@celilo/cli 0.14.4 → 0.16.1

package/src/services/alerting/inbound.ts

@@ -12,20 +12,52 @@
  * A message from an address matching no route is discarded and logged WITHOUT
  * a reply. Replying would confirm the number is live and that this is a celilo
  * instance, which is free reconnaissance for anyone probing.
+ *
+ * ── ORDER MATTERS: RESOLVE THE TOKEN, THEN PICK THE GRAMMAR ────────────────
+ *
+ * The same table carries alert pages and deploy questions, and they want
+ * OPPOSITE parsing. An alert reply is a token and at most a verb; anything
+ * wordier is refused, because `<token> resolve` silently acknowledging an
+ * alert the operator meant to escalate is the worst outcome here. An interview
+ * answer is a token followed by arbitrary text, because the text IS the answer.
+ *
+ * Parsing before resolving cannot serve both, and #533 is what that cost: the
+ * alert grammar ran first, read every real answer as a sentence, and rejected
+ * it before the poller could ever see it was a question. The feature was dead
+ * for months and the operator was told `unrecognised`, which reads as their
+ * typing being wrong.
+ *
+ * A delivery knows its own kind, so the token is resolved FIRST and the
+ * grammar chosen from what it named. Which rule applies was never a property
+ * of the text.
  */
 
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type NotificationDelivery, type Route, routes } from '../../db/schema';
-import { findLiveDelivery, normaliseToken } from './tokens';
+import { findLiveDeliveriesByPrefix, normaliseToken } from './tokens';
 
 /**
- * v1 grammar: a bare token acknowledges. `snooze` and `resolve` verbs are
- * deferred — ack is what an operator does at 3am, and every extra verb is
- * another thing to mistype under stress.
+ * v1 grammar: a token acknowledges. `snooze` and `resolve` verbs are deferred —
+ * ack is what an operator does at 3am, and every extra verb is another thing to
+ * mistype under stress.
  *
- * A bare `ack` with no token is accepted when the sender has exactly one
- * outstanding delivery, since the token adds nothing when there is no ambiguity.
+ * Deliberately forgiving about everything EXCEPT what the message means. An
+ * earlier cut accepted `<token> ack` but not `ack <token>`, so an operator who
+ * read "reply BPRJEH" and typed the natural "ack BPRJEH" was refused — the verb
+ * was parsed as the token, failed the length check, and the reply was rejected.
+ * That is a real page going unacknowledged over word order, so:
+ *
+ *   - the ack verb may come BEFORE the token, AFTER it, or not at all
+ *   - case never matters, for the verb or the token
+ *   - the token may be shortened to any unambiguous prefix (see below)
+ *
+ * `token` here is a CANDIDATE, not necessarily a whole token: resolution
+ * against what is actually outstanding happens in `interpretInbound`, because
+ * only the database knows which prefixes are unique right now.
+ *
+ * A bare ack with no token at all is accepted when the sender has exactly one
+ * outstanding delivery, since a token adds nothing when there is no ambiguity.
  */
 export type InboundIntent =
   | { kind: 'ack'; token: string }
@@ -33,37 +65,87 @@ export type InboundIntent =
   | { kind: 'unrecognised' };
 
 const ACK_VERB = /^(ack|ok|k|👍)$/iu;
-const TOKEN_SHAPE = /^[0-9ABCDEFGHJKMNPQRSTVWXYZ]{6}$/;
+/**
+ * One to six characters of the token alphabet. Not anchored to the full
+ * length: a prefix is legal input, and whether it identifies something is a
+ * question for the delivery table, not for a regex.
+ */
+const TOKEN_SHAPE = /^[0-9ABCDEFGHJKMNPQRSTVWXYZ]{1,6}$/;
 
 export function parseInbound(body: string): InboundIntent {
-  const trimmed = body.trim();
-  if (!trimmed) return { kind: 'unrecognised' };
+  const words = body.trim().split(/\s+/).filter(Boolean);
+  if (words.length === 0) return { kind: 'unrecognised' };
+
+  // Strip ack synonyms wherever they appear. What remains must be the token,
+  // or nothing at all.
+  const remainder = words.filter((word) => !ACK_VERB.test(word));
+  if (remainder.length === 0) return { kind: 'bare_ack' };
+
+  // More than one non-verb word is not a token with politeness around it, it
+  // is a sentence — and a sentence may be a request celilo does not implement.
+  // Guessing at it risks acknowledging an alert the operator meant to escalate:
+  // an earlier cut let `<token> resolve` silently ACK, so the operator believed
+  // they had cleared an alert that was still firing. Doing nothing and saying
+  // so is strictly better than doing the wrong thing quietly.
+  if (remainder.length > 1) return { kind: 'unrecognised' };
+
+  const token = normaliseToken(remainder[0]);
+  if (!TOKEN_SHAPE.test(token)) return { kind: 'unrecognised' };
 
-  if (ACK_VERB.test(trimmed)) return { kind: 'bare_ack' };
+  return { kind: 'ack', token };
+}
 
-  const [first, ...rest] = trimmed.split(/\s+/);
-  const token = normaliseToken(first);
-  if (!TOKEN_SHAPE.test(token)) return { kind: 'unrecognised' };
+/** A message that leads with a token, and whatever text followed it. */
+export interface TokenLedMessage {
+  token: string;
+  /** Everything after the token, trimmed. Empty when the token stood alone. */
+  rest: string;
+}
 
-  // A verb after the token must be an ack synonym or nothing. An earlier cut
-  // ignored the verb entirely, which meant `<token> resolve` silently
-  // ACKNOWLEDGED — the operator believes they cleared the alert and it is
-  // still firing. Doing nothing and saying so is strictly better than doing
-  // the wrong thing quietly.
-  //
-  // `resolve` and `silence` are terminal operations, not reply verbs (design
-  // D10): every extra verb is another thing to mistype at 3am.
-  if (rest.length > 0 && !ACK_VERB.test(rest.join(' '))) {
-    return { kind: 'unrecognised' };
-  }
+/**
+ * Split a message that LEADS with a token, or null if it does not.
+ *
+ * This is the interview grammar and it is deliberately not the alert one: the
+ * page says `reply <TOKEN> <value>`, and the value is whatever follows,
+ * verbatim. It may contain spaces, punctuation, or a word that happens to look
+ * like a verb — second-guessing it would corrupt exactly the values an operator
+ * cannot easily retype.
+ *
+ * `parseInbound` cannot serve both. Its "more than one non-verb word is a
+ * sentence" rule is what protects an ALERT from `<token> resolve`, and it is
+ * also what made every real interview answer unrecognised (#533): a value is
+ * a sentence by construction. Which rule applies is not a property of the text
+ * — it is a property of what the token names, and only the delivery table
+ * knows that. So both readings are produced here and `interpretInbound`
+ * chooses between them AFTER resolving the token.
+ */
+export function parseTokenLed(body: string): TokenLedMessage | null {
+  const trimmed = body.trim();
+  if (!trimmed) return null;
 
-  return { kind: 'ack', token };
+  const boundary = trimmed.search(/\s/);
+  const head = boundary === -1 ? trimmed : trimmed.slice(0, boundary);
+  const token = normaliseToken(head);
+  if (!TOKEN_SHAPE.test(token)) return null;
+
+  return { token, rest: boundary === -1 ? '' : trimmed.slice(boundary).trim() };
 }
 
 export type InboundOutcome =
   | { action: 'ack'; delivery: NotificationDelivery; route: Route }
+  /** An answer to a deploy question. `value` is the operator's text, verbatim. */
+  | { action: 'answer'; delivery: NotificationDelivery; route: Route; value: string }
   | { action: 'ignored'; reason: 'unknown_sender' }
-  | { action: 'rejected'; reason: 'unknown_token' | 'wrong_sender' | 'ambiguous' | 'unrecognised' };
+  | {
+      action: 'rejected';
+      reason:
+        | 'unknown_token'
+        | 'wrong_sender'
+        | 'ambiguous'
+        | 'unrecognised'
+        /** A question was named, but no value was supplied to answer it with. */
+        | 'needs_value';
+    };
 
 function routeForAddress(db: DbClient, senderAddress: string): Route | undefined {
   return db.select().from(routes).where(eq(routes.address, senderAddress)).get();
@@ -91,10 +173,9 @@ export function interpretInbound(db: DbClient, context: InboundContext): Inbound
 
   const intent = parseInbound(context.body);
 
-  if (intent.kind === 'unrecognised') {
-    return { action: 'rejected', reason: 'unrecognised' };
-  }
-
+  // A bare ack names no token, so there is nothing to resolve and nothing a
+  // question could be answered with. It is an ALERT reply by construction —
+  // `outstandingForRoute` supplies alert deliveries only.
   if (intent.kind === 'bare_ack') {
     const outstanding = context.outstandingForRoute(route.id);
     if (outstanding.length === 0) return { action: 'rejected', reason: 'unknown_token' };
@@ -102,11 +183,59 @@ export function interpretInbound(db: DbClient, context: InboundContext): Inbound
     return { action: 'ack', delivery: outstanding[0], route };
   }
 
-  const delivery = findLiveDelivery(db, intent.token, context.now);
-  if (!delivery) return { action: 'rejected', reason: 'unknown_token' };
+  // Both readings of the text, neither yet privileged. The alert reading is
+  // the more constrained one, so it names the token when it applies; otherwise
+  // a leading token does.
+  const led = parseTokenLed(context.body);
+  const namesAToken = intent.kind === 'ack';
+  const candidate = namesAToken ? intent.token : led?.token;
+
+  // Nothing token-shaped anywhere: not a reply celilo can act on.
+  if (!candidate) return { action: 'rejected', reason: 'unrecognised' };
+
+  // A prefix is resolved against what is LIVE right now, so how much of the
+  // token an operator must type depends on what is actually outstanding — one
+  // alert, one character. Matching is deliberately global rather than scoped to
+  // this route: it keeps `wrong_sender` a distinguishable answer below, and a
+  // globally-unique prefix is a stricter bar than a per-route one.
+  const matches = findLiveDeliveriesByPrefix(db, candidate, context.now);
+  if (matches.length === 0) {
+    // Ordinary words are token-shaped surprisingly often — the alphabet is
+    // most of the Latin one, so `what is going on` leads with a perfectly
+    // well-formed `WHAT`. Only call it a token the operator got WRONG when the
+    // alert grammar agreed it was one; otherwise this is a sentence, and
+    // saying `unknown_token` would send them hunting for a typo they did not
+    // make.
+    return { action: 'rejected', reason: namesAToken ? 'unknown_token' : 'unrecognised' };
+  }
+
+  // Ambiguous is its own answer, never a guess. Taking the first match would
+  // acknowledge an alert the operator did not name.
+  if (matches.length > 1) return { action: 'rejected', reason: 'ambiguous' };
+
+  const delivery = matches[0];
 
   // Factor two: a valid token replayed from a different number is refused.
+  // Checked before the grammar so a stranger learns nothing about which of the
+  // two a token names.
   if (delivery.routeId !== route.id) return { action: 'rejected', reason: 'wrong_sender' };
 
+  // NOW the kind is known, so the right grammar can be applied to the body.
+  if (delivery.kind === 'interview') {
+    // The value must follow the token the question was asked with; a verb-led
+    // message (`ack <TOKEN>`) names no value and is not an answer.
+    if (!led || led.token !== candidate) return { action: 'rejected', reason: 'unrecognised' };
+    // Named the question but supplied nothing to answer it with. Distinct from
+    // `unrecognised`: the operator got the token right and stopped too soon,
+    // and telling them that is the difference between retyping six characters
+    // and giving up.
+    if (!led.rest) return { action: 'rejected', reason: 'needs_value' };
+    return { action: 'answer', delivery, route, value: led.rest };
+  }
+
+  // An alert. The strict grammar applies, which is what keeps `<token> resolve`
+  // from silently acknowledging something the operator meant to escalate.
+  if (intent.kind !== 'ack') return { action: 'rejected', reason: 'unrecognised' };
+
   return { action: 'ack', delivery, route };
 }

package/src/services/alerting/interview-responder.test.ts

@@ -4,7 +4,6 @@ import {
   decideInterviewDelivery,
   describeQuestion,
   isRefusedFamily,
-  parseInterviewAnswer,
 } from './interview-responder';
 
 const headless = { hasTty: false, hasBidirectionalRoute: true };
@@ -98,37 +97,6 @@ describe('composeInterviewBody', () => {
   });
 });
 
-describe('parseInterviewAnswer', () => {
-  test('takes everything after the token as the answer', () => {
-    expect(parseInterviewAnswer('K7QM2X www.example.com', 'K7QM2X')).toBe('www.example.com');
-  });
-
-  test('is case-insensitive on the token', () => {
-    expect(parseInterviewAnswer('k7qm2x www.example.com', 'K7QM2X')).toBe('www.example.com');
-  });
-
-  // An answer may legitimately contain spaces and punctuation. Second-guessing
-  // it would corrupt exactly the values that are painful to retype.
-  test('preserves an answer containing spaces and punctuation verbatim', () => {
-    expect(parseInterviewAnswer('K7QM2X my value: with, punctuation', 'K7QM2X')).toBe(
-      'my value: with, punctuation',
-    );
-  });
-
-  test('an answer that looks like a verb is still an answer', () => {
-    expect(parseInterviewAnswer('K7QM2X resolve', 'K7QM2X')).toBe('resolve');
-  });
-
-  test('a token with no value is not an answer', () => {
-    expect(parseInterviewAnswer('K7QM2X', 'K7QM2X')).toBeNull();
-    expect(parseInterviewAnswer('K7QM2X   ', 'K7QM2X')).toBeNull();
-  });
-
-  test('a different token does not match', () => {
-    expect(parseInterviewAnswer('ZZZZZZ value', 'K7QM2X')).toBeNull();
-  });
-});
-
 /**
  * The families disagree on payload shape, and reading the wrong field means an
  * operator gets the raw event type instead of the question.

package/src/services/alerting/interview-responder.ts

@@ -136,23 +136,12 @@ export function composeInterviewBody(input: {
   return lines.join('\n');
 }
 
-/**
- * Extract the answer from an inbound reply.
- *
- * Everything after the token is the value, verbatim and unparsed — an answer
- * may legitimately contain spaces, punctuation, or something that looks like a
- * verb, and second-guessing it would corrupt exactly the values an operator
- * cannot easily retype.
- */
-export function parseInterviewAnswer(body: string, token: string): string | null {
-  const trimmed = body.trim();
-  const upper = trimmed.toUpperCase();
-  const normalisedToken = token.toUpperCase();
-  if (!upper.startsWith(normalisedToken)) return null;
-
-  const answer = trimmed.slice(token.length).trim();
-  return answer.length > 0 ? answer : null;
-}
+// `parseInterviewAnswer` lived here and is gone. It was correct and had the
+// tests to prove it, and it was never reachable: the caller only ran it for a
+// body the ALERT grammar had already accepted, which no real answer ever was
+// (#533). Extraction now happens in `interpretInbound` — the one place that
+// knows a delivery's kind before it parses — so the reply grammar exists once
+// rather than in two halves that could disagree.
 
 /** Severity an interview question is delivered at — never a page-worthy one. */
 export const INTERVIEW_SEVERITY: AlertSeverity = 'warning';

package/src/services/alerting/notify-deps.ts

@@ -0,0 +1,113 @@
+/**
+ * Resolving an alert to the people it should page.
+ *
+ * The escalation policy is a property of the MONITOR, and it is read here on
+ * every sweep rather than copied onto the alert when the alert is created.
+ * That ordering is the whole point: an operator only reaches for
+ * `escalation-policy assign` once something is already firing and reaching
+ * nobody, so a policy that only applied to alerts created afterwards would be
+ * a no-op for the one alert they were trying to fix (#481).
+ *
+ * The cost of resolving late is that a policy edited mid-escalation changes
+ * where the remaining steps go. That is the behaviour an operator asks for
+ * when they edit it — the alert's own progress through the chain
+ * (`escalationStep`, `nextEscalationAt`) is what stays on the alert.
+ *
+ * Lives here rather than in the sweep command so the sweep's tests can drive
+ * the real resolution instead of a fake, which is how the snapshot bug
+ * survived: every existing test stubbed `notifyDepsFor`.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { type Alert, type EscalationPolicy, escalationPolicies, monitors } from '../../db/schema';
+import type { NotifyDeps } from './notifier';
+import { listPeople, listPolicySteps, listRoutes } from './people';
+import { mintDelivery } from './tokens';
+import { loadNotificationTransport } from './transport-loader';
+
+/**
+ * How long a reply token stays valid. A day is long enough that someone who
+ * sees a page overnight can still act on it in the morning, and short enough
+ * that a token found later is useless.
+ */
+const TOKEN_TTL_MS = 24 * 60 * 60_000;
+
+/**
+ * The escalation policy an alert resolves to right now, or null.
+ *
+ * The single answer to "who would this page", shared by the sweep and by every
+ * command that has to show it. Two readers computing it separately is how a
+ * CLI ends up confidently reporting a policy the sweep does not use.
+ */
+export function policyForAlert(
+  db: DbClient,
+  alert: Pick<Alert, 'monitorId'>,
+): EscalationPolicy | null {
+  const monitor = db.select().from(monitors).where(eq(monitors.id, alert.monitorId)).get();
+  if (!monitor?.escalationPolicyId) return null;
+  return (
+    db
+      .select()
+      .from(escalationPolicies)
+      .where(eq(escalationPolicies.id, monitor.escalationPolicyId))
+      .get() ?? null
+  );
+}
+
+/**
+ * Assemble everything needed to page for one alert, or null when nobody can be.
+ *
+ * Returning null rather than an empty policy is deliberate: "no escalation
+ * policy assigned" and "policy exists but nobody is eligible" are different
+ * situations, and only the second is worth an escalation decision.
+ */
+export function buildNotifyDeps(db: DbClient, alert: Alert, now: Date): NotifyDeps | null {
+  const policy = policyForAlert(db, alert);
+  if (!policy) return null;
+
+  const steps = listPolicySteps(db, policy.id).map((step) => ({
+    stepIndex: step.stepIndex,
+    routeId: step.routeId,
+    delayMinutes: step.delayMinutes,
+  }));
+  if (steps.length === 0) return null;
+
+  const routeRows = listRoutes(db);
+  const people = listPeople(db);
+
+  return {
+    steps,
+    routes: new Map(
+      routeRows.map((r) => [
+        r.id,
+        { id: r.id, severityFloor: r.severityFloor, enabled: r.enabled },
+      ]),
+    ),
+    routeDetails: new Map(routeRows.map((r) => [r.id, r])),
+    quietHoursByPerson: new Map(
+      people
+        .filter((p) => p.quietHoursStart && p.quietHoursEnd)
+        .map((p) => [
+          p.id,
+          {
+            personId: p.id,
+            start: p.quietHoursStart,
+            end: p.quietHoursEnd,
+            timezone: p.timezone,
+          },
+        ]),
+    ),
+    bypassQuietHours: policy.bypassQuietHours,
+    transportFor: (route) => loadNotificationTransport(db, route.transportModuleId),
+    mintToken: (alertId, routeId) =>
+      mintDelivery(db, {
+        kind: 'alert',
+        targetId: alertId,
+        routeId,
+        now,
+        ttlMs: TOKEN_TTL_MS,
+      }).token,
+    now,
+  };
+}

package/src/services/alerting/run-monitor.ts

@@ -151,7 +151,6 @@ export async function runOneMonitor(
 
   const { createdIds, resolvedIds } = applyReconcileActions(db, actions, {
     monitorId: monitor.id,
-    escalationPolicyId: monitor.escalationPolicyId,
     now,
   });
 

package/src/services/alerting/store.test.ts

@@ -27,7 +27,7 @@ describe('alert store', () => {
   let dir: string;
   let db: DbClient;
 
-  const context = { monitorId: MONITOR, escalationPolicyId: null, now: NOW };
+  const context = { monitorId: MONITOR, now: NOW };
 
   const create = (key: string): ReconcileAction => ({
     type: 'create',

package/src/services/alerting/store.ts

@@ -28,7 +28,6 @@ export function loadLiveAlerts(db: DbClient, monitorId: string): LiveAlert[] {
 
 export interface ApplyContext {
   monitorId: string;
-  escalationPolicyId: string | null;
   now: Date;
 }
 
@@ -66,7 +65,6 @@ export function applyReconcileActions(
           lastSeenAt: context.now,
           graceUntil: action.graceUntil,
           escalationStep: 0,
-          escalationPolicyId: context.escalationPolicyId,
           message: action.message,
           details: action.details,
         })

package/src/services/alerting/sweep-runner.test.ts

@@ -238,7 +238,16 @@ describe('runSweep', () => {
 
       expect(liveAlerts()).toHaveLength(1);
       expect(report.notified).toBe(0);
-      expect(report.noPolicy).toBe(1);
+      expect(report.noPolicy).toEqual([{ alertKey: PORT_CHECK, monitor: MODULE }]);
+    });
+
+    // A count told the operator something was unroutable but not WHICH thing,
+    // so the remedy printed next to it could not be aimed anywhere (#481).
+    test('the unroutable alert is named, along with the monitor to assign to', async () => {
+      const report = await runSweep(db, currentMonitors(), deps());
+
+      expect(report.noPolicy[0].alertKey).toBe(PORT_CHECK);
+      expect(report.noPolicy[0].monitor).toBe(MODULE);
     });
 
     test('escalation declining to notify records WHICH reason', async () => {
@@ -270,7 +279,7 @@ describe('runSweep', () => {
       );
 
       expect(report.notified).toBe(0);
-      expect(report.noPolicy).toBe(0);
+      expect(report.noPolicy).toEqual([]);
       expect(report.skipped.within_grace).toBe(1);
     });
 

package/src/services/alerting/sweep-runner.ts

@@ -63,13 +63,16 @@ export interface SweepReport {
   failed: number;
   /**
    * Live alerts nobody is configured to be told about — no escalation policy on
-   * the monitor, so `notifyDepsFor` returns null.
+   * the monitor, so `notifyDepsFor` returns null. Each carries the monitor that
+   * owns it, which is the thing an operator has to assign a policy TO.
    *
-   * Counted rather than skipped in silence: "nothing needed sending" and "an
-   * alert is firing and no policy points at anyone" are opposite situations that
-   * previously rendered identically as `0 notified`.
+   * Identified rather than merely counted: `1 no-policy` told an operator that
+   * something was unreachable but not WHICH thing, so the remedy the sweep
+   * printed alongside it could not be aimed at anything. Assigning the policy to
+   * all eighteen monitors then changed nothing observable (#481). A bare count
+   * is only half a step better than the silence it replaced.
    */
-  noPolicy: number;
+  noPolicy: { alertKey: string; monitor: string }[];
   /**
    * Deliveries escalation declined, keyed by its reason (`within_grace`,
    * `no_eligible_route`, …).
@@ -113,7 +116,7 @@ export async function runSweep(
     deferred: 0,
     deferredDelivered: 0,
     failed: 0,
-    noPolicy: 0,
+    noPolicy: [],
     skipped: {},
     failures: [],
   };
@@ -206,10 +209,14 @@ export async function runSweep(
   }
 
   // 5. Notify. Re-read: the steps above changed state under us.
+  const monitorTargets = new Map(monitors.map((m) => [m.id, m.target]));
   for (const alert of loadAllLiveAlerts(db)) {
     const notifyDeps = deps.notifyDepsFor(alert);
     if (!notifyDeps) {
-      report.noPolicy++;
+      report.noPolicy.push({
+        alertKey: alert.key,
+        monitor: monitorTargets.get(alert.monitorId) ?? '(unknown monitor)',
+      });
       continue;
     }
 

package/src/services/alerting/tokens.ts

@@ -13,7 +13,7 @@
  */
 
 import { randomInt, randomUUID } from 'node:crypto';
-import { and, eq, gt, isNull } from 'drizzle-orm';
+import { and, eq, gt, isNull, like } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
 import { type NotificationDelivery, notificationDeliveries } from '../../db/schema';
 
@@ -100,6 +100,44 @@ export function findLiveDelivery(
     .get();
 }
 
+/**
+ * Every live delivery whose token STARTS WITH `prefix`.
+ *
+ * An operator typing at 3am should not have to copy six characters exactly.
+ * They need only enough to be unambiguous, and "unambiguous" is scoped to what
+ * is actually outstanding right now — consumed and expired deliveries are not
+ * candidates, so yesterday's tokens cannot make today's prefix ambiguous.
+ *
+ * Returning every match rather than the first is the point: the caller must be
+ * able to tell "no such token" from "you were ambiguous, be more specific".
+ * Silently taking the first match would acknowledge an alert the operator did
+ * not mean, which is worse than asking again.
+ *
+ * The shortening does not weaken authentication in the way it first appears.
+ * The token was never a secret on its own — the sender address is the other
+ * factor and is unaffected — and the search space here is not 32^6 but the
+ * handful of alerts live at this moment.
+ */
+export function findLiveDeliveriesByPrefix(
+  db: DbClient,
+  prefix: string,
+  now: Date,
+): NotificationDelivery[] {
+  const normalised = normaliseToken(prefix);
+  if (!normalised) return [];
+  return db
+    .select()
+    .from(notificationDeliveries)
+    .where(
+      and(
+        like(notificationDeliveries.token, `${normalised}%`),
+        isNull(notificationDeliveries.consumedAt),
+        gt(notificationDeliveries.expiresAt, now),
+      ),
+    )
+    .all();
+}
+
 export function consumeDelivery(db: DbClient, deliveryId: string, now: Date): void {
   db.update(notificationDeliveries)
     .set({ consumedAt: now })

package/src/services/audit/backup-source.ts

@@ -0,0 +1,54 @@
+/**
+ * Reading the roster the backup-freshness check runs against.
+ *
+ * Split out from the check itself so the decision — is this backup too
+ * old — stays pure, while the queries that feed it live here (Rule 2.3).
+ * Shared by `celilo system audit` and by the scheduled `backups` monitor,
+ * so both judge the same fleet from the same data.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { backups, modules } from '../../db/schema';
+import type { ModuleManifest } from '../../manifest/schema';
+import type { InstalledModuleBackupInfo } from './backups';
+
+const DEPLOYED_STATES = ['INSTALLED', 'VERIFIED'];
+
+/**
+ * Most recent COMPLETED backup per module, in epoch ms.
+ *
+ * The `backups` table is added via inline ALTER statements in
+ * db/client.ts for upgraded databases, so a freshly-initialized DB built
+ * from the drizzle journal alone may not have it yet. Absence means "no
+ * backups recorded", never a crashed audit.
+ */
+function latestSuccessfulBackupByModule(db: DbClient): Map<string, number> {
+  const latest = new Map<string, number>();
+  try {
+    for (const backup of db.select().from(backups).where(eq(backups.status, 'completed')).all()) {
+      if (!backup.moduleId || !backup.completedAt) continue;
+      const at = backup.completedAt.getTime();
+      const previous = latest.get(backup.moduleId);
+      if (previous === undefined || at > previous) latest.set(backup.moduleId, at);
+    }
+  } catch {
+    // Table missing — leave the map empty.
+  }
+  return latest;
+}
+
+export function loadBackupAuditInfo(db: DbClient): InstalledModuleBackupInfo[] {
+  const latest = latestSuccessfulBackupByModule(db);
+  return db
+    .select()
+    .from(modules)
+    .all()
+    .filter((module) => DEPLOYED_STATES.includes(module.state))
+    .map((module) => ({
+      id: module.id,
+      state: module.state,
+      manifest: module.manifestData as ModuleManifest,
+      lastSuccessfulBackupAt: latest.get(module.id) ?? null,
+    }));
+}