@vellumai/assistant 0.11.2-dev.202608070306.b97cdd6 → 0.11.2-dev.202608070534.d55eaf1

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -157,6 +157,8 @@ export {
   hashVerificationSecret,
   IdentityBindingStatusSchema,
   ResolveBootstrapSessionIpcParamsSchema,
+  bindsSameIdentity,
+  boundIdentity,
   RevokePendingSessionsIpcParamsSchema,
   SessionLookupIpcResponseSchema,
   SessionMutationIpcResponseSchema,
@@ -172,6 +174,7 @@ export {
 
 export type {
   BindSessionIdentityIpcParams,
+  BoundIdentity,
   CountRecentSendsIpcParams,
   CountRecentSendsIpcResponse,
   CreateInboundSessionIpcParams,
@@ -183,6 +186,7 @@ export type {
   FindActiveSessionIpcParams,
   GetPendingSessionIpcParams,
   IdentityBindingStatus,
+  IdentityBoundSession,
   ResolveBootstrapSessionIpcParams,
   RevokePendingSessionsIpcParams,
   SessionLookupIpcResponse,

package/node_modules/@vellumai/gateway-client/src/verification-session-contract.ts

@@ -113,6 +113,78 @@ export const VerificationSessionSchema = z.object({
 
 export type VerificationSessionWire = z.infer<typeof VerificationSessionSchema>;
 
+// ---------------------------------------------------------------------------
+// Bound identity (which of the three identity columns decides who may redeem)
+// ---------------------------------------------------------------------------
+
+/** The identity fields the rules read. Callers may pass a full session row. */
+export interface IdentityBoundSession {
+  expectedExternalUserId?: string | null;
+  expectedChatId?: string | null;
+  expectedPhoneE164?: string | null;
+}
+
+/**
+ * The identity a session redeems on.
+ *
+ * `chatId` is compared against the actor's conversation and everything else
+ * against the actor themselves, which is why the field travels with the value.
+ */
+export interface BoundIdentity {
+  field: "phoneE164" | "externalUserId" | "chatId";
+  value: string;
+}
+
+/**
+ * The one identity a session is bound to, or null when it is bound to none
+ * (an inbound challenge, or a bootstrap session before its deep link is
+ * redeemed).
+ *
+ * This lives in the contract because more than one side has to agree on it:
+ * the gateway consume path decides who may redeem a code, and the supersede
+ * scope decides whose earlier codes a fresh mint kills. Those two disagreeing
+ * is a silent one-time-code bug, so the rule is stated once.
+ *
+ * Precedence, most to least specific:
+ *
+ * 1. `expectedPhoneE164` (a voice session's subject is the number itself).
+ * 2. `expectedExternalUserId` (the person).
+ * 3. `expectedChatId` (the conversation), and only when nothing identifies a
+ *    person. A chat id can be shared (a Slack channel, a Telegram group), so
+ *    on its own it would let any participant satisfy the binding. It counts
+ *    only where there is no better answer.
+ */
+export function boundIdentity(
+  session: IdentityBoundSession,
+): BoundIdentity | null {
+  // Presence, not truthiness. An empty string is a set-but-useless identity,
+  // and treating it as absent would report the session unbound, which the
+  // consume path reads as "no identity to check" and admits anyone holding
+  // the code. Kept as a value it can compare against and fail instead.
+  if (session.expectedPhoneE164 != null) {
+    return { field: "phoneE164", value: session.expectedPhoneE164 };
+  }
+  if (session.expectedExternalUserId != null) {
+    return { field: "externalUserId", value: session.expectedExternalUserId };
+  }
+  if (session.expectedChatId != null) {
+    return { field: "chatId", value: session.expectedChatId };
+  }
+  return null;
+}
+
+/**
+ * Whether two sessions are bound to the same identity. Two sessions bound to
+ * no identity are not the same: bootstrap sessions are claimed by id, so an
+ * unbound mint must not sweep up every other unbound row.
+ */
+export function bindsSameIdentity(
+  a: BoundIdentity | null,
+  b: BoundIdentity | null,
+): boolean {
+  return a !== null && b !== null && a.field === b.field && a.value === b.value;
+}
+
 // ---------------------------------------------------------------------------
 // IPC methods
 // ---------------------------------------------------------------------------
@@ -193,9 +265,12 @@ export type CreateInboundSessionIpcResponse = z.infer<
 /** Request for `verification_sessions_create_outbound`. */
 export const CreateOutboundSessionIpcParamsSchema = z.object({
   channel: z.string().min(1),
-  expectedExternalUserId: z.string().optional(),
-  expectedChatId: z.string().optional(),
-  expectedPhoneE164: z.string().optional(),
+  // An identity field is either absent or a real value. An empty string is
+  // neither, and a session bound to one can never be redeemed by anybody,
+  // so reject it at the boundary rather than mint a dead code.
+  expectedExternalUserId: z.string().min(1).optional(),
+  expectedChatId: z.string().min(1).optional(),
+  expectedPhoneE164: z.string().min(1).optional(),
   identityBindingStatus: IdentityBindingStatusSchema.optional(),
   destinationAddress: z.string().optional(),
   codeDigits: z.number().int().positive().optional(),
@@ -211,7 +286,6 @@ export const CreateOutboundSessionIpcParamsSchema = z.object({
   requireSourceSessionPending: z.string().min(1).optional(),
   // Mint only if the channel has no active (pending_bootstrap /
   // awaiting_response, non-expired) session.
-  ifNoneActive: z.boolean().optional(),
   // Sender-scoped variant: mint unless the channel's active session is bound
   // to this expectedExternalUserId (a different sender may supersede).
   ifNoneActiveForExternalUserId: z.string().min(1).optional(),
@@ -240,7 +314,8 @@ export type CreateOutboundSessionIpcResponse = z.infer<
 
 /**
  * Conflict marker returned by `verification_sessions_create_outbound` when a
- * claim guard (`requireSourceSessionPending` / `ifNoneActive`) fails. Only
+ * claim guard (`requireSourceSessionPending` /
+ * `ifNoneActiveForExternalUserId`) fails. Only
  * reachable when a guard was passed — legacy callers never see this shape.
  */
 export const CreateOutboundSessionConflictSchema = z.object({
@@ -277,7 +352,17 @@ export type GetPendingSessionIpcParams = z.infer<
  * Request for `verification_sessions_find_active` (statuses
  * `pending_bootstrap`/`awaiting_response`, newest first).
  */
-export const FindActiveSessionIpcParamsSchema = ChannelOnlyIpcParamsSchema;
+export const FindActiveSessionIpcParamsSchema =
+  ChannelOnlyIpcParamsSchema.extend({
+    /**
+     * Narrows the lookup to one session. A channel can carry several live
+     * sessions at once, one per person verifying plus the guardian's own flow,
+     * so a caller that means a particular one has to say which. Omitted, the
+     * lookup returns whoever started most recently.
+     */
+    expectedExternalUserId: z.string().min(1).optional(),
+    verificationPurpose: VerificationPurposeSchema.optional(),
+  });
 
 export type FindActiveSessionIpcParams = z.infer<
   typeof FindActiveSessionIpcParamsSchema

package/openapi.yaml

@@ -9293,8 +9293,10 @@ paths:
   /v1/conversations/reorder:
     post:
       operationId: conversations_reorder_post
-      summary: Reorder conversations
-      description: Batch-update display order and pin state for conversations.
+      summary: Move conversations between sections
+      description:
+        Batch-update which group holds each conversation, and its pin state. Lists are ordered by recency, so this
+        sets placement, not order.
       tags:
         - conversations
       requestBody:
@@ -9311,8 +9313,6 @@ paths:
                     properties:
                       conversationId:
                         type: string
-                      displayOrder:
-                        type: number
                       isPinned:
                         type: boolean
                       groupId:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.2-dev.202608070306.b97cdd6",
+  "version": "0.11.2-dev.202608070534.d55eaf1",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/background-workers-disk-pressure.test.ts

@@ -61,7 +61,7 @@ mock.module("../persistence/conversation-crud.js", () => ({
   getConversationPersistedSeq: () => null,
   addMessage: mock(() => ({ id: "msg-1" })),
   archiveConversation: mock(() => true),
-  batchSetDisplayOrders: mock(() => {}),
+  batchSetConversationPlacement: mock(() => {}),
   createConversation: (opts: { conversationType: string }) => {
     createdConversations.push(opts);
     return { id: "conv-1", ...opts };

package/src/__tests__/call-start-guardian-guard.test.ts

@@ -40,10 +40,24 @@ const realGatewaySessionsModule = {
 };
 mock.module("../channels/gateway-verification-sessions.js", () => ({
   ...realGatewaySessionsModule,
-  findActiveSession: async (channel: string) =>
-    findActiveSessionMockActive
-      ? activeVoiceSession
-      : realGatewaySessionsModule.findActiveSession(channel),
+  // Honours the caller's filter: the guard asks for the number it is about
+  // to dial, so a session for a different number must read as absent.
+  findActiveSession: async (
+    channel: string,
+    filter?: { expectedExternalUserId?: string },
+  ) => {
+    if (!findActiveSessionMockActive) {
+      return realGatewaySessionsModule.findActiveSession(channel, filter);
+    }
+    const wanted = filter?.expectedExternalUserId;
+    if (
+      wanted !== undefined &&
+      activeVoiceSession?.expectedPhoneE164 !== wanted
+    ) {
+      return null;
+    }
+    return activeVoiceSession;
+  },
 }));
 
 const { executeCallStart } = await import("../tools/calls/call-start.js");

package/src/__tests__/channel-guardian.test.ts

@@ -1640,32 +1640,42 @@ describe("outbound verification sessions", () => {
 
   // ── Auto-revoke of prior sessions ──
 
-  test("creating a new outbound session auto-revokes prior pending/awaiting sessions", async () => {
+  test("a second code for the same number revokes the first", async () => {
     const { sessionId: firstId } = await createOutboundSession({
       channel: "phone",
-      expectedPhoneE164: "+15551234567",
-      destinationAddress: "+15551234567",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
+    const { sessionId: secondId } = await createOutboundSession({
+      channel: "phone",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
     });
 
-    const first = await serviceFindActiveSession("phone");
-    expect(first).not.toBeNull();
-    expect(first!.id).toBe(firstId);
+    // Read by id rather than through the unfiltered lookup: two live
+    // sessions minted in the same millisecond have no defined order, and
+    // what matters here is each row's status, not which one is "latest".
+    expect(getSessionById(firstId)!.status).toBe("revoked");
+    expect(getSessionById(secondId)!.status).toBe("awaiting_response");
+  });
 
-    // Create a second session — first should be revoked
+  test("a code for a different number leaves the first alone", async () => {
+    // Two numbers are two people. Verifying one must not silently kill the
+    // other's code, which they would learn about only by trying to use it
+    // and being told it is "invalid or has expired".
+    const { sessionId: firstId } = await createOutboundSession({
+      channel: "phone",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
     const { sessionId: secondId } = await createOutboundSession({
       channel: "phone",
-      expectedPhoneE164: "+15559876543",
-      destinationAddress: "+15559876543",
+      expectedPhoneE164: "+15555550102",
+      destinationAddress: "+15555550102",
     });
 
-    const second = await serviceFindActiveSession("phone");
-    expect(second).not.toBeNull();
-    expect(second!.id).toBe(secondId);
-
-    // First session should no longer be findable as active
-    const firstRow = getSessionById(firstId);
-    expect(firstRow).not.toBeNull();
-    expect(firstRow!.status).toBe("revoked");
+    expect(getSessionById(firstId)!.status).toBe("awaiting_response");
+    expect(getSessionById(secondId)!.status).toBe("awaiting_response");
   });
 
   // ── findActiveSession returns correct session ──
@@ -1772,26 +1782,46 @@ describe("outbound verification sessions", () => {
     expect(result.success).toBe(true);
   });
 
-  // ── Voice identity match via expectedExternalUserId ──
+  // ── Voice identity is the number ──
 
-  test("Voice identity match succeeds via expectedExternalUserId", async () => {
+  test("a voice session is redeemed by the number it was sent to", async () => {
+    // Voice knows the caller by one thing, so the consume path receives that
+    // number as both actor axes. Every voice mint records it in both
+    // identity columns, and either way the session is bound to the number.
     const { secret } = await createOutboundSession({
       channel: "phone",
-      expectedExternalUserId: "voice-user-42",
-      expectedPhoneE164: "+15551234567",
-      destinationAddress: "+15551234567",
+      expectedExternalUserId: "+15555550101",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
     });
 
-    // Actor matches expectedExternalUserId
     const result = await validateAndConsumeVerification(
       "phone",
       secret,
-      "voice-user-42",
-      "voice-chat-1",
+      "+15555550101",
+      "+15555550101",
     );
 
     expect(result.success).toBe(true);
   });
+
+  test("a voice session refuses a caller on a different number", async () => {
+    const { secret } = await createOutboundSession({
+      channel: "phone",
+      expectedExternalUserId: "+15555550101",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
+
+    const result = await validateAndConsumeVerification(
+      "phone",
+      secret,
+      "+15555550102",
+      "+15555550102",
+    );
+
+    expect(result.success).toBe(false);
+  });
 });
 
 // ═══════════════════════════════════════════════════════════════════════════

package/src/__tests__/conversation-list-recency-ordering.test.ts

@@ -0,0 +1,104 @@
+import type { Database } from "bun:sqlite";
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import { createConversation } from "../persistence/conversation-crud.js";
+import { ensureGroupMigration } from "../persistence/conversation-group-migration.js";
+import {
+  listConversations,
+  listPinnedConversations,
+} from "../persistence/conversation-queries.js";
+import { getDb } from "../persistence/db-connection.js";
+import { initializeDb } from "../persistence/db-init.js";
+import { createGroup } from "../persistence/group-crud.js";
+
+await initializeDb();
+ensureGroupMigration();
+
+function getRawDb(): Database {
+  return (getDb() as unknown as { $client: Database }).$client;
+}
+
+/**
+ * Every conversation list orders by recency, pinned and custom groups
+ * included.
+ *
+ * `display_order` is a live column and some rows carry a value in it, so
+ * "nothing writes it" is not enough to make the order consistent: a read that
+ * consulted it would serve those rows in an arrangement no user can change,
+ * while every other surface shows recency.
+ *
+ * Each test sets `display_order` to contradict recency, so a read that
+ * consults it fails here rather than passing by coincidence.
+ */
+describe("conversation list ordering ignores display_order", () => {
+  beforeEach(() => {
+    const raw = getRawDb();
+    raw.run("DELETE FROM conversations");
+    raw.run("DELETE FROM conversation_groups WHERE is_system_group = 0");
+  });
+
+  /** Give a row a `display_order` and a recency stamp that disagree. */
+  function arrange(id: string, displayOrder: number, lastMessageAt: number) {
+    getRawDb().run(
+      "UPDATE conversations SET display_order = ?, last_message_at = ? WHERE id = ?",
+      [displayOrder, lastMessageAt, id],
+    );
+  }
+
+  test("a custom group orders by recency, ignoring display_order", () => {
+    const groupId = createGroup("Briefs").id;
+    createConversation({ id: "conv-old", source: "user", groupId });
+    createConversation({ id: "conv-new", source: "user", groupId });
+    // `display_order` says old-then-new; recency says the opposite.
+    arrange("conv-old", 0, 1_000);
+    arrange("conv-new", 1, 9_000);
+
+    expect(listConversations({ groupId }).map((c) => c.id)).toEqual([
+      "conv-new",
+      "conv-old",
+    ]);
+  });
+
+  test("the pinned group orders by recency, ignoring display_order", () => {
+    createConversation({
+      id: "pin-old",
+      source: "user",
+      groupId: "system:pinned",
+    });
+    createConversation({
+      id: "pin-new",
+      source: "user",
+      groupId: "system:pinned",
+    });
+    arrange("pin-old", 0, 1_000);
+    arrange("pin-new", 1, 9_000);
+
+    expect(
+      listConversations({ groupId: "system:pinned" }).map((c) => c.id),
+    ).toEqual(["pin-new", "pin-old"]);
+  });
+
+  /* The page-one pinned injection reads through its own query, so it needs
+     the same guarantee: one section must not have two orderings depending on
+     which read served it. */
+  test("listPinnedConversations orders by recency too", () => {
+    createConversation({
+      id: "pin-old",
+      source: "user",
+      groupId: "system:pinned",
+    });
+    createConversation({
+      id: "pin-new",
+      source: "user",
+      groupId: "system:pinned",
+    });
+    getRawDb().run("UPDATE conversations SET is_pinned = 1");
+    arrange("pin-old", 0, 1_000);
+    arrange("pin-new", 1, 9_000);
+
+    expect(listPinnedConversations().map((c) => c.id)).toEqual([
+      "pin-new",
+      "pin-old",
+    ]);
+  });
+});

package/src/__tests__/conversation-placement-promotion.test.ts

@@ -17,7 +17,7 @@
 import { beforeEach, describe, expect, test } from "bun:test";
 
 import {
-  batchSetDisplayOrders,
+  batchSetConversationPlacement,
   createConversation,
 } from "../persistence/conversation-crud.js";
 import { listConversations } from "../persistence/conversation-queries.js";
@@ -58,22 +58,16 @@ describe("pinning a background conversation", () => {
     const conv = seedRoutedBackground("bg-job", "background");
     expect(visibleTitles()).toEqual([]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: "system:pinned" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:pinned" }]);
 
     expect(titlesInGroup("system:pinned")).toEqual(["bg-job"]);
   });
 
   test("unpinning lands it in Recents rather than hiding it again", () => {
     const conv = seedRoutedBackground("bg-job", "background");
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: "system:pinned" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:pinned" }]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:all" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:all" }]);
 
     expect(titlesInGroup("system:all")).toEqual(["bg-job"]);
   });
@@ -84,9 +78,7 @@ describe("filing a background conversation into a custom group", () => {
     const group = createGroup("Car Chat");
     const conv = seedRoutedBackground("bg-job", "background");
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: group.id },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: group.id }]);
 
     expect(titlesInGroup(group.id)).toEqual(["bg-job"]);
   });
@@ -94,13 +86,9 @@ describe("filing a background conversation into a custom group", () => {
   test("removing it from the group lands it in Recents rather than losing it", () => {
     const group = createGroup("Car Chat");
     const conv = seedRoutedBackground("bg-job", "background");
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: group.id },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: group.id }]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:all" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:all" }]);
 
     expect(titlesInGroup("system:all")).toEqual(["bg-job"]);
     expect(visibleTitles()).toEqual(["bg-job"]);
@@ -110,12 +98,8 @@ describe("filing a background conversation into a custom group", () => {
     const group = createGroup("Morning Briefs");
     const conv = seedRoutedBackground("sched-job", "scheduled");
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: group.id },
-    ]);
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:all" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: group.id }]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:all" }]);
 
     expect(titlesInGroup("system:all")).toEqual(["sched-job"]);
   });
@@ -125,13 +109,11 @@ describe("what promotion must not do", () => {
   test("filing into system:background still demotes", () => {
     const conv = seedRoutedBackground("bg-job", "background");
     // Promote first, so the demotion has something to undo.
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: "system:pinned" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:pinned" }]);
     expect(titlesInGroup("system:pinned")).toEqual(["bg-job"]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:background" },
+    batchSetConversationPlacement([
+      { id: conv.id, groupId: "system:background" },
     ]);
 
     expect(visibleTitles()).toEqual([]);
@@ -149,9 +131,7 @@ describe("what promotion must not do", () => {
     // system bucket.
     const conv = seedRoutedBackground("bg-job", "background");
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, groupId: "system:all" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:all" }]);
 
     expect(visibleTitles()).toEqual([]);
   });
@@ -168,13 +148,9 @@ describe("what promotion must not do", () => {
     // came from, `surfaced_at` records that the user promoted it, and only
     // an explicit demotion clears the latter.
     const conv = seedRoutedBackground("bg-job", "background");
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: "system:pinned" },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: "system:pinned" }]);
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: null, isPinned: false },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, isPinned: false }]);
 
     expect(visibleTitles()).toEqual(["bg-job"]);
     expect(titlesInGroup("system:all")).toEqual(["bg-job"]);
@@ -186,9 +162,7 @@ describe("what promotion must not do", () => {
     const group = createGroup("Car Chat");
     const conv = createConversation("plain-chat");
 
-    batchSetDisplayOrders([
-      { id: conv.id, displayOrder: 0, groupId: group.id },
-    ]);
+    batchSetConversationPlacement([{ id: conv.id, groupId: group.id }]);
 
     const row = getDb()
       .all(`SELECT surfaced_at FROM conversations WHERE id = '${conv.id}'`)

package/src/__tests__/conversation-retry-route.test.ts

@@ -74,7 +74,7 @@ const getConversationMock = mock((id: string) =>
 mock.module("../persistence/conversation-crud.js", () => ({
   addMessage: async () => ({ id: "unused", deduplicated: false }),
   archiveConversation: () => true,
-  batchSetDisplayOrders: () => {},
+  batchSetConversationPlacement: () => {},
   countConversationsByScheduleJobId: () => 0,
   deleteConversation: () => ({ segmentIds: [], deletedSummaryIds: [] }),
   extractImageSourcePaths: () => undefined,

package/src/__tests__/conversation-summarize-route.test.ts

@@ -53,7 +53,7 @@ const getConversationMock = mock((id: string) =>
 mock.module("../persistence/conversation-crud.js", () => ({
   addMessage: addMessageMock,
   archiveConversation: () => true,
-  batchSetDisplayOrders: () => {},
+  batchSetConversationPlacement: () => {},
   countConversationsByScheduleJobId: () => 0,
   deleteConversation: () => ({ segmentIds: [], deletedSummaryIds: [] }),
   extractImageSourcePaths: () => undefined,

package/src/__tests__/helpers/gateway-verification-sessions-stub.ts

@@ -139,9 +139,22 @@ export function createGatewayVerificationSessionsStub(options: {
       throwIfUnreachable("updateSessionDelivery");
       calls.updateSessionDelivery.push(args);
     },
-    findActiveSession: async () => {
+    // Honours the caller's `expectedExternalUserId` filter the way the
+    // gateway does. Returning the session for every filter would make a
+    // "someone else is verifying" test pass against a lookup that, against
+    // the real gateway, would have found nothing.
+    findActiveSession: async (...args: unknown[]) => {
       calls.sessionReads.push("findActiveSession");
       throwIfUnreachable("findActiveSession");
+      const wantedActor = (
+        args[1] as { expectedExternalUserId?: string } | undefined
+      )?.expectedExternalUserId;
+      if (
+        wantedActor !== undefined &&
+        state.activeSession?.expectedExternalUserId !== wantedActor
+      ) {
+        return null;
+      }
       return state.activeSession;
     },
     getPendingSession: async () => {