v2.6.0

Added

• Resolution hold. A re-fire of an alert closed as resolved or self_resolved stays closed for housekeeping.resolution_hold (default 2h, 0 disables). Higher-severity re-fires still notify.
• JIRA close sync. Closing an alert the jira notifier ticketed comments on the ticket and can transition it (on_close, close_transition). New plugins.CloseNotifier interface.
• API keys in the CLI. credentials.token in client.yaml, $SNOOZE_TOKEN, --token. New snooze apikey create|list|revoke, snooze whoami, --owner me.
• GET /api/v1/user/me returns the verified caller identity.
• Tool attribution. Comments and CLI writes accept a source (--source, $SNOOZE_SOURCE), shown on the timeline.
• Alert ownership. Ack/close set an owner; new Assign and Release actions, owner filter, POST /api/v1/record/bulk_owner, GET /api/v1/record/owners. Run snooze-server migrate owners once after upgrading.
• Profile pictures. Upload from the Profile page; PUT/DELETE /api/v1/user/me/avatar, GET /api/v1/avatar/{method}/{name}, GET /api/v1/people. CLI: snooze people, snooze avatar.
• resolved verdict for remediation_plan.status (a fix was applied, as opposed to self_resolved).
• CLI triage. record list filters (--active, --state, --host, --severity, --owner, -c); record comments, comment, reopen, escalate.
• Agentic analysis. Alerts can carry an agentic subtree (root_cause, remediation_plan, server-stamped analysis), served by GET/PUT/DELETE /api/v1/record/{uid}/agentic, snooze record agentic, and the MCP tools. It is the first protected field: ingestion strips it, and CRUD, rules and notifiers refuse it. Writes need the literal rw_protected permission (rw_all does not grant it); reads need ro_record. See general/agentic_analysis.md.
• Analysis in the web UI. Inspector Analysis tab, dashboard Analyses view (/web/dashboard?view=analyses), and an Analysed tile.
• Notification delivery history. Every send is recorded in notificationlog, shown on a Deliveries tab. Settings: notification.delivery_log (default on), housekeeping.cleanup_notificationlog (30 days). Reads need ro_notificationlog.
• Postgres search indexes. Each search_fields entry gets expression indexes, built by a background worker.

Changed

• Analyses view keeps closed alerts and has a multi-select Verdict filter; filters live in the URL.
• snooze record agentic get prints a readable summary; --json gives the raw subtree.
• Repeated deliveries and timeline entries are folded into runs (GET /api/v1/notificationlog/runs, GET /api/v1/comment/runs).
• The Flow chart marks where a run stopped (silenced, or held by the throttle).
• Alert tabs are Alerts, Acknowledged, Snoozed, Closed, Shelved, All. The Re-escalated tab is gone.
• Analysis contract adds root_cause.detail, root_cause.caveats, remediation_plan.status and steps[].when.
• bulk_update and bulk_state return 403 for collections with per-document write hooks (apikey, role, user, comment, savedsearch, notificationlog, heartbeat, aggregaterule, tenantmatch) unless the plugin implements plugins.BulkWriteGuard.
• The snooze plugin owns the snoozed field (plugins.SuppressionOwner). A filter's Hits counter now counts throttled repeats too.
• Alert details header reorganised; first_seen stamped on records; record tab fills the drawer and has a find box.
• Drawers are non-modal side panels instead of blocking scrims.

Fixed

• Switching a condition group to NOT keeps only its first child.
• An alert still firing when its snooze filter ends is notified (the throttle no longer hides it).
• A snooze filter now applies to alerts inside a throttle window (plugins.Filter).
• Alerts silenced by a filter that no longer exists are released (reconcile_suppression sweep).
• A snooze filter the pipeline cannot parse is rejected with 422 instead of silently ignored.
• A discard filter no longer leaves phantom lifecycle comments (plugins.Result.AfterPersist).
• A recovered silenced alert shows as passed through, not "not notified".
• Snooze hit counts are batched, and a throttled repeat is no longer counted twice on the dashboard.
• API-key actions are owned by the key's owner.
• Profile pictures for email logins display (%40 in avatar paths).
• Back navigation pushes one history entry per tab change.
• Deep links with both ?search= and ?record= open the inspector.
• POST /api/v1/{plugin}/bulk_update no longer returns 405.
• ro_all satisfies ro_* gates on bespoke routes.
• Data race between plugins.WaitBackground and Build.
• Batch buckets, hits/last_sent counters and notificationlog writes are tenant-scoped and no longer trigger reload storms.
• SQLite concurrent writes wait on busy_timeout instead of failing with SQLITE_BUSY.
• Postgres maintenance queries skip rows with non-numeric values instead of aborting.