feat: страница логов /ui/logs с SSE real-time потоком

- log_buffer: RingBufferHandler, кольцевой буфер 600 записей, fan-out SSE - ui_logs: GET /ui/logs (HTML), GET /ui/logs/stream (EventSource) - main: install_log_handler при старте, подключён router логов - nav_rail: ссылка Логи, root_html: кнопка-ссылка Логи - Исправлено: NaN/Inf/NUL в теле вебхука → 500 от PostgreSQL jsonb - Тесты: test_log_buffer, test_json_sanitize; 51 passed Made-with: Cursor
release: v1.10.0 — модуль команд (teams), team_id на алертах
2026-04-03 15:56:58 +03:00 · 2026-04-03 15:34:46 +03:00 · 2026-04-03 15:26:38 +03:00 · 2026-04-03 15:06:17 +03:00 · 2026-04-03 15:04:22 +03:00 · 2026-04-03 14:41:15 +03:00
37 changed files with 2272 additions and 131 deletions
--- a/.env.example
+++ b/.env.example
@ -6,6 +6,9 @@ LOG_LEVEL=info
 # Опционально: общий секрет для вебхуков (если у источника в JSON не задан свой webhook_secret)
 # GRAFANA_WEBHOOK_SECRET=

+# Устаревшее: автосоздание инцидента на каждый вебхук (дублирует irm_alerts). Обычно не нужно.
+# AUTO_INCIDENT_FROM_ALERT=1
+
 # Несколько Grafana: JSON-массив. slug — часть URL вебхука: /api/v1/ingress/grafana/{slug}
 # Пример: [{"slug":"adibrov","api_url":"https://grafana-adibrov.example","api_token":"glsa_...","webhook_secret":"длинный-секрет"}]
 # Если пусто, но задан GRAFANA_URL — один источник со slug "default" (вебхук /api/v1/ingress/grafana/default)
@ -36,3 +39,7 @@ VAULT_TOKEN=
 # Токен: Forgejo → Settings → Applications → Generate New Token (или старый PAT)
 FORGEJO_URL=https://forgejo.pvenode.ru
 # FORGEJO_TOKEN=
+
+# --- Деплой через Forgejo Actions (НЕ сюда) ---
+# DEPLOY_HOST, DEPLOY_USER, DEPLOY_PATH, DEPLOY_SSH_KEY задаются только в веб-UI:
+# репозиторий → Настройки → Actions → Secrets. Контейнер onGuard24 их не читает.
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@ -1,18 +1,27 @@
-# Forgejo / Gitea Actions — проверка перед деплоем
+# Forgejo / Gitea Actions — проверка перед деплоем (совместимо с синтаксисом GitHub Actions).
 name: CI

 on:
  push:
    branches: [main]
+    tags:
+      - "v*"
  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true

 jobs:
  test:
    runs-on: ubuntu-latest
+    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4

+      # Без cache: pip — на Forgejo/act часто таймаут getCacheEntry (172.17.x), долгий шаг и warning.
      - name: Python 3.12
        uses: actions/setup-python@v5
        with:
@ -20,5 +29,7 @@ jobs:

      - name: Pytest
        run: |
-          pip install -e ".[dev]"
-          pytest -q
+          set -euo pipefail
+          python -m pip install -U pip
+          python -m pip install -e ".[dev]"
+          python -m pytest tests/ -q --tb=short
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@ -8,7 +8,7 @@ on:
  workflow_dispatch:
    inputs:
      ref:
-        description: "Git ref (тег для релиза или отката, напр. v1.5.0 или v1.4.1)"
+        description: "main, v1.7.0 или 1.7.0 (без v подставится автоматически)."
        required: true
        default: "main"

@ -18,31 +18,74 @@ jobs:
    steps:
      - name: Определить ревизию
        id: pick
+        env:
+          RAW_REF: ${{ inputs.ref }}
        run: |
+          # Forgejo иногда подставляет refs/heads/main вместо main — иначе нет origin/refs/heads/main.
+          normalize_ref() {
+            case "$1" in
+              refs/heads/*) echo "${1#refs/heads/}" ;;
+              refs/tags/*) echo "${1#refs/tags/}" ;;
+              *) echo "$1" ;;
+            esac
+          }
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "ref=${{ inputs.ref }}" >> "$GITHUB_OUTPUT"
+            R=$(printf '%s' "$RAW_REF" | tr -d '\r\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+            R=$(normalize_ref "$R")
+            # Теги в git: v1.7.0; если ввели 1.7.0 — подставляем v.
+            if echo "$R" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+              echo "::notice::Указано $R без префикса v — деплой на v${R}"
+              R="v${R}"
+            fi
+            echo "ref=$R" >> "$GITHUB_OUTPUT"
          else
-            echo "ref=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            R=$(normalize_ref "${{ github.ref_name }}")
+            echo "ref=$R" >> "$GITHUB_OUTPUT"
          fi

+      # Без секретов appleboy/ssh-action падает с «missing server host» — даём явную подсказку.
+      - name: Проверить секреты деплоя
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          ok=0
+          [ -n "$DEPLOY_HOST" ] || { echo "::error::Секрет DEPLOY_HOST пустой. Forgejo → репозиторий → Настройки → Actions → Secrets."; ok=1; }
+          [ -n "$DEPLOY_USER" ] || { echo "::error::Секрет DEPLOY_USER пустой."; ok=1; }
+          [ -n "$DEPLOY_PATH" ] || { echo "::error::Секрет DEPLOY_PATH пустой (каталог клона на сервере, напр. /opt/onGuard24)."; ok=1; }
+          [ -n "$DEPLOY_SSH_KEY" ] || { echo "::error::Секрет DEPLOY_SSH_KEY пустой (приватный SSH-ключ целиком, PEM)."; ok=1; }
+          exit "$ok"
+
      - name: SSH — fetch, checkout, docker compose
        uses: appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.DEPLOY_HOST }}
+          port: "22"
          username: ${{ secrets.DEPLOY_USER }}
          key: ${{ secrets.DEPLOY_SSH_KEY }}
          script_stop: true
          command_timeout: 20m
          script: |
            set -euo pipefail
+            REF="${{ steps.pick.outputs.ref }}"
            cd "${{ secrets.DEPLOY_PATH }}"
+            echo "=== deploy REF=$REF ==="
            git fetch origin --tags --prune
-            git checkout "${{ steps.pick.outputs.ref }}"
-            if git show-ref --verify --quiet "refs/remotes/origin/${{ steps.pick.outputs.ref }}"; then
-              git reset --hard "origin/${{ steps.pick.outputs.ref }}"
+            git checkout "$REF"
+            # Теги не дают refs/remotes/origin/<тег> — только ветки; для v* срабатывает else.
+            if git show-ref --verify --quiet "refs/remotes/origin/$REF"; then
+              git reset --hard "origin/$REF"
            else
-              git reset --hard "${{ steps.pick.outputs.ref }}"
+              git reset --hard "$REF"
            fi
-            docker compose build
+            echo "=== git HEAD ==="
+            git log -1 --oneline
+            echo "=== docker compose version ==="
+            docker compose version
+            echo "=== docker compose build ==="
+            docker compose --progress plain build
+            echo "=== docker compose up ==="
            docker compose up -d
            docker compose ps
--- a/.gitignore
+++ b/.gitignore
@ -1,5 +1,7 @@
 .env
 .env.local
+# локальные секреты на сервере (compose использует только .env)
+/env
 *.pem
 dist/
 bin/
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -2,6 +2,60 @@

 Формат: семантическое версионирование `MAJOR.MINOR.PATCH`. Git-теги `v1.0.0`, `v1.1.0` и т.д. — см. [docs/VERSIONING.md](docs/VERSIONING.md).

+## [1.10.1] — 2026-04-03
+
+### Добавлено
+
+- **Страница логов** `/ui/logs` — кольцевой буфер (600 записей) + **SSE real-time** поток; фильтр по уровню, авто-прокрутка; ссылка на главной и в nav rail (раздел «📋 Логи»).
+
+### Исправлено
+
+- **Вебхук Grafana:** санитизация тела перед записью в `jsonb` — `NaN` / `±Inf` → `None`, удаление `\x00` в строках (иначе PostgreSQL и строгий JSON часто давали **500** на реальных алертах с метриками, тогда как «Test contact point» оставался рабочим).
+- Ошибки подписчиков **`alert.received`** после успешного коммита в БД больше не рвут ответ вебхука (логируются).
+
+## [1.10.0] — 2026-04-03
+
+Команды (teams) по лейблам, как ориентир на Grafana IRM **Team**.
+
+### Добавлено
+
+- **Alembic `006_teams`:** таблицы `teams`, `team_label_rules`, колонка **`irm_alerts.team_id`**.
+- **Модуль «Команды»:** CRUD команд, правила лейблов (`priority`), UI список и карточка.
+- **Вебхук Grafana:** подстановка `team_id` по первому совпадению правила.
+- **Алерты:** в API и UI колонка команды, фильтр `team_id`, `GET /alerts/?team_id=…`.
+
+### Изменено
+
+- Документация [IRM_GRAFANA_PARITY.md](docs/IRM_GRAFANA_PARITY.md), [IRM.md](docs/IRM.md).
+
+## [1.9.0] — 2026-04-03
+
+Алерты отдельно от инцидентов (модель ближе к Grafana IRM).
+
+### Добавлено
+
+- **Alembic `005_irm_alerts`:** таблицы `irm_alerts`, `incident_alert_links`.
+- **Модуль «Алерты»:** API и UI, статусы firing → acknowledged → resolved, полный JSON вебхука, кнопка «Создать инцидент».
+- **Вебхук Grafana:** в одной транзакции `ingress_events` + `irm_alerts`.
+- **`extract_alert_row_from_grafana_body`** — заголовок, severity, labels, fingerprint.
+- **Документация:** [docs/IRM_GRAFANA_PARITY.md](docs/IRM_GRAFANA_PARITY.md).
+
+### Изменено
+
+- **Инцидент из вебхука по умолчанию не создаётся**; включение старого поведения: `AUTO_INCIDENT_FROM_ALERT=1`.
+- **POST /incidents:** опционально `alert_ids` для привязки к `irm_alerts`.
+
+## [1.8.0] — 2026-04-03
+
+UI каталога Grafana и инцидентов; правки CI/CD деплоя.
+
+### Добавлено / изменено
+
+- **Каталог Grafana (UI):** кнопка синхронизации без `curl`, раскрывающееся дерево папок (имя, UID, родитель) и правил (title, rule_uid, группа, интервал, labels); блок namespace без папки в API.
+- **Инциденты (UI):** колонка «Создан», ссылка на карточку; карточка с полями и сырым JSON вебхука из `ingress_events`.
+- **API `GET …/grafana-catalog/tree`:** поле `orphan_rule_groups`.
+- **CI/CD:** нормализация ref (`refs/heads/main`, semver без `v`), `docker compose --progress plain`; отключён pip cache при таймауте Actions cache.
+
 ## [1.7.0] — 2026-04-03

 Каталог Grafana (топология правил), доработки ingress/IRM, тесты.
--- a/alembic/versions/005_irm_alerts.py
+++ b/alembic/versions/005_irm_alerts.py
@ -0,0 +1,74 @@
+"""IRM: алерты отдельно от инцидентов (ack/resolve), связь N:M инцидент↔алерт
+
+Revision ID: 005_irm_alerts
+Revises: 004_grafana_catalog
+Create Date: 2026-04-03
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+revision: str = "005_irm_alerts"
+down_revision: Union[str, None] = "004_grafana_catalog"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.execute(
+        """
+        CREATE TABLE IF NOT EXISTS irm_alerts (
+            id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+            ingress_event_id uuid NOT NULL UNIQUE REFERENCES ingress_events(id) ON DELETE CASCADE,
+            status text NOT NULL DEFAULT 'firing'
+                CHECK (status IN ('firing', 'acknowledged', 'resolved', 'silenced')),
+            title text NOT NULL DEFAULT '',
+            severity text NOT NULL DEFAULT 'warning',
+            source text NOT NULL DEFAULT 'grafana',
+            grafana_org_slug text,
+            service_name text,
+            labels jsonb NOT NULL DEFAULT '{}'::jsonb,
+            fingerprint text,
+            acknowledged_at timestamptz,
+            acknowledged_by text,
+            resolved_at timestamptz,
+            resolved_by text,
+            created_at timestamptz NOT NULL DEFAULT now(),
+            updated_at timestamptz NOT NULL DEFAULT now()
+        );
+        """
+    )
+    op.execute(
+        """
+        CREATE INDEX IF NOT EXISTS irm_alerts_status_created_idx
+        ON irm_alerts (status, created_at DESC);
+        """
+    )
+    op.execute(
+        """
+        CREATE INDEX IF NOT EXISTS irm_alerts_ingress_event_id_idx
+        ON irm_alerts (ingress_event_id);
+        """
+    )
+    op.execute(
+        """
+        CREATE TABLE IF NOT EXISTS incident_alert_links (
+            incident_id uuid NOT NULL REFERENCES incidents(id) ON DELETE CASCADE,
+            alert_id uuid NOT NULL REFERENCES irm_alerts(id) ON DELETE CASCADE,
+            PRIMARY KEY (incident_id, alert_id)
+        );
+        """
+    )
+    op.execute(
+        """
+        CREATE INDEX IF NOT EXISTS incident_alert_links_alert_idx
+        ON incident_alert_links (alert_id);
+        """
+    )
+
+
+def downgrade() -> None:
+    op.execute("DROP TABLE IF EXISTS incident_alert_links;")
+    op.execute("DROP TABLE IF EXISTS irm_alerts;")
--- a/alembic/versions/006_teams.py
+++ b/alembic/versions/006_teams.py
@ -0,0 +1,78 @@
+"""IRM: команды (teams) и правила сопоставления по лейблам алерта
+
+Revision ID: 006_teams
+Revises: 005_irm_alerts
+Create Date: 2026-04-03
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+revision: str = "006_teams"
+down_revision: Union[str, None] = "005_irm_alerts"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.execute(
+        """
+        CREATE TABLE IF NOT EXISTS teams (
+            id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+            slug text NOT NULL UNIQUE,
+            name text NOT NULL,
+            description text,
+            created_at timestamptz NOT NULL DEFAULT now()
+        );
+        """
+    )
+    op.execute(
+        """
+        CREATE INDEX IF NOT EXISTS teams_slug_idx ON teams (slug);
+        """
+    )
+    op.execute(
+        """
+        CREATE TABLE IF NOT EXISTS team_label_rules (
+            id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+            team_id uuid NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+            label_key text NOT NULL,
+            label_value text NOT NULL,
+            priority integer NOT NULL DEFAULT 0,
+            created_at timestamptz NOT NULL DEFAULT now(),
+            CONSTRAINT team_label_rules_key_nonempty CHECK (
+                length(trim(label_key)) > 0
+            )
+        );
+        """
+    )
+    op.execute(
+        """
+        CREATE INDEX IF NOT EXISTS team_label_rules_team_idx ON team_label_rules (team_id);
+        """
+    )
+    op.execute(
+        """
+        CREATE INDEX IF NOT EXISTS team_label_rules_priority_idx
+        ON team_label_rules (priority DESC, id ASC);
+        """
+    )
+    op.execute(
+        """
+        ALTER TABLE irm_alerts
+        ADD COLUMN IF NOT EXISTS team_id uuid REFERENCES teams(id) ON DELETE SET NULL;
+        """
+    )
+    op.execute(
+        """
+        CREATE INDEX IF NOT EXISTS irm_alerts_team_id_idx ON irm_alerts (team_id);
+        """
+    )
+
+
+def downgrade() -> None:
+    op.execute("ALTER TABLE irm_alerts DROP COLUMN IF EXISTS team_id;")
+    op.execute("DROP TABLE IF EXISTS team_label_rules;")
+    op.execute("DROP TABLE IF EXISTS teams;")
--- a/docs/CICD.md
+++ b/docs/CICD.md
@ -6,7 +6,7 @@

 | Файл | Назначение |
 |------|------------|
-| `.gitea/workflows/ci.yml` | На `push` в `main` и PR: `pytest`. |
+| `.gitea/workflows/ci.yml` | `pytest` на `push` в `main`, на `push` тегов `v*`, на PR в `main` (см. чеклист ниже). |
 | `.gitea/workflows/deploy.yml` | На `push` тега `v*`: SSH на сервер → `git checkout` → `docker compose build/up`. |
 | `Dockerfile` | Образ Python 3.12, `pip install .`, entrypoint: `alembic upgrade` + `uvicorn`. |
 | `docker-compose.yml` | Сервис `onguard24`, порт `8080`, `env_file: .env`. |
@ -36,6 +36,14 @@ sudo docker run -d --restart always --name act_runner \

 Стабильные теги: [hub.docker.com/r/gitea/act_runner/tags](https://hub.docker.com/r/gitea/act_runner/tags).

+## Чеклист: CI и Deploy проходят
+
+1. **Runner** зарегистрирован, метка совпадает с `runs-on: ubuntu-latest` в `ci.yml` / `deploy.yml` (или поменяйте `runs-on` на свою метку, например `self-hosted`).
+2. **Сеть:** runner может скачивать образы Docker (для job’ов) и при необходимости — **`github.com`** (экшены `actions/checkout`, `actions/setup-python`, `appleboy/ssh-action`). Если Forgejo без выхода в интернет — в админке задайте **зеркало/прокси для Actions** или подставьте полные URL экшенов с вашего зеркала.
+3. **CI:** после `push` в `main` или тега `v*` в разделе **Actions** должен быть успешный workflow **CI** (установка Python 3.12, `pytest`). Локально то же самое: `python -m pip install -e ".[dev]" && python -m pytest tests/ -q`.
+4. **Deploy:** заданы секреты `DEPLOY_HOST`, `DEPLOY_USER`, `DEPLOY_SSH_KEY`, `DEPLOY_PATH`; с хоста runner выполняется `ssh` на сервер (см. раздел про секреты). Если SSH падает с **host key** — при первом подключении с runner можно зафиксировать отпечаток и добавить в Forgejo секрет (см. раздел «Устранение неполадок»).
+5. **На сервере** в `DEPLOY_PATH`: рабочий `git remote`, `docker compose`, без конфликтов портов.
+
 ## Секреты репозитория

 **Настройки репозитория → Actions → Secrets:**
@ -84,7 +92,7 @@ curl -s http://127.0.0.1:8080/health
 ## Откат версии (простой процесс)

 1. В Forgejo: **Actions → Deploy → Run workflow**.
-2. В поле **ref** указать **старый тег**, например `v1.4.1`.
+2. В поле **ref** указать **старый тег** (`v1.4.1` или для удобства просто `1.4.1` — workflow добавит `v`).
 3. Запустить. На сервере выполнится `checkout` и `reset` на этот ref, затем `docker compose build && up -d`.

 Убедитесь, что старый тег есть в `origin` (`git push --tags` не удалялся).
@ -95,9 +103,14 @@ curl -s http://127.0.0.1:8080/health

 ## Устранение неполадок

+- **`Error: missing server host` / `cd ""` в логе** — в репозитории **не заданы** (или пустые) секреты **`DEPLOY_HOST`**, **`DEPLOY_USER`**, **`DEPLOY_SSH_KEY`**, **`DEPLOY_PATH`**. Задайте их в **Forgejo → репозиторий → Настройки → Actions → Secrets** (имена **точно** как в таблице выше). Workflow теперь падает раньше с явным сообщением, какой секрет пустой.
+- **SSH: host key verification failed** — runner впервые видит ключ сервера. Варианты: (а) один раз с машины runner выполнить `ssh-keyscan -H <DEPLOY_HOST>` и настроить доверие в среде act (зависит от образа); (б) в `appleboy/ssh-action` при необходимости задать входной параметр **`fingerprint`** (SHA256), его можно взять так: `ssh-keyscan -t ed25519 <DEPLOY_HOST> 2>/dev/null | ssh-keygen -lf -` (на любой машине, которая видит сервер). Пустой `DEPLOY_SSH_KEY` или ключ с Windows-переводами строк (`\r\n`) тоже даёт ошибки SSH — ключ в секрете должен быть PEM целиком, Unix newlines.
+- **CI: не качается `actions/checkout@v4`** — настройте зеркало GitHub для Actions в Forgejo или замените `uses:` на URL экшена с доступного вам хоста (см. документацию вашей версии Forgejo).
 - **Runner не берёт job** — проверьте `runs-on` и метки runner.
 - **SSH fails** — `ssh -i key root@DEPLOY_HOST` с машины runner; `known_hosts` при необходимости добавьте в экшен (расширение `appleboy/ssh-action` / `ssh-keyscan`).
 - **`git checkout` fails** — выполните на сервере `git fetch --tags` вручную, проверьте remote URL и ключ.
+- **`fatal: ambiguous argument 'origin/v1.x.x'`** при ручном деплое — у **тегов** нет ref вида `origin/имя-тега`, только `refs/tags/…`. После `git fetch && git checkout v1.x.x` делайте `git reset --hard v1.x.x`, а не `origin/v1.x.x`. В `.gitea/workflows/deploy.yml` это уже учтено (ветка `origin/<ref>` только для **веток**).
+- **Deploy остаётся на старом коммите (напр. v1.6.0), в логе `REF=refs/heads/main`** — UI Forgejo может подставлять полный ref. Workflow приводит `refs/heads/main` → `main`, чтобы выполнялся `git reset --hard origin/main` и подтягивался актуальный `main` с Forgejo.
 - **База недоступна из контейнера** — в `DATABASE_URL` укажите хост, доступный **из Docker** (не `127.0.0.1` хоста, если БД на хосте — используйте IP хоста или `host.docker.internal` где поддерживается).

 См. также [VERSIONING.md](VERSIONING.md) и [IRM.md](IRM.md).
--- a/docs/IRM.md
+++ b/docs/IRM.md
@ -6,9 +6,11 @@

 | Область | Назначение | onGuard24 | Grafana / внешнее |
 |---------|------------|-----------|-------------------|
-| **Инциденты** | Учёт сбоев, статусы (open → resolved), связь с алертом | Модуль `incidents`: таблица `incidents`, API, UI, авто-создание из `alert.received` | Contact point **Webhook** → `POST /api/v1/ingress/grafana`; правила алертинга в Grafana |
+| **Инциденты** | Учёт сбоев, статусы (open → resolved), связь с алертами | Модуль `incidents`: `incidents`, `incident_alert_links`, API, UI; создание вручную или с `alert_ids` | См. **Алерты**; [IRM_GRAFANA_PARITY.md](IRM_GRAFANA_PARITY.md) |
+| **Алерты (IRM)** | Приём, Ack/Resolve, не смешивать с инцидентом | Модуль `alerts`: `irm_alerts`, UI/API, вебхук пишет в одной транзакции с `ingress_events` | Grafana IRM Alert Groups; у нас без группировки/эскалации на уровне алерта |
 | **Задачи** | Подзадачи по инциденту (разбор, фикс) | Модуль `tasks`: таблица `tasks`, привязка к `incident_id` | Опционально: ссылки из алерта; основная работа в onGuard24 |
 | **Цепочки эскалаций** | Кого звать и в каком порядке при таймаутах | Модуль `escalations`: таблица `escalation_policies` (JSON `steps`), API/UI заготовка | Маршрутизация уведомлений может дублироваться в Grafana contact points; целевая логика — в onGuard24 |
+| **Команды (teams)** | Фильтр и маршрутизация как в IRM | Модуль `teams`: `teams`, `team_label_rules`, `irm_alerts.team_id`; правила по лейблам при вебхуке | Колонка **Team** в Grafana IRM; у нас сопоставление по `label_key` = `label_value` |
 | **Календарь дежурств** | Кто в смене, расписание | Модуль `schedules` (развитие) | Календари/команды — данные в onGuard24; уведомления — через интеграции |
 | **Контакты** | Люди, каналы | Модуль `contacts` | Получатели в **Contact points** (email, Slack, webhook) |
 | **Светофор / статус сервисов** | Агрегат здоровья | Модуль `statusboard` | Источник метрик — Prometheus/Loki; правила — Grafana |
@ -17,11 +19,12 @@
 | **Пользователи / права** | RBAC | *Пока нет* | SSO Grafana, сеть за reverse proxy |
 | **SLO** | Цели по доступности | *Вне скоупа v1* | Grafana SLO / Mimir |

-## Поток данных (алерт → инцидент)
+## Поток данных (как в Grafana IRM)

-1. Grafana срабатывает правило → шлёт JSON на **webhook** onGuard24.
-2. Сервис пишет строку в `ingress_events`, публикует **`alert.received`**.
-3. Модуль **incidents** подписан на событие и создаёт запись в **`incidents`** с ссылкой на `ingress_event_id`.
+1. Grafana срабатывает правило → JSON на **webhook** onGuard24.
+2. В одной транзакции: **`ingress_events`** + **`irm_alerts`** (статус `firing`), публикуется **`alert.received`**.
+3. Дежурный в модуле **Алерты** читает заголовок, лейблы, **Acknowledge** / **Resolve** — это не создание инцидента.
+4. **Инцидент** создаётся отдельно (вручную или из карточки алерта), опционально с привязкой **`alert_ids`**. Авто-инцидент из вебхука только при **`AUTO_INCIDENT_FROM_ALERT=1`** (legacy).

 ## Что настроить в Grafana (обязательно для приёма алертов)

--- a/docs/IRM_GRAFANA_PARITY.md
+++ b/docs/IRM_GRAFANA_PARITY.md
@ -0,0 +1,40 @@
+# Сравнение onGuard24 с Grafana IRM (Alerting / Incident)
+
+Grafana Cloud / IRM даёт **группы алертов**, **Acknowledge / Resolve**, **инциденты**, **команды (teams)**, **эскалационные цепочки**, **расписания дежурств**. Ниже — что уже есть в onGuard24 и что планировать отдельно.
+
+## Уже есть (после разделения алерт / инцидент)
+
+| Grafana IRM (идея) | onGuard24 |
+|--------------------|-----------|
+| Входящие уведомления от интеграции | Webhook `POST /api/v1/ingress/grafana` → `ingress_events` + **`irm_alerts`** |
+| Статусы firing / acknowledged / resolved | Поле **`irm_alerts.status`**, UI **Алерты**, API `PATCH …/acknowledge`, `…/resolve` |
+| Просмотр labels / сырого payload | Карточка алерта в UI, JSON вебхука |
+| Инцидент как отдельная сущность | **`incidents`**, создание вручную или кнопка «Создать инцидент» на алерте; связь **`incident_alert_links`** |
+| Эскалации (JSON-шаги) | Модуль **Эскалации** (`escalation_policies`) — без автодвижка по таймерам |
+| Контакты / каналы | Модуль **Контакты** |
+| Расписания (заглушка) | **Календарь дежурств** — UI-задел |
+| **Teams** (команда по лейблам) | Таблицы **`teams`**, **`team_label_rules`**, поле **`irm_alerts.team_id`**; вебхук подбирает команду по первому совпадению правила (priority); UI/API **Команды**, фильтр по команде в **Алертах** |
+
+## Пока нет (зрелые следующие этапы)
+
+| Функция Grafana IRM | Заметка |
+|---------------------|---------|
+| **Teams** как маршрутизация уведомлений (кому слать из коробки) | Команда назначена на алерт; **цепочки уведомлений по team** — впереди (связка с escalations / contact points) |
+| **Alert groups** (несколько алертов в одной группе с общим ID) | Сейчас **одна строка `irm_alerts` на один webhook**; группировка fingerprint / rule_uid — отдельная задача |
+| **Silence / Restart** из UI | Статус `silenced` в БД зарезервирован, логика не подключена |
+| **Эскалация по таймеру** (wait 15m → notify next) | Политики есть, **фонового исполнителя** нет |
+| **On-call из расписания** в цепочке | Нет связи schedules → escalation executor |
+| **Пользователи / «Mine» / назначение** | Нет учётных записей onGuard24 для дежурного; `acknowledged_by` — свободный текст (можно расширить) |
+| **Интеграция обратно в Grafana** (resolve в Grafana из IRM) | Не делалось |
+
+## Переменные окружения
+
+- **`AUTO_INCIDENT_FROM_ALERT`** — если `1` / `true`, сохраняется старое поведение: **каждый** вебхук ещё и создаёт строку в **`incidents`**. По умолчанию **выключено**: только **`irm_alerts`**.
+
+## Рекомендуемый поток
+
+1. Grafana → webhook → **алерт** (`firing`).
+2. Дежурный в **Алертах**: прочитал → **Ack** → разобрался → **Resolve** (или сразу Resolve).
+3. При необходимости **Создать инцидент** (документирование, задачи, эскалация вручную).
+
+Так модель ближе к IRM, где **алерт** и **инцидент** разведены.
--- a/onguard24/init.py
+++ b/onguard24/init.py
@ -1,3 +1,3 @@
 """onGuard24 — модульный монолит (ядро + модули)."""

-__version__ = "1.7.0"
+__version__ = "1.10.1"
--- a/onguard24/config.py
+++ b/onguard24/config.py
@ -34,6 +34,11 @@ class Settings(BaseSettings):
    forgejo_url: str = Field(default="", validation_alias="FORGEJO_URL")
    forgejo_token: str = Field(default="", validation_alias="FORGEJO_TOKEN")
    log_level: str = Field(default="info", validation_alias="LOG_LEVEL")
+    # Устаревшее: автосоздание инцидента на каждый вебхук (без учёта irm_alerts). По умолчанию выкл.
+    auto_incident_from_alert: bool = Field(
+        default=False,
+        validation_alias="AUTO_INCIDENT_FROM_ALERT",
+    )


 def get_settings() -> Settings:
--- a/onguard24/ingress/grafana.py
+++ b/onguard24/ingress/grafana.py
@ -9,6 +9,9 @@ from starlette.responses import Response

 from onguard24.domain.entities import Alert, Severity
 from onguard24.grafana_sources import sources_by_slug, webhook_authorized
+from onguard24.ingress.grafana_payload import extract_alert_row_from_grafana_body
+from onguard24.ingress.json_sanitize import sanitize_for_jsonb
+from onguard24.ingress.team_match import resolve_team_id_for_labels

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["ingress"])
@ -97,6 +100,8 @@ async def _grafana_webhook_impl(
        body = {}
    if not isinstance(body, dict):
        body = {}
+    else:
+        body = sanitize_for_jsonb(body)

    derived = extract_grafana_source_key(body)
    path_key: str | None = None
@ -119,19 +124,40 @@ async def _grafana_webhook_impl(
        logger.warning("ingress: database not configured, event not persisted")
        return Response(status_code=202)

+    title_row, sev_row, labels_row, fp_row = extract_alert_row_from_grafana_body(body)
    async with pool.acquire() as conn:
-        row = await conn.fetchrow(
-            """
-            INSERT INTO ingress_events (source, body, org_slug, service_name)
-            VALUES ($1, $2::jsonb, $3, $4)
-            RETURNING id
-            """,
-            "grafana",
-            json.dumps(body),
-            stored_org_slug,
-            service_name,
-        )
-    raw_id = row["id"] if row else None
+        async with conn.transaction():
+            row = await conn.fetchrow(
+                """
+                INSERT INTO ingress_events (source, body, org_slug, service_name)
+                VALUES ($1, $2::jsonb, $3, $4)
+                RETURNING id
+                """,
+                "grafana",
+                json.dumps(body, ensure_ascii=False, allow_nan=False),
+                stored_org_slug,
+                service_name,
+            )
+            raw_id = row["id"] if row else None
+            if raw_id is not None:
+                team_id = await resolve_team_id_for_labels(conn, labels_row)
+                await conn.execute(
+                    """
+                    INSERT INTO irm_alerts (
+                        ingress_event_id, status, title, severity, source,
+                        grafana_org_slug, service_name, labels, fingerprint, team_id
+                    )
+                    VALUES ($1, 'firing', $2, $3, 'grafana', $4, $5, $6::jsonb, $7, $8)
+                    """,
+                    raw_id,
+                    title_row or "—",
+                    sev_row,
+                    stored_org_slug,
+                    service_name,
+                    json.dumps(labels_row, ensure_ascii=False, allow_nan=False),
+                    fp_row,
+                    team_id,
+                )
    bus = getattr(request.app.state, "event_bus", None)
    if bus and raw_id is not None:
        title = str(body.get("title") or body.get("ruleName") or "")[:500]
@ -142,12 +168,17 @@ async def _grafana_webhook_impl(
            payload=body,
            received_at=datetime.now(timezone.utc),
        )
-        await bus.publish_alert_received(
-            alert,
-            raw_payload_ref=raw_id,
-            grafana_org_slug=stored_org_slug,
-            service_name=service_name,
-        )
+        try:
+            await bus.publish_alert_received(
+                alert,
+                raw_payload_ref=raw_id,
+                grafana_org_slug=stored_org_slug,
+                service_name=service_name,
+            )
+        except Exception:
+            logger.exception(
+                "ingress: событие alert.received не доставлено подписчикам (БД уже сохранена)"
+            )
    return Response(status_code=202)


--- a/onguard24/ingress/grafana_payload.py
+++ b/onguard24/ingress/grafana_payload.py
@ -0,0 +1,53 @@
+"""Извлечение полей для учёта алерта из тела вебхука Grafana (Unified Alerting)."""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+
+def extract_alert_row_from_grafana_body(body: dict[str, Any]) -> tuple[str, str, dict[str, Any], str | None]:
+    """
+    Возвращает: title, severity (info|warning|critical), labels (dict), fingerprint.
+    """
+    title = str(body.get("title") or body.get("ruleName") or "").strip()[:500]
+    alerts = body.get("alerts")
+    labels: dict[str, Any] = {}
+    fingerprint: str | None = None
+    sev = "warning"
+
+    if isinstance(alerts, list) and alerts and isinstance(alerts[0], dict):
+        a0 = alerts[0]
+        fp = a0.get("fingerprint")
+        if fp is not None:
+            fingerprint = str(fp)[:500]
+        if isinstance(a0.get("labels"), dict):
+            labels.update(a0["labels"])
+        ann = a0.get("annotations")
+        if isinstance(ann, dict) and not title:
+            title = str(ann.get("summary") or ann.get("description") or "").strip()[:500]
+
+    cl = body.get("commonLabels")
+    if isinstance(cl, dict):
+        for k, v in cl.items():
+            labels.setdefault(k, v)
+
+    if not title and isinstance(alerts, list) and alerts and isinstance(alerts[0], dict):
+        title = str(alerts[0].get("labels", {}).get("alertname") or "").strip()[:500]
+
+    raw_s = None
+    if isinstance(labels.get("severity"), str):
+        raw_s = labels["severity"].lower()
+    elif isinstance(labels.get("priority"), str):
+        raw_s = labels["priority"].lower()
+    if raw_s in ("critical", "error", "fatal"):
+        sev = "critical"
+    elif raw_s in ("warning", "warn"):
+        sev = "warning"
+    elif raw_s in ("info", "informational", "none"):
+        sev = "info"
+
+    # JSONB: только JSON-совместимые значения
+    clean_labels = {str(k): v for k, v in labels.items() if isinstance(v, (str, int, float, bool, type(None)))}
+
+    return title, sev, clean_labels, fingerprint
--- a/onguard24/ingress/json_sanitize.py
+++ b/onguard24/ingress/json_sanitize.py
@ -0,0 +1,26 @@
+"""Подготовка структур из JSON к записи в PostgreSQL jsonb."""
+
+from __future__ import annotations
+
+import math
+from typing import Any
+
+
+def sanitize_for_jsonb(obj: Any) -> Any:
+    """
+    - float NaN / ±Inf → None (иначе json.dumps даёт невалидный JSON для PG / сюрпризы при записи).
+    - Символ NUL в строках убрать (PostgreSQL text/jsonb NUL в строке не принимает).
+    """
+    if isinstance(obj, float):
+        if math.isnan(obj) or math.isinf(obj):
+            return None
+        return obj
+    if isinstance(obj, str):
+        if "\x00" not in obj:
+            return obj
+        return obj.replace("\x00", "")
+    if isinstance(obj, dict):
+        return {k: sanitize_for_jsonb(v) for k, v in obj.items()}
+    if isinstance(obj, list):
+        return [sanitize_for_jsonb(x) for x in obj]
+    return obj
--- a/onguard24/ingress/team_match.py
+++ b/onguard24/ingress/team_match.py
@ -0,0 +1,51 @@
+"""Сопоставление входящего алерта с командой по правилам лейблов (как Team в Grafana IRM)."""
+
+from __future__ import annotations
+
+from typing import Any, Sequence
+from uuid import UUID
+
+import asyncpg
+
+
+def match_team_for_labels(
+    labels: dict[str, Any],
+    rules: Sequence[asyncpg.Record | tuple[UUID, str, str]],
+) -> UUID | None:
+    """
+    rules — упорядочены по приоритету (выше priority — раньше проверка).
+    Первое совпадение label_key == label_value возвращает team_id.
+    """
+    if not labels or not rules:
+        return None
+    flat: dict[str, str] = {
+        str(k): "" if v is None else str(v) for k, v in labels.items()
+    }
+    for row in rules:
+        if isinstance(row, tuple):
+            tid, key, val = row[0], row[1], row[2]
+        else:
+            tid = row["team_id"]
+            key = row["label_key"]
+            val = row["label_value"]
+        if flat.get(str(key)) == str(val):
+            return tid if isinstance(tid, UUID) else UUID(str(tid))
+    return None
+
+
+async def fetch_team_rules(conn: asyncpg.Connection) -> list[asyncpg.Record]:
+    return await conn.fetch(
+        """
+        SELECT team_id, label_key, label_value
+        FROM team_label_rules
+        ORDER BY priority DESC, id ASC
+        """
+    )
+
+
+async def resolve_team_id_for_labels(
+    conn: asyncpg.Connection,
+    labels: dict[str, Any],
+) -> UUID | None:
+    rules = await fetch_team_rules(conn)
+    return match_team_for_labels(labels, list(rules))
--- a/onguard24/log_buffer.py
+++ b/onguard24/log_buffer.py
@ -0,0 +1,91 @@
+"""Кольцевой буфер логов + fan-out в SSE-очереди подписчиков.
+
+Подключается через RingBufferHandler в main.py (install_log_handler()).
+Потокобезопасен: emit() вызывается в любом потоке, asyncio-очереди
+обновляются через loop.call_soon_threadsafe.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import collections
+import logging
+import threading
+from datetime import datetime, timezone
+from typing import Any
+
+MAX_HISTORY = 600
+_lock = threading.Lock()
+_ring: collections.deque[dict[str, Any]] = collections.deque(maxlen=MAX_HISTORY)
+_subscribers: list[asyncio.Queue[dict[str, Any]]] = []
+_loop: asyncio.AbstractEventLoop | None = None
+
+
+def set_event_loop(loop: asyncio.AbstractEventLoop) -> None:
+    global _loop
+    _loop = loop
+
+
+def get_history() -> list[dict[str, Any]]:
+    with _lock:
+        return list(_ring)
+
+
+def subscribe() -> asyncio.Queue[dict[str, Any]]:
+    q: asyncio.Queue[dict[str, Any]] = asyncio.Queue(maxsize=300)
+    with _lock:
+        _subscribers.append(q)
+    return q
+
+
+def unsubscribe(q: asyncio.Queue[dict[str, Any]]) -> None:
+    with _lock:
+        try:
+            _subscribers.remove(q)
+        except ValueError:
+            pass
+
+
+def _push_to_subscriber(q: asyncio.Queue[dict[str, Any]], entry: dict[str, Any]) -> None:
+    try:
+        q.put_nowait(entry)
+    except asyncio.QueueFull:
+        pass
+
+
+class RingBufferHandler(logging.Handler):
+    """Logging handler — пишет в кольцевой буфер и раздаёт SSE-подписчикам."""
+
+    def emit(self, record: logging.LogRecord) -> None:
+        try:
+            msg = self.format(record)
+            ts = datetime.fromtimestamp(record.created, tz=timezone.utc).strftime(
+                "%Y-%m-%d %H:%M:%S"
+            )
+            entry: dict[str, Any] = {
+                "ts": ts,
+                "level": record.levelname,
+                "name": record.name,
+                "msg": msg,
+            }
+            with _lock:
+                _ring.append(entry)
+                subs = list(_subscribers)
+            if subs and _loop is not None and _loop.is_running():
+                for q in subs:
+                    _loop.call_soon_threadsafe(_push_to_subscriber, q, entry)
+        except Exception:
+            self.handleError(record)
+
+
+def install_log_handler(loop: asyncio.AbstractEventLoop) -> None:
+    """Вызывается один раз при старте: регистрирует handler на корневом логгере."""
+    set_event_loop(loop)
+    handler = RingBufferHandler()
+    handler.setFormatter(
+        logging.Formatter("%(name)s %(message)s")
+    )
+    handler.setLevel(logging.DEBUG)
+    root = logging.getLogger()
+    if not any(isinstance(h, RingBufferHandler) for h in root.handlers):
+        root.addHandler(handler)
--- a/onguard24/main.py
+++ b/onguard24/main.py
@ -1,3 +1,4 @@
+import asyncio
 import logging
 from contextlib import asynccontextmanager

@ -5,14 +6,16 @@ from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from starlette.responses import HTMLResponse, Response

+from onguard24 import __version__ as app_version
 from onguard24.config import get_settings
 from onguard24.db import create_pool
 from onguard24.domain.events import InMemoryEventBus
 from onguard24.ingress import grafana as grafana_ingress
+from onguard24.log_buffer import install_log_handler
 from onguard24.modules.registry import MODULE_MOUNTS, register_module_events
 from onguard24.root_html import render_root_page
 from onguard24.status_snapshot import build as build_status
-from onguard24 import __version__ as app_version
+from onguard24.ui_logs import router as logs_router

 logging.basicConfig(level=logging.INFO)
 logging.getLogger("httpx").setLevel(logging.WARNING)
@ -31,6 +34,7 @@ def parse_addr(http_addr: str) -> tuple[str, int]:

@asynccontextmanager
 async def lifespan(app: FastAPI):
+    install_log_handler(asyncio.get_event_loop())
    settings = get_settings()
    pool = await create_pool(settings)
    bus = InMemoryEventBus()
@ -38,7 +42,7 @@ async def lifespan(app: FastAPI):
    app.state.pool = pool
    app.state.settings = settings
    app.state.event_bus = bus
-    log.info("onGuard24 started, db=%s", "ok" if pool else "disabled")
+    log.info("onGuard24 started v%s, db=%s", app_version, "ok" if pool else "disabled")
    yield
    if pool:
        await pool.close()
@ -82,6 +86,7 @@ def create_app() -> FastAPI:
        return await build_status(request)

    app.include_router(grafana_ingress.router, prefix="/api/v1")
+    app.include_router(logs_router)
    for mount in MODULE_MOUNTS:
        app.include_router(mount.router, prefix=mount.url_prefix)
        if mount.ui_router is not None:
--- a/onguard24/modules/alerts.py
+++ b/onguard24/modules/alerts.py
@ -0,0 +1,457 @@
+"""Учёт входящих алертов (отдельно от инцидентов): firing → acknowledged → resolved."""
+
+from __future__ import annotations
+
+import html
+import json
+import logging
+from uuid import UUID
+
+import asyncpg
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import HTMLResponse
+from pydantic import BaseModel, Field
+
+from onguard24.deps import get_pool
+from onguard24.domain.events import EventBus
+from onguard24.modules.ui_support import wrap_module_html_page
+
+log = logging.getLogger(__name__)
+
+router = APIRouter(tags=["module-alerts"])
+ui_router = APIRouter(tags=["web-alerts"], include_in_schema=False)
+
+_VALID_STATUS = frozenset({"firing", "acknowledged", "resolved", "silenced"})
+
+
+def register_events(_bus: EventBus, _pool: asyncpg.Pool | None = None) -> None:
+    pass
+
+
+class AckBody(BaseModel):
+    by_user: str | None = Field(default=None, max_length=200, description="Кто подтвердил")
+
+
+class ResolveBody(BaseModel):
+    by_user: str | None = Field(default=None, max_length=200)
+
+
+def _row_to_item(r: asyncpg.Record) -> dict:
+    tid = r.get("team_id")
+    out = {
+        "id": str(r["id"]),
+        "ingress_event_id": str(r["ingress_event_id"]),
+        "status": r["status"],
+        "title": r["title"],
+        "severity": r["severity"],
+        "source": r["source"],
+        "grafana_org_slug": r["grafana_org_slug"],
+        "service_name": r["service_name"],
+        "labels": r["labels"] if isinstance(r["labels"], dict) else {},
+        "fingerprint": r["fingerprint"],
+        "team_id": str(tid) if tid is not None else None,
+        "team_slug": r.get("team_slug"),
+        "team_name": r.get("team_name"),
+        "acknowledged_at": r["acknowledged_at"].isoformat() if r["acknowledged_at"] else None,
+        "acknowledged_by": r["acknowledged_by"],
+        "resolved_at": r["resolved_at"].isoformat() if r["resolved_at"] else None,
+        "resolved_by": r["resolved_by"],
+        "created_at": r["created_at"].isoformat() if r["created_at"] else None,
+        "updated_at": r["updated_at"].isoformat() if r["updated_at"] else None,
+    }
+    return out
+
+
+_ALERT_SELECT = """
+    SELECT a.*, t.slug AS team_slug, t.name AS team_name
+    FROM irm_alerts a
+    LEFT JOIN teams t ON t.id = a.team_id
+"""
+
+
+async def _fetch_alert_with_team(conn: asyncpg.Connection, alert_id: UUID) -> asyncpg.Record | None:
+    return await conn.fetchrow(
+        f"{_ALERT_SELECT} WHERE a.id = $1::uuid",
+        alert_id,
+    )
+
+
+@router.get("/")
+async def list_alerts_api(
+    pool: asyncpg.Pool | None = Depends(get_pool),
+    status: str | None = None,
+    team_id: UUID | None = None,
+    limit: int = 100,
+):
+    if pool is None:
+        return {"items": [], "database": "disabled"}
+    limit = min(max(limit, 1), 200)
+    st = (status or "").strip().lower()
+    if st and st not in _VALID_STATUS:
+        raise HTTPException(status_code=400, detail="invalid status filter")
+    async with pool.acquire() as conn:
+        if st and team_id is not None:
+            rows = await conn.fetch(
+                f"""
+                {_ALERT_SELECT}
+                WHERE a.status = $1 AND a.team_id = $2::uuid
+                ORDER BY a.created_at DESC LIMIT $3
+                """,
+                st,
+                team_id,
+                limit,
+            )
+        elif st:
+            rows = await conn.fetch(
+                f"""
+                {_ALERT_SELECT}
+                WHERE a.status = $1
+                ORDER BY a.created_at DESC LIMIT $2
+                """,
+                st,
+                limit,
+            )
+        elif team_id is not None:
+            rows = await conn.fetch(
+                f"""
+                {_ALERT_SELECT}
+                WHERE a.team_id = $1::uuid
+                ORDER BY a.created_at DESC LIMIT $2
+                """,
+                team_id,
+                limit,
+            )
+        else:
+            rows = await conn.fetch(
+                f"""
+                {_ALERT_SELECT}
+                ORDER BY a.created_at DESC LIMIT $1
+                """,
+                limit,
+            )
+    return {"items": [_row_to_item(r) for r in rows]}
+
+
+@router.get("/{alert_id}")
+async def get_alert_api(alert_id: UUID, pool: asyncpg.Pool | None = Depends(get_pool)):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    async with pool.acquire() as conn:
+        row = await _fetch_alert_with_team(conn, alert_id)
+        raw = None
+        if row and row.get("ingress_event_id"):
+            raw = await conn.fetchrow(
+                "SELECT id, body, received_at FROM ingress_events WHERE id = $1::uuid",
+                row["ingress_event_id"],
+            )
+    if not row:
+        raise HTTPException(status_code=404, detail="not found")
+    out = _row_to_item(row)
+    if raw:
+        out["raw_received_at"] = raw["received_at"].isoformat() if raw["received_at"] else None
+        body = raw["body"]
+        out["raw_body"] = dict(body) if hasattr(body, "keys") else body
+    else:
+        out["raw_received_at"] = None
+        out["raw_body"] = None
+    return out
+
+
+@router.patch("/{alert_id}/acknowledge", status_code=200)
+async def acknowledge_alert_api(
+    alert_id: UUID,
+    body: AckBody,
+    pool: asyncpg.Pool | None = Depends(get_pool),
+):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    who = (body.by_user or "").strip() or None
+    async with pool.acquire() as conn:
+        uid = await conn.fetchval(
+            """
+            UPDATE irm_alerts SET
+                status = 'acknowledged',
+                acknowledged_at = now(),
+                acknowledged_by = COALESCE($2, acknowledged_by),
+                updated_at = now()
+            WHERE id = $1::uuid AND status = 'firing'
+            RETURNING id
+            """,
+            alert_id,
+            who,
+        )
+        if not uid:
+            raise HTTPException(status_code=409, detail="alert not in firing state or not found")
+        row = await _fetch_alert_with_team(conn, alert_id)
+    assert row is not None
+    return _row_to_item(row)
+
+
+@router.patch("/{alert_id}/resolve", status_code=200)
+async def resolve_alert_api(
+    alert_id: UUID,
+    body: ResolveBody,
+    pool: asyncpg.Pool | None = Depends(get_pool),
+):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    who = (body.by_user or "").strip() or None
+    async with pool.acquire() as conn:
+        uid = await conn.fetchval(
+            """
+            UPDATE irm_alerts SET
+                status = 'resolved',
+                resolved_at = now(),
+                resolved_by = COALESCE($2, resolved_by),
+                updated_at = now()
+            WHERE id = $1::uuid AND status IN ('firing', 'acknowledged')
+            RETURNING id
+            """,
+            alert_id,
+            who,
+        )
+        if not uid:
+            raise HTTPException(
+                status_code=409,
+                detail="alert cannot be resolved from current state or not found",
+            )
+        row = await _fetch_alert_with_team(conn, alert_id)
+    assert row is not None
+    return _row_to_item(row)
+
+
+_SYNC_BTN_STYLE = """
+<script>
+function ogAck(aid){fetch('/api/v1/modules/alerts/'+aid+'/acknowledge',{method:'PATCH',headers:{'Content-Type':'application/json'},body:JSON.stringify({})}).then(r=>{if(r.ok)location.reload();else r.text().then(t=>alert('Ошибка '+r.status+': '+t.slice(0,200)));});}
+function ogRes(aid){fetch('/api/v1/modules/alerts/'+aid+'/resolve',{method:'PATCH',headers:{'Content-Type':'application/json'},body:JSON.stringify({})}).then(r=>{if(r.ok)location.reload();else r.text().then(t=>alert('Ошибка '+r.status+': '+t.slice(0,200)));});}
+function ogInc(aid,title){var t=prompt('Заголовок инцидента',title||'');if(t===null)return;fetch('/api/v1/modules/incidents/',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({title:t,alert_ids:[aid]})}).then(r=>{if(r.ok)r.json().then(j=>location.href='/ui/modules/incidents/'+j.id);else r.text().then(x=>alert('Ошибка '+r.status+': '+x.slice(0,200)));});}
+</script>
+"""
+
+
+@ui_router.get("/", response_class=HTMLResponse)
+async def alerts_ui_list(request: Request):
+    pool = get_pool(request)
+    body = ""
+    filter_tid: UUID | None = None
+    raw_team = (request.query_params.get("team_id") or "").strip()
+    if raw_team:
+        try:
+            filter_tid = UUID(raw_team)
+        except ValueError:
+            filter_tid = None
+    if pool is None:
+        body = "<p>База не настроена.</p>"
+    else:
+        try:
+            async with pool.acquire() as conn:
+                teams_opts = await conn.fetch(
+                    "SELECT id, slug, name FROM teams ORDER BY name"
+                )
+                if filter_tid is not None:
+                    rows = await conn.fetch(
+                        """
+                        SELECT a.id, a.status, a.title, a.severity, a.grafana_org_slug,
+                               a.service_name, a.created_at, a.fingerprint,
+                               t.slug AS team_slug, t.name AS team_name, a.team_id
+                        FROM irm_alerts a
+                        LEFT JOIN teams t ON t.id = a.team_id
+                        WHERE a.team_id = $1::uuid
+                        ORDER BY a.created_at DESC
+                        LIMIT 150
+                        """,
+                        filter_tid,
+                    )
+                else:
+                    rows = await conn.fetch(
+                        """
+                        SELECT a.id, a.status, a.title, a.severity, a.grafana_org_slug,
+                               a.service_name, a.created_at, a.fingerprint,
+                               t.slug AS team_slug, t.name AS team_name, a.team_id
+                        FROM irm_alerts a
+                        LEFT JOIN teams t ON t.id = a.team_id
+                        ORDER BY a.created_at DESC
+                        LIMIT 150
+                        """
+                    )
+            if not rows:
+                body = "<p>Пока нет алертов. События появляются после вебхука Grafana.</p>"
+            else:
+                trs = []
+                for r in rows:
+                    aid = str(r["id"])
+                    ts = r.get("team_slug")
+                    tn = r.get("team_name")
+                    tid = r.get("team_id")
+                    team_cell = "—"
+                    if tid and ts:
+                        team_cell = (
+                            f"<a href=\"/ui/modules/teams/{html.escape(str(tid), quote=True)}\">"
+                            f"{html.escape(ts)}</a>"
+                        )
+                    elif tn:
+                        team_cell = html.escape(str(tn))
+                    trs.append(
+                        "<tr>"
+                        f"<td>{html.escape(r['status'])}</td>"
+                        f"<td><a href=\"/ui/modules/alerts/{html.escape(aid, quote=True)}\">"
+                        f"{html.escape(aid[:8])}…</a></td>"
+                        f"<td>{html.escape((r['title'] or '—')[:200])}</td>"
+                        f"<td>{html.escape(r['severity'])}</td>"
+                        f"<td>{team_cell}</td>"
+                        f"<td>{html.escape(str(r['grafana_org_slug'] or '—'))}</td>"
+                        f"<td>{html.escape(str(r['service_name'] or '—'))}</td>"
+                        f"<td>{html.escape(r['created_at'].isoformat() if r['created_at'] else '—')}</td>"
+                        "</tr>"
+                    )
+                opts = ["<option value=''>Все команды</option>"]
+                for t in teams_opts:
+                    tid = str(t["id"])
+                    sel = " selected" if filter_tid and str(filter_tid) == tid else ""
+                    opts.append(
+                        f"<option value='{html.escape(tid, quote=True)}'{sel}>"
+                        f"{html.escape(t['slug'])} — {html.escape(t['name'])}</option>"
+                    )
+                filter_form = (
+                    "<form method='get' class='og-filter-bar' style='margin-bottom:1rem'>"
+                    "<label>Команда <select name='team_id' onchange='this.form.submit()'>"
+                    + "".join(opts)
+                    + "</select></label></form>"
+                )
+                body = (
+                    "<p class='gc-muted'>Алерт — запись о входящем уведомлении. "
+                    "<strong>Инцидент</strong> создаётся вручную (из карточки алерта или раздела «Инциденты») "
+                    "и может ссылаться на один или несколько алертов. Команда назначается по "
+                    "<a href=\"/ui/modules/teams/\">правилам лейблов</a>.</p>"
+                    + filter_form
+                    + "<table class='irm-table'><thead><tr><th>Статус</th><th>ID</th><th>Заголовок</th>"
+                    "<th>Важность</th><th>Команда</th><th>Grafana slug</th><th>Сервис</th><th>Создан</th></tr></thead><tbody>"
+                    + "".join(trs)
+                    + "</tbody></table>"
+                )
+        except Exception as e:
+            body = f"<p class='module-err'>{html.escape(str(e))}</p>"
+    page = f"<h1>Алерты</h1>{body}{_SYNC_BTN_STYLE}"
+    return HTMLResponse(
+        wrap_module_html_page(
+            document_title="Алерты — onGuard24",
+            current_slug="alerts",
+            main_inner_html=page,
+        )
+    )
+
+
+@ui_router.get("/{alert_id:uuid}", response_class=HTMLResponse)
+async def alerts_ui_detail(request: Request, alert_id: UUID):
+    pool = get_pool(request)
+    if pool is None:
+        return HTMLResponse(
+            wrap_module_html_page(
+                document_title="Алерт — onGuard24",
+                current_slug="alerts",
+                main_inner_html="<h1>Алерт</h1><p>База не настроена.</p>",
+            )
+        )
+    try:
+        async with pool.acquire() as conn:
+            row = await _fetch_alert_with_team(conn, alert_id)
+            raw = None
+            if row and row.get("ingress_event_id"):
+                raw = await conn.fetchrow(
+                    "SELECT body, received_at FROM ingress_events WHERE id = $1::uuid",
+                    row["ingress_event_id"],
+                )
+    except Exception as e:
+        return HTMLResponse(
+            wrap_module_html_page(
+                document_title="Алерт — onGuard24",
+                current_slug="alerts",
+                main_inner_html=f"<h1>Алерт</h1><p class='module-err'>{html.escape(str(e))}</p>",
+            )
+        )
+    if not row:
+        inner = "<p>Не найдено.</p>"
+    else:
+        aid = str(row["id"])
+        st = row["status"]
+        title_js = json.dumps(row["title"] or "")
+        btns = []
+        if st == "firing":
+            btns.append(
+                f"<button type='button' class='og-btn og-btn-primary' "
+                f"onclick=\"ogAck('{html.escape(aid, quote=True)}')\">Подтвердить (Ack)</button>"
+            )
+        if st in ("firing", "acknowledged"):
+            btns.append(
+                f"<button type='button' class='og-btn' "
+                f"onclick=\"ogRes('{html.escape(aid, quote=True)}')\">Resolve</button>"
+            )
+        btns.append(
+            f"<button type='button' class='og-btn' "
+            f"onclick=\"ogInc('{html.escape(aid, quote=True)}',{title_js})\">"
+            "Создать инцидент</button>"
+        )
+        lab = row["labels"]
+        lab_s = json.dumps(dict(lab), ensure_ascii=False, indent=2) if isinstance(lab, dict) else "{}"
+        raw_pre = ""
+        if raw:
+            b = raw["body"]
+            pretty = json.dumps(dict(b), ensure_ascii=False, indent=2) if hasattr(b, "keys") else str(b)
+            if len(pretty) > 14000:
+                pretty = pretty[:14000] + "\n…"
+            raw_pre = (
+                "<h2 style='font-size:1.05rem;margin-top:1rem'>Полное тело вебхука</h2>"
+                f"<pre style='overflow:auto;max-height:26rem;font-size:0.78rem;"
+                f"background:#18181b;color:#e4e4e7;padding:0.75rem;border-radius:8px'>"
+                f"{html.escape(pretty)}</pre>"
+            )
+        team_dd = ""
+        if row.get("team_id") and row.get("team_slug"):
+            team_dd = (
+                f"<dt>Команда</dt><dd><a href=\"/ui/modules/teams/{html.escape(str(row['team_id']), quote=True)}\">"
+                f"{html.escape(row['team_slug'])}</a> ({html.escape(row.get('team_name') or '')})</dd>"
+            )
+        elif row.get("team_id"):
+            team_dd = f"<dt>Команда</dt><dd><code>{html.escape(str(row['team_id']))}</code></dd>"
+        inner = (
+            f"<p><a href=\"/ui/modules/alerts/\">← К списку алертов</a></p>"
+            f"<h1>Алерт</h1><div class='og-sync-bar'>{''.join(btns)}</div>"
+            f"<dl style='display:grid;grid-template-columns:11rem 1fr;gap:0.35rem 1rem;font-size:0.9rem'>"
+            f"<dt>ID</dt><dd><code>{html.escape(aid)}</code></dd>"
+            f"<dt>Статус</dt><dd>{html.escape(st)}</dd>"
+            f"<dt>Заголовок</dt><dd>{html.escape(row['title'] or '—')}</dd>"
+            f"<dt>Важность</dt><dd>{html.escape(row['severity'])}</dd>"
+            f"<dt>Grafana slug</dt><dd>{html.escape(str(row['grafana_org_slug'] or '—'))}</dd>"
+            f"<dt>Сервис</dt><dd>{html.escape(str(row['service_name'] or '—'))}</dd>"
+            + team_dd
+            + f"<dt>Fingerprint</dt><dd><code>{html.escape(str(row['fingerprint'] or '—'))}</code></dd>"
+            f"<dt>Labels</dt><dd><pre style='margin:0;font-size:0.8rem'>{html.escape(lab_s)}</pre></dd>"
+            f"</dl>{raw_pre}"
+        )
+    page = f"{inner}{_SYNC_BTN_STYLE}"
+    return HTMLResponse(
+        wrap_module_html_page(
+            document_title="Алерт — onGuard24",
+            current_slug="alerts",
+            main_inner_html=page,
+        )
+    )
+
+
+async def render_home_fragment(request: Request) -> str:
+    pool = get_pool(request)
+    if pool is None:
+        return '<p class="module-note">Нужна БД для учёта алертов.</p>'
+    try:
+        async with pool.acquire() as conn:
+            n = await conn.fetchval("SELECT count(*)::int FROM irm_alerts")
+            nf = await conn.fetchval(
+                "SELECT count(*)::int FROM irm_alerts WHERE status = 'firing'"
+            )
+    except Exception:
+        return '<p class="module-note">Таблица алертов недоступна (миграция 005?).</p>'
+    return (
+        f'<div class="module-fragment"><p>Алертов в учёте: <strong>{int(n)}</strong> '
+        f'(<strong>{int(nf)}</strong> firing). '
+        f'<a href="/ui/modules/alerts/">Открыть</a></p></div>'
+    )
--- a/onguard24/modules/grafana_catalog.py
+++ b/onguard24/modules/grafana_catalog.py
@ -238,47 +238,41 @@ async def list_meta_api(pool: asyncpg.Pool | None = Depends(get_pool)):
    return {"items": items}


-@router.get("/tree")
-async def tree_api(
-    instance_slug: str,
-    pool: asyncpg.Pool | None = Depends(get_pool),
-):
-    if pool is None:
-        raise HTTPException(status_code=503, detail="database disabled")
+async def _build_catalog_tree_dict(conn: asyncpg.Connection, instance_slug: str) -> dict | None:
+    """Сборка дерева из БД (общая логика для API и UI)."""
    slug = instance_slug.strip().lower()
-    async with pool.acquire() as conn:
-        meta = await conn.fetchrow(
-            """
-            SELECT * FROM grafana_catalog_meta
-            WHERE instance_slug = $1 AND grafana_org_id > 0
-            ORDER BY synced_at DESC LIMIT 1
-            """,
-            slug,
-        )
-        if not meta:
-            raise HTTPException(status_code=404, detail="no catalog for this slug; run POST /sync first")
-        oid = meta["grafana_org_id"]
-        folders = await conn.fetch(
-            """
-            SELECT folder_uid, title, parent_uid
-            FROM grafana_catalog_folders
-            WHERE instance_slug = $1 AND grafana_org_id = $2
-            ORDER BY title
-            """,
-            slug,
-            oid,
-        )
-        rules = await conn.fetch(
-            """
-            SELECT namespace_uid, rule_group_name, rule_uid, title,
-                   rule_group_interval, labels
-            FROM grafana_catalog_rules
-            WHERE instance_slug = $1 AND grafana_org_id = $2
-            ORDER BY namespace_uid, rule_group_name, title
-            """,
-            slug,
-            oid,
-        )
+    meta = await conn.fetchrow(
+        """
+        SELECT * FROM grafana_catalog_meta
+        WHERE instance_slug = $1 AND grafana_org_id > 0
+        ORDER BY synced_at DESC LIMIT 1
+        """,
+        slug,
+    )
+    if not meta:
+        return None
+    oid = meta["grafana_org_id"]
+    folders = await conn.fetch(
+        """
+        SELECT folder_uid, title, parent_uid
+        FROM grafana_catalog_folders
+        WHERE instance_slug = $1 AND grafana_org_id = $2
+        ORDER BY title
+        """,
+        slug,
+        oid,
+    )
+    rules = await conn.fetch(
+        """
+        SELECT namespace_uid, rule_group_name, rule_uid, title,
+               rule_group_interval, labels
+        FROM grafana_catalog_rules
+        WHERE instance_slug = $1 AND grafana_org_id = $2
+        ORDER BY namespace_uid, rule_group_name, title
+        """,
+        slug,
+        oid,
+    )

    by_ns: dict[str, list[dict]] = {}
    for r in rules:
@ -293,6 +287,10 @@ async def tree_api(
            }
        )

+    folder_uids = {f["folder_uid"] for f in folders}
+    orphans = sorted(set(by_ns.keys()) - folder_uids)
+    orphan_blocks = [{"namespace_uid": ns, "rules": by_ns[ns]} for ns in orphans]
+
    folder_nodes = []
    for f in folders:
        uid = f["folder_uid"]
@ -311,14 +309,118 @@ async def tree_api(
        "org_name": meta["org_name"],
        "synced_at": meta["synced_at"].isoformat() if meta["synced_at"] else None,
        "folders": folder_nodes,
-        "orphan_rule_namespaces": sorted(set(by_ns.keys()) - {f["folder_uid"] for f in folders}),
+        "orphan_rule_namespaces": orphans,
+        "orphan_rule_groups": orphan_blocks,
    }


+@router.get("/tree")
+async def tree_api(
+    instance_slug: str,
+    pool: asyncpg.Pool | None = Depends(get_pool),
+):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    async with pool.acquire() as conn:
+        data = await _build_catalog_tree_dict(conn, instance_slug)
+    if not data:
+        raise HTTPException(status_code=404, detail="no catalog for this slug; run POST /sync first")
+    return data
+
+
+def _rules_subtable_html(rules: list[dict]) -> str:
+    if not rules:
+        return "<p class='gc-muted'>Нет правил в этой группе/папке (по данным Ruler).</p>"
+    rows = []
+    for ru in rules:
+        title = html.escape(str(ru.get("title") or "—"))
+        uid = html.escape(str(ru.get("rule_uid") or "—"))
+        grp = html.escape(str(ru.get("rule_group") or "—"))
+        interval = html.escape(str(ru.get("interval") or "—"))
+        labels = ru.get("labels") or {}
+        lab_s = html.escape(json.dumps(labels, ensure_ascii=False)[:240])
+        if len(json.dumps(labels, ensure_ascii=False)) > 240:
+            lab_s += "…"
+        rows.append(
+            f"<tr><td>{title}</td><td><code>{uid}</code></td>"
+            f"<td>{grp}</td><td>{interval}</td><td><code>{lab_s}</code></td></tr>"
+        )
+    head = "<thead><tr><th>Название правила</th><th>rule_uid</th><th>Группа</th><th>Интервал</th><th>Labels (фрагмент)</th></tr></thead>"
+    return f"<table class='gc-subtable irm-table'>{head}<tbody>{''.join(rows)}</tbody></table>"
+
+
+def _catalog_tree_html(tree: dict) -> str:
+    """HTML: папки и правила под ними + «осиротевшие» namespace из Ruler."""
+    parts: list[str] = [
+        "<div class='gc-tree'><h2 style='font-size:1.1rem;margin:0 0 0.5rem'>Папки и правила</h2>"
+        "<p class='gc-muted' style='margin:0 0 0.75rem'>Папки — из API Grafana; правила — из Ruler, привязка по UID папки (namespace). "
+        "Название колонки «Правил» наверху — число всех записей с типом grafana_alert.</p>"
+    ]
+    for f in tree.get("folders") or []:
+        uid = html.escape(str(f.get("folder_uid") or ""))
+        title = html.escape(str(f.get("title") or "—"))
+        parent = f.get("parent_uid")
+        parent_s = html.escape(str(parent)) if parent else "—"
+        rules: list = f.get("rules") or []
+        n = len(rules)
+        summ = (
+            f"<strong>{title}</strong> "
+            f"<span class='gc-muted'>· UID папки <code>{uid}</code> · родитель <code>{parent_s}</code> · правил: {n}</span>"
+        )
+        parts.append(
+            f"<details class='gc-folder' open><summary>{summ}</summary>{_rules_subtable_html(rules)}</details>"
+        )
+    for block in tree.get("orphan_rule_groups") or []:
+        ns = block.get("namespace_uid")
+        rules = block.get("rules") or []
+        ns_e = html.escape(str(ns))
+        parts.append(
+            f"<div class='gc-orphan'><strong>Namespace Ruler без папки в API</strong> "
+            f"(<code>{ns_e}</code>) — часто системная группа. Правил: {len(rules)}."
+            f"{_rules_subtable_html(rules)}</div>"
+        )
+    parts.append("</div>")
+    return "".join(parts)
+
+
+_SYNC_SCRIPT = """
+<script>
+(function () {
+  var btn = document.getElementById('og-sync-btn');
+  var st = document.getElementById('og-sync-status');
+  if (!btn || !st) return;
+  btn.addEventListener('click', function () {
+    st.textContent = 'Синхронизация…';
+    btn.disabled = true;
+    fetch('/api/v1/modules/grafana-catalog/sync', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}'
+    }).then(function (r) {
+      return r.text().then(function (t) {
+        if (!r.ok) {
+          st.textContent = 'Ошибка HTTP ' + r.status + ': ' + (t.slice(0, 400) || r.statusText);
+          btn.disabled = false;
+          return;
+        }
+        st.textContent = 'Готово, обновляем страницу…';
+        location.reload();
+      });
+    }).catch(function (e) {
+      st.textContent = 'Сбой сети: ' + e;
+      btn.disabled = false;
+    });
+  });
+})();
+</script>
+"""
+
+
@ui_router.get("/", response_class=HTMLResponse)
 async def grafana_catalog_ui(request: Request):
    pool = get_pool(request)
    inner = ""
+    tree_html = ""
    if pool is None:
        inner = "<p>База не настроена.</p>"
    else:
@ -331,12 +433,26 @@ async def grafana_catalog_ui(request: Request):
                    ORDER BY instance_slug
                    """
                )
+            sync_bar = """<div class="og-sync-bar">
+<button type="button" class="og-btn og-btn-primary" id="og-sync-btn">Синхронизировать с Grafana</button>
+<span class="og-sync-status" id="og-sync-status"></span>
+</div>"""
            if not rows:
-                inner = "<p>Каталог пуст. Вызовите <code>POST /api/v1/modules/grafana-catalog/sync</code>.</p>"
+                inner = (
+                    sync_bar
+                    + "<p>Каталог пуст — нажмите кнопку выше (нужны <code>GRAFANA_URL</code> и токен в .env).</p>"
+                )
            else:
-                inner = "<table class='irm-table'><thead><tr><th>Slug</th><th>Org</th><th>Синхр.</th><th>Папок</th><th>Правил</th><th>Ошибка</th></tr></thead><tbody>"
+                inner = (
+                    sync_bar
+                    + "<p class='gc-muted'>Строка ниже — сводка по последней синхронизации. "
+                    "Число <strong>Правил</strong> — все правила алертинга (Grafana-managed) из Ruler для этой org.</p>"
+                    + "<table class='irm-table'><thead><tr><th>Slug</th><th>Org</th><th>Синхр.</th>"
+                    "<th>Папок (API)</th><th>Правил (Ruler)</th><th>Ошибка</th></tr></thead><tbody>"
+                )
+                seen_slugs: set[str] = set()
                for r in rows:
-                    err = html.escape(str(r["error_text"] or "—"))[:120]
+                    err = html.escape(str(r["error_text"] or "—"))[:200]
                    st = r["synced_at"].isoformat() if r["synced_at"] else "—"
                    inner += (
                        f"<tr><td>{html.escape(r['instance_slug'])}</td>"
@ -345,13 +461,27 @@ async def grafana_catalog_ui(request: Request):
                        f"<td>{r['folder_count']}</td><td>{r['rule_count']}</td>"
                        f"<td>{err}</td></tr>"
                    )
+                    slug = str(r["instance_slug"])
+                    if slug not in seen_slugs:
+                        seen_slugs.add(slug)
                inner += "</tbody></table>"
+                async with pool.acquire() as conn:
+                    for slug in sorted(seen_slugs):
+                        tree = await _build_catalog_tree_dict(conn, slug)
+                        if tree:
+                            tree_html += (
+                                f"<h2 style='font-size:1.15rem;margin:1.25rem 0 0.35rem'>Инстанс "
+                                f"<code>{html.escape(slug)}</code> · {html.escape(str(tree['org_name']))}</h2>"
+                                + _catalog_tree_html(tree)
+                            )
        except Exception as e:
            inner = f"<p class='module-err'>{html.escape(str(e))}</p>"
    page = f"""<h1>Каталог Grafana</h1>
-<p>Иерархия: инстанс (slug) → организация → папки → правила. Синхронизация по HTTP API.</p>
+<p>Иерархия: инстанс (slug) → организация → папки (имена и UID) → правила (название, UID, группа, интервал, labels).</p>
 {inner}
-<p><small>API: <code>POST …/grafana-catalog/sync</code>, <code>GET …/grafana-catalog/tree?instance_slug=…</code></small></p>"""
+{tree_html}
+<p><small>API: <code>POST /api/v1/modules/grafana-catalog/sync</code>, <code>GET …/tree?instance_slug=…</code></small></p>
+{_SYNC_SCRIPT}"""
    return HTMLResponse(
        wrap_module_html_page(
            document_title="Каталог Grafana — onGuard24",
--- a/onguard24/modules/incidents.py
+++ b/onguard24/modules/incidents.py
@ -3,6 +3,7 @@
 from __future__ import annotations

 import html
+import json
 import logging
 from uuid import UUID

@ -11,6 +12,7 @@ from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import HTMLResponse
 from pydantic import BaseModel, Field

+from onguard24.config import get_settings
 from onguard24.deps import get_pool
 from onguard24.domain.events import AlertReceived, DomainEvent, EventBus
 from onguard24.modules.ui_support import wrap_module_html_page
@ -25,6 +27,7 @@ class IncidentCreate(BaseModel):
    title: str = Field(..., min_length=1, max_length=500)
    status: str = Field(default="open", max_length=64)
    severity: str = Field(default="warning", max_length=32)
+    alert_ids: list[UUID] = Field(default_factory=list, description="Привязка к irm_alerts")


 class IncidentPatch(BaseModel):
@ -38,6 +41,8 @@ def register_events(bus: EventBus, pool: asyncpg.Pool | None = None) -> None:
        return

    async def on_alert(ev: DomainEvent) -> None:
+        if not get_settings().auto_incident_from_alert:
+            return
        if not isinstance(ev, AlertReceived) or ev.raw_payload_ref is None:
            return
        a = ev.alert
@ -135,17 +140,29 @@ async def create_incident_api(
    if pool is None:
        raise HTTPException(status_code=503, detail="database disabled")
    async with pool.acquire() as conn:
-        row = await conn.fetchrow(
-            """
-            INSERT INTO incidents (title, status, severity, source, grafana_org_slug, service_name)
-            VALUES ($1, $2, $3, 'manual', NULL, NULL)
-            RETURNING id, title, status, severity, source, ingress_event_id, created_at, updated_at,
-                      grafana_org_slug, service_name
-            """,
-            body.title.strip(),
-            body.status,
-            body.severity,
-        )
+        async with conn.transaction():
+            row = await conn.fetchrow(
+                """
+                INSERT INTO incidents (title, status, severity, source, grafana_org_slug, service_name)
+                VALUES ($1, $2, $3, 'manual', NULL, NULL)
+                RETURNING id, title, status, severity, source, ingress_event_id, created_at, updated_at,
+                          grafana_org_slug, service_name
+                """,
+                body.title.strip(),
+                body.status,
+                body.severity,
+            )
+            iid = row["id"]
+            for aid in body.alert_ids[:50]:
+                await conn.execute(
+                    """
+                    INSERT INTO incident_alert_links (incident_id, alert_id)
+                    VALUES ($1::uuid, $2::uuid)
+                    ON CONFLICT DO NOTHING
+                    """,
+                    iid,
+                    aid,
+                )
    return {
        "id": str(row["id"]),
        "title": row["title"],
@ -261,6 +278,11 @@ async def patch_incident_api(
    return _incident_row_dict(row)


+def _title_cell(raw: object) -> str:
+    t = (str(raw).strip() if raw is not None else "") or "—"
+    return html.escape(t)
+
+
@ui_router.get("/", response_class=HTMLResponse)
 async def incidents_ui_home(request: Request):
    pool = get_pool(request)
@ -280,17 +302,22 @@ async def incidents_ui_home(request: Request):
                    """
                )
            for r in rows:
+                iid = r["id"]
+                iid_s = str(iid)
                org = html.escape(str(r["grafana_org_slug"] or "—"))
                svc = html.escape(str(r["service_name"] or "—"))
+                ca = r["created_at"].isoformat() if r["created_at"] else "—"
                rows_html += (
                    "<tr>"
-                    f"<td>{html.escape(str(r['id']))[:8]}…</td>"
-                    f"<td>{html.escape(r['title'])}</td>"
+                    f"<td><a href=\"/ui/modules/incidents/{html.escape(iid_s, quote=True)}\">"
+                    f"{html.escape(iid_s[:8])}…</a></td>"
+                    f"<td>{_title_cell(r['title'])}</td>"
                    f"<td>{html.escape(r['status'])}</td>"
                    f"<td>{html.escape(r['severity'])}</td>"
                    f"<td>{html.escape(r['source'])}</td>"
                    f"<td>{org}</td>"
                    f"<td>{svc}</td>"
+                    f"<td>{html.escape(ca)}</td>"
                    "</tr>"
                )
        except Exception as e:
@ -298,10 +325,10 @@ async def incidents_ui_home(request: Request):
    inner = f"""<h1>Инциденты</h1>
 {err}
 <table class="irm-table">
-<thead><tr><th>ID</th><th>Заголовок</th><th>Статус</th><th>Важность</th><th>Источник</th><th>Grafana slug</th><th>Сервис</th></tr></thead>
-<tbody>{rows_html or '<tr><td colspan="7">Пока нет записей</td></tr>'}</tbody>
+<thead><tr><th>ID</th><th>Заголовок</th><th>Статус</th><th>Важность</th><th>Источник</th><th>Grafana slug</th><th>Сервис</th><th>Создан</th></tr></thead>
+<tbody>{rows_html or '<tr><td colspan="8">Пока нет записей</td></tr>'}</tbody>
 </table>
-<p><small>Создание из Grafana: webhook → запись в <code>ingress_events</code> → событие → строка здесь.</small></p>"""
+<p><small>Сначала вебхук создаёт <a href="/ui/modules/alerts/">алерт</a> (учёт, Ack/Resolve). Инцидент — отдельная сущность: создаётся вручную или из карточки алерта, к нему можно привязать один или несколько алертов. Пустой заголовок в списке — часто тестовый JSON без полей правила.</small></p>"""
    return HTMLResponse(
        wrap_module_html_page(
            document_title="Инциденты — onGuard24",
@ -309,3 +336,90 @@ async def incidents_ui_home(request: Request):
            main_inner_html=inner,
        )
    )
+
+
+@ui_router.get("/{incident_id:uuid}", response_class=HTMLResponse)
+async def incident_detail_ui(request: Request, incident_id: UUID):
+    pool = get_pool(request)
+    if pool is None:
+        body = "<p>База данных не настроена.</p>"
+        return HTMLResponse(
+            wrap_module_html_page(
+                document_title="Инцидент — onGuard24",
+                current_slug="incidents",
+                main_inner_html=f"<h1>Инцидент</h1>{body}",
+            )
+        )
+    try:
+        async with pool.acquire() as conn:
+            row = await conn.fetchrow(
+                """
+                SELECT id, title, status, severity, source, ingress_event_id, created_at, updated_at,
+                       grafana_org_slug, service_name
+                FROM incidents WHERE id = $1::uuid
+                """,
+                incident_id,
+            )
+            raw_row = None
+            if row and row.get("ingress_event_id"):
+                raw_row = await conn.fetchrow(
+                    """
+                    SELECT id, source, received_at, body, org_slug, service_name
+                    FROM ingress_events WHERE id = $1::uuid
+                    """,
+                    row["ingress_event_id"],
+                )
+    except Exception as e:
+        return HTMLResponse(
+            wrap_module_html_page(
+                document_title="Инцидент — onGuard24",
+                current_slug="incidents",
+                main_inner_html=f"<h1>Инцидент</h1><p class='module-err'>{html.escape(str(e))}</p>",
+            )
+        )
+    if not row:
+        body = "<p>Запись не найдена.</p>"
+    else:
+        title = _title_cell(row["title"])
+        ing = row["ingress_event_id"]
+        ing_l = html.escape(str(ing)) if ing else "—"
+        meta = f"""<dl style="display:grid;grid-template-columns:10rem 1fr;gap:0.35rem 1rem;font-size:0.9rem">
+<dt>ID</dt><dd><code>{html.escape(str(row['id']))}</code></dd>
+<dt>Заголовок</dt><dd>{title}</dd>
+<dt>Статус</dt><dd>{html.escape(row['status'])}</dd>
+<dt>Важность</dt><dd>{html.escape(row['severity'])}</dd>
+<dt>Источник</dt><dd>{html.escape(row['source'])}</dd>
+<dt>Grafana slug</dt><dd>{html.escape(str(row['grafana_org_slug'] or '—'))}</dd>
+<dt>Сервис</dt><dd>{html.escape(str(row['service_name'] or '—'))}</dd>
+<dt>Создан</dt><dd>{html.escape(row['created_at'].isoformat() if row['created_at'] else '—')}</dd>
+<dt>Обновлён</dt><dd>{html.escape(row['updated_at'].isoformat() if row.get('updated_at') else '—')}</dd>
+<dt>ingress_event_id</dt><dd><code>{ing_l}</code></dd>
+</dl>"""
+        raw_block = ""
+        if raw_row:
+            try:
+                body_obj = raw_row["body"]
+                if hasattr(body_obj, "keys"):
+                    pretty = json.dumps(dict(body_obj), ensure_ascii=False, indent=2)
+                else:
+                    pretty = str(body_obj)
+                if len(pretty) > 12000:
+                    pretty = pretty[:12000] + "\n…"
+                raw_block = (
+                    "<h2 style='font-size:1.05rem;margin-top:1.25rem'>Сырой JSON вебхука</h2>"
+                    f"<p class='gc-muted'>ingress_events · {html.escape(str(raw_row['received_at']))}</p>"
+                    f"<pre style='overflow:auto;max-height:28rem;font-size:0.78rem;background:#18181b;color:#e4e4e7;"
+                    f"padding:0.75rem;border-radius:8px'>{html.escape(pretty)}</pre>"
+                )
+            except Exception as ex:
+                raw_block = f"<p class='module-err'>Не удалось показать JSON: {html.escape(str(ex))}</p>"
+        body = (
+            f"<p><a href=\"/ui/modules/incidents/\">← К списку</a></p><h1>Инцидент</h1>{meta}{raw_block}"
+        )
+    return HTMLResponse(
+        wrap_module_html_page(
+            document_title="Инцидент — onGuard24",
+            current_slug="incidents",
+            main_inner_html=body,
+        )
+    )
--- a/onguard24/modules/registry.py
+++ b/onguard24/modules/registry.py
@ -14,6 +14,7 @@ from starlette.requests import Request

 from onguard24.domain.events import EventBus
 from onguard24.modules import (
+    alerts,
    contacts,
    escalations,
    grafana_catalog,
@ -21,6 +22,7 @@ from onguard24.modules import (
    schedules,
    statusboard,
    tasks,
+    teams,
 )

 # async (Request) -> str — фрагмент HTML для главной страницы (опционально)
@ -52,6 +54,24 @@ def _mounts() -> list[ModuleMount]:
            ui_router=grafana_catalog.ui_router,
            render_home_fragment=grafana_catalog.render_home_fragment,
        ),
+        ModuleMount(
+            router=alerts.router,
+            url_prefix="/api/v1/modules/alerts",
+            register_events=alerts.register_events,
+            slug="alerts",
+            title="Алерты",
+            ui_router=alerts.ui_router,
+            render_home_fragment=alerts.render_home_fragment,
+        ),
+        ModuleMount(
+            router=teams.router,
+            url_prefix="/api/v1/modules/teams",
+            register_events=teams.register_events,
+            slug="teams",
+            title="Команды",
+            ui_router=teams.ui_router,
+            render_home_fragment=teams.render_home_fragment,
+        ),
        ModuleMount(
            router=incidents.router,
            url_prefix="/api/v1/modules/incidents",
--- a/onguard24/modules/teams.py
+++ b/onguard24/modules/teams.py
@ -0,0 +1,378 @@
+"""IRM: команды (teams) — как Team в Grafana IRM; правила сопоставления по лейблам алерта."""
+
+from __future__ import annotations
+
+import html
+import re
+from uuid import UUID
+
+import asyncpg
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import HTMLResponse
+from pydantic import BaseModel, Field
+
+from onguard24.deps import get_pool
+from onguard24.domain.events import EventBus
+from onguard24.modules.ui_support import wrap_module_html_page
+
+router = APIRouter(tags=["module-teams"])
+ui_router = APIRouter(tags=["web-teams"], include_in_schema=False)
+
+_SLUG_RE = re.compile(r"^[a-z0-9][a-z0-9_-]{0,62}$")
+
+
+def register_events(_bus: EventBus, _pool: asyncpg.Pool | None = None) -> None:
+    pass
+
+
+def _normalize_slug(raw: str) -> str:
+    s = raw.strip().lower()
+    if not _SLUG_RE.match(s):
+        raise HTTPException(
+            status_code=400,
+            detail="slug: 1–63 символа, a-z 0-9 _ -, начинается с буквы или цифры",
+        )
+    return s
+
+
+class TeamCreate(BaseModel):
+    slug: str = Field(..., min_length=1, max_length=63)
+    name: str = Field(..., min_length=1, max_length=200)
+    description: str | None = Field(default=None, max_length=2000)
+
+
+class TeamPatch(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=200)
+    description: str | None = Field(default=None, max_length=2000)
+
+
+class RuleCreate(BaseModel):
+    label_key: str = Field(..., min_length=1, max_length=500)
+    label_value: str = Field(..., min_length=1, max_length=2000)
+    priority: int = Field(default=0, ge=-1000, le=100000)
+
+
+def _team_row(r: asyncpg.Record) -> dict:
+    return {
+        "id": str(r["id"]),
+        "slug": r["slug"],
+        "name": r["name"],
+        "description": r["description"],
+        "created_at": r["created_at"].isoformat() if r["created_at"] else None,
+    }
+
+
+def _rule_row(r: asyncpg.Record) -> dict:
+    return {
+        "id": str(r["id"]),
+        "team_id": str(r["team_id"]),
+        "label_key": r["label_key"],
+        "label_value": r["label_value"],
+        "priority": int(r["priority"]),
+        "created_at": r["created_at"].isoformat() if r["created_at"] else None,
+    }
+
+
+@router.get("/")
+async def list_teams_api(pool: asyncpg.Pool | None = Depends(get_pool)):
+    if pool is None:
+        return {"items": [], "database": "disabled"}
+    async with pool.acquire() as conn:
+        rows = await conn.fetch(
+            """
+            SELECT id, slug, name, description, created_at
+            FROM teams
+            ORDER BY name
+            """
+        )
+    return {"items": [_team_row(r) for r in rows]}
+
+
+@router.post("/", status_code=201)
+async def create_team_api(body: TeamCreate, pool: asyncpg.Pool | None = Depends(get_pool)):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    slug = _normalize_slug(body.slug)
+    async with pool.acquire() as conn:
+        try:
+            row = await conn.fetchrow(
+                """
+                INSERT INTO teams (slug, name, description)
+                VALUES ($1, $2, $3)
+                RETURNING id, slug, name, description, created_at
+                """,
+                slug,
+                body.name.strip(),
+                (body.description or "").strip() or None,
+            )
+        except asyncpg.UniqueViolationError:
+            raise HTTPException(status_code=409, detail="team slug already exists") from None
+    return _team_row(row)
+
+
+@router.get("/{team_id}")
+async def get_team_api(team_id: UUID, pool: asyncpg.Pool | None = Depends(get_pool)):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    async with pool.acquire() as conn:
+        row = await conn.fetchrow(
+            """
+            SELECT id, slug, name, description, created_at
+            FROM teams WHERE id = $1::uuid
+            """,
+            team_id,
+        )
+    if not row:
+        raise HTTPException(status_code=404, detail="not found")
+    return _team_row(row)
+
+
+@router.patch("/{team_id}", status_code=200)
+async def patch_team_api(
+    team_id: UUID,
+    body: TeamPatch,
+    pool: asyncpg.Pool | None = Depends(get_pool),
+):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    name = body.name.strip() if body.name is not None else None
+    desc = body.description
+    if desc is not None:
+        desc = desc.strip() or None
+    async with pool.acquire() as conn:
+        row = await conn.fetchrow(
+            """
+            UPDATE teams SET
+                name = COALESCE($2, name),
+                description = COALESCE($3, description)
+            WHERE id = $1::uuid
+            RETURNING id, slug, name, description, created_at
+            """,
+            team_id,
+            name,
+            desc,
+        )
+    if not row:
+        raise HTTPException(status_code=404, detail="not found")
+    return _team_row(row)
+
+
+@router.delete("/{team_id}", status_code=204)
+async def delete_team_api(team_id: UUID, pool: asyncpg.Pool | None = Depends(get_pool)):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    async with pool.acquire() as conn:
+        r = await conn.execute("DELETE FROM teams WHERE id = $1::uuid", team_id)
+    if r == "DELETE 0":
+        raise HTTPException(status_code=404, detail="not found")
+
+
+@router.get("/{team_id}/rules")
+async def list_rules_api(team_id: UUID, pool: asyncpg.Pool | None = Depends(get_pool)):
+    if pool is None:
+        return {"items": [], "database": "disabled"}
+    async with pool.acquire() as conn:
+        ok = await conn.fetchval("SELECT 1 FROM teams WHERE id = $1::uuid", team_id)
+        if not ok:
+            raise HTTPException(status_code=404, detail="team not found")
+        rows = await conn.fetch(
+            """
+            SELECT id, team_id, label_key, label_value, priority, created_at
+            FROM team_label_rules
+            WHERE team_id = $1::uuid
+            ORDER BY priority DESC, id ASC
+            """,
+            team_id,
+        )
+    return {"items": [_rule_row(r) for r in rows]}
+
+
+@router.post("/{team_id}/rules", status_code=201)
+async def create_rule_api(
+    team_id: UUID,
+    body: RuleCreate,
+    pool: asyncpg.Pool | None = Depends(get_pool),
+):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    async with pool.acquire() as conn:
+        ok = await conn.fetchval("SELECT 1 FROM teams WHERE id = $1::uuid", team_id)
+        if not ok:
+            raise HTTPException(status_code=404, detail="team not found")
+        row = await conn.fetchrow(
+            """
+            INSERT INTO team_label_rules (team_id, label_key, label_value, priority)
+            VALUES ($1::uuid, $2, $3, $4)
+            RETURNING id, team_id, label_key, label_value, priority, created_at
+            """,
+            team_id,
+            body.label_key.strip(),
+            body.label_value.strip(),
+            body.priority,
+        )
+    return _rule_row(row)
+
+
+@router.delete("/{team_id}/rules/{rule_id}", status_code=204)
+async def delete_rule_api(
+    team_id: UUID,
+    rule_id: UUID,
+    pool: asyncpg.Pool | None = Depends(get_pool),
+):
+    if pool is None:
+        raise HTTPException(status_code=503, detail="database disabled")
+    async with pool.acquire() as conn:
+        r = await conn.execute(
+            """
+            DELETE FROM team_label_rules
+            WHERE id = $1::uuid AND team_id = $2::uuid
+            """,
+            rule_id,
+            team_id,
+        )
+    if r == "DELETE 0":
+        raise HTTPException(status_code=404, detail="not found")
+
+
+@ui_router.get("/", response_class=HTMLResponse)
+async def teams_ui_list(request: Request):
+    pool = get_pool(request)
+    inner = ""
+    if pool is None:
+        inner = "<p>База не настроена.</p>"
+    else:
+        try:
+            async with pool.acquire() as conn:
+                rows = await conn.fetch(
+                    """
+                    SELECT t.id, t.slug, t.name,
+                           (SELECT count(*)::int FROM team_label_rules r WHERE r.team_id = t.id) AS n_rules,
+                           (SELECT count(*)::int FROM irm_alerts a WHERE a.team_id = t.id) AS n_alerts
+                    FROM teams t
+                    ORDER BY t.name
+                    """
+                )
+            if not rows:
+                inner = (
+                    "<p>Команд пока нет. Создайте команду через API "
+                    "<code>POST /api/v1/modules/teams/</code> и добавьте правила лейблов — "
+                    "новые алерты из Grafana получат <code>team_id</code> при совпадении.</p>"
+                )
+            else:
+                trs = []
+                for r in rows:
+                    tid = str(r["id"])
+                    trs.append(
+                        "<tr>"
+                        f"<td><a href=\"/ui/modules/teams/{html.escape(tid, quote=True)}\">"
+                        f"{html.escape(r['slug'])}</a></td>"
+                        f"<td>{html.escape(r['name'])}</td>"
+                        f"<td>{int(r['n_rules'])}</td>"
+                        f"<td>{int(r['n_alerts'])}</td>"
+                        "</tr>"
+                    )
+                inner = (
+                    "<p class='gc-muted'>Команда соответствует колонке <strong>Team</strong> в Grafana IRM. "
+                    "Сопоставление: первое правило по приоритету, у которого совпали ключ и значение лейбла.</p>"
+                    "<table class='irm-table'><thead><tr><th>Slug</th><th>Название</th>"
+                    "<th>Правил</th><th>Алертов</th></tr></thead><tbody>"
+                    + "".join(trs)
+                    + "</tbody></table>"
+                )
+        except Exception as e:
+            inner = f"<p class='module-err'>{html.escape(str(e))}</p>"
+    page = f"<h1>Команды</h1>{inner}"
+    return HTMLResponse(
+        wrap_module_html_page(
+            document_title="Команды — onGuard24",
+            current_slug="teams",
+            main_inner_html=page,
+        )
+    )
+
+
+@ui_router.get("/{team_id:uuid}", response_class=HTMLResponse)
+async def teams_ui_detail(request: Request, team_id: UUID):
+    pool = get_pool(request)
+    if pool is None:
+        return HTMLResponse(
+            wrap_module_html_page(
+                document_title="Команда — onGuard24",
+                current_slug="teams",
+                main_inner_html="<h1>Команда</h1><p>База не настроена.</p>",
+            )
+        )
+    try:
+        async with pool.acquire() as conn:
+            team = await conn.fetchrow(
+                "SELECT id, slug, name, description FROM teams WHERE id = $1::uuid",
+                team_id,
+            )
+            rules = await conn.fetch(
+                """
+                SELECT label_key, label_value, priority, id
+                FROM team_label_rules
+                WHERE team_id = $1::uuid
+                ORDER BY priority DESC, id ASC
+                """,
+                team_id,
+            )
+    except Exception as e:
+        return HTMLResponse(
+            wrap_module_html_page(
+                document_title="Команда — onGuard24",
+                current_slug="teams",
+                main_inner_html=f"<h1>Команда</h1><p class='module-err'>{html.escape(str(e))}</p>",
+            )
+        )
+    if not team:
+        inner = "<p>Не найдено.</p>"
+    else:
+        tid = str(team["id"])
+        rows_html = []
+        for ru in rules:
+            rows_html.append(
+                "<tr>"
+                f"<td><code>{html.escape(ru['label_key'])}</code></td>"
+                f"<td><code>{html.escape(ru['label_value'])}</code></td>"
+                f"<td>{int(ru['priority'])}</td>"
+                f"<td><code>{html.escape(str(ru['id']))}</code></td>"
+                "</tr>"
+            )
+        desc = html.escape(team["description"] or "—")
+        inner = (
+            f"<p><a href=\"/ui/modules/teams/\">← К списку команд</a></p>"
+            f"<h1>{html.escape(team['name'])}</h1>"
+            f"<p><strong>slug:</strong> <code>{html.escape(team['slug'])}</code></p>"
+            f"<p><strong>Описание:</strong> {desc}</p>"
+            "<h2 style='font-size:1.05rem;margin-top:1rem'>Правила лейблов</h2>"
+            "<p class='gc-muted'>Пример: <code>team</code> = <code>infra</code> — как в ваших алертах Grafana.</p>"
+            "<table class='irm-table'><thead><tr><th>Ключ</th><th>Значение</th><th>Priority</th><th>ID правила</th></tr></thead><tbody>"
+            + ("".join(rows_html) or "<tr><td colspan='4'>Правил нет — добавьте через API.</td></tr>")
+            + "</tbody></table>"
+            f"<p style='margin-top:1rem;font-size:0.85rem'>API: "
+            f"<code>POST /api/v1/modules/teams/{tid}/rules</code> с JSON "
+            "<code>{\"label_key\":\"team\",\"label_value\":\"infra\",\"priority\":10}</code></p>"
+        )
+    return HTMLResponse(
+        wrap_module_html_page(
+            document_title="Команда — onGuard24",
+            current_slug="teams",
+            main_inner_html=inner,
+        )
+    )
+
+
+async def render_home_fragment(request: Request) -> str:
+    pool = get_pool(request)
+    if pool is None:
+        return '<p class="module-note">Нужна БД для команд.</p>'
+    try:
+        async with pool.acquire() as conn:
+            n = await conn.fetchval("SELECT count(*)::int FROM teams")
+    except Exception:
+        return '<p class="module-note">Таблица teams недоступна (миграция 006?).</p>'
+    return (
+        f'<div class="module-fragment"><p>Команд: <strong>{int(n)}</strong>. '
+        f'<a href="/ui/modules/teams/">Открыть</a></p></div>'
+    )
--- a/onguard24/modules/ui_support.py
+++ b/onguard24/modules/ui_support.py
@ -30,6 +30,23 @@ APP_SHELL_CSS = """
    .irm-table { width: 100%; border-collapse: collapse; font-size: 0.9rem; }
    .irm-table th, .irm-table td { border: 1px solid #e4e4e7; padding: 0.45rem 0.65rem; text-align: left; }
    .irm-table thead th { background: #f4f4f5; }
+    .og-btn { padding: 0.45rem 0.9rem; font-size: 0.875rem; border-radius: 6px;
+      border: 1px solid #d4d4d8; background: #fff; cursor: pointer; margin-right: 0.5rem; }
+    .og-btn:hover { background: #f4f4f5; }
+    .og-btn-primary { background: #2563eb; color: #fff; border-color: #1d4ed8; }
+    .og-btn-primary:hover { background: #1d4ed8; }
+    .og-sync-bar { display: flex; flex-wrap: wrap; align-items: center; gap: 0.5rem; margin: 1rem 0; }
+    .og-sync-status { font-size: 0.85rem; color: #52525b; min-height: 1.25rem; }
+    .gc-tree { margin-top: 1.25rem; }
+    .gc-folder { margin: 0.4rem 0; border: 1px solid #e4e4e7; border-radius: 8px; padding: 0.35rem 0.6rem; background: #fff; }
+    .gc-folder summary { cursor: pointer; list-style: none; }
+    .gc-folder summary::-webkit-details-marker { display: none; }
+    .gc-muted { color: #71717a; font-size: 0.82rem; font-weight: normal; }
+    .gc-subtable { width: 100%; border-collapse: collapse; font-size: 0.82rem; margin: 0.5rem 0 0.25rem; }
+    .gc-subtable th, .gc-subtable td { border: 1px solid #e4e4e7; padding: 0.3rem 0.45rem; }
+    .gc-subtable th { background: #fafafa; }
+    .gc-orphan { margin-top: 1rem; padding: 0.75rem; background: #fffbeb; border: 1px solid #fcd34d; border-radius: 8px; font-size: 0.88rem; }
+    .rail-item--util { border-top: 1px solid #e4e4e7; margin-top: 0.4rem; padding-top: 0.4rem; }
 """


@ -56,6 +73,11 @@ def nav_rail_html(current_slug: str | None = None) -> str:
        items.append(
            f'<li class="{licls}"><a href="{html.escape(href)}"{cur}>{html.escape(m.title)}</a></li>'
        )
+    logs_active = current_slug == "__logs__"
+    items.append(
+        '<li class="rail-item rail-item--util' + (" is-active" if logs_active else "") + '">'
+        '<a href="/ui/logs"' + (' aria-current="page"' if logs_active else "") + ">📋 Логи</a></li>"
+    )
    lis = "".join(items)
    return (
        '<aside class="app-rail" role="navigation" aria-label="Разделы приложения">'
--- a/onguard24/root_html.py
+++ b/onguard24/root_html.py
@ -128,6 +128,7 @@ async def render_root_page(request: Request) -> str:
    <a href="/openapi.json">OpenAPI</a>
    <a href="/health">/health</a>
    <a href="/api/v1/status">JSON статус</a>
+    <a href="/ui/logs" style="font-weight:600">📋 Логи</a>
  </p>
  <h2>Проверки доступа</h2>
  <table>
--- a/onguard24/ui_logs.py
+++ b/onguard24/ui_logs.py
@ -0,0 +1,234 @@
+"""Страница просмотра логов в реальном времени (SSE).
+
+Маршруты:
+  GET  /ui/logs          — HTML-страница с историей + EventSource
+  GET  /ui/logs/stream   — Server-Sent Events (text/event-stream)
+"""
+
+from __future__ import annotations
+
+import asyncio
+import html as _html
+import json
+from collections.abc import AsyncGenerator
+
+from fastapi import APIRouter
+from starlette.requests import Request
+from starlette.responses import HTMLResponse, StreamingResponse
+
+from onguard24 import log_buffer
+from onguard24.modules.ui_support import APP_SHELL_CSS, nav_rail_html
+
+router = APIRouter(include_in_schema=False, tags=["web-logs"])
+
+_LEVEL_COLOR: dict[str, str] = {
+    "DEBUG": "#71717a",
+    "INFO": "#a3e635",
+    "WARNING": "#fbbf24",
+    "ERROR": "#f87171",
+    "CRITICAL": "#ef4444",
+}
+
+_LOG_CSS = """
+  .log-wrap { background:#0f0f10; border-radius:10px; padding:0.75rem; min-height:20rem;
+    max-height:75vh; overflow-y:auto; font-family:monospace; font-size:0.8rem;
+    line-height:1.55; color:#e4e4e7; }
+  .log-line { display:flex; gap:0.5rem; border-bottom:1px solid #1e1e21; padding:0.12rem 0; }
+  .log-line:last-child { border-bottom: none; }
+  .log-ts { color:#52525b; flex-shrink:0; }
+  .log-lv { flex-shrink:0; width:5.5rem; font-weight:600; }
+  .log-name { flex-shrink:0; width:16rem; overflow:hidden; text-overflow:ellipsis;
+    white-space:nowrap; color:#a1a1aa; }
+  .log-msg { flex:1; word-break:break-all; white-space:pre-wrap; color:#e4e4e7; }
+  .lv-DEBUG    { color:#71717a; }
+  .lv-INFO     { color:#a3e635; }
+  .lv-WARNING  { color:#fbbf24; }
+  .lv-ERROR    { color:#f87171; }
+  .lv-CRITICAL { color:#ef4444; background:#3f0000; border-radius:3px; padding:0 2px; }
+  .log-controls { display:flex; gap:0.75rem; align-items:center; margin-bottom:0.75rem; }
+  .log-controls label { font-size:0.85rem; color:#52525b; display:flex; align-items:center; gap:0.3rem; }
+  .badge-live { display:inline-block; width:8px; height:8px; border-radius:50%;
+    background:#a3e635; box-shadow:0 0 6px #a3e635; animation: pulse 1.6s infinite; }
+  .badge-live.disconnected { background:#f87171; box-shadow:0 0 6px #f87171; animation:none; }
+  @keyframes pulse { 0%,100%{opacity:1} 50%{opacity:.4} }
+  #status-bar { font-size:0.8rem; color:#52525b; margin-bottom:0.5rem; }
+"""
+
+_LOG_JS = """
+<script>
+(function(){
+  const wrap = document.getElementById('log-wrap');
+  const cntEl = document.getElementById('log-count');
+  const statusEl = document.getElementById('status-bar');
+  const dot = document.getElementById('live-dot');
+  const autoCheck = document.getElementById('auto-scroll');
+  const levelFilter = document.getElementById('level-filter');
+  let count = parseInt(cntEl.textContent || '0', 10);
+
+  const LEVEL_COLOR = {
+    DEBUG:'#71717a', INFO:'#a3e635', WARNING:'#fbbf24', ERROR:'#f87171', CRITICAL:'#ef4444'
+  };
+
+  function makeRow(d) {
+    const row = document.createElement('div');
+    row.className = 'log-line';
+    row.dataset.level = d.level;
+    const lvl = d.level || 'INFO';
+    const col = LEVEL_COLOR[lvl] || '#e4e4e7';
+    row.innerHTML =
+      '<span class="log-ts">' + esc(d.ts || '') + '</span>' +
+      '<span class="log-lv lv-' + lvl + '">' + esc(lvl) + '</span>' +
+      '<span class="log-name">' + esc((d.name||'').slice(0,36)) + '</span>' +
+      '<span class="log-msg">' + esc(d.msg||'') + '</span>';
+    return row;
+  }
+
+  function esc(s){ const d=document.createElement('div');d.textContent=s;return d.innerHTML; }
+
+  function applyFilter() {
+    const lv = levelFilter.value;
+    const ORDER = ['DEBUG','INFO','WARNING','ERROR','CRITICAL'];
+    const minIdx = lv ? ORDER.indexOf(lv) : 0;
+    wrap.querySelectorAll('.log-line').forEach(function(el){
+      const idx = ORDER.indexOf(el.dataset.level);
+      el.style.display = (idx >= minIdx) ? '' : 'none';
+    });
+  }
+
+  levelFilter.addEventListener('change', applyFilter);
+  applyFilter();
+
+  function scrollBottom() {
+    if (autoCheck.checked) wrap.scrollTop = wrap.scrollHeight;
+  }
+
+  scrollBottom();
+
+  const src = new EventSource('/ui/logs/stream');
+
+  src.onopen = function(){
+    dot.className = 'badge-live';
+    statusEl.textContent = 'Live — соединение установлено';
+  };
+
+  src.onmessage = function(e){
+    try {
+      const d = JSON.parse(e.data);
+      const row = makeRow(d);
+      wrap.appendChild(row);
+      count++;
+      cntEl.textContent = count;
+      // keep DOM manageable: trim oldest
+      while (wrap.children.length > 1000) wrap.removeChild(wrap.firstChild);
+      const lv = levelFilter.value;
+      if (lv) {
+        const ORDER = ['DEBUG','INFO','WARNING','ERROR','CRITICAL'];
+        if (ORDER.indexOf(d.level) < ORDER.indexOf(lv)) row.style.display='none';
+      }
+      scrollBottom();
+    } catch(ex){}
+  };
+
+  src.onerror = function(){
+    dot.className = 'badge-live disconnected';
+    statusEl.textContent = 'Соединение потеряно — попытка переподключения…';
+  };
+})();
+</script>
+"""
+
+
+def _line_html(entry: dict) -> str:
+    ts = _html.escape(entry.get("ts", ""))
+    lvl = entry.get("level", "INFO")
+    name = _html.escape((entry.get("name") or "")[:36])
+    msg = _html.escape(entry.get("msg") or "")
+    return (
+        f'<div class="log-line" data-level="{_html.escape(lvl)}">'
+        f'<span class="log-ts">{ts}</span>'
+        f'<span class="log-lv lv-{_html.escape(lvl)}">{_html.escape(lvl)}</span>'
+        f'<span class="log-name">{name}</span>'
+        f'<span class="log-msg">{msg}</span>'
+        f"</div>"
+    )
+
+
+@router.get("/ui/logs", response_class=HTMLResponse)
+async def logs_page(request: Request) -> HTMLResponse:
+    history = log_buffer.get_history()
+    lines_html = "\n".join(_line_html(e) for e in history)
+    count = len(history)
+    rail = nav_rail_html("__logs__")
+
+    page = f"""<!DOCTYPE html>
+<html lang="ru">
+<head>
+  <meta charset="utf-8"/>
+  <meta name="viewport" content="width=device-width,initial-scale=1"/>
+  <title>Логи — onGuard24</title>
+  <style>
+    {APP_SHELL_CSS}
+    {_LOG_CSS}
+  </style>
+</head>
+<body>
+<div class="app-shell">
+<main class="app-main module-page-main">
+  <h1>Логи приложения</h1>
+  <div class="log-controls">
+    <span><span id="live-dot" class="badge-live"></span> real-time</span>
+    <span>Записей: <strong id="log-count">{count}</strong></span>
+    <label><input type="checkbox" id="auto-scroll" checked> авто-прокрутка</label>
+    <label>
+      Уровень:
+      <select id="level-filter">
+        <option value="">Все</option>
+        <option value="DEBUG">DEBUG+</option>
+        <option value="INFO">INFO+</option>
+        <option value="WARNING">WARNING+</option>
+        <option value="ERROR">ERROR+</option>
+        <option value="CRITICAL">CRITICAL</option>
+      </select>
+    </label>
+    <a href="/ui/logs" class="og-btn" style="text-decoration:none;padding:0.3rem 0.7rem;font-size:0.8rem">Обновить</a>
+  </div>
+  <div id="status-bar">Подключаемся к потоку…</div>
+  <div class="log-wrap" id="log-wrap">
+{lines_html}
+  </div>
+</main>
+{rail}
+</div>
+{_LOG_JS}
+</body>
+</html>"""
+    return HTMLResponse(page)
+
+
+@router.get("/ui/logs/stream")
+async def logs_stream(request: Request) -> StreamingResponse:
+    q = log_buffer.subscribe()
+
+    async def generator() -> AsyncGenerator[bytes, None]:
+        try:
+            while True:
+                if await request.is_disconnected():
+                    break
+                try:
+                    entry = await asyncio.wait_for(q.get(), timeout=20.0)
+                    payload = json.dumps(entry, ensure_ascii=False)
+                    yield f"data: {payload}\n\n".encode()
+                except asyncio.TimeoutError:
+                    yield b": keepalive\n\n"
+        finally:
+            log_buffer.unsubscribe(q)
+
+    return StreamingResponse(
+        generator(),
+        media_type="text/event-stream",
+        headers={
+            "Cache-Control": "no-cache",
+            "X-Accel-Buffering": "no",
+            "Connection": "keep-alive",
+        },
+    )
--- a/pyproject.toml
+++ b/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "onguard24"
-version = "1.7.0"
+version = "1.10.1"
 description = "onGuard24 — модульный сервис (аналог IRM)"
 readme = "README.md"
 requires-python = ">=3.11"
--- a/tests/irm_db_fake.py
+++ b/tests/irm_db_fake.py
@ -25,15 +25,28 @@ class Row:
        return self._data.get(key, default)


+class _FakeTxn:
+    async def __aenter__(self) -> None:
+        return None
+
+    async def __aexit__(self, *args: Any) -> None:
+        return None
+
+
 class IrmFakeConn:
    def __init__(self, store: IrmFakeStore) -> None:
        self.store = store

+    def transaction(self) -> _FakeTxn:
+        return _FakeTxn()
+
    def _q(self, query: str) -> str:
        return " ".join(query.split())

    async def execute(self, query: str, *args: Any) -> str:
        q = self._q(query)
+        if "INSERT INTO incident_alert_links" in q:
+            return "INSERT 0 1"
        if "INSERT INTO incidents" in q and "ingress_event_id" in q:
            self.store.insert_incident_alert(
                args[0], args[1], args[2], args[3], args[4]
--- a/tests/test_alerts_api.py
+++ b/tests/test_alerts_api.py
@ -0,0 +1,9 @@
+"""API модуля алертов без БД."""
+
+from fastapi.testclient import TestClient
+
+
+def test_alerts_list_no_db(client: TestClient) -> None:
+    r = client.get("/api/v1/modules/alerts/")
+    assert r.status_code == 200
+    assert r.json() == {"items": [], "database": "disabled"}
--- a/tests/test_grafana_payload.py
+++ b/tests/test_grafana_payload.py
@ -0,0 +1,26 @@
+"""Парсинг полей из тела вебхука Grafana."""
+
+from onguard24.ingress.grafana_payload import extract_alert_row_from_grafana_body
+
+
+def test_extract_title_and_severity_from_unified() -> None:
+    body = {
+        "title": "RuleName",
+        "alerts": [
+            {
+                "labels": {"severity": "critical", "alertname": "X"},
+                "fingerprint": "abc",
+            }
+        ],
+    }
+    title, sev, labels, fp = extract_alert_row_from_grafana_body(body)
+    assert title == "RuleName"
+    assert sev == "critical"
+    assert labels.get("alertname") == "X"
+    assert fp == "abc"
+
+
+def test_extract_empty_title_uses_alertname() -> None:
+    body = {"alerts": [{"labels": {"alertname": "HostDown"}}]}
+    title, _, _, _ = extract_alert_row_from_grafana_body(body)
+    assert title == "HostDown"
--- a/tests/test_ingress.py
+++ b/tests/test_ingress.py
@ -1,9 +1,24 @@
 import json
 from unittest.mock import AsyncMock, MagicMock, patch
-
 from fastapi.testclient import TestClient


+def _webhook_mock_pool(mock_conn: AsyncMock) -> MagicMock:
+    """Пул с транзакцией и execute — как после вставки ingress + irm_alerts."""
+    tx = AsyncMock()
+    tx.__aenter__ = AsyncMock(return_value=None)
+    tx.__aexit__ = AsyncMock(return_value=None)
+    mock_conn.transaction = MagicMock(return_value=tx)
+    mock_conn.fetch = AsyncMock(return_value=[])
+    mock_conn.execute = AsyncMock()
+    mock_cm = AsyncMock()
+    mock_cm.__aenter__ = AsyncMock(return_value=mock_conn)
+    mock_cm.__aexit__ = AsyncMock(return_value=None)
+    mock_pool = MagicMock()
+    mock_pool.acquire = MagicMock(return_value=mock_cm)
+    return mock_pool
+
+
 def test_grafana_webhook_no_db(client: TestClient) -> None:
    """Без пула БД — 202, запись не падает."""
    r = client.post(
@ -41,12 +56,7 @@ def test_grafana_webhook_inserts_with_mock_pool(client: TestClient) -> None:
    mock_conn = AsyncMock()
    uid = uuid4()
    mock_conn.fetchrow = AsyncMock(return_value={"id": uid})
-    mock_cm = AsyncMock()
-    mock_cm.__aenter__ = AsyncMock(return_value=mock_conn)
-    mock_cm.__aexit__ = AsyncMock(return_value=None)
-
-    mock_pool = MagicMock()
-    mock_pool.acquire = MagicMock(return_value=mock_cm)
+    mock_pool = _webhook_mock_pool(mock_conn)

    app = client.app
    real_pool = app.state.pool
@ -59,6 +69,7 @@ def test_grafana_webhook_inserts_with_mock_pool(client: TestClient) -> None:
        )
        assert r.status_code == 202
        mock_conn.fetchrow.assert_called_once()
+        mock_conn.execute.assert_called_once()
    finally:
        app.state.pool = real_pool

@ -69,11 +80,7 @@ def test_grafana_webhook_auto_org_from_external_url(client: TestClient) -> None:
    mock_conn = AsyncMock()
    uid = uuid4()
    mock_conn.fetchrow = AsyncMock(return_value={"id": uid})
-    mock_cm = AsyncMock()
-    mock_cm.__aenter__ = AsyncMock(return_value=mock_conn)
-    mock_cm.__aexit__ = AsyncMock(return_value=None)
-    mock_pool = MagicMock()
-    mock_pool.acquire = MagicMock(return_value=mock_cm)
+    mock_pool = _webhook_mock_pool(mock_conn)

    app = client.app
    real_pool = app.state.pool
@ -99,11 +106,7 @@ def test_grafana_webhook_publishes_alert_received(client: TestClient) -> None:
    mock_conn = AsyncMock()
    uid = uuid4()
    mock_conn.fetchrow = AsyncMock(return_value={"id": uid})
-    mock_cm = AsyncMock()
-    mock_cm.__aenter__ = AsyncMock(return_value=mock_conn)
-    mock_cm.__aexit__ = AsyncMock(return_value=None)
-    mock_pool = MagicMock()
-    mock_pool.acquire = MagicMock(return_value=mock_cm)
+    mock_pool = _webhook_mock_pool(mock_conn)

    app = client.app
    bus = app.state.event_bus
@ -130,11 +133,7 @@ def test_grafana_webhook_org_any_slug_without_json_config(client: TestClient) ->
    mock_conn = AsyncMock()
    uid = uuid4()
    mock_conn.fetchrow = AsyncMock(return_value={"id": uid})
-    mock_cm = AsyncMock()
-    mock_cm.__aenter__ = AsyncMock(return_value=mock_conn)
-    mock_cm.__aexit__ = AsyncMock(return_value=None)
-    mock_pool = MagicMock()
-    mock_pool.acquire = MagicMock(return_value=mock_cm)
+    mock_pool = _webhook_mock_pool(mock_conn)

    app = client.app
    real_pool = app.state.pool
@ -157,11 +156,7 @@ def test_grafana_webhook_org_ok(client: TestClient) -> None:
    mock_conn = AsyncMock()
    uid = uuid4()
    mock_conn.fetchrow = AsyncMock(return_value={"id": uid})
-    mock_cm = AsyncMock()
-    mock_cm.__aenter__ = AsyncMock(return_value=mock_conn)
-    mock_cm.__aexit__ = AsyncMock(return_value=None)
-    mock_pool = MagicMock()
-    mock_pool.acquire = MagicMock(return_value=mock_cm)
+    mock_pool = _webhook_mock_pool(mock_conn)

    app = client.app
    real_json = app.state.settings.grafana_sources_json
--- a/tests/test_irm_modules.py
+++ b/tests/test_irm_modules.py
@ -29,8 +29,41 @@ def test_escalations_api_list_no_db(client: TestClient) -> None:


@pytest.mark.asyncio
-async def test_incident_inserted_on_alert_received() -> None:
-    """При пуле БД подписка создаёт инцидент (INSERT)."""
+async def test_incident_not_created_from_alert_by_default() -> None:
+    """По умолчанию AUTO_INCIDENT_FROM_ALERT выкл — инцидент из вебхука не создаётся."""
+    calls: list = []
+
+    async def fake_execute(_query, *args):
+        calls.append(args)
+        return "INSERT 0 1"
+
+    mock_conn = AsyncMock()
+    mock_conn.execute = fake_execute
+    mock_cm = AsyncMock()
+    mock_cm.__aenter__ = AsyncMock(return_value=mock_conn)
+    mock_cm.__aexit__ = AsyncMock(return_value=None)
+    mock_pool = MagicMock()
+    mock_pool.acquire = MagicMock(return_value=mock_cm)
+
+    from onguard24.domain.events import InMemoryEventBus
+    from onguard24.modules import incidents as inc_mod
+
+    bus = InMemoryEventBus()
+    inc_mod.register_events(bus, mock_pool)
+
+    uid = uuid4()
+    ev = AlertReceived(
+        alert=Alert(source="grafana", title="CPU high", severity=Severity.WARNING),
+        raw_payload_ref=uid,
+    )
+    await bus.publish(ev)
+    assert calls == []
+
+
+@pytest.mark.asyncio
+async def test_incident_inserted_on_alert_when_auto_enabled(monkeypatch: pytest.MonkeyPatch) -> None:
+    """При AUTO_INCIDENT_FROM_ALERT=1 подписка снова создаёт инцидент (legacy)."""
+    monkeypatch.setenv("AUTO_INCIDENT_FROM_ALERT", "1")
    inserted: dict = {}

    async def fake_execute(_query, *args):
--- a/tests/test_json_sanitize.py
+++ b/tests/test_json_sanitize.py
@ -0,0 +1,26 @@
+import json
+import math
+
+from onguard24.ingress.json_sanitize import sanitize_for_jsonb
+
+
+def test_sanitize_nan_inf_to_none() -> None:
+    raw = json.loads('{"a": NaN, "b": Infinity, "c": -Infinity, "d": 1.5}')
+    out = sanitize_for_jsonb(raw)
+    assert math.isnan(raw["a"])
+    assert out["a"] is None
+    assert out["b"] is None
+    assert out["c"] is None
+    assert out["d"] == 1.5
+
+
+def test_sanitize_strips_nul_in_strings() -> None:
+    assert sanitize_for_jsonb({"x": "a\x00b"}) == {"x": "ab"}
+
+
+def test_dumps_after_sanitize_is_valid_json() -> None:
+    raw = json.loads('{"v": NaN}')
+    clean = sanitize_for_jsonb(raw)
+    s = json.dumps(clean, allow_nan=False)
+    assert "NaN" not in s
+    assert json.loads(s)["v"] is None
--- a/tests/test_log_buffer.py
+++ b/tests/test_log_buffer.py
@ -0,0 +1,45 @@
+"""Кольцевой буфер логов и SSE-страница."""
+
+import logging
+
+import pytest
+from fastapi.testclient import TestClient
+
+from onguard24 import log_buffer
+
+
+def test_ring_buffer_captures_log_records() -> None:
+    log_buffer._ring.clear()
+    handler = log_buffer.RingBufferHandler()
+    handler.setFormatter(logging.Formatter("%(name)s %(message)s"))
+    logger = logging.getLogger("test.ring")
+    logger.addHandler(handler)
+    logger.setLevel(logging.DEBUG)
+    try:
+        logger.info("hello ring")
+        history = log_buffer.get_history()
+        assert any("hello ring" in e["msg"] for e in history)
+    finally:
+        logger.removeHandler(handler)
+        log_buffer._ring.clear()
+
+
+def test_logs_page_returns_html(client: TestClient) -> None:
+    r = client.get("/ui/logs")
+    assert r.status_code == 200
+    assert "text/html" in r.headers.get("content-type", "")
+    assert "Логи" in r.text
+    assert "log-wrap" in r.text
+    assert "EventSource" in r.text or "event-stream" in r.text or "ui/logs/stream" in r.text
+
+
+def test_logs_page_in_nav_rail(client: TestClient) -> None:
+    r = client.get("/ui/logs")
+    assert r.status_code == 200
+    assert "/ui/logs" in r.text
+
+
+def test_root_has_logs_link(client: TestClient) -> None:
+    r = client.get("/")
+    assert r.status_code == 200
+    assert "/ui/logs" in r.text
--- a/tests/test_root_ui.py
+++ b/tests/test_root_ui.py
@ -33,6 +33,8 @@ def test_rail_lists_all_registered_ui_modules(client: TestClient) -> None:
    t = r.text
    expected = (
        ("grafana-catalog", "Каталог Grafana"),
+        ("alerts", "Алерты"),
+        ("teams", "Команды"),
        ("incidents", "Инциденты"),
        ("tasks", "Задачи"),
        ("escalations", "Эскалации"),
@ -49,6 +51,8 @@ def test_each_module_page_single_active_nav_item(client: TestClient) -> None:
    """На странице модуля ровно один пункт с aria-current (текущий раздел)."""
    for slug in (
        "grafana-catalog",
+        "alerts",
+        "teams",
        "incidents",
        "tasks",
        "escalations",
--- a/tests/test_team_match.py
+++ b/tests/test_team_match.py
@ -0,0 +1,38 @@
+"""Сопоставление лейблов с командой (без БД)."""
+
+from uuid import UUID, uuid4
+
+from onguard24.ingress.team_match import match_team_for_labels
+
+
+def test_match_returns_none_when_empty() -> None:
+    assert match_team_for_labels({}, []) is None
+    assert match_team_for_labels({"a": "b"}, []) is None
+
+
+def test_match_first_rule_wins_in_order() -> None:
+    u_infra = uuid4()
+    u_other = uuid4()
+    labels = {"team": "infra", "env": "prod"}
+    rules: list[tuple[UUID, str, str]] = [
+        (u_infra, "team", "infra"),
+        (u_other, "env", "prod"),
+    ]
+    assert match_team_for_labels(labels, rules) == u_infra
+
+
+def test_match_skips_until_value_matches() -> None:
+    u = uuid4()
+    labels = {"x": "1"}
+    rules: list[tuple[UUID, str, str]] = [
+        (uuid4(), "x", "2"),
+        (u, "x", "1"),
+    ]
+    assert match_team_for_labels(labels, rules) == u
+
+
+def test_match_coerces_label_values_to_str() -> None:
+    u = uuid4()
+    labels = {"port": 8080}
+    rules: list[tuple[UUID, str, str]] = [(u, "port", "8080")]
+    assert match_team_for_labels(labels, rules) == u
--- a/tests/test_teams_api.py
+++ b/tests/test_teams_api.py
@ -0,0 +1,9 @@
+"""API модуля команд без БД."""
+
+from fastapi.testclient import TestClient
+
+
+def test_teams_list_no_db(client: TestClient) -> None:
+    r = client.get("/api/v1/modules/teams/")
+    assert r.status_code == 200
+    assert r.json() == {"items": [], "database": "disabled"}
Author	SHA1	Message	Date
Alexandr	80645713a0	feat: страница логов /ui/logs с SSE real-time потоком Some checks failed CI / test (push) Successful in 39s Details Deploy / deploy (push) Failing after 15s Details - log_buffer: RingBufferHandler, кольцевой буфер 600 записей, fan-out SSE - ui_logs: GET /ui/logs (HTML), GET /ui/logs/stream (EventSource) - main: install_log_handler при старте, подключён router логов - nav_rail: ссылка Логи, root_html: кнопка-ссылка Логи - Исправлено: NaN/Inf/NUL в теле вебхука → 500 от PostgreSQL jsonb - Тесты: test_log_buffer, test_json_sanitize; 51 passed Made-with: Cursor	2026-04-03 15:56:58 +03:00
Alexandr	18ba48e8d0	release: v1.10.0 — модуль команд (teams), team_id на алертах Some checks failed CI / test (push) Successful in 43s Details Deploy / deploy (push) Failing after 17s Details - Alembic 006: teams, team_label_rules, irm_alerts.team_id - Вебхук: сопоставление команды по правилам лейблов (priority) - API/UI Команды; алерты: JOIN team, фильтр team_id - Тесты test_team_match, test_teams_api; обновлён test_root_ui Made-with: Cursor	2026-04-03 15:34:46 +03:00
Alexandr	a8ccf1d35c	release: v1.9.0 — IRM-алерты отдельно от инцидентов Some checks failed Deploy / deploy (push) Has been cancelled Details CI / test (push) Successful in 37s Details - Alembic 005: таблицы irm_alerts и incident_alert_links - Модуль alerts: API/UI, Ack/Resolve, привязка к инциденту через alert_ids - Вебхук Grafana: одна транзакция ingress + irm_alerts; разбор payload в grafana_payload - По умолчанию инцидент из вебхука не создаётся (AUTO_INCIDENT_FROM_ALERT) - Документация IRM_GRAFANA_PARITY.md, обновления IRM.md и CHANGELOG Made-with: Cursor	2026-04-03 15:26:38 +03:00
Alexandr	3cb75eb7b7	chore: release 1.8.0 Some checks failed CI / test (push) Successful in 36s Details Deploy / deploy (push) Failing after 18s Details Made-with: Cursor	2026-04-03 15:06:17 +03:00
Alexandr	420821f3a0	ui: синхронизация каталога Grafana в браузере, дерево папок/правил; инциденты — ссылка, деталка, сырой JSON; ci: docker compose --progress plain All checks were successful CI / test (push) Successful in 37s Details Made-with: Cursor	2026-04-03 15:04:22 +03:00
Alexandr	c324b4732f	ci: deploy — нормализация refs/heads/* и refs/tags/* (Forgejo main) All checks were successful CI / test (push) Successful in 38s Details Made-with: Cursor	2026-04-03 14:41:15 +03:00
Alexandr	36945ed796	ci: deploy ref 1.7.0 → v1.7.0 если введён semver без префикса v All checks were successful CI / test (push) Successful in 37s Details Made-with: Cursor	2026-04-03 14:39:03 +03:00
Alexandr	cf16a57442	ci: deploy — лог ref, git HEAD, docker compose build --progress=plain All checks were successful CI / test (push) Successful in 35s Details Made-with: Cursor	2026-04-03 14:36:01 +03:00
Alexandr	719991d60b	ci: отключить pip cache в setup-python (таймаут Actions cache на Forgejo) All checks were successful CI / test (push) Successful in 35s Details Made-with: Cursor	2026-04-03 14:32:16 +03:00
Alexandr	9f2aa2d2b5	ci: CI на тегах v, проверка DEPLOY_, документация деплоя и тегов Some checks failed CI / test (push) Has been cancelled Details Made-with: Cursor	2026-04-03 14:26:39 +03:00