@bendyline/gezel-inference 1.0.2 → 1.0.3

package/dist/providers/llama-cpp/cache-adapter.d.ts

@@ -123,7 +123,7 @@ export declare class LlamaCppCacheAdapter implements EngineCacheAdapter {
      */
     private allocationTail;
     private engineGeneration;
-    private readonly slotCount;
+    private slotCount;
     private readonly resolveBaseUrl;
     private readonly resolveAuthToken;
     private readonly fetchImpl;
@@ -168,6 +168,12 @@ export declare class LlamaCppCacheAdapter implements EngineCacheAdapter {
      */
     private slotActionsUnsupported;
     constructor(opts: LlamaCppCacheAdapterOptions);
+    /**
+     * Follow an engine relaunched with a different `--parallel` count. Every
+     * binding goes with it: a session pinned to a slot the new engine lacks
+     * would send an `id_slot` the server rejects.
+     */
+    setSlotCount(slotCount: number): void;
     /** The provider survives engine restarts, but its resident slot contents do not. */
     resetEngineState(): void;
     /**

package/dist/providers/llama-cpp/cache-adapter.js

@@ -181,6 +181,15 @@ export class LlamaCppCacheAdapter {
             throw new Error('Invalid llama disk cache budget');
         this.diskCacheBudgetBytes = budget * 1024 * 1024;
     }
+    /**
+     * Follow an engine relaunched with a different `--parallel` count. Every
+     * binding goes with it: a session pinned to a slot the new engine lacks
+     * would send an `id_slot` the server rejects.
+     */
+    setSlotCount(slotCount) {
+        this.slotCount = Math.max(1, Math.floor(slotCount));
+        this.resetEngineState();
+    }
     /** The provider survives engine restarts, but its resident slot contents do not. */
     resetEngineState() {
         this.engineGeneration++;

package/dist/providers/llama-cpp/devices.d.ts

@@ -37,6 +37,8 @@ export interface LlamaDeviceProbe {
      * means the cached devices describe a machine that no longer exists.
      */
     systemRamBytes?: number;
+    /** {@link llamaBinaryFingerprint} of the build that answered. */
+    binary?: string;
 }
 export interface NvidiaRuntimeDevice {
     index: number;
@@ -75,11 +77,20 @@ export declare function maxGpuVramBytes(devices: LlamaDevice[]): number;
  * (e.g. "AMD Radeon RX 7900 XTX") in a tier rationale. Pure — unit-tested.
  */
 export declare function pickBestGpuDevice(devices: LlamaDevice[]): LlamaDevice | null;
+/**
+ * Which build a cached listing came from: its path (the backend) and its
+ * size and mtime (the release, since a native update rewrites the files).
+ * A listing taken from the CPU build, or from the build an update replaced,
+ * said "no GPU" about a 32 GB Radeon and was served for the rest of the day
+ * (2026-10-19).
+ */
+export declare function llamaBinaryFingerprint(binaryPath: string): string;
 /**
  * Probe device memory by running `<binaryPath> --list-devices`, caching
  * the result. Reads the cache when present (VRAM capacity is stable per
- * machine) and the OS still reports the RAM it was probed with; pass
- * `force` to re-probe. Any failure (spawn error, no
+ * machine), the OS still reports the RAM it was probed with, and the same
+ * build answered it; an empty listing is re-asked hourly. Pass `force` to
+ * re-probe. Any failure (spawn error, no
  * cache, unparseable output) resolves to an empty device list — the
  * planner then simply does nothing and the engine's own `--fit`/`-ngl
  * auto` takes over. `nowIso` and `systemRamBytes` are injectable for

package/dist/providers/llama-cpp/devices.js

@@ -16,7 +16,7 @@
  * `backend.json` pattern in `core/native/llama-backend.ts`.
  */
 import { execFile } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { totalmem } from 'node:os';
 import { delimiter, dirname, join } from 'node:path';
 import { promisify } from 'node:util';
@@ -122,11 +122,34 @@ export function pickBestGpuDevice(devices) {
 function cachePath(home) {
     return join(home, 'engines', 'llama-cpp', 'devices.json');
 }
+/**
+ * An empty listing is re-asked after this long. A CPU build always answers
+ * "(none)", but so can a GPU build whose driver was mid-update, and a cached
+ * "no GPU" sizes every model against system RAM.
+ */
+const EMPTY_DEVICES_RETRY_MS = 60 * 60 * 1000;
+/**
+ * Which build a cached listing came from: its path (the backend) and its
+ * size and mtime (the release, since a native update rewrites the files).
+ * A listing taken from the CPU build, or from the build an update replaced,
+ * said "no GPU" about a 32 GB Radeon and was served for the rest of the day
+ * (2026-10-19).
+ */
+export function llamaBinaryFingerprint(binaryPath) {
+    try {
+        const { size, mtimeMs } = statSync(binaryPath);
+        return `${binaryPath}|${size}|${Math.floor(mtimeMs)}`;
+    }
+    catch {
+        return binaryPath;
+    }
+}
 /**
  * Probe device memory by running `<binaryPath> --list-devices`, caching
  * the result. Reads the cache when present (VRAM capacity is stable per
- * machine) and the OS still reports the RAM it was probed with; pass
- * `force` to re-probe. Any failure (spawn error, no
+ * machine), the OS still reports the RAM it was probed with, and the same
+ * build answered it; an empty listing is re-asked hourly. Pass `force` to
+ * re-probe. Any failure (spawn error, no
  * cache, unparseable output) resolves to an empty device list — the
  * planner then simply does nothing and the engine's own `--fit`/`-ngl
  * auto` takes over. `nowIso` and `systemRamBytes` are injectable for
@@ -137,11 +160,19 @@ export async function probeLlamaDevices(opts) {
     const now = opts.nowIso ?? (() => new Date().toISOString());
     const systemRamBytes = opts.systemRamBytes ?? totalmem();
     const path = cachePath(home);
+    const binary = llamaBinaryFingerprint(binaryPath);
     if (!force && existsSync(path)) {
         try {
             const cached = JSON.parse(readFileSync(path, 'utf8'));
-            // A cache without the RAM figure predates the check and re-probes once.
-            if (Array.isArray(cached.devices) && cached.systemRamBytes === systemRamBytes) {
+            // A cache without the RAM figure or the binary predates that check and
+            // re-probes once.
+            const emptyExpired = Array.isArray(cached.devices) &&
+                cached.devices.length === 0 &&
+                !(Date.parse(now()) - Date.parse(cached.probedAt) < EMPTY_DEVICES_RETRY_MS);
+            if (Array.isArray(cached.devices) &&
+                cached.systemRamBytes === systemRamBytes &&
+                cached.binary === binary &&
+                !emptyExpired) {
                 return { ...cached, cached: true };
             }
         }
@@ -171,7 +202,13 @@ export async function probeLlamaDevices(opts) {
         // Leave devices empty — caller treats "no devices" as "no offload target".
         return { devices, probedAt: now(), cached: false };
     }
-    const probe = { devices, probedAt: now(), cached: false, systemRamBytes };
+    const probe = {
+        devices,
+        probedAt: now(),
+        cached: false,
+        systemRamBytes,
+        binary,
+    };
     try {
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, JSON.stringify(probe, null, 2), 'utf8');

package/dist/providers/llama-cpp/models.js

@@ -748,7 +748,10 @@ export class LlamaCppModelManager {
         installed.fileSha256 = await hashModelPayloadFiles(itemDir, verifiedDigests);
         await writeFile(join(itemDir, 'manifest.json'), JSON.stringify(installed, null, 2), 'utf8');
         await makeSharedModelReadable(itemDir);
-        const warning = summary.chatTemplateMissing
+        // ds4-server renders each family's prompt itself and never reads
+        // tokenizer.chat_template; DeepSeek V4.1 ships no Jinja template at all,
+        // and its first install warned that replies "may be incoherent".
+        const warning = summary.chatTemplateMissing && this.engine === 'llama-cpp'
             ? 'Model has no embedded chat template (tokenizer.chat_template is missing). llama-server will fall back to a generic template that may not match this model — replies may be incoherent. Consider a different quant of the same model.'
             : undefined;
         try {

package/dist/providers/llama-cpp/offload-planner.d.ts

@@ -166,6 +166,29 @@ export declare function planMoeOffload(input: MoeOffloadInput): MoeOffloadDecisi
 export declare function degradeMoeOffloadDecision(decision: MoeOffloadDecision | undefined): MoeOffloadDecision | null;
 /** Dense counterpart of {@link degradeMoeOffloadDecision}. */
 export declare function degradeDenseFfnOffloadDecision(decision: MoeOffloadDecision | undefined, blockCount: number | undefined): MoeOffloadDecision | null;
+/**
+ * Room an extra engine slot must leave on the card. Other programs' graphics
+ * memory moves while a model runs (a browser, a video, the desktop), and a
+ * two-slot launch planned to within a gigabyte or two died with a Vulkan
+ * out-of-memory when they took more (2026-10-19, a 32 GB card).
+ */
+export declare const EXTRA_SLOT_GPU_CUSHION_BYTES: number;
+/**
+ * Fewer slots before system RAM. Keep `slots` only when the model stays
+ * fully on the GPU with {@link EXTRA_SLOT_GPU_CUSHION_BYTES} to spare;
+ * otherwise drop to one slot when that alone keeps it fully on the GPU. A
+ * model that needs system RAM even at one slot keeps its slots and the
+ * planner's split. `plan` prices one slot count against one VRAM pool.
+ */
+export declare function shedSlotsForGpuResidency(input: {
+    slots: number;
+    vramBytes: number;
+    plan: (slots: number, vramBytes: number) => MoeOffloadDecision;
+}): {
+    slots: number;
+    decision: MoeOffloadDecision;
+    shed: boolean;
+};
 export interface KvReserveInput {
     blockCount?: number | undefined;
     embeddingLength?: number | undefined;

package/dist/providers/llama-cpp/offload-planner.js

@@ -272,6 +272,33 @@ export function degradeDenseFfnOffloadDecision(decision, blockCount) {
     }
     return null;
 }
+/**
+ * Room an extra engine slot must leave on the card. Other programs' graphics
+ * memory moves while a model runs (a browser, a video, the desktop), and a
+ * two-slot launch planned to within a gigabyte or two died with a Vulkan
+ * out-of-memory when they took more (2026-10-19, a 32 GB card).
+ */
+export const EXTRA_SLOT_GPU_CUSHION_BYTES = 2 * 1024 ** 3;
+/**
+ * Fewer slots before system RAM. Keep `slots` only when the model stays
+ * fully on the GPU with {@link EXTRA_SLOT_GPU_CUSHION_BYTES} to spare;
+ * otherwise drop to one slot when that alone keeps it fully on the GPU. A
+ * model that needs system RAM even at one slot keeps its slots and the
+ * planner's split. `plan` prices one slot count against one VRAM pool.
+ */
+export function shedSlotsForGpuResidency(input) {
+    const decision = input.plan(input.slots, input.vramBytes);
+    const keep = { slots: input.slots, decision, shed: false };
+    if (input.slots <= 1 || input.vramBytes <= 0)
+        return keep;
+    const roomy = input.plan(input.slots, Math.max(0, input.vramBytes - EXTRA_SLOT_GPU_CUSHION_BYTES));
+    if (roomy.fullGpuResidency)
+        return keep;
+    const single = input.plan(1, input.vramBytes);
+    if (!single.fullGpuResidency)
+        return keep;
+    return { slots: 1, decision: single, shed: true };
+}
 /** Bytes per KV element for llama-server's `--cache-type-k/v` values. */
 const KV_BYTES_PER_ELEMENT = {
     f32: 4,

package/dist/providers/llama-cpp/provider.d.ts

@@ -143,7 +143,9 @@ export declare class LlamaCppProvider implements LLMProvider {
     /** Request-scoped effort shape for compatible wrappers such as ds4-server. */
     private readonly reasoningEffortRequestShape;
     /** Engine batch width; see the `batchMaxConcurrency` constructor opt. */
-    private readonly batchMaxConcurrency;
+    private batchMaxConcurrency;
+    /** See the `reserveBackgroundSlot` constructor opt. */
+    private readonly reservesBackgroundLane;
     /**
      * Number of real llama-server request slots (`--parallel`). The provider
      * queue can intentionally be wider than this by one reserved background
@@ -152,7 +154,7 @@ export declare class LlamaCppProvider implements LLMProvider {
      * boundary: cache slot save/restore plus the streamed engine request must
      * never exceed the slots the native server actually owns.
      */
-    private readonly engineRequestWidth;
+    private engineRequestWidth;
     private engineRequestsActive;
     private readonly engineRequestWaiters;
     /**
@@ -409,7 +411,7 @@ export declare class LlamaCppProvider implements LLMProvider {
      */
     private cacheAdapter;
     private slotSavePath?;
-    private readonly launchedSlots;
+    private launchedSlots;
     setCacheAdapter(adapter: import('./cache-adapter.js').LlamaCppCacheAdapter): void;
     getCacheAdapter(): import('./cache-adapter.js').LlamaCppCacheAdapter | null;
     /**
@@ -430,6 +432,15 @@ export declare class LlamaCppProvider implements LLMProvider {
      * would 400 silently, and the debug probe's slot narration was fiction.
      */
     getLaunchedSlots(): number;
+    /**
+     * Follow a supervised engine that is relaunching with fewer `--parallel`
+     * slots because the wider launch ran the GPU out of memory. Runs between
+     * the failed start and the retry, while the request that asked for the
+     * engine still holds its lease. Refused when more requests hold leases
+     * than the narrower engine has slots: two turns on one slot would save and
+     * restore it under each other.
+     */
+    narrowEngineSlots(slots: number): boolean;
     /**
      * Claim one physical llama-server request slot.
      *

package/dist/providers/llama-cpp/provider.js

@@ -25,7 +25,7 @@ import * as os from 'node:os';
 import { createLogger } from '@bendyline/gezel';
 import { DEFAULT_NUM_CTX, LlamaCppSession, NativeEngineCrashedError, TOOL_GRAMMAR_FALLBACK_ORDER, constrainedToolNoSignalMsForModel, engineRequestAbortError, parseEnvMs, } from '@bendyline/gezel/local-loop';
 import { ProviderDisposedError } from '../provider-disposal.js';
-import { ProviderQueue, QUEUE_WAIT_NOTICE_DELAY_MS, QUEUE_WAIT_NOTICE_REPEAT_MS, backgroundLaneCap, defaultAmbientQuietMs, } from '../queue.js';
+import { ProviderQueue, QUEUE_WAIT_NOTICE_DELAY_MS, QUEUE_WAIT_NOTICE_REPEAT_MS, backgroundLaneCap, defaultAmbientQuietMs, defaultQueueYieldQuantumMs, } from '../queue.js';
 import { createToolExecutor } from '../tool-executor.js';
 import { classifyStartupLine } from './stdout-parser.js';
 // The session and its helpers live in core so a phone runs the same loop.
@@ -147,6 +147,8 @@ export class LlamaCppProvider {
     reasoningEffortRequestShape;
     /** Engine batch width; see the `batchMaxConcurrency` constructor opt. */
     batchMaxConcurrency;
+    /** See the `reserveBackgroundSlot` constructor opt. */
+    reservesBackgroundLane;
     /**
      * Number of real llama-server request slots (`--parallel`). The provider
      * queue can intentionally be wider than this by one reserved background
@@ -341,7 +343,10 @@ export class LlamaCppProvider {
         // mid-turn compaction wedges the turn, the same failure the MLX
         // single-slot path hit. See the matching note in the MLX provider.
         const interactiveConcurrency = batchMax;
-        const queueConcurrency = opts.reserveBackgroundSlot === false ? slots : Math.max(slots, interactiveConcurrency + 1);
+        this.reservesBackgroundLane = opts.reserveBackgroundSlot !== false;
+        const queueConcurrency = this.reservesBackgroundLane
+            ? Math.max(slots, interactiveConcurrency + 1)
+            : slots;
         this.queue = new ProviderQueue({
             // llama-server is launched with `--parallel ${slots}` (see
             // `buildLlamaCppProvider` in chat/manager.ts) so the engine has matching
@@ -364,6 +369,9 @@ export class LlamaCppProvider {
             // a multi-minute chore turn never lands right before their next
             // move. Applies to ds4 too — its provider wraps this class.
             ambientQuietMs: defaultAmbientQuietMs(),
+            // A tool loop hands the slot to a waiting conversation between
+            // iterations once it has held it this long (see `QueueLease`).
+            yieldQuantumMs: defaultQueueYieldQuantumMs(),
         });
     }
     /**
@@ -458,6 +466,31 @@ export class LlamaCppProvider {
     getLaunchedSlots() {
         return this.launchedSlots;
     }
+    /**
+     * Follow a supervised engine that is relaunching with fewer `--parallel`
+     * slots because the wider launch ran the GPU out of memory. Runs between
+     * the failed start and the retry, while the request that asked for the
+     * engine still holds its lease. Refused when more requests hold leases
+     * than the narrower engine has slots: two turns on one slot would save and
+     * restore it under each other.
+     */
+    narrowEngineSlots(slots) {
+        const next = Math.max(1, Math.floor(slots));
+        if (next >= this.launchedSlots || this.engineRequestsActive > next)
+            return false;
+        this.launchedSlots = next;
+        this.engineRequestWidth = next;
+        this.batchMaxConcurrency = Math.min(this.batchMaxConcurrency, next);
+        this.queue.narrow({
+            concurrency: this.reservesBackgroundLane
+                ? Math.max(next, this.batchMaxConcurrency + 1)
+                : next,
+            interactiveConcurrency: this.batchMaxConcurrency,
+            backgroundConcurrency: backgroundLaneCap(next),
+        });
+        this.cacheAdapter?.setSlotCount(next);
+        return true;
+    }
     /**
      * Claim one physical llama-server request slot.
      *

package/dist/providers/mlx/provider.js

@@ -58,7 +58,7 @@ import { MlxEngineGate } from './engine-gate.js';
 import { EngineHold, engineHoldLabelFor } from './engine-hold.js';
 import { EngineLogRouter } from './engine-log-router.js';
 import { MlxEngineStatsSampler } from './engine-stats-sampler.js';
-import { REASONING_OPEN_HEADER, StreamingReasoningSplit, engineOpensReasoning, requestOpensReasoning, } from './reasoning-stream.js';
+import { REASONING_OPEN_HEADER, StreamingReasoningSplit, engineOpensReasoning, reopenTemplateReasoning, requestOpensReasoning, } from './reasoning-stream.js';
 import { applyMlxRequestShape } from './request-shape.js';
 import { PRE_FIRST_BYTE_BASE_MS, buildMidStreamDropMessage, buildPreFirstByteAbortMessage, computePreFirstByteBudgetMs, estimatePromptTokens, formatTps, isMidStreamConnectionDrop, mlxHttpError, } from './runtime-diagnostics.js';
 import { classifyMlxFatalErrorLine, classifyMlxStartupLine, } from './stdout-parser.js';
@@ -2159,7 +2159,7 @@ class MlxSession extends StreamingSessionBase {
                 // accumulated into `lastTurnReasoning` so the chat bubble can
                 // render it behind a collapsed expander.
                 {
-                    const split = extractReasoningWithProfile(turnContent, this.deps.profile);
+                    const split = extractReasoningWithProfile(reopenTemplateReasoning(turnContent, opensInReasoning), this.deps.profile);
                     turnContent = split.visible;
                     if (split.reasoning) {
                         this.lastTurnReasoning =

package/dist/providers/mlx/reasoning-stream.d.ts

@@ -56,6 +56,21 @@ export declare function templateTextOpensReasoning(template: string): TemplateRe
  * into the reasoning pane. Absent means on, matching the engine's default.
  */
 export declare function requestOpensReasoning(templateOpen: TemplateReasoningOpen | undefined, body: Record<string, unknown>): boolean;
+/**
+ * Restore the reasoning opener the chat template supplied, before the
+ * end-of-turn reasoning pass.
+ *
+ * When the rendered prompt left generation inside a reasoning block, the
+ * model's text starts mid-thought and carries only the closer. The live split
+ * knows that, but `extractReasoning` reads a lone `<channel|>` as stray and
+ * keeps the thoughts as the reply: Gemma 4 E4B, after a tool response, saved
+ * "The user wants to know…I need to answer in one sentence.The launch is on
+ * Friday…", and the stall check then asked it to answer again.
+ *
+ * Unchanged when the turn did not open in reasoning, when the model opened a
+ * block itself, or when no closer arrived.
+ */
+export declare function reopenTemplateReasoning(text: string, opensInReasoning: boolean): string;
 export interface ReasoningSplitChunk {
     visible: string;
     reasoning: string;

package/dist/providers/mlx/reasoning-stream.js

@@ -112,6 +112,41 @@ export function requestOpensReasoning(templateOpen, body) {
         return true;
     return kwargs.enable_thinking !== false;
 }
+/** The opener `extractReasoning` pairs with each closer a template-opened turn emits. */
+const OPENER_FOR_CLOSER = [
+    ['</think>', '<think>'],
+    ['</reasoning>', '<reasoning>'],
+    ['[/THINK]', '[THINK]'],
+    ['<channel|>', '<|channel>thought\n'],
+    ['<|end|>', '<|channel|>analysis<|message|>'],
+];
+/**
+ * Restore the reasoning opener the chat template supplied, before the
+ * end-of-turn reasoning pass.
+ *
+ * When the rendered prompt left generation inside a reasoning block, the
+ * model's text starts mid-thought and carries only the closer. The live split
+ * knows that, but `extractReasoning` reads a lone `<channel|>` as stray and
+ * keeps the thoughts as the reply: Gemma 4 E4B, after a tool response, saved
+ * "The user wants to know…I need to answer in one sentence.The launch is on
+ * Friday…", and the stall check then asked it to answer again.
+ *
+ * Unchanged when the turn did not open in reasoning, when the model opened a
+ * block itself, or when no closer arrived.
+ */
+export function reopenTemplateReasoning(text, opensInReasoning) {
+    if (!opensInReasoning || /^\s*(?:<think>|<reasoning>|\[THINK\]|<\|?channel\|?>)/i.test(text)) {
+        return text;
+    }
+    const lower = text.toLowerCase();
+    let first = null;
+    for (const [closer, opener] of OPENER_FOR_CLOSER) {
+        const index = lower.indexOf(closer.toLowerCase());
+        if (index !== -1 && (first === null || index < first.index))
+            first = { index, opener };
+    }
+    return first ? `${first.opener}${text}` : text;
+}
 /**
  * Incremental reasoning splitter for a streamed MLX turn.
  *

package/dist/providers/native/capacity-broker.js

@@ -814,14 +814,20 @@ export function resolveLlamaCppContextRequirement(opts) {
     const strictModelMax = opts.contextSizing === 'model-max' && opts.explicitContextWindow === undefined;
     const requestedContextWindow = opts.explicitContextWindow ??
         (strictModelMax ? opts.modelContextWindow : opts.adaptiveContextWindow);
+    // Env, per-model and machine-wide numeric settings all express deliberate
+    // operator intent. The automatic host floor must not silently turn a 32K
+    // memory-saving request back into 64K. Resolve this here so launch and
+    // preview cannot apply different floors to the same explicit request.
+    const hostFloor = opts.minViableContextTokens ?? minViableLocalContextTokens();
+    const minimum = opts.explicitContextWindow !== undefined && opts.explicitContextWindow > 0
+        ? Math.min(hostFloor, opts.explicitContextWindow)
+        : hostFloor;
     const resolved = resolveLocalContextRequirement({
         ...(opts.modelContextWindow !== undefined
             ? { modelContextWindow: opts.modelContextWindow }
             : {}),
         ...(requestedContextWindow !== undefined ? { requestedContextWindow } : {}),
-        ...(opts.minViableContextTokens !== undefined
-            ? { minViableContextTokens: opts.minViableContextTokens }
-            : {}),
+        minViableContextTokens: minimum,
     });
     if (strictModelMax) {
         return {

package/dist/providers/native/local-engine-runtime.js

@@ -223,11 +223,19 @@ export class LocalEngineRuntime {
             return null;
         if (this.engineRouterInitPromise)
             return this.engineRouterInitPromise;
-        this.engineRouterInitPromise = this.buildEngineRouter().then((r) => {
+        const pending = this.buildEngineRouter().then((r) => {
             this.engineRouterCache = r;
             return r;
+        }, (err) => {
+            // A failed build must not be cached. One that ran while a dev rebuild
+            // had emptied dist/ failed every later local turn with "Cannot find
+            // module …engine-router.js" until the app restarted (2026-10-19).
+            if (this.engineRouterInitPromise === pending)
+                this.engineRouterInitPromise = null;
+            throw err;
         });
-        return this.engineRouterInitPromise;
+        this.engineRouterInitPromise = pending;
+        return pending;
     }
     async buildEngineRouter() {
         const { EngineRouter } = await import('./engine-router.js');
@@ -1136,17 +1144,12 @@ export class LocalEngineRuntime {
         const manifestEngineConfig = await resolveCatalogLlamaCppEngineConfig(this.catalog, modelId);
         const perModelCtxOverride = config.modelContextOverrides?.[`llama-cpp:${modelId}`];
         const explicitContextWindow = envNumCtx ?? perModelCtxOverride ?? config.llamaCppNumCtx;
-        // A per-model override below the host floor is deliberate user intent —
-        // lower the admission floor to the override instead of silently raising
-        // the request back to 64K. Env / machine-wide values keep their
-        // historical floor semantics. Mirrors buildLlamaCppProvider.
+        // The shared resolver honors every explicit numeric context below the
+        // host floor. Keep per-model override state for the Settings auto marker.
         const overrideActive = perModelCtxOverride !== undefined && explicitContextWindow === perModelCtxOverride;
-        const minViableTokens = overrideActive
-            ? Math.min(contextFloor, perModelCtxOverride)
-            : contextFloor;
         const contextRequirement = resolveLlamaCppContextRequirement({
             modelContextWindow: installed.contextWindow,
-            minViableContextTokens: minViableTokens,
+            minViableContextTokens: contextFloor,
             ...(explicitContextWindow !== undefined ? { explicitContextWindow } : {}),
             ...(manifestEngineConfig?.contextSize !== undefined
                 ? {
@@ -1162,7 +1165,7 @@ export class LocalEngineRuntime {
         // per-model override deliberately does NOT short-circuit on a resident
         // engine: the full plan must run so a stale resident window surfaces as
         // restart-required instead of masquerading as the applied setting.
-        const shortCircuit = (residentContextWindow !== undefined && !overrideActive) || envNumCtx !== undefined;
+        const shortCircuit = residentContextWindow !== undefined && !overrideActive;
         const { defaultLocalEngineSlots, estimatePerSlotKvBytes, kvQuantScale, llamaCppSlotCeiling, planAdaptiveContextGrowth, planCtxTokensForMemory, plannedLocalEngineSlots, } = await import('./capacity-broker.js');
         const capacity = await this.previewCapacityInputs('llama-cpp', modelId, capacityOpts);
         const { budgetBytes: admissionBudgetBytes, fastBudgetBytes, committedOtherBytes } = capacity;
@@ -1587,7 +1590,7 @@ export class LocalEngineRuntime {
             }
             return { grantedCtx, slots, kvCacheType: kv, plannedFieldsOk: true };
         };
-        const plan = llamaPlanPass(explicitContextWindow, minViableTokens);
+        const plan = llamaPlanPass(explicitContextWindow, contextFloor);
         let autoContextWindow;
         if (overrideActive) {
             try {

package/dist/providers/native/supervisor.js

@@ -55,7 +55,9 @@ const RESTART_WINDOW_MS = 60_000;
 /**
  * Ceiling on `recoverStartup` retries within one start. Two covers the
  * full MoE degradation ladder (partial split → all experts to RAM →
- * engine-owned fit); a hook that keeps asking past that is looping.
+ * engine-owned fit), or one slot and one offload rung; a hook that keeps
+ * asking past that is looping. Every failed start also spends the restart
+ * budget, which refuses a fourth start inside its window anyway.
  */
 const MAX_STARTUP_RECOVERIES = 2;
 const HEALTH_FAIL_THRESHOLD = 3;

package/dist/providers/queue.d.ts

@@ -5,11 +5,18 @@
  * service's import point and keeps the one piece that reads the process
  * environment.
  */
-export { AbortedWhileQueuedError, DEFAULT_AMBIENT_QUIET_MS, ProviderQueue, QUEUE_WAIT_NOTICE_DELAY_MS, QUEUE_WAIT_NOTICE_REPEAT_MS, backgroundLaneCap, runInQueue, } from '@bendyline/gezel/runtime';
-export type { EnqueueRequest, Lane, ProviderQueueOptions, QueueSnapshot, QueueWaitOpts, } from '@bendyline/gezel/runtime';
+export { AbortedWhileQueuedError, DEFAULT_AMBIENT_QUIET_MS, DEFAULT_LOCAL_YIELD_QUANTUM_MS, ProviderQueue, QUEUE_WAIT_NOTICE_DELAY_MS, QUEUE_WAIT_NOTICE_REPEAT_MS, backgroundLaneCap, runInQueue, } from '@bendyline/gezel/runtime';
+export type { EnqueueRequest, Lane, ProviderQueueOptions, QueueLease, QueueSnapshot, QueueWaitOpts, } from '@bendyline/gezel/runtime';
 /**
  * Ambient quiet window for local engine queues. Override with
  * `GEZEL_AMBIENT_QUIET_MS` (milliseconds; `0` disables ambient gating
  * entirely).
  */
 export declare function defaultAmbientQuietMs(): number;
+/**
+ * How long a local turn holds its queue slot before it hands the slot to
+ * another conversation that is waiting. Override with
+ * `GEZEL_QUEUE_YIELD_QUANTUM_MS` (milliseconds; `0` keeps a slot for the
+ * whole turn).
+ */
+export declare function defaultQueueYieldQuantumMs(): number;

package/dist/providers/queue.js

@@ -5,8 +5,8 @@
  * service's import point and keeps the one piece that reads the process
  * environment.
  */
-import { DEFAULT_AMBIENT_QUIET_MS } from '@bendyline/gezel/runtime';
-export { AbortedWhileQueuedError, DEFAULT_AMBIENT_QUIET_MS, ProviderQueue, QUEUE_WAIT_NOTICE_DELAY_MS, QUEUE_WAIT_NOTICE_REPEAT_MS, backgroundLaneCap, runInQueue, } from '@bendyline/gezel/runtime';
+import { DEFAULT_AMBIENT_QUIET_MS, DEFAULT_LOCAL_YIELD_QUANTUM_MS } from '@bendyline/gezel/runtime';
+export { AbortedWhileQueuedError, DEFAULT_AMBIENT_QUIET_MS, DEFAULT_LOCAL_YIELD_QUANTUM_MS, ProviderQueue, QUEUE_WAIT_NOTICE_DELAY_MS, QUEUE_WAIT_NOTICE_REPEAT_MS, backgroundLaneCap, runInQueue, } from '@bendyline/gezel/runtime';
 /**
  * Ambient quiet window for local engine queues. Override with
  * `GEZEL_AMBIENT_QUIET_MS` (milliseconds; `0` disables ambient gating
@@ -21,3 +21,18 @@ export function defaultAmbientQuietMs() {
     }
     return DEFAULT_AMBIENT_QUIET_MS;
 }
+/**
+ * How long a local turn holds its queue slot before it hands the slot to
+ * another conversation that is waiting. Override with
+ * `GEZEL_QUEUE_YIELD_QUANTUM_MS` (milliseconds; `0` keeps a slot for the
+ * whole turn).
+ */
+export function defaultQueueYieldQuantumMs() {
+    const raw = process.env.GEZEL_QUEUE_YIELD_QUANTUM_MS;
+    if (raw !== undefined) {
+        const parsed = Number.parseInt(raw, 10);
+        if (Number.isFinite(parsed) && parsed >= 0)
+            return parsed;
+    }
+    return DEFAULT_LOCAL_YIELD_QUANTUM_MS;
+}

package/dist/providers/session-hooks.d.ts

@@ -22,5 +22,8 @@ export interface ToolGroundingHooks {
         kind: 'allow';
         args: Record<string, unknown>;
     } | null;
-    labelEvidence(toolName: string, args: Record<string, unknown>, text: string): string | null;
+    /** `source.thirdParty` is true for a tool served by any server but gezel's own. */
+    labelEvidence(toolName: string, args: Record<string, unknown>, text: string, source?: {
+        thirdParty: boolean;
+    }): string | null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bendyline/gezel-inference",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Gezel's on-device inference runtime: native engines, local model management, embeddings, knowledge search, and OpenAI-compatible routes.",
   "license": "MIT",
   "keywords": [
@@ -73,10 +73,10 @@
     "!dist/**/__pycache__"
   ],
   "dependencies": {
-    "@bendyline/gezel": "1.2.7",
-    "@bendyline/gezel-catalog": "1.2.7",
-    "@bendyline/gezel-client": "1.2.7",
-    "@bendyline/gezel-knowledge": "1.2.7",
+    "@bendyline/gezel": "1.2.8",
+    "@bendyline/gezel-catalog": "1.2.8",
+    "@bendyline/gezel-client": "1.2.8",
+    "@bendyline/gezel-knowledge": "1.2.8",
     "hono": "4.13.9",
     "tar": "7.5.21",
     "undici": "8.11.2",