@cat-factory/app 0.210.1 → 0.212.0

package/app/components/board/RecurringPipelineModal.vue

@@ -7,6 +7,9 @@
 // where that pipeline files its ticket) and saved alongside.
 import type { IssueIntakeConfig, Recurrence, ScheduleTemplate } from '~/types/recurring'
 import type { TaskSourceKind } from '~/types/domain'
+import type { IssueIntakeRefusalReason } from '@cat-factory/contracts'
+import { BUILTIN_TASK_SOURCE_KINDS } from '@cat-factory/contracts'
+import { apiErrorReason } from '~/composables/api/errors'
 import { pipelineAllowedForSchedule } from '~/utils/pipeline'
 
 const ui = useUiStore()
@@ -17,7 +20,7 @@ const tracker = useTrackerStore()
 const tasks = useTasksStore()
 const toast = useToast()
 const access = useWorkspaceAccess()
-const { t } = useI18n()
+const { t, te } = useI18n()
 
 const open = computed({
   get: () => ui.addRecurringFrameId !== null,
@@ -50,6 +53,68 @@ const intakeSource = ref<TaskSourceKind | null>(null)
 const intakeJiraProjectKey = ref('')
 const intakeLinearTeamId = ref('')
 const intakeGithubRepo = ref('')
+/**
+ * The board scope for a DEPLOYMENT-REGISTERED source, held opaquely. Its own field rather than
+ * reusing one of the three above, mirroring `issueIntakeConfigSchema.board.boardId`: only that
+ * deployment's provider knows what its board id means, so the form carries the string and the
+ * label stays generic.
+ */
+const intakeBoardId = ref('')
+
+/**
+ * Opt in to driving THIS schedule from tracker webhooks, for a pipeline that has no `bug-intake`
+ * step. Enabling it also switches the schedule to on-demand, because the two are inseparable: a
+ * cadence tick carries no triggering ticket, and the server refuses that combination.
+ */
+const trackerTrigger = ref(false)
+
+function setTrackerTrigger(on: boolean): void {
+  trackerTrigger.value = on
+  if (on) onDemand.value = true
+}
+
+/**
+ * On-demand is FORCED, not merely defaulted, while the tracker trigger is on: the server refuses a
+ * per-ticket schedule that could also fire on a cadence, and setting the switch once at opt-in time
+ * left the refusal reachable by turning it back off afterwards. The switch is disabled rather than
+ * hidden, so the state it is locked into stays visible and the reason is stated beside it.
+ */
+const onDemandLocked = computed(() => trackerTrigger.value)
+
+/**
+ * Translated copy for a refused intake configuration, keyed off the backend's machine-readable
+ * `details.reason`.
+ *
+ * The form makes both refusals unrepresentable, so this is the SECOND line rather than the first:
+ * a stale form whose pipeline gained a `bug-intake` step since it opened, or an API client driving
+ * the same endpoint, still reaches them, and the backend does not localize its prose. An EXHAUSTIVE
+ * `Record` over the contracts union is the drift guard: a new refusal reason fails this typecheck
+ * until it has copy, which a runtime `t()` lookup could not catch.
+ */
+const INTAKE_REFUSAL_KEYS: Record<IssueIntakeRefusalReason, string> = {
+  per_ticket_requires_on_demand: 'board.recurring.refusalPerTicketRequiresOnDemand',
+  per_ticket_conflicts_with_bug_intake: 'board.recurring.refusalPerTicketConflictsWithBugIntake',
+}
+
+function intakeRefusalCopy(error: unknown): string | null {
+  const reason = apiErrorReason(error)
+  if (!reason || !(reason in INTAKE_REFUSAL_KEYS)) return null
+  // `te` before `t`, the `usePipelineErrorToast` idiom: a locale missing the key falls through to
+  // the backend's prose rather than rendering the key path at the user.
+  const key = INTAKE_REFUSAL_KEYS[reason as IssueIntakeRefusalReason]
+  return te(key) ? t(key) : null
+}
+
+/**
+ * Whether the picked source is one this build ships (and so has a vendor-specific board field).
+ *
+ * Read from the contracts constant rather than re-listing the three ids: the vocabulary has one
+ * owner, and a fourth built-in source would otherwise render the opaque board field here while
+ * every other surface offered its vendor one.
+ */
+const intakeSourceIsBuiltin = computed(() =>
+  (BUILTIN_TASK_SOURCE_KINDS as readonly string[]).includes(intakeSource.value ?? ''),
+)
 const intakeTitleFragment = ref('')
 const intakeLabels = ref('') // comma-separated in the UI, sent as an array
 const intakeIssueType = ref('')
@@ -98,6 +163,23 @@ const isBugIntake = computed(() => {
     (kind, i) => kind === 'bug-intake' && pipeline.enabled?.[i] !== false,
   )
 })
+/**
+ * Whether the intake section is shown, and in which DISPATCH mode — both DERIVED from the picked
+ * pipeline rather than chosen, because the two modes are not interchangeable:
+ *
+ *  - a `bug-intake` pipeline pulls its own work from the board, so a pushed event can only mean
+ *    "drain the queue now" (`queue`);
+ *  - any other pipeline has no step that picks work, so a pushed event can only mean "run THIS
+ *    ticket" (`per-ticket`).
+ *
+ * Deriving it makes the combination the server refuses (`per-ticket` on a `bug-intake` pipeline)
+ * unrepresentable here, instead of offering it and reporting a validation error afterwards.
+ */
+const showIntake = computed(() => isBugIntake.value || trackerTrigger.value)
+const intakeDispatch = computed<'queue' | 'per-ticket'>(() =>
+  isBugIntake.value ? 'queue' : 'per-ticket',
+)
+
 // Sources that can back intake right now (connected / App-installed AND enabled).
 const intakeSources = computed(() => tasks.offeredSources)
 
@@ -119,6 +201,8 @@ watch(open, (isOpen) => {
   intakeJiraProjectKey.value = ''
   intakeLinearTeamId.value = ''
   intakeGithubRepo.value = ''
+  intakeBoardId.value = ''
+  trackerTrigger.value = false
   intakeTitleFragment.value = ''
   intakeLabels.value = ''
   intakeIssueType.value = ''
@@ -147,6 +231,8 @@ const { requestClose } = useUnsavedGuard({
     intakeJiraProjectKey: intakeJiraProjectKey.value.trim(),
     intakeLinearTeamId: intakeLinearTeamId.value.trim(),
     intakeGithubRepo: intakeGithubRepo.value.trim(),
+    intakeBoardId: intakeBoardId.value.trim(),
+    trackerTrigger: trackerTrigger.value,
     intakeTitleFragment: intakeTitleFragment.value.trim(),
     intakeLabels: intakeLabels.value.trim(),
     intakeIssueType: intakeIssueType.value.trim(),
@@ -156,10 +242,13 @@ const { requestClose } = useUnsavedGuard({
 
 // The board field required for the picked source must be filled before a bug-intake schedule saves.
 const intakeReady = computed(() => {
-  if (!isBugIntake.value) return true
+  if (!showIntake.value) return true
   if (intakeSource.value === 'jira') return intakeJiraProjectKey.value.trim().length > 0
   if (intakeSource.value === 'linear') return intakeLinearTeamId.value.trim().length > 0
   if (intakeSource.value === 'github') return intakeGithubRepo.value.trim().length > 0
+  // A registered source is scoped by its opaque board id. Falling through to `false` here would
+  // make its schedule permanently unsaveable rather than merely unscoped.
+  if (intakeSource.value) return intakeBoardId.value.trim().length > 0
   return false
 })
 
@@ -181,6 +270,9 @@ function buildIssueIntake(): IssueIntakeConfig {
       ...(source === 'github' && intakeGithubRepo.value.trim()
         ? { githubRepo: intakeGithubRepo.value.trim() }
         : {}),
+      ...(!intakeSourceIsBuiltin.value && intakeBoardId.value.trim()
+        ? { boardId: intakeBoardId.value.trim() }
+        : {}),
     },
     predicates: {
       ...(intakeTitleFragment.value.trim()
@@ -192,6 +284,9 @@ function buildIssueIntake(): IssueIntakeConfig {
     ...(source === 'github' && intakeInProgressLabel.value.trim()
       ? { inProgressLabel: intakeInProgressLabel.value.trim() }
       : {}),
+    // Sent only when it differs from the default, so an ordinary bug-intake schedule's stored
+    // config is byte-for-byte what it was before the mode existed.
+    ...(intakeDispatch.value === 'per-ticket' ? { dispatch: 'per-ticket' as const } : {}),
   }
 }
 
@@ -227,13 +322,13 @@ async function add() {
       onDemand: onDemand.value,
       ...(onDemand.value ? {} : { recurrence: recurrence.value }),
       ...(description.value.trim() ? { description: description.value.trim() } : {}),
-      ...(isBugIntake.value ? { issueIntake: buildIssueIntake() } : {}),
+      ...(showIntake.value ? { issueIntake: buildIssueIntake() } : {}),
     })
     ui.closeAddRecurring()
   } catch (e) {
     toast.add({
       title: t('board.recurring.addFailedTitle'),
-      description: e instanceof Error ? e.message : String(e),
+      description: intakeRefusalCopy(e) ?? (e instanceof Error ? e.message : String(e)),
       icon: 'i-lucide-triangle-alert',
       color: 'error',
     })
@@ -287,10 +382,16 @@ async function add() {
         </UFormField>
 
         <div class="flex items-start gap-2 rounded-lg border border-slate-800 p-3">
-          <USwitch v-model="onDemand" size="sm" class="mt-0.5" />
+          <USwitch v-model="onDemand" :disabled="onDemandLocked" size="sm" class="mt-0.5" />
           <div class="space-y-0.5">
             <p class="text-xs font-medium text-slate-200">{{ t('board.recurring.onDemand') }}</p>
-            <p class="text-[11px] text-slate-500">{{ t('board.recurring.onDemandHint') }}</p>
+            <p class="text-[11px] text-slate-500">
+              {{
+                onDemandLocked
+                  ? t('board.recurring.onDemandLockedHint')
+                  : t('board.recurring.onDemandHint')
+              }}
+            </p>
           </div>
         </div>
 
@@ -356,7 +457,29 @@ async function add() {
           </UFormField>
         </div>
 
-        <div v-if="isBugIntake" class="space-y-3 rounded-lg border border-slate-800 p-3">
+        <!--
+          A pipeline with no `bug-intake` step has no step that picks work, so tracker intake is an
+          OPT-IN here: turning it on makes a matching webhook event run that ticket as its own task.
+          A `bug-intake` pipeline needs no toggle — it cannot run without intake config at all.
+        -->
+        <div v-if="!isBugIntake" class="flex items-start gap-2">
+          <USwitch
+            :model-value="trackerTrigger"
+            size="sm"
+            class="mt-0.5"
+            @update:model-value="setTrackerTrigger"
+          />
+          <div>
+            <p class="text-xs font-medium text-slate-200">
+              {{ t('board.recurring.trackerTrigger') }}
+            </p>
+            <p class="text-[11px] text-slate-500">
+              {{ t('board.recurring.trackerTriggerHint') }}
+            </p>
+          </div>
+        </div>
+
+        <div v-if="showIntake" class="space-y-3 rounded-lg border border-slate-800 p-3">
           <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
             {{ t('board.recurring.intake') }}
           </p>
@@ -410,8 +533,23 @@ async function add() {
             <!-- A GitHub repo ref is always the literal `owner/name` path, never localized. -->
             <UInput v-model="intakeGithubRepo" placeholder="owner/name" class="w-full" />
           </UFormField>
+          <UFormField
+            v-if="intakeSource && !intakeSourceIsBuiltin"
+            :label="t('board.recurring.intakeBoardId')"
+            :help="t('board.recurring.intakeBoardIdHelp')"
+            required
+          >
+            <UInput v-model="intakeBoardId" class="w-full" />
+          </UFormField>
 
           <template v-if="intakeSource">
+            <p class="text-[11px] text-slate-500">
+              {{
+                intakeDispatch === 'per-ticket'
+                  ? t('board.recurring.intakeDispatchPerTicketHint')
+                  : t('board.recurring.intakeDispatchQueueHint')
+              }}
+            </p>
             <UFormField :label="t('board.recurring.intakeTitleFragment')">
               <UInput
                 v-model="intakeTitleFragment"

package/app/components/layout/AccountPlatformAlertSettings.vue

@@ -0,0 +1,329 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from 'vue'
+import type {
+  PlatformAlertSettings,
+  PlatformAlertThresholdOverrides,
+  PlatformAlertWindow,
+} from '~/types/execution'
+
+// Per-account tuning for the platform-health alert sweep (admin only): the ceilings the
+// deployment's aggregate run health is checked against, and the window they are evaluated over.
+// The deployment's env vars set the DEFAULTS; anything left blank here inherits them, so this
+// panel is an override sheet rather than a settings form.
+//
+// That distinction drives the whole component. An empty field means "inherit", NOT zero, and a
+// zero is a live setting in this vocabulary (a `minStalledPriorRuns` of 0 says "page even on an
+// idle window"), so the editor keeps blank and 0 apart end to end and only sends the fields the
+// admin actually filled in.
+const props = defineProps<{ accountId: string }>()
+
+const store = useAccountSettingsStore()
+const toast = useToast()
+const { t } = useI18n()
+
+const WINDOWS = ['1h', '24h', '7d'] as const satisfies readonly PlatformAlertWindow[]
+
+// Exhaustive enum→key map (the tier-2 dynamic-key guard): adding a window without a label
+// fails the typecheck here rather than rendering a raw code.
+const windowLabels = computed<Record<PlatformAlertWindow, string>>(() => ({
+  '1h': t('settings.platformAlerts.window.oneHour'),
+  '24h': t('settings.platformAlerts.window.oneDay'),
+  '7d': t('settings.platformAlerts.window.sevenDays'),
+}))
+const windowItems = computed(() =>
+  [
+    { label: t('settings.platformAlerts.window.inherit'), value: '' },
+    ...WINDOWS.map((w) => ({ label: windowLabels.value[w], value: w })),
+  ].map((i) => i),
+)
+
+/**
+ * The numeric ceilings, each rendered as one row: the contract key plus the input's step.
+ * ONE table drives the form, the hydrate and the save, so adding a threshold to the contract
+ * is a single entry rather than a form field plus a save branch free to disagree with it.
+ */
+const THRESHOLDS = [
+  { field: 'minRuns', step: 1 },
+  { field: 'maxFailureRate', step: 0.05 },
+  { field: 'maxP99DurationMs', step: 1 },
+  { field: 'maxBacklog', step: 1 },
+  { field: 'stalledBuckets', step: 1 },
+  { field: 'minStalledPriorRuns', step: 1 },
+  { field: 'maxFailureKindShare', step: 0.05 },
+  { field: 'maxSweepFailures', step: 1 },
+] as const satisfies readonly { field: keyof PlatformAlertThresholdOverrides; step: number }[]
+
+type ThresholdField = (typeof THRESHOLDS)[number]['field']
+
+// Exhaustive label/hint maps, same drift guard as the windows above.
+const thresholdLabels = computed<Record<ThresholdField, string>>(() => ({
+  minRuns: t('settings.platformAlerts.thresholds.minRuns'),
+  maxFailureRate: t('settings.platformAlerts.thresholds.maxFailureRate'),
+  maxP99DurationMs: t('settings.platformAlerts.thresholds.maxP99DurationMs'),
+  maxBacklog: t('settings.platformAlerts.thresholds.maxBacklog'),
+  stalledBuckets: t('settings.platformAlerts.thresholds.stalledBuckets'),
+  minStalledPriorRuns: t('settings.platformAlerts.thresholds.minStalledPriorRuns'),
+  maxFailureKindShare: t('settings.platformAlerts.thresholds.maxFailureKindShare'),
+  maxSweepFailures: t('settings.platformAlerts.thresholds.maxSweepFailures'),
+}))
+const thresholdHints = computed<Record<ThresholdField, string>>(() => ({
+  minRuns: t('settings.platformAlerts.hints.minRuns'),
+  maxFailureRate: t('settings.platformAlerts.hints.maxFailureRate'),
+  maxP99DurationMs: t('settings.platformAlerts.hints.maxP99DurationMs'),
+  maxBacklog: t('settings.platformAlerts.hints.maxBacklog'),
+  stalledBuckets: t('settings.platformAlerts.hints.stalledBuckets'),
+  minStalledPriorRuns: t('settings.platformAlerts.hints.minStalledPriorRuns'),
+  maxFailureKindShare: t('settings.platformAlerts.hints.maxFailureKindShare'),
+  maxSweepFailures: t('settings.platformAlerts.hints.maxSweepFailures'),
+}))
+
+// Editable state. Every value is a STRING so an empty field stays distinguishable from a typed
+// `0`: binding a number input to a nullable number collapses those two the moment the field is
+// cleared, and one of them is "leave the deployment default alone".
+const muted = ref(false)
+const alertWindow = ref<PlatformAlertWindow | ''>('')
+const values = ref<Record<ThresholdField, string>>(blankValues())
+const saving = ref(false)
+
+function blankValues(): Record<ThresholdField, string> {
+  return Object.fromEntries(THRESHOLDS.map((th) => [th.field, ''])) as Record<
+    ThresholdField,
+    string
+  >
+}
+
+/** The p99 ceiling is stored in ms and edited in MINUTES, which is how operators think of it. */
+function toDisplay(field: ThresholdField, stored: number | undefined): string {
+  if (stored === undefined) return ''
+  return field === 'maxP99DurationMs' ? String(stored / 60_000) : String(stored)
+}
+function fromDisplay(field: ThresholdField, raw: string): number | undefined {
+  const trimmed = raw.trim()
+  if (trimmed === '') return undefined
+  const n = Number(trimmed)
+  if (!Number.isFinite(n)) return undefined
+  return field === 'maxP99DurationMs' ? Math.round(n * 60_000) : n
+}
+
+function hydrate() {
+  const stored = store.view?.config?.platformAlerts
+  muted.value = stored?.enabled === false
+  alertWindow.value = stored?.window ?? ''
+  const next = blankValues()
+  for (const th of THRESHOLDS) next[th.field] = toDisplay(th.field, stored?.thresholds?.[th.field])
+  values.value = next
+}
+
+onMounted(async () => {
+  // A sibling panel loads the same store on mount; only load when nothing is there yet.
+  if (!store.view && store.available !== false) {
+    try {
+      await store.load(props.accountId)
+    } catch {
+      // The deployment-settings panel surfaces the error text; what matters HERE is that the
+      // rest of the account's config never arrived, which `loaded` below turns into a refusal
+      // to save rather than a silent write of a config that is missing everything.
+    }
+  }
+  hydrate()
+})
+watch(() => store.view, hydrate)
+
+/**
+ * Whether the account's CURRENT config is in hand.
+ *
+ * Load-bearing because a save REPLACES the whole non-secret config and this panel only edits one
+ * key of it: saving on top of a failed load would carry nothing forward and silently wipe the
+ * model policy, the run-credential floor and every other sibling setting. The store only clears
+ * `available` for a 503 (the settings module is unwired), so any other load failure leaves the
+ * panel rendered with a null view, which is exactly the state this guards.
+ */
+const loaded = computed(() => !!store.view)
+
+/**
+ * Fields whose text is not a number. Reported rather than dropped: `fromDisplay` returning
+ * `undefined` means "inherit" everywhere else, so silently coercing a typo into it would answer
+ * a mis-typed ceiling by quietly restoring the deployment default.
+ */
+const invalidFields = computed(() =>
+  THRESHOLDS.filter((th) => {
+    const raw = values.value[th.field].trim()
+    return raw !== '' && !Number.isFinite(Number(raw))
+  }).map((th) => thresholdLabels.value[th.field]),
+)
+
+/** The overrides to persist: only the fields the admin actually filled in. */
+function collectThresholds(): PlatformAlertThresholdOverrides {
+  const out: PlatformAlertThresholdOverrides = {}
+  for (const th of THRESHOLDS) {
+    const parsed = fromDisplay(th.field, values.value[th.field])
+    if (parsed !== undefined) out[th.field] = parsed
+  }
+  return out
+}
+
+async function save() {
+  if (!loaded.value) {
+    toast.add({ title: t('settings.platformAlerts.notLoaded'), color: 'error' })
+    return
+  }
+  if (invalidFields.value.length > 0) {
+    toast.add({
+      title: t('settings.platformAlerts.invalidNumbers'),
+      description: invalidFields.value.join(', '),
+      color: 'error',
+    })
+    return
+  }
+  const thresholds = collectThresholds()
+  // Each key is omitted rather than nulled when it carries no override: an absent key is what
+  // the backend reads as "inherit the deployment default", and a stored null would be a value.
+  const settings: PlatformAlertSettings = {
+    ...(muted.value ? { enabled: false } : {}),
+    ...(alertWindow.value ? { window: alertWindow.value } : {}),
+    ...(Object.keys(thresholds).length > 0 ? { thresholds } : {}),
+  }
+  saving.value = true
+  try {
+    // `config` fully replaces the stored non-secret config, so carry the rest forward (guarded
+    // by `loaded` above, or "the rest" would be nothing).
+    await store.save(props.accountId, {
+      config: { ...store.view?.config, platformAlerts: settings },
+    })
+    toast.add({
+      title: t('settings.platformAlerts.saved'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    toast.add({
+      title: t('settings.platformAlerts.saveFailed'),
+      description: e instanceof Error ? e.message : String(e),
+      color: 'error',
+    })
+  } finally {
+    saving.value = false
+  }
+}
+
+function resetAll() {
+  muted.value = false
+  alertWindow.value = ''
+  values.value = blankValues()
+}
+
+const hasOverrides = computed(
+  () =>
+    muted.value ||
+    alertWindow.value !== '' ||
+    THRESHOLDS.some((th) => values.value[th.field].trim() !== ''),
+)
+</script>
+
+<template>
+  <section
+    v-if="store.available !== false"
+    data-testid="account-platform-alerts"
+    class="space-y-3 border-t border-slate-800 pt-6"
+  >
+    <div>
+      <h4 class="text-sm font-semibold text-slate-200">
+        {{ t('settings.platformAlerts.title') }}
+      </h4>
+      <p class="text-[11px] text-slate-400">{{ t('settings.platformAlerts.description') }}</p>
+    </div>
+
+    <!--
+      The one-way switch. It is stated rather than presented as a symmetric toggle because it
+      genuinely is one: the deployment's env var decides whether the sweep runs at all, and no
+      stored row can start a timer that was never started.
+    -->
+    <div class="space-y-1">
+      <UCheckbox
+        v-model="muted"
+        size="sm"
+        :label="t('settings.platformAlerts.muteLabel')"
+        data-testid="platform-alerts-mute"
+      />
+      <p class="ps-6 text-[11px] text-slate-400">{{ t('settings.platformAlerts.muteHint') }}</p>
+    </div>
+
+    <div class="space-y-1">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.platformAlerts.windowLabel') }}
+      </label>
+      <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
+        <USelect
+          v-model="alertWindow"
+          :items="windowItems"
+          value-key="value"
+          size="sm"
+          data-testid="platform-alerts-window"
+        />
+      </div>
+      <p class="text-[11px] text-slate-400">{{ t('settings.platformAlerts.windowHint') }}</p>
+    </div>
+
+    <div class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.platformAlerts.thresholdsLabel') }}
+      </label>
+      <p class="text-[11px] text-slate-400">{{ t('settings.platformAlerts.inheritHint') }}</p>
+      <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+        <div v-for="th in THRESHOLDS" :key="th.field" class="space-y-1">
+          <label class="block text-[11px] text-slate-300" :for="`platform-alert-${th.field}`">
+            {{ thresholdLabels[th.field] }}
+          </label>
+          <UInput
+            :id="`platform-alert-${th.field}`"
+            v-model="values[th.field]"
+            type="number"
+            :step="th.step"
+            size="sm"
+            :placeholder="t('settings.platformAlerts.inheritPlaceholder')"
+            :data-testid="`platform-alert-${th.field}`"
+          />
+          <p class="text-[11px] leading-snug text-slate-500">{{ thresholdHints[th.field] }}</p>
+        </div>
+      </div>
+    </div>
+
+    <!--
+      A save REPLACES the whole account config and this sheet edits one key of it, so with the
+      current config not in hand there is nothing to carry forward. Say so and disable the
+      button rather than letting a click wipe the sibling settings.
+    -->
+    <p
+      v-if="!loaded"
+      class="rounded-lg border border-amber-800/60 bg-amber-950/30 px-3 py-2 text-xs text-amber-200"
+      data-testid="account-platform-alerts-unloaded"
+    >
+      {{ t('settings.platformAlerts.notLoaded') }}
+    </p>
+
+    <div class="flex gap-2">
+      <UButton
+        color="primary"
+        size="xs"
+        icon="i-lucide-save"
+        :loading="saving"
+        :disabled="!loaded || invalidFields.length > 0"
+        data-testid="account-platform-alerts-save"
+        @click="save"
+      >
+        {{ t('common.save') }}
+      </UButton>
+      <UButton
+        v-if="hasOverrides"
+        color="neutral"
+        variant="subtle"
+        size="xs"
+        icon="i-lucide-rotate-ccw"
+        data-testid="account-platform-alerts-reset"
+        @click="resetAll"
+      >
+        {{ t('settings.platformAlerts.reset') }}
+      </UButton>
+    </div>
+  </section>
+</template>

package/app/components/layout/AccountTeamSettings.vue

@@ -5,6 +5,7 @@ import type { AccountRole } from '~/types/domain'
 import type { InvitationStatus } from '@cat-factory/contracts'
 import AccountDeploymentSettings from '~/components/layout/AccountDeploymentSettings.vue'
 import AccountModelPolicySettings from '~/components/layout/AccountModelPolicySettings.vue'
+import AccountPlatformAlertSettings from '~/components/layout/AccountPlatformAlertSettings.vue'
 import AccountRunCredentialSettings from '~/components/layout/AccountRunCredentialSettings.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 
@@ -339,6 +340,14 @@ async function disconnectEmail() {
       <AccountModelPolicySettings :account-id="accountId" />
     </section>
 
+    <!-- per-account tuning for the platform-health alert sweep (admin-only). Not gated on
+         `modelPolicySupported`: the alert thresholds bind wherever account settings exist, and
+         a deployment that never opted the sweep in already renders the mute switch as the
+         one-way control it is. -->
+    <section v-if="isAdmin">
+      <AccountPlatformAlertSettings :account-id="accountId" />
+    </section>
+
     <!-- account-wide floor under each board's run-credential switch (admin-only). Not gated on
          `modelPolicySupported`: unlike a model policy this binds wherever account settings
          exist, and a deployment that could not enforce it would be the one case where saying