Cloudflare's hourly figures for the API, every scheduled job, third-party status and open alerts. A job alerts after three failures in a row, or when its last success is overdue.

Alerts (reports, stale backups, billing, vendor outages), a daily stats post and admin-security events go to the Slack ops channel. It's outbound only — act on alerts here in the console. Setup: docs/runbooks/ops-room.md. Every admin action is listed below.

Database dumped every 6 hours and photos mirrored nightly into the locked buymethis-backups bucket (objects undeletable for 30 days; dumps kept 90). Plus D1 Time Travel for point-in-time rollback. Admins are emailed if no dump succeeds for 12 hours. Restore runbook: docs/runbooks/restore-from-backup.md.

Reports from users about items shared into their groups (Online Safety Act reporting route). Take down removes the item from every group — it stays in the owner's private list. Illegal-content reports: acknowledge within 24h, decide within 72h [targets — solicitor to confirm]. Never view or forward suspected CSAM beyond the reporting pipeline.

This is a local-first app, so real usage = gift activity, not logins. Activated = added ≥1 gift; "came back" = last activity a day/week after joining. Admins excluded.

Powers link auto-fill & product photos. A low balance suspends the account and silently breaks both.

Scan → product identification (ISBN→Open Library, else UPCitemdb). A high miss-rate is the trigger to add a paid source. Admins are emailed when misses grow.

Claude usage and cost. Each suggestion call is logged with tokens, cost and outcome.

Plan mix and the Apple/Stripe breakdown from live billing data.

Creating or demoting an admin needs two-factor sign-in turned on and your current password, and posts to the ops channel. An admin can't appear or disappear silently.