fix(dashboard-agent): stop a run of failed watch checks nesting forever

Each failed check stored the whole previous `lastResult` under `previous`, so
consecutive failures wrapped one another without bound. The row escapes: an
unverified expiry copies `lastResult` into the wake facts, which the alert and
the webhook body serialise. A failure record is now unwrapped before it is
stored, so `previous` is always the last observation the check really made.

Author: kathiekiwi

internal-packages/dashboard-agent/src/watch-lifecycle.ts

@@ -57,6 +57,27 @@ export type CheckOutcome =
 // non-2xx is a failed check and the tick keeps watching to the row's own deadline.
 export const REVOKED_CODES = new Set(["access_revoked", "cancelled", "not_found"]);
 
+/**
+ * The last result the check actually produced. A failure record is unwrapped, so a run of
+ * failures replaces one another instead of nesting — the row's `lastResult` reaches the
+ * wake facts, the alert and the webhook body.
+ */
+export function lastObservedResult(lastResult: unknown): Record<string, unknown> | undefined {
+  let current = lastResult;
+  while (isCheckFailure(current)) current = current.previous;
+  return current !== null && typeof current === "object" && !Array.isArray(current)
+    ? (current as Record<string, unknown>)
+    : undefined;
+}
+
+function isCheckFailure(value: unknown): value is { previous?: unknown } {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    (value as { checkFailed?: unknown }).checkFailed === true
+  );
+}
+
 // One watch's tick, shared by the per-watch task and the batch. The order of the
 // branches below is the algorithm.
 export async function runWatchLifecycle(
@@ -121,7 +142,11 @@ export async function runWatchLifecycle(
       // The generation is spent and the result isn't trusted, so keep watching.
       await deps.store.recordWatchCheck({
         id: claimed.id,
-        lastResult: { checkFailed: true, detail: check.detail, previous: claimed.lastResult },
+        lastResult: {
+          checkFailed: true,
+          detail: check.detail,
+          previous: lastObservedResult(claimed.lastResult),
+        },
       });
       if (check.handOff) return { outcome: "handed_off", tickCount: args.tick };
       await deps.onPending(claimed, args.tick);

internal-packages/dashboard-agent/src/watch-tick.test.ts

@@ -566,6 +566,53 @@ describe("runWatchTick", () => {
     expect(row.lastResult).toMatchObject({ checkFailed: true, previous: { pending: 12 } });
   });
 
+  it("a run of failed checks does not nest: `previous` stays the last real observation", async () => {
+    const { store, row } = fakeStore(
+      watchRow({
+        tickCount: 2,
+        lastCheckedAt: new Date("2026-01-01T12:50:00.000Z"),
+        lastResult: { pending: 12 },
+      })
+    );
+    const { fetch } = fakeFetch(() => ({ status: 503, body: { error: "clickhouse is down" } }));
+    const { deliver } = fakeDeliver();
+    const { reschedule } = fakeReschedule();
+    const d = deps({ store, fetch, deliver, reschedule });
+
+    for (const tick of [3, 4, 5, 6]) await runWatchTick(payloadFor(tick), d);
+
+    // One level, not four: the row is serialised into the wake, the alert and the webhook.
+    expect((row.lastResult as { previous?: unknown }).previous).toEqual({ pending: 12 });
+  });
+
+  it("the facts an unverified expiry carries are bounded by the same unwrap", async () => {
+    const { store, row } = fakeStore(
+      watchRow({
+        tickCount: 28,
+        lastCheckedAt: new Date("2026-01-01T12:50:00.000Z"),
+        lastResult: { pending: 41 },
+      })
+    );
+    const { fetch } = fakeFetch(() => ({ status: 500, body: { error: "metrics unavailable" } }));
+    const { appends, deliver } = fakeDeliver();
+    const { reschedule } = fakeReschedule();
+
+    for (const tick of [29, 30, 31]) {
+      await runWatchTick(payloadFor(tick), deps({ store, fetch, deliver, reschedule }));
+    }
+    await runWatchTick(
+      payloadFor(32),
+      deps({ store, fetch, deliver, reschedule, now: new Date("2026-01-01T13:00:01.000Z") })
+    );
+
+    expect(row.status).toBe("expired");
+    const facts = (appends[0]!.action as { facts: Record<string, unknown> }).facts;
+    expect(facts.reason).toBe("unverified_at_expiry");
+    const observation = facts.lastObservation as { checkFailed?: boolean; previous?: unknown };
+    expect(observation.checkFailed).toBe(true);
+    expect(observation.previous).toEqual({ pending: 41 });
+  });
+
   it("access_revoked: exits without resolving, delivering, or rescheduling", async () => {
     const { store, calls, row } = fakeStore(watchRow());
     const { fetch } = fakeFetch(() => ({