Native mobile + Auto Research land on rc-0.9.0

Native mobile (Tauri) client landed on rc-0.9.0 — QR device pairing, bearer-token HTTP+WS auth, and a native on-device STT seam — all gated behind a new CHALIE_INTERNAL_DEV feature flag that surfaces internal_dev on /auth/status and stays invisible by default. /pairing/ was extracted into its own MPA entry (mirroring login/onboarding) so the chat shell’s missing no longer strands LinkDevice, and Flask gained matching routes so the web path can serve it too.

The native surfaces shipped through several rounds of P4+P5 critic fixes: AuthStatus consolidated onto system.ts as the single source (incl. vault_state), native notification grant cached in tauriPlatformAdapter since the web Notification API never updates in-webview, and the non-functional loadRecentConversation() resume call dropped. SonarCloud reliability bugs got scrubbed, and voice now routes mic to native on-device STT on Tauri (bridging transcripts to the DOM bus) and falls back to /voice/transcribe when native STT cannot start.

Auto Research arrived as the eighth subconscious-worker step: at most once every 6 hours (durable across restarts), it runs a dedicated discovery loop grounded in the user’s synthesis and recent discussion, records genuinely-interesting findings as a new ‘discovery’ memory kind that decays after ~2 weeks, and surfaces them in the Brain dashboard under Cognition -> Auto Research. Each run persists to a new discovery_runs table; the discovery channel is muted in the source-profile allowlist so transcripts never become episodes or facts.

Boot self-heals a broken onnxruntime GPU wheel (e.g. CUDA 13 wheel on a host without CUDA 13 -> libcudart.so missing): RuntimeDepsService.ensure_onnxruntime() runs synchronously before warmup, uninstalls the broken wheel, installs the CPU wheel, and logs an actionable hint that parses libcudart.so.N -> “CUDA N” so the mismatch surfaces in Cognition -> Errors. /ready now delegates to a new read-only preflight_service reporting verified component state instead of eternal “loading”. The logger was capped to the most recent 20k entries via _CountCappedFileHandler, batching rewrite work in 2k chunks for O(1) steady-state.

The interface now renders Auto Research and the World “What Chalie sees” panel as HTML via a shared escape-first mdToHtml in format.ts — escape first, then protocol-gate links so javascript: cannot inject. The WebSocket got a notifyDisconnect() chokepoint that collapses the active act group on drop and clears in-flight turn callbacks first, so a mid-turn socket drop cannot leave a spinner hanging. The cancel path now reaches a turn parked on an interactive ask permission gate — _ask_user polls cancel_event and resolves as denied so dispatch unwinds and frees the per-channel lock instead of deadlocking later turns.

Several pre-existing bugs got tightened: chat fails loud with 400 “message required” on empty submit (backstop for non-FE clients), calendar list_events widens a bare-date upper bound to end-of-day so same-day timed events no longer drop, the vault prunes key-material backups to the newest 6 plus a conftest autouse fixture redirects _SECURE_DIR per-test so future tests cannot pollute data/secure/. RestrictedPython’s missing inplacevar runtime was added so x += 1 no longer dies with NameError, the .perm-card pointer-events got re-enabled so Allow/Deny clicks do not fall through, and a botched internal-ref scrub in b34d8793 was reverted with [document_id] / [task_tracker] placeholders restored across the pipeline.

Brain’s pairing QR now opens in a BrainModal centered overlay (canvas mounts only when opened) and the QR canvas is block-level with auto side margins so it no longer overlaps the inline-flex generate button. The UMP user-channel system prompt now instructs the model to acknowledge tool outcomes in its final reply. Ten confirmed-dead module functions plus their orphaned deps were removed (net -98 LOC, ruff + mypy --strict clean).

Native mobile (Tauri) client merged into rc-0.9.0, all surfaces behind CHALIE_INTERNAL_DEV feature flag
/pairing extracted to standalone MPA entry; Flask gained /pairing routes
Auto Research: 6-hour subconscious discovery loop with ‘discovery’ memory kind decaying after ~2 weeks
Boot self-heals broken onnxruntime GPU wheel; /ready delegates to preflight_service; logger capped to 20k via _CountCappedFileHandler with 2k batched rewrites
Cancel-aware _ask_user frees the channel lock on a cancelled parked turn; sandbox augmented-assignment fixed via inplacevar
Vault key-material backups pruned to newest 6 with autouse _SECURE_DIR isolation; calendar same-day events fixed; chat empty submit returns 400