container.<name>.down: should be up and isn't — not merely stopped; the default alert watches that

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/api/alerts.go

@@ -90,7 +90,7 @@ type alertEngine struct {
 
 var defaultRules = []AlertRule{
 	{ID: "machine-offline", Name: "Machine not answering", Sensor: "hamlab.reachable", Op: "==", Value: false, ForSec: 120, Severity: "crit", Enabled: true},
-	{ID: "container-down", Name: "Container not running", Sensor: "container.*.running", Op: "==", Value: false, ForSec: 120, Severity: "crit", Enabled: true},
+	{ID: "container-down", Name: "Container down", Sensor: "container.*.down", Op: "==", Value: true, ForSec: 120, Severity: "crit", Enabled: true},
 	{ID: "container-unhealthy", Name: "Container unhealthy", Sensor: "container.*.health", Op: "==", Value: "unhealthy", ForSec: 180, Severity: "warn", Enabled: true},
 	{ID: "service-failed", Name: "A service has failed", Sensor: "services.failed", Op: ">", Value: 0.0, ForSec: 300, Severity: "warn", Enabled: true},
 	{ID: "disk-full", Name: "Filesystem nearly full", Sensor: "fs.*.used_pct", Op: ">=", Value: 90.0, ForSec: 300, Severity: "warn", Enabled: true},
@@ -109,6 +109,11 @@ func newAlertEngine(s *Server) *alertEngine {
 	if !e.saved.Seeded {
 		e.saved.Rules, e.saved.Seeded = append([]AlertRule{}, defaultRules...), true
 	}
+	for i, r := range e.saved.Rules { // the first day's default watched "not running", which a container stopped on purpose also is
+		if r.ID == "container-down" && r.Sensor == "container.*.running" {
+			e.saved.Rules[i].Name, e.saved.Rules[i].Sensor, e.saved.Rules[i].Value = "Container down", "container.*.down", true
+		}
+	}
 	go e.run()
 	return e
 }