@celilo/cli 0.14.2 → 0.15.0

package/src/cli/index.ts

@@ -66,6 +66,7 @@ import { handleModuleHealth } from './commands/module-health';
 import { handleModuleImport } from './commands/module-import';
 import { handleModuleList } from './commands/module-list';
 import { handleModuleLogs } from './commands/module-logs';
+import { handleModuleOperations } from './commands/module-operations';
 import { handleModulePublish } from './commands/module-publish';
 import { handleModuleRemove } from './commands/module-remove';
 import { handleModuleSearch } from './commands/module-search';
@@ -747,6 +748,9 @@ Subcommands:
       --storage <id>       Use specific storage destination
       --no-interactive     Non-interactive mode (for cron)
 
+  sweep                    Back up every module whose declared schedule is due
+                           (run by the event bus on timer.tick.1h, not by hand)
+
   list [module-id]         List available backups
     Options:
       --limit <n>          Number of backups to show (default: 20)
@@ -1466,6 +1470,8 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
         return handleModuleLogs(parsed.args, parsed.flags);
       case 'health':
         return handleModuleHealth(parsed.args, parsed.flags);
+      case 'operations':
+        return handleModuleOperations(parsed.args, parsed.flags);
       case 'remove':
         return handleModuleRemove(parsed.args, parsed.flags);
       case 'update':
@@ -1864,6 +1870,11 @@ export async function runCli(argv: string[]): Promise<CommandResult> {
       return handleBackupCreate(parsed.args, parsed.flags);
     }
 
+    if (parsed.subcommand === 'sweep') {
+      const { handleBackupSweep } = await import('./commands/backup-sweep');
+      return handleBackupSweep();
+    }
+
     if (parsed.subcommand === 'list') {
       const { handleBackupList } = await import('./commands/backup-list');
       return handleBackupList(parsed.args, parsed.flags);

package/src/db/schema.ts

@@ -1048,9 +1048,11 @@ export const alerts = sqliteTable(
     deferredRouteId: text('deferred_route_id').references(() => routes.id, {
       onDelete: 'set null',
     }),
-    escalationPolicyId: text('escalation_policy_id').references(() => escalationPolicies.id, {
-      onDelete: 'set null',
-    }),
+    // No escalation policy is stored here on purpose. It lives on the MONITOR
+    // and is resolved fresh on every sweep, so assigning a policy takes effect
+    // on alerts that are already firing. Snapshotting it at alert creation made
+    // `escalation-policy assign` a no-op for exactly the alert an operator was
+    // trying to route — the one already paging nobody (#481).
     message: text('message').notNull(),
     details: text('details'),
     resolvedAt: integer('resolved_at', { mode: 'timestamp' }),

package/src/hooks/capability-loader.ts

@@ -361,17 +361,6 @@ export async function loadCapabilityFunctions(
       debugLog(`public_web: using firewall natIp ${firewallNatIp} for internal DNS`);
     }
 
-    // Caddy's external (WAN) IP for the D1 public A record (M1 / #328). Caddy
-    // learns it from its own firewall.exposeService at install and persists it
-    // as the `public_ip` hook output (stored as a caddy secret). register_route
-    // points a new hostname's PUBLIC record here, so it's reachable from one
-    // deploy — no per-hostname DNAT (shared :443 ingress).
-    const caddyExternalIp =
-      typeof providerSecrets.public_ip === 'string' ? providerSecrets.public_ip : undefined;
-    if (caddyExternalIp) {
-      debugLog(`public_web: using caddy externalIp ${caddyExternalIp} for public DNS`);
-    }
-
     // Caddy's configured hostnames — public_web rejects routes for any
     // hostname not in this list, throwing a structured error that runs
     // caddy's `managed_hostname` ensure interview. Empty list means
@@ -484,7 +473,6 @@ export async function loadCapabilityFunctions(
         dnsInternal: result.dns_internal as DnsInternalCapability | undefined,
         firewallNatIp,
         dnsRegistrar: result.dns_registrar as DnsRegistrarCapability | undefined,
-        externalIp: caddyExternalIp,
         hostnames: caddyHostnames,
         caddyModuleId: provider.moduleId,
         dnsManagedDomains,

package/src/manifest/schema.ts

@@ -694,7 +694,10 @@ export const ModuleManifestSchema = z
 
     backup: z
       .object({
-        schedule: z.enum(['hourly', 'daily', 'weekly', 'monthly', 'manual']).default('manual'),
+        // Absent means `daily`. Opting out of backups entirely is a real
+        // decision and takes an explicit `manual` — see
+        // [[services/backup-schedule.ts]].
+        schedule: z.enum(['hourly', 'daily', 'weekly', 'monthly', 'manual']).default('daily'),
         retention: z
           .object({
             count: z.number().int().positive().default(7),

package/src/module/packaging/build.ts

@@ -59,6 +59,10 @@ const EXCLUDE_PATTERNS = [
   '.DS_Store',
   '*.netapp',
   '*.test.ts',
+  // Dev-only, same bucket as the tests: scripts/tsconfig.json exists so tsc can
+  // check hooks in CI. Nothing on a target ever runs tsc, and shipping it would
+  // make every module's packaged content change whenever the shared base moves.
+  'tsconfig.json',
   'checksums.json',
   'signature.sig',
 ];

package/src/services/alerting/builtin-source.ts

@@ -12,70 +12,37 @@
  * as "nothing is wrong".
  */
 
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
+import type { DbClient } from '../../db/client';
+import { loadBackupAuditInfo } from '../audit/backup-source';
+import { auditBackups } from '../audit/backups';
 import { auditMachinesReachable } from '../audit/machines-reachable';
-import type { MachineReachableResult } from '../audit/machines-reachable';
 import type { DriftCategory, DriftFinding } from '../audit/types';
-import { listMachines } from '../machine-pool';
-
-const execFileAsync = promisify(execFile);
+import { probeMachines } from '../machine-probe';
 
 /** Categories a monitor can currently schedule. */
-export const SCHEDULABLE_BUILTIN_CHECKS: readonly DriftCategory[] = ['machines_reachable'];
+export const SCHEDULABLE_BUILTIN_CHECKS: readonly DriftCategory[] = [
+  'machines_reachable',
+  'backups',
+];
 
 export function isSchedulableBuiltin(category: string): category is DriftCategory {
   return (SCHEDULABLE_BUILTIN_CHECKS as readonly string[]).includes(category);
 }
 
-/**
- * SSH-probe every pool machine.
- *
- * `BatchMode=yes` prevents a password prompt from hanging the probe forever,
- * and `ConnectTimeout` bounds the wait on an unresponsive host — the exact
- * condition this check exists to detect must not be the one that wedges it.
- */
-async function probeMachines(): Promise<MachineReachableResult[]> {
-  const machines = await listMachines();
-  return Promise.all(
-    machines.map(async (m): Promise<MachineReachableResult> => {
-      try {
-        await execFileAsync(
-          'ssh',
-          [
-            '-o',
-            'BatchMode=yes',
-            '-o',
-            'ConnectTimeout=5',
-            '-o',
-            'StrictHostKeyChecking=no',
-            '-o',
-            'UserKnownHostsFile=/dev/null',
-            `${m.sshUser}@${m.ipAddress}`,
-            'true',
-          ],
-          { timeout: 8000 },
-        );
-        return { id: m.id, hostname: m.hostname, ipAddress: m.ipAddress, reachable: true };
-      } catch (err) {
-        const e = err as { stderr?: string; message?: string };
-        return {
-          id: m.id,
-          hostname: m.hostname,
-          ipAddress: m.ipAddress,
-          reachable: false,
-          message: e.stderr?.trim() || e.message || 'SSH probe failed',
-        };
-      }
-    }),
-  );
-}
-
-export async function runBuiltinCheckForMonitor(category: DriftCategory): Promise<DriftFinding[]> {
+export async function runBuiltinCheckForMonitor(
+  category: DriftCategory,
+  db: DbClient,
+): Promise<DriftFinding[]> {
   if (category === 'machines_reachable') {
     return auditMachinesReachable({ results: await probeMachines() });
   }
 
+  // Local DB reads only — cheap enough to run on every sweep, which is
+  // the whole reason this category is schedulable and most are not.
+  if (category === 'backups') {
+    return auditBackups({ modules: loadBackupAuditInfo(db) });
+  }
+
   throw new Error(
     `Built-in check "${category}" is not schedulable yet. Schedulable: ${SCHEDULABLE_BUILTIN_CHECKS.join(', ')}.`,
   );

package/src/services/alerting/delivery-loop.test.ts

@@ -68,6 +68,11 @@ beforeAll(async () => {
       ...process.env,
       SIGNAL_RPC_PORT: String(PORT),
       SIGNAL_KNOWN_RECIPIENTS: `${PETER},${WIFE}`,
+      // The flag the module's systemd unit must pass. The simulator defaults
+      // to signal-cli's real default (`on-start`), where the daemon drains
+      // replies into its own SSE stream and REFUSES `receive` — so a loop test
+      // may only read replies from a daemon started the way celilo deploys it.
+      SIGNAL_RECEIVE_MODE: 'manual',
     },
     stdout: 'pipe',
     stderr: 'pipe',
@@ -169,7 +174,6 @@ describe('delivery loop against the signal-cli simulator', () => {
       silencedUntil: null,
       escalationStep: 0,
       nextEscalationAt: null,
-      escalationPolicyId: null,
       message: '/var 94% used',
       details: null,
       resolvedAt: null,

package/src/services/alerting/format.test.ts

@@ -34,7 +34,6 @@ function alert(over: Partial<Alert> = {}): Alert {
     silencedUntil: null,
     escalationStep: 0,
     nextEscalationAt: null,
-    escalationPolicyId: null,
     message: '/var 94% used',
     details: null,
     resolvedAt: null,

package/src/services/alerting/inbound-poller.test.ts

@@ -27,7 +27,7 @@ describe('pollInbound', () => {
 
   function deps(messages: InboundMessage[], over: Partial<InboundPollDeps> = {}): InboundPollDeps {
     return {
-      receiveFrom: async () => ({ messages, cursor: 'cursor-1' }),
+      receiveFrom: async () => ({ status: 'received', messages, cursor: 'cursor-1' }),
       readCursor: (t) => cursors.get(t) ?? null,
       writeCursor: (t, c) => {
         cursors.set(t, c);
@@ -190,7 +190,7 @@ describe('pollInbound', () => {
     const delivery = page(peterRoute.id);
     const report = await pollInbound(db, deps([inbound(WIFE, delivery.token)]));
 
-    expect(report.rejected).toBe(1);
+    expect(report.unheard).toEqual([{ senderAddress: WIFE, reason: 'wrong_sender' }]);
     expect(report.acked).toBe(0);
     expect(alertState()).toBe('firing');
   });
@@ -200,7 +200,7 @@ describe('pollInbound', () => {
     const delivery = page(peterRoute.id);
     const report = await pollInbound(db, deps([inbound(STRANGER, delivery.token)]));
 
-    expect(report.ignored).toBe(1);
+    expect(report.unheard).toEqual([{ senderAddress: STRANGER, reason: 'unknown_sender' }]);
     expect(alertState()).toBe('firing');
   });
 
@@ -228,7 +228,7 @@ describe('pollInbound', () => {
     expect(first.acked).toBe(1);
     // The token is spent, so the replay is refused rather than acking again.
     expect(second.acked).toBe(0);
-    expect(second.rejected).toBe(1);
+    expect(second.unheard).toEqual([{ senderAddress: PETER, reason: 'unknown_token' }]);
     expect(alertState()).toBe('acked');
   });
 
@@ -262,31 +262,67 @@ describe('pollInbound', () => {
     });
 
     const report = await pollInbound(db, deps([inbound(PETER, 'ack')]));
-    expect(report.rejected).toBe(1);
+    expect(report.unheard).toEqual([{ senderAddress: PETER, reason: 'ambiguous' }]);
     expect(alertState()).toBe('firing');
   });
 
   // One dead transport must not stop the others being read.
   test('an unreachable transport is skipped without throwing', async () => {
-    const report = await pollInbound(db, deps([], { receiveFrom: async () => null }));
+    const report = await pollInbound(
+      db,
+      deps([], { receiveFrom: async () => ({ status: 'failed', error: 'connection refused' }) }),
+    );
     expect(report.transportsPolled).toBe(1);
     expect(report.messagesRead).toBe(0);
   });
 
+  /**
+   * The regression that cost a week. signal-cli's daemon refused celilo's read
+   * call outright ("Receive command cannot be used if messages are already
+   * being received") and the poller reported the same "0 message(s)" it
+   * reports when nobody has replied. The reason must reach the report, or the
+   * two are indistinguishable from outside.
+   */
+  test('a transport that REFUSES the read says so instead of looking quiet', async () => {
+    const refusal = 'Receive command cannot be used if messages are already being received.';
+    const report = await pollInbound(
+      db,
+      deps([], { receiveFrom: async () => ({ status: 'failed', error: refusal }) }),
+    );
+
+    expect(report.failures).toEqual([{ transportModuleId: 'signal', error: refusal }]);
+    // ...and a genuinely quiet transport must NOT look like a failure.
+    const quiet = await pollInbound(db, deps([]));
+    expect(quiet.failures).toEqual([]);
+    expect(quiet.messagesRead).toBe(0);
+  });
+
+  test('a unidirectional transport is not reported as a failure', async () => {
+    const report = await pollInbound(
+      db,
+      deps([], { receiveFrom: async () => ({ status: 'unidirectional' }) }),
+    );
+    expect(report.failures).toEqual([]);
+    expect(report.transportsPolled).toBe(1);
+  });
+
   test('the cursor is persisted after a successful poll', async () => {
     await pollInbound(db, deps([]));
     expect(cursors.get('signal')).toBe('cursor-1');
   });
 
   test('the cursor is NOT advanced when the transport could not be reached', async () => {
-    await pollInbound(db, deps([], { receiveFrom: async () => null }));
+    await pollInbound(
+      db,
+      deps([], { receiveFrom: async () => ({ status: 'failed', error: 'connection refused' }) }),
+    );
     expect(cursors.get('signal')).toBeUndefined();
   });
 
   test('gibberish is rejected without touching the alert', async () => {
     page(peterRoute.id);
     const report = await pollInbound(db, deps([inbound(PETER, 'what is going on')]));
-    expect(report.rejected).toBe(1);
+    expect(report.unheard).toEqual([{ senderAddress: PETER, reason: 'unrecognised' }]);
     expect(alertState()).toBe('firing');
   });
 

package/src/services/alerting/inbound-poller.ts

@@ -25,12 +25,35 @@ import type { NotificationTransport } from './notifier';
 import { composeAckBroadcastBody } from './notifier';
 import { consumeDelivery } from './tokens';
 
+/**
+ * What one attempt to read a transport produced.
+ *
+ * `unidirectional` and `failed` used to collapse into a bare null, and that
+ * cost a week: a transport whose read call was being REFUSED reported the same
+ * "0 message(s)" as a transport nobody had replied on. An operator could not
+ * tell "my reply never arrived" from "celilo cannot read this transport at
+ * all", and neither could anyone debugging it.
+ */
+export type TransportReceive =
+  | { status: 'received'; messages: InboundMessage[]; cursor: string | null }
+  | { status: 'unidirectional' }
+  | { status: 'failed'; error: string };
+
+/** A transport that could not be read, and why. */
+export interface TransportFailure {
+  transportModuleId: string;
+  error: string;
+}
+
+/** A message that was read but not acted on, and why. */
+export interface UnheardMessage {
+  senderAddress: string;
+  reason: 'unknown_sender' | 'unknown_token' | 'wrong_sender' | 'ambiguous' | 'unrecognised';
+}
+
 export interface InboundPollDeps {
-  /** Receive from one transport module, or null when it cannot be reached. */
-  receiveFrom(
-    transportModuleId: string,
-    cursor: string | null,
-  ): Promise<{ messages: InboundMessage[]; cursor: string | null } | null>;
+  /** Receive from one transport module. */
+  receiveFrom(transportModuleId: string, cursor: string | null): Promise<TransportReceive>;
   /** Persisted receive cursor per transport. */
   readCursor(transportModuleId: string): string | null;
   writeCursor(transportModuleId: string, cursor: string | null): void;
@@ -53,12 +76,14 @@ export interface InboundPollReport {
   transportsPolled: number;
   messagesRead: number;
   acked: number;
-  ignored: number;
-  rejected: number;
   /** Routes told that someone else took the alert. */
   broadcast: number;
   /** Deploy questions answered from a phone. */
   answered: number;
+  /** Transports that could not be read at all. Never silent — see above. */
+  failures: TransportFailure[];
+  /** Messages read and then discarded, with the reason each was discarded. */
+  unheard: UnheardMessage[];
 }
 
 /** Transports that have at least one route pointing at them. */
@@ -89,19 +114,24 @@ export async function pollInbound(db: DbClient, deps: InboundPollDeps): Promise<
     transportsPolled: 0,
     messagesRead: 0,
     acked: 0,
-    ignored: 0,
-    rejected: 0,
     broadcast: 0,
     answered: 0,
+    failures: [],
+    unheard: [],
   };
 
   for (const transportId of transportsWithRoutes(db)) {
     const received = await deps.receiveFrom(transportId, deps.readCursor(transportId));
     report.transportsPolled++;
-    // A transport that cannot be reached is not an error here — its own
-    // health check is what reports that, and one dead transport must not stop
-    // the others from being read.
-    if (!received) continue;
+    // One dead transport must not stop the others being read — but it is
+    // RECORDED rather than skipped in silence, because "cannot read" and
+    // "nothing to read" are the two things an operator most needs to tell
+    // apart at 3am.
+    if (received.status === 'failed') {
+      report.failures.push({ transportModuleId: transportId, error: received.error });
+      continue;
+    }
+    if (received.status === 'unidirectional') continue;
 
     for (const message of received.messages) {
       report.messagesRead++;
@@ -113,12 +143,8 @@ export async function pollInbound(db: DbClient, deps: InboundPollDeps): Promise<
         outstandingForRoute: (routeId) => outstandingAlertDeliveries(db, routeId, deps.now()),
       });
 
-      if (outcome.action === 'ignored') {
-        report.ignored++;
-        continue;
-      }
-      if (outcome.action === 'rejected') {
-        report.rejected++;
+      if (outcome.action === 'ignored' || outcome.action === 'rejected') {
+        report.unheard.push({ senderAddress: message.senderAddress, reason: outcome.reason });
         continue;
       }
 
@@ -127,7 +153,7 @@ export async function pollInbound(db: DbClient, deps: InboundPollDeps): Promise<
       if (outcome.delivery.kind === 'interview') {
         const value = parseInterviewAnswer(message.body, outcome.delivery.token);
         if (!value || !deps.answerInterview) {
-          report.rejected++;
+          report.unheard.push({ senderAddress: message.senderAddress, reason: 'unrecognised' });
           continue;
         }
         consumeDelivery(db, outcome.delivery.id, deps.now());
@@ -213,12 +239,23 @@ function outstandingAlertDeliveries(db: DbClient, routeId: string, now: Date) {
  *
  * A transport with no `receive` is unidirectional — that is not an error, it
  * just means replies cannot arrive, which the route's `can_ack` already
- * records.
+ * records. Anything else going wrong IS an error and is returned as one.
+ *
+ * This used to be a bare `catch {}` returning null, on the reasoning that the
+ * transport's own health check would report an unreachable daemon. That was
+ * wrong twice over: a health check that only proves the daemon answers cannot
+ * see a read call being REFUSED by a daemon that is otherwise perfectly
+ * healthy, and the swallowed error was the only place the reason existed. The
+ * live signal-cli case was exactly that shape — `receive` refused with
+ * "Receive command cannot be used if messages are already being received."
+ * while every health check passed and every poll reported zero messages.
  */
 export function makeReceiver(db: DbClient) {
-  return async (transportModuleId: string, cursor: string | null) => {
+  return async (transportModuleId: string, cursor: string | null): Promise<TransportReceive> => {
     const module = db.select().from(modules).where(eq(modules.id, transportModuleId)).get();
-    if (!module) return null;
+    if (!module) {
+      return { status: 'failed', error: `no module '${transportModuleId}' is installed` };
+    }
 
     try {
       const { logger } = createCapturingLogger();
@@ -226,11 +263,11 @@ export function makeReceiver(db: DbClient) {
       const notification = (capabilities as Record<string, unknown>).notification as
         | NotificationCapability
         | undefined;
-      if (!notification?.receive) return null;
-      return await notification.receive(cursor);
-    } catch {
-      // Unreachable transport: the transport's own health check reports it.
-      return null;
+      if (!notification?.receive) return { status: 'unidirectional' };
+      const result = await notification.receive(cursor);
+      return { status: 'received', messages: result.messages, cursor: result.cursor };
+    } catch (error) {
+      return { status: 'failed', error: error instanceof Error ? error.message : String(error) };
     }
   };
 }

package/src/services/alerting/notify-deps.ts

@@ -0,0 +1,113 @@
+/**
+ * Resolving an alert to the people it should page.
+ *
+ * The escalation policy is a property of the MONITOR, and it is read here on
+ * every sweep rather than copied onto the alert when the alert is created.
+ * That ordering is the whole point: an operator only reaches for
+ * `escalation-policy assign` once something is already firing and reaching
+ * nobody, so a policy that only applied to alerts created afterwards would be
+ * a no-op for the one alert they were trying to fix (#481).
+ *
+ * The cost of resolving late is that a policy edited mid-escalation changes
+ * where the remaining steps go. That is the behaviour an operator asks for
+ * when they edit it — the alert's own progress through the chain
+ * (`escalationStep`, `nextEscalationAt`) is what stays on the alert.
+ *
+ * Lives here rather than in the sweep command so the sweep's tests can drive
+ * the real resolution instead of a fake, which is how the snapshot bug
+ * survived: every existing test stubbed `notifyDepsFor`.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { type Alert, type EscalationPolicy, escalationPolicies, monitors } from '../../db/schema';
+import type { NotifyDeps } from './notifier';
+import { listPeople, listPolicySteps, listRoutes } from './people';
+import { mintDelivery } from './tokens';
+import { loadNotificationTransport } from './transport-loader';
+
+/**
+ * How long a reply token stays valid. A day is long enough that someone who
+ * sees a page overnight can still act on it in the morning, and short enough
+ * that a token found later is useless.
+ */
+const TOKEN_TTL_MS = 24 * 60 * 60_000;
+
+/**
+ * The escalation policy an alert resolves to right now, or null.
+ *
+ * The single answer to "who would this page", shared by the sweep and by every
+ * command that has to show it. Two readers computing it separately is how a
+ * CLI ends up confidently reporting a policy the sweep does not use.
+ */
+export function policyForAlert(
+  db: DbClient,
+  alert: Pick<Alert, 'monitorId'>,
+): EscalationPolicy | null {
+  const monitor = db.select().from(monitors).where(eq(monitors.id, alert.monitorId)).get();
+  if (!monitor?.escalationPolicyId) return null;
+  return (
+    db
+      .select()
+      .from(escalationPolicies)
+      .where(eq(escalationPolicies.id, monitor.escalationPolicyId))
+      .get() ?? null
+  );
+}
+
+/**
+ * Assemble everything needed to page for one alert, or null when nobody can be.
+ *
+ * Returning null rather than an empty policy is deliberate: "no escalation
+ * policy assigned" and "policy exists but nobody is eligible" are different
+ * situations, and only the second is worth an escalation decision.
+ */
+export function buildNotifyDeps(db: DbClient, alert: Alert, now: Date): NotifyDeps | null {
+  const policy = policyForAlert(db, alert);
+  if (!policy) return null;
+
+  const steps = listPolicySteps(db, policy.id).map((step) => ({
+    stepIndex: step.stepIndex,
+    routeId: step.routeId,
+    delayMinutes: step.delayMinutes,
+  }));
+  if (steps.length === 0) return null;
+
+  const routeRows = listRoutes(db);
+  const people = listPeople(db);
+
+  return {
+    steps,
+    routes: new Map(
+      routeRows.map((r) => [
+        r.id,
+        { id: r.id, severityFloor: r.severityFloor, enabled: r.enabled },
+      ]),
+    ),
+    routeDetails: new Map(routeRows.map((r) => [r.id, r])),
+    quietHoursByPerson: new Map(
+      people
+        .filter((p) => p.quietHoursStart && p.quietHoursEnd)
+        .map((p) => [
+          p.id,
+          {
+            personId: p.id,
+            start: p.quietHoursStart,
+            end: p.quietHoursEnd,
+            timezone: p.timezone,
+          },
+        ]),
+    ),
+    bypassQuietHours: policy.bypassQuietHours,
+    transportFor: (route) => loadNotificationTransport(db, route.transportModuleId),
+    mintToken: (alertId, routeId) =>
+      mintDelivery(db, {
+        kind: 'alert',
+        targetId: alertId,
+        routeId,
+        now,
+        ttlMs: TOKEN_TTL_MS,
+      }).token,
+    now,
+  };
+}

package/src/services/alerting/run-monitor.ts

@@ -151,7 +151,6 @@ export async function runOneMonitor(
 
   const { createdIds, resolvedIds } = applyReconcileActions(db, actions, {
     monitorId: monitor.id,
-    escalationPolicyId: monitor.escalationPolicyId,
     now,
   });
 

package/src/services/alerting/store.test.ts

@@ -27,7 +27,7 @@ describe('alert store', () => {
   let dir: string;
   let db: DbClient;
 
-  const context = { monitorId: MONITOR, escalationPolicyId: null, now: NOW };
+  const context = { monitorId: MONITOR, now: NOW };
 
   const create = (key: string): ReconcileAction => ({
     type: 'create',

package/src/services/alerting/store.ts

@@ -28,7 +28,6 @@ export function loadLiveAlerts(db: DbClient, monitorId: string): LiveAlert[] {
 
 export interface ApplyContext {
   monitorId: string;
-  escalationPolicyId: string | null;
   now: Date;
 }
 
@@ -66,7 +65,6 @@ export function applyReconcileActions(
           lastSeenAt: context.now,
           graceUntil: action.graceUntil,
           escalationStep: 0,
-          escalationPolicyId: context.escalationPolicyId,
           message: action.message,
           details: action.details,
         })

package/src/services/alerting/sweep-runner.test.ts

@@ -238,7 +238,16 @@ describe('runSweep', () => {
 
       expect(liveAlerts()).toHaveLength(1);
       expect(report.notified).toBe(0);
-      expect(report.noPolicy).toBe(1);
+      expect(report.noPolicy).toEqual([{ alertKey: PORT_CHECK, monitor: MODULE }]);
+    });
+
+    // A count told the operator something was unroutable but not WHICH thing,
+    // so the remedy printed next to it could not be aimed anywhere (#481).
+    test('the unroutable alert is named, along with the monitor to assign to', async () => {
+      const report = await runSweep(db, currentMonitors(), deps());
+
+      expect(report.noPolicy[0].alertKey).toBe(PORT_CHECK);
+      expect(report.noPolicy[0].monitor).toBe(MODULE);
     });
 
     test('escalation declining to notify records WHICH reason', async () => {
@@ -270,7 +279,7 @@ describe('runSweep', () => {
       );
 
       expect(report.notified).toBe(0);
-      expect(report.noPolicy).toBe(0);
+      expect(report.noPolicy).toEqual([]);
       expect(report.skipped.within_grace).toBe(1);
     });