fix(operator-queue): platform alerts are conditions — one pending row per subject (#3246, part 1)

[vybe]

Fixes #3246 — PR 1 of 2 (the rest is #3254). Independent of the ask-contract stack (#3250 → #3253 → #3247) that came out of the same session. Base is dev. Draft until the operator calls the merge order.

What

Platform alerts describe a condition, and the queue now stores them that way: one pending row per subject, updated in place, ended by the platform when the condition clears.

• One shared path (services/platform_alerts.py): observe / clear / reconcile. A registry names each alert kind, its id prefix and its lifetime. observe never raises into its caller.
• One pending row per subject: two nullable columns on the queue table (subject, last_seen_at) and a partial unique index on pending rows per agent and subject; the create runs inside the same per-agent lock as native asks. A newer reading updates the row (latest text, priority, last-seen, a seen count in context).
• Ended by the platform: ask_service.clear_platform ends a row as cancelled / platform with reason condition_cleared or superseded, through the existing endings vocabulary and as a compare-and-set on pending, so a row a person ended is never overwritten.
• Lifetimes: polled and per-event kinds expire 14 days after last seen; edge-triggered kinds with a clear hook get a fixed 30 days as a net; the four kinds a person must act on never expire. Two env knobs, in .env.example and all three compose files.
• After a person ends an alert, the same reading files nothing for 7 days unless its priority rises or a material value changes.
• Upgrade cleanup (Alembic 0090_platform_alert_subjects, both schema tracks): for each subject it can derive, the newest pending platform row stays and the older ones are ended as one recorded batch; the unique index is created only after that. It considers only rows the platform raised, never guesses a subject, and is idempotent.
• Four emitter families on the path: subscription headroom (keyed by subscription, so a critical reading replaces the warning), legacy skills-library adoption (one subject per URL), the system agent's stale base image and start failure, the agent circuit breaker. Every other emitter stays on its old path and is listed in a ratchet test; they move in bug: the remaining platform alert emitters still file one row per reading — move them onto the shared alert path (#3246 part 2) #3254.
• Four previously unreserved platform id prefixes are now reserved, so an agent cannot author rows under them.
• Surfaces: a platform-ended row reads "Ended by the platform — the condition cleared" (or "superseded by a newer reading"); a repeated pending alert shows "seen N times · last seen …" on the Operations card, its detail and /m.

Rulings carried (orchestrator, on the operator's behalf — plan file)

• T1 the schema change, approved by the operator.
• T5 deviates from the plan: the quiet window after a person ends an alert is 7 days, not 24 hours.
• T8 deviates: two PRs — this one carries the shared path, the cleanup and the four families that made up most of the observed pile; bug: the remaining platform alert emitters still file one row per reading — move them onto the shared alert path (#3246 part 2) #3254 carries the rest.
• T2, T3, T4, T6, T7, T9, T10 as recommended. Operator queue: acknowledging a platform-minted alert leaves it responded forever — the write-back re-injects it into the agent's queue file and the #1631 guard rejects it on every boot #2372 stays separate.

Review + security

Review in two halves after an all-in-one review timed out with nothing on disk. Correctness + security (claude-fable-5-1, by reading): MERGEABLE AFTER FIXES. Evidence sweep (partial): one new red.

• C1, fixed in ae988d0e: the upgrade cleanup derived a subject from the row id alone. An agent-raised row under a newly reserved prefix hosted on the agent's own name could be grouped with the platform's alarm and, if newer, survive while the platform alarm was ended. The cleanup now reads raised_by in the query and in the planner; 17 new cases cover agent and gate rows under all four prefixes.
• C2, fixed in 95cb5cf9: the path's queue-sync WebSocket broadcast named no agent and reached every logged-in client (test_ent467_ws_agent_scope red). It is now keyed by the row's host agent.
• 443c6b81 merges live dev; 499f2cca fixes a test that was order-dependent across files (see Tests); 34917656 adds the one emitter test a mutation check showed missing (the quiet window at the headroom emitter). All five named mutations now turn tests red.
• /cso --diff: nothing further supported.

Tests

CI on the tip 499f2cca: all checks green — the full backend suite in CI's shuffled, parallel order (21,570 passed, 39 skipped; regression diff clean against the dev baseline), Postgres Migrations Smoke, frontend-e2e, MCP tests, schema parity, the container and docs guards.

• CI's first full run found one failure that no engineer-side run had shown: this branch's own test_3246_platform_alerts_db…::test_a_refresh_between_select_and_cas_keeps_the_row. Cause: the test patched db.operator_queue.select by module name, and two sibling files stub that module in sys.modules, so under CI's order the patch landed on a different module object. Fixed in 499f2cca (the test patches the globals the running method reads; claim unchanged; 20 of 20 seeds green). Not a defect in mark_expired.
• One existing test flaked once on the way: test_ent329_operator_resume::test_spawn_keeps_a_strong_reference ("The future belongs to a different loop"). This branch does not touch it; it passed on the previous head and on the re-run.
• Engineer-side: the required pytest list (24 files) 851 passed; mcp-server 705 passed; frontend unit 4,633 passed.

Before merge

• Migration number: 0090_platform_alert_subjects on 0089… is a single head against dev today. Open PR feat(pull): /chat on the durable queue for pull pilots (#3127) #3145 carries another 0090 on the same parent, and the stack's Scheduled runs re-ask what is already pending — show an agent its open asks and let it replace one #3247 branch carries a third. Whichever lands second renumbers and re-parents (file name, revision id, down_revision, textual mirrors).
• Conflicts with the stack from the same session: with feat(operator-queue): approvals get a "Something else" answer (#3242) #3250 / feat(operator-queue): atomic asks — authoring rules in the ask_operator contract, option and title limits (#3243) #3253 in docs/memory/feature-flows/operating-room.md, QueueCard.vue, QueueItemDetail.vue; with the Scheduled runs re-ask what is already pending — show an agent its open asks and let it replace one #3247 branch in 14 files (the queue db layer, schema tracks, the Workspace ask projection, the three operator components, utils/operatorQueue.js, operator_queue.ts). Keep both intents; merge order is the operator's call.
• Other open PRs: this branch adds conflicts with feat(workspace): Discuss and Dismiss on asks (abilityai/trinity-enterprise#747, #748) #3181 (operating-room.md, operator_queue.ts) and feat(pull): /chat on the durable queue for pull pilots (#3127) #3145 (db/migrations.py).
• Upgrade note: an agent row that already sits under one of the four newly reserved prefixes keeps its pending state but loses its ending wake and file mirror; a retry of that id is refused.
• Two pre-existing reds on dev, not from this branch: test_ent236_skills_lifecycle::…::test_real_repo_still_pulls, and two test files that fail to import strip_url_credentials.

Handoffs

• bug: the remaining platform alert emitters still file one row per reading — move them onto the shared alert path (#3246 part 2) #3254: the remaining emitters, including the budgeted alerts and create_bounded_alert_outcome.
• Operator queue: acknowledging a platform-minted alert leaves it responded forever — the write-back re-injects it into the agent's queue file and the #1631 guard rejects it on every boot #2372 (acknowledge leaves a platform alert responded) is next in line and untouched here.

🤖 Generated with Claude Code

[vybe]

merge-train (2026-10-06): ejected — rides the next train once fixed. Design, SQL (lock-first upsert + partial unique backstop), both migration tracks, Alembic heads, compose defaults and every gate check out; 3/3 mutations red on the seam. One real defect:

spawn_on_loop raises from every thread-origin caller this PR introduces, so the platform ending loses its audit row and live trigger. subscription_recovery_service.py:418 (await asyncio.to_thread(alerts.clear_recovered, …)) and :424, skills_sync_service.py:183, routers/skills.py:289 and :1058 run the seam on the loop's default executor. operator_resume_service.spawn_on_loop (:559-579) handles only a running loop or an anyio worker thread and re-raises otherwise ("not a shape any production caller has" — now false). ask_service._ended (:993-997) and platform_alerts._spawn (:559-564) swallow it, so every 5-minute headroom sweep that clears a recovered subscription, and every skills auto-sync reconcile, commits the ending with no platform_cleared audit row, no operator_queue_cancelled trigger, and a WARNING traceback. Reproduced: loop thread OK, anyio.to_thread OK, asyncio.to_thread → RuntimeError. It escaped because test_1816 monkeypatches spawn_on_loop to a no-op and test_ent434 stubs observe.

Fix: anyio.to_thread.run_sync at those call sites, or a captured-loop call_soon_threadsafe fallback in spawn_on_loop; plus a thread-origin clear/observe test asserting the audit row lands.

Also: test_1816_system_agent_adoption.py followed by test_ent329_operator_resume.py::test_spawn_keeps_a_strong_reference fails deterministically (The future belongs to a different loop, from the new_event_loop() at test_1816:115); CI shuffles, so it will recur. And the PR body cites commits that no longer exist on the branch after the rebase.

Merge order after the fix: this PR leads the next train; #3256 and #3145 re-parent their 0090 onto it (disjoint tables, mechanical).