Now I have the full picture. Starting with the module rename.Rename verified clean. Committing, then building the config layer.Now the config layer: `[keyproxy]`, `mpk:` refs, loop polling keys, status map, `[gitea]`, and quoted TOML keys.Now the apply() and Validate() additions:Now update the example config:Config layer green. Committing, then building Redmine writeback.Now the Redmine writeback client (note POST + status transition + updated_on refresh):Now the Gitea REPORT-commit writer:Now refactoring the conductor to share `runTask` with the daemon and use the key resolver:Now the loop state store and the daemon itself:Now the CLI wiring for `harness loop`:Now add the `runLoop` function after `runOnce`:Vet clean. Now the loop end-to-end tests against a fake Redmine:Dry-run must not create the state file. Fixing `openLoopState` to support a read-only mode:All green. Adding a focused writeback unit test, then committing the core:Now the docs. Updating README sections:Now the CLI reference table and Status table:Now updating REPORT.md with the new build-phase section:Adding a `loop` passthrough to dev.sh so the daemon runs through the Docker discipline too:Live CLI smoke through the builder:Improving `--once` failure semantics (a failed cron scan should exit non-zero):All green. Committing docs + dev.sh, then pushing:The smoke test leaked `state/loop/loop.jsonl` into the commit — fixing with amend and .gitignore:Now the PMO report:Done. Self-host core shipped to ukrrs/MOPAC main (`86c39c8`..`2901bb8`, working tree clean) and PMO report delivered.

**What landed**
- `harness loop` daemon (internal/loop/daemon.go): polls `/issues.json` every 120s (config/`-interval`, `--once` cron mode, `--dry-run` zero-trace), one sequential bounded turn per issue deduped by id + `updated_on` in append-only `state/loop/loop.jsonl`; failed turns recorded, never hot-looped; marker refreshed post-writeback so its own notes can't re-trigger it (test-asserted).
- Redmine note writeback implemented (internal/writeback/redmine.go): REPORT body → journal note + `[redmine.status_map]` transitions ("In Progress" → Done) via `/issue_statuses.json`.
- `mpk:` key refs through keyproxy `/v1/resolve` (internal/config/keys.go:113) with cache; `env:`/`file:`/`literal:` untouched — runs with or without keyproxy.
- Optional Gitea REPORT commit, off by default (internal/writeback/gitea.go); module renamed to `ukrrs.com/mopac/harness`.
- Fake-Redmine e2e suite (internal/loop/daemon_test.go) + keyproxy/writeback unit tests; `./dev.sh check` green in the digest-pinned builder. One leak (state file from my CLI smoke) was amended out and `state/` gitignored.

**PMO report**: `~/.coordinate/inbox-pmo/REPORT-20260828-2131-selfhost-core.md` — start command (`./dev.sh loop`), die list (semaphore.sh, queue scripts, already-dead `reachableceo-PMO` doorbell; nothing deleted), rollback (stop loop, bash stack intact).