omnius 1.0.853 → 1.0.855

package/docs/DISCOVERY.json

@@ -33442,6 +33442,43 @@
         }
       ]
     },
+    {
+      "id": "guide.work-orders-evidence-telegram-retained-source-handoff-live-20261013",
+      "kind": "guide",
+      "title": "Telegram Retained Source Handoff Live 20261013",
+      "summary": "Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-retained-source-handoff-live-20261013.json.",
+      "keywords": [
+        "work",
+        "orders",
+        "evidence",
+        "telegram",
+        "retained",
+        "source",
+        "handoff",
+        "live",
+        "20261013",
+        "json"
+      ],
+      "maturity": "internal",
+      "audiences": [
+        "maintainer",
+        "large-context-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/work-orders/evidence/telegram-retained-source-handoff-live-20261013.json"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/work-orders/evidence/telegram-retained-source-handoff-live-20261013.json",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
     {
       "id": "guide.work-orders-evidence-terminal-review-contract-probe-20261012",
       "kind": "guide",
@@ -38264,7 +38301,7 @@
       "id": "guide.work-orders-wo-completion-review-recovery-20261013-uppercase",
       "kind": "guide",
       "title": "Completion review recovery and Telegram liveness",
-      "summary": "Status: active. Follow-up to the operator's live completion-block and typing indicator report on installed Omnius 1.0.852, PID 2845019, telegramtest.",
+      "summary": "Status: implementation and verification complete; source pushed to origin/main. Operator publication and bot restart remain pending. Follow-up to the live completion-block and typing indicator report on installed Omnius 1.0.852, PID 2845019, telegramtest, and subsequent 1.0.853 restart PID 3697027.",
       "keywords": [
         "work",
         "orders",
@@ -38792,6 +38829,42 @@
         }
       ]
     },
+    {
+      "id": "guide.work-orders-wo-telegram-retained-source-handoff-20261013-uppercase",
+      "kind": "guide",
+      "title": "Recover accepted Telegram drafts without restarting completed work",
+      "summary": "Status: implementation and installed-package live verification complete. Follow-up to the Case Theory stall on installed Omnius 1.0.854, PID 161677, running from telegramtest. Publication and bot restart remain operator-owned.",
+      "keywords": [
+        "work",
+        "orders",
+        "WO",
+        "telegram",
+        "retained",
+        "source",
+        "handoff",
+        "20261013",
+        "md"
+      ],
+      "maturity": "internal",
+      "audiences": [
+        "maintainer",
+        "large-context-agent"
+      ],
+      "layer": "documentation",
+      "interfaces": [
+        {
+          "type": "file",
+          "target": "docs/work-orders/WO-telegram-retained-source-handoff-20261013.md"
+        }
+      ],
+      "references": [
+        {
+          "type": "documentation",
+          "target": "docs/work-orders/WO-telegram-retained-source-handoff-20261013.md",
+          "relation": "canonical-artifact"
+        }
+      ]
+    },
     {
       "id": "guide.work-orders-wo-telegram-unavailable-review-presentation-20261012-uppercase",
       "kind": "guide",

package/docs/DISCOVERY.md

@@ -546,6 +546,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-telegram-all-free-live-20261013` | Telegram All Free Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-all-free-live-20261013.json. |
 | `guide.work-orders-evidence-telegram-completion-review-live-20261013` | Telegram Completion Review Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-completion-review-live-20261013.json. |
 | `guide.work-orders-evidence-telegram-native-planning-live-20261013` | Telegram Native Planning Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-native-planning-live-20261013.json. |
+| `guide.work-orders-evidence-telegram-retained-source-handoff-live-20261013` | Telegram Retained Source Handoff Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-retained-source-handoff-live-20261013.json. |
 | `guide.work-orders-evidence-terminal-review-contract-probe-20261012` | Terminal Review Contract Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-contract-probe-20261012.json. |
 | `guide.work-orders-evidence-terminal-review-error-probe-20261012` | Terminal Review Error Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-error-probe-20261012.json. |
 | `guide.work-orders-evidence-terminal-review-schema-repair-probe-20261012` | Terminal Review Schema Repair Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-schema-repair-probe-20261012.json. |
@@ -673,7 +674,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-wo-active-inference-route-and-telegram-review-20261012-uppercase` | Active inference route and Telegram completion review | Status: implementation complete and verified. Publication remains with the user. |
 | `guide.work-orders-wo-am-gaps-uppercase` | Associative Memory Gap Work Orders | Generated: 2026-04-13 Source: Deep audit of multimodal associative memory systems Status: READY FOR IMPLEMENTATION |
 | `guide.work-orders-wo-built-in-free-model-startup-20261012-uppercase` | Built-in free inference and clean Telegram settlement | Status: implemented, tested and committed. Live service limits are recorded below rather than claimed as model availability. Publication and bot restart remain operator-owned. |
-| `guide.work-orders-wo-completion-review-recovery-20261013-uppercase` | Completion review recovery and Telegram liveness | Status: active. Follow-up to the operator's live completion-block and typing indicator report on installed Omnius 1.0.852, PID 2845019, telegramtest. |
+| `guide.work-orders-wo-completion-review-recovery-20261013-uppercase` | Completion review recovery and Telegram liveness | Status: implementation and verification complete; source pushed to origin/main. Operator publication and bot restart remain pending. Follow-up to the live completion-block and typing indicator report on installed Omnius 1.0.852, PID 2845019, telegramtest, and subsequent 1.0.853 restart PID 3697027. |
 | `guide.work-orders-wo-fallback-quality-order-20261012-uppercase` | Benchmark-informed fallback cascade | Status: implemented and verified. Publication and active runtime replacement remain with the user. Telegram progress presentation stays deferred. |
 | `guide.work-orders-wo-fallback-reply-contracts-20261012-uppercase` | Fallback reply contracts and live Telegram regressions | Status: implemented and verified in source and the freshly installed package. Publishing and restarting the active bot remain user-owned. The subsequent OpenCode-first capability ordering is tracked in its work order; Telegram progress presentation remains explicitly deferred. |
 | `guide.work-orders-wo-inference-fallback-20261012-uppercase` | Local inference outage fallback | Status: source implementation complete and verified. Installed-runtime activation is separate; the running daemon has not been upgraded or restarted. |
@@ -688,6 +689,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-wo-telegram-plain-answer-and-provider-catalog-20261012-uppercase` | Preserve native Telegram answers and use compatible free inference routes | Status: implemented and verified. The user owns publication and runtime replacement. |
 | `guide.work-orders-wo-telegram-progress-presentation-20261012-uppercase` | Telegram progress presentation | Status: implemented and verified, resumed by the user with instructions to complete, commit and push. The evidenced OpenCode compatibility failure is handled in the current repair order. |
 | `guide.work-orders-wo-telegram-reply-lifecycle-20261013-uppercase` | Telegram reply lifecycle | Status: implemented and verified. The built-in-model/startup and multi-model live acceptance work continues under WO-built-in-free-model-startup-20261012.md. |
+| `guide.work-orders-wo-telegram-retained-source-handoff-20261013-uppercase` | Recover accepted Telegram drafts without restarting completed work | Status: implementation and installed-package live verification complete. Follow-up to the Case Theory stall on installed Omnius 1.0.854, PID 161677, running from telegramtest. Publication and bot restart remain operator-owned. |
 | `guide.work-orders-wo-telegram-unavailable-review-presentation-20261012-uppercase` | Telegram reply presentation when an auxiliary review is unavailable | Status: implemented and verified. Publication and runtime replacement remain with the user. |
 | `guide.work-orders-world-class-memory-compiler-readme-uppercase` | World-Class Memory Compiler Program | Status: active implementation program Owner: Omnius orchestration and memory packages Last updated: 2026-07-13 |
 | `guide.work-orders-world-class-memory-compiler-tracker-uppercase` | Memory Compiler Implementation Tracker | Last reconciled: 2026-07-13 Authority: This file is the granular program tracker. The work-order documents define the contract and acceptance criteria; neither test output nor a model claim may check an item without the named evidence. |

package/docs/work-orders/WO-completion-review-recovery-20261013.md

@@ -1,7 +1,9 @@
 # Completion review recovery and Telegram liveness
 
-Status: active. Follow-up to the operator's live completion-block and typing
-indicator report on installed Omnius 1.0.852, PID 2845019, `telegram_test`.
+Status: implementation and verification complete; source pushed to `origin/main`.
+Operator publication and bot restart remain pending. Follow-up to the live
+completion-block and typing indicator report on installed Omnius 1.0.852,
+PID 2845019, `telegram_test`, and subsequent 1.0.853 restart PID 3697027.
 
 ## Live anchors
 
@@ -15,7 +17,8 @@ indicator report on installed Omnius 1.0.852, PID 2845019, `telegram_test`.
   the aggregate deadline. The error tells the actor to revise the document.
 - `claim-review`: Muse repairs `uniqueItems`, then gets an unclassified HTTP400;
   Ling times out. A later retry eventually succeeds on Step, after which the
-  terminal/native pipeline runs again. Exact unknown400 diagnosis is pending.
+  terminal/native pipeline runs again. Live reproduction identified the next
+  exact400 as `'oneOf' is not permitted`; the guarded adapter repair passed.
 - A failed semantic review is cached by exact bytes/context and consumes the
   three-revision budget even when the verifier was unavailable. Retrying the
   same valid bytes therefore produces an instruction to modify the artifact.
@@ -49,6 +52,18 @@ indicator report on installed Omnius 1.0.852, PID 2845019, `telegram_test`.
 7. Run focused regressions and real installed-package review acceptance, then
    make scoped commits and push. Preserve unrelated dirty changes. Publication
    and runtime restart remain operator-owned.
+8. Follow-up from the operator's 1.0.853 session: a cold first router skips the
+   entire preferred tier before selecting Hermes; the next two select Muse.
+   Share the existing validated bundled free-model snapshot with fallback,
+   retain authoritative last-good metadata, and archive bounded discovery and
+   exclusion reasons. Empty/removal/paid metadata remains authoritative.
+9. Repair the newly identified typing starvation: a blocked durable message
+   at the head of a chat queue prevents eligible typing behind it. Preserve
+   durable FIFO, global/typing/flood limits and exact work ownership; add
+   admitted-human queue liveness and distinguish expected expiry from API failure.
+10. Apply the bounded default review allowance to the observed public-chat
+    review and retry phases. Test the production generation plus independent
+    review with real remote replies and catalog-failure injection.
 
 Do not remove completion evidence gates, fabricate successful reviews, promote
 summary into a reply, weaken required delivery or rewrite missing source facts
@@ -80,6 +95,49 @@ The original missing source requirement remains a genuine unresolved fact.
 - `1a14d955` / `ba291791`: typing transport regression and implementation.
   26 typing/governor checks and CLI TypeScript passed. One old route-shape
   fixture fails identically on isolated `3d8dff50` source, before this repair.
+- `c36af315`: typed review-only resume, consistent artifact scope and exact
+  committed incomplete-reply delivery. Full isolated workspace build, tarball
+  audit (569 files, zero warnings), compiler-free fresh npm install, and three
+  real installed Muse review scenarios passed. The candidate uses tracked
+  manifest version1.0.790 and is identified by its bundle hash; it is not an
+  npm publication or a claim that the operator's installed runtime was replaced.
+- `2e722a9d`: shared validated snapshot, authoritative last-good catalog and
+  availability recovery, fixed cache deadlines, and private bounded discovery
+  diagnostics. Default streamed public-chat review/retry gets the same bounded
+  allowance as other structured review. 291 focused orchestrator checks passed;
+  generation-receipt fixtures were updated in `ffe4e21d` (67 checks passed).
+- `3cd52ce2`: typing may pass a durable message blocked solely by message quotas;
+  durable order, global concurrency, typing quotas, flood waits and Stop remain
+  enforced. Exact addressed human intake retains queue liveness. Expected typed
+  expiry stays quiet while transport/authentication failures still warn.
+
+Final isolated build and fresh installed candidate passed 98 focused CLI checks
+across eight files, including 22 governor checks and the real loopback HTTP test.
+The test server sends 200 headers then stalls the body; action expiry frees the
+slot for durable delivery and the next heartbeat reaches the server. The 182s
+queue test observes 61 refreshes without minting a runner or reply authority.
+
+The final installed live harness deliberately fails the runtime catalog read
+after genuine live free/available eligibility preflight. Muse alone handled
+attention (~4.2s), generation and independent public-chat review (~7.9s); five
+real requests returned 400/200/200/400/200 with automatic schema repair. The
+discovery receipt records the bundled nine-model catalog after a timeout. No
+Hermes route was selected, and no inference or metadata response was invented.
+An additional real semantic-artifact review passed and its exact-byte receipt
+verified on the final installed candidate. Final bundle SHA256:
+`3acd8389d627c8a79416a5bc0b79373647d041b8051e15150d456e599df8539b`.
+
+Both final tarball audit (569 files, zero warnings) and compiler-free fresh npm
+install passed. The synthetic live harness forbids Telegram API sends and does
+not establish actual Telegram delivery/ACK or visible typing in the operator's
+chat; those runtime checks require the operator's updated publication/restart.
+
+The earlier broader check passed 483 orchestrator tests (one skipped) and 151 CLI
+tests. The 25 older terminal-fixture failures reproduce on untouched `ba291791`
+with rebuilt dependencies: model-request cloning fails on host callbacks, and
+synthetic private work lacks authenticated intake custody. Nine new exact
+receipt handoff regressions pass on the isolated candidate. The old fixtures
+remain a recorded test limitation; assertions and custody gates were not weakened.
 
 The compiled inline-source scenario also passed real Muse review with zero
 artifact claims despite an optional local draft. No inference reply or catalog

package/docs/work-orders/WO-telegram-retained-source-handoff-20261013.md

@@ -0,0 +1,111 @@
+# Recover accepted Telegram drafts without restarting completed work
+
+Status: implementation and installed-package live verification complete.
+Follow-up to the Case Theory stall on installed Omnius 1.0.854, PID 161677,
+running from `telegram_test`. Publication and bot restart remain operator-owned.
+
+## Incident anchors
+
+The original input is `telegram:chat:-1003960149435:0:1083`; task
+`tgtask-2d2fee541b8304db4568`, bridge run `telegram:2a5a22214cf84400`,
+actor run `telegram-84e4e6e5411c9753-1791918893130-1`.
+The input explicitly addresses the bot while replying to an independently
+adopted message 1081 by another participant. Private source and draft text are
+not copied here or sent to the synthetic live test.
+
+- 19:15:01Z: Telegram progress delivery succeeds.
+- 19:15:39Z: `task_complete` accepts a full answer for deferred Telegram
+  delivery. The actor did draft an answer; this was not a generation failure.
+- Finalization `terminal-3e4feb48f9f23fd29a87` records
+  `incomplete_verification`: required observation and visible response have no
+  canonical receipts. The source-answer review's support verdict is separate
+  from actual observation or provider delivery evidence.
+- The old runner exits immediately on the accepted completion despite missing
+  work, filters the full answer from its return, and gives terminal review an
+  empty candidate. Review requests another action run.
+- Continuation reopens the unchanged source and falsely rejects it as
+  `original_native_source_changed`: it compares every adopted source's author
+  to the current task owner. Initial admission had correctly preserved the
+  independently adopted participant's author. Both native envelopes and text
+  hashes still match their immutable spool/requirement bases.
+- At 19:22:02Z the exhausted planning transition becomes
+  `reconciliation_required`. `missing_action_tool_names` is the generic
+  diagnostic after the host removes a rejected plan, not evidence that the
+  model independently omitted tools. Public chat gets no paused status.
+- A later human follow-up 1086 obtains assistant reply 1089 at 19:30:36Z. The
+  original request required another prompt to recover; it was not deliberately
+  ignored by the attention router.
+
+The installed incident bundle SHA256 is
+`1c385603d694ff5ca04edf20af158b1f75895e96b900e603a9063112fe2a257c`.
+
+## Ordered repairs
+
+1. Validate retained adopted sources against each source's admitted actor,
+   envelope, text basis, topic and immutable custody. The original task owner
+   still owns the task. Legacy actorless locators retain the owner-only rule.
+2. Before leaving an accepted completion, check required non-provider work
+   effects. Keep the same runner, tools, workspace and exact answer while
+   gathering only the missing evidence. Use the existing bounded completion
+   budget. Do not hold for visibility or provider delivery alone.
+3. On bounded exhaustion, retain the exact accepted draft as typed
+   `pending_work_evidence` metadata. It cannot become a deliverable, successful
+   observation, provider ACK or completed objective. Reopen the exact committed
+   terminal marker and native source custody before exposing it to review.
+4. For an already admitted public human task whose planning recovery stops,
+   send one brief paused status with the original issued reply grant/topic.
+   Preserve Stop, later-human preemption, native ownership, durable attempt
+   deduplication and physical ACK checks. Keep status separate from task result
+   and effect receipts; never broadcast ambient or peer-bot failures.
+5. Verify isolated source, full package rebuild, tarball and fresh install.
+   Run the installed production runner with real remote free-model responses
+   and a real source read on synthetic data. Make a scoped commit and push.
+
+## Source locations
+
+- `packages/orchestrator/src/agenticRunner.ts`: completion reply ownership,
+  required-work hold, bounded retention and result handoff.
+- `packages/cli/src/tui/telegram-bridge.ts`: retained native source validation,
+  terminal review draft context and public paused-task ownership/dispatch.
+- `packages/cli/src/tui/telegram-planning-failure-notice.ts`: fixed public status
+  and existing durable exclusive attempt store.
+- `scripts/live-telegram-retained-work-harness.mjs`: synthetic installed-runtime
+  live acceptance. It pins the eligible Muse endpoint, bounds requests, forbids
+  local inference and Telegram sends, and invents no model/catalog replies.
+
+## Verification
+
+All 66 new regressions passed: 13 runner repair, 11 adopted-source custody,
+9 retained-draft Bridge custody, and 33 public paused-status cases. The isolated
+orchestrator batch passed 62/62. The broader isolated CLI batch passed 199/201;
+its two old source/owner guard final-state assertions fail identically on
+untouched, fully compiled `ba291791`. An additional existing terminal-review
+fixture fails on that same baseline (17 other cases pass). These are recorded
+test limitations, not an assertion that the entire suite is green; no custody
+guard or test assertion was relaxed to obtain success.
+
+The full isolated workspace rebuild, 571-file tarball audit (zero warnings),
+and compiler-free fresh npm installation passed. The installed candidate uses
+the tracked test manifest version 1.0.790; it is identified by bundle SHA256
+`c78a20f7d05ef313e2226211235fb57402a52249aa366b7274a8a1cc28479a5f`,
+not an npm publication or replacement of the operator's runtime.
+
+The real installed Muse run passed in 16.7 seconds, with three HTTP 200 streamed
+Responses requests and the sequence `task_complete → file_read → task_complete`.
+Exactly one bounded required-work hold preceded one actual production
+`FileReadTool` read. Both completion submissions have the same exact answer
+hash. Observation becomes satisfied; only visible response remains pending.
+The runner returns `provider_delivery_pending`, no retained-only draft, no
+accepted/completed result, and zero provider ACKs. Model/catalog replies were
+not mocked; all source content was synthetic and no Telegram message was sent.
+
+This live test covers the installed runner and real source tool with a
+host-owned scratch acceptance adapter. It does not exercise real Telegram
+ingress/reply grants, the Bridge source-answer critic, or Telegram API delivery.
+Actual paused dispatch/source custody are covered by the focused synthetic
+transport tests. Actual Telegram delivery and typing visibility require the
+operator's updated publication/restart; no live conversation state is modified
+by this repair or test. [Safe receipts](evidence/telegram-retained-source-handoff-live-20261013.json)
+retain hashes and synthetic diagnostics without private source/draft text.
+
+Architecture: [separate review, delivery and task states](../../.aiwg/architecture/adr-completion-review-delivery-states-20261013.md).