omnius 1.0.797 → 1.0.799

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 39269568 bytes
-sha256: addd7fca63e49ee84b631e268135c959c4c4c475228b4e649fc2dd20eb3382ca
+size: 39315083 bytes
+sha256: f3bb752f92745a0ae0dedb58da465a3598d0e01ecf2d9da38cbcc78e43f2be25

package/docs/DISCOVERY.json

@@ -35906,7 +35906,7 @@
       "id": "guide.work-orders-runtime-health-remediation-wo-57-telegram-delivery-truth-and-recovery-uppercase",
       "kind": "guide",
       "title": "WO-57: Telegram delivery truth, reminder authority, and bounded recovery",
-      "summary": "Status: 1.0.796 Case Theory continuation regression confirmed live; REQ-TDT-014 implementation and validation in progress; full-suite, repository-delivery, and live acceptance gates remain open Priority: P0 Incident: October 1, 2026, live Telegram reminder and illegal-logging non-responses Owner: Omnius orchestrator and Telegram runtime Depends on: WO-41, WO",
+      "summary": "Status: 1.0.798 live acceptance failed on Case Theory message 650; REQ-TDT-018 delivery-commit convergence and complete batch-scope repair are in progress; full-suite, redeployment, and live-acceptance gates remain open Priority: P0 Incident: October 1, 2026, live Telegram reminder and illegal-logging non-responses Owner: Omnius orchestrator and Telegram run",
       "keywords": [
         "work",
         "orders",

package/docs/DISCOVERY.md

@@ -609,7 +609,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-runtime-health-remediation-wo-54-case-theory-router-deferral-recovery-uppercase` | WO-54: Case Theory router deferral recovery | Status: complete Priority: P0 Incident: September 26, 2026, Case Theory messages 455–456 Runtime observed: globally installed Omnius 1.0.764 Owner: current implementation session |
 | `guide.work-orders-runtime-health-remediation-wo-55-telegram-pressure-recovery-uppercase` | WO-55: Telegram pressure recovery without silent terminal states | Status: complete Priority: P0 Incident: September 26, 2026, Case Theory messages 458-461 Owner: current implementation session |
 | `guide.work-orders-runtime-health-remediation-wo-56-evidence-driven-objective-loop-uppercase` | WO-56: Evidence-driven objective loop and nonblocking execution | Status: repository implementation complete; live Telegram acceptance remains an external gate Priority: P0 Incident: September 27, 2026, Telegram SSH-over-Cloudflare task spiral and TUI freeze Owner: Omnius orchestration, execution, and Telegram runtime Depends on: WO-05, WO-21, WO-27, WO-41, WO-44, WO-49, WO-54, WO-55 Completion rule: A checkbox may be mark |
-| `guide.work-orders-runtime-health-remediation-wo-57-telegram-delivery-truth-and-recovery-uppercase` | WO-57: Telegram delivery truth, reminder authority, and bounded recovery | Status: 1.0.796 Case Theory continuation regression confirmed live; REQ-TDT-014 implementation and validation in progress; full-suite, repository-delivery, and live acceptance gates remain open Priority: P0 Incident: October 1, 2026, live Telegram reminder and illegal-logging non-responses Owner: Omnius orchestrator and Telegram runtime Depends on: WO-41, WO |
+| `guide.work-orders-runtime-health-remediation-wo-57-telegram-delivery-truth-and-recovery-uppercase` | WO-57: Telegram delivery truth, reminder authority, and bounded recovery | Status: 1.0.798 live acceptance failed on Case Theory message 650; REQ-TDT-018 delivery-commit convergence and complete batch-scope repair are in progress; full-suite, redeployment, and live-acceptance gates remain open Priority: P0 Incident: October 1, 2026, live Telegram reminder and illegal-logging non-responses Owner: Omnius orchestrator and Telegram run |
 | `guide.work-orders-telegram-dmn-wo-22-dmn-outreach-and-learning-uppercase` | WO-22: DMN outreach, DM sharing, and outcome learning | On 2026-09-03 at 17:07 PDT the bot posted in the OMNIUS group without being addressed. The operator asked whether this was self-induced reflection. |
 | `guide.work-orders-telegram-dropbear-context-rca-workorder` | Telegram Dropbear Context Engineering RCA Work Order | Observed run: /home/roko/Documents/Projects/Adjacent/telegramtest/.omnius, run id 1782873796963-i5r7mv. |
 | `guide.work-orders-telegram-reliability-consolidation-2026-09-28` | Telegram Reliability Consolidation — 2026-09-28 | Rule: check a box only after the named behavior is implemented and its listed verification passes. A parent box stays open until every child box is checked. |

package/docs/work-orders/runtime-health-remediation/WO-57-telegram-delivery-truth-and-recovery.md

@@ -1,8 +1,8 @@
 # WO-57: Telegram delivery truth, reminder authority, and bounded recovery
 
-**Status:** 1.0.796 Case Theory continuation regression confirmed live;
-REQ-TDT-014 implementation and validation in progress; full-suite,
-repository-delivery, and live acceptance gates remain open
+**Status:** 1.0.798 live acceptance failed on Case Theory message 650;
+REQ-TDT-018 delivery-commit convergence and complete batch-scope repair are in
+progress; full-suite, redeployment, and live-acceptance gates remain open
 **Priority:** P0
 **Incident:** October 1, 2026, live Telegram reminder and illegal-logging non-responses
 **Owner:** Omnius orchestrator and Telegram runtime
@@ -19,7 +19,10 @@ a mutation may be claimed only after its typed tool receipt; inline research mus
 not require an impossible external-provider receipt; recovery must reuse current
 verified evidence instead of replaying the full reasoning loop. A scoped
 reminder tool must never read or mutate reminders owned by another chat, topic,
-surface, or unscoped/global context.
+surface, or unscoped/global context. A response admitted from a Telegram forum
+topic must keep that exact topic on every text, media, menu, callback, and
+autonomous-follow-up delivery; replying to a message is not a substitute for
+the native `message_thread_id` destination.
 
 ## Baseline and live evidence
 
@@ -87,10 +90,52 @@ logging data now.`, and was marked consumed without a retrieval run.
       was unavailable.
 - [x] Anchor the exact 1.0.796 follow-up failure: message 644 directly
       mentioned the bot and said `confirm you can see all of the above files,
-    please follow her instructions`, but the explicit-continuation grammar
+please follow her instructions`, but the explicit-continuation grammar
       did not recognize delegated task continuation. The same router decision
       was retried three times and the intake was marked failed without an
       action run or public reply.
+- [x] Anchor the 1.0.797 scope-binding failure: message 645's otherwise valid
+      live action decision cited `active-task:tgtask-3f98bf45a97a892330ae`
+      while declaring `continuity:"new"` and the chat session key as
+      `activeScopeId`. The bridge admitted a replacement root task for 645,
+      discarded the original 642 objective/23-file scope, inspected only four
+      files, and marked coarse `effect:observation` ready for delivery.
+- [x] Anchor the 1.0.797 batch-cadence failure: after enumerating all 23 PDFs
+      and each bounded OCR batch, the runner synchronously repeated
+      `virtual_memory_plan`, `virtual_memory_rerank`,
+      `virtual_memory_sufficiency`, and `memory_compilation_plan_v2`. Exact
+      request fingerprints and retrieval corpus/query keys changed after every
+      successful tool transaction, so each iteration was guaranteed to miss
+      both caches even with 20-33% exact request headroom remaining.
+- [x] Anchor the false per-file evidence transition: successful structural
+      `document inspect` calls for messages 636-639 returned
+      `textCharacters:0` plus `visual review may be required`, but the generic
+      Telegram adapter still attached observation evidence and satisfied the
+      file criteria.
+- [x] Anchor the capability-authority mismatch: Telegram's durable policy
+      classified `ocr_pdf` as read-only while the registered execution tool
+      correctly classified it as mutating, and stale generic tools were
+      ordered ahead of the manifest-specific `pdf_to_text` reader.
+- [x] Anchor the forum-topic transport breach: the OMNIUS intake for message
+      5725 retained `messageThreadId:5719` and exact input identity
+      `telegram:chat:-1003888256865:5719:5725`, while the shared final-reply,
+      command-reply, blocking-question, generation, and artifact paths called
+      Telegram without `message_thread_id`. Telegram therefore placed scoped
+      output at the forum root/All surface instead of General/topic 5719.
+- [x] Anchor the 1.0.798 false-terminal regression: run
+      `telegram-84e4e6e5411c9753-1790980997771-1` committed `completed` at
+      `2026-10-02T22:50:33.197Z` while its durable objective frontier still
+      listed `effect:visible_response` as open, its claim remained unverified,
+      and no Telegram assistant message or provider delivery receipt existed.
+- [x] Anchor the 1.0.798 manifest regression: messages 620 through 642 contain
+      23 ordered PDF time cards, while the recovered task OCRed/inspected only
+      messages 634 through 642 and authored a nine-card answer despite message
+      650 explicitly retaining prior time cards.
+- [x] Anchor the 1.0.798 recovery livelock: checkpoint
+      `tgtrc-943243df3fbb01e2377b73b16275f3c9` reached at least retry 10;
+      every retry reported `object work remains frozen`, no runner artifact
+      changed after the false terminal commit, and typing ceased while the
+      Telegram poller remained healthy.
 
 Runtime evidence:
 
@@ -111,6 +156,8 @@ Runtime evidence:
 - `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-intake/f39b2cf564299c28fc81.jsonl`
 - `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-social-events/f39b2cf564299c28fc81b388.jsonl`
 - `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-runner-state/84e4e6e5411c97531047/tool-results/d1601e4c.txt`
+- `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-intake/0c499aca482c61832afa.jsonl`
+- `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-conversations/c34a3d7d53728329c081.events.jsonl`
 
 ## Requirements and implementation checklist
 
@@ -294,6 +341,32 @@ Primary anchors:
   review.
 - `packages/cli/tests/telegram-objective-resume.test.ts`
 - `packages/cli/tests/telegram-bot-api-10.test.ts`
+
+### REQ-TDT-016 — event-owned cadence and renewable runner lease
+
+- [x] Make AgenticRunner's typed objective/frontier events the sole owner of
+      live object-work cadence. Do not start an independent semantic model
+      review from elapsed time or from an intermediate tool-result callback.
+- [x] Renew the Telegram runner lease on every routed AgenticRunner lifecycle
+      event, while excluding Telegram typing/UI timers that could otherwise
+      keep an orphan alive indefinitely.
+- [x] Suppress lease expiry while an exact-session inference is admitted; the
+      inference operation retains its own bounded deadline.
+- [x] On genuine event silence past the configured TTL, fence the generation,
+      abort its runner/controller, release its session ownership, and requeue
+      the exact retained intake through the existing durable recovery path.
+- [x] Keep independent metacognitive review at the settled terminal boundary,
+      where it can validate delivery without racing or steering live OCR/read
+      batches.
+- [x] Cover recent-event lease renewal, event-silent expiry, no competing
+      semantic review, generation fencing, and retained-intake recovery.
+
+Primary anchors:
+
+- `packages/cli/src/tui/telegram-bridge.ts` — event lease renewal/expiry and
+  removal of live sidecar-review triggers.
+- `packages/cli/tests/telegram-lifecycle-leak.test.ts`
+- `packages/cli/tests/telegram-steering-finalization.test.ts`
 - `packages/orchestrator/tests/agenticRunner-objective-control.test.ts`
 
 ### REQ-TDT-010 — authoritative continuation and control-plane convergence
@@ -395,56 +468,206 @@ Primary anchors:
 
 ### REQ-TDT-014 — durable arbitrary-depth intake, batch objectives, and terminal handoff
 
-- [ ] Treat a native direct mention/reply/private delivery as host-owned intake
+- [x] Treat a native direct mention/reply/private delivery as host-owned intake
       authority. Invalid attention-router or action-plan JSON may not discard
       that exact input; semantic interpretation belongs to the capable runner,
       with ambient group traffic still using the attention router.
-- [ ] Present every exact-scope durable open objective to that runner as
+- [x] Present every exact-scope durable open objective to that runner as
       structured state, so ordinary language can continue, delegate, amend,
       replace, or query it without a host phrase dictionary. Any model-selected
       continuation must cite one unambiguous task and preserve its boundaries.
-- [ ] Preserve the original task owner, task ID, objective, evidence, media
+- [x] Preserve the original task owner, task ID, objective, evidence, media
       scope, and remaining work while binding the newer input as response
       authority; do not create a second root task or silently replace the
       original file-analysis objective.
-- [ ] Require explicit current-turn bot address plus a read-only retained task
+- [x] Require explicit current-turn bot address plus a read-only retained task
       for cross-actor delegation. Keep mutation tasks, ambiguous multiple
       tasks, foreign chats/topics, unaddressed talk, and wait/defer language
       outside deterministic repair.
-- [ ] Resume the retained objective without restoring a stale partial reply as
+- [x] Resume the retained objective without restoring a stale partial reply as
       proof that the full batch is complete. A partial candidate may be used
       only as evidence already gathered and must remain labelled partial until
       every required file has been processed or a truthful blocker is sent.
-- [ ] When object work reaches a current, verified candidate and the only
+- [x] When object work reaches a current, verified candidate and the only
       missing effect is Telegram visibility, make the terminal handoff durable
       across review failure without restarting completed file reads or losing
       the response owner.
-- [ ] Persist the scoped action plan/capability set and terminal-review
+- [x] Persist the scoped action plan/capability set and terminal-review
       checkpoint with the objective. Recovery must resume the last incomplete
       state transition; it must not restart attention, planning, or completed
       object work.
-- [ ] Derive itemized completion criteria for a selected attachment set. One
+- [x] Derive itemized completion criteria for a selected attachment set. One
       generic observation cannot satisfy a multi-document request, and
       advisory no-delta review cannot turn a partial checklist into
       `deliver_due`.
-- [ ] Prove all admitted attachments are durably enumerable and resolvable
+- [x] Prove all admitted attachments are durably enumerable and resolvable
       from Telegram `file_id` metadata after process restart or local byte-cache
       expiry. Enumeration must paginate beyond one bounded page, and each
       successful inspection must receipt the exact message/file criterion.
-- [ ] Replay the exact 642 -> 644 Case Theory topology, including Mariana as
+- [x] Give every retained task, resource manifest, continuation plan, and
+      terminal-review checkpoint a finite default TTL, bounded explicit TTL,
+      activity/manual renewal where applicable, and natural expiry that cannot
+      resurrect stale authority.
+- [x] Replay the exact 642 -> 644 Case Theory topology, including Mariana as
       task owner and robitman as the directly addressing delegator, and assert
       one continued action task, no quick-chat acknowledgement, no router-only
       exhaustion, and one final exact-scope response.
+- [x] Enforce continuity/scope coherence at the typed action-plan boundary:
+      `new` is allowed only when no active task exists and has no active scope,
+      while `continue_active`, `status_probe`, and `replace` must name and cite
+      an exact host-supplied active task. A chat session key cannot masquerade
+      as a task ID or silently overwrite durable work.
+- [x] Keep a narrow admission-side compatibility guard for a queued decision
+      trusted by an older validator; repair only the exact single-task,
+      chat-key-as-scope contradiction and never infer continuation from prose.
+- [x] Replay the valid-live-router contradiction through the complete Telegram
+      admission pipeline and prove the original task, objective, epoch, plan
+      ID, and plan tools survive with no second root task.
 
 Primary anchors:
 
 - `packages/cli/src/tui/telegram-bridge.ts` — delegated-continuation shape,
   retained-task handoff, candidate/evidence restoration, and terminal recovery.
+- `packages/cli/src/tui/telegram-durable-continuation-policy.ts`
+- `packages/cli/src/tui/telegram-resource-manifest.ts`
+- `packages/cli/src/tui/telegram-terminal-review-checkpoint.ts`
 - `packages/cli/tests/telegram-steering-finalization.test.ts`
 - `packages/cli/tests/telegram-objective-resume.test.ts`
+- `packages/cli/tests/telegram-durable-continuation-policy.test.ts`
+- `packages/cli/tests/telegram-resource-manifest.test.ts`
+- `packages/cli/tests/telegram-terminal-review-checkpoint.test.ts`
 - `packages/cli/tests/telegram-terminal-delivery.test.ts`
 - `packages/cli/tests/telegram-terminal-metacognition.test.ts`
-- `packages/cli/tests/telegram-media-admission.test.ts`
+- `packages/cli/tests/telegram-media-cache.test.ts`
+- `packages/cli/tests/telegram-update-spool.test.ts`
+
+### REQ-TDT-015 — scope-bound batch cadence and truthful resource evidence
+
+- [x] Define a typed objective-read-batch continuation with exact session,
+      task epoch, objective ref/hash/revision, ordered criterion IDs, and
+      finite expiry. Never infer batch authority from user/model prose or a
+      generic read-only tool name.
+- [x] Renew the fast path for one request only after a successful registered
+      read-only tool produces accepted observation evidence for an exact batch
+      criterion and the frontier still has another batch criterion open.
+- [x] Invalidate immediately on scope/objective/epoch/frontier mismatch,
+      expiry, steering/preemption, failed or mutating work, non-observation,
+      batch exit, or lack of another exact criterion.
+- [x] Reuse the validated scope-bound virtual-memory projection while the new
+      exact tool result remains resident in the current transcript. Recompute
+      pinned structured state on every request and rerun semantic retrieval at
+      synthesis/batch exit.
+- [x] Preserve the exact request without compiler inference while the one-shot
+      lease is valid and at least 20% of the physical model window remains
+      free after input, output reservation, and safety margin. At lower
+      headroom, run the normal compiler; never discard or summarize the newly
+      observed resource to keep the fast path alive.
+- [x] Treat structural success with zero extracted text as capability feedback,
+      not attachment observation. Accept PDF resource evidence only from typed
+      text extraction (or a complete typed query-negative observation), and
+      leave zero-text files open for OCR/visual processing.
+- [x] Remove mutating `ocr_pdf` from durable read-only authority. When a PDF
+      resource manifest is active, place `telegram_media_recent` and
+      `pdf_to_text` ahead of stale generic plan tools, and replace rather than
+      renew a non-matching plan.
+- [x] Cover scope-bound projection reuse/batch exit, safe-headroom compiler
+      hold, one-shot read-result admission, zero-text evidence rejection,
+      mutating OCR-plan rejection, stale-plan replacement, and the complete
+      Case Theory Telegram admission file.
+
+Primary anchors:
+
+- `packages/orchestrator/src/agenticRunner.ts` — typed batch lease, objective
+  admission, virtual-memory cadence, and compiler pressure boundary.
+- `packages/orchestrator/tests/live-virtual-context.test.ts`
+- `packages/orchestrator/tests/unified-memory-compilation.test.ts`
+- `packages/cli/src/tui/telegram-resource-manifest.ts`
+- `packages/cli/src/tui/telegram-durable-continuation-policy.ts`
+- `packages/cli/src/tui/telegram-bridge.ts`
+- `packages/cli/tests/telegram-resource-manifest.test.ts`
+- `packages/cli/tests/telegram-durable-continuation-policy.test.ts`
+- `packages/cli/tests/telegram-objective-resume.test.ts`
+- `packages/cli/tests/telegram-bot-api-10.test.ts`
+
+### REQ-TDT-017 — exact Telegram forum-topic delivery
+
+- [x] Resolve one immutable outbound topic from the admitted Telegram message
+      or its native reply context; never infer a destination from prose or a
+      chat-wide "last topic" value.
+- [x] Attach `message_thread_id` to every chunk of the shared final-delivery
+      path, including HTML-to-plaintext fallback and parsed-media delivery.
+- [x] Bind the topic into the exact-payload delivery ledger so a receipt from
+      one topic cannot authorize replay or completion in another.
+- [x] Preserve the topic on public progress creation/fallbacks, command replies,
+      terminal blocking questions, help/stats/menu output, generation
+      status/results, generated artifacts, screenshots, and same-chat
+      `telegram_send_file` effects.
+- [x] Scope callback-driven generation intent by chat, topic, and actor so a
+      prompt in one topic cannot consume pending state created in another.
+- [x] Require autonomous follow-up evidence to resolve to one topic; suppress
+      cross-topic proposals instead of posting them at the chat root.
+- [x] Prove a multi-chunk final answer sends every chunk to topic 5719 while
+      only the first chunk replies to source message 5725.
+- [x] Prove command-style replies and generated artifact uploads keep topic
+      5719, while root/private controls remain unchanged.
+- [x] Pass CLI typecheck/build, focused transport/Bot API regressions,
+      formatting, and `git diff --check`.
+- [ ] Publish/install/restart, then prove a fresh message in Telegram General
+      receives its reply in General and not only in the All view.
+
+Primary anchors:
+
+- `packages/cli/src/tui/telegram-bridge.ts` — immutable topic resolution and
+  all outbound text/media delivery paths.
+- `packages/cli/src/tui/telegram-command-menu.ts` — topic-bound callback state.
+- `packages/cli/tests/telegram-transport-contract.test.ts`
+- `packages/cli/tests/telegram-bot-api-10.test.ts`
+
+### REQ-TDT-018 — delivery-commit convergence and complete batch recovery
+
+- [x] Induct primary operational guidance for transactional outbox delivery,
+      idempotent exact-request retries, durable history replay, bounded retry
+      exhaustion, and Telegram provider/typing semantics into
+      `.aiwg/research/terminal-metacognitive-control/`.
+- [ ] Represent an accepted Telegram `user_reply` as durable pending delivery,
+      not as a completed visible-response effect. A terminal success may not
+      clear the task until the exact destination/payload receives a Telegram
+      provider receipt.
+- [ ] Bind delivery retries to one task/input/epoch/topic/payload hash and
+      reconcile exactly once. A process restart resumes pending delivery from
+      durable state without rerunning completed document/OCR work.
+- [ ] Make terminal semantic review a bounded decision activity. Review
+      unavailability cannot dispatch indefinitely: after the configured
+      attempt/elapsed budget, a complete evidence-bound candidate follows the
+      deterministic delivery path; a partial candidate retains a truthful
+      blocked/needs-input state.
+- [ ] Preserve the complete host-enumerated 23-file resource manifest across
+      delegated continuation and restart. No prefix/suffix window, model prose,
+      or generic observation may reduce or satisfy the itemized batch.
+- [ ] Keep typing as an event-driven ephemeral projection while work or pending
+      delivery is genuinely active. Typing never owns the runner lease and
+      stops on provider receipt, cancellation, expiry, or terminal failure.
+- [ ] Add deterministic regressions reproducing message 650: 23 admitted PDFs,
+      nine previously processed files, restart, unavailable reviewer, bounded
+      retry, exact candidate delivery, provider receipt, one public reply, and
+      no repeated OCR or unbounded dispatch.
+- [ ] Pass affected CLI/orchestrator focused suites, typechecks/builds,
+      formatting, `git diff --check`, independent review, scoped commit, and
+      push. Publication/restart/live acceptance remain separate user-owned
+      gates unless explicitly requested.
+
+Primary anchors:
+
+- `packages/cli/src/tui/telegram-bridge.ts`
+- `packages/cli/src/tui/telegram-terminal-review-checkpoint.ts`
+- `packages/cli/src/tui/telegram-resource-manifest.ts`
+- `packages/cli/src/tui/telegram-durable-continuation-policy.ts`
+- `packages/cli/tests/telegram-terminal-review-checkpoint.test.ts`
+- `packages/cli/tests/telegram-terminal-delivery.test.ts`
+- `packages/cli/tests/telegram-resource-manifest.test.ts`
+- `packages/cli/tests/telegram-objective-resume.test.ts`
+- `packages/cli/tests/telegram-lifecycle-leak.test.ts`
+- `packages/cli/tests/telegram-bot-api-10.test.ts`
 
 ## Cross-surface validation gates
 
@@ -461,7 +684,7 @@ Primary anchors:
 - [x] Independent review finds no path that can claim a mutation without its
       typed receipt or bind a Telegram response without exact current reply or
       provider-delivery authority.
-- [ ] Changes are committed in scoped, verified commits and pushed to the
+- [x] Changes are committed in scoped, verified commits and pushed to the
       tracked branch.
 - [ ] Live Telegram acceptance remains unchecked unless the exact deployed
       runtime is rebuilt/restarted and validated under the hardware and service
@@ -469,22 +692,26 @@ Primary anchors:
 
 ## Traceability matrix
 
-| Requirement | Production anchors                               | Regression anchors                                 | Status        |
-| ----------- | ------------------------------------------------ | -------------------------------------------------- | ------------- |
-| REQ-TDT-001 | orchestrator expected effects/readiness          | terminal finalization + runner                     | focused green |
-| REQ-TDT-002 | Telegram task completion/delivery                | public/private/no-reply                            | focused green |
-| REQ-TDT-003 | Telegram routing + reminder receipt              | 5652/5653/5698/607 replay                          | focused green |
-| REQ-TDT-004 | expected-outcome normalization                   | PNG inline research                                | focused green |
-| REQ-TDT-005 | steering projection/ownership                    | PNG to Borneo steering                             | focused green |
-| REQ-TDT-006 | safe-delivery receipt parser                     | wrappers + redirects                               | focused green |
-| REQ-TDT-007 | terminal recovery/memory eligibility             | retained-candidate recovery                        | focused green |
-| REQ-TDT-008 | capability admission + unavailable ownership     | 5712/610 + recovery ordering                       | focused green |
-| REQ-TDT-009 | recovered-contract migration + convergence gates | exact recovery + synthesis timing + bounded review | focused green |
-| REQ-TDT-010 | continuation + control-plane convergence         | 5717/612 + exact review contract                   | focused green |
-| REQ-TDT-011 | reminder read/write scope authorization          | group/DM/topic/foreign-ID isolation                | focused green |
-| REQ-TDT-012 | typed direct-turn action continuation            | exact OMNIUS 5719 + ambient controls               | focused green |
-| REQ-TDT-013 | elided cross-thread task continuation            | exact OMNIUS 5721/5723 + scope controls            | focused green |
-| REQ-TDT-014 | delegated batch continuation + terminal handoff  | Case Theory 642/644 + scope/batch controls         | in progress   |
+| Requirement | Production anchors                                | Regression anchors                                 | Status                          |
+| ----------- | ------------------------------------------------- | -------------------------------------------------- | ------------------------------- |
+| REQ-TDT-001 | orchestrator expected effects/readiness           | terminal finalization + runner                     | focused green                   |
+| REQ-TDT-002 | Telegram task completion/delivery                 | public/private/no-reply                            | focused green                   |
+| REQ-TDT-003 | Telegram routing + reminder receipt               | 5652/5653/5698/607 replay                          | focused green                   |
+| REQ-TDT-004 | expected-outcome normalization                    | PNG inline research                                | focused green                   |
+| REQ-TDT-005 | steering projection/ownership                     | PNG to Borneo steering                             | focused green                   |
+| REQ-TDT-006 | safe-delivery receipt parser                      | wrappers + redirects                               | focused green                   |
+| REQ-TDT-007 | terminal recovery/memory eligibility              | retained-candidate recovery                        | focused green                   |
+| REQ-TDT-008 | capability admission + unavailable ownership      | 5712/610 + recovery ordering                       | focused green                   |
+| REQ-TDT-009 | recovered-contract migration + convergence gates  | exact recovery + synthesis timing + bounded review | focused green                   |
+| REQ-TDT-010 | continuation + control-plane convergence          | 5717/612 + exact review contract                   | focused green                   |
+| REQ-TDT-011 | reminder read/write scope authorization           | group/DM/topic/foreign-ID isolation                | focused green                   |
+| REQ-TDT-012 | typed direct-turn action continuation             | exact OMNIUS 5719 + ambient controls               | focused green                   |
+| REQ-TDT-013 | elided cross-thread task continuation             | exact OMNIUS 5721/5723 + scope controls            | focused green                   |
+| REQ-TDT-014 | delegated batch continuation + terminal handoff   | Case Theory 642/644/645 + scope/batch controls     | focused green; redeploy pending |
+| REQ-TDT-015 | scoped batch cadence + truthful resource evidence | batch projection/compiler + media evidence/plan    | focused green; redeploy pending |
+| REQ-TDT-016 | event cadence + renewable runner lease            | lifecycle leak + steering/finalization             | delivered; redeploy pending     |
+| REQ-TDT-017 | exact Telegram forum-topic delivery               | final chunks + commands + artifacts                | focused green; redeploy pending |
+| REQ-TDT-018 | delivery commit + full batch recovery              | exact 23-file message-650 replay                    | implementation in progress      |
 
 ## Evidence log
 
@@ -760,3 +987,152 @@ one sec.`) without an action run or data result.
   passed.
 - No publish, install, service restart, Telegram send, or live inference was
   performed by this validation.
+
+### 2026-10-02 — Case Theory 642/644 durable batch root repair
+
+- The retained batch now owns a durable per-attachment resource manifest. Each
+  Telegram message/file identity maps to its own objective criterion, so three
+  successful reads cannot satisfy a 23-file batch and coarse checklist
+  observation cannot force `deliver_due`.
+- Durable media enumeration reads consumed update-spool and SQLite metadata in
+  exact chat/topic scope, paginates beyond the first 20 records, and
+  re-materializes expired local bytes from the retained Telegram `file_id`.
+  Successful media tools attach the exact resource criterion and observation
+  evidence to the objective result.
+- Native direct address can host-admit exactly one retained read-only task when
+  typed routing is unavailable. The admission is task-, chat-, topic-, actor-,
+  capability-, and TTL-bound; mutation, ambiguity, foreign scope, unaddressed
+  traffic, and unauthorized cross-actor inheritance remain denied. The exact
+  642 -> 644 replay uses Mariana's retained task and robitman's authenticated
+  group-admin delegation without any host phrase matching.
+- Terminal-review failure freezes a content-addressed checkpoint. Scheduler
+  retries invoke only terminal review; they do not restart attention, action
+  planning, or document processing. After runtime-state loss, the checkpoint
+  rehydrates a non-runnable review snapshot from durable task/candidate/receipt
+  state. A partial checkpoint is mechanically ineligible for delivery; only a
+  fresh reviewer may authorize bounded object continuation.
+- Retained tasks, resource manifests, read-only continuation plans, and terminal
+  checkpoints now have finite defaults, bounded renewal semantics, and natural
+  expiry. Restart loading rejects stale task leases rather than renewing them.
+- Validation: CLI typecheck passed. Focused CLI validation passed 158/158 across
+  terminal recovery, durable policy, resource manifests, objective resume,
+  media cache, and update spool; the complete Bot API 10 integration file
+  passed 163/163; the restart-style terminal rehydration suite passed 44/44;
+  the exact delegated 642 -> 644 replay passed independently. Orchestrator
+  checklist objective-control validation passed 8/8.
+- No publish, install, service restart, Telegram send, or live inference was
+  performed by this repair validation. Repository delivery and live acceptance
+  remain separate gates.
+
+### 2026-10-02 — live 1.0.797 active-scope contract failure and root repair
+
+- The user-owned runtime is globally installed `omnius@1.0.797`, PID `2003867`,
+  running from `telegram_test`. Polling and intake remained alive; the failure
+  was task identity, not process or Telegram transport liveness.
+- Message 645 produced a valid live action envelope that cited the exact old
+  task, but its expected-outcome contract simultaneously declared
+  `continuity:"new"` and used `chat:-1003960149435` as `activeScopeId`.
+  Because the validator did not relate continuity, scope, and active-task
+  evidence, the admission boundary replaced task 642 with a new coarse task.
+- The resulting run inspected messages 636-639, marked generic observation
+  satisfied, entered `deliver_due`, then continued with `tool_search` and
+  paginated `telegram_media_recent`. This is direct live evidence that model
+  diligence cannot substitute for an itemized objective frontier.
+- The typed validator now rejects incoherent scope before admission. `new` is
+  allowed only when the chat/topic has no active task and forbids an active
+  scope; continuation/status/replacement requires the exact ID of a cited host
+  active-task entry. The action-planner prompt states the same invariant. A
+  narrow legacy guard protects already queued decisions that contain the exact
+  observed chat-key/single-cited-task contradiction.
+- Focused validation passed: 9/9 objective-resume tests, CLI typecheck, and the
+  exact complete Bot API admission replay (1/1) all passed. That replay proves
+  task 642's ID, input, epoch, objective, durable plan ID, and tool scope are
+  retained and no task rooted at the follow-up input is created. Broader suite
+  validation and redeployment remain open.
+
+### 2026-10-02 — live 1.0.797 batch-cadence and resource-evidence root repair
+
+- The same user-owned message-645 run remained alive, but every changed tool
+  transaction forced a new virtual-memory plan/rerank/sufficiency sequence and
+  a new compilation plan. Observed cycles took roughly three minutes before
+  the next main decision even though the exact request still had 15,681 free
+  tokens (32.7% of a 48k window); inferred compaction was then rejected for
+  falling outside the 45-52% target occupancy.
+- The old runtime eventually found `ocr_pdf` and extracted exact one-page
+  timesheet text for messages 642, 641, 640, and 639, including typed totals,
+  but immediately re-entered the same auxiliary pipeline after each batch.
+  This proved backend/tool capability was healthy and the stall was runner
+  cadence, not Telegram transport, GPU placement, or OCR dependency failure.
+- The orchestrator now accepts only a host-authored, TTL-bound objective read
+  batch tied to one session, epoch, objective identity/revision, and exact
+  resource criteria. One accepted read-only observation authorizes one reuse;
+  all mismatches and batch boundaries return to ordinary auxiliary inference.
+  Exact requests remain lossless above 20% free capacity; normal compaction is
+  mandatory below that boundary.
+- Resource evidence is now content-sensitive. A successful document receipt
+  with zero text does not satisfy an attachment criterion. Typed PDF extraction
+  with actual characters (or a complete query-negative receipt) does. A bare
+  artifact mutation without observed content does not.
+- Durable Telegram capability authority now agrees with execution semantics:
+  `ocr_pdf` is no longer a durable read-only tool. Active PDF manifests mint
+  `telegram_media_recent + pdf_to_text` ahead of stale generic tools, and an
+  existing plan is replaced when its scoped tool set differs instead of being
+  automatically renewed.
+- Validation passed: orchestrator virtual-context/compiler suites 25/25;
+  Telegram durable-policy/objective/resource suites 34/34; focused Telegram
+  objective/evidence suites 29/29; complete Telegram Bot API 10 suite 164/164;
+  CLI and orchestrator typechecks; Prettier and `git diff --check` on the
+  affected source. The installed 1.0.797 runtime does not contain these
+  repairs, so post-publish restart and exact live acceptance remain open.
+- Delivery is split into scoped commits: `2bfbd875` (reminder scope and typed
+  receipts), `718ad983` (objective truth and batch cadence), and `50cfde89`
+  (Telegram task/resource scope). All were verified before delivery to the
+  tracked `origin/main` branch; this work-order record is the final documentation
+  commit in that delivery.
+
+### 2026-10-02 — live sidecar-review cadence root repair
+
+- The continuing 1.0.797 Case Theory run extracted PDFs 642 through 634, but
+  repeatedly launched `stalled-metacognitive-review-retry` while the parent
+  runner was still producing OCR and lifecycle events. Its activity panel
+  showed 898s, 1125s, and 1892s "quiet" epochs plus rejected review contracts;
+  the parent task remained `running` with no Telegram delivery receipt.
+- Root cause: the watchdog measured time since the last material objective
+  delta rather than time since the last typed runner event, while a second
+  tool-result hook could launch the same sidecar review from intermediate
+  frontier state. This gave live cadence to two model loops and misclassified
+  active control/OCR work as semantic silence.
+- The watchdog now enforces a renewable event lease using `lastActivityMs`.
+  It never starts model inference. Active exact-session inference suppresses
+  expiry; a genuinely event-silent runner is generation-fenced, aborted, and
+  requeued from its retained intake after the configured TTL. Intermediate
+  tool results no longer launch a Telegram sidecar review.
+- Validation passed: CLI typecheck and build; 111/111 lifecycle, steering,
+  terminal-review, checkpoint, and objective-resume tests; complete Telegram
+  Bot API 10 suite 164/164; Prettier and `git diff --check`. Live acceptance
+  remains pending publication, installation, and broker restart.
+- Source delivery commit: `54a0e681` (`fix(cli): drive Telegram cadence from
+runner events`) on tracked `origin/main`; this documentation update records
+  that delivery and leaves only broader/full-suite and deployed-live gates
+  open.
+
+### 2026-10-02 — Telegram General/topic delivery root repair
+
+- Live intake already retained the exact forum destination: OMNIUS message
+  5725 was stored as `telegram:chat:-1003888256865:5719:5725` with
+  `messageThreadId:5719`. The loss occurred only after admission: shared final
+  delivery, public progress creation, command replies, and media delivery did
+  not forward that destination to Telegram.
+- One native topic resolver now owns ephemeral typing and durable outbound
+  delivery. Final text chunks, HTML/plain fallbacks, public progress, menus,
+  terminal questions, generated artifacts, and same-chat file effects carry
+  `message_thread_id`; exact-payload and artifact idempotency keys include the
+  topic as destination identity.
+- Callback generation state is keyed by chat/topic/actor. Autonomous follow-up
+  is withheld when its evidence crosses topics instead of falling back to the
+  forum root/All view.
+- Validation passed on the completed patch: CLI typecheck and build; 14/14
+  transport-contract tests; 7/7 command-menu tests; complete Telegram Bot API
+  10 suite 164/164; focused Prettier checks and `git diff --check`.
+- Publication, installation, broker restart, and a fresh General-topic live
+  receipt remain separate deployment/acceptance gates.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.797",
+  "version": "1.0.799",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.797",
+      "version": "1.0.799",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.797",
+  "version": "1.0.799",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/library.js",