77fe133e

build(web): console logic answers to a test suite

a73x 2026-08-11 10:18

Commit message

build(web): console logic answers to a test suite

The console was rendering and fetch glue for long enough that it needed no
tests: a component either drew the snapshot or it did not, and the eye
caught that faster than an assertion would. vmTrustStale broke the run.
It is a real rule with a real contract — three separate cases where it
must answer false because answering true would assert more than the
console knows — and the whole point of those cases is that they are
invisible on screen. A regression in any of them shows up as a marker
that is quietly absent, or quietly on every guest in the fleet, and
nothing about the page looks wrong either way.

So web/ gets vitest, the smallest harness that runs the code as it ships.
The test imports the real export from fleet.svelte.ts: vitest inherits the
plugin pipeline from vite.config.ts, so the same compiler that builds the
SPA compiles the .svelte.ts module for the test run, and nothing had to be
extracted into a testable shape first. The environment is node, because
the rules under test are pure and the module's DOM-touching parts already
guard on `typeof window`.

The five tests are the contract in fleet.svelte.ts's comment, read back:
the guest that is stale, the guest that holds everything the tenant holds,
and one apiece for the three deliberate silences — CAs not fetched yet, a
guest that recorded no set, and a fingerprint neither side can read.

`make ci` runs them last, after site-check. web-test skips with a note
when the web toolchain is absent, exactly as `make api` does for
openapi-typescript, so `make ci` still runs on a machine with no Node; CI
builds the SPA first, so it is enforced there.

The rule this adopts: new console LOGIC lands with tests. Markup does not
need them.

Makefile

Old		New
@@ -12,7 +12,7 @@ LINT_WARN := errcheck,revive,gocyclo,funlen,gocritic,misspell,unconvert,nakedret
12		12
13	.PHONY: build build-go build-darwin web test vet proto clean \	13	.PHONY: build build-go build-darwin web test vet proto clean \
14	lint lint-extra arch cover fmt fmt-check tidy-check proto-check shape shape-check api api-check \	14	lint lint-extra arch cover fmt fmt-check tidy-check proto-check shape shape-check api api-check \
15	site site-check ci deadcode \	15	site site-check ci deadcode web-test \
16	deploy release ship hooks site-image server-image	16	deploy release ship hooks site-image server-image
17		17
18	# Enable the repo's client-side merge gate: point git at .githooks, whose	18	# Enable the repo's client-side merge gate: point git at .githooks, whose
@@ -196,6 +196,19 @@ site-image:
196	server-image: web	196	server-image: web
197	./scripts/server-image.sh	197	./scripts/server-image.sh
198		198
		199	# Console logic under test (web/src/*/.test.ts, run by vitest). New logic in
		200	# the SPA lands with tests; markup does not need them.
		201	#
		202	# Skips (does not fail) when the web toolchain is absent, like `make api` —
		203	# `make ci` still runs on a machine with no Node. CI runs `make web` first, so
		204	# the gate is enforced there.
		205	web-test:
		206	@if [ -x web/node_modules/.bin/vitest ]; then \
		207	cd web && npm test; \
		208	else \
		209	echo "web-test: vitest not installed (run 'make web') — SKIPPING (enforced in CI)"; \
		210	fi
		211
199	# Whole-program dead-code gate: fails on any function unreachable from a real	212	# Whole-program dead-code gate: fails on any function unreachable from a real
200	# entrypoint — every main() in cmd/. Rooting at the binaries (NOT -test) is what	213	# entrypoint — every main() in cmd/. Rooting at the binaries (NOT -test) is what
201	# catches production code kept alive only by its own tests; the fix is to remove	214	# catches production code kept alive only by its own tests; the fix is to remove
@@ -227,7 +240,7 @@ deadcode:
227	# The merge gate. Mirrors the required checks in CI. `test` is the authoritative	240	# The merge gate. Mirrors the required checks in CI. `test` is the authoritative
228	# race-detector run; `cover` re-runs without -race to enforce the ratchet; `arch`	241	# race-detector run; `cover` re-runs without -race to enforce the ratchet; `arch`
229	# re-runs the fitness tests with -count=1 (the race run may serve them cached).	242	# re-runs the fitness tests with -count=1 (the race run may serve them cached).
230	ci: vet build-go build-darwin arch lint fmt-check test cover tidy-check proto-check api-check shape-check deadcode site-check	243	ci: vet build-go build-darwin arch lint fmt-check test cover tidy-check proto-check api-check shape-check deadcode site-check web-test
231		244
232	# Compile every Go package (no Node/web build needed — the embed dir ships a	245	# Compile every Go package (no Node/web build needed — the embed dir ships a
233	# placeholder, so the server builds and serves a "UI not built" notice).	246	# placeholder, so the server builds and serves a "UI not built" notice).

web/package-lock.json

@@ @@ -20,7 +20,8 @@ @@
+				"svelte": "^5.56.1",
+				"svelte-check": "^4.6.0",
+				"typescript": "^6.0.3",
+				"vite": "^8.0.16",
+				"vitest": "^4.1.10"
+		},
+		"node_modules/@babel/code-frame": {
@@ @@ -616,6 +617,17 @@ @@
+				"tslib": "^2.4.0"
+		},
+		"node_modules/@types/chai": {
+			"version": "5.2.3",
+			"resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+			"integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@types/deep-eql": "*",
+				"assertion-error": "^2.0.1"
+			}
+		},
+		"node_modules/@types/cookie": {
+			"version": "0.6.0",
+			"resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
@@ @@ -623,6 +635,13 @@ @@
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/@types/deep-eql": {
+			"version": "4.0.2",
+			"resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+			"integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/@types/estree": {
+			"version": "1.0.9",
+			"resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
@@ @@ -647,6 +666,119 @@ @@
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/@vitest/expect": {
+			"version": "4.1.10",
+			"resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz",
+			"integrity": "sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@standard-schema/spec": "^1.1.0",
+				"@types/chai": "^5.2.2",
+				"@vitest/spy": "4.1.10",
+				"@vitest/utils": "4.1.10",
+				"chai": "^6.2.2",
+				"tinyrainbow": "^3.1.0"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/mocker": {
+			"version": "4.1.10",
+			"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.10.tgz",
+			"integrity": "sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/spy": "4.1.10",
+				"estree-walker": "^3.0.3",
+				"magic-string": "^0.30.21"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			},
+			"peerDependencies": {
+				"msw": "^2.4.9",
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+			},
+			"peerDependenciesMeta": {
+				"msw": {
+					"optional": true
+				},
+				"vite": {
+					"optional": true
+				}
+			}
+		},
+		"node_modules/@vitest/pretty-format": {
+			"version": "4.1.10",
+			"resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.10.tgz",
+			"integrity": "sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"tinyrainbow": "^3.1.0"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/runner": {
+			"version": "4.1.10",
+			"resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.10.tgz",
+			"integrity": "sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/utils": "4.1.10",
+				"pathe": "^2.0.3"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/snapshot": {
+			"version": "4.1.10",
+			"resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.10.tgz",
+			"integrity": "sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/pretty-format": "4.1.10",
+				"@vitest/utils": "4.1.10",
+				"magic-string": "^0.30.21",
+				"pathe": "^2.0.3"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/spy": {
+			"version": "4.1.10",
+			"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.10.tgz",
+			"integrity": "sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==",
+			"dev": true,
+			"license": "MIT",
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@vitest/utils": {
+			"version": "4.1.10",
+			"resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.10.tgz",
+			"integrity": "sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/pretty-format": "4.1.10",
+				"convert-source-map": "^2.0.0",
+				"tinyrainbow": "^3.1.0"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			}
+		},
+		"node_modules/@xterm/xterm": {
+			"version": "6.0.0",
+			"resolved": "https://registry.npmjs.org/@xterm/xterm/-/xterm-6.0.0.tgz",
@@ @@ -706,6 +838,16 @@ @@
+				"node": ">= 0.4"
+		},
+		"node_modules/assertion-error": {
+			"version": "2.0.1",
+			"resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+			"integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=12"
+			}
+		},
+		"node_modules/axobject-query": {
+			"version": "4.1.0",
+			"resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
@@ @@ -733,6 +875,16 @@ @@
+				"balanced-match": "^1.0.0"
+		},
+		"node_modules/chai": {
+			"version": "6.2.2",
+			"resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+			"integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/change-case": {
+			"version": "5.4.4",
+			"resolved": "https://registry.npmjs.org/change-case/-/change-case-5.4.4.tgz",
@@ @@ -773,6 +925,13 @@ @@
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/convert-source-map": {
+			"version": "2.0.0",
+			"resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+			"integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/cookie": {
+			"version": "0.6.0",
+			"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
@@ @@ -828,6 +987,13 @@ @@
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/es-module-lexer": {
+			"version": "2.3.1",
+			"resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.1.tgz",
+			"integrity": "sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/esm-env": {
+			"version": "1.2.2",
+			"resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
@@ @@ -853,6 +1019,26 @@ @@
+		},
+		"node_modules/estree-walker": {
+			"version": "3.0.3",
+			"resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+			"integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@types/estree": "^1.0.0"
+			}
+		},
+		"node_modules/expect-type": {
+			"version": "1.4.0",
+			"resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+			"integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+			"dev": true,
+			"license": "Apache-2.0",
+			"engines": {
+				"node": ">=12.0.0"
+			}
+		},
+		"node_modules/fast-deep-equal": {
+			"version": "3.1.3",
+			"resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ @@ -1389,6 +1575,13 @@ @@
+				"url": "https://github.com/sponsors/sindresorhus"
+		},
+		"node_modules/pathe": {
+			"version": "2.0.3",
+			"resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+			"integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/picocolors": {
+			"version": "1.1.1",
+			"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ @@ -1526,6 +1719,13 @@ @@
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/siginfo": {
+			"version": "2.0.0",
+			"resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+			"integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+			"dev": true,
+			"license": "ISC"
+		},
+		"node_modules/sirv": {
+			"version": "3.0.2",
+			"resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
@@ @@ -1551,6 +1751,20 @@ @@
+				"node": ">=0.10.0"
+		},
+		"node_modules/stackback": {
+			"version": "0.0.2",
+			"resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+			"integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/std-env": {
+			"version": "4.2.0",
+			"resolved": "https://registry.npmjs.org/std-env/-/std-env-4.2.0.tgz",
+			"integrity": "sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/supports-color": {
+			"version": "10.2.2",
+			"resolved": "https://registry.npmjs.org/supports-color/-/supports-color-10.2.2.tgz",
@@ @@ -1617,6 +1831,23 @@ @@
+				"typescript": ">=5.0.0"
+		},
+		"node_modules/tinybench": {
+			"version": "2.9.0",
+			"resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+			"integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+			"dev": true,
+			"license": "MIT"
+		},
+		"node_modules/tinyexec": {
+			"version": "1.3.0",
+			"resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.0.tgz",
+			"integrity": "sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/tinyglobby": {
+			"version": "0.2.17",
+			"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
@@ @@ -1634,6 +1865,16 @@ @@
+				"url": "https://github.com/sponsors/SuperchupuDev"
+		},
+		"node_modules/tinyrainbow": {
+			"version": "3.1.1",
+			"resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.1.tgz",
+			"integrity": "sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": ">=14.0.0"
+			}
+		},
+		"node_modules/totalist": {
+			"version": "3.0.1",
+			"resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
@@ @@ -1791,6 +2032,113 @@ @@
+		},
+		"node_modules/vitest": {
+			"version": "4.1.10",
+			"resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz",
+			"integrity": "sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@vitest/expect": "4.1.10",
+				"@vitest/mocker": "4.1.10",
+				"@vitest/pretty-format": "4.1.10",
+				"@vitest/runner": "4.1.10",
+				"@vitest/snapshot": "4.1.10",
+				"@vitest/spy": "4.1.10",
+				"@vitest/utils": "4.1.10",
+				"es-module-lexer": "^2.0.0",
+				"expect-type": "^1.3.0",
+				"magic-string": "^0.30.21",
+				"obug": "^2.1.1",
+				"pathe": "^2.0.3",
+				"picomatch": "^4.0.3",
+				"std-env": "^4.0.0-rc.1",
+				"tinybench": "^2.9.0",
+				"tinyexec": "^1.0.2",
+				"tinyglobby": "^0.2.15",
+				"tinyrainbow": "^3.1.0",
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+				"why-is-node-running": "^2.3.0"
+			},
+			"bin": {
+				"vitest": "vitest.mjs"
+			},
+			"engines": {
+				"node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+			},
+			"funding": {
+				"url": "https://opencollective.com/vitest"
+			},
+			"peerDependencies": {
+				"@edge-runtime/vm": "*",
+				"@opentelemetry/api": "^1.9.0",
+				"@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+				"@vitest/browser-playwright": "4.1.10",
+				"@vitest/browser-preview": "4.1.10",
+				"@vitest/browser-webdriverio": "4.1.10",
+				"@vitest/coverage-istanbul": "4.1.10",
+				"@vitest/coverage-v8": "4.1.10",
+				"@vitest/ui": "4.1.10",
+				"happy-dom": "*",
+				"jsdom": "*",
+				"vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+			},
+			"peerDependenciesMeta": {
+				"@edge-runtime/vm": {
+					"optional": true
+				},
+				"@opentelemetry/api": {
+					"optional": true
+				},
+				"@types/node": {
+					"optional": true
+				},
+				"@vitest/browser-playwright": {
+					"optional": true
+				},
+				"@vitest/browser-preview": {
+					"optional": true
+				},
+				"@vitest/browser-webdriverio": {
+					"optional": true
+				},
+				"@vitest/coverage-istanbul": {
+					"optional": true
+				},
+				"@vitest/coverage-v8": {
+					"optional": true
+				},
+				"@vitest/ui": {
+					"optional": true
+				},
+				"happy-dom": {
+					"optional": true
+				},
+				"jsdom": {
+					"optional": true
+				},
+				"vite": {
+					"optional": false
+				}
+			}
+		},
+		"node_modules/why-is-node-running": {
+			"version": "2.3.0",
+			"resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+			"integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"siginfo": "^2.0.0",
+				"stackback": "0.0.2"
+			},
+			"bin": {
+				"why-is-node-running": "cli.js"
+			},
+			"engines": {
+				"node": ">=8"
+			}
+		},
+		"node_modules/yaml-ast-parser": {
+			"version": "0.0.43",
+			"resolved": "https://registry.npmjs.org/yaml-ast-parser/-/yaml-ast-parser-0.0.43.tgz",

web/package.json

Old		New
@@ -10,7 +10,8 @@
10	"prepare": "svelte-kit sync \|\| echo ''",	10	"prepare": "svelte-kit sync \|\| echo ''",
11	"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",	11	"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
12	"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",	12	"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
13	"gen:api": "openapi-typescript ../docs/openapi.json -o src/lib/api-types.ts"	13	"gen:api": "openapi-typescript ../docs/openapi.json -o src/lib/api-types.ts",
		14	"test": "vitest run"
14	},	15	},
15	"overrides": {	16	"overrides": {
16	"openapi-typescript": {	17	"openapi-typescript": {
@@ -27,7 +28,8 @@
27	"svelte": "^5.56.1",	28	"svelte": "^5.56.1",
28	"svelte-check": "^4.6.0",	29	"svelte-check": "^4.6.0",
29	"typescript": "^6.0.3",	30	"typescript": "^6.0.3",
30	"vite": "^8.0.16"	31	"vite": "^8.0.16",
		32	"vitest": "^4.1.10"
31	},	33	},
32	"dependencies": {	34	"dependencies": {
33	"@xterm/xterm": "^6.0.0"	35	"@xterm/xterm": "^6.0.0"

web/src/lib/fleet.test.ts

@@ @@ -0,0 +1,90 @@ @@
+import { beforeEach, describe, expect, test } from 'vitest';
+import { fleet, vmTrustStale, type UserCA, type VM } from './fleet.svelte';
+import type { components } from './api-types';
+type TrustedCA = components['schemas']['TrustedCA'];
+const alpha = 'SHA256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
+const beta = 'SHA256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb';
+function userCA(fingerprint: string, label = 'ca'): UserCA {
+	return { fingerprint, label, pubkey: `ssh-ed25519 AAAA ${label}` };
+}
+/** vmTrusting is a VM as the fleet page sees one, carrying the CA set recorded
+ *  at its create. Pass null for a VM created before the set was recorded. */
+function vmTrusting(trusted_cas: TrustedCA[] | null): VM {
+	return {
+		actual_power: 'running',
+		assigned_ip: '10.0.0.2',
+		created_at: '2026-08-11T09:00:00Z',
+		deleted: false,
+		destroy_at: 0,
+		disk_gb: 10,
+		host_id: 'host-1',
+		id: 'vm-1',
+		image_url: 'https://example.invalid/img.raw',
+		last_error: '',
+		lifecycle: 'ready',
+		mem_mb: 1024,
+		name: 'guest',
+		persistent: false,
+		phase: 'ready',
+		power_state: 'running',
+		status: 'ready',
+		trusted_cas,
+		vcpus: 1
+	};
+}
+beforeEach(() => {
+	fleet.userCAs = [];
+	fleet.userCAsLoaded = false;
+});
+describe('vmTrustStale', () => {
+	test('a guest is stale when the tenant holds a CA the guest does not', () => {
+		fleet.userCAs = [userCA(alpha), userCA(beta)];
+		fleet.userCAsLoaded = true;
+		expect(vmTrustStale(vmTrusting([{ fingerprint: alpha, label: 'ca' }]))).toBe(true);
+	});
+	test('a guest holding every CA the tenant holds is current', () => {
+		fleet.userCAs = [userCA(alpha), userCA(beta)];
+		fleet.userCAsLoaded = true;
+		expect(
+			vmTrustStale(
+				vmTrusting([
+					{ fingerprint: alpha, label: 'ca' },
+					{ fingerprint: beta, label: 'ca' }
+				])
+			)
+		).toBe(false);
+	});
+	test('no guest is stale before the tenant CAs have been fetched', () => {
+		fleet.userCAs = [userCA(alpha)];
+		fleet.userCAsLoaded = false;
+		expect(vmTrustStale(vmTrusting([]))).toBe(false);
+	});
+	test('a guest that recorded no set is never stale, only silent', () => {
+		fleet.userCAs = [userCA(alpha)];
+		fleet.userCAsLoaded = true;
+		expect(vmTrustStale(vmTrusting(null))).toBe(false);
+	});
+	test('an unreadable fingerprint on either side is not counted as missing', () => {
+		fleet.userCAs = [userCA(alpha), userCA('')];
+		fleet.userCAsLoaded = true;
+		expect(vmTrustStale(vmTrusting([{ fingerprint: alpha, label: 'ca' }]))).toBe(false);
+		expect(
+			vmTrustStale(
+				vmTrusting([
+					{ fingerprint: alpha, label: 'ca' },
+					{ fingerprint: '', label: 'ca' }
+				])
+			)
+		).toBe(false);
+	});
+});

web/vite.config.ts

Old		New
@@ -1,6 +1,6 @@
1	import adapter from '@sveltejs/adapter-static';	1	import adapter from '@sveltejs/adapter-static';
2	import { sveltekit } from '@sveltejs/kit/vite';	2	import { sveltekit } from '@sveltejs/kit/vite';
3	import { defineConfig } from 'vite';	3	import { defineConfig } from 'vitest/config';
4		4
5	export default defineConfig({	5	export default defineConfig({
6	plugins: [	6	plugins: [
@@ -20,5 +20,13 @@ export default defineConfig({
20	proxy: {	20	proxy: {
21	'/api': 'http://localhost:8080'	21	'/api': 'http://localhost:8080'
22	}	22	}
		23	},
		24	// Console logic is tested where it lives: the same plugin pipeline compiles
		25	// the .svelte.ts modules for the test run, so a test imports the real export
		26	// rather than a copy of it. Node environment — the rules under test are
		27	// pure, and the modules that do touch the DOM guard on `typeof window`.
		28	test: {
		29	environment: 'node',
		30	include: ['src/*/.test.ts']
23	}	31	}
24	});	32	});