@obsunified/collector 2.2.0 → 2.2.3

package/src/lib/housekeeping.test.ts

@@ -62,6 +62,7 @@ describe("purgeSecondaryRows", () => {
 			ontology_nodes: 0,
 			change_events: 0,
 			incident_investigations: 0,
+			incident_leases_reaped: 0,
 			remediation_proposals: 0,
 			investigation_findings: 0,
 		});
@@ -150,4 +151,73 @@ describe("purgeSecondaryRows", () => {
 		]);
 		db.close();
 	});
+
+	it("reaps expired leases back to open without touching live leases or non-leased incidents (RFC 0013 § 11)", async () => {
+		const db = createMigratedSqliteDb();
+		const ins = db.raw.prepare(
+			`INSERT INTO incident_investigations (project_id, environment, id, dedup_key, status, target_node_id, symptom_anchor_kind, symptom_anchor_id, lease_owner_id, lease_expires_at, opened_at, updated_at, expires_at)
+			 VALUES ('alpha', 'prod', ?, ?, ?, 'n', 'trace', 't', ?, ?, ?, ?, ?)`,
+		);
+		const farFuture = iso(-24 * 365);
+		ins.run(
+			"lease-expired",
+			"k1",
+			"leased",
+			"runner-a",
+			iso(1),
+			iso(5),
+			iso(5),
+			farFuture,
+		);
+		ins.run(
+			"lease-live",
+			"k2",
+			"leased",
+			"runner-b",
+			iso(-1),
+			iso(5),
+			iso(5),
+			farFuture,
+		);
+		ins.run(
+			"remediating",
+			"k3",
+			"remediating",
+			"runner-c",
+			iso(1),
+			iso(5),
+			iso(5),
+			farFuture,
+		);
+
+		const summary = await purgeSecondaryRows(db, {
+			retentionHours: 72,
+			now: () => NOW,
+		});
+		expect(summary.incident_leases_reaped).toBe(1);
+		const rows = db.raw
+			.prepare(
+				`SELECT id, status, lease_owner_id FROM incident_investigations ORDER BY id`,
+			)
+			.all() as Array<{
+			id: string;
+			status: string;
+			lease_owner_id: string | null;
+		}>;
+		expect(rows).toEqual([
+			{ id: "lease-expired", status: "open", lease_owner_id: null },
+			{ id: "lease-live", status: "leased", lease_owner_id: "runner-b" },
+			{ id: "remediating", status: "remediating", lease_owner_id: "runner-c" },
+		]);
+		db.close();
+	});
+
+	it("propagates storage errors instead of silently swallowing them", async () => {
+		const db = createMigratedSqliteDb();
+		db.raw.exec("DROP TABLE remediation_proposals");
+		await expect(
+			purgeSecondaryRows(db, { retentionHours: 72, now: () => NOW }),
+		).rejects.toThrow(/remediation_proposals/);
+		db.close();
+	});
 });

package/src/lib/housekeeping.ts

@@ -13,7 +13,6 @@
  *    the signal they reference); expansions follow their ref.
  */
 
-import { evaluateRemediationWatchdogs } from "./autosre-remediation-gate";
 import type { SqlDb } from "./sql-db";
 
 export const ALERT_EVALUATIONS_MAX_AGE_HOURS = 720;
@@ -29,6 +28,8 @@ export interface HousekeepingSummary {
 	ontology_nodes?: number;
 	change_events?: number;
 	incident_investigations?: number;
+	/** `leased` incidents whose lease expired and were returned to `open` (RFC 0013 § 11). */
+	incident_leases_reaped?: number;
 	investigation_findings?: number;
 	remediation_proposals?: number;
 }
@@ -92,90 +93,96 @@ export async function purgeSecondaryRows(
 		.run();
 
 	// RFC 0013 — AutoSRE ontology, change events, incident investigations,
-	// investigation findings, and remediation proposals retention + watchdog.
+	// investigation findings, and remediation proposals retention, plus lease
+	// reaping. Errors propagate (the retention caller logs them); the
+	// post-remediation watchdog runs on the 1-minute analyses tick instead.
 	const thirtyDaysAgoIso = isoBefore(30 * 24);
 	const ninetyDaysAgoIso = isoBefore(90 * 24);
-	let ontologyEdgesPurged = 0;
-	let ontologyNodesPurged = 0;
-	let changeEventsPurged = 0;
-	let incidentInvestigationsPurged = 0;
-	let investigationFindingsPurged = 0;
-	let remediationProposalsPurged = 0;
-	try {
-		const edgesRes = await db
-			.prepare(`DELETE FROM ontology_edges WHERE last_seen_at < ?`)
-			.bind(thirtyDaysAgoIso)
-			.run();
-		ontologyEdgesPurged = changes(edgesRes);
-
-		const nodesRes = await db
-			.prepare(
-				`DELETE FROM ontology_nodes
-				 WHERE last_seen_at < ?
-				   AND NOT EXISTS (
-				     SELECT 1 FROM ontology_edges e
-				     WHERE e.project_id = ontology_nodes.project_id
-				       AND e.environment = ontology_nodes.environment
-				       AND (e.source_node_id = ontology_nodes.id OR e.target_node_id = ontology_nodes.id)
-				   )`,
-			)
-			.bind(thirtyDaysAgoIso)
-			.run();
-		ontologyNodesPurged = changes(nodesRes);
-
-		const proposalsRes = await db
-			.prepare(
-				`DELETE FROM remediation_proposals
-				 WHERE (expires_at IS NOT NULL AND expires_at < ?)
-				    OR (expires_at IS NULL AND created_at < ?)`,
-			)
-			.bind(nowIso, ninetyDaysAgoIso)
-			.run();
-		remediationProposalsPurged = changes(proposalsRes);
-
-		const findingsRes = await db
-			.prepare(
-				`DELETE FROM investigation_findings
-				 WHERE causal_verification_status NOT IN ('counterfactual_verified', 'operationally_corroborated')
-				   AND ((expires_at IS NOT NULL AND expires_at < ?)
-				     OR (expires_at IS NULL AND created_at < ?))`,
-			)
-			.bind(nowIso, ninetyDaysAgoIso)
-			.run();
-		investigationFindingsPurged = changes(findingsRes);
-
-		// Preserve change_events referenced by active investigation_findings
-		const changesRes = await db
-			.prepare(
-				`DELETE FROM change_events
-				 WHERE ((expires_at IS NOT NULL AND expires_at < ?)
-				     OR (expires_at IS NULL AND occurred_at < ?))
-				   AND NOT EXISTS (
-				     SELECT 1 FROM investigation_findings f
-				     WHERE f.project_id = change_events.project_id
-				       AND f.environment = change_events.environment
-				       AND f.contributing_change_id = change_events.id
-				   )`,
-			)
-			.bind(nowIso, ninetyDaysAgoIso)
-			.run();
-		changeEventsPurged = changes(changesRes);
-
-		const incidentsRes = await db
-			.prepare(
-				`DELETE FROM incident_investigations
-				 WHERE status IN ('resolved', 'escalated')
-				   AND ((expires_at IS NOT NULL AND expires_at < ?)
-				     OR (expires_at IS NULL AND updated_at < ?))`,
-			)
-			.bind(nowIso, ninetyDaysAgoIso)
-			.run();
-		incidentInvestigationsPurged = changes(incidentsRes);
-
-		await evaluateRemediationWatchdogs(db, { nowIso });
-	} catch {
-		// Gracefully ignore when running against partial test schemas without 050
-	}
+	const edgesRes = await db
+		.prepare(`DELETE FROM ontology_edges WHERE last_seen_at < ?`)
+		.bind(thirtyDaysAgoIso)
+		.run();
+	const ontologyEdgesPurged = changes(edgesRes);
+
+	const nodesRes = await db
+		.prepare(
+			`DELETE FROM ontology_nodes
+			 WHERE last_seen_at < ?
+			   AND NOT EXISTS (
+			     SELECT 1 FROM ontology_edges e
+			     WHERE e.project_id = ontology_nodes.project_id
+			       AND e.environment = ontology_nodes.environment
+			       AND (e.source_node_id = ontology_nodes.id OR e.target_node_id = ontology_nodes.id)
+			   )`,
+		)
+		.bind(thirtyDaysAgoIso)
+		.run();
+	const ontologyNodesPurged = changes(nodesRes);
+
+	const proposalsRes = await db
+		.prepare(
+			`DELETE FROM remediation_proposals
+			 WHERE (expires_at IS NOT NULL AND expires_at < ?)
+			    OR (expires_at IS NULL AND created_at < ?)`,
+		)
+		.bind(nowIso, ninetyDaysAgoIso)
+		.run();
+	const remediationProposalsPurged = changes(proposalsRes);
+
+	const findingsRes = await db
+		.prepare(
+			`DELETE FROM investigation_findings
+			 WHERE causal_verification_status NOT IN ('counterfactual_verified', 'operationally_corroborated')
+			   AND ((expires_at IS NOT NULL AND expires_at < ?)
+			     OR (expires_at IS NULL AND created_at < ?))`,
+		)
+		.bind(nowIso, ninetyDaysAgoIso)
+		.run();
+	const investigationFindingsPurged = changes(findingsRes);
+
+	// Preserve change_events referenced by active investigation_findings
+	const changesRes = await db
+		.prepare(
+			`DELETE FROM change_events
+			 WHERE ((expires_at IS NOT NULL AND expires_at < ?)
+			     OR (expires_at IS NULL AND occurred_at < ?))
+			   AND NOT EXISTS (
+			     SELECT 1 FROM investigation_findings f
+			     WHERE f.project_id = change_events.project_id
+			       AND f.environment = change_events.environment
+			       AND f.contributing_change_id = change_events.id
+			   )`,
+		)
+		.bind(nowIso, ninetyDaysAgoIso)
+		.run();
+	const changeEventsPurged = changes(changesRes);
+
+	const incidentsRes = await db
+		.prepare(
+			`DELETE FROM incident_investigations
+			 WHERE status IN ('resolved', 'escalated')
+			   AND ((expires_at IS NOT NULL AND expires_at < ?)
+			     OR (expires_at IS NULL AND updated_at < ?))`,
+		)
+		.bind(nowIso, ninetyDaysAgoIso)
+		.run();
+	const incidentInvestigationsPurged = changes(incidentsRes);
+
+	// Lease reaping (RFC 0013 § 11): a runner that died holding a lease must not
+	// strand the incident. Expired `leased` incidents go back to `open` so the
+	// next runner can pick them up. `remediating`/`verifying` are owned by the
+	// proposal claim/watchdog timeouts, not by this reaper.
+	const leasesRes = await db
+		.prepare(
+			`UPDATE incident_investigations
+			 SET status = 'open', lease_owner_id = NULL, lease_expires_at = NULL, updated_at = ?
+			 WHERE status = 'leased'
+			   AND lease_expires_at IS NOT NULL
+			   AND lease_expires_at < ?`,
+		)
+		.bind(nowIso, nowIso)
+		.run();
+	const incidentLeasesReaped = changes(leasesRes);
 
 	return {
 		alert_evaluations: changes(alertEvaluations),
@@ -187,6 +194,7 @@ export async function purgeSecondaryRows(
 		ontology_nodes: ontologyNodesPurged,
 		change_events: changeEventsPurged,
 		incident_investigations: incidentInvestigationsPurged,
+		incident_leases_reaped: incidentLeasesReaped,
 		investigation_findings: investigationFindingsPurged,
 		remediation_proposals: remediationProposalsPurged,
 	};

package/src/lib/projects-store.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { sha256Hex } from "./hash";
-import { ProjectsStore } from "./projects-store";
+import { displayPrefix, ProjectsStore } from "./projects-store";
 import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
 
 describe("ProjectsStore.revokeKey", () => {
@@ -23,3 +23,40 @@ describe("ProjectsStore.revokeKey", () => {
 		db.close();
 	});
 });
+
+describe("bootstrap key display prefix", () => {
+	it("never exposes a short bootstrap key in full", async () => {
+		const db = createMigratedSqliteDb();
+		const store = new ProjectsStore(db);
+		await store.bootstrapEnvKey("short-key-12345"); // 15 chars
+		const [key] = (await store.listKeys("default")).filter(
+			(k) => k.name === "bootstrap",
+		);
+		expect(key?.keyPrefix).toBe("short");
+		expect("short-key-12345".startsWith(key?.keyPrefix ?? "")).toBe(true);
+		expect(key?.keyPrefix.length).toBeLessThan("short-key-12345".length);
+		db.close();
+	});
+
+	it("keeps 16 chars for long keys, matching minted keys", () => {
+		expect(displayPrefix("a".repeat(64))).toHaveLength(16);
+		expect(displayPrefix("abc")).toBe("a");
+		expect(displayPrefix("")).toBe("");
+	});
+
+	it("shrinks a legacy full-length prefix on the next bootstrap", async () => {
+		const db = createMigratedSqliteDb();
+		const store = new ProjectsStore(db);
+		await store.bootstrapEnvKey("legacy-key-1234");
+		await db
+			.prepare(`UPDATE ingest_keys SET key_prefix = ? WHERE name = 'bootstrap'`)
+			.bind("legacy-key-1234")
+			.run();
+		await store.bootstrapEnvKey("legacy-key-1234");
+		const [key] = (await store.listKeys("default")).filter(
+			(k) => k.name === "bootstrap",
+		);
+		expect(key?.keyPrefix).toBe("legac");
+		db.close();
+	});
+});

package/src/lib/projects-store.ts

@@ -31,6 +31,15 @@ const rowToKey = (row: IngestKeyRow): IngestKey => ({
 
 const SLUG_PATTERN = /^[a-z0-9]([a-z0-9-]{0,48}[a-z0-9])?$/;
 
+/**
+ * Display identifier for a secret: at most 16 chars (what minted keys show),
+ * but never more than a third of the secret, so a short operator-chosen
+ * INGEST_KEY can never be returned in full by `keys list`.
+ */
+export function displayPrefix(plaintext: string): string {
+	return plaintext.slice(0, Math.min(16, Math.floor(plaintext.length / 3)));
+}
+
 export class ProjectsStore {
 	constructor(private readonly db: SqlDb) {}
 
@@ -189,14 +198,24 @@ export class ProjectsStore {
 		if (!plaintext) return;
 		await this.ensureDefaultProject();
 		const keyHash = await sha256Hex(plaintext);
+		const keyPrefix = displayPrefix(plaintext);
 		const existing = await this.db
-			.prepare(`SELECT id FROM ingest_keys WHERE key_hash = ?`)
+			.prepare(`SELECT id, key_prefix FROM ingest_keys WHERE key_hash = ?`)
 			.bind(keyHash)
-			.first<{ id: string }>();
-		if (existing) return;
+			.first<{ id: string; key_prefix: string }>();
+		if (existing) {
+			// Rows written before the prefix was length-capped may hold a short
+			// bootstrap key in full; shrink them to the safe display prefix.
+			if (existing.key_prefix.length > keyPrefix.length) {
+				await this.db
+					.prepare(`UPDATE ingest_keys SET key_prefix = ? WHERE id = ?`)
+					.bind(keyPrefix, existing.id)
+					.run();
+			}
+			return;
+		}
 
 		const id = randomHex(16);
-		const keyPrefix = plaintext.slice(0, Math.min(16, plaintext.length));
 		const createdAt = new Date().toISOString();
 		await this.db
 			.prepare(

package/src/lib/sql-db-postgres.integration.test.ts

@@ -28,20 +28,22 @@ import type {
 	StoredSpan,
 	UsageEventRecord,
 } from "@obsunified/types";
-import type { MiddlewareHandler } from "hono";
+import { Hono, type MiddlewareHandler } from "hono";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { deriveAnalysesForProject } from "../analyses/derive";
 import { INVESTIGATION_ANALYSES } from "../analyses/investigations";
 import { TIER0_ANALYSES } from "../analyses/tier0";
 import {
-	type CollectorRuntime,
+	CollectorRuntime,
 	createTelemetryCollectorApp,
 	type SpanProcessorPlugin,
 } from "../framework/collector";
 import type { CollectorEnv, CollectorRouteContext } from "../framework/env";
 import type { DecodedMetricPoint } from "../otlp/decode";
 import { aiSpanPayloadsProcessorPlugin } from "../plugins/ai-span-payloads-processor";
+import { connectedRoutesPlugin } from "../plugins/connected-routes";
 import { identityReceiverPlugin } from "../plugins/identity-receiver";
+import { usageQueryRoutesPlugin } from "../plugins/usage-query-routes";
 import { purgeExpiredActionGraph } from "./action-retention";
 import { ActionStore } from "./actions-store";
 import { getAICallsOverview, ingestAICallBatch } from "./ai-store/calls";
@@ -1222,4 +1224,75 @@ describe.skipIf(!databaseUrl)("PostgresAdapter against a live Postgres", () => {
 		expect(errorRate.primaryValue).toBe(0.5);
 		expect(Array.isArray(errorRate.payload.sparkline)).toBe(true);
 	});
+
+	it("serves the change connected-rail and usage sessions routes without Postgres query errors", async () => {
+		const now = isoNow();
+		const later = isoIn(60 * 60 * 1000);
+		const insertSpan = (spanId: string, startTime: string) =>
+			db
+				.prepare(
+					`INSERT INTO telemetry_spans (
+						project_id, environment, trace_id, span_id, service_name, service_version,
+						span_name, status_code, start_time, end_time, duration_ms, received_at, expires_at
+					) VALUES ('default', 'default', 'trace-pg-1', ?, 'checkout', 'v9.9.9', 'POST /pay', 2, ?, ?, 5, ?, ?)`,
+				)
+				.bind(spanId, startTime, startTime, now, later)
+				.run();
+		await insertSpan("span-pg-a", "2026-01-01T00:00:00.000Z");
+		await insertSpan("span-pg-b", "2026-01-01T00:00:01.000Z");
+		await db
+			.prepare(
+				`INSERT INTO change_events (
+					project_id, environment, id, target_node_id, kind, source, summary,
+					service_name, version, occurred_at, received_at
+				) VALUES ('default', 'default', 'chg-pg-1', 'service:checkout', 'deploy', 'explicit', 'deploy v9.9.9', 'checkout', 'v9.9.9', ?, ?)`,
+			)
+			.bind(now, now)
+			.run();
+		await new UsageStore(db).ingest([
+			usageEvent({
+				eventId: "pg-s1-a",
+				sessionId: "pg-sess-1",
+				pagePath: "/a",
+			}),
+			usageEvent({
+				eventId: "pg-s1-b",
+				sessionId: "pg-sess-1",
+				pagePath: "/b",
+				eventType: "interaction",
+			}),
+		]);
+
+		const app = new Hono<{ Bindings: CollectorEnv }>();
+		const runtime = new CollectorRuntime();
+		connectedRoutesPlugin.register(app, runtime);
+		usageQueryRoutesPlugin.register(app, runtime);
+		const env = { DB: db as unknown as D1Database } as CollectorEnv;
+
+		const change = await app.request(
+			"/internal/connected/change/chg-pg-1",
+			{},
+			env,
+		);
+		expect(change.status).toBe(200);
+		const manifest = (await change.json()) as {
+			across: Array<{ links: Array<{ entityId: string }> }>;
+		};
+		const spanIds = manifest.across.flatMap((s) =>
+			s.links.map((l) => l.entityId),
+		);
+		// Most recent first, one link per span.
+		expect(spanIds).toEqual(["trace-pg-1:span-pg-b", "trace-pg-1:span-pg-a"]);
+
+		const sessions = await app.request(
+			"/internal/usage/sessions?hours=24",
+			{},
+			env,
+		);
+		expect(sessions.status).toBe(200);
+		const body = (await sessions.json()) as {
+			sessions: Array<{ sessionId: string; lastPath: string | null }>;
+		};
+		expect(body.sessions.map((r) => r.sessionId)).toContain("pg-sess-1");
+	});
 });

package/src/lib/store/ingest.ts

@@ -8,6 +8,7 @@ import type { SqlDb } from "../sql-db";
 export async function ingestTelemetrySpans(
 	db: SqlDb,
 	spans: StoredSpan[],
+	logger: { warn: (message: string) => void } = console,
 ): Promise<{ inserted: number; traceCount: number }> {
 	if (spans.length === 0) return { inserted: 0, traceCount: 0 };
 
@@ -82,65 +83,16 @@ export async function ingestTelemetrySpans(
 			),
 	);
 
-	try {
-		await db.batch(statements);
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		if (msg.includes("no such column: environment")) {
-			// Fallback for unit tests running against pre-050 partial schemas
-			const legacyStatements = enrichedSpans.map((span) =>
-				db
-					.prepare(`
-            INSERT OR IGNORE INTO telemetry_spans (
-              project_id, trace_id, span_id, parent_span_id, trace_state,
-              service_name, scope_name, scope_version, span_name, span_kind,
-              status_code, status_message, start_time, end_time, duration_ms,
-              attributes_json, dropped_attributes_count,
-              resource_attributes_json, events_json, dropped_events_count,
-              links_json, dropped_links_count, received_at, expires_at,
-              session_id, interaction_id, telemetry_sdk_name
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-          `)
-					.bind(
-						span.projectId,
-						span.traceId,
-						span.spanId,
-						span.parentSpanId,
-						span.traceState,
-						span.serviceName,
-						span.scopeName,
-						span.scopeVersion,
-						span.spanName,
-						span.spanKind,
-						span.statusCode,
-						span.statusMessage,
-						span.startTime,
-						span.endTime,
-						span.durationMs,
-						span.attributesJson,
-						span.droppedAttributesCount,
-						span.resourceAttributesJson,
-						span.eventsJson,
-						span.droppedEventsCount,
-						span.linksJson,
-						span.droppedLinksCount,
-						span.receivedAt,
-						span.expiresAt,
-						span.sessionId ?? null,
-						span.interactionId ?? null,
-						span.telemetrySdkName ?? null,
-					),
-			);
-			await db.batch(legacyStatements);
-		} else {
-			throw err;
-		}
-	}
+	await db.batch(statements);
 
 	try {
 		await upsertOntologyFromSpans(db, enrichedSpans);
-	} catch {
-		// Non-fatal on partial-schema unit test DBs
+	} catch (err) {
+		// Ontology enrichment must never block span ingest, but a failure here
+		// means the causal graph is silently going stale, so surface it.
+		logger.warn(
+			`upsertOntologyFromSpans failed: ${err instanceof Error ? err.message : String(err)}`,
+		);
 	}
 
 	// Trace instrumentation gaps are computed lazily at read time (see

package/src/lib/usage-store.ts

@@ -503,15 +503,21 @@ export class UsageStore {
 					SUM(CASE WHEN event_type = 'interaction' THEN 1 ELSE 0 END) AS interaction_count,
 					SUM(CASE WHEN event_type = 'frontend_error' OR severity = 'error' THEN 1 ELSE 0 END) AS error_count,
 					MAX(CASE WHEN event_type = 'page_view' THEN CAST(COALESCE(${loadMsExpr}, ${loadTimeMsExpr}, ${durationMsExpr}) AS REAL) ELSE NULL END) AS max_load_ms,
-					(SELECT referrer FROM usage_events ref WHERE ref.project_id = ue.project_id AND ref.session_id = ue.session_id ORDER BY occurred_at ASC LIMIT 1) AS referrer,
-					(SELECT page_path FROM usage_events lp WHERE lp.project_id = ue.project_id AND lp.session_id = ue.session_id ORDER BY occurred_at DESC LIMIT 1) AS last_path
+					(SELECT referrer FROM usage_events ref WHERE ref.project_id = ? AND ref.session_id = ue.session_id ORDER BY occurred_at ASC LIMIT 1) AS referrer,
+					(SELECT page_path FROM usage_events lp WHERE lp.project_id = ? AND lp.session_id = ue.session_id ORDER BY occurred_at DESC LIMIT 1) AS last_path
 				FROM usage_events ue
 				WHERE project_id = ? AND received_at >= ?
 				GROUP BY session_id
 				ORDER BY last_seen DESC
 				LIMIT ?`,
 			)
-			.bind(options.projectId, cutoff, limit * 3)
+			.bind(
+				options.projectId,
+				options.projectId,
+				options.projectId,
+				cutoff,
+				limit * 3,
+			)
 			.all<{
 				session_id: string;
 				visitor_id: string;

package/src/migrations/051_incident_active_dedup_unique.sql

@@ -0,0 +1,31 @@
+-- Make active-incident deduplication race-free (RFC 0013 § 6.A, governance review B4).
+--
+-- `openOrDeduplicateIncident` used to SELECT-then-INSERT, so two concurrent
+-- alerts for the same symptom could each open an incident. A partial UNIQUE
+-- index lets the database arbitrate; the application inserts with
+-- ON CONFLICT DO NOTHING and re-reads the winner.
+
+-- Collapse any pre-existing duplicate active rows (keep the newest per key) so
+-- the index can be built. Older duplicates are closed as escalated, not deleted.
+UPDATE incident_investigations
+SET status = 'escalated'
+WHERE status IN ('open', 'dispatched', 'leased', 'remediating', 'verifying')
+  AND EXISTS (
+    SELECT 1 FROM incident_investigations o
+    WHERE o.project_id = incident_investigations.project_id
+      AND o.environment = incident_investigations.environment
+      AND o.dedup_key = incident_investigations.dedup_key
+      AND o.status IN ('open', 'dispatched', 'leased', 'remediating', 'verifying')
+      AND (
+        o.opened_at > incident_investigations.opened_at
+        OR (o.opened_at = incident_investigations.opened_at AND o.id > incident_investigations.id)
+      )
+  );
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_incidents_active_dedup
+  ON incident_investigations (project_id, environment, dedup_key)
+  WHERE status IN ('open', 'dispatched', 'leased', 'remediating', 'verifying');
+
+-- Watchdog (governance review B11): a finding is only `recovered` after two
+-- consecutive checkpoints with sufficient traffic and a healthy error rate.
+ALTER TABLE investigation_findings ADD COLUMN consecutive_ok_checks INTEGER NOT NULL DEFAULT 0;

package/src/migrations/052_remediation_callback.sql

@@ -0,0 +1,10 @@
+-- Persisted grant-handoff callback (RFC 0013 § 6.B, journey review J17).
+--
+-- A proposal parked for human approval may carry a webhook that receives the
+-- one-time grant token when the approval happens later. `callback_url` is the
+-- target (SSRF-guarded again at delivery time); `callback_secret` is the HMAC
+-- signing secret, stored as supplied (the collector has no at-rest encryption
+-- helper) and never returned by any GET. Both are cleared once the grant is
+-- delivered, rejected or expired.
+ALTER TABLE remediation_proposals ADD COLUMN callback_url TEXT;
+ALTER TABLE remediation_proposals ADD COLUMN callback_secret TEXT;

package/src/migrations/053_remediation_callback_delivery.sql

@@ -0,0 +1,7 @@
+-- Last grant-handoff webhook delivery outcome (RFC 0013 § 6.B).
+--
+-- JSON `{status: 'delivered'|'failed', attempts, lastError, at}` recorded after
+-- the grant webhook is attempted (up to 3 attempts). It never contains the
+-- callback URL or secret, so unlike callback_url it is kept after approval so
+-- the dashboard can flag a failed handoff.
+ALTER TABLE remediation_proposals ADD COLUMN callback_delivery TEXT;

package/src/migrations/alert-state-notified.test.ts

@@ -44,9 +44,9 @@ describe("migration 049 (alert_state.notified)", () => {
 			.map((c) => (c as { name: string }).name);
 		expect(columnsBefore).not.toContain("notified");
 
-		expect(
-			applySqliteMigrations(db.raw, { from: "049", upTo: "049" }),
-		).toEqual(["049_alert_state_notified.sql"]);
+		expect(applySqliteMigrations(db.raw, { from: "049", upTo: "049" })).toEqual(
+			["049_alert_state_notified.sql"],
+		);
 
 		const notified = db.raw
 			.prepare("PRAGMA table_info(alert_state)")