Get Pending System Broadcasts

Live announcements this user has not acknowledged. Any authenticated user.

{"items": [{id, severity, message, body_html, min_seconds, show_on_login, sent_at}]}, oldest first.

This is the announcement's ONLY delivery path since the top banner was removed, and every open tab polls it every 30 seconds — so it is kept to one indexed, row-capped query (see app/db/system_broadcasts.py) and it answers from the archive, not from the cache.

show_on_login is DATA, not a filter. It says when the client opens the window: false = now, true = wait for a session that started after sent_at. The server has no idea what a login is and does not track sessions; it reports the flag and the timestamp and lets the client decide. Filtering on it here would mean an announcement meant to be read now was never delivered at all.

NEVER an error, by contract — {"items": []} covers every degraded state (storage not migrated, no resolvable user, a failed query). A 500 on a 30-second poll in every tab of every tenant is a worse outcome than a message arriving late.

Like /history, this serializes a FILTERED view: id is the archive row's INT identity (the handle /{id}/ack takes), never the internal broadcast uid, and the operator's identity is not serialized at all.