fix(ops): a message is worth sending only if a human must act on it

[catomean]

Thirteen Telegrams reached George on the evening of 2026-08-28. Two were real — and one of those two, botsmann being down, was buried in the noise of the other eleven. This makes every category of the eleven impossible, and fixes the outage class that produced the two.

What each of last night's messages was, and what happens to it now

Message	Cause	Now
6× UNIT DOWN: vitareba-app in 60s	crash loop, no cooldown	already fixed in #432; now via alert_once
UNIT DOWN: restic-check	failed on a 25-day-old stale lock from the laptop, retried 46s later and finished clean	oneshot grace: a retry in flight or already succeeded does not page. Root cause also fixed — ExecStartPre=-restic unlock on the box
FAILED UNIT: ● / RECOVERED: unit____	systemd's bullet read as the unit name	already fixed earlier that evening
FAILED UNIT: cloud-init-hotplugd	failed since 2026-07-22, nothing to do, never recovers	masked — a unit that can only produce noise should not be in the failed set at all
zz-audit-probe failed + recovered	a planted test probe	ALERT_DRY_RUN=1: probes journal, they do not deliver
fleet register check failed on TEST	a deliberate test send to the real chat	same
2× identical register check failed … substrata port 4022	read a working tree ~15 agent sessions share, mid-edit; and had its own Telegram call with no state	judges the committed register; one message per finding per day
UNIT DOWN: botsmann-app	real: /opt/botsmann/shared/.env was root-owned, app runs as ubuntu	repaired live, and the class is now self-healing

The changes

• lib-alert.sh — one delivery point. alert_once/alert_clear give every sender a per-subject cooldown. An identical-text floor sits under the unkeyed path only, so a caller with no state cannot repeat itself; keyed senders bypass it, because two mechanisms arguing about one message means the quieter one silently wins. Suppressed is never invisible — the journal gets every alert, including suppressed ones.
• notify-failure.sh — a oneshot a retry already fixed is not an incident. The unit template gains TimeoutStartSec=300: DefaultTimeoutStartSec is 90s, so the notifier would otherwise be SIGTERMed inside its own grace window and the page never sent — an anti-noise guard that becomes an anti-alert bug.
• host-check.sh — an app whose .env its own unit User= cannot read is repaired and reported, not asked about. This took two apps down on 2026-08-28 (vitareba 18:38, botsmann 20:16) and both times the remedy was one deterministic command. The owner is not a guess: it is the unit's User=. deploy.sh asserts the same invariant where the file is written.
• scripts/local/fleet-register-check moves into the repo — it was untracked, which is why neither of its bugs was ever reviewed.

Verification

• npm run test:ops: 52 passed, 0 failed in the host-alert suite (33 before), whole bundle green.
• Six mutations, each reintroducing one behaviour, each turning the suite red — floor removed, dry-run removed, oneshot grace removed, env repair downgraded to a report, per-subject cooldown removed, env stamp-clear removed. 0 inert. Mutations ran against a throwaway copy; the pushed artifact was grepped before and after.
• Register check proven both ways live: a dirty working tree with a duplicate port → passes (reads the commit); a scratch commit that really has one → fails, would send once, second run says not repeating.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AqzRcMP1uJzd7Tav5fNxQz