test(openspec): map cloud integration scenarios

tests/test_cloud_repository_contract.py

@@ -123,6 +123,37 @@ def test_repository_crud_contract(database_url: str) -> None:
         database.close()
 
 
+def test_repository_can_atomically_transfer_explicit_device_takeover(
+    database_url: str,
+) -> None:
+    database = CloudDatabase(database_url)
+    repository = database.repository
+    old_host_id = _unique_id("old-host")
+    new_host_id = _unique_id("new-host")
+    device_id = _unique_id("shared-device")
+
+    try:
+        repository.replace_host_devices(
+            old_host_id,
+            [_device(device_id, old_host_id)],
+        )
+        repository.replace_host_devices(
+            new_host_id,
+            [_device(device_id, new_host_id)],
+            allow_device_takeover=True,
+        )
+
+        matching = [
+            device
+            for device in repository.list_devices()
+            if device.device_id == device_id
+        ]
+        assert len(matching) == 1
+        assert matching[0].host_id == new_host_id
+    finally:
+        database.close()
+
+
 def test_failed_snapshot_transaction_rolls_back(database_url: str) -> None:
     database = CloudDatabase(database_url)
     repository = database.repository

tests/test_host_agent_internal_api.py

@@ -77,6 +77,33 @@ def test_authenticated_heartbeat_replaces_complete_snapshot(tmp_path) -> None:
     }
 
 
+def test_empty_heartbeat_removes_only_reporting_hosts_devices(tmp_path) -> None:
+    client, pool = _build_client(tmp_path)
+    client.put(
+        "/internal/v1/hosts/host-a/heartbeat",
+        headers={"Authorization": "Bearer token-a"},
+        json=_heartbeat_payload("host-a", "device-a"),
+    )
+    client.put(
+        "/internal/v1/hosts/host-b/heartbeat",
+        headers={"Authorization": "Bearer token-b"},
+        json=_heartbeat_payload("host-b", "device-b"),
+    )
+
+    response = client.put(
+        "/internal/v1/hosts/host-a/heartbeat",
+        headers={"Authorization": "Bearer token-a"},
+        json=_heartbeat_payload("host-a"),
+    )
+
+    assert response.status_code == 200
+    assert response.json()["accepted_devices"] == 0
+    devices = pool.store.list_devices()
+    assert [(device.device_id, device.host_id) for device in devices] == [
+        ("device-b", "host-b")
+    ]
+
+
 def test_invalid_duplicate_snapshot_preserves_previous_devices(tmp_path) -> None:
     client, pool = _build_client(tmp_path)
     client.put(
@@ -127,6 +154,35 @@ def test_live_device_owner_conflict_is_rejected_without_partial_sync(tmp_path) -
     assert devices[0].host_id == "host-a"
 
 
+def test_stale_device_owner_can_be_replaced_by_live_host(tmp_path) -> None:
+    client, pool = _build_client(tmp_path)
+    stale_at = datetime.now(UTC) - timedelta(seconds=61)
+    pool.store.upsert_host("host-a", address=None, last_seen_at=stale_at)
+    pool.store.replace_host_devices(
+        "host-a",
+        [
+            PooledDevice(
+                device_id="shared-device",
+                host_id="host-a",
+                driver_type="wda",
+                status="idle",
+                synced_at=stale_at,
+            )
+        ],
+    )
+
+    response = client.put(
+        "/internal/v1/hosts/host-b/heartbeat",
+        headers={"Authorization": "Bearer token-b"},
+        json=_heartbeat_payload("host-b", "shared-device"),
+    )
+
+    assert response.status_code == 200
+    device = pool.store.list_devices()[0]
+    assert device.device_id == "shared-device"
+    assert device.host_id == "host-b"
+
+
 def test_host_token_cannot_submit_heartbeat_for_another_host(tmp_path) -> None:
     client, pool = _build_client(tmp_path)