docs: add current Alerts walkthrough and footer proof

pr-evidence/daily-issues/nov7-alerts/README.md

@@ -0,0 +1,23 @@
+# Alerts walkthrough
+
+[Watch the 173-second walkthrough](alerts-demo.mp4). Captions cover all five alert families, grouped investigations, Activity, monitoring settings, model migrations, and the notification menu. The original resource icon grid is restored and stays pinned while the menu scrolls.
+
+The browser uses real HTTP responses from two proxy workers and an isolated PostgreSQL copy. Historical traffic is synthetic. No inference calls were made during this recording. This demonstrates the product flow, not production throughput or memory safety.
+
+The frontend is `a5826182f6d59e6d3d28bb8bb9b72620d6c01368`. The backend is `f1cd795a923f0d203e9d02fb4bd08144af537109`. The before screenshot uses frontend `d44a94ee0068f90c087e79879c4a7972b38aef25` against the same backend and data. Later main-branch integration and backend fixes are covered by separate checks.
+
+## What is shown
+
+Open Alerts, then select the key spend alert. The established key spent $100 against a $2 daily baseline, a 50-fold increase. Its related request increase appears in the same investigation. Activity uses the saved key and date range.
+
+Return to Alerts and open provider latency. Two models share an independently confirmed provider-level increase. Open error rate and reduced traffic examples to inspect their saved comparisons. Open retirement, then Migration details, to reach the existing model-deprecation workflow.
+
+Settings shows four performance families with defaults. Editing Unexpected spend exposes its threshold. Email delivery settings opens the existing delivery configuration. No threshold is saved during the walkthrough.
+
+The notification menu contains Alerts and collapsed product updates. Docs, Releases, Blog, Slack, Discord, GitHub, and Deployment health remain visible below the scrollable content. The last four scenes open key, team, user, and model Activity directly.
+
+## Verification
+
+All five families and all four entity Activity views rendered. Each Activity request total matched its API response. The 50-fold spend example has a positive established baseline. No browser exception occurred. Desktop and 390-pixel layouts were checked in light and dark themes, without document overflow. The footer's vertical position remained unchanged while notification content scrolled.
+
+[Verification record](verification.json) contains source identities and observed totals. [Chapters](chapters.json) contains timestamps and captions. The recording is silent with captions.

pr-evidence/daily-issues/nov7-alerts/chapters.json

@@ -0,0 +1,98 @@
+[
+  {
+    "seconds": 0.25,
+    "caption": "Alerts combines model retirements and performance changes. This demo uses synthetic daily history; every screen reads live HTTP responses from a local LiteLLM proxy."
+  },
+  {
+    "seconds": 11.39,
+    "caption": "Open the key spend alert."
+  },
+  {
+    "seconds": 15.14,
+    "caption": "This key spent fifty times its established daily baseline. Related request changes appear in the same investigation."
+  },
+  {
+    "seconds": 23.24,
+    "caption": "Scroll to Activity."
+  },
+  {
+    "seconds": 27.02,
+    "caption": "The charts keep the alert's key and saved date range. You can inspect resources and source signals only when you need them."
+  },
+  {
+    "seconds": 37.35,
+    "caption": "Return to Alerts and open the provider latency alert."
+  },
+  {
+    "seconds": 42.54,
+    "caption": "The comparison and Activity share the measured provider scope. Grouping shows related observations; it does not claim a proven root cause."
+  },
+  {
+    "seconds": 52.38,
+    "caption": "Open the reliability alert."
+  },
+  {
+    "seconds": 56.15,
+    "caption": "Here the saved comparison explains the error change and its baseline, with the matching activity below."
+  },
+  {
+    "seconds": 63.82,
+    "caption": "Open the traffic alert."
+  },
+  {
+    "seconds": 67.57,
+    "caption": "The same investigation view explains a drop in requests against established history."
+  },
+  {
+    "seconds": 73.5,
+    "caption": "Open the model retirement alert."
+  },
+  {
+    "seconds": 77.35,
+    "caption": "The retirement date, replacement guidance, and recorded usage stay together. Open Migration details for the existing migration workflow."
+  },
+  {
+    "seconds": 86.57,
+    "caption": "The migration page preserves affected keys and replacement guidance."
+  },
+  {
+    "seconds": 91.18,
+    "caption": "Return to Alerts and open Settings."
+  },
+  {
+    "seconds": 95.24,
+    "caption": "Daily monitoring starts with defaults. Settings explains when checks are waiting for history or catching up. Email setup uses the existing Email Settings page."
+  },
+  {
+    "seconds": 106.45,
+    "caption": "Edit Unexpected spend."
+  },
+  {
+    "seconds": 110.36,
+    "caption": "Change the increase factor when you need a different threshold. Advanced controls stay collapsed, and custom rules can target a particular resource."
+  },
+  {
+    "seconds": 120.66,
+    "caption": "Open Notifications."
+  },
+  {
+    "seconds": 124.5,
+    "caption": "Alerts link to the same investigations. Updates are collapsed, and the compact resource links remain at the bottom while the content scrolls."
+  },
+  {
+    "seconds": 135.39,
+    "caption": "The same Activity charts also live on each resource. Open this key\u2019s Activity tab to continue investigating the exact key and dates."
+  },
+  {
+    "seconds": 144.66,
+    "caption": "Team details have Activity too. The chart shows the recorded traffic for this team without rebuilding a filter on the Usage page."
+  },
+  {
+    "seconds": 153.91,
+    "caption": "User details reuse the same Activity view and saved dates. The request totals match the live API response."
+  },
+  {
+    "seconds": 163.15,
+    "caption": "Model Activity uses the underlying model identity and the same dates. These screens reuse the existing charts; the history shown here is synthetic demo data."
+  }
+]

pr-evidence/daily-issues/nov7-alerts/verification.json

@@ -0,0 +1,48 @@
+{
+  "source": "a5826182f6d59e6d3d28bb8bb9b72620d6c01368",
+  "before_source": "d44a94ee0068f90c087e79879c4a7972b38aef25",
+  "before_scope": "PR3 frontend and same backend API/data; PR4 changes only frontend",
+  "history": "Synthetic daily history copied into an isolated database; actual live HTTP and UI, no mocked responses",
+  "checks": [
+    "All five alert families",
+    "Key50x positive baseline",
+    "Activity matches actual HTTP totals",
+    "Key/team/user/model Activity tabs match API totals",
+    "Existing retirement migration workflow",
+    "Monitoring defaults and optional edit",
+    "Existing email settings link",
+    "Collapsed updates and pinned footer",
+    "Desktop/dark/narrow without document overflow"
+  ],
+  "page_errors": [],
+  "notification_geometry": [
+    {
+      "footer_before_scroll_y": 582,
+      "footer_after_scroll_y": 582
+    }
+  ],
+  "expected_activity_totals": [
+    {
+      "family": "spend",
+      "requests": 57000
+    },
+    {
+      "family": "latency",
+      "requests": 16000
+    },
+    {
+      "family": "traffic",
+      "requests": 7100
+    },
+    {
+      "family": "reliability",
+      "requests": 8000
+    },
+    {
+      "family": "retirement",
+      "requests": 2101
+    }
+  ],
+  "duration_seconds": 173.24,
+  "inference_calls": 0
+}