Mira roadmap

October29 current checkpoint: Main cffb46b; successful rollback baseline a9c9508/a6ef6b22, one active and auto-deploy off on the fresh read. #90 metadata provenance does not enforce hardware applicability; do not deploy it as the failed smoke’s repair. Three open drafts: #92 bounded current-contact actor, #93 production metadata trace (1,266 full/8 offline, independent review, exact-head CI40918151890 PASS), #94 evidence policy/adversarial checks (1,266 full/8 policy groups and independent scoped review pass, but refund-approval and hardware-applicability probes remain genuinely red). #94 policy is not installed or required on main yet; branch protection/rule reads show no effective requirements. The master plan records installation/accuracy limits. No paid run, merge, deployment, optional enablement or new Discord test; third smoke held. Scores64/56 unchanged. Older checkpoints below are history where superseded.

Current October28: #91 merged a461f86, then its rollout failed source applicability despite passing context preservation/private delivery. Rollback baseline a9c9508/a6ef6b22 is verified healthy. #90 merged cffb46b after1,258 tests,8 no-model checks, independent integration/final review and exact-head/merged-main Node20/24/PostgreSQL CI; it is not deployed. The earlier PR queue is closed; one new current-contact draft is being prepared under #83. #83 now has three red synthetic reviewer diagnostics plus a passing ordinary-answer control, and an actual-handler unresolved-FAQ failure plus useful-detail control. These are offline injected diagnostics, not an implemented applicability repair or live-model accuracy. The October29 draft preserves a bounded current contact next actor through the existing redirect owner and shared escalation policy; no new model field, prompt or store. Its final review/CI and applicable quality gate remain. Trustworthy source applicability and arbitrary contradiction resolution are still open; this draft does not repair the failed hardware smoke. Further releases and the third smoke remain held; no paid run or memory enablement. Scores64/100 implementation and56/100 delivery unchanged.

Earlier October26 checkpoint: #86 merged647b549 after1202/no-model8, exact-head hosted Node20/24/real PostgreSQL, independent review and merged-main CI. Lifecycle details. The old PR backlog is cleared; new work is Mira repository presentation and local #83 source provenance/conflict handling. #62 stays open for reproduced narration/context loss despite merged diagnostics. Production stays c6f482d; no paid run, public Omi test issue or memory enablement. Main implementation64/100; delivery56/100;44 left. Technical identifiers remain unchanged under the Mira product name.

Earlier audited dashboard — October 26, 2026

#88 merged884fb46, #87 merged928676b and #86 merged647b549 after their gates; none was deployed separately. Memory-notice wording approval is not publication/enablement. #86's approved30-day retention/replay/erasure implementation is awaiting release. No repeat policy question or paid run. Delivery score56/100 is unchanged; production remains c6f482d, optional controls/automatic deploy off at the fresh read.

The master plan is authoritative: audited main647b549,16/25 implemented/tested/reviewed milestone foundations (64/100 main implementation coverage), eight verified operations, 56/100 delivery completion and44 left, not accuracy. Full A–E acceptance remains2/21. The dated issue audit closed speculative summaries #52 not planned. Eleven issues remain unresolved; #62 still reproduces narration/context loss. No assignments or production settings changed.

Next work: #83's source provenance/conflict handling, then #65 multipart accuracy, using merged stage evidence; remaining C/D/E and #51/#53/#56 dependencies remain. Do not recreate closed PRs or treat unfinished scope as complete. Every older checkpoint below is historical and superseded where it conflicts with this dashboard.

Current October25 — Step2 merged, deterministic privacy repair next

#84 implements its one authorized deterministic output rework: shared request/echo filtering, application-owned localized private path gated by actual availability/delivery, question-aware handoff naming and final source/next-step/safety-warning length reservation. Initial32 output regressions were observed red; additional independent findings are repaired with output tests, not prompt self-certification. Full1165/offline8/isolated SQL and independent final scoped review pass. Exact final-head hosted CI/identity remain before readiness; keep draft and production unchanged. No paid run.

#28 merged0986b75 after1086/offline8/SQL, exact-head Node20/24/real PostgreSQL CI and independent final review. One open draft remains, #84. Production stays Aryan's7b41e119/38337e7; no agent deploy/settings change. Rework #84 once outside the model, then gated combined release/Aryan's smokes and memory preparation only. Earlier snapshots below are historical, not renewed holds or active instructions.

Earlier October25 — final multipart decision and private intake

#80/#81 are deployed as exact GitHub d550dc1/1bce9049, both limited smokes accepted and optional features off. #82 and #71 are closed unmerged with branches/tests/results kept; #65 stays open. The final standalone #71 attempt saved324 outputs, all independently read plus4 earlier-turn replies, but systematic second-run unavailability/no recorded usage and stopped final validation prevent accuracy approval. Source/hash/input/full-window power checks pass; they do not rescue failed generation or prove patch causation. No further #71 rework/rerun or automatic deploy. #83 tracks source-date conflicts as issue-only work. Private-intake draft #84 passes five red-before/979 full/offline8 checks, independent117 and hosted CI at4ca5e53, without provider calls. Instructions are not proof of generated-answer compliance; that separate gate remains. Current four drafts28/59/75/84; #28's October27 decision and other comparison/memory gates remain. Execution-validity diagnostics stay in #56/E2. Score47/100 unchanged; dated checkpoints below are history.

October25 — final comparison decided; staff-approval repairs next

Later operator update: Aryan confirms deploying main38337e7 as7b41e119 at17:09IST. Fresh checks show one healthy running instance, optional controls off and auto-deploy off. This supersedes the earlier production snapshot below; no agent deployment and no new live-acceptance point.

Local #28 repairs now pass1086 tests and disposable SQL: canonical repository/case/target unpublished proposal deduplication, creator-only card attempt and GitHub App/encryption readiness. Original encrypted evidence/revision and unknown-publication fences remain. Token-only approval controls stay off without breaking private handoff. Hosted multi-connection PostgreSQL and independent final review remain. #85 tracks operational metadata retention/erasure separately; no code or deletion is authorized by that issue.

Step1 history: #59 merged as 38337e7 after one simultaneous three-arm 81×2 comparison and independent reading of all492 replies. Main70/pass-both,p9549.051s; #59 74/50.840s with no new material finding; #75 72/51.122s but four candidate-only material findings, so it closed unmerged with branch/evidence and unfinished intent-correction scope retained. No rework or further paid run. At that cutoff production wasa0b0e0fd/d550dc1; the later operator deployment above supersedes it. #28 has since integrated main and repaired the two boundaries locally; current CI/final review remain. The older checkpoints below are historical, not renewed approvals.

October24 — existing staff-publication draft updated, not approved

#28 integrates deployed main d550dc1 without rebasing. Full1063/offline8 and isolated SQL pass, including current heartbeat/delivery fences, references-only privacy cleanup, thread-language expiry and this draft's encrypted publication/uncertain-write checks. PGlite serializes connections; hosted multi-connection PostgreSQL and independent privacy/authorization review remain required, as does affected-flow integration. No deployment, real publication, new private data flow, permission change or optional enablement. Decision remains dueOctober27; do not merge merely to meet it. A+B release smokes, C/#82 and #71 accuracy work remain separate.

October24 — existing persona draft updated, not released

#59 integrates deployed main d550dc1 without rebasing. Its narrow change remains the shared calm, warm and practical character; current main owns source policy, language, redirect cleanup, delivery and recovery. The master product plan remains canonical, with no duplicated milestone rows or readiness claim. Independent review, exact-head checks and its own representative serious-problem/language/identity/generated-answer comparison remain required. C/#82 and #71 accuracy work are separate; no paid comparison, merge, deploy or optional enablement occurs here.

Current October23 — smoke passed, approved merges resume

All three reliability checks pass: sourced English answer without handoff; one private refund card; same-commit Redeploy with clean drain, one post-SIGTERM reply and old instance observed removed after69.197s, stable30s. Live6a815fbf records unchanged6b6d97d; rollback458d4a6f, optional features off. #67 merged94e4f57 after the auto-deploy-off guard. #74 integration7860417 preserves reviewed privacy/#67 code;952/offline8/SQL and independent298-check review pass. Final hosted CI precedes its approved merge; no new-code deploy or memory enablement. #71's guard/shared-page repair and fair concurrent-arm comparison remain. The named timing test is reproduced by withholding loopback progress; its separate test-only fix stays queued. Score47/100.

Earlier October23 reviewer decision — historical smoke hold

#67's protected-handoff grade passes; the reviewer accepts the measured 0.200s p50 exception. Its required same-PR fix strips support-address redirects independent of language, preserving sources, secret warnings and the app-owned failed-delivery fallback, with new fr/de/ja/pt tests. #74 may be pushed now for CI only; its integration review already passed77 focused checks. No merge/deploy while release smokes await Aryan. After acceptance, #67/#74 are first next merges. #77 stays draft until #67 lands, then loses overlapping redirect work; #78 waits for drain-smoke review. #71's saved results show retrieval/review tail growth, not answer-prompt growth; no provider rerun or proven latency fix. Score47/100.

Earlier October23 state — deployed reliability, smoke deferred

#76/#70 are merged; main6b6d97d is live as61e8ce70 with recorded GitHub commit, one healthy instance and optional features off.907 tests/offline8/SQL, independent re-review and candidate/final-main Node20/24/PostgreSQL pass. The production-configured audience check is private_staff_destination. Actual rollout SIGTERM/drain20:23:12IST is clean; the separately required English/refund/controlled Redeploy smokes remain pending because Aryan will send inputs later. No #66/PR closure, later merge or memory enablement yet. While waiting, #74 is locally integrated with this main;916/offline8/combinedSQL pass, with only document conflicts resolved. It is not pushed or marked ready; integration review/current-head CI remain. Read-only #71 timing analysis finds answer prompts smaller, so blindly cutting evidence is not a supported latency fix. All original comparison results remain unchanged. Score47/100, not accuracy.

Latest October23 — finish existing drafts, no release mutation

#67's protected-handoff grade passes; the measured0.200s p50 exception is accepted. Released main6b6d97d is integrated by merge commitdc79d80. Required language-independent address cleanup and shared localized Source handling pass943/offline8/SQL; all25 new regressions fail before the repair, and final independent review passes185 focused checks. Current-head CI is recorded in the PR. #74 is pushed for CI only; Node20/24/PostgreSQL run39978407664 passes. #71's saved arms show retrieval/review tail growth, not answer-prompt growth; no provider run. Release61e8ce70's smokes remain deferred by Aryan; no merge/deploy. #67/#74 are first next merges after smoke acceptance and their gates. Later #77 loses overlapping redirects; #78 stays untouched until drain review. Score47/100, not accuracy.

Historical preparation

Separate draft preparation: fix/no-email-redirect adds application-owned in-thread next steps for ordinary answers and a tested real handoff when those steps still fail. No prompt, memory enablement or deployment. See the scoped design and checks. #62 is only partially related and remains open; current release-smoke failures #65/#66 block further rollout. Current authoritative operational status belongs in the master-plan update, not older snapshots below.

October 23 reviewer-approved finish order

#76 merged as d06e41c after 884 tests, six local loopback checks and current CI. Its per-request deadline fixes the trickling-body mechanism; the unfinished overall answer budget/remainder-bounded retries move from closed #72 to #56/A4/B3/E2. #70's reviewer-required pre-work outage-note correction is now implemented with observed red-before tests: total claim outage gives one honest note without database authorization; lost claim acknowledgment gives one note and preserves later fenced recovery. Actual answers, post-start/uncertain errors and known lost ownership remain fenced. Full tests/SQL/current CI and independent re-review control its next merge. Nothing new deployed yet; rollback baseline458d4a6f/ec51f7a. Then authorized exact-GitHub rollout, Aryan-submitted ordinary/refund smokes and same-commit Redeploy drain test. Subsequent closures/integrations/comparisons follow the master queue; no new PRs. #70 does not implement #51's receipts, same-nonce retries, staff-visible held alerts or #30's full closure recovery. New standing cap is three open PRs and a reviewed merge-or-close decision within48h, with #28's explicit October27 exception. Progress47/100, not an accuracy claim.

October 23 — authorized merges and existing-PR repairs

#69 (577c0c0), #73 (c61920d) and #49 (ec51f7a) are merged with reviewed exact-head checks: 13→10 open PRs. Aryan confirms his later 18:58 IST deploy, 458d4a6f / ec51f7a; health 200/ok, one active, zero automatic GitHub triggers. No agent deploy/settings/enablement occurred. #68's code 477d361 passes review, 896 tests and hosted Node 20/24/PostgreSQL; targeted generated-answer evidence remains for its fallback-only prompt. #70 reproduces original and follow-up review escapes before repair; 896 tests/offline8/expanded isolated SQL now pass. Final hosted checks and re-review precede readiness. No new PRs, paid runs or Discord inputs. Score remains 47/100.

October 23: safe merges resumed, no deployment

Authenticated Railway reads verify zero matching automatic GitHub triggers and unchanged healthy production bc2166f9 / 5bafe93; no setting change was needed. #69 merged as 577c0c0; #73 as c61920d after docs-only integration, fresh 839 tests/eight SQL groups, exact-head Node 20/24/PostgreSQL and independent review. #49 combines that reviewed test rehearsal with its unchanged disabled runtime; fresh 878/offline8/SQL pass, final integration review/CI precede merge. Then repair #68 and #70; no new PRs. Score stays 47/100: merges alone do not earn delivery points. Historical checkpoints below are retained, not current instructions.

October 23: finish existing work before adding drafts

The master plan lists all 13 existing PRs and their concrete merge/repair/close decisions. #69/#73 passed review and affected checks; #49/#74 passed review for disabled foundations, not feature enablement. #68 and #70 have specific reproduced review findings to repair; #67/#71 retain their failed speed gates. Verify the actual merge-versus-deploy boundary before merging. No count-driven closure or new feature PR. Score is 47/100 solely because milestone 18 gained independent foundation review; full acceptance stays 2/21.

Public-data request is recorded in Mira's data plan: eight owner/license screens, a blocked-by-default metadata register and 12 original multilingual support scenarios are prepared. No downloaded corpus rows, training job, runtime/prompt change, new feature PR or progress point. Later execution maps to A1/A2/E2 and #59, after the finish queue; rights, provider/cost, actual answer-quality comparison and review remain open. Discord memory is never silently repurposed into training.

October 23: answer audit becomes an integrated repair checklist

All nine audit themes remain mapped to A1/A2/A4/B2/E2 acceptance in docs/ANSWER_QUALITY_CONTRACT.md. Original scoring/evidence stays private, not a current accuracy rate. Draft #75 keeps its actual multi-turn/quality/adapter-parity/comparison/review gates; ownership copy and diagnostic continuity remain required without opening more drafts ahead of the finish queue. No runtime deployment, customer message or optional enablement follows. The current milestone ledger is in the master plan; older dated scores below are historical.

October 21: forgetting reaches reviewed-correction links in a draft

Separate draft #74 dfc1398 is stacked on #49, preserving its review head. It adds owner-derived case server/forum metadata and connects durable forum forgetting to verified correction-link erasure without deleting independent facts or other known scopes. Opt-out persists before cleanup, fences late/new-case writes and drives mandatory retry; manual/automatic legacy scope is never guessed and unknown orphan markers cannot produce a success claim. Local 887/offline8/PGlite and exact-head hosted PostgreSQL/Node 20/24 CI 39554963703 pass; nine new focused tests include eight baseline failures, with additional SQL strict-scope regressions observed red/green. Independent parent/child review remains pending. Existing comparison holds, actual ingestion/validator/UI/jobs, privacy/security/data-use/backup and enabled pilot remain open. No comparison rerun, main merge, deploy or optional enablement; score stays 46/100, acceptance 2/21.

October 21: learning foundation integrated, mandatory expiry tested

Existing draft #49 now merges deployed main 5bafe93 as 141e718, preserving the reference-memory, closing-language and off-only prompt paths. Head 3f83024 adds tracked, bounded automatic expiry of internal case references and stale erasure barriers with active-barrier protection and concurrent-revocation safety. Local 878/offline8/PGlite and exact-head hosted Node 20/24/real PostgreSQL 39549961373 pass. Nine new focused tests include eight observed red assertions; server deadlines are transaction-local, not client cancellation. Independent review and full D1–D6 work remain: real source/regression validation, owner-scoped minimized signals/drafts, review controls, privacy adapter and nightly/weekly jobs. Nothing is published, merged to main, deployed or enabled; no paid/protected run. Score remains 46/100, full acceptance 2/21, with all existing comparison and memory gates unchanged.

October 21: automatic memory SQL/reader rehearsal, still off

Draft #73 c2953f2 is test-only and based on main. It joins the real reference store/service and live-context reader using synthetic posts, closing a combined-read verification gap without changing bot runtime, prompts, schema or settings. Eight groups pass locally and in the exact-head PostgreSQL CI job, alongside 839 unit tests/offline8/hosted Node 20/24. Five independent in-memory faults are caught. Review and C1–C4 data-use/live-pilot requirements remain; memory stays off. No paid calls, protected input or Discord messages. #67/#71 timing holds, #68 quality review, #70 review and later persona/learning/reliability work are unchanged. Score stays 46/100, full acceptance 2/21.

October 21 now: both checks complete; no new rollout

Aryan confirmed open/plugged-in time for both checks. Fresh local #67 f2781eb passes 850 tests and #68 1ffae62 passes 845; both offline8/isolated SQL and exact-head hosted Node 20/24/Postgres pass. One keep-awake supervisor completes both separate fresh 81×2-per-arm pairs at concurrency3, zero invalid/unscored rows, no interruption/retry, unchanged harness/judge/lockfile and same UTC/IST day. Full power histories show no system sleep. Each twelve-file review ZIP preserves both JSONs, all changed verbatim replies/signals/problems, words and audits; known-secret/hash/archive checks pass. No production/Discord/settings/memory changes and no new score points.

#67 finishes at 08:50:34 IST: p50 30.255→32.455 s fails +2 s; p95 47.351→52.850 s meets +6 s. Pass-both 73→72, unwanted/missing flags 8/4→9/6. Held, not automatically rerun. #68 finishes 09:56:33 IST: p50 34.503→32.450 s, p95 57.020→54.446 s meets no-rise; pass-both 71→71, unwanted/missing 10/5→10/6. Numerical pass only, not independent quality/safety approval. Four planner deadline fallbacks and two other planning failures remain in the evidence; single-turn planning max 20.007 s, larger multi-turn totals are not single requests. Both drafts need protected-handoff/factual/clipping review; no merge/deploy. Current production is read-only reverified accepted/healthy, optional controls off. The Mac no longer needs to stay awake.

A credential-free loopback experiment confirms a shared inactivity-timeout gap for trickling response bodies; cancellation and the existing planner guard bound that fixture. It does not prove why historical #71 was slower. Broader answer/review/retry budgeting is parked as #72 (A4/B3/E2), not implemented or mixed into these frozen comparisons. Production remains accepted 13ead500 / GitHub 5bafe93, optional controls off; #71's failed gate and all memory/learning/reliability work remain open. Score stays 46/100, full acceptance 2/21.

A separate draft (fix/provider-full-operation-deadline) closes only the reproduced mechanism from #72: each planner, answer and review provider request now carries a full-operation abort signal alongside the inactivity timeout, so a trickling body stops at the configured budget and surfaces as the existing timeout error. Six new loopback tests include four observed red assertions (the 250 ms budget previously ran about 3.9 s); the full local suite passes. The shared cross-stage budget, remainder-bounded retries and fallback wording remain parked under #72. Code implemented and tests passed locally; not independently reviewed, merged, compared or deployed.

October 21: multipart comparison complete; failed speed gate, no rollout

Main 5bafe93 and draft #71 baec24d each complete all 162 rows on October 20 UTC/IST, concurrency three, with zero invalid/unscored rows, no signal/stop and normal structural-failure child exits. Source/lockfile/input-metadata guards and known-secret scan pass. Complete power history records no system sleep/wake/DarkWake; max clock drift 45 ms. Pass-both/flaky/fail-both: 71/5/5→72/3/6; unwanted/missing flags: 10/5→10/5. p50 27.114→27.731 s meets its bound; p95 42.508→61.332 s fails +6 s. Delivered-reply median/p90 words 74/106→75/103; empty turns and all slow rows stay included.

Candidate logs contain one planner timeout, nine docs-fetch timeouts, fourteen fetch-failed lines and one review EPIPE; main has two docs timeouts. Existing metadata cannot establish a patch-versus-remote/local cause. Preserve the immutable heads and all rows, diagnose before any rerun, and obtain independent per-case grading. The eleven-file private review ZIP includes both result JSONs, five changed cases' exact replies/signals/problems, summary, word counts and audits; no protected case file or raw logs. No new code, merge, deploy, setting or private-data enablement. October 21 production recheck still verifies accepted 13ead500 / 5bafe93, one healthy instance and optional switches off. Master score remains 46/100, full acceptance 2/21. #70 review, #67/#68 independent gates, memory/pilot and all later product work remain open; older running checkpoints below are history.

October 20: synthetic gate catches an overlapping-evidence gap

23:10:40 IST: main completes 162/162 rows with zero invalid results, no process signal/stop and at most 9 ms clock drift; normal exit 1 reflects structural test failures. The frozen candidate starts next on the existing run. Five timing cases meet <90 s; one of them has a retained permission-concept structural failure, not a provider error. Candidate/full review remain pending; no restart, merge, deploy or optional capability change.

Release retry remains accepted live on 13ead500 / GitHub 5bafe93, optional capabilities off. Initial #71 diagnostics complete all six provider rows without invalid results, but main answers all parts in 0/3 and draft 21b21b1 in 2/3. Actual provider prompts show missing evidence before generation, not a restart fault. Shared primary page matches left spare slots open to unrelated background. Revised draft baec24d allocates those slots to each part's next distinct relevant page first; two general non-phone regressions fail before and pass after, full 850/offline8/isolated SQL and hosted Node 20/24/Postgres pass. The complete fresh six-run check now yields main 0/3 versus candidate 3/3, same official corpus fingerprint and zero invalid rows. Five serial timing cases finish below 90 s; full frozen main/candidate comparison starts at 22:46 IST, 81×2 each/concurrency three with AC/lid/keep-awake and IST/UTC date guards. All initial results are retained; the standard comparison remains running and ungraded. No later draft merge, deployment or enabled memory; score remains 46/100, full acceptance 2/21.

This is the living implementation record. A checked implementation item means code exists and its regression checks passed; it does not mean production was deployed. Record release verification separately. Preserve the current official-source answer/review pipeline and improve the whole customer workflow, not isolated examples.

Historical — October 19 combined release, accepted retry October 20

October 20 retry complete, 22:20 IST: all required rechecks pass: Spanish ordinary closure, private refund and the corrected same-commit deployment teardown. Live 13ead500 records GitHub 5bafe93 and matches the approved retry image; one running instance and healthy readiness, all optional controls off. Redeploy dispatch +11.737 s; old SIGTERM 22:18:32.077, reply 22:18:32.131, successful drain 22:18:32.335, replacement login 22:18:20.972; old instance observed removed 22:19:38.246 (66.169 s), stable one-reply proof by 22:20:12.231. No rollback/settings/permissions change. Earlier ordinary/low-risk smokes carry from identical runtime. First pre-dispatch punctuation rejection caused no rollout and is retained separately, with two red/seven green scope checks and 26 observer checks after the private helper repair. No further Discord posts needed. Score is 46/100 (+1 for reviewed #48 now verified live), full A–E 2/21; later draft/generated-answer/memory gates remain. Next is the approved synthetic and full #71 comparison against this deployed main, then separate #67/#68 comparisons.

October 20 draft publication: #71, 21b21b1, generalizes existing complementary evidence to every 2+ part request without raising short-request search caps or the eight-chunk/9,000-character/four-page budget. All nine new tests pass (eight observed red on frozen main), full 848/offline8/isolated SQL and hosted Node 20/24/Postgres run 39389362750 pass; generated-answer checks/review remain pending. The shared adapter preserves the pre-feature baseline path and changes no judge. No phone-specific production wording or expected URL. Six own synthetic provider checks and standard comparison wait until Step A passes; protected inputs remain sealed. #70 stays review-pending and undeployed. Aryan sends every Discord message/command; no redeploy test is armed/dispatched.

Current October 20 retry, after 22:02/22:07 IST: Spanish ordinary closure and private refund pass from screenshots/scoped REST. Spanish: one sourced answer, no handoff, fully localized closed/locked post. Refund: one reply and private card awaiting acceptance, positive delivery confirmed, no approval/timing promise. 6e0fa65d still records 5bafe93, healthy with optional controls off; rollback adcfb8b4. The final same-commit redeploy observer passes 19 offline checks and armed at 22:09:53 IST; its exact slow input was requested afterward. No pass or dispatch inferred from arming. No Restart/settings change or Codex Discord writes. Draft quality/review gates follow Step A; score stays 45/100, acceptance 2/21.

Latest diagnosis supersedes the blanket #65 hold: authorized own-synthetic 3×2 live checks fail phone-only startup on both 7fe0e0a and 5bafe93, with every planner retaining all three parts. Same harness/live-corpus fingerprint, zero invalid rows; no protected inputs. Three new independent stored-retrieval variants fail on both versions before repair. #65 is pre-existing and gets a separate fix-forward PR, not a reason alone to hold the already-reviewed combination. The test file is local/uncommitted on fix/phone-only-multipart; no green repair is claimed. Both restart snapshots/current service have 100-second draining, no environment override; logins follow SIGTERM by about 20 seconds, but exit reason/manual-Restart grace is not exposed or documented. No setting change recommended without platform clarification. Report Steps 1–2 before starting the separately authorized ~45-second dead-owner pickup draft, preserving delivery fences/SQL checks. #67/#68 stay drafts with future baseline 5bafe93; no comparison run started. No deployment/restart/settings/Discord writes; memory/pilot off. Detailed private evidence is in /Users/astar/omi-eval/phone-only-20261019/. Score remains 45/100, full acceptance 2/21.

Final outcome: rolled back. Four smokes passed; the restart produced one recovered reply but missed the phone-only requirement and lacked clean-drain proof. #65/#66 preserve the two findings. Requested rollback e1f76a93 now runs as adcfb8b4, verified SUCCESS/one instance/schema/login/health and matching image digest. Its historic upload lacks commit metadata; do not claim a GitHub-recorded SHA for it. Main remains 5bafe93; no further rollout or memory enablement. Parked labels #52–#58 are done. Separate draft #67 passes local850/offline8/SQL; #68 local845/offline8/SQL; both exact heads pass hosted Node 20/24/Postgres. Separate comparison/review remain required. See the master plan's current table; the deployment-success checkpoint immediately below is earlier evidence, not final acceptance.

#60 → #48 → #61 are merged with merge commits. Final main 5bafe93 passes 839/839, offline 8/8, isolated SQL and hosted Node 20/24/Postgres run 39217854468. The reviewed prompt-parity safeguard is unchanged. Exact GitHub-commit deployment 89d45a3a is SUCCESS, records the same commit and has one running instance. Its schema initialization, Discord login and health are verified; five Aryan-submitted live smokes remain pending. Original rollback e1f76a93 is verified eligible; all optional memory/context/fix-inbox controls stay off.

Aryan asked to finish other work before supplying test inputs. Prepare parked labels #52–#58 and separate no-email-redirect/planner-deadline drafts without pretending the live checks passed or deploying another change. Each behavior change needs red-before tests, its own comparison and review. Memory pilot remains test-only and gated; #59/#28/#29/#30/#49 remain preserved. Product score 45/100, full acceptance 2/21. The master plan's current-status table controls; older checkpoints below are historical.

Earlier October 19 checkpoints

Latest integration: #60 main merge 05c0b48 was manually deployed by Aryan as d49bfa68, with recorded source commit and optional flags off; no duplicate deployment by this task. #48 is merged as 46282bb, following local 802/offline8/SQL and hosted Node 20/24/Postgres run 39216244319. #61 now combines those runtime changes automatically, with documentation conflicts preserving the current main record and SQL conflict resolution retaining both forum-erasure races and language-preference checks. Its exact snapshot guard/fixture remain unchanged. Final combined verification and deployment/smokes still pending; rollback remains e1f76a93 and all optional features off.

Step 0 scope is reconciled through live Help metadata/private cards: nine branch entries in four non-test posts; one new staff card plus eight follow-ups across three pre-existing cases; no unmatched threads. No customer text, names or private references enter GitHub. Exact historical answer-loss stage is unavailable, not fabricated; the Apple Watch line is present. Neither finding authorizes extra protected runs or a new prompt change in this release.

Latest explicit reviewer/user release authorization accepts the partial-duration health window for this memory-off release. The Apple Watch support line is present live. Historical gs-007 intermediate text is absent; four rerun synthetic diagnostics reproduce shared pre-existing erasure and the five review/presentation files are unchanged by #48, not proof of the exact historical stage. Step 0 reconciliation finds nine escalation-branch entries in four non-test threads, one positive new-delivery line; scoped case lookup is in progress. #60 now includes main's test repair with merge commit 0667eb3, local 771/offline8/SQL pass before push; hosted CI pending. Canonical documentation is preserved on this branch. Final merge/deploy/smoke and later separate redirect/planner-deadline drafts remain unfinished.

Aryan explicitly stopped further health-summary waiting. The existing automation is PAUSED and verified; no replacement schedule. Final cutoff 11:43:26 IST covers 19 h 49 min after restart, not 24 h. Current production remains accepted Release 1, SUCCESS/one running instance; health HTTP 200/ok, optional flags off. Before 24 h → after 19 h 49 min: two/nine answer events, two/nine route attempts, one/one positive staff-channel outcome lines, zero/zero staff-failure lines, one/one not-found new-thread errors, p50/p95 68.648/84.252 → 44.625/101.520 seconds. API/CLI date-bounded log counts agree, uncapped (11/36). Exact sends/fallbacks/crashes unavailable. No full-day or causal reliability claim. Private counts-only report: /Users/astar/omi-eval/health-summary-20261019-final.md.

Return to approved #60 → #48 → #61 final integration/release verification, not another health-only timer. Tests/CI/SQL, exact GitHub source, rollback and smoke requirements remain; no feature merge/deploy/restart/production settings change in this report, no memory enablement. Score unchanged at 45/100 and full acceptance 2/21. Older October 18 scheduled/timing text below is historical, superseded by this explicit request.

October 18: persistent product goal and current execution

Requested early health summary — read-only, not a 24-hour pass: cutoff October 18, 22:05:19 IST; after-restart coverage 6 h 11 min versus the pre-release 24 h. Two/four completed answer events, two/four handoff attempts, one/one positive staff-channel outcome lines, zero/zero staff-delivery failure lines, one/one not-found new-thread errors; nearest-rank p50/p95 68.648/84.252 s → 50.800/101.520 s. Exact send/fallback/crash counts are unavailable. Unfiltered date-bounded API and CLI searches match, uncapped; no extrapolation or speed/reliability grade. Current health is OK, accepted production unchanged, all optional flags off; auto-deploy and PR preview environments off. Full October 19 report/timing gate remains. Read-only GitHub check finds #60/#48/#61 ready, #44/#35 closed and #52–#58 still unlabeled; no external writes. Private counts-only report: /Users/astar/omi-eval/health-summary-20261018-interim.md. Score remains 45/100, full acceptance 2/21.

#61 integration verified: merge commit bc793cca472b8f4f56832e100deee75ed7757543 brings reviewed main adf016c into memory head 9dfd18a, preserving the baseline snapshot guard and unchanged application runtime. Only the typing test/docs change; two documentation conflicts preserve both records. Local 792/offline8/isolated SQL and hosted Node 20/24/Postgres run 39142032614 pass. Main's run 39141826057 passes too. #64 merged; #63 resolved; #61 remains a draft, not merged to main. Auto-deploy remains disabled and production remains accepted Release 1. No user action before tomorrow's ACTIVE 15:55 IST health summary; then the previously approved feature merge/release sequence and final-SHA gate. Score stays 45/100, full acceptance 2/21. No deployment/data-use change. Latest explicit test-only merge approval: #64 is independently approved and merged with merge commit adf016cfe0c37cd4dc3735a90cebf65b7ed1c427; fresh local 755/offline8 and hosted Node 20/24/Postgres checks pass. Only the typing test and two documentation files change. Read-only production source check confirms automatic deployment disabled and accepted Release 1 still latest/successful before merge; no deploy/settings or runtime change. Bring this exact main merge into #61, preserve its parity guard and resolve two documentation-only conflicts with the current product/repair record. Fresh integrated tests/CI/SQL follow. Do not retry the failed old SHA or request another #64 review. Feature main merges #60 → #48 → #61 still wait for October 19 after 15:54 IST and the scheduled health summary first. Then GitHub deployment/smoke, revisit the two Step 1 findings, no-email PR and test-only memory pilot. Score stays 45/100, full acceptance 2/21; no new shipped milestone.

Test-only gate repair, #63 (preserved main evidence): the real-time 5 ms/30 ms typing test failed twice in hosted Node 20. #64 replaces only that assumption with controlled callbacks proving the production interval, initial/periodic notifications, unref/clear, late-stop behavior and cleanup. Runtime and the memory implementation are unchanged. Preserve both failed attempts as diagnosis, not a hidden green rerun.

Subsequent test-repair result: #64 8b6dc75 now passes hosted Node 20/24/Postgres run 39140603602; local 755/focused2/offline8/SQL also pass. Independent review/integration is still needed, and #61's original CI remains failed. This is a test-only gate repair, not a new shipped behavior, parity waiver expansion or release approval. No main merge/deployment.

Parity guard pushed; existing test gate diagnosed: #61 9dfd18a commits the requested single baseline-snapshot guard and documentation, no runtime change. Local 792/offline8/SQL pass; the guard passes in hosted Node 20/24. Overall run 39140111396 fails the unchanged real-time typing test in two Node 20 attempts; Node 24 and Postgres succeed. No further blind reruns. Synthetic scheduling evidence shows why three callbacks are not guaranteed in 30 ms. Track #63; separate main-based draft #64, 8b6dc75, changes only that test to controlled callbacks plus documentation. Local 755/focused2/offline8/SQL pass; hosted/review pending. No main merge, deployment, provider comparison or memory enablement. Keep the October 19 health/timing hold and approved release sequence, adding no unreviewed repair to main.

Subsequent explicit #61 waiver: Aryan supplied the independent reviewer's decision to skip the provider comparison for the memory-off release only. The required single automated regression now checks stored pre-feature-main outputs for histories of length 0/3/24/30/60 across clipping, answer prompt, contextual question, planner request/history and reviewer Earlier-thread text. Eight focused checks, full 792/792, offline 8/8 and isolated SQL pass. Five in-memory export mutations each cause the new guard to fail; unmodified code passes. Expected strings were captured from clean 7fe0e0a using only synthetic histories and stubbed provider calls. No runtime behavior, private context or provider quota changed. Commit/push/hosted verification follows; enabled scenario/pilot and final integration checks remain, and the October 19 health/timing hold is unchanged. Earlier “clarification requested” entries below record the preceding checkpoint.

Latest supplied independent review: #60 approved; #61 approved with memory off; #48 comparison approved with protected topics intact and the three additional non-protected flags accepted. #59 still needs its separate comparison. Published heads remain unchanged, open/draft, hosted-green against main 7fe0e0a; nothing was merged or deployed. The new release brief restores a hold until October 19, 15:54 IST and the health summary first, superseding the prior timer waiver for this release. Final merge order is #60 → #48 → #61, final-SHA tests/CI/SQL, GitHub deployment with rollback e1f76a93 and flags off, then five Aryan-submitted live checks. New no-email-redirect work follows that release; test-only memory enablement follows 24 clean hours plus remaining data-use gates, never help-forum enablement. Full acceptance stays 2/21; three independent code-review points bring the fixed score to 45/100, not more shipped work.

Read-only follow-ups: the live product page explicitly says “Record with your Apple Watch supported” under Connect Everywhere. The historical short answer's saved logs do not contain draft/reviewer/filter-stage text, so its exact loss stage is unprovable. Four synthetic checks reproduce pre-existing whole-sentence erasure in stripPingNarration and stripSupportRedirect on both frozen versions; their review/safety/presentation files are identical. Issue #62 preserves the failure and evidence limits without protected wording. No runtime or judge change and no sealed-input read. Memory comparison preparation passed a fresh 791-test/offline8 run and seven formatter/integrity checks; no provider run started. Clarification was requested about retaining versus explicitly waiving the earlier required #61 comparison, not silently marking it done.

Earlier dated checkpoints below retain their original states; this latest review/sequence controls current work.

Memory-off synthetic prescreen: 21 prompt pairs across seven lanes and three current-history shapes, plus six stubbed intent/reviewer request-body pairs, are byte-identical to clean deployed main 7fe0e0a. No network calls or protected inputs. This is bounded parity evidence, not the required full comparison or quality approval; score stays 42/100. Current draft head 37ed12c changes documentation only after runtime d447f6f.

Memory draft published: #61, runtime d447f6f, is open with hosted Node 20/24/Postgres run 39128548042 green. Local 791/791, offline 8/8 and isolated SQL passed before push. No merge/deploy/enablement or protected run. Next is its required fresh memory-off comparison, then independent grading and the separately approved enabled scenario/pilot. Capacity bounds are per process; legacy ownerless tombstones remain thread-scoped rather than inventing identity provenance. Score remains 42/100 and full acceptance 2/21. Earlier publication-pending text below is historical.

Release 2 reader checkpoint: feat/memory-references now wires scoped earlier-post context through the existing handler, clipping and answer/reviewer prompts, without changing deterministic routing/search inputs or official evidence. At most two other same-owner posts, three owner messages/last bot reply each, uncached reads, a 1.5-second extra-work ceiling and three still-outstanding operations maximum. Timeouts/DB errors keep current-post history; deleted references are retired and opt-out rechecked before use. 27 new tests include 17 observed red-before checks; 62 focused plus two handler checks, full 791, offline 8/8 and isolated SQL pass. The old-refund routing leak, deletion/outcome race and opt-out-after-query race were reproduced and fixed. Draft publication/hosted CI/comparison/review and enabled pilot remain pending; no production or flag change. Score 42/100 (bounded-reader Built/Tested), full acceptance still 2/21.

Release 2 storage checkpoint: new feat/memory-references starts from current/deployed main 7fe0e0a. Reference-only storage, a no-text migration, removal of the memory key dependency and customer/forum erasure/opt-out are implemented locally. Six initial store checks, switch/no-key/command checks, schema verification and deletion-marker erasure had observed red-before evidence. Now 764 local tests, focused 37, offline 8/8 and isolated SQL pass. Legacy metadata outcomes remain quarantined without an invented forum; old permanent opt-outs are retained conservatively, and unrelated identity encryption is unchanged. Cross-post live reads, 1.5-second fallback, prompt isolation, CI, comparison, independent review and enabled pilot are still pending. No push/PR or production/data-use change. Master score is 40/100 (store Built/Tested only), full acceptance remains 2/21. Release 1/#48/#60/#59 review sequencing remains unchanged.

Latest #59 preparation: pushed runtime 698609f uses calm, warm and practical and retains visible Mira · Omi AI support. Six observed red assertions before the two-line runtime correction, followed by eight focused, 760 full and offline 8/8 passes; hosted Node 20/24/Postgres run 39125817220 is green. No profile/avatar, source/routing, production or optional-flag change. Independent review remains separate, and its own comparison stays held until #48 is graded. The completed #48 comparison and #60 review gates remain the release blockers; the 24-hour timer is waived, not the gates. Score stays 38/100.

Reviewer accepted Release 1's six live checks. Aryan subsequently waived the 24-hour deployment wait; this removes elapsed time as a blocker, not the existing tests/comparison/review gates. Release 1 is already live, and no next candidate is ready to release yet. The closing-language draft is now in workflow inspection on its isolated branch, followed by #48's comparison and #59's requested wording. A one-off read-only counts-only 24-hour health comparison is scheduled for October 19 at 15:55 IST. Future deployments must use the GitHub commit, not a local upload, so Railway records the source hash. The reviewer explicitly deferred the minor Spanish background-app citation note.

Subsequent checkpoint: closing-language draft #60, 7b15974, is built and locally verified (771/771, offline 8/8, isolated SQL); hosted Node 20/24/Postgres all pass. It saves language codes only with owner/guild/thread scope, reuses the existing Hindi script rule, preserves case-language precedence/English fallback and feedback IDs, and adds delete/expiry handling independently of memory. Eight behavior checks and missing-schema integration were observed red before repair. No merge/deploy; independent review is pending. #48's new comparison has now started its five-case timing preflight against frozen deployed main 7fe0e0a; full 81×2/concurrency-three arms and grade remain pending. Both clean checkouts/lockfiles and the awake AC/lid-open host were checked; no held-out content was opened. Output stays private at /Users/astar/omi-eval/ranking-20261018.

The five-case timing preflight finished at 10:49:41 UTC, all below 90 seconds (maximum 59.192 s), with zero provider-invalid rows, no signal or watchdog stop. Its normal exit 1 is a structural evaluation result, not a process crash or a quality pass. The full baseline arm is running under the same verified process handle. Do not rerun, modify frozen answer behavior or claim a full comparison/grade before both arms finish.

The ranking baseline subsequently completed at 11:22:10.460 UTC: all 162 rows / 81 cases × two, zero provider-invalid rows, no signal/watchdog stop, normal structural exit 1. Maximum latency 107.726 seconds and two rows ≥90 seconds are retained. Frozen #48's candidate arm has started; the whole comparison/grade and any new deployment remain pending. No protected input was inspected or used to change either version.

Read-only Railway source readiness check: expected repository already connected, automatic deployments off, accepted Release 1 still latest/successful. The live schema supports commit-specific deployment through that existing source. No settings, permissions, access or deployment changed; record/verify the exact approved GitHub SHA during the later gated rollout, not a local upload. Configuration presence is not an end-to-end build/health pass. Candidate comparison continues unchanged.

October 18 ranking comparison — complete, independent grade required

Both frozen arms finished: deployed main 7fe0e0a and #48 476b433, 81×2/concurrency three, same harness, zero provider-invalid rows and no process signal/watchdog stop. Window 10:46:58.772–11:54:07.207 UTC includes the five timing probes. No recorded host sleep/wake event; maximum heartbeat gap 30.008 s. Source/lockfile/input-metadata guards held; no sealed input was opened, no rows excluded or selectively rerun. Private artifact secret scan matched zero known values.

Main → #48: pass-both/flaky/fail-both 73/1/7 → 71/5/5; unwanted-handoff flags 13 → 10; missing-handoff flags 2 → 5. p50/p95 33.986/59.659 s → 34.620/57.392 s; delivered-reply median/p90 80/111 → 80/102 words. Numerical relative limits pass at the pass-both boundary, not a factual/safety or deployment approval. Increased missing-handoff flags and flakiness need independent per-case review, including protected topics, how-to false handoffs and whole-item coverage. All slow rows remain included (main maximum 107.726 s, two ≥90; candidate maximum 97.147 s, one ≥90). Each arm has 156 nonempty and eight empty turns; empty turns remain in scores/timing.

Both JSONs, the seven changed cases with both runs/verbatim replies/signals/judge problems, word counts, Markdown review summary, hashes and host audit are ready in /Users/astar/omi-eval/ranking-20261018, outside Git. Live sources were fetched independently and handoffs stubbed; flags stayed off. No merge/deploy or later-draft grade follows. Next: #59's requested wording only; hold its comparison until #48's grade. #60's independent review is separately pending. Product score remains 38/100.

Latest checkpoint: Release 1 is deployed as e1f76a93 from approved main 7fe0e0a; all six requested live smoke scenarios now pass. October 18's same-image in-flight restart preserves one reply, drains successfully and returns healthy; deployment ID is unchanged. Memory/context/fix-inbox flags remain off. Rollback stays 0eabf17b; no rollback was required. The master plan and private release report retain the exact evidence and limits. Conservatively count the next 24-hour clean interval from 15:54 IST restart verification, unless Aryan explicitly waives it.

Latest explicit order is serial: report Release 1, then implement the language-code-only no-handoff closing correction on fix/closing-language-no-case as a draft PR, then run #48's fresh comparison against deployed 7fe0e0a. #59's calm/warm/practical revision follows; its comparison waits for #48 grading. #28/#29/#49 remain held until items 1–3 complete. This supersedes the earlier decision to park #50 and the allowance to work on independent drafts while smoke is waiting. Other unfinished product work and issues #51–#58 remain preserved; no approval for new access, retention, facts, settings/permission changes or another deployment follows from this checkpoint. October 19 release integration: the reviewer accepts the 19 h 49 min health window and authorizes #60 → #48 → #61 with memory off. Bring the approved test-only main change into this branch with a merge commit, preserve the language fix and deterministic typing test, and rerun checks before push. Final combined-SHA CI/SQL and GitHub-commit deployment/smoke remain required. No new deployment by this integration.

Release 1 is live at main 7fe0e0a / deployment e1f76a93, reviewer-accepted 6/6. Aryan waived the 24-hour timer, not the tests or independent review. Future deployment uses the GitHub commit rather than a local upload. A read-only counts-only health comparison is scheduled for October 19, 15:55 IST. Optional flags stay off; no new release is approved by this update.

Closing language after an ordinary answer — draft, not deployed

fix/closing-language-no-case starts from deployed main, not the unmerged ranking/personality branches. supportThreadLanguage.js adds a language-code-only Postgres preference keyed by guild/thread/current owner with 30-day expiry. Successful owner answers in configured help/test posts save the already-computed planner language, including the existing Hindi script rule. Case context wins at closure; otherwise the matching preference is used, then English. Language-database errors never use a process-memory copy and emit fixed metadata only. Thread deletion and independent bounded expiry sweeps remain active with memory off. Existing case-state safety, feedback IDs, copy, links and archive ordering remain unchanged.

Observed red before green: Spanish and Chinese no-case closing plus the read-error diagnostic (3 failures), answer-language/script saving, save-error handling and thread deletion (5 failures); isolated SQL failed with missing schema before registration. Final local suite 771/771, offline 8/8, isolated SQL passed. Hosted CI and independent review pending; draft PR only. Next is #48's fresh comparison against deployed 7fe0e0a, then #59's calm/warm/practical revision; its comparison waits for #48 grading. #28/#29/#49 stay held. Progress remains 38/100, not an accuracy percentage.

Test-only gate repair, #63: the unchanged typing refresh test failed twice on Node 20 in hosted run 39140111396, observing only two callbacks in its real 30 ms window. The memory-off parity test passed; Node 24 and Postgres passed. Real interval timing cannot guarantee three callbacks while an event loop is busy. Replace only that test with controlled interval callbacks: assert the 8-second production interval, initial send, three refreshes, clearing/unref and a harmless late callback, with cleanup on failure. Runtime code and all support behavior stay unchanged. This branch is a separate reviewable test repair, not a memory/prompt change, release approval or permission to skip CI. The canonical current product/release record remains in the master plan; no deployment or production setting changes.

Latest #59 correction: Release 1 is already live and reviewer-accepted, #60 is a built/tested draft awaiting review, and #48's full comparison is complete but ungraded. This branch now narrows Mira's shared voice to calm, warm and practical and retains Mira · Omi AI support in the visible display name. The existing portrait/profile and every safety, language, word-budget, source and truthful-handoff rule are unchanged. Six assertions failed before the two-line runtime correction; eight focused tests, all 760 local tests and offline 8/8 pass afterward. Hosted checks/review remain required, and #59's separate comparison must wait for #48's grade. No protected input, provider evaluation, live profile mutation, deployment or optional flag change. Aryan waived the fixed deployment wait, not these gates. The original persona request below is implementation history, not the current voice instruction.

Subsequent CI checkpoint: correction runtime 698609f is pushed; hosted Node 20/24/Postgres run 39125817220 passes. Draft/review/comparison/deployment holds above remain; no extra delivery points or production changes.

Original persona request: Aryan asked for Mira's short name, an attractive/modest fictional adult portrait, and a consistent elegant/charming personality. The account/server name and selected portrait were explicitly authorized, applied and verified by fresh REST reads; the profile identifies Mira as Omi's AI support assistant. No bot permissions, runtime deployment, capture, context or fact-publication setting changed. Private before-state metadata and operation outcome stay outside Git; no secrets/customer text are in this asset or report.

The separate feat/mira-personality draft branches from deployed main 7fe0e0a, not #48/#49. It preserves product/technical identifiers and adds a shared persona to the existing answer/reviewer voice, not a second prompt or training pipeline. Name persistence after restart is implemented in source but not deployed. Two name/disclosure checks and three personality checks had observed failures before their changes; six focused checks, full 758 and offline 8/8 pass. Research uses primary Google conversation-design guidance, Microsoft's HAX guidelines and author-published customer-service findings; the guide distinguishes original design choices from proven product outcomes. See docs/MIRA_PERSONALITY.md and assets/MIRA_AVATAR.md. Independent review/quality/release gates still apply; live Release 1 checks and #48 remain priorities rather than being replaced by this request.

SUPPORT_MASTER_PLAN.md is the controlling end-to-end acceptance checklist. Aryan clarified that reviews are evidence for improving the product, not a replacement goal. Map each finding to an item, keep unfinished work visible, and return to the next product item after corrections. Built/tested/live remain separate; no invented completion percentage.

SUPPORT_MASTER_PLAN.md is the controlling end-to-end acceptance checklist. Review findings improve that goal; they do not replace it. Preserve built/tested/reviewed/live distinctions and update the evidence-based milestone score, not a guessed accuracy percentage.

October 18: #28 current-main integration

Release 1 main 7fe0e0a is deployed; its live smoke remains pending. Main is integrated into #28 with merge commit 758808a, preserving current voice, typing, localized closing cards, disabled memory cleanup and health readiness. Combined verification passes 844/844 tests, offline 8/8 and isolated SQL (both approval/private-link and memory/edit-delete checks); hosted Node 20/24/Postgres run 39108526377 passes. A fresh production-configured read-only preflight returns private_staff_destination, superseding the October 12 rejection below. Earlier behavior changes retain their red-before evidence: nine member/boot failures, two read-only-script failures and two SDK-hydration failures. Independent re-review is pending; no new protected evaluation, customer/GitHub issue write, deployment, permission change or feature enablement accompanies this integration.

October 12 Phase 5 release stop — historical, superseded by October 18

Reports 2 and 3 passed; current production is #41 at main b9eeb16, deployment 4a8e93d5, rollback 6ddd1673. #28 is not deployed. Remaining order is gated/reviewed #42 → reviewed closing-card fix #43 → reviewed #28 → #29 → #30, with one deployment at a time and 24 clean hours unless explicitly waived. Earlier entries below are historical.

Main merged into this branch with merge commit 42c6d42. Merge verification passed 736 tests, preserving /health's Discord/coordination/non-stopping readiness and both live-card receipts and GitHub approval-card binding. Combined SQL checks preserve old-schema upgrade/live-card/acceptance coverage alongside encrypted approvals and private issue links.
Scoped privacy corrections are retained locally, not pushed/released: direct member grants use one forced, uncached REST member read rather than cached authority; no bulk fetch or privileged member intent. Boot checks the configured destination and reports rejection through a bounded, metadata-only Telegram operational alert. Actual sends and GitHub actions retain their own fresh destination checks. A read-only preflight refuses all write methods and never logs API payloads.
Regression proof: nine focused failures before the member/boot correction, two before the read-only script and two SDK hydration regressions before the approved helper correction. Afterward 750/750 unit tests and the isolated SQL check pass. These are not production delivery or privacy proof.
STOPPED at the live gate: the first actual read returned guild_acl_unavailable because a bare REST SDK Guild lacks gateway channel state. Aryan explicitly approved a tested metadata-only helper repair and one additional read-only check. The repair hydrates native SDK objects from verified guild/role/bot/target-channel metadata without assigning an availability flag or weakening the validator. The approved 02:57:16–02:57:20 UTC rerun returned untrusted_role_can_view, not private_staff_destination: the actual staff channel has a View Channel grant outside the configured staff/moderator/bot authority set. Each check made six GETs and one single-member read; no gateway login, privileged intent, write or permission change. Both results are retained outside Git in phase5-private-destination-preflight-oct12.json and phase5-private-destination-preflight-oct12-approved-rerun.json. Stop release work, reconcile the audience with an administrator and obtain direction before another check or merge/deploy. Never add unverified roles to force the gate to pass.

The latest staged-release brief governs release order. #28 receives only its separately authorized corrections; #29–#30 remain untouched. Aryan's live staff-card status and acceptance feature shipped in #41 and Report 3 passed. No diagnostics or new backend access accompanies it.

Current #48 ranking correction — local tests pass, review/release pending

Merged deployed main 7fe0e0a into #48 with merge commit 93f2488; no direct main push or deployment. The reviewer-found source-fit bug is corrected across rank fusion, local chunks, multipart selection and index selection. Phone relevance is compared before authority/audience preferences; source fit only demotes developer/SDK/desktop pages on ties and never grants a Help Center/docs bonus. Existing non-phone/developer/desktop policy and the reviewed confidence-only handoff decision are unchanged. We corrected older synthetic assertions that required a weaker consumer page to leapfrog stronger retrieval evidence, retaining cap checks and an equally relevant SDK-demotion test.

Eight new synthetic tests: six failed before the implementation and all pass afterward. The 57 focused checks and full 786-test suite pass. Local evidence is outside Git at /Users/astar/omi-eval/ranking-local-20261018.i8Fiib/. No protected input was opened. The plain-language master plan now separates done, in progress, next, waiting and parked work, with technical evidence folded below. #48 is not merged/deployed; its fresh comparison waits for Release 1's remaining live checks. Memory and fix-inbox flags remain off.

Latest Release 2 decision — specified, not implemented

Aryan supplied 30-day support-memory approval and is the daily fix-card reviewer. The new design replaces encrypted message storage with scoped references and text-free outcomes, live context from up to two other posts by the same owner in the same forum, a 1.5-second optional-context deadline, and customer/forum-wide forgetting plus persistent opt-out. The existing observer indeed re-fetches messages before reuse; retained ciphertext adds no necessary answer context. Do not enable that older text-retention implementation. Identity/order encryption is unrelated and must be preserved.

Create feat/memory-references from main after Release 1 is deployed, not from the unmerged candidate now. Implement with red/green isolation, deletion/expiry, timeout and no-text-schema tests; run local Postgres/CI and a fresh memory-off main-versus-branch comparison before independent review. No merge/deploy before grading. The requested real two-post scenario needs an explicitly approved isolated candidate runtime or the post-review test-forum rollout; never connect an unreviewed worker to production just to generate smoke evidence. Then verify at least 48 clean test-only hours plus functional checks before reviewed public expansion and notice publication. Exact scope, notice and acceptance checks are in the master plan/runbook. This documentation is not implementation or a claim that the notice is pinned.

Release 1's quality approval remains valid for its frozen runtime, but its private staff smoke is blocked: Aryan explicitly answered “Not fixed yet” about channel permissions. Do not repeat the preflight, change permissions or deploy while this is unresolved. The isolated confidence-only follow-up and reviewed-fix inbox remain separate open work; this memory decision does not discard them.

Confidence-only handoff follow-up — implemented locally, not graded or deployed

Draft #48, fix/low-confidence-grounded runtime 58f69f1, is stacked on the unchanged Release 1 candidate while that release awaits the real staff-audience repair. It prevents a reviewed, actually sourced non-protected answer from being withheld solely for a confidence score below 0.72. Every independent signal remains decisive: model/review, route, triage, explicit human request, data loss, person-required answer, public-copy restriction and caption. Refund/order/replacement/warranty/account/deletion/data-loss paths retain their old handoff behavior. The old grounded-how-to exception is unchanged.

Source identity now travels from the selected retrieval rows outside formatted prose, including cache hits, canonical GitHub-docs rewrites and chosen release identities. A Feedback title or forged source marker in its body cannot add an official source to the confidence waiver. The evaluation adapter forwards the same metadata without changing the judge or running protected inputs. Consumer phone-app guidance is preferred over relevant SDK/developer/desktop-only pages before candidate and output caps; explicit developer/desktop requests and the existing eight-chunk/9,000-character caps remain.

Validation: 778/778 full tests, offline 8/8, focused provenance suite 227/227 and clean diff checks. Added 23 independent synthetic tests. Observed failures before repair: six waiver/source-fit groups, two candidate-cap/URL-marker regressions and ten provenance checks (including both Feedback spoof cases); all now pass. No new database schema or private capability. Hosted Node 20/24/Postgres passed at runtime 58f69f1 (run 39098047301). Independent review and the required fresh same-day 81×2/concurrency-three comparison must use Release 1 as deployed, not the older main or an undeployed candidate. Do not run that gate, merge or deploy this follow-up yet. The approved Release 1 runtime was not modified, and all memory/fix-inbox flags remain off. Red/green/full/offline logs are preserved outside Git at /Users/astar/omi-eval/grounded-local-20261018.Hv9QfB/.

Latest decision: Aryan supplied the independent review approving Release 1 for deployment, including the accepted borderline new missing-handoff result and protected-category review. The older pending-grade language below records the pre-review checkpoint. Approved runtime remains e7601a3; later changes are Markdown only. A fresh pre-merge npm test passed 755/755. Railway read confirms active successful 0eabf17b-9b43-4d33-8210-ead5320a84f2 (dad2505, October 13), HTTP 200 /health, and all memory/context/policy/fix-inbox flags off. Record that as the actual rollback candidate and reverify immediately before release; do not reuse 4a8e93d5 from old notes. No merge or deployment has started. The unresolved non-staff audience prevents a verified staff-only smoke: Aryan has been asked for permissions-fixed confirmation; the held read-only preflight was not repeated and no permission changed. The follow-up confidence-only handoff/source-fit PR is queued separately, with its comparison based on Release 1 after actual deployment. The full reviewed-improvement loop remains open, not discarded for this review.

The updated Release 1 candidate #47 merges #45 d60236c and #42 c8d23df, with the single shared voice contract replacing the separate 1,500-character prompt instruction. It preserves whole-item clipping, capped multipart evidence and damage intake. #46 was rechecked (670 tests/offline 8/8 plus hosted checks) and merged as 273550c, without deploying. Candidate e7601a3 passes 755 local tests, offline 8/8, isolated SQL and hosted Node 20/24/Postgres. Its authorized fresh 81×2 per arm/concurrency-three comparison is complete; no protected input was inspected or used for tuning. Memory/context/fix-inbox flags stay off.

This master-plan documentation was prepared separately from the frozen runtime checkout and merged here only after the comparison completed. Only Markdown files differ from tested runtime e7601a3; the full test suite is rerun before pushing this documentation merge. No deployment, permission update, data capture or automatic publication accompanies it. Next: independent grading and Release 1; independent synthetic improvement-loop preparation can continue while real-data/release gates remain closed. Older dated instructions below are history.

Architecture inspection for master item D5 found that faq: currently adds a bounded process-local note, boot hydration can reconstruct staff notes, and legacy database notes are deliberately excluded for lacking provenance. The reviewed loop needs additive durable approval/source/version/expiry/revocation and normal lookup/hydration enforcement; merely writing an approved line to the old table would not complete it. No knowledge behavior changed during the frozen comparison.

Release 1 interruption audit: the first attempt's baseline completed all 162 rows; the candidate saved 46 before macOS clamshell sleep (October 18, 00:48:57–01:05:00 IST, 963 s). Power logs show keep-awake assertions present before sleep; they did not override lid closure on battery. The runner stopped its child with SIGTERM on wake for no progress. No completed candidate row reached 90 s or had crash/empty/error flags (maximum 54.226 s); twelve documentation-fetch timeout log lines lack individual timestamps and are not proof of a pre-sleep model hang. Preserve the incomplete artifacts unmodified; the partial file's incomplete:false is not completion evidence without 162 rows and normal process completion. Aryan explicitly authorized rerunning both arms with AC power/lid open after this diagnosis. No runtime or scoring change, protected-input inspection, deployment or data enablement accompanies the rerun.

October 18 fresh Release 1 comparison — complete, independent review pending

Frozen main 273550c and candidate e7601a3 each completed all 162 rows on October 18 UTC, with no provider-invalid rows or interrupted child process. The five independent timing probes completed below 90 s each. The full run lasted 02:20:53–03:27:52 UTC (07:50:53–08:57:52 IST), under keep-awake assertions; macOS recorded no sleep/wake transition in that window and the longest heartbeat gap was 32.744 s. Full-arm exit 1 records structural case failures, not a process crash. Checkouts, shared harness, input metadata and dependency lockfile guards held throughout.

Measure	Main	Release 1
Pass both / flaky / fail both	70 / 4 / 7	71 / 3 / 7
Unwanted handoff flags, rows	16	14
Missing handoff flags, rows	2	3
Total p50 / p95, seconds	34.049 / 69.443	30.715 / 51.541
Delivered-reply median / p90, words	130 / 191	79 / 108

All numerical relative checks pass; this is not factual/safety approval. Missing-handoff flags increased, so the independent per-case grade must check protected data-loss/money/privacy/account cases, how-to false handoffs and whole-item clipping before any merge/release. Seven cases changed on pass/handoff; the result-only comparison includes both runs, verbatim final/all-turn replies, actual [Bot] Escalating lines and judge problems. No rows were excluded: main maximum 143.708 s (three ≥90 s), candidate maximum 92.702 s (one ≥90 s). Nonempty delivered turns have the word counts above; eight empty turns per arm remain in scoring/timing and are counted separately. All raw files, result hashes, host audit and a Markdown review summary are retained outside Git at /Users/astar/omi-eval/release1-20261018-retry1/; the first interrupted directory is preserved separately. Known local secret-value scanning matched zero artifact files.

Both arms fetched official sources live independently, not from an identical frozen corpus, and handoffs were stubbed—not real staff receipt. Memory capture/context/fix-inbox stayed off. Candidate runtime is unchanged from e7601a3; subsequent documentation does not extend this evidence to later behavior changes. No new protected run, deployment or privacy enablement is authorized by the score. Keep the complete master plan active while independent grading is pending.

October 17 combined Release 1 implementation record — not deployed

Aryan's updated brief authorizes one combined candidate and one fresh same-day comparison, not deployment. #46 was rechecked locally (670 tests/offline 8/8) and in hosted Node 20/24/Postgres CI, marked ready and merged with a merge commit as 273550c. No Railway deployment followed. The candidate merges #45 (d60236c) and #42 (c8d23df) with merge commits, preserving their history; neither source PR is separately approved for release by this integration.

Earlier October 17 foundation record — draft only

Aryan authorized renewed implementation of a simpler, more natural and reliable support experience. This supersedes release-only restrictions on preparing this separate branch, not the outstanding review/deployment gates. #42 remains held; #28 still awaits Aryan's explicit permissions-fixed confirmation before its read-only preflight. No protected evaluation, production permission/configuration change, training job or deployment accompanies this work.

Research and design rationale: Support experience. Architecture, operations and the implementation checklist below distinguish implemented, disabled and verified behavior.

Historical release-only mode and merge gates

The latest staged-release brief governs release order. #28–#30 remain unchanged by this work. Live staff-card status and acceptance notices shipped in #41; Report 3 was graded PASS. No diagnostics or new backend access accompanies that release or the closing-card localization below.

October 12 current production and closing-card correction

Reports 2 and 3 were graded PASS. Current production is 4a8e93d5-771c-486e-91f6-335839f05be4, main b9eeb16; rollback 6ddd1673-2e45-4cac-9d0d-28c71a9107fd. Earlier release entries below are history. The retained synthetic English/Spanish retry cases verified acceptance, localized pickup notices, start/wait, status persistence through restart/refresh, and /done closure. Aryan intentionally deleted the cards afterward; do not recreate them. Accept disappears after the first processed acceptance and the database claim prevents another notice for that acceptance; no additional live double-click test is required by the latest review.
Phase 4b implemented locally, not deployed: fix/localized-closing-card localizes the /done closing card using the case's stored context.replyLanguage, not the staff member's locale. All 14 acceptance-copy languages have a title, description, optional honest-review field and button labels; unknown/missing languages fall back to the identical existing English card. Regional tags fall back to the base language; the two supported Hindi scripts remain distinct.
Five of seven new localization tests failed before implementation; all pass afterward. Full suite 668/668. Store URLs, feedback custom IDs, customer-only voting, no-ping mentions and send-before-close ordering are unchanged. This correction adds no provider call or new private capability. Human language/copy review and release smoke remain pending.

Remaining deploy order: #42 after its fresh same-day main-versus-branch gate and review → closing-card fix after review → #28 after live read-only private-destination preflight/review → #29 → #30. One deploy at a time, 24 clean hours unless Aryan explicitly says go. No merge or deployment accompanies this local implementation.

October 12 current production and next gates

Reports 1 and 2 were graded PASS. Phase 2 shipped the foundation and six approved contributor fixes at main 8321439, deployment 5b25759b-d01e-4645-ade1-c869a482b323, with 8e9e453b-d60b-4001-86c0-8303deaf123d as that release's rollback target. The observed Phase 2 suite was 638 tests and offline 8/8. A later same-code deployment, 6ddd1673-2e45-4cac-9d0d-28c71a9107fd, was the healthy active copy immediately before Phase 3.
Phase 2 deployed October 11 at 12:08:24 UTC / 17:38:24 IST. Health returned HTTP 200, status=ok, staffHandoff=configured; settings and variables were unchanged. All four synthetic posts received one reply. The extra long guide exercised clipping at 1,900 characters and retained one complete Source line and both URLs, but its body was incomplete. Staff delivery was screenshot-confirmed; Aryan intentionally removed the test cards. The public filing formatter hid phone/order offline; a live filing draft was not inspected. Preserve these limitations rather than treating the smoke as blanket answer quality approval.
#41 (feat/live-staff-case-status, reviewed head e5cff9e) passed 661 local tests and Node 20/24 plus Postgres CI, then merged with two-parent commit b9eeb16 after Aryan explicitly said go. Initial deployment: ee7dba58-1720-478d-a612-d893dbab85ab. Current production after the same-image restart test: 4a8e93d5-771c-486e-91f6-335839f05be4, created October 12 at 01:02:10 UTC / 06:32:10 IST. Phase 3 rollback: the verified pre-release 6ddd1673 deployment above. Health is HTTP 200, status=ok, staffHandoff=configured; no settings or variables changed. English and Spanish live cards progressed through Awaiting staff acceptance, Accepted, In progress, Waiting for customer, restart/Refresh, and Closed. Each customer received one correctly localized acceptance notice; Refresh re-rendered the same cards after restart. Both customer threads archived and locked after /done. Login-to-old-SIGTERM was 4.0 seconds and the old copy logged drain completed=true. The Accept button is removed after acceptance and the database permits one notice per acceptance cycle; the reviewer accepted that tested protection with no live retest required. phase3-production-smoke-oct12.json preserves full REST snapshots, notices and smoke-window logs for REPORT 3 review. Aryan intentionally deleted the Closed cards after screenshots; that is cleanup, not failed delivery. The existing Spanish closing-feedback card remains English, and damaged-item tracking intake awaits Phase 4. REPORT 3 was graded PASS.
Phase 4 is implemented on fix/howto-routing-and-long-answers, from main 8321439: technical topics select retrieval lanes without asserting a failure or forcing a handoff; real failures and protected person-required paths remain. Triage has no separate topic-only escalation rule; tests preserve real model/reviewer handoffs. Offline-capability questions and diagnostic-log guides are not incident reports by themselves. Navigation/confusion is not a fault; conditional failure clauses are hypothetical, while an independent actual failure and protected person-required routes remain.
Phase 4 answers get an approximately 1,500-character draft budget, brief supported parts in requested order and complete-item overflow clipping. Wrapped bullets/steps remain atomic; Source links and data-preservation warnings stay whole. An oversized first item gets an honest truncation note, not partial guidance.
Phase 4 multipart planning retains a neutral search query for each distinct part (bounded to eight). More than three parts can select four complementary official pages within eight chunks and 9,000 evidence characters. Normal query/citation defaults remain; multipart citations can use up to four retrieved URLs on one Source line. Production's stored corpus and the eval's joint multipart corpus share coverage selection. Ordinary evidence concatenation is not newly sliced, preserving the earlier Help Center regression fix.
Physical damaged/replacement intake asks for photos/video, private order email and delivery date, not tracking. Account/code/receipt changes retain their prior intake; delivered-but-missing parcels retain tracking intake. Private staff order retention is unchanged.
Local Phase 4 suite after merging current main: 707 tests. The routing correction has six own English/Spanish navigation/hypothetical how-tos and six incident reports, plus clause-boundary and protected-lane regressions; seven groups failed before the fix. The October 11 comparison at 945773a stopped after eight candidate replies while main completed 162; retain both as interrupted evidence, not a passed gate. The eight completed replies had no recorded execution errors or timeouts; a 109.9 s total is the sum of normally completed stages, not a timed-out request. No sleep transition or Node crash report was found near the interruption, but no exit status was retained, so the exact termination cause is unknown. phase4-interruption-diagnosis-oct12.json preserves all eight row/stage latencies and this uncertainty.
Fresh October 12 comparison completed, quality approval still held. Five candidate cases ran serially first, without errors, in 66.197/79.940/34.697/56.338/53.643 s (all under 90 s). Main b9eeb16 ran 02:25:04–03:09:18 UTC; candidate runtime 251d20e ran 03:09:18–03:53:25 UTC. Both completed all 162 valid rows (81×2/concurrency three), with no logged execution errors, a normal scoring exit 1 and no termination signal. The supervisor exited 0. Shared environment/harness/lockfile and clean pinned commits were guarded; temporary caffeinate assertions were verified active. The inter-arm gap was 81 ms. Independent live source/provider variation remains; this is not a frozen-corpus or isolated-host causal benchmark.
Mutually exclusive structural pass-both/flaky/fail-both: main 71/6/4, candidate 70/5/6. Nearest-rank total wall latency includes every row: main p50/p95 50.601/79.179 s, candidate 49.957/80.067 s. Numerical gates pass (70 ≥ 69; p50 delta −0.644 s; p95 delta +0.888 s). This is not the requested quality pass: structural unwanted-handoff flags are 12 main / 15 candidate, missing-handoff flags 2 / 2. Candidate's missing flags are gs-035 in both runs; no implementation is tuned from protected outputs. Duplicate source labels: 1 main / 0 candidate. No end-ellipsis/ellipsis-before-source pattern was found, but that is only an advisory clipping screen, not semantic proof. Six second reviews per arm; 18/162 matched replies were byte-identical. Full private outputs, per-stage percentiles and per-case escalation deltas remain outside Git in holdout-phase4-main-oct12.json, holdout-phase4-branch-oct12.json, holdout-phase4-oct12-comparison-summary.json and provenance. Independent factual/how-to/protected-escalation/clipping grading is required before any merge or deploy.
Phase 4b is separately implemented in draft #43 (fix/localized-closing-card, 3413f48): stored case language controls closing-card title, description, optional honest-review text and buttons for the 14 acceptance languages, with English fallback and unchanged IDs/URLs. Seven new tests had red-before proof; its independent suite is 668 and Node 20/24/Postgres CI is green. Spanish wording explicitly says marked resolved rather than claiming customer-confirmed resolution. Review and release remain pending after #42.
Scoped Phase 5 preparation is local only at 3688d99 on #28's branch after merging main with 42c6d42; 750 tests and isolated SQL pass. Its actual read-only private-destination gate failed. The first check hit a REST-only SDK availability limitation; Aryan explicitly approved its tested metadata hydration repair and one rerun. The rerun returned untrusted_role_can_view for the current-production-configured staff channel. Each check used six GETs and one single-member read, no gateway login or external write. Stop #28: no push, merge, deploy, permission/allowlist change or silent recheck. Preserve both private preflight JSONs and reconcile the audience with an administrator before new direction. #29/#30 remain untouched.

Deployment order: gated/reviewed #42 → reviewed localized closing-card fix (Phase 4b) → reviewed/private-preflight #28 → reviewed #29 → reviewed #30. One deployment and its own smoke report at a time, 24 clean hours unless Aryan explicitly says go. Private diagnostics remain parked. N12 credential rotation remains deferred by Aryan (Oct 9), accepted risk.

Historical October 11 foundation and Phase 2 record

#33 and #32 merged into #26's foundation; #26 merged into main as 2150383. Its pre-release suite was 626/626, with Node 20/24 and database CI green.
Initial release 565be7b7-66ab-48a9-97e5-2cd8dedbc48d succeeded on October 10 at 13:20:42 UTC. Direct node index.js startup replaced the unset override/effective npm startup; draining went from unset to 100 s. /health and its default timeout are unchanged; no service variables changed. Auto-deploy remains disabled; this was an explicit deploy.
Four normal smoke replies and two in-flight restart replies were observed on October 11. Each had exactly one source label and no link-only fragments; no missing/duplicate reply, schema/model/review/staff-delivery error was observed in the smoke window. Both old copies answered after SIGTERM and logged drain completed=true telegram_completed=true. The replacement card was screenshot-confirmed then intentionally deleted by Aryan; restart B's card was also independently read from Discord before its later removal.
Phase 1 final same-image deployment: 8e9e453b-d60b-4001-86c0-8303deaf123d, created October 11 at 11:01:55 UTC, SUCCESS. It is now Phase 2's immediate rollback target; the earlier 0955e078-42ea-4830-bba5-006dae841745 remains historical.
Restart A/B: new-login → old-SIGTERM gaps 3.678/9.398 s; new-login → old drain-completed logs 23.675/29.395 s. The latter are connection-shutdown proxies, not exact socket disconnect times. This verifies the two observed drains, not every possible duplicate/uncertain-send failure mode.
Report 1 was graded PASS. Quality exceptions remain: the first webhook answer points at the prompt-app guide, Spanish mixes conflicting language guidance, replacement intake still asks for tracking, restart A omits available Developer Mode steps, and restart B hands off an ordinary how-to. Do not represent the reliability smoke as blanket answer-quality approval.
Phase 2 is deployed; Report 2 awaits grading. Approved fixes merged in order #37 → #40 → #34 → #36 → #38 → #39, with main CI green between every merge. Main 8321439 passes 638 tests and offline 8/8; the brief's 641 count is not this combined main's observed count. Deployment 5b25759b-d01e-4645-ade1-c869a482b323 is SUCCESS, created October 11 at 17:38:24 IST. HTTP 200, status=ok, staffHandoff=configured; no settings or variables changed. Aryan explicitly waived the 24-hour interval for this Phase 2 deploy only.
All four Phase 2 synthetic posts have one observed bot reply. The extra long-guide reply exercises the 1,900-character limit: the body ends in an ellipsis and one complete Source line retains both Help Center URLs. Both handoff cards were screenshot-confirmed, then intentionally removed by Aryan; do not recreate them. Phone hidden on private intake, order retained by explicit approval. The public filing formatter hides both in an offline check, but no live GitHub draft was inspected or issue filed. No missing-env, boot, model, review, staff-delivery or unhandled errors, and no second looks, in the checked smoke window. Full replies and timing lines are retained outside Git in phase2-production-smoke-oct11.json.
Phase 2 quality exceptions: the first guide omitted documented language/deletion steps; the clipped guide is incomplete despite preserving citations. The suggested test title containing “privacy” changed the crash report's route to privacy; a synthetic body-only comparison routes app, and Phase 2 did not change that classifier. Replacement intake still asks for tracking. These are not a blanket quality pass or evidence that the redaction fixes caused a new routing regression. #35 received the requested Changes requested review and remains unmerged.

October 11 staged release order (superseded): Phase 2 → #41 → routing comparison → #28 → #29 → #30. The October 12 brief adds the separate closing-card correction after #42. Each deploy retains its own review, smoke and clean interval; broader knowledge/access work remains parked.

Historical release plan (superseded by the staged order above)

The earlier entries below are historical evidence, not a claim that the foundation is still undeployed or authority to skip current gates.

Complete and report Aryan's four #24 smoke tests, their exact timing lines, second-look lines and errors, and the private staff card. Screenshots received on October 9 confirm the four replies and replacement card. Totals: deletion 24.760 s, replacement 30.631 s, Spanish 31.251 s, developer 53.540 s; no second looks or model/staff-delivery failures in that window. Functional checks pass, but do not convert this into a blanket answer-quality signoff: the Undo wording overpromises recovery and the replacement intake asks for tracking details.
Release approved #25 with a merge commit, deploy main, verify HTTP 200/status ok/staff handoff configured, and record a real successful rollback target. Read but do not change overlap/draining variables. Set only Healthcheck Path /health, leave timeout default, verify the health-gated deployment and measure new Discord login versus old SIGTERM. If overlap exceeds ten seconds, tell Aryan before any further deployments.
Standalone citation fix #31 replaces #27, whose branch is retained. Approved head 4f2c6e5 is merged as 3a28c7f; 516 tests and offline 8/8 pass. Deployment 0955e078-42ea-4830-bba5-006dae841745 succeeded in an observed quiet window, with HTTP 200/status ok/staff handoff configured and Discord login confirmed. Rollback target: 75e41379-2bad-46a4-b130-04bd52382504. Spanish phone-only smoke reply ends with one Fuente line. Chinese returns/warranty reply has one 来源 line followed by an English handoff footer; Aryan confirmed staff receipt and approved continuing with this layout exception recorded. Smoke total timing: Spanish 39.197 s, Chinese 55.366 s. No reply-formatting or Railway setting changes were made. Hosted CI on main still awaits unmerged #26.
#26's preceding protected gate at 65edcdb completed 81 cases × two runs/concurrency three: 71 pass both / 3 flaky / 7 fail both; defined safety counters zero, total p50 44.560 s/p95 79.606 s (holdout-pr26-oct10-final.json). Those absolute latency limits are superseded by Aryan's latest same-day comparison, not erased from history. After the approved control-character parse fix, run pinned main 3a28c7f first and #26 second, back to back with identical 81×2/concurrency-3 settings and no code/profile changes between them. Relative gate: #26 pass-both ≥ main pass-both −2; safety counters zero on both; #26 total p50 ≤ main p50 +2 s and p95 ≤ main p95 +6 s. Provide both JSONs and per-stage p50/p95, then stop for review; no merge/deploy. The preceding October 9 gate at fb97e4b was 73/2/6 with 45.281 s/76.107 s (holdout-pr26-oct9.json). Protected inputs stay unopened, and no tuning is authorized from comparison results. Structural scoring is not factual-answer or broad safety approval; live evidence/provider variance remains a comparison limitation.
Ship #26 first only after the same-day gate and release approval. Its rollout includes the prepared direct node index.js start command and a restart-during-reply smoke test; neither is applied during evaluation.
Once #26 is live and verified, unfreeze #28 for its own review/release. Deploy it alone and smoke-test staff approval and the GitHub preview, including the restart-safe draft flow. Frozen means retained, not discarded.
Next, deliver access step 1 (reviewed known-issues/releases and product facts) plus the support-voice rules below. Runtime prompt/canned-answer changes still need the full held-out gate; a docs-only preference change does not enable new access or change deployed behavior.
Keep #29 and #30 unmerged and unchanged until a go/no-go review of two weeks of production duplicate-reply evidence after #26. Count actual duplicate replies and uncertain-send outcomes using existing safe metadata, send identifiers and customer/staff confirmation where available; absence of error lines is not proof of zero duplicates. Record traffic volume and coverage gaps. If duplicates justify the extra machinery, review/release #29 and then #30 separately, with their duplicate-send and close/reopen smoke tests. Otherwise park both with their code/branches retained. A count does not automatically authorize a deploy.
Then deliver access steps 2–3, one at a time in staff-only shadow mode, followed by deferred staff queue, monitoring and retention work. Recording-pipeline diagnostics remain step 4 and need backend/privacy agreement. One deploy at a time, each verified with a rollback target.

Any change to answer/reviewer prompts or canned customer-answer replies must pass the full 81-case held-out gate before merge. A focused live probe is additional evidence, never a substitute. Keep held-out questions unopened, preserve distinct checkout/commit provenance and do not alter code based on protected-case results. Merge commits only; no generated authorship trailers, model names in commit messages, force-pushes or direct pushes to main.

Product decision confirmed by Aryan: keep optional honest App Store/Google Play review buttons in #26, shown regardless of feedback. They shipped with the foundation. Store clicks are not internal support votes or verified review submissions.

Customer-impacting follow-ups take priority over deferred plumbing: developer pages cited for consumer questions; deletion how-to escalating unnecessarily; and speed. Chinese duplicate source labels are addressed by #31; the English footer following its localized citation was a recorded production smoke exception. The October 10 reviewer/lookup/footer fixes and separately approved planner-human-flag correction are implemented, tested and not deployed. The latest approval adds only raw-control recovery in the shared model JSON helper plus the same-day comparison above. Keep valid escapes/content/structural whitespace, escape unescaped controls inside strings, and reject other malformed JSON; do not use a blanket strip that changes meaning. #28–#30 remain frozen. Milestone 3 stays parked until Omi backend-team agreement and privacy review, before any implementation.

Current milestone

Foundation, approved Phase 2 fixes and #41 are live at b9eeb16. REPORT 3 was graded PASS; the reviewer accepted button removal plus the tested one-notice database invariant without a live retest. Phase 4's fresh comparison is complete and meets numerical limits, but independent quality/escalation grading remains pending. #43 is draft; #28's real audience preflight is stopped. No GCP permissions or customer-content access have been granted.

The older #24/#25 prerequisites are complete. Each subsequent release still needs its own review, smoke report, clean interval and rollback evidence; never redeploy over an unfinished reply.

Already working before this milestone

Official Help Center/docs/source retrieval, interpretation, independent answer review and grounded source links.
Explicit mentions in accessible general channels and scoped direct-reply continuations; staff interventions and pure thanks remain quiet.
Public ephemeral order commands with email ownership verification.
Private staff handoffs and redacted, staff-approved GitHub filing.
Per-stage timing/token logging, escalation reasons and a second review after a rejected first review.

These capabilities remain subject to answer-quality checks. Existing functionality is not a blanket company-grade signoff.

Milestone 1 Reliable support workflows

Live staff-card follow-through — #41 deployed; REPORT 3 passed

Validation on October 11: 647 unit/regression tests pass, offline customer evaluation 8/8, and the isolated SQL check passes with an old-schema upgrade, concurrent notice claims and card/close/reopen synchronization. The first hosted Postgres job caught a real microsecond-watermark bug that the initial millisecond-resolution fixture missed. It was reproduced with a sub-millisecond timestamp and corrected by stamping the exact server timestamp only for the rendered projection; a newer status remains pending. Hosted PR CI on the corrected head and the protected customer-wording gate are separate checks, not implied by local results.

Phase 3 correction: Phase 2 main merged into #41 with a merge commit. An unconfirmed acceptance notice now explicitly tells the accepting staff member, ephemerally: “The customer notice was not confirmed. Please reply in their thread yourself.” Regression coverage includes unconfirmed send, claim failure, stale acceptance, missing receipt, unavailable destination and a thrown notification. Boot and 30-second timer wiring are exercised directly; a previously synchronized card stays stale after an edit failure and is repaired on the next pending sweep. Current combined suite: 661 pass, offline 8/8. Hosted CI/reviewer approval remain separate gates; no protected run or production release accompanies this correction.

Show awaiting acceptance, accepted/not started, in progress, waiting for customer, resolved and closed from the same durable case. A staff action—not ticket delivery or elapsed time—starts work.
Persist staff-card message references only; edit existing private cards immediately on transitions and recover missed edits through a bounded 30 s/25-case sweep. Serialize same-case edits across copies. Do not repost a card a person deleted.
Preserve the first accepting staff member per acceptance cycle, reset acceptance/work state on customer-authorized reopening, and separate the suggested specialist from the actual acceptor.
Send one localized, no-ping acceptance update in the bound customer thread (or verified original-message reply). No ETA, private intake, backend check or resolution claim. Cross-copy claims and a per-cycle nonce prevent repeated Accept clicks from repeating the notice.
On an unconfirmed notice, keep the real acceptance and tell staff to follow up via Jump; do not blindly replay an uncertain send or claim the customer was notified. A crash between the durable claim and Discord delivery can leave this optional notice unconfirmed; staff follow-up is the fallback, not an exactly-once guarantee.
#41 reviewed, merged and deployed; REPORT 3 graded PASS. English/Spanish notices, work/wait, restart/Refresh and /done were observed live. The reviewer accepted button removal and tested notice uniqueness without a live duplicate-click retest. No new backend access was added.

Milestone 2 Complete case handling and delivery recovery

Retained, not discarded. The current staged order puts #28 after #41 and the routing comparison, with its own live private-destination preflight/review/smoke. #29 preparation follows #28's merge; #30 preparation follows #29 approval. They remain unmerged and receive no unrelated feature additions. Their uncertain-send protection can hold a reply rather than retry it; the authorized phase corrections require same-nonce retries, outage fallback and staff-visible held-reply alerts before review. Existing branch code is not production deployment. Other open delivery-plumbing items remain deferred.

Milestone 3 Verified recording diagnostics

Parked. Omi backend-team agreement and privacy review are prerequisites before writing diagnostics/sign-in code or granting access.

Add private Omi sign-in and a short-lived, revocable diagnostic grant bound to the customer and case. Shopify OTP is not Omi account authorization.
Implement a backend-owned, pure-read diagnostic projection for capture/upload/sync/finalization/storage availability. Existing backend GET endpoints are not automatically safe to proxy.
Authenticate the bot to that one capability; enforce ownership, bounded windows/results and an allowlisted output schema outside the model.
Keep audio, transcripts, titles/summaries, photos, raw logs, signed URLs, keys and unrelated customers out of model inputs and public replies.
Add bounded server-side log correlation only if metadata alone is insufficient; do not grant the public bot general GCP log/database access.
Pilot with synthetic accounts, then a small authorized group. Test unauthorized, wrong-customer, expired/revoked-grant and injection cases before public enablement.

Recovery, reprocessing, refunds, deletion and account mutations remain separate human-authorized workflows. A diagnostic result must distinguish unknown evidence from verified loss and must not promise recovery.

Access ladder and support voice

This is a plan, not newly enabled access. Start with missing public knowledge, not broad privileges. Keep the existing application-controlled answer/review, ownership and delivery pipeline. Omi Support Bot is the product name; no repo, domain, channel or environment identifier migration is implied.

Reviewed public knowledge first. Add a small staff-maintained known-issues/releases list and product facts sheet. Each entry needs its official source, affected product/version, observation/review time, owner and expiry/recheck date; fixes need release/deployment evidence, not just a merged PR. Label unknowns instead of filling gaps from memory. No customer data in these records. Preserve Help Center priority and distinguish product guidance from customer reports.
Verified order facts, read-only. Existing /order and /orders are public commands whose results are ephemeral after email ownership verification. Any new conversational use must keep exact order targeting and customer ownership, use deterministic allowlisted facts, and return them ephemerally, by an authorized private response, or in authorized staff intake—not in an ordinary thread post or general model prompt. A tag, Discord staff role or public order number is not authorization. No edits, refunds or cancellations.
Linked Omi account metadata, read-only. After backend-team agreement and privacy review, implement real Omi sign-in and explicit case-bound, scoped, expiring/revocable consent. Allowlisted candidates are device type, app/firmware version, last observed sync, plan and an unsynced count only if the backend can establish it. Missing/stale/offline evidence remains unknown, not zero. Never audio, transcripts, memories, summaries or unrelated customers. Shopify OTP does not link an Omi account.
Recording-pipeline diagnostics later. Keep Milestone 3 parked until its backend-owned pure-read projections, customer authorization and privacy gates are approved. Do not turn general cloud logs or existing potentially mutating/decrypting GET endpoints into a bot tool.

Every new knowledge/access adapter begins with customer-independent or synthetic checks, then a scoped staff-only shadow pilot. Authorized results appear only on the private staff card, not in customer/model replies; no new private lookup occurs without owner verification and consent. Staff compare outcomes against the real authorized source before reviewed enablement. Existing verified ephemeral order commands are not disabled by this future-access rule. Each adapter needs an independent kill switch, fixed allowlisted output schema, rate/result/time limits and a metadata-only access audit (actor/case/scope/outcome/time, never fetched content, credentials or raw logs). Shadow mode limits exposure; it is not a guarantee against leaks or wrong facts. Choose a representative pilot and acceptance criteria, not an elapsed week alone.

Never grant new write access to customer accounts/orders, refunds, deletions, recovery/reprocessing, raw logs, general databases/audio buckets, broad cloud roles or backend impersonation. Existing writes to the bot's own support records and separately staff-approved redacted GitHub filing remain narrowly controlled workflows; they are not customer-account permissions.

Support voice is kind framing, true facts, as recorded in AGENTS.md. Acknowledge the problem and previous attempts, provide one useful next step, and retain protective warnings and material uncertainty. Confirm a staff delivery before saying “it's with the team”; delivery is not acceptance or resolution. Never invent an investigation, access, fix, deadline or outcome. These written preferences are not a claim that all production replies already comply.

Milestone 4 Answer quality and operations

Redesign /done closure with internal resolution feedback and optional honest App Store/Google Play review links. Links are shown before any vote, regardless of satisfaction. Store clicks are not dashboard votes or verified review submissions.
Keep “Still need help” functional and show feedback-storage failure honestly, without invented dashboard totals or a false “recorded” acknowledgment.
Normalize Chinese citation labels (#31 live; Chinese smoke has one 来源 citation line, with the footer-layout exception above).
Improve retrieval coverage and publish missing official support guidance; do not compensate with unverified product facts.
Maintain a reviewed incident/release registry with deployment evidence, affected versions and supported workarounds. Merged does not mean released.
Track resolution/reopen rates, handoff reasons, capability success and p50/p95 latency without logging customer content.
Continue speed work after quality holds. Never cut useful evidence to manufacture a faster score.

Deferred security work: N12 exposed credential rotation

Deferred by Aryan (Oct 9), accepted risk. Removed from the first priority slot at Aryan's explicit request; N12 remains an unresolved P0 security finding, not a completed rotation or a lowered severity.

Rotate/revoke the exposed Discord token, GitHub App private key, webhook secret and CommandCode key; revoke the old OpenCode key. Rotation/revocation is unconfirmed.
Handle DATA_ENCRYPTION_KEY through a data-preserving migration before replacement. Do not make retained encrypted records unreadable or reset state to hide a failure.

Never print or paste replacement values into chat, logs or GitHub. Record completion through provider-side revocation and successful authorized use, not merely a variable being present. No credential or Railway variable changes are authorized as a side effect of this release/evaluation work.

Validation and operating rules

Validation recorded on October 9, 2026: 593 unit/regression tests pass, the offline customer check is 8/8, and the isolated SQL check passes. Hosted CI passes on runtime head 3960f24. The communication probe used snapshot 4d643e3: 23/24 replies passed, with the voice-question/no-answer case missing part of the requested explanation on one run; later interaction-deadline and public-order privacy changes have separate regressions and CI coverage. Do not hide that remaining answer-quality inconsistency or call this a full held-out approval.

Historical next-milestone validation: PR #28 independently passes 668 tests; PR #27 independently passes 599. Their combined working tree passes 674 tests and the offline check is 8/8. Isolated SQL passes encrypted drafts, canonical repository identity, single dispatch, preserved legacy ciphertext, private links and migration refusal without deleting conflicting records. A focused three-run live check passes 12/12 replies across deletion how-to, developer-key how-to, Spanish refund and pure thanks. Its staff delivery is stubbed; this is neither a real delivery/ACL smoke test nor a held-out gate. Hosted CI is a separate required check on each PR.

The #24 smoke test is now posted and reported. #25 is merged as 4f7d7a1 and live: initial deployment 73760501-ddd2-4b49-a21d-7e383840b5d8, then health-gated deployment 75e41379-2bad-46a4-b130-04bd52382504, both SUCCESS. /health returns HTTP 200, status ok and staff handoff configured. Only Healthcheck Path /health changed; timeout remains default, overlap/draining variables remain unset, and no credential variables changed.

Railway healthcheck evidence (UTC): started 15:14:45.671, new Discord login 15:14:46.451, healthcheck passed 15:14:46.871. The old bot's own Received SIGTERM line is missing; platform stop is 15:14:53.151 (+6.7 s) and npm SIGTERM is 15:15:02.638 (+16.2 s). The npm time is a termination proxy, not proof of exact dual-connection duration. This possible over-ten-second window was reported to Aryan; further deployments are paused for review, without changing teardown/window settings. No Missing env, model failed or Staff delivery failed lines were found since the health-gated deployment.

The earlier #25 rollback targets remain historical records. Current production is #31 deployment 0955e078-42ea-4830-bba5-006dae841745, with 75e41379-2bad-46a4-b130-04bd52382504 as its rollback target. Aryan's explicit approval for #31's quiet-window release superseded the earlier deployment pause; overlap/draining/start settings were not changed. #26 incorporates main through merge commit 95c2c13 (citation formatter from main; readiness combines Discord, coordination initialization and non-stopping runtime). Its unit suite passes 603 tests and offline check is 8/8; hosted Node 20/24 and disposable database checks pass at tested head fb97e4b. Its protected gate is complete but blocked by latency, as recorded above. #26, #28, #29 and #30 remain unmerged/unreleased. No feature commits were made to #28–#30.

The current Railway service/deployment start-command overrides are unset; runtime logs confirm the npm start lifecycle before node index.js. Changing to direct Node remains a #26 rollout action, not performed here. Output-only safety review has not found positive destructive troubleshooting instructions, duplicate citation lines, or staff-action promises without the harness handoff flag. This is not a clean broad-safety approval: heat precautions, non-English data-preservation warnings, public intake of tracking/conversation details, and extra email redirects after handoff need review. No fixes were added from the protected results.

October 10 scoped follow-up: 610 unit tests and offline 8/8 pass; hosted Node 20/24 and disposable database checks pass at tested head 65edcdb. A synthetic integration review found that the order fallback discarded a planner-confirmed human-request flag. Aryan explicitly authorized stopping the incomplete 11-reply attempt, preserving it, correcting that flag, then running one complete gate on the corrected head. No protected result drove this correction. The incomplete /Users/astar/omi-eval/holdout-pr26-oct10.json is not a scored gate; the complete result is holdout-pr26-oct10-final.json, recorded above. The preceding gs-033 run-1 review error was an invalid control character in reviewer JSON (JSON parse failure, not a timeout/HTTP error); log chronology is strongly correlated with that row, not explicitly tagged per case. This error path is unchanged. A direct-Node start-command patch and rollout/restart-smoke checklist are prepared outside the repository at /tmp/omi-pr26-oct10.HgcqmN/, not applied; local railway.toml still says npm start, and no Railway settings/variables/deployments were changed. Code remained unchanged throughout the complete gate; only documentation is updated after it. #28–#30 remain frozen.

Run npm test, the offline customer check and relevant isolated database checks. Answer/reviewer prompt or canned-answer changes require the full 81-case held-out gate before merge, not just a focused live probe. Held-out files stay unopened and must never become tuning inputs. Record failed checks and remaining limitations instead of marking work complete prematurely.

Latest comparison preparation: 617 unit tests and offline 8/8 pass after raw-control recovery; planner, answer and reviewer caller regressions cover lossless controls, valid escaping, unchanged text normalization and fail-closed syntax. Main baseline is a separate clean checkout at 3a28c7f. Both processes use the same pinned Node binary, primary-checkout harness/cwd and captured environment, with private services disabled. The harness and dependency lockfile match main. Evidence is fetched live independently: page counts do not prove identical content/order, so this is a same-day live-network comparison, not a frozen-corpus causal experiment. The direct-Node rollout patch remains prepared, not applied; no Railway/credential changes.

October 10 same-day comparison: complete, release still held

Raw-control recovery is committed as c3d881b; both runs tested frozen code: main 3a28c7f first, #26 930b45f second. Each completed all 162 rows (81 cases × two runs, concurrency three), with no provider-invalid or unscored rows. The second process started 66 ms after the first ended; checkout, dataset, harness, lockfile and local environment guards passed. Only 8/162 matched replies are byte-identical. Both crawled 58 Help Center and 40 website pages, but live content/order is not guaranteed identical. Retrieval and staff delivery are in-memory/stubbed, not a production Postgres or real-card test.

Structural score, mutually exclusive pass-both/flaky/fail-both: main 70/4/7; #26 70/6/5. Nearest-rank timings in seconds, including every row and summed turns:

Stage	Main p50	Main p95	#26 p50	#26 p95
Planner	9.547	18.963	9.315	17.301
Retrieval	1.282	4.470	1.343	4.684
Answer	12.463	25.479	11.693	27.383
Review	15.336	37.221	13.907	38.850
Total	44.130	71.129	40.875	76.846

The numerical relative checks pass: 70 ≥ 68 pass-both, p50 40.875 ≤ 46.130 s, p95 76.846 ≤ 77.129 s (p95 delta +5.717 s, only 0.283 s inside the limit). This is not full approval: each output has a real duplicate citation label (main gs-038 run 2; #26 gs-052 run 2), so the zero-duplicates condition fails. The citation formatter is byte-identical between tested roots; these outputs do not establish a new formatter regression. Main also has one advisory manual-flash fallback, naming a method rather than a detailed procedure. #26 has none. Explicit reinstall/logout/local-clear/factory-wipe instructions and staff-action promises without the harness handoff flag were zero in both full 162-row audits. Missing preservation/heat precautions and private-intake guidance remain separate concerns; zero positive-advice counts are not broad safety approval.

The long background interruption compromises the benchmark: #26's final hs-081 run 2 took 2,223.620 s and ended with an empty reply/no handoff. Its planner, retrieval and review recorded unusually large durations; the run logged two request-coordination failures and two review errors (JSON syntax and timeout). Normal provider timeout is 60 s. Do not attribute this row to normal code/provider speed or assert a verified host-sleep cause. It stays in every score/percentile; nothing was excluded, tuned or silently rerun. Main had three second looks (all approved); #26 had six (four approved). The raw-control fix does not attempt to repair other malformed JSON.

Results are retained outside Git in ~/omi-eval/holdout-main-sameday-oct10.json and ~/omi-eval/holdout-pr26-sameday-oct10.json, with provenance alongside them. Neither result contains an exact scanned known local secret value. Unit suite: 617 pass; offline check: 8/8; hosted Node 20/24 and disposable database checks pass at tested head 930b45f. Docs-only draft #32 records the support voice and shadow-mode access ladder; it grants no access. No merge, deploy, credential/setting change or additional held-out run was performed. #28–#30 remain unchanged; the direct-Node patch is still prepared, not applied. Stop for review.

No production settings or credentials change as a side effect of coding. Previously exposed credentials remain unrotated/unconfirmed, deferred by Aryan with accepted risk; encryption-key rotation needs a data-preserving migration. Omi Support Bot is the product name; technical repository/domain/channel names are not renamed without an explicit migration.

See Architecture, Implementation Checklist, and Operations Runbook.

October29 draft: explain support answer decisions

Prepare the production metadata trace as one separate PR, with red-before actual-handler tests, privacy/attempt/receipt/filter checks and independent review. It records stages, public catalog sources, claimed reviewer citations, filter codes and delivery status without customer/model text or platform IDs. This is observation only, with omitted-source markers for unknown metadata; broader #83 applicability and #85 operational retention remain open. No implementation/delivery score changes, paid run or deployment.

October30 production fix A

Prepare one production-fix PR for unverified financial outcome statements across draft/review/final output. Its original #94 refund probe and independent adversarial findings have regression coverage; hardware applicability remains B. No paid run or financial capability is added. Final current-head CI/independent review and combined #94 integration remain before readiness; production stays the rollback baseline.

FilesExpand file tree

ROADMAP.md

Latest commit

History