🚧 WIP

CHANGELOG.md

@@ -6,6 +6,28 @@ bump per [SemVer](https://semver.org/). Dates are YYYY-MM-DD.
 
 ## [Unreleased]
 
+### Added — Phase 2 reporters
+- Rotating JSONL evidence log: one JSON event per line, config-digest header
+  for provenance, size rotation with backups retained.
+- Plain-text anomaly log (spec §9.1): `anomalies-YYYYMMDD.log`, one line per
+  detected anomaly in `timestamp  SEVERITY  KIND  message` order with clear-text
+  statuses; recoveries included so the file reads as an incident narrative.
+- Windows Event Log sink: severity-mapped (INFO/WARN/CRITICAL →
+  Information/Warning/Error), WARN+ by default, delivery verified live.
+- Optional HTTP webhook (`report.http`): bounded queue + daemon sender thread,
+  per-event POST with bearer auth; failures dropped and counted — never blocks
+  the poll loop.
+- Reporter fan-out dispatcher: every sink isolated (one failing sink never
+  kills the others or polling); the `run` verb wires all configured sinks.
+
+### Fixed
+- Windows Event Log reporter initially lost every event silently:
+  `win32evtlog.ReportEvent` takes **positional arguments only** (keyword calls
+  raise `TypeError`, swallowed by the sink's own isolation) — now uses a
+  `RegisterEventSource` handle with positional calls (live-verified).
+- HTTP webhook in injected-`post` mode raised into the poll loop on a failing
+  POST; both modes now count-and-drop.
+
 ### Added — Phase 1 core engine (the continuous monitoring loop)
 - `run` verb: the foreground monitoring loop — coordinator + dedicated COM
   worker thread (the client is born on the worker; COM is per-thread),