@celilo/cli 0.23.0 → 0.24.0

package/src/services/alerting/coverage-source.ts

@@ -6,21 +6,18 @@
  * lives here. See Rule 2.3.
  */
 
-import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
-import { modules, monitors } from '../../db/schema';
+import { modules } from '../../db/schema';
 import type { ModuleManifest } from '../../manifest/schema';
+import { loadModuleHealthCadences } from './health-cadence';
 import type { ModuleCoverageInput } from './health-coverage';
 
 export function loadModuleCoverage(db: DbClient): ModuleCoverageInput[] {
-  const monitored = new Set(
-    db
-      .select({ target: monitors.target })
-      .from(monitors)
-      .where(eq(monitors.enabled, true))
-      .all()
-      .map((row) => row.target),
-  );
+  // Coverage now asks the same question the sweep asks — "what is this module's
+  // effective cadence" — rather than "does an enabled monitor row exist". The
+  // row's `enabled` column is `builtin_check`-only, so reading it here would
+  // have reported a module as watched that the sweep had stopped scheduling.
+  const cadences = loadModuleHealthCadences(db);
 
   return db
     .select({ id: modules.id, state: modules.state, manifestData: modules.manifestData })
@@ -32,7 +29,7 @@ export function loadModuleCoverage(db: DbClient): ModuleCoverageInput[] {
         id: module.id,
         state: module.state,
         hasHealthCheckHook: Boolean(manifest.hooks?.health_check),
-        hasEnabledMonitor: monitored.has(module.id),
+        cadence: cadences.get(module.id)?.cadence ?? null,
       };
     });
 }

package/src/services/alerting/deploy-hooks.test.ts

@@ -101,21 +101,30 @@ describe('deploy hooks', () => {
       expect(monitor.intervalMinutes).toBe(15);
     });
 
-    test('a module without an interval gets nothing', () => {
+    // The row carries severity, escalation policy and lastRunAt; WHETHER it
+    // runs comes from the module's effective cadence. So a module with the hook
+    // and no suggested interval still gets a row — otherwise an operator who
+    // sets `health_check_interval` on it would have nothing to schedule against.
+    test('a module with the hook but no interval still gets a row to carry its state', () => {
       addModule('caddy', { hooks: { health_check: { script: 'x' } } });
-      expect(ensureMonitorOnDeploy(db, 'caddy')).toBe(false);
+      expect(ensureMonitorOnDeploy(db, 'caddy')).toBe(true);
+      expect(db.select().from(monitors).all()).toHaveLength(1);
+    });
+
+    test('a module with no health_check hook at all gets nothing', () => {
+      addModule('signal', { hooks: {} });
+      expect(ensureMonitorOnDeploy(db, 'signal')).toBe(false);
       expect(db.select().from(monitors).all()).toEqual([]);
     });
 
-    // The manifest interval is a SUGGESTION. An operator's setting has to
-    // survive module upgrades.
-    test('an existing monitor is never overwritten', () => {
+    // Not because the row protects an operator's setting any more — that lives
+    // in module_configs now — but because a redeploy must not duplicate rows.
+    test('a second deploy does not create a second row', () => {
       addModule('caddy', { hooks: { health_check: { script: 'x', interval: '15m' } } });
       ensureMonitorOnDeploy(db, 'caddy');
-      db.update(monitors).set({ intervalMinutes: 60 }).run();
 
       expect(ensureMonitorOnDeploy(db, 'caddy')).toBe(false);
-      expect(db.select().from(monitors).all()[0].intervalMinutes).toBe(60);
+      expect(db.select().from(monitors).all()).toHaveLength(1);
     });
 
     test('an unknown module does not throw', () => {

package/src/services/alerting/deploy-hooks.ts

@@ -92,10 +92,14 @@ export function modulesInDeployWindow(db: DbClient): Set<string> {
 }
 
 /**
- * Create a monitor for a freshly deployed module that asks for one.
+ * Create the monitor row for a freshly deployed module that declares a
+ * `health_check` hook.
  *
- * Never overwrites: the manifest's interval is the author's suggestion, and an
- * operator's setting must survive module upgrades.
+ * A row for any such module, not only one whose manifest suggests an interval:
+ * the row carries severity, escalation policy and `lastRunAt`, while whether it
+ * runs comes from the module's effective cadence. Without a row, an operator
+ * setting `health_check_interval` on a module whose author named none would
+ * have nothing to schedule against.
  */
 export function ensureMonitorOnDeploy(db: DbClient, moduleId: string): boolean {
   try {
@@ -103,8 +107,10 @@ export function ensureMonitorOnDeploy(db: DbClient, moduleId: string): boolean {
     if (!module) return false;
 
     const manifest = module.manifestData as ModuleManifest;
-    const interval = manifest.hooks?.health_check?.interval;
-    return ensureMonitorForModule(db, moduleId, interval) !== null;
+    const healthCheck = manifest.hooks?.health_check;
+    if (!healthCheck) return false;
+
+    return ensureMonitorForModule(db, moduleId, healthCheck.interval) !== null;
   } catch {
     return false;
   }

package/src/services/alerting/health-cadence.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, test } from 'bun:test';
+import type { ModuleManifest } from '../../manifest/schema';
+import { effectiveHealthCheckCadence, isScheduled } from './health-cadence';
+
+function manifestWith(interval?: string): ModuleManifest {
+  return {
+    hooks: { health_check: { script: './health.ts', ...(interval ? { interval } : {}) } },
+  } as unknown as ModuleManifest;
+}
+
+describe('effectiveHealthCheckCadence', () => {
+  test("the manifest's suggestion applies when nobody has overridden", () => {
+    expect(effectiveHealthCheckCadence(manifestWith('15m'), undefined)).toEqual({ minutes: 15 });
+  });
+
+  test('the operator override wins', () => {
+    expect(effectiveHealthCheckCadence(manifestWith('15m'), '1h')).toEqual({ minutes: 60 });
+  });
+
+  // The failure this whole change exists for: the cadence used to be seeded onto
+  // the monitor row at first deploy and never reconsulted, so an author who
+  // corrected a bad interval never reached an existing install.
+  test('a corrected suggestion reaches an un-overridden module', () => {
+    const before = effectiveHealthCheckCadence(manifestWith('1h'), undefined);
+    const afterUpgrade = effectiveHealthCheckCadence(manifestWith('15m'), undefined);
+
+    expect(before).toEqual({ minutes: 60 });
+    expect(afterUpgrade).toEqual({ minutes: 15 });
+  });
+
+  test('a corrected suggestion does NOT disturb an overridden module', () => {
+    expect(effectiveHealthCheckCadence(manifestWith('15m'), '1h')).toEqual({ minutes: 60 });
+  });
+
+  test('`manual` stops it being scheduled, and is not the same as unset', () => {
+    expect(effectiveHealthCheckCadence(manifestWith('15m'), 'manual')).toBe('manual');
+    expect(isScheduled('manual')).toBe(false);
+    expect(isScheduled(null)).toBe(false);
+    expect(isScheduled({ minutes: 15 })).toBe(true);
+  });
+
+  test('unsetting the override resumes the manifest cadence', () => {
+    // `undefined` is what the accessor sees once the row is deleted.
+    expect(effectiveHealthCheckCadence(manifestWith('15m'), undefined)).toEqual({ minutes: 15 });
+  });
+
+  test('nobody naming a cadence is null — a gap, not an opt-out', () => {
+    expect(effectiveHealthCheckCadence(manifestWith(), undefined)).toBeNull();
+  });
+
+  test('an operator can set a cadence a module never suggested', () => {
+    expect(effectiveHealthCheckCadence(manifestWith(), 'daily')).toEqual({ minutes: 1440 });
+  });
+
+  test('an unparseable override falls back to the manifest rather than going quiet', () => {
+    expect(effectiveHealthCheckCadence(manifestWith('15m'), 'fifteen')).toEqual({ minutes: 15 });
+  });
+});

package/src/services/alerting/health-cadence.ts

@@ -0,0 +1,128 @@
+/**
+ * How often celilo health-checks a module.
+ *
+ * The same shape as the backup cadence, and for the same reason. The manifest's
+ * `hooks.health_check.interval` is the author's SUGGESTION; the operator's
+ * `health_check_interval` override decides; both resolve HERE, at read time.
+ *
+ * What this replaces is worth stating, because it failed silently in both
+ * directions. The cadence used to be seeded onto the `monitors` row at first
+ * deploy and never reconsulted (`monitors.ts` returned early if a row existed),
+ * so an author who corrected a bad interval never reached an existing install,
+ * with nothing an operator could read to discover it. And since nothing ever
+ * wrote `monitors.intervalMinutes` after that insert, an operator's only way to
+ * re-cadence a module was raw SQL against `celilo.db`.
+ *
+ * `manual` means the operator has stopped watching the module. That is a
+ * decision, not a gap: it raises no health-coverage finding, because a finding
+ * asking for the action they just declined is one no action can clear.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { moduleConfigs, modules } from '../../db/schema';
+import type { ModuleManifest } from '../../manifest/schema';
+import { type Cadence, parseCadence } from '../cadence';
+import { getModuleConfigValue, parseStoredConfigValue } from '../module-config';
+import { findMonitor, resolveMonitorAlerts } from './monitors';
+
+/** The `module_configs` key an operator's health-check cadence is stored under. */
+export const HEALTH_CHECK_INTERVAL_CONFIG_KEY = 'health_check_interval';
+
+/**
+ * `null` means NOBODY has said how often — the module is unscheduled and that
+ * is a coverage gap. It is distinct from `'manual'`, which is an operator
+ * saying not to watch it. There is no default: an interval celilo invented
+ * would run someone's health hook on a cadence no one chose.
+ *
+ * An unparseable override falls back to the manifest, the same direction the
+ * backup cadence fails in — values are validated at SET time, so a bad one here
+ * means hand-edited state, and continuing to watch beats going quiet.
+ */
+export function effectiveHealthCheckCadence(
+  manifest: ModuleManifest,
+  override: string | undefined,
+): Cadence | null {
+  if (override !== undefined) {
+    const chosen = parseCadence(override);
+    if (chosen !== null) return chosen;
+  }
+  const suggested = manifest.hooks?.health_check?.interval;
+  if (suggested !== undefined) {
+    const parsed = parseCadence(suggested);
+    if (parsed !== null) return parsed;
+  }
+  return null;
+}
+
+/** Whether a resolved cadence schedules anything at all. */
+export function isScheduled(cadence: Cadence | null): cadence is { minutes: number } {
+  return cadence !== null && cadence !== 'manual';
+}
+
+export interface ModuleHealthCadence {
+  moduleId: string;
+  manifest: ModuleManifest;
+  state: string;
+  cadence: Cadence | null;
+}
+
+/**
+ * Every module's effective health-check cadence, in one pass.
+ *
+ * Read here rather than resolved per call site (Rule 2.3): the alerting sweep,
+ * the coverage check and `monitor list` all need the same answer, and three
+ * queries that could disagree is the shape this change exists to remove.
+ */
+export function loadModuleHealthCadences(db: DbClient): Map<string, ModuleHealthCadence> {
+  const overrides = new Map<string, string>();
+  for (const row of db
+    .select()
+    .from(moduleConfigs)
+    .where(eq(moduleConfigs.key, HEALTH_CHECK_INTERVAL_CONFIG_KEY))
+    .all()) {
+    overrides.set(row.moduleId, String(parseStoredConfigValue(row)));
+  }
+
+  const cadences = new Map<string, ModuleHealthCadence>();
+  for (const module of db.select().from(modules).all()) {
+    const manifest = module.manifestData as ModuleManifest;
+    cadences.set(module.id, {
+      moduleId: module.id,
+      manifest,
+      state: module.state,
+      cadence: effectiveHealthCheckCadence(manifest, overrides.get(module.id)),
+    });
+  }
+  return cadences;
+}
+
+/**
+ * Bring a module's watch state into line with its effective cadence.
+ *
+ * Only one direction needs doing: a module that has just become `manual` may
+ * still own live alerts from its last scheduled runs, and nothing will ever
+ * report on them again — they would sit firing forever with no operator action
+ * able to clear them. This resolves them, the way disabling a monitor always
+ * has.
+ *
+ * Idempotent, and safe to call when nothing changed. Called wherever a
+ * `health_check_interval` override is written: `module config set`/`unset`, and
+ * the migrate step.
+ */
+export function reconcileModuleWatchState(db: DbClient, moduleId: string, now: Date): number {
+  const monitor = findMonitor(db, 'module_hook', moduleId);
+  if (!monitor) return 0;
+
+  const module = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+  if (!module) return 0;
+
+  const override = getModuleConfigValue(moduleId, HEALTH_CHECK_INTERVAL_CONFIG_KEY, db);
+  const cadence = effectiveHealthCheckCadence(
+    module.manifestData as ModuleManifest,
+    override === null ? undefined : String(override.value),
+  );
+  if (isScheduled(cadence)) return 0;
+
+  return resolveMonitorAlerts(db, monitor.id, now);
+}

package/src/services/alerting/health-coverage.ts

@@ -10,7 +10,13 @@
  *
  * Two ways that happens, and both are worth saying out loud:
  *   - the module ships no `health_check` hook, so it can never be verified;
- *   - it has one, but no enabled monitor schedules it.
+ *   - it has one, but nothing gives it a cadence, so nothing schedules it.
+ *
+ * An effective cadence of `manual` raises NOTHING. The check exists to catch
+ * blindness nobody chose; `manual` is a recorded decision, visible in `module
+ * status` and removable with one command. A finding raised by an operator's
+ * explicit opt-out asks for the action they just declined, so no action of
+ * theirs could ever clear it.
  *
  * Deliberately cheap: this reads the module roster against the monitor set and
  * contacts nothing. It is safe to run on every sweep.
@@ -19,6 +25,8 @@
  */
 
 import type { ModuleState } from '../../db/schema';
+import type { Cadence } from '../cadence';
+import { isScheduled } from './health-cadence';
 import { type FailingKey, builtinAlertKey } from './keys';
 
 export const HEALTH_COVERAGE_CHECK = 'health_coverage';
@@ -35,8 +43,11 @@ export interface ModuleCoverageInput {
   state: ModuleState;
   /** Whether the manifest declares a `health_check` hook at all. */
   hasHealthCheckHook: boolean;
-  /** Whether an ENABLED monitor schedules that hook. */
-  hasEnabledMonitor: boolean;
+  /**
+   * The module's effective health-check cadence: `null` when nobody has named
+   * one (a gap), `'manual'` when the operator opted out (a decision).
+   */
+  cadence: Cadence | null;
 }
 
 /**
@@ -65,15 +76,14 @@ export function healthCoverageFailingKeys(modules: ModuleCoverageInput[]): Faili
       continue;
     }
 
-    if (!module.hasEnabledMonitor) {
+    if (module.cadence === 'manual') continue;
+
+    if (!isScheduled(module.cadence)) {
       failing.push({
         key,
         severity: 'warning',
         message: `${module.id} has a health_check hook but nothing schedules it`,
-        details:
-          'The module can be verified on demand but is not being watched.\n' +
-          'Create a monitor for it, or set hooks.health_check.interval in the\n' +
-          'module manifest so one is created on deploy.',
+        details: `The module can be verified on demand but is not being watched.\nGive it a cadence:  celilo module config set ${module.id} health_check_interval 15m\nor set hooks.health_check.interval in the module manifest.`,
       });
     }
   }

package/src/services/alerting/monitors.ts

@@ -1,10 +1,20 @@
 /**
  * Monitor CRUD.
  *
- * A monitor binds a thing to check to a cadence, a severity, and an escalation
- * policy. Operators address them by their target (`caddy`,
- * `machines_reachable`) rather than by id — per CLAUDE.md, a UUID never
- * reaches the operator.
+ * A monitor binds a thing to check to a severity and an escalation policy.
+ * Operators address them by their target (`caddy`, `machines_reachable`) rather
+ * than by id — per CLAUDE.md, a UUID never reaches the operator.
+ *
+ * ⚠️ `intervalMinutes` and `enabled` are meaningful for `builtin_check` rows
+ * ONLY. A built-in check targets a fleet-level audit category with no module
+ * and no manifest, so nothing suggests its cadence and the row legitimately IS
+ * the config. A `module_hook` row targets a module whose manifest MAY suggest
+ * one, so its cadence and whether it is watched at all resolve at read time
+ * from `health_check_interval` — see [[services/alerting/health-cadence.ts]].
+ * Two columns whose meaning depends on `kind` is a smell, named here rather
+ * than discovered in review (design.md D8); the alternatives are a resolved
+ * value cached on the row, which rots, or splitting the table, which needs a
+ * synthetic monitor identity for `alerts.monitorId` and friends.
  */
 
 import { randomUUID } from 'node:crypto';
@@ -17,11 +27,12 @@ import {
   alerts,
   monitors,
 } from '../../db/schema';
-import { parseIntervalMinutes } from '../../manifest/schema';
+import { ALERTING_SWEEP_PATTERN, MONITOR_INTERVAL_FLOOR_MINUTES, parseCadence } from '../cadence';
 
 export interface CreateMonitorInput {
   kind: MonitorKind;
   target: string;
+  /** `builtin_check` only. Not consulted for `module_hook` — see the file header. */
   intervalMinutes: number;
   severity?: AlertSeverity;
   suppressible?: boolean;
@@ -69,29 +80,50 @@ export function createMonitor(db: DbClient, input: CreateMonitorInput): Monitor
 }
 
 /**
- * Ensure a monitor exists for a module that declares a suggested interval.
+ * Ensure a `module_hook` monitor row exists for a module that declares a
+ * `health_check` hook.
+ *
+ * The row is no longer where the cadence lives — it carries severity, the
+ * escalation policy and `lastRunAt`, and whether it runs at all is resolved
+ * from the module's effective cadence at sweep time. So it is created for any
+ * module with the hook, not only for one whose manifest happens to suggest an
+ * interval: an operator can now set a cadence on a module whose author never
+ * named one, and without a row there would be nothing to carry its last run.
  *
- * Called on deploy. Never overwrites an existing monitor: the manifest's
- * interval is the author's SUGGESTION and the operator's setting must survive
- * module upgrades, so a second call is a no-op rather than a reset.
+ * The stored `intervalMinutes` is the manifest's suggestion where there is one,
+ * and is NOT read back for this kind. It is written so that rolling back to a
+ * release which does read it behaves as it did before.
  *
- * Returns the monitor when one was created, null when one already existed or
- * the manifest declares no interval.
+ * Idempotent: a second call is a no-op, which is what keeps deploys from
+ * duplicating rows. It is no longer what protects an operator's setting — that
+ * lives in `module_configs` now and cannot be overwritten from here at all.
  */
 export function ensureMonitorForModule(
   db: DbClient,
   moduleId: string,
   suggestedInterval: string | undefined,
 ): Monitor | null {
-  if (!suggestedInterval) return null;
   if (findMonitor(db, 'module_hook', moduleId)) return null;
 
-  const intervalMinutes = parseIntervalMinutes(suggestedInterval);
-  if (intervalMinutes === null) return null;
+  const suggested = suggestedInterval ? parseCadence(suggestedInterval) : null;
+  const intervalMinutes =
+    suggested !== null && suggested !== 'manual'
+      ? suggested.minutes
+      : MONITOR_INTERVAL_FLOOR_MINUTES;
 
   return createMonitor(db, { kind: 'module_hook', target: moduleId, intervalMinutes });
 }
 
+/**
+ * Change a `builtin_check` monitor's cadence in place.
+ *
+ * In place, rather than remove-and-recreate, because the monitor id owns the
+ * alert history: recreating it would orphan every live alert it raised.
+ */
+export function updateMonitorInterval(db: DbClient, monitorId: string, minutes: number): void {
+  db.update(monitors).set({ intervalMinutes: minutes }).where(eq(monitors.id, monitorId)).run();
+}
+
 /**
  * Enable or disable a monitor.
  *
@@ -139,7 +171,10 @@ export function resolveMonitorAlerts(db: DbClient, monitorId: string, now: Date)
  * what switches on the sweep.
  */
 export const ALERTING_SWEEP_SUBSCRIBER = 'celilo-alerting-sweep';
-export const ALERTING_SWEEP_PATTERN = 'timer.tick.5m';
+// The tick itself lives in services/cadence.ts, next to the floor derived from
+// it — a sweep whose tick and whose finest servable cadence are stated in two
+// files is the pair that drifts.
+export { ALERTING_SWEEP_PATTERN };
 
 export interface SubscriberRegistrar {
   subscribe(options: {

package/src/services/alerting/sweep-runner.test.ts

@@ -4,9 +4,11 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
-import { type Alert, type Monitor, alerts, monitors } from '../../db/schema';
+import { type Alert, type Monitor, alerts, modules, monitors } from '../../db/schema';
 import { setupTestDatabase } from '../../test-utils/setup-test-db';
 import type { HealthCheckResult } from '../health-runner';
+import { deleteModuleConfig, upsertModuleConfig } from '../module-config';
+import { HEALTH_CHECK_INTERVAL_CONFIG_KEY, reconcileModuleWatchState } from './health-cadence';
 import { moduleCheckAlertKey } from './keys';
 import type { MonitorRunDeps } from './run-monitor';
 import { type SuppressionTopology, machineAlertKey } from './suppression';
@@ -67,6 +69,21 @@ describe('runSweep', () => {
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
     db = await setupTestDatabase(dbPath);
+    // The module row is load-bearing now: a `module_hook` monitor's cadence
+    // resolves from the module's manifest and config, not from its own row.
+    db.insert(modules)
+      .values({
+        id: MODULE,
+        name: MODULE,
+        sourcePath: dir,
+        version: '1.0.0',
+        state: 'INSTALLED',
+        manifestData: {
+          id: MODULE,
+          hooks: { health_check: { script: './h.ts', interval: '15m' } },
+        },
+      })
+      .run();
     db.insert(monitors)
       .values({
         id: 'mon-1',
@@ -117,11 +134,42 @@ describe('runSweep', () => {
     expect(report.monitorsRun).toBe(0);
   });
 
-  test('a disabled monitor is never run', async () => {
+  // `enabled` and `intervalMinutes` are builtin_check-only now (design.md D8).
+  // A future reader that reintroduces the dependency on the row fails here
+  // rather than silently regressing to write-time resolution.
+  test("a module monitor's stored enabled flag is not consulted", async () => {
     db.update(monitors).set({ enabled: false }).where(eq(monitors.id, 'mon-1')).run();
     const report = await runSweep(db, currentMonitors(), deps());
+    expect(report.monitorsRun).toBe(1);
+  });
+
+  test("a module monitor's stored interval is not consulted", async () => {
+    // The row says a full day; the manifest says 15m, which is what wins.
+    db.update(monitors).set({ intervalMinutes: 1440 }).where(eq(monitors.id, 'mon-1')).run();
+    await runSweep(db, currentMonitors(), deps());
+    const report = await runSweep(db, currentMonitors(), deps({}, failing, later(20)));
+    expect(report.monitorsRun).toBe(1);
+  });
+
+  test('a module whose effective cadence is manual is never run, and its alerts resolve', async () => {
+    await runSweep(db, currentMonitors(), deps());
+    expect(liveAlerts()).not.toEqual([]);
+
+    upsertModuleConfig(db, MODULE, HEALTH_CHECK_INTERVAL_CONFIG_KEY, 'manual');
+    reconcileModuleWatchState(db, MODULE, later(20));
+
+    const report = await runSweep(db, currentMonitors(), deps({}, failing, later(20)));
     expect(report.monitorsRun).toBe(0);
-    expect(liveAlerts()).toEqual([]);
+    expect(liveAlerts().every((a) => a.state === 'resolved')).toBe(true);
+  });
+
+  test('unsetting the override resumes watching', async () => {
+    upsertModuleConfig(db, MODULE, HEALTH_CHECK_INTERVAL_CONFIG_KEY, 'manual');
+    expect((await runSweep(db, currentMonitors(), deps())).monitorsRun).toBe(0);
+
+    deleteModuleConfig(db, MODULE, HEALTH_CHECK_INTERVAL_CONFIG_KEY);
+    const report = await runSweep(db, currentMonitors(), deps({}, failing, later(20)));
+    expect(report.monitorsRun).toBe(1);
   });
 
   test('recovery resolves the alert on a later sweep', async () => {

package/src/services/alerting/sweep-runner.ts

@@ -21,6 +21,8 @@
 
 import type { DbClient } from '../../db/client';
 import type { Alert, Monitor } from '../../db/schema';
+import { MONITOR_INTERVAL_FLOOR_MINUTES } from '../cadence';
+import { isScheduled, loadModuleHealthCadences } from './health-cadence';
 import type { NotifyDeps, NotifyOutcome } from './notifier';
 import { deliverDeferred, notifyAlert } from './notifier';
 import { type MonitorRunDeps, runOneMonitor } from './run-monitor';
@@ -124,14 +126,35 @@ export async function runSweep(
   };
 
   // 1. Run due monitors.
+  //
+  // A `module_hook` monitor's cadence and whether it is watched at all come
+  // from the module's effective health-check cadence, NOT from its row: the row
+  // was seeded once at first deploy and never reconsulted, so a corrected
+  // manifest could never reach an existing install (design.md D2/D8). A
+  // `builtin_check` has no module and no manifest, so its row is the config.
+  const cadences = loadModuleHealthCadences(db);
   const due = selectDueMonitors(
-    monitors.map((m) => ({
-      id: m.id,
-      intervalMinutes: m.intervalMinutes,
-      enabled: m.enabled,
-      lastRunAt: m.lastRunAt,
-      monitor: m,
-    })),
+    monitors.map((m) => {
+      if (m.kind !== 'module_hook') {
+        return {
+          id: m.id,
+          intervalMinutes: m.intervalMinutes,
+          enabled: m.enabled,
+          lastRunAt: m.lastRunAt,
+          monitor: m,
+        };
+      }
+      const cadence = cadences.get(m.target)?.cadence ?? null;
+      return {
+        id: m.id,
+        // Unscheduled monitors are filtered out by `enabled` below, so this
+        // value is never used to decide due-ness for them.
+        intervalMinutes: isScheduled(cadence) ? cadence.minutes : MONITOR_INTERVAL_FLOOR_MINUTES,
+        enabled: isScheduled(cadence),
+        lastRunAt: m.lastRunAt,
+        monitor: m,
+      };
+    }),
     deps.now(),
   );
 

package/src/services/audit/backup-source.ts

@@ -9,8 +9,10 @@
 
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
-import { backups, modules } from '../../db/schema';
+import { backups, moduleConfigs, modules } from '../../db/schema';
 import type { ModuleManifest } from '../../manifest/schema';
+import { BACKUP_SCHEDULE_CONFIG_KEY } from '../backup-schedule';
+import { parseStoredConfigValue } from '../module-config';
 import type { InstalledModuleBackupInfo } from './backups';
 
 const DEPLOYED_STATES = ['INSTALLED', 'VERIFIED'];
@@ -40,6 +42,7 @@ function latestSuccessfulBackupByModule(db: DbClient): Map<string, number> {
 
 export function loadBackupAuditInfo(db: DbClient): InstalledModuleBackupInfo[] {
   const latest = latestSuccessfulBackupByModule(db);
+  const overrides = backupScheduleOverrides(db);
   return db
     .select()
     .from(modules)
@@ -49,6 +52,26 @@ export function loadBackupAuditInfo(db: DbClient): InstalledModuleBackupInfo[] {
       id: module.id,
       state: module.state,
       manifest: module.manifestData as ModuleManifest,
+      scheduleOverride: overrides.get(module.id),
       lastSuccessfulBackupAt: latest.get(module.id) ?? null,
     }));
 }
+
+/**
+ * Every operator backup-cadence override, by module.
+ *
+ * Read here rather than resolved here: the audit resolves override-against-
+ * manifest through the same accessor the backup sweep uses, so the two cannot
+ * disagree about what a module's cadence is.
+ */
+export function backupScheduleOverrides(db: DbClient): Map<string, string> {
+  const overrides = new Map<string, string>();
+  for (const row of db
+    .select()
+    .from(moduleConfigs)
+    .where(eq(moduleConfigs.key, BACKUP_SCHEDULE_CONFIG_KEY))
+    .all()) {
+    overrides.set(row.moduleId, String(parseStoredConfigValue(row)));
+  }
+  return overrides;
+}