13 — Expose outbox backlog, failures, metrics and safe retries

## Objective Operators can distinguish committed voting state from incomplete delivery, see failures/retries and recover work without resubmitting user commands. ## Existing locations and reuse app/services/voting_engine/{diagnostics,debug_overview}.rb; app/controllers/admin/voting_operations_controller.rb; app/views/admin/voting_operations/show.html.haml; app/components/badge_component.rb; config/initializers/yabeda.rb; docs/voting_engine_operations.md. Existing staff/meeting permissions withhold details if any case is unreadable. Diagnostics[:issues] currently gates participant corrections; delivery outages must not become canonical voting inconsistencies. ## Changes - Proposed Outbox::Status shared bounded query for page, console and rake output. Expose pending/processing/retrying/blocked counts, oldest outstanding age, event/receipt ID, command/effect, attempts, next attempt, lease expiry, sanitized error and completion/skip distinction. Prioritize outstanding records; avoid loading unbounded history. - Extend existing operations page (no parallel admin dashboard). Use BadgeComponent and existing styles/partials; follow styleguides and confidential-case restrictions. Keep raw payloads, addresses, Teams URLs, credentials and sensitive exception bodies out of output. - Keep delivery diagnostics separate from Diagnostics[:issues]; outages do not disable ordinary audited corrections. - Structured logs/Sentry context carry IDs and sanitized codes. Add bounded-cardinality backlog/age/failure metrics via Yabeda, never event/meeting ID labels. Include recovery-sweep health so a dead scheduler is detectable. - Proposed lib/tasks/voting_engine_outbox.rake tasks voting_engine:outbox:status and voting_engine:outbox:retry[delivery_id]. Retry only eligible incomplete work by adjusting schedule; never clear successful effects, mutate receipts or blindly retry ambiguous remote creation. Record operator retry context where available. - Update operations/core docs: automatic recovery, expected latency, blocked/error meaning, retry procedure, escalation, scheduler/queue requirements; remove manual-refresh-only claim. - All new copy through bin/translation with nb, nn, sme, pl, en and da. Never hand-edit YAML; validate keys. No generic unauthorised retry endpoint is required. ## Acceptance and tests Extend diagnostics_spec.rb, debug_overview_spec.rb, admin voting operations controller/system specs; proposed spec/tasks/voting_engine_outbox_spec.rb. Verify accurate counts/states, bounded query, sensitive-data redaction, restricted access, no voting-health contamination, retries preserve successes and reject unsafe states. Run bundle exec rspec spec/services/voting_engine/diagnostics_spec.rb spec/services/voting_engine/debug_overview_spec.rb spec/controllers/admin/voting_operations_controller_spec.rb spec/tasks/voting_engine_outbox_spec.rb; yarn build:js; yarn build:css; bundle exec rspec spec/system/voting_operations_spec.rb; bin/translation validate voting_engine.operations; RuboCop changed Ruby. ## Depends on https://task.matda.me/tasks/tsk_5t6us3yxjk — ledger states. https://task.matda.me/tasks/tsk_beu5nmfqfj — retry/lease behavior. Provider tasks supply safe retry classifications and final runbook details. ## Questions - Which existing monitoring/alert destination should receive sustained backlog, blocked delivery and missing-sweep alerts at rollout? Reuse deployed monitoring where discoverable; obtain operator ownership if not documented. - No product decision is needed to expose status through the existing restricted operations page and console/rake tooling; do not broaden permissions.