Household Operations dashboard: connected-system review

Reviewed September 15, 2026, America/Chicago. This is a dated implementation and
runtime audit, not a guarantee of continuing availability. The maintained entry
point is ../services-platform/README.md, mirrored into the dashboard README.
Private evidence is retained under
/mnt/sol-data/sol-stack/desk-audit-20260915/; message reconciliation and model
replays are under /mnt/sol-data/sol-stack/desk-update-20260915/.

Result

The dashboard's twelve household sections rendered and remained usable at three
screen sizes. The protected APIs, local message bridge, mail watcher, local model,
private push service, and Record Player stream responded during the review.
Living Room playback could not be verified. Source-reported facts, plans,
completion, staffing proposals, and uncertain timing remain separate.

The review fixed phone timeline overflow and a database concurrency defect,
completed the appointment updates and day markers, and installed the generalized
BlueBubbles scheduling monitor. No new appointment ETA has yet arrived naturally
to exercise the entire incoming-message-to-dashboard-to-push path.

Dashboard inventory and data ownership

| Section | Role and source | Verification |
| --- | --- | --- |
| Command brief | Operations document, manual override, local inference, sale-prep state | Rendered; appointment nodes and automation status present |
| Housing | Projects, dependencies, linked work and evidence | Rendered; protected project API responded |
| Work board | D1 work items, ownership, status, due dates and links | Rendered; existing items readable |
| Time clock | Server time entries, staff and rate snapshots | Rendered; existing entries readable; no timers started |
| Timeline | Source-qualified operations events | Rendered; phone wrapping repaired |
| Schedule | Versioned operations schedule and routines | Rendered; updated appointment dispositions retained |
| Staff & growth | Staff/candidate records and onboarding | Rendered; candidates remain distinct from hired staff |
| People | Private contact profiles and normalized contact links | Rendered; API permissions checked |
| Projects | Dependencies, evidence references and linked work | Rendered; API permissions checked |
| Inventory | Persistent item IDs and recorded disposition | Rendered; empty current inventory is valid |
| Protocols | Role-aware operational instructions | Rendered |
| Handoffs | Scoped work context | Rendered; guest access remains restricted |

The Worker at services-platform/src/index.js owns authorization and D1 writes.
The browser at www/services/desk/ presents that data. Mail, Messages, local AI,
display composition, and private push each retain their own runtime ownership;
none is a replacement source of truth for every household record.

Appointment and monitoring changes

- Recorded the owner-reported home-health visit as September 13, 2:00–2:45 PM,
and September 14 UT appointments as concluded.
- Reconciled the organizer conversation against BlueBubbles and Mac Messages.
The delivered reply offered a one-hour delay or a follow-up when the existing
client visit ended. The acknowledgement supplies no firm arrival time.
The dashboard therefore retains delayed status, 1 PM offered/flexible, exact
ETA pending. A travel duration while still with another client is not an ETA.
- Added one progress-bar node per appointment day, with grouped date details
and phone controls. Completed dates use teal; other recorded dates use gold.
- Added scripts/appointment_eta_monitor.py, protected configuration and state,
and sol37-bluebubbles-automation.timer. It consumes the existing incoming
ledger without replacing the bridge's explicit reply workflow.

The local Gemma model classifies scheduling intent through a JSON function-call
envelope. A bounded dispatcher validates sender/appointment relationships,
source quotes, time values, ordering and same-day limits before changing the
schedule and linked work. It computes arrival durations from source text rather
than trusting model UTC arithmetic. Exact phone/email contact links broaden
coverage beyond the initial organizer binding. Ambiguous matches, new dates,
and invalid interpretations become private review work; acknowledgements do
not change appointments or send update pushes.

The timer runs 20 seconds after the preceding pass completes. That is polling
cadence, not guaranteed notification latency: an observed model replay took
about 45 seconds. Model failure leaves timing unknown and reports degraded
health. Per-appointment opt-out and global timer disable are available.

Applied changes and review requests enter a durable private push outbox using
Unified Clock's /api/push/send. Stable tags and receipt reconciliation avoid
blind retries after ambiguous acceptance. The activation push reached the
Clock's sent state with a one-device delivery receipt. This proves transport
delivery, not a visible phone banner or that the notification was read.

Validation repairs

A model replay initially misclassified an acknowledgement as review-worthy.
The unnecessary review was cancelled, the correction retained, and an explicit
acknowledgement no-op guard added. No appointment time changed from that replay.
A separate synthetic ETA replay exposed incorrect model clock arithmetic;
source-derived duration validation now produced the expected local arrival time.
That dispatcher replay was isolated from the live schedule.

The operations API previously checked a revision before an unconditional write.
Two simultaneous writers could both pass the check. The write now compares the
revision in the database statement itself. A stale writer gets HTTP 409 and must
reload. A live concurrent pair of identical no-op patches returned 200 and 409,
without changing business data. Worker version:
da8f8825-21cc-486d-b4be-d243d31614f1.

Connected services and displays

| Connection | Observed state | Interpretation |
| --- | --- | --- |
| Worker/D1 | Protected API groups returned 200; no pending migrations | Read path healthy during audit |
| Service-request bridge and retry timer | Active; health endpoint 200 | Runtime available; no new external email was sent |
| Solmail/Care mail watcher | Active; fresh successful health | Older last-change artifacts alone do not establish staleness |
| BlueBubbles bridge | Workers alive; queue and operations pending counts zero | Incoming ledger available |
| Household brief inference | Active; current manual override | Old last-generated brief file is not a liveness failure |
| LiteLLM and local model | Active; local model health 200 | Local replay succeeded; no cloud fallback |
| Unified Clock/custom notifier | Active; one private push subscription | Private transport receipt verified |
| Central display fleet | Effective mode home-health from winning systemd drop-in | Inspect effective configuration, not the base unit alone |
| Mac dedicated dashboard | Screenshot shows dashboard and appointment nodes | Dedicated tab refreshed for current staffing bundle; separate from physical-screen observation |
| Record Player | PLAYING; receiver time advanced 69.771 to 71.714 seconds | Active playback supported by telemetry and decoded source frame |
| Living Room | UNKNOWN; time did not advance; Home Assistant unavailable | Presentation not verified; requires device-level follow-up |
| Lee's TV | YouTube TV playing; excluded before and after checks | Protected display was left untouched |
| Camera gateway | Raw and tracked endpoints returned current images | Owned by local dashboard API; no separate camera unit is required |
| Vision/QR overlays | User configuration hides cards | Intentional presentation state, not a camera failure |
| Nest appointment snapshot | Reconciled from canonical schedule; three unmatched legacy dates retained | Snapshot is not continuous synchronization; unresolved dates remain review items |

Standalone Cast display units were disabled while the central fleet owned the
targets. The fleet's aggregate status was not fully healthy because Living Room
was unverified. Record Player uses its specialized audio/video attention feed;
the shared base feed's audio label cannot establish Record Player audibility.

Recording and evidence path

The fleet composes the desk into a live HLS stream, with a specialized Record
Player feed. HLS segments form a rolling playback cache. No continuous durable
recording archive was verified or enabled by this review.

For source-derived evidence, preserve the current playlist and last completed
segment, decode that segment, and retain capture time and hashes. The review
saved source-playlist.m3u8, live-segment.ts, and live-stream.png locally.
This verifies the generated source pixels. Mac browser screenshots verify the
browser surface. Receiver playback counters verify playback progression.
Neither alone proves the exact pixels on a physical television or audible cues;
that last boundary needs an optical/audio observation.

Keep recordings, screenshots, raw messages and private endpoint paths out of the
public README. The audit artifact directory is private, with restricted access.

Verification evidence

| Check | Result |
| --- | --- |
| JavaScript suite (npm test) | 21 passed |
| Python service-platform suite | 48 passed, including database revision race regression |
| Scheduling monitor tests | 8 passed, including timing, matching, idempotence and private push reconciliation |
| Household browser audit | 12 sections × 3 sizes = 36 views; no blank active views, overflow, console errors or HTTP errors |
| Relative-date audit | Desktop/tablet/phone and midnight rollover passed; 81 bound summaries; no stale/unbound labels |
| Owner API groups | Config, operations, work, staff, timeline, people, projects, inventory, time, home health, sale prep and tokens readable |
| Existing Operator credential | Expected protected read groups returned 200 |
| Existing Guest credential | Scoped config/operations returned 200; private groups returned 403; automation field absent |
| No credential | Operations returned 401 |
| Local model replay | Real model acknowledgement and isolated synthetic ETA cases exercised |
| Live database conflict | One accepted write and one 409; business data unchanged |
| Private notification | Clock sent receipt for one device |

The browser audit tests rendering and navigation, not every possible mutation.
No hire, payment, new timer, public publication of private evidence, or message
to the organizer was used as a test.

Recovery and remaining boundaries

Runtime backup coverage now explicitly includes the BlueBubbles automation
configuration, bridge implementation and incoming ledger, in addition to
dashboard/source files, user units, local operations state and private remote-D1
exports. The final closeout verifies the new manifest and selected compressed
blob hashes. A full disaster restore was not performed. Wider mail archives and
the Mac Messages database retain separate backup boundaries.

Priorities after this review:

1. Check Living Room device availability and physical display before claiming
fleet-wide presentation. Do not restart unrelated screens to resolve it.
2. Observe the next genuine scheduling response end to end; retain the source
event, applied revision, work update and private push receipt together.
3. Review the three unmatched legacy Nest dates against a current source.
4. If durable dashboard recording is desired, define retention and storage scope;
the current HLS cache should not be treated as an archive.
5. Perform a scoped recovery drill separately from the successful backup and
selected-blob integrity checks.