omnius 1.0.866 → 1.0.868

package/docs/DISCOVERY.md

@@ -161,18 +161,24 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `api.v1-mcps` | /v1/mcps | List MCP servers (PT-03) |
 | `api.v1-mcps-name` | /v1/mcps/{name} | Get MCP server details (PT-03) |
 | `api.v1-mcps-name-call` | /v1/mcps/{name}/call | Invoke a tool on an MCP server (PT-03) |
-| `api.v1-media-audio` | /v1/media/audio | Generate a sound effect — body {prompt, model?, backend?, duration?, seed?} |
+| `api.v1-media-audio` | /v1/media/audio | Generate sound — body {projectRoot,prompt,request_id?,session_id?,model?,backend?,duration?,seed?} |
 | `api.v1-media-av-analyze` | /v1/media/av/analyze | Analyze a media file into a grounded entity/event/evidence answer (AV entity-comprehension) — body {path\|mediaUri, question?}; reports per-role live-vs-mock adapter status |
-| `api.v1-media-file` | /v1/media/file | Stream one generated media file — query {kind, name} |
-| `api.v1-media-gallery` | /v1/media/gallery | List previously generated media from the global store, newest first |
-| `api.v1-media-image` | /v1/media/image | Generate an image — body {prompt, model?, backend?, width?, height?, steps?, guidance?, seed?, aspect_ratio?} |
+| `api.v1-media-file` | /v1/media/file | Stream an exact artifact — query {projectRoot,kind,name} or {scope:'legacy-global',kind,name}; Validate exact project/archive identity, MIME and ETag before acquisition; Delete a selected project artifact or explicit legacy copy and matching metadata |
+| `api.v1-media-gallery` | /v1/media/gallery | Discover existing artifacts in a registered project, or the explicit legacy global archive |
+| `api.v1-media-generations-cancel` | /v1/media/generations/cancel | Request daemon-owned Stop — JSON {projectRoot,request_id\|generation_id,session_id?} |
+| `api.v1-media-generations-status` | /v1/media/generations/status | Read actual daemon-owned generation settlement for captured project and request identity |
+| `api.v1-media-image` | /v1/media/image | Generate an image in a registered project — body {projectRoot,prompt,request_id?,session_id?,model?,backend?,width?,height?,steps?,guidance?,seed?,aspect_ratio?} |
 | `api.v1-media-migrate` | /v1/media/migrate | Dedup + migrate legacy per-group media caches into the unified store — body {dryRun?, roots?, maxDepth?} |
 | `api.v1-media-models` | /v1/media/models | List available generative media models per kind (image/video/audio/music) |
-| `api.v1-media-music` | /v1/media/music | Generate music — body {prompt, model?, backend?, duration?, seed?} |
+| `api.v1-media-music` | /v1/media/music | Generate music — body {projectRoot,prompt,request_id?,session_id?,model?,backend?,duration?,seed?} |
 | `api.v1-media-relocate` | /v1/media/relocate | Relocate the whole media store (weights/venvs/gallery) to a chosen folder — body {newRoot, dryRun?}; streams media.relocate_progress and returns 202 + job_id |
 | `api.v1-media-relocate-status` | /v1/media/relocate/status | Status of the in-flight (or last) media-store relocation job |
-| `api.v1-media-store` | /v1/media/store | Media-store root + disk usage plus any legacy per-group caches still reclaimable |
-| `api.v1-media-video` | /v1/media/video | Generate a video — body {prompt, model?, backend?, num_frames?, fps?, width?, height?, steps?, guidance?, seed?} |
+| `api.v1-media-store` | /v1/media/store | Resolved media/model/gallery roots and disk information |
+| `api.v1-media-video` | /v1/media/video | Generate video — body {projectRoot,prompt,request_id?,session_id?,model?,backend?,num_frames?,fps?,width?,height?,steps?,guidance?,seed?} |
+| `api.v1-media-weights` | /v1/media/weights | Inspect an exact media model's actual cache paths, physical bytes, known dependencies, sharing and supported actions; Delete an exact cached dependency while retaining its catalog entry |
+| `api.v1-media-weights-download` | /v1/media/weights/download | Start or reattach a durable network/disk-only weight download |
+| `api.v1-media-weights-jobs-id` | /v1/media/weights/jobs/{id} | Read durable download state and restart interruption status |
+| `api.v1-media-weights-jobs-id-cancel` | /v1/media/weights/jobs/{id}/cancel | Cancel a local daemon-owned weight download |
 | `api.v1-memory` | /v1/memory | Memory backends summary (PT-04) |
 | `api.v1-memory-entities` | /v1/memory/entities | List extracted memory entities |
 | `api.v1-memory-episodes` | /v1/memory/episodes | List episodes |
@@ -424,6 +430,13 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.context-management-medium-models-proposal` | Context Management for Medium Models (30-40B) — Implementation Proposal | Date: 2026-04-25 Problem: Medium-tier models (~35B params) exhibit excessive repetition at ~35% context fill despite 256K context windows Root Cause: Monolithic context structure + attention degradation + tool schema bloat |
 | `guide.corpus-ocr` | Explicit scanned-PDF corpus OCR | The public sourcecorpus tool can process an acquired PDF population with begin using filters: {channel: "ocrtext"} and optional ocrlanguage (default eng). Repeated process calls resume a durable per-source page cursor. Installed CPU Poppler and Tesseract are required. The default channel remains nativetext; completing native extraction of an empty scanned pa |
 | `guide.dedup-false-positive-meta-analysis` | Meta-Analysis: False Positive Duplicate Tool Call Detection | Date: 2026-05-14 Scope: packages/orchestrator/src/agenticRunner.ts — proactivePrune() + buildResourceKey() |
+| `guide.design-dashboard-reconstruction-plan` | Dashboard reconstruction plan | 2026-10-16 · source implementation only; publishing remains with the user. |
+| `guide.design-dashboard-styleguide` | Omnius browser instrument design system | Version 1 · 2026-10-16 · implementation contract |
+| `guide.design-dashboard-todo-uppercase` | Dashboard reconstruction — durable TODO | Updated: 2026-10-16. Contract: styleguide. Scope and sequence: plan. |
+| `guide.design-media-unification-design` | Unified media: project artifacts, shared models, deliberate presentation | Status: implementation contract, 2026-10-16. Follows the delivered dashboard reconstruction (6cfaebbd). Track verification in media-unification-TODO.md. |
+| `guide.design-media-unification-todo-uppercase` | Next phase: media storage and generation interface unification | Requested 2026-10-16. Active after dashboard reconstruction delivery 6cfaebbd. Contract: media unification design. The preceding dashboard receipt does not count as verification of this phase. |
+| `guide.design-update-operation-cancellation` | Owned update cancellation and restart | The native update dialog stays present while an operation is running. Escape, Ctrl+C and outside clicks do not dismiss it. Its top-right Cancel control sends an explicit request; it shows cancellation pending until the owned work settles. An error remains in the same dialog with a Close action. Ordinary menu dismissal and native frame animation remain unchan |
+| `guide.design-update-session-restoration-todo-uppercase` | Queued next: update lifecycle and exact session restoration | Requested 2026-10-16. Implement after the active media-unification phase; keep this requirement durable without diverting the current work. |
 | `guide.discovery-agent-map` | Agent Map | Bundled Omnius documentation artifact: docs/discovery/agent-map.json. |
 | `guide.discovery-catalog-overrides` | Discovery Catalog Curated Source | Curated aliases, relationships, invocation modes, and conceptual entries merged into the generated catalog. |
 | `guide.discovery-json` | Omnius Machine Discovery Catalog | Generated JSON catalog consumed by the CLI, REST discovery API, JavaScript API, and offline agents. |
@@ -538,6 +551,8 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-browser-controls-package-verification-20261016` | Browser Controls Package Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/browser-controls-package-verification-20261016.json. |
 | `guide.work-orders-evidence-builtin-provider-authorized-access-audit-20261014` | Builtin Provider Authorized Access Audit 20261014 | Bundled Omnius documentation artifact: docs/work-orders/evidence/builtin-provider-authorized-access-audit-20261014.json. |
 | `guide.work-orders-evidence-computer-use-runtime-readiness-20261014` | Computer Use Runtime Readiness 20261014 | Bundled Omnius documentation artifact: docs/work-orders/evidence/computer-use-runtime-readiness-20261014.json. |
+| `guide.work-orders-evidence-dashboard-browser-reconstruction-20261016` | Dashboard Browser Reconstruction 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/dashboard-browser-reconstruction-20261016.json. |
+| `guide.work-orders-evidence-dashboard-media-management-20261016` | Dashboard Media Management 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/dashboard-media-management-20261016.json. |
 | `guide.work-orders-evidence-desktop-indicator-registration-20261016` | Desktop Indicator Registration 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/desktop-indicator-registration-20261016.json. |
 | `guide.work-orders-evidence-fallback-contract-cooldown-before-20261013` | Fallback Contract Cooldown Before 20261013 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-contract-cooldown-before-20261013.json. |
 | `guide.work-orders-evidence-fallback-model-benchmarks-20261012` | Fallback Model Benchmarks 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-model-benchmarks-20261012.json. |
@@ -557,6 +572,18 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-instrument-divider-collapsed-160x48` | Instrument Divider Collapsed 160x48 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-divider-collapsed-160x48.png. |
 | `guide.work-orders-evidence-instrument-divider-resized-160x48` | Instrument Divider Resized 160x48 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-divider-resized-160x48.png. |
 | `guide.work-orders-evidence-instrument-help-scroll-120x36` | Instrument Help Scroll 120x36 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-help-scroll-120x36.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-audio-playing` | Media Audio Playing | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-audio-playing.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-100x30` | Media Image 100x30 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-100x30.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-120x36` | Media Image 120x36 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-120x36.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-160x48` | Media Image 160x48 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-160x48.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-60x20` | Media Image 60x20 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-60x20.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-80x24` | Media Image 80x24 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-80x24.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-progress-collapsed` | Media Progress Collapsed | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-progress-collapsed.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-video-frame-a` | Media Video Frame A | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-video-frame-a.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-video-frame-b` | Media Video Frame B | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-video-frame-b.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-voice-autocomplete-junction` | Media Voice Autocomplete Junction | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-voice-autocomplete-junction.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-report` | Report | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/report.json. |
+| `guide.work-orders-evidence-instrument-media-verification-20261016` | Instrument Media Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-verification-20261016.json. |
 | `guide.work-orders-evidence-instrument-package-artifact-20261016` | Instrument Package Artifact 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-package-artifact-20261016.json. |
 | `guide.work-orders-evidence-instrument-package-install-20261016` | Instrument Package Install 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-package-install-20261016.json. |
 | `guide.work-orders-evidence-instrument-package-install-20261016-updated` | Instrument Package Install 20261016 Updated | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-package-install-20261016-updated.json. |
@@ -592,6 +619,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-local-recovery-production-routes-20261014` | Local Recovery Production Routes 20261014 | Bundled Omnius documentation artifact: docs/work-orders/evidence/local-recovery-production-routes-20261014.json. |
 | `guide.work-orders-evidence-native-conversation-prompt-audit-20261012` | Native Conversation Prompt Audit 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-conversation-prompt-audit-20261012.json. |
 | `guide.work-orders-evidence-native-goal-contract-probe-20261012` | Native Goal Contract Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-goal-contract-probe-20261012.json. |
+| `guide.work-orders-evidence-native-interface-state-verification-20261016` | Native Interface State Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-interface-state-verification-20261016.json. |
 | `guide.work-orders-evidence-native-reconciliation-readonly-live-20261014` | Native Reconciliation Readonly Live 20261014 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-reconciliation-readonly-live-20261014.json. |
 | `guide.work-orders-evidence-native-session-lifecycle-verification-20261016` | Native Session Lifecycle Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-session-lifecycle-verification-20261016.json. |
 | `guide.work-orders-evidence-native-session-regression-verification-20261016` | Native Session Regression Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-session-regression-verification-20261016.json. |
@@ -599,6 +627,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-native-sessions-installed-pty-20261016` | Native Sessions Installed Pty 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-sessions-installed-pty-20261016.json. |
 | `guide.work-orders-evidence-native-sessions-production-pty-20261016` | Native Sessions Production Pty 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-sessions-production-pty-20261016.json. |
 | `guide.work-orders-evidence-native-sessions-production-vte-20261016` | Native Sessions Production Vte 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-sessions-production-vte-20261016.json. |
+| `guide.work-orders-evidence-native-straight-boundaries-verification-20261016` | Native Straight Boundaries Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-straight-boundaries-verification-20261016.json. |
 | `guide.work-orders-evidence-native-tui-committed-scope-20261015` | Native Tui Committed Scope 20261015 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-tui-committed-scope-20261015.json. |
 | `guide.work-orders-evidence-native-tui-gpu-preflight-20261015` | Native Tui Gpu Preflight 20261015 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-tui-gpu-preflight-20261015.json. |
 | `guide.work-orders-evidence-native-tui-history-benchmark-20261015` | Native Tui History Benchmark 20261015 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-tui-history-benchmark-20261015.json. |
@@ -620,6 +649,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-opencode-step-rate-limited-diagnostic-20261012` | Opencode Step Rate Limited Diagnostic 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/opencode-step-rate-limited-diagnostic-20261012.json. |
 | `guide.work-orders-evidence-ovh-production-compatibility-20261012` | Ovh Production Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/ovh-production-compatibility-20261012.json. |
 | `guide.work-orders-evidence-ovh-structured-context-compatibility-20261012` | Ovh Structured Context Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/ovh-structured-context-compatibility-20261012.json. |
+| `guide.work-orders-evidence-project-media-unification-20261016` | Project Media Unification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/project-media-unification-20261016.json. |
 | `guide.work-orders-evidence-public-review-after-20261012` | Public Review After 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-review-after-20261012.json. |
 | `guide.work-orders-evidence-public-review-before-20261012` | Public Review Before 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-review-before-20261012.json. |
 | `guide.work-orders-evidence-session-tabs-installation-20261016` | Session Tabs Installation 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/session-tabs-installation-20261016.json. |

package/docs/design/dashboard-TODO.md

@@ -0,0 +1,86 @@
+# Dashboard reconstruction — durable TODO
+
+Updated: 2026-10-16. Contract: [styleguide](dashboard-styleguide.md). Scope and sequence: [plan](dashboard-reconstruction-plan.md).
+
+Use `[x]` only after implementation and relevant verification. Record evidence below; retain incomplete items across handoffs.
+
+## Design and discovery
+- [x] Inventory all nine routes, shared/static/dynamic modules and existing browser tests.
+- [x] Trace weight caches, download/load differences, output ownership and missing deletion APIs.
+- [x] Write grayscale hierarchy, broad negative-space composition and reusable component contract.
+- [x] Specify Departure Mono, local bundling and license.
+- [x] Specify nested model-module explorer in a modal instead of raw model dropdown.
+- [x] Write page-by-page implementation and validation plan before production edits.
+
+## Shared system and pages
+- [x] Bundle Departure Mono and license; verify actual browser font loading.
+- [x] Replace pure black/white tokens with readable muted grayscale surface hierarchy.
+- [x] Reconstruct shared shell, headings, sections, fields, actions, lists and dialogs.
+- [x] Chat and nested workspace/session/voice controls.
+- [x] Agent and nested run/approval/detail controls.
+- [x] Voice and nested ASR/TTS/clone/model controls.
+- [x] Generate composer, all generation/analysis modes and optional parameter groups.
+- [x] Projects and nested management.
+- [x] Dashboard and nested telemetry/jobs.
+- [x] Activity and nested event detail.
+- [x] Discover and nested capability exploration.
+- [x] Settings and nested configuration forms.
+
+## Model modules and saved media
+- [x] Accurate model/dependency/cache inventory and explicit unsupported-provider states.
+- [x] Durable download-only jobs, deduplication, status and restart recovery.
+- [x] Scoped guarded weight deletion, shared dependency and busy-operation handling.
+- [x] Guard generation/download/store mutation interactions.
+- [x] Reusable model browser dialog, search, module detail/back and selected-model trigger.
+- [x] Download/status/delete actions plus exact storage paths and first-use explanation.
+- [x] Safe saved-gallery DELETE with explicit artifact/metadata scope.
+- [x] Result/library/detail Delete action with confirmation and failure recovery.
+- [x] Preserve authenticated preview/download receipts and blob cleanup.
+
+## Verification and delivery
+- [x] Backend isolated mutation/lifecycle/security tests.
+- [x] Media runtime/modal/mode identity tests.
+- [x] Mandatory chat transport/runtime/script gate.
+- [x] Route/style/contrast checks.
+- [x] Real Chromium: nine routes, mobile/tablet/desktop, light/dark.
+- [x] Real Chromium: nested model/weights/output deletion, media/analysis/voice flows.
+- [x] Sidebar pointer/keyboard, mobile navigation and Send regression harness.
+- [x] Screenshot review; fix negative space, nested hierarchy, overflow and font issues.
+- [x] Scoped verified commits fetched/pushed to current tracked branch.
+- [x] Record precise evidence and remaining limitations; publishing left to user.
+
+## Evidence / handoff log
+
+- Discovery: three read-only delegated searches, no user-data or runtime mutations. Existing prepare/pull tools may allocate CUDA; dedicated download-only implementation required.
+- Baseline source: `cd22526b` on `main` / `origin/main`. Existing unrelated work and concurrent `publish/` changes are outside this task.
+- Initial design documents written before production changes. User's later dot-grid reference and nested model explorer / Departure Mono instructions incorporated.
+
+### Implementation in progress
+
+- Model explorer controller implemented with nested catalog/detail views, per-kind selection, explicit cache paths/dependencies, asynchronous download status and scoped deletion confirmation. Shared markup/style integration is underway.
+- Generated-media deletion controller captures exact item identity, requires a matching daemon deletion receipt, retains media on failure, and revokes previews after success.
+- Gallery pagination now retains existing acquired previews instead of downloading every visible image again. Store inspection is deferred to the model dialog.
+- Verification so far: 21 media runtime tests pass; mandatory chat transport/runtime/script gate passes (34 tests). Full backend and Chromium integration remain pending; no live deployment claim.
+
+### Shared interface verification
+
+- All nine page compositions and dynamic Voice/settings controls reconstructed; dialogs and media/voice model selection share module primitives. Local unmodified Departure Mono WOFF2 (22,496 bytes) loads in Chromium; license is embedded and shipped under CLI assets.
+- Media runtime now 23 passing tests, including cancel, voice draft preservation and acquired-preview reuse. The seven-suite frontend gate passed 74 tests before adding two extra runtime cases; the route registry also passed its two tests.
+- Browser iteration passed 162 fixture checks including four nested voice engines; screenshot review then found and corrected detail centering, irrelevant Chat controls on media pages, and inverse-action hover contrast. Final rerun pending those fixes.
+- Navigation/Send browser harness passed all18 checks against source, including short viewport,1106sessions, pointer/keyboard resize/collapse/reopen and light/dark contrast.
+
+### Final source verification
+
+- All planned browser pages, nested model modules, weight inventory/download/cancel/delete and saved-media deletion are implemented. Earlier progress entries above are historical.
+- Frontend: 85 passing tests across nine suites, including all three mandatory chat transport/runtime/script suites. Backend/execution: 134 passing tests across twelve suites, overlapping those same 34 transport tests. Combined unique total: **185 tests across eighteen suites**.
+- Final isolated Chromium: **168 checks** (nine routes, 1440/768/360 widths, dark/light, generated media playback/download, nested Voice/model modules, shared-weight confirmation, cancellation, gallery deletion and analysis). Sidebar/Send: **18 checks**, including 1,106 fixture sessions. Both use identical production HTML SHA256 `20bd243e434d83bf99d758584796ff1102b58b48868910bbd9dd07db45ae617b`.
+- Zero browser page errors, console errors or external requests. Departure Mono and pinned syntax highlighting are bundled locally; provider marks make no favicon requests. Reviewed final desktop Generate and mobile model-dialog screenshots, in addition to the previous page/theme reviews.
+- CLI and execution typechecks pass; scoped whitespace checks pass. Existing managed-stop test fixtures emit SIGINT/SIGTERM listener-count warnings; their assertions pass.
+- Durable receipts: `docs/work-orders/evidence/dashboard-media-management-20261016.json` and `docs/work-orders/evidence/dashboard-browser-reconstruction-20261016.json`. Reproducible browser scripts build isolated source bundles, without touching shared dist/publish output.
+- No live inference, real model downloads/deletions, installed-package changes, daemon restart, or npm publishing. The running 11435 daemon has **not** been updated by this source delivery. Publishing remains with the user.
+- Participating media operations serialize per shared store because generation can download or evict weights. External programs and older running versions do not participate. Download-only jobs fetch full pinned repository snapshots; provider-specific TTS/ASR remains separate. Saved-media deletion currently removes the gallery copy and sidecar only, retaining source/work copies.
+- **Next phase, explicitly deferred by the user until this delivery:** [media unification TODO](media-unification-TODO.md). It covers shared weights with project-scoped artifacts across browser/TUI sessions, compact generation progress, responsive previews, and audio/video playback. This delivery does not claim that storage/interface unification is complete.
+
+### Git delivery
+
+- Fetched `origin/main` and pushed verified implementation commits `48eef78f` (media management) and `be16ac1b` (dashboard reconstruction) to `origin/main`. Initial design contract was pushed first as `1cc8b037`. Unrelated working-tree and publishing changes were preserved.

package/docs/design/dashboard-reconstruction-plan.md

@@ -0,0 +1,58 @@
+# Dashboard reconstruction plan
+
+2026-10-16 · source implementation only; publishing remains with the user.
+
+Contract: [styleguide](dashboard-styleguide.md). Execution ledger: [TODO](dashboard-TODO.md).
+
+## Discovery and constraints
+
+The daemon renders one HTML application in `packages/cli/src/api/web-ui.ts`, one stylesheet in `web-instrument-style.ts`, and a separate media controller in `web-media-runtime.ts`. Nine canonical routes share shell, dialogs and operational components. Rebuild these shared components and each route's composition rather than layering a second stylesheet over the old UI.
+
+Existing media APIs provide generation, catalog, store inspection/relocation, gallery and authenticated files. They do not provide browser weight management or saved-media deletion. Tool prepare/pull operations often load CUDA and therefore cannot serve a Download weights action. Shared caches and generated gallery copies have different ownership. The plan includes real backend operations and isolated lifecycle tests.
+
+Preserve unrelated work, publish artifacts, package versions, running daemon and user data. No real model downloads, GPU loads, inference or user-media deletions are needed to implement or validate this change. Keep service-specific voice management truthful.
+
+## Sequence and ownership
+
+1. Establish and commit design contract, this plan and durable checklist before implementation.
+2. Reconstruct shared tokens, typography, shell, headings, section/field/module/dialog primitives. Bundle Departure Mono with license. Restyle static and dynamic page compositions together.
+3. Add guarded media management service and routes: weight inventory, network-only download jobs/status, guarded deletion, exact saved-gallery deletion. Persist download state and interrupted recovery. Use injectable adapters and temporary fixtures for tests.
+4. Reconstruct the generative composer: selected-model trigger; reusable model-module modal with nested detail, download/status/delete actions; clear storage and automatic-download information; optional generation parameters; separate analysis workspace; result/library deletion controls.
+5. Apply the design to all nine routes and nested Voice/settings components. Preserve IDs/controllers where needed to keep transport and workflow behavior intact. Remove obsolete inline presentational overrides in changed surfaces.
+6. Run scoped backend/runtime/style/route suites and mandatory transport tests. Extend real Chromium fixture coverage for models, deletion, all media modes, nested forms, navigation, themes, responsiveness and keyboard behavior. Inspect screenshots and correct composition issues.
+7. Commit verified coherent changes, fetch/push `origin/main`, and update the ledger with test receipts and any honest limitations. User publishes; do not replace or restart their installed daemon.
+
+Work areas can proceed in parallel after the design contract: shared UI/style; backend media management; independent browser verification; media composer controller/integration. Avoid concurrent edits to the same file through explicit ownership.
+
+## Page-by-page reconstruction
+
+| Page | Primary composition | Auxiliary / nested work |
+| --- | --- | --- |
+| Chat | Open transcript reading area; deliberate composer and styled Send; clear session context | Workspace inspector, resizable navigation, recents, model dialog, mini voice controls, action/confirmation dialogs; preserve streaming/Stop. |
+| Agent | Run objective and primary action above open run state; related facts grouped | Plan, approvals, tool results and evidence grouped under their parent run; restrained logs and telemetry. |
+| Voice | Live session, transcription and synthesis as distinct operational sections | Labeled ASR upload/context, engine/model setup, clone/model forms, preview/error states; actual per-service storage semantics. |
+| Generate | Mode navigation, selected model module, prompt, expandable parameters, local progress and output | Model explorer/detail; weights/store management; audio/video/live analysis; gallery filters/detail/download/delete; shared state across modes without stale operation crossover. |
+| Projects | Searchable project rows with useful path/context and local actions | Project detail, session association and bounded path display; avoid box-per-field nesting. |
+| Dashboard | Readable run/system sections, substantial space between distinct groups | Compact metric rows, activity/jobs and resource detail, meaningful empty states; no fake telemetry. |
+| Activity | Chronological operational list with grouped filters | Event detail/evidence/error surfaces and bounded log views. |
+| Discover | Search/exploration first, results as inspectable modules | Nested capability details and actual links/actions; avoid dense decorative card walls. |
+| Settings | Grouped preference sections with a clear primary control per task | Connection/auth, theme, voice/clones and nested fields; no placeholder-only labels, gray hierarchy across dialog/auxiliary levels. |
+
+## Backend operation contracts
+
+Keep existing `/v1/media/models` compatible. Introduce a separate management API for expensive cache inventory and operations. Model identity is `{kind, modelId}` resolved from the catalog; clients never supply an arbitrary deletion path or executable downloader. Return dependency records with repository, actual paths, measured bytes, cache state, sharing and explicit supported actions. Do not equate `_meta.json` with a completed installation.
+
+Download is asynchronous and disk/network-only, with job ID and durable status; queued/running/ready/failed/interrupted states and known/unknown totals. Deduplicate concurrent requests. Use the same unified cache/env resolution as generation. Block destructive operations while generation, download or relocation can use that cache. Validate kind, model and repository membership; enforce run/admin scope locally. Known external providers/custom paths get an explicit unavailable action with reason.
+
+Saved-media deletion validates a strict media kind and exact basename beneath its canonical gallery directory, rejects symlinks/traversal, and removes only the selected owned artifact and matching metadata. It must not follow arbitrary source paths from sidecars. Return the deletion scope honestly, including retained working copies where relevant. Do not remove catalog entries when deleting weights.
+
+Coordinate migration/relocation and generation with the management guard; reject unsafe concurrent mutations. Tests prove busy states and shared dependencies, not merely successful deletion.
+
+## Validation and delivery
+
+- Route/service tests: isolated `OMNIUS_HOME`, `OMNIUS_MEDIA_HOME` and catalog, dummy files, injected downloader. Auth scopes, traversal/symlinks, dependency membership, duplicate/active jobs, restart recovery, deletion bytes, retained catalog, gallery scope and failure behavior.
+- Runtime tests: immutable selected/output identity across refresh and mode changes, confirm cancellation sends no mutation, pending dedup, errors retain items, job progress truthfulness, blob cleanup, modal focus/back/keyboard behavior.
+- Mandatory daemon frontend tests: `web-chat-transport-lifecycle.test.ts`, `web-ui-client-runtime.test.ts`, `web-ui-script.test.ts`. Also media runtime/routes, route/basepath, observability/style suites.
+- Chromium: production HTML against an isolated authenticated prefixed API fixture. Nine routes × three widths × two themes; all four generation modes; three analysis modes; models/download/delete and output delete; Voice/nested settings; actual preview decode/audio playback/download bytes; pointer sidebar and Send; dialog keyboard/outside dismiss; no page errors or horizontal overflow. Disable browser GPU and block all nonfixture network traffic.
+- Visual review: screenshots of primary and nested surfaces at desktop/mobile; inspect negative space, implied boundaries, font loading and grayscale hierarchy. Check text contrast numerically.
+- Build source in isolated temporary output for browser verification, leaving concurrent publish output untouched. Report source/fixture verification separately from the user's running deployment.

package/docs/design/dashboard-styleguide.md

@@ -0,0 +1,86 @@
+# Omnius browser instrument design system
+
+Version 1 · 2026-10-16 · implementation contract
+
+Companion documents: [reconstruction plan](dashboard-reconstruction-plan.md) and [durable implementation checklist](dashboard-TODO.md).
+
+## Intent and references
+
+Reconstruct the existing daemon dashboard around deliberate negative space, implied boundaries, muted monochrome readings and explorable operational modules. The user's flight-instrument and sparse dot-grid references establish composition, not decorative text or fictional telemetry. References supplied locally: `c86dda8010aea451db238b027854c6a6.jpg`, `82182e9d241909503a2daa9ef735de8d.jpg`, and `/home/roko/Desktop/OPENTUI_INSTRUMENT_STYLEGUIDE.md`. This browser contract adapts their geometry to accessible HTML; native OpenTUI remains a separate renderer.
+
+Broad open space belongs between groups. Related readings remain compact. Do not fill blank areas with ornamental grids, empty cards, duplicated descriptions, status badges, invented counters or redundant headings. Every visible module must support an actual task. Most sections have no enclosing box. Thin rules and alignment imply boundaries; complete borders belong primarily to controls, selected modules and dialogs. No diagonals, rounded corners, gradients, glows or shadows.
+
+## Grayscale hierarchy
+
+Surface levels express ownership, rather than arbitrary alternating strips. Use one stylesheet and semantic tokens, including all dynamically rendered content.
+
+| Token / purpose | Dark | Light |
+| --- | --- | --- |
+| Canvas | `#141414` | `#f1f1f1` |
+| Navigation / persistent left panel | `#101010` | `#e7e7e7` |
+| Main working surface | `#171717` | `#f5f5f5` |
+| Auxiliary settings / subordinate region | `#1c1c1c` | `#eeeeee` |
+| Hover / selected module | `#292929` | `#dddddd` |
+| Modal / elevated inspection | `#242424` | `#fafafa` |
+| Primary text | `#d6d6d6` | `#353535` |
+| Secondary text | `#b0b0b0` | `#595959` |
+| Muted readable text | `#999999` | `#606060` |
+| Decorative hairline | `#414141` | `#c5c5c5` |
+| Control boundary / focus | `#898989` | `#777777` |
+| Selected action fill / text | `#cccccc` / `#171717` | `#454545` / `#fafafa` |
+
+Normal text must retain at least 4.5:1 contrast on its actual surface. Focus and essential control outlines need 3:1 contrast. Decorative lines may be subtler. Never use low-contrast decorative gray for required labels. State is conveyed in words plus geometry, not color alone. Light, dark and system modes share the same hierarchy. Media itself keeps its original colors.
+
+## Typography and spacing
+
+Use locally bundled **Departure Mono**, from the user's `DepartureMono-1.500` distribution, with its SIL Open Font License. Prefer its WOFF2 web artifact; no external font request. `font-display: swap`; native monospace fallback. Avoid synthetic heavy weights. The supplied font recommends multiples of 11px for pixel-perfect rendering; use 22px titles and prioritize readable 14px body text over shrinking controls to 11px. Base text 14px with approximately 1.6 line height; compact labels 11–12px with modest tracking; page titles 20–22px. Preserve mixed-case prose, filenames, paths and prompts. Uppercase is reserved for short navigation/section labels. Tabular numbers align readings. Do not shrink text to fit a crowded layout.
+
+Spacing scale: 4, 8, 12, 16, 24, 32, 48, 64px. Related field label/control gap 8px; field group gap 16–24px; section gap 32–48px; desktop page gutters 32–48px. Narrow screens use 16px gutters and 24–32px group gaps. Reading width approximately 72ch; workbench preview may use the remaining width. Surplus width creates breathing room, not oversize inputs or a wall of boxed cells.
+
+## Shared component grammar
+
+| Component | Contract |
+| --- | --- |
+| Shell | Quiet navigation surface; resizable/reopenable left boundary; main canvas; compact mobile drawer with real close control. |
+| Route heading | Small identity label, concise title, one useful sentence at most. Leave open space before the working area. Actions aligned beside heading on wide screens and below on narrow screens. |
+| Section | Unboxed semantic section with heading and optional action; dotted or solid rule only when separating distinct responsibilities. |
+| Auxiliary region | Subordinate grayscale surface and padding; avoid repeated border-in-border cards. |
+| Field | Visible label, control, concise help/error. No placeholder-only labels. Seed/steps/duration group under expandable parameters when secondary. |
+| Button | Sharp small rectangle; primary action muted inverse; secondary quiet outline; text action for navigation; clear focus. Minimum 36px desktop / 44px coarse-pointer or narrow viewport targets. |
+| Module browser | A dialog containing selectable model modules and a nested detail view, not a raw model select. Search/filter, meaningful state, exact ownership and back navigation. |
+| Selected model | One compact composer trigger with name and state; opens reusable module browser. No duplicate model dropdown. |
+| Detail list | Label/value pairs with natural wrap; optional dotted leaders on wide screens. Paths wrap and remain selectable. Unknown differs from zero. |
+| Status | Local to the affected operation. Idle, queued, downloading, ready, failed and interrupted have literal text. Real byte progress only; indeterminate progress when total is unknown. |
+| Media result | Actual validated preview, concise metadata, Download and Delete saved media actions. No giant empty preview placeholder. |
+| Library | Bounded pages and lazy previews; filters grouped separately from results; responsive tiles with readable caption/actions; stable item identity. |
+| Modal | Distinct gray surface, dim backdrop, restrained corner/rule framing, bounded viewport scroll. Escape/outside close, focus trap and restoration; destructive confirmation names item and deletion scope. |
+| Empty / error | One explanation and an applicable next action. Do not pretend failed requests are empty successful collections. |
+| Tables / telemetry | Compact rows within spacious sections; right-aligned numbers with units; scroll only inside an explicitly bounded data region when unavoidable. |
+
+## Generative composer and nested model exploration
+
+Image, video, sound and music share one composer anatomy: task mode → selected model module → prompt → optional parameters → operation status → output. Audio/video/live analysis retain separate inputs appropriate to analysis; do not expose generation parameters there.
+
+Model exploration opens a modal from the composer. It contains searchable modules for the current media kind. Opening a module reveals capabilities, backend, known dependencies, installation state, cache locations, measured bytes and supported actions. Selecting it returns to the composer without starting inference or a download. Returning to the module list preserves the current media kind. Automatic model selection is a deliberate module with an explanation of its first-run behavior.
+
+Weights and generated outputs are separate resources:
+
+- **Download weights:** an explicit network/disk-only job. It must not reuse prepare/prewarm operations that load CUDA. Show pending/running/complete/failed/interrupted state; do not label partial cache presence as installed. Make unsupported/custom provider management explicit.
+- **Delete cached weights:** confirmation identifies repository and measured cache location. Shared dependencies are identified. Busy generation/download/relocation blocks deletion. Catalog entries remain available for later downloads. Never present removal of a catalog adapter as deletion of its weights.
+- **Automatic downloads:** state before generation that first use can fetch weights and runtime dependencies. Show the resolved model store root, not a hardcoded home path. Explain existing disk-management behavior accurately.
+- **Delete saved media:** confirmation names the saved gallery item and metadata. Deleting a gallery copy must not claim to delete unrelated source/work files or model weights. Download and delete operate on authenticated, validated immutable item identity.
+- **Store management:** an auxiliary inspection area in the model browser shows current root, gallery root and explicit relocation/migration controls. It should not dominate the prompt workspace.
+
+Voice shares the field/module/inspection grammar while preserving its actual ASR, live microphone, clone and TTS service contracts. Do not imply that every voice engine uses the same storage or download API.
+
+## Interaction, responsiveness and performance
+
+All actions keyboard accessible. Modal focus remains contained; close restores invoking control. Tabs implement tab semantics and arrow/home/end behavior, or use ordinary buttons without misleading ARIA. Native disclosures keep advanced settings accessible. No hover-only actions. Errors are announced through local live regions. Reduced motion disables transitions; ordinary transitions should be subtle and short.
+
+Test 360, 768 and 1440px widths, both themes, short windows and zoom. Main document must not overflow horizontally. Long paths and Unicode names wrap. Forms stack in source order. Mobile navigation remains reopenable and controls do not cover composer or dialog actions. Dialogs scroll within available height.
+
+No new UI framework, GPU visualization dependency, remote fonts or per-item polling. Bound gallery preview concurrency and pagination. Poll only visible active jobs, stop on terminal state/close, and preserve meaningful failure states. Reuse authenticated media receipts and blob lifecycle. Preserve all same-origin base-path, streaming, session, authentication and daemon Stop behavior.
+
+## Acceptance
+
+Every route and nested module uses these primitives, including error/empty/loading states and dynamic Voice/settings forms. Screenshots come from the actual production HTML in an isolated Chromium fixture; no generated mockups. Verify actual pointer/keyboard behavior, measured contrast and overflow, not only class names. Keep implementation and evidence status in `dashboard-TODO.md`.

package/docs/design/media-unification-TODO.md

@@ -0,0 +1,78 @@
+# Next phase: media storage and generation interface unification
+
+Requested 2026-10-16. Active after dashboard reconstruction delivery `6cfaebbd`.
+Contract: [media unification design](media-unification-design.md). The preceding
+dashboard receipt does not count as verification of this phase.
+
+## Storage contract
+
+- [x] Trace browser, TUI, tool and session generation/output paths for image,
+  video, audio and music before choosing a migration strategy.
+- [ ] Share model weights across Omnius sessions and project locations through
+  one configured model store; expose its actual path consistently.
+- [ ] Scope generated outputs to the directory/project where generation was
+  invoked. Browser and TUI sessions in that same location must discover the same
+  artifacts, without copying them into divergent galleries.
+- [ ] Carry explicit project identity through browser generation, jobs, gallery,
+  preview, download and deletion. Preserve authenticated validation receipts.
+- [ ] Define compatibility/discovery for existing project outputs and global
+  gallery copies; never silently move or delete existing user artifacts.
+- [ ] Show the output directory and exact artifact location in both interfaces.
+- [ ] Test two sessions sharing one project and two separate projects sharing
+  weights but keeping generated artifacts scoped.
+
+## Uniform generation modules
+
+- [ ] Use one deliberate interaction pattern for LLM and media model selection,
+  download, readiness/deployment, generation, stop, failure and output actions.
+- [ ] Replace transcript floods with a single updating generation module tied to
+  its parent turn. Keep raw diagnostics and warnings in an explicit expansion.
+- [ ] Parse progress semantically: download bytes, model loading, inference
+  steps, saving and completion. Do not label deprecation warnings or inference
+  progress bars as model downloads.
+- [ ] Keep download-only and GPU deployment separate, with truthful status and
+  existing broker coordination and live inference hardware gates.
+- [ ] Provide responsive media previews sized from available content width,
+  including after terminal resize and sidebar dragging; retain aspect ratio.
+- [ ] Support click/Open actions and a subtle hover Open affordance, plus
+  keyboard access and clear local file handling.
+- [x] Investigate OpenTUI audio streaming APIs for generated audio playback and
+  visualization: https://opentui.com/docs/application-apis/audio-streaming/.
+- [ ] Implement video playback via updating frames using the same media module,
+  with bounded work, explicit play/pause and cleanup when hidden or closed.
+- [ ] Match browser preview sizing and media controls to these same artifact and
+  lifecycle semantics; avoid tiny fixed-size centered output previews.
+
+## Verification and delivery
+
+- [x] Update the design contract before edits, recording ownership, migration,
+  progress, preview and playback semantics.
+- [ ] Test storage identity, legacy discovery, concurrency, cancellation,
+  authorization, deletion scope and failure recovery with isolated fixtures.
+- [ ] Exercise TUI progress and resize/playback live without allocating models.
+- [ ] Exercise browser project switching, responsive output, playback and file
+  actions using isolated media fixtures and the mandatory transport tests.
+- [ ] Run actual inference only after the existing exact endpoint/model/GPU
+  preflight gate; report fixture tests separately from real inference.
+- [ ] Make scoped verified commits and push the tracked branch. Leave publishing
+  to the user unless subsequently instructed otherwise.
+
+## Progress log
+
+- Dashboard source delivery completed first through `6cfaebbd` on `origin/main`.
+- `0a6e9ada`: shared incremental media progress framing and owned image-worker
+  cancellation pushed. 67 tests across eight execution suites passed, including
+  real disposable Node subprocess Stop/timeout checks. No inference ran.
+- Current backend work replaces browser global work/copy behavior with explicit
+  registered-project identity and a labeled legacy gallery scope. Shared weights
+  stay in their configured store. Alias canonicalization is being repaired so
+  configured symlink roots share one lease.
+- Current terminal work retains one invocation module with bounded diagnostics,
+  responsive previews and local playback. Native model modules separate selection,
+  file-only download and preparation; their six isolated control tests pass.
+- Media artifact persistence round-trip: five disk-state tests pass. This is
+  media-block compatibility, not a claim that the queued full session-restoration
+  overhaul is complete.
+- Include the newly reported disconnected sidebar rule through suggestions,
+  scrolling and enabled Voice rows in this phase's terminal validation.
+- Queued after this phase: [update and session restoration](update-session-restoration-TODO.md).

package/docs/design/media-unification-design.md

@@ -0,0 +1,89 @@
+# Unified media: project artifacts, shared models, deliberate presentation
+
+Status: implementation contract, 2026-10-16. Follows the delivered dashboard
+reconstruction (`6cfaebbd`). Track verification in `media-unification-TODO.md`.
+
+## Ownership and discovery
+
+Model weights and runtimes remain in the existing configured shared media store.
+Changing projects or opening another session must not create a second model cache.
+Generated images belong to `<project>/.omnius/images`, video to `.omnius/videos`,
+and sound/music to `.omnius/audio`, matching the existing execution tools.
+
+Browser requests capture the selected project when the operation starts. The
+daemon resolves that identity through the project registry; a request cannot
+substitute an arbitrary filesystem root. Generation, gallery, preview, download
+and deletion carry the same captured identity. Switching projects while a job or
+preview is pending must not attach its result to the new project's gallery.
+
+Existing project artifacts are discoverable without import or duplication.
+Metadata sidecars enrich records but cannot redirect file access outside the
+project. File operations validate actual containment, supported extensions and
+regular files, rejecting symlinks/traversal. Existing global gallery copies stay
+available through an explicitly labeled legacy scope; they are not moved or
+deleted automatically. Deletion confirmations state the actual selected artifact
+and scope. Shared weight deletion remains a separate control.
+
+The REST project registry is an access boundary: admin scope is required to
+register, rename or unregister roots, and to write project preferences that
+create discovery sentinels. Switching an existing registered project and listing
+or scanning projects remain read operations; scanning does not register its
+results. `registerIfMissing` on project switching requires admin scope. Local
+trusted project discovery remains separate from these REST operations.
+
+Media APIs require the captured `projectRoot`; they never fall back to the
+daemon's current project. Project-root aliases resolve to the same physical
+artifact identity. Optional known `session_id` values must belong to that
+project. New requests carry a bounded `request_id` alongside the server's
+`generation_id`, and all terminal receipts retain that identity. Preview and
+deletion accept `If-Match` against the inspected artifact revision; video
+deletion also removes its exact derived regular thumbnail, never a path supplied
+by a sidecar. Legacy global gallery access requires `scope=legacy-global` and
+does not accept a project attribution.
+
+Configured shared-store root aliases resolve to one physical lease. Nested cache
+and lease-file symlinks are rejected. The existing conservative store lease
+serializes generation with weight/cache mutation because generation can download
+or evict weights; it does not add a per-project model cache. Stop receipts remain
+`stopping` until the owned invocation actually settles. Generation status records
+are bounded in daemon memory and do not survive a daemon restart.
+
+## Generation lifecycle
+
+One invocation has one updating module in its parent turn. The module shows kind,
+model, a single current phase and measured progress, then output controls. It
+does not append every subprocess line to the transcript. Raw warnings and bounded
+diagnostics live in an explicit disclosure. Download, runtime setup, loading,
+inference steps and saving are distinct phases. Unknown progress stays unknown.
+Heartbeat updates preserve the latest meaningful phase; they do not regress from
+inference to a stale “downloading/loading” label. Subprocess records must survive
+split lines and UTF-8 chunks.
+
+Model browsing uses the existing nested module pattern. Selecting weights,
+downloading files, deploying a runner and generating output are distinct actions;
+their state labels must describe actual behavior. Existing broker and live
+inference hardware gates still apply. No visual test should load a model.
+
+## Media presentation
+
+Image/video previews derive dimensions from the available content width and
+aspect ratio. Sidebar dragging and terminal/browser resizing update that fit.
+Opening media is an explicit clickable preview or Open action, with keyboard
+access and a quiet hover treatment. File location is available in the module,
+not repeatedly injected as log lines. The browser uses the same artifact identity
+and exposes preview, download and scoped delete actions together.
+
+Generated audio uses OpenTUI's native audio stream API with bounded PCM decoding
+when the file format requires it, and measured waveform/progress visualization.
+OpenTUI streaming has no pause/resume API; file transport must implement any such
+control explicitly by disposing and restarting at a captured position. Decoder,
+stream, timer and device cleanup belongs to the module lifecycle.
+
+Video updates the native image frame while playing, at a bounded cadence. Only
+active visible playback does decoding work; pause, navigation, removal and exit
+must stop owned decoder processes/timers. Playback failures stay inside the media
+module with a usable Open fallback. Tests exercise real fixture decoding and
+native rendering without claiming audible output or actual model inference.
+
+Reference: https://opentui.com/docs/application-apis/audio-streaming/ (checked
+against the installed `@opentui/core` 0.6.6 audio declarations).

package/docs/design/update-operation-cancellation.md

@@ -0,0 +1,40 @@
+# Owned update cancellation and restart
+
+The native update dialog stays present while an operation is running. Escape,
+Ctrl+C and outside clicks do not dismiss it. Its top-right Cancel control sends
+an explicit request; it shows cancellation pending until the owned work settles.
+An error remains in the same dialog with a Close action. Ordinary menu dismissal
+and native frame animation remain unchanged for other dialogs.
+
+The initiating client creates a private cancellation capability. Durable update
+state contains only its hash. Cancellation requests carry the exact operation
+identity and require the capability; clients adopting an existing shared update
+receive progress without cancellation authority. The worker observes a private,
+operation-specific request file, aborts its own installer process group, waits for
+process close, and attempts recovery of a daemon it quiesced. Status remains
+`running` during `cancelling` and `recovering`, then becomes `cancelled`. No UI
+client signals an arbitrary recorded PID. Interrupted package changes are
+retained; cancellation never claims package rollback. A recovery failure remains
+explicit in the terminal receipt.
+
+Quick Update waits for durable terminal settlement rather than treating a polling
+timeout as proof of termination. A cancelled transaction does not restart the
+client. Safe task admission, checkpointing, failure resume and the acknowledged
+verified launcher handoff stay in the shared restart flow. The replacement keeps
+the current configuration, environment, arguments, working directory and session
+identity; native interface and transcript persistence are separate checkpoints.
+
+`/update full` is now an alias for the coordinated package, daemon and indicator
+transaction. It no longer automatically updates Ollama, Python, Cloudflared or
+subordinate packages, or deletes global package directories and daemon artifacts.
+Explicit `/update deps`, `/update rebuild`, `/update python`, individual dependency
+menu actions and `/update ollama` remain available. Owned npm/pip maintenance
+commands use the same process-group cancellation mechanism. Interactive privilege
+and system-runtime setup prompts temporarily borrow the terminal through the
+existing explicit handoff; these prompts keep their own terminal controls.
+
+Verification uses scratch state directories, injected installers/service receipts,
+actual native renderer input and harmless Node process groups. It does not install
+an Omnius release, change services, load models or exercise CUDA. POSIX process
+group escalation is tested locally; Windows uses its owned PID's task tree via
+`taskkill`, with a direct-child fallback if that command is unavailable.

package/docs/design/update-session-restoration-TODO.md

@@ -0,0 +1,30 @@
+# Queued next: update lifecycle and exact session restoration
+
+Requested 2026-10-16. Implement after the active media-unification phase; keep
+this requirement durable without diverting the current work.
+
+- [ ] Make the update modal non-dismissible by outside click while an update is
+  running. Ordinary modal dismissal must not hide or retire the operation.
+- [ ] Provide an explicit top-right Cancel button. Cancellation must stop the
+  owned update operation safely and reflect its actual outcome; do not equate
+  hiding the modal with cancelling the update.
+- [ ] Define behavior for Escape and other close shortcuts consistently with
+  the non-dismissible running-update state.
+- [ ] Capture the exact interface/session state before update and restore it
+  after reload/restart: active project, session/tabs and selected agent,
+  transcript content and scroll position, draft/cursor, sidebar/layout,
+  expanded sections and other meaningful view state.
+- [ ] Resume old sessions from their complete persisted message/tool/media
+  history and saved interface state. Do not substitute a summary for the
+  visible conversation. Model-context compaction and visible history are
+  separate concerns.
+- [ ] Identify legacy sessions with incomplete saved history and report actual
+  availability honestly; never invent missing turns.
+- [ ] Verify running-update outside-click rejection, explicit cancellation,
+  restart restoration and old-session full-history reconstruction with
+  isolated fixtures plus live terminal interaction tests.
+- [ ] Commit and push verified changes, preserving the user's publishing work.
+
+Additional reproduction: the browser dashboard loads the session transcript, but
+resuming that same saved session in the TUI does not restore it. Trace both
+loaders against the same saved session and verify full-history parity.