omnius 1.0.854 → 1.0.856

package/docs/work-orders/WO-fallback-contract-cooldown-20261013.md

@@ -0,0 +1,83 @@
+# Keep internal inference failures within their contract and budget
+
+Status: contract cooldown, aggregate deadline and phase output allocations
+verified; final installed full-source public-path acceptance passed.
+
+The installed full-source Telegram harness, with a configured 32k context,
+reached a real `virtual-memory:plan` request before its first work turn. Muse
+returned HTTP 200, but its 1,000-token structured reply failed validation
+(`transport_envelope`, `json_object`). A model-wide cooldown then suppressed
+the different primary native-tool request without sending it. Intake failed
+before any page was fetched. This is a production-path failure, not a mocked
+provider response or a source-extraction failure.
+
+Observed bundle SHA256:
+`e1e3a9dfedc1a811497de0949c3d76ce3886f9cce6fd6227c903c9cf9758a716`.
+Receipt: `/tmp/omnius-web-source-installed-public-live-20261013.json`.
+
+1. Scope empty/invalid/expected-response validation cooldowns to the actual
+   requested response contract and output allowance. A failed auxiliary JSON
+   reply cannot suppress ordinary tool calling or a different response schema.
+2. Preserve global availability, authentication and provider rate-limit
+   cooldowns, including retry-after behavior. Do not change provider identity
+   or bypass quota enforcement.
+3. Verify failures remain cooled for equivalent contracts, while distinct
+   work/review contracts and corrected output allowances can proceed.
+4. Rebuild the installed candidate and repeat the real public full-source
+   task. Keep the failed receipt, and record actual auxiliary terminal metadata
+   without model text or credentials. Do not disable the failing phase merely
+   to make the fixture pass.
+5. Repair the confirmed underlying tiny-output defaults. Actual provider
+   terminal receipts report `incomplete/max_output_tokens` with no visible
+   output for both the 1,000-token VM planner and a 900-token artifact-search
+   helper. Allocate adequate internal structured output, bounded by complete
+   input, schemas, communication policy, context margin and explicit user caps.
+   Preserve every input character; never fund output by clipping the request.
+6. Fence the aggregate deadline after asynchronous preparation and route
+   callbacks. An attempt timer clipped to the whole cascade's remaining time
+   must end that cascade, including millisecond clock/timer skew; shorter
+   per-attempt timeouts must still permit fallback.
+7. Restore adequate primary-turn output before context admission. Reserve
+   4,096 tokens, honoring an explicit lower user cap. Try the existing canonical
+   owned-duplicate release before rejecting capacity; never clip protected
+   source, request or authority. Remote eligibility must enforce the same
+   host-owned reserve without sending that internal marker to providers or
+   poisoning model-wide cooldowns when a route lacks capacity.
+8. Keep completed extraction findings separate from its verbose checkpoint.
+   Reopen all findings without rerunning completed workers. If the complete
+   result still does not fit, return an explicit pending/capacity receipt.
+
+An intermediate installed diagnostic run processed all 109,910 RFC source
+characters in five valid workers, then exhausted its explicit 20-generation
+test budget while small auxiliary requests fell through providers. This proves
+whole-source processing, not accepted final delivery. A previous invalid worker
+reply was not captured, so its exact rejecting field cannot honestly be inferred
+from the later valid replies. It remains distinct from confirmed output
+exhaustion and global cooldown poisoning.
+
+The cooldown/deadline repair passes the original 94 remote-fallback tests,
+11 contract tests and eight deterministic aggregate-deadline tests. Installed
+live receipts show healthy main requests reaching Muse after auxiliary failures.
+A broader legacy keyless-routing suite has 20 failures expecting older provider
+priority; the same 20 failures reproduce with the prior committed fallback
+source (`06443c0a`). Those fixtures are not counted as passing or changed here.
+
+Subsequent live wire diagnostics distinguished a separate primary-turn limit:
+662/882-token native tool requests failed after all source workers had already
+completed. That was not the earlier 900-token artifact-query helper. Both
+allocations are repaired without shortening their inputs. Final selected
+runner/extraction/fallback/budget suites pass 264 tests with one existing
+opt-in test skipped, including explicit user ceilings, provider route reserves,
+unchanged inputs and completed-findings reopening.
+
+The [final installed public acceptance](evidence/web-source-installed-public-live-20261013.json)
+uses nine real model requests, all 109,910 RFC source characters and three
+validated extraction workers. It produces a sourced final reply and settles
+the native host goal after a scratch Telegram ACK. A separate
+[32k run](evidence/web-source-installed-capacity-guard-20261013.json) proves that
+insufficient capacity causes a typed before-transport pause with no tiny-output
+request or automatic replay. It does not pass final-answer acceptance. No live
+Telegram network delivery, local inference or fabricated provider response is
+claimed by these receipts.
+
+This repair supports the [complete-source work order](WO-web-source-full-coverage-extraction-20261013.md).

package/docs/work-orders/WO-telegram-public-research-stream-progress-20261013.md

@@ -0,0 +1,100 @@
+# Public research stream recovery and meaningful progress
+
+Status: repaired and verified in the isolated installed runtime. Publication
+and the operator's bot restart are separate.
+
+## Live incident
+
+Installed Omnius 1.0.855, main PID 1141122, started at 20:10:15Z from
+`telegram_test`. OMNIUS group `chat:-1003888256865`, input 5826 asks for this
+week's biggest AI research; task `tgtask-b3b2802ea8259be5a181`, bridge run
+`telegram:8928c8a1534bdb23`, actor
+`telegram-c34a3d7d53728329-1791922362455-1`.
+
+- Attention succeeds on Muse at 20:12:41Z after guarded schema adaptation.
+- Three searches succeed. Four page fetches run: three succeed, one gets 429.
+  The final successful fetch ends at 20:13:03Z.
+- The next actor request has approximately 34,904 input tokens. Its context
+  falsely says `web_fetch:no-target` has failed 46 rounds, despite this being
+  a fresh native goal with one failed fetch.
+- At 20:15:03Z finalization commits `inference_stream_interrupted`, turn 3,
+  `retryable:false`, before any accepted final answer. This is approximately
+  120 seconds after the last request started. The old actor trace was not saved,
+  and the interruption error discarded its cause/frame categories, so the
+  precise provider failure or timer cannot be reconstructed from this receipt.
+- Message 5828 is solely the canned incomplete sentence. An absent native goal
+  assessment caused the host to append it to an empty failed result, then mark
+  intake failed after delivery. A separate empty-result branch would instead
+  wrongly consume it as a social no-reply if the appendix alone were removed.
+- The first edited progress message stores three differently worded “pulling
+  the research” paragraphs. Exact-text deduplication permits near duplicates;
+  no stage grouping replaces the stale explanation when inference waits/fails.
+
+Incident bundle SHA256:
+`1c51f6f647513d3b3f43c2ed42d9aa3ea3bb56eeb0a27aab4daf63cdd85e5625`.
+Finalization SHA256:
+`362776f300db24c47c81b32708ac11ea90151aedb1e7996c37029904e6d4e9dd`.
+Scoped log copies and hashes were preserved outside the live state. No
+historical transcript or private source content is sent by the live harness.
+
+## Repairs and constraints
+
+1. Scope persisted convergence to stable native task identity and epoch;
+   retain genuine continuations, isolate new original inputs. Hash the whole
+   normalized URL as the operation target, preserving query distinctions and
+   omitting fragments. Successful work resolves only its exact target/family.
+2. Buffer each Telegram primary generation until its complete turn validates.
+   Failed uncommitted text/tool frames may fall back without replaying prior
+   successful research tools. Use the existing configured per-attempt limit
+   within the total/caller limit, preserving time for the next route. Immediate
+   TUI streams retain their no-replay fence after actual output. Stop and manual
+   approval remain authoritative; marked auxiliary review allowances remain.
+3. Hidden reasoning/accounting alone never constitutes an irreversible answer
+   or tool effect. Discard failed hidden-only attempts before switching models.
+   Bound buffered frames/bytes, and recheck ownership before release.
+4. Save actor inference routes as well as auxiliary routes. Record only static
+   failure category, status, deadline kind, frame categories and commit policy;
+   never provider bodies, generated text, endpoints or credentials.
+5. Group public progress by actual host tool stage. Replace same-step model
+   explainers, retain factual completed stages and show waiting/paused/stopped
+   state. Counts describe successful operations, not unique sources or goal
+   fulfillment. Keep tool chronology behind Activity and explicit progress
+   available; do not add progress-only model requests or change admin behavior.
+6. Empty failed native work produces no fabricated final answer, no final
+   delivery receipt and no consumed intake. Retain the original goal/evidence
+   and make the existing progress message paused. Legitimate current accepted
+   partial answers retain their separate receipt-backed delivery path.
+7. Hand the bridge an issued, immutable source receipt directly from the
+   actual runner result, bound to the current scope/run/epoch/tool action.
+   Display projection cannot remove verified source custody. Forged, copied,
+   stale, failed or blocked event carriers confer no source evidence; legacy
+   marker parsing remains only for events without the new field.
+
+The follow-up [complete-source work order](WO-web-source-full-coverage-extraction-20261013.md)
+tracks the operator's additional requirement to remove page prefixes and
+account for every source chunk when dedicated extraction is necessary.
+
+## Verification
+
+The isolated workspace build, tarball audit (573 files, no warnings) and fresh
+compiler-free npm install pass. Isolated suites pass 137 orchestrator checks,
+133 CLI checks and 40 typed receipt/public-native checks (overlapping suites,
+not a unique total). Four broader native-transport fixture failures reproduce
+unchanged on baseline `ba291791`; they are not represented as passing.
+
+The [installed live receipt](evidence/telegram-public-research-stream-live-20261013.json)
+records nine real free-model POSTs, two actual scoped RFC page reads and real
+native goal assessment. After both reads, the harness cuts a real Step text
+delta (227 bytes forwarded). MiMo completes the same logical generation,
+without another source read. Both issued receipts reach the bridge, both source
+URLs reach the final wire text, and intake settles consumed/goal fulfilled.
+Bundle SHA256: `666eaaf77fce81bd82f2a214c0f787447af75decaafc6bd2bda65527822a7266`.
+
+Only Telegram transport/ACK is simulated in disposable state. No inference or
+catalog response is fabricated, no local inference runs, and no actual Telegram
+message is sent. Earlier fault-fixture runs completed useful research but did
+not actually inject a disconnect; they are excluded from interruption proof.
+The first fresh-install attempt hit a SQLite prebuild download timeout; the
+unchanged tarball passed on retry. Actual Telegram delivery/typing needs
+operator deployment. The separate full-source extraction work remains tracked
+in its follow-up order.

package/docs/work-orders/WO-telegram-retained-source-handoff-20261013.md

@@ -0,0 +1,111 @@
+# Recover accepted Telegram drafts without restarting completed work
+
+Status: implementation and installed-package live verification complete.
+Follow-up to the Case Theory stall on installed Omnius 1.0.854, PID 161677,
+running from `telegram_test`. Publication and bot restart remain operator-owned.
+
+## Incident anchors
+
+The original input is `telegram:chat:-1003960149435:0:1083`; task
+`tgtask-2d2fee541b8304db4568`, bridge run `telegram:2a5a22214cf84400`,
+actor run `telegram-84e4e6e5411c9753-1791918893130-1`.
+The input explicitly addresses the bot while replying to an independently
+adopted message 1081 by another participant. Private source and draft text are
+not copied here or sent to the synthetic live test.
+
+- 19:15:01Z: Telegram progress delivery succeeds.
+- 19:15:39Z: `task_complete` accepts a full answer for deferred Telegram
+  delivery. The actor did draft an answer; this was not a generation failure.
+- Finalization `terminal-3e4feb48f9f23fd29a87` records
+  `incomplete_verification`: required observation and visible response have no
+  canonical receipts. The source-answer review's support verdict is separate
+  from actual observation or provider delivery evidence.
+- The old runner exits immediately on the accepted completion despite missing
+  work, filters the full answer from its return, and gives terminal review an
+  empty candidate. Review requests another action run.
+- Continuation reopens the unchanged source and falsely rejects it as
+  `original_native_source_changed`: it compares every adopted source's author
+  to the current task owner. Initial admission had correctly preserved the
+  independently adopted participant's author. Both native envelopes and text
+  hashes still match their immutable spool/requirement bases.
+- At 19:22:02Z the exhausted planning transition becomes
+  `reconciliation_required`. `missing_action_tool_names` is the generic
+  diagnostic after the host removes a rejected plan, not evidence that the
+  model independently omitted tools. Public chat gets no paused status.
+- A later human follow-up 1086 obtains assistant reply 1089 at 19:30:36Z. The
+  original request required another prompt to recover; it was not deliberately
+  ignored by the attention router.
+
+The installed incident bundle SHA256 is
+`1c385603d694ff5ca04edf20af158b1f75895e96b900e603a9063112fe2a257c`.
+
+## Ordered repairs
+
+1. Validate retained adopted sources against each source's admitted actor,
+   envelope, text basis, topic and immutable custody. The original task owner
+   still owns the task. Legacy actorless locators retain the owner-only rule.
+2. Before leaving an accepted completion, check required non-provider work
+   effects. Keep the same runner, tools, workspace and exact answer while
+   gathering only the missing evidence. Use the existing bounded completion
+   budget. Do not hold for visibility or provider delivery alone.
+3. On bounded exhaustion, retain the exact accepted draft as typed
+   `pending_work_evidence` metadata. It cannot become a deliverable, successful
+   observation, provider ACK or completed objective. Reopen the exact committed
+   terminal marker and native source custody before exposing it to review.
+4. For an already admitted public human task whose planning recovery stops,
+   send one brief paused status with the original issued reply grant/topic.
+   Preserve Stop, later-human preemption, native ownership, durable attempt
+   deduplication and physical ACK checks. Keep status separate from task result
+   and effect receipts; never broadcast ambient or peer-bot failures.
+5. Verify isolated source, full package rebuild, tarball and fresh install.
+   Run the installed production runner with real remote free-model responses
+   and a real source read on synthetic data. Make a scoped commit and push.
+
+## Source locations
+
+- `packages/orchestrator/src/agenticRunner.ts`: completion reply ownership,
+  required-work hold, bounded retention and result handoff.
+- `packages/cli/src/tui/telegram-bridge.ts`: retained native source validation,
+  terminal review draft context and public paused-task ownership/dispatch.
+- `packages/cli/src/tui/telegram-planning-failure-notice.ts`: fixed public status
+  and existing durable exclusive attempt store.
+- `scripts/live-telegram-retained-work-harness.mjs`: synthetic installed-runtime
+  live acceptance. It pins the eligible Muse endpoint, bounds requests, forbids
+  local inference and Telegram sends, and invents no model/catalog replies.
+
+## Verification
+
+All 66 new regressions passed: 13 runner repair, 11 adopted-source custody,
+9 retained-draft Bridge custody, and 33 public paused-status cases. The isolated
+orchestrator batch passed 62/62. The broader isolated CLI batch passed 199/201;
+its two old source/owner guard final-state assertions fail identically on
+untouched, fully compiled `ba291791`. An additional existing terminal-review
+fixture fails on that same baseline (17 other cases pass). These are recorded
+test limitations, not an assertion that the entire suite is green; no custody
+guard or test assertion was relaxed to obtain success.
+
+The full isolated workspace rebuild, 571-file tarball audit (zero warnings),
+and compiler-free fresh npm installation passed. The installed candidate uses
+the tracked test manifest version 1.0.790; it is identified by bundle SHA256
+`c78a20f7d05ef313e2226211235fb57402a52249aa366b7274a8a1cc28479a5f`,
+not an npm publication or replacement of the operator's runtime.
+
+The real installed Muse run passed in 16.7 seconds, with three HTTP 200 streamed
+Responses requests and the sequence `task_complete → file_read → task_complete`.
+Exactly one bounded required-work hold preceded one actual production
+`FileReadTool` read. Both completion submissions have the same exact answer
+hash. Observation becomes satisfied; only visible response remains pending.
+The runner returns `provider_delivery_pending`, no retained-only draft, no
+accepted/completed result, and zero provider ACKs. Model/catalog replies were
+not mocked; all source content was synthetic and no Telegram message was sent.
+
+This live test covers the installed runner and real source tool with a
+host-owned scratch acceptance adapter. It does not exercise real Telegram
+ingress/reply grants, the Bridge source-answer critic, or Telegram API delivery.
+Actual paused dispatch/source custody are covered by the focused synthetic
+transport tests. Actual Telegram delivery and typing visibility require the
+operator's updated publication/restart; no live conversation state is modified
+by this repair or test. [Safe receipts](evidence/telegram-retained-source-handoff-live-20261013.json)
+retain hashes and synthetic diagnostics without private source/draft text.
+
+Architecture: [separate review, delivery and task states](../../.aiwg/architecture/adr-completion-review-delivery-states-20261013.md).

package/docs/work-orders/WO-web-browser-crawl-full-coverage-20261013.md

@@ -0,0 +1,65 @@
+# Complete browser and crawler reads
+
+Status: implemented and verified; follows the complete HTTP source repair.
+
+The operator's no-truncation requirement also covers browser and crawler page
+reads. The final audit found independent prefix cuts in Playwright, the legacy
+browser service and crawler formatting; preserving full HTTP responses alone
+does not repair those paths.
+
+1. Remove successful prefix cuts from browser content/DOM/element reads and
+   evaluation serialization, including predecessor service serialization.
+   Preserve valid complete JSON. Distinguish a selected element, evaluation
+   result, controls snapshot and complete returned document view.
+2. Issue a distinct immutable page-content capability with exact content hash,
+   source URL, producer/action, invocation identity, capture and session
+   provenance. A browser observation is not an HTTP fetch receipt or proof of
+   a read-only action; JavaScript evaluation can mutate the page.
+3. Remove crawler per-page/global text clipping and discarded link/metadata
+   tails. Preserve code whitespace and all static sections. Keep requested
+   page/depth scope explicit. Resource failures must not masquerade as a
+   successful complete prefix or a successful multi-page crawl.
+4. Route these complete returned views through the same capacity admission,
+   full-request source workers, exact quote checks and contiguous checkpoint
+   mechanism used by HTTP fetches. Preserve Stop, task ownership and original
+   source scope through adapters and normalization.
+5. Provide host-owned extraction resumption without replaying potentially
+   mutating JavaScript. Ordinary browser/crawl reads may be repeated to obtain
+   a new observation; an evaluation result must reopen its saved source.
+6. Verify actual large producer results, serializer boundaries, late facts,
+   copied/stale capabilities, complete-view normalization, bounded pending
+   coverage and resumption. Rebuild and validate the installed package before
+   committing and pushing the coherent repair.
+
+Bounded UI/control summaries remain observations of their explicit scope;
+they cannot establish a complete document read. This work does not widen
+Telegram tool permissions or reuse active browser sessions in acceptance tests.
+
+Depends on [complete-source extraction](WO-web-source-full-coverage-extraction-20261013.md)
+and [inference contract/output budgets](WO-fallback-contract-cooldown-20261013.md).
+
+## Verification
+
+The [installed browser receipt](evidence/browser-complete-source-live-20261013.json)
+records six successful real Playwright tool reads against isolated Chromium:
+content, DOM, innerText, textContent, innerHTML and evaluate. The complete DOM
+has 477,626 characters; evaluation retains valid JSON with all 350 rows and its
+late Unicode field. No user browser, local inference, external source site,
+runtime installation or Telegram transport was used. The exact installed
+bundle SHA256 is recorded; this covers execution tools, not a GUI benchmark or
+real Telegram delivery.
+
+The isolated producer suites pass 98 tests. Shared runner/extraction/fallback/
+budget suites pass 264 with one existing opt-in test skipped, including exact
+contiguous resumption with no browser replay,
+ownership/Stop rejection and honest unresolved facets. Telegram suites pass
+115, including genuine source receipts, actual child-page destinations beyond
+clipped event text, unsafe URL rejection and existing native settlement checks.
+Crawler Python parser/BFS fixtures run the actual implementation with a fixture
+transport; no live Crawlee service or full browser-driven Telegram conversation
+is claimed. Bounded rapid UI snapshots now explicitly report omitted frames and
+text and state that they are not complete page reads.
+
+All workspace packages rebuild, the 583-file tarball audit has zero warnings,
+and the compiler-free fresh npm install passes. The operator's publication
+directory and active runtime are unchanged by these isolated acceptance runs.

package/docs/work-orders/WO-web-source-full-coverage-extraction-20261013.md

@@ -0,0 +1,135 @@
+# Complete web sources and request-bound extraction
+
+Status: implemented and verified in the isolated installed runtime. Added by
+the operator during the OMNIUS research stream/progress repair. Publication and
+restart of the active session remain with the operator.
+
+## Requirement
+
+Do not silently truncate web pages. When a complete page cannot fit the main
+agent's context, use a dedicated isolated extraction pass that accounts for the
+whole source and preserves the requested information's depth and breadth.
+An archive containing the full bytes is necessary, but is not proof that the
+agent or extractor read the complete requested material.
+
+## Gaps found and repaired
+
+- Native HTTP bytes were already complete, content-addressed and hash-bound.
+- `web_fetch` nevertheless returned a default 5,000-character prefix, including
+  on cache hits, with a 100,000-character display ceiling.
+- The pending HTML evidence implementation selected the first article and capped
+  article text; supplementary rendering clips other material.
+- The runner could admit that short projection without any extraction call.
+- The existing evidence branch remains useful targeted discovery, but samples at
+  most six windows/220 lines/24,000 characters and two semantic rounds. It
+  clips long lines, excerpts and the request brief. It is not a full-source
+  extraction mechanism and must not be presented as one.
+
+## Ordered work
+
+1. Return the full requested textual/raw source view on fresh and cached
+   fetches. Keep legacy `max_length` accepted without silently clipping the
+   source. Retain explicit size failures, immutable raw bytes and native hash
+   receipts. Capacity management belongs to the runner.
+2. Traverse the complete static document in order, including all articles,
+   tables, code/pre whitespace and captions. Distinguish non-rendered code and
+   bounded supplementary metadata from the complete semantic source. Sparse
+   or JavaScript-dependent pages must explicitly require GUI/rendered evidence
+   rather than claiming rendered-page coverage from static HTML.
+3. Capacity-admit the complete semantic view when it fits. Otherwise archive
+   that complete semantic document separately from raw HTML and dispatch a
+   source-wide extraction coordinator through the existing configured backend.
+4. Partition every source character into contiguous lossless hash-bound
+   ranges, including long minified lines and Unicode. Every worker receives
+   the full accepted original request and requested facets, never a clipped
+   replacement. Validate quoted findings against exact chunk/source ranges.
+5. Track real completed chunk coverage and exact resumable source/request
+   identity. Budget, ownership, Stop, invalid response or unavailable inference
+   leaves explicit remaining coverage/cursor. Do not infer absence from an
+   unread region or declare the source complete because a few excerpts look
+   relevant. Worker judgments do not grant objective fulfillment.
+6. Preserve all extraction findings in the owned artifact/state. Give the
+   parent a complete request-focused result only after coverage is accounted
+   for and it fits; otherwise require an explicit reduction/read/resume step,
+   retaining the full findings rather than clipping the main view silently.
+7. Verify full-content tails, multiple articles, code/tables/captions, fresh
+   and cache paths, request clauses beyond old limits, chunk coverage, Stop,
+   resume identity, invalid model evidence and true budget exhaustion. Run
+   actual remote extraction on synthetic documents with late and distributed
+   requested facts; no invented inference replies count as live acceptance.
+8. Rebuild and test the isolated installed package, then make scoped commits
+   and push. Preserve unrelated changes and the operator's publication files.
+9. Repair invalid returned worker replies within the dedicated pass using
+   existing finite calls/attempt/deadline budgets. Record static validation
+   reasons and reply hashes, reserve correction-prompt capacity in advance,
+   and keep exact quote validation. An invalid chunk earns no coverage credit.
+
+Installed acceptance exposed a separate [request-contract/budget repair](WO-fallback-contract-cooldown-20261013.md)
+needed before the low-context public path could finish. Keep these dependencies
+explicit; a successful isolated worker alone does not certify the final path.
+The final scope audit also opened the [browser/crawler work order](WO-web-browser-crawl-full-coverage-20261013.md)
+for independent prefix cuts in those producers.
+
+Dependencies: the existing native web-source custody, source artifacts,
+configured branch backend, capacity admission and Stop/owner fences. Reuse
+them; do not add a separate completion-approval workflow.
+
+## Verification receipts
+
+The [live coordinator receipt](evidence/web-source-wide-coordinator-live-20261013.json)
+records eight real Muse HTTP 200 generations in 40.4 seconds. Five contiguous
+workers cover all 99,981 characters of a synthetic HTML semantic document;
+three cover all 54,551 characters of single-line JSON. Every requested field
+is recovered with exact host-validated source quotes, including later sections,
+table values, code, Unicode, captions and an attribute-only API destination.
+Full original request/facets survive the actual wire adaptation unchanged.
+
+This receipt covers the compiled coordinator and production remote backend.
+Installed public Telegram source routing, parent capacity and goal settlement
+are covered by the separate final acceptance below. No local inference, fake
+model/catalog replies or actual Telegram sends are involved.
+
+The [installed worker diagnostic](evidence/web-source-worker-validation-before-20261013.json)
+captures two distinct returned-reply problems: Step normalized whitespace inside
+quotes, while Muse returned literal quotes but marked the compound request
+uncertain because only part of it appeared in the chunk. Exact quotes remain
+mandatory. Valid quoted findings may coexist with an unresolved facet; neither
+chunk support nor processing coverage establishes whole-task fulfillment.
+
+The [parent-capacity diagnostic](evidence/web-source-parent-capacity-before-20261013.json)
+then records five valid workers covering all 109,910 RFC characters, followed
+by completed-extraction resumption and primary turns with only 662/882 output
+tokens. The latter returned an incomplete provider response before the
+fixture's 20-request cap. This is a main-turn reservation/reduction problem,
+not an invalid source worker or an artifact-query helper. Primary turns now
+reserve at least 4,096 output tokens, subject to an explicit lower user ceiling,
+and completed findings have a compact complete artifact that reopens without
+another worker pass. Runtime timeouts remain bounded and unchanged.
+
+The [final installed public-path receipt](evidence/web-source-installed-public-live-20261013.json)
+records nine actual model requests in 65.8 seconds, with real catalog, inference
+and RFC source responses. The first schema rejection is repaired on the same
+model; the remaining eight HTTP requests succeed. Three workers account for
+all 109,910 source characters, preserve the complete original request and
+produce exact host-validated quotes. The final reply contains all three
+requested details, including the late appendix, and preserves mandatory versus
+advisory wording. The native host goal is fulfilled and intake is consumed
+after the scratch Telegram ACK. The installed bundle SHA256 is
+`546ad34240141d7597b979bb298a7381ae3ab4c8356c28a95a9c7955ddcf51ef`.
+
+This run uses a 65,536-token configured context. The separate
+[32k capacity receipt](evidence/web-source-installed-capacity-guard-20261013.json)
+records complete source processing followed by a typed before-transport pause:
+the intact request, safety margin and required output reserve exceed capacity.
+It is a successful capacity-guard check, not a successful final-answer run.
+No source prefix or fabricated completion is substituted, and automatic replay
+stops. Complete extraction cannot guarantee a final reply when the essential
+request itself cannot fit the selected model's context.
+
+Execution suites pass 98 tests; runner/extraction/fallback/budget suites pass
+264 with one existing opt-in test skipped; Telegram suites pass 115. All
+workspace packages rebuild. The 583-file tarball audit has zero warnings and
+the compiler-free fresh npm installation passes. Browser producer acceptance
+uses the same installed bundle and is recorded in the dependent work order.
+Telegram transport acknowledgments are simulated; actual delivery/typing,
+historical group transcripts and web-search availability are outside this run.

package/docs/work-orders/evidence/browser-complete-source-live-20261013.json

@@ -0,0 +1,111 @@
+{
+  "schema": "omnius.live-browser-complete-source-acceptance.v1",
+  "startedAt": "2026-10-13T23:32:33.094Z",
+  "coverage": "installed_execution_tool_transport",
+  "bundleSha256": "546ad34240141d7597b979bb298a7381ae3ab4c8356c28a95a9c7955ddcf51ef",
+  "installedOmniusRuntimeCoverage": true,
+  "runnerTelegramCoverage": false,
+  "localInferenceCalls": 0,
+  "telegramWrites": 0,
+  "userBrowserAttached": false,
+  "automaticInstallAllowed": false,
+  "browserMode": "headless",
+  "launchFlags": [
+    "--disable-gpu",
+    "--disable-gpu-compositing",
+    "--disable-software-rasterizer",
+    "--use-gl=disabled",
+    "--disable-features=Vulkan,WebGPU"
+  ],
+  "syntheticSourceChars": 477611,
+  "syntheticSourceSha256": "2e1207c0a479381c25e4a941d977be6d2eee2bf58d7c31f1b3b63a123ae68c81",
+  "records": [
+    {
+      "action": "content",
+      "chars": 351086,
+      "bytes": 351089,
+      "sha256": "850317106c9f3b47f193e5b90938257db04bb3f3e1061a38bfe4a035f88d270c",
+      "viewKind": "rendered_text",
+      "scope": "document",
+      "coverage": "complete_returned_view",
+      "tailVerified": true,
+      "validCompleteJson": null,
+      "invocationBound": true,
+      "sourceBrandVerified": true,
+      "sessionBound": true
+    },
+    {
+      "action": "dom",
+      "chars": 477626,
+      "bytes": 491632,
+      "sha256": "af78adbdcf530ef417c832c16a6cf9405bdbd2f4139bfc578faac0c596e43fa0",
+      "viewKind": "raw_html",
+      "scope": "document",
+      "coverage": "complete_returned_view",
+      "tailVerified": true,
+      "validCompleteJson": null,
+      "invocationBound": true,
+      "sourceBrandVerified": true,
+      "sessionBound": true
+    },
+    {
+      "action": "innerText",
+      "chars": 351088,
+      "bytes": 351091,
+      "sha256": "c96eb96c69be09e7e0a12e3b6fd290004d0c38a0bc82d338462f1766585d61ea",
+      "viewKind": "rendered_text",
+      "scope": "selected_element",
+      "coverage": "complete_returned_view",
+      "tailVerified": true,
+      "validCompleteJson": null,
+      "invocationBound": true,
+      "sourceBrandVerified": true,
+      "sessionBound": true
+    },
+    {
+      "action": "textContent",
+      "chars": 351086,
+      "bytes": 351089,
+      "sha256": "850317106c9f3b47f193e5b90938257db04bb3f3e1061a38bfe4a035f88d270c",
+      "viewKind": "rendered_text",
+      "scope": "selected_element",
+      "coverage": "complete_returned_view",
+      "tailVerified": true,
+      "validCompleteJson": null,
+      "invocationBound": true,
+      "sourceBrandVerified": true,
+      "sessionBound": true
+    },
+    {
+      "action": "innerHTML",
+      "chars": 351154,
+      "bytes": 351157,
+      "sha256": "1c373997afa742c08399367deac8dd63b3a5d4b7163bf880f56539a9234df857",
+      "viewKind": "raw_html",
+      "scope": "selected_element",
+      "coverage": "complete_returned_view",
+      "tailVerified": true,
+      "validCompleteJson": null,
+      "invocationBound": true,
+      "sourceBrandVerified": true,
+      "sessionBound": true
+    },
+    {
+      "action": "evaluate",
+      "chars": 138353,
+      "bytes": 152356,
+      "sha256": "e2cf0105734b8a10fa9674821efdb08442d7712309934ffdd507c776a9800f0b",
+      "viewKind": "evaluation_json",
+      "scope": "evaluation_result",
+      "coverage": "complete_returned_view",
+      "tailVerified": true,
+      "validCompleteJson": true,
+      "invocationBound": true,
+      "sourceBrandVerified": true,
+      "sessionBound": true
+    }
+  ],
+  "status": "passed",
+  "finishedAt": "2026-10-13T23:32:34.178Z",
+  "blockedExternalRequests": 0
+}