[tang-vu]

Expose download-status outages while retaining verified transfer progress and allowing a fresh poll to recover.

Why this matters

A failed progress endpoint currently leaves a stale download bar looking live or displays nothing during an initial outage.

Root cause: Non-success polling responses return silently, and transport failures only reach the browser console.

Behavioral invariant: A status observation failure is visible separately from transfer or cancellation failure; stale successful bodies cannot clear a newer outage.

Implementation and compatibility

Expose statusError from the hook, render it in Models, preserve progress and cancellation receipts, and guard state publication after JSON decoding. Reconcile with beta's 45-second cancel acknowledgement contract without awaiting a subsequent progress read under that guard.

This updates the original canonical PR onto public-beta at 3c186f3f12ba21dad7b7266ec5449393529abb00; it does not create a competing replacement. The shared browser code applies to Linux, macOS and Windows installations. There is no persisted schema migration. Rollback is a revert/rebuild of the dashboard; server lifecycle and authorization remain backend-owned.

Overlap check

Searched open and closed upstream PRs by semantic keywords and inspected the complete 1,010-entry public-beta changed-file index on 2026-09-16. Searched production paths: ods/extensions/services/dashboard/src/hooks/useDownloadProgress.js, ods/extensions/services/dashboard/src/pages/Models.jsx.

Relevant same-file results: #4396 (open: feat(identity): make assistant naming generic and configurable), #4215 (open: Fix public-beta local reinstall blockers), #3843 (open: feat(models): compare catalog models before downloading), #3803 (open: fix(dashboard): keep dismissed download errors dismissed across polling), #4873 (merged: fix(downloads): bound cancellation acknowledgements), #4267 (merged: fix(dashboard-api): sanitize throughput metric samples in agent monitor), #4266 (merged: fix(dashboard-api): guard null nodes payload in cluster status refresh), #4207 (merged: feat(beta): workspace UX, Portal mascot and Settings refinement)

#4873 bounds cancellation acknowledgements; #3803 handles dismissal of terminal transfer errors; #3843 is model comparison. #3040 serializes progress polling and remains separate. This change reports observation failures without claiming that the backend download failed.

Regression and validation

Candidate commit: 8ebcc87250e63389838422fb2657c089ba2d6257.

• From ods/extensions/services/dashboard: npx vitest run src/hooks/__tests__/useDownloadProgress src/pages/Models — 66 passed.
• Hook outage assertions fail against untouched beta; all 66 candidate hook, cancellation, Models and activation tests pass. The follow-up malformed-JSON regression preserves visible transfer progress and verifies recovery without depending on concurrent polling, so it composes with fix(downloads): report accurate progress without overlapping polls #3040.
• Changed-file ESLint, git diff --check, and pre-commit secret/private-key/large-file checks pass. Existing lint warnings are not errors.
• Clean beta baseline: full dashboard 1,232 tests passed, lint and production build passed on Windows Node 24.14.1. CI uses Node 20 and validates Linux/macOS/Windows. No browser-on-hardware or live GPU/model-service claim is made by these mocked HTTP/UI tests.
• Broad make gate on a Linux-native clean beta checkout stops at the existing no-sudo Docker fallback contract (2 failures under the root test environment). The Windows-mounted copy additionally exposed CRLF-sensitive Hermes fixture assertions. Full-tree pre-commit finds existing dummy private-key test fixtures and Windows lacks awk for the heredoc hook; the candidate's scoped secret/key/size hooks pass. These limitations are not represented as successful runtime validation.

Review readiness and batch integration

Implementation and focused checks are complete; this PR is Ready for independent review. CI limits below remain visible and no upstream merge or deployment has been performed.

Exact-head CI at 2026-09-16T13:33:01.8060875Z for 8ebcc87250e63389838422fb2657c089ba2d6257: 37 successful checks; 0 failed; 0 pending; 4 skipped review/security jobs (not counted as passes).

All 37 executed current-head checks completed successfully; four review/security jobs were skipped. This establishes automated review readiness, not live hardware validation, an independent human review, or approval to merge.

All 20 exact candidate commits were merged into synthetic integration d3c05b74ddfa from beta 3c186f3f12ba21dad7b7266ec5449393529abb00. That exact head passed 1,279 tests across 167 files, full ESLint (0 errors; 618 existing warnings), production build, scoped secret/private-key/large-file hooks and git diff --check on Windows Node 24.14.1. These are mocked browser/HTTP checks, not live GPU or deployment evidence.

Verified merge order: #3044 → #3046 → #3025 → #3038 → #3043 → #3050 → #3312 → #3313 → #3315 → #3316 → #3376 → #3041 → #3042 → #3051 → #3065 → #3062 → #3039 → #3040 → #3049 → #2780.

Merge guidance for this scope: With #3040, retain its controller-owned single flight and 15-second headers/body race, and return either data or the decoded HTTP error within that race. Preserve this PR’s statusError/UI, the 45-second cancellation acknowledgement boundary, and both test sets. The synthetic merge replaces sequence IDs with controller ownership. External #3803 conflicts only in the progress test file; preserve its dismissal tests when integrating it.

The only textual conflicts inside the selected batch were #3316/#3040 (download hook plus tests) and #3046/#2780 (tests only). Use the linked integration commit as the reviewed resolution reference. Each PR remains independently based on beta; if merging them separately or squashing, reapply the relevant resolution and rerun affected suites. Outside-batch checks used git merge-tree only: #3846/#3848/#3841/#3843 merged textually, while #3803/#4356/#5276/#5125 conflicted. Textual compatibility alone does not establish runtime compatibility.

Additional clean-beta Linux checks: make lint, make smoke, and make simulate pass. make bats has five baseline environment failures (WSL classification, root permissions/preflight, and a 15 GB free-space boundary), in addition to the full-gate limitations described above. Installer/backend sources are unchanged by this batch. Rollback remains a revert and dashboard rebuild; no stored schema or backend lifecycle migration was introduced.