fix all seven failing tests — every one was a stale assertion, not a live bug

The suite has been carried at "1038 pass / 7 fail, same as baseline" for long
enough that the count became the thing being checked instead of the tests. All
seven turned out to pin a contract that changed on 2026-08-13, when a batch of
features were switched off pending plugin extraction. None was a defect in
running code; two were tests that could no longer detect what they were written
to detect.

── Five in registry.test.ts, one root cause ──

Switching a feature off comments out its `api:` line but keeps the permission
(the frontend route still needs gating, and existing role grants have to keep
meaning something). Eleven permissions therefore declare no API prefix now.

  • `REAL_WS` still listed 'desktop', which server.tsx stopped serving. The
    file's own header says it mirrors that map by hand and that this is "the
    drift this file keeps catching" — it caught it, and the failure was read as
    baseline for five days.
  • 'refuses a claim on a router that no longer exists' withdrew /gitea, which
    claims nothing any more, so nothing threw. The test could not fail for the
    right reason OR pass. Re-pointed at /tasks, which is core and mounted.
  • Two path→permission tests asserted /api/gitea and /api/caldav resolve.
    Re-pointed at /tasks and at /user vs /users — the latter is a live overlap
    AND a real privilege boundary (resolving /api/users to 'account' would hand
    the ordinary-account permission the user-administration API), where the old
    /dav vs /caldav pair mapped to one permission and never showed the property.
  • 'every permission declares at least one api prefix' stopped being true by
    design. Replaced with what it was protecting — a permission must gate
    SOMETHING reachable, api or route, since one gating nothing can be granted
    and revoked to no effect while reading as a control. `notify` is named as
    the one genuine exception rather than silently tolerated: no API, and no
    screen by design.

── plugins/music/cliamp: a real ordering fix, pushed separately ──

openPlayer checked for the cliamp binary BEFORE validating the path, so a path
escaping the owner's home answered "cliamp not found on host" on any machine
without it. Fixed there (3f4ee82): validate the request, then inspect the host.

── The pty timeout: an env var that had done nothing for five days ──

The test pinned `HOME_DIR: '/tmp'`. `HOME_DIR` was removed from the platform on
2026-08-13 when the install root became derived, and sessions.mjs resolves `~`
with node's `homedir()` — which reads `$HOME`. So the shell opened in the real
home, `pwd` never printed /tmp, and the test spent its full 15s timeout waiting
for output that could not arrive. One character class of a rename, five days
ago, costing 15s of every suite run since.

1044 pass, 0 fail, 85 files (unchanged). Suite is ~15s quicker for the obvious
reason.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/pty/index.test.ts

@@ -117,7 +117,12 @@ describe('pty sidecar', () => {
         // The sidecar chooses the shell and the home itself, so pin both rather than spawning the owner's
         // interactive zsh, which would read their rc files and their history.
         SHELL: '/bin/sh',
-        HOME_DIR: '/tmp',
+        // `HOME`, not `HOME_DIR`. This said `HOME_DIR: '/tmp'` until 2026-08-18 and had silently done
+        // nothing since 2026-08-13, when that variable was removed from the platform entirely (the install
+        // root is derived now — see `data-path.ts`). `sessions.mjs` resolves `~` with node's `homedir()`,
+        // which on POSIX reads `$HOME`, so the shell opened in the OWNER's real home and `pwd` never
+        // printed `/tmp`. The test then waited the full 15s for output that could not arrive.
+        HOME: '/tmp',
         ENV: '/dev/null',
       },
       stdout: 'ignore',
@@ -132,7 +137,7 @@ describe('pty sidecar', () => {
     const a = client(wsBase, `sessionId=${sessionId}&cwd=~&cols=80&rows=24`);
     await a.open();
 
-    // `~` is resolved by the sidecar against its own HOME_DIR.
+    // `~` is resolved by the sidecar against its own home — `homedir()` in sessions.mjs, pinned above.
     a.send({ type: 'input', data: 'pwd\n' });
     await a.await(sawOutput('/tmp'), 'pwd output');