@checkstack/healthcheck-backend 1.21.2 → 1.22.0

package/src/realtime-aggregation.test.ts

@@ -1,12 +1,11 @@
 import { describe, it, expect, mock, beforeEach } from "bun:test";
+import { getHourBucketStart, incrementHourlyAggregate } from "./realtime-aggregation";
 import {
-  getHourBucketStart,
   serializeTDigest,
   deserializeTDigest,
-  incrementHourlyAggregate,
-} from "./realtime-aggregation";
+  createTDigest,
+} from "@checkstack/backend-api";
 import { computeAssertionKey } from "@checkstack/healthcheck-common";
-import { TDigest } from "tdigest";
 
 describe("getHourBucketStart", () => {
   it("floors timestamp to the hour", () => {
@@ -42,7 +41,7 @@ describe("getHourBucketStart", () => {
 
 describe("t-digest serialization", () => {
   it("serializes and deserializes empty t-digest", () => {
-    const original = new TDigest();
+    const original = createTDigest();
     const serialized = serializeTDigest(original);
     const restored = deserializeTDigest(serialized);
 
@@ -52,7 +51,7 @@ describe("t-digest serialization", () => {
   });
 
   it("serializes and deserializes t-digest with values", () => {
-    const original = new TDigest();
+    const original = createTDigest();
     original.push(100);
     original.push(200);
     original.push(300);
@@ -67,7 +66,7 @@ describe("t-digest serialization", () => {
   });
 
   it("preserves p95 accuracy after serialization", () => {
-    const original = new TDigest();
+    const original = createTDigest();
     // Add 100 values from 1 to 100
     for (let i = 1; i <= 100; i++) {
       original.push(i);
@@ -85,7 +84,7 @@ describe("t-digest serialization", () => {
 
   it("handles incremental updates correctly", () => {
     // First batch
-    const digest1 = new TDigest();
+    const digest1 = createTDigest();
     digest1.push(100);
     digest1.push(110);
 
@@ -254,7 +253,7 @@ describe("incrementHourlyAggregate", () => {
   it("updates min/max when existing aggregate has values", async () => {
     // Set up existing aggregate
     existingAggregate = {
-      tdigestState: serializeTDigest(new TDigest()),
+      tdigestState: serializeTDigest(createTDigest()),
       minLatencyMs: 100,
       maxLatencyMs: 200,
     };
@@ -309,7 +308,7 @@ describe("incrementHourlyAggregate", () => {
 
   it("updates max when new latency is higher", async () => {
     existingAggregate = {
-      tdigestState: serializeTDigest(new TDigest()),
+      tdigestState: serializeTDigest(createTDigest()),
       minLatencyMs: 100,
       maxLatencyMs: 200,
     };
@@ -361,7 +360,7 @@ describe("incrementHourlyAggregate", () => {
 
   it("accumulates t-digest state across multiple runs", async () => {
     // First run
-    const digest1 = new TDigest();
+    const digest1 = createTDigest();
     digest1.push(100);
     digest1.push(200);
     digest1.push(300);

package/src/realtime-aggregation.ts

@@ -2,6 +2,10 @@ import type {
   ScopedQueryRunner,
   CollectorRegistry,
 } from "@checkstack/backend-api";
+import {
+  pushValuesIntoState,
+  percentileFromState,
+} from "@checkstack/backend-api";
 import {
   ASSERTIONS_AGG_KEY,
   AssertionOutcomeSchema,
@@ -9,7 +13,6 @@ import {
   readAssertionStats,
   type AssertionOutcome,
 } from "@checkstack/healthcheck-common";
-import { TDigest } from "tdigest";
 import * as schema from "./schema";
 import { healthCheckAggregates } from "./schema";
 import { eq, and, sql } from "drizzle-orm";
@@ -30,46 +33,6 @@ export function getHourBucketStart(timestamp: Date): Date {
   return bucketStart;
 }
 
-/**
- * Serialize a t-digest to an array of numbers for storage.
- * Format: [centroid1_mean, centroid1_n, centroid2_mean, centroid2_n, ...]
- */
-export function serializeTDigest(digest: TDigest): number[] {
-  const centroids = digest.toArray();
-  const result: number[] = [];
-  for (const c of centroids) {
-    result.push(c.mean, c.n);
-  }
-  return result;
-}
-
-/**
- * Deserialize a t-digest from storage format.
- */
-export function deserializeTDigest(state: number[]): TDigest {
-  const digest = new TDigest();
-
-  if (state.length === 0) {
-    return digest;
-  }
-
-  // Reconstruct centroids from pairs of [mean, n]
-  const centroids: Array<{ mean: number; n: number }> = [];
-  for (let i = 0; i < state.length; i += 2) {
-    const mean = state[i];
-    const n = state[i + 1];
-    if (mean !== undefined && n !== undefined && n > 0) {
-      centroids.push({ mean, n });
-    }
-  }
-
-  if (centroids.length > 0) {
-    digest.push_centroid(centroids);
-  }
-
-  return digest;
-}
-
 interface IncrementHourlyAggregateParams {
   db: Db;
   systemId: string;
@@ -177,15 +140,14 @@ export async function incrementHourlyAggregate(
             max = latencyMs;
           }
 
-          // Update t-digest for p95 calculation
-          const digest =
-            existing?.tdigestState && existing.tdigestState.length > 0
-              ? deserializeTDigest(existing.tdigestState)
-              : new TDigest();
-
-          digest.push(latencyMs);
-          const tdigestState = serializeTDigest(digest);
-          const p95 = Math.round(digest.percentile(0.95));
+          // Update t-digest for p95 calculation (shared backend-api helper).
+          const tdigestState = pushValuesIntoState({
+            state: existing?.tdigestState ?? null,
+            values: [latencyMs],
+          });
+          const p95 = Math.round(
+            percentileFromState({ state: tdigestState, q: 0.95 }) ?? latencyMs,
+          );
 
           return { latencySumIncr, min, max, tdigestState, p95 };
         })();

package/src/router-satellite-ingest.test.ts

@@ -0,0 +1,136 @@
+import { describe, it, expect, mock } from "bun:test";
+import { call } from "@orpc/server";
+import { createMockRpcContext } from "@checkstack/backend-api";
+import { createHealthCheckRouter } from "./router";
+import { createStubHealthCheckCache } from "./cache-test-stub";
+import type { HealthRunReaction } from "./queue-executor";
+
+/**
+ * A satellite result MUST drive the SAME core post-run path a local run does:
+ * the reactive `health` entity write, the notification, the automation hooks,
+ * etc. The router routes it there via the injected `reactToSatelliteRun`
+ * reactor. These tests pin that wiring so ingest can never silently regress to
+ * an insert-only path (which is what left satellite-detected outages silent).
+ */
+
+// A service principal - ingestSatelliteResult is a backend-to-backend proc.
+const serviceContext = () =>
+  createMockRpcContext({
+    user: { type: "service", pluginId: "satellite-backend" } as never,
+  });
+
+function buildRouter(opts: {
+  reactToSatelliteRun?: (run: HealthRunReaction) => Promise<void>;
+  transaction?: ReturnType<typeof mock>;
+}) {
+  // db.select(...).from(...).where(...) resolves the config row (name +
+  // collectors) that processSatelliteResult reads.
+  const database = {
+    select: mock(() => ({
+      from: mock(() => ({
+        where: mock(() =>
+          Promise.resolve([{ name: "Ping", collectors: [] }]),
+        ),
+      })),
+    })),
+    transaction:
+      opts.transaction ??
+      mock(async () => {
+        /* not expected in the reactor path */
+      }),
+  };
+
+  const collectorRegistry = {
+    register: mock(() => {}),
+    getCollector: mock(() => undefined),
+    getCollectors: mock(() => []),
+  };
+
+  const catalogClient = {
+    getSystem: mock(async () => ({ id: "sys-1", name: "API Server" })),
+  };
+
+  return createHealthCheckRouter({
+    database: database as never,
+    registry: { getStrategy: mock(() => undefined) } as never,
+    collectorRegistry: collectorRegistry as never,
+    gitOpsClient: {} as never,
+    getEmitHook: () => undefined,
+    cache: createStubHealthCheckCache(),
+    configService: {} as never,
+    catalogClient: catalogClient as never,
+    maintenanceClient: {} as never,
+    logger: {
+      debug: mock(() => {}),
+      info: mock(() => {}),
+      warn: mock(() => {}),
+      error: mock(() => {}),
+    } as never,
+    ...(opts.reactToSatelliteRun
+      ? { reactToSatelliteRun: opts.reactToSatelliteRun }
+      : {}),
+  });
+}
+
+const ingestInput = {
+  configId: "config-1",
+  systemId: "sys-1",
+  status: "unhealthy" as const,
+  latencyMs: 123,
+  result: {
+    status: "unhealthy" as const,
+    latencyMs: 123,
+    message: "Check failed",
+    metadata: { connected: true, collectors: {} },
+  },
+  executedAt: "2026-07-03T10:00:00.000Z",
+  sourceId: "sat-eu",
+  sourceLabel: "EU West",
+  environmentId: "env-prod",
+};
+
+describe("ingestSatelliteResult - drives the shared post-run path", () => {
+  it("routes a satellite result through reactToSatelliteRun with its processed payload", async () => {
+    const runs: HealthRunReaction[] = [];
+    const router = buildRouter({
+      reactToSatelliteRun: async (run) => {
+        runs.push(run);
+      },
+    });
+
+    await call(router.ingestSatelliteResult, ingestInput, {
+      context: serviceContext(),
+    });
+
+    expect(runs).toHaveLength(1);
+    const run = runs[0];
+    // The run carries the satellite's SOURCE + environment, and its display
+    // name was resolved for the notification the shared path will send.
+    expect(run.systemId).toBe("sys-1");
+    expect(run.systemName).toBe("API Server");
+    expect(run.configId).toBe("config-1");
+    expect(run.configName).toBe("Ping");
+    expect(run.environmentId).toBe("env-prod");
+    expect(run.status).toBe("unhealthy");
+    expect(run.sourceId).toBe("sat-eu");
+    expect(run.sourceLabel).toBe("EU West");
+    expect(run.runTimestamp).toEqual(new Date("2026-07-03T10:00:00.000Z"));
+  });
+
+  it("falls back to an insert-only persist when no reactor is wired", async () => {
+    // Record that the insert-only fallback opened a transaction, without
+    // executing its body (the aggregate internals need a full db mock and are
+    // covered elsewhere); the point is that ingest still records the run.
+    const transaction = mock(async () => {});
+    const router = buildRouter({ transaction });
+
+    await call(router.ingestSatelliteResult, ingestInput, {
+      context: serviceContext(),
+    });
+
+    // The insert-only fallback ran (a run is still recorded), but there is no
+    // reactor path to drive notifications/automations - which is exactly why
+    // the real host always wires `reactToSatelliteRun`.
+    expect(transaction).toHaveBeenCalledTimes(1);
+  });
+});

package/src/router.ts

@@ -46,6 +46,7 @@ import { CatalogApi } from "@checkstack/catalog-common";
 import { MaintenanceApi } from "@checkstack/maintenance-common";
 import type { Logger } from "@checkstack/backend-api";
 import type { HealthCheckCache } from "./cache";
+import type { HealthRunReaction } from "./queue-executor";
 import {
   applySystemHealthOverrides,
   type SystemHealthOverrideReader,
@@ -104,6 +105,17 @@ export const createHealthCheckRouter = (opts: {
    * Optional so tests / no-incident deployments simply skip the fold.
    */
   incidentHealthOverrideReader?: SystemHealthOverrideReader;
+  /**
+   * Drives the SHARED core post-run path for an ingested satellite result -
+   * the reactive `health` entity write, cache reconcile, realtime signal,
+   * automation hooks, transition record, and subscriber notification - so a
+   * satellite-detected change reacts exactly like a local run. The host binds
+   * the service dependencies once (via a `persistRunAndReact` closure) and
+   * passes this narrowed reactor, so the local and satellite callers cannot
+   * pass different deps and drift. Optional so tests may omit it, in which case
+   * ingest falls back to an insert-only persist.
+   */
+  reactToSatelliteRun?: (run: HealthRunReaction) => Promise<void>;
 }) => {
   const {
     database,
@@ -118,6 +130,7 @@ export const createHealthCheckRouter = (opts: {
     signalService,
     recomputeSystemRollupHealth,
     incidentHealthOverrideReader,
+    reactToSatelliteRun,
   } = opts;
   // Create service instance once - shared across all handlers
   const service = new HealthCheckService(
@@ -612,6 +625,7 @@ export const createHealthCheckRouter = (opts: {
         enabled: input.body.enabled,
         stateThresholds: input.body.stateThresholds,
         satelliteIds: input.body.satelliteIds,
+        satelliteEnvironmentIds: input.body.satelliteEnvironmentIds,
         environmentIds: input.body.environmentIds,
         includeLocal: input.body.includeLocal,
         notificationPolicy: input.body.notificationPolicy,
@@ -634,6 +648,7 @@ export const createHealthCheckRouter = (opts: {
         enabled: input.enabled,
         stateThresholds: input.stateThresholds,
         satelliteIds: input.satelliteIds,
+        satelliteEnvironmentIds: input.satelliteEnvironmentIds,
         environmentIds: input.environmentIds,
         includeLocal: input.includeLocal,
         notificationPolicy: input.notificationPolicy,
@@ -899,10 +914,56 @@ export const createHealthCheckRouter = (opts: {
 
     ingestSatelliteResult: os.ingestSatelliteResult.handler(
       async ({ input }) => {
-        await service.ingestSatelliteResult(input);
-        // A satellite result writes a new run for this system, so the
-        // cached aggregate status is now stale.
-        await cache.invalidateSystem(input.systemId);
+        // Process the satellite's raw result (evaluate assertions, strip
+        // ephemeral fields, resolve the check name) WITHOUT persisting...
+        const { status, resultRecord, configName } =
+          await service.processSatelliteResult({
+            configId: input.configId,
+            status: input.status,
+            result: input.result,
+          });
+
+        if (reactToSatelliteRun) {
+          // ...then persist + REACT through the SAME core post-run path a local
+          // run uses (reactive entity, cache reconcile, signals, automation
+          // hooks, transition, notification). Previously ingest only inserted
+          // the row, so a satellite-detected outage fired no notifications or
+          // automations - routing it here is what keeps the two from drifting.
+          const system = await catalogClient
+            .getSystem({ systemId: input.systemId })
+            .catch(() => null);
+          await reactToSatelliteRun({
+            systemId: input.systemId,
+            systemName: system?.name ?? input.systemId,
+            configId: input.configId,
+            configName,
+            environmentId: input.environmentId ?? null,
+            // The env NAME is intentionally omitted (no extra catalog
+            // round-trip): the notifier falls back to the system name.
+            status,
+            latencyMs: input.latencyMs,
+            result: resultRecord,
+            sourceId: input.sourceId,
+            sourceLabel: input.sourceLabel,
+            runTimestamp: new Date(input.executedAt),
+          });
+        } else {
+          // No reactor wired (older host / test harness): fall back to a bare
+          // persist + cache refresh so the run is still recorded. The real host
+          // always wires the reactor above.
+          await service.insertSatelliteRun({
+            configId: input.configId,
+            systemId: input.systemId,
+            environmentId: input.environmentId ?? null,
+            status,
+            latencyMs: input.latencyMs,
+            result: resultRecord,
+            sourceId: input.sourceId,
+            sourceLabel: input.sourceLabel,
+            executedAt: input.executedAt,
+          });
+          await cache.invalidateSystem(input.systemId);
+        }
       },
     ),
 

package/src/schema.ts

@@ -111,6 +111,27 @@ export const systemHealthChecks = pgTable(
      * `length === 0`; jsonb stores both faithfully.
      */
     environmentIds: jsonb("environment_ids").$type<string[]>(),
+    /**
+     * Per-SATELLITE environment scoping, keyed by satellite id.
+     *
+     * Additive on top of `satelliteIds`, which still answers "which satellites
+     * run this". This answers "and for which environments", so a prod satellite
+     * can run only the prod environment instead of probing every environment
+     * from a network it may have no route to.
+     *
+     * Semantics per entry, mirroring `environmentIds`:
+     * - key ABSENT (or `null`) => that satellite runs every environment the
+     *   assignment resolves to. This is the backfilled default, so existing
+     *   rows keep behaving as they did.
+     * - `[]`       => opt out: that satellite runs ONCE with no environment.
+     * - non-empty  => exactly those ids, INTERSECTED with the assignment's own
+     *   effective set - a satellite can never widen the assignment's scope,
+     *   only narrow it.
+     */
+    satelliteEnvironmentIds:
+      jsonb("satellite_environment_ids").$type<
+        Record<string, string[] | null>
+      >(),
     /**
      * Whether to also run this check locally on the core instance.
      * Defaults to true. Only relevant when satelliteIds is set.

package/src/service-batching.test.ts

@@ -97,7 +97,9 @@ describe("HealthCheckService.getSystemHealthStatus - read batching", () => {
 
     const result = await service.getSystemHealthStatus("system-1");
 
-    expect(result.status).toBe("healthy");
+    // `unknown`, not `healthy`: a system with no checks is unmeasured, and this
+    // test is about transaction batching, not about inventing a status.
+    expect(result.status).toBe("unknown");
     expect(result.checkStatuses).toHaveLength(0);
     const transaction = (mockDb as unknown as { transaction: ReturnType<typeof mock> })
       .transaction;

package/src/service-ingest-assertions.test.ts

@@ -13,8 +13,9 @@ import { HealthCheckService } from "./service";
  * Satellite ingest evaluates assertions ON THE CORE (satellites never held
  * the assertion semantics — before this, satellite-executed checks silently
  * skipped assertions), then strips ephemeral fields for parity with local
- * runs. These tests drive `ingestSatelliteResult` against a mock db and
- * assert on the run row it persists.
+ * runs. `processSatelliteResult` returns the processed status + result record
+ * (and the check name); the shared post-run path persists it. These tests
+ * assert on that returned payload.
  */
 
 const KEY = computeAssertionKey({
@@ -30,43 +31,17 @@ const collectorResultSchema = z.object({
   body: healthResultString({ "x-ephemeral": true }),
 });
 
-function buildService({
-  entries,
-  inserted,
-}: {
-  entries: CollectorConfigEntry[];
-  inserted: Record<string, unknown>[];
-}) {
-  const tx = {
-    insert: mock(() => ({
-      values: mock((vals: Record<string, unknown>) => {
-        inserted.push(vals);
-        return Object.assign(Promise.resolve(), {
-          onConflictDoUpdate: mock(() => Promise.resolve()),
-          onConflictDoNothing: mock(() => Promise.resolve()),
-        });
-      }),
-    })),
+function buildService({ entries }: { entries: CollectorConfigEntry[] }) {
+  const db = {
     select: mock(() => ({
       from: mock(() => ({
         where: mock(() =>
-          Object.assign(Promise.resolve([]), {
-            limit: mock(() => Promise.resolve([])),
-          }),
+          Promise.resolve([{ name: "Test check", collectors: entries }]),
         ),
       })),
     })),
   };
 
-  const db = {
-    select: mock(() => ({
-      from: mock(() => ({
-        where: mock(() => Promise.resolve([{ collectors: entries }])),
-      })),
-    })),
-    transaction: mock(async (fn: (t: typeof tx) => Promise<void>) => fn(tx)),
-  };
-
   const collectorRegistry = {
     register: mock(() => {}),
     getCollector: mock(() => ({
@@ -113,64 +88,59 @@ const entries: CollectorConfigEntry[] = [
   },
 ];
 
-async function ingest({
+async function process({
   entries,
   statusCode,
 }: {
   entries: CollectorConfigEntry[];
   statusCode: number;
 }) {
-  const inserted: Record<string, unknown>[] = [];
-  const service = buildService({ entries, inserted });
-  await service.ingestSatelliteResult({
+  const service = buildService({ entries });
+  return service.processSatelliteResult({
     configId: "config-1",
-    systemId: "system-1",
     status: "healthy",
-    latencyMs: 42,
     result: satelliteResult({ statusCode }) as never,
-    executedAt: "2026-07-03T10:00:00.000Z",
-    sourceId: "sat-1",
-    sourceLabel: "EU West",
   });
-  const runInsert = inserted.find((v) => "status" in v && "result" in v);
-  expect(runInsert).toBeDefined();
-  return runInsert as Record<string, unknown>;
 }
 
-function collectorEntryOf(runInsert: Record<string, unknown>) {
-  const result = runInsert.result as {
+function collectorEntryOf(resultRecord: Record<string, unknown>) {
+  const result = resultRecord as {
     metadata: { collectors: Record<string, Record<string, unknown>> };
   };
   return result.metadata.collectors["entry-1"];
 }
 
-describe("ingestSatelliteResult - assertion evaluation at ingest", () => {
+describe("processSatelliteResult - assertion evaluation at ingest", () => {
   it("downgrades a satellite-healthy run whose assertion fails", async () => {
-    const runInsert = await ingest({ entries, statusCode: 404 });
-    expect(runInsert.status).toBe("unhealthy");
+    const { status, resultRecord } = await process({ entries, statusCode: 404 });
+    expect(status).toBe("unhealthy");
 
-    const entry = collectorEntryOf(runInsert);
+    const entry = collectorEntryOf(resultRecord);
     expect(entry._assertionFailed).toBe("statusCode equals 200");
     expect(entry._assertions).toEqual([
       expect.objectContaining({ key: KEY, passed: false, actual: "404" }),
     ]);
-    const message = (runInsert.result as { message: string }).message;
-    expect(message).toBe(
+    expect((resultRecord as { message: string }).message).toBe(
       "Check failed: Assertion failed: statusCode equals 200",
     );
   });
 
   it("keeps a passing run healthy and stores the passing outcome", async () => {
-    const runInsert = await ingest({ entries, statusCode: 200 });
-    expect(runInsert.status).toBe("healthy");
+    const { status, resultRecord } = await process({ entries, statusCode: 200 });
+    expect(status).toBe("healthy");
 
-    const entry = collectorEntryOf(runInsert);
+    const entry = collectorEntryOf(resultRecord);
     expect(entry._assertionFailed).toBeUndefined();
     expect(entry._assertions).toEqual([
       expect.objectContaining({ key: KEY, passed: true, actual: "200" }),
     ]);
   });
 
+  it("resolves the check name for the notification", async () => {
+    const { configName } = await process({ entries, statusCode: 200 });
+    expect(configName).toBe("Test check");
+  });
+
   it("strips ephemeral fields AFTER assertions ran against them", async () => {
     const withBodyAssertion: CollectorConfigEntry[] = [
       {
@@ -187,12 +157,12 @@ describe("ingestSatelliteResult - assertion evaluation at ingest", () => {
         ],
       },
     ];
-    const runInsert = await ingest({
+    const { status, resultRecord } = await process({
       entries: withBodyAssertion,
       statusCode: 200,
     });
 
-    const entry = collectorEntryOf(runInsert);
+    const entry = collectorEntryOf(resultRecord);
     // The JSONPath assertion evaluated against the (ephemeral) body...
     expect(entry._assertions).toEqual([
       expect.objectContaining({ passed: true, actual: "ok" }),
@@ -200,14 +170,17 @@ describe("ingestSatelliteResult - assertion evaluation at ingest", () => {
     // ...but the body itself never reaches storage.
     expect(entry.body).toBeUndefined();
     expect(entry.statusCode).toBe(200);
-    expect(runInsert.status).toBe("healthy");
+    expect(status).toBe("healthy");
   });
 
   it("tolerates collector entries the config no longer knows", async () => {
-    const runInsert = await ingest({ entries: [], statusCode: 500 });
+    const { status, resultRecord } = await process({
+      entries: [],
+      statusCode: 500,
+    });
     // No assertions configured: status passes through untouched.
-    expect(runInsert.status).toBe("healthy");
-    const entry = collectorEntryOf(runInsert);
+    expect(status).toBe("healthy");
+    const entry = collectorEntryOf(resultRecord);
     expect(entry._assertions).toBeUndefined();
   });
 });

package/src/service-paused-filter.test.ts

@@ -159,9 +159,12 @@ describe("HealthCheckService - paused configuration filtering", () => {
       const result = await service.getSystemHealthStatus("system-1");
 
       // The post-filter associations list is empty, so the system has no
-      // active checks and reads healthy — paused failures do NOT keep the
-      // system degraded.
-      expect(result.status).toBe("healthy");
+      // ACTIVE checks. Paused failures still do NOT keep the system degraded -
+      // that is the behaviour this test guards - but the result is now
+      // `unknown` rather than `healthy`: with its only check paused, nothing is
+      // measuring this system, and claiming health it has no evidence for is
+      // what made a broken check read green on the catalog and status page.
+      expect(result.status).toBe("unknown");
       expect(result.checkStatuses).toHaveLength(0);
     });
 
@@ -260,7 +263,9 @@ describe("HealthCheckService - paused configuration filtering", () => {
 
       const result = await service.getSystemHealthStatus("system-1");
 
-      expect(result.status).toBe("healthy");
+      // No enabled associations = nothing measured, so `unknown` rather than an
+      // invented `healthy`.
+      expect(result.status).toBe("unknown");
       expect(result.checkStatuses).toHaveLength(0);
     });
   });