From 1cf7125b0168436b6607b503a03088ba93ef8b6a Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Tue, 29 Sep 2026 20:10:03 -0500
Subject: [PATCH] test: scope Telegram lease fault to its fixture company

Fence the credential-reclamation hook used by the global recovery sweep so it cannot leave synthetic lease owners on earlier companies. Exercise a paused foreign receipt after the fault is armed and verify it settles without a leaked lease.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .../chat-channels.integration.test.ts         | 36 ++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/server/src/__tests__/chat-channels.integration.test.ts b/server/src/__tests__/chat-channels.integration.test.ts
index 292a036a647..b50e38dad2f 100644
--- a/server/src/__tests__/chat-channels.integration.test.ts
+++ b/server/src/__tests__/chat-channels.integration.test.ts
@@ -31015,6 +31015,28 @@ describeEmbeddedPostgres("chat channel control-plane integration", () => {
   });
 
   it("quarantines Telegram maintenance success when credential-lease ownership is reclaimed", async () => {
+    // Global sweeps may also reconcile a retired fixture's receipt. Keep that
+    // work eligible so the fault hook proves it cannot steal another owner.
+    const retiredFixture = await seedCompany();
+    const retired = await configuredSlackEndpoint(retiredFixture);
+    const retiredThread = makeThread({ channelId: "C-LEASE-SCOPE", id: "slack:C-LEASE-SCOPE:7002.1" });
+    await deliverMessage({
+      callbacks: retired.callbacks,
+      endpointId: retired.endpoint.id,
+      thread: retiredThread.thread,
+      message: makeMessage({ id: "7002.1", text: "@maya check lease isolation", mentioned: true }),
+      trigger: "mention",
+    });
+    await retired.service.shutdown();
+    const [retiredReceipt] = await db.select().from(chatActions).where(and(
+      eq(chatActions.endpointId, retired.endpoint.id),
+      eq(chatActions.kind, "receipt_reaction"),
+    ));
+    expect(retiredReceipt).toBeDefined();
+    await db.update(chatActions).set({ status: "received" })
+      .where(eq(chatActions.id, retiredReceipt!.id));
+    await retireFixtureState([retiredFixture.companyId]);
+
     const fixture = await seedCompany();
     const botToken = "123456:telegram-lease-reclaim";
     let reclaimLease = false;
@@ -31067,7 +31089,12 @@ describeEmbeddedPostgres("chat channel control-plane integration", () => {
     const { service } = createService(new FakeChatSdkRuntime(), providerFetch, {
       credentialMutationLeaseRenewalIntervalMs: 5,
       renewCredentialMutationLease: async (input) => {
-        if (!reclaimLease) return true;
+        // Force the unrelated receipt to reach its ownership check only
+        // after the Telegram fault is armed, independent of query timing.
+        if (blockCommands && input.companyId === retiredFixture.companyId) {
+          await leaseReclaimed;
+        }
+        if (input.companyId !== fixture.companyId || !reclaimLease) return true;
         const reclaimed = await db
           .update(chatEndpointLeases)
           .set({
@@ -31125,6 +31152,13 @@ describeEmbeddedPostgres("chat channel control-plane integration", () => {
 
     await service.processPendingDeliveries();
 
+    await expect(db.select({ status: chatActions.status }).from(chatActions)
+      .where(eq(chatActions.id, retiredReceipt!.id)))
+      .resolves.toEqual([{ status: "cancelled" }]);
+    await expect(db.select().from(chatEndpointLeases)
+      .where(eq(chatEndpointLeases.endpointId, retired.endpoint.id)))
+      .resolves.toEqual([]);
+
     await expect(
       db
         .select({ status: chatActions.status, result: chatActions.result })