omnius 1.0.798 → 1.0.800

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 39293720 bytes
-sha256: b42d8ee55332f05faf34e2f916f255e665af67cdcccd40b3bd5ee34b852741c2
+size: 39351823 bytes
+sha256: 812b782621e8e4b7fb2af446cd38684559e1ea1fa8c79c43345605a4084e24c8

package/docs/DISCOVERY.json

@@ -35906,7 +35906,7 @@
       "id": "guide.work-orders-runtime-health-remediation-wo-57-telegram-delivery-truth-and-recovery-uppercase",
       "kind": "guide",
       "title": "WO-57: Telegram delivery truth, reminder authority, and bounded recovery",
-      "summary": "Status: 1.0.797 live acceptance failed on Case Theory message 645; REQ-TDT-014/015/016 are delivered and focused-green; full-suite, redeployment, and live-acceptance gates remain open Priority: P0 Incident: October 1, 2026, live Telegram reminder and illegal-logging non-responses Owner: Omnius orchestrator and Telegram runtime Depends on: WO-41, WO-44, WO-49",
+      "summary": "Status: 1.0.798 live acceptance failed on Case Theory message 650; REQ-TDT-018 delivery-commit convergence and complete batch-scope repair are verified and pushed; full-suite, publication, redeployment, and live-acceptance gates remain open Priority: P0 Incident: October 1, 2026, live Telegram reminder and illegal-logging non-responses Owner: Omnius orchestr",
       "keywords": [
         "work",
         "orders",

package/docs/DISCOVERY.md

@@ -609,7 +609,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-runtime-health-remediation-wo-54-case-theory-router-deferral-recovery-uppercase` | WO-54: Case Theory router deferral recovery | Status: complete Priority: P0 Incident: September 26, 2026, Case Theory messages 455–456 Runtime observed: globally installed Omnius 1.0.764 Owner: current implementation session |
 | `guide.work-orders-runtime-health-remediation-wo-55-telegram-pressure-recovery-uppercase` | WO-55: Telegram pressure recovery without silent terminal states | Status: complete Priority: P0 Incident: September 26, 2026, Case Theory messages 458-461 Owner: current implementation session |
 | `guide.work-orders-runtime-health-remediation-wo-56-evidence-driven-objective-loop-uppercase` | WO-56: Evidence-driven objective loop and nonblocking execution | Status: repository implementation complete; live Telegram acceptance remains an external gate Priority: P0 Incident: September 27, 2026, Telegram SSH-over-Cloudflare task spiral and TUI freeze Owner: Omnius orchestration, execution, and Telegram runtime Depends on: WO-05, WO-21, WO-27, WO-41, WO-44, WO-49, WO-54, WO-55 Completion rule: A checkbox may be mark |
-| `guide.work-orders-runtime-health-remediation-wo-57-telegram-delivery-truth-and-recovery-uppercase` | WO-57: Telegram delivery truth, reminder authority, and bounded recovery | Status: 1.0.797 live acceptance failed on Case Theory message 645; REQ-TDT-014/015/016 are delivered and focused-green; full-suite, redeployment, and live-acceptance gates remain open Priority: P0 Incident: October 1, 2026, live Telegram reminder and illegal-logging non-responses Owner: Omnius orchestrator and Telegram runtime Depends on: WO-41, WO-44, WO-49 |
+| `guide.work-orders-runtime-health-remediation-wo-57-telegram-delivery-truth-and-recovery-uppercase` | WO-57: Telegram delivery truth, reminder authority, and bounded recovery | Status: 1.0.798 live acceptance failed on Case Theory message 650; REQ-TDT-018 delivery-commit convergence and complete batch-scope repair are verified and pushed; full-suite, publication, redeployment, and live-acceptance gates remain open Priority: P0 Incident: October 1, 2026, live Telegram reminder and illegal-logging non-responses Owner: Omnius orchestr |
 | `guide.work-orders-telegram-dmn-wo-22-dmn-outreach-and-learning-uppercase` | WO-22: DMN outreach, DM sharing, and outcome learning | On 2026-09-03 at 17:07 PDT the bot posted in the OMNIUS group without being addressed. The operator asked whether this was self-induced reflection. |
 | `guide.work-orders-telegram-dropbear-context-rca-workorder` | Telegram Dropbear Context Engineering RCA Work Order | Observed run: /home/roko/Documents/Projects/Adjacent/telegramtest/.omnius, run id 1782873796963-i5r7mv. |
 | `guide.work-orders-telegram-reliability-consolidation-2026-09-28` | Telegram Reliability Consolidation — 2026-09-28 | Rule: check a box only after the named behavior is implemented and its listed verification passes. A parent box stays open until every child box is checked. |

package/docs/work-orders/runtime-health-remediation/WO-57-telegram-delivery-truth-and-recovery.md

@@ -1,8 +1,9 @@
 # WO-57: Telegram delivery truth, reminder authority, and bounded recovery
 
-**Status:** 1.0.797 live acceptance failed on Case Theory message 645;
-REQ-TDT-014/015/016 are delivered and focused-green; full-suite, redeployment,
-and live-acceptance gates remain open
+**Status:** 1.0.798 live acceptance failed on Case Theory message 650;
+REQ-TDT-018 delivery-commit convergence and complete batch-scope repair are
+verified and pushed; full-suite, publication, redeployment, and live-acceptance
+gates remain open
 **Priority:** P0
 **Incident:** October 1, 2026, live Telegram reminder and illegal-logging non-responses
 **Owner:** Omnius orchestrator and Telegram runtime
@@ -14,12 +15,16 @@ is not a Telegram delivery receipt.
 ## Objective
 
 Restore truthful, bounded delivery across Telegram action, quick-chat, steering,
-and recovery paths. A successful observation must reach the user exactly once;
-a mutation may be claimed only after its typed tool receipt; inline research must
-not require an impossible external-provider receipt; recovery must reuse current
-verified evidence instead of replaying the full reasoning loop. A scoped
-reminder tool must never read or mutate reminders owned by another chat, topic,
-surface, or unscoped/global context.
+and recovery paths. A successful observation must not be credited before a
+provider receipt, lost on restart, or blindly duplicated after ambiguous
+provider acceptance; a mutation may be claimed only after its typed tool
+receipt; inline research must not require an impossible external-provider
+receipt; recovery must reuse current verified evidence instead of replaying the
+full reasoning loop. A scoped reminder tool must never read or mutate reminders
+owned by another chat, topic, surface, or unscoped/global context. A response
+admitted from a Telegram forum topic must keep that exact topic on every text,
+media, menu, callback, and autonomous-follow-up delivery; replying to a message
+is not a substitute for the native `message_thread_id` destination.
 
 ## Baseline and live evidence
 
@@ -113,6 +118,26 @@ please follow her instructions`, but the explicit-continuation grammar
       classified `ocr_pdf` as read-only while the registered execution tool
       correctly classified it as mutating, and stale generic tools were
       ordered ahead of the manifest-specific `pdf_to_text` reader.
+- [x] Anchor the forum-topic transport breach: the OMNIUS intake for message
+      5725 retained `messageThreadId:5719` and exact input identity
+      `telegram:chat:-1003888256865:5719:5725`, while the shared final-reply,
+      command-reply, blocking-question, generation, and artifact paths called
+      Telegram without `message_thread_id`. Telegram therefore placed scoped
+      output at the forum root/All surface instead of General/topic 5719.
+- [x] Anchor the 1.0.798 false-terminal regression: run
+      `telegram-84e4e6e5411c9753-1790980997771-1` committed `completed` at
+      `2026-10-02T22:50:33.197Z` while its durable objective frontier still
+      listed `effect:visible_response` as open, its claim remained unverified,
+      and no Telegram assistant message or provider delivery receipt existed.
+- [x] Anchor the 1.0.798 manifest regression: messages 620 through 642 contain
+      23 ordered PDF time cards, while the recovered task OCRed/inspected only
+      messages 634 through 642 and authored a nine-card answer despite message
+      650 explicitly retaining prior time cards.
+- [x] Anchor the 1.0.798 recovery livelock: checkpoint
+      `tgtrc-943243df3fbb01e2377b73b16275f3c9` reached at least retry 10;
+      every retry reported `object work remains frozen`, no runner artifact
+      changed after the false terminal commit, and typing ceased while the
+      Telegram poller remained healthy.
 
 Runtime evidence:
 
@@ -133,6 +158,8 @@ Runtime evidence:
 - `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-intake/f39b2cf564299c28fc81.jsonl`
 - `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-social-events/f39b2cf564299c28fc81b388.jsonl`
 - `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-runner-state/84e4e6e5411c97531047/tool-results/d1601e4c.txt`
+- `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-intake/0c499aca482c61832afa.jsonl`
+- `/home/roko/Documents/Projects/Adjacent/telegram_test/.omnius/telegram-conversations/c34a3d7d53728329c081.events.jsonl`
 
 ## Requirements and implementation checklist
 
@@ -564,6 +591,89 @@ Primary anchors:
 - `packages/cli/tests/telegram-objective-resume.test.ts`
 - `packages/cli/tests/telegram-bot-api-10.test.ts`
 
+### REQ-TDT-017 — exact Telegram forum-topic delivery
+
+- [x] Resolve one immutable outbound topic from the admitted Telegram message
+      or its native reply context; never infer a destination from prose or a
+      chat-wide "last topic" value.
+- [x] Attach `message_thread_id` to every chunk of the shared final-delivery
+      path, including HTML-to-plaintext fallback and parsed-media delivery.
+- [x] Bind the topic into the exact-payload delivery ledger so a receipt from
+      one topic cannot authorize replay or completion in another.
+- [x] Preserve the topic on public progress creation/fallbacks, command replies,
+      terminal blocking questions, help/stats/menu output, generation
+      status/results, generated artifacts, screenshots, and same-chat
+      `telegram_send_file` effects.
+- [x] Scope callback-driven generation intent by chat, topic, and actor so a
+      prompt in one topic cannot consume pending state created in another.
+- [x] Require autonomous follow-up evidence to resolve to one topic; suppress
+      cross-topic proposals instead of posting them at the chat root.
+- [x] Prove a multi-chunk final answer sends every chunk to topic 5719 while
+      only the first chunk replies to source message 5725.
+- [x] Prove command-style replies and generated artifact uploads keep topic
+      5719, while root/private controls remain unchanged.
+- [x] Pass CLI typecheck/build, focused transport/Bot API regressions,
+      formatting, and `git diff --check`.
+- [ ] Publish/install/restart, then prove a fresh message in Telegram General
+      receives its reply in General and not only in the All view.
+
+Primary anchors:
+
+- `packages/cli/src/tui/telegram-bridge.ts` — immutable topic resolution and
+  all outbound text/media delivery paths.
+- `packages/cli/src/tui/telegram-command-menu.ts` — topic-bound callback state.
+- `packages/cli/tests/telegram-transport-contract.test.ts`
+- `packages/cli/tests/telegram-bot-api-10.test.ts`
+
+### REQ-TDT-018 — delivery-commit convergence and complete batch recovery
+
+- [x] Induct primary operational guidance for transactional outbox delivery,
+      idempotent exact-request retries, durable history replay, bounded retry
+      exhaustion, and Telegram provider/typing semantics into
+      `.aiwg/research/terminal-metacognitive-control/`.
+- [x] Represent an accepted Telegram `user_reply` as durable pending delivery,
+      not as a completed visible-response effect. A terminal success may not
+      clear the task until the exact destination/payload receives a Telegram
+      provider receipt.
+- [x] Bind delivery retries to one task/input/epoch/topic/payload hash. A
+      process restart resumes work that was still durably pending without
+      rerunning completed document/OCR work; a restart after dispatch began but
+      before a Bot API receipt becomes `delivery_ambiguous` and is not blindly
+      resent. Exactly-once remains unavailable on the HTTP Bot API because it
+      accepts no caller idempotency token (REF-048).
+- [x] Make terminal semantic review a bounded decision activity. Review
+      unavailability cannot dispatch indefinitely: after the configured
+      attempt/elapsed budget, a complete evidence-bound candidate follows the
+      deterministic delivery path; a partial candidate retains a truthful
+      blocked/needs-input state.
+- [x] Preserve the complete host-enumerated 23-file resource manifest across
+      delegated continuation and restart. No prefix/suffix window, model prose,
+      or generic observation may reduce or satisfy the itemized batch.
+- [x] Keep typing as an event-driven ephemeral projection while work or pending
+      delivery is genuinely active. Typing never owns the runner lease and
+      stops on provider receipt, cancellation, expiry, or terminal failure.
+- [x] Add deterministic regressions reproducing message 650: 23 admitted PDFs,
+      nine previously processed files, restart, unavailable reviewer, bounded
+      retry, exact candidate delivery, provider receipt, one public reply, and
+      no repeated OCR or unbounded dispatch.
+- [x] Pass affected CLI/orchestrator focused suites, typechecks/builds,
+      formatting, `git diff --check`, and independent review.
+- [x] Commit and push the scoped repair. Publication/restart/live acceptance
+      remain separate user-owned gates unless explicitly requested.
+
+Primary anchors:
+
+- `packages/cli/src/tui/telegram-bridge.ts`
+- `packages/cli/src/tui/telegram-terminal-review-checkpoint.ts`
+- `packages/cli/src/tui/telegram-resource-manifest.ts`
+- `packages/cli/src/tui/telegram-durable-continuation-policy.ts`
+- `packages/cli/tests/telegram-terminal-review-checkpoint.test.ts`
+- `packages/cli/tests/telegram-terminal-delivery.test.ts`
+- `packages/cli/tests/telegram-resource-manifest.test.ts`
+- `packages/cli/tests/telegram-objective-resume.test.ts`
+- `packages/cli/tests/telegram-lifecycle-leak.test.ts`
+- `packages/cli/tests/telegram-bot-api-10.test.ts`
+
 ## Cross-surface validation gates
 
 - [x] Orchestrator focused tests pass for visible-response evidence, completion
@@ -605,6 +715,8 @@ Primary anchors:
 | REQ-TDT-014 | delegated batch continuation + terminal handoff   | Case Theory 642/644/645 + scope/batch controls     | focused green; redeploy pending |
 | REQ-TDT-015 | scoped batch cadence + truthful resource evidence | batch projection/compiler + media evidence/plan    | focused green; redeploy pending |
 | REQ-TDT-016 | event cadence + renewable runner lease            | lifecycle leak + steering/finalization             | delivered; redeploy pending     |
+| REQ-TDT-017 | exact Telegram forum-topic delivery               | final chunks + commands + artifacts                | focused green; redeploy pending |
+| REQ-TDT-018 | delivery commit + full batch recovery             | exact 23-file message-650 replay                   | focused green; deploy pending   |
 
 ## Evidence log
 
@@ -1008,3 +1120,68 @@ one sec.`) without an action run or data result.
 runner events`) on tracked `origin/main`; this documentation update records
   that delivery and leaves only broader/full-suite and deployed-live gates
   open.
+
+### 2026-10-02 — Telegram General/topic delivery root repair
+
+- Live intake already retained the exact forum destination: OMNIUS message
+  5725 was stored as `telegram:chat:-1003888256865:5719:5725` with
+  `messageThreadId:5719`. The loss occurred only after admission: shared final
+  delivery, public progress creation, command replies, and media delivery did
+  not forward that destination to Telegram.
+- One native topic resolver now owns ephemeral typing and durable outbound
+  delivery. Final text chunks, HTML/plain fallbacks, public progress, menus,
+  terminal questions, generated artifacts, and same-chat file effects carry
+  `message_thread_id`; exact-payload and artifact idempotency keys include the
+  topic as destination identity.
+- Callback generation state is keyed by chat/topic/actor. Autonomous follow-up
+  is withheld when its evidence crosses topics instead of falling back to the
+  forum root/All view.
+- Validation passed on the completed patch: CLI typecheck and build; 14/14
+  transport-contract tests; 7/7 command-menu tests; complete Telegram Bot API
+  10 suite 164/164; focused Prettier checks and `git diff --check`.
+- Publication, installation, broker restart, and a fresh General-topic live
+  receipt remain separate deployment/acceptance gates.
+
+### 2026-10-02 — REQ-TDT-018 durable delivery and batch-recovery convergence
+
+- Primary guidance was inducted for transactional outbox state, idempotent
+  request identity, durable event replay, bounded retry exhaustion, and
+  Telegram delivery/typing semantics. The HTTP Bot API has no caller-supplied
+  idempotency key, so a request that may have been accepted without a returned
+  message receipt is now retained as `delivery_ambiguous` and is not resent
+  automatically.
+- A terminal `user_reply` is a provider-delivery candidate, not visible
+  completion. Its immutable ledger transition is `prepared` ->
+  `dispatch_started` -> provider receipt; only the receipt clears the exact
+  task/input/epoch/topic/payload operation. Provider attempts are bounded to
+  four attempts and 90 seconds; only explicit flood control is automatically
+  retryable.
+- Restart recovery enters checkpoint transport before capability inference,
+  routing, OCR, or object work. Completed document receipts and the full
+  messages 620-642 resource manifest survive database/spool divergence and
+  retain their configured TTL. Expired leases are not silently revived.
+- Terminal review is a bounded activity. A complete evidence-bound candidate
+  takes the deterministic delivery path when review is unavailable; a partial
+  candidate cannot. Typing is emitted only as an activity pulse and does not
+  own a retry timer or runner lease.
+- Checkpoint queue settlement partitions exact owner intake from later work,
+  re-reads the live queue across lifecycle awaits, and wakes residual work.
+  Regressions cover concurrent arrival, retry-cap, missing checkpoint,
+  rehydration failure, no-reply, wait-for-user, and multi-chunk delivery exits.
+- Forum identity is canonicalized at ingress: a positive raw thread wins,
+  otherwise a positive native reply-context thread is frozen. Input, task,
+  history, checkpoint, ledger, restart, and provider payload therefore cannot
+  disagree or fall back to chat-wide scope.
+- Validation passed: 390/390 affected Telegram tests and 10/10 orchestrator
+  authority/finalization tests; CLI and orchestrator typechecks/builds;
+  Prettier, YAML parsing, and `git diff --check`. Two independent review rounds
+  found and closed the concurrent queue-loss and reply-context-only topic-scope
+  defects; the final review reported no blocker.
+- Scoped source/test commit: `8f58e3f7` (`fix(telegram): converge durable
+terminal delivery`).
+- Research/work-order commit: `68546cd4` (`docs: induct durable Telegram
+delivery controls`). Both scoped commits were pushed to tracked branch
+  `origin/main` after a clean fetch confirmed no upstream divergence.
+- No live inference, Telegram send, publication, installation, or service
+  restart was performed. Deployment and live Case Theory/OMNIUS acceptance
+  remain open.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.798",
+  "version": "1.0.800",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.798",
+      "version": "1.0.800",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.798",
+  "version": "1.0.800",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/library.js",