Test the parts the docs call fragile: discover(), the socket payload, exit codes #28

Where the coverage isn't

27 functions are defined; the suite touches 8. The gaps that need no SSH and no network:

discover() — the README and CLAUDE.md both warn that the session-record schema "is not a documented interface and can change between releases". That warning describes this function, and it has no tests. tempfile.TemporaryDirectory plus mock.patch.object(cc_peer, "sessions_dir") covers all of it: non-numeric stems skipped, malformed JSON skipped, non-int pid skipped, missing socket path → reachable=False, and the include_unreachable filter.

post_to_socket() — nothing verifies the wire format. The protocol is the reason this tool exists. An AF_UNIX listener in a tmpdir gives a real round trip: exactly one JSON line terminated with \n, ensure_ascii=False so emoji survive as bytes (which the README advertises as "byte-for-byte"), CcPeerError on a missing path, and no leak from the post-SHUT_WR recv timeout.

main() exit codes — the README publishes 0/1/2 as a contract, and the branch deciding it is:

return EXIT_NO_TARGET if "no reachable session" in message else EXIT_ERROR

A string match against an error message. Reword resolve_target's error even slightly and exit 2 silently becomes exit 1, breaking any script that branches on it. main(argv) already takes argv, so this is easy to test.

While here

The README currently claims:

The cases cover ... the argument quoting that stops --to reaching a remote shell, the caps that weren't enforced under --dry-run, and the reply line's user and absolute path.

Only the third is true. run_remote() has no tests, so the quoting isn't covered; check_message is tested directly but nothing exercises cmd_send, so deleting its call would pass. Fix the sentence along with the gap.

run_remote() is testable too — test_cc_peer.py's RemoteInstalledVersion already mocks cc_peer.subprocess, and the same pattern covers the assembled command string, empty stdout, non-JSON, and in-band ok:false.

Acceptance criteria

• discover() covered against a temp directory of fixture records
• post_to_socket() verified against a real AF_UNIX listener
• Exit codes 0/1/2 asserted through main(argv)
• run_remote() command assembly covered with the existing mock pattern
• README's coverage claim matches reality