@oneuptime/common 12.0.4 → 12.0.5

package/Server/API/StatusPageAPI.ts

@@ -53,7 +53,6 @@ import JSONFunctions from "../../Types/JSONFunctions";
 import ObjectID from "../../Types/ObjectID";
 import Phone from "../../Types/Phone";
 import PositiveNumber from "../../Types/PositiveNumber";
-import HashedString from "../../Types/HashedString";
 import AcmeChallenge from "../../Models/DatabaseModels/AcmeChallenge";
 import Incident from "../../Models/DatabaseModels/Incident";
 import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
@@ -85,7 +84,9 @@ import StatusPageOIDC from "../../Models/DatabaseModels/StatusPageOidc";
 import StatusPageSubscriber from "../../Models/DatabaseModels/StatusPageSubscriber";
 import StatusPageEventType from "../../Types/StatusPage/StatusPageEventType";
 import StatusPageResourceUptimeUtil from "../../Utils/StatusPage/ResourceUptime";
-import StatusPageGroupTreeUtil from "../../Utils/StatusPage/GroupTree";
+import StatusPageGroupTreeUtil, {
+  StatusPageGroupTreeIndex,
+} from "../../Utils/StatusPage/GroupTree";
 import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
 import { Green } from "../../Types/BrandColors";
 import UptimeUtil, { UptimeWindow } from "../../Utils/Uptime/UptimeUtil";
@@ -100,7 +101,6 @@ import Hostname from "../../Types/API/Hostname";
 import Protocol from "../../Types/API/Protocol";
 import DatabaseConfig from "../DatabaseConfig";
 import CookieUtil from "../Utils/Cookie";
-import { EncryptionSecret } from "../EnvironmentConfig";
 import { StatusPageApiRoute } from "../../ServiceRoute";
 import ProjectSmtpConfigService from "../Services/ProjectSmtpConfigService";
 import ForbiddenException from "../../Types/Exception/ForbiddenException";
@@ -941,10 +941,9 @@ export default class StatusPageAPI extends BaseAPI<
             req.params["statusPageId"] as string,
           );
 
-          const password: string | undefined =
-            req.body && (req.body["password"] as string);
+          const password: unknown = req.body && req.body["password"];
 
-          if (!password) {
+          if (typeof password !== "string" || !password) {
             throw new BadDataException("Master password is required.");
           }
 
@@ -956,6 +955,7 @@ export default class StatusPageAPI extends BaseAPI<
                 projectId: true,
                 enableMasterPassword: true,
                 masterPassword: true,
+                masterPasswordSalt: true,
                 isPublicStatusPage: true,
               },
               props: {
@@ -979,12 +979,14 @@ export default class StatusPageAPI extends BaseAPI<
             );
           }
 
-          const hashedInput: string = await HashedString.hashValue(
-            password,
-            EncryptionSecret,
-          );
+          const isMasterPasswordValid: boolean =
+            await StatusPageService.verifyHashedColumnValue({
+              item: statusPage,
+              columnName: "masterPassword",
+              plainValue: password,
+            });
 
-          if (hashedInput !== statusPage.masterPassword.toString()) {
+          if (!isMasterPasswordValid) {
             throw new BadDataException(MASTER_PASSWORD_INVALID_MESSAGE);
           }
 
@@ -1407,19 +1409,35 @@ export default class StatusPageAPI extends BaseAPI<
           const resourceUptimesByGroupId: Dictionary<Array<ResourceUptime>> =
             {};
 
+          /*
+           * Keyed the same way, so the loop below can look a group's uptime up
+           * instead of scanning the whole list for it. A status page can carry
+           * well over a thousand groups, and a scan per group is a scan of the
+           * whole list per group.
+           */
+          const groupUptimeByGroupId: Dictionary<StatusPageGroupUptime> = {};
+
           for (const groupUptime of groupUptimes) {
-            resourceUptimesByGroupId[
-              groupUptime.statusPageGroupId?.toString() || ""
-            ] = groupUptime.statusPageResourceUptimes;
+            const groupId: string =
+              groupUptime.statusPageGroupId?.toString() || "";
+
+            resourceUptimesByGroupId[groupId] =
+              groupUptime.statusPageResourceUptimes;
+            groupUptimeByGroupId[groupId] = groupUptime;
           }
 
+          /*
+           * One index for every subtree walk below, rather than one
+           * re-bucketing of the group list per group.
+           */
+          const statusPageGroupTreeIndex: StatusPageGroupTreeIndex =
+            StatusPageGroupTreeUtil.buildIndex({
+              statusPageGroups: statusPageGroups,
+            });
+
           for (const group of statusPageGroups) {
             const groupUptime: StatusPageGroupUptime | undefined =
-              groupUptimes.find((item: StatusPageGroupUptime) => {
-                return (
-                  item.statusPageGroupId?.toString() === group.id?.toString()
-                );
-              });
+              groupUptimeByGroupId[group.id?.toString() || ""];
 
             if (!groupUptime) {
               continue;
@@ -1429,6 +1447,7 @@ export default class StatusPageAPI extends BaseAPI<
               StatusPageGroupTreeUtil.getGroupAndDescendants({
                 statusPageGroup: group,
                 statusPageGroups: statusPageGroups,
+                index: statusPageGroupTreeIndex,
               }).flatMap((groupInSubtree: StatusPageGroup) => {
                 return (
                   resourceUptimesByGroupId[

package/Server/EnvironmentConfig.ts

@@ -8,6 +8,7 @@ import {
   HomeRoute,
 } from "../ServiceRoute";
 import BillingConfig from "./BillingConfig";
+import { getDistributedDdlTaskTimeoutSeconds } from "./Utils/AnalyticsDatabase/ClusterConfig";
 import Protocol from "../Types/API/Protocol";
 import URL from "../Types/API/URL";
 import Route from "../Types/API/Route";
@@ -569,6 +570,21 @@ export const ClickhouseClusterName: string =
 export const ClickhouseShardingKeyOverride: string =
   process.env["CLICKHOUSE_SHARDING_KEY"] || "";
 
+/*
+ * How long migration / schema-sync ON CLUSTER DDL waits for every host to
+ * report completion before giving up on confirmation (the statement itself
+ * stays queued and still executes on every host in the background). Default
+ * 180 — the ClickHouse server default. Raise this on clusters whose DDL queue
+ * drains slowly; the migration pool's socket-idle ceiling scales with it (see
+ * ClickhouseConfig.ts). 0 returns immediately (async); a negative value
+ * removes the server-side wait limit but the client still gives up at the
+ * migration pool's socket-idle ceiling (30-minute floor), so prefer a finite
+ * value. Mirrors the live reader getDistributedDdlTaskTimeoutSeconds() in
+ * ClusterConfig.ts, which is the single source of parsing truth.
+ */
+export const ClickhouseDistributedDdlTaskTimeoutSeconds: number =
+  getDistributedDdlTaskTimeoutSeconds();
+
 export const GitSha: string = process.env["GIT_SHA"] || "unknown";
 
 export const AppVersion: string = process.env["APP_VERSION"] || "unknown";

package/Server/Infrastructure/ClickhouseConfig.ts

@@ -13,6 +13,7 @@ import {
   MaxClickhouseIngestConnections,
   ShouldClickhouseSslEnable,
 } from "../EnvironmentConfig";
+import { getDistributedDdlTaskTimeoutSeconds } from "../Utils/AnalyticsDatabase/ClusterConfig";
 import Hostname from "../../Types/API/Hostname";
 
 export type ClickHouseClientConfigOptions = NodeClickHouseClientConfigOptions;
@@ -114,10 +115,23 @@ export const ingestDataSourceOptions: ClickHouseClientConfigOptions = {
  * additionally carry send_progress_in_http_headers (see MigrationExecuteOptions
  * in AnalyticsDatabaseService) so the socket stays non-idle, and a server-side
  * SETTINGS max_execution_time so ClickHouse remains the authoritative cap.
+ *
+ * The ON CLUSTER confirmation wait (distributed_ddl_task_timeout) streams zero
+ * bytes while pending, so this idle ceiling is the effective upper bound on any
+ * DDL confirmation wait. When CLICKHOUSE_DISTRIBUTED_DDL_TASK_TIMEOUT_SECONDS
+ * is raised past the 30-minute floor, scale the ceiling with it (plus slack)
+ * so the longer wait isn't killed client-side. A negative (infinite) DDL
+ * timeout is still bounded by the 30-minute floor — the client must not hang
+ * forever on a dead socket.
  */
+const migrationRequestTimeoutInMs: number = Math.max(
+  30 * 60 * 1000, // 30-minute floor
+  (getDistributedDdlTaskTimeoutSeconds() + 120) * 1000,
+);
+
 export const migrationDataSourceOptions: ClickHouseClientConfigOptions = {
   ...options,
-  request_timeout: 30 * 60 * 1000, // 30 minutes
+  request_timeout: migrationRequestTimeoutInMs,
 };
 
 export const testDataSourceOptions: ClickHouseClientConfigOptions =

package/Server/Infrastructure/ClickhouseDatabase.ts

@@ -87,7 +87,7 @@ export default class ClickhouseDatabase {
             }
 
             logger.debug(
-              `Clickhouse Database Connected: ${dataSourceOptions.host?.toString()}`,
+              `Clickhouse Database Connected: ${dataSourceOptions.url?.toString()}`,
             );
 
             return clickhouseClient;

package/Server/Infrastructure/Postgres/SchemaMigrations/1786096660558-AddTimeRangeToLogSavedView.ts

@@ -0,0 +1,27 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * A saved log view used to carry its time selection only inside the serialized
+ * `query`, where it had already been resolved to an absolute InBetween window.
+ * That froze "Past 1 Hour" into the hour it happened to be when the view was
+ * saved. The selection itself now lives here — the rolling range token, or the
+ * absolute window when the range is Custom — and is re-resolved on every apply.
+ *
+ * Nullable on purpose: rows created before this column still carry their
+ * absolute window in `query`, and readers fall back to it as a Custom range.
+ */
+export class AddTimeRangeToLogSavedView1786096660558
+  implements MigrationInterface
+{
+  public name = "AddTimeRangeToLogSavedView1786096660558";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "LogSavedView" ADD "timeRange" jsonb`);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "LogSavedView" DROP COLUMN "timeRange"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786101798351-MigrationName.ts

@@ -0,0 +1,89 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1786101798351 implements MigrationInterface {
+  public name = "MigrationName1786101798351";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableIncidentInstrumentationFixTasks" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAlertInstrumentationFixTasks" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutomaticIncidentCodeFixes" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutomaticAlertCodeFixes" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "incidentAiDailyAutonomousTokenLimit" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "alertAiDailyAutonomousTokenLimit" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "incidentAiDailyFixTaskLimit" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "alertAiDailyFixTaskLimit" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "incidentAiMaxConcurrentInvestigations" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "alertAiMaxConcurrentInvestigations" integer`,
+    );
+    await queryRunner.query(
+      `UPDATE "Project" SET "enableIncidentInstrumentationFixTasks" = "enableInstrumentationFixTasks", "enableAlertInstrumentationFixTasks" = "enableInstrumentationFixTasks", "enableAutomaticIncidentCodeFixes" = "enableAutomaticCodeFixes", "enableAutomaticAlertCodeFixes" = "enableAutomaticCodeFixes", "incidentAiDailyAutonomousTokenLimit" = "aiDailyAutonomousTokenLimit", "alertAiDailyAutonomousTokenLimit" = "aiDailyAutonomousTokenLimit", "incidentAiDailyFixTaskLimit" = "aiDailyFixTaskLimit", "alertAiDailyFixTaskLimit" = "aiDailyFixTaskLimit", "incidentAiMaxConcurrentInvestigations" = "aiMaxConcurrentInvestigations", "alertAiMaxConcurrentInvestigations" = "aiMaxConcurrentInvestigations"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableInstrumentationFixTasks"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutomaticCodeFixes"`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutomaticCodeFixes" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableInstrumentationFixTasks" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `UPDATE "Project" SET "enableInstrumentationFixTasks" = "enableIncidentInstrumentationFixTasks" OR "enableAlertInstrumentationFixTasks", "enableAutomaticCodeFixes" = "enableAutomaticIncidentCodeFixes" OR "enableAutomaticAlertCodeFixes"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "alertAiMaxConcurrentInvestigations"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "incidentAiMaxConcurrentInvestigations"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "alertAiDailyFixTaskLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "incidentAiDailyFixTaskLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "alertAiDailyAutonomousTokenLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "incidentAiDailyAutonomousTokenLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutomaticAlertCodeFixes"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutomaticIncidentCodeFixes"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAlertInstrumentationFixTasks"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableIncidentInstrumentationFixTasks"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786105470826-MigrationName.ts

@@ -0,0 +1,27 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1786105470826 implements MigrationInterface {
+  public name = "MigrationName1786105470826";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "IncidentFeed" ADD "aiRunId" uuid`);
+    await queryRunner.query(`ALTER TABLE "AlertFeed" ADD "aiRunId" uuid`);
+    await queryRunner.query(
+      `CREATE INDEX "IDX_bae064a2cf9282fc2cca934d78" ON "IncidentFeed" ("incidentId", "aiRunId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_7da528b06c0ae8b2f1b6c9c848" ON "AlertFeed" ("alertId", "aiRunId") `,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_7da528b06c0ae8b2f1b6c9c848"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_bae064a2cf9282fc2cca934d78"`,
+    );
+    await queryRunner.query(`ALTER TABLE "AlertFeed" DROP COLUMN "aiRunId"`);
+    await queryRunner.query(`ALTER TABLE "IncidentFeed" DROP COLUMN "aiRunId"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786400000000-AddMasterPasswordSalt.ts

@@ -0,0 +1,40 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+type ScryptHashExistsResult = {
+  exists: boolean;
+};
+
+export class AddMasterPasswordSalt1786400000000 implements MigrationInterface {
+  public name = "AddMasterPasswordSalt1786400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "masterPasswordSalt" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" ADD "masterPasswordSalt" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    const [dashboardResult] = (await queryRunner.query(
+      `SELECT EXISTS (SELECT 1 FROM "Dashboard" WHERE "masterPassword" LIKE 'scrypt$%') AS "exists"`,
+    )) as Array<ScryptHashExistsResult>;
+    const [statusPageResult] = (await queryRunner.query(
+      `SELECT EXISTS (SELECT 1 FROM "StatusPage" WHERE "masterPassword" LIKE 'scrypt$%') AS "exists"`,
+    )) as Array<ScryptHashExistsResult>;
+
+    if (dashboardResult?.exists || statusPageResult?.exists) {
+      throw new Error(
+        "Cannot remove master-password salt columns while scrypt master-password hashes exist.",
+      );
+    }
+
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" DROP COLUMN "masterPasswordSalt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "masterPasswordSalt"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786500000000-AddInvestigationCodeFixRecommendation.ts

@@ -0,0 +1,26 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with `npm run generate-postgres-migration` after adding
+ * AIRun.codeFixRecommendation. Existing rows fail closed as NotRecommended;
+ * incident/alert investigations move to Pending only in their atomic
+ * Completed transition, then settle through structured post-analysis
+ * classification.
+ */
+export class AddInvestigationCodeFixRecommendation1786500000000
+  implements MigrationInterface
+{
+  public name = "AddInvestigationCodeFixRecommendation1786500000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AIRun" ADD "codeFixRecommendation" character varying(100) NOT NULL DEFAULT 'NotRecommended'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AIRun" DROP COLUMN "codeFixRecommendation"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -501,9 +501,14 @@ import { AddRemediationVerification1785768089408 } from "./1785768089408-AddReme
 import { AddStatusPageMonitorRule1786005052769 } from "./1786005052769-AddStatusPageMonitorRule";
 import { AddPerUserPasswordSalt1786018109307 } from "./1786018109307-AddPerUserPasswordSalt";
 import { WidenHashedStringColumnsForScrypt1786023262402 } from "./1786023262402-WidenHashedStringColumnsForScrypt";
+import { AddTimeRangeToLogSavedView1786096660558 } from "./1786096660558-AddTimeRangeToLogSavedView";
 import { RestoreServiceLowerNameIndex1786100000000 } from "./1786100000000-RestoreServiceLowerNameIndex";
+import { MigrationName1786101798351 } from "./1786101798351-MigrationName";
+import { MigrationName1786105470826 } from "./1786105470826-MigrationName";
 import { RestoreDroppedUniqueIndexes1786200000000 } from "./1786200000000-RestoreDroppedUniqueIndexes";
 import { QuarantineUnboundGitHubInstallations1786300000000 } from "./1786300000000-QuarantineUnboundGitHubInstallations";
+import { AddMasterPasswordSalt1786400000000 } from "./1786400000000-AddMasterPasswordSalt";
+import { AddInvestigationCodeFixRecommendation1786500000000 } from "./1786500000000-AddInvestigationCodeFixRecommendation";
 
 export default [
   InitialMigration,
@@ -1009,7 +1014,12 @@ export default [
   AddStatusPageMonitorRule1786005052769,
   AddPerUserPasswordSalt1786018109307,
   WidenHashedStringColumnsForScrypt1786023262402,
+  AddTimeRangeToLogSavedView1786096660558,
   RestoreServiceLowerNameIndex1786100000000,
   RestoreDroppedUniqueIndexes1786200000000,
   QuarantineUnboundGitHubInstallations1786300000000,
+  MigrationName1786101798351,
+  AddMasterPasswordSalt1786400000000,
+  MigrationName1786105470826,
+  AddInvestigationCodeFixRecommendation1786500000000,
 ];

package/Server/Services/AIRunService.ts

@@ -3,12 +3,17 @@ import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import AIRunStatus from "../../Types/AI/AIRunStatus";
 import AIRunType from "../../Types/AI/AIRunType";
+import AIRunCodeFixRecommendation from "../../Types/AI/AIRunCodeFixRecommendation";
 import AIRunHumanVerdict from "../../Types/AI/AIRunHumanVerdict";
 import BadDataException from "../../Types/Exception/BadDataException";
 import CodeFixTaskType, {
   CodeFixContextKind,
   CodeFixTaskTypeHelper,
 } from "../../Types/AI/CodeFixTaskType";
+import {
+  getInvestigationCodeFixTaskSnapshot,
+  InvestigationCodeFixTaskContext,
+} from "../../Types/AI/CodeFixTaskContext";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CountBy from "../Types/Database/CountBy";
@@ -40,6 +45,7 @@ export interface AIRunTransitionSet {
   llmCallCount?: number | undefined;
   toolCallCount?: number | undefined;
   totalTokens?: number | undefined;
+  codeFixRecommendation?: AIRunCodeFixRecommendation | undefined;
   // The claiming agent's id as a string (ObjectID.toString()) — see above.
   aiAgentId?: string | undefined;
 }
@@ -52,8 +58,8 @@ export class Service extends DatabaseService<Model> {
   /*
    * A genuinely atomic status transition: one conditional UPDATE whose WHERE
    * carries the expected current status (and optionally the expected
-   * attemptCount). Returns the number of rows changed — 0 means another
-   * actor won the race.
+   * attemptCount / heartbeat snapshot). Returns the number of rows changed —
+   * 0 means another actor won the race or refreshed the heartbeat.
    *
    * This exists because updateOneBy is SELECT-then-save: two concurrent
    * callers can both observe the precondition and both write, so it cannot
@@ -65,6 +71,7 @@ export class Service extends DatabaseService<Model> {
     aiRunId: ObjectID;
     fromStatus: AIRunStatus;
     expectedAttemptCount?: number | undefined;
+    expectedLastHeartbeatAt?: Date | undefined;
     set: AIRunTransitionSet;
   }): Promise<number> {
     const queryBuilder: UpdateQueryBuilder<Model> = this.getRepository()
@@ -81,11 +88,57 @@ export class Service extends DatabaseService<Model> {
       });
     }
 
+    if (data.expectedLastHeartbeatAt !== undefined) {
+      queryBuilder.andWhere('"lastHeartbeatAt" = :expectedLastHeartbeatAt', {
+        expectedLastHeartbeatAt: data.expectedLastHeartbeatAt,
+      });
+    }
+
     const result: UpdateResult = await queryBuilder.execute();
 
     return result.affected || 0;
   }
 
+  /*
+   * Atomically settle the code-fix decision written as Pending by the
+   * winning investigation completion transition. The recommendation and
+   * immutable analysis snapshot are one database UPDATE guarded by both the
+   * run id and Pending state; a stale writer can never overwrite a decision
+   * another actor already settled.
+   */
+  @CaptureSpan()
+  public async finalizeInvestigationCodeFixRecommendation(
+    data:
+      | {
+          aiRunId: ObjectID;
+          recommendation: AIRunCodeFixRecommendation.Recommended;
+          taskContext: InvestigationCodeFixTaskContext;
+        }
+      | {
+          aiRunId: ObjectID;
+          recommendation: AIRunCodeFixRecommendation.NotRecommended;
+        },
+  ): Promise<number> {
+    const result: UpdateResult = await this.getRepository()
+      .createQueryBuilder()
+      .update(Model)
+      .set({
+        codeFixRecommendation: data.recommendation,
+        ...(data.recommendation === AIRunCodeFixRecommendation.Recommended
+          ? { taskContext: data.taskContext }
+          : {}),
+      } as QueryDeepPartialEntity<Model>)
+      .where('"_id" = :id', { id: data.aiRunId.toString() })
+      .andWhere('"status" = :status', { status: AIRunStatus.Completed })
+      .andWhere('"codeFixRecommendation" = :pending', {
+        pending: AIRunCodeFixRecommendation.Pending,
+      })
+      .andWhere('"deletedAt" IS NULL')
+      .execute();
+
+    return result.affected || 0;
+  }
+
   /*
    * Atomically claim the oldest Queued code-fix run for an external agent
    * worker (the /ai-agent-task/get-pending-task route). The Queued -> Running
@@ -193,10 +246,22 @@ export class Service extends DatabaseService<Model> {
           ? null
           : "Queued code-fix run has no telemetry exception to fix.";
       } else if (contextKind === CodeFixContextKind.IncidentOrAlertSubject) {
-        missingContextMessage =
-          run.triggeredByIncidentId || run.triggeredByAlertId
-            ? null
-            : "Queued code-fix run has no incident or alert subject.";
+        if (!run.triggeredByIncidentId && !run.triggeredByAlertId) {
+          missingContextMessage =
+            "Queued code-fix run has no incident or alert subject.";
+        } else if (
+          run.codeFixTaskType === CodeFixTaskType.FixFromIncident &&
+          !getInvestigationCodeFixTaskSnapshot(run.taskContext)
+        ) {
+          /*
+           * A subject alone is mutable context: a later investigation can post
+           * another RootCause before the worker starts. FixFromIncident must
+           * therefore carry the exact Recommended run + analysis it was
+           * authorized from. Contextless legacy rows fail closed.
+           */
+          missingContextMessage =
+            "Queued FixFromIncident run has no complete pinned investigation analysis snapshot.";
+        }
       } else if (
         run.codeFixTaskType === CodeFixTaskType.ImproveLogging ||
         run.codeFixTaskType === CodeFixTaskType.ImproveTracing
@@ -296,7 +361,7 @@ export class Service extends DatabaseService<Model> {
 
   /*
    * Measurement layer (Phase 2): record a human's one-click verdict
-   * (Confirmed / Rejected) on the LATEST COMPLETED investigation run for an
+   * (Confirmed / Rejected) on one exact COMPLETED investigation run for an
    * incident or alert. Overwriting an existing verdict is deliberate — a
    * user may change their mind; the verdict is per-run state, not an audit
    * trail. Throws when no completed investigation exists for the subject.
@@ -305,7 +370,9 @@ export class Service extends DatabaseService<Model> {
    * are system-authored, so the per-user privacy pin would hide them).
    */
   @CaptureSpan()
-  public async applyHumanVerdictToLatestInvestigation(data: {
+  public async applyHumanVerdictToInvestigation(data: {
+    aiRunId: ObjectID;
+    projectId: ObjectID;
     incidentId?: ObjectID | undefined;
     alertId?: ObjectID | undefined;
     verdict: AIRunHumanVerdict;
@@ -319,6 +386,8 @@ export class Service extends DatabaseService<Model> {
 
     const run: Model | null = await this.findOneBy({
       query: {
+        _id: data.aiRunId,
+        projectId: data.projectId,
         runType: AIRunType.Investigation,
         status: AIRunStatus.Completed,
         ...(data.incidentId
@@ -326,13 +395,12 @@ export class Service extends DatabaseService<Model> {
           : { triggeredByAlertId: data.alertId! }),
       },
       select: { _id: true },
-      sort: { createdAt: SortOrder.Descending },
       props: { isRoot: true },
     });
 
     if (!run || !run.id) {
       throw new BadDataException(
-        "No completed AI investigation exists for this subject yet — a verdict can only be recorded on a completed investigation.",
+        "The selected completed AI investigation does not exist for this subject — refresh the page before recording a verdict.",
       );
     }