Replace the tautological session-id re-creation test with a real one

The prior test called createTelemetry() twice but asserted against
getSessionId(), which never reads from a Telemetry instance — it
would have passed even if createTelemetry() were never called. The
replacement drives the actual toggle.ts enable/disable/enable cycle
and asserts session_id stays constant across the captured payloads.

Author: TheGreatAxios

tests/unit/telemetry-toggle.test.ts

@@ -1,6 +1,6 @@
 import { test, expect } from "bun:test";
 import { createTelemetryToggleHandler, type TelemetryToggleDeps } from "../../src/telemetry/toggle.js";
-import { createTelemetry } from "../../src/telemetry/index.js";
+import { createTelemetry, getSessionId } from "../../src/telemetry/index.js";
 import type { Settings } from "../../src/config/settings.js";
 import type { Telemetry } from "../../src/telemetry/index.js";
 
@@ -178,3 +178,39 @@ test("toggle on re-enables after settings load/save resolve", async () => {
   expect(saved?.telemetry?.enabled).toBe(true);
   expect(getInstance().enabled).toBe(true);
 });
+
+test("session_id on captured payloads stays constant across an enable/disable/enable toggle cycle", async () => {
+  const capturedBodies: { properties: Record<string, unknown> }[] = [];
+  const fetchFn = ((_url: string, init: RequestInit) => {
+    capturedBodies.push(JSON.parse(init.body as string));
+    return Promise.resolve(new Response("1", { status: 200 }));
+  }) as unknown as typeof fetch;
+  const { deps, getInstance } = fakeDeps({
+    createTelemetry: (opts) =>
+      createTelemetry({ ...opts, env: opts.env ?? {}, apiKey: opts.apiKey ?? "test-key", fetchFn }),
+  });
+  const handler = createTelemetryToggleHandler("/fake/path", deps);
+
+  // Re-enable once up front so the captured instance is one built through
+  // deps.createTelemetry (and thus fetchFn) rather than fakeDeps' bootstrap
+  // instance, which is wired to its own separate fetch counter.
+  handler(true);
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  getInstance().capture("cli_start");
+
+  handler(false);
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  getInstance().capture("cli_start"); // disabled: no fetch, but proves the swapped instance is live
+
+  handler(true);
+  await new Promise((resolve) => setTimeout(resolve, 10));
+  getInstance().capture("cli_start");
+
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  expect(capturedBodies.length).toBe(2);
+  const sessionId = capturedBodies[0].properties.session_id;
+  expect(typeof sessionId).toBe("string");
+  expect((sessionId as string).length).toBeGreaterThan(0);
+  expect(capturedBodies[1].properties.session_id).toBe(sessionId);
+  expect(sessionId).toBe(getSessionId());
+});

tests/unit/telemetry.test.ts

@@ -269,14 +269,6 @@ test("capture attaches the same session_id across multiple events in one process
   expect(sessionId).toBe(getSessionId());
 });
 
-test("getSessionId is stable across separate createTelemetry instances in the same process", () => {
-  const first = createTelemetry({ settings: settingsWith("id"), env: {}, apiKey: "" });
-  const second = createTelemetry({ settings: settingsWith("id"), env: {}, apiKey: "" });
-  void first;
-  void second;
-  expect(getSessionId()).toBe(getSessionId());
-});
-
 test("ensureTelemetrySettings called twice keeps installationId and enabled flag unchanged", async () => {
   const dir = await mkdtemp(join(tmpdir(), "corbits-telemetry-settings-"));
   const path = join(dir, "settings.json");