feat(alerts): resolved events stay in the log, referenced by their closing event (#1349) (#1396)

Resolve used to DELETE the original event from alert_log: after an
outdated -> updated cycle only the 'resolved' event remained, with no
way to review what had actually happened.

- alert_log gains resolved_ts (defensive migration). Resolve marks the
  event (and unsets its read mirror so a recurrence with the same stable
  id cannot inherit the old read state - #1107 still holds) instead of
  deleting the row.
- loadPersisted brings resolved events back into the feed MARKED
  (resolvedTs, always read, and they never seed the dedup map: a
  recurrence right after a restart must alert immediately, same as the
  hot Resolve path).
- persistLocked upserts resolved_ts, so a recurrence with the same
  stable id un-resolves the row.
- AlertEvent gains resolves[]: the closing event references what it
  closed. Filled for agent outdated->updated and snmp failing->recovered
  (the two Resolve pairs; volatile incidents use Remove and never reach
  the log).
- UI: resolved events carry a Resolved badge, count under the Resolved
  filter tab (warnings/info exclude them, All keeps them), and expanding
  a closing event lists the events it resolved (dropdown). i18n es/en.

Tests updated to the new contract (resolved events persist across
restart, read-forgetting on recurrence) plus the pre-existing suite.

Closes #1349

Author: gnacho

app/public/locales/en/translation.json

@@ -49,6 +49,9 @@
     },
     "filterByCategory": "Filter by category",
     "urgentBadge": "URGENT",
+    "resolvedBadge": "Resolved",
+    "resolvesTitle_one": "Resolves {{count}} event",
+    "resolvesTitle_other": "Resolves {{count}} events",
     "configButton": "Configure alerts",
     "configTitle": "Alert settings",
     "configDescription": "Choose which events are kept in your history and counted on the bell, per category.",

app/public/locales/es/translation.json

@@ -49,6 +49,9 @@
     },
     "filterByCategory": "Filtrar por categoría",
     "urgentBadge": "URGENTE",
+    "resolvedBadge": "Resuelta",
+    "resolvesTitle_one": "Resuelve {{count}} evento",
+    "resolvesTitle_other": "Resuelve {{count}} eventos",
     "configButton": "Configurar alertas",
     "configTitle": "Configuración de alertas",
     "configDescription": "Elige qué eventos entran en tu historial y cuentan en la campana, por categoría.",

app/src/data/types.ts

@@ -369,6 +369,12 @@ export interface AlertEvent {
   routerId?: string
   /** Router padre que suprime esta alerta (issue #332). Ausente si no aplica. */
   suppressedBy?: string
+  /** #1349: unix segundos de cuándo se resolvió. Ausente/0 = activa. El
+   *  evento resuelto se conserva en el log (pestaña Resueltas). */
+  resolvedTs?: number
+  /** #1349: IDs de los eventos que este evento de cierre resuelve. La UI
+   *  los lista al expandirlo. */
+  resolves?: string[]
 }
 
 // ---------------------------------------------------------------------------

app/src/pages/Alerts.tsx

@@ -300,11 +300,14 @@ interface FeedRowProps {
   onSilence?: (id: string, duration: '1h' | '24h' | 'forever') => void
   onDismiss?: (id: string) => void
   action?: { icon: LucideIcon; title: string; onClick: () => void }
+  /** #1349: feed por id para resolver los eventos que un evento de cierre
+   *  (`ev.resolves`) cerró y listarlos al expandirlo. */
+  feedById?: Map<string, FeedEvent>
 }
 
 // #862: RowAction vive en components/RowAction.tsx (compartido con AlertItem).
 
-function FeedRow({ ev, index, read, expanded, onToggle, reduce, onSilence, onDismiss, action }: FeedRowProps) {
+function FeedRow({ ev, index, read, expanded, onToggle, reduce, onSilence, onDismiss, action, feedById }: FeedRowProps) {
   const { t } = useTranslation()
   const sev = SEVERITY[ev.severity]
   const Icon = ev.icon ?? sev.icon
@@ -370,6 +373,12 @@ function FeedRow({ ev, index, read, expanded, onToggle, reduce, onSilence, onDis
                   {t('alerts.urgentBadge')}
                 </span>
               )}
+              {/* #1349: marca visible del episodio cerrado en el log */}
+              {!!ev.resolvedTs && ev.resolvedTs > 0 && (
+                <span className="shrink-0 rounded-md bg-ok/10 px-1.5 py-0.5 text-[10px] font-bold uppercase tracking-[0.05em] text-ok">
+                  {t('alerts.resolvedBadge')}
+                </span>
+              )}
               {catMeta && CatIcon && (
                 <span
                   className={cn(
@@ -482,6 +491,30 @@ function FeedRow({ ev, index, read, expanded, onToggle, reduce, onSilence, onDis
           >
             <div className="mx-3 mb-2 mt-1">
               <ContextPanel ev={ev} animateIn={!reduce} />
+              {/* #1349: el evento de cierre lista los eventos que resolvió
+                  (conservados en el log marcados, no borrados). */}
+              {expanded && ev.resolves && ev.resolves.length > 0 && feedById && (
+                <div className="mt-2 rounded-lg border border-border bg-canvas px-3 py-2">
+                  <p className="text-[11px] font-semibold uppercase tracking-[0.05em] text-text-muted">
+                    {t('alerts.resolvesTitle', { count: ev.resolves.length })}
+                  </p>
+                  <ul className="mt-1 space-y-1">
+                    {ev.resolves.map((rid) => {
+                      const orig = feedById.get(rid)
+                      return (
+                        <li key={rid} className="flex items-center justify-between gap-2 text-caption">
+                          <span className="min-w-0 truncate text-text-secondary">
+                            {orig ? alertTitle(t, orig) : rid}
+                          </span>
+                          {orig && (
+                            <span className="shrink-0 font-mono text-[10px] text-text-muted">{alertRelTime(orig)}</span>
+                          )}
+                        </li>
+                      )
+                    })}
+                  </ul>
+                </div>
+              )}
             </div>
           </motion.div>
         )}
@@ -613,7 +646,15 @@ export default function Alerts() {
   const filtered = useMemo(
     () =>
       alertFeed.filter((ev) => {
-        if (sev !== 'todas' && ev.severity !== SEV_MATCH[sev]) return false
+        // #1349: un evento resuelto (resolvedTs) pertenece a la pestaña
+        // Resueltas; en Avisos/Info ya no cuenta (su condición cerró).
+        // "Todas" lo muestra: es el registro de actividad completo.
+        if (sev === 'resueltas') {
+          if (ev.severity !== 'ok' && !(ev.resolvedTs && ev.resolvedTs > 0)) return false
+        } else if (sev !== 'todas') {
+          if (ev.resolvedTs && ev.resolvedTs > 0) return false
+          if (ev.severity !== SEV_MATCH[sev]) return false
+        }
         if (cats.size > 0 && !cats.has(ev.category)) return false
         if (onlyUnread && isRead(ev)) return false
         return true
@@ -629,6 +670,9 @@ export default function Alerts() {
     [filtered],
   )
 
+  // #1349: lookup por id para el dropdown de "eventos que resuelve".
+  const feedById = useMemo(() => new Map(alertFeed.map((ev) => [ev.id, ev])), [alertFeed])
+
   // Infinite scroll simulado: skeleton → fin del historial (alerts.md §Scroll)
   useEffect(() => {
     const el = sentinelRef.current
@@ -995,6 +1039,7 @@ export default function Alerts() {
                     onSilence={silenceAlert}
                     onDismiss={dismissAlert}
                     action={actionOf(ev)}
+                    feedById={feedById}
                   />
                 ))}
               </ul>

server-go/internal/adapters/agent.go

@@ -991,7 +991,10 @@ func (l *Live) checkAgentVersion(cfg RouterConfig, p *probe.Payload) {
 				Description: fmt.Sprintf("%s now pushes version %s of %s", name, p.Version, kindLabel),
 				Type:        alerts.TypeAgentUpdated,
 				Vars:        map[string]string{"router": name, "version": p.Version, "kind": kindLabel},
-				Time:        "just now", RouterID: cfg.ID,
+				// #1349: el evento de cierre referencia al que resuelve
+				// (conservado en el log marcado, no borrado).
+				Resolves: []string{fmt.Sprintf("alert-agent-outdated-%s", cfg.ID)},
+				Time:     "just now", RouterID: cfg.ID,
 			})
 		}
 	}

server-go/internal/adapters/snmp_live.go

@@ -256,7 +256,8 @@ func (l *Live) recordSnmpSuccess(cfg RouterConfig) {
 
 	if wasOpen {
 		log.Printf("[netpulse] SNMP recuperado %s", cfg.LogLabel())
-		l.engine.Resolve(fmt.Sprintf("alert-snmp-failing-%s", cfg.ID))
+		failID := fmt.Sprintf("alert-snmp-failing-%s", cfg.ID)
+		l.engine.Resolve(failID)
 		l.engine.Emit(AlertEvent{
 			ID:       fmt.Sprintf("alert-snmp-recovered-%s-%d", cfg.ID, now),
 			Category: alerts.CatSystem, Urgent: false,
@@ -265,6 +266,7 @@ func (l *Live) recordSnmpSuccess(cfg RouterConfig) {
 			Description: fmt.Sprintf("SNMP polling for %s is responding again", name),
 			Type:        alerts.TypeSnmpRecovered,
 			Vars:        map[string]string{"router": name},
+			Resolves:    []string{failID}, // #1349
 			Time:        "just now", RouterID: cfg.ID,
 		})
 	}

server-go/internal/alerts/alerts.go

@@ -79,6 +79,15 @@ type AlertEvent struct {
 	// SuppressedBy is the routerId of the parent router whose offline alert
 	// is suppressing this one (issue #332). Empty when not suppressed.
 	SuppressedBy string `json:"suppressedBy,omitempty"`
+	// ResolvedTs (#1349): unix SEGUNDOS de cuándo se resolvió la condición.
+	// 0/ausente = activa. El evento resuelto NO se borra del log: queda
+	// marcado para revisión posterior (pestaña Resueltas) y una
+	// reincidencia con el mismo ID estable lo des-resuelve (upsert).
+	ResolvedTs int64 `json:"resolvedTs,omitempty"`
+	// Resolves (#1349): IDs de los eventos que este evento CIERRA (p. ej.
+	// "Agent updated" resuelve "alert-agent-outdated-<id>"). La UI los
+	// muestra al expandir el evento de cierre.
+	Resolves []string `json:"resolves,omitempty"`
 	// Volatile (#966): la alerta vive SOLO en memoria (no se persiste en
 	// alert_log ni sobrevive a reinicios) y desaparece del feed cuando su
 	// condicion se resuelve (engine.Remove). Uso: caida de agente, cuya
@@ -319,7 +328,7 @@ func (e *Engine) loadPersistedLocked() {
 	}
 	rows, err := e.db.Query(
 		`SELECT id, ts, category, type, severity, urgent, title, description, hint,
-		        router_id, suppressed_by, vars, read_flag
+		        router_id, suppressed_by, vars, read_flag, resolved_ts
 		 FROM alert_log ORDER BY ts DESC LIMIT ?`, MaxEvents)
 	if err != nil {
 		return
@@ -335,13 +344,18 @@ func (e *Engine) loadPersistedLocked() {
 		var typ, sev, hint, routerID, suppressedBy, varsRaw string
 		var urgent, read int
 		if err := rows.Scan(&ev.ID, &ev.Ts, &ev.Category, &typ, &sev, &urgent,
-			&ev.Title, &ev.Description, &hint, &routerID, &suppressedBy, &varsRaw, &read); err != nil {
+			&ev.Title, &ev.Description, &hint, &routerID, &suppressedBy, &varsRaw, &read, &ev.ResolvedTs); err != nil {
 			return
 		}
 		// #833: una alerta limpiada no vuelve a aparecer tras un reinicio.
 		if e.dismissed[ev.ID] {
 			continue
 		}
+		// #1349: un evento resuelto vuelve al feed MARCADO (historia
+		// consultable en Resueltas) y nunca como pendiente de leer.
+		if ev.ResolvedTs > 0 {
+			read = 1
+		}
 		ev.Type = typ
 		ev.Severity = sev
 		ev.Urgent = urgent != 0
@@ -363,8 +377,13 @@ func (e *Engine) loadPersistedLocked() {
 		key := r.ev.Category + "|" + r.ev.Title + "|" + r.ev.RouterID
 		// Las filas vienen de más reciente a más antigua: solo la primera por
 		// clave es el timestamp de dedup válido (no pisar con la más vieja).
-		if _, ok := e.dedup[key]; !ok {
-			e.dedup[key] = r.ev.Ts * 1000
+		// #1349: un RESUELTO no siembra dedup - su condición está cerrada y
+		// una reincidencia tras reinicio debe alertar de inmediato (mismo
+		// criterio que Resolve en caliente, que borra la clave de dedup).
+		if r.ev.ResolvedTs == 0 {
+			if _, ok := e.dedup[key]; !ok {
+				e.dedup[key] = r.ev.Ts * 1000
+			}
 		}
 		if r.read && r.ev.ID != "" && !e.readSet[r.ev.ID] {
 			e.readSet[r.ev.ID] = true
@@ -508,14 +527,15 @@ func (e *Engine) persistLocked(ev AlertEvent) {
 		urgent = 1
 	}
 	_, _ = e.db.Exec(
-		`INSERT INTO alert_log (id, ts, category, type, severity, urgent, title, description, hint, router_id, suppressed_by, vars)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		`INSERT INTO alert_log (id, ts, category, type, severity, urgent, title, description, hint, router_id, suppressed_by, vars, resolved_ts)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 		 ON CONFLICT(id) DO UPDATE SET ts=excluded.ts, category=excluded.category,
 		   type=excluded.type, severity=excluded.severity, urgent=excluded.urgent,
 		   title=excluded.title, description=excluded.description, hint=excluded.hint,
-		   router_id=excluded.router_id, suppressed_by=excluded.suppressed_by, vars=excluded.vars`,
+		   router_id=excluded.router_id, suppressed_by=excluded.suppressed_by, vars=excluded.vars,
+		   resolved_ts=excluded.resolved_ts`,
 		ev.ID, ev.Ts, ev.Category, ev.Type, ev.Severity, urgent,
-		ev.Title, ev.Description, ev.Hint, ev.RouterID, ev.SuppressedBy, varsRaw)
+		ev.Title, ev.Description, ev.Hint, ev.RouterID, ev.SuppressedBy, varsRaw, ev.ResolvedTs)
 	_, _ = e.db.Exec(
 		`DELETE FROM alert_log WHERE id NOT IN
 		   (SELECT id FROM alert_log ORDER BY ts DESC LIMIT ?)`, PersistMaxEvents)
@@ -986,7 +1006,14 @@ func (e *Engine) Resolve(id string) {
 	}
 	e.saveReadLocked()
 	if e.db != nil {
-		_, _ = e.db.Exec("DELETE FROM alert_log WHERE id = ?", id)
+		// #1349: el evento resuelto se CONSERVA en el log (marcado con su ts
+		// de cierre) en vez de borrarse: el registro de actividad mantiene
+		// qué pasó y cuándo se cerró. La pestaña Resueltas de la UI lo lista.
+		// read_flag=0: el resuelto se muestra leído por la regla de carga
+		// (resolved_ts>0 → leído), y si la condición REINCIDE con el mismo
+		// ID estable, el upsert (resolved_ts=0) no puede heredar un leído
+		// viejo de la fila conservada (#1107 sigue valiendo).
+		_, _ = e.db.Exec("UPDATE alert_log SET resolved_ts = ?, read_flag = 0 WHERE id = ?", time.Now().Unix(), id)
 	}
 }
 

server-go/internal/alerts/dismiss_test.go

@@ -130,10 +130,35 @@ func TestResolvePersistsAcrossRestart(t *testing.T) {
 	e := New(d, nil)
 	e.Emit(ev("a1", CatSystem, false))
 	e.Resolve("a1")
+	// En memoria sale del feed activo en caliente (como siempre).
+	if e.Has("a1") {
+		t.Fatal("Has tras resolve en caliente")
+	}
 
+	// #1349: tras reinicio el evento resuelto VUELVE al log marcado
+	// (resolvedTs>0, leído): el registro conserva qué pasó y cuándo cerró.
 	e2 := New(d, nil)
-	if got := len(e2.List()); got != 0 {
-		t.Fatalf("lista tras reinicio: %d, esperaba 0", got)
+	got := e2.List()
+	if len(got) != 1 {
+		t.Fatalf("lista tras reinicio: %d, esperaba 1 (resuelto conservado)", len(got))
+	}
+	if got[0].ResolvedTs == 0 {
+		t.Fatal("el evento cargado debe llevar resolvedTs")
+	}
+	if !got[0].Read {
+		t.Fatal("el resuelto nunca vuelve como pendiente de leer")
+	}
+
+	// Reincidencia con el mismo ID estable: el upsert lo des-resuelve y
+	// vuelve activo y no leído (#1107 sigue valiendo con el log conservado).
+	e2.Emit(ev("a1", CatSystem, false))
+	e3 := New(d, nil)
+	got3 := e3.List()
+	if len(got3) != 1 || got3[0].ResolvedTs != 0 {
+		t.Fatalf("reincidencia debe des-resolver: %+v", got3)
+	}
+	if got3[0].Read {
+		t.Fatal("la reincidencia no puede heredar el leído")
 	}
 }
 

server-go/internal/db/db.go

@@ -581,6 +581,10 @@ func Open(dataDir string, opts ...OpenOption) (*DB, error) {
 	migrate(sqldb, "routers", "mac", "ALTER TABLE routers ADD COLUMN mac TEXT")
 	// Ancho de canal de los vecinos (#1087), con el agente nuevo; 0 = viejo.
 	migrate(sqldb, "wifi_scans", "width_mhz", "ALTER TABLE wifi_scans ADD COLUMN width_mhz INTEGER NOT NULL DEFAULT 0")
+	// #1349: el evento resuelto NO se borra del log: queda marcado con su
+	// ts de resolución para revisión posterior (y el evento de cierre lo
+	// referencia con `resolves`). 0 = activo/no resuelto.
+	migrate(sqldb, "alert_log", "resolved_ts", "ALTER TABLE alert_log ADD COLUMN resolved_ts INTEGER NOT NULL DEFAULT 0")
 	// issue #241: target de firmware por router (string libre; NULL/"" = sin comprobar).
 	migrate(sqldb, "routers", "firmware_target", "ALTER TABLE routers ADD COLUMN firmware_target TEXT")
 	// issue #309: SNMP polling for managed switches.