@celilo/cli 0.14.4 → 0.16.1

package/src/cli/commands/module-journal.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from 'bun:test';
+import type { JournalReport } from '../../services/module-journal';
+import { formatJournalReport } from './module-journal';
+
+const system = (over: Partial<JournalReport['systems'][number]> = {}) => ({
+  system: 'signal',
+  hostname: 'signal',
+  ipv4Address: '10.0.20.40',
+  unit: 'signal*',
+  ok: true,
+  lines: [] as string[],
+  ...over,
+});
+
+describe('formatJournalReport', () => {
+  test('renders the journal lines under their host', () => {
+    const { message, allOk } = formatJournalReport({
+      moduleId: 'signal',
+      systems: [system({ lines: ['Received sync sent message'] })],
+    });
+    expect(allOk).toBe(true);
+    expect(message).toContain('signal (10.0.20.40)');
+    expect(message).toContain('Received sync sent message');
+  });
+
+  // The defect class of #501: unreadable must not present as quiet.
+  test('an unreadable host and an empty journal do not look the same', () => {
+    const empty = formatJournalReport({ moduleId: 'signal', systems: [system()] });
+    const broken = formatJournalReport({
+      moduleId: 'signal',
+      systems: [system({ ok: false, error: 'Connection timed out' })],
+    });
+
+    expect(empty.allOk).toBe(true);
+    expect(broken.allOk).toBe(false);
+    expect(broken.message).not.toBe(empty.message);
+    expect(broken.message).toContain('UNREADABLE');
+  });
+
+  test('one unreadable host among several fails the whole read', () => {
+    const { allOk } = formatJournalReport({
+      moduleId: 'forgejo',
+      systems: [system({ lines: ['ok'] }), system({ ok: false, error: 'no route to host' })],
+    });
+    expect(allOk).toBe(false);
+  });
+});

package/src/cli/commands/module-journal.ts

@@ -0,0 +1,98 @@
+/**
+ * Module journal command — read a deployed module's runtime daemon logs
+ * (`journalctl -u <unit>`) through celilo, without SSH to the host.
+ *
+ * Sibling to `celilo module logs`, not an extension of it: `logs` reads the
+ * LOCAL deploy log written by Ansible on celilo-mgr, `journal` reads the
+ * REMOTE daemon's journal on the host that runs the module. Different source,
+ * different failure modes (a host can be unreachable; a log file cannot), and
+ * different answers to different questions. Folding them together would have
+ * meant one command whose meaning depended on a flag.
+ *
+ * Read-only by construction — see services/module-journal.ts.
+ */
+
+import { getDb } from '../../db/client';
+import { type JournalReport, readModuleJournal } from '../../services/module-journal';
+import { getArg, hasFlag, validateRequiredArgs } from '../parser';
+import type { CommandResult } from '../types';
+
+const USAGE =
+  'Usage: celilo module journal <id> [--unit <name>] [--lines <n>] [--since <when>] [--grep <pattern>] [--json]';
+
+function numericFlag(value: string | boolean | undefined): number | undefined {
+  return typeof value === 'string' ? Number(value) : undefined;
+}
+
+function stringFlag(value: string | boolean | undefined): string | undefined {
+  return typeof value === 'string' ? value : undefined;
+}
+
+/**
+ * Handle module journal command.
+ */
+export async function handleModuleJournal(
+  args: string[],
+  flags: Record<string, string | boolean> = {},
+): Promise<CommandResult> {
+  const argError = validateRequiredArgs(args, 1);
+  if (argError) {
+    return { success: false, error: `${argError}\n\n${USAGE}` };
+  }
+
+  const moduleId = getArg(args, 0);
+  if (!moduleId) {
+    return { success: false, error: 'Module ID is required' };
+  }
+
+  const report = readModuleJournal(
+    {
+      moduleId,
+      unit: stringFlag(flags.unit),
+      lines: numericFlag(flags.lines),
+      since: stringFlag(flags.since),
+      grep: stringFlag(flags.grep),
+    },
+    getDb(),
+  );
+
+  if ('error' in report) {
+    return { success: false, error: report.error };
+  }
+
+  if (hasFlag(flags, 'json')) {
+    return {
+      success: true,
+      message: JSON.stringify(report, null, 2),
+      rawOutput: true,
+      data: report,
+    };
+  }
+
+  const { message, allOk } = formatJournalReport(report);
+  return allOk ? { success: true, message } : { success: false, error: message };
+}
+
+/**
+ * Presentation. A host celilo could not read is a FAILURE, not a quiet success
+ * — the defect this whole change exists to fix is unreadable and empty being
+ * byte-identical to the operator.
+ */
+export function formatJournalReport(report: JournalReport): { message: string; allOk: boolean } {
+  const out: string[] = [];
+  for (const sys of report.systems) {
+    out.push(`── ${sys.hostname} (${sys.ipv4Address}) · unit ${sys.unit}`);
+    if (!sys.ok) {
+      out.push(`  ✗ UNREADABLE: ${sys.error}`);
+    } else if (sys.lines.length === 0) {
+      out.push('  (no matching journal lines)');
+    } else {
+      out.push(...sys.lines.map((line) => `  ${line}`));
+    }
+    out.push('');
+  }
+  return {
+    message: out.join('\n').trimEnd(),
+    allOk: report.systems.every((s) => s.ok),
+  };
+}

package/src/cli/commands/module-operations.test.ts

@@ -0,0 +1,93 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { eq } from 'drizzle-orm';
+import { closeDb, getDb } from '../../db/client';
+import { runMigrations } from '../../db/migrate';
+import { moduleOperations } from '../../db/schema';
+import { OPERATION_TTL_MS } from '../../services/module-operations';
+import { handleModuleOperations } from './module-operations';
+
+describe('celilo module operations', () => {
+  let dir: string;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-ops-cmd-test-'));
+    process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+    await runMigrations(process.env.CELILO_DB_PATH);
+  });
+
+  afterEach(() => {
+    closeDb();
+    process.env.CELILO_DB_PATH = undefined;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  function insert(id: string, pid: number, ageMs: number): void {
+    getDb()
+      .insert(moduleOperations)
+      .values({
+        id,
+        moduleId: 'byoi',
+        operation: 'deploy',
+        status: 'in_progress',
+        pid,
+        startedAt: new Date(Date.now() - ageMs),
+      })
+      .run();
+  }
+
+  function statusOf(id: string): string | undefined {
+    return getDb().select().from(moduleOperations).where(eq(moduleOperations.id, id)).get()?.status;
+  }
+
+  it('reports nothing to clear when the lock is genuinely held', () => {
+    insert('live', process.pid, 60_000);
+
+    const result = handleModuleOperations(['clear'], {});
+
+    if (!result.success) throw new Error(`expected success, got: ${result.error}`);
+    expect(result.message).toContain('still look genuinely in flight');
+    expect(statusOf('live')).toBe('in_progress');
+  });
+
+  it('releases an expired row without touching a live one', () => {
+    insert('expired', process.pid, OPERATION_TTL_MS + 60_000);
+    insert('live', process.pid, 60_000);
+
+    const result = handleModuleOperations(['clear'], {});
+
+    expect(result.success).toBe(true);
+    expect(statusOf('expired')).toBe('failed');
+    expect(statusOf('live')).toBe('in_progress');
+  });
+
+  // The escape hatch's reason for existing: when liveness detection is wrong
+  // — a recycled pid reads as perfectly healthy — refusing to clear would
+  // recreate the outage the command exists to end.
+  it('--all releases a row whose process is still alive', () => {
+    insert('live', process.pid, 60_000);
+
+    const result = handleModuleOperations(['clear'], { all: true });
+
+    expect(result.success).toBe(true);
+    expect(statusOf('live')).toBe('failed');
+  });
+
+  it('lists without mutating anything', () => {
+    insert('expired', process.pid, OPERATION_TTL_MS + 60_000);
+
+    const result = handleModuleOperations([], {});
+
+    if (!result.success) throw new Error(`expected success, got: ${result.error}`);
+    expect(result.message).toContain('1 abandoned');
+    expect(statusOf('expired')).toBe('in_progress');
+  });
+
+  it('rejects an unknown action rather than silently listing', () => {
+    const result = handleModuleOperations(['nuke'], {});
+    if (result.success) throw new Error('expected an unknown action to fail');
+    expect(result.error).toContain('Unknown action');
+  });
+});

package/src/cli/commands/module-operations.ts

@@ -0,0 +1,134 @@
+/**
+ * `celilo module operations` — see and release the module-operation lock.
+ *
+ * Backup and restore refuse to run while another operation is in flight.
+ * When that refusal is wrong, the operator previously had no way to see
+ * the lock at all, let alone clear it: the error said "wait for it to
+ * complete", which for a suspended process is advice that can never come
+ * true. A `module deploy` Ctrl-Z'd on a lost terminal blocked every
+ * backup on the fleet for 20 days on exactly that advice.
+ *
+ * `clear` marks rows failed rather than deleting them — the history of
+ * what was abandoned, and when, is worth more than a tidy table.
+ */
+
+import { and, eq } from 'drizzle-orm';
+import { getDb } from '../../db/client';
+import { type ModuleOperation, moduleOperations } from '../../db/schema';
+import { OPERATION_TTL_MS, isPidRunnable } from '../../services/module-operations';
+import type { CommandResult } from '../types';
+
+/** Why a row is not holding the lock, or null when it still is. */
+function abandonedReason(row: ModuleOperation, now: number): string | null {
+  if (now - row.startedAt.getTime() > OPERATION_TTL_MS) return 'expired';
+  if (!isPidRunnable(row.pid)) return 'not running';
+  return null;
+}
+
+function formatAge(ms: number): string {
+  const minutes = Math.floor(ms / 60_000);
+  if (minutes < 60) return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h`;
+  return `${Math.floor(hours / 24)}d`;
+}
+
+function inProgressRows(): ModuleOperation[] {
+  return getDb()
+    .select()
+    .from(moduleOperations)
+    .where(eq(moduleOperations.status, 'in_progress'))
+    .all();
+}
+
+function handleList(): CommandResult {
+  const now = Date.now();
+  const rows = inProgressRows();
+
+  if (rows.length === 0) {
+    console.log('\nNo module operations in progress.\n');
+    return { success: true, message: 'no operations in progress' };
+  }
+
+  console.log('\nModule operations in progress:\n');
+  let holding = 0;
+  for (const row of rows) {
+    const reason = abandonedReason(row, now);
+    if (!reason) holding++;
+    const age = formatAge(now - row.startedAt.getTime());
+    const status = reason ? `abandoned (${reason})` : 'HOLDING LOCK';
+    console.log(
+      `  ${row.operation.padEnd(9)} ${row.moduleId.padEnd(16)} pid ${String(row.pid).padEnd(8)} ${age.padStart(4)} ago   ${status}`,
+    );
+  }
+
+  const abandoned = rows.length - holding;
+  console.log('');
+  if (abandoned > 0) {
+    console.log(`${abandoned} abandoned row(s) — "celilo module operations clear" sweeps them.\n`);
+  }
+
+  return {
+    success: true,
+    message: `${rows.length} in progress (${holding} holding the lock, ${abandoned} abandoned)`,
+  };
+}
+
+/**
+ * Release abandoned rows. `--all` also releases rows whose process still
+ * looks alive.
+ *
+ * The permissive form exists because the pathological case is precisely
+ * the one where our liveness detection was wrong — a pid that has been
+ * recycled by an unrelated process reads as perfectly healthy. Refusing
+ * to clear it would recreate the outage this command exists to end. It
+ * is opt-in and names what it is overriding.
+ */
+function handleClear(flags: Record<string, boolean | string>): CommandResult {
+  const db = getDb();
+  const now = Date.now();
+  const force = flags.all === true;
+  const rows = inProgressRows();
+
+  const targets = force ? rows : rows.filter((row) => abandonedReason(row, now) !== null);
+
+  if (targets.length === 0) {
+    const held = rows.length;
+    if (held > 0) {
+      return {
+        success: true,
+        message: `Nothing to clear — ${held} operation(s) still look genuinely in flight. Use --all to release them anyway.`,
+      };
+    }
+    return { success: true, message: 'Nothing to clear — no operations in progress.' };
+  }
+
+  for (const row of targets) {
+    db.update(moduleOperations)
+      .set({
+        status: 'failed',
+        completedAt: new Date(),
+        errorMessage: 'abandoned — released by "celilo module operations clear"',
+      })
+      .where(and(eq(moduleOperations.id, row.id), eq(moduleOperations.status, 'in_progress')))
+      .run();
+    console.log(`  released ${row.operation} of ${row.moduleId} (pid ${row.pid})`);
+  }
+
+  return { success: true, message: `Released ${targets.length} operation(s)` };
+}
+
+export function handleModuleOperations(
+  args: string[],
+  flags: Record<string, boolean | string>,
+): CommandResult {
+  const action = args[0];
+
+  if (!action || action === 'list') return handleList();
+  if (action === 'clear') return handleClear(flags);
+
+  return {
+    success: false,
+    error: `Unknown action "${action}"\n\nUsage: celilo module operations [list|clear] [--all]`,
+  };
+}

package/src/cli/commands/module-upgrade.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from 'bun:test';
 import type { ModuleManifest } from '../../manifest/schema';
 import {
   type PollCandidate,
+  isPollInvocation,
   needsPreUpgradeBackup,
   pickAutoUpgrade,
   pickUpgradePolicy,
@@ -15,39 +16,50 @@ function manifest(hooks?: ModuleManifest['hooks']): ModuleManifest {
 const withBackupHook = manifest({ on_backup: { script: './scripts/backup.ts', timeout: 300000 } });
 const noBackupHook = manifest({ on_install: { script: './scripts/setup.ts', timeout: 180000 } });
 
-describe('pickUpgradePolicy (ISS-0138 — config override > manifest default > by-semver)', () => {
-  test('operator config wins over the manifest default', () => {
-    expect(pickUpgradePolicy('always-safe', 'always-fast')).toBe('always-safe');
+describe('pickUpgradePolicy (ISS-0138 — operator config, else by-semver)', () => {
+  test('operator config decides', () => {
+    expect(pickUpgradePolicy('always-safe')).toBe('always-safe');
+    expect(pickUpgradePolicy('always-fast')).toBe('always-fast');
   });
 
-  test('manifest default applies when there is no config override', () => {
-    expect(pickUpgradePolicy(undefined, 'always-fast')).toBe('always-fast');
+  test('defaults to by-semver when unset', () => {
+    expect(pickUpgradePolicy(undefined)).toBe('by-semver');
   });
 
-  test('defaults to by-semver when neither is set', () => {
-    expect(pickUpgradePolicy(undefined, undefined)).toBe('by-semver');
+  test('an unknown value falls back to by-semver (no crash on bad input)', () => {
+    expect(pickUpgradePolicy('bogus')).toBe('by-semver');
   });
+});
 
-  test('an unknown value falls back to by-semver (no crash on bad input)', () => {
-    expect(pickUpgradePolicy('bogus', undefined)).toBe('by-semver');
-    expect(pickUpgradePolicy(undefined, 'nonsense')).toBe('by-semver');
+describe('pickAutoUpgrade (ISS-0139 — opt-in via operator config, default off)', () => {
+  test('config value (string or boolean) decides', () => {
+    expect(pickAutoUpgrade('true')).toBe(true);
+    expect(pickAutoUpgrade('false')).toBe(false);
+    expect(pickAutoUpgrade(true)).toBe(true);
+    expect(pickAutoUpgrade(false)).toBe(false);
+  });
+
+  test('defaults to OFF (opt-in) when unset', () => {
+    expect(pickAutoUpgrade(undefined)).toBe(false);
   });
 });
 
-describe('pickAutoUpgrade (ISS-0139 — opt-in: config override > manifest default > off)', () => {
-  test('config override (string or boolean) wins', () => {
-    expect(pickAutoUpgrade('true', false)).toBe(true);
-    expect(pickAutoUpgrade('false', true)).toBe(false);
-    expect(pickAutoUpgrade(true, false)).toBe(true);
+// The dispatcher spawns a subprocess handler as `<handler> <event_id>`
+// (openspec/specs/event-bus/spec.md), so the registry-poll subscription's
+// handler arrives as `celilo module upgrade --poll 5517`. Without --poll the
+// event id landed in the module-name slot and every 15m tick died with
+// "Module not found: 5517" — the poll never ran on celilo-mgr for weeks.
+describe('isPollInvocation (the CD poll must survive the appended event id)', () => {
+  test('--poll wins over a positional (the dispatcher-appended event id)', () => {
+    expect(isPollInvocation(['5517'], { poll: true })).toBe(true);
   });
 
-  test('manifest default applies with no override', () => {
-    expect(pickAutoUpgrade(undefined, true)).toBe(true);
-    expect(pickAutoUpgrade(undefined, false)).toBe(false);
+  test('bare `module upgrade` is still the poll', () => {
+    expect(isPollInvocation([], {})).toBe(true);
   });
 
-  test('defaults to OFF (opt-in) when neither is set', () => {
-    expect(pickAutoUpgrade(undefined, undefined)).toBe(false);
+  test('a named module without --poll is a single-module upgrade', () => {
+    expect(isPollInvocation(['lunacycle'], {})).toBe(false);
   });
 });
 

package/src/cli/commands/module-upgrade.ts

@@ -37,33 +37,29 @@ import { classifyVersionChange, fetchAndUpdate } from './module-update';
 const VALID_POLICIES: readonly UpgradePolicy[] = ['by-semver', 'always-safe', 'always-fast'];
 
 /**
- * Pick the effective upgrade policy. Pure (Rule 10): operator config override
- * wins over the manifest default; an unknown/absent value falls back to
- * `by-semver`.
+ * Pick the effective upgrade policy. Pure (Rule 10): operator config decides;
+ * an unknown/absent value falls back to `by-semver`.
+ *
+ * Config-only by construction — the manifest schema is `.strict()` and declares
+ * no `upgrade_policy`, so a manifest that set one could never pass validation.
+ * (The old manifest-default branch read a key no valid manifest can carry —
+ * Rule 3.9 dead code, deleted rather than left as a corpse.)
  */
-export function pickUpgradePolicy(
-  fromConfig: string | undefined,
-  fromManifest: string | undefined,
-): UpgradePolicy {
-  const candidate = fromConfig ?? fromManifest;
-  return VALID_POLICIES.includes(candidate as UpgradePolicy)
-    ? (candidate as UpgradePolicy)
+export function pickUpgradePolicy(fromConfig: string | undefined): UpgradePolicy {
+  return VALID_POLICIES.includes(fromConfig as UpgradePolicy)
+    ? (fromConfig as UpgradePolicy)
     : 'by-semver';
 }
 
 /**
  * Resolve whether a module opts into auto-upgrade by the poll. Pure (Rule 10):
- * operator config override wins over the manifest default; the default is OFF
- * (opt-in — a production module isn't auto-upgraded unless chosen).
+ * operator config only (same `.strict()` reason as pickUpgradePolicy), default
+ * OFF — a production module isn't auto-upgraded unless the operator chose it:
+ * `celilo module config set <module> auto_upgrade true`.
  */
-export function pickAutoUpgrade(
-  fromConfig: string | boolean | undefined,
-  fromManifest: boolean | undefined,
-): boolean {
+export function pickAutoUpgrade(fromConfig: string | boolean | undefined): boolean {
   if (typeof fromConfig === 'boolean') return fromConfig;
-  if (fromConfig === 'true') return true;
-  if (fromConfig === 'false') return false;
-  return fromManifest ?? false;
+  return fromConfig === 'true';
 }
 
 /**
@@ -113,14 +109,11 @@ export function selectPollTargets(candidates: PollCandidate[]): PollTarget[] {
   return targets;
 }
 
-/** Resolve a module's auto_upgrade flag from config (override) + manifest (default). */
-function resolveAutoUpgrade(moduleId: string, manifest: ModuleManifest): boolean {
+/** Resolve a module's auto_upgrade opt-in from operator config. */
+function resolveAutoUpgrade(moduleId: string): boolean {
   const cfg = getModuleConfigValue(moduleId, 'auto_upgrade');
-  const fromConfig =
-    typeof cfg?.value === 'string' || typeof cfg?.value === 'boolean' ? cfg.value : undefined;
   return pickAutoUpgrade(
-    fromConfig,
-    (manifest as ModuleManifest & { auto_upgrade?: boolean }).auto_upgrade,
+    typeof cfg?.value === 'string' || typeof cfg?.value === 'boolean' ? cfg.value : undefined,
   );
 }
 
@@ -158,13 +151,11 @@ async function upgradeOneModule(
     (updatedRow?.manifestData as ModuleManifest | undefined) ??
     (mod.manifestData as ModuleManifest);
 
-  // Posture. Version delta is installed→target; the policy comes from the
-  // TARGET manifest (the version being installed declares its upgrade risk),
-  // with an operator config override still winning.
+  // Posture. Version delta is installed→target; the policy comes from operator
+  // config (`celilo module config set <m> upgrade_policy …`), else by-semver.
   const configPolicy = getModuleConfigValue(moduleId, 'upgrade_policy');
   const modulePolicy = pickUpgradePolicy(
     typeof configPolicy?.value === 'string' ? configPolicy.value : undefined,
-    (targetManifest as ModuleManifest & { upgrade_policy?: string }).upgrade_policy,
   );
   // Per-release deploy_posture override lives in the .netapp release metadata;
   // reading it requires fetching the package first. Deferred — the classifier
@@ -244,7 +235,7 @@ async function runRegistryPoll(
       moduleId: mod.id,
       installed: mod.version,
       latest: await latestRegistryVersion(client, mod.id),
-      autoUpgrade: resolveAutoUpgrade(mod.id, mod.manifestData as ModuleManifest),
+      autoUpgrade: resolveAutoUpgrade(mod.id),
     });
   }
 
@@ -278,6 +269,20 @@ async function runRegistryPoll(
   };
 }
 
+/**
+ * Pure (Rule 10.1): is this the CD poll rather than a single-module upgrade?
+ *
+ * `--poll` is what a bus subscription MUST use. The dispatcher spawns a
+ * subprocess handler as `<handler> <event_id>` (openspec/specs/event-bus/spec.md),
+ * so a bare `celilo module upgrade` handler arrives as `celilo module upgrade
+ * 5517` — the event id lands in the optional module-name slot and the poll dies
+ * with "Module not found: 5517" every tick. An explicit flag makes the poll
+ * invocation immune to the appended id instead of relying on argv position.
+ */
+export function isPollInvocation(args: string[], flags: Record<string, string | boolean>): boolean {
+  return Boolean(flags.poll) || !getArg(args, 0);
+}
+
 export async function handleModuleUpgrade(
   args: string[],
   flags: Record<string, string | boolean> = {},
@@ -285,8 +290,8 @@ export async function handleModuleUpgrade(
   const db = getDb();
   const moduleId = getArg(args, 0);
 
-  // No name → the CD poll over all auto_upgrade modules.
-  if (!moduleId) {
+  // `--poll` or no name → the CD poll over all auto_upgrade modules.
+  if (isPollInvocation(args, flags) || !moduleId) {
     return runRegistryPoll(db, flags);
   }
 

package/src/cli/commands/monitor.ts

@@ -11,7 +11,10 @@ import { getEventBusPath } from '../../config/paths';
 import { getDb } from '../../db/client';
 import type { MonitorKind } from '../../db/schema';
 import { parseIntervalMinutes } from '../../manifest/schema';
-import { runBuiltinCheckForMonitor } from '../../services/alerting/builtin-source';
+import {
+  isSchedulableBuiltin,
+  runBuiltinCheckForMonitor,
+} from '../../services/alerting/builtin-source';
 import { loadModuleCoverage } from '../../services/alerting/coverage-source';
 import { HEALTH_COVERAGE_CHECK } from '../../services/alerting/health-coverage';
 import {
@@ -21,6 +24,7 @@ import {
   listMonitors,
   setMonitorEnabled,
 } from '../../services/alerting/monitors';
+import { listPolicies } from '../../services/alerting/people';
 import { runOneMonitor } from '../../services/alerting/run-monitor';
 import { promoteReadyAlerts } from '../../services/alerting/store';
 import type { DriftCategory } from '../../services/audit/types';
@@ -37,7 +41,7 @@ function buildDeps() {
   return {
     runModuleCheck: (moduleId: string) =>
       runModuleHealthCheck(moduleId, db, { unattended: true, noInteractive: true }),
-    runBuiltinCheck: (category: DriftCategory) => runBuiltinCheckForMonitor(category),
+    runBuiltinCheck: (category: DriftCategory) => runBuiltinCheckForMonitor(category, db),
     loadModuleCoverage: () => loadModuleCoverage(db),
     now: () => new Date(),
     graceMs: DEFAULT_GRACE_MS,
@@ -53,15 +57,26 @@ function handleList(): CommandResult {
     return { success: true, message: 'No monitors configured' };
   }
 
+  // The POLICY column is the answer to "why did nothing page me". A monitor
+  // with no policy is one whose alerts reach nobody, and until this column
+  // existed there was no way to see that from the CLI at all — `assign`
+  // reported success and nothing anywhere reflected the result (#481).
+  const policies = new Map(listPolicies(getDb()).map((p) => [p.id, p.name]));
+  const policyOf = (id: string | null) =>
+    id ? (policies.get(id) ?? '(deleted policy)') : '— pages nobody';
+
   const width = Math.max(6, ...rows.map((r) => r.target.length));
+  const policyWidth = Math.max(6, ...rows.map((r) => policyOf(r.escalationPolicyId).length));
   console.log('');
-  console.log(`${'TARGET'.padEnd(width)}  ${'KIND'.padEnd(14)}  ${'EVERY'.padEnd(6)}  STATE`);
+  console.log(
+    `${'TARGET'.padEnd(width)}  ${'KIND'.padEnd(14)}  ${'EVERY'.padEnd(6)}  ${'POLICY'.padEnd(policyWidth)}  STATE`,
+  );
   for (const monitor of rows) {
     const state = monitor.enabled ? 'enabled' : 'disabled';
     const suffix = monitor.lastRunAt ? '' : '  (never run)';
     const every = `${monitor.intervalMinutes}m`;
     console.log(
-      `${monitor.target.padEnd(width)}  ${monitor.kind.padEnd(14)}  ${every.padEnd(6)}  ${state}${suffix}`,
+      `${monitor.target.padEnd(width)}  ${monitor.kind.padEnd(14)}  ${every.padEnd(6)}  ${policyOf(monitor.escalationPolicyId).padEnd(policyWidth)}  ${state}${suffix}`,
     );
   }
   console.log('');
@@ -89,9 +104,14 @@ function handleAdd(args: string[], flags: Record<string, boolean | string>): Com
   }
 
   // A target naming an audit category is a built-in check; anything else is a
-  // module's health_check hook.
+  // module's health_check hook. `isSchedulableBuiltin` is checked explicitly
+  // because not every category is snake_case — `backups` is one word, and the
+  // underscore heuristic alone would file it as a module hook against a module
+  // that does not exist.
   const kind: MonitorKind =
-    target === HEALTH_COVERAGE_CHECK || target.includes('_') ? 'builtin_check' : 'module_hook';
+    target === HEALTH_COVERAGE_CHECK || isSchedulableBuiltin(target) || target.includes('_')
+      ? 'builtin_check'
+      : 'module_hook';
 
   createMonitor(db, { kind, target, intervalMinutes });