable", lastChecked: "t" }],
+    [3, { status: "offline", lastChecked: "t" }],
   ]);
   service.statusesFor.mockImplementation(async () => state.statuses);
   service.get.mockImplementation(

src/backend/tests/database/routes/host-tag-routes.test.ts

@@ -0,0 +1,82 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import express from "express";
+import request from "supertest";
+
+const settings = vi.hoisted(() => new Map<string, string>());
+vi.mock("../../../database/repositories/factory.js", () => ({
+  createCurrentSettingsRepository: () => ({
+    get: async (key: string) => settings.get(key) ?? null,
+    set: async (key: string, value: string) => {
+      settings.set(key, value);
+    },
+  }),
+}));
+vi.mock("../../../utils/logger.js", () => ({
+  databaseLogger: { error: vi.fn() },
+}));
+import { registerHostTagRoutes } from "../../../database/routes/host-tag-routes.js";
+
+function app() {
+  const server = express();
+  server.use(express.json());
+  registerHostTagRoutes(
+    server,
+    (req, res, next) =>
+      req.headers.authorization ? next() : void res.sendStatus(401),
+    (req, res, next) =>
+      req.headers.authorization === "admin" ? next() : void res.sendStatus(403),
+  );
+  return server;
+}
+
+beforeEach(() => settings.clear());
+describe("instance host tag catalog", () => {
+  it("allows authenticated users to read the same admin-managed catalog", async () => {
+    const server = app();
+    await request(server)
+      .put("/tags")
+      .set("Authorization", "admin")
+      .send({ tags: [" Linux ", "Domain Controller", "Linux"] })
+      .expect(200, { tags: ["Linux", "Domain Controller"] });
+    await request(server)
+      .get("/tags")
+      .set("Authorization", "member")
+      .expect(200, { tags: ["Linux", "Domain Controller"] });
+  });
+  it("rejects anonymous reads and non-admin writes", async () => {
+    await request(app()).get("/tags").expect(401);
+    await request(app())
+      .put("/tags")
+      .set("Authorization", "member")
+      .send({ tags: ["test"] })
+      .expect(403);
+    expect(settings.size).toBe(0);
+  });
+  it.each([null, [42], [" "], ["x".repeat(101)], Array(501).fill("tag")])(
+    "rejects invalid catalogs",
+    async (tags) => {
+      await request(app())
+        .put("/tags")
+        .set("Authorization", "admin")
+        .send({ tags })
+        .expect(400);
+      expect(settings.size).toBe(0);
+    },
+  );
+  it("allows clearing suggestions without modifying hosts", async () => {
+    settings.set("host_tag_catalog", '["Linux"]');
+    await request(app())
+      .put("/tags")
+      .set("Authorization", "admin")
+      .send({ tags: [] })
+      .expect(200, { tags: [] });
+  });
+
+  it("reads a damaged catalog as empty instead of failing", async () => {
+    settings.set("host_tag_catalog", "{not json");
+    await request(app())
+      .get("/tags")
+      .set("Authorization", "member")
+      .expect(200, { tags: [] });
+  });
+});

src/backend/tests/database/routes/user-external-account-routes.test.ts

@@ -201,6 +201,65 @@ describe("linking an external account to a password account", () => {
     });
     expect(response.status).toBe(400);
   });
+
+  it("merges a 2.9.0 duplicate back into its 2.8 SSO account", async () => {
+    h.users.set("orig", {
+      id: "orig",
+      username: "bob",
+      isAdmin: false,
+      isOidc: true,
+      passwordHash: "",
+      oidcIdentifier: "sub-9",
+    });
+    h.users.set("dup", {
+      id: "dup",
+      username: "bob-1",
+      isAdmin: false,
+      isOidc: true,
+      passwordHash: "",
+      oidcIdentifier: null,
+    });
+    h.identities.push(
+      { userId: "orig", providerId: "legacy-oidc", subject: "sub-9" },
+      { userId: "dup", providerId: "1", subject: "sub-9" },
+    );
+
+    const response = await post("/link-external-to-password", {
+      externalUserId: "dup",
+      targetUsername: "bob",
+    });
+
+    expect(response.status).toBe(200);
+    expect(h.deleted).toEqual(["dup"]);
+    expect(h.users.get("orig")!.oidcIdentifier).toBe("sub-9");
+    expect(
+      h.identities
+        .filter((row) => row.userId === "orig")
+        .map((row) => row.providerId),
+    ).toEqual(["legacy-oidc", "1"]);
+  });
+
+  it("does not treat an unrelated SSO account as a duplicate target", async () => {
+    h.users.set("other", {
+      id: "other",
+      username: "carol",
+      isAdmin: false,
+      isOidc: true,
+      passwordHash: "",
+      oidcIdentifier: "sub-x",
+    });
+    h.identities.push({
+      userId: "other",
+      providerId: "legacy-oidc",
+      subject: "sub-x",
+    });
+
+    const response = await post("/link-external-to-password", {
+      externalUserId: "sso",
+      targetUsername: "carol",
+    });
+    expect(response.status).toBe(400);
+  });
 });
 
 describe("unlinking", () => {

src/backend/tests/electron/after-pack.test.ts

@@ -5,9 +5,14 @@ import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 
 const require = createRequire(import.meta.url);
-const { copyPluginSdk } =
+const { copyPluginSdk, resourcesDirFor } =
   require("../../../../packaging/build/after-pack.cjs") as {
     copyPluginSdk: (resourcesDir: string, sdkDir?: string) => string;
+    resourcesDirFor: (context: {
+      electronPlatformName: string;
+      appOutDir: string;
+      packager: { appInfo: { productFilename: string } };
+    }) => string;
   };
 
 let dir: string;
@@ -53,4 +58,30 @@ describe("afterPack plugin SDK copy", () => {
       "npm run build:sdk",
     );
   });
+
+  it.each(["darwin", "mas"])(
+    "copies into the app bundle for %s builds",
+    (electronPlatformName) => {
+      const context = {
+        electronPlatformName,
+        appOutDir: "/out",
+        packager: { appInfo: { productFilename: "Termix" } },
+      };
+      expect(resourcesDirFor(context)).toBe(
+        path.join("/out", "Termix.app", "Contents", "Resources"),
+      );
+    },
+  );
+
+  it.each(["win32", "linux"])(
+    "copies into resources for %s builds",
+    (electronPlatformName) => {
+      const context = {
+        electronPlatformName,
+        appOutDir: "/out",
+        packager: { appInfo: { productFilename: "Termix" } },
+      };
+      expect(resourcesDirFor(context)).toBe(path.join("/out", "resources"));
+    },
+  );
 });

src/backend/tests/hosts/host-key-recovery.test.ts

@@ -76,3 +76,47 @@ describe("host key recovery", () => {
     expect(accepted).toEqual([]);
   });
 });
+
+describe("a host missing from the database", () => {
+  function answeringSocket(action: "accept" | "reject") {
+    const socket = new EventEmitter() as EventEmitter & {
+      send: (data: string) => void;
+    };
+    socket.send = () =>
+      socket.emit(
+        "message",
+        Buffer.from(
+          JSON.stringify({
+            type: "host_key_verification_response",
+            data: { action },
+          }),
+        ),
+      );
+    return socket as unknown as WebSocket;
+  }
+
+  async function verifyMissingHost(ws: WebSocket | null) {
+    const verifier = await SSHHostKeyVerifier.createHostVerifier(
+      hostId,
+      "127.0.0.1",
+      22,
+      ws,
+      "user",
+      false,
+      null,
+    );
+    return new Promise<boolean>((resolve) =>
+      verifier(Buffer.from("any-key"), resolve),
+    );
+  }
+
+  it("refuses the key when nobody can be asked", async () => {
+    expect(await verifyMissingHost(null)).toBe(false);
+  });
+
+  it("asks the user and saves nothing", async () => {
+    expect(await verifyMissingHost(answeringSocket("accept"))).toBe(true);
+    expect(await verifyMissingHost(answeringSocket("reject"))).toBe(false);
+    expect(updateHostKey).not.toHaveBeenCalled();
+  });
+});

src/backend/tests/hosts/host-resolver.test.ts

@@ -487,6 +487,16 @@ describe("resolveHostById", () => {
     expect(host.sshOptions).toEqual({ keepaliveCountMax: 3 });
   });
 
+  it("turns the stored force_keyboard_interactive text into a boolean", async () => {
+    state.host = baseHost({ forceKeyboardInteractive: "false" });
+    const off = (await resolveHostById(42, "owner")) as Record<string, unknown>;
+    expect(off.forceKeyboardInteractive).toBe(false);
+
+    state.host = baseHost({ forceKeyboardInteractive: "true" });
+    const on = (await resolveHostById(42, "owner")) as Record<string, unknown>;
+    expect(on.forceKeyboardInteractive).toBe(true);
+  });
+
   it("resolves an admin bypass like the owner, keeping owner-only secrets", async () => {
     state.isAdminBypass = true;
     state.host = baseHost({

src/backend/tests/hosts/host-session-status.test.ts

@@ -13,10 +13,13 @@ describe("HostSessionStatus", () => {
     expect(listener).toHaveBeenCalledTimes(1);
     expect(listener).toHaveBeenLastCalledWith(7, true);
 
+    expect(status.hasActiveSession(7)).toBe(true);
     closeFirst();
+    expect(status.hasActiveSession(7)).toBe(true);
     expect(listener).toHaveBeenCalledTimes(1);
 
     closeSecond();
+    expect(status.hasActiveSession(7)).toBe(false);
     expect(listener).toHaveBeenLastCalledWith(7, false);
     expect(listener).toHaveBeenCalledTimes(2);
   });

src/backend/tests/hosts/status/host-status-service.test.ts

@@ -52,8 +52,10 @@ function setup(
     loadSharedHostIds: async (userId) => shared[userId] ?? [],
     ping,
     pingThroughJumpHosts,
+    hasActiveSession: (id) => hostSessionStatus.hasActiveSession(id),
     globalInterval: () => 60,
     emit: (payload) => emitted.push(payload),
+    retryDelayMs: 0,
   });
   return { service, emitted, ping, pingThroughJumpHosts, loadTargets };
 }
@@ -74,6 +76,34 @@ afterEach(() => {
 });
 
 describe("HostStatusService", () => {
+  it.each([{ jumpHosts: [] }, { jumpHosts: [{ hostId: 9 }] }])(
+    "skips probes while a session is open, including jump hosts: %j",
+    async ({ jumpHosts }) => {
+      const { service, ping, pingThroughJumpHosts } = setup([
+        target(7, { jumpHosts }),
+      ]);
+      active = service;
+      const close = hostSessionStatus.register(7);
+      try {
+        await service.statusesFor("owner", null);
+        await flush();
+        await vi.advanceTimersByTimeAsync(60_000);
+        await flush();
+        expect(service.get(7)?.status).toBe("online");
+        expect(ping).not.toHaveBeenCalled();
+        expect(pingThroughJumpHosts).not.toHaveBeenCalled();
+        close();
+        await vi.advanceTimersByTimeAsync(60_000);
+        await flush();
+        expect(
+          jumpHosts.length ? pingThroughJumpHosts : ping,
+        ).toHaveBeenCalledOnce();
+      } finally {
+        close();
+      }
+    },
+  );
+
   it("starts a user's own hosts and reports them online", async () => {
     const { service, emitted, ping } = setup([target(1), target(2)]);
     active = service;
@@ -163,86 +193,44 @@ describe("HostStatusService", () => {
     expect(ping).toHaveBeenCalledWith("10.0.0.1", 3389);
   });
 
-  it("warns about a failed login until a login works again", async () => {
+  it("ignores a failed login and counts a working one as online", async () => {
     const { service, emitted } = setup([target(1)]);
     active = service;
     await service.statusesFor("owner", null);
-    await flush();
 
+    const before = emitted.length;
     service.reportLogin(1, { ok: false });
-    expect(service.get(1)?.status).toBe("reachable");
-    expect(emitted.at(-1)).toMatchObject({
-      status: "reachable",
-      previous: "online",
-    });
-
-    vi.advanceTimersByTime(75_000);
-    await flush();
-    expect(service.get(1)?.status).toBe("reachable");
-
-    service.reportLogin(1, { ok: true });
-    expect(service.get(1)?.status).toBe("online");
-    vi.advanceTimersByTime(75_000);
-    await flush();
     expect(service.get(1)?.status).toBe("online");
+    expect(emitted).toHaveLength(before);
   });
 
-  it("marks a changed host key and clears it once the new key is accepted", async () => {
-    const { service } = setup([target(1)]);
+  it("marks a host online when a terminal session opens", async () => {
+    const { service } = setup([target(1)], false);
     active = service;
     service.start();
     await service.statusesFor("owner", null);
-    await flush();
-    service.reportLogin(1, { ok: false, hostKeyChanged: true });
-    expect(service.get(1)).toMatchObject({
-      status: "reachable",
-      reason: "host_key_changed",
-    });
-
-    pluginEvents.emit(TOPICS.hostKeyUpdated, { hostId: 1 });
-    expect(service.get(1)?.reason).toBeUndefined();
-    expect(service.get(1)?.status).toBe("online");
-  });
-
-  it("clears a failed login when the host is edited", async () => {
-    const { service } = setup([target(1)]);
-    active = service;
-    service.start();
-    await service.statusesFor("owner", null);
-    await flush();
-    service.reportLogin(1, { ok: false });
-
-    pluginEvents.emit(TOPICS.hostUpdated, { hostId: 1 });
-    await flush();
-    await flush();
-    expect(service.get(1)?.status).toBe("online");
-  });
-
-  it("clears a failed login when a terminal session opens", async () => {
-    const { service } = setup([target(1)]);
-    active = service;
-    service.start();
-    await service.statusesFor("owner", null);
-    await flush();
-    service.reportLogin(1, { ok: false });
+    expect(service.get(1)?.status).toBe("offline");
 
     const release = hostSessionStatus.register(1);
     expect(service.get(1)?.status).toBe("online");
     release();
+  });
+
+  it("tries a failed ping again before reporting offline", async () => {
+    const { service, ping } = setup([target(1)]);
+    active = service;
+    ping.mockResolvedValueOnce(false);
+    await service.statusesFor("owner", null);
+    expect(ping).toHaveBeenCalledTimes(2);
     expect(service.get(1)?.status).toBe("online");
   });
 
-  it("shows an offline host as offline whatever the login said", async () => {
-    const { service } = setup([target(1)], false);
+  it("answers the first request with the first checks done", async () => {
+    const { service } = setup([target(1), target(2)]);
     active = service;
-    await service.statusesFor("owner", null);
-    await flush();
-    service.reportLogin(1, { ok: false });
-    expect(service.get(1)?.status).toBe("offline");
-    service.reportLogin(1, { ok: true });
-    vi.advanceTimersByTime(75_000);
-    await flush();
-    expect(service.get(1)?.status).toBe("offline");
+    const statuses = await service.statusesFor("owner", null);
+    expect(statuses.get(1)?.status).toBe("online");
+    expect(statuses.get(2)?.status).toBe("online");
   });
 
   it("only checks the requested hosts on the desktop app", async () => {

src/backend/tests/hosts/status/host-status.test.ts

@@ -1,9 +1,5 @@
 import { describe, expect, it } from "vitest";
-import {
-  isHostKeyVerificationError,
-  statusAfterAuthentication,
-  statusAfterReachabilityCheck,
-} from "../../../hosts/status/host-status.js";
+import { isHostKeyVerificationError } from "../../../hosts/status/host-status.js";
 
 describe("isHostKeyVerificationError", () => {
   it.each([
@@ -19,24 +15,3 @@ describe("isHostKeyVerificationError", () => {
     );
   });
 });
-
-describe("host availability status", () => {
-  it("calls a host whose port answers online", () => {
-    expect(statusAfterReachabilityCheck(true, false)).toBe("online");
-    expect(statusAfterReachabilityCheck(false, false)).toBe("offline");
-  });
-
-  it("warns about a reachable host whose last login failed", () => {
-    expect(statusAfterReachabilityCheck(true, true)).toBe("reachable");
-    expect(statusAfterReachabilityCheck(false, true)).toBe("offline");
-  });
-
-  it("marks successful authentication online", () => {
-    expect(statusAfterAuthentication(true, "reachable")).toBe("online");
-  });
-
-  it("downgrades failed authentication without hiding reachability", () => {
-    expect(statusAfterAuthentication(false, "online")).toBe("reachable");
-    expect(statusAfterAuthentication(false, "offline")).toBe("offline");
-  });
-});

src/backend/tests/hosts/status/jump-probe-pool.test.ts

@@ -0,0 +1,127 @@
+import { EventEmitter } from "node:events";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { JumpProbePool } from "../../../hosts/status/jump-probe-pool.js";
+
+function fakeClient(reachable = true) {
+  const client = Object.assign(new EventEmitter(), {
+    end: vi.fn(),
+    forwardOut: vi.fn(
+      (
+        _srcIp: string,
+        _srcPort: number,
+        _host: string,
+        _port: number,
+        callback: (error: Error | null, stream?: { destroy(): void }) => void,
+      ) => {
+        callback(
+          reachable ? null : new Error("refused"),
+          reachable ? { destroy: () => {} } : undefined,
+        );
+      },
+    ),
+  });
+  return client;
+}
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe("JumpProbePool", () => {
+  it("shares one chain across hosts behind the same hops", async () => {
+    const client = fakeClient();
+    const open = vi.fn(async () => client as never);
+    const pool = new JumpProbePool(open);
+    const hops = [{ hostId: 1 }, { hostId: 2 }];
+
+    const results = await Promise.all([
+      pool.ping(hops, "u1", "10.0.0.3", 22),
+      pool.ping(hops, "u1", "10.0.0.4", 22),
+      pool.ping(hops, "u1", "10.0.0.5", 22),
+    ]);
+
+    expect(results).toEqual([true, true, true]);
+    expect(open).toHaveBeenCalledTimes(1);
+    expect(client.forwardOut).toHaveBeenCalledTimes(3);
+    expect(client.end).not.toHaveBeenCalled();
+    pool.closeAll();
+  });
+
+  it("keeps chains apart per user and hop list", async () => {
+    const open = vi.fn(async () => fakeClient() as never);
+    const pool = new JumpProbePool(open);
+    await pool.ping([{ hostId: 1 }], "u1", "a", 22);
+    await pool.ping([{ hostId: 1 }], "u2", "a", 22);
+    await pool.ping([{ hostId: 2 }], "u1", "a", 22);
+    expect(open).toHaveBeenCalledTimes(3);
+    pool.closeAll();
+  });
+
+  it("reports an unreachable target without dropping the chain", async () => {
+    const client = fakeClient(false);
+    const open = vi.fn(async () => client as never);
+    const pool = new JumpProbePool(open);
+    expect(await pool.ping([{ hostId: 1 }], "u1", "a", 22)).toBe(false);
+    expect(await pool.ping([{ hostId: 1 }], "u1", "b", 22)).toBe(false);
+    expect(open).toHaveBeenCalledTimes(1);
+    pool.closeAll();
+  });
+
+  it("drops a chain whose hop stops answering", async () => {
+    vi.useFakeTimers();
+    const stale = Object.assign(new EventEmitter(), {
+      end: vi.fn(),
+      forwardOut: vi.fn(),
+    });
+    const fresh = fakeClient();
+    const open = vi
+      .fn()
+      .mockResolvedValueOnce(stale)
+      .mockResolvedValueOnce(fresh);
+    const pool = new JumpProbePool(open);
+
+    const first = pool.ping([{ hostId: 1 }], "u1", "a", 22, 1000);
+    await vi.advanceTimersByTimeAsync(1000);
+    expect(await first).toBe(false);
+    expect(stale.end).toHaveBeenCalled();
+
+    expect(await pool.ping([{ hostId: 1 }], "u1", "a", 22)).toBe(true);
+    expect(open).toHaveBeenCalledTimes(2);
+    pool.closeAll();
+  });
+
+  it("retries a chain that failed to open", async () => {
+    const open = vi
+      .fn()
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce(fakeClient());
+    const pool = new JumpProbePool(open);
+    expect(await pool.ping([{ hostId: 1 }], "u1", "a", 22)).toBe(false);
+    expect(await pool.ping([{ hostId: 1 }], "u1", "a", 22)).toBe(true);
+    pool.closeAll();
+  });
+
+  it("opens a new chain after the old one closed or sat idle", async () => {
+    vi.useFakeTimers();
+    const first = fakeClient();
+    const second = fakeClient();
+    const third = fakeClient();
+    const open = vi
+      .fn()
+      .mockResolvedValueOnce(first)
+      .mockResolvedValueOnce(second)
+      .mockResolvedValueOnce(third);
+    const pool = new JumpProbePool(open, 1000);
+
+    await pool.ping([{ hostId: 1 }], "u1", "a", 22);
+    first.emit("close");
+    await pool.ping([{ hostId: 1 }], "u1", "a", 22);
+    expect(open).toHaveBeenCalledTimes(2);
+
+    await vi.advanceTimersByTimeAsync(1500);
+    expect(second.end).toHaveBeenCalled();
+    await pool.ping([{ hostId: 1 }], "u1", "a", 22);
+    expect(open).toHaveBeenCalledTimes(3);
+    pool.closeAll();
+  });
+});

src/backend/tests/hosts/stored-ssh-key.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from "vitest";
+
+const resolve = vi.fn(async (_userId: string, ref: string) => `real:${ref}`);
+vi.mock("../../hosts/external-secrets.js", async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  resolveSecretReference: (userId: string, ref: string) => resolve(userId, ref),
+}));
+
+const { parseKeyForStorage, resolveKeyReferences } =
+  await import("../../hosts/stored-ssh-key.js");
+
+describe("parseKeyForStorage", () => {
+  it("accepts a secret reference without parsing it", () => {
+    expect(parseKeyForStorage(" op://v/i/private_key ")).toEqual({
+      success: true,
+      privateKey: "op://v/i/private_key",
+      publicKey: "",
+      keyType: "",
+      reference: true,
+    });
+  });
+
+  it("does not try to open a real key with a referenced passphrase", () => {
+    const result = parseKeyForStorage("-----BEGIN...", "op://v/i/pass");
+    expect(result).toMatchObject({ success: true, reference: true });
+  });
+
+  it("parses anything else as a key", () => {
+    const result = parseKeyForStorage("not a key");
+    expect(result.success).toBe(false);
+    expect(result.reference).toBe(false);
+  });
+});
+
+describe("resolveKeyReferences", () => {
+  it("resolves only the values that are references", async () => {
+    expect(await resolveKeyReferences("u1", "op://v/i/key", "plain")).toEqual({
+      key: "real:op://v/i/key",
+      passphrase: "plain",
+    });
+    expect(resolve).toHaveBeenCalledTimes(1);
+  });
+});

src/backend/tests/plugins/ctx-audit.test.ts

@@ -73,7 +73,8 @@ describe("ctx.audit.record", () => {
     const ctx = contextFor("audit-fixture");
     await ctx.audit.record({ action: "cleanup", success: false });
     expect(auditEntries[0]).toMatchObject({
-      userId: "system",
+      userId: null,
+      username: "system",
       resourceType: "plugin",
       resourceId: "audit-fixture",
       resourceName: "Audit Fixture",

src/backend/tests/plugins/ctx-hosts.test.ts

@@ -129,7 +129,7 @@ vi.mock("../../hosts/host-session-status.js", () => ({
 vi.mock("../../hosts/status/host-status-service.js", () => ({
   hostStatusService: {
     get: (hostId: number) =>
-      hostId === 4 ? { status: "reachable", lastChecked: "t" } : null,
+      hostId === 4 ? { status: "online", lastChecked: "t" } : null,
     check: async (hostId: number) => ({
       status: "offline",
       lastChecked: String(hostId),
@@ -496,7 +496,7 @@ describe("ctx.hosts", () => {
     }
     expect(record.sshOptions).toEqual({ keepaliveInterval: 5 });
     expect(record.pluginSettings).toEqual({ mine: "own-4" });
-    expect(record.status).toEqual({ status: "reachable", lastChecked: "t" });
+    expect(record.status).toEqual({ status: "online", lastChecked: "t" });
     expect(record.enableSsh).toBe(true);
   });
 
@@ -620,7 +620,7 @@ describe("ctx.hosts.status", () => {
       audit: vi.fn(async () => {}),
     });
     await expect(hosts.status.get(4)).resolves.toEqual({
-      status: "reachable",
+      status: "online",
       lastChecked: "t",
     });
     await expect(hosts.status.get(5)).resolves.toBeNull();
@@ -656,11 +656,9 @@ describe("ctx.hosts.status", () => {
       manifest: manifest(["hosts:read"]),
       audit: vi.fn(async () => {}),
     });
-    hosts.status.reportLogin(4, { ok: false, hostKeyChanged: true });
+    hosts.status.reportLogin(4, { ok: true });
     await settle();
-    expect(h.statusReports).toEqual([
-      { hostId: 4, ok: false, hostKeyChanged: true },
-    ]);
+    expect(h.statusReports).toEqual([{ hostId: 4, ok: true }]);
   });
 
   it("removes a registered port when the plugin is disposed", async () => {

src/backend/tests/plugins/ctx-ssh-auth.test.ts

@@ -91,6 +91,18 @@ vi.mock("../../hosts/connect/connect-host.js", () => ({
     return { client, jumpClient: null, dispose: vi.fn(() => client.end()) };
   },
 }));
+vi.mock("../../hosts/host-resolver.js", () => ({
+  resolveHostById: async (hostId: number, userId: string) => ({
+    id: hostId,
+    userId,
+    ip: "10.0.0.5",
+    port: 22,
+    username: "root",
+    authType: "password",
+    password: "stored-secret",
+  }),
+  resolveHostBySyncId: async () => null,
+}));
 vi.mock("../../hosts/status/host-status-service.js", () => ({
   hostStatusService: {
     reportLogin: (hostId: number, outcome: unknown) =>
@@ -208,24 +220,19 @@ describe("ctx.ssh", () => {
     expect(h.logins).toEqual([{ hostId: 7, outcome: { ok: true } }]);
   });
 
-  it("reports an auth or host key failure, but not a timeout", async () => {
+  it("never reports a failed login to the status", async () => {
     h.granted = new Set(["ssh:connect", "credentials:use"]);
     const ssh = createPluginSsh({
       manifest: manifest(["ssh:connect", "credentials:use"]),
       bag: new DisposableBag("fixture"),
       audit: vi.fn(async () => {}),
     });
-    h.connectError = new Error("Timed out while waiting for handshake");
-    await expect(ssh.connect(7)).rejects.toThrow();
     h.connectError = new Error("All configured authentication methods failed");
     await expect(ssh.connect(7)).rejects.toThrow();
     h.connectError = new Error("Host key changed");
     await expect(ssh.connect(8)).rejects.toThrow();
     await new Promise((resolve) => setTimeout(resolve, 0));
-    expect(h.logins).toEqual([
-      { hostId: 7, outcome: { ok: false, hostKeyChanged: false } },
-      { hostId: 8, outcome: { ok: false, hostKeyChanged: true } },
-    ]);
+    expect(h.logins).toEqual([]);
   });
 
   it("never believes a host object's own userId", async () => {
@@ -253,6 +260,50 @@ describe("ctx.ssh", () => {
     expect(h.connects[0].target).toMatchObject({ userId: "caller" });
   });
 
+  it("connects a copied redacted host with its stored login", async () => {
+    h.granted = new Set(["ssh:connect", "credentials:use"]);
+    const ssh = createPluginSsh({
+      manifest: manifest(["ssh:connect", "credentials:use"]),
+      bag: new DisposableBag("fixture"),
+      audit: vi.fn(async () => {}),
+    });
+    const host = (await ssh.resolveHost(5))!;
+    expect((host as Record<string, unknown>).password).toBeUndefined();
+    expect(JSON.stringify(host)).not.toContain("stored-secret");
+    for (const symbol of Object.getOwnPropertySymbols(host)) {
+      expect(JSON.stringify((host as never)[symbol])).not.toContain(
+        "stored-secret",
+      );
+    }
+
+    await ssh.connect({ ...host, port: host.port || 22 });
+    expect(h.connects[0].target).toMatchObject({ password: "stored-secret" });
+
+    await ssh.connect({ ...host, password: "typed", authType: "password" });
+    expect(h.connects[1].target).toMatchObject({ password: "typed" });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(h.logins.map((login) => login.hostId)).toEqual([5, 5]);
+  });
+
+  it("does not honor another plugin's resolved host", async () => {
+    h.granted = new Set(["ssh:connect", "credentials:use"]);
+    const deps = {
+      manifest: manifest(["ssh:connect", "credentials:use"]),
+      audit: vi.fn(async () => {}),
+    };
+    const first = createPluginSsh({
+      ...deps,
+      bag: new DisposableBag("fixture"),
+    });
+    const second = createPluginSsh({
+      ...deps,
+      bag: new DisposableBag("fixture"),
+    });
+    const host = (await first.resolveHost(5))!;
+    await second.connect({ ...host });
+    expect(h.connects[0].target).not.toHaveProperty("password");
+  });
+
   it("passes a given stream through to the pipeline, gated like any connect", async () => {
     const stream = { throughSource: true };
     const ssh = createPluginSsh({

src/backend/tests/plugins/user-data.test.ts

@@ -117,6 +117,32 @@ describe("plugin user data", () => {
     expect(again).toMatchObject({ imported: 0, skipped: 1 });
   });
 
+  it("writes large tables in chunks and lets the event loop run between them", async () => {
+    const insert = sqlite.prepare(
+      "INSERT INTO p_fixture_bookmark (user_id, path) VALUES ('u1', ?)",
+    );
+    sqlite.transaction(() => {
+      for (let i = 0; i < 4999; i++) insert.run(`/p/${i}`);
+    })();
+    const file = new Database(":memory:");
+    file.exec("CREATE TABLE users (id TEXT PRIMARY KEY)");
+    file.exec("CREATE TABLE ssh_data (id INTEGER PRIMARY KEY)");
+    file.exec("INSERT INTO users (id) VALUES ('u1')");
+    const transaction = vi.spyOn(file, "transaction");
+    let ticks = 0;
+    const ticker = setInterval(() => ticks++, 0);
+
+    const written = await writeUserPluginTables(file, "u1");
+    clearInterval(ticker);
+
+    expect(written).toBe(5000);
+    expect(transaction).toHaveBeenCalled();
+    expect(ticks).toBeGreaterThan(0);
+    expect(
+      file.prepare("SELECT COUNT(*) AS n FROM p_fixture_bookmark").get(),
+    ).toEqual({ n: 5000 });
+  });
+
   it("reads a pre-2.9 export by the legacy table name", async () => {
     const file = new Database(":memory:");
     file.exec(

src/backend/tests/sync/host-plugin-settings.test.ts

@@ -11,10 +11,19 @@ const h = vi.hoisted(() => ({
   writes: [] as Array<[string, number, string, unknown]>,
   hooks: new Map<string, unknown>(),
   manifests: [] as PluginManifest[],
+  visible: null as Record<string, Record<string, unknown>> | null,
+  viewerCalls: [] as Array<[Record<string, unknown>, string | undefined]>,
 }));
 
 vi.mock("../../database/routes/host-plugin-settings.js", () => ({
   hostSettingsPlugins: () => h.manifests,
+  withHostPluginSettings: async (
+    host: Record<string, unknown>,
+    viewerId?: string,
+  ) => {
+    h.viewerCalls.push([host, viewerId]);
+    return h.visible ? { ...host, pluginSettings: h.visible } : host;
+  },
 }));
 vi.mock("../../plugins/registry.js", () => ({
   consume: (key: string) => h.hooks.get(key),
@@ -65,11 +74,27 @@ const VAULT = {
   },
 } as unknown as PluginManifest;
 
+const TUNNELS = {
+  id: "tunnels",
+  contributes: {
+    settings: {
+      host: {
+        fields: [
+          { key: "enableTunnel", type: "boolean", labelKey: "k" },
+          { key: "tunnelConnections", type: "custom", labelKey: "k" },
+        ],
+      },
+    },
+  },
+} as unknown as PluginManifest;
+
 beforeEach(() => {
   h.stored.clear();
   h.writes.length = 0;
   h.hooks.clear();
   h.manifests = [VAULT];
+  h.visible = null;
+  h.viewerCalls.length = 0;
   h.hooks.set("vault.hostSettingsSync", {
     exportValue: (key: string, value: unknown) =>
       key === "profileId" && value === 4 ? "profile-sync-4" : value,
@@ -87,6 +112,25 @@ describe("host plugin settings over sync", () => {
     });
   });
 
+  it("exports only what a shared host's viewer sees", async () => {
+    h.manifests = [VAULT, TUNNELS];
+    h.visible = {
+      vault: { token: { set: true } },
+      tunnels: { enableTunnel: true, tunnelConnections: [{ sourcePort: 22 }] },
+    };
+    expect(
+      await exportHostPluginSettings(1, {
+        userId: "viewer",
+        permissionLevel: "connect",
+      }),
+    ).toEqual({
+      tunnels: { enableTunnel: true, tunnelConnections: [{ sourcePort: 22 }] },
+    });
+    expect(h.viewerCalls).toEqual([
+      [{ id: 1, isShared: true, permissionLevel: "connect" }, "viewer"],
+    ]);
+  });
+
   it("imports them back to local ids", async () => {
     await importHostPluginSettings(9, {
       vault: { profileId: "profile-sync-4", token: "ignored" },

src/backend/tests/sync/host-protocol-auth.test.ts

@@ -8,6 +8,8 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const state = vi.hoisted(() => ({
   logins: [] as Array<Record<string, unknown>>,
   replaced: null as null | { ownerId: string; hostId: number; logins: unknown },
+  rows: [] as Array<{ protocol: string }>,
+  recipient: new Map<string, Record<string, unknown> | Error>(),
 }));
 
 vi.mock(
@@ -20,6 +22,15 @@ vi.mock(
     return {
       ...actual,
       listProtocolLogins: async () => state.logins,
+      resolveRecipientProtocolLogin: async (
+        _host: unknown,
+        _userId: string,
+        declared: { id: string },
+      ) => {
+        const login = state.recipient.get(declared.id);
+        if (login instanceof Error) throw login;
+        return login;
+      },
       replaceProtocolLogins: async (
         ownerId: string,
         hostId: number,
@@ -30,6 +41,11 @@ vi.mock(
     };
   },
 );
+vi.mock("../../database/repositories/factory.js", () => ({
+  createCurrentHostProtocolAuthRepository: () => ({
+    listRowsForHost: async () => state.rows,
+  }),
+}));
 vi.mock("../../database/db/index.js", () => ({
   getDb: () => null,
   getSqlite: () => null,
@@ -37,12 +53,15 @@ vi.mock("../../database/db/index.js", () => ({
 
 import {
   exportProtocolLogins,
+  exportSharedProtocolLogins,
   importProtocolLogins,
 } from "../../sync/host-protocol-auth.js";
 import { setHostProtocolSource } from "../../hosts/protocol-auth/registry.js";
 
 beforeEach(() => {
   state.replaced = null;
+  state.rows = [];
+  state.recipient.clear();
   state.logins = [
     {
       protocol: "spice",
@@ -129,3 +148,52 @@ describe("host protocol logins over sync", () => {
     expect(state.replaced).toBeNull();
   });
 });
+
+describe("shared host protocol logins over sync", () => {
+  it("sends what the recipient may use as direct logins", async () => {
+    state.rows = [{ protocol: "spice" }, { protocol: "unknown" }];
+    state.recipient.set("spice", {
+      authType: "credential",
+      username: "alice",
+      password: "pw",
+      fields: { display: "2", ticket: "" },
+    });
+    expect(
+      await exportSharedProtocolLogins({ id: 1, userId: "owner" }, "viewer"),
+    ).toEqual({
+      spice: {
+        authType: "direct",
+        username: "alice",
+        password: "pw",
+        fields: { display: "2" },
+        credentialSyncId: null,
+      },
+    });
+  });
+
+  it("keeps a none login and skips one that fails", async () => {
+    setHostProtocolSource(() => [
+      { id: "spice", credentialFields: [], pluginId: "p", pluginName: "P" },
+      { id: "vnc", credentialFields: [], pluginId: "p", pluginName: "P" },
+    ]);
+    state.rows = [{ protocol: "spice" }, { protocol: "vnc" }];
+    state.recipient.set("spice", {
+      authType: "none",
+      username: "",
+      password: "",
+      fields: {},
+    });
+    state.recipient.set("vnc", new Error("locked"));
+    expect(
+      await exportSharedProtocolLogins({ id: 1, userId: "owner" }, "viewer"),
+    ).toEqual({
+      spice: {
+        authType: "none",
+        username: null,
+        password: null,
+        fields: {},
+        credentialSyncId: null,
+      },
+    });
+  });
+});

src/backend/tests/sync/two-way.test.ts

@@ -26,6 +26,7 @@ vi.mock("../../utils/database-save-trigger.js", () => ({
   DatabaseSaveTrigger: {
     triggerSave: vi.fn(),
     forceSave: vi.fn(async () => {}),
+    batched: <T>(work: T) => work,
   },
 }));
 vi.mock("../../utils/system-crypto.js", () => ({

src/backend/tests/upgrade/external-identity-migration.test.ts

@@ -111,4 +111,20 @@ describe("runExternalIdentityMigration", () => {
     expect(second).toEqual({ identities: 0, skipped: 1 });
     expect(h.state.identities).toHaveLength(1);
   });
+
+  it("does not recreate a legacy-oidc link that was moved to its provider", async () => {
+    user("oidc-user", { oidcIdentifier: "sub-1" });
+    h.state.identities.push({
+      id: 1,
+      userId: "oidc-user",
+      providerId: "1",
+      subject: "sub-1",
+      email: null,
+    } as never);
+
+    const result = await runExternalIdentityMigration();
+
+    expect(result).toEqual({ identities: 0, skipped: 1 });
+    expect(h.state.identities).toHaveLength(1);
+  });
 });

src/backend/tests/upgrade/snippets-schema-migration.test.ts

@@ -0,0 +1,57 @@
+import Database from "better-sqlite3";
+import { readFileSync } from "node:fs";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { repairSnippetsNoteColumn } from "../../upgrade/snippets-schema-migration.js";
+
+let sqlite: Database.Database;
+beforeEach(() => {
+  sqlite = new Database(":memory:");
+});
+afterEach(() => {
+  sqlite.close();
+});
+
+describe("snippet note column upgrade", () => {
+  it.each(["snippets", "p_snippets_snippets"])(
+    "repairs %s without losing rows",
+    (table) => {
+      sqlite.exec(
+        `CREATE TABLE "${table}" (id INTEGER PRIMARY KEY, user_id TEXT, content TEXT)`,
+      );
+      sqlite
+        .prepare(`INSERT INTO "${table}" VALUES (7, 'user', 'echo hello')`)
+        .run();
+      expect(() => sqlite.prepare(`SELECT "is_note" FROM "${table}"`)).toThrow(
+        /is_note/,
+      );
+      repairSnippetsNoteColumn(sqlite);
+      if (table === "snippets") {
+        sqlite.exec(
+          readFileSync(
+            "plugins/snippets/migrations/sqlite/0001_adopt_snippets_tables.sql",
+            "utf8",
+          ),
+        );
+      }
+      expect(
+        sqlite
+          .prepare("SELECT id, content, is_note FROM p_snippets_snippets")
+          .get(),
+      ).toEqual({ id: 7, content: "echo hello", is_note: 0 });
+      sqlite.exec("UPDATE p_snippets_snippets SET is_note = 1");
+      repairSnippetsNoteColumn(sqlite);
+      expect(
+        sqlite.prepare("SELECT is_note FROM p_snippets_snippets").get(),
+      ).toEqual({ is_note: 1 });
+    },
+  );
+
+  it("does not create tables on a fresh install", () => {
+    repairSnippetsNoteColumn(sqlite);
+    expect(
+      sqlite
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+        .all(),
+    ).toEqual([]);
+  });
+});

src/backend/tests/upgrade/sso-legacy-identity-migration.test.ts

@@ -0,0 +1,200 @@
+/**
+ * 2.8 OIDC accounts with no provider id were filed under "legacy-oidc", but
+ * the sso plugin signs in through the migrated provider row (#1381). They move
+ * to that row when it is the only one from before 2.9 and the env provider is
+ * not in use; anything ambiguous is left alone.
+ */
+
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const h = vi.hoisted(() => ({
+  db: null as unknown,
+  warn: null as unknown as ReturnType<typeof vi.fn>,
+}));
+
+vi.mock("../../database/db/index.js", () => ({ getDb: () => h.db }));
+vi.mock("../../utils/logger.js", () => {
+  const log = { info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+  h.warn = log.warn;
+  return { databaseLogger: log };
+});
+
+const { runSsoLegacyIdentityMigration } =
+  await import("../../upgrade/sso-legacy-identity-migration.js");
+
+const ENV = [
+  "OIDC_CLIENT_ID",
+  "OIDC_CLIENT_SECRET",
+  "OIDC_ISSUER_URL",
+  "OIDC_AUTHORIZATION_URL",
+  "OIDC_TOKEN_URL",
+  "OIDC_ENV_OVERRIDE",
+];
+
+let sqlite: Database.Database;
+
+function setup(providers: Array<[number, string, number, number]>) {
+  sqlite = new Database(":memory:");
+  sqlite.exec(`
+    CREATE TABLE users (id TEXT PRIMARY KEY, oidc_identifier TEXT);
+    CREATE TABLE p_sso_providers (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      name TEXT NOT NULL DEFAULT 'x',
+      type TEXT NOT NULL,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      legacy_callback INTEGER NOT NULL DEFAULT 0
+    );
+    CREATE TABLE user_external_identities (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      user_id TEXT NOT NULL,
+      provider_id TEXT NOT NULL,
+      subject TEXT NOT NULL,
+      email TEXT
+    );
+  `);
+  const insert = sqlite.prepare(
+    "INSERT INTO p_sso_providers (id, type, enabled, legacy_callback) VALUES (?, ?, ?, ?)",
+  );
+  for (const row of providers) insert.run(...row);
+  h.db = drizzle(sqlite);
+}
+
+function addUser(id: string, identifier: string, providerId: string) {
+  sqlite
+    .prepare("INSERT INTO users (id, oidc_identifier) VALUES (?, ?)")
+    .run(id, identifier);
+  const subject = identifier.replace(/^github:[^:]+:/, "");
+  sqlite
+    .prepare(
+      "INSERT INTO user_external_identities (user_id, provider_id, subject) VALUES (?, ?, ?)",
+    )
+    .run(id, providerId, subject);
+}
+
+function links() {
+  return sqlite
+    .prepare(
+      "SELECT user_id, provider_id, subject FROM user_external_identities ORDER BY id",
+    )
+    .all();
+}
+
+beforeEach(() => {
+  for (const name of ENV) delete process.env[name];
+});
+
+afterEach(() => {
+  for (const name of ENV) delete process.env[name];
+});
+
+describe("runSsoLegacyIdentityMigration", () => {
+  it("moves legacy OIDC sign-ins to the one migrated provider", async () => {
+    setup([
+      [1, "oidc", 1, 1],
+      [2, "github", 1, 1],
+    ]);
+    addUser("alice", "sub-a", "legacy-oidc");
+    addUser("gh", "github:null:42", "legacy-oidc");
+
+    const result = await runSsoLegacyIdentityMigration();
+
+    expect(result).toEqual({ moved: 1, conflicts: 0 });
+    expect(links()).toEqual([
+      { user_id: "alice", provider_id: "1", subject: "sub-a" },
+      { user_id: "gh", provider_id: "legacy-oidc", subject: "42" },
+    ]);
+  });
+
+  it("ignores OIDC providers added after the upgrade", async () => {
+    setup([
+      [1, "oidc", 1, 1],
+      [5, "oidc", 1, 0],
+    ]);
+    addUser("alice", "sub-a", "legacy-oidc");
+
+    await runSsoLegacyIdentityMigration();
+
+    expect(links()).toEqual([
+      { user_id: "alice", provider_id: "1", subject: "sub-a" },
+    ]);
+  });
+
+  it("leaves them when two providers are from before 2.9", async () => {
+    setup([
+      [1, "oidc", 1, 1],
+      [2, "oidc", 1, 1],
+    ]);
+    addUser("alice", "sub-a", "legacy-oidc");
+
+    expect(await runSsoLegacyIdentityMigration()).toEqual({
+      moved: 0,
+      conflicts: 0,
+    });
+    expect(links()[0]).toMatchObject({ provider_id: "legacy-oidc" });
+  });
+
+  it("leaves them when the env provider signs in", async () => {
+    setup([[1, "oidc", 1, 1]]);
+    addUser("alice", "sub-a", "legacy-oidc");
+    for (const name of ENV.slice(0, 5)) process.env[name] = "x";
+    process.env.OIDC_ENV_OVERRIDE = "true";
+
+    await runSsoLegacyIdentityMigration();
+
+    expect(links()[0]).toMatchObject({ provider_id: "legacy-oidc" });
+  });
+
+  it("still moves them when env settings exist but the row is what signs in", async () => {
+    setup([[1, "oidc", 1, 1]]);
+    addUser("alice", "sub-a", "legacy-oidc");
+    for (const name of ENV.slice(0, 5)) process.env[name] = "x";
+
+    await runSsoLegacyIdentityMigration();
+
+    expect(links()[0]).toMatchObject({ provider_id: "1" });
+  });
+
+  it("skips a subject a 2.9.0 duplicate account already holds", async () => {
+    setup([[1, "oidc", 1, 1]]);
+    addUser("alice", "sub-a", "legacy-oidc");
+    sqlite
+      .prepare(
+        "INSERT INTO user_external_identities (user_id, provider_id, subject) VALUES ('dup', '1', 'sub-a')",
+      )
+      .run();
+
+    const result = await runSsoLegacyIdentityMigration();
+
+    expect(result).toEqual({ moved: 0, conflicts: 1 });
+    expect(h.warn).toHaveBeenCalled();
+    expect(links()).toHaveLength(2);
+  });
+
+  it("drops the legacy link once the same account holds the real one", async () => {
+    setup([[1, "oidc", 1, 1]]);
+    addUser("alice", "sub-a", "legacy-oidc");
+    sqlite
+      .prepare(
+        "INSERT INTO user_external_identities (user_id, provider_id, subject) VALUES ('alice', '1', 'sub-a')",
+      )
+      .run();
+
+    await runSsoLegacyIdentityMigration();
+
+    expect(links()).toEqual([
+      { user_id: "alice", provider_id: "1", subject: "sub-a" },
+    ]);
+  });
+
+  it("is idempotent", async () => {
+    setup([[1, "oidc", 1, 1]]);
+    addUser("alice", "sub-a", "legacy-oidc");
+    await runSsoLegacyIdentityMigration();
+    expect(await runSsoLegacyIdentityMigration()).toEqual({
+      moved: 0,
+      conflicts: 0,
+    });
+  });
+});

src/backend/tests/utils/database-save-trigger.test.ts

@@ -7,6 +7,25 @@ describe("DatabaseSaveTrigger", () => {
     DatabaseSaveTrigger.cleanup();
   });
 
+  it("batches informational touches without scheduling per-session saves", async () => {
+    vi.useFakeTimers();
+    const save = vi.fn().mockResolvedValue(undefined);
+    DatabaseSaveTrigger.initialize(save);
+    for (let minute = 0; minute < 4; minute++) {
+      DatabaseSaveTrigger.markDirty();
+      await vi.advanceTimersByTimeAsync(60_000);
+    }
+    expect(save).not.toHaveBeenCalled();
+    expect(DatabaseSaveTrigger.isDirty).toBe(true);
+    expect(DatabaseSaveTrigger.getStatus().hasPendingTimeout).toBe(false);
+    const flushed = DatabaseSaveTrigger.forceSave("periodic_flush");
+    // A save yields one event-loop turn, which fake timers also control.
+    await vi.runOnlyPendingTimersAsync();
+    await flushed;
+    expect(save).toHaveBeenCalledOnce();
+    expect(DatabaseSaveTrigger.isDirty).toBe(false);
+  });
+
   it("force saves through the initialized save function", async () => {
     const save = vi.fn().mockResolvedValue(undefined);
     DatabaseSaveTrigger.initialize(save);
@@ -21,6 +40,18 @@ describe("DatabaseSaveTrigger", () => {
     });
   });
 
+  it("lets the event loop turn before a force save resolves", async () => {
+    DatabaseSaveTrigger.initialize(vi.fn().mockResolvedValue(undefined));
+    let turned = false;
+    setImmediate(() => {
+      turned = true;
+    });
+
+    await DatabaseSaveTrigger.forceSave("bulk_write");
+
+    expect(turned).toBe(true);
+  });
+
   it("debounces dirty saves and marks the database clean after saving", async () => {
     vi.useFakeTimers();
     const save = vi.fn().mockResolvedValue(undefined);
@@ -33,12 +64,24 @@ describe("DatabaseSaveTrigger", () => {
     expect(DatabaseSaveTrigger.getStatus().hasPendingTimeout).toBe(true);
 
     await vi.advanceTimersByTimeAsync(2000);
+    await vi.runOnlyPendingTimersAsync();
 
     expect(save).toHaveBeenCalledTimes(1);
     expect(DatabaseSaveTrigger.isDirty).toBe(false);
     expect(DatabaseSaveTrigger.getStatus().pendingSave).toBe(false);
   });
 
+  it("saves within the max wait even while writes keep coming", async () => {
+    vi.useFakeTimers();
+    const save = vi.fn().mockResolvedValue(undefined);
+    DatabaseSaveTrigger.initialize(save);
+    for (let second = 0; second < 40; second++) {
+      void DatabaseSaveTrigger.triggerSave("sample");
+      await vi.advanceTimersByTimeAsync(1000);
+    }
+    expect(save).toHaveBeenCalledTimes(1);
+  });
+
   it("queues a force save behind an in-flight save", async () => {
     let finishFirstSave: (() => void) | undefined;
     const firstSave = new Promise<void>((resolve) => {
@@ -62,4 +105,77 @@ describe("DatabaseSaveTrigger", () => {
     expect(save).toHaveBeenCalledTimes(2);
     expect(DatabaseSaveTrigger.getStatus().pendingSave).toBe(false);
   });
+
+  it("collapses force saves inside a batch into one save", async () => {
+    const save = vi.fn().mockResolvedValue(undefined);
+    DatabaseSaveTrigger.initialize(save);
+
+    const result = await DatabaseSaveTrigger.batched(async (rows: number) => {
+      for (let i = 0; i < rows; i++) {
+        await DatabaseSaveTrigger.forceSave("row_write");
+      }
+      expect(save).not.toHaveBeenCalled();
+      return rows;
+    })(50);
+
+    expect(result).toBe(50);
+    expect(save).toHaveBeenCalledTimes(1);
+    expect(DatabaseSaveTrigger.isDirty).toBe(false);
+  });
+
+  it("folds a nested batch into the outer one", async () => {
+    const save = vi.fn().mockResolvedValue(undefined);
+    DatabaseSaveTrigger.initialize(save);
+    const inner = DatabaseSaveTrigger.batched(() =>
+      DatabaseSaveTrigger.forceSave("inner_write"),
+    );
+
+    await DatabaseSaveTrigger.batched(async () => {
+      await inner();
+      await inner();
+    })();
+
+    expect(save).toHaveBeenCalledTimes(1);
+  });
+
+  it("skips the save when a batch wrote nothing", async () => {
+    const save = vi.fn().mockResolvedValue(undefined);
+    DatabaseSaveTrigger.initialize(save);
+
+    await DatabaseSaveTrigger.batched(async () => {})();
+
+    expect(save).not.toHaveBeenCalled();
+  });
+
+  it("still saves what a failed batch wrote", async () => {
+    const save = vi.fn().mockResolvedValue(undefined);
+    DatabaseSaveTrigger.initialize(save);
+
+    await expect(
+      DatabaseSaveTrigger.batched(async () => {
+        await DatabaseSaveTrigger.forceSave("row_write");
+        throw new Error("boom");
+      })(),
+    ).rejects.toThrow("boom");
+
+    expect(save).toHaveBeenCalledTimes(1);
+  });
+
+  it("saves immediately for work that outlives its batch", async () => {
+    const save = vi.fn().mockResolvedValue(undefined);
+    DatabaseSaveTrigger.initialize(save);
+    let release: (() => void) | undefined;
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    let detached: Promise<void> | undefined;
+
+    await DatabaseSaveTrigger.batched(async () => {
+      detached = gate.then(() => DatabaseSaveTrigger.forceSave("late_write"));
+    })();
+    release?.();
+    await detached;
+
+    expect(save).toHaveBeenCalledTimes(1);
+  });
 });