omnius 1.0.855 → 1.0.857

package/docs/DISCOVERY.md

@@ -523,6 +523,10 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.voice-flow-architecture` | Voice TTS Flow — Architecture &amp; Implementation Guide | This document describes the voice synthesis system in omnius: how it's built, how all the pieces connect, and how to add new voice features following the same patterns. |
 | `guide.work-orders-active-inference-route-remote-probes-20261012` | Active Inference Route Remote Probes 20261012 | Bundled Omnius documentation artifact: docs/work-orders/active-inference-route-remote-probes-20261012.json. |
 | `guide.work-orders-daemon-hud-ui-overhaul` | Daemon HUD UI Overhaul Work Order | Overhaul the daemon web interface using /home/roko/Desktop/hud-ui-style-kit(6)/hud-ui-style-kit as the source of truth. Preserve current daemon behavior while replacing the OpenWebUI-like rounded dashboard styling with the cold tactical HUD visual system. |
+| `guide.work-orders-evidence-automatic-capacity-before-source-route-20261013` | Automatic Capacity Before Source Route 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/automatic-capacity-before-source-route-20261013.json. |
+| `guide.work-orders-evidence-automatic-capacity-stream-installed-20261013` | Automatic Capacity Stream Installed 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/automatic-capacity-stream-installed-20261013.json. |
+| `guide.work-orders-evidence-browser-complete-source-live-20261013` | Browser Complete Source Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/browser-complete-source-live-20261013.json. |
+| `guide.work-orders-evidence-fallback-contract-cooldown-before-20261013` | Fallback Contract Cooldown Before 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-contract-cooldown-before-20261013.json. |
 | `guide.work-orders-evidence-fallback-model-benchmarks-20261012` | Fallback Model Benchmarks 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-model-benchmarks-20261012.json. |
 | `guide.work-orders-evidence-fallback-quality-installed-20261012` | Fallback Quality Installed 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-quality-installed-20261012.json. |
 | `guide.work-orders-evidence-fallback-reply-contracts-installed-20261012` | Fallback Reply Contracts Installed 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-reply-contracts-installed-20261012.json. |
@@ -532,6 +536,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-kilo-production-compatibility-20261012` | Kilo Production Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/kilo-production-compatibility-20261012.json. |
 | `guide.work-orders-evidence-native-conversation-prompt-audit-20261012` | Native Conversation Prompt Audit 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-conversation-prompt-audit-20261012.json. |
 | `guide.work-orders-evidence-native-goal-contract-probe-20261012` | Native Goal Contract Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-goal-contract-probe-20261012.json. |
+| `guide.work-orders-evidence-native-reconciliation-readonly-live-20261014` | Native Reconciliation Readonly Live 20261014 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-reconciliation-readonly-live-20261014.json. |
 | `guide.work-orders-evidence-opencode-all-free-audit-20261012` | Opencode All Free Audit 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/opencode-all-free-audit-20261012.json. |
 | `guide.work-orders-evidence-opencode-all-free-installed-verification-20261012` | Opencode All Free Installed Verification 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/opencode-all-free-installed-verification-20261012.json. |
 | `guide.work-orders-evidence-opencode-installed-production-stream-live-20261012` | Opencode Installed Production Stream Live 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/opencode-installed-production-stream-live-20261012.json. |
@@ -543,13 +548,20 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-ovh-structured-context-compatibility-20261012` | Ovh Structured Context Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/ovh-structured-context-compatibility-20261012.json. |
 | `guide.work-orders-evidence-public-review-after-20261012` | Public Review After 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-review-after-20261012.json. |
 | `guide.work-orders-evidence-public-review-before-20261012` | Public Review Before 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-review-before-20261012.json. |
+| `guide.work-orders-evidence-source-hierarchy-installed-20261013` | Source Hierarchy Installed 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/source-hierarchy-installed-20261013.json. |
 | `guide.work-orders-evidence-telegram-all-free-live-20261013` | Telegram All Free Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-all-free-live-20261013.json. |
 | `guide.work-orders-evidence-telegram-completion-review-live-20261013` | Telegram Completion Review Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-completion-review-live-20261013.json. |
 | `guide.work-orders-evidence-telegram-native-planning-live-20261013` | Telegram Native Planning Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-native-planning-live-20261013.json. |
+| `guide.work-orders-evidence-telegram-public-research-stream-live-20261013` | Telegram Public Research Stream Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-public-research-stream-live-20261013.json. |
 | `guide.work-orders-evidence-telegram-retained-source-handoff-live-20261013` | Telegram Retained Source Handoff Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/telegram-retained-source-handoff-live-20261013.json. |
 | `guide.work-orders-evidence-terminal-review-contract-probe-20261012` | Terminal Review Contract Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-contract-probe-20261012.json. |
 | `guide.work-orders-evidence-terminal-review-error-probe-20261012` | Terminal Review Error Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-error-probe-20261012.json. |
 | `guide.work-orders-evidence-terminal-review-schema-repair-probe-20261012` | Terminal Review Schema Repair Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-schema-repair-probe-20261012.json. |
+| `guide.work-orders-evidence-web-source-installed-capacity-guard-20261013` | Web Source Installed Capacity Guard 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/web-source-installed-capacity-guard-20261013.json. |
+| `guide.work-orders-evidence-web-source-installed-public-live-20261013` | Web Source Installed Public Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/web-source-installed-public-live-20261013.json. |
+| `guide.work-orders-evidence-web-source-parent-capacity-before-20261013` | Web Source Parent Capacity Before 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/web-source-parent-capacity-before-20261013.json. |
+| `guide.work-orders-evidence-web-source-wide-coordinator-live-20261013` | Web Source Wide Coordinator Live 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/web-source-wide-coordinator-live-20261013.json. |
+| `guide.work-orders-evidence-web-source-worker-validation-before-20261013` | Web Source Worker Validation Before 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/web-source-worker-validation-before-20261013.json. |
 | `guide.work-orders-hermes-architecture-deltas-01-public-scrutiny-provenance-control-index-uppercase` | Public Scrutiny Provenance Control Index | Bundled Omnius documentation artifact: docs/work-orders/hermes-architecture-deltas/01-public-scrutiny-provenance-control/INDEX.md. |
 | `guide.work-orders-hermes-architecture-deltas-01-public-scrutiny-provenance-control-workorder-uppercase` | Workorder: Public Scrutiny Provenance Control | Add a public Telegram scrutiny control plane that can elevate completion provenance checks when public accuracy risk rises, without hard-coded scenario phrases or shortcut wording that teaches the model to satisfy the gate without evidence. |
 | `guide.work-orders-hermes-architecture-deltas-02-context-engine-plugin-boundary-index-uppercase` | Context Engine Plugin Boundary Index | Bundled Omnius documentation artifact: docs/work-orders/hermes-architecture-deltas/02-context-engine-plugin-boundary/INDEX.md. |
@@ -673,8 +685,12 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-telegram-reliability-consolidation-2026-09-28` | Telegram Reliability Consolidation — 2026-09-28 | Rule: check a box only after the named behavior is implemented and its listed verification passes. A parent box stays open until every child box is checked. |
 | `guide.work-orders-wo-active-inference-route-and-telegram-review-20261012-uppercase` | Active inference route and Telegram completion review | Status: implementation complete and verified. Publication remains with the user. |
 | `guide.work-orders-wo-am-gaps-uppercase` | Associative Memory Gap Work Orders | Generated: 2026-04-13 Source: Deep audit of multimodal associative memory systems Status: READY FOR IMPLEMENTATION |
+| `guide.work-orders-wo-automatic-capacity-recovery-and-room-history-20261013-uppercase` | Automatic capacity recovery and consecutive room history | Status: streamed-source recovery is implemented and verified through the isolated installed package; default eager-source transport preservation is under repair. Supersedes treating ordinary context pressure as an acceptable terminal result in the complete-source work order. Publication and active-runtime update remain with the operator. |
 | `guide.work-orders-wo-built-in-free-model-startup-20261012-uppercase` | Built-in free inference and clean Telegram settlement | Status: implemented, tested and committed. Live service limits are recorded below rather than claimed as model availability. Publication and bot restart remain operator-owned. |
 | `guide.work-orders-wo-completion-review-recovery-20261013-uppercase` | Completion review recovery and Telegram liveness | Status: implementation and verification complete; source pushed to origin/main. Operator publication and bot restart remain pending. Follow-up to the live completion-block and typing indicator report on installed Omnius 1.0.852, PID 2845019, telegramtest, and subsequent 1.0.853 restart PID 3697027. |
+| `guide.work-orders-wo-computer-use-loop-reconciliation-20261013-uppercase` | Reconcile legacy desktop tools with the rapid computer-use controller | Status: reconciliation implemented; isolated build, focused regressions and real read-only desktop observation/capture verified. Live Kev/Moondream inference and visual input acceptance remain limited by the missing profile and host GPU health described below. No claim that every application/control is supported. |
+| `guide.work-orders-wo-escape-crash-and-gpu-incident-20261013-uppercase` | Escape exit and NVIDIA device incident | Status: parallel read-only investigation complete. GNOME Terminal crashed in GTK; one A100 is unqueryable and the broker correctly blocks new CUDA work. The exact GTK trigger and physical GPU failure cause remain unresolved. The computer-use reconciliation is delivered separately; a broad application refactor is not established as a repair for either failure |
+| `guide.work-orders-wo-fallback-contract-cooldown-20261013-uppercase` | Keep internal inference failures within their contract and budget | Status: contract cooldown, aggregate deadline and phase output allocations verified; final installed full-source public-path acceptance passed. |
 | `guide.work-orders-wo-fallback-quality-order-20261012-uppercase` | Benchmark-informed fallback cascade | Status: implemented and verified. Publication and active runtime replacement remain with the user. Telegram progress presentation stays deferred. |
 | `guide.work-orders-wo-fallback-reply-contracts-20261012-uppercase` | Fallback reply contracts and live Telegram regressions | Status: implemented and verified in source and the freshly installed package. Publishing and restarting the active bot remain user-owned. The subsequent OpenCode-first capability ordering is tracked in its work order; Telegram progress presentation remains explicitly deferred. |
 | `guide.work-orders-wo-inference-fallback-20261012-uppercase` | Local inference outage fallback | Status: source implementation complete and verified. Installed-runtime activation is separate; the running daemon has not been upgraded or restarted. |
@@ -688,9 +704,12 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-wo-telegram-fallback-20261012-uppercase` | Telegram outage fallback and user-selected approval mode | Status: implementation complete; distributable verification recorded below. Publication and runtime installation are reserved for the user. |
 | `guide.work-orders-wo-telegram-plain-answer-and-provider-catalog-20261012-uppercase` | Preserve native Telegram answers and use compatible free inference routes | Status: implemented and verified. The user owns publication and runtime replacement. |
 | `guide.work-orders-wo-telegram-progress-presentation-20261012-uppercase` | Telegram progress presentation | Status: implemented and verified, resumed by the user with instructions to complete, commit and push. The evidenced OpenCode compatibility failure is handled in the current repair order. |
+| `guide.work-orders-wo-telegram-public-research-stream-progress-20261013-uppercase` | Public research stream recovery and meaningful progress | Status: repaired and verified in the isolated installed runtime. Publication and the operator's bot restart are separate. |
 | `guide.work-orders-wo-telegram-reply-lifecycle-20261013-uppercase` | Telegram reply lifecycle | Status: implemented and verified. The built-in-model/startup and multi-model live acceptance work continues under WO-built-in-free-model-startup-20261012.md. |
 | `guide.work-orders-wo-telegram-retained-source-handoff-20261013-uppercase` | Recover accepted Telegram drafts without restarting completed work | Status: implementation and installed-package live verification complete. Follow-up to the Case Theory stall on installed Omnius 1.0.854, PID 161677, running from telegramtest. Publication and bot restart remain operator-owned. |
 | `guide.work-orders-wo-telegram-unavailable-review-presentation-20261012-uppercase` | Telegram reply presentation when an auxiliary review is unavailable | Status: implemented and verified. Publication and runtime replacement remain with the user. |
+| `guide.work-orders-wo-web-browser-crawl-full-coverage-20261013-uppercase` | Complete browser and crawler reads | Status: implemented and verified; follows the complete HTTP source repair. |
+| `guide.work-orders-wo-web-source-full-coverage-extraction-20261013-uppercase` | Complete web sources and request-bound extraction | Status: implemented and verified in the isolated installed runtime. Added by the operator during the OMNIUS research stream/progress repair. Publication and restart of the active session remain with the operator. |
 | `guide.work-orders-world-class-memory-compiler-readme-uppercase` | World-Class Memory Compiler Program | Status: active implementation program Owner: Omnius orchestration and memory packages Last updated: 2026-07-13 |
 | `guide.work-orders-world-class-memory-compiler-tracker-uppercase` | Memory Compiler Implementation Tracker | Last reconciled: 2026-07-13 Authority: This file is the granular program tracker. The work-order documents define the contract and acceptance criteria; neither test output nor a model claim may check an item without the named evidence. |
 | `guide.work-orders-world-class-memory-compiler-wo-01-exact-request-budget-uppercase` | WO-01 — Exact Request and Budget Compiler | Status: in progress Primary modules: packages/orchestrator/src/agenticRunner.ts, contextWindowDump.ts, context-compiler.ts, context-fabric.ts Depends on: none |
@@ -889,6 +908,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `tool.live-media-loop` | Live Media Loop | live_media_loop is a directly callable Omnius tool. |
 | `tool.log-explore` | Log Explore | log_explore is a directly callable Omnius tool. |
 | `tool.manage-tools` | Manage Tools | manage_tools is a directly callable Omnius tool. |
+| `tool.manual-desktop-vision` | Manual Desktop Vision | manual_desktop_vision is a directly callable Omnius tool. |
 | `tool.memory-metabolize` | Memory Metabolize | memory_metabolize is a directly callable Omnius tool. |
 | `tool.memory-ops` | Memory Ops | memory_ops is a directly callable Omnius tool. |
 | `tool.memory-read` | Memory Read | memory_read is a directly callable Omnius tool. |
@@ -944,7 +964,6 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `tool.video-scan` | Video Scan | video_scan is a directly callable Omnius tool. |
 | `tool.video-understand` | Video Understand | video_understand is a directly callable Omnius tool. |
 | `tool.vision` | Vision | vision is a directly callable Omnius tool. |
-| `tool.vision-action-loop` | Vision Action Loop | vision_action_loop is a directly callable Omnius tool. |
 | `tool.visual-memory` | Visual Memory | visual_memory is a directly callable Omnius tool. |
 | `tool.visual-trigger` | Visual Trigger | visual_trigger is a directly callable Omnius tool. |
 | `tool.web-crawl` | Web Crawl | web_crawl is a directly callable Omnius tool. |

package/docs/guides/tools-and-web-search.md

@@ -58,6 +58,50 @@ installed service explicitly marks it direct-callable. Catalog presence,
 read-scope classification, or a tool schema alone does not grant that
 invocation mode.
 
+## Complete Web Sources
+
+`web_fetch` retains the complete native response and its byte hash. Its `text`
+view includes all static body sections, articles, tables, code, captions and
+exact link/image/form destinations;
+`format: "raw_html"` returns complete markup, including script and API clues.
+The legacy `max_length` argument is accepted but ignored, so it cannot discard
+later source content. Context capacity is handled by the agent runtime: use the
+complete view when it fits, otherwise extract from the immutable full source
+and keep unresolved coverage explicit. A selected excerpt is not a full read.
+
+Static text does not establish what a JavaScript application renders or that
+missing information is absent. Inspect sparse or script-dependent pages with
+an available authorized browser. Responses above the 5 MiB fetch limit fail
+explicitly instead of returning a successful partial prefix. Supplemental
+image/date metadata indexes are selective; the complete raw source remains
+available for broader inspection.
+
+Browser content, DOM, selected-element and evaluation reads also retain the
+complete returned view, including valid complete evaluation JSON. Their source
+receipts describe that actual scope; a selected element or evaluation result is
+not a complete rendered-page observation. Crawler results retain each returned
+page's content, links and metadata within the explicit page/depth scope.
+
+Oversized views use isolated source workers that receive the full request and
+every requested facet. They account for contiguous source ranges, validate
+literal source quotes and retain all findings. An unfinished pass reports its
+remaining cursor; it cannot establish absence in unread material. If the full
+findings do not fit the parent context, they remain in an owned artifact for
+explicit reading or reduction.
+
+Completed passes also retain a compact artifact containing every finding,
+separate from the verbose checkpoint. Read that artifact to reopen all findings
+without repeating extraction. If the intact request and required output reserve
+cannot fit the selected model's context, the runtime pauses explicitly; it does
+not substitute a shortened page or repeated tiny-output requests.
+
+For a current task's retained extraction, `artifact_read` accepts
+`resume_source_extraction: true` with the exact source/findings `artifact_uri`.
+This resumes remaining chunks without replaying a browser evaluation. It cannot
+be combined with a query or line range. Restarted or foreign tasks cannot adopt
+that live resumer; the artifact remains readable and the runtime reports the
+missing current ownership instead of rerunning potentially mutating JavaScript.
+
 ## Direct Tools
 
 For a tool marked `direct_callable: true`, use:

package/docs/work-orders/WO-automatic-capacity-recovery-and-room-history-20261013.md

@@ -0,0 +1,134 @@
+# Automatic capacity recovery and consecutive room history
+
+Status: streamed-source recovery is implemented and verified through the
+isolated installed package; default eager-source transport preservation is
+under repair. Supersedes treating ordinary context pressure as an acceptable
+terminal result in the complete-source work order. Publication and active-runtime
+update remain with the operator.
+
+Room-history repair: implemented and verified. Consecutive completed requests
+reuse the same chronological block for the exact room/topic identity while the
+block remains at the scrollback tail and the idle gap is below 30 seconds.
+Other rooms, unrelated appended output, overlapping work and Stop break the
+sequence. Every inference retains its own callback identity, request boundary,
+output, failure history and usage; stale callbacks cannot modify a later request.
+Read mode remains available for the entire retained chronology.
+
+Verification: 67 selected TUI/registry/status-bar tests and CLI typecheck pass.
+Two unrelated broad observability assertions reproduce against the prior bridge
+and remain unchanged; they are not counted as passing.
+
+## Accepted requirements
+
+1. Preserve the complete original request, constraints, source identity and
+   evidence. Whole-source custody alone does not establish whole-source reading.
+2. Recover automatically from context pressure: release owned duplicates,
+   organize evidence hierarchically, and choose an authorized eligible model
+   with sufficient actual context before declaring an external blocker.
+3. Persist processing coverage and resumable progress. Recovery must change
+   capacity, representation, output allowance or route; never replay the same
+   failing request indefinitely. Preserve Stop, ownership, privacy and explicit
+   fallback settings.
+4. Handle large HTTP sources through durable streaming storage instead of an
+   arbitrary small successful-prefix or immediate size rejection. Retain exact
+   source bytes and verify the completed retrieval before granting source-read
+   evidence. Resource exhaustion must identify the real external limit.
+5. Keep every requested facet, contradictions, citations and unresolved details
+   through hierarchical evidence processing. Complete archived findings remain
+   recoverable; a reduced parent view cannot manufacture support or fulfillment.
+6. Validate the original constrained 32k RFC task through the installed native
+   Telegram path with real model/catalog/source responses and a complete cited
+   final answer. Distinguish simulated transport ACKs from actual Telegram sends.
+7. Consolidate consecutive TUI inference activity for the same Telegram room
+   into one chronological block. An interlaced room/activity or meaningful time
+   break starts a separate block. Preserve request identity, errors, read-mode
+   history, scrolling and room/topic separation.
+8. Present the bundled public models as built-in free inference in user-facing
+   model, route and status text. Keep actual provider identities in machine
+   audit receipts so transport failures remain diagnosable.
+9. Apply known endpoint/model schema restrictions before the first request.
+   Preserve validation against the original host contract. A transport adapter
+   must not weaken required fields, exclusivity, ownership or effect checks.
+10. Distinguish accepted task output from acknowledged Telegram delivery. Retry
+    a proven preconnection failure using the same immutable saved operation;
+    retain ambiguous sends for reconciliation without regenerating the task.
+    Public progress must reflect preparation, sending, retrying, unconfirmed
+    delivery or complete acknowledgement.
+
+## Implementation and acceptance record
+
+- Complete HTTP bodies stream to verified, indexed immutable files. The eager
+  threshold selects storage representation; it does not truncate or reject the
+  remaining response. CAS imports and extraction read bounded exact ranges.
+- Source workers automatically cover the finite source under the original full
+  request. Large retained findings use lossless encoding first, then isolated
+  hierarchical reduction with an independent preservation review and resumable
+  checkpoints. Coverage and reduced prose do not establish factual support.
+- Context negotiation binds a prepared remote route to the exact packet and
+  owner. Working local capacity remains unchanged; an explicit hard ceiling
+  remains binding. Consumed preparation tokens never reach child backends.
+- Installed validation found a second capacity disconnect: a fitting primary
+  packet could fall back successfully to a larger remote model without a prior
+  preparation receipt, leaving the following source read at 32k. The first
+  streamed run accounted for all 109,910 characters with HTTP 200 responses,
+  but exhausted its unchanged 32-generation budget reducing/reopening findings.
+  It failed acceptance. The repair must bind actual successful route capacity
+  to that response's exact returned tool calls, including ordinary fallback;
+  this receipt cannot authorize a later model dispatch or enlarge local context.
+- The installed live test must exercise actual catalog, source and model
+  responses at the original 32k working window. Its forced file-storage mode
+  tests the production streaming path on the complete RFC; separate real HTTP
+  producer tests exercise sources larger than 32 MiB. Neither implies a live
+  Telegram API send: transport acknowledgements are simulated in scratch state.
+- The latest production failure is a saved seven-item research answer followed
+  by an unacknowledged final send (`fetch failed`). Progress edits succeeded.
+  The old log omitted the transport cause, so that operation remains ambiguous;
+  the repair must not retroactively infer that it was never sent.
+- Final isolated recursive build, artifact audit (586 files, zero warnings),
+  compiler-free fresh npm install and 581 focused checks pass: execution 81,
+  orchestrator 391, delivery/activity 92, room continuity 13 and retained
+  timeout/rate-limit/Stop/5xx delivery invariants 4.
+- Installed bundle SHA-256:
+  `bf6ed73b5034f8d1463eb2cd93fabd2e3d5476e151ddb9760a1ed9a0a9c977cc`.
+  The original 32k working-window test used actual catalog, RFC retrieval and
+  model replies: 11 generations, all HTTP 200, two source cores covering all
+  109,910 characters, all three cited details, fulfilled goal, consumed intake
+  and complete simulated Telegram acknowledgement. Mandatory versus advisory
+  wording was manually checked in the actual unmodified answer.
+- A separate installed hierarchy run made three real HTTP 200 requests:
+  extraction, organization and independent preservation review. It retained
+  all six findings and exact caveats/Unicode/numbers/code in 1,802 characters
+  under a 1,900-character parent budget; checkpoint reopen required no inference.
+  Its fixture budget is selected below the genuine lossless representation so
+  concise extraction cannot accidentally skip the hierarchy being tested.
+- Known schema restrictions were applied before the first wire request; no
+  400/unsupported-schema repair occurred in the successful installed runs.
+  Curated receipts are in `evidence/automatic-capacity-stream-installed-20261013.json`
+  and `evidence/source-hierarchy-installed-20261013.json`. The failed prior
+  candidate remains explicitly recorded in
+  `evidence/automatic-capacity-before-source-route-20261013.json`.
+- Delivery transport regressions exercise the actual Bridge fetch boundary and
+  durable operation ledger. No actual Telegram message/typing call, GPU model
+  request, publication or active-session restart was performed by this repair.
+- Additional default-storage live acceptance exposed an older memory-compiler
+  handoff: a complete eager view admitted under the successful remote route was
+  replaced with a memory artifact reference before model transport. Repeated
+  fetches did not fix that missing input. Pending repair must preserve the exact
+  host-owned unread source until its successful model input, then permit normal
+  historical archiving; no marker-based exemption or global compaction disable.
+
+## Delivery
+
+Use scoped changes and commits, preserve existing unrelated working-tree and
+publication changes, rebuild and verify the isolated installed package, fetch
+the tracked branch and push verified commits. The operator publishes and
+updates the active runtime.
+
+## Prior failure to reproduce
+
+The complete-source 32k installed test accounted for every one of 109,910
+characters, then rejected a final request requiring 27,282 input tokens,
+1,967 safety tokens and 4,096 output tokens: 33,345 total. The runner rejected
+before model transport, preventing the normal remote route selection from
+recovering. The former test recorded an honest incomplete result; the new
+acceptance requires automatic recovery and completed final delivery.

package/docs/work-orders/WO-computer-use-loop-reconciliation-20261013.md

@@ -0,0 +1,104 @@
+# Reconcile legacy desktop tools with the rapid computer-use controller
+
+Status: reconciliation implemented; isolated build, focused regressions and real
+read-only desktop observation/capture verified. Live Kev/Moondream inference
+and visual input acceptance remain limited by the missing profile and host GPU
+health described below. No claim that every application/control is supported.
+
+## Observed production disconnect
+
+The current terminal run in `telegram_test`,
+`tui-3144597-mv5p6bvu-1791939658797-1`, was asked to open Firefox and search
+archive.org. At 2026-10-14T01:04:57Z it invoked `vision_action_loop` with
+`action=observe`. The result captured the desktop using `gnome-screenshot`, ran
+Tesseract OCR, reported `Vision analysis unavailable`, and performed no input
+action. The next recorded tool was a todo update. This is not evidence that
+Kev, Moondream, or the new rapid decision/executor loop ran.
+
+## Accepted work
+
+1. Identify the canonical new controller and trace the legacy tool, registration,
+   desktop discovery, prompt guidance and configured model routing into it.
+2. Reconcile existing desktop entry points with the new controller. Ordinary
+   authorized desktop tasks must discover the intended semantic observation,
+   finite-action policy, visual grounding and verified executor rather than an
+   independent OCR-only observe/planner loop.
+3. Preserve OS focus, exact current target identity, task authority, Stop and
+   public/private tool boundaries. An observation or tool success cannot claim
+   an action, model invocation or verified goal progress.
+4. Report actual policy/vision availability and invoked model identities. Use
+   the configured Kev/alternative decision and Moondream adapters when required;
+   semantic fast paths may correctly avoid model calls. Do not silently load a
+   different checkpoint or allocate an unintended GPU.
+5. Cover the actual runtime registration/discovery and legacy-to-controller
+   transition. Perform live model/desktop acceptance only after the repository's
+   exact endpoint, model and accelerator preflight; distinguish offline fixtures
+   from actual GUI actions and inference.
+
+## Scope and delivery
+
+Continue the already authorized capacity, source-processing and Telegram
+delivery repairs. Keep this migration separately reviewable and committed after
+its own checks; preserve unrelated work and the operator's publication staging.
+The operator publishes and updates the active runtime.
+
+Architecture anchor:
+`/home/roko/Documents/open_weight_rapid_computer_use_architecture_2026-10-11.md`.
+
+## Reconciled runtime
+
+- TUI, its subagents and Telegram admin construct one configured native tool per
+  scope and pass the same instance to the legacy wrapper. Browser and native
+  factories share operator-controlled pinned policy/vision clients, preflight
+  gates, request quarantine and explicit capability/model receipts.
+- `vision_action_loop` now returns canonical native observations and actionable
+  handoff to `native_ui`. Its old coordinates/keyboard/allow-actions parameters
+  cannot dispatch input. The previous manual utility is unregistered and absent
+  from default discovery. Existing camera/image tools retain their own purposes.
+- Desktop discovery and every shared model-tier route select `native_ui`;
+  browser UI selects `playwright_browser`. Telegram and visual-sensor guidance
+  no longer recommends the retired OCR loop or global keyboard injection.
+- Unique semantic controls skip inference. Ambiguous candidates can use pinned
+  Kev; missing semantic targets can use pinned Moondream. Selection/grounding
+  cannot dispatch: a separate host-admitted step checks the exact task effect,
+  current window/control, Stop and observed outcome.
+- Native visual capture matches AT-SPI's active PID/bounds against actual X11
+  XID/PID/geometry before and after capture. Input rechecks that binding, moves
+  to the finite point, verifies actual pointer arrival and rechecks ownership
+  before a targeted click. Accessibility IDs are never cast to XIDs and titles
+  never establish window identity. Capture failure retains real semantic state.
+- This visual input adapter targets Linux X11. Existing native semantic adapters
+  remain available; unavailable visual backends are explicit. There is no new
+  global raw-key fallback or claimed universal visual control.
+
+## Verification
+
+The CU-only isolated recursive build and artifact audit pass. Its focused checks
+pass 261 cases: execution 164, CLI runtime/actual Telegram discovery/guidance 60,
+and shared routing/discovery 37. The model transport tests use fixtures and are
+not counted as live inference.
+
+The final isolated bundle SHA-256 is
+`359772f23c1dbc48c3cac29253ba57115b7f024650180b8268997d2729a830da`.
+Its tarball audit passes with 588 files and zero warnings. A fresh global npm
+install also passes, including the required SQLite prebuild without a native
+compiler. The isolated package was not published; the operator owns publication.
+
+Actual read-only OS validation observed 84 AT-SPI nodes and captured the active
+786x557 window with verified X11/accessibility geometry. It made zero model
+requests, input actions or service changes. Both model capabilities correctly
+reported `not_configured`. Receipt:
+`evidence/native-reconciliation-readonly-live-20261014.json`; repeatable probe:
+`scripts/live-native-reconciliation-harness.mjs`.
+
+## Current runtime preflight
+
+Read-only checks at approximately 2026-10-14T01:15Z found no configured
+`~/.omnius/computer-use-runtime.json` and no resident Kev or Moondream process.
+GPU0 is an A100 80 GB with 6 MiB allocated; GPU1 hosts the existing voice
+workloads. `docker gpu discover` reports `gpu_health.admission_blocked=true`
+because selected GPU2 is missing and reports recovery required. The scoped
+lease policy therefore does not currently permit starting fresh model workloads.
+No GPU lease, model load, inference request, reboot or service change was made.
+This limits live model acceptance; it does not prevent implementing and testing
+the shared runtime, canonical discovery and guarded execution contracts.

package/docs/work-orders/WO-escape-crash-and-gpu-incident-20261013.md

@@ -0,0 +1,79 @@
+# Escape exit and NVIDIA device incident
+
+Status: parallel read-only investigation complete. GNOME Terminal crashed in
+GTK; one A100 is unqueryable and the broker correctly blocks new CUDA work.
+The exact GTK trigger and physical GPU failure cause remain unresolved. The
+computer-use reconciliation is delivered separately; a broad application
+refactor is not established as a repair for either failure.
+
+## User report and confirmed observations
+
+- User reports pressing Escape in the `telegram_test` TUI crashed the terminal
+  and that the A100s appeared to disappear. Requested full parallel agent
+  investigation and repair.
+- Process 3144597 is no longer present. Its interruption lifecycle records
+  `stopped`, `all owners acknowledged stop`, at 2026-10-14T01:30:11.580Z.
+- `~/.omnius/crash.log` has an approximately 01:30Z modification time but its
+  last recorded exception is an older 03:13Z packaging verifier entry. File
+  modification time is not evidence of a current exception or its cause.
+- At 01:15Z, before Escape, GPU2 was already unqueryable. At 01:34Z, GPU0 and
+  GPU1 still enumerate as A100 80 GB; GPU1 retains the existing voice workloads.
+  The broker reports a missing selected GPU and recovery required, blocking new
+  CUDA admissions. No current evidence establishes Escape as its cause.
+
+## Parallel investigations
+
+1. Trace Escape, Stop, cancellation ownership, rendering and process exit.
+   Recover actual terminal/error/exit evidence; distinguish an exception,
+   signal, intentional exit, terminal failure and OS resource exhaustion.
+2. Inspect NVIDIA/PCIe/kernel events and actual current device/runner placement.
+   Establish first fault time and affected UUIDs before proposing recovery.
+3. Inspect broker/service/container state, GPU health admission and existing
+   leases. Correlate endpoint failures and workload events with the other logs.
+
+## Repair and delivery constraints
+
+Preserve active workloads and durable user tasks. No GPU reset, reboot,
+unrelated workload termination or CUDA/model load during diagnosis. Every CUDA
+deployment follows the host broker policy and exact hardware preflight.
+Implement a scoped verified application repair when the cause is established;
+do not substitute a speculative broad rewrite for a reproducible fix.
+Checkpoint current native-loop, source and delivery work, then complete and
+push each coherent repair without including unrelated publication changes.
+
+## Established findings
+
+| Finding | Evidence | Limit |
+| --- | --- | --- |
+| GNOME Terminal's server received SIGSEGV | `/var/crash/_usr_libexec_gnome-terminal-server.1000.crash`, PID 6967, GNOME Terminal 3.52.0-1ubuntu2, dated 2026-10-13 18:30:11 PDT | The faulting stack is `gtk_main_do_event` → GDK → GLib. It does not establish which input caused the GTK fault. |
+| Omnius acknowledged Stop | Interruption receipt at 2026-10-14T01:30:11.580Z, all 209 interruption owners acknowledged | Receipt is cancellation evidence, not proof that terminal rendering cannot trigger a native library bug. |
+| Actual Escape handler survives its fixture | Compiled DirectInput and the actual handler source: first Escape pauses, second aborts; zero close, exit or signal calls, and subsequent text input accepted | CPU fixture, not a reproduction in the affected GNOME Terminal. |
+| GPU2 does not answer PCI configuration reads | A100 UUID `GPU-fc9d264d-8a20-bf8c-eb72-72a6dcbdaf2a`, PCI `0000:84:00.0`; configuration reads return all FF, header 7f, invalid link state | Cached PCI/proc identity alone does not prove a functioning GPU. Physical cause is unresolved. |
+| GPU0 and GPU1 still answer individual driver queries | A100 UUIDs `GPU-3538758b-6ba7-fa1b-a80c-e315a606c3f0` and `GPU-170a99ee-850f-2182-1050-4e8d3c87b6b0`; valid PCI configuration and individual `nvidia-smi` queries | Both report recovery action Reboot. Presence and a voice HTTP health check do not prove healthy CUDA inference. |
+| GPU degradation predates Escape | Broker health recorder already degraded at 2026-10-12T20:08Z and 23:57Z; GPU2 unqueryable at 2026-10-14T01:15Z | Earlier HTTP 503s alone would not date the physical failure. |
+| Broker admission is a deliberate health fence | `/usr/local/libexec/ollama-unify-gpu-negotiator`, fresh-driver-health checks at lines 874–955; missing selected GPU or required reboot returns 503 | Bypassing admission would not repair the device. Existing voice lease remains active. |
+
+The kernel warning near 01:30:46Z names Nautilus PID 548295 closing NVIDIA
+file descriptors (`nvidia_dev_put` / `nvidia_close`). It is not a recorded
+Omnius model-loading event. No new Xid/AER, incident OOM, current Omnius
+JavaScript exception, or Omnius PID segmentation-fault entry was found in the
+examined records. This is an absence of supporting evidence, not proof that
+all possible failure records were retained.
+
+## Evidence and next repair boundary
+
+The private extracted terminal core and backtrace remain in
+`/tmp/omnius-terminal-crash-20261014/`; the core is not checked into source.
+The actual-handler receipt is `escape-handler-proof.json` in that directory.
+Sanitized GPU-only command evidence is
+`/tmp/omnius-gpu-readonly-evidence-20261014.json`, SHA-256
+`36da195241d3ef7514cafaba36aaa29fec42d0d264905933a283d5ce1a9cb48a`.
+These temporary local artifacts can expire; the durable report records only
+the findings above and their diagnostic limits.
+
+For the terminal, retain the native crash report and reproduce the GTK event
+fault before choosing a terminal package repair or a narrowly evidenced TUI
+change. For GPUs, coordinate release of the active voice workload and host
+recovery before any reset/reboot, then verify each designated device and the
+broker's health admission before model loads. No reset, reboot, service change,
+CUDA allocation, or workload termination was performed during this investigation.

package/docs/work-orders/WO-fallback-contract-cooldown-20261013.md

@@ -0,0 +1,83 @@
+# Keep internal inference failures within their contract and budget
+
+Status: contract cooldown, aggregate deadline and phase output allocations
+verified; final installed full-source public-path acceptance passed.
+
+The installed full-source Telegram harness, with a configured 32k context,
+reached a real `virtual-memory:plan` request before its first work turn. Muse
+returned HTTP 200, but its 1,000-token structured reply failed validation
+(`transport_envelope`, `json_object`). A model-wide cooldown then suppressed
+the different primary native-tool request without sending it. Intake failed
+before any page was fetched. This is a production-path failure, not a mocked
+provider response or a source-extraction failure.
+
+Observed bundle SHA256:
+`e1e3a9dfedc1a811497de0949c3d76ce3886f9cce6fd6227c903c9cf9758a716`.
+Receipt: `/tmp/omnius-web-source-installed-public-live-20261013.json`.
+
+1. Scope empty/invalid/expected-response validation cooldowns to the actual
+   requested response contract and output allowance. A failed auxiliary JSON
+   reply cannot suppress ordinary tool calling or a different response schema.
+2. Preserve global availability, authentication and provider rate-limit
+   cooldowns, including retry-after behavior. Do not change provider identity
+   or bypass quota enforcement.
+3. Verify failures remain cooled for equivalent contracts, while distinct
+   work/review contracts and corrected output allowances can proceed.
+4. Rebuild the installed candidate and repeat the real public full-source
+   task. Keep the failed receipt, and record actual auxiliary terminal metadata
+   without model text or credentials. Do not disable the failing phase merely
+   to make the fixture pass.
+5. Repair the confirmed underlying tiny-output defaults. Actual provider
+   terminal receipts report `incomplete/max_output_tokens` with no visible
+   output for both the 1,000-token VM planner and a 900-token artifact-search
+   helper. Allocate adequate internal structured output, bounded by complete
+   input, schemas, communication policy, context margin and explicit user caps.
+   Preserve every input character; never fund output by clipping the request.
+6. Fence the aggregate deadline after asynchronous preparation and route
+   callbacks. An attempt timer clipped to the whole cascade's remaining time
+   must end that cascade, including millisecond clock/timer skew; shorter
+   per-attempt timeouts must still permit fallback.
+7. Restore adequate primary-turn output before context admission. Reserve
+   4,096 tokens, honoring an explicit lower user cap. Try the existing canonical
+   owned-duplicate release before rejecting capacity; never clip protected
+   source, request or authority. Remote eligibility must enforce the same
+   host-owned reserve without sending that internal marker to providers or
+   poisoning model-wide cooldowns when a route lacks capacity.
+8. Keep completed extraction findings separate from its verbose checkpoint.
+   Reopen all findings without rerunning completed workers. If the complete
+   result still does not fit, return an explicit pending/capacity receipt.
+
+An intermediate installed diagnostic run processed all 109,910 RFC source
+characters in five valid workers, then exhausted its explicit 20-generation
+test budget while small auxiliary requests fell through providers. This proves
+whole-source processing, not accepted final delivery. A previous invalid worker
+reply was not captured, so its exact rejecting field cannot honestly be inferred
+from the later valid replies. It remains distinct from confirmed output
+exhaustion and global cooldown poisoning.
+
+The cooldown/deadline repair passes the original 94 remote-fallback tests,
+11 contract tests and eight deterministic aggregate-deadline tests. Installed
+live receipts show healthy main requests reaching Muse after auxiliary failures.
+A broader legacy keyless-routing suite has 20 failures expecting older provider
+priority; the same 20 failures reproduce with the prior committed fallback
+source (`06443c0a`). Those fixtures are not counted as passing or changed here.
+
+Subsequent live wire diagnostics distinguished a separate primary-turn limit:
+662/882-token native tool requests failed after all source workers had already
+completed. That was not the earlier 900-token artifact-query helper. Both
+allocations are repaired without shortening their inputs. Final selected
+runner/extraction/fallback/budget suites pass 264 tests with one existing
+opt-in test skipped, including explicit user ceilings, provider route reserves,
+unchanged inputs and completed-findings reopening.
+
+The [final installed public acceptance](evidence/web-source-installed-public-live-20261013.json)
+uses nine real model requests, all 109,910 RFC source characters and three
+validated extraction workers. It produces a sourced final reply and settles
+the native host goal after a scratch Telegram ACK. A separate
+[32k run](evidence/web-source-installed-capacity-guard-20261013.json) proves that
+insufficient capacity causes a typed before-transport pause with no tiny-output
+request or automatic replay. It does not pass final-answer acceptance. No live
+Telegram network delivery, local inference or fabricated provider response is
+claimed by these receipts.
+
+This repair supports the [complete-source work order](WO-web-source-full-coverage-extraction-20261013.md).