release(v4.6.150): commit the module work that has been live but uncommitted

Operator commit-approve, 2026-11-06. These changes have been served since
2026-11-02/03 while git HEAD still stamped v4.6.146, so the mirror published a
tree four builds behind the running instance and the release tag named the
wrong build.

module-orchestrator.js — orchestrate-parallel reported success it could not
prove. Results are now recorded by sub-task id through a resultSink handed to
delegateTask (harvest matched by currentTask/lastTask strings, which a later
delegation on the same agent overwrote, losing finished work as "agent not
found"); the tally counts summaries with status ok instead of
Promise.allSettled resolutions (a spawn refusal fulfils with undefined and used
to print green); and a busy agent is no longer reused at pool cap, where two
siblings erased each other's lease. Guard:
modules/test/test-orchestrator-parallel-harvest.js (16 cases, reproduces the
one-agent three-sub-task cap case that printed 3/3 succeeded).

module-billing.js — the balance said "not signed in — newOS4 sends no session
token", which was already false: the browser sends the HttpOnly cookie and
parse_bearer_token() falls back to it. `cost` is on by default (the flag was
opt-in and nobody knew the command existed; `cost off` opts out) and the
command now prints today's platform spend from GET /api/billing/usage?days=1
alongside the session estimate.

modules/ext/webdav.js — the inline WebView detector missed "Version/4.0"
Android WebViews, including the operator's own phone, so the login offered a
Telegram widget that cannot complete there. It now delegates to
modules/wx11-tg-webview.js when the page loaded it and keeps a matching
fallback (wv token, Version/4.0-Android, Telegram, FBAN/Instagram/Line).

modules/ext/media.js — text analysis model renamed deepseek-v4-flash ->
deepseek-v4.1-flash in both the field and the printed label.

main.html + module-loader.js — v4.6.146 -> v4.6.150 in LATEST_VER and the three
asset queries; core-bundle.js rebuilt (rebuild-bundles.py reports it already
in sync, 1,250,569 bytes).

Verified: node --check on all six scripts and the new test; the 16-case
orchestrator guard passes against the deployed bundle (ORCH_SRC=...); bundle
rebuild is a no-op; core-bundle.js?v=v4.6.150 answers 200.

2 files changed, 17 insertions, 9 deletions

diff --git a/modules/ext/media.js b/modules/ext/media.js
index 5723e27..bdc50e2 100644
--- a/modules/ext/media.js
+++ b/modules/ext/media.js
@@ -1,13 +1,13 @@
 // newOS4 Media Analysis Module (v4.5.79)
 // Commands: analyze <path> [--flags]
 // Uses gemini-3-flash-preview:cloud for vision (images, video frames)
-// Uses deepseek-v4-flash:cloud for text analysis (audio features, summaries)
+// Uses deepseek-v4.1-flash:cloud for text analysis (audio features, summaries)
 class MediaModule {
     constructor() {
         this.commands = {};
         this.terminal = null;
         this._visionModel = 'gemini-3-flash-preview:cloud';
-        this._textModel = 'deepseek-v4-flash:cloud';
+        this._textModel = 'deepseek-v4.1-flash:cloud';
         this._maxFrames = 10;       // max video frames to analyze
         this._frameInterval = 5;    // seconds between video frames
     }
@@ -118,7 +118,7 @@ class MediaModule {
             }
 
             // Send features to text model for AI interpretation
-            this.terminal.print('\n🤖 AI interpretation (deepseek-v4-flash)...', 'info');
+            this.terminal.print('\n🤖 AI interpretation (deepseek-v4.1-flash)...', 'info');
             const prompt = `Analyze these audio features and describe what the audio likely sounds like. Consider the genre, mood, and characteristics:
 
 Duration: ${features.duration.toFixed(1)}s
diff --git a/modules/ext/webdav.js b/modules/ext/webdav.js
index a97a8bc..fa42b96 100644
--- a/modules/ext/webdav.js
+++ b/modules/ext/webdav.js
@@ -976,12 +976,20 @@ class WebDAVModule {
             };
             const mount = document.getElementById('wdav-tg-mount');
             // A Telegram widget cannot log anyone in inside an Android WebView or an in-app
-            // browser: it needs a popup that can postMessage back to the opener, and those hosts
-            // hand the link to the system browser, which has no opener. Measured 2026-11-02 (the
-            // operator's phone UA ends "...; wv)"): every attempt landed in Chrome and died there.
-            // In that case skip the widget entirely and start the code flow, which needs no popup.
-            const _tgWV = /;\s*wv\)/.test(navigator.userAgent || '') ||
-                          /\bTelegram\b/i.test(navigator.userAgent || '');
+            // browser: tapping it hands the whole tab to oauth.telegram.org and must come back to
+            // this page with #tgAuthResult. Those hosts either hand the navigation to the system
+            // browser (no way back) or never return. Measured 2026-11-03, operator's phone.
+            // Fallback only: modules/wx11-tg-webview.js is the source of truth when the host page
+            // loaded it (the dashboard does). This inline copy missed "Version/4.0" WebViews — the
+            // operator's own phone — until 2026-11-03, and the Meta/Line classes until the review
+            // that followed. Probe: /tg-widget-test.html.
+            const _ua = navigator.userAgent || '';
+            const _tgWV = (window.WX11TG && window.WX11TG.isWebView)
+                ? window.WX11TG.isWebView()
+                : (/;\s*wv\)/.test(_ua) ||
+                   (/\bVersion\/4\.0\b/.test(_ua) && /Android/i.test(_ua) && !/\bSamsungBrowser\b/.test(_ua)) ||
+                   /\bTelegram\b/i.test(_ua) ||
+                   /\bFBAN\b|\bFBAV\b|\bInstagram\b|\bLine\//i.test(_ua));
             const tw = document.createElement('script');
             tw.src = 'https://telegram.org/js/telegram-widget.js?22';
             tw.setAttribute('data-telegram-login', 'roducbot');