diff --git a/findings.md b/findings.md
index de863aa..e0ac060 100644
--- a/findings.md
+++ b/findings.md
@@ -87,6 +87,12 @@
 - The `admin-web` tracking page still used the removed browser-plugin monitoring bridge for `立即采集`, even though the current monitoring architecture is desktop-client driven and runs silently in the background.
 - The user clarified that `立即采集` must only be available when the current logged-in user's own desktop client is online; another user's online client in the same workspace must not make the action available.
 - `MonitoringService.CollectNow` previously fell back to the most recently online workspace client regardless of `user_id`, so the backend rule did not match the desired UI rule until this turn.
+- Media publishing is now treated as the desktop runtime foreground channel, while AI monitoring remains background/best-effort. This is implemented through admission control rather than queue ordering alone.
+- A new in-memory `publish-scheduler.ts` owns publish queue selection, per-platform active locks, and 3-6 second post-completion platform cooldowns. It intentionally does not persist state or copy monitor scheduler question/cross-day semantics.
+- `runtime-controller.ts` now uses per-kind lease-in-flight tracking, so a monitor lease request no longer blocks a publish lease request at the runtime-controller guard.
+- Total runtime concurrency is now derived from hardware class, current Electron process health, and optional `GEO_DESKTOP_MAX_TOTAL_CONCURRENCY`, while monitor capacity is capped to leave a reserved foreground publish slot.
+- When publish is queued or publish lease is in flight, monitor admission returns zero; even a same-platform/cooldown-blocked publish backlog prevents monitor from consuming the publish reserve.
+- Desktop runtime diagnostics now expose `publishScheduler` alongside `monitorScheduler` in the runtime snapshot.
 
 ## Technical Decisions
 | Decision | Rationale |
@@ -111,6 +117,8 @@
 | Only enforce active auth preflight for monitor tasks on `yuanbao`, `kimi`, and `deepseek` | The user explicitly allowed anonymous execution for the other AI monitoring platforms |
 | Gate tracking `collect-now` on the current actor's online desktop client, not any workspace client | The user explicitly wants the action tied to the current logged-in account's client presence |
 | Expose current-user desktop-client availability through the monitoring dashboard response | `TrackingView` already loads the dashboard, so returning the runtime bit there avoids a second frontend probe and keeps button gating aligned with backend validation |
+| Implement publish priority through runtime admission control, not just queue sort order | Already-running monitor tasks cannot be moved by queue priority; publish needs reserved execution capacity to avoid starvation |
+| Keep monitor hard preemption out of the first publish-priority slice | Soft priority with reserved capacity avoids browser half-submit and lease/result inconsistency while still preventing monitor saturation |
 
 ## Issues Encountered
 | Issue | Resolution |
diff --git a/progress.md b/progress.md
index 9c913fe..21802ed 100644
--- a/progress.md
+++ b/progress.md
@@ -387,6 +387,21 @@
 | 2026-03-31 | Playwright MCP browser open failed on `/.playwright-mcp` | 1 | Used preview HTTP verification instead of blocking on browser environment setup |
 | 2026-03-31 | Browser click on the login CTA did not submit the form, so Playwright stayed on `/login` | 1 | Added an explicit `@click=\"handleSubmit\"` binding to the CTA and re-ran the E2E flow successfully |
 
+### Phase 21: Foreground Publish Admission
+- **Status:** complete
+- Actions taken:
+  - Confirmed the current runtime only starts publish when `state.activeExecutions.size === 0`, so an already-running monitor can block media publish.
+  - Locked the implementation model: publish is foreground, monitor is background, publish receives reserved runtime capacity, and publish platform policy stays in a lightweight in-memory scheduler.
+  - Added `apps/desktop-client/src/main/publish-scheduler.ts` with in-memory queueing, same-platform active locks, and 3-6 second platform cooldowns.
+  - Refactored `runtime-controller.ts` so publish can start while monitor is running, monitor pauses behind any publish backlog, and lease-in-flight is tracked separately for publish vs. monitor.
+  - Added hardware/runtime adaptive total concurrency with `GEO_DESKTOP_MAX_TOTAL_CONCURRENCY` as an optional cap and a reserved publish slot for monitor budgeting.
+  - Exposed `publishScheduler` in the desktop runtime snapshot and added scheduler unit tests.
+- Verification:
+  - `pnpm --filter @geo/desktop-client build` passed.
+  - `pnpm --filter @geo/desktop-client test` passed: 5 files, 26 tests.
+  - `git diff --check` passed.
+  - `pnpm --filter @geo/desktop-client typecheck` failed before checking runtime changes because `electron.vite.config.ts` has a Vite 5/8 plugin type mismatch.
+
 ## 5-Question Reboot Check
 | Question | Answer |
 |----------|--------|
diff --git a/task_plan.md b/task_plan.md
index 3fb9f9b..678f638 100644
--- a/task_plan.md
+++ b/task_plan.md
@@ -4,7 +4,7 @@
 Continue the desktop AI monitoring implementation by first adding a client-side local scheduler with durable queueing and adaptive execution policy, then adding a reusable hidden Playwright CDP execution layer that attaches to Electron Chromium and reuses existing account partitions.
 
 ## Current Phase
-Phase 20
+Phase 21
 
 ## Phases
 ### Phase 1: Progress Verification
@@ -134,6 +134,13 @@ Phase 20
 - [x] Run targeted frontend/backend verification for the repaired flow
 - **Status:** complete
 
+### Phase 21: Foreground Publish Admission
+- [x] Add a lightweight in-memory publish scheduler with per-platform locks and cooldowns
+- [x] Refactor desktop runtime admission so publish is foreground and monitor is background
+- [x] Add hardware/runtime adaptive total concurrency with a publish-reserved slot
+- [x] Run targeted desktop verification
+- **Status:** complete
+
 ## Key Questions
 1. How should the desktop client defer and locally optimize monitor-task execution without violating one-task-per-platform serialism?
 2. What is the smallest durable local cache that allows same-day resume while safely dropping stale next-day monitor tasks?
@@ -159,6 +166,9 @@ Phase 20
 | Allow stale cross-day monitor tasks to be dropped on the client | The user explicitly allows漏采 and does not want next-day catch-up for unfinished tasks |
 | Implement hidden browser infrastructure before expanding more adapters | Qwen and similar platforms cannot reliably use direct API calls and need browser-native execution |
 | Only require active login for monitor tasks on `yuanbao` / `kimi` / `deepseek` | The user clarified that other AI platforms can still query and collect anonymously |
+| Treat media publish as foreground and AI monitoring as background | The user explicitly wants publish to have the highest priority and never be starved by monitor execution |
+| Reserve runtime capacity for publish instead of relying on queue priority alone | Running monitor tasks cannot be preempted by queue ordering, so production-grade priority needs admission control and reserved capacity |
+| Keep publish scheduling in memory with per-platform locks/cooldowns | Publish needs foreground platform admission but not monitor-style durable recovery, cross-day pruning, or question cooldown semantics |
 
 ## Errors Encountered
 | Error | Attempt | Resolution |
@@ -171,6 +181,7 @@ Phase 20
 | Login button click did not trigger the sign-in flow in browser testing even though the backend endpoint worked | 1 | Bound the primary login button directly to `handleSubmit` and re-ran browser verification until the route change succeeded |
 | Desktop monitor execution is currently global-serial and lacks durable local queueing | 1 | Replace the ad-hoc in-memory FIFO with a scheduler module that owns persistence, concurrency, and stale-task cleanup |
 | `connectOverCDP()` is not wired yet even though `playwright-core` is installed | 1 | Add a dedicated hidden-browser manager instead of pushing CDP code directly into adapters or the runtime controller |
+| `pnpm --filter @geo/desktop-client typecheck` fails in `electron.vite.config.ts` due to a pre-existing Vite 5/8 plugin type mismatch | 1 | Verified this change with `pnpm --filter @geo/desktop-client build` and `pnpm --filter @geo/desktop-client test`; leave config dependency alignment as a separate fix |
 
 ## Notes
 - Re-check task_plan.md before major implementation decisions.