omnius 1.0.806 → 1.0.808

package/dist/update-worker.js

@@ -295027,9 +295027,127 @@ init_vision();
 init_system_deps();
 init_vision();
 
+// packages/execution/dist/tools/pdf-corpus-archive.js
+init_process_async();
+
 // packages/execution/dist/tools/ocr-pdf.js
 init_process_async();
 
+// packages/execution/dist/tools/pdf-transform.js
+init_process_async();
+var BUFFER_BYTES = 128 * 1024;
+var MAX_RECORD_BYTES = 64 * 1024;
+
+// packages/execution/dist/tools/source-corpus.js
+var SEGMENT_CHARS = 64 * 1024;
+var RECORD_BYTES = 64 * 1024;
+var ACTIONS = /* @__PURE__ */ new Set(["ingest", "inventory", "search", "read", "begin", "process", "status"]);
+var SOURCE_CORPUS_TOOL_DEFINITION = {
+  name: "source_corpus",
+  aliases: ["pdf_corpus"],
+  description: "Acquire and process a scoped PDF corpus without a total document/page-count cap. ingest uses an immutable JSONL manifest, one {ref,sha256} per source, and returns a durable import ID; repeat it to resume bounded batches. Local directory acquisition requires an explicit host policy and resumes bounded traversal/hash/manifest work with ingest_id. It captures an observed, version-fenced filesystem selection, not an atomic live-tree snapshot, and excludes only this workspace's owned .omnius state tree. inventory/search are cursor-paged; read returns exact channel-labelled segments with character offsets. begin preserves the full processing request and selected source versions; process checkpoints complete native pages and resumes after cancellation/restart. Source bytes, full native text and bbox are archived before bounded views. Explicit filters.channel='ocr_text' schedules resumable CPU OCR; rendered pages, engine/language, full OCR text and TSV are preserved separately. For OCR summaries/extractions use corpus_work filters.channel='ocr_text', complete anchored work, export, and corpus_export_review before delivery; source_answer_review only accepts native facts. Native or OCR engine completion does not prove visual understanding, summaries or final delivery.",
+  parameters: { type: "object", properties: {
+    action: { type: "string", enum: [...ACTIONS] },
+    corpus_id: { type: "string" },
+    manifest: { type: "string", description: "Host-authorized JSONL file or alias; one {ref,sha256} record per PDF." },
+    manifest_sha256: { type: "string" },
+    directory: { type: "string", description: "Explicit local-admin directory enumeration only." },
+    ingest_id: { type: "string", description: "Resume directory acquisition or the immutable import without resupplying its directory/manifest. Use a new ID for a deliberately changed directory selection." },
+    source_budget: { type: "integer", minimum: 1, maximum: 64 },
+    operation_id: { type: "string" },
+    request: { type: "string", description: "Complete extraction processing request; not authority to replace the user's goal." },
+    page_budget: { type: "integer", minimum: 1, maximum: 64 },
+    page_size: { type: "integer", minimum: 1, maximum: 128 },
+    cursor: { type: "string" },
+    query: { type: "string" },
+    filters: { type: "object" },
+    direction: { type: "string", enum: ["asc", "desc"] },
+    page_id: { type: "string" },
+    ocr_language: { type: "string", description: "Explicit OCR operation language, e.g. eng or eng+deu. Immutable after begin; uses installed Tesseract languages." },
+    char_offset: { type: "integer", minimum: 0 },
+    max_chars: { type: "integer", minimum: 2, maximum: SEGMENT_CHARS }
+  }, required: ["action", "corpus_id"], additionalProperties: false }
+};
+
+// packages/execution/dist/tools/corpus-work.js
+var ACTIONS2 = ["begin", "next", "read", "commit", "status", "complete", "cancel", "export", "aggregate", "order"];
+var CORPUS_WORK_TOOL_DEFINITION = {
+  name: "corpus_work",
+  aliases: ["pdf_corpus_work"],
+  description: "Durable model-driven summary or extraction over a scoped corpus. Native text is default; explicitly select filters.channel='ocr_text' for previously processed OCR evidence. begin preserves the FULL request and immutable selection. next gives bounded leased claims; read exposes each complete input through resumable exact character ranges. commit requires every input fully delivered through a successful host model request and exact quote anchors for every input. A read result prepares an exact range; same-response read+commit cannot establish model exposure. Full derived content is archived, never substituted for originals. Summary parents use host-issued bounded child membership and require complete child reads. Repeat next until leaves and reduction finish. Processing coverage is actor-attested, not proof of factual correctness, visual understanding or final delivery. Optional anchored decimal/count records support exact deterministic aggregates; record selection remains actor-attested. Exact anchored typed fields support SQL ordering before pagination through order, after processing completes. Text uses explicit binary collation; decimal is exact, dates calendar, clocks require declared fixed/source offsets. Missing and multiple values require explicit policies; field meaning and selection remain actor-attested. export resumably streams all derived leaf records and the summary root to JSONL. Repeat the exact export while completeExport=false; partial work has no finished artifact. byte_budget bounds each call, not the final output. Public OCR results require corpus_export_review prepare/process/finalize on the returned retained artifactPath; source_answer_review does not ground OCR inline prose. There is no total corpus or output count cap.",
+  parameters: { type: "object", properties: {
+    action: { type: "string", enum: [...ACTIONS2] },
+    corpus_id: { type: "string" },
+    operation_id: { type: "string" },
+    mode: { type: "string", enum: ["summary", "extraction"] },
+    request: { type: "string" },
+    filters: { type: "object" },
+    query: { type: "string" },
+    direction: { type: "string", enum: ["asc", "desc"] },
+    fan_in: { type: "integer", minimum: 2, maximum: 64, description: "Per-parent child allocation, not total corpus limit." },
+    byte_budget: { type: "integer", minimum: 1, maximum: 67108864, description: "Per-call export write/fixity byte budget; repeat export to finish arbitrarily large output." },
+    page_size: { type: "integer", minimum: 1, maximum: 32 },
+    claim_id: { type: "string" },
+    input_id: { type: "string" },
+    char_offset: { type: "integer", minimum: 0 },
+    max_chars: { type: "integer", minimum: 2, maximum: 65536 },
+    content: { type: "string", description: "Complete nonempty model-derived output for this claim." },
+    anchors: { type: "array", minItems: 1, items: { type: "object", properties: {
+      input_id: { type: "string" },
+      char_start: { type: "integer", minimum: 0 },
+      char_end: { type: "integer", minimum: 0 },
+      quote: { type: "string" }
+    }, required: ["input_id", "char_start", "char_end", "quote"], additionalProperties: false } },
+    fields: { type: "array", items: { type: "object", properties: {
+      field: { type: "string" },
+      kind: { type: "string", enum: ["text", "decimal", "date", "time", "datetime"] },
+      anchor: { type: "integer", minimum: 0 },
+      literal: { type: "string", description: "Entire exact literal in the indicated source anchor." },
+      timezone: { type: "string", description: "Dates: calendar. Clocks: source_offset when the literal has Z/offset; otherwise UTC or a fixed +/-HH:MM offset. No inferred timezone." }
+    }, required: ["field", "kind", "anchor", "literal"], additionalProperties: false } },
+    order_spec: { type: "object", properties: {
+      field: { type: "string" },
+      kind: { type: "string", enum: ["text", "decimal", "date", "time", "datetime"] },
+      unit: { type: "string", enum: ["source", "page"] },
+      direction: { type: "string", enum: ["asc", "desc"] },
+      missing: { type: "string", enum: ["first", "last", "exclude", "error"] },
+      multiple: { type: "string", enum: ["min", "max", "error"] },
+      collation: { type: "string", enum: ["binary"] },
+      timezone: { type: "string", enum: ["calendar", "recorded_offset"] },
+      timeSemantics: { type: "string", enum: ["utc_clock"] },
+      where: { type: "object", properties: { equals: { type: "string" }, from: { type: "string" }, through: { type: "string" } }, additionalProperties: false }
+    }, required: ["field", "kind", "unit", "direction", "missing", "multiple"], additionalProperties: false },
+    cursor: { type: "string" },
+    numbers: { type: "array", items: { type: "object", properties: {
+      field: { type: "string" },
+      kind: { type: "string", enum: ["decimal", "count"] },
+      anchor: { type: "integer", minimum: 0 },
+      literal: { type: "string" }
+    }, required: ["field", "kind", "anchor"], additionalProperties: false } },
+    field: { type: "string" }
+  }, required: ["action", "corpus_id", "operation_id"], additionalProperties: false }
+};
+
+// packages/execution/dist/tools/pdf-corpus-transform.js
+init_process_async();
+var LINE_BYTES = 64 * 1024;
+var ACTIONS3 = /* @__PURE__ */ new Set(["begin", "process", "status"]);
+var PDF_CORPUS_TRANSFORM_TOOL_DEFINITION = {
+  name: "pdf_corpus_transform",
+  aliases: ["pdf_corpus_compose"],
+  description: "Resumable original-page PDF merge, split and reorder over an acquired source_corpus. begin accepts an immutable JSONL recipe with one {sourceId,sourceSha256,page} per output page; order and repetitions are exact. process commits bounded partial PDFs and a durable merge tree; repeat the same operation_id after cancellation/update/restart. Source references must already belong to this host-scoped corpus. No text/OCR extraction is required for page copying. Returns a canonical PDF and streamed flattened original-page lineage with exact hashes; document metadata/forms/signatures are not preserved. No total PDF/page-count cap; each physical merge is atomic and may require a longer host work deadline for very large containers.",
+  parameters: { type: "object", properties: {
+    action: { type: "string", enum: [...ACTIONS3] },
+    corpus_id: { type: "string" },
+    operation_id: { type: "string" },
+    operation: { type: "string", enum: ["merge", "split", "reorder"] },
+    request: { type: "string", description: "Complete caller-declared transformation request; does not replace host goal authority." },
+    manifest: { type: "string" },
+    manifest_sha256: { type: "string" },
+    work_budget: { type: "integer", minimum: 1, maximum: 64, description: "Bounded recipe import or leaf/merge work units for this invocation." }
+  }, required: ["action", "corpus_id", "operation_id"], additionalProperties: false }
+};
+
 // packages/execution/dist/tools/pdf-visual-markdown.js
 var MAX_IMAGE_BYTES = 8 * 1024 * 1024;
 

package/docs/DISCOVERY.json

@@ -29211,6 +29211,37 @@
         }
       ]
     },
+    {
+      "id": "guide.corpus-ocr",
+      "kind": "guide",
+      "title": "Explicit scanned-PDF corpus OCR",
+      "summary": "The public sourcecorpus tool can process an acquired PDF population with begin using filters: {channel: \"ocrtext\"} and optional ocrlanguage (default eng). Repeated process calls resume a durable per-source page cursor. Installed CPU Poppler and Tesseract are required. The default channel remains nativetext; completing native extraction of an empty scanned pa",
+      "keywords": [
+        "corpus",
+        "ocr",
+        "md"
+      ],
+      "maturity": "stable",
+      "audiences": [
+        "user",
+        "integrator",
+        "coding-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/corpus-ocr.md"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/corpus-ocr.md",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
     {
       "id": "guide.dedup-false-positive-meta-analysis",
       "kind": "guide",
@@ -29931,6 +29962,38 @@
         }
       ]
     },
+    {
+      "id": "guide.guides-pdf-collections",
+      "kind": "guide",
+      "title": "Large PDF collections",
+      "summary": "Ask Omnius to process the collection in ordinary language, specifying the result you need: search, ordering, original-page manipulation, summary, or extraction. For example: “Review every supplied PDF, extract each recorded duration with its source page, order the documents by the invoice date, and deliver the complete results.” A field's meaning, units, mis",
+      "keywords": [
+        "guides",
+        "pdf",
+        "collections",
+        "md"
+      ],
+      "maturity": "stable",
+      "audiences": [
+        "user",
+        "integrator",
+        "coding-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/guides/pdf-collections.md"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/guides/pdf-collections.md",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
     {
       "id": "guide.guides-realtime",
       "kind": "guide",
@@ -45026,6 +45089,62 @@
         }
       ]
     },
+    {
+      "id": "tool.pdf-transform",
+      "kind": "tool",
+      "title": "Pdf Transform",
+      "summary": "pdf_transform is a directly callable Omnius tool.",
+      "aliases": [
+        "pdf_transform"
+      ],
+      "keywords": [
+        "tool",
+        "pdf",
+        "transform"
+      ],
+      "maturity": "stable",
+      "layer": "execution",
+      "audiences": [
+        "coding-agent",
+        "integrator",
+        "service-agent"
+      ],
+      "use_when": [
+        "The caller needs this isolated operation and live metadata confirms direct-call availability"
+      ],
+      "avoid_when": [
+        "The live registry reports the tool unavailable or the caller lacks its required scope"
+      ],
+      "interfaces": [
+        {
+          "type": "rest-schema",
+          "target": "/v1/tools/pdf_transform"
+        },
+        {
+          "type": "rest-call",
+          "target": "/v1/tools/pdf_transform/call"
+        }
+      ],
+      "references": [
+        {
+          "type": "source",
+          "target": "packages/execution/src/tools/pdf-transform.ts",
+          "relation": "implementation"
+        }
+      ],
+      "direct_callable": true,
+      "live_metadata": "GET /v1/tools/pdf_transform",
+      "source_of_truth": [
+        "packages/execution/src/tools/pdf-transform.ts",
+        "GET /v1/tools/pdf_transform"
+      ],
+      "verification": [
+        {
+          "check": "Inspect GET /v1/tools/pdf_transform before use",
+          "expected": "Schema, security, exposure, and availability match the intended invocation"
+        }
+      ]
+    },
     {
       "id": "tool.pdf-visual-markdown",
       "kind": "tool",

package/docs/DISCOVERY.md

@@ -420,6 +420,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.asd-ste100-communication-audit-uppercase` | ASD-STE100 Communication Audit | Use ASD-STE100 Issue 9 for all Omnius natural-language communication. Apply the rule to external replies and internal agent messages. Preserve exact machine content without a change. |
 | `guide.concept-relational-language` | Concept Relational Language (CRL) — Token-Efficient Concept Communication | &gt; Experimental hyper-compressed symbolic notation for mind-mapped logical flow tracking |
 | `guide.context-management-medium-models-proposal` | Context Management for Medium Models (30-40B) — Implementation Proposal | Date: 2026-04-25 Problem: Medium-tier models (~35B params) exhibit excessive repetition at ~35% context fill despite 256K context windows Root Cause: Monolithic context structure + attention degradation + tool schema bloat |
+| `guide.corpus-ocr` | Explicit scanned-PDF corpus OCR | The public sourcecorpus tool can process an acquired PDF population with begin using filters: {channel: "ocrtext"} and optional ocrlanguage (default eng). Repeated process calls resume a durable per-source page cursor. Installed CPU Poppler and Tesseract are required. The default channel remains nativetext; completing native extraction of an empty scanned pa |
 | `guide.dedup-false-positive-meta-analysis` | Meta-Analysis: False Positive Duplicate Tool Call Detection | Date: 2026-05-14 Scope: packages/orchestrator/src/agenticRunner.ts — proactivePrune() + buildResourceKey() |
 | `guide.discovery-agent-map` | Agent Map | Bundled Omnius documentation artifact: docs/discovery/agent-map.json. |
 | `guide.discovery-catalog-overrides` | Discovery Catalog Curated Source | Curated aliases, relationships, invocation modes, and conceptual entries merged into the generated catalog. |
@@ -442,6 +443,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.guides-long-horizon-feature-workflow` | Long-horizon feature work | Implementation, acceptance cases and delivery records are tracked in WO-01. |
 | `guide.guides-media-generation` | Media Generation | Omnius exposes media generation through TUI commands, tools, Telegram creative workflows, and sponsor media endpoints. |
 | `guide.guides-osint-research` | Categorized OSINT research | Omnius ships a local, searchable snapshot of the OSINT4ALL Start.me page. It uses the same compact discovery pattern as AIWG skills: |
+| `guide.guides-pdf-collections` | Large PDF collections | Ask Omnius to process the collection in ordinary language, specifying the result you need: search, ordering, original-page manipulation, summary, or extraction. For example: “Review every supplied PDF, extract each recorded duration with its source page, order the documents by the invoice date, and deliver the complete results.” A field's meaning, units, mis |
 | `guide.guides-realtime` | Realtime Conversations | Realtime mode is for short, natural, back-and-forth spoken conversation behind ASR and TTS. |
 | `guide.guides-sponsor-and-cohere` | Sponsor And COHERE Mesh | Sponsor and COHERE let Omnius share inference capacity across peers. Sponsor mode is explicit provider/consumer sharing. COHERE is a distributed cognitive inference mesh. |
 | `guide.guides-system-tray` | System Tray Indicator | Omnius ships a native per-login tray indicator for Linux, macOS, and Windows on x64 hosts. It is separate from the REST daemon: closing the indicator never stops the daemon, and the daemon remains usable in headless sessions. |
@@ -830,6 +832,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `tool.osint-search` | OSINT Search | Search the bundled OSINT4ALL snapshot locally and return a bounded ranked shortlist with category, archived-health, interaction, and risk metadata; no cataloged service is contacted. |
 | `tool.osint-show` | OSINT Show | Expand one exact local OSINT resource ID into its URL, aliases, original category placements, archived health, and safe next-tool route; no cataloged service is contacted. |
 | `tool.pdf-to-text` | Pdf To Text | pdf_to_text is a directly callable Omnius tool. |
+| `tool.pdf-transform` | Pdf Transform | pdf_transform is a directly callable Omnius tool. |
 | `tool.pdf-visual-markdown` | Pdf Visual Markdown | pdf_visual_markdown is a directly callable Omnius tool. |
 | `tool.phase-recall` | Phase Recall | phase_recall is a directly callable Omnius tool. |
 | `tool.play-sound` | Play Sound | play_sound is a directly callable Omnius tool. |

package/docs/corpus-ocr.md

@@ -0,0 +1,57 @@
+# Explicit scanned-PDF corpus OCR
+
+The public `source_corpus` tool can process an acquired PDF population with
+`begin` using `filters: {channel: "ocr_text"}` and optional `ocr_language`
+(default `eng`). Repeated `process` calls resume a durable per-source page
+cursor. Installed CPU Poppler and Tesseract are required. The default channel
+remains `native_text`; completing native extraction of an empty scanned page
+does not complete its OCR extraction.
+
+Each OCR page retains the original PDF identity, rendered PNG, full Tesseract
+text and TSV geometry in durable content-addressed files, with exact hashes,
+page lineage, engine version and language. Immutable segmented evidence powers
+bounded search and read operations. OCR receipts preserve the original issuing
+owner; subsequent reads bind their exact exposed range to the current owner.
+OCR TSV geometry is separate from native PDF geometry.
+
+`corpus_work` can explicitly select the complete `ocr_text` population for
+anchored extraction or summary. A read checkpoint is prepared when text is
+returned, then confirmed only after the production runner successfully sends
+the exact protected OCR text carrier to its configured backend. Failed
+transport cannot confirm that read or authorize a derived commit. Derived
+content remains `actor_attested`, requiring independent factual review.
+
+OCR completion means the engine processed every selected page. It does not
+prove transcription accuracy or visual comprehension: `visualCoverage`
+remains `not_assessed`, and OCR does not receive native evidence authority.
+Complete OCR-derived text exports can pass the separate export reviewer after
+it reopens every original PDF, rendered page, OCR text, TSV and immutable
+source/producer/exposure record. Fresh bounded factual review sees explicit
+`ocr_text` transcription provenance and the unassessed visual limitation.
+The complete source and output unions remain required before retention and
+provider delivery. Exact numeric source-line transcription can be verified
+against OCR engine output; this does not verify that output against the image.
+
+Native table-cell, count, sum and aggregate quantity gates remain strict: OCR
+text and TSV do not confer native field or arithmetic authority. OCR-derived
+arithmetic needs a separately reviewed transcription/operand population before
+approval; matching digits or a prose verdict cannot provide it. The inline
+Telegram source-answer review path still has no OCR-specific source-index
+adapter; the verified delivery route here is the full derived text export.
+Both OCR-only and mixed native/OCR factual inline candidates are refused after
+an actual successful OCR model handoff. The barrier is durable for the admitted
+session/run/epoch; ingestion, metadata and failed transport do not create it.
+The refusal preserves existing OCR evidence and gives the exact work/export/
+review steps instead of requesting another native-empty read.
+
+After fresh `corpus_export_review` completes under the current request, use
+`task_complete` with `deliver_artifacts: true` and the exact neutral notice
+`The reviewed OCR results are attached.` The host reopens the complete export,
+its original OCR source proof and current signed semantic receipt. Completion
+still requires actual provider acknowledgement for every selected output.
+That file review does not approve unrelated inline factual prose, and the
+neutral notice alone cannot waive missing review or delivery receipts.
+
+Population traversal and page work are resumable and have no total source or
+page count ceiling. A single-page rasterization still needs physical CPU/RAM
+resources; this implementation does not tile unusually large page images.

package/docs/guides/pdf-collections.md

@@ -0,0 +1,76 @@
+# Large PDF collections
+
+Ask Omnius to process the collection in ordinary language, specifying the result
+you need: search, ordering, original-page manipulation, summary, or extraction.
+For example: “Review every supplied PDF, extract each recorded duration with its
+source page, order the documents by the invoice date, and deliver the complete
+results.” A field's meaning, units, missing-value handling, and ordering direction
+remain part of the request; a date appearing somewhere in a PDF does not by
+itself establish that it is the requested invoice date.
+
+The collection is stored outside the model context. Original PDFs, complete
+native page text, page geometry, immutable source identities and hashes remain
+available in the private source archive. SQL applies scope, version and request
+filters before sorting and paging. Retrieval can reopen exact source ranges;
+condensing a model prompt never replaces the original evidence.
+
+Search uses cursor-paged lexical matches in the authorized collection. A search
+result, including a result with no matches, does not establish that every source
+was extracted or reviewed. Exhaustive requests retain the complete selected
+population and track source coverage separately from relevance ranking.
+
+There is no application limit on the total number of PDFs, pages, selected
+records, or output files. Per-call work widths keep memory and prompts finite;
+the model's actual context window, available storage, compute and each provider's
+per-file upload limit still apply. Processing the entire collection takes work
+proportional to that collection. Targeted search and exhaustive extraction use
+different coverage requirements.
+
+| Task | Runtime tools and retained result |
+| --- | --- |
+| Ingest and search | `source_corpus` retains originals, indexes native pages, and returns scoped inventories and exact ranges. Telegram's `manifest="current_task"` selects the host-admitted attachment population. |
+| Scanned pages | Explicit `source_corpus` OCR work retains page images, full engine text, word positions and engine receipts in the separate `ocr_text` channel. Interrupted page work resumes without replacing native text. |
+| Summary and extraction | `corpus_work` preserves the complete request and selection, issues bounded input claims, records ranges that actually reached a successful model request, and commits derived records with source anchors. |
+| Field ordering | `corpus_work` stores source-anchored typed fields and orders through SQL. Exact decimal and date handling, ties, missing values and multiple values have explicit policies. Model-selected field meaning remains subject to source review. |
+| Original-page manipulation | `pdf_corpus_recipe` and `pdf_corpus_transform` plan and execute original-page ordering, merge and split operations without reconstructing PDFs from summaries. |
+| Factual acceptance | `source_answer_review` and `corpus_export_review` independently review complete selected output and source coverage. Numeric aggregates reopen every selected native input and verify exact operands and arithmetic. |
+| Large result delivery | `corpus_export_review` partition actions retain upload-sized data and reconstruction files. `partition_finalize` inherits a complete current parent review and verifies every child; actual provider receipts still establish delivery. |
+
+Processing and delivery checkpoints survive restart. Committed work and accepted
+uploads are reused under the current task; stale owner or request authority must
+be renewed. A Telegram upload quota wait retains the exact reviewed candidate
+and resumes at the provider retry time. Completion requires receipts for every
+selected output, including all reconstruction files. An extracted index, a model
+claim of completion, or an intermediate progress message does not establish that
+the final answer was delivered.
+
+Directory acquisition preserves enumeration, original-file acquisition and
+manifest-writing checkpoints. Restart verifies the previously observed directory
+and file identities before continuing; a changing directory cannot silently
+become a different collection. This is an observed, verified manifest, not an
+atomic filesystem snapshot. Export writing and fixity checks also resume within
+an individual JSONL record, so output size does not impose a total export cap.
+
+Verified durable work can continue beyond the default emergency turn budget.
+An explicit finite budget still applies. Repeating a call without advancing its
+current source-bound checkpoint earns no continuation credit; progress does not
+approve facts or fulfill the final-output and delivery requirements.
+
+After restart, the host reopens the current pending SQL job before applying its
+retry guard. An authentic job can receive one admission attempt at its existing
+producer clock, including an initialized job that has not advanced yet. Reopening
+the job creates no progress event. The consumed attempt survives restart and
+cannot be renewed by switching job IDs; actual verified work must advance the
+clock before another attempt becomes available.
+
+Native text and geometry can be incomplete or ambiguous. Unresolved extraction,
+field association or arithmetic stays explicit; visual review can resolve the
+relevant page on the configured capable backend. The research basis and
+stage-by-stage evaluation criteria are in the
+[PDF distillation synthesis](../../.aiwg/research/pdf-knowledge-distillation/synthesis.md).
+
+Numeric review distinguishes populated cells from recorded events. A nonempty
+cell can contain zero or an incomplete time placeholder; it does not necessarily
+record an event. Bounded examples expose exact distinct native spellings without
+frequencies or expected answers. The reviewer selects the meaning from the full
+request, and the host verifies arithmetic against the complete original field.

package/docs/guides/telegram.md

@@ -145,6 +145,12 @@ a lease, bounded backoff, and the returned Telegram message ID.
 | Audio | `audio_edit` | inspect, trim, concatenate, typed splice and silence, mix, normalize, fade, convert, resample | `audio_analyze` for sound/music or `transcribe_file` for speech |
 | PDF or DOCX | `document` | create from heading/paragraph/bullet/page-break blocks, inspect, hash-guarded revise | `document action='inspect'` on the exact output |
 
+Photo intake and `telegram_image_analyze` use the configured endpoint and model
+with the original image. The backend must declare image support. If that
+capability is unavailable, Omnius retains the image and reports it as unassessed.
+These paths do not automatically select another vision model. An uncaptioned
+photo retains its native media identity without inventing a caption or request.
+
 These tools do not accept shell commands, raw FFmpeg filters, ImageMagick
 expressions, raw PDF/OOXML bytes, HTML, macros, or paths outside the chat
 workspace. Image and audio edits never overwrite an artifact. Document

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.806",
+  "version": "1.0.808",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.806",
+      "version": "1.0.808",
       "bundleDependencies": [
         "image-to-ascii"
       ],