fix(agent99): close canonical host readbacks

apps/api/tests/test_agent99_transport_recovery_deploy_contract.py

@@ -189,6 +189,7 @@ def test_agent99_99_config_has_bounded_transport_and_recovery_defaults() -> None
     assert config["recoverySlo"]["targetMinutes"] == 10
     assert "192.168.0.111" in config["hosts"]
     assert "192.168.0.111" in config["selfHealth"]["requiredHosts"]
+    assert config["sshUsers"]["192.168.0.111"] == "ooo"
     host111 = next(item for item in config["externalHosts"] if item["host"] == "192.168.0.111")
     assert host111["recoveryAction"] == "wake_on_lan"
     assert host111["required"] is True
@@ -227,6 +228,21 @@ def test_agent99_host111_recovery_is_allowlisted_and_independently_verified() ->
     assert 'New-AgentOutcomeCheck "external_hosts_recovered"' in source
 
 
+def test_agent99_host111_restricted_perf_readback_has_a_canonical_parser() -> None:
+    source = CONTROL.read_text(encoding="utf-8")
+    readback = (ROOT / "scripts/reboot-recovery/macos-host-boot-readback.sh").read_text(
+        encoding="utf-8"
+    )
+
+    assert "perf_schema=agent99_perf_readback_v1 os=darwin" in readback
+    assert "memory_pressure -Q" in readback
+    assert "sysctl -n hw.logicalcpu" in readback
+    assert "df -Pk /" in readback
+    assert "perf_schema=agent99_perf_readback_v1" in source
+    for group in ('Groups["cores"]', 'Groups["load"]', 'Groups["memory"]', 'Groups["disk"]'):
+        assert group in source
+
+
 def test_agent99_startup_recovery_uses_full_outcome_callback_and_learning_chain() -> None:
     tasks = (ROOT / "agent99-register-tasks.ps1").read_text(encoding="utf-8")
 
@@ -243,15 +259,19 @@ def test_agent99_deployer_migrates_and_verifies_host111_and_host112_sources() ->
     deploy = DEPLOY.read_text(encoding="utf-8")
 
     for migration in (
+        "host111_canonical_ssh_user",
         "host111_canonical_recovery_target",
         "host111_wol_executor",
         "host111_self_health_coverage",
-        "host112_ssd_vmx_source",
+        "host112_canonical_vmx_path",
     ):
         assert migration in deploy
-    assert '"S:\\VMs\\host112\\kali-linux-2025.4-vmware-amd64.vmx"' in deploy
+    assert "Get-AgentHost112CanonicalVm $policyConfigPath" in deploy
+    assert r"S:\VMs\host112\kali-linux-2025.4-vmware-amd64.vmx" not in deploy
+    assert "$persistedHost111User" in deploy
     assert "$host111ExternalReady" in deploy
-    assert "$host112VmxReady" in deploy
+    assert "$persistedHost112Vmx -ne $canonicalHost112Vmx" in deploy
+    assert "Test-Path -LiteralPath $persistedHost112Vmx -PathType Leaf" in deploy
 
 
 def test_agent99_deployer_verifies_promoted_runtime_and_writes_revision() -> None: