Gate endpoint UI refresh on fresh telemetry and land endpoint agent

A command reaching 'succeeded' only proves the agent ran the action, not that it posted a new telemetry snapshot. Reloading panels on command success alone re-rendered stale service/process rows, so a stopped process could still show running right after Refresh Status.

Add a lightweight telemetrymeta probe exposing lastreportedat and gate both the header Refresh Status action and inline row Start/Stop on that stamp advancing past a pre-action baseline. Polling is bounded so an offline or idle agent never hangs the button, and messaging distinguishes a confirmed refresh from a queued one.

Bring the .NET endpoint agent source (service, tray, installer) into the repo so Cameron can merge and test, with an agent/.gitignore keeping bin/obj/publish out. Includes the DncMain launch-path fix, tray single-file host env scrub, and best-effort file logger.

plugins/computers/frontend/views/PCDetail.vue

@@ -3,6 +3,8 @@
     <div class="page-header">
       <h2>Computer Details</h2>
       <div class="header-actions">
+        <button v-if="canCommand" @click="refreshStatus" class="btn btn-secondary" :disabled="restarting || refreshing">{{ refreshing ? 'Refreshing...' : 'Refresh Status' }}</button>
+        <button v-if="canRestart" @click="confirmRestart" class="btn btn-warning" :disabled="restarting">Restart Computer</button>
         <router-link :to="`/print/asset-label/computer/${$route.params.id}`" class="btn btn-secondary" target="_blank">Print Label</router-link>
         <router-link :to="`/pcs/${$route.params.id}/edit`" class="btn btn-primary">Edit</router-link>
         <button @click="confirmRetire" class="btn btn-danger">Retire</button>
@@ -248,7 +250,7 @@
           <CustomFieldsSection :assetid="computer.assetid" />
 
           <!-- Warranty -->
-          <PluginAssetPanels :assetid="computer.assetid" />
+          <PluginAssetPanels ref="assetPanels" :assetid="computer.assetid" />
 
           <!-- All relationships (controls, defaultprinter, ...) -->
           <AssetRelationships v-if="computer.assetid" :assetid="computer.assetid" />
@@ -275,10 +277,10 @@
 </template>
 
 <script setup>
-import { ref, onMounted } from 'vue'
+import { ref, computed, onMounted } from 'vue'
 import { colorStyle } from "@/utils/colorStyle"
 import { useRoute, useRouter } from 'vue-router'
-import { computersApi, applicationsApi } from '@/api'
+import { computersApi, applicationsApi, endpointsApi } from '@/api'
 import { withBase } from '@/utils/basePath'
 import { useWarrantyBadge } from '@/composables/warrantyBadge'
 import LocationMapTooltip from '@/components/LocationMapTooltip.vue'
@@ -289,15 +291,26 @@ import { useIdentifierFlags } from '@/composables/identifierSettings'
 import { setRecordTitle } from '@/composables/pageTitle'
 import { useToast } from '@/composables/toast'
 import { apiError } from '@/utils/apiError'
+import { useAuthStore } from '@/stores/auth'
 
 const route = useRoute()
 const router = useRouter()
 const toast = useToast()
+const authStore = useAuthStore()
 const { isEnabled } = useIdentifierFlags()
 
 const loading = ref(true)
 const computer = ref(null)
 const installedApps = ref([])
+const assetPanels = ref(null)
+const restarting = ref(false)
+const refreshing = ref(false)
+
+// Header endpoint controls only make sense to users who can act on the agent.
+// Restart is gated separately because it is a destructive grant (endpoints.restart)
+// enforced again server-side; hiding the button is convenience, not the guard.
+const canCommand = computed(() => authStore.hasPermission('endpoints.command'))
+const canRestart = computed(() => authStore.hasPermission('endpoints.restart'))
 
 // Warranty fetch + hero badge (shared across asset detail pages).
 const { heroWarranty, warrantyDate: formatWarrantyDate } = useWarrantyBadge(() => computer.value?.assetid)
@@ -338,6 +351,108 @@ function formatDate(dateStr) {
   return new Date(dateStr).toLocaleString()
 }
 
+// Force a live telemetry cycle rather than re-reading the cached snapshot.
+// Enqueues collect_now (the agent reports off-cadence), waits for the agent to
+// finish it, then re-fetches the panels so the cards reflect the endpoint's
+// real current state (e.g. a process the operator just closed).
+async function refreshStatus() {
+  if (refreshing.value) return
+  refreshing.value = true
+  try {
+    // Baseline the current telemetry timestamp BEFORE forcing a collect. A
+    // command reaching 'succeeded' only means the agent ran collect_now, not
+    // that it has posted the fresh snapshot yet, so we additionally wait for
+    // lastreportedat to move past this baseline before re-rendering the panels.
+    const baseline = await currentTelemetryStamp()
+    const response = await endpointsApi.enqueueCommand(computer.value.assetid, 'collect_now')
+    const commandId = response?.data?.data?.endpointcommandid
+    const outcome = await waitForCommand(commandId)
+    const fresh = outcome === 'succeeded'
+      ? await waitForFreshTelemetry(baseline)
+      : false
+    await assetPanels.value?.refresh()
+    if (outcome === 'timeout') {
+      toast.info('Refresh queued; the endpoint agent may be offline or busy')
+    } else if (outcome === 'failed') {
+      toast.error('The endpoint agent could not refresh telemetry')
+    } else if (!fresh) {
+      toast.info('Refresh sent; the endpoint has not reported new data yet')
+    } else {
+      toast.success('Status refreshed')
+    }
+  } catch (error) {
+    toast.error(apiError(error, 'Failed to refresh status'))
+  } finally {
+    refreshing.value = false
+  }
+}
+
+// Read the endpoint's current lastreportedat (ISO string or null). Used as the
+// freshness baseline; a null baseline means the box has never reported, so any
+// non-null stamp later counts as fresh.
+async function currentTelemetryStamp() {
+  try {
+    const response = await endpointsApi.telemetryMeta(computer.value.assetid)
+    return response?.data?.data?.lastreportedat || null
+  } catch {
+    return null
+  }
+}
+
+// Poll lastreportedat until it advances past the baseline (proof a new snapshot
+// landed) or the attempt budget runs out. Returns true only on a confirmed
+// newer stamp; a bounded false lets the caller still refresh and message that
+// the box has not reported yet, rather than hanging the button on an idle agent.
+async function waitForFreshTelemetry(baseline, { attempts = 15, delayMs = 1000 } = {}) {
+  const baseMs = baseline ? Date.parse(baseline) : 0
+  for (let i = 0; i < attempts; i += 1) {
+    await new Promise((resolve) => setTimeout(resolve, delayMs))
+    const stamp = await currentTelemetryStamp()
+    if (stamp && Date.parse(stamp) > baseMs) return true
+  }
+  return false
+}
+
+// Poll the endpoint's recent commands until the given command reaches a terminal
+// state or we give up. Returns 'succeeded' | 'failed' | 'timeout'. The agent
+// long-polls, so a live box turns this around in a couple of seconds; an offline
+// box lets it time out cleanly rather than hanging the button forever.
+async function waitForCommand(commandId, { attempts = 15, delayMs = 1000 } = {}) {
+  if (!commandId) return 'timeout'
+  for (let i = 0; i < attempts; i += 1) {
+    await new Promise((resolve) => setTimeout(resolve, delayMs))
+    try {
+      const response = await endpointsApi.listCommands(computer.value.assetid)
+      const command = (response?.data?.data || []).find(
+        (row) => row.endpointcommandid === commandId)
+      if (command && command.status === 'succeeded') return 'succeeded'
+      if (command && command.status === 'failed') return 'failed'
+    } catch {
+      // Transient poll failure: keep trying until the attempt budget runs out.
+    }
+  }
+  return 'timeout'
+}
+
+// Destructive: queues a system_restart that reboots the PC immediately
+// (shutdown /r /t 0 on the agent). The confirm gate is the last stop before an
+// unrecoverable action; the server re-checks endpoints.restart regardless.
+async function confirmRestart() {
+  const label = computer.value?.assetnumber || computer.value?.name || 'this PC'
+  if (!confirm(`Restart ${label} now?\n\n`
+               + 'The computer reboots immediately with no grace period. '
+               + 'Any unsaved work on it will be lost.')) return
+  restarting.value = true
+  try {
+    await endpointsApi.enqueueCommand(computer.value.assetid, 'system_restart')
+    toast.success(`Restart queued for ${label}`)
+  } catch (error) {
+    toast.error(apiError(error, 'Failed to queue restart'))
+  } finally {
+    restarting.value = false
+  }
+}
+
 // Retire, not delete: the server deactivates the asset, so the PC
 // leaves every list and report while its history and relationships stay put.
 // Reversible by an admin setting isactive back to true.

plugins/endpoints/api/routes.py

@@ -11,7 +11,7 @@ import time
 from datetime import datetime, timedelta, timezone
 
 from flask import Blueprint, request, current_app
-from flask_jwt_extended import jwt_required, current_user
+from flask_jwt_extended import current_user
 
 from shopdb.api import (
     db, Asset, Setting, success_response, error_response, paginated_response,
@@ -21,7 +21,7 @@ from shopdb.api import (
 )
 
 from ..models import EndpointState, EndpointEvent, EndpointCommand
-from ..commands import COMMAND_ALLOWLIST, is_allowed_action, ALLOWED_ACTIONS_FOR, row_actions_for, requires_target, action_targetkind
+from ..commands import COMMAND_ALLOWLIST, is_allowed_action, ALLOWED_ACTIONS_FOR, row_actions_for, requires_target, action_targetkind, elevated_permission_for
 from ..eventcatalog import CRITICAL_EVENT_IDS, event_severity, event_title
 
 endpoints_bp = Blueprint('endpoints', __name__)
@@ -56,7 +56,6 @@ def _format_uptime(seconds):
 # =============================================================================
 
 @endpoints_bp.route('/', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def list_endpoints():
     """List reported endpoint states.
@@ -91,7 +90,6 @@ def list_endpoints():
 
 
 @endpoints_bp.route('/<int:asset_id>', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def get_endpoint(asset_id: int):
     """Get the current state for one endpoint by asset id."""
@@ -108,7 +106,6 @@ def get_endpoint(asset_id: int):
 
 
 @endpoints_bp.route('/<int:asset_id>/events', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def list_endpoint_events(asset_id: int):
     """List curated Windows events for one endpoint, newest first."""
@@ -136,7 +133,6 @@ def list_endpoint_events(asset_id: int):
 # =============================================================================
 
 @endpoints_bp.route('/asset/<int:asset_id>/status', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def panel_status(asset_id: int):
     """Keyvalue panel: the endpoint's current status snapshot.
@@ -168,8 +164,25 @@ def panel_status(asset_id: int):
     return success_response({'fields': fields})
 
 
+@endpoints_bp.route('/asset/<int:asset_id>/telemetrymeta', methods=['GET'])
+@require_permission('endpoints.view')
+def panel_telemetry_meta(asset_id: int):
+    """Lightweight freshness probe for the panels.
+
+    Returns just the endpoint's lastreportedat so the WebUI can tell whether a
+    genuinely new telemetry snapshot has landed after it forces a collect. The
+    UI captures this before enqueuing collect_now (or a row Start/Stop), then
+    polls until the stamp advances - a command reaching 'succeeded' only means
+    the agent ran it, not that it has yet posted the fresh services snapshot, so
+    gating the refresh on this timestamp is what avoids re-rendering stale rows.
+    """
+    state = EndpointState.query.filter_by(assetid=asset_id).first()
+    stamp = (state.lastreportedat.isoformat() + 'Z'
+             if state and state.lastreportedat else None)
+    return success_response({'lastreportedat': stamp})
+
+
 @endpoints_bp.route('/asset/<int:asset_id>/services', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def panel_services(asset_id: int):
     """List panel: monitored services/processes with a run-state badge per row.
@@ -199,6 +212,7 @@ def panel_services(asset_id: int):
         running = raw in ('running', 'started', 'up', 'ok', 'active')
         row = {
             'name': name,
+            'kind': (kind or '').lower() or None,
             'statelabel': 'Running' if running else (raw.title() or 'Unknown'),
             'statecolor': 'green' if running else ('red' if raw else 'gray'),
         }
@@ -217,7 +231,6 @@ def panel_services(asset_id: int):
 
 
 @endpoints_bp.route('/asset/<int:asset_id>/recentevents', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def panel_recent_events(asset_id: int):
     """List panel: the endpoint's most recent curated events, newest first.
@@ -241,7 +254,6 @@ def panel_recent_events(asset_id: int):
 
 
 @endpoints_bp.route('/asset/<int:asset_id>/interfaces', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def panel_interfaces(asset_id: int):
     """Table panel: every hardware NIC the agent last reported.
@@ -287,7 +299,6 @@ def panel_interfaces(asset_id: int):
 # =============================================================================
 
 @endpoints_bp.route('/dashboard/summary', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def dashboard_summary():
     """High-level fleet counts for the endpoints dashboard."""
@@ -315,7 +326,6 @@ def dashboard_summary():
 
 
 @endpoints_bp.route('/dashboard/quiet', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def dashboard_quiet():
     """Endpoints that reported before, then went quiet past the window.
@@ -351,7 +361,6 @@ def dashboard_quiet():
 
 
 @endpoints_bp.route('/dashboard/stability', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def dashboard_stability():
     """Endpoints with recent crash/shutdown/corruption events.
@@ -441,7 +450,6 @@ def _agentkey_status_payload():
 
 
 @endpoints_bp.route('/agentkey', methods=['GET'])
-@jwt_required()
 @require_role('admin')
 def get_agentkey():
     """Report the endpoint agent key state (no secret)."""
@@ -449,7 +457,6 @@ def get_agentkey():
 
 
 @endpoints_bp.route('/agentkey/regenerate', methods=['POST'])
-@jwt_required()
 @require_role('admin')
 def regenerate_agentkey():
     """Mint a fresh endpoint agent key, revoking any previous one.
@@ -480,7 +487,6 @@ def regenerate_agentkey():
 
 
 @endpoints_bp.route('/agentkey', methods=['DELETE'])
-@jwt_required()
 @require_role('admin')
 def revoke_agentkey():
     """Revoke the endpoint agent key: stop all managed-token endpoint traffic.
@@ -534,7 +540,6 @@ def _resolve_asset_for_hostname(hostname):
 
 
 @endpoints_bp.route('/<int:asset_id>/commands', methods=['GET'])
-@jwt_required()
 @require_permission('endpoints.view')
 def list_endpoint_commands(asset_id: int):
     """Recent commands for one endpoint, newest first (operator view)."""
@@ -547,7 +552,6 @@ def list_endpoint_commands(asset_id: int):
 
 
 @endpoints_bp.route('/<int:asset_id>/commands', methods=['POST'])
-@jwt_required()
 @require_permission('endpoints.command')
 def enqueue_endpoint_command(asset_id: int):
     """Queue an allowlisted command for one endpoint.
@@ -562,6 +566,16 @@ def enqueue_endpoint_command(asset_id: int):
         return error_response(ErrorCodes.VALIDATION_ERROR,
                               f'Unknown or disallowed action: {action!r}')
 
+    # Destructive actions (for example system_restart) demand a stricter grant
+    # ON TOP OF endpoints.command, so a remote reboot cannot ride the routine
+    # toggle permission.
+    elevated = elevated_permission_for(action)
+    if elevated and not current_user.haspermission(elevated):
+        return error_response(
+            ErrorCodes.FORBIDDEN,
+            f'Action {action!r} requires the {elevated} permission',
+            http_code=403)
+
     if action not in ALLOWED_ACTIONS_FOR(assetid=asset_id):
         return error_response(
             ErrorCodes.VALIDATION_ERROR,

plugins/endpoints/commands.py

@@ -69,9 +69,30 @@ COMMAND_ALLOWLIST = {
         'label': 'Check MTConnect',
         'description': 'Report whether the MTConnect UDC agent is running.',
     },
+    'system_restart': {
+        'label': 'Restart computer',
+        'description': 'Restart the endpoint computer immediately.',
+    },
+    'collect_now': {
+        'label': 'Collect now',
+        'description': 'Force the endpoint agent to report fresh telemetry off-cadence.',
+    },
 }
 
 
+# Actions that demand a permission stricter than the base endpoints.command.
+# The enqueue route requires the caller to ALSO hold the mapped permission, so a
+# destructive action (a remote reboot) is a heavier grant than a routine toggle.
+ELEVATED_ACTION_PERMISSIONS = {
+    'system_restart': 'endpoints.restart',
+}
+
+
+def elevated_permission_for(action):
+    """The extra permission an action requires, or None for routine actions."""
+    return ELEVATED_ACTION_PERMISSIONS.get(action)
+
+
 # Maps a monitored services/processes row to the start/stop/status actions that
 # control it, so the services panel can render an inline toggle on exactly the
 # rows that have a registered command action. The key is the agent-reported

plugins/endpoints/plugin.py

@@ -108,6 +108,11 @@ class EndpointsPlugin(BasePlugin):
             # shop-floor PC is a heavier grant than reading its telemetry.
             ('endpoints.command',
              'Send allowlisted commands to endpoint agents', 'endpoints'),
+            # Elevated grant for destructive endpoint actions (system_restart).
+            # Required IN ADDITION to endpoints.command by the enqueue route, so a
+            # remote reboot is a strictly heavier grant than a routine toggle.
+            ('endpoints.restart',
+             'Restart endpoint computers (destructive)', 'endpoints'),
             # Collector service scope for the endpoint agent. A managed token
             # scoped to ONLY this authorizes the endpoints collector and nothing
             # else, so rotating/revoking it stops endpoint-agent traffic without
@@ -181,6 +186,8 @@ class EndpointsPlugin(BasePlugin):
                 'icon': 'activity',
                 'route': '/endpoints',
                 'position': 16,
+                'permission': 'endpoints.view',
+                'section': 'fleet',
             },
         ]
 
@@ -192,11 +199,13 @@ class EndpointsPlugin(BasePlugin):
     def get_asset_panels(self) -> List[Dict]:
         """Per-PC detail panels, computer assets only.
 
-        Three panels feeding the generic renderer: the current status snapshot
-        (keyvalue), monitored services with a run-state badge (list), and the
-        most recent curated events (list). Each is a single-asset indexed read,
-        so the cost is the same profile as the warranty/backups panels. Panels
-        hide themselves when their endpoint returns nothing.
+        Panels feeding the generic renderer: the current status snapshot
+        (keyvalue), monitored services and processes split into two list cards
+        that share one services snapshot (filtered by kind), the most recent
+        curated events (list), and the network interfaces (table). Each is a
+        single-asset indexed read, so the cost is the same profile as the
+        warranty/backups panels. Panels hide themselves when their endpoint
+        returns nothing.
         """
         return [
             {
@@ -209,12 +218,13 @@ class EndpointsPlugin(BasePlugin):
                 'position': 10,
             },
             {
-                'id': 'endpoints-services',
-                'title': 'Services and processes',
+                'id': 'endpoints-tracked-services',
+                'title': 'Tracked Services',
                 'assettypes': ['computer'],
                 'endpoint': '/api/endpoints/asset/{assetid}/services',
                 'render': 'list',
                 'collapsible': True,
+                'filter': {'key': 'kind', 'equals': 'service'},
                 'status': {
                     'key': 'statecolor',
                     'levels': {
@@ -233,6 +243,32 @@ class EndpointsPlugin(BasePlugin):
                 'empty': 'No monitored services reported.',
                 'position': 12,
             },
+            {
+                'id': 'endpoints-tracked-processes',
+                'title': 'Tracked Processes',
+                'assettypes': ['computer'],
+                'endpoint': '/api/endpoints/asset/{assetid}/services',
+                'render': 'list',
+                'collapsible': True,
+                'filter': {'key': 'kind', 'equals': 'process'},
+                'status': {
+                    'key': 'statecolor',
+                    'levels': {
+                        'green': 'ok',
+                        'yellow': 'warning',
+                        'red': 'critical',
+                    },
+                },
+                'map': {
+                    'title': 'name',
+                    'badge': {'label': 'statelabel', 'color': 'statecolor'},
+                    'action': 'action',
+                },
+                'commandendpoint': '/api/endpoints/{assetid}/commands',
+                'permission': 'endpoints.command',
+                'empty': 'No monitored processes reported.',
+                'position': 13,
+            },
             {
                 'id': 'endpoints-events',
                 'title': 'Recent events',
@@ -263,7 +299,8 @@ class EndpointsPlugin(BasePlugin):
                     ],
                 },
                 'empty': 'No recent events.',
-                'position': 14,
+                'collapsedDefault': True,
+                'position': 90,
             },
             {
                 'id': 'endpoints-interfaces',

plugins/endpoints/tests/test_plugin.py

@@ -9,6 +9,10 @@ from flask import Blueprint
 
 from plugins.endpoints.plugin import EndpointsPlugin, CURATED_EVENT_IDS
 from plugins.endpoints.eventcatalog import EVENT_CATALOG, CRITICAL_EVENT_IDS
+from plugins.endpoints.commands import (
+    COMMAND_ALLOWLIST, is_allowed_action, elevated_permission_for,
+    requires_target,
+)
 
 
 def test_endpoints_plugin_meta_is_valid():
@@ -65,11 +69,41 @@ def test_endpoints_asset_panels_are_computer_scoped():
     """Every asset panel targets computer assets only, with an endpoint."""
     plugin = EndpointsPlugin()
     panels = plugin.get_asset_panels()
-    assert len(panels) == 3
+    assert len(panels) == 5
     for panel in panels:
         assert panel['assettypes'] == ['computer']
         assert panel['endpoint'].startswith('/api/endpoints/asset/{assetid}')
-        assert panel['render'] in ('keyvalue', 'list')
+        assert panel['render'] in ('keyvalue', 'list', 'table')
+
+
+def test_services_and_processes_are_split_into_two_filtered_cards():
+    """The single services card is now two cards filtered by row kind, both
+    reading the same services snapshot so a future top-20 collector is just
+    another filtered panel over the same feed."""
+    plugin = EndpointsPlugin()
+    panels = {p['id']: p for p in plugin.get_asset_panels()}
+    services = panels['endpoints-tracked-services']
+    processes = panels['endpoints-tracked-processes']
+    assert services['title'] == 'Tracked Services'
+    assert processes['title'] == 'Tracked Processes'
+    assert services['filter'] == {'key': 'kind', 'equals': 'service'}
+    assert processes['filter'] == {'key': 'kind', 'equals': 'process'}
+    # Both slice one endpoint feed.
+    assert services['endpoint'] == processes['endpoint']
+    assert services['endpoint'].endswith('/services')
+    # Command wiring carries over to both cards.
+    assert services['permission'] == 'endpoints.command'
+    assert processes['permission'] == 'endpoints.command'
+
+
+def test_recent_events_card_is_last_and_starts_collapsed():
+    """Events is the lowest-priority card: forced to the bottom of the column
+    and collapsed by default."""
+    plugin = EndpointsPlugin()
+    panels = plugin.get_asset_panels()
+    events = next(p for p in panels if p['id'] == 'endpoints-events')
+    assert events['collapsedDefault'] is True
+    assert events['position'] == max(p['position'] for p in panels)
 
 
 def test_endpoints_dashboard_widgets_declared():
@@ -90,3 +124,48 @@ def test_endpoints_navigation_item_points_at_fleet_view():
     items = plugin.get_navigation_items()
     routes = {item['route'] for item in items}
     assert '/endpoints' in routes
+
+
+def test_system_restart_is_allowlisted_and_policy_selectable():
+    """Restart is a real allowlisted action, so the policy builder (which
+    reads COMMAND_ALLOWLIST) surfaces it as a selectable action."""
+    assert is_allowed_action('system_restart')
+    assert 'system_restart' in COMMAND_ALLOWLIST
+    assert COMMAND_ALLOWLIST['system_restart']['label'] == 'Restart computer'
+
+
+def test_system_restart_requires_the_elevated_restart_permission():
+    """Restart maps to endpoints.restart so the enqueue route can demand a
+    heavier grant than the routine endpoints.command toggle. Routine actions
+    carry no elevated requirement."""
+    assert elevated_permission_for('system_restart') == 'endpoints.restart'
+    assert elevated_permission_for('mtconnect_start') is None
+
+
+def test_endpoints_declares_the_restart_permission():
+    """The dedicated restart permission is declared for role-grid seeding."""
+    plugin = EndpointsPlugin()
+    permissions = {name for name, *_ in plugin.get_permissions()}
+    assert 'endpoints.restart' in permissions
+    assert 'endpoints.command' in permissions
+
+
+def test_collect_now_is_allowlisted_targetless_and_routine():
+    """collect_now forces an off-cadence telemetry report. It is allowlisted so
+    the enqueue route accepts it, carries no wire target (fixed action), and
+    needs no elevated grant beyond endpoints.command."""
+    assert is_allowed_action('collect_now')
+    assert 'collect_now' in COMMAND_ALLOWLIST
+    assert not requires_target('collect_now')
+    assert elevated_permission_for('collect_now') is None
+
+
+def test_telemetrymeta_route_is_registered_for_freshness_gating():
+    """The WebUI gates panel refreshes on lastreportedat advancing, so the
+    lightweight freshness probe must be exposed on the plugin blueprint."""
+    from flask import Flask
+
+    application = Flask(__name__)
+    application.register_blueprint(EndpointsPlugin().get_blueprint())
+    rules = {rule.rule for rule in application.url_map.iter_rules()}
+    assert any(rule.endswith('/asset/<int:asset_id>/telemetrymeta') for rule in rules)