fix(backup): reconcile-missing is about one server, not its group

[passcod]

🤖 A group-wide backup-reconcile-missing alert that names a single server — by uuid — turned out to be two visible symptoms of one mistake, plus a third defect neither symptom exposed.

The mistake

backup-reconcile-missing was filed at Scope::Group, on the reasoning that a device lying about a successful backup should page regardless of the server's monitoring state. Scope was the wrong lever for that.

Group issues key on (server_group_id, source, ref), and the ref folds in only the backup type — not the server. So every server in a group collided on one issue row:

• the message was whichever server the sweep reached last;
• the recovery arm checked whether the group issue was active, so a healthy server in the group filed the Passed that cleared a broken server's alert — and the next sweep re-raised it. Order-dependent flapping.

The spec justified group scope for signals "that belong to no single server", but this one names a server in its own message. restore-verification had the same tension and was already resolved the other way: a fleet-stable ref carrying the extra dimensions, filed at server scope.

Changes

backup-reconcile-missing becomes an ordinary server-scoped check with the same ref. Stored silences carry over untouched — the ref is unchanged, and CheckPolicy::apply_scoped consults the server's group as well as the server, so an existing group-level silence still matches.

All three reconcile messages now use server_label() (shared out of staleness.rs), resolved in one batched query for the whole scan rather than per finding. Report-gap and size-mismatch were the worse offenders: both fetched the Server and then interpolated server.id anyway.

Spec: missing-snapshot reconciliation moves to the per-server bullet, and restore-verification is dropped from the group-level list where it was already stale. Two servers failing the same check now hold separate alerts, and alert text names servers the way an operator knows them. Stale doc comments in refs.rs, restore.rs, and issues.rs corrected to match.

Behaviour change

Reconcile-missing now respects the monitoring gate. The alternative was an always_page flag on CheckFiling to decouple "always pages" from "is a group fact", but backup-staleness and backup-never are equally data-safety signals and are already gated — a server whose backups you have deliberately stopped monitoring should not page on any of them.

Migration

2026-08-03-233339-0000_fold_reconcile_missing_to_server_scope folds live group-scoped rows onto the server recorded in their check detail, falling back to the uuid in the message text for rows predating detail-carrying filings. Incident membership survives, so an open incident stays continuous and the next sweep rewrites its message with the server's name.

Rows with no server to fold onto (the server was deleted) can no longer be reached by any code path, so they would hold their incident open forever. Those are released from the incident and resolved, and an incident left with no failing contributors is closed — mirroring the leave path in re_evaluate_incident_membership, without enqueueing a Slack resolve for servers that no longer exist.

Alerts the collision hid are not recoverable and are not recreated; the next sweep files them fresh against their own servers.

Verified against a populated database in a rolled-back transaction: rows folded via both attribution paths, orphan released and resolved.

Incidental

A one-line unused_mut warning fix in tests/it/incident_list_status.rs, already present on main, rode along in the same commit.