@checkstack/anomaly-backend 1.1.8 → 1.2.0

package/src/config-read.test.ts

@@ -0,0 +1,115 @@
+import { describe, test, expect, mock } from "bun:test";
+import { AnomalyService } from "./service";
+import type { SafeDatabase } from "@checkstack/backend-api";
+import type * as schema from "./schema";
+
+/**
+ * Read-side migrate-then-validate guard. `getAnomalyConfig` and
+ * `getAnomalyAssignmentConfig` previously cast the stored jsonb straight to a
+ * typed `VersionedRecord`, bypassing the strategy schema entirely. They now run
+ * the stored record through `anomalySettingsConfig.parseRecord` /
+ * `anomalyAssignmentConfig.parseRecord`, so the data is validated (and migrated
+ * once migrations exist) on every read. These tests prove the read path goes
+ * through `.parseRecord`: stray keys are stripped and defaults are applied.
+ */
+
+function createSelectMockDb({
+  storedConfig,
+}: {
+  storedConfig: unknown | undefined;
+}): SafeDatabase<typeof schema> {
+  const rows = storedConfig === undefined ? [] : [{ config: storedConfig }];
+  const db = {
+    select: mock(() => ({
+      from: mock(() => ({
+        where: mock(() => Promise.resolve(rows)),
+      })),
+    })),
+  };
+  // The service only touches `select().from().where()` on these read paths.
+  return db as unknown as SafeDatabase<typeof schema>;
+}
+
+describe("getAnomalyConfig read path", () => {
+  test("validates the stored record via parseRecord (strips stray keys)", async () => {
+    const service = new AnomalyService(
+      createSelectMockDb({
+        storedConfig: {
+          version: 1,
+          data: {
+            enabled: false,
+            baselineWindow: "30d",
+            notify: false,
+            // Not part of AnomalySettingsSchema — must be stripped by parse.
+            legacyField: "should-be-dropped",
+          },
+        },
+      }),
+    );
+
+    const result = await service.getAnomalyConfig("cfg-1");
+
+    expect(result.version).toBe(1);
+    expect(result.data.enabled).toBe(false);
+    expect(result.data.baselineWindow).toBe("30d");
+    expect(result.data.notify).toBe(false);
+    expect("legacyField" in result.data).toBe(false);
+  });
+
+  test("applies schema defaults to a sparse stored record", async () => {
+    const service = new AnomalyService(
+      createSelectMockDb({ storedConfig: { version: 1, data: {} } }),
+    );
+
+    const result = await service.getAnomalyConfig("cfg-1");
+
+    // Defaults come from AnomalySettingsSchema, proving validation ran.
+    expect(result.data.enabled).toBe(true);
+    expect(result.data.baselineWindow).toBe("7d");
+    expect(result.data.notify).toBe(true);
+  });
+
+  test("returns a validated default wrapper when no row exists", async () => {
+    const service = new AnomalyService(
+      createSelectMockDb({ storedConfig: undefined }),
+    );
+
+    const result = await service.getAnomalyConfig("cfg-missing");
+
+    expect(result.version).toBe(1);
+    expect(result.data.enabled).toBe(true);
+  });
+});
+
+describe("getAnomalyAssignmentConfig read path", () => {
+  test("validates the stored override record via parseRecord", async () => {
+    const service = new AnomalyService(
+      createSelectMockDb({
+        storedConfig: {
+          version: 1,
+          data: {
+            enabled: true,
+            // Stray key not on PartialAnomalySettingsSchema — must be stripped.
+            bogus: 123,
+          },
+        },
+      }),
+    );
+
+    const result = await service.getAnomalyAssignmentConfig("sys-1", "cfg-1");
+
+    expect(result).toBeDefined();
+    expect(result?.data.enabled).toBe(true);
+    expect(result && "bogus" in result.data).toBe(false);
+  });
+
+  test("returns undefined when no override row exists", async () => {
+    const service = new AnomalyService(
+      createSelectMockDb({ storedConfig: undefined }),
+    );
+
+    const result = await service.getAnomalyAssignmentConfig("sys-1", "cfg-1");
+
+    expect(result).toBeUndefined();
+  });
+});

package/src/config.ts

@@ -1,8 +1,48 @@
+import { z } from "zod";
 import { Versioned } from "@checkstack/backend-api";
-import { AnomalySettingsSchema } from "@checkstack/anomaly-common";
-import type { AnomalySettings } from "@checkstack/anomaly-common";
+import type { VersionedRecord } from "@checkstack/backend-api";
+import {
+  AnomalySettingsSchema,
+  PartialAnomalySettingsSchema,
+} from "@checkstack/anomaly-common";
+import type {
+  AnomalySettings,
+  PartialAnomalySettings,
+} from "@checkstack/anomaly-common";
+
+/**
+ * Envelope schema for the stored versioned record. Stored configs come back
+ * from the jsonb column typed as `unknown`, so we validate the wrapper shape
+ * (`{ version, data }`) before handing it to `Versioned.parseRecord`, which
+ * then migrates + validates the inner `data` against the strategy schema.
+ */
+const versionedEnvelopeSchema = z.object({
+  version: z.number(),
+  data: z.unknown(),
+  migratedAt: z.date().optional(),
+  originalVersion: z.number().optional(),
+});
+
+/**
+ * Narrow a stored jsonb config (`unknown`) into a {@link VersionedRecord}
+ * envelope so it can be passed to `Versioned.parse`/`parseRecord`.
+ */
+export function toVersionedRecord(stored: unknown): VersionedRecord<unknown> {
+  return versionedEnvelopeSchema.parse(stored);
+}
 
 export const anomalySettingsConfig = new Versioned<AnomalySettings>({
   version: 1,
   schema: AnomalySettingsSchema,
 });
+
+/**
+ * Versioned config for assignment-level overrides. Stored alongside the
+ * template config and migrated/validated on read via {@link Versioned.parseRecord}.
+ * `version: 1` with no migrations today; threading it through the read path
+ * means a future reshape only needs a migration step added here.
+ */
+export const anomalyAssignmentConfig = new Versioned<PartialAnomalySettings>({
+  version: 1,
+  schema: PartialAnomalySettingsSchema,
+});

package/src/detector.test.ts

@@ -886,6 +886,167 @@ describe("Anomaly Detector — processCheckCompleted", () => {
     expect(broadcastPayload).toMatchObject({ newState: "recovered" });
   });
 
+  // ─── PART A: self-resolution (settled at a new level) ─────────────────
+
+  test("self-resolves a confirmed anomaly once recent samples settle at a new level", async () => {
+    const baseline = createBaseline({ mean: 100, stdDev: 10 });
+    const cache = createMockCache(new Map([[cacheKeyPrefix, baseline]]));
+    const catalogClient = createMockCatalogClient();
+    const notificationClient = createMockNotificationClient(["user-1"]);
+    // Four prior healthy samples already sitting at the new stable level (~200);
+    // the fifth (anomalousResult = 200) completes the window → self-resolve.
+    const db = createMockDb({
+      existingAnomaly: {
+        id: "anomaly-stuck",
+        systemId,
+        configurationId,
+        fieldPath: "collectors.http.request.responseTimeMs",
+        state: "anomaly",
+        suspiciousRunCount: 5,
+        confirmationThreshold: 3,
+        baselineValue: 100,
+        observedValue: "200",
+        suppressedAt: null,
+        suppressedValue: null,
+        metadata: { recentSamples: [200, 200, 200, 200] },
+      },
+    });
+
+    await processCheckCompleted({
+      ...baseProps,
+      latencyMs: 50,
+      result: anomalousResult, // still 10σ above the stale baseline
+      db: db as never,
+      cache,
+      logger: createMockLogger() as never,
+      catalogClient: catalogClient as never,
+      notificationClient: notificationClient as never,
+    });
+
+    expect(db._updateCalls.length).toBe(1);
+    expect(db._updateCalls[0]).toMatchObject({ state: "recovered" });
+    // Recovery notification is dispatched.
+    expect(notificationClient.notifyForSubscription).toHaveBeenCalledTimes(1);
+  });
+
+  test("does not self-resolve while the window is still filling", async () => {
+    const baseline = createBaseline({ mean: 100, stdDev: 10 });
+    const cache = createMockCache(new Map([[cacheKeyPrefix, baseline]]));
+    const db = createMockDb({
+      existingAnomaly: {
+        id: "anomaly-filling",
+        systemId,
+        configurationId,
+        fieldPath: "collectors.http.request.responseTimeMs",
+        state: "anomaly",
+        suspiciousRunCount: 5,
+        confirmationThreshold: 3,
+        baselineValue: 100,
+        observedValue: "200",
+        suppressedAt: null,
+        suppressedValue: null,
+        metadata: { recentSamples: [200, 200] },
+      },
+    });
+
+    await processCheckCompleted({
+      ...baseProps,
+      latencyMs: 50,
+      result: anomalousResult,
+      db: db as never,
+      cache,
+      logger: createMockLogger() as never,
+      catalogClient: createMockCatalogClient() as never,
+      notificationClient: createMockNotificationClient() as never,
+    });
+
+    expect(db._updateCalls.length).toBe(1);
+    // Still anomalous: only the rolling window/observed value is updated.
+    expect(db._updateCalls[0]).not.toHaveProperty("state");
+    expect(db._updateCalls[0].metadata).toMatchObject({
+      recentSamples: [200, 200, 200],
+    });
+  });
+
+  // ─── PART B: auto-unsuppress ("changes again") ────────────────────────
+
+  test("auto-unsuppresses a suppressed anomaly when the value changes again", async () => {
+    const baseline = createBaseline({ mean: 100, stdDev: 10 });
+    const cache = createMockCache(new Map([[cacheKeyPrefix, baseline]]));
+    const db = createMockDb({
+      existingAnomaly: {
+        id: "anomaly-suppressed",
+        systemId,
+        configurationId,
+        fieldPath: "collectors.http.request.responseTimeMs",
+        state: "anomaly",
+        suspiciousRunCount: 5,
+        confirmationThreshold: 3,
+        baselineValue: 100,
+        observedValue: "200",
+        suppressedAt: new Date(),
+        suppressedValue: 200, // suppressed at ~200; new value 200 is unchanged...
+        metadata: {},
+      },
+    });
+
+    // anomalousResult is 200 — within band → must NOT auto-unsuppress.
+    await processCheckCompleted({
+      ...baseProps,
+      latencyMs: 50,
+      result: anomalousResult,
+      db: db as never,
+      cache,
+      logger: createMockLogger() as never,
+      catalogClient: createMockCatalogClient() as never,
+      notificationClient: createMockNotificationClient() as never,
+    });
+    const unsuppressed = db._updateCalls.find(
+      (c) => c.suppressedAt === null,
+    );
+    expect(unsuppressed).toBeUndefined();
+  });
+
+  test("auto-unsuppresses when the value moves outside the reactivation band", async () => {
+    // Baseline far below so the new high value is still anomalous and reaches
+    // the anomaly branch; suppressed at 50, observed jumps to 200 (>25% move).
+    const baseline = createBaseline({ mean: 100, stdDev: 10 });
+    const cache = createMockCache(new Map([[cacheKeyPrefix, baseline]]));
+    const db = createMockDb({
+      existingAnomaly: {
+        id: "anomaly-suppressed-2",
+        systemId,
+        configurationId,
+        fieldPath: "collectors.http.request.responseTimeMs",
+        state: "anomaly",
+        suspiciousRunCount: 5,
+        confirmationThreshold: 3,
+        baselineValue: 100,
+        observedValue: "50",
+        suppressedAt: new Date(),
+        suppressedValue: 50,
+        metadata: {},
+      },
+    });
+
+    await processCheckCompleted({
+      ...baseProps,
+      latencyMs: 50,
+      result: anomalousResult, // 200, far from suppressedValue 50
+      db: db as never,
+      cache,
+      logger: createMockLogger() as never,
+      catalogClient: createMockCatalogClient() as never,
+      notificationClient: createMockNotificationClient() as never,
+    });
+
+    expect(db._updateCalls.length).toBe(1);
+    expect(db._updateCalls[0]).toMatchObject({
+      suppressedAt: null,
+      suppressedValue: null,
+    });
+  });
+
   // ─── Notification resilience ──────────────────────────────────────────
 
   test("does not crash when notification dispatch fails", async () => {

package/src/detector.ts

@@ -7,6 +7,10 @@ import {
   isAnomalous,
   isCategoricalAnomalous,
   resolveEffectiveConfig,
+  appendRecentSample,
+  hasSettledAtNewLevel,
+  hasChangedSinceSuppression,
+  type AnomalyMetadata,
   type FieldBaseline,
 } from "@checkstack/anomaly-common";
 import type { Logger } from "@checkstack/backend-api";
@@ -304,7 +308,7 @@ export async function processCheckCompleted({
               deviation,
             })
             .where(eq(schema.anomalies.id, existingAnomaly.id));
-          logger.warn(`Anomaly confirmed for ${systemId} on ${path}`);
+          logger.debug(`Anomaly confirmed for ${systemId} on ${path}`);
 
           await routerCache?.invalidateAnomalies();
 
@@ -340,13 +344,112 @@ export async function processCheckCompleted({
             .where(eq(schema.anomalies.id, existingAnomaly.id));
         }
       } else if (existingAnomaly.state === "anomaly") {
-        await db
-          .update(schema.anomalies)
-          .set({
-            observedValue: String(value),
-            deviation,
+        // PART B: a suppressed anomaly auto-unsuppresses once the metric
+        // "changes again" — the observed value moves outside the relative band
+        // around the value it was suppressed at. We detect that here (the only
+        // place fresh samples flow through) before the self-resolution check so
+        // a re-activated anomaly resumes normal lifecycle handling.
+        const suppressedValue = existingAnomaly.suppressedValue;
+        if (
+          existingAnomaly.suppressedAt &&
+          typeof value === "number" &&
+          typeof suppressedValue === "number" &&
+          hasChangedSinceSuppression({
+            observedValue: value,
+            suppressedValue,
           })
-          .where(eq(schema.anomalies.id, existingAnomaly.id));
+        ) {
+          await db
+            .update(schema.anomalies)
+            .set({
+              suppressedAt: null,
+              suppressedValue: null,
+              suppressedBaseline: null,
+              observedValue: String(value),
+              deviation,
+            })
+            .where(eq(schema.anomalies.id, existingAnomaly.id));
+          await routerCache?.invalidateAnomalies();
+          if (signalService) {
+            await signalService.broadcast(ANOMALY_STATE_CHANGED, {
+              systemId,
+              anomalyId: existingAnomaly.id,
+              newState: "anomaly",
+            });
+          }
+          continue;
+        }
+
+        // PART A: self-resolution. The value is still anomalous against the
+        // (stale) baseline, but if the recent healthy samples have settled into
+        // a tight relative band the metric has found a new normal — resolve
+        // independently of the slow baseline analyzer. We keep a rolling window
+        // of recent samples on the row's metadata (shared Postgres, so every
+        // pod sees the same window).
+        if (typeof value === "number") {
+          const metadata = (existingAnomaly.metadata ??
+            {}) as AnomalyMetadata;
+          const recentSamples = appendRecentSample(
+            metadata.recentSamples,
+            value,
+          );
+
+          if (hasSettledAtNewLevel(recentSamples)) {
+            await db
+              .update(schema.anomalies)
+              .set({
+                state: "recovered",
+                recoveredAt: new Date(),
+                observedValue: String(value),
+                deviation,
+                metadata: { ...metadata, recentSamples: [] },
+              })
+              .where(eq(schema.anomalies.id, existingAnomaly.id));
+            logger.debug(
+              `Anomaly self-resolved (settled at new level) for ${systemId} on ${path}`,
+            );
+
+            await routerCache?.invalidateAnomalies();
+
+            if (signalService) {
+              await signalService.broadcast(ANOMALY_STATE_CHANGED, {
+                systemId,
+                anomalyId: existingAnomaly.id,
+                newState: "recovered",
+              });
+            }
+
+            await dispatchAnomalyNotification({
+              action: "recovered",
+              systemId,
+              fieldPath: path,
+              observedValue: value,
+              baselineMean: baseline.mean,
+              catalogClient,
+              notificationClient,
+              db,
+              logger,
+            });
+            continue;
+          }
+
+          await db
+            .update(schema.anomalies)
+            .set({
+              observedValue: String(value),
+              deviation,
+              metadata: { ...metadata, recentSamples },
+            })
+            .where(eq(schema.anomalies.id, existingAnomaly.id));
+        } else {
+          await db
+            .update(schema.anomalies)
+            .set({
+              observedValue: String(value),
+              deviation,
+            })
+            .where(eq(schema.anomalies.id, existingAnomaly.id));
+        }
       }
     } else {
       if (existingAnomaly) {
@@ -361,9 +464,14 @@ export async function processCheckCompleted({
               state: "recovered",
               recoveredAt: new Date(),
               observedValue: String(value),
+              // Baseline-relative recovery clears any active suppression and the
+              // rolling self-resolution window — the row is no longer active.
+              suppressedAt: null,
+              suppressedValue: null,
+              suppressedBaseline: null,
             })
             .where(eq(schema.anomalies.id, existingAnomaly.id));
-          logger.info(`Anomaly recovered for ${systemId} on ${path}`);
+          logger.debug(`Anomaly recovered for ${systemId} on ${path}`);
 
           await routerCache?.invalidateAnomalies();
 

package/src/drift-evaluator.test.ts

@@ -1,7 +1,11 @@
 import { describe, test, expect, mock } from "bun:test";
 import { evaluateDrift } from "./drift-evaluator";
 import * as schema from "./schema";
-import type { AnomalySettings, FieldBaseline } from "@checkstack/anomaly-common";
+import {
+  STABLE_DRIFT_RESOLUTION_RUN_COUNT,
+  type AnomalySettings,
+  type FieldBaseline,
+} from "@checkstack/anomaly-common";
 
 function createBaseline(overrides: Partial<FieldBaseline> = {}): FieldBaseline {
   return {
@@ -357,6 +361,97 @@ describe("evaluateDrift", () => {
       expect(notification.notifyForSubscription).toHaveBeenCalledTimes(1);
     });
 
+    // ─── PART A: drift self-resolution (settled at a new level) ──────────
+
+    // Statistically drifting (slope×n = 150 ≫ 2×σ = 20) yet the projected
+    // change is tiny relative to the new mean (150 / 10000 = 1.5% < band) — the
+    // metric has settled at a high new level the 7-day window hasn't caught up to.
+    const flatHighMeanBaseline = createBaseline({
+      mean: 10000,
+      stdDev: 10,
+      trendSlope: 1.5,
+      sampleCount: 100,
+    });
+
+    test("self-resolves a confirmed drift once slope is flat relative to the new mean for N runs", async () => {
+      const existing = {
+        id: "drift-stuck",
+        state: "anomaly",
+        suspiciousRunCount: 2,
+        confirmationThreshold: 2,
+        // One prior flat run already recorded; this run reaches the threshold.
+        metadata: { stableDriftRunCount: STABLE_DRIFT_RESOLUTION_RUN_COUNT - 1 },
+      };
+      const db = createMockDb({ existingAnomaly: existing });
+      const notification = createMockNotificationClient();
+      await evaluateDrift({
+        ...baseProps,
+        baseline: flatHighMeanBaseline,
+        schemaDirection: "lower-is-better",
+        templateConfig: defaultTemplate,
+        db: db as never,
+        catalogClient: createMockCatalogClient() as never,
+        notificationClient: notification as never,
+        logger: createMockLogger() as never,
+      });
+      expect(db._updateCalls.length).toBe(1);
+      expect(db._updateCalls[0].state).toBe("recovered");
+      expect(notification.notifyForSubscription).toHaveBeenCalledTimes(1);
+    });
+
+    test("accumulates the flat-run counter without resolving prematurely", async () => {
+      const existing = {
+        id: "drift-counting",
+        state: "anomaly",
+        suspiciousRunCount: 2,
+        confirmationThreshold: 2,
+        metadata: {},
+      };
+      const db = createMockDb({ existingAnomaly: existing });
+      await evaluateDrift({
+        ...baseProps,
+        baseline: flatHighMeanBaseline,
+        schemaDirection: "lower-is-better",
+        templateConfig: defaultTemplate,
+        db: db as never,
+        catalogClient: createMockCatalogClient() as never,
+        notificationClient: createMockNotificationClient() as never,
+        logger: createMockLogger() as never,
+      });
+      expect(db._updateCalls.length).toBe(1);
+      expect(db._updateCalls[0].state).toBeUndefined();
+      expect(db._updateCalls[0].metadata).toMatchObject({
+        stableDriftRunCount: 1,
+      });
+    });
+
+    test("resets the flat-run counter when drift is steep again", async () => {
+      const existing = {
+        id: "drift-resteepening",
+        state: "anomaly",
+        suspiciousRunCount: 2,
+        confirmationThreshold: 2,
+        metadata: { stableDriftRunCount: 1 },
+      };
+      const db = createMockDb({ existingAnomaly: existing });
+      // driftingBaseline: mean 200, projectedChange 150 → 75% of mean → not flat.
+      await evaluateDrift({
+        ...baseProps,
+        baseline: driftingBaseline,
+        schemaDirection: "lower-is-better",
+        templateConfig: defaultTemplate,
+        db: db as never,
+        catalogClient: createMockCatalogClient() as never,
+        notificationClient: createMockNotificationClient() as never,
+        logger: createMockLogger() as never,
+      });
+      expect(db._updateCalls.length).toBe(1);
+      expect(db._updateCalls[0].state).toBeUndefined();
+      expect(db._updateCalls[0].metadata).toMatchObject({
+        stableDriftRunCount: 0,
+      });
+    });
+
     test("does nothing when no row and no drift (steady state)", async () => {
       const db = createMockDb();
       await evaluateDrift({

package/src/drift-evaluator.ts

@@ -8,7 +8,10 @@ import {
   ANOMALY_TREND_DETECTED,
   detectDrift,
   resolveEffectiveConfig,
+  isDriftFlatRelative,
+  STABLE_DRIFT_RESOLUTION_RUN_COUNT,
   type AnomalyDirection,
+  type AnomalyMetadata,
   type AnomalySettings,
   type FieldBaseline,
 } from "@checkstack/anomaly-common";
@@ -170,7 +173,7 @@ export async function evaluateDrift({
             deviation: driftResult.deviationSigmas,
           })
           .where(eq(schema.anomalies.id, existing.id));
-        logger.warn(`Drift confirmed for ${systemId} on ${fieldPath}`);
+        logger.debug(`Drift confirmed for ${systemId} on ${fieldPath}`);
 
         if (signalService) {
           await signalService.broadcast(ANOMALY_STATE_CHANGED, {
@@ -211,11 +214,65 @@ export async function evaluateDrift({
     }
 
     if (existing.state === "anomaly") {
+      // PART A (drift self-resolution): the slope-based detector still reports
+      // drift because the 7-day window straddles the old and new regimes, but
+      // if the *projected change relative to the (new) mean* has gone flat for
+      // several consecutive analyzer runs, the metric has settled at its new
+      // level — resolve independently of the slow window catching up. The
+      // run-count lives on the row's metadata (shared Postgres) so it survives
+      // across whichever pod claims the analyzer job.
+      const metadata = (existing.metadata ?? {}) as AnomalyMetadata;
+      const flat = isDriftFlatRelative({
+        projectedChange: driftResult.projectedChange,
+        mean: baseline.mean,
+      });
+      const stableDriftRunCount = flat
+        ? (metadata.stableDriftRunCount ?? 0) + 1
+        : 0;
+
+      if (stableDriftRunCount >= STABLE_DRIFT_RESOLUTION_RUN_COUNT) {
+        await db
+          .update(schema.anomalies)
+          .set({
+            state: "recovered",
+            recoveredAt: new Date(),
+            observedValue: baseline.mean.toString(),
+            deviation: driftResult.deviationSigmas,
+            metadata: { ...metadata, stableDriftRunCount: 0 },
+          })
+          .where(eq(schema.anomalies.id, existing.id));
+        logger.debug(
+          `Drift self-resolved (settled at new level) for ${systemId} on ${fieldPath}`,
+        );
+
+        if (signalService) {
+          await signalService.broadcast(ANOMALY_STATE_CHANGED, {
+            systemId,
+            anomalyId: existing.id,
+            newState: "recovered",
+          });
+        }
+
+        await dispatchAnomalyNotification({
+          action: "drift_recovered",
+          systemId,
+          fieldPath,
+          observedValue: baseline.mean,
+          baselineMean: baseline.mean,
+          catalogClient,
+          notificationClient,
+          db,
+          logger,
+        });
+        return;
+      }
+
       await db
         .update(schema.anomalies)
         .set({
           observedValue: baseline.mean.toString(),
           deviation: driftResult.deviationSigmas,
+          metadata: { ...metadata, stableDriftRunCount },
         })
         .where(eq(schema.anomalies.id, existing.id));
       return;
@@ -241,9 +298,12 @@ export async function evaluateDrift({
         state: "recovered",
         recoveredAt: new Date(),
         observedValue: baseline.mean.toString(),
+        suppressedAt: null,
+        suppressedValue: null,
+        suppressedBaseline: null,
       })
       .where(eq(schema.anomalies.id, existing.id));
-    logger.info(`Drift recovered for ${systemId} on ${fieldPath}`);
+    logger.debug(`Drift recovered for ${systemId} on ${fieldPath}`);
 
     if (signalService) {
       await signalService.broadcast(ANOMALY_STATE_CHANGED, {