Set the chart's placeholder version to 0.10.0

Cosmetic, as in 9669b8f and f46e5f5. `make helm-package` passes --version and --app-version from the tag, so neither field decides anything about what release.yaml publishes. Done anyway because a tree heading for v0.10.0 that still says 0.9.4 tells a reader something false, and the tree is what gets read before the tag exists. appVersion keeps the v, per APPVERSION_PREFIX in .release.conf.
Serve a web UI for the incident queue, built for phones
2026-09-19 17:48:28 +02:00 · 2026-09-19 17:48:21 +02:00 · 2026-09-04 18:08:21 +02:00 · 2026-09-04 18:08:05 +02:00 · 2026-09-02 10:11:13 +02:00 · 2026-09-02 10:04:51 +02:00
65 changed files with 10179 additions and 726 deletions
@@ -0,0 +1,128 @@
+name: CI
+
+# The release workflow gates a tag, which is late: a broken commit sits green until
+# somebody decides to publish. This runs the same checks on the way in.
+#
+# push is scoped to main rather than all branches so that a branch pushed as part of a
+# pull request is not checked twice.
+#
+# No actions/checkout, deliberately -- same as the letsvisit and charts workflows. The
+# runner image is ubuntu:22.04 whose `nodejs` package is Node 12, and actions/checkout@v4
+# is built with ES2022 static initialiser blocks, so it dies with
+# `SyntaxError: Unexpected token '{'` before running. Cloning with git directly avoids JS
+# actions entirely. This repo is public, so the clone needs no credential at all.
+#
+# `${{ }}` values are passed through `env:` and referenced as quoted shell variables: a
+# ref name is attacker-influenced by anyone who can push a branch or open a PR, and
+# expanding one straight into `run:` is a shell-injection vector.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# A rapid series of pushes only needs the last one checked.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REPO_URL: https://git.ryuvia.com/niklas/terdut-server.git
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      # Runs inside the toolchain image rather than installing Go per job. Note this puts
+      # the job on the dind bridge, which cannot reach github.com or get.helm.sh --
+      # proxy.golang.org and git.ryuvia.com are reachable, which is all this job needs.
+      image: golang:1.26.6-bookworm
+      # act_runner destroys a job's own volumes when it finishes, so without these every
+      # run re-downloads the whole module graph. The names must appear in the runner's
+      # container.valid_volumes allowlist (charts/act-runner in the k8s repo); unlisted
+      # volumes are dropped silently, so a workflow that looks correct can still be
+      # running uncached.
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -n "$HEAD_SHA" ]; then
+            # A pull_request ref_name is "<n>/merge", which is not a fetchable branch.
+            git clone "$REPO_URL" .
+            git checkout -q "$HEAD_SHA"
+          else
+            git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+          fi
+
+      # The gate is the Makefile's rather than a second copy of it here, the way riksdata
+      # and rd-web already do it. `make fmt lint test` is exactly what a developer runs, so
+      # a green pipeline and a green working copy mean the same thing by construction
+      # instead of by remembering to update two files together.
+      #
+      # The reasoning that used to live here moved with the targets: why gofmt is checked
+      # at all (import order survives `go vet`, and both repos sat unformatted through a
+      # green run and a release -- 9046f6e), why both of gofmt's failure modes need
+      # handling, and why `test` adds -race when this job does not have to.
+      - name: Format, vet and test
+        run: make fmt lint test
+
+  # Runs on every push and pull request, unlike the image scan, which needs something
+  # published to scan and so lives in release.yaml. Both are needed: govulncheck reads the
+  # source and its module graph, trivy reads the built artifact, and neither sees what the
+  # other does.
+  security:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -n "$HEAD_SHA" ]; then
+            git clone "$REPO_URL" .
+            git checkout -q "$HEAD_SHA"
+          else
+            git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+          fi
+
+      - name: Go vulnerability scan (govulncheck)
+        run: make security-go
+
+      - name: Secret scan (gitleaks)
+        run: make security-secrets
+
+  # Host mode, no `container:`: helm is baked into the runner image, and a container job
+  # could not install it -- get.helm.sh is unreachable from the dind bridge. Same reason
+  # release.yaml's chart job runs on the host.
+  #
+  # The chart had no lint step in any workflow until 2026-09-01: release.yaml packaged and
+  # pushed it without rendering it first, so a template that did not compile would have
+  # been found by Flux rather than here.
+  chart:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -n "$HEAD_SHA" ]; then
+            git clone "$REPO_URL" .
+            git checkout -q "$HEAD_SHA"
+          else
+            git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+          fi
+
+      - name: Lint and render the chart
+        run: make helm-lint
@@ -0,0 +1,223 @@
+name: Release
+
+# Checkout, interpolation and caching conventions match ci.yaml -- see the header there
+# for why there are no JS actions and why every `${{ }}` goes through `env:`.
+#
+# There is no upload-artifact/download-artifact equivalent here (both are JS actions, and
+# this Gitea has no artifact store wired up), so the job that builds the binaries is also
+# the job that publishes them. Nothing is handed between jobs at all.
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+# A tag is not normally re-pushed, so this mostly matters when one is force-moved during
+# a botched release -- the superseded run stops holding runner slots.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REPO_URL: https://git.ryuvia.com/niklas/terdut-server.git
+  API: https://git.ryuvia.com/api/v1/repos/niklas/terdut-server
+  REGISTRY: git.ryuvia.com
+  IMAGE: git.ryuvia.com/niklas/terdut-server
+
+jobs:
+  # Gates every publishing job below. A tag that fails here publishes nothing: the
+  # binaries, the image and the chart are all downstream of it.
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      # Same gate as ci.yaml, and the same one a developer runs. See the Makefile for why
+      # each check is there; restating it here is how the two drift apart.
+      - name: Format, vet and test
+        run: make fmt lint test
+
+  binaries:
+    needs: test
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      # Compiling is the Makefile's; uploading is not. `make binaries` is runnable on a
+      # laptop, while the step below needs a token and the Gitea release API, which is
+      # this workflow's business and nothing a developer wants a target for.
+      - name: Build every target
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: make binaries VERSION="$REF_NAME"
+
+      # Creating the release is made idempotent rather than assumed-new: a re-run of a
+      # failed release must not die on the release that already exists. Assets are
+      # replaced the same way, so a re-run repairs a partial upload.
+      - name: Publish the release
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          auth="Authorization: token $TOKEN"
+
+          body=$(curl -sf -H "$auth" "$API/releases/tags/$REF_NAME" || true)
+          if [ -z "$body" ]; then
+            body=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
+              -d "{\"tag_name\":\"$REF_NAME\",\"name\":\"$REF_NAME\"}" \
+              "$API/releases")
+          fi
+
+          # The release object serialises `id` first, so the first match is the release's
+          # own id and not one of the nested author/asset ids.
+          release_id=$(printf '%s' "$body" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
+          [ -n "$release_id" ] || { echo "::error::could not determine release id"; exit 1; }
+          echo "release id $release_id"
+
+          for f in dist/*; do
+            name=$(basename "$f")
+            # Drop an existing asset of the same name first: Gitea happily stores two
+            # attachments with one name, and the updater matches by name.
+            old=$(curl -sf -H "$auth" "$API/releases/$release_id/assets" \
+                  | tr '}' '\n' | grep "\"name\":\"$name\"" \
+                  | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2 || true)
+            if [ -n "$old" ]; then
+              curl -sf -X DELETE -H "$auth" "$API/releases/$release_id/assets/$old" || true
+            fi
+            echo "uploading $name"
+            curl -sf -X POST -H "$auth" -F "attachment=@$f" \
+              "$API/releases/$release_id/assets?name=$name" > /dev/null
+          done
+
+  # Host mode on purpose (no `container:`): this is the only context with a Docker CLI
+  # pointed at the dind daemon. A `container:` job would sit on the dind bridge with no
+  # docker socket at all.
+  image:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      - name: Log in to the registry
+        env:
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: echo "$TOKEN" | docker login "$REGISTRY" -u niklas --password-stdin
+
+      # buildx setup, the platform list and why there is no QEMU all live on the `push`
+      # target now, so the same command publishes from a laptop and from here.
+      - name: Build and push
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: make push VERSION="$REF_NAME"
+
+  # Also host mode: helm is baked into the runner image, and a `container:` job could not
+  # install it -- get.helm.sh is unreachable from the dind bridge.
+  chart:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      # This job is the only thing that publishes the chart, which is what keeps the
+      # published metadata honest. There used to be a second publisher on every charts/**
+      # push to main, and the two raced for the same chart version with different answers:
+      # this one stamps version and appVersion from the tag, that one took Chart.yaml
+      # verbatim, where appVersion is the hardcoded "latest". Whichever landed first won,
+      # so the metadata of a release depended on which runner was quicker -- chart 0.9.0
+      # went out on 2026-08-08 reading appVersion "latest" that way.
+      #
+      # It could not be fixed by making both agree: the tag is pushed after the branch, so
+      # a workflow triggered by the main push cannot know the version it is about to be
+      # tagged with. One publisher, triggered by the tag.
+      #
+      # The cost is that the chart only ships with an app release. That is no real loss --
+      # `make helm-package` derives the chart version from the tag, so a chart-only change
+      # has no version of its own to be released under anyway. Chart fixes ride the next
+      # tag.
+      - name: Refuse a non-version tag
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -eu
+          if ! echo "$REF_NAME" | grep -qE '^v[0-9]'; then
+            echo "::error::refusing to publish a chart for non-version tag ${REF_NAME}"
+            exit 1
+          fi
+
+      # Render before publishing. Until 2026-09-01 this job packaged and pushed without
+      # linting, so a template that did not compile reached the registry and was found by
+      # Flux instead.
+      - name: Lint and render the chart
+        run: make helm-lint
+
+      # The version and appVersion are no longer sed'd into Chart.yaml before packaging:
+      # `helm package --version --app-version` sets both from the tag without mutating the
+      # tree mid-build, which is what the rest of the release process already assumed
+      # happened. The isolated helm repo list moved onto the targets with them.
+      - name: Package and push
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          echo "$TOKEN" | helm registry login "$REGISTRY" -u niklas --password-stdin
+          make helm-package helm-push VERSION="$REF_NAME"
+
+  # Host mode, like image and chart: this needs a docker daemon to run trivy in, and a
+  # `container:` job would sit on the dind bridge with none.
+  #
+  # It scans the pushed image rather than a locally built one, because trivy cannot read a
+  # local image on this runner -- Talos has no docker socket and the dind sidecar shares no
+  # filesystem with the job -- so it pulls from the registry. That is also why this runs
+  # after `image` rather than gating it: a red scan does not unpublish anything.
+  #
+  # What a red scan means is therefore not "the release failed" but "do not bump the wrapper
+  # chart in Ryuvia/charts to this version". The image and chart are already published by
+  # the time this runs, and deliberately so -- this pipeline does not deploy.
+  #
+  # riksdata and rd-web have had this since they were set up; terdut-server went without any
+  # image scanning until 2026-09-02, so every release before v0.9.4 was published with no
+  # CVE check at all.
+  scan-image:
+    needs: image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+
+      # Credentials are passed even though these packages are anonymously pullable -- that
+      # is a property of the personal namespace this publishes to, not something a release
+      # should depend on staying true.
+      - name: Scan the pushed image (trivy)
+        env:
+          TRIVY_USERNAME: niklas
+          TRIVY_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
+          REF_NAME: ${{ github.ref_name }}
+        run: make security-image VERSION="$REF_NAME"
@@ -1,33 +0,0 @@
-name: Release Helm Chart
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - charts/**
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-
-      - name: Install Helm
-        uses: azure/setup-helm@v4
-
-      - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.6.0
-        env:
-          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
@@ -1,123 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - goos: linux
-            goarch: amd64
-          - goos: linux
-            goarch: arm64
-          - goos: darwin
-            goarch: amd64
-          - goos: darwin
-            goarch: arm64
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Build
-        env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-        run: |
-          go build \
-            -ldflags "-w -s -X main.version=${{ github.ref_name }}" \
-            -o terdut-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }} \
-            ./cmd/terdut
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: terdut-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: terdut-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }}
-
-  docker:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          build-args: VERSION=${{ github.ref_name }}
-          tags: |
-            ghcr.io/yeniklas/terdut-server:latest
-            ghcr.io/yeniklas/terdut-server:${{ github.ref_name }}
-
-  chart:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-
-      - name: Install Helm
-        uses: azure/setup-helm@v4
-
-      - name: Update chart versions
-        run: |
-          VERSION="${{ github.ref_name }}"
-          if [[ "$VERSION" =~ ^v[0-9] ]]; then
-            CHART_VERSION="${VERSION#v}"
-            sed -i "s/^version:.*/version: ${CHART_VERSION}/" charts/terdut-server/Chart.yaml
-            sed -i "s/^appVersion:.*/appVersion: \"${VERSION}\"/" charts/terdut-server/Chart.yaml
-          fi
-
-      - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.6.0
-        with:
-          skip_existing: true
-        env:
-          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-  release:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          merge-multiple: true
-
-      - uses: softprops/action-gh-release@v2
-        with:
-          files: 'terdut-*'
@@ -1,6 +1,11 @@
 # build output
 /terdut
 /terdut-server
+# `make binaries` and `make helm-package` write here
+/dist/
+# isolated helm repo list written by the publishing targets, so the machine-wide
+# one (which has an unreachable entry) cannot abort a release
+/.helm-repos.yaml

 # SQLite database files
 *.db
@@ -0,0 +1,24 @@
+# Read by the `release` skill (~/.claude/skills/release).
+#
+# Only what the Makefile cannot already say. IMAGE, HELM_CHART and HELM_REPO come from
+# `make release-vars`, so they have one definition and cannot drift from what is built.
+#
+# Defaults, set here only where this repo differs:
+#   CHARTS_REPO=$HOME/git/charts   CHARTS_DIR=<image basename>
+#   GITEA_LOGIN=Ryuvia            APPVERSION_PREFIX=
+#   PROSE_LANG=en
+
+# Same as the image basename, so this is only stated to be read rather than derived.
+CHARTS_DIR=terdut-server
+
+# riksdata writes appVersion: "v0.3.1", rd-web writes a bare 0.5.0; this repo writes the
+# v, like riksdata. Nothing reads the field -- .gitea/workflows/release.yaml stamps both
+# version and appVersion from the tag when it publishes -- but people read it, and until
+# 2026-09-01 it said "latest" while the tree headed for a numbered release.
+APPVERSION_PREFIX=v
+
+# English. The Swedish in riksdata and rd-web follows from their subject matter, not from a
+# house style: terdut-server is an on-call tool whose labels, API and data are English, and
+# nothing about it is coupled to Swedish. Code comments and docs here were always English;
+# from 2026-09-01 the release prose is too.
+PROSE_LANG=en
@@ -0,0 +1,43 @@
+## Release
+
+Say **"Release"** (or "Release X.Y.Z") and the `release` skill runs it: commit, push, tag,
+wait for the pipeline, then open the wrapper-chart PR against `Ryuvia/charts`. It stops
+there — merging and the Flux reconcile stay manual, deliberately.
+
+Preconditions and the plan, without side effects:
+
+```sh
+~/.claude/skills/release/scripts/release-preflight          # state + suggested version
+~/.claude/skills/release/scripts/release-preflight vX.Y.Z   # validate that release
+```
+
+Config is `.release.conf` here plus `make release-vars`. The process itself lives in
+`~/.claude/skills/release/`; why it is shaped this way is in README.md §Releasing.
+
+Two things about this repo specifically:
+
+- **The image is scanned after it is published, not before.** `scan-image` runs trivy
+  against the pushed image, because trivy cannot read a locally built one on this runner.
+  A red scan therefore unpublishes nothing — it means: do not bump the wrapper chart in
+  `Ryuvia/charts` to this version. Added 2026-09-02; every release up to and including
+  v0.9.3 was published with no CVE check at all.
+- **The wrapper chart has two `tag:` lines** — the app image and the python backup sidecar —
+  so `chart-bump` needs `--image "$IMAGE"` to know which one moves.
+
+## Checks
+
+`make fmt lint test helm-lint` **is** what the pipeline runs — `ci.yaml` and `release.yaml`
+call these targets rather than restating them, the way riksdata and rd-web do. A green gate
+here and a green pipeline are the same code, not two descriptions of it. `test` adds `-race`,
+which the workflows do not have to ask for since they call the target; see the comment on it
+for why.
+
+`make release` (build + push the multi-arch image, package + push the chart) is what
+`release.yaml` invokes. Do not run it by hand — it refuses `VERSION=dev` for that reason, and
+publishing happens by pushing a tag.
+
+Three scans, and they see different things: `security-go` (govulncheck) reads the source and
+its module graph and reports only vulnerabilities the code can actually reach;
+`security-secrets` (gitleaks) reads the working tree, not the history, so it catches a secret
+on the way in rather than auditing what is already committed; `security-image` (trivy) reads
+the published artifact and therefore only runs on a tag. The first two gate every push.
@@ -1,10 +1,19 @@
-FROM golang:1.25-alpine AS builder
+# --platform=$BUILDPLATFORM pins the builder to the machine doing the building, so a
+# multi-arch build compiles both targets natively instead of running an emulated arm64
+# toolchain under QEMU. Go cross-compiles from TARGETOS/TARGETARCH, which BuildKit fills
+# in per platform. The CI runner has no binfmt registration and no way to get one (the
+# JS action that used to install it cannot run there), so this is not just an
+# optimisation -- it is what makes the arm64 image buildable at all.
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 ARG VERSION=dev
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s -X main.version=${VERSION}" -o /terdut ./cmd/terdut
+ARG TARGETOS
+ARG TARGETARCH
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
+    go build -ldflags="-w -s -X main.version=${VERSION}" -o /terdut ./cmd/terdut

 FROM scratch
 COPY --from=builder /terdut /terdut
@@ -0,0 +1,219 @@
+REGISTRY  := git.ryuvia.com
+# The personal namespace, not ryuvia — deliberately, and for one reason: Gitea
+# scopes package visibility to the owner with no per-package override, so
+# ryuvia/* is private because the org is. Publishing here keeps the image and
+# chart anonymously pullable, so no pull secret is needed in the cluster and
+# Flux needs no registry credentials. Same choice riksdata and rd-web made.
+OWNER     := niklas
+
+IMAGE      := $(REGISTRY)/$(OWNER)/terdut-server
+HELM_CHART := charts/terdut-server
+HELM_REPO  := oci://$(REGISTRY)/$(OWNER)
+
+# go.mod pins an exact patch release so nobody builds the shipped binary with a
+# toolchain carrying known stdlib CVEs. Fedora's Go package overrides the
+# upstream GOTOOLCHAIN default to `local`, which turns that pin into a hard
+# failure on a dev box one patch behind, so restore the upstream default here.
+export GOTOOLCHAIN ?= auto
+
+.PHONY: help
+help: ## Show this help
+	@grep -hE '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | \
+		awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-22s\033[0m %s\n", $$1, $$2}'
+
+## --- checks ---
+#
+# These three mirror .gitea/workflows/ci.yaml step for step, so a green `make fmt
+# lint test` here means the same thing CI means. The one deliberate difference is
+# -race below.
+
+.PHONY: test
+test: ## Run the test suite
+	go test -race ./...
+
+# CI runs a bare `go test ./...`. This is stricter on purpose: the sweeper, the
+# notifier goroutine and the deadman sweep all touch the same single-connection
+# database, and a race there would surface as a flaky production incident rather
+# than a failed build. It passes today; if it ever costs more than it catches,
+# the honest fix is to teach CI -race too, not to quietly drop it here.
+.PHONY: lint
+lint: ## go vet
+	go vet ./...
+
+# Copied from ci.yaml rather than simplified, because both of gofmt's failure
+# modes need handling and they are not alike. A file that is merely misformatted
+# is listed on stdout with exit 0 — so the failure has to be raised by hand. A
+# file that does not parse is the opposite: nothing on stdout and exit 2, which a
+# naive `[ -n "$$out" ]` reads as success. See 9046f6e.
+.PHONY: fmt
+fmt: ## Report unformatted files
+	@if ! unformatted=$$(gofmt -l .); then \
+		echo "gofmt could not parse the tree:"; gofmt -l .; exit 1; \
+	fi; \
+	if [ -n "$$unformatted" ]; then \
+		echo "gofmt needed:"; echo "$$unformatted"; gofmt -d .; exit 1; \
+	fi
+
+.PHONY: helm-lint
+helm-lint: ## Lint and render the chart
+	helm lint $(HELM_CHART) --set image.tag=v0.0.0
+	helm template terdut-server $(HELM_CHART) --namespace terdut-server \
+		--set image.tag=v0.0.0 >/dev/null
+	@# networking.listener defaults to "", which attaches the route to every
+	@# matching listener including plaintext HTTP. Production sets it, so the
+	@# default render proves nothing about the path that actually ships.
+	helm template terdut-server $(HELM_CHART) --namespace terdut-server \
+		--set image.tag=v0.0.0 --set networking.listener=https-terdut >/dev/null
+
+## --- release ---
+
+# The release process (~/.claude/skills/release) reads these rather than restating them.
+# One definition, so the version that gets tagged, the image that gets pushed and the chart
+# the wrapper pins cannot drift apart in a second copy.
+.PHONY: release-vars
+release-vars: ## Print the variables the release process reads
+	@printf 'IMAGE=%s\nHELM_CHART=%s\nHELM_REPO=%s\n' '$(IMAGE)' '$(HELM_CHART)' '$(HELM_REPO)'
+
+# There is deliberately no build/push/helm-package/helm-push/release here, unlike
+# riksdata and rd-web. .gitea/workflows/release.yaml owns publishing for this repo,
+# and it does two things a local make cannot: it builds linux/amd64 and linux/arm64
+# through buildx, and it stamps the chart's version and appVersion from the tag. A
+# `docker build && docker push` target would push a single-architecture image over
+# the multi-arch tag, which is both easy to do by accident and invisible afterwards
+# — the tag would still resolve, just not on arm64. Publishing happens by pushing a
+# tag; nothing else.
+
+## --- publishing ---
+#
+# These exist so .gitea/workflows/release.yaml can call `make release` instead of
+# restating the build in YAML, the way riksdata and rd-web already do. One definition
+# of how this is built and published, runnable locally, reviewable in a diff.
+#
+# VERSION is the git tag, passed in by the workflow. The guard below is why a stray
+# local `make release` cannot publish: dev is not a version anyone releases.
+
+VERSION ?= dev
+
+# Helm requires strict SemVer — strip a leading 'v' if present.
+CHART_VERSION := $(shell echo "$(VERSION)" | sed 's/^v//')
+
+PLATFORMS      ?= linux/amd64,linux/arm64
+BUILDX_BUILDER ?= terdut
+
+TRIVY_VERSION       := 0.73.0
+GOVULNCHECK_VERSION := v1.1.4
+GITLEAKS_VERSION    := v8.30.0
+
+# --pull, not --no-cache: refresh the base image without discarding the layer cache.
+DOCKER_BUILD_FLAGS ?= --pull
+
+# An isolated repo list. The machine-wide one is not this build's business, and one
+# unreachable entry in it aborts otherwise-fine helm commands — there is a dead
+# TrueCharts repo on this host that does exactly that. HELM_REPOSITORY_CACHE is
+# deliberately NOT overridden alongside it: helm writes a refreshed index to the default
+# cache and then looks for it in the overridden one.
+HELM_ISOLATED = HELM_REPOSITORY_CONFIG=$(CURDIR)/.helm-repos.yaml
+
+.PHONY: require-version
+require-version:
+	@test "$(VERSION)" != "dev" || \
+		(echo "VERSION=dev names no release — pass VERSION=vX.Y.Z (the workflow passes the tag)" && exit 1)
+
+.PHONY: build
+build: ## Build the image for this host only, without pushing (local check / CI smoke)
+	docker build $(DOCKER_BUILD_FLAGS) \
+		--build-arg VERSION=$(VERSION) \
+		-t $(IMAGE):$(VERSION) .
+
+# Multi-arch, so unlike riksdata and rd-web this cannot be a separate build then push:
+# buildx cannot load a multi-platform result into the local image store, it can only
+# push it. `build` above stays single-platform and local-only for that reason.
+#
+# No QEMU: the Dockerfile's builder stage runs on $$BUILDPLATFORM and cross-compiles from
+# TARGETARCH, so both platforms build natively. The default "docker" driver cannot build
+# more than one platform at a time; the docker-container driver can.
+.PHONY: push
+push: require-version ## Build and publish the multi-arch image
+	docker buildx create --name $(BUILDX_BUILDER) --use 2>/dev/null || docker buildx use $(BUILDX_BUILDER)
+	docker buildx build \
+		--platform $(PLATFORMS) \
+		--build-arg "VERSION=$(VERSION)" \
+		--tag "$(IMAGE):latest" \
+		--tag "$(IMAGE):$(VERSION)" \
+		--push .
+
+# --version and --app-version come from the tag, so Chart.yaml's own fields decide nothing
+# about what is published. They used to be rewritten in place with sed before packaging;
+# the flags do the same job without mutating the tree mid-build.
+.PHONY: helm-package
+helm-package: require-version ## Package the chart, versioned from the tag
+	$(HELM_ISOLATED) helm package $(HELM_CHART) \
+		--version $(CHART_VERSION) \
+		--app-version $(VERSION) \
+		--destination dist
+
+.PHONY: helm-push
+helm-push: require-version ## Push the packaged chart to the OCI registry
+	$(HELM_ISOLATED) helm push dist/terdut-server-$(CHART_VERSION).tgz $(HELM_REPO)
+
+.PHONY: binaries
+binaries: require-version ## Cross-compile the release binaries into dist/
+	@mkdir -p dist
+	@set -eu; for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do \
+		GOOS="$${target%/*}"; GOARCH="$${target#*/}"; \
+		out="dist/terdut-$(VERSION)-$${GOOS}-$${GOARCH}"; \
+		echo "building $$out"; \
+		GOOS="$$GOOS" GOARCH="$$GOARCH" go build \
+			-ldflags "-w -s -X main.version=$(VERSION)" \
+			-o "$$out" ./cmd/terdut; \
+	done
+
+.PHONY: release
+release: push helm-package helm-push ## Publish image + chart (the workflow's one call)
+
+## --- security ---
+
+# Symbol-level, not dependency-level: govulncheck reports a vulnerability only when the
+# code can actually reach it. As of 2026-09-02 this repo imports three chi advisories and
+# reports none of them, because all three are middleware.RealIP and router.go uses Logger
+# and Recoverer. That is the useful property rather than a loophole -- adding
+# middleware.RealIP would turn this red, which is exactly when someone should look.
+.PHONY: security-go
+security-go: ## Scan Go deps for known CVEs (govulncheck)
+	go run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) ./...
+
+# --no-git scans the working tree rather than the history, so this catches a secret on the
+# way in. It is not a history audit and finding nothing here says nothing about what is
+# already committed. --redact because the finding is printed into a CI log.
+#
+# Note when testing it that gitleaks allowlists well-known example credentials -- the AWS
+# key from their own documentation does not trip it. A private key block does.
+.PHONY: security-secrets
+security-secrets: ## Scan the working tree for committed secrets (gitleaks)
+	go run github.com/zricethezav/gitleaks/v8@$(GITLEAKS_VERSION) detect --no-git \
+		--source . --redact --no-banner --exit-code 1
+
+
+# Scans the pushed image, not a local one: trivy cannot read a locally built image on the
+# runner -- Talos has no docker socket, and the dind sidecar shares no filesystem with the
+# job -- so it pulls from the registry. Same reason riksdata and rd-web scan after pushing.
+#
+# It cannot gate a deploy, because this pipeline does not deploy. A red scan means: do not
+# bump the wrapper chart in Ryuvia/charts to this version.
+#
+# The image is FROM scratch, so there are no OS packages to scan and trivy sees exactly one
+# target -- the Go binary and its module graph. That also makes scanning a single platform
+# sufficient here: linux/amd64 and linux/arm64 are the same modules built for a different
+# GOARCH, so a CVE in one is a CVE in both. On an image with a base layer that would not
+# hold and both platforms would need scanning.
+#
+# This is the last of the three scans and the only one that needs a published artifact;
+# security-go and security-secrets above run on every push.
+.PHONY: security-image
+security-image: require-version ## Scan the pushed image for CVEs (needs VERSION)
+	@# The named volume persists trivy's vulnerability DB between runs; without it every
+	@# scan re-downloads the whole database.
+	docker run --rm -e TRIVY_USERNAME -e TRIVY_PASSWORD \
+		-v trivy-cache:/root/.cache/trivy \
+		docker.io/aquasec/trivy:$(TRIVY_VERSION) image --severity HIGH,CRITICAL \
+		--ignore-unfixed --exit-code 1 $(IMAGE):$(VERSION)
@@ -1,11 +1,13 @@
 # Terminal Duty (terdut-server)

-On-call alert management server for teams using Prometheus Alertmanager.
+Incident management server for teams using Prometheus Alertmanager.

 - Receives Alertmanager webhooks directly — no adapter needed
- Stores and queries alerts (acknowledge, comment)
- On-call schedule management (user-to-day assignments)
- Alert statistics (by status, by hour, by day)
+- Turns alerts into **incidents**, correlated by Alertmanager's own `groupKey`
+- Incident workflow: acknowledge, assign, snooze, note, resolve, with a full timeline
+- On-call schedule management, with new incidents auto-assigned to whoever is on call
+- Alert and incident statistics, including MTTA and MTTR
+- Web UI for phones and desktops, served by the same binary
 - REST API with per-user API key authentication
 - Single binary, SQLite storage — trivial to self-host

@@ -16,7 +18,7 @@ On-call alert management server for teams using Prometheus Alertmanager.
 **Prerequisites:** Go 1.21+

 ```bash
-git clone https://github.com/yeniklas/terdut-server
+git clone https://git.ryuvia.com/niklas/terdut-server
 cd terdut-server
 go run ./cmd/terdut
 ```
@@ -28,10 +30,11 @@ The server starts on `:8080` with a `terdut.db` file in the working directory.
 ```bash
 curl -X POST http://localhost:8080/api/bootstrap \
  -H "Content-Type: application/json" \
-  -d '{"username": "admin", "email": "admin@example.com"}'
+  -d '{"username": "admin", "email": "admin@example.com", "password": "<at least 10 characters>"}'
 ```

-Save the `api_key.key` value from the response — it is shown **once only**.
+Save the `api_key.key` value from the response — it is shown **once only**. The
+`password` is optional and is what signs you in to the [web UI](#web-ui).

 Use it as a bearer token for all subsequent requests:

@@ -40,6 +43,48 @@ export KEY=<your-key>
 curl -H "Authorization: Bearer $KEY" http://localhost:8080/api/users
 ```

+### Web UI
+
+The server serves a web UI at `/`: the incident queue, each incident's alerts
+and timeline with every action (acknowledge, assign, snooze, note, resolve,
+archive), who is on call, the alert feed, and changing your own password. It is
+built for a phone first. On a phone it has a bottom tab bar and a sticky action
+bar, it follows the system's dark mode, and it can be added to the home screen.
+From 900px wide it switches to a sidebar with the queue and the incident side by
+side. Schedule editing, statistics and user management remain in
+[terdut-tui](https://github.com/yeniklas/terdut-tui) for now.
+
+You sign in with a username and password. Users have no password until one is
+set, and a user without one can only use API keys:
+
+```bash
+# an admin sets someone's first password with their API key
+curl -X PUT http://localhost:8080/api/users/2/password \
+  -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
+  -d '{"password": "<at least 10 characters>"}'
+```
+
+After that, users change it themselves under *Account*. Changing your own
+password requires the current one.
+
+How a browser stays signed in:
+
+- A successful login sets an `HttpOnly`, `SameSite=Lax` session cookie. It lasts
+  30 days and slides forward while it is used, so an on-call phone stays signed
+  in.
+- The cookie is marked `Secure` when `TERDUT_PUBLIC_URL` starts with `https://`,
+  so set it to the HTTPS address. TLS terminates at the gateway and the server
+  itself only ever sees plain HTTP.
+- Requests authenticated by the cookie are checked for cross-origin use (Go's
+  `http.CrossOriginProtection`). That is the CSRF guard. Bearer-key clients are
+  not affected.
+- Setting a password signs that user out everywhere else.
+- Ten failed logins for one username within 15 minutes lock that username for
+  the rest of the window.
+
+With `TERDUT_PUBLIC_URL` set, tapping a push notification opens the incident in
+the web UI (`/incidents/{id}`).
+
 ### Docker

 ```bash
@@ -49,6 +94,47 @@ docker run -p 8080:8080 -v $(pwd)/data:/data \
  terdut-server
 ```

+### Kubernetes
+
+A Helm chart is published from this repository as an OCI artifact, versioned in lockstep
+with the app — chart `x.y.z` is always app `vx.y.z`:
+
+```bash
+helm upgrade --install terdut-server oci://git.ryuvia.com/niklas/terdut-server \
+  --version 0.9.2 \
+  --namespace terdut-server --create-namespace \
+  --set networking.hostname=terdut.example.com
+```
+
+The chart expects a [Gateway API](https://gateway-api.sigs.k8s.io/) Gateway named `envoy-main` in
+the `envoy-gateway-system` namespace to already exist — it renders an `HTTPRoute` against it rather
+than an `Ingress`. TLS is terminated at the gateway, so the server itself never sees a certificate.
+
+| Value | Default | Description |
+|---|---|---|
+| `networking.hostname` | `terdut.example.com` | Hostname the `HTTPRoute` serves |
+| `networking.listener` | `""` | Gateway listener (`sectionName`) to bind to. Empty attaches to every matching listener, **including plaintext HTTP** — set it to the HTTPS listener's name to serve TLS only |
+| `networking.servicePort` | `8080` | Port the route forwards to; keep in sync with `service.port` |
+| `bootstrap.enabled` | `true` | Runs a post-install hook that creates the first user and stores its API key in the `<release>-admin-key` Secret. Already-bootstrapped servers are left alone |
+| `backupSidecar.enabled` | `true` | Adds an idle `python` sidecar and the [k8up](https://k8up.io/) annotations that dump the database through it |
+
+The API key travels in an `Authorization: Bearer` header, so set `networking.listener` whenever the
+hostname is reachable outside a trusted network.
+
+#### Backups
+
+The server image is `FROM scratch` — the binary and nothing else — so there is no interpreter to
+run a database dump in, and the database runs in WAL mode, where a file-level copy of the volume is
+not crash-consistent. The chart therefore ships an idle `python:*-alpine` sidecar that shares the
+data volume, and points k8up's `backupcommand` at it with `k8up.io/backupcommand-container`. Without
+that annotation k8up execs into `.spec.containers[0]` and the dump fails.
+
+The dump is buffered and sanity-checked before its first byte reaches stdout, because k8up streams
+stdout straight into Restic: a dump that dies partway is otherwise stored as a silently truncated
+snapshot that k8up still reports as successful.
+
+Set `backupSidecar.enabled=false` if you back the volume up some other way.
+
 ---

 ## Configuration
@@ -57,12 +143,24 @@ docker run -p 8080:8080 -v $(pwd)/data:/data \
 |---|---|---|
 | `TERDUT_ADDR` | `:8080` | TCP address to listen on |
 | `TERDUT_DB_PATH` | `terdut.db` | Path to the SQLite database file |
-| `TERDUT_ARCHIVE_AFTER` | `168h` (7d) | How long a resolved alert stays in the default list before being auto-archived |
+| `TERDUT_ARCHIVE_AFTER` | `168h` (7d) | How long a resolved alert or incident stays in the default list before being auto-archived |
 | `TERDUT_STALE_AFTER` | `6h` | How long a firing alert may go without a refreshing webhook before it is treated as resolved — **must exceed your Alertmanager `repeat_interval`** |
+| `TERDUT_DEADMAN_MATCHERS` | `alertname=Watchdog` | Which alerts are [dead man's switches](#dead-mans-switch). `;` separates matchers, `,` the label conditions within one, `=` is exact equality. Every matcher must name an `alertname` |
+| `TERDUT_DEADMAN_TIMEOUT` | `15m` | How long a heartbeat may go unheard before its switch is declared dead — **must be shorter than the `repeat_interval` of the route carrying it**. `0` disables dead man's switch handling |
+| `TERDUT_DEADMAN_SEVERITY` | `critical` | Severity a dead man's switch incident opens at |
+| `TERDUT_NTFY_URL` | — | ntfy server to publish push notifications to. Empty disables notifications entirely |
+| `TERDUT_NTFY_TOKEN` | — | Bearer token for an access-controlled ntfy |
+| `TERDUT_NTFY_FALLBACK_TOPIC` | — | Topic used when nobody is on call |
+| `TERDUT_PUBLIC_URL` | — | Base URL a phone uses to reach this server: the notification's link into the web UI, its Acknowledge button, and whether the session cookie is `Secure` |
+| `TERDUT_NOTIFY_REPEAT` | `15m` | How long an incident may sit unacknowledged before it is paged again. `0` notifies once and never repeats |

 Durations use Go syntax (`30m`, `12h`, `168h`). An unparseable value falls back to the default.

-In the Helm chart the two sweeper durations are set via `sweeper.staleAfter` and `sweeper.archiveAfter`.
+Note that `TERDUT_STALE_AFTER` and `TERDUT_DEADMAN_TIMEOUT` point in opposite directions. Staleness
+is a generous grace period around a `repeat_interval` you do not control; a dead man's switch is a
+deadline you set deliberately, and the heartbeat's route is configured to beat faster than it.
+
+In the Helm chart the two sweeper durations are set via `sweeper.staleAfter` and `sweeper.archiveAfter`, dead man's switches via the `deadman.*` values, and notifications via the `notify.*` values.

 ---

@@ -83,6 +181,153 @@ route:

 The webhook endpoint requires no authentication.

+If you use the [dead man's switch](#dead-mans-switch) — and the default configuration does — give
+the heartbeat a route of its own, because the deadline is only as tight as the interval feeding it:
+
+```yaml
+route:
+  receiver: terdut
+  repeat_interval: 4h
+  routes:
+    - matchers: [ 'alertname = "Watchdog"' ]
+      receiver: terdut
+      group_wait: 0s
+      group_interval: 1m
+      repeat_interval: 1m
+```
+
+That delivers a heartbeat every **2 minutes**, not every minute. Alertmanager only reconsiders a
+group every `group_interval`, and at exactly one elapsed interval `repeat_interval` has not *quite*
+passed, so the send slips to the next tick — equal values give 2×. Two minutes against the 15 minute
+default is seven heartbeats per window, which is the point; use `group_interval: 30s` if you want
+the numbers to mean what they say.
+
+kube-prometheus-stack users get the `Watchdog` alert (`expr: vector(1)`) for free; it just needs
+routing to terdut rather than to `null`.
+
+---
+
+## Alerts and incidents
+
+There are two objects, and the difference between them is the whole design.
+
+**An alert is Alertmanager's record.** It has two states, `firing` and
+`resolved`, one row per fingerprint, and no human ever writes to it. The API
+exposes alerts read-only.
+
+**An incident is the work item.** It goes `triggered → acknowledged → resolved`,
+carries an assignee, a snooze, notes and a timeline, and is the only thing people
+act on. Many alerts belong to one incident.
+
+### Correlation uses Alertmanager's `groupKey`
+
+Alertmanager has already grouped alerts according to the `group_by` routing tree
+you configured, and it sends the resulting `groupKey` and `groupLabels` on every
+webhook. Incidents adopt that answer rather than re-grouping alerts a second
+time — if you want different correlation, change `group_by` in
+`alertmanager.yml` and terdut follows.
+
+At most one incident is open per `groupKey` at a time. Alerts firing in a group
+that already has an open incident join it. The incident's `severity` is a
+high-water mark — the highest `severity` label any of its alerts has carried — so
+an incident that hit `critical` still reads as critical after the critical alert
+clears.
+
+### An incident opens only on a new occurrence
+
+An incident opens when an alert **transitions into firing**: a fingerprint that
+was never seen, an alert with a newer `startsAt`, or a resolved alert that
+started again. The unchanged firing notifications Alertmanager re-sends every
+`repeat_interval` are none of those, and open nothing.
+
+This is what makes closing an incident by hand mean something. Without the rule,
+`POST /api/incidents/{id}/resolve` would be undone by the next re-send of an
+alert that never stopped firing.
+
+### Leaving the open state
+
+- **Automatically**, once every alert under the incident has stopped firing —
+  whether by a resolved webhook or by the sweeper's
+  [stale-alert expiry](#stale-alert-expiry). The incident gets
+  `"resolution_source": "alerts"`.
+- **By hand**, via `POST /api/incidents/{id}/resolve`
+  (`"resolution_source": "manual"`). This is **terminal**: a later occurrence in
+  that group opens a *new* incident rather than reopening this one. If the alert
+  underneath never stops firing, the incident stays closed — that is what
+  resolving by hand asserts.
+- **On recovery**, for a [dead man's switch](#dead-mans-switch) incident whose
+  heartbeat started arriving again (`"resolution_source": "recovered"`). These
+  incidents have no member alerts, so the automatic cascade above cannot reach
+  them.
+
+To quieten an incident you expect to come back, snooze it instead
+(`POST /api/incidents/{id}/snooze`). A snooze hides the incident from the default
+list without closing it, and expires by simply falling into the past.
+
+### On-call assignment
+
+A new incident is assigned to whoever holds today's schedule entry at the moment
+it opens (`GET /api/schedule/current`). If nobody is scheduled it opens
+unassigned. Reassign with `POST /api/incidents/{id}/assign`.
+
+One person holds a given day, so `POST /api/schedule` refuses a date somebody
+already has: taking a shift off the person expecting to be paged for it should
+not be something a plain call does by accident. Pass `"replace": true` to take
+them anyway. Either way the whole request is one transaction — a week where some
+days are free and some are taken moves as a unit, and a failure leaves the rota
+exactly as it was rather than with a hole in it.
+
+### Push notifications
+
+With `TERDUT_NTFY_URL` set, an incident that opens is pushed to the on-call
+person's phone through [ntfy](https://ntfy.sh). Set each user's topic with
+`PUT /api/users/{id}/notify`; a user with no topic falls back to
+`TERDUT_NTFY_FALLBACK_TOPIC`, as does an incident that opens with nobody on call.
+If neither yields a topic, nothing is queued.
+
+Three things get pushed:
+
+- **triggered** — an incident opened. Priority follows severity (`critical` maps
+  to ntfy's max priority, the one that overrides the phone's quiet settings).
+- **reminder** — the incident is still `triggered` after `TERDUT_NOTIFY_REPEAT`.
+  Repeats until somebody acts. Acknowledging, snoozing, resolving or archiving
+  all stop it — snooze is the mute button.
+- **resolved** — every alert under the incident stopped firing. Only sent to
+  whoever was paged in the first place, and only for the automatic cascade:
+  resolving by hand pushes nothing, since the person who did it already knows.
+
+Notifications carry an **Acknowledge** button that acknowledges the incident
+without opening anything. It POSTs to `/api/notify/ack/{token}`, an
+unauthenticated route authorised by the 256-bit token in its path — minted fresh
+per notification, scoped to one incident and one action, and valid for 24 hours.
+A real API key is never put in a notification, because the message is stored on
+the ntfy server and cached on the device.
+
+The token is **not** consumed by use. Acknowledging is idempotent, so a token
+stays valid for its full 24 hours and a second tap is a no-op that reports the
+incident's current state rather than an error — which is what you want when a
+tap is retried on a flaky mobile connection. What bounds it is scope, not a use
+count: one incident, one action, one day. Expired tokens are purged by the
+sweeper.
+
+Two consequences worth planning for:
+
+- `/api/notify/ack/{token}` **must stay publicly reachable**, or the button will
+  not work when the responder is off your network.
+- Notifications sent to the fallback topic carry **no** Acknowledge button. The
+  topic is shared, and a button on it would let any subscriber acknowledge as
+  somebody else.
+
+Delivery is a queue, not an inline call: the webhook writes a row and a
+background notifier sends it within 30 seconds, retrying with exponential
+backoff up to 8 attempts. Nothing about ingestion blocks on ntfy being reachable.
+
+Every delivery is recorded on the incident's timeline: a `notified` event once
+ntfy accepts the publish, and a `notify_failed` event when a notification
+exhausts its retries. Written from the result rather than at enqueue, so the
+timeline says what actually happened — and a page that never landed is visible
+instead of looking the same as one that did.
+
 ### Stale alert expiry

 A resolved webhook is the only signal that an alert has stopped firing, so a
@@ -99,26 +344,107 @@ than your `repeat_interval` (default 4h), or live alerts will be resolved
 prematurely. Alerts resolved this way are marked `"resolution_source": "expiry"`
 to distinguish them from a real Alertmanager resolve (`"alertmanager"`).

+An expiry cascades: once it leaves an incident with nothing firing under it, the
+incident resolves too, in the same sweep.
+
+### Dead man's switch
+
+Everything above assumes alerts arrive. If Prometheus stops evaluating, or
+Alertmanager cannot reach this server, nothing arrives — and silence looks
+exactly like everything being fine. A dead man's switch inverts the handling for
+one designated alert so that silence is the signal:
+
+- **receiving** it opens no incident, and
+- the **absence** of it does.
+
+kube-prometheus-stack already ships the alert for this. `Watchdog` is
+`expr: vector(1)`, so it fires permanently and is re-sent forever; it is worth
+nothing unless something downstream notices it stop. That is what
+`TERDUT_DEADMAN_MATCHERS` defaults to.
+
+A matcher is a set of exact label conditions, one of which must be the
+`alertname`:
+
+```
+TERDUT_DEADMAN_MATCHERS="alertname=Watchdog,cluster=prod; alertname=EdgeHeartbeat"
+```
+
+**The unit of monitoring is the fingerprint, not the alert name.** Two clusters
+sending the same `Watchdog` are two independent switches, so a healthy one can
+never mask a dead one.
+
+#### The lifecycle
+
+A switch is **dormant** until its first heartbeat arrives. A configured matcher
+that has never been heard from opens nothing, so a fresh deploy or a restored
+database does not page. It also means a matcher that never matches anything is
+silently inert — check the startup log line, which lists the matchers that
+survived parsing.
+
+Once armed, the sweeper declares it **dead** when either the heartbeat has not
+been refreshed within `TERDUT_DEADMAN_TIMEOUT`, or Alertmanager explicitly
+resolved it — the sender saying the heartbeat stopped needs no further waiting.
+That opens an incident at `TERDUT_DEADMAN_SEVERITY`, assigned and paged like any
+other, and marks the heartbeat alert `"resolution_source": "deadman"` so the
+alert list stops claiming a dead switch is firing.
+
+It **recovers** when the heartbeat starts arriving again: the incident resolves
+with `"resolution_source": "recovered"` and the all-clear goes to whoever was
+paged.
+
+Resolving the incident by hand sticks, the same way it does for an alert-backed
+one. While the switch stays silent nothing new opens — so a decommissioned
+source is a one-time page rather than a nag. The switch **re-arms** on the next
+heartbeat: come back and die again, and that is a new incident.
+
+#### Two things to know
+
+`TERDUT_DEADMAN_TIMEOUT` must be **shorter** than the `repeat_interval` of the
+route carrying the heartbeat, which is the exact opposite of
+`TERDUT_STALE_AFTER`. Inheriting a default `repeat_interval` of 4h gives you a
+switch that takes four hours to notice anything, so give the heartbeat
+[its own route](#alertmanager-configuration). Matched alerts are exempt from
+stale-alert expiry — a heartbeat answers to its own timeout and nothing else.
+
+A dead man's switch incident has **no member alerts**:
+`GET /api/incidents/{id}/alerts` returns an empty list. There is no alert
+describing the problem, because the problem is that no alert arrived. What
+happened is on the timeline instead, as a `deadman_silent` event carrying the age
+of the last heartbeat, and the heartbeat's labels are on the incident's
+`group_labels`.
+
 ---

 ## API reference

 ### Authentication

-All endpoints except `/api/bootstrap` and `/api/alertmanager/webhook` require:
+All endpoints except `/api/bootstrap`, `/api/alertmanager/webhook`,
+`/api/notify/ack/{token}`, `/api/login` and `/api/logout` require either an API key:

 ```
 Authorization: Bearer <api-key>
 ```

+or the web UI's session cookie. A request that carries an `Authorization` header
+is judged on that header alone.
+
+| Method | Path | Description |
+|---|---|---|
+| `POST` | `/api/login` | `{"username","password"}` → sets the session cookie, returns `{user, has_password}`. `429` after too many failures |
+| `POST` | `/api/logout` | Ends the session and clears the cookie |
+| `GET` | `/api/me` | The caller: `{user, has_password}` |
+
 ### Users

 | Method | Path | Description |
 |---|---|---|
-| `POST` | `/api/bootstrap` | Create first user + API key (only works on empty DB) |
+| `POST` | `/api/bootstrap` | Create first user + API key `{"username","email","password"?}` (only works on empty DB) |
 | `GET` | `/api/users` | List users |
 | `POST` | `/api/users` | Create user `{"username","email"}` |
 | `DELETE` | `/api/users/{id}` | Delete user (cascades to keys) |
+| `PUT` | `/api/users/{id}/notify` | Set push notification target `{"ntfy_topic"}` — empty string clears it |
+| `PUT` | `/api/users/{id}/password` | Set web UI password `{"password","current_password"}`. `current_password` is required only when changing your own existing password. Ends the user's other sessions |
 | `POST` | `/api/users/{id}/api-keys` | Issue API key `{"name"}` — key shown once |
 | `DELETE` | `/api/users/{id}/api-keys/{keyID}` | Revoke API key |

@@ -128,45 +454,259 @@ Authorization: Bearer <api-key>
 |---|---|---|
 | `POST` | `/api/alertmanager/webhook` | Alertmanager v4 webhook receiver (no auth) |

-### Alerts
+### Notifications

 | Method | Path | Description |
 |---|---|---|
-| `GET` | `/api/alerts` | List alerts. Filters: `?status=firing\|resolved`, `?name=`, `?archived=true`, `?from=YYYY-MM-DD`, `?to=YYYY-MM-DD`, `?limit=` (default 50, max 500) |
+| `POST` | `/api/notify/ack/{token}` | Acknowledge an incident from a push notification's Acknowledge button. No auth: the token in the path is the credential — one incident, one action, 24 hours, idempotent. Must stay publicly reachable |
+
+### Incidents
+
+| Method | Path | Description |
+|---|---|---|
+| `GET` | `/api/incidents` | List incidents. Filters: `?status=triggered\|acknowledged\|resolved`, `?severity=`, `?assigned_to=<user id>`, `?archived=true`, `?snoozed=true`, `?from=YYYY-MM-DD`, `?to=YYYY-MM-DD`, `?sort=severity`, `?limit=` (default 50, max 500) |
+| `GET` | `/api/incidents/{id}` | Get single incident, with its alerts inline |
+| `GET` | `/api/incidents/{id}/alerts` | Alerts under this incident |
+| `GET` | `/api/incidents/{id}/timeline` | Full event history, chronological |
+| `POST` | `/api/incidents/{id}/acknowledge` | Acknowledge (stamps authed user + time) |
+| `DELETE` | `/api/incidents/{id}/acknowledge` | Clear acknowledgement, back to `triggered` |
+| `POST` | `/api/incidents/{id}/resolve` | Close by hand — **terminal**, see above |
+| `POST` | `/api/incidents/{id}/assign` | Reassign `{"user_id"}` |
+| `POST` | `/api/incidents/{id}/snooze` | Hide until `{"until": RFC3339}` or `{"duration": "2h"}` |
+| `DELETE` | `/api/incidents/{id}/snooze` | Un-snooze |
+| `POST` | `/api/incidents/{id}/archive` | Archive (hides from the default list) |
+| `DELETE` | `/api/incidents/{id}/archive` | Un-archive |
+| `POST` | `/api/incidents/{id}/notes` | Add a note `{"content"}` |
+| `DELETE` | `/api/incidents/{id}/notes/{eventID}` | Delete own note |
+
+With no `?status=` filter, `GET /api/incidents` returns **open** incidents only —
+the queue an on-call person wants. Currently snoozed and archived incidents are
+excluded unless asked for. Actions that only make sense on an open incident
+return `409` once it is resolved.
+
+Notes are ordinary timeline events of type `note`; only they are deletable, and
+only by their author. The rest of the timeline is a record of what happened.
+
+#### The incident object
+
+| Field | Type | Notes |
+|---|---|---|
+| `id` | integer | Server-assigned |
+| `group_key` | string | Alertmanager's `groupKey` — opaque, treat as an identifier |
+| `title` | string | Rendered from `groupLabels` |
+| `group_labels` | object | String→string, as sent by Alertmanager |
+| `status` | string | `"triggered"`, `"acknowledged"` or `"resolved"` |
+| `severity` | string | *optional* — high-water mark across the incident's alerts; never lowered |
+| `triggered_at` | timestamp | When the incident opened |
+| `acknowledged_by_id` / `acknowledged_by` / `acknowledged_at` | | *optional* — user id, username, time |
+| `assigned_to_id` / `assigned_to` | | *optional* — user id, username |
+| `snoozed_until` | timestamp | *optional* — a value in the past reads as not snoozed |
+| `resolved_at` | timestamp | *optional* |
+| `resolution_source` | string | *optional* — `"alerts"`, `"manual"` or `"recovered"` |
+| `archived_at` | timestamp | *optional* |
+| `alerts` | array | Only on `GET /api/incidents/{id}` |
+
+Treat `resolution_source` as an open set, as with the alert field of the same
+name: degrade unknown values to "resolved, reason unknown".
+
+#### The timeline event object
+
+| Field | Type | Notes |
+|---|---|---|
+| `id` | integer | |
+| `incident_id` | integer | |
+| `type` | string | See below — treat as an open set |
+| `user_id` / `username` | | *optional* — absent when the server acted rather than a person |
+| `alert_id` | integer | *optional* — the alert an `alert_added` / `alert_resolved` event refers to |
+| `detail` | string | *optional* — the note body, the snooze deadline, etc. |
+| `created_at` | timestamp | |
+
+Types written today: `triggered`, `alert_added`, `alert_resolved`,
+`acknowledged`, `unacknowledged`, `assigned`, `snoozed`, `unsnoozed`, `resolved`,
+`note`, `notified`, `notify_failed`, `deadman_silent`. On an `assigned` event
+`user_id` is the **assignee**, not the actor. New types may be added; render
+unknown ones generically rather than dropping them.
+
+On `notified` and `notify_failed`, `detail` carries the notification kind
+(`triggered` | `reminder` | `resolved`), and on a failure the reason after it.
+`user_id` is who was paged — absent means the page went to the shared fallback
+topic and so belongs to nobody. The topic itself is never written to the
+timeline: it is a shared secret with the ntfy server, and every API key can read
+this.
+
+### Alerts
+
+Alerts are read-only. Everything a person does happens on the incident.
+
+| Method | Path | Description |
+|---|---|---|
+| `GET` | `/api/alerts` | List alerts. Filters: `?status=firing\|resolved`, `?name=`, `?incident_id=`, `?archived=true`, `?from=YYYY-MM-DD`, `?to=YYYY-MM-DD`, `?limit=` (default 50, max 500) |
 | `GET` | `/api/alerts/{id}` | Get single alert |
-| `POST` | `/api/alerts/{id}/acknowledge` | Acknowledge alert (stamps authed user + time) |
-| `DELETE` | `/api/alerts/{id}/acknowledge` | Clear acknowledgement |
-| `POST` | `/api/alerts/{id}/archive` | Archive alert (hides it from the default list) |
-| `DELETE` | `/api/alerts/{id}/archive` | Un-archive alert |
-| `GET` | `/api/alerts/{id}/comments` | List comments (chronological) |
-| `POST` | `/api/alerts/{id}/comments` | Add comment `{"content"}` |
-| `DELETE` | `/api/alerts/{id}/comments/{commentID}` | Delete own comment |

 Archived alerts are hidden from `GET /api/alerts` unless `?archived=true` is
-passed. Resolved alerts carry `resolution_source`: `"alertmanager"` for a real
+passed; alert archiving is automatic housekeeping by the sweeper, not a user
+action. Resolved alerts carry `resolution_source`: `"alertmanager"` for a real
 resolved webhook, `"expiry"` when the sweeper inferred it (see
-[Stale alert expiry](#stale-alert-expiry)).
+[Stale alert expiry](#stale-alert-expiry)), `"deadman"` for a heartbeat declared
+dead (see [Dead man's switch](#dead-mans-switch)).
+
+#### The alert object
+
+Returned by `GET /api/alerts` (as an array) and `GET /api/alerts/{id}`.
+Timestamps are RFC 3339 in UTC. Fields marked *optional* are omitted entirely
+when unset, so clients must treat them as nullable.
+
+| Field | Type | Notes |
+|---|---|---|
+| `id` | integer | Server-assigned; stable for the life of the row |
+| `fingerprint` | string | Alertmanager's fingerprint — the upsert key |
+| `name` | string | From the `alertname` label |
+| `status` | string | `"firing"` or `"resolved"` |
+| `labels` | object | String→string, as sent by Alertmanager |
+| `annotations` | object | String→string, as sent by Alertmanager |
+| `starts_at` | timestamp | When the alert instance began, **per Prometheus** |
+| `ends_at` | timestamp | *optional* — absent while no end is known |
+| `generator_url` | string | Link back to the originating Prometheus |
+| `received_at` | timestamp | When the server last accepted a webhook for this alert — see below |
+| `incident_id` | integer | *optional* — the most recent incident this alert belongs to |
+| `resolution_source` | string | *optional* — `"alertmanager"`, `"expiry"` or `"deadman"` |
+| `archived_at` | timestamp | *optional* — set while archived |
+
+##### `received_at` is a liveness heartbeat
+
+`starts_at` comes from Prometheus and **never changes** for the lifetime of an
+alert instance. It says when the problem began, not whether it is still
+happening — an alert that started twelve days ago looks identical whether
+Alertmanager refreshed it a minute ago or went silent a week ago.
+
+`received_at` is the field that answers "is this still live". It is set to the
+server's clock on **every accepted webhook** for that fingerprint, including the
+unchanged firing notifications Alertmanager re-sends every `repeat_interval`.
+Clients may rely on this:
+
+- **A firing alert whose `received_at` is advancing is still being refreshed.**
+  Stale-dating it against `repeat_interval` is a valid liveness check, and it is
+  what the built-in sweeper does (see
+  [Stale alert expiry](#stale-alert-expiry)).
+- **`received_at` tracks accepted payloads, not delivery attempts.** A retry
+  that describes an older instance than the stored one is discarded, and a
+  discarded payload does not move `received_at`.
+- **It stops advancing once the alert resolves,** because Alertmanager stops
+  re-sending. On an alert resolved by the sweeper
+  (`"resolution_source": "expiry"`) it therefore marks the last time
+  Alertmanager was actually heard from, which is earlier than `ends_at`.
+
+`GET /api/alerts` is ordered by `received_at` descending — most recently
+refreshed first — and the `?from=` / `?to=` filters on both the alert and stats
+endpoints select on `received_at`, not `starts_at`.
+
+##### `resolution_source` says how much to trust `ends_at`
+
+An alert can leave the firing state two ways, and `resolution_source` records
+which happened. Clients may rely on this:
+
+- **Absent while firing.** It is set only on resolve, and a re-fire under the
+  same fingerprint clears it again, so its presence always agrees with
+  `"status": "resolved"`.
+- **`"alertmanager"` — a real resolved webhook arrived.** `ends_at` is the end
+  time Alertmanager reported. It is an observed value and can be displayed as
+  fact.
+- **`"expiry"` — the sweeper inferred the resolve** because Alertmanager stopped
+  refreshing the alert (see [Stale alert expiry](#stale-alert-expiry)). Nothing
+  ever reported an end, so **`ends_at` is approximate**: it is either the stale
+  `endsAt` watermark from the last notification, or — when that notification
+  carried none — the time the sweep ran, which lags the last real contact by up
+  to `TERDUT_STALE_AFTER` plus a sweep interval. Treat it as "no later than",
+  not as when the problem stopped.
+
+  On these alerts `received_at` is the more truthful signal: it marks the last
+  time Alertmanager was actually heard from. Surfacing the distinction is
+  worthwhile, since `"expiry"` can also mean the alert is still firing and the
+  notification path broke.
+
+- **`"deadman"` — a heartbeat was declared dead** (see
+  [Dead man's switch](#dead-mans-switch)). Like `"expiry"`, an inference from
+  silence rather than an observed end, so `ends_at` is approximate — but a much
+  tighter one, bounded by `TERDUT_DEADMAN_TIMEOUT`. It is also the one resolution
+  a re-fire under the same `starts_at` can undo, since the switch coming back is
+  exactly the evidence that the inference was wrong.
+
+Treat the value as an open set and tolerate ones you do not recognise — new
+sources may be added, and unknown values should degrade to "resolved, reason
+unknown" rather than being rejected.

 ### On-call schedule

 | Method | Path | Description |
 |---|---|---|
-| `POST` | `/api/schedule` | Assign user to dates `{"user_id", "dates":["YYYY-MM-DD",...]}` — all-or-nothing |
+| `POST` | `/api/schedule` | Assign user to dates `{"user_id", "dates":["YYYY-MM-DD",...], "replace"}` — all-or-nothing |
 | `GET` | `/api/schedule` | List entries. Filters: `?from=YYYY-MM-DD`, `?to=YYYY-MM-DD` |
 | `GET` | `/api/schedule/current` | Today's on-call user (UTC), 404 if none |
 | `DELETE` | `/api/schedule/{id}` | Remove schedule entry |

 ### Statistics

-All stat endpoints accept optional `?from=YYYY-MM-DD` and `?to=YYYY-MM-DD` to filter by `received_at`. Archived alerts are excluded, matching the default alert list.
+All stat endpoints accept optional `?from=YYYY-MM-DD` and `?to=YYYY-MM-DD`, and exclude archived rows to match the default list views. Alert stats filter on `received_at`; incident stats filter on `triggered_at`.

 | Method | Path | Description |
 |---|---|---|
+| `GET` | `/api/stats/incidents` | `{total, triggered, acknowledged, resolved, mtta_seconds, mttr_seconds}` |
 | `GET` | `/api/stats/alerts` | `{total, firing, resolved}` counts |
 | `GET` | `/api/stats/alerts/top` | Most frequent alert names. `?limit=` (default 10, max 100) |
 | `GET` | `/api/stats/alerts/by-hour` | Count per hour-of-day (UTC), all 24 slots returned |
 | `GET` | `/api/stats/alerts/by-day` | Count per day-of-week, all 7 slots with names returned |

+`mtta_seconds` (time to acknowledge) and `mttr_seconds` (time to resolve) are
+averages over incidents that have actually been acknowledged or resolved, and are
+**null** until there are any — null means "no data", not zero.
+
+---
+
+## Upgrading to incidents
+
+The incidents release moves the workflow off alerts, which is a **breaking API
+change**. These endpoints are gone:
+
+| Removed | Replacement |
+|---|---|
+| `POST`/`DELETE` `/api/alerts/{id}/acknowledge` | `POST`/`DELETE` `/api/incidents/{id}/acknowledge` |
+| `POST`/`DELETE` `/api/alerts/{id}/archive` | `POST`/`DELETE` `/api/incidents/{id}/archive` (alert archiving is now sweeper-only) |
+| `GET`/`POST` `/api/alerts/{id}/comments` | `GET /api/incidents/{id}/timeline`, `POST /api/incidents/{id}/notes` |
+| `DELETE /api/alerts/{id}/comments/{commentID}` | `DELETE /api/incidents/{id}/notes/{eventID}` |
+
+The alert object also drops `acknowledged_by_id`, `acknowledged_by` and
+`acknowledged_at`, and gains `incident_id`.
+
+Migration `008_incidents.sql` runs automatically on start and preserves existing
+data: every alert gets a backfilled incident carrying its acknowledgement, and
+comments become timeline notes. Backfilled incidents have a `group_key` of
+`backfill:<fingerprint>` — there is no historical `groupKey` to correlate on, so
+they are one-per-alert rather than grouped.
+
+Nothing about the two documented alert contracts changes: `received_at` is still
+advanced on every accepted webhook, and `resolution_source` still means what it
+did.
+
+## Upgrading to dead man's switches
+
+Dead man's switch handling is **on by default**, watching `alertname=Watchdog`
+with a 15 minute timeout. If you already route `Watchdog` to this server, the
+behaviour of that alert changes on upgrade, in both directions:
+
+- it stops opening incidents when it arrives, and
+- it starts opening one when it stops arriving.
+
+**Check your `repeat_interval` before upgrading.** The switch pages whenever a
+heartbeat has not been refreshed within `TERDUT_DEADMAN_TIMEOUT`, so a `Watchdog`
+route inheriting a 4h or 12h `repeat_interval` will page constantly against the
+15 minute default. Either give the heartbeat
+[its own fast route](#alertmanager-configuration) — the point of the feature — or
+set `TERDUT_DEADMAN_TIMEOUT` above your current `repeat_interval` until you have.
+`TERDUT_DEADMAN_TIMEOUT=0` turns the whole thing off.
+
+There is no migration and no schema change. An existing open incident from a
+`Watchdog` that arrived under the old behaviour is unaffected; resolve it by hand.
+
 ---

 ## Development
@@ -176,3 +716,68 @@ go test ./...        # run all tests
 go build ./...       # compile all packages
 go run ./cmd/terdut  # run locally
 ```
+
+`make fmt lint test helm-lint` is the gate. It mirrors `.gitea/workflows/ci.yaml` step for
+step, so a green run here means a green pipeline — with one deliberate exception: `make test`
+adds `-race`, which CI does not. The sweeper, the notifier goroutine and the dead man's switch
+sweep all touch the same single database connection, and a race between them would surface as
+a flaky incident in production rather than as a red build.
+
+The web UI lives in `internal/web/static/` as plain HTML, CSS and ES modules,
+embedded into the binary with `go:embed`. It has no build step and no npm, so
+editing a file and restarting the server is the whole loop.
+
+## Releasing
+
+```
+push or PR         → ci.yaml       gofmt, go vet, go test -race
+                                   govulncheck, gitleaks
+                                   helm lint + render
+push tag vX.Y.Z    → release.yaml  the same gate, then publish:
+                                     git.ryuvia.com/niklas/terdut-server:vX.Y.Z
+                                     oci://git.ryuvia.com/niklas/terdut-server  X.Y.Z
+                                   then trivy-scan the pushed image
+PR to Ryuvia/charts →              bump the wrapper chart to X.Y.Z; on merge
+                                   Flux reconciles and the release rolls out
+```
+
+Both artifacts go to the **personal** Gitea namespace rather than `ryuvia`, because Gitea
+scopes package visibility to the owner with no per-package override — so `ryuvia/*` is private
+because the org is. Publishing to `niklas` keeps them anonymously pullable, which is why no
+pull secret is needed in the cluster. Same reasoning, and the same choice, as riksdata and
+rd-web.
+
+Saying **"Release"** runs all three rows: the `release` skill commits, pushes, tags, waits for
+the pipeline, and opens the `Ryuvia/charts` PR, stopping before the merge. See
+`~/.claude/skills/release/`, or `.release.conf` here for this repo's part of it.
+
+The chart is published **only** from the tag, by the `chart` job. There used to be a second
+publisher on every `charts/**` push to main, and the two raced for the same chart version with
+different answers — chart 0.9.0 went out reading `appVersion: "latest"` that way. One
+publisher, triggered by the tag (`766f439`). The cost is that a chart-only change has no
+version of its own and rides the next app tag.
+
+Both workflows are thin drivers over the Makefile: `ci.yaml` runs `make fmt lint test` and
+`make helm-lint`, `release.yaml` adds `make binaries`, `make push`, `make helm-package` and
+`make helm-push`. That is deliberate — it is what makes a green local gate and a green
+pipeline the same code rather than two descriptions of it, and it is how riksdata and rd-web
+have always worked.
+
+`make push` builds and pushes in one step, unlike those two, because the image is
+`linux/amd64,linux/arm64` and buildx cannot load a multi-platform result into the local image
+store. `make build` stays single-platform and local-only. Both refuse `VERSION=dev`:
+publishing is one command, so it is also one command to run by accident. Publishing happens
+by pushing a tag.
+
+Two things the release process needs to know about this repo:
+
+- **The image scan runs after publishing**, like riksdata's and rd-web's: trivy cannot read
+  a locally built image on this runner, so it pulls the pushed one. A red `scan-image` means
+  do not bump the wrapper chart to that version — it cannot unpublish anything. The image is
+  `FROM scratch`, so trivy sees exactly one target, the Go binary and its module graph.
+- **The wrapper chart's `values.yaml` has two `tag:` lines** — the app image and the python
+  backup sidecar — so `chart-bump` is given `--image` to say which one moves.
+
+The wrapper chart must have **its own `version:` bumped in the same commit**. Flux reconciles
+with `reconcileStrategy: ChartVersion`, so a chart whose version did not change produces no
+new artifact and the change is never deployed — with no error anywhere.
@@ -2,5 +2,18 @@ apiVersion: v2
 name: terdut-server
 description: A Helm chart for Terminal Duty — on-call alert management server
 type: application
-version: 0.2.0
-appVersion: "latest"
+# These two are placeholders for a local `helm install ./charts/terdut-server`, not the
+# released values. .gitea/workflows/release.yaml rewrites both from the git tag when it
+# publishes, so the chart version always equals the app version.
+#
+# They are kept in step with the tag anyway. Being read is the only thing these two lines
+# do -- `helm package --version --app-version` sets the published values from the tag and
+# never consults these -- and a tree heading for a numbered release that states an older
+# number tells its reader something false. They said 0.9.0 and "latest" until 2026-09-01,
+# through two releases.
+#
+# appVersion and image.tag in values.yaml no longer agree, and that is not an oversight:
+# image.tag stays "latest", which is what a local install actually pulls. appVersion is
+# metadata and drives nothing.
+version: 0.10.0
+appVersion: "v0.10.0"
@@ -23,13 +23,23 @@ spec:
      serviceAccountName: {{ include "terdut-server.fullname" . }}-bootstrap
      containers:
        - name: bootstrap
-          image: alpine:3
+          # alpine/curl, not alpine:3 + `apk add curl`. Installing the binary at run time
+          # writes it into the container's writable upper layer, which is exactly the
+          # signature Falco's `Drop and execute new binary in container` (MITRE TA0003)
+          # exists to catch -- this hook emitted two Critical events on every single
+          # upgrade. See Ryuvia/charts#100. It also made `helm upgrade` depend on the
+          # Alpine CDN answering, since this runs as a post-upgrade hook and a failed
+          # hook fails the release.
+          #
+          # Still a full Alpine underneath, so sh, cat, sleep, grep, cut, head and tail
+          # are all present (verified in-cluster 2026-09-04). The image declares
+          # ENTRYPOINT ["/entrypoint.sh"], which `command:` below overrides -- do not
+          # change `command:` to `args:`.
+          image: alpine/curl:8.21.0@sha256:a1c44bab54d88e18ea9a6a4ecefab7f2d230b968567b78960fcaff8d51b7f067
          command:
            - /bin/sh
            - -c
            - |
-              apk add --no-cache curl > /dev/null 2>&1
-
              SERVICE_URL="http://{{ include "terdut-server.fullname" . }}:{{ .Values.service.port }}"
              SECRET_NAME="{{ include "terdut-server.bootstrapSecretName" . }}"
              K8S_API="https://kubernetes.default.svc"
@@ -10,10 +10,50 @@ spec:
  selector:
    matchLabels:
      {{- include "terdut-server.selectorLabels" . | nindent 6 }}
+  # The data PVC is ReadWriteOnce, so a RollingUpdate deadlocks: the new pod
+  # cannot attach the volume until the old one releases it, and the old one is
+  # not torn down until the new one is ready.
+  strategy:
+    type: Recreate
  template:
    metadata:
      labels:
        {{- include "terdut-server.selectorLabels" . | nindent 8 }}
+      {{- if .Values.backupSidecar.enabled }}
+      annotations:
+        # Dumps the whole database: incidents, alerts, users, API key hashes,
+        # the schedule and the notification outbox.
+        #
+        # Runs in the `backup` sidecar, NOT in the app container: the server
+        # image is FROM scratch and has no interpreter at all. k8up execs into
+        # .spec.containers[0] unless told otherwise, hence the explicit
+        # k8up.io/backupcommand-container.
+        #
+        # Buffered and sanity-checked before the first byte reaches stdout: k8up
+        # streams stdout straight into restic, so a dump that dies partway is
+        # stored as a silently-truncated snapshot that k8up still reports as
+        # Succeeded. The check counts users rather than incidents -- incidents
+        # are swept and archived, so an empty incidents table is a legitimate
+        # state, whereas a database with no users never is.
+        #
+        # The connection is read-only but the mount is not: the database runs in
+        # WAL mode, and opening it mode=ro still needs write access to the -shm
+        # wal-index.
+        #
+        # chr(10), not '\n': k8up parses this annotation with go-shellquote.
+        k8up.io/backupcommand-container: backup
+        k8up.io/backupcommand: >-
+          python3 -c "import sqlite3, sys;
+          con = sqlite3.connect('file:/data/terdut.db?mode=ro', uri=True);
+          con.execute('BEGIN');
+          users = con.execute('SELECT count(*) FROM users').fetchone()[0];
+          out = chr(10).join(con.iterdump()) + chr(10);
+          (users > 0 and out.rstrip().endswith('COMMIT;'))
+          or sys.exit('terdut: db dump failed sanity checks');
+          sys.stdout.write(out)"
+        k8up.io/file-extension: ".sql"
+        k8up.io/backup: "true"
+      {{- end }}
    spec:
      enableServiceLinks: false
      containers:
@@ -33,6 +73,29 @@ spec:
              value: "{{ .Values.sweeper.staleAfter }}"
            - name: TERDUT_ARCHIVE_AFTER
              value: "{{ .Values.sweeper.archiveAfter }}"
+            - name: TERDUT_DEADMAN_MATCHERS
+              value: "{{ .Values.deadman.matchers }}"
+            - name: TERDUT_DEADMAN_TIMEOUT
+              value: "{{ .Values.deadman.timeout }}"
+            - name: TERDUT_DEADMAN_SEVERITY
+              value: "{{ .Values.deadman.severity }}"
+            {{- if .Values.notify.ntfyUrl }}
+            - name: TERDUT_NTFY_URL
+              value: "{{ .Values.notify.ntfyUrl }}"
+            - name: TERDUT_NTFY_FALLBACK_TOPIC
+              value: "{{ .Values.notify.fallbackTopic }}"
+            - name: TERDUT_NOTIFY_REPEAT
+              value: "{{ .Values.notify.repeatEvery }}"
+            - name: TERDUT_PUBLIC_URL
+              value: "{{ .Values.notify.publicUrl | default (printf "https://%s" .Values.networking.hostname) }}"
+            {{- if .Values.notify.tokenSecret.name }}
+            - name: TERDUT_NTFY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.notify.tokenSecret.name }}
+                  key: {{ .Values.notify.tokenSecret.key }}
+            {{- end }}
+            {{- end }}
          volumeMounts:
            - name: data
              mountPath: /data
@@ -46,6 +109,25 @@ spec:
              path: /healthz
              port: http
            initialDelaySeconds: 5
+
+        {{- if .Values.backupSidecar.enabled }}
+        # Idle sidecar. It exists only so k8up has a container with a sqlite3
+        # module to exec the backupcommand in. Mounted read-write on purpose:
+        # see the note on the backupcommand annotation above.
+        - name: backup
+          image: "{{ .Values.backupSidecar.image.repository }}:{{ .Values.backupSidecar.image.tag }}"
+          imagePullPolicy: {{ .Values.backupSidecar.image.pullPolicy }}
+          command: ["sleep", "infinity"]
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              memory: "16Mi"
+              cpu: "10m"
+            limits:
+              memory: "64Mi"
+        {{- end }}
      volumes:
        - name: data
          persistentVolumeClaim:
@@ -9,6 +9,9 @@ spec:
  parentRefs:
  - name: envoy-main
    namespace: envoy-gateway-system
+    {{- with .Values.networking.listener }}
+    sectionName: {{ . | quote }}
+    {{- end }}
  rules:
  - backendRefs:
    - name: {{ include "terdut-server.fullname" . }}
@@ -1,9 +1,13 @@
 networking:
  hostname: "terdut.example.com"
  servicePort: 8080
+  # Gateway listener to bind the HTTPRoute to. Empty attaches to every matching
+  # listener, including plaintext HTTP. Set this to the name of the HTTPS
+  # listener to serve the API over TLS only.
+  listener: ""

 image:
-  repository: ghcr.io/yeniklas/terdut-server
+  repository: git.ryuvia.com/niklas/terdut-server
  tag: "latest"
  pullPolicy: IfNotPresent

@@ -22,6 +26,80 @@ sweeper:
  # How long a resolved alert stays in the default list before auto-archiving.
  archiveAfter: 168h

+# Alerts treated as dead man's switches: receiving one opens no incident, and
+# the absence of one does. The Watchdog alert kube-prometheus-stack ships is
+# exactly this — an always-firing alert whose only value is something noticing
+# when it stops.
+deadman:
+  # Which alerts to treat as heartbeats. ";" separates matchers, "," separates
+  # the label conditions within one, "=" is exact equality. Every matcher must
+  # name an alertname:
+  #   alertname=Watchdog,cluster=prod; alertname=EdgeHeartbeat
+  # Each distinct label set is watched independently, so two clusters sending
+  # the same alertname are two switches and a live one cannot mask a dead one.
+  matchers: "alertname=Watchdog"
+  # How long a heartbeat may go unheard before its switch is declared dead.
+  #
+  # This must be SHORTER than the Alertmanager repeat_interval of the route
+  # carrying the heartbeat — the opposite of sweeper.staleAfter. The default
+  # repeat_interval of 4h (12h in many setups) makes for a useless dead man's
+  # switch, so give the heartbeat a route of its own:
+  #
+  #   - matchers: [ 'alertname = "Watchdog"' ]
+  #     receiver: terdut
+  #     group_wait: 0s
+  #     group_interval: 1m
+  #     repeat_interval: 1m
+  #
+  # That delivers every 2m rather than every 1m: a group is only reconsidered
+  # each group_interval, and at exactly one elapsed interval repeat_interval has
+  # not quite passed, so equal values give 2x. Fine against 15m; use
+  # group_interval: 30s if you want a true 1m.
+  #
+  # Set to 0 to disable dead man's switch handling entirely.
+  timeout: 15m
+  # Severity a dead man's switch incident opens at. These incidents have no
+  # member alerts to derive one from, and the heartbeat's own severity label is
+  # meaningless — Watchdog ships as "none". Only "critical" maps to the ntfy
+  # priority that overrides a phone's quiet hours.
+  severity: critical
+
+notify:
+  # ntfy server that push notifications are published to, e.g.
+  # http://ntfy.ntfy.svc.cluster.local. Empty disables notifications entirely.
+  ntfyUrl: ""
+  # Topic used when nobody is on call today. Notifications sent here carry no
+  # Acknowledge button: the topic is shared, so there is no user to attribute an
+  # acknowledgement to. Leave empty to send nothing when the schedule is unset.
+  fallbackTopic: ""
+  # How long an incident may sit unacknowledged before it is paged again.
+  # Set to 0 to notify once and never repeat.
+  repeatEvery: 15m
+  # Base URL a phone uses to reach this server, for the link and the Acknowledge
+  # button inside a notification. Defaults to https://<networking.hostname>.
+  #
+  # The Acknowledge button is a POST to /api/notify/ack/{token} from the
+  # responder's phone, so that path has to stay publicly reachable — it is
+  # authorised by the scoped token in the URL, not by network placement.
+  publicUrl: ""
+  # Optional bearer token for an access-controlled ntfy, read from an existing
+  # Secret. Leave name empty for an open ntfy.
+  tokenSecret:
+    name: ""
+    key: token
+
+# The server image is FROM scratch — just the binary, with no shell, no sqlite3
+# and no python — so a k8up backupcommand cannot run in the app container. This
+# idle sidecar shares the data volume and is selected with
+# k8up.io/backupcommand-container. Only the stdlib sqlite3 module is used, so any
+# python image works.
+backupSidecar:
+  enabled: true
+  image:
+    repository: python
+    tag: "3.13-alpine"
+    pullPolicy: IfNotPresent
+
 bootstrap:
  enabled: true
  username: admin
@@ -8,9 +8,9 @@ import (
 	"syscall"
 	"time"

-	"github.com/yeniklas/terdut-server/internal/api"
-	"github.com/yeniklas/terdut-server/internal/config"
-	"github.com/yeniklas/terdut-server/internal/db"
+	"git.ryuvia.com/niklas/terdut-server/internal/api"
+	"git.ryuvia.com/niklas/terdut-server/internal/config"
+	"git.ryuvia.com/niklas/terdut-server/internal/db"
 )

 var version = "dev"
@@ -28,7 +28,17 @@ func main() {
 		log.Fatalf("migrate: %v", err)
 	}

-	router := api.NewRouter(database)
+	notify := api.NotifyConfig{
+		BaseURL:       cfg.NtfyURL,
+		Token:         cfg.NtfyToken,
+		FallbackTopic: cfg.NtfyFallbackTopic,
+		PublicURL:     cfg.PublicURL,
+		RepeatEvery:   cfg.NotifyRepeat,
+	}
+
+	deadman := api.ParseDeadmanConfig(cfg.DeadmanMatchers, cfg.DeadmanTimeout, cfg.DeadmanSeverity)
+
+	router := api.NewRouter(database, notify, deadman)

 	srv := &http.Server{
 		Addr:         cfg.Addr,
@@ -41,7 +51,8 @@ func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()

-	go api.StartArchiver(ctx, database, cfg.ArchiveAfter, cfg.StaleAfter)
+	go api.StartArchiver(ctx, database, cfg.ArchiveAfter, cfg.StaleAfter, deadman, notify)
+	go api.StartNotifier(ctx, database, notify)

 	go func() {
 		log.Printf("terdut-server %s listening on %s", version, cfg.Addr)
@@ -1,9 +1,10 @@
-module github.com/yeniklas/terdut-server
+module git.ryuvia.com/niklas/terdut-server

-go 1.25.9
+go 1.26.0

 require (
 	github.com/go-chi/chi/v5 v5.2.5
+	golang.org/x/crypto v0.57.0
 	modernc.org/sqlite v1.50.1
 )

@@ -13,7 +14,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
@@ -14,13 +14,15 @@ github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOF
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
 golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
 golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
@@ -1,6 +1,7 @@
 package api

 import (
+	"context"
 	"database/sql"
 	"encoding/json"
 	"log"
@@ -13,12 +14,26 @@ import (
 const (
 	resolutionAlertmanager = "alertmanager"
 	resolutionExpiry       = "expiry"
+
+	// resolutionDeadman marks a heartbeat the dead man's switch sweeper declared
+	// dead. Distinct from expiry because it is load-bearing, not just
+	// descriptive: it is the one resolution the ingest upsert will let a
+	// same-instance re-fire undo, so a switch that comes back can be heard.
+	resolutionDeadman = "deadman"
 )

 // amPayload mirrors the Alertmanager webhook v4 payload.
 type amPayload struct {
 	Version string `json:"version"`
 	Status  string `json:"status"`
+
+	// GroupKey and GroupLabels are how alerts get correlated into incidents.
+	// Alertmanager has already done the grouping work according to the group_by
+	// routing tree the operator configured, so we adopt its answer instead of
+	// inventing a second grouping scheme here.
+	GroupKey    string            `json:"groupKey"`
+	GroupLabels map[string]string `json:"groupLabels"`
+
 	Alerts []amAlert `json:"alerts"`
 }

@@ -32,7 +47,30 @@ type amAlert struct {
 	Fingerprint  string            `json:"fingerprint"`
 }

-func handleAlertmanagerWebhook(db *sql.DB) http.HandlerFunc {
+// ingested records what actually happened to one alert of a payload, which is
+// what decides whether an incident opens.
+type ingested struct {
+	id     int64
+	name   string
+	firing bool
+
+	// newOccurrence marks an alert that transitioned *into* firing: a
+	// fingerprint we had never seen, a newer startsAt, or a resolved alert that
+	// started again. A repeat_interval re-send of an already-firing alert is
+	// none of these, which is what keeps a manually resolved incident closed.
+	newOccurrence bool
+
+	// justResolved marks the firing → resolved edge, worth a timeline entry.
+	justResolved bool
+
+	// deadman marks a heartbeat: an alert whose arrival means everything is
+	// fine. It is stored like any other alert — received_at is the heartbeat —
+	// but it never reaches an incident. Its absence is what opens one, which
+	// sweepDeadman decides later and elsewhere.
+	deadman bool
+}
+
+func handleAlertmanagerWebhook(db *sql.DB, notify NotifyConfig, deadman DeadmanConfig) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		var payload amPayload
 		if err := decodeJSON(r, &payload); err != nil {
@@ -40,12 +78,107 @@ func handleAlertmanagerWebhook(db *sql.DB) http.HandlerFunc {
 			return
 		}

+		// Alertmanager retries anything that is not 2xx, and a retry of a payload
+		// we failed to store is more useful than an error it cannot act on — so
+		// failures are logged, not surfaced.
+		if err := ingest(r.Context(), db, notify, deadman, payload); err != nil {
+			log.Printf("webhook ingest (group %q): %v", payload.GroupKey, err)
+		}
+
+		w.WriteHeader(http.StatusOK)
+	}
+}
+
+// ingest stores a payload's alerts and reconciles the incident for its group.
+// The whole payload is one transaction: an incident that opened but whose alerts
+// failed to link would be a work item nobody could act on.
+func ingest(ctx context.Context, db *sql.DB, notify NotifyConfig, deadman DeadmanConfig, payload amPayload) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	accepted, err := upsertAlerts(ctx, tx, deadman, payload.Alerts)
+	if err != nil {
+		return err
+	}
+
+	// touched collects every incident this payload affected, so severity and the
+	// resolution cascade are recomputed once per incident at the end.
+	touched := map[int64]bool{}
+
+	incidentID, err := incidentForGroup(ctx, tx, notify, payload, accepted)
+	if err != nil {
+		return err
+	}
+	if incidentID != 0 {
+		touched[incidentID] = true
+		for _, a := range accepted {
+			if !a.firing || a.deadman {
+				continue
+			}
+			if err := linkAlert(ctx, tx, incidentID, a.id); err != nil {
+				return err
+			}
+		}
+	}
+
+	for _, a := range accepted {
+		if !a.justResolved || a.deadman {
+			continue
+		}
+		id, err := openIncidentForAlert(ctx, tx, a.id)
+		if err != nil {
+			return err
+		}
+		if id == 0 {
+			continue
+		}
+		touched[id] = true
+		alertID := a.id
+		if err := logEvent(ctx, tx, id, evAlertResolved, nil, &alertID, nil); err != nil {
+			return err
+		}
+	}
+
+	for id := range touched {
+		if err := refreshSeverity(ctx, tx, id); err != nil {
+			return err
+		}
+		if _, err := resolveIfSettled(ctx, tx, id); err != nil {
+			return err
+		}
+	}
+
+	return tx.Commit()
+}
+
+// upsertAlerts stores each alert of a payload and reports what changed. Payloads
+// the ordering guard rejected are left out entirely.
+func upsertAlerts(ctx context.Context, tx *sql.Tx, deadman DeadmanConfig, alerts []amAlert) ([]ingested, error) {
 	now := time.Now().Unix()
-		for _, a := range payload.Alerts {
+	accepted := make([]ingested, 0, len(alerts))
+
+	for _, a := range alerts {
 		name := a.Labels["alertname"]
 		labelsJSON, _ := json.Marshal(a.Labels)
 		annotationsJSON, _ := json.Marshal(a.Annotations)

+		// The stored state has to be read before the upsert overwrites it: it is
+		// the only way to tell a genuine new occurrence from a re-send.
+		var prevStatus string
+		var prevStartsAt int64
+		existed := true
+		switch err := tx.QueryRowContext(ctx,
+			"SELECT status, starts_at FROM alerts WHERE fingerprint = ?", a.Fingerprint,
+		).Scan(&prevStatus, &prevStartsAt); {
+		case err == sql.ErrNoRows:
+			existed = false
+		case err != nil:
+			return nil, err
+		}
+
 		// Zero time ("0001-01-01T00:00:00Z") means "no end known" — that is the
 		// convention of Alertmanager's ingest API. Outgoing notifications
 		// normally carry a real future endsAt instead, which is the watermark
@@ -66,8 +199,16 @@ func handleAlertmanagerWebhook(db *sql.DB) http.HandlerFunc {
 		// older than the stored one. Alertmanager retries failed notifications,
 		// so a stale firing retry can arrive after the resolved one; it carries
 		// the same startsAt, whereas a genuine re-fire carries a newer one.
-			// Within a single instance, resolution is terminal.
-			_, err := db.ExecContext(r.Context(), `
+		// Within a single instance, resolution is terminal — with one exception.
+		//
+		// A resolution this server synthesised for a dead man's switch is not
+		// Alertmanager's word that the instance ended; it is our inference from
+		// silence. The heartbeat that proves us wrong carries the unchanged
+		// startsAt of an alert that never stopped firing, so without the
+		// exemption a switch could go dead exactly once and never be heard from
+		// again. Scoped to 'deadman' so no resolution anybody else wrote can be
+		// undone by a stale retry.
+		if _, err := tx.ExecContext(ctx, `
 			INSERT INTO alerts
 				(fingerprint, name, status, labels, annotations, starts_at, ends_at,
 				 generator_url, received_at, resolution_source)
@@ -79,6 +220,10 @@ func handleAlertmanagerWebhook(db *sql.DB) http.HandlerFunc {
 				starts_at         = excluded.starts_at,
 				ends_at           = excluded.ends_at,
 				generator_url     = excluded.generator_url,
+				-- Load-bearing: advancing received_at on every accepted
+				-- payload, re-sends included, is the documented liveness
+				-- heartbeat clients and the sweeper both read. Removing it
+				-- is a breaking API change — see models.Alert.ReceivedAt.
 				received_at       = excluded.received_at,
 				resolution_source = excluded.resolution_source,
 				-- A re-fire makes the alert current again, so it leaves the archive.
@@ -86,17 +231,167 @@ func handleAlertmanagerWebhook(db *sql.DB) http.HandlerFunc {
 				                        THEN NULL ELSE alerts.archived_at END
 			WHERE excluded.starts_at > alerts.starts_at
 			   OR (excluded.starts_at = alerts.starts_at
-				       AND NOT (alerts.status = 'resolved' AND excluded.status = 'firing'))`,
+			       AND (alerts.resolution_source = '`+resolutionDeadman+`'
+			            OR NOT (alerts.status = 'resolved' AND excluded.status = 'firing')))`,
 			a.Fingerprint, name, a.Status,
 			string(labelsJSON), string(annotationsJSON),
 			a.StartsAt.Unix(), endsAtUnix,
 			a.GeneratorURL, now, resolutionSource,
-			)
+		); err != nil {
+			return nil, err
+		}
+
+		var id int64
+		var curStatus string
+		var curStartsAt int64
+		if err := tx.QueryRowContext(ctx,
+			"SELECT id, status, starts_at FROM alerts WHERE fingerprint = ?", a.Fingerprint,
+		).Scan(&id, &curStatus, &curStartsAt); err != nil {
+			return nil, err
+		}
+
+		// The upsert copies status and starts_at straight from the payload, so a
+		// row that does not match it is one the ordering guard rejected. A
+		// discarded payload describes a past instance and must not touch the
+		// incident state either.
+		if existed && (curStatus != a.Status || curStartsAt != a.StartsAt.Unix()) {
+			continue
+		}
+
+		firing := a.Status == "firing"
+		accepted = append(accepted, ingested{
+			id:            id,
+			name:          name,
+			firing:        firing,
+			newOccurrence: firing && (!existed || a.StartsAt.Unix() > prevStartsAt || prevStatus == "resolved"),
+			justResolved:  !firing && existed && prevStatus == "firing",
+			deadman:       deadman.isDeadman(a.Labels),
+		})
+	}
+
+	return accepted, nil
+}
+
+// incidentForGroup returns the open incident that this payload's firing alerts
+// belong to, opening one if the group has none. It returns 0 when the payload
+// warrants no incident at all.
+//
+// The rule that matters: a group with no open incident gets a new one only if
+// something actually started firing. Without that, a manually resolved incident
+// would reappear on the next repeat_interval re-send of an alert that never
+// stopped, and manual resolution would be meaningless.
+//
+// Heartbeats do not count as anything here. A group of nothing but dead man's
+// switch alerts opens no incident at all, and a mixed group gets an incident for
+// its real alerts only.
+func incidentForGroup(ctx context.Context, tx *sql.Tx, notify NotifyConfig, payload amPayload, accepted []ingested) (int64, error) {
+	var firstName string
+	anyFiring, anyNew := false, false
+	for _, a := range accepted {
+		if a.deadman {
+			continue
+		}
+		if a.firing {
+			if !anyFiring {
+				firstName = a.name
+			}
+			anyFiring = true
+		}
+		if a.newOccurrence {
+			anyNew = true
+		}
+	}
+	if !anyFiring {
+		// A payload of nothing but resolutions never opens an incident.
+		return 0, nil
+	}
+
+	groupKey := payload.GroupKey
+	if groupKey == "" {
+		// Alertmanager always sends groupKey; a sender that does not still gets
+		// one incident per alert name rather than one giant shared incident.
+		groupKey = "groupless:" + firstName
+	}
+
+	var id int64
+	switch err := tx.QueryRowContext(ctx,
+		"SELECT id FROM incidents WHERE group_key = ? AND resolved_at IS NULL", groupKey,
+	).Scan(&id); {
+	case err == nil:
+		return id, nil
+	case err != sql.ErrNoRows:
+		return 0, err
+	}
+
+	if !anyNew {
+		return 0, nil
+	}
+	return openIncident(ctx, tx, notify, groupKey,
+		incidentTitle(payload.GroupLabels, firstName), payload.GroupLabels, nil)
+}
+
+// openIncident creates an incident and assigns it to whoever is on call today,
+// which is the point at which the schedule stops being decorative.
+//
+// The one place an incident is born, for both of the things that can raise one:
+// the webhook, inside its transaction, and the dead man's switch sweeper, inside
+// its own. Hence the querier rather than a *sql.Tx. A nil severity leaves the
+// column for refreshSeverity to fill from the member alerts; the sweeper passes
+// one because its incidents have no members to derive it from.
+func openIncident(ctx context.Context, q querier, notify NotifyConfig, groupKey, title string, groupLabels map[string]string, severity *string) (int64, error) {
+	onCall, err := currentOnCall(ctx, q)
 	if err != nil {
-				log.Printf("upsert alert %s: %v", a.Fingerprint, err)
+		return 0, err
+	}
+
+	labelsJSON, _ := json.Marshal(groupLabels)
+	if groupLabels == nil {
+		labelsJSON = []byte("{}")
+	}
+
+	res, err := q.ExecContext(ctx, `
+		INSERT INTO incidents (group_key, title, group_labels, status, severity, triggered_at, assigned_to)
+		VALUES (?, ?, ?, 'triggered', ?, ?, ?)`,
+		groupKey, title, string(labelsJSON), severity,
+		time.Now().Unix(), onCall)
+	if err != nil {
+		return 0, err
+	}
+	id, err := res.LastInsertId()
+	if err != nil {
+		return 0, err
+	}
+
+	if err := logEvent(ctx, q, id, evTriggered, nil, nil, nil); err != nil {
+		return 0, err
+	}
+	if onCall != nil {
+		// On an "assigned" event user_id is the assignee, not the actor.
+		if err := logEvent(ctx, q, id, evAssigned, onCall, nil, nil); err != nil {
+			return 0, err
 		}
 	}

-		w.WriteHeader(http.StatusOK)
+	// Queue the page, but do not send it here: this runs inside a transaction on
+	// a single-connection pool, so an HTTP call would hold up every other
+	// request. The notifier picks the row up within a tick.
+	if err := enqueueOpened(ctx, q, notify, id, onCall); err != nil {
+		return 0, err
 	}
+	return id, nil
+}
+
+// linkAlert adds an alert to an incident, emitting a timeline entry only the
+// first time. Re-sends of an already-linked alert are silent.
+func linkAlert(ctx context.Context, tx *sql.Tx, incidentID, alertID int64) error {
+	res, err := tx.ExecContext(ctx, `
+		INSERT OR IGNORE INTO incident_alerts (incident_id, alert_id, added_at)
+		VALUES (?, ?, ?)`, incidentID, alertID, time.Now().Unix())
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return nil
+	}
+	return logEvent(ctx, tx, incidentID, evAlertAdded, nil, &alertID, nil)
 }
@@ -10,20 +10,26 @@ import (
 	"strings"
 	"time"

+	"git.ryuvia.com/niklas/terdut-server/internal/models"
 	"github.com/go-chi/chi/v5"
-	"github.com/yeniklas/terdut-server/internal/models"
 )

 // alertSelectFrom is the shared SELECT … FROM … clause used by all alert queries.
-// It LEFT JOINs users so acknowledged_by username is always available.
+// The subquery resolves the alert's most recent incident: membership is kept in
+// incident_alerts rather than as a column here, because one alert row is reused
+// across occurrences and belongs to a different incident each time.
 const alertSelectFrom = `
 	SELECT a.id, a.fingerprint, a.name, a.status,
 	       a.labels, a.annotations,
 	       a.starts_at, a.ends_at, a.generator_url, a.received_at,
-	       a.acknowledged_by, a.acknowledged_at, u.username,
+	       (SELECT ia.incident_id
+	          FROM incident_alerts ia
+	          JOIN incidents i ON i.id = ia.incident_id
+	         WHERE ia.alert_id = a.id
+	         ORDER BY i.triggered_at DESC, i.id DESC
+	         LIMIT 1),
 	       a.resolution_source, a.archived_at
-	FROM   alerts a
-	LEFT   JOIN users u ON u.id = a.acknowledged_by`
+	FROM   alerts a`

 func handleListAlerts(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -45,6 +51,12 @@ func handleListAlerts(db *sql.DB) http.HandlerFunc {
 		} else {
 			where = append(where, "a.archived_at IS NULL")
 		}
+		if incidentID := q.Get("incident_id"); incidentID != "" {
+			if n, err := strconv.ParseInt(incidentID, 10, 64); err == nil {
+				where = append(where, "a.id IN (SELECT alert_id FROM incident_alerts WHERE incident_id = ?)")
+				args = append(args, n)
+			}
+		}

 		if from := q.Get("from"); from != "" {
 			if t, err := time.Parse("2006-01-02", from); err == nil {
@@ -114,55 +126,7 @@ func handleGetAlert(db *sql.DB) http.HandlerFunc {
 	}
 }

-func handleAcknowledge(db *sql.DB) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
-		if err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid alert id"))
-			return
-		}
-		user, _ := userFromContext(r.Context())
-
-		res, err := db.ExecContext(r.Context(),
-			"UPDATE alerts SET acknowledged_by = ?, acknowledged_at = ? WHERE id = ?",
-			user.ID, time.Now().Unix(), id)
-		if err != nil {
-			respond(w, http.StatusInternalServerError, errResp("internal error"))
-			return
-		}
-		if n, _ := res.RowsAffected(); n == 0 {
-			respond(w, http.StatusNotFound, errResp("alert not found"))
-			return
-		}
-
-		a, _ := fetchAlert(r.Context(), db, id)
-		respond(w, http.StatusOK, a)
-	}
-}
-
-func handleUnacknowledge(db *sql.DB) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
-		if err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid alert id"))
-			return
-		}
-
-		res, err := db.ExecContext(r.Context(),
-			"UPDATE alerts SET acknowledged_by = NULL, acknowledged_at = NULL WHERE id = ?", id)
-		if err != nil {
-			respond(w, http.StatusInternalServerError, errResp("internal error"))
-			return
-		}
-		if n, _ := res.RowsAffected(); n == 0 {
-			respond(w, http.StatusNotFound, errResp("alert not found"))
-			return
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}
-}
-
-// fetchAlert loads a single alert by ID using the shared JOIN query.
+// fetchAlert loads a single alert by ID using the shared query.
 func fetchAlert(ctx context.Context, db *sql.DB, id int64) (models.Alert, error) {
 	return scanAlert(db.QueryRowContext(ctx, alertSelectFrom+" WHERE a.id = ?", id))
 }
@@ -176,16 +140,14 @@ func scanAlert(s scanner) (models.Alert, error) {
 	var a models.Alert
 	var labelsJSON, annotationsJSON string
 	var startsAtUnix, receivedAtUnix int64
-	var endsAtUnix, ackAtUnix, archivedAtUnix *int64
-	var ackByID *int64
-	var ackByUser *string
+	var endsAtUnix, archivedAtUnix *int64

 	if err := s.Scan(
 		&a.ID, &a.Fingerprint, &a.Name, &a.Status,
 		&labelsJSON, &annotationsJSON,
 		&startsAtUnix, &endsAtUnix,
 		&a.GeneratorURL, &receivedAtUnix,
-		&ackByID, &ackAtUnix, &ackByUser,
+		&a.IncidentID,
 		&a.ResolutionSource, &archivedAtUnix,
 	); err != nil {
 		return a, err
@@ -195,62 +157,7 @@ func scanAlert(s scanner) (models.Alert, error) {
 	json.Unmarshal([]byte(annotationsJSON), &a.Annotations) //nolint:errcheck
 	a.StartsAt = time.Unix(startsAtUnix, 0).UTC()
 	a.ReceivedAt = time.Unix(receivedAtUnix, 0).UTC()
-	if endsAtUnix != nil {
-		t := time.Unix(*endsAtUnix, 0).UTC()
-		a.EndsAt = &t
-	}
-	if ackByID != nil {
-		t := time.Unix(*ackAtUnix, 0).UTC()
-		a.AcknowledgedByID = ackByID
-		a.AcknowledgedByUser = ackByUser
-		a.AcknowledgedAt = &t
-	}
-	if archivedAtUnix != nil {
-		t := time.Unix(*archivedAtUnix, 0).UTC()
-		a.ArchivedAt = &t
-	}
+	a.EndsAt = unixPtr(endsAtUnix)
+	a.ArchivedAt = unixPtr(archivedAtUnix)
 	return a, nil
 }
-
-func handleArchive(db *sql.DB) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
-		if err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid alert id"))
-			return
-		}
-		res, err := db.ExecContext(r.Context(),
-			"UPDATE alerts SET archived_at = unixepoch() WHERE id = ?", id)
-		if err != nil {
-			respond(w, http.StatusInternalServerError, errResp("internal error"))
-			return
-		}
-		if n, _ := res.RowsAffected(); n == 0 {
-			respond(w, http.StatusNotFound, errResp("alert not found"))
-			return
-		}
-		a, _ := fetchAlert(r.Context(), db, id)
-		respond(w, http.StatusOK, a)
-	}
-}
-
-func handleUnarchive(db *sql.DB) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
-		if err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid alert id"))
-			return
-		}
-		res, err := db.ExecContext(r.Context(),
-			"UPDATE alerts SET archived_at = NULL WHERE id = ?", id)
-		if err != nil {
-			respond(w, http.StatusInternalServerError, errResp("internal error"))
-			return
-		}
-		if n, _ := res.RowsAffected(); n == 0 {
-			respond(w, http.StatusNotFound, errResp("alert not found"))
-			return
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}
-}
@@ -12,8 +12,8 @@ import (
 	"testing"
 	"time"

-	"github.com/yeniklas/terdut-server/internal/api"
-	"github.com/yeniklas/terdut-server/internal/db"
+	"git.ryuvia.com/niklas/terdut-server/internal/api"
+	"git.ryuvia.com/niklas/terdut-server/internal/db"
 )

 // ts wraps httptest.Server with a pre-bootstrapped API key. db is exposed so
@@ -22,10 +22,30 @@ type ts struct {
 	*httptest.Server
 	key     string
 	db      *sql.DB
+	notify  api.NotifyConfig
+	deadman api.DeadmanConfig
 }

-func newTS(t *testing.T) *ts {
+// newTS builds a server over a fresh in-memory database. Notifications are off
+// unless a NotifyConfig is passed, so tests that predate them are unaffected.
+// Dead man's switches are off too — see newDeadmanTS.
+func newTS(t *testing.T, notify ...api.NotifyConfig) *ts {
 	t.Helper()
+	var cfg api.NotifyConfig
+	if len(notify) > 0 {
+		cfg = notify[0]
+	}
+	return newDeadmanTS(t, api.DeadmanConfig{}, cfg)
+}
+
+// newDeadmanTS is newTS with dead man's switch handling configured.
+func newDeadmanTS(t *testing.T, deadman api.DeadmanConfig, notify ...api.NotifyConfig) *ts {
+	t.Helper()
+	var cfg api.NotifyConfig
+	if len(notify) > 0 {
+		cfg = notify[0]
+	}
+
 	database, err := db.Open(":memory:")
 	if err != nil {
 		t.Fatalf("open db: %v", err)
@@ -33,7 +53,7 @@ func newTS(t *testing.T) *ts {
 	if err := db.Migrate(database); err != nil {
 		t.Fatalf("migrate: %v", err)
 	}
-	srv := httptest.NewServer(api.NewRouter(database))
+	srv := httptest.NewServer(api.NewRouter(database, cfg, deadman))
 	t.Cleanup(func() { srv.Close(); database.Close() })

 	body, _ := json.Marshal(map[string]string{"username": "admin", "email": "admin@test.com"})
@@ -49,7 +69,7 @@ func newTS(t *testing.T) *ts {
 	json.NewDecoder(resp.Body).Decode(&result)
 	key := result["api_key"].(map[string]any)["key"].(string)

-	return &ts{Server: srv, key: key, db: database}
+	return &ts{Server: srv, key: key, db: database, notify: cfg, deadman: deadman}
 }

 // exec runs a statement against the test database.
@@ -72,6 +92,29 @@ func (s *ts) alertRow(t *testing.T, fingerprint string) (status string, source *
 	return status, source, archivedAt
 }

+// alertTimes reads the timestamp columns that make up the received_at contract.
+func (s *ts) alertTimes(t *testing.T, fingerprint string) (startsAt, receivedAt int64) {
+	t.Helper()
+	err := s.db.QueryRow(
+		"SELECT starts_at, received_at FROM alerts WHERE fingerprint = ?",
+		fingerprint).Scan(&startsAt, &receivedAt)
+	if err != nil {
+		t.Fatalf("read alert times %s: %v", fingerprint, err)
+	}
+	return startsAt, receivedAt
+}
+
+// alertEndsAt reads the nullable ends_at column of one alert.
+func (s *ts) alertEndsAt(t *testing.T, fingerprint string) *int64 {
+	t.Helper()
+	var endsAt *int64
+	if err := s.db.QueryRow(
+		"SELECT ends_at FROM alerts WHERE fingerprint = ?", fingerprint).Scan(&endsAt); err != nil {
+		t.Fatalf("read ends_at %s: %v", fingerprint, err)
+	}
+	return endsAt
+}
+
 // req sends an authenticated request, optionally with a JSON body.
 func (s *ts) req(t *testing.T, method, path string, body any) *http.Response {
 	t.Helper()
@@ -148,9 +191,22 @@ func TestBootstrap_SecondCallForbidden(t *testing.T) {
 // Alert upsert by fingerprint
 // ---------------------------------------------------------------------------

-func postWebhook(t *testing.T, s *ts, alerts []map[string]any) {
+// postWebhook sends an Alertmanager v4 payload. groupKey is optional: omitting
+// it exercises the fallback for senders that do not group, which is what most of
+// these tests want.
+func postWebhook(t *testing.T, s *ts, alerts []map[string]any, groupKey ...string) {
 	t.Helper()
 	payload := map[string]any{"version": "4", "status": "firing", "alerts": alerts}
+	if len(groupKey) > 0 {
+		payload["groupKey"] = groupKey[0]
+		// Alertmanager groups by alertname by default, so the group labels echo
+		// the first alert's name.
+		if len(alerts) > 0 {
+			if labels, ok := alerts[0]["labels"].(map[string]string); ok {
+				payload["groupLabels"] = map[string]string{"alertname": labels["alertname"]}
+			}
+		}
+	}
 	data, _ := json.Marshal(payload)
 	resp, err := http.Post(s.URL+"/api/alertmanager/webhook", "application/json", bytes.NewReader(data))
 	if err != nil {
@@ -220,84 +276,6 @@ func TestAlertUpsert_DifferentFingerprintsStored(t *testing.T) {
 	}
 }

-// ---------------------------------------------------------------------------
-// Alert acknowledge
-// ---------------------------------------------------------------------------
-
-func TestAcknowledge(t *testing.T) {
-	s := newTS(t)
-	postWebhook(t, s, []map[string]any{{
-		"status": "firing", "labels": map[string]string{"alertname": "X"},
-		"annotations": map[string]string{}, "startsAt": "2026-05-20T10:00:00Z",
-		"endsAt": "0001-01-01T00:00:00Z", "generatorURL": "", "fingerprint": "fp-ack",
-	}})
-
-	resp := s.req(t, http.MethodPost, "/api/alerts/1/acknowledge", nil)
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("acknowledge returned %d", resp.StatusCode)
-	}
-	var alert map[string]any
-	decode(t, resp, &alert)
-	if alert["acknowledged_by"] == nil {
-		t.Error("expected acknowledged_by to be set")
-	}
-
-	// Clear it.
-	resp = s.req(t, http.MethodDelete, "/api/alerts/1/acknowledge", nil)
-	if resp.StatusCode != http.StatusNoContent {
-		t.Errorf("unacknowledge returned %d", resp.StatusCode)
-	}
-
-	resp = s.req(t, http.MethodGet, "/api/alerts/1", nil)
-	var alert2 map[string]any
-	decode(t, resp, &alert2)
-	if alert2["acknowledged_by"] != nil {
-		t.Error("expected acknowledged_by to be cleared")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// Comments — own-only deletion
-// ---------------------------------------------------------------------------
-
-func TestComment_DeleteOwnOnly(t *testing.T) {
-	s := newTS(t)
-	postWebhook(t, s, []map[string]any{{
-		"status": "firing", "labels": map[string]string{"alertname": "Y"},
-		"annotations": map[string]string{}, "startsAt": "2026-05-20T10:00:00Z",
-		"endsAt": "0001-01-01T00:00:00Z", "generatorURL": "", "fingerprint": "fp-comment",
-	}})
-
-	// Create a second user and their own key.
-	s.req(t, http.MethodPost, "/api/users",
-		map[string]string{"username": "alice", "email": "alice@test.com"})
-	keyResp := s.req(t, http.MethodPost, "/api/users/2/api-keys",
-		map[string]string{"name": "alice-key"})
-	var keyData map[string]any
-	decode(t, keyResp, &keyData)
-	aliceKey := keyData["key"].(string)
-
-	// Admin posts a comment.
-	s.req(t, http.MethodPost, "/api/alerts/1/comments",
-		map[string]string{"content": "admin note"})
-
-	// Alice tries to delete admin's comment (should 404).
-	req, _ := http.NewRequest(http.MethodDelete, s.URL+"/api/alerts/1/comments/1", nil)
-	req.Header.Set("Authorization", "Bearer "+aliceKey)
-	resp, _ := http.DefaultClient.Do(req)
-	resp.Body.Close()
-	if resp.StatusCode != http.StatusNotFound {
-		t.Errorf("expected 404 when deleting another user's comment, got %d", resp.StatusCode)
-	}
-
-	// Admin deletes own comment (should 204).
-	resp = s.req(t, http.MethodDelete, "/api/alerts/1/comments/1", nil)
-	resp.Body.Close()
-	if resp.StatusCode != http.StatusNoContent {
-		t.Errorf("expected 204 when deleting own comment, got %d", resp.StatusCode)
-	}
-}
-
 // ---------------------------------------------------------------------------
 // Schedule conflict
 // ---------------------------------------------------------------------------
@@ -344,6 +322,125 @@ func TestSchedule_MultiDateRollbackOnConflict(t *testing.T) {
 	}
 }

+// ---------------------------------------------------------------------------
+// Schedule reassignment
+// ---------------------------------------------------------------------------
+
+// addUser creates a second person to hand a shift to. The bootstrap user is
+// admin, id 1.
+func addUser(t *testing.T, s *ts, username string) {
+	t.Helper()
+	resp := s.req(t, http.MethodPost, "/api/users",
+		map[string]any{"username": username, "email": username + "@test.com"})
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create user returned %d", resp.StatusCode)
+	}
+}
+
+// scheduleHolder reports who is on call for one date, or "" for nobody.
+func scheduleHolder(t *testing.T, s *ts, date string) string {
+	t.Helper()
+	var entries []map[string]any
+	decode(t, s.req(t, http.MethodGet, "/api/schedule?from="+date+"&to="+date, nil), &entries)
+	if len(entries) == 0 {
+		return ""
+	}
+	return entries[0]["username"].(string)
+}
+
+// Taking a day somebody else holds is possible, but only by asking for it.
+func TestSchedule_ReplaceTakesAnAssignedDate(t *testing.T) {
+	s := newTS(t)
+	addUser(t, s, "alex")
+
+	s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": 1, "dates": []string{"2026-06-01"}}).Body.Close()
+
+	resp := s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": 2, "dates": []string{"2026-06-01"}, "replace": true})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("expected replace to succeed, got %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	if got := scheduleHolder(t, s, "2026-06-01"); got != "alex" {
+		t.Errorf("expected alex to hold the day, got %q", got)
+	}
+
+	// One row, not two: two entries for a date would mean two people believing
+	// they are on call for it.
+	var entries []map[string]any
+	decode(t, s.req(t, http.MethodGet, "/api/schedule?from=2026-06-01&to=2026-06-01", nil), &entries)
+	if len(entries) != 1 {
+		t.Errorf("expected exactly one entry for the date, got %d", len(entries))
+	}
+}
+
+// A week where only some days are taken is the case that was impossible before:
+// the free days and the taken ones have to land together.
+func TestSchedule_ReplaceMixedWeek(t *testing.T) {
+	s := newTS(t)
+	addUser(t, s, "alex")
+
+	s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": 1, "dates": []string{"2026-06-02", "2026-06-04"}}).Body.Close()
+
+	week := []string{"2026-06-01", "2026-06-02", "2026-06-03", "2026-06-04", "2026-06-05"}
+	resp := s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": 2, "dates": week, "replace": true})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("expected the mixed week to succeed, got %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	for _, d := range week {
+		if got := scheduleHolder(t, s, d); got != "alex" {
+			t.Errorf("%s: expected alex, got %q", d, got)
+		}
+	}
+}
+
+// Without replace the guard stands: nobody loses a shift by accident.
+func TestSchedule_ReplaceDefaultsOff(t *testing.T) {
+	s := newTS(t)
+	addUser(t, s, "alex")
+
+	s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": 1, "dates": []string{"2026-06-01"}}).Body.Close()
+
+	resp := s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": 2, "dates": []string{"2026-06-01"}})
+	if resp.StatusCode != http.StatusConflict {
+		t.Fatalf("expected 409 without replace, got %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	if got := scheduleHolder(t, s, "2026-06-01"); got != "admin" {
+		t.Errorf("expected the original holder untouched, got %q", got)
+	}
+}
+
+// Replace makes a repeated date idempotent rather than a conflict: the second
+// pass clears what the first wrote and rewrites it. Worth pinning down, because
+// the same input without replace is a 409.
+func TestSchedule_ReplaceCollapsesRepeatedDates(t *testing.T) {
+	s := newTS(t)
+
+	resp := s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": 1, "dates": []string{"2026-06-01", "2026-06-01"}, "replace": true})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("expected a repeated date to be accepted under replace, got %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	var entries []map[string]any
+	decode(t, s.req(t, http.MethodGet, "/api/schedule?from=2026-06-01&to=2026-06-01", nil), &entries)
+	if len(entries) != 1 {
+		t.Errorf("expected one entry for the repeated date, got %d", len(entries))
+	}
+}
+
 // ---------------------------------------------------------------------------
 // Stats
 // ---------------------------------------------------------------------------
@@ -386,35 +483,29 @@ func TestStats_ByHourReturnsTwentyFourSlots(t *testing.T) {
 // Archive
 // ---------------------------------------------------------------------------

-func TestArchive_RoundTrip(t *testing.T) {
+// Alert archiving is sweeper-only housekeeping now — nobody archives an alert by
+// hand — but the list filter it drives is still part of the API.
+func TestArchive_AlertListFilter(t *testing.T) {
 	s := newTS(t)

 	postWebhook(t, s, []map[string]any{{
 		"status": "resolved", "fingerprint": "arch1",
 		"labels":       map[string]string{"alertname": "Archivable"},
 		"annotations":  map[string]string{},
-		"startsAt": "2026-05-20T10:00:00Z", "endsAt": "2026-05-20T11:00:00Z",
+		"startsAt":     "2026-05-20T10:00:00Z",
+		"endsAt":       "2026-05-20T11:00:00Z",
 		"generatorURL": "",
 	}})

-	// 1. Alert appears in default list (not archived).
+	// 1. Alert appears in the default list.
 	var alerts []map[string]any
 	decode(t, s.req(t, http.MethodGet, "/api/alerts", nil), &alerts)
 	if len(alerts) != 1 {
 		t.Fatalf("expected 1 alert in default list, got %d", len(alerts))
 	}
-	id := int(alerts[0]["id"].(float64))

-	// 2. Archive it.
-	resp := s.req(t, http.MethodPost, fmt.Sprintf("/api/alerts/%d/archive", id), nil)
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("archive: expected 200, got %d", resp.StatusCode)
-	}
-	var archived map[string]any
-	decode(t, resp, &archived)
-	if archived["archived_at"] == nil {
-		t.Error("expected archived_at to be set in response")
-	}
+	// 2. Let the sweeper archive it: ends_at is already well past archiveAfter.
+	api.Sweep(context.Background(), s.db, time.Hour, 6*time.Hour, s.deadman, s.notify)

 	// 3. Default list excludes it.
 	decode(t, s.req(t, http.MethodGet, "/api/alerts", nil), &alerts)
@@ -427,19 +518,6 @@ func TestArchive_RoundTrip(t *testing.T) {
 	if len(alerts) != 1 {
 		t.Fatalf("expected 1 archived alert, got %d", len(alerts))
 	}
-
-	// 5. Un-archive.
-	resp = s.req(t, http.MethodDelete, fmt.Sprintf("/api/alerts/%d/archive", id), nil)
-	if resp.StatusCode != http.StatusNoContent {
-		t.Fatalf("unarchive: expected 204, got %d", resp.StatusCode)
-	}
-	resp.Body.Close()
-
-	// 6. Back in default list.
-	decode(t, s.req(t, http.MethodGet, "/api/alerts", nil), &alerts)
-	if len(alerts) != 1 {
-		t.Errorf("expected unarchived alert to reappear, got %d results", len(alerts))
-	}
 }

 // ---------------------------------------------------------------------------
@@ -468,7 +546,7 @@ func postAlert(t *testing.T, s *ts, fingerprint, status, startsAt, endsAt string

 func sweep(t *testing.T, s *ts, staleAfter time.Duration) {
 	t.Helper()
-	api.Sweep(context.Background(), s.db, noArchive, staleAfter)
+	api.Sweep(context.Background(), s.db, noArchive, staleAfter, s.deadman, s.notify)
 }

 // A firing alert Alertmanager stopped refreshing is resolved via the
@@ -626,6 +704,107 @@ func TestWebhook_IgnoresOutOfOrderRetry(t *testing.T) {
 	}
 }

+// An expiry resolve writes ends_at as an upper bound, not an observed end: an
+// Alertmanager watermark already on the row is preserved, and a row that never
+// carried one is stamped at sweep time. Clients are told to read it that way —
+// see "resolution_source says how much to trust ends_at" in the README.
+func TestExpiry_EndsAtIsUpperBound(t *testing.T) {
+	s := newTS(t)
+
+	// No watermark: expires on the received_at heartbeat, so the sweeper has
+	// nothing to go on but its own clock.
+	postAlert(t, s, "ub-none", "firing", time.Now().Add(-24*time.Hour).Format(time.RFC3339), zeroTime)
+	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'ub-none'",
+		time.Now().Add(-10*time.Hour).Unix())
+
+	// Stale watermark: expires on the ends_at branch, and that reported time
+	// must survive the resolve rather than be overwritten with sweep time.
+	watermark := time.Now().Add(-90 * time.Minute).Truncate(time.Second)
+	postAlert(t, s, "ub-mark", "firing",
+		time.Now().Add(-3*time.Hour).Format(time.RFC3339), watermark.Format(time.RFC3339))
+
+	sweep(t, s, 6*time.Hour)
+
+	if _, source, _ := s.alertRow(t, "ub-none"); source == nil || *source != "expiry" {
+		t.Fatalf("expected resolution_source=expiry for heartbeat expiry, got %v", source)
+	}
+	stamped := s.alertEndsAt(t, "ub-none")
+	if stamped == nil {
+		t.Fatal("expected expiry to stamp ends_at when no watermark was known")
+	}
+	if skew := time.Now().Unix() - *stamped; skew < 0 || skew > 5 {
+		t.Errorf("expected stamped ends_at at sweep time, off by %ds", skew)
+	}
+
+	if _, source, _ := s.alertRow(t, "ub-mark"); source == nil || *source != "expiry" {
+		t.Fatalf("expected resolution_source=expiry for watermark expiry, got %v", source)
+	}
+	switch kept := s.alertEndsAt(t, "ub-mark"); {
+	case kept == nil:
+		t.Errorf("expected reported watermark %d preserved, got NULL", watermark.Unix())
+	case *kept != watermark.Unix():
+		t.Errorf("expected reported watermark %d preserved, got %d", watermark.Unix(), *kept)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// received_at heartbeat contract
+//
+// received_at is documented as a public liveness signal, so these lock the
+// behaviour clients are told they may rely on. See "received_at is a liveness
+// heartbeat" in the README and the comment on models.Alert.ReceivedAt.
+// ---------------------------------------------------------------------------
+
+// The heartbeat itself: an unchanged firing notification — what Alertmanager
+// re-sends every repeat_interval — must advance received_at, while leaving
+// starts_at, which identifies the alert instance, untouched.
+func TestWebhook_ResendBumpsReceivedAt(t *testing.T) {
+	s := newTS(t)
+	start := time.Now().Add(-24 * time.Hour).Format(time.RFC3339)
+	postAlert(t, s, "beat1", "firing", start, zeroTime)
+
+	startsBefore, _ := s.alertTimes(t, "beat1")
+
+	// received_at has one-second granularity, so back-date it to make the bump
+	// observable instead of sleeping out a second.
+	aged := time.Now().Add(-2 * time.Hour).Unix()
+	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'beat1'", aged)
+
+	// Identical re-send: same fingerprint, same startsAt, still firing.
+	postAlert(t, s, "beat1", "firing", start, zeroTime)
+
+	startsAfter, receivedAfter := s.alertTimes(t, "beat1")
+	if receivedAfter <= aged {
+		t.Errorf("expected re-send to advance received_at past %d, got %d", aged, receivedAfter)
+	}
+	if skew := time.Now().Unix() - receivedAfter; skew < 0 || skew > 5 {
+		t.Errorf("expected received_at to track the server clock, off by %ds", skew)
+	}
+	if startsAfter != startsBefore {
+		t.Errorf("expected starts_at unchanged by re-send, got %d want %d", startsAfter, startsBefore)
+	}
+}
+
+// received_at tracks accepted payloads, not delivery attempts: a retry
+// describing an already-resolved instance is discarded, so it must not register
+// as a heartbeat and revive the alert's apparent liveness.
+func TestWebhook_DiscardedRetryLeavesReceivedAtAlone(t *testing.T) {
+	s := newTS(t)
+	start := time.Now().Add(-time.Hour).Format(time.RFC3339)
+
+	postAlert(t, s, "beat2", "firing", start, zeroTime)
+	postAlert(t, s, "beat2", "resolved", start, time.Now().Format(time.RFC3339))
+
+	aged := time.Now().Add(-2 * time.Hour).Unix()
+	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'beat2'", aged)
+
+	postAlert(t, s, "beat2", "firing", start, zeroTime) // stale retry, discarded
+
+	if _, receivedAfter := s.alertTimes(t, "beat2"); receivedAfter != aged {
+		t.Errorf("expected discarded retry to leave received_at at %d, got %d", aged, receivedAfter)
+	}
+}
+
 func TestStats_ByDayReturnsSevenSlots(t *testing.T) {
 	s := newTS(t)
 	resp := s.req(t, http.MethodGet, "/api/stats/alerts/by-day", nil)
@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"log"
+	"strings"
 	"time"
 )

@@ -18,27 +19,39 @@ const (

 // StartArchiver runs the alert sweeper until ctx is cancelled, starting with an
 // immediate pass so a restart reconciles state right away.
-func StartArchiver(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Duration) {
+func StartArchiver(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Duration, deadman DeadmanConfig, notify NotifyConfig) {
 	ticker := time.NewTicker(sweepInterval)
 	defer ticker.Stop()

-	Sweep(ctx, db, archiveAfter, staleAfter)
+	Sweep(ctx, db, archiveAfter, staleAfter, deadman, notify)
 	for {
 		select {
 		case <-ticker.C:
-			Sweep(ctx, db, archiveAfter, staleAfter)
+			Sweep(ctx, db, archiveAfter, staleAfter, deadman, notify)
 		case <-ctx.Done():
 			return
 		}
 	}
 }

-// Sweep runs a single pass: expire stale firing alerts, then archive resolved
-// ones. Expiry runs first so an alert can expire and be archived in one pass.
+// Sweep runs a single pass, in dependency order: reconcile the dead man's
+// switches, expire stale firing alerts, close the incidents that leaves with
+// nothing firing, then archive whatever has been settled long enough. Running
+// them in one pass means an alert can go stale and its incident can close and
+// archive without waiting three ticks.
+//
+// The switches go first because they hand expireStale the alerts it must not
+// touch: a heartbeat answers to its own, much tighter, timeout, and the generic
+// staleness rules would otherwise resolve it as 'expiry' long before that.
 // Exported so tests can drive a pass without waiting on the ticker.
-func Sweep(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Duration) {
-	expireStale(ctx, db, staleAfter)
+func Sweep(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Duration, deadman DeadmanConfig, notify NotifyConfig) {
+	heartbeats := sweepDeadman(ctx, db, deadman, notify)
+	expireStale(ctx, db, staleAfter, heartbeats)
+	resolveSettledIncidents(ctx, db)
 	archiveResolved(ctx, db, archiveAfter)
+	archiveResolvedIncidents(ctx, db, archiveAfter)
+	purgeAckTokens(ctx, db)
+	purgeSessions(ctx, db)
 }

 // expireStale resolves firing alerts that Alertmanager has stopped refreshing.
@@ -53,24 +66,140 @@ func Sweep(ctx context.Context, db *sql.DB, archiveAfter, staleAfter time.Durati
 //   - received_at is older than staleAfter. Alertmanager re-sends firing
 //     notifications every repeat_interval, making received_at a liveness
 //     heartbeat — provided staleAfter exceeds that interval.
-func expireStale(ctx context.Context, db *sql.DB, staleAfter time.Duration) {
+//
+// Alerts in skip are left alone: they are dead man's switch heartbeats, whose
+// liveness sweepDeadman has already judged against a timeout of its own.
+//
+// The matching rows are collected before the update rather than updated in bulk,
+// because each one owes its incident a timeline entry.
+func expireStale(ctx context.Context, db *sql.DB, staleAfter time.Duration, skip map[int64]bool) {
 	now := time.Now()
-	res, err := db.ExecContext(ctx, `
+
+	found, err := staleAlertIDs(ctx, db, now, staleAfter)
+	if err != nil {
+		log.Printf("sweeper: find stale: %v", err)
+		return
+	}
+
+	ids := make([]int64, 0, len(found))
+	for _, id := range found {
+		if !skip[id] {
+			ids = append(ids, id)
+		}
+	}
+	if len(ids) == 0 {
+		return
+	}
+
+	args := make([]any, 0, len(ids)+1)
+	args = append(args, resolutionExpiry)
+	for _, id := range ids {
+		args = append(args, id)
+	}
+	if _, err := db.ExecContext(ctx, `
 		UPDATE alerts
 		   SET status            = 'resolved',
 		       resolution_source = ?,
 		       ends_at           = COALESCE(ends_at, unixepoch())
-		 WHERE status = 'firing'
-		   AND archived_at IS NULL
-		   AND ((ends_at IS NOT NULL AND ends_at < ?) OR received_at < ?)`,
-		resolutionExpiry, now.Add(-expiryGrace).Unix(), now.Add(-staleAfter).Unix())
-	if err != nil {
+		 WHERE id IN (`+placeholders(len(ids))+`)`, args...); err != nil {
 		log.Printf("sweeper: expire stale: %v", err)
 		return
 	}
-	if n, _ := res.RowsAffected(); n > 0 {
-		log.Printf("sweeper: expired %d stale firing alert(s)", n)
+	log.Printf("sweeper: expired %d stale firing alert(s)", len(ids))
+
+	for _, id := range ids {
+		incidentID, err := openIncidentForAlert(ctx, db, id)
+		if err != nil {
+			log.Printf("sweeper: incident for alert %d: %v", id, err)
+			continue
 		}
+		if incidentID == 0 {
+			continue
+		}
+		alertID := id
+		if err := logEvent(ctx, db, incidentID, evAlertResolved, nil, &alertID, nil); err != nil {
+			log.Printf("sweeper: log expiry event: %v", err)
+		}
+	}
+}
+
+// staleAlertIDs reads the ids in one go and closes the cursor before the caller
+// writes: the pool is limited to a single connection, so an open read would
+// block the update behind it.
+func staleAlertIDs(ctx context.Context, db *sql.DB, now time.Time, staleAfter time.Duration) ([]int64, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT id FROM alerts
+		 WHERE status = 'firing'
+		   AND archived_at IS NULL
+		   AND ((ends_at IS NOT NULL AND ends_at < ?) OR received_at < ?)`,
+		now.Add(-expiryGrace).Unix(), now.Add(-staleAfter).Unix())
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		ids = append(ids, id)
+	}
+	return ids, rows.Err()
+}
+
+// resolveSettledIncidents closes incidents whose alerts have all stopped firing.
+// This is the cascade from alerts up to the work item, and it is what turns an
+// expiry into a closed incident rather than one that sits open forever.
+func resolveSettledIncidents(ctx context.Context, db *sql.DB) {
+	ids, err := settledIncidentIDs(ctx, db)
+	if err != nil {
+		log.Printf("sweeper: find settled incidents: %v", err)
+		return
+	}
+
+	resolved := 0
+	for _, id := range ids {
+		ok, err := resolveIfSettled(ctx, db, id)
+		if err != nil {
+			log.Printf("sweeper: resolve incident %d: %v", id, err)
+			continue
+		}
+		if ok {
+			resolved++
+		}
+	}
+	if resolved > 0 {
+		log.Printf("sweeper: resolved %d settled incident(s)", resolved)
+	}
+}
+
+func settledIncidentIDs(ctx context.Context, db *sql.DB) ([]int64, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT i.id
+		FROM   incidents i
+		WHERE  i.resolved_at IS NULL
+		  AND  EXISTS (SELECT 1 FROM incident_alerts ia WHERE ia.incident_id = i.id)
+		  AND  NOT EXISTS (SELECT 1
+		                     FROM incident_alerts ia
+		                     JOIN alerts a ON a.id = ia.alert_id
+		                    WHERE ia.incident_id = i.id
+		                      AND a.status = 'firing')`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		ids = append(ids, id)
+	}
+	return ids, rows.Err()
 }

 // archiveResolved hides resolved alerts that have been settled for archiveAfter.
@@ -89,3 +218,25 @@ func archiveResolved(ctx context.Context, db *sql.DB, archiveAfter time.Duration
 		log.Printf("archiver: archived %d resolved alert(s)", n)
 	}
 }
+
+// archiveResolvedIncidents does the same for the work items, on the same clock.
+func archiveResolvedIncidents(ctx context.Context, db *sql.DB, archiveAfter time.Duration) {
+	cutoff := time.Now().Add(-archiveAfter).Unix()
+	res, err := db.ExecContext(ctx,
+		`UPDATE incidents SET archived_at = unixepoch()
+		 WHERE resolved_at IS NOT NULL
+		   AND archived_at IS NULL
+		   AND resolved_at < ?`, cutoff)
+	if err != nil {
+		log.Printf("archiver: incidents: %v", err)
+		return
+	}
+	if n, _ := res.RowsAffected(); n > 0 {
+		log.Printf("archiver: archived %d resolved incident(s)", n)
+	}
+}
+
+// placeholders builds "?, ?, …" for an IN clause of n values.
+func placeholders(n int) string {
+	return strings.TrimSuffix(strings.Repeat("?, ", n), ", ")
+}
@@ -0,0 +1,356 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"log"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"golang.org/x/crypto/bcrypt"
+)
+
+const (
+	// sessionCookie carries a web UI session. It is HttpOnly, so page script
+	// never sees the token; the page learns who it is from GET /api/me.
+	sessionCookie = "terdut_session"
+
+	// sessionTTL is how long a session lives without being used. It slides, so
+	// a phone that opens the UI now and then stays signed in indefinitely.
+	sessionTTL = 30 * 24 * time.Hour
+
+	// sessionTouchEvery bounds how often a request may slide the expiry.
+	sessionTouchEvery = time.Hour
+
+	minPasswordLen = 10
+	// maxPasswordLen is bcrypt's limit; it rejects longer input outright.
+	maxPasswordLen = 72
+
+	loginWindow      = 15 * time.Minute
+	loginMaxPerUser  = 10
+	loginMaxPerAddr  = 30
+	passwordHashCost = bcrypt.DefaultCost
+)
+
+// dummyHash is compared against when the username is unknown or has no
+// password, so a failed login takes as long whichever way it failed.
+var dummyHash = sync.OnceValue(func() []byte {
+	h, _ := bcrypt.GenerateFromPassword([]byte("terdut-dummy-password"), passwordHashCost)
+	return h
+})
+
+// loginLimiter counts failed logins in a fixed window, per username and per
+// client address. The username limit is what stops guessing one account; the
+// address limit is looser because every user behind the same gateway or NAT
+// shares it.
+type loginLimiter struct {
+	mu       sync.Mutex
+	failures map[string]*loginWindowCount
+}
+
+type loginWindowCount struct {
+	start time.Time
+	n     int
+}
+
+func newLoginLimiter() *loginLimiter {
+	return &loginLimiter{failures: map[string]*loginWindowCount{}}
+}
+
+func (l *loginLimiter) blocked(key string, max int) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	c, ok := l.failures[key]
+	if !ok || time.Since(c.start) > loginWindow {
+		return false
+	}
+	return c.n >= max
+}
+
+func (l *loginLimiter) fail(keys ...string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	now := time.Now()
+	for k, c := range l.failures {
+		if now.Sub(c.start) > loginWindow {
+			delete(l.failures, k)
+		}
+	}
+	for _, key := range keys {
+		c, ok := l.failures[key]
+		if !ok {
+			c = &loginWindowCount{start: now}
+			l.failures[key] = c
+		}
+		c.n++
+	}
+}
+
+func (l *loginLimiter) clear(key string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	delete(l.failures, key)
+}
+
+// clientAddr is the address a login is counted against. Behind the gateway
+// RemoteAddr is the gateway itself, so the first X-Forwarded-For hop is used
+// when present. It can be forged, but only to dodge the address limit; the
+// per-username limit does not depend on it.
+func clientAddr(r *http.Request) string {
+	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		first, _, _ := strings.Cut(xff, ",")
+		return strings.TrimSpace(first)
+	}
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return host
+}
+
+// cookieSecure decides the cookie's Secure flag. TLS terminates at the gateway,
+// so the server usually sees plain HTTP; the public URL is what says whether
+// browsers reach it over HTTPS.
+func cookieSecure(publicURL string, r *http.Request) bool {
+	return strings.HasPrefix(publicURL, "https://") ||
+		r.TLS != nil ||
+		r.Header.Get("X-Forwarded-Proto") == "https"
+}
+
+// validatePassword returns a message for the client, or "" when acceptable.
+func validatePassword(pw string) string {
+	switch {
+	case len(pw) < minPasswordLen:
+		return "password must be at least " + strconv.Itoa(minPasswordLen) + " characters"
+	case len(pw) > maxPasswordLen:
+		return "password must be at most " + strconv.Itoa(maxPasswordLen) + " bytes"
+	}
+	return ""
+}
+
+func hashPassword(pw string) (string, error) {
+	h, err := bcrypt.GenerateFromPassword([]byte(pw), passwordHashCost)
+	return string(h), err
+}
+
+// handleLogin exchanges a username and password for a session cookie.
+func handleLogin(db *sql.DB, limiter *loginLimiter, publicURL string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req struct {
+			Username string `json:"username"`
+			Password string `json:"password"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		username := strings.TrimSpace(req.Username)
+		userKey := "user:" + strings.ToLower(username)
+		addrKey := "addr:" + clientAddr(r)
+
+		if limiter.blocked(userKey, loginMaxPerUser) || limiter.blocked(addrKey, loginMaxPerAddr) {
+			w.Header().Set("Retry-After", strconv.Itoa(int(loginWindow.Seconds())))
+			respond(w, http.StatusTooManyRequests, errResp("too many failed attempts, try again later"))
+			return
+		}
+
+		var userID int64
+		var hash sql.NullString
+		err := db.QueryRowContext(r.Context(),
+			"SELECT id, password_hash FROM users WHERE username = ?", username,
+		).Scan(&userID, &hash)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		stored := dummyHash()
+		if hash.Valid {
+			stored = []byte(hash.String)
+		}
+		match := bcrypt.CompareHashAndPassword(stored, []byte(req.Password)) == nil
+		if !match || !hash.Valid {
+			limiter.fail(userKey, addrKey)
+			respond(w, http.StatusUnauthorized, errResp("invalid username or password"))
+			return
+		}
+		limiter.clear(userKey)
+
+		raw, tokenHash, err := randomToken()
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		now := time.Now()
+		if _, err := db.ExecContext(r.Context(), `
+			INSERT INTO sessions (token_hash, user_id, created_at, last_seen_at, expires_at, user_agent)
+			VALUES (?, ?, ?, ?, ?, ?)`,
+			tokenHash, userID, now.Unix(), now.Unix(), now.Add(sessionTTL).Unix(), r.UserAgent()); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		http.SetCookie(w, &http.Cookie{
+			Name:     sessionCookie,
+			Value:    raw,
+			Path:     "/",
+			MaxAge:   int(sessionTTL.Seconds()),
+			HttpOnly: true,
+			Secure:   cookieSecure(publicURL, r),
+			SameSite: http.SameSiteLaxMode,
+		})
+
+		user, err := fetchUser(r.Context(), db, userID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, meResponse{User: user, HasPassword: true})
+	}
+}
+
+// handleLogout ends the browser's session. It sits outside AuthMiddleware so
+// that a browser holding an already-expired cookie can still clear it.
+func handleLogout(db *sql.DB, publicURL string) http.HandlerFunc {
+	crossOrigin := http.NewCrossOriginProtection()
+	return func(w http.ResponseWriter, r *http.Request) {
+		if err := crossOrigin.Check(r); err != nil {
+			respond(w, http.StatusForbidden, errResp("cross-origin request rejected"))
+			return
+		}
+		if c, err := r.Cookie(sessionCookie); err == nil && c.Value != "" {
+			db.ExecContext(r.Context(), "DELETE FROM sessions WHERE token_hash = ?", hashToken(c.Value))
+		}
+		http.SetCookie(w, &http.Cookie{
+			Name:     sessionCookie,
+			Value:    "",
+			Path:     "/",
+			MaxAge:   -1,
+			HttpOnly: true,
+			Secure:   cookieSecure(publicURL, r),
+			SameSite: http.SameSiteLaxMode,
+		})
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+type meResponse struct {
+	User        any  `json:"user"`
+	HasPassword bool `json:"has_password"`
+}
+
+// handleMe says who the caller is. The web UI calls it on load to decide
+// between the login form and the app, since it cannot read its own cookie.
+func handleMe(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		caller, _ := userFromContext(r.Context())
+		user, err := fetchUser(r.Context(), db, caller.ID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		var hash sql.NullString
+		db.QueryRowContext(r.Context(),
+			"SELECT password_hash FROM users WHERE id = ?", caller.ID).Scan(&hash)
+		respond(w, http.StatusOK, meResponse{User: user, HasPassword: hash.Valid})
+	}
+}
+
+// handleSetPassword sets a user's web UI password.
+//
+// Changing your own password takes the current one, when there is one, so an
+// unattended signed-in browser cannot be used to take the account over. Setting
+// somebody else's is how an admin gives a user their first password, and like
+// the other user endpoints it is open to any authenticated caller.
+//
+// Every other session of the target is ended: a password change is what you
+// do when you think someone else is signed in.
+func handleSetPassword(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid user id"))
+			return
+		}
+		var req struct {
+			Password        string `json:"password"`
+			CurrentPassword string `json:"current_password"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		if msg := validatePassword(req.Password); msg != "" {
+			respond(w, http.StatusBadRequest, errResp(msg))
+			return
+		}
+
+		var existing sql.NullString
+		err = db.QueryRowContext(r.Context(),
+			"SELECT password_hash FROM users WHERE id = ?", id).Scan(&existing)
+		if errors.Is(err, sql.ErrNoRows) {
+			respond(w, http.StatusNotFound, errResp("user not found"))
+			return
+		}
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		caller, _ := userFromContext(r.Context())
+		if caller.ID == id && existing.Valid &&
+			bcrypt.CompareHashAndPassword([]byte(existing.String), []byte(req.CurrentPassword)) != nil {
+			respond(w, http.StatusForbidden, errResp("current password is incorrect"))
+			return
+		}
+
+		hash, err := hashPassword(req.Password)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		tx, err := db.BeginTx(r.Context(), nil)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		defer tx.Rollback()
+
+		if _, err := tx.ExecContext(r.Context(),
+			"UPDATE users SET password_hash = ? WHERE id = ?", hash, id); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		keep, _ := sessionFromContext(r.Context()) // zero when changed with an API key
+		if _, err := tx.ExecContext(r.Context(),
+			"DELETE FROM sessions WHERE user_id = ? AND id != ?", id, keep); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if err := tx.Commit(); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// purgeSessions deletes sessions that have expired, from the sweeper.
+func purgeSessions(ctx context.Context, db *sql.DB) {
+	res, err := db.ExecContext(ctx,
+		"DELETE FROM sessions WHERE expires_at < ?", time.Now().Unix())
+	if err != nil {
+		log.Printf("sweeper: purge sessions: %v", err)
+		return
+	}
+	if n, _ := res.RowsAffected(); n > 0 {
+		log.Printf("sweeper: purged %d expired session(s)", n)
+	}
+}
@@ -0,0 +1,360 @@
+package api_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/cookiejar"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/api"
+	"git.ryuvia.com/niklas/terdut-server/internal/db"
+)
+
+const adminPassword = "correct horse battery"
+
+// browser is an HTTP client with its own cookie jar, standing in for one
+// signed-in browser.
+type browser struct {
+	*http.Client
+	base string
+}
+
+func newBrowser(t *testing.T, base string) *browser {
+	t.Helper()
+	jar, _ := cookiejar.New(nil)
+	return &browser{Client: &http.Client{Jar: jar}, base: base}
+}
+
+// do sends a request the way the web UI's own fetch would: same-origin, with
+// the cookie from the jar.
+func (b *browser) do(t *testing.T, method, path string, body any, header ...string) *http.Response {
+	t.Helper()
+	var r io.Reader
+	if body != nil {
+		data, _ := json.Marshal(body)
+		r = bytes.NewReader(data)
+	}
+	req, _ := http.NewRequest(method, b.base+path, r)
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req.Header.Set("Sec-Fetch-Site", "same-origin")
+	for i := 0; i+1 < len(header); i += 2 {
+		req.Header.Set(header[i], header[i+1])
+	}
+	resp, err := b.Do(req)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, path, err)
+	}
+	return resp
+}
+
+func (b *browser) login(t *testing.T, username, password string) *http.Response {
+	t.Helper()
+	return b.do(t, http.MethodPost, "/api/login", map[string]string{"username": username, "password": password})
+}
+
+// setAdminPassword gives the bootstrapped admin a password over its API key.
+func setAdminPassword(t *testing.T, s *ts) {
+	t.Helper()
+	resp := s.req(t, http.MethodPut, "/api/users/1/password", map[string]string{"password": adminPassword})
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("set password: %d", resp.StatusCode)
+	}
+}
+
+func signedIn(t *testing.T, s *ts) *browser {
+	t.Helper()
+	setAdminPassword(t, s)
+	b := newBrowser(t, s.URL)
+	resp := b.login(t, "admin", adminPassword)
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("login: %d", resp.StatusCode)
+	}
+	return b
+}
+
+func status(t *testing.T, resp *http.Response) int {
+	t.Helper()
+	resp.Body.Close()
+	return resp.StatusCode
+}
+
+func TestLogin_SetsSessionCookie(t *testing.T) {
+	s := newTS(t)
+	setAdminPassword(t, s)
+	b := newBrowser(t, s.URL)
+
+	resp := b.login(t, "admin", adminPassword)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("login: %d", resp.StatusCode)
+	}
+	var cookie *http.Cookie
+	for _, c := range resp.Cookies() {
+		if c.Name == "terdut_session" {
+			cookie = c
+		}
+	}
+	if cookie == nil || !cookie.HttpOnly || cookie.SameSite != http.SameSiteLaxMode {
+		t.Fatalf("expected an HttpOnly, SameSite=Lax session cookie, got %+v", cookie)
+	}
+	if cookie.Secure {
+		t.Error("cookie is Secure on a plain-HTTP server with no https public URL")
+	}
+	var me struct {
+		User struct {
+			Username string `json:"username"`
+		} `json:"user"`
+		HasPassword bool `json:"has_password"`
+	}
+	decode(t, resp, &me)
+	if me.User.Username != "admin" || !me.HasPassword {
+		t.Errorf("unexpected login response %+v", me)
+	}
+}
+
+func TestLogin_CookieAuthenticatesAPI(t *testing.T) {
+	s := newTS(t)
+	b := signedIn(t, s)
+
+	if code := status(t, b.do(t, http.MethodGet, "/api/incidents", nil)); code != http.StatusOK {
+		t.Errorf("GET /api/incidents with cookie: %d", code)
+	}
+	resp := b.do(t, http.MethodGet, "/api/me", nil)
+	var me struct {
+		User struct {
+			ID int64 `json:"id"`
+		} `json:"user"`
+	}
+	decode(t, resp, &me)
+	if me.User.ID != 1 {
+		t.Errorf("/api/me returned user %d", me.User.ID)
+	}
+}
+
+func TestLogin_SecureCookieBehindHTTPSPublicURL(t *testing.T) {
+	s := newTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+	setAdminPassword(t, s)
+	resp := newBrowser(t, s.URL).login(t, "admin", adminPassword)
+	resp.Body.Close()
+	for _, c := range resp.Cookies() {
+		if c.Name == "terdut_session" && !c.Secure {
+			t.Error("cookie should be Secure when the public URL is https")
+		}
+	}
+}
+
+func TestLogin_WrongPasswordAndUnknownUser(t *testing.T) {
+	s := newTS(t)
+	setAdminPassword(t, s)
+	b := newBrowser(t, s.URL)
+
+	if code := status(t, b.login(t, "admin", "not the password")); code != http.StatusUnauthorized {
+		t.Errorf("wrong password: %d", code)
+	}
+	if code := status(t, b.login(t, "nobody", adminPassword)); code != http.StatusUnauthorized {
+		t.Errorf("unknown user: %d", code)
+	}
+}
+
+func TestLogin_UserWithoutPasswordCannotSignIn(t *testing.T) {
+	s := newTS(t)
+	b := newBrowser(t, s.URL)
+	// The empty password must not match a user that has none.
+	if code := status(t, b.login(t, "admin", "")); code != http.StatusUnauthorized {
+		t.Errorf("login without a password set: %d", code)
+	}
+}
+
+func TestLogin_RateLimitedPerUsername(t *testing.T) {
+	s := newTS(t)
+	setAdminPassword(t, s)
+	b := newBrowser(t, s.URL)
+
+	for i := range 10 {
+		if code := status(t, b.login(t, "admin", "wrong")); code != http.StatusUnauthorized {
+			t.Fatalf("attempt %d: %d", i+1, code)
+		}
+	}
+	// Even the right password is refused once the limit is reached.
+	resp := b.login(t, "admin", adminPassword)
+	if resp.StatusCode != http.StatusTooManyRequests {
+		t.Fatalf("expected 429, got %d", resp.StatusCode)
+	}
+	if resp.Header.Get("Retry-After") == "" {
+		t.Error("429 without Retry-After")
+	}
+	resp.Body.Close()
+}
+
+func TestSession_CrossOriginWriteRejected(t *testing.T) {
+	s := newTS(t)
+	b := signedIn(t, s)
+
+	code := status(t, b.do(t, http.MethodPost, "/api/incidents/999/acknowledge", nil,
+		"Sec-Fetch-Site", "cross-site", "Origin", "https://evil.example"))
+	if code != http.StatusForbidden {
+		t.Errorf("cross-origin POST with cookie: %d, want 403", code)
+	}
+
+	// The same request from the page itself gets through to the handler.
+	code = status(t, b.do(t, http.MethodPost, "/api/incidents/999/acknowledge", nil))
+	if code != http.StatusNotFound {
+		t.Errorf("same-origin POST with cookie: %d, want 404 from the handler", code)
+	}
+}
+
+func TestSession_BearerIgnoresOriginChecks(t *testing.T) {
+	s := newTS(t)
+	req, _ := http.NewRequest(http.MethodPost, s.URL+"/api/incidents/999/acknowledge", nil)
+	req.Header.Set("Authorization", "Bearer "+s.key)
+	req.Header.Set("Sec-Fetch-Site", "cross-site")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := status(t, resp); code != http.StatusNotFound {
+		t.Errorf("Bearer request: %d, want 404 from the handler", code)
+	}
+}
+
+func TestLogout_EndsSession(t *testing.T) {
+	s := newTS(t)
+	b := signedIn(t, s)
+
+	if code := status(t, b.do(t, http.MethodPost, "/api/logout", nil)); code != http.StatusNoContent {
+		t.Fatalf("logout: %d", code)
+	}
+	if code := status(t, b.do(t, http.MethodGet, "/api/me", nil)); code != http.StatusUnauthorized {
+		t.Errorf("after logout: %d", code)
+	}
+	var n int
+	s.db.QueryRow("SELECT COUNT(*) FROM sessions").Scan(&n)
+	if n != 0 {
+		t.Errorf("%d session(s) left after logout", n)
+	}
+}
+
+func TestSession_ExpiredIsRejected(t *testing.T) {
+	s := newTS(t)
+	b := signedIn(t, s)
+	s.exec(t, "UPDATE sessions SET expires_at = 1")
+
+	if code := status(t, b.do(t, http.MethodGet, "/api/me", nil)); code != http.StatusUnauthorized {
+		t.Errorf("expired session: %d", code)
+	}
+	api.Sweep(t.Context(), s.db, 0, 0, api.DeadmanConfig{}, api.NotifyConfig{})
+	var n int
+	s.db.QueryRow("SELECT COUNT(*) FROM sessions").Scan(&n)
+	if n != 0 {
+		t.Errorf("sweep left %d expired session(s)", n)
+	}
+}
+
+func TestSetPassword_OwnNeedsCurrent(t *testing.T) {
+	s := newTS(t)
+	b := signedIn(t, s)
+
+	code := status(t, b.do(t, http.MethodPut, "/api/users/1/password",
+		map[string]string{"password": "a brand new secret", "current_password": "wrong"}))
+	if code != http.StatusForbidden {
+		t.Errorf("wrong current password: %d", code)
+	}
+	code = status(t, b.do(t, http.MethodPut, "/api/users/1/password",
+		map[string]string{"password": "short", "current_password": adminPassword}))
+	if code != http.StatusBadRequest {
+		t.Errorf("too-short password: %d", code)
+	}
+	code = status(t, b.do(t, http.MethodPut, "/api/users/1/password",
+		map[string]string{"password": "a brand new secret", "current_password": adminPassword}))
+	if code != http.StatusNoContent {
+		t.Fatalf("change password: %d", code)
+	}
+	if code := status(t, newBrowser(t, s.URL).login(t, "admin", "a brand new secret")); code != http.StatusOK {
+		t.Errorf("login with the new password: %d", code)
+	}
+}
+
+func TestSetPassword_EndsOtherSessionsButNotThisOne(t *testing.T) {
+	s := newTS(t)
+	phone := signedIn(t, s)
+	laptop := newBrowser(t, s.URL)
+	status(t, laptop.login(t, "admin", adminPassword))
+
+	code := status(t, phone.do(t, http.MethodPut, "/api/users/1/password",
+		map[string]string{"password": "a brand new secret", "current_password": adminPassword}))
+	if code != http.StatusNoContent {
+		t.Fatalf("change password: %d", code)
+	}
+	if code := status(t, phone.do(t, http.MethodGet, "/api/me", nil)); code != http.StatusOK {
+		t.Errorf("the session that changed the password: %d", code)
+	}
+	if code := status(t, laptop.do(t, http.MethodGet, "/api/me", nil)); code != http.StatusUnauthorized {
+		t.Errorf("the other session: %d", code)
+	}
+}
+
+func TestBootstrap_WithPassword(t *testing.T) {
+	database, err := db.Open(":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Migrate(database); err != nil {
+		t.Fatal(err)
+	}
+	srv := httptest.NewServer(api.NewRouter(database, api.NotifyConfig{}, api.DeadmanConfig{}))
+	t.Cleanup(func() { srv.Close(); database.Close() })
+
+	body := `{"username":"admin","email":"a@test.com","password":"` + adminPassword + `"}`
+	resp, err := http.Post(srv.URL+"/api/bootstrap", "application/json", strings.NewReader(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := status(t, resp); code != http.StatusCreated {
+		t.Fatalf("bootstrap: %d", code)
+	}
+	if code := status(t, newBrowser(t, srv.URL).login(t, "admin", adminPassword)); code != http.StatusOK {
+		t.Errorf("login after bootstrap: %d", code)
+	}
+}
+
+func TestRouter_UnknownAPIPathIsJSON404(t *testing.T) {
+	s := newTS(t)
+	resp, err := http.Get(s.URL + "/api/nope")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusNotFound || !strings.HasPrefix(resp.Header.Get("Content-Type"), "application/json") {
+		t.Errorf("GET /api/nope: %d %s", resp.StatusCode, resp.Header.Get("Content-Type"))
+	}
+}
+
+func TestRouter_DeepLinkServesWebUI(t *testing.T) {
+	s := newTS(t)
+	resp, err := http.Get(s.URL + "/incidents/1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK || !strings.HasPrefix(resp.Header.Get("Content-Type"), "text/html") {
+		t.Errorf("GET /incidents/1: %d %s", resp.StatusCode, resp.Header.Get("Content-Type"))
+	}
+	if resp.Header.Get("Content-Security-Policy") == "" {
+		t.Error("web UI served without a CSP")
+	}
+
+	resp2, err := http.Get(s.URL + "/js/missing.js")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := status(t, resp2); code != http.StatusNotFound {
+		t.Errorf("missing asset: %d", code)
+	}
+}
@@ -1,131 +0,0 @@
-package api
-
-import (
-	"database/sql"
-	"net/http"
-	"strconv"
-	"time"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/yeniklas/terdut-server/internal/models"
-)
-
-func handleListComments(db *sql.DB) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		alertID, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
-		if err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid alert id"))
-			return
-		}
-
-		// Verify the alert exists.
-		var exists int
-		if err := db.QueryRowContext(r.Context(), "SELECT 1 FROM alerts WHERE id = ?", alertID).Scan(&exists); err != nil {
-			respond(w, http.StatusNotFound, errResp("alert not found"))
-			return
-		}
-
-		rows, err := db.QueryContext(r.Context(), `
-			SELECT c.id, c.alert_id, c.user_id, u.username, c.content, c.created_at
-			FROM   alert_comments c
-			JOIN   users u ON u.id = c.user_id
-			WHERE  c.alert_id = ?
-			ORDER  BY c.created_at ASC`, alertID)
-		if err != nil {
-			respond(w, http.StatusInternalServerError, errResp("internal error"))
-			return
-		}
-		defer rows.Close()
-
-		comments := []models.Comment{}
-		for rows.Next() {
-			var c models.Comment
-			var ts int64
-			if err := rows.Scan(&c.ID, &c.AlertID, &c.UserID, &c.Username, &c.Content, &ts); err != nil {
-				respond(w, http.StatusInternalServerError, errResp("internal error"))
-				return
-			}
-			c.CreatedAt = time.Unix(ts, 0).UTC()
-			comments = append(comments, c)
-		}
-		respond(w, http.StatusOK, comments)
-	}
-}
-
-func handleCreateComment(db *sql.DB) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		alertID, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
-		if err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid alert id"))
-			return
-		}
-
-		var req struct {
-			Content string `json:"content"`
-		}
-		if err := decodeJSON(r, &req); err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid request body"))
-			return
-		}
-		if req.Content == "" {
-			respond(w, http.StatusBadRequest, errResp("content is required"))
-			return
-		}
-
-		// Verify the alert exists.
-		var exists int
-		if err := db.QueryRowContext(r.Context(), "SELECT 1 FROM alerts WHERE id = ?", alertID).Scan(&exists); err != nil {
-			respond(w, http.StatusNotFound, errResp("alert not found"))
-			return
-		}
-
-		user, _ := userFromContext(r.Context())
-		res, err := db.ExecContext(r.Context(),
-			"INSERT INTO alert_comments (alert_id, user_id, content) VALUES (?, ?, ?)",
-			alertID, user.ID, req.Content)
-		if err != nil {
-			respond(w, http.StatusInternalServerError, errResp("internal error"))
-			return
-		}
-		commentID, _ := res.LastInsertId()
-
-		comment := models.Comment{
-			ID:        commentID,
-			AlertID:   alertID,
-			UserID:    user.ID,
-			Username:  user.Username,
-			Content:   req.Content,
-			CreatedAt: time.Now().UTC(),
-		}
-		respond(w, http.StatusCreated, comment)
-	}
-}
-
-func handleDeleteComment(db *sql.DB) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		alertID, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
-		if err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid alert id"))
-			return
-		}
-		commentID, err := strconv.ParseInt(chi.URLParam(r, "commentID"), 10, 64)
-		if err != nil {
-			respond(w, http.StatusBadRequest, errResp("invalid comment id"))
-			return
-		}
-
-		user, _ := userFromContext(r.Context())
-		res, err := db.ExecContext(r.Context(),
-			"DELETE FROM alert_comments WHERE id = ? AND alert_id = ? AND user_id = ?",
-			commentID, alertID, user.ID)
-		if err != nil {
-			respond(w, http.StatusInternalServerError, errResp("internal error"))
-			return
-		}
-		if n, _ := res.RowsAffected(); n == 0 {
-			respond(w, http.StatusNotFound, errResp("comment not found"))
-			return
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}
-}
@@ -0,0 +1,378 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"log"
+	"sort"
+	"strings"
+	"time"
+)
+
+// deadmanGroupPrefix namespaces the incidents this file opens. Alertmanager
+// group keys always contain braces, so this can never collide with one, and the
+// partial unique index on open group_key (see 008_incidents.sql) gives one open
+// incident per switch for free.
+const deadmanGroupPrefix = "deadman:"
+
+// DeadmanMatcher selects the alerts that are heartbeats rather than problems.
+// Every condition has to match, and Name — the alertname label — is mandatory:
+// it is what lets the sweeper find candidate rows through alerts_name_idx
+// instead of JSON-extracting labels from every row in the table.
+type DeadmanMatcher struct {
+	Name   string
+	Labels map[string]string
+}
+
+// String renders the matcher the way it was configured, which is also how it
+// reads in an incident title.
+func (m DeadmanMatcher) String() string {
+	if len(m.Labels) == 0 {
+		return m.Name
+	}
+	parts := make([]string, 0, len(m.Labels))
+	for k, v := range m.Labels {
+		parts = append(parts, k+"="+v)
+	}
+	sort.Strings(parts)
+	return m.Name + " (" + strings.Join(parts, ", ") + ")"
+}
+
+// matches reports whether an alert's labels satisfy every condition.
+func (m DeadmanMatcher) matches(labels map[string]string) bool {
+	if labels["alertname"] != m.Name {
+		return false
+	}
+	for k, v := range m.Labels {
+		if labels[k] != v {
+			return false
+		}
+	}
+	return true
+}
+
+// DeadmanConfig inverts the handling of the alerts it matches: receiving one
+// opens nothing, and the absence of one opens an incident.
+//
+// The unit of monitoring is the fingerprint, not the matcher — two clusters
+// sending the same heartbeat alertname are two independent switches, so one
+// healthy cluster cannot mask a dead one.
+type DeadmanConfig struct {
+	Matchers []DeadmanMatcher
+
+	// Timeout is how long a matched alert may go without a refreshing webhook
+	// before it is declared dead. It must be shorter than Alertmanager's
+	// repeat_interval for the heartbeat's route, which is what refreshes it.
+	// Zero disables dead man's switch handling entirely.
+	Timeout time.Duration
+
+	// Severity is the severity every dead man's switch incident opens at. These
+	// incidents have no member alerts to derive one from, and the heartbeat's
+	// own severity label is meaningless — Watchdog ships as "none".
+	Severity string
+}
+
+// enabled reports whether there is anything to watch.
+func (c DeadmanConfig) enabled() bool { return c.Timeout > 0 && len(c.Matchers) > 0 }
+
+// match returns the first matcher an alert satisfies.
+func (c DeadmanConfig) match(labels map[string]string) (DeadmanMatcher, bool) {
+	if !c.enabled() {
+		return DeadmanMatcher{}, false
+	}
+	for _, m := range c.Matchers {
+		if m.matches(labels) {
+			return m, true
+		}
+	}
+	return DeadmanMatcher{}, false
+}
+
+// isDeadman is match without the matcher, for the ingest path.
+func (c DeadmanConfig) isDeadman(labels map[string]string) bool {
+	_, ok := c.match(labels)
+	return ok
+}
+
+// names lists the distinct alertnames worth loading from the database.
+func (c DeadmanConfig) names() []string {
+	seen := map[string]bool{}
+	out := make([]string, 0, len(c.Matchers))
+	for _, m := range c.Matchers {
+		if !seen[m.Name] {
+			seen[m.Name] = true
+			out = append(out, m.Name)
+		}
+	}
+	return out
+}
+
+// ParseDeadmanConfig reads the matcher list from its configured form:
+// ";" separates matchers, "," separates the conditions within one, and "=" is
+// exact label equality — `alertname=Watchdog,cluster=prod; alertname=Heartbeat`.
+//
+// A malformed or alertname-less entry is dropped rather than fatal, following
+// config.duration's rule that one bad tuning knob should not take the server
+// down. Silence would be worse here than elsewhere, though — a typo that
+// disarms the switch is exactly the failure this feature exists to catch — so
+// the matchers that survived are logged.
+func ParseDeadmanConfig(matchers string, timeout time.Duration, severity string) DeadmanConfig {
+	cfg := DeadmanConfig{Timeout: timeout, Severity: severity}
+
+	for _, entry := range strings.Split(matchers, ";") {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+
+		m := DeadmanMatcher{Labels: map[string]string{}}
+		malformed := false
+		for _, cond := range strings.Split(entry, ",") {
+			k, v, ok := strings.Cut(cond, "=")
+			k, v = strings.TrimSpace(k), strings.TrimSpace(v)
+			if !ok || k == "" || v == "" {
+				log.Printf("deadman: ignoring matcher %q: %q is not label=value", entry, strings.TrimSpace(cond))
+				malformed = true
+				break
+			}
+			if k == "alertname" {
+				m.Name = v
+				continue
+			}
+			m.Labels[k] = v
+		}
+		if malformed {
+			continue
+		}
+		if m.Name == "" {
+			log.Printf("deadman: ignoring matcher %q: no alertname condition", entry)
+			continue
+		}
+		cfg.Matchers = append(cfg.Matchers, m)
+	}
+
+	switch {
+	case timeout <= 0:
+		log.Print("deadman: disabled (timeout is zero)")
+	case len(cfg.Matchers) == 0:
+		log.Print("deadman: disabled (no usable matchers)")
+	default:
+		rendered := make([]string, 0, len(cfg.Matchers))
+		for _, m := range cfg.Matchers {
+			rendered = append(rendered, m.String())
+		}
+		log.Printf("deadman: watching %s, timeout %s, severity %s",
+			strings.Join(rendered, "; "), timeout, severity)
+	}
+	return cfg
+}
+
+// deadmanAlert is one switch: the alert row carrying its last heartbeat.
+type deadmanAlert struct {
+	id          int64
+	fingerprint string
+	labels      map[string]string
+	matcher     DeadmanMatcher
+	resolved    bool
+	receivedAt  int64
+}
+
+// groupKey is the switch's identity as an incident. Per fingerprint, so each
+// source is tracked on its own.
+func (a deadmanAlert) groupKey() string { return deadmanGroupPrefix + a.fingerprint }
+
+// sweepDeadman is the whole point of the feature: it opens an incident for every
+// switch that has stopped chirping, and closes one whose switch came back.
+//
+// It returns the ids of the alerts it owns, because the generic staleness
+// expiry must leave them alone — staleAfter and ends_at would otherwise resolve
+// a heartbeat long before its own, much tighter, timeout ever fired.
+func sweepDeadman(ctx context.Context, db *sql.DB, cfg DeadmanConfig, notify NotifyConfig) map[int64]bool {
+	owned := map[int64]bool{}
+	if !cfg.enabled() {
+		return owned
+	}
+
+	switches, err := deadmanAlerts(ctx, db, cfg)
+	if err != nil {
+		log.Printf("deadman: load switches: %v", err)
+		return owned
+	}
+
+	now := time.Now()
+	cutoff := now.Add(-cfg.Timeout).Unix()
+
+	for _, sw := range switches {
+		owned[sw.id] = true
+
+		// An explicit resolved from Alertmanager is a stronger death signal than
+		// mere absence: the sender is telling us the heartbeat stopped, so there
+		// is nothing left to wait out.
+		if sw.resolved || sw.receivedAt < cutoff {
+			if err := deadmanDied(ctx, db, cfg, notify, sw, now); err != nil {
+				log.Printf("deadman: open incident for %s: %v", sw.matcher.Name, err)
+			}
+			continue
+		}
+		if err := deadmanRecovered(ctx, db, sw); err != nil {
+			log.Printf("deadman: resolve incident for %s: %v", sw.matcher.Name, err)
+		}
+	}
+	return owned
+}
+
+// deadmanAlerts loads every alert row that a matcher claims. The candidate query
+// is narrowed by alertname so it rides alerts_name_idx; the rest of the matching
+// happens in Go, which keeps one implementation of the rules. The rows are read
+// in full before the caller writes, because the pool holds a single connection.
+func deadmanAlerts(ctx context.Context, db *sql.DB, cfg DeadmanConfig) ([]deadmanAlert, error) {
+	names := cfg.names()
+	args := make([]any, 0, len(names))
+	for _, n := range names {
+		args = append(args, n)
+	}
+
+	rows, err := db.QueryContext(ctx, `
+		SELECT id, fingerprint, labels, status, received_at
+		FROM   alerts
+		WHERE  name IN (`+placeholders(len(names))+`)
+		  AND  archived_at IS NULL`, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []deadmanAlert
+	for rows.Next() {
+		var a deadmanAlert
+		var labelsJSON, status string
+		if err := rows.Scan(&a.id, &a.fingerprint, &labelsJSON, &status, &a.receivedAt); err != nil {
+			return nil, err
+		}
+		json.Unmarshal([]byte(labelsJSON), &a.labels) //nolint:errcheck
+
+		m, ok := cfg.match(a.labels)
+		if !ok {
+			continue
+		}
+		a.matcher = m
+		a.resolved = status == "resolved"
+		out = append(out, a)
+	}
+	return out, rows.Err()
+}
+
+// deadmanDied raises the incident for a switch that has gone quiet.
+//
+// Two conditions gate it, and both matter. There must be no open incident for
+// the switch already — the partial unique index enforces that anyway, but a
+// second one would be a wasted page. And the heartbeat must have been seen since
+// the last incident was raised, which is the re-arm rule: resolving a dead man's
+// switch incident sticks, exactly as resolving an alert-backed one does (see
+// incidentForGroup), and a source that is gone for good is a one-time page
+// rather than a nag. Only a heartbeat that comes back and dies again earns a new
+// incident.
+func deadmanDied(ctx context.Context, db *sql.DB, cfg DeadmanConfig, notify NotifyConfig, sw deadmanAlert, now time.Time) error {
+	var lastTriggered, open int64
+	if err := db.QueryRowContext(ctx, `
+		SELECT COALESCE(MAX(triggered_at), 0),
+		       COALESCE(SUM(resolved_at IS NULL), 0)
+		FROM   incidents WHERE group_key = ?`,
+		sw.groupKey()).Scan(&lastTriggered, &open); err != nil {
+		return err
+	}
+	if open > 0 || sw.receivedAt <= lastTriggered {
+		return nil
+	}
+
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	// A heartbeat nobody has heard from is not firing, and saying otherwise in
+	// the alert list would be a lie. An Alertmanager-sourced resolution keeps its
+	// own source: it told us the truth first.
+	if !sw.resolved {
+		if _, err := tx.ExecContext(ctx, `
+			UPDATE alerts
+			   SET status            = 'resolved',
+			       resolution_source = ?,
+			       ends_at           = COALESCE(ends_at, unixepoch())
+			 WHERE id = ? AND status = 'firing'`, resolutionDeadman, sw.id); err != nil {
+			return err
+		}
+	}
+
+	severity := cfg.Severity
+	var sev *string
+	if severity != "" {
+		sev = &severity
+	}
+
+	incidentID, err := openIncident(ctx, tx, notify, sw.groupKey(),
+		"No heartbeat from "+sw.matcher.String(), sw.labels, sev)
+	if err != nil {
+		return err
+	}
+
+	alertID := sw.id
+	detail := "last heartbeat " + humanDuration(now.Sub(time.Unix(sw.receivedAt, 0))) + " ago"
+	if err := logEvent(ctx, tx, incidentID, evDeadmanSilent, nil, &alertID, &detail); err != nil {
+		return err
+	}
+
+	if err := tx.Commit(); err != nil {
+		return err
+	}
+	log.Printf("deadman: %s went silent, opened incident %d", sw.matcher.String(), incidentID)
+	return nil
+}
+
+// deadmanRecovered closes the incident for a switch that started chirping again.
+//
+// It cannot go through resolveIfSettled: a dead man's switch incident has no
+// member alerts (linking the heartbeat would have the settled-incident cascade
+// close it on the very same sweep that opened it), so the alert-driven cascade
+// ignores it entirely and recovery is the only automatic way out.
+func deadmanRecovered(ctx context.Context, db *sql.DB, sw deadmanAlert) error {
+	var incidentID int64
+	switch err := db.QueryRowContext(ctx, `
+		SELECT id FROM incidents
+		 WHERE group_key = ? AND resolved_at IS NULL`, sw.groupKey()).Scan(&incidentID); {
+	case err == sql.ErrNoRows:
+		return nil
+	case err != nil:
+		return err
+	}
+
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	if _, err := tx.ExecContext(ctx, `
+		UPDATE incidents
+		   SET status = 'resolved', resolved_at = ?, resolution_source = ?
+		 WHERE id = ? AND resolved_at IS NULL`,
+		time.Now().Unix(), incidentResolutionRecovered, incidentID); err != nil {
+		return err
+	}
+	if err := logEvent(ctx, tx, incidentID, evResolved, nil, nil, nil); err != nil {
+		return err
+	}
+	// The all-clear goes to whoever was paged, which enqueueResolved works out
+	// from the incident's own notification history.
+	if err := enqueueResolved(ctx, tx, incidentID); err != nil {
+		return err
+	}
+
+	if err := tx.Commit(); err != nil {
+		return err
+	}
+	log.Printf("deadman: %s is back, resolved incident %d", sw.matcher.String(), incidentID)
+	return nil
+}
@@ -0,0 +1,468 @@
+package api_test
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/api"
+)
+
+// ---------------------------------------------------------------------------
+// Harness
+// ---------------------------------------------------------------------------
+
+// watchdogGroupKey is what Alertmanager sends for a Watchdog grouped by
+// alertname, which is how the deployed route is configured.
+const watchdogGroupKey = `{}:{alertname="Watchdog"}`
+
+// deadmanCfg watches Watchdog with a timeout short enough to reason about and
+// long enough that a fresh heartbeat is never accidentally stale.
+func deadmanCfg() api.DeadmanConfig {
+	return api.ParseDeadmanConfig("alertname=Watchdog", time.Hour, "critical")
+}
+
+// deadmanTS is notifyTS with dead man's switch handling on: notifications
+// enabled against a fake ntfy, the admin on call today with a topic.
+func deadmanTS(t *testing.T, cfg api.DeadmanConfig) (*ts, *fakeNtfy) {
+	t.Helper()
+	f := newFakeNtfy(t)
+	s := newDeadmanTS(t, cfg, api.NotifyConfig{
+		BaseURL:   f.URL,
+		PublicURL: "https://terdut.example.com",
+	})
+
+	putOnCall(t, s, 1)
+	setTopic(t, s, 1, "terdut-admin")
+	return s, f
+}
+
+// heartbeat posts one Watchdog webhook. Its startsAt never changes: a dead man's
+// switch alert fires once and is re-sent unchanged forever, which is precisely
+// what makes its absence meaningful.
+func heartbeat(t *testing.T, s *ts, fingerprint string, labels map[string]string) {
+	t.Helper()
+	postWebhook(t, s, []map[string]any{
+		amAlert(fingerprint, "Watchdog", "firing", "2026-05-20T10:00:00Z", zeroTime, labels),
+	}, watchdogGroupKey)
+}
+
+// silence back-dates a heartbeat's received_at, which is the only clock the
+// sweeper reads. There is no fake clock in this package.
+func silence(t *testing.T, s *ts, fingerprint string, ago time.Duration) {
+	t.Helper()
+	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = ?",
+		time.Now().Add(-ago).Unix(), fingerprint)
+}
+
+// ageIncidents back-dates every incident. The re-arm rule compares a heartbeat
+// against the last incident raised for its switch, so a test that wants a second
+// episode has to put the first one in the past — there is no fake clock here.
+func ageIncidents(t *testing.T, s *ts, ago time.Duration) {
+	t.Helper()
+	past := time.Now().Add(-ago).Unix()
+	s.exec(t, `UPDATE incidents
+	              SET triggered_at = ?,
+	                  resolved_at  = CASE WHEN resolved_at IS NULL THEN NULL ELSE ? END`,
+		past, past)
+}
+
+// incidentByGroup reads the incident for a group key, resolved ones included.
+func incidentByGroup(t *testing.T, s *ts, groupKey string) (id int64, status, severity string, source *string) {
+	t.Helper()
+	err := s.db.QueryRow(`
+		SELECT id, status, COALESCE(severity, ''), resolution_source
+		FROM   incidents WHERE group_key = ? ORDER BY id DESC LIMIT 1`,
+		groupKey).Scan(&id, &status, &severity, &source)
+	if err != nil {
+		t.Fatalf("read incident for group %s: %v", groupKey, err)
+	}
+	return id, status, severity, source
+}
+
+// ---------------------------------------------------------------------------
+// Receiving a heartbeat
+// ---------------------------------------------------------------------------
+
+// The whole inversion: arrival of a dead man's switch alert is good news, and
+// good news is not an incident.
+func TestDeadman_HeartbeatOpensNoIncident(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-watchdog", nil)
+
+	if got := s.countIncidents(t); got != 0 {
+		t.Fatalf("expected a heartbeat to open no incident, got %d", got)
+	}
+	if got := s.countNotifications(t, ""); got != 0 {
+		t.Errorf("expected no notification for a heartbeat, got %d", got)
+	}
+	if status, _, _ := s.alertRow(t, "fp-watchdog"); status != "firing" {
+		t.Errorf("expected the heartbeat to be stored firing, got %q", status)
+	}
+}
+
+// A heartbeat routed into a group alongside real alerts must not join their
+// incident: it is not a symptom of anything.
+func TestDeadman_MixedGroupExcludesHeartbeat(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-mixed-wd", "Watchdog", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+		amAlert("fp-mixed-disk", "DiskFull", "firing", "2026-05-20T10:00:00Z", zeroTime,
+			map[string]string{"severity": "critical"}),
+	}, `{}:{namespace="prod"}`)
+
+	if got := s.countIncidents(t); got != 1 {
+		t.Fatalf("expected 1 incident for the real alert, got %d", got)
+	}
+
+	var alerts []map[string]any
+	decode(t, s.req(t, http.MethodGet, "/api/incidents/1/alerts", nil), &alerts)
+	if len(alerts) != 1 {
+		t.Fatalf("expected 1 member alert, got %d", len(alerts))
+	}
+	if name := alerts[0]["name"]; name != "DiskFull" {
+		t.Errorf("expected only the real alert linked, got %v", name)
+	}
+}
+
+// A matcher scoped by label only claims the alerts it names, so a heartbeat from
+// somewhere else stays an ordinary alert.
+func TestDeadman_LabelScopedMatcherIgnoresOthers(t *testing.T) {
+	s, _ := deadmanTS(t, api.ParseDeadmanConfig("alertname=Watchdog,cluster=prod", time.Hour, "critical"))
+
+	heartbeat(t, s, "fp-dev", map[string]string{"cluster": "dev"})
+
+	if got := s.countIncidents(t); got != 1 {
+		t.Fatalf("expected an unmatched Watchdog to behave like any other alert, got %d incidents", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Silence
+// ---------------------------------------------------------------------------
+
+func TestDeadman_SilenceOpensIncident(t *testing.T) {
+	s, f := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	silence(t, s, "fp-watchdog", 2*time.Hour)
+	sweep(t, s, noArchive)
+
+	if got := s.countIncidents(t); got != 1 {
+		t.Fatalf("expected silence to open 1 incident, got %d", got)
+	}
+	id, status, severity, _ := incidentByGroup(t, s, "deadman:fp-watchdog")
+	if status != "triggered" {
+		t.Errorf("expected a triggered incident, got %q", status)
+	}
+	if severity != "critical" {
+		t.Errorf("expected the configured severity, got %q", severity)
+	}
+
+	// The alert list must not keep claiming a dead heartbeat is firing.
+	alertStatus, source, _ := s.alertRow(t, "fp-watchdog")
+	if alertStatus != "resolved" || source == nil || *source != "deadman" {
+		t.Errorf("expected the heartbeat resolved as deadman, got %q / %v", alertStatus, source)
+	}
+
+	// Nobody was told anything by an alert here, so the page has to come from
+	// the switch itself.
+	s.sweepNotify(t)
+	msgs := f.messages()
+	if len(msgs) != 1 {
+		t.Fatalf("expected 1 page, got %d", len(msgs))
+	}
+	if msgs[0].Topic != "terdut-admin" {
+		t.Errorf("expected the on-call topic, got %q", msgs[0].Topic)
+	}
+	if msgs[0].Priority != 5 {
+		t.Errorf("expected a critical page to override quiet hours (priority 5), got %d", msgs[0].Priority)
+	}
+
+	// The timeline says why, with the age of the last heartbeat.
+	types := eventTypes(timeline(t, s, int(id)))
+	found := false
+	for _, ty := range types {
+		if ty == "deadman_silent" {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("expected a deadman_silent event, got %v", types)
+	}
+}
+
+// The generic staleness sweep must keep its hands off heartbeats: they answer to
+// their own, much tighter, timeout, and an 'expiry' resolution here would be
+// both wrong and unrecoverable.
+func TestDeadman_GenericExpiryLeavesHeartbeatAlone(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	silence(t, s, "fp-watchdog", 5*time.Minute)
+
+	// staleAfter far tighter than the dead man's switch timeout.
+	sweep(t, s, time.Minute)
+
+	status, source, _ := s.alertRow(t, "fp-watchdog")
+	if status != "firing" || source != nil {
+		t.Errorf("expected a live heartbeat left alone, got %q / %v", status, source)
+	}
+	if got := s.countIncidents(t); got != 0 {
+		t.Errorf("expected no incident for a heartbeat that is still fresh, got %d", got)
+	}
+}
+
+// An explicit resolved from Alertmanager is the sender telling us the heartbeat
+// stopped. There is nothing left to wait out.
+func TestDeadman_AlertmanagerResolvedIsImmediateDeath(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-watchdog", "Watchdog", "resolved", "2026-05-20T10:00:00Z", zeroTime, nil),
+	}, watchdogGroupKey)
+
+	// No ageing: received_at is seconds old, well inside the timeout.
+	sweep(t, s, noArchive)
+
+	if got := s.countIncidents(t); got != 1 {
+		t.Fatalf("expected a resolved heartbeat to open an incident at once, got %d", got)
+	}
+	// Alertmanager told the truth first, so its resolution source stands.
+	if _, source, _ := s.alertRow(t, "fp-watchdog"); source == nil || *source != "alertmanager" {
+		t.Errorf("expected the Alertmanager resolution source kept, got %v", source)
+	}
+}
+
+// Each label set is its own switch, so one healthy source cannot mask a dead one.
+func TestDeadman_TracksEachFingerprintSeparately(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-a", map[string]string{"cluster": "a"})
+	heartbeat(t, s, "fp-b", map[string]string{"cluster": "b"})
+	silence(t, s, "fp-b", 2*time.Hour)
+	sweep(t, s, noArchive)
+
+	if got := s.countIncidents(t); got != 1 {
+		t.Fatalf("expected only the silent switch to page, got %d incidents", got)
+	}
+	if _, status, _, _ := incidentByGroup(t, s, "deadman:fp-b"); status != "triggered" {
+		t.Errorf("expected the incident to belong to the silent switch, got %q", status)
+	}
+	if status, _, _ := s.alertRow(t, "fp-a"); status != "firing" {
+		t.Errorf("expected the live switch untouched, got %q", status)
+	}
+}
+
+// A switch nothing has ever been heard from is dormant. A fresh deploy, a
+// restored database or a typo'd alertname must not page.
+func TestDeadman_UnheardOfSwitchIsDormant(t *testing.T) {
+	s, _ := deadmanTS(t, api.ParseDeadmanConfig("alertname=NeverSent", time.Hour, "critical"))
+
+	sweep(t, s, noArchive)
+
+	if got := s.countIncidents(t); got != 0 {
+		t.Fatalf("expected a switch that never chirped to be dormant, got %d incidents", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Recovery and re-arming
+// ---------------------------------------------------------------------------
+
+// The returning heartbeat carries the unchanged startsAt of an alert that never
+// stopped firing, so this also covers the ingest guard exemption: without it the
+// upsert would discard the payload and the switch could die exactly once.
+func TestDeadman_RecoveryResolvesIncident(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	silence(t, s, "fp-watchdog", 2*time.Hour)
+	sweep(t, s, noArchive)
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	if status, source, _ := s.alertRow(t, "fp-watchdog"); status != "firing" || source != nil {
+		t.Fatalf("expected the returning heartbeat to be accepted, got %q / %v", status, source)
+	}
+
+	sweep(t, s, noArchive)
+
+	_, status, _, source := incidentByGroup(t, s, "deadman:fp-watchdog")
+	if status != "resolved" {
+		t.Errorf("expected recovery to close the incident, got %q", status)
+	}
+	if source == nil || *source != "recovered" {
+		t.Errorf("expected resolution_source recovered, got %v", source)
+	}
+	if got := s.countNotifications(t, "resolved"); got != 1 {
+		t.Errorf("expected 1 all-clear, got %d", got)
+	}
+}
+
+// Resolving a dead man's switch incident sticks, exactly as it does for an
+// alert-backed one. A source that is gone for good is a one-time page.
+func TestDeadman_ManualResolveSticksWhileSilent(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	silence(t, s, "fp-watchdog", 2*time.Hour)
+	sweep(t, s, noArchive)
+
+	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
+
+	// Still silent, several sweeps later.
+	sweep(t, s, noArchive)
+	sweep(t, s, noArchive)
+
+	if got := s.countIncidents(t); got != 1 {
+		t.Fatalf("expected a manually resolved incident to stay closed, got %d", got)
+	}
+}
+
+// ...but the switch re-arms, so a heartbeat that comes back and dies again is a
+// new incident rather than silence forever.
+func TestDeadman_ReArmsAfterHeartbeatReturns(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	silence(t, s, "fp-watchdog", 2*time.Hour)
+	sweep(t, s, noArchive)
+	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
+
+	// That episode is yesterday's news; the heartbeat now returns after it.
+	ageIncidents(t, s, 10*time.Hour)
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	sweep(t, s, noArchive)
+	if got := s.countIncidents(t); got != 1 {
+		t.Fatalf("expected the live switch to open nothing, got %d incidents", got)
+	}
+
+	silence(t, s, "fp-watchdog", 2*time.Hour)
+	sweep(t, s, noArchive)
+
+	if got := s.countIncidents(t); got != 2 {
+		t.Fatalf("expected a second death to open a second incident, got %d", got)
+	}
+}
+
+// A dead man's switch incident has no member alerts — linking the heartbeat
+// would have the settled-incident cascade close it on the very sweep that opened
+// it — so the cascade has to leave it alone.
+func TestDeadman_SettledCascadeLeavesIncidentOpen(t *testing.T) {
+	s, _ := deadmanTS(t, deadmanCfg())
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	silence(t, s, "fp-watchdog", 2*time.Hour)
+	sweep(t, s, noArchive)
+	sweep(t, s, noArchive)
+
+	if _, status, _, _ := incidentByGroup(t, s, "deadman:fp-watchdog"); status != "triggered" {
+		t.Fatalf("expected the incident to stay open until the switch recovers, got %q", status)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Configuration
+// ---------------------------------------------------------------------------
+
+func TestParseDeadmanConfig(t *testing.T) {
+	tests := []struct {
+		name     string
+		matchers string
+		timeout  time.Duration
+		want     []api.DeadmanMatcher
+		enabled  bool
+	}{
+		{
+			name:     "single alertname",
+			matchers: "alertname=Watchdog",
+			timeout:  time.Hour,
+			want:     []api.DeadmanMatcher{{Name: "Watchdog", Labels: map[string]string{}}},
+			enabled:  true,
+		},
+		{
+			name:     "several matchers with extra labels and whitespace",
+			matchers: " alertname=Watchdog, cluster=prod ; alertname=EdgeHeartbeat ",
+			timeout:  time.Hour,
+			want: []api.DeadmanMatcher{
+				{Name: "Watchdog", Labels: map[string]string{"cluster": "prod"}},
+				{Name: "EdgeHeartbeat", Labels: map[string]string{}},
+			},
+			enabled: true,
+		},
+		{
+			// Mandatory: it is what keeps the sweeper's candidate query on an index.
+			name:     "matcher without alertname is dropped",
+			matchers: "cluster=prod; alertname=Watchdog",
+			timeout:  time.Hour,
+			want:     []api.DeadmanMatcher{{Name: "Watchdog", Labels: map[string]string{}}},
+			enabled:  true,
+		},
+		{
+			name:     "malformed condition drops only its matcher",
+			matchers: "alertname=Watchdog,garbage; alertname=Other",
+			timeout:  time.Hour,
+			want:     []api.DeadmanMatcher{{Name: "Other", Labels: map[string]string{}}},
+			enabled:  true,
+		},
+		{
+			name:     "zero timeout disables",
+			matchers: "alertname=Watchdog",
+			timeout:  0,
+			want:     []api.DeadmanMatcher{{Name: "Watchdog", Labels: map[string]string{}}},
+			enabled:  false,
+		},
+		{
+			name:     "no usable matchers disables",
+			matchers: "",
+			timeout:  time.Hour,
+			want:     nil,
+			enabled:  false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := api.ParseDeadmanConfig(tc.matchers, tc.timeout, "critical")
+			if len(got.Matchers) != len(tc.want) {
+				t.Fatalf("got %d matchers %v, want %d", len(got.Matchers), got.Matchers, len(tc.want))
+			}
+			for i, w := range tc.want {
+				if got.Matchers[i].Name != w.Name {
+					t.Errorf("matcher %d: name %q, want %q", i, got.Matchers[i].Name, w.Name)
+				}
+				if len(got.Matchers[i].Labels) != len(w.Labels) {
+					t.Errorf("matcher %d: labels %v, want %v", i, got.Matchers[i].Labels, w.Labels)
+					continue
+				}
+				for k, v := range w.Labels {
+					if got.Matchers[i].Labels[k] != v {
+						t.Errorf("matcher %d: label %s=%q, want %q", i, k, got.Matchers[i].Labels[k], v)
+					}
+				}
+			}
+		})
+	}
+}
+
+// A zero config is off, which is what keeps the feature opt-in for anything
+// building a router without one.
+func TestDeadman_DisabledConfigIsInert(t *testing.T) {
+	s, _ := deadmanTS(t, api.DeadmanConfig{})
+
+	heartbeat(t, s, "fp-watchdog", nil)
+	silence(t, s, "fp-watchdog", 48*time.Hour)
+	sweep(t, s, time.Hour)
+
+	// Ordinary alert handling: an incident from the arrival, not the absence.
+	if got := s.countIncidents(t); got != 1 {
+		t.Fatalf("expected plain alert handling with deadman off, got %d incidents", got)
+	}
+	if _, source, _ := s.alertRow(t, "fp-watchdog"); source == nil || *source != "expiry" {
+		t.Errorf("expected the generic sweeper to own the alert, got %v", source)
+	}
+}
@@ -0,0 +1,300 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"sort"
+	"strings"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/models"
+)
+
+// Values for incidents.resolution_source, recording who closed the incident:
+// every member alert stopped firing, or a person decided it was done.
+const (
+	incidentResolutionAlerts = "alerts"
+	incidentResolutionManual = "manual"
+
+	// incidentResolutionRecovered closes a dead man's switch incident whose
+	// heartbeat started arriving again. It cannot be "alerts": these incidents
+	// have no member alerts for the cascade to work from.
+	incidentResolutionRecovered = "recovered"
+)
+
+// Incident timeline event types. Stored as free text so adding one later is not
+// a migration, but these are the ones the server writes.
+const (
+	evTriggered      = "triggered"
+	evAlertAdded     = "alert_added"
+	evAlertResolved  = "alert_resolved"
+	evAcknowledged   = "acknowledged"
+	evUnacknowledged = "unacknowledged"
+	evAssigned       = "assigned"
+	evSnoozed        = "snoozed"
+	evUnsnoozed      = "unsnoozed"
+	evResolved       = "resolved"
+	evNote           = "note"
+	evDeadmanSilent  = "deadman_silent"
+)
+
+// severityLabel is the Alertmanager label an incident's severity is derived from.
+const severityLabel = "severity"
+
+// querier is satisfied by both *sql.DB and *sql.Tx, so the helpers below work
+// inside the webhook's transaction and standalone from handlers and the sweeper.
+type querier interface {
+	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
+	QueryContext(ctx context.Context, query string, args ...any) (*sql.Rows, error)
+	QueryRowContext(ctx context.Context, query string, args ...any) *sql.Row
+}
+
+const incidentSelectFrom = `
+	SELECT i.id, i.group_key, i.title, i.group_labels, i.status, i.severity,
+	       i.triggered_at,
+	       i.acknowledged_by, i.acknowledged_at, ack.username,
+	       i.assigned_to, asg.username, i.snoozed_until,
+	       i.resolved_at, i.resolution_source, i.archived_at
+	FROM   incidents i
+	LEFT   JOIN users ack ON ack.id = i.acknowledged_by
+	LEFT   JOIN users asg ON asg.id = i.assigned_to`
+
+func scanIncident(s scanner) (models.Incident, error) {
+	var i models.Incident
+	var groupLabelsJSON string
+	var triggeredAt int64
+	var ackAt, snoozedUntil, resolvedAt, archivedAt *int64
+
+	if err := s.Scan(
+		&i.ID, &i.GroupKey, &i.Title, &groupLabelsJSON, &i.Status, &i.Severity,
+		&triggeredAt,
+		&i.AcknowledgedByID, &ackAt, &i.AcknowledgedByUser,
+		&i.AssignedToID, &i.AssignedToUser, &snoozedUntil,
+		&resolvedAt, &i.ResolutionSource, &archivedAt,
+	); err != nil {
+		return i, err
+	}
+
+	json.Unmarshal([]byte(groupLabelsJSON), &i.GroupLabels) //nolint:errcheck
+	i.TriggeredAt = time.Unix(triggeredAt, 0).UTC()
+	i.AcknowledgedAt = unixPtr(ackAt)
+	i.SnoozedUntil = unixPtr(snoozedUntil)
+	i.ResolvedAt = unixPtr(resolvedAt)
+	i.ArchivedAt = unixPtr(archivedAt)
+	return i, nil
+}
+
+// unixPtr converts a nullable Unix-second column to a nullable UTC time.
+func unixPtr(sec *int64) *time.Time {
+	if sec == nil {
+		return nil
+	}
+	t := time.Unix(*sec, 0).UTC()
+	return &t
+}
+
+func fetchIncident(ctx context.Context, q querier, id int64) (models.Incident, error) {
+	return scanIncident(q.QueryRowContext(ctx, incidentSelectFrom+" WHERE i.id = ?", id))
+}
+
+// logEvent appends one entry to an incident's timeline. A nil userID means the
+// server acted rather than a person.
+func logEvent(ctx context.Context, q querier, incidentID int64, evType string, userID, alertID *int64, detail *string) error {
+	_, err := q.ExecContext(ctx, `
+		INSERT INTO incident_events (incident_id, type, user_id, alert_id, detail, created_at)
+		VALUES (?, ?, ?, ?, ?, ?)`,
+		incidentID, evType, userID, alertID, detail, time.Now().Unix())
+	return err
+}
+
+// todayUTC is the schedule's day key. The schedule's smallest unit is one UTC day.
+func todayUTC() string {
+	return time.Now().UTC().Format("2006-01-02")
+}
+
+// currentOnCall returns today's on-call user, or nil when nobody is scheduled.
+// A missing schedule entry is not an error — incidents just open unassigned.
+func currentOnCall(ctx context.Context, q querier) (*int64, error) {
+	var userID int64
+	err := q.QueryRowContext(ctx,
+		"SELECT user_id FROM schedule_entries WHERE date = ?", todayUTC()).Scan(&userID)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &userID, nil
+}
+
+// severityRank orders the conventional Alertmanager severity label values.
+// Anything unrecognised sorts below all of them rather than being dropped.
+func severityRank(s string) int {
+	switch strings.ToLower(s) {
+	case "critical":
+		return 4
+	case "error":
+		return 3
+	case "warning":
+		return 2
+	case "info":
+		return 1
+	default:
+		return 0
+	}
+}
+
+// refreshSeverity raises an incident's severity to the highest `severity` label
+// seen across its alerts.
+//
+// It is a high-water mark, never lowered: an incident that hit critical was a
+// critical incident, even after the critical alert clears and a warning is all
+// that is left firing. Downgrading a live incident would also quietly demote it
+// in the queue while the work is still open.
+func refreshSeverity(ctx context.Context, q querier, incidentID int64) error {
+	rows, err := q.QueryContext(ctx, `
+		SELECT json_extract(a.labels, '$.'||?)
+		FROM   incident_alerts ia
+		JOIN   alerts a ON a.id = ia.alert_id
+		WHERE  ia.incident_id = ?`, severityLabel, incidentID)
+	if err != nil {
+		return err
+	}
+
+	best := ""
+	for rows.Next() {
+		var sev *string
+		if err := rows.Scan(&sev); err != nil {
+			rows.Close()
+			return err
+		}
+		if sev != nil && severityRank(*sev) > severityRank(best) {
+			best = *sev
+		}
+	}
+	if err := rows.Err(); err != nil {
+		rows.Close()
+		return err
+	}
+	rows.Close()
+
+	if best == "" {
+		return nil
+	}
+	// The comparison lives in SQL so an unrelated concurrent update cannot be
+	// clobbered by a stale read.
+	_, err = q.ExecContext(ctx, `
+		UPDATE incidents SET severity = ?
+		 WHERE id = ?
+		   AND (severity IS NULL OR `+severityRankSQL("severity")+` < ?)`,
+		best, incidentID, severityRank(best))
+	return err
+}
+
+// severityRankSQL mirrors severityRank for use inside a statement. SQL cannot
+// order these strings meaningfully on its own.
+func severityRankSQL(col string) string {
+	return `CASE lower(COALESCE(` + col + `, ''))
+		WHEN 'critical' THEN 4
+		WHEN 'error'    THEN 3
+		WHEN 'warning'  THEN 2
+		WHEN 'info'     THEN 1
+		ELSE 0 END`
+}
+
+// resolveIfSettled closes an incident once every alert under it has stopped
+// firing — PagerDuty's cascade, and the only automatic route out of the open
+// state. Reports whether it actually resolved anything.
+func resolveIfSettled(ctx context.Context, q querier, incidentID int64) (bool, error) {
+	res, err := q.ExecContext(ctx, `
+		UPDATE incidents
+		   SET status            = 'resolved',
+		       resolved_at       = ?,
+		       resolution_source = ?
+		 WHERE id = ?
+		   AND resolved_at IS NULL
+		   -- An incident with no members yet is mid-creation, not settled.
+		   AND EXISTS (SELECT 1 FROM incident_alerts ia WHERE ia.incident_id = incidents.id)
+		   AND NOT EXISTS (SELECT 1
+		                     FROM incident_alerts ia
+		                     JOIN alerts a ON a.id = ia.alert_id
+		                    WHERE ia.incident_id = incidents.id
+		                      AND a.status = 'firing')`,
+		time.Now().Unix(), incidentResolutionAlerts, incidentID)
+	if err != nil {
+		return false, err
+	}
+	n, _ := res.RowsAffected()
+	if n == 0 {
+		return false, nil
+	}
+	if err := logEvent(ctx, q, incidentID, evResolved, nil, nil, nil); err != nil {
+		return false, err
+	}
+	// The all-clear goes only to whoever was paged in the first place, which
+	// enqueueResolved works out from the incident's own notification history.
+	// Manual resolution sends nothing: the person who closed it already knows.
+	return true, enqueueResolved(ctx, q, incidentID)
+}
+
+// acknowledgeIncident records that userID has picked an incident up, and reports
+// whether it changed anything — an already-resolved incident is left alone.
+// Shared by the authenticated handler and the Acknowledge button in a push
+// notification, so both write the same state and the same timeline entry.
+func acknowledgeIncident(ctx context.Context, q querier, incidentID, userID int64) (bool, error) {
+	res, err := q.ExecContext(ctx, `
+		UPDATE incidents
+		   SET status = 'acknowledged', acknowledged_by = ?, acknowledged_at = ?
+		 WHERE id = ? AND resolved_at IS NULL`,
+		userID, time.Now().Unix(), incidentID)
+	if err != nil {
+		return false, err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return false, nil
+	}
+	return true, logEvent(ctx, q, incidentID, evAcknowledged, &userID, nil, nil)
+}
+
+// openIncidentForAlert returns the open incident an alert currently belongs to,
+// or 0 when it has none. Used when an alert resolves or expires so the event
+// lands on the right timeline.
+func openIncidentForAlert(ctx context.Context, q querier, alertID int64) (int64, error) {
+	var id int64
+	err := q.QueryRowContext(ctx, `
+		SELECT i.id
+		FROM   incident_alerts ia
+		JOIN   incidents i ON i.id = ia.incident_id
+		WHERE  ia.alert_id = ? AND i.resolved_at IS NULL`, alertID).Scan(&id)
+	if err == sql.ErrNoRows {
+		return 0, nil
+	}
+	return id, err
+}
+
+// incidentTitle renders a human-readable title from Alertmanager's groupLabels,
+// leading with the alert name and appending whatever else the operator grouped
+// by. Falls back to the alert's own name when the payload carried no groupLabels.
+func incidentTitle(groupLabels map[string]string, fallback string) string {
+	name := groupLabels["alertname"]
+	if name == "" {
+		name = fallback
+	}
+	if name == "" {
+		name = "Incident"
+	}
+
+	rest := make([]string, 0, len(groupLabels))
+	for k, v := range groupLabels {
+		if k == "alertname" {
+			continue
+		}
+		rest = append(rest, k+"="+v)
+	}
+	if len(rest) == 0 {
+		return name
+	}
+	sort.Strings(rest)
+	return name + " (" + strings.Join(rest, ", ") + ")"
+}
@@ -0,0 +1,557 @@
+package api
+
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/models"
+	"github.com/go-chi/chi/v5"
+)
+
+func handleListIncidents(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		q := r.URL.Query()
+
+		where := []string{}
+		args := []any{}
+
+		// Without an explicit status the queue shows open work, which is what an
+		// on-call person opens the tool to see.
+		if status := q.Get("status"); status != "" {
+			where = append(where, "i.status = ?")
+			args = append(args, status)
+		} else {
+			where = append(where, "i.resolved_at IS NULL")
+		}
+
+		if q.Get("archived") == "true" {
+			where = append(where, "i.archived_at IS NOT NULL")
+		} else {
+			where = append(where, "i.archived_at IS NULL")
+		}
+
+		// A snooze expires by simply falling into the past; nothing sweeps it.
+		if q.Get("snoozed") == "true" {
+			where = append(where, "i.snoozed_until > ?")
+			args = append(args, time.Now().Unix())
+		} else {
+			where = append(where, "(i.snoozed_until IS NULL OR i.snoozed_until <= ?)")
+			args = append(args, time.Now().Unix())
+		}
+
+		if severity := q.Get("severity"); severity != "" {
+			where = append(where, "i.severity = ?")
+			args = append(args, severity)
+		}
+		if assignee := q.Get("assigned_to"); assignee != "" {
+			if n, err := strconv.ParseInt(assignee, 10, 64); err == nil {
+				where = append(where, "i.assigned_to = ?")
+				args = append(args, n)
+			}
+		}
+		if from := q.Get("from"); from != "" {
+			if t, err := time.Parse("2006-01-02", from); err == nil {
+				where = append(where, "i.triggered_at >= ?")
+				args = append(args, t.UTC().Unix())
+			}
+		}
+		if to := q.Get("to"); to != "" {
+			if t, err := time.Parse("2006-01-02", to); err == nil {
+				where = append(where, "i.triggered_at < ?")
+				args = append(args, t.UTC().AddDate(0, 0, 1).Unix())
+			}
+		}
+
+		limit := 50
+		if l := q.Get("limit"); l != "" {
+			if n, err := strconv.Atoi(l); err == nil && n > 0 && n <= 500 {
+				limit = n
+			}
+		}
+
+		order := "i.triggered_at DESC"
+		if q.Get("sort") == "severity" {
+			order = severityRankSQL("i.severity") + " DESC, i.triggered_at DESC"
+		}
+		args = append(args, limit)
+
+		rows, err := db.QueryContext(r.Context(),
+			fmt.Sprintf("%s WHERE %s ORDER BY %s LIMIT ?",
+				incidentSelectFrom, strings.Join(where, " AND "), order),
+			args...)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		defer rows.Close()
+
+		incidents := []models.Incident{}
+		for rows.Next() {
+			i, err := scanIncident(rows)
+			if err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			}
+			incidents = append(incidents, i)
+		}
+		respond(w, http.StatusOK, incidents)
+	}
+}
+
+func handleGetIncident(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		inc, err := fetchIncident(r.Context(), db, id)
+		if err == sql.ErrNoRows {
+			respond(w, http.StatusNotFound, errResp("incident not found"))
+			return
+		}
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if inc.Alerts, err = incidentAlerts(r, db, id); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, inc)
+	}
+}
+
+func handleIncidentAlerts(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		if !incidentExists(w, r, db, id) {
+			return
+		}
+		alerts, err := incidentAlerts(r, db, id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, alerts)
+	}
+}
+
+func handleIncidentTimeline(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		if !incidentExists(w, r, db, id) {
+			return
+		}
+
+		rows, err := db.QueryContext(r.Context(), `
+			SELECT e.id, e.incident_id, e.type, e.user_id, u.username,
+			       e.alert_id, e.detail, e.created_at
+			FROM   incident_events e
+			LEFT   JOIN users u ON u.id = e.user_id
+			WHERE  e.incident_id = ?
+			ORDER  BY e.created_at ASC, e.id ASC`, id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		defer rows.Close()
+
+		events := []models.IncidentEvent{}
+		for rows.Next() {
+			var e models.IncidentEvent
+			var ts int64
+			if err := rows.Scan(&e.ID, &e.IncidentID, &e.Type, &e.UserID, &e.Username,
+				&e.AlertID, &e.Detail, &ts); err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			}
+			e.CreatedAt = time.Unix(ts, 0).UTC()
+			events = append(events, e)
+		}
+		respond(w, http.StatusOK, events)
+	}
+}
+
+func handleIncidentAcknowledge(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		user, _ := userFromContext(r.Context())
+		acked, err := acknowledgeIncident(r.Context(), db, id, user.ID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if !acked {
+			if !incidentExists(w, r, db, id) {
+				return
+			}
+			respond(w, http.StatusConflict, errResp("incident is resolved"))
+			return
+		}
+		respondIncident(w, r, db, id)
+	}
+}
+
+func handleIncidentUnacknowledge(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		user, _ := userFromContext(r.Context())
+		if !updateOpenIncident(w, r, db, id,
+			`UPDATE incidents SET status = 'triggered', acknowledged_by = NULL, acknowledged_at = NULL
+			  WHERE id = ? AND resolved_at IS NULL`, id) {
+			return
+		}
+		if err := logEvent(r.Context(), db, id, evUnacknowledged, &user.ID, nil, nil); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// handleIncidentResolve closes an incident by hand. This is terminal: a later
+// occurrence opens a new incident rather than reopening this one, which is what
+// stops a resolved incident from reappearing on the next repeat_interval
+// re-send of an alert that never stopped firing. Use snooze for "not now".
+func handleIncidentResolve(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		user, _ := userFromContext(r.Context())
+		if !updateOpenIncident(w, r, db, id,
+			`UPDATE incidents SET status = 'resolved', resolved_at = ?, resolution_source = ?
+			  WHERE id = ? AND resolved_at IS NULL`,
+			time.Now().Unix(), incidentResolutionManual, id) {
+			return
+		}
+		if err := logEvent(r.Context(), db, id, evResolved, &user.ID, nil, nil); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respondIncident(w, r, db, id)
+	}
+}
+
+func handleIncidentAssign(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		var req struct {
+			UserID int64 `json:"user_id"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		if req.UserID == 0 {
+			respond(w, http.StatusBadRequest, errResp("user_id is required"))
+			return
+		}
+		var exists int
+		if err := db.QueryRowContext(r.Context(),
+			"SELECT 1 FROM users WHERE id = ?", req.UserID).Scan(&exists); err != nil {
+			respond(w, http.StatusNotFound, errResp("user not found"))
+			return
+		}
+
+		if !updateOpenIncident(w, r, db, id,
+			"UPDATE incidents SET assigned_to = ? WHERE id = ? AND resolved_at IS NULL",
+			req.UserID, id) {
+			return
+		}
+		// On an "assigned" event user_id is the assignee, not the actor.
+		if err := logEvent(r.Context(), db, id, evAssigned, &req.UserID, nil, nil); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respondIncident(w, r, db, id)
+	}
+}
+
+// handleIncidentSnooze hides an incident from the default queue without closing
+// it. Accepts either an absolute {"until": RFC3339} or a relative
+// {"duration": "2h"}.
+func handleIncidentSnooze(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		var req struct {
+			Until    string `json:"until"`
+			Duration string `json:"duration"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+
+		var until time.Time
+		switch {
+		case req.Until != "":
+			t, err := time.Parse(time.RFC3339, req.Until)
+			if err != nil {
+				respond(w, http.StatusBadRequest, errResp("invalid until (expected RFC3339)"))
+				return
+			}
+			until = t
+		case req.Duration != "":
+			d, err := time.ParseDuration(req.Duration)
+			if err != nil {
+				respond(w, http.StatusBadRequest, errResp("invalid duration"))
+				return
+			}
+			until = time.Now().Add(d)
+		default:
+			respond(w, http.StatusBadRequest, errResp("until or duration is required"))
+			return
+		}
+		if !until.After(time.Now()) {
+			respond(w, http.StatusBadRequest, errResp("snooze must end in the future"))
+			return
+		}
+
+		user, _ := userFromContext(r.Context())
+		if !updateOpenIncident(w, r, db, id,
+			"UPDATE incidents SET snoozed_until = ? WHERE id = ? AND resolved_at IS NULL",
+			until.Unix(), id) {
+			return
+		}
+		detail := until.UTC().Format(time.RFC3339)
+		if err := logEvent(r.Context(), db, id, evSnoozed, &user.ID, nil, &detail); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respondIncident(w, r, db, id)
+	}
+}
+
+func handleIncidentUnsnooze(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		user, _ := userFromContext(r.Context())
+		if !updateOpenIncident(w, r, db, id,
+			"UPDATE incidents SET snoozed_until = NULL WHERE id = ? AND resolved_at IS NULL", id) {
+			return
+		}
+		if err := logEvent(r.Context(), db, id, evUnsnoozed, &user.ID, nil, nil); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+func handleIncidentArchive(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		res, err := db.ExecContext(r.Context(),
+			"UPDATE incidents SET archived_at = unixepoch() WHERE id = ?", id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if n, _ := res.RowsAffected(); n == 0 {
+			respond(w, http.StatusNotFound, errResp("incident not found"))
+			return
+		}
+		respondIncident(w, r, db, id)
+	}
+}
+
+func handleIncidentUnarchive(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		res, err := db.ExecContext(r.Context(),
+			"UPDATE incidents SET archived_at = NULL WHERE id = ?", id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if n, _ := res.RowsAffected(); n == 0 {
+			respond(w, http.StatusNotFound, errResp("incident not found"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// handleCreateNote adds a note to the timeline. Notes are ordinary events, so a
+// single query renders the whole story of an incident in order.
+func handleCreateNote(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		var req struct {
+			Content string `json:"content"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		if req.Content == "" {
+			respond(w, http.StatusBadRequest, errResp("content is required"))
+			return
+		}
+		if !incidentExists(w, r, db, id) {
+			return
+		}
+
+		user, _ := userFromContext(r.Context())
+		now := time.Now()
+		res, err := db.ExecContext(r.Context(), `
+			INSERT INTO incident_events (incident_id, type, user_id, detail, created_at)
+			VALUES (?, ?, ?, ?, ?)`, id, evNote, user.ID, req.Content, now.Unix())
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		eventID, _ := res.LastInsertId()
+
+		respond(w, http.StatusCreated, models.IncidentEvent{
+			ID:         eventID,
+			IncidentID: id,
+			Type:       evNote,
+			UserID:     &user.ID,
+			Username:   &user.Username,
+			Detail:     &req.Content,
+			CreatedAt:  now.UTC().Truncate(time.Second),
+		})
+	}
+}
+
+// handleDeleteNote removes one of your own notes. Only notes are deletable — the
+// rest of the timeline is what actually happened, and is not editable.
+func handleDeleteNote(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, ok := incidentIDParam(w, r)
+		if !ok {
+			return
+		}
+		eventID, err := strconv.ParseInt(chi.URLParam(r, "eventID"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid note id"))
+			return
+		}
+
+		user, _ := userFromContext(r.Context())
+		res, err := db.ExecContext(r.Context(), `
+			DELETE FROM incident_events
+			 WHERE id = ? AND incident_id = ? AND type = ? AND user_id = ?`,
+			eventID, id, evNote, user.ID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if n, _ := res.RowsAffected(); n == 0 {
+			respond(w, http.StatusNotFound, errResp("note not found"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Shared handler plumbing
+// ---------------------------------------------------------------------------
+
+func incidentIDParam(w http.ResponseWriter, r *http.Request) (int64, bool) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		respond(w, http.StatusBadRequest, errResp("invalid incident id"))
+		return 0, false
+	}
+	return id, true
+}
+
+func incidentExists(w http.ResponseWriter, r *http.Request, db *sql.DB, id int64) bool {
+	var exists int
+	if err := db.QueryRowContext(r.Context(),
+		"SELECT 1 FROM incidents WHERE id = ?", id).Scan(&exists); err != nil {
+		respond(w, http.StatusNotFound, errResp("incident not found"))
+		return false
+	}
+	return true
+}
+
+// updateOpenIncident runs a mutation that is only valid while an incident is
+// open. The query must be constrained to `resolved_at IS NULL`, so no rows means
+// either the incident does not exist or it is already closed — two different
+// answers the caller should not have to distinguish itself.
+func updateOpenIncident(w http.ResponseWriter, r *http.Request, db *sql.DB, id int64, query string, args ...any) bool {
+	res, err := db.ExecContext(r.Context(), query, args...)
+	if err != nil {
+		respond(w, http.StatusInternalServerError, errResp("internal error"))
+		return false
+	}
+	if n, _ := res.RowsAffected(); n > 0 {
+		return true
+	}
+	if !incidentExists(w, r, db, id) {
+		return false
+	}
+	respond(w, http.StatusConflict, errResp("incident is resolved"))
+	return false
+}
+
+func respondIncident(w http.ResponseWriter, r *http.Request, db *sql.DB, id int64) {
+	inc, err := fetchIncident(r.Context(), db, id)
+	if err != nil {
+		respond(w, http.StatusInternalServerError, errResp("internal error"))
+		return
+	}
+	respond(w, http.StatusOK, inc)
+}
+
+// incidentAlerts loads the alerts under an incident, newest signal first.
+func incidentAlerts(r *http.Request, db *sql.DB, id int64) ([]models.Alert, error) {
+	rows, err := db.QueryContext(r.Context(), alertSelectFrom+`
+		JOIN incident_alerts m ON m.alert_id = a.id
+		WHERE m.incident_id = ?
+		ORDER BY a.received_at DESC`, id)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	alerts := []models.Alert{}
+	for rows.Next() {
+		a, err := scanAlert(rows)
+		if err != nil {
+			return nil, err
+		}
+		alerts = append(alerts, a)
+	}
+	return alerts, rows.Err()
+}
@@ -0,0 +1,827 @@
+package api_test
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/api"
+	"git.ryuvia.com/niklas/terdut-server/internal/db"
+)
+
+// amAlert builds one alert of a webhook payload.
+func amAlert(fingerprint, name, status, startsAt, endsAt string, labels map[string]string) map[string]any {
+	l := map[string]string{"alertname": name}
+	for k, v := range labels {
+		l[k] = v
+	}
+	return map[string]any{
+		"status":       status,
+		"labels":       l,
+		"annotations":  map[string]string{},
+		"startsAt":     startsAt,
+		"endsAt":       endsAt,
+		"generatorURL": "",
+		"fingerprint":  fingerprint,
+	}
+}
+
+func listIncidents(t *testing.T, s *ts, query string) []map[string]any {
+	t.Helper()
+	var out []map[string]any
+	decode(t, s.req(t, http.MethodGet, "/api/incidents"+query, nil), &out)
+	return out
+}
+
+func getIncident(t *testing.T, s *ts, id int) map[string]any {
+	t.Helper()
+	var out map[string]any
+	decode(t, s.req(t, http.MethodGet, fmt.Sprintf("/api/incidents/%d", id), nil), &out)
+	return out
+}
+
+func timeline(t *testing.T, s *ts, id int) []map[string]any {
+	t.Helper()
+	var out []map[string]any
+	decode(t, s.req(t, http.MethodGet, fmt.Sprintf("/api/incidents/%d/timeline", id), nil), &out)
+	return out
+}
+
+// eventTypes flattens a timeline to its event types, which is what the ordering
+// assertions actually care about.
+func eventTypes(events []map[string]any) []string {
+	types := make([]string, len(events))
+	for i, e := range events {
+		types[i] = e["type"].(string)
+	}
+	return types
+}
+
+// countIncidents counts rows directly, including resolved and archived ones that
+// no list view returns.
+func (s *ts) countIncidents(t *testing.T) int {
+	t.Helper()
+	var n int
+	if err := s.db.QueryRow("SELECT COUNT(*) FROM incidents").Scan(&n); err != nil {
+		t.Fatalf("count incidents: %v", err)
+	}
+	return n
+}
+
+// ---------------------------------------------------------------------------
+// Ingest: alerts becoming incidents
+// ---------------------------------------------------------------------------
+
+func TestWebhook_FiringOpensIncident(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-1", "HighCPU", "firing", "2026-05-20T10:00:00Z", zeroTime,
+			map[string]string{"severity": "critical"}),
+	}, "{}:{alertname=\"HighCPU\"}")
+
+	incidents := listIncidents(t, s, "")
+	if len(incidents) != 1 {
+		t.Fatalf("expected 1 incident, got %d", len(incidents))
+	}
+	inc := incidents[0]
+	if inc["status"] != "triggered" {
+		t.Errorf("expected status triggered, got %v", inc["status"])
+	}
+	if inc["severity"] != "critical" {
+		t.Errorf("expected severity critical, got %v", inc["severity"])
+	}
+	if inc["title"] != "HighCPU" {
+		t.Errorf("expected title from groupLabels, got %v", inc["title"])
+	}
+
+	// The alert points back at the incident it opened.
+	var alerts []map[string]any
+	decode(t, s.req(t, http.MethodGet, "/api/alerts", nil), &alerts)
+	if len(alerts) != 1 || alerts[0]["incident_id"] == nil {
+		t.Fatalf("expected the alert to carry an incident_id, got %v", alerts)
+	}
+}
+
+// Alertmanager already grouped these; we adopt its answer rather than
+// correlating again.
+func TestWebhook_SameGroupKeyJoinsOneIncident(t *testing.T) {
+	s := newTS(t)
+	const groupKey = "{}:{alertname=\"DiskFull\"}"
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-a", "DiskFull", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+		amAlert("fp-b", "DiskFull", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	}, groupKey)
+
+	incidents := listIncidents(t, s, "")
+	if len(incidents) != 1 {
+		t.Fatalf("expected 1 incident for one groupKey, got %d", len(incidents))
+	}
+	id := int(incidents[0]["id"].(float64))
+
+	inc := getIncident(t, s, id)
+	members, _ := inc["alerts"].([]any)
+	if len(members) != 2 {
+		t.Fatalf("expected 2 alerts under the incident, got %d", len(members))
+	}
+
+	added := 0
+	for _, ty := range eventTypes(timeline(t, s, id)) {
+		if ty == "alert_added" {
+			added++
+		}
+	}
+	if added != 2 {
+		t.Errorf("expected 2 alert_added events, got %d", added)
+	}
+}
+
+// The load-bearing rule. Alertmanager re-sends firing notifications every
+// repeat_interval; if those re-sends reopened incidents, resolving one by hand
+// would mean nothing.
+func TestWebhook_HeartbeatDoesNotReopenResolvedIncident(t *testing.T) {
+	s := newTS(t)
+	const groupKey = "{}:{alertname=\"Flapper\"}"
+	alert := amAlert("fp-hb", "Flapper", "firing", "2026-05-20T10:00:00Z", zeroTime, nil)
+
+	postWebhook(t, s, []map[string]any{alert}, groupKey)
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("resolve returned %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	// Same startsAt, same fingerprint: a re-send, not a new occurrence.
+	postWebhook(t, s, []map[string]any{alert}, groupKey)
+
+	if n := s.countIncidents(t); n != 1 {
+		t.Fatalf("expected the heartbeat to open no incident, got %d total", n)
+	}
+	if inc := getIncident(t, s, 1); inc["resolved_at"] == nil {
+		t.Error("expected incident 1 to stay resolved")
+	}
+
+	// The alert itself is still firing and still being tracked — only the work
+	// item is closed.
+	status, _, _ := s.alertRow(t, "fp-hb")
+	if status != "firing" {
+		t.Errorf("expected the alert to still be firing, got %q", status)
+	}
+}
+
+func TestWebhook_NewOccurrenceOpensNewIncident(t *testing.T) {
+	s := newTS(t)
+	const groupKey = "{}:{alertname=\"Recurring\"}"
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-new", "Recurring", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	}, groupKey)
+	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
+
+	// A newer startsAt is a genuinely new occurrence, not a re-send.
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-new", "Recurring", "firing", "2026-05-21T09:00:00Z", zeroTime, nil),
+	}, groupKey)
+
+	if n := s.countIncidents(t); n != 2 {
+		t.Fatalf("expected a second incident for the new occurrence, got %d total", n)
+	}
+	open := listIncidents(t, s, "")
+	if len(open) != 1 || int(open[0]["id"].(float64)) != 2 {
+		t.Fatalf("expected incident 2 to be the open one, got %v", open)
+	}
+
+	// The new incident starts unacknowledged: that is the point of the split.
+	if open[0]["acknowledged_by"] != nil {
+		t.Error("expected a fresh occurrence to start unacknowledged")
+	}
+}
+
+func TestWebhook_ResolvedOnlyPayloadOpensNothing(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-res", "AlreadyOver", "resolved", "2026-05-20T10:00:00Z", "2026-05-20T11:00:00Z", nil),
+	}, "{}:{alertname=\"AlreadyOver\"}")
+
+	if n := s.countIncidents(t); n != 0 {
+		t.Errorf("expected no incident from a resolved-only payload, got %d", n)
+	}
+	if status, _, _ := s.alertRow(t, "fp-res"); status != "resolved" {
+		t.Errorf("expected the alert itself to be stored, got %q", status)
+	}
+}
+
+// An incident that hit critical was a critical incident, even once the critical
+// alert clears and only a warning is left.
+func TestIncident_SeverityIsHighWaterMark(t *testing.T) {
+	s := newTS(t)
+	const groupKey = "{}:{alertname=\"Mixed\"}"
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-warn", "Mixed", "firing", "2026-05-20T10:00:00Z", zeroTime,
+			map[string]string{"severity": "warning"}),
+		amAlert("fp-crit", "Mixed", "firing", "2026-05-20T10:00:00Z", zeroTime,
+			map[string]string{"severity": "critical"}),
+	}, groupKey)
+
+	if inc := getIncident(t, s, 1); inc["severity"] != "critical" {
+		t.Fatalf("expected severity critical, got %v", inc["severity"])
+	}
+
+	// The critical alert clears; the warning keeps the incident open.
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-crit", "Mixed", "resolved", "2026-05-20T10:00:00Z", "2026-05-20T11:00:00Z",
+			map[string]string{"severity": "critical"}),
+	}, groupKey)
+
+	inc := getIncident(t, s, 1)
+	if inc["resolved_at"] != nil {
+		t.Fatal("expected the incident to stay open")
+	}
+	if inc["severity"] != "critical" {
+		t.Errorf("expected severity to stay critical, got %v", inc["severity"])
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Resolution cascade
+// ---------------------------------------------------------------------------
+
+func TestIncident_AllAlertsResolvedAutoResolves(t *testing.T) {
+	s := newTS(t)
+	const groupKey = "{}:{alertname=\"Pair\"}"
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-p1", "Pair", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+		amAlert("fp-p2", "Pair", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	}, groupKey)
+
+	// One down, one still firing: the work is not done.
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-p1", "Pair", "resolved", "2026-05-20T10:00:00Z", "2026-05-20T11:00:00Z", nil),
+	}, groupKey)
+	if inc := getIncident(t, s, 1); inc["resolved_at"] != nil {
+		t.Fatal("expected the incident to stay open while an alert is firing")
+	}
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-p2", "Pair", "resolved", "2026-05-20T10:00:00Z", "2026-05-20T11:30:00Z", nil),
+	}, groupKey)
+
+	inc := getIncident(t, s, 1)
+	if inc["status"] != "resolved" {
+		t.Errorf("expected status resolved, got %v", inc["status"])
+	}
+	if inc["resolution_source"] != "alerts" {
+		t.Errorf("expected resolution_source alerts, got %v", inc["resolution_source"])
+	}
+}
+
+// Expiry is inference, not observation, but it still has to close the work item
+// — otherwise a lost resolved notification leaves an incident open forever.
+func TestExpiry_CascadesToIncidentResolution(t *testing.T) {
+	s := newTS(t)
+	postAlert(t, s, "fp-exp", "firing", time.Now().Add(-24*time.Hour).Format(time.RFC3339), zeroTime)
+
+	s.exec(t, "UPDATE alerts SET received_at = ? WHERE fingerprint = 'fp-exp'",
+		time.Now().Add(-10*time.Hour).Unix())
+	sweep(t, s, 6*time.Hour)
+
+	inc := getIncident(t, s, 1)
+	if inc["status"] != "resolved" {
+		t.Errorf("expected the incident to resolve after expiry, got %v", inc["status"])
+	}
+	if inc["resolution_source"] != "alerts" {
+		t.Errorf("expected resolution_source alerts, got %v", inc["resolution_source"])
+	}
+
+	// The expiry is recorded against the alert, not the incident.
+	if _, source, _ := s.alertRow(t, "fp-exp"); source == nil || *source != "expiry" {
+		t.Errorf("expected the alert's resolution_source to stay expiry, got %v", source)
+	}
+	if types := eventTypes(timeline(t, s, 1)); !contains(types, "alert_resolved") {
+		t.Errorf("expected an alert_resolved event on the timeline, got %v", types)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Workflow actions
+// ---------------------------------------------------------------------------
+
+func TestIncident_Acknowledge(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-ack", "X", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/acknowledge", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("acknowledge returned %d", resp.StatusCode)
+	}
+	var inc map[string]any
+	decode(t, resp, &inc)
+	if inc["acknowledged_by"] == nil {
+		t.Error("expected acknowledged_by to be set")
+	}
+	if inc["status"] != "acknowledged" {
+		t.Errorf("expected status acknowledged, got %v", inc["status"])
+	}
+
+	resp = s.req(t, http.MethodDelete, "/api/incidents/1/acknowledge", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("unacknowledge returned %d", resp.StatusCode)
+	}
+	if inc := getIncident(t, s, 1); inc["status"] != "triggered" {
+		t.Errorf("expected status back to triggered, got %v", inc["status"])
+	}
+}
+
+func TestIncident_ManualResolveIsTerminal(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-term", "Terminal", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("first resolve returned %d", resp.StatusCode)
+	}
+	var inc map[string]any
+	decode(t, resp, &inc)
+	if inc["resolution_source"] != "manual" {
+		t.Errorf("expected resolution_source manual, got %v", inc["resolution_source"])
+	}
+
+	resp = s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusConflict {
+		t.Errorf("expected 409 on re-resolve, got %d", resp.StatusCode)
+	}
+
+	// Acknowledging a closed incident is equally meaningless.
+	resp = s.req(t, http.MethodPost, "/api/incidents/1/acknowledge", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusConflict {
+		t.Errorf("expected 409 acknowledging a resolved incident, got %d", resp.StatusCode)
+	}
+}
+
+func TestIncident_SnoozeHiddenFromDefaultList(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-snz", "Noisy", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/snooze", map[string]string{"duration": "2h"})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("snooze returned %d", resp.StatusCode)
+	}
+	var inc map[string]any
+	decode(t, resp, &inc)
+	if inc["snoozed_until"] == nil {
+		t.Error("expected snoozed_until to be set")
+	}
+
+	if got := listIncidents(t, s, ""); len(got) != 0 {
+		t.Errorf("expected the snoozed incident to be hidden, got %d", len(got))
+	}
+	if got := listIncidents(t, s, "?snoozed=true"); len(got) != 1 {
+		t.Errorf("expected snoozed=true to show it, got %d", len(got))
+	}
+
+	// A snooze is not a resolution: the incident is still open work.
+	if inc := getIncident(t, s, 1); inc["resolved_at"] != nil {
+		t.Error("expected a snoozed incident to stay open")
+	}
+
+	resp = s.req(t, http.MethodDelete, "/api/incidents/1/snooze", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("unsnooze returned %d", resp.StatusCode)
+	}
+	if got := listIncidents(t, s, ""); len(got) != 1 {
+		t.Errorf("expected the incident back in the default list, got %d", len(got))
+	}
+}
+
+func TestIncident_SnoozeRejectsPastDeadline(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-past", "Past", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/snooze",
+		map[string]string{"until": time.Now().Add(-time.Hour).UTC().Format(time.RFC3339)})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("expected 400 for a snooze in the past, got %d", resp.StatusCode)
+	}
+}
+
+// The schedule stops being decorative here: it is read at trigger time.
+func TestIncident_AutoAssignedToCurrentOnCall(t *testing.T) {
+	s := newTS(t)
+
+	today := time.Now().UTC().Format("2006-01-02")
+	resp := s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": 1, "dates": []string{today}})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("schedule assignment returned %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-oncall", "PageMe", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	inc := getIncident(t, s, 1)
+	if inc["assigned_to"] != "admin" {
+		t.Errorf("expected the incident assigned to today's on-call, got %v", inc["assigned_to"])
+	}
+	if types := eventTypes(timeline(t, s, 1)); !contains(types, "assigned") {
+		t.Errorf("expected an assigned event, got %v", types)
+	}
+}
+
+func TestIncident_AssignToUser(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-asg", "Assignable", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	s.req(t, http.MethodPost, "/api/users",
+		map[string]string{"username": "alice", "email": "alice@test.com"}).Body.Close()
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/assign", map[string]any{"user_id": 2})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("assign returned %d", resp.StatusCode)
+	}
+	var inc map[string]any
+	decode(t, resp, &inc)
+	if inc["assigned_to"] != "alice" {
+		t.Errorf("expected assigned_to alice, got %v", inc["assigned_to"])
+	}
+
+	resp = s.req(t, http.MethodPost, "/api/incidents/1/assign", map[string]any{"user_id": 99})
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("expected 404 assigning an unknown user, got %d", resp.StatusCode)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Timeline and notes
+// ---------------------------------------------------------------------------
+
+func TestIncident_TimelineOrdering(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-tl", "Storyline", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	s.req(t, http.MethodPost, "/api/incidents/1/acknowledge", nil).Body.Close()
+	s.req(t, http.MethodPost, "/api/incidents/1/notes",
+		map[string]string{"content": "looking into it"}).Body.Close()
+	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
+
+	events := timeline(t, s, 1)
+	want := []string{"triggered", "alert_added", "acknowledged", "note", "resolved"}
+	got := eventTypes(events)
+	if len(got) != len(want) {
+		t.Fatalf("expected timeline %v, got %v", want, got)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("expected timeline %v, got %v", want, got)
+		}
+	}
+
+	// The note carries its author; system events do not.
+	for _, e := range events {
+		if e["type"] == "note" {
+			if e["username"] != "admin" || e["detail"] != "looking into it" {
+				t.Errorf("unexpected note event: %v", e)
+			}
+		}
+		if e["type"] == "triggered" && e["username"] != nil {
+			t.Errorf("expected the triggered event to have no author, got %v", e["username"])
+		}
+	}
+}
+
+func TestIncident_NoteDeleteOwnOnly(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-note", "Y", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	s.req(t, http.MethodPost, "/api/users",
+		map[string]string{"username": "alice", "email": "alice@test.com"}).Body.Close()
+	var keyData map[string]any
+	decode(t, s.req(t, http.MethodPost, "/api/users/2/api-keys",
+		map[string]string{"name": "alice-key"}), &keyData)
+	aliceKey := keyData["key"].(string)
+
+	var note map[string]any
+	decode(t, s.req(t, http.MethodPost, "/api/incidents/1/notes",
+		map[string]string{"content": "admin note"}), &note)
+	noteID := int(note["id"].(float64))
+
+	// Alice cannot delete admin's note.
+	req, _ := http.NewRequest(http.MethodDelete,
+		fmt.Sprintf("%s/api/incidents/1/notes/%d", s.URL, noteID), nil)
+	req.Header.Set("Authorization", "Bearer "+aliceKey)
+	resp, _ := http.DefaultClient.Do(req)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("expected 404 deleting another user's note, got %d", resp.StatusCode)
+	}
+
+	resp = s.req(t, http.MethodDelete, fmt.Sprintf("/api/incidents/1/notes/%d", noteID), nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Errorf("expected 204 deleting own note, got %d", resp.StatusCode)
+	}
+}
+
+// Only notes are deletable — the rest of the timeline is what happened.
+func TestIncident_CannotDeleteSystemEvent(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-sys", "System", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	events := timeline(t, s, 1)
+	id := int(events[0]["id"].(float64))
+	resp := s.req(t, http.MethodDelete, fmt.Sprintf("/api/incidents/1/notes/%d", id), nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("expected 404 deleting a system event, got %d", resp.StatusCode)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Archive
+// ---------------------------------------------------------------------------
+
+func TestIncident_ArchiveRoundTrip(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-arc", "Archivable", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/archive", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("archive returned %d", resp.StatusCode)
+	}
+	var inc map[string]any
+	decode(t, resp, &inc)
+	if inc["archived_at"] == nil {
+		t.Error("expected archived_at to be set")
+	}
+
+	if got := listIncidents(t, s, "?status=resolved"); len(got) != 0 {
+		t.Errorf("expected the archived incident to be hidden, got %d", len(got))
+	}
+	if got := listIncidents(t, s, "?status=resolved&archived=true"); len(got) != 1 {
+		t.Errorf("expected archived=true to show it, got %d", len(got))
+	}
+
+	resp = s.req(t, http.MethodDelete, "/api/incidents/1/archive", nil)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("unarchive returned %d", resp.StatusCode)
+	}
+	if got := listIncidents(t, s, "?status=resolved"); len(got) != 1 {
+		t.Errorf("expected the incident back, got %d", len(got))
+	}
+}
+
+func TestSweeper_ArchivesResolvedIncidents(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-swp", "Old", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
+
+	s.exec(t, "UPDATE incidents SET resolved_at = ? WHERE id = 1",
+		time.Now().Add(-30*24*time.Hour).Unix())
+	api.Sweep(context.Background(), s.db, 7*24*time.Hour, 6*time.Hour, s.deadman, s.notify)
+
+	if inc := getIncident(t, s, 1); inc["archived_at"] == nil {
+		t.Error("expected the sweeper to archive a long-resolved incident")
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Stats
+// ---------------------------------------------------------------------------
+
+func TestStats_Incidents(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-s1", "One", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	}, "g1")
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-s2", "Two", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	}, "g2")
+	s.req(t, http.MethodPost, "/api/incidents/1/acknowledge", nil).Body.Close()
+	s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil).Body.Close()
+
+	var stats map[string]any
+	decode(t, s.req(t, http.MethodGet, "/api/stats/incidents", nil), &stats)
+
+	if stats["total"].(float64) != 2 {
+		t.Errorf("expected total 2, got %v", stats["total"])
+	}
+	if stats["resolved"].(float64) != 1 {
+		t.Errorf("expected resolved 1, got %v", stats["resolved"])
+	}
+	if stats["triggered"].(float64) != 1 {
+		t.Errorf("expected triggered 1, got %v", stats["triggered"])
+	}
+	// One incident has been acknowledged and resolved, so both averages exist.
+	if stats["mtta_seconds"] == nil || stats["mttr_seconds"] == nil {
+		t.Errorf("expected mtta and mttr to be computable, got %v", stats)
+	}
+}
+
+// An empty window is a report of zero, not a failure. SUM over no rows is NULL
+// in SQLite, which used to come back as a 500 the moment every incident was
+// archived — the state a quiet installation settles into.
+func TestStats_IncidentsEmptyWindowIsZeroNotAnError(t *testing.T) {
+	s := newTS(t)
+
+	// No incidents at all.
+	resp := s.req(t, http.MethodGet, "/api/stats/incidents", nil)
+	if resp.StatusCode != http.StatusOK {
+		resp.Body.Close()
+		t.Fatalf("expected 200 on an empty database, got %d", resp.StatusCode)
+	}
+	var stats map[string]any
+	decode(t, resp, &stats)
+	for _, k := range []string{"total", "triggered", "acknowledged", "resolved"} {
+		if stats[k].(float64) != 0 {
+			t.Errorf("expected %s 0, got %v", k, stats[k])
+		}
+	}
+
+	// And with every incident archived out of the window.
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-s4", "Gone", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+	s.req(t, http.MethodPost, "/api/incidents/1/archive", nil).Body.Close()
+
+	resp = s.req(t, http.MethodGet, "/api/stats/incidents", nil)
+	if resp.StatusCode != http.StatusOK {
+		resp.Body.Close()
+		t.Fatalf("expected 200 when every incident is archived, got %d", resp.StatusCode)
+	}
+	stats = nil
+	decode(t, resp, &stats)
+	if stats["total"].(float64) != 0 {
+		t.Errorf("expected total 0, got %v", stats["total"])
+	}
+}
+
+// The alert stats share the same aggregate, and the same empty-window trap.
+func TestStats_AlertsEmptyWindowIsZeroNotAnError(t *testing.T) {
+	s := newTS(t)
+	resp := s.req(t, http.MethodGet, "/api/stats/alerts", nil)
+	if resp.StatusCode != http.StatusOK {
+		resp.Body.Close()
+		t.Fatalf("expected 200 on an empty database, got %d", resp.StatusCode)
+	}
+	var stats map[string]any
+	decode(t, resp, &stats)
+	for _, k := range []string{"total", "firing", "resolved"} {
+		if stats[k].(float64) != 0 {
+			t.Errorf("expected %s 0, got %v", k, stats[k])
+		}
+	}
+}
+
+// Nothing acknowledged yet means "no data", which is not the same claim as zero.
+func TestStats_IncidentsNullMTTAWhenNothingAcknowledged(t *testing.T) {
+	s := newTS(t)
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-s3", "Untouched", "firing", "2026-05-20T10:00:00Z", zeroTime, nil),
+	})
+
+	var stats map[string]any
+	decode(t, s.req(t, http.MethodGet, "/api/stats/incidents", nil), &stats)
+	if stats["mtta_seconds"] != nil {
+		t.Errorf("expected mtta_seconds null, got %v", stats["mtta_seconds"])
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Migration backfill
+// ---------------------------------------------------------------------------
+
+// An upgrade must not drop the acknowledgements and comments people already
+// have, so 008 is replayed here over a database left at 007.
+func TestMigration_BackfillCarriesAckAndComments(t *testing.T) {
+	database, err := db.Open(":memory:")
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { database.Close() })
+
+	files, err := filepath.Glob("../db/migrations/*.sql")
+	if err != nil || len(files) == 0 {
+		t.Fatalf("find migrations: %v", err)
+	}
+	sort.Strings(files)
+
+	var incidentsMigration string
+	for _, f := range files {
+		if filepath.Base(f) >= "008" {
+			incidentsMigration = f
+			break
+		}
+		data, err := os.ReadFile(f)
+		if err != nil {
+			t.Fatalf("read %s: %v", f, err)
+		}
+		if _, err := database.Exec(string(data)); err != nil {
+			t.Fatalf("apply %s: %v", f, err)
+		}
+	}
+	if incidentsMigration == "" {
+		t.Fatal("008 migration not found")
+	}
+
+	// A database as it would look on the old schema: an acknowledged firing
+	// alert with a comment on it.
+	if _, err := database.Exec(`
+		INSERT INTO users (id, username, email) VALUES (1, 'admin', 'admin@test.com');
+		INSERT INTO alerts (id, fingerprint, name, status, labels, annotations,
+		                    starts_at, received_at, acknowledged_by, acknowledged_at)
+		VALUES (1, 'legacy-fp', 'LegacyAlert', 'firing',
+		        '{"severity":"warning"}', '{}', 1000, 1000, 1, 1500);
+		INSERT INTO alert_comments (alert_id, user_id, content, created_at)
+		VALUES (1, 1, 'legacy comment', 1600);`); err != nil {
+		t.Fatalf("seed pre-008 data: %v", err)
+	}
+
+	data, err := os.ReadFile(incidentsMigration)
+	if err != nil {
+		t.Fatalf("read 008: %v", err)
+	}
+	if _, err := database.Exec(string(data)); err != nil {
+		t.Fatalf("apply 008: %v", err)
+	}
+
+	var status, groupKey string
+	var ackBy int64
+	var severity string
+	if err := database.QueryRow(
+		"SELECT status, group_key, acknowledged_by, severity FROM incidents WHERE id = 1",
+	).Scan(&status, &groupKey, &ackBy, &severity); err != nil {
+		t.Fatalf("read backfilled incident: %v", err)
+	}
+	if status != "acknowledged" {
+		t.Errorf("expected the ack to carry over as status, got %q", status)
+	}
+	if groupKey != "backfill:legacy-fp" {
+		t.Errorf("unexpected group_key %q", groupKey)
+	}
+	if ackBy != 1 {
+		t.Errorf("expected acknowledged_by 1, got %d", ackBy)
+	}
+	if severity != "warning" {
+		t.Errorf("expected severity carried from labels, got %q", severity)
+	}
+
+	var notes int
+	if err := database.QueryRow(
+		"SELECT COUNT(*) FROM incident_events WHERE type = 'note' AND detail = 'legacy comment'",
+	).Scan(&notes); err != nil {
+		t.Fatalf("count notes: %v", err)
+	}
+	if notes != 1 {
+		t.Errorf("expected the comment to become a note, got %d", notes)
+	}
+
+	// And the columns that caused the ack-survives-a-re-fire bug are gone.
+	if _, err := database.Exec("SELECT acknowledged_by FROM alerts"); err == nil {
+		t.Error("expected alerts.acknowledged_by to be dropped")
+	}
+}
+
+func contains(haystack []string, needle string) bool {
+	for _, s := range haystack {
+		if s == needle {
+			return true
+		}
+	}
+	return false
+}
@@ -9,39 +9,105 @@ import (
 	"strings"
 	"time"

-	"github.com/yeniklas/terdut-server/internal/models"
+	"git.ryuvia.com/niklas/terdut-server/internal/models"
 )

 type contextKey string

-const ctxUser contextKey = "user"
+const (
+	ctxUser    contextKey = "user"
+	ctxSession contextKey = "session"
+)

+// AuthMiddleware accepts either of the two credentials the server issues: an
+// API key in an Authorization header (the TUI, scripts) or a session cookie
+// (the web UI). A request carrying a Bearer header is judged on that alone and
+// never falls back to the cookie.
+//
+// Only the cookie needs a CSRF guard. A browser attaches it to requests other
+// sites make, whereas an Authorization header is only ever set by the client
+// that holds the key.
 func AuthMiddleware(db *sql.DB) func(http.Handler) http.Handler {
+	crossOrigin := http.NewCrossOriginProtection()
+
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			token, ok := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
+			if header := r.Header.Get("Authorization"); header != "" {
+				token, ok := strings.CutPrefix(header, "Bearer ")
 				if !ok || token == "" {
 					respond(w, http.StatusUnauthorized, errResp("unauthorized"))
 					return
 				}
-
-			h := sha256.Sum256([]byte(token))
-			hash := hex.EncodeToString(h[:])
-
-			var keyID, userID int64
-			err := db.QueryRowContext(r.Context(),
-				"SELECT id, user_id FROM api_keys WHERE key_hash = ?", hash,
-			).Scan(&keyID, &userID)
-			if err != nil {
+				userID, ok := apiKeyUser(r.Context(), db, token)
+				if !ok {
 					respond(w, http.StatusUnauthorized, errResp("unauthorized"))
 					return
 				}
+				serveAs(w, r, next, db, userID, 0)
+				return
+			}
+
+			c, err := r.Cookie(sessionCookie)
+			if err != nil || c.Value == "" {
+				respond(w, http.StatusUnauthorized, errResp("unauthorized"))
+				return
+			}
+			sessionID, userID, ok := sessionUser(r.Context(), db, c.Value)
+			if !ok {
+				respond(w, http.StatusUnauthorized, errResp("unauthorized"))
+				return
+			}
+			if err := crossOrigin.Check(r); err != nil {
+				respond(w, http.StatusForbidden, errResp("cross-origin request rejected"))
+				return
+			}
+			serveAs(w, r, next, db, userID, sessionID)
+		})
+	}
+}
+
+// apiKeyUser resolves an API key to its user and stamps its last use.
+func apiKeyUser(ctx context.Context, db *sql.DB, token string) (int64, bool) {
+	var keyID, userID int64
+	err := db.QueryRowContext(ctx,
+		"SELECT id, user_id FROM api_keys WHERE key_hash = ?", hashToken(token),
+	).Scan(&keyID, &userID)
+	if err != nil {
+		return 0, false
+	}

 	// best-effort; don't fail the request if this update fails
-			db.ExecContext(r.Context(),
+	db.ExecContext(ctx,
 		"UPDATE api_keys SET last_used_at = ? WHERE id = ?",
 		time.Now().Unix(), keyID)
+	return userID, true
+}

+// sessionUser resolves a session token to its session and user. The expiry
+// slides forward with use, but at most once per sessionTouchEvery, so a page
+// that polls does not write to the database on every request.
+func sessionUser(ctx context.Context, db *sql.DB, token string) (sessionID, userID int64, ok bool) {
+	now := time.Now()
+	var lastSeen int64
+	err := db.QueryRowContext(ctx, `
+		SELECT id, user_id, last_seen_at FROM sessions
+		 WHERE token_hash = ? AND expires_at > ?`,
+		hashToken(token), now.Unix()).Scan(&sessionID, &userID, &lastSeen)
+	if err != nil {
+		return 0, 0, false
+	}
+
+	if now.Sub(time.Unix(lastSeen, 0)) > sessionTouchEvery {
+		db.ExecContext(ctx,
+			"UPDATE sessions SET last_seen_at = ?, expires_at = ? WHERE id = ?",
+			now.Unix(), now.Add(sessionTTL).Unix(), sessionID)
+	}
+	return sessionID, userID, true
+}
+
+// serveAs loads the user and hands the request on with it in the context.
+// sessionID is zero for API-key requests.
+func serveAs(w http.ResponseWriter, r *http.Request, next http.Handler, db *sql.DB, userID, sessionID int64) {
 	var u models.User
 	var createdUnix int64
 	if err := db.QueryRowContext(r.Context(),
@@ -52,12 +118,26 @@ func AuthMiddleware(db *sql.DB) func(http.Handler) http.Handler {
 	}
 	u.CreatedAt = time.Unix(createdUnix, 0).UTC()

-			next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), ctxUser, u)))
-		})
+	ctx := context.WithValue(r.Context(), ctxUser, u)
+	if sessionID != 0 {
+		ctx = context.WithValue(ctx, ctxSession, sessionID)
 	}
+	next.ServeHTTP(w, r.WithContext(ctx))
+}
+
+func hashToken(token string) string {
+	h := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(h[:])
 }

 func userFromContext(ctx context.Context) (models.User, bool) {
 	u, ok := ctx.Value(ctxUser).(models.User)
 	return u, ok
 }
+
+// sessionFromContext returns the id of the session a request was authenticated
+// with, or false for an API-key request.
+func sessionFromContext(ctx context.Context) (int64, bool) {
+	id, ok := ctx.Value(ctxSession).(int64)
+	return id, ok
+}
@@ -0,0 +1,565 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/models"
+)
+
+const (
+	// notifyInterval is how often the notifier looks for work. The archiver's
+	// 15 minute tick is far too coarse for something that has to wake a person.
+	notifyInterval = 30 * time.Second
+
+	// notifyRetryBase and notifyRetryMax bound the delivery backoff. ntfy being
+	// briefly unreachable should not lose the page.
+	notifyRetryBase = 30 * time.Second
+	notifyRetryMax  = 15 * time.Minute
+
+	// notifyMaxAttempts stops a permanently undeliverable row from being retried
+	// forever. It keeps last_error so the reason survives.
+	notifyMaxAttempts = 8
+
+	// notifyBatch caps one delivery pass, so a large backlog cannot hold the
+	// single database connection for an unbounded stretch.
+	notifyBatch = 100
+
+	// ackTokenTTL is how long the Acknowledge button in a notification keeps
+	// working. Past this the notification is stale enough that the responder
+	// should look at the incident rather than blind-acknowledge it.
+	ackTokenTTL = 24 * time.Hour
+)
+
+// Notification kinds, recording why a push was sent.
+const (
+	notifyTriggered = "triggered"
+	notifyReminder  = "reminder"
+	notifyResolved  = "resolved"
+)
+
+// Timeline event types the notifier writes, so an incident's history says who
+// was paged and whether the page landed. Written from the delivery result
+// rather than at enqueue: a queued notification is an intention, and claiming
+// somebody was told before ntfy accepted it would be a lie the timeline keeps.
+//
+// The topic is deliberately absent from both. It is a shared secret with the
+// ntfy server — anyone holding it can publish to it — and the timeline is
+// readable by every API key.
+const (
+	eventNotified     = "notified"
+	eventNotifyFailed = "notify_failed"
+)
+
+// NotifyConfig is everything the notifier needs to reach ntfy and to build URLs
+// a phone can follow back to this server.
+type NotifyConfig struct {
+	// BaseURL is the ntfy server. Empty disables notifications entirely: no
+	// goroutine, and nothing is ever enqueued.
+	BaseURL string
+
+	// Token is an optional bearer token for an access-controlled ntfy.
+	Token string
+
+	// FallbackTopic receives incidents that open with nobody on call. Those
+	// notifications carry no Acknowledge button — there is no user to attribute
+	// the acknowledgement to, and putting one on a shared topic would let any
+	// subscriber acknowledge as somebody else.
+	FallbackTopic string
+
+	// PublicURL is the base URL a phone uses to reach this server, for the
+	// notification's click target and its Acknowledge action. Without it a
+	// notification is informational only.
+	PublicURL string
+
+	// RepeatEvery is how long an incident may sit unacknowledged before it is
+	// notified again. Zero disables reminders.
+	RepeatEvery time.Duration
+}
+
+// enabled reports whether notifications are configured at all.
+func (c NotifyConfig) enabled() bool { return c.BaseURL != "" }
+
+// notifyClient is shared: a page is small and infrequent, and the timeout is
+// what keeps a hung ntfy from stalling the delivery pass.
+var notifyClient = &http.Client{Timeout: 10 * time.Second}
+
+// StartNotifier delivers queued notifications until ctx is cancelled, starting
+// with an immediate pass so a restart flushes whatever the last one left behind.
+func StartNotifier(ctx context.Context, db *sql.DB, cfg NotifyConfig) {
+	if !cfg.enabled() {
+		log.Print("notifier: disabled (no ntfy URL configured)")
+		return
+	}
+	log.Printf("notifier: publishing to %s", cfg.BaseURL)
+
+	ticker := time.NewTicker(notifyInterval)
+	defer ticker.Stop()
+
+	NotifySweep(ctx, db, cfg)
+	for {
+		select {
+		case <-ticker.C:
+			NotifySweep(ctx, db, cfg)
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+// NotifySweep runs a single pass: queue reminders for incidents nobody has
+// picked up, then deliver everything that is due. Reminders are queued first so
+// a freshly due one goes out in the same pass rather than a tick later.
+// Exported so tests can drive a pass without waiting on the ticker.
+func NotifySweep(ctx context.Context, db *sql.DB, cfg NotifyConfig) {
+	enqueueReminders(ctx, db, cfg)
+	deliverPending(ctx, db, cfg)
+}
+
+// enqueueReminders re-notifies incidents that are still sitting untouched.
+//
+// The stop conditions are the incident states that already mean "somebody has
+// this": acknowledged, snoozed, resolved, archived. Snooze in particular is the
+// mute button — a deliberate "not now" that should not keep buzzing — which is
+// why there is no separate reminder cap.
+//
+// The previous notification must have actually been sent before another is
+// queued, so an ntfy outage produces a retry backlog rather than a reminder
+// backlog that all lands at once when it comes back.
+func enqueueReminders(ctx context.Context, db *sql.DB, cfg NotifyConfig) {
+	if cfg.RepeatEvery <= 0 {
+		return
+	}
+	now := time.Now()
+
+	type due struct {
+		incidentID int64
+		userID     *int64
+		topic      string
+	}
+
+	rows, err := db.QueryContext(ctx, `
+		SELECT n.incident_id, n.user_id, n.topic
+		FROM   notifications n
+		JOIN   incidents i ON i.id = n.incident_id
+		WHERE  n.id = (SELECT MAX(id) FROM notifications WHERE incident_id = n.incident_id)
+		  AND  n.sent_at IS NOT NULL
+		  AND  n.created_at <= ?
+		  AND  i.resolved_at IS NULL
+		  AND  i.archived_at IS NULL
+		  AND  i.status = 'triggered'
+		  AND  (i.snoozed_until IS NULL OR i.snoozed_until <= ?)`,
+		now.Add(-cfg.RepeatEvery).Unix(), now.Unix())
+	if err != nil {
+		log.Printf("notifier: find reminders: %v", err)
+		return
+	}
+
+	// Collected before inserting: the pool is limited to a single connection, so
+	// an open cursor would block the writes behind it.
+	var pending []due
+	for rows.Next() {
+		var d due
+		if err := rows.Scan(&d.incidentID, &d.userID, &d.topic); err != nil {
+			rows.Close()
+			log.Printf("notifier: scan reminder: %v", err)
+			return
+		}
+		pending = append(pending, d)
+	}
+	if err := rows.Err(); err != nil {
+		rows.Close()
+		log.Printf("notifier: find reminders: %v", err)
+		return
+	}
+	rows.Close()
+
+	for _, d := range pending {
+		if err := enqueueNotification(ctx, db, d.incidentID, d.userID, d.topic, notifyReminder); err != nil {
+			log.Printf("notifier: queue reminder for incident %d: %v", d.incidentID, err)
+		}
+	}
+	if len(pending) > 0 {
+		log.Printf("notifier: queued %d reminder(s)", len(pending))
+	}
+}
+
+// outboxRow is one queued notification, read before any HTTP happens.
+type outboxRow struct {
+	id         int64
+	incidentID int64
+	userID     *int64
+	topic      string
+	kind       string
+	attempts   int
+}
+
+// deliverPending sends everything that is due and records the outcome.
+func deliverPending(ctx context.Context, db *sql.DB, cfg NotifyConfig) {
+	batch, err := pendingNotifications(ctx, db)
+	if err != nil {
+		log.Printf("notifier: find pending: %v", err)
+		return
+	}
+
+	sent := 0
+	for _, n := range batch {
+		if err := deliver(ctx, db, cfg, n); err != nil {
+			log.Printf("notifier: deliver %d (incident %d): %v", n.id, n.incidentID, err)
+			markFailed(ctx, db, n, err)
+			continue
+		}
+		if _, err := db.ExecContext(ctx,
+			"UPDATE notifications SET sent_at = ?, attempts = attempts + 1, last_error = NULL WHERE id = ?",
+			time.Now().Unix(), n.id); err != nil {
+			log.Printf("notifier: mark sent %d: %v", n.id, err)
+		}
+		// Logged, not returned: the page has already gone out, and treating a
+		// failed timeline write as a failed delivery would send it again.
+		if err := logEvent(ctx, db, n.incidentID, eventNotified, n.userID, nil, &n.kind); err != nil {
+			log.Printf("notifier: log delivery of %d: %v", n.id, err)
+		}
+		sent++
+	}
+	if sent > 0 {
+		log.Printf("notifier: delivered %d notification(s)", sent)
+	}
+}
+
+// pendingNotifications reads the due rows and closes the cursor before the
+// caller writes, for the same single-connection reason as staleAlertIDs.
+func pendingNotifications(ctx context.Context, db *sql.DB) ([]outboxRow, error) {
+	rows, err := db.QueryContext(ctx, `
+		SELECT id, incident_id, user_id, topic, kind, attempts
+		FROM   notifications
+		WHERE  sent_at IS NULL
+		  AND  send_after <= ?
+		  AND  attempts < ?
+		ORDER  BY id
+		LIMIT  ?`, time.Now().Unix(), notifyMaxAttempts, notifyBatch)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var batch []outboxRow
+	for rows.Next() {
+		var n outboxRow
+		if err := rows.Scan(&n.id, &n.incidentID, &n.userID, &n.topic, &n.kind, &n.attempts); err != nil {
+			return nil, err
+		}
+		batch = append(batch, n)
+	}
+	return batch, rows.Err()
+}
+
+// markFailed bumps the attempt count and pushes the row out to its next retry.
+//
+// The attempt that exhausts the budget also writes a timeline event. Without it
+// a page that never landed leaves the incident's history identical to one that
+// did, which is the failure most worth seeing: nobody was told, and nothing
+// says so.
+func markFailed(ctx context.Context, db *sql.DB, n outboxRow, cause error) {
+	next := time.Now().Add(retryDelay(n.attempts)).Unix()
+	if _, err := db.ExecContext(ctx,
+		"UPDATE notifications SET attempts = attempts + 1, send_after = ?, last_error = ? WHERE id = ?",
+		next, cause.Error(), n.id); err != nil {
+		log.Printf("notifier: mark failed %d: %v", n.id, err)
+	}
+
+	if n.attempts+1 < notifyMaxAttempts {
+		return
+	}
+	detail := fmt.Sprintf("%s: %s", n.kind, cause)
+	if err := logEvent(ctx, db, n.incidentID, eventNotifyFailed, n.userID, nil, &detail); err != nil {
+		log.Printf("notifier: log failure of %d: %v", n.id, err)
+	}
+}
+
+// retryDelay doubles the wait per attempt, up to notifyRetryMax.
+func retryDelay(attempts int) time.Duration {
+	d := notifyRetryBase << attempts
+	if d > notifyRetryMax || d <= 0 {
+		return notifyRetryMax
+	}
+	return d
+}
+
+// deliver renders one notification against the incident's *current* state and
+// publishes it. Rendering happens here rather than at enqueue time so a message
+// that waited in the queue while its incident escalated goes out at the
+// severity the incident has now.
+func deliver(ctx context.Context, db *sql.DB, cfg NotifyConfig, n outboxRow) error {
+	inc, err := fetchIncident(ctx, db, n.incidentID)
+	if err != nil {
+		return fmt.Errorf("load incident: %w", err)
+	}
+
+	var firing int
+	if err := db.QueryRowContext(ctx, `
+		SELECT COUNT(*)
+		FROM   incident_alerts ia
+		JOIN   alerts a ON a.id = ia.alert_id
+		WHERE  ia.incident_id = ? AND a.status = 'firing'`, n.incidentID).Scan(&firing); err != nil {
+		return fmt.Errorf("count firing: %w", err)
+	}
+
+	msg := renderNotification(inc, n, firing, cfg)
+
+	// An Acknowledge button needs both a user to attribute the acknowledgement
+	// to and a URL the phone can reach. Minted per delivery, so every push
+	// carries its own short-lived token rather than reusing one.
+	if n.kind != notifyResolved && n.userID != nil && cfg.PublicURL != "" {
+		raw, err := issueAckToken(ctx, db, n.incidentID, *n.userID)
+		if err != nil {
+			return fmt.Errorf("issue ack token: %w", err)
+		}
+		msg.Actions = append(msg.Actions, ntfyAction{
+			Action: "http",
+			Label:  "Acknowledge",
+			URL:    strings.TrimSuffix(cfg.PublicURL, "/") + "/api/notify/ack/" + raw,
+			Method: "POST",
+			Clear:  true,
+		})
+	}
+
+	return publish(ctx, cfg, msg)
+}
+
+// ntfyMessage is ntfy's JSON publish format. Using it rather than the X-Actions
+// header avoids that header's comma and quote escaping rules, which are easy to
+// break with a title that happens to contain a comma.
+type ntfyMessage struct {
+	Topic    string       `json:"topic"`
+	Title    string       `json:"title,omitempty"`
+	Message  string       `json:"message"`
+	Priority int          `json:"priority,omitempty"`
+	Tags     []string     `json:"tags,omitempty"`
+	Click    string       `json:"click,omitempty"`
+	Actions  []ntfyAction `json:"actions,omitempty"`
+}
+
+type ntfyAction struct {
+	Action string `json:"action"`
+	Label  string `json:"label"`
+	URL    string `json:"url"`
+	Method string `json:"method,omitempty"`
+	Clear  bool   `json:"clear,omitempty"`
+}
+
+// renderNotification builds the message body for one queued notification.
+func renderNotification(inc models.Incident, n outboxRow, firing int, cfg NotifyConfig) ntfyMessage {
+	msg := ntfyMessage{Topic: n.topic}
+
+	if cfg.PublicURL != "" {
+		// The web UI's page for the incident, so tapping the notification
+		// opens something a browser can use.
+		msg.Click = fmt.Sprintf("%s/incidents/%d",
+			strings.TrimSuffix(cfg.PublicURL, "/"), inc.ID)
+	}
+
+	switch n.kind {
+	case notifyResolved:
+		msg.Title = "Resolved: " + inc.Title
+		msg.Message = "All alerts stopped firing after " +
+			humanDuration(time.Since(inc.TriggeredAt))
+		msg.Priority = ntfyPriorityLow
+		msg.Tags = []string{"white_check_mark"}
+		return msg
+
+	case notifyReminder:
+		msg.Title = "Still unacknowledged: " + inc.Title
+	default:
+		msg.Title = inc.Title
+	}
+
+	severity := derefString(inc.Severity)
+
+	parts := []string{fmt.Sprintf("%d alert%s firing", firing, plural(firing))}
+	if severity != "" {
+		parts = append(parts, "severity "+severity)
+	}
+	if assignee := derefString(inc.AssignedToUser); assignee != "" {
+		parts = append(parts, "on call: "+assignee)
+	}
+	if n.kind == notifyReminder {
+		parts = append(parts, "open "+humanDuration(time.Since(inc.TriggeredAt)))
+	}
+
+	msg.Message = strings.Join(parts, " · ")
+	msg.Priority = ntfyPriority(severity)
+	msg.Tags = []string{severityTag(severity)}
+	return msg
+}
+
+// ntfy's priority scale. Max is the one that overrides the phone's quiet
+// settings, which is the whole point of paging on critical.
+const (
+	ntfyPriorityLow     = 2
+	ntfyPriorityDefault = 3
+	ntfyPriorityHigh    = 4
+	ntfyPriorityMax     = 5
+)
+
+// ntfyPriority maps an incident's severity onto ntfy's scale, following the
+// same ordering severityRank uses. An unrecognised severity gets the default
+// rather than being silenced.
+func ntfyPriority(severity string) int {
+	switch severityRank(severity) {
+	case 4:
+		return ntfyPriorityMax
+	case 3:
+		return ntfyPriorityHigh
+	case 2:
+		return ntfyPriorityDefault
+	case 1:
+		return ntfyPriorityLow
+	default:
+		return ntfyPriorityDefault
+	}
+}
+
+func severityTag(severity string) string {
+	switch severityRank(severity) {
+	case 4:
+		return "rotating_light"
+	case 3:
+		return "red_circle"
+	case 2:
+		return "warning"
+	case 1:
+		return "information_source"
+	default:
+		return "bell"
+	}
+}
+
+// publish POSTs one message to ntfy.
+func publish(ctx context.Context, cfg NotifyConfig, msg ntfyMessage) error {
+	body, err := json.Marshal(msg)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
+		strings.TrimSuffix(cfg.BaseURL, "/"), bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if cfg.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+cfg.Token)
+	}
+
+	resp, err := notifyClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("ntfy returned %s", resp.Status)
+	}
+	return nil
+}
+
+// enqueueNotification adds one row to the outbox, due immediately.
+func enqueueNotification(ctx context.Context, q querier, incidentID int64, userID *int64, topic, kind string) error {
+	now := time.Now().Unix()
+	_, err := q.ExecContext(ctx, `
+		INSERT INTO notifications (incident_id, user_id, topic, kind, created_at, send_after)
+		VALUES (?, ?, ?, ?, ?, ?)`, incidentID, userID, topic, kind, now, now)
+	return err
+}
+
+// notifyTarget decides where a newly opened incident's notification goes.
+//
+// The on-call user's own topic when they have one, otherwise the fallback
+// topic with no user attached. Deliberately not "the fallback topic, attributed
+// to the on-call user": the fallback is shared, and an Acknowledge button on a
+// shared topic would let any subscriber acknowledge as somebody else.
+func notifyTarget(ctx context.Context, q querier, cfg NotifyConfig, onCall *int64) (topic string, userID *int64) {
+	if onCall != nil {
+		var t *string
+		err := q.QueryRowContext(ctx,
+			"SELECT ntfy_topic FROM users WHERE id = ?", *onCall).Scan(&t)
+		if err == nil && t != nil && *t != "" {
+			return *t, onCall
+		}
+	}
+	return cfg.FallbackTopic, nil
+}
+
+// enqueueOpened queues the notification for a freshly opened incident. It is the
+// only enqueue point that has to resolve a topic from scratch; every later
+// notification for the incident reuses what this one chose.
+func enqueueOpened(ctx context.Context, q querier, cfg NotifyConfig, incidentID int64, onCall *int64) error {
+	if !cfg.enabled() {
+		return nil
+	}
+	topic, userID := notifyTarget(ctx, q, cfg, onCall)
+	if topic == "" {
+		// Nobody on call has a topic and there is no fallback: there is nowhere
+		// to send this, and queueing it would only accumulate undeliverable rows.
+		return nil
+	}
+	return enqueueNotification(ctx, q, incidentID, userID, topic, notifyTriggered)
+}
+
+// enqueueResolved queues the all-clear, reusing the topic the incident's last
+// notification went to. That needs no configuration to reach this function, and
+// it gives the right rule for free: you only hear that something resolved if you
+// were told it started.
+func enqueueResolved(ctx context.Context, q querier, incidentID int64) error {
+	var topic string
+	var userID *int64
+	err := q.QueryRowContext(ctx, `
+		SELECT topic, user_id FROM notifications
+		 WHERE incident_id = ? ORDER BY id DESC LIMIT 1`, incidentID).Scan(&topic, &userID)
+	if err == sql.ErrNoRows {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	return enqueueNotification(ctx, q, incidentID, userID, topic, notifyResolved)
+}
+
+// humanDuration renders an age the way a person reads it at 3am: coarse, and
+// never more than two units.
+func humanDuration(d time.Duration) string {
+	if d < time.Minute {
+		return "less than a minute"
+	}
+	if d < time.Hour {
+		return fmt.Sprintf("%dm", int(d.Minutes()))
+	}
+	h := int(d.Hours())
+	m := int(d.Minutes()) - h*60
+	if m == 0 {
+		return fmt.Sprintf("%dh", h)
+	}
+	return fmt.Sprintf("%dh%dm", h, m)
+}
+
+func plural(n int) string {
+	if n == 1 {
+		return ""
+	}
+	return "s"
+}
+
+// derefString reads a nullable text column as a plain string.
+func derefString(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
@@ -0,0 +1,98 @@
+package api
+
+import (
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// issueAckToken mints the secret behind one notification's Acknowledge button
+// and returns the raw value to embed in its URL. Only the hash is stored, the
+// same way api_keys works.
+//
+// A fresh token per delivery rather than one per incident: the raw value only
+// exists for as long as it takes to build the message, so there is nothing to
+// look up and reuse later, and a reminder that supersedes an earlier page
+// carries its own credential.
+func issueAckToken(ctx context.Context, q querier, incidentID, userID int64) (string, error) {
+	raw, hash, err := randomToken()
+	if err != nil {
+		return "", err
+	}
+	now := time.Now()
+	if _, err := q.ExecContext(ctx, `
+		INSERT INTO incident_ack_tokens (token_hash, incident_id, user_id, created_at, expires_at)
+		VALUES (?, ?, ?, ?, ?)`,
+		hash, incidentID, userID, now.Unix(), now.Add(ackTokenTTL).Unix()); err != nil {
+		return "", err
+	}
+	return raw, nil
+}
+
+// handleNotifyAck acknowledges an incident from the Acknowledge button in a
+// push notification.
+//
+// It is deliberately outside AuthMiddleware: the caller is a phone acting on a
+// notification, not a client holding an API key. What stands in for the key is
+// the token in the path — 256 bits of entropy, valid for one incident, one
+// action, and one day. It must stay publicly reachable for the button to work
+// when the responder is off the cluster network.
+func handleNotifyAck(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		h := sha256.Sum256([]byte(chi.URLParam(r, "token")))
+		hash := hex.EncodeToString(h[:])
+
+		var incidentID, userID int64
+		err := db.QueryRowContext(r.Context(), `
+			SELECT incident_id, user_id FROM incident_ack_tokens
+			 WHERE token_hash = ? AND expires_at > ?`,
+			hash, time.Now().Unix()).Scan(&incidentID, &userID)
+		if err != nil {
+			// Unknown and expired get the same answer, so the endpoint cannot be
+			// used to probe which tokens once existed.
+			respond(w, http.StatusNotFound, errResp("invalid or expired token"))
+			return
+		}
+
+		acked, err := acknowledgeIncident(r.Context(), db, incidentID, userID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if !acked {
+			// The incident closed between the page and the tap. Nothing to do,
+			// and nothing the responder did wrong — report the state, not an error,
+			// so ntfy shows a success toast rather than a failure.
+			respond(w, http.StatusOK, map[string]any{
+				"incident_id": incidentID,
+				"status":      "resolved",
+			})
+			return
+		}
+		respond(w, http.StatusOK, map[string]any{
+			"incident_id": incidentID,
+			"status":      "acknowledged",
+		})
+	}
+}
+
+// purgeAckTokens drops tokens whose notifications are long past. Nothing else
+// deletes them: incidents are archived rather than removed, so the cascade never
+// fires in practice.
+func purgeAckTokens(ctx context.Context, db *sql.DB) {
+	res, err := db.ExecContext(ctx,
+		"DELETE FROM incident_ack_tokens WHERE expires_at < ?", time.Now().Unix())
+	if err != nil {
+		log.Printf("sweeper: purge ack tokens: %v", err)
+		return
+	}
+	if n, _ := res.RowsAffected(); n > 0 {
+		log.Printf("sweeper: purged %d expired ack token(s)", n)
+	}
+}
@@ -0,0 +1,724 @@
+package api_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/api"
+)
+
+// ---------------------------------------------------------------------------
+// Fake ntfy
+// ---------------------------------------------------------------------------
+
+// pushed is one message the fake ntfy received, in ntfy's JSON publish shape.
+type pushed struct {
+	Topic    string   `json:"topic"`
+	Title    string   `json:"title"`
+	Message  string   `json:"message"`
+	Priority int      `json:"priority"`
+	Tags     []string `json:"tags"`
+	Click    string   `json:"click"`
+	Actions  []struct {
+		Action string `json:"action"`
+		Label  string `json:"label"`
+		URL    string `json:"url"`
+		Method string `json:"method"`
+		Clear  bool   `json:"clear"`
+	} `json:"actions"`
+}
+
+// fakeNtfy records what the notifier published. status controls the reply, so a
+// test can make delivery fail.
+type fakeNtfy struct {
+	*httptest.Server
+	mu     sync.Mutex
+	got    []pushed
+	status int
+}
+
+func newFakeNtfy(t *testing.T) *fakeNtfy {
+	t.Helper()
+	f := &fakeNtfy{status: http.StatusOK}
+	f.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var msg pushed
+		if err := json.NewDecoder(r.Body).Decode(&msg); err != nil {
+			http.Error(w, "bad json", http.StatusBadRequest)
+			return
+		}
+		f.mu.Lock()
+		f.got = append(f.got, msg)
+		status := f.status
+		f.mu.Unlock()
+		w.WriteHeader(status)
+	}))
+	t.Cleanup(f.Close)
+	return f
+}
+
+func (f *fakeNtfy) messages() []pushed {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]pushed(nil), f.got...)
+}
+
+func (f *fakeNtfy) failWith(status int) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.status = status
+}
+
+// ---------------------------------------------------------------------------
+// Harness
+// ---------------------------------------------------------------------------
+
+// notifyTS builds a server with notifications enabled, the admin on call today,
+// and a topic on the admin — the setup every delivery test needs.
+func notifyTS(t *testing.T, cfg api.NotifyConfig) (*ts, *fakeNtfy) {
+	t.Helper()
+	f := newFakeNtfy(t)
+	cfg.BaseURL = f.URL
+	s := newTS(t, cfg)
+
+	putOnCall(t, s, 1)
+	setTopic(t, s, 1, "terdut-admin")
+	return s, f
+}
+
+func putOnCall(t *testing.T, s *ts, userID int) {
+	t.Helper()
+	today := time.Now().UTC().Format("2006-01-02")
+	resp := s.req(t, http.MethodPost, "/api/schedule",
+		map[string]any{"user_id": userID, "dates": []string{today}})
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("schedule assignment returned %d", resp.StatusCode)
+	}
+}
+
+func setTopic(t *testing.T, s *ts, userID int, topic string) {
+	t.Helper()
+	resp := s.req(t, http.MethodPut,
+		fmt.Sprintf("/api/users/%d/notify", userID), map[string]any{"ntfy_topic": topic})
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("set notify topic returned %d", resp.StatusCode)
+	}
+}
+
+func (s *ts) sweepNotify(t *testing.T) {
+	t.Helper()
+	api.NotifySweep(context.Background(), s.db, s.notify)
+}
+
+// countNotifications reports how many outbox rows exist, optionally of one kind.
+func (s *ts) countNotifications(t *testing.T, kind string) int {
+	t.Helper()
+	var n int
+	query := "SELECT COUNT(*) FROM notifications"
+	args := []any{}
+	if kind != "" {
+		query += " WHERE kind = ?"
+		args = append(args, kind)
+	}
+	if err := s.db.QueryRow(query, args...).Scan(&n); err != nil {
+		t.Fatalf("count notifications: %v", err)
+	}
+	return n
+}
+
+// fireCritical posts a single critical alert, which opens one incident.
+func fireCritical(t *testing.T, s *ts) {
+	t.Helper()
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-notify", "DiskFull", "firing", "2026-05-20T10:00:00Z", zeroTime,
+			map[string]string{"severity": "critical"}),
+	}, "{}:{alertname=\"DiskFull\"}")
+}
+
+// ---------------------------------------------------------------------------
+// Delivery
+// ---------------------------------------------------------------------------
+
+func TestNotify_TriggeredIncidentPagesOnCall(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+
+	if got := s.countNotifications(t, "triggered"); got != 1 {
+		t.Fatalf("expected 1 queued notification, got %d", got)
+	}
+	s.sweepNotify(t)
+
+	msgs := f.messages()
+	if len(msgs) != 1 {
+		t.Fatalf("expected 1 push, got %d", len(msgs))
+	}
+	m := msgs[0]
+
+	if m.Topic != "terdut-admin" {
+		t.Errorf("expected the on-call user's topic, got %q", m.Topic)
+	}
+	if m.Priority != 5 {
+		t.Errorf("expected max priority for a critical incident, got %d", m.Priority)
+	}
+	if !strings.Contains(m.Title, "DiskFull") {
+		t.Errorf("expected the incident title in %q", m.Title)
+	}
+	if !strings.Contains(m.Message, "severity critical") {
+		t.Errorf("expected the severity in %q", m.Message)
+	}
+	if m.Click != "https://terdut.example.com/incidents/1" {
+		t.Errorf("unexpected click target %q", m.Click)
+	}
+	if len(m.Actions) != 1 || m.Actions[0].Label != "Acknowledge" {
+		t.Fatalf("expected an Acknowledge action, got %+v", m.Actions)
+	}
+	if m.Actions[0].Method != http.MethodPost {
+		t.Errorf("expected the action to POST, got %q", m.Actions[0].Method)
+	}
+}
+
+// A delivered row must not be delivered again on the next pass.
+func TestNotify_DeliveredOnlyOnce(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+	s.sweepNotify(t)
+
+	if got := len(f.messages()); got != 1 {
+		t.Errorf("expected 1 push across two passes, got %d", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Delivery on the timeline
+// ---------------------------------------------------------------------------
+
+// notifyEvents picks the notifier's entries out of an incident's timeline.
+// Asserted through the API rather than the table: the timeline is what the
+// clients read, so its shape is the contract worth covering.
+func notifyEvents(t *testing.T, s *ts, id int) []map[string]any {
+	t.Helper()
+	var out []map[string]any
+	for _, e := range timeline(t, s, id) {
+		if e["type"] == "notified" || e["type"] == "notify_failed" {
+			out = append(out, e)
+		}
+	}
+	return out
+}
+
+func TestNotify_DeliveryIsRecordedOnTheTimeline(t *testing.T) {
+	s, _ := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	// Queued is not notified: nothing is on the timeline until ntfy accepts it.
+	if got := notifyEvents(t, s, 1); len(got) != 0 {
+		t.Fatalf("expected no event before delivery, got %v", got)
+	}
+
+	s.sweepNotify(t)
+
+	events := notifyEvents(t, s, 1)
+	if len(events) != 1 {
+		t.Fatalf("expected 1 notification event, got %v", events)
+	}
+	e := events[0]
+	if e["type"] != "notified" {
+		t.Errorf("expected a notified event, got %v", e["type"])
+	}
+	if e["detail"] != "triggered" {
+		t.Errorf("expected the kind in detail, got %v", e["detail"])
+	}
+	if e["username"] != "admin" {
+		t.Errorf("expected the paged user attached, got %v", e["username"])
+	}
+	// The topic is a shared secret with ntfy; the timeline is not the place for it.
+	for _, v := range e {
+		if s, ok := v.(string); ok && strings.Contains(s, "terdut-admin") {
+			t.Errorf("expected the topic kept out of the timeline, found it in %v", e)
+		}
+	}
+}
+
+// A redelivery-free pass must not double-log either.
+func TestNotify_TimelineRecordsOneEventPerDelivery(t *testing.T) {
+	s, _ := notifyTS(t, api.NotifyConfig{
+		PublicURL:   "https://terdut.example.com",
+		RepeatEvery: 15 * time.Minute,
+	})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+	s.sweepNotify(t)
+	s.ageNotifications(t, 20*time.Minute)
+	s.sweepNotify(t)
+
+	events := notifyEvents(t, s, 1)
+	if len(events) != 2 {
+		t.Fatalf("expected one event per delivery, got %v", events)
+	}
+	if events[0]["detail"] != "triggered" || events[1]["detail"] != "reminder" {
+		t.Errorf("expected triggered then reminder, got %v and %v",
+			events[0]["detail"], events[1]["detail"])
+	}
+}
+
+func TestNotify_AllClearIsRecordedOnTheTimeline(t *testing.T) {
+	s, _ := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-notify", "DiskFull", "resolved", "2026-05-20T10:00:00Z",
+			"2026-05-20T11:00:00Z", map[string]string{"severity": "critical"}),
+	}, "{}:{alertname=\"DiskFull\"}")
+	s.sweepNotify(t)
+
+	events := notifyEvents(t, s, 1)
+	if len(events) != 2 {
+		t.Fatalf("expected the all-clear recorded, got %v", events)
+	}
+	if events[1]["detail"] != "resolved" {
+		t.Errorf("expected a resolved event, got %v", events[1]["detail"])
+	}
+}
+
+// A page to the shared fallback belongs to nobody, and the timeline has to say
+// so rather than attributing it to whoever happens to be on call now.
+func TestNotify_FallbackDeliveryHasNoUser(t *testing.T) {
+	f := newFakeNtfy(t)
+	s := newTS(t, api.NotifyConfig{
+		BaseURL:       f.URL,
+		FallbackTopic: "terdut-oncall",
+		PublicURL:     "https://terdut.example.com",
+	})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	events := notifyEvents(t, s, 1)
+	if len(events) != 1 {
+		t.Fatalf("expected 1 notification event, got %v", events)
+	}
+	if got, ok := events[0]["username"]; ok && got != nil && got != "" {
+		t.Errorf("expected no user on a fallback-topic page, got %v", got)
+	}
+}
+
+// The failure worth seeing: nobody was paged, and the timeline says so instead
+// of looking exactly like a delivery that worked.
+func TestNotify_ExhaustedRetriesAreRecordedOnce(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+	f.failWith(http.StatusInternalServerError)
+
+	fireCritical(t, s)
+	// One pass per attempt, each made due by clearing the backoff the last one set.
+	for i := 0; i < 10; i++ {
+		s.sweepNotify(t)
+		s.exec(t, "UPDATE notifications SET send_after = ? WHERE sent_at IS NULL",
+			time.Now().Add(-time.Second).Unix())
+	}
+
+	events := notifyEvents(t, s, 1)
+	if len(events) != 1 {
+		t.Fatalf("expected exactly one failure event, got %v", events)
+	}
+	if events[0]["type"] != "notify_failed" {
+		t.Errorf("expected notify_failed, got %v", events[0]["type"])
+	}
+	detail, _ := events[0]["detail"].(string)
+	if !strings.HasPrefix(detail, "triggered: ") || !strings.Contains(detail, "500") {
+		t.Errorf("expected the kind and the reason in %q", detail)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Acknowledging from the notification
+// ---------------------------------------------------------------------------
+
+func TestNotify_AckButtonAcknowledgesIncident(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	ackURL := f.messages()[0].Actions[0].URL
+	// The action URL is built for the public hostname; point it at the test
+	// server, which is the same handler.
+	path := ackURL[strings.Index(ackURL, "/api/notify/ack/"):]
+
+	resp, err := http.Post(s.URL+path, "application/json", nil)
+	if err != nil {
+		t.Fatalf("ack: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("expected 200 from the ack button, got %d", resp.StatusCode)
+	}
+
+	inc := getIncident(t, s, 1)
+	if inc["status"] != "acknowledged" {
+		t.Errorf("expected the incident acknowledged, got %v", inc["status"])
+	}
+	if inc["acknowledged_by"] != "admin" {
+		t.Errorf("expected the ack attributed to the token's user, got %v", inc["acknowledged_by"])
+	}
+
+	// The timeline must record it the same way the authenticated route would.
+	events := timeline(t, s, 1)
+	if !contains(eventTypes(events), "acknowledged") {
+		t.Errorf("expected an acknowledged event, got %v", eventTypes(events))
+	}
+	for _, e := range events {
+		if e["type"] == "acknowledged" && e["username"] != "admin" {
+			t.Errorf("expected the acknowledged event attributed to admin, got %v", e["username"])
+		}
+	}
+}
+
+func TestNotify_AckRejectsUnknownToken(t *testing.T) {
+	s, _ := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+	fireCritical(t, s)
+
+	resp, err := http.Post(s.URL+"/api/notify/ack/deadbeef", "application/json", nil)
+	if err != nil {
+		t.Fatalf("ack: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("expected 404 for an unknown token, got %d", resp.StatusCode)
+	}
+	if inc := getIncident(t, s, 1); inc["status"] != "triggered" {
+		t.Errorf("expected the incident untouched, got %v", inc["status"])
+	}
+}
+
+func TestNotify_AckRejectsExpiredToken(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	ackURL := f.messages()[0].Actions[0].URL
+	path := ackURL[strings.Index(ackURL, "/api/notify/ack/"):]
+
+	// Age the token past its TTL. The token's inputs are wall-clock timestamps,
+	// so this is the same trick the sweeper tests use.
+	s.exec(t, "UPDATE incident_ack_tokens SET expires_at = ?", time.Now().Add(-time.Minute).Unix())
+
+	resp, err := http.Post(s.URL+path, "application/json", nil)
+	if err != nil {
+		t.Fatalf("ack: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("expected 404 for an expired token, got %d", resp.StatusCode)
+	}
+	if inc := getIncident(t, s, 1); inc["status"] != "triggered" {
+		t.Errorf("expected the incident untouched, got %v", inc["status"])
+	}
+}
+
+// The sweeper is what stops expired tokens accumulating forever.
+func TestNotify_SweepPurgesExpiredAckTokens(t *testing.T) {
+	s, _ := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+	s.exec(t, "UPDATE incident_ack_tokens SET expires_at = ?", time.Now().Add(-time.Minute).Unix())
+
+	api.Sweep(context.Background(), s.db, 168*time.Hour, 6*time.Hour, s.deadman, s.notify)
+
+	var n int
+	if err := s.db.QueryRow("SELECT COUNT(*) FROM incident_ack_tokens").Scan(&n); err != nil {
+		t.Fatalf("count tokens: %v", err)
+	}
+	if n != 0 {
+		t.Errorf("expected expired tokens purged, %d left", n)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Reminders
+// ---------------------------------------------------------------------------
+
+// ageNotifications backdates every sent notification so the next pass sees the
+// reminder as due.
+func (s *ts) ageNotifications(t *testing.T, by time.Duration) {
+	t.Helper()
+	s.exec(t, "UPDATE notifications SET created_at = ? WHERE sent_at IS NOT NULL",
+		time.Now().Add(-by).Unix())
+}
+
+func TestNotify_UnacknowledgedIncidentIsRenotified(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{
+		PublicURL:   "https://terdut.example.com",
+		RepeatEvery: 15 * time.Minute,
+	})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+	s.ageNotifications(t, 20*time.Minute)
+	s.sweepNotify(t)
+
+	msgs := f.messages()
+	if len(msgs) != 2 {
+		t.Fatalf("expected a reminder push, got %d message(s)", len(msgs))
+	}
+	if !strings.Contains(msgs[1].Title, "Still unacknowledged") {
+		t.Errorf("expected the reminder to say so, got %q", msgs[1].Title)
+	}
+	if msgs[1].Topic != "terdut-admin" {
+		t.Errorf("expected the reminder on the same topic, got %q", msgs[1].Topic)
+	}
+	// Each page carries its own credential.
+	if len(msgs[1].Actions) != 1 || msgs[1].Actions[0].URL == msgs[0].Actions[0].URL {
+		t.Errorf("expected the reminder to carry a fresh ack token")
+	}
+}
+
+func TestNotify_AcknowledgedIncidentStopsReminders(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{
+		PublicURL:   "https://terdut.example.com",
+		RepeatEvery: 15 * time.Minute,
+	})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/acknowledge", nil)
+	resp.Body.Close()
+
+	s.ageNotifications(t, 20*time.Minute)
+	s.sweepNotify(t)
+
+	if got := len(f.messages()); got != 1 {
+		t.Errorf("expected no reminder once acknowledged, got %d message(s)", got)
+	}
+}
+
+// Snooze is the deliberate "not now", and it is what mutes the pager.
+func TestNotify_SnoozedIncidentStopsReminders(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{
+		PublicURL:   "https://terdut.example.com",
+		RepeatEvery: 15 * time.Minute,
+	})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/snooze", map[string]any{"duration": "1h"})
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("snooze returned %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	s.ageNotifications(t, 20*time.Minute)
+	s.sweepNotify(t)
+
+	if got := len(f.messages()); got != 1 {
+		t.Errorf("expected no reminder while snoozed, got %d message(s)", got)
+	}
+}
+
+func TestNotify_ZeroRepeatDisablesReminders(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+	s.ageNotifications(t, 24*time.Hour)
+	s.sweepNotify(t)
+
+	if got := len(f.messages()); got != 1 {
+		t.Errorf("expected reminders off, got %d message(s)", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Resolution
+// ---------------------------------------------------------------------------
+
+func TestNotify_ResolvedIncidentSendsAllClear(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	postWebhook(t, s, []map[string]any{
+		amAlert("fp-notify", "DiskFull", "resolved", "2026-05-20T10:00:00Z",
+			"2026-05-20T11:00:00Z", map[string]string{"severity": "critical"}),
+	}, "{}:{alertname=\"DiskFull\"}")
+	s.sweepNotify(t)
+
+	msgs := f.messages()
+	if len(msgs) != 2 {
+		t.Fatalf("expected an all-clear push, got %d message(s)", len(msgs))
+	}
+	if !strings.HasPrefix(msgs[1].Title, "Resolved:") {
+		t.Errorf("expected a resolved title, got %q", msgs[1].Title)
+	}
+	if msgs[1].Priority != 2 {
+		t.Errorf("expected the all-clear at low priority, got %d", msgs[1].Priority)
+	}
+	// Nothing to acknowledge on a closed incident.
+	if len(msgs[1].Actions) != 0 {
+		t.Errorf("expected no actions on the all-clear, got %+v", msgs[1].Actions)
+	}
+}
+
+// Closing an incident by hand sends nothing: the person who did it knows.
+func TestNotify_ManualResolveSendsNothing(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	resp := s.req(t, http.MethodPost, "/api/incidents/1/resolve", nil)
+	resp.Body.Close()
+	s.sweepNotify(t)
+
+	if got := len(f.messages()); got != 1 {
+		t.Errorf("expected no push for a manual resolve, got %d message(s)", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Routing and configuration
+// ---------------------------------------------------------------------------
+
+// With nobody on call the page goes to the shared fallback, and carries no
+// Acknowledge button — there is no user to attribute the acknowledgement to.
+func TestNotify_FallbackTopicHasNoAckButton(t *testing.T) {
+	f := newFakeNtfy(t)
+	s := newTS(t, api.NotifyConfig{
+		BaseURL:       f.URL,
+		FallbackTopic: "terdut-oncall",
+		PublicURL:     "https://terdut.example.com",
+	})
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	msgs := f.messages()
+	if len(msgs) != 1 {
+		t.Fatalf("expected 1 push, got %d", len(msgs))
+	}
+	if msgs[0].Topic != "terdut-oncall" {
+		t.Errorf("expected the fallback topic, got %q", msgs[0].Topic)
+	}
+	if len(msgs[0].Actions) != 0 {
+		t.Errorf("expected no ack button on a shared topic, got %+v", msgs[0].Actions)
+	}
+}
+
+// Nobody on call and no fallback means there is nowhere to send: queueing would
+// only pile up rows that can never be delivered.
+func TestNotify_NoTargetQueuesNothing(t *testing.T) {
+	f := newFakeNtfy(t)
+	s := newTS(t, api.NotifyConfig{BaseURL: f.URL})
+
+	fireCritical(t, s)
+
+	if got := s.countNotifications(t, ""); got != 0 {
+		t.Errorf("expected nothing queued without a target, got %d", got)
+	}
+	s.sweepNotify(t)
+	if got := len(f.messages()); got != 0 {
+		t.Errorf("expected no push, got %d", got)
+	}
+}
+
+// The zero NotifyConfig is what every pre-existing test runs under.
+func TestNotify_DisabledQueuesNothing(t *testing.T) {
+	s := newTS(t)
+	putOnCall(t, s, 1)
+	setTopic(t, s, 1, "terdut-admin")
+
+	fireCritical(t, s)
+
+	if got := s.countNotifications(t, ""); got != 0 {
+		t.Errorf("expected nothing queued with notifications off, got %d", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Retries
+// ---------------------------------------------------------------------------
+
+func TestNotify_FailedDeliveryRetriesWithBackoff(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+	f.failWith(http.StatusInternalServerError)
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+
+	var attempts int
+	var sentAt *int64
+	var sendAfter int64
+	var lastError *string
+	if err := s.db.QueryRow(
+		"SELECT attempts, sent_at, send_after, last_error FROM notifications WHERE id = 1").
+		Scan(&attempts, &sentAt, &sendAfter, &lastError); err != nil {
+		t.Fatalf("read notification: %v", err)
+	}
+	if attempts != 1 {
+		t.Errorf("expected 1 attempt recorded, got %d", attempts)
+	}
+	if sentAt != nil {
+		t.Errorf("expected the row unsent, got sent_at %v", *sentAt)
+	}
+	if sendAfter <= time.Now().Unix() {
+		t.Errorf("expected the retry pushed into the future, got %d", sendAfter)
+	}
+	if lastError == nil || !strings.Contains(*lastError, "500") {
+		t.Errorf("expected the failure recorded, got %v", lastError)
+	}
+
+	// Backing off means the next pass leaves it alone until it is due.
+	s.sweepNotify(t)
+	if got := len(f.messages()); got != 1 {
+		t.Errorf("expected no immediate retry, got %d attempt(s)", got)
+	}
+
+	// Once due and once ntfy recovers, it goes out.
+	f.failWith(http.StatusOK)
+	s.exec(t, "UPDATE notifications SET send_after = ? WHERE id = 1", time.Now().Add(-time.Second).Unix())
+	s.sweepNotify(t)
+
+	if err := s.db.QueryRow("SELECT sent_at FROM notifications WHERE id = 1").Scan(&sentAt); err != nil {
+		t.Fatalf("read notification: %v", err)
+	}
+	if sentAt == nil {
+		t.Error("expected the retry to succeed once ntfy recovered")
+	}
+}
+
+// An ntfy outage must not produce a reminder backlog that all lands at once
+// when it comes back: the previous page has to have been sent first.
+func TestNotify_UnsentNotificationBlocksReminders(t *testing.T) {
+	s, f := notifyTS(t, api.NotifyConfig{
+		PublicURL:   "https://terdut.example.com",
+		RepeatEvery: 15 * time.Minute,
+	})
+	f.failWith(http.StatusInternalServerError)
+
+	fireCritical(t, s)
+	s.sweepNotify(t)
+	s.exec(t, "UPDATE notifications SET created_at = ?", time.Now().Add(-time.Hour).Unix())
+	s.sweepNotify(t)
+
+	if got := s.countNotifications(t, "reminder"); got != 0 {
+		t.Errorf("expected no reminders queued behind an undelivered page, got %d", got)
+	}
+}
@@ -4,11 +4,16 @@ import (
 	"database/sql"
 	"net/http"

+	"git.ryuvia.com/niklas/terdut-server/internal/web"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 )

-func NewRouter(db *sql.DB) http.Handler {
+// NewRouter builds the HTTP surface. notify and deadman are passed through to
+// the webhook, the only handler that has to decide where a new incident's page
+// goes and which arriving alerts are heartbeats rather than problems. A zero
+// notify disables notifications; a zero deadman disables dead man's switches.
+func NewRouter(db *sql.DB, notify NotifyConfig, deadman DeadmanConfig) http.Handler {
 	r := chi.NewRouter()
 	r.Use(middleware.Logger)
 	r.Use(middleware.Recoverer)
@@ -17,40 +22,76 @@ func NewRouter(db *sql.DB) http.Handler {
 		respond(w, http.StatusOK, map[string]string{"status": "ok"})
 	})

-	// Unauthenticated: bootstrap and Alertmanager webhook receiver.
+	// Unauthenticated: bootstrap, the Alertmanager webhook receiver, and the
+	// Acknowledge button in a push notification. The last one is authorised by
+	// the scoped token in its path rather than an API key, and has to stay
+	// reachable from outside the cluster for the button to work.
 	r.Post("/api/bootstrap", handleBootstrap(db))
-	r.Post("/api/alertmanager/webhook", handleAlertmanagerWebhook(db))
+	r.Post("/api/alertmanager/webhook", handleAlertmanagerWebhook(db, notify, deadman))
+	r.Post("/api/notify/ack/{token}", handleNotifyAck(db))
+
+	// Signing in to the web UI. Login trades a password for a session cookie,
+	// which AuthMiddleware accepts in place of an API key.
+	r.Post("/api/login", handleLogin(db, newLoginLimiter(), notify.PublicURL))
+	r.Post("/api/logout", handleLogout(db, notify.PublicURL))

 	// All other /api routes require a valid API key.
 	r.Group(func(r chi.Router) {
 		r.Use(AuthMiddleware(db))

+		r.Get("/api/me", handleMe(db))
 		r.Get("/api/users", handleListUsers(db))
 		r.Post("/api/users", handleCreateUser(db))
 		r.Delete("/api/users/{id}", handleDeleteUser(db))
+		r.Put("/api/users/{id}/notify", handleSetNotifyTarget(db))
+		r.Put("/api/users/{id}/password", handleSetPassword(db))
 		r.Post("/api/users/{id}/api-keys", handleCreateAPIKey(db))
 		r.Delete("/api/users/{id}/api-keys/{keyID}", handleDeleteAPIKey(db))

+		// Alerts are read-only: they are Alertmanager's record, not a work
+		// queue. Everything a person does happens on the incident instead.
 		r.Get("/api/alerts", handleListAlerts(db))
 		r.Get("/api/alerts/{id}", handleGetAlert(db))
-		r.Post("/api/alerts/{id}/acknowledge", handleAcknowledge(db))
-		r.Delete("/api/alerts/{id}/acknowledge", handleUnacknowledge(db))
-		r.Post("/api/alerts/{id}/archive", handleArchive(db))
-		r.Delete("/api/alerts/{id}/archive", handleUnarchive(db))
-		r.Get("/api/alerts/{id}/comments", handleListComments(db))
-		r.Post("/api/alerts/{id}/comments", handleCreateComment(db))
-		r.Delete("/api/alerts/{id}/comments/{commentID}", handleDeleteComment(db))
+
+		r.Get("/api/incidents", handleListIncidents(db))
+		r.Get("/api/incidents/{id}", handleGetIncident(db))
+		r.Get("/api/incidents/{id}/alerts", handleIncidentAlerts(db))
+		r.Get("/api/incidents/{id}/timeline", handleIncidentTimeline(db))
+		r.Post("/api/incidents/{id}/acknowledge", handleIncidentAcknowledge(db))
+		r.Delete("/api/incidents/{id}/acknowledge", handleIncidentUnacknowledge(db))
+		r.Post("/api/incidents/{id}/resolve", handleIncidentResolve(db))
+		r.Post("/api/incidents/{id}/assign", handleIncidentAssign(db))
+		r.Post("/api/incidents/{id}/snooze", handleIncidentSnooze(db))
+		r.Delete("/api/incidents/{id}/snooze", handleIncidentUnsnooze(db))
+		r.Post("/api/incidents/{id}/archive", handleIncidentArchive(db))
+		r.Delete("/api/incidents/{id}/archive", handleIncidentUnarchive(db))
+		r.Post("/api/incidents/{id}/notes", handleCreateNote(db))
+		r.Delete("/api/incidents/{id}/notes/{eventID}", handleDeleteNote(db))

 		r.Post("/api/schedule", handleCreateSchedule(db))
 		r.Get("/api/schedule/current", handleCurrentSchedule(db)) // must be before /{id}
 		r.Get("/api/schedule", handleListSchedule(db))
 		r.Delete("/api/schedule/{id}", handleDeleteSchedule(db))

+		r.Get("/api/stats/incidents", handleStatsIncidents(db))
 		r.Get("/api/stats/alerts", handleStatsAlerts(db))
 		r.Get("/api/stats/alerts/top", handleStatsTop(db))
 		r.Get("/api/stats/alerts/by-hour", handleStatsByHour(db))
 		r.Get("/api/stats/alerts/by-day", handleStatsByDay(db))
 	})

+	// Anything else under /api is a mistake in a client, and should say so in
+	// JSON rather than get the web UI's HTML.
+	r.Handle("/api/*", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		respond(w, http.StatusNotFound, errResp("not found"))
+	}))
+
+	// Everything outside /api is the web UI.
+	site, err := web.Handler()
+	if err != nil {
+		panic(err) // the site is embedded at build time; this cannot fail at runtime
+	}
+	r.Handle("/*", site)
+
 	return r
 }
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"time"

+	"git.ryuvia.com/niklas/terdut-server/internal/models"
 	"github.com/go-chi/chi/v5"
-	"github.com/yeniklas/terdut-server/internal/models"
 )

 func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
@@ -17,6 +17,12 @@ func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
 		var req struct {
 			UserID int64    `json:"user_id"`
 			Dates  []string `json:"dates"`
+
+			// Replace takes dates that somebody else already holds. It defaults
+			// to off so that the plain call cannot quietly move a shift off the
+			// person expecting to be paged for it — reassigning has to be asked
+			// for.
+			Replace bool `json:"replace"`
 		}
 		if err := decodeJSON(r, &req); err != nil {
 			respond(w, http.StatusBadRequest, errResp("invalid request body"))
@@ -44,7 +50,10 @@ func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
 			return
 		}

-		// All-or-nothing: if any date already has an assignment, reject the whole request.
+		// All-or-nothing, in both directions: without replace, one taken date
+		// rejects the whole request; with it, either every date moves or none
+		// does. The rota must never be left with a hole where a shift used to
+		// be, so the delete and the insert share one transaction.
 		tx, err := db.BeginTx(r.Context(), nil)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
@@ -53,10 +62,18 @@ func handleCreateSchedule(db *sql.DB) http.HandlerFunc {
 		defer tx.Rollback()

 		for _, d := range req.Dates {
+			if req.Replace {
+				if _, err := tx.ExecContext(r.Context(),
+					"DELETE FROM schedule_entries WHERE date = ?", d); err != nil {
+					respond(w, http.StatusInternalServerError, errResp("internal error"))
+					return
+				}
+			}
 			if _, err := tx.ExecContext(r.Context(),
 				"INSERT INTO schedule_entries (user_id, date) VALUES (?, ?)", req.UserID, d); err != nil {
 				if strings.Contains(err.Error(), "UNIQUE constraint failed") {
-					respond(w, http.StatusConflict, errResp("date already assigned: "+d))
+					respond(w, http.StatusConflict,
+						errResp("date already assigned: "+d+" (pass replace to take it)"))
 					return
 				}
 				respond(w, http.StatusInternalServerError, errResp("internal error"))
@@ -11,13 +11,16 @@ import (

 func handleStatsAlerts(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query())
+		where, args := statsFilter(r.URL.Query(), "received_at")

+		// COALESCE because SUM over zero rows is NULL, not 0, and a count of
+		// nothing is 0 — without it an empty window is a 500 rather than a
+		// legitimately empty report.
 		var total, firing, resolved int64
 		err := db.QueryRowContext(r.Context(), fmt.Sprintf(`
 			SELECT COUNT(*),
-			       SUM(CASE WHEN status = 'firing'   THEN 1 ELSE 0 END),
-			       SUM(CASE WHEN status = 'resolved' THEN 1 ELSE 0 END)
+			       COALESCE(SUM(CASE WHEN status = 'firing'   THEN 1 ELSE 0 END), 0),
+			       COALESCE(SUM(CASE WHEN status = 'resolved' THEN 1 ELSE 0 END), 0)
 			FROM alerts WHERE %s`, where), args...,
 		).Scan(&total, &firing, &resolved)
 		if err != nil {
@@ -34,7 +37,7 @@ func handleStatsAlerts(db *sql.DB) http.HandlerFunc {

 func handleStatsTop(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query())
+		where, args := statsFilter(r.URL.Query(), "received_at")

 		limit := 10
 		if l := r.URL.Query().Get("limit"); l != "" {
@@ -78,7 +81,7 @@ func handleStatsTop(db *sql.DB) http.HandlerFunc {

 func handleStatsByHour(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query())
+		where, args := statsFilter(r.URL.Query(), "received_at")

 		rows, err := db.QueryContext(r.Context(), fmt.Sprintf(`
 			SELECT CAST(strftime('%%H', datetime(received_at, 'unixepoch')) AS INTEGER) AS hr,
@@ -118,7 +121,7 @@ func handleStatsByHour(db *sql.DB) http.HandlerFunc {

 func handleStatsByDay(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		where, args := statsFilter(r.URL.Query())
+		where, args := statsFilter(r.URL.Query(), "received_at")

 		// SQLite strftime('%w') → 0=Sunday … 6=Saturday
 		rows, err := db.QueryContext(r.Context(), fmt.Sprintf(`
@@ -159,19 +162,62 @@ func handleStatsByDay(db *sql.DB) http.HandlerFunc {
 	}
 }

-// statsFilter builds a WHERE clause and args from optional ?from and ?to query params.
-// Archived alerts are always excluded, matching the default GET /api/alerts view.
-func statsFilter(q url.Values) (where string, args []any) {
+// handleStatsIncidents reports the queue and the two numbers a rota actually
+// cares about: how long it takes someone to pick work up, and how long it takes
+// to finish. Neither was computable before incidents existed — alert rows are
+// mutated in place and carry no acknowledgement or closure time.
+func handleStatsIncidents(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		where, args := statsFilter(r.URL.Query(), "triggered_at")
+
+		// The counts are COALESCEd because SUM over zero rows is NULL, not 0.
+		// The averages are not: mtta and mttr stay null on purpose, since zero
+		// would read as "instant" rather than "nothing to measure yet".
+		var total, triggered, acknowledged, resolved int64
+		var mtta, mttr *float64
+		err := db.QueryRowContext(r.Context(), fmt.Sprintf(`
+			SELECT COUNT(*),
+			       COALESCE(SUM(CASE WHEN status = 'triggered'    THEN 1 ELSE 0 END), 0),
+			       COALESCE(SUM(CASE WHEN status = 'acknowledged' THEN 1 ELSE 0 END), 0),
+			       COALESCE(SUM(CASE WHEN status = 'resolved'     THEN 1 ELSE 0 END), 0),
+			       AVG(CASE WHEN acknowledged_at IS NOT NULL
+			                THEN acknowledged_at - triggered_at END),
+			       AVG(CASE WHEN resolved_at IS NOT NULL
+			                THEN resolved_at - triggered_at END)
+			FROM incidents WHERE %s`, where), args...,
+		).Scan(&total, &triggered, &acknowledged, &resolved, &mtta, &mttr)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		respond(w, http.StatusOK, map[string]any{
+			"total":        total,
+			"triggered":    triggered,
+			"acknowledged": acknowledged,
+			"resolved":     resolved,
+			// Null until something has actually been acknowledged or resolved —
+			// zero would read as "instant", which is a different claim.
+			"mtta_seconds": mtta,
+			"mttr_seconds": mttr,
+		})
+	}
+}
+
+// statsFilter builds a WHERE clause and args from optional ?from and ?to query
+// params, filtering on timeCol. Archived rows are always excluded, matching the
+// default list views.
+func statsFilter(q url.Values, timeCol string) (where string, args []any) {
 	clauses := []string{"archived_at IS NULL"}
 	if from := q.Get("from"); from != "" {
 		if t, err := time.Parse("2006-01-02", from); err == nil {
-			clauses = append(clauses, "received_at >= ?")
+			clauses = append(clauses, timeCol+" >= ?")
 			args = append(args, t.UTC().Unix())
 		}
 	}
 	if to := q.Get("to"); to != "" {
 		if t, err := time.Parse("2006-01-02", to); err == nil {
-			clauses = append(clauses, "received_at < ?")
+			clauses = append(clauses, timeCol+" < ?")
 			args = append(args, t.UTC().AddDate(0, 0, 1).Unix())
 		}
 	}
@@ -11,8 +11,8 @@ import (
 	"strings"
 	"time"

+	"git.ryuvia.com/niklas/terdut-server/internal/models"
 	"github.com/go-chi/chi/v5"
-	"github.com/yeniklas/terdut-server/internal/models"
 )

 func handleBootstrap(db *sql.DB) http.HandlerFunc {
@@ -20,6 +20,9 @@ func handleBootstrap(db *sql.DB) http.HandlerFunc {
 		var req struct {
 			Username string `json:"username"`
 			Email    string `json:"email"`
+			// Password is optional; without one the first user can only use the
+			// API key until somebody sets it.
+			Password string `json:"password"`
 		}
 		if err := decodeJSON(r, &req); err != nil {
 			respond(w, http.StatusBadRequest, errResp("invalid request body"))
@@ -29,6 +32,19 @@ func handleBootstrap(db *sql.DB) http.HandlerFunc {
 			respond(w, http.StatusBadRequest, errResp("username and email are required"))
 			return
 		}
+		var passwordHash *string
+		if req.Password != "" {
+			if msg := validatePassword(req.Password); msg != "" {
+				respond(w, http.StatusBadRequest, errResp(msg))
+				return
+			}
+			h, err := hashPassword(req.Password)
+			if err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			}
+			passwordHash = &h
+		}

 		var count int
 		if err := db.QueryRowContext(r.Context(), "SELECT COUNT(*) FROM users").Scan(&count); err != nil {
@@ -41,14 +57,15 @@ func handleBootstrap(db *sql.DB) http.HandlerFunc {
 		}

 		res, err := db.ExecContext(r.Context(),
-			"INSERT INTO users (username, email) VALUES (?, ?)", req.Username, req.Email)
+			"INSERT INTO users (username, email, password_hash) VALUES (?, ?, ?)",
+			req.Username, req.Email, passwordHash)
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
 		}
 		userID, _ := res.LastInsertId()

-		raw, hash, err := newAPIKey()
+		raw, hash, err := randomToken()
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -70,7 +87,7 @@ func handleBootstrap(db *sql.DB) http.HandlerFunc {
 func handleListUsers(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		rows, err := db.QueryContext(r.Context(),
-			"SELECT id, username, email, created_at FROM users ORDER BY id")
+			"SELECT id, username, email, created_at, ntfy_topic FROM users ORDER BY id")
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -81,7 +98,7 @@ func handleListUsers(db *sql.DB) http.HandlerFunc {
 		for rows.Next() {
 			var u models.User
 			var ts int64
-			if err := rows.Scan(&u.ID, &u.Username, &u.Email, &ts); err != nil {
+			if err := rows.Scan(&u.ID, &u.Username, &u.Email, &ts, &u.NtfyTopic); err != nil {
 				respond(w, http.StatusInternalServerError, errResp("internal error"))
 				return
 			}
@@ -123,6 +140,50 @@ func handleCreateUser(db *sql.DB) http.HandlerFunc {
 	}
 }

+// handleSetNotifyTarget points a user's push notifications at an ntfy topic, or
+// clears it with an empty string. The topic is a shared secret with the ntfy
+// server — anyone who knows it can publish to it — so pick an unguessable one
+// unless your ntfy enforces access control.
+func handleSetNotifyTarget(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid user id"))
+			return
+		}
+		var req struct {
+			NtfyTopic string `json:"ntfy_topic"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+
+		var topic *string
+		if t := strings.TrimSpace(req.NtfyTopic); t != "" {
+			topic = &t
+		}
+
+		res, err := db.ExecContext(r.Context(),
+			"UPDATE users SET ntfy_topic = ? WHERE id = ?", topic, id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if n, _ := res.RowsAffected(); n == 0 {
+			respond(w, http.StatusNotFound, errResp("user not found"))
+			return
+		}
+
+		user, err := fetchUser(r.Context(), db, id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		respond(w, http.StatusOK, user)
+	}
+}
+
 func handleDeleteUser(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
@@ -170,7 +231,7 @@ func handleCreateAPIKey(db *sql.DB) http.HandlerFunc {
 			return
 		}

-		raw, hash, err := newAPIKey()
+		raw, hash, err := randomToken()
 		if err != nil {
 			respond(w, http.StatusInternalServerError, errResp("internal error"))
 			return
@@ -215,8 +276,9 @@ func handleDeleteAPIKey(db *sql.DB) http.HandlerFunc {
 	}
 }

-// newAPIKey generates a random 32-byte key encoded as hex, plus its SHA-256 hash for storage.
-func newAPIKey() (raw, hash string, err error) {
+// randomToken generates a random 32-byte secret encoded as hex, plus its SHA-256
+// hash for storage. Used for API keys and for notification acknowledge tokens.
+func randomToken() (raw, hash string, err error) {
 	b := make([]byte, 32)
 	if _, err = rand.Read(b); err != nil {
 		return
@@ -230,8 +292,9 @@ func newAPIKey() (raw, hash string, err error) {
 func fetchUser(ctx context.Context, db *sql.DB, id int64) (models.User, error) {
 	var u models.User
 	var ts int64
-	err := db.QueryRowContext(ctx, "SELECT id, username, email, created_at FROM users WHERE id = ?", id).
-		Scan(&u.ID, &u.Username, &u.Email, &ts)
+	err := db.QueryRowContext(ctx,
+		"SELECT id, username, email, created_at, ntfy_topic FROM users WHERE id = ?", id).
+		Scan(&u.ID, &u.Username, &u.Email, &ts, &u.NtfyTopic)
 	if err != nil {
 		return u, err
 	}
@@ -14,6 +14,44 @@ type Config struct {
 	// before the sweeper treats it as resolved. It must exceed Alertmanager's
 	// repeat_interval (default 4h), which is what refreshes the alert.
 	StaleAfter time.Duration
+
+	// DeadmanMatchers selects the alerts that are heartbeats rather than
+	// problems: receiving one opens no incident, and the absence of one does.
+	//
+	// ";" separates matchers, "," the label conditions within one, "=" is exact
+	// equality — `alertname=Watchdog,cluster=prod; alertname=Heartbeat`. Every
+	// matcher must name an alertname. See api.ParseDeadmanConfig.
+	DeadmanMatchers string
+
+	// DeadmanTimeout is how long a heartbeat may go unheard before its switch is
+	// declared dead. It must be *shorter* than the Alertmanager repeat_interval
+	// of the route carrying the heartbeat — the opposite of StaleAfter, and the
+	// reason a dead man's switch usually wants a route of its own. Zero disables
+	// dead man's switch handling entirely.
+	DeadmanTimeout time.Duration
+
+	// DeadmanSeverity is the severity a dead man's switch incident opens at.
+	// These incidents have no member alerts to derive one from.
+	DeadmanSeverity string
+
+	// NtfyURL is the ntfy server push notifications are published to. Empty
+	// disables notifications entirely.
+	NtfyURL string
+
+	// NtfyToken is an optional bearer token for an access-controlled ntfy.
+	NtfyToken string
+
+	// NtfyFallbackTopic receives incidents that open with nobody on call.
+	NtfyFallbackTopic string
+
+	// PublicURL is the base URL a phone uses to reach this server, used for the
+	// link and the Acknowledge button inside a notification. Without it
+	// notifications carry neither.
+	PublicURL string
+
+	// NotifyRepeat is how long an incident may sit unacknowledged before it is
+	// notified again. Zero disables reminders.
+	NotifyRepeat time.Duration
 }

 func Load() Config {
@@ -25,17 +63,40 @@ func Load() Config {
 	if dbPath == "" {
 		dbPath = "terdut.db"
 	}
-	archiveAfter := 7 * 24 * time.Hour
-	if s := os.Getenv("TERDUT_ARCHIVE_AFTER"); s != "" {
-		if d, err := time.ParseDuration(s); err == nil {
-			archiveAfter = d
+	deadmanMatchers := os.Getenv("TERDUT_DEADMAN_MATCHERS")
+	if deadmanMatchers == "" {
+		deadmanMatchers = "alertname=Watchdog"
 	}
+	deadmanSeverity := os.Getenv("TERDUT_DEADMAN_SEVERITY")
+	if deadmanSeverity == "" {
+		deadmanSeverity = "critical"
 	}
-	staleAfter := 6 * time.Hour
-	if s := os.Getenv("TERDUT_STALE_AFTER"); s != "" {
-		if d, err := time.ParseDuration(s); err == nil {
-			staleAfter = d
+	return Config{
+		Addr:         addr,
+		DBPath:       dbPath,
+		ArchiveAfter: duration("TERDUT_ARCHIVE_AFTER", 7*24*time.Hour),
+		StaleAfter:   duration("TERDUT_STALE_AFTER", 6*time.Hour),
+
+		DeadmanMatchers: deadmanMatchers,
+		DeadmanTimeout:  duration("TERDUT_DEADMAN_TIMEOUT", 15*time.Minute),
+		DeadmanSeverity: deadmanSeverity,
+
+		NtfyURL:           os.Getenv("TERDUT_NTFY_URL"),
+		NtfyToken:         os.Getenv("TERDUT_NTFY_TOKEN"),
+		NtfyFallbackTopic: os.Getenv("TERDUT_NTFY_FALLBACK_TOPIC"),
+		PublicURL:         os.Getenv("TERDUT_PUBLIC_URL"),
+		NotifyRepeat:      duration("TERDUT_NOTIFY_REPEAT", 15*time.Minute),
 	}
-	}
-	return Config{Addr: addr, DBPath: dbPath, ArchiveAfter: archiveAfter, StaleAfter: staleAfter}
+}
+
+// duration reads a time.ParseDuration-formatted env var. An unset or
+// unparseable value falls back to def rather than failing startup: a typo in one
+// tuning knob should not take the server down.
+func duration(env string, def time.Duration) time.Duration {
+	if s := os.Getenv(env); s != "" {
+		if d, err := time.ParseDuration(s); err == nil {
+			return d
+		}
+	}
+	return def
 }
@@ -0,0 +1,123 @@
+-- Splits the single alerts row into two objects, the way an incident management
+-- tool needs them: alerts stay the machine-owned signal record that Alertmanager
+-- writes, and incidents become the human work item people acknowledge, assign,
+-- snooze, discuss and resolve.
+--
+-- Correlation uses Alertmanager's own groupKey, so incidents follow the group_by
+-- routing tree the operator already tuned rather than a second grouping scheme
+-- invented here.
+
+CREATE TABLE incidents (
+    id                INTEGER PRIMARY KEY AUTOINCREMENT,
+    group_key         TEXT    NOT NULL,              -- Alertmanager groupKey, opaque
+    title             TEXT    NOT NULL,              -- rendered from group_labels
+    group_labels      TEXT    NOT NULL DEFAULT '{}', -- JSON
+    status            TEXT    NOT NULL CHECK(status IN ('triggered', 'acknowledged', 'resolved')),
+    severity          TEXT,                          -- highest `severity` label across firing members
+    triggered_at      INTEGER NOT NULL,
+    acknowledged_by   INTEGER REFERENCES users(id) ON DELETE SET NULL,
+    acknowledged_at   INTEGER,
+    assigned_to       INTEGER REFERENCES users(id) ON DELETE SET NULL,
+    snoozed_until     INTEGER,
+    resolved_at       INTEGER,
+    resolution_source TEXT,                          -- 'alerts' | 'manual'
+    archived_at       INTEGER
+);
+
+-- Load-bearing: at most one OPEN incident per group_key. This is what makes
+-- "resolved incident + a new alert occurrence = a new incident" work, and it is
+-- the constraint the webhook's find-or-open lookup relies on.
+CREATE UNIQUE INDEX incidents_open_group_key_idx ON incidents(group_key) WHERE resolved_at IS NULL;
+CREATE INDEX incidents_status_idx       ON incidents(status);
+CREATE INDEX incidents_triggered_at_idx ON incidents(triggered_at DESC);
+CREATE INDEX incidents_archived_at_idx  ON incidents(archived_at);
+
+-- Membership is historical, not a pointer on alerts: one alert row (one
+-- fingerprint) resolves and re-fires over time and belongs to a different
+-- incident each occurrence.
+CREATE TABLE incident_alerts (
+    incident_id INTEGER NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+    alert_id    INTEGER NOT NULL REFERENCES alerts(id)    ON DELETE CASCADE,
+    added_at    INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+    PRIMARY KEY (incident_id, alert_id)
+);
+
+CREATE INDEX incident_alerts_alert_id_idx ON incident_alerts(alert_id);
+
+-- The timeline. Append-only, and the only history this server keeps: alert rows
+-- are mutated in place, so without this there is no record that anything
+-- happened. Notes are events too, so one query renders the whole story.
+CREATE TABLE incident_events (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    incident_id INTEGER NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+    -- triggered | alert_added | alert_resolved | acknowledged | unacknowledged
+    -- | assigned | snoozed | unsnoozed | resolved | note
+    type        TEXT    NOT NULL,
+    user_id     INTEGER REFERENCES users(id)  ON DELETE SET NULL, -- NULL = the server acted
+    alert_id    INTEGER REFERENCES alerts(id) ON DELETE SET NULL,
+    detail      TEXT,
+    created_at  INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+);
+
+CREATE INDEX incident_events_incident_idx ON incident_events(incident_id, created_at);
+
+-- ---------------------------------------------------------------------------
+-- Backfill
+--
+-- Every pre-existing alert gets its own incident, archived ones included, so no
+-- acknowledgement and no comment is orphaned. There is no historical groupKey to
+-- correlate on, hence one incident per fingerprint under a 'backfill:' prefix
+-- that can never collide with a real Alertmanager groupKey.
+-- ---------------------------------------------------------------------------
+
+INSERT INTO incidents (group_key, title, group_labels, status, severity, triggered_at,
+                       acknowledged_by, acknowledged_at, assigned_to,
+                       resolved_at, resolution_source, archived_at)
+SELECT 'backfill:' || a.fingerprint,
+       a.name,
+       json_object('alertname', a.name),
+       CASE WHEN a.status = 'resolved'          THEN 'resolved'
+            WHEN a.acknowledged_by IS NOT NULL  THEN 'acknowledged'
+            ELSE 'triggered' END,
+       json_extract(a.labels, '$.severity'),
+       a.starts_at,
+       a.acknowledged_by,
+       a.acknowledged_at,
+       a.acknowledged_by,
+       CASE WHEN a.status = 'resolved' THEN COALESCE(a.ends_at, a.received_at) END,
+       CASE WHEN a.status = 'resolved' THEN 'alerts' END,
+       a.archived_at
+FROM alerts a;
+
+INSERT INTO incident_alerts (incident_id, alert_id, added_at)
+SELECT i.id, a.id, a.starts_at
+FROM alerts a
+JOIN incidents i ON i.group_key = 'backfill:' || a.fingerprint;
+
+INSERT INTO incident_events (incident_id, type, alert_id, created_at)
+SELECT i.id, 'triggered', ia.alert_id, i.triggered_at
+FROM incidents i JOIN incident_alerts ia ON ia.incident_id = i.id;
+
+INSERT INTO incident_events (incident_id, type, user_id, created_at)
+SELECT i.id, 'acknowledged', i.acknowledged_by, i.acknowledged_at
+FROM incidents i WHERE i.acknowledged_at IS NOT NULL;
+
+INSERT INTO incident_events (incident_id, type, created_at)
+SELECT i.id, 'resolved', i.resolved_at
+FROM incidents i WHERE i.resolved_at IS NOT NULL;
+
+INSERT INTO incident_events (incident_id, type, user_id, alert_id, detail, created_at)
+SELECT ia.incident_id, 'note', c.user_id, c.alert_id, c.content, c.created_at
+FROM alert_comments c
+JOIN incident_alerts ia ON ia.alert_id = c.alert_id;
+
+-- ---------------------------------------------------------------------------
+-- Workflow state now lives on incidents only. Leaving these behind would keep
+-- the bug they caused: the webhook upsert owns the alerts row and never cleared
+-- the acknowledgement, so a re-fire days later still read as acknowledged.
+-- ---------------------------------------------------------------------------
+
+DROP TABLE alert_comments;
+
+ALTER TABLE alerts DROP COLUMN acknowledged_by;
+ALTER TABLE alerts DROP COLUMN acknowledged_at;
@@ -0,0 +1,44 @@
+-- Adds push notification delivery, so an incident reaches the person on call
+-- instead of waiting to be discovered.
+--
+-- Delivery is an outbox rather than an inline HTTP call: the pool is limited to
+-- a single connection, so a POST made while holding the webhook's transaction
+-- would stall every other request behind it. The webhook inserts a row; the
+-- notifier goroutine delivers it.
+
+CREATE TABLE notifications (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    incident_id INTEGER NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+    -- Nullable: a notification sent to the fallback topic belongs to nobody,
+    -- because nobody was on call when the incident opened.
+    user_id     INTEGER REFERENCES users(id) ON DELETE SET NULL,
+    topic       TEXT    NOT NULL,              -- resolved at enqueue: who was on call then
+    kind        TEXT    NOT NULL CHECK(kind IN ('triggered', 'reminder', 'resolved')),
+    created_at  INTEGER NOT NULL,
+    send_after  INTEGER NOT NULL,              -- retry backoff watermark
+    attempts    INTEGER NOT NULL DEFAULT 0,
+    sent_at     INTEGER,
+    last_error  TEXT                           -- kept after the last attempt, for debugging
+);
+
+-- The delivery loop's only query: what is due and still unsent.
+CREATE INDEX notifications_pending_idx  ON notifications(send_after) WHERE sent_at IS NULL;
+-- Reminders and resolved notices both look up an incident's newest row.
+CREATE INDEX notifications_incident_idx ON notifications(incident_id, id DESC);
+
+-- A notification body is stored on the ntfy server and cached on the device, so
+-- a real API key must never appear in one. Each delivery mints its own token
+-- instead: one incident, one action, one day.
+CREATE TABLE incident_ack_tokens (
+    token_hash  TEXT    PRIMARY KEY,           -- SHA-256 of the raw token, as with api_keys
+    incident_id INTEGER NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+    user_id     INTEGER NOT NULL REFERENCES users(id)     ON DELETE CASCADE,
+    created_at  INTEGER NOT NULL,
+    expires_at  INTEGER NOT NULL
+);
+
+CREATE INDEX incident_ack_tokens_expires_idx ON incident_ack_tokens(expires_at);
+
+-- Where this user's notifications go. NULL means they get none; incidents
+-- assigned to them fall back to the configured fallback topic.
+ALTER TABLE users ADD COLUMN ntfy_topic TEXT;
@@ -0,0 +1,18 @@
+-- A password is what lets a person sign in to the web UI. NULL means the user
+-- has none and can only use API keys, which is every user created before this.
+ALTER TABLE users ADD COLUMN password_hash TEXT;
+
+-- A session is a browser's credential, the cookie counterpart of an API key:
+-- only the hash of the token is stored. expires_at slides forward while the
+-- session is in use, so an on-call phone stays signed in.
+CREATE TABLE sessions (
+    id           INTEGER PRIMARY KEY AUTOINCREMENT,
+    token_hash   TEXT    NOT NULL UNIQUE,
+    user_id      INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    created_at   INTEGER NOT NULL,
+    last_seen_at INTEGER NOT NULL,
+    expires_at   INTEGER NOT NULL,
+    user_agent   TEXT
+);
+
+CREATE INDEX idx_sessions_user ON sessions(user_id);
@@ -2,6 +2,10 @@ package models

 import "time"

+// Alert is the machine-owned signal record: what Alertmanager told us, and
+// nothing else. It has two states, firing and resolved, and no human ever writes
+// to it — acknowledgement, assignment, notes and closure all live on the
+// Incident an alert belongs to.
 type Alert struct {
 	ID           int64             `json:"id"`
 	Fingerprint  string            `json:"fingerprint"`
@@ -12,16 +16,38 @@ type Alert struct {
 	StartsAt     time.Time         `json:"starts_at"`
 	EndsAt       *time.Time        `json:"ends_at,omitempty"`
 	GeneratorURL string            `json:"generator_url"`
+
+	// ReceivedAt is when the server last accepted a webhook for this
+	// fingerprint, including the unchanged firing notifications Alertmanager
+	// re-sends every repeat_interval.
+	//
+	// This is a documented part of the public API, not an internal ingest
+	// detail: StartsAt never changes for an alert instance, so ReceivedAt is
+	// the only signal a client has that a firing alert is still being
+	// refreshed. The sweeper stale-dates against it (see expireStale), API
+	// clients render it, and GET /api/alerts is ordered by it. Anything that
+	// stops the webhook handler from advancing it on a re-send is a breaking
+	// change — see "received_at is a liveness heartbeat" in the README and
+	// TestWebhook_ResendBumpsReceivedAt.
 	ReceivedAt time.Time `json:"received_at"`

-	// Populated when the alert has been acknowledged.
-	AcknowledgedByID   *int64     `json:"acknowledged_by_id,omitempty"`
-	AcknowledgedByUser *string    `json:"acknowledged_by,omitempty"`
-	AcknowledgedAt     *time.Time `json:"acknowledged_at,omitempty"`
+	// IncidentID is the most recent incident this alert belongs to. An alert row
+	// is reused across occurrences of the same fingerprint, so over its life it
+	// belongs to a series of incidents; incident_alerts keeps the full history
+	// and this is only the newest link.
+	IncidentID *int64 `json:"incident_id,omitempty"`

 	// ResolutionSource records why a resolved alert left the firing state:
 	// "alertmanager" for a real resolved webhook, "expiry" when the sweeper
-	// inferred it after the alert stopped being refreshed.
+	// inferred it after the alert stopped being refreshed. Nil while firing, and
+	// cleared again by a re-fire under the same fingerprint.
+	//
+	// Also public API: it is how a client knows whether EndsAt was observed or
+	// inferred. Under "expiry" nothing ever reported an end, so EndsAt is only
+	// an upper bound (see expireStale) and ReceivedAt is the more truthful
+	// signal. Treat the value set as open — see "resolution_source says how much
+	// to trust ends_at" in the README, and TestWebhook_ResolvedSetsSource /
+	// TestExpiry_StaleFiringAlert.
 	ResolutionSource *string `json:"resolution_source,omitempty"`

 	ArchivedAt *time.Time `json:"archived_at,omitempty"`
@@ -1,12 +0,0 @@
-package models
-
-import "time"
-
-type Comment struct {
-	ID        int64     `json:"id"`
-	AlertID   int64     `json:"alert_id"`
-	UserID    int64     `json:"user_id"`
-	Username  string    `json:"username"`
-	Content   string    `json:"content"`
-	CreatedAt time.Time `json:"created_at"`
-}
@@ -0,0 +1,68 @@
+package models
+
+import "time"
+
+// Incident is the human work item: the thing that gets acknowledged, assigned,
+// snoozed, discussed and resolved. Alerts are the machine-owned signal records
+// underneath it — many alerts map to one incident, correlated by the groupKey
+// Alertmanager already computed from the operator's group_by configuration.
+//
+// Nothing here is ever written by the Alertmanager webhook except Status, which
+// the webhook and the sweeper may flip to "resolved" once every member alert has
+// stopped firing.
+type Incident struct {
+	ID          int64             `json:"id"`
+	GroupKey    string            `json:"group_key"`
+	Title       string            `json:"title"`
+	GroupLabels map[string]string `json:"group_labels"`
+
+	// Status is "triggered", "acknowledged" or "resolved".
+	Status string `json:"status"`
+
+	// Severity is the highest `severity` label across the alerts that were
+	// firing when it was last recomputed. It is deliberately not cleared when an
+	// incident resolves — a resolved incident should still say how bad it was.
+	Severity *string `json:"severity,omitempty"`
+
+	TriggeredAt time.Time `json:"triggered_at"`
+
+	AcknowledgedByID   *int64     `json:"acknowledged_by_id,omitempty"`
+	AcknowledgedByUser *string    `json:"acknowledged_by,omitempty"`
+	AcknowledgedAt     *time.Time `json:"acknowledged_at,omitempty"`
+
+	AssignedToID   *int64  `json:"assigned_to_id,omitempty"`
+	AssignedToUser *string `json:"assigned_to,omitempty"`
+
+	// SnoozedUntil hides the incident from the default queue without closing it.
+	// A timestamp in the past reads as "not snoozed"; nothing sweeps it.
+	SnoozedUntil *time.Time `json:"snoozed_until,omitempty"`
+
+	ResolvedAt *time.Time `json:"resolved_at,omitempty"`
+
+	// ResolutionSource is "alerts" when every member alert stopped firing, or
+	// "manual" when a human closed it. Manual resolution is terminal: a later
+	// occurrence opens a new incident rather than reopening this one.
+	ResolutionSource *string `json:"resolution_source,omitempty"`
+
+	ArchivedAt *time.Time `json:"archived_at,omitempty"`
+
+	// Alerts is populated by GET /api/incidents/{id} only.
+	Alerts []Alert `json:"alerts,omitempty"`
+}
+
+// IncidentEvent is one entry in an incident's timeline. The table is append-only
+// and is the only history this server keeps — alert rows are mutated in place.
+//
+// Type is one of: triggered, alert_added, alert_resolved, acknowledged,
+// unacknowledged, assigned, snoozed, unsnoozed, resolved, note. A nil UserID
+// means the server acted rather than a person.
+type IncidentEvent struct {
+	ID         int64     `json:"id"`
+	IncidentID int64     `json:"incident_id"`
+	Type       string    `json:"type"`
+	UserID     *int64    `json:"user_id,omitempty"`
+	Username   *string   `json:"username,omitempty"`
+	AlertID    *int64    `json:"alert_id,omitempty"`
+	Detail     *string   `json:"detail,omitempty"`
+	CreatedAt  time.Time `json:"created_at"`
+}
@@ -7,6 +7,11 @@ type User struct {
 	Username  string    `json:"username"`
 	Email     string    `json:"email"`
 	CreatedAt time.Time `json:"created_at"`
+
+	// NtfyTopic is where this user's push notifications go. Nil means they get
+	// none of their own; incidents assigned to them fall back to the configured
+	// fallback topic instead.
+	NtfyTopic *string `json:"ntfy_topic,omitempty"`
 }

 type APIKey struct {
@@ -0,0 +1,622 @@
+/* terdut web UI.
+ *
+ * Mobile first: one column, a top bar and a bottom tab bar. From 900px the tab
+ * bar becomes a sidebar and the queue shows list and detail side by side.
+ * Colour is reserved for severity and status; everything else is neutral.
+ */
+
+:root {
+  --bg: #f5f6f8;
+  --surface: #ffffff;
+  --surface-2: #eff1f4;
+  --surface-hover: #f7f8fa;
+  --border: #e2e5ea;
+  --border-strong: #cfd3da;
+  --text: #16181d;
+  --muted: #5b626e;
+  --faint: #8a909b;
+
+  --accent: #2f5bd3;
+  --accent-text: #ffffff;
+  --accent-soft: #e8eefc;
+
+  --crit: #d0342c;
+  --crit-soft: #fdecea;
+  --warn: #b86e00;
+  --warn-soft: #fdf3e1;
+  --info: #2f6fdf;
+  --info-soft: #e9f0fd;
+  --ok: #1d7f4c;
+  --ok-soft: #e6f5ec;
+  --snooze: #6b5bd2;
+  --snooze-soft: #efedfb;
+
+  --radius: 10px;
+  --radius-sm: 6px;
+  --shadow: 0 1px 2px rgb(16 24 40 / 6%), 0 1px 3px rgb(16 24 40 / 8%);
+  --shadow-lg: 0 12px 32px rgb(16 24 40 / 18%);
+
+  --font: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  --mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+
+  --topbar-h: 52px;
+  --tabbar-h: 58px;
+  --safe-top: env(safe-area-inset-top, 0px);
+  --safe-bottom: env(safe-area-inset-bottom, 0px);
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #0f1115;
+    --surface: #171a20;
+    --surface-2: #1f232b;
+    --surface-hover: #1c2027;
+    --border: #2a2f38;
+    --border-strong: #394050;
+    --text: #e7e9ed;
+    --muted: #a0a7b3;
+    --faint: #737a87;
+
+    --accent: #6d8ff0;
+    --accent-text: #0b0d12;
+    --accent-soft: #1d2640;
+
+    --crit: #ff6b61;
+    --crit-soft: #3a1c1b;
+    --warn: #f0b140;
+    --warn-soft: #362a14;
+    --info: #74a3ff;
+    --info-soft: #1a2640;
+    --ok: #4cc488;
+    --ok-soft: #15301f;
+    --snooze: #a89bff;
+    --snooze-soft: #262245;
+
+    --shadow: 0 1px 2px rgb(0 0 0 / 40%);
+    --shadow-lg: 0 16px 40px rgb(0 0 0 / 55%);
+  }
+}
+
+*, *::before, *::after { box-sizing: border-box; }
+[hidden] { display: none !important; }
+
+html { -webkit-text-size-adjust: 100%; }
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--text);
+  font: 15px/1.45 var(--font);
+  font-variant-numeric: tabular-nums;
+  -webkit-font-smoothing: antialiased;
+  -webkit-tap-highlight-color: transparent;
+}
+
+a { color: inherit; text-decoration: none; }
+button, input, textarea, select { font: inherit; color: inherit; }
+code { font-family: var(--mono); font-size: 0.9em; }
+h1, h2, h3 { margin: 0; line-height: 1.25; }
+
+:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+
+/* ---------- boot + login ---------- */
+
+.boot { display: grid; place-items: center; min-height: 100dvh; }
+.spinner {
+  width: 26px; height: 26px; border-radius: 50%;
+  border: 3px solid var(--border); border-top-color: var(--accent);
+  animation: spin 0.8s linear infinite;
+}
+@keyframes spin { to { transform: rotate(360deg); } }
+
+.login {
+  min-height: 100dvh;
+  display: grid; place-items: center;
+  padding: calc(24px + var(--safe-top)) 16px calc(24px + var(--safe-bottom));
+}
+.login-card {
+  width: 100%; max-width: 360px;
+  display: grid; gap: 14px;
+}
+.login-brand { display: flex; align-items: center; gap: 10px; margin-bottom: 8px; }
+.login-brand h1 { font-size: 24px; letter-spacing: -0.01em; }
+.login-hint { color: var(--faint); font-size: 13px; margin: 4px 0 0; }
+
+label { display: grid; gap: 6px; }
+label > span { font-size: 13px; font-weight: 600; color: var(--muted); }
+
+input, textarea, select {
+  width: 100%;
+  min-height: 44px;
+  padding: 10px 12px;
+  background: var(--surface);
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  font-size: 16px; /* 16px stops iOS zooming into the field */
+}
+textarea { min-height: 110px; resize: vertical; line-height: 1.45; }
+input:focus, textarea:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px var(--accent-soft); }
+
+.form-error {
+  margin: 0; padding: 10px 12px;
+  background: var(--crit-soft); color: var(--crit);
+  border-radius: var(--radius-sm); font-size: 14px;
+}
+
+/* ---------- buttons ---------- */
+
+.btn {
+  display: inline-flex; align-items: center; justify-content: center; gap: 8px;
+  min-height: 44px; padding: 0 16px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface);
+  font-weight: 600; font-size: 15px;
+  cursor: pointer;
+  white-space: nowrap;
+  transition: background 0.12s, border-color 0.12s, opacity 0.12s;
+}
+.btn:hover { background: var(--surface-hover); }
+.btn:disabled { opacity: 0.55; cursor: default; }
+.btn-primary { background: var(--accent); border-color: var(--accent); color: var(--accent-text); }
+.btn-primary:hover { background: var(--accent); filter: brightness(1.06); }
+.btn-danger { background: var(--crit); border-color: var(--crit); color: #fff; }
+.btn-danger:hover { background: var(--crit); filter: brightness(1.06); }
+.btn-ghost { background: transparent; border-color: transparent; }
+.btn-ghost:hover { background: var(--surface-2); }
+.btn-block { width: 100%; }
+.btn-icon { width: 44px; padding: 0; }
+.btn-sm { min-height: 32px; padding: 0 8px; font-size: 13px; }
+.btn-sm svg { width: 16px; height: 16px; }
+.btn svg, .icon { width: 20px; height: 20px; fill: none; stroke: currentColor; stroke-width: 2; stroke-linecap: round; stroke-linejoin: round; }
+
+/* ---------- app frame ---------- */
+
+.app { min-height: 100dvh; }
+
+.topbar {
+  position: sticky; top: 0; z-index: 10;
+  display: flex; align-items: center; justify-content: space-between; gap: 12px;
+  height: calc(var(--topbar-h) + var(--safe-top));
+  padding: var(--safe-top) 16px 0;
+  background: color-mix(in srgb, var(--bg) 88%, transparent);
+  backdrop-filter: saturate(1.4) blur(12px);
+  -webkit-backdrop-filter: saturate(1.4) blur(12px);
+  border-bottom: 1px solid var(--border);
+}
+.topbar-title { font-size: 18px; font-weight: 700; letter-spacing: -0.01em; }
+
+.open-pill {
+  display: inline-flex; align-items: center; gap: 6px;
+  padding: 3px 10px; border-radius: 999px;
+  font-size: 13px; font-weight: 600;
+  background: var(--surface-2); color: var(--muted);
+}
+.open-pill::before { content: ""; width: 8px; height: 8px; border-radius: 50%; background: var(--faint); }
+.open-pill.has-triggered { background: var(--crit-soft); color: var(--crit); }
+.open-pill.has-triggered::before { background: var(--crit); }
+.open-pill.all-acked::before { background: var(--warn); }
+
+/* Bottom tab bar on phones. */
+.nav {
+  position: fixed; left: 0; right: 0; bottom: 0; z-index: 20;
+  display: grid; grid-template-columns: repeat(4, 1fr);
+  height: calc(var(--tabbar-h) + var(--safe-bottom));
+  padding-bottom: var(--safe-bottom);
+  background: color-mix(in srgb, var(--surface) 92%, transparent);
+  backdrop-filter: saturate(1.4) blur(12px);
+  -webkit-backdrop-filter: saturate(1.4) blur(12px);
+  border-top: 1px solid var(--border);
+}
+.nav-brand { display: none; }
+.nav-link {
+  position: relative;
+  display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 2px;
+  color: var(--faint); font-size: 11px; font-weight: 600;
+}
+.nav-link svg { width: 24px; height: 24px; fill: none; stroke: currentColor; stroke-width: 1.8; stroke-linecap: round; stroke-linejoin: round; }
+.nav-link[aria-current="page"] { color: var(--accent); }
+.nav-badge {
+  position: absolute; top: 6px; left: calc(50% + 6px);
+  min-width: 18px; height: 18px; padding: 0 5px;
+  border-radius: 999px; background: var(--crit); color: #fff;
+  font-size: 11px; font-weight: 700; line-height: 18px; text-align: center;
+}
+
+.view { padding-bottom: calc(var(--tabbar-h) + var(--safe-bottom)); }
+.view-page { padding-left: 16px; padding-right: 16px; }
+.view-page > * { max-width: 760px; margin-left: auto; margin-right: auto; }
+
+/* Phone detail: the incident takes the whole screen with its own action bar,
+   so the tab bar and top bar step aside. */
+.app.detail-open .nav,
+.app.detail-open .topbar { display: none; }
+.app.detail-open .pane-list { display: none; }
+.app.detail-open .view-queue { padding-bottom: 0; }
+.view-queue:not(.has-detail) .pane-detail { display: none; }
+
+/* ---------- chips ---------- */
+
+.chips {
+  display: flex; gap: 6px;
+  padding: 12px 16px 8px;
+  overflow-x: auto; scrollbar-width: none;
+}
+.chips::-webkit-scrollbar { display: none; }
+.chip {
+  flex: none;
+  min-height: 34px; padding: 0 12px;
+  border: 1px solid var(--border-strong); border-radius: 999px;
+  background: var(--surface); color: var(--muted);
+  font-size: 13px; font-weight: 600; cursor: pointer;
+}
+.chip[aria-selected="true"] { background: var(--text); border-color: var(--text); color: var(--bg); }
+.chip .count { margin-left: 4px; opacity: 0.7; }
+
+/* ---------- lists ---------- */
+
+.list { padding: 0 16px 16px; display: grid; gap: 8px; }
+
+.row {
+  position: relative;
+  display: grid; grid-template-columns: 1fr auto; gap: 4px 12px;
+  padding: 11px 14px 11px 18px;
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow);
+  cursor: pointer;
+  overflow: hidden;
+}
+.row:hover { background: var(--surface-hover); }
+.row[aria-current="true"] { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
+.row.kbd-focus { outline: 2px solid var(--accent); outline-offset: 1px; }
+.row::before {
+  content: ""; position: absolute; left: 0; top: 0; bottom: 0; width: 4px;
+  background: var(--sev, var(--border-strong));
+}
+.row-title {
+  font-weight: 650; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+.row-age { color: var(--faint); font-size: 13px; text-align: right; white-space: nowrap; }
+.row-meta {
+  grid-column: 1 / -1;
+  display: flex; flex-wrap: wrap; align-items: center; gap: 4px 8px;
+  color: var(--muted); font-size: 13px;
+  min-width: 0;
+}
+.row-meta .labels { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; min-width: 0; max-width: 100%; color: var(--faint); }
+.row.resolved .row-title { color: var(--muted); }
+
+.sev-critical { --sev: var(--crit); }
+.sev-warning  { --sev: var(--warn); }
+.sev-info     { --sev: var(--info); }
+
+.empty {
+  padding: 48px 16px; text-align: center; color: var(--muted);
+}
+.empty strong { display: block; color: var(--text); font-size: 16px; margin-bottom: 4px; }
+.empty .icon { width: 36px; height: 36px; color: var(--ok); margin-bottom: 8px; }
+
+.load-error {
+  margin: 12px 16px; padding: 10px 12px;
+  background: var(--crit-soft); color: var(--crit);
+  border-radius: var(--radius-sm); font-size: 14px;
+}
+
+/* ---------- badges ---------- */
+
+.badge {
+  display: inline-flex; align-items: center; gap: 5px;
+  padding: 1px 8px; border-radius: 999px;
+  font-size: 12px; font-weight: 700; letter-spacing: 0.01em;
+  background: var(--surface-2); color: var(--muted);
+  white-space: nowrap;
+}
+.badge::before { content: ""; width: 7px; height: 7px; border-radius: 50%; background: currentColor; }
+.badge.plain::before { display: none; }
+.badge.st-triggered, .badge.st-firing { background: var(--crit-soft); color: var(--crit); }
+.badge.st-acknowledged { background: var(--warn-soft); color: var(--warn); }
+.badge.st-snoozed { background: var(--snooze-soft); color: var(--snooze); }
+.badge.st-resolved { background: var(--ok-soft); color: var(--ok); }
+.badge.sev-critical { background: var(--crit-soft); color: var(--crit); }
+.badge.sev-warning { background: var(--warn-soft); color: var(--warn); }
+.badge.sev-info { background: var(--info-soft); color: var(--info); }
+
+/* ---------- incident detail ---------- */
+
+.detail { padding: 0 16px calc(96px + var(--safe-bottom)); }
+.detail-head {
+  position: sticky; top: 0; z-index: 5;
+  display: flex; align-items: center; gap: 4px;
+  height: calc(var(--topbar-h) + var(--safe-top));
+  margin: 0 -16px; padding: var(--safe-top) 8px 0;
+  background: color-mix(in srgb, var(--bg) 88%, transparent);
+  backdrop-filter: saturate(1.4) blur(12px);
+  -webkit-backdrop-filter: saturate(1.4) blur(12px);
+  border-bottom: 1px solid var(--border);
+}
+.detail-head .crumb { font-weight: 600; color: var(--muted); font-size: 14px; }
+.detail-title { font-size: 21px; font-weight: 750; letter-spacing: -0.01em; margin: 16px 0 8px; overflow-wrap: anywhere; }
+.detail-badges { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 14px; }
+
+.card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow);
+}
+.card + .card, .section + .section { margin-top: 14px; }
+.card-pad { padding: 14px; }
+
+.facts { display: grid; grid-template-columns: auto 1fr; gap: 8px 16px; margin: 0; padding: 14px; font-size: 14px; }
+.facts dt { color: var(--muted); }
+.facts dd { margin: 0; overflow-wrap: anywhere; }
+.facts .sub { color: var(--faint); }
+
+.section { margin-top: 22px; }
+.section-title {
+  display: flex; align-items: baseline; justify-content: space-between; gap: 8px;
+  font-size: 13px; font-weight: 700; text-transform: uppercase; letter-spacing: 0.06em;
+  color: var(--muted); margin: 0 2px 8px;
+}
+
+.labels-wrap { display: flex; flex-wrap: wrap; gap: 6px; }
+.label {
+  display: inline-flex; max-width: 100%;
+  font-family: var(--mono); font-size: 12px;
+  border: 1px solid var(--border); border-radius: var(--radius-sm);
+  overflow: hidden;
+}
+.label > span { padding: 2px 6px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.label > span:first-child { background: var(--surface-2); color: var(--muted); }
+
+.alert-item { padding: 12px 14px; display: grid; gap: 6px; }
+.alert-item + .alert-item { border-top: 1px solid var(--border); }
+.alert-item-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
+.alert-item-name { font-weight: 650; overflow-wrap: anywhere; }
+.alert-item-summary { color: var(--muted); font-size: 14px; overflow-wrap: anywhere; }
+.alert-item-foot { display: flex; flex-wrap: wrap; gap: 4px 12px; font-size: 13px; color: var(--faint); }
+.alert-item-foot a { color: var(--accent); font-weight: 600; }
+details > summary { cursor: pointer; color: var(--muted); font-size: 13px; font-weight: 600; list-style: none; }
+details > summary::-webkit-details-marker { display: none; }
+details > summary::before { content: "▸ "; }
+details[open] > summary::before { content: "▾ "; }
+details[open] > summary { margin-bottom: 8px; }
+
+.timeline { list-style: none; margin: 0; padding: 4px 0; }
+.tl-item {
+  position: relative;
+  display: grid; grid-template-columns: 20px 1fr; gap: 10px;
+  padding: 8px 14px;
+}
+.tl-item::before {
+  content: ""; position: absolute; left: 23px; top: 0; bottom: 0; width: 2px; background: var(--border);
+}
+.tl-item:first-child::before { top: 16px; }
+.tl-item:last-child::before { bottom: calc(100% - 16px); }
+.tl-dot {
+  position: relative; z-index: 1;
+  width: 10px; height: 10px; margin: 5px 0 0 5px; border-radius: 50%;
+  background: var(--surface); border: 2px solid var(--faint);
+}
+.tl-triggered .tl-dot, .tl-notify_failed .tl-dot, .tl-deadman_silent .tl-dot { border-color: var(--crit); background: var(--crit); }
+.tl-acknowledged .tl-dot { border-color: var(--warn); background: var(--warn); }
+.tl-resolved .tl-dot { border-color: var(--ok); background: var(--ok); }
+.tl-snoozed .tl-dot { border-color: var(--snooze); }
+.tl-note .tl-dot { border-color: var(--accent); background: var(--accent); }
+.tl-body { min-width: 0; font-size: 14px; }
+.tl-text { overflow-wrap: anywhere; }
+.tl-text .who { font-weight: 650; }
+.tl-time { color: var(--faint); font-size: 12px; }
+.tl-note .note {
+  margin-top: 6px; padding: 10px 12px;
+  background: var(--surface-2); border-radius: var(--radius-sm);
+  white-space: pre-wrap; overflow-wrap: anywhere;
+}
+.note-actions { display: flex; justify-content: flex-end; }
+.note-actions .btn { color: var(--muted); }
+
+/* The action bar sits at the bottom of the screen on a phone, and at the
+   bottom of the detail pane on desktop. */
+.actionbar {
+  position: fixed; left: 0; right: 0; bottom: 0; z-index: 15;
+  display: flex; gap: 8px;
+  padding: 10px 16px calc(10px + var(--safe-bottom));
+  background: var(--surface);
+  border-top: 1px solid var(--border);
+}
+.actionbar .btn { min-height: 48px; }
+.actionbar .btn-primary { flex: 1; font-size: 16px; }
+
+.detail-placeholder {
+  display: grid; place-items: center; height: 100%;
+  color: var(--faint); text-align: center; padding: 32px;
+}
+
+/* ---------- sheet (dialog) ---------- */
+
+.sheet {
+  width: 100%; max-width: 100%;
+  max-height: 88dvh;
+  margin: auto 0 0; padding: 0;
+  border: 0; border-radius: 16px 16px 0 0;
+  background: var(--surface); color: var(--text);
+  box-shadow: var(--shadow-lg);
+  overflow: auto;
+}
+.sheet::backdrop { background: rgb(0 0 0 / 40%); }
+.sheet[open] { animation: sheet-up 0.18s ease-out; }
+@keyframes sheet-up { from { transform: translateY(24px); opacity: 0.6; } }
+.sheet-inner { padding: 8px 16px calc(16px + var(--safe-bottom)); }
+.sheet-grab { width: 40px; height: 4px; margin: 0 auto 12px; border-radius: 2px; background: var(--border-strong); }
+.sheet-title { font-size: 17px; font-weight: 700; margin: 0 0 4px; }
+.sheet-text { color: var(--muted); margin: 0 0 14px; font-size: 14px; }
+.sheet-form { display: grid; gap: 12px; }
+.sheet-actions { display: flex; gap: 8px; margin-top: 16px; }
+.sheet-actions .btn { flex: 1; }
+
+.menu { list-style: none; margin: 0 -4px; padding: 0; }
+.menu-item {
+  display: flex; align-items: center; gap: 12px;
+  width: 100%; min-height: 50px; padding: 0 12px;
+  background: none; border: 0; border-radius: var(--radius-sm);
+  text-align: left; font-size: 16px; cursor: pointer;
+}
+.menu-item:hover { background: var(--surface-2); }
+.menu-item .icon { color: var(--muted); flex: none; }
+.menu-item .menu-sub { margin-left: auto; color: var(--faint); font-size: 13px; }
+.menu-item.danger, .menu-item.danger .icon { color: var(--crit); }
+.menu-item[aria-checked="true"] { font-weight: 700; }
+.menu-item[aria-checked="true"]::after { content: "✓"; margin-left: 8px; color: var(--accent); }
+.menu-sep { height: 1px; background: var(--border); margin: 6px 12px; }
+
+/* ---------- toast ---------- */
+
+.toast {
+  position: fixed; left: 50%; z-index: 50;
+  bottom: calc(var(--tabbar-h) + var(--safe-bottom) + 12px);
+  transform: translateX(-50%);
+  max-width: calc(100% - 32px);
+  padding: 10px 16px; border-radius: var(--radius);
+  background: var(--text); color: var(--bg);
+  font-size: 14px; font-weight: 600;
+  box-shadow: var(--shadow-lg);
+}
+.toast.error { background: var(--crit); color: #fff; }
+.app.detail-open ~ .toast { bottom: calc(80px + var(--safe-bottom)); }
+
+/* ---------- on-call ---------- */
+
+.page-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; margin: 16px auto 12px; }
+.page-head h2 { font-size: 13px; font-weight: 700; text-transform: uppercase; letter-spacing: 0.06em; color: var(--muted); }
+
+.now-card { display: flex; align-items: center; gap: 14px; padding: 16px; margin-top: 16px; }
+.avatar {
+  flex: none; display: grid; place-items: center;
+  width: 44px; height: 44px; border-radius: 50%;
+  background: var(--accent-soft); color: var(--accent);
+  font-weight: 750; font-size: 17px; text-transform: uppercase;
+}
+.avatar.none { background: var(--surface-2); color: var(--faint); }
+.now-label { color: var(--muted); font-size: 13px; font-weight: 600; }
+.now-name { font-size: 20px; font-weight: 750; }
+.you { color: var(--accent); font-weight: 650; font-size: 13px; margin-left: 6px; }
+
+.week-nav { display: flex; align-items: center; gap: 4px; }
+.week-nav .label { font-size: 14px; font-weight: 650; min-width: 9em; text-align: center; }
+.days { list-style: none; margin: 0; padding: 0; }
+.day { display: grid; grid-template-columns: 3.2em 4.2em 1fr; align-items: center; gap: 8px; min-height: 50px; padding: 0 14px; }
+.day + .day { border-top: 1px solid var(--border); }
+.day-name { font-weight: 650; }
+.day-date { color: var(--faint); font-size: 13px; }
+.day-who { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.day-who.nobody { color: var(--faint); font-style: italic; }
+.day.today { background: var(--accent-soft); }
+.day.today:first-child { border-radius: var(--radius) var(--radius) 0 0; }
+.day.today:last-child { border-radius: 0 0 var(--radius) var(--radius); }
+.day.today .day-name { color: var(--accent); }
+.day.past { opacity: 0.6; }
+
+.shift-list { list-style: none; margin: 0; padding: 0; }
+.shift-list li { display: flex; justify-content: space-between; padding: 12px 14px; }
+.shift-list li + li { border-top: 1px solid var(--border); }
+.shift-list .muted { color: var(--faint); }
+
+/* ---------- alerts page ---------- */
+
+.view-alerts .chips { padding-left: 0; padding-right: 0; }
+.view-alerts .list { padding-left: 0; padding-right: 0; }
+.row.st-firing { --sev: var(--crit); }
+.row.st-resolved { --sev: var(--ok); }
+.row.no-link { cursor: default; }
+
+/* ---------- account ---------- */
+
+.account-card { display: flex; align-items: center; gap: 14px; padding: 16px; margin-top: 16px; }
+.account-name { font-size: 18px; font-weight: 750; }
+.account-email { color: var(--muted); font-size: 14px; overflow-wrap: anywhere; }
+.pw-form { display: grid; gap: 12px; padding: 16px; }
+.form-ok {
+  margin: 0; padding: 10px 12px;
+  background: var(--ok-soft); color: var(--ok);
+  border-radius: var(--radius-sm); font-size: 14px;
+}
+.kbd-table { width: 100%; border-collapse: collapse; font-size: 14px; }
+.kbd-table td { padding: 8px 14px; border-top: 1px solid var(--border); }
+.kbd-table tr:first-child td { border-top: 0; }
+kbd {
+  display: inline-block; min-width: 1.6em; padding: 1px 6px;
+  font-family: var(--mono); font-size: 12px; text-align: center;
+  background: var(--surface-2); border: 1px solid var(--border-strong); border-bottom-width: 2px;
+  border-radius: 4px;
+}
+.only-desktop { display: none; }
+.foot-note { color: var(--faint); font-size: 13px; text-align: center; margin: 24px auto; }
+
+/* ---------- desktop ---------- */
+
+@media (min-width: 900px) {
+  :root { --tabbar-h: 0px; }
+
+  .app { display: grid; grid-template-columns: 220px 1fr; height: 100dvh; }
+
+  .nav {
+    position: static; grid-row: 1 / span 2;
+    display: flex; flex-direction: column; gap: 2px;
+    height: auto; padding: 16px 12px;
+    background: var(--surface);
+    border-top: 0; border-right: 1px solid var(--border);
+    backdrop-filter: none;
+  }
+  .nav-brand {
+    display: flex; align-items: center; gap: 10px;
+    padding: 4px 10px 18px; font-size: 18px; font-weight: 750; letter-spacing: -0.01em;
+  }
+  .nav-link {
+    flex-direction: row; justify-content: flex-start; gap: 12px;
+    min-height: 40px; padding: 0 10px; border-radius: var(--radius-sm);
+    color: var(--muted); font-size: 14px;
+  }
+  .nav-link:hover { background: var(--surface-2); }
+  .nav-link[aria-current="page"] { background: var(--accent-soft); color: var(--accent); }
+  .nav-link svg { width: 20px; height: 20px; }
+  .nav-badge { position: static; margin-left: auto; }
+
+  .topbar { display: none; }
+  .view { padding-bottom: 0; overflow: auto; height: 100dvh; }
+  .view-page { padding: 8px 32px 32px; }
+
+  .view-queue {
+    display: grid; grid-template-columns: minmax(340px, 420px) 1fr;
+    overflow: hidden;
+  }
+  .view-queue .pane { overflow: auto; height: 100dvh; }
+  .pane-list { border-right: 1px solid var(--border); }
+  .pane-list .chips { position: sticky; top: 0; z-index: 2; background: var(--bg); padding-top: 16px; }
+  .view-queue:not(.has-detail) .pane-detail { display: block; }
+
+  /* On desktop the list stays visible next to the detail. */
+  .app.detail-open .nav { display: flex; }
+  .app.detail-open .pane-list { display: block; }
+  .detail-head .back { display: none; }
+  .detail-head { padding-left: 16px; }
+
+  .pane-detail { position: relative; display: flex; flex-direction: column; }
+  .detail { flex: 1; padding: 0 32px 24px; max-width: 900px; width: 100%; }
+  .detail-head { margin: 0 -32px; padding-left: 32px; }
+  .actionbar {
+    position: sticky; bottom: 0;
+    padding: 12px 32px;
+  }
+  .actionbar .btn-primary { flex: 0 1 240px; }
+
+  .sheet {
+    width: min(440px, calc(100% - 32px));
+    margin: auto; border-radius: 14px;
+  }
+  .sheet-grab { display: none; }
+  .sheet-inner { padding: 20px; }
+
+  .toast, .app.detail-open ~ .toast { bottom: 24px; }
+  .only-desktop { display: block; }
+}
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#1b1e25"/>
+  <path d="M10 34h11l5-12 8 22 6-15 3 5h11" fill="none" stroke="#ff6b61" stroke-width="4.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
@@ -0,0 +1,89 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="color-scheme" content="light dark">
+  <meta name="theme-color" content="#f5f6f8" media="(prefers-color-scheme: light)">
+  <meta name="theme-color" content="#0f1115" media="(prefers-color-scheme: dark)">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="default">
+  <meta name="apple-mobile-web-app-title" content="terdut">
+  <title>terdut</title>
+  <link rel="manifest" href="/manifest.webmanifest">
+  <link rel="icon" href="/icon.svg" type="image/svg+xml">
+  <link rel="apple-touch-icon" href="/apple-touch-icon.png">
+  <link rel="stylesheet" href="/app.css">
+  <script type="module" src="/js/app.js"></script>
+</head>
+<body>
+  <div id="boot" class="boot" aria-busy="true"><span class="spinner"></span></div>
+
+  <main id="login" class="login" hidden>
+    <form id="login-form" class="login-card" autocomplete="on">
+      <div class="login-brand">
+        <img src="/icon.svg" alt="" width="40" height="40">
+        <h1>terdut</h1>
+      </div>
+      <label>
+        <span>Username</span>
+        <input name="username" autocomplete="username" autocapitalize="none" spellcheck="false" required>
+      </label>
+      <label>
+        <span>Password</span>
+        <input name="password" type="password" autocomplete="current-password" required>
+      </label>
+      <p class="form-error" role="alert" hidden></p>
+      <button class="btn btn-primary btn-block" type="submit">Sign in</button>
+      <p class="login-hint">No password yet? Ask an admin to set one, or run
+        <code>PUT /api/users/{id}/password</code> with your API key.</p>
+    </form>
+  </main>
+
+  <div id="app" class="app" hidden>
+    <nav class="nav" aria-label="Sections">
+      <a class="nav-brand" href="/">
+        <img src="/icon.svg" alt="" width="28" height="28">
+        <span>terdut</span>
+      </a>
+      <a class="nav-link" href="/" data-section="queue">
+        <svg viewBox="0 0 24 24" aria-hidden="true"><path d="M4 6h16M4 12h16M4 18h10"/></svg>
+        <span class="nav-label">Queue</span>
+        <span class="nav-badge" data-badge hidden></span>
+      </a>
+      <a class="nav-link" href="/oncall" data-section="oncall">
+        <svg viewBox="0 0 24 24" aria-hidden="true"><rect x="3.5" y="5" width="17" height="15" rx="2"/><path d="M3.5 10h17M8 3v4M16 3v4"/></svg>
+        <span class="nav-label">On-call</span>
+      </a>
+      <a class="nav-link" href="/alerts" data-section="alerts">
+        <svg viewBox="0 0 24 24" aria-hidden="true"><path d="M6 16V11a6 6 0 0 1 12 0v5l1.5 2h-15z"/><path d="M10 20.5a2 2 0 0 0 4 0"/></svg>
+        <span class="nav-label">Alerts</span>
+      </a>
+      <a class="nav-link" href="/more" data-section="more">
+        <svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="8" r="3.5"/><path d="M5 20a7 7 0 0 1 14 0"/></svg>
+        <span class="nav-label">Account</span>
+      </a>
+    </nav>
+
+    <header class="topbar">
+      <h1 class="topbar-title" id="topbar-title">Queue</h1>
+      <span class="open-pill" id="open-pill" hidden></span>
+    </header>
+
+    <section id="view-queue" class="view view-queue" data-view="queue">
+      <div class="pane pane-list">
+        <div class="chips" id="queue-filters" role="tablist" aria-label="Filter"></div>
+        <div id="queue-list" class="list"></div>
+      </div>
+      <div class="pane pane-detail" id="detail" aria-live="polite"></div>
+    </section>
+
+    <section id="view-oncall" class="view view-page" data-view="oncall" hidden></section>
+    <section id="view-alerts" class="view view-page" data-view="alerts" hidden></section>
+    <section id="view-more" class="view view-page" data-view="more" hidden></section>
+  </div>
+
+  <dialog id="sheet" class="sheet"></dialog>
+  <div id="toast" class="toast" role="status" aria-live="polite" hidden></div>
+</body>
+</html>
@@ -0,0 +1,110 @@
+// Account: who you are signed in as, changing your password, signing out.
+
+import * as api from './api.js';
+import { h, clear, icon, toast } from './ui.js';
+import { initial } from './format.js';
+import { state } from './state.js';
+import { signOut } from './app.js';
+
+const view = () => document.getElementById('view-more');
+
+// Rendered once per visit rather than on every poll, so a half-typed password
+// is never wiped out from under you.
+export function show() {
+  render();
+}
+
+function render() {
+  const { user, has_password: hasPassword } = state.me;
+  clear(view(),
+    h('div', { class: 'card account-card' },
+      h('div', { class: 'avatar', text: initial(user.username) }),
+      h('div', {},
+        h('div', { class: 'account-name', text: user.username }),
+        h('div', { class: 'account-email', text: user.email }))),
+
+    h('div', { class: 'page-head' }, h('h2', { text: hasPassword ? 'Change password' : 'Set a password' })),
+    passwordForm(user, hasPassword),
+
+    h('div', { class: 'only-desktop' },
+      h('div', { class: 'page-head' }, h('h2', { text: 'Keyboard' })),
+      h('div', { class: 'card' }, shortcuts())),
+
+    h('div', { class: 'page-head' }),
+    h('button', { class: 'btn btn-block', type: 'button', onclick: signOut }, icon('logout'), 'Sign out'),
+    h('p', { class: 'foot-note', text: 'Schedule editing, statistics and user management are in terdut-tui for now.' }),
+  );
+}
+
+function passwordForm(user, hasPassword) {
+  const err = h('p', { class: 'form-error', role: 'alert', hidden: true });
+  const ok = h('p', { class: 'form-ok', role: 'status', hidden: true });
+  const current = hasPassword
+    ? h('input', { name: 'current', type: 'password', autocomplete: 'current-password', required: true })
+    : null;
+  const next = h('input', { name: 'next', type: 'password', autocomplete: 'new-password', required: true, minlength: '10' });
+  const again = h('input', { name: 'again', type: 'password', autocomplete: 'new-password', required: true, minlength: '10' });
+  const submit = h('button', { class: 'btn btn-primary', type: 'submit', text: 'Save password' });
+
+  // A hidden username field lets password managers file the new password
+  // under the right account.
+  const form = h('form', { class: 'card pw-form', autocomplete: 'on' },
+    h('input', { type: 'text', name: 'username', autocomplete: 'username', value: user.username, hidden: true, readonly: true }),
+    current && h('label', {}, h('span', { text: 'Current password' }), current),
+    h('label', {}, h('span', { text: 'New password' }), next),
+    h('label', {}, h('span', { text: 'Repeat new password' }), again),
+    err, ok, submit,
+  );
+
+  form.addEventListener('submit', async (e) => {
+    e.preventDefault();
+    err.hidden = true;
+    ok.hidden = true;
+    if (next.value !== again.value) {
+      err.textContent = 'The new passwords do not match.';
+      err.hidden = false;
+      return;
+    }
+    submit.disabled = true;
+    try {
+      await api.setPassword(user.id, next.value, current ? current.value : '');
+      state.me.has_password = true;
+      form.reset();
+      if (!current) {
+        // From now on the form needs the current-password field.
+        render();
+        toast('Password saved');
+        return;
+      }
+      ok.textContent = 'Password saved. Other devices have been signed out.';
+      ok.hidden = false;
+    } catch (ex) {
+      err.textContent = ex.message;
+      err.hidden = false;
+    } finally {
+      submit.disabled = false;
+    }
+  });
+  return form;
+}
+
+function shortcuts() {
+  const rows = [
+    ['j / k', 'Move through the queue'],
+    ['Enter', 'Open incident'],
+    ['Esc', 'Back to the queue'],
+    ['f', 'Cycle the queue filter'],
+    ['a / A', 'Acknowledge / clear acknowledgement'],
+    ['R', 'Resolve (asks first)'],
+    ['s', 'Assign'],
+    ['z / Z', 'Snooze / end snooze'],
+    ['c', 'Add a note'],
+    ['x', 'Archive / unarchive a resolved incident'],
+    ['r', 'Refresh now'],
+  ];
+  return h('table', { class: 'kbd-table' },
+    h('tbody', {}, rows.map(([k, v]) =>
+      h('tr', {},
+        h('td', {}, k.split(' / ').map((x, i) => [i ? ' / ' : '', h('kbd', { text: x })])),
+        h('td', { text: v })))));
+}
@@ -0,0 +1,91 @@
+// The alert feed: Alertmanager's own records, read-only. Each row leads to the
+// incident it belongs to, which is where anything can be done about it.
+
+import * as api from './api.js';
+import { h, clear, badge, emptyState, spinner } from './ui.js';
+import { age, severityClass, labelSummary } from './format.js';
+
+const FILTERS = [
+  { id: 'firing', label: 'Firing', query: { status: 'firing' } },
+  { id: 'resolved', label: 'Resolved', query: { status: 'resolved' } },
+  { id: 'all', label: 'All', query: {} },
+  { id: 'archived', label: 'Archived', query: { archived: 'true' } },
+];
+
+const view = () => document.getElementById('view-alerts');
+
+let filter = 'firing';
+let items = null;
+let error = null;
+
+export function show() {
+  render();
+  refresh();
+}
+
+export async function refresh() {
+  const requested = filter;
+  const f = FILTERS.find((x) => x.id === filter);
+  try {
+    const result = await api.alerts({ ...f.query, limit: 200 });
+    if (requested !== filter) return;
+    items = result;
+    error = null;
+  } catch (err) {
+    if (requested !== filter) return;
+    error = err.message;
+  }
+  render();
+}
+
+function setFilter(id) {
+  if (id === filter) return;
+  filter = id;
+  items = null;
+  render();
+  refresh();
+}
+
+function render() {
+  const chips = h('div', { class: 'chips', role: 'tablist', 'aria-label': 'Filter' },
+    FILTERS.map((f) => h('button', {
+      class: 'chip',
+      type: 'button',
+      role: 'tab',
+      'aria-selected': String(f.id === filter),
+      onclick: () => setFilter(f.id),
+      text: f.label,
+    })));
+
+  let body;
+  if (error && !items) body = h('div', { class: 'load-error', text: error });
+  else if (!items) body = spinner();
+  else if (!items.length) body = emptyState(filter === 'firing' ? 'Nothing firing' : 'No alerts', '', filter === 'firing' ? 'checkCircle' : null);
+  else {
+    body = h('div', { class: 'list' },
+      error && h('div', { class: 'load-error', text: `Showing older data: ${error}` }),
+      items.map(row));
+  }
+  clear(view(), h('div', {}, chips, body));
+}
+
+function row(a) {
+  const summary = (a.annotations && a.annotations.summary) || '';
+  const sev = a.labels && a.labels.severity;
+  const labels = labelSummary(Object.fromEntries(
+    Object.entries(a.labels || {}).filter(([k]) => k !== 'severity')));
+  const linked = a.incident_id != null;
+  return h(linked ? 'a' : 'div', {
+    class: `row st-${a.status} ${linked ? '' : 'no-link'}`,
+    href: linked ? `/incidents/${a.incident_id}` : null,
+  },
+    h('div', { class: 'row-title', text: a.name }),
+    h('div', { class: 'row-age', title: a.starts_at, text: age(a.status === 'firing' ? a.starts_at : a.received_at) }),
+    h('div', { class: 'row-meta' },
+      badge(a.status === 'firing' ? 'Firing' : 'Resolved', `st-${a.status}`),
+      sev && badge(sev, `plain ${severityClass(sev)}`),
+      summary && h('span', { text: summary }),
+      labels && h('span', { class: 'labels', text: labels }),
+    ),
+  );
+}
@@ -0,0 +1,98 @@
+// The terdut-server client. The page is served by the server itself, so every
+// call is same-origin and carries the session cookie.
+
+export class ApiError extends Error {
+  constructor(status, message) {
+    super(message);
+    this.name = 'ApiError';
+    this.status = status;
+  }
+}
+
+// Called whenever the server says the session is gone, so the app can put the
+// login form back up wherever the user happened to be.
+let onUnauthorized = () => {};
+export function setUnauthorizedHandler(fn) {
+  onUnauthorized = fn;
+}
+
+async function call(method, path, { query, body, signal } = {}) {
+  const url = new URL('/api' + path, location.origin);
+  for (const [k, v] of Object.entries(query || {})) {
+    if (v === '' || v == null) continue;
+    url.searchParams.set(k, v);
+  }
+
+  const headers = { Accept: 'application/json' };
+  if (body !== undefined) headers['Content-Type'] = 'application/json';
+
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method,
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+      credentials: 'same-origin',
+      signal,
+    });
+  } catch (err) {
+    if (err.name === 'AbortError') throw err;
+    throw new ApiError(0, 'Cannot reach the server.');
+  }
+
+  if (resp.status === 204) return null;
+
+  let data = null;
+  try {
+    data = await resp.json();
+  } catch {
+    /* non-JSON body: keep null */
+  }
+
+  if (!resp.ok) {
+    if (resp.status === 401 && path !== '/login') onUnauthorized();
+    const message = (data && data.error) || `Server answered ${resp.status}.`;
+    throw new ApiError(resp.status, message);
+  }
+  return data;
+}
+
+// session
+export const me = () => call('GET', '/me');
+export const login = (username, password) => call('POST', '/login', { body: { username, password } });
+export const logout = () => call('POST', '/logout');
+export const setPassword = (userID, password, currentPassword) =>
+  call('PUT', `/users/${userID}/password`, { body: { password, current_password: currentPassword } });
+
+// users
+export const users = () => call('GET', '/users');
+
+// incidents
+export const incidents = (query, opts) => call('GET', '/incidents', { query, ...opts });
+export const incident = (id) => call('GET', `/incidents/${id}`);
+export const timeline = (id) => call('GET', `/incidents/${id}/timeline`);
+
+export const acknowledge = (id) => call('POST', `/incidents/${id}/acknowledge`);
+export const unacknowledge = (id) => call('DELETE', `/incidents/${id}/acknowledge`);
+export const resolve = (id) => call('POST', `/incidents/${id}/resolve`);
+export const assign = (id, userID) => call('POST', `/incidents/${id}/assign`, { body: { user_id: userID } });
+export const snooze = (id, spec) => call('POST', `/incidents/${id}/snooze`, { body: spec });
+export const unsnooze = (id) => call('DELETE', `/incidents/${id}/snooze`);
+export const archive = (id) => call('POST', `/incidents/${id}/archive`);
+export const unarchive = (id) => call('DELETE', `/incidents/${id}/archive`);
+export const addNote = (id, content) => call('POST', `/incidents/${id}/notes`, { body: { content } });
+export const deleteNote = (id, eventID) => call('DELETE', `/incidents/${id}/notes/${eventID}`);
+
+// alerts
+export const alerts = (query, opts) => call('GET', '/alerts', { query, ...opts });
+
+// schedule
+export const schedule = (from, to) => call('GET', '/schedule', { query: { from, to } });
+export async function onCallNow() {
+  try {
+    return await call('GET', '/schedule/current');
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) return null;
+    throw err;
+  }
+}
@@ -0,0 +1,234 @@
+// Entry point: session, routing, badges and keyboard.
+
+import * as api from './api.js';
+import * as ui from './ui.js';
+import * as poll from './poll.js';
+import { state, reset } from './state.js';
+import * as queue from './queue.js';
+import * as incident from './incident.js';
+import * as oncall from './oncall.js';
+import * as alerts from './alerts.js';
+import * as account from './account.js';
+
+const $ = (id) => document.getElementById(id);
+
+// One route per section; /incidents/{id} is the queue with a detail open.
+const SECTIONS = {
+  queue: { title: 'Queue', view: queue },
+  oncall: { title: 'On-call', view: oncall },
+  alerts: { title: 'Alerts', view: alerts },
+  more: { title: 'Account', view: account },
+};
+
+function parseRoute(pathname) {
+  const m = pathname.match(/^\/incidents\/(\d+)\/?$/);
+  if (m) return { section: 'queue', incident: Number(m[1]) };
+  const name = pathname.replace(/^\/|\/$/g, '');
+  if (name === 'oncall' || name === 'alerts' || name === 'more') return { section: name };
+  return { section: 'queue', incident: null };
+}
+
+let route = parseRoute(location.pathname);
+// How many in-app navigations deep we are, so Back can use the browser's
+// history when there is somewhere to go back to, and the queue otherwise.
+let depth = 0;
+let listScroll = 0;
+
+export function navigate(path, { replace = false } = {}) {
+  if (path === location.pathname + location.search) return;
+  if (replace) {
+    history.replaceState({ depth }, '', path);
+  } else {
+    depth += 1;
+    history.pushState({ depth }, '', path);
+  }
+  render();
+}
+
+export function back() {
+  if (depth > 0) history.back();
+  else navigate('/', { replace: true });
+}
+
+window.addEventListener('popstate', (e) => {
+  depth = (e.state && e.state.depth) || 0;
+  render();
+});
+
+function render() {
+  const prev = route;
+  route = parseRoute(location.pathname);
+  const app = $('app');
+
+  for (const [name, s] of Object.entries(SECTIONS)) {
+    const el = $(`view-${name}`);
+    el.hidden = name !== route.section;
+    if (name === route.section) $('topbar-title').textContent = s.title;
+  }
+  for (const link of document.querySelectorAll('.nav-link')) {
+    if (link.dataset.section === route.section) link.setAttribute('aria-current', 'page');
+    else link.removeAttribute('aria-current');
+  }
+
+  const detailOpen = route.section === 'queue' && route.incident != null;
+  const wasOpen = prev.section === 'queue' && prev.incident != null;
+  if (detailOpen && !wasOpen) listScroll = window.scrollY;
+  app.classList.toggle('detail-open', detailOpen);
+  $('view-queue').classList.toggle('has-detail', detailOpen);
+
+  if (route.section === 'queue') {
+    queue.show(route.incident);
+    incident.show(route.incident);
+  } else {
+    incident.show(null);
+    SECTIONS[route.section].view.show();
+  }
+
+  if (detailOpen && !wasOpen) window.scrollTo(0, 0);
+  else if (!detailOpen && wasOpen) requestAnimationFrame(() => window.scrollTo(0, listScroll));
+  else if (prev.section !== route.section) window.scrollTo(0, 0);
+
+  updateTitle();
+}
+
+// ---------- refresh + badges ----------
+
+async function refresh() {
+  state.open = await api.incidents({ sort: 'severity' });
+  updateBadges();
+  const jobs = [];
+  if (route.section === 'queue') {
+    jobs.push(queue.refresh());
+    if (route.incident != null) jobs.push(incident.refresh());
+  } else {
+    const v = SECTIONS[route.section].view;
+    if (v.refresh) jobs.push(v.refresh());
+  }
+  await Promise.allSettled(jobs);
+}
+
+function updateBadges() {
+  const open = state.open.length;
+  const triggered = state.open.filter((i) => i.status === 'triggered').length;
+
+  const pill = $('open-pill');
+  pill.hidden = false;
+  pill.textContent = open ? `${open} open` : 'All clear';
+  pill.classList.toggle('has-triggered', triggered > 0);
+  pill.classList.toggle('all-acked', open > 0 && triggered === 0);
+
+  const badge = document.querySelector('[data-badge]');
+  badge.hidden = triggered === 0;
+  badge.textContent = String(triggered);
+  updateTitle();
+}
+
+function updateTitle() {
+  const triggered = state.open.filter((i) => i.status === 'triggered').length;
+  const section = SECTIONS[route.section].title;
+  const base = route.section === 'queue' && route.incident == null ? 'terdut' : `${section} · terdut`;
+  document.title = triggered ? `(${triggered}) ${base}` : base;
+}
+
+// ---------- session ----------
+
+async function boot() {
+  ui.initSheet();
+  api.setUnauthorizedHandler(showLogin);
+  document.addEventListener('click', interceptLinks);
+  document.addEventListener('keydown', onKey);
+  $('login-form').addEventListener('submit', onLogin);
+
+  try {
+    state.me = await api.me();
+    showApp();
+  } catch (err) {
+    if (err.status === 401) showLogin();
+    else showBootError(err);
+  }
+}
+
+function showBootError(err) {
+  ui.clear($('boot'), ui.emptyState('Cannot load terdut', err.message));
+  $('boot').append(ui.h('button', { class: 'btn', onclick: () => location.reload(), text: 'Retry' }));
+}
+
+function showLogin() {
+  poll.stop();
+  ui.closeSheet(null);
+  reset();
+  $('boot').hidden = true;
+  $('app').hidden = true;
+  $('login').hidden = false;
+  const form = $('login-form');
+  form.querySelector('.form-error').hidden = true;
+  form.password.value = '';
+  (form.username.value ? form.password : form.username).focus();
+}
+
+async function onLogin(e) {
+  e.preventDefault();
+  const form = e.currentTarget;
+  const err = form.querySelector('.form-error');
+  const btn = form.querySelector('button[type=submit]');
+  err.hidden = true;
+  btn.disabled = true;
+  try {
+    state.me = await api.login(form.username.value.trim(), form.password.value);
+    form.password.value = '';
+    showApp();
+  } catch (ex) {
+    err.textContent = ex.message;
+    err.hidden = false;
+  } finally {
+    btn.disabled = false;
+  }
+}
+
+export async function signOut() {
+  try {
+    await api.logout();
+  } catch {
+    /* the cookie is cleared server-side or already gone */
+  }
+  showLogin();
+}
+
+function showApp() {
+  $('boot').hidden = true;
+  $('login').hidden = true;
+  $('app').hidden = false;
+  render();
+  poll.start(refresh);
+  poll.now();
+}
+
+// ---------- links + keys ----------
+
+function interceptLinks(e) {
+  if (e.defaultPrevented || e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+  const a = e.target.closest('a[href]');
+  if (!a || a.target || a.origin !== location.origin || a.pathname.startsWith('/api/')) return;
+  e.preventDefault();
+  navigate(a.pathname + a.search);
+}
+
+function onKey(e) {
+  if (e.metaKey || e.ctrlKey || e.altKey || ui.sheetIsOpen() || $('app').hidden) return;
+  const tag = e.target.tagName;
+  if (tag === 'INPUT' || tag === 'TEXTAREA' || tag === 'SELECT') return;
+
+  if (e.key === 'r') {
+    poll.now();
+    e.preventDefault();
+    return;
+  }
+  if (route.section !== 'queue') return;
+  if (route.incident != null && incident.key(e)) {
+    e.preventDefault();
+    return;
+  }
+  if (queue.key(e)) e.preventDefault();
+}
+
+boot();
@@ -0,0 +1,110 @@
+// Formatting of times, durations and labels.
+
+const MIN = 60 * 1000;
+const HOUR = 60 * MIN;
+const DAY = 24 * HOUR;
+
+// Compact age for list rows: "now", "4m", "3h", "2d".
+export function age(iso, now = Date.now()) {
+  const ms = Math.max(0, now - Date.parse(iso));
+  if (ms < MIN) return 'now';
+  if (ms < HOUR) return `${Math.floor(ms / MIN)}m`;
+  if (ms < DAY) return `${Math.floor(ms / HOUR)}h`;
+  return `${Math.floor(ms / DAY)}d`;
+}
+
+// "4 min ago", "3 h ago", "yesterday"-free: stays unambiguous at 3am.
+export function ago(iso, now = Date.now()) {
+  const a = age(iso, now);
+  return a === 'now' ? 'just now' : `${a} ago`;
+}
+
+// Time remaining until iso, e.g. "1h 20m".
+export function until(iso, now = Date.now()) {
+  return duration(Date.parse(iso) - now);
+}
+
+export function duration(ms) {
+  ms = Math.max(0, ms);
+  if (ms < MIN) return '<1m';
+  const d = Math.floor(ms / DAY);
+  const h = Math.floor((ms % DAY) / HOUR);
+  const m = Math.floor((ms % HOUR) / MIN);
+  if (d) return h ? `${d}d ${h}h` : `${d}d`;
+  if (h) return m ? `${h}h ${m}m` : `${h}h`;
+  return `${m}m`;
+}
+
+const timeFmt = new Intl.DateTimeFormat(undefined, { hour: '2-digit', minute: '2-digit' });
+const dayTimeFmt = new Intl.DateTimeFormat(undefined, {
+  weekday: 'short', day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit',
+});
+
+// Local timestamp; the date is dropped when it is today.
+export function when(iso) {
+  const d = new Date(iso);
+  const today = new Date();
+  if (d.toDateString() === today.toDateString()) return timeFmt.format(d);
+  return dayTimeFmt.format(d);
+}
+
+export function isFuture(iso) {
+  return iso != null && Date.parse(iso) > Date.now();
+}
+
+// Local calendar dates, as the schedule stores them (YYYY-MM-DD).
+export function isoDate(d) {
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, '0');
+  const day = String(d.getDate()).padStart(2, '0');
+  return `${y}-${m}-${day}`;
+}
+
+export function mondayOf(d) {
+  const r = new Date(d.getFullYear(), d.getMonth(), d.getDate());
+  r.setDate(r.getDate() - ((r.getDay() + 6) % 7));
+  return r;
+}
+
+export function addDays(d, n) {
+  const r = new Date(d);
+  r.setDate(r.getDate() + n);
+  return r;
+}
+
+// ISO 8601 week number.
+export function isoWeek(d) {
+  const t = new Date(Date.UTC(d.getFullYear(), d.getMonth(), d.getDate()));
+  const day = t.getUTCDay() || 7;
+  t.setUTCDate(t.getUTCDate() + 4 - day);
+  const yearStart = new Date(Date.UTC(t.getUTCFullYear(), 0, 1));
+  return Math.ceil(((t - yearStart) / DAY + 1) / 7);
+}
+
+export const STATUS_LABEL = {
+  triggered: 'Triggered',
+  acknowledged: 'Acknowledged',
+  resolved: 'Resolved',
+  snoozed: 'Snoozed',
+  firing: 'Firing',
+};
+
+export function severityClass(sev) {
+  const s = (sev || '').toLowerCase();
+  if (s === 'critical' || s === 'page' || s === 'error') return 'sev-critical';
+  if (s === 'warning' || s === 'warn') return 'sev-warning';
+  if (s) return 'sev-info';
+  return '';
+}
+
+// A one-line summary of the group labels, without the one the title already shows.
+export function labelSummary(labels, skip = 'alertname') {
+  return Object.entries(labels || {})
+    .filter(([k]) => k !== skip)
+    .map(([k, v]) => `${k}=${v}`)
+    .join(' · ');
+}
+
+export function initial(name) {
+  return (name || '?').trim().charAt(0) || '?';
+}
@@ -0,0 +1,447 @@
+// Incident detail: facts, member alerts, the timeline with notes, and the
+// action bar that carries everything a responder does to an incident.
+
+import * as api from './api.js';
+import * as poll from './poll.js';
+import {
+  h, clear, icon, badge, labelChip, openSheet, closeSheet, confirm, toast, spinner, emptyState,
+} from './ui.js';
+import {
+  ago, when, until, isFuture, severityClass, STATUS_LABEL,
+} from './format.js';
+import { myID, users } from './state.js';
+import { back } from './app.js';
+
+const pane = () => document.getElementById('detail');
+
+let currentID = null;
+let inc = null;
+let events = [];
+let error = null;
+let busy = false;
+
+export function show(id) {
+  if (id === currentID) return;
+  currentID = id;
+  inc = null;
+  events = [];
+  error = null;
+  if (id == null) {
+    renderPlaceholder();
+    return;
+  }
+  render();
+  refresh();
+}
+
+export async function refresh() {
+  const id = currentID;
+  if (id == null) return;
+  try {
+    const [i, t] = await Promise.all([api.incident(id), api.timeline(id)]);
+    if (id !== currentID) return;
+    inc = i;
+    events = t;
+    error = null;
+  } catch (err) {
+    if (id !== currentID) return;
+    error = err.status === 404 ? 'This incident does not exist.' : err.message;
+  }
+  render();
+}
+
+function renderPlaceholder() {
+  clear(pane(), h('div', { class: 'detail-placeholder' },
+    h('div', {}, icon('flag', 'icon'), h('p', { text: 'Select an incident to see its alerts and timeline.' }))));
+}
+
+function render() {
+  const head = h('div', { class: 'detail-head' },
+    h('button', { class: 'btn btn-ghost btn-icon back', type: 'button', 'aria-label': 'Back to queue', onclick: back },
+      icon('back')),
+    h('span', { class: 'crumb', text: currentID != null ? `Incident #${currentID}` : '' }),
+  );
+
+  if (!inc) {
+    clear(pane(), h('div', { class: 'detail' }, head,
+      error ? h('div', { class: 'load-error', text: error }) : spinner()));
+    return;
+  }
+
+  // Keep the scroll position across the periodic re-render.
+  const scroller = document.querySelector('.pane-detail');
+  const top = scroller ? scroller.scrollTop : 0;
+
+  clear(pane(),
+    h('article', { class: 'detail' },
+      head,
+      error && h('div', { class: 'load-error', text: `Showing older data: ${error}` }),
+      h('h1', { class: 'detail-title', text: inc.title }),
+      h('div', { class: 'detail-badges' }, statusBadges()),
+      facts(),
+      groupLabels(),
+      alertsSection(),
+      timelineSection(),
+    ),
+    actionBar(),
+  );
+  if (scroller) scroller.scrollTop = top;
+}
+
+function statusBadges() {
+  const out = [];
+  if (inc.severity) out.push(badge(inc.severity, `plain ${severityClass(inc.severity)}`));
+  out.push(badge(STATUS_LABEL[inc.status] || inc.status, `st-${inc.status}`));
+  if (inc.status !== 'resolved' && isFuture(inc.snoozed_until)) {
+    out.push(badge(`Snoozed · ${until(inc.snoozed_until)} left`, 'st-snoozed'));
+  }
+  if (inc.archived_at) out.push(badge('Archived', 'plain'));
+  return out;
+}
+
+function who(id, name) {
+  if (id != null && id === myID()) return 'you';
+  return name || 'someone';
+}
+
+function facts() {
+  const rows = [];
+  const add = (k, ...v) => rows.push(h('dt', { text: k }), h('dd', {}, ...v));
+  add('Triggered', when(inc.triggered_at), h('span', { class: 'sub', text: ` · ${ago(inc.triggered_at)}` }));
+  if (inc.acknowledged_at) {
+    add('Acknowledged', `${who(inc.acknowledged_by_id, inc.acknowledged_by)} · ${when(inc.acknowledged_at)}`);
+  }
+  add('Assigned', inc.assigned_to_id != null ? who(inc.assigned_to_id, inc.assigned_to) : 'Unassigned');
+  if (inc.status !== 'resolved' && isFuture(inc.snoozed_until)) {
+    add('Snoozed until', when(inc.snoozed_until));
+  }
+  if (inc.resolved_at) {
+    const how = inc.resolution_source === 'manual' ? 'by hand' : 'alerts stopped firing';
+    add('Resolved', when(inc.resolved_at), h('span', { class: 'sub', text: ` · ${how}` }));
+  }
+  if (inc.archived_at) add('Archived', when(inc.archived_at));
+  return h('div', { class: 'card' }, h('dl', { class: 'facts' }, rows));
+}
+
+function groupLabels() {
+  const entries = Object.entries(inc.group_labels || {});
+  if (!entries.length) return null;
+  return h('section', { class: 'section' },
+    h('h2', { class: 'section-title', text: 'Grouped by' }),
+    h('div', { class: 'labels-wrap' }, entries.map(([k, v]) => labelChip(k, v))),
+  );
+}
+
+function alertsSection() {
+  const list = inc.alerts || [];
+  const firing = list.filter((a) => a.status === 'firing').length;
+  return h('section', { class: 'section' },
+    h('h2', { class: 'section-title' },
+      h('span', { text: `Alerts (${list.length})` }),
+      firing ? h('span', { text: `${firing} firing` }) : null),
+    list.length
+      ? h('div', { class: 'card' }, list.map(alertItem))
+      : h('div', { class: 'card card-pad', text: 'No alerts attached.' }),
+  );
+}
+
+function alertItem(a) {
+  const summary = (a.annotations && (a.annotations.summary || a.annotations.description)) || '';
+  const labels = Object.entries(a.labels || {});
+  return h('div', { class: 'alert-item' },
+    h('div', { class: 'alert-item-head' },
+      h('span', { class: 'alert-item-name', text: a.name }),
+      badge(a.status === 'firing' ? 'Firing' : 'Resolved', `st-${a.status}`)),
+    summary && h('div', { class: 'alert-item-summary', text: summary }),
+    h('div', { class: 'alert-item-foot' },
+      h('span', { text: `Started ${ago(a.starts_at)}` }),
+      h('span', { text: `Last seen ${ago(a.received_at)}` }),
+      a.generator_url && h('a', { href: a.generator_url, target: '_blank', rel: 'noopener noreferrer' }, 'Source ↗'),
+    ),
+    labels.length > 0 && h('details', {},
+      h('summary', { text: `${labels.length} labels` }),
+      h('div', { class: 'labels-wrap' }, labels.map(([k, v]) => labelChip(k, v)))),
+  );
+}
+
+// ---------- timeline ----------
+
+function eventText(ev) {
+  const person = ev.user_id != null ? who(ev.user_id, ev.username) : null;
+  const strong = (t) => h('span', { class: 'who', text: t || 'someone' });
+  const alertName = () => {
+    const a = (inc.alerts || []).find((x) => x.id === ev.alert_id);
+    return a ? a.name : 'an alert';
+  };
+  switch (ev.type) {
+    case 'triggered': return ['Incident triggered'];
+    case 'alert_added': return [`Alert added: ${alertName()}`];
+    case 'alert_resolved': return [`Alert resolved: ${alertName()}`];
+    case 'acknowledged': return [strong(person), ' acknowledged'];
+    case 'unacknowledged': return [strong(person), ' cleared the acknowledgement'];
+    case 'assigned': return ['Assigned to ', strong(person)];
+    case 'snoozed': return [strong(person), ` snoozed until ${ev.detail ? when(ev.detail) : '…'}`];
+    case 'unsnoozed': return [strong(person), ' ended the snooze'];
+    case 'resolved': return person ? [strong(person), ' resolved the incident'] : ['Resolved: every alert stopped firing'];
+    case 'note': return [strong(person), ' added a note'];
+    case 'notified': {
+      const to = person ? strong(person) : 'the fallback topic';
+      if (ev.detail === 'reminder') return ['Reminder sent to ', to];
+      if (ev.detail === 'resolved') return ['Resolution sent to ', to];
+      return ['Paged ', to];
+    }
+    case 'notify_failed': return ['Notification failed', ev.detail ? `: ${ev.detail}` : ''];
+    case 'deadman_silent': return ['Heartbeat went silent', ev.detail ? ` (${ev.detail})` : ''];
+    default: return [ev.type, ev.detail ? `: ${ev.detail}` : ''];
+  }
+}
+
+function timelineSection() {
+  const sorted = [...events].sort((a, b) => Date.parse(a.created_at) - Date.parse(b.created_at) || a.id - b.id);
+  return h('section', { class: 'section' },
+    h('h2', { class: 'section-title' },
+      h('span', { text: 'Timeline' }),
+      h('button', { class: 'btn btn-ghost btn-sm', type: 'button', onclick: addNote },
+        icon('note'), 'Add note')),
+    h('div', { class: 'card' },
+      sorted.length
+        ? h('ol', { class: 'timeline' }, sorted.map(timelineItem))
+        : emptyState('No events yet', '')),
+  );
+}
+
+function timelineItem(ev) {
+  const mine = ev.type === 'note' && ev.user_id === myID();
+  return h('li', { class: `tl-item tl-${ev.type}` },
+    h('span', { class: 'tl-dot' }),
+    h('div', { class: 'tl-body' },
+      h('div', { class: 'tl-text' }, eventText(ev)),
+      h('div', { class: 'tl-time', title: ev.created_at, text: `${when(ev.created_at)} · ${ago(ev.created_at)}` }),
+      ev.type === 'note' && h('div', { class: 'note', text: ev.detail || '' }),
+      mine && h('div', { class: 'note-actions' },
+        h('button', { class: 'btn btn-ghost btn-sm', type: 'button', onclick: () => deleteNote(ev) }, icon('trash'), 'Delete')),
+    ),
+  );
+}
+
+// ---------- actions ----------
+
+const isOpen = () => inc.status !== 'resolved';
+const isSnoozed = () => isOpen() && isFuture(inc.snoozed_until);
+
+function actionBar() {
+  let primary;
+  let secondary;
+  if (inc.status === 'triggered') {
+    primary = h('button', { class: 'btn btn-primary', type: 'button', onclick: acknowledge }, icon('check'), 'Acknowledge');
+  } else if (inc.status === 'acknowledged') {
+    primary = h('button', { class: 'btn btn-primary', type: 'button', onclick: resolve }, icon('checkCircle'), 'Resolve');
+  } else {
+    primary = inc.archived_at
+      ? h('button', { class: 'btn btn-primary', type: 'button', onclick: unarchive }, icon('undo'), 'Unarchive')
+      : h('button', { class: 'btn btn-primary', type: 'button', onclick: archive }, icon('archive'), 'Archive');
+  }
+  if (isOpen()) {
+    secondary = isSnoozed()
+      ? h('button', { class: 'btn', type: 'button', onclick: unsnooze }, icon('bell'), 'Unsnooze')
+      : h('button', { class: 'btn', type: 'button', onclick: snooze }, icon('clock'), 'Snooze');
+  } else {
+    secondary = h('button', { class: 'btn', type: 'button', onclick: addNote }, icon('note'), 'Note');
+  }
+  const more = h('button', { class: 'btn btn-icon', type: 'button', 'aria-label': 'More actions', onclick: moreMenu }, icon('more'));
+  const bar = h('div', { class: 'actionbar' }, primary, secondary, more);
+  if (busy) for (const b of bar.querySelectorAll('button')) b.disabled = true;
+  return bar;
+}
+
+// run performs one action, then reloads the incident and the queue.
+async function run(fn, done) {
+  if (busy) return;
+  busy = true;
+  render();
+  try {
+    await fn();
+    if (done) toast(done);
+  } catch (err) {
+    toast(err.message, 'error');
+  } finally {
+    busy = false;
+    await refresh();
+    poll.now();
+  }
+}
+
+function acknowledge() {
+  const id = inc.id;
+  return run(() => api.acknowledge(id), 'Acknowledged');
+}
+
+function unacknowledge() {
+  const id = inc.id;
+  return run(() => api.unacknowledge(id), 'Acknowledgement cleared');
+}
+
+async function resolve() {
+  const id = inc.id;
+  const ok = await confirm({
+    title: 'Resolve this incident?',
+    text: 'Resolving is final. If these alerts fire again they open a new incident, '
+      + 'and if any are still firing this one stays closed regardless. '
+      + 'Use snooze if you only need it out of the way.',
+    confirmLabel: 'Resolve',
+    danger: true,
+  });
+  if (ok) await run(() => api.resolve(id), 'Resolved');
+}
+
+function archive() {
+  const id = inc.id;
+  return run(() => api.archive(id), 'Archived');
+}
+
+function unarchive() {
+  const id = inc.id;
+  return run(() => api.unarchive(id), 'Unarchived');
+}
+
+function unsnooze() {
+  const id = inc.id;
+  return run(() => api.unsnooze(id), 'Snooze ended');
+}
+
+async function snooze() {
+  const id = inc.id;
+  const tomorrow9 = new Date();
+  tomorrow9.setDate(tomorrow9.getDate() + 1);
+  tomorrow9.setHours(9, 0, 0, 0);
+
+  const options = [
+    ['30 minutes', { duration: '30m' }],
+    ['1 hour', { duration: '1h' }],
+    ['2 hours', { duration: '2h' }],
+    ['4 hours', { duration: '4h' }],
+    ['8 hours', { duration: '8h' }],
+    ['Until 09:00 tomorrow', { until: tomorrow9.toISOString() }],
+  ];
+  const spec = await openSheet(() => [
+    h('h2', { class: 'sheet-title', text: 'Snooze' }),
+    h('p', { class: 'sheet-text', text: 'Hide it from the queue for a while. It comes back on its own.' }),
+    h('ul', { class: 'menu' }, options.map(([label, value]) =>
+      h('li', {}, h('button', { class: 'menu-item', type: 'button', onclick: () => closeSheet(value) },
+        icon('clock'), label)))),
+  ]);
+  if (spec) await run(() => api.snooze(id, spec), 'Snoozed');
+}
+
+async function assign() {
+  const id = inc.id;
+  let list;
+  let onCall;
+  try {
+    [list, onCall] = await Promise.all([users(), api.onCallNow()]);
+  } catch (err) {
+    toast(err.message, 'error');
+    return;
+  }
+  const me = myID();
+  const sorted = [...list].sort((a, b) => (b.id === me) - (a.id === me) || a.username.localeCompare(b.username));
+  const userID = await openSheet(() => [
+    h('h2', { class: 'sheet-title', text: 'Assign to' }),
+    h('ul', { class: 'menu', role: 'menu' }, sorted.map((u) =>
+      h('li', {}, h('button', {
+        class: 'menu-item',
+        type: 'button',
+        role: 'menuitemradio',
+        'aria-checked': String(u.id === inc.assigned_to_id),
+        onclick: () => closeSheet(u.id),
+      },
+        icon('user'),
+        u.id === me ? `${u.username} (you)` : u.username,
+        onCall && onCall.user_id === u.id ? h('span', { class: 'menu-sub', text: 'on call' }) : null,
+      )))),
+  ]);
+  if (userID != null) await run(() => api.assign(id, userID), 'Assigned');
+}
+
+async function addNote() {
+  const id = inc.id;
+  const content = await openSheet(() => {
+    const textarea = h('textarea', {
+      name: 'content', required: true, autofocus: true, placeholder: 'What did you find? What did you do?', maxlength: '10000',
+    });
+    const form = h('form', {
+      class: 'sheet-form',
+      onsubmit: (e) => {
+        e.preventDefault();
+        const v = textarea.value.trim();
+        if (v) closeSheet(v);
+      },
+    },
+      h('h2', { class: 'sheet-title', text: 'Add note' }),
+      textarea,
+      h('div', { class: 'sheet-actions' },
+        h('button', { class: 'btn', type: 'button', onclick: () => closeSheet(null), text: 'Cancel' }),
+        h('button', { class: 'btn btn-primary', type: 'submit', text: 'Save note' })),
+    );
+    // Ctrl/Cmd+Enter saves, as in most note fields.
+    textarea.addEventListener('keydown', (e) => {
+      if (e.key === 'Enter' && (e.ctrlKey || e.metaKey)) form.requestSubmit();
+    });
+    return form;
+  });
+  if (content) await run(() => api.addNote(id, content), 'Note added');
+}
+
+async function deleteNote(ev) {
+  const id = inc.id;
+  const ok = await confirm({ title: 'Delete this note?', text: ev.detail || '', confirmLabel: 'Delete', danger: true });
+  if (ok) await run(() => api.deleteNote(id, ev.id), 'Note deleted');
+}
+
+async function moreMenu() {
+  const item = (iconName, label, fn, cls = '') =>
+    h('li', {}, h('button', { class: `menu-item ${cls}`, type: 'button', onclick: () => closeSheet(fn) }, icon(iconName), label));
+
+  const items = [];
+  if (isOpen()) {
+    if (inc.status === 'triggered') items.push(item('check', 'Acknowledge', acknowledge));
+    else items.push(item('undo', 'Clear acknowledgement', unacknowledge));
+    items.push(item('user', 'Assign…', assign));
+    items.push(isSnoozed() ? item('bell', 'End snooze', unsnooze) : item('clock', 'Snooze…', snooze));
+    items.push(item('note', 'Add note…', addNote));
+    items.push(h('li', { class: 'menu-sep', role: 'separator' }));
+    items.push(item('checkCircle', 'Resolve…', resolve, 'danger'));
+  } else {
+    items.push(item('note', 'Add note…', addNote));
+    items.push(inc.archived_at ? item('undo', 'Unarchive', unarchive) : item('archive', 'Archive', archive));
+  }
+
+  const fn = await openSheet(() => [
+    h('h2', { class: 'sheet-title', text: inc.title }),
+    h('ul', { class: 'menu' }, items),
+  ]);
+  if (fn) await fn();
+}
+
+// key handles the detail's shortcuts. Returns true when it used the key.
+export function key(e) {
+  if (!inc) {
+    if (e.key === 'Escape') {
+      back();
+      return true;
+    }
+    return false;
+  }
+  switch (e.key) {
+    case 'Escape': back(); return true;
+    case 'a': if (inc.status === 'triggered') acknowledge(); return true;
+    case 'A': if (inc.status === 'acknowledged') unacknowledge(); return true;
+    case 'R': if (isOpen()) resolve(); return true;
+    case 's': if (isOpen()) assign(); return true;
+    case 'z': if (isOpen() && !isSnoozed()) snooze(); return true;
+    case 'Z': if (isSnoozed()) unsnooze(); return true;
+    case 'c': addNote(); return true;
+    case 'x': if (!isOpen()) (inc.archived_at ? unarchive() : archive()); return true;
+    default: return false;
+  }
+}
@@ -0,0 +1,141 @@
+// On-call: who is on duty now, the week around it, and your own next shifts.
+// Read-only for now; the TUI edits the schedule.
+
+import * as api from './api.js';
+import { h, clear, icon, spinner } from './ui.js';
+import { isoDate, mondayOf, addDays, isoWeek, initial } from './format.js';
+import { myID } from './state.js';
+
+const view = () => document.getElementById('view-oncall');
+
+let weekStart = mondayOf(new Date());
+let data = null;
+let error = null;
+
+const dayName = new Intl.DateTimeFormat(undefined, { weekday: 'short' });
+const dayDate = new Intl.DateTimeFormat(undefined, { day: 'numeric', month: 'short' });
+
+export function show() {
+  if (!data) clear(view(), spinner());
+  refresh();
+}
+
+export async function refresh() {
+  const start = weekStart;
+  const today = new Date();
+  try {
+    const [now, week, upcoming] = await Promise.all([
+      api.onCallNow(),
+      api.schedule(isoDate(start), isoDate(addDays(start, 6))),
+      api.schedule(isoDate(today), isoDate(addDays(today, 60))),
+    ]);
+    if (start !== weekStart) return;
+    data = { now, week, upcoming };
+    error = null;
+  } catch (err) {
+    error = err.message;
+  }
+  render();
+}
+
+function shiftWeek(n) {
+  weekStart = addDays(weekStart, 7 * n);
+  refresh();
+}
+
+function render() {
+  if (!data) {
+    clear(view(), error ? h('div', { class: 'load-error', text: error }) : spinner());
+    return;
+  }
+  clear(view(),
+    error && h('div', { class: 'load-error', text: `Showing older data: ${error}` }),
+    nowCard(),
+    weekCard(),
+    myShifts(),
+  );
+}
+
+function you(userID) {
+  return userID === myID() ? h('span', { class: 'you', text: 'you' }) : null;
+}
+
+function nowCard() {
+  const n = data.now;
+  return h('div', { class: 'card now-card' },
+    h('div', { class: `avatar ${n ? '' : 'none'}`, text: n ? initial(n.username) : '–' }),
+    h('div', {},
+      h('div', { class: 'now-label', text: 'On call now' }),
+      h('div', { class: 'now-name' }, n ? n.username : 'Nobody', n && you(n.user_id)),
+    ),
+  );
+}
+
+function weekCard() {
+  const byDate = new Map(data.week.map((e) => [e.date, e]));
+  const today = isoDate(new Date());
+  const days = [];
+  for (let i = 0; i < 7; i++) {
+    const d = addDays(weekStart, i);
+    const key = isoDate(d);
+    const e = byDate.get(key);
+    days.push(h('li', { class: `day ${key === today ? 'today' : ''} ${key < today ? 'past' : ''}` },
+      h('span', { class: 'day-name', text: dayName.format(d) }),
+      h('span', { class: 'day-date', text: dayDate.format(d) }),
+      h('span', { class: `day-who ${e ? '' : 'nobody'}` }, e ? e.username : 'nobody', e && you(e.user_id)),
+    ));
+  }
+  const thisWeek = isoDate(weekStart) === isoDate(mondayOf(new Date()));
+  return [
+    h('div', { class: 'page-head' },
+      h('h2', { text: thisWeek ? 'This week' : 'Week' }),
+      h('div', { class: 'week-nav' },
+        h('button', { class: 'btn btn-ghost btn-icon', type: 'button', 'aria-label': 'Previous week', onclick: () => shiftWeek(-1) },
+          icon('chevronLeft')),
+        h('button', {
+          class: 'btn btn-ghost label',
+          type: 'button',
+          title: 'Back to this week',
+          onclick: () => { weekStart = mondayOf(new Date()); refresh(); },
+          text: `Week ${isoWeek(weekStart)}`,
+        }),
+        h('button', { class: 'btn btn-ghost btn-icon', type: 'button', 'aria-label': 'Next week', onclick: () => shiftWeek(1) },
+          icon('chevronRight')),
+      ),
+    ),
+    h('ul', { class: 'card days' }, days),
+  ];
+}
+
+// myShifts groups your upcoming dates into runs of consecutive days.
+function myShifts() {
+  const mine = data.upcoming.filter((e) => e.user_id === myID()).map((e) => e.date).sort();
+  const runs = [];
+  for (const date of mine) {
+    const last = runs[runs.length - 1];
+    if (last && isoDate(addDays(parse(last.to), 1)) === date) last.to = date;
+    else runs.push({ from: date, to: date });
+  }
+  const fmt = (s) => `${dayName.format(parse(s))} ${dayDate.format(parse(s))}`;
+  return [
+    h('div', { class: 'page-head' }, h('h2', { text: 'Your next shifts' })),
+    h('div', { class: 'card' },
+      runs.length
+        ? h('ul', { class: 'shift-list' }, runs.slice(0, 8).map((r) =>
+          h('li', {},
+            h('span', { text: r.from === r.to ? fmt(r.from) : `${fmt(r.from)} – ${fmt(r.to)}` }),
+            h('span', { class: 'muted', text: days(r) })),
+        ))
+        : h('div', { class: 'empty', text: 'Nothing scheduled in the next 60 days.' })),
+  ];
+}
+
+function parse(s) {
+  const [y, m, d] = s.split('-').map(Number);
+  return new Date(y, m - 1, d);
+}
+
+function days(r) {
+  const n = Math.round((parse(r.to) - parse(r.from)) / 86400000) + 1;
+  return n === 1 ? '1 day' : `${n} days`;
+}
@@ -0,0 +1,56 @@
+// Keeps the page fresh the way the TUI does: refresh on an interval, but only
+// while the page is visible, and immediately when it becomes visible again —
+// which is the moment a phone is picked up after a page.
+
+const INTERVAL = 20 * 1000;
+
+let refreshFn = null;
+let timer = 0;
+let running = false;
+let inFlight = null;
+
+export function start(fn) {
+  refreshFn = fn;
+  running = true;
+  schedule();
+}
+
+export function stop() {
+  running = false;
+  clearInterval(timer);
+}
+
+// now refreshes straight away and restarts the interval, after an action.
+export function now() {
+  if (!running) return Promise.resolve();
+  schedule();
+  return tick();
+}
+
+function tick() {
+  if (!refreshFn) return Promise.resolve();
+  // Collapse overlapping refreshes into the one already under way.
+  if (!inFlight) {
+    inFlight = Promise.resolve()
+      .then(refreshFn)
+      .catch(() => {})
+      .finally(() => {
+        inFlight = null;
+      });
+  }
+  return inFlight;
+}
+
+function schedule() {
+  clearInterval(timer);
+  if (running && !document.hidden) timer = setInterval(tick, INTERVAL);
+}
+
+document.addEventListener('visibilitychange', () => {
+  if (!running) return;
+  if (!document.hidden) tick();
+  schedule();
+});
+window.addEventListener('online', () => {
+  if (running) tick();
+});
@@ -0,0 +1,182 @@
+// The incident queue: filter chips and a list of incident rows.
+
+import * as api from './api.js';
+import { h, clear, badge, emptyState, spinner } from './ui.js';
+import { age, until, isFuture, severityClass, labelSummary } from './format.js';
+import { state, myID } from './state.js';
+import { navigate } from './app.js';
+
+// The same filters as the TUI's `f` cycle, plus archived ones to get back to.
+const FILTERS = [
+  { id: 'open', label: 'Open', query: { sort: 'severity' } },
+  { id: 'triggered', label: 'Triggered', query: { status: 'triggered', sort: 'severity' } },
+  { id: 'acknowledged', label: 'Acked', query: { status: 'acknowledged', sort: 'severity' } },
+  { id: 'snoozed', label: 'Snoozed', query: { snoozed: 'true' } },
+  { id: 'resolved', label: 'Resolved', query: { status: 'resolved' } },
+  { id: 'archived', label: 'Archived', query: { status: 'resolved', archived: 'true' } },
+];
+
+const EMPTY = {
+  open: ['All clear', 'Nothing open right now.'],
+  triggered: ['Nothing triggered', 'Every open incident has been acknowledged.'],
+  acknowledged: ['Nothing acknowledged', 'No one is working an incident right now.'],
+  snoozed: ['Nothing snoozed', 'Snoozed incidents show up here until the snooze runs out.'],
+  resolved: ['Nothing resolved', 'Resolved incidents are archived after a while.'],
+  archived: ['Nothing archived', ''],
+};
+
+let filter = loadFilter();
+let items = null; // null while loading
+let error = null;
+let selected = null;
+let cursor = -1; // keyboard position in the list
+let built = false;
+
+function loadFilter() {
+  try {
+    const f = sessionStorage.getItem('terdut.queue.filter');
+    if (FILTERS.some((x) => x.id === f)) return f;
+  } catch {
+    /* storage unavailable */
+  }
+  return 'open';
+}
+
+function saveFilter() {
+  try {
+    sessionStorage.setItem('terdut.queue.filter', filter);
+  } catch {
+    /* storage unavailable */
+  }
+}
+
+export function show(incidentID) {
+  selected = incidentID;
+  if (!built) {
+    renderChips();
+    built = true;
+  }
+  renderList();
+}
+
+export async function refresh({ fresh = false } = {}) {
+  const f = FILTERS.find((x) => x.id === filter);
+  const requested = filter;
+  try {
+    // The open list is already fetched for the badges; no need to ask twice.
+    const result = filter === 'open' && !fresh ? state.open : await api.incidents(f.query);
+    if (requested !== filter) return;
+    items = result;
+    error = null;
+  } catch (err) {
+    if (requested !== filter) return;
+    error = err.message;
+  }
+  renderList();
+}
+
+function setFilter(id) {
+  if (id === filter) return;
+  filter = id;
+  saveFilter();
+  items = null;
+  cursor = -1;
+  renderChips();
+  renderList();
+  refresh({ fresh: true });
+}
+
+function renderChips() {
+  const el = document.getElementById('queue-filters');
+  clear(el, FILTERS.map((f) =>
+    h('button', {
+      class: 'chip',
+      type: 'button',
+      role: 'tab',
+      'aria-selected': String(f.id === filter),
+      onclick: () => setFilter(f.id),
+      text: f.label,
+    }),
+  ));
+}
+
+function renderList() {
+  const el = document.getElementById('queue-list');
+  if (error && !items) {
+    clear(el, h('div', { class: 'load-error', text: error }));
+    return;
+  }
+  if (!items) {
+    clear(el, spinner());
+    return;
+  }
+  if (!items.length) {
+    const [title, text] = EMPTY[filter];
+    clear(el, emptyState(title, text, filter === 'open' ? 'checkCircle' : null));
+    return;
+  }
+  clear(el,
+    error && h('div', { class: 'load-error', text: `Showing older data: ${error}` }),
+    items.map((inc, i) => row(inc, i)),
+  );
+}
+
+function row(inc, index) {
+  const snoozed = isFuture(inc.snoozed_until);
+  const resolved = inc.status === 'resolved';
+
+  let status;
+  if (resolved) status = badge('Resolved', 'st-resolved');
+  else if (snoozed) status = badge(`Snoozed · ${until(inc.snoozed_until)}`, 'st-snoozed');
+  else if (inc.status === 'acknowledged') {
+    const by = inc.acknowledged_by_id === myID() ? 'you' : inc.acknowledged_by;
+    status = badge(`Acked${by ? ' · ' + by : ''}`, 'st-acknowledged');
+  }
+  else status = badge('Triggered', 'st-triggered');
+
+  let assignee = null;
+  if (inc.assigned_to_id != null) {
+    assignee = h('span', { text: inc.assigned_to_id === myID() ? '→ you' : `→ ${inc.assigned_to}` });
+  }
+
+  // The server already puts the group labels in the title; show only the rest.
+  const labels = labelSummary(Object.fromEntries(
+    Object.entries(inc.group_labels || {}).filter(([k, v]) => !inc.title.includes(`${k}=${v}`))));
+  return h('a', {
+    class: `row ${severityClass(inc.severity)} ${resolved ? 'resolved' : ''} ${index === cursor ? 'kbd-focus' : ''}`,
+    href: `/incidents/${inc.id}`,
+    'aria-current': inc.id === selected ? 'true' : null,
+    dataset: { index: String(index) },
+  },
+    h('div', { class: 'row-title', text: inc.title }),
+    h('div', { class: 'row-age', title: inc.triggered_at, text: age(inc.triggered_at) }),
+    h('div', { class: 'row-meta' },
+      status,
+      assignee,
+      labels && h('span', { class: 'labels', text: labels }),
+    ),
+  );
+}
+
+// key handles j/k/enter on the list. Returns true when it used the key.
+export function key(e) {
+  if (!items || !items.length) return false;
+  if (e.key === 'j' || e.key === 'ArrowDown') {
+    cursor = Math.min(items.length - 1, cursor + 1);
+  } else if (e.key === 'k' || e.key === 'ArrowUp') {
+    cursor = Math.max(0, cursor - 1);
+  } else if (e.key === 'Enter' && cursor >= 0) {
+    navigate(`/incidents/${items[cursor].id}`);
+    return true;
+  } else if (e.key === 'f') {
+    const i = FILTERS.findIndex((x) => x.id === filter);
+    setFilter(FILTERS[(i + 1) % FILTERS.length].id);
+    return true;
+  } else {
+    return false;
+  }
+  renderList();
+  const el = document.querySelector(`#queue-list [data-index="${cursor}"]`);
+  if (el) el.scrollIntoView({ block: 'nearest' });
+  return true;
+}
@@ -0,0 +1,31 @@
+// State shared between views: who is signed in, the user list, and the open
+// queue that drives the badges.
+
+import * as api from './api.js';
+
+export const state = {
+  me: null, // { user, has_password }
+  open: [], // the default queue: open, not snoozed
+};
+
+export function myID() {
+  return state.me ? state.me.user.id : null;
+}
+
+// The user list changes rarely; it is fetched once and then at most every
+// five minutes, for the assign sheet and for display names.
+let usersCache = null;
+let usersAt = 0;
+export async function users() {
+  if (!usersCache || Date.now() - usersAt > 5 * 60 * 1000) {
+    usersCache = await api.users();
+    usersAt = Date.now();
+  }
+  return usersCache;
+}
+
+export function reset() {
+  state.me = null;
+  state.open = [];
+  usersCache = null;
+}
@@ -0,0 +1,173 @@
+// DOM helpers, the bottom sheet, confirmation and toasts.
+
+// h builds an element. attrs: class, text, on<event>, dataset, aria/other
+// attributes; boolean true sets an empty attribute, false/null skips it.
+export function h(tag, attrs = {}, ...children) {
+  const el = document.createElement(tag);
+  for (const [k, v] of Object.entries(attrs || {})) {
+    if (v == null || v === false) continue;
+    if (k === 'class') el.className = v;
+    else if (k === 'text') el.textContent = v;
+    else if (k === 'dataset') Object.assign(el.dataset, v);
+    else if (k.startsWith('on') && typeof v === 'function') el.addEventListener(k.slice(2), v);
+    else if (k in el && typeof v !== 'string') el[k] = v;
+    else el.setAttribute(k, v === true ? '' : v);
+  }
+  append(el, children);
+  return el;
+}
+
+function append(el, children) {
+  for (const c of children.flat(Infinity)) {
+    if (c == null || c === false) continue;
+    el.append(c instanceof Node ? c : document.createTextNode(String(c)));
+  }
+}
+
+export function clear(el, ...children) {
+  el.replaceChildren();
+  append(el, children);
+  return el;
+}
+
+// Stroke icons, 24×24. Built as SVG nodes so the CSP needs no inline anything.
+const ICONS = {
+  back: ['M15 18l-6-6 6-6'],
+  more: ['M5 12h.01M12 12h.01M19 12h.01'],
+  check: ['M5 12.5l4.5 4.5L19 7'],
+  checkCircle: ['M8 12.5l3 3 5-6', 'circle:12,12,9'],
+  undo: ['M9 14L4 9l5-5', 'M4 9h10a6 6 0 0 1 0 12h-3'],
+  user: ['circle:12,8,3.5', 'M5 20a7 7 0 0 1 14 0'],
+  clock: ['circle:12,12,9', 'M12 7v5l3 2'],
+  bell: ['M6 16V11a6 6 0 0 1 12 0v5l1.5 2h-15z', 'M10 20.5a2 2 0 0 0 4 0'],
+  note: ['M5 4h14v12l-4 4H5z', 'M15 20v-4h4', 'M9 9h6M9 13h4'],
+  archive: ['M3.5 5h17v4h-17z', 'M5 9v10h14V9', 'M10 13h4'],
+  flag: ['M5 21V4', 'M5 4h11l-2 4 2 4H5'],
+  trash: ['M4 7h16', 'M9 7V4h6v3', 'M6 7l1 13h10l1-13'],
+  chevronLeft: ['M15 18l-6-6 6-6'],
+  chevronRight: ['M9 6l6 6-6 6'],
+  external: ['M14 4h6v6', 'M20 4l-9 9', 'M18 14v6H4V6h6'],
+  logout: ['M15 4h4v16h-4', 'M10 17l5-5-5-5', 'M15 12H4'],
+};
+
+const SVG = 'http://www.w3.org/2000/svg';
+export function icon(name, cls = 'icon') {
+  const svg = document.createElementNS(SVG, 'svg');
+  svg.setAttribute('viewBox', '0 0 24 24');
+  svg.setAttribute('aria-hidden', 'true');
+  svg.setAttribute('class', cls);
+  for (const d of ICONS[name] || []) {
+    let node;
+    if (d.startsWith('circle:')) {
+      const [cx, cy, r] = d.slice(7).split(',');
+      node = document.createElementNS(SVG, 'circle');
+      node.setAttribute('cx', cx);
+      node.setAttribute('cy', cy);
+      node.setAttribute('r', r);
+    } else {
+      node = document.createElementNS(SVG, 'path');
+      node.setAttribute('d', d);
+    }
+    svg.append(node);
+  }
+  return svg;
+}
+
+// ---------- sheet ----------
+
+const sheet = () => document.getElementById('sheet');
+let sheetResolve = null;
+
+// openSheet shows content in the bottom sheet (a centred dialog on desktop)
+// and resolves with whatever closeSheet is given, or null when dismissed.
+export function openSheet(build) {
+  const dlg = sheet();
+  if (dlg.open) closeSheet(null);
+  const inner = h('div', { class: 'sheet-inner' }, h('div', { class: 'sheet-grab' }));
+  append(inner, [build()]);
+  clear(dlg, inner);
+  dlg.showModal();
+  const first = dlg.querySelector('[autofocus]');
+  if (first) first.focus();
+  return new Promise((resolve) => {
+    sheetResolve = resolve;
+  });
+}
+
+export function closeSheet(value = null) {
+  const dlg = sheet();
+  const resolve = sheetResolve;
+  sheetResolve = null;
+  if (dlg.open) dlg.close();
+  if (resolve) resolve(value);
+}
+
+export function sheetIsOpen() {
+  return sheet().open;
+}
+
+export function initSheet() {
+  const dlg = sheet();
+  // A tap on the backdrop lands on the dialog element itself.
+  dlg.addEventListener('click', (e) => {
+    if (e.target === dlg) closeSheet(null);
+  });
+  dlg.addEventListener('cancel', (e) => {
+    e.preventDefault();
+    closeSheet(null);
+  });
+}
+
+// confirm asks a yes/no question in the sheet.
+export function confirm({ title, text, confirmLabel = 'Confirm', danger = false }) {
+  return openSheet(() => [
+    h('h2', { class: 'sheet-title', text: title }),
+    text && h('p', { class: 'sheet-text', text }),
+    h('div', { class: 'sheet-actions' },
+      h('button', { class: 'btn', type: 'button', onclick: () => closeSheet(false), text: 'Cancel' }),
+      h('button', {
+        class: `btn ${danger ? 'btn-danger' : 'btn-primary'}`,
+        type: 'button',
+        autofocus: true,
+        onclick: () => closeSheet(true),
+        text: confirmLabel,
+      }),
+    ),
+  ]).then((v) => v === true);
+}
+
+// ---------- toast ----------
+
+let toastTimer = 0;
+export function toast(message, kind = '') {
+  const el = document.getElementById('toast');
+  el.textContent = message;
+  el.className = `toast ${kind}`;
+  el.hidden = false;
+  clearTimeout(toastTimer);
+  toastTimer = setTimeout(() => {
+    el.hidden = true;
+  }, kind === 'error' ? 5000 : 2500);
+}
+
+// ---------- misc ----------
+
+export function badge(text, cls = '') {
+  return h('span', { class: `badge ${cls}`, text });
+}
+
+export function labelChip(k, v) {
+  return h('span', { class: 'label', title: `${k}=${v}` }, h('span', { text: k }), h('span', { text: v }));
+}
+
+export function emptyState(title, text, iconName) {
+  return h('div', { class: 'empty' },
+    iconName && icon(iconName),
+    h('strong', { text: title }),
+    text && h('span', { text }),
+  );
+}
+
+export function spinner() {
+  return h('div', { class: 'empty' }, h('span', { class: 'spinner' }));
+}
@@ -0,0 +1,16 @@
+{
+  "name": "terdut",
+  "short_name": "terdut",
+  "description": "Incident queue and on-call for terdut-server",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#0f1115",
+  "theme_color": "#1b1e25",
+  "icons": [
+    { "src": "/icon.svg", "sizes": "any", "type": "image/svg+xml" },
+    { "src": "/icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
+    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
+    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" }
+  ]
+}
@@ -0,0 +1,135 @@
+// Package web serves the web UI, compiled into the binary.
+//
+// There is no build step: the files under static/ are what the browser gets.
+// The page talks to the server's own /api over the same origin, signed in with
+// the session cookie from POST /api/login.
+package web
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"embed"
+	"encoding/base64"
+	"errors"
+	"io/fs"
+	"net/http"
+	"path"
+	"strings"
+	"time"
+)
+
+//go:embed static
+var files embed.FS
+
+// asset is one embedded file, with its validator computed once at startup.
+type asset struct {
+	body  []byte
+	etag  string
+	ctype string
+	cache string
+}
+
+// Handler serves the embedded site. A path without a file extension that
+// matches no file gets index.html, so a deep link such as /incidents/42 — the
+// target of a notification tap — survives a reload; the page reads the path
+// and renders the right view. A missing file with an extension is a real 404.
+func Handler() (http.Handler, error) {
+	root, err := fs.Sub(files, "static")
+	if err != nil {
+		return nil, err
+	}
+
+	assets := make(map[string]*asset)
+	err = fs.WalkDir(root, ".", func(p string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return err
+		}
+		b, err := fs.ReadFile(root, p)
+		if err != nil {
+			return err
+		}
+		sum := sha256.Sum256(b)
+		assets["/"+p] = &asset{
+			body:  b,
+			etag:  `"` + base64.RawURLEncoding.EncodeToString(sum[:16]) + `"`,
+			ctype: contentType(p),
+			cache: cacheControl(p),
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	index, ok := assets["/index.html"]
+	if !ok {
+		return nil, errors.New("web: static/index.html is missing")
+	}
+
+	// embed.FS reports a zero ModTime, so http.FileServerFS would emit no
+	// validator and every asset would be refetched in full on every load.
+	// Hence the ETag above and ServeContent below, with a zero time that
+	// suppresses Last-Modified.
+	var noTime time.Time
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet && r.Method != http.MethodHead {
+			w.Header().Set("Allow", "GET, HEAD")
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+
+		p := path.Clean(r.URL.Path)
+		f, ok := assets[p]
+		if !ok {
+			if path.Ext(p) != "" {
+				http.NotFound(w, r)
+				return
+			}
+			f = index
+		}
+
+		w.Header().Set("Content-Type", f.ctype)
+		w.Header().Set("Cache-Control", f.cache)
+		w.Header().Set("ETag", f.etag)
+		// The page loads nothing from anywhere else, so the policy can say so
+		// outright rather than carve out exceptions.
+		w.Header().Set("Content-Security-Policy",
+			"default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; "+
+				"connect-src 'self'; manifest-src 'self'; form-action 'self'; "+
+				"frame-ancestors 'none'; base-uri 'none'")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("Referrer-Policy", "same-origin")
+
+		http.ServeContent(w, r, "", noTime, bytes.NewReader(f.body))
+	}), nil
+}
+
+func contentType(p string) string {
+	switch path.Ext(p) {
+	case ".html":
+		return "text/html; charset=utf-8"
+	case ".css":
+		return "text/css; charset=utf-8"
+	case ".js":
+		return "text/javascript; charset=utf-8"
+	case ".svg":
+		return "image/svg+xml"
+	case ".png":
+		return "image/png"
+	case ".webmanifest":
+		return "application/manifest+json"
+	default:
+		return "application/octet-stream"
+	}
+}
+
+// cacheControl keeps index.html revalidating on every load, because it names
+// the current asset paths. Assets carry an ETag, so a five-minute window costs
+// one conditional request after a deploy rather than a stale page.
+func cacheControl(p string) string {
+	if strings.HasSuffix(p, ".html") {
+		return "no-cache"
+	}
+	return "public, max-age=300"
+}