Now I have full context. Setting up the work plan:Host confirmed as ultix-streaming itself. Quick check of loop dedup/status semantics so the runbook is accurate:Dedup is refresh-safe (evRefresh). Writing the deliverables now:Now the installer:Now the runbook:Now the Makefile and the test suite:All 13 packaging tests pass. Building the release binary and running the full Go suite:While that runs, the README deploy section:Full Go suite green. Live smoke of the actual release binary against a rendered config:All green. Committing:Pushed as b7799ea. Writing the PMO report:Done — commit `b7799ea` pushed to ukrrs/MOPAC main; report at `~/.coordinate/inbox-pmo/REPORT-20260829-0900-deploy.md`.

**Delivered**
- `deploy/accounts.tsv` — fleet authority: 9 accounts × (host, vertical, redmine project, quota group); ports `events=4100+idx` / `serve=8090+idx`, global index 0-8 so daemons never collide on a host
- `deploy/install-account.sh <account>` — idempotent, runs as the target user: builds `~/.mopac/{bin,state,reports,work}`, installs the static binary, renders `harness.toml` from `deploy/harness.toml.in`, writes 0600 `~/.mopac/env` (never overwrites config/secrets; re-run = upgrade), generates `mopac-start`/`mopac-stop` (nohup, no systemd)
- `deploy/runbook.md` — exact Charles sequence: build → stage → install (incl. `sudo -u` fan-out per host) → secrets bootstrap → verify → start → rollback, with the account-port table, cron `@reboot` option, and per-host time estimates (~10 min streaming / ~8 min offstage incl. secrets)
- `Makefile` — `release` (digest-pinned docker builder, CGO=0, static+stripped `bin/harness-linux-amd64`) plus `check`/`deploy-test`
- README deploy section + docs links

**Verified**: `./dev.sh check` all green; `make deploy-test` 13/13 (TSV scheme, all-9-account render, idempotence, refuse-to-overwrite, binary lookup); `make release` confirmed statically linked; end-to-end smoke installed COSWFO in a fake HOME and ran the release binary's `once --dry-run --demo` (exit 0).

**Flagged assumptions** (runbook §assumptions): the 9 `mopac-*` Redmine project identifiers must exist (or edit TSV/scope), quota grouping zai-max-1/2 per host is a guess pending key mapping, status_map ships empty by design.