Close the loop: sensors (pH, EC, temperatures, level, flow) and dosing pumps (nutrients, pH, top-off) with hard safety limits; suggest first, then auto; the crew can drive it via MCP #586

Owner 2026-10-26: "eventually i will want to get some sensors so the system can handle this. dispensers would be great too so the forge/crew can fully automate."

The closed loop: sensors measure, dosers act, and the app (or the forge crew through the app's API/MCP) decides, inside hard limits. It builds on #585's Reading interface and #582's Switch.

Sensors (one driver each, auto-detected, each a Reading source; manual entry stays as the fallback):

• Water temperature DS18B20 (1-Wire).
• Air temperature/humidity SHT31 or BME280 (I²C).
• Reservoir level: float switch, plus optional ultrasonic for litres.
• pH and EC probes via ADS1115, with guided calibration (4.0/7.0 buffers; 1413 µS/cm) and temperature compensation from the DS18B20. The app tracks the calibration date and reminds monthly.
• Pump flow or "water reached the top" (a float at the emitter), for the pump-off alarm.

Dispensers: peristaltic dosing pumps (12 V, through a relay or MOSFET board) for nutrient A, nutrient B, pH down (and pH up only if needed), plus a top-off pump from a fresh-water jug. Each pump has a measured ml/s calibration.

Safety is the point:

1. Hard limits per day and per dose (ml), configured on /admin. The app refuses beyond them and alerts.
2. Dose → wait → re-measure. Wait for the pump to mix (≥10 min). Never dose twice on one reading; never dose on a stale (>30 min) or uncalibrated reading. pH down only after the nutrients are mixed.
3. Sanity checks: a reading outside physical bounds, or a dose that didn't move the reading as expected, stops automation and asks the owner.
4. Modes per loop: off → suggest (the app says "add 3 ml pH down", and the owner taps Do it) → auto. It ships in suggest.
5. Every action is logged in the log book (#585) with its cause (rule, crew, owner).
6. Top-off stops on the high float or a time cap, whichever comes first (no flooding).

Forge/crew control: the app exposes readings, log, suggest_dose and dose (in auto mode, still bound by the limits) through its MCP. A crew agent can read the trend and propose or act, and the limits live on the Pi, not in the agent.

A parts list (README "Sensors & dosing"): the exact modules, wiring to the Pi GPIO/I²C, and the price each. It's the start of a kit BOM.

Done when: the drivers with fakes; the calibration flows; the dose controller with the limits/wait/re-measure state machine; suggest mode end to end; the MCP tools. Tests: a dose refused over the daily limit; no dose on a stale reading; the stop on an unexpected response; top-off stops at the float; suggest mode never actuates.

Order: after #585 (care) and #582 (switches). Each sensor or doser driver is a small separate pull.

Planner: this no longer waits on #582. Its grow light is done on main in 82337a2 (#596), and the Switch interface this needs is there. It now waits only on #585.

Parked by the crew: the preview's deploy failed and the decider saw no point in another try try 1: Software/so101/README.md, Software/so101/bench/fake-serve.ts, Software/so101/src/absent-arm.test.ts, Software/so101/src/absent-bus.ts (+34 more) (pull #604 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Done on main already, waiting for you to close it: 49a9eb7baadedc256744cb4616a4997000b34ccf d2bae2e95137fa29d4816812556ada5567c8c807 f8a754381583ffbced4a83f33d793c66ed215c9b fa0051d0073b9659eb3e652feff365a59d8d01de 73a59b838fbb7fe04ae5237fc2d32386c1e6adef

Closed: already done on main in 49a9eb7, d2bae2e, f8a7543, fa0051d, 73a59b8. Closed by the crew's live triage; reopen it to undo, and it stays open.