Chen Operator Watch Loop

Chen exposes one transport-neutral watch flow for a movie or one exact TV episode. The runtime checks Plex first and stops when the target is present. Only a positive absence observation permits discovery through authorized providers.

The shared completion directory is /media/plex/downloads/complete on the host and in Luna, and /downloads/complete inside qBittorrent. The workflow provider translates that exact root and its descendants on submission; Chen translates completed content paths back before host containment, import and finalization revalidation. Other roots are not implicitly trusted, and traversal is refused. New acquisition proposals bind both save paths. Before starting, Chen verifies qBittorrent reports the approved provider path. Historical wrong-path acquisitions are not relocated or reauthorized by this mapping.

The deployed watch service reads existing exact-infohash Chen lifecycle evidence before selecting a candidate. The latest recorded metadata stall, download stall, failure, missing files, missing torrent or unresolved request-level containment excludes that hash from automatic selection, with its proposal and observation time retained in discovery evidence. This is an acquisition-health filter after unchanged hard policy and ranking; upstream seed counts remain claims. A fresh candidate requires its own exact Lich review. Newer healthy observations can supersede earlier failure evidence.

VPN readiness and namespace containment do not establish DHT or peer viability. An enabled but dormant qBittorrent DHT session can require a separately governed session repair even when same-namespace UDP probes succeed. Lifecycle monitoring continues to report stalls; it does not restart the downloader, change preferences, replace candidates or relax VPN policy automatically.

After Plex absence, Chen requires both authenticated qBittorrent readiness and independent Gluetun VPN evidence before discovery. GLUETUN_STATUS_URL binds a fixed read-only Gluetun VPN status endpoint. The deployed default uses the qbittorrent-gluetun-status sidecar on llm-net; that proxy exposes only GET /v1/vpn/status, while Gluetun's full control API remains isolated on the qBittorrent network. A separate readiness process on that private network reports running only when both Gluetun's internal health server and the read-only VPN process status agree. Keeping the aggregator outside Gluetun's network namespace preserves status across controlled Gluetun restarts. This proxy is also published on host loopback port 8081 for the host Terminal transport. LUNA_TUI_GLUETUN_STATUS_URL selects that host-only URL without changing the container-side Docker DNS default or granting Terminal any additional authority. The proxy permits only the exact read-only status route; Gluetun's control API remains unexposed. This prevents an authentication-failed OpenVPN process from being reported as a ready tunnel. Missing, malformed, unavailable, or non-running evidence fails closed before provider discovery. Chen revalidates the same independent evidence immediately before an approved acquisition execution; readiness never grants approval or execution authority.

Bitmagnet uses fixed container endpoints and a fixed GraphQL document. Search is ready when DHT and Postgres report up. TMDB failure makes metadata degraded but does not close search. An unreachable GraphQL endpoint, malformed schema, pagination overflow, DHT failure, or Postgres failure closes discovery.

The chen_media_watch_v1 policy runs hard filters before ranking:

movies are strictly smaller than 3 GiB;
episodes are at least 50 MiB and strictly smaller than the effective TV-episode maximum (default 2 GB; inspect/set through inspect_tv_episode_max_size / set_tv_episode_max_size);
only a single observed 720p or 1080p resolution is accepted;
exact identity, exact TV coordinates, a valid BTIH, and known size are required; and
equal winner decision keys fail closed.

An eligible winner creates a durable acquisition proposal bound to its hash, magnet digest, target, both download save paths, operator, conversation, expiry, and policy evidence. Lich owns the exact decision. Approving an acquisition releases only that bound acquisition through the governed executor. The executor adds the torrent stopped, verifies its provider path, explicitly starts the exact hash, observes an appropriate active/completed state, then records its receipt. Discovery alone never grants execution authority.

The existing monitor observes completion and advances only an unchanged approved cascade. Historical containment drift requires a fresh finalization review and separate explicit execution. See post-submission observation and delivery and completed-payload recovery for the current manifest, promotion and readiness contracts.

Former session pending_chen_media_approvals records are discarded on load. They are continuity data only and cannot select, approve, or execute a media capability.

Discord, Web TUI, and terminal reach the same runtime service. Compose supplies the same Bitmagnet URLs, configurable Gluetun status URL, and media roots to both long-running Luna transports.

Named-room playback

When the operator names an allowlisted room, Chen retains that place on the watch target through acquisition. If the title is already in Plex, Earthshaker plays it immediately. If Chen must acquire first, the completion pulse continues the same named-room play after verified Plex availability and job-only cleanup. This is not a new grant of authority: play_library_title_on_named_room remains auto-execute for the exact allowlisted places. HTTP success is not playback; Earthshaker must observe a matching Plex session. A listed Plex client is not actuation; if playMedia fails, Earthshaker wakes the bound player through Companion and retries the same command once. The completion pulse journals one playback attempt before dispatch. Observed playback fulfills that objective; manual stop, natural end, later session absence, and process restart never re-arm it. An interrupted attempt remains uncertain and requires a new explicit play request rather than automatic replay. Previously recorded playback outcomes also suppress repeat dispatch. See docs/architecture/media_playback.md.

Always-on Gluetun supervision

Gluetun is a permanent infrastructure invariant. Docker Compose starts it with the qBittorrent stack and its unless-stopped policy, while qBittorrent remains bound to Gluetun's network namespace. AncientOS does not tear down a healthy VPN during ordinary operation. The Discord runtime owns one persistent, single-flight supervision loop because it is the deployed AncientOS process with the existing Docker-socket boundary; the state machine, renderer, probe, and recovery adapter remain transport-neutral.

The loop polls the canonical read-only readiness surface every 30 seconds. It allows 180 seconds of startup grace and requires three consecutive unhealthy observations before recovery. A transient failure therefore produces evidence but no mutation. State and sanitized transition evidence are stored in the canonical governed-state SQLite database, survive runtime reconstruction, and are readable from Discord, Web TUI, and terminal. The conceptual states are startup_grace, healthy, transient_unhealthy, sustained_unhealthy, recovery_in_progress, and recovery_exhausted.

Rubick exposes recover_gluetun_vpn as a typed, single-target standing authority (auto_execute). This is not a general Lich exemption. Its adapter has no caller-selected target: it checks exact Docker identities and the declared canonical qBittorrent dependency before requesting restart of qbittorrent-gluetun. Ambiguous identity, broken containment, unavailable Docker evidence, and interrupted recovery fail closed. The capability cannot restart arbitrary containers, mutate qBittorrent, edit Compose or networks, change credentials or provider configuration, touch media/Plex, or acquire content.

Anti-loop policy permits at most two attempts in 30 minutes, with at least five minutes between attempts. Exhaustion suppresses automatic recovery for one hour while retaining explicit unhealthy state. Each meaningful observation or recovery transition records its readiness reason, authority class, attempt count, cooldown, and result without credentials or public IP addresses. Oracle inspection reports watcher activity, last healthy time, recovery state, recent attempts, suppression, and acquisition safety.

Self-healing is not acquisition authority. The watcher attempts to preserve infrastructure health, but cached last_healthy state is never sufficient for any download. Any future qBittorrent mutation must independently call the canonical readiness probe immediately before execution, and must fail closed when that current observation is unhealthy or unavailable.

Shared namespace lifecycle reconciliation

The deployment retains network_mode: service:gluetun and the existing single supervisor. Container ID equality is not namespace equality: Gluetun can restart with the same ID while its dependent remains in the old live network namespace. The observer reads /proc/self/ns/net inside both exact running containers and rechecks their process identities afterward. Missing, stopped, malformed or racing observations fail closed. No independent Docker network or published port is allowed on qBittorrent itself.

The qBittorrent Compose dependency uses condition: service_healthy and restart: true. This propagates explicit Compose operations; it does not cover direct Docker or engine restarts. Existing supervision supplies that remaining lifecycle path without a new watchdog, host PID mount or database.

reconcile_qbittorrent_gluetun_binding retains the all-torrents-paused before recreation invariant. Its capability-local transaction performs:

Inspect exact identities, stale namespace, healthy Gluetun and approved Compose containment. Capture complete bounded torrent API state and exact originally active hashes in the existing vpn_supervision_events ledger before any pause. Hash the state-bearing image/configuration/mount mapping.
Gracefully pause only the originally active hashes. Require zero measured transfer rates and every exact persisted resume record paused with libtorrent automatic queue management disabled. A missing state directory is not an empty paused inventory. Wait at most 30 observations, two seconds apart, with separately bounded API calls; failure prevents recreation.
Use only the canonical Compose definition to recreate literal qbittorrent with no dependency restart, image build or image pull. Do not re-add torrents, edit preferences, change save paths, categories or tags, or touch media/Plex.
Prove live current namespace containment, healthy Gluetun, its existing DROP firewall/tunnel routes, identical image and state-bearing mount/configuration mapping, unchanged torrent identities/configuration and preserved progress. Verify the normal configured Luna downloader API is available.
Record restoration evidence, then restore only the original active hashes. Previously stopped torrents remain stopped. Retain the final observed inventory or an explicit uncertain outcome; never replay a restore merely because its response was lost.

This is narrowly scoped standing lifecycle authority approved for the existing supervisor, not arbitrary torrent control or acquisition authority. Requests with unknown/checking states, force-start semantics, incomplete or oversized state, changed configuration, unavailable evidence, failed graceful pause, unhealthy VPN or failed postflight are refused. Up to 1,000 torrents and 4 MiB of complete snapshot evidence are accepted; no state is silently truncated. The namespace-local adapter permits only authentication, version/inventory reads and exact-hash stop/start through the existing container's loopback. It passes credentials on stdin, never follows redirects and creates no cookie file.

Single-flight and existing recovery cooldown remain. Durable interrupted reconciliation state fails closed and does not automatically restore transfers. The pre-pause evidence retains original intent for a separately governed continuation; a process interruption is not permission to resume. Existing bounded supervision event retention also applies to these transaction records. Cached supervision success still grants no acquisition authority.

Bitmagnet already uses the same declarative Compose dependency, plus a legacy in-container worker wrapper that exits on loss of eth0 so Docker can reattach it. That wrapper waits for VPN readiness before starting the worker. Its standing authority is separate: qBittorrent supervision does not acquire a Bitmagnet mutation target. Namespace equality, VPN health and Bitmagnet service readiness remain distinct observations. A shared new controller is unnecessary for this repair; replacing the existing Bitmagnet wrapper is not implied.

Completed-payload readiness observation

Io also owns a separate bounded read-only tether for durable episode records in download_complete. It invokes only the typed promotion-readiness inspector, persists one terminal ready or blocked artifact, and excludes that record from later pulses. This reuses restart-safe Clockwerk/Io relinking and creates no competing watcher. It cannot start or stop torrents, write or move files, refresh Plex, request approval, or execute promotion.

Additional qBittorrent Search discovery

Movie and episode watch requests use the shared provider boundary described in media acquisition discovery. The deployed Compose configuration explicitly enables the reviewed piratebay 3.9 Search plugin as an additional discovery source while retaining Bitmagnet. An unavailable Bitmagnet client does not terminate discovery when this separately configured provider can return candidates under healthy VPN evidence.

The adapter owns only transient Search jobs and returns untrusted normalized candidates. Provider/plugin/upstream provenance and policy rejection evidence remain visible through candidate evaluation. Conflicting strong-identity claims fail conservatively, and the merged candidate digest binds their evidence. The existing hard policy, tie handling and Chen/Lich acquisition boundary are unchanged. Search success never starts a download or grants approval. Prowlarr and additional plugin installation remain outside this implementation.

A deployed acceptance may use an unavailable endpoint only for Luna's Bitmagnet client, then restore it, without stopping Bitmagnet or its VPN. The normal transport-neutral media request must show successful Search discovery and either truthful hard-policy rejection, ambiguity or the normal governed proposal state. A media download is not required to prove this boundary.

Post-submission observation and delivery

Chen watch acquisitions (chen_media_acquire_v1) and the separate episode submission/download capabilities have different durable lifecycles. A Chen acquisition's rollback_available state and acquire receipt mean submission execution finished, not that the download or operator request finished.

The existing chen_media_completion_monitor_loop hosted by the Discord process provides the Chen pulse (60 seconds by default, minimum 30). It is not a Keeper job, an external Clockwerk job, or the episode Io tether. Runtime Composition reports the composed Chen observer without claiming that composition proves scheduler liveness. With the Discord process unavailable, automatic Chen observation stops; durable timestamps expose the resulting stale observation.

Each bounded pulse selects Chen acquisitions before applying its limit, ordered by oldest observation. It verifies proposal, approval and acquisition-receipt lineage, observes only the exact infohash, and writes chen_lifecycle evidence in the existing governed action store. The original acquisition receipt remains immutable. One target's provider failure does not hide the remaining targets. The domain evidence distinguishes:

downloading_metadata, downloading, and waiting;
metadata_stalled, download_stalled, or waiting_stalled after 15 minutes without observed byte/progress advance or the arrival of metadata;
stopped, missing torrent, mismatched identity, provider failure, missing files, download failure, and unknown/unhealthy provider states;
download complete, requiring a known positive payload size, zero bytes left, full progress, and a completed provider state (excluding checking/missing files);
downloaded pending verification, operator attention required, and availability established by cleanup evidence and acknowledged completion return.

A stall is an actionable observation, not proof that the torrent can never recover. Normal provider progress can clear a stall on a later pulse. Observation never starts, restarts, replaces, force-starts, deletes, or changes the torrent's save path. An acquisition start is verified with bounded polling; observing an existing stopped torrent no longer justifies the message that it started. Exact-hash lookup cannot fall back to a title match. An unavailable downloader observation renders no invented percentage; independently verified request availability remains visible from its finalization evidence.

Meepo-revalidated continuation remains separate from read-only observation. Current manifest finalization and historical recovery are described below. Legacy direct-file finalization records retain their original import/verify/stop ordering and compensation behavior; they are not rewritten into new approvals. A reauthorize_cascade record is a halt/review artifact, not an executor.

show Chen media status and show Chen media status for proposal <id> read persisted observations through the shared runtime. The canonical principal in the original Lich review owns visibility, including when a valid browser session reads a Terminal-originated request. Status queries grant no execution authority. The authenticated Web Inbox includes and renders the same media observations. Browser views refresh through the existing Inbox refresh/navigation behavior; they do not introduce a new polling loop.

The existing notification outbox now retains durable outcome returns. Its principal, objective, governed work reference/hash, origin transport/conversation/ request, terminal disposition, evidence references and result text are immutable bindings. Recording a result is advisory, never approval or execution authority. Media Manager validates cleanup receipts and after-evidence before recording success; intervention results link the domain observation. Routine progress does not enqueue messages. The first result for a principal/work/disposition is retained idempotently.

The existing Discord completion notifier consumes these shared records, replies in the original channel with an original-message reference, suppresses mentions, and uses a stable nonce. A durable send claim precedes delivery. An interrupted/uncertain send is reconciled against at most 200 channel-history messages rather than blindly resent; unresolved delivery becomes failed after bounded attempts and requires inspection. This avoids duplicate retry messages but cannot promise delivery during an unobservable external-effect failure.

Recording an outcome also enqueues one advisory Web Push per current principal device. Re-enrollment replaces any previous live subscription for that exact device so a stale endpoint cannot capture later deliveries. The Chen pulse and Discord completion notifier both attempt deliver_due; creating a Lich review is not the only dispatcher. Each Push row is atomically claimed in SQLite as sending before external dispatch; only the caller that wins the conditional status/attempt update sends it. Ordinary send failures retain bounded backoff. Claims older than five minutes become failed with an uncertain-delivery reason, never automatically requeued: a crash may have followed provider acceptance. This reuses existing status/timestamp fields, not a lease or another queue. A sent acknowledgement means provider acceptance, not proof the user read it. available requires acknowledged delivery on at least one path; a queued origin row is not a successful user notification.

Authenticated Web Inbox reads and displays the same principal-owned durable returns. It is a pull surface, not the proactive completion path. Terminal retains shared principal-scoped media status; no asynchronous terminal-session push is implemented. The outbox remains inspectable even without a live transport.

Keeper task completion is task management, and governed continuations preserve blocked work and require fresh resume authority; neither is a conversational delivery queue. Reusing the existing shared outbox avoids overloading those contracts or creating another task store, notification subsystem, scheduler or memory authority. The shared API has no media or transport imports. Other governed domains could supply the same verified result bindings later; no other consumer is implemented here.

Completed-payload promotion and historical path recovery

observe Chen media completion for proposal <acquisition-id> inspects the exact receipt-bound completed torrent for the original canonical requester. The existing finalization proposal now binds a bounded manifest (at most 32 files), total torrent size, provider content/save paths, host source paths, SHA-256 of the one playable file and its matching .srt, deterministic Movies or TV destination, and Plex section. Every listed file must be complete, regular, uniquely named and correctly sized; traversal, symlink components, hardlinks, multiple playable files and destination collisions fail closed. Ancillary files remain in downloads; they are not deleted.

Known provider roots /downloads/complete and /downloads/incomplete translate to host /media/plex/downloads/complete and /media/plex/downloads/incomplete. Normal submission still uses only the completed provider root. Luna's two runtime services mount the incomplete host root for explicit recovery inspection and execution. A historical wrong save path is preserved as evidence, not silently rewritten into an old approval. Recovery of completed content retained there requires a new exact Lich finalization approval, followed by execute Chen media proposal <finalization-id>. The old reauthorize_cascade containment review remains non-executing authority.

Historical directory manifests retain their originally approved cascade and its identity, total-size, VPN and containment checks. Historical incomplete-root recovery cannot pass that automatic containment boundary. Explicit execution revalidates the original receipt, manifest and hashes before stopping the exact torrent. It verifies stopped-complete state, publishes files without overwrite, records each move, refreshes the bound library once, then polls read-only Plex verification for up to 30 observations two seconds apart. Cross-mount imports use a verified, fsynced temporary copy and exclusive destination publication before source removal; equal filesystem device numbers do not imply links can cross bind mounts.

Plex readiness requires the exact movie title/year or show/season/episode, a matching media Part at the imported path, matching byte size, positive duration and no reported missing/inaccessible flag. It is indexed-file readiness, not a guarantee that every playback client can decode every codec. Title-only matches and refresh acceptance do not complete a request. A successful historical finalization receipt proves promotion, not job cleanup or notification. An older containment child does not invalidate that promotion evidence. Download completion remains separately observable.

Failures after stopping retain the stopped torrent and any verified imported files; Zeus stage evidence records partial operations and failed Plex verification. There is no automatic retry, rollback, torrent removal or resume. Delayed Plex readiness past the bounded verification interval remains operator attention and needs a separately supported continuation; it never causes reacquisition automatically. Existing principal-scoped Terminal/Web status and advisory outbox behavior remain unchanged. Browser Push delivery failure does not suppress durable status.

Approved completion lifecycle

New acquisition envelopes explicitly include completion version 2, file-preserving publication, Plex verification, exact job stop/removal, Plex re-verification and an outcome return. Submission remains an intermediate receipt. The existing monitor resumes finalization/cleanup proposals in execution_in_progress; durable checkpoints live in the existing governed evidence store. Transient service/Plex delays retry only until the immutable proposal expiry (normally 24 hours). Expiry, changed evidence, missing files or unsafe torrent management fail closed and require intervention. A crash releases the process-shared advisory lock on an adjacent, stateless .chen-execution.lock file; fresh record revisions and authority are checked before resumed effects. Never lock by independently opening/closing the SQLite database inode: closing that descriptor discards SQLite's POSIX locks and can leave processes using unlinked WAL journals. The lock file is not authority or a second state store; it must not be unlinked while processes may use it.

New completion publishes a verified copy into Plex while retaining the source, then proves exact Plex Part identity/path/size/accessibility before stopping seeding. This intentionally uses additional disk space to keep qBittorrent's completed source intact; source deletion is not authorized. Partial-copy checkpoints permit resuming only the exact approved publication. Historical move/failure policies remain unchanged.

Cleanup binds acquisition and finalization hashes/receipts, file hashes, exact torrent hash and delete_files=false. It rechecks files and Plex, verifies stopped-complete state with zero transfer rates, journals removal intent, calls only POST /api/v2/torrents/delete with the exact hash and deleteFiles=false, observes job absence, and rechecks files and Plex. A missing torrent without prior removal intent is not successful cleanup. Removal is not reversible by this workflow: re-adding or restarting a torrent would require separate authority. Existing generic proposal receipt state rollback_available does not grant such authority.

The qBittorrent API's deleteFiles=false preserves content; see the official API documentation. No seeding preferences, auto-management, network namespaces or VPN topology change. Historical approvals explicitly excluding deletion require a separate exact Lich cleanup review: clean up completed Chen media proposal <acquisition-id>, followed by approval and explicit execute Chen media proposal <cleanup-id>. The monitor cannot turn a pending historical cleanup review into execution authority.

AncientOS Home adds qBittorrent WebUI under Operations. The link uses the configured Web runtime's QBITTORRENT_BASE_URL through a credential-free HTTP(S) redirect; it does not proxy credentials, invent a hostname, or change qBittorrent authentication. Reachability and HTTPS restrictions remain properties of that configured endpoint.

Media acquisition ownership and entity resolution

The shared affirmative acquisition parser accepts movie titles with or without the word "movie"/"film", including balanced quoted titles. Episode coordinates are not ownership prerequisites. Bare titles use the existing movie search path; explicit episode/latest requests retain TV semantics. Recognizable URLs, file operands and non-media resources stay outside this path. This is a bounded intent grammar, not unrestricted natural-language entity inference: unsupported forms are not claims that another media kind is available.

The intent boundary preserves a quoted title only when the enclosing request is an affirmative acquisition directive. Quoted commands, reports, prospective and negated instructions remain non-authoritative. Missing movie titles stay owned but blocked. Plex is inspected first; a fuzzy surrounding-title match cannot establish availability. Absent movies use the existing provider pipeline and hard policy. Ordered release-title boundaries and consistent structured metadata bind movie identity independently of episode coordinates.

When discovery observes multiple exact-title release years, Media Manager asks which movie through the same durable input continuation used for series. Identity ambiguity is evaluated before release size/ranking policy, so a policy-ineligible remake cannot silently select another movie. Choices contain only observed years; this bounded provider result is not an exhaustive movie catalog. A unique observed year, or the user's bounded year selection, is resolved through fresh Plex and provider checks before creating the exact Lich proposal. A selection is never approval. Movies consume the same completion-v2 cascade and outcome-return path.

Latest-episode selection

An affirmative acquisition directive can specify a latest/newest/most-recent episode without knowing season/episode coordinates. The shared acquisition parser retains episode_selection=latest; operational routing owns that request before metadata resolution. Incidental, quoted-command and negated discussion does not select acquisition. Compact latest-title directives exclude ordinary software/news/weather/report/file requests; explicit episode intent remains a media request even when its parameters are incomplete.

Media Manager reuses EpisodeAvailabilityService and its existing TVmaze adapter. Here “latest” means the highest standard aired-order season/episode whose air time is not in the future, according to that provider. It does not mean the newest upload, a season pack, or a guarantee that a download candidate exists. Exact-title series ambiguity uses existing Plex external IDs when available; otherwise Media Manager asks which series/year was intended. Missing metadata, unknown airtime or unresolved identity produces a Media Manager-owned blocked result, never generic inference.

The resolved exact title/year/episode then follows unchanged Plex, downloader/VPN, discovery, policy and Lich checks. Metadata-resolution evidence is included in the immutable acquisition payload. Completion-v2 binds the resolved target and candidate hash; the relative word “latest” cannot later expand an approved acquisition to a new episode. No new provider, transport router, prompt rule or preference store was introduced. Users do not need to reformulate ambiguous requests with a year.

Series ambiguity is retained in the existing GovernedContinuationService and its SQLite store, in clarification_pending. Media Manager supplies the original structured target, exact provider-backed options and discovery hash. Year, country and network/Web platform labels are shown only when observed in provider metadata. The original principal, conversation and message bind the continuation; credentials and session tokens are not persisted in it. Numbered replies or a unique observed year/platform resolve the offered provider ID. Fresh metadata resolution still has to prove that identity and the latest aired episode before normal candidate/policy checks can create a Lich proposal. No proposal is created while ambiguous.

The shared input extension atomically records input_resolved, which means only a parameter has been selected, not that execution is approved or the media objective is complete. It cannot enter resume_claimed or supply approval authority. The bounded resolution response is cached on this continuation for exact ingress replay; the acquisition retains the original message as its completion-return destination. Pending choices survive recreation, expire after 15 minutes, and a newer ambiguous objective supersedes an older choice in the same context. Wrong principals, other conversations, negated instructions and incidental discussion cannot select a show.

If the process dies after claiming a selection but before recording its response, replay reports an unconfirmed return and requires proposal inspection rather than blindly creating another proposal. The original target, selected identity and reply remain durable. This narrow fail-closed crash window does not claim user completion.

Synchronous clarification uses existing transport rendering; eventual verified completion uses the existing durable outcome-return outbox. Neither is a new media notification store. Shared continuations own pending input; the outbox owns terminal return delivery. Other capabilities may use the same bounded input operation without acquiring execution authority, but no other consumer is added here.

Natural acquisition-status follow-ups

Direct questions such as “What is the status of the download?” are owned by Media Manager before generic inference. Runtime validates the existing canonical principal and authenticated Web session. Existing acquisition origins and Lich decision-audit attribution associate work with the conversation, including a Web approval of a Discord-originated acquisition. No additional conversational-memory store is created. Work in the existing approval/cascade window takes precedence over expired historical work. Context-bound work takes precedence over other acquisitions owned by the same principal; if context supplies no match, one canonical user's acquisition may still be inspected across transports. Multiple eligible acquisitions produce a durable, principal/context-bound choice using the same continuation as series clarification. A numeric reply selects only one of the offered proposal hashes and only inspects it.

Interactive status and the background observer share _observe_status for current qBittorrent facts and durable progress/stall timestamps. Status reads do not call the execution-capable completion-advancement function. They distinguish incomplete payloads, metadata waits/stalls, provider unavailability, complete-awaiting-Plex, cleanup pending, and verified ready media. After completed cleanup they validate the bound cleanup receipt/evidence and recheck the preserved file and Plex; absence of the deliberately removed torrent is not reported as download failure. An inquiry never starts, stops or removes a torrent and never dispatches a completion notification.

The canonical Web approval audit supplies a status context even though the older Web acquisition-proposal actor-alias limitation remains separate. Unauthenticated Web aliases cannot inspect or select private download/series state. Generic inference must not replace an owned status result when provider or completion evidence is unavailable.

Authenticated Web proposal creation revalidates the session-bound principal through the canonical principal registry, just as assistant presentation and natural download status do. The Web envelope's generic presentation author is not a session alias. Chen preserves its originating conversation scope and binds the canonical requester to the Lich review; subsequent durable outcome returns use that bound requester. Missing, revoked, mismatched or invalid Web session identity fails closed, including when a body or request text claims a principal. The same Chen principal resolver serves explicit lifecycle status; no alternate Web identity mapping or acquisition authority is introduced.

Episode candidate identity requires the complete normalized series title before its season/episode marker, matching the canonical title or an existing canonical alias. Ordered words and title boundaries are preserved; finding requested words somewhere in another show's title is insufficient. Separator punctuation, underscores, optional release-year suffixes and explicit www.… site branding are normalized, but arbitrary surrounding title words are not stripped. Supplied structured title evidence must agree with a canonical name/alias and cannot rescue a contradictory release title. Episode coordinates and single-episode, pack, size, resolution and provider-conflict gates remain separate requirements. Unrecognized naming layouts fail closed; discovery does not infer new aliases.