Exc1D · Exc1D · Apr 28, 2026 · Apr 28, 2026 · Apr 28, 2026 · Apr 28, 2026
diff --git a/docs/learnings.md b/docs/learnings.md
@@ -30,13 +30,15 @@
 - Fail explicitly on missing auth/scope; no permissive fallbacks.
 - Normalize fields on both read and write paths.
 - Verify Firestore Rules function signatures match call sites.
+- Staff MFA audits must inspect `multiFactor.enrolledFactors` directly; `CustomClaims.mfaEnrolled` can record intent, but custom claims are not the source of truth for current TOTP enrollment or factor type.
 - Staff MFA audits must inspect `multiFactor.enrolledFactors` directly; custom claims only describe role and access, not whether TOTP is actually enrolled.
 
 ## Testing
 
 - `vi.hoisted()` mocks must be created inside the hoisted callback.
 - `requestAnimationFrame` in Vitest: capture callback explicitly, don’t assume timers.
 - A passing test is not enough; confirm it exercises the changed path.
+- BigQuery summary jobs should keep the core dependency-injected; mocking `query()` directly is simpler than testing the scheduler wrapper.
 - Never mix Admin SDK and Client SDK Firestore calls in the same context.
 - Callable error handling: use runtime client code (`not-found`), not internal enum names.
 - Wrap `waitFor(() => expect(...))` assertion body in braces to avoid `no-confusing-void-expression`.

diff --git a/docs/progress.md b/docs/progress.md
@@ -83,6 +83,7 @@
 - **Code quality + security refactor (2026-04-23)** — 14 `catch (err: unknown)` conversions, error logging improvements, 8 new https-error tests.
 - **Phase 5 Responder MVP (2026-04-23)** — Decline callable, queue/detail hooks, Playwright smoke (6 pass, 4 skipped). Fixed stale `enforceAppCheck` binary causing E2E `internal` error.
 - **3-Step Wizard Wiring (2026-04-23)** — WizardContainer + SubmissionPanel. 101 tests pass.
+- **Phase 8B cost snapshot writer (2026-04-28)** — Scheduled BigQuery summarizer now writes `costSnapshot` into `system_health/latest`; focused writer test passes.
 - **Citizen PWA Firebase env fallback (2026-04-22)** — Graceful degradation when `VITE_FIREBASE_*` vars missing.
 - **Map Tab (2026-04-22)** — Full Leaflet implementation with public incident + own-report layers.
 - **PR #56 Review Fixes (2026-04-22)** — 18 fixes across citizen PWA: guard empty report ref, canvas blob preview for CodeQL, offline state fixes, schema alignment.