# REPORT — Beta finish: 525 / 522 / 495 (2026-08-29 15:30 CST)

Repo: `~/projects/meta/MOPAC/harness` (main). All work in the digest-pinned
Docker builder via `./dev.sh`. `./dev.sh check` (build + vet + test ./...)
ran GREEN immediately before EVERY commit below. Branch pushed:
`19d61a0..f9fb729` on `origin/main`. Working tree clean at handoff.

Note: no Redmine tickets were written from this session (PMO owns tickets),
per instructions.

## Commit map

| Commit | Part | Subject |
|---|---|---|
| `e8f50d3` | env chore | deploy: add host docker group to the loop container (uncommitted WIP found in tree; prerequisite for the Docker builders) |
| `3927b38` | **525** | loop: retry Redmine writebacks with backoff, verify, and park on failure |
| `5784698` | **522** | notify: native SMS notifier for loop events via stdlib SMTP |
| `f9fb729` | **495** | brief: wire the 0630 pipeline - journal note, sections, daemon schedule |

Net: 24 files changed, +2732 / -112.

## 525 — retry/backoff on status/note writes

**Compile fix (first):** the loop turn's WIP did not build —
`retry.go:74` field/method collision (`Backoff`), `redmine.go:186-210`
`Attempts` used as a value, and the `[redmine] writeback_*` config fields
did not exist yet. All fixed (method renamed `BackoffFor`; config knobs
added to `RedmineConfig` + TOML parsing).

**Finished behavior**
- Bounded retries with exponential backoff + ±25% jitter on the note and
  status writes: `[redmine] writeback_retries = 3`, `writeback_backoff_secs
  = 2`, `writeback_max_backoff_secs = 30`. Retryable: 5xx, 429, transport
  (dial/reset/EOF). Never retried: 4xx, caller context cancel. Retried
  PUTs replay an identical body; every retry logs one audit line to the
  loop stdout.
- **Verification re-read** after the writes: one GET confirms the status
  transition actually landed and advances the dedup marker in the same
  round trip (`IssueState`; supersedes the old refresh-only read).
- **Park on final failure:** when the outage outlives the bound the task
  PARKS — issue status left exactly as-is (New stays New), one `park`
  event in loop.jsonl pins the dedup marker (no hot-loop), heartbeat
  `status.json` gains `last_writeback_error` + a `parked` counter
  (cleared by the next verified writeback), and the next PMO update of
  the issue re-releases the task. A paid-for REPORT is never silently
  stranded.

**Tests (all green, fake-server based)**
- `internal/writeback` — 14 tests total incl. new: 502-then-success
  (replayed body + audit line asserted), bounded give-up after exactly N
  attempts, 401 one-shot, verify re-read shape, RetryPolicyFrom
  defaults/overrides, BackoffFor jitter band, Retryable classification.
- `internal/loop` — 502-flap recovery at the daemon level, park path
  (no note, no status move, no hot-loop, PMO update re-dispatches),
  `last_writeback_error`/`parked` surfaced in status.json.

## 522 — native SMS notifier

**`internal/notify` (rewritten from the WIP sketch) + `[notify]` config**
- Stdlib-only send (`net/smtp` via `NewClient` + `DialTimeout`, deadline-
  bounded so a black-holed relay cannot stall the sequential loop;
  optional PLAIN AUTH from refs). Recipients = carrier email-to-SMS
  gateway addresses, resolved from one ref.
- Events wired in the daemon: turn complete, turn failed (incl. parked
  writebacks), quota/resource deferral, scan error, daemon start/stop.
- Per-kind rate limit with **collapsed repeats**: repeats inside the
  window are counted and ride along on the next send
  ("+N suppressed repeat(s)"); no phone spam during a flapping scan.
- **Offline queue on disk** (one JSON file per event, FIFO by name,
  bounded with oldest-dropped, corrupt-entry tolerant) drained after
  every scan and at daemon stop.
- **Redaction rules** applied BEFORE queueing (so secrets are never at
  rest either): credential-shaped assignments (`token=`, `password:`,
  bearer/api-key/secret/auth) and key refs (`env:`/`file:`/`literal:`/
  `mpk:`/`bw:` values).
- Disabled `[notify]` yields a nil notifier; all methods are no-ops, so
  call sites never gate. `once` never notifies (daemon-only surface).

**Tests** — 7 in `internal/notify` against a local fake SMTP server
(real SMTP dialogue: EHLO/AUTH/MAIL/RCPT/DATA/QUIT): send + headers +
recipients, rate-limit collapse + follow-up count, offline queue drain,
bounded queue oldest-drop, redaction (no secret bytes on the wire), nil
no-op, AUTH path. Plus a loop-level wiring test (turn_complete +
daemon_start fire and queue while SMTP is dead).

## 495 — 0630 briefing pipeline (surface existed at 064aed0; now wired)

- **Render** grows the 0630 sections: one-line **executive summary**
  (shipped/moved/incoming/open · review chain · decisions needed ·
  quota pulse), per-vertical **open-now backlog table** (window-
  independent, capped at 15 rows) alongside the existing shipped/moved/
  incoming window tables, **decisions-needed** (open issues in Feedback/
  Needs-Decision statuses), **review-chain line** (open PR count + oldest
  age), **quota line from quota state** (unchanged section + exec pulse),
  and **system health** (loop heartbeat status.json: running/scans/
  dispatched/reports/parked/last_scan_error + host load/mem/disk).
- **Delivery:** journal note on `[brief] redmine_issue` (the SoR copy,
  e.g. 495 — benefits from 525's retry on the note write) + Discourse
  topic when creds are present; missing creds = graceful logged skip
  (never a failed briefing when the SoR note landed). Legacy
  discourse-with-fallback path preserved when no redmine_issue is set.
  Marker records `redmine` / `discourse` / `redmine+discourse`.
- **Daemon schedule hook:** the loop fires the brief daily at
  `[brief] schedule` (default **06:00 America/Chicago** — 06:00 render
  for the 0630 read; configurable HH:MM + timezone; "" = off; catch-up
  on late start). Injected via `loop.DailyHook` from the CLI to avoid an
  import cycle (brief already reads loop state). Idempotent per calendar
  day via the existing brief.jsonl marker; `harness brief` unchanged as
  the one-shot/cron surface.

**Tests** — 16 in `internal/brief` (9 new): render section coverage
(exec line / open-now / decisions / review chain / quota / health),
classify open-backlog + decisions, health-file reading, Redmine-primary
delivery (note content + graceful discourse skip), redmine+discourse
both-land marker, redmine-fails-discourse-saves, full render against the
fake Redmine; plus loop-side daily-hook tests (timezone math table +
fires-exactly-once-per-day under a live daemon loop).

## Smoke evidence

- `./dev.sh check` green before each commit (build + go vet + go test
  ./... — 12 packages ok, no failures; final run at commit `f9fb729`).
- Live read-only smoke of the 495 render (dry-run, **no writes to
  Redmine**, no marker): authenticated GET of the real scope at
  projects.knownelement.com (fixed_version_id=35, status New — genuinely
  empty; the live loop heartbeat's "29 scans / 0 dispatched" corroborates),
  live system-health section reading this host's running daemon
  status.json. Transcript: `SMOKE-20260829-brief-dryrun.txt` beside this
  report.
- 525/522 behaviors are exercised in-test against fake Redmine/SMTP
  servers (see test lists above); no live 502-injection or SMS send was
  performed against production systems.

## Deferred / open

- **Live Discourse send** (495): vendored client is wired and fake-tested,
  but no live topic has been created — awaiting the 1900 CST creds
  session Charles offered (discourse key ref + category). Config slot is
  ready (`[brief] discourse_url` / `discourse_key_ref` / `category_slug`).
- **Live SMS send** (522): fake-SMTP-tested; a real relay + carrier
  gateway addresses are needed to enable `[notify]` in production.
- **Quota pulse depth** (495): quota line currently reads "gate off"
  until `[quota]` is enabled per instance (existing 490 surface, opt-in).
- gofmt drift exists across the repo (pre-existing, incl. at 19d61a0);
  the check gate is build+vet+test, unchanged.

## Handoff

- `git status` clean; `origin/main` at `f9fb729`.
- New config surfaces documented in `harness.toml.example` ([redmine]
  writeback knobs, [notify], [brief]) and README tables/usage.