omnius 1.0.867 → 1.0.868

package/docs/DISCOVERY.md

@@ -161,18 +161,20 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `api.v1-mcps` | /v1/mcps | List MCP servers (PT-03) |
 | `api.v1-mcps-name` | /v1/mcps/{name} | Get MCP server details (PT-03) |
 | `api.v1-mcps-name-call` | /v1/mcps/{name}/call | Invoke a tool on an MCP server (PT-03) |
-| `api.v1-media-audio` | /v1/media/audio | Generate a sound effect — body {prompt, model?, backend?, duration?, seed?} |
+| `api.v1-media-audio` | /v1/media/audio | Generate sound — body {projectRoot,prompt,request_id?,session_id?,model?,backend?,duration?,seed?} |
 | `api.v1-media-av-analyze` | /v1/media/av/analyze | Analyze a media file into a grounded entity/event/evidence answer (AV entity-comprehension) — body {path\|mediaUri, question?}; reports per-role live-vs-mock adapter status |
-| `api.v1-media-file` | /v1/media/file | Stream an exact owned gallery file — query {kind,name}; Validate an exact gallery identity and MIME before acquisition; Delete only a selected saved gallery file and matching metadata |
-| `api.v1-media-gallery` | /v1/media/gallery | List previously generated media from the global store, newest first |
-| `api.v1-media-image` | /v1/media/image | Generate an image — body {prompt, model?, backend?, width?, height?, steps?, guidance?, seed?, aspect_ratio?} |
+| `api.v1-media-file` | /v1/media/file | Stream an exact artifact — query {projectRoot,kind,name} or {scope:'legacy-global',kind,name}; Validate exact project/archive identity, MIME and ETag before acquisition; Delete a selected project artifact or explicit legacy copy and matching metadata |
+| `api.v1-media-gallery` | /v1/media/gallery | Discover existing artifacts in a registered project, or the explicit legacy global archive |
+| `api.v1-media-generations-cancel` | /v1/media/generations/cancel | Request daemon-owned Stop — JSON {projectRoot,request_id\|generation_id,session_id?} |
+| `api.v1-media-generations-status` | /v1/media/generations/status | Read actual daemon-owned generation settlement for captured project and request identity |
+| `api.v1-media-image` | /v1/media/image | Generate an image in a registered project — body {projectRoot,prompt,request_id?,session_id?,model?,backend?,width?,height?,steps?,guidance?,seed?,aspect_ratio?} |
 | `api.v1-media-migrate` | /v1/media/migrate | Dedup + migrate legacy per-group media caches into the unified store — body {dryRun?, roots?, maxDepth?} |
 | `api.v1-media-models` | /v1/media/models | List available generative media models per kind (image/video/audio/music) |
-| `api.v1-media-music` | /v1/media/music | Generate music — body {prompt, model?, backend?, duration?, seed?} |
+| `api.v1-media-music` | /v1/media/music | Generate music — body {projectRoot,prompt,request_id?,session_id?,model?,backend?,duration?,seed?} |
 | `api.v1-media-relocate` | /v1/media/relocate | Relocate the whole media store (weights/venvs/gallery) to a chosen folder — body {newRoot, dryRun?}; streams media.relocate_progress and returns 202 + job_id |
 | `api.v1-media-relocate-status` | /v1/media/relocate/status | Status of the in-flight (or last) media-store relocation job |
 | `api.v1-media-store` | /v1/media/store | Resolved media/model/gallery roots and disk information |
-| `api.v1-media-video` | /v1/media/video | Generate a video — body {prompt, model?, backend?, num_frames?, fps?, width?, height?, steps?, guidance?, seed?} |
+| `api.v1-media-video` | /v1/media/video | Generate video — body {projectRoot,prompt,request_id?,session_id?,model?,backend?,num_frames?,fps?,width?,height?,steps?,guidance?,seed?} |
 | `api.v1-media-weights` | /v1/media/weights | Inspect an exact media model's actual cache paths, physical bytes, known dependencies, sharing and supported actions; Delete an exact cached dependency while retaining its catalog entry |
 | `api.v1-media-weights-download` | /v1/media/weights/download | Start or reattach a durable network/disk-only weight download |
 | `api.v1-media-weights-jobs-id` | /v1/media/weights/jobs/{id} | Read durable download state and restart interruption status |
@@ -431,7 +433,10 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.design-dashboard-reconstruction-plan` | Dashboard reconstruction plan | 2026-10-16 · source implementation only; publishing remains with the user. |
 | `guide.design-dashboard-styleguide` | Omnius browser instrument design system | Version 1 · 2026-10-16 · implementation contract |
 | `guide.design-dashboard-todo-uppercase` | Dashboard reconstruction — durable TODO | Updated: 2026-10-16. Contract: styleguide. Scope and sequence: plan. |
-| `guide.design-media-unification-todo-uppercase` | Next phase: media storage and generation interface unification | Requested 2026-10-16. Queued after the current browser dashboard reconstruction; do not divert the current delivery into this work. These items are not implemented or verified by the dashboard reconstruction receipt. |
+| `guide.design-media-unification-design` | Unified media: project artifacts, shared models, deliberate presentation | Status: implementation contract, 2026-10-16. Follows the delivered dashboard reconstruction (6cfaebbd). Track verification in media-unification-TODO.md. |
+| `guide.design-media-unification-todo-uppercase` | Next phase: media storage and generation interface unification | Requested 2026-10-16. Active after dashboard reconstruction delivery 6cfaebbd. Contract: media unification design. The preceding dashboard receipt does not count as verification of this phase. |
+| `guide.design-update-operation-cancellation` | Owned update cancellation and restart | The native update dialog stays present while an operation is running. Escape, Ctrl+C and outside clicks do not dismiss it. Its top-right Cancel control sends an explicit request; it shows cancellation pending until the owned work settles. An error remains in the same dialog with a Close action. Ordinary menu dismissal and native frame animation remain unchan |
+| `guide.design-update-session-restoration-todo-uppercase` | Queued next: update lifecycle and exact session restoration | Requested 2026-10-16. Implement after the active media-unification phase; keep this requirement durable without diverting the current work. |
 | `guide.discovery-agent-map` | Agent Map | Bundled Omnius documentation artifact: docs/discovery/agent-map.json. |
 | `guide.discovery-catalog-overrides` | Discovery Catalog Curated Source | Curated aliases, relationships, invocation modes, and conceptual entries merged into the generated catalog. |
 | `guide.discovery-json` | Omnius Machine Discovery Catalog | Generated JSON catalog consumed by the CLI, REST discovery API, JavaScript API, and offline agents. |
@@ -567,6 +572,18 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-instrument-divider-collapsed-160x48` | Instrument Divider Collapsed 160x48 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-divider-collapsed-160x48.png. |
 | `guide.work-orders-evidence-instrument-divider-resized-160x48` | Instrument Divider Resized 160x48 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-divider-resized-160x48.png. |
 | `guide.work-orders-evidence-instrument-help-scroll-120x36` | Instrument Help Scroll 120x36 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-help-scroll-120x36.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-audio-playing` | Media Audio Playing | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-audio-playing.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-100x30` | Media Image 100x30 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-100x30.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-120x36` | Media Image 120x36 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-120x36.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-160x48` | Media Image 160x48 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-160x48.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-60x20` | Media Image 60x20 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-60x20.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-image-80x24` | Media Image 80x24 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-image-80x24.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-progress-collapsed` | Media Progress Collapsed | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-progress-collapsed.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-video-frame-a` | Media Video Frame A | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-video-frame-a.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-video-frame-b` | Media Video Frame B | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-video-frame-b.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-media-voice-autocomplete-junction` | Media Voice Autocomplete Junction | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/media-voice-autocomplete-junction.png. |
+| `guide.work-orders-evidence-instrument-media-live-20261016-report` | Report | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-live-20261016/report.json. |
+| `guide.work-orders-evidence-instrument-media-verification-20261016` | Instrument Media Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-media-verification-20261016.json. |
 | `guide.work-orders-evidence-instrument-package-artifact-20261016` | Instrument Package Artifact 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-package-artifact-20261016.json. |
 | `guide.work-orders-evidence-instrument-package-install-20261016` | Instrument Package Install 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-package-install-20261016.json. |
 | `guide.work-orders-evidence-instrument-package-install-20261016-updated` | Instrument Package Install 20261016 Updated | Bundled Omnius documentation artifact: docs/work-orders/evidence/instrument-package-install-20261016-updated.json. |
@@ -602,6 +619,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-local-recovery-production-routes-20261014` | Local Recovery Production Routes 20261014 | Bundled Omnius documentation artifact: docs/work-orders/evidence/local-recovery-production-routes-20261014.json. |
 | `guide.work-orders-evidence-native-conversation-prompt-audit-20261012` | Native Conversation Prompt Audit 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-conversation-prompt-audit-20261012.json. |
 | `guide.work-orders-evidence-native-goal-contract-probe-20261012` | Native Goal Contract Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-goal-contract-probe-20261012.json. |
+| `guide.work-orders-evidence-native-interface-state-verification-20261016` | Native Interface State Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-interface-state-verification-20261016.json. |
 | `guide.work-orders-evidence-native-reconciliation-readonly-live-20261014` | Native Reconciliation Readonly Live 20261014 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-reconciliation-readonly-live-20261014.json. |
 | `guide.work-orders-evidence-native-session-lifecycle-verification-20261016` | Native Session Lifecycle Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-session-lifecycle-verification-20261016.json. |
 | `guide.work-orders-evidence-native-session-regression-verification-20261016` | Native Session Regression Verification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-session-regression-verification-20261016.json. |
@@ -631,6 +649,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-evidence-opencode-step-rate-limited-diagnostic-20261012` | Opencode Step Rate Limited Diagnostic 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/opencode-step-rate-limited-diagnostic-20261012.json. |
 | `guide.work-orders-evidence-ovh-production-compatibility-20261012` | Ovh Production Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/ovh-production-compatibility-20261012.json. |
 | `guide.work-orders-evidence-ovh-structured-context-compatibility-20261012` | Ovh Structured Context Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/ovh-structured-context-compatibility-20261012.json. |
+| `guide.work-orders-evidence-project-media-unification-20261016` | Project Media Unification 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/project-media-unification-20261016.json. |
 | `guide.work-orders-evidence-public-review-after-20261012` | Public Review After 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-review-after-20261012.json. |
 | `guide.work-orders-evidence-public-review-before-20261012` | Public Review Before 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/public-review-before-20261012.json. |
 | `guide.work-orders-evidence-session-tabs-installation-20261016` | Session Tabs Installation 20261016 | Bundled Omnius documentation artifact: docs/work-orders/evidence/session-tabs-installation-20261016.json. |

package/docs/design/media-unification-TODO.md

@@ -1,12 +1,12 @@
 # Next phase: media storage and generation interface unification
 
-Requested 2026-10-16. Queued after the current browser dashboard reconstruction;
-do not divert the current delivery into this work. These items are not implemented
-or verified by the dashboard reconstruction receipt.
+Requested 2026-10-16. Active after dashboard reconstruction delivery `6cfaebbd`.
+Contract: [media unification design](media-unification-design.md). The preceding
+dashboard receipt does not count as verification of this phase.
 
 ## Storage contract
 
-- [ ] Trace browser, TUI, tool and session generation/output paths for image,
+- [x] Trace browser, TUI, tool and session generation/output paths for image,
   video, audio and music before choosing a migration strategy.
 - [ ] Share model weights across Omnius sessions and project locations through
   one configured model store; expose its actual path consistently.
@@ -36,7 +36,7 @@ or verified by the dashboard reconstruction receipt.
   including after terminal resize and sidebar dragging; retain aspect ratio.
 - [ ] Support click/Open actions and a subtle hover Open affordance, plus
   keyboard access and clear local file handling.
-- [ ] Investigate OpenTUI audio streaming APIs for generated audio playback and
+- [x] Investigate OpenTUI audio streaming APIs for generated audio playback and
   visualization: https://opentui.com/docs/application-apis/audio-streaming/.
 - [ ] Implement video playback via updating frames using the same media module,
   with bounded work, explicit play/pause and cleanup when hidden or closed.
@@ -45,7 +45,7 @@ or verified by the dashboard reconstruction receipt.
 
 ## Verification and delivery
 
-- [ ] Update the design contract before edits, recording ownership, migration,
+- [x] Update the design contract before edits, recording ownership, migration,
   progress, preview and playback semantics.
 - [ ] Test storage identity, legacy discovery, concurrency, cancellation,
   authorization, deletion scope and failure recovery with isolated fixtures.
@@ -56,3 +56,23 @@ or verified by the dashboard reconstruction receipt.
   preflight gate; report fixture tests separately from real inference.
 - [ ] Make scoped verified commits and push the tracked branch. Leave publishing
   to the user unless subsequently instructed otherwise.
+
+## Progress log
+
+- Dashboard source delivery completed first through `6cfaebbd` on `origin/main`.
+- `0a6e9ada`: shared incremental media progress framing and owned image-worker
+  cancellation pushed. 67 tests across eight execution suites passed, including
+  real disposable Node subprocess Stop/timeout checks. No inference ran.
+- Current backend work replaces browser global work/copy behavior with explicit
+  registered-project identity and a labeled legacy gallery scope. Shared weights
+  stay in their configured store. Alias canonicalization is being repaired so
+  configured symlink roots share one lease.
+- Current terminal work retains one invocation module with bounded diagnostics,
+  responsive previews and local playback. Native model modules separate selection,
+  file-only download and preparation; their six isolated control tests pass.
+- Media artifact persistence round-trip: five disk-state tests pass. This is
+  media-block compatibility, not a claim that the queued full session-restoration
+  overhaul is complete.
+- Include the newly reported disconnected sidebar rule through suggestions,
+  scrolling and enabled Voice rows in this phase's terminal validation.
+- Queued after this phase: [update and session restoration](update-session-restoration-TODO.md).

package/docs/design/media-unification-design.md

@@ -0,0 +1,89 @@
+# Unified media: project artifacts, shared models, deliberate presentation
+
+Status: implementation contract, 2026-10-16. Follows the delivered dashboard
+reconstruction (`6cfaebbd`). Track verification in `media-unification-TODO.md`.
+
+## Ownership and discovery
+
+Model weights and runtimes remain in the existing configured shared media store.
+Changing projects or opening another session must not create a second model cache.
+Generated images belong to `<project>/.omnius/images`, video to `.omnius/videos`,
+and sound/music to `.omnius/audio`, matching the existing execution tools.
+
+Browser requests capture the selected project when the operation starts. The
+daemon resolves that identity through the project registry; a request cannot
+substitute an arbitrary filesystem root. Generation, gallery, preview, download
+and deletion carry the same captured identity. Switching projects while a job or
+preview is pending must not attach its result to the new project's gallery.
+
+Existing project artifacts are discoverable without import or duplication.
+Metadata sidecars enrich records but cannot redirect file access outside the
+project. File operations validate actual containment, supported extensions and
+regular files, rejecting symlinks/traversal. Existing global gallery copies stay
+available through an explicitly labeled legacy scope; they are not moved or
+deleted automatically. Deletion confirmations state the actual selected artifact
+and scope. Shared weight deletion remains a separate control.
+
+The REST project registry is an access boundary: admin scope is required to
+register, rename or unregister roots, and to write project preferences that
+create discovery sentinels. Switching an existing registered project and listing
+or scanning projects remain read operations; scanning does not register its
+results. `registerIfMissing` on project switching requires admin scope. Local
+trusted project discovery remains separate from these REST operations.
+
+Media APIs require the captured `projectRoot`; they never fall back to the
+daemon's current project. Project-root aliases resolve to the same physical
+artifact identity. Optional known `session_id` values must belong to that
+project. New requests carry a bounded `request_id` alongside the server's
+`generation_id`, and all terminal receipts retain that identity. Preview and
+deletion accept `If-Match` against the inspected artifact revision; video
+deletion also removes its exact derived regular thumbnail, never a path supplied
+by a sidecar. Legacy global gallery access requires `scope=legacy-global` and
+does not accept a project attribution.
+
+Configured shared-store root aliases resolve to one physical lease. Nested cache
+and lease-file symlinks are rejected. The existing conservative store lease
+serializes generation with weight/cache mutation because generation can download
+or evict weights; it does not add a per-project model cache. Stop receipts remain
+`stopping` until the owned invocation actually settles. Generation status records
+are bounded in daemon memory and do not survive a daemon restart.
+
+## Generation lifecycle
+
+One invocation has one updating module in its parent turn. The module shows kind,
+model, a single current phase and measured progress, then output controls. It
+does not append every subprocess line to the transcript. Raw warnings and bounded
+diagnostics live in an explicit disclosure. Download, runtime setup, loading,
+inference steps and saving are distinct phases. Unknown progress stays unknown.
+Heartbeat updates preserve the latest meaningful phase; they do not regress from
+inference to a stale “downloading/loading” label. Subprocess records must survive
+split lines and UTF-8 chunks.
+
+Model browsing uses the existing nested module pattern. Selecting weights,
+downloading files, deploying a runner and generating output are distinct actions;
+their state labels must describe actual behavior. Existing broker and live
+inference hardware gates still apply. No visual test should load a model.
+
+## Media presentation
+
+Image/video previews derive dimensions from the available content width and
+aspect ratio. Sidebar dragging and terminal/browser resizing update that fit.
+Opening media is an explicit clickable preview or Open action, with keyboard
+access and a quiet hover treatment. File location is available in the module,
+not repeatedly injected as log lines. The browser uses the same artifact identity
+and exposes preview, download and scoped delete actions together.
+
+Generated audio uses OpenTUI's native audio stream API with bounded PCM decoding
+when the file format requires it, and measured waveform/progress visualization.
+OpenTUI streaming has no pause/resume API; file transport must implement any such
+control explicitly by disposing and restarting at a captured position. Decoder,
+stream, timer and device cleanup belongs to the module lifecycle.
+
+Video updates the native image frame while playing, at a bounded cadence. Only
+active visible playback does decoding work; pause, navigation, removal and exit
+must stop owned decoder processes/timers. Playback failures stay inside the media
+module with a usable Open fallback. Tests exercise real fixture decoding and
+native rendering without claiming audible output or actual model inference.
+
+Reference: https://opentui.com/docs/application-apis/audio-streaming/ (checked
+against the installed `@opentui/core` 0.6.6 audio declarations).

package/docs/design/update-operation-cancellation.md

@@ -0,0 +1,40 @@
+# Owned update cancellation and restart
+
+The native update dialog stays present while an operation is running. Escape,
+Ctrl+C and outside clicks do not dismiss it. Its top-right Cancel control sends
+an explicit request; it shows cancellation pending until the owned work settles.
+An error remains in the same dialog with a Close action. Ordinary menu dismissal
+and native frame animation remain unchanged for other dialogs.
+
+The initiating client creates a private cancellation capability. Durable update
+state contains only its hash. Cancellation requests carry the exact operation
+identity and require the capability; clients adopting an existing shared update
+receive progress without cancellation authority. The worker observes a private,
+operation-specific request file, aborts its own installer process group, waits for
+process close, and attempts recovery of a daemon it quiesced. Status remains
+`running` during `cancelling` and `recovering`, then becomes `cancelled`. No UI
+client signals an arbitrary recorded PID. Interrupted package changes are
+retained; cancellation never claims package rollback. A recovery failure remains
+explicit in the terminal receipt.
+
+Quick Update waits for durable terminal settlement rather than treating a polling
+timeout as proof of termination. A cancelled transaction does not restart the
+client. Safe task admission, checkpointing, failure resume and the acknowledged
+verified launcher handoff stay in the shared restart flow. The replacement keeps
+the current configuration, environment, arguments, working directory and session
+identity; native interface and transcript persistence are separate checkpoints.
+
+`/update full` is now an alias for the coordinated package, daemon and indicator
+transaction. It no longer automatically updates Ollama, Python, Cloudflared or
+subordinate packages, or deletes global package directories and daemon artifacts.
+Explicit `/update deps`, `/update rebuild`, `/update python`, individual dependency
+menu actions and `/update ollama` remain available. Owned npm/pip maintenance
+commands use the same process-group cancellation mechanism. Interactive privilege
+and system-runtime setup prompts temporarily borrow the terminal through the
+existing explicit handoff; these prompts keep their own terminal controls.
+
+Verification uses scratch state directories, injected installers/service receipts,
+actual native renderer input and harmless Node process groups. It does not install
+an Omnius release, change services, load models or exercise CUDA. POSIX process
+group escalation is tested locally; Windows uses its owned PID's task tree via
+`taskkill`, with a direct-child fallback if that command is unavailable.

package/docs/design/update-session-restoration-TODO.md

@@ -0,0 +1,30 @@
+# Queued next: update lifecycle and exact session restoration
+
+Requested 2026-10-16. Implement after the active media-unification phase; keep
+this requirement durable without diverting the current work.
+
+- [ ] Make the update modal non-dismissible by outside click while an update is
+  running. Ordinary modal dismissal must not hide or retire the operation.
+- [ ] Provide an explicit top-right Cancel button. Cancellation must stop the
+  owned update operation safely and reflect its actual outcome; do not equate
+  hiding the modal with cancelling the update.
+- [ ] Define behavior for Escape and other close shortcuts consistently with
+  the non-dismissible running-update state.
+- [ ] Capture the exact interface/session state before update and restore it
+  after reload/restart: active project, session/tabs and selected agent,
+  transcript content and scroll position, draft/cursor, sidebar/layout,
+  expanded sections and other meaningful view state.
+- [ ] Resume old sessions from their complete persisted message/tool/media
+  history and saved interface state. Do not substitute a summary for the
+  visible conversation. Model-context compaction and visible history are
+  separate concerns.
+- [ ] Identify legacy sessions with incomplete saved history and report actual
+  availability honestly; never invent missing turns.
+- [ ] Verify running-update outside-click rejection, explicit cancellation,
+  restart restoration and old-session full-history reconstruction with
+  isolated fixtures plus live terminal interaction tests.
+- [ ] Commit and push verified changes, preserving the user's publishing work.
+
+Additional reproduction: the browser dashboard loads the session transcript, but
+resuming that same saved session in the TUI does not restore it. Trace both
+loaders against the same saved session and verify full-history parity.