@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/runtime/__tests__/background-job-runner.test.ts

@@ -267,24 +267,106 @@ describe("runBackgroundJob", () => {
     // `turnFailure`. The runner must surface this as a failure, not ok=true.
     processMessageImpl = async () => ({
       messageId: "msg-failed-turn",
-      turnFailure: { failureCode: "provider_error" },
+      turnFailure: { failureCode: "PROVIDER_BILLING" },
     });
 
     const result = await runBackgroundJob(baseOpts());
 
     expect(result.ok).toBe(false);
     expect(result.errorKind).toBe("model_provider");
-    expect(result.error?.message).toContain("provider_error");
+    expect(result.error?.message).toContain("PROVIDER_BILLING");
     expect(result.conversationId).toBe(STUB_CONVERSATION_ID);
     // The stable classified code rides the result so callers can branch on
     // the failure class without parsing the error message.
-    expect(result.failureCode).toBe("provider_error");
+    expect(result.turnFailure?.failureCode).toBe("PROVIDER_BILLING");
 
     expect(emitCalls).toHaveLength(1);
     expect(emitCalls[0].sourceEventName).toBe("activity.failed");
     expect(
       (emitCalls[0].contextPayload as { errorKind: string }).errorKind,
     ).toBe("model_provider");
+    // A provider-scoped failure code keys the notification on the cause and
+    // the resolved provider scope, not the job. `heartbeatAgent` resolves the
+    // cost-optimized default profile, so every job failing on this code
+    // through that route collapses into one notification per UTC day.
+    expect(emitCalls[0].dedupeKey as string).toMatch(
+      /^activity-failed:cause:PROVIDER_BILLING:cost-optimized:\d{4}-\d{2}-\d{2}$/,
+    );
+  });
+
+  test("a usable overrideProfile scopes the cause-keyed dedupe", async () => {
+    processMessageImpl = async () => ({
+      messageId: "msg-failed-turn",
+      turnFailure: { failureCode: "PROVIDER_BILLING" },
+    });
+
+    await runBackgroundJob(baseOpts({ overrideProfile: "balanced" }));
+
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].dedupeKey as string).toMatch(
+      /^activity-failed:cause:PROVIDER_BILLING:balanced:\d{4}-\d{2}-\d{2}$/,
+    );
+  });
+
+  test("carried turn attribution scopes the dedupe and rides the payload", async () => {
+    processMessageImpl = async () => ({
+      messageId: "msg-failed-turn",
+      turnFailure: {
+        failureCode: "PROVIDER_BILLING",
+        userMessage: "You're out of credits.",
+        errorCategory: "credits_exhausted",
+        connectionName: "conn-a",
+        profileName: "balanced",
+      },
+    });
+
+    const result = await runBackgroundJob(baseOpts());
+
+    expect(result.ok).toBe(false);
+    expect(result.turnFailure?.userMessage).toBe("You're out of credits.");
+    expect(emitCalls).toHaveLength(1);
+    // The carried connection outranks the call site's recomputed profile.
+    expect(emitCalls[0].dedupeKey as string).toMatch(
+      /^activity-failed:cause:PROVIDER_BILLING:conn-a:\d{4}-\d{2}-\d{2}$/,
+    );
+    expect(emitCalls[0].contextPayload).toMatchObject({
+      failureSummary: "You're out of credits.",
+      errorCategory: "credits_exhausted",
+      connectionName: "conn-a",
+    });
+  });
+
+  test("job-specific failure code keeps the per-job dedupe key", async () => {
+    // CONTEXT_TOO_LARGE names a defect in this job's own prompt; collapsing
+    // it across jobs would hide a second job's unrelated failure.
+    processMessageImpl = async () => ({
+      messageId: "msg-failed-turn",
+      turnFailure: { failureCode: "CONTEXT_TOO_LARGE" },
+    });
+
+    const result = await runBackgroundJob(baseOpts());
+
+    expect(result.ok).toBe(false);
+    expect(result.turnFailure?.failureCode).toBe("CONTEXT_TOO_LARGE");
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].dedupeKey as string).toMatch(
+      /^activity-failed:test-job:\d{4}-\d{2}-\d{2}$/,
+    );
+  });
+
+  test("code-less provider failure dedupes on the shared model_provider cause", async () => {
+    processMessageImpl = async () => {
+      throw new Error("provider returned 401");
+    };
+
+    const result = await runBackgroundJob(baseOpts());
+
+    expect(result.ok).toBe(false);
+    expect(result.errorKind).toBe("model_provider");
+    expect(emitCalls).toHaveLength(1);
+    expect(emitCalls[0].dedupeKey as string).toMatch(
+      /^activity-failed:cause:model_provider:cost-optimized:\d{4}-\d{2}-\d{2}$/,
+    );
   });
 
   test("timeout: returns ok=false with errorKind=timeout and emits activity.failed", async () => {
@@ -301,6 +383,10 @@ describe("runBackgroundJob", () => {
     expect(
       (emitCalls[0].contextPayload as { errorKind: string }).errorKind,
     ).toBe("timeout");
+    // A timeout is job-specific, so it keeps the per-job dedupe key.
+    expect(emitCalls[0].dedupeKey as string).toMatch(
+      /^activity-failed:test-job:\d{4}-\d{2}-\d{2}$/,
+    );
   });
 
   test("suppressFailureNotifications: failure returns ok=false but emits nothing", async () => {

package/src/runtime/agent-wake.ts

@@ -459,6 +459,20 @@ export interface WakeResult {
   producedToolCalls: boolean;
   /** Present only when `invoked: false`; identifies why the wake was skipped. */
   reason?: WakeSkipReason;
+  /**
+   * How the agent loop terminated, from its `agent_loop_exit` event. Set on
+   * `invoked: true` results whose loop reported a terminal exit, and absent
+   * when it reported none (a checkpoint handoff, whose run resumes
+   * separately).
+   *
+   * `"no_tool_calls"` is the model-driven stop: the run finished because the
+   * assistant answered without asking for another tool. Every other reason
+   * means something ended the run for it (cancellation, an output-token
+   * ceiling, an unhandled error), so a caller reading the run's output as a
+   * complete conclusion has to tell them apart: the memory retrospective
+   * accepts a reviewed-nothing-to-save pass only on a model-driven stop.
+   */
+  exitReason?: AgentLoopExitReason;
 }
 
 /**
@@ -1051,6 +1065,10 @@ export async function wakeAgentForOpportunity(
     // catch turns provider rejections and unhandled throws into a graceful
     // no-output stop instead of rethrowing).
     let terminalExitReason: AgentLoopExitReason | null = null;
+    // The `exitReason` field for an `invoked: true` result: present exactly
+    // when the loop reported a terminal exit.
+    const exitReasonField = (): { exitReason?: AgentLoopExitReason } =>
+      terminalExitReason !== null ? { exitReason: terminalExitReason } : {};
     const persistLog = (record: PendingLog): void => {
       try {
         recordRequestLog(
@@ -1125,10 +1143,23 @@ export async function wakeAgentForOpportunity(
             // the conversation-id seed resolves the same mix arm the dispatch
             // path chose. Without these, attribution credits the call-site
             // profile/arm instead of the one that ran.
+            //
+            // A rerouted call (`RetryProvider`'s fallback-profile escalation)
+            // outranks both: the wake resolved `overrideProfile` before the
+            // run and cannot know the request was escalated, while
+            // `providerName` and `model` on this same row already follow the
+            // backup off the event. Attributing the profile from the wake's
+            // own resolution would write a row that contradicts itself. One
+            // row is written per `usage` event, each from that event alone,
+            // so this needs no cross-call state: a later non-rerouted call
+            // writes its own row under the wake's resolution.
             {
               callSite,
-              overrideProfile: overrideProfile ?? null,
-              forceOverrideProfile,
+              overrideProfile:
+                event.actualInferenceProfile ?? overrideProfile ?? null,
+              forceOverrideProfile:
+                event.actualInferenceProfile !== undefined ||
+                forceOverrideProfile,
               selectionSeed: conversationId,
             },
             opts.cronRunId ?? null,
@@ -1545,7 +1576,11 @@ export async function wakeAgentForOpportunity(
             reason: "run_error" as const,
           };
         }
-        return { invoked: true, producedToolCalls: false };
+        return {
+          invoked: true,
+          producedToolCalls: false,
+          ...exitReasonField(),
+        };
       } finally {
         // Restore the pre-wake values so a queued user turn or background read
         // never observes the wake's stamps. (`runAgentLoopImpl` re-stamps both
@@ -1642,7 +1677,11 @@ export async function wakeAgentForOpportunity(
         // since checkpoints only fire after tool turns and there were
         // none.) The finally still kicks the queue drain so a racy queued
         // message isn't stranded.
-        return { invoked: true, producedToolCalls: false };
+        return {
+          invoked: true,
+          producedToolCalls: false,
+          ...exitReasonField(),
+        };
       }
 
       tailMessageCount = tailMessages.length;
@@ -1677,7 +1716,7 @@ export async function wakeAgentForOpportunity(
       });
       drainedInTry = true;
 
-      return { invoked: true, producedToolCalls };
+      return { invoked: true, producedToolCalls, ...exitReasonField() };
     } finally {
       // Put the conversation's resting trust back on every exit path.
       restorePersistentWakeTrust();

package/src/runtime/background-job-runner.ts

@@ -18,15 +18,18 @@
  * `suppressFailureNotifications`.
  */
 
+import { resolveSingleRouteProfileKey } from "../config/llm-resolver.js";
+import { getConfig } from "../config/loader.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import { processMessage } from "../daemon/process-message.js";
 import type { SubagentToolGateMode } from "../daemon/tool-setup-types.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
-import { emitNotificationSignal } from "../notifications/emit-signal.js";
-import type { AttentionHints } from "../notifications/signal.js";
+import { emitBackgroundFailureSignal } from "../notifications/background-failure-signal.js";
 import { bootstrapConversation } from "../persistence/conversation-bootstrap.js";
 import { addMessage } from "../persistence/conversation-crud.js";
 import type { TitleOrigin } from "../persistence/conversation-title-service.js";
+import { dispatchProviderResolvable } from "../providers/provider-resolvability.js";
+import type { TurnFailure } from "../telemetry/turn-outcome.js";
 import { getLogger } from "../util/logger.js";
 import { hasReceivedUserMessage } from "./pre-first-message-gate.js";
 
@@ -53,12 +56,14 @@ class BackgroundJobTimeoutError extends Error {
  */
 class BackgroundJobTurnFailureError extends Error {
   override name = "BackgroundJobTurnFailureError";
-  readonly failureCode: string | undefined;
-  constructor(failureCode: string | undefined) {
+  readonly turnFailure: TurnFailure;
+  constructor(turnFailure: TurnFailure) {
     super(
-      failureCode ? `Agent turn failed (${failureCode})` : "Agent turn failed",
+      turnFailure.failureCode
+        ? `Agent turn failed (${turnFailure.failureCode})`
+        : "Agent turn failed",
     );
-    this.failureCode = failureCode;
+    this.turnFailure = turnFailure;
   }
 }
 
@@ -99,9 +104,9 @@ export interface RunBackgroundJobOptions {
   timeoutMs: number;
   /**
    * When true, failures do NOT emit an `activity.failed` notification.
-   * Use for jobs that own their own failure UX (e.g. heartbeat's alerter)
-   * or for "quiet" scheduled jobs that the user has explicitly asked to
-   * suppress notifications for.
+   * Use for jobs whose failure alerting is owned elsewhere: heartbeat's
+   * alerter banner, and the scheduler's retry policy (which alerts once,
+   * when retries are exhausted, instead of once per attempt).
    */
   suppressFailureNotifications?: boolean;
   /** Conversation grouping id. Defaults to `"system:background"`. */
@@ -199,13 +204,14 @@ export interface RunBackgroundJobResult {
   error?: Error;
   errorKind?: BackgroundJobErrorKind;
   /**
-   * Stable classified error code (`ConversationErrorCode`, e.g.
-   * `"PROVIDER_BILLING"`) when the turn failed without throwing. Absent for
-   * timeouts and thrown exceptions. Lets callers branch on the failure class
-   * (e.g. billing vs transient) without depending on error identity or
-   * message text.
+   * The failing turn's full carried classification (stable failureCode,
+   * authored user message, category, connection/profile attribution), when
+   * the failure was a non-throwing turn failure. Absent for timeouts and
+   * thrown exceptions. The single classification field on the result:
+   * callers branch on `turnFailure?.failureCode` and forward the object
+   * wholesale when reporting the failure onward.
    */
-  failureCode?: string;
+  turnFailure?: TurnFailure;
   /**
    * Set when the runner declined to execute. Callers can distinguish a
    * skipped job from a successful one even though both report `ok: true`.
@@ -377,18 +383,17 @@ export async function runBackgroundJob(
     // Rethrow so it flows through the shared failure path below (logging +
     // `activity.failed` emission) rather than returning `ok: true`.
     if (runResult.turnFailure) {
-      throw new BackgroundJobTurnFailureError(
-        runResult.turnFailure.failureCode,
-      );
+      throw new BackgroundJobTurnFailureError(runResult.turnFailure);
     }
     return { conversationId: conversation.id, ok: true };
   } catch (err) {
     const errorKind = classifyError(err);
     const error = err instanceof Error ? err : new Error(String(err));
-    const failureCode =
+    const turnFailure =
       err instanceof BackgroundJobTurnFailureError
-        ? err.failureCode
+        ? err.turnFailure
         : undefined;
+    const failureCode = turnFailure?.failureCode;
     // Bootstrap can fail before `conversation` is assigned; fall back to ""
     // so the structured failure result still flows to the caller.
     const conversationId = conversation?.id ?? "";
@@ -404,38 +409,51 @@ export async function runBackgroundJob(
     );
 
     if (!opts.suppressFailureNotifications) {
-      const hints: AttentionHints = {
-        requiresAction: false,
-        urgency: "medium",
-        isAsyncBackground: true,
-        visibleInSourceNow: false,
-      };
-      // Dedupe by jobName + UTC date so repeated failures of the same
-      // background job (e.g. a watcher whose credentials are revoked)
-      // collapse into a single home-feed entry per day rather than
-      // spamming on every tick.
-      const day = new Date().toISOString().slice(0, 10);
-      const dedupeKey = `activity-failed:${opts.jobName}:${day}`;
-      emitNotificationSignal({
-        sourceChannel: "assistant_tool",
-        sourceContextId: conversationId,
-        sourceEventName: "activity.failed",
-        dedupeKey,
-        contextPayload: {
-          jobName: opts.jobName,
-          errorMessage: error.message,
-          errorKind,
-        },
-        attentionHints: hints,
-      }).catch((emitErr) => {
-        log.warn(
+      // Fallback scope for failures that carry no attribution: the profile
+      // key the resolver would use for this call site, computed with the
+      // same provider-resolvability predicate dispatch uses so the
+      // recomputation cannot accept a profile dispatch rejected (e.g. a pin
+      // whose connection was force-deleted). A mix winner, no named winner,
+      // or a config read failing on this path all yield no scope, and the
+      // key falls back to per-job. A carried `turnFailure.profileName` is
+      // dispatch's own attribution and takes precedence over all of this.
+      let fallbackProviderScope: string | undefined;
+      try {
+        fallbackProviderScope = resolveSingleRouteProfileKey(
+          opts.callSite,
+          getConfig().llm,
           {
-            err: emitErr instanceof Error ? emitErr.message : String(emitErr),
-            jobName: opts.jobName,
-            conversationId,
+            ...(opts.overrideProfile
+              ? { overrideProfile: opts.overrideProfile }
+              : {}),
+            isResolvableProvider: dispatchProviderResolvable,
           },
-          "Failed to emit activity.failed notification for background job",
         );
+      } catch {
+        fallbackProviderScope = undefined;
+      }
+      emitBackgroundFailureSignal({
+        jobName: opts.jobName,
+        sourceChannel: "assistant_tool",
+        sourceContextId: conversationId,
+        errorKind,
+        errorMessage: error.message,
+        ...(failureCode !== undefined ? { failureCode } : {}),
+        ...(turnFailure?.userMessage !== undefined
+          ? { failureSummary: turnFailure.userMessage }
+          : {}),
+        ...(turnFailure?.errorCategory !== undefined
+          ? { errorCategory: turnFailure.errorCategory }
+          : {}),
+        ...(turnFailure?.connectionName !== undefined
+          ? { connectionName: turnFailure.connectionName }
+          : {}),
+        ...(turnFailure?.profileName !== undefined
+          ? { profileName: turnFailure.profileName }
+          : {}),
+        ...(fallbackProviderScope !== undefined
+          ? { fallbackProviderScope }
+          : {}),
       });
     }
 
@@ -444,7 +462,7 @@ export async function runBackgroundJob(
       ok: false,
       error,
       errorKind,
-      ...(failureCode !== undefined ? { failureCode } : {}),
+      ...(turnFailure !== undefined ? { turnFailure } : {}),
     };
   } finally {
     if (timer) {

package/src/runtime/channel-readiness-service.ts

@@ -548,44 +548,6 @@ const slackProbe: ChannelProbe = {
   },
 };
 
-/**
- * Whether Discord admits anything in the guilds it has joined.
- *
- * A configuration check rather than an operational one, and the distinction
- * carries the meaning. An empty allow-list is a setup step nobody finished,
- * not a channel that broke: direct messages reach the assistant either way,
- * because a message with no guild never meets this gate. Reporting it as
- * failing health would send an operator to look for an outage that is not
- * there, and reporting it as ready would claim delivery while every guild
- * message is dropped.
- *
- * An unreachable gateway is indeterminate, matching the socket check beside
- * it: nobody looked, so nothing is claimed either way.
- */
-async function checkDiscordGuildAdmission(): Promise<ReadinessCheckResult> {
-  const { readDiscordAdmission } =
-    await import("../channels/gateway-discord-admission.js");
-
-  let admitted;
-  try {
-    admitted = (await readDiscordAdmission()).admittedChannelCount;
-  } catch {
-    return {
-      name: "guild_admission",
-      passed: true,
-      message: "Could not reach the gateway to read Discord's allow-list",
-      indeterminate: true,
-    };
-  }
-
-  return check(
-    "guild_admission",
-    admitted > 0,
-    `Discord may act in ${admitted} channel${admitted === 1 ? "" : "s"}`,
-    "Discord is in no channel's allow-list, so every guild message is dropped. Add channel ids to `discord.allowedChannelIds`",
-  );
-}
-
 // ── Discord Probe ───────────────────────────────────────────────────────────
 
 /**
@@ -614,7 +576,6 @@ const discordProbe: ChannelProbe = {
         "Discord bot token",
       ),
       await checkSocketInboundDelivery("discord"),
-      await checkDiscordGuildAdmission(),
     ];
   },
 };

package/src/runtime/http-server.ts

@@ -42,6 +42,7 @@ import {
   startPluginScheduleReconcileSweep,
   stopPluginScheduleReconcileSweep,
 } from "../schedule/plugin-schedule-reconciler.js";
+import { sttCatalogKeyForRole } from "../stt/roles.js";
 import {
   activeSttStreamSessions,
   SttStreamSession,
@@ -265,16 +266,22 @@ export class RuntimeHttpServer {
             const sttData = data;
 
             // The runtime is config-authoritative: always resolve the
-            // provider from `services.stt.provider` regardless of what
-            // the client/gateway requested.
+            // provider from config regardless of what the client/gateway
+            // requested. Dictation's own role selects it, matching the dial
+            // below, so the session's label, its failure copy and the
+            // mismatch telemetry all name the provider this socket actually
+            // reaches.
             //
             // getConfig() can throw (e.g. after invalidateConfigCache()
             // when config.json is temporarily invalid). Wrap in try/catch
-            // so the session still starts normally — resolveStreamingTranscriber
+            // so the session still starts normally: resolveStreamingTranscriber
             // reads config inside SttStreamSession.start()'s own guarded path.
             let configuredProvider: string | undefined;
             try {
-              configuredProvider = getConfig().services.stt.provider;
+              configuredProvider = sttCatalogKeyForRole(
+                getConfig().services.stt,
+                "dictation",
+              );
 
               // Mismatch telemetry: when the optional requested provider
               // disagrees with the configured provider, log a warning so
@@ -327,6 +334,7 @@ export class RuntimeHttpServer {
             // transcriber and sends a `ready` event on success.
             void session.start(() =>
               resolveStreamingTranscriber({
+                role: "dictation",
                 sampleRate: sttData.sampleRate,
               }),
             );

package/src/runtime/routes/__tests__/avatar-state-routes.test.ts

@@ -464,7 +464,7 @@ describe("GET /avatar/get (manifest-driven precedence)", () => {
     base64?: string;
   }
 
-  test("returns the PNG for an image manifest", () => {
+  test("returns the PNG for an image manifest", async () => {
     writeFileSync(path(IMAGE_FILENAME), Buffer.from("png bytes"));
     const state: AvatarState = {
       kind: "image",
@@ -474,12 +474,12 @@ describe("GET /avatar/get (manifest-driven precedence)", () => {
     };
     writeManifest(state, avatarDir);
 
-    const result = getHandler("avatar_get")({}) as GetResult;
+    const result = (await getHandler("avatar_get")({})) as GetResult;
     expect(result.exists).toBe(true);
     expect(result.path).toBe(path(IMAGE_FILENAME));
   });
 
-  test("returns base64 for an image manifest when format=base64", () => {
+  test("returns base64 for an image manifest when format=base64", async () => {
     writeFileSync(path(IMAGE_FILENAME), Buffer.from("png bytes"));
     const state: AvatarState = {
       kind: "image",
@@ -489,15 +489,15 @@ describe("GET /avatar/get (manifest-driven precedence)", () => {
     };
     writeManifest(state, avatarDir);
 
-    const result = getHandler("avatar_get")({
+    const result = (await getHandler("avatar_get")({
       queryParams: { format: "base64" },
-    }) as GetResult;
+    })) as GetResult;
     expect(result.exists).toBe(true);
     expect(result.base64).toBe(Buffer.from("png bytes").toString("base64"));
     expect(result.path).toBeUndefined();
   });
 
-  test("returns the existing raster for a character manifest", () => {
+  test("returns the existing raster for a character manifest", async () => {
     // The builder writes the rendered PNG; assert the accessor returns it
     // without needing to re-render (the manifest says character).
     writeFileSync(path(IMAGE_FILENAME), Buffer.from("rendered character png"));
@@ -509,12 +509,12 @@ describe("GET /avatar/get (manifest-driven precedence)", () => {
     };
     writeManifest(state, avatarDir);
 
-    const result = getHandler("avatar_get")({}) as GetResult;
+    const result = (await getHandler("avatar_get")({})) as GetResult;
     expect(result.exists).toBe(true);
     expect(result.path).toBe(path(IMAGE_FILENAME));
   });
 
-  test("manifest precedence wins over file order: a character manifest is honored even when a PNG is present", () => {
+  test("manifest precedence wins over file order: a character manifest is honored even when a PNG is present", async () => {
     // Both a PNG and traits are on disk, but the manifest declares character.
     // The pre-manifest accessor was image-first; precedence is now the manifest.
     writeFileSync(path(IMAGE_FILENAME), Buffer.from("rendered character png"));
@@ -527,27 +527,27 @@ describe("GET /avatar/get (manifest-driven precedence)", () => {
     };
     writeManifest(state, avatarDir);
 
-    const result = getHandler("avatar_get")({}) as GetResult;
+    const result = (await getHandler("avatar_get")({})) as GetResult;
     expect(result.exists).toBe(true);
     expect(result.path).toBe(path(IMAGE_FILENAME));
   });
 
-  test("returns exists:false for a none manifest", () => {
+  test("returns exists:false for a none manifest", async () => {
     writeManifest(
       { kind: "none", traits: null, source: null, image: null },
       avatarDir,
     );
 
-    const result = getHandler("avatar_get")({}) as GetResult;
+    const result = (await getHandler("avatar_get")({})) as GetResult;
     expect(result.exists).toBe(false);
     expect(result.path).toBeUndefined();
   });
 
-  test("self-heals from legacy files when no manifest exists (image file) and persists the manifest", () => {
+  test("self-heals from legacy files when no manifest exists (image file) and persists the manifest", async () => {
     writeFileSync(path(IMAGE_FILENAME), Buffer.from("png bytes"));
     expect(existsSync(path(MANIFEST_FILENAME))).toBe(false);
 
-    const result = getHandler("avatar_get")({}) as GetResult;
+    const result = (await getHandler("avatar_get")({})) as GetResult;
     expect(result.exists).toBe(true);
     expect(result.path).toBe(path(IMAGE_FILENAME));
 
@@ -558,14 +558,14 @@ describe("GET /avatar/get (manifest-driven precedence)", () => {
     expect(persisted.kind).toBe("image");
   });
 
-  test("returns exists:false for an empty workspace (no manifest, no files)", () => {
-    const result = getHandler("avatar_get")({}) as GetResult;
+  test("returns exists:false for an empty workspace (no manifest, no files)", async () => {
+    const result = (await getHandler("avatar_get")({})) as GetResult;
     expect(result.exists).toBe(false);
   });
 
-  test("rejects an invalid format", () => {
-    expect(() =>
+  test("rejects an invalid format", async () => {
+    await expect(
       getHandler("avatar_get")({ queryParams: { format: "bmp" } }),
-    ).toThrow(/Invalid format/);
+    ).rejects.toThrow(/Invalid format/);
   });
 });

package/src/runtime/routes/__tests__/backup-routes.test.ts

@@ -270,7 +270,7 @@ afterEach(() => {
 // ---------------------------------------------------------------------------
 
 describe("handleBackupList", () => {
-  test("empty workspace: returns empty local array and one unreachable iCloud default", async () => {
+  test("empty workspace uses the platform offsite default", async () => {
     const origHome = process.env.HOME;
     process.env.HOME = ROOT;
     try {
@@ -287,10 +287,14 @@ describe("handleBackupList", () => {
 
       const result = await handleBackupList();
       expect(result.local).toEqual([]);
-      expect(result.offsite).toHaveLength(1);
-      expect(result.offsite[0].destination.encrypt).toBe(true);
-      expect(result.offsite[0].snapshots).toEqual([]);
-      expect(result.offsite[0].reachable).toBe(false);
+      expect(result.offsite).toHaveLength(
+        process.platform === "darwin" ? 1 : 0,
+      );
+      if (process.platform === "darwin") {
+        expect(result.offsite[0].destination.encrypt).toBe(true);
+        expect(result.offsite[0].snapshots).toEqual([]);
+        expect(result.offsite[0].reachable).toBe(false);
+      }
       expect(result.nextRunAt).toBeNull();
     } finally {
       if (origHome === undefined) {