@celilo/cli 0.14.4 → 0.15.0

package/src/services/alerting/format.test.ts

@@ -34,7 +34,6 @@ function alert(over: Partial<Alert> = {}): Alert {
     silencedUntil: null,
     escalationStep: 0,
     nextEscalationAt: null,
-    escalationPolicyId: null,
     message: '/var 94% used',
     details: null,
     resolvedAt: null,

package/src/services/alerting/inbound-poller.test.ts

@@ -27,7 +27,7 @@ describe('pollInbound', () => {
 
   function deps(messages: InboundMessage[], over: Partial<InboundPollDeps> = {}): InboundPollDeps {
     return {
-      receiveFrom: async () => ({ messages, cursor: 'cursor-1' }),
+      receiveFrom: async () => ({ status: 'received', messages, cursor: 'cursor-1' }),
       readCursor: (t) => cursors.get(t) ?? null,
       writeCursor: (t, c) => {
         cursors.set(t, c);
@@ -190,7 +190,7 @@ describe('pollInbound', () => {
     const delivery = page(peterRoute.id);
     const report = await pollInbound(db, deps([inbound(WIFE, delivery.token)]));
 
-    expect(report.rejected).toBe(1);
+    expect(report.unheard).toEqual([{ senderAddress: WIFE, reason: 'wrong_sender' }]);
     expect(report.acked).toBe(0);
     expect(alertState()).toBe('firing');
   });
@@ -200,7 +200,7 @@ describe('pollInbound', () => {
     const delivery = page(peterRoute.id);
     const report = await pollInbound(db, deps([inbound(STRANGER, delivery.token)]));
 
-    expect(report.ignored).toBe(1);
+    expect(report.unheard).toEqual([{ senderAddress: STRANGER, reason: 'unknown_sender' }]);
     expect(alertState()).toBe('firing');
   });
 
@@ -228,7 +228,7 @@ describe('pollInbound', () => {
     expect(first.acked).toBe(1);
     // The token is spent, so the replay is refused rather than acking again.
     expect(second.acked).toBe(0);
-    expect(second.rejected).toBe(1);
+    expect(second.unheard).toEqual([{ senderAddress: PETER, reason: 'unknown_token' }]);
     expect(alertState()).toBe('acked');
   });
 
@@ -262,31 +262,67 @@ describe('pollInbound', () => {
     });
 
     const report = await pollInbound(db, deps([inbound(PETER, 'ack')]));
-    expect(report.rejected).toBe(1);
+    expect(report.unheard).toEqual([{ senderAddress: PETER, reason: 'ambiguous' }]);
     expect(alertState()).toBe('firing');
   });
 
   // One dead transport must not stop the others being read.
   test('an unreachable transport is skipped without throwing', async () => {
-    const report = await pollInbound(db, deps([], { receiveFrom: async () => null }));
+    const report = await pollInbound(
+      db,
+      deps([], { receiveFrom: async () => ({ status: 'failed', error: 'connection refused' }) }),
+    );
     expect(report.transportsPolled).toBe(1);
     expect(report.messagesRead).toBe(0);
   });
 
+  /**
+   * The regression that cost a week. signal-cli's daemon refused celilo's read
+   * call outright ("Receive command cannot be used if messages are already
+   * being received") and the poller reported the same "0 message(s)" it
+   * reports when nobody has replied. The reason must reach the report, or the
+   * two are indistinguishable from outside.
+   */
+  test('a transport that REFUSES the read says so instead of looking quiet', async () => {
+    const refusal = 'Receive command cannot be used if messages are already being received.';
+    const report = await pollInbound(
+      db,
+      deps([], { receiveFrom: async () => ({ status: 'failed', error: refusal }) }),
+    );
+
+    expect(report.failures).toEqual([{ transportModuleId: 'signal', error: refusal }]);
+    // ...and a genuinely quiet transport must NOT look like a failure.
+    const quiet = await pollInbound(db, deps([]));
+    expect(quiet.failures).toEqual([]);
+    expect(quiet.messagesRead).toBe(0);
+  });
+
+  test('a unidirectional transport is not reported as a failure', async () => {
+    const report = await pollInbound(
+      db,
+      deps([], { receiveFrom: async () => ({ status: 'unidirectional' }) }),
+    );
+    expect(report.failures).toEqual([]);
+    expect(report.transportsPolled).toBe(1);
+  });
+
   test('the cursor is persisted after a successful poll', async () => {
     await pollInbound(db, deps([]));
     expect(cursors.get('signal')).toBe('cursor-1');
   });
 
   test('the cursor is NOT advanced when the transport could not be reached', async () => {
-    await pollInbound(db, deps([], { receiveFrom: async () => null }));
+    await pollInbound(
+      db,
+      deps([], { receiveFrom: async () => ({ status: 'failed', error: 'connection refused' }) }),
+    );
     expect(cursors.get('signal')).toBeUndefined();
   });
 
   test('gibberish is rejected without touching the alert', async () => {
     page(peterRoute.id);
     const report = await pollInbound(db, deps([inbound(PETER, 'what is going on')]));
-    expect(report.rejected).toBe(1);
+    expect(report.unheard).toEqual([{ senderAddress: PETER, reason: 'unrecognised' }]);
     expect(alertState()).toBe('firing');
   });
 

package/src/services/alerting/inbound-poller.ts

@@ -25,12 +25,35 @@ import type { NotificationTransport } from './notifier';
 import { composeAckBroadcastBody } from './notifier';
 import { consumeDelivery } from './tokens';
 
+/**
+ * What one attempt to read a transport produced.
+ *
+ * `unidirectional` and `failed` used to collapse into a bare null, and that
+ * cost a week: a transport whose read call was being REFUSED reported the same
+ * "0 message(s)" as a transport nobody had replied on. An operator could not
+ * tell "my reply never arrived" from "celilo cannot read this transport at
+ * all", and neither could anyone debugging it.
+ */
+export type TransportReceive =
+  | { status: 'received'; messages: InboundMessage[]; cursor: string | null }
+  | { status: 'unidirectional' }
+  | { status: 'failed'; error: string };
+
+/** A transport that could not be read, and why. */
+export interface TransportFailure {
+  transportModuleId: string;
+  error: string;
+}
+
+/** A message that was read but not acted on, and why. */
+export interface UnheardMessage {
+  senderAddress: string;
+  reason: 'unknown_sender' | 'unknown_token' | 'wrong_sender' | 'ambiguous' | 'unrecognised';
+}
+
 export interface InboundPollDeps {
-  /** Receive from one transport module, or null when it cannot be reached. */
-  receiveFrom(
-    transportModuleId: string,
-    cursor: string | null,
-  ): Promise<{ messages: InboundMessage[]; cursor: string | null } | null>;
+  /** Receive from one transport module. */
+  receiveFrom(transportModuleId: string, cursor: string | null): Promise<TransportReceive>;
   /** Persisted receive cursor per transport. */
   readCursor(transportModuleId: string): string | null;
   writeCursor(transportModuleId: string, cursor: string | null): void;
@@ -53,12 +76,14 @@ export interface InboundPollReport {
   transportsPolled: number;
   messagesRead: number;
   acked: number;
-  ignored: number;
-  rejected: number;
   /** Routes told that someone else took the alert. */
   broadcast: number;
   /** Deploy questions answered from a phone. */
   answered: number;
+  /** Transports that could not be read at all. Never silent — see above. */
+  failures: TransportFailure[];
+  /** Messages read and then discarded, with the reason each was discarded. */
+  unheard: UnheardMessage[];
 }
 
 /** Transports that have at least one route pointing at them. */
@@ -89,19 +114,24 @@ export async function pollInbound(db: DbClient, deps: InboundPollDeps): Promise<
     transportsPolled: 0,
     messagesRead: 0,
     acked: 0,
-    ignored: 0,
-    rejected: 0,
     broadcast: 0,
     answered: 0,
+    failures: [],
+    unheard: [],
   };
 
   for (const transportId of transportsWithRoutes(db)) {
     const received = await deps.receiveFrom(transportId, deps.readCursor(transportId));
     report.transportsPolled++;
-    // A transport that cannot be reached is not an error here — its own
-    // health check is what reports that, and one dead transport must not stop
-    // the others from being read.
-    if (!received) continue;
+    // One dead transport must not stop the others being read — but it is
+    // RECORDED rather than skipped in silence, because "cannot read" and
+    // "nothing to read" are the two things an operator most needs to tell
+    // apart at 3am.
+    if (received.status === 'failed') {
+      report.failures.push({ transportModuleId: transportId, error: received.error });
+      continue;
+    }
+    if (received.status === 'unidirectional') continue;
 
     for (const message of received.messages) {
       report.messagesRead++;
@@ -113,12 +143,8 @@ export async function pollInbound(db: DbClient, deps: InboundPollDeps): Promise<
         outstandingForRoute: (routeId) => outstandingAlertDeliveries(db, routeId, deps.now()),
       });
 
-      if (outcome.action === 'ignored') {
-        report.ignored++;
-        continue;
-      }
-      if (outcome.action === 'rejected') {
-        report.rejected++;
+      if (outcome.action === 'ignored' || outcome.action === 'rejected') {
+        report.unheard.push({ senderAddress: message.senderAddress, reason: outcome.reason });
         continue;
       }
 
@@ -127,7 +153,7 @@ export async function pollInbound(db: DbClient, deps: InboundPollDeps): Promise<
       if (outcome.delivery.kind === 'interview') {
         const value = parseInterviewAnswer(message.body, outcome.delivery.token);
         if (!value || !deps.answerInterview) {
-          report.rejected++;
+          report.unheard.push({ senderAddress: message.senderAddress, reason: 'unrecognised' });
           continue;
         }
         consumeDelivery(db, outcome.delivery.id, deps.now());
@@ -213,12 +239,23 @@ function outstandingAlertDeliveries(db: DbClient, routeId: string, now: Date) {
  *
  * A transport with no `receive` is unidirectional — that is not an error, it
  * just means replies cannot arrive, which the route's `can_ack` already
- * records.
+ * records. Anything else going wrong IS an error and is returned as one.
+ *
+ * This used to be a bare `catch {}` returning null, on the reasoning that the
+ * transport's own health check would report an unreachable daemon. That was
+ * wrong twice over: a health check that only proves the daemon answers cannot
+ * see a read call being REFUSED by a daemon that is otherwise perfectly
+ * healthy, and the swallowed error was the only place the reason existed. The
+ * live signal-cli case was exactly that shape — `receive` refused with
+ * "Receive command cannot be used if messages are already being received."
+ * while every health check passed and every poll reported zero messages.
  */
 export function makeReceiver(db: DbClient) {
-  return async (transportModuleId: string, cursor: string | null) => {
+  return async (transportModuleId: string, cursor: string | null): Promise<TransportReceive> => {
     const module = db.select().from(modules).where(eq(modules.id, transportModuleId)).get();
-    if (!module) return null;
+    if (!module) {
+      return { status: 'failed', error: `no module '${transportModuleId}' is installed` };
+    }
 
     try {
       const { logger } = createCapturingLogger();
@@ -226,11 +263,11 @@ export function makeReceiver(db: DbClient) {
       const notification = (capabilities as Record<string, unknown>).notification as
         | NotificationCapability
         | undefined;
-      if (!notification?.receive) return null;
-      return await notification.receive(cursor);
-    } catch {
-      // Unreachable transport: the transport's own health check reports it.
-      return null;
+      if (!notification?.receive) return { status: 'unidirectional' };
+      const result = await notification.receive(cursor);
+      return { status: 'received', messages: result.messages, cursor: result.cursor };
+    } catch (error) {
+      return { status: 'failed', error: error instanceof Error ? error.message : String(error) };
     }
   };
 }

package/src/services/alerting/notify-deps.ts

@@ -0,0 +1,113 @@
+/**
+ * Resolving an alert to the people it should page.
+ *
+ * The escalation policy is a property of the MONITOR, and it is read here on
+ * every sweep rather than copied onto the alert when the alert is created.
+ * That ordering is the whole point: an operator only reaches for
+ * `escalation-policy assign` once something is already firing and reaching
+ * nobody, so a policy that only applied to alerts created afterwards would be
+ * a no-op for the one alert they were trying to fix (#481).
+ *
+ * The cost of resolving late is that a policy edited mid-escalation changes
+ * where the remaining steps go. That is the behaviour an operator asks for
+ * when they edit it — the alert's own progress through the chain
+ * (`escalationStep`, `nextEscalationAt`) is what stays on the alert.
+ *
+ * Lives here rather than in the sweep command so the sweep's tests can drive
+ * the real resolution instead of a fake, which is how the snapshot bug
+ * survived: every existing test stubbed `notifyDepsFor`.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { type Alert, type EscalationPolicy, escalationPolicies, monitors } from '../../db/schema';
+import type { NotifyDeps } from './notifier';
+import { listPeople, listPolicySteps, listRoutes } from './people';
+import { mintDelivery } from './tokens';
+import { loadNotificationTransport } from './transport-loader';
+
+/**
+ * How long a reply token stays valid. A day is long enough that someone who
+ * sees a page overnight can still act on it in the morning, and short enough
+ * that a token found later is useless.
+ */
+const TOKEN_TTL_MS = 24 * 60 * 60_000;
+
+/**
+ * The escalation policy an alert resolves to right now, or null.
+ *
+ * The single answer to "who would this page", shared by the sweep and by every
+ * command that has to show it. Two readers computing it separately is how a
+ * CLI ends up confidently reporting a policy the sweep does not use.
+ */
+export function policyForAlert(
+  db: DbClient,
+  alert: Pick<Alert, 'monitorId'>,
+): EscalationPolicy | null {
+  const monitor = db.select().from(monitors).where(eq(monitors.id, alert.monitorId)).get();
+  if (!monitor?.escalationPolicyId) return null;
+  return (
+    db
+      .select()
+      .from(escalationPolicies)
+      .where(eq(escalationPolicies.id, monitor.escalationPolicyId))
+      .get() ?? null
+  );
+}
+
+/**
+ * Assemble everything needed to page for one alert, or null when nobody can be.
+ *
+ * Returning null rather than an empty policy is deliberate: "no escalation
+ * policy assigned" and "policy exists but nobody is eligible" are different
+ * situations, and only the second is worth an escalation decision.
+ */
+export function buildNotifyDeps(db: DbClient, alert: Alert, now: Date): NotifyDeps | null {
+  const policy = policyForAlert(db, alert);
+  if (!policy) return null;
+
+  const steps = listPolicySteps(db, policy.id).map((step) => ({
+    stepIndex: step.stepIndex,
+    routeId: step.routeId,
+    delayMinutes: step.delayMinutes,
+  }));
+  if (steps.length === 0) return null;
+
+  const routeRows = listRoutes(db);
+  const people = listPeople(db);
+
+  return {
+    steps,
+    routes: new Map(
+      routeRows.map((r) => [
+        r.id,
+        { id: r.id, severityFloor: r.severityFloor, enabled: r.enabled },
+      ]),
+    ),
+    routeDetails: new Map(routeRows.map((r) => [r.id, r])),
+    quietHoursByPerson: new Map(
+      people
+        .filter((p) => p.quietHoursStart && p.quietHoursEnd)
+        .map((p) => [
+          p.id,
+          {
+            personId: p.id,
+            start: p.quietHoursStart,
+            end: p.quietHoursEnd,
+            timezone: p.timezone,
+          },
+        ]),
+    ),
+    bypassQuietHours: policy.bypassQuietHours,
+    transportFor: (route) => loadNotificationTransport(db, route.transportModuleId),
+    mintToken: (alertId, routeId) =>
+      mintDelivery(db, {
+        kind: 'alert',
+        targetId: alertId,
+        routeId,
+        now,
+        ttlMs: TOKEN_TTL_MS,
+      }).token,
+    now,
+  };
+}

package/src/services/alerting/run-monitor.ts

@@ -151,7 +151,6 @@ export async function runOneMonitor(
 
   const { createdIds, resolvedIds } = applyReconcileActions(db, actions, {
     monitorId: monitor.id,
-    escalationPolicyId: monitor.escalationPolicyId,
     now,
   });
 

package/src/services/alerting/store.test.ts

@@ -27,7 +27,7 @@ describe('alert store', () => {
   let dir: string;
   let db: DbClient;
 
-  const context = { monitorId: MONITOR, escalationPolicyId: null, now: NOW };
+  const context = { monitorId: MONITOR, now: NOW };
 
   const create = (key: string): ReconcileAction => ({
     type: 'create',

package/src/services/alerting/store.ts

@@ -28,7 +28,6 @@ export function loadLiveAlerts(db: DbClient, monitorId: string): LiveAlert[] {
 
 export interface ApplyContext {
   monitorId: string;
-  escalationPolicyId: string | null;
   now: Date;
 }
 
@@ -66,7 +65,6 @@ export function applyReconcileActions(
           lastSeenAt: context.now,
           graceUntil: action.graceUntil,
           escalationStep: 0,
-          escalationPolicyId: context.escalationPolicyId,
           message: action.message,
           details: action.details,
         })

package/src/services/alerting/sweep-runner.test.ts

@@ -238,7 +238,16 @@ describe('runSweep', () => {
 
       expect(liveAlerts()).toHaveLength(1);
       expect(report.notified).toBe(0);
-      expect(report.noPolicy).toBe(1);
+      expect(report.noPolicy).toEqual([{ alertKey: PORT_CHECK, monitor: MODULE }]);
+    });
+
+    // A count told the operator something was unroutable but not WHICH thing,
+    // so the remedy printed next to it could not be aimed anywhere (#481).
+    test('the unroutable alert is named, along with the monitor to assign to', async () => {
+      const report = await runSweep(db, currentMonitors(), deps());
+
+      expect(report.noPolicy[0].alertKey).toBe(PORT_CHECK);
+      expect(report.noPolicy[0].monitor).toBe(MODULE);
     });
 
     test('escalation declining to notify records WHICH reason', async () => {
@@ -270,7 +279,7 @@ describe('runSweep', () => {
       );
 
       expect(report.notified).toBe(0);
-      expect(report.noPolicy).toBe(0);
+      expect(report.noPolicy).toEqual([]);
       expect(report.skipped.within_grace).toBe(1);
     });
 

package/src/services/alerting/sweep-runner.ts

@@ -63,13 +63,16 @@ export interface SweepReport {
   failed: number;
   /**
    * Live alerts nobody is configured to be told about — no escalation policy on
-   * the monitor, so `notifyDepsFor` returns null.
+   * the monitor, so `notifyDepsFor` returns null. Each carries the monitor that
+   * owns it, which is the thing an operator has to assign a policy TO.
    *
-   * Counted rather than skipped in silence: "nothing needed sending" and "an
-   * alert is firing and no policy points at anyone" are opposite situations that
-   * previously rendered identically as `0 notified`.
+   * Identified rather than merely counted: `1 no-policy` told an operator that
+   * something was unreachable but not WHICH thing, so the remedy the sweep
+   * printed alongside it could not be aimed at anything. Assigning the policy to
+   * all eighteen monitors then changed nothing observable (#481). A bare count
+   * is only half a step better than the silence it replaced.
    */
-  noPolicy: number;
+  noPolicy: { alertKey: string; monitor: string }[];
   /**
    * Deliveries escalation declined, keyed by its reason (`within_grace`,
    * `no_eligible_route`, …).
@@ -113,7 +116,7 @@ export async function runSweep(
     deferred: 0,
     deferredDelivered: 0,
     failed: 0,
-    noPolicy: 0,
+    noPolicy: [],
     skipped: {},
     failures: [],
   };
@@ -206,10 +209,14 @@ export async function runSweep(
   }
 
   // 5. Notify. Re-read: the steps above changed state under us.
+  const monitorTargets = new Map(monitors.map((m) => [m.id, m.target]));
   for (const alert of loadAllLiveAlerts(db)) {
     const notifyDeps = deps.notifyDepsFor(alert);
     if (!notifyDeps) {
-      report.noPolicy++;
+      report.noPolicy.push({
+        alertKey: alert.key,
+        monitor: monitorTargets.get(alert.monitorId) ?? '(unknown monitor)',
+      });
       continue;
     }
 

package/src/services/audit/backup-source.ts

@@ -0,0 +1,54 @@
+/**
+ * Reading the roster the backup-freshness check runs against.
+ *
+ * Split out from the check itself so the decision — is this backup too
+ * old — stays pure, while the queries that feed it live here (Rule 2.3).
+ * Shared by `celilo system audit` and by the scheduled `backups` monitor,
+ * so both judge the same fleet from the same data.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { backups, modules } from '../../db/schema';
+import type { ModuleManifest } from '../../manifest/schema';
+import type { InstalledModuleBackupInfo } from './backups';
+
+const DEPLOYED_STATES = ['INSTALLED', 'VERIFIED'];
+
+/**
+ * Most recent COMPLETED backup per module, in epoch ms.
+ *
+ * The `backups` table is added via inline ALTER statements in
+ * db/client.ts for upgraded databases, so a freshly-initialized DB built
+ * from the drizzle journal alone may not have it yet. Absence means "no
+ * backups recorded", never a crashed audit.
+ */
+function latestSuccessfulBackupByModule(db: DbClient): Map<string, number> {
+  const latest = new Map<string, number>();
+  try {
+    for (const backup of db.select().from(backups).where(eq(backups.status, 'completed')).all()) {
+      if (!backup.moduleId || !backup.completedAt) continue;
+      const at = backup.completedAt.getTime();
+      const previous = latest.get(backup.moduleId);
+      if (previous === undefined || at > previous) latest.set(backup.moduleId, at);
+    }
+  } catch {
+    // Table missing — leave the map empty.
+  }
+  return latest;
+}
+
+export function loadBackupAuditInfo(db: DbClient): InstalledModuleBackupInfo[] {
+  const latest = latestSuccessfulBackupByModule(db);
+  return db
+    .select()
+    .from(modules)
+    .all()
+    .filter((module) => DEPLOYED_STATES.includes(module.state))
+    .map((module) => ({
+      id: module.id,
+      state: module.state,
+      manifest: module.manifestData as ModuleManifest,
+      lastSuccessfulBackupAt: latest.get(module.id) ?? null,
+    }));
+}

package/src/services/audit/backups.test.ts

@@ -75,7 +75,10 @@ describe('auditBackups', () => {
     expect(result).toEqual([]);
   });
 
-  test('no schedule declared → treated as manual (no stale flag)', async () => {
+  // Silence-by-default is the bug: an undeclared cadence is how celilo-mgmt
+  // went 55 days without a backup and nobody was told. Opting out takes an
+  // explicit `manual` — see services/backup-schedule.ts.
+  test('no schedule declared → daily, so a year-old backup is stale', async () => {
     const result = await auditBackups({
       modules: [
         makeModule('lunacycle', {
@@ -85,7 +88,9 @@ describe('auditBackups', () => {
       ],
       now: () => NOW,
     });
-    expect(result).toEqual([]);
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({ code: 'backup_stale', subject: 'lunacycle' });
+    expect(result[0].message).toContain('daily');
   });
 
   test('daily schedule: 26h-old is stale', async () => {

package/src/services/audit/backups.ts

@@ -8,14 +8,17 @@
  * scheduled run doesn't flag drift on every audit.
  *
  * Modules without an `on_backup` hook are skipped — there's nothing
- * to back up. Modules whose schedule is `manual` (or unset) skip the
- * staleness check (the user decides cadence) but still get a
- * `backup_missing` finding if no backup has ever been recorded.
+ * to back up. Modules whose schedule is explicitly `manual` skip the
+ * staleness check (the operator decides cadence) but still get a
+ * `backup_missing` finding if no backup has ever been recorded. An
+ * unset schedule is `daily`, not `manual` — see
+ * [[services/backup-schedule.ts]] for why that default matters.
  *
  * Time is injected so tests can pin "now" deterministically.
  */
 
 import type { ModuleManifest } from '../../manifest/schema';
+import { effectiveBackupSchedule } from '../backup-schedule';
 import type { DriftFinding } from './types';
 
 export interface InstalledModuleBackupInfo {
@@ -50,10 +53,7 @@ const DAY = 24 * HOUR;
  * - daily   → 25h  (24h + 1h grace)
  * - weekly  → 8d   (7d + 1d grace)
  * - monthly → 32d  (~30d + 2d grace)
- * - manual  → null (no staleness check; user-driven cadence)
- *
- * `undefined` (no `backup:` block in manifest) is treated as
- * `manual` — author opted out of declaring a cadence.
+ * - manual  → null (no staleness check; operator-driven cadence)
  */
 const SCHEDULE_THRESHOLDS = {
   hourly: 2 * HOUR,
@@ -63,21 +63,13 @@ const SCHEDULE_THRESHOLDS = {
   manual: null,
 } as const;
 
-type ScheduleKey = keyof typeof SCHEDULE_THRESHOLDS;
-
 function moduleHasBackupHook(manifest: ModuleManifest): boolean {
   return Boolean(manifest.hooks?.on_backup);
 }
 
-function scheduleFor(manifest: ModuleManifest): ScheduleKey {
-  const s = manifest.backup?.schedule;
-  if (s === 'hourly' || s === 'daily' || s === 'weekly' || s === 'monthly') return s;
-  return 'manual';
-}
-
 function thresholdFor(manifest: ModuleManifest, override: number | undefined): number | null {
   if (override !== undefined) return override;
-  return SCHEDULE_THRESHOLDS[scheduleFor(manifest)];
+  return SCHEDULE_THRESHOLDS[effectiveBackupSchedule(manifest)];
 }
 
 function formatAge(ms: number): string {
@@ -109,7 +101,7 @@ export async function auditBackups(deps: BackupsAuditDeps): Promise<DriftFinding
         category: 'backups',
         severity: 'drift',
         code: 'backup_missing',
-        message: `${m.id}: no successful backup recorded (schedule: ${scheduleFor(m.manifest)})`,
+        message: `${m.id}: no successful backup recorded (schedule: ${effectiveBackupSchedule(m.manifest)})`,
         remediation: `celilo backup create ${m.id} --force`,
         actionable: true,
         subject: m.id,
@@ -126,7 +118,7 @@ export async function auditBackups(deps: BackupsAuditDeps): Promise<DriftFinding
         category: 'backups',
         severity: 'drift',
         code: 'backup_stale',
-        message: `${m.id}: last successful backup is ${formatAge(age)} old (schedule: ${scheduleFor(m.manifest)}, threshold: ${formatAge(threshold)})`,
+        message: `${m.id}: last successful backup is ${formatAge(age)} old (schedule: ${effectiveBackupSchedule(m.manifest)}, threshold: ${formatAge(threshold)})`,
         remediation: `celilo backup create ${m.id} --force`,
         actionable: true,
         subject: m.id,