@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/ipc/__tests__/watcher-ipc.test.ts

@@ -19,7 +19,7 @@ import { cliIpcCall } from "../cli-client.js";
 // DB + provider setup
 // ---------------------------------------------------------------------------
 
-initializeDb();
+await initializeDb();
 
 const mockProvider: WatcherProvider = {
   id: "test-provider",
@@ -67,12 +67,14 @@ afterEach(async () => {
 async function createTestWatcher(
   overrides?: Record<string, unknown>,
 ): Promise<Watcher> {
-  const result = await cliIpcCall<Watcher>("watcher_create", { body: {
-    name: "Test Watcher",
-    provider: "test-provider",
-    action_prompt: "Handle events",
-    ...overrides,
-  } });
+  const result = await cliIpcCall<Watcher>("watcher_create", {
+    body: {
+      name: "Test Watcher",
+      provider: "test-provider",
+      action_prompt: "Handle events",
+      ...overrides,
+    },
+  });
   expect(result.ok).toBe(true);
   expect(result.result).toBeDefined();
   createdWatcherIds.push(result.result!.id);
@@ -96,7 +98,9 @@ describe("watcher IPC routes", () => {
     expect(watcher.status).toBe("idle");
 
     // List all
-    const listResult = await cliIpcCall<Watcher[]>("watcher_list", { body: {} });
+    const listResult = await cliIpcCall<Watcher[]>("watcher_list", {
+      body: {},
+    });
     expect(listResult.ok).toBe(true);
     expect(Array.isArray(listResult.result)).toBe(true);
     const found = listResult.result!.find((w) => w.id === watcher.id);
@@ -112,10 +116,12 @@ describe("watcher IPC routes", () => {
     expect(Array.isArray(detailResult.result!.events)).toBe(true);
 
     // Update
-    const updateResult = await cliIpcCall<Watcher>("watcher_update", { body: {
-      watcher_id: watcher.id,
-      name: "Updated Watcher",
-    } });
+    const updateResult = await cliIpcCall<Watcher>("watcher_update", {
+      body: {
+        watcher_id: watcher.id,
+        name: "Updated Watcher",
+      },
+    });
     expect(updateResult.ok).toBe(true);
     expect(updateResult.result!.name).toBe("Updated Watcher");
 
@@ -133,7 +139,9 @@ describe("watcher IPC routes", () => {
     if (idx >= 0) createdWatcherIds.splice(idx, 1);
 
     // Confirm gone
-    const afterDelete = await cliIpcCall<Watcher[]>("watcher_list", { body: {} });
+    const afterDelete = await cliIpcCall<Watcher[]>("watcher_list", {
+      body: {},
+    });
     expect(afterDelete.ok).toBe(true);
     const gone = afterDelete.result!.find((w) => w.id === watcher.id);
     expect(gone).toBeUndefined();
@@ -142,11 +150,13 @@ describe("watcher IPC routes", () => {
   // -- Create: unknown provider -----------------------------------------------
 
   test("watcher/create rejects unknown provider", async () => {
-    const result = await cliIpcCall("watcher_create", { body: {
-      name: "Bad Watcher",
-      provider: "nonexistent",
-      action_prompt: "Do stuff",
-    } });
+    const result = await cliIpcCall("watcher_create", {
+      body: {
+        name: "Bad Watcher",
+        provider: "nonexistent",
+        action_prompt: "Do stuff",
+      },
+    });
     expect(result.ok).toBe(false);
     expect(result.error).toContain('Unknown provider "nonexistent"');
     expect(result.error).toContain("test-provider");
@@ -155,12 +165,14 @@ describe("watcher IPC routes", () => {
   // -- Create: poll interval too low ------------------------------------------
 
   test("watcher/create rejects poll_interval_ms < 15000", async () => {
-    const result = await cliIpcCall("watcher_create", { body: {
-      name: "Fast Watcher",
-      provider: "test-provider",
-      action_prompt: "Handle events",
-      poll_interval_ms: 5000,
-    } });
+    const result = await cliIpcCall("watcher_create", {
+      body: {
+        name: "Fast Watcher",
+        provider: "test-provider",
+        action_prompt: "Handle events",
+        poll_interval_ms: 5000,
+      },
+    });
     expect(result.ok).toBe(false);
     expect(result.error).toBeDefined();
   });
@@ -179,9 +191,11 @@ describe("watcher IPC routes", () => {
 
   test("watcher/update rejects when no update fields provided", async () => {
     const watcher = await createTestWatcher();
-    const result = await cliIpcCall("watcher_update", { body: {
-      watcher_id: watcher.id,
-    } });
+    const result = await cliIpcCall("watcher_update", {
+      body: {
+        watcher_id: watcher.id,
+      },
+    });
     expect(result.ok).toBe(false);
     expect(result.error).toContain("No updates provided");
   });
@@ -189,9 +203,11 @@ describe("watcher IPC routes", () => {
   // -- Delete: non-existent watcher -------------------------------------------
 
   test("watcher/delete returns error for non-existent watcher", async () => {
-    const result = await cliIpcCall("watcher_delete", { body: {
-      watcher_id: "does-not-exist",
-    } });
+    const result = await cliIpcCall("watcher_delete", {
+      body: {
+        watcher_id: "does-not-exist",
+      },
+    });
     expect(result.ok).toBe(false);
     expect(result.error).toContain("Watcher not found");
   });
@@ -211,11 +227,13 @@ describe("watcher IPC routes", () => {
   // -- Underscore aliases -----------------------------------------------------
 
   test("watcher_create alias works identically to watcher/create", async () => {
-    const result = await cliIpcCall<Watcher>("watcher_create", { body: {
-      name: "Alias Watcher",
-      provider: "test-provider",
-      action_prompt: "Handle events",
-    } });
+    const result = await cliIpcCall<Watcher>("watcher_create", {
+      body: {
+        name: "Alias Watcher",
+        provider: "test-provider",
+        action_prompt: "Handle events",
+      },
+    });
     expect(result.ok).toBe(true);
     expect(result.result!.name).toBe("Alias Watcher");
     createdWatcherIds.push(result.result!.id);
@@ -232,10 +250,12 @@ describe("watcher IPC routes", () => {
 
   test("watcher_update alias works identically to watcher/update", async () => {
     const watcher = await createTestWatcher();
-    const result = await cliIpcCall<Watcher>("watcher_update", { body: {
-      watcher_id: watcher.id,
-      name: "Alias Updated",
-    } });
+    const result = await cliIpcCall<Watcher>("watcher_update", {
+      body: {
+        watcher_id: watcher.id,
+        name: "Alias Updated",
+      },
+    });
     expect(result.ok).toBe(true);
     expect(result.result!.name).toBe("Alias Updated");
   });

package/src/ipc/assistant-server.ts

@@ -33,7 +33,7 @@ import { createServer, type Server, type Socket } from "node:net";
 
 import { ensureSocketDir, SocketWatchdog } from "@vellumai/ipc-server-utils";
 
-import { findLocalGuardianPrincipalId } from "../runtime/local-actor-identity.js";
+import { findLocalGuardianPrincipalIdFromStore } from "../runtime/local-actor-identity.js";
 import { RouteError } from "../runtime/routes/errors.js";
 import { ROUTES } from "../runtime/routes/index.js";
 import type {
@@ -55,6 +55,7 @@ import {
   type DbProxyTransactionParams,
   handleDbProxyTransaction,
 } from "./routes/db-proxy-transaction.js";
+import { INVITE_IPC_METHODS } from "./routes/invite-ipc-routes.js";
 import { routeDefinitionsToIpcMethods } from "./routes/route-adapter.js";
 import { ensureSocketPathFree } from "./socket-cleanup.js";
 import { resolveIpcSocketPath } from "./socket-path.js";
@@ -202,6 +203,13 @@ export class AssistantIpcServer {
       handleDbProxyTransaction(params as unknown as DbProxyTransactionParams),
     );
 
+    // IPC-only invite methods (see ipc/routes/invite-ipc-routes.ts). The
+    // gateway calls these back over IPC to mint tokens / redeem voice + token
+    // invites (assistant-owned secrets). No HTTP surface; never in ROUTES.
+    for (const [operationId, handler] of Object.entries(INVITE_IPC_METHODS)) {
+      this.methods.set(operationId, handler);
+    }
+
     this.methods.set("$cancel", (params) => {
       const targetId = (params as { targetId?: string }).targetId;
       if (targetId) this.abortControllers.get(targetId)?.abort();
@@ -629,7 +637,7 @@ function injectLocalActorHeader(
   // that require the header will fail-closed on their own.
   let localActor: string | undefined;
   try {
-    localActor = findLocalGuardianPrincipalId();
+    localActor = findLocalGuardianPrincipalIdFromStore();
   } catch (err) {
     log.debug(
       { err },

package/src/ipc/gateway-client.ts

@@ -62,6 +62,7 @@ let persistentClient: PackagePersistentIpcClient | null = null;
 export async function ipcCallPersistent(
   method: string,
   params?: Record<string, unknown>,
+  timeoutMs?: number,
 ): Promise<unknown> {
   if (!persistentClient) {
     persistentClient = new PackagePersistentIpcClient(
@@ -70,7 +71,7 @@ export async function ipcCallPersistent(
       log,
     );
   }
-  return persistentClient.call(method, params);
+  return persistentClient.call(method, params, timeoutMs);
 }
 
 /**

package/src/ipc/routes/__tests__/invite-ipc-routes.test.ts

@@ -0,0 +1,58 @@
+/**
+ * The three gateway-facing invite methods are IPC-only: registered on the
+ * assistant IPC server by operationId, and absent from the shared HTTP route
+ * set / `get_route_schema`. Relocating them out of `ROUTES` (per the
+ * documented IPC-only pattern) is what structurally guarantees they can never
+ * reach the gateway's HTTP IPC proxy route schema.
+ */
+
+import { describe, expect, mock, test } from "bun:test";
+
+mock.module("../../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../../../security/secure-keys.js", () => ({
+  getSecureKeyAsync: async () => undefined,
+  setSecureKeyAsync: async () => {},
+  deleteSecureKeyAsync: async () => {},
+}));
+
+import { ROUTES as contactRoutes } from "../../../runtime/routes/contact-routes.js";
+import { INVITE_IPC_METHODS } from "../invite-ipc-routes.js";
+import { routeDefinitionsToIpcMethods } from "../route-adapter.js";
+
+const INVITE_IPC_OPERATION_IDS = [
+  "invites_mint",
+  "invites_redeem_voice",
+  "invites_redeem_token",
+] as const;
+
+describe("invite IPC-only methods", () => {
+  test("are reachable on the IPC surface by operationId", () => {
+    for (const operationId of INVITE_IPC_OPERATION_IDS) {
+      expect(typeof INVITE_IPC_METHODS[operationId]).toBe("function");
+    }
+  });
+
+  test("are NOT in the shared contact ROUTES array", () => {
+    const sharedIds = new Set(contactRoutes.map((r) => r.operationId));
+    for (const operationId of INVITE_IPC_OPERATION_IDS) {
+      expect(sharedIds.has(operationId)).toBe(false);
+    }
+  });
+
+  test("are NOT in the gateway-facing get_route_schema", async () => {
+    const ipcMethods = routeDefinitionsToIpcMethods(contactRoutes);
+    const meta = ipcMethods.find((r) => r.operationId === "get_route_schema");
+    expect(meta).toBeDefined();
+    const schema = (await meta!.handler({})) as { operationId: string }[];
+    const schemaIds = new Set(schema.map((e) => e.operationId));
+    for (const operationId of INVITE_IPC_OPERATION_IDS) {
+      expect(schemaIds.has(operationId)).toBe(false);
+    }
+  });
+});

package/src/ipc/routes/invite-ipc-routes.ts

@@ -0,0 +1,66 @@
+/**
+ * IPC-only invite methods called by the gateway's native invite HTTP
+ * handlers over the assistant IPC socket (`ipcCallAssistant`).
+ *
+ * Token secrecy + voice fields are assistant-owned, so the gateway mints
+ * tokens / redeems codes here and mirrors the canonical lifecycle into its
+ * own DB. These have no HTTP surface: they are registered directly on the
+ * IPC server and never enter the shared `ROUTES` array, so they can never
+ * reach the gateway's HTTP IPC proxy route schema (`get_route_schema`).
+ *
+ * Per `assistant/AGENTS.md`, IPC-only methods are registered here rather
+ * than flagged inside `ROUTES`.
+ */
+
+import { mintIngressInvite } from "../../runtime/invite-service.js";
+import {
+  handleRedeemTokenInvite,
+  handleRedeemVoiceInvite,
+} from "../../runtime/routes/contact-routes.js";
+import { BadRequestError } from "../../runtime/routes/errors.js";
+import type { RouteHandlerArgs } from "../../runtime/routes/types.js";
+
+/**
+ * Mint an invite for the gateway (`invites_mint`).
+ *
+ * Returns the raw token plus the minimal projection the gateway mirrors into
+ * its own store. Token generation/hashing and voice fields stay
+ * assistant-owned.
+ */
+export async function handleMintInvite({ body = {} }: RouteHandlerArgs) {
+  const result = await mintIngressInvite({
+    sourceChannel: body.sourceChannel as string | undefined,
+    note: body.note as string | undefined,
+    maxUses: body.maxUses as number | undefined,
+    expiresInMs: body.expiresInMs as number | undefined,
+    expectedExternalUserId: body.expectedExternalUserId as string | undefined,
+    contactId: body.contactId as string,
+  });
+
+  if (!result.ok) {
+    throw new BadRequestError(result.error);
+  }
+  return {
+    ok: true,
+    invite: result.data.invite,
+    rawToken: result.data.rawToken,
+    gateway: result.data.gateway,
+  };
+}
+
+/**
+ * IPC-only invite methods, keyed by IPC operationId. Registered directly on
+ * the assistant IPC server (see `assistant-server.ts`).
+ *
+ * `invites_redeem_voice` / `invites_redeem_token` reuse the same split
+ * handlers that back the shared HTTP `invites_redeem` route, so token/voice
+ * redemption behaves identically across both transports.
+ */
+export const INVITE_IPC_METHODS: Record<
+  string,
+  (args: RouteHandlerArgs) => unknown
+> = {
+  invites_mint: handleMintInvite,
+  invites_redeem_voice: handleRedeemVoiceInvite,
+  invites_redeem_token: handleRedeemTokenInvite,
+};

package/src/live-voice/__tests__/live-voice-archive.test.ts

@@ -31,7 +31,7 @@ import {
   linkLiveVoiceUserUtteranceAudioToMessage,
 } from "../live-voice-archive.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTables() {
   const db = getDb();

package/src/memory/__tests__/activation-session-store.test.ts

@@ -15,7 +15,7 @@ import { getDb } from "../db-connection.js";
 import { initializeDb } from "../db-init.js";
 import { activationSessions } from "../schema.js";
 
-initializeDb();
+await initializeDb();
 
 describe("activation-session-store", () => {
   beforeEach(() => {

package/src/memory/__tests__/auto-analysis-guard.test.ts

@@ -15,7 +15,7 @@ import {
 import { createConversation } from "../conversation-crud.js";
 import { getDb } from "../db-connection.js";
 import { initializeDb } from "../db-init.js";
-initializeDb();
+await initializeDb();
 
 function resetTables(): void {
   const db = getDb();

package/src/memory/__tests__/conversation-group-migration.test.ts

@@ -10,7 +10,7 @@ mock.module("../../util/logger.js", () => ({
 import { ensureGroupMigration } from "../conversation-group-migration.js";
 import { initializeDb } from "../db-init.js";
 import { rawAll, rawExec, rawGet, rawRun } from "../raw-query.js";
-initializeDb();
+await initializeDb();
 
 // Simulate a legacy install that has the `system:reflections` system group
 // plus a conversation pointing at it. The migration must:

package/src/memory/__tests__/conversation-queries.test.ts

@@ -25,7 +25,7 @@ import { initializeDb } from "../db-init.js";
 import { rawRun } from "../raw-query.js";
 import { conversations } from "../schema.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTables(): void {
   const db = getDb();

package/src/memory/__tests__/db-async-query.test.ts

@@ -24,7 +24,7 @@ const { runAsyncSqlite, _resetFallbackWarning } =
   await import("../db-async-query.js");
 const { findSqlite3 } = await import("../../util/sqlite3-runtime.js");
 
-initializeDb();
+await initializeDb();
 
 const sqlite3Available = findSqlite3() !== undefined;
 

package/src/memory/__tests__/db-logs-attach.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Tests for the dedicated logs database connection.
+ *
+ * What this locks in:
+ *   1. Opening the logs connection creates `assistant-logs.db` on disk and
+ *      runs it in WAL mode (its own `-wal`, independent of the main DB) — the
+ *      regression that lets a heavy append-only table bloat the *main* WAL is
+ *      exactly what this split exists to prevent.
+ *   2. The main connection no longer ATTACHes the logs file: there is no
+ *      `logs` schema on its `database_list`.
+ *   3. `llm_request_logs` lives in the dedicated logs connection, not in the
+ *      main connection — proving the physical split.
+ *   4. `runAsyncSqlite({ dbPath })` targets the given file via the sqlite3
+ *      CLI backend, leaving the main DB untouched.
+ */
+import { existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import { removeTestDbFiles } from "../../__tests__/assert-not-live-db.js";
+
+const { getSqlite, getLogsSqlite } = await import("../db-connection.js");
+const { initializeDb } = await import("../db-init.js");
+const { runAsyncSqlite } = await import("../db-async-query.js");
+const { getLogsDbPath } = await import("../../util/logs-db-path.js");
+const { findSqlite3 } = await import("../../util/sqlite3-runtime.js");
+
+await initializeDb();
+
+const sqlite3Available = findSqlite3() !== undefined;
+
+describe("logs database connection", () => {
+  test("opens the logs file and creates it on disk in WAL mode", () => {
+    const logs = getLogsSqlite();
+    expect(logs).not.toBeNull();
+    expect(existsSync(getLogsDbPath())).toBe(true);
+
+    const mode = logs!
+      .query<{ journal_mode: string }, []>("PRAGMA journal_mode")
+      .get();
+    expect(mode?.journal_mode).toBe("wal");
+  });
+
+  test("the main connection does not attach the logs file", () => {
+    const attached = getSqlite()
+      .query<{ name: string }, []>("PRAGMA database_list")
+      .all();
+    expect(attached.some((e) => e.name === "logs")).toBe(false);
+  });
+
+  test("llm_request_logs lives in the logs connection, not main", () => {
+    const inLogs = getLogsSqlite()!
+      .query<
+        { name: string },
+        []
+      >(`SELECT name FROM sqlite_master WHERE type='table' AND name='llm_request_logs'`)
+      .get();
+    expect(inLogs?.name).toBe("llm_request_logs");
+
+    const inMain = getSqlite()
+      .query<
+        { name: string },
+        []
+      >(`SELECT name FROM main.sqlite_master WHERE name='llm_request_logs'`)
+      .get();
+    expect(inMain).toBeNull();
+  });
+
+  test.if(sqlite3Available)(
+    "runAsyncSqlite({ dbPath }) targets the given file, not the main DB",
+    async () => {
+      const targetPath = join(tmpdir(), `vellum-async-dbpath-${Date.now()}.db`);
+      try {
+        const result = await runAsyncSqlite(
+          "CREATE TABLE dbpath_probe (x INTEGER); INSERT INTO dbpath_probe VALUES (42); SELECT changes();",
+          { dbPath: targetPath, forceBackend: "sqlite3-cli" },
+        );
+        expect(result.ok).toBe(true);
+        expect(result.backend).toBe("sqlite3-cli");
+
+        // The target file got the table…
+        const { Database } = await import("bun:sqlite");
+        const probe = new Database(targetPath, { readonly: true });
+        try {
+          const row = probe
+            .query<
+              { name: string },
+              []
+            >("SELECT name FROM sqlite_master WHERE name = 'dbpath_probe'")
+            .get();
+          expect(row?.name).toBe("dbpath_probe");
+        } finally {
+          probe.close();
+        }
+
+        // …and the main DB did not.
+        const inMain = getSqlite()
+          .query<
+            { name: string },
+            []
+          >("SELECT name FROM main.sqlite_master WHERE name = 'dbpath_probe'")
+          .get();
+        expect(inMain).toBeNull();
+      } finally {
+        removeTestDbFiles(targetPath);
+      }
+    },
+  );
+});

package/src/memory/__tests__/db-maintenance.test.ts

@@ -2,14 +2,12 @@
  * Tests for `db-maintenance.ts` (orchestration) and the underlying
  * `db-async-query.ts` abstraction.
  *
- * The contract this PR locks in:
- *   1. `runDbMaintenance` runs `VACUUM` through the async abstraction
- *      — when the `sqlite3` CLI is available, that means a subprocess
- *      and the daemon's main event loop keeps ticking. (The structural
- *      anti-block assertion lives in
- *      `db-async-query.test.ts`; here we focus on orchestration.)
- *   2. The subprocess actually shrinks the on-disk page count when
- *      there's reclaimable space.
+ * The contract this locks in:
+ *   1. `runDbMaintenance` runs `PRAGMA optimize` through the async
+ *      abstraction and then truncates the WAL on the daemon connection.
+ *      It intentionally does NOT run a full VACUUM (which in WAL mode
+ *      inflates the WAL to ~the DB size and needs ~2x the DB size free).
+ *   2. The truncating checkpoint shrinks the WAL file once it has grown.
  *   3. `maybeRunDbMaintenance` is genuinely async — callers can `await`
  *      it and observe completion.
  *   4. The 24 h interval guard short-circuits a recent re-run.
@@ -17,7 +15,7 @@
  * The per-file temp workspace is set up by `test-preload.ts`; tests just
  * dynamic-import the DB modules so they resolve paths under that temp dir.
  */
-import { Database } from "bun:sqlite";
+import { existsSync, statSync } from "node:fs";
 import { beforeEach, describe, expect, test } from "bun:test";
 
 const { getSqlite } = await import("../db-connection.js");
@@ -28,7 +26,7 @@ const { maybeRunDbMaintenance } = await import("../db-maintenance.js");
 const { getLastUserMessageTimestamp } = await import("../conversation-crud.js");
 const { getDbPath } = await import("../../util/platform.js");
 
-initializeDb();
+await initializeDb();
 
 const MAINTENANCE_CHECKPOINT_KEY = "db_maintenance:last_run";
 const QUIET_PERIOD_MS = 3 * 60 * 60 * 1000;
@@ -56,8 +54,9 @@ function insertMessage(role: "user" | "assistant", createdAt: number): void {
     .run(`msg-${createdAt}-${role}`, convId, role, "[]", createdAt);
 }
 
-/** Inflate the test DB with bloat that VACUUM can reclaim. */
-function inflateAndDelete(byteTarget: number): void {
+/** Pile writes into the WAL (without checkpointing) so a truncating
+ *  checkpoint has measurable work to do. */
+function inflateWal(byteTarget: number): void {
   const sqlite = getSqlite();
   sqlite.exec(
     "CREATE TABLE IF NOT EXISTS bloat (id INTEGER PRIMARY KEY, payload BLOB)",
@@ -72,11 +71,10 @@ function inflateAndDelete(byteTarget: number): void {
   for (let i = 0; i < rowsTarget; i++) {
     insert.run(payload);
   }
+  // Commit, but do not checkpoint — the frames stay in the WAL, leaving it at
+  // its high-water mark (a PASSIVE auto-checkpoint resets the WAL for reuse but
+  // never shrinks the file). Maintenance is what should truncate it.
   sqlite.exec("COMMIT");
-  sqlite.exec("DELETE FROM bloat");
-  sqlite.exec("DROP TABLE bloat");
-  // Force the WAL onto the main DB file so the bloat is visible on disk.
-  sqlite.exec("PRAGMA wal_checkpoint(TRUNCATE)");
 }
 
 describe("maybeRunDbMaintenance", () => {
@@ -106,36 +104,30 @@ describe("maybeRunDbMaintenance", () => {
     expect(getMemoryCheckpoint(MAINTENANCE_CHECKPOINT_KEY)).toBe(String(now));
   });
 
-  test("VACUUM reclaims pages on a bloated DB", async () => {
+  test("truncates a bloated WAL", async () => {
     const sqlite = getSqlite();
     sqlite.exec("DROP TABLE IF EXISTS bloat");
     sqlite.exec("PRAGMA wal_checkpoint(TRUNCATE)");
 
-    inflateAndDelete(8 * 1024 * 1024);
-
-    const dbPath = getDbPath();
-    // Read page_count from a fresh connection so we observe post-write
-    // ground truth without snapshot caching on the main test connection.
-    const readPageCount = (): number => {
-      const probe = new Database(dbPath, { readonly: true });
-      try {
-        return (
-          probe.query("PRAGMA page_count").get() as { page_count: number }
-        ).page_count;
-      } finally {
-        probe.close();
-      }
-    };
-    const pagesBefore = readPageCount();
+    const walPath = `${getDbPath()}-wal`;
+    const walSize = (): number =>
+      existsSync(walPath) ? statSync(walPath).size : 0;
+
+    inflateWal(4 * 1024 * 1024);
+    // Sanity: the writes really did grow the WAL on disk.
+    expect(walSize()).toBeGreaterThan(1024 * 1024);
 
     await maybeRunDbMaintenance();
 
-    const pagesAfter = readPageCount();
-    expect(pagesAfter).toBeLessThan(pagesBefore);
+    // Maintenance truncates the WAL back down (no VACUUM, so the data is folded
+    // into the main file rather than rebuilt).
+    expect(walSize()).toBeLessThan(64 * 1024);
+
+    sqlite.exec("DROP TABLE IF EXISTS bloat");
   }, 60_000);
 
   test("defers maintenance while the last user message is within the quiet period", async () => {
-    /** VACUUM must not fire while the user is active, so a recent user
+    /** Maintenance must not fire while the user is active, so a recent user
      *  message keeps maintenance deferred. */
     // GIVEN the user sent a message one minute ago (well within the quiet period)
     const now = Date.now();