Sync feedback: Desktop chat, model, and preview fixes

.github/workflows/release.yml

@@ -125,7 +125,7 @@ jobs:
       - name: Build llama-server (pinned deployment target)
         run: |
           command -v cmake >/dev/null || brew install cmake
-          MACOS_DEPLOYMENT_TARGET=13.0 LLAMA_REF=b9838 bash scripts/build-llama.sh
+          MACOS_DEPLOYMENT_TARGET=13.0 bash scripts/build-llama.sh
           otool -l resources/bin/llama/llama-server | awk '/LC_BUILD_VERSION/{f=1} f&&/minos/{print "[ci] bundled engine minos="$2; exit}'
       # Rebuild the one-shot Whisper CLI instead of trusting the committed LFS
       # payload. The production script disables OpenMP/BLAS auto-discovery and

docs/GAPS_BACKLOG.md

@@ -7,6 +7,20 @@ how to reproduce, and the fix direction. Close with evidence; never hide.
 
 ## OPEN
 
+### SYN-004 (P1) - Late-pair full graph is not verified between the real Desktop and Mobile apps
+
+**Evidence (2026-08-13):** the production send paths now backfill state records, generated images,
+message attachments, and knowledge documents when a device pairs after the data exists. Shared tests
+prove byte-bounded anti-entropy. Desktop tests use the real service, SQLite, and temporary files.
+Mobile tests use two real sync engines and prove exact file bytes and durable controls. These tests do
+not start both actual apps and verify final receiver materialization and UI in one journey.
+
+**Evidence required to close:** create a project, settings, chat text, enhanced prompt, reasoning,
+completed tool, generated image, attachment, and knowledge document on device A before device B is
+paired. Pair the real apps through the production connect path. Verify every record, relationship,
+and byte on B, restart B, and verify that the same graph returns without duplicate transfers or
+detached files. Run Desktop-to-Mobile and Mobile-to-Desktop on physical macOS, iOS, and Android.
+
 ### DEF-001 (P1) - Replay capture control reports a state that is not factual
 
 **Evidence (2026-08-08):** macOS Settings reported `Screen access: denied` and `Permission
@@ -1181,3 +1195,31 @@ Independently: `0 failed` next to a logged `request.failed` is its own bug - the
 reaching Activity even for the file that DID have a row.
 
 ---
+
+## MTP is a mobile feature, and it should be a `@offgrid/models` one
+
+**Status:** open. Filed 2026-08-12. Deliberately NOT in the current PR - it is a package extraction,
+not a fix, and folding it in would bloat a release branch that is about sync feedback.
+
+**The gap.** MTP support exists on mobile and does not exist on desktop. Both apps consume the same
+model layer, so a capability that lives in one app's screens is a rule with one home and two
+audiences - the shape this repo keeps finding at the root of its bugs.
+
+**Why it is a shared-package problem, not a desktop one.** Copying the mobile implementation across
+would make it a rule with TWO homes, which is worse than having it once. The model layer is the owner:
+whether a model needs MTP, which artefacts it implies, and how a device advertises support are all
+properties of the MODEL, and every surface should be asking `@offgrid/models` rather than each app
+deciding for itself. Desktop then gets it by consuming the package, and so does any future surface.
+
+**Fix shape.**
+
+1. Move the MTP capability rule into `shared/packages/models` - one definition of what MTP is and which
+   models require it, keyed off the catalog entry, with no app-specific branching inside it.
+2. Mobile stops deciding and starts asking. Its current behaviour is the reference for what the rule
+   must produce, so it is the regression check that the extraction changed nothing.
+3. Desktop consumes the same rule. No `if (platform)` in either app: a platform that cannot serve MTP
+   reports that through the same interface, it does not get a special case at the call site.
+
+**Watch for:** the mobile implementation almost certainly carries assumptions that are really about the
+phone runtime rather than about MTP. Those belong on the platform adapter, not in the shared rule - and
+the tell is any code in the extracted package that names a platform.

docs/WINDOWS_SUPPORT.md

@@ -31,7 +31,7 @@ at the bottom.
 | -------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Windows CI build                 | 🟢     | `.github/workflows/windows-build.yml` (`windows-2022`) builds + packages a branch artifact; `release.yml`'s `build-win` job publishes the installer + updater feed to the release. Verified by installing a build on real Windows hardware.                                                                                                                                                                                                          |
 | Native-module compile (node-gyp) | 🟢     | Pinned toolchain: `windows-2022` (VS 2022) + Python 3.12. `windows-latest`/VS 2026 + Python 3.13 break node-gyp 11 — documented in the workflow. Covers `better-sqlite3-multiple-ciphers`, `node-llama-cpp`, `sharp`.                                                                                                                                                                                                                                |
-| Windows runtime binaries fetch   | 🟢     | `scripts/fetch-win-binaries.ps1` pulls win64 `llama-server` / `whisper-cli` / `sd-cli` / `ffmpeg` (+ DLLs) from upstream GitHub releases at build time. **`llama-server` is pinned to `b9838`** (byte-for-byte parity with the macOS engine); `whisper-cli` / `sd-cli` / `ffmpeg` resolve dynamically from their latest upstream releases. Repo LFS binaries are macOS-only and skipped (`lfs: false`). Fails loud if `llama-server.exe` is missing. |
+| Windows runtime binaries fetch   | 🟢     | `scripts/fetch-win-binaries.ps1` pulls win64 `llama-server` / `whisper-cli` / `sd-cli` / `ffmpeg` (+ DLLs) from upstream GitHub releases at build time. **`llama-server` is pinned by `package.json `offgrid.llamaRef``** — one owner, shared with the macOS source build, so the two are byte-for-byte parity; `whisper-cli` / `sd-cli` / `ffmpeg` resolve dynamically from their latest upstream releases. Repo LFS binaries are macOS-only and skipped (`lfs: false`). Fails loud if `llama-server.exe` is missing. |
 | NSIS installer                   | 🟢     | `electron-builder.yml` → `win.executableName`, `nsis` block (desktop shortcut, uninstall name). Untested end-to-end.                                                                                                                                                                                                                                                                                                                                 |
 | Code signing                     | 🟡     | Optional via `WIN_CSC_LINK` / `WIN_CSC_KEY_PASSWORD` secrets; **unset → unsigned build → SmartScreen will warn** on install. No cert configured yet.                                                                                                                                                                                                                                                                                                 |
 | Auto-update                      | 🟢     | `electron-updater` is cross-platform (`src/main/updater.ts`); `release.yml`'s `build-win` job publishes `latest.yml` (stable) / `beta.yml` (nightly) to the release, so Windows installs self-update like macOS.                                                                                                                                                                                                                                     |

e2e/devices-sync.spec.ts

@@ -518,7 +518,7 @@ test.describe('Devices surface — pro tier', () => {
     await page.getByRole('button', { name: 'Rescan network' }).click()
     await expect(page.getByRole('button', { name: 'Rescan network' })).toBeEnabled()
     await expect(page.getByText('Synthetic Android').first()).toBeVisible()
-    await expect(page.getByText('Scanning LAN and Nearby routes.')).toHaveCount(0)
+    await expect(page.getByText('Scanning WiFi and Nearby routes.')).toHaveCount(0)
     await expect(page.getByRole('alert')).toHaveCount(0)
 
     const timestamp = new Date().toISOString()