@bendyline/gezel-inference 1.0.0 → 1.0.2

package/dist/providers/llama-cpp/devices.d.ts

@@ -31,6 +31,12 @@ export interface LlamaDeviceProbe {
     probedAt: string;
     /** True when returned from the on-disk cache rather than a fresh spawn. */
     cached: boolean;
+    /**
+     * The RAM the OS reported when the probe ran. Changing an integrated GPU's
+     * firmware carve-out changes this figure and the GPU's own, so a mismatch
+     * means the cached devices describe a machine that no longer exists.
+     */
+    systemRamBytes?: number;
 }
 export interface NvidiaRuntimeDevice {
     index: number;
@@ -72,16 +78,19 @@ export declare function pickBestGpuDevice(devices: LlamaDevice[]): LlamaDevice |
 /**
  * Probe device memory by running `<binaryPath> --list-devices`, caching
  * the result. Reads the cache when present (VRAM capacity is stable per
- * machine); pass `force` to re-probe. Any failure (spawn error, no
+ * machine) and the OS still reports the RAM it was probed with; pass
+ * `force` to re-probe. Any failure (spawn error, no
  * cache, unparseable output) resolves to an empty device list — the
  * planner then simply does nothing and the engine's own `--fit`/`-ngl
- * auto` takes over. `nowIso` is injectable for deterministic tests.
+ * auto` takes over. `nowIso` and `systemRamBytes` are injectable for
+ * deterministic tests.
  */
 export declare function probeLlamaDevices(opts: {
     binaryPath: string;
     home: string;
     force?: boolean;
     nowIso?: () => string;
+    systemRamBytes?: number;
 }): Promise<LlamaDeviceProbe>;
 /**
  * Best-effort VRAM for a non-NVIDIA GPU (AMD Radeon, Intel Arc, any Vulkan

package/dist/providers/llama-cpp/devices.js

@@ -17,6 +17,7 @@
  */
 import { execFile } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { totalmem } from 'node:os';
 import { delimiter, dirname, join } from 'node:path';
 import { promisify } from 'node:util';
 import { windowsHeadlessSpawnOptions } from '@bendyline/gezel/native';
@@ -124,20 +125,25 @@ function cachePath(home) {
 /**
  * Probe device memory by running `<binaryPath> --list-devices`, caching
  * the result. Reads the cache when present (VRAM capacity is stable per
- * machine); pass `force` to re-probe. Any failure (spawn error, no
+ * machine) and the OS still reports the RAM it was probed with; pass
+ * `force` to re-probe. Any failure (spawn error, no
  * cache, unparseable output) resolves to an empty device list — the
  * planner then simply does nothing and the engine's own `--fit`/`-ngl
- * auto` takes over. `nowIso` is injectable for deterministic tests.
+ * auto` takes over. `nowIso` and `systemRamBytes` are injectable for
+ * deterministic tests.
  */
 export async function probeLlamaDevices(opts) {
     const { binaryPath, home, force } = opts;
     const now = opts.nowIso ?? (() => new Date().toISOString());
+    const systemRamBytes = opts.systemRamBytes ?? totalmem();
     const path = cachePath(home);
     if (!force && existsSync(path)) {
         try {
             const cached = JSON.parse(readFileSync(path, 'utf8'));
-            if (Array.isArray(cached.devices))
+            // A cache without the RAM figure predates the check and re-probes once.
+            if (Array.isArray(cached.devices) && cached.systemRamBytes === systemRamBytes) {
                 return { ...cached, cached: true };
+            }
         }
         catch {
             // fall through to a fresh probe
@@ -165,7 +171,7 @@ export async function probeLlamaDevices(opts) {
         // Leave devices empty — caller treats "no devices" as "no offload target".
         return { devices, probedAt: now(), cached: false };
     }
-    const probe = { devices, probedAt: now(), cached: false };
+    const probe = { devices, probedAt: now(), cached: false, systemRamBytes };
     try {
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, JSON.stringify(probe, null, 2), 'utf8');

package/dist/providers/llama-cpp/engine-flags.d.ts

@@ -126,24 +126,6 @@ export interface EngineFlagInput {
      * when the client also replays `reasoning_content`.
      */
     reasoningPreserve?: boolean | undefined;
-    /**
-     * The model's GGUF `general.architecture`, for the Gemma-family auto
-     * defaults (sliding-window full cache). Undefined disables the arch
-     * heuristic; an explicit config/manifest `swaFull` still applies.
-     */
-    architecture?: string | undefined;
-    /** The resolved model id, a fallback for `architecture` (see isGemmaModel). */
-    modelId?: string | undefined;
-    /**
-     * Whether resident weights plus the full SWA KV cache fit the host's
-     * fast-memory pool (VRAM on a discrete GPU). The exact estimate honors
-     * per-layer SWA dimensions and shared-KV layers. `false` declines the
-     * auto-default so a low-memory device keeps the model's full context on
-     * the windowed cache instead of spilling or OOMing. `undefined` (unknown
-     * host/metadata) and `true` retain the compatibility default. An explicit
-     * config/manifest `swaFull` wins regardless.
-     */
-    swaFullAutoFits?: boolean | undefined;
     /**
      * The llama-server build's backend (`cuda`, `vulkan`, `metal`, `cpu`).
      * Only a GPU backend can receive the GPU-resident thread default.

package/dist/providers/llama-cpp/engine-flags.js

@@ -21,7 +21,6 @@
  * dependency; the real `GezelConfig` / `LlamaCppEngineConfig` satisfy
  * these shapes by construction.
  */
-import { isGemmaModel } from './kv-cache-type.js';
 /** Default `--cache-reuse` chunk when neither config nor manifest set it. */
 export const DEFAULT_CACHE_REUSE = 256;
 /**
@@ -101,7 +100,7 @@ function normalizeFlagKey(key) {
  * `args` array.
  */
 export function buildLlamaCppEngineArgs(input) {
-    const { config, perModel, planner, kvCacheType, slots, ggufHasMtp, installedDraftModelPath, reasoningFormat, reasoningPreserve, architecture, modelId, swaFullAutoFits, backend, hostCpuCount, } = input;
+    const { config, perModel, planner, kvCacheType, slots, ggufHasMtp, installedDraftModelPath, reasoningFormat, reasoningPreserve, backend, hostCpuCount, } = input;
     const args = [];
     // ── GPU-layer offload (`--n-gpu-layers`) ──────────────────────────
     const nGpuLayers = config.llamaCppNGpuLayers ?? perModel?.nGpuLayers ?? planner?.nGpuLayers;
@@ -176,26 +175,20 @@ export function buildLlamaCppEngineArgs(input) {
     //
     // So the engine already declines it precisely when it cannot honour it,
     // which is what the warning is for. Withholding the flag ourselves only
-    // cost reuse on multi-slot dense engines. Note the coupling this exposes:
-    // the memory-driven `--swa-full` decision below also silently decides
-    // whether Gemma gets any cross-request prefix reuse at all.
+    // cost reuse on multi-slot dense engines. Gemma therefore gets it only
+    // with a pinned `--swa-full` below.
     const explicitCacheReuse = config.llamaCppCacheReuse ?? perModel?.cacheReuse;
     const cacheReuse = explicitCacheReuse ?? DEFAULT_CACHE_REUSE;
     if (cacheReuse > 0)
         args.push('--cache-reuse', String(cacheReuse));
     // ── SWA full cache (`--swa-full`) ─────────────────────────────────
-    // Tri-state: explicit config/manifest `true`/`false` wins; `undefined`
-    // at both layers falls through to the Gemma-family auto-default. Gemma's
-    // sliding-window attention refuses cross-request prefix reuse under the
-    // memory-efficient windowed cache; the full cache preserves old SWA KV
-    // for cache operations by allocating full-context storage on every
-    // cache-owning layer. The cost varies sharply with model geometry, so
-    // Auto is gated on `swaFullAutoFits`: when weights + full KV do not fit
-    // fast memory, Gemma launches with the windowed cache instead.
-    const swaFull = config.llamaCppSwaFull ??
-        perModel?.swaFull ??
-        (swaFullAutoFits !== false && isGemmaModel({ architecture, modelId }));
-    if (swaFull)
+    // Opt-in only: an explicit config/manifest `swaFull`. Gemma used to get
+    // it by default for cross-request prefix reuse, until a paired A/B on
+    // gemma4-31b (2026-10-15) showed the full cache decodes 17-25% slower at
+    // every context depth, because decode reads each sliding-window layer's
+    // whole cache, and costs 51 GB more at 64K. Trials ran 19% longer in
+    // total despite the better reuse.
+    if (config.llamaCppSwaFull ?? perModel?.swaFull)
         args.push('--swa-full');
     // ── Thread / batch overrides ──────────────────────────────────────
     // The GPU-resident default needs positive evidence that no model compute
@@ -248,7 +241,8 @@ export function buildLlamaCppEngineArgs(input) {
         const nMax = config.llamaCppSpecDraftNMax ?? perModel?.spec?.nMax;
         if (typeof nMax === 'number')
             args.push('--spec-draft-n-max', String(nMax));
-        // v0.6.0 supports probabilistic selection only for MTP/simple drafts.
+        // v0.7.0 supports probabilistic selection only for MTP/simple drafts
+        // (DFlash/LiLiCorr ignore it).
         // Leave the upstream greedy default untouched unless explicitly set.
         if ((safeSpecType === 'draft-mtp' || safeSpecType === 'draft-simple') &&
             config.llamaCppSpecDraftSampling) {

package/dist/providers/llama-cpp/gguf-metadata-async.js

@@ -122,6 +122,9 @@ async function runInWorker(path, options) {
     const id = nextId++;
     return new Promise((resolveSummary, reject) => {
         pending.set(id, { resolve: resolveSummary, reject });
+        // Held while busy: an unreferenced worker let a plain Node host exit
+        // mid-await during an engine cold start.
+        target.ref();
         target.postMessage({ id, path, ...(options ? { options } : {}) });
     });
 }
@@ -141,6 +144,8 @@ function ensureWorker() {
             else if (worker === next)
                 worker = null;
         });
+        // An idle reader must never hold the event loop open; runInWorker refs it
+        // only while a request is in flight.
         next.unref();
         worker = next;
         return next;
@@ -158,6 +163,8 @@ function onMessage(reply) {
     if (!request)
         return;
     pending.delete(reply.id);
+    if (pending.size === 0)
+        worker?.unref();
     if (reply.error)
         request.reject(new Error(reply.error));
     else if (reply.summary)

package/dist/providers/llama-cpp/gguf-metadata.js

@@ -32,8 +32,9 @@ const GgufValueType = {
     INT64: 11,
     FLOAT64: 12,
 };
-// `general.file_type` enum from llama.cpp/src/llama.h. Only the
-// common values — the enum has ~30 entries and upstream adds more.
+// `general.file_type` enum (`llama_ftype`) from llama.cpp's include/llama.h.
+// Copy new values from upstream rather than guessing: this table once mapped
+// 30 to BF16 (upstream 30 is IQ4_XS, BF16 is 32) and had no NVFP4 at all.
 // Anything unrecognised is reported by number.
 const FILE_TYPE_NAMES = {
     0: 'ALL_F32',
@@ -54,8 +55,24 @@ const FILE_TYPE_NAMES = {
     18: 'MOSTLY_Q6_K',
     19: 'MOSTLY_IQ2_XXS',
     20: 'MOSTLY_IQ2_XS',
+    21: 'MOSTLY_Q2_K_S',
+    22: 'MOSTLY_IQ3_XS',
     23: 'MOSTLY_IQ3_XXS',
-    30: 'MOSTLY_BF16',
+    24: 'MOSTLY_IQ1_S',
+    25: 'MOSTLY_IQ4_NL',
+    26: 'MOSTLY_IQ3_S',
+    27: 'MOSTLY_IQ3_M',
+    28: 'MOSTLY_IQ2_S',
+    29: 'MOSTLY_IQ2_M',
+    30: 'MOSTLY_IQ4_XS',
+    31: 'MOSTLY_IQ1_M',
+    32: 'MOSTLY_BF16',
+    36: 'MOSTLY_TQ1_0',
+    37: 'MOSTLY_TQ2_0',
+    38: 'MOSTLY_MXFP4_MOE',
+    39: 'MOSTLY_NVFP4',
+    40: 'MOSTLY_Q1_0',
+    41: 'MOSTLY_Q2_0',
 };
 /**
  * The quantization tag a GGUF declares about itself, in the shape the model

package/dist/providers/llama-cpp/gpu-startup-watch.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Did a GPU build of llama-server actually get its GPU? Read from the
+ * engine's own startup output, because nothing else says.
+ *
+ * The bundled builds load their GPU backend with dlopen (`GGML_BACKEND_DL`),
+ * and in a release build ggml skips a backend that fails to load without a
+ * word. A CUDA backend that loads but cannot initialize prints one error line
+ * and registers no devices. Either way the engine starts, answers, and runs
+ * every token on the CPU — at a fraction of the speed the person's hardware
+ * and Settings promise — while gezel reports the CUDA or Vulkan build it
+ * launched.
+ *
+ * llama.cpp names every GPU it will use while loading a model
+ * (`using device CUDA0 (NVIDIA GB10) …`), integrated GPUs included. A GPU
+ * build that reached readiness after loading a model without that line ran
+ * without its GPU. The explicit lines say why when there is a why to say.
+ */
+export type GpuUnusedReason = 
+/** The CUDA runtime loaded and refused to start: `failed to initialize CUDA`. */
+'init-failed'
+/** The backend loaded and found no device it could use. */
+ | 'no-devices'
+/** No sign of the GPU backend at all: it failed to load, silently. */
+ | 'not-loaded';
+export interface GpuUnused {
+    backend: 'cuda' | 'vulkan';
+    reason: GpuUnusedReason;
+    /** The engine's own words, when it gave any. */
+    detail?: string;
+}
+export declare class GpuStartupWatch {
+    private readonly backend;
+    private usingGpu;
+    private sawModelLoad;
+    private initFailure;
+    private noDevices;
+    constructor(backend: string | undefined);
+    observe(line: string): void;
+    /** At readiness: what kept the GPU out, or null when it is in use or this is no GPU build. */
+    verdict(): GpuUnused | null;
+}

package/dist/providers/llama-cpp/gpu-startup-watch.js

@@ -0,0 +1,58 @@
+/**
+ * Did a GPU build of llama-server actually get its GPU? Read from the
+ * engine's own startup output, because nothing else says.
+ *
+ * The bundled builds load their GPU backend with dlopen (`GGML_BACKEND_DL`),
+ * and in a release build ggml skips a backend that fails to load without a
+ * word. A CUDA backend that loads but cannot initialize prints one error line
+ * and registers no devices. Either way the engine starts, answers, and runs
+ * every token on the CPU — at a fraction of the speed the person's hardware
+ * and Settings promise — while gezel reports the CUDA or Vulkan build it
+ * launched.
+ *
+ * llama.cpp names every GPU it will use while loading a model
+ * (`using device CUDA0 (NVIDIA GB10) …`), integrated GPUs included. A GPU
+ * build that reached readiness after loading a model without that line ran
+ * without its GPU. The explicit lines say why when there is a why to say.
+ */
+const USING_GPU = /\busing device (?:CUDA|Vulkan|ROCm|SYCL|MTL)\d+\b/;
+const CUDA_INIT_FAILED = /ggml_cuda_init: failed to initialize CUDA:\s*(.+?)\s*$/;
+const VULKAN_NO_DEVICES = /ggml_vulkan: No devices found/;
+/**
+ * Lines llama.cpp prints at the same verbosity as `using device`, while
+ * loading a model. Without one the output is too quiet to conclude anything.
+ */
+const MODEL_LOAD = /\b(?:llama_model_loader:|load_tensors:|print_info:|llama_model_load_from_file_impl:)/;
+export class GpuStartupWatch {
+    backend;
+    usingGpu = false;
+    sawModelLoad = false;
+    initFailure;
+    noDevices = false;
+    constructor(backend) {
+        this.backend = backend;
+    }
+    observe(line) {
+        if (USING_GPU.test(line))
+            this.usingGpu = true;
+        if (MODEL_LOAD.test(line))
+            this.sawModelLoad = true;
+        const failure = CUDA_INIT_FAILED.exec(line);
+        if (failure?.[1])
+            this.initFailure = failure[1];
+        if (VULKAN_NO_DEVICES.test(line))
+            this.noDevices = true;
+    }
+    /** At readiness: what kept the GPU out, or null when it is in use or this is no GPU build. */
+    verdict() {
+        const backend = this.backend;
+        if ((backend !== 'cuda' && backend !== 'vulkan') || this.usingGpu)
+            return null;
+        if (backend === 'cuda' && this.initFailure) {
+            return { backend, reason: 'init-failed', detail: this.initFailure };
+        }
+        if (backend === 'vulkan' && this.noDevices)
+            return { backend, reason: 'no-devices' };
+        return this.sawModelLoad ? { backend, reason: 'not-loaded' } : null;
+    }
+}

package/dist/providers/llama-cpp/models.d.ts

@@ -236,6 +236,11 @@ export interface LlamaCppModelManagerOptions {
         engine: 'llama-cpp' | 'ds4';
         id: string;
     }) => void;
+    /**
+     * The llama-server backend installs are judged against for a catalog
+     * source's `excludeBackends`. Test seam — defaults to the process's own.
+     */
+    resolveBackend?: () => string | undefined;
 }
 export declare class LlamaCppModelManager {
     private readonly modelsRoot;
@@ -244,6 +249,7 @@ export declare class LlamaCppModelManager {
     private readonly fetchImpl;
     private readonly engine;
     private readonly onInstalled?;
+    private readonly resolveBackend;
     /**
      * In-flight installs. `install()` registers an entry on first yield
      * and clears it in the iterator's `finally` block, so consumers

package/dist/providers/llama-cpp/models.js

@@ -35,13 +35,14 @@ import { createHash } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { basename, join, resolve } from 'node:path';
-import { createLogger } from '@bendyline/gezel';
+import { createLogger, llamaCppBackendExclusion, llamaCppBackendLabel } from '@bendyline/gezel';
 import { listBundleModelFiles, publishStagedModel, safeBundleModelPath, } from '../../models/bundle-storage.js';
 import { evaluateCatalogDrift } from '../../models/catalog-drift.js';
 import { catalogPayloadFingerprint, describeCatalogPayload, } from '../../models/catalog-payload-identity.js';
 import { MODEL_HASH_READ_BUFFER_BYTES, assertModelStorePathSafe, findModelRoot, findRenamedModelId, hashModelPayloadFiles, inspectModelDirectory, listIncompleteModelDownloads, listOverlayModelIds, makeSharedModelReadable, modelExistsOnlyReadOnly, modelStorageRoots, pruneModelPayloadFiles, readOnlyModelError, removeModelDir, verifyReadOnlyModelPayload, } from '../../models/storage-roots.js';
 import { checkDiskSpace, describeDiskShortfall } from '../../utils/disk-space.js';
 import { downloadWithRetry } from '../../utils/download-with-retry.js';
+import { currentLlamaCppBackend } from './backend-health.js';
 import { ggufQuantizationTag, readGgufSummary } from './gguf-metadata.js';
 import { backfillGgufQuantization } from './gguf-quantization-backfill.js';
 /**
@@ -58,6 +59,7 @@ export class LlamaCppModelManager {
     fetchImpl;
     engine;
     onInstalled;
+    resolveBackend;
     /**
      * In-flight installs. `install()` registers an entry on first yield
      * and clears it in the iterator's `finally` block, so consumers
@@ -78,6 +80,7 @@ export class LlamaCppModelManager {
         this.catalog = opts.catalog;
         this.fetchImpl = opts.fetchImpl ?? fetch;
         this.onInstalled = opts.onInstalled;
+        this.resolveBackend = opts.resolveBackend ?? currentLlamaCppBackend;
     }
     /**
      * The catalog source block this manager downloads from — `ds4` for the
@@ -435,6 +438,17 @@ export class LlamaCppModelManager {
                 };
                 return;
             }
+            if (this.engine === 'llama-cpp') {
+                const backend = this.resolveBackend();
+                const excluded = llamaCppBackendExclusion(manifest.llamaCpp, backend);
+                if (excluded && backend) {
+                    yield {
+                        type: 'error',
+                        error: `chat-model "${catalogId}" is not available on the ${llamaCppBackendLabel(backend)} llama.cpp engine: ${excluded}`,
+                    };
+                    return;
+                }
+            }
             tracked.totalBytes = installSrc.approxSizeBytes;
             yield* this.runInstall(catalogId, manifest, tracked, skipSha, includeMmproj);
         }
@@ -964,6 +978,10 @@ includeMmproj = true) {
     // after install without a second download.
     if (src.draftModel) {
         out.push({
+            ...(src.draftModel.huggingfaceRepo
+                ? { huggingfaceRepo: src.draftModel.huggingfaceRepo }
+                : {}),
+            ...(src.draftModel.revision ? { revision: src.draftModel.revision } : {}),
             repoPath: src.draftModel.filename,
             destFilename: basename(src.draftModel.filename),
             sha256: src.draftModel.sha256,

package/dist/providers/llama-cpp/offload-planner.d.ts

@@ -286,10 +286,9 @@ export interface WindowedKvLinearization {
  * than the layer ratio — global layers carry fewer KV heads at wider head
  * dims (31b: 10 layers × 4 heads × 512+512 vs 50 layers × 16 heads ×
  * 256+256) — so full-attention math overstates the windowed cache ~14×
- * and using it for admission over-clamps or over-denies exactly the
- * launches the `--swa-full` decline is trying to keep whole (the
- * 2026-08-04 gemma4-26b sweep shipped 19–56K windows on a 65536 request
- * this way).
+ * and using it for admission over-clamps or over-denies launches the
+ * windowed cache holds easily (the 2026-08-04 gemma4-26b sweep shipped
+ * 19–56K windows on a 65536 request this way).
  *
  * Returns undefined when the header lacks the SWA layout (no window, no
  * pattern, length mismatches) so callers fall back to their conservative
@@ -323,17 +322,3 @@ export declare function estimateExactPerSlotKvBytesF16(input: Omit<WindowedKvInp
  */
 export declare function estimateLinearHybridKvLinearization(input: WindowedKvInput): WindowedKvLinearization | undefined;
 export declare function estimateWindowedKvLinearization(input: WindowedKvInput): WindowedKvLinearization | undefined;
-export interface SwaFullFastMemoryFitInput {
-    residentWeightsBytes: number;
-    fullKvBytes: number;
-    /** Already safety-discounted fast-memory budget (VRAM on a discrete GPU). */
-    fastBudgetBytes: number;
-    /** Fast-memory reservations held by models that are already resident. */
-    committedOtherBytes?: number | undefined;
-}
-/**
- * Whether Auto may keep `--swa-full` without spilling the model or KV cache
- * out of the fast pool. The capacity budget already reserves driver/OS
- * headroom, so this comparison must not discount it a second time.
- */
-export declare function fitsSwaFullInFastMemory(input: SwaFullFastMemoryFitInput): boolean;

package/dist/providers/llama-cpp/offload-planner.js

@@ -406,10 +406,9 @@ const SWA_UBATCH_MARGIN_TOKENS = 2048;
  * than the layer ratio — global layers carry fewer KV heads at wider head
  * dims (31b: 10 layers × 4 heads × 512+512 vs 50 layers × 16 heads ×
  * 256+256) — so full-attention math overstates the windowed cache ~14×
- * and using it for admission over-clamps or over-denies exactly the
- * launches the `--swa-full` decline is trying to keep whole (the
- * 2026-08-04 gemma4-26b sweep shipped 19–56K windows on a 65536 request
- * this way).
+ * and using it for admission over-clamps or over-denies launches the
+ * windowed cache holds easily (the 2026-08-04 gemma4-26b sweep shipped
+ * 19–56K windows on a 65536 request this way).
  *
  * Returns undefined when the header lacks the SWA layout (no window, no
  * pattern, length mismatches) so callers fall back to their conservative
@@ -512,13 +511,3 @@ export function estimateWindowedKvLinearization(input) {
         fixedBytes: Math.round(swaElemsPerToken * bytesPerElement * (slidingWindow + SWA_UBATCH_MARGIN_TOKENS) * loops),
     };
 }
-/**
- * Whether Auto may keep `--swa-full` without spilling the model or KV cache
- * out of the fast pool. The capacity budget already reserves driver/OS
- * headroom, so this comparison must not discount it a second time.
- */
-export function fitsSwaFullInFastMemory(input) {
-    const required = Math.max(0, input.residentWeightsBytes) + Math.max(0, input.fullKvBytes);
-    const available = Math.max(0, input.fastBudgetBytes - Math.max(0, input.committedOtherBytes ?? 0));
-    return Number.isFinite(required) && Number.isFinite(available) && required <= available;
-}

package/dist/providers/llama-cpp/provider.d.ts

@@ -22,6 +22,7 @@
  * lazily respawn its process (see {@link shutdown}).
  */
 import { type DisableThinkingRequestShape, LlamaCppSession, type ReasoningEffortRequestShape, type ToolGrammarFallback } from '@bendyline/gezel/local-loop';
+import type { StartupCrashVerdict } from '@bendyline/gezel/native';
 import type { GpuArbiter } from '../gpu-arbiter.js';
 import type { NativeEngineLifecycleSnapshot, NativeEngineSupervisor } from '../native/supervisor.js';
 import { ProviderQueue } from '../queue.js';
@@ -55,6 +56,7 @@ export declare class LlamaCppProvider implements LLMProvider {
      */
     private toolGrammarFloor;
     private readonly supervisor?;
+    private readonly startupCrashVerdict?;
     /** Explicit base URL when no supervisor is managing the process. */
     private readonly externalBaseUrl?;
     private readonly defaultModel;
@@ -242,6 +244,12 @@ export declare class LlamaCppProvider implements LLMProvider {
          * `baseUrl`.
          */
         supervisor?: NativeEngineSupervisor;
+        /**
+         * What a startup crash did to its build's standing (strike or
+         * quarantine), looked up by incident id when a start fails, so the error
+         * says what the next request will actually do.
+         */
+        startupCrashVerdict?: (incidentId: string) => StartupCrashVerdict | undefined;
         /**
          * Fixed base URL of an already-running llama-server. Used in
          * dev iteration and LAN-shared setups. Mutually exclusive with

package/dist/providers/llama-cpp/provider.js

@@ -57,6 +57,7 @@ export class LlamaCppProvider {
      */
     toolGrammarFloor = null;
     supervisor;
+    startupCrashVerdict;
     /** Explicit base URL when no supervisor is managing the process. */
     externalBaseUrl;
     defaultModel;
@@ -247,6 +248,8 @@ export class LlamaCppProvider {
         }
         if (opts.supervisor)
             this.supervisor = opts.supervisor;
+        if (opts.startupCrashVerdict)
+            this.startupCrashVerdict = opts.startupCrashVerdict;
         if (opts.baseUrl)
             this.externalBaseUrl = opts.baseUrl.replace(/\/+$/, '');
         // Only register an evictor when we own the lifecycle. External-baseUrl
@@ -848,7 +851,7 @@ export class LlamaCppProvider {
         catch (err) {
             const nativeExit = this.supervisor.lastExitSnapshot?.();
             if (nativeExit && !nativeExit.expected && nativeExit.exitedAt >= ensureStartedAt) {
-                throw new NativeEngineCrashedError(nativeExit, err);
+                throw new NativeEngineCrashedError(nativeExit, err, this.startupCrashVerdict?.(nativeExit.incidentId));
             }
             throw err;
         }

package/dist/providers/mlx/provider.js

@@ -27,7 +27,7 @@
  */
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
-import { AwakeBudget, autoCompactedNotice, createAwakeTimeout, createLogger, leaksUntaggedReasoning, turnCancelledMessage, } from '@bendyline/gezel';
+import { AwakeBudget, autoCompactedNotice, createAwakeTimeout, createLogger, isProjectStartingCall, leaksUntaggedReasoning, turnCancelledMessage, } from '@bendyline/gezel';
 import { leadingSystemMessages, standaloneTurnMessages, toolSurfaceSize, } from '@bendyline/gezel/local-loop';
 import { computeToolBudgetChars } from '@bendyline/gezel/local-loop';
 import { extractReasoningWithProfile, profileBehaviorConfig, profileHasBehavior, } from '../../model-profile/runtime.js';
@@ -58,9 +58,9 @@ import { MlxEngineGate } from './engine-gate.js';
 import { EngineHold, engineHoldLabelFor } from './engine-hold.js';
 import { EngineLogRouter } from './engine-log-router.js';
 import { MlxEngineStatsSampler } from './engine-stats-sampler.js';
-import { StreamingReasoningSplit, requestOpensReasoning, } from './reasoning-stream.js';
+import { REASONING_OPEN_HEADER, StreamingReasoningSplit, engineOpensReasoning, requestOpensReasoning, } from './reasoning-stream.js';
 import { applyMlxRequestShape } from './request-shape.js';
-import { PRE_FIRST_BYTE_BASE_MS, buildMidStreamDropMessage, buildPreFirstByteAbortMessage, computePreFirstByteBudgetMs, estimatePromptTokens, formatTps, isMidStreamConnectionDrop, translateMlxHttpError, } from './runtime-diagnostics.js';
+import { PRE_FIRST_BYTE_BASE_MS, buildMidStreamDropMessage, buildPreFirstByteAbortMessage, computePreFirstByteBudgetMs, estimatePromptTokens, formatTps, isMidStreamConnectionDrop, mlxHttpError, } from './runtime-diagnostics.js';
 import { classifyMlxFatalErrorLine, classifyMlxStartupLine, } from './stdout-parser.js';
 import { salvageTextualToolCalls } from './textual-tool-call-salvage.js';
 import { APPEND_TO_FILE_CONTINUATION_TOOL, MlxToolCallAccumulator, applyCallableToolGrammar, callableRequestToolNames, chatCompletionToolName, externalToolsAsChatCompletions, hermesRequiredArgGrammarRequested, missingTopLevelRequiredToolArgs, toChatCompletionsTools, validatorReportedMissingRequiredArgs, } from './tool-call-protocol.js';
@@ -1571,7 +1571,7 @@ class MlxSession extends StreamingSessionBase {
                     this.deps.markUsed();
                     const txt = await res.text().catch(() => '');
                     log.error(`turn#${seq}.${turn} HTTP-ERR status=${res.status} ${res.statusText}`);
-                    throw new Error(translateMlxHttpError(res.status, res.statusText, txt));
+                    throw mlxHttpError(res.status, res.statusText, txt);
                 }
                 if (debugOn) {
                     log.debug(`turn#${seq}.${turn} HTTP-OK status=${res.status} ` +
@@ -1616,10 +1616,14 @@ class MlxSession extends StreamingSessionBase {
                 // `turn.ramble-detection`; per-model thresholds come from
                 // the validated config. Absent → detector disabled.
                 //
-                // Read from the request, not only the template: a thinking-off
-                // request renders the block already closed, and seeding from the
-                // template streamed a whole `write_file` call into the reasoning pane.
-                const opensInReasoning = requestOpensReasoning(this.deps.templateOpensReasoning, body);
+                // The engine reports what the rendered prompt did; the template guess
+                // is only a fallback. A thinking-off request renders the block already
+                // closed (seeding from the template streamed a whole `write_file` call
+                // into the reasoning pane), and Qwen 3.5 0.8B's template opens it only
+                // when thinking is explicitly on (guessing closed streamed its thoughts
+                // and a stray `</think>` as the reply).
+                const opensInReasoning = engineOpensReasoning(res.headers.get(REASONING_OPEN_HEADER)) ??
+                    requestOpensReasoning(this.deps.templateOpensReasoning, body);
                 const rambleConfig = profileBehaviorConfig(this.deps.profile, 'turn.ramble-detection');
                 const ramble = outputIsConstrained(this.deps.tuning)
                     ? inertRambleDetector()
@@ -2652,7 +2656,7 @@ class MlxSession extends StreamingSessionBase {
                         output =
                             "You already posted a question card to the user earlier in this turn. The second `ask_user_question` call was suppressed so the user only sees one card. END YOUR TURN NOW — the user's answer to the first question will arrive as the next user message; this turn produces no further visible content.";
                     }
-                    else if ((call.function.name === 'start_project' || call.function.name === 'start_job') &&
+                    else if (isProjectStartingCall(call.function.name, args) &&
                         startedProjectOrJobThisTurn) {
                         // Success-led phrasing — wild-caught on gemma4-26b/MLX,
                         // the previous "DO NOT call..." wording got misread by
@@ -2749,8 +2753,7 @@ class MlxSession extends StreamingSessionBase {
                         // Successful start_project / start_job → arm the
                         // per-turn macro guard so subsequent variants get
                         // intercepted above before reaching the bridge.
-                        if ((call.function.name === 'start_project' || call.function.name === 'start_job') &&
-                            !output.startsWith('ERROR:')) {
+                        if (isProjectStartingCall(call.function.name, args) && !output.startsWith('ERROR:')) {
                             startedProjectOrJobThisTurn = { tool: call.function.name, firstResult: output };
                         }
                     }

package/dist/providers/mlx/python/batch_processors.py

@@ -0,0 +1,26 @@
+"""batch_processors — per-sequence logits-processor lists for mlx_lm's
+BatchGenerator that stay aligned across waves.
+
+mlx_lm 0.31.3's `GenerationBatch.filter()` trims `logits_processors` only
+`if any(self.logits_processors)`. Once every live sequence carries `[]`, the
+finished ones' entries survive the filter, and the next wave's sequences are
+appended after them at the wrong index: a request's tool grammar, think
+budget or response format then ran for its first token only, and in a mixed
+wave one sequence's grammar could land on another's output. Caught
+2026-10-13: a JSON-schema request right after a plain one came back as free
+text. Giving every sequence a non-empty list keeps `any()` true, so the
+filter always trims. The pass-through costs nothing measurable (A/B on
+gemma4-e4b, 2026-10-14: 64.3 vs 62.7 tok/s median, within noise).
+"""
+
+from typing import Any, Callable, List, Sequence
+
+
+def pass_through_logits(tokens: Any, logits: Any) -> Any:
+    """A no-op processor that keeps a sequence's processor list non-empty."""
+    return logits
+
+
+def per_sequence_processors(processors: Sequence[Callable[[Any, Any], Any]]) -> List[Callable[[Any, Any], Any]]:
+    """The processor list to hand BatchGenerator for one sequence; never empty."""
+    return list(processors) or [pass_through_logits]