reh3376 · reh3376 · Jun 8, 2026 · May 6, 2026 · May 6, 2026 · May 6, 2026
@@ -9,13 +9,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **Sprint NOSILENT-001 — Fail-loud scheduled jobs (no silent failures)** (2026-06-08). Triggered by a live-discovered silent failure: with `TSDB_BACKUP_ENABLED=true`, the backup scheduler ran every 24h, its `docker compose pg_dump` failing every time (docker not on the launchd PATH), surfacing only a buried `slog.Warn`. A core data-protection job, silently broken. This sprint kills the *class*.
+  - **V0024 `scheduled_job_events` hypertable** + synchronous `RecordJobEvent` writer (mirrors V0021). One row per run of a scheduled job: `job_name`, `success`, `latency_ms`, `error_message`, `metadata`. Schema 23→24.
+  - **`internal/jobhealth.Report`** — single policy point: record the outcome + fire a high-severity alert on failure (pool + dispatcher nil-safe). Wired into all three scheduled jobs: TSDB backup scheduler (decoupled result hook + server dispatcher), `maintenance` + `export-auto` (CLI → short-lived pool + file-backed dispatcher writing the same `~/.mdemg/alerts/current.json` the hooks surface).
+  - **Two server-native alert rules** over `scheduled_job_events`: `scheduled_job_recent_failure` (any failure in `JOB_FAILURE_LOOKBACK_MIN`) and `backup_no_recent_success` (zero successful backups in the staleness window — **the "job never ran" guarantee**, firing from the server observing *absent* success, gated on `TSDB_BACKUP_ENABLED`). Distinct alert services so the `(service, severity)` cooldown never lets one mask the other.
+  - **Config-driven** (no hardcoded literals): `JOB_HEALTH_ALERT_ENABLED` (default true), `JOB_BACKUP_STALENESS_HOURS` (0 → derive from backup interval × 2), `JOB_FAILURE_LOOKBACK_MIN` (60).
+  - **Live-verified (Tier 3):** induced a real `maintenance` failure → immediate alert + failure row + evaluator failure rule fired; the staleness rule fired for the never-succeeded backup; both surfaced as distinct alert-file entries. A live-caught cooldown-collision (both rules sharing one service → one masked the other) was fixed in-sprint. Feature doc: `docs/features/scheduled-job-health.md`. Sprint: `docs/development/nosilent-001/`.
+
+- **Sprint EVENTGRAPH-002 — Guidance-outcome federation (Pattern Y1, second event class)** (2026-06-08). Federates the guidance-outcome event stream: walk a constraint's Neo4j neighborhood, surface the time-windowed `constraint_outcomes` (followed/ignored/contradicted) for the constraint **and its graph-related constraints**. Answers "how well is this constraint and its conceptual cluster being followed?" — which `GetConstraintEffectiveness` (per-constraint, no neighborhood, no time-series) can't.
+  - **Endpoint:** `POST /v1/eventgraph/guidance-outcome-neighborhood`. **CLI:** `mdemg eventgraph guidance-outcome-neighborhood` (`--seed`/`--query`/`--hops`/`--since`/`--limit`/`--json`; table shows followed/ignored split + per-outcome code/outcome/sim/guidance_id, or `--json`).
+  - **Reuses the existing `constraint_outcomes` sink** — no new hypertable/writer/enqueue site (RRF-SCALE-001 already populates it). Data-decided: a parallel sink would duplicate populated data.
+  - **Joins graph↔events on `constraint_code`** (TSDB `constraint_id` is a UUID that doesn't match the Neo4j `node_id` CUID; code is the only viable key). Walk collects neighborhood codes → query `constraint_outcomes WHERE constraint_code = ANY(codes)` → Go-side join resolves each outcome's `constraint_node_id`.
+  - **Single-source refactor:** extracted the shared federation gate (`eventgraphGate`) + default-resolution (`resolveFederationDefaults`, hops/since/limit/ceiling) into helpers used by **both** the reinforcement and guidance-outcome handlers — one place to change the rules. Reinforcement endpoint un-regressed (UATS still 6/6 live).
+  - **Tests:** Tier 1 (`-race`: validation, empty-arrays-not-null, join, CLI request-mapping/render); Tier 2 (live integration round-trip hops=1/0/unknown-seed + UATS 6/6 live); Tier 3 (real binary cross-checked against direct SQL — **11 outcomes = 11, all followed**; the `--query` "0 outcomes" result traced to SQL ground truth as correct, not a join bug). Sprint in `docs/development/eventgraph-002/`. Feature doc: `docs/features/event-graph-federation.md`.
+
+### Changed
+
+- **TSDB schema version 23 → 24** (NOSILENT-001 V0024). Additive migration `024_scheduled_job_events.sql` adds the `scheduled_job_events` hypertable (scheduled-job run outcomes). `TSDB_REQUIRED_SCHEMA_VERSION` default bumped to 24. No data change; idempotent; rollback = `DROP TABLE` + revert the default.
+
+- **TSDB schema version 22 → 23** (EVENTGRAPH-002 V0023). Additive migration `023_constraint_outcomes_code_index.sql` adds `idx_constraint_outcomes_code (space_id, constraint_code, time DESC)` to back the guidance-outcome federation join. `TSDB_REQUIRED_SCHEMA_VERSION` default bumped to 23. No data change; idempotent; rollback = `DROP INDEX` + revert the default.
+
 - **Sprint EVENTGRAPH-CLI-001 — `mdemg eventgraph reinforcement-neighborhood`: the first consumer of the federation API** (2026-06-08). EVENTGRAPH-001 shipped the `POST /v1/eventgraph/reinforcement-neighborhood` federation endpoint but nothing consumed it. This sprint ships the operator-facing CLI consumer + a live-testing harness for the EVENTGRAPH line (002/003 follow on).
   - **CLI:** `mdemg eventgraph reinforcement-neighborhood` walks the graph from a seed and renders the reinforcement (Hebbian co-activation) events touching that neighborhood — a summary + table (`new` column = `created_new_edge`, `nbhd` = which endpoints fell inside the N-hop walk), or `--json` for piping. Seed via `--seed n_…` or `--query "<text>"` (resolves the seed from the top `/v1/memory/retrieve` result). `--hops`/`--since`/`--limit` are **omitted from the request when unset** so the server applies its own config defaults — no second copy of the defaults hardcoded in the CLI (single source of truth).
   - **UATS contract:** `eventgraph_reinforcement_neighborhood.uats.json` (6 cases, validated 6/6 live) backfills the contract-test gap EVENTGRAPH-001 left: happy-200 response shape, required-field 400s, negative-hops 400, over-ceiling 400, GET 405. sha256-hashed.
   - **Live verification (Tier 3):** the real binary against the real stack surfaced **20 reinforcement events in a 5-node neighborhood**, demonstrating the full Hebbian-write → federation-read loop closing in one command (the `--query` retrieval fired `ApplyCoactivation`, and the federation read those very events back). `--limit` truncation, `--json`, unknown-seed, and no-arg error paths all verified live. See `docs/development/eventgraph-cli-001/verification.md`.
 
 ### Fixed
 
+- **`docker` CLI unresolvable under the launchd minimal PATH — server-runtime shellouts silently failing** (2026-06-08). The native server (launchd) inherits `PATH=/usr/bin:/bin:/usr/sbin:/sbin`, which excludes the Docker Desktop symlink (`/usr/local/bin/docker`). Two server-runtime `docker` shellouts failed with "executable file not found in $PATH": (1) Neo4j container CPU/mem stats logged an ERROR every 60s and left the `neo4j_container_*` gauges empty (so the `neo4j_high_cpu/_memory` alert rules had no data); (2) the TSDB backup scheduler's `docker compose pg_dump` failed with only a `slog.Warn`. The data plane was never affected — Neo4j (Bolt) + TSDB (pgx) connect over mapped TCP ports, not the docker CLI. Fix: new `internal/dockerbin` resolver (`MDEMG_DOCKER_BIN` env → `exec.LookPath` → well-known install locations → graceful unavailable), wired into both shellouts; the perpetual ERROR downgraded to a one-shot WARN when docker is genuinely absent; a sane `PATH` added to the launchd server plist template. Live-verified: container gauges now land in `metric_samples`; backup resolves docker under a simulated minimal PATH. (`export-auto` was **not** a victim — it exports via network SQL, not docker.)
+
 - **`neighbor_node_ids` serialized as `null` (not `[]`) for an empty neighborhood — caught in EVENTGRAPH-CLI-001 live contract testing** (2026-06-08). `eventgraph.walkNeighborhood` returns a nil slice when the seed has no neighborhood (e.g. an unknown seed), which JSON-marshals to `null`, while the sibling `events` field was already initialized to `[]`. Both are array fields and must serialize consistently — `null` breaks any consumer asserting an array type (incl. the new UATS contract's `type_is array`). `EventsInGraphNeighborhood` now coalesces the nil slice to `[]string{}`; `TestFederationResult_EmptyArraysNotNull` pins the contract. Standard Go unit tests missed it (they don't marshal the empty result); the live UATS happy-path against the running server caught it immediately — its own fix-commit per the live-smoke precedent.