diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3d8903235..130264e6c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,44 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.8.0] - Unreleased candidate
+
+Source manifests currently identify `0.8.0-rc.1`; no final release is implied.
+See [release notes and migration](docs/release-notes-0.8.0.md) and the
+[checkpoint qualification](docs/release-qa-0.8.0.md) before choosing a consumer pin.
+
+### Added
+
+- Typed generic model operations and capability discovery, including bounded
+  Image-to-Text requests and explicit model/projector roles. Availability still
+  depends on the selected model, serving profile and qualified runtime.
+- Authenticated local owner discovery, explicit existing-library enumeration,
+  owner retention and generation fencing for embedding consumers.
+- Digest-bound local imports and conditional S3 single-object/authored-bundle
+  acquisition, with immutable selection and retained download custody.
+- Pinned inference-enabled headless candidate assembly for Linux x86_64,
+  Windows x86_64 and macOS ARM64. The release inventory now requires sixteen
+  artifacts; assembly and startup do not qualify pretrained inference.
+
+### Changed
+
+- Older download metadata requires an explicit offline schema-7 upgrade with
+  stopped-reader/writer confirmation and an exact metadata-only backup.
+- Hugging Face detail resolution follows explicit model selection; cached
+  discovery and live download authority remain distinguishable.
+- Installed speech has conditional custody and qualification plumbing;
+  production Audio-to-Text remains unavailable until its admission gates pass.
+
+### Fixed
+
+- Desktop startup failures keep recovery and metadata upgrade actionable,
+  including small windows and failed replacement startup attempts.
+- Startup preserves retained downloads whose destination folders are missing,
+  without recreating folders or finalizing absent outputs.
+- Receipt-bound GGUF selection survives owned library moves, and explicit
+  headless legacy-schema preflight avoids creating a new failed owner claim.
+- Candidate packaging selects notices matching the current source version.
+
 ## [0.7.0] - Unreleased candidate
 
 See [0.7.0 release notes](docs/release-notes-0.7.0.md) for capabilities,
diff --git a/docs/plans/v080-qualification/execution-ledger.md b/docs/plans/v080-qualification/execution-ledger.md
new file mode 100644
index 000000000..9c6d6ec73
--- /dev/null
+++ b/docs/plans/v080-qualification/execution-ledger.md
@@ -0,0 +1,121 @@
+# Qualification continuation ledger
+
+## 2026-10-14 — resumed actual state
+
+Original candidate and remote PR70 head remain
+`df53db08e2ba224edfaf713522ddd410f7d4ac44`; the worktree was clean at resumption.
+Build 38522709859 is in progress. Workflow/release and frontend/desktop jobs passed;
+the remaining source/native jobs are still active. No submitted GitHub review
+or inline thread exists; the separate independent report was requested.
+
+Fresh pnpm 10.33.0 audit: production has zero advisories; all dependencies report
+one moderate sprintf-js advisory GHSA-hp3w-g68c-fv3c. The existing dependency review
+already owns its build-only path and absence of a compatible minimal removal.
+No lockfile or dependency update has been selected. Cargo audit tool setup and
+frozen no-script dependency setup are underway; no results are assumed.
+
+## 2026-10-14 — CI failure, bounded fixture repair and local evidence
+
+Headless job 115716297437 failed exactly one unit test on df53: the worker did not
+reach `pause_is_rejected_after_final_file_commit_and_during_cleanup`'s blocked
+cleanup cutpoint within one second (2,069 passed, one failed, 13 ignored).
+The [retained excerpt](reports/ci-df53-headless-failure.txt) names the source/run/job.
+The same candidate's full Rust quality job passed. This is separate from the
+earlier catalogue test, which did not reproduce locally.
+
+Amended the plan before changing only the cleanup test. Its fixture admission,
+cutpoint and settlement waits now share a bounded ten-second budget and report
+the selected cutpoint/worker stage. Both actual cleanup cutpoints, refused pause,
+Downloading-before-release, Completed settlement and zero retained claims remain
+asserted; no production timeout or custody semantics changed.
+
+- Focused no-default test passed: 1/1, 0 ignored, 0.67 seconds after compilation.
+- Full no-default unit cohort run concurrently with Clippy passed 2,067 and failed
+  three unrelated one/three-second fixtures, with 13 ignored; 147.74 seconds.
+  These failures and that noncanonical resource-contention condition are retained,
+  not relabeled as passing or used to broaden this repair.
+- Once compilation/lint finished, the unchanged full cohort passed **2,070/2,070**,
+  13 ignored, in **41.56 seconds**. The three other tests needed no source changes.
+- `cargo clippy --locked --offline --manifest-path rust/Cargo.toml -p pumas-library
+  --no-default-features --tests -- -D warnings` and Rust formatting passed.
+- These local runs used pinned Rust/Cargo 1.92.0, an isolated task target,
+  `CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0`; this changes debug metadata/cache
+  use, not optimization or assertion semantics. No package/model inference claim.
+
+## Current dependency/package observations
+
+Cargo audit completed with zero vulnerability entries, three maintenance notices,
+and one lru unsoundness warning. The concrete S3 SDK key/access path does not expose
+the warning's panicking-key/pop trigger. Current pnpm production audit has zero
+advisories; its one moderate build-only sprintf-js finding retains the existing
+owned disposition. [Dependency review](reports/dependency-review.md) retains raw
+audits, exact notice hashes and bounded source reasoning without suppression.
+Default and S3 notice inventories regenerated byte-identically (378/428 entries).
+
+The exact df53 Linux inference CI job 115716297315 passed native pinned ORT loader,
+strict production build/archive verification, authenticated owner startup/drain,
+and the real ORT/untrained-graph lifecycle. Artifact 11875745665 is 30,659,590 bytes,
+GitHub ZIP SHA-256 `2dc6dd91e0f7f6258b5f7c96a433d45653190cb939eb6bad12c4c03283627a91`.
+Evidence artifact 11875865202 ZIP SHA-256 is
+`a51626da4d0460ffd083618ffa2461ade5126bb012044789c3490c6f92e498bf`.
+These are old-candidate identities, not relabeled as the repaired source.
+
+GitHub connector retrieval of artifact 11875745665 succeeded as file reference
+`file_00000000a08081fd9504dd4b9ca6d671`; the executor's subsequent byte transfer
+was denied by its HTTP proxy tunnel (403). No ZIP bytes reached local storage,
+so inner archive/binary hashes and a local replay are unavailable, not passed.
+The same denial occurred for audio artifact 11874379748. No alternate host or
+authorization bypass was attempted. Original CI is still running; no push has
+cancelled it, and final native/model/publication gates remain explicit.
+
+## 2026-10-14 — terminal repair qualification and handoff
+
+Original Build 38522709859 completed failure: eight applicable jobs passed and
+the headless fixture failure above remained its sole failing job. Its terminal
+snapshot is [retained](reports/ci-df53-terminal.json). After that terminal result,
+committed and pushed the scoped repair as
+`aa40e155846cdac6cd94b6f5c2fd6a35cddce16e`, tree
+`f016a43b50f815f77177aafec2655e763abe3aad`.
+
+Repair Build [38526618039](https://github.com/MrScripty/Pumas-Library/actions/runs/38526618039)
+completed **success: all nine applicable jobs passed**. This includes full Rust
+quality, headless no-default/HF and RPC, enabled-S3 tests/lint, frontend/desktop,
+Linux inference review packaging, confined audio dependencies, and native source
+QA on Linux, Windows and macOS. Tag-only package/assembly jobs were skipped.
+The [final machine receipt](reports/qualification.json) retains exact job IDs,
+per-command headless totals and current artifact identities. The separately
+required ignored Linux kernel read-confinement test actually ran and passed.
+
+The exact aa40 Linux review package is artifact 11877010982, 30,659,584 bytes,
+GitHub ZIP SHA-256
+`3dfdca18419edf3b1125f2ad6e6577c2d9b480caa293e3a612d979a7bbac4303`.
+Its native pinned ORT loader, extraction/authenticated owner startup, untrained
+256-dimensional graph execution, loaded packaged-runtime identity, unload and
+graceful stop passed in CI. This establishes neither trained-model quality nor
+the final sixteen-artifact matrix. No local byte transfer of this replacement
+was attempted after the two earlier proxy denials; no inner hash is invented.
+
+Inspected Pantograph's published consumer receipt at handoff
+`3649df2d3c4c718aa278e809f27cbc2a915f8c47`: actual source
+`039cee079d273a8d4968df56a4b35e8eb8aacbbe` qualified Pumas df53 through public
+Chrema and Candle. Its owner reports 19 integration, 598 library (2 existing
+ignores), 4 HTTP tests and independent consumer review. No API repair was needed.
+The df53-to-aa40 Rust diff is solely in the existing test module; the production
+prefix is byte-identical. Parent decides final pin/lineage acceptance; this is
+not a substituted aa40 consumer run or an independent review of all PR70 changes.
+GitHub still has no submitted PR70 review or inline thread; no separate Pumas
+independent diff report was supplied.
+
+The [decision report](reports/release-blockers.md) reduces remaining release gates
+to source/review/pin acceptance, required native final artifacts, minimal trained
+model/runtime execution, final-file metadata/review and aligned final version/
+parent promotion. It explicitly excludes unrelated future capability expansion.
+The original candidate receipt remains unchanged; main remains ef9eead9 after
+refresh. Local inference artifacts and user source work remain preserved.
+
+This final followup changes evidence only. Its commit may trigger a new automatic
+Build; the terminal acceptance above belongs to immutable aa40, not an unobserved
+later documentation head. No tag, release, model download or user migration ran.
+Final mechanical checks passed: all report JSON parsed, relative Markdown links
+resolved, receipt source tree/lock/earlier-receipt hashes matched, all CI jobs were
+terminal with nine successes, artifact metadata bound aa40, and `git diff --check`.
diff --git a/docs/plans/v080-qualification/issues.md b/docs/plans/v080-qualification/issues.md
new file mode 100644
index 000000000..1f5ea3945
--- /dev/null
+++ b/docs/plans/v080-qualification/issues.md
@@ -0,0 +1,11 @@
+# Qualification issues
+
+| Finding | State / owner / next evidence |
+| --- | --- |
+| Original Build 38522709859 failed | Closed with retained terminal snapshot; eight applicable jobs passed, one fixture failed. Never relabeled green. |
+| Exact-head no-default cleanup test failed at one-second cutpoint wait | Closed on aa40: bounded fixture repair, focused/full local cohort, Clippy/format and all nine applicable Build 38526618039 jobs passed. |
+| Independent Pumas diff report not present on PR70 | Parent disposition remains open. Published independent Pantograph consumer review inspected for df53 only; not a PR70 diff review or aa40 pin adoption. |
+| Known sprintf-js moderate advisory | Existing build-only disposition; verify current exact lock path, preserve it without suppression |
+| lru 0.16.4 unsoundness notice | Reviewed exact AWS SDK cache: private String key, no panicking custom Drop or pop access. Specific advisory trigger absent; keep warning and S3-owner revisit trigger visible. |
+| Artifact transfer to executor denied | GitHub connector retrieval succeeded; executor proxy tunnel denied both audio and exact df53 inference artifact file-reference transfers with 403. Local byte inspection/replay unavailable; do not substitute old artifacts or infer inner hashes. |
+| Actual final package/model/platform acceptance | Exact aa40 Linux review archive passed real untrained ORT execution in CI. Final sixteen-artifact/native/trained-model/metadata gates remain parent/platform-owned; exact minimal list in reports/release-blockers.md. |
diff --git a/docs/plans/v080-qualification/plan.md b/docs/plans/v080-qualification/plan.md
new file mode 100644
index 000000000..1c69ed029
--- /dev/null
+++ b/docs/plans/v080-qualification/plan.md
@@ -0,0 +1,99 @@
+# v0.8 qualification continuation
+
+**Status:** Complete. **Acceptance:** Q1–Q4 evidence satisfied within stated scope;
+final source adoption and release approval remain parent-owned.
+**Current phase:** terminal qualification handoff.
+**Next slice:** parent selects the source pin and completes the remaining native
+artifact, trained-model, metadata and version/promotion gates in the decision report.
+
+## Objective and admission
+
+The parent's 2026-10-14 continuation explicitly starts this new plan after the
+accepted preparation plan. Deliver a concrete release-blocking list with actual
+CI, security, notices and package evidence. Preserve the immutable candidate
+`df53db08e2ba224edfaf713522ddd410f7d4ac44`, its earlier receipt, shared history,
+and the user's inference work. Do not assume errored continuations executed.
+No candidate/final tag, release publication or huge model download is authorized.
+Pantograph PR78 head `34dfedd27dde9a30274226e1ea26ec1e1b2de8e3` supplies a real
+cross-repository untrained-CPU fixture. Its owner qualifies the Pumas candidate
+separately; coordinate findings through the parent, without changing its pin.
+
+## Claims
+
+| ID | Observable result | Kind / environment / mode | State |
+| --- | --- | --- | --- |
+| Q1 | Build 38522709859 reaches a recorded terminal status for `df53db08`; failed applicable jobs are dispositioned | integration / required-real GitHub CI / automated | satisfied: original failed; repaired aa40 Build 38526618039 succeeded |
+| Q2 | Current Cargo/pnpm audits and default/S3 notice collection have concrete results and shipped-versus-build dispositions | contract / representative Linux plus current advisory databases / automated and manual | satisfied: raw audits, exact closure triage and identical regenerated notices |
+| Q3 | Available exact-source package identity, inventory, runtime and startup/inference evidence are inspected without overstating synthetic/pretrained or platform coverage | release-artifact / actual available target / automated and manual | satisfied: exact aa40 Linux review CI; local bytes unavailable |
+| Q4 | Independent review is inspected, or precisely recorded unavailable; only actual remaining release blockers are handed to parent | contract / real report and source evidence / manual | satisfied: published consumer review inspected; separate Pumas diff review unavailable; final gates named |
+
+## Scope and decisions
+
+Write set: this plan directory; current `docs/release-qa-0.8.0.md` and directly
+affected release-information links. Retain `v080-readiness/reports/candidate.json`
+unchanged as the immutable earlier receipt. No production change is admitted
+until a reproduced CI/review/security finding identifies its exact owning paths
+and the relevant regression/acceptance evidence is added to this plan.
+
+**Admitted repair:** CI headless job 115716297437 failed only
+`pause_is_rejected_after_final_file_commit_and_during_cleanup`: its real worker
+did not reach the fixture's terminal-cleanup observation within one second.
+The 2,069 other unit tests passed. Add only this test's bounded setup/settlement
+budget and stage diagnostics in
+`rust/crates/pumas-core/src/model_library/hf/download.rs`. This is a fixture
+admission wait, not a product latency promise; preserve both cleanup cutpoints,
+false pause admission, unchanged Downloading state until release, Completed
+settlement and zero retained destination claims. Run the focused test and full
+no-default core unit cohort, Rust format and affected lint when available.
+Rust/Async and Verification Oracles guidance apply to the test's separate worker
+runtime and blocking channel observations. No production download code, ownership
+authority or schema changes are admitted.
+
+The existing sixteen-file artifact plan, RELEASING.md and binding support matrix
+govern package claims. Native Windows/macOS and final model acceptance cannot be
+inferred from Linux source tests or untrained graph execution. Installed speech
+remains unavailable and is not promoted into a release prerequisite merely
+because its future scope exists. Unrelated consumers need not release together.
+
+Reuse current release scripts and accepted dependency dispositions. Current pnpm
+audit already distinguishes zero production advisories from the known moderate
+build-only sprintf-js finding. Audit raw counts are not shipped exposure proof.
+Use cargo-audit 0.22.2 (official crates.io package, Rust 1.88 minimum, compatible
+with pinned 1.92) under task-local tool/cache roots. Frozen JS dependency setup
+must not rewrite manifests or locks; skip dependency lifecycle scripts for notice
+collection. No home config/credentials or user libraries are qualification inputs.
+
+Canonical standards read in preparation still apply. Additional reads select
+Dependencies, Licensing and Security for current dependency/provenance review,
+and the existing Build/Release/Verification/Platforms rules for artifact claims.
+The application standards router remains unavailable; no executable certificate
+is claimed. **Composed-design review:** not-applicable, because this slice uses
+existing authorities/tools and changes evidence, not runtime composition.
+
+## Milestone and gates
+
+**Milestone:** qualified candidate evidence. **State:** Complete within scope.
+Gate Q1–Q4: retain exact SHA/run/job/artifact identities, passed/failed/skipped and
+not-run results, authoritative advisories and actual closure; inspect staged and
+cumulative diffs, commit/push the coherent handoff, update draft PR70. Do not push
+while its original exact-head run is active, to avoid cancelling that run.
+The candidate's runtime/source identity stays pinned even if a later evidence-only
+commit records its result. A source repair creates a separately named candidate.
+
+## Blockers, assumptions and stopping conditions
+
+- Both source cohorts reached terminal status. Original df53 failed one fixture;
+  repaired aa40 passed all nine applicable jobs. Tag-only jobs were skipped.
+- GitHub has no submitted reviews or inline threads for PR70; CodeRabbit states
+  drafts are not auto-reviewed. The published Pantograph consumer report was
+  inspected; no separate PR70 diff review was supplied. Parent owns disposition.
+- Package verification depends on the actual downloadable artifact and native
+  host compatibility. Inspect the existing CI-produced candidate first; do not
+  rebuild/rename a different source or treat a development binary as the package.
+- Replan before a source, dependency-resolution, workflow, migration or artifact
+  contract change. Stop expanding when current evidence identifies the minimal
+  remaining pre-tag/publication gates under the accepted release policy.
+
+[Ledger](execution-ledger.md) · [Issues](issues.md) ·
+[Prior preparation](../v080-readiness/plan.md) ·
+[Final receipt](reports/qualification.json) · [Release gates](reports/release-blockers.md)
diff --git a/docs/plans/v080-qualification/reports/cargo-audit.json b/docs/plans/v080-qualification/reports/cargo-audit.json
new file mode 100644
index 000000000..b4cd331af
--- /dev/null
+++ b/docs/plans/v080-qualification/reports/cargo-audit.json
@@ -0,0 +1 @@
+{"database":{"advisory-count":1310,"last-commit":"6aed84668c23d7f535077a9fe918bf1fa0f6a5bc","last-updated":"2026-10-13T17:07:33+02:00"},"lockfile":{"dependency-count":514},"settings":{"target_arch":[],"target_os":[],"severity":null,"ignore":[],"informational_warnings":["unmaintained","unsound","notice"]},"vulnerabilities":{"found":false,"count":0,"list":[]},"warnings":{"unmaintained":[{"kind":"unmaintained","package":{"name":"bincode","version":"1.3.3","source":"registry+https://github.com/rust-lang/crates.io-index","checksum":"b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad","dependencies":[{"name":"serde","version":"1.0.228","source":"registry+https://github.com/rust-lang/crates.io-index"}],"replace":null},"advisory":{"id":"RUSTSEC-2025-0141","package":"bincode","title":"Bincode is unmaintained","description":"Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently.\n\nThe team considers version 1.3.3 a complete version of bincode that is not in need of any updates.\n\n## Alternatives to consider\n\n* [wincode](https://crates.io/crates/wincode)\n* [postcard](https://crates.io/crates/postcard)\n* [bitcode](https://crates.io/crates/bitcode)\n* [rkyv](https://crates.io/crates/rkyv)","date":"2025-12-16","aliases":[],"related":[],"collection":"crates","categories":[],"keywords":[],"cvss":null,"informational":"unmaintained","references":[],"source":null,"url":"https://git.sr.ht/~stygianentity/bincode/tree/v3.0/item/README.md","withdrawn":null,"license":"CC0-1.0","expect-deleted":false},"affected":null,"versions":{"patched":[],"unaffected":[]}},{"kind":"unmaintained","package":{"name":"instant","version":"0.1.13","source":"registry+https://github.com/rust-lang/crates.io-index","checksum":"e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222","dependencies":[{"name":"cfg-if","version":"1.0.4","source":"registry+https://github.com/rust-lang/crates.io-index"}],"replace":null},"advisory":{"id":"RUSTSEC-2024-0384","package":"instant","title":"`instant` is unmaintained","description":"This crate is no longer maintained, and the author recommends using the maintained [`web-time`] crate instead.\n\n[`web-time`]: https://crates.io/crates/web-time","date":"2024-09-01","aliases":[],"related":[],"collection":"crates","categories":[],"keywords":[],"cvss":null,"informational":"unmaintained","references":["https://crates.io/crates/instant/0.1.13","https://github.com/sebcrozet/instant/issues/52"],"source":null,"url":null,"withdrawn":null,"license":"CC0-1.0","expect-deleted":false},"affected":null,"versions":{"patched":[],"unaffected":[]}},{"kind":"unmaintained","package":{"name":"paste","version":"1.0.15","source":"registry+https://github.com/rust-lang/crates.io-index","checksum":"57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a","replace":null},"advisory":{"id":"RUSTSEC-2024-0436","package":"paste","title":"paste - no longer maintained","description":"The creator of the crate `paste` has stated in the [`README.md`](https://github.com/dtolnay/paste/blob/master/README.md) \nthat this project is not longer maintained as well as archived the repository\n\n## Possible Alternative(s)\n\n- [`pastey`]: a fork of paste and is aimed to be a drop-in replacement with additional features for paste crate\n- [`with_builtin_macros`]: crate providing a [superset of `paste`'s functionality including general `macro_rules!` eager expansions](https://docs.rs/with_builtin_macros/0.1.0/with_builtin_macros/macro.with_eager_expansions.html)  and `concat!`/`concat_idents!` macros\n\n[`pastey`]: https://crates.io/crates/pastey\n[`with_builtin_macros`]: https://crates.io/crates/with_builtin_macros","date":"2024-10-07","aliases":[],"related":[],"collection":"crates","categories":[],"keywords":[],"cvss":null,"informational":"unmaintained","references":[],"source":null,"url":"https://github.com/dtolnay/paste","withdrawn":null,"license":"CC0-1.0","expect-deleted":false},"affected":null,"versions":{"patched":[],"unaffected":[]}}],"unsound":[{"kind":"unsound","package":{"name":"lru","version":"0.16.4","source":"registry+https://github.com/rust-lang/crates.io-index","checksum":"7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39","dependencies":[{"name":"hashbrown","version":"0.16.1","source":"registry+https://github.com/rust-lang/crates.io-index"}],"replace":null},"advisory":{"id":"RUSTSEC-2026-0253","package":"lru","title":"Potential use-after-free due to lack of panic safety in `LruCache::pop()`","description":"`LruCache::pop()` in `lru` was not panic-safe. If the `Drop` implementation of a stored key panics during `pop()`, `self.detach()` is never called, leaving dangling pointers in the internal doubly-linked list.\n\nA subsequent cache operation that triggers eviction can then dereference these dangling pointers:\n- The node is freed from the map, but remains linked in the LRU list due to the skipped `detach()` call\n- When a new insertion causes eviction, the LRU traversal encounters the dangling pointer\n- This results in a write to already-freed memory during the eviction process\n\n## Impact\n\n- **CWE-416 (Use-After-Free):** memory corruption when subsequent cache operations access freed node pointers in the linked list\n- **CWE-415 (Double Free):** potential heap corruption when the same memory is freed multiple times\n\nBoth types of undefined behavior can be invoked in safe Rust, but only if unwinding panics are enabled and `std::panic::catch_unwind` is used with key types that have potentially-panicking `Drop` implementations.\n\n## Fix\n\nFixed in `lru` 0.18.2 by detaching the node from the linked list before freeing it and dropping the key ([lru-rs#238](https://github.com/jeromefroe/lru-rs/pull/238)).","date":"2026-05-12","aliases":[],"related":[],"collection":"crates","categories":["memory-corruption"],"keywords":["panic-safety","memory-safety","use-after-free","double-free"],"cvss":null,"informational":"unsound","references":[],"source":null,"url":"https://github.com/jeromefroe/lru-rs/pull/238","withdrawn":null,"license":"CC0-1.0","expect-deleted":false},"affected":null,"versions":{"patched":[">=0.18.2"],"unaffected":[]}}]}}
diff --git a/docs/plans/v080-qualification/reports/ci-df53-headless-failure.txt b/docs/plans/v080-qualification/reports/ci-df53-headless-failure.txt
new file mode 100644
index 000000000..6fa5ad4b2
--- /dev/null
+++ b/docs/plans/v080-qualification/reports/ci-df53-headless-failure.txt
@@ -0,0 +1,19 @@
+Source: df53db08e2ba224edfaf713522ddd410f7d4ac44
+Build: 38522709859
+Job: 115716297437 (Headless without inference plugins)
+URL: https://github.com/MrScripty/Pumas-Library/actions/runs/38522709859/job/115716297437
+Decoded log excerpt retrieved on 2026-10-14; ANSI and trailing whitespace normalized:
+
+2026-10-14T06:45:23.1398056Z ---- model_library::hf::download::tests::pause_is_rejected_after_final_file_commit_and_during_cleanup stdout ----
+2026-10-14T06:45:23.1398952Z
+2026-10-14T06:45:23.1400136Z thread 'model_library::hf::download::tests::pause_is_rejected_after_final_file_commit_and_during_cleanup' (8208) panicked at crates/pumas-core/src/model_library/hf/download.rs:16589:18:
+2026-10-14T06:45:23.1401670Z Worker must reach terminal cleanup: Timeout
+2026-10-14T06:45:23.1402318Z
+2026-10-14T06:45:23.1402324Z
+2026-10-14T06:45:23.1402487Z failures:
+2026-10-14T06:45:23.1403260Z     model_library::hf::download::tests::pause_is_rejected_after_final_file_commit_and_during_cleanup
+2026-10-14T06:45:23.1404069Z
+2026-10-14T06:45:23.1404635Z test result: FAILED. 2069 passed; 1 failed; 13 ignored; 0 measured; 0 filtered out; finished in 79.22s
+2026-10-14T06:45:23.1405425Z
+2026-10-14T06:45:23.1586758Z error: test failed, to rerun pass `-p pumas-library --lib`
+2026-10-14T06:45:23.2293933Z ##[error]Process completed with exit code 101.
diff --git a/docs/plans/v080-qualification/reports/ci-df53-terminal.json b/docs/plans/v080-qualification/reports/ci-df53-terminal.json
new file mode 100644
index 000000000..e83b8ee6d
--- /dev/null
+++ b/docs/plans/v080-qualification/reports/ci-df53-terminal.json
@@ -0,0 +1,187 @@
+{
+  "source_revision": "df53db08e2ba224edfaf713522ddd410f7d4ac44",
+  "run_id": 38522709859,
+  "url": "https://github.com/MrScripty/Pumas-Library/actions/runs/38522709859",
+  "status": "completed",
+  "conclusion": "failure",
+  "observed": "2026-10-14",
+  "jobs": [
+    {
+      "id": 115716122649,
+      "name": "Workflow and release contracts",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 115716297315,
+      "name": "Review Linux inference candidate",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 115716297392,
+      "name": "Rust quality",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 115716297437,
+      "name": "Headless without inference plugins",
+      "status": "completed",
+      "conclusion": "failure",
+      "failed_steps": [
+        "Run cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features"
+      ]
+    },
+    {
+      "id": 115716297441,
+      "name": "Frontend and desktop contracts",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 115716297465,
+      "name": "Torch native QA (macos-15)",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 115716297515,
+      "name": "Review confined audio dependencies",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 115716297522,
+      "name": "Torch native QA (windows-2025)",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 115716297562,
+      "name": "Torch native QA (ubuntu-24.04)",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 115716298865,
+      "name": "Torch native RPC E2E (${{ matrix.os }})",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115716299008,
+      "name": "Rust release (${{ matrix.os }})",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115716299071,
+      "name": "Inference headless candidate (${{ matrix.target }})",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115716299301,
+      "name": "Headless archive (${{ matrix.headless_os }})",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115718210702,
+      "name": "Desktop package without inference (win)",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115718210755,
+      "name": "Rust release (windows-2025)",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115718210942,
+      "name": "Linux release startup",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115718211412,
+      "name": "Desktop package without inference (${{ matrix.platform }})",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115718211418,
+      "name": "Desktop package (${{ matrix.platform }})",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 115728209246,
+      "name": "Assemble release candidate",
+      "status": "completed",
+      "conclusion": "skipped"
+    }
+  ],
+  "artifacts": [
+    {
+      "id": 11875865202,
+      "name": "review-inference-evidence-linux-x86_64",
+      "size_in_bytes": 38521,
+      "url": "https://api.github.com/repos/MrScripty/Pumas-Library/actions/artifacts/11875865202",
+      "archive_download_url": "https://api.github.com/repos/MrScripty/Pumas-Library/actions/artifacts/11875865202/zip",
+      "expired": false,
+      "created_at": "2026-10-14T06:58:46Z",
+      "expires_at": "2026-10-21T06:58:45Z",
+      "updated_at": "2026-10-14T06:58:46Z",
+      "digest": "sha256:a51626da4d0460ffd083618ffa2461ade5126bb012044789c3490c6f92e498bf",
+      "workflow_run": {
+        "id": 38522709859,
+        "repository_id": 1118589530,
+        "head_repository_id": 1118589530,
+        "head_branch": "readiness/v080-20261014",
+        "head_sha": "df53db08e2ba224edfaf713522ddd410f7d4ac44"
+      }
+    },
+    {
+      "id": 11875745665,
+      "name": "review-inference-linux-x86_64",
+      "size_in_bytes": 30659590,
+      "url": "https://api.github.com/repos/MrScripty/Pumas-Library/actions/artifacts/11875745665",
+      "archive_download_url": "https://api.github.com/repos/MrScripty/Pumas-Library/actions/artifacts/11875745665/zip",
+      "expired": false,
+      "created_at": "2026-10-14T06:58:45Z",
+      "expires_at": "2026-10-21T06:58:44Z",
+      "updated_at": "2026-10-14T06:58:45Z",
+      "digest": "sha256:2dc6dd91e0f7f6258b5f7c96a433d45653190cb939eb6bad12c4c03283627a91",
+      "workflow_run": {
+        "id": 38522709859,
+        "repository_id": 1118589530,
+        "head_repository_id": 1118589530,
+        "head_branch": "readiness/v080-20261014",
+        "head_sha": "df53db08e2ba224edfaf713522ddd410f7d4ac44"
+      }
+    },
+    {
+      "id": 11874379748,
+      "name": "review-audio-dependency-evidence-linux",
+      "size_in_bytes": 14477,
+      "url": "https://api.github.com/repos/MrScripty/Pumas-Library/actions/artifacts/11874379748",
+      "archive_download_url": "https://api.github.com/repos/MrScripty/Pumas-Library/actions/artifacts/11874379748/zip",
+      "expired": false,
+      "created_at": "2026-10-14T06:48:05Z",
+      "expires_at": "2026-10-21T06:48:04Z",
+      "updated_at": "2026-10-14T06:48:05Z",
+      "digest": "sha256:effe0e880f823f305e59baad54cc450a220e9897273dd5c4a7baacb835113e9c",
+      "workflow_run": {
+        "id": 38522709859,
+        "repository_id": 1118589530,
+        "head_repository_id": 1118589530,
+        "head_branch": "readiness/v080-20261014",
+        "head_sha": "df53db08e2ba224edfaf713522ddd410f7d4ac44"
+      }
+    }
+  ],
+  "qualification_limit": "Native source/Torch tests and Linux untrained inference package job passed; no final release matrix or trained-model acceptance."
+}
diff --git a/docs/plans/v080-qualification/reports/dependency-review.md b/docs/plans/v080-qualification/reports/dependency-review.md
new file mode 100644
index 000000000..7d94b047e
--- /dev/null
+++ b/docs/plans/v080-qualification/reports/dependency-review.md
@@ -0,0 +1,79 @@
+# Current locked dependency and notice qualification
+
+Candidate: `df53db08e2ba224edfaf713522ddd410f7d4ac44`, version 0.8.0-rc.1.
+Inspection date: 2026-10-14. The cleanup-fixture repair changes no dependency
+manifest, lockfile or notice input. This review concerns the current closure,
+not a claim that a clean scanner proves the complete artifact secure.
+
+## Cargo
+
+`cargo-audit 0.22.2 audit --file rust/Cargo.lock --db
+/tmp/pumas-v080-advisory-db --json` exited 0. Official advisory database commit
+`6aed84668c23d7f535077a9fe918bf1fa0f6a5bc`, updated 2026-10-13, contains
+1,310 advisories; the lockfile contains 514 packages. The
+[raw result](cargo-audit.json) reports **zero vulnerability entries**, three
+maintenance notices and one unsoundness notice. No ignore/suppression was used.
+
+| Notice | Actual locked consumer and disposition |
+| --- | --- |
+| `bincode 1.3.3`, RUSTSEC-2025-0141 | UniFFI macro/build tooling; existing maintenance follow-up, not a new security exploit finding. Host bindings still have no accepted release tuple. |
+| `instant 0.1.13`, RUSTSEC-2024-0384 | notify-types → notify → core; retain the maintenance follow-up with the filesystem-watcher owner. |
+| `paste 1.0.15`, RUSTSEC-2024-0436 | Macro dependency through tokenizers and UniFFI tooling; retain existing maintenance tracking. |
+| `lru 0.16.4`, [RUSTSEC-2026-0253](https://rustsec.org/advisories/RUSTSEC-2026-0253.html) | Present in the S3 shipping closure only through aws-sdk-s3 1.137.0. The advisory's specific panic-safety trigger is absent from the inspected consumer; see below. |
+
+The lru advisory concerns `pop()`: a stored key's destructor panics before the
+node is detached, then a later cache operation follows a dangling pointer. It
+requires unwinding/catching that panic and a potentially panicking key destructor.
+The locked SDK's sole LruCache owner is `S3ExpressIdentityCache`, whose private
+`CacheKey(String)` has derived traits and no custom Drop. Its operational access
+is `get_or_insert_mut`; it exposes no caller-supplied key implementation or `pop`
+call. A plain String key cannot supply the required panicking custom destructor.
+This source observation disposes the current trigger; it does not repair or
+declare the upstream generic container sound.
+
+Inspected official crate member:
+`aws-sdk-s3-1.137.0/src/s3_express.rs`, SHA-256
+`033da02f9bc2ae4f74fbd5393503cf770fd5a19b53c3565af2a72c862e29749d`.
+`cargo tree --locked --offline --manifest-path rust/Cargo.toml -p pumas-rpc
+--no-default-features --features s3 -i lru --edges normal,build --prefix none`
+establishes the actual S3 path. Keep the raw warning visible. The S3 dependency
+owner must revisit on SDK/key/cache use changes or an accepted compatible upstream
+upgrade; no forced incompatible lru override is part of this release slice.
+
+## JavaScript
+
+Fresh pnpm 10.33.0 audits used the unchanged frozen lockfile:
+
+- [Production audit](pnpm-audit-production.json): zero advisories, exit 0.
+- [All-dependency audit](pnpm-audit-all.json): one moderate advisory, exit 1,
+  [GHSA-hp3w-g68c-fv3c](https://github.com/advisories/GHSA-hp3w-g68c-fv3c),
+  sprintf-js 1.1.3; no patched version reported.
+
+The current path remains `electron-builder → app-builder-lib → @electron/get →
+global-agent → roarr → sprintf-js`. This is build tooling, absent from the
+production audit closure. The existing [dependency decision](../../../dependency-review-0.7.0.md)
+retains that risk pending a compatible parent/upstream removal. This continuation
+adds no suppression and no major dependency replacement. GitHub's generic
+52-alert push notice is not substituted for these exact-lock results or treated
+as 52 confirmed shipped vulnerabilities.
+
+## Notices and license inventory
+
+Frozen pnpm installation used `--ignore-scripts` and task-owned data/cache/store
+paths. The first default-home attempt failed before installation; no home access
+or lockfile rewrite was used. `cargo fetch --locked` supplied missing target crate
+sources before the existing generator could run offline.
+
+Regenerated into disposable output directories using
+`python3 scripts/release/generate-notices.py --output DIR` and its `--features s3`
+variant. Both notice text and inventory are **byte-identical** to the checked-in
+versioned collections:
+
+| Collection | Entries | Notice SHA-256 | Inventory SHA-256 |
+| --- | --- | --- | --- |
+| Default | 378 | `5e5e273c6d4a24563d91de8d9d349413481da992d714438d80e884d61eb13dfc` | `ed9af5ce215f4d1d7a4f868bcd00e1d2ca14945addbe759911ee2cbddcc28d60` |
+| S3 | 428 | `abf171b832a35b70752979877aaab3b9ad3fdbf2e9cb2a034e2bce3a832134df` | `a4ff1463884e0e891143db7e3868afdcacce4569da97796ae2bb3fd9bf499501` |
+
+This checks authoritative collected text, closure and freshness under the existing
+license policy. Final per-artifact inclusion, native dependency coverage, SBOM,
+provenance and final-byte checksums remain artifact-specific release gates.
diff --git a/docs/plans/v080-qualification/reports/pnpm-audit-all.json b/docs/plans/v080-qualification/reports/pnpm-audit-all.json
new file mode 100644
index 000000000..6fac15b22
--- /dev/null
+++ b/docs/plans/v080-qualification/reports/pnpm-audit-all.json
@@ -0,0 +1,58 @@
+{
+  "actions": [],
+  "advisories": {
+    "1241202": {
+      "findings": [
+        {
+          "version": "1.1.3",
+          "paths": [
+            "electron>electron-builder>app-builder-lib>@electron/get>global-agent>roarr>sprintf-js"
+          ]
+        }
+      ],
+      "found_by": null,
+      "deleted": null,
+      "references": "- https://nvd.nist.gov/vuln/detail/CVE-2026-97058\n- https://github.com/alexei/sprintf.js/issues/237\n- https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L17\n- https://github.com/alexei/sprintf.js/blob/3a0d8c26d291b5bd9f1974877ecc50739921d6f5/src/sprintf.js#L84-L90\n- https://www.vulncheck.com/advisories/sprintf-js-through-1.1.3-denial-of-service-via-unbounded-precision\n- https://github.com/advisories/GHSA-hp3w-g68c-fv3c",
+      "created": "2026-09-24T15:31:31.000Z",
+      "id": 1241202,
+      "npm_advisory_id": null,
+      "overview": "sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.",
+      "reported_by": null,
+      "title": "sprintf-js vulnerable to denial of service through unbounded precision specifiers",
+      "metadata": null,
+      "cves": [
+        "CVE-2026-97058"
+      ],
+      "access": "public",
+      "severity": "moderate",
+      "module_name": "sprintf-js",
+      "vulnerable_versions": "<=1.1.3",
+      "github_advisory_id": "GHSA-hp3w-g68c-fv3c",
+      "recommendation": "None",
+      "patched_versions": "<0.0.0",
+      "updated": "2026-10-05T23:47:35.000Z",
+      "cvss": {
+        "score": 5.3,
+        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+      },
+      "cwe": [
+        "CWE-1284"
+      ],
+      "url": "https://github.com/advisories/GHSA-hp3w-g68c-fv3c"
+    }
+  },
+  "muted": [],
+  "metadata": {
+    "vulnerabilities": {
+      "info": 0,
+      "low": 0,
+      "moderate": 1,
+      "high": 0,
+      "critical": 0
+    },
+    "dependencies": 707,
+    "devDependencies": 0,
+    "optionalDependencies": 0,
+    "totalDependencies": 707
+  }
+}
diff --git a/docs/plans/v080-qualification/reports/pnpm-audit-production.json b/docs/plans/v080-qualification/reports/pnpm-audit-production.json
new file mode 100644
index 000000000..3db564c75
--- /dev/null
+++ b/docs/plans/v080-qualification/reports/pnpm-audit-production.json
@@ -0,0 +1,18 @@
+{
+  "actions": [],
+  "advisories": {},
+  "muted": [],
+  "metadata": {
+    "vulnerabilities": {
+      "info": 0,
+      "low": 0,
+      "moderate": 0,
+      "high": 0,
+      "critical": 0
+    },
+    "dependencies": 24,
+    "devDependencies": 0,
+    "optionalDependencies": 0,
+    "totalDependencies": 24
+  }
+}
diff --git a/docs/plans/v080-qualification/reports/qualification.json b/docs/plans/v080-qualification/reports/qualification.json
new file mode 100644
index 000000000..4fdc75f62
--- /dev/null
+++ b/docs/plans/v080-qualification/reports/qualification.json
@@ -0,0 +1,341 @@
+{
+  "schema_version": 1,
+  "date": "2026-10-14",
+  "repository": "MrScripty/Pumas-Library",
+  "source": {
+    "qualified_commit": "aa40e155846cdac6cd94b6f5c2fd6a35cddce16e",
+    "tree": "f016a43b50f815f77177aafec2655e763abe3aad",
+    "base_main": "ef9eead9fe6595f5b3152ef8df19c5dace30190b",
+    "version": "0.8.0-rc.1",
+    "branch": "readiness/v080-20261014",
+    "draft_pr": "https://github.com/MrScripty/Pumas-Library/pull/70",
+    "evidence_commit": "This receipt is recorded in a subsequent documentation-only commit; qualified code identity remains the commit above.",
+    "locks": {
+      "rust_sha256": "91fb9823de2f0346211b4f68ca400f03a628890e55dca90e0803e2dd7ad47e42",
+      "pnpm_sha256": "78cac9b50e2f28d293420ffb8b9d57889a723669a3969b3a670dd3e6cbfdda18"
+    }
+  },
+  "lineage": {
+    "original_commit": "df53db08e2ba224edfaf713522ddd410f7d4ac44",
+    "rust_change": "Only pause_is_rejected_after_final_file_commit_and_during_cleanup inside the existing cfg(test) module of model_library/hf/download.rs; bounded fixture readiness/settlement and diagnostics.",
+    "unchanged_production_prefix_bytes": 284377,
+    "unchanged_production_prefix_sha256": "1cdc30e4f30b2f41104ee153bd63f9be7709aebd832084f33be109bee095d5d8",
+    "production_api_schema_dependencies_changed": false,
+    "earlier_receipt": "../../v080-readiness/reports/candidate.json",
+    "earlier_receipt_sha256": "617b7fb1ec18c04274d7ad56d346d0a8e6d62b2b3358b1b1f18a139715fdb814"
+  },
+  "ci": {
+    "run_id": 38526618039,
+    "run_number": 574,
+    "url": "https://github.com/MrScripty/Pumas-Library/actions/runs/38526618039",
+    "status": "completed",
+    "conclusion": "success",
+    "applicable_jobs_passed": 9,
+    "jobs": [
+      {
+        "id": 115728372231,
+        "name": "Workflow and release contracts",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728538912,
+        "name": "Headless without inference plugins",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728538931,
+        "name": "Frontend and desktop contracts",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728538932,
+        "name": "Rust quality",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728538975,
+        "name": "Review Linux inference candidate",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728538977,
+        "name": "Review confined audio dependencies",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728538999,
+        "name": "Torch native QA (windows-2025)",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728539123,
+        "name": "Torch native QA (ubuntu-24.04)",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728539127,
+        "name": "Torch native QA (macos-15)",
+        "status": "completed",
+        "conclusion": "success"
+      },
+      {
+        "id": 115728540414,
+        "name": "Torch native RPC E2E (${{ matrix.os }})",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115728540645,
+        "name": "Inference headless candidate (${{ matrix.target }})",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115728541011,
+        "name": "Headless archive (${{ matrix.headless_os }})",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115728541119,
+        "name": "Rust release (${{ matrix.os }})",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115730622921,
+        "name": "Desktop package without inference (win)",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115730623293,
+        "name": "Desktop package (${{ matrix.platform }})",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115730623420,
+        "name": "Rust release (windows-2025)",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115730623574,
+        "name": "Linux release startup",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115730623753,
+        "name": "Desktop package without inference (${{ matrix.platform }})",
+        "status": "completed",
+        "conclusion": "skipped"
+      },
+      {
+        "id": 115741444416,
+        "name": "Assemble release candidate",
+        "status": "completed",
+        "conclusion": "skipped"
+      }
+    ],
+    "headless_command_totals": {
+      "cargo test --locked --offline --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --features s3 --test s3_reader --test s3_acquisition -- --test-threads=1": {
+        "passed": 58,
+        "failed": 0,
+        "ignored": 0
+      },
+      "cargo test --locked --offline --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --features s3 --lib acquisition::s3:: -- --test-threads=1": {
+        "passed": 43,
+        "failed": 0,
+        "ignored": 2
+      },
+      "cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features": {
+        "passed": 2294,
+        "failed": 0,
+        "ignored": 29
+      },
+      "cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features platform::audio_read_boundary::tests::kernel_exec_denies_unselected_reads_and_ambient_descriptors -- --ignored --exact --nocapture": {
+        "passed": 1,
+        "failed": 0,
+        "ignored": 0
+      },
+      "cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --features hf-client": {
+        "passed": 2294,
+        "failed": 0,
+        "ignored": 29
+      },
+      "cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc --no-default-features": {
+        "passed": 257,
+        "failed": 0,
+        "ignored": 13
+      }
+    },
+    "original_run": {
+      "run_id": 38522709859,
+      "status": "completed",
+      "conclusion": "failure",
+      "applicable_jobs_passed": 8,
+      "failing_job": 115716297437,
+      "failed_test": "pause_is_rejected_after_final_file_commit_and_during_cleanup",
+      "evidence": "ci-df53-terminal.json"
+    }
+  },
+  "local_repair": {
+    "toolchain": "Rust/Cargo 1.92.0; Linux x86_64",
+    "environment": "CARGO_INCREMENTAL=0 CARGO_PROFILE_DEV_DEBUG=0 CARGO_TARGET_DIR=/tmp/pumas-v080-qualification-target",
+    "focused": {
+      "passed": 1,
+      "ignored": 0,
+      "seconds": 0.67
+    },
+    "full_units_sequential": {
+      "passed": 2070,
+      "failed": 0,
+      "ignored": 13,
+      "seconds": 41.56
+    },
+    "earlier_contended_run": {
+      "passed": 2067,
+      "failed": 3,
+      "ignored": 13,
+      "seconds": 147.74,
+      "disposition": "Ran concurrently with compilation/Clippy; three unrelated bounded fixtures timed out. Unchanged sequential cohort passed; no edits to those tests."
+    },
+    "clippy": "passed: cargo clippy --locked --offline --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --tests -- -D warnings",
+    "rustfmt": "passed"
+  },
+  "security": {
+    "cargo_audit_version": "0.22.2",
+    "advisory_database_commit": "6aed84668c23d7f535077a9fe918bf1fa0f6a5bc",
+    "cargo_lock_packages": 514,
+    "cargo_vulnerability_entries": 0,
+    "cargo_maintenance_notices": 3,
+    "cargo_unsoundness_notices": 1,
+    "lru_disposition": "RUSTSEC-2026-0253 retained. Shipping consumer AWS SDK S3 1.137.0 uses private CacheKey(String), no custom panicking Drop or pop access; inspected trigger absent, revisit on consumer change.",
+    "pnpm_production_advisories": 0,
+    "pnpm_all_advisories": {
+      "moderate": 1,
+      "advisory": "GHSA-hp3w-g68c-fv3c",
+      "package": "sprintf-js 1.1.3",
+      "disposition": "Existing build-only electron-builder dependency path; no suppression or major override."
+    },
+    "review": "dependency-review.md",
+    "raw": [
+      "cargo-audit.json",
+      "pnpm-audit-production.json",
+      "pnpm-audit-all.json"
+    ],
+    "notices": {
+      "default_entries": 378,
+      "s3_entries": 428,
+      "text_and_inventory_regenerated_byte_identically": true
+    }
+  },
+  "artifacts": {
+    "source": "Authenticated GitHub workflow metadata; hashes cover outer ZIP files.",
+    "items": [
+      {
+        "id": 11877010982,
+        "name": "review-inference-linux-x86_64",
+        "size_in_bytes": 30659584,
+        "github_zip_digest": "sha256:3dfdca18419edf3b1125f2ad6e6577c2d9b480caa293e3a612d979a7bbac4303",
+        "expires_at": "2026-10-21T07:26:29Z",
+        "source_revision": "aa40e155846cdac6cd94b6f5c2fd6a35cddce16e"
+      },
+      {
+        "id": 11876891933,
+        "name": "review-inference-evidence-linux-x86_64",
+        "size_in_bytes": 35263,
+        "github_zip_digest": "sha256:f321f82c812a3853be83dd87a03f29f52d93b7e016ad1d422ded7dfeb91b741c",
+        "expires_at": "2026-10-21T07:26:31Z",
+        "source_revision": "aa40e155846cdac6cd94b6f5c2fd6a35cddce16e"
+      },
+      {
+        "id": 11876861099,
+        "name": "review-audio-dependency-evidence-linux",
+        "size_in_bytes": 10686,
+        "github_zip_digest": "sha256:979d4b4928074b2734808b43a66fc70000d2258b23c3d24e1c5b10e2de4ccea3",
+        "expires_at": "2026-10-21T07:21:57Z",
+        "source_revision": "aa40e155846cdac6cd94b6f5c2fd6a35cddce16e"
+      }
+    ],
+    "ci_execution": "Exact-source optimized Linux inference archive, pinned official CPU ORT 1.24.2 native loader/API24, extraction/inventory, authenticated startup, actual untrained ONNX import/load/finite 256-dimensional embeddings/unload/packaged-runtime identity/graceful stop passed.",
+    "audio_scope": "Frozen dependency imports and CPU operation plus three controlled lifecycle tests; production_available=false, child_tree_drained=true; no ASR acceptance.",
+    "local_bytes": {
+      "status": "unavailable",
+      "attempted_artifacts": [
+        11875745665,
+        11874379748
+      ],
+      "connector_retrieval": "succeeded",
+      "executor_transfer": "denied by HTTP proxy tunnel 403; no bytes received",
+      "bypass_attempted": false,
+      "inner_archive_and_binary_hashes": null,
+      "local_replay": "not_run",
+      "current_aa40_byte_transfer": "not attempted after identical df53 transfer denials"
+    }
+  },
+  "consumer": {
+    "receipt": "https://github.com/MrScripty/Pantograph/blob/3649df2d3c4c718aa278e809f27cbc2a915f8c47/docs/plans/pumas-pr70-cpu-consumer/reports/consumer-compatibility.md",
+    "pantograph_source": "039cee079d273a8d4968df56a4b35e8eb8aacbbe",
+    "handoff": "3649df2d3c4c718aa278e809f27cbc2a915f8c47",
+    "pumas_pin": "df53db08e2ba224edfaf713522ddd410f7d4ac44",
+    "chrema": "508c8b8cb724b49c655dab8bc4c8336190e516c7",
+    "candle": "88ed7911de9e88196b1f55b199145d22647f415e",
+    "owner_reported_tests": {
+      "integration": 19,
+      "library_passed": 598,
+      "library_existing_ignored": 2,
+      "http": 4
+    },
+    "independent_consumer_review": "accepted; actual public Chrema/Pumas untrained CPU composition",
+    "scope": "Published owner evidence, not rerun here; does not silently accept aa40 pin or hosted/pretrained scopes."
+  },
+  "review": {
+    "github_reviews": 0,
+    "github_inline_threads": 0,
+    "independent_pumas_diff_report": "not supplied",
+    "consumer_report_inspected": true,
+    "final_source_acceptance_owner": "parent"
+  },
+  "remaining_release_gates": [
+    "Parent accepts source/review and actual consumer pin or explicit lineage disposition.",
+    "Ten desktop and six headless final native artifacts and required extraction/install/start/recovery/termination qualification.",
+    "Reviewed trained model/tokenizer fixture and real packaged-runtime inference on required Linux/Windows/macOS inference targets.",
+    "Final-file licenses/notices, per-artifact SPDX, aggregate in-toto provenance/checksums and maintainer review.",
+    "Separate aligned 0.8.0 version commit, affected verification/rebuild and parent promotion decision."
+  ],
+  "not_run": [
+    "trained/pretrained model inference",
+    "GPU/hardware inference qualification",
+    "Windows/macOS final packaged model execution",
+    "sixteen-file final artifact set and final-file metadata",
+    "live AWS/non-AWS/MinIO provider qualification",
+    "user library migration",
+    "tag or release publication"
+  ],
+  "migration": {
+    "authority": "../../../library-upgrade.md",
+    "schema": 7,
+    "mode": "explicit offline conversion with all readers/writers stopped and exact metadata-only backup",
+    "automatic_downgrade": false,
+    "user_models_touched": false
+  },
+  "promotion": {
+    "executed": false,
+    "owner": "parent/maintainer",
+    "source_pin_requires_tag": false,
+    "final_tag": "v0.8.0 only after separate aligned final-version commit and all accepted pre-tag QA; exact SHA selected by parent",
+    "candidate_tag": "v0.8.0-rc.1 only if parent selects the current prerelease cohort after its required gates"
+  },
+  "decision_report": "release-blockers.md"
+}
diff --git a/docs/plans/v080-qualification/reports/release-blockers.md b/docs/plans/v080-qualification/reports/release-blockers.md
new file mode 100644
index 000000000..db9c5573b
--- /dev/null
+++ b/docs/plans/v080-qualification/reports/release-blockers.md
@@ -0,0 +1,103 @@
+# Release decision for the v0.8 source cohort
+
+Status: source CI qualified; release remains blocked. Original Build 38522709859
+is terminal failure (eight applicable jobs passed; headless failed its one-second
+fixture cutpoint). Repair Build
+[38526618039](https://github.com/MrScripty/Pumas-Library/actions/runs/38526618039)
+completed successfully on aa40: all nine applicable jobs passed. Tag-only package
+and assembly jobs were skipped. [The final receipt](qualification.json) binds
+source, jobs and artifacts. No tag or publication decision is made here.
+
+## Source and evidence identities
+
+- Original reviewed candidate: `df53db08e2ba224edfaf713522ddd410f7d4ac44`.
+- Bounded cleanup-fixture repair: `aa40e155846cdac6cd94b6f5c2fd6a35cddce16e`.
+  Only test code and qualification records changed; no production timeout,
+  public API, persisted schema, dependency pin or inference policy changed.
+- Pantograph's separate [consumer receipt](https://github.com/MrScripty/Pantograph/blob/3649df2d3c4c718aa278e809f27cbc2a915f8c47/docs/plans/pumas-pr70-cpu-consumer/reports/consumer-compatibility.md)
+  accepts the bounded local CPU edge on source
+  `039cee079d273a8d4968df56a4b35e8eb8aacbbe` with Pumas df53, public Chrema
+  `508c8b8cb724b49c655dab8bc4c8336190e516c7` and Candle
+  `88ed7911de9e88196b1f55b199145d22647f415e`. Handoff commit is
+  `3649df2d3c4c718aa278e809f27cbc2a915f8c47`. Nineteen integration contracts,
+  598 library tests (2 existing ignores), 4 HTTP contracts and independent
+  consumer review passed; no API repair was needed. The original PR78 baseline
+  still pins aa1d79ae. These are the consumer owner's published observations,
+  not tests rerun in this executor or acceptance against aa40.
+
+The only Rust-file change from df53 to aa40 is inside the existing `cfg(test)`
+module of `hf/download.rs`. Its 284,377-byte prefix before that module is
+identical, SHA-256 `1cdc30e4f30b2f41104ee153bd63f9be7709aebd832084f33be109bee095d5d8`;
+no other Rust path changed. This is reviewed source lineage, not a claim of
+byte-identical binaries or automatic transfer of an independently pinned receipt.
+
+## Concrete remaining gates
+
+| Gate | Current obstruction | Exact completion evidence / owner |
+| --- | --- | --- |
+| Final source review and actual consumer pin adoption | Independent consumer review accepted the df53 edge. The aa40 repair is test-only, but final pin adoption/lineage acceptance is parent-owned. No separate PR70 independent diff review has been supplied or submitted on GitHub. | Parent accepts the final source/evidence, maps the df53 consumer receipt to the selected pin or requests its locked rerun, and dispositions the referenced review report with its actual SHA/scope. This requires no new Chrema SDK or unrelated repository release. |
+| Required native artifact set and workflows | The exact aa40 Linux inference review archive passed its native job. Tag-only desktop, no-inference and three-target inference publication jobs are skipped on PRs. A source-quality pass is not the sixteen-file candidate. | Produce the accepted source/version's ten desktop installers and six headless archives. Apply RELEASING.md's exact extraction, native install/start, desktop/root-recovery and termination procedures on Linux x86_64, Windows x86_64 and macOS ARM64. Retain exact source/target/features/artifact hashes. Parent/native platform owners own this gate; this task does not authorize a tag to bypass pre-tag QA. |
+| Required trained model and native-runtime execution | Linux review proves import/load/finite 256-dimensional execution/unload/graceful stop of an untrained graph through pinned ORT. No reviewed trained Nomic model/tokenizer fixture was provided here. Native Windows/macOS packaged model execution is absent. | Supply one exact reviewed trained model/tokenizer fixture and retain its hashes. Run `verify-packaged-onnx.py EXTRACTED_RPC NOMIC_DIRECTORY` on Linux with packaged CPU ORT 1.24.2; on Windows/macOS retain equivalent native request, loaded packaged-runtime identity, finite inference, unload and graceful-stop evidence. The artifact plan requires this on each inference target. This does not require enabling production speech or testing every future model. |
+| Final-file release metadata and maintainer review | Current source default/S3 notices regenerate byte-identically and current audits are triaged, but no final sixteen-artifact set exists from which to produce complete metadata. | On the actual final files, verify embedded license/notices, generate each SPDX inventory, aggregate in-toto provenance and SHA-256 checksums over all other final files. Maintainer accepts the notices/current vulnerability results against the shipped closure. Source inventories alone do not satisfy final-file coverage. |
+| Final 0.8.0 identity and promotion | Current manifests remain 0.8.0-rc.1; they cannot be tagged v0.8.0. | Parent selects the compatible checkpoint, aligns final manifests/workspace lock entries and versioned notices without incidental dependency resolution, reruns affected checks and rebuilds final artifacts. Only then can the parent authorize the exact final tag and later publication. |
+
+These gates follow `scripts/release/artifact-plan.json`, RELEASING.md and the
+current binding support matrix. Unrelated repository releases, new SDKs, installed
+production speech, custom Torch assembly, download-location reconciliation and
+other proposed features are not added to the blocking list. Tuldok trained vision
+acceptance is required for a demo that promises it; it is not a dependency of
+Pantograph's untrained CPU source demonstration.
+The acquisition plan's AQ-HTTP/AQ-S3/AQ-COMPLETE gates still own their named runtime,
+provider and full-plan claims. Current controlled S3 protocol tests do not accept
+live AWS/non-AWS/MinIO combinations. Those broader claims are not introduced as
+hidden prerequisites for the local, zero-acquisition-byte CPU source edge.
+
+## Closed or bounded findings
+
+- Repair Build 38526618039 passed all nine applicable jobs, including native
+  Linux/Windows/macOS source QA, Rust quality, frontend/desktop, actual Linux
+  inference packaging and confined audio dependencies. Its no-default and HF
+  core cohorts each passed 2,294 tests with 29 ignored; RPC passed 257 with 13
+  ignored. The required ignored Linux kernel read-confinement proof was separately
+  executed and passed. Enabled S3 reader/acquisition tests passed 58, signing/prefix
+  tests passed 43 with 2 ignored, and S3 warning-deny lint passed. Zero-test
+  feature-gated targets do not qualify disabled features.
+- Earlier catalogue timing failure did not reproduce in the complete local
+  no-default core cohort; retain its evidence boundary rather than resurrecting it.
+- Fresh Cargo audit: zero vulnerability entries, three maintenance notices, one
+  lru unsoundness notice whose trigger is absent from the exact SDK key/access
+  path. Fresh pnpm production audit: zero advisories. The one moderate build-only
+  sprintf-js advisory retains its existing disposition, without suppression.
+  See [the dependency review](dependency-review.md).
+- Default/S3 notice text and inventories regenerated identically: 378/428 entries.
+- Schema-7 migration remains explicit and offline, with all readers/writers
+  stopped and an exact metadata-only backup. It provides no automatic downgrade,
+  model backup or dead-PID claim deletion. No user library was migrated here.
+
+## Executor limitation separate from product failures
+
+GitHub successfully retrieved audio artifact 11874379748 and exact df53 Linux
+inference artifact 11875745665 into file references. This executor's HTTP proxy
+denied both subsequent byte transfers with tunnel 403; no ZIP bytes were received
+locally and no alternate host/authorization bypass was attempted. Local extraction,
+inner-archive/binary hashes and local replay remain unavailable. The source-bound
+successful CI package job and GitHub ZIP identities remain usable scoped evidence.
+Current repaired-source artifacts from Build 38526618039 are:
+
+| Artifact | Bytes | GitHub ZIP SHA-256 |
+| --- | --- | --- |
+| `review-inference-linux-x86_64`, 11877010982 | 30,659,584 | `3dfdca18419edf3b1125f2ad6e6577c2d9b480caa293e3a612d979a7bbac4303` |
+| `review-inference-evidence-linux-x86_64`, 11876891933 | 35,263 | `f321f82c812a3853be83dd87a03f29f52d93b7e016ad1d422ded7dfeb91b741c` |
+| `review-audio-dependency-evidence-linux`, 11876861099 | 10,686 | `979d4b4928074b2734808b43a66fc70000d2258b23c3d24e1c5b10e2de4ccea3` |
+
+Earlier df53 artifacts remain separately identified:
+
+| Artifact | Bytes | GitHub ZIP SHA-256 |
+| --- | --- | --- |
+| `review-inference-linux-x86_64`, 11875745665 | 30,659,590 | `2dc6dd91e0f7f6258b5f7c96a433d45653190cb939eb6bad12c4c03283627a91` |
+| `review-inference-evidence-linux-x86_64`, 11875865202 | 38,521 | `a51626da4d0460ffd083618ffa2461ade5126bb012044789c3490c6f92e498bf` |
+| `review-audio-dependency-evidence-linux`, 11874379748 | 14,477 | `effe0e880f823f305e59baad54cc450a220e9897273dd5c4a7baacb835113e9c` |
+
+These GitHub-reported ZIP hashes identify workflow artifacts, not the contained
+tarball, native binary or final release inventory. Their seven-day retention ends
+2026-10-21; preserve required release evidence through the parent-approved path.
diff --git a/docs/plans/v080-readiness/execution-ledger.md b/docs/plans/v080-readiness/execution-ledger.md
new file mode 100644
index 000000000..33bdc79da
--- /dev/null
+++ b/docs/plans/v080-readiness/execution-ledger.md
@@ -0,0 +1,80 @@
+# Checkpoint execution ledger
+
+## 2026-10-14 — preparation
+
+- Original worktree was clean on `work` at `0dd38c70`. Fetched `origin/main`
+  and created task branch at `ef9eead9`; old refs and local inference work remain
+  untouched. No model, native runtime or user library was accessed.
+- Connected GitHub search found no open Pumas PRs. PR #69 is merged; its head
+  `036bed9c` records successful Build 38247599905 and CodeQL 38247594558.
+  Those are historical author/CI records, not this executor's validation.
+- Local `gh` read API requests returned Forbidden. Connected GitHub reads work;
+  Git fetch succeeds. Push/PR outcomes will be recorded separately.
+- Plan admitted before implementation; existing headless and release-script
+  checks started against current source. Results pending.
+
+## 2026-10-14 — current baseline and launcher fixture repair
+
+- Complete no-default core run passed: 2,070 unit tests, 218 integration tests,
+  6 doctests; 29 ignored entries, including top-level subprocess helpers and
+  examples. Catalogue recovery passed 7 tests with one child helper ignored at
+  top level. No earlier catalogue timing failure reproduced. S3 feature-gated
+  integration targets have zero tests in this configuration.
+- Release Node suite passed 33/33; version alignment at rc.1, dependency ownership,
+  default/S3 attribution and Rust formatting passed. Node 24.19.0 and Python
+  3.12.14 differ from repository patch pins; Rust/Cargo is the pinned 1.92.0.
+- Launcher initially passed 47 and failed 2: immediate Node startup took 146 ms
+  against a 100 ms minimum; terminated PID 6421 remained state Z under PID 1.
+  Amended the plan before editing the fixture, retained actual process-group
+  termination and force/close checks, gave the early-exit fixture startup margin,
+  and observed Linux process state. Corrected complete suite passed 49/49.
+- RPC first attempt stopped before tests because CMake was unavailable. CMake
+  3.31.6 was installed under `/tmp/pumas-v080-cmake`; the retry uses that binary
+  and task-owned XDG configuration. Outcome pending.
+- To stay within executor disk capacity, removed 47 task-touched disposable
+  incremental-cache directories after core compilation completed. Source files,
+  old refs and saved binaries were retained. Preserved the pre-existing RPC at
+  `/workspace/.pumas-tools/pre-v080-20261014-pumas-rpc`, 633,094,624 bytes,
+  SHA-256 `336690da08cd505c6bb86c8007cd8ddc2976c4f02ec82f089a15fb0bb3d751fa`.
+- Current main and PR #69's passing head have the identical Git tree
+  `7301cb8e86f9e7a498f5dd64b663a4ea5e174b75`. Historical CI remains labeled
+  separately from current local execution. No model/native runtime was downloaded.
+- Parent clarified that only actual demo dependency edges need qualification;
+  unrelated consumers do not need simultaneous releases. Read-only inventories
+  and remaining source/package gates will accompany an immutable receipt.
+
+## 2026-10-14 — immutable source handoff
+
+- Qualified code commit `5da74a2c9bd1fe3c0b1fa0184eef3667f31eed88` was pushed
+  without force; [draft PR #70](https://github.com/MrScripty/Pumas-Library/pull/70)
+  is open against main. This documentation follow-up adds the changelog,
+  migration/release notes, current consumer inventory and
+  [candidate receipt](reports/candidate.json); it changes no production source.
+- RPC's second build attempt ended in linker SIGBUS while the filesystem was
+  full, and sandbox startup independently reported ENOSPC. Cleanup of only the
+  completed task-built core test executables recovered 15,991,790,400 bytes.
+  Automatic approval review permitted the cleanup outside the broken full-disk
+  sandbox. No source, saved executable or model data was deleted.
+- The unchanged final RPC invocation passed: 233 unit tests and 24 integration
+  tests, with 13 ignored entries; S3 process targets contain zero tests without
+  their feature. The development binary passed health, inference-route absence
+  and graceful-stop smoke. Two explicitly selected native session-reference tests
+  passed owned start/borrowed retention/cleanup and borrowed cancellation keeping
+  its external owner healthy. These are not actual Chrema/Tuldok/Pantograph tests.
+- Rebuilt local RPC: 752,728,784 bytes, SHA-256
+  `da0bb23c6a4889baca2bc8500a07d07a38457cb43c2999d324d6d8a5419b04ed`.
+  Actual features are `pumas-library/hf-client,pumas-library/test-support`.
+  Source/target provenance is absent from its advertisement. This is a debug
+  test executable, not a release archive or inference qualification.
+- Receipt validation checked its exact input hashes, source-commit existence,
+  unchanged production roots and JSON. Fourteen local documentation links and
+  whitespace checks passed. No permanent test harness was added for prose.
+- GitHub's push notice reported 52 dependency alerts on default main (27 high,
+  19 moderate, 6 low); no shipped-closure triage is claimed. Keep the existing
+  release security-review gate. The receipt separately lists failed/resolved
+  setup attempts, ignored/disabled tests, not-run suites, native artifacts,
+  model/hardware inference and final publication gates.
+- Checkpoint preparation is accepted within its named source-information scope.
+  Current/final PR CI and actual consumer edges remain separately qualified;
+  parent owns any candidate tag, final version bump, native artifact acceptance
+  and release publication. No tag or release was created.
diff --git a/docs/plans/v080-readiness/issues.md b/docs/plans/v080-readiness/issues.md
new file mode 100644
index 000000000..5012133d3
--- /dev/null
+++ b/docs/plans/v080-readiness/issues.md
@@ -0,0 +1,13 @@
+# Checkpoint findings
+
+| Finding | Disposition / owner / trigger |
+| --- | --- |
+| Saved checkout predates merged v0.8 integration | Refreshed by new task branch; historical refs preserved |
+| Earlier catalogue timing failure | Did not reproduce: complete core headless cohort passed, including 7 catalogue recovery tests. Main also includes the separate fork-inherited local-start lease fixture correction `dceaf642`. |
+| Launcher qualification fixture failures | Repaired the 100 ms startup assumption and Linux zombie liveness oracle; all 49 launcher tests passed. Production process supervision unchanged. |
+| RPC build prerequisite/resource failures | Missing CMake and later disk exhaustion prevented two attempts before tests. Installed task-local CMake 3.31.6 and removed completed task-built test executables; final RPC run passed 257 tests, with 13 ignored. |
+| Changelog/release notes lag current rc.1 manifests | In scope: current release notes and checkpoint QA |
+| Installed production audio remains unavailable | Preserve the gate; audio owner must supply the complete admitted model/runtime/read/disposal qualification before advertising production |
+| Inference-enabled headless artifacts and pretrained models lack final qualification | Parent/release owner selects accepted tuples and final bytes; controlled fixtures do not close these gates |
+| gh API Forbidden; standards application routing unavailable | Use connected GitHub for review/PR when available; report exact remaining capability limits, never claim routing certification |
+| GitHub default-branch dependency alert notice | Push reported 52 alerts (27 high, 19 moderate, 6 low). Not independently triaged as shipped exposure; release owner retains the current security-review gate. No unrelated dependency expansion in this slice. |
diff --git a/docs/plans/v080-readiness/plan.md b/docs/plans/v080-readiness/plan.md
new file mode 100644
index 000000000..3295c8864
--- /dev/null
+++ b/docs/plans/v080-readiness/plan.md
@@ -0,0 +1,96 @@
+# Pumas v0.8.0 checkpoint preparation
+
+**Plan status:** Accepted. **Acceptance status:** satisfied for source checkpoint
+preparation only; release publication remains unaccepted.
+**Current phase:** parent review and promotion handoff.
+**Next slice:** none.
+
+## Objective and scope
+
+Provide the parent integration owner with one immutable, tested source candidate
+for Pantograph, Chrema and Tuldok demonstrations, current migration/release notes,
+and a bounded publication decision. This is checkpoint preparation, not release
+publication or qualification of every future modality.
+
+The user explicitly authorizes this plan's `start` operation. Branch
+`readiness/v080-20261014` belongs to this task, targets `main`, and starts at
+`ef9eead9fe6595f5b3152ef8df19c5dace30190b`. Preserve the original `work` and
+`integrate/http-acquisition-baseline` refs at `0dd38c70`; no history rewrite,
+user library migration, model download, final tag or release publication.
+Retain the task branch for draft-PR review; parent owns integration and retirement.
+
+## Acceptance claims
+
+| ID | Observable result | Kind / environment / mode | State |
+| --- | --- | --- | --- |
+| A1 | Current no-inference core/RPC suites qualify the source foundation; catalogue custody failures are reproduced or explicitly dispositioned | system / representative Linux / automated | satisfied: full cohorts passed; catalogue failure did not reproduce |
+| A2 | Existing release contracts, version alignment and current default/S3 notices pass | contract / representative Linux / automated | satisfied: release QA and receipt |
+| A3 | Release notes and changelog describe current contracts, migration, actual consumer pins and unqualified boundaries | contract / source inspection / manual | satisfied: release notes, QA, receipt and link review |
+| A4 | Qualified source commit is pushed with a draft PR and exact evidence; final tag action remains parent-controlled | integration / required-real GitHub / automated | satisfied: `5da74a2c9bd1fe3c0b1fa0184eef3667f31eed88` pushed, draft PR #70 open |
+
+## Decisions and standards
+
+Current main already contains PRs #64–#69 and versions `0.8.0-rc.1`.
+Do not reapply historical fixes or change versions merely to create a new name.
+Re-run the existing headless gate before deciding whether the earlier catalogue
+timing failure still blocks. Preserve production audio's unavailable outcome and
+all model/runtime qualification gates. The current artifact plan requires sixteen
+files: ten desktop installers, three no-inference headless archives and three
+inference headless archives. Native archive/model acceptance remains separate
+from the ordinary PR checks.
+
+No repository AGENTS.md or local .agents/skills exists in this saved checkout;
+the workspace .agents directory is empty. Read CONTRIBUTING, Architecture,
+Development, Releasing and current integration/consumer/distribution plans.
+Coding-Standards was fetched separately at
+`188beda1fa477d21d576c233dd8c7f4c4c267d23`. Core/Router select Planning,
+Implementation, Verification, Development Proportionality, Commit,
+Documentation, Release, Library, Contracts and Contract Evolution for this
+release-information slice. No runtime composition or language mechanism changes
+are planned. Re-route if a reproduced defect requires source changes.
+The application-purpose executable route is unavailable: its reference CLI
+returns `Application invocation is unavailable; use the published interface
+contract.` No connected standards tool is exposed. Direct canonical reads are
+guidance, not an executable routing certificate.
+
+**Composed-design review:** not-applicable. The initial write set changes release
+information and evidence only, adding no state, process or API composition.
+A repair that changes composition triggers a design review before editing.
+
+## Milestone: reviewed checkpoint
+
+**Status:** Accepted for checkpoint preparation.
+**Write set:** this plan directory, CHANGELOG.md, docs/release-notes-0.8.0.md,
+docs/release-qa-0.8.0.md; directly affected current release guidance links only.
+Amendment before fixture edits: `scripts/launcher/commands.test.mjs` owns two
+reproduced false failures. Immediate Node startup exceeded the 100 ms negative
+fixture window; the Linux descendant was actually terminated (`/proc` state Z)
+but container PID 1 did not reap it. Give the early-exit fixture startup margin
+and observe Linux execution state as well as PID existence. Keep actual process
+group termination, force-path and child-close assertions. Add Launcher,
+Resilience and Verification Oracles/Platforms guidance for these fixture facts.
+No production lifecycle or runtime composition changes are admitted.
+Consumer repositories are read-only inventory inputs, owned by their respective
+integration agents; this task does not change their pins.
+
+**Gate:** A1–A4. Run existing checks, inspect the cumulative and staged diff,
+commit conventionally, push without force, open a draft PR. Do not add a new
+validation harness for prose. Linux source/fixture tests cannot qualify native
+Windows/macOS packages, pretrained inference, GPU behavior or external consumers.
+
+## Blockers and re-plan triggers
+
+Final release remains blocked on the required native artifact/model evidence
+selected by RELEASING.md. Parent qualifies only the actual consumer dependency
+edges used by each demo; unrelated repositories need not release together. A missing
+optional production capability is later scope when it is advertised unavailable;
+a false availability claim, broken supported migration or reproduced ownership
+failure is a release blocker. A new owner/contract, migration, dependency change
+or unsafe operation requires an explicit scoped amendment before implementation.
+Stop investigation once current tests and source inventory support a bounded
+handoff; do not turn checkpoint preparation into open-ended feature expansion.
+
+[Execution ledger](execution-ledger.md) · [Issues](issues.md) ·
+[Release QA](../../release-qa-0.8.0.md) ·
+[Immutable receipt](reports/candidate.json) ·
+[Draft PR #70](https://github.com/MrScripty/Pumas-Library/pull/70)
diff --git a/docs/plans/v080-readiness/reports/candidate.json b/docs/plans/v080-readiness/reports/candidate.json
new file mode 100644
index 000000000..6799987ff
--- /dev/null
+++ b/docs/plans/v080-readiness/reports/candidate.json
@@ -0,0 +1,367 @@
+{
+  "schema_version": 1,
+  "purpose": "immutable source-foundation receipt; not release approval",
+  "date_utc": "2026-10-14",
+  "source": {
+    "repository": "https://github.com/MrScripty/Pumas-Library",
+    "qualified_code_revision": "5da74a2c9bd1fe3c0b1fa0184eef3667f31eed88",
+    "qualified_code_tree": "b5b8e9134ba75563a37458bbab0e440e29f42022",
+    "production_source_revision": "ef9eead9fe6595f5b3152ef8df19c5dace30190b",
+    "production_source_tree": "7301cb8e86f9e7a498f5dd64b663a4ea5e174b75",
+    "production_equivalence_command": "git diff --exit-code ef9eead9fe6595f5b3152ef8df19c5dace30190b HEAD -- rust frontend electron package.json pnpm-lock.yaml scripts/release bindings",
+    "production_equivalence_result": "passed; no changes",
+    "version": "0.8.0-rc.1",
+    "receipt_followup": "The subsequent documentation commit adds this receipt, migration notes and changelog; it changes no production source."
+  },
+  "inputs": {
+    "rust/Cargo.lock": {
+      "sha256": "91fb9823de2f0346211b4f68ca400f03a628890e55dca90e0803e2dd7ad47e42",
+      "bytes": 127936
+    },
+    "pnpm-lock.yaml": {
+      "sha256": "78cac9b50e2f28d293420ffb8b9d57889a723669a3969b3a670dd3e6cbfdda18",
+      "bytes": 210197
+    },
+    "rust-toolchain.toml": {
+      "sha256": "1d76a06616a42a984bad672eeb24ca39a0496e95a8b624e21df0d420d1557734",
+      "bytes": 86
+    },
+    ".node-version": {
+      "sha256": "b911698dc3cf3227d34d0ad6727f1c4408791203c9665de99ab959331a1fb07d",
+      "bytes": 8
+    },
+    ".python-version": {
+      "sha256": "fa682ae9d943f5c8076e68335c9ba3ab4d063ad035c07ac6928653dd4ac50af7",
+      "bytes": 7
+    },
+    "scripts/release/artifact-plan.json": {
+      "sha256": "66348a507f00ffdc74741fc7d70eab02f4a0eed4d3655354784cea2971662064",
+      "bytes": 16523
+    },
+    "bindings/support-matrix.json": {
+      "sha256": "30b301e8be9298ced5a7e51a0c750593ed3e4eed95434ef83b94c85d0d31083f",
+      "bytes": 3596
+    }
+  },
+  "environment": {
+    "execution": "Cloud Linux container",
+    "target": "x86_64-unknown-linux-gnu",
+    "rustc": "1.92.0 (ded5c06cf 2025-12-08)",
+    "cargo": "1.92.0 (344c4567c 2025-10-21)",
+    "node": "24.19.0",
+    "repository_node_pin": "24.15.0",
+    "python": "3.12.14",
+    "repository_python_pin": "3.12.3",
+    "task_local_cmake": "3.31.6",
+    "profile": "development test/debug; not optimized release",
+    "native_inference_runtime": "not provisioned or loaded",
+    "model_identity": null
+  },
+  "artifacts": [
+    {
+      "role": "local development test binary; not distributable",
+      "path": "rust/target/debug/pumas-rpc",
+      "sha256": "da0bb23c6a4889baca2bc8500a07d07a38457cb43c2999d324d6d8a5419b04ed",
+      "bytes": 752728784,
+      "build_info": {
+        "build_info_schema_version": 1,
+        "component": "pumas-rpc",
+        "package_version": "0.8.0-rc.1",
+        "compiled_features": [
+          "pumas-library/hf-client",
+          "pumas-library/test-support"
+        ],
+        "protocols": [
+          {
+            "name": "pumas.local-ipc",
+            "versions": [
+              1
+            ]
+          },
+          {
+            "name": "pumas.local-http",
+            "versions": [
+              1
+            ]
+          }
+        ],
+        "schemas": [
+          {
+            "name": "pumas.build-info",
+            "version": 1
+          },
+          {
+            "name": "pumas.discovery",
+            "version": 1
+          },
+          {
+            "name": "pumas.model-ref",
+            "version": 1
+          },
+          {
+            "name": "pumas.model-selector",
+            "version": 1
+          },
+          {
+            "name": "pumas.http-advertisement",
+            "version": 1
+          },
+          {
+            "name": "pumas.http-admission-fence",
+            "version": 1
+          },
+          {
+            "name": "pumas.http-owner-retention",
+            "version": 1
+          }
+        ]
+      },
+      "build_info_sha256": "c746079e822ae0614c0f2a9fe874676a3054c02456541ce7e8b198edd75d5840",
+      "embedded_source_revision": null,
+      "embedded_target": null,
+      "provenance_limit": "Build advertisement omits source/target provenance. Source receipt records the unchanged production checkout independently; no self-authenticated release provenance is claimed."
+    }
+  ],
+  "release_artifacts": {
+    "status": "not_produced",
+    "required_count": 16,
+    "runtime_pin_for_future_inference_archives": "CPU ONNX Runtime 1.24.2; not loaded by this task"
+  },
+  "gates": [
+    {
+      "id": "core-no-default",
+      "status": "passed",
+      "command": "cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features",
+      "unit_passed": 2070,
+      "integration_passed": 218,
+      "doctest_passed": 6,
+      "ignored": 29,
+      "feature_gated_zero_test_targets": "S3 and other disabled feature-specific targets",
+      "log": "/tmp/pumas-v080-headless.log",
+      "log_sha256": "e9ad254f0060eb39175be06bbba02140201fb41c7f38a0dbc006c7186403e5fc"
+    },
+    {
+      "id": "rpc-no-default",
+      "status": "passed",
+      "command": "XDG_CONFIG_HOME=/tmp/pumas-v080-config cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc --no-default-features",
+      "unit_passed": 233,
+      "integration_passed": 24,
+      "ignored": 13,
+      "log": "/tmp/pumas-v080-rpc-final.log",
+      "log_sha256": "4700ca8f30fc976b8e3361ee4b7d253e645e92aad5db0b5194db8ca3a046425d"
+    },
+    {
+      "id": "release-contracts",
+      "status": "passed",
+      "command": "node --test scripts/release/*.test.mjs",
+      "passed": 33,
+      "failed": 0,
+      "skipped": 0,
+      "log": "/tmp/pumas-v080-release.log",
+      "log_sha256": "6dc12ffacc75fac7a254afbfdf081d5290af8a23c1beec6f0abac46be079d80b"
+    },
+    {
+      "id": "launcher",
+      "status": "passed",
+      "command": "npm run test:launcher",
+      "passed": 49,
+      "failed": 0,
+      "skipped": 0,
+      "log": "/tmp/pumas-v080-launcher-repaired.log",
+      "log_sha256": "3c1712ecedfde6dfb7fbb2f572a51b9795153b967ad326267f91c9ef9641ff99"
+    },
+    {
+      "id": "version-alignment",
+      "status": "passed",
+      "command": "npm run check:release-versions -- v0.8.0-rc.1"
+    },
+    {
+      "id": "dependency-ownership",
+      "status": "passed",
+      "command": "npm run check:dependency-ownership"
+    },
+    {
+      "id": "default-attribution",
+      "status": "passed",
+      "command": "node scripts/release/check-attribution.cjs"
+    },
+    {
+      "id": "s3-attribution",
+      "status": "passed",
+      "command": "node scripts/release/check-attribution.cjs --features s3"
+    },
+    {
+      "id": "rust-format",
+      "status": "passed",
+      "command": "cargo fmt --manifest-path rust/Cargo.toml --all -- --check",
+      "log": "/tmp/pumas-v080-fmt.log",
+      "log_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    {
+      "id": "development-rpc-smoke",
+      "status": "passed",
+      "command": "python3 scripts/release/smoke-rpc.py rust/target/debug/pumas-rpc --inference-disabled",
+      "claims": [
+        "HTTP health",
+        "inference route absence",
+        "graceful child shutdown"
+      ],
+      "log": "/tmp/pumas-v080-rpc-smoke.log",
+      "log_sha256": "499c48b7575abab845a33d0c179d51a8d88b2069d83c00aa2ecd15e5a5c2abc3"
+    },
+    {
+      "id": "native-session-reference",
+      "status": "passed",
+      "command": "PUMAS_CONSUMER_TEST_BINARY=/workspace/Pumas-Library/rust/target/debug/pumas-rpc python3 -m unittest test_local_http_session.NativeConsumerTests.test_owned_start_borrowed_retention_and_context_cleanup test_local_http_session.NativeConsumerTests.test_cancelled_borrowed_context_leaves_external_owner_healthy -v",
+      "cwd": "scripts/consumers",
+      "passed": 2,
+      "skipped": 0,
+      "claims": [
+        "owned startup and cleanup",
+        "borrowed retention",
+        "borrowed cancellation preserves external owner"
+      ],
+      "log": "/tmp/pumas-v080-consumer.log",
+      "log_sha256": "aa3121363a006f3da1174c7e5e86820cc3d341052f00bbe91c8801bd9987b86d"
+    },
+    {
+      "id": "candidate-ci",
+      "status": "pending",
+      "reason": "Draft PR checks must run on the final review head."
+    },
+    {
+      "id": "all-features-workspace-and-clippy",
+      "status": "not_run",
+      "reason": "No Rust production source changed; not rerun locally. Historical identical-runtime-base CI is separate."
+    },
+    {
+      "id": "enabled-s3-source-cohorts",
+      "status": "not_run",
+      "reason": "S3 is disabled in these local Cargo invocations; attribution/release fixtures do not substitute."
+    },
+    {
+      "id": "frontend-electron-torch-suites",
+      "status": "not_run",
+      "reason": "Not rerun locally for this documentation and launcher-fixture slice; no UI, Electron or Torch source changed."
+    },
+    {
+      "id": "explicit-ignored-kernel-confinement-gate",
+      "status": "not_run",
+      "reason": "The ordinary Cargo invocation leaves its ignored entry unexecuted; no new confinement claim."
+    },
+    {
+      "id": "external-consumer-acceptance",
+      "status": "not_run",
+      "reason": "Only read-only source inventories were inspected; each selected actual consumer edge needs its own locked/application acceptance."
+    },
+    {
+      "id": "native-windows-macos",
+      "status": "not_run",
+      "reason": "These native targets were not executed in this Linux container."
+    },
+    {
+      "id": "release-artifact-matrix",
+      "status": "not_run",
+      "reason": "No optimized installer/archive set, native installation acceptance or final-byte metadata was produced."
+    },
+    {
+      "id": "pretrained-model-inference",
+      "status": "not_run",
+      "reason": "No provided pretrained model/tokenizer/projector fixtures; no model downloads or real model inference run."
+    },
+    {
+      "id": "hardware-qualified-inference",
+      "status": "not_run",
+      "reason": "No hardware qualification performed."
+    },
+    {
+      "id": "final-security-sbom-signing",
+      "status": "not_run",
+      "reason": "Not performed; freshness checks do not establish dependency/security/license or signing acceptance."
+    },
+    {
+      "id": "tags-and-publication",
+      "status": "not_run",
+      "reason": "Parent-owned; no tag or release action executed."
+    }
+  ],
+  "earlier_attempts": [
+    {
+      "id": "launcher-initial",
+      "status": "failed",
+      "passed": 47,
+      "failed": 2,
+      "log_sha256": "3f93b9a0f203d9e0545f2afb98aa0c788b8382c670b41b156f831e930842820b",
+      "disposition": "Corrected fixture startup margin and Linux zombie execution-state oracle; production launcher unchanged; full rerun passed."
+    },
+    {
+      "id": "rpc-initial",
+      "status": "failed_before_tests",
+      "reason": "CMake missing",
+      "log_sha256": "882226528f3957d4a9bb5437d187aec0fa3d5378ded0f6e6fe86f33069253f8f",
+      "disposition": "Installed task-local CMake 3.31.6."
+    },
+    {
+      "id": "rpc-second",
+      "status": "failed_before_tests",
+      "reason": "Linker SIGBUS while container filesystem was full; sandbox startup also failed with ENOSPC.",
+      "log_sha256": "a64457e4488550652c51c9655a2c9d709c8be19b91bea87486d13e73db7bfc3e",
+      "disposition": "Removed only completed task-built core test executables; unchanged RPC invocation subsequently passed."
+    }
+  ],
+  "consumer_inventory": [
+    {
+      "repository": "MrScripty/Pantograph",
+      "inspected_main": "2253cbe6fe8f1969b347c61fccba31859b13a4ba",
+      "pumas_pin": "aa1d79ae2d53f0acb088bc85223ecc2ff46af12b",
+      "acceptance": "not_run; coordinate manifest, lock and CI setup pin for the actual source edge"
+    },
+    {
+      "repository": "MrScripty/Chrema",
+      "inspected_main": "508c8b8cb724b49c655dab8bc4c8336190e516c7",
+      "pumas_pin": null,
+      "acceptance": "not_run; no Pumas adapter present on inspected main; historical qualification targets a different cohort"
+    },
+    {
+      "repository": "MrScripty/Tuldok",
+      "inspected_main": "d856a984535a430909761ed13ce42eadd55b0710",
+      "pumas_contract_pin": "36c2aab2c885b8416fd4e39cf8c37c510596d6e4",
+      "acceptance": "not_run; operation DTO definitions unchanged by source comparison; real caption/runtime path remains separate"
+    }
+  ],
+  "migration": {
+    "download_store": "schema 7; explicit offline conversion from supported v4/v5/schema-6 states",
+    "backup": "exact private downloads.json metadata backup only",
+    "model_payloads": "not scanned, copied, hashed or rewritten by conversion",
+    "preconditions": [
+      "all old/current readers and writers stopped",
+      "one-way upgrade acknowledged"
+    ],
+    "downgrade": "unsupported; no automatic restore after uncertain publication",
+    "old_failed_claims": "not automatically retired; dead PID alone is insufficient",
+    "user_library_migrated_by_this_task": false,
+    "authority": "docs/library-upgrade.md"
+  },
+  "promotion": {
+    "owner": "parent/maintainer",
+    "independent_consumer_releases_required": false,
+    "source_pin_does_not_require_tag": true,
+    "candidate_tag_if_parent_accepts_all_pre_tag_gates": "v0.8.0-rc.1",
+    "final_tag": "v0.8.0 only after a separate aligned final-version commit and required acceptance",
+    "executed": false
+  },
+  "review": {
+    "draft_pr": "https://github.com/MrScripty/Pumas-Library/pull/70",
+    "base": "main",
+    "branch": "readiness/v080-20261014",
+    "qualified_code_pushed": true,
+    "ci": "pending; final documentation head requires its own PR run"
+  },
+  "github_push_notice": {
+    "default_branch_reported_alerts": 52,
+    "high": 27,
+    "moderate": 19,
+    "low": 6,
+    "assessment": "Not independently triaged against the shipped dependency closure; current release security-review gate remains open."
+  }
+}
diff --git a/docs/release-notes-0.8.0.md b/docs/release-notes-0.8.0.md
new file mode 100644
index 000000000..68ec5313e
--- /dev/null
+++ b/docs/release-notes-0.8.0.md
@@ -0,0 +1,85 @@
+# Pumas Library 0.8.0 candidate
+
+Status: source checkpoint preparation. Current manifests are `0.8.0-rc.1`.
+There is no final v0.8.0 tag, accepted installer set or publication decision in
+this change. [Release QA](release-qa-0.8.0.md) owns candidate identity, observed
+consumer revisions, evidence and remaining gates.
+
+## Consumer-visible changes
+
+The generic HTTP operation boundary accepts typed text, embeddings, image and
+audio requests against an explicitly selected model/profile. Capability
+descriptors report what the current serving context can execute. Bounded
+Image-to-Text adds named image and image-bearing message inputs, preserving
+request identity, image bytes, resource bounds and typed refusal outcomes.
+See the [Image-to-Text contract](contracts/image-to-text-v0.8.md).
+Production installed Audio-to-Text remains unavailable; qualification-only
+constructors and controlled provider replies do not enable production speech.
+
+Local consumers can discover and explicitly attach to a selected ready owner,
+retain its lifetime and fence requests against root/generation changes. An
+existing catalogue entry does not imply a loaded or executable model. Borrowed
+attachment must not terminate another application's owner; a disconnect or
+uncertain request result does not authorize inference replay.
+
+Acquisition includes digest-bound local input capabilities and conditional S3
+single-object/authored-bundle GGUF imports. Hugging Face browse/cache observations
+remain separate from download details resolved after selection. Managed models
+keep receipt-bound identities, including the selected GGUF primary/projector
+through owned library moves. These contracts do not promise arbitrary
+ONNX/Safetensors/Diffusers imports through the public S3 GGUF path.
+The current S3 checks use controlled HTTPS fixtures; they do not certify AWS,
+non-AWS providers or MinIO endpoint combinations. Those provider-specific claims
+retain their existing AQ-S3 acceptance gate.
+
+## Existing libraries and migration
+
+Read [Opening an older library](library-upgrade.md) before opening a shared
+library with this candidate. Download-store schema 7 is an explicit one-way
+metadata conversion from the supported v4/v5/schema-6 states. Stop all readers,
+writers, old applications and developer instances first. Use the desktop's
+**Upgrade Library** confirmation or the documented Linux offline RPC command.
+The converter creates a private exact backup of `downloads.json`; it does not
+copy, scan, hash or rewrite model payloads. Opening the converted library then
+performs ordinary startup work.
+
+Do not reopen upgraded metadata with an older binary or automatically restore
+the backup after an uncertain publication. Preserve metadata, backups and logs
+on failure. Unsupported/corrupt stores are refused. Migration cannot retire a
+previously retained failed owner claim: a dead PID is insufficient authority to
+delete registry state. Recovery requires the existing custody contract.
+
+Missing download destinations remain represented in their retained error/paused
+state without startup creating folders or pretending absent bytes completed.
+Interactive download-location reconciliation is separately planned work; this
+checkpoint does not turn its proposal into implemented functionality.
+
+## Compatibility and distribution
+
+Native Rust consumers use an immutable Git revision and their locked dependency
+closure. Update Pantograph's manifest, lockfile and CI setup pin as one consumer
+cohort, then run its actual library/IPC/lifecycle checks. Independent HTTP
+consumers must validate the named protocol/schema advertisements and closed
+operation variants they use; matching product versions alone is insufficient.
+The source-exported Python session helper is a reference, not a supported SDK.
+The binding support matrix still accepts no UniFFI/Rustler host package tuple.
+
+The [artifact plan](../scripts/release/artifact-plan.json) requires sixteen
+files: five full desktop installers, five no-inference desktop installers,
+three no-inference headless archives and three inference headless archives.
+Targets are Linux x86_64, Windows x86_64 and macOS ARM64. Headless binaries
+include the core; embedders do not need a separate core binary. Choose the
+correct inference variant explicitly. Run only one desktop variant per machine
+because their product name is shared.
+
+Inference archives bind exact source/schema/runtime bytes and upstream notices.
+CPU ONNX Runtime is pinned to 1.24.2; Cargo never downloads it. Current PR Linux
+review can prove an extracted archive's finite untrained-graph execution and
+cleanup. This is distinct from pretrained Nomic quality, native Windows/macOS
+acceptance, vision model/projector execution, production speech and final
+distribution acceptance. Follow [Releasing](../RELEASING.md) for native runtime
+prerequisites, packaged model checks, notices, security review and publication.
+
+Custom Torch component assembly, additional discovery networks, arbitrary
+modality pairs and new language SDKs are later scope. Their absence does not
+authorize weakening current capability, ownership or migration refusals.
diff --git a/docs/release-qa-0.8.0.md b/docs/release-qa-0.8.0.md
new file mode 100644
index 000000000..a258d361d
--- /dev/null
+++ b/docs/release-qa-0.8.0.md
@@ -0,0 +1,155 @@
+# v0.8.0 source checkpoint
+
+Checkpoint owner: parent cross-repository integrator. Preparation date:
+2026-10-14. Runtime source baseline:
+`ef9eead9fe6595f5b3152ef8df19c5dace30190b` (merged PR #69).
+The immutable qualified code revision is
+`5da74a2c9bd1fe3c0b1fa0184eef3667f31eed88`; its subsequent documentation commit
+adds this handoff without production changes. [Draft PR #70](https://github.com/MrScripty/Pumas-Library/pull/70)
+owns review of both. The [machine-readable receipt](plans/v080-readiness/reports/candidate.json)
+binds source/tree, lockfiles, input hashes, local artifact bytes and each gate.
+This slice changes release information and launcher
+fixtures, not production APIs, runtime code, dependency resolution or manifests.
+Version remains `0.8.0-rc.1`. No tag, final release or accepted archive is created.
+
+Qualification continued after preparation. Repair commit
+`aa40e155846cdac6cd94b6f5c2fd6a35cddce16e` changes only a cleanup fixture and
+qualification records. [The current decision report](plans/v080-qualification/reports/release-blockers.md)
+owns the original df53 CI failure, repair CI, current dependency/notices review,
+actual package identities and remaining release gates. The initial receipt and
+tables below retain their original scope; they are not relabeled as repair results.
+Repair Build [38526618039](https://github.com/MrScripty/Pumas-Library/actions/runs/38526618039)
+is terminal success: all nine applicable jobs passed. The
+[qualification receipt](plans/v080-qualification/reports/qualification.json)
+retains exact jobs, headless totals, artifact ZIP hashes and review limits.
+
+## Current consumer inventory
+
+These are read-only observations of consumer `main` on 2026-10-14, not successful
+downstream builds. Each consumer owner qualifies the actual dependency edge used
+by its demo; unrelated repositories do not need to release together. A Pumas-only
+test cannot accept the external application.
+
+| Consumer / inspected revision | Actual Pumas boundary | Required next acceptance |
+| --- | --- | --- |
+| Pantograph `2253cbe6fe8f1969b347c61fccba31859b13a4ba` | Cargo.toml, Cargo.lock and `.github/workflows/quality-gates.yml` all pin `aa1d79ae2d53f0acb088bc85223ecc2ff46af12b`. Native Rust library consumer. | Coordinate all three pins to one reviewed Pumas SHA, retain lockfile resolution, then run actual locked Rust/library/IPC and lifecycle tests. This inventory does not establish source compatibility across that revision gap. |
+| Chrema `508c8b8cb724b49c655dab8bc4c8336190e516c7` | Current main contains reusable workflow/content-ledger packages and host-supplied provider adapters. Pantograph PR78 now supplies an actual host composition using these public packages and Pumas. | Qualify the host's exact Pumas edge; no new Chrema release or Pumas-specific Chrema SDK is required. Historical Pumas `qualify_chrema_native.py` requires Chrema `d9f660beb8273aac16e62fae3902b9f5e4d1559b` and Pumas `fe3c9f04c243f436a393ae47e16f616244a85cee`; it cannot be relabeled current-main acceptance. |
+| Tuldok `d856a984535a430909761ed13ce42eadd55b0710` | `docs/contracts/pumas-image-to-text-consumer.md` and fixture `source.json` pin merged Pumas `36c2aab2c885b8416fd4e39cf8c37c510596d6e4`. Opt-in typed HTTP caption consumer. | Retain its seven-variant parser and six actual DTO-schema pins, then qualify final source/schema advertisements, finite real model/projector captioning, cancellation and borrowed-owner survival. The inspected operation DTO definitions are unchanged from that merge; this is source comparison, not a new schema-export or model receipt. |
+
+Protocol/schema advertisement, exact selected owner/root/generation, artifact
+digest, model/profile and runtime identity remain separate compatibility facts.
+Do not substitute a product-version match or a successful health check for them.
+The [release notes](release-notes-0.8.0.md) link the supported migration path.
+
+[Pantograph PR78](https://github.com/MrScripty/Pantograph/pull/78) now has a repaired
+baseline and a separate [published consumer receipt](https://github.com/MrScripty/Pantograph/blob/3649df2d3c4c718aa278e809f27cbc2a915f8c47/docs/plans/pumas-pr70-cpu-consumer/reports/consumer-compatibility.md)
+for Pumas df53. Pantograph source `039cee079d273a8d4968df56a4b35e8eb8aacbbe`
+passed 19 integration, 598 library (2 existing ignores) and 4 HTTP contracts,
+plus independent consumer review, without an API repair. It exercises actual
+public Chrema/Pumas/untrained-BERT CPU composition. PR78's adopted baseline pin
+remains aa1d79ae; the separate df53 receipt is not silently promoted to aa40.
+The parent owns final source/pin adoption and any lineage acceptance.
+
+## Initial preparation evidence
+
+Environment: this Cloud Linux x86_64 container, Rust/Cargo 1.92.0 from the repository
+pin, Node 24.19.0 (repository pin 24.15.0), Python 3.12.14 (repository pin 3.12.3).
+Node/Python results are supporting compatibility observations on these patch
+versions, not a claim that the exact pinned environment was run here. No models,
+native inference runtime or external S3 account were provisioned by this task.
+
+| Command | Observed result / proof boundary |
+| --- | --- |
+| `node --test scripts/release/*.test.mjs` | 33 passed, zero failed/skipped; existing release/packaging fixture contracts, not actual release archives |
+| `npm run check:release-versions -- v0.8.0-rc.1` | Passed; aligned workspace source manifests |
+| `npm run check:dependency-ownership` | Passed; workspace ownership declarations |
+| `node scripts/release/check-attribution.cjs` and `--features s3` | Both passed; current inputs/pinned notice text freshness, not final SBOM/security approval |
+| `npm run test:launcher` | Initial 47 passed / 2 failed. After fixture correction, 49 passed / zero failed/skipped. See diagnosis below. |
+| `cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features` | Passed: 2,070 unit tests, 218 integration tests and 6 doctests; 29 ignored entries including child helpers/doctest examples. Catalogue recovery: 7 passed, 1 child helper ignored at top level. Feature-gated S3 targets contain zero tests in this configuration. No pretrained inference is exercised. |
+| `cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc --no-default-features` | Passed with task-local CMake and XDG configuration: 233 unit and 24 integration tests; 13 ignored entries. S3 feature-gated process targets contain zero tests. |
+| `cargo fmt --manifest-path rust/Cargo.toml --all -- --check` | Passed |
+| `python3 scripts/release/smoke-rpc.py rust/target/debug/pumas-rpc --inference-disabled` | Passed HTTP health, inference-route absence and graceful stop against the rebuilt development test binary |
+| Two selected `NativeConsumerTests` in `scripts/consumers/test_local_http_session.py` | Passed actual owned start/borrowed retention/cleanup and borrowed cancellation preserving the external owner. This is Pumas's source reference, not acceptance of an external application. Exact command is in the receipt. |
+
+Raw preparation logs are task-local `/tmp/pumas-v080-*.log`;
+they are not permanent downloadable release assets. The execution ledger and PR
+retain reviewed result summaries.
+
+The initial launcher failures had distinct observations: an immediate Node child
+exited after 146 ms, exceeding the negative fixture's 100 ms threshold; a killed
+descendant remained as Linux state `Z` under container PID 1. The fixture now
+allows one second for the early-exit discriminator and checks Linux execution
+state rather than interpreting every retained PID as live work. Actual process
+group termination and force/close assertions remain exercised. Production
+launcher code is unchanged. Native Windows/macOS launcher evidence is not run here.
+
+RPC's first attempt stopped before tests because CMake was missing. The second
+link attempt terminated with SIGBUS while the container filesystem was full;
+sandbox startup independently reported ENOSPC. After task-local CMake 3.31.6 and
+removal of completed task-built test executables, the unchanged RPC invocation
+passed. These attempts and log digests remain in the receipt.
+
+The local test binary is 752,728,784 bytes, SHA-256
+`da0bb23c6a4889baca2bc8500a07d07a38457cb43c2999d324d6d8a5419b04ed`.
+Its actual advertisement lists `pumas-library/hf-client` and
+`pumas-library/test-support`, with no inference feature. Source/target provenance
+fields are absent; checkout equivalence is recorded independently. This debug
+test executable is not an optimized, self-authenticating or shipped artifact.
+No native inference runtime was loaded. The original saved executable is retained
+separately; its path and hash are in the execution ledger.
+
+Current local execution does not include all-feature workspace/Clippy,
+enabled-S3 source cohorts, frontend/Electron/Torch suites, the explicitly ignored
+kernel-confinement gate, external consumer applications, native Windows/macOS,
+optimized packaging, pretrained inference or final security/SBOM/signing review.
+The receipt lists each as not-run; historical CI never silently closes them.
+
+Historical PR #69 head `036bed9cb60a91a440034b7324fd6f611ea58c2a`
+records successful [Build 38247599905](https://github.com/MrScripty/Pumas-Library/actions/runs/38247599905)
+and [CodeQL 38247594558](https://github.com/MrScripty/Pumas-Library/actions/runs/38247594558).
+Its Linux extracted inference archive exercised finite 256-dimensional embeddings
+through real ORT with an untrained graph; its audio job acquired the frozen cohort,
+imported dependencies and performed a CPU operation with `production_available=false`.
+These are historical recorded CI results for that head, not this executor's
+inference tests, pretrained quality acceptance or final candidate artifacts.
+
+## Release blockers and later scope
+
+| Item | Disposition / owner / required evidence |
+| --- | --- |
+| Earlier headless catalogue ownership timing failure | Did not reproduce in the complete current core headless cohort, including actual catalogue cold-recovery tests. Do not carry it forward as a current reproduced blocker. |
+| Consumer dependency edges | Pantograph's published df53 receipt qualifies its bounded public Chrema/Pumas CPU edge; parent adopts the actual final pin or explicitly accepts test-only lineage. Tuldok captioning still requires its advertised schema and model path. No new Chrema SDK or unrelated release is required. |
+| Final version and notices | Parent decides promotion from rc.1 to 0.8.0. Change the four manifest sources and matching workspace lock entries without dependency updates, regenerate/review both versioned attribution sets, run version and release tests |
+| Sixteen exact candidate artifacts | Blocks release publication: all native targets and package/install/start/recovery/shutdown flows required by RELEASING.md, plus exact final-file checksums/provenance/SBOM and maintainer review. Current exact-lock audits and regenerated notices are reviewed in the continuation receipt; the generic 52-alert push notice is not treated as confirmed shipped exposure. |
+| Pretrained ONNX and vision/runtime evidence | Blocks claims of those production/demo capabilities. Use explicitly provided model/tokenizer/projector fixtures and the extracted pinned runtime; synthetic graphs and provider responses do not satisfy this |
+| Production installed speech | Later capability scope while admission stays unavailable. Its owner must satisfy actual model/runtime/read containment/disposal gates before advertising support; do not expand this checkpoint to enable it |
+| Interactive download-location reconciliation, custom Torch assembly, new SDKs/network discovery | Later scope under their existing owners; do not treat plans as delivered features |
+
+## Exact parent release action
+
+First review/merge this draft and record the accepted full candidate SHA. Source
+demonstrations may pin that immutable revision within their explicitly qualified
+capabilities; accept each actual consumer edge separately. They need no final tag.
+
+If the parent selects the unchanged prerelease version after required pre-tag
+qualification, its candidate action is `git tag -a v0.8.0-rc.1
+<accepted-candidate-commit> -m 'Pumas Library v0.8.0-rc.1'` followed by
+`git push origin refs/tags/v0.8.0-rc.1`. It must first verify that this tag does
+not exist. This task does not execute either command.
+
+After the final-version commit and all **pre-tag** QA in RELEASING.md are accepted,
+the parent/maintainer may run the following with the actual reviewed full SHA:
+
+```bash
+npm run check:release-versions -- v0.8.0
+git tag -a v0.8.0 <accepted-final-version-commit> -m 'Pumas Library v0.8.0'
+git push origin refs/tags/v0.8.0
+```
+
+This is a proposed future action, not an executed command. Current rc.1 manifests
+must not be tagged v0.8.0. The tag triggers candidate assembly, which must pass on
+that exact SHA for all sixteen planned files. Inspect native results and final
+metadata, stage a draft release with the reviewed notes, then let the maintainer
+authorize publication. Never move a published tag or substitute historical CI
+artifacts. If pre-tag qualification remains incomplete, keep the source checkpoint
+pinned and the release blocked.
diff --git a/rust/crates/pumas-core/src/model_library/hf/download.rs b/rust/crates/pumas-core/src/model_library/hf/download.rs
index c52a3eb95..964e32133 100644
--- a/rust/crates/pumas-core/src/model_library/hf/download.rs
+++ b/rust/crates/pumas-core/src/model_library/hf/download.rs
@@ -16490,6 +16490,10 @@ mod tests {
 
     #[tokio::test]
     async fn pause_is_rejected_after_final_file_commit_and_during_cleanup() {
+        // These waits establish fixture cutpoints, not a download latency SLO.
+        // The worker owns a separate runtime and can be descheduled by parallel
+        // process/filesystem tests before it reaches the blocked cleanup phase.
+        let fixture_timeout = Duration::from_secs(10);
         for block_at in [
             "terminal-cleanup-committed",
             "remove ambient download marker",
@@ -16581,12 +16585,12 @@ mod tests {
                 }
             });
             let download_id = id_receiver
-                .recv_timeout(Duration::from_secs(1))
+                .recv_timeout(fixture_timeout)
                 .unwrap_or_else(|error| panic!("start must return its admitted ID: {error:?}; cleanup fixture={block_at}; {}", admission.describe(worker_runtime.is_finished())));
             drop(physical_guard);
             reached
-                .recv_timeout(Duration::from_secs(1))
-                .expect("Worker must reach terminal cleanup");
+                .recv_timeout(fixture_timeout)
+                .unwrap_or_else(|error| panic!("Worker must reach terminal cleanup: {error:?}; cleanup fixture={block_at}; {}", admission.describe(worker_runtime.is_finished())));
             assert!(!client.pause_download(&download_id).await.unwrap());
             assert_eq!(
                 client.downloads.read().await[&download_id].status,
@@ -16594,7 +16598,7 @@ mod tests {
             );
             release_sender.send(()).unwrap();
 
-            tokio::time::timeout(Duration::from_secs(2), async {
+            tokio::time::timeout(fixture_timeout, async {
                 loop {
                     client.observe_finished_download_tasks().await;
                     if client.downloads.read().await[&download_id].status
diff --git a/scripts/launcher/commands.test.mjs b/scripts/launcher/commands.test.mjs
index 5e7b9e029..6bf506d71 100644
--- a/scripts/launcher/commands.test.mjs
+++ b/scripts/launcher/commands.test.mjs
@@ -26,7 +26,8 @@ test('runBoundedCommand rejects when the process exits before the minimum smoke
       process.execPath,
       ['-e', 'process.exit(0)'],
       {
-        minUptimeMs: 100,
+        // Node startup can exceed 100 ms on a loaded qualification host.
+        minUptimeMs: 1_000,
         maxUptimeMs: 2_000,
         processTree,
       }
@@ -226,7 +227,7 @@ test('command failures do not disclose forwarded argument values', async () => {
   );
 });
 
-test('runBoundedCommand removes a real descendant process with its owned tree', async () => {
+test('runBoundedCommand stops a real descendant process with its owned tree', async () => {
   const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'pumas-launcher-tree-'));
   const descendantPidPath = path.join(tempRoot, 'descendant.pid');
   let descendantPid;
@@ -276,9 +277,19 @@ test('runBoundedCommand removes a real descendant process with its owned tree',
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
+    if (process.platform === 'linux') {
+      // A container's PID 1 may retain an orphan zombie after group SIGKILL.
+      // It cannot execute; kill(pid, 0) alone would mistake it for live work.
+      const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+      const state = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[0];
+      return state !== 'Z' && state !== 'X';
+    }
     return true;
   } catch (error) {
-    return error?.code !== 'ESRCH';
+    if (error?.code === 'ESRCH' || error?.code === 'ENOENT') {
+      return false;
+    }
+    throw error;
   }
 }