Show live staff case progress and announce real acceptance

ROADMAP.md

@@ -4,7 +4,25 @@ This is the living implementation record. A checked implementation item means co
 
 ## Release-only mode and merge gates
 
-Feature work is frozen. Do not extend Milestone 2, add diagnostics code or make further feature commits to #28–#30. #25 and #31 have explicit release approval and are live; #26 and the remaining stack still require review before merge/deployment.
+The latest staged-release brief governs release order. #28–#30 remain unchanged by this work. Aryan explicitly requested live staff-card status and an acceptance notice on October 11; that narrow feature is on the separate `feat/live-staff-case-status` draft branch, not deployed or blanket-approved for release. No diagnostics or new backend access accompanies it.
+
+### October 11 current production and review gate
+
+- #33 and #32 merged into #26's foundation; #26 merged into main as `2150383`. Its pre-release suite was 626/626, with Node 20/24 and database CI green.
+- Initial release `565be7b7-66ab-48a9-97e5-2cd8dedbc48d` succeeded on October 10 at 13:20:42 UTC. Direct `node index.js` startup replaced the unset override/effective npm startup; draining went from unset to 100 s. `/health` and its default timeout are unchanged; no service variables changed. Auto-deploy remains disabled; this was an explicit deploy.
+- Four normal smoke replies and two in-flight restart replies were observed on October 11. Each had exactly one source label and no link-only fragments; no missing/duplicate reply, schema/model/review/staff-delivery error was observed in the smoke window. Both old copies answered after SIGTERM and logged `drain completed=true telegram_completed=true`. The replacement card was screenshot-confirmed then intentionally deleted by Aryan; restart B's card was also independently read from Discord before its later removal.
+- Phase 1 final same-image deployment: `8e9e453b-d60b-4001-86c0-8303deaf123d`, created October 11 at 11:01:55 UTC, SUCCESS. It is now Phase 2's immediate rollback target; the earlier `0955e078-42ea-4830-bba5-006dae841745` remains historical.
+- Restart A/B: new-login → old-SIGTERM gaps 3.678/9.398 s; new-login → old drain-completed logs 23.675/29.395 s. The latter are connection-shutdown proxies, not exact socket disconnect times. This verifies the two observed drains, not every possible duplicate/uncertain-send failure mode.
+- **Report 1 was graded PASS.** Quality exceptions remain: the first webhook answer points at the prompt-app guide, Spanish mixes conflicting language guidance, replacement intake still asks for tracking, restart A omits available Developer Mode steps, and restart B hands off an ordinary how-to. Do not represent the reliability smoke as blanket answer-quality approval.
+- **Phase 2 is deployed; Report 2 awaits grading.** Approved fixes merged in order #37 → #40 → #34 → #36 → #38 → #39, with main CI green between every merge. Main `8321439` passes 638 tests and offline 8/8; the brief's 641 count is not this combined main's observed count. Deployment `5b25759b-d01e-4645-ade1-c869a482b323` is SUCCESS, created October 11 at 17:38:24 IST. HTTP 200, `status=ok`, `staffHandoff=configured`; no settings or variables changed. Aryan explicitly waived the 24-hour interval for this Phase 2 deploy only.
+- All four Phase 2 synthetic posts have one observed bot reply. The extra long-guide reply exercises the 1,900-character limit: the body ends in an ellipsis and one complete Source line retains both Help Center URLs. Both handoff cards were screenshot-confirmed, then intentionally removed by Aryan; do not recreate them. Phone hidden on private intake, order retained by explicit approval. The public filing formatter hides both in an offline check, but no live GitHub draft was inspected or issue filed. No missing-env, boot, model, review, staff-delivery or unhandled errors, and no second looks, in the checked smoke window. Full replies and timing lines are retained outside Git in `phase2-production-smoke-oct11.json`.
+- Phase 2 quality exceptions: the first guide omitted documented language/deletion steps; the clipped guide is incomplete despite preserving citations. The suggested test title containing “privacy” changed the crash report's route to privacy; a synthetic body-only comparison routes app, and Phase 2 did not change that classifier. Replacement intake still asks for tracking. These are not a blanket quality pass or evidence that the redaction fixes caused a new routing regression. #35 received the requested Changes requested review and remains unmerged.
+
+**Current staged release order:** Phase 2 → #41 live staff status (review first) → `fix/howto-not-escalated` (same-day 81×2/concurrency-3 main comparison and review) → #28 durable filing/private-destination checks (live read-only preflight and review) → #29 → #30. Each deploy has its own smoke report and 24 clean hours unless Aryan explicitly says go. #28–#30 receive only their separately authorized phase corrections; this #41 work does not modify them. Broader knowledge/access work remains after these reliability gates, with diagnostics still parked.
+
+### Historical release plan (superseded by the staged order above)
+
+The gate/comparison entries below are retained as history, not a claim that #26 is still undeployed or that the old two-week #29/#30 decision precedes the latest staged instructions.
 
 1. Complete and report Aryan's four #24 smoke tests, their exact timing lines, second-look lines and errors, and the private staff card. Screenshots received on October 9 confirm the four replies and replacement card. Totals: deletion 24.760 s, replacement 30.631 s, Spanish 31.251 s, developer 53.540 s; no second looks or model/staff-delivery failures in that window. Functional checks pass, but do not convert this into a blanket answer-quality signoff: the Undo wording overpromises recovery and the replacement intake asks for tracking details.
 2. Release approved #25 with a merge commit, deploy main, verify HTTP 200/status `ok`/staff handoff `configured`, and record a real successful rollback target. Read but do not change overlap/draining variables. Set only Healthcheck Path `/health`, leave timeout default, verify the health-gated deployment and measure new Discord login versus old SIGTERM. If overlap exceeds ten seconds, tell Aryan before any further deployments.
@@ -18,15 +36,15 @@ Feature work is frozen. Do not extend Milestone 2, add diagnostics code or make
 
 Any change to answer/reviewer prompts or canned customer-answer replies must pass the full **81-case held-out gate before merge**. A focused live probe is additional evidence, never a substitute. Keep held-out questions unopened, preserve distinct checkout/commit provenance and do not alter code based on protected-case results. Merge commits only; no generated authorship trailers, model names in commit messages, force-pushes or direct pushes to main.
 
-Product decision confirmed by Aryan: **keep** optional honest App Store/Google Play review buttons in #26, shown regardless of feedback. Their implementation is complete; release remains pending #26's gates. Store clicks are not internal support votes or verified review submissions.
+Product decision confirmed by Aryan: **keep** optional honest App Store/Google Play review buttons in #26, shown regardless of feedback. They shipped with the foundation. Store clicks are not internal support votes or verified review submissions.
 
 Customer-impacting follow-ups take priority over deferred plumbing: developer pages cited for consumer questions; deletion how-to escalating unnecessarily; and speed. Chinese duplicate source labels are addressed by #31; the English footer following its localized citation was a recorded production smoke exception. The October 10 reviewer/lookup/footer fixes and separately approved planner-human-flag correction are implemented, tested and not deployed. The latest approval adds only raw-control recovery in the shared model JSON helper plus the same-day comparison above. Keep valid escapes/content/structural whitespace, escape unescaped controls inside strings, and reject other malformed JSON; do not use a blanket strip that changes meaning. #28–#30 remain frozen. Milestone 3 stays parked until Omi backend-team agreement and privacy review, before any implementation.
 
 ## Current milestone
 
-**Workflow foundation is implemented on the working branch; production rollout is pending.** The earlier documentation-only proposal is now being extended with actual runtime changes. No GCP permissions or customer-content access have been granted.
+**Workflow foundation plus the approved Phase 2 fixes are live at `8321439`; Report 1 passed and Report 2 awaits grading.** Live staff-card status and acceptance notices are implemented on the separate draft branch, not production. No GCP permissions or customer-content access have been granted.
 
-The existing PR #24 smoke-test prerequisite still applies to the approved PR #25 readiness rollout. Do not redeploy over an unfinished smoke test or claim the new foundation is live before deployment and end-to-end checks succeed.
+The earlier #24/#25 smoke prerequisites are complete. Subsequent releases still require their own review, smoke report and rollback evidence; never redeploy over an unfinished reply.
 
 ## Already working before this milestone
 
@@ -56,11 +74,24 @@ These capabilities remain subject to answer-quality checks. Existing functionali
 - [x] Add PR checks with no provider/Discord secrets, and a disposable Postgres integration job.
 - [x] Complete hosted CI for runtime head `3960f24`: rules on Node 20/24 and the disposable Postgres job pass.
 - [x] Run a focused three-run communication evaluation: eight cases meet the pass threshold, one is flaky, none fail the threshold. This is not the 81-case held-out gate or a production smoke test.
-- [ ] Deploy through the existing smoke-test and rollback gates; verify real private delivery, restart behavior and deployment overlap.
+- [x] Deploy #26/#33/#32 and record private delivery, two in-flight drains, overlap and rollback evidence; Report 1 graded PASS, with the quality exceptions above. Approved Phase 2 fixes are subsequently deployed and reported separately.
+
+### Requested live staff-card follow-through — draft, not live
+
+Validation on October 11: 647 unit/regression tests pass, offline customer evaluation 8/8, and the isolated SQL check passes with an old-schema upgrade, concurrent notice claims and card/close/reopen synchronization. The first hosted Postgres job caught a real microsecond-watermark bug that the initial millisecond-resolution fixture missed. It was reproduced with a sub-millisecond timestamp and corrected by stamping the exact server timestamp only for the rendered projection; a newer status remains pending. Hosted PR CI on the corrected head and the protected customer-wording gate are separate checks, not implied by local results.
+
+Phase 3 correction: Phase 2 main merged into #41 with a merge commit. An unconfirmed acceptance notice now explicitly tells the accepting staff member, ephemerally: “The customer notice was not confirmed. Please reply in their thread yourself.” Regression coverage includes unconfirmed send, claim failure, stale acceptance, missing receipt, unavailable destination and a thrown notification. Boot and 30-second timer wiring are exercised directly; a previously synchronized card stays stale after an edit failure and is repaired on the next pending sweep. Current combined suite: 661 pass, offline 8/8. Hosted CI/reviewer approval remain separate gates; no protected run or production release accompanies this correction.
+
+- [x] Show awaiting acceptance, accepted/not started, in progress, waiting for customer, resolved and closed from the same durable case. A staff action—not ticket delivery or elapsed time—starts work.
+- [x] Persist staff-card message references only; edit existing private cards immediately on transitions and recover missed edits through a bounded 30 s/25-case sweep. Serialize same-case edits across copies. Do not repost a card a person deleted.
+- [x] Preserve the first accepting staff member per acceptance cycle, reset acceptance/work state on customer-authorized reopening, and separate the suggested specialist from the actual acceptor.
+- [x] Send one localized, no-ping acceptance update in the bound customer thread (or verified original-message reply). No ETA, private intake, backend check or resolution claim. Cross-copy claims and a per-cycle nonce prevent repeated Accept clicks from repeating the notice.
+- [x] On an unconfirmed notice, keep the real acceptance and tell staff to follow up via Jump; do not blindly replay an uncertain send or claim the customer was notified. A crash between the durable claim and Discord delivery can leave this optional notice unconfirmed; staff follow-up is the fallback, not an exactly-once guarantee.
+- [ ] Send #41 for review before merge; run any required wording gate, then smoke-test accept/double-accept/start/wait/refresh/restart/close in the separately approved rollout. The latest staged order places #41 before #28; #28's audience validation is a later gate, not claimed as present here. No competing audience checker or new backend access was added. The protected file has not been opened or rerun for this feature.
 
 ## Milestone 2 Complete case handling and delivery recovery
 
-Retained, not discarded. #28 (durable engineering approvals/destination checks) unfreezes only after #26 is live and verified, then ships alone after review and smoke tests. #29 (Discord receipt ledger) and #30 (tracked closure/reopening) stay unmerged and unchanged pending the two-week production go/no-go above. Their uncertain-send protection can hold a reply rather than retry it; weigh missing replies as well as duplicates. Existing branch code is not production deployment. Other open delivery-plumbing items remain deferred behind the access ladder.
+Retained, not discarded. The current staged order puts #28 after #41 and the routing comparison, with its own live private-destination preflight/review/smoke. #29 preparation follows #28's merge; #30 preparation follows #29 approval. They remain unmerged and receive no unrelated feature additions. Their uncertain-send protection can hold a reply rather than retry it; the authorized phase corrections require same-nonce retries, outage fallback and staff-visible held-reply alerts before review. Existing branch code is not production deployment. Other open delivery-plumbing items remain deferred.
 
 - [ ] **Deferred:** complete delivery outbox, remaining adapters, bounded retries and uncertain-outcome reconciliation. Never blindly replay a request that may already have replied.
 - [ ] **Deferred:** encrypted/minimized cumulative case summaries and attempted steps, pending an approved retention/deletion policy. Current durable context is operational categories and sources, not raw conversation content.