From 63304f7024cece9f9897b73fbab6771efb02beab Mon Sep 17 00:00:00 2001
From: Tomer Weller
 <tomer@user-dev-050a.dev.stellar002.internal.stellar-ops.com>
Date: Tue, 25 Aug 2026 05:38:35 +0000
Subject: [PATCH 1/2] =?UTF-8?q?Regression=20tests=20for=20#3824=20?=
 =?UTF-8?q?=E2=80=94=20recovery-stalled=20family-union=20re-key=20(fail=20?=
 =?UTF-8?q?on=20main)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds scripts/lib/test_eval_alarms_recovery_family.py and a catalog TAP
assertion (Test 41c) in test-monitor-skill-snippets.sh. On origin/main these
fail: eval_counter_streak has no `prev` param, post_restart_absolute_label is
unhandled (family sum false-fires the absolute guard), validate_catalog does
not reject a non-string label, render_aggregate has no reason breakdown, and
the catalog stanza is still extraction=form2 + single-label selector.

Refs #3824

Co-authored-by: Claude Code <claude-code@anthropic.com>
---
 .../lib/test_eval_alarms_recovery_family.py   | 346 ++++++++++++++++++
 scripts/test-monitor-skill-snippets.sh        |  17 +-
 2 files changed, 362 insertions(+), 1 deletion(-)
 create mode 100644 scripts/lib/test_eval_alarms_recovery_family.py

diff --git a/scripts/lib/test_eval_alarms_recovery_family.py b/scripts/lib/test_eval_alarms_recovery_family.py
new file mode 100644
index 00000000..fa263023
--- /dev/null
+++ b/scripts/lib/test_eval_alarms_recovery_family.py
@@ -0,0 +1,346 @@
+#!/usr/bin/env python3
+"""Regression tests for the recovery-stalled family-union re-key (issue #3824).
+
+Check 12b (`recovery-stalled` counter-streak) historically observed a single
+`reason` series (`forcing_catchup_behind`) of the 8-label
+`henyey_recovery_stalled_tick_total` family. During an at-tip stall the node
+takes the `forcing_catchup_not_behind` branch by construction, so the one label
+the alarm watched was exactly the branch that could not move — a real recovery
+episode incremented two UNCOVERED labels and the tick reported `ok (delta=0)`.
+
+The fix re-keys the delta/streak/burst trigger onto the SUM of all `reason`
+series (`extraction = "form2-sum-all"`), while scoping the post-restart absolute
+guard to a single historically-calibrated label via `post_restart_absolute_label`
+(so a summed warmup value of ~113 does not false-fire the absolute check tuned
+for `forcing_catchup_behind` alone). A per-reason `reason_breakdown` is attached
+on breach/firing so a summed fire still names the moving labels.
+"""
+
+import tempfile
+from pathlib import Path
+
+# eval-alarms.py uses a hyphen, so we need importlib
+import importlib.util
+
+_spec = importlib.util.spec_from_file_location(
+    "eval_alarms",
+    Path(__file__).parent / "eval-alarms.py",
+)
+_mod = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_mod)
+
+read_snapshot = _mod.read_snapshot
+write_snapshot = _mod.write_snapshot
+eval_counter_streak = _mod.eval_counter_streak
+render_aggregate = _mod.render_aggregate
+validate_catalog = _mod.validate_catalog
+
+
+def _make_alarm(name="recovery-stalled", **kwargs):
+    alarm = {"name": name, "kind": "counter-streak"}
+    alarm.update(kwargs)
+    return alarm
+
+
+def _family(behind, not_behind, peer_scp):
+    """Build a current-metrics dict for the recovery family with 3 reasons set."""
+    return {
+        "henyey_recovery_stalled_tick_total": [
+            ({"reason": "forcing_catchup_behind"}, float(behind)),
+            ({"reason": "forcing_catchup_not_behind"}, float(not_behind)),
+            ({"reason": "near_tip_peer_scp_recovery"}, float(peer_scp)),
+        ]
+    }
+
+
+# ── post-restart absolute guard is scoped to a single label, not the sum ──────
+
+def test_post_restart_absolute_uses_label_not_sum():
+    """On a baseline reset, the post-restart absolute guard must evaluate only
+    the `post_restart_absolute_label` series, NOT the family sum.
+
+    forcing_catchup_behind == 40 (< 50 threshold) while the family sums to 120
+    (> 50). The correct behaviour is `collecting_baseline` (no post-restart
+    fire), because the historically-calibrated absolute signal (#3197/#3198) is
+    the single label, not the aggregate.
+
+    Fails on origin/main: `post_restart_absolute_label` is unhandled, so under a
+    `form2-sum-all` extraction the aggregate 120 >= 50 fires as post-restart.
+    """
+    with tempfile.TemporaryDirectory() as d:
+        state_dir = Path(d)
+        snap_path = state_dir / "recovery_family_streak_snapshot"
+        # Existing baseline under a DIFFERENT pid → next eval is a baseline reset.
+        write_snapshot(snap_path, {
+            "version": "1",
+            "pid": "111",
+            "start_ticks": "100",
+            "counter_value": "0",
+            "breach_streak": "0",
+        })
+
+        alarm = _make_alarm(
+            metric="henyey_recovery_stalled_tick_total",
+            extraction="form2-sum-all",
+            delta_threshold=1, streak_threshold=3, burst_threshold=10,
+            post_restart_absolute_threshold=50,
+            post_restart_absolute_label="forcing_catchup_behind",
+            snapshot_file="recovery_family_streak_snapshot",
+            severity="WARN",
+        )
+        # behind=40 (<50), family sum = 40 + 50 + 30 = 120 (>50).
+        current = _family(behind=40, not_behind=50, peer_scp=30)
+
+        result = eval_counter_streak(
+            alarm, current, state_dir, "222", "200", prev=None,
+        )
+
+        assert result["state"] == "collecting_baseline", (
+            "post-restart guard must use the single label (40 < 50), not the "
+            f"family sum (120 >= 50); got state={result['state']}"
+        )
+
+
+def test_post_restart_absolute_label_fires_on_label_value():
+    """Complementary case: when the scoped label itself crosses the threshold,
+    the post-restart absolute fire still triggers (guard not disabled)."""
+    with tempfile.TemporaryDirectory() as d:
+        state_dir = Path(d)
+        snap_path = state_dir / "recovery_family_streak_snapshot"
+        write_snapshot(snap_path, {
+            "version": "1",
+            "pid": "111",
+            "start_ticks": "100",
+            "counter_value": "0",
+            "breach_streak": "0",
+        })
+
+        alarm = _make_alarm(
+            metric="henyey_recovery_stalled_tick_total",
+            extraction="form2-sum-all",
+            delta_threshold=1, streak_threshold=3, burst_threshold=10,
+            post_restart_absolute_threshold=50,
+            post_restart_absolute_label="forcing_catchup_behind",
+            snapshot_file="recovery_family_streak_snapshot",
+            severity="WARN",
+        )
+        # behind=63 (>= 50) → post-restart fire on the scoped label.
+        current = _family(behind=63, not_behind=1, peer_scp=49)
+
+        result = eval_counter_streak(
+            alarm, current, state_dir, "222", "200", prev=None,
+        )
+
+        assert result["state"] == "firing", (
+            f"scoped label 63 >= 50 must post-restart fire, got {result['state']}"
+        )
+        assert result.get("post_restart") is True
+        # The fresh baseline snapshot stores the SUM (the streak machine's unit).
+        snap = read_snapshot(snap_path)
+        assert snap["counter_value"] == "113", (
+            f"baseline must snapshot the family sum 113, got {snap['counter_value']}"
+        )
+
+
+def test_snapshot_file_rename_rebaselines_without_post_restart_fire():
+    """Baseline migration via snapshot_file rename (#3222 lever): when only the
+    OLD snapshot filename is present, the first post-migration tick re-collects
+    a fresh baseline (`collecting_baseline`) — NOT a post-restart fire — even
+    when the scoped label already exceeds the absolute threshold.
+
+    The empty-snapshot first-tick branch does not invoke the post-restart path,
+    so renaming the file avoids the spurious post-restart fire a version bump
+    would cause on a long-running process.
+    """
+    with tempfile.TemporaryDirectory() as d:
+        state_dir = Path(d)
+        # Only the OLD filename exists; the new path is absent.
+        old_path = state_dir / "counter_streak_snapshot"
+        write_snapshot(old_path, {
+            "version": "1",
+            "pid": "222",
+            "start_ticks": "200",
+            "counter_value": "500",
+            "breach_streak": "3",
+        })
+
+        alarm = _make_alarm(
+            metric="henyey_recovery_stalled_tick_total",
+            extraction="form2-sum-all",
+            delta_threshold=1, streak_threshold=3, burst_threshold=10,
+            post_restart_absolute_threshold=50,
+            post_restart_absolute_label="forcing_catchup_behind",
+            snapshot_file="recovery_family_streak_snapshot",
+            severity="WARN",
+        )
+        # Same pid/start_ticks as the old snapshot; scoped label >= 50.
+        current = _family(behind=63, not_behind=1, peer_scp=50)
+
+        result = eval_counter_streak(
+            alarm, current, state_dir, "222", "200", prev=None,
+        )
+
+        assert result["state"] == "collecting_baseline", (
+            "rename must re-baseline cleanly (empty new-path snapshot), not "
+            f"post-restart fire; got {result['state']}"
+        )
+        # New-path baseline written with the family sum.
+        snap = read_snapshot(state_dir / "recovery_family_streak_snapshot")
+        assert snap["counter_value"] == "114"
+
+
+# ── the trigger fires on the family sum (the branch that actually moves) ───────
+
+def test_at_tip_stall_fires_on_family_sum():
+    """An at-tip stall increments `not_behind` + `near_tip_peer_scp_recovery`
+    while `forcing_catchup_behind` barely moves. Summing the family makes the
+    burst trigger observe the branch that moves: delta 161 >= burst 10 → fire.
+    """
+    with tempfile.TemporaryDirectory() as d:
+        state_dir = Path(d)
+        snap_path = state_dir / "recovery_family_streak_snapshot"
+        # Baseline sum = 63 + 1 + 50 = 114.
+        write_snapshot(snap_path, {
+            "version": "1",
+            "pid": "222",
+            "start_ticks": "200",
+            "counter_value": "114",
+            "breach_streak": "0",
+        })
+
+        alarm = _make_alarm(
+            metric="henyey_recovery_stalled_tick_total",
+            extraction="form2-sum-all",
+            delta_threshold=1, streak_threshold=3, burst_threshold=10,
+            post_restart_absolute_threshold=50,
+            post_restart_absolute_label="forcing_catchup_behind",
+            snapshot_file="recovery_family_streak_snapshot",
+            severity="WARN",
+        )
+        prev = _family(behind=63, not_behind=1, peer_scp=50)
+        # not_behind 1→81, peer_scp 50→130, behind 63→64 → sum 275, delta 161.
+        current = _family(behind=64, not_behind=81, peer_scp=130)
+
+        result = eval_counter_streak(
+            alarm, current, state_dir, "222", "200", prev=prev,
+        )
+
+        assert result["state"] == "firing", (
+            f"family sum delta 161 >= burst 10 must fire, got {result['state']}"
+        )
+        assert result["value"] == 161, f"expected delta 161, got {result['value']}"
+
+
+def test_reason_breakdown_names_moving_labels():
+    """On a burst fire, the result carries `reason_breakdown` naming the moved
+    reasons with their deltas and omitting flat ones."""
+    with tempfile.TemporaryDirectory() as d:
+        state_dir = Path(d)
+        snap_path = state_dir / "recovery_family_streak_snapshot"
+        write_snapshot(snap_path, {
+            "version": "1",
+            "pid": "222",
+            "start_ticks": "200",
+            "counter_value": "114",
+            "breach_streak": "0",
+        })
+
+        alarm = _make_alarm(
+            metric="henyey_recovery_stalled_tick_total",
+            extraction="form2-sum-all",
+            delta_threshold=1, streak_threshold=3, burst_threshold=10,
+            post_restart_absolute_threshold=50,
+            post_restart_absolute_label="forcing_catchup_behind",
+            snapshot_file="recovery_family_streak_snapshot",
+            severity="WARN",
+        )
+        prev = _family(behind=63, not_behind=1, peer_scp=50)
+        current = _family(behind=63, not_behind=81, peer_scp=130)
+
+        result = eval_counter_streak(
+            alarm, current, state_dir, "222", "200", prev=prev,
+        )
+
+        assert result["state"] == "firing"
+        breakdown = result.get("reason_breakdown")
+        assert breakdown, f"expected reason_breakdown, got {breakdown!r}"
+        moved = {b["reason"]: b["delta"] for b in breakdown}
+        assert moved.get("forcing_catchup_not_behind") == 80, moved
+        assert moved.get("near_tip_peer_scp_recovery") == 80, moved
+        # forcing_catchup_behind was flat (63→63) — omitted.
+        assert "forcing_catchup_behind" not in moved, moved
+
+
+def test_render_breakdown_appended_to_line():
+    """render_aggregate appends the per-reason breakdown to the recovery_stalled
+    line so a summed fire names the moving labels."""
+    r = {
+        "contributes_to": "recovery_stalled",
+        "state": "firing",
+        "value": 160,
+        "post_restart": False,
+        "reason_breakdown": [
+            {"reason": "forcing_catchup_not_behind", "delta": 80},
+            {"reason": "near_tip_peer_scp_recovery", "delta": 80},
+        ],
+    }
+    out = render_aggregate([r], watcher_mode=False)
+    line = out["recovery_stalled_line"]
+    assert "delta=160" in line and "(burst)" in line, line
+    assert "forcing_catchup_not_behind+80" in line, line
+    assert "near_tip_peer_scp_recovery+80" in line, line
+
+
+# ── catalog validation ────────────────────────────────────────────────────────
+
+def test_validate_catalog_rejects_non_string_post_restart_label():
+    """A non-string post_restart_absolute_label is a schema error."""
+    catalog = {
+        "schema_version": _mod.SCHEMA_VERSION,
+        "alarm": [{
+            "name": "recovery-stalled",
+            "kind": "counter-streak",
+            "metric": "henyey_recovery_stalled_tick_total",
+            "severity": "WARN",
+            "delta_threshold": 1,
+            "streak_threshold": 3,
+            "burst_threshold": 10,
+            "post_restart_absolute_label": 123,  # not a string
+        }],
+    }
+    errors = validate_catalog(catalog)
+    assert any("post_restart_absolute_label" in e for e in errors), (
+        f"expected a post_restart_absolute_label type error, got {errors}"
+    )
+
+
+def test_validate_catalog_accepts_string_post_restart_label():
+    catalog = {
+        "schema_version": _mod.SCHEMA_VERSION,
+        "alarm": [{
+            "name": "recovery-stalled",
+            "kind": "counter-streak",
+            "metric": "henyey_recovery_stalled_tick_total",
+            "severity": "WARN",
+            "delta_threshold": 1,
+            "streak_threshold": 3,
+            "burst_threshold": 10,
+            "post_restart_absolute_label": "forcing_catchup_behind",
+        }],
+    }
+    errors = validate_catalog(catalog)
+    assert not any("post_restart_absolute_label" in e for e in errors), errors
+
+
+if __name__ == "__main__":
+    import sys
+    fns = [v for k, v in sorted(globals().items()) if k.startswith("test_") and callable(v)]
+    failed = 0
+    for fn in fns:
+        try:
+            fn()
+            print(f"ok - {fn.__name__}")
+        except Exception as e:  # noqa: BLE001
+            failed += 1
+            print(f"not ok - {fn.__name__}: {e}")
+    sys.exit(1 if failed else 0)
diff --git a/scripts/test-monitor-skill-snippets.sh b/scripts/test-monitor-skill-snippets.sh
index 9f23dd18..d42efddf 100755
--- a/scripts/test-monitor-skill-snippets.sh
+++ b/scripts/test-monitor-skill-snippets.sh
@@ -55,7 +55,7 @@ cleanup() {
 trap cleanup EXIT
 
 # ── TAP state ────────────────────────────────────────────────────────────────
-TAP_PLAN=478
+TAP_PLAN=479
 TAP_CURRENT=0
 TAP_FAILURES=0
 
@@ -1604,6 +1604,7 @@ run_tests() {
   # Test 41: TOML catalog file exists, is parseable, and contains recovery-stalled alarm
   # Extract recovery-stalled alarm constants from metric-alarms.toml
   local streak_val burst_val delta_val post_restart_val snapshot_file mode_val metric_name metric_label
+  local extraction_val post_restart_label_val
   # Use Python to extract the recovery-stalled alarm entry from the TOML
   local toml_extract
   toml_extract=$(python3 - "$constants_file" <<'PYEOF'
@@ -1620,6 +1621,8 @@ for a in data['alarm']:
         print('burst_val=' + str(a['burst_threshold']))
         print('delta_val=' + str(a['delta_threshold']))
         print('post_restart_val=' + str(a.get('post_restart_absolute_threshold', 0)))
+        print('extraction_val=' + str(a.get('extraction', '')))
+        print('post_restart_label_val=' + str(a.get('post_restart_absolute_label', '')))
         print('snapshot_file=' + a['snapshot_file'])
         print('metric_name=' + a['metric'])
         labels = a.get('labels', [])
@@ -1646,6 +1649,18 @@ PYEOF
       tap_not_ok "metric-alarms: recovery-stalled post_restart_absolute_threshold == 50" \
         "expected post_restart_absolute_threshold=50, got '$post_restart_val'"
     fi
+    # Test 41c: family-union re-key (#3824). The delta/streak/burst trigger must
+    # observe the SUM of all 8 `reason` series (extraction=form2-sum-all), and
+    # the post-restart absolute guard must be scoped to a single historically
+    # calibrated label (post_restart_absolute_label=forcing_catchup_behind) so a
+    # summed warmup value (~113) does not false-fire the absolute check.
+    if [[ "$extraction_val" == "form2-sum-all" \
+          && "$post_restart_label_val" == "forcing_catchup_behind" ]]; then
+      tap_ok "metric-alarms: recovery-stalled family-union (form2-sum-all + post_restart_absolute_label)"
+    else
+      tap_not_ok "metric-alarms: recovery-stalled family-union (form2-sum-all + post_restart_absolute_label)" \
+        "expected extraction=form2-sum-all and post_restart_absolute_label=forcing_catchup_behind, got extraction='$extraction_val' label='$post_restart_label_val'"
+    fi
   else
     tap_not_ok "metric-alarms: TOML exists and parseable" \
       "Failed to parse recovery-stalled alarm from metric-alarms.toml"

From b43a243e251802520c8f33472820f98b638550d0 Mon Sep 17 00:00:00 2001
From: Tomer Weller
 <tomer@user-dev-050a.dev.stellar002.internal.stellar-ops.com>
Date: Tue, 25 Aug 2026 05:56:29 +0000
Subject: [PATCH 2/2] Re-key recovery-stalled alarm to the family sum of all
 reason series
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check 12b (recovery-stalled counter-streak) keyed only on
henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}. During an
at-tip stall the node takes the forcing_catchup_not_behind branch by
construction, so the one label the alarm watched was exactly the branch that
could not move — a real recovery episode incremented two uncovered labels and
the tick reported ok (delta=0).

Re-key the delta/streak/burst trigger onto the SUM of every reason series
(extraction = form2-sum-all). Scope the post-restart absolute guard to a single
calibrated label via a new post_restart_absolute_label field, so the summed
warmup value (~113) does not false-fire the #3197/#3198 absolute threshold
tuned for forcing_catchup_behind alone. Attach a per-reason breakdown on
breach/firing so a summed fire names the moving labels, on the status line and
in filing details. Rename the snapshot file to force a clean re-baseline on
deploy (empty new path → collecting_baseline, no spurious post-restart fire),
bump baseline_version 3→4, and generalize the cooldown/filing identity to the
family.

Streak-3 / burst-10 gating still absorbs transient single-tick blips (including
the deliberately-non-alarming near_tip_gap1_suppressed / near_tip_park_inflated
suppression counters the node now also exports), so #3728's false-positive class
does not return.

Refs #3824

Co-authored-by: Claude Code <claude-code@anthropic.com>
---
 .agents/skills/monitor-loop/SKILL.md     |   6 +-
 .agents/skills/monitor-tick/SKILL.md     |  59 ++++++----
 .agents/skills/shared/metric-alarms.toml |  39 +++++--
 .claude/skills/monitor-loop/SKILL.md     |   6 +-
 .claude/skills/monitor-tick/SKILL.md     | 100 +++++++++++------
 .claude/skills/shared/metric-alarms.toml |  39 +++++--
 .gitignore                               |   1 +
 scripts/ci/check-alarm-versions.py       |   2 +-
 scripts/lib/eval-alarms.py               | 131 +++++++++++++++++++++--
 scripts/test-monitor-skill-snippets.sh   |  45 ++++----
 10 files changed, 318 insertions(+), 110 deletions(-)

diff --git a/.agents/skills/monitor-loop/SKILL.md b/.agents/skills/monitor-loop/SKILL.md
index a4be555b..7766537a 100644
--- a/.agents/skills/monitor-loop/SKILL.md
+++ b/.agents/skills/monitor-loop/SKILL.md
@@ -245,11 +245,11 @@ table is the human reference.
 These counter-based checks use streak gating rather than immediate-fire thresholds
 because single-tick increments are often transient self-recovering events that
 don't warrant operator attention (see #2309). State is tracked independently of
-the ratio checks in a separate snapshot (`metrics/counter_streak_snapshot`).
+the ratio checks in a separate snapshot (`metrics/recovery_family_streak_snapshot`).
 
 | Metric | Delta threshold | Streak threshold | Burst threshold | Severity | Rationale |
 |--------|-----------------|------------------|-----------------|----------|-----------|
-| `henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}` | ≥ 1 | 3 ticks | ≥ 10 | WARN | Recovery forced catchup while behind consensus; single occurrences are transient self-recovering events (see #2309); large bursts indicate sustained stalling |
+| `henyey_recovery_stalled_tick_total` (sum of all `reason` series, #3824) | ≥ 1 | 3 ticks | ≥ 10 | WARN | Recovery stalled — the delta/streak/burst trigger observes the SUM of every `reason` series (an at-tip stall moves `forcing_catchup_not_behind`/`near_tip_peer_scp_recovery`, not `forcing_catchup_behind`); single-tick blips are transient self-recovering events (see #2309/#3728) absorbed by streak-3 gating; large bursts indicate sustained stalling. Post-restart absolute guard stays scoped to `forcing_catchup_behind` via `post_restart_absolute_label` |
 
 **D. Ratio checks — fire on sustained ratio breach (3 consecutive ticks)**
 
@@ -296,7 +296,7 @@ pending_breach_streak=<N>
 ```
 Invalidate on PID/start_ticks change, malformed snapshot, or counter reset (current < previous).
 
-**Counter-streak snapshot** persisted at `~/data/<session-id>/metrics/counter_streak_snapshot`
+**Counter-streak snapshot** persisted at `~/data/<session-id>/metrics/recovery_family_streak_snapshot`
 (format and invalidation rules defined in Check 12b of monitor-tick/SKILL.md;
 path canonicalized in [`shared/metric-alarms.toml`](../shared/metric-alarms.toml)).
 Separate from ratio snapshot — runs independently of ratio skip conditions (see
diff --git a/.agents/skills/monitor-tick/SKILL.md b/.agents/skills/monitor-tick/SKILL.md
index 4db59a53..2c6ce634 100644
--- a/.agents/skills/monitor-tick/SKILL.md
+++ b/.agents/skills/monitor-tick/SKILL.md
@@ -121,7 +121,7 @@ All files below live in `/home/tomer/data/$MONITOR_SESSION_ID/`:
 | `metrics/prev.prom` | previous Prometheus scrape | check 12 |
 | `metrics/scrape_identity` | process identity of the scrape now in prev.prom | check 12 |
 | `metrics/ratio_snapshot` | counter-ratio history (check 12) | check 12 |
-| `metrics/counter_streak_snapshot` | counter-streak state (check 12b) | check 12b ([metric-alarms](../shared/metric-alarms.toml)) |
+| `metrics/recovery_family_streak_snapshot` | counter-streak state (check 12b; #3824 family-union) | check 12b ([metric-alarms](../shared/metric-alarms.toml)) |
 | `metrics/anomaly_cooldown.json` | alert dedup state | check 9 |
 | `metrics/archive/` | Per-tick snapshot dirs (current.prom + prev.prom + metadata.env), rolling 500, atomic write | check 12 |
 | `logs/monitor.log` | node stdout/stderr (rotated on restart) | node process |
@@ -1119,7 +1119,7 @@ against a node that is in real-time sync with age=2s).
      breach on the next tick before firing.
    - All other §GAUGES are unaffected — they are point-in-time readings from
      `current.prom` only.
-   - Do NOT skip ratio_snapshot or counter_streak_snapshot checks — they have
+   - Do NOT skip ratio_snapshot or recovery_family_streak_snapshot checks — they have
      their own independent PID/start_ticks invalidation logic and snapshot files.
      Independence is safe: each check reads PID/start_ticks from `/proc` and
      compares against its own snapshot.
@@ -1357,12 +1357,25 @@ eval_result=$(python3 scripts/lib/eval-alarms.py \
 > This section is authoritative for the state machine *logic*; inline literals
 > are cross-validated against the TOML by `scripts/test-monitor-skill-snippets.sh`.
 
-This check tracks `henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}`
-using a streak-gated alert, independent of Check 12's ratio checks. It runs on
-its own state machine because ratio checks are globally skipped during unsync
+This check tracks the **sum of every `reason` series** of
+`henyey_recovery_stalled_tick_total` (family-union, `extraction = "form2-sum-all"`,
+#3824) using a streak-gated alert, independent of Check 12's ratio checks. It runs
+on its own state machine because ratio checks are globally skipped during unsync
 states (ledger age > 30s, gap > 5, etc.), but the recovery-stalled counter fires
 precisely during recovery transitions when the node is briefly unsynced.
 
+> **Why the family sum, not a single label (#3824):** Check 12b previously keyed
+> only on `{reason="forcing_catchup_behind"}`. During an *at-tip* stall the node
+> takes the `forcing_catchup_not_behind` branch by construction, so the one label
+> the alarm watched was exactly the branch that could not move — a real recovery
+> episode incremented two uncovered labels and the tick reported `ok (delta=0)`.
+> Summing the whole family makes the trigger observe whichever branch moves and
+> covers any future `reason`. On a fire a per-reason breakdown is appended
+> (`[by reason: <label>+<delta>, …]`). Streak-3 / burst-10 gating still absorbs
+> transient single-tick blips (including the deliberately-non-alarming
+> `near_tip_gap1_suppressed` / `near_tip_park_inflated` suppression counters), so
+> #3728's false-positive class does not return.
+
 **Data source:** Reuses the same `/metrics` scrape result (`$metrics_body` /
 `metrics/current.prom`) already fetched by check-12. Does NOT perform a
 second `/metrics` fetch.
@@ -1370,14 +1383,17 @@ second `/metrics` fetch.
 **Applicability:** Validator mode only. In watcher mode, skip Check 12b entirely
 and omit the `recovery_stalled:` line from the status report.
 
-**Snapshot file:** `/home/tomer/data/$MONITOR_SESSION_ID/metrics/counter_streak_snapshot`
+**Snapshot file:** `/home/tomer/data/$MONITOR_SESSION_ID/metrics/recovery_family_streak_snapshot`
+(renamed from `counter_streak_snapshot` in #3824 to force a clean re-baseline on
+the family-union deploy — the old baseline is absent at the new path, so the
+first post-migration tick re-collects without a spurious post-restart fire.)
 
-Format:
+`counter_value` is the **sum of all `reason` series** (the family-union unit):
 ```
 version=1
 pid=<PID>
 start_ticks=<field 22 from /proc/$PID/stat>
-counter_value=<value>
+counter_value=<family sum across all reason series>
 breach_streak=<N>
 ```
 
@@ -1390,7 +1406,8 @@ counters to a pre-restart baseline.
 **Skip conditions (skip Check 12b only when any is true):**
 - `/metrics` fetch failed this tick (same condition check-12 detects)
 - `/metrics` returns "recorder not installed"
-- `forcing_catchup_behind` label missing from the scrape
+- `henyey_recovery_stalled_tick_total` metric family absent from the scrape
+  (no `reason` series present at all)
 
 On skip: write snapshot preserving existing `counter_value` value (or
 0 if no prior snapshot) with `breach_streak=0`. Next healthy
@@ -1410,10 +1427,15 @@ the first tick after a restart where the counter jumps from 0 to the current
 absolute value.
 
 **Post-restart absolute-value fire (#3198):** After writing the fresh baseline,
-evaluate the *absolute* `counter_value` value that the reset would
-otherwise discard. If it meets `post_restart_absolute_threshold` (= `50`, from
-`metric-alarms.toml`), fire WARN once on this invalidation tick instead of
-reporting `collecting baseline`, and route through the Bug Filing Workflow.
+evaluate the *absolute* value that the reset would otherwise discard. Under the
+#3824 family-union the trigger sums all reasons, but this absolute guard stays
+**scoped to a single calibrated series** via `post_restart_absolute_label`
+(= `forcing_catchup_behind`): the summed family legitimately reaches ~113 during
+warmup, which would false-fire the absolute threshold (tuned for
+`forcing_catchup_behind` alone) every restart. If that scoped label's absolute
+value meets `post_restart_absolute_threshold` (= `50`, from `metric-alarms.toml`),
+fire WARN once on this invalidation tick instead of reporting `collecting
+baseline`, and route through the Bug Filing Workflow.
 This closes the blind spot from #3197/#3198: a self-recovering
 `forcing_catchup_behind` stall that completes before the 15m clean-restart sync
 deadline (so check (2) never reports SYNC FAILURE) and accrues its entire burst
@@ -1428,9 +1450,10 @@ reset) are covered, so the absolute baseline is never silently discarded.
 Otherwise (absolute value below threshold, or threshold disabled): report
 `recovery_stalled: collecting baseline` as before.
 
-**Per-tick logic (not skipped AND not invalidated):**
+**Per-tick logic (not skipped AND not invalidated):** `counter_value` is the
+**family sum** across all `reason` series (#3824):
 ```
-delta = current(counter_value) - prev(counter_value)
+delta = current(family_sum) - prev(family_sum)
 
 if delta >= 10:
     # Immediate-fire override: large burst indicates sustained stalling.
@@ -1454,10 +1477,10 @@ trouble regardless of tick granularity.
 Second tick has a valid prev for delta comparison and begins normal evaluation.
 
 **Alert identity and cooldown:**
-- Cooldown key: `henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}` (full selector-qualified)
+- Cooldown key: `henyey_recovery_stalled_tick_total` (family-level, #3824)
 - Cooldown period: 7200s (2h)
-- Issue search: `gh issue list --search 'metrics: henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}' --state open`
-- Issue title on filing: `metrics: henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"} — sustained breach`
+- Issue search: `gh issue list --search 'metrics: henyey_recovery_stalled_tick_total (family)' --state open`
+- Issue title on filing: `metrics: henyey_recovery_stalled_tick_total (family) — sustained breach`
 - Filing follows the standard Bug Filing Workflow (§Firing alerts — cooldown + filing)
 
 **Integration with metrics aggregate:** Check 12b alerts are NOT counted in the
diff --git a/.agents/skills/shared/metric-alarms.toml b/.agents/skills/shared/metric-alarms.toml
index 90962e6b..b567163b 100644
--- a/.agents/skills/shared/metric-alarms.toml
+++ b/.agents/skills/shared/metric-alarms.toml
@@ -771,11 +771,15 @@ notes = "Overlay lag or stale-envelope flood. Investigate overlay peer health an
 name = "recovery-stalled"
 metric = "henyey_recovery_stalled_tick_total"
 kind = "counter-streak"
-extraction = "form2"
-labels = [{ key = "reason", value = "forcing_catchup_behind" }]
-# Relaxed label validation: only forcing_catchup_behind required.
-# Other labels (backoff_active, forcing_catchup_not_behind, etc.) are
-# created dynamically on first use — may not exist on fresh nodes.
+# Family-union observation (#3824): the delta/streak/burst trigger observes the
+# SUM of ALL `reason` series, not a single label. During an at-tip stall the node
+# takes the `forcing_catchup_not_behind` branch by construction, so the previously
+# watched `forcing_catchup_behind` label was exactly the branch that could not
+# move — a real recovery episode incremented two uncovered labels and the tick
+# reported `ok (delta=0)`. Summing routes every series (including any future
+# `reason` added to consensus.rs) through the single-snapshot delta machine.
+extraction = "form2-sum-all"
+labels = []
 delta_threshold = 1
 streak_threshold = 3
 burst_threshold = 10
@@ -787,15 +791,28 @@ burst_threshold = 10
 # episode accrued 213; a clean restart reaching real-time sync promptly accrues
 # only a handful. 0/absent disables the check.
 post_restart_absolute_threshold = 50
-baseline_version = 3  # bumped in #3222: de-double snapshot_file (metrics/ prefix removed → bare filename)
-semantic_change_date = "2026-06-07T00:00:00Z"
+# The post-restart absolute guard stays SCOPED to a single historically
+# calibrated series (#3824): the summed family legitimately reaches ~113 during
+# warmup (`near_tip_peer_scp_recovery` alone ~50), which would false-fire the
+# absolute threshold (50, tuned on #3197/#3198 for `forcing_catchup_behind`
+# alone) every restart. The delta/burst trigger uses the sum; only the absolute
+# guard reads this single label.
+post_restart_absolute_label = "forcing_catchup_behind"
+baseline_version = 4  # bumped in #3824: family-union re-key (single label → sum of all reasons)
+semantic_change_date = "2026-08-25T00:00:00Z"
 severity = "WARN"
 gates = ["validator-only"]
-snapshot_file = "counter_streak_snapshot"
-cooldown_key = "henyey_recovery_stalled_tick_total{reason=\"forcing_catchup_behind\"}"
+# Renamed from counter_streak_snapshot in #3824 to force a clean re-baseline on
+# deploy: the old baseline is absent at the new path, so the evaluator's
+# empty-snapshot first-tick branch re-collects WITHOUT a spurious post-restart
+# fire (a version-field bump would route the accumulated counter through the
+# post-restart path). The old file is left orphaned — harmless; this alarm is the
+# only counter-streak consumer.
+snapshot_file = "recovery_family_streak_snapshot"
+cooldown_key = "henyey_recovery_stalled_tick_total"
 cooldown_seconds = 7200
-filing_title = "metrics: henyey_recovery_stalled_tick_total{reason=\"forcing_catchup_behind\"} — sustained breach"
-filing_search = "metrics: henyey_recovery_stalled_tick_total{reason=\"forcing_catchup_behind\"}"
+filing_title = "metrics: henyey_recovery_stalled_tick_total (family) — sustained breach"
+filing_search = "metrics: henyey_recovery_stalled_tick_total (family)"
 summary = "Recovery stalled — sustained breach"
 details = "delta={value} streak={streak}/{streak_threshold}"
 notes = ""
diff --git a/.claude/skills/monitor-loop/SKILL.md b/.claude/skills/monitor-loop/SKILL.md
index 6ce4abdd..71fa4be5 100644
--- a/.claude/skills/monitor-loop/SKILL.md
+++ b/.claude/skills/monitor-loop/SKILL.md
@@ -245,11 +245,11 @@ table is the human reference.
 These counter-based checks use streak gating rather than immediate-fire thresholds
 because single-tick increments are often transient self-recovering events that
 don't warrant operator attention (see #2309). State is tracked independently of
-the ratio checks in a separate snapshot (`metrics/counter_streak_snapshot`).
+the ratio checks in a separate snapshot (`metrics/recovery_family_streak_snapshot`).
 
 | Metric | Delta threshold | Streak threshold | Burst threshold | Severity | Rationale |
 |--------|-----------------|------------------|-----------------|----------|-----------|
-| `henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}` | ≥ 1 | 3 ticks | ≥ 10 | WARN | Recovery forced catchup while behind consensus; single occurrences are transient self-recovering events (see #2309); large bursts indicate sustained stalling |
+| `henyey_recovery_stalled_tick_total` (sum of all `reason` series, #3824) | ≥ 1 | 3 ticks | ≥ 10 | WARN | Recovery stalled — the delta/streak/burst trigger observes the SUM of every `reason` series (an at-tip stall moves `forcing_catchup_not_behind`/`near_tip_peer_scp_recovery`, not `forcing_catchup_behind`); single-tick blips are transient self-recovering events (see #2309/#3728) absorbed by streak-3 gating; large bursts indicate sustained stalling. Post-restart absolute guard stays scoped to `forcing_catchup_behind` via `post_restart_absolute_label` |
 
 **D. Ratio checks — fire on sustained ratio breach (3 consecutive ticks)**
 
@@ -296,7 +296,7 @@ pending_breach_streak=<N>
 ```
 Invalidate on PID/start_ticks change, malformed snapshot, or counter reset (current < previous).
 
-**Counter-streak snapshot** persisted at `~/data/<session-id>/metrics/counter_streak_snapshot`
+**Counter-streak snapshot** persisted at `~/data/<session-id>/metrics/recovery_family_streak_snapshot`
 (format and invalidation rules defined in Check 12b of monitor-tick/SKILL.md;
 path canonicalized in [`shared/metric-alarms.toml`](../shared/metric-alarms.toml)).
 Separate from ratio snapshot — runs independently of ratio skip conditions (see
diff --git a/.claude/skills/monitor-tick/SKILL.md b/.claude/skills/monitor-tick/SKILL.md
index d846a5f6..0a924cb3 100644
--- a/.claude/skills/monitor-tick/SKILL.md
+++ b/.claude/skills/monitor-tick/SKILL.md
@@ -120,7 +120,7 @@ All files below live in `/home/tomer/data/$MONITOR_SESSION_ID/`:
 | `metrics/prev.prom` | previous Prometheus scrape | check 12 |
 | `metrics/scrape_identity` | process identity of the scrape now in prev.prom | check 12 |
 | `metrics/ratio_snapshot` | counter-ratio history (check 12) | check 12 |
-| `metrics/counter_streak_snapshot` | counter-streak state (check 12b) | check 12b ([metric-alarms](../shared/metric-alarms.toml)) |
+| `metrics/recovery_family_streak_snapshot` | counter-streak state (check 12b; #3824 family-union) | check 12b ([metric-alarms](../shared/metric-alarms.toml)) |
 | `metrics/anomaly_cooldown.json` | alert dedup state (written by the evaluator via `--cooldown-file`; #3762) | check 12 |
 | `obsrvr-not-indexed.state` | OBSRVR Radar `not-indexed` streak counter + one-shot escalation marker (`eval_obsrvr_not_indexed_streak`) | check 9 |
 | `metrics/archive/` | Per-tick snapshot dirs (current.prom + prev.prom + metadata.env), rolling 500, atomic write | check 12 |
@@ -1308,7 +1308,7 @@ tracks node health, and this signal is not one.
      breach on the next tick before firing.
    - All other §GAUGES are unaffected — they are point-in-time readings from
      `current.prom` only.
-   - Do NOT skip ratio_snapshot or counter_streak_snapshot checks — they have
+   - Do NOT skip ratio_snapshot or recovery_family_streak_snapshot checks — they have
      their own independent PID/start_ticks invalidation logic and snapshot files.
      Independence is safe: each check reads PID/start_ticks from `/proc` and
      compares against its own snapshot.
@@ -1557,28 +1557,42 @@ eval_result=$(python3 scripts/lib/eval-alarms.py \
 > This section is authoritative for the state machine *logic*; inline literals
 > are cross-validated against the TOML by `scripts/test-monitor-skill-snippets.sh`.
 
-This check tracks `henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}`
-using a streak-gated alert, independent of Check 12's ratio checks. It runs on
-its own state machine because ratio checks are globally skipped during unsync
+This check tracks the **sum of every `reason` series** of
+`henyey_recovery_stalled_tick_total` (family-union, `extraction = "form2-sum-all"`,
+#3824) using a streak-gated alert, independent of Check 12's ratio checks. It runs
+on its own state machine because ratio checks are globally skipped during unsync
 states (ledger age > 30s, gap > 5, etc.), but the recovery-stalled counter fires
 precisely during recovery transitions when the node is briefly unsynced.
 
+> **Why the family sum, not a single label (#3824):** Check 12b previously keyed
+> only on `{reason="forcing_catchup_behind"}`. During an *at-tip* stall the node
+> takes the `forcing_catchup_not_behind` branch by construction
+> (`latest_externalized == current_ledger`), so the one label the alarm watched
+> was exactly the branch that could not move — a real recovery episode
+> incremented two **uncovered** labels (`forcing_catchup_not_behind`,
+> `near_tip_peer_scp_recovery`) and the tick reported `ok (delta=0)`. Summing the
+> whole family makes the trigger observe whichever branch actually moves, and
+> automatically covers any future `reason` added to `consensus.rs`. On a fire, a
+> per-reason breakdown is appended (`[by reason: <label>+<delta>, …]`) so the
+> summed delta still names the moving labels.
+
 > **#3728 firing scope (post-PR #3731):** A momentary single-ledger lag
-> (`gap == 1`) no longer increments `forcing_catchup_behind` on every recovery
+> (`gap == 1`) does not increment `forcing_catchup_behind` on every recovery
 > tick — the escalation is suppressed while the gap stays momentary, so the
-> false-positive streak-3 breach that filed #3728 no longer occurs. The
-> suppression is **bounded**: a node genuinely wedged at exactly `gap == 1`
-> resumes firing `forcing_catchup_behind` once the stall persists past
-> `RECOVERY_ESCALATION_NEAR_TIP_GAP_STALL_ATTEMPTS` (12) consecutive
-> no-progress attempts, so this check still catches a truly-stuck near-tip node
-> — just after a short grace window rather than on the first tick. While the
-> gap stays suppressed, the node instead increments the distinct,
-> **non-alarming** `henyey_recovery_stalled_tick_total{reason="near_tip_gap1_suppressed"}`
-> counter. That label is **not** an alarm input (Check 12b keys only on
-> `forcing_catchup_behind`); it is a scrape-only observability signal — a
-> steadily-climbing `near_tip_gap1_suppressed` with a flat ledger indicates a
-> node parked at `gap == 1` and is worth manual investigation even before the
-> bounded backstop trips `forcing_catchup_behind`.
+> node instead increments the distinct
+> `henyey_recovery_stalled_tick_total{reason="near_tip_gap1_suppressed"}` (and,
+> for park-inflated ticks, `near_tip_park_inflated`) counter. Under the #3824
+> family-union these suppression series ARE now part of the summed trigger, but
+> the **streak-3 / burst-10 gating still absorbs transient blips**: a momentary
+> gap==1 that self-heals in one or two ticks never reaches a 3-consecutive-tick
+> streak and is nowhere near a +10 single-tick burst, so #3728's false-positive
+> class does not return. A node genuinely *parked* at `gap == 1` climbs
+> `near_tip_gap1_suppressed` steadily — a flat ledger with a rising suppressed
+> counter — which the family-union now surfaces on the `recovery_stalled:` line
+> (this is exactly the "worth manual investigation" condition the previous prose
+> flagged, and the bounded backstop past
+> `RECOVERY_ESCALATION_NEAR_TIP_GAP_STALL_ATTEMPTS` (12) still re-trips
+> `forcing_catchup_behind` for a truly wedged near-tip node).
 
 **Data source:** Reuses the same `/metrics` scrape result (`$metrics_body` /
 `metrics/current.prom`) already fetched by check-12. Does NOT perform a
@@ -1587,16 +1601,21 @@ second `/metrics` fetch.
 **Applicability:** Validator mode only. In watcher mode, skip Check 12b entirely
 and omit the `recovery_stalled:` line from the status report.
 
-**Snapshot file:** `/home/tomer/data/$MONITOR_SESSION_ID/metrics/counter_streak_snapshot`
+**Snapshot file:** `/home/tomer/data/$MONITOR_SESSION_ID/metrics/recovery_family_streak_snapshot`
+(renamed from `counter_streak_snapshot` in #3824 to force a clean re-baseline on
+the family-union deploy — the old baseline is absent at the new path, so the
+first post-migration tick re-collects without a spurious post-restart fire. The
+old file is left orphaned; this alarm is the only counter-streak consumer.)
 
 Write it with the single-writer helper (#3791) — the sole constructor of this
-artifact — so the format stays canonical:
+artifact — so the format stays canonical. `--counter-value` is the **sum of all
+`reason` series** (the family-union trigger's unit, #3824):
 ```bash
 MTA="$(git rev-parse --show-toplevel)/scripts/lib/monitor-tick-artifacts.py"
 python3 "$MTA" write-counter-streak \
   --pid "$PID" --start-ticks "$START_TICKS" \
   --counter-value "$COUNTER_VALUE" --breach-streak "$BREACH_STREAK" \
-  > /home/tomer/data/$MONITOR_SESSION_ID/metrics/counter_streak_snapshot
+  > /home/tomer/data/$MONITOR_SESSION_ID/metrics/recovery_family_streak_snapshot
 ```
 
 Format (as emitted by the helper):
@@ -1604,7 +1623,7 @@ Format (as emitted by the helper):
 version=1
 pid=<PID>
 start_ticks=<field 22 from /proc/$PID/stat>
-counter_value=<value>
+counter_value=<family sum across all reason series>
 breach_streak=<N>
 ```
 
@@ -1617,7 +1636,8 @@ counters to a pre-restart baseline.
 **Skip conditions (skip Check 12b only when any is true):**
 - `/metrics` fetch failed this tick (same condition check-12 detects)
 - `/metrics` returns "recorder not installed"
-- `forcing_catchup_behind` label missing from the scrape
+- `henyey_recovery_stalled_tick_total` metric family absent from the scrape
+  (no `reason` series present at all)
 
 On skip: write snapshot preserving existing `counter_value` value (or
 0 if no prior snapshot) with `breach_streak=0`. Next healthy
@@ -1637,10 +1657,16 @@ the first tick after a restart where the counter jumps from 0 to the current
 absolute value.
 
 **Post-restart absolute-value fire (#3198):** After writing the fresh baseline,
-evaluate the *absolute* `counter_value` value that the reset would
-otherwise discard. If it meets `post_restart_absolute_threshold` (= `50`, from
-`metric-alarms.toml`), fire WARN once on this invalidation tick instead of
-reporting `collecting baseline`, and route through the Bug Filing Workflow.
+evaluate the *absolute* value that the reset would otherwise discard. Under the
+#3824 family-union the trigger sums all reasons, but this absolute guard stays
+**scoped to a single calibrated series** via `post_restart_absolute_label`
+(= `forcing_catchup_behind`): the summed family legitimately reaches ~113 during
+warmup (`near_tip_peer_scp_recovery` alone ~50), which would false-fire the
+absolute threshold (tuned on #3197/#3198 for `forcing_catchup_behind` alone)
+every restart. If that scoped label's absolute value meets
+`post_restart_absolute_threshold` (= `50`, from `metric-alarms.toml`), fire WARN
+once on this invalidation tick instead of reporting `collecting baseline`, and
+route through the Bug Filing Workflow.
 This closes the blind spot from #3197/#3198: a self-recovering
 `forcing_catchup_behind` stall that completes before the 15m clean-restart sync
 deadline (so check (2) never reports SYNC FAILURE) and accrues its entire burst
@@ -1655,9 +1681,11 @@ reset) are covered, so the absolute baseline is never silently discarded.
 Otherwise (absolute value below threshold, or threshold disabled): report
 `recovery_stalled: collecting baseline` as before.
 
-**Per-tick logic (not skipped AND not invalidated):**
+**Per-tick logic (not skipped AND not invalidated):** `counter_value` is the
+**family sum** across all `reason` series (#3824), so `delta` observes whichever
+branch moved this tick:
 ```
-delta = current(counter_value) - prev(counter_value)
+delta = current(family_sum) - prev(family_sum)
 
 if delta >= 10:
     # Immediate-fire override: large burst indicates sustained stalling.
@@ -1681,10 +1709,10 @@ trouble regardless of tick granularity.
 Second tick has a valid prev for delta comparison and begins normal evaluation.
 
 **Alert identity and cooldown:**
-- Cooldown key: `henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}` (full selector-qualified)
+- Cooldown key: `henyey_recovery_stalled_tick_total` (family-level, #3824)
 - Cooldown period: 7200s (2h)
-- Issue search: `gh issue list --search 'metrics: henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"}' --state open`
-- Issue title on filing: `metrics: henyey_recovery_stalled_tick_total{reason="forcing_catchup_behind"} — sustained breach`
+- Issue search: `gh issue list --search 'metrics: henyey_recovery_stalled_tick_total (family)' --state open`
+- Issue title on filing: `metrics: henyey_recovery_stalled_tick_total (family) — sustained breach`
 - Filing follows the standard Bug Filing Workflow (§Firing alerts — cooldown + filing)
 
 **Integration with metrics aggregate:** Check 12b alerts are NOT counted in the
@@ -1697,7 +1725,11 @@ to overall tick severity — the tick is considered unhealthy when any alert fir
 - `recovery_stalled: breach (delta=N, streak M/3)` — incrementing, below threshold
 - `recovery_stalled: WARNING delta=N (M ticks) — investigating` — streak ≥ 3
 - `recovery_stalled: WARNING delta=N (burst) — investigating` — immediate fire (delta ≥ 10)
-- `recovery_stalled: WARNING absolute=N (post-restart) — investigating` — post-restart absolute fire (absolute ≥ 50 on a baseline-reset tick, #3198)
+- `recovery_stalled: WARNING absolute=N (post-restart) — investigating` — post-restart absolute fire on the scoped `forcing_catchup_behind` label (absolute ≥ 50 on a baseline-reset tick, #3198)
+
+On a breach or delta/burst fire, a per-reason breakdown is appended so the summed
+delta names the moving labels, e.g.
+`recovery_stalled: WARNING delta=161 (burst) — investigating [by reason: forcing_catchup_not_behind+80, near_tip_peer_scp_recovery+80]` (#3824).
 - `recovery_stalled: skipped (<reason>)` — metric missing or fetch failed
 - `recovery_stalled: collecting baseline` — first tick after restart/invalidation (absolute value below the post-restart threshold)
 
diff --git a/.claude/skills/shared/metric-alarms.toml b/.claude/skills/shared/metric-alarms.toml
index 90962e6b..b567163b 100644
--- a/.claude/skills/shared/metric-alarms.toml
+++ b/.claude/skills/shared/metric-alarms.toml
@@ -771,11 +771,15 @@ notes = "Overlay lag or stale-envelope flood. Investigate overlay peer health an
 name = "recovery-stalled"
 metric = "henyey_recovery_stalled_tick_total"
 kind = "counter-streak"
-extraction = "form2"
-labels = [{ key = "reason", value = "forcing_catchup_behind" }]
-# Relaxed label validation: only forcing_catchup_behind required.
-# Other labels (backoff_active, forcing_catchup_not_behind, etc.) are
-# created dynamically on first use — may not exist on fresh nodes.
+# Family-union observation (#3824): the delta/streak/burst trigger observes the
+# SUM of ALL `reason` series, not a single label. During an at-tip stall the node
+# takes the `forcing_catchup_not_behind` branch by construction, so the previously
+# watched `forcing_catchup_behind` label was exactly the branch that could not
+# move — a real recovery episode incremented two uncovered labels and the tick
+# reported `ok (delta=0)`. Summing routes every series (including any future
+# `reason` added to consensus.rs) through the single-snapshot delta machine.
+extraction = "form2-sum-all"
+labels = []
 delta_threshold = 1
 streak_threshold = 3
 burst_threshold = 10
@@ -787,15 +791,28 @@ burst_threshold = 10
 # episode accrued 213; a clean restart reaching real-time sync promptly accrues
 # only a handful. 0/absent disables the check.
 post_restart_absolute_threshold = 50
-baseline_version = 3  # bumped in #3222: de-double snapshot_file (metrics/ prefix removed → bare filename)
-semantic_change_date = "2026-06-07T00:00:00Z"
+# The post-restart absolute guard stays SCOPED to a single historically
+# calibrated series (#3824): the summed family legitimately reaches ~113 during
+# warmup (`near_tip_peer_scp_recovery` alone ~50), which would false-fire the
+# absolute threshold (50, tuned on #3197/#3198 for `forcing_catchup_behind`
+# alone) every restart. The delta/burst trigger uses the sum; only the absolute
+# guard reads this single label.
+post_restart_absolute_label = "forcing_catchup_behind"
+baseline_version = 4  # bumped in #3824: family-union re-key (single label → sum of all reasons)
+semantic_change_date = "2026-08-25T00:00:00Z"
 severity = "WARN"
 gates = ["validator-only"]
-snapshot_file = "counter_streak_snapshot"
-cooldown_key = "henyey_recovery_stalled_tick_total{reason=\"forcing_catchup_behind\"}"
+# Renamed from counter_streak_snapshot in #3824 to force a clean re-baseline on
+# deploy: the old baseline is absent at the new path, so the evaluator's
+# empty-snapshot first-tick branch re-collects WITHOUT a spurious post-restart
+# fire (a version-field bump would route the accumulated counter through the
+# post-restart path). The old file is left orphaned — harmless; this alarm is the
+# only counter-streak consumer.
+snapshot_file = "recovery_family_streak_snapshot"
+cooldown_key = "henyey_recovery_stalled_tick_total"
 cooldown_seconds = 7200
-filing_title = "metrics: henyey_recovery_stalled_tick_total{reason=\"forcing_catchup_behind\"} — sustained breach"
-filing_search = "metrics: henyey_recovery_stalled_tick_total{reason=\"forcing_catchup_behind\"}"
+filing_title = "metrics: henyey_recovery_stalled_tick_total (family) — sustained breach"
+filing_search = "metrics: henyey_recovery_stalled_tick_total (family)"
 summary = "Recovery stalled — sustained breach"
 details = "delta={value} streak={streak}/{streak_threshold}"
 notes = ""
diff --git a/.gitignore b/.gitignore
index 54429a29..334bf6d4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -102,6 +102,7 @@ crates/*/transactions/[0-9a-f][0-9a-f]/
 /metrics/gauge_persistence
 /metrics/scrape_identity
 /metrics/counter_streak_snapshot
+/metrics/recovery_family_streak_snapshot
 /metrics/ratio_snapshot
 /metrics/counter_dynamic_snapshot
 /metrics/anomaly_cooldown.json
diff --git a/scripts/ci/check-alarm-versions.py b/scripts/ci/check-alarm-versions.py
index 52349f72..fee99bf2 100644
--- a/scripts/ci/check-alarm-versions.py
+++ b/scripts/ci/check-alarm-versions.py
@@ -29,7 +29,7 @@
     "op", "threshold", "multiplier", "min_absolute",
     "gates", "for_ticks",
     "burst_threshold", "delta_threshold", "streak_threshold",
-    "post_restart_absolute_threshold",
+    "post_restart_absolute_threshold", "post_restart_absolute_label",
     "denominator", "denominator_metric", "denominator_sum",
     "denominator_extraction", "denominator_includes_numerator",
     "numerator", "numerator_metric", "numerator_sum", "numerator_extraction",
diff --git a/scripts/lib/eval-alarms.py b/scripts/lib/eval-alarms.py
index ea61b52b..5f206778 100644
--- a/scripts/lib/eval-alarms.py
+++ b/scripts/lib/eval-alarms.py
@@ -210,6 +210,66 @@ def extract_value(
     return None
 
 
+def post_restart_label_value(
+    alarm: dict,
+    current: dict[str, list[tuple[dict[str, str], float]]],
+    fallback: float,
+) -> float:
+    """Value fed to the post-restart absolute guard for a counter-streak alarm.
+
+    The delta/streak/burst trigger observes the family SUM (extraction
+    ``form2-sum-all``), but the post-restart absolute guard (#3198) is calibrated
+    for a single historically-tuned series (#3824). When
+    ``post_restart_absolute_label`` is set, the guard evaluates ONLY that
+    ``reason`` series (not the aggregate sum, which legitimately reaches ~113
+    during warmup and would false-fire the absolute threshold every restart).
+    A missing scoped series is treated as 0 (no fire). When the field is absent,
+    fall back to the value the trigger already uses (the aggregate).
+    """
+    label = alarm.get("post_restart_absolute_label")
+    if not label:
+        return fallback
+    v = extract_value(
+        current, alarm["metric"], "form2", [{"key": "reason", "value": label}]
+    )
+    return v if v is not None else 0.0
+
+
+def compute_reason_breakdown(
+    current: dict[str, list[tuple[dict[str, str], float]]],
+    prev: dict[str, list[tuple[dict[str, str], float]]] | None,
+    metric: str,
+    label_key: str = "reason",
+) -> list[dict]:
+    """Per-``reason`` cross-tick deltas for a family-union counter-streak fire.
+
+    A summed fire reports only the aggregate delta (e.g. 161) with no attribution
+    (#3824). This computes each ``reason`` series' current-vs-prev delta, keeps
+    only the nonzero movers, and returns them sorted by descending delta so a
+    fire can name the labels that actually moved. Read-only/additive — no
+    snapshot-schema change. Returns [] when ``prev`` is unavailable.
+    """
+    if not prev:
+        return []
+    cur_series: dict[str, float] = {}
+    for lbl, val in current.get(metric, []):
+        r = lbl.get(label_key)
+        if r is not None:
+            cur_series[r] = val
+    prev_series: dict[str, float] = {}
+    for lbl, val in prev.get(metric, []):
+        r = lbl.get(label_key)
+        if r is not None:
+            prev_series[r] = val
+    out: list[dict] = []
+    for reason, cval in cur_series.items():
+        delta = int(cval) - int(prev_series.get(reason, 0.0))
+        if delta != 0:
+            out.append({"reason": reason, "delta": delta})
+    out.sort(key=lambda b: (-b["delta"], b["reason"]))
+    return out
+
+
 def extract_sum(
     metrics: dict[str, list[tuple[dict[str, str], float]]],
     metric_names: list[str],
@@ -1482,10 +1542,15 @@ def eval_counter_streak(
     start_ticks: str,
     gap_stale: bool = False,
     too_fresh: bool = False,
+    prev: dict | None = None,
 ) -> dict:
     """Evaluate a counter-streak alarm.
 
     Independent of PREV_PROM_INVALID — uses own PID/start_ticks in snapshot.
+
+    ``prev`` (the previous scrape's parsed metrics) is optional and used only to
+    attach a per-``reason`` breakdown on breach/firing when the alarm observes a
+    family sum (#3824); it does not affect the trigger's snapshot-based delta.
     """
     ev_default = default_extra_values(alarm, "counter-streak")
 
@@ -1536,7 +1601,8 @@ def eval_counter_streak(
                 "breach_streak": "0",
             }
             write_snapshot(snapshot_path, new_snapshot)
-            post_restart = maybe_post_restart_fire(alarm, cur_val)
+            post_restart = maybe_post_restart_fire(
+                alarm, post_restart_label_value(alarm, current, cur_val))
             if post_restart is not None:
                 return post_restart
             return make_result(alarm, "collecting_baseline",
@@ -1564,6 +1630,14 @@ def eval_counter_streak(
     # branch: write the fresh baseline FIRST, then evaluate the discarded
     # absolute value for a post-restart fire (#3198). The fire here uses the
     # absolute value, so it is not double-counting a delta.
+    #
+    # Under the family-union extraction (#3824), cur_val here is the SUM of all
+    # `reason` series. All 8 series live in the same metric family and reset
+    # together on a restart / metric re-registration, so a partial reset that
+    # left the sum flat is not a real case — the sum regressing is the correct
+    # reset signal. The post-restart guard stays scoped to the single calibrated
+    # label via post_restart_label_value (the summed value legitimately reaches
+    # ~113 during warmup and must not absolute-fire).
     if cur_val < prev_counter:
         new_snapshot = {
             "version": "1",
@@ -1573,7 +1647,8 @@ def eval_counter_streak(
             "breach_streak": "0",
         }
         write_snapshot(snapshot_path, new_snapshot)
-        post_restart = maybe_post_restart_fire(alarm, cur_val)
+        post_restart = maybe_post_restart_fire(
+            alarm, post_restart_label_value(alarm, current, cur_val))
         if post_restart is not None:
             return post_restart
         return make_result(alarm, "collecting_baseline",
@@ -1625,6 +1700,21 @@ def eval_counter_streak(
 
     ev = {"streak": streak, "streak_threshold": streak_threshold}
 
+    # Per-reason attribution for a family-union fire (#3824). Computed once; a
+    # summed delta otherwise reports only the aggregate with no moving-label
+    # names. Read-only vs `prev` — no snapshot-schema change. Empty when prev is
+    # absent (e.g. no-prev.prom tick) or nothing moved.
+    breakdown = compute_reason_breakdown(current, prev, metric)
+
+    def _with_breakdown(result: dict) -> dict:
+        if breakdown:
+            result["reason_breakdown"] = breakdown
+            # Thread into filing details so a filed issue names the movers, not
+            # just the aggregate delta (#3824).
+            suffix = f" by_reason: {format_reason_breakdown(breakdown)}"
+            result["details"] = (result.get("details", "") or "") + suffix
+        return result
+
     if delta >= burst_threshold:
         streak += 1
         new_snapshot = {
@@ -1635,10 +1725,10 @@ def eval_counter_streak(
             "breach_streak": str(streak),
         }
         write_snapshot(snapshot_path, new_snapshot)
-        return make_result(
+        return _with_breakdown(make_result(
             alarm, "firing", value=delta, threshold=burst_threshold,
             for_ticks_elapsed=streak, extra_values={"streak": streak, "streak_threshold": streak_threshold},
-        )
+        ))
 
     if delta >= delta_threshold:
         streak += 1
@@ -1652,14 +1742,14 @@ def eval_counter_streak(
         write_snapshot(snapshot_path, new_snapshot)
 
         if streak >= streak_threshold:
-            return make_result(
+            return _with_breakdown(make_result(
                 alarm, "firing", value=delta, threshold=delta_threshold,
                 for_ticks_elapsed=streak, extra_values={"streak": streak, "streak_threshold": streak_threshold},
-            )
-        return make_result(
+            ))
+        return _with_breakdown(make_result(
             alarm, "breach", value=delta, threshold=delta_threshold,
             for_ticks_elapsed=streak, extra_values={"streak": streak, "streak_threshold": streak_threshold},
-        )
+        ))
 
     # delta == 0
     new_snapshot = {
@@ -1675,6 +1765,19 @@ def eval_counter_streak(
 
 # ── Aggregate line rendering ────────────────────────────────────────────────
 
+def format_reason_breakdown(breakdown: list[dict]) -> str:
+    """Render a per-reason breakdown as `reason+delta` comma-separated tokens."""
+    return ", ".join(f"{b['reason']}+{b['delta']}" for b in breakdown)
+
+
+def _reason_breakdown_suffix(result: dict) -> str:
+    """Advisory ` [by reason: ...]` suffix for a family-union fire (#3824)."""
+    breakdown = result.get("reason_breakdown")
+    if not breakdown:
+        return ""
+    return f" [by reason: {format_reason_breakdown(breakdown)}]"
+
+
 def render_aggregate(results: list[dict], watcher_mode: bool) -> dict:
     """Render aggregate status lines from alarm results."""
     # metrics line
@@ -1749,9 +1852,11 @@ def render_aggregate(results: list[dict], watcher_mode: bool) -> dict:
             else:
                 streak = r.get("for_ticks_elapsed", 0)
                 recovery_stalled_line = f"recovery_stalled: WARNING delta={r['value']} ({streak} ticks) — investigating"
+            recovery_stalled_line += _reason_breakdown_suffix(r)
         elif r["state"] == "breach":
             streak = r.get("for_ticks_elapsed", 0)
             recovery_stalled_line = f"recovery_stalled: breach (delta={r['value']}, streak {streak}/3)"
+            recovery_stalled_line += _reason_breakdown_suffix(r)
         elif r["state"] == "skipped":
             recovery_stalled_line = f"recovery_stalled: skipped ({r.get('skip_reason', '')})"
         elif r["state"] == "collecting_baseline":
@@ -1899,6 +2004,14 @@ def validate_catalog(catalog: dict) -> list[str]:
                 errors.append(f"{name}: counter-streak requires 'streak_threshold'")
             if "burst_threshold" not in alarm:
                 errors.append(f"{name}: counter-streak requires 'burst_threshold'")
+            # post_restart_absolute_label (#3824) scopes the post-restart absolute
+            # guard to a single `reason` series while the trigger sums the family.
+            # Optional, but must be a string when present (it becomes a label
+            # selector value passed to extract_value).
+            prl = alarm.get("post_restart_absolute_label")
+            if prl is not None and not isinstance(prl, str):
+                errors.append(
+                    f"{name}: invalid post_restart_absolute_label '{prl}' (must be a string)")
 
     return errors
 
@@ -2089,7 +2202,7 @@ def main() -> int:
                 )
             elif kind == "counter-streak":
                 result = eval_counter_streak(alarm, current, state_dir, pid, start_ticks_val,
-                                             gap_stale, too_fresh)
+                                             gap_stale, too_fresh, prev=prev)
             else:
                 result = make_result(alarm, "skipped", skip_reason=f"unknown kind: {kind}")
 
diff --git a/scripts/test-monitor-skill-snippets.sh b/scripts/test-monitor-skill-snippets.sh
index d42efddf..07088aa8 100755
--- a/scripts/test-monitor-skill-snippets.sh
+++ b/scripts/test-monitor-skill-snippets.sh
@@ -1727,9 +1727,10 @@ PYEOF
   fi
 
   # Test 48: Cross-file — monitor-loop table row matches TOML values (row-specific)
-  # Use metric_label from TOML to select the row (not hardcoded)
+  # Select the row by the family metric name (#3824: the single-label selector was
+  # dropped in favour of the family-union sum, so metric_name is the stable key).
   local recovery_row
-  recovery_row=$(echo "$loop_streak_table" | grep -F "$metric_label" || true)
+  recovery_row=$(echo "$loop_streak_table" | grep -F "$metric_name" || true)
   if [[ -n "$recovery_row" ]] \
      && echo "$recovery_row" | grep -Fq "${streak_val} ticks" \
      && echo "$recovery_row" | grep -Fq "≥ ${burst_val}" \
@@ -1778,13 +1779,16 @@ PYEOF
       "Expected '$metric_name' in both Check 12b section and monitor-loop table"
   fi
 
-  # Test 53: Metric label from TOML appears in both SKILL.md files
-  if echo "$check_12b_section" | grep -Fq "$metric_label" \
-     && echo "$loop_streak_table" | grep -Fq "$metric_label"; then
-    tap_ok "check-12b-semantics: metric label from TOML in both specs ($metric_label)"
+  # Test 53: Post-restart scoped label from TOML appears in both SKILL.md files
+  # (#3824: the family-union trigger has no single selector, but the post-restart
+  # absolute guard is scoped to post_restart_absolute_label, and both specs must
+  # document that scoping so the ~113 warmup sum does not appear to absolute-fire.)
+  if echo "$check_12b_section" | grep -Fq "$post_restart_label_val" \
+     && echo "$loop_streak_table" | grep -Fq "$post_restart_label_val"; then
+    tap_ok "check-12b-semantics: post_restart_absolute_label from TOML in both specs ($post_restart_label_val)"
   else
-    tap_not_ok "check-12b-semantics: metric label from TOML in both specs" \
-      "Expected '$metric_label' in both Check 12b section and monitor-loop table"
+    tap_not_ok "check-12b-semantics: post_restart_absolute_label from TOML in both specs" \
+      "Expected '$post_restart_label_val' in both Check 12b section and monitor-loop table"
   fi
 
   # Test 53b: recovery-stalled snapshot_file is a BARE filename (no '/'), matching
@@ -1795,11 +1799,11 @@ PYEOF
   # invalid; the bare name resolves single-level under --state-dir. Substring greps
   # (Tests 44/48) do NOT catch the doubling because the bare name is a substring of
   # the doubled path — hence this dedicated structural assertion.
-  if [[ "$snapshot_file" != */* && "$snapshot_file" == "counter_streak_snapshot" ]]; then
+  if [[ "$snapshot_file" != */* && "$snapshot_file" == "recovery_family_streak_snapshot" ]]; then
     tap_ok "metric-alarms: recovery-stalled snapshot_file is bare filename ($snapshot_file)"
   else
     tap_not_ok "metric-alarms: recovery-stalled snapshot_file is bare filename" \
-      "snapshot_file must be the bare name 'counter_streak_snapshot' (no '/' prefix), got '$snapshot_file' — a directory prefix doubles the resolved path under --state-dir .../metrics (#3222)"
+      "snapshot_file must be the bare name 'recovery_family_streak_snapshot' (no '/' prefix), got '$snapshot_file' — a directory prefix doubles the resolved path under --state-dir .../metrics (#3222/#3824)"
   fi
 
   # Test 53c: check-12b Format block documents the evaluator's ACTUAL snapshot
@@ -4760,6 +4764,7 @@ PYEOF
     "gauge_persistence"
     "scrape_identity"
     "counter_streak_snapshot"
+    "recovery_family_streak_snapshot"
     "ratio_snapshot"
     "counter_dynamic_snapshot"
     "anomaly_cooldown.json"
@@ -5395,7 +5400,7 @@ except:
   # Pre-seed a snapshot from the PRE-restart incarnation (pid=1000). The catalog
   # snapshot_file is the BARE name (#3222), so the evaluator resolves it directly
   # under --state-dir (no 'metrics/' subdir).
-  cat > "$state_dir_148c/counter_streak_snapshot" <<'SNAP_148C'
+  cat > "$state_dir_148c/recovery_family_streak_snapshot" <<'SNAP_148C'
 version=1
 pid=1000
 start_ticks=1000
@@ -5441,7 +5446,7 @@ except:
   # Test 148d: recovery-stalled clean restart below threshold does NOT fire.
   local state_dir_148d
   state_dir_148d=$(mktemp -d)
-  cat > "$state_dir_148d/counter_streak_snapshot" <<'SNAP_148D'
+  cat > "$state_dir_148d/recovery_family_streak_snapshot" <<'SNAP_148D'
 version=1
 pid=1000
 start_ticks=1000
@@ -5513,7 +5518,7 @@ except:
     # $1 = state-dir; (re)write the PRE-restart snapshot fixture. The catalog
     # snapshot_file is the BARE name (#3222), so the evaluator resolves it
     # directly under --state-dir (no 'metrics/' subdir).
-    cat > "$1/counter_streak_snapshot" <<'SNAP_148E'
+    cat > "$1/recovery_family_streak_snapshot" <<'SNAP_148E'
 version=1
 pid=1000
 start_ticks=1000
@@ -5571,7 +5576,7 @@ TICK_PROM_148E
   # so parse_args() exits non-zero, out3 is empty, and rs3 != firing.
   seed_148e_snapshot "$state_dir_148e"
   local snap_before_148e
-  snap_before_148e=$(cat "$state_dir_148e/counter_streak_snapshot")
+  snap_before_148e=$(cat "$state_dir_148e/recovery_family_streak_snapshot")
   local out3_148e rs3_148e snap_after_148e
   out3_148e=$(MONITOR_MODE=validator UPTIME_SECONDS=900 WARMUP_TICKS_REMAINING=0 \
     PID=2000 START_TICKS=2000 \
@@ -5587,11 +5592,11 @@ TICK_PROM_148E
     tap_not_ok "eval-alarms: --no-snapshot-write run 3 (with flag) still fires recovery-stalled" \
       "expected firing with --no-snapshot-write, got $rs3_148e (unknown flag on origin/main?)"
   fi
-  snap_after_148e=$(cat "$state_dir_148e/counter_streak_snapshot")
+  snap_after_148e=$(cat "$state_dir_148e/recovery_family_streak_snapshot")
   if [[ "$snap_before_148e" == "$snap_after_148e" ]]; then
-    tap_ok "eval-alarms: --no-snapshot-write leaves counter_streak_snapshot byte-unchanged"
+    tap_ok "eval-alarms: --no-snapshot-write leaves recovery_family_streak_snapshot byte-unchanged"
   else
-    tap_not_ok "eval-alarms: --no-snapshot-write leaves counter_streak_snapshot byte-unchanged" \
+    tap_not_ok "eval-alarms: --no-snapshot-write leaves recovery_family_streak_snapshot byte-unchanged" \
       "snapshot mutated despite --no-snapshot-write"
   fi
   rm -f "$tick_prom_148e"
@@ -5716,7 +5721,7 @@ GAP_CUR
   # reset never triggers; gap-staleness is what re-baselines here.
   local state_dir_148h tick_prom_148h
   state_dir_148h=$(mktemp -d)
-  cat > "$state_dir_148h/counter_streak_snapshot" <<'SNAP_148H'
+  cat > "$state_dir_148h/recovery_family_streak_snapshot" <<'SNAP_148H'
 version=1
 pid=3366449
 start_ticks=5000
@@ -5737,8 +5742,8 @@ TICK_PROM_148H
     --state-dir "$state_dir_148h" 2>/dev/null) || true
   rs_state_148h=$(rs_state_of "$out_148h")
   local snap_cv_148h snap_streak_148h
-  snap_cv_148h=$(grep '^counter_value=' "$state_dir_148h/counter_streak_snapshot" | cut -d= -f2)
-  snap_streak_148h=$(grep '^breach_streak=' "$state_dir_148h/counter_streak_snapshot" | cut -d= -f2)
+  snap_cv_148h=$(grep '^counter_value=' "$state_dir_148h/recovery_family_streak_snapshot" | cut -d= -f2)
+  snap_streak_148h=$(grep '^breach_streak=' "$state_dir_148h/recovery_family_streak_snapshot" | cut -d= -f2)
   if [[ "$rs_state_148h" == "collecting_baseline" \
         && "$snap_cv_148h" == "703" && "$snap_streak_148h" == "0" ]]; then
     tap_ok "eval-alarms: recovery-stalled burst gap-stale re-baseline (703 ⇒ collecting_baseline, snapshot reseeded to 703 streak 0, not firing)"