Reading the alert ledger as ops historyReview

alert-state.json is your pager: open entries are the infra to-do list, the count field is how loud each is shouting, and a missing entry means auto-resolve did its job.

You shipped the dedup + auto-resolve layer on Jul 21 (PDB d9b37fc) to stop failure spam: first failure opens an incident and fires ONE 🚨 Things task; repeat failures bump `count` and update `last_seen` without new tasks; a success for that job key deletes the entry and closes the loop. The ledger is the layer's memory.

That gives every entry a grammar. `opened_at` = when it broke. `last_seen` = the most recent re-failure — if it's old, the job may have stopped running entirely (a vanish, which the ledger can't see — that's the dead-man's-switch gap from the Jul 29 lesson). `count` = how many times it's re-fired; a rising count with no fix is a standing appointment you keep missing.

Reading it as ops history: jobhunt-sweep opened Jul 27, last_seen Aug 3, count 2 — a weekly job that has failed both chances since opening, root cause known (permission wall, yesterday's lesson). weekly-review-fail opened Aug 2, count 1 — and if tonight's run succeeds, watch it auto-resolve out of the file. An empty ledger isn't 'no information'; it's the system attesting fleet-healthy.

Worked example

Read the pager and verify it against Things:

python3 -c "
import json, datetime
ledger = json.load(open('/Users/tom/Claude/PDB/data/alert-state.json'))
for key, inc in ledger.items():
    print(f\"{key}: open since {inc['opened_at'][:10]}, last failure {inc['last_seen'][:10]}, fired {inc['count']}x\")
"

• Each line is one open incident, human-readable. The task_id field (not printed here) links to the 🚨 Things task the layer created — one per incident, no matter how many failures.

Gotchas

• Completing the 🚨 task in Things does NOT close the incident — only a successful run of the failing job does. The task is the notification, not the state.
• The ledger only knows about jobs that RAN and failed. A job that never fires leaves no entry — absence of an incident is only good news for jobs you know ran.