ottyl/tickets/105-move-alert-evaluation-to-profile-actor.md

105 — Move alert evaluation onto the profile actor

Summary

Alert rules are profile-scoped and read metric buckets (alert_states: HashMap<String, AlertRuntimeState> lives on the single actor's stack frame today), so per 0001-actor-split's resolved decision, alert evaluation moves with metric computation. Depends on 104-move-metric-computation-to-profile-actor landing first — alert evaluation reads the metric buckets that ticket moves onto ProfileSnapshot.

Where

• src/engine/handle.rs:141 — let mut alert_states: HashMap<String, AlertRuntimeState> = HashMap::new();, currently a local in the single actor's run() loop.
• src/engine/handle.rs's Ingest arm — today, right after write.mutate(...) publishes, the actor does write.peek() and calls alerts::evaluate_alerts(&rules, &mut alert_states, &guard, sequence, timestamp, &text), then spawns alerts::deliver_for_rule for each fired alert. This whole block moves to wherever the profile actor's per-line processing lives (the watch-wake loop from ticket 103/104).
• src/engine/alerts.rs:139 (AlertRuntimeState), :241 (evaluate_alerts), :384 (deliver_for_rule) — signatures take the rules list and a &EngineSnapshot-shaped guard; check whether evaluate_alerts needs to change its snapshot parameter type to ProfileSnapshot (likely yes, since it reads bucket data that now lives there) or whether it can stay snapshot-shape-agnostic via whatever trait/accessor bucket-reading already uses.
• Settings access for alert rules/ntfy config (src/engine/handle.rs:170-177, settings.lock().unwrap()) — this stays available to the profile actor the same way (it's a SettingsHandle clone, not primary-actor state), so no primary dependency here.

Scope

• Move alert_states ownership to the profile actor's task-local state.
• Move the post-publish evaluate_alerts call and deliver_for_rule spawn to fire from the profile actor's per-line processing, reading ProfileSnapshot (post-metric-computation) instead of the primary's EngineSnapshot.
• Update evaluate_alerts's signature in src/engine/alerts.rs if it needs to accept a different snapshot type; keep its actual evaluation logic unchanged — this ticket is a relocation, not a rewrite of alert semantics.
• Out of scope: any change to alert rule semantics, ntfy delivery, or the AlertRuntimeState model itself — purely which actor owns and drives evaluation.