@mono-agent/web 0.20.14 → 0.21.0

package/README.md

@@ -24,6 +24,15 @@ Catalog responsibility: Serves the always-on browser operator console for persis
 - Persist agents, threads, messages, structured reasoning/tool/telemetry parts,
   revisions, turns, attachments, and agent pin preferences under
   `~/.mono-agent/web`.
+- Persist optional per-agent model/effort defaults for new interactive web
+  threads, copied at creation and clearable back to resolved config.
+- Preserve each turn's requested, attempted, and answering route plus the Pi
+  wrapper's effective thinking level, and project bounded fallback/retry
+  attribution without exposing raw provider diagnostics.
+- Proxy ephemeral, exact-origin provider-auth status and login sessions to the
+  currently connected capability-advertising agent without storing credentials,
+  prompt input, or session projections. The client omits authorization for an
+  agent with no operator API key and sends the discovered bearer when one exists.
 - Let an MCP-capable agent replace the interim first-message title with a short
   semantic title and evolve it after a material topic shift, while treating any
   user rename as a permanent lock.
@@ -31,7 +40,20 @@ Catalog responsibility: Serves the always-on browser operator console for persis
   opaque-artifact metadata carried by structured agent stream events; web
   SQLite remains a client cache, not the canonical lifecycle store.
 - Keep an upstream turn running when a browser reloads or disconnects, and expose
-  state invalidations over SSE so any connected browser can catch up.
+  content deltas plus rate-limited change hints over SSE so any connected browser
+  can catch up without reloading what it already holds.
+- Project foreground outcomes and retained background-job activity into conversation
+  rows. Current work and failures take priority over reply previews, including for
+  closed conversations and job cards outside the loaded message page.
+  Silent assistant-only host wakes retain the previous meaningful outcome for
+  this priority, without changing their actual run status or completion time.
+  The optional `runState.lastOutcome` is derived from retained user-message
+  provenance and visible reply content; `null` means no prior outcome, while
+  absent metadata preserves compatibility with older cached summaries.
+- Shape projected transcripts at the service boundary — drop non-allowlisted
+  telemetry payloads, and preview oversized tool arguments/results with their
+  byte count and a digest — while serving the whole part from message-bound
+  routes and honoring `?full=1` as the unshaped escape hatch.
 - Offer plain-text follow-ups to a capable active provider run, persist their
   pending/applied/queued state, and promote safe fallbacks into normal turns.
 - Render a running agent's structured `AskUser` interaction by exact
@@ -52,17 +74,43 @@ Catalog responsibility: Serves the always-on browser operator console for persis
   channel per `(sourceId, jobId)` and reconcile all run states from the agent.
 - Accept exact-source/thread process-job notifications through the same private
   ingress, update one durable job card in place without a verbatim-history
-  append, and proxy thread job refreshes through the agent's independent owner
-  operator capability.
+  append, and poll its bounded redacted live output tail through the agent's
+  independent owner operator capability without persisting each output chunk.
+  The browser collects cards from the loaded message window in one
+  conversation-level stack after the transcript. Queued, starting, and running
+  cards stay visible by default; terminal cards remain mounted behind
+  expandable history so status counts and live transitions stay current.
+  When a loaded launching `Exec`/`Bash` call has its exact persisted machine
+  receipt, that response's Activity also shows its actual start row. The
+  terminal row appears where the exact wake was consumed: at the steered point
+  in an active response or first in a follow-up response. If no retained wake
+  marker exists, the terminal row falls back beside the launch. These rows
+  never poll or duplicate card output; legacy or paginated-out launch receipts
+  remain stack-only.
 - Accept exact-source/thread Monitor wakes through that private ingress, steer
   them into the active run or serialize one assistant-only follow-up, retain
   delivery identity plus a payload hash for fail-closed duplicate handling, and
-  group their secret-free projections into one compact Monitor activity row per
-  assistant run. Raw event text and delivery keys never reach the rendered row;
-  Monitor wakes have no browser-side stop control.
+  group their secret-free projections into compact Monitor activity. The
+  browser presents adjacent activity-only follow-ups for the same watch as one
+  continuous Activity block; a visible reply or unrelated message ends that
+  block. Raw event text and delivery keys never reach the rendered row; Monitor
+  wakes have no browser-side stop control. For a verified Monitor wake, a
+  terminal no-op assistant message is suppressed while an earlier meaningful
+  answer and rich content remain visible. Push delivery waits for an outstanding
+  steering receipt and uses the normalized reply. Monitor callbacks use the
+  independent owner credential derived from the advertised private state directory.
 
 ## Install / Usage
 
+Process-job completion replies suppress only an exact sentinel-only terminal
+message with a verified wake association; narration and rich replies remain
+visible. Silent replies create no response push. A web wake receipt confirms
+that steering was applied or that the agent accepted the exact follow-up turn
+request, which is also when the wake's host-owned chain depth and background
+starts bind to it; the turn's later model outcome remains separate. Job cards
+distinguish an unknown pre-confirmation receipt from failure and explain that
+replay was suppressed.
+
 `@mono-agent/agent-app` provides the normal managed-service lifecycle:
 
 ```bash
@@ -71,12 +119,21 @@ mono-agent web status
 mono-agent web
 ```
 
+The server and the webapp ship as one artifact — this package serves the bundle
+built beside it — so `mono-agent web restart` re-stages both and they always
+upgrade together. A console build older than the bootstrap and delta protocol
+below cannot read this server, and an installed PWA picks up a new build only
+when its staged service worker is applied.
+
 Bare `mono-agent web` reports status and usable URLs; it does not implicitly
 start or mutate the service. Use `mono-agent web run` for a foreground process
 or `--loopback` to bind only `127.0.0.1`. The curated `--theme` values are
-`evergreen` (default), `ocean`, `plum`, and `terracotta`. Managed starts persist
-the selection, restarts retain it unless explicitly replaced, and `web status`
-reports the effective theme.
+`evergreen` (default), `ocean`, `plum`, and `terracotta`. `--name <label>` sets
+the console label used for the installed PWA name/short name, browser title, and
+rail brand, defaulting to the machine hostname. Managed starts persist both
+selections, restarts retain them unless explicitly replaced, `--name -` clears
+the stored label back to the hostname default, and `web status` reports the
+effective values.
 
 Install this package directly only when embedding the server in another host:
 
@@ -97,13 +154,14 @@ who can reach port 5050 can inspect conversations and operate discovered agents;
 use host firewall/LAN policy and Tailscale ACLs as the access boundary. The
 server emits no CORS permission and rejects cross-origin mutations.
 
-The service derives its console identity from the operating-system hostname.
-That hostname replaces the generic mono-agent brand in the desktop/mobile
-header, prefixes the browser title, and becomes the installed PWA name. The
-selected theme changes shell and accent colors while keeping content, status,
-warning, and danger semantics consistent across hosts. The generated PWA
-manifest remains network-fetched rather than service-worker-cached so its host
-identity cannot be masked by a generic build-time manifest.
+The service uses the operating-system hostname as its machine identity and as
+the default display name. An operator-selected `name` replaces that default in
+the desktop/mobile header, browser title, and installed PWA name while the
+hostname continues to key browser cache ownership. The selected theme changes
+shell and accent colors while keeping content, status, warning, and danger
+semantics consistent across hosts. The generated PWA manifest remains
+network-fetched rather than service-worker-cached so its console identity cannot
+be masked by a generic build-time manifest.
 
 Private IP literals, localhost, the machine hostname, and its exact `.local`
 name are accepted as browser hosts. Set `MONO_AGENT_WEB_ALLOWED_HOSTS` to a
@@ -114,18 +172,47 @@ managed agent protects its loopback operator endpoint, discovery reads only
 
 On desktop, the agent rail has fixed compact and expanded layouts selected by
 an explicit expand/collapse control. That choice is remembered by the browser.
-Offline agents are hidden behind a subtle count by default; pinned agents and
-the currently selected agent remain visible even while offline. The same
-filter applies to the desktop rail, mobile picker, and command palette. Pin or
-unpin with the star control; pins live in the web service so favorites stay
-consistent over localhost, LAN, and Tailscale.
-
-The assistant-ui run-settings popover combines searchable model selection with
-the selected model's supported reasoning-effort choices and becomes a
-viewport-safe bottom sheet on narrow screens. Exact choices come from the
-running agent's startup capability snapshot; when a model does not advertise
-exact levels, the console offers provider/config default only instead of the
-global effort ladder. Usage telemetry remains internal
+On narrow touch screens, a deliberate right swipe across the unoccupied chat
+surface or ordinary unselected transcript text opens the conversation drawer.
+A left swipe across either open navigation drawer closes it. Controls, active
+text selections, inputs, and any native horizontal scroller keep their normal
+touch behavior; short drags and vertically dominant scrolling do not trigger
+navigation. The two header navigation controls remain available as 44-pixel
+touch targets.
+Offline agents that remain in the current discovery result are hidden behind a
+subtle count by default; pinned agents and the currently selected agent remain
+visible even while offline. An agent omitted by a successful discovery refresh
+is removed from every picker and from that count regardless of its prior pin or
+selection. Its rows, conversations, and pin stay retained in SQLite and return
+if the same source id is discovered again. The same filter applies to the
+desktop rail, mobile picker, and command palette. Pin or unpin with the star
+control; pins live in the web service so favorites stay consistent over
+localhost, LAN, and Tailscale.
+
+The single-row mobile header keeps navigation, title, notifications, and a
+conversation actions menu together. Run settings sit beside **Send** in the
+composer, where the compact trigger shows only the resolved model and effort.
+Its popover combines searchable model selection with the selected model's
+supported reasoning-effort choices and becomes a viewport-safe bottom sheet on
+narrow screens. Model rows use the configured
+display name when present and otherwise use the running agent's catalog name.
+Choosing a model applies it immediately while keeping the popover open for an
+effort choice; the explicit **Close** action finishes the interaction.
+Pointer/touch opening and model or effort changes do not focus the search input;
+keyboard opening retains search navigation. Local LM Studio and Ollama models
+confirmed as embedding-only by native metadata are omitted from chat choices.
+Unknown metadata preserves compatibility; model names are not used as a heuristic.
+A persisted catalog-only selection stays visible by its canonical reference when
+lazy provider metadata is absent, fails, or omits that model. While no metadata
+describes that model at all, its current effort and the shared compatibility
+ladder the agent accepts remain controllable, without reverting to the agent
+default; once exact metadata loads it supplies the catalog display name and the
+advertised ladder, which may narrow, keep, or remove those choices. Exact choices
+come from the running agent's startup capability snapshot. Silence about a model
+is not a claim and keeps the compatibility ladder, but metadata that marks a
+model as reasoning-capable without enumerating its levels hides the effort
+control entirely, default row included, rather than guessing cloud grades.
+Usage telemetry remains internal
 and is summarized through a context display that keeps exact Pi, Codex,
 OpenCode, and ACP provider-request snapshots separate from last-turn processed
 tokens and conversation cost. Running turns are labeled `Updating`; failed
@@ -133,9 +220,68 @@ turns and model changes are `Last measured`. A running or successful compaction
 suppresses the older number until the next exact snapshot, while legacy and
 unsupported-runtime threads show `Context —` instead of deriving a percentage
 from aggregate work.
-Structured reasoning, routine tools, and one update-in-place row per compaction
-share the stream-aware Activity disclosure, which collapses at every terminal
-message state without reordering answer parts.
+Structured reasoning, routine tools, process-job lifecycle evidence, and one
+update-in-place row per compaction share the stream-aware Activity disclosure,
+which collapses at every terminal message state without reordering answer
+parts. Receipt-bearing job launches keep their start row beside the exact
+launch call. Their terminal row follows the consumed wake chronologically, with
+launch-adjacent placement only as a fallback when no wake marker was retained;
+ordinary adjacent same-tool calls retain their existing clustering.
+
+The picker is labelled **Next turn**. The conversation header carries no run
+attribution. Below an assistant message, a normal route marker appears only when
+the model that ran differs from the conversation's current selection. A fallback
+warning always appears there, even when its answering model matches the current
+selection, and names requested and answering models plus the classified reason
+when the runtime supplied one. Expanding the marker shows the bounded route
+chain, same-model retries, route-level effort, and Pi's actual effective thinking
+level. Configured subagents keep independent attribution in their own Activity
+row. The browser never infers a fallback from selector state, and the
+route-attribution payload never carries raw provider errors or request identifiers.
+
+The agent rail's settings action opens a separate **Agent settings** dialog.
+Its model and effort choices become the defaults for subsequently created web
+console conversations for that agent. Either field may inherit resolved config,
+and **Revert to config** clears both overrides in one action. These settings live
+in the web service's SQLite database, survive restart, and do not edit
+`mono-agent.config.json`; existing conversations and Telegram, Slack, cron,
+webhook, API, and TUI requests remain unchanged.
+
+The same dialog shows **Provider authentication** when the current agent
+advertises provider-auth v1. It renders only the host-returned providers used by
+effective routes, distinguishing detected credentials from live-request
+verification: **OK** requires a retained real success, while static presence is
+**Not verified**. A normal-size neutral Authenticate/Re-authenticate button stays
+available for every supported login method regardless of the row state. Agents
+advertising the additive checks capability also show one section-level **Run
+check** button; it checks only the displayed providers, reports partial fixed
+outcomes inline, and never runs on settings reads or polling. GitHub Copilot and
+OpenAI Codex expose Pi device-code flows;
+Anthropic accepts the final redirect URL/code; API-key providers use masked
+provider-owned prompts. Re-authentication remains available during an active
+login: a valid choice replaces it, while the compact flow stays visible until
+the fresh session arrives. Stale start, poll, input, and cancel responses cannot
+restore the old session. Polling continues through identical active snapshots;
+an expired retained session releases the local running control, while transient
+read failures remain retryable. A replacement whose prior credential transaction
+cannot drain safely within two seconds reports `replacement_timeout`. Secret
+input is cleared before submission. The web
+server requires exact origin, proxies through the agent's ordinary operator
+connection, marks responses no-store, and never reads the Pi auth path. The
+operator request is keyless when that agent has no API key and uses its bearer
+when it does. Auth state is component/agent memory only—not SQLite, thread
+history, browser storage, or run artifacts. The console remains a
+trusted-network single-user surface, not a per-human authenticated application.
+
+Live checks are explicit side effects: each selected provider receives one tiny
+no-fallback request, which may consume quota, trigger minimum billing, or refresh
+OAuth. Check sessions and observations are process-local, expire from memory,
+and are not persisted by the web service. They must be cancelled explicitly
+before starting authentication.
+
+Standalone process-job and Monitor revival turns in an existing web conversation
+read that conversation's model/effort snapshot immediately before admission. A
+wake steered into an active run stays on that run's already selected route.
 
 New interactive threads initially use the first user message as their fallback
 title. On compatible routes, an allowlisted app-owned `SetConversationTitle`
@@ -161,6 +307,8 @@ unavailable entries disabled with their status. Keyboard, pointer, and touch
 selection only inserts the canonical `$skill-name` token at the caret; it never
 sends the draft. Loading, stale, empty, unsupported, offline, and registry-error
 states leave normal composition available.
+The browse control uses a library icon, and touch opening leaves the search
+unfocused so the software keyboard does not cover the viewport-safe sheet.
 
 Select rendered message text to quote it into the composer. One quote is kept
 with the authored user message and supplied to the operator as Markdown
@@ -168,18 +316,30 @@ blockquote context; it does not rewrite the visible message text. The public
 turn DTO exposes this as `quote: { text, messageId }`, and the source message
 must belong to the same thread.
 
-The composer remains sendable while a response is running. A text-only send is
-persisted immediately and offered to the active provider as live guidance. Its
-message shows `pending`, `applied`, `queued`, or `cancelled`; an unsupported
-provider, delivery failure, end-of-turn race, or web-service restart queues it
-as the next normal turn instead of dropping it. Attachments keep the ordinary
-turn path, and cancelling the active turn also cancels its pending or queued
-live follow-ups. Live follow-ups are capped at 8,000 characters and 100
-unsettled messages per thread.
-
-Once the provider applies a follow-up, the assistant's Activity disclosure also
+The composer has one **Send** action whether the thread looks idle or running.
+Button Send, desktop Enter, and **Control/Command + Shift + Enter** all submit
+one immutable UUID-bearing payload; Shift+Enter and touch Enter remain newline.
+The server, not browser run state, admits it as either a normal turn or targeted
+live guidance for the exact active Web operation. There is no secondary Steer
+button. With no active turn, the service starts exactly one normal turn using
+the conversation route captured at admission.
+
+The message shows `pending`, `applied`, `queued`, `cancelled`, or `uncertain`.
+`applied` means exact owned-operation transcript consumption, not provider
+receipt or answer adherence. Unsupported targeting or proved-safe removal
+visibly queues one normal turn; a post-dispatch failure, end-of-turn race,
+cancellation, or restart is permanently uncertain and is not retried
+automatically. Active-turn attachments are rejected with
+`active_attachments_unsupported` before upload ownership changes; the browser
+restores the full text, structured quote, and staged files. The same payload may
+be deliberately sent after the response finishes with a new submission id.
+Cancelling the active turn also cancels its pending or queued live follow-ups.
+Live follow-ups are capped at 8,000 characters and 100 unsettled messages per
+thread.
+
+Once exact consumption is host-confirmed, the assistant's Activity disclosure also
 receives one completed `↪️ Steered: “<safe preview>”` tool row with result
-`Applied to current run`. The original follow-up remains the full human message;
+`Consumed by current run`. The original follow-up remains the full human message;
 the synthetic activity carries only a one-line, redacted, 40-code-point preview.
 
 The header bell explicitly enables standards-based Web Push. Permission and
@@ -227,12 +387,40 @@ late or replayed delivery cannot recreate the channel. Bootstrap and paging are
 bounded per source and archive state, with redirect-resolving thread fetches for selections
 or mutations outside the current window.
 
-Run-now and runtime enable/disable controls appear only when the agent advertises
-them. They require same-origin browser mutation, source-qualified routing, an
-operator API key, explicit agent-side opt-in, an idempotency key, and an
-agent-issued confirmation. The console neither edits config nor computes a
-schedule. Runtime enable state, run history, action audit, and idempotency are
-agent-owned; the web SQLite database is a reconnect/refresh projection.
+The cron header is read-only: a quiet line shows human-language cadence and the
+agent-authored next run in the viewer's local date/time, with the viewer timezone
+available on the time label. Wall-clock cadence includes the scheduler timezone
+(UTC by default); unsupported expressions retain normalized cron text and timezone.
+Disabled or removed jobs say so. Missing, invalid, past, or offline/stale next-run
+state says **Next run unavailable**. Configuration stays in files/config JSON;
+the browser neither edits it nor computes a schedule.
+
+Each visible terminal run keeps **Reply**, status, and local time in its compact
+footer; secondary artifact, originating-session, activity, and truncation
+diagnostics live under an accessible **Details** disclosure. Reply snapshots the
+exact persisted result at activation—compact summary unless activity detail is
+already loaded—and imports at most 32 KiB of explicitly marked untrusted
+provenance/result into a separate normal conversation for the same agent. It
+does not fetch hidden detail, rerun cron, invoke a provider, submit the empty
+composer, include tools/files/config/neighbouring history, or continue the cron
+session. The agent must positively advertise context-import v1 with a sufficient
+byte limit. Unknown transport outcomes keep one operation for explicit Retry;
+they are never replayed on startup. The page keeps unresolved identity in
+memory even when bounded session persistence is unavailable, and temporary
+offline/unsupported retry preflight does not discard it. A later deliberate
+Reply after a definitive failure creates another operation and conversation.
+The imported conversation renders that immutable snapshot as a compact card:
+run provenance and status, Markdown result, optional failure/truncation notices,
+and an accessible **Details** disclosure with exact raw JSON. This is read-time
+presentation only. The two host-seeded rows, snapshot text and digest remain
+unchanged in SQLite and in the agent's canonical history; unparseable or
+non-v1 text remains ordinary text.
+
+The web HTTP config-view, run-now, and effective-enabled proxies remain available
+for operator clients. Mutations still require same-origin requests, source-qualified
+routing, an operator API key, explicit agent-side opt-in, an idempotency key, and
+agent-issued confirmation. Runtime enable state, run history, action audit, and
+idempotency are agent-owned; web SQLite is a reconnect/refresh projection.
 
 When the selected agent advertises `capabilities.askUser`, a running `AskUser`
 tool call appears as one form containing all remaining questions. Each question
@@ -258,7 +446,21 @@ artifact availability, and explicit persistence failure. The browser never
 reconstructs those outcomes from display text, run JSONL, or its own SQLite.
 Historical content and artifact references remain untrusted; references expose
 no host path and may later become unavailable when their independently retained
-artifact is removed.
+artifact is removed. An oversized argument or result reaches the card as a
+preview carrying its full byte count and a digest of the body it was cut from;
+expanding fetches the whole part from the message-bound tool-call route, and a
+device-restored repair is accepted only when that digest still matches.
+
+The console runs in a browser-local data mode — Auto, Lean, or Full — cycled
+from the sidebar-footer indicator or the command palette, alongside a session
+byte total and per-minute rate marked estimated whenever any component is not a
+browser measurement. `Auto` reads the Network Information API and resolves to
+Full where there is none (Safari, and so iOS), which is why an installed PWA is
+offered Lean once. Lean loads pictures and MCP App documents on request, batches
+delta paint to one second, halves page sizes and poll rates, and retains fewer
+image blobs; polling pauses while the document is hidden. The preference keys
+`mono-agent.web.data-mode` and `mono-agent.web.data-mode-suggested` are browser
+storage, not configuration.
 ### Reply files and MCP Apps
 
 Agents that advertise reply attachments expose message-bound downloads in the
@@ -276,7 +478,11 @@ message write and rejected if found in durable rich-part records.
 
 The service mints exact-thread/message/part capabilities only while projecting
 a browser DTO, with the existing ten-minute access TTL bounded by the part's
-retention deadline. An authentic expired capability returns
+retention deadline and quantised down to a five-minute bucket, so a repeated
+projection of the same message yields the same URL and its transcript stays
+conditionally revalidatable. Content is served
+`private, max-age=<remaining key life>, no-transform`; those bytes may therefore
+survive in the browser's own private disk cache after the key expires. An authentic expired capability returns
 `reply_access_expired`; forged, cross-thread, and unknown references keep the
 generic not-found response. The PWA then asks the exact-origin access route to
 re-project the authoritative retained part and retries an attachment, app
@@ -307,6 +513,33 @@ cross-resource requests fail. See
 
 ## Architecture
 
+### Silent cron history
+
+Successful empty answers and answers suppressed by `NOTHING_TO_REPORT` add no
+visible conversation row. Failures, real output and completed notification
+content remain visible. The console retains compact silent run history separately
+from visible messages; each job keeps up to 500 visible and 500 suppressed run
+projections. Paging, search, previews and message counts exclude suppressed rows.
+
+Schema 19 marks existing definitely-silent projections without deleting their
+messages, turns or delivery receipts. Ambiguous text truncated by an older agent
+stays visible until authoritative evidence arrives. Cron transcript caches reset
+when their authoritative revision advances, so previously loaded older pages may
+need to be loaded again. Offline hydration also hides old synthetic-only silent
+rows while preserving delivered text and rich replies.
+
+### Storage migrations
+
+`src/store-migrations.ts` owns the ordered, named migration registry; its last
+step determines the supported SQLite schema version. Append a guarded step and
+historical-layout preservation tests when changing storage. Never relabel a
+shipped step: rebase before choosing a version, and append a repair if released
+layouts collided. Bootstrap DDL and the upgrade transaction stay in `store.ts`.
+Registry validation runs before bootstrap writes, and schema postconditions run
+before the upgrade commits and on current-version opens. Step failures report
+only the version/name, not stored content. A version stamp is not an execution
+ledger; postconditions check the required effects.
+
 ### Data flow
 
 1. `server.ts` accepts the versioned browser API, staged uploads, and SSE
@@ -316,35 +549,53 @@ cross-resource requests fail. See
    Web Push subscription/event/delivery, notification, and cron projection
    records through the SQLite store, and
    drives each agent over its loopback operator endpoint.
-3. Service mutations publish invalidations. Browsers consume `/api/v1/events`
-   and refetch authoritative projections, including the selected agent's
-   memory-only live skill registry, so reloads and concurrent tabs do not own or
-   interrupt upstream turns.
+3. Service mutations publish content deltas and change hints. A browser names
+   one conversation on `/api/v1/events` and receives that conversation's
+   `message.delta` frames in full; every other change arrives as a hint,
+   rate-limited to one per conversation per second, that it answers with an
+   `If-None-Match` read of exactly the projection it names — including the
+   selected agent's memory-only live skill registry. Responses are compressed
+   and carry per-route cache policy: immutable hashed assets, revalidated shell
+   and worker scripts, `private, no-cache` API reads, and immutable
+   content-addressed upload bytes. Reloads and concurrent tabs still do not own
+   or interrupt upstream turns.
 4. The bundled assistant-ui webapp maps those DTOs—including canonical
    lifecycle metadata—into its external store, thread list, messages, compact
    Monitor activity, tool cards, composer, attachments, and push-subscription
-   UI; its service worker handles background delivery and same-origin clicks.
+   UI, keeping a per-conversation cache that is also written to the device
+   (IndexedDB `mono-agent-web`, version 2, swept per writer on hydration) so a
+   cold start draws before the first response. Its service worker precaches the
+   shell, handles background push delivery and same-origin clicks, and is
+   registered in `prompt` mode: a new build is staged and applied on the next
+   idle foreground moment or an explicit reload, never over a running turn or an
+   unsent draft.
 5. `deliverWebNotification` reads the owner-private live ingress record and
    performs one bearer-authenticated loopback delivery. Cron/webhook delivery
    first appends the result to agent history, then atomically exposes an
    idempotent assistant-only thread. A process-job delivery instead updates one
    source/thread-bound durable card; its normal wake turn owns the single agent
-   history entry. A Monitor delivery is steered into an active run or becomes an
-   assistant-only follow-up in the exact existing web thread; exact host-owned
-   receipts update one compact, secret-free activity row rather than creating
-   repeated steering cards. The browser may be closed, but the web service must
-   remain running.
+   history entry. Its receipt returns once that exact follow-up is durably
+   admitted rather than waiting for model completion. A Monitor delivery is
+   steered into an active run or becomes an assistant-only follow-up in the exact
+   existing web thread; exact host-owned receipts update one compact, secret-free
+   activity row rather than creating repeated steering cards. The browser may be
+   closed, but the web service must remain running.
+
+Monitor activity shows suppressed lines/batches and follow-up, steered, or
+unknown wake dispositions. These are host delivery counts, not model-turn or
+cost estimates. Historical v1 Monitor projections in SQLite and browser caches
+remain readable alongside v2 projections.
 
 ### Package structure
 
 | Source area | Responsibility |
 | --- | --- |
-| [`server.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/server.ts) | HTTP service, `/api/v1` routes, host/theme bootstrap identity, per-host PWA manifest, uploads, SSE invalidations, host/origin checks, and static webapp serving. |
-| [`service.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/service.ts) | Application lifecycle for discovery, threads, turns, agent-authored automatic titles, live-input delivery/fallback, attachments, `AskUser` snapshots/submission, cancellation, notifications, and invalidation. |
+| [`server.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/server.ts) | HTTP service, `/api/v1` routes, hostname/display-name/theme bootstrap identity, per-console PWA manifest, uploads, SSE invalidations, host/origin checks, provider-auth no-store proxy routes, and static webapp serving. |
+| [`service.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/service.ts) | Application lifecycle for discovery, threads, turns, agent-authored automatic titles, live-input delivery/fallback, attachments, `AskUser` snapshots/submission, provider-auth connection-generation guarding, cancellation, notifications, and invalidation. |
 | [`store.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/store.ts) | Owner-private SQLite schema and transactional persistence, including race-safe automatic-title updates that never overwrite a user rename. |
-| [`operator-client.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/operator-client.ts) | Structured turn streaming, info/capabilities, live-input settlement, pending/submitted `AskUser`, cancellation, durable history append, and owner-authenticated process-job reads/cancel over the operator protocol. |
+| [`operator-client.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/operator-client.ts) | Structured turn streaming, info/capabilities, live-input settlement, pending/submitted `AskUser`, cancellation, durable history append, conditionally bearer-authenticated provider-auth, and owner-authenticated process-job requests over the operator protocol. |
 | [`notification-client.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/notification-client.ts) and [`notification-ingress.ts`](https://github.com/robertsreberski/mono-agent/blob/main/packages/web/src/notification-ingress.ts) | Bounded, authenticated cron/webhook delivery, source/thread-bound process-job cards, and Monitor wake turns. |
-| [`webapp/`](https://github.com/robertsreberski/mono-agent/tree/main/packages/web/webapp) | Isolated assistant-ui PWA, including compact Monitor activity, atomic `AskUser` forms, tests, and its own dependency lockfile. |
+| [`webapp/`](https://github.com/robertsreberski/mono-agent/tree/main/packages/web/webapp) | Isolated assistant-ui PWA, including compact Monitor activity, the loaded conversation-level process-job stack and live tails, atomic `AskUser` forms, tests, and its own dependency lockfile. |
 
 ## Public API
 
@@ -359,7 +610,7 @@ cross-resource requests fail. See
 | `discoverAcpBridgeAgents` | Discover Worklab-importable ACP sources through a credential-free, versioned ownership contract. |
 | `discoverOperatorAgents` | Read trusted operator endpoints from trace-source manifests. |
 | `WebBootstrap`, `WebThreadDetail`, `WebEvent`, and related `Web*` DTOs | Build another client against the versioned browser API. |
-| `WEB_THEMES`, `DEFAULT_WEB_THEME`, `WebTheme`, and `WebConsoleIdentity` | Select a curated theme and consume the hostname/theme identity returned to browsers. |
+| `WEB_THEMES`, `DEFAULT_WEB_THEME`, `WEB_CONSOLE_NAME_MAX_CHARACTERS`, `WebTheme`, and `WebConsoleIdentity` | Select a curated theme/name and consume the hostname/display-name/theme identity returned to browsers. |
 
 <!-- public-api-inventory:start -->
 <!-- Generated by scripts/generate-public-api-docs.mjs. Do not edit by hand. -->
@@ -376,6 +627,7 @@ ACP_PROTOCOL_VERSION
 AcpBridgeDiscovery
 AcpBridgeSourceDescriptor
 AcpBridgeSourceHealth
+CreateWebCronReplyInput
 CreateWebThreadInput
 CreateWebUploadInput
 DEFAULT_WEB_HOST
@@ -398,11 +650,14 @@ OperatorTurnInput
 OperatorTurnResult
 PatchWebAgentInput
 PatchWebThreadInput
+PutWebAgentRunSettingsInput
 SearchWebThreadsInput
 StartWebLiveInputInput
 StartWebServerOptions
+StartWebSubmissionInput
 StartWebTurnInput
 WEB_API_VERSION
+WEB_CONSOLE_NAME_MAX_CHARACTERS
 WEB_MAX_ACTIVE_ATTACHMENT_TURN_BYTES
 WEB_MAX_CONCURRENT_UPLOADS
 WEB_MAX_FILES_PER_TURN
@@ -417,16 +672,25 @@ WEB_STAGED_UPLOAD_TTL_MS
 WEB_THEMES
 WEB_THREAD_SEARCH_MAX
 WEB_THREAD_SEARCH_MIN_QUERY
+WebAgentRunSettings
 WebAgentStatus
 WebAgentSummary
+WebAgentsChangedPayload
 WebAttachment
 WebBootstrap
+WebBootstrapScope
 WebConsoleError
 WebConsoleIdentity
+WebCronReplyContextPart
+WebCronReplyReceipt
+WebCronReplySnapshotKind
 WebEvent
 WebEventType
+WebJobActivity
 WebLiveInputReceipt
 WebMessage
+WebMessageDelta
+WebMessageDeltaOp
 WebMessagePart
 WebMessageStatus
 WebModelOption
@@ -435,8 +699,14 @@ WebPushBootstrap
 WebPushSubscriptionState
 WebPushSubscriptionStatus
 WebQuote
+WebRunAttribution
+WebRunExecution
+WebRunRetry
+WebRunSelection
+WebRunSettingSource
 WebRunState
 WebRunStatus
+WebRunTransition
 WebServerHandle
 WebSkillAvailability
 WebSkillInfo
@@ -444,8 +714,10 @@ WebSkillRegistry
 WebSkillUnavailableReason
 WebStatePathOptions
 WebStatePaths
+WebSubmissionReceipt
 WebTheme
 WebThread
+WebThreadChangedPayload
 WebThreadDetail
 WebThreadNotificationTriggerKind
 WebThreadSearchHit
@@ -476,9 +748,16 @@ the actual bound address/port plus idempotent `stop()` and `close()` methods.
 
 The browser API is rooted at `/api/v1`:
 
-- `GET /bootstrap`, `PATCH /agents/:id`, and `GET/PATCH/DELETE /threads/:id`
+- `GET /bootstrap` (one `?sourceId`/`?archived` thread bucket, `?limit` capped),
+  `PATCH /agents/:id`, and `GET/PATCH/DELETE /threads/:id`
 - `POST /threads`, `/threads/:id/turns`, `/threads/:id/live-input`, and
-  `/threads/:id/cancel`
+  `/threads/:id/cancel`; the browser composer uses
+  `POST /threads/:id/submissions` plus recovery reads at
+  `GET /threads/:id/submissions/:submissionId`
+- `GET /threads/:id/messages/:messageId` for one message (delta gap recovery)
+  and `GET /threads/:id/messages/:messageId/tool-calls/:toolCallId` for the
+  unshaped body behind a truncated tool-call preview; `?full=1` on a transcript
+  read returns it unshaped
 - `GET /threads/:id/ask` and `POST /threads/:id/ask` for the current structured
   `AskUser` snapshot and atomic answer submission
 - `POST /uploads`, `PUT/GET /uploads/:id/content`, and `DELETE /uploads/:id`
@@ -491,7 +770,13 @@ The browser API is rooted at `/api/v1`:
   and `POST /push/events/:eventId/ack`; the status read carries the exact
   `X-Mono-Agent-Web-Origin` browser-origin claim and returns no endpoint or key
   material
-- `GET /events` (SSE)
+- `GET /events` (SSE); the optional `?thread=<id>` subscribes that connection to
+  one conversation's `message.delta` frames, resolving a redirected id to the
+  canonical one. `Last-Event-ID` is ignored — `ready` means resync
+- `POST /agents/:sourceId/cron/jobs/:jobId/runs/:runId/reply-threads` snapshots
+  one visible terminal run and imports it into one normal same-agent thread;
+  the exact-origin request carries a browser-owned operation UUID and summary
+  or already-loaded-detail selection
 
 `GET /healthz` is intentionally outside the versioned API for service probes.
 Its compatibility-stable `status` remains `ok` while the additive `push` field
@@ -503,16 +788,49 @@ The additive `WebBootstrap.console` object carries the server-derived
 `POST /threads/:id/live-input` accepts `{ text }` and returns a persisted message
 with `disposition: "pending" | "queued"`; SSE invalidation exposes its later
 `liveInputStatus` settlement.
+
+`POST /threads/:id/submissions` accepts a canonical UUID plus the ordinary turn
+payload. The thread-scoped immutable payload is recorded in `web_submissions`
+with its turn/live-input/rejection associations. Same-id same-payload replay
+returns the existing current receipt without dispatch; conflicting reuse is
+`409`. `GET /threads/:id/submissions/:submissionId` is side-effect-free and both
+receipt routes are `private, no-store`. Browser recovery persists only thread
+and submission ids in session storage—never draft text or file bytes—and checks
+the receipt without automatically posting again.
+
+Schema 22 adds a nullable `live_inputs.dispatch_started_at` marker committed
+before the operator request. On restart, an unmarked offered row is safe to
+queue once; a marked row becomes `uncertain` and non-promotable. Existing
+schema-21 rows migrate with a null marker, so their earlier dispatch history is
+not reconstructible. Schema 23 adds the durable `web_submissions` ledger and
+keeps it for the lifetime of its thread, including archive; permanent deletion
+cascades it. Schema 24 adds the read indexes used by conversation run-state
+lookups. Schema 25 adds `cron_reply_operations`, which owns the immutable
+snapshot, canonical-import identity, pending/terminal settlement, and deletion
+tombstone. Pending rows survive restart for explicit same-operation retry;
+failed or deleted rows cannot expose or resurrect a conversation. Stop the Web
+service and make a compatible database backup before migration. A schema-24
+binary refuses a schema-25 database; rollback requires
+restoring that compatible pre-upgrade backup and loses writes made afterward.
+Upgrade the operator-adapter before the Web producer so `liveInputTargeting`
+is available; an older operator is not guessed through and the receipt visibly
+queues `unsupported_targeting`. Deployment remains a separate operation.
 Permanent deletion is limited to archived, inactive conversations. It removes
 database descendants transactionally and deletes committed attachment files;
 startup and scheduled cleanup remove any file orphaned by a crash or transient
-filesystem failure after the database commit.
+filesystem failure after the database commit. Archiving a truly empty manual
+conversation conditionally removes it instead; any authoritative trigger,
+message, turn, attachment, live input, submission receipt, or delivery evidence makes the server
+preserve it in Archived, including activity that arrives during the archive
+race.
 
 ## Dependency Boundary
 
 The server depends only on the `core` `@mono-agent/agent-contracts` and
 `@mono-agent/config` packages, the `observability` trace-source registry, and
-Express. Its compiled browser bundle additionally contains the production graph
+Express. Its Node-side operator clients use Undici to keep deliberately
+long-lived turn and host-wake streams under their explicit lifecycle owners.
+Its compiled browser bundle additionally contains the production graph
 from the isolated `webapp` lockfile: assistant-ui, Base UI, cmdk, React, and
 Workbox plus their transitive dependencies. The repository advisory and license
 gates audit that nested production graph separately because it ships inside this