@celilo/cli 0.23.0 → 0.24.1

package/src/services/alerting/health-cadence.ts

@@ -0,0 +1,128 @@
+/**
+ * How often celilo health-checks a module.
+ *
+ * The same shape as the backup cadence, and for the same reason. The manifest's
+ * `hooks.health_check.interval` is the author's SUGGESTION; the operator's
+ * `health_check_interval` override decides; both resolve HERE, at read time.
+ *
+ * What this replaces is worth stating, because it failed silently in both
+ * directions. The cadence used to be seeded onto the `monitors` row at first
+ * deploy and never reconsulted (`monitors.ts` returned early if a row existed),
+ * so an author who corrected a bad interval never reached an existing install,
+ * with nothing an operator could read to discover it. And since nothing ever
+ * wrote `monitors.intervalMinutes` after that insert, an operator's only way to
+ * re-cadence a module was raw SQL against `celilo.db`.
+ *
+ * `manual` means the operator has stopped watching the module. That is a
+ * decision, not a gap: it raises no health-coverage finding, because a finding
+ * asking for the action they just declined is one no action can clear.
+ */
+
+import { eq } from 'drizzle-orm';
+import type { DbClient } from '../../db/client';
+import { moduleConfigs, modules } from '../../db/schema';
+import type { ModuleManifest } from '../../manifest/schema';
+import { type Cadence, parseCadence } from '../cadence';
+import { getModuleConfigValue, parseStoredConfigValue } from '../module-config';
+import { findMonitor, resolveMonitorAlerts } from './monitors';
+
+/** The `module_configs` key an operator's health-check cadence is stored under. */
+export const HEALTH_CHECK_INTERVAL_CONFIG_KEY = 'health_check_interval';
+
+/**
+ * `null` means NOBODY has said how often — the module is unscheduled and that
+ * is a coverage gap. It is distinct from `'manual'`, which is an operator
+ * saying not to watch it. There is no default: an interval celilo invented
+ * would run someone's health hook on a cadence no one chose.
+ *
+ * An unparseable override falls back to the manifest, the same direction the
+ * backup cadence fails in — values are validated at SET time, so a bad one here
+ * means hand-edited state, and continuing to watch beats going quiet.
+ */
+export function effectiveHealthCheckCadence(
+  manifest: ModuleManifest,
+  override: string | undefined,
+): Cadence | null {
+  if (override !== undefined) {
+    const chosen = parseCadence(override);
+    if (chosen !== null) return chosen;
+  }
+  const suggested = manifest.hooks?.health_check?.interval;
+  if (suggested !== undefined) {
+    const parsed = parseCadence(suggested);
+    if (parsed !== null) return parsed;
+  }
+  return null;
+}
+
+/** Whether a resolved cadence schedules anything at all. */
+export function isScheduled(cadence: Cadence | null): cadence is { minutes: number } {
+  return cadence !== null && cadence !== 'manual';
+}
+
+export interface ModuleHealthCadence {
+  moduleId: string;
+  manifest: ModuleManifest;
+  state: string;
+  cadence: Cadence | null;
+}
+
+/**
+ * Every module's effective health-check cadence, in one pass.
+ *
+ * Read here rather than resolved per call site (Rule 2.3): the alerting sweep,
+ * the coverage check and `monitor list` all need the same answer, and three
+ * queries that could disagree is the shape this change exists to remove.
+ */
+export function loadModuleHealthCadences(db: DbClient): Map<string, ModuleHealthCadence> {
+  const overrides = new Map<string, string>();
+  for (const row of db
+    .select()
+    .from(moduleConfigs)
+    .where(eq(moduleConfigs.key, HEALTH_CHECK_INTERVAL_CONFIG_KEY))
+    .all()) {
+    overrides.set(row.moduleId, String(parseStoredConfigValue(row)));
+  }
+
+  const cadences = new Map<string, ModuleHealthCadence>();
+  for (const module of db.select().from(modules).all()) {
+    const manifest = module.manifestData as ModuleManifest;
+    cadences.set(module.id, {
+      moduleId: module.id,
+      manifest,
+      state: module.state,
+      cadence: effectiveHealthCheckCadence(manifest, overrides.get(module.id)),
+    });
+  }
+  return cadences;
+}
+
+/**
+ * Bring a module's watch state into line with its effective cadence.
+ *
+ * Only one direction needs doing: a module that has just become `manual` may
+ * still own live alerts from its last scheduled runs, and nothing will ever
+ * report on them again — they would sit firing forever with no operator action
+ * able to clear them. This resolves them, the way disabling a monitor always
+ * has.
+ *
+ * Idempotent, and safe to call when nothing changed. Called wherever a
+ * `health_check_interval` override is written: `module config set`/`unset`, and
+ * the migrate step.
+ */
+export function reconcileModuleWatchState(db: DbClient, moduleId: string, now: Date): number {
+  const monitor = findMonitor(db, 'module_hook', moduleId);
+  if (!monitor) return 0;
+
+  const module = db.select().from(modules).where(eq(modules.id, moduleId)).get();
+  if (!module) return 0;
+
+  const override = getModuleConfigValue(moduleId, HEALTH_CHECK_INTERVAL_CONFIG_KEY, db);
+  const cadence = effectiveHealthCheckCadence(
+    module.manifestData as ModuleManifest,
+    override === null ? undefined : String(override.value),
+  );
+  if (isScheduled(cadence)) return 0;
+
+  return resolveMonitorAlerts(db, monitor.id, now);
+}

package/src/services/alerting/health-coverage.ts

@@ -10,7 +10,13 @@
  *
  * Two ways that happens, and both are worth saying out loud:
  *   - the module ships no `health_check` hook, so it can never be verified;
- *   - it has one, but no enabled monitor schedules it.
+ *   - it has one, but nothing gives it a cadence, so nothing schedules it.
+ *
+ * An effective cadence of `manual` raises NOTHING. The check exists to catch
+ * blindness nobody chose; `manual` is a recorded decision, visible in `module
+ * status` and removable with one command. A finding raised by an operator's
+ * explicit opt-out asks for the action they just declined, so no action of
+ * theirs could ever clear it.
  *
  * Deliberately cheap: this reads the module roster against the monitor set and
  * contacts nothing. It is safe to run on every sweep.
@@ -19,6 +25,8 @@
  */
 
 import type { ModuleState } from '../../db/schema';
+import type { Cadence } from '../cadence';
+import { isScheduled } from './health-cadence';
 import { type FailingKey, builtinAlertKey } from './keys';
 
 export const HEALTH_COVERAGE_CHECK = 'health_coverage';
@@ -35,8 +43,11 @@ export interface ModuleCoverageInput {
   state: ModuleState;
   /** Whether the manifest declares a `health_check` hook at all. */
   hasHealthCheckHook: boolean;
-  /** Whether an ENABLED monitor schedules that hook. */
-  hasEnabledMonitor: boolean;
+  /**
+   * The module's effective health-check cadence: `null` when nobody has named
+   * one (a gap), `'manual'` when the operator opted out (a decision).
+   */
+  cadence: Cadence | null;
 }
 
 /**
@@ -65,15 +76,14 @@ export function healthCoverageFailingKeys(modules: ModuleCoverageInput[]): Faili
       continue;
     }
 
-    if (!module.hasEnabledMonitor) {
+    if (module.cadence === 'manual') continue;
+
+    if (!isScheduled(module.cadence)) {
       failing.push({
         key,
         severity: 'warning',
         message: `${module.id} has a health_check hook but nothing schedules it`,
-        details:
-          'The module can be verified on demand but is not being watched.\n' +
-          'Create a monitor for it, or set hooks.health_check.interval in the\n' +
-          'module manifest so one is created on deploy.',
+        details: `The module can be verified on demand but is not being watched.\nGive it a cadence:  celilo module config set ${module.id} health_check_interval 15m\nor set hooks.health_check.interval in the module manifest.`,
       });
     }
   }

package/src/services/alerting/monitors.ts

@@ -1,10 +1,20 @@
 /**
  * Monitor CRUD.
  *
- * A monitor binds a thing to check to a cadence, a severity, and an escalation
- * policy. Operators address them by their target (`caddy`,
- * `machines_reachable`) rather than by id — per CLAUDE.md, a UUID never
- * reaches the operator.
+ * A monitor binds a thing to check to a severity and an escalation policy.
+ * Operators address them by their target (`caddy`, `machines_reachable`) rather
+ * than by id — per CLAUDE.md, a UUID never reaches the operator.
+ *
+ * ⚠️ `intervalMinutes` and `enabled` are meaningful for `builtin_check` rows
+ * ONLY. A built-in check targets a fleet-level audit category with no module
+ * and no manifest, so nothing suggests its cadence and the row legitimately IS
+ * the config. A `module_hook` row targets a module whose manifest MAY suggest
+ * one, so its cadence and whether it is watched at all resolve at read time
+ * from `health_check_interval` — see [[services/alerting/health-cadence.ts]].
+ * Two columns whose meaning depends on `kind` is a smell, named here rather
+ * than discovered in review (design.md D8); the alternatives are a resolved
+ * value cached on the row, which rots, or splitting the table, which needs a
+ * synthetic monitor identity for `alerts.monitorId` and friends.
  */
 
 import { randomUUID } from 'node:crypto';
@@ -17,11 +27,12 @@ import {
   alerts,
   monitors,
 } from '../../db/schema';
-import { parseIntervalMinutes } from '../../manifest/schema';
+import { ALERTING_SWEEP_PATTERN, MONITOR_INTERVAL_FLOOR_MINUTES, parseCadence } from '../cadence';
 
 export interface CreateMonitorInput {
   kind: MonitorKind;
   target: string;
+  /** `builtin_check` only. Not consulted for `module_hook` — see the file header. */
   intervalMinutes: number;
   severity?: AlertSeverity;
   suppressible?: boolean;
@@ -69,29 +80,50 @@ export function createMonitor(db: DbClient, input: CreateMonitorInput): Monitor
 }
 
 /**
- * Ensure a monitor exists for a module that declares a suggested interval.
+ * Ensure a `module_hook` monitor row exists for a module that declares a
+ * `health_check` hook.
+ *
+ * The row is no longer where the cadence lives — it carries severity, the
+ * escalation policy and `lastRunAt`, and whether it runs at all is resolved
+ * from the module's effective cadence at sweep time. So it is created for any
+ * module with the hook, not only for one whose manifest happens to suggest an
+ * interval: an operator can now set a cadence on a module whose author never
+ * named one, and without a row there would be nothing to carry its last run.
  *
- * Called on deploy. Never overwrites an existing monitor: the manifest's
- * interval is the author's SUGGESTION and the operator's setting must survive
- * module upgrades, so a second call is a no-op rather than a reset.
+ * The stored `intervalMinutes` is the manifest's suggestion where there is one,
+ * and is NOT read back for this kind. It is written so that rolling back to a
+ * release which does read it behaves as it did before.
  *
- * Returns the monitor when one was created, null when one already existed or
- * the manifest declares no interval.
+ * Idempotent: a second call is a no-op, which is what keeps deploys from
+ * duplicating rows. It is no longer what protects an operator's setting — that
+ * lives in `module_configs` now and cannot be overwritten from here at all.
  */
 export function ensureMonitorForModule(
   db: DbClient,
   moduleId: string,
   suggestedInterval: string | undefined,
 ): Monitor | null {
-  if (!suggestedInterval) return null;
   if (findMonitor(db, 'module_hook', moduleId)) return null;
 
-  const intervalMinutes = parseIntervalMinutes(suggestedInterval);
-  if (intervalMinutes === null) return null;
+  const suggested = suggestedInterval ? parseCadence(suggestedInterval) : null;
+  const intervalMinutes =
+    suggested !== null && suggested !== 'manual'
+      ? suggested.minutes
+      : MONITOR_INTERVAL_FLOOR_MINUTES;
 
   return createMonitor(db, { kind: 'module_hook', target: moduleId, intervalMinutes });
 }
 
+/**
+ * Change a `builtin_check` monitor's cadence in place.
+ *
+ * In place, rather than remove-and-recreate, because the monitor id owns the
+ * alert history: recreating it would orphan every live alert it raised.
+ */
+export function updateMonitorInterval(db: DbClient, monitorId: string, minutes: number): void {
+  db.update(monitors).set({ intervalMinutes: minutes }).where(eq(monitors.id, monitorId)).run();
+}
+
 /**
  * Enable or disable a monitor.
  *
@@ -139,7 +171,10 @@ export function resolveMonitorAlerts(db: DbClient, monitorId: string, now: Date)
  * what switches on the sweep.
  */
 export const ALERTING_SWEEP_SUBSCRIBER = 'celilo-alerting-sweep';
-export const ALERTING_SWEEP_PATTERN = 'timer.tick.5m';
+// The tick itself lives in services/cadence.ts, next to the floor derived from
+// it — a sweep whose tick and whose finest servable cadence are stated in two
+// files is the pair that drifts.
+export { ALERTING_SWEEP_PATTERN };
 
 export interface SubscriberRegistrar {
   subscribe(options: {

package/src/services/alerting/sweep-runner.test.ts

@@ -4,9 +4,11 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
-import { type Alert, type Monitor, alerts, monitors } from '../../db/schema';
+import { type Alert, type Monitor, alerts, modules, monitors } from '../../db/schema';
 import { setupTestDatabase } from '../../test-utils/setup-test-db';
 import type { HealthCheckResult } from '../health-runner';
+import { deleteModuleConfig, upsertModuleConfig } from '../module-config';
+import { HEALTH_CHECK_INTERVAL_CONFIG_KEY, reconcileModuleWatchState } from './health-cadence';
 import { moduleCheckAlertKey } from './keys';
 import type { MonitorRunDeps } from './run-monitor';
 import { type SuppressionTopology, machineAlertKey } from './suppression';
@@ -67,6 +69,21 @@ describe('runSweep', () => {
     const dbPath = join(dir, 'celilo.db');
     process.env.CELILO_DB_PATH = dbPath;
     db = await setupTestDatabase(dbPath);
+    // The module row is load-bearing now: a `module_hook` monitor's cadence
+    // resolves from the module's manifest and config, not from its own row.
+    db.insert(modules)
+      .values({
+        id: MODULE,
+        name: MODULE,
+        sourcePath: dir,
+        version: '1.0.0',
+        state: 'INSTALLED',
+        manifestData: {
+          id: MODULE,
+          hooks: { health_check: { script: './h.ts', interval: '15m' } },
+        },
+      })
+      .run();
     db.insert(monitors)
       .values({
         id: 'mon-1',
@@ -117,11 +134,42 @@ describe('runSweep', () => {
     expect(report.monitorsRun).toBe(0);
   });
 
-  test('a disabled monitor is never run', async () => {
+  // `enabled` and `intervalMinutes` are builtin_check-only now (design.md D8).
+  // A future reader that reintroduces the dependency on the row fails here
+  // rather than silently regressing to write-time resolution.
+  test("a module monitor's stored enabled flag is not consulted", async () => {
     db.update(monitors).set({ enabled: false }).where(eq(monitors.id, 'mon-1')).run();
     const report = await runSweep(db, currentMonitors(), deps());
+    expect(report.monitorsRun).toBe(1);
+  });
+
+  test("a module monitor's stored interval is not consulted", async () => {
+    // The row says a full day; the manifest says 15m, which is what wins.
+    db.update(monitors).set({ intervalMinutes: 1440 }).where(eq(monitors.id, 'mon-1')).run();
+    await runSweep(db, currentMonitors(), deps());
+    const report = await runSweep(db, currentMonitors(), deps({}, failing, later(20)));
+    expect(report.monitorsRun).toBe(1);
+  });
+
+  test('a module whose effective cadence is manual is never run, and its alerts resolve', async () => {
+    await runSweep(db, currentMonitors(), deps());
+    expect(liveAlerts()).not.toEqual([]);
+
+    upsertModuleConfig(db, MODULE, HEALTH_CHECK_INTERVAL_CONFIG_KEY, 'manual');
+    reconcileModuleWatchState(db, MODULE, later(20));
+
+    const report = await runSweep(db, currentMonitors(), deps({}, failing, later(20)));
     expect(report.monitorsRun).toBe(0);
-    expect(liveAlerts()).toEqual([]);
+    expect(liveAlerts().every((a) => a.state === 'resolved')).toBe(true);
+  });
+
+  test('unsetting the override resumes watching', async () => {
+    upsertModuleConfig(db, MODULE, HEALTH_CHECK_INTERVAL_CONFIG_KEY, 'manual');
+    expect((await runSweep(db, currentMonitors(), deps())).monitorsRun).toBe(0);
+
+    deleteModuleConfig(db, MODULE, HEALTH_CHECK_INTERVAL_CONFIG_KEY);
+    const report = await runSweep(db, currentMonitors(), deps({}, failing, later(20)));
+    expect(report.monitorsRun).toBe(1);
   });
 
   test('recovery resolves the alert on a later sweep', async () => {

package/src/services/alerting/sweep-runner.ts

@@ -21,6 +21,8 @@
 
 import type { DbClient } from '../../db/client';
 import type { Alert, Monitor } from '../../db/schema';
+import { MONITOR_INTERVAL_FLOOR_MINUTES } from '../cadence';
+import { isScheduled, loadModuleHealthCadences } from './health-cadence';
 import type { NotifyDeps, NotifyOutcome } from './notifier';
 import { deliverDeferred, notifyAlert } from './notifier';
 import { type MonitorRunDeps, runOneMonitor } from './run-monitor';
@@ -124,14 +126,35 @@ export async function runSweep(
   };
 
   // 1. Run due monitors.
+  //
+  // A `module_hook` monitor's cadence and whether it is watched at all come
+  // from the module's effective health-check cadence, NOT from its row: the row
+  // was seeded once at first deploy and never reconsulted, so a corrected
+  // manifest could never reach an existing install (design.md D2/D8). A
+  // `builtin_check` has no module and no manifest, so its row is the config.
+  const cadences = loadModuleHealthCadences(db);
   const due = selectDueMonitors(
-    monitors.map((m) => ({
-      id: m.id,
-      intervalMinutes: m.intervalMinutes,
-      enabled: m.enabled,
-      lastRunAt: m.lastRunAt,
-      monitor: m,
-    })),
+    monitors.map((m) => {
+      if (m.kind !== 'module_hook') {
+        return {
+          id: m.id,
+          intervalMinutes: m.intervalMinutes,
+          enabled: m.enabled,
+          lastRunAt: m.lastRunAt,
+          monitor: m,
+        };
+      }
+      const cadence = cadences.get(m.target)?.cadence ?? null;
+      return {
+        id: m.id,
+        // Unscheduled monitors are filtered out by `enabled` below, so this
+        // value is never used to decide due-ness for them.
+        intervalMinutes: isScheduled(cadence) ? cadence.minutes : MONITOR_INTERVAL_FLOOR_MINUTES,
+        enabled: isScheduled(cadence),
+        lastRunAt: m.lastRunAt,
+        monitor: m,
+      };
+    }),
     deps.now(),
   );
 

package/src/services/audit/backup-source.ts

@@ -9,8 +9,10 @@
 
 import { eq } from 'drizzle-orm';
 import type { DbClient } from '../../db/client';
-import { backups, modules } from '../../db/schema';
+import { backups, moduleConfigs, modules } from '../../db/schema';
 import type { ModuleManifest } from '../../manifest/schema';
+import { BACKUP_SCHEDULE_CONFIG_KEY } from '../backup-schedule';
+import { parseStoredConfigValue } from '../module-config';
 import type { InstalledModuleBackupInfo } from './backups';
 
 const DEPLOYED_STATES = ['INSTALLED', 'VERIFIED'];
@@ -40,6 +42,7 @@ function latestSuccessfulBackupByModule(db: DbClient): Map<string, number> {
 
 export function loadBackupAuditInfo(db: DbClient): InstalledModuleBackupInfo[] {
   const latest = latestSuccessfulBackupByModule(db);
+  const overrides = backupScheduleOverrides(db);
   return db
     .select()
     .from(modules)
@@ -49,6 +52,26 @@ export function loadBackupAuditInfo(db: DbClient): InstalledModuleBackupInfo[] {
       id: module.id,
       state: module.state,
       manifest: module.manifestData as ModuleManifest,
+      scheduleOverride: overrides.get(module.id),
       lastSuccessfulBackupAt: latest.get(module.id) ?? null,
     }));
 }
+
+/**
+ * Every operator backup-cadence override, by module.
+ *
+ * Read here rather than resolved here: the audit resolves override-against-
+ * manifest through the same accessor the backup sweep uses, so the two cannot
+ * disagree about what a module's cadence is.
+ */
+export function backupScheduleOverrides(db: DbClient): Map<string, string> {
+  const overrides = new Map<string, string>();
+  for (const row of db
+    .select()
+    .from(moduleConfigs)
+    .where(eq(moduleConfigs.key, BACKUP_SCHEDULE_CONFIG_KEY))
+    .all()) {
+    overrides.set(row.moduleId, String(parseStoredConfigValue(row)));
+  }
+  return overrides;
+}

package/src/services/audit/backups.test.ts

@@ -1,19 +1,19 @@
 import { describe, expect, test } from 'bun:test';
 import type { ModuleManifest } from '../../manifest/schema';
-import { type InstalledModuleBackupInfo, auditBackups } from './backups';
+import { parseCadence } from '../cadence';
+import { type InstalledModuleBackupInfo, auditBackups, backupStaleThresholdMs } from './backups';
 
 const NOW = new Date('2026-04-25T00:00:00Z').getTime();
 const HOUR = 60 * 60 * 1000;
 const ONE_DAY = 24 * HOUR;
 
-type Schedule = 'hourly' | 'daily' | 'weekly' | 'monthly' | 'manual';
-
 function makeModule(
   id: string,
   opts: {
     hasBackupHook: boolean;
     lastSuccessfulBackupAt: number | null;
-    schedule?: Schedule;
+    schedule?: string;
+    scheduleOverride?: string;
   },
 ): InstalledModuleBackupInfo {
   const manifest = {
@@ -27,9 +27,42 @@ function makeModule(
   // Default to INSTALLED — existing tests assert backup findings
   // fire, which is the deployed-module behavior. Tests for the
   // non-deployed-skip behavior override this explicitly.
-  return { id, state: 'INSTALLED', manifest, lastSuccessfulBackupAt: opts.lastSuccessfulBackupAt };
+  return {
+    id,
+    state: 'INSTALLED',
+    manifest,
+    scheduleOverride: opts.scheduleOverride,
+    lastSuccessfulBackupAt: opts.lastSuccessfulBackupAt,
+  };
 }
 
+describe('backupStaleThresholdMs', () => {
+  function cadence(value: string) {
+    const parsed = parseCadence(value);
+    if (parsed === null) throw new Error(`test fixture is not a cadence: ${value}`);
+    return parsed;
+  }
+
+  // The four values the change's release note promises. A table could not
+  // answer for `6h`, so these come out of `cadence + max(1h, cadence × 0.1)`;
+  // `weekly` is the only one that now alerts EARLIER than it used to (8d).
+  test('the four documented thresholds', () => {
+    expect(backupStaleThresholdMs(cadence('hourly'))).toBe(2 * HOUR);
+    expect(backupStaleThresholdMs(cadence('daily'))).toBe(26.4 * HOUR);
+    expect(backupStaleThresholdMs(cadence('weekly'))).toBe(7.7 * ONE_DAY);
+    expect(backupStaleThresholdMs(cadence('monthly'))).toBe(33 * ONE_DAY);
+  });
+
+  test('a custom duration has a defined threshold', () => {
+    expect(backupStaleThresholdMs(cadence('6h'))).toBe(7 * HOUR);
+    expect(backupStaleThresholdMs(cadence('90m'))).toBe(90 * 60_000 + HOUR);
+  });
+
+  test('manual has none — an opted-out module is never stale', () => {
+    expect(backupStaleThresholdMs('manual')).toBeNull();
+  });
+});
+
 describe('auditBackups', () => {
   test('skips modules without an on_backup hook', async () => {
     const result = await auditBackups({
@@ -39,7 +72,10 @@ describe('auditBackups', () => {
     expect(result).toEqual([]);
   });
 
-  test('reports missing backup regardless of schedule (still want at least one)', async () => {
+  // A module opted out of scheduled backups used to be reported as missing one
+  // forever: the never-backed-up check fired BEFORE the manual check, and the
+  // only remediation offered was the very thing the operator declined.
+  test('a module opted out is not reported as missing a backup', async () => {
     const result = await auditBackups({
       modules: [
         makeModule('lunacycle', {
@@ -51,14 +87,63 @@ describe('auditBackups', () => {
       now: () => NOW,
     });
 
+    expect(result).toEqual([]);
+  });
+
+  test('a module that has NOT opted out is still reported as missing a backup', async () => {
+    const result = await auditBackups({
+      modules: [
+        makeModule('authentik', {
+          hasBackupHook: true,
+          lastSuccessfulBackupAt: null,
+          schedule: 'daily',
+        }),
+      ],
+      now: () => NOW,
+    });
+
     expect(result).toHaveLength(1);
     expect(result[0]).toMatchObject({
       category: 'backups',
       severity: 'drift',
       code: 'backup_missing',
-      subject: 'lunacycle',
+      subject: 'authentik',
+    });
+  });
+
+  test("an operator's manual override silences a module the manifest wanted backed up", async () => {
+    const result = await auditBackups({
+      modules: [
+        makeModule('authentik', {
+          hasBackupHook: true,
+          lastSuccessfulBackupAt: null,
+          schedule: 'daily',
+          scheduleOverride: 'manual',
+        }),
+      ],
+      now: () => NOW,
+    });
+
+    expect(result).toEqual([]);
+  });
+
+  test('staleness is judged against the override, not the suggestion', async () => {
+    // Manifest says weekly (fresh at 2 days); the operator asked for hourly.
+    const result = await auditBackups({
+      modules: [
+        makeModule('caddy', {
+          hasBackupHook: true,
+          lastSuccessfulBackupAt: NOW - 2 * ONE_DAY,
+          schedule: 'weekly',
+          scheduleOverride: 'hourly',
+        }),
+      ],
+      now: () => NOW,
     });
-    expect(result[0].message).toContain('manual');
+
+    expect(result).toHaveLength(1);
+    expect(result[0].code).toBe('backup_stale');
+    expect(result[0].message).toContain('hourly');
   });
 
   test('manual schedule: never flags stale (user-driven cadence)', async () => {
@@ -93,12 +178,12 @@ describe('auditBackups', () => {
     expect(result[0].message).toContain('daily');
   });
 
-  test('daily schedule: 26h-old is stale', async () => {
+  test('daily schedule: 27h-old is stale', async () => {
     const result = await auditBackups({
       modules: [
         makeModule('authentik', {
           hasBackupHook: true,
-          lastSuccessfulBackupAt: NOW - 26 * HOUR,
+          lastSuccessfulBackupAt: NOW - 27 * HOUR,
           schedule: 'daily',
         }),
       ],