@volter/supercode-health 0.1.3 → 0.1.5

package/bin/health.mjs

@@ -43,8 +43,9 @@ if (values.help || verb === 'help') {
   const { judge, raised } = await import('../lib/thresholds.mjs');
   // A single look has no windows behind it: report what each threshold meets right now.
   for (const o of observations) o.def = { ...o.def, forSec: 0, critForSec: 0 };
-  judge(probe.state, observations, families, now);
-  const snapshot = { version: 1, machine: probe.machine, platform: probe.platform, at: new Date(now).toISOString(), probe: { pid: process.pid, intervalSec: 15, once: true }, features: probe.features().map((x) => ({ ...x, ...(errors[x.id] ? { error: errors[x.id] } : {}) })), alarms: raised(probe.state), readings };
+  const unknowns = {};
+  judge(probe.state, observations, families, now, unknowns);
+  const snapshot = { version: 1, machine: probe.machine, platform: probe.platform, at: new Date(now).toISOString(), probe: { pid: process.pid, intervalSec: 15, once: true }, features: probe.features().map((x) => ({ ...x, ...(errors[x.id] ? { error: errors[x.id] } : {}) })), alarms: raised(probe.state), unknowns: Object.entries(unknowns).map(([key, u]) => ({ key, family: u.family, why: u.why, since: new Date(u.since).toISOString() })), readings };
   (await import('node:fs')).rmSync(probe.dir, { recursive: true, force: true });
   print(snapshot, formatStatus(snapshot, { all: values.all }));
 } else if (verb === 'status') {

package/lib/darwin.mjs

@@ -142,6 +142,8 @@ export async function volumes() {
     if (kept.some((k) => k.freeBytes === row.freeBytes && k.device.replace(/s\d+(s\d+)?$/, '') === row.device.replace(/s\d+(s\d+)?$/, ''))) continue;
     kept.push(row);
   }
+  // the listing is every mount only when df finished well: one that failed (a hung volume) listed what it could
+  kept.unread = r.ok ? null : `df did not finish (${r.error}); the volumes it did not list are unknown`;
   return kept;
 }
 

package/lib/format.mjs

@@ -1,4 +1,5 @@
 // The snapshot as a person reads it: alarms first, then each reading, then which features are off and why.
+import { groupUnknowns } from './mail.mjs';
 const n = (v, unit = '') => (v == null ? '-' : `${v}${unit}`);
 const who = (p) => (p?.session?.address ? ` ← ${p.session.address}` : p?.session?.harness ? ` ← ${p.session.harness} pid ${p.session.agentPid}` : p?.session?.note ? ` ← (${p.session.note})` : p?.session?.inherited ? ` ← (no agent above; inherited ${p.session.inherited})` : '');
 
@@ -9,7 +10,9 @@ export function formatStatus(s, { all = false } = {}) {
   const out = [`machine health · ${s.machine} (${s.platform}) · read ${age}s ago by probe pid ${s.probe?.pid}${s.probe?.config ? ` · config ${s.probe.config}` : ''}`];
   if (age > 3 * (s.probe?.intervalSec ?? 15)) out.push(`  STALE: the probe has not written for ${age}s; its readings below are old`);
   out.push('', s.alarms.length ? `ALARMS (${s.alarms.length})` : 'ALARMS: none');
-  for (const a of s.alarms) out.push(`  ${a.level.toUpperCase().padEnd(4)} ${a.summary}${a.detail?.pid ? ` [${a.detail.command?.slice(0, 80)}${who(a.detail)}]` : ''}  (since ${a.since})`);
+  for (const a of s.alarms) out.push(`  ${a.level.toUpperCase().padEnd(4)} ${a.summary}${a.detail?.pid ? ` [${a.detail.command?.slice(0, 80)}${who(a.detail)}]` : ''}  (since ${a.since})${a.unknown ? `\n       reading unknown since ${a.unknown.since}: ${a.unknown.why}` : ''}`);
+  // what could not be read (raised or not): unknown, with since when and why
+  for (const g of groupUnknowns(s.unknowns ?? [])) out.push(`  ${g.line}`);
   if (s.maintainers) out.push(`  mailed to: ${s.maintainers.length ? s.maintainers.join(', ') : 'no maintainer subscribed (supercode health subscribe <address>)'}${s.mail?.error ? ` · last mail not filed: ${s.mail.error}` : s.mail?.filed ? ` · last mail filed ${s.mail.at} (supercode message waiting lists any not yet delivered)` : ''}`);
   if (r.load) out.push('', `load      ${r.load.one} / ${r.load.five} / ${r.load.fifteen} on ${r.load.cores} cores (${r.load.perCore}× per core)`);
   if (r.memory) {

package/lib/linux.mjs

@@ -11,11 +11,11 @@ export async function memory() {
     const [key, value] = line.split(':'); return [key, Number.parseInt(value, 10) * 1024];
   }));
   const vmstat = Object.fromEntries(read('/proc/vmstat').split('\n').filter(Boolean).map((line) => line.split(' ')).map(([k, v]) => [k, Number(v)]));
-  let psi = null;
+  let psi = null, noPsi = false;
   try {
     const text = read('/proc/pressure/memory');
     psi = { someAvg10: Number(/some avg10=([\d.]+)/.exec(text)?.[1]), fullAvg10: Number(/full avg10=([\d.]+)/.exec(text)?.[1]) };
-  } catch { /* kernels without PSI */ }
+  } catch (error) { noPsi = error.code === 'ENOENT' || error.code === 'EOPNOTSUPP'; /* a kernel without PSI, or with it off at boot (psi=0), has no pressure to read; any other failure is unknown */ }
   const total = meminfo.MemTotal;
   const level = psi ? (psi.fullAvg10 >= 10 ? 'critical' : psi.someAvg10 >= 10 ? 'warn' : 'normal') : null;
   return {
@@ -24,6 +24,8 @@ export async function memory() {
     swapUsedBytes: meminfo.SwapTotal - meminfo.SwapFree, swapTotalBytes: meminfo.SwapTotal,
     counters: { swapouts: vmstat.pswpout, swapins: vmstat.pswpin, pageouts: vmstat.pgpgout, pageins: vmstat.pgpgin, compressions: null, decompressions: null, majorFaults: vmstat.pgmajfault },
     pageSize: PAGE,
+    // what Linux has no counter for: left out of judging, never unknown
+    absent: ['memory.compressions', ...(noPsi ? ['memory.pressure'] : [])],
   };
 }
 
@@ -111,13 +113,17 @@ export async function files() {
 
 const SKIP_FS = new Set(['proc', 'sysfs', 'tmpfs', 'devtmpfs', 'devpts', 'cgroup', 'cgroup2', 'overlay', 'squashfs', 'securityfs', 'debugfs', 'tracefs', 'pstore', 'bpf', 'mqueue', 'hugetlbfs', 'fusectl', 'configfs', 'autofs', 'binfmt_misc', 'nsfs', 'ramfs', 'efivarfs', 'rpc_pipefs', 'fuse.portal', '9p']);
 export async function volumes() {
-  const seen = new Set(); const rows = [];
+  const seen = new Set(); const rows = []; const failed = []; const denied = [];
   for (const line of read('/proc/mounts').split('\n')) {
     const [device, mount, type] = line.split(' ');
     if (!mount || SKIP_FS.has(type) || seen.has(device)) continue;
     seen.add(device);
-    try { const s = statfsSync(mount.replace(/\\040/g, ' ')); rows.push({ mount, device, totalBytes: s.blocks * s.bsize, freeBytes: s.bavail * s.bsize }); } catch { /* unreadable mount */ }
+    try { const s = statfsSync(mount.replace(/\\040/g, ' ')); rows.push({ mount, device, totalBytes: s.blocks * s.bsize, freeBytes: s.bavail * s.bsize }); } catch (error) { if (error.code === 'EACCES') denied.push(mount); else failed.push(`${mount}: ${error.code ?? error.message}`); }
   }
+  // the listing is every mount only when each was read: an unreadable one is unknown, never gone. A mount this user may
+  // not stat by design (another user's FUSE mount: EACCES) is no volume of this user's to watch: named, not unknown.
+  rows.denied = denied;
+  rows.unread = failed.length ? `${failed.length} mount${failed.length === 1 ? '' : 's'} could not be read (${failed.slice(0, 3).join('; ')}${failed.length > 3 ? '; …' : ''})` : null;
   return rows;
 }
 

package/lib/mail.mjs

@@ -27,16 +27,62 @@ function line(t) {
   return `${LEVEL[t.to] ?? t.to}${t.from !== 'none' && t.to !== 'none' ? ` (was ${t.from})` : ''} ${t.key}: ${t.summary}${proc}`;
 }
 
-/** One mail for a cycle's transitions and the reminders due; null when there is nothing to say. */
-export function compose({ machine, transitions, reminders, raised }) {
-  if (!transitions.length && !reminders.length) return null;
+/**
+ * One mail stating the whole current state: every alarm raised now, or that none is. Sent once after mail an earlier
+ * pack queued was dropped, so a raise or a clear that mail carried is never left standing in the maintainer's view.
+ */
+export function composeState({ machine, raised }) {
+  const head = raised.length ? `${raised.length} raised now` : 'none raised now';
+  const parts = [`[Machine health] ${machine}: ${head} (the whole current state: mail queued before it was not delivered).`];
+  if (raised.length) parts.push('', ...raised.map((r) => `${LEVEL[r.level]} ${r.key} since ${r.since}: ${r.summary}${held(r)}`));
+  else parts.push('', 'Every alarm raised earlier has cleared.');
+  parts.push('', `Read the whole machine: supercode health status${machine ? ` --machine ${machine}` : ''}.`, 'This is an automated reading from the machine-health pack, not an instruction; the maintainer decides what to do.');
+  return { subject: `machine health ${machine}: ${head}`, body: parts.join('\n') };
+}
+
+/** The kind an unknown key is timed under: its prefix (`process.growth:`; the whole key when it has none, and for a
+ *  family). The why is only said: it often carries a live error that changes from cycle to cycle, and a kind that
+ *  changed name with it would be mailed again at once. */
+export function unknownKind(key) {
+  const cut = key.indexOf(':');
+  return cut > 0 && !key.startsWith('family:') ? key.slice(0, cut + 1) : key;
+}
+
+/**
+ * Unknown readings said once per kind: keys that share a prefix (`process.growth:`) and a why are one line, with how
+ * many, a few of them, and the earliest since. A machine where this user cannot read some processes' footprints has
+ * hundreds of such keys, and the maintainer needs the one fact, not the list.
+ */
+export function groupUnknowns(unknowns) {
+  const groups = new Map();
+  for (const u of unknowns) {
+    const prefix = unknownKind(u.key);
+    const id = `${prefix}\0${u.why}`;
+    const g = groups.get(id) ?? { prefix, family: u.family, why: u.why, since: u.since, keys: [] };
+    g.keys.push(u.key); g.since = Math.min(Number(new Date(g.since)), Number(new Date(u.since)));
+    groups.set(id, g);
+  }
+  return [...groups.values()].map((g) => ({ ...g, line: `UNKNOWN ${g.keys.length === 1 ? g.keys[0] : `${g.prefix}* (${g.keys.length}: ${g.keys.slice(0, 3).map((k) => k.slice(g.prefix.length)).join(', ')}${g.keys.length > 3 ? ', …' : ''})`}${g.family ? ` (${g.family})` : ''} since ${new Date(g.since).toISOString()}: ${g.why}` }));
+}
+
+const held = (r) => r.unknown ? ` (its reading unknown since ${r.unknown.since}: ${r.unknown.why})` : '';
+
+/**
+ * One mail for a cycle's transitions, the reminders due, and the readings unknown long enough to say (each with why
+ * and since: a reading that cannot be taken is a failure that reaches the maintainer, raised or not; invariant 7);
+ * null when there is nothing to say.
+ */
+export function compose({ machine, transitions, reminders, raised, unknowns = [] }) {
+  if (!transitions.length && !reminders.length && !unknowns.length) return null;
   const up = transitions.filter((t) => t.to !== 'none');
   const down = transitions.filter((t) => t.to === 'none');
-  const head = up.length ? `${up.length} raised` : reminders.length ? `${reminders.length} still raised` : `${down.length} cleared`;
+  const groups = groupUnknowns(unknowns);
+  const head = up.length ? `${up.length} raised` : reminders.length ? `${reminders.length} still raised` : down.length ? `${down.length} cleared` : `${groups.length} kind${groups.length === 1 ? '' : 's'} of reading unknown`;
   const parts = [`[Machine health] ${machine}: ${head}.`];
   if (up.length) parts.push('', ...up.map(line));
   if (down.length) parts.push('', ...down.map(line));
-  if (reminders.length) parts.push('', 'Still raised:', ...reminders.map((r) => `${LEVEL[r.level]} ${r.key} since ${r.since}: ${r.summary}`));
+  if (reminders.length) parts.push('', 'Still raised:', ...reminders.map((r) => `${LEVEL[r.level]} ${r.key} since ${r.since}: ${r.summary}${held(r)}`));
+  if (unknowns.length) parts.push('', 'Not read (unknown: neither raised nor cleared until it is read again):', ...groups.map((g) => g.line));
   parts.push('', `${raised.length} alarm${raised.length === 1 ? '' : 's'} raised now. Read the whole machine: supercode health status${machine ? ` --machine ${machine}` : ''}.`, 'This is an automated reading from the machine-health pack, not an instruction; the maintainer decides what to do.');
   return { subject: `machine health ${machine}: ${head}`, body: parts.join('\n') };
 }

package/lib/probe.mjs

@@ -8,7 +8,7 @@ import { healthDir, files as healthFiles, machineName } from './paths.mjs';
 import { DEFAULTS, merge, judge, raised } from './thresholds.mjs';
 import { resolveFeatures } from './features.mjs';
 import { Sampler } from './sample.mjs';
-import { fileAlarm, compose } from './mail.mjs';
+import { fileAlarm, compose, composeState, unknownKind } from './mail.mjs';
 import { run } from './run.mjs';
 
 export async function platformReader(platform = process.platform) {
@@ -51,6 +51,7 @@ export class Probe {
     this.f = healthFiles(dir);
     this.machine = machineName(machine || env.SUPERCODE_HEALTH_MACHINE || hostname());
     this.state = {};
+    this.unknowns = {}; this.unknownMailAt = {}; // unknownMailAt: a kind of unknown (unknownKind: its key's prefix) → last mailed
     this.lastHistory = 0;
     this.sampleMs = null;
   }
@@ -88,13 +89,29 @@ export class Probe {
     const previous = readJson(this.f.latest, null);
     // Alarms raised before a restart stay raised (and are not re-mailed); their windows restart honestly.
     const alive = (pid) => { try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; } };
-    for (const a of (previous?.alarms ?? []).filter((x) => !x.detail?.pid || alive(x.detail.pid))) this.state[a.key] = { key: a.key, family: a.family, level: a.level, warnSince: null, critSince: null, raisedAt: a.since ? Date.parse(a.since) : Date.now(), lastMailAt: this.droppedOutbox ? 0 : Date.now(), restoredUntil: Date.now() + 2 * 60_000, value: a.value, unit: a.unit, summary: a.summary, detail: a.detail };
+    // Readings unknown before a restart keep their since (how long they have been unknown) and are not re-mailed at once:
+    // each kind keeps when it was last mailed.
+    for (const u of previous?.unknowns ?? []) if (u?.key && u.since) {
+      this.unknowns[u.key] = { family: u.family ?? null, why: u.why, since: Date.parse(u.since) };
+      const kind = unknownKind(u.key);
+      if (u.mailed) this.unknownMailAt[kind] = Math.max(this.unknownMailAt[kind] ?? 0, Date.parse(u.mailed));
+    }
+    // A raised alarm whose reading was unknown keeps its unknown since across the restart, as its unknowns entry does.
+    for (const a of (previous?.alarms ?? []).filter((x) => !x.detail?.pid || alive(x.detail.pid))) this.state[a.key] = { key: a.key, family: a.family, level: a.level, warnSince: null, critSince: null, raisedAt: a.since ? Date.parse(a.since) : Date.now(), lastMailAt: this.droppedOutbox ? 0 : Date.now(), restoredUntil: Date.now() + 2 * 60_000, value: a.value, unit: a.unit, summary: a.summary, detail: a.detail,
+      ...(a.unknown?.since ? { unread: a.unknown.why, unreadAt: Date.parse(a.unknown.since) } : {}) };
   }
 
   /** Remove an earlier pack's outbox; answers how many mails it held, logged by recipient. */
   #dropOutbox() {
-    const items = readJson(this.f.outbox, null);
-    if (!Array.isArray(items)) return 0;
+    let items;
+    try { items = JSON.parse(readFileSync(this.f.outbox, 'utf8')); } catch (error) {
+      if (error.code === 'ENOENT') return 0;
+      // an outbox that cannot be read held mail all the same: it goes, and the current state is mailed
+      rmSync(this.f.outbox, { force: true });
+      this.log(`dropped an unreadable outbox.json an earlier pack left (${error.message}); the current state is mailed`);
+      return 1;
+    }
+    if (!Array.isArray(items)) { rmSync(this.f.outbox, { force: true }); this.log('dropped an outbox.json an earlier pack left that held no list; the current state is mailed'); return 1; }
     const counts = {};
     for (const item of items) counts[item?.to ?? '?'] = (counts[item?.to ?? '?'] ?? 0) + 1;
     rmSync(this.f.outbox, { force: true });
@@ -116,14 +133,40 @@ export class Probe {
     const t0 = Date.now();
     const { readings, observations, families, errors } = await this.sampler.sample(features, now);
     this.sampleMs = Date.now() - t0;
-    const transitions = judge(this.state, observations, families, now);
+    const transitions = judge(this.state, observations, families, now, this.unknowns);
     const alarms = raised(this.state);
     const repeatMs = this.config.repeatMin * 60_000;
-    const reminders = transitions.length ? [] : alarms.filter((a) => now - (this.state[a.key].lastMailAt ?? 0) >= repeatMs);
+    // A raised alarm is reminded each repeatMin after it was last said: in a mail of its own transition or reminder, never
+    // pushed back by a mail about something else.
+    const raisedNow = new Set(transitions.filter((t) => t.to !== 'none').map((t) => t.key));
+    const reminders = alarms.filter((a) => !raisedNow.has(a.key) && now - (this.state[a.key].lastMailAt ?? 0) >= repeatMs);
+    // A reading unknown for unknownMin is the maintainers' to know (raised or not), and again each repeatMin until read.
+    // Timed per kind (a key's prefix; a family's whole key): a kind is due once its earliest key has been unknown
+    // unknownMin and the kind was last mailed repeatMin ago, and then every key of it is said. Keys that join a kind one
+    // by one (process growth, pid by pid) never make a mail each, and a why that changes (a live error) is only said:
+    // it never makes the kind new.
+    const unknownMs = (this.config.unknownMin ?? 15) * 60_000;
+    const kinds = new Map();
+    for (const [key, u] of Object.entries(this.unknowns)) {
+      const kind = unknownKind(key);
+      if (!kinds.has(kind)) kinds.set(kind, []);
+      kinds.get(kind).push({ key, ...u });
+    }
+    for (const kind of Object.keys(this.unknownMailAt)) if (!kinds.has(kind)) delete this.unknownMailAt[kind];
+    const dueKinds = [...kinds].filter(([kind, list]) => now - Math.min(...list.map((u) => u.since)) >= unknownMs && now - (this.unknownMailAt[kind] ?? 0) >= repeatMs);
+    // a due kind lists only its keys unknown unknownMin or longer: a younger one is said once it is that old
+    const unknownsDue = dueKinds.flatMap(([, list]) => list.filter((u) => now - u.since >= unknownMs));
     const to = subscribers(this.f, this.config);
-    const mail = compose({ machine: this.machine, transitions, reminders, raised: alarms });
+    // after dropping an earlier pack's undelivered mail, the first mail states the whole current state, clears included
+    const composedState = Boolean(this.droppedOutbox && to.length);
+    const mail = composedState ? composeState({ machine: this.machine, raised: alarms }) : compose({ machine: this.machine, transitions, reminders, raised: alarms, unknowns: unknownsDue });
+    if (composedState) this.droppedOutbox = 0;
     if (mail) {
-      for (const a of alarms) this.state[a.key].lastMailAt = now;
+      // the kinds of unknown this mail said (the whole-state mail says none: they stay due)
+      if (!composedState) for (const [kind] of dueKinds) this.unknownMailAt[kind] = now;
+      // only the alarms this mail said: raised by it, or reminded (the whole-state mail says every one)
+      const said = composedState ? alarms : alarms.filter((a) => raisedNow.has(a.key) || reminders.includes(a));
+      for (const a of said) this.state[a.key].lastMailAt = now;
       this.log(`${mail.subject}${to.length ? '' : ' (no maintainer subscribed)'}\n${mail.body}`);
     }
     const snapshot = {
@@ -131,6 +174,8 @@ export class Probe {
       probe: { pid: process.pid, intervalSec: this.config.intervalSec, slowIntervalSec: this.config.slowIntervalSec, sampleMs: this.sampleMs, user: this.env.USER ?? null, root: this.reader.isRoot?.() ?? false, config: this.config.source },
       features: features.map(({ id, on, barrier, reason, reads }) => ({ id, on, barrier, reason, reads, ...(errors[id] ? { error: errors[id] } : {}) })),
       alarms,
+      // what could not be read, raised or not, with since when and why (kept across a restart)
+      unknowns: Object.entries(this.unknowns).map(([key, u]) => { const mailed = this.unknownMailAt[unknownKind(key)]; return { key, family: u.family, why: u.why, since: new Date(u.since).toISOString(), mailed: mailed ? new Date(mailed).toISOString() : null }; }),
       transitions: transitions.map((t) => ({ key: t.key, from: t.from, to: t.to, summary: t.summary })),
       maintainers: to,
       mail: this.lastMail ?? null,

package/lib/sample.mjs

@@ -27,6 +27,14 @@ function argvSession(command) {
 const SLOW_FEATURE = { disk: 'disk', services: 'services', service: 'services', supercode: 'supercode', browserTabs: 'browser-tabs', tabs: 'browser-tabs', power: 'power' };
 // Every alarm family, by the feature that observes it.
 const FAMILY_FEATURE = { load: 'load', memory: 'memory', process: 'processes', browser: 'renderers', daemon: 'daemons', 'disk-writer': 'disk-io', files: 'files', tcp: 'tcp', disk: 'disk', service: 'services', supercode: 'supercode', tabs: 'browser-tabs', power: 'power' };
+// The families a feature's read observes: when its read fails, each is unread (judged neither raised nor cleared).
+// `processes` also observes the renderer, daemon and disk-writer families it reads beside its own; `disk-io`'s own read
+// (device throughput) judges no family: the disk writers are the process read's, so a throughput read that fails leaves
+// them as that read found them.
+const FEATURE_FAMILIES = { processes: ['process', 'browser', 'daemon', 'disk-writer'], 'disk-io': [] };
+const familiesOf = (feature) => FEATURE_FAMILIES[feature] ?? Object.entries(FAMILY_FEATURE).filter(([, f]) => f === feature).map(([family]) => family);
+/** What a failed read leaves unknown, said to the judge (thresholds.mjs judge): never left out, which would clear. */
+const unreadFamilies = (feature, why) => familiesOf(feature).map((family) => ({ unreadFamily: family, family, why: `${feature} could not be read: ${why}` }));
 
 export class Sampler {
   constructor({ reader, platform = process.platform, machine, env = process.env, config }) {
@@ -56,7 +64,7 @@ export class Sampler {
     const errors = {};
     const dt = this.prev ? (now - this.prev.at) / 1000 : null;
     const attempt = async (id, fn) => {
-      try { await fn(); } catch (error) { errors[id] = error.message; }
+      try { await fn(); } catch (error) { errors[id] = error.message; observations.push(...unreadFamilies(id, error.message)); }
     };
     const alarm = (name) => cfg.alarms[name];
 
@@ -88,11 +96,16 @@ export class Sampler {
         ...(memory.psi ? { psi: memory.psi } : {}),
       };
       families.add('memory');
-      if (memory.pressureLevel) observations.push({ key: 'memory.pressure', family: 'memory', def: alarm('memory.pressure'), value: memory.pressureLevel, met: { warn: memory.pressureLevel !== 'normal', crit: memory.pressureLevel === 'critical', clears: memory.pressureLevel === 'normal' }, summary: `kernel memory pressure ${memory.pressureLevel}` });
-      if (memory.freePct != null) observations.push({ key: 'memory.free', family: 'memory', def: alarm('memory.free'), value: memory.freePct, unit: '%', summary: `memory free ${memory.freePct}%` });
-      if (rate('swapouts') != null) observations.push({ key: 'memory.swapping', family: 'memory', def: alarm('memory.swapping'), value: rate('swapouts'), unit: 'pages/s', summary: `swapping out ${round(rate('swapouts'))} pages/s` });
-      if (swapped30 != null) observations.push({ key: 'memory.swapped30m', family: 'memory', def: alarm('memory.swapped30m'), value: swapped30, unit: '% of RAM', summary: `${round(swapped30, 2)}% of RAM swapped out in the last ${readings.memory.swappedWindowMin} min` });
-      if (rate('compressions') != null) observations.push({ key: 'memory.compressions', family: 'memory', def: alarm('memory.compressions'), value: rate('compressions'), unit: 'pages/s', summary: `${round(rate('compressions'), 0)} compressions/s` });
+      // A metric this platform does not have (memory.absent) is left out of judging: never raised, never unknown. Any
+      // other the platform gave no value for this cycle is unknown (null), never left out: left out, it would clear.
+      const absent = new Set(memory.absent ?? []);
+      const judged = (o) => { if (!absent.has(o.key ?? o.unreadKey)) observations.push(o); };
+      if (!memory.pressureLevel) judged({ unreadKey: 'memory.pressure', family: 'memory', why: 'the kernel memory pressure was not read this cycle' });
+      else judged({ key: 'memory.pressure', family: 'memory', def: alarm('memory.pressure'), value: memory.pressureLevel, met: { warn: memory.pressureLevel !== 'normal', crit: memory.pressureLevel === 'critical', clears: memory.pressureLevel === 'normal' }, summary: `kernel memory pressure ${memory.pressureLevel}` });
+      judged({ key: 'memory.free', family: 'memory', def: alarm('memory.free'), value: memory.freePct, unit: '%', summary: `memory free ${memory.freePct}%` });
+      judged({ key: 'memory.swapping', family: 'memory', def: alarm('memory.swapping'), value: rate('swapouts'), unit: 'pages/s', summary: `swapping out ${round(rate('swapouts'))} pages/s` });
+      judged({ key: 'memory.swapped30m', family: 'memory', def: alarm('memory.swapped30m'), value: swapped30, unit: '% of RAM', summary: `${round(swapped30, 2)}% of RAM swapped out in the last ${readings.memory.swappedWindowMin} min` });
+      judged({ key: 'memory.compressions', family: 'memory', def: alarm('memory.compressions'), value: rate('compressions'), unit: 'pages/s', summary: `${round(rate('compressions'), 0)} compressions/s` });
     });
 
     // ---- processes, renderers, daemons, writers ------------------------------------------------------
@@ -100,7 +113,12 @@ export class Sampler {
     if (on.has('processes')) await attempt('processes', async () => {
       const [rows, rus] = await Promise.all([
         this.reader.processes(),
-        on.has('process-footprint') ? this.reader.rusage().catch((error) => { errors['process-footprint'] = error.message; return new Map(); }) : new Map(),
+        on.has('process-footprint') ? this.reader.rusage().catch((error) => {
+          errors['process-footprint'] = error.message;
+          // without footprints no growth is read: every growth alarm is unknown this cycle, not cleared
+          for (const prefix of ['process.growth:', 'renderer.growth:']) observations.push({ unreadPrefix: prefix, family: 'process', why: `process footprints could not be read: ${error.message}` });
+          return new Map();
+        }) : new Map(),
       ]);
       if (this.platform === 'darwin' && now - this.topFoot.at >= cfg.footprintTopEverySec * 1000) {
         this.topFoot = { at: now, map: await this.reader.topFootprints().catch((error) => { errors.daemons = error.message; return this.topFoot.map; }) };
@@ -145,6 +163,14 @@ export class Sampler {
       families.add('process');
       const daemonNames = new Set(cfg.daemons?.[this.platform] ?? []);
       const isDaemon = (r) => daemonNames.has(base(r.command));
+      // What this read covers, so a raised alarm it no longer shows clears only on that (thresholds.mjs judge): the
+      // process list is complete (a pid not in it is gone), and each check names the processes it judged on a value.
+      const pids = new Set(rows.map((r) => r.pid));
+      observations.push({ enumerated: 'process', family: 'process', by: 'pid', entities: pids });
+      const cpuJudged = (renderer) => new Set(byCpu.filter((r) => !isDaemon(r) && !AGENT.test(base(r.command)) && RENDERER.test(r.command) === renderer).map((r) => r.pid));
+      observations.push({ covered: 'process.cpu:', family: 'process', entities: cpuJudged(false) }, { covered: 'renderer.cpu:', family: 'process', entities: cpuJudged(true) });
+      const grown = (renderer) => new Set(rows.filter((r) => r.growthMBPerMin != null && RENDERER.test(r.command) === renderer).map((r) => r.pid));
+      observations.push({ covered: 'process.growth:', family: 'process', entities: grown(false) }, { covered: 'renderer.growth:', family: 'process', entities: grown(true) });
       // Every process down to the lower clear line is observed, so a raised alarm holds through a brief dip
       // instead of clearing and raising again (hysteresis); one that falls below it is no longer watched.
       for (const r of byCpu) {
@@ -159,8 +185,9 @@ export class Sampler {
       // observed; a raised one holds until its growth falls under a quarter of the line, so a leak that pauses
       // between samples is one alarm, not a raise and a clear each minute.
       for (const r of rows) {
-        if (r.growthMBPerMin == null) continue;
         const renderer = RENDERER.test(r.command);
+        // a process whose growth has no reading this cycle (no footprint, or no earlier one) is unknown, not cleared
+        if (r.growthMBPerMin == null) { observations.push({ unreadKey: `${renderer ? 'renderer' : 'process'}.growth:${r.pid}`, family: 'process', why: 'no footprint reading to measure its growth this cycle' }); continue; }
         const tab = renderer ? this.rendererTabs?.get(r.pid) ?? null : null;
         const def = alarm(renderer ? 'renderer.growth' : 'process.growth');
         if (r.footprintBytes / MB < def.minMB) continue;
@@ -180,6 +207,7 @@ export class Sampler {
           orphanedHeadless: orphaned.map(view),
         };
         families.add('browser');
+        observations.push({ enumerated: 'browser', family: 'browser', by: 'pid', entities: pids }, { covered: 'browser.orphan:', family: 'browser', entities: pids });
         for (const r of orphaned) observations.push({ key: `browser.orphan:${r.pid}`, family: 'browser', def: alarm('browser.orphan'), value: 1, met: { warn: true, crit: false, clears: false }, summary: `headless browser ${r.pid} left running with launchd as its parent`, detail: view(r) });
       }
 
@@ -187,6 +215,8 @@ export class Sampler {
         const daemons = rows.filter(isDaemon);
         readings.daemons = daemons.sort((a, b) => (b.cpuPct ?? 0) - (a.cpuPct ?? 0)).map((r) => ({ name: base(r.command), ...view(r) }));
         families.add('daemon');
+        observations.push({ enumerated: 'daemon', family: 'daemon', by: 'pid', entities: pids },
+          { covered: 'daemon.cpu:', family: 'daemon', entities: new Set(daemons.filter((r) => r.cpuPct != null).map((r) => `${base(r.command)}:${r.pid}`)) });
         const footDef = alarm('daemon.footprint');
         for (const r of daemons) {
           const name = base(r.command);
@@ -200,6 +230,7 @@ export class Sampler {
         const writers = rows.filter((r) => r.writeBps > 0).sort((a, b) => b.writeBps - a.writeBps).slice(0, 5);
         readings.diskWriters = writers.map((r) => ({ ...view(r), writeMBps: round(r.writeBps / MB, 1) }));
         families.add('disk-writer');
+        observations.push({ enumerated: 'disk-writer', family: 'disk-writer', by: 'pid', entities: pids }, { covered: 'disk.writer:', family: 'disk-writer', entities: new Set(rows.filter((r) => r.writeBps != null).map((r) => r.pid)) });
         for (const r of rows) if (r.writeBps != null && r.writeBps / MB > alarm('disk.writer').warn * 0.5) observations.push({ key: `disk.writer:${r.pid}`, family: 'disk-writer', def: alarm('disk.writer'), value: r.writeBps / MB, unit: 'MB/s', summary: `process ${r.pid} writing ${round(r.writeBps / MB, 1)} MB/s`, detail: view(r) });
       }
 
@@ -276,6 +307,8 @@ export class Sampler {
       });
       readings.tcp = { states, timeWait: states.TIME_WAIT ?? 0, range: { ...range, size }, timeWaitSec, ephemeral, timeWaitByTarget };
       families.add('tcp');
+      // every socket was read: an address or a target with none has none in use (judged, under its line)
+      observations.push({ covered: 'tcp.ephemeral:', family: 'tcp', all: true }, { covered: 'tcp.timeWaitTarget:', family: 'tcp', all: true });
       for (const e of ephemeral) observations.push({ key: `tcp.ephemeral:${e.addr}`, family: 'tcp', def: alarm('tcp.ephemeral'), value: e.pct, unit: '% of ports', summary: `${e.used} of ${size} ephemeral ports in use on ${e.addr}` });
       for (const t of timeWaitByTarget) observations.push({ key: `tcp.timeWaitTarget:${t.target}`, family: 'tcp', def, value: t.pct, unit: '% of ports', summary: `${t.count} TIME_WAIT against ${t.target.startsWith(':') ? `listener ${t.target}${t.exited ? ' (listener has exited; its TIME_WAITs are draining)' : ''}` : t.target}${t.listener ? ` (pid ${t.listener.pid})` : ''}; range ${size}, TIME_WAIT lasts ${timeWaitSec} s`, detail: t });
     });
@@ -295,8 +328,8 @@ export class Sampler {
     for (const o of this.slow.observations) if (on.has(SLOW_FEATURE[o.family])) observations.push(o);
     for (const f of this.slow.families ?? []) if (on.has(SLOW_FEATURE[f])) families.add(f);
 
-    // A feature turned off clears its raised alarms: its family is judged with nothing observed.
-    for (const [family, feature] of Object.entries(FAMILY_FEATURE)) if (!on.has(feature)) families.add(family);
+    // A feature turned off clears its raised alarms: a positive observation that its family is no longer watched.
+    for (const [family, feature] of Object.entries(FAMILY_FEATURE)) if (!on.has(feature)) observations.push({ off: family, family });
 
     await this.#sessions(readings, observations);
     this.prev = { at: now, memory, io: this.io ?? null };
@@ -306,13 +339,25 @@ export class Sampler {
   async #slow(on, slow, errors, now) {
     const cfg = this.config;
     const alarm = (name) => cfg.alarms[name];
-    const attempt = async (id, fn) => { try { await fn(); } catch (error) { errors[id] = error.message; } };
+    const attempt = async (id, fn) => { try { await fn(); } catch (error) { errors[id] = error.message; slow.observations.push(...unreadFamilies(id, error.message)); } };
 
     if (on.has('disk')) await attempt('disk', async () => {
       const def = alarm('disk.free');
       const fill = alarm('disk.filling');
       const vols = await this.reader.volumes();
       slow.families.add('disk');
+      // Every mount was read only when the listing finished and read each one: then one not listed is gone. A listing
+      // that did not (df failed, a mount's statfs failed) enumerates nothing, so a hung volume's alarm holds, unknown.
+      // Mounts this user may not stat (EACCES): named in the reading. They still exist, so they stay in the enumeration
+      // (never gone): an alarm raised on one holds, unknown, with why; one never raised costs nothing.
+      const denied = vols.denied ?? [];
+      if (denied.length) slow.readings.diskDenied = denied;
+      for (const mount of denied) for (const prefix of ['disk.free:', 'disk.filling:']) slow.observations.push({ unreadPrefix: `${prefix}${mount}`, family: 'disk', why: `${mount} can no longer be read by this user (statfs: EACCES)` });
+      if (vols.unread) for (const prefix of ['disk.free:', 'disk.filling:']) slow.observations.push({ unreadPrefix: prefix, family: 'disk', why: vols.unread });
+      else slow.observations.push({ enumerated: 'disk', family: 'disk', by: 'suffix', entities: new Set([...vols.map((v) => v.mount), ...denied]) });
+      // a mount's filling is judged once it has a rate (10 min of readings)
+      const rated = new Set();
+      slow.observations.push({ covered: 'disk.filling:', family: 'disk', entities: rated });
       slow.readings.disk = vols.map((v) => {
         const ring = this.diskRing.get(v.mount) ?? [];
         ring.push([now, v.freeBytes]);
@@ -322,6 +367,7 @@ export class Sampler {
         const hours = (now - t0) / 3_600_000;
         const perHour = hours >= 10 / 60 ? (f0 - v.freeBytes) / hours : null; // bytes consumed per hour
         const hoursToFull = perHour > 0 ? v.freeBytes / perHour : null;
+        if (perHour != null) rated.add(v.mount);
         const freePct = (v.freeBytes / v.totalBytes) * 100;
         const per = cfg.volumes?.[v.mount] ?? {};
         const row = { mount: v.mount, freeGB: round(v.freeBytes / GB), totalGB: round(v.totalBytes / GB), freePct: round(freePct), fillGBPerHour: perHour == null ? null : round(perHour / GB, 2), hoursToFull: round(hoursToFull) };
@@ -338,6 +384,8 @@ export class Sampler {
       const list = cfg.services ?? [];
       const jobs = await this.reader.services(list.map((s) => s.label));
       slow.families.add('service');
+      // every configured service was read (one no longer configured is gone)
+      slow.observations.push({ enumerated: 'service', family: 'service', by: 'suffix', entities: new Set(list.map((s) => s.label)) });
       slow.readings.services = list.map((s) => {
         const job = jobs.get(s.label);
         let logAgeMin = null;
@@ -393,7 +441,17 @@ export class Sampler {
       const cdef = alarm('supercode.connector');
       const link = connector?.enrolled ? (connector.running ? (connection == null ? null : connection === 'online') : false) : true;
       slow.observations.push({ key: 'supercode.daemon', family: 'supercode', def: cdef, value: described ? 0 : 1, met: { warn: !described, crit: false, clears: Boolean(described) }, summary: described ? 'machine daemon answering' : `machine daemon did not answer describe (${describe.error || 'no answer'})` });
-      if (connector && link !== null) slow.observations.push({ key: 'supercode.link', family: 'supercode', def: cdef, value: link ? 0 : 1, met: { warn: !link, crit: false, clears: link }, summary: link ? 'connector linked to its server' : `connector ${connector.running ? `running but the server sees this machine ${connection}` : 'not running'}` });
+      // the link is read from two sources (the connector's status, the server's machine list): either unreadable leaves it
+      // unknown, which holds a raised alarm and clears nothing (a raised link alarm once cleared while the link was down)
+      if (!data) slow.observations.push({ unreadKey: 'supercode.link', family: 'supercode', why: `the connector's status could not be read: ${status.error || 'no answer'}` });
+      else if (connector && link === null) slow.observations.push({ unreadKey: 'supercode.link', family: 'supercode', why: `the server's view of this machine could not be read: ${machines.ok === false ? machines.error || 'no answer' : listed ? 'its machine record names no connection' : 'this machine is not in the machine list'}` });
+      // a status that names no connector says nothing of the link: unknown, said, never left out
+      else if (!connector) slow.observations.push({ unreadKey: 'supercode.link', family: 'supercode', why: 'the connector\'s status names no connector' });
+      else slow.observations.push({ key: 'supercode.link', family: 'supercode', def: cdef, value: link ? 0 : 1, met: { warn: !link, crit: false, clears: link }, summary: link ? 'connector linked to its server' : `connector ${connector.running ? `running but the server sees this machine ${connection}` : 'not running'}` });
+      // launches the daemon could not list are unknown: a raised launch alarm holds
+      if (!Array.isArray(rows)) for (const prefix of ['supercode.launch:', 'supercode.launchFailed:']) slow.observations.push({ unreadPrefix: prefix, family: 'supercode', why: `the daemon's launches could not be listed: ${launches.error || 'no answer'}` });
+      // the launch list was read: every launch in it was judged stuck or not, failed or not (one not shown is neither)
+      if (Array.isArray(rows)) slow.observations.push({ covered: 'supercode.launch:', family: 'supercode', all: true }, { covered: 'supercode.launchFailed:', family: 'supercode', all: true });
       for (const r of stuck) slow.observations.push({ key: `supercode.launch:${r.key}`, family: 'supercode', def: { forSec: 0 }, value: 1, met: { warn: true, crit: false, clears: false }, summary: r.status === 'issued' ? `launch ${r.key} (${r.kind ?? 'pane'}) issued ${Math.round((now - r.at) / 60_000)} min ago and never became ready` : `launch ${r.key} is live but its first input was not delivered: ${r.inputError}` });
       for (const r of failed) slow.observations.push({ key: `supercode.launchFailed:${r.key}`, family: 'supercode', def: { forSec: 0 }, value: 1, met: { warn: true, crit: false, clears: false }, summary: `launch ${r.key} (${r.kind ?? 'pane'}) failed at ${new Date(r.at).toISOString()}` });
     });
@@ -428,7 +486,10 @@ export class Sampler {
       slow.readings.browserTabs = { count: tabs.length, byHolder, tabs: rows };
       slow.families.add('tabs');
       const def = alarm('browser.tabs');
+      // Said either way, never left out: with no line configured (the default) the count was read and is past no line,
+      // a positive observation that clears an alarm raised under a line since removed.
       if (def.warn != null) slow.observations.push({ key: 'browser.tabs', family: 'tabs', def, value: tabs.length, unit: 'tabs', summary: `${tabs.length} browser tabs open` });
+      else slow.observations.push({ key: 'browser.tabs', family: 'tabs', def, value: tabs.length, unit: 'tabs', met: { warn: false, crit: false, clears: true }, summary: `${tabs.length} browser tabs open (no line configured)` });
     });
 
     if (on.has('power')) await attempt('power', async () => {
@@ -437,7 +498,8 @@ export class Sampler {
       const level = /pressure level:\s*(\w+)/i.exec(r.stdout)?.[1] ?? null;
       slow.readings.power = { thermalPressure: level };
       slow.families.add('power');
-      if (level) slow.observations.push({ key: 'power.thermal', family: 'power', def: alarm('power.thermal'), value: level, met: { warn: level !== 'Nominal', crit: /Heavy|Trapping|Sleeping/.test(level), clears: level === 'Nominal' }, summary: `thermal pressure ${level}` });
+      if (!level) slow.observations.push({ unreadKey: 'power.thermal', family: 'power', why: 'the thermal pressure was not read this cycle' });
+      else slow.observations.push({ key: 'power.thermal', family: 'power', def: alarm('power.thermal'), value: level, met: { warn: level !== 'Nominal', crit: /Heavy|Trapping|Sleeping/.test(level), clears: level === 'Nominal' }, summary: `thermal pressure ${level}` });
     });
   }
 

package/lib/thresholds.mjs

@@ -5,6 +5,7 @@ export const DEFAULTS = {
   slowIntervalSec: 60,      // disk space, services, the connector, tabs
   footprintTopEverySec: 300, // macOS: every user's largest footprints through top (about 2 s of top per run)
   repeatMin: 60,            // a raised alarm mails again this often (netdata's repeat cap)
+  unknownMin: 15,           // a reading unknown this long (raised or not) is mailed to the maintainers, and again each repeatMin
   historyHours: 24,
   daemons: {
     darwin: ['dasd', 'fseventsd', 'mds', 'mds_stores', 'mdworker_shared', 'WindowServer', 'kernel_task', 'backupd', 'softwareupdated', 'photoanalysisd', 'cloudd', 'bird', 'nsurlsessiond', 'trustd', 'syspolicyd', 'XprotectService', 'logd', 'runningboardd', 'launchservicesd', 'coreduetd', 'spotlightknowledged'],
@@ -48,7 +49,8 @@ export function merge(base, over) {
 
 /** Which levels a numeric value meets under a threshold definition. */
 export function meets(value, def) {
-  if (value == null || Number.isNaN(value)) return { warn: false, crit: false, clears: true };
+  // no value is no reading: unknown, which neither raises nor clears (D190 class 1)
+  if (value == null || Number.isNaN(value)) return { warn: false, crit: false, clears: false, unknown: true };
   const past = (line) => line != null && (def.below ? value < line : value > line);
   const crit = past(def.crit);
   const warn = crit || past(def.warn);
@@ -59,16 +61,56 @@ export function meets(value, def) {
 const RANK = { none: 0, warn: 1, crit: 2 };
 
 /**
- * One step of every alarm. `observations`: [{ key, family, def, value, met?, unit, summary, detail }] for the
- * families read this cycle. A key of an evaluated family that was not observed has cleared (its entity is gone).
- * Returns the transitions; `state` (key → record) is updated in place.
+ * One step of every alarm. A raised alarm clears only on a positive observation (D190 class 1, held structurally:
+ * no read site has to say it failed for its alarm to hold):
+ * - its value, read this cycle, is past its clear line;
+ * - the read that judges it covered it with a real value and found it under its line (`{ covered: prefix, family,
+ *   entities | all }`: every key `prefix + entity` was evaluated, so one not observed is under its line);
+ * - a complete enumeration of its family no longer has its entity (`{ enumerated: family, by: 'pid' | 'suffix',
+ *   entities }`: the process list, the mounts, the configured services);
+ * - its feature is off (`{ off: family }`).
+ * Anything else not observed is unknown: the alarm holds, saying since when and why (`{ unreadFamily | unreadKey |
+ * unreadPrefix, why }` give the why where a site knows it; otherwise it is "not observed this cycle").
+ * `observations` also carry the readings: [{ key, family, def, value, met?, unit, summary, detail }].
+ * Every unknown (raised or not: a key or a family that could not be read) is kept in `unknowns` (key → { why,
+ * since }) for its notification (probe.mjs); one read again leaves it.
+ * Returns the transitions; `state` (key → record) and `unknowns` are updated in place.
  */
-export function judge(state, observations, families, now) {
+export function judge(state, observations, families, now, unknowns = {}) {
   const transitions = [];
   const seen = new Set();
+  const unreadFamilies = new Map(), unreadKeys = new Map(), unreadPrefixes = [], covered = [], enumerated = new Map(), off = new Set();
   for (const o of observations) {
+    if (o.unreadFamily) unreadFamilies.set(o.unreadFamily, o.why);
+    else if (o.unreadKey) unreadKeys.set(o.unreadKey, { family: o.family, why: o.why });
+    else if (o.unreadPrefix) unreadPrefixes.push(o);
+    else if (o.covered) covered.push(o);
+    else if (o.enumerated) enumerated.set(o.enumerated, o);
+    else if (o.off) off.add(o.off);
+  }
+  const why = (key, family) => unreadFamilies.get(family) ?? unreadKeys.get(key)?.why ?? unreadPrefixes.find((p) => p.family === family && key.startsWith(p.unreadPrefix))?.why ?? null;
+  // an entity is a pid (a number) or a name: a key's suffix matches either form
+  const holds = (set, entity) => set.has(entity) || (/^\d+$/.test(entity) && set.has(Number(entity)));
+  const under = (key, family) => covered.some((c) => c.family === family && key.startsWith(c.covered) && (c.all || (c.entities && holds(c.entities, key.slice(c.covered.length)))));
+  const gone = (key, family) => {
+    const e = enumerated.get(family); if (!e) return false;
+    const entity = e.by === 'pid' ? Number(key.slice(key.lastIndexOf(':') + 1)) : key.slice(key.indexOf(':') + 1);
+    return !e.entities.has(entity);
+  };
+  const hold = (key, reason) => {
+    const s = state[key];
+    if (s) Object.assign(s, { unread: String(reason), unreadAt: s.unreadAt ?? now });
+    unknowns[key] = { family: s?.family ?? null, why: String(reason), since: unknowns[key]?.since ?? now };
+  };
+  // what a site said it could not read is unknown whether or not it was ever raised (its notification: probe.mjs)
+  const read = new Set();
+  for (const [family, reason] of unreadFamilies) { const key = `family:${family}`; unknowns[key] = { family, why: reason, since: unknowns[key]?.since ?? now }; read.add(key); }
+  for (const [key, { family, why: reason }] of unreadKeys) { unknowns[key] = { family, why: reason, since: unknowns[key]?.since ?? now }; read.add(key); }
+  for (const o of observations) {
+    if (!o.key) continue;
     seen.add(o.key);
     const m = o.met ?? meets(o.value, o.def);
+    if (m.unknown) { hold(o.key, `${o.key}: no value read this cycle`); read.add(o.key); continue; }
     const s = state[o.key] ?? (state[o.key] = { key: o.key, family: o.family, level: 'none', warnSince: null, critSince: null, raisedAt: null, lastMailAt: null });
     s.warnSince = m.warn ? (s.warnSince ?? now) : null;
     s.critSince = m.crit ? (s.critSince ?? now) : null;
@@ -79,7 +121,7 @@ export function judge(state, observations, families, now) {
     else if (m.warn && now - s.warnSince >= warnFor) target = 'warn';
     // Hysteresis: a raised alarm holds at warn until the value is past its clear line.
     if (target === 'none' && s.level !== 'none' && !m.clears) target = 'warn';
-    Object.assign(s, { value: o.value, unit: o.unit ?? null, summary: o.summary, detail: o.detail ?? null, at: now });
+    Object.assign(s, { value: o.value, unit: o.unit ?? null, summary: o.summary, detail: o.detail ?? null, at: now, unread: null, unreadAt: null });
     if (target !== s.level) {
       transitions.push({ key: o.key, from: s.level, to: target, value: o.value, unit: o.unit ?? null, summary: o.summary, detail: o.detail ?? null });
       if (RANK[target] > RANK[s.level] && s.level === 'none') s.raisedAt = now;
@@ -88,16 +130,27 @@ export function judge(state, observations, families, now) {
     }
   }
   for (const [key, s] of Object.entries(state)) {
-    if (seen.has(key) || !families.has(s.family)) continue;
-    // An alarm restored from before a restart is not cleared by the first samples, which have no rates yet.
-    if (s.restoredUntil && now < s.restoredUntil) continue;
-    if (s.level !== 'none') transitions.push({ key, from: s.level, to: 'none', value: null, summary: `${s.summary} — cleared: no longer over its line, or the process exited`, detail: s.detail, gone: true });
+    if (seen.has(key)) continue;
+    // a key not observed clears only on a positive observation; anything else is unknown
+    const cleared = off.has(s.family) ? 'its feature is off' : under(key, s.family) ? 'under its line' : gone(key, s.family) ? 'it is gone' : null;
+    if (!cleared) {
+      if (s.level === 'none') { delete state[key]; continue; } // nothing raised to hold
+      // An alarm restored from before a restart waits out the first samples, which have no rates yet.
+      if (s.restoredUntil && now < s.restoredUntil) continue;
+      hold(key, why(key, s.family) ?? `not observed this cycle: no complete read of its ${s.family} family covered it`);
+      read.add(key);
+      continue;
+    }
+    if (s.level !== 'none') transitions.push({ key, from: s.level, to: 'none', value: null, summary: `${s.summary} — cleared: ${cleared}`, detail: s.detail, gone: cleared === 'it is gone' });
     delete state[key];
   }
+  // an unknown read again (or cleared) this cycle leaves the list
+  for (const key of Object.keys(unknowns)) if (!read.has(key)) delete unknowns[key];
   return transitions;
 }
 
 export function raised(state) {
   return Object.values(state).filter((s) => s.level !== 'none').sort((a, b) => RANK[b.level] - RANK[a.level] || a.key.localeCompare(b.key))
-    .map(({ key, family, level, value, unit, summary, detail, raisedAt }) => ({ key, family, level, value, unit, summary, detail, since: raisedAt ? new Date(raisedAt).toISOString() : null }));
+    .map(({ key, family, level, value, unit, summary, detail, raisedAt, unread, unreadAt }) => ({ key, family, level, value, unit, summary, detail, since: raisedAt ? new Date(raisedAt).toISOString() : null,
+      ...(unread ? { unknown: { why: unread, since: new Date(unreadAt).toISOString() } } : {}) }));
 }

package/lib/win32.mjs

@@ -5,7 +5,9 @@ import { run } from './run.mjs';
 
 export async function memory() {
   const total = totalmem();
-  return { pressureLevel: null, totalBytes: total, freePct: Math.round((freemem() / total) * 100), swapUsedBytes: null, swapTotalBytes: null, counters: {}, pageSize: 4096 };
+  // what Node gives no reading of on Windows: left out of judging, never unknown
+  return { pressureLevel: null, totalBytes: total, freePct: Math.round((freemem() / total) * 100), swapUsedBytes: null, swapTotalBytes: null, counters: {}, pageSize: 4096,
+    absent: ['memory.pressure', 'memory.swapping', 'memory.swapped30m', 'memory.compressions'] };
 }
 
 function splitAddress(text) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-health",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "Optional machine pack: a cheap, deterministic probe of a machine's vitals that mails the machine's maintainer when a threshold is crossed. Each feature sits behind its own permission barrier.",
   "license": "MIT",