Stabilise riskoff for release: eliminate unexplained errors

Destination

A release-ready codebase with no unexplained errors in the riskoff PC logs: every ERROR/WARN class diagnosed and fixed-or-accepted, verified by a clean production run. The cron→report pipeline (cron run → Telegram report) works end-to-end with zero silent drops.

Notes

• Scope: cron→delivery→report pipeline + prefilter + claude_health + the stderr-drain noise (both worker and cron copies). Provider composition and other subsystems are out of scope.
• Repo conventions: AGENTS.md (Rust standards, verification cadence, architecture split). Plan first; do not fix until tickets resolve and the approach is proven empirically.
• Skills per ticket: grilling + domain-modeling for decisions; research for the shared wait_with_output hang; prototype for the live probe.
• Log source: ~/.right/logs/riskoff.log.2026-08-*, PC logs via ~/.right/run/state.json + PC API, aggregator log right-mcp-server.

Decisions so far

• Diagnose delivery subprocess exit-1 and 120s timeout — transport never relays guest exit to host wait_with_output; fix: break-on-result + kill.
• Diagnose prefilter 30s timeout on json output path — same transport hang, 30s budget.
• Suppress stderr-drain timeout noise on success paths — downgrade to debug in worker+cron, fix stale "ssh" comment.
• claude_health false-fails — rename to honest MCP-init signal, log full exit/stderr on failure.
• cron reflection exit-1 cascade — keep reflection, fix its transport, skip for deterministic failures.
• Probe: does stream-json exit where json-mode hangs? — directionally right; production logs now prove it directly. Transport never relays exit to host. Fix = break-on-result + kill.
• Release-readiness gate: define 'no unexplained errors' — 24h prod soak + curated allowlist; zero unexplained = ready.
• Fix delivery and prefilter json-mode hang (break-on-result + kill) — root cause CONFIRMED from prod logs: result envelope lands ~45s after spawn, ExecEvent::Exited never fires; break-on-result + kill at async_delivery.rs:1145 and learning_prefilter.rs:559. Ready to implement.
• Land claude_health honest-signal rename and failure diagnostics — DONE: ClaudeHealth→McpInitHealth, logs claude_health:→right_mcp_init:; probe stderr piped + bounded 2 KiB tail excerpt in failure error alongside exit code; still non-billable.
• Skip cron reflection for deterministic failures — DONE: failure arm calls skip_reflection_decision; 529/429/5xx/turn-limit classified results skip the futile --resume turn and report the classifier's user message; unclassifiable failures still reflect.
• Delivery relay leaks "send_message not available" note into content — follow-up: relay model attempts mcp__right__send_message (correctly disallowed) and leaks a "Delivery note" into user-facing content. Blocked by #189.

Not yet specified

All execution tickets have landed (#183–#187, #189, #190–#194; #189/#191 closed). The frontier is the release gate itself: run the 24h production soak and curate the error allowlist per #188.

Out of scope

• Provider composition/credential subsystem (right_openshell::providers, dashboard) — separate ownership.
• Historical ssrf_denied network-policy errors — pre-fix era, not reproducing.
• Telegram API delete_my_commands channel rejection — accepted noise.
• Historical delivery exit-1 fast-fail (auth/ssrf, SSH era) — distinct root cause, gone since microsandbox cutover.

Start with AGENTS.md, issue #188, and the production logs at ~/.right/logs/riskoff.log.2026-08-*, using ~/.right/run/state.json, the PC API, and the right-mcp-server aggregator log to classify every ERROR/WARN during a 24-hour soak. Done means a curated allowlist, no unexplained errors, and an end-to-end cron-to-Telegram report with zero silent drops.