Latest push does this and has tests for both step_user and step_bluetooth where the timeout expires and also where a suitable advertisement is injected, allowing the flow to recover and correctly detect the encryption type.