test(openspec): map cloud integration scenarios

tests/test_host_agent_internal_api.py

@@ -77,6 +77,33 @@ def test_authenticated_heartbeat_replaces_complete_snapshot(tmp_path) -> None:
     }
 
 
+def test_empty_heartbeat_removes_only_reporting_hosts_devices(tmp_path) -> None:
+    client, pool = _build_client(tmp_path)
+    client.put(
+        "/internal/v1/hosts/host-a/heartbeat",
+        headers={"Authorization": "Bearer token-a"},
+        json=_heartbeat_payload("host-a", "device-a"),
+    )
+    client.put(
+        "/internal/v1/hosts/host-b/heartbeat",
+        headers={"Authorization": "Bearer token-b"},
+        json=_heartbeat_payload("host-b", "device-b"),
+    )
+
+    response = client.put(
+        "/internal/v1/hosts/host-a/heartbeat",
+        headers={"Authorization": "Bearer token-a"},
+        json=_heartbeat_payload("host-a"),
+    )
+
+    assert response.status_code == 200
+    assert response.json()["accepted_devices"] == 0
+    devices = pool.store.list_devices()
+    assert [(device.device_id, device.host_id) for device in devices] == [
+        ("device-b", "host-b")
+    ]
+
+
 def test_invalid_duplicate_snapshot_preserves_previous_devices(tmp_path) -> None:
     client, pool = _build_client(tmp_path)
     client.put(
@@ -127,6 +154,35 @@ def test_live_device_owner_conflict_is_rejected_without_partial_sync(tmp_path) -
     assert devices[0].host_id == "host-a"
 
 
+def test_stale_device_owner_can_be_replaced_by_live_host(tmp_path) -> None:
+    client, pool = _build_client(tmp_path)
+    stale_at = datetime.now(UTC) - timedelta(seconds=61)
+    pool.store.upsert_host("host-a", address=None, last_seen_at=stale_at)
+    pool.store.replace_host_devices(
+        "host-a",
+        [
+            PooledDevice(
+                device_id="shared-device",
+                host_id="host-a",
+                driver_type="wda",
+                status="idle",
+                synced_at=stale_at,
+            )
+        ],
+    )
+
+    response = client.put(
+        "/internal/v1/hosts/host-b/heartbeat",
+        headers={"Authorization": "Bearer token-b"},
+        json=_heartbeat_payload("host-b", "shared-device"),
+    )
+
+    assert response.status_code == 200
+    device = pool.store.list_devices()[0]
+    assert device.device_id == "shared-device"
+    assert device.host_id == "host-b"
+
+
 def test_host_token_cannot_submit_heartbeat_for_another_host(tmp_path) -> None:
     client, pool = _build_client(tmp_path)