@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/__tests__/attachments.test.ts

@@ -88,8 +88,8 @@ describe("attachmentsToReferenceBlocks", () => {
 // ---------------------------------------------------------------------------
 
 describe("attachmentsToContentBlocks", () => {
-  test("creates image content block for image/jpeg", () => {
-    const blocks = attachmentsToContentBlocks([
+  test("creates image content block for image/jpeg", async () => {
+    const blocks = await attachmentsToContentBlocks([
       { filename: "photo.jpg", mimeType: "image/jpeg", data: "base64data" },
     ]);
 
@@ -104,8 +104,8 @@ describe("attachmentsToContentBlocks", () => {
     expect(block.source.data).toBe("base64data");
   });
 
-  test("creates image content block for image/png", () => {
-    const blocks = attachmentsToContentBlocks([
+  test("creates image content block for image/png", async () => {
+    const blocks = await attachmentsToContentBlocks([
       { filename: "screenshot.png", mimeType: "image/png", data: "pngdata" },
     ]);
 
@@ -113,8 +113,8 @@ describe("attachmentsToContentBlocks", () => {
     expect(blocks[0].type).toBe("image");
   });
 
-  test("creates image content block for image/webp", () => {
-    const blocks = attachmentsToContentBlocks([
+  test("creates image content block for image/webp", async () => {
+    const blocks = await attachmentsToContentBlocks([
       { filename: "sticker.webp", mimeType: "image/webp", data: "webpdata" },
     ]);
 
@@ -122,8 +122,8 @@ describe("attachmentsToContentBlocks", () => {
     expect(blocks[0].type).toBe("image");
   });
 
-  test("creates file content block for non-image mime types", () => {
-    const blocks = attachmentsToContentBlocks([
+  test("creates file content block for non-image mime types", async () => {
+    const blocks = await attachmentsToContentBlocks([
       { filename: "doc.pdf", mimeType: "application/pdf", data: "pdfdata" },
     ]);
 
@@ -137,8 +137,8 @@ describe("attachmentsToContentBlocks", () => {
     expect(block.source.media_type).toBe("application/pdf");
   });
 
-  test("handles multiple attachments including mixed types", () => {
-    const blocks = attachmentsToContentBlocks([
+  test("handles multiple attachments including mixed types", async () => {
+    const blocks = await attachmentsToContentBlocks([
       { filename: "photo.jpg", mimeType: "image/jpeg", data: "imgdata" },
       { filename: "notes.txt", mimeType: "text/plain", data: "txtdata" },
     ]);
@@ -148,8 +148,8 @@ describe("attachmentsToContentBlocks", () => {
     expect(blocks[1].type).toBe("file");
   });
 
-  test("returns empty array for no attachments", () => {
-    const blocks = attachmentsToContentBlocks([]);
+  test("returns empty array for no attachments", async () => {
+    const blocks = await attachmentsToContentBlocks([]);
     expect(blocks).toHaveLength(0);
   });
 });
@@ -159,8 +159,8 @@ describe("attachmentsToContentBlocks", () => {
 // ---------------------------------------------------------------------------
 
 describe("createUserMessage with image attachments", () => {
-  test("includes both text and image blocks", () => {
-    const msg = createUserMessage("what is this?", [
+  test("includes both text and image blocks", async () => {
+    const msg = await createUserMessage("what is this?", [
       { filename: "photo.jpg", mimeType: "image/jpeg", data: "base64img" },
     ]);
 
@@ -173,8 +173,8 @@ describe("createUserMessage with image attachments", () => {
     expect(msg.content[1].type).toBe("image");
   });
 
-  test("includes only image block when text is empty", () => {
-    const msg = createUserMessage("", [
+  test("includes only image block when text is empty", async () => {
+    const msg = await createUserMessage("", [
       { filename: "photo.jpg", mimeType: "image/jpeg", data: "base64img" },
     ]);
 
@@ -183,8 +183,8 @@ describe("createUserMessage with image attachments", () => {
     expect(msg.content[0].type).toBe("image");
   });
 
-  test("includes only image block when text is whitespace", () => {
-    const msg = createUserMessage("   ", [
+  test("includes only image block when text is whitespace", async () => {
+    const msg = await createUserMessage("   ", [
       { filename: "photo.jpg", mimeType: "image/jpeg", data: "base64img" },
     ]);
 
@@ -193,8 +193,8 @@ describe("createUserMessage with image attachments", () => {
     expect(msg.content[0].type).toBe("image");
   });
 
-  test("includes multiple image blocks", () => {
-    const msg = createUserMessage("compare these", [
+  test("includes multiple image blocks", async () => {
+    const msg = await createUserMessage("compare these", [
       { filename: "a.jpg", mimeType: "image/jpeg", data: "img1" },
       { filename: "b.png", mimeType: "image/png", data: "img2" },
     ]);
@@ -206,9 +206,9 @@ describe("createUserMessage with image attachments", () => {
     expect(msg.content[2].type).toBe("image");
   });
 
-  test("preserves base64 data in image content block", () => {
+  test("preserves base64 data in image content block", async () => {
     const base64 = "dGVzdC1pbWFnZS1kYXRh";
-    const msg = createUserMessage("test", [
+    const msg = await createUserMessage("test", [
       { filename: "photo.jpg", mimeType: "image/jpeg", data: base64 },
     ]);
 
@@ -227,7 +227,7 @@ describe("createUserMessage with image attachments", () => {
 // ---------------------------------------------------------------------------
 
 describe("enrichMessageWithSourcePaths", () => {
-  test("appends a source path annotation for images with filePath", () => {
+  test("appends a source path annotation for images with filePath", async () => {
     const attachments = [
       {
         filename: "photo.jpg",
@@ -236,7 +236,7 @@ describe("enrichMessageWithSourcePaths", () => {
         filePath: "/Users/me/Desktop/photo.jpg",
       },
     ];
-    const original = createUserMessage("what is this?", attachments);
+    const original = await createUserMessage("what is this?", attachments);
     const enriched = enrichMessageWithSourcePaths(original, attachments);
 
     expect(enriched).not.toBe(original);
@@ -249,7 +249,7 @@ describe("enrichMessageWithSourcePaths", () => {
     );
   });
 
-  test("returns the original message (same reference) when no images have filePath", () => {
+  test("returns the original message (same reference) when no images have filePath", async () => {
     const attachments = [
       {
         filename: "photo.jpg",
@@ -257,13 +257,13 @@ describe("enrichMessageWithSourcePaths", () => {
         data: "base64img",
       },
     ];
-    const original = createUserMessage("what is this?", attachments);
+    const original = await createUserMessage("what is this?", attachments);
     const result = enrichMessageWithSourcePaths(original, attachments);
 
     expect(result).toBe(original);
   });
 
-  test("skips non-image attachments with filePath", () => {
+  test("skips non-image attachments with filePath", async () => {
     const attachments = [
       {
         filename: "doc.pdf",
@@ -272,14 +272,14 @@ describe("enrichMessageWithSourcePaths", () => {
         filePath: "/Users/me/Documents/doc.pdf",
       },
     ];
-    const original = createUserMessage("review this", attachments);
+    const original = await createUserMessage("review this", attachments);
     const result = enrichMessageWithSourcePaths(original, attachments);
 
     // Non-image attachments are not annotated, so we get back the same ref
     expect(result).toBe(original);
   });
 
-  test("handles multiple images with file paths", () => {
+  test("handles multiple images with file paths", async () => {
     const attachments = [
       {
         filename: "a.jpg",
@@ -294,7 +294,7 @@ describe("enrichMessageWithSourcePaths", () => {
         filePath: "/path/to/b.png",
       },
     ];
-    const original = createUserMessage("compare", attachments);
+    const original = await createUserMessage("compare", attachments);
     const enriched = enrichMessageWithSourcePaths(original, attachments);
 
     expect(enriched).not.toBe(original);
@@ -307,7 +307,7 @@ describe("enrichMessageWithSourcePaths", () => {
     );
   });
 
-  test("only annotates images that have filePath, skips those without", () => {
+  test("only annotates images that have filePath, skips those without", async () => {
     const attachments = [
       {
         filename: "a.jpg",
@@ -322,7 +322,7 @@ describe("enrichMessageWithSourcePaths", () => {
         // no filePath — e.g. pasted screenshot
       },
     ];
-    const original = createUserMessage("compare", attachments);
+    const original = await createUserMessage("compare", attachments);
     const enriched = enrichMessageWithSourcePaths(original, attachments);
 
     expect(enriched).not.toBe(original);
@@ -332,7 +332,7 @@ describe("enrichMessageWithSourcePaths", () => {
     expect(annotation.text).toBe("[Attached image source: /path/to/a.jpg]");
   });
 
-  test("annotates non-image attachments that have storedPath", () => {
+  test("annotates non-image attachments that have storedPath", async () => {
     const attachments = [
       {
         filename: "report.pdf",
@@ -342,7 +342,7 @@ describe("enrichMessageWithSourcePaths", () => {
         storedPath: "/conv/attachments/report-2.pdf",
       },
     ];
-    const original = createUserMessage("review my edits", attachments);
+    const original = await createUserMessage("review my edits", attachments);
     const enriched = enrichMessageWithSourcePaths(original, attachments);
 
     expect(enriched).not.toBe(original);
@@ -355,7 +355,7 @@ describe("enrichMessageWithSourcePaths", () => {
     );
   });
 
-  test("emits image source lines before stored path lines in one block", () => {
+  test("emits image source lines before stored path lines in one block", async () => {
     const attachments = [
       {
         filename: "data.csv",
@@ -371,7 +371,7 @@ describe("enrichMessageWithSourcePaths", () => {
         storedPath: "/conv/attachments/photo.jpg",
       },
     ];
-    const original = createUserMessage("compare", attachments);
+    const original = await createUserMessage("compare", attachments);
     const enriched = enrichMessageWithSourcePaths(original, attachments);
 
     const annotation = enriched.content.at(-1) as {

package/src/__tests__/background-workers-disk-pressure.test.ts

@@ -61,7 +61,7 @@ mock.module("../persistence/conversation-crud.js", () => ({
   getConversationPersistedSeq: () => null,
   addMessage: mock(() => ({ id: "msg-1" })),
   archiveConversation: mock(() => true),
-  batchSetDisplayOrders: mock(() => {}),
+  batchSetConversationPlacement: mock(() => {}),
   createConversation: (opts: { conversationType: string }) => {
     createdConversations.push(opts);
     return { id: "conv-1", ...opts };

package/src/__tests__/call-start-guardian-guard.test.ts

@@ -40,10 +40,24 @@ const realGatewaySessionsModule = {
 };
 mock.module("../channels/gateway-verification-sessions.js", () => ({
   ...realGatewaySessionsModule,
-  findActiveSession: async (channel: string) =>
-    findActiveSessionMockActive
-      ? activeVoiceSession
-      : realGatewaySessionsModule.findActiveSession(channel),
+  // Honours the caller's filter: the guard asks for the number it is about
+  // to dial, so a session for a different number must read as absent.
+  findActiveSession: async (
+    channel: string,
+    filter?: { expectedExternalUserId?: string },
+  ) => {
+    if (!findActiveSessionMockActive) {
+      return realGatewaySessionsModule.findActiveSession(channel, filter);
+    }
+    const wanted = filter?.expectedExternalUserId;
+    if (
+      wanted !== undefined &&
+      activeVoiceSession?.expectedPhoneE164 !== wanted
+    ) {
+      return null;
+    }
+    return activeVoiceSession;
+  },
 }));
 
 const { executeCallStart } = await import("../tools/calls/call-start.js");

package/src/__tests__/canned-reply-release.test.ts

@@ -0,0 +1,86 @@
+/**
+ * The canned-reply routes (canned first greeting, unknown slash command) hold
+ * the processing lock themselves and release it from a deferred callback that
+ * also publishes their client event burst. That release is the only one those
+ * turns get: no agent loop runs, so a throw escaping the burst would latch the
+ * conversation "processing" for the life of the daemon and queue every later
+ * send behind an idle conversation.
+ */
+import { describe, expect, test } from "bun:test";
+
+import type { QueueDrainReason } from "../daemon/conversation-queue-manager.js";
+import { scheduleCannedReplyRelease } from "../runtime/routes/canned-reply-release.js";
+
+function makeConversation() {
+  let processing = true;
+  const drainOrigins: string[] = [];
+  return {
+    isProcessing: () => processing,
+    drainOrigins,
+    target: {
+      setProcessing: (value: boolean) => {
+        processing = value;
+      },
+      kickDrainQueue: (_reason?: QueueDrainReason, origin?: string) => {
+        drainOrigins.push(origin ?? "");
+        return Promise.resolve();
+      },
+    },
+  };
+}
+
+/** Let the scheduled `setTimeout(..., 0)` callback run. */
+function nextTick(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, 0));
+}
+
+describe("scheduleCannedReplyRelease", () => {
+  test("releases and drains after the deferred event burst", async () => {
+    const conversation = makeConversation();
+    const order: string[] = [];
+
+    scheduleCannedReplyRelease({
+      conversation: {
+        setProcessing: (value: boolean) => {
+          order.push("release");
+          conversation.target.setProcessing(value);
+        },
+        kickDrainQueue: conversation.target.kickDrainQueue,
+      },
+      origin: "canned_greeting",
+      emit: () => {
+        order.push("emit");
+      },
+      afterRelease: () => {
+        order.push("after");
+      },
+    });
+
+    // Nothing runs synchronously: the HTTP response has to reach the client
+    // before its events do.
+    expect(order).toEqual([]);
+
+    await nextTick();
+
+    expect(order).toEqual(["emit", "release", "after"]);
+    expect(conversation.isProcessing()).toBe(false);
+    expect(conversation.drainOrigins).toEqual(["canned_greeting"]);
+  });
+
+  test("still releases and drains when a broadcast throws", async () => {
+    const conversation = makeConversation();
+
+    scheduleCannedReplyRelease({
+      conversation: conversation.target,
+      origin: "slash_command",
+      emit: () => {
+        throw new Error("broadcast exploded");
+      },
+    });
+
+    await nextTick();
+
+    expect(conversation.isProcessing()).toBe(false);
+    expect(conversation.drainOrigins).toEqual(["slash_command"]);
+  });
+});

package/src/__tests__/channel-guardian.test.ts

@@ -137,7 +137,7 @@ import {
   startOutbound,
 } from "../runtime/verification-outbound-actions.js";
 import {
-  composeVerificationTelegram,
+  composeVerificationText,
   GUARDIAN_VERIFY_TEMPLATE_KEYS,
 } from "../runtime/verification-templates.js";
 import { resetDbForTesting } from "./db-test-helpers.js";
@@ -1640,32 +1640,42 @@ describe("outbound verification sessions", () => {
 
   // ── Auto-revoke of prior sessions ──
 
-  test("creating a new outbound session auto-revokes prior pending/awaiting sessions", async () => {
+  test("a second code for the same number revokes the first", async () => {
     const { sessionId: firstId } = await createOutboundSession({
       channel: "phone",
-      expectedPhoneE164: "+15551234567",
-      destinationAddress: "+15551234567",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
+    const { sessionId: secondId } = await createOutboundSession({
+      channel: "phone",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
     });
 
-    const first = await serviceFindActiveSession("phone");
-    expect(first).not.toBeNull();
-    expect(first!.id).toBe(firstId);
+    // Read by id rather than through the unfiltered lookup: two live
+    // sessions minted in the same millisecond have no defined order, and
+    // what matters here is each row's status, not which one is "latest".
+    expect(getSessionById(firstId)!.status).toBe("revoked");
+    expect(getSessionById(secondId)!.status).toBe("awaiting_response");
+  });
 
-    // Create a second session — first should be revoked
+  test("a code for a different number leaves the first alone", async () => {
+    // Two numbers are two people. Verifying one must not silently kill the
+    // other's code, which they would learn about only by trying to use it
+    // and being told it is "invalid or has expired".
+    const { sessionId: firstId } = await createOutboundSession({
+      channel: "phone",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
     const { sessionId: secondId } = await createOutboundSession({
       channel: "phone",
-      expectedPhoneE164: "+15559876543",
-      destinationAddress: "+15559876543",
+      expectedPhoneE164: "+15555550102",
+      destinationAddress: "+15555550102",
     });
 
-    const second = await serviceFindActiveSession("phone");
-    expect(second).not.toBeNull();
-    expect(second!.id).toBe(secondId);
-
-    // First session should no longer be findable as active
-    const firstRow = getSessionById(firstId);
-    expect(firstRow).not.toBeNull();
-    expect(firstRow!.status).toBe("revoked");
+    expect(getSessionById(firstId)!.status).toBe("awaiting_response");
+    expect(getSessionById(secondId)!.status).toBe("awaiting_response");
   });
 
   // ── findActiveSession returns correct session ──
@@ -1772,26 +1782,46 @@ describe("outbound verification sessions", () => {
     expect(result.success).toBe(true);
   });
 
-  // ── Voice identity match via expectedExternalUserId ──
+  // ── Voice identity is the number ──
 
-  test("Voice identity match succeeds via expectedExternalUserId", async () => {
+  test("a voice session is redeemed by the number it was sent to", async () => {
+    // Voice knows the caller by one thing, so the consume path receives that
+    // number as both actor axes. Every voice mint records it in both
+    // identity columns, and either way the session is bound to the number.
     const { secret } = await createOutboundSession({
       channel: "phone",
-      expectedExternalUserId: "voice-user-42",
-      expectedPhoneE164: "+15551234567",
-      destinationAddress: "+15551234567",
+      expectedExternalUserId: "+15555550101",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
     });
 
-    // Actor matches expectedExternalUserId
     const result = await validateAndConsumeVerification(
       "phone",
       secret,
-      "voice-user-42",
-      "voice-chat-1",
+      "+15555550101",
+      "+15555550101",
     );
 
     expect(result.success).toBe(true);
   });
+
+  test("a voice session refuses a caller on a different number", async () => {
+    const { secret } = await createOutboundSession({
+      channel: "phone",
+      expectedExternalUserId: "+15555550101",
+      expectedPhoneE164: "+15555550101",
+      destinationAddress: "+15555550101",
+    });
+
+    const result = await validateAndConsumeVerification(
+      "phone",
+      secret,
+      "+15555550102",
+      "+15555550102",
+    );
+
+    expect(result.success).toBe(false);
+  });
 });
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -2344,7 +2374,7 @@ describe("outbound Telegram verification", () => {
   });
 
   test("telegram template does not include verification code in message", async () => {
-    const msg = composeVerificationTelegram(
+    const msg = composeVerificationText(
       GUARDIAN_VERIFY_TEMPLATE_KEYS.TELEGRAM_CHALLENGE_REQUEST,
       { code: "abc123", expiresInMinutes: 10 },
     );
@@ -2353,7 +2383,7 @@ describe("outbound Telegram verification", () => {
   });
 
   test("telegram resend template does not include code and includes (resent) suffix", async () => {
-    const msg = composeVerificationTelegram(
+    const msg = composeVerificationText(
       GUARDIAN_VERIFY_TEMPLATE_KEYS.TELEGRAM_RESEND,
       { code: "xyz789", expiresInMinutes: 5 },
     );
@@ -2363,7 +2393,7 @@ describe("outbound Telegram verification", () => {
   });
 
   test("telegram template includes Vellum assistant prefix", async () => {
-    const msg = composeVerificationTelegram(
+    const msg = composeVerificationText(
       GUARDIAN_VERIFY_TEMPLATE_KEYS.TELEGRAM_CHALLENGE_REQUEST,
       { code: "999999", expiresInMinutes: 10, assistantName: "MyBot" },
     );

package/src/__tests__/channel-readiness-telegram-remote.test.ts

@@ -0,0 +1,154 @@
+/**
+ * The Telegram probe's remote check.
+ *
+ * Local checks establish that credentials exist. That is a different claim
+ * from "messages arrive": a registration that never landed leaves every
+ * credential in place and the channel dark, which is how the readiness
+ * indicator went green on a channel nobody could reach.
+ *
+ * The classification lives in `checkTelegramWebhookHealth`, which already
+ * handles error recency and the managed-versus-self-hosted recovery text.
+ * These tests pin how the probe maps its verdicts across three outcomes, not
+ * two: verified pass, hard failure, and the no-evidence statuses that are
+ * neither. A probe that cannot see the answer must not report a fault, and
+ * must not be counted as proof either.
+ */
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type { TelegramWebhookHealthResult } from "../telegram/webhook-health.js";
+
+let health: TelegramWebhookHealthResult;
+
+mock.module("../telegram/webhook-health.js", () => ({
+  checkTelegramWebhookHealth: async () => health,
+}));
+
+mock.module("../calls/twilio-rest.js", () => ({
+  hasTwilioCredentials: () => false,
+}));
+mock.module("../calls/twilio-config.js", () => ({
+  resolveTwilioPhoneNumber: () => undefined,
+}));
+mock.module("../runtime/channel-invite-transports/whatsapp.js", () => ({
+  resolveWhatsAppDisplayNumber: () => undefined,
+}));
+
+async function runTelegramRemoteProbe() {
+  const { createReadinessService } =
+    await import("../runtime/channel-readiness-service.js");
+  const service = createReadinessService();
+  return service.getReadiness("telegram", true);
+}
+
+async function deliveryCheck() {
+  const [snapshot] = await runTelegramRemoteProbe();
+  const remote = snapshot.remoteChecks ?? [];
+  const result = remote.find((c) => c.name === "webhook_delivery");
+  if (!result) {
+    throw new Error(
+      `no webhook_delivery check ran; got: ${remote.map((c) => c.name).join(", ") || "(none)"}`,
+    );
+  }
+  return result;
+}
+
+beforeEach(() => {
+  health = { status: "healthy", detail: "ok" };
+});
+
+afterEach(() => {
+  mock.restore();
+});
+
+describe("telegram remote probe (webhook delivery)", () => {
+  test("passes when Telegram reports a healthy webhook", async () => {
+    health = { status: "healthy", detail: "delivering" };
+
+    expect((await deliveryCheck()).passed).toBe(true);
+  });
+
+  test("fails when no webhook is registered, carrying the recovery text", async () => {
+    health = {
+      status: "not_registered",
+      detail: "Telegram has no webhook registered. Contact support.",
+    };
+
+    const result = await deliveryCheck();
+    expect(result.passed).toBe(false);
+    // The detail carries fixPath()'s managed-versus-self-hosted guidance, so
+    // the probe relays it rather than substituting wording of its own.
+    expect(result.message).toBe(health.detail);
+  });
+
+  test("fails when Telegram reports a recent delivery error", async () => {
+    health = {
+      status: "delivery_failing",
+      detail: 'Telegram reported "Connection refused"',
+    };
+
+    const result = await deliveryCheck();
+    expect(result.passed).toBe(false);
+    expect(result.message).toBe(health.detail);
+  });
+
+  test("fails when Telegram holds a webhook this deployment did not register", async () => {
+    // The case last_error_date cannot see: on a quiet channel a stale tunnel
+    // address or another deployment's callback never produces a delivery
+    // error, so before the URL comparison this read as healthy.
+    health = {
+      status: "url_mismatch",
+      detail: "Telegram is registered at a different address",
+      registeredUrl: "https://stale.example/webhooks/telegram",
+      expectedUrl: "https://current.example/webhooks/telegram",
+    };
+
+    const result = await deliveryCheck();
+    expect(result.passed).toBe(false);
+    expect(result.message).toBe(health.detail);
+  });
+
+  // The three indeterminate statuses. Each must satisfy BOTH halves: no fault
+  // reported (so a network blip does not paint a working channel broken), and
+  // not counted as evidence (so nothing can claim delivery from a check that
+  // never established it). Asserting only `passed` would let a regression that
+  // drops `indeterminate` through, which is exactly the false-success this
+  // contract exists to prevent.
+  const indeterminateCases = [
+    ["skipped", "no bot token stored"],
+    ["unknown", "could not reach Telegram"],
+    ["unverified", "no record of registering this webhook"],
+  ] as const;
+
+  for (const [status, detail] of indeterminateCases) {
+    test(`${status} is indeterminate: no fault reported, but not proof of delivery`, async () => {
+      health = { status, detail };
+
+      const result = await deliveryCheck();
+      expect(result.passed).toBe(true);
+      expect(result.indeterminate).toBe(true);
+    });
+  }
+
+  test("an untouched install stays not_configured rather than incomplete", async () => {
+    // setupStatus separates not_configured from incomplete by asking whether
+    // any check passed. Counting an indeterminate check there reported a
+    // workspace with no Telegram credentials at all as half-finished, which is
+    // what routes the Channels UI to the "finish setup" prompt instead of the
+    // normal setup flow.
+    health = { status: "skipped", detail: "no bot token stored" };
+
+    const [snapshot] = await runTelegramRemoteProbe();
+    expect(snapshot.setupStatus).toBe("not_configured");
+    expect(snapshot.ready).toBe(false);
+  });
+
+  test("a verified healthy result is not marked indeterminate", async () => {
+    // Sensitivity check for the cases above: if `indeterminate` were set
+    // unconditionally they would pass while proving nothing.
+    health = { status: "healthy", detail: "registered where we set it" };
+
+    const result = await deliveryCheck();
+    expect(result.passed).toBe(true);
+    expect(result.indeterminate).toBeFalsy();
+  });
+});