omnius 1.0.856 → 1.0.858

package/docs/work-orders/WO-automatic-capacity-recovery-and-room-history-20261013.md

@@ -0,0 +1,167 @@
+# Automatic capacity recovery and consecutive room history
+
+Status: automatic recovery and exact unread-source preservation are implemented
+and verified through live remote inference in the isolated installed package,
+for both default eager and file-backed source storage. Supersedes treating
+ordinary context pressure as an acceptable terminal result in the complete-source
+work order. Publication and active-runtime update remain with the operator.
+
+Room-history repair: implemented and verified. Consecutive completed requests
+reuse the same chronological block for the exact room/topic identity while the
+block remains at the scrollback tail and the idle gap is below 30 seconds.
+Other rooms, unrelated appended output, overlapping work and Stop break the
+sequence. Every inference retains its own callback identity, request boundary,
+output, failure history and usage; stale callbacks cannot modify a later request.
+Read mode remains available for the entire retained chronology.
+
+Verification: 67 selected TUI/registry/status-bar tests and CLI typecheck pass.
+Two unrelated broad observability assertions reproduce against the prior bridge
+and remain unchanged; they are not counted as passing.
+
+## Accepted requirements
+
+1. Preserve the complete original request, constraints, source identity and
+   evidence. Whole-source custody alone does not establish whole-source reading.
+2. Recover automatically from context pressure: release owned duplicates,
+   organize evidence hierarchically, and choose an authorized eligible model
+   with sufficient actual context before declaring an external blocker.
+3. Persist processing coverage and resumable progress. Recovery must change
+   capacity, representation, output allowance or route; never replay the same
+   failing request indefinitely. Preserve Stop, ownership, privacy and explicit
+   fallback settings.
+4. Handle large HTTP sources through durable streaming storage instead of an
+   arbitrary small successful-prefix or immediate size rejection. Retain exact
+   source bytes and verify the completed retrieval before granting source-read
+   evidence. Resource exhaustion must identify the real external limit.
+5. Keep every requested facet, contradictions, citations and unresolved details
+   through hierarchical evidence processing. Complete archived findings remain
+   recoverable; a reduced parent view cannot manufacture support or fulfillment.
+6. Validate the original constrained 32k RFC task through the installed native
+   Telegram path with real model/catalog/source responses and a complete cited
+   final answer. Distinguish simulated transport ACKs from actual Telegram sends.
+7. Consolidate consecutive TUI inference activity for the same Telegram room
+   into one chronological block. An interlaced room/activity or meaningful time
+   break starts a separate block. Preserve request identity, errors, read-mode
+   history, scrolling and room/topic separation.
+8. Present the bundled public models as built-in free inference in user-facing
+   model, route and status text. Keep actual provider identities in machine
+   audit receipts so transport failures remain diagnosable.
+9. Apply known endpoint/model schema restrictions before the first request.
+   Preserve validation against the original host contract. A transport adapter
+   must not weaken required fields, exclusivity, ownership or effect checks.
+10. Distinguish accepted task output from acknowledged Telegram delivery. Retry
+    a proven preconnection failure using the same immutable saved operation;
+    retain ambiguous sends for reconciliation without regenerating the task.
+    Public progress must reflect preparation, sending, retrying, unconfirmed
+    delivery or complete acknowledgement.
+
+## Implementation and acceptance record
+
+- Complete HTTP bodies stream to verified, indexed immutable files. The eager
+  threshold selects storage representation; it does not truncate or reject the
+  remaining response. CAS imports and extraction read bounded exact ranges.
+- Source workers automatically cover the finite source under the original full
+  request. Large retained findings use lossless encoding first, then isolated
+  hierarchical reduction with an independent preservation review and resumable
+  checkpoints. Coverage and reduced prose do not establish factual support.
+- Context negotiation binds a prepared remote route to the exact packet and
+  owner. Working local capacity remains unchanged; an explicit hard ceiling
+  remains binding. Consumed preparation tokens never reach child backends.
+- Installed validation found a second capacity disconnect: a fitting primary
+  packet could fall back successfully to a larger remote model without a prior
+  preparation receipt, leaving the following source read at 32k. The first
+  streamed run accounted for all 109,910 characters with HTTP 200 responses,
+  but exhausted its unchanged 32-generation budget reducing/reopening findings.
+  It failed acceptance. The repair must bind actual successful route capacity
+  to that response's exact returned tool calls, including ordinary fallback;
+  this receipt cannot authorize a later model dispatch or enlarge local context.
+- The installed live test must exercise actual catalog, source and model
+  responses at the original 32k working window. Its forced file-storage mode
+  tests the production streaming path on the complete RFC; separate real HTTP
+  producer tests exercise sources larger than 32 MiB. Neither implies a live
+  Telegram API send: transport acknowledgements are simulated in scratch state.
+- The latest production failure is a saved seven-item research answer followed
+  by an unacknowledged final send (`fetch failed`). Progress edits succeeded.
+  The old log omitted the transport cause, so that operation remains ambiguous;
+  the repair must not retroactively infer that it was never sent.
+- Earlier streamed-source candidate: isolated recursive build, artifact audit (586 files, zero warnings),
+  compiler-free fresh npm install and 581 focused checks pass: execution 81,
+  orchestrator 391, delivery/activity 92, room continuity 13 and retained
+  timeout/rate-limit/Stop/5xx delivery invariants 4.
+- Installed bundle SHA-256:
+  `bf6ed73b5034f8d1463eb2cd93fabd2e3d5476e151ddb9760a1ed9a0a9c977cc`.
+  The original 32k working-window test used actual catalog, RFC retrieval and
+  model replies: 11 generations, all HTTP 200, two source cores covering all
+  109,910 characters, all three cited details, fulfilled goal, consumed intake
+  and complete simulated Telegram acknowledgement. Mandatory versus advisory
+  wording was manually checked in the actual unmodified answer.
+- A separate installed hierarchy run made three real HTTP 200 requests:
+  extraction, organization and independent preservation review. It retained
+  all six findings and exact caveats/Unicode/numbers/code in 1,802 characters
+  under a 1,900-character parent budget; checkpoint reopen required no inference.
+  Its fixture budget is selected below the genuine lossless representation so
+  concise extraction cannot accidentally skip the hierarchy being tested.
+- Known schema restrictions were applied before the first wire request; no
+  400/unsupported-schema repair occurred in the successful installed runs.
+  Curated receipts are in `evidence/automatic-capacity-stream-installed-20261013.json`
+  and `evidence/source-hierarchy-installed-20261013.json`. The failed prior
+  candidate remains explicitly recorded in
+  `evidence/automatic-capacity-before-source-route-20261013.json`.
+- Delivery transport regressions exercise the actual Bridge fetch boundary and
+  durable operation ledger. No actual Telegram message/typing call, GPU model
+  request, publication or active-session restart was performed by this repair.
+- Additional default-storage live acceptance exposed an older memory-compiler
+  handoff: a complete eager view admitted under the successful remote route was
+  replaced with a memory artifact reference before model transport. Repeated
+  fetches did not fix that missing input. The repair preserves the exact
+  host-owned unread source until successful primary model exposure, then permits
+  ordinary historical archiving. Copied or serialized source markers cannot
+  grant preservation. Same-response fetch/completion is rejected without replay.
+- Live streaming acceptance exposed a second triage of a detached tool result
+  that replaced the source with a 100k output-cap preview. Its honest failed
+  result is retained in `evidence/automatic-capacity-eager-before-stream-fix-20261014.json`.
+  Current exact call/tool/arguments/body ownership now survives this streaming
+  boundary. The regression reproduces non-streaming success/streaming failure
+  before the repair and verifies both paths after it.
+- Credential scrubbing intentionally copies requests. Private source evidence
+  identity is restored only for an unchanged exact source carrier; redacted text
+  and serialized lookalikes cannot inherit it. Backend sanitation now preserves
+  original blank lines, Unicode and literal source no-think text. The updated
+  regression reproduced three failures before this repair and passes afterward.
+- Final eager acceptance: installed bundle
+  `f379b897c218a66c93da1ad22cc51a70e5d3ebef1b665863b5a63d5dd3084c04`,
+  nine real HTTP 200 inference requests, one complete source fetch and physical
+  model input containing all 109,910 exact source characters. The cited final
+  answer fulfills the goal and simulated transport acknowledges its single chunk.
+  Receipt: `evidence/automatic-capacity-eager-installed-20261014.json`.
+- Final combined source/Escape package: installed bundle
+  `82bcf42836e77699e8c660349a99325a858fd723cb857951ccae406e43b15886`,
+  eleven real HTTP 200 requests, two source cores covering all 109,910 characters,
+  complete cited answer, fulfilled goal and acknowledged simulated delivery.
+  Both final runs retain the original 32k working window, 32-generation bound and
+  300-second lifecycle. No mocked model/catalog replies or local inference.
+  Receipt: `evidence/automatic-capacity-final-stream-installed-20261014.json`.
+- Final recursive build, tarball audit (591 files, zero warnings) and compiler-free
+  fresh global npm install pass. Source/carrier/streaming regressions pass 54
+  checks; the isolated combined interruption/capacity/input suites pass 238.
+  The final Responses wire checker also inspects `function_call_output.output`;
+  a content-only checker had falsely failed an otherwise complete earlier run.
+  Runner status is a pre-delivery receipt; the fulfilled goal and complete
+  post-ACK delivery ledger establish final acceptance. No actual Telegram send
+  or typing call is claimed.
+
+## Delivery
+
+Use scoped changes and commits, preserve existing unrelated working-tree and
+publication changes, rebuild and verify the isolated installed package, fetch
+the tracked branch and push verified commits. The operator publishes and
+updates the active runtime.
+
+## Prior failure to reproduce
+
+The complete-source 32k installed test accounted for every one of 109,910
+characters, then rejected a final request requiring 27,282 input tokens,
+1,967 safety tokens and 4,096 output tokens: 33,345 total. The runner rejected
+before model transport, preventing the normal remote route selection from
+recovering. The former test recorded an honest incomplete result; the new
+acceptance requires automatic recovery and completed final delivery.

package/docs/work-orders/WO-computer-use-loop-reconciliation-20261013.md

@@ -0,0 +1,104 @@
+# Reconcile legacy desktop tools with the rapid computer-use controller
+
+Status: reconciliation implemented; isolated build, focused regressions and real
+read-only desktop observation/capture verified. Live Kev/Moondream inference
+and visual input acceptance remain limited by the missing profile and host GPU
+health described below. No claim that every application/control is supported.
+
+## Observed production disconnect
+
+The current terminal run in `telegram_test`,
+`tui-3144597-mv5p6bvu-1791939658797-1`, was asked to open Firefox and search
+archive.org. At 2026-10-14T01:04:57Z it invoked `vision_action_loop` with
+`action=observe`. The result captured the desktop using `gnome-screenshot`, ran
+Tesseract OCR, reported `Vision analysis unavailable`, and performed no input
+action. The next recorded tool was a todo update. This is not evidence that
+Kev, Moondream, or the new rapid decision/executor loop ran.
+
+## Accepted work
+
+1. Identify the canonical new controller and trace the legacy tool, registration,
+   desktop discovery, prompt guidance and configured model routing into it.
+2. Reconcile existing desktop entry points with the new controller. Ordinary
+   authorized desktop tasks must discover the intended semantic observation,
+   finite-action policy, visual grounding and verified executor rather than an
+   independent OCR-only observe/planner loop.
+3. Preserve OS focus, exact current target identity, task authority, Stop and
+   public/private tool boundaries. An observation or tool success cannot claim
+   an action, model invocation or verified goal progress.
+4. Report actual policy/vision availability and invoked model identities. Use
+   the configured Kev/alternative decision and Moondream adapters when required;
+   semantic fast paths may correctly avoid model calls. Do not silently load a
+   different checkpoint or allocate an unintended GPU.
+5. Cover the actual runtime registration/discovery and legacy-to-controller
+   transition. Perform live model/desktop acceptance only after the repository's
+   exact endpoint, model and accelerator preflight; distinguish offline fixtures
+   from actual GUI actions and inference.
+
+## Scope and delivery
+
+Continue the already authorized capacity, source-processing and Telegram
+delivery repairs. Keep this migration separately reviewable and committed after
+its own checks; preserve unrelated work and the operator's publication staging.
+The operator publishes and updates the active runtime.
+
+Architecture anchor:
+`/home/roko/Documents/open_weight_rapid_computer_use_architecture_2026-10-11.md`.
+
+## Reconciled runtime
+
+- TUI, its subagents and Telegram admin construct one configured native tool per
+  scope and pass the same instance to the legacy wrapper. Browser and native
+  factories share operator-controlled pinned policy/vision clients, preflight
+  gates, request quarantine and explicit capability/model receipts.
+- `vision_action_loop` now returns canonical native observations and actionable
+  handoff to `native_ui`. Its old coordinates/keyboard/allow-actions parameters
+  cannot dispatch input. The previous manual utility is unregistered and absent
+  from default discovery. Existing camera/image tools retain their own purposes.
+- Desktop discovery and every shared model-tier route select `native_ui`;
+  browser UI selects `playwright_browser`. Telegram and visual-sensor guidance
+  no longer recommends the retired OCR loop or global keyboard injection.
+- Unique semantic controls skip inference. Ambiguous candidates can use pinned
+  Kev; missing semantic targets can use pinned Moondream. Selection/grounding
+  cannot dispatch: a separate host-admitted step checks the exact task effect,
+  current window/control, Stop and observed outcome.
+- Native visual capture matches AT-SPI's active PID/bounds against actual X11
+  XID/PID/geometry before and after capture. Input rechecks that binding, moves
+  to the finite point, verifies actual pointer arrival and rechecks ownership
+  before a targeted click. Accessibility IDs are never cast to XIDs and titles
+  never establish window identity. Capture failure retains real semantic state.
+- This visual input adapter targets Linux X11. Existing native semantic adapters
+  remain available; unavailable visual backends are explicit. There is no new
+  global raw-key fallback or claimed universal visual control.
+
+## Verification
+
+The CU-only isolated recursive build and artifact audit pass. Its focused checks
+pass 261 cases: execution 164, CLI runtime/actual Telegram discovery/guidance 60,
+and shared routing/discovery 37. The model transport tests use fixtures and are
+not counted as live inference.
+
+The final isolated bundle SHA-256 is
+`359772f23c1dbc48c3cac29253ba57115b7f024650180b8268997d2729a830da`.
+Its tarball audit passes with 588 files and zero warnings. A fresh global npm
+install also passes, including the required SQLite prebuild without a native
+compiler. The isolated package was not published; the operator owns publication.
+
+Actual read-only OS validation observed 84 AT-SPI nodes and captured the active
+786x557 window with verified X11/accessibility geometry. It made zero model
+requests, input actions or service changes. Both model capabilities correctly
+reported `not_configured`. Receipt:
+`evidence/native-reconciliation-readonly-live-20261014.json`; repeatable probe:
+`scripts/live-native-reconciliation-harness.mjs`.
+
+## Current runtime preflight
+
+Read-only checks at approximately 2026-10-14T01:15Z found no configured
+`~/.omnius/computer-use-runtime.json` and no resident Kev or Moondream process.
+GPU0 is an A100 80 GB with 6 MiB allocated; GPU1 hosts the existing voice
+workloads. `docker gpu discover` reports `gpu_health.admission_blocked=true`
+because selected GPU2 is missing and reports recovery required. The scoped
+lease policy therefore does not currently permit starting fresh model workloads.
+No GPU lease, model load, inference request, reboot or service change was made.
+This limits live model acceptance; it does not prevent implementing and testing
+the shared runtime, canonical discovery and guarded execution contracts.

package/docs/work-orders/WO-escape-crash-and-gpu-incident-20261013.md

@@ -0,0 +1,79 @@
+# Escape exit and NVIDIA device incident
+
+Status: parallel read-only investigation complete. GNOME Terminal crashed in
+GTK; one A100 is unqueryable and the broker correctly blocks new CUDA work.
+The exact GTK trigger and physical GPU failure cause remain unresolved. The
+computer-use reconciliation is delivered separately; a broad application
+refactor is not established as a repair for either failure.
+
+## User report and confirmed observations
+
+- User reports pressing Escape in the `telegram_test` TUI crashed the terminal
+  and that the A100s appeared to disappear. Requested full parallel agent
+  investigation and repair.
+- Process 3144597 is no longer present. Its interruption lifecycle records
+  `stopped`, `all owners acknowledged stop`, at 2026-10-14T01:30:11.580Z.
+- `~/.omnius/crash.log` has an approximately 01:30Z modification time but its
+  last recorded exception is an older 03:13Z packaging verifier entry. File
+  modification time is not evidence of a current exception or its cause.
+- At 01:15Z, before Escape, GPU2 was already unqueryable. At 01:34Z, GPU0 and
+  GPU1 still enumerate as A100 80 GB; GPU1 retains the existing voice workloads.
+  The broker reports a missing selected GPU and recovery required, blocking new
+  CUDA admissions. No current evidence establishes Escape as its cause.
+
+## Parallel investigations
+
+1. Trace Escape, Stop, cancellation ownership, rendering and process exit.
+   Recover actual terminal/error/exit evidence; distinguish an exception,
+   signal, intentional exit, terminal failure and OS resource exhaustion.
+2. Inspect NVIDIA/PCIe/kernel events and actual current device/runner placement.
+   Establish first fault time and affected UUIDs before proposing recovery.
+3. Inspect broker/service/container state, GPU health admission and existing
+   leases. Correlate endpoint failures and workload events with the other logs.
+
+## Repair and delivery constraints
+
+Preserve active workloads and durable user tasks. No GPU reset, reboot,
+unrelated workload termination or CUDA/model load during diagnosis. Every CUDA
+deployment follows the host broker policy and exact hardware preflight.
+Implement a scoped verified application repair when the cause is established;
+do not substitute a speculative broad rewrite for a reproducible fix.
+Checkpoint current native-loop, source and delivery work, then complete and
+push each coherent repair without including unrelated publication changes.
+
+## Established findings
+
+| Finding | Evidence | Limit |
+| --- | --- | --- |
+| GNOME Terminal's server received SIGSEGV | `/var/crash/_usr_libexec_gnome-terminal-server.1000.crash`, PID 6967, GNOME Terminal 3.52.0-1ubuntu2, dated 2026-10-13 18:30:11 PDT | The faulting stack is `gtk_main_do_event` → GDK → GLib. It does not establish which input caused the GTK fault. |
+| Omnius acknowledged Stop | Interruption receipt at 2026-10-14T01:30:11.580Z, all 209 interruption owners acknowledged | Receipt is cancellation evidence, not proof that terminal rendering cannot trigger a native library bug. |
+| Actual Escape handler survives its fixture | Compiled DirectInput and the actual handler source: first Escape pauses, second aborts; zero close, exit or signal calls, and subsequent text input accepted | CPU fixture, not a reproduction in the affected GNOME Terminal. |
+| GPU2 does not answer PCI configuration reads | A100 UUID `GPU-fc9d264d-8a20-bf8c-eb72-72a6dcbdaf2a`, PCI `0000:84:00.0`; configuration reads return all FF, header 7f, invalid link state | Cached PCI/proc identity alone does not prove a functioning GPU. Physical cause is unresolved. |
+| GPU0 and GPU1 still answer individual driver queries | A100 UUIDs `GPU-3538758b-6ba7-fa1b-a80c-e315a606c3f0` and `GPU-170a99ee-850f-2182-1050-4e8d3c87b6b0`; valid PCI configuration and individual `nvidia-smi` queries | Both report recovery action Reboot. Presence and a voice HTTP health check do not prove healthy CUDA inference. |
+| GPU degradation predates Escape | Broker health recorder already degraded at 2026-10-12T20:08Z and 23:57Z; GPU2 unqueryable at 2026-10-14T01:15Z | Earlier HTTP 503s alone would not date the physical failure. |
+| Broker admission is a deliberate health fence | `/usr/local/libexec/ollama-unify-gpu-negotiator`, fresh-driver-health checks at lines 874–955; missing selected GPU or required reboot returns 503 | Bypassing admission would not repair the device. Existing voice lease remains active. |
+
+The kernel warning near 01:30:46Z names Nautilus PID 548295 closing NVIDIA
+file descriptors (`nvidia_dev_put` / `nvidia_close`). It is not a recorded
+Omnius model-loading event. No new Xid/AER, incident OOM, current Omnius
+JavaScript exception, or Omnius PID segmentation-fault entry was found in the
+examined records. This is an absence of supporting evidence, not proof that
+all possible failure records were retained.
+
+## Evidence and next repair boundary
+
+The private extracted terminal core and backtrace remain in
+`/tmp/omnius-terminal-crash-20261014/`; the core is not checked into source.
+The actual-handler receipt is `escape-handler-proof.json` in that directory.
+Sanitized GPU-only command evidence is
+`/tmp/omnius-gpu-readonly-evidence-20261014.json`, SHA-256
+`36da195241d3ef7514cafaba36aaa29fec42d0d264905933a283d5ce1a9cb48a`.
+These temporary local artifacts can expire; the durable report records only
+the findings above and their diagnostic limits.
+
+For the terminal, retain the native crash report and reproduce the GTK event
+fault before choosing a terminal package repair or a narrowly evidenced TUI
+change. For GPUs, coordinate release of the active voice workload and host
+recovery before any reset/reboot, then verify each designated device and the
+broker's health admission before model loads. No reset, reboot, service change,
+CUDA allocation, or workload termination was performed during this investigation.

package/docs/work-orders/WO-tui-escape-input-wait-20261014.md

@@ -0,0 +1,28 @@
+# TUI Escape: cancel inference and wait for input
+
+Status: implementation verified in the isolated combined package; ready for scoped delivery by the parent task.
+
+The operator requires Escape to pause Omnius, keep the editor usable, retain completed work and queued instructions, and wait for explicit new input. Repeated Escape must remain paused. Initial routing and background root submissions must not restart work behind the paused interface. Ctrl+C and `/stop` retain permanent stop semantics; ordinary updater and daemon safe-boundary pause remains available.
+
+## Source comparison
+
+The official [Codex CLI source](https://github.com/openai/codex/tree/1b6e0d8145e1fe5b2663d32fbe7ee02f51a10e1c) was cloned and inspected directly, without web search. Its active-turn interrupt cancels a task token, permits 100 ms of cooperative cleanup, aborts an uncooperative task, preserves interrupted history, and restores input. Relevant sources are `codex-rs/core/src/tasks/mod.rs`, `core/src/session/turn.rs`, `core/src/client_common.rs`, and `tui/src/chatwidget/input_restore.rs`. Codex also has a distinct queued-steer submission path; Omnius's requested Escape behavior deliberately retains queued instructions until the operator submits input.
+
+Omnius previously left an active model request running to its returned-contract boundary, promoted queued steering on Escape, aborted on a second Escape, and could not interrupt initial routing after its recall window. New input submitted while lifecycle acknowledgement was still `pausing` attempted an invalid immediate resume and displayed processing anyway.
+
+## Implemented behavior
+
+- `AgenticRunner.pauseForInput()` closes admission, cancels operation-scoped model signals, fences uncooperative late results and stream chunks, and retains the durable task, tool receipts and conversation. Unfinished model contracts are discarded; resumed inference uses a new logical generation.
+- `resumeAfterInput()` waits for exact active owners to acknowledge. A newer Escape supersedes a pending resume, and unresolved external effects still prevent resumption. Atomic tool work is allowed to reach its truthful boundary; cancellation does not fabricate absent effects.
+- A small terminal-owned controller cancels and fences intake routing and repair requests. Escape remains idempotent, automatic root submissions stay queued, blank Enter remains paused, and explicit input or `/resume` releases the hold after acknowledgement. Independent Telegram runners and host services are unchanged.
+- Interrupted presentation stops timers and discards unrendered partial tails without synthesizing a successful stream terminator. The displayed inference block becomes paused. Duplicate pending resume results cannot overwrite the first successful resume's processing state.
+
+## Verification
+
+The parent repeated the final suites in an isolated checkout: 238 tests passed, comprising 130 orchestrator tests and 108 CLI tests. They cover existing safe-boundary pause/stop/recovery, lifecycle and context-capacity behavior, unread-source transport, actual production Escape/queue/resume closures, real DirectInput, router repair cancellation, interrupted rendering and timer cleanup. The new transport regression uses the actual production inference adapter against an exact loopback HTTP fixture: both unary and SSE sockets close on Escape, no retry or fallback starts while held, and explicit resume generates a fresh request. Late uncooperative tool contracts and iterators cannot commit, completed reads and new input remain visible, and ambiguous external effects retain their resume fence.
+
+The full isolated recursive build, tarball audit (591 files, zero warnings), and fresh global npm install pass. The required SQLite prebuild loads without a native compiler. Combined runtime bundle SHA-256: `82bcf42836e77699e8c660349a99325a858fd723cb857951ccae406e43b15886`. The isolated package has not been published.
+
+No live model inference, CUDA workload, host-service change, Telegram send or active-session restart was used for these checks. HTTP cancellation cannot guarantee that an arbitrary upstream provider stops its physical compute; Omnius closes its transport and rejects late results. No GPU unload or server-side cancellation guarantee is claimed.
+
+The parent built and verified the isolated final package and delivers the scoped Escape commit separately from source-capacity recovery. The operator owns publication and active-runtime reload. The previous GNOME Terminal SIGSEGV is a separately evidenced host crash; this work does not claim to repair GTK or GPU hardware.

package/docs/work-orders/evidence/automatic-capacity-before-source-route-20261013.json

@@ -0,0 +1,72 @@
+{
+  "schema": "omnius.live-telegram-public-research.v1",
+  "bundleSha256": "5ec7e474ca581ce61f1773bec7a8723167d31ad74223e1711c4233968cf1b2dc",
+  "startedAt": "2026-10-14T00:56:45.290Z",
+  "finishedAt": "2026-10-14T01:01:33.584Z",
+  "bounds": {
+    "physicalGenerations": 32,
+    "contextWindowTokens": 32768,
+    "lifecycleMs": 300000,
+    "sourceUrls": [
+      "https://www.rfc-editor.org/rfc/rfc9112.txt"
+    ],
+    "sourceStorage": "file-backed host storage policy"
+  },
+  "result": {
+    "intakeLifecycle": "failed",
+    "runnerStatus": "incomplete",
+    "terminalReplyDisposition": null,
+    "admittedWebFetchReceiptCount": 1,
+    "sourceUrlsRead": [
+      "https://www.rfc-editor.org/rfc/rfc9112.txt"
+    ]
+  },
+  "physicalGenerations": 32,
+  "attemptedGenerations": 33,
+  "passed": false,
+  "state": "failed_acceptance",
+  "blocked": [
+    "Generation budget exhausted"
+  ],
+  "httpStatuses": [
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200
+  ],
+  "completeSource": {
+    "chars": 109910,
+    "sha256": "e4f426bac6206b67fdf9e0da826154f70588db2133a0a86b15cde4ff725d8937",
+    "processedChunks": 6,
+    "totalChunks": 6
+  },
+  "diagnosis": "Actual successful nonprepared remote fallback did not expose its capacity to the source-read guard. Full source coverage still ended in parent reduction/reopen loops and exhausted the unchanged generation budget. This candidate failed acceptance."
+}

package/docs/work-orders/evidence/automatic-capacity-eager-before-stream-fix-20261014.json

@@ -0,0 +1,73 @@
+{
+  "schema": "omnius.eager-source-before-stream-triage-fix.v1",
+  "finishedAt": "2026-10-14T02:10:48.000Z",
+  "bundleSha256": "6531bafa563eaa740f1db0548641d4f8f0f802c0451f934f51b6236105d4406d",
+  "passed": false,
+  "bounds": {
+    "physicalGenerations": 32,
+    "contextWindowTokens": 32768,
+    "lifecycleMs": 300000,
+    "sourceUrls": [
+      "https://www.rfc-editor.org/rfc/rfc9112.txt"
+    ],
+    "sourceStorage": "default host storage policy"
+  },
+  "sourceReads": [
+    {
+      "url": "https://www.rfc-editor.org/rfc/rfc9112.txt",
+      "success": true,
+      "verifiedRead": true,
+      "storage": "eager",
+      "outputSha256": "cd0138a2c4b5f8092de4e3d2e154a2f311711c1323b9fcf8735efc8c41e84ea2",
+      "responseChars": 109910,
+      "responseSha256": "e4f426bac6206b67fdf9e0da826154f70588db2133a0a86b15cde4ff725d8937"
+    }
+  ],
+  "fullSourceWireAdmissions": [],
+  "sourceExtractions": [],
+  "physicalGenerations": 22,
+  "httpStatuses": [
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    200,
+    429,
+    429,
+    200,
+    200
+  ],
+  "compilerRequestNumber": 8,
+  "compilerPacketSha256": "f3be0dfea5488117677f46ccf71816eb3d4a0b3b98ed323ebb3e6ca1e979944e",
+  "genericTriagePreviewHeaders": [
+    "[oversize output: 110865 bytes / 2471 lines — exceeds tool-output cap of 100000 bytes]"
+  ],
+  "cause": "Streaming result copy lost current source admission before a second generic triage pass; full source was replaced by an output-cap preview before model exposure.",
+  "coverage": {
+    "admission": "actual public native intake + attention",
+    "work": "actual Bridge/Runner + scoped web_fetch",
+    "assessment": "actual native goal assessment",
+    "transport": "simulated Telegram send/edit ACK in scratch state only",
+    "excludes": [
+      "actual Telegram delivery/typing",
+      "historical group transcripts",
+      "web_search provider availability"
+    ]
+  },
+  "modelRepliesMocked": 0,
+  "localInferenceRequests": 0,
+  "telegramMessages": 0
+}