docs: mark network module Phase 3 shipped + refresh manual-test checks

Record Phase 3 (diagnostics + speed test in the panel) as the dated event-log entry on its task: net speedtest plus the four-section panel. Refresh the manual-test checklist to the final settled bar-click scheme (left = panel, middle = portal, right = net-fix) and add the Phase 3 tab checks, including the speed-test run that confirms the byte-rate unit assumption.

The waybar network module is complete through Phase 3; Phase 4 (help/docs) and Phase 5 (VPN) remain as future work.

1 files changed, 40 insertions, 17 deletions

diff --git a/todo.org b/todo.org
index 2e3d97f..daf3625 100644
--- a/todo.org
+++ b/todo.org
@@ -154,15 +154,30 @@ green (32 suites). Live-verified on velox: panel opens/toggles, list shows real
 profiles, right-click notification delivers (Craig confirmed). Phase 3 (diagnose/repair/
 speedtest IN the panel) is next; the engine for it already exists from Phase 1.
 
-*** TODO Phase 3 — diagnostics + speed test in the panel :network:
-Deliverable: wire =net diagnose= / =net repair= / =net doctor= / =net portal= /
-=net speedtest= into the Diagnose (read-only) vs Repair (mutating, confirmed)
-sections; "Get me online" with live escalation reporting; portal Open button;
-speedtest (=speedtest-go --json=) progress + cancel; failure-mode → exact-string
-rendering across surfaces.
-Tests: diagnose read-only; each repair tier confirms + verifies cleanup (DNS
-override reverts → cleanup_verified, else cleanup-unverified); speedtest parse from
-fixture JSON + fixture stderr failure messages.
+*** 2026-06-29 Mon @ 22:43:40 -0400 Phase 3 shipped — diagnostics + speed test in the panel
+Shipped to dotfiles (=91277cf=..=691abcb=) + archsetup (=48052d6=, speedtest-go-bin),
+pushed. Engine: =net speedtest= (parses speedtest-go --json → ping from latency ns,
+down/up from per-server byte rates; missing-backend / offline / malformed → error
+envelope per the failure table). Panel grew a section switcher with four pages:
+- Connections (Phase 2).
+- Diagnose: =net diagnose= on a worker thread, each step a row (✓/✗/… glyph + title +
+  redacted evidence), read-only; Open-portal button when captive.
+- Repair: "Get me online" (=net doctor --fix=) + tiers (rfkill/reset/bounce/dns-test)
+  + force portal. Confirmations in-panel with the spec's exact wording; the privileged
+  tiers run via =net-popup= terminal (where the sudo prompt + step output, incl.
+  cleanup-verified, show) — a panel has no tty, and pkexec would mean a prompt per op.
+- Speed test: in-process =net speedtest= (no privilege → inline result: ↓/↑ Mbps + ping
+  + server), Run/Cancel (Cancel pkills the child), error envelope shown.
+
+213 net tests; pure helpers (step_indicator, format_speedtest) unit-tested. Full
+dotfiles suite green (32 suites). One unverified assumption: speedtest-go's dl/ul unit
+(taken as bytes/s; =BYTES_PER_SEC= flips it) — needs one real run vs a reference. The
+in-panel repair streaming (vs terminal) is a named future polish once the GUI-privilege
+story settles.
+
+The waybar network module ([#B] parent) is now COMPLETE through Phase 3. Phase 4
+(in-app help + user guide) and Phase 5 (VPN/WireGuard) remain as future work; the core
+feature (indicator + recovery + panel + diagnostics + speed test) is done.
 Verify (manual, live): see Manual testing and validation.
 
 *** TODO Phase 4 — docs + rollout :network:
@@ -822,17 +837,25 @@ rfkill list wifi         # confirm Soft blocked: yes
 make -C ~/.dotfiles online   # or: net doctor --fix
 #+end_src
 - Expected: doctor reports the rfkill block, runs =rfkill unblock wifi= + =nmcli radio wifi on=, reconnects, and ends "online" — all from the TTY.
-*** Network module Phase 1 — bar clicks + airplane keybind
-What we're verifying: the custom/net clicks do the useful thing and airplane is a deliberate keybind, not a misclickable foot-gun (it disconnects you). Clicks (revised after live use 2026-06-29): left = =net doctor --notify= (desktop notification, no terminal — diagnose is read-only), middle = nmtui scratchpad, right = =net portal= in a floating terminal (=net-popup=, so the sudo prompt + browser work). Airplane = Super+Shift+A. The sudo fix path (=net doctor --fix=) stays =make online= in a terminal.
-- Left-click =custom/net= while online.
-- Expected: a desktop notification "Network / Online" (success), nothing changed. When offline it notifies the problem + next action.
-- Right-click =custom/net= on a captive network (or at a hotel).
-- Expected: =net portal= runs in the floating terminal — reset + opens the portal page to log in.
-- Middle-click =custom/net=.
-- Expected: the nmtui scratchpad (manual connection manager).
+*** Network module — bar clicks + airplane keybind (FINAL scheme)
+What we're verifying: the custom/net clicks and the airplane keybind. Clicks (settled with Craig over live use 2026-06-29): left = =net-panel= toggle (the GTK panel), middle = =net portal= (floating terminal), right = =net-fix= (notify the doctor result when one-way; open a terminal only when fixable). Airplane = Super+Shift+A.
+- Left-click =custom/net=.
+- Expected: the GTK connection panel toggles open (left-click again, or Esc, closes it).
+- Right-click =custom/net= while online.
+- Expected: a desktop notification "Network / Online" (success), no terminal. When a repair is needed it instead opens a terminal running =net doctor --fix=. (Craig confirmed the notification delivers, 2026-06-29.)
+- Middle-click =custom/net= on a captive network.
+- Expected: =net portal= runs in the floating terminal — reset + opens the portal page.
 - Press Super+Shift+A.
 - Expected: airplane engages (wifi off, dim, low-power); =custom/net= shows the airplane glyph in gold. Super+Shift+A again restores everything.
 - Check =airplane-mode= is still present (=ls ~/.local/bin/airplane-mode=), and =waybar-airplane= / =waybar-netspeed= / =custom/airplane= are gone.
+*** Network module Phase 3 — panel Diagnose / Repair / Speed test tabs
+What we're verifying: the four-tab panel works end to end. Left-click =custom/net= to open it.
+- Diagnose tab → "Run diagnose".
+- Expected: a list of steps (link, DHCP, gateway, DNS config, DNS resolution, internet) each with a ✓/✗/… glyph + evidence; on a captive network an "Open portal" button appears.
+- Repair tab → click Reset (or Bounce, or DNS override test).
+- Expected: a confirmation dialog with the exact wording (Reset names the network + new-MAC warning; Bounce "links drop briefly"; DNS test "reverts automatically"). Proceed opens a floating terminal that runs the repair (sudo prompt there) and shows the step output incl. cleanup-verified for the DNS test.
+- Speed test tab → "Run speed test" (uses ~30s + data — do it on real wifi, not the metered hotspot).
+- Expected: ↓/↑ Mbps + ping + server shown inline. CONFIRM THE NUMBERS are sane vs a reference (fast.com) — this verifies the byte-rate→Mbps unit. If off by ~8x, the =BYTES_PER_SEC= constant in =net/src/net/speedtest.py= flips.
 
 ** DOING [#B] Prepare for GitHub open-source release
 :PROPERTIES: