From 05e31eadf03ffd25a11f6e3244b60f6ddf1462e5 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Sun, 6 Sep 2026 19:46:16 +0100
Subject: [PATCH] test(monitoring): synchronise canonical token host fixture

GetMonitor starts polling concurrently, so monitor.mu does not protect the fixture host slice from State.GetSnapshot. Use the state-owned UpsertHost setter to match the reader lock while retaining all canonical-token diagnostics assertions. Addresses the fixture race reported in PR1943 rest-1; no production behaviour changes.

Change-source: pulse-maintainer
---
 internal/monitoring/canonical_guardrails_test.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/internal/monitoring/canonical_guardrails_test.go b/internal/monitoring/canonical_guardrails_test.go
index ac7f80490..4398e9f8c 100644
--- a/internal/monitoring/canonical_guardrails_test.go
+++ b/internal/monitoring/canonical_guardrails_test.go
@@ -2683,8 +2683,9 @@ func TestDefaultOrgMonitorSharesCanonicalRuntimeTokenInventory(t *testing.T) {
 		Scopes:    []string{config.ScopeAgentExec},
 	}}
 	config.Mu.Unlock()
-	monitor.mu.Lock()
-	monitor.state.Hosts = []models.Host{{
+	// GetMonitor starts polling concurrently; host fixtures must use the
+	// state-owned lock, not monitor.mu, to synchronise with snapshots.
+	monitor.state.UpsertHost(models.Host{
 		ID:              "agent-fresh-token",
 		Hostname:        "fresh-token-host",
 		Status:          "online",
@@ -2692,8 +2693,7 @@ func TestDefaultOrgMonitorSharesCanonicalRuntimeTokenInventory(t *testing.T) {
 		AgentVersion:    "6.2.2",
 		TokenID:         "fresh-agent-token",
 		CommandsEnabled: true,
-	}}
-	monitor.mu.Unlock()
+	})
 
 	diagnostics := monitor.GetAgentFleetDiagnostics("6.2.2", now)
 	agent := requireAgentDiagnostic(t, diagnostics, "agent-agent-fresh-token")