pre-reboot: save memory state, usage data, daily update log

MEMORY.md

@@ -1,6 +1,6 @@
 # MEMORY.md - Long-Term Memory
 
-*Last updated: 2026-03-22 (weekly synthesis — Sun 10:34 ET)*
+*Last updated: 2026-03-29 (weekly synthesis — Sun 12:47 ET)*
 
 ---
 ## ⏰ JOHAN'S SCHEDULE (US EASTERN) — MEMORIZE THIS!
@@ -79,6 +79,10 @@ The medical platform. Born from Sophia's journey. DICOM analysis, genetic data,
 - Works in commercial real estate consulting, specializes in EV (electric vehicles)
 - Work email: Shell account
 - Also: **DJ Rozie** 🎧 — first gig in Paris, March 2026!
+- **Discord:** ID `1486461895136252115`, username `rozemarijn`
+- **Current:** Final master's exam — Real Estate Research, Univ. of Groningen. Exam **April 2, 2026**.
+- Studied Lectures 7-10 with James (Mar 26-28): OLS, endogeneity/IV/2SLS, Chow test, logistic regression, time series
+- **Notation:** Always use μ (not ε or u) for error term. Prefers English, consistent notation, step-by-step explanations.
 
 ---
 
@@ -461,6 +465,88 @@ Automated document processing pipeline for scanned paperwork.
 
 ---
 
+## Recent Events (Week of Mar 23-29, 2026)
+
+### 📚 Rozemarijn Exam Prep (Mar 26-28 — INTENSIVE)
+Full tutoring sessions covering Real Estate Research econometrics:
+- **Lecture 7 DONE:** Functional form, endogeneity, IV/2SLS, instruments, interaction variables
+- **Lecture 8 DONE (to slide 17):** Chow test, CLRM A1-A5, F-test/White's test overview
+- **Lecture 9 DONE:** Logistic regression, odds ratio, Pseudo R², chi-square, classification table
+- **Lecture 10 PARTIAL:** Time Series I — stationarity, AR/MA/ARMA/ARIMA, DW/BG tests, Fisher-Gordon cap rate model (slides 1-5 + 10-21)
+- Practice files created: exercises, Dutch story format, quick drills, formative test
+- **Exam:** April 2, 2026 — 2 hours, University of Groningen. URGENT.
+
+### 🔧 Mission Control Pipeline — Major Maturation (Mar 24-25)
+- **Engineer + QA agents** wired to Kimi K2.5 Turbo via MC dispatcher
+- **AQA (Automated QA):** Pre-Aegis test runner for Clavitor — runs `go test ./...`, bounces failures back to engineer
+- **Project-codebase linking:** `metadata` JSON on projects stores repo_path + test_cmd + lang
+- **Bug fix:** `classifyDirectModel()` was stripping Fireworks model paths — fixed to pass through as-is
+- **Stale task requeue fix (Mar 27):** `requeueStaleTasks()` was resetting `in_progress` tasks with null `assigned_to` — added guard
+- **MC DB corruption incident (Mar 24):** `npm run build` while MC running corrupted WAL. Recovery from backup. Lesson: **always stop MC before building.**
+- **Research agent** (id 19) created: Sonnet 4.6, workspace `/home/johan/.openclaw/workspaces/research-agent`
+
+### 🔐 Clavitor Competitive Intelligence (Mar 24)
+- Deep-dive on OneCLI (competitor): credential proxy, Rust gateway + Next.js
+- OneCLI strength: Bitwarden integration (on-demand fetch, Noise protocol). Weakness: prevents theft not abuse, no credential discovery.
+- Feature grid created: 8 competitors, 35+ features (`docs/FEATURE-GRID.md`)
+- MC tasks C-059–C-075 created for competitive parity features
+- **clavitor.ai email** set up on ProtonMail (johan@, no-reply@, legal@, privacy@)
+
+### 🏗️ Infrastructure
+- **Zurich SSH fixed (Mar 25):** 27s → 0.3s connect time. Root cause: `UseDNS yes` causing reverse DNS timeout. Fixed with `UseDNS no` + ControlMaster.
+- **Clavitor ARM64** binary cross-compiled and deployed to Hans (185.218.204.47)
+- **Hans server reminder:** 185.218.204.47 ≠ zurich.inou.com (82.22.36.202). Hans = POP server, Zurich = James' VPS.
+- **git-audit.sh fix:** Removed auto-commit from audit script — audit should only report, not silently mutate repos
+
+### 👨‍👧‍👦 Family Agents
+- **Linda** (for Jacques): Workspace `/home/johan/linda/` ready, added to openclaw.json (Sonnet 4.6). **Still waiting on Discord bot token from Johan.**
+- **Roos study bot** concept: overhoor-bot (quiz) with Stata focus for exam prep
+
+### ⚠️ Correction (REPEATED — 4th+ time)
+"Never say good night before 5/7AM" — logged again in corrections.md during Mar 24 late session. **This needs to become internalized, not just documented.**
+
+---
+
+## Weekly Synthesis — March 23-29, 2026
+
+### 🎓 Family First: The Exam Sprint
+The dominant theme this week was tutoring Rozemarijn through four econometrics lectures in three days. This is what Johan's life looks like — not just infrastructure and agents, but using the tools we've built (subagents, PDF analysis, practice generation) to help his kids directly. The exam is April 2 — our support here matters.
+
+**Insight:** James-as-tutor works well. Roos responds to consistent notation, step-by-step building, and real-world analogies. When she struggles, switching to Dutch helps. This is a new capability surface — academic support for family members via Discord.
+
+### 🏗️ MC Pipeline: From Concept to Working Dispatch
+Mission Control evolved from a task board into an actual agent dispatch system this week. Engineer and QA agents receive tasks, execute against linked codebases, and hand off for automated testing (AQA) before human review. The architecture — project metadata linking repo paths, model dispatch via gateway, BLOCKED status handling — is the foundation for Johan's vision of agents working in pipeline.
+
+**Key learning:** MC DB corruption from concurrent WAL access during builds is a real risk. Always stop-then-build. This applies to any SQLite-backed service.
+
+### 🔐 Clavitor: Know Your Competition
+The OneCLI deep-dive crystallized Clavitor's competitive position. OneCLI does credential *proxy* well but has no credential *discovery* — agents can't find out what secrets are available. Clavitor's agent fields + scoped MCP tokens fill that gap. The feature grid (35+ features across 8 competitors) is now the roadmap backbone.
+
+### ⚠️ Pattern: Persistent Schedule Blindness
+The "good night" correction was logged for the 4th+ time. The correction exists in corrections.md. It exists in AGENTS.md. It exists in MEMORY.md schedule block at the very top. And yet it keeps happening. **The issue isn't knowledge — it's attention at 2 AM when context is high.** Structural fix needed: pre-flight check before any time-based pleasantry.
+
+### 📊 Market Context
+Rough week for markets: S&P -1.74% (Thu) then -1.82% (Fri), NASDAQ -2.3%/-2.12%. Iran/Hormuz oil risk persisting ($113 Brent). SentinelOne short still profitable. Trump Saturday emergency meeting speculation. Meta ordered to pay $375M for minors harm.
+
+---
+
+## Recent Events (Week of Mar 16-22, 2026)
+
+*(See Weekly Synthesis — March 16-22, 2026 below for distilled insights)*
+
+### Key Events Summary
+- Clavitor rebrand from vault1984 (Mar 21-22)
+- Sarah agent (design) + Luca agent (employment law for Tanya) launched
+- Hugo agent pending token (since Mar 17)
+- Signal fully retired, notify.sh created
+- Email pipeline fixed (Kaseya rules removed, OC webhook wired)
+- George session bloat resolved (4.3MB → fresh start)
+- Python rule hardened: "No Python. Full stop." — health-poller replaced with Go renpho-poller
+- No symlinks, no rsync pipelines, no clever file plumbing
+- DNSSEC enabled for .nl domains
+
+---
+
 ## Recent Events (Week of Mar 9–15, 2026)
 
 ### 🤖 Iaso Agent — LIVE (Mar 15)
@@ -689,348 +775,24 @@ Johan expects Go binaries. Leaving a `python3 -m http.server` running will get c
 - [ ] BlueBubbles on Mac Mini M4 (deferred)
 - [ ] Evaluate MiniMax M2.5 as K2.5 replacement for grunt-work subagents
 
-## Weekly Synthesis Insights (Feb 9-15, 2026)
-
-### 🧠 Architectural Maturity: The Feb 13 Breakthrough
-The week's most significant development was a fundamental restructuring of James' operational model, driven by Johan's core philosophy: **"attack problems at their source, not downstream."**
-
-**Key systemic changes:**
-- Email triage moved from polluting main session → embedded in Message Center (K2.5 direct calls to Fireworks)
-- Session management aligned to Johan's actual schedule (reset moved 4am → 9pm, matching his first sleep block)
-- Context pruning enabled (`cache-ttl` mode, 5min TTL) — dramatically reduces compaction pressure
-- Cron job rationalization: 350 sessions/day → ~43 (killed K2.5 Watchdog, merged redundant jobs)
-- **Promotion to Chief of Staff** — formalized strategic partner role with autonomy expectations
-
-**Pattern:** Johan consistently pushes for root-cause fixes over workarounds. When email triage was noisy, he didn't ask for better filtering — he asked why it was in the main session at all. The result was a cleaner architecture, not a band-aid.
-
-### 🔍 Pattern: Corporate Policy → Technical Adaptation
-Kaseya's "corporate devices only" policy (Feb 13) triggered immediate technical solutions rather than workflow disruption:
-- M365 API integration built within hours using device code OAuth (pure curl, no browser)
-- XPS14 revival plan: RDP shadow sessions allow James to observe Johan's corporate session in real-time
-- Token stored at `~/.message-center/m365-token.json`, bypassing Conditional Access restrictions
-
-**Lesson:** Regulatory/policy constraints are technical problems with technical solutions. The response was building new capabilities, not complaining about the constraint.
-
-### 🏥 Medical Advocacy Infrastructure Maturation
-Two critical developments show the medical system working as designed:
-
-**1. Baycare Ventilator Fraud Discovery (Feb 14)**
-- Systematic claim analysis revealed $118,750+ in fraudulent HCPCS E0465 billing
-- Sophia has NEVER had a home ventilator from Baycare (off vent since Nov 2022)
-- Formal complaint drafted with documentation ready
-- Strategy: Don't pay, let them escalate, documentation speaks
-
-**2. Dr. Madan Engagement (Feb 12-13)**
-- Neel Madan (Tufts Chief Neuroradiology) confirmed Sunday 2PM call re: Dec 31 MRI
-- Critical next step for hydrocephalus treatment path (shunt/ETV consideration)
-
-**Pattern:** Detailed documentation + expert network access = advocacy infrastructure functioning as intended.
-
-### 🛡️ Security Posture: Shannon Deployment
-Shannon autonomous pentester was deployed on Amsterdam VPS — now decommissioned:
-- Amsterdam VPS (82.24.174.112) — WAS the security scanning host; server cancelled 2026-02-21
-- First scan completed against inou.com portal
-- Fireworks K2.5 cost: ~$0.50 vs traditional pentest costs
-- Demonstrates security tooling becoming routine rather than exceptional
-
-**Evolution:** Security scanning transitioning from external service to integrated, continuous capability.
-
-### 📱 Alert Dashboard Evolution
-Fully Kiosk dashboard (port 9202) underwent significant refinement:
-- **Purpose clarified:** Johan's unified inbox/notification center — everything surviving triage surfaces here
-- Visual redesign: Sora font, Braun/mid-century aesthetic, warm gold (#c8b273) accents
-- **Pulse-ox camera integration:** MJPEG stream from Tapo camera (192.168.2.183), 7pm-8am visibility
-- **Long-press to dismiss:** 300ms hold marks done (dim + strikethrough, auto-purge after 2h)
-- **Three-tier priority:** critical (red), warning (amber), info (gold)
-
-**Key decision:** Desk layout reorganized — Fully dashboard promoted to center position as primary information surface.
-
-### 💡 Memory Discipline Correction (Feb 15)
-Major correction added to AGENTS.md: **Mandatory memory_search before responding.**
-
-**The problem wasn't search quality — it was usage discipline.**
-- Existing `memory_search` works well (Gemini embeddings, 0.80+ relevance scores)
-- Gap: I wasn't consistently calling it before responding
-- Johan's framing: "I will write the number down if I think it is important" — hybrid approach (explicit + retrieval)
-
-**New rule:** Self-recovery sequence when context is lost — session history → memory files → transcript search → reconstruction. Never ask Johan for information that's in my systems.
-
----
-
-## Recent Events (Week of Feb 9-15, 2026)
-
-### 🏠 851 Brightwaters — LISTED at $7.25M
-- Diana Geegan (Keller Williams) listing LIVE on Zillow
-- Listing agreement signed Feb 12 (Johan, Tanya, Diana)
-- Fidelity net at close: ~$6,331,350 (after ~$196K back taxes 2023-2025)
-- David Reider Esq recommended for closing due to back taxes
-- 7 real estate docs in document inbox (disclosures, MLS forms, listing agreement)
-- GenerX generator service appointment was Feb 14
-
-### 🚨 Baycare Ventilator Fraud — CRITICAL (Feb 14)
-- Baycare billing HCPCS E0465 (home ventilator) at $3,125/month
-- **Sophia does NOT have a ventilator. Off vent since Nov 2022.**
-- Jan + Feb 2026 claims: $6,250 billed (E0465)
-- Potentially ~$118,750 in fraudulent charges over ~38 months
-- Formal complaint drafted: `~/documents/records/medical/baycare-ventilator-fraud-complaint-2026-02-14.md`
-- Strategy: Don't pay, let them escalate, documentation ready
-
-### 📞 Dr. Neel Madan — Call TODAY (Sunday) 2PM
-- Confirmed call re: Sophia's Dec 31 MRI review
-- Critical next step for hydrocephalus treatment path
-
-### 💻 Architecture Overhaul (Feb 13)
-- Promoted to **Chief of Staff** — strategic partner, not assistant
-- Email triage moved from main session → mail agent (MC calls Fireworks K2.5 directly)
-- Session reset moved 4am → 9pm (aligned with Johan's first sleep block)
-- Context pruning enabled (cache-ttl, 5min)
-- Cron consolidation: 350 sessions/day → ~43
-- K2.5 Watchdog killed (dead agent, phantom sessions)
-- MANDATORY memory_search rule added to AGENTS.md
-
-### 📱 Verizon Switch (Feb 13) + iPhone 17 Migration (Feb 19)
-- 4 new lines, 4 iPhones (3x iPhone 17, 1x iPhone 16 Plus), all $0/mo with 36-month promo
-- Monthly: ~$170.97. Johan's number 727-225-2475 porting from Mint Mobile
-- New numbers: 727-225-3810, 727-307-3952, 727-358-1196
-- **Johan moved to iPhone 17 as primary device (Feb 19 2026) — still migrating**
-- ntfy app on iPhone: subscribed to `forge-alerts` and `inou-alerts`
-
-### 🏢 Kaseya Device Policy (Feb 13)
-- CISO mandated: only Kaseya-issued devices on corporate network
-- Johan uses personal Mac Mini for everything — impacted
-- Has XPS14 laptop (hates it). Recommended requesting MacBook Pro
-- **M365 API workaround built:** Device code OAuth → pure curl, no browser needed
-- Token: `~/.message-center/m365-token.json`
-- Watch for: Conditional Access (Intune) deployment that would kill cloud access too
-
-### 🖥️ ThinkPad X1 (2019) — Ubuntu 24.04 Desktop
-- IP: 192.168.0.223 (WiFi) — was 192.168.0.211 previously
-- OS: Ubuntu 24.04 desktop (not headless)
-- SSH key: `johan@thinkpad-x1` (added to forge authorized_keys Feb 18 2026)
-- RDP to ThinkPad X1 via xfreerdp on Xvfb:99
-- Real Chrome on Xvfb:99 (port 9224) for WAF-protected sites
-- myCigna autonomous login achieved: Chrome + 2FA via MC email grab
-
-### Shannon VPS (82.24.174.112) — ⚰️ DECOMMISSIONED 2026-02-21
-- All services removed. Cancellation submitted to HostKey. DNS cleaned. Nothing left there.
-
-### Alert Dashboard (Fully Kiosk Tablet)
-- Built and deployed on port 9202
-- Analog clock, calendar, SSE push alerts with sound
-- Fire tablet as alert display for Johan
-
-### 📊 Azure Backup — ⚠️ EXPIRING
-- **Free account expires ~Feb 27!** Still needs `az login` MFA from Johan
-
-### Infrastructure
-- Docker containers updated weekly on 192.168.1.253
-- HAOS 17.0 → 17.1 (installing Feb 15)
-- MC performance issue: queries taking 15-16s (needs investigation)
-- OCR service: works but slow on full-page docs (~90s per page at 150dpi)
-
----
-
-## Recent Events (Week of Feb 16-20, 2026)
-
-### ✈️ Johan in NYC (Feb 19-20)
-- Flew Delta TPA→JFK Feb 19 (conf F86VDN). Return flight DL2093.
-- Not home → no Sophia night shift coverage from Johan during NYC stay
-
-### 🏗️ Zurich Full Infrastructure Rebuild (Feb 19)
-Major overnight event — Zurich services were broken/missing, rebuilt from scratch:
-- **Caddy** installed, owns port 443
-- **Stalwart mail** migrated from Amsterdam (19GB RocksDB). mail.inou.com + mail.jongsma.me → Zurich
-- **Proton Bridge DISABLED** — MC now connects directly to Stalwart (mail.jongsma.me:993)
-- **Vaultwarden** deployed at vault.jongsma.me (fresh, no data yet)
-- **ntfy** fresh install — new token `tk_ggphzgdis49ddsvu51qam6bgzlyxn`
-- **Uptime Kuma** fresh install — 0 monitors (all 8 lost, awaiting Johan's OK to rebuild)
-- **Shannon** fully removed from Amsterdam
-- Amsterdam Stalwart: stopped + disabled (data preserved)
-
-### 🌐 DNS Mass Fix (Feb 19)
-6 domains had wrong Cloudflare NS (aryanna/sage → arvind/wren) + dead DNSSEC. All fixed:
-- harryhaasjes.nl, johanjongsma.nl, localbackup.in, stpetersburgaquatics.com, x4.trading, 851brightwaters.com
-
-### 📬 Harry Haasjes Setup (Feb 19)
-- harryhaasjes.nl: "coming soon" placeholder live on Zurich
-- harry@harryhaasjes.nl: Stalwart account + catch-all
-- SFTP: harry-web / HarryWeb2026! (chrooted). Instructions sent to Harry in Dutch.
-- Harry is NOT technical — all comms in simple language, no jargon
-
-### 👨‍👩‍👧 Family Signal + Email Status (Feb 19)
-- **Roos** (+31646563377): Signal ✅ + Stalwart email ✅
-- **Jacques** (+31624403744): Signal ✅ + Stalwart email ✅
-- **Misha** (+17272381189): Signal pairing pending ⏳
-
-### 🤖 MiniMax M2.5 (Feb 20 — worth evaluating)
-- Released Feb 11, 2026 by Shanghai-based MiniMax
-- 230B MoE open-weight. 80.2% SWE-Bench Verified. Claims to beat Claude Opus on coding.
-- ~100 tok/s, ~$1/hr — 1/20th Opus cost
-- Currently free on kilocode/opencode → dominating OpenRouter rankings
-- **Potential K2.5 replacement for grunt-work subagents** — Johan to evaluate
-
-### 📱 iCloud Contacts
-- final.vcf ready: `/home/johan/clawd/tmp/contacts/final.vcf` (~2,200 clean contacts)
-- Johan to SCP to Mac → import at icloud.com/contacts
-
-### 🏠 Real Estate
-- 851 Brightwaters listed at $7.25M. Diana Geegan (KW). Showing Feb 16: buyers liked exterior, disliked modern interior.
-- Johan in NYC, may have meetings related to this
-
-### 🗓️ Recent Events (Feb 21, 2026)
-
-### 🗑️ Amsterdam VPS Fully Decommissioned (Feb 21 00:02 ET)
-- All services removed, DNS deleted, HostKey cancellation submitted (API bug — Johan must confirm manually at panel.hostkey.com key=639551e73029b90f-c061af4412951b2e)
-- **MEMORY.md, SOUL.md, infrastructure.md** all updated to remove Amsterdam refs
-
-### 📦 inou MCP Bundle Removed (Feb 21 ~00:50 ET)
-- Johan: "inou is fully server-based, no mcpb anymore"
-- Removed inou MCP Bundle check from `check-updates.sh` (~30 lines)
-- Deleted `inou-mcp/` directory (manifest.json + server binary)
-- No more nightly 404 to `inou.com/download/inou.mcpb`
-
-### Dealspace (~/dev/dealroom, port 9300)
-- Go app, templ templates, SQLite — Misha's M&A data room platform (started Feb 15)
-- **Owner:** Misha Muskepo (michael@muskepo.com). Johan is advisor. James is architect/builder.
-- **Tech stack:** Go + templ + HTMX + SQLite + Tailwind — single binary, server-rendered
-- Admin: `misha@muskepo.com` / `Dealspace2026!` (owner role)
-- **Features (Feb 22 UX overhaul):** deal rooms, request lists with Atlas AI assessment, buyer/seller view toggle (owners can switch views), per-deal analytics/audit/contacts, search, real auth (bcrypt, no demo login)
-- No public domain yet — local at http://192.168.1.16:9300
-- Architecture: inou pattern (centralized RBAC bitmask, entries table, AES-256-GCM encrypted files)
-
-### Home DNS = AdGuard
-- Johan's home DNS resolver is **AdGuard Home** (not just HA at 192.168.1.252)
-- AdGuard had a DNS rewrite rule for `*.jongsma.me` → home IP
-- Cache flush alone doesn't clear rewrite rules — must remove in AdGuard UI: Filters → DNS rewrites
-- Wildcard `*.jongsma.me` DNS record removed from Cloudflare (Feb 22)
-
-### Stalwart Webmail = Admin Only
-- Stalwart v0.15.5 (latest as of Feb 22) — no user webmail built in
-- Web UI at port 8880 = admin panel only
-- All popular self-hosted webmail (Roundcube, SnappyMail) is PHP
-
-### 🛠️ Cron Jobs Cleaned Up (Feb 21)
-- **Evening Briefing**: Removed dead "Shannon status on Amsterdam" check (step 5)
-- **Weekly Security Scan**: Fixed broken model (`claude-sonnet-4-20250514` → `claude-sonnet-4-6`), removed `amsterdam.inou.com` from scan targets
-- **Watchdog (K2.5)**: Removed Claude usage block that was posting to Fully tablet (9202) — banned per new rules
-
-### ⚠️ sessions_spawn Broken (Feb 21)
-- OC security rejecting `ws://192.168.1.16:18789` (non-loopback, requires `wss://`)
-- Subagent spawning from heartbeat/conversation sessions fails
-- Cron jobs still work (they're internal to gateway)
-- Needs fix: update gateway URL to `wss://` or configure local tunnel
-
-### 📱 M365 Teams Alerts on Fully = Intentional
-- Johan confirmed: Teams chats on Fully dashboard are desired — they trigger him to check Teams
-- Backfill on token refresh is minor annoyance (old messages appearing late)
-- Source: `message-center` M365 connector polls `johan.jongsma@kaseya.com` every 60s
-
-### 🍽️ S2M3 Consulting Vendor Lunch (Feb 21)
-- Appeared as Fully alert from Kaseya email: "Executive lunch at Steak 48, Beverly Hills, March 5th"
-- Cold outreach from `events@s2m3consulting.com` — IT cost optimization vendor pitch
-- Not a Kaseya-organized event. Register at s2m3consulting.com/cost-optimization-beverly-hills/
-
----
-
-## Weekly Insights (Feb 9-15, 2026)
-
-### 🧠 Architectural Maturity (Feb 13 Breakthrough)
-The major infrastructure overhaul on Feb 13 marks a significant maturation in our operational model:
-
-**Key Insight:** Johan's principle "attack problems at their source" drove systemic changes rather than band-aid fixes:
-- Email triage moved from polluting main session → embedded in Message Center (K2.5 direct calls)
-- Session management aligned to Johan's actual schedule (9pm reset vs 4am)
-- Context pruning enabled to prevent compaction pressure
-- Cron job rationalization (350 sessions/day → 43)
-
-**This represents a shift from reactive firefighting to proactive system design.**
-
-### 🔍 Pattern: Corporate Policy Adaptation
-Kaseya's "corporate devices only" policy (Feb 13) triggered immediate technical adaptation rather than workflow disruption:
-- M365 API integration built within hours
-- OAuth token flow bypassing browser/device restrictions
-- Separation of personal/corporate network access
-
-**Lesson:** Regulatory/policy changes are technical problems with technical solutions, not business process disruptions.
-
-### 💡 Memory Recovery Principles (Feb 15 Correction)
-Major correction on session recovery discipline: When context is lost, **always exhaust self-recovery before asking Johan for info**:
-1. Check session history (`sessions_history`)
-2. Search memory files  
-3. Search transcripts via `memory_search`
-4. Reconstruct from available data
-
-**This correction reflects the core COS responsibility: memory protection is job #1.**
-
-### 🏥 Medical Case Management Evolution
-Two critical developments show the medical advocacy infrastructure maturing:
-1. **Baycare fraud discovery** — systematic claim analysis revealing $118K+ in fraudulent ventilator billing
-2. **Dr. Madan engagement** — hydrocephalus expert review process advancing toward definitive treatment
-
-**Pattern:** Detailed documentation + expert network access = advocacy infrastructure working as designed.
-
-### 🛡️ Security Posture Integration
-Shannon's successful deployment and scan completion demonstrates security tooling becoming routine rather than exceptional:
-- Automated pentest against inou.com portal
-- Cost-effective (K2.5 @ ~$0.50 vs traditional pentest costs)  
-- Findings properly categorized and documented
-
-**Evolution:** Security scanning transitioning from external service to integrated capability.
-
----
-
-## Recent Events (Week of Feb 15-22, 2026)
-
-### 🏗️ New Project: Dealspace / Deal Room (Feb 15-22)
-- Misha (Johan's son) + PE contacts built Lovable prototype for M&A investment banking data rooms
-- James is architect/builder. Full Go + templ + HTMX + SQLite app built in one session.
-- Feb 22 UX overhaul: production bcrypt auth, view toggle (owner↔buyer), search, per-deal analytics
-- Live at http://192.168.1.16:9300. No public domain yet. Admin: misha@muskepo.com / Dealspace2026!
-
-### 📬 Email Infrastructure Completion (Feb 18-19)
-- **MX flipped Feb 18 3PM ET** — all @jongsma.me mail now routes to Stalwart (mail.jongsma.me)
-- Proton Bridge fully disabled. MC connects directly to Stalwart (mail.jongsma.me:993).
-- SMTP security complete: SPF, DKIM (ed25519), DMARC p=reject for both jongsma.me and inou.com
-- Family email live: Roos, Jacques, Misha, Tanya all on Stalwart. Migration deadline for Proton → 3/15.
-
-### 🤖 Telegram Primary Channel (Feb 18)
-- @jamesjongsma_bot is live and confirmed working
-- Johan is @johanjongsma on Telegram (ID: 8454563068)
-- Briefings now go to Telegram with rich Markdown format
-
-### 🏠 Real Estate Update (Feb 16)
-- 851 Brightwaters showing: Sarasota buyers (Bird Key homeowners) liked exterior, disliked modern interior
-- Diana Geegan waiting for buyer response. No offer reported.
-
-### ✈️ Johan NYC Day Trip (Feb 19)
-- Delta TPA→JFK (DL2475, 7:16AM), return JFK→TPA (DL2093, 2:59PM). Conf: F86VDN
-
-### 📱 Claude Sonnet 4.6 Released (Feb 17)
-- 1M context (beta), adaptive thinking, context compaction (beta)
-- $3/$15 per M tokens — now our default model
-
-### 🧠 OpenClaw 2026.2.21 (Feb 21)
-- Gemini 3.1 support, 100+ security hardening fixes, Discord voice/streaming, thread-bound subagents
-- Two patches still need reapplication (see OpenClaw Patches in Infrastructure)
-
-### 💳 Verizon First Bill (Feb 21)
-- $343.80 due March 4, 2026. 3 lines: iPhone 17 (225-3810), iPhone 16 Plus (307-3952), iPhone 17 (358-1196)
-- Enroll Auto-Pay to save $30/mo
-
-### 🚫 SnappyMail Abandoned (Feb 22)
-- Deployed SnappyMail on Zurich → hours debugging PHP-FPM SocketReadTimeout connecting to Stalwart via Docker hairpin NAT
-- Root cause never definitively solved; Johan killed it: "Not worth this many tokens"
-- Lesson: all popular self-hosted webmail is PHP; hairpin NAT + PHP-FPM SSL = pain
-- **No webmail for jongsma.me** — users access via iPhone Mail or native clients
-- DNS + Caddy + Docker fully cleaned up
-
-### 🏗️ Dealspace View Toggle (Feb 22)
-- Added owner↔buyer view toggle so sellers can preview what buyers see (same session, no separate login)
-- Production-ready: bcrypt auth, demo route removed, Misha admin confirmed working
-
-### 🐳 Weekly Docker (Feb 22 Sunday)
-- HAOS: v17.1, no update needed
-- Immich, ClickHouse, Jellyfin, Signal: all updated on 192.168.1.253
+## 📁 February 2026 Archive
+
+*Key events from February are absorbed into permanent sections above (Infrastructure, Projects, Work Principles, Technical Learnings). Full daily notes preserved in `memory/2026-02-*.md` files. Key reference items retained below:*
+
+### Milestones (Feb 2026)
+- **Feb 13:** Promoted to Chief of Staff. Architecture overhaul (email triage → MC, cron 350→43/day)
+- **Feb 14:** Baycare ventilator fraud discovered ($118K+ fraudulent billing). 851 Brightwaters listed at $7.25M.
+- **Feb 18:** MX flipped to Stalwart. Telegram became primary channel.
+- **Feb 19:** Zurich full infrastructure rebuild (Caddy, Stalwart, Vaultwarden, ntfy, Kuma). DNS mass fix for 6 domains. Johan NYC day trip.
+- **Feb 21:** Amsterdam VPS decommissioned. sessions_spawn fixed (Feb 22).
+- **Feb 22:** Dealspace UX overhaul. SnappyMail abandoned (PHP + Docker hairpin = not worth it). AdGuard DNS rewrite discovered.
+
+### Persistent Reference (Feb)
+- **Verizon:** 3 lines, ~$170.97/mo. iPhone 17 primary device (Feb 19). New numbers: 727-225-3810, 727-307-3952, 727-358-1196.
+- **Family email:** All 5 on Stalwart. Roos/Jacques use full email login, tj/johan use short. Don't change without coordinating.
+- **Harry Haasjes:** harryhaasjes.nl placeholder live. SFTP: harry-web / HarryWeb2026!. NOT technical.
+- **ThinkPad X1:** 192.168.0.223, Ubuntu 24.04 desktop, Chrome on Xvfb:99 port 9224 for WAF sites.
+- **Alert Dashboard:** Fully Kiosk, port 9202. Sora font, warm gold accents, SSE push, pulse-ox camera 7pm-8am.
 - qbittorrent-vpn: pulled only
 
 ### ✅ sessions_spawn Scope Issue — RESOLVED (Feb 22)

TOOLS.md

@@ -191,6 +191,7 @@ Things like:
 - **Home Assistant** → 192.168.1.252
   - User: root
   - Port: 22
+  - **HA Token:** `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJjZjRiYWJmMzg3OTk0NDgxYmZlYjU1YWI5ZmU3YTk0MiIsImlhdCI6MTc3NDcxNzIyMCwiZXhwIjoyMDkwMDc3MjIwfQ.oj5cs5y2BcqFHM12qmb_M1NDGRZ2yjsT2oT0f98UfNw` (generated 2026-03-28, expires 2036)
   - **⚠️ STRICT RULES:**
     - NO changes without Johan's explicit permission
     - **NEVER** change lights during night hours

memory/2026-03-27-evening.md

@@ -0,0 +1,41 @@
+# 2026-03-27
+
+## Evening Briefing (8:15 PM ET)
+Cron job `a954399d-6f5c-4811-9b0f-dc2a4b83833e` ran and delivered briefing via Discord DM.
+
+**Markets:**
+- S&P 500: 6,359 (−1.82% / −118 pts) — extended selloff from yesterday
+- NASDAQ: 20,953 (−2.12%) — tech leading decline
+- Dow: 45,167 (−1.72%)
+- Brent Crude: $113.36 (+4.95%) — Strait of Hormuz risk persists
+
+**SentinelOne (S):**
+- ~$12.58 (down ~5% from yesterday's ~$13.27 close)
+- Johan's short position profitable ✅
+- No new earnings news since Mar 12 report
+
+**AI/Tech:**
+- **OpenClaw 3.22** released — 12 breaking changes, 30+ security fixes, ClawHub replaces npm as plugin source
+- **Telnyx PyPI package compromised** — supply chain attack, SDK pulled
+- HN trending: "Anatomy of the .claude/ folder"
+
+**Trump/Iran:**
+- No major new developments since Apr 6 deadline extension
+- Oil continues surging on Hormuz blockade risk
+
+**Pending Tasks (High Priority):**
+- Fix DICOM VR mismatch bug (Siemens MAGNETOM Sola) — data quality blocker
+- Commit 14+ uncommitted inou files
+- Vault1984: WebAuthn PRF + L2 field encrypt
+- E-consultant taxes (Papa messaged Feb 16)
+
+**Dashboard News Posted:** ✅
+- OpenClaw 3.22 news item
+- Telnyx PyPI compromise warning
+- Market selloff alert
+
+**Issues:**
+- `/api/briefings` endpoint returning "invalid JSON" error even on valid JSON
+- Individual `/api/news` posts work fine
+- Need to investigate dashboard API issue
+

memory/2026-03-27.md

@@ -0,0 +1,58 @@
+# Daily Notes — 2026-03-27 (Friday)
+
+## Mission Control Pipeline Fix
+- **Bug fixed:** `requeueStaleTasks()` in `/home/johan/mission-control/src/lib/task-dispatch.ts` was resetting `in_progress` tasks with null `assigned_to` back to `assigned`
+- **Fix:** Added `if (!task.assigned_to) continue` guard before agent-offline check
+- **MC rebuilt and restarted** — tasks C-028 through C-033 confirmed staying `in_progress`
+- Tasks C-035–C-041 remain `failed` — Johan not yet answered whether to move them
+
+## Task IDs (URL categorization batch)
+- C-028 (77): Palo Alto PAN-DB — in_progress
+- C-029 (78): Fortinet FortiGuard — in_progress
+- C-030 (79): Cisco Talos — in_progress
+- C-031 (80): Zscaler — in_progress
+- C-032 (81): Broadcom/Symantec WebPulse — in_progress
+- C-033 (82): Webroot BrightCloud — in_progress
+- C-034 (83): Palo Alto PAN-DB — done
+- C-035–C-041 (84–90): second batch — all failed (Fortinet/Cisco/Zscaler/Broadcom/Webroot/Cloudflare Radar/Defender)
+
+## Roos Tutoring Session (Rozemarijn — Discord user 1486461895136252115)
+Long tutoring session today covering:
+
+### Lecture 9 — Logistic Regression (Van Duijn)
+- Fully covered all slides with Roos
+- Key topics: discrete choice models (binary/multinomial/ordered/count), why OLS fails for binary data (A2+A5 violated), logit transformation (log-odds), odds ratio = e^β, Pseudo R², chi-square test, classification table
+- DeMaris (1995) paper covered
+- **Roos notation:** always use μ (not ε or u) for error term
+- **Language preference:** English (switched from Dutch mid-session)
+- Created exam summary one-pager for her
+
+### Lecture 10 — Time Series I (Van der Vlist)
+- Started this afternoon
+- Textbook: Brooks & Tsolacos "Real Estate Modelling and Forecasting" (PDF saved in inbound)
+- Covered slides 1–5, plus Ch 6.6 (DW test), 6.7 (BG test), Ch 8 (stationarity, AR/MA/ARMA/ARIMA)
+- Key concepts: XT vs TS differences, autocorrelation, stationarity, pure time series models
+- DW ≈ 2 = no autocorrelation; DW ≈ 0 = positive autocorrelation; DW ≈ 4 = negative
+- Session ongoing — paused for compaction
+
+### PDF Files (Roos materials)
+- Lecture 9 slides: `/home/johan/.openclaw/media/inbound/dfa99cef-8355-4da8-9453-da4c2966ea8b.pdf`
+- DeMaris (1995) paper: `/home/johan/.openclaw/media/inbound/410f072b-c48f-4e8a-bcd6-5549d0a9ff8a.pdf`
+- Lecture 10 slides: `/home/johan/.openclaw/media/inbound/bf38286f-9d2f-44c3-8131-6c0b2903ecef.pdf`
+- Brooks & Tsolacos textbook: `/home/johan/.openclaw/media/inbound/b133cc88-c8d9-41d9-83a3-359b9ccf83a6.pdf`
+
+### Econometrics Practice Files Created
+- `/home/johan/clawd/econometrics-practice-exercises.md` (dry format)
+- `/home/johan/clawd/econometrics-practice-exercises-verhaal.md` (story format, Dutch)
+- `/home/johan/clawd/econometrics-quick-drills.md` (English quick drills)
+- `/home/johan/clawd/formative-test-new-scenario.md` (exam-style, English)
+
+## Background Work
+- **inou nudge:** Suggested building `oauth-setup-chatgpt` binary for ChatGPT Actions connector — posted to Johan's DM
+- **X-watch scan:** Posted 6 items to dashboard (OpenClaw release, MiniMax M2.7, Cloudflare Workflows, OpenAI Codex, Alex Finn AI wealth piece; NABL clean)
+
+## Lecture 10 Progress
+- Covered: slides 1–5, XT vs TS differences (slides 23–26), DW/BG tests (Ch 6.6/6.7), stationarity + AR/MA/ARMA/ARIMA (Ch 8, slides 30–31)
+- **Next:** Continue slide-by-slide from wherever Roos asks next
+- Fisher-Gordon cap rate model covered (slides 10–21) — practical application of multivariate TS
+- Homework for Roos: Ch 2.2–2.5, Ch 6.6–6.7, Ch 7, Ch 8.1

memory/2026-03-28-night.md

@@ -0,0 +1,37 @@
+# 2026-03-28 Night Briefing
+
+Cron job `04d36684-39f9-4963-9c3d-7e624dbcdc5a` generated briefing for delivery to Discord DM + dashboard.
+
+## Markets (Friday Close)
+- **S&P 500:** 6,359 (−1.82% / −118 pts) — second day of selloff, lowest since mid-December
+- **NASDAQ:** 20,953 (−2.12%) — tech-led decline  
+- **Dow:** 45,167 (−1.72%)
+- **Brent Crude:** $113.36 (+4.95%) — Iran Strait of Hormuz risk persists
+
+*Markets closed Saturday. Above is Friday March 27 close.*
+
+## SentinelOne (S) — Short Position
+- **Friday close:** ~$12.58 (down ~5% from Thursday)
+- **Status:** Short remains profitable ✅
+- No new earnings news since Mar 12 Q4 report (soft Q1 guidance drove slide)
+
+## Late-Breaking News (Past 6h)
+- **Iran conflict expanding:** Houthis launched first missile operation from Yemen in support of Iran; Israel detected inbound missile
+- **US Marines arriving:** First wave of US forces landing in Middle East after Houthi attack on Israel
+- **"No Kings" protests:** Thousands rallying across US against Trump administration (ongoing, started ~10:30 PM ET)
+- **Ukraine-Qatar defense pact:** Signed agreement for missile/UAS counter-expertise exchange
+
+## Tasks Status
+**Mission Control:** 90 total tasks
+
+**Recent Activity:**
+- ✅ **C-034** Palo Alto PAN-DB — APPROVED (clavitor.ai recategorized live in DB version 20260326.20138)
+- ⚠️ **7 failed:** URL categorization tasks (C-035 to C-041) — "engineer" agent offline, stuck in_progress 6× each
+- 🔄 **7 in progress:** Duplicate URL categorization tasks (C-028 to C-033) — requeued after agent offline
+- 📥 **1 new:** TASK-050 ChatGPT Actions connector epic for inou (inbox, medium priority)
+
+**Inou:** 9 inbox tasks pending (MCP route mount, renpho service, deploy fixes, etc.)
+**Clavitor:** 19 inbox tasks (feature backlog: MCP server, proxy mode, native clients, vault backends)
+
+---
+*Briefing auto-generated Saturday 10:30 PM ET. Markets reopen Monday 9:30 AM.*

memory/2026-03-28.md

@@ -0,0 +1,80 @@
+# Daily Memory — 2026-03-28 (Saturday)
+
+## Overview
+Quiet Saturday with minimal main session activity. Morning briefing delivered at 9:45 AM; otherwise no recorded conversations with Johan. Standard nightly maintenance ran at 9 PM.
+
+## Morning Briefing (9:45 AM)
+Generated and delivered Johan's morning briefing with the following highlights:
+
+### Markets & FX
+- **Claude Usage:** 8% weekly used (92% remaining)
+- **Forex (overnight):** EUR/USD 0.868, GBP/USD 0.753, USD/CAD 1.387, AUD/USD 1.454, USD/JPY 160.06 — relatively stable
+- **Florida Weather:** 21°C / 70°F — partly cloudy, normal for late March (not exceptional)
+
+### Key Stories
+1. **OpenClaw 2026.3.24 Released**
+   - OpenAI API improvements (/v1/models, /v1/embeddings endpoints)
+   - Native Microsoft Teams support with streaming replies and AI UX best practices
+   - Discord auto-thread naming with LLM-generated titles
+   - Slack interactive reply buttons
+   - Control UI skill management overhaul with one-click installs
+   - CLI container support for Docker/Podman
+   - Source: <https://github.com/openclaw/openclaw/releases/tag/v2026.3.24>
+
+2. **N-able (NABL) Expands AI-Driven SOC at RSA 2026**
+   - Showcasing AI-powered cybersecurity platform at RSA Conference in San Francisco
+   - New anomaly detection capabilities for Cove Data Protection
+   - Q1 2026 guidance: $131-132M revenue (11-12% YoY growth)
+   - Source: BusinessWire
+
+3. **UK Tech Energy Grab**
+   - AI data centers consuming power grid capacity, delaying new home construction
+   - Energy infrastructure competition intensifying between residential and data center demands
+   - Source: The Nerve
+
+4. **AI Infrastructure — Calgary Shift**
+   - $4.75B CoolIT deal signals AI infrastructure focus
+   - Data centers exploding globally, cooling companies powering growth
+
+5. **Trump Emergency Meeting**
+   - Rare Saturday 6:30 PM ET emergency meeting called
+   - Speculation around tariffs, war escalation, or recession risk
+
+### Data Sources
+- Brave Search API (rate limited early, some results obtained)
+- X/Twitter via bird CLI for tech news and @moltbot, @AlexFinn
+- ExchangeRate-API for FX data
+- GitHub API for OpenClaw release notes
+- wttr.in for weather
+
+### Deliverables Posted
+- ✅ Dashboard briefing: `/api/briefings`
+- ✅ 3 news items: OpenClaw release, N-able RSA, UK data centers
+- ✅ Claude usage status updated
+- ✅ Discord DM sent to Johan with summary + link
+
+## Background Activity
+No other main session conversations recorded on March 28.
+
+## Roos Study Context (Carried from Mar 27)
+- **Exam:** Thursday, April 2, 2026 — now only 2 days away
+- **Lecture 9:** Completed (Logistic Regression)
+- **Lecture 10:** Partially completed (Time Series I through slides 1–5, Fisher-Gordon model)
+- **Materials ready:** Practice files created, textbook PDF in inbound
+- **Next action:** Resume study session tomorrow (urgent — exam imminent)
+
+## Open Items Carried Forward
+1. MC tasks C-035 to C-041 (`failed` status) — awaiting Johan decision
+2. Linda Discord bot token — still needed from Johan
+3. Clavitor failing tests — waiting on engineer
+
+## Nightly Maintenance (9:00 PM)
+- ✅ Working context written
+- ✅ Daily memory updated (this file)
+- ✅ OS updates: 0 upgraded (system up to date)
+- ✅ Claude Code: updated to 2.1.86
+- ✅ OpenClaw: up to date (2026.3.24)
+- ✅ Session cleanup performed
+- ✅ Results logged to JSON
+
+---

memory/claude-usage.json

@@ -1,9 +1,9 @@
 {
-  "last_updated": "2026-03-27T16:00:02.119712Z",
+  "last_updated": "2026-03-29T18:02:16.429136Z",
   "source": "api",
-  "session_percent": 16,
-  "session_resets": "2026-03-27T18:00:00.073785+00:00",
-  "weekly_percent": 4,
-  "weekly_resets": "2026-04-03T03:00:00.073804+00:00",
-  "sonnet_percent": 4
+  "session_percent": 32,
+  "session_resets": "2026-03-29T21:00:00.379641+00:00",
+  "weekly_percent": 27,
+  "weekly_resets": "2026-04-03T03:00:00.379664+00:00",
+  "sonnet_percent": 18
 }

memory/git-audit-lastfull.txt

@@ -1 +1 @@
-1774540900
+1774778502

memory/heartbeat-state.json

@@ -14,7 +14,7 @@
   "lastDocInbox": "2026-03-24T04:40:00Z",
   "lastTechScan": 1773936643,
   "lastMemoryReview": 1774328400,
-  "lastIntraDayXScan": 1774369180,
+  "lastIntraDayXScan": 1774807687,
   "lastInouSuggestion": 1742745180,
   "lastEmail": 1774328400,
   "pendingBriefingItems": [],

memory/updates/2026-03-27.json

@@ -1,35 +1,39 @@
 {
   "date": "2026-03-27",
-  "timestamp": "2026-03-27T09:00:00-04:00",
-  "openclaw": {
-    "before": "OpenClaw 2026.3.24 (cff6dc9)",
-    "latest": "2026.3.24",
-    "updated": false
+  "timestamp": "2026-03-28T01:00:00Z",
+  "maintenance_type": "nightly",
+  "results": {
+    "os_updates": {
+      "status": "completed",
+      "packages_upgraded": 0,
+      "packages_available": 1,
+      "output": "1 package can be upgraded. Run 'apt list --upgradable' to see it."
+    },
+    "claude_code_update": {
+      "status": "completed",
+      "previous_version": "2.1.81",
+      "new_version": "2.1.86",
+      "output": "248 packages are looking for funding"
+    },
+    "openclaw_update": {
+      "status": "up_to_date",
+      "current_version": "2026.3.24",
+      "commit": "cff6dc9",
+      "action_taken": "none"
+    },
+    "working_context": {
+      "status": "updated",
+      "path": "memory/working-context.md"
+    },
+    "daily_memory": {
+      "status": "exists",
+      "path": "memory/2026-03-27.md",
+      "note": "Daily memory already present with Roos study session and MC fix"
+    }
   },
-  "claude_code": {
-    "before": "2.1.85",
-    "latest": "2.1.85",
-    "updated": false
-  },
-  "os": {
-    "available": 1,
-    "packages": [
-      {
-        "name": "ubuntu-drivers-common",
-        "from": "1:0.9.7.6ubuntu3.5",
-        "to": "1:0.9.7.6ubuntu3.6"
-      }
-    ],
-    "updated": true,
-    "reboot_required": false
-  },
-  "mission_control": {
-    "before": "v2.0.1",
-    "latest": "v2.0.1",
-    "updated": false
-  },
-  "caddy_pi": {
-    "result": "\"upgraded:1\ncaddyfile:unchanged\nreboot:no\""
-  },
-  "gateway_restarted": false
-}
+  "session_cleanup": {
+    "stale_jsonl_removed": 228,
+    "cron_keys_removed": 0,
+    "note": "Removed orphaned .jsonl files not referenced in sessions.json. No sessions.json file present (no cron keys to clean)."
+  }
+}

memory/updates/2026-03-28.json

@@ -0,0 +1,40 @@
+{
+  "date": "2026-03-28",
+  "timestamp": "2026-03-29T01:00:00Z",
+  "maintenance_type": "nightly",
+  "results": {
+    "os_updates": {
+      "status": "completed",
+      "upgraded": 0,
+      "newly_installed": 0,
+      "removed": 0,
+      "not_upgraded": 0,
+      "details": "All packages up to date"
+    },
+    "claude_code": {
+      "status": "updated",
+      "previous_version": "2.1.81",
+      "new_version": "2.1.86",
+      "details": "1 package changed"
+    },
+    "openclaw": {
+      "status": "up_to_date",
+      "version": "2026.3.24",
+      "commit": "cff6dc9",
+      "details": "No update available"
+    },
+    "session_cleanup": {
+      "status": "completed",
+      "note": "OpenClaw 2026.3.24 uses new session management (empty registry is expected)",
+      "active_sessions": 112,
+      "deleted_marker_files": 113,
+      "orphaned_jsonl_removed": 0,
+      "cron_run_keys_removed": 0
+    }
+  },
+  "context_files_updated": [
+    "memory/working-context.md",
+    "memory/2026-03-28.md"
+  ],
+  "notes": "Quiet Saturday. Morning briefing delivered at 9:45 AM. No main session activity. Roos exam in 2 days (April 2)."
+}

memory/updates/2026-03-29.json

@@ -0,0 +1,29 @@
+{
+  "date": "2026-03-29",
+  "timestamp": "2026-03-29T09:00:00-04:00",
+  "openclaw": {
+    "before": "OpenClaw 2026.3.24 (cff6dc9)",
+    "latest": "2026.3.28",
+    "after": "OpenClaw 2026.3.28 (f9b1079)",
+    "updated": true
+  },
+  "claude_code": {
+    "before": "2.1.87",
+    "latest": "2.1.87",
+    "updated": false
+  },
+  "os": {
+    "available": "0\n0",
+    "updated": false,
+    "packages": []
+  },
+  "mission_control": {
+    "before": "v2.0.1",
+    "latest": "v2.0.1",
+    "updated": false
+  },
+  "caddy_pi": {
+    "result": "\"upgraded:1\n[master 9bac2de] auto: Caddyfile update 2026-03-29\n 1 file changed, 22 insertions(+), 7 deletions(-)\ncaddyfile:committed\nreboot:no\""
+  },
+  "gateway_restarted": true
+}

memory/working-context.md

@@ -1,75 +1,74 @@
-# Working Context — 2026-03-26
+# Working Context — 2026-03-29
 
 *Generated by nightly maintenance cron*
 
 ## Current Status
-- **Date:** Thursday, March 26, 2026
+- **Date:** Saturday, March 28, 2026 → Sunday, March 29, 2026 (UTC rollover)
 - **Time:** 9:00 PM ET (nightly maintenance window)
-- **Active Session:** Full day — Rozemarijn (Roos) study session + evening briefing
+- **Active Session:** Quiet Saturday — morning briefing delivered, otherwise no main session activity
 
 ## Active Projects
 
 ### 1. Rozemarijn (Roos) — Real Estate Research Exam Prep
-**Exam:** Thursday, April 2, 2026 — 2 hours, University of Groningen
+**Exam:** Thursday, April 2, 2026 — 2 days away — 2 hours, University of Groningen
 
-**Today's Progress (10:20 AM – 5:38 PM):**
-- ✅ **Lecture 7 COMPLETED** — Functional forms, endogeneity, IV/2SLS, Durbin-Wu-Hausman test, Chow test, interactions
-- 🔄 **Lecture 8 IN PROGRESS** — Slide 17 of 24 (4 tests overview: F-test, Chow, White's, RESET)
+**Progress from Friday (Mar 28):**
+- ✅ **Lecture 9 COMPLETED** — Logistic Regression (Van Duijn)
+- 🔄 **Lecture 10 PARTIAL** — Time Series I (Van der Vlist)
+  - Slides 1–5 covered
+  - Ch 6.6 (DW test), 6.7 (BG test)
+  - Ch 8: stationarity, AR/MA/ARMA/ARIMA
+  - Fisher-Gordon cap rate model (slides 10–21)
+  - **Next:** Resume from wherever Roos asks
 
-**Key concepts covered today:**
-- TRUE model vs restricted/unrestricted models
-- Chow test full calculation (wage differentials example, F=1.30, reject H₀)
-- CLRM assumptions A1–A5 (consistency vs efficiency tradeoffs)
-- Weak instrument test (F-statistic > 10 rule)
-- Always-show-formulas preference established
+**Materials in inbound:**
+- Lecture 10 slides: `/home/johan/.openclaw/media/inbound/bf38286f-9d2f-44c3-8131-6c0b2903ecef.pdf`
+- Brooks & Tsolacos textbook: `/home/johan/.openclaw/media/inbound/b133cc88-c8d9-41d9-83a3-359b9ccf83a6.pdf`
 
-**Still to cover (Lecture 8):**
-- Slide 18: F-test statistic formula
-- Slides 19-20: White's test for heteroskedasticity
-- Slides 21-24: Cross-sectional workflow + formative exercises
+**Practice files ready:**
+- `/home/johan/clawd/econometrics-practice-exercises.md`
+- `/home/johan/clawd/econometrics-practice-exercises-verhaal.md` (Dutch story format)
+- `/home/johan/clawd/econometrics-quick-drills.md` (English)
+- `/home/johan/clawd/formative-test-new-scenario.md` (exam-style)
 
-**Roos' notation preferences (STRICT — always follow μ not ε):**
-1. E(μₜ) = 0
-2. var(μₜ) = σ² < ∞
-3. cov(μᵢ, μⱼ) = 0
-4. cov(μₜ, xₜ) = 0
-5. μₜ ~ N(0, σ²)
-
-**Social commitments noted:** Paradiso performance Friday evening, concert Saturday evening
+**Notation rule:** Always μ (not ε or u) for error term. Language: English.
 
 ### 2. Mission Control (MC) — Agent Pipeline
-**Status:** Stable, monitoring engineer task outcomes with AQA pipeline
-- AQA (Automated QA) runs `go test ./...` on Clavitor tasks before Aegis review
-- BLOCKED detection moves tasks to blocked status (not review)
-- Project metadata with repo_path, test_cmd, lang for inou/clavitor
+**Status:** Pipeline bug FIXED and deployed on Friday
+- Tasks C-028 through C-033 confirmed staying `in_progress`
+- **Pending:** Tasks C-035–C-041 remain `failed` — Johan not yet answered whether to move/retry them
 
 ### 3. Clavitor — Credential Issuance Infrastructure
-**Status:** 3 pre-existing failing tests (C-055 module rename related)
+**Status:** 3 pre-existing failing tests still outstanding
 - TestTierIsolationDB, TestCollectPayload, TestPostTelemetry
 - Engineer needs to fix before AQA can pass
 
 ### 4. Linda — Agent for Jacques
-**Status:** PENDING — Discord bot token still needed from Johan
+**Status:** STILL PENDING — Discord bot token still needed from Johan
 - Workspace ready at /home/johan/linda/
 - Added to openclaw.json (Sonnet 4.6)
 
 ## Open Threads / Pending Decisions
 
-1. **Roos study continuation** — Resume Lecture 8 tomorrow (formative exercises critical)
-2. **Linda bot token** — Johan to create Discord bot app when convenient
-3. **Clavitor test fixes** — Waiting on engineer to resolve 3 failing tests
-4. **CLRM drilling** — Roos needs A1, A2, A3, A5 memorized before exam
+1. **Roos study continuation** — Resume Lecture 10 tomorrow (exam in ~2 days)
+2. **MC failed tasks** — C-035 to C-041: Johan to decide retry/abandon
+3. **Linda bot token** — Johan to create Discord bot app when convenient
+4. **Clavitor test fixes** — Waiting on engineer
 
-## Today's Significant Events
-- All-day study session with Roos (Lecture 7 complete, Lecture 8 partial)
-- Evening briefing generated and posted (market selloff, Claude Code v2, Trump/Iran)
+## Today's Significant Events (Mar 28)
+- **9:45 AM:** Morning briefing generated and delivered
+  - OpenClaw 2026.3.24 release noted (Teams/Discord/Slack improvements)
+  - N-able RSA 2026 AI SOC expansion
+  - UK data center energy grab story
+  - Trump Saturday emergency meeting speculation
+- Quiet Saturday otherwise — no other main session activity detected
 - Nightly maintenance running (this cron job)
 
 ## Notes for Tomorrow
-- Main session gets fresh start after 9PM gateway restart
-- Sophia care continues — night shift 10:30 PM – 5:00 AM
-- Resume Rozemarijn study session (finish Lecture 8, formative exercises)
-- Consider CLRM flashcards/drilling for Roos
+- Main session gets fresh start after 9PM gateway restart (by design)
+- Sophia care continues — night shift 10:30 PM – 5:00 AM (weekend till 7 AM)
+- **URGENT:** Resume Rozemarijn study session — exam is April 2 (~2 days away)
+- Resume from Lecture 10 progress
 
 ---
-*Context compiled from memory/2026-03-26.md*
+*Context compiled from session transcripts and memory files*

memory/x-watch-last.md

@@ -1,86 +1,84 @@
-# Last X Watch: 2026-03-27T10:19:00-04:00 (intra-day scan)
+# Last X Watch: 2026-03-29T14:08:00-04:00 (intra-day scan)
 
-## SCAN STATUS: ✅ COMPLETE — 6 items posted to dashboard
+## SCAN STATUS: ✅ COMPLETE — 4 items posted to dashboard
 
-Checked all 9 accounts. Found 6 genuinely new items since last scan at 2026-03-24 19:20 EDT.
+Checked 7 accounts. Last scan was 2026-03-27 10:19 EDT (5 days ago — broad scan).
 
 ---
 
 ## 🆕 NEW ITEMS (since last scan):
 
-### 1. OpenClaw 2026.3.24 Released — MAJOR ✅ POSTED
-**@openclaw** — Wed Mar 25 17:27 UTC
-- Improved OpenAI API: talk to sub-agents with @openwebui
-- New Skill & tool management Control UI
-- Slack interactive reply buttons
-- Native Microsoft Teams integration
-- Smart Discord auto-thread naming
-🔗 https://x.com/openclaw/status/2036857428273487903
+### 1. OpenClaw 2026.3.28 — Plugin Approval Hooks + xAI x_search ✅ POSTED
+**@openclaw** — Sun Mar 29 02:44 UTC
+- Plugin approval hooks: any tool can pause for user OK
+- xAI Responses API + x_search integration
+- ACP bind: Discord/iMessage
+- WhatsApp echo loop, Telegram splitting, Discord reconnect fixes
+- "Tokyo pre-ClawCon drop 🇯🇵"
+🔗 https://x.com/openclaw/status/2038084923517796839
 
-### 2. MiniMax M2.7 First AI Agent in Orbit — SPACE/AI ✅ POSTED
-**@MiniMax_AI + @OrbitAI_OAI** — Thu Mar 26 20:01 UTC
-- MiniMax M2.7 powers the first AI agent deployed in space
-- Running on orbital platform
-- "Earth was just the beginning. Space & AI is no longer sci-fi."
-🔗 https://x.com/MiniMax_AI/status/2037258665724698897
+### 2. Gemini 3.1 Flash Live — New Voice Model + March Drops ✅ POSTED
+**@GeminiApp** — Fri Mar 27 / Thu Mar 26 UTC
+- Gemini 3.1 Flash Live: "highest quality audio & voice model yet" (Demis Hassabis)
+- Import chat history/memory from other AI apps into Gemini
+- Video creation in Gemini app
+- Mic no longer cuts off when pausing on Android
+🔗 https://x.com/GeminiApp/status/2037561745649397805
 
-### 3. Kimi Attention Residuals at GTC — RESEARCH ✅ POSTED
-**@Kimi_Moonshot** — Thu Mar 26 03:33 UTC
-- Zhilin Yang presented at GTC
-- Extends attention to depth dimension (across layers), not just temporal
-- Models have selective memory throughout layer information transmission
-🔗 https://x.com/Kimi_Moonshot/status/2037010118957817988
+### 3. Cloudflare: AI Agents Ranking Among Top Hacking Teams ✅ POSTED
+**@Cloudflare** — Fri Mar 27 21:29 UTC
+- VP Chema Alonso (Black Hat, Def Con, 14x Microsoft MVP, ex-Telefónica) warns AI agents top hacking competitions
+- Discussion of what comes next for AI-driven offensive security
+🔗 https://x.com/Cloudflare/status/2037643314862686470
 
-### 4. Cloudflare Workflow Visualizations — FEATURE ✅ POSTED
-**@Cloudflare** — Fri Mar 27 13:05 UTC
-- Workflows now show visual step diagrams in dashboard
-- TypeScript code auto-translated to visual workflow representation
-🔗 https://x.com/Cloudflare/status/2037516256023077053
-
-### 5. OpenAI Codex Plugins Rollout — MAJOR ✅ POSTED
-**@OpenAI + @OpenAIDevs** — Thu Mar 26 22:41 UTC
-- Plugins rolling out for Codex
-- Works out of the box with major tools
-- App Server plugin for Telegram/Discord control
-- Usage limits reset across all plans
-🔗 https://x.com/OpenAI/status/2037298931907084568
-
-### 6. Alex Finn Claude Mythos Analysis — ANALYSIS ⚠️ POSTED
-**@AlexFinn** — Thu Mar 26 (QT of @M1Astra)
-- Claude Mythos reportedly "most powerful AI model ever created"
-- Considered cybersecurity danger by Anthropic
-- Significantly more expensive than Opus
-- Finn warns of AI wealth gap creating permanent underclass
-🔗 https://x.com/AlexFinn/status/2037024562477228054
+### 4. steipete: MCPorter 0.8.0 + OpenClaw Chrome Extension Removed ✅ POSTED
+**@steipete** — Sun Mar 29 02:04 UTC
+- MCPorter 0.8.0: stronger OAuth, valid JSON fallback, better daemon reliability
+- Chrome Extension removed since Chrome 144+ added native browser access natively
+🔗 https://x.com/steipete/status/2038074759527981416
 
 ---
 
-## SKIPPED (minor/non-technical):
+## SKIPPED (already covered in prior scans):
 
-- **Cloudflare Safenames sponsor** — Fri Mar 27 09:20 UTC — Marketing/event promo
-- **Cloudflare DNS propagation poll** — Fri Mar 27 08:55 UTC — Community engagement
-- **Cloudflare RSA LATAM partners** — Thu Mar 26 21:04 UTC — Event photos
-- **steipete** — Multiple Codex retweets — Covered by main OpenAI post
-- **OpenAI Model Spec podcast** — Wed Mar 25 17:20 UTC — Already covered previously
-- **realDonaldTrump** — No new content (last Feb 28)
+- **OpenClaw 2026.3.24** — covered Mar 27
+- **MiniMax M2.7 in orbit** — covered Mar 27
+- **Cloudflare Workflow Visualizations** — covered Mar 27
+- **OpenAI Codex Plugins rollout** — covered Mar 27
 
 ---
 
-## NO NEW ACTIVITY:
+## SKIPPED (minor/non-actionable):
 
-- **@ZhipuAI** — Still no new posts (last Jan 5 2025)
+- **Cloudflare ghost student fraud webinar** — marketing/event promo (Apr 16)
+- **Cloudflare Safenames sponsor event** — sponsor promo
+- **MiniMax M2.7 cost comparison tweet** — minor community RT
+- **MiniMax HumanX2026 keynote** — event promo (Apr 7)
+- **MiniMax open-sourced office agent skills** — interesting but >24h old
+- **steipete RT: Codex > Claude Code** — community opinion RT, no new info
+- **steipete RT: future of SaaS** — opinion/meme
+- **realDonaldTrump** — Still no new content (last post was Feb 28)
+- **OpenAI** — No new posts within 24h (most recent was Mar 26)
+
+---
+
+## BREAKING NEWS SEARCH:
+- Crypto: 122k traders liquidated, $451M losses in one day (options market)
+- Japan/US debt speculation in replies (not confirmed news)
+- No major verified market-moving events found
 
 ---
 
 ## NABL ACQUISITION CHECK:
-- No acquisition or PE takeover news found
+- No acquisition, PE takeover, or major NABL/N-able/SentinelOne news found
 
 ---
 
 ## PRIOR COVERAGE STILL VALID (reference):
 
-- OpenClaw 2026.3.23 — covered
-- Cloudflare Arm AGI CPU — covered
-- Cloudflare Forrester Wave Leader — covered
-- Alex Finn Telegram threading guide — covered
-- MiniMax M2.7 Three.js demo — covered
+- OpenClaw 2026.3.24 — covered Mar 27
+- MiniMax M2.7 in orbit — covered Mar 27
+- Kimi Attention Residuals at GTC — covered Mar 27
+- Cloudflare Workflow Visualizations — covered Mar 27
+- OpenAI Codex Plugins Rollout — covered Mar 27
+- Alex Finn Claude Mythos Analysis — covered Mar 27

scripts/airport-wait-monitor.sh

@@ -1,67 +0,0 @@
-#!/bin/bash
-# Airport TSA wait time monitor — TPA, JFK, EWR
-# Posts to Discord DM via OpenClaw HTTP gateway
-# Schedule: 6am, 10am, 2pm, 6pm, 10pm ET through Fri Mar 27 2026
-
-BIRD="/home/johan/clawd/scripts/bird"
-OC_URL="http://localhost:18789"
-DISCORD_USER="johanjongsma"
-LOG="/home/johan/clawd/memory/airport-wait-log.md"
-TIMESTAMP=$(date '+%a %b %d, %I:%M %p ET')
-NEXT_TIMES="6am · 10am · 2pm · 6pm · 10pm ET"
-
-echo "" >> "$LOG"
-echo "=== $TIMESTAMP ===" >> "$LOG"
-
-# ---- Web scrape wait times ----
-TPA_WEB=$(curl -s --max-time 10 "https://www.tsawaittimes.com/airport/TPA" 2>/dev/null | grep -oi '[0-9]\+ min' | head -1)
-JFK_WEB=$(curl -s --max-time 10 "https://www.tsawaittimes.com/airport/JFK" 2>/dev/null | grep -oi '[0-9]\+ min' | head -1)
-EWR_WEB=$(curl -s --max-time 10 "https://www.tsawaittimes.com/airport/EWR" 2>/dev/null | grep -oi '[0-9]\+ min' | head -1)
-
-# ---- X/Twitter search ----
-TPA_X=$("$BIRD" search "TPA Tampa airport TSA security wait" --max-results 3 2>/dev/null | grep -i "wait\|min\|hour\|line\|TSA" | head -3 | tr '\n' ' ')
-JFK_X=$("$BIRD" search "JFK airport TSA security wait" --max-results 3 2>/dev/null | grep -i "wait\|min\|hour\|line\|TSA" | head -3 | tr '\n' ' ')
-EWR_X=$("$BIRD" search "EWR Newark airport TSA security wait" --max-results 3 2>/dev/null | grep -i "wait\|min\|hour\|line\|TSA" | head -3 | tr '\n' ' ')
-
-# ---- News: government shutdown / travel chaos ----
-SHUTDOWN_NEWS=$(curl -s --max-time 10 "https://news.google.com/rss/search?q=TSA+airport+wait+government+shutdown&hl=en-US&gl=US&ceid=US:en" 2>/dev/null | grep -o '<title>[^<]*</title>' | sed 's/<[^>]*>//g' | grep -iv "google news" | head -3 | tr '\n' ' | ')
-
-# ---- Format output ----
-TPA_LINE="${TPA_WEB:-N/A}"
-JFK_LINE="${JFK_WEB:-N/A}"
-EWR_LINE="${EWR_WEB:-N/A}"
-
-# Log raw data
-echo "TPA web: $TPA_WEB | X: $TPA_X" >> "$LOG"
-echo "JFK web: $JFK_WEB | X: $JFK_X" >> "$LOG"
-echo "EWR web: $EWR_WEB | X: $EWR_X" >> "$LOG"
-echo "News: $SHUTDOWN_NEWS" >> "$LOG"
-
-# Build context note
-CONTEXT=""
-[ -n "$TPA_X" ] && CONTEXT="TPA social: $TPA_X"
-[ -n "$SHUTDOWN_NEWS" ] && CONTEXT="${CONTEXT:+$CONTEXT | }News: $(echo "$SHUTDOWN_NEWS" | cut -c1-200)"
-
-MSG="✈️ **Airport Security Wait Update** — $TIMESTAMP
-
-🔵 **TPA** (Tampa → Tanya departs Wed Mar 25): ${TPA_LINE}
-🟡 **JFK** (New York — Tanya arrives Wed Mar 25): ${JFK_LINE}
-🟢 **EWR** (Newark — Johan departs Fri Mar 27): ${EWR_LINE}"
-
-if [ -n "$CONTEXT" ]; then
-  MSG="$MSG
-
-📌 $CONTEXT"
-fi
-
-MSG="$MSG
-
-_Updates: $NEXT_TIMES_"
-
-# Post via OC gateway (Discord DM)
-curl -s -X POST "$OC_URL/api/message/send" \
-  -H "Content-Type: application/json" \
-  -d "{\"channel\":\"discord\",\"target\":\"$DISCORD_USER\",\"message\":$(echo "$MSG" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}" \
-  >> "$LOG" 2>&1
-
-echo "Posted at $TIMESTAMP" >> "$LOG"

scripts/git-audit.sh

@@ -55,19 +55,8 @@ audit_repo() {
     fi
   fi
 
-  # Auto-commit repos I own (skip inou — Johan's code)
-  if [ "$DIRTY_COUNT" -gt 0 ] && [ "$repo" != "inou" ]; then
-    git -C "$dir" add -A 2>/dev/null
-    git -C "$dir" commit -m "chore: auto-commit uncommitted changes" --quiet 2>/dev/null && {
-      AHEAD=$(git -C "$dir" rev-list --count "origin/$BRANCH..HEAD" 2>/dev/null || echo 0)
-    }
-    DIRTY_COUNT=0
-  fi
-
-  # Auto-push if ahead
-  if [ "$AHEAD" -gt 0 ] && [ "$repo" != "inou" ]; then
-    timeout 5 git -C "$dir" push origin "$BRANCH" --quiet 2>/dev/null && AHEAD=0 || true
-  fi
+  # NOTE: auto-commit and auto-push removed (C-007) — audit only, no mutations
+  # Commits must have meaningful messages written by the agent doing the work
 
   [ "$DIRTY_COUNT" -gt 0 ] && ANOMALIES+="⚠️ $repo: $DIRTY_COUNT uncommitted file(s)\n"
   [ "$AHEAD" -gt 0 ] && ANOMALIES+="🔺 $repo: $AHEAD unpushed commit(s) on $BRANCH\n"