@teamscala/service-boot 0.23.516 → 0.23.518

package/src/handlers/platform-fault-escalation/config.ts

@@ -1,95 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The config row of the platform-fault-escalation pg-boss handler
- * (config/platform-fault-escalation).
- *
- * Split out of handlers/platform-fault-escalation.ts (500 lines) —
- * byte-for-byte move; import paths adjusted only.
- */
-
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import * as v from "valibot";
-
-export const CONFIG_SLUG = "platform-fault-escalation";
-
-export const FaultEscalationConfigSchema = v.object({
-	/** Postgres regex patterns selecting watched event_log kinds. */
-	watched_kind_patterns: v.array(v.string()),
-	/** Lookback window for the recurrence/duration aggregate, minutes. */
-	window_minutes: v.number(),
-	min_count: v.number(),
-	min_span_minutes: v.number(),
-	/** Per-kind recurrence/duration overrides — low-rate-but-persistent kinds. */
-	kind_thresholds: v.optional(
-		v.record(
-			v.string(),
-			v.object({
-				min_count: v.optional(v.number()),
-				min_span_minutes: v.optional(v.number()),
-			}),
-		),
-	),
-	resolve_after_minutes: v.number(),
-	/** Kinds a standing agent lane answers, which therefore escalate to the
-	 * work item WITHOUT paging the operator (operator ruling 2026-08-28: "why
-	 * is the WhatsApp PA messaging me about stuff that you should be doing").
-	 * The episode, the comment and the durable record are unchanged — only the
-	 * phone is spared, so silencing a page never silences the signal. */
-	agent_handled_kinds: v.optional(v.array(v.string())),
-	/** Per-kind volume sources closing the quiet-vs-dead gap: a fault kind
-	 * whose producer can DIE maps to the kind whose row VOLUME proves the
-	 * pipeline alive. Without a source, resolution on quiet is unchanged;
-	 * with one, resolve additionally requires the volume floor in-window,
-	 * and quiet-with-zero-volume HOLDS the episode open instead (one hold
-	 * notice per episode-state — measured 2026-08-27: the dead llm-router
-	 * emitted zero failures and the sweep closed as healthy). */
-	volume_sources: v.optional(
-		v.record(
-			v.string(),
-			v.object({
-				volume_kind_pattern: v.string(),
-				min_volume: v.optional(v.number()),
-			}),
-		),
-	),
-	/** Per-kind CAPABILITY PROBES gating the recovery transition (operator
-	 * ruling 2026-08-28: a layer emitting a degraded transition owes a
-	 * recovery transition backed by a capability probe, never a timer over
-	 * an empty event stream). A kind declared here resolves only when its
-	 * probe answers HTTP OK; an unreachable probe HOLDS the episode open —
-	 * once per episode-state, never an alarm. The volume floor above is
-	 * still event-stream evidence and cannot answer alone: its window is
-	 * cumulative, so hours of healthy history mask a just-died producer
-	 * (measured 2026-08-28: llm.provider.call.failed resolved after 31
-	 * quiet minutes on 12h-old volume while the pipeline was down). */
-	probe_sources: v.optional(
-		v.record(
-			v.string(),
-			v.object({
-				url: v.pipe(v.string(), v.minLength(1)),
-				timeout_seconds: v.optional(v.number()),
-			}),
-		),
-	),
-	/** The orchestrator's work item — escalations are COMMENTS on it, never
-	 * task rows (the fleet-task-placement CHECK constraint refuses a system
-	 * task without session identity, and an escalation is a finding, not an
-	 * assigned unit of work). */
-	orchestrator_work_item_id: v.string(),
-	/** Per-kind copy for the message (impact + recommendation). Falls back to default_copy. */
-	copy: v.record(v.string(), v.object({ impact: v.string(), recommendation: v.string() })),
-	default_copy: v.object({ impact: v.string(), recommendation: v.string() }),
-	/** Per-kind payload-field whitelist sampled into the message's evidence
-	 * line — named fields ONLY, never the whole payload: some kinds embed
-	 * request context, and the escalation channel is WhatsApp. */
-	sample_fields: v.optional(v.record(v.string(), v.array(v.string()))),
-});
-
-export type FaultEscalationConfig = v.InferOutput<typeof FaultEscalationConfigSchema>;
-
-export function loadFaultEscalationConfig(): Promise<FaultEscalationConfig> {
-	return loadRegistryConfig("config", CONFIG_SLUG, FaultEscalationConfigSchema);
-}

package/src/handlers/platform-fault-escalation/delivery.ts

@@ -1,327 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Escalation delivery of the platform-fault-escalation handler: claim the
- * episode, resolve the operator-relay WhatsApp bot, send via
- * messaging_whatsapp_send, verify the message id, record the comment +
- * readback-corrected episode — and close a quiet episode.
- *
- * Split out of handlers/platform-fault-escalation.ts (500 lines) —
- * byte-for-byte move; import paths adjusted only.
- */
-
-import type { ExecutionContext } from "@teamscala/os/contracts/mcp";
-import { idsWhereJsonKey } from "@teamscala/db/json-key-filter";
-import { recordEvent } from "@teamscala/event-log/record-event";
-import {
-	composeEscalationMessage,
-	composeZeroVolumeMessage,
-	extractWhatsAppMessageId,
-	pagesOperator,
-	type EscalationEpisode,
-	type FaultAggregate,
-	type ZeroVolumeSource,
-} from "../platform-fault-escalation-logic.ts";
-import type { FaultEscalationConfig } from "./config.ts";
-import { loadFaultEscalationConfig } from "./config.ts";
-import { fetchLatestEvidence } from "./event-log-queries.ts";
-import { getSystemIdentity, orpc } from "./orpc-client.ts";
-
-interface OperatorRelayBot {
-	id: string;
-	organisation_id: string;
-	external_id: string | null;
-	flow_config: { operator_phone?: string } | null;
-}
-
-async function resolveOperatorRelay(): Promise<OperatorRelayBot> {
-	// flow_config.mode lives inside json; the v8 builder cannot address it.
-	const relayBotIds = await idsWhereJsonKey({
-		table: "messaging_bots",
-		column: "flow_config",
-		key: "mode",
-		equals: "operator-relay",
-	});
-	const bot = (await (await orpc()).messaging_bots.findFirst({
-		where: {
-			is_active: true,
-			platform: "whatsapp",
-			id: { in: relayBotIds },
-		},
-		select: { id: true, organisation_id: true, external_id: true, flow_config: true },
-	})) as unknown as OperatorRelayBot | null;
-	if (!bot) throw new Error("platform-fault-escalation: no active operator-relay WhatsApp bot row");
-	const phone = (bot.flow_config as { operator_phone?: string } | null)?.operator_phone;
-	if (!phone) throw new Error("platform-fault-escalation: operator-relay bot has no operator_phone");
-	return bot as OperatorRelayBot;
-}
-
-export async function deliverEscalation(
-	kind: string,
-	aggregate: FaultAggregate,
-	config: FaultEscalationConfig,
-): Promise<{ messageId: string | null; workItemId: string }> {
-	const now = new Date();
-
-	// 1. Claim the episode BEFORE sending, so a send failure leaves a durable
-	// claim the next sweep retries instead of a lost escalation.
-	await (await orpc()).platform_fault_escalations.upsert({
-		where: { kind },
-		create: {
-			kind,
-			first_seen_at: aggregate.firstSeen.toISOString(),
-			last_seen_at: aggregate.lastSeen.toISOString(),
-			event_count: aggregate.count,
-		},
-		update: {
-			first_seen_at: aggregate.firstSeen.toISOString(),
-			last_seen_at: aggregate.lastSeen.toISOString(),
-			event_count: aggregate.count,
-			resolved_at: null,
-			// CLEARING THIS IS WHAT STOPS AN ESCALATION STORM. A re-armed row
-			// keeps resolved_at NULL, so it still loads as open, and
-			// `escalate` fires for any episode that is resolved OR re-armed.
-			// Leaving rearmed_at set would therefore re-escalate the same kind
-			// on EVERY sweep — the firing state must be consumed by the firing.
-			rearmed_at: null,
-		},
-	});
-
-	// 2. Resolve the operator relay and send. The send surface is the
-	// `messaging_whatsapp_send` intrinsic (scala-mcp / messaging-mcp-boot),
-	// which delegates to the Rust scala-messaging-service — the channel owner
-	// that picks the device and records the send in messaging_logs. The retired
-	// api_gowa_message tool (deactivated 2026-08-26) is no longer callable;
-	// naming it here left every escalation send failing with "Unknown tool".
-
-	// PAGING IS PER-KIND (operator ruling 2026-08-28). Only the phone is
-	// skipped; episode, comment and record are identical, so a silenced page
-	// never becomes a silenced signal.
-	const paging = pagesOperator(kind, config.agent_handled_kinds);
-	const copy = config.copy[kind] ?? config.default_copy;
-	const { sample, lastEvent } = await fetchLatestEvidence(kind, config.sample_fields?.[kind] ?? []);
-	const message = composeEscalationMessage({
-		kind,
-		aggregate,
-		sample,
-		lastEvent,
-		impact: copy.impact,
-		recommendation: copy.recommendation,
-	});
-
-	// 3. VERIFY delivery before recording it: the send must return a WhatsApp
-	// message id. No id => throw, the claim stays undelivered, next sweep retries.
-	// An agent-handled kind sends nothing, so there is no id to verify and none
-	// is recorded — absence here means "never paged", never "paged unverified".
-	let messageId: string | null = null;
-	if (paging) {
-		const bot = await resolveOperatorRelay();
-		const operatorPhone = (bot.flow_config as { operator_phone?: string }).operator_phone!;
-		const { userId, organisationId } = await getSystemIdentity();
-		const systemCtx: ExecutionContext = { userId, organisationId } as ExecutionContext;
-		const { forwardToolToCentralMcp } = await import(
-			"@teamscala/chat-completion/central-tool-forwarder"
-		);
-		const sendResult = await forwardToolToCentralMcp(
-			"messaging_whatsapp_send",
-			{ phone: operatorPhone, message },
-			systemCtx,
-		);
-		messageId = extractWhatsAppMessageId(sendResult);
-		if (!messageId) {
-			throw new Error(
-				`platform-fault-escalation: WhatsApp send for '${kind}' returned no message id — not recording delivery. ` +
-					`Response: ${JSON.stringify(sendResult).slice(0, 400)}`,
-			);
-		}
-	}
-
-	// 4. Durable record: a COMMENT on the orchestrator's work item — an
-	// escalation is a finding the orchestrator/operator triages, not an
-	// assigned task (the fleet-task-placement constraint refuses task rows
-	// without session identity by design).
-	const comment = await (await orpc()).comments.create({
-		data: {
-			work_item_id: config.orchestrator_work_item_id,
-			content: message,
-			source_cli_session_id: null,
-		},
-	});
-
-	// 5. Readback-correct the episode: delivered + linked in one update.
-	await (await orpc()).platform_fault_escalations.update({
-		where: { kind },
-		data: {
-			escalated_at: now.toISOString(),
-			work_item_id: config.orchestrator_work_item_id,
-			delivered_comment_id: comment.id,
-			delivered_message_id: messageId,
-			last_updated_at: now.toISOString(),
-			updated_at: now.toISOString(),
-		},
-	});
-
-	recordEvent({
-		kind: "platform.fault.escalated",
-		payload: {
-			event_kind: kind,
-			count: aggregate.count,
-			sample,
-			last_event_id: lastEvent?.eventId ?? null,
-			last_event_occurred_at: lastEvent?.occurredAt ?? null,
-			work_item_id: config.orchestrator_work_item_id,
-			delivered_comment_id: comment.id,
-			delivered_message_id: messageId,
-		},
-	});
-	return { messageId, workItemId: config.orchestrator_work_item_id };
-}
-
-/**
- * Re-arm an episode whose kind went quiet but whose condition NOBODY CHECKED.
- * The alarm becomes audible again and no claim is made that the fault
- * stopped, so there is deliberately NO operator comment: "Fault stopped" on
- * the strength of silence is the sentence this change exists to stop writing.
- * The event is still recorded — re-arming is a state change. See migration 811.
- */
-export async function rearmEpisode(
-	episode: EscalationEpisode,
-	quietMinutes: number,
-): Promise<void> {
-	const now = new Date();
-	await (await orpc()).platform_fault_escalations.update({
-		where: { kind: episode.kind },
-		data: { rearmed_at: now.toISOString(), updated_at: now.toISOString() },
-	});
-	recordEvent({
-		kind: "platform.fault.rearmed",
-		payload: {
-			event_kind: episode.kind,
-			quiet_minutes: Math.round(quietMinutes),
-			work_item_id: episode.workItemId,
-			// Named so a reader never mistakes this for a resolution: no probe
-			// exists for this kind, so nothing verified the condition ended.
-			verified: false,
-			reason: "no capability probe declared for this kind",
-		},
-	});
-}
-
-export async function resolveEpisode(
-	episode: EscalationEpisode,
-	quietMinutes: number,
-): Promise<void> {
-	const now = new Date();
-	await (await orpc()).platform_fault_escalations.update({
-		where: { kind: episode.kind },
-		data: { resolved_at: now.toISOString(), updated_at: now.toISOString() },
-	});
-	if (episode.workItemId) {
-		await (await orpc()).comments.create({
-			data: {
-				work_item_id: episode.workItemId,
-				content: `Fault stopped — no '${episode.kind}' events for ${Math.round(quietMinutes)} min. Episode closed; the fault will re-escalate if it recurs.`,
-				sender_role: "system",
-				sender_name: "platform-fault-escalation",
-			},
-		});
-	}
-	recordEvent({
-		kind: "platform.fault.resolved",
-		payload: { event_kind: episode.kind, quiet_minutes: Math.round(quietMinutes), work_item_id: episode.workItemId },
-	});
-}
-
-/**
- * Refresh an OPEN episode's window facts from the live aggregate.
- *
- * Escalation wrote the row once and never again, so its facts froze while the
- * fault kept firing (2026-08-28: fifteen hours stale, 1,150 later events).
- * That also corrupts RESOLUTION, since `decideSweep` falls back to
- * `lastSeenAt` once a kind leaves the window. Fields mirror the escalation
- * upsert. `last_updated_at` is untouched: it gates the resolve-hold dedupe.
- */
-export async function refreshOpenEpisode(
-	kind: string,
-	aggregate: { firstSeen: Date; lastSeen: Date; count: number },
-): Promise<void> {
-	await (await orpc()).platform_fault_escalations.update({
-		where: { kind },
-		data: {
-			first_seen_at: aggregate.firstSeen.toISOString(),
-			last_seen_at: aggregate.lastSeen.toISOString(),
-			event_count: aggregate.count,
-			updated_at: new Date().toISOString(),
-		},
-	});
-}
-
-/** Send one message to the operator through the verified WhatsApp relay and
- * record it as a comment on the orchestrator's work item. Returns the
- * verified ids; throws when the send carries no message id so the caller's
- * durable claim stays undelivered and retries next sweep (same contract as
- * deliverEscalation — a component may not report a delivery it cannot show). */
-async function sendOperatorNotice(message: string): Promise<{ messageId: string; workItemId: string }> {
-	const bot = await resolveOperatorRelay();
-	const operatorPhone = (bot.flow_config as { operator_phone?: string }).operator_phone!;
-	const { userId, organisationId } = await getSystemIdentity();
-	const systemCtx: ExecutionContext = { userId, organisationId } as ExecutionContext;
-	const { forwardToolToCentralMcp } = await import("@teamscala/chat-completion/central-tool-forwarder");
-	const sendResult = await forwardToolToCentralMcp("messaging_whatsapp_send", { phone: operatorPhone, message }, systemCtx);
-	const messageId = extractWhatsAppMessageId(sendResult);
-	if (!messageId) {
-		throw new Error(
-			`platform-fault-escalation: zero-volume notice send returned no message id — not recording delivery. ` +
-				`Response: ${JSON.stringify(sendResult).slice(0, 400)}`,
-		);
-	}
-	const config = await loadFaultEscalationConfig();
-	await (await orpc()).comments.create({
-		data: { work_item_id: config.orchestrator_work_item_id, content: message, source_cli_session_id: null },
-	});
-	return { messageId, workItemId: config.orchestrator_work_item_id };
-}
-
-/** Raise the zero-volume hold ONCE for an open episode whose producer went
- * silent alongside its failures. Delivery is VERIFIED before the marker
- * event lands, so a failed send leaves the hold unflagged and the next
- * sweep retries — never a flagged-but-unheard hold. */
-export async function deliverZeroVolumeHold(
-	episode: EscalationEpisode,
-	quietMinutes: number,
-	volumeCount: number,
-	source: ZeroVolumeSource,
-): Promise<void> {
-	const message = composeZeroVolumeMessage({
-		kind: episode.kind,
-		volumeKindPattern: source.volume_kind_pattern,
-		minVolume: source.min_volume ?? 1,
-		quietMinutes,
-		volumeCount,
-		firstSeenAt: episode.firstSeenAt,
-	});
-	const { messageId, workItemId } = await sendOperatorNotice(message);
-	recordEvent({
-		kind: "platform.fault.zero_volume_flagged",
-		payload: {
-			event_kind: episode.kind,
-			volume_kind_pattern: source.volume_kind_pattern,
-			volume_count: volumeCount,
-			quiet_minutes: Math.round(quietMinutes),
-			work_item_id: workItemId,
-			delivered_message_id: messageId,
-		},
-	});
-}
-
-/** Clear a standing zero-volume hold: volume is back above floor (or faults
- * recurred), so quiet regains its meaning and the normal resolve path takes
- * over. One clearing emission per flag — transitions, not conditions. */
-export async function clearZeroVolumeHold(episode: EscalationEpisode, volumeCount: number): Promise<void> {
-	recordEvent({
-		kind: "platform.fault.zero_volume_cleared",
-		payload: { event_kind: episode.kind, volume_count: volumeCount, work_item_id: episode.workItemId },
-	});
-}

package/src/handlers/platform-fault-escalation/event-log-queries.ts

@@ -1,182 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The bounded event_log reads of the platform-fault-escalation handler: the
- * recurrence/duration aggregate and the latest-payload evidence sample, both
- * with the `occurred_at <= now()` database-clock top edge.
- *
- * Split out of handlers/platform-fault-escalation.ts (500 lines) —
- * byte-for-byte move; import paths adjusted only.
- */
-
-import { getPrisma } from "@teamscala/db/prisma-registry";
-import { formatEscalationSample, type FaultAggregate } from "../platform-fault-escalation-logic.ts";
-import { CONFIG_SLUG } from "./config.ts";
-
-interface EventLogAggregateRow {
-	kind: string;
-	n: bigint;
-	first_seen: Date;
-	last_seen: Date;
-}
-
-export async function fetchAggregates(patterns: string[], windowMinutes: number): Promise<FaultAggregate[]> {
-	const prisma = getPrisma();
-	// Patterns come from the valibot-validated registry row and are regex-only
-	// by construction below; embedding them as one alternation keeps the query
-	// parameter-free on the pattern side while the window is a real parameter.
-	// The window is bounded on BOTH sides by the database's own statement
-	// clock: `occurred_at` is producer-claimed, and an unbounded top edge
-	// admits rows stamped in the future by a skewed or mocked producer clock —
-	// which then fabricate "still recurring" for a quiet fault (measured
-	// 2026-08-26). A future row is not evidence of anything happening now.
-	const regexClass = /^[A-Za-z0-9_\\^$.*+?()[\]{}|-]+$/;
-	for (const pattern of patterns) {
-		if (!regexClass.test(pattern)) {
-			throw new Error(`config/${CONFIG_SLUG}: watched_kind_pattern is not regex-only: ${pattern}`);
-		}
-	}
-	const combined = `(${patterns.join("|")})`;
-	const rows = await prisma.$queryRawUnsafe<EventLogAggregateRow[]>(
-		`SELECT kind, count(*)::bigint AS n, min(occurred_at) AS first_seen, max(occurred_at) AS last_seen
-			 FROM event_log
-			 WHERE occurred_at > now() - ($1::int * interval '1 minute')
-			   AND occurred_at <= now()
-			   AND kind ~ $2::text
-			 GROUP BY kind`,
-		windowMinutes,
-		combined,
-	);
-	return rows.map((row) => ({
-		kind: row.kind,
-		count: Number(row.n),
-		firstSeen: new Date(row.first_seen),
-		lastSeen: new Date(row.last_seen),
-	}));
-}
-
-/**
- * The message's evidence: the whitelisted sample fields AND the row identity
- * (id + occurred_at) of the newest payload for the kind. Field names come
- * from the valibot-validated config row and are constrained to bare
- * identifiers below, so the JSON path cannot break out of the string. The
- * `occurred_at <= now()` bound matches the aggregate's top edge: the cited
- * "last" row must be a real, non-future event whose id rides in the message
- * so the claim resolves against event_log.
- */
-export async function fetchLatestEvidence(
-	kind: string,
-	fields: string[],
-): Promise<{ sample: string; lastEvent: { occurredAt: string; eventId: string } | null }> {
-	const prisma = getPrisma();
-	if (fields.length === 0) {
-		const rows = await prisma.$queryRawUnsafe<Array<{ id: unknown; occurred_at: Date }>>(
-			`SELECT id::text, occurred_at
-				 FROM event_log
-				 WHERE kind = $1::text AND occurred_at <= now()
-				 ORDER BY occurred_at DESC
-				 LIMIT 1`,
-			kind,
-		);
-		const top = rows[0];
-		return { sample: "", lastEvent: top ? { occurredAt: isoSeconds(top.occurred_at), eventId: String(top.id) } : null };
-	}
-	for (const field of fields) {
-		if (!/^[A-Za-z0-9_]+$/.test(field)) {
-			throw new Error(`config/${CONFIG_SLUG}: sample_fields entry is not a bare field name: ${field}`);
-		}
-	}
-	const selection = fields.map((field) => `payload_json->'${field}' AS "${field}"`).join(", ");
-	const rows = await prisma.$queryRawUnsafe<Array<Record<string, unknown>>>(
-		`SELECT id::text, occurred_at, ${selection}
-				 FROM event_log
-				 WHERE kind = $1::text AND occurred_at <= now()
-				 ORDER BY occurred_at DESC
-				 LIMIT 1`,
-		kind,
-	);
-	const row = rows[0];
-	if (!row) return { sample: "", lastEvent: null };
-	const parts: string[] = [];
-	for (const field of fields) {
-		const value = row[field];
-		if (value === null || value === undefined) continue;
-		const formatted = formatEscalationSample(value);
-		if (formatted) parts.push(`${field}=${formatted}`);
-	}
-	return {
-		sample: parts.join("; "),
-		lastEvent: {
-			occurredAt: isoSeconds(row.occurred_at as string | Date),
-			eventId: String(row.id),
-		},
-	};
-}
-
-/** ISO-8601 to whole seconds — the same precision event_log stores, so the
- * cited string round-trips a `WHERE occurred_at = '<cited>'` query. */
-function isoSeconds(value: Date | string): string {
-	return new Date(value).toISOString().replace(/\.\d{3}Z$/, "Z");
-}
-
-/** The bounded VOLUME count for one fault kind's volume source: how many
- * rows of `kind ~ pattern` landed inside the window (both edges database-
- * clock-bounded, identical discipline to fetchAggregates). A floor-checked
- * zero here is what separates "failures stopped because things recovered"
- * from "failures stopped because nothing is calling anymore" — 2026-08-27:
- * the dead llm-router produced BOTH zeros and read as healthy. */
-export async function fetchVolumeCount(pattern: string, windowMinutes: number): Promise<number> {
-	const prisma = getPrisma();
-	const regexClass = /^[A-Za-z0-9_\\^$.*+?()[\]{}|-]+$/;
-	if (!regexClass.test(pattern)) {
-		throw new Error(`config/${CONFIG_SLUG}: volume_kind_pattern is not regex-only: ${pattern}`);
-	}
-	const rows = await prisma.$queryRawUnsafe<Array<{ n: bigint }>>(
-		`SELECT count(*)::bigint AS n
-			 FROM event_log
-			 WHERE occurred_at > now() - ($1::int * interval '1 minute')
-			   AND occurred_at <= now()
-			   AND kind ~ $2::text`,
-		windowMinutes,
-		pattern,
-	);
-	return Number(rows[0]?.n ?? 0);
-}
-
-/** Whether a resolve-HOLD has already been raised for this episode state:
- * the newest `platform.fault.resolve_held` naming the kind is newer than the
- * episode's last transition. Durable, never process memory — a restart must
- * not re-raise the hold, and a NEW episode state (a later last_updated_at)
- * may raise it again. */
-export async function resolveHoldRaisedSince(kind: string, since: Date | null): Promise<boolean> {
-	const prisma = getPrisma();
-	const rows = await prisma.$queryRawUnsafe<Array<{ occurred_at: Date }>>(
-		`SELECT occurred_at FROM event_log
-			 WHERE kind = 'platform.fault.resolve_held'
-			   AND payload_json->>'event_kind' = $1::text
-			 ORDER BY occurred_at DESC LIMIT 1`,
-		kind,
-	);
-	const latest = rows[0]?.occurred_at;
-	if (!latest) return false;
-	if (!since) return true;
-	return new Date(latest) > since;
-}
-
-/** Whether a zero-volume hold marker STANDS for a fault kind: derived from
- * the durable stream (latest flagged/cleared wins), never from process
- * memory — a restart must not re-raise or silently drop a standing hold.
- * Returns false when no marker exists (unflagged). */
-export async function zeroVolumeFlagActive(kind: string): Promise<boolean> {
-	const prisma = getPrisma();
-	const rows = await prisma.$queryRawUnsafe<Array<{ kind: string }>>(
-		`SELECT kind FROM event_log
-			 WHERE kind IN ('platform.fault.zero_volume_flagged', 'platform.fault.zero_volume_cleared')
-			   AND payload_json->>'event_kind' = $1::text
-			 ORDER BY occurred_at DESC LIMIT 1`,
-		kind,
-	);
-	return rows[0]?.kind === "platform.fault.zero_volume_flagged";
-}