@bendyline/gezel-inference 1.0.6 → 1.0.8

package/dist/providers/mlx/runtime-diagnostics.d.ts

@@ -38,6 +38,12 @@ export declare function buildPreFirstByteAbortMessage(lastPrefill: {
 } | null): string;
 /** Build the user-facing message for an engine stream that died mid-turn. */
 export declare function buildMidStreamDropMessage(charsReceived: number, plannedStop: boolean, engineStillRunning?: boolean): string;
+/**
+ * Prompt characters one attached image stands for. The sidecar bounds images
+ * to 1024px, so their patch tokens are bounded too, and base64 bytes are never
+ * read as language tokens.
+ */
+export declare const MLX_IMAGE_RESERVED_CHARS = 8192;
 /** Estimate request tokens from message bodies and serialized tool schemas. */
 export declare function estimatePromptTokens(messages: unknown, tools: unknown): number;
 export declare const PRE_FIRST_BYTE_BASE_MS = 300000;

package/dist/providers/mlx/runtime-diagnostics.js

@@ -146,11 +146,28 @@ export function buildMidStreamDropMessage(charsReceived, plannedStop, engineStil
     }
     return `[Mac AI] the on-device engine dropped the connection mid-turn (${got}). This usually means the mlx server crashed, ran out of memory, or was restarted while the turn was streaming — this turn's work was lost. Retry the turn; if it keeps happening, restart the engine in Settings → On-device.`;
 }
+/**
+ * Prompt characters one attached image stands for. The sidecar bounds images
+ * to 1024px, so their patch tokens are bounded too, and base64 bytes are never
+ * read as language tokens.
+ */
+export const MLX_IMAGE_RESERVED_CHARS = 8192;
 /** Estimate request tokens from message bodies and serialized tool schemas. */
 export function estimatePromptTokens(messages, tools) {
     let chars = 0;
     try {
-        chars += JSON.stringify(messages)?.length ?? 0;
+        // Counted as base64, one generated picture read as ~1.1M tokens: an
+        // image gezel's six renders and reads put the estimate past 6M while the
+        // engine prefilled 14K (qwen3.8-27b, 2026-11-04).
+        let images = 0;
+        const text = JSON.stringify(messages, (key, value) => {
+            if (key === 'images' && Array.isArray(value)) {
+                images += value.length;
+                return undefined;
+            }
+            return value;
+        });
+        chars += (text?.length ?? 0) + images * MLX_IMAGE_RESERVED_CHARS;
     }
     catch {
         /* circular or unstringifiable */

package/dist/providers/mlx/tool-call-protocol.d.ts

@@ -39,9 +39,10 @@ export declare function applyCallableToolGrammar(body: Record<string, unknown>,
  *
  * This deliberately checks presence only. A present-but-wrongly-typed value
  * remains the MCP validator's job; the MLX Hermes grammar promises only that
- * every declared required key is emitted before the call can close. Seeing a
- * missing key is therefore evidence that the live constrained-decoding path
- * broke its own contract, not an ordinary model validation miss.
+ * every declared required key is emitted before a constrained call can close.
+ * A missing key alone does not establish a decoder fault: calls salvaged from
+ * ordinary prose were not subject to that grammar. The caller must preserve
+ * their origin when deciding whether to disable speculative decoding.
  */
 export declare function missingTopLevelRequiredToolArgs(schema: Record<string, unknown> | undefined, args: Record<string, unknown>): string[];
 export declare function hermesRequiredArgGrammarRequested(body: Record<string, unknown>): boolean;

package/dist/providers/mlx/tool-call-protocol.js

@@ -59,9 +59,10 @@ export function applyCallableToolGrammar(body, bridges) {
  *
  * This deliberately checks presence only. A present-but-wrongly-typed value
  * remains the MCP validator's job; the MLX Hermes grammar promises only that
- * every declared required key is emitted before the call can close. Seeing a
- * missing key is therefore evidence that the live constrained-decoding path
- * broke its own contract, not an ordinary model validation miss.
+ * every declared required key is emitted before a constrained call can close.
+ * A missing key alone does not establish a decoder fault: calls salvaged from
+ * ordinary prose were not subject to that grammar. The caller must preserve
+ * their origin when deciding whether to disable speculative decoding.
  */
 export function missingTopLevelRequiredToolArgs(schema, args) {
     const required = schema?.required;

package/dist/providers/native/capacity-broker.d.ts

@@ -31,7 +31,7 @@ export interface CapacityBrokerOptions {
      * tests and for users who want to opt out of the budget entirely.
      */
     budgetBytes?: number;
-    /** Test seam — defaults to {@link totalmem}. */
+    /** Test seam — defaults to {@link totalMemoryBytes}. */
     systemRamBytes?: () => number;
     /**
      * Whether this host shares one memory pool between CPU and GPU, which

package/dist/providers/native/capacity-broker.js

@@ -18,8 +18,8 @@
  */
 import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
-import { freemem, totalmem } from 'node:os';
 import { CONSTRAINED_LOCAL_CONTEXT_FLOOR_TOKENS, LLAMA_CPP_COMPUTE_HEADROOM, LOCAL_CONTEXT_FLOOR_TOKENS, MLX_COMPUTE_HEADROOM, createLogger, estimateLlamaCppResidentBytes, estimateMlxResidentBytes, localContextFloorTokens, } from '@bendyline/gezel';
+import { capToContainer, freeMemoryBytes, totalMemoryBytes } from '../../system/host-memory.js';
 import { autoAllowRamSpillover, computeCapacityBudget, fastMemoryBudgetBytes, getDetectedGpuVramBytes, } from './capacity-budget.js';
 export { autoAllowRamSpillover, autoDetectBudgetBytes, computeCapacityBudget, getDetectedGpuVramBytes, pressureIdleGraceMs, setDetectedGpuVramBytes, } from './capacity-budget.js';
 export { fastMemoryBudgetBytes };
@@ -156,7 +156,7 @@ export class CapacityBroker {
     explicitAllowRamSpillover;
     reservations = new Map();
     constructor(opts = {}) {
-        this.systemRamBytes = (opts.systemRamBytes ?? totalmem)();
+        this.systemRamBytes = (opts.systemRamBytes ?? totalMemoryBytes)();
         this.unifiedMemory = opts.unifiedMemory;
         this.gpuVramBytes = opts.gpuVramBytes;
         this.reservedGpuBytes = opts.reservedGpuBytes;
@@ -467,24 +467,24 @@ export function availableSystemRamBytes() {
     // vm_stat categories overlap (file-backed pages span active+inactive),
     // so the raw sum can exceed physical RAM; cap at 90% of totalmem — the
     // consumers already hold back their own OS reserves on top.
-    const cap = totalmem() * 0.9;
+    const cap = totalMemoryBytes() * 0.9;
     try {
         if (process.platform === 'darwin') {
             const out = execFileSync('/usr/bin/vm_stat', { encoding: 'utf8', timeout: 3_000 });
             const parsed = parseVmStatAvailableBytes(out);
             if (parsed !== null)
-                return Math.max(Math.min(parsed, cap), freemem());
+                return capToContainer(Math.max(Math.min(parsed, cap), freeMemoryBytes()));
         }
         else if (process.platform === 'linux') {
             const parsed = parseMeminfoAvailableBytes(readFileSync('/proc/meminfo', 'utf8'));
             if (parsed !== null)
-                return Math.max(Math.min(parsed, cap), freemem());
+                return capToContainer(Math.max(Math.min(parsed, cap), freeMemoryBytes()));
         }
     }
     catch {
         // Probe failure falls through to the conservative number.
     }
-    return freemem();
+    return freeMemoryBytes();
 }
 /** Pure vm_stat parser (exported for tests). Returns null when the output
  *  doesn't look like vm_stat. */
@@ -664,7 +664,7 @@ export function llamaCppSlotCeiling(opts) {
  * going to free 5 GiB, because nothing was holding it but the estimate.
  * Planning and admission must read one number.
  */
-export function liveRamOsReserveBytes(totalRamBytes = totalmem()) {
+export function liveRamOsReserveBytes(totalRamBytes = totalMemoryBytes()) {
     return Math.min(4 * GIB, Math.max(2 * GIB, totalRamBytes * 0.1));
 }
 /**
@@ -769,7 +769,7 @@ export function minViableLocalContextTokens(opts) {
     const override = envMinContextTokens();
     if (override !== null)
         return override;
-    const systemRamBytes = opts?.systemRamBytes ?? totalmem();
+    const systemRamBytes = opts?.systemRamBytes ?? totalMemoryBytes();
     const budget = opts?.budget ?? computeCapacityBudget({ systemRamBytes });
     return localContextFloorTokens({
         totalRamBytes: systemRamBytes,

package/dist/providers/native/capacity-budget.js

@@ -1,4 +1,5 @@
-import { arch, platform, totalmem } from 'node:os';
+import { arch, platform } from 'node:os';
+import { totalMemoryBytes } from '../../system/host-memory.js';
 const GIB = 1024 ** 3;
 /**
  * Ceiling on the auto-derived SYSTEM-RAM share, however much RAM the host
@@ -152,7 +153,7 @@ export function isUnifiedMemoryHost() {
  * `GEZEL_CAPACITY_BUDGET_GB` overrides the total, including the setting.
  */
 export function computeCapacityBudget(input = {}) {
-    const systemRamBytes = input.systemRamBytes ?? totalmem();
+    const systemRamBytes = input.systemRamBytes ?? totalMemoryBytes();
     // Reading the ambient probe is for callers that know nothing about the
     // host. One that passes `unifiedMemory` has already described it.
     const measuredVram = input.gpuVramBytes !== undefined
@@ -269,7 +270,7 @@ function envOverrideBytes() {
  * (Settings → the engine pages) is the dial for owners who want that traded
  * either way.
  */
-export function autoDetectBudgetBytes(systemRamBytes = totalmem(), opts = {}) {
+export function autoDetectBudgetBytes(systemRamBytes = totalMemoryBytes(), opts = {}) {
     return computeCapacityBudget({ systemRamBytes, ...opts }).budgetBytes;
 }
 /**
@@ -277,7 +278,7 @@ export function autoDetectBudgetBytes(systemRamBytes = totalmem(), opts = {}) {
  * the whole budget otherwise. KV slots, prompt caches, and anything else
  * that must live where the compute happens size against this.
  */
-export function fastMemoryBudgetBytes(systemRamBytes = totalmem(), opts = {}) {
+export function fastMemoryBudgetBytes(systemRamBytes = totalMemoryBytes(), opts = {}) {
     return computeCapacityBudget({ systemRamBytes, ...opts }).fastBytes;
 }
 /** Fast pool at or below which a host is treated as accelerator-constrained. */

package/dist/providers/native/device-capacity-ledger.d.ts

@@ -1,4 +1,6 @@
 import type { NativeCapacityCommand, NativeCapacityReply } from '@bendyline/gezel';
+import { ProcessIdentityCache, processAlive, type readProcessIdentities } from './process-identity.js';
+export { processAlive };
 export interface DeviceCapacitySample {
     budgetBytes: number;
     gpuBudgetBytes: number;
@@ -13,7 +15,6 @@ export interface DeviceCapacitySample {
     availableRamBytes?: number;
     serializeLoads: boolean;
 }
-export declare function processAlive(pid: number): boolean;
 /**
  * SQLite's process lock makes check-and-reserve atomic across GEZEL_HOME values.
  * Reservations survive a broker restart. A dead parent does not free the memory
@@ -21,10 +22,13 @@ export declare function processAlive(pid: number): boolean;
  */
 export declare class DeviceCapacityLedger {
     private readonly options;
+    private readonly identityCache;
     constructor(options: {
         directory: string;
         sample: () => Promise<DeviceCapacitySample>;
         alive?: (pid: number) => boolean;
+        identities?: typeof readProcessIdentities;
+        identityCache?: ProcessIdentityCache;
     });
     execute(command: NativeCapacityCommand): Promise<NativeCapacityReply>;
     private transact;

package/dist/providers/native/device-capacity-ledger.js

@@ -2,6 +2,8 @@ import { chmod, mkdir } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { join } from 'node:path';
 import { CapacityDeniedError } from './capacity-broker.js';
+import { ProcessIdentityCache, processAlive, sharedProcessIdentities, } from './process-identity.js';
+export { processAlive };
 // Keep the newer builtin behind a runtime require. The current tsup/esbuild
 // target rewrites a static `node:sqlite` import to the nonexistent npm package
 // `sqlite`, making the daemon bundle fail before it can write runtime state.
@@ -10,15 +12,6 @@ const { DatabaseSync } = nodeRequire('node:sqlite');
 function gb(bytes) {
     return `${(bytes / 1024 ** 3).toFixed(1)} GB`;
 }
-export function processAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code !== 'ESRCH';
-    }
-}
 /**
  * SQLite's process lock makes check-and-reserve atomic across GEZEL_HOME values.
  * Reservations survive a broker restart. A dead parent does not free the memory
@@ -26,8 +19,18 @@ export function processAlive(pid) {
  */
 export class DeviceCapacityLedger {
     options;
+    identityCache;
     constructor(options) {
         this.options = options;
+        // An injected reader still goes through a cache, so tests see the reads
+        // production makes. An injected `alive` alone checks liveness only.
+        this.identityCache =
+            options.identityCache ??
+                (options.identities
+                    ? new ProcessIdentityCache({ read: options.identities, alive: options.alive })
+                    : options.alive
+                        ? undefined
+                        : sharedProcessIdentities);
     }
     async execute(command) {
         const sample = await this.options.sample();
@@ -38,9 +41,39 @@ export class DeviceCapacityLedger {
             await chmod(path, 0o600);
             db.exec('PRAGMA busy_timeout = 1000');
             db.exec('CREATE TABLE IF NOT EXISTS claims (id TEXT PRIMARY KEY, claim TEXT NOT NULL)');
+            const snapshot = db
+                .prepare('SELECT claim FROM claims')
+                .all()
+                .map((row) => JSON.parse(String(row.claim)));
+            const record = [];
+            if (command.action === 'acquire' && !snapshot.some((claim) => claim.id === command.id))
+                record.push(command.ownerPid);
+            if (command.action === 'bind')
+                record.push(command.childPid);
+            // Stamps only decide which reservations are stale, and a stale one costs
+            // someone only while a request waits for memory. With no request
+            // waiting, liveness alone prunes, so the status check that runs before
+            // every engine request reads no stamps.
+            const confirm = new Map();
+            const stamp = (pid, identity) => {
+                if (pid !== undefined && identity !== undefined)
+                    confirm.set(pid, [...(confirm.get(pid) ?? []), identity]);
+            };
+            if (command.action === 'acquire' || snapshot.some((claim) => claim.phase === 'waiting')) {
+                for (const claim of snapshot) {
+                    stamp(claim.childPid, claim.childIdentity);
+                    // An owner's stamp is only consulted while its claim is queued.
+                    if (claim.phase === 'waiting')
+                        stamp(claim.ownerPid, claim.ownerIdentity);
+                }
+            }
+            // OS probes may spawn a helper. Never hold SQLite's writer lock while awaiting one.
+            const identities = command.action !== 'release' && this.identityCache
+                ? await this.identityCache.lookup(record, confirm).catch(() => new Map())
+                : new Map();
             db.exec('BEGIN IMMEDIATE');
             try {
-                const result = this.transact(db, command, sample);
+                const result = this.transact(db, command, sample, identities, new Map(snapshot.map((claim) => [claim.id, JSON.stringify(claim)])));
                 db.exec('COMMIT');
                 return result;
             }
@@ -53,17 +86,27 @@ export class DeviceCapacityLedger {
             db.close();
         }
     }
-    transact(db, command, sample) {
+    transact(db, command, sample, identities, observedClaims) {
         const alive = this.options.alive ?? processAlive;
+        const sameProcess = (pid, identity) => {
+            if (!alive(pid))
+                return false;
+            const current = identities.get(pid);
+            return identity === undefined || current === undefined || current === identity;
+        };
         const rows = db.prepare('SELECT claim FROM claims ORDER BY rowid').all();
         const claims = rows.map((row) => JSON.parse(String(row.claim)));
         const remove = db.prepare('DELETE FROM claims WHERE id = ?');
         const save = db.prepare('UPDATE claims SET claim = ? WHERE id = ?');
         const live = claims.filter((claim) => {
+            // Another coordinator can acquire/rebind while the OS probe is in flight.
+            // Its newer claim must not be compared with our earlier process snapshot.
+            if (observedClaims.get(claim.id) !== JSON.stringify(claim))
+                return true;
             // An unbound grant with a dead owner could have spawned just before the
             // owner died. Keep it conservatively; never guess that its bytes are free.
-            const stale = (claim.childPid !== undefined && !alive(claim.childPid)) ||
-                (!alive(claim.ownerPid) && claim.phase === 'waiting');
+            const stale = (claim.childPid !== undefined && !sameProcess(claim.childPid, claim.childIdentity)) ||
+                (!sameProcess(claim.ownerPid, claim.ownerIdentity) && claim.phase === 'waiting');
             if (stale)
                 remove.run(claim.id);
             return !stale;
@@ -80,6 +123,7 @@ export class DeviceCapacityLedger {
             own = {
                 id: command.id,
                 ownerPid: command.ownerPid,
+                ownerIdentity: identities.get(command.ownerPid),
                 label: command.label,
                 bytes: command.bytes,
                 gpuBytes: command.gpuBytes,
@@ -95,8 +139,10 @@ export class DeviceCapacityLedger {
             return { state: 'released', releaseRequested: false };
         if (command.action === 'acquire' && command.priority === 'interactive')
             own.priority = 'interactive';
-        if (command.action === 'bind' && own.phase !== 'waiting')
+        if (command.action === 'bind' && own.phase !== 'waiting') {
             own.childPid = command.childPid;
+            own.childIdentity = identities.get(command.childPid);
+        }
         if (command.action === 'ready' && own.phase === 'loading')
             own.phase = 'ready';
         const active = live.filter((c) => c.phase !== 'waiting');

package/dist/providers/native/device-capacity.js

@@ -1,11 +1,12 @@
 import { randomUUID } from 'node:crypto';
 import { readdir, stat } from 'node:fs/promises';
-import { homedir, totalmem } from 'node:os';
+import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { DS4_FULL_RESIDENCY_HEADROOM_BYTES, GEZEL_VERSION, NativeCapacityCommandSchema, NativeCapacityReplySchema, awakeNow, createLogger, isUnstampedDevBuild, } from '@bendyline/gezel';
 import { readSystemServiceRuntime, systemServiceHome } from '@bendyline/gezel-client/node';
 import { ConfigStore } from '../../fs/config-store.js';
 import { createPinnedFetch } from '../../remotes/pinned-fetch.js';
+import { totalMemoryBytes } from '../../system/host-memory.js';
 import { CapacityDeniedError, availableSystemRamBytes, liveRamOsReserveBytes, } from './capacity-broker.js';
 import { DeviceCapacityLedger } from './device-capacity-ledger.js';
 import { measuredCapacityBudget } from './measured-budget.js';
@@ -156,7 +157,7 @@ export function staticCapacityCeilings(budget, ramBytes, configuredBytes, platfo
 }
 export async function sampleDeviceCapacity(home) {
     const budget = await measuredCapacityBudget();
-    const ram = totalmem();
+    const ram = totalMemoryBytes();
     const config = home ? await new ConfigStore(home).readConfig() : {};
     const ceilings = staticCapacityCeilings(budget, ram, configuredEngineMemoryBytes(config));
     // The ledger's RAM ceiling and the OS's currently reclaimable RAM answer
@@ -213,7 +214,7 @@ async function capacityExecutor(home) {
                 // broker that is merely unreachable is an outage, never permission to
                 // double-book the machine — so claim the authority before rethrowing.
                 observedMachineAuthorities.add(machineHome);
-                throw error;
+                throw new Error(`Local models can't start: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
             }
             const skew = assessBrokerVersionSkew(identity.gezelVersion);
             if (skew)

package/dist/providers/native/local-engine-runtime.js

@@ -609,10 +609,10 @@ export class LocalEngineRuntime {
                                 residentCtxTokens: ds4Block?.residentCtxTokens,
                             });
                             if (line) {
-                                const { totalmem } = await import('node:os');
+                                const { totalMemoryBytes } = await import('../../system/host-memory.js');
                                 bytes = ds4ProjectedResidentBytes(line, resolveDs4LaunchCtx({
                                     configured: config.modelContextOverrides?.[`ds4:${modelId}`] ?? config.ds4NumCtx,
-                                    ramTieredCtx: totalmem() / 1024 ** 3 >= 192 ? 262_144 : 131_072,
+                                    ramTieredCtx: totalMemoryBytes() / 1024 ** 3 >= 192 ? 262_144 : 131_072,
                                     catalogMaxCtx: ds4Block?.maxLaunchCtx,
                                     minViableContextTokens: minViableLocalContextTokens(),
                                 }));
@@ -1046,8 +1046,8 @@ export class LocalEngineRuntime {
             if (!installed && !hasExplicitSource && !(opts.allowUninstalled && ds4Source)) {
                 throw new ModelNotInstalledError(name, modelId);
             }
-            const { totalmem } = await import('node:os');
-            const ramTieredCtx = totalmem() / 1024 ** 3 >= 192 ? 262_144 : 131_072;
+            const { totalMemoryBytes } = await import('../../system/host-memory.js');
+            const ramTieredCtx = totalMemoryBytes() / 1024 ** 3 >= 192 ? 262_144 : 131_072;
             const ds4Override = config.modelContextOverrides?.[`ds4:${modelId}`];
             const ds4Floor = ds4Override !== undefined ? Math.min(contextFloor, ds4Override) : contextFloor;
             const effective = resolveDs4LaunchCtx({

package/dist/providers/native/process-identity.d.ts

@@ -0,0 +1,40 @@
+export declare function processAlive(pid: number): boolean;
+/** Birth stamps survive coordinator restarts and distinguish a reused PID. */
+export declare function readProcessIdentities(pids: readonly number[]): Promise<ReadonlyMap<number, string>>;
+/**
+ * How long a stamp read for a still-live PID is trusted. A PID can die and be
+ * reused between two liveness checks; this bounds how long such a dead
+ * engine's reservation outlives it. That is the safe direction: memory looks
+ * taken for a few seconds longer, never free twice.
+ */
+export declare const VERIFIED_IDENTITY_TTL_MS = 10000;
+export interface ProcessIdentityCacheOptions {
+    read?: (pids: readonly number[]) => Promise<ReadonlyMap<number, string>>;
+    alive?: (pid: number) => boolean;
+    now?: () => number;
+    ttlMs?: number;
+}
+/**
+ * Reading a birth stamp starts `ps`, or PowerShell on Windows. The capacity
+ * ledger used to read every PID it holds on each command, which ran before
+ * every engine request. A stamp read for a PID that is still alive is reused
+ * for a short while, and the PIDs that do need reading go in one batch.
+ *
+ * A cached stamp may only confirm the stamp a reservation already recorded.
+ * A stamp about to be recorded, or one that disagrees, is read again: another
+ * coordinator may have recorded a newer process at that PID, and trusting an
+ * older stamp there would free a live engine's memory.
+ */
+export declare class ProcessIdentityCache {
+    private readonly options;
+    private readonly verified;
+    constructor(options?: ProcessIdentityCacheOptions);
+    /**
+     * `record`: PIDs whose stamp is about to be written onto a reservation.
+     * `confirm`: each PID's stamps as reservations recorded them.
+     * PIDs that are dead, or whose stamp cannot be read, are left out.
+     */
+    lookup(record: Iterable<number>, confirm: ReadonlyMap<number, readonly string[]>): Promise<ReadonlyMap<number, string>>;
+}
+/** One cache per process: every ledger in it asks about the same OS processes. */
+export declare const sharedProcessIdentities: ProcessIdentityCache;

package/dist/providers/native/process-identity.js

@@ -0,0 +1,156 @@
+import { execFile } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+/**
+ * One PID the probe refuses blanks every row in its batch: macOS ps prints
+ * "process id too large" past XNU's PID_MAX, and Get-Process -Id binds Int32.
+ * A PID past the limit cannot be live, so it is left out like an absent one.
+ */
+const PROBE_PID_LIMIT = {
+    darwin: 99_999,
+    win32: 2_147_483_647,
+};
+export function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+}
+/** Birth stamps survive coordinator restarts and distinguish a reused PID. */
+export async function readProcessIdentities(pids) {
+    const limit = PROBE_PID_LIMIT[process.platform] ?? Number.MAX_SAFE_INTEGER;
+    const ids = [...new Set(pids)].filter((pid) => Number.isSafeInteger(pid) && pid > 0 && pid <= limit);
+    const identities = new Map();
+    if (!ids.length)
+        return identities;
+    try {
+        if (process.platform === 'linux') {
+            const boot = (await readFile('/proc/sys/kernel/random/boot_id', 'utf8')).trim();
+            await Promise.all(ids.map(async (pid) => {
+                const value = await readFile(`/proc/${pid}/stat`, 'utf8').catch(() => null);
+                if (!value)
+                    return;
+                // comm may contain spaces and parentheses; fields after its final ')' start at field 3.
+                const start = value
+                    .slice(value.lastIndexOf(')') + 2)
+                    .trim()
+                    .split(/\s+/)[19];
+                if (start && /^\d+$/.test(start))
+                    identities.set(pid, `${boot}:${start}`);
+            }));
+        }
+        else {
+            const windows = process.platform === 'win32';
+            const { stdout } = await exec(windows ? 'powershell.exe' : 'ps', windows
+                ? [
+                    '-NoProfile',
+                    '-NonInteractive',
+                    '-Command',
+                    `Get-Process -Id ${ids.join(',')} -ErrorAction SilentlyContinue | ForEach-Object { try { [string]$_.Id + ":" + $_.StartTime.ToUniversalTime().Ticks.ToString() } catch {} }`,
+                ]
+                : ['-p', ids.join(','), '-o', 'pid=', '-o', 'lstart='], {
+                windowsHide: true,
+                timeout: 3000,
+                maxBuffer: 256 * 1024,
+                env: { ...process.env, TZ: 'UTC', LC_ALL: 'C', LANG: 'C' },
+            }).catch((error) => {
+                // ps (and Windows process lookup) may return live rows alongside a missing PID error.
+                if (typeof error.stdout === 'string')
+                    return { stdout: error.stdout };
+                throw error;
+            });
+            for (const line of stdout.split(/\r?\n/)) {
+                const match = windows
+                    ? /^\s*(\d+):(\d+)\s*$/.exec(line)
+                    : /^\s*(\d+)\s+(.+?)\s*$/.exec(line);
+                if (match && ids.includes(Number(match[1])))
+                    identities.set(Number(match[1]), match[2]);
+            }
+        }
+    }
+    catch {
+        // Access denied or an unavailable OS probe is unknown, never proof of death.
+    }
+    return identities;
+}
+/**
+ * How long a stamp read for a still-live PID is trusted. A PID can die and be
+ * reused between two liveness checks; this bounds how long such a dead
+ * engine's reservation outlives it. That is the safe direction: memory looks
+ * taken for a few seconds longer, never free twice.
+ */
+export const VERIFIED_IDENTITY_TTL_MS = 10_000;
+/**
+ * Reading a birth stamp starts `ps`, or PowerShell on Windows. The capacity
+ * ledger used to read every PID it holds on each command, which ran before
+ * every engine request. A stamp read for a PID that is still alive is reused
+ * for a short while, and the PIDs that do need reading go in one batch.
+ *
+ * A cached stamp may only confirm the stamp a reservation already recorded.
+ * A stamp about to be recorded, or one that disagrees, is read again: another
+ * coordinator may have recorded a newer process at that PID, and trusting an
+ * older stamp there would free a live engine's memory.
+ */
+export class ProcessIdentityCache {
+    options;
+    verified = new Map();
+    constructor(options = {}) {
+        this.options = options;
+    }
+    /**
+     * `record`: PIDs whose stamp is about to be written onto a reservation.
+     * `confirm`: each PID's stamps as reservations recorded them.
+     * PIDs that are dead, or whose stamp cannot be read, are left out.
+     */
+    async lookup(record, confirm) {
+        const alive = this.options.alive ?? processAlive;
+        const ttl = this.options.ttlMs ?? VERIFIED_IDENTITY_TTL_MS;
+        const now = (this.options.now ?? (() => performance.now()))();
+        for (const [pid, entry] of this.verified) {
+            if (now - entry.at >= ttl)
+                this.verified.delete(pid);
+        }
+        const live = (pid) => {
+            if (alive(pid))
+                return true;
+            // Forget a PID seen dead, so whatever process takes it next is read.
+            this.verified.delete(pid);
+            return false;
+        };
+        const identities = new Map();
+        const unread = new Set();
+        for (const pid of record)
+            if (live(pid))
+                unread.add(pid);
+        for (const [pid, stamps] of confirm) {
+            if (unread.has(pid) || !live(pid))
+                continue;
+            const cached = this.verified.get(pid)?.identity;
+            if (cached !== undefined && stamps.every((stamp) => stamp === cached)) {
+                identities.set(pid, cached);
+            }
+            else {
+                unread.add(pid);
+            }
+        }
+        if (unread.size === 0)
+            return identities;
+        const read = await (this.options.read ?? readProcessIdentities)([...unread]).catch(() => new Map());
+        for (const pid of unread) {
+            const identity = read.get(pid);
+            if (identity === undefined) {
+                this.verified.delete(pid);
+                continue;
+            }
+            this.verified.set(pid, { identity, at: now });
+            identities.set(pid, identity);
+        }
+        return identities;
+    }
+}
+/** One cache per process: every ledger in it asks about the same OS processes. */
+export const sharedProcessIdentities = new ProcessIdentityCache();

package/dist/relevance/relevance-core.js

@@ -3,6 +3,7 @@ import { createReadStream } from 'node:fs';
 import { join } from 'node:path';
 import { createLogger } from '@bendyline/gezel';
 import { transformersGraphOptions } from '@bendyline/gezel-knowledge';
+import { disableOnnxRuntimeTelemetry } from '@bendyline/gezel/native';
 import { PipelineLoadError } from '../memory/embed-core.js';
 /**
  * Cross-encoder inference: load a pinned relevance model from its local
@@ -19,6 +20,7 @@ const BATCH = 8;
 const MAX_LOADED = 2;
 const loaded = new Map();
 async function importTransformers() {
+    disableOnnxRuntimeTelemetry();
     return (await import('@huggingface/transformers'));
 }
 export async function loadRelevanceModel(model, transformers) {

package/dist/relevance/relevance-model.js

@@ -1,5 +1,6 @@
 import { Worker } from 'node:worker_threads';
 import { createLogger } from '@bendyline/gezel';
+import { disableOnnxRuntimeTelemetry } from '@bendyline/gezel/native';
 import { retireModelWorker } from '../utils/retire-model-worker.js';
 import { findServiceWorkerEntry } from '../utils/service-worker-entry.js';
 import { disposeRelevanceModels, loadRelevanceModel, scoreRelevancePairs, } from './relevance-core.js';
@@ -185,6 +186,7 @@ class RelevanceModelHost {
             return null;
         }
         try {
+            disableOnnxRuntimeTelemetry();
             const worker = new Worker(entry);
             worker.on('message', (reply) => {
                 const pending = this.pending.get(reply.id);

package/dist/relevance/settings.js

@@ -1,5 +1,5 @@
-import { availableParallelism } from 'node:os';
 import { KNOWLEDGE_FILTER_MIN_RELEVANCE, } from '@bendyline/gezel';
+import { availableCpuCount } from '../system/host-memory.js';
 import { relevanceModelDir } from './install.js';
 import { DEFAULT_RELEVANCE_MODEL_ID, findRelevanceModel } from './registry.js';
 const DEFAULT_BUDGETS = {
@@ -76,6 +76,6 @@ export function toResolvedModel(home, spec) {
         maxTokens: spec.maxTokens,
         queryMaxTokens: spec.queryMaxTokens,
         scoreActivation: spec.scoreActivation,
-        intraOpNumThreads: Math.max(1, Math.min(4, Math.floor(availableParallelism() / 2))),
+        intraOpNumThreads: Math.max(1, Math.min(4, Math.floor(availableCpuCount() / 2))),
     };
 }