Harden production workflows and agent admission

web/src/app/api/poll/incidents/route.ts

@@ -1,18 +1,35 @@
 import { NextResponse } from "next/server";
 
-import { loadIncidents } from "@/lib/loaders";
+import { loadIncidentsPage } from "@/lib/loaders";
 import { jsonError } from "@/lib/poll-response";
 
 export const dynamic = "force-dynamic";
 
+const SORTS = new Set(["status", "opened_at", "resolved_at"]);
+const DIRS = new Set(["asc", "desc"]);
+
+// PH-001: poll a single page, not the entire incident history. Sort and
+// direction are forwarded so the server orders consistently across pages.
 export async function GET(request: Request) {
   const url = new URL(request.url);
   const stateParam = url.searchParams.get("state");
   const state = stateParam === "open" || stateParam === "resolved" ? stateParam : undefined;
+  const cursor = url.searchParams.get("cursor") ?? undefined;
+  const back = url.searchParams.get("back") === "1";
+  const limitRaw = url.searchParams.get("limit");
+  const parsed = limitRaw ? Number(limitRaw) : undefined;
+  const limit = parsed && Number.isFinite(parsed) ? Math.min(Math.max(parsed, 1), 500) : 100;
+  const sortRaw = url.searchParams.get("sort") ?? undefined;
+  const sort =
+    sortRaw && SORTS.has(sortRaw)
+      ? (sortRaw as "status" | "opened_at" | "resolved_at")
+      : undefined;
+  const dirRaw = url.searchParams.get("direction") ?? undefined;
+  const direction = dirRaw && DIRS.has(dirRaw) ? (dirRaw as "asc" | "desc") : undefined;
 
   try {
-    const items = await loadIncidents(state);
-    return NextResponse.json({ items });
+    const page = await loadIncidentsPage({ state, cursor, back, limit, sort, direction });
+    return NextResponse.json(page);
   } catch (e) {
     return jsonError(e);
   }