vybe · Oct 6, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
diff --git a/.env.example b/.env.example
@@ -396,6 +396,12 @@ OPERATOR_QUEUE_EXECUTION_ID_MAX=128           # max execution_id preserved in a
 OPERATOR_QUEUE_EMAIL_MAX=320                  # ent#364: addressee email length clamp (RFC 5321)
 OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS=300  # one flood alert per agent per this window
 OPERATOR_ALERT_MAX_PENDING_PER_TYPE=5         # per-(agent, type) pending budget for agent-influenceable platform alerts (#1677)
+# #3246: a platform alert is one row per condition — it expires this many days after
+# its LAST reading (bad value → default + WARNING) …
+OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS=14
+# … and after a person ends one, the same reading files nothing for this many days
+# unless its priority rises or a material field changes.
+OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS=7
 
 # ===========================================
 # SERVICE URLS (Usually no need to change)

diff --git a/docker-compose.hosted.yml b/docker-compose.hosted.yml
@@ -283,6 +283,8 @@ services:
       - OPERATOR_QUEUE_EMAIL_MAX=${OPERATOR_QUEUE_EMAIL_MAX:-320}                               # ent#364: addressee email length clamp (RFC 5321)
       - OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS=${OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS:-300}  # one flood alert / agent / window
       - OPERATOR_ALERT_MAX_PENDING_PER_TYPE=${OPERATOR_ALERT_MAX_PENDING_PER_TYPE:-5}     # per-(agent,type) platform-alert budget (#1677)
+      - OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS=${OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS:-14}   # #3246: platform alert expires N days after its last reading
+      - OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS=${OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS:-7}        # #3246: a person's ending holds N days unless priority rises
       - GITHUB_PAT=${GITHUB_PAT}
       # Log Retention & Archival Configuration (#1039)
       # These were MISSING from prod — prod launches standalone (no base-compose

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
@@ -220,6 +220,8 @@ services:
       - OPERATOR_QUEUE_EMAIL_MAX=${OPERATOR_QUEUE_EMAIL_MAX:-320}                               # ent#364: addressee email length clamp (RFC 5321)
       - OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS=${OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS:-300}  # one flood alert / agent / window
       - OPERATOR_ALERT_MAX_PENDING_PER_TYPE=${OPERATOR_ALERT_MAX_PENDING_PER_TYPE:-5}     # per-(agent,type) platform-alert budget (#1677)
+      - OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS=${OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS:-14}   # #3246: platform alert expires N days after its last reading
+      - OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS=${OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS:-7}        # #3246: a person's ending holds N days unless priority rises
       - GITHUB_PAT=${GITHUB_PAT}
       # Log Retention & Archival Configuration (#1039)
       # These were MISSING from prod — prod launches standalone (no base-compose

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -162,6 +162,8 @@ services:
       - OPERATOR_QUEUE_EMAIL_MAX=${OPERATOR_QUEUE_EMAIL_MAX:-320}                               # ent#364: addressee email length clamp (RFC 5321)
       - OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS=${OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS:-300}  # one flood alert / agent / window
       - OPERATOR_ALERT_MAX_PENDING_PER_TYPE=${OPERATOR_ALERT_MAX_PENDING_PER_TYPE:-5}     # per-(agent,type) platform-alert budget (#1677)
+      - OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS=${OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS:-14}   # #3246: platform alert expires N days after its last reading
+      - OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS=${OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS:-7}        # #3246: a person's ending holds N days unless priority rises
       - GITHUB_PAT=${GITHUB_PAT:-}
       - HOST_TEMPLATES_PATH=${PWD}/config/agent-templates
       # First-run default system seed (trinity-enterprise#124): a path to an

diff --git a/docs/memory/architecture/backend.md b/docs/memory/architecture/backend.md
diff --git a/docs/memory/architecture/database.md b/docs/memory/architecture/database.md
@@ -751,7 +751,7 @@ CREATE TABLE operator_queue (
     -- trinity-enterprise#611 (SQLite `operator_queue_ask_object` / Alembic `0076_operator_queue_ask_object`; nullable, no backfill):
     disposition TEXT,                   -- answered|cancelled|expired — written in the SAME CAS UPDATE that flips `status`; NULL = ended before the ledger
     disposed_at TEXT,
-    disposed_by TEXT,                   -- person|timeout (an enum of two: only a person or the clock ends an ask)
+    disposed_by TEXT,                   -- person|timeout|platform — only a person or the clock ends an ASK; `platform` ends only a platform alert (#3130 superseded flood alarms, #3246 condition_cleared)
     disposed_by_email TEXT,             -- NULL for timeout; withheld from machine keys on get/list
     disposition_reason TEXT,            -- the operator's optional cancel reason (≤ 500); never in an audit row, never to a Workspace client
     batch_id TEXT,                      -- one uuid per bulk-cancel sweep; its re-select is the sweep's CAS winners
@@ -761,6 +761,8 @@ CREATE TABLE operator_queue (
     resolved_to TEXT,                   -- PR B: JSON list of person refs; withheld from machine keys
     proposal TEXT,                      -- PR B: JSON, the frozen action
     supersedes_expired TEXT,            -- PR B: the agent's own expired predecessor (row uuid)
+    subject TEXT,                       -- #3246: a platform alert's condition key `<kind>:<key>`; at most one PENDING row per (agent_name, subject) — partial unique index uq_operator_queue_pending_subject
+    last_seen_at TEXT,                  -- #3246: the latest reading of that condition (the count rides in context.seen_count)
     FOREIGN KEY (responded_by_id) REFERENCES users(id)
 );
 CREATE INDEX idx_operator_queue_agent ON operator_queue(agent_name);

diff --git a/docs/memory/feature-flows/internal-system-agent.md b/docs/memory/feature-flows/internal-system-agent.md
@@ -129,7 +129,7 @@ would assert only that a correct container is correct.
 
 | Boundary | Behaviour |
 |---|---|
-| Backend boot, container **running** | **Read-only.** `check_base_image_state()` → `result["base_image_state"]` ∈ `stale \| current \| unknown`; `action: "none"`. WARNING names the remedy; an edge-triggered `base-image-stale-` operator-queue alarm fires on `stale` **only** (a fail-open probe must never manufacture an alert, so `unknown` never alarms). **No recreate call exists in this branch** — source-pinned. The alarm's cooldown cursor is **per-process**, and `ensure_deployed` runs once per worker's lifespan, so a stale boot files one item **per worker** (`--workers 2` ⇒ 2). Deliberate: a cross-worker cursor would put Redis or a DB read on the boot path for an advisory alarm, and the un-guessable timestamped id — which is what stops an agent pre-creating and silencing it — cannot be deduped by `on_conflict_do_nothing` anyway. |
+| Backend boot, container **running** | **Read-only.** `check_base_image_state()` → `result["base_image_state"]` ∈ `stale \| current \| unknown`; `action: "none"`. WARNING names the remedy; an edge-triggered `base-image-stale-` operator-queue alarm fires on `stale` **only** (a fail-open probe must never manufacture an alert, so `unknown` never alarms). **No recreate call exists in this branch** — source-pinned. The alarm's cooldown cursor is **per-process**, and `ensure_deployed` runs once per worker's lifespan, so a stale boot files one item **per worker** (`--workers 2` ⇒ 2). *(Since #3246 the alarm goes through `platform_alerts.observe` under the subject `base_image_stale:trinity-system`: every worker's reading lands on the SAME pending row (seen count + 1), the platform ends it when the image is current again, and it expires after a 30-day net — no longer one item per worker that stays until acknowledged.)* Deliberate: a cross-worker cursor would put Redis or a DB read on the boot path for an advisory alarm, and the un-guessable timestamped id — which is what stops an agent pre-creating and silencing it — cannot be deduped by `on_conflict_do_nothing` anyway. |
 | Backend boot, container **stopped** | Delegates to `start_agent_internal(SYSTEM_AGENT_NAME)` instead of a bare `container_start`, inheriting the #1809 cold-start image gate, #1560 clear-before-recreate ordering, the 409/NotFound concurrent-recreate hardening and the post-recreate handle re-lookup. `recreated` / `recreate_reason` are surfaced into the result. **This is where adoption happens.** |
 | `POST /api/system-agent/restart` | Explicit stop, then `start_agent_internal` — same adoption path. The response re-fetches the container so it reports the replacement's status, not the removed handle's. |