@checkstack/healthcheck-backend 1.14.0 → 1.16.0

package/src/queue-executor.test.ts

@@ -1459,3 +1459,185 @@ describe("recomputeSystemRollupHealth", () => {
     expect(logger.error).toHaveBeenCalledTimes(1);
   });
 });
+
+describe("executeHealthCheckJob - structured assertion outcomes", () => {
+  it("stores _assertions per collector entry and downgrades on failure", async () => {
+    const mockDb = createMockDb();
+    const mockRegistry = createMockRegistry();
+    const mockLogger = createMockLogger();
+    const mockQueueManager = createMockQueueManager();
+    const mockCatalogClient = createMockCatalogClient();
+    const mockMaintenanceClient = createMockMaintenanceClient();
+    const mockIncidentClient = createMockIncidentClient();
+    const mockSignalService = createMockSignalService();
+
+    (mockCatalogClient.getSystem as any) = mock(async () => ({
+      id: "system-1",
+      name: "web-01",
+    }));
+
+    // One collector entry with two assertions: isTrue passes, equals fails.
+    let selectCallCount = 0;
+    (mockDb.select as any) = mock(() => {
+      selectCallCount++;
+      if (selectCallCount === 2) {
+        return {
+          from: mock(() => ({
+            innerJoin: mock(() => ({
+              where: mock(() =>
+                Promise.resolve([
+                  {
+                    configId: "config-1",
+                    configName: "checkout",
+                    strategyId: "test-strategy",
+                    config: { timeout: 5000 },
+                    collectors: [
+                      {
+                        id: "col-1",
+                        collectorId: "test-collector",
+                        config: {},
+                        assertions: [
+                          { field: "ok", operator: "isTrue" },
+                          { field: "code", operator: "equals", value: 200 },
+                        ],
+                      },
+                    ],
+                    interval: 45,
+                    enabled: true,
+                    paused: false,
+                    includeLocal: true,
+                    satelliteIds: [],
+                  },
+                ]),
+              ),
+            })),
+          })),
+        };
+      }
+      return {
+        from: mock(() => ({
+          innerJoin: mock(() => ({
+            where: mock(() => Promise.resolve([])),
+          })),
+        })),
+      };
+    });
+
+    // Capture every insert's values so we can find the stored run.
+    const insertedValues: Record<string, unknown>[] = [];
+    (mockDb.insert as any) = mock(() => ({
+      values: mock((vals: Record<string, unknown>) => {
+        insertedValues.push(vals);
+        return Object.assign(Promise.resolve(), {
+          onConflictDoUpdate: mock(() => Promise.resolve()),
+          onConflictDoNothing: mock(() => Promise.resolve()),
+          returning: mock(() => Promise.resolve([])),
+        });
+      }),
+    }));
+
+    const mockCollectorRegistry = {
+      register: mock(() => {}),
+      getCollector: mock(() => ({
+        collector: {
+          id: "test-collector",
+          execute: mock(async () => ({ result: { ok: true, code: 404 } })),
+          config: new Versioned({ version: 1, schema: z.object({}) }),
+          result: new Versioned({
+            version: 1,
+            schema: z.object({ ok: z.boolean(), code: z.number() }),
+          }),
+          mergeResult: mock(() => ({})),
+        },
+      })),
+      getCollectors: mock(() => []),
+    };
+
+    const queue =
+      mockQueueManager.getQueue<HealthCheckJobPayload>("health-checks");
+    let capturedHandler:
+      | ((job: { data: HealthCheckJobPayload }) => Promise<void>)
+      | undefined;
+    (queue.consume as any) = mock(
+      async (
+        handler: (job: { data: HealthCheckJobPayload }) => Promise<void>,
+      ) => {
+        capturedHandler = handler;
+      },
+    );
+
+    await setupHealthCheckWorker({
+      db: mockDb as unknown as Parameters<
+        typeof setupHealthCheckWorker
+      >[0]["db"],
+      advisoryLock: mockAdvisoryLock,
+      registry: mockRegistry,
+      collectorRegistry: mockCollectorRegistry as unknown as Parameters<
+        typeof setupHealthCheckWorker
+      >[0]["collectorRegistry"],
+      logger: mockLogger,
+      queueManager: mockQueueManager,
+      signalService: mockSignalService,
+      catalogClient: mockCatalogClient as unknown as Parameters<
+        typeof setupHealthCheckWorker
+      >[0]["catalogClient"],
+      notificationClient: {
+        notifyForSubscription: () => Promise.resolve({ notifiedCount: 0 }),
+      } as unknown as Parameters<
+        typeof setupHealthCheckWorker
+      >[0]["notificationClient"],
+      maintenanceClient: mockMaintenanceClient as unknown as Parameters<
+        typeof setupHealthCheckWorker
+      >[0]["maintenanceClient"],
+      incidentClient: mockIncidentClient as unknown as Parameters<
+        typeof setupHealthCheckWorker
+      >[0]["incidentClient"],
+      getEmitHook: () => undefined,
+      cache: passthroughCache,
+    });
+
+    if (capturedHandler) {
+      // Downstream aggregation touches DB surfaces the lightweight mock
+      // doesn't model; the run insert we assert on happens before that.
+      await capturedHandler({
+        data: { configId: "config-1", systemId: "system-1" },
+      }).catch(() => {});
+    }
+
+    const runInsert = insertedValues.find(
+      (vals) => "status" in vals && "result" in vals,
+    );
+    expect(runInsert).toBeDefined();
+    // The failed `code equals 200` assertion downgrades the run.
+    expect(runInsert?.status).toBe("unhealthy");
+
+    const runResult = runInsert?.result as {
+      metadata: {
+        collectors: Record<
+          string,
+          {
+            _assertionFailed?: string;
+            _assertions?: {
+              field: string;
+              passed: boolean;
+              actual?: string;
+            }[];
+          }
+        >;
+      };
+    };
+    const entry = runResult.metadata.collectors["col-1"];
+    expect(entry._assertionFailed).toBe("code equals 200");
+    expect(entry._assertions?.length).toBe(2);
+    expect(entry._assertions?.[0]).toMatchObject({
+      field: "ok",
+      passed: true,
+      actual: "true",
+    });
+    expect(entry._assertions?.[1]).toMatchObject({
+      field: "code",
+      passed: false,
+      actual: "404",
+    });
+  });
+});

package/src/queue-executor.ts

@@ -46,7 +46,11 @@ import { NotificationApi } from "@checkstack/notification-common";
 import { healthcheckSystemSubscription } from "@checkstack/healthcheck-common";
 import { resolveRoute, type InferClient, extractErrorMessage} from "@checkstack/common";
 import { secretEnvMappingSchema } from "@checkstack/secrets-common";
-import type { SecretResolverService } from "@checkstack/secrets-backend";
+import type {
+  SecretResolverService,
+  InternalSecretsService,
+} from "@checkstack/secrets-backend";
+import { inflateConfigSecrets } from "./config-secrets";
 import { HealthCheckService } from "./service";
 import { healthCheckHooks } from "./hooks";
 import { incrementHourlyAggregate } from "./realtime-aggregation";
@@ -56,7 +60,8 @@ import {
   shouldNotifyTransition,
 } from "./notification-policy";
 import { recordStateTransition } from "./state-transitions";
-import { evaluateCollectorAssertions } from "./collector-assertions";
+import { evaluateCollectorAssertionOutcomes } from "./collector-assertions";
+import type { AssertionOutcome } from "@checkstack/healthcheck-common";
 import {
   writeHealthEntity,
   createHealthEntitySerializer,
@@ -538,6 +543,14 @@ async function executeHealthCheckJob(props: {
    * / test isolation.
    */
   secretResolver?: SecretResolverService;
+  /**
+   * Internal secret store. When set (together with `secretResolver`), stored
+   * strategy/collector config `x-secret` fields - internal markers and
+   * `${{ secrets.* }}` references - are INFLATED to their real values just
+   * before use, in memory only. Optional for version-skew / test isolation;
+   * without it, marker-bearing configs fail their runs clearly.
+   */
+  internalSecrets?: InternalSecretsService;
 }): Promise<void> {
   const {
     payload,
@@ -555,6 +568,7 @@ async function executeHealthCheckJob(props: {
     getHealthEntity,
     cache,
     secretResolver,
+    internalSecrets,
   } = props;
   const { configId, systemId } = payload;
 
@@ -656,6 +670,22 @@ async function executeHealthCheckJob(props: {
       return;
     }
 
+    // Inflate stored secret markers / `${{ secrets.* }}` references to their
+    // real values ONCE, memory-only, BEFORE migrate+validate - so validation
+    // sees real values. Old-shape rows (whose current-schema secret keys do
+    // not exist yet) and legacy bare literals pass through untouched.
+    let rawStrategyConfig = configRow.config;
+    if (internalSecrets && secretResolver) {
+      const inflated = await inflateConfigSecrets({
+        configurationId: configId,
+        scope: { kind: "strategy" },
+        schema: strategy.config.schema,
+        config: configRow.config,
+        deps: { internalSecrets, secretResolver },
+      });
+      rawStrategyConfig = inflated.config;
+    }
+
     // Migrate the stored (UNVERSIONED) strategy config ONCE, before the
     // per-environment render loop, so every env renders from the same
     // migrated shape. Stored configs predate explicit versioning and may be
@@ -663,7 +693,7 @@ async function executeHealthCheckJob(props: {
     // -on-read runs the declared migration chain, then validates. The
     // migrations are idempotent, so an already-current config is a no-op.
     const strategyConfig: BaseStrategyConfig =
-      await strategy.config.parseAssumingV1(configRow.config);
+      await strategy.config.parseAssumingV1(rawStrategyConfig);
     const executionTimeout = strategyConfig.timeout ?? 60_000;
 
     // ── Per-environment fan-out (§7) ────────────────────────────────────────
@@ -872,9 +902,26 @@ async function executeHealthCheckJob(props: {
               // reads the raw `secretEnv` mapping (a constant string field
               // unaffected by the strategy/collector reshapes), keeping the
               // migrate -> secret resolve -> render -> execute order intact.
+              // Inflate this entry's secret markers / references (memory
+              // only) before its migrate+validate parse, mirroring the
+              // strategy-config inflation above.
+              let rawCollectorConfig = collectorEntry.config;
+              if (internalSecrets && secretResolver) {
+                const inflated = await inflateConfigSecrets({
+                  configurationId: configId,
+                  scope: {
+                    kind: "collector",
+                    entryId: collectorEntry.id,
+                  },
+                  schema: registered.collector.config.schema,
+                  config: collectorEntry.config,
+                  deps: { internalSecrets, secretResolver },
+                });
+                rawCollectorConfig = inflated.config;
+              }
               const migratedCollectorConfig =
                 await registered.collector.config.parseAssumingV1(
-                  collectorEntry.config,
+                  rawCollectorConfig,
                 );
 
               // (2) Environment/templating pass for the collector config -
@@ -901,13 +948,18 @@ async function executeHealthCheckJob(props: {
                 collectorError = collectorResult.error;
               }
 
-              // Evaluate per-collector assertions (plain fields + JSONPath)
+              // Evaluate per-collector assertions (plain fields + JSONPath).
+              // ALL outcomes are stored (pass AND fail) so assertions are
+              // analyzable over time, not only visible on failure.
               let assertionFailed: string | undefined;
+              let assertionOutcomes: AssertionOutcome[] = [];
               if (collectorResult.result) {
-                assertionFailed = evaluateCollectorAssertions({
+                const evaluation = evaluateCollectorAssertionOutcomes({
                   assertions: collectorEntry.assertions,
                   result: collectorResult.result as Record<string, unknown>,
                 });
+                assertionFailed = evaluation.firstFailureMessage;
+                assertionOutcomes = evaluation.outcomes;
                 if (assertionFailed) {
                   logger.debug(
                     `Collector ${storageKey} assertion failed: ${assertionFailed}`,
@@ -931,6 +983,9 @@ async function executeHealthCheckJob(props: {
                   _collectorId: collectorEntry.collectorId,
                   _assertionFailed: assertionFailed,
                   _collectorError: collectorError,
+                  ...(assertionOutcomes.length > 0
+                    ? { _assertions: assertionOutcomes }
+                    : {}),
                   ...strippedResult,
                 },
               };
@@ -1518,6 +1573,7 @@ export async function setupHealthCheckWorker(props: {
   getHealthEntity?: () => EntityHandle<HealthEntityState> | undefined;
   cache: HealthCheckCache;
   secretResolver?: SecretResolverService;
+  internalSecrets?: InternalSecretsService;
 }): Promise<void> {
   const {
     db,
@@ -1535,6 +1591,7 @@ export async function setupHealthCheckWorker(props: {
     getHealthEntity,
     cache,
     secretResolver,
+    internalSecrets,
   } = props;
 
   const queue =
@@ -1559,6 +1616,7 @@ export async function setupHealthCheckWorker(props: {
         getHealthEntity,
         cache,
         secretResolver,
+        internalSecrets,
       });
     },
     {

package/src/realtime-aggregation.test.ts

@@ -5,6 +5,7 @@ import {
   deserializeTDigest,
   incrementHourlyAggregate,
 } from "./realtime-aggregation";
+import { computeAssertionKey } from "@checkstack/healthcheck-common";
 import { TDigest } from "tdigest";
 
 describe("getHourBucketStart", () => {
@@ -494,3 +495,138 @@ describe("incrementHourlyAggregate", () => {
     expect(inserted.maxLatencyMs).toBe(150);
   });
 });
+
+describe("incrementHourlyAggregate - assertion stats folding", () => {
+  const KEY = computeAssertionKey({
+    assertion: { field: "statusCode", operator: "equals", value: 200 },
+  });
+
+  const outcome = (passed: boolean) => ({
+    key: KEY,
+    field: "statusCode",
+    operator: "equals",
+    value: "200",
+    passed,
+  });
+
+  const collectorRegistry = {
+    register: mock(() => {}),
+    getCollector: mock(() => ({
+      collector: {
+        id: "test-collector",
+        mergeResult: mock(() => ({ count: 1 })),
+      },
+    })),
+    getCollectors: mock(() => []),
+  } as unknown as Parameters<
+    typeof incrementHourlyAggregate
+  >[0]["collectorRegistry"];
+
+  function runResult(outcomes: unknown[]) {
+    return {
+      metadata: {
+        collectors: {
+          "uuid-1": {
+            _collectorId: "test-collector",
+            _assertions: outcomes,
+            statusCode: 200,
+          },
+        },
+      },
+    };
+  }
+
+  it("folds a run's outcomes into the bucket's per-assertion counts", async () => {
+    let inserted: Record<string, unknown> | undefined;
+    const db = {
+      select: mock(() => ({
+        from: mock(() => ({
+          where: mock(() => ({
+            limit: mock(() => Promise.resolve([])),
+          })),
+        })),
+      })),
+      insert: mock(() => ({
+        values: mock((values: Record<string, unknown>) => {
+          inserted = values;
+          return { onConflictDoUpdate: mock(() => Promise.resolve()) };
+        }),
+      })),
+    };
+
+    await incrementHourlyAggregate({
+      db: db as never,
+      systemId: "sys-1",
+      configurationId: "config-1",
+      status: "unhealthy",
+      latencyMs: 100,
+      runTimestamp: new Date("2024-01-15T10:35:00Z"),
+      result: runResult([outcome(true), outcome(false)]) as never,
+      collectorRegistry,
+    });
+
+    const aggregated = inserted?.aggregatedResult as Record<string, unknown>;
+    expect(aggregated.assertions).toEqual({
+      "uuid-1": { [KEY]: { passCount: 1, failCount: 1 } },
+    });
+    // The internal _assertions never leak into collector merge output.
+    const collectors = aggregated.collectors as Record<
+      string,
+      Record<string, unknown>
+    >;
+    expect(collectors["uuid-1"]._assertions).toBeUndefined();
+  });
+
+  it("increments existing counts and keeps distinct keys separate (mid-bucket config edit)", async () => {
+    const OTHER_KEY = computeAssertionKey({
+      assertion: { field: "statusCode", operator: "equals", value: 201 },
+    });
+    const existing = {
+      tdigestState: null,
+      minLatencyMs: null,
+      maxLatencyMs: null,
+      aggregatedResult: {
+        collectors: {},
+        assertions: { "uuid-1": { [KEY]: { passCount: 4, failCount: 0 } } },
+      },
+    };
+    let inserted: Record<string, unknown> | undefined;
+    const db = {
+      select: mock(() => ({
+        from: mock(() => ({
+          where: mock(() => ({
+            limit: mock(() => Promise.resolve([existing])),
+          })),
+        })),
+      })),
+      insert: mock(() => ({
+        values: mock((values: Record<string, unknown>) => {
+          inserted = values;
+          return { onConflictDoUpdate: mock(() => Promise.resolve()) };
+        }),
+      })),
+    };
+
+    // The edited assertion (value 201) starts a NEW series in the same bucket.
+    await incrementHourlyAggregate({
+      db: db as never,
+      systemId: "sys-1",
+      configurationId: "config-1",
+      status: "healthy",
+      latencyMs: 100,
+      runTimestamp: new Date("2024-01-15T10:40:00Z"),
+      result: runResult([
+        { ...outcome(true), key: OTHER_KEY, value: "201" },
+      ]) as never,
+      collectorRegistry,
+    });
+
+    const aggregated = inserted?.aggregatedResult as Record<string, unknown>;
+    expect(aggregated.assertions).toEqual({
+      "uuid-1": {
+        [KEY]: { passCount: 4, failCount: 0 },
+        [OTHER_KEY]: { passCount: 1, failCount: 0 },
+      },
+    });
+  });
+});

package/src/realtime-aggregation.ts

@@ -1,4 +1,11 @@
 import type { SafeDatabase, CollectorRegistry } from "@checkstack/backend-api";
+import {
+  ASSERTIONS_AGG_KEY,
+  AssertionOutcomeSchema,
+  foldOutcomesIntoStats,
+  readAssertionStats,
+  type AssertionOutcome,
+} from "@checkstack/healthcheck-common";
 import { TDigest } from "tdigest";
 import * as schema from "./schema";
 import { healthCheckAggregates } from "./schema";
@@ -269,6 +276,31 @@ function mergeCollectorResults(params: {
     return existingResult ?? undefined;
   }
 
+  // Fold this run's structured assertion outcomes into the bucket's
+  // per-assertion pass/fail counts (a PLATFORM-owned top-level key, sibling
+  // of `collectors`, so collector mergers never see it). Folded for every
+  // entry that carries outcomes, even collectors without a mergeResult.
+  let assertionStats = readAssertionStats({
+    aggregatedResult: existingResult ?? undefined,
+  });
+  if (runCollectors) {
+    for (const [uuid, collectorData] of Object.entries(runCollectors)) {
+      const rawOutcomes = collectorData._assertions;
+      if (!Array.isArray(rawOutcomes) || rawOutcomes.length === 0) continue;
+      const outcomes: AssertionOutcome[] = [];
+      for (const raw of rawOutcomes) {
+        const parsed = AssertionOutcomeSchema.safeParse(raw);
+        if (parsed.success) outcomes.push(parsed.data);
+      }
+      if (outcomes.length === 0) continue;
+      assertionStats = foldOutcomesIntoStats({
+        stats: assertionStats,
+        collectorEntryId: uuid,
+        outcomes,
+      });
+    }
+  }
+
   // Start with existing collectors or empty object
   const existingCollectors = (existingResult?.collectors ?? {}) as Record<
     string,
@@ -291,7 +323,7 @@ function mergeCollectorResults(params: {
       const existingAggregate = existingCollectors[uuid];
 
       // Strip internal fields from collector data for the run
-      const { _collectorId, _assertionFailed, ...collectorMetadata } =
+      const { _collectorId, _assertionFailed, _assertions, ...collectorMetadata } =
         collectorData;
 
       // Call the collector's mergeResult
@@ -313,5 +345,10 @@ function mergeCollectorResults(params: {
     }
   }
 
-  return { collectors: mergedCollectors };
+  return {
+    collectors: mergedCollectors,
+    ...(assertionStats === undefined
+      ? {}
+      : { [ASSERTIONS_AGG_KEY]: assertionStats }),
+  };
 }

package/src/retention-job.ts

@@ -8,6 +8,12 @@ import {
   DEFAULT_RETENTION_CONFIG,
 } from "./schema";
 import { eq, and, lt, sql, desc } from "drizzle-orm";
+import {
+  ASSERTIONS_AGG_KEY,
+  mergeAssertionStats,
+  readAssertionStats,
+  type BucketAssertionStats,
+} from "@checkstack/healthcheck-common";
 import type { QueueManager } from "@checkstack/queue-api";
 
 type Db = SafeDatabase<typeof schema>;
@@ -244,6 +250,8 @@ export interface HourlyAggregateRow {
   minLatencyMs: number | null;
   maxLatencyMs: number | null;
   p95LatencyMs: number | null;
+  /** Carried for the per-assertion pass/fail counts (additive across hours). */
+  aggregatedResult?: Record<string, unknown> | null;
 }
 
 /** A computed daily aggregate ready to upsert. */
@@ -261,6 +269,12 @@ export interface DailyAggregateValues {
   minLatencyMs: number | undefined;
   maxLatencyMs: number | undefined;
   p95LatencyMs: number | undefined;
+  /**
+   * Summed per-assertion pass/fail counts across the day's hourly buckets.
+   * The ONLY part of `aggregatedResult` that survives the daily rollup —
+   * assertion counts are purely additive, unlike strategy/collector states.
+   */
+  assertionStats: BucketAssertionStats | undefined;
 }
 
 /**
@@ -296,6 +310,7 @@ export function buildDailyAggregates(
     let degradedCount = 0;
     let unhealthyCount = 0;
     let latencySumMs = 0;
+    let assertionStats: BucketAssertionStats | undefined;
 
     for (const a of rows) {
       runCount += a.runCount;
@@ -308,6 +323,12 @@ export function buildDailyAggregates(
       } else if (a.avgLatencyMs !== null) {
         latencySumMs += a.avgLatencyMs * a.runCount;
       }
+      assertionStats = mergeAssertionStats({
+        a: assertionStats,
+        b: readAssertionStats({
+          aggregatedResult: a.aggregatedResult ?? undefined,
+        }),
+      });
     }
 
     const minValues = rows
@@ -336,6 +357,7 @@ export function buildDailyAggregates(
       maxLatencyMs: maxValues.length > 0 ? Math.max(...maxValues) : undefined,
       // Use max of hourly p95s as an upper-bound approximation.
       p95LatencyMs: p95Values.length > 0 ? Math.max(...p95Values) : undefined,
+      assertionStats,
     });
   }
 
@@ -370,6 +392,42 @@ async function rollupHourlyAggregates(params: RollupParams) {
   // Fold into daily aggregates, preserving (day, environmentId, sourceId) series.
   for (const daily of buildDailyAggregates(oldHourly)) {
     const newLatencySum = daily.latencySumMs;
+
+    // Assertion pass/fail counts are the ONLY aggregatedResult content that
+    // survives the daily rollup (strategy/collector states cannot combine
+    // across hours). The conflict path merges in JS by pre-reading the
+    // existing daily row — safe because retention runs in a single work-queue
+    // consumer group, so there is no concurrent writer for this tuple.
+    let dailyAggregatedResult: Record<string, unknown> | undefined;
+    if (daily.assertionStats !== undefined) {
+      const [existingDaily] = await db
+        .select({ aggregatedResult: healthCheckAggregates.aggregatedResult })
+        .from(healthCheckAggregates)
+        .where(
+          and(
+            eq(healthCheckAggregates.systemId, systemId),
+            eq(healthCheckAggregates.configurationId, configurationId),
+            eq(healthCheckAggregates.bucketSize, "daily"),
+            eq(healthCheckAggregates.bucketStart, daily.bucketStart),
+            daily.environmentId === null
+              ? sql`${healthCheckAggregates.environmentId} IS NULL`
+              : eq(healthCheckAggregates.environmentId, daily.environmentId),
+            daily.sourceId === null
+              ? sql`${healthCheckAggregates.sourceId} IS NULL`
+              : eq(healthCheckAggregates.sourceId, daily.sourceId),
+          ),
+        );
+      const mergedStats = mergeAssertionStats({
+        a: readAssertionStats({
+          aggregatedResult: existingDaily?.aggregatedResult ?? undefined,
+        }),
+        b: daily.assertionStats,
+      });
+      if (mergedStats !== undefined) {
+        dailyAggregatedResult = { [ASSERTIONS_AGG_KEY]: mergedStats };
+      }
+    }
+
     // Upsert the daily aggregate. A row may already exist for this
     // (configurationId, systemId, environmentId, day, daily, sourceId) tuple if
     // a prior rollup ran and then late-arriving hourly buckets (e.g. from a
@@ -394,7 +452,8 @@ async function rollupHourlyAggregates(params: RollupParams) {
         minLatencyMs: daily.minLatencyMs,
         maxLatencyMs: daily.maxLatencyMs,
         p95LatencyMs: daily.p95LatencyMs,
-        aggregatedResult: undefined, // Cannot combine result across hours
+        // Only the additive assertion counts survive across hours.
+        aggregatedResult: dailyAggregatedResult,
       })
       .onConflictDoUpdate({
         target: [...DAILY_AGGREGATE_CONFLICT_TARGET],
@@ -417,6 +476,10 @@ async function rollupHourlyAggregates(params: RollupParams) {
             daily.p95LatencyMs === undefined
               ? sql`${healthCheckAggregates.p95LatencyMs}`
               : sql`GREATEST(COALESCE(${healthCheckAggregates.p95LatencyMs}, ${daily.p95LatencyMs}), ${daily.p95LatencyMs})`,
+          // JS-merged above (existing row's counts + this rollup's counts).
+          ...(dailyAggregatedResult === undefined
+            ? {}
+            : { aggregatedResult: dailyAggregatedResult }),
         },
       });
   }