@teamscala/service-boot 0.23.516 → 0.23.518

package/src/handlers/platform-fault-escalation/orpc-client.ts

@@ -1,114 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The system-authed in-process ORPC client of the platform-fault-escalation
- * handler (lazy, built from the composed appRouter) and the system identity
- * it falls back to.
- *
- * Split out of handlers/platform-fault-escalation.ts (500 lines) —
- * byte-for-byte move; import paths adjusted only.
- */
-
-/**
- * The system-authed in-process ORPC client, built LAZILY on first use from the
- * SAME composed appRouter the /api/rpc mount uses (getAppRouter — never a raw
- * re-import of the generated routers, per register-page-server-client's
- * documented module-identity trap). Built here rather than read from
- * page-server-orpc/server-client because a pg-boss handler can fire on a
- * BACKEND service, where the page-server client is never registered — the
- * empty-router fallback returns a client with no model namespaces (the
- * TypeError this replaced). Per `no-direct-prisma-outside-orpc`, every WRITE
- * in this handler routes through this client; the two raw reads (the
- * event_log recurrence aggregate and the latest-payload sample, shapes no
- * generated CRUD expresses) use
- * the assigned-client form with $queryRawUnsafe. Timestamps are ISO strings,
- * never Date instances (the generated valibot schemas require it).
- */
-
-import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
-import * as v from "valibot";
-import { createCache } from "@teamscala/cache/create-cache";
-
-const systemIdentityCache = createCache<{
-	userId: string | undefined;
-	organisationId: string | undefined;
-}>("service-boot:fault-escalation-system-identity", {
-	ttlMs: Number.POSITIVE_INFINITY,
-	maxSize: 1,
-});
-
-export async function getSystemIdentity(): Promise<{ userId: string | undefined; organisationId: string | undefined }> {
-	const hit = systemIdentityCache.get("default");
-	if (hit) return hit;
-	const row = await loadRegistryConfig("config", "system-identity", v.looseObject({}));
-	const identity = {
-		userId: row?.system_user_id as string | undefined,
-		organisationId: row?.system_org_id as string | undefined,
-	};
-	systemIdentityCache.set("default", identity);
-	return identity;
-}
-
-const orpcSurfaceCache = createCache<OrpcSurface>(
-	"service-boot:fault-escalation-orpc",
-	{ ttlMs: Number.POSITIVE_INFINITY, maxSize: 1 },
-);
-
-export async function orpc(): Promise<OrpcSurface> {
-	const hit = orpcSurfaceCache.get("default");
-	if (hit) return hit;
-	const { createRouterClient } = await import("@orpc/server");
-	const { getAppRouter } = await import("@teamscala/orpc/app-router");
-	const appRouter = (await getAppRouter()) as Record<string, unknown> | null;
-	if (!appRouter) {
-		throw new Error(
-			"platform-fault-escalation: no ORPC appRouter — the service has no generated routers to write through",
-		);
-	}
-	const prismaRegistry = await import("@teamscala/db/prisma-registry");
-	const registryLoader = await import("@teamscala/db/registry/load-config");
-	const { PlatformIdentitySchema } = await import(
-		"@teamscala/db-validation/registry-schemas/platform-identity"
-	);
-	const platformIdentity = await registryLoader.loadRegistryConfig(
-		"config",
-		"platform-identity",
-		PlatformIdentitySchema,
-	);
-	const surface = createRouterClient(
-		{ ...appRouter } as never,
-		{
-			context: {
-				prisma: prismaRegistry.getPrisma(),
-				user: {
-					id: "system",
-					isSuperAdmin: true,
-					organisationId: platformIdentity.platformOrganisationId,
-				},
-			},
-		} as never,
-	) as unknown as OrpcSurface;
-	orpcSurfaceCache.set("default", surface);
-	return surface;
-}
-
-/** The router subset this handler uses — mirrors the generated procedure args. */
-export interface OrpcSurface {
-	platform_fault_escalations: {
-		upsert(args: {
-			where: { kind: string };
-			create: Record<string, unknown>;
-			update: Record<string, unknown>;
-		}): Promise<unknown>;
-		update(args: { where: { kind: string }; data: Record<string, unknown> }): Promise<unknown>;
-		findMany(args?: { where?: Record<string, unknown> }): Promise<Array<Record<string, unknown>>>;
-	};
-	messaging_bots: {
-		findFirst(args: Record<string, unknown>): Promise<Record<string, unknown> | null>;
-	};
-	comments: {
-		create(args: { data: Record<string, unknown> }): Promise<{ id: string }>;
-	};
-}

package/src/handlers/platform-fault-escalation/probe.test.ts

@@ -1,63 +0,0 @@
-// @system codegen
-// @status generated
-// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-//
-// This suite's assertions are OWNED by the codegen band: the band module
-// carries them verbatim, this file is the emission, and hand edits here are
-// overwritten on the next run. The rationale each assertion carries moved
-// with it into the band.
-
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { probeHttpOk } from "./probe.ts";
-
-describe("probeHttpOk — the resolve gate's instrument", () => {
-	let server: Bun.Server<undefined>;
-	let port = 0;
-
-	beforeAll(() => {
-		server = Bun.serve({
-			port: 0,
-			fetch(request) {
-				const url = new URL(request.url);
-				if (url.pathname === "/ok") return new Response('{"status":"ok"}');
-				if (url.pathname === "/degraded") return new Response('{"status":"degraded"}', { status: 503 });
-				return new Response("not found", { status: 404 });
-			},
-		});
-		port = server.port as number;
-	});
-
-	afterAll(() => {
-		server.stop(true);
-	});
-
-	test("an answering, healthy endpoint verifies", async () => {
-		expect(await probeHttpOk(`http://127.0.0.1:${port}/ok`)).toBe(true);
-	});
-
-	test("a subject answering DEGRADED must not read as healthy — 503 is not an OK", async () => {
-		// THE MEASURED SHAPE: the 2026-08-28 close-on-quiet fired while the
-		// pipeline was down. A probe that treated "any response" as health
-		// would resolve an episode whose subject is still answering
-		// "degraded" — the same verdict with no instrument behind it.
-		expect(await probeHttpOk(`http://127.0.0.1:${port}/degraded`)).toBe(false);
-	});
-
-	test("a subject that does not answer the probe's question must not read as healthy", async () => {
-		expect(await probeHttpOk(`http://127.0.0.1:${port}/missing`)).toBe(false);
-	});
-
-	test("a subject that cannot be reached at all must not read as healthy", async () => {
-		// Port 1 on loopback: nothing listens there; the probe must refuse
-		// promptly, not hang or throw.
-		expect(await probeHttpOk("http://127.0.0.1:1/health", 1)).toBe(false);
-	});
-
-	test("an unreachable subject must not read as healthy", async () => {
-		expect(await probeHttpOk("http://127.0.0.1:1/health", 1)).toBe(false);
-	});
-
-	test("an unreachable subject with a tiny timeout still refuses, never throws", async () => {
-		expect(await probeHttpOk("http://10.255.255.1:9/health", 1)).toBe(false);
-	});
-});

package/src/handlers/platform-fault-escalation/probe.ts

@@ -1,19 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * The capability probe behind the resolve gate (operator ruling 2026-08-28):
- * a recovery transition is backed by an ACTIVE question to the subject's
- * capability surface, never a timer over an empty event stream. Healthy
- * means HTTP OK (2xx) — llm-router /health answers 503 while degraded.
- */
-
-export async function probeHttpOk(url: string, timeoutSeconds = 5): Promise<boolean> {
-	try {
-		const response = await fetch(url, { signal: AbortSignal.timeout(timeoutSeconds * 1000) });
-		return response.ok;
-	} catch {
-		return false;
-	}
-}

package/src/handlers/platform-fault-escalation-logic.ts

@@ -1,382 +0,0 @@
-/**
- * @system server-boot
- * @status handwritten
- * @edit edit directly
- *
- * Pure decision logic for the platform-fault escalation sweep — full
- * contract in curated `apps/escalation.md`. Episodes emit on TRANSITIONS
- * ONLY; a future-dated `lastSeen` is never recurrence evidence.
- */
-
-export interface FaultAggregate {
-	kind: string;
-	count: number;
-	firstSeen: Date;
-	lastSeen: Date;
-	/** Id of the newest row backing `lastSeen`, when the caller resolved it —
-	 * the resolvable handle the escalation cites so "last at T" is checkable
-	 * against a real event_log row, not a computed or cached value. */
-	lastEventId?: string | null;
-}
-
-export interface EscalationEpisode {
-	kind: string;
-	firstSeenAt: Date;
-	lastSeenAt: Date;
-	eventCount: number;
-	escalatedAt: Date | null;
-	workItemId: string | null;
-	/** VERIFIED over — a capability probe answered OK, or a declared recovery
-	 * transition arrived. Never written from silence. */
-	resolvedAt: Date | null;
-	/** The kind went quiet and the alarm is ARMED AGAIN. This is all that
-	 * quiet ever honestly supported, and it is deliberately weaker than
-	 * `resolvedAt`: it claims nothing about the condition. */
-	rearmedAt: Date | null;
-	lastUpdatedAt: Date | null;
-	deliveredCommentId?: string | null;
-}
-
-export interface FaultEscalationPolicy {
-	/** Recurrence floor: minimum event count inside the window. */
-	minCount: number;
-	/** Duration floor: minimum first→last spread inside the window, minutes. */
-	minSpanMinutes: number;
-	/** Quiet period that closes an episode and re-arms escalation, minutes. */
-	resolveAfterMinutes: number;
-}
-
-/** Per-kind threshold overrides — a low-rate-but-persistent kind (guard.fail.open
- * at ~1/hour over 12h) has different noise characteristics than a bursty one, so
- * the recurrence/duration floors are per-kind policy in the config row. */
-export interface KindThresholdOverride {
-	minCount?: number;
-	minSpanMinutes?: number;
-}
-
-export interface SweepDecision {
-	/** Sustained faults needing a FIRST delivery (new episode, or a claim whose send failed). */
-	escalate: Array<{ aggregate: FaultAggregate; episode: EscalationEpisode | null }>;
-	/** Open episodes whose kind went quiet past the resolve window — close them.
-	 * ONLY reachable from the probe gate: quiet alone never populates this. */
-	resolve: Array<{ episode: EscalationEpisode; quietMinutes: number; clearZeroVolumeFlag: boolean }>;
-	/** Open episodes quiet past the resolve window whose kind declares NO
-	 * capability probe: the alarm is RE-ARMED (the next occurrence escalates
-	 * again) and nothing is claimed about the condition. Quiet used to write
-	 * `resolved_at` and post "Fault stopped", which is the unsound close
-	 * `emit-transitions-not-conditions` names. It is re-armed rather than
-	 * merely held open because `escalate` fires only for an absent, resolved
-	 * or re-armed episode — holding it open would silence the alarm for good.
-	 * Rationale + measurements: migration 811. */
-	rearm: Array<{ episode: EscalationEpisode; quietMinutes: number; clearZeroVolumeFlag: boolean }>;
-	/** Open episodes quiet past the resolve window whose producer ALSO went
-	 * silent: zero failure rows AND zero call volume that would produce them.
-	 * Quiet is NOT evidence of health here (measured 2026-08-27: llm-router
-	 * died and produced zero llm.provider.call.failed events, which the
-	 * sweep closed as "no failures for 30 min" while crush lanes had no
-	 * model backend at all). The episode HOLDS OPEN and the hold raises
-	 * once; it never resolves from silence alone. */
-	zeroVolumeHold: Array<{ episode: EscalationEpisode; quietMinutes: number; volumeCount: number }>;
-	/** Open episodes quiet past the resolve window whose kind declares a
-	 * CAPABILITY PROBE: the close is withheld until the probe answers OK.
-	 * The handler runs the probe and either resolves or holds — the decision
-	 * core stays pure (it selects WHO must be probed, it never probes). */
-	resolveProbeGate: Array<{
-		episode: EscalationEpisode;
-		quietMinutes: number;
-		clearZeroVolumeFlag: boolean;
-		probeUrl: string;
-		probeTimeoutSeconds: number;
-	}>;
-}
-
-/** Per-kind config naming the kind whose VOLUME proves the producing
- * pipeline is alive — e.g. failures pair with completed calls. A fault kind
- * without a source resolves on quiet exactly as before; with one, resolve
- * additionally requires the volume floor to be met inside the window. */
-export interface ZeroVolumeSource {
-	volume_kind_pattern: string;
-	min_volume?: number;
-}
-
-/** Per-kind config naming the capability probe that must answer OK before
- * this fault kind's episode may close. The probe is an ACTIVE question to
- * the subject's capability surface (HTTP OK), never a read of the event
- * stream — absence of events is never evidence of state. */
-export interface ProbeSource {
-	url: string;
-	timeout_seconds?: number;
-}
-
-/** Everything decideSweep needs to judge quiet-vs-healthy, computed by the
- * caller from the valibot-validated config row + bounded queries. */
-export interface ZeroVolumeInputs {
-	/** Configured sources keyed by watched kind. */
-	sources: Record<string, ZeroVolumeSource>;
-	/** Resolved volume count per watched kind over the window. */
-	countByKind: Record<string, number>;
-	/** Whether a flagged/cleared marker already stands for the kind (derived
-	 * from event_log by the caller — never process memory). */
-	flagActiveByKind: Record<string, boolean>;
-}
-
-function minutesBetween(a: Date, b: Date): number {
-	return (b.getTime() - a.getTime()) / 60_000;
-}
-
-function isSustained(
-	aggregate: FaultAggregate,
-	policy: FaultEscalationPolicy,
-	override: KindThresholdOverride | undefined,
-	now: Date,
-): boolean {
-	const minCount = override?.minCount ?? policy.minCount;
-	const minSpan = override?.minSpanMinutes ?? policy.minSpanMinutes;
-	// Recency, not merely presence in the lookback window. Count and span
-	// answer "did this happen"; a fault qualifies only while it is STILL
-	// happening. Without this the 720-minute lookback keeps a dead fault
-	// qualifying for hours, and since a resolved episode reads as no episode
-	// it re-escalates on every sweep until its events age out (2026-08-26).
-	// A future `lastSeen` (producer clock skew / mocked test clock, measured
-	// 2026-08-26: "still recurring" citing a timestamp 44 min in its own
-	// future) makes minutesBetween go NEGATIVE — refuse it as evidence.
-	return (
-		aggregate.count >= minCount &&
-		minutesBetween(aggregate.firstSeen, aggregate.lastSeen) >= minSpan &&
-		aggregate.lastSeen.getTime() <= now.getTime() &&
-		minutesBetween(aggregate.lastSeen, now) < policy.resolveAfterMinutes
-	);
-}
-
-/**
- * Classify the current sweep. `aggregates` are the per-kind error aggregates
- * from the lookback window; `episodes` are the existing episode rows for those
- * kinds PLUS every still-open episode (an open episode whose kind no longer
- * appears in the window at all is the strongest resolve candidate).
- */
-export function decideSweep(
-	aggregates: FaultAggregate[],
-	episodes: EscalationEpisode[],
-	policy: FaultEscalationPolicy,
-	now: Date,
-	kindThresholds: Record<string, KindThresholdOverride> = {},
-	zeroVolume?: ZeroVolumeInputs,
-	probeSources: Record<string, ProbeSource> = {},
-): SweepDecision {
-	const byKind = new Map(episodes.map((e) => [e.kind, e]));
-	const aggregateByKind = new Map(aggregates.map((a) => [a.kind, a]));
-	const decision: SweepDecision =
-		{ escalate: [], resolve: [], rearm: [], resolveProbeGate: [], zeroVolumeHold: [] };
-
-	for (const aggregate of aggregates) {
-		const episode = byKind.get(aggregate.kind);
-		if (!isSustained(aggregate, policy, kindThresholds[aggregate.kind], now)) continue;
-		// No episode, or the previous episode closed (quiet past resolve window):
-		// a NEW episode begins and must be delivered.
-		// A RE-ARMED episode starts a new one exactly as a resolved one does.
-		// This is the half that keeps the alarm audible: without it, dropping
-		// the quiet-close would leave every probe-less kind permanently silent.
-		if (!episode || episode.resolvedAt || episode.rearmedAt) {
-			decision.escalate.push({ aggregate, episode: episode ?? null });
-			continue;
-		}
-		// Open episode with no verified delivery — the claim is retried, never
-		// counted as escalated (a component may not report a state it has not
-		// verified).
-		if (!episode.escalatedAt) {
-			decision.escalate.push({ aggregate, episode });
-		}
-		// An open, delivered episode emits NOTHING while it recurs: the open
-		// emission already happened and the close emission fires when the kind
-		// goes quiet. A cadence-driven "still recurring" repeat is exactly the
-		// silenced-alarm shape `emit-transitions-not-conditions` prohibits.
-	}
-
-	for (const episode of episodes) {
-		if (episode.resolvedAt || episode.rearmedAt) continue;
-		const aggregate = aggregateByKind.get(episode.kind);
-		// A future-dated aggregate lastSeen (producer clock skew) cannot serve
-		// as the quiet reference — it would freeze quietMinutes negative and
-		// hold the episode open forever while the kind is actually quiet. Fall
-		// back to the episode's own last_seen_at, which the bounded aggregate
-		// wrote and is therefore never in the future.
-		const quietReference =
-			aggregate && aggregate.lastSeen.getTime() <= now.getTime() ? aggregate.lastSeen : episode.lastSeenAt;
-		const quietMinutes = minutesBetween(quietReference, now);
-		if (quietMinutes < policy.resolveAfterMinutes) continue;
-
-		// ZERO-VOLUME GATE on resolution. When this fault kind declares a
-		// volume source and that volume is below its floor inside the window,
-		// "no failure rows" no longer separates healthy from dead-producer:
-		// hold the episode open instead of closing it. The hold raises once
-		// (when unflagged) through zeroVolumeHold; a flagged hold emits
-		// nothing while it persists — same transitions-only rule as an open
-		// escalation.
-		const source = zeroVolume?.sources[episode.kind];
-		const volumeCount = zeroVolume?.countByKind[episode.kind];
-		if (source) {
-			const floor = source.min_volume ?? 1;
-			if ((volumeCount ?? 0) < floor) {
-				decision.zeroVolumeHold.push({ episode, quietMinutes, volumeCount: volumeCount ?? 0 });
-				continue;
-			}
-		}
-		// PROBE-GATED RESOLUTION (operator ruling 2026-08-28): a kind with a
-		// declared capability probe does not close on quiet + volume alone —
-		// the handler must first ask the subject's capability surface and
-		// only an HTTP OK closes the episode. An unreachable probe holds the
-		// episode open (once per episode-state, never an alarm).
-		const probe = probeSources[episode.kind];
-		if (probe) {
-			decision.resolveProbeGate.push({
-				episode,
-				quietMinutes,
-				clearZeroVolumeFlag: Boolean(source && zeroVolume?.flagActiveByKind[episode.kind]),
-				probeUrl: probe.url,
-				probeTimeoutSeconds: probe.timeout_seconds ?? 5,
-			});
-			continue;
-		}
-		// NO PROBE DECLARED: re-arm, never resolve. Quiet re-arms the alarm and
-		// says nothing about the condition — see the `rearm` field's comment.
-		decision.rearm.push({
-			episode,
-			quietMinutes,
-			clearZeroVolumeFlag: Boolean(source && zeroVolume?.flagActiveByKind[episode.kind]),
-		});
-	}
-
-	return decision;
-}
-
-/** Human "N min" span, rounded — for the phone-sized escalation message. */
-/**
- * Do this OPEN episode's stored window facts lag the live aggregate?
- *
- * Both NEGATIVE answers carry weight: a quiet kind keeps its last true
- * sighting (the value resolve falls back to), and an aggregate no newer than
- * the row is never written, so a steady-state sweep writes nothing.
- */
-export function episodeNeedsRefresh(
-	episode: Pick<EscalationEpisode, "lastSeenAt">,
-	aggregate: { lastSeen: Date } | undefined,
-): boolean {
-	if (!aggregate) return false;
-	return aggregate.lastSeen.getTime() > episode.lastSeenAt.getTime();
-}
-
-/**
- * Does this fault kind page the operator, or land on the work item alone?
- *
- * DEFAULT IS TO PAGE. An unlisted kind reaches the phone, so forgetting to
- * classify a new fault fails loudly rather than silently — the opposite
- * default would let a kind be silenced by omission.
- */
-export function pagesOperator(kind: string, agentHandledKinds?: string[]): boolean {
-	return !(agentHandledKinds ?? []).includes(kind);
-}
-
-export function formatSpanMinutes(minutes: number): string {
-	if (minutes < 60) return `${Math.round(minutes)} min`;
-	const hours = minutes / 60;
-	return `${hours >= 10 ? Math.round(hours) : Math.round(hours * 10) / 10} h`;
-}
-
-/**
- * The WhatsApp message id from a messaging_whatsapp_send result. The
- * intrinsic (scala-mcp / messaging-mcp-boot) returns
- * `{ ok, message_id, error }` — the Rust scala-messaging-service owns the
- * channel, picks the device, and records the send in messaging_logs itself.
- * Delivery is only VERIFIED on a real id — a `"true"` ack, an error body, or
- * an empty body is not a message id and must not be recorded as delivered.
- */
-export function extractWhatsAppMessageId(sendResult: unknown): string | null {
-	if (sendResult && typeof sendResult === "object") {
-		const id = (sendResult as { message_id?: unknown }).message_id;
-		if (typeof id === "string" && id.length > 0) return id;
-	}
-	return null;
-}
-
-/**
- * One sampled payload value rendered for the message's evidence line: a
- * kind+count escalation is a pointer to evidence, not evidence (2026-08-26:
- * the llm.provider.call.failed payloads held our own bounded-output contract
- * violations while the escalation's impact line named healthy providers).
- * JSON-encoded when non-string so structure survives, whitespace-collapsed
- * to one line, credential shapes redacted before truncation (a hard cut can
- * never expose the tail of a secret the length limit happened to spare),
- * hard-truncated with an ellipsis so the reader knows the cut happened.
- */
-export function formatEscalationSample(value: unknown): string {
-	const maxChars = 200;
-	const redactions: ReadonlyArray<[RegExp, string]> = [
-		[/\b(?:sk|gsk|ghp|gho|xox[baprs])[-_][A-Za-z0-9_-]{8,}/g, "[redacted]"],
-		[/\b(api[_-]?key|token|password|secret|authorization)\b["'=:\s]+(?:(?:bearer|basic)\s+)?[A-Za-z0-9._~+/=-]{4,}/gi, "$1=[redacted]"],
-		[/Bearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, "Bearer [redacted]"],
-	];
-	const raw = typeof value === "string" ? value : (JSON.stringify(value) ?? "");
-	if (raw.length === 0) return "";
-	const redacted = redactions.reduce((acc, [pattern, replacement]) => acc.replace(pattern, replacement), raw);
-	const collapsed = redacted.replace(/\s+/g, " ").trim();
-	return collapsed.length > maxChars ? `${collapsed.slice(0, maxChars)}…` : collapsed;
-}
-
-/**
- * The escalation message — escalation-routing's three-field contract adapted
- * to an automated detector: what was OBSERVED (evidence + sample), what it
- * MEANS (impact), and the RECOMMENDATION. Short: the channel is a phone. The
- * sample line is the triage evidence — `sample_fields` whitelisted per kind
- * by the caller, formatted by formatEscalationSample; empty means the kind
- * samples nothing or the latest payload carried none of its fields.
- */
-export function composeEscalationMessage(input: {
-	kind: string;
-	aggregate: FaultAggregate;
-	impact: string;
-	recommendation: string;
-	sample: string;
-	/** ISO timestamp + event id of the newest backing row, when resolved —
-	 * cited verbatim so the reader can resolve the claim against event_log. */
-	lastEvent?: { occurredAt: string; eventId: string } | null;
-}): string {
-	const span = formatSpanMinutes(
-		(input.aggregate.lastSeen.getTime() - input.aggregate.firstSeen.getTime()) / 60_000,
-	);
-	const observed = input.lastEvent
-		? `Observed: ${input.aggregate.count} errors over ${span}, last ${input.lastEvent.occurredAt} (event ${input.lastEvent.eventId.slice(0, 8)}).`
-		: `Observed: ${input.aggregate.count} errors over ${span}, last ${input.aggregate.lastSeen.toISOString()}.`;
-	const lines = [`🔴 Platform fault: ${input.kind}`, observed];
-	if (input.sample) lines.push(`Sample: ${input.sample}`);
-	lines.push(`Impact: ${input.impact}`, `Recommendation: ${input.recommendation}`);
-	return lines.join("\n");
-}
-
-/**
- * The zero-volume hold notice — the same three-field contract, for the shape
- * where the watched failures went quiet AND the call volume that would have
- * produced them went quiet too. That combination is NOT a resolution: it is
- * either "fault ended" or "the producer itself died" (2026-08-27: the dead
- * llm-router emitted zero llm.provider.call.failed rows and the sweep closed
- * the episode as healthy while crush lanes had no model backend). Holds one
- * episode open; raises once per episode-state, never on cadence.
- */
-export function composeZeroVolumeMessage(input: {
-	kind: string;
-	volumeKindPattern: string;
-	minVolume: number;
-	quietMinutes: number;
-	volumeCount: number;
-	firstSeenAt: Date;
-}): string {
-	const observed =
-		`Observed: '${input.kind}' open since ${input.firstSeenAt.toISOString()}, ` +
-		`quiet ${Math.round(input.quietMinutes)} min — but volume kind ~${input.volumeKindPattern} is ALSO silent ` +
-		`(${input.volumeCount} < floor ${input.minVolume} in window). Quiet is indistinguishable from dead.`;
-	return [
-		`🟡 Platform fault unresolved: ${input.kind}`,
-		observed,
-		"Impact: failures stopping means EITHER recovery OR its producer died entirely — this exact ambiguity hid llm-router's halt behind an all-clear.",
-		`Recommendation: probe/restart the producer of ${input.volumeKindPattern} directly; resolve the episode by hand only once completion is verified.`,
-	].join("\n");
-}

package/src/handlers/platform-fault-escalation-refresh.test.ts

@@ -1,72 +0,0 @@
-// @system codegen
-// @status generated
-// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-//
-// This suite's assertions are OWNED by the codegen band: the band module
-// carries them verbatim, this file is the emission, and hand edits here are
-// overwritten on the next run. The rationale each assertion carries moved
-// with it into the band.
-
-import { describe, expect, test } from "bun:test";
-import { episodeNeedsRefresh, pagesOperator } from "./platform-fault-escalation-logic.ts";
-
-const at = (iso: string) => ({ lastSeenAt: new Date(iso) });
-const seen = (iso: string) => ({ lastSeen: new Date(iso) });
-
-describe("episodeNeedsRefresh", () => {
-	test("a still-firing fault whose row has fallen behind is refreshed", () => {
-		// The measured incident, in miniature: row frozen at escalation time,
-		// events still arriving fifteen hours later.
-		expect(episodeNeedsRefresh(at("2026-08-27T12:25:03Z"), seen("2026-08-28T03:00:41Z"))).toBe(
-			true,
-		);
-	});
-
-	test("a kind that has gone quiet keeps its last true sighting", () => {
-		// No aggregate means nothing landed in the window. The stored value must
-		// STAND rather than advance, because it is the reference the resolve
-		// decision falls back to — advancing it here would hold every quiet
-		// episode open forever.
-		expect(episodeNeedsRefresh(at("2026-08-27T12:25:03Z"), undefined)).toBe(false);
-	});
-
-	test("an unchanged fault is not written back", () => {
-		// Equal timestamps must not write: a sweep over steady state performs
-		// zero updates, so the refresh cannot become a per-sweep write storm.
-		const same = "2026-08-28T03:00:41Z";
-		expect(episodeNeedsRefresh(at(same), seen(same))).toBe(false);
-	});
-
-	test("an aggregate OLDER than the row never rewinds it", () => {
-		// A shrinking window can report an older newest-event than the row
-		// already holds. Rewinding would fabricate quiet time and resolve a
-		// live fault early.
-		expect(episodeNeedsRefresh(at("2026-08-28T03:00:41Z"), seen("2026-08-28T01:00:00Z"))).toBe(
-			false,
-		);
-	});
-});
-
-describe("pagesOperator", () => {
-	// Operator ruling 2026-08-28: "why is the WhatsApp PA messaging me about
-	// stuff that you should be doing". A kind a standing lane answers escalates
-	// to the work item; the phone is spared.
-	const AGENT_HANDLED = ["guard.fail.open", "host-command-bus.command.failed"];
-
-	test("a kind the maintenance lane answers does not page", () => {
-		expect(pagesOperator("guard.fail.open", AGENT_HANDLED)).toBe(false);
-		expect(pagesOperator("host-command-bus.command.failed", AGENT_HANDLED)).toBe(false);
-	});
-
-	test("an unlisted kind still pages", () => {
-		expect(pagesOperator("supervisor.halt.entered", AGENT_HANDLED)).toBe(true);
-	});
-
-	test("DEFAULT IS TO PAGE when nothing is configured", () => {
-		// The load-bearing direction: a kind is silenced only by being named.
-		// If the list is missing or empty, every fault reaches the operator, so
-		// a new kind can never be silenced by omission.
-		expect(pagesOperator("guard.fail.open", undefined)).toBe(true);
-		expect(pagesOperator("guard.fail.open", [])).toBe(true);
-	});
-});