@bendyline/gezel-inference 1.0.0 → 1.0.2

package/dist/providers/native/capacity-budget.d.ts

@@ -5,7 +5,13 @@
  * VRAM and RAM are common on small discrete-GPU machines, so their ratio is
  * not enough to tell a GeForce from a genuinely shared GB10/iGPU pool.
  */
-export declare function setDetectedGpuVramBytes(bytes: number | null, unifiedMemory?: boolean): void;
+export declare function setDetectedGpuVramBytes(bytes: number | null, unifiedMemory?: boolean, reservedGpuBytes?: number | null, gpuAddressableBytes?: number | null): void;
+/**
+ * What engines may hold of memory an integrated GPU owns or can reach — its
+ * carve-out, or carve-out plus GTT — after the share the desktop it also
+ * drives needs.
+ */
+export declare function usableReservedGpuBytes(reservedGpuBytes: number | null | undefined): number;
 /** The published accelerator-memory figure, or null when none was measured. */
 export declare function getDetectedGpuVramBytes(): number | null;
 /**
@@ -26,13 +32,19 @@ export interface CapacityBudget {
     budgetBytes: number;
     /**
      * The FAST pool inside that budget: usable VRAM on a discrete card, the
-     * whole budget on unified / CPU hosts. Size KV slots and prompt caches
+     * whole budget on unified / CPU hosts — except an integrated GPU that can
+     * reach less than that (Linux GTT; see
+     * {@link CapacityBudgetInput.gpuAddressableBytes}). Size KV slots and prompt caches
      * against this, not against {@link budgetBytes} — on a discrete card the
      * rest of the budget is system RAM that weights stream from, and putting
      * more KV there than the card holds is how a GPU OOMs.
      */
     fastBytes: number;
-    /** Usable VRAM on a discrete card; 0 on unified / CPU-only hosts. */
+    /**
+     * Usable VRAM on a discrete card. On a unified host, the usable part of an
+     * integrated GPU's firmware carve-out — memory the GPU owns that free-RAM
+     * readings never include — and 0 when there is none. 0 on CPU-only hosts.
+     */
     vramBytes: number;
     /** The system-RAM share of the budget. */
     ramShareBytes: number;
@@ -59,6 +71,26 @@ export interface CapacityBudgetInput {
      */
     gpuVramBytes?: number | null;
     unifiedMemory?: boolean;
+    /**
+     * Memory firmware sets aside for an integrated GPU (an AMD "UMA frame
+     * buffer"): carved out before the OS counts RAM, so it is NOT inside
+     * `systemRamBytes`, and only the GPU can use it. Credited on a unified host
+     * only — an engine on the CPU build cannot reach it. Without this, raising
+     * the carve-out shrank the budget: the bytes left the RAM figure and were
+     * counted nowhere. Omit to fall back to the last published probe, under the
+     * same rule as `gpuVramBytes`.
+     */
+    reservedGpuBytes?: number | null;
+    /**
+     * The most memory an integrated GPU can reach: on Linux amdgpu, its
+     * carve-out plus GTT, the window of system RAM the kernel lets it map
+     * (half of RAM by default). Caps the FAST pool on a unified host — the GPU
+     * cannot hold more KV or weights than this, whatever the RAM share says —
+     * while the admission budget keeps the rest for layers the CPU runs. Omit
+     * to fall back to the last published probe, under the same rule as
+     * `gpuVramBytes`.
+     */
+    gpuAddressableBytes?: number | null;
 }
 /**
  * Resolve the memory a host can give resident local engines, per pool.

package/dist/providers/native/capacity-budget.js

@@ -67,6 +67,13 @@ const VRAM_USABLE_FRACTION = 0.95;
  * bytes, so those hosts take the unified curve instead.
  */
 const UNIFIED_VRAM_RATIO = 0.75;
+/**
+ * Held back from an integrated GPU's firmware carve-out (see
+ * {@link CapacityBudgetInput.reservedGpuBytes}) for the desktop it also
+ * drives. The discrete card's 5% margin is too thin here: on a 512 MiB
+ * carve-out it would leave the compositor 25 MiB.
+ */
+const CARVE_OUT_DISPLAY_RESERVE_BYTES = 512 * 1024 ** 2;
 /**
  * Last accelerator-memory figure `detectMemoryProfile` measured on this host,
  * or null when nothing has probed yet / no GPU memory figure was published.
@@ -81,6 +88,8 @@ const UNIFIED_VRAM_RATIO = 0.75;
  */
 let detectedGpuVramBytes = null;
 let detectedGpuUnifiedMemory;
+let detectedGpuReservedBytes = null;
+let detectedGpuAddressableBytes = null;
 /**
  * Publish the measured accelerator pool. Called by `detectMemoryProfile`.
  *
@@ -88,10 +97,26 @@ let detectedGpuUnifiedMemory;
  * VRAM and RAM are common on small discrete-GPU machines, so their ratio is
  * not enough to tell a GeForce from a genuinely shared GB10/iGPU pool.
  */
-export function setDetectedGpuVramBytes(bytes, unifiedMemory) {
-    detectedGpuVramBytes =
-        typeof bytes === 'number' && Number.isFinite(bytes) && bytes > 0 ? bytes : null;
+export function setDetectedGpuVramBytes(bytes, unifiedMemory, reservedGpuBytes, gpuAddressableBytes) {
+    detectedGpuVramBytes = positiveOrNull(bytes);
     detectedGpuUnifiedMemory = unifiedMemory;
+    detectedGpuReservedBytes = positiveOrNull(reservedGpuBytes);
+    detectedGpuAddressableBytes = positiveOrNull(gpuAddressableBytes);
+}
+function positiveOrNull(bytes) {
+    return typeof bytes === 'number' && Number.isFinite(bytes) && bytes > 0 ? bytes : null;
+}
+/**
+ * What engines may hold of memory an integrated GPU owns or can reach — its
+ * carve-out, or carve-out plus GTT — after the share the desktop it also
+ * drives needs.
+ */
+export function usableReservedGpuBytes(reservedGpuBytes) {
+    const reserved = positiveOrNull(reservedGpuBytes);
+    if (reserved === null)
+        return 0;
+    const display = Math.max(CARVE_OUT_DISPLAY_RESERVE_BYTES, Math.ceil(reserved * (1 - VRAM_USABLE_FRACTION)));
+    return Math.max(0, reserved - display);
 }
 /** The published accelerator-memory figure, or null when none was measured. */
 export function getDetectedGpuVramBytes() {
@@ -144,6 +169,16 @@ export function computeCapacityBudget(input = {}) {
     const sharedPool = hasCard && measuredVram >= systemRamBytes * UNIFIED_VRAM_RATIO;
     const unified = measuredUnifiedMemory ?? (isUnifiedMemoryHost() || sharedPool);
     const discrete = hasCard && !unified;
+    const reservedGpuBytes = input.reservedGpuBytes !== undefined
+        ? input.reservedGpuBytes
+        : input.unifiedMemory === undefined && input.gpuVramBytes === undefined
+            ? detectedGpuReservedBytes
+            : null;
+    const gpuAddressableBytes = input.gpuAddressableBytes !== undefined
+        ? input.gpuAddressableBytes
+        : input.unifiedMemory === undefined && input.gpuVramBytes === undefined
+            ? detectedGpuAddressableBytes
+            : null;
     const highMemory = systemRamBytes >= HIGH_MEMORY_THRESHOLD_BYTES;
     // Whichever bound leaves the host MORE memory wins between the fraction and
     // the capped reserve, then the 4 GiB floor reserve caps them both. Written
@@ -153,7 +188,11 @@ export function computeCapacityBudget(input = {}) {
     const unifiedShare = Math.max(0, Math.min(Math.max(unifiedFractionShare, systemRamBytes - UNIFIED_OS_RESERVE_MAX_BYTES), systemRamBytes - UNIFIED_OS_RESERVE_BYTES));
     const nonUnifiedShare = Math.min(Math.floor(systemRamBytes * (highMemory ? 0.8 : 0.6)), BUDGET_CAP_BYTES);
     const ramShareBytes = unified ? unifiedShare : nonUnifiedShare;
-    const vramBytes = discrete ? Math.floor(measuredVram * VRAM_USABLE_FRACTION) : 0;
+    const vramBytes = discrete
+        ? Math.floor(measuredVram * VRAM_USABLE_FRACTION)
+        : unified
+            ? usableReservedGpuBytes(reservedGpuBytes)
+            : 0;
     // The pre-cap curve, retained for slot sizing only.
     const concurrencyRamShare = unified
         ? Math.max(0, Math.min(unifiedFractionShare, systemRamBytes - UNIFIED_OS_RESERVE_BYTES, BUDGET_CAP_BYTES))
@@ -175,7 +214,12 @@ export function computeCapacityBudget(input = {}) {
             overriddenByEnv: true,
         };
     }
-    const fastBytes = discrete ? vramBytes : auto;
+    const addressable = positiveOrNull(gpuAddressableBytes);
+    const fastBytes = discrete
+        ? vramBytes
+        : unified && addressable !== null
+            ? Math.min(auto, usableReservedGpuBytes(addressable))
+            : auto;
     return {
         budgetBytes: auto,
         fastBytes,

package/dist/providers/native/device-capacity.d.ts

@@ -73,7 +73,7 @@ export declare function configuredEngineMemoryBytes(config: {
  * download pages hide is exactly one the launch path refuses. Omit
  * `configuredBytes` for the machine's automatic ceilings.
  */
-export declare function staticCapacityCeilings(budget: Pick<CapacityBudget, 'budgetBytes' | 'fastBytes' | 'kind'>, ramBytes: number, configuredBytes?: number): {
+export declare function staticCapacityCeilings(budget: Pick<CapacityBudget, 'budgetBytes' | 'fastBytes' | 'kind' | 'vramBytes'>, ramBytes: number, configuredBytes?: number, platform?: NodeJS.Platform): {
     budgetBytes: number;
     gpuBudgetBytes: number;
 };

package/dist/providers/native/device-capacity.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { readdir, stat } from 'node:fs/promises';
 import { homedir, totalmem } from 'node:os';
 import { join } from 'node:path';
-import { GEZEL_VERSION, NativeCapacityCommandSchema, NativeCapacityReplySchema, awakeNow, createLogger, isUnstampedDevBuild, } from '@bendyline/gezel';
+import { DS4_FULL_RESIDENCY_HEADROOM_BYTES, GEZEL_VERSION, NativeCapacityCommandSchema, NativeCapacityReplySchema, awakeNow, createLogger, isUnstampedDevBuild, } from '@bendyline/gezel';
 import { readSystemServiceRuntime, systemServiceHome } from '@bendyline/gezel-client/node';
 import { ConfigStore } from '../../fs/config-store.js';
 import { createPinnedFetch } from '../../remotes/pinned-fetch.js';
@@ -119,21 +119,39 @@ export function configuredEngineMemoryBytes(config) {
         ? config.localEngineMemoryGb * GIB
         : undefined;
 }
+/**
+ * GPU bytes a unified host may commit to one launch. macOS keeps 0.75 × RAM,
+ * near where Metal's recommended GPU working set sits. Linux unified hosts
+ * (DGX Spark GB10) have no such limit, so a large one may commit all but the
+ * OS reserve ds4's residency gate keeps: on a 121.6 GiB Spark, 0.75 × RAM
+ * (91.2 GiB) refused a GLM 5.3 Q2 launch that runs at 105 GiB with ~9 GiB to
+ * spare. Smaller Linux hosts stay on the 0.75 curve, which is the larger one there.
+ */
+function unifiedGpuCeilingBytes(ramBytes, platform) {
+    const curve = ramBytes * 0.75;
+    return platform === 'linux'
+        ? Math.max(curve, ramBytes - DS4_FULL_RESIDENCY_HEADROOM_BYTES)
+        : curve;
+}
 /**
  * The ledger's static ceilings: a request above either is refused at acquire,
  * whatever else is running. Shared with the media fit check so a model the
  * download pages hide is exactly one the launch path refuses. Omit
  * `configuredBytes` for the machine's automatic ceilings.
  */
-export function staticCapacityCeilings(budget, ramBytes, configuredBytes) {
+export function staticCapacityCeilings(budget, ramBytes, configuredBytes, platform = process.platform) {
     const budgetBytes = configuredBytes === undefined
         ? budget.budgetBytes
         : Math.min(configuredBytes, budget.budgetBytes);
     return {
         budgetBytes,
-        // Keep non-reclaimable accelerator commitments on the conservative curve;
-        // a larger RAM budget is not permission to wire the whole machine.
-        gpuBudgetBytes: Math.min(budgetBytes, budget.kind === 'unified' ? Math.min(budget.fastBytes, ramBytes * 0.75) : budget.fastBytes),
+        // Non-reclaimable accelerator commitments get their own ceiling: a larger
+        // RAM budget is not permission to wire the whole machine. An integrated
+        // GPU's carve-out (`vramBytes` on a unified host) is already the GPU's,
+        // and sits outside `ramBytes`.
+        gpuBudgetBytes: Math.min(budgetBytes, budget.kind === 'unified'
+            ? Math.min(budget.fastBytes, unifiedGpuCeilingBytes(ramBytes, platform) + budget.vramBytes)
+            : budget.fastBytes),
     };
 }
 export async function sampleDeviceCapacity(home) {

package/dist/providers/native/local-engine-runtime.js

@@ -260,6 +260,8 @@ export class LocalEngineRuntime {
                 ? {
                     unifiedMemory: memoryProfile.gpuMemoryKind === 'integrated' ||
                         memoryProfile.gpuMemoryKind === 'unified',
+                    reservedGpuBytes: memoryProfile.gpuReservedBytes ?? null,
+                    gpuAddressableBytes: memoryProfile.gpuAddressableBytes ?? null,
                 }
                 : {}),
             allowRamSpillover: config.allowRamSpillover ?? null,
@@ -1481,22 +1483,18 @@ export class LocalEngineRuntime {
                     vramBytes: capacity.vramBytes,
                 });
                 // Mirror the launch path's windowed-cache admission (see
-                // buildLlamaCppProvider): when the launch will decline the Gemma
-                // `--swa-full` auto-default (or the windowed cache is pinned), the
-                // full-attention plan above overstates the real allocation — re-plan
-                // with the windowed linearization so the previewed window matches
-                // what the engine will actually grant.
+                // buildLlamaCppProvider): unless `swaFull` is pinned, a
+                // sliding-window model runs the windowed cache, which the
+                // full-attention plan above overstates — re-plan with the windowed
+                // linearization so the previewed window matches what the engine will
+                // actually grant.
                 // Strict model-max deliberately does NOT gate this: for SWA models
                 // the windowed cache is the only layout whose native-window KV can
                 // fit real machines, and the strict minimum rides inside
                 // `requirement.minimumPerTurnCtxTokens`, so the windowed
                 // re-plan sheds slots or denies but never shortens the window.
                 const explicitSwaFull = config.llamaCppSwaFull ?? manifestEngineConfig?.swaFull;
-                const windowedCacheWillRun = (!admission.minimumSatisfied || admission.clamped || admission.slots < slots) &&
-                    (explicitSwaFull === false ||
-                        (explicitSwaFull === undefined &&
-                            isGemmaModel({ architecture: installed.architecture, modelId })));
-                if (windowedCacheWillRun) {
+                if (explicitSwaFull !== true) {
                     const windowed = estimateWindowedKvLinearization({
                         blockCount: summary.blockCount,
                         embeddingLength: summary.embeddingLength,
@@ -1536,9 +1534,13 @@ export class LocalEngineRuntime {
                             fixedPerSlotBytes: windowed.fixedBytes,
                         };
                     }
-                    else if ((summary.slidingWindow ?? 0) > 0 || explicitSwaFull === undefined) {
-                        // SWA model without a readable layout: the launch path leaves
-                        // such a launch untouched — preview the requested window.
+                    else if ((!admission.minimumSatisfied || admission.clamped || admission.slots < slots) &&
+                        (explicitSwaFull === false
+                            ? (summary.slidingWindow ?? 0) > 0
+                            : isGemmaModel({ architecture: installed.architecture, modelId }))) {
+                        // SWA model without a readable layout, over budget on full
+                        // math: the launch path leaves such a launch untouched — preview
+                        // the requested window.
                         return { grantedCtx, slots, kvCacheType: kv, plannedFieldsOk: false };
                     }
                 }

package/dist/providers/native/measured-budget.js

@@ -50,5 +50,7 @@ export async function measuredCapacityBudget() {
         systemRamBytes: profile.totalRamBytes,
         gpuVramBytes: profile.gpuVramBytes,
         unifiedMemory: profile.gpuMemoryKind === 'integrated' || profile.gpuMemoryKind === 'unified',
+        reservedGpuBytes: profile.gpuReservedBytes ?? null,
+        gpuAddressableBytes: profile.gpuAddressableBytes ?? null,
     });
 }

package/dist/providers/native/supervisor.d.ts

@@ -158,6 +158,11 @@ export interface NativeEngineSupervisorOptions {
     onLog?: (line: string) => void;
     /** Called for both expected and unexpected exits after a snapshot is sealed. */
     onExit?: (snapshot: NativeEngineExitSnapshot) => void | Promise<void>;
+    /**
+     * Called each time a start reaches readiness. Errors are caught and logged;
+     * a failing hook never fails the start.
+     */
+    onReady?: (launch: NativeEngineLaunch) => void;
     /**
      * Consulted after a start attempt fails (child died or never became
      * ready — not spawn errors, and not crashes after readiness). Return
@@ -214,6 +219,13 @@ export interface NativeEngineSupervisorOptions {
     psRunner?: () => Promise<NativeProcessSnapshot[]>;
     /** Platform seam for Windows owner-liveness semantics in orphan tests. */
     platform?: NodeJS.Platform;
+    /**
+     * The kernel's running count of out-of-memory kills, or null when it
+     * cannot be read. Compared across a child's life to tell Linux's
+     * out-of-memory killer from any other SIGKILL. Defaults to `oom_kill` in
+     * `/proc/vmstat` on Linux (any account can read it) and null elsewhere.
+     */
+    readOomKillCount?: () => number | null;
     /**
      * Test seam paired with `psRunner` — invoked instead of
      * `process.kill(pid, 'SIGKILL')`. Lets unit tests assert which pids
@@ -263,6 +275,7 @@ export declare class NativeEngineSupervisor {
     private readonly fetchImpl;
     private readonly onLog;
     private readonly onExit?;
+    private readonly onReady?;
     private readonly recoverStartup?;
     private readonly onRawLine?;
     private readonly logPrefix;
@@ -271,6 +284,9 @@ export declare class NativeEngineSupervisor {
     private readonly psRunner;
     private readonly killProcess;
     private readonly platform;
+    private readonly readOomKillCount;
+    /** `oom_kill` when the current child spawned; null where it cannot be read. */
+    private currentOomKills;
     private readonly logListeners;
     private recentStarts;
     private lastUsedAt;
@@ -482,6 +498,13 @@ export declare class NativeEngineSupervisor {
      */
     private runFreeze;
     private clearIdleTimer;
+    /**
+     * The counter's movement since `before`, when it rose. Another process
+     * killed in the same window would also move it, but a child that died by a
+     * SIGKILL this supervisor did not send while the counter rose is, in
+     * practice, the one the killer chose.
+     */
+    private oomKillsSince;
     private clearFreezeTimer;
     private clearHealthTimer;
 }
@@ -490,6 +513,8 @@ export declare function classifyNativeEnginePanic(line: string): {
     kind: NativeEnginePanicKind;
     line: string;
 } | undefined;
+/** `oom_kill` from `/proc/vmstat` (Linux 4.13+), or null when it cannot be read. */
+export declare function readLinuxOomKillCount(): number | null;
 /** Parse the portable `ps -axo pid=,ppid=,command=` shape. */
 export declare function parseNativeProcessSnapshot(stdout: string): NativeProcessSnapshot[];
 /** `code` stamped on every engine-launch failure. See {@link isEngineLaunchError}. */

package/dist/providers/native/supervisor.js

@@ -21,6 +21,7 @@
  * so we can drive the lifecycle without a real binary.
  */
 import { spawn as nodeSpawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import { basename } from 'node:path';
 import { awakeNow, createLogger } from '@bendyline/gezel';
 import { listProcessSnapshots } from '@bendyline/gezel-client/node';
@@ -179,6 +180,7 @@ export class NativeEngineSupervisor {
     fetchImpl;
     onLog;
     onExit;
+    onReady;
     recoverStartup;
     onRawLine;
     logPrefix;
@@ -187,6 +189,9 @@ export class NativeEngineSupervisor {
     psRunner;
     killProcess;
     platform;
+    readOomKillCount;
+    /** `oom_kill` when the current child spawned; null where it cannot be read. */
+    currentOomKills = null;
     // Ad-hoc log listeners attached at runtime (vs. the construction-time
     // `onLog` / `onRawLine` hooks). Used by the owning provider to
     // subscribe to engine log lines for the duration of a single request
@@ -274,6 +279,8 @@ export class NativeEngineSupervisor {
         this.onLog = opts.onLog ?? ((line) => log.info(line));
         if (opts.onExit)
             this.onExit = opts.onExit;
+        if (opts.onReady)
+            this.onReady = opts.onReady;
         if (opts.recoverStartup)
             this.recoverStartup = opts.recoverStartup;
         if (opts.onRawLine)
@@ -282,6 +289,8 @@ export class NativeEngineSupervisor {
         this.readinessPath = opts.readinessPath ?? '/health';
         this.readyOnAnyResponse = opts.readyOnAnyResponse ?? false;
         this.platform = opts.platform ?? process.platform;
+        this.readOomKillCount =
+            opts.readOomKillCount ?? (this.platform === 'linux' ? readLinuxOomKillCount : () => null);
         this.psRunner = opts.psRunner ?? (() => defaultPsRunner(this.platform));
         this.killProcess = opts.killProcess ?? ((pid, sig) => process.kill(pid, sig));
     }
@@ -600,6 +609,7 @@ export class NativeEngineSupervisor {
         this.currentDiagnostics = launch.diagnostics ? { ...launch.diagnostics } : undefined;
         this.currentOutput = '';
         this.currentPanic = undefined;
+        this.currentOomKills = this.readOomKillCount();
         this.expectedExitReason = undefined;
         this.onLog(`${this.logPrefix} launch ${JSON.stringify({
             pid: this.currentPid ?? null,
@@ -698,6 +708,12 @@ export class NativeEngineSupervisor {
             this.state = { kind: 'running', launch, child, healthFails: 0 };
             this.resetIdleTimer();
             this.startHealthWatch();
+            try {
+                this.onReady?.(launch);
+            }
+            catch (hookErr) {
+                this.onLog(`${this.logPrefix} onReady hook threw: ${hookErr instanceof Error ? hookErr.message : hookErr}`);
+            }
         }
         catch (err) {
             // The panic classifier state is cleared by handleExit — read it now,
@@ -998,13 +1014,23 @@ export class NativeEngineSupervisor {
         // the output didn't already explain the death more precisely: an
         // engine that printed `CUDA error: …` and then took SIGILL on the
         // way down is a CUDA fault, not an unrunnable build.
-        const panic = this.currentPanic ??
-            (signal === 'SIGILL'
-                ? {
-                    kind: 'illegal-instruction',
-                    line: 'engine terminated by SIGILL (illegal instruction) with no diagnostic output',
-                }
-                : undefined);
+        // An out-of-memory kill outranks anything the engine printed: a CUDA or
+        // Vulkan allocation line on the way there is a symptom of the same
+        // shortage, and the GPU-to-RAM ladder those lines trigger cannot help
+        // when RAM is what ran out.
+        const oomKilled = signal === 'SIGKILL' && !expected ? this.oomKillsSince(this.currentOomKills) : null;
+        const panic = oomKilled
+            ? {
+                kind: 'host-out-of-memory',
+                line: `engine killed by the Linux out-of-memory killer (oom_kill ${oomKilled.before} -> ${oomKilled.after})`,
+            }
+            : (this.currentPanic ??
+                (signal === 'SIGILL'
+                    ? {
+                        kind: 'illegal-instruction',
+                        line: 'engine terminated by SIGILL (illegal instruction) with no diagnostic output',
+                    }
+                    : undefined));
         const snapshot = {
             incidentId: `native-${pid ?? 'unknown'}-${exitedAt}`,
             ...(pid !== undefined ? { pid } : {}),
@@ -1062,6 +1088,7 @@ export class NativeEngineSupervisor {
         this.currentDiagnostics = undefined;
         this.currentOutput = '';
         this.currentPanic = undefined;
+        this.currentOomKills = null;
         this.expectedExitReason = undefined;
         if (priorState.kind === 'stopped')
             return;
@@ -1313,6 +1340,18 @@ export class NativeEngineSupervisor {
             this.idleTimer = undefined;
         }
     }
+    /**
+     * The counter's movement since `before`, when it rose. Another process
+     * killed in the same window would also move it, but a child that died by a
+     * SIGKILL this supervisor did not send while the counter rose is, in
+     * practice, the one the killer chose.
+     */
+    oomKillsSince(before) {
+        if (before === null)
+            return null;
+        const after = this.readOomKillCount();
+        return after !== null && after > before ? { before, after } : null;
+    }
     clearFreezeTimer() {
         if (this.freezeTimer) {
             clearTimeout(this.freezeTimer);
@@ -1346,6 +1385,9 @@ export function classifyNativeEnginePanic(line) {
     if (/CUDA error:.*device-side assert/i.test(line)) {
         return { kind: 'cuda-device-assert', line: clipped };
     }
+    if (/CUDA error:\s*(?:no kernel image is available|the provided PTX was compiled with an unsupported toolchain)/i.test(line)) {
+        return { kind: 'cuda-unsupported-device', line: clipped };
+    }
     if (/CUDA error:/i.test(line))
         return { kind: 'cuda-error', line: clipped };
     if (/assert(?:ion)? failed|GGML_ASSERT/i.test(line)) {
@@ -1353,6 +1395,16 @@ export function classifyNativeEnginePanic(line) {
     }
     return undefined;
 }
+/** `oom_kill` from `/proc/vmstat` (Linux 4.13+), or null when it cannot be read. */
+export function readLinuxOomKillCount() {
+    try {
+        const match = /^oom_kill (\d+)$/m.exec(readFileSync('/proc/vmstat', 'utf8'));
+        return match?.[1] ? Number(match[1]) : null;
+    }
+    catch {
+        return null;
+    }
+}
 function panicPriority(kind) {
     if (kind === 'cuda-error')
         return 1;

package/dist/remotes/identity.d.ts

@@ -73,6 +73,7 @@ export declare const IdentityResponseSchema: z.ZodObject<{
         "machine-engine": "machine-engine";
         "legacy-full": "legacy-full";
     }>>;
+    pairingMethods: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export type IdentityResponse = z.infer<typeof IdentityResponseSchema>;
 /** Hex SHA-256 of a PEM-encoded X.509 cert's DER bytes. */

package/dist/remotes/identity.js

@@ -70,6 +70,12 @@ export const IdentityResponseSchema = z.object({
     gezelVersion: z.string().optional(),
     protocolVersion: z.number().optional(),
     serviceRole: z.enum(['user', 'machine-engine', 'legacy-full']).optional(),
+    /**
+     * How a client may pair: `code` (a connect code shown on this device,
+     * SPAKE2 over `/v1/apps/pair/*`) and/or `approval` (`/v1/apps/register`,
+     * approved here). Absent → a server from before connect codes: approval only.
+     */
+    pairingMethods: z.array(z.string()).max(8).optional(),
 });
 /** Hex SHA-256 of a PEM-encoded X.509 cert's DER bytes. */
 export function certFingerprintFromPem(certPem) {

package/dist/remotes/pinned-fetch.d.ts

@@ -17,6 +17,8 @@ import type { PairedRemote, RemotesRegistry } from './types.js';
 export type ClosableFetch = typeof fetch & {
     close(): Promise<void>;
 };
+/** Connect timeout for a paired peer (see {@link createPinnedFetch}). */
+export declare const PINNED_CONNECT_TIMEOUT_MS = 5000;
 /**
  * Pin a single self-signed cert as the sole CA and skip hostname/SAN
  * verification. Long-call-friendly (no header/body timeouts) for streamed

package/dist/remotes/pinned-fetch.js

@@ -15,6 +15,29 @@
  */
 import { Agent, fetch as undiciFetch } from 'undici';
 import { IdentityResponseSchema, certFingerprintFromPem, fingerprintOfPublicKeyPem, verifyIdentitySignature, } from './identity.js';
+/** Connect timeout for a paired peer (see {@link createPinnedFetch}). */
+export const PINNED_CONNECT_TIMEOUT_MS = 5_000;
+/** Failures before any TLS handshake: no certificate was presented, so none can be stale. */
+const NO_HANDSHAKE_CODES = new Set([
+    'ECONNREFUSED',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'EHOSTDOWN',
+    'ENETDOWN',
+    'ETIMEDOUT',
+    'EADDRNOTAVAIL',
+    'UND_ERR_CONNECT_TIMEOUT',
+]);
+function failedBeforeHandshake(err) {
+    let current = err;
+    for (let depth = 0; depth < 6 && current && typeof current === 'object'; depth++) {
+        const code = current.code;
+        if (typeof code === 'string' && NO_HANDSHAKE_CODES.has(code))
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
 async function closeFetch(fetchImpl) {
     const close = fetchImpl?.close;
     if (typeof close === 'function')
@@ -34,6 +57,10 @@ export function createPinnedFetch(certPem) {
             // IP; the cert identity itself is the pin, reinforced by the identity
             // signature verified at connect time.
             checkServerIdentity: () => undefined,
+            // A peer on the local network answers a connect within milliseconds.
+            // Waiting undici's default 10 s for one that left the network only
+            // delays the fallback; streamed replies keep their unlimited timeouts.
+            timeout: PINNED_CONNECT_TIMEOUT_MS,
         },
         allowH2: true,
         headersTimeout: 0,
@@ -100,7 +127,9 @@ export function createPairedRemoteFetch(remote, registry, deps = {}) {
             return await active(url, init);
         }
         catch (originalError) {
-            if (init?.signal?.aborted)
+            // A refresh re-dials the same address; when that address answered
+            // nothing at all it doubles the wait and fails the same way.
+            if (init?.signal?.aborted || failedBeforeHandshake(originalError))
                 throw originalError;
             refresh ??= refreshPairedCertificate(remote, registry, makeBootstrap).then((cert) => {
                 const previous = active;

package/dist/remotes/types.d.ts

@@ -1,3 +1,11 @@
+export interface RemoteKnownModel {
+    id: string;
+    name: string;
+    contextWindow?: number;
+    supportsTools?: boolean;
+    supportsReasoning?: boolean;
+    parameterSize?: string;
+}
 export interface PairedRemote {
     /** Stable id A assigns to this server = its full identity fingerprint. */
     remoteId: string;
@@ -29,6 +37,12 @@ export interface PairedRemote {
     pairedAt: number;
     /** Last time A successfully reached this server (in-memory unless flushed). */
     lastSeenAt?: number;
+    /**
+     * The server's chat models the last time A listed them, already namespaced
+     * for A. Kept so a picker can show them, marked unavailable, while the
+     * server is asleep or A is off its network.
+     */
+    knownModels?: RemoteKnownModel[];
     /**
      * Runtime-managed connections are never persisted and cannot be removed by
      * the ordinary pairing UI. Today the only managed peer is this computer's

package/dist/runtime-lock.js

@@ -9,7 +9,7 @@ export class SingleInstanceError extends Error {
     lockPath;
     constructor(holderPid, lockPath) {
         super(holderPid > 0
-            ? `Another gezel daemon is already running for this home (pid ${holderPid}). Stop it first with \`gezel stop --daemon\` (plain \`gezel stop\` only halts AI work), or use a different GEZEL_HOME.`
+            ? `Another gezel daemon is already running for this home (pid ${holderPid}). Stop it first with \`gezel stop\`, or use a different GEZEL_HOME.`
             : `Could not acquire the single-instance lock at ${lockPath}.`);
         this.holderPid = holderPid;
         this.lockPath = lockPath;

package/dist/system/amdgpu-adapters.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The amdgpu devices Linux describes in sysfs, for the carve-out decision in
+ * gpu-carve-out.ts — the Linux counterpart of the DXCore adapter listing the
+ * device-health helper reads on Windows. Everything read here is
+ * world-readable, so the machine service's unprivileged account sees it too.
+ */
+import type { GpuAdapterFacts } from './gpu-carve-out.js';
+export interface SysfsIo {
+    readFile?: (path: string) => string;
+    readDir?: (path: string) => string[];
+}
+/**
+ * One entry per amdgpu device: `dedicatedBytes` from `mem_info_vram_total`,
+ * `sharedSystemBytes` from `mem_info_gtt_total` (the system RAM the kernel
+ * lets it map). Connector entries (`card0-HDMI-A-1`) and render nodes are
+ * skipped. Empty off Linux, without amdgpu, or when sysfs cannot be read.
+ */
+export declare function readAmdgpuAdapters(io?: SysfsIo): GpuAdapterFacts[];