ci: centralize QBit source scanning

Co-Authored-By: Codex <noreply@openai.com>

.circleci/config.yml

@@ -1,60 +1,14 @@
 version: 2.1
-
+setup: true
 orbs:
-   qqq-orb: kingsrook/qqq-orb@0.6.9
-
-commands:
-   configure-package-install:
-      steps:
-         - run:
-              name: Keep package installation unattended
-              command: |
-                 # These build machines are discarded after the job.
-                 sudo install -d /etc/needrestart/conf.d
-                 printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
-
+  qqq-orb: kingsrook/qqq-orb@0.7.12
 workflows:
-   test_only:
-      jobs:
-         - qqq-orb/mvn_test_only:
-              pre-steps:
-                 - configure-package-install
-              context: [qqq-maven-registry-credentials]
-              filters:
-                 branches:
-                    ignore: /(develop|release\/.*)/
-
-   publish_snapshot:
-      jobs:
-         - qqq-orb/mvn_publish:
-              pre-steps:
-                 - configure-package-install
-              context: [qqq-maven-registry-credentials]
-              branch_type: snapshot
-              filters:
-                 branches:
-                    only: [develop]
-
-   publish_release_candidate:
-      jobs:
-         - qqq-orb/mvn_publish:
-              pre-steps:
-                 - configure-package-install
-              context: [qqq-maven-registry-credentials]
-              branch_type: release_candidate
-              filters:
-                 branches:
-                    only: [/release\/.*/]
-
-   publish_release:
-      jobs:
-         - qqq-orb/mvn_publish:
-              pre-steps:
-                 - configure-package-install
-              context: [qqq-maven-registry-credentials]
-              branch_type: release
-              filters:
-                 branches:
-                    ignore: /.*/
-                 tags:
-                    only: [/^v\d+\.\d+\.\d+$/]
+  setup:
+    jobs:
+    - qqq-orb/generate_pipeline:
+        orb_version: 0.7.12
+        filters:
+          branches:
+            ignore: automation/qbit-rc-pending
+          tags:
+            only: /^v\d+\.\d+\.\d+$/

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.github/workflows/release-rc.yml

@@ -1,25 +1,74 @@
-# Cut the next release candidate (QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md, C6):
-# run this workflow by hand, or merge a develop PR labelled `release:rc`. It merges develop into
-# the release line and the release/* push runs CircleCI publish_release_candidate.
 name: Release candidate
-
-on:
+'on':
   workflow_dispatch:
     inputs:
       dry_run:
-        description: Print the plan without merging or creating branches
+        description: Plan a cut without changing release state
         type: boolean
         default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original Circle publisher build number (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
   pull_request:
-    types: [closed]
-    branches: [develop]
-
+    types:
+    - closed
+    branches:
+    - develop
+  repository_dispatch:
+    types:
+    - qbit-rc-published
 permissions:
   contents: write
-
+  actions: read
+  checks: read
 jobs:
   release-rc:
-    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
-    uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-release-rc.yml@cc30f599e63c8e41629c99d23395bac1adb8bc44
     with:
-      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'repository_dispatch' || (github.event_name
+        == 'workflow_dispatch' && inputs.finalize) }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.merge_sha
+        || inputs.merge_sha || '' }}
+      bump_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.bump_sha
+        || inputs.bump_sha || '' }}
+      branch: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.branch
+        || inputs.branch || '' }}
+      version: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version
+        || inputs.version || '' }}
+    secrets: inherit

.qqq-ci.yml

@@ -0,0 +1,16 @@
+profile: qbit
+orb_version: 0.7.12
+default_branch: develop
+java_version: '21'
+browsers: true
+api_checks: false
+docs_only: false
+release_on_main: false
+release_tag_policy: stable
+test_branch_policy: non-release
+publish:
+  snapshot: true
+  release_candidate: true
+  release: true
+  asciidoc: false
+release_completion: true

CHANGELOG.md

@@ -4,15 +4,33 @@ All notable changes to this project are documented here. The format follows Keep
 
 ## [0.1.0] - Unreleased
 
+### Fixed
+- Under OAuth2, per-recipient checks (alert visibility for external channels, follower record access, audience sessions) never worked: they used token-less automated sessions, which OAuth2 rejects, so external sends fell back to the conservative rule. When the host declares the QQQ `alerts` service principal (`AlertsQBitConfig.withServicePrincipal`, default `alerts`), these checks run on the recipient's behalf through it: the recipient's current access intersected with the principal's. Alert recording and routing bookkeeping stay on the system session, so alerting does not depend on the identity provider being up. With no principal declared, behavior is unchanged. Needs the QQQ release with service identities (qqq#1255, #1256).
+- Audit noise: every monitor run (lease claim, then run result) and every reminder check wrote a "Record was Edited" audit (about 7,000 `alerts_monitor` and 1,800 `alerts_alert` audits in 6 hours on one production host, most with no field details). Engine updates that touch only bookkeeping fields (`RuntimeFields`: monitor `claimedBy`, `claimedUntil`, `lastRunAt`, `nextRunAt`, `lastStatus`, `lastValue`, `lastError`, `lastElapsedMs`, `consecutiveFailures`, `conditionSince`; alert `timedNotificationCheckedAt`, `lastNotifiedAt`, `recordRefCount`) are written with `omitDmlAudit`. Configuration edits, raises and alert state changes are audited as before, as are UI and API edits of any field.
+- Read the QBit metadata version from the Maven-filtered artifact version so release builds report their release version.
+- Record-view child lists (e.g. a notification's Recipients) failed with "Error in JSON Serialization": the child table's meta-data includes the qbit config, and `AlertsQBitConfig.getRuntime()` points at a runtime that points back at the config, so Jackson recursed to its 1000-level nesting limit. `getRuntime()` and `getAudienceResolver()` are now `@JsonIgnore`, as in the other qbits' configs. A regression test renders and serializes every child-list widget.
+
+### Added
+- Ship the full host-neutral Alerts help bundle through QQQ 4.1.0-RC.7 core registration, replacing the temporary loader. Cover owned tables, fields, actions, jobs, widgets and possible-value sources with a bundle coverage gate; support HOST overrides and hosts without help tables.
+- Starter defaults changelog `alerts-defaults.changelog.sql` (insert-only, guarded): the `in-app` and `email` channels and the `alerts` and `other` groups, equal to what the runtime creates on first use. Tested through real Liquibase on H2.
+- Help for the Alerts app and every `alerts_*` table (`help/qbit-alerts.yaml`): what the table is for and how its rows get created, shown when it is empty.
+- A Setup card first on the Alerts home (alerts admins): each configuration table, its state and the next step.
+- `AlertsTablesGuardrailTest`: every table is used by runtime code, seeded or listed as starting empty with a reason, and has help.
+
+### Fixed
+- A group's `ownerTeamId` was stored but never read. An alert that no subscription matches (WARNING and above) now goes to the owner team of its group, or of the nearest parent group that has one.
+- A user's `defaultChannelIds` was stored but never read. It now adds the chosen external channels to the bell (unless In-App is off) for subscriptions that name none.
+- Alert types, groups and default monitors also sync on the first bell request, so those tables are not empty on a running install.
+
 ### Changed
 - Keep reminders and escalations immediate for digest subscribers while applying pause and quiet hours to their push channels. Preserve team audience resolution, mute scopes, both scheduled jobs and changesets 21-27.
 - Apply user pause and local quiet hours to personal push channels (email, email lists and other non-IN_APP channels), including team members, with logged suppression reasons and a configurable quiet-hours severity bypass. The in-app bell remains unaffected, including digest delivery. Channel subscriptions are unaffected.
 - Queue hourly and daily alert subscription digests and send them through the hidden hourly `alertsSendDigests` process. Group linked alert summaries into one message per user/channel/window, use the existing email integration, and keep durable dispatch claims in the Delivery Log (guarded changeset 27). Reruns cannot send a window twice; failed, interrupted and oversized windows remain visible for review.
 - Team subscriptions now combine explicit members with ROLE and IDP_GROUP users from the optional public `AlertAudienceResolver` configured through `withAudienceResolver`. Recipients are deduplicated and retain per-user visibility checks. Missing resolvers resolve to nobody, log the reason, and show configuration-aware help on team/member screens.
-- Fix the alert Mute action to target its subject record, or its type and dedup key when no subject exists. Add the separate "Mute this alert type" action. RECORD mutes now compare table and record ID. Guarded changesets 21–22 add `scope_record_id` and allow full ALERT keys; existing type-wide mutes retain their scope.
+- Fix the alert Mute action to target its subject record, or its type and dedup key when no subject exists. Add the separate "Mute this alert type" action. RECORD mutes now compare table and record ID. Guarded changesets 21–22 add `scope_record_id` and allow full ALERT keys; existing type-wide mutes retain their scope.
 - Switch the optional qbit-email integration to its published `com.kingsrook.qbits.email.api` package in `0.1.0-RC.2`, preserving templates, categories, idempotency keys, linked records and outcome mapping. Narrow the architecture allowance to that API package while retaining all guardrails.
 - Email goes through qbit-email when it is produced in the instance (optional dependency, `qbit-email.version` 0.1.0-RC.2): alert channel emails (template `alerts_alert`), notification emails (`alerts_notification`) and digests (`alerts_digest`), all NOTIFICATION, one recipient per message, with idempotency keys and the alert or notification as the linked record. `messagingProviderName` stays as the fallback when qbit-email is absent, and is not required when it is present.
-- Target released QQQ `4.1.0-RC.6`; verify normally with `./mvnw -B verify` (no version override).
+- Target released QQQ `4.1.0-RC.7`; verify offline with `./mvnw -o -q verify` (no version override).
 - Adopt `qbit-build-parent:2.1.0` with architecture guardrail enforcement and strict UI API routes enabled for tests. Dependency, extension contract and stand-in checks run in the normal build.
 - Add record followers to alert routing through core `RecordFollowers.get(instance, ref, FollowEvent.ALERT)` (#16, QRun-IO/qqq#1164). Deduplicate by user/channel with subscriptions and other record refs; require source-record read access under the follower's session, including record locks. Followers use the existing alert visibility, preferences and suppression pipeline without a dependency on qbit-collaboration. Missing/disabled/failing providers preserve subscription routing.
 - Register six JSON UI specs as extension `alerts` at the established `/alerts` prefix, preserving methods, paths and existing payload fields. Publish the OpenAPI fragment with a regeneration/contract test and strict server coverage (#13, F2).
@@ -26,10 +44,14 @@ All notable changes to this project are documented here. The format follows Keep
 - Webhook signing delegates to core `WebhookSigner`/`WebhookSecret` (qbit-alerts#15, F11). Headers, `v1,` signatures and `whsec_` encoding are unchanged. A thin adapter preserves legacy keys shorter than core's 16-byte minimum using equivalent HMAC zero-padding.
 
 ### Added
-- Send notifications to Slack per user and category (QRun-IO/qbit-slack docs/DESIGN.md section 10; supersedes "Slack never per user"). `alerts_notification_preference` gets `slackMode` (OFF/IMMEDIATE/DAILY_DIGEST, default OFF) and `slackMinSeverity` (default WARNING); recipients get `slackStatus` and `slackMessageId` (guarded changeset 28). IMMEDIATE and daily-digest DMs go through core `SendMessageAction` (provider `AlertsQBitConfig.withSlackProviderName`, default `slack`, address `user:<id>`) with no qbit-slack dependency. Pause and quiet hours hold them (CRITICAL bypasses), SECURITY carries title and link only, a user without a Slack connection is skipped, and failures never fail the notification. RC.6 has no idempotency key or `isAvailable`, so `slackStatus` guards resends (STAND-IN core#1194, removeBy RC.8) and availability checks the instance's provider.
+- Alerts UI API extension 1.1.0 adds nullable `preferencesSection` to the typed inbox summary alongside `inboxHref`, with a regenerated OpenAPI fragment. Slack category controls appear in Notifications preferences when the configured per-user Slack provider is registered; SECURITY Slack controls remain editable.
+- Notifications user-preferences section over the existing settings and subscription tables, with user/client-channel audits, category in-app/email/Slack severity controls, ownership validation, and an inbox `preferencesSection` shortcut. Enabled by default when core preferences metadata is available; configurable with `withPreferencesSectionEnabled`.
+- Nullable in-app notification severity threshold (`qbit-alerts:29`); SECURITY always arrives in-app. Notification email and per-user Slack pauses now defer non-security immediate and digest delivery without losing older pending items.
+- Send notifications to Slack per user and category (QRun-IO/qbit-slack docs/DESIGN.md section 10; supersedes "Slack never per user"). `alerts_notification_preference` gets `slackMode` (OFF/IMMEDIATE/DAILY_DIGEST, default OFF) and `slackMinSeverity` (default WARNING); recipients get `slackStatus` and `slackMessageId` (guarded changeset 28). IMMEDIATE and daily-digest DMs go through core `SendMessageAction` (provider `AlertsQBitConfig.withSlackProviderName`, default `slack`, address `user:<id>`) with no qbit-slack dependency. Pause holds non-SECURITY messages; quiet hours hold them (CRITICAL bypasses), SECURITY carries title and link only, a user without a Slack connection is skipped, and failures never fail the notification. RC.6 has no idempotency key or `isAvailable`, so `slackStatus` guards resends (STAND-IN core#1194, removeBy RC.8) and availability checks the instance's provider.
 - Apply reminders and escalation (#27, part 2): a minute-based hidden job sends due reminders, advances ordered USER/TEAM/CHANNEL escalation steps, and caps final-step repeats. Acknowledgement, snooze, resolution and mutes stop both; reopening restarts escalation. Delivery, events and progress commit together, with a persisted same-minute checkpoint.
 - Add admin escalation policy and step tables, child step lists, and type/group policy links in guarded Liquibase changesets 23–26. Type policies override group policies. CRITICAL reminders default to 60 minutes; explicit zero turns them off.
 - Keep EXPIRED reserved and remove it from selectable resolution values because the design specifies no expiration rule.
+- Per-notification email opt-in via recipient email status `REQUESTED`: immediate delivery without a standing category preference. It still honours the category email minimum severity, the user pause (SECURITY bypasses) and quiet hours (held until they end, for up to a day), is skipped when no address is known, and is never emailed for ALERT notifications.
 - Optional external channels:
   - Slack (an Incoming Webhook, Block Kit)
   - Microsoft Teams (a Workflows webhook, an Adaptive Card)

README.md

@@ -60,7 +60,7 @@ shared rules, not personal notification preferences.
 
 RECORD mutes store the table in `scopeValue` and its record ID in `scopeRecordId`.
 ALERT mutes store the engine's full `type|dedupKey` in `scopeValue`. Apply guarded
-Liquibase changesets 21–22 before running this version: they add the record ID
+Liquibase changesets 21–22 before running this version: they add the record ID
 column and widen mute scope values to 520 characters. Existing type-wide mutes
 remain type-wide; historical RECORD mutes need their intended record ID filled
 in because previous versions did not store it.
@@ -76,13 +76,14 @@ The qbit also carries ordinary notifications for people (design: [docs/NOTIFICAT
 - **Email** is opt-in per user and category (IMMEDIATE, or DAILY_DIGEST at the digest hour in My Alert Settings), through the configured messaging provider; without one it is off. ALERT notifications are not emailed here (alert subscriptions already do), and SECURITY emails carry only the title and link.
 - **Failed and partial jobs** notify the person who started them (`notifyFailedJobs`, `jobRunLinkPattern`).
 - **Links** must be app paths with one leading slash, or https URLs; backslashes, whitespace and control characters are refused.
-- **People** see them in the Next UI bell and notifications page, and choose per-category settings in My Notification Settings (security notices can't be muted).
+- **Preferences:** the Notifications section combines pause, digest time and zone, alert switches, per-category in-app/email/Slack settings, and the user's own subscriptions. It uses existing tables and FIELD audits; SECURITY cannot be muted in-app. Slack controls appear when the configured per-user Slack provider is registered before Alerts is produced; SECURITY Slack settings stay editable. Uses core's released user-preferences contract in QQQ `4.1.0-RC.7`; disable with `withPreferencesSectionEnabled(false)`. See [Notification settings in Preferences](docs/NOTIFICATIONS.md#34-notification-settings-in-preferences).
+- **People** see them in the Next UI bell and notifications page, and choose settings in Preferences > Notifications or the standard My Notification Settings table (security notices can't be muted).
 
 Grant `getNotificationAdminPermissionNames()` to authors. Viewers' permissions include their own recipient rows and settings.
 
 **Upgrading from 0.1.0-RC.1:** changeset 16 renames the delivery log `alerts_notification` to `alerts_delivery`, and changeset 17 drops `alerts_inbox_item` (bell state only). Both are guarded, so a fresh schema and an RC.1 schema both end up the same.
 
-The UI routes are published as the `alerts` extension (`1.0.0`, established prefix `/alerts`), with
+The UI routes are published as the `alerts` extension (`1.2.0`, established prefix `/alerts`), with
 [the OpenAPI fragment](src/main/resources/openapi/qqq-v1/alerts.yaml) and a contract test.
 See [UI API and webhook migration](docs/UI-API.md) for operation IDs and the complete Next handoff.
 Summary `inboxHref`, item/alert `actions`, and panel `follow.available` are additive. Existing
@@ -104,7 +105,7 @@ a warning. Both paths use the same bearer-token check. Strict hosts use the cano
 ## Requirements
 
 - Java 21.
-- QQQ `4.1.0-RC.6` (released on Maven Central).
+- QQQ `4.1.0-RC.7` (released on Maven Central).
 - An RDBMS backend.
 - A scheduler, for monitors and email delivery.
 - For email, either [qbit-email](https://github.com/QRun-IO/qbit-email) produced in the same instance, or a messaging provider.
@@ -113,7 +114,7 @@ a warning. Both paths use the same bearer-token check. Strict hosts use the cano
 The build uses `qbit-build-parent:2.1.0` with architecture guardrails and strict UI API route
 tests enabled. Run `./mvnw -B verify` (`.\mvnw.cmd -B verify` on Windows), without a snapshot
 override. The default-active `qqq-snapshot` profile retains its historical name but selects
-the released RC.6 BOM ahead of the parent's QQQ 4.0 BOM.
+the released RC.7 BOM ahead of the parent's QQQ 4.0 BOM.
 
 ## Install
 
@@ -140,6 +141,20 @@ new AlertsQBitProducer()
 
 4. **Optional: ESB and Quick Search.** `AlertsIntegrations` names the main tables and searchable fields for the host's ESB and Quick Search configuration.
 
+## Starter defaults and setup
+
+After the schema, include the starter defaults. Include order: the schema first, then the defaults. They are insert-only (a row is added only when its name is absent, so edits survive and nothing is ever updated), hold no secrets, and are guarded so a host without the tables skips them:
+
+```yaml
+- include: { file: db/liquibase/qbit-alerts/alerts-defaults.changelog.sql }
+```
+
+They create the `in-app` and `email` channels and the `alerts` and `other` groups, exactly the rows the runtime would otherwise create on first use. Everything else starts empty for a reason the table's own help gives: alert types and default monitors are declared in code by the installed qbits and synced on the first visit; teams, escalation policies and subscriptions name your people; the rest is runtime data and user content.
+
+Every table has help that says what it is for and **how its rows get created**, shown on the table screen and when it is empty (`help/qbit-alerts.yaml`). Alerts admins also get a **Setup** card first on the home that lists each configuration table, whether it is set up, and the next step.
+
+Routing details worth knowing: an alert that no subscription matches goes to the owner team of its group (or the nearest parent group that has one), at WARNING and above; a person's **Default Channels** (My Alert Settings) replace the built-in email choice for subscriptions that name no channels (the bell stays unless turned off). Follow-ups go to the owner team only if it was told about the raise.
+
 ## Raising alerts
 
 Use the producer SPI from `com.kingsrook.qqq.backend.core.alerts`, released in QQQ 4.1.0-RC.5 ([QRun-IO/qqq#1108](https://github.com/QRun-IO/qqq/pull/1108)). `AlertsQBitProducer` registers the qbit's sink through core's `AlertsInstanceMetaData`, so host producers need only core:
@@ -161,7 +176,7 @@ User notifications use core `QAlerts.notify(NotificationSignal)` (RC.6, QRun-IO/
 
 | Method | Path | What |
 |---|---|---|
-| GET | `/qqq/v1/alerts/inbox/summary` | Unread count, highest unread severity, the latest 10 notifications and sticky banners (the bell) |
+| GET | `/qqq/v1/alerts/inbox/summary` | Unread count, highest unread severity, the latest 10 notifications and sticky banners (the bell), plus `inboxHref` and `preferencesSection` (`"notifications"` when registered, otherwise null; see [API contract](docs/NOTIFICATIONS.md#81-api-qqqv1alerts-session-authenticated-alertsview)) |
 | GET | `/qqq/v1/alerts/inbox` | The notifications page: `status` (all, unread), `category`, `severity`, `offset`, `limit` |
 | POST | `/qqq/v1/alerts/inbox/read` | `{"id": n}`, `{"ids": [..]}`, `{"all": true}`, or `{"alertId": n}` |
 | POST | `/qqq/v1/alerts/inbox/unread` | `{"id": n}` or `{"ids": [..]}` |
@@ -265,6 +280,23 @@ assigned automatically. The Resolve action continues to record MANUAL.
 - **Alertmanager sink:** open alerts are sent with an `endsAt` a week out, not re-posted.
 - **Not built yet:** Micrometer metrics, mirrored lock columns and a configurable table namespace. These are the rest of design phases P4 to P6.
 
+## In-app help
+
+The producer registers [`help/qbit-alerts.yaml`](src/main/resources/help/qbit-alerts.yaml)
+with QQQ's help-bundle registry. It covers the Alerts app, tables and fields,
+actions, scheduled jobs, widgets and possible-value sources. QQQ syncs the bundle
+when the host installs the help-content tables; registration is harmless without them.
+
+Hosts can override individual entries by registering their own bundle with
+`layer: HOST`, using the same entry `key` and `role` (default `ALL_SCREENS`).
+Register it with `HelpBundles.register(qInstance, "help/my-host.yaml")`. Host
+bundles take precedence over this `QBIT` bundle, and edits made by users remain protected.
+
+`AlertsTablesGuardrailTest` runs `HelpBundleAssertions` against the produced instance
+to check owned-object coverage, summary length and live references. It also requires
+widget and possible-value-source help and preserves the table empty-state guidance.
+When releasing, keep the bundle's literal version aligned with the POM's revision.
+
 ## Build
 
 ```bash

UPGRADE.md

@@ -0,0 +1,16 @@
+# Upgrading
+
+## Unreleased: starter defaults, setup card, table help
+
+1. **Add the defaults changelog** after `alerts.changelog.sql` in the host's master changelog:
+
+   ```yaml
+   - include: { file: db/liquibase/qbit-alerts/alerts-defaults.changelog.sql }
+   ```
+
+   It is insert-only and guarded (row exists by name: no change; table missing: skipped), so it is safe on an installed host. It creates the `in-app` and `email` channels and the `alerts` and `other` groups only, the same rows the runtime creates on first use.
+2. **Behavior changes to know about.**
+   - A group's **Owner Team** is now used: an alert at WARNING or above that no subscription covers (by scope and severity) is sent to that team's members; follow-ups (resolved, reminders) go only to members who were told about the raise. Hosts that never set an owner team see no change.
+   - **Default Channels** on My Alert Settings is now used for subscriptions that name no channels. The bell stays whenever In-App is not turned off; the list replaces the built-in email choice with the channels you chose (unknown ids are ignored). Hosts that never set it see no change.
+   - Alert types, groups and default monitors now also sync on the first request of the bell, not only on the home or the first signal.
+3. Nothing else is required. The help bundle and the Setup card need no configuration.

docs/NOTIFICATIONS.md

@@ -101,11 +101,62 @@ editable; inserts and deletes are the qbit's.
 
 One row per user and category, unique (`userId`, `category`); a missing row means the defaults.
 
-`userId`, `category`, `inAppMuted` (boolean; refused for SECURITY), `emailMode` (OFF / IMMEDIATE /
+`userId`, `category`, `inAppMuted` (boolean; refused for SECURITY), `inAppMinSeverity` (nullable; null means every severity, refused for SECURITY), `emailMode` (OFF / IMMEDIATE /
 DAILY_DIGEST, default OFF), `emailMinSeverity` (default WARNING), `slackMode` (OFF / IMMEDIATE / DAILY_DIGEST, default OFF),
 `slackMinSeverity` (default WARNING). It is owner-locked on `userId`. The
 digest hour and time zone come from `alerts_user_preference`.
 
+### 3.4 Notification settings in Preferences
+
+With the core user-preferences contract installed, the qbit registers **Notifications** (`notifications`,
+order 20, icon `notifications`): “What reaches you in the app, by email and on Slack.” It requires `alerts.view`
+and has no app scope. Hosts can disable it with `AlertsQBitConfig.withPreferencesSectionEnabled(false)`.
+Older core runtimes without preferences metadata omit the section.
+
+The section reads and writes the existing owner-locked tables, through core table actions with FIELD
+level audits retaining the signed-in user and client channel. It exposes:
+
+- Pause notifications until (security notices still arrive), daily digest time (24 hourly choices),
+  time zone (a valid Java `ZoneId`), and the alert in-app and email switches from `alerts_user_preference`.
+  A missing user row gets the same defaults as the bell's first-visit setup.
+- One category row per notification category: In-app, In-app from, Email (Off / Immediate / Daily digest),
+  Email from, Slack (Off / Immediate / Daily digest) and Slack from. Slack fields appear only when
+  the configured `slackProviderName` messaging provider is registered before Alerts is produced.
+  They use the same `alerts_email_mode` choices as the table. Missing category rows use table defaults;
+  edits upsert only that user's category. SECURITY Slack fields remain editable.
+  SECURITY's two in-app fields are read-only: “Security notices can't be muted.”
+- Only the user's own USER subscriptions, labelled by scope, with Enabled, From severity and Delivery mode.
+  Other users' rules and team/channel rules cannot be edited here, including by administrators.
+
+`GET /qqq/v1/preferences/notifications` loads the section and inline enum choices.
+`PATCH /qqq/v1/preferences/notifications` accepts partial changes, for example:
+
+```json
+{
+  "values": { "digestHour": 8, "timeZone": "America/Chicago" },
+  "lists": {
+    "categories": [{ "key": "JOB", "values": { "inAppMinSeverity": "WARNING", "emailMode": "DAILY_DIGEST", "slack": "IMMEDIATE", "slackMinSeverity": "WARNING" } }],
+    "subscriptions": [{ "key": "42", "values": { "enabled": true, "minSeverity": "ERROR" } }]
+  }
+}
+```
+
+Subscription keys are persisted row IDs. Invalid zones, foreign/team subscription keys and SECURITY
+in-app changes return 400; a section hidden by permission or configuration returns 404.
+The section has no user parameter and cannot change ownership. Administrators retain the standard
+table screens for administering other users' settings.
+
+In-app severity filters apply when recipients are materialized, just like category muting; existing
+inbox items remain. SECURITY always reaches its in-app recipients. While `pausedUntil` is in the future,
+non-SECURITY notification emails and per-user Slack DMs are deferred, including daily digests; recipients remain in the inbox
+and eligible after the pause ends, even after more than a day. SECURITY keeps its category email mode
+and Slack mode/severity settings but bypasses the pause. Existing alert routing continues to use the same pause
+and alert channel switches.
+
+Schema migration: `qbit-alerts:29` adds nullable `in_app_min_severity VARCHAR(16)`.
+The migration uses `onFail:MARK_RAN` when the column already exists.
+The POM targets released QQQ `4.1.0-RC.7`; build with `./mvnw -o -q verify`.
+
 ## 4. Audiences
 
 `AlertsAudienceResolver` resolves an audience to user ids at send time:
@@ -201,7 +252,8 @@ QAlerts.notify(new NotificationSignal("Your export failed")
   through that user's own Slack connection; qbit-slack is never imported). IMMEDIATE sends one DM per
   notification at or above `slackMinSeverity`; DAILY_DIGEST sends one DM per user at their digest hour,
   listing their unread notifications, and marks the rows DIGESTED. Slack is a push channel, so a user's pause
-  and quiet hours (`alerts_user_preference`) hold it, with the same CRITICAL bypass as other push channels;
+  holds non-SECURITY items; quiet hours (`alerts_user_preference`) hold items with the same CRITICAL
+  bypass as other push channels. SECURITY bypasses pause, and mixed digests include only eligible items;
   the bell is never held. ALERT notifications are not sent (alert channels already cover them) and SECURITY
   carries the title and link only. With no provider registered under that name the rows are SKIPPED. A user
   without a Slack connection is SKIPPED with no retry; any other error is FAILED; neither fails the
@@ -228,7 +280,7 @@ Gating is unchanged from #85: no bell and zero requests unless `metaData.apps.al
 
 | Method | Path | Body or query | Returns |
 |---|---|---|---|
-| GET | `/inbox/summary` | | `{unreadCount, highestUnreadSeverity, items[≤10], banners[], pollSeconds, notificationsHref}` |
+| GET | `/inbox/summary` | | `{unreadCount, highestUnreadSeverity, items[≤10], banners[], pollSeconds, notificationsHref, inboxHref, alertsHref, preferencesSection}` |
 | GET | `/inbox` | `?status=all\|unread&category=&severity=&offset=0&limit=25` | `{items[], total, offset, limit}` |
 | POST | `/inbox/read` | `{id}` or `{ids:[..]}` or `{all:true}` (`{alertId}` still works) | `{updated}` |
 | POST | `/inbox/unread` | `{id}` | `{updated}` |
@@ -238,6 +290,9 @@ An item is `{id, notificationId, title, body, severity, category, source, href,
 deliveredAt, age, unread, sticky}`. `id` is the recipient row id. `body` appears only in `/inbox` and in
 banners. `highestUnreadSeverity` is one of the five severities. Every call works in the caller's
 session, so the record locks apply.
+The alerts extension is version `1.1.0`. `inboxHref` retains the canonical inbox link.
+`preferencesSection` is `"notifications"` when that section is registered, otherwise JSON null.
+Clients can use it for the bell's settings shortcut to the core Preferences section.
 
 ## 9. Security
 

docs/UI-API.md

@@ -1,7 +1,7 @@
 # Alerts UI API and webhook migration
 
-The qbit targets QQQ **4.1.0-RC.6** (pending release). `AlertsQBitProducer` registers the
-`alerts` `MiddlewareSpecExtension`, version `1.0.0`, with the established `/alerts` prefix.
+The qbit targets QQQ **4.1.0-RC.15**, UI API **1.6.0**. `AlertsQBitProducer` registers the
+`alerts` `MiddlewareSpecExtension`, version `1.2.0`, with the established `/alerts` prefix.
 `withRegisterRoutes(false)` opts out of both the extension and webhook registration.
 The six JSON specs extend `AbstractJsonEndpointSpec`; existing `AlertsApi` logic continues
 to enforce caller permissions, recipient ownership and alert visibility.
@@ -20,13 +20,24 @@ discovers the `alerts` extension so clients need not infer installation from an
 | GET | `/qqq/v1/alerts/record-panel` | `alertsRecordPanel` |
 
 All existing query parameters, selector precedence, paging defaults and clamps, status
-codes, JSON content-type requirements, and response keys remain. IDs refer to recipient
+codes, JSON content-type requirements, and success response keys remain. IDs refer to recipient
 rows for inbox operations; legacy `alertId` selectors remain accepted. `all:true` applies
 only to read/dismiss. Items in a summary omit `body`; page items and banners include it.
 Nullable fields remain serialized as JSON null.
 
+## UI API extension changes
+
+UI API extension alerts 1.2.0 (requires QQQ 4.1.0-RC.15, UI API 1.6.0): operationIds,
+standard error responses with BasicErrorResponseV1, and extension tags. The six existing
+operationIds are preserved. Errors retain their HTTP statuses and now include `error`,
+`code`, `message`, and `traceId` (with `fieldErrors` when applicable). `AlertsErrorV1`
+remains in components with a deprecation description for compatibility. The core upgrade
+also retires the expired Slack shim: capable providers now receive notification
+idempotency keys; providers without that capability keep recipient-row deduplication.
+
 ## Next handoff: additive payload fields
 
+- Summary adds nullable `preferencesSection`: the user Preferences section name (`notifications`) or null when not registered. Clients can use `/qqq/v1/preferences/{name}` for notification settings.
 - Summary adds `inboxHref`, currently `/app/notifications`. Retain and honor the existing
   `notificationsHref` and `alertsHref` fields for older clients.
 - Every inbox item (including banners) adds `actions`: `name`, `label`, `operationId`.
@@ -126,13 +137,15 @@ The supplied Next `main` checkout still has no alerts client; the
 
 ## Verification
 
-Use the Maven wrapper. The committed BOM version is RC.6; while it is unreleased, verify with
-an already installed local core build:
+Use the Maven wrapper offline against the locally installed migration build:
 
 ```sh
-./mvnw -B verify -Dqqq.snapshot.version=4.1.0-ARCHRC6-SNAPSHOT
+./mvnw -o verify -Dqqq.snapshot.version=4.1.99-SNAPSHOT -Denforcer.skipRules=requireReleaseDeps
 ```
 
 Regenerate intentionally with `-Dtest=AlertsApiContractTest -Dalerts.openapi.update=true test`
-(and the same local version override). Normal tests compare the fragment without rewriting it.
+(with `-o` for an offline build). Normal tests compare the fragment without rewriting it.
 Checkstyle uses `checkstyle/config.xml` and the repository's existing short Apache headers.
+
+The Enforcer switch skips only the release-dependency rule for the local SNAPSHOT;
+omit it and the version override when building against the released RC.12 BOM.

pom.xml

@@ -24,6 +24,8 @@
       <jacoco.version>0.8.15</jacoco.version>
       <!-- qbit-email from Maven Central -->
       <qbit-email.version>0.1.0-RC.2</qbit-email.version>
+      <liquibase.version>4.33.0</liquibase.version>
+      <testcontainers.version>2.0.5</testcontainers.version>
       <qbit.guardrails.enforce>true</qbit.guardrails.enforce>
       <qbit.guardrails.strictUiApiRoutes>true</qbit.guardrails.strictUiApiRoutes>
    </properties>
@@ -104,7 +106,39 @@
          <version>2.2.220</version>
          <scope>test</scope>
       </dependency>
+      <!-- AlertsForeignKeysTest applies the shipped changelog with Liquibase to a real PostgreSQL (Testcontainers) -->
+      <dependency>
+         <groupId>org.liquibase</groupId>
+         <artifactId>liquibase-core</artifactId>
+         <version>${liquibase.version}</version>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>org.postgresql</groupId>
+         <artifactId>postgresql</artifactId>
+         <version>42.7.14</version>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>org.testcontainers</groupId>
+         <artifactId>testcontainers-postgresql</artifactId>
+         <version>${testcontainers.version}</version>
+         <scope>test</scope>
+      </dependency>
+      <dependency>
+         <groupId>org.testcontainers</groupId>
+         <artifactId>testcontainers-junit-jupiter</artifactId>
+         <version>${testcontainers.version}</version>
+         <scope>test</scope>
+      </dependency>
 
+      <!-- AlertsDefaultsChangelogTest runs the shipped seed changelog through real Liquibase on H2. -->
+      <dependency>
+         <groupId>org.liquibase</groupId>
+         <artifactId>liquibase-core</artifactId>
+         <version>4.33.0</version>
+         <scope>test</scope>
+      </dependency>
       <dependency>
          <groupId>org.junit.jupiter</groupId>
          <artifactId>junit-jupiter</artifactId>
@@ -119,7 +153,36 @@
    </dependencies>
 
    <build>
+      <resources>
+         <!-- help bundles carry the artifact version (QQQ help bundle provenance) -->
+         <resource>
+            <directory>src/main/resources</directory>
+            <filtering>true</filtering>
+            <includes>
+               <include>help/*.yaml</include>
+               <include>qbit-alerts.properties</include>
+            </includes>
+         </resource>
+         <resource>
+            <directory>src/main/resources</directory>
+            <filtering>false</filtering>
+            <excludes>
+               <exclude>help/*.yaml</exclude>
+               <exclude>qbit-alerts.properties</exclude>
+            </excludes>
+         </resource>
+      </resources>
       <plugins>
+         <!-- the artifact version, for the help bundle version test -->
+         <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-surefire-plugin</artifactId>
+            <configuration>
+               <systemPropertyVariables combine.children="append">
+                  <qbit.artifactVersion>${project.version}</qbit.artifactVersion>
+               </systemPropertyVariables>
+            </configuration>
+         </plugin>
          <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-checkstyle-plugin</artifactId>
@@ -197,14 +260,14 @@
    <profiles>
       <!-- Built against qqq 4.1 (QBitMetaDataProducer). Until qbit-build-parent  -->
       <!-- imports the released 4.1 BOM, this profile is active by default and     -->
-      <!-- imports qqq-bom-pom 4.1.0-RC.6 ahead of the parent's 4.0.0 BOM.         -->
+      <!-- imports qqq-bom-pom 4.1.0-RC.15 ahead of the parent's 4.0.0 BOM.         -->
       <profile>
          <id>qqq-snapshot</id>
          <activation>
             <activeByDefault>true</activeByDefault>
          </activation>
          <properties>
-            <qqq.snapshot.version>4.1.0-RC.6</qqq.snapshot.version>
+            <qqq.snapshot.version>4.1.0-RC.19</qqq.snapshot.version>
          </properties>
          <dependencyManagement>
             <dependencies>

src/main/java/com/kingsrook/qbits/alerts/AlertsPreferences.java

@@ -17,6 +17,8 @@
 package com.kingsrook.qbits.alerts;
 
 
+import java.io.Serializable;
+import java.util.List;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import com.kingsrook.qbits.alerts.engine.AlertsDb;
@@ -26,7 +28,12 @@ import com.kingsrook.qbits.alerts.model.AlertsPossibleValues.ScopeType;
 import com.kingsrook.qbits.alerts.model.AlertsPossibleValues.SubscriberType;
 import com.kingsrook.qbits.alerts.model.AlertsSubscription;
 import com.kingsrook.qbits.alerts.model.AlertsUserPreference;
+import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.model.session.QSession;
 
@@ -42,6 +49,9 @@ import com.kingsrook.qqq.backend.core.model.session.QSession;
  *******************************************************************************/
 public final class AlertsPreferences
 {
+   /** marks the bootstrap rule's subscription (createdByUserId). */
+   static final String BOOTSTRAP_CREATOR = "alerts (bootstrap rule)";
+
    private static final Set<String> ENSURED = ConcurrentHashMap.newKeySet();
 
 
@@ -69,36 +79,72 @@ public final class AlertsPreferences
 
       boolean admin    = session.hasPermission(AlertsQBitConfig.PERMISSION_ADMIN);
       String  fullName = session.getUser() == null ? null : session.getUser().getFullName();
-      runtime.asSystem(() ->
-      {
-         if(AlertsDb.first(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", userId)) == null)
-         {
-            AlertsDb.insert(AlertsUserPreference.TABLE_NAME, new QRecord()
-               .withValue("userId", userId)
-               .withValue("userLabel", fullName == null ? userId : fullName)
-               .withValue("inAppEnabled", true)
-               .withValue("emailEnabled", true)
-               .withValue("quietBypassSeverity", "CRITICAL")
-               .withValue("digestHour", 8));
-         }
 
-         if(admin && runtime.getConfig().getBootstrapMinSeverity() != null && AlertsDb.first(AlertsSubscription.TABLE_NAME, AlertsDb.eq("userId", userId)) == null)
+      ////////////////////////////////////////////////////////////////////////////
+      // A page load fires the home widgets and the bell together, so first     //
+      // calls for one user race. Serialize them in this JVM; across replicas,  //
+      // the clean-up below keeps one bootstrap subscription (the lowest id).   //
+      ////////////////////////////////////////////////////////////////////////////
+      synchronized(AlertsPreferences.class)
+      {
+         if(ENSURED.contains(userId))
          {
-            QRecord inApp = runtime.getChannels().defaultChannel(ChannelType.IN_APP);
-            AlertsDb.insert(AlertsSubscription.TABLE_NAME, new QRecord()
-               .withValue("subscriberType", SubscriberType.USER.name())
-               .withValue("userId", userId)
-               .withValue("scopeType", ScopeType.ALL.name())
-               .withValue("minSeverity", runtime.getConfig().getBootstrapMinSeverity().name())
-               .withValue("events", "RAISED,ESCALATED,REMINDER,RESOLVED")
-               .withValue("deliveryMode", DeliveryMode.IMMEDIATE.name())
-               .withValue("channelOverrideIds", String.valueOf(inApp.getValue("id")))
-               .withValue("enabled", true)
-               .withValue("createdByUserId", "alerts (bootstrap rule)"));
+            return;
          }
-         return (null);
-      });
-      ENSURED.add(userId);
+         runtime.asSystem(() ->
+         {
+            if(AlertsDb.first(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", userId)) == null)
+            {
+               AlertsDb.insert(AlertsUserPreference.TABLE_NAME, new QRecord()
+                  .withValue("userId", userId)
+                  .withValue("userLabel", fullName == null ? userId : fullName)
+                  .withValue("inAppEnabled", true)
+                  .withValue("emailEnabled", true)
+                  .withValue("quietBypassSeverity", "CRITICAL")
+                  .withValue("digestHour", 8));
+            }
+
+            if(admin && runtime.getConfig().getBootstrapMinSeverity() != null && AlertsDb.first(AlertsSubscription.TABLE_NAME, AlertsDb.eq("userId", userId)) == null)
+            {
+               QRecord inApp = runtime.getChannels().defaultChannel(ChannelType.IN_APP);
+               AlertsDb.insert(AlertsSubscription.TABLE_NAME, new QRecord()
+                  .withValue("subscriberType", SubscriberType.USER.name())
+                  .withValue("userId", userId)
+                  .withValue("scopeType", ScopeType.ALL.name())
+                  .withValue("minSeverity", runtime.getConfig().getBootstrapMinSeverity().name())
+                  .withValue("events", "RAISED,ESCALATED,REMINDER,RESOLVED")
+                  .withValue("deliveryMode", DeliveryMode.IMMEDIATE.name())
+                  .withValue("channelOverrideIds", String.valueOf(inApp.getValue("id")))
+                  .withValue("enabled", true)
+                  .withValue("createdByUserId", BOOTSTRAP_CREATOR));
+            }
+
+            removeDuplicateBootstrapSubscriptions(userId);
+            return (null);
+         });
+         ENSURED.add(userId);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Keep only the first bootstrap subscription of a user. Two replicas can
+    ** each see no subscription and insert one; every later first call (and the
+    ** losers' own calls) delete the extra copies, so the user is not notified
+    ** twice per alert. Subscriptions a person made are never touched.
+    *******************************************************************************/
+   static void removeDuplicateBootstrapSubscriptions(String userId) throws QException
+   {
+      List<QRecord> bootstrap = AlertsDb.query(AlertsSubscription.TABLE_NAME, AlertsDb.eq("userId", userId)
+         .withCriteria("createdByUserId", QCriteriaOperator.EQUALS, BOOTSTRAP_CREATOR)
+         .withOrderBy(new QFilterOrderBy("id")));
+      if(bootstrap.size() < 2)
+      {
+         return;
+      }
+      List<Serializable> extra = bootstrap.subList(1, bootstrap.size()).stream().map(r -> (Serializable) r.getValue("id")).toList();
+      new DeleteAction().execute(new DeleteInput(AlertsSubscription.TABLE_NAME).withPrimaryKeys(extra).withTransaction(QContext.getQBackendTransaction()));
    }
 
 

src/main/java/com/kingsrook/qbits/alerts/AlertsQBitConfig.java

@@ -19,6 +19,7 @@ package com.kingsrook.qbits.alerts;
 
 import java.util.ArrayList;
 import java.util.List;
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.kingsrook.qbits.alerts.model.AlertsAlert;
 import com.kingsrook.qbits.alerts.model.AlertsChannel;
 import com.kingsrook.qbits.alerts.model.AlertsDelivery;
@@ -79,6 +80,7 @@ public class AlertsQBitConfig implements QBitConfig
    private Boolean legacyAlertmanagerPath = false;
 
    private String backendName;
+   private String servicePrincipal = "alerts";
    private String schedulerName;
    private String messagingProviderName;
    private String fromAddress;
@@ -100,6 +102,7 @@ public class AlertsQBitConfig implements QBitConfig
 
    private String alertmanagerIngestTokenSecretRef;
 
+   private Boolean preferencesSectionEnabled = true;
    private Boolean registerRoutes  = true;
    private Boolean synchronousSink = false;
 
@@ -118,6 +121,7 @@ public class AlertsQBitConfig implements QBitConfig
    /*******************************************************************************
     ** Optional host resolver for ROLE and IDP_GROUP team members.
     *******************************************************************************/
+   @JsonIgnore
    public AlertAudienceResolver getAudienceResolver()
    {
       return (audienceResolver);
@@ -673,8 +677,11 @@ public class AlertsQBitConfig implements QBitConfig
 
 
    /*******************************************************************************
-    ** Getter for runtime (built by the producer)
+    ** Getter for runtime (built by the producer). Never serialized: the runtime
+    ** points back at this config, and QQQ meta-data JSON (e.g. a child-list
+    ** widget's table meta-data) can include the qbit config.
     *******************************************************************************/
+   @JsonIgnore
    public AlertsRuntime getRuntime()
    {
       return (this.runtime);
@@ -847,6 +854,27 @@ public class AlertsQBitConfig implements QBitConfig
 
 
 
+   /*******************************************************************************
+    ** Whether to register Notifications in user preferences (default true).
+    *******************************************************************************/
+   public Boolean getPreferencesSectionEnabled()
+   {
+      return (preferencesSectionEnabled);
+   }
+
+
+
+   /*******************************************************************************
+    ** Enable or disable the Notifications preferences section.
+    *******************************************************************************/
+   public AlertsQBitConfig withPreferencesSectionEnabled(Boolean enabled)
+   {
+      preferencesSectionEnabled = enabled;
+      return (this);
+   }
+
+
+
    /*******************************************************************************
     ** Whether to expose the deprecated UI-path webhook alias (default false).
     ** Requires non-strict UI route mode; remove after one minor release.
@@ -866,4 +894,30 @@ public class AlertsQBitConfig implements QBitConfig
       this.legacyAlertmanagerPath = legacyAlertmanagerPath;
       return (this);
    }
+
+
+   /*******************************************************************************
+    ** Getter for servicePrincipal: when the host declares this QQQ service
+    ** principal, per-recipient checks (alert visibility, follower record access,
+    ** audience) run on the recipient's behalf through it - their current access
+    ** intersected with the principal's - instead of a token-less automated
+    ** session (rejected under OAuth2). Alert recording and routing bookkeeping
+    ** stay on the system session so alerting never depends on the identity
+    ** provider being up.
+    *******************************************************************************/
+   public String getServicePrincipal()
+   {
+      return (this.servicePrincipal);
+   }
+
+
+
+   /*******************************************************************************
+    ** Fluent setter for servicePrincipal (default alerts).
+    *******************************************************************************/
+   public AlertsQBitConfig withServicePrincipal(String servicePrincipal)
+   {
+      this.servicePrincipal = servicePrincipal;
+      return (this);
+   }
 }

src/main/java/com/kingsrook/qbits/alerts/AlertsQBitProducer.java

@@ -17,8 +17,11 @@
 package com.kingsrook.qbits.alerts;
 
 
+import java.io.IOException;
+import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Properties;
 import com.kingsrook.qbits.alerts.delivery.DeliveryWorker;
 import com.kingsrook.qbits.alerts.engine.AlertsProcessListener;
 import com.kingsrook.qbits.alerts.engine.AlertsSinkAdapter;
@@ -37,6 +40,7 @@ import com.kingsrook.qqq.backend.core.logging.QLogger;
 import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
 import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.help.bundles.HelpBundles;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaDataProducer;
 import static com.kingsrook.qqq.backend.core.logging.LogUtils.logPair;
@@ -65,7 +69,7 @@ public class AlertsQBitProducer implements QBitMetaDataProducer<AlertsQBitConfig
 
    public static final String GROUP_ID    = "com.kingsrook.qbits";
    public static final String ARTIFACT_ID = "qbit-alerts";
-   public static final String VERSION     = "0.1.0";
+   public static final String VERSION     = loadVersion();
 
    private static final String JAVALIN_CLASS = "com.kingsrook.qqq.middleware.javalin.QJavalinMetaData";
 
@@ -74,6 +78,34 @@ public class AlertsQBitProducer implements QBitMetaDataProducer<AlertsQBitConfig
 
 
 
+   /*******************************************************************************
+    ** Read the artifact version from the Maven-filtered resource.
+    *******************************************************************************/
+   private static String loadVersion()
+   {
+      try(InputStream inputStream = AlertsQBitProducer.class.getClassLoader().getResourceAsStream("qbit-alerts.properties"))
+      {
+         if(inputStream == null)
+         {
+            throw (new IllegalStateException("Missing qbit-alerts.properties; build with Maven to generate the artifact version"));
+         }
+         Properties properties = new Properties();
+         properties.load(inputStream);
+         String version = properties.getProperty("version");
+         if(version == null || version.isBlank() || version.contains("${"))
+         {
+            throw (new IllegalStateException("Missing or invalid version in qbit-alerts.properties; build with Maven resource filtering enabled"));
+         }
+         return (version);
+      }
+      catch(IOException e)
+      {
+         throw (new IllegalStateException("Could not read artifact version from qbit-alerts.properties", e));
+      }
+   }
+
+
+
    /*******************************************************************************
     ** Fluent setter for the config.
     *******************************************************************************/
@@ -173,6 +205,8 @@ public class AlertsQBitProducer implements QBitMetaDataProducer<AlertsQBitConfig
 
       MetaDataProducerMultiOutput output = QBitMetaDataProducer.super.produce(qInstance);
       output.addSelfToInstance(qInstance);
+      // Registration is metadata-only; core guards startup sync when helpContent is absent.
+      HelpBundles.register(qInstance, "help/qbit-alerts.yaml");
       return (new MetaDataProducerMultiOutput());
    }
 
@@ -209,6 +243,11 @@ public class AlertsQBitProducer implements QBitMetaDataProducer<AlertsQBitConfig
          qInstance.withProcessLifecycleListener(new QCodeReference(AlertsProcessListener.class));
       }
 
+      if(Boolean.TRUE.equals(qBitConfig.getPreferencesSectionEnabled()) && isPreferencesAvailable())
+      {
+         com.kingsrook.qbits.alerts.preferences.AlertsNotificationPreferencesProvider.register(qInstance, qBitConfig);
+      }
+
       boolean routes = false;
       if(Boolean.TRUE.equals(qBitConfig.getRegisterRoutes()) && isJavalinAvailable())
       {
@@ -290,4 +329,32 @@ public class AlertsQBitProducer implements QBitMetaDataProducer<AlertsQBitConfig
          return (false);
       }
    }
+
+
+
+   /*******************************************************************************
+    ** Older core versions can run without the optional preferences integration.
+    *******************************************************************************/
+   private static boolean isPreferencesAvailable()
+   {
+      try
+      {
+         Class.forName("com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferencesMetaData", false, AlertsQBitProducer.class.getClassLoader());
+         return (true);
+      }
+      catch(ClassNotFoundException | LinkageError e)
+      {
+         return (false);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** The bell shortcut is present only when the section is registered.
+    *******************************************************************************/
+   public static String preferencesSectionName(QInstance instance)
+   {
+      return (isPreferencesAvailable() && com.kingsrook.qbits.alerts.preferences.AlertsNotificationPreferencesProvider.isRegistered(instance) ? "notifications" : null);
+   }
 }

src/main/java/com/kingsrook/qbits/alerts/AlertsRuntime.java

@@ -144,7 +144,7 @@ public class AlertsRuntime
    public <R> R asSystem(SystemWork<R> work) throws QException
    {
       Object[] result = new Object[1];
-      QContext.withTemporaryContext(new CapturedContext(qInstance, AlertsSecurity.systemSession()), () ->
+      QContext.withTemporaryContext(new CapturedContext(qInstance, AlertsSecurity.systemSession(qInstance)), () ->
       {
          result[0] = work.run();
       });

src/main/java/com/kingsrook/qbits/alerts/AlertsSecurity.java

@@ -26,6 +26,7 @@ import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper;
 import com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType;
 import com.kingsrook.qqq.backend.core.context.CapturedContext;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
 import com.kingsrook.qqq.backend.core.model.metadata.security.MultiRecordSecurityLock;
@@ -34,6 +35,9 @@ import com.kingsrook.qqq.backend.core.model.metadata.security.RecordSecurityLock
 import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
 import com.kingsrook.qqq.backend.core.model.session.QSession;
 import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleDispatcher;
+import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleInterface;
+import com.kingsrook.qqq.backend.core.serviceidentity.ServiceIdentities;
 import com.kingsrook.qqq.backend.core.utils.StringUtils;
 
 
@@ -278,7 +282,19 @@ public final class AlertsSecurity
     *******************************************************************************/
    public static QSystemUserSession systemSession()
    {
-      QSystemUserSession session = new QSystemUserSession();
+      return (systemSession(QContext.getQInstance()));
+   }
+
+
+
+   /*******************************************************************************
+    ** A system-user session for this instance, holding the alerts all-access
+    ** keys.  Background threads (the alerts sink, schedulers) have no QContext
+    ** yet, so they must pass the instance in.
+    *******************************************************************************/
+   public static QSystemUserSession systemSession(QInstance qInstance)
+   {
+      QSystemUserSession session = new QSystemUserSession(qInstance);
       session.withSecurityKeyValue(KEY_USER_ALL_ACCESS, true);
       session.withSecurityKeyValue(KEY_PERMISSION_ALL, true);
       session.withSecurityKeyValue(KEY_READABLE_TABLE_ALL, true);
@@ -295,4 +311,25 @@ public final class AlertsSecurity
    {
       return (QContext.getQSession() instanceof QSystemUserSession);
    }
+
+
+   /*******************************************************************************
+    ** A session for a recipient: on their behalf through the alerts service
+    ** principal when the host declares it (QQQ service identities), else the
+    ** authentication module's automated session (previous behavior). Null when
+    ** neither can be made - callers fail closed.
+    *******************************************************************************/
+   public static QSession recipientSession(QInstance qInstance, String principalName, String userId) throws QException
+   {
+      if(qInstance == null || qInstance.getAuthentication() == null)
+      {
+         return (null);
+      }
+      if(StringUtils.hasContent(principalName) && ServiceIdentities.isDeclared(qInstance, principalName))
+      {
+         return (ServiceIdentities.sessionOnBehalfOf(qInstance, principalName, userId));
+      }
+      QAuthenticationModuleInterface module = new QAuthenticationModuleDispatcher().getQModule(qInstance.getAuthentication());
+      return (module.createAutomatedSessionForUser(qInstance, userId));
+   }
 }

src/main/java/com/kingsrook/qbits/alerts/api/AlertsApi.java

@@ -30,6 +30,7 @@ import java.util.Map;
 import java.util.Set;
 import com.kingsrook.qbits.alerts.AlertsPreferences;
 import com.kingsrook.qbits.alerts.AlertsQBitConfig;
+import com.kingsrook.qbits.alerts.AlertsQBitProducer;
 import com.kingsrook.qbits.alerts.AlertsRuntime;
 import com.kingsrook.qbits.alerts.AlertsSecurity;
 import com.kingsrook.qbits.alerts.delivery.AlertMessageRenderer;
@@ -55,6 +56,7 @@ import com.kingsrook.qqq.backend.core.context.QContext;
 import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException;
+import com.kingsrook.qqq.backend.core.logging.QLogger;
 import com.kingsrook.qqq.backend.core.model.actions.AbstractActionInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
@@ -75,6 +77,8 @@ import com.kingsrook.qqq.middleware.javalin.specs.extensions.MiddlewareSpecExten
  *******************************************************************************/
 public class AlertsApi
 {
+   private static final QLogger LOG = QLogger.getLogger(AlertsApi.class);
+
    static final int INBOX_ITEMS        = 10;
    static final int MAX_BANNERS        = 3;
    static final int SCAN_LIMIT         = 1000;
@@ -102,7 +106,9 @@ public class AlertsApi
 
 
    /*******************************************************************************
-    ** Check alerts.view and set up the session (keys, settings).
+    ** Check alerts.view and set up the session (keys, settings, and the first-visit
+    ** sync of alert types, groups and default monitors, so those tables are never
+    ** empty on a running install).
     *******************************************************************************/
    public String requireViewer() throws QException
    {
@@ -113,6 +119,17 @@ public class AlertsApi
       }
       AlertsSecurity.ensureSessionKeys(runtime.getQInstance(), session);
       AlertsPreferences.ensure(runtime, session);
+      try
+      {
+         runtime.getTypeSync().syncIfNeeded();
+      }
+      catch(Exception e)
+      {
+         ////////////////////////////////////////////////////////////////////////
+         // best effort: the bell must work even if the sync fails; next call retries //
+         ////////////////////////////////////////////////////////////////////////
+         LOG.warn("Alert type sync failed on the first visit; will retry on the next request", e);
+      }
       return (AlertsSecurity.userId(session));
    }
 
@@ -156,6 +173,7 @@ public class AlertsApi
       result.put("items", latest);
       result.put("banners", banners);
       result.put("notificationsHref", NOTIFICATIONS_HREF);
+      result.put("preferencesSection", AlertsQBitProducer.preferencesSectionName(QContext.getQInstance()));
       result.put("inboxHref", NOTIFICATIONS_HREF);
       result.put("alertsHref", "/app/" + AlertsQBitConfig.APP_NAME);
       result.put("pollSeconds", POLL_SECONDS);

src/main/java/com/kingsrook/qbits/alerts/api/AlertsJsonSpec.java

@@ -23,6 +23,7 @@ import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.middleware.javalin.specs.BasicResponse;
 import com.kingsrook.qqq.middleware.javalin.specs.extensions.AbstractJsonEndpointSpec;
+import com.kingsrook.qqq.middleware.javalin.specs.v1.responses.BasicErrorResponseV1;
 import com.kingsrook.qqq.openapi.model.Method;
 import io.javalin.http.Context;
 import io.javalin.http.HttpStatus;
@@ -79,10 +80,10 @@ abstract class AlertsJsonSpec extends AbstractJsonEndpointSpec
    @Override
    public List<BasicResponse> defineAdditionalBasicResponses()
    {
-      return (List.of(new BasicResponse(HttpStatus.BAD_REQUEST, "Invalid input", "AlertsErrorV1"),
-         new BasicResponse(HttpStatus.UNAUTHORIZED, "Sign in required", "AlertsErrorV1"),
-         new BasicResponse(HttpStatus.FORBIDDEN, "Permission denied", "AlertsErrorV1"),
-         new BasicResponse(HttpStatus.NOT_FOUND, "Not found", "AlertsErrorV1")));
+      return (List.of(new BasicResponse(HttpStatus.BAD_REQUEST, "Invalid input", BasicErrorResponseV1.class.getSimpleName()),
+         new BasicResponse(HttpStatus.UNAUTHORIZED, "Sign in required", BasicErrorResponseV1.class.getSimpleName()),
+         new BasicResponse(HttpStatus.FORBIDDEN, "Permission denied", BasicErrorResponseV1.class.getSimpleName()),
+         new BasicResponse(HttpStatus.NOT_FOUND, "Not found", BasicErrorResponseV1.class.getSimpleName())));
    }
 
 

src/main/java/com/kingsrook/qbits/alerts/api/AlertsSchemas.java

@@ -49,7 +49,7 @@ public final class AlertsSchemas
          Map.entry("AlertsInboxItemV1", new AlertsInboxItemV1(null, null, null, null, null, null, null, null, null, null, null, null, null, null, null).toSchema()),
          Map.entry("AlertsPanelAlertV1", new AlertsPanelAlertV1(null, null, null, null, null, null, null, null, null).toSchema()),
          Map.entry("AlertsFollowV1", new AlertsFollowV1(null).toSchema()),
-         Map.entry("AlertsInboxSummaryV1", new AlertsInboxSummaryV1(null, null, null, null, null, null, null, null).toSchema()),
+         Map.entry("AlertsInboxSummaryV1", new AlertsInboxSummaryV1(null, null, null, null, null, null, null, null, null).toSchema()),
          Map.entry("AlertsInboxPageV1", new AlertsInboxPageV1(null, null, null, null).toSchema()),
          Map.entry("AlertsRecordPanelV1", new AlertsRecordPanelV1(null, null, null, null, null, null, null, null).toSchema()),
          Map.entry("AlertsMutationResultV1", new AlertsMutationResultV1(null).toSchema()),
@@ -161,7 +161,7 @@ public final class AlertsSchemas
    /*******************************************************************************
     ** Bell summary, latest ten items and up to three sticky banners.
     *******************************************************************************/
-   public record AlertsInboxSummaryV1(Integer unreadCount, String highestUnreadSeverity, List<AlertsInboxItemV1> items, List<AlertsInboxItemV1> banners, String notificationsHref, String inboxHref, String alertsHref, Integer pollSeconds) implements ToSchema
+   public record AlertsInboxSummaryV1(Integer unreadCount, String highestUnreadSeverity, List<AlertsInboxItemV1> items, List<AlertsInboxItemV1> banners, String notificationsHref, String inboxHref, String preferencesSection, String alertsHref, Integer pollSeconds) implements ToSchema
    {
       /*******************************************************************************
        ** Describe the public JSON shape.
@@ -175,6 +175,7 @@ public final class AlertsSchemas
             Map.entry("items", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("AlertsInboxItemV1"))),
             Map.entry("banners", new Schema().withType(Type.ARRAY).withItems(new Schema().withRefToSchema("AlertsInboxItemV1"))),
             Map.entry("notificationsHref", new Schema().withType(Type.STRING).withDescription("Existing notifications page link; retained for compatibility.")),
+            Map.entry("preferencesSection", new Schema().withType(Type.STRING).withNullable(true).withDescription("Name of the user Preferences section for notification settings (/qqq/v1/preferences/{name}), or null when not registered.")),
             Map.entry("inboxHref", new Schema().withType(Type.STRING).withDescription("Canonical inbox navigation link.")),
             Map.entry("alertsHref", new Schema().withType(Type.STRING)),
             Map.entry("pollSeconds", new Schema().withType(Type.INTEGER))))));
@@ -299,7 +300,7 @@ public final class AlertsSchemas
       @Override
       public Schema toSchema()
       {
-         return (new Schema().withType(Type.OBJECT).withDescription("Framework error response.").withProperties(new TreeMap<>(Map.ofEntries(
+         return (new Schema().withType(Type.OBJECT).withDescription("Deprecated since 1.2.0: errors use BasicErrorResponseV1.").withProperties(new TreeMap<>(Map.ofEntries(
             Map.entry("error", new Schema().withType(Type.STRING).withNullable(true))))));
       }
    }

src/main/java/com/kingsrook/qbits/alerts/api/AlertsUiApi.java

@@ -52,7 +52,7 @@ public final class AlertsUiApi
    public static MiddlewareSpecExtension extension()
    {
       return (new MiddlewareSpecExtension().withName("alerts").withPathPrefix("/alerts")
-         .withSemanticVersion("1.0.0").withDescription("Alerts inbox and record panel")
+         .withSemanticVersion("1.2.0").withDescription("Alerts inbox and record panel")
          .withSpec(InboxSummarySpec.class).withSpec(InboxSpec.class)
          .withSpec(InboxReadSpec.class).withSpec(InboxUnreadSpec.class)
          .withSpec(InboxDismissSpec.class).withSpec(RecordPanelSpec.class));

src/main/java/com/kingsrook/qbits/alerts/customizers/AlertsNotificationCustomizer.java

@@ -236,7 +236,7 @@ public class AlertsNotificationCustomizer implements TableCustomizerInterface
     *******************************************************************************/
    static void checkPreference(QRecord record)
    {
-      if(NotificationCategory.SECURITY.name().equals(record.getValueString("category")) && Boolean.TRUE.equals(record.getValueBoolean("inAppMuted")))
+      if(NotificationCategory.SECURITY.name().equals(record.getValueString("category")) && (Boolean.TRUE.equals(record.getValueBoolean("inAppMuted")) || record.getValue("inAppMinSeverity") != null))
       {
          record.addError(new PermissionDeniedMessage("Security notices can't be muted in-app; you can still choose how they are emailed."));
       }

src/main/java/com/kingsrook/qbits/alerts/engine/AlertRouter.java

@@ -66,8 +66,6 @@ import com.kingsrook.qqq.backend.core.model.metadata.collaboration.FollowEvent;
 import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordFollower;
 import com.kingsrook.qqq.backend.core.model.metadata.collaboration.RecordReference;
 import com.kingsrook.qqq.backend.core.model.session.QSession;
-import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleDispatcher;
-import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleInterface;
 import com.kingsrook.qqq.backend.core.utils.CollectionUtils;
 import com.kingsrook.qqq.backend.core.utils.StringUtils;
 import static com.kingsrook.qqq.backend.core.logging.LogUtils.logPair;
@@ -148,7 +146,7 @@ public class AlertRouter
       try
       {
          deliver(alert, eventType, eventId, kind, destinations(AlertTarget.of(alert),
-            AlertSeverity.fromLabel(alert.getValueString("severity"), AlertSeverity.WARNING), kind));
+            AlertSeverity.fromLabel(alert.getValueString("severity"), AlertSeverity.WARNING), kind, alert.getValue("id")));
       }
       catch(Exception e)
       {
@@ -164,7 +162,7 @@ public class AlertRouter
    public int remind(QRecord alert) throws QException
    {
       return (deliver(alert, null, null, DeliveryKind.REMINDER, destinations(AlertTarget.of(alert),
-         AlertSeverity.fromLabel(alert.getValueString("severity"), AlertSeverity.WARNING), DeliveryKind.REMINDER)));
+         AlertSeverity.fromLabel(alert.getValueString("severity"), AlertSeverity.WARNING), DeliveryKind.REMINDER, alert.getValue("id"))));
    }
 
 
@@ -415,20 +413,32 @@ public class AlertRouter
     ** Every destination for an alert: subscribed users (directly or through a
     ** team) with their in-app and email channels (or the subscription's
     ** chosen channels), subscribed channels, and readable record followers.
+    ** An alert that no subscription matches (at WARNING or above) goes to the
+    ** members of its group's owner team, so an unowned problem is not silent.
     *******************************************************************************/
-   List<Destination> destinations(AlertTarget target, AlertSeverity severity, DeliveryKind kind) throws QException
+   List<Destination> destinations(AlertTarget target, AlertSeverity severity, DeliveryKind kind, Object alertId) throws QException
    {
       Map<Integer, List<String>> groupNames   = new HashMap<>();
       Map<String, Destination>   destinations = new LinkedHashMap<>();
+      boolean                    subscribed   = false;
       for(QRecord subscription : AlertsDb.query(AlertsSubscription.TABLE_NAME, AlertsDb.eq("enabled", true)))
       {
          AlertSeverity min = AlertSeverity.fromLabel(subscription.getValueString("minSeverity"), AlertSeverity.WARNING);
-         if(!severity.isAtLeast(min) || !includesKind(subscription.getValueString("events"), kind)
+         if(!severity.isAtLeast(min)
             || !scopeMatches(subscription.getValueString("scopeType"), subscription.getValueString("scopeValue"), subscription.getValueString("scopeRecordId"), target, groupNames))
          {
             continue;
          }
 
+         //////////////////////////////////////////////////////////////////////////////
+         // covered by scope and severity alone: a subscription that leaves out an   //
+         // event kind (events=RAISED) still means someone owns this alert           //
+         //////////////////////////////////////////////////////////////////////////////
+         subscribed = true;
+         if(!includesKind(subscription.getValueString("events"), kind))
+         {
+            continue;
+         }
          Integer subscriptionId = subscription.getValueInteger("id");
          String  minName        = subscription.getValueString("minSeverity");
          String  subscriberType = subscription.getValueString("subscriberType");
@@ -465,6 +475,10 @@ public class AlertRouter
             }
          }
       }
+      if(!subscribed && severity.isAtLeast(AlertSeverity.WARNING))
+      {
+         addOwnerTeam(destinations, target, kind, alertId);
+      }
       for(String recordKey : kind == DeliveryKind.REMINDER ? java.util.Set.<String>of() : target.recordKeys())
       {
          String[] parts = recordKey.split(":", 2);
@@ -488,6 +502,79 @@ public class AlertRouter
 
 
 
+   /*******************************************************************************
+    ** The fallback for an alert nobody subscribed to: the members of the owner
+    ** team of its group (or of the nearest parent group that has one), through
+    ** their normal channels and the usual suppression checks.
+    *******************************************************************************/
+   private void addOwnerTeam(Map<String, Destination> destinations, AlertTarget target, DeliveryKind kind, Object alertId) throws QException
+   {
+      Integer teamId = ownerTeamId(target.groupId());
+      if(teamId == null)
+      {
+         return;
+      }
+      for(String userId : teamMembers(teamId))
+      {
+         if(!StringUtils.hasContent(userId))
+         {
+            continue;
+         }
+         if((kind == DeliveryKind.RESOLVED || kind == DeliveryKind.REMINDER) && !wasToldOfRaise(alertId, userId))
+         {
+            ///////////////////////////////////////////////////////////////////////////
+            // a follow-up only goes to owners who were told about the alert itself //
+            ///////////////////////////////////////////////////////////////////////////
+            continue;
+         }
+         QRecord preference = AlertsDb.first(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", userId));
+         for(QRecord channel : userChannels(null, preference))
+         {
+            destinations.putIfAbsent("user:" + userId + ":" + channel.getValue("id"), new Destination(userId, channel, null, null, preference, "IMMEDIATE"));
+         }
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Whether the user was sent (not suppressed) the RAISED notice for this alert.
+    *******************************************************************************/
+   private boolean wasToldOfRaise(Object alertId, String userId) throws QException
+   {
+      return (alertId != null && AlertsDb.count(AlertsDelivery.TABLE_NAME, AlertsDb.eq("alertId", (java.io.Serializable) alertId)
+         .withCriteria("recipientUserId", QCriteriaOperator.EQUALS, userId).withCriteria("kind", QCriteriaOperator.EQUALS, DeliveryKind.RAISED.name())
+         .withCriteria("status", QCriteriaOperator.NOT_EQUALS, DeliveryStatus.SUPPRESSED.name())) > 0);
+   }
+
+
+
+   /*******************************************************************************
+    ** The owner team of a group, or of the nearest parent that has one (null:
+    ** none).
+    *******************************************************************************/
+   Integer ownerTeamId(Integer groupId) throws QException
+   {
+      Integer current = groupId;
+      int     depth   = 0;
+      while(current != null && depth++ < 10)
+      {
+         QRecord group = AlertsDb.byId(AlertsGroup.TABLE_NAME, current);
+         if(group == null)
+         {
+            return (null);
+         }
+         if(group.getValueInteger("ownerTeamId") != null)
+         {
+            return (group.getValueInteger("ownerTeamId"));
+         }
+         current = group.getValueInteger("parentGroupId");
+      }
+      return (null);
+   }
+
+
+
    /*******************************************************************************
     ** Explicit members plus the team's optional host-managed source. Missing
     ** or failed resolvers contribute nobody and leave an actionable log entry.
@@ -545,7 +632,9 @@ public class AlertRouter
 
    /*******************************************************************************
     ** A user's channels for a subscription: the ones it names, else in-app
-    ** (unless turned off) and email (when enabled in their settings).
+    ** (unless turned off) plus the user's own default channels (My Alert
+    ** Settings) in place of the built-in email, else in-app and email (when
+    ** enabled in their settings).
     *******************************************************************************/
    private List<QRecord> userChannels(QRecord subscription, QRecord preference) throws QException
    {
@@ -553,18 +642,32 @@ public class AlertRouter
       String        overrides = subscription == null ? null : subscription.getValueString("channelOverrideIds");
       if(StringUtils.hasContent(overrides))
       {
-         for(String id : overrides.split("[,\\s]+"))
+         return (channelsById(overrides));
+      }
+
+      boolean inApp = preference == null || !Boolean.FALSE.equals(preference.getValueBoolean("inAppEnabled"));
+      String  defaults = preference == null ? null : preference.getValueString("defaultChannelIds");
+      if(StringUtils.hasContent(defaults))
+      {
+         List<QRecord> chosen = channelsById(defaults);
+         if(!chosen.isEmpty())
          {
-            if(!id.isBlank())
+            /////////////////////////////////////////////////////////////////////////
+            // the bell stays (unless turned off); the list replaces external ones //
+            /////////////////////////////////////////////////////////////////////////
+            if(inApp)
             {
-               QRecord channel = AlertsDb.byId(AlertsChannel.TABLE_NAME, Integer.valueOf(id.trim()));
-               if(channel != null)
+               channels.add(runtime.getChannels().defaultChannel(ChannelType.IN_APP));
+            }
+            for(QRecord channel : chosen)
+            {
+               if(!ChannelType.IN_APP.name().equals(channel.getValueString("channelType")))
                {
                   channels.add(channel);
                }
             }
+            return (channels);
          }
-         return (channels);
       }
 
       if(preference == null || !Boolean.FALSE.equals(preference.getValueBoolean("inAppEnabled")))
@@ -580,6 +683,37 @@ public class AlertRouter
 
 
 
+   /*******************************************************************************
+    ** The channel rows for a list of ids ("3, 5"); ids that are not numbers or
+    ** no longer exist are skipped.
+    *******************************************************************************/
+   private List<QRecord> channelsById(String ids) throws QException
+   {
+      List<QRecord> channels = new ArrayList<>();
+      for(String id : ids.split("[,\\s]+"))
+      {
+         if(id.isBlank())
+         {
+            continue;
+         }
+         try
+         {
+            QRecord channel = AlertsDb.byId(AlertsChannel.TABLE_NAME, Integer.valueOf(id.trim()));
+            if(channel != null)
+            {
+               channels.add(channel);
+            }
+         }
+         catch(NumberFormatException e)
+         {
+            LOG.debug("Ignoring a channel id that is not a number", logPair("id", id));
+         }
+      }
+      return (channels);
+   }
+
+
+
    /*******************************************************************************
     ** Whether a subscription or mute scope covers the target.
     *******************************************************************************/
@@ -746,18 +880,12 @@ public class AlertRouter
 
 
    /*******************************************************************************
-    ** A session for a user, from the instance's authentication module (null
-    ** when it can't make one).
+    ** A session for a user: on their behalf via the alerts service principal
+    ** when declared, else the authentication module's (null when neither).
     *******************************************************************************/
    private QSession automatedSession(String userId) throws QException
    {
-      QInstance qInstance = runtime.getQInstance();
-      if(qInstance.getAuthentication() == null)
-      {
-         return (null);
-      }
-      QAuthenticationModuleInterface module = new QAuthenticationModuleDispatcher().getQModule(qInstance.getAuthentication());
-      return (module.createAutomatedSessionForUser(qInstance, userId));
+      return (AlertsSecurity.recipientSession(runtime.getQInstance(), runtime.getConfig().getServicePrincipal(), userId));
    }
 
 

src/main/java/com/kingsrook/qbits/alerts/engine/AlertsDb.java

@@ -40,7 +40,8 @@ import com.kingsrook.qqq.backend.core.utils.CollectionUtils;
 /*******************************************************************************
  ** Small helpers over QQQ's table actions, for the engine. They run in
  ** whatever context the caller set up (the engine uses the system user), so
- ** customizers, audits and ESB listeners apply as for any other write.
+ ** customizers, audits and ESB listeners apply as for any other write, except
+ ** that bookkeeping-only updates (RuntimeFields) are not record-audited.
  *******************************************************************************/
 public final class AlertsDb
 {
@@ -114,11 +115,14 @@ public final class AlertsDb
 
 
    /*******************************************************************************
-    ** Update one row (it must carry its id); throws on an error.
+    ** Update one row (it must carry its id); throws on an error. An update of
+    ** engine bookkeeping fields only (RuntimeFields) is not record-audited.
     *******************************************************************************/
    public static QRecord update(String tableName, QRecord record) throws QException
    {
-      List<QRecord> updated = UpdateAction.executeForRecords(new UpdateInput(tableName).withRecord(record).withTransaction(QContext.getQBackendTransaction()));
+      UpdateInput   input   = new UpdateInput(tableName).withRecord(record).withTransaction(QContext.getQBackendTransaction())
+         .withOmitDmlAudit(RuntimeFields.onlyRuntime(tableName, record));
+      List<QRecord> updated = UpdateAction.executeForRecords(input);
       QRecord       result  = updated.get(0);
       throwIfErrors(tableName, result);
       return (result);

src/main/java/com/kingsrook/qbits/alerts/engine/RuntimeFields.java

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts.engine;
+
+
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.alerts.model.AlertsAlert;
+import com.kingsrook.qbits.alerts.model.AlertsMonitor;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** Engine bookkeeping columns: evaluation leases, run results and notification
+ ** timers that change on every scheduler pass. An update that touches only
+ ** these (plus the primary key and modifyDate) is not record-audited; the core
+ ** FIELD audit would otherwise write an audit row per monitor run and per
+ ** reminder check. Any update that also changes a configuration or alert-state
+ ** field (status, severity, acknowledgement, assignment, a monitor's settings)
+ ** is audited in full, as before. Run history lives in the run fields
+ ** themselves; alert raises, transitions and notifications have their own
+ ** event and delivery tables.
+ *******************************************************************************/
+public final class RuntimeFields
+{
+   private static final Set<String> ALWAYS = Set.of("id", "modifyDate");
+
+   private static final Map<String, Set<String>> BY_TABLE = Map.of(
+      AlertsMonitor.TABLE_NAME, Set.of("claimedBy", "claimedUntil", "lastRunAt", "nextRunAt", "lastStatus", "lastValue", "lastError",
+         "lastElapsedMs", "consecutiveFailures", "conditionSince"),
+      AlertsAlert.TABLE_NAME, Set.of("timedNotificationCheckedAt", "lastNotifiedAt", "recordRefCount"));
+
+
+
+   /*******************************************************************************
+    ** Constants only.
+    *******************************************************************************/
+   private RuntimeFields()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** The bookkeeping fields of a table (empty when it has none).
+    *******************************************************************************/
+   public static Set<String> of(String tableName)
+   {
+      return (BY_TABLE.getOrDefault(tableName, Set.of()));
+   }
+
+
+
+   /*******************************************************************************
+    ** Whether an update record carries nothing but bookkeeping fields.
+    *******************************************************************************/
+   public static boolean onlyRuntime(String tableName, QRecord update)
+   {
+      Set<String> runtime = of(tableName);
+      return (!runtime.isEmpty() && update.getValues().keySet().stream().allMatch(field -> runtime.contains(field) || ALWAYS.contains(field)));
+   }
+}

src/main/java/com/kingsrook/qbits/alerts/home/AlertsHome.java

@@ -80,6 +80,7 @@ import com.kingsrook.qqq.backend.core.utils.StringUtils;
  *******************************************************************************/
 public final class AlertsHome
 {
+   public static final String KIND_SETUP     = "setup";
    public static final String KIND_SEVERITY  = "severity";
    public static final String KIND_MINE      = "mine";
    public static final String KIND_ACTION    = "needsAction";
@@ -121,6 +122,7 @@ public final class AlertsHome
       Instant now = runtime.now();
       return switch(kind == null ? "" : kind)
       {
+         case KIND_SETUP -> setup(runtime, now);
          case KIND_SEVERITY -> severity(runtime, now);
          case KIND_MINE -> mine(now);
          case KIND_ACTION -> needsAction(now);
@@ -136,6 +138,34 @@ public final class AlertsHome
 
 
 
+   /*******************************************************************************
+    ** Setup (alerts admins): each configuration table, whether it is set up, and
+    ** the next step, linked to its table.
+    *******************************************************************************/
+   static QWidgetData setup(AlertsRuntime runtime, Instant now) throws QException
+   {
+      List<AlertsSetupStatus.Item> items = AlertsSetupStatus.load(runtime, now);
+      long                         todo  = items.stream().filter(item -> item.state() == AlertsSetupStatus.State.TODO).count();
+      StringBuilder                html  = new StringBuilder(HomeHtml.note(todo == 0 ? "Everything Alerts needs is set up." : HomeHtml.plural(todo, "item") + (todo == 1 ? " needs" : " need") + " attention."));
+      for(AlertsSetupStatus.Item item : items)
+      {
+         String badge = switch(item.state())
+         {
+            case OK -> HomeHtml.badge("Set up", HomeHtml.OK_COLOR);
+            case TODO -> HomeHtml.badge("Needs setup", HomeHtml.BAD_COLOR);
+            case DEFAULT -> HomeHtml.badge("Using defaults", HomeHtml.WARN_COLOR);
+            case OPTIONAL -> HomeHtml.badge("Optional", HomeHtml.OFF_COLOR);
+         };
+         String label = item.tableName() == null ? HomeHtml.escape(item.label()) : HomeHtml.link("/app/" + item.tableName(), item.label());
+         html.append("<div style=\"padding:8px 0;border-top:1px solid rgba(127,127,127,.2)\">")
+            .append(HomeHtml.card("<strong>" + label + "</strong> " + badge, HomeHtml.escape(item.detail()), item.nextStep() == null ? null : "Next: " + HomeHtml.escape(item.nextStep())))
+            .append("</div>");
+      }
+      return (new RawHTML(null, html.toString()));
+   }
+
+
+
    /*******************************************************************************
     ** Open by severity: four tiles, each with the unacknowledged count and the
     ** oldest age, linking to the filtered list.
@@ -749,6 +779,6 @@ public final class AlertsHome
     *******************************************************************************/
    static Set<String> kinds()
    {
-      return (Set.of(KIND_SEVERITY, KIND_MINE, KIND_ACTION, KIND_BY_GROUP, KIND_TREND, KIND_NOISY, KIND_DELIVERY, KIND_RESOLVED));
+      return (Set.of(KIND_SETUP, KIND_SEVERITY, KIND_MINE, KIND_ACTION, KIND_BY_GROUP, KIND_TREND, KIND_NOISY, KIND_DELIVERY, KIND_RESOLVED));
    }
 }

src/main/java/com/kingsrook/qbits/alerts/home/AlertsSetupStatus.java

@@ -0,0 +1,179 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts.home;
+
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.List;
+import com.kingsrook.qbits.alerts.AlertsRuntime;
+import com.kingsrook.qbits.alerts.engine.AlertsDb;
+import com.kingsrook.qbits.alerts.model.AlertsChannel;
+import com.kingsrook.qbits.alerts.model.AlertsEscalationPolicy;
+import com.kingsrook.qbits.alerts.model.AlertsEscalationStep;
+import com.kingsrook.qbits.alerts.model.AlertsGroup;
+import com.kingsrook.qbits.alerts.model.AlertsMonitor;
+import com.kingsrook.qbits.alerts.model.AlertsMute;
+import com.kingsrook.qbits.alerts.model.AlertsPossibleValues.ChannelType;
+import com.kingsrook.qbits.alerts.model.AlertsPossibleValues.HealthStatus;
+import com.kingsrook.qbits.alerts.model.AlertsSubscription;
+import com.kingsrook.qbits.alerts.model.AlertsTeam;
+import com.kingsrook.qbits.alerts.model.AlertsType;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+
+
+/*******************************************************************************
+ ** The Setup card on the Alerts home: each configuration table, whether it is
+ ** set up, and the next step. Reads only the qbit's own small configuration
+ ** tables, in the signed-in administrator's session.
+ *******************************************************************************/
+public final class AlertsSetupStatus
+{
+   /*******************************************************************************
+    ** OK: working. TODO: needs attention. DEFAULT: working on built-in defaults.
+    ** OPTIONAL: a feature that is off until set up.
+    *******************************************************************************/
+   public enum State
+   {
+      OK, TODO, DEFAULT, OPTIONAL
+   }
+
+
+
+   /*******************************************************************************
+    ** One line of the card. tableName is null for an item with no table.
+    *******************************************************************************/
+   public record Item(String label, String tableName, State state, String detail, String nextStep)
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Utility class.
+    *******************************************************************************/
+   private AlertsSetupStatus()
+   {
+   }
+
+
+
+   /*******************************************************************************
+    ** Build the items.
+    *******************************************************************************/
+   public static List<Item> load(AlertsRuntime runtime, Instant now) throws QException
+   {
+      List<Item> items = new ArrayList<>();
+
+      /////////////
+      // channels //
+      /////////////
+      List<QRecord> channels = AlertsDb.query(AlertsChannel.TABLE_NAME, new QQueryFilter());
+      long          external = channels.stream().filter(c -> !List.of(ChannelType.IN_APP.name(), ChannelType.EMAIL.name()).contains(c.getValueString("channelType"))).count();
+      long          unhealthy = channels.stream().filter(c -> HealthStatus.UNHEALTHY.name().equals(c.getValueString("healthStatus"))).count();
+      if(channels.isEmpty())
+      {
+         items.add(new Item("Channels", AlertsChannel.TABLE_NAME, State.DEFAULT, "No channel rows yet: the bell and email channels are created when the first alert is routed.",
+            "Include alerts-defaults.changelog.sql to create them now, then add Slack, Teams or a webhook if you want them."));
+      }
+      else if(unhealthy > 0)
+      {
+         items.add(new Item("Channels", AlertsChannel.TABLE_NAME, State.TODO, unhealthy + (unhealthy == 1 ? " channel is" : " channels are") + " failing.",
+            "Open it, check its settings and secret reference, then Send test notification."));
+      }
+      else
+      {
+         items.add(new Item("Channels", AlertsChannel.TABLE_NAME, State.OK, plural(channels.size(), "channel") + (external == 0 ? ": the bell and email only." : ", " + external + " of them outside the bell and email."),
+            external == 0 ? "Optional: add Slack, Teams, a webhook or PagerDuty." : null));
+      }
+
+      ///////////////////////
+      // types and monitors //
+      ///////////////////////
+      int types = AlertsDb.count(AlertsType.TABLE_NAME, AlertsDb.eq("installed", true));
+      items.add(types == 0
+         ? new Item("Alert types", AlertsType.TABLE_NAME, State.TODO, "No installed alert type.", "Types are declared in code by the installed qbits (QAlertTypeMetaData); open the Alerts home once so they sync.")
+         : new Item("Alert types", AlertsType.TABLE_NAME, State.OK, plural(types, "type") + " declared by the installed qbits.", null));
+
+      int monitors = AlertsDb.count(AlertsMonitor.TABLE_NAME, AlertsDb.eq("enabled", true));
+      items.add(monitors == 0
+         ? new Item("Monitors", AlertsMonitor.TABLE_NAME, State.OPTIONAL, "No monitor is turned on: alerts come only from code that raises them.", "On an alert type, choose Create monitor, or add one with New.")
+         : new Item("Monitors", AlertsMonitor.TABLE_NAME, State.OK, plural(monitors, "monitor") + " turned on.", null));
+
+      /////////////////////////////////
+      // groups, teams and owner teams //
+      /////////////////////////////////
+      List<QRecord> groups      = AlertsDb.query(AlertsGroup.TABLE_NAME, new QQueryFilter());
+      long          ownedGroups = groups.stream().filter(g -> g.getValueInteger("ownerTeamId") != null).count();
+      items.add(ownedGroups == 0
+         ? new Item("Groups", AlertsGroup.TABLE_NAME, State.OPTIONAL, plural(groups.size(), "group") + ", none with an owner team.", "Give a group an Owner Team so alerts that nobody subscribed to still reach someone.")
+         : new Item("Groups", AlertsGroup.TABLE_NAME, State.OK, plural(groups.size(), "group") + ", " + ownedGroups + " with an owner team.", null));
+
+      int teams = AlertsDb.count(AlertsTeam.TABLE_NAME, new QQueryFilter());
+      items.add(teams == 0
+         ? new Item("Teams", AlertsTeam.TABLE_NAME, State.OPTIONAL, "No team.", "Add a team and its members to subscribe people together or to own a group.")
+         : new Item("Teams", AlertsTeam.TABLE_NAME, State.OK, plural(teams, "team") + ".", null));
+
+      /////////////////////////////////////////////////////
+      // subscriptions: nobody hears anything without one //
+      /////////////////////////////////////////////////////
+      int subscriptions = AlertsDb.count(AlertsSubscription.TABLE_NAME, AlertsDb.eq("enabled", true));
+      if(subscriptions > 0)
+      {
+         items.add(new Item("Subscriptions", AlertsSubscription.TABLE_NAME, State.OK, plural(subscriptions, "subscription") + " turned on.", null));
+      }
+      else
+      {
+         items.add(new Item("Subscriptions", AlertsSubscription.TABLE_NAME, ownedGroups > 0 ? State.DEFAULT : State.TODO, "No subscription: " + (ownedGroups > 0 ? "alerts reach only the owner teams of their groups." : "alerts reach nobody."),
+            "Use Subscribe me on a type, group or monitor, or add one with New. An alerts admin gets an in-app subscription to errors on first visit."));
+      }
+
+      ///////////////////////////////////////
+      // escalation, maintenance, scheduler //
+      ///////////////////////////////////////
+      int policies = AlertsDb.count(AlertsEscalationPolicy.TABLE_NAME, AlertsDb.eq("enabled", true));
+      int steps    = AlertsDb.count(AlertsEscalationStep.TABLE_NAME, new QQueryFilter());
+      items.add(policies == 0
+         ? new Item("Escalation policies", AlertsEscalationPolicy.TABLE_NAME, State.OPTIONAL, "None: alerts are reminded, not escalated.", "Add a policy and its steps, then pick it on a type or group.")
+         : steps == 0
+            ? new Item("Escalation policies", AlertsEscalationPolicy.TABLE_NAME, State.TODO, plural(policies, "policy") + ", but no steps, so nothing escalates.", "Add steps to the policy.")
+            : new Item("Escalation policies", AlertsEscalationPolicy.TABLE_NAME, State.OK, plural(policies, "policy") + ", " + plural(steps, "step") + ".", null));
+
+      int mutes = AlertsDb.count(AlertsMute.TABLE_NAME, AlertsDb.eq("enabled", true).withCriteria("endsAt", QCriteriaOperator.GREATER_THAN, now));
+      items.add(new Item("Mutes and maintenance", AlertsMute.TABLE_NAME, State.OPTIONAL, mutes == 0 ? "Nothing is muted." : plural(mutes, "mute") + " active or scheduled.",
+         mutes == 0 ? "Add a window before planned maintenance." : null));
+
+      items.add(runtime.getConfig().getSchedulerName() == null
+         ? new Item("Scheduler", null, State.TODO, "No scheduler is configured, so monitors, delivery, digests and escalation only run when started by hand.", "Set schedulerName in the Alerts config.")
+         : new Item("Scheduler", null, State.OK, "Monitors, delivery, digests and escalation run on the " + runtime.getConfig().getSchedulerName() + " scheduler.", null));
+      return (items);
+   }
+
+
+
+   /*******************************************************************************
+    ** "1 channel", "2 channels".
+    *******************************************************************************/
+   private static String plural(long count, String noun)
+   {
+      return (count + " " + noun + (count == 1 ? "" : "s"));
+   }
+
+}

src/main/java/com/kingsrook/qbits/alerts/metadata/AlertsHomeWidgetsMetaDataProducer.java

@@ -33,11 +33,12 @@ import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitComponentMetaData
 
 /*******************************************************************************
  ** The Alerts home dashboard (design section 6.2), in page order, all full
- ** width: open by severity, my alerts, needs action, by group, trend, noisy
+ ** width: setup (admins), open by severity, my alerts, needs action, by group, trend, noisy
  ** types, delivery health (admins) and recently resolved.
  *******************************************************************************/
 public class AlertsHomeWidgetsMetaDataProducer extends QBitComponentMetaDataProducer<MetaDataProducerMultiOutput, AlertsQBitConfig>
 {
+   public static final String SETUP    = "alertsHomeSetup";
    public static final String SEVERITY = "alertsHomeOpenBySeverity";
    public static final String MINE     = "alertsHomeMyAlerts";
    public static final String ACTION   = "alertsHomeNeedsAction";
@@ -55,7 +56,7 @@ public class AlertsHomeWidgetsMetaDataProducer extends QBitComponentMetaDataProd
     *******************************************************************************/
    public static List<String> homeWidgetNames()
    {
-      return (List.of(SEVERITY, MINE, ACTION, BY_GROUP, TREND, NOISY, DELIVERY, NOTICES, RESOLVED));
+      return (List.of(SETUP, SEVERITY, MINE, ACTION, BY_GROUP, TREND, NOISY, DELIVERY, NOTICES, RESOLVED));
    }
 
 
@@ -70,6 +71,7 @@ public class AlertsHomeWidgetsMetaDataProducer extends QBitComponentMetaDataProd
       String table = WidgetType.TABLE.getType();
 
       MetaDataProducerMultiOutput output = new MetaDataProducerMultiOutput();
+      output.add(widget(SETUP, "Setup", html, AlertsHome.KIND_SETUP, AlertsQBitConfig.PERMISSION_ADMIN));
       output.add(widget(SEVERITY, "Open Alerts", html, AlertsHome.KIND_SEVERITY, AlertsQBitConfig.PERMISSION_VIEW));
       output.add(widget(MINE, "My Alerts", table, AlertsHome.KIND_MINE, AlertsQBitConfig.PERMISSION_VIEW));
       output.add(widget(ACTION, "Needs Action", table, AlertsHome.KIND_ACTION, AlertsQBitConfig.PERMISSION_VIEW));

src/main/java/com/kingsrook/qbits/alerts/metadata/AlertsTableMetaDataHelper.java

@@ -464,7 +464,7 @@ public final class AlertsTableMetaDataHelper
          .withUniqueKey(new UniqueKey("userId", "category"))
          .withRecordSecurityLock(AlertsSecurity.ownerLock("userId"))
          .withAuditRules(new QAuditRules().withAuditLevel(AuditLevel.FIELD))
-         .withSection(new QFieldSection("identity", new QIcon("badge"), Tier.T1, List.of("id", "category", "inAppMuted", "emailMode", "emailMinSeverity", "slackMode", "slackMinSeverity")))
+         .withSection(new QFieldSection("identity", new QIcon("badge"), Tier.T1, List.of("id", "category", "inAppMuted", "inAppMinSeverity", "emailMode", "emailMinSeverity", "slackMode", "slackMinSeverity")))
          .withSection(new QFieldSection("system", new QIcon("calendar_month"), Tier.T3, List.of("userId", "createDate", "modifyDate")));
       table.getField("category").setDefaultValue(NotificationCategory.SYSTEM.name());
       table.getField("inAppMuted").setDefaultValue(false);

src/main/java/com/kingsrook/qbits/alerts/model/AlertsNotificationPreference.java

@@ -25,7 +25,7 @@ import com.kingsrook.qqq.backend.core.model.metadata.fields.ValueTooLongBehavior
 
 
 /*******************************************************************************
- ** A user's settings for one notification category: muted in-app (never for security), and email off, immediate or in a daily digest, from a minimum severity.
+ ** A user's settings for one notification category: in-app minimum severity (never for security), and email/Slack off, immediate or in a daily digest, from a minimum severity.
  **
  ** Generated from the qbit-alerts schema (one definition for the entity,
  ** the Liquibase changelog and the test DDL).
@@ -46,6 +46,9 @@ public class AlertsNotificationPreference extends QRecordEntity
    @QField(label = "Muted In-App")
    private Boolean inAppMuted;
 
+   @QField(maxLength = 16, possibleValueSourceName = "alerts_notification_severity", label = "In-App From Severity")
+   private String inAppMinSeverity;
+
    @QField(maxLength = 16, possibleValueSourceName = "alerts_email_mode", label = "Email")
    private String emailMode;
 
@@ -307,6 +310,35 @@ public class AlertsNotificationPreference extends QRecordEntity
    }
 
 
+   /*******************************************************************************
+    ** Getter for inAppMinSeverity
+    *******************************************************************************/
+   public String getInAppMinSeverity()
+   {
+      return (this.inAppMinSeverity);
+   }
+
+
+   /*******************************************************************************
+    ** Setter for inAppMinSeverity
+    *******************************************************************************/
+   public void setInAppMinSeverity(String inAppMinSeverity)
+   {
+      this.inAppMinSeverity = inAppMinSeverity;
+   }
+
+
+   /*******************************************************************************
+    ** Fluent setter for inAppMinSeverity
+    *******************************************************************************/
+   public AlertsNotificationPreference withInAppMinSeverity(String inAppMinSeverity)
+   {
+      this.inAppMinSeverity = inAppMinSeverity;
+      return (this);
+   }
+
+
+
    /*******************************************************************************
     ** Getter for slackMode
     *******************************************************************************/

src/main/java/com/kingsrook/qbits/alerts/model/AlertsPossibleValues.java

@@ -290,7 +290,7 @@ public final class AlertsPossibleValues
     *******************************************************************************/
    public enum EmailStatus
    {
-      NONE, PENDING, SENT, DIGESTED, SKIPPED, FAILED
+      NONE, PENDING, REQUESTED, SENT, DIGESTED, SKIPPED, FAILED
    }
 
 
@@ -324,7 +324,7 @@ public final class AlertsPossibleValues
       List<QPossibleValue<?>> possibleValues = new ArrayList<>();
       for(Enum<?> value : values)
       {
-         possibleValues.add(new QPossibleValue<>(value.name(), label(value.name())));
+         possibleValues.add(new QPossibleValue<>(value.name(), value == EmailMode.DAILY_DIGEST ? "Daily digest" : label(value.name())));
       }
       return (new QPossibleValueSource()
          .withName(name)

src/main/java/com/kingsrook/qbits/alerts/notifications/AlertsAudienceResolver.java

@@ -26,6 +26,7 @@ import java.util.Map;
 import java.util.Set;
 import java.util.stream.Collectors;
 import com.kingsrook.qbits.alerts.AlertsRuntime;
+import com.kingsrook.qbits.alerts.AlertsSecurity;
 import com.kingsrook.qqq.backend.core.actions.customizers.QCodeLoader;
 import com.kingsrook.qqq.backend.core.alerts.NotificationAudience;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
@@ -33,8 +34,6 @@ import com.kingsrook.qqq.backend.core.logging.QLogger;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
 import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
 import com.kingsrook.qqq.backend.core.model.session.QSession;
-import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleDispatcher;
-import com.kingsrook.qqq.backend.core.modules.authentication.QAuthenticationModuleInterface;
 import static com.kingsrook.qqq.backend.core.logging.LogUtils.logPair;
 
 
@@ -218,20 +217,14 @@ public class AlertsAudienceResolver
 
 
    /*******************************************************************************
-    ** A session for a user from the instance's authentication module (null
-    ** when it can't make one).
+    ** A session for a user: on their behalf via the alerts service principal
+    ** when declared, else the authentication module's (null when neither).
     *******************************************************************************/
    private QSession automatedSession(String userId)
    {
       try
       {
-         QInstance qInstance = runtime.getQInstance();
-         if(qInstance.getAuthentication() == null)
-         {
-            return (null);
-         }
-         QAuthenticationModuleInterface module = new QAuthenticationModuleDispatcher().getQModule(qInstance.getAuthentication());
-         return (module.createAutomatedSessionForUser(qInstance, userId));
+         return (AlertsSecurity.recipientSession(runtime.getQInstance(), runtime.getConfig().getServicePrincipal(), userId));
       }
       catch(Exception e)
       {

src/main/java/com/kingsrook/qbits/alerts/notifications/NotificationEmailer.java

@@ -29,11 +29,14 @@ import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
 import com.kingsrook.qbits.alerts.AlertsQBitConfig;
 import com.kingsrook.qbits.alerts.AlertsRuntime;
 import com.kingsrook.qbits.alerts.delivery.AlertRedactor;
 import com.kingsrook.qbits.alerts.email.AlertsEmail;
 import com.kingsrook.qbits.alerts.email.AlertsEmailSender;
+import com.kingsrook.qbits.alerts.engine.AlertTiming;
 import com.kingsrook.qbits.alerts.engine.AlertsDb;
 import com.kingsrook.qbits.alerts.metadata.AlertsProcessesMetaDataProducer;
 import com.kingsrook.qbits.alerts.model.AlertsNotification;
@@ -43,6 +46,7 @@ import com.kingsrook.qbits.alerts.model.AlertsPossibleValues.EmailMode;
 import com.kingsrook.qbits.alerts.model.AlertsPossibleValues.EmailStatus;
 import com.kingsrook.qbits.alerts.model.AlertsUserPreference;
 import com.kingsrook.qqq.backend.core.actions.messaging.SendMessageAction;
+import com.kingsrook.qqq.backend.core.alerts.AlertSeverity;
 import com.kingsrook.qqq.backend.core.alerts.NotificationCategory;
 import com.kingsrook.qqq.backend.core.alerts.NotificationSeverity;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
@@ -54,6 +58,7 @@ import com.kingsrook.qqq.backend.core.model.actions.messaging.SendMessageInput;
 import com.kingsrook.qqq.backend.core.model.actions.messaging.email.EmailContentRole;
 import com.kingsrook.qqq.backend.core.model.actions.messaging.email.EmailPartyRole;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.utils.StringUtils;
@@ -66,6 +71,11 @@ import static com.kingsrook.qqq.backend.core.logging.LogUtils.logPair;
  ** - IMMEDIATE: one email per notification at or above the minimum severity;
  ** - DAILY_DIGEST: one email at the user's digest hour (in their time zone,
  **   from My Alert Settings) listing the day's unread notifications.
+ ** A recipient with email status REQUESTED (a per-notification opt-in, e.g. by
+ ** a job) is emailed immediately without a standing category preference. It
+ ** still honours the category's email minimum severity when one is set, the
+ ** user's pause (SECURITY bypasses) and quiet hours (held, not dropped), is
+ ** skipped without a known address, and is only eligible for a day.
  ** Sent through qbit-email when it is produced in the instance (one message
  ** per recipient; templates alerts_notification and alerts_digest,
  ** NOTIFICATION), else through core SendMessageAction. Inert without either
@@ -136,45 +146,84 @@ public class NotificationEmailer
          {
             preferences.computeIfAbsent(preference.getValueString("userId"), k -> new HashMap<>()).put(preference.getValueString("category"), preference);
          }
-         if(preferences.isEmpty())
+
+         QQueryFilter eligible = new QQueryFilter().withBooleanOperator(QQueryFilter.BooleanOperator.OR)
+            .withSubFilter(new QQueryFilter()
+               .withCriteria("emailStatus", QCriteriaOperator.EQUALS, EmailStatus.REQUESTED.name())
+               .withCriteria("deliveredAt", QCriteriaOperator.GREATER_THAN_OR_EQUALS, now.minus(1, ChronoUnit.DAYS)));
+         if(!preferences.isEmpty())
          {
-            return (new Result(0, 0, 0, 0));
+            eligible.withSubFilter(new QQueryFilter()
+               .withCriteria("userId", QCriteriaOperator.IN, new ArrayList<>(preferences.keySet()))
+               .withCriteria("emailStatus", QCriteriaOperator.IN, List.of(EmailStatus.NONE.name(), EmailStatus.PENDING.name())));
          }
 
-         List<QRecord> recipients = AlertsDb.query(AlertsNotificationRecipient.TABLE_NAME, new QQueryFilter()
-            .withCriteria("userId", QCriteriaOperator.IN, new ArrayList<>(preferences.keySet()))
-            .withCriteria("emailStatus", QCriteriaOperator.IN, List.of(EmailStatus.NONE.name(), EmailStatus.PENDING.name()))
-            .withCriteria("deliveredAt", QCriteriaOperator.GREATER_THAN_OR_EQUALS, now.minus(1, ChronoUnit.DAYS))
-            .withLimit(SCAN));
-         Map<Integer, QRecord> notifications = notifications(recipients, now);
-         Map<String, QRecord>  settings      = userSettings(preferences.keySet());
-
-         int                         sent    = 0;
-         int                         skipped = 0;
-         int                         failed  = 0;
+         Map<String, QRecord> settings = new HashMap<>();
+         int sent = 0;
+         int skipped = 0;
+         int failed = 0;
          Map<String, List<QRecord[]>> digests = new LinkedHashMap<>();
-         for(QRecord recipient : recipients)
+         int afterId = 0;
+         while(true)
          {
-            QRecord notification = notifications.get(recipient.getValueInteger("notificationId"));
-            String  userId       = recipient.getValueString("userId");
-            QRecord preference   = notification == null ? null : preferences.get(userId).get(notification.getValueString("category"));
-            if(notification == null || preference == null || NotificationCategory.ALERT.name().equals(notification.getValueString("category"))
-               || !atLeast(notification.getValueString("severity"), preference.getValueString("emailMinSeverity")))
+            List<QRecord> recipients = AlertsDb.query(AlertsNotificationRecipient.TABLE_NAME, new QQueryFilter()
+               .withSubFilter(eligible)
+               .withCriteria("id", QCriteriaOperator.GREATER_THAN, afterId)
+               .withOrderBy(new QFilterOrderBy("id", true)).withLimit(SCAN));
+            if(recipients.isEmpty())
             {
-               mark(recipient, EmailStatus.SKIPPED, null);
-               skipped++;
+               break;
             }
-            else if(EmailMode.IMMEDIATE.name().equals(preference.getValueString("emailMode")))
+            afterId = recipients.get(recipients.size() - 1).getValueInteger("id");
+            Map<Integer, QRecord> notifications = notifications(recipients, now);
+            Set<String> pageUsers = recipients.stream().map(recipient -> recipient.getValueString("userId")).collect(Collectors.toSet());
+            settings.putAll(userSettings(pageUsers));
+            Map<String, Map<String, QRecord>> requestedPreferences = new HashMap<>();
+            for(QRecord preference : AlertsDb.query(AlertsNotificationPreference.TABLE_NAME, new QQueryFilter()
+               .withCriteria("userId", QCriteriaOperator.IN, new ArrayList<>(pageUsers))))
             {
-               EmailStatus status = sendImmediate(address(settings.get(userId)), notification);
-               mark(recipient, status, status == EmailStatus.SENT ? now : null);
-               sent += status == EmailStatus.SENT ? 1 : 0;
-               skipped += status == EmailStatus.SKIPPED ? 1 : 0;
-               failed += status == EmailStatus.FAILED ? 1 : 0;
+               requestedPreferences.computeIfAbsent(preference.getValueString("userId"), k -> new HashMap<>()).put(preference.getValueString("category"), preference);
             }
-            else if(recipient.getValue("readAt") == null)
+            for(QRecord recipient : recipients)
             {
-               digests.computeIfAbsent(userId, k -> new ArrayList<>()).add(new QRecord[] {recipient, notification});
+               QRecord notification = notifications.get(recipient.getValueInteger("notificationId"));
+               String  userId       = recipient.getValueString("userId");
+               boolean requested    = EmailStatus.REQUESTED.name().equals(recipient.getValueString("emailStatus"));
+               String  category     = notification == null ? null : notification.getValueString("category");
+               QRecord preference   = category == null ? null : (requested ? requestedPreferences : preferences).getOrDefault(userId, Map.of()).get(category);
+               QRecord setting      = settings.get(userId);
+               if(notification == null || NotificationCategory.ALERT.name().equals(category)
+                  || (requested ? (!StringUtils.hasContent(address(setting)) || (preference != null && StringUtils.hasContent(preference.getValueString("emailMinSeverity"))
+                  && !atLeast(notification.getValueString("severity"), preference.getValueString("emailMinSeverity"))))
+                  : (preference == null || !atLeast(notification.getValueString("severity"), preference.getValueString("emailMinSeverity")))))
+               {
+                  mark(recipient, EmailStatus.SKIPPED, null);
+                  skipped++;
+               }
+               else if(!NotificationCategory.SECURITY.name().equals(category)
+                  && setting != null && setting.getValueInstant("pausedUntil") != null
+                  && setting.getValueInstant("pausedUntil").isAfter(now))
+               {
+                  // Leave the recipient pending so a later run can deliver it.
+                  skipped++;
+               }
+               else if(requested && AlertTiming.isQuiet(setting, AlertSeverity.fromLabel(notification.getValueString("severity"), AlertSeverity.WARNING), now))
+               {
+                  // Quiet hours hold a requested email; it stays REQUESTED until the window ends or it ages out.
+                  skipped++;
+               }
+               else if(requested || EmailMode.IMMEDIATE.name().equals(preference.getValueString("emailMode")))
+               {
+                  EmailStatus status = sendImmediate(address(settings.get(userId)), notification);
+                  mark(recipient, status, status == EmailStatus.SENT ? now : null);
+                  sent += status == EmailStatus.SENT ? 1 : 0;
+                  skipped += status == EmailStatus.SKIPPED ? 1 : 0;
+                  failed += status == EmailStatus.FAILED ? 1 : 0;
+               }
+               else if(recipient.getValue("readAt") == null)
+               {
+                  digests.computeIfAbsent(userId, k -> new ArrayList<>()).add(new QRecord[] {recipient, notification});
+               }
             }
          }
 

src/main/java/com/kingsrook/qbits/alerts/notifications/NotificationService.java

@@ -173,7 +173,7 @@ public class NotificationService
 
          AlertsAudienceResolver.Resolved resolved = resolver.resolve(audienceOf(notification));
          Set<String>                     existing = recipientUserIds(notificationId);
-         Set<String>                     muted    = mutedUsers(notification.getValueString("category"));
+         Set<String>                     muted    = mutedUsers(notification.getValueString("category"), notification.getValueString("severity"));
 
          List<QRecord> inserts = new ArrayList<>();
          for(String userId : resolved.userIds())
@@ -602,16 +602,20 @@ public class NotificationService
    /*******************************************************************************
     ** Users who muted a category in-app (never for SECURITY).
     *******************************************************************************/
-   private Set<String> mutedUsers(String category) throws QException
+   private Set<String> mutedUsers(String category, String severity) throws QException
    {
       Set<String> userIds = new HashSet<>();
       if(category == null || NotificationCategory.SECURITY.name().equals(category))
       {
          return (userIds);
       }
-      for(QRecord preference : AlertsDb.query(AlertsNotificationPreference.TABLE_NAME, AlertsDb.eq("category", category).withCriteria("inAppMuted", QCriteriaOperator.EQUALS, true)))
+      for(QRecord preference : AlertsDb.query(AlertsNotificationPreference.TABLE_NAME, AlertsDb.eq("category", category)))
       {
-         userIds.add(preference.getValueString("userId"));
+         String minimum = preference.getValueString("inAppMinSeverity");
+         if(Boolean.TRUE.equals(preference.getValueBoolean("inAppMuted")) || (minimum != null && !NotificationEmailer.atLeast(severity, minimum)))
+         {
+            userIds.add(preference.getValueString("userId"));
+         }
       }
       return (userIds);
    }

src/main/java/com/kingsrook/qbits/alerts/notifications/NotificationSlackSender.java

@@ -19,7 +19,6 @@ package com.kingsrook.qbits.alerts.notifications;
 
 
 import java.time.Instant;
-import java.time.temporal.ChronoUnit;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
@@ -45,8 +44,10 @@ import com.kingsrook.qqq.backend.core.model.actions.messaging.ContentRole;
 import com.kingsrook.qqq.backend.core.model.actions.messaging.Party;
 import com.kingsrook.qqq.backend.core.model.actions.messaging.SendMessageInput;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.modules.messaging.MessagingProviderCapability;
 import com.kingsrook.qqq.backend.core.utils.StringUtils;
 import static com.kingsrook.qqq.backend.core.logging.LogUtils.logPair;
 
@@ -114,47 +115,61 @@ public class NotificationSlackSender
             return (new Result(0, 0, 0, 0, 0));
          }
 
-         List<QRecord> recipients = AlertsDb.query(AlertsNotificationRecipient.TABLE_NAME, new QQueryFilter()
-            .withCriteria("userId", QCriteriaOperator.IN, new ArrayList<>(preferences.keySet()))
-            .withCriteria("slackStatus", QCriteriaOperator.IN, List.of(SlackStatus.NONE.name(), SlackStatus.PENDING.name()))
-            .withCriteria("deliveredAt", QCriteriaOperator.GREATER_THAN_OR_EQUALS, now.minus(1, ChronoUnit.DAYS))
-            .withLimit(NotificationEmailer.SCAN));
-         Map<Integer, QRecord> notifications = NotificationEmailer.notifications(recipients, now);
-         Map<String, QRecord>  settings      = NotificationEmailer.userSettings(preferences.keySet());
-         boolean               available     = isAvailable();
+         Map<String, QRecord> settings = NotificationEmailer.userSettings(preferences.keySet());
+         boolean available = isAvailable();
 
          int                          sent    = 0;
          int                          held    = 0;
          int                          skipped = 0;
          int                          failed  = 0;
          Map<String, List<QRecord[]>> digests = new LinkedHashMap<>();
-         for(QRecord recipient : recipients)
+         int afterId = 0;
+         while(true)
          {
-            QRecord notification = notifications.get(recipient.getValueInteger("notificationId"));
-            String  userId       = recipient.getValueString("userId");
-            QRecord preference   = notification == null ? null : preferences.get(userId).get(notification.getValueString("category"));
-            if(notification == null || preference == null || NotificationCategory.ALERT.name().equals(notification.getValueString("category"))
-               || !NotificationEmailer.atLeast(notification.getValueString("severity"), preference.getValueString("slackMinSeverity")) || !available)
+            List<QRecord> recipients = AlertsDb.query(AlertsNotificationRecipient.TABLE_NAME, new QQueryFilter()
+               .withCriteria("userId", QCriteriaOperator.IN, new ArrayList<>(preferences.keySet()))
+               .withCriteria("slackStatus", QCriteriaOperator.IN, List.of(SlackStatus.NONE.name(), SlackStatus.PENDING.name()))
+               .withCriteria("id", QCriteriaOperator.GREATER_THAN, afterId)
+               .withOrderBy(new QFilterOrderBy("id", true))
+               .withLimit(NotificationEmailer.SCAN));
+            if(recipients.isEmpty())
             {
-               mark(recipient, SlackStatus.SKIPPED);
-               skipped++;
+               break;
             }
-            else if(EmailMode.IMMEDIATE.name().equals(preference.getValueString("slackMode")))
+            afterId = recipients.get(recipients.size() - 1).getValueInteger("id");
+            Map<Integer, QRecord> notifications = NotificationEmailer.notifications(recipients, now);
+            for(QRecord recipient : recipients)
             {
-               if(isHeld(settings.get(userId), notification, now))
+               QRecord notification = notifications.get(recipient.getValueInteger("notificationId"));
+               String  userId       = recipient.getValueString("userId");
+               QRecord preference   = notification == null ? null : preferences.get(userId).get(notification.getValueString("category"));
+               if(notification == null || preference == null || NotificationCategory.ALERT.name().equals(notification.getValueString("category"))
+                  || !NotificationEmailer.atLeast(notification.getValueString("severity"), preference.getValueString("slackMinSeverity")) || !available)
+               {
+                  mark(recipient, SlackStatus.SKIPPED);
+                  skipped++;
+               }
+               else if(!NotificationCategory.SECURITY.name().equals(notification.getValueString("category")) && AlertRouter.isPaused(settings.get(userId), now))
                {
                   held++;
-                  continue;
                }
-               SlackStatus status = sendExternal(userId, notification.getValueString("title"), List.of(notification), notification.getValueInteger("id"));
-               mark(recipient, status);
-               sent += status == SlackStatus.SENT ? 1 : 0;
-               skipped += status == SlackStatus.SKIPPED ? 1 : 0;
-               failed += status == SlackStatus.FAILED ? 1 : 0;
-            }
-            else if(recipient.getValue("readAt") == null)
-            {
-               digests.computeIfAbsent(userId, k -> new ArrayList<>()).add(new QRecord[] {recipient, notification});
+               else if(EmailMode.IMMEDIATE.name().equals(preference.getValueString("slackMode")))
+               {
+                  if(isHeld(settings.get(userId), notification, now))
+                  {
+                     held++;
+                     continue;
+                  }
+                  SlackStatus status = sendExternal(userId, notification.getValueString("title"), List.of(notification), notification.getValueInteger("id"));
+                  mark(recipient, status);
+                  sent += status == SlackStatus.SENT ? 1 : 0;
+                  skipped += status == SlackStatus.SKIPPED ? 1 : 0;
+                  failed += status == SlackStatus.FAILED ? 1 : 0;
+               }
+               else if(recipient.getValue("readAt") == null)
+               {
+                  digests.computeIfAbsent(userId, k -> new ArrayList<>()).add(new QRecord[] {recipient, notification});
+               }
             }
          }
 
@@ -200,11 +215,12 @@ public class NotificationSlackSender
 
    /*******************************************************************************
     ** Whether a push is held for now: the user paused notifications, or it is
-    ** their quiet hours (CRITICAL bypasses). The bell is never held.
+    ** their quiet hours (CRITICAL bypasses). SECURITY bypasses the pause.
+    ** The bell is never held.
     *******************************************************************************/
    private static boolean isHeld(QRecord setting, QRecord notification, Instant now)
    {
-      return (AlertRouter.isPaused(setting, now)
+      return ((!NotificationCategory.SECURITY.name().equals(notification.getValueString("category")) && AlertRouter.isPaused(setting, now))
          || AlertTiming.isQuiet(setting, AlertSeverity.fromLabel(notification.getValueString("severity"), AlertSeverity.WARNING), now));
    }
 
@@ -217,9 +233,8 @@ public class NotificationSlackSender
     ** when the provider says the user can't be reached (no Slack connection),
     ** with no retry; FAILED for anything else.
     **
-    ** STAND-IN(core=QRun-IO/qqq#1194, removeBy=4.1.0-RC.8): RC.6 SendMessageInput has no
-    ** idempotency key (notify:<notificationId>:<userId>:slack), so the
-    ** recipient row's slackStatus is what prevents a resend.
+    ** Pass the notification idempotency key when the provider supports it.
+    ** The recipient row's slackStatus also prevents a resend.
     *******************************************************************************/
    private SlackStatus sendExternal(String userId, String subject, List<QRecord> items, Integer notificationId)
    {
@@ -243,6 +258,7 @@ public class NotificationSlackSender
       {
          new SendMessageAction().execute(new SendMessageInput()
             .withMessagingProviderName(runtime.getConfig().getSlackProviderName())
+            .withIdempotencyKey(SendMessageAction.capabilities(runtime.getConfig().getSlackProviderName()).contains(MessagingProviderCapability.IDEMPOTENCY) ? key : null)
             .withTo(new Party().withAddress("user:" + userId))
             .withSubject(subject)
             .withContentList(List.of(new Content().withContentRole(ContentRole.Default.DEFAULT).withBody(text.toString().stripTrailing()))));

src/main/java/com/kingsrook/qbits/alerts/preferences/AlertsNotificationPreferencesProvider.java

@@ -0,0 +1,349 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts.preferences;
+
+
+import java.io.Serializable;
+import java.time.DateTimeException;
+import java.time.ZoneId;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+import com.kingsrook.qbits.alerts.AlertsQBitConfig;
+import com.kingsrook.qbits.alerts.AlertsRuntime;
+import com.kingsrook.qbits.alerts.engine.AlertsDb;
+import com.kingsrook.qbits.alerts.model.AlertsNotificationPreference;
+import com.kingsrook.qbits.alerts.model.AlertsSubscription;
+import com.kingsrook.qbits.alerts.model.AlertsUserPreference;
+import com.kingsrook.qqq.backend.core.actions.permissions.CorePermissionEnforcer;
+import com.kingsrook.qqq.backend.core.alerts.NotificationCategory;
+import com.kingsrook.qqq.backend.core.alerts.NotificationSeverity;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType;
+import com.kingsrook.qqq.backend.core.model.metadata.help.QHelpContent;
+import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValue;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSource;
+import com.kingsrook.qqq.backend.core.model.metadata.possiblevalues.QPossibleValueSourceType;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceChange;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceListMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceProviderInterface;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceRequestContext;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceRow;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceRowChange;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceSectionMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceValues;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferencesMetaData;
+
+
+/*******************************************************************************
+ ** The session user's notification settings, stored in the existing Alerts tables.
+ *******************************************************************************/
+public class AlertsNotificationPreferencesProvider implements UserPreferenceProviderInterface
+{
+   public static final String SECTION_NAME = "notifications";
+   private static final String SECURITY_REASON = "Security notices can't be muted.";
+   private static final Map<String, String> SCALARS = Map.of("pausedUntil", "pausedUntil", "digestHour", "digestHour", "timeZone", "timeZone",
+      "alertInAppEnabled", "inAppEnabled", "alertEmailEnabled", "emailEnabled");
+
+
+
+   /*******************************************************************************
+    ** Register once; no app scope, so bell users need only alerts.view.
+    *******************************************************************************/
+   public static void register(QInstance instance, AlertsQBitConfig config)
+   {
+      if(isRegistered(instance))
+      {
+         return;
+      }
+      List<QPossibleValue<?>> hours = new ArrayList<>();
+      for(int hour = 0; hour < 24; hour++)
+      {
+         hours.add(new QPossibleValue<>(hour, (hour % 12 == 0 ? 12 : hour % 12) + ":00 " + (hour < 12 ? "AM" : "PM")));
+      }
+      instance.addPossibleValueSource(new QPossibleValueSource().withName("alerts_digest_hour").withType(QPossibleValueSourceType.ENUM).withEnumValues(hours));
+      UserPreferenceListMetaData categories = new UserPreferenceListMetaData().withName("categories").withLabel("Categories").withRowLabel("Category")
+         .withField(new QFieldMetaData("inApp", QFieldType.BOOLEAN).withLabel("In-app"))
+         .withField(enumField("inAppMinSeverity", "In-app from", "alerts_notification_severity"))
+         .withField(enumField("emailMode", "Email", "alerts_email_mode"))
+         .withField(enumField("emailMinSeverity", "Email from", "alerts_notification_severity"));
+      if(slackConfigured(instance, config))
+      {
+         categories.withField(enumField("slack", "Slack", "alerts_email_mode"))
+            .withField(enumField("slackMinSeverity", "Slack from", "alerts_notification_severity"));
+      }
+      UserPreferencesMetaData.ofOrWithNew(instance).withSection(new UserPreferenceSectionMetaData()
+         .withName(SECTION_NAME).withLabel("Notifications").withIcon(new QIcon("notifications")).withOrder(20)
+         .withDescription("What reaches you in the app, by email and on Slack.").withPermissionName(AlertsQBitConfig.PERMISSION_VIEW)
+         .withProvider(new QCodeReference(AlertsNotificationPreferencesProvider.class))
+         .withField(new QFieldMetaData("pausedUntil", QFieldType.DATE_TIME).withLabel("Pause notifications until")
+            .withHelpContent(new QHelpContent("Security notices still arrive.")))
+         .withField(new QFieldMetaData("digestHour", QFieldType.INTEGER).withLabel("Daily digest time").withPossibleValueSourceName("alerts_digest_hour"))
+         .withField(new QFieldMetaData("timeZone", QFieldType.STRING).withLabel("Time zone").withMaxLength(64))
+         .withField(new QFieldMetaData("alertInAppEnabled", QFieldType.BOOLEAN).withLabel("Show alerts in the app"))
+         .withField(new QFieldMetaData("alertEmailEnabled", QFieldType.BOOLEAN).withLabel("Email me alerts"))
+         .withList(categories)
+         .withList(new UserPreferenceListMetaData().withName("subscriptions").withLabel("Subscriptions").withRowLabel("Alert rule")
+            .withField(new QFieldMetaData("enabled", QFieldType.BOOLEAN).withLabel("Enabled"))
+            .withField(enumField("minSeverity", "From severity", "alerts_severity"))
+            .withField(enumField("deliveryMode", "Delivery mode", "alerts_delivery_mode"))));
+   }
+
+
+
+   /*******************************************************************************
+    ** Only expose Slack controls when the configured messaging provider exists.
+    *******************************************************************************/
+   private static boolean slackConfigured(QInstance instance, AlertsQBitConfig config)
+   {
+      String name = config.getSlackProviderName();
+      return (name != null && !name.isBlank() && instance.getMessagingProvider(name) != null);
+   }
+
+
+
+   /*******************************************************************************
+    ** Whether the section is actually installed in this instance.
+    *******************************************************************************/
+   public static boolean isRegistered(QInstance instance)
+   {
+      UserPreferencesMetaData metadata = UserPreferencesMetaData.of(instance);
+      return (metadata != null && metadata.getSections().stream().anyMatch(section -> SECTION_NAME.equals(section.getName())));
+   }
+
+
+
+   /*******************************************************************************
+    ** String enums use ordinary fields with an ENUM possible-value source.
+    *******************************************************************************/
+   private static QFieldMetaData enumField(String name, String label, String source)
+   {
+      return (new QFieldMetaData(name, QFieldType.STRING).withLabel(label).withPossibleValueSourceName(source));
+   }
+
+
+
+   /*******************************************************************************
+    ** Load defaults and fixed category rows, plus only this user's subscriptions.
+    *******************************************************************************/
+   @Override
+   public UserPreferenceValues load(UserPreferenceRequestContext context) throws QException
+   {
+      QRecord settings = userSettings(context);
+      UserPreferenceValues result = new UserPreferenceValues();
+      SCALARS.forEach((name, column) -> result.getValues().put(name, settings.getValue(column)));
+      Map<String, QRecord> preferences = new LinkedHashMap<>();
+      for(QRecord preference : AlertsDb.query(AlertsNotificationPreference.TABLE_NAME, AlertsDb.eq("userId", context.getUserId())))
+      {
+         preferences.put(preference.getValueString("category"), preference);
+      }
+      List<UserPreferenceRow> categories = new ArrayList<>();
+      for(NotificationCategory category : NotificationCategory.values())
+      {
+         QRecord preference = preferences.get(category.name());
+         Map<String, Serializable> values = new LinkedHashMap<>();
+         values.put("inApp", preference == null || !Boolean.TRUE.equals(preference.getValueBoolean("inAppMuted")));
+         for(String field : List.of("inAppMinSeverity", "emailMode", "emailMinSeverity"))
+         {
+            values.put(field, preference == null ? QContext.getQInstance().getTable(AlertsNotificationPreference.TABLE_NAME).getField(field).getDefaultValue() : preference.getValue(field));
+         }
+
+         ///////////////////////////////////////////////////////////////////////
+         // no in-app threshold means everything; show it as the lowest level //
+         ///////////////////////////////////////////////////////////////////////
+         if(values.get("inAppMinSeverity") == null)
+         {
+            values.put("inAppMinSeverity", NotificationSeverity.INFO.name());
+         }
+         if(slackConfigured(QContext.getQInstance(), AlertsRuntime.get(QContext.getQInstance()).getConfig()))
+         {
+            for(String field : List.of("slackMode", "slackMinSeverity"))
+            {
+               values.put("slackMode".equals(field) ? "slack" : field, preference == null
+                  ? QContext.getQInstance().getTable(AlertsNotificationPreference.TABLE_NAME).getField(field).getDefaultValue() : preference.getValue(field));
+            }
+         }
+         String label = QContext.getQInstance().getPossibleValueSource("alerts_notification_category").getEnumValues().stream()
+            .filter(value -> category.name().equals(value.getId())).findFirst().orElseThrow().getLabel();
+         UserPreferenceRow row = new UserPreferenceRow().withKey(category.name()).withLabel(label).withValues(values);
+         if(category == NotificationCategory.SECURITY)
+         {
+            values.put("inApp", true);
+            values.put("inAppMinSeverity", NotificationSeverity.INFO.name());
+            row.withReadOnlyFieldNames(List.of("inApp", "inAppMinSeverity")).withReadOnlyReason(SECURITY_REASON);
+         }
+         categories.add(row);
+      }
+      result.getLists().put("categories", categories);
+      List<UserPreferenceRow> subscriptions = new ArrayList<>();
+      for(QRecord subscription : ownSubscriptions(context))
+      {
+         Map<String, Serializable> values = new LinkedHashMap<>();
+         for(String field : List.of("enabled", "minSeverity", "deliveryMode"))
+         {
+            values.put(field, subscription.getValue(field));
+         }
+         subscriptions.add(new UserPreferenceRow().withKey(subscription.getValueString("id")).withLabel(scopeLabel(subscription)).withValues(values));
+      }
+      result.getLists().put("subscriptions", subscriptions);
+      return (result);
+   }
+
+
+
+   /*******************************************************************************
+    ** Validate domain rules; core invokes this outside its trusted store scope.
+    *******************************************************************************/
+   @Override
+   public List<String> validate(UserPreferenceRequestContext context, UserPreferenceChange change) throws QException
+   {
+      List<String> errors = new ArrayList<>();
+      Serializable zone = change.getValues().get("timeZone");
+      if(zone != null)
+      {
+         try
+         {
+            ZoneId.of(zone.toString());
+         }
+         catch(DateTimeException e)
+         {
+            errors.add("Time zone: must be a valid time zone, such as America/Chicago.");
+         }
+      }
+      for(UserPreferenceRowChange row : change.getLists().getOrDefault("categories", List.of()))
+      {
+         if("SECURITY".equals(row.getKey()) && (row.getValues().containsKey("inApp") || row.getValues().containsKey("inAppMinSeverity")))
+         {
+            errors.add(SECURITY_REASON);
+         }
+      }
+      if(!change.getLists().getOrDefault("subscriptions", List.of()).isEmpty())
+      {
+         Set<String> ownIds = CorePermissionEnforcer.runTrusted("validate session user's alert subscriptions", () -> ownSubscriptions(context).stream()
+            .map(row -> row.getValueString("id")).collect(Collectors.toSet()));
+         for(UserPreferenceRowChange row : change.getLists().get("subscriptions"))
+         {
+            if(!ownIds.contains(row.getKey()))
+            {
+               errors.add("Alert rule: isn't one of your subscriptions.");
+            }
+         }
+      }
+      return (errors);
+   }
+
+
+
+   /*******************************************************************************
+    ** Partial updates through normal actions preserve auditing and customizers.
+    *******************************************************************************/
+   @Override
+   public void store(UserPreferenceRequestContext context, UserPreferenceChange change) throws QException
+   {
+      List<String> errors = validate(context, change);
+      if(!errors.isEmpty())
+      {
+         throw (new QBadRequestException(String.join("; ", errors)));
+      }
+      if(!change.getValues().isEmpty())
+      {
+         QRecord update = new QRecord().withValue("id", userSettings(context).getValue("id"));
+         change.getValues().forEach((field, value) -> update.setValue(SCALARS.get(field), value));
+         AlertsDb.update(AlertsUserPreference.TABLE_NAME, update);
+      }
+      for(UserPreferenceRowChange row : change.getLists().getOrDefault("categories", List.of()))
+      {
+         QRecord existing = AlertsDb.first(AlertsNotificationPreference.TABLE_NAME, AlertsDb.eq("userId", context.getUserId())
+            .withCriteria("category", QCriteriaOperator.EQUALS, row.getKey()));
+         QRecord update = new QRecord();
+         row.getValues().forEach((field, value) -> update.setValue("inApp".equals(field) ? "inAppMuted" : "slack".equals(field) ? "slackMode" : field,
+            "inApp".equals(field) ? Boolean.FALSE.equals(value) : value));
+         if(existing == null)
+         {
+            AlertsDb.insert(AlertsNotificationPreference.TABLE_NAME, update.withValue("userId", context.getUserId()).withValue("category", row.getKey()));
+         }
+         else
+         {
+            AlertsDb.update(AlertsNotificationPreference.TABLE_NAME, update.withValue("id", existing.getValue("id")));
+         }
+      }
+      for(UserPreferenceRowChange row : change.getLists().getOrDefault("subscriptions", List.of()))
+      {
+         QRecord update = new QRecord().withValue("id", Integer.valueOf(row.getKey()));
+         row.getValues().forEach(update::setValue);
+         AlertsDb.update(AlertsSubscription.TABLE_NAME, update);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Create the same defaults as AlertsPreferences.ensure, retaining the user.
+    *******************************************************************************/
+   private QRecord userSettings(UserPreferenceRequestContext context) throws QException
+   {
+      QRecord settings = AlertsDb.first(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", context.getUserId()));
+      if(settings == null)
+      {
+         String label = context.getSession().getUser().getFullName();
+         settings = AlertsDb.insert(AlertsUserPreference.TABLE_NAME, new QRecord().withValue("userId", context.getUserId())
+            .withValue("userLabel", label == null ? context.getUserId() : label).withValue("inAppEnabled", true).withValue("emailEnabled", true)
+            .withValue("quietBypassSeverity", "CRITICAL").withValue("digestHour", 8));
+      }
+      return (settings);
+   }
+
+
+
+   /*******************************************************************************
+    ** Never expose team or channel rules, even to an administrator.
+    *******************************************************************************/
+   private List<QRecord> ownSubscriptions(UserPreferenceRequestContext context) throws QException
+   {
+      return (AlertsDb.query(AlertsSubscription.TABLE_NAME, AlertsDb.eq("userId", context.getUserId()).withCriteria("subscriberType", QCriteriaOperator.EQUALS, "USER")));
+   }
+
+
+
+   /*******************************************************************************
+    ** Readable scope without relying on access to the subscription's target table.
+    *******************************************************************************/
+   private String scopeLabel(QRecord subscription)
+   {
+      String value = subscription.getValueString("scopeValue");
+      return (switch(subscription.getValueString("scopeType"))
+      {
+         case "ALL" -> "All alerts";
+         case "TYPE" -> "Type: " + value;
+         case "GROUP" -> "Group: " + value;
+         case "RECORD" -> "Record: " + value + " #" + subscription.getValueString("scopeRecordId");
+         case "MONITOR" -> "Monitor: " + value;
+         default -> "Table: " + value;
+      });
+   }
+}

src/main/resources/db/liquibase/qbit-alerts/alerts-defaults.changelog.sql

@@ -0,0 +1,59 @@
+-- liquibase formatted sql
+
+-- qbit-alerts starter defaults: the two channels every install needs, and the
+-- two groups the qbit itself files alerts under, so Delivery health and the
+-- group lists are not empty before the first alert.
+-- Include it from the host's master changelog AFTER alerts.changelog.sql:
+--
+--   - include: { file: db/liquibase/qbit-alerts/alerts-defaults.changelog.sql }
+--
+-- Rollback is empty on purpose: a name-based delete would also remove rows the host already had.
+-- Rules for this file:
+--   * insert-only: every row is inserted only when its natural key (the name) is
+--     absent, so an administrator's edits always survive and nothing is updated;
+--   * no secrets: the channels hold settings only, never a secret;
+--   * portable SQL (PostgreSQL and H2): INSERT ... SELECT ... WHERE NOT EXISTS;
+--   * every changeset has a precondition on its table, so a host that has not
+--     created a table yet simply skips it (MARK_RAN).
+-- The runtime creates the same rows when they are missing (AlertChannels.defaultChannel,
+-- AlertTypeSync.ensureGroup); this file only makes them exist from the first deploy.
+-- Alert types, monitors, escalation policies, teams and subscriptions are NOT seeded
+-- here: types and default monitors are declared by the installed qbits and synced at
+-- startup of the Alerts home, and the rest is the host's own people and policy.
+-- AlertsDefaultsChangelogTest runs this file twice against a fresh schema.
+
+-- changeset qbit-alerts:defaults-1
+-- preconditions onFail:MARK_RAN onError:MARK_RAN
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM alerts_channel WHERE name = 'in-app'
+-- comment: The in-app channel (the bell): every user has it, full detail, no rate limit.
+INSERT INTO alerts_channel (name, label, channel_type, enabled, detail_level, min_severity, rate_limit_per_hour, health_status, consecutive_failures, create_date, modify_date)
+SELECT 'in-app', 'In-App (Bell)', 'IN_APP', TRUE, 'FULL', 'INFO', 0, 'HEALTHY', 0, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+WHERE NOT EXISTS (SELECT 1 FROM alerts_channel WHERE name = 'in-app');
+-- rollback empty
+
+-- changeset qbit-alerts:defaults-2
+-- preconditions onFail:MARK_RAN onError:MARK_RAN
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM alerts_channel WHERE name = 'email'
+-- comment: The personal email channel: a user's own address (My Alert Settings), minimal detail, 60 an hour.
+INSERT INTO alerts_channel (name, label, channel_type, enabled, detail_level, min_severity, rate_limit_per_hour, health_status, consecutive_failures, create_date, modify_date)
+SELECT 'email', 'Email (Personal Address)', 'EMAIL', TRUE, 'MINIMAL', 'INFO', 60, 'HEALTHY', 0, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+WHERE NOT EXISTS (SELECT 1 FROM alerts_channel WHERE name = 'email');
+-- rollback empty
+
+-- changeset qbit-alerts:defaults-3
+-- preconditions onFail:MARK_RAN onError:MARK_RAN
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM alerts_group WHERE name = 'alerts'
+-- comment: The group the qbit files its own alerts under (a monitor that cannot run, a failing channel, dropped signals).
+INSERT INTO alerts_group (name, label, create_date, modify_date)
+SELECT 'alerts', 'Alerts', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+WHERE NOT EXISTS (SELECT 1 FROM alerts_group WHERE name = 'alerts');
+-- rollback empty
+
+-- changeset qbit-alerts:defaults-4
+-- preconditions onFail:MARK_RAN onError:MARK_RAN
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM alerts_group WHERE name = 'other'
+-- comment: The catch-all group for alert types that name no group (and the unregistered type).
+INSERT INTO alerts_group (name, label, create_date, modify_date)
+SELECT 'other', 'Other', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
+WHERE NOT EXISTS (SELECT 1 FROM alerts_group WHERE name = 'other');
+-- rollback empty

src/main/resources/db/liquibase/qbit-alerts/alerts.changelog.sql

@@ -8,6 +8,10 @@
 -- Rules for this file: the host runs it, the qbit never runs DDL; additive only
 -- (nothing is ever dropped or rewritten, except the one pre-GA rename in changesets 16-17);
 -- every statement is idempotent (IF NOT EXISTS, or a precondition). Column names are the snake_case form of the field names.
+-- Foreign keys (changesets 30-53): one changeset per constraint, named fk_<child_table>_<child_column> and guarded by a
+-- precondition on that name, so a host that already added it (e.g. from its own changelog) marks it ran. Before adding the
+-- constraint each one records orphan rows in qqq_fk_quarantine (the same DDL in every qbit), then nulls a nullable column
+-- or deletes a row whose column is NOT NULL (row_data keeps the full row), so the migration never fails on old data.
 
 -- changeset qbit-alerts:1
 -- comment: A category of alerts for people ("Backups", "CDN"), optionally nested. The Alerts home groups by these, subscriptions target them, and every alert type belongs to one.
@@ -513,3 +517,261 @@ ALTER TABLE alerts_notification_preference ADD COLUMN slack_min_severity VARCHAR
 ALTER TABLE alerts_notification_recipient ADD COLUMN slack_status VARCHAR(16);
 ALTER TABLE alerts_notification_recipient ADD COLUMN slack_message_id VARCHAR(100);
 CREATE INDEX ix_alerts_notification_recipient_slack_status ON alerts_notification_recipient (slack_status);
+
+-- changeset qbit-alerts:29
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.columns WHERE LOWER(table_name) = 'alerts_notification_preference' AND LOWER(column_name) = 'in_app_min_severity'
+-- comment: Optional minimum severity for in-app notifications (security always arrives).
+ALTER TABLE alerts_notification_preference ADD COLUMN in_app_min_severity VARCHAR(16);
+
+-- changeset qbit-alerts:30
+-- comment: Indexes for the join child columns: a per-record monitor finds its open alerts by (monitor_id, status) on every evaluation (MonitorEvaluator), and the record pages list a type's monitors (alert_type_id) and a group's types (group_id).
+CREATE INDEX IF NOT EXISTS ix_alerts_alert_monitor_id_status ON alerts_alert (monitor_id, status);
+CREATE INDEX IF NOT EXISTS ix_alerts_monitor_alert_type_id ON alerts_monitor (alert_type_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_type_group_id ON alerts_type (group_id);
+
+-- changeset qbit-alerts:31
+-- comment: Indexes for the foreign-key columns no earlier index leads with, so FK checks and ON DELETE actions do not scan the child table.
+CREATE INDEX IF NOT EXISTS ix_alerts_alert_group_id ON alerts_alert (group_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_alert_assigned_team_id ON alerts_alert (assigned_team_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_type_escalation_policy_id ON alerts_type (escalation_policy_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_group_parent_group_id ON alerts_group (parent_group_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_group_owner_team_id ON alerts_group (owner_team_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_group_escalation_policy_id ON alerts_group (escalation_policy_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_delivery_alert_event_id ON alerts_delivery (alert_event_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_delivery_subscription_id ON alerts_delivery (subscription_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_subscription_team_id ON alerts_subscription (team_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_subscription_channel_id ON alerts_subscription (channel_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_escalation_step_team_id ON alerts_escalation_step (team_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_escalation_step_channel_id ON alerts_escalation_step (channel_id);
+-- rollback DROP INDEX IF EXISTS ix_alerts_alert_group_id; DROP INDEX IF EXISTS ix_alerts_alert_assigned_team_id; DROP INDEX IF EXISTS ix_alerts_type_escalation_policy_id; DROP INDEX IF EXISTS ix_alerts_group_parent_group_id; DROP INDEX IF EXISTS ix_alerts_group_owner_team_id; DROP INDEX IF EXISTS ix_alerts_group_escalation_policy_id; DROP INDEX IF EXISTS ix_alerts_delivery_alert_event_id; DROP INDEX IF EXISTS ix_alerts_delivery_subscription_id; DROP INDEX IF EXISTS ix_alerts_subscription_team_id; DROP INDEX IF EXISTS ix_alerts_subscription_channel_id; DROP INDEX IF EXISTS ix_alerts_escalation_step_team_id; DROP INDEX IF EXISTS ix_alerts_escalation_step_channel_id;
+
+-- changeset qbit-alerts:32 dbms:postgresql
+-- comment: alerts_type.group_id -> alerts_group ON DELETE SET NULL. A deleted group leaves its types ungrouped; AlertTypeSync puts them back in their declared (or the default) group at the next boot. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_type_group_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_type', 'group_id', CAST(c.id AS VARCHAR(100)), CAST(c.group_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:32' FROM alerts_type c WHERE c.group_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_group p WHERE p.id = c.group_id);
+UPDATE alerts_type c SET group_id = NULL WHERE c.group_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_group p WHERE p.id = c.group_id);
+ALTER TABLE alerts_type ADD CONSTRAINT fk_alerts_type_group_id FOREIGN KEY (group_id) REFERENCES alerts_group (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_type DROP CONSTRAINT IF EXISTS fk_alerts_type_group_id;
+
+-- changeset qbit-alerts:33 dbms:postgresql
+-- comment: alerts_type.escalation_policy_id -> alerts_escalation_policy ON DELETE SET NULL. A deleted escalation policy leaves the type on its group's policy (or none). Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_type_escalation_policy_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_type', 'escalation_policy_id', CAST(c.id AS VARCHAR(100)), CAST(c.escalation_policy_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:33' FROM alerts_type c WHERE c.escalation_policy_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_escalation_policy p WHERE p.id = c.escalation_policy_id);
+UPDATE alerts_type c SET escalation_policy_id = NULL WHERE c.escalation_policy_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_escalation_policy p WHERE p.id = c.escalation_policy_id);
+ALTER TABLE alerts_type ADD CONSTRAINT fk_alerts_type_escalation_policy_id FOREIGN KEY (escalation_policy_id) REFERENCES alerts_escalation_policy (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_type DROP CONSTRAINT IF EXISTS fk_alerts_type_escalation_policy_id;
+
+-- changeset qbit-alerts:34 dbms:postgresql
+-- comment: alerts_group.parent_group_id -> alerts_group ON DELETE SET NULL. A deleted parent group makes its child groups top-level. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_group_parent_group_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_group', 'parent_group_id', CAST(c.id AS VARCHAR(100)), CAST(c.parent_group_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:34' FROM alerts_group c WHERE c.parent_group_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_group p WHERE p.id = c.parent_group_id);
+UPDATE alerts_group c SET parent_group_id = NULL WHERE c.parent_group_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_group p WHERE p.id = c.parent_group_id);
+ALTER TABLE alerts_group ADD CONSTRAINT fk_alerts_group_parent_group_id FOREIGN KEY (parent_group_id) REFERENCES alerts_group (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_group DROP CONSTRAINT IF EXISTS fk_alerts_group_parent_group_id;
+
+-- changeset qbit-alerts:35 dbms:postgresql
+-- comment: alerts_group.owner_team_id -> alerts_team ON DELETE SET NULL. A deleted team leaves the group without an owner. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_group_owner_team_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_group', 'owner_team_id', CAST(c.id AS VARCHAR(100)), CAST(c.owner_team_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:35' FROM alerts_group c WHERE c.owner_team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.owner_team_id);
+UPDATE alerts_group c SET owner_team_id = NULL WHERE c.owner_team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.owner_team_id);
+ALTER TABLE alerts_group ADD CONSTRAINT fk_alerts_group_owner_team_id FOREIGN KEY (owner_team_id) REFERENCES alerts_team (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_group DROP CONSTRAINT IF EXISTS fk_alerts_group_owner_team_id;
+
+-- changeset qbit-alerts:36 dbms:postgresql
+-- comment: alerts_group.escalation_policy_id -> alerts_escalation_policy ON DELETE SET NULL. A deleted escalation policy leaves the group without one. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_group_escalation_policy_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_group', 'escalation_policy_id', CAST(c.id AS VARCHAR(100)), CAST(c.escalation_policy_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:36' FROM alerts_group c WHERE c.escalation_policy_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_escalation_policy p WHERE p.id = c.escalation_policy_id);
+UPDATE alerts_group c SET escalation_policy_id = NULL WHERE c.escalation_policy_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_escalation_policy p WHERE p.id = c.escalation_policy_id);
+ALTER TABLE alerts_group ADD CONSTRAINT fk_alerts_group_escalation_policy_id FOREIGN KEY (escalation_policy_id) REFERENCES alerts_escalation_policy (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_group DROP CONSTRAINT IF EXISTS fk_alerts_group_escalation_policy_id;
+
+-- changeset qbit-alerts:37 dbms:postgresql
+-- comment: alerts_monitor.alert_type_id -> alerts_type ON DELETE RESTRICT. A monitor needs its type; types are never deleted (TABLE_DELETE is off, AlertTypeSync only adds and updates). Orphans are recorded in qqq_fk_quarantine and deleted first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_monitor_alert_type_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_monitor', 'alert_type_id', CAST(c.id AS VARCHAR(100)), CAST(c.alert_type_id AS VARCHAR(100)), 'DELETED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:37' FROM alerts_monitor c WHERE c.alert_type_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_type p WHERE p.id = c.alert_type_id);
+DELETE FROM alerts_monitor c WHERE c.alert_type_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_type p WHERE p.id = c.alert_type_id);
+ALTER TABLE alerts_monitor ADD CONSTRAINT fk_alerts_monitor_alert_type_id FOREIGN KEY (alert_type_id) REFERENCES alerts_type (id) ON DELETE RESTRICT;
+-- rollback ALTER TABLE alerts_monitor DROP CONSTRAINT IF EXISTS fk_alerts_monitor_alert_type_id;
+
+-- changeset qbit-alerts:38 dbms:postgresql
+-- comment: alerts_alert.alert_type_id -> alerts_type ON DELETE RESTRICT. An alert keeps its type; types are never deleted. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_alert_alert_type_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_alert', 'alert_type_id', CAST(c.id AS VARCHAR(100)), CAST(c.alert_type_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:38' FROM alerts_alert c WHERE c.alert_type_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_type p WHERE p.id = c.alert_type_id);
+UPDATE alerts_alert c SET alert_type_id = NULL WHERE c.alert_type_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_type p WHERE p.id = c.alert_type_id);
+ALTER TABLE alerts_alert ADD CONSTRAINT fk_alerts_alert_alert_type_id FOREIGN KEY (alert_type_id) REFERENCES alerts_type (id) ON DELETE RESTRICT;
+-- rollback ALTER TABLE alerts_alert DROP CONSTRAINT IF EXISTS fk_alerts_alert_alert_type_id;
+
+-- changeset qbit-alerts:39 dbms:postgresql
+-- comment: alerts_alert.monitor_id -> alerts_monitor ON DELETE SET NULL. A deleted monitor leaves its alerts (history) in place, without the monitor. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_alert_monitor_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_alert', 'monitor_id', CAST(c.id AS VARCHAR(100)), CAST(c.monitor_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:39' FROM alerts_alert c WHERE c.monitor_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_monitor p WHERE p.id = c.monitor_id);
+UPDATE alerts_alert c SET monitor_id = NULL WHERE c.monitor_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_monitor p WHERE p.id = c.monitor_id);
+ALTER TABLE alerts_alert ADD CONSTRAINT fk_alerts_alert_monitor_id FOREIGN KEY (monitor_id) REFERENCES alerts_monitor (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_alert DROP CONSTRAINT IF EXISTS fk_alerts_alert_monitor_id;
+
+-- changeset qbit-alerts:40 dbms:postgresql
+-- comment: alerts_alert.group_id -> alerts_group ON DELETE SET NULL. A deleted group leaves its alerts in place, ungrouped. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_alert_group_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_alert', 'group_id', CAST(c.id AS VARCHAR(100)), CAST(c.group_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:40' FROM alerts_alert c WHERE c.group_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_group p WHERE p.id = c.group_id);
+UPDATE alerts_alert c SET group_id = NULL WHERE c.group_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_group p WHERE p.id = c.group_id);
+ALTER TABLE alerts_alert ADD CONSTRAINT fk_alerts_alert_group_id FOREIGN KEY (group_id) REFERENCES alerts_group (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_alert DROP CONSTRAINT IF EXISTS fk_alerts_alert_group_id;
+
+-- changeset qbit-alerts:41 dbms:postgresql
+-- comment: alerts_alert.assigned_team_id -> alerts_team ON DELETE SET NULL. A deleted team unassigns its alerts. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_alert_assigned_team_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_alert', 'assigned_team_id', CAST(c.id AS VARCHAR(100)), CAST(c.assigned_team_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:41' FROM alerts_alert c WHERE c.assigned_team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.assigned_team_id);
+UPDATE alerts_alert c SET assigned_team_id = NULL WHERE c.assigned_team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.assigned_team_id);
+ALTER TABLE alerts_alert ADD CONSTRAINT fk_alerts_alert_assigned_team_id FOREIGN KEY (assigned_team_id) REFERENCES alerts_team (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_alert DROP CONSTRAINT IF EXISTS fk_alerts_alert_assigned_team_id;
+
+-- changeset qbit-alerts:42 dbms:postgresql
+-- comment: alerts_record_ref.alert_id -> alerts_alert ON DELETE CASCADE. Record references belong to their alert. Orphans are recorded in qqq_fk_quarantine and deleted first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_record_ref_alert_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_record_ref', 'alert_id', CAST(c.id AS VARCHAR(100)), CAST(c.alert_id AS VARCHAR(100)), 'DELETED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:42' FROM alerts_record_ref c WHERE c.alert_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_alert p WHERE p.id = c.alert_id);
+DELETE FROM alerts_record_ref c WHERE c.alert_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_alert p WHERE p.id = c.alert_id);
+ALTER TABLE alerts_record_ref ADD CONSTRAINT fk_alerts_record_ref_alert_id FOREIGN KEY (alert_id) REFERENCES alerts_alert (id) ON DELETE CASCADE;
+-- rollback ALTER TABLE alerts_record_ref DROP CONSTRAINT IF EXISTS fk_alerts_record_ref_alert_id;
+
+-- changeset qbit-alerts:43 dbms:postgresql
+-- comment: alerts_event.alert_id -> alerts_alert ON DELETE CASCADE. The timeline belongs to its alert. Orphans are recorded in qqq_fk_quarantine and deleted first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_event_alert_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_event', 'alert_id', CAST(c.id AS VARCHAR(100)), CAST(c.alert_id AS VARCHAR(100)), 'DELETED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:43' FROM alerts_event c WHERE c.alert_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_alert p WHERE p.id = c.alert_id);
+DELETE FROM alerts_event c WHERE c.alert_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_alert p WHERE p.id = c.alert_id);
+ALTER TABLE alerts_event ADD CONSTRAINT fk_alerts_event_alert_id FOREIGN KEY (alert_id) REFERENCES alerts_alert (id) ON DELETE CASCADE;
+-- rollback ALTER TABLE alerts_event DROP CONSTRAINT IF EXISTS fk_alerts_event_alert_id;
+
+-- changeset qbit-alerts:44 dbms:postgresql
+-- comment: alerts_delivery.alert_id -> alerts_alert ON DELETE CASCADE. Delivery log rows of an alert go with the alert. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_delivery_alert_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_delivery', 'alert_id', CAST(c.id AS VARCHAR(100)), CAST(c.alert_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:44' FROM alerts_delivery c WHERE c.alert_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_alert p WHERE p.id = c.alert_id);
+UPDATE alerts_delivery c SET alert_id = NULL WHERE c.alert_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_alert p WHERE p.id = c.alert_id);
+ALTER TABLE alerts_delivery ADD CONSTRAINT fk_alerts_delivery_alert_id FOREIGN KEY (alert_id) REFERENCES alerts_alert (id) ON DELETE CASCADE;
+-- rollback ALTER TABLE alerts_delivery DROP CONSTRAINT IF EXISTS fk_alerts_delivery_alert_id;
+
+-- changeset qbit-alerts:45 dbms:postgresql
+-- comment: alerts_delivery.alert_event_id -> alerts_event ON DELETE SET NULL. The timeline event that caused a delivery (AlertRouter); the log row outlives it. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_delivery_alert_event_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_delivery', 'alert_event_id', CAST(c.id AS VARCHAR(100)), CAST(c.alert_event_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:45' FROM alerts_delivery c WHERE c.alert_event_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_event p WHERE p.id = c.alert_event_id);
+UPDATE alerts_delivery c SET alert_event_id = NULL WHERE c.alert_event_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_event p WHERE p.id = c.alert_event_id);
+ALTER TABLE alerts_delivery ADD CONSTRAINT fk_alerts_delivery_alert_event_id FOREIGN KEY (alert_event_id) REFERENCES alerts_event (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_delivery DROP CONSTRAINT IF EXISTS fk_alerts_delivery_alert_event_id;
+
+-- changeset qbit-alerts:46 dbms:postgresql
+-- comment: alerts_delivery.subscription_id -> alerts_subscription ON DELETE SET NULL. A deleted subscription keeps its delivery history. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_delivery_subscription_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_delivery', 'subscription_id', CAST(c.id AS VARCHAR(100)), CAST(c.subscription_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:46' FROM alerts_delivery c WHERE c.subscription_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_subscription p WHERE p.id = c.subscription_id);
+UPDATE alerts_delivery c SET subscription_id = NULL WHERE c.subscription_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_subscription p WHERE p.id = c.subscription_id);
+ALTER TABLE alerts_delivery ADD CONSTRAINT fk_alerts_delivery_subscription_id FOREIGN KEY (subscription_id) REFERENCES alerts_subscription (id) ON DELETE SET NULL;
+-- rollback ALTER TABLE alerts_delivery DROP CONSTRAINT IF EXISTS fk_alerts_delivery_subscription_id;
+
+-- changeset qbit-alerts:47 dbms:postgresql
+-- comment: alerts_delivery.channel_id -> alerts_channel ON DELETE RESTRICT. A channel with delivery history is disabled, not deleted. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_delivery_channel_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_delivery', 'channel_id', CAST(c.id AS VARCHAR(100)), CAST(c.channel_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:47' FROM alerts_delivery c WHERE c.channel_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_channel p WHERE p.id = c.channel_id);
+UPDATE alerts_delivery c SET channel_id = NULL WHERE c.channel_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_channel p WHERE p.id = c.channel_id);
+ALTER TABLE alerts_delivery ADD CONSTRAINT fk_alerts_delivery_channel_id FOREIGN KEY (channel_id) REFERENCES alerts_channel (id) ON DELETE RESTRICT;
+-- rollback ALTER TABLE alerts_delivery DROP CONSTRAINT IF EXISTS fk_alerts_delivery_channel_id;
+
+-- changeset qbit-alerts:48 dbms:postgresql
+-- comment: alerts_subscription.team_id -> alerts_team ON DELETE RESTRICT. A team subscription needs its team (AlertsSubscriptionCustomizer); remove the subscriptions before the team. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_subscription_team_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_subscription', 'team_id', CAST(c.id AS VARCHAR(100)), CAST(c.team_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:48' FROM alerts_subscription c WHERE c.team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.team_id);
+UPDATE alerts_subscription c SET team_id = NULL WHERE c.team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.team_id);
+ALTER TABLE alerts_subscription ADD CONSTRAINT fk_alerts_subscription_team_id FOREIGN KEY (team_id) REFERENCES alerts_team (id) ON DELETE RESTRICT;
+-- rollback ALTER TABLE alerts_subscription DROP CONSTRAINT IF EXISTS fk_alerts_subscription_team_id;
+
+-- changeset qbit-alerts:49 dbms:postgresql
+-- comment: alerts_subscription.channel_id -> alerts_channel ON DELETE RESTRICT. A channel subscription needs its channel (AlertsSubscriptionCustomizer); remove the subscriptions before the channel. Orphans are recorded in qqq_fk_quarantine and nulled first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_subscription_channel_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_subscription', 'channel_id', CAST(c.id AS VARCHAR(100)), CAST(c.channel_id AS VARCHAR(100)), 'NULLED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:49' FROM alerts_subscription c WHERE c.channel_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_channel p WHERE p.id = c.channel_id);
+UPDATE alerts_subscription c SET channel_id = NULL WHERE c.channel_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_channel p WHERE p.id = c.channel_id);
+ALTER TABLE alerts_subscription ADD CONSTRAINT fk_alerts_subscription_channel_id FOREIGN KEY (channel_id) REFERENCES alerts_channel (id) ON DELETE RESTRICT;
+-- rollback ALTER TABLE alerts_subscription DROP CONSTRAINT IF EXISTS fk_alerts_subscription_channel_id;
+
+-- changeset qbit-alerts:50 dbms:postgresql
+-- comment: alerts_team_member.team_id -> alerts_team ON DELETE CASCADE. Members belong to their team. Orphans are recorded in qqq_fk_quarantine and deleted first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_team_member_team_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_team_member', 'team_id', CAST(c.id AS VARCHAR(100)), CAST(c.team_id AS VARCHAR(100)), 'DELETED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:50' FROM alerts_team_member c WHERE c.team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.team_id);
+DELETE FROM alerts_team_member c WHERE c.team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.team_id);
+ALTER TABLE alerts_team_member ADD CONSTRAINT fk_alerts_team_member_team_id FOREIGN KEY (team_id) REFERENCES alerts_team (id) ON DELETE CASCADE;
+-- rollback ALTER TABLE alerts_team_member DROP CONSTRAINT IF EXISTS fk_alerts_team_member_team_id;
+
+-- changeset qbit-alerts:51 dbms:postgresql
+-- comment: alerts_notification_recipient.notification_id -> alerts_notification ON DELETE CASCADE. Recipient rows belong to their notification (NotificationService.purge deletes them first; this covers any other delete). Orphans are recorded in qqq_fk_quarantine and deleted first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_notification_recipient_notification_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_notification_recipient', 'notification_id', CAST(c.id AS VARCHAR(100)), CAST(c.notification_id AS VARCHAR(100)), 'DELETED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:51' FROM alerts_notification_recipient c WHERE c.notification_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_notification p WHERE p.id = c.notification_id);
+DELETE FROM alerts_notification_recipient c WHERE c.notification_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_notification p WHERE p.id = c.notification_id);
+ALTER TABLE alerts_notification_recipient ADD CONSTRAINT fk_alerts_notification_recipient_notification_id FOREIGN KEY (notification_id) REFERENCES alerts_notification (id) ON DELETE CASCADE;
+-- rollback ALTER TABLE alerts_notification_recipient DROP CONSTRAINT IF EXISTS fk_alerts_notification_recipient_notification_id;
+
+-- changeset qbit-alerts:52 dbms:postgresql
+-- comment: alerts_escalation_step.policy_id -> alerts_escalation_policy ON DELETE CASCADE. Steps belong to their policy. Orphans are recorded in qqq_fk_quarantine and deleted first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_escalation_step_policy_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_escalation_step', 'policy_id', CAST(c.id AS VARCHAR(100)), CAST(c.policy_id AS VARCHAR(100)), 'DELETED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:52' FROM alerts_escalation_step c WHERE c.policy_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_escalation_policy p WHERE p.id = c.policy_id);
+DELETE FROM alerts_escalation_step c WHERE c.policy_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_escalation_policy p WHERE p.id = c.policy_id);
+ALTER TABLE alerts_escalation_step ADD CONSTRAINT fk_alerts_escalation_step_policy_id FOREIGN KEY (policy_id) REFERENCES alerts_escalation_policy (id) ON DELETE CASCADE;
+-- rollback ALTER TABLE alerts_escalation_step DROP CONSTRAINT IF EXISTS fk_alerts_escalation_step_policy_id;
+
+-- changeset qbit-alerts:53 dbms:postgresql
+-- comment: alerts_escalation_step.team_id -> alerts_team ON DELETE RESTRICT. A team step needs its team (ck_alerts_escalation_step_target forbids a NULL), so an orphan step is removed, not nulled. Orphans are recorded in qqq_fk_quarantine and deleted first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_escalation_step_team_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_escalation_step', 'team_id', CAST(c.id AS VARCHAR(100)), CAST(c.team_id AS VARCHAR(100)), 'DELETED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:53' FROM alerts_escalation_step c WHERE c.team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.team_id);
+DELETE FROM alerts_escalation_step c WHERE c.team_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_team p WHERE p.id = c.team_id);
+ALTER TABLE alerts_escalation_step ADD CONSTRAINT fk_alerts_escalation_step_team_id FOREIGN KEY (team_id) REFERENCES alerts_team (id) ON DELETE RESTRICT;
+-- rollback ALTER TABLE alerts_escalation_step DROP CONSTRAINT IF EXISTS fk_alerts_escalation_step_team_id;
+
+-- changeset qbit-alerts:54 dbms:postgresql
+-- comment: alerts_escalation_step.channel_id -> alerts_channel ON DELETE RESTRICT. A channel step needs its channel (ck_alerts_escalation_step_target forbids a NULL), so an orphan step is removed, not nulled. Orphans are recorded in qqq_fk_quarantine and deleted first.
+-- preconditions onFail:MARK_RAN onError:HALT
+-- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.table_constraints WHERE LOWER(constraint_name) = 'fk_alerts_escalation_step_channel_id'
+CREATE TABLE IF NOT EXISTS qqq_fk_quarantine (id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, table_name VARCHAR(100) NOT NULL, column_name VARCHAR(100) NOT NULL, row_id VARCHAR(100), missing_parent_id VARCHAR(100), action VARCHAR(20) NOT NULL, row_data TEXT, changeset VARCHAR(200), quarantined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP);
+INSERT INTO qqq_fk_quarantine (table_name, column_name, row_id, missing_parent_id, action, row_data, changeset) SELECT 'alerts_escalation_step', 'channel_id', CAST(c.id AS VARCHAR(100)), CAST(c.channel_id AS VARCHAR(100)), 'DELETED', CAST(row_to_json(c) AS TEXT), 'qbit-alerts:54' FROM alerts_escalation_step c WHERE c.channel_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_channel p WHERE p.id = c.channel_id);
+DELETE FROM alerts_escalation_step c WHERE c.channel_id IS NOT NULL AND NOT EXISTS (SELECT 1 FROM alerts_channel p WHERE p.id = c.channel_id);
+ALTER TABLE alerts_escalation_step ADD CONSTRAINT fk_alerts_escalation_step_channel_id FOREIGN KEY (channel_id) REFERENCES alerts_channel (id) ON DELETE RESTRICT;
+-- rollback ALTER TABLE alerts_escalation_step DROP CONSTRAINT IF EXISTS fk_alerts_escalation_step_channel_id;

src/main/resources/openapi/qqq-v1/alerts.yaml

@@ -16,7 +16,7 @@ components:
           type: "string"
       type: "object"
     AlertsErrorV1:
-      description: "Framework error response."
+      description: "Deprecated since 1.2.0: errors use BasicErrorResponseV1."
       properties:
         error:
           nullable: true
@@ -115,6 +115,11 @@ components:
           type: "string"
         pollSeconds:
           type: "integer"
+        preferencesSection:
+          description: "Name of the user Preferences section for notification settings\
+            \ (/qqq/v1/preferences/{name}), or null when not registered."
+          nullable: true
+          type: "string"
         unreadCount:
           type: "integer"
       type: "object"
@@ -207,17 +212,89 @@ components:
             type: "integer"
           type: "array"
       type: "object"
+    BasicErrorResponseV1:
+      description: "The error body of every UI API operation (core and extensions)."
+      properties:
+        error:
+          description: "The error message (the same as message; kept for clients of\
+            \ UI API 1.0 to 1.5)."
+          type: "string"
+        code:
+          description: "A stable, machine-readable code. Well-known values: BAD_REQUEST\
+            \ (400), UNAUTHENTICATED (401),\nPERMISSION_DENIED (403), NOT_FOUND (404),\
+            \ CONFLICT (409), RATE_LIMITED (429), INTERNAL_ERROR (500),\nERROR (other).\
+            \ Extensions may add codes; treat an unknown code by the HTTP status.\
+            \ Since 1.6.0."
+          type: "string"
+        message:
+          description: "A message to show the user. Since 1.6.0."
+          type: "string"
+        fieldErrors:
+          description: "Errors about particular request fields, when known. Since\
+            \ 1.6.0."
+          items:
+            properties:
+              field:
+                description: "The field (or parameter) name."
+                type: "string"
+              message:
+                description: "The error about that field."
+                type: "string"
+              code:
+                description: "An optional machine-readable code, e.g. REQUIRED, TOO_LONG,\
+                  \ PATTERN."
+                type: "string"
+            type: "object"
+          type: "array"
+        traceId:
+          description: "Identifies this request in the server logs (also the X-QQQ-Trace-Id\
+            \ response header); quote it when reporting a problem. Since 1.6.0."
+          type: "string"
+      type: "object"
   securitySchemes:
     sessionUuidCookie:
+      description: "The session cookie set by POST /qqq/v1/manageSession (web clients)."
       in: "cookie"
       name: "sessionUUID"
       type: "apiKey"
+    bearerAuth:
+      bearerFormat: "JWT or session UUID"
+      description: "`Authorization: Bearer <token>`, where the token is either\n-\
+        \ an OAuth2 access token (a signed JWT) issued by the app's identity provider\
+        \ to the app's client,\n  or to its native client (`values.nativeClientId`\
+        \ in GET /qqq/v1/metaData/authentication), for\n  example from the device-authorization\
+        \ grant or auth-code + PKCE. It is verified against the\n  provider's keys\
+        \ (issuer, audience, expiry, signature) and gives the same user and permissions\n\
+        \  as signing in on the web. When it expires (401), refresh it at the provider\
+        \ and retry; or\n- a session UUID returned by POST /qqq/v1/manageSession,\
+        \ which the server keeps refreshed."
+      scheme: "bearer"
+      type: "http"
+    oauth2:
+      description: "The app's OAuth2 / OpenID Connect provider. The real endpoints\
+        \ come from the provider's discovery\ndocument: `{values.baseUrl}.well-known/openid-configuration`,\
+        \ with values from\nGET /qqq/v1/metaData/authentication. Native clients use\
+        \ `values.nativeClientId` (a public client)\nwith auth-code + PKCE (loopback\
+        \ or custom-scheme redirect URI registered at the provider) or the\ndevice-authorization\
+        \ grant (`device_authorization_endpoint`, RFC 8628), then send the access\
+        \ token\nas `Authorization: Bearer`."
+      flows:
+        authorizationCode:
+          authorizationUrl: "/authorize"
+          scopes:
+            email: "Email address"
+            offline_access: "A refresh token, to renew the access token without signing\
+              \ in again"
+            openid: "OpenID Connect sign-in"
+            profile: "Name, username and groups (permissions come from the groups)"
+          tokenUrl: "/token"
+      type: "oauth2"
 info:
   contact:
     email: "contact@kingsrook.com"
   description: "Alerts inbox and record panel"
   title: "QQQ Middleware API extension: alerts"
-  version: "1.0.0"
+  version: "1.2.0"
 openapi: "3.0.3"
 paths:
   /qqq/v1/alerts/inbox/summary:
@@ -229,25 +306,25 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Invalid input"
         401:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Sign in required"
         403:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Permission denied"
         404:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Not found"
         200:
           content:
@@ -255,10 +332,31 @@ paths:
               schema:
                 $ref: "#/components/schemas/AlertsInboxSummaryV1"
           description: "Successful Response"
+        409:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Conflict with the current state, e.g. an edit conflict or\
+            \ an invalid transition (code CONFLICT)."
+        429:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Too many requests (code RATE_LIMITED); retry later."
       security:
       - sessionUuidCookie:
         - "N/A"
+      - bearerAuth:
+        - "N/A"
+      - oauth2:
+        - "openid"
+        - "profile"
+        - "email"
       summary: "Read the bell summary"
+      tags:
+      - "alerts"
   /qqq/v1/alerts/inbox:
     get:
       description: "Uses the signed-in caller's permissions and record visibility."
@@ -299,25 +397,25 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Invalid input"
         401:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Sign in required"
         403:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Permission denied"
         404:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Not found"
         200:
           content:
@@ -325,10 +423,31 @@ paths:
               schema:
                 $ref: "#/components/schemas/AlertsInboxPageV1"
           description: "Successful Response"
+        409:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Conflict with the current state, e.g. an edit conflict or\
+            \ an invalid transition (code CONFLICT)."
+        429:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Too many requests (code RATE_LIMITED); retry later."
       security:
       - sessionUuidCookie:
         - "N/A"
+      - bearerAuth:
+        - "N/A"
+      - oauth2:
+        - "openid"
+        - "profile"
+        - "email"
       summary: "Page the notification inbox"
+      tags:
+      - "alerts"
   /qqq/v1/alerts/inbox/read:
     post:
       description: "Uses the signed-in caller's permissions and record visibility."
@@ -344,25 +463,25 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Invalid input"
         401:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Sign in required"
         403:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Permission denied"
         404:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Not found"
         200:
           content:
@@ -370,10 +489,31 @@ paths:
               schema:
                 $ref: "#/components/schemas/AlertsMutationResultV1"
           description: "Successful Response"
+        409:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Conflict with the current state, e.g. an edit conflict or\
+            \ an invalid transition (code CONFLICT)."
+        429:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Too many requests (code RATE_LIMITED); retry later."
       security:
       - sessionUuidCookie:
         - "N/A"
+      - bearerAuth:
+        - "N/A"
+      - oauth2:
+        - "openid"
+        - "profile"
+        - "email"
       summary: "Mark own notifications read"
+      tags:
+      - "alerts"
   /qqq/v1/alerts/inbox/unread:
     post:
       description: "Uses the signed-in caller's permissions and record visibility."
@@ -389,25 +529,25 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Invalid input"
         401:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Sign in required"
         403:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Permission denied"
         404:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Not found"
         200:
           content:
@@ -415,10 +555,31 @@ paths:
               schema:
                 $ref: "#/components/schemas/AlertsMutationResultV1"
           description: "Successful Response"
+        409:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Conflict with the current state, e.g. an edit conflict or\
+            \ an invalid transition (code CONFLICT)."
+        429:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Too many requests (code RATE_LIMITED); retry later."
       security:
       - sessionUuidCookie:
         - "N/A"
+      - bearerAuth:
+        - "N/A"
+      - oauth2:
+        - "openid"
+        - "profile"
+        - "email"
       summary: "Mark own notifications unread"
+      tags:
+      - "alerts"
   /qqq/v1/alerts/inbox/dismiss:
     post:
       description: "Uses the signed-in caller's permissions and record visibility."
@@ -434,25 +595,25 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Invalid input"
         401:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Sign in required"
         403:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Permission denied"
         404:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Not found"
         200:
           content:
@@ -460,10 +621,31 @@ paths:
               schema:
                 $ref: "#/components/schemas/AlertsMutationResultV1"
           description: "Successful Response"
+        409:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Conflict with the current state, e.g. an edit conflict or\
+            \ an invalid transition (code CONFLICT)."
+        429:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Too many requests (code RATE_LIMITED); retry later."
       security:
       - sessionUuidCookie:
         - "N/A"
+      - bearerAuth:
+        - "N/A"
+      - oauth2:
+        - "openid"
+        - "profile"
+        - "email"
       summary: "Dismiss own notifications"
+      tags:
+      - "alerts"
   /qqq/v1/alerts/record-panel:
     get:
       description: "Uses the signed-in caller's permissions and record visibility."
@@ -486,25 +668,25 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Invalid input"
         401:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Sign in required"
         403:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Permission denied"
         404:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/AlertsErrorV1"
+                $ref: "#/components/schemas/BasicErrorResponseV1"
           description: "Not found"
         200:
           content:
@@ -512,7 +694,34 @@ paths:
               schema:
                 $ref: "#/components/schemas/AlertsRecordPanelV1"
           description: "Successful Response"
+        409:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Conflict with the current state, e.g. an edit conflict or\
+            \ an invalid transition (code CONFLICT)."
+        429:
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BasicErrorResponseV1"
+          description: "Too many requests (code RATE_LIMITED); retry later."
       security:
       - sessionUuidCookie:
         - "N/A"
+      - bearerAuth:
+        - "N/A"
+      - oauth2:
+        - "openid"
+        - "profile"
+        - "email"
       summary: "Read visible alerts for a record"
+      tags:
+      - "alerts"
+servers:
+- description: "The QQQ server that serves this document (paths include /qqq/v1)."
+  url: "/"
+tags:
+- description: "Operations of the alerts extension."
+  name: "alerts"

src/main/resources/qbit-alerts.properties

@@ -0,0 +1 @@
+version=${project.version}

src/test/java/com/kingsrook/qbits/alerts/AlertsApiContractTest.java

@@ -51,12 +51,13 @@ class AlertsApiContractTest extends BaseAlertsTest
       assertThat(UiApiContract.check(generated, Files.readString(path), null, 1,
          "mvnw.cmd -Dtest=AlertsApiContractTest -Dalerts.openapi.update=true test")).isEmpty();
       var model = version.generateExtensionOpenAPIModel("qqq", extension);
-      assertThat(model.getComponents().getSchemas().keySet()).allMatch(name -> name.startsWith("Alerts"));
+      assertThat(model.getComponents().getSchemas().keySet()).allMatch(name -> name.startsWith("Alerts") || name.equals("BasicErrorResponseV1"));
       assertThat(model.getPaths().keySet()).containsExactlyInAnyOrder(
          "/qqq/v1/alerts/inbox/summary", "/qqq/v1/alerts/inbox", "/qqq/v1/alerts/inbox/read",
          "/qqq/v1/alerts/inbox/unread", "/qqq/v1/alerts/inbox/dismiss", "/qqq/v1/alerts/record-panel");
       assertThat(extension.getSpecs()).hasSize(6);
-      assertThat(generated).contains("alertsInboxSummary", "alertsInboxRead", "alertsInboxUnread", "alertsInboxDismiss", "alertsRecordPanel", "inboxHref", "actions", "follow");
+      assertThat(extension.getSemanticVersion()).isEqualTo("1.2.0");
+      assertThat(generated).contains("alertsInboxSummary", "alertsInboxRead", "alertsInboxUnread", "alertsInboxDismiss", "alertsRecordPanel", "inboxHref", "preferencesSection", "actions", "follow");
       assertThat(generated).doesNotContain("/watch", "/ingest/", "/hooks/");
    }
 

src/test/java/com/kingsrook/qbits/alerts/AlertsApiHttpTest.java

@@ -200,7 +200,7 @@ class AlertsApiHttpTest extends BaseAlertsTest
       start();
       String base = "/qqq/v1/alerts";
       Map<String, Object> summary = json(request("GET", base + "/inbox/summary", null, ADMIN, null));
-      assertThat(summary).containsEntry("inboxHref", "/app/notifications").containsEntry("notificationsHref", "/app/notifications");
+      assertThat(summary).containsEntry("inboxHref", "/app/notifications").containsEntry("notificationsHref", "/app/notifications").containsEntry("preferencesSection", "notifications");
       List<Map<String, Object>> items = (List<Map<String, Object>>) summary.get("items");
       assertThat(items).hasSize(1);
       Map<String, Object> item = items.get(0);
@@ -224,7 +224,12 @@ class AlertsApiHttpTest extends BaseAlertsTest
       assertThat(request("POST", base + "/record-panel/watch", "{}", ADMIN, null).statusCode()).isEqualTo(404);
       HttpResponse<String> invalidJson = request("POST", base + "/inbox/read", "not json", ADMIN, null);
       assertThat(invalidJson.statusCode()).isEqualTo(400);
-      assertThat(invalidJson.body()).contains("The request body is not valid JSON.");
+      Map<String, Object> error = JsonUtils.toObject(invalidJson.body(), Map.class);
+      assertThat(error).containsKeys("error", "code", "message", "traceId")
+         .containsEntry("message", "The request body is not valid JSON.");
+      assertThat(error.get("error")).isEqualTo(error.get("message"));
+      assertThat(error.get("code")).isNotNull();
+      assertThat((String) error.get("traceId")).isNotBlank();
       assertThat(request("POST", base + "/inbox/read", null, ADMIN, null).statusCode()).isEqualTo(400);
       assertThat(request("GET", base + "/inbox/summary", null, "nobody", null).statusCode()).isEqualTo(403);
       assertThat(request("GET", base + "/record-panel?tableName=widget&recordId=1", null, OUTSIDER, null).statusCode()).isEqualTo(403);

src/test/java/com/kingsrook/qbits/alerts/AlertsDefaultsChangelogTest.java

@@ -0,0 +1,352 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts;
+
+
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.Statement;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.alerts.model.AlertsPossibleValues.ChannelType;
+import liquibase.Liquibase;
+import liquibase.database.Database;
+import liquibase.database.DatabaseFactory;
+import liquibase.database.jvm.JdbcConnection;
+import liquibase.resource.ClassLoaderResourceAccessor;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** The shipped starter defaults (db/liquibase/qbit-alerts/alerts-defaults.
+ ** changelog.sql), run through real Liquibase on H2 (PostgreSQL mode) against
+ ** the qbit's test schema: the rows appear, a second update runs nothing, an
+ ** edited row survives, a host without the tables marks the changesets ran,
+ ** and the seeded rows are the ones the runtime would create itself.
+ *******************************************************************************/
+class AlertsDefaultsChangelogTest extends BaseAlertsTest
+{
+   static final String CHANGELOG = "db/liquibase/qbit-alerts/alerts-defaults.changelog.sql";
+
+   /** the tables the changelog seeds. */
+   static final Set<String> SEEDED_TABLES = Set.of("alerts_channel", "alerts_group");
+
+
+
+   /*******************************************************************************
+    ** Fresh schema, update twice: same rows; an edit survives.
+    *******************************************************************************/
+   @Test
+   void seedsAFreshSchemaInsertOnly() throws Exception
+   {
+      try(Connection connection = freshDatabase(true))
+      {
+         update(connection);
+         assertThat(names(connection, "alerts_channel")).containsExactlyInAnyOrder("in-app", "email");
+         assertThat(names(connection, "alerts_group")).containsExactlyInAnyOrder("alerts", "other");
+
+         try(Statement statement = connection.createStatement())
+         {
+            statement.execute("UPDATE alerts_channel SET label = 'Bell', enabled = FALSE WHERE name = 'in-app'");
+            statement.execute("DELETE FROM alerts_group WHERE name = 'other'");
+         }
+         connection.commit();
+         update(connection);
+         assertThat(scalar(connection, "SELECT label FROM alerts_channel WHERE name = 'in-app'")).isEqualTo("Bell");
+         assertThat(scalar(connection, "SELECT COUNT(*) FROM alerts_channel")).isEqualTo("2");
+         assertThat(scalar(connection, "SELECT COUNT(*) FROM databasechangelog WHERE exectype = 'EXECUTED'")).isEqualTo("4");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** A host that already has a row by that name (its own settings) keeps it
+    ** untouched, and no second one is added.
+    *******************************************************************************/
+   @Test
+   void keepsAHostsExistingRows() throws Exception
+   {
+      try(Connection connection = freshDatabase(true); Statement statement = connection.createStatement())
+      {
+         statement.execute("INSERT INTO alerts_channel (name, label, channel_type, enabled, rate_limit_per_hour) VALUES ('email', 'Ops mail', 'EMAIL', FALSE, 5)");
+         update(connection);
+         assertThat(scalar(connection, "SELECT label FROM alerts_channel WHERE name = 'email'")).isEqualTo("Ops mail");
+         assertThat(scalar(connection, "SELECT rate_limit_per_hour FROM alerts_channel WHERE name = 'email'")).isEqualTo("5");
+         assertThat(scalar(connection, "SELECT COUNT(*) FROM alerts_channel WHERE name = 'email'")).isEqualTo("1");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Rolling the seeds back (Liquibase also rolls back changesets it only marked
+    ** as ran) never deletes rows the host already had.
+    *******************************************************************************/
+   @Test
+   void rollbackKeepsHostOwnedRows() throws Exception
+   {
+      try(Connection connection = freshDatabase(true))
+      {
+         try(Statement statement = connection.createStatement())
+         {
+            statement.execute("INSERT INTO alerts_channel (name, label, channel_type) VALUES ('in-app', 'Mine', 'IN_APP')");
+            statement.execute("INSERT INTO alerts_group (name, label) VALUES ('other', 'Mine')");
+         }
+         connection.commit();
+         update(connection);
+         Database database = DatabaseFactory.getInstance().findCorrectDatabaseImplementation(new JdbcConnection(connection));
+         new Liquibase(CHANGELOG, new ClassLoaderResourceAccessor(), database).rollback(4, "");
+         connection.commit();
+         assertThat(scalar(connection, "SELECT label FROM alerts_channel WHERE name = 'in-app'")).isEqualTo("Mine");
+         assertThat(scalar(connection, "SELECT label FROM alerts_group WHERE name = 'other'")).isEqualTo("Mine");
+         assertThat(scalar(connection, "SELECT COUNT(*) FROM alerts_channel")).isEqualTo("2");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** A host that has not created the tables yet skips every changeset (marked
+    ** ran), rather than failing its deploy.
+    *******************************************************************************/
+   @Test
+   void aMissingTableMarksTheChangesetsRan() throws Exception
+   {
+      try(Connection connection = freshDatabase(false))
+      {
+         update(connection);
+         assertThat(scalar(connection, "SELECT COUNT(*) FROM databasechangelog WHERE exectype = 'MARK_RAN'")).isEqualTo("4");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Every changeset guards itself and uses only precondition forms that parse
+    ** in Liquibase 4 and 5.
+    *******************************************************************************/
+   @Test
+   void everyChangesetIsGuarded() throws Exception
+   {
+      String text = changelogText();
+      assertThat(text).doesNotContain("precondition-table-exists");
+      String[] changesets = text.split("(?m)^(?=-- changeset )");
+      List<String> parts = new ArrayList<>();
+      for(String part : changesets)
+      {
+         if(part.startsWith("-- changeset "))
+         {
+            parts.add(part);
+         }
+      }
+      assertThat(parts).hasSize(4);
+      for(String part : parts)
+      {
+         assertThat(part).contains("-- preconditions onFail:MARK_RAN onError:MARK_RAN").contains("precondition-sql-check expectedResult:0").contains("-- rollback ").contains("NOT EXISTS");
+      }
+      for(String table : SEEDED_TABLES)
+      {
+         assertThat(text).contains("INSERT INTO " + table + " ");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** The seeded rows equal what the runtime creates by itself when they are
+    ** missing, so a deploy never changes behavior.
+    *******************************************************************************/
+   @Test
+   void seededRowsEqualTheRuntimeDefaults() throws Exception
+   {
+      QRecordPair in    = runtimeChannel(ChannelType.IN_APP);
+      QRecordPair email = runtimeChannel(ChannelType.EMAIL);
+      Integer     alertsGroup = runtime.asSystem(() -> runtime.getTypeSync().ensureGroup("alerts"));
+      Integer     otherGroup  = runtime.asSystem(() -> runtime.getTypeSync().ensureGroup(com.kingsrook.qbits.alerts.engine.AlertTypeSync.DEFAULT_GROUP));
+
+      try(Connection connection = freshDatabase(true))
+      {
+         update(connection);
+         for(QRecordPair channel : List.of(in, email))
+         {
+            for(Map.Entry<String, String> column : channel.columns.entrySet())
+            {
+               assertThat(scalar(connection, "SELECT " + column.getKey() + " FROM alerts_channel WHERE name = '" + channel.name + "'")).as(channel.name + " " + column.getKey()).isEqualTo(column.getValue());
+            }
+         }
+         assertThat(scalar(connection, "SELECT label FROM alerts_group WHERE name = 'alerts'")).isEqualTo(groupLabel(alertsGroup));
+         assertThat(scalar(connection, "SELECT label FROM alerts_group WHERE name = 'other'")).isEqualTo(groupLabel(otherGroup));
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** The channel the runtime makes when missing, as comparable column values.
+    *******************************************************************************/
+   private QRecordPair runtimeChannel(ChannelType type) throws Exception
+   {
+      return (runtime.asSystem(() ->
+      {
+         var row = runtime.getChannels().defaultChannel(type);
+         QRecordPair pair = new QRecordPair(row.getValueString("name"));
+         pair.columns.put("label", row.getValueString("label"));
+         pair.columns.put("channel_type", row.getValueString("channelType"));
+         pair.columns.put("detail_level", row.getValueString("detailLevel"));
+         pair.columns.put("min_severity", row.getValueString("minSeverity"));
+         pair.columns.put("rate_limit_per_hour", String.valueOf(row.getValueInteger("rateLimitPerHour")));
+         pair.columns.put("health_status", row.getValueString("healthStatus"));
+         return (pair);
+      }));
+   }
+
+
+
+   /*******************************************************************************
+    ** The label of a group the runtime created.
+    *******************************************************************************/
+   private String groupLabel(Integer id) throws Exception
+   {
+      return (runtime.asSystem(() -> com.kingsrook.qbits.alerts.engine.AlertsDb.byId("alerts_group", id).getValueString("label")));
+   }
+
+
+
+   /*******************************************************************************
+    ** A name and its expected column values.
+    *******************************************************************************/
+   private static final class QRecordPair
+   {
+      private final String                         name;
+      private final Map<String, String> columns = new java.util.LinkedHashMap<>();
+
+
+
+      /*******************************************************************************
+       **
+       *******************************************************************************/
+      private QRecordPair(String name)
+      {
+         this.name = name;
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** A fresh in-memory H2 (PostgreSQL mode), with or without the qbit's tables.
+    *******************************************************************************/
+   static Connection freshDatabase(boolean withTables) throws Exception
+   {
+      Connection connection = DriverManager.getConnection("jdbc:h2:mem:defaults" + System.nanoTime() + ";MODE=PostgreSQL;DEFAULT_NULL_ORDERING=HIGH");
+      if(withTables)
+      {
+         String script;
+         try(InputStream in = AlertsDefaultsChangelogTest.class.getClassLoader().getResourceAsStream("alerts-h2.sql"))
+         {
+            script = new String(in.readAllBytes(), StandardCharsets.UTF_8);
+         }
+         try(Statement statement = connection.createStatement())
+         {
+            StringBuilder current = new StringBuilder();
+            for(String line : script.split("\n"))
+            {
+               if(line.trim().startsWith("--"))
+               {
+                  continue;
+               }
+               current.append(line).append('\n');
+               if(line.trim().endsWith(";"))
+               {
+                  statement.execute(current.toString().trim().replaceAll(";$", ""));
+                  current.setLength(0);
+               }
+            }
+         }
+      }
+      return (connection);
+   }
+
+
+
+   /*******************************************************************************
+    ** Run the changelog with real Liquibase.
+    *******************************************************************************/
+   static void update(Connection connection) throws Exception
+   {
+      Database database = DatabaseFactory.getInstance().findCorrectDatabaseImplementation(new JdbcConnection(connection));
+      //////////////////////////////////////////////////////////////////
+      // not closed: closing Liquibase would close the test connection //
+      //////////////////////////////////////////////////////////////////
+      new Liquibase(CHANGELOG, new ClassLoaderResourceAccessor(), database).update("");
+      connection.commit();
+   }
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   static String changelogText() throws Exception
+   {
+      try(InputStream stream = AlertsDefaultsChangelogTest.class.getClassLoader().getResourceAsStream(CHANGELOG))
+      {
+         assertThat(stream).as(CHANGELOG + " is on the classpath").isNotNull();
+         return (new String(stream.readAllBytes(), StandardCharsets.UTF_8));
+      }
+   }
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private static List<String> names(Connection connection, String table) throws Exception
+   {
+      List<String> names = new ArrayList<>();
+      try(Statement statement = connection.createStatement(); ResultSet rs = statement.executeQuery("SELECT name FROM " + table))
+      {
+         while(rs.next())
+         {
+            names.add(rs.getString(1));
+         }
+      }
+      return (names);
+   }
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private static String scalar(Connection connection, String sql) throws Exception
+   {
+      try(Statement statement = connection.createStatement(); ResultSet rs = statement.executeQuery(sql))
+      {
+         rs.next();
+         return (rs.getString(1));
+      }
+   }
+
+}

src/test/java/com/kingsrook/qbits/alerts/AlertsForeignKeysTest.java

@@ -0,0 +1,419 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts;
+
+
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeMap;
+import java.util.TreeSet;
+import com.kingsrook.qbits.alerts.metadata.AlertsTableMetaDataHelper;
+import com.kingsrook.qqq.backend.core.instances.QInstanceEnricher;
+import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.joins.QJoinMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import liquibase.Contexts;
+import liquibase.LabelExpression;
+import liquibase.Liquibase;
+import liquibase.database.Database;
+import liquibase.database.DatabaseFactory;
+import liquibase.database.jvm.JdbcConnection;
+import liquibase.resource.ClassLoaderResourceAccessor;
+import liquibase.resource.DirectoryResourceAccessor;
+import liquibase.resource.ResourceAccessor;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.testcontainers.containers.PostgreSQLContainer;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+
+/*******************************************************************************
+ ** Referential integrity guardrail: the shipped changelog, applied by Liquibase
+ ** to PostgreSQL, gives every relation the metadata declares (one-to-many joins
+ ** and table possible-value fields) a foreign key with the decided ON DELETE
+ ** rule, led by an index; old orphan rows are quarantined, not lost; and a host
+ ** that already added a constraint under the same name skips it.
+ *******************************************************************************/
+@ExtendWith(RequiresDockerCondition.class)
+@Testcontainers
+class AlertsForeignKeysTest
+{
+   private static final String CHANGELOG = "db/liquibase/qbit-alerts/alerts.changelog.sql";
+
+   /////////////////////////////////////////////////////////////////////////////////////
+   // child_table.child_column -> parent_table and ON DELETE rule (pg_constraint       //
+   // confdeltype: c CASCADE, n SET NULL, r RESTRICT). Add a row here with the new     //
+   // changeset when a table gains a relation; reasons are in the changeset comments. //
+   /////////////////////////////////////////////////////////////////////////////////////
+   private static final Map<String, String> EXPECTED = new TreeMap<>(Map.ofEntries(
+      Map.entry("alerts_type.group_id", "alerts_group n"),
+      Map.entry("alerts_type.escalation_policy_id", "alerts_escalation_policy n"),
+      Map.entry("alerts_group.parent_group_id", "alerts_group n"),
+      Map.entry("alerts_group.owner_team_id", "alerts_team n"),
+      Map.entry("alerts_group.escalation_policy_id", "alerts_escalation_policy n"),
+      Map.entry("alerts_monitor.alert_type_id", "alerts_type r"),
+      Map.entry("alerts_alert.alert_type_id", "alerts_type r"),
+      Map.entry("alerts_alert.monitor_id", "alerts_monitor n"),
+      Map.entry("alerts_alert.group_id", "alerts_group n"),
+      Map.entry("alerts_alert.assigned_team_id", "alerts_team n"),
+      Map.entry("alerts_record_ref.alert_id", "alerts_alert c"),
+      Map.entry("alerts_event.alert_id", "alerts_alert c"),
+      Map.entry("alerts_delivery.alert_id", "alerts_alert c"),
+      Map.entry("alerts_delivery.alert_event_id", "alerts_event n"),
+      Map.entry("alerts_delivery.subscription_id", "alerts_subscription n"),
+      Map.entry("alerts_delivery.channel_id", "alerts_channel r"),
+      Map.entry("alerts_subscription.team_id", "alerts_team r"),
+      Map.entry("alerts_subscription.channel_id", "alerts_channel r"),
+      Map.entry("alerts_team_member.team_id", "alerts_team c"),
+      Map.entry("alerts_notification_recipient.notification_id", "alerts_notification c"),
+      Map.entry("alerts_escalation_step.policy_id", "alerts_escalation_policy c"),
+      Map.entry("alerts_escalation_step.team_id", "alerts_team r"),
+      Map.entry("alerts_escalation_step.channel_id", "alerts_channel r")
+   ));
+
+   //////////////////////////////////////////////////////////////////////////////////////
+   // declared relations that deliberately have no foreign key, with the reason. None //
+   // today: the polymorphic references (alerts_alert.subject_table_name/record_id,   //
+   // alerts_record_ref.table_name/record_id, alerts_notification.source_table_name/  //
+   // source_record_id, subscription and mute scope_value/scope_record_id) and the    //
+   // id lists (channel_override_ids, default_channel_ids) are not declared as joins  //
+   // or table possible values, so they never reach this check.                       //
+   //////////////////////////////////////////////////////////////////////////////////////
+   private static final Map<String, String> EXEMPT = Map.of();
+
+   @Container
+   static final PostgreSQLContainer<?> POSTGRES = new PostgreSQLContainer<>("postgres:17-alpine");
+
+   @TempDir
+   Path tempDir;
+
+
+
+   /*******************************************************************************
+    ** Start every test from an empty schema.
+    *******************************************************************************/
+   @BeforeEach
+   void emptySchema() throws Exception
+   {
+      try(Connection connection = connect(); Statement statement = connection.createStatement())
+      {
+         statement.execute("DROP SCHEMA public CASCADE");
+         statement.execute("CREATE SCHEMA public");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Every declared relation has its foreign key with the decided rule, there
+    ** are no undecided ones, and every foreign-key column leads an index.
+    *******************************************************************************/
+   @Test
+   void testEveryRelationHasForeignKey() throws Exception
+   {
+      update(new ClassLoaderResourceAccessor());
+      Map<String, String> actual = foreignKeys();
+
+      for(String relation : declaredRelations().keySet())
+      {
+         if(EXEMPT.containsKey(relation))
+         {
+            continue;
+         }
+         assertThat(actual).as("a foreign key (or an EXEMPT entry with its reason) for " + relation + " -> " + declaredRelations().get(relation)).containsKey(relation);
+         assertThat(actual.get(relation)).as("foreign key " + relation + " references " + declaredRelations().get(relation))
+            .startsWith(declaredRelations().get(relation) + " ");
+      }
+      assertThat(actual).as("foreign keys and their ON DELETE rules").isEqualTo(EXPECTED);
+      assertThat(unindexedForeignKeys()).as("foreign-key columns no index leads with").isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Orphans from before the constraints: recorded, then nulled (nullable
+    ** column) or deleted (NOT NULL column, full row kept); valid rows untouched.
+    ** Running the changelog again changes nothing.
+    *******************************************************************************/
+   @Test
+   void testOrphansAreQuarantined() throws Exception
+   {
+      update(preForeignKeyChangelog());
+      try(Connection connection = connect(); Statement statement = connection.createStatement())
+      {
+         statement.execute("INSERT INTO alerts_team (id, name, label) VALUES (1, 'ops', 'Ops')");
+         statement.execute("INSERT INTO alerts_team_member (id, team_id, user_id) VALUES (1, 1, 'kept'), (2, 999, 'orphan')");
+         statement.execute("INSERT INTO alerts_type (id, name, group_id) VALUES (1, 'fk.test', 999)");
+         statement.execute("INSERT INTO alerts_monitor (id, name, alert_type_id, kind) VALUES (1, 'orphan monitor', 999, 'TABLE')");
+         statement.execute("INSERT INTO alerts_alert (id, alert_type_id, monitor_id, group_id, assigned_team_id) VALUES (1, 1, 1, 999, 1)");
+         statement.execute("INSERT INTO alerts_event (id, alert_id, event_type) VALUES (1, 1, 'RAISED'), (2, 999, 'RAISED')");
+         statement.execute("INSERT INTO alerts_delivery (id, alert_id, alert_event_id, channel_id) VALUES (1, 1, 2, 999)");
+         statement.execute("INSERT INTO alerts_notification_recipient (id, notification_id, user_id) VALUES (1, 999, 'u')");
+         statement.execute("INSERT INTO alerts_escalation_policy (id, name) VALUES (1, 'p')");
+         statement.execute("INSERT INTO alerts_escalation_step (id, policy_id, step_order, after_minutes, target_type, team_id) VALUES (1, 1, 1, 0, 'TEAM', 999), (2, 1, 2, 5, 'TEAM', 1)");
+      }
+
+      update(new ClassLoaderResourceAccessor());
+      Set<String> expected = Set.of(
+         "alerts_type.group_id 1 999 NULLED",
+         "alerts_monitor.alert_type_id 1 999 DELETED",
+         "alerts_alert.monitor_id 1 1 NULLED",
+         "alerts_alert.group_id 1 999 NULLED",
+         "alerts_event.alert_id 2 999 DELETED",
+         "alerts_delivery.alert_event_id 1 2 NULLED",
+         "alerts_delivery.channel_id 1 999 NULLED",
+         "alerts_team_member.team_id 2 999 DELETED",
+         "alerts_notification_recipient.notification_id 1 999 DELETED",
+         "alerts_escalation_step.team_id 1 999 DELETED");
+      assertThat(quarantined()).isEqualTo(expected);
+
+      try(Connection connection = connect(); Statement statement = connection.createStatement())
+      {
+         assertThat(queryRow(statement, "SELECT alert_type_id, monitor_id, group_id, assigned_team_id FROM alerts_alert WHERE id = 1")).containsExactly("1", null, null, "1");
+         assertThat(queryRow(statement, "SELECT alert_id, alert_event_id, channel_id FROM alerts_delivery WHERE id = 1")).containsExactly("1", null, null);
+         assertThat(queryRow(statement, "SELECT COUNT(*) FROM alerts_team_member WHERE user_id = 'kept'")).containsExactly("1");
+         assertThat(queryRow(statement, "SELECT COUNT(*) FROM alerts_escalation_step WHERE id = 2")).containsExactly("1");
+         assertThat(queryRow(statement, "SELECT row_data FROM qqq_fk_quarantine WHERE table_name = 'alerts_monitor'").get(0)).contains("\"orphan monitor\"");
+      }
+
+      update(new ClassLoaderResourceAccessor());
+      assertThat(quarantined()).as("a second run quarantines nothing more").isEqualTo(expected);
+      assertThat(foreignKeys()).isEqualTo(EXPECTED);
+   }
+
+
+
+   /*******************************************************************************
+    ** A host that added a constraint itself (same name) marks that changeset
+    ** ran instead of failing on a duplicate constraint.
+    *******************************************************************************/
+   @Test
+   void testExistingConstraintIsSkipped() throws Exception
+   {
+      update(preForeignKeyChangelog());
+      try(Connection connection = connect(); Statement statement = connection.createStatement())
+      {
+         statement.execute("ALTER TABLE alerts_event ADD CONSTRAINT fk_alerts_event_alert_id FOREIGN KEY (alert_id) REFERENCES alerts_alert (id) ON DELETE CASCADE");
+      }
+      update(new ClassLoaderResourceAccessor());
+      assertThat(foreignKeys()).isEqualTo(EXPECTED);
+   }
+
+
+
+   /*******************************************************************************
+    ** The rules at work: an alert takes its timeline, records and delivery log
+    ** with it; a used channel and the type of a monitor cannot be deleted; a
+    ** deleted team unassigns its alerts and takes its members.
+    *******************************************************************************/
+   @Test
+   void testOnDeleteRules() throws Exception
+   {
+      update(new ClassLoaderResourceAccessor());
+      try(Connection connection = connect(); Statement statement = connection.createStatement())
+      {
+         statement.execute("INSERT INTO alerts_type (id, name) VALUES (1, 't')");
+         statement.execute("INSERT INTO alerts_monitor (id, name, alert_type_id, kind) VALUES (1, 'm', 1, 'TABLE')");
+         statement.execute("INSERT INTO alerts_team (id, name, label) VALUES (1, 'ops', 'Ops')");
+         statement.execute("INSERT INTO alerts_team_member (team_id, user_id) VALUES (1, 'u')");
+         statement.execute("INSERT INTO alerts_channel (id, name, label, channel_type) VALUES (1, 'c', 'C', 'EMAIL')");
+         statement.execute("INSERT INTO alerts_alert (id, alert_type_id, monitor_id, assigned_team_id) VALUES (1, 1, 1, 1)");
+         statement.execute("INSERT INTO alerts_event (id, alert_id) VALUES (1, 1)");
+         statement.execute("INSERT INTO alerts_record_ref (alert_id) VALUES (1)");
+         statement.execute("INSERT INTO alerts_delivery (alert_id, alert_event_id, channel_id) VALUES (1, 1, 1)");
+
+         assertThatThrownBy(() -> statement.execute("DELETE FROM alerts_channel WHERE id = 1")).isInstanceOf(SQLException.class);
+         assertThatThrownBy(() -> statement.execute("DELETE FROM alerts_type WHERE id = 1")).isInstanceOf(SQLException.class);
+
+         statement.execute("DELETE FROM alerts_team WHERE id = 1");
+         assertThat(queryRow(statement, "SELECT assigned_team_id FROM alerts_alert WHERE id = 1")).containsExactly((String) null);
+         assertThat(queryRow(statement, "SELECT COUNT(*) FROM alerts_team_member")).containsExactly("0");
+
+         statement.execute("DELETE FROM alerts_alert WHERE id = 1");
+         assertThat(queryRow(statement, "SELECT (SELECT COUNT(*) FROM alerts_event) + (SELECT COUNT(*) FROM alerts_record_ref) + (SELECT COUNT(*) FROM alerts_delivery)")).containsExactly("0");
+         statement.execute("DELETE FROM alerts_channel WHERE id = 1");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** child_table.child_column -> parent_table for every one-to-many join and
+    ** every field whose possible values are an alerts table.
+    *******************************************************************************/
+   private static Map<String, String> declaredRelations() throws Exception
+   {
+      Map<String, String> relations = new TreeMap<>();
+      Set<String>         tables    = new TreeSet<>(AlertsQBitConfig.allTableNames());
+      for(QTableMetaData table : AlertsTableMetaDataHelper.buildAllTables(new AlertsQBitConfig()))
+      {
+         for(QFieldMetaData field : table.getFields().values())
+         {
+            if(field.getPossibleValueSourceName() != null && tables.contains(field.getPossibleValueSourceName()))
+            {
+               relations.put(table.getName() + "." + QInstanceEnricher.inferBackendName(field.getName()), field.getPossibleValueSourceName());
+            }
+         }
+      }
+      for(QJoinMetaData join : AlertsTableMetaDataHelper.buildJoins())
+      {
+         relations.put(join.getRightTable() + "." + QInstanceEnricher.inferBackendName(join.getJoinOns().get(0).getRightField()), join.getLeftTable());
+      }
+      return (relations);
+   }
+
+
+
+   /*******************************************************************************
+    ** The changelog up to (not including) the foreign-key changesets, at the
+    ** same path, so the full changelog later continues where it stopped.
+    *******************************************************************************/
+   private ResourceAccessor preForeignKeyChangelog() throws Exception
+   {
+      String changelog;
+      try(InputStream in = getClass().getClassLoader().getResourceAsStream(CHANGELOG))
+      {
+         changelog = new String(in.readAllBytes(), StandardCharsets.UTF_8);
+      }
+      Path file = tempDir.resolve(CHANGELOG);
+      Files.createDirectories(file.getParent());
+      Files.writeString(file, changelog.substring(0, changelog.indexOf("-- changeset qbit-alerts:31")));
+      return (new DirectoryResourceAccessor(tempDir));
+   }
+
+
+
+   /*******************************************************************************
+    ** Run Liquibase update with the changelog from the given accessor.
+    *******************************************************************************/
+   private static void update(ResourceAccessor accessor) throws Exception
+   {
+      Database database = DatabaseFactory.getInstance().findCorrectDatabaseImplementation(new JdbcConnection(connect()));
+      try(Liquibase liquibase = new Liquibase(CHANGELOG, accessor, database))
+      {
+         liquibase.update(new Contexts(), new LabelExpression());
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** child_table.child_column -> "parent_table rule" for every foreign key.
+    *******************************************************************************/
+   private static Map<String, String> foreignKeys() throws Exception
+   {
+      Map<String, String> keys = new TreeMap<>();
+      try(Connection connection = connect(); Statement statement = connection.createStatement();
+         ResultSet result = statement.executeQuery("""
+            SELECT c.conrelid::regclass::text, a.attname, c.confrelid::regclass::text, c.confdeltype
+            FROM pg_constraint c JOIN pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = c.conkey[1]
+            WHERE c.contype = 'f' AND c.conrelid::regclass::text LIKE 'alerts%'"""))
+      {
+         while(result.next())
+         {
+            keys.put(result.getString(1) + "." + result.getString(2), result.getString(3) + " " + result.getString(4));
+         }
+      }
+      return (keys);
+   }
+
+
+
+   /*******************************************************************************
+    ** Foreign keys whose column does not lead any index on the child table.
+    *******************************************************************************/
+   private static List<String> unindexedForeignKeys() throws Exception
+   {
+      List<String> missing = new ArrayList<>();
+      try(Connection connection = connect(); Statement statement = connection.createStatement();
+         ResultSet result = statement.executeQuery("""
+            SELECT c.conname FROM pg_constraint c
+            WHERE c.contype = 'f' AND NOT EXISTS (SELECT 1 FROM pg_index i WHERE i.indrelid = c.conrelid AND i.indkey[0] = c.conkey[1])"""))
+      {
+         while(result.next())
+         {
+            missing.add(result.getString(1));
+         }
+      }
+      return (missing);
+   }
+
+
+
+   /*******************************************************************************
+    ** The quarantine log as "table.column rowId missingParentId action".
+    *******************************************************************************/
+   private static Set<String> quarantined() throws Exception
+   {
+      Set<String> rows = new TreeSet<>();
+      try(Connection connection = connect(); Statement statement = connection.createStatement();
+         ResultSet result = statement.executeQuery("SELECT table_name, column_name, row_id, missing_parent_id, action, changeset FROM qqq_fk_quarantine"))
+      {
+         while(result.next())
+         {
+            assertThat(result.getString(6)).startsWith("qbit-alerts:");
+            rows.add(result.getString(1) + "." + result.getString(2) + " " + result.getString(3) + " " + result.getString(4) + " " + result.getString(5));
+         }
+      }
+      return (rows);
+   }
+
+
+
+   /*******************************************************************************
+    ** The first row of a query, as strings.
+    *******************************************************************************/
+   private static List<String> queryRow(Statement statement, String sql) throws SQLException
+   {
+      try(ResultSet result = statement.executeQuery(sql))
+      {
+         assertThat(result.next()).as(sql).isTrue();
+         List<String> values = new ArrayList<>();
+         for(int i = 1; i <= result.getMetaData().getColumnCount(); i++)
+         {
+            values.add(result.getString(i));
+         }
+         return (values);
+      }
+   }
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private static Connection connect() throws SQLException
+   {
+      return (DriverManager.getConnection(POSTGRES.getJdbcUrl(), POSTGRES.getUsername(), POSTGRES.getPassword()));
+   }
+}

src/test/java/com/kingsrook/qbits/alerts/AlertsQBitProducerTest.java

@@ -64,6 +64,8 @@ class AlertsQBitProducerTest extends BaseAlertsTest
    void testProduce()
    {
       assertThat(qInstance.getQBits()).hasSize(1);
+      assertThat(System.getProperty("qbit.artifactVersion")).isNotBlank().isEqualTo(AlertsQBitProducer.VERSION);
+      assertThat(qInstance.getQBits().values().iterator().next().getVersion()).isEqualTo(System.getProperty("qbit.artifactVersion"));
       assertThat(qInstance.getQBits().values().iterator().next().getArtifactId()).isEqualTo(AlertsQBitProducer.ARTIFACT_ID);
       assertThat(AlertsRuntime.find(qInstance)).isSameAs(runtime);
       assertThat(AlertsRuntime.find(new QInstance())).isNull();
@@ -283,7 +285,12 @@ class AlertsQBitProducerTest extends BaseAlertsTest
       {
          changelog = new String(in.readAllBytes(), StandardCharsets.UTF_8);
       }
-      String sql = changelog.lines().filter(line -> !line.stripLeading().startsWith("--")).collect(Collectors.joining("\n"));
+      ////////////////////////////////////////////////////////////////////////////////////
+      // the foreign-key changesets (31+) use PostgreSQL functions; AlertsForeignKeysTest //
+      // runs the whole changelog on PostgreSQL                                           //
+      ////////////////////////////////////////////////////////////////////////////////////
+      String preForeignKeys = changelog.substring(0, changelog.indexOf("-- changeset qbit-alerts:31"));
+      String sql            = preForeignKeys.lines().filter(line -> !line.stripLeading().startsWith("--")).collect(Collectors.joining("\n"));
       try(Connection connection = DriverManager.getConnection("jdbc:h2:mem:alerts_digest_migration"); Statement statement = connection.createStatement())
       {
          for(String command : sql.split(";"))
@@ -309,6 +316,50 @@ class AlertsQBitProducerTest extends BaseAlertsTest
 
 
 
+   /*******************************************************************************
+    ** Changeset 29 upgrades existing Slack preferences once and preserves their
+    ** values; its MARK_RAN guard skips a database that already has the column.
+    *******************************************************************************/
+   @Test
+   void testInAppSeverityMigration() throws Exception
+   {
+      String changelog;
+      try(InputStream in = getClass().getClassLoader().getResourceAsStream("db/liquibase/qbit-alerts/alerts.changelog.sql"))
+      {
+         changelog = new String(in.readAllBytes(), StandardCharsets.UTF_8);
+      }
+      String block = changelog.substring(changelog.indexOf("-- changeset qbit-alerts:29"));
+      assertThat(block).contains("-- preconditions onFail:MARK_RAN onError:HALT");
+      String guard = block.lines().filter(line -> line.startsWith("-- precondition-sql-check")).findFirst().orElseThrow();
+      String sql = block.lines().filter(line -> line.startsWith("ALTER TABLE")).findFirst().orElseThrow();
+      try(Connection connection = DriverManager.getConnection("jdbc:h2:mem:alerts_preferences_migration"); Statement statement = connection.createStatement())
+      {
+         statement.execute("CREATE TABLE alerts_notification_preference (user_id VARCHAR(100), slack_mode VARCHAR(16), slack_min_severity VARCHAR(16))");
+         statement.execute("INSERT INTO alerts_notification_preference VALUES ('viewer-1', 'DAILY_DIGEST', 'ERROR')");
+         for(int pass = 0; pass < 2; pass++)
+         {
+            try(ResultSet result = statement.executeQuery(guard.substring(guard.indexOf("SELECT"))))
+            {
+               assertThat(result.next()).isTrue();
+               assertThat(result.getInt(1)).isEqualTo(pass);
+            }
+            if(pass == 0)
+            {
+               statement.execute(sql);
+            }
+         }
+         try(ResultSet result = statement.executeQuery("SELECT slack_mode, slack_min_severity, in_app_min_severity FROM alerts_notification_preference"))
+         {
+            assertThat(result.next()).isTrue();
+            assertThat(result.getString(1)).isEqualTo("DAILY_DIGEST");
+            assertThat(result.getString(2)).isEqualTo("ERROR");
+            assertThat(result.getString(3)).isNull();
+         }
+      }
+   }
+
+
+
    /*******************************************************************************
     ** Permissions: the three alerts permissions are listed; role lists nest.
     *******************************************************************************/
@@ -369,4 +420,35 @@ class AlertsQBitProducerTest extends BaseAlertsTest
          com.kingsrook.qqq.backend.core.actions.permissions.TablePermissionSubType.INSERT)).isTrue();
    }
 
+
+
+   /*******************************************************************************
+    ** Every one-to-many join's child column leads an index in the shipped
+    ** changelog, so record pages, child lists and per-parent lookups do not scan
+    ** the child table.
+    *******************************************************************************/
+   @Test
+   void testJoinChildColumnsAreIndexed() throws Exception
+   {
+      String changelog;
+      try(InputStream in = getClass().getClassLoader().getResourceAsStream("db/liquibase/qbit-alerts/alerts.changelog.sql"))
+      {
+         changelog = new String(in.readAllBytes(), StandardCharsets.UTF_8);
+      }
+      for(com.kingsrook.qqq.backend.core.model.metadata.joins.QJoinMetaData join : AlertsTableMetaDataHelper.buildJoins())
+      {
+         String table  = join.getRightTable();
+         String column = join.getJoinOns().get(0).getRightField().replaceAll("([a-z0-9])([A-Z])", "$1_$2").toLowerCase();
+         java.util.regex.Pattern index = java.util.regex.Pattern.compile("(?i)CREATE (UNIQUE )?INDEX (IF NOT EXISTS )?\\w+ ON " + table + " \\(" + column + "[,)]");
+         java.util.regex.Pattern unique = java.util.regex.Pattern.compile("(?is)CREATE TABLE IF NOT EXISTS " + table + " \\((?:(?!\\);).)*UNIQUE \\(" + column + "[,)]");
+         //////////////////////////////////////////////////////////////////////
+         // alerts_delivery was renamed from the RC.1 alerts_notification;   //
+         // its indexes came along by ALTER INDEX ... RENAME TO ix_<t>_<col> //
+         //////////////////////////////////////////////////////////////////////
+         boolean renamed = changelog.contains("RENAME TO ix_" + table + "_" + column + ";") || changelog.contains("RENAME TO ix_" + table + "_" + column + "_");
+         assertThat(index.matcher(changelog).find() || unique.matcher(changelog).find() || renamed)
+            .as("index leading with " + table + "." + column + " for join " + join.getName())
+            .isTrue();
+      }
+   }
 }

src/test/java/com/kingsrook/qbits/alerts/AlertsServicePrincipalTest.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts;
+
+
+import com.kingsrook.qqq.backend.core.model.session.QSession;
+import com.kingsrook.qqq.backend.core.serviceidentity.QDelegatedSession;
+import com.kingsrook.qqq.backend.core.serviceidentity.QServicePrincipalMetaData;
+import com.kingsrook.qqq.backend.core.serviceidentity.ServiceIdentities;
+import com.kingsrook.qqq.backend.core.serviceidentity.ServiceIdentitiesMetaData;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Per-recipient checks run on the recipient's behalf through the alerts
+ ** service principal when the host declares it; otherwise unchanged.
+ *******************************************************************************/
+class AlertsServicePrincipalTest extends BaseAlertsTest
+{
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   void recipientSessionsGoThroughTheDeclaredPrincipal() throws Exception
+   {
+      QSession before = AlertsSecurity.recipientSession(qInstance, config.getServicePrincipal(), "alice");
+      assertThat(before).isNotInstanceOf(QDelegatedSession.class);
+      assertThat(before.getUser().getIdReference()).isEqualTo("alice");
+
+      ServiceIdentitiesMetaData.declare(qInstance, new QServicePrincipalMetaData().withName("alerts").withMayActOnBehalfOfUsers(true));
+      QSession after = AlertsSecurity.recipientSession(qInstance, config.getServicePrincipal(), "alice");
+      assertThat(after).isInstanceOf(QDelegatedSession.class);
+      assertThat(after.getUser().getIdReference()).isEqualTo("alice");
+      assertThat(ServiceIdentities.principalOf(after)).isEqualTo("alerts");
+      assertThat(ServiceIdentities.attributionName(after)).endsWith("via service:alerts");
+   }
+}

src/test/java/com/kingsrook/qbits/alerts/AlertsSystemSessionTest.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts;
+
+
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.logging.QCollectingLogger;
+import com.kingsrook.qqq.backend.core.logging.QLogger;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Background threads (the alerts sink, schedulers) run engine work through
+ ** asSystem with no QContext of their own; the system session must be built
+ ** from the runtime instance, not from the (empty) context.
+ *******************************************************************************/
+class AlertsSystemSessionTest extends BaseAlertsTest
+{
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Test
+   void asSystemWithoutContextUsesTheRuntimeInstance() throws Exception
+   {
+      QContext.clear();
+      QCollectingLogger collectingLogger = QLogger.activateCollectingLoggerForClass(QSystemUserSession.class);
+      try
+      {
+         Boolean systemUser = runtime.asSystem(() -> QContext.getQInstance() != null && AlertsSecurity.isSystemUser());
+         assertThat(systemUser).isTrue();
+         assertThat(collectingLogger.getCollectedMessages())
+            .noneMatch(m -> m.getMessage().contains("QInstance was not supplied"));
+      }
+      finally
+      {
+         QLogger.deactivateCollectingLoggerForClass(QSystemUserSession.class);
+      }
+   }
+}

src/test/java/com/kingsrook/qbits/alerts/AlertsTablesGuardrailTest.java

@@ -0,0 +1,218 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts;
+
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+import com.kingsrook.qbits.alerts.metadata.AlertsProcessesMetaDataProducer;
+import com.kingsrook.qqq.backend.core.model.metadata.help.bundles.HelpBundles;
+import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData;
+import com.kingsrook.qqq.backend.core.testing.HelpBundleAssertions;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Guardrail (owner requirement 2026-10-14: "all tables should be populated
+ ** and the qbit should be fully using them"). For every alerts_* table:
+ ** - runtime code (not just its model, metadata, config or home screen) reads
+ **   or writes it, so no table exists only on paper;
+ ** - it is either seeded by the shipped defaults changelog, or listed here
+ **   with why it starts empty;
+ ** - it has bundle help that says what it is for and how its rows get created.
+ ** A new table fails this test until it is wired, seeded or explained.
+ *******************************************************************************/
+class AlertsTablesGuardrailTest extends BaseAlertsTest
+{
+   private static final Path MAIN = Path.of("src", "main", "java", "com", "kingsrook", "qbits", "alerts");
+
+   /*******************************************************************************
+    ** Tables that legitimately start empty, and where their rows come from.
+    *******************************************************************************/
+   static final Map<String, String> STARTS_EMPTY = Map.ofEntries(
+      Map.entry("alerts_type", "synced from the alert types the installed qbits declare in code, on the first visit (AlertTypeSync)"),
+      Map.entry("alerts_monitor", "default monitors are shipped by the declaring qbits and seeded by AlertTypeSync; admins add the rest"),
+      Map.entry("alerts_alert", "runtime: a producer or monitor raises an alert"),
+      Map.entry("alerts_record_ref", "runtime: written with an alert that names records"),
+      Map.entry("alerts_event", "runtime: the alert timeline"),
+      Map.entry("alerts_subscription", "people's own choices; the first alerts admin gets one by the bootstrap rule (AlertsPreferences)"),
+      Map.entry("alerts_user_preference", "user content: created per person on their first visit (AlertsPreferences)"),
+      Map.entry("alerts_team", "the host's own people"),
+      Map.entry("alerts_team_member", "the host's own people"),
+      Map.entry("alerts_mute", "user content: maintenance windows and mutes people create"),
+      Map.entry("alerts_delivery", "runtime log: every delivery attempt"),
+      Map.entry("alerts_notification", "user content and producer messages"),
+      Map.entry("alerts_notification_recipient", "runtime: one per person a notification reaches"),
+      Map.entry("alerts_notification_preference", "user content: a person's per-category choice; defaults apply without a row"),
+      Map.entry("alerts_heartbeat", "runtime: written by QAlerts.heartbeat and completed processes"),
+      Map.entry("alerts_escalation_policy", "host-specific: names real people, teams and channels"),
+      Map.entry("alerts_escalation_step", "host-specific: names real people, teams and channels"));
+
+
+
+   /*******************************************************************************
+    ** Every table is used by runtime code.
+    *******************************************************************************/
+   @Test
+   void everyTableIsUsedAtRuntime() throws Exception
+   {
+      Map<String, String> entityByTable = entityByTable();
+      List<String>        runtimeSource;
+      try(Stream<Path> files = Files.walk(MAIN))
+      {
+         runtimeSource = files.filter(p -> p.toString().endsWith(".java"))
+            .filter(p -> !p.startsWith(MAIN.resolve("model")) && !p.startsWith(MAIN.resolve("metadata")) && !p.startsWith(MAIN.resolve("home")) && !p.endsWith("AlertsQBitConfig.java"))
+            .map(AlertsTablesGuardrailTest::read).toList();
+      }
+      for(String table : alertsTables())
+      {
+         String entity = entityByTable.get(table);
+         assertThat(entity).as("entity class for " + table).isNotNull();
+         Pattern use = Pattern.compile("\\b" + entity + "(\\.TABLE_NAME|\\.class|\\(|::)");
+         assertThat(runtimeSource.stream().anyMatch(source -> use.matcher(source).find()))
+            .as(table + " (" + entity + ") must be read or written by runtime code, not only declared").isTrue();
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Every table is seeded or explained.
+    *******************************************************************************/
+   @Test
+   void everyTableIsSeededOrExplained() throws Exception
+   {
+      String changelog = AlertsDefaultsChangelogTest.changelogText();
+      for(String table : alertsTables())
+      {
+         boolean seeded = AlertsDefaultsChangelogTest.SEEDED_TABLES.contains(table);
+         assertThat(seeded || STARTS_EMPTY.containsKey(table)).as(table + " must be seeded by the defaults changelog or listed in STARTS_EMPTY").isTrue();
+         assertThat(seeded && STARTS_EMPTY.containsKey(table)).as(table + " cannot be both seeded and listed as starting empty").isFalse();
+         assertThat(changelog.contains("INSERT INTO " + table + " ")).as(table + " seeded iff the changelog inserts it").isEqualTo(seeded);
+      }
+      assertThat(STARTS_EMPTY.keySet()).allMatch(table -> qInstance.getTable(table) != null, "STARTS_EMPTY names only real tables");
+   }
+
+
+
+   /*******************************************************************************
+    ** Every table and the app have bundle help that says how rows get created.
+    *******************************************************************************/
+   @Test
+   void everyTableHasEmptyStateHelp() throws Exception
+   {
+      // Core adds bulk CRUD processes during validation; the qbit owns its declared actions and jobs.
+      var processes = AlertsProcessesMetaDataProducer.buildProcesses(config).stream().map(process -> process.getName()).toList();
+      HelpBundleAssertions.forInstance(qInstance)
+         .bundles("help/qbit-alerts.yaml")
+         .owning(target -> "process".equals(target.kind()) ? processes.contains(target.name()) : target.name().startsWith("alerts"))
+         .assertComplete();
+      var entries = HelpBundles.of(qInstance).getBundles().get(0).getEntries();
+      // Core's gate does not yet require widget and possible-value-source help.
+      var keys = entries.stream().map(entry -> entry.getKey()).toList();
+      qInstance.getWidgets().keySet().stream().filter(name -> name.startsWith("alerts"))
+         .forEach(name -> assertThat(keys).contains("widget:" + name + ";slot:help"));
+      qInstance.getPossibleValueSources().keySet().stream().filter(name -> name.startsWith("alerts"))
+         .forEach(name -> assertThat(keys).contains("possibleValueSource:" + name + ";slot:help"));
+      for(String table : alertsTables())
+      {
+         assertThat(entries).anySatisfy(entry ->
+         {
+            assertThat(entry.getKey()).isEqualTo("table:" + table + ";slot:help");
+            assertThat(entry.getContent()).contains("How rows get created");
+         });
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Bundle registration needs no help table; core safely skips startup sync.
+    *******************************************************************************/
+   @Test
+   void hostWithoutHelpTableIsSupported()
+   {
+      assertThat(qInstance.getTable("helpContent")).isNull();
+      assertThat(HelpBundles.of(qInstance).getBundles()).singleElement().satisfies(bundle ->
+      {
+         assertThat(bundle.getId()).isEqualTo("qbit-alerts");
+         assertThat(bundle.getVersion()).as("the help bundle carries the artifact and producer version").isEqualTo(System.getProperty("qbit.artifactVersion")).isEqualTo(AlertsQBitProducer.VERSION);
+      });
+      HelpBundles.syncOnStartup(qInstance);
+   }
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private List<String> alertsTables()
+   {
+      List<String> tables = qInstance.getTables().values().stream().map(QTableMetaData::getName).filter(n -> n.startsWith("alerts_")).sorted().toList();
+      assertThat(tables).hasSizeGreaterThan(15);
+      return (tables);
+   }
+
+
+
+   /*******************************************************************************
+    ** model/X.java declares TABLE_NAME = "x".
+    *******************************************************************************/
+   private static Map<String, String> entityByTable() throws Exception
+   {
+      Map<String, String> rs = new HashMap<>();
+      Pattern             p  = Pattern.compile("TABLE_NAME\\s*=\\s*\"([a-z_]+)\"");
+      try(Stream<Path> files = Files.list(MAIN.resolve("model")))
+      {
+         for(Path file : files.toList())
+         {
+            Matcher m = p.matcher(read(file));
+            if(m.find())
+            {
+               rs.put(m.group(1), file.getFileName().toString().replace(".java", ""));
+            }
+         }
+      }
+      return (rs);
+   }
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private static String read(Path path)
+   {
+      try
+      {
+         return (Files.readString(path, StandardCharsets.UTF_8));
+      }
+      catch(Exception e)
+      {
+         throw (new IllegalStateException(e));
+      }
+   }
+
+}

src/test/java/com/kingsrook/qbits/alerts/RequiresDockerCondition.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts;
+
+
+import org.junit.jupiter.api.extension.ConditionEvaluationResult;
+import org.junit.jupiter.api.extension.ExecutionCondition;
+import org.junit.jupiter.api.extension.ExtensionContext;
+import org.testcontainers.DockerClientFactory;
+
+
+/*******************************************************************************
+ ** Runs a PostgreSQL (Testcontainers) test when Docker is available; skips it
+ ** on a workstation without Docker, and fails when CI is set but Docker is not.
+ *******************************************************************************/
+public class RequiresDockerCondition implements ExecutionCondition
+{
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Override
+   public ConditionEvaluationResult evaluateExecutionCondition(ExtensionContext context)
+   {
+      boolean available;
+      try
+      {
+         available = DockerClientFactory.instance().isDockerAvailable();
+      }
+      catch(Exception | LinkageError e)
+      {
+         available = false;
+      }
+      if(available)
+      {
+         return (ConditionEvaluationResult.enabled("Docker is available"));
+      }
+      if(System.getenv("CI") != null)
+      {
+         throw new IllegalStateException("Docker is required when CI is set");
+      }
+      return (ConditionEvaluationResult.disabled("Docker is unavailable; the PostgreSQL schema tests need it"));
+   }
+}

src/test/java/com/kingsrook/qbits/alerts/demo/AlertsDemoServer.java

@@ -279,6 +279,10 @@ public class AlertsDemoServer extends AbstractQQQApplication
       {
          QRecord preference = AlertsDb.first(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", ADMIN));
          AlertsDb.update(AlertsUserPreference.TABLE_NAME, new QRecord().withValue("id", preference.getValue("id")).withValue("emailAddress", "dana@example.com"));
+         AlertsDb.insert("alerts_notification_preference", new QRecord().withValue("userId", ADMIN).withValue("category", "JOB")
+            .withValue("inAppMinSeverity", "WARNING").withValue("emailMode", "IMMEDIATE").withValue("emailMinSeverity", "ERROR"));
+         AlertsDb.insert("alerts_notification_preference", new QRecord().withValue("userId", ADMIN).withValue("category", "RELEASE")
+            .withValue("emailMode", "DAILY_DIGEST").withValue("emailMinSeverity", "INFO"));
          QRecord list = AlertsDb.insert(AlertsChannel.TABLE_NAME, new QRecord().withValue("name", "ops-list").withValue("label", "Ops email list").withValue("channelType", "EMAIL_LIST")
             .withValue("enabled", true).withValue("settings", JsonUtils.toJson(Map.of("addresses", List.of("ops@example.com")))).withValue("detailLevel", "MINIMAL")
             .withValue("minSeverity", "ERROR").withValue("rateLimitPerHour", 60).withValue("healthStatus", "HEALTHY").withValue("consecutiveFailures", 0));

src/test/java/com/kingsrook/qbits/alerts/engine/AlertsWiringTest.java

@@ -0,0 +1,306 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts.engine;
+
+
+import java.util.List;
+import com.kingsrook.qbits.alerts.AlertsQBitConfig;
+import com.kingsrook.qbits.alerts.BaseAlertsTest;
+import com.kingsrook.qbits.alerts.TestSteps;
+import com.kingsrook.qbits.alerts.delivery.DeliveryResult;
+import com.kingsrook.qbits.alerts.model.AlertsChannel;
+import com.kingsrook.qbits.alerts.model.AlertsDelivery;
+import com.kingsrook.qbits.alerts.model.AlertsGroup;
+import com.kingsrook.qbits.alerts.model.AlertsPossibleValues.Resolution;
+import com.kingsrook.qbits.alerts.model.AlertsSubscription;
+import com.kingsrook.qbits.alerts.model.AlertsTeam;
+import com.kingsrook.qbits.alerts.model.AlertsTeamMember;
+import com.kingsrook.qbits.alerts.model.AlertsUserPreference;
+import com.kingsrook.qqq.backend.core.alerts.AlertSeverity;
+import com.kingsrook.qqq.backend.core.alerts.AlertSignal;
+import com.kingsrook.qqq.backend.core.alerts.AlertsInstanceMetaData;
+import com.kingsrook.qqq.backend.core.alerts.QAlertTypeMetaData;
+import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Two settings that used to be stored but never read, now enforced by the
+ ** router: a group's owner team (the fallback audience for an alert nobody
+ ** subscribed to) and a user's default channels.
+ *******************************************************************************/
+class AlertsWiringTest extends BaseAlertsTest
+{
+   static final String TYPE = "test.system.down";
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Override
+   protected void customizeConfig(AlertsQBitConfig config)
+   {
+      config.withChannelType(new QCodeReference(TestSteps.RecordingChannel.class));
+   }
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Override
+   protected void customizeInstance(QInstance qInstance)
+   {
+      AlertsInstanceMetaData.ofOrWithNew(qInstance)
+         .withAlertType(new QAlertTypeMetaData().withName(TYPE).withLabel("System down").withGroupName("infrastructure").withDefaultSeverity(AlertSeverity.CRITICAL));
+   }
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @BeforeEach
+   void reset()
+   {
+      TestSteps.SENT.clear();
+      TestSteps.nextOutcome = DeliveryResult.Outcome.SENT;
+   }
+
+
+
+   /*******************************************************************************
+    ** A team with these members; returns its id.
+    *******************************************************************************/
+   private Integer team(String name, String... members) throws QException
+   {
+      Integer teamId = runtime.asSystem(() -> AlertsDb.insert(AlertsTeam.TABLE_NAME, new QRecord().withValue("name", name).withValue("label", name)).getValueInteger("id"));
+      for(String member : members)
+      {
+         runtime.asSystem(() -> AlertsDb.insert(AlertsTeamMember.TABLE_NAME, new QRecord().withValue("teamId", teamId).withValue("userId", member)));
+      }
+      return (teamId);
+   }
+
+
+
+   /*******************************************************************************
+    ** The group row for the test type (synced on first use).
+    *******************************************************************************/
+   private QRecord group(String name) throws QException
+   {
+      runtime.getTypeSync().syncIfNeeded();
+      return (runtime.asSystem(() -> AlertsDb.first(AlertsGroup.TABLE_NAME, AlertsDb.eq("name", name))));
+   }
+
+
+
+   /*******************************************************************************
+    ** The users who were sent an alert, sorted.
+    *******************************************************************************/
+   private List<String> recipients() throws QException
+   {
+      return (all(AlertsDelivery.TABLE_NAME).stream().map(n -> n.getValueString("recipientUserId")).distinct().sorted().toList());
+   }
+
+
+
+   /*******************************************************************************
+    ** A user subscription to everything at WARNING and worse.
+    *******************************************************************************/
+   private void subscribe(String userId) throws QException
+   {
+      runtime.asSystem(() -> AlertsDb.insert(AlertsSubscription.TABLE_NAME, new QRecord().withValue("subscriberType", "USER").withValue("userId", userId)
+         .withValue("scopeType", "ALL").withValue("minSeverity", "WARNING").withValue("events", "RAISED").withValue("deliveryMode", "IMMEDIATE").withValue("enabled", true)));
+   }
+
+
+
+   /*******************************************************************************
+    ** An alert nobody subscribed to goes to its group's owner team; once a
+    ** subscription matches, the owner team is not added.
+    *******************************************************************************/
+   @Test
+   void ownerTeamIsTheFallbackAudience() throws Exception
+   {
+      Integer teamId = team("infra", "owner-1", "owner-2");
+      QRecord group  = group("infrastructure");
+      runtime.asSystem(() -> AlertsDb.update(AlertsGroup.TABLE_NAME, new QRecord().withValue("id", group.getValue("id")).withValue("ownerTeamId", teamId)));
+
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("a").withTitle("Down"));
+      assertThat(recipients()).containsExactly("owner-1", "owner-2");
+      assertThat(all(AlertsDelivery.TABLE_NAME)).allMatch(n -> "SENT".equals(n.getValueString("status")));
+
+      List<java.io.Serializable> before = all(AlertsDelivery.TABLE_NAME).stream().map(n -> n.getValue("id")).toList();
+      subscribe("subscriber");
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("b").withTitle("Down again"));
+      List<QRecord> second = all(AlertsDelivery.TABLE_NAME).stream().filter(n -> !before.contains(n.getValue("id"))).toList();
+      assertThat(second).extracting(n -> n.getValueString("recipientUserId")).containsExactly("subscriber");
+   }
+
+
+
+   /*******************************************************************************
+    ** The nearest parent group with an owner team is used; a group with no
+    ** owner anywhere leaves the alert unrouted, as before.
+    *******************************************************************************/
+   @Test
+   void ownerTeamComesFromTheNearestParentGroup() throws Exception
+   {
+      QRecord group = group("infrastructure");
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("none").withTitle("Down"));
+      assertThat(recipients()).as("no owner team anywhere: nobody is notified").isEmpty();
+
+      Integer teamId = team("platform", "parent-owner");
+      Integer parent = runtime.asSystem(() -> AlertsDb.insert(AlertsGroup.TABLE_NAME, new QRecord().withValue("name", "platform").withValue("label", "Platform")
+         .withValue("ownerTeamId", teamId)).getValueInteger("id"));
+      runtime.asSystem(() -> AlertsDb.update(AlertsGroup.TABLE_NAME, new QRecord().withValue("id", group.getValue("id")).withValue("parentGroupId", parent)));
+
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("parent").withTitle("Down"));
+      assertThat(recipients()).containsExactly("parent-owner");
+   }
+
+
+
+   /*******************************************************************************
+    ** The owner fallback is for alerts that matter: an INFO alert is not sent
+    ** to the owner team.
+    *******************************************************************************/
+   @Test
+   void ownerTeamIsNotToldAboutInfo() throws Exception
+   {
+      Integer teamId = team("infra", "owner-1");
+      QRecord group  = group("infrastructure");
+      runtime.asSystem(() -> AlertsDb.update(AlertsGroup.TABLE_NAME, new QRecord().withValue("id", group.getValue("id")).withValue("ownerTeamId", teamId)));
+
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("info").withSeverity(AlertSeverity.INFO).withTitle("FYI"));
+      assertThat(recipients()).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** A user's default channels replace the built-in email choice, but the bell
+    ** stays unless the user turned it off.
+    *******************************************************************************/
+   @Test
+   void defaultChannelsDecideWhereAUserIsReached() throws Exception
+   {
+      QRecord chat = runtime.asSystem(() -> AlertsDb.insert(AlertsChannel.TABLE_NAME, new QRecord().withValue("name", "chat").withValue("label", "Chat")
+         .withValue("channelType", "SLACK").withValue("enabled", true).withValue("detailLevel", "STANDARD").withValue("rateLimitPerHour", 60)
+         .withValue("healthStatus", "HEALTHY").withValue("consecutiveFailures", 0)));
+      String chatId = String.valueOf(chat.getValue("id"));
+      subscribe("u1");
+
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("plain").withTitle("Down"));
+      List<QRecord> plain = all(AlertsDelivery.TABLE_NAME);
+      assertThat(plain).singleElement().matches(n -> !chatId.equals(String.valueOf(n.getValue("channelId"))), "went to the built-in in-app channel");
+
+      QRecord preference = runtime.asSystem(() -> AlertsDb.insert(AlertsUserPreference.TABLE_NAME, new QRecord().withValue("userId", "u1").withValue("userLabel", "One")
+         .withValue("inAppEnabled", true).withValue("emailEnabled", false).withValue("defaultChannelIds", "not-a-number, " + chatId + ", 99999")));
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("chosen").withTitle("Down again"));
+      List<QRecord> chosen = all(AlertsDelivery.TABLE_NAME).stream().filter(n -> !n.getValue("id").equals(plain.get(0).getValue("id"))).toList();
+      assertThat(chosen).hasSize(2);
+      assertThat(chosen).anyMatch(n -> chatId.equals(String.valueOf(n.getValue("channelId"))));
+      assertThat(chosen).anyMatch(n -> !chatId.equals(String.valueOf(n.getValue("channelId"))));
+
+      runtime.asSystem(() -> AlertsDb.update(AlertsUserPreference.TABLE_NAME, new QRecord().withValue("id", preference.getValue("id")).withValue("inAppEnabled", false)));
+      List<Object> before = all(AlertsDelivery.TABLE_NAME).stream().map(n -> (Object) n.getValue("id")).toList();
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("no-bell").withTitle("Down a third time"));
+      List<QRecord> third = all(AlertsDelivery.TABLE_NAME).stream().filter(n -> !before.contains(n.getValue("id"))).toList();
+      assertThat(third).singleElement().matches(n -> chatId.equals(String.valueOf(n.getValue("channelId"))), "only the chosen channel when the bell is off");
+   }
+
+
+
+   /*******************************************************************************
+    ** A subscription that covers the alert by scope and severity, but only for
+    ** some events, still counts as ownership: RESOLVED does not fall through to
+    ** the owner team.
+    *******************************************************************************/
+   @Test
+   void aSubscriptionWithFewerEventsStillCoversTheAlert() throws Exception
+   {
+      Integer teamId = team("infra", "owner-1");
+      QRecord group  = group("infrastructure");
+      runtime.asSystem(() -> AlertsDb.update(AlertsGroup.TABLE_NAME, new QRecord().withValue("id", group.getValue("id")).withValue("ownerTeamId", teamId)));
+      subscribe("subscriber");
+
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("a").withTitle("Down"));
+      runtime.getEngine().resolve(TYPE, "a", Resolution.PRODUCER, null, "fixed");
+      assertThat(recipients()).containsExactly("subscriber");
+   }
+
+
+
+   /*******************************************************************************
+    ** Follow-ups (resolved, reminders) go to the owner team only when it was
+    ** told about the raise.
+    *******************************************************************************/
+   @Test
+   void ownerTeamGetsFollowUpsOnlyAfterTheRaise() throws Exception
+   {
+      Integer teamId = team("infra", "owner-1");
+      QRecord group  = group("infrastructure");
+
+      /////////////////////////////////////////////////////////////////
+      // raised with no owner team: nobody is told, so nobody is told //
+      // about the resolution even though a team is named afterwards  //
+      /////////////////////////////////////////////////////////////////
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("early").withTitle("Down"));
+      runtime.asSystem(() -> AlertsDb.update(AlertsGroup.TABLE_NAME, new QRecord().withValue("id", group.getValue("id")).withValue("ownerTeamId", teamId)));
+      runtime.getEngine().resolve(TYPE, "early", Resolution.PRODUCER, null, "fixed");
+      assertThat(recipients()).isEmpty();
+
+      runtime.getEngine().raise(new AlertSignal(TYPE).withDedupKey("late").withTitle("Down"));
+      assertThat(recipients()).containsExactly("owner-1");
+      runtime.getEngine().resolve(TYPE, "late", Resolution.PRODUCER, null, "fixed");
+      assertThat(all(AlertsDelivery.TABLE_NAME).stream().filter(n -> "RESOLVED".equals(n.getValueString("kind")))).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** A failing type sync (a unique-key race between replicas, say) never breaks
+    ** the bell; the next request retries.
+    *******************************************************************************/
+   @Test
+   void aFailingSyncDoesNotBreakTheBell() throws Exception
+   {
+      try(java.sql.Connection connection = com.kingsrook.qqq.backend.module.rdbms.jdbc.ConnectionManager.getConnection((com.kingsrook.qqq.backend.module.rdbms.model.metadata.RDBMSBackendMetaData) qInstance.getBackend(BACKEND_NAME));
+         java.sql.Statement statement = connection.createStatement())
+      {
+         statement.execute("ALTER TABLE alerts_type RENAME TO alerts_type_gone");
+         try
+         {
+            assertThat(new com.kingsrook.qbits.alerts.api.AlertsApi(runtime).requireViewer()).isEqualTo(ADMIN);
+         }
+         finally
+         {
+            statement.execute("ALTER TABLE alerts_type_gone RENAME TO alerts_type");
+         }
+      }
+      assertThat(new com.kingsrook.qbits.alerts.api.AlertsApi(runtime).requireViewer()).isEqualTo(ADMIN);
+      assertThat(all("alerts_type")).isNotEmpty();
+   }
+}

src/test/java/com/kingsrook/qbits/alerts/engine/RoutingAndDeliveryTest.java

@@ -135,6 +135,76 @@ class RoutingAndDeliveryTest extends BaseAlertsTest
 
 
 
+   /*******************************************************************************
+    ** First calls for one user race (the home widgets and the bell load
+    ** together): only one bootstrap subscription is created.
+    *******************************************************************************/
+   @Test
+   void testConcurrentFirstCallsBootstrapOnce() throws Exception
+   {
+      com.kingsrook.qqq.backend.core.context.CapturedContext context = QContext.capture();
+      java.util.concurrent.ExecutorService pool = java.util.concurrent.Executors.newFixedThreadPool(4);
+      try
+      {
+         java.util.concurrent.CountDownLatch start = new java.util.concurrent.CountDownLatch(1);
+         List<java.util.concurrent.Future<Object>> futures = new java.util.ArrayList<>();
+         for(int i = 0; i < 4; i++)
+         {
+            futures.add(pool.submit(() ->
+            {
+               QContext.init(context);
+               start.await();
+               AlertsPreferences.ensure(runtime, QContext.getQSession());
+               return (null);
+            }));
+         }
+         start.countDown();
+         for(java.util.concurrent.Future<Object> future : futures)
+         {
+            future.get();
+         }
+      }
+      finally
+      {
+         pool.shutdownNow();
+      }
+      assertThat(all(AlertsSubscription.TABLE_NAME)).hasSize(1);
+      assertThat(all(AlertsUserPreference.TABLE_NAME)).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** Another replica raced and left a second bootstrap subscription: the next
+    ** first call keeps the oldest and leaves a person's own subscriptions alone.
+    *******************************************************************************/
+   @Test
+   void testDuplicateBootstrapSubscriptionsAreRemoved() throws Exception
+   {
+      for(String creator : List.of("alerts (bootstrap rule)", "alerts (bootstrap rule)", ADMIN))
+      {
+         runtime.asSystem(() -> AlertsDb.insert(AlertsSubscription.TABLE_NAME, new QRecord()
+            .withValue("subscriberType", "USER")
+            .withValue("userId", ADMIN)
+            .withValue("scopeType", "ALL")
+            .withValue("minSeverity", "ERROR")
+            .withValue("events", "RAISED")
+            .withValue("deliveryMode", "IMMEDIATE")
+            .withValue("enabled", true)
+            .withValue("createdByUserId", creator)));
+      }
+      List<QRecord> before = all(AlertsSubscription.TABLE_NAME);
+      assertThat(before).hasSize(3);
+
+      AlertsPreferences.ensure(runtime, QContext.getQSession());
+
+      List<QRecord> after = all(AlertsSubscription.TABLE_NAME);
+      assertThat(after).hasSize(2);
+      assertThat(after).extracting(r -> r.getValueInteger("id")).containsExactlyInAnyOrder(before.get(0).getValueInteger("id"), before.get(2).getValueInteger("id"));
+   }
+
+
+
    /*******************************************************************************
     ** No subscriptions: nobody is notified. The bootstrap rule gives admins an
     ** in-app subscription to ERROR and worse on first visit.

src/test/java/com/kingsrook/qbits/alerts/engine/RuntimeFieldsAuditTest.java

@@ -0,0 +1,166 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts.engine;
+
+
+import java.sql.Connection;
+import java.sql.Statement;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.alerts.BaseAlertsTest;
+import com.kingsrook.qbits.alerts.model.AlertsAlert;
+import com.kingsrook.qbits.alerts.model.AlertsMonitor;
+import com.kingsrook.qbits.alerts.model.AlertsType;
+import com.kingsrook.qqq.backend.core.alerts.AlertSeverity;
+import com.kingsrook.qqq.backend.core.alerts.AlertsInstanceMetaData;
+import com.kingsrook.qqq.backend.core.alerts.QAlertTypeMetaData;
+import com.kingsrook.qqq.backend.core.instances.QInstanceEnricher;
+import com.kingsrook.qqq.backend.core.model.audits.AuditsMetaDataProvider;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import com.kingsrook.qqq.backend.module.rdbms.jdbc.ConnectionManager;
+import com.kingsrook.qqq.backend.module.rdbms.model.metadata.RDBMSBackendMetaData;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** Engine bookkeeping writes (monitor leases and run results, alert reminder
+ ** and notification timers) create no audit rows; configuration edits and
+ ** alert state changes still do.
+ *******************************************************************************/
+class RuntimeFieldsAuditTest extends BaseAlertsTest
+{
+   static final String TYPE = "test.widget.broken";
+
+
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   @Override
+   protected void customizeInstance(QInstance qInstance)
+   {
+      AlertsInstanceMetaData.ofOrWithNew(qInstance)
+         .withAlertType(new QAlertTypeMetaData().withName(TYPE).withLabel("Widget broken").withGroupName("widgets").withSubjectTableName(WIDGET).withDefaultSeverity(AlertSeverity.WARNING));
+   }
+
+
+
+   /*******************************************************************************
+    ** Core audit tables on the test backend.
+    *******************************************************************************/
+   @BeforeEach
+   void auditTables() throws Exception
+   {
+      new AuditsMetaDataProvider().defineAll(qInstance, BACKEND_NAME, null);
+      new QInstanceEnricher(qInstance).enrich();
+      try(Connection connection = ConnectionManager.getConnection((RDBMSBackendMetaData) qInstance.getBackend(BACKEND_NAME)); Statement statement = connection.createStatement())
+      {
+         for(String table : List.of("auditDetail", "audit", "auditUser", "auditTable"))
+         {
+            statement.execute("DROP TABLE IF EXISTS " + table);
+         }
+         statement.execute("CREATE TABLE auditUser (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(200), createDate TIMESTAMP, modifyDate TIMESTAMP)");
+         statement.execute("CREATE TABLE auditTable (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(200), label VARCHAR(200), createDate TIMESTAMP, modifyDate TIMESTAMP)");
+         statement.execute("CREATE TABLE audit (id BIGINT AUTO_INCREMENT PRIMARY KEY, auditTableId INTEGER, auditUserId INTEGER, recordId INTEGER, message VARCHAR(250), timestamp TIMESTAMP)");
+         statement.execute("CREATE TABLE auditDetail (id BIGINT AUTO_INCREMENT PRIMARY KEY, auditId BIGINT, message VARCHAR(250), fieldName VARCHAR(100), oldValue VARCHAR(250), newValue VARCHAR(250))");
+      }
+   }
+
+
+
+   /*******************************************************************************
+    ** Edited-record audits for one table.
+    *******************************************************************************/
+   private List<QRecord> edits(String tableName) throws Exception
+   {
+      List<QRecord> tables = where("auditTable", AlertsDb.eq("name", tableName));
+      if(tables.isEmpty())
+      {
+         return (List.of());
+      }
+      return (where("audit", AlertsDb.eq("auditTableId", tables.get(0).getValue("id")).withCriteria("message", com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator.EQUALS, "Record was Edited")));
+   }
+
+
+
+   /*******************************************************************************
+    ** Changed field names of one table's edit audits.
+    *******************************************************************************/
+   private List<String> editedFields(String tableName) throws Exception
+   {
+      List<Object> ids = edits(tableName).stream().map(r -> r.getValue("id")).map(Object.class::cast).toList();
+      return (all("auditDetail").stream().filter(d -> ids.contains(d.getValue("auditId"))).map(d -> d.getValueString("fieldName")).toList());
+   }
+
+
+
+   /*******************************************************************************
+    ** The classifier: bookkeeping only, or not.
+    *******************************************************************************/
+   @Test
+   void classifiesBookkeepingOnlyUpdates()
+   {
+      assertThat(RuntimeFields.onlyRuntime(AlertsMonitor.TABLE_NAME, new QRecord().withValue("id", 1).withValue("claimedBy", "x").withValue("claimedUntil", Instant.now()))).isTrue();
+      assertThat(RuntimeFields.onlyRuntime(AlertsMonitor.TABLE_NAME, new QRecord().withValue("id", 1).withValue("lastRunAt", Instant.now()).withValue("enabled", false))).isFalse();
+      assertThat(RuntimeFields.onlyRuntime(AlertsAlert.TABLE_NAME, new QRecord().withValue("id", 1).withValue("timedNotificationCheckedAt", Instant.now()))).isTrue();
+      assertThat(RuntimeFields.onlyRuntime(AlertsAlert.TABLE_NAME, new QRecord().withValue("id", 1).withValue("status", "ACKNOWLEDGED"))).isFalse();
+      assertThat(RuntimeFields.onlyRuntime(WIDGET, new QRecord().withValue("id", 1).withValue("checkedAt", Instant.now()))).isFalse();
+   }
+
+
+
+   /*******************************************************************************
+    ** Evaluations and reminder checks write no monitor or alert edit audits;
+    ** an admin edit and an acknowledgement do.
+    *******************************************************************************/
+   @Test
+   void evaluationsAreNotAuditedButEditsAndTransitionsAre() throws Exception
+   {
+      insertWidgets("BROKEN", "OK");
+      runtime.getTypeSync().syncIfNeeded();
+      QRecord type = runtime.asSystem(() -> AlertsDb.first(AlertsType.TABLE_NAME, AlertsDb.eq("name", TYPE)));
+      Integer monitorId = runtime.asSystem(() -> AlertsDb.insert(AlertsMonitor.TABLE_NAME, new QRecord()
+         .withValue("name", "Broken widgets").withValue("alertTypeId", type.getValue("id")).withValue("kind", "TABLE_QUERY").withValue("enabled", true)
+         .withValue("definition", JsonUtils.toJson(Map.of("tableName", WIDGET, "filter", Map.of("criteria", List.of(Map.of("fieldName", "status", "operator", "EQUALS", "values", List.of("BROKEN")))))))
+         .withValue("perRecord", false).withValue("scheduleSeconds", 60).withValue("forMinutes", 0).withValue("consecutiveFailures", 0)).getValueInteger("id"));
+
+      for(int run = 0; run < 3; run++)
+      {
+         runtime.getEvaluator().evaluateDue();
+         new EscalationAndReminder(runtime).runDue();
+         clock.advance(java.time.Duration.ofMinutes(2));
+      }
+      assertThat(runtime.asSystem(() -> AlertsDb.byId(AlertsMonitor.TABLE_NAME, monitorId)).getValueInstant("lastRunAt")).isNotNull();
+      assertThat(edits(AlertsMonitor.TABLE_NAME)).as("monitor runs are bookkeeping").isEmpty();
+      assertThat(editedFields(AlertsAlert.TABLE_NAME)).as("reminder checks and ref counts are bookkeeping")
+         .doesNotContain("timedNotificationCheckedAt", "recordRefCount", "lastNotifiedAt");
+
+      runtime.asSystem(() -> AlertsDb.update(AlertsMonitor.TABLE_NAME, new QRecord().withValue("id", monitorId).withValue("name", "Broken widgets (renamed)")));
+      runtime.asSystem(() -> AlertsDb.update(AlertsMonitor.TABLE_NAME, new QRecord().withValue("id", monitorId).withValue("enabled", false).withValue("nextRunAt", null)));
+      assertThat(edits(AlertsMonitor.TABLE_NAME)).hasSize(2);
+      assertThat(editedFields(AlertsMonitor.TABLE_NAME)).contains("name", "enabled");
+
+      QRecord alert = where(AlertsAlert.TABLE_NAME, AlertsDb.eq("monitorId", monitorId)).get(0);
+      runtime.getEngine().acknowledge(alert.getValueInteger("id"), ADMIN);
+      assertThat(editedFields(AlertsAlert.TABLE_NAME)).contains("status");
+   }
+}

src/test/java/com/kingsrook/qbits/alerts/home/AlertsSetupTest.java

@@ -0,0 +1,105 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts.home;
+
+
+import java.util.List;
+import com.kingsrook.qbits.alerts.BaseAlertsTest;
+import com.kingsrook.qbits.alerts.engine.AlertsDb;
+import com.kingsrook.qbits.alerts.home.AlertsSetupStatus.Item;
+import com.kingsrook.qbits.alerts.home.AlertsSetupStatus.State;
+import com.kingsrook.qbits.alerts.model.AlertsChannel;
+import com.kingsrook.qbits.alerts.model.AlertsGroup;
+import com.kingsrook.qbits.alerts.model.AlertsSubscription;
+import com.kingsrook.qbits.alerts.model.AlertsTeam;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** The Setup card: states follow the real configuration, and the home widget
+ ** renders for admins only.
+ *******************************************************************************/
+class AlertsSetupTest extends BaseAlertsTest
+{
+
+   /*******************************************************************************
+    **
+    *******************************************************************************/
+   private Item item(String label) throws Exception
+   {
+      return (AlertsSetupStatus.load(runtime, clock.instant()).stream().filter(i -> i.label().equals(label)).findFirst().orElseThrow());
+   }
+
+
+
+   /*******************************************************************************
+    ** A fresh install: defaults channels, nobody subscribed, no scheduler.
+    *******************************************************************************/
+   @Test
+   void freshInstallNeedsSubscriptionsAndAScheduler() throws Exception
+   {
+      runtime.getTypeSync().syncIfNeeded();
+      assertThat(item("Channels").state()).isEqualTo(State.DEFAULT);
+      assertThat(item("Alert types").state()).isEqualTo(State.OK);
+      assertThat(item("Subscriptions").state()).isEqualTo(State.TODO);
+      assertThat(item("Scheduler").state()).isEqualTo(State.TODO);
+      assertThat(item("Teams").state()).isEqualTo(State.OPTIONAL);
+      assertThat(item("Groups").state()).isEqualTo(State.OPTIONAL);
+      assertThat(AlertsSetupStatus.load(runtime, clock.instant())).allMatch(i -> i.tableName() == null || i.tableName().startsWith("alerts_"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Configuring a part moves its line.
+    *******************************************************************************/
+   @Test
+   void configuringMovesTheState() throws Exception
+   {
+      runtime.getTypeSync().syncIfNeeded();
+      runtime.getChannels().ensureDefaults();
+      assertThat(item("Channels").state()).isEqualTo(State.OK);
+
+      runtime.asSystem(() -> AlertsDb.insert(AlertsSubscription.TABLE_NAME, new QRecord().withValue("subscriberType", "USER").withValue("userId", "u")
+         .withValue("scopeType", "ALL").withValue("minSeverity", "ERROR").withValue("enabled", true)));
+      assertThat(item("Subscriptions").state()).isEqualTo(State.OK);
+
+      Integer team = runtime.asSystem(() -> AlertsDb.insert(AlertsTeam.TABLE_NAME, new QRecord().withValue("name", "t").withValue("label", "T")).getValueInteger("id"));
+      QRecord group = runtime.asSystem(() -> AlertsDb.first(AlertsGroup.TABLE_NAME, new com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter()));
+      runtime.asSystem(() -> AlertsDb.update(AlertsGroup.TABLE_NAME, new QRecord().withValue("id", group.getValue("id")).withValue("ownerTeamId", team)));
+      assertThat(item("Groups").state()).isEqualTo(State.OK);
+      assertThat(item("Teams").state()).isEqualTo(State.OK);
+
+      runtime.asSystem(() -> AlertsDb.update(AlertsChannel.TABLE_NAME, new QRecord().withValue("id", 1).withValue("healthStatus", "UNHEALTHY")));
+      assertThat(item("Channels").state()).isEqualTo(State.TODO);
+   }
+
+
+
+   /*******************************************************************************
+    ** The widget renders the card for an admin, with links to the tables.
+    *******************************************************************************/
+   @Test
+   void widgetRendersForAdmins() throws Exception
+   {
+      runtime.getTypeSync().syncIfNeeded();
+      String html = ((com.kingsrook.qqq.backend.core.model.dashboard.widgets.RawHTML) AlertsHome.load(AlertsHome.KIND_SETUP, runtime)).getHtml();
+      assertThat(html).contains("Needs setup").contains("href=\"/app/alerts_subscription\"").contains("Next: ").contains("attention");
+   }
+}

src/test/java/com/kingsrook/qbits/alerts/metadata/ChildListWidgetsJsonTest.java

@@ -0,0 +1,128 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts.metadata;
+
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import com.kingsrook.qbits.alerts.BaseAlertsTest;
+import com.kingsrook.qbits.alerts.model.AlertsNotification;
+import com.kingsrook.qqq.backend.core.actions.dashboard.RenderWidgetAction;
+import com.kingsrook.qqq.backend.core.actions.dashboard.widgets.ChildRecordListRenderer;
+import com.kingsrook.qqq.backend.core.alerts.NotificationAudience;
+import com.kingsrook.qqq.backend.core.alerts.NotificationCategory;
+import com.kingsrook.qqq.backend.core.alerts.NotificationSeverity;
+import com.kingsrook.qqq.backend.core.alerts.NotificationSignal;
+import com.kingsrook.qqq.backend.core.alerts.QAlerts;
+import com.kingsrook.qqq.backend.core.model.actions.widgets.RenderWidgetInput;
+import com.kingsrook.qqq.backend.core.model.dashboard.widgets.ChildRecordListData;
+import com.kingsrook.qqq.backend.core.model.dashboard.widgets.QWidgetData;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.dashboard.QWidgetMetaDataInterface;
+import com.kingsrook.qqq.backend.core.utils.JsonUtils;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+/*******************************************************************************
+ ** The record-view child lists serialize to JSON (the payload the record page
+ ** fetches). The child table's meta-data carries the qbit config, whose
+ ** runtime points back at the config: unless that back-reference is ignored,
+ ** Jackson recurses until its nesting limit ("Error in JSON Serialization").
+ *******************************************************************************/
+class ChildListWidgetsJsonTest extends BaseAlertsTest
+{
+
+   /*******************************************************************************
+    ** The qbit config itself serializes, without its runtime.
+    *******************************************************************************/
+   @Test
+   void testConfigSerializesWithoutRuntime()
+   {
+      assertThat(config.getRuntime()).isNotNull();
+      assertThat(JsonUtils.toJson(config)).doesNotContain("\"runtime\"").doesNotContain("\"audienceResolver\"");
+   }
+
+
+
+   /*******************************************************************************
+    ** A notification's Recipients list, with recipient rows (the kof22 case).
+    *******************************************************************************/
+   @Test
+   void testRecipientsChildListSerializes() throws Exception
+   {
+      QAlerts.notify(new NotificationSignal("Run backup now finished with errors").withSeverity(NotificationSeverity.ERROR)
+         .withCategory(NotificationCategory.JOB).withAudience(NotificationAudience.users(VIEWER, ADMIN)));
+      QRecord notification = runtime.asSystem(() -> all(AlertsNotification.TABLE_NAME)).get(0);
+
+      loginAs(ADMIN);
+      QWidgetMetaDataInterface widget = qInstance.getWidget(AlertsTableMetaDataHelper.JOIN_NOTIFICATION_RECIPIENT);
+      assertThat(widget).isNotNull();
+
+      ChildRecordListData data = (ChildRecordListData) render(widget, notification.getValue("id"));
+      assertThat(data.getQueryOutput().getRecords()).hasSize(2);
+
+      String json = JsonUtils.toJson(data);
+      assertThat(json).contains("\"totalRows\":2").doesNotContain("\"runtime\"");
+   }
+
+
+
+   /*******************************************************************************
+    ** Every child list in the qbit (rendered without a parent, as on an insert
+    ** screen, which still sends the child table's meta-data).
+    *******************************************************************************/
+   @Test
+   void testEveryChildListSerializes() throws Exception
+   {
+      loginAs(ADMIN);
+      List<String> rendered = new ArrayList<>();
+      for(QWidgetMetaDataInterface widget : qInstance.getWidgets().values())
+      {
+         if(widget.getCodeReference() != null && ChildRecordListRenderer.class.getName().equals(widget.getCodeReference().getName()))
+         {
+            String json = JsonUtils.toJson(render(widget, null));
+            assertThat(json).as(widget.getName()).contains("\"childTableMetaData\"").doesNotContain("\"runtime\"");
+            rendered.add(widget.getName());
+         }
+      }
+      assertThat(rendered).contains(AlertsTableMetaDataHelper.JOIN_NOTIFICATION_RECIPIENT).hasSizeGreaterThan(5);
+   }
+
+
+
+   /*******************************************************************************
+    ** Render a child-list widget as the record page does (its default values as
+    ** query params, plus the parent id when there is one).
+    *******************************************************************************/
+   private QWidgetData render(QWidgetMetaDataInterface widget, Serializable id) throws Exception
+   {
+      Map<String, String> params = new HashMap<>();
+      widget.getDefaultValues().forEach((key, value) -> params.put(key, value == null ? null : String.valueOf(value)));
+      if(id != null)
+      {
+         params.put("id", String.valueOf(id));
+      }
+
+      RenderWidgetInput input = new RenderWidgetInput().withWidgetMetaData(widget);
+      input.setQueryParams(params);
+      return (new RenderWidgetAction().execute(input).getWidgetData());
+   }
+}

src/test/java/com/kingsrook/qbits/alerts/notifications/NotificationEmailAndNoticesTest.java

@@ -18,17 +18,21 @@
 package com.kingsrook.qbits.alerts.notifications;
 
 
+import java.time.Duration;
 import java.time.Instant;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.CopyOnWriteArrayList;
 import com.kingsrook.qbits.alerts.AlertsPreferences;
 import com.kingsrook.qbits.alerts.AlertsQBitConfig;
 import com.kingsrook.qbits.alerts.BaseAlertsTest;
+import com.kingsrook.qbits.alerts.api.AlertsApi;
 import com.kingsrook.qbits.alerts.engine.AlertsDb;
 import com.kingsrook.qbits.alerts.model.AlertsNotification;
 import com.kingsrook.qbits.alerts.model.AlertsNotificationPreference;
 import com.kingsrook.qbits.alerts.model.AlertsNotificationRecipient;
 import com.kingsrook.qbits.alerts.model.AlertsUserPreference;
+import com.kingsrook.qqq.backend.core.actions.tables.InsertAction;
 import com.kingsrook.qqq.backend.core.alerts.AlertLink;
 import com.kingsrook.qqq.backend.core.alerts.NotificationAudience;
 import com.kingsrook.qqq.backend.core.alerts.NotificationCategory;
@@ -39,6 +43,7 @@ import com.kingsrook.qqq.backend.core.exceptions.QException;
 import com.kingsrook.qqq.backend.core.model.actions.messaging.Content;
 import com.kingsrook.qqq.backend.core.model.actions.messaging.SendMessageInput;
 import com.kingsrook.qqq.backend.core.model.actions.messaging.SendMessageOutput;
+import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.model.metadata.messaging.QMessagingProviderMetaData;
 import com.kingsrook.qqq.backend.core.modules.messaging.MessagingProviderInterface;
@@ -167,6 +172,232 @@ class NotificationEmailAndNoticesTest extends BaseAlertsTest
 
 
 
+   /*******************************************************************************
+    ** A requested email does not require a standing category preference.
+    *******************************************************************************/
+   @Test
+   void testRequestedWithoutPreference() throws Exception
+   {
+      addressOnly();
+      requested("JOB");
+      assertThat(new NotificationEmailer(runtime).run().sent()).isEqualTo(1);
+      assertThat(emailStatus("viewer-1")).isEqualTo("SENT");
+      assertThat(new NotificationEmailer(runtime).run().sent()).isZero();
+      assertThat(SENT).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** An explicit request and an immediate preference still send only once.
+    *******************************************************************************/
+   @Test
+   void testRequestedWithImmediatePreference() throws Exception
+   {
+      emailSettings("viewer-1", "JOB", "IMMEDIATE", "INFO");
+      requested("JOB");
+      assertThat(new NotificationEmailer(runtime).run().sent()).isEqualTo(1);
+      assertThat(new NotificationEmailer(runtime).run().sent()).isZero();
+      assertThat(SENT).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** A request overrides digest timing (not the category's minimum severity).
+    *******************************************************************************/
+   @Test
+   void testRequestedWithDigestPreference() throws Exception
+   {
+      emailSettings("viewer-1", "JOB", "DAILY_DIGEST", "INFO");
+      requested("JOB");
+      NotificationEmailer.Result result = new NotificationEmailer(runtime).run();
+      assertThat(result.sent()).isEqualTo(1);
+      assertThat(result.digests()).isZero();
+      assertThat(SENT).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** Knowing an address alone does not opt a notification into email.
+    *******************************************************************************/
+   @Test
+   void testNotRequestedWithoutPreference() throws Exception
+   {
+      addressOnly();
+      runtime.getNotifications().notify(new NotificationSignal("Done").withCategory(NotificationCategory.JOB)
+         .withAudience(NotificationAudience.user("viewer-1")));
+      assertThat(new NotificationEmailer(runtime).run().sent()).isZero();
+      assertThat(emailStatus("viewer-1")).isEqualTo("NONE");
+      assertThat(SENT).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Missing addresses are skipped rather than counted as delivery failures.
+    *******************************************************************************/
+   @Test
+   void testRequestedWithoutAddress() throws Exception
+   {
+      requested("JOB");
+      NotificationEmailer.Result result = new NotificationEmailer(runtime).run();
+      assertThat(result.skipped()).isEqualTo(1);
+      assertThat(result.failed()).isZero();
+      assertThat(emailStatus("viewer-1")).isEqualTo("SKIPPED");
+      assertThat(SENT).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Alert subscriptions own alert emails, even with an explicit request.
+    *******************************************************************************/
+   @Test
+   void testRequestedAlertNeverEmailed() throws Exception
+   {
+      emailSettings("viewer-1", "ALERT", "IMMEDIATE", "INFO");
+      requested("ALERT");
+      assertThat(new NotificationEmailer(runtime).run().skipped()).isEqualTo(1);
+      assertThat(emailStatus("viewer-1")).isEqualTo("SKIPPED");
+      assertThat(SENT).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Requests older than the delivery window are not emailed.
+    *******************************************************************************/
+   @Test
+   void testRequestedOutsideDeliveryWindow() throws Exception
+   {
+      addressOnly();
+      requested("JOB");
+      clock.set(clock.instant().plusSeconds(86401));
+      assertThat(new NotificationEmailer(runtime).run().sent()).isZero();
+      assertThat(emailStatus("viewer-1")).isEqualTo("REQUESTED");
+      assertThat(SENT).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Provider failures remain terminal and do not cause repeated sends.
+    *******************************************************************************/
+   @Test
+   void testRequestedDeliveryFailure() throws Exception
+   {
+      addressOnly();
+      requested("JOB");
+      runtime.getConfig().withMessagingProviderName("missing-provider");
+      NotificationEmailer.Result result = new NotificationEmailer(runtime).run();
+      assertThat(result.failed()).isEqualTo(1);
+      assertThat(emailStatus("viewer-1")).isEqualTo("FAILED");
+      assertThat(new NotificationEmailer(runtime).run().failed()).isZero();
+      assertThat(SENT).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** A request still honours the category's email minimum severity.
+    *******************************************************************************/
+   @Test
+   void testRequestedBelowMinSeverity() throws Exception
+   {
+      emailSettings("viewer-1", "JOB", "OFF", "ERROR");
+      requested("JOB");
+      NotificationEmailer.Result result = new NotificationEmailer(runtime).run();
+      assertThat(result.skipped()).isEqualTo(1);
+      assertThat(emailStatus("viewer-1")).isEqualTo("SKIPPED");
+      assertThat(SENT).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** A user's pause or quiet hours hold a requested email until they end.
+    *******************************************************************************/
+   @Test
+   void testRequestedHeldByPauseAndQuietHours() throws Exception
+   {
+      clock.set(Instant.parse("2026-10-12T12:00:00Z"));
+      addressOnly();
+      requested("JOB");
+      setUserPreference(new QRecord().withValue("pausedUntil", clock.instant().plusSeconds(3600)));
+      assertThat(new NotificationEmailer(runtime).run().sent()).isZero();
+      assertThat(emailStatus("viewer-1")).isEqualTo("REQUESTED");
+
+      clock.set(Instant.parse("2026-10-12T13:30:00Z"));
+      setUserPreference(new QRecord().withValue("timeZone", "UTC").withValue("quietHoursStart", "13:00").withValue("quietHoursEnd", "14:00"));
+      assertThat(new NotificationEmailer(runtime).run().sent()).isZero();
+      assertThat(emailStatus("viewer-1")).isEqualTo("REQUESTED");
+
+      clock.set(Instant.parse("2026-10-12T14:00:00Z"));
+      assertThat(new NotificationEmailer(runtime).run().sent()).isEqualTo(1);
+      assertThat(emailStatus("viewer-1")).isEqualTo("SENT");
+      assertThat(SENT).hasSize(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** A pause does not hold a requested SECURITY email.
+    *******************************************************************************/
+   @Test
+   void testRequestedSecurityBypassesPause() throws Exception
+   {
+      addressOnly();
+      requested("SECURITY");
+      setUserPreference(new QRecord().withValue("pausedUntil", clock.instant().plusSeconds(3600)));
+      assertThat(new NotificationEmailer(runtime).run().sent()).isEqualTo(1);
+   }
+
+
+
+   /*******************************************************************************
+    ** Update the user's alert settings row.
+    *******************************************************************************/
+   private void setUserPreference(QRecord values) throws QException
+   {
+      runtime.asSystem(() ->
+      {
+         QRecord setting = AlertsDb.first(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", "viewer-1"));
+         return (AlertsDb.update(AlertsUserPreference.TABLE_NAME, values.withValue("id", setting.getValue("id"))));
+      });
+   }
+
+
+
+   /*******************************************************************************
+    ** Store an address without opting into any category.
+    *******************************************************************************/
+   private void addressOnly() throws QException
+   {
+      runtime.asSystem(() -> AlertsDb.insert(AlertsUserPreference.TABLE_NAME,
+         new QRecord().withValue("userId", "viewer-1").withValue("emailAddress", "viewer-1@example.com")));
+   }
+
+
+
+   /*******************************************************************************
+    ** Set up a recipient explicitly requesting email for worker tests.
+    *******************************************************************************/
+   private void requested(String category) throws QException
+   {
+      Integer id = runtime.getNotifications().notify(new NotificationSignal("Done").withCategory(NotificationCategory.valueOf(category))
+         .withAudience(NotificationAudience.user("viewer-1")));
+      runtime.asSystem(() ->
+      {
+         QRecord recipient = AlertsDb.first(AlertsNotificationRecipient.TABLE_NAME, AlertsDb.eq("notificationId", id));
+         return (AlertsDb.update(AlertsNotificationRecipient.TABLE_NAME,
+            new QRecord().withValue("id", recipient.getValue("id")).withValue("emailStatus", "REQUESTED")));
+      });
+   }
+
+
+
    /*******************************************************************************
     ** The daily digest waits for the user's hour, then lists the unread ones.
     *******************************************************************************/
@@ -218,4 +449,80 @@ class NotificationEmailAndNoticesTest extends BaseAlertsTest
       assertThat(SENT).hasSize(4);
       assertThat(SENT).noneMatch(message -> text(message).contains("change your password"));
    }
+
+
+
+   /*******************************************************************************
+    ** Pauses defer immediate and digest mail past a day without hiding the inbox;
+    ** SECURITY still sends in both email modes.
+    *******************************************************************************/
+   @Test
+   void testPausedEmail() throws Exception
+   {
+      emailSettings("viewer-1", "JOB", "IMMEDIATE", "INFO");
+      emailSettings("viewer-1", "SECURITY", "IMMEDIATE", "INFO");
+      emailSettings("viewer-2", "JOB", "DAILY_DIGEST", "INFO");
+      emailSettings("viewer-2", "SECURITY", "DAILY_DIGEST", "INFO");
+      runtime.asSystem(() ->
+      {
+         for(QRecord setting : all(AlertsUserPreference.TABLE_NAME))
+         {
+            AlertsDb.update(AlertsUserPreference.TABLE_NAME, new QRecord().withValue("id", setting.getValue("id"))
+               .withValue("pausedUntil", clock.instant().plus(Duration.ofDays(2))));
+         }
+         return (null);
+      });
+      for(NotificationCategory category : List.of(NotificationCategory.JOB, NotificationCategory.SECURITY))
+      {
+         runtime.getNotifications().notify(new NotificationSignal(category.name()).withCategory(category).withAudience(NotificationAudience.users("viewer-1", "viewer-2")));
+      }
+      NotificationEmailer.Result paused = new NotificationEmailer(runtime).run();
+      assertThat(paused.sent()).isEqualTo(1);
+      assertThat(paused.digests()).isEqualTo(1);
+      assertThat(paused.skipped()).isEqualTo(2);
+      assertThat(SENT).hasSize(2).allSatisfy(message -> assertThat(text(message)).contains("SECURITY").doesNotContain("JOB"));
+      assertThat(all(AlertsNotificationRecipient.TABLE_NAME)).filteredOn(row -> row.getValueInstant("emailedAt") == null).hasSize(2)
+         .allSatisfy(row -> assertThat(row.getValueString("emailStatus")).isEqualTo("NONE"));
+      assertThat(new AlertsApi(runtime).inboxSummary()).containsEntry("unreadCount", 2);
+      clock.advance(Duration.ofDays(2));
+      NotificationEmailer.Result resumed = new NotificationEmailer(runtime).run();
+      assertThat(resumed.sent()).isEqualTo(1);
+      assertThat(resumed.digests()).isEqualTo(1);
+      assertThat(SENT).hasSize(4);
+      assertThat(all(AlertsNotificationRecipient.TABLE_NAME)).allSatisfy(row -> assertThat(row.getValueInstant("emailedAt")).isNotNull());
+      assertThat(new NotificationEmailer(runtime).run().sent()).isZero();
+   }
+
+
+
+   /*******************************************************************************
+    ** A full scan page of paused recipients cannot starve a later security notice.
+    *******************************************************************************/
+   @Test
+   void testPausedBacklogDoesNotBlockSecurity() throws Exception
+   {
+      emailSettings(VIEWER, "JOB", "IMMEDIATE", "INFO");
+      emailSettings(VIEWER, "SECURITY", "IMMEDIATE", "INFO");
+      runtime.asSystem(() ->
+      {
+         QRecord settings = AlertsDb.first(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", VIEWER));
+         AlertsDb.update(AlertsUserPreference.TABLE_NAME, new QRecord().withValue("id", settings.getValue("id"))
+            .withValue("pausedUntil", clock.instant().plusSeconds(3600)));
+         List<QRecord> notifications = new ArrayList<>();
+         for(int i = 0; i < NotificationEmailer.SCAN; i++)
+         {
+            notifications.add(new QRecord().withValue("title", "Paused job " + i).withValue("category", "JOB").withValue("status", "SENT"));
+         }
+         notifications = InsertAction.executeForRecords(
+            new InsertInput(AlertsNotification.TABLE_NAME).withRecords(notifications));
+         List<QRecord> recipients = notifications.stream().map(notification -> new QRecord().withValue("notificationId", notification.getValue("id"))
+            .withValue("userId", VIEWER).withValue("deliveredAt", clock.instant())).toList();
+         InsertAction.executeForRecords(
+            new InsertInput(AlertsNotificationRecipient.TABLE_NAME).withRecords(recipients));
+         return (null);
+      });
+      runtime.getNotifications().notify(new NotificationSignal("Security after backlog").withCategory(NotificationCategory.SECURITY).withAudience(NotificationAudience.user(VIEWER)));
+      assertThat(new NotificationEmailer(runtime).run().sent()).isEqualTo(1);
+      assertThat(SENT).singleElement().satisfies(message -> assertThat(message.getSubject()).isEqualTo("Security after backlog"));
+   }
 }

src/test/java/com/kingsrook/qbits/alerts/notifications/NotificationSlackTest.java

@@ -18,8 +18,10 @@
 package com.kingsrook.qbits.alerts.notifications;
 
 
+import java.time.Duration;
 import java.time.Instant;
 import java.util.List;
+import java.util.Set;
 import java.util.concurrent.CopyOnWriteArrayList;
 import com.kingsrook.qbits.alerts.AlertsPreferences;
 import com.kingsrook.qbits.alerts.AlertsQBitConfig;
@@ -41,6 +43,7 @@ import com.kingsrook.qqq.backend.core.model.actions.messaging.SendMessageInput;
 import com.kingsrook.qqq.backend.core.model.actions.messaging.SendMessageOutput;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.model.metadata.messaging.QMessagingProviderMetaData;
+import com.kingsrook.qqq.backend.core.modules.messaging.MessagingProviderCapability;
 import com.kingsrook.qqq.backend.core.modules.messaging.MessagingProviderInterface;
 import com.kingsrook.qqq.backend.core.modules.messaging.QMessagingProviderDispatcher;
 import org.junit.jupiter.api.Test;
@@ -56,6 +59,7 @@ class NotificationSlackTest extends BaseAlertsTest
    static final List<SendMessageInput> SENT = new CopyOnWriteArrayList<>();
 
    static volatile String failureMode = "NONE";
+   static boolean idempotency;
 
 
 
@@ -75,6 +79,17 @@ class NotificationSlackTest extends BaseAlertsTest
 
 
 
+      /*******************************************************************************
+       ** Advertise optional provider deduplication.
+       *******************************************************************************/
+      @Override
+      public Set<MessagingProviderCapability> getCapabilities()
+      {
+         return (idempotency ? Set.of(MessagingProviderCapability.IDEMPOTENCY) : Set.of());
+      }
+
+
+
       /*******************************************************************************
        **
        *******************************************************************************/
@@ -106,6 +121,7 @@ class NotificationSlackTest extends BaseAlertsTest
       qInstance.addMessagingProvider(new QMessagingProviderMetaData().withName("slack").withType("alerts-slack-capture"));
       SENT.clear();
       failureMode = "NONE";
+      idempotency = false;
    }
 
 
@@ -186,6 +202,7 @@ class NotificationSlackTest extends BaseAlertsTest
          assertThat(message.getMessagingProviderName()).isEqualTo("slack");
          assertThat(message.getTo().getAddress()).isEqualTo("user:viewer-1");
          assertThat(message.getSubject()).isEqualTo("Export failed");
+         assertThat(message.getIdempotencyKey()).isNull();
          assertThat(text(message)).contains("Export failed").contains("Disk full").contains("https://admin.example.com/app/widget");
       });
       assertThat(slackStatus("viewer-1")).isEqualTo("SENT");
@@ -199,6 +216,22 @@ class NotificationSlackTest extends BaseAlertsTest
 
 
 
+   /*******************************************************************************
+    ** Capable providers receive a stable key for immediate notifications.
+    *******************************************************************************/
+   @Test
+   void testIdempotencyKey() throws Exception
+   {
+      idempotency = true;
+      slackSettings("viewer-1", "JOB", "IMMEDIATE", "WARNING", null);
+      notifyJob("Export failed", NotificationSeverity.WARNING, "viewer-1");
+      assertThat(new NotificationSlackSender(runtime).run().sent()).isEqualTo(1);
+      assertThat(SENT).singleElement().satisfies(message ->
+         assertThat(message.getIdempotencyKey()).matches("notify:[0-9]+:viewer-1:slack"));
+   }
+
+
+
    /*******************************************************************************
     ** A category muted in-app gets no recipient row, so no Slack message.
     *******************************************************************************/
@@ -254,6 +287,44 @@ class NotificationSlackTest extends BaseAlertsTest
       assertThat(new NotificationSlackSender(runtime).run().held()).isEqualTo(1);
       assertThat(SENT).isEmpty();
       assertThat(slackStatus("viewer-1")).isEqualTo("NONE");
+      clock.advance(Duration.ofDays(2));
+      assertThat(new NotificationSlackSender(runtime).run().sent()).isEqualTo(1);
+      assertThat(slackStatus("viewer-1")).isEqualTo("SENT");
+   }
+
+
+
+   /*******************************************************************************
+    ** Pauses hold JOB items in both Slack modes, even in a digest containing
+    ** SECURITY. After two days every held item is delivered exactly once.
+    *******************************************************************************/
+   @Test
+   void testPausedSecurityAndMixedDigest() throws Exception
+   {
+      clock.set(Instant.parse("2026-10-12T12:05:00Z"));
+      for(String userId : List.of("viewer-1", "viewer-2"))
+      {
+         String mode = "viewer-1".equals(userId) ? "IMMEDIATE" : "DAILY_DIGEST";
+         QRecord paused = new QRecord().withValue("pausedUntil", clock.instant().plus(Duration.ofDays(2)));
+         slackSettings(userId, "JOB", mode, "INFO", paused);
+         slackSettings(userId, "SECURITY", mode, "INFO", paused);
+      }
+      for(NotificationCategory category : List.of(NotificationCategory.JOB, NotificationCategory.SECURITY))
+      {
+         QAlerts.notify(new NotificationSignal(category.name()).withCategory(category).withSeverity(NotificationSeverity.CRITICAL)
+            .withAudience(NotificationAudience.users("viewer-1", "viewer-2")));
+      }
+      NotificationSlackSender.Result paused = new NotificationSlackSender(runtime).run();
+      assertThat(paused.sent()).isEqualTo(1);
+      assertThat(paused.digests()).isEqualTo(1);
+      assertThat(paused.held()).isEqualTo(2);
+      assertThat(SENT).hasSize(2).allSatisfy(message -> assertThat(text(message)).contains("SECURITY").doesNotContain("JOB"));
+      clock.advance(Duration.ofDays(2));
+      NotificationSlackSender.Result resumed = new NotificationSlackSender(runtime).run();
+      assertThat(resumed.sent()).isEqualTo(1);
+      assertThat(resumed.digests()).isEqualTo(1);
+      assertThat(SENT).hasSize(4);
+      assertThat(new NotificationSlackSender(runtime).run()).isEqualTo(new NotificationSlackSender.Result(0, 0, 0, 0, 0));
    }
 
 

src/test/java/com/kingsrook/qbits/alerts/notifications/NotificationsTest.java

@@ -534,4 +534,37 @@ class NotificationsTest extends BaseAlertsTest
       new DeleteAction().execute(new DeleteInput(AlertsNotification.TABLE_NAME).withPrimaryKeys(List.of(other)));
       assertThat(runtime.asSystem(() -> all(AlertsNotificationRecipient.TABLE_NAME))).isEmpty();
    }
+
+
+
+   /*******************************************************************************
+    ** In-app severity is inclusive; null means all, and SECURITY always arrives.
+    *******************************************************************************/
+   @Test
+   void testInAppMinimumSeverity() throws Exception
+   {
+      runtime.asSystem(() ->
+      {
+         AlertsDb.insert(AlertsNotificationPreference.TABLE_NAME, new QRecord().withValue("userId", VIEWER).withValue("category", "JOB").withValue("inAppMinSeverity", "ERROR"));
+         AlertsDb.insert(AlertsNotificationPreference.TABLE_NAME, new QRecord().withValue("userId", VIEWER).withValue("category", "SECURITY")
+            .withValue("inAppMuted", true).withValue("inAppMinSeverity", "CRITICAL"));
+         return (null);
+      });
+      for(NotificationSeverity severity : List.of(NotificationSeverity.WARNING, NotificationSeverity.ERROR, NotificationSeverity.CRITICAL))
+      {
+         runtime.getNotifications().notify(new NotificationSignal("Job " + severity).withSeverity(severity).withCategory(NotificationCategory.JOB)
+            .withAudience(NotificationAudience.users(VIEWER, "viewer-2")));
+      }
+      runtime.getNotifications().notify(new NotificationSignal("Security info").withCategory(NotificationCategory.SECURITY).withAudience(NotificationAudience.user(VIEWER)));
+      assertThat(where(AlertsNotificationRecipient.TABLE_NAME, AlertsDb.eq("userId", VIEWER))).hasSize(3);
+      assertThat(where(AlertsNotificationRecipient.TABLE_NAME, AlertsDb.eq("userId", "viewer-2"))).hasSize(3);
+      loginAs(VIEWER);
+      QRecord preference = where(AlertsNotificationPreference.TABLE_NAME, AlertsDb.eq("userId", VIEWER)).stream()
+         .filter(row -> "JOB".equals(row.getValueString("category"))).findFirst().orElseThrow();
+      assertThat(new UpdateAction().execute(new UpdateInput(AlertsNotificationPreference.TABLE_NAME).withRecord(new QRecord().withValue("id", preference.getValue("id"))
+         .withValue("category", "SECURITY"))).getRecords().get(0).getErrors()).isNotEmpty();
+      AlertsDb.update(AlertsNotificationPreference.TABLE_NAME, new QRecord().withValue("id", preference.getValue("id")).withValue("inAppMinSeverity", null));
+      runtime.getNotifications().notify(new NotificationSignal("Job info").withCategory(NotificationCategory.JOB).withAudience(NotificationAudience.user(VIEWER)));
+      assertThat(where(AlertsNotificationRecipient.TABLE_NAME, AlertsDb.eq("userId", VIEWER))).hasSize(4);
+   }
 }

src/test/java/com/kingsrook/qbits/alerts/preferences/NotificationPreferencesTest.java

@@ -0,0 +1,262 @@
+/*
+ * Copyright 2026 Kingsrook, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.kingsrook.qbits.alerts.preferences;
+
+
+import java.io.Serializable;
+import java.sql.Connection;
+import java.sql.Statement;
+import java.time.Instant;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import com.kingsrook.qbits.alerts.AlertsQBitConfig;
+import com.kingsrook.qbits.alerts.AlertsQBitProducer;
+import com.kingsrook.qbits.alerts.BaseAlertsTest;
+import com.kingsrook.qbits.alerts.api.AlertsApi;
+import com.kingsrook.qbits.alerts.engine.AlertsDb;
+import com.kingsrook.qbits.alerts.model.AlertsNotificationPreference;
+import com.kingsrook.qbits.alerts.model.AlertsSubscription;
+import com.kingsrook.qbits.alerts.model.AlertsUserPreference;
+import com.kingsrook.qqq.backend.core.actions.preferences.UserPreferencesAction;
+import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.exceptions.QBadRequestException;
+import com.kingsrook.qqq.backend.core.exceptions.QNotFoundException;
+import com.kingsrook.qqq.backend.core.instances.QInstanceEnricher;
+import com.kingsrook.qqq.backend.core.model.audits.AuditsMetaDataProvider;
+import com.kingsrook.qqq.backend.core.model.data.QRecord;
+import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput;
+import com.kingsrook.qqq.backend.core.model.metadata.messaging.QMessagingProviderMetaData;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceChange;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceRequestContext;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferenceRowChange;
+import com.kingsrook.qqq.backend.core.model.metadata.preferences.UserPreferencesMetaData;
+import com.kingsrook.qqq.backend.module.rdbms.jdbc.ConnectionManager;
+import com.kingsrook.qqq.backend.module.rdbms.model.metadata.RDBMSBackendMetaData;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+
+/*******************************************************************************
+ ** Real core action round trips, ownership, validation and field auditing.
+ *******************************************************************************/
+class NotificationPreferencesTest extends BaseAlertsTest
+{
+   private final UserPreferencesAction action = new UserPreferencesAction();
+
+
+
+   /*******************************************************************************
+    ** Defaults, all settings, partial changes and isolation persist in real tables.
+    *******************************************************************************/
+   @Test
+   void roundTrip() throws Exception
+   {
+      QRecord mine = subscription(VIEWER, "USER", "ALL");
+      QRecord other = subscription("viewer-2", "USER", "GROUP");
+      subscription(VIEWER, "TEAM", "ALL");
+      loginAs("viewer-2");
+      action.patchSection("notifications", Map.of("values", Map.of("digestHour", 7), "lists", Map.of("categories", List.of(row("JOB", Map.of("emailMode", "IMMEDIATE"))))));
+      Map<String, Serializable> otherSettings = new HashMap<>(all(AlertsUserPreference.TABLE_NAME).get(0).getValues());
+      Map<String, Serializable> otherCategory = new HashMap<>(all(AlertsNotificationPreference.TABLE_NAME).get(0).getValues());
+      loginAs(VIEWER).setPermissions(Set.of(AlertsQBitConfig.PERMISSION_VIEW));
+      qInstance.setEnforcePermissionsInCoreActions(true);
+      var defaults = action.getSection("notifications");
+      assertThat(defaults.getSection().getAppName()).isNull();
+      assertThat(defaults.getValues().getValues()).containsEntry("digestHour", 8).containsEntry("alertInAppEnabled", true).containsEntry("alertEmailEnabled", true);
+      assertThat(defaults.getValues().getLists().get("categories")).hasSize(7).allSatisfy(category ->
+      {
+         assertThat(category.getValues()).containsEntry("inApp", true).containsEntry("inAppMinSeverity", "INFO").containsEntry("emailMode", "OFF").containsEntry("emailMinSeverity", "WARNING");
+      });
+      assertThat(defaults.getValues().getLists().get("subscriptions")).singleElement().satisfies(rule -> assertThat(rule.getLabel()).isEqualTo("All alerts"));
+      action.patchSection("notifications", Map.of("values", Map.of("pausedUntil", "2026-11-01T12:00:00Z", "digestHour", 22, "timeZone", "America/Chicago",
+         "alertInAppEnabled", false, "alertEmailEnabled", false), "lists", Map.of(
+            "categories", List.of(row("JOB", Map.of("inApp", false, "inAppMinSeverity", "ERROR", "emailMode", "DAILY_DIGEST", "emailMinSeverity", "CRITICAL"))),
+            "subscriptions", List.of(row(mine.getValueString("id"), Map.of("enabled", false, "minSeverity", "ERROR", "deliveryMode", "DIGEST_DAILY"))))));
+      var loaded = action.getSection("notifications").getValues();
+      assertThat(loaded.getValues()).containsEntry("digestHour", 22).containsEntry("timeZone", "America/Chicago")
+         .containsEntry("pausedUntil", Instant.parse("2026-11-01T12:00:00Z")).containsEntry("alertInAppEnabled", false).containsEntry("alertEmailEnabled", false);
+      assertThat(where(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", VIEWER))).singleElement().satisfies(record ->
+         assertThat(record.getValues()).containsEntry("inAppEnabled", false).containsEntry("emailEnabled", false).containsEntry("quietBypassSeverity", "CRITICAL"));
+      assertThat(where(AlertsNotificationPreference.TABLE_NAME, AlertsDb.eq("userId", VIEWER))).singleElement().satisfies(record ->
+         assertThat(record.getValues()).containsEntry("category", "JOB").containsEntry("inAppMuted", true).containsEntry("inAppMinSeverity", "ERROR")
+            .containsEntry("emailMode", "DAILY_DIGEST").containsEntry("emailMinSeverity", "CRITICAL"));
+      assertThat(where(AlertsSubscription.TABLE_NAME, AlertsDb.eq("id", mine.getValue("id")))).singleElement().satisfies(record ->
+         assertThat(record.getValues()).containsEntry("enabled", false).containsEntry("minSeverity", "ERROR").containsEntry("deliveryMode", "DIGEST_DAILY"));
+      Map<String, Object> clearMinimum = new HashMap<>();
+      clearMinimum.put("inAppMinSeverity", null);
+      action.patchSection("notifications", Map.of("lists", Map.of("categories", List.of(row("JOB", clearMinimum)))));
+      assertThat(action.getSection("notifications").getValues().getLists().get("categories")).filteredOn(row -> row.getKey().equals("JOB"))
+         .singleElement().satisfies(row -> assertThat(row.getValues()).containsEntry("inAppMinSeverity", "INFO").containsEntry("inApp", false));
+      assertThat(where(AlertsUserPreference.TABLE_NAME, AlertsDb.eq("userId", "viewer-2")).get(0).getValues()).isEqualTo(otherSettings);
+      assertThat(where(AlertsNotificationPreference.TABLE_NAME, AlertsDb.eq("userId", "viewer-2")).get(0).getValues()).isEqualTo(otherCategory);
+      loginAs("viewer-2");
+      assertThat(action.getSection("notifications").getValues().getLists().get("subscriptions")).singleElement()
+         .satisfies(row -> assertThat(row.getKey()).isEqualTo(other.getValueString("id")));
+      assertThat(where(AlertsSubscription.TABLE_NAME, AlertsDb.eq("id", other.getValue("id"))).get(0).getValueBoolean("enabled")).isTrue();
+   }
+
+
+
+   /*******************************************************************************
+    ** Slack settings are available only with the configured provider, persist per
+    ** user and category, and remain editable for SECURITY.
+    *******************************************************************************/
+   @Test
+   void slackPreferences() throws Exception
+   {
+      var absent = action.getSection("notifications");
+      assertThat(absent.getValues().getLists().get("categories")).allSatisfy(row ->
+         assertThat(row.getValues()).doesNotContainKeys("slack", "slackMinSeverity"));
+      assertThatThrownBy(() -> action.patchSection("notifications", Map.of("lists", Map.of("categories",
+         List.of(row("JOB", Map.of("slack", "IMMEDIATE"))))))).isInstanceOf(QBadRequestException.class);
+      runtime.getConfig().withSlackProviderName("personal-slack");
+      qInstance.addMessagingProvider(new QMessagingProviderMetaData().withName("personal-slack").withType("test"));
+      UserPreferencesMetaData.of(qInstance).getSections().clear();
+      qInstance.getPossibleValueSources().remove("alerts_digest_hour");
+      AlertsNotificationPreferencesProvider.register(qInstance, runtime.getConfig());
+      loginAs(VIEWER).setPermissions(Set.of(AlertsQBitConfig.PERMISSION_VIEW));
+      qInstance.setEnforcePermissionsInCoreActions(true);
+      var defaults = action.getSection("notifications");
+      assertThat(defaults.getValues().getLists().get("categories")).allSatisfy(row ->
+         assertThat(row.getValues()).containsEntry("slack", "OFF").containsEntry("slackMinSeverity", "WARNING"));
+      action.patchSection("notifications", Map.of("lists", Map.of("categories", List.of(
+         row("JOB", Map.of("slack", "DAILY_DIGEST", "slackMinSeverity", "ERROR")),
+         row("SECURITY", Map.of("slack", "IMMEDIATE", "slackMinSeverity", "INFO"))))));
+      assertThat(action.getSection("notifications").getValues().getLists().get("categories"))
+         .filteredOn(row -> row.getKey().equals("JOB")).singleElement().satisfies(row ->
+            assertThat(row.getValues()).containsEntry("slack", "DAILY_DIGEST").containsEntry("slackMinSeverity", "ERROR"));
+      assertThat(where(AlertsNotificationPreference.TABLE_NAME, AlertsDb.eq("userId", VIEWER)))
+         .filteredOn(row -> "SECURITY".equals(row.getValueString("category"))).singleElement().satisfies(row ->
+            assertThat(row.getValues()).containsEntry("slackMode", "IMMEDIATE").containsEntry("slackMinSeverity", "INFO"));
+      action.patchSection("notifications", Map.of("lists", Map.of("categories", List.of(row("SECURITY", Map.of("slack", "OFF"))))));
+      loginAs("viewer-2");
+      assertThat(action.getSection("notifications").getValues().getLists().get("categories")).allSatisfy(row ->
+         assertThat(row.getValues()).containsEntry("slack", "OFF").containsEntry("slackMinSeverity", "WARNING"));
+   }
+
+
+
+   /*******************************************************************************
+    ** Invalid and foreign row keys fail even for admins with all-access keys.
+    *******************************************************************************/
+   @Test
+   void rejectsUnsafeChanges() throws Exception
+   {
+      QRecord other = subscription("viewer-2", "USER", "ALL");
+      QRecord team = subscription(ADMIN, "TEAM", "ALL");
+      for(String key : List.of(other.getValueString("id"), team.getValueString("id"), "99999", "bogus"))
+      {
+         assertThatThrownBy(() -> action.patchSection("notifications", Map.of("lists", Map.of("subscriptions", List.of(row(key, Map.of("enabled", false)))))))
+            .isInstanceOf(QBadRequestException.class);
+      }
+      for(String field : List.of("inApp", "inAppMinSeverity"))
+      {
+         assertThatThrownBy(() -> action.patchSection("notifications", Map.of("lists", Map.of("categories", List.of(row("SECURITY", Map.of(field, field.equals("inApp") ? false : "ERROR")))))))
+            .isInstanceOf(QBadRequestException.class).hasMessageContaining("Security notices can't be muted.");
+      }
+      assertThatThrownBy(() -> action.patchSection("notifications", Map.of("values", Map.of("timeZone", "Not/AZone")))).isInstanceOf(QBadRequestException.class);
+      assertThatThrownBy(() -> action.patchSection("notifications", Map.of("values", Map.of("digestHour", 24)))).isInstanceOf(QBadRequestException.class);
+      assertThatThrownBy(() -> action.patchSection("notifications", Map.of("userId", "viewer-2"))).isInstanceOf(QBadRequestException.class);
+      var context = new UserPreferenceRequestContext(action.getSection("notifications").getSection(), QContext.getQSession());
+      var provider = new AlertsNotificationPreferencesProvider();
+      assertThat(provider.validate(context, new UserPreferenceChange().withLists(Map.of("subscriptions", List.of(new UserPreferenceRowChange().withKey(other.getValueString("id"))))))).isNotEmpty();
+      assertThat(provider.validate(context, new UserPreferenceChange().withLists(Map.of("categories", List.of(new UserPreferenceRowChange().withKey("SECURITY").withValues(Map.of("inApp", false))))))).isNotEmpty();
+      loginAs("nobody");
+      assertThat(action.listSections()).isEmpty();
+      assertThatThrownBy(() -> action.getSection("notifications")).isInstanceOf(QNotFoundException.class);
+      assertThatThrownBy(() -> action.patchSection("notifications", Map.of())).isInstanceOf(QNotFoundException.class);
+   }
+
+
+
+   /*******************************************************************************
+    ** Registration is idempotent, configurable, and drives the inbox shortcut.
+    *******************************************************************************/
+   @Test
+   void registrationAndSummary() throws Exception
+   {
+      AlertsNotificationPreferencesProvider.register(qInstance, runtime.getConfig());
+      assertThat(UserPreferencesMetaData.of(qInstance).getSections()).hasSize(1);
+      assertThat(new AlertsApi(runtime).inboxSummary()).containsEntry("preferencesSection", "notifications");
+      assertThat(qInstance.getPossibleValueSource("alerts_digest_hour").getEnumValues()).hasSize(24);
+      assertThat(qInstance.getPossibleValueSource("alerts_digest_hour").getEnumValues().get(0).getLabel()).isEqualTo("12:00 AM");
+      assertThat(qInstance.getPossibleValueSource("alerts_digest_hour").getEnumValues().get(23).getLabel()).isEqualTo("11:00 PM");
+      UserPreferencesMetaData.of(qInstance).getSections().clear();
+      new AlertsQBitProducer().withQBitConfig(config.withPreferencesSectionEnabled(false)).postProduceActions(new MetaDataProducerMultiOutput(), qInstance);
+      assertThat(new AlertsApi(runtime).inboxSummary()).containsEntry("preferencesSection", null);
+      assertThat(action.listSections()).isEmpty();
+   }
+
+
+
+   /*******************************************************************************
+    ** Standard FIELD audits retain both user identity and client channel.
+    *******************************************************************************/
+   @Test
+   void audits() throws Exception
+   {
+      new AuditsMetaDataProvider().withClientChannelField(true).defineAll(qInstance, BACKEND_NAME, null);
+      new QInstanceEnricher(qInstance).enrich();
+      try(Connection connection = ConnectionManager.getConnection((RDBMSBackendMetaData) qInstance.getBackend(BACKEND_NAME)); Statement statement = connection.createStatement())
+      {
+         for(String table : List.of("auditDetail", "audit", "auditUser", "auditTable"))
+         {
+            statement.execute("DROP TABLE IF EXISTS " + table);
+         }
+         statement.execute("CREATE TABLE auditUser (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(200), createDate TIMESTAMP, modifyDate TIMESTAMP)");
+         statement.execute("CREATE TABLE auditTable (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(200), label VARCHAR(200), createDate TIMESTAMP, modifyDate TIMESTAMP)");
+         statement.execute("CREATE TABLE audit (id BIGINT AUTO_INCREMENT PRIMARY KEY, auditTableId INTEGER, auditUserId INTEGER, recordId INTEGER, message VARCHAR(250), timestamp TIMESTAMP, clientChannel VARCHAR(100))");
+         statement.execute("CREATE TABLE auditDetail (id BIGINT AUTO_INCREMENT PRIMARY KEY, auditId BIGINT, message VARCHAR(250), fieldName VARCHAR(100), oldValue VARCHAR(250), newValue VARCHAR(250))");
+      }
+      QRecord rule = subscription(VIEWER, "USER", "ALL");
+      loginAs(VIEWER).withClientChannel("cli/test").setPermissions(Set.of(AlertsQBitConfig.PERMISSION_VIEW));
+      qInstance.setEnforcePermissionsInCoreActions(true);
+      action.patchSection("notifications", Map.of("values", Map.of("digestHour", 17), "lists", Map.of("categories", List.of(row("JOB", Map.of("emailMode", "IMMEDIATE"))),
+         "subscriptions", List.of(row(rule.getValueString("id"), Map.of("enabled", false))))));
+      action.patchSection("notifications", Map.of("lists", Map.of("categories", List.of(row("JOB", Map.of("emailMode", "DAILY_DIGEST"))))));
+      List<QRecord> audits = all("audit").stream().filter(record -> "cli/test".equals(record.getValueString("clientChannel"))).toList();
+      assertThat(audits).hasSize(5);
+      QRecord user = where("auditUser", AlertsDb.eq("name", "Name of " + VIEWER)).get(0);
+      assertThat(audits).allSatisfy(audit -> assertThat(audit.getValue("auditUserId")).isEqualTo(user.getValue("id")));
+      assertThat(all("auditDetail")).anyMatch(detail -> "digestHour".equals(detail.getValueString("fieldName")))
+         .anyMatch(detail -> "emailMode".equals(detail.getValueString("fieldName"))).anyMatch(detail -> "enabled".equals(detail.getValueString("fieldName")));
+   }
+
+
+
+   /*******************************************************************************
+    ** A raw API row patch.
+    *******************************************************************************/
+   private Map<String, Object> row(String key, Map<String, ?> values)
+   {
+      return (Map.of("key", key, "values", values));
+   }
+
+
+
+   /*******************************************************************************
+    ** Seed a subscription as the engine would.
+    *******************************************************************************/
+   private QRecord subscription(String userId, String type, String scope) throws Exception
+   {
+      return (runtime.asSystem(() -> AlertsDb.insert(AlertsSubscription.TABLE_NAME, new QRecord().withValue("userId", userId)
+         .withValue("subscriberType", type).withValue("scopeType", scope).withValue("scopeValue", "widgets"))));
+   }
+}

src/test/resources/alerts-h2.sql

@@ -1,25 +1,25 @@
-DROP TABLE IF EXISTS alerts_escalation_step;
-DROP TABLE IF EXISTS alerts_escalation_policy;
+DROP TABLE IF EXISTS alerts_escalation_step CASCADE;
+DROP TABLE IF EXISTS alerts_escalation_policy CASCADE;
 -- H2 version of src/main/resources/db/liquibase/qbit-alerts/alerts.changelog.sql, for unit tests (generated together).
 
-DROP TABLE IF EXISTS alerts_heartbeat;
-DROP TABLE IF EXISTS alerts_inbox_item;
-DROP TABLE IF EXISTS alerts_notification_preference;
-DROP TABLE IF EXISTS alerts_notification_recipient;
-DROP TABLE IF EXISTS alerts_notification;
-DROP TABLE IF EXISTS alerts_delivery;
-DROP TABLE IF EXISTS alerts_mute;
-DROP TABLE IF EXISTS alerts_channel;
-DROP TABLE IF EXISTS alerts_team_member;
-DROP TABLE IF EXISTS alerts_team;
-DROP TABLE IF EXISTS alerts_user_preference;
-DROP TABLE IF EXISTS alerts_subscription;
-DROP TABLE IF EXISTS alerts_event;
-DROP TABLE IF EXISTS alerts_record_ref;
-DROP TABLE IF EXISTS alerts_alert;
-DROP TABLE IF EXISTS alerts_monitor;
-DROP TABLE IF EXISTS alerts_type;
-DROP TABLE IF EXISTS alerts_group;
+DROP TABLE IF EXISTS alerts_heartbeat CASCADE;
+DROP TABLE IF EXISTS alerts_inbox_item CASCADE;
+DROP TABLE IF EXISTS alerts_notification_preference CASCADE;
+DROP TABLE IF EXISTS alerts_notification_recipient CASCADE;
+DROP TABLE IF EXISTS alerts_notification CASCADE;
+DROP TABLE IF EXISTS alerts_delivery CASCADE;
+DROP TABLE IF EXISTS alerts_mute CASCADE;
+DROP TABLE IF EXISTS alerts_channel CASCADE;
+DROP TABLE IF EXISTS alerts_team_member CASCADE;
+DROP TABLE IF EXISTS alerts_team CASCADE;
+DROP TABLE IF EXISTS alerts_user_preference CASCADE;
+DROP TABLE IF EXISTS alerts_subscription CASCADE;
+DROP TABLE IF EXISTS alerts_event CASCADE;
+DROP TABLE IF EXISTS alerts_record_ref CASCADE;
+DROP TABLE IF EXISTS alerts_alert CASCADE;
+DROP TABLE IF EXISTS alerts_monitor CASCADE;
+DROP TABLE IF EXISTS alerts_type CASCADE;
+DROP TABLE IF EXISTS alerts_group CASCADE;
 
 CREATE TABLE IF NOT EXISTS alerts_group (
    id INTEGER GENERATED BY DEFAULT AS IDENTITY NOT NULL,
@@ -377,6 +377,7 @@ CREATE TABLE IF NOT EXISTS alerts_notification_preference (
    user_id VARCHAR(100) NOT NULL,
    category VARCHAR(16) NOT NULL,
    in_app_muted BOOLEAN,
+   in_app_min_severity VARCHAR(16),
    email_mode VARCHAR(16),
    email_min_severity VARCHAR(16),
    slack_mode VARCHAR(16),
@@ -440,3 +441,40 @@ ALTER TABLE alerts_group ADD COLUMN escalation_policy_id INTEGER;
 -- preconditions onFail:MARK_RAN onError:HALT
 -- precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM information_schema.columns WHERE LOWER(table_name) = 'alerts_alert' AND LOWER(column_name) = 'timed_notification_checked_at'
 ALTER TABLE alerts_alert ADD COLUMN timed_notification_checked_at TIMESTAMP;
+
+-- Foreign keys and their indexes (changesets 30-53).
+CREATE INDEX IF NOT EXISTS ix_alerts_alert_group_id ON alerts_alert (group_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_alert_assigned_team_id ON alerts_alert (assigned_team_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_type_escalation_policy_id ON alerts_type (escalation_policy_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_group_parent_group_id ON alerts_group (parent_group_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_group_owner_team_id ON alerts_group (owner_team_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_group_escalation_policy_id ON alerts_group (escalation_policy_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_delivery_alert_event_id ON alerts_delivery (alert_event_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_delivery_subscription_id ON alerts_delivery (subscription_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_subscription_team_id ON alerts_subscription (team_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_subscription_channel_id ON alerts_subscription (channel_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_escalation_step_team_id ON alerts_escalation_step (team_id);
+CREATE INDEX IF NOT EXISTS ix_alerts_escalation_step_channel_id ON alerts_escalation_step (channel_id);
+ALTER TABLE alerts_type ADD CONSTRAINT fk_alerts_type_group_id FOREIGN KEY (group_id) REFERENCES alerts_group (id) ON DELETE SET NULL;
+ALTER TABLE alerts_type ADD CONSTRAINT fk_alerts_type_escalation_policy_id FOREIGN KEY (escalation_policy_id) REFERENCES alerts_escalation_policy (id) ON DELETE SET NULL;
+ALTER TABLE alerts_group ADD CONSTRAINT fk_alerts_group_parent_group_id FOREIGN KEY (parent_group_id) REFERENCES alerts_group (id) ON DELETE SET NULL;
+ALTER TABLE alerts_group ADD CONSTRAINT fk_alerts_group_owner_team_id FOREIGN KEY (owner_team_id) REFERENCES alerts_team (id) ON DELETE SET NULL;
+ALTER TABLE alerts_group ADD CONSTRAINT fk_alerts_group_escalation_policy_id FOREIGN KEY (escalation_policy_id) REFERENCES alerts_escalation_policy (id) ON DELETE SET NULL;
+ALTER TABLE alerts_monitor ADD CONSTRAINT fk_alerts_monitor_alert_type_id FOREIGN KEY (alert_type_id) REFERENCES alerts_type (id) ON DELETE RESTRICT;
+ALTER TABLE alerts_alert ADD CONSTRAINT fk_alerts_alert_alert_type_id FOREIGN KEY (alert_type_id) REFERENCES alerts_type (id) ON DELETE RESTRICT;
+ALTER TABLE alerts_alert ADD CONSTRAINT fk_alerts_alert_monitor_id FOREIGN KEY (monitor_id) REFERENCES alerts_monitor (id) ON DELETE SET NULL;
+ALTER TABLE alerts_alert ADD CONSTRAINT fk_alerts_alert_group_id FOREIGN KEY (group_id) REFERENCES alerts_group (id) ON DELETE SET NULL;
+ALTER TABLE alerts_alert ADD CONSTRAINT fk_alerts_alert_assigned_team_id FOREIGN KEY (assigned_team_id) REFERENCES alerts_team (id) ON DELETE SET NULL;
+ALTER TABLE alerts_record_ref ADD CONSTRAINT fk_alerts_record_ref_alert_id FOREIGN KEY (alert_id) REFERENCES alerts_alert (id) ON DELETE CASCADE;
+ALTER TABLE alerts_event ADD CONSTRAINT fk_alerts_event_alert_id FOREIGN KEY (alert_id) REFERENCES alerts_alert (id) ON DELETE CASCADE;
+ALTER TABLE alerts_delivery ADD CONSTRAINT fk_alerts_delivery_alert_id FOREIGN KEY (alert_id) REFERENCES alerts_alert (id) ON DELETE CASCADE;
+ALTER TABLE alerts_delivery ADD CONSTRAINT fk_alerts_delivery_alert_event_id FOREIGN KEY (alert_event_id) REFERENCES alerts_event (id) ON DELETE SET NULL;
+ALTER TABLE alerts_delivery ADD CONSTRAINT fk_alerts_delivery_subscription_id FOREIGN KEY (subscription_id) REFERENCES alerts_subscription (id) ON DELETE SET NULL;
+ALTER TABLE alerts_delivery ADD CONSTRAINT fk_alerts_delivery_channel_id FOREIGN KEY (channel_id) REFERENCES alerts_channel (id) ON DELETE RESTRICT;
+ALTER TABLE alerts_subscription ADD CONSTRAINT fk_alerts_subscription_team_id FOREIGN KEY (team_id) REFERENCES alerts_team (id) ON DELETE RESTRICT;
+ALTER TABLE alerts_subscription ADD CONSTRAINT fk_alerts_subscription_channel_id FOREIGN KEY (channel_id) REFERENCES alerts_channel (id) ON DELETE RESTRICT;
+ALTER TABLE alerts_team_member ADD CONSTRAINT fk_alerts_team_member_team_id FOREIGN KEY (team_id) REFERENCES alerts_team (id) ON DELETE CASCADE;
+ALTER TABLE alerts_notification_recipient ADD CONSTRAINT fk_alerts_notification_recipient_notification_id FOREIGN KEY (notification_id) REFERENCES alerts_notification (id) ON DELETE CASCADE;
+ALTER TABLE alerts_escalation_step ADD CONSTRAINT fk_alerts_escalation_step_policy_id FOREIGN KEY (policy_id) REFERENCES alerts_escalation_policy (id) ON DELETE CASCADE;
+ALTER TABLE alerts_escalation_step ADD CONSTRAINT fk_alerts_escalation_step_team_id FOREIGN KEY (team_id) REFERENCES alerts_team (id) ON DELETE RESTRICT;
+ALTER TABLE alerts_escalation_step ADD CONSTRAINT fk_alerts_escalation_step_channel_id FOREIGN KEY (channel_id) REFERENCES alerts_channel (id) ON DELETE RESTRICT;

src/test/resources/log4j2-test.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Configuration status="WARN">
+   <Appenders>
+      <Console name="Console" target="SYSTEM_OUT">
+         <!-- Core can emit diagnostic events at OFF; exclude those as well. -->
+         <LevelRangeFilter minLevel="FATAL" maxLevel="WARN" onMatch="NEUTRAL" onMismatch="DENY"/>
+         <PatternLayout pattern="%d{HH:mm:ss} %-5level %logger{36} - %msg%n"/>
+      </Console>
+   </Appenders>
+   <Loggers>
+      <Logger name="org.testcontainers" level="WARN"/>
+      <Logger name="com.github.dockerjava" level="WARN"/>
+      <Logger name="org.apache.hc" level="WARN"/>
+      <Logger name="tc" level="WARN"/>
+      <Root level="WARN"><AppenderRef ref="Console"/></Root>
+   </Loggers>
+</Configuration>