@glassly/engine 0.3.5 → 0.3.6-dev.846

package/src/services/GlassesTouchInput.ts

@@ -5,6 +5,7 @@ import BluetoothSdk from "@glassly/bluetooth-sdk/internal"
 import {useAppStatusStore} from "../stores/apps"
 import {useGlassesStore} from "../stores/glasses"
 import {BgTimer} from "../utils/timers"
+import {hasInput2d} from "./controllers"
 import dashboardOpenTrace from "./debug/DashboardOpenTrace"
 import gestureDotsService from "./GestureDotsService"
 import {isGlassesConnected} from "./GlassesReadiness"
@@ -17,7 +18,7 @@ import {pagesEligible} from "./pages/pageEligibility"
 
 const miniappExitGesture = new MiniappExitGesture({
   getState: () => useAppStatusStore.getState(),
-  getVisiblePackageName: () => localDisplayManager.getVisibleMiniappPackageName(),
+  getTargetPackageName: () => localDisplayManager.getMiniappToLeave(),
   beginExitNotice: (packageName, text) => localDisplayManager.beginMiniappExit(packageName, text),
   finishExitNotice: (packageName) => localDisplayManager.finishMiniappExit(packageName),
   cancelExitNotice: (packageName) => localDisplayManager.cancelMiniappExit(packageName),
@@ -25,54 +26,104 @@ const miniappExitGesture = new MiniappExitGesture({
   clearTimeout: (timerId) => BgTimer.clearTimeout(timerId),
 })
 
-// Raw ring reports include every scroll step, whether the CFW forwards them
-// (deviceModel G2) or the ring sends them to the phone itself (deviceModel R1);
-// both tag source 2. Rate-limit scroll actions separately from press/release
-// recognition, per ring, using native receipt timestamps so a JS backlog does
-// not collapse otherwise separate gestures.
-const RING_SCROLL_INTERVAL_MS = 100
-const lastRingScrollAt = new Map<string, number>()
-
-function shouldForwardScroll(event: TouchEvent): boolean {
-  if (event.source !== 2 || (event.gestureName !== "swipe_up" && event.gestureName !== "swipe_down")) return true
-  const ring = event.controllerId ?? `source:${event.source}`
-  const last = lastRingScrollAt.get(ring)
+// The ring reports a slide once per step of travel, whether the CFW forwards
+// it (deviceModel G2) or the ring sends it to the phone itself (deviceModel
+// R1); both tag source 2. One press is one swipe: the stroke's first step goes
+// out as swipe_up / swipe_down, and every step, the first included, as
+// scroll_up / scroll_down with its distance and speed for smooth scrolling. A
+// stroke ends at the ring's next touch_down or tap_end, or after
+// RING_STROKE_IDLE_MS without a step when a report was lost. Reversing within
+// a stroke fires no swipe (a finger rolling back at lift-off). Native receipt
+// timestamps keep strokes apart when JS drains a backlog.
+const RING_STROKE_IDLE_MS = 1000
+/** Per ring, when the open stroke's last step arrived. */
+const ringStrokes = new Map<string, number>()
+
+function ringKey(event: TouchEvent): string {
+  return event.controllerId ?? `source:${event.source}`
+}
+
+function isRingSlideStep(event: TouchEvent): boolean {
+  return event.source === 2 && (event.gestureName === "swipe_up" || event.gestureName === "swipe_down")
+}
+
+function opensRingStroke(event: TouchEvent): boolean {
+  const last = ringStrokes.get(ringKey(event))
+  ringStrokes.set(ringKey(event), event.timestamp)
   const elapsed = last === undefined ? null : event.timestamp - last
-  if (elapsed !== null && elapsed >= 0 && elapsed < RING_SCROLL_INTERVAL_MS) return false
-  lastRingScrollAt.set(ring, event.timestamp)
-  return true
+  return elapsed === null || elapsed < 0 || elapsed >= RING_STROKE_IDLE_MS
+}
+
+function endRingStroke(event: TouchEvent): void {
+  if (event.source === 2 && (event.gestureName === "touch_down" || event.gestureName === "tap_end")) {
+    ringStrokes.delete(ringKey(event))
+  }
+}
+
+/** The discrete swipe a stroke opens with: the step's travel belongs to scroll_*. */
+function strokeSwipe(step: TouchEvent): TouchEvent {
+  const swipe = {...step}
+  delete swipe.distance
+  delete swipe.speed
+  return swipe
+}
+
+/**
+ * Miniapps' copy of the touch: `input2d: true` when it came from a controller
+ * that swipes in two dimensions (the Neural Band), the field absent otherwise,
+ * so a 1D swipe from the temples or the ring stays tellable while a band is
+ * connected under the same gesture names.
+ */
+function toMiniapps(event: TouchEvent): TouchEvent & {input2d?: true} {
+  const id = event.controllerId
+  if (id === undefined) return event
+  const model = useGlassesStore.getState().controllers?.[id]?.model
+  return model !== undefined && hasInput2d(model) ? {...event, input2d: true} : event
 }
 
 /**
  * Route both real glasses input and phone mirror controls through the same
  * policy. A claimed gesture goes to the app holding the claim, alone; an
  * unclaimed one goes to every subscriber and then the engine's default. The
- * one rule ahead of the claims: an unclaimed double tap on a miniapp whose
- * frame is visibly on the glasses leaves that app, whoever else claimed the
- * gesture — the dashboard's claim is for the empty screen. Head position
+ * one rule ahead of the claims: an unclaimed double tap leaves the miniapp
+ * the wearer is in — the one visibly on the glasses, else the running
+ * standard app on an empty screen — whoever else claimed the gesture; the
+ * dashboard's claim is for the screen with no app in it. Head position
  * (head_up / head_down) is a gesture like any other: the dashboard claims it
  * while it runs, and an unclaimed head_up on glasses that defer the dashboard
- * to the phone opens the native one, as it would with no app at all.
+ * to the phone opens the native one, as it would with no app at all. A ring
+ * slide step becomes one swipe per stroke plus a scroll step (see above).
  */
 export function dispatchTouchEvent(event: TouchEvent): void {
+  if (isRingSlideStep(event)) {
+    if (opensRingStroke(event)) routeTouchEvent(strokeSwipe(event))
+    routeTouchEvent({...event, gestureName: event.gestureName === "swipe_up" ? "scroll_up" : "scroll_down"})
+    return
+  }
+  endRingStroke(event)
+  routeTouchEvent(event)
+}
+
+function routeTouchEvent(event: TouchEvent): void {
   const gesture = event.gestureName
   const claimant = localMiniappRuntime.gestureClaimant(gesture)
-  // The Neural Band's middle finger (index 1) shares the tap names but is left
-  // to miniapps: the engine's own double-tap behaviors are the index finger's.
-  const osDoubleTap = gesture === "double_tap" && event.index !== 1
+  const doubleTap = gesture === "double_tap"
+  // The Neural Band's middle finger (index 1) shares the tap names. Either
+  // finger leaves the app on screen; the firmware dashboard is the index finger's.
+  const osDoubleTap = doubleTap && event.index !== 1
   const osHeadUp = gesture === "head_up"
 
-  if (osDoubleTap) {
-    // A visible main miniapp opts out of OS exit by registering double tap (the
+  if (doubleTap) {
+    // The app being left opts out of OS exit by registering double tap (the
     // terminal's back-to-menu). The latest claimant still receives it. Otherwise
     // the tap means "leave the app". The controller shows the bounded OS
-    // notice first, then uses the normal
-    // store stop path (and closes its phone overlay).
-    const visible = localDisplayManager.getVisibleMiniappPackageName()
+    // notice first, then uses the normal store stop path (and closes its
+    // phone overlay).
+    const leaving = localDisplayManager.getMiniappToLeave()
     if (
-      visible !== null &&
-      !localMiniappRuntime.hasGestureClaim(visible, gesture) &&
-      miniappExitGesture.tryExitVisibleMiniapp()
+      leaving !== null &&
+      !localMiniappRuntime.hasGestureClaim(leaving, gesture) &&
+      miniappExitGesture.tryExitMiniapp()
     ) {
       gestureDotsService.noteGesture(gesture, true, event.index, event.controllerId)
       return
@@ -86,18 +137,15 @@ export function dispatchTouchEvent(event: TouchEvent): void {
     }
     // The press may have started before this app claimed its release edge.
     gestureDotsService.noteGesture(gesture, true, event.index, event.controllerId)
-    if (!shouldForwardScroll(event)) return
-    localMiniappRuntime.forwardEvent("touch_event", event, undefined, claimant)
+    localMiniappRuntime.forwardEvent("touch_event", toMiniapps(event), undefined, claimant)
     return
   }
 
   // Gesture-dots debug indicator (any device, gated by its setting). It
-  // only paints while the screen is otherwise empty. Process even suppressed
-  // scroll repeats here so their completion still clears a held dot.
+  // only paints while the screen is otherwise empty.
   gestureDotsService.noteGesture(gesture, false, event.index, event.controllerId)
 
-  if (!shouldForwardScroll(event)) return
-  localMiniappRuntime.forwardEvent("touch_event", event)
+  localMiniappRuntime.forwardEvent("touch_event", toMiniapps(event))
 
   // Nobody claimed a double tap or a head-up: the glasses' native dashboard.
   // On eligible Glassly CFW glasses the dashboard miniapp claims both while it
@@ -118,7 +166,7 @@ export function dispatchTouchEvent(event: TouchEvent): void {
 
 export function resetTouchInput(): void {
   miniappExitGesture.reset()
-  lastRingScrollAt.clear()
+  ringStrokes.clear()
 }
 
 /** Phone mirror input uses the same dashboard/miniapp policy as real glasses. */

package/src/services/LocalDisplayManager.ts

@@ -165,7 +165,7 @@ class LocalDisplayManager {
   private overlayOwner: string | null = null
 
   /** Miniapp whose visible frame is temporarily covered by an OS exit notice. */
-  private exitingApp: {packageName: string; coveredDisplay: ActiveDisplay} | null = null
+  private exitingApp: {packageName: string; coveredDisplay: ActiveDisplay | null} | null = null
 
   private expiryTimerId: number | null = null
 
@@ -309,16 +309,30 @@ class LocalDisplayManager {
   }
 
   /**
-   * Cover the currently visible miniapp with a persistent system exit notice.
-   * While it is up, miniapp display traffic is held off so a streaming app
-   * cannot immediately overwrite the notice. The caller completes the normal
-   * stop flow and then calls finishMiniappExit(); onUnmount does the same as a
+   * The miniapp an unclaimed double tap leaves: the one visibly drawing on
+   * the main view, else the core (running standard) app on an empty or
+   * system-drawn screen — an app that has drawn nothing yet, or whose frame
+   * expired, is still the one the wearer is in. Nothing while a page covers
+   * the main view: the page's claims own the tap.
+   */
+  public getMiniappToLeave(): string | null {
+    if (this.overlayOwner !== null) return null
+    return this.getVisibleMiniappPackageName() ?? this.coreApp
+  }
+
+  /**
+   * Cover the leaving miniapp with a persistent system exit notice. While it
+   * is up, miniapp display traffic is held off so a streaming app cannot
+   * immediately overwrite the notice. The caller completes the normal stop
+   * flow and then calls finishMiniappExit(); onUnmount does the same as a
    * safety net.
    */
   public beginMiniappExit(packageName: string, text: string): boolean {
     if (this.exitingApp !== null) return this.exitingApp.packageName === packageName
-    const coveredDisplay = this.currentDisplay
-    if (!coveredDisplay || this.getVisibleMiniappPackageName() !== packageName) return false
+    if (this.getMiniappToLeave() !== packageName) return false
+    // Only the app's own visible frame comes back on cancel; a system frame
+    // or an empty screen does not.
+    const coveredDisplay = this.getVisibleMiniappPackageName() === packageName ? this.currentDisplay : null
 
     console.log(`${LOG_TAG}: beginMiniappExit(${packageName})`)
     this.exitingApp = {packageName, coveredDisplay}
@@ -349,7 +363,7 @@ class LocalDisplayManager {
     this.exitingApp = null
 
     if (this.currentDisplay?.packageName !== SYSTEM_NOTICE_PKG) return
-    if (covered.expiresAt === null || covered.expiresAt > this.now()) {
+    if (covered && (covered.expiresAt === null || covered.expiresAt > this.now())) {
       this.restoreDisplay(covered)
     } else {
       this.currentDisplay = null

package/src/services/LocalLlmModelManager.ts

@@ -24,8 +24,10 @@ export interface LocalLlmModelConfig {
   id: LocalLlmModelId
   /** Human label for the Settings dropdown. */
   label: string
-  /** Approximate download size in bytes (the .pte dominates). */
+  /** Total download size in bytes (the .pte dominates). */
   sizeBytes: number
+  /** Exact size of the published .pte; the availability check compares against it. */
+  modelBytes: number
   /** Rough resident memory while loaded; the Settings copy warns above ~half of device RAM. */
   ramBytes: number
   urls: {
@@ -54,8 +56,10 @@ export interface LocalLlmDownloadStatus {
 
 // XNNPACK 8da4w exports from software-mansion/react-native-executorch-qwen-3,
 // pinned to the v0.10.0 release tag that react-native-executorch 0.10.x
-// expects. Sizes are the .pte file sizes on the Hub (tokenizer adds ~11 MB).
+// expects. modelBytes are the .pte sizes on the Hub; sizeBytes adds the
+// tokenizer files (~11 MB).
 const QWEN3_BASE = "https://huggingface.co/software-mansion/react-native-executorch-qwen-3/resolve/v0.10.0"
+const TOKENIZER_BYTES = 11_431_080
 const MB = 1024 * 1024
 const GB = 1024 * MB
 
@@ -63,7 +67,8 @@ const MODELS: Record<LocalLlmModelId, LocalLlmModelConfig> = {
   "qwen3-0.6b": {
     id: "qwen3-0.6b",
     label: "Qwen3 0.6B",
-    sizeBytes: 517 * MB,
+    sizeBytes: 505_686_400 + TOKENIZER_BYTES,
+    modelBytes: 505_686_400,
     ramBytes: 0.9 * GB,
     urls: {
       model: `${QWEN3_BASE}/0_6b/xnnpack/qwen_3_0_6b_xnnpack_8da4w.pte`,
@@ -74,7 +79,8 @@ const MODELS: Record<LocalLlmModelId, LocalLlmModelConfig> = {
   "qwen3-1.7b": {
     id: "qwen3-1.7b",
     label: "Qwen3 1.7B",
-    sizeBytes: 1315 * MB,
+    sizeBytes: 1_303_738_496 + TOKENIZER_BYTES,
+    modelBytes: 1_303_738_496,
     ramBytes: 1.8 * GB,
     urls: {
       model: `${QWEN3_BASE}/1_7b/xnnpack/qwen_3_1_7b_xnnpack_8da4w.pte`,
@@ -85,7 +91,8 @@ const MODELS: Record<LocalLlmModelId, LocalLlmModelConfig> = {
   "qwen3-4b": {
     id: "qwen3-4b",
     label: "Qwen3 4B",
-    sizeBytes: 2693 * MB,
+    sizeBytes: 2_681_646_976 + TOKENIZER_BYTES,
+    modelBytes: 2_681_646_976,
     ramBytes: 3.4 * GB,
     urls: {
       model: `${QWEN3_BASE}/4b/xnnpack/qwen_3_4b_xnnpack_8da4w.pte`,
@@ -161,7 +168,7 @@ class LocalLlmModelManager {
       // most of the published size. Downloads land in a .part file and are
       // renamed only once whole, so this only catches external tampering.
       const stat = await RNFS.stat(paths.model)
-      return Number(stat.size) >= MODELS[id].sizeBytes * 0.95
+      return Number(stat.size) >= MODELS[id].modelBytes * 0.95
     } catch (error) {
       console.warn("LOCAL_LLM: availability check failed:", error)
       return false
@@ -243,6 +250,9 @@ class LocalLlmModelManager {
       await this.fetchFile(config.urls.model, paths.model, (percent) =>
         this.setStatus({modelId: id, stage: "downloading", percent}),
       )
+      if (!(await this.isModelAvailable(id))) {
+        throw new Error(`downloaded model is smaller than the expected ${config.modelBytes} bytes`)
+      }
       this.setStatus({modelId: id, stage: "complete", percent: 100})
       for (const listener of this.modelReadyListeners) {
         try {

package/src/services/LocalLlmPrompt.ts

@@ -85,55 +85,74 @@ export function toTemplateTools(tools?: LlmTool[]): TemplateTool[] | undefined {
   }))
 }
 
-/** Rough tokens-per-character for a BPE vocabulary over mixed prose/JSON. */
-const CHARS_PER_TOKEN = 3.2
-/** Template framing per message (`<|im_start|>role … <|im_end|>`). */
-const TOKENS_PER_MESSAGE = 6
-
-export function estimateTokens(text: string): number {
-  return Math.ceil(text.length / CHARS_PER_TOKEN)
-}
-
-export function estimateMessageTokens(message: TemplateMessage): number {
-  let total = TOKENS_PER_MESSAGE + estimateTokens(message.content)
-  if (message.role === "assistant" && message.tool_calls) {
-    for (const call of message.tool_calls) total += estimateTokens(JSON.stringify(call.function)) + 8
-  }
-  return total
+export interface FittedLocalPrompt {
+  prompt: string
+  promptTokens: number
+  truncated: boolean
 }
 
-const MIN_TOOL_CONTENT_CHARS = 1_200
-
 /**
- * Fit the conversation into `budgetTokens`. History is grouped into turns
- * (a user message plus everything up to the next user message, so a tool
- * round stays with the question it answers); the oldest turns go first and
- * the last turn is never dropped — the model must at least see the question.
- * When that last turn alone still does not fit, tool outputs are cut to
- * their head.
+ * Measure the complete rendered prompt with the model's tokenizer, including
+ * template framing, system instructions and tool schemas. Drop old turns first,
+ * then shorten tool results / message text in the final turn. Never cut template
+ * delimiters, system instructions, or structured tool calls to make them fit.
  */
-export function fitToBudget(messages: TemplateMessage[], budgetTokens: number, toolTokens = 0): TemplateMessage[] {
-  const total = (list: TemplateMessage[]) => list.reduce((sum, m) => sum + estimateMessageTokens(m), toolTokens)
+export async function fitPromptToContext(
+  messages: TemplateMessage[],
+  budgetTokens: number,
+  render: (messages: TemplateMessage[]) => string,
+  countTokens: (prompt: string) => Promise<number>,
+): Promise<FittedLocalPrompt> {
+  if (!Number.isInteger(budgetTokens) || budgetTokens < 1) {
+    throw new Error("On-device model has no room for a prompt after reserving output tokens")
+  }
   const system = messages[0]?.role === "system" ? [messages[0]] : []
   const turns: TemplateMessage[][] = []
   for (const message of messages.slice(system.length)) {
     if (message.role === "user" || turns.length === 0) turns.push([message])
     else turns[turns.length - 1]!.push(message)
   }
-
-  while (turns.length > 1 && total([...system, ...turns.flat()]) > budgetTokens) {
-    turns.shift()
-  }
-
   let fitted = [...system, ...turns.flat()]
-  if (total(fitted) > budgetTokens) {
-    fitted = fitted.map((m) =>
-      m.role === "tool" && m.content.length > MIN_TOOL_CONTENT_CHARS
-        ? {...m, content: `${m.content.slice(0, MIN_TOOL_CONTENT_CHARS)}\n…[truncated]`}
-        : m,
-    )
+  let truncated = false
+  const marker = "\n…[truncated]…\n"
+  while (true) {
+    const prompt = render(fitted)
+    const promptTokens = await countTokens(prompt)
+    if (!Number.isInteger(promptTokens) || promptTokens < 1) {
+      throw new Error("On-device tokenizer returned an invalid prompt token count")
+    }
+    if (promptTokens <= budgetTokens) return {prompt, promptTokens, truncated}
+    truncated = true
+    if (turns.length > 1) {
+      turns.shift()
+      fitted = [...system, ...turns.flat()]
+      continue
+    }
+    // Preserve the user's question while tool output can still be shortened.
+    const candidates = fitted
+      .map((message, index) => ({message, index}))
+      .filter(({message}) => message.role !== "system" && Array.from(message.content).length > marker.length * 2)
+      .sort(
+        (a, b) =>
+          Number(b.message.role === "tool") - Number(a.message.role === "tool") ||
+          b.message.content.length - a.message.content.length,
+      )
+    const candidate = candidates[0]
+    if (!candidate) {
+      throw new Error(
+        `On-device prompt instructions and tool definitions exceed the context budget (${promptTokens} > ${budgetTokens} tokens)`,
+      )
+    }
+    // Keep both ends of long transcripts and questions, without splitting a
+    // Unicode code point. Each pass shrinks strictly, then remeasures the whole
+    // rendered prompt; character ratios are never used as a safety check.
+    const chars = Array.from(candidate.message.content)
+    const keep = Math.floor(chars.length / 4)
+    fitted[candidate.index] = {
+      ...candidate.message,
+      content: `${chars.slice(0, keep).join("")}${marker}${chars.slice(-keep).join("")}`,
+    }
   }
-  return fitted
 }
 
 /** Remove a leading `<think>…</think>` block (or an unterminated one). */

package/src/services/LocalLlmProvider.ts

@@ -22,9 +22,8 @@ import {BgTimer} from "../utils/timers"
 import localLlmModelManager, {type LocalLlmModelId} from "./LocalLlmModelManager"
 import {
   buildTemplateMessages,
-  estimateTokens,
   finalizeLocalResult,
-  fitToBudget,
+  fitPromptToContext,
   toTemplateTools,
   type LocalCompletion,
 } from "./LocalLlmPrompt"
@@ -33,6 +32,7 @@ import {SETTINGS, useSettingsStore} from "../stores/settings"
 type Rne = typeof import("react-native-executorch")
 // The runner API lives on the `llm` namespace; derive its types from there so
 // the import stays a type-only reference (no native module at load time).
+type Tokenizer = ReturnType<Rne["nlp"]["loadTokenizer"]>
 type LLMRunner = ReturnType<Rne["llm"]["createLLMRunner"]>
 type LLMGenerationStats = ReturnType<LLMRunner["generate"]>
 type LLMGenerationConfig = NonNullable<Parameters<LLMRunner["generate"]>[1]>
@@ -43,14 +43,23 @@ const LOG_TAG = "LOCAL_LLM"
 const IDLE_UNLOAD_MS = 5 * 60_000
 /** Hard stop on one generation — the SDK request times out at 120 s anyway. */
 const GENERATION_DEADLINE_MS = 100_000
+// One generating, one waiting. Assist's proactive insights re-request every
+// time the SDK's 60 s timeout fires while a slow on-device run is still going,
+// and an unbounded queue kept the phone generating for callers that had
+// already given up (one reporter saw 472 s runs and 15 s touch latency).
+const MAX_PENDING_REQUESTS = 2
+// Under the SDK's 60 s request timeout: a request that waited longer has no caller.
+const QUEUE_WAIT_LIMIT_MS = 55_000
 const DEFAULT_MAX_NEW_TOKENS = 512
 const MAX_NEW_TOKENS_CEILING = 1_024
-/** Headroom between the estimated prompt and the context end; estimates are rough. */
+/** Reserve space for runner-added BOS/EOS tokens and context boundary bookkeeping. */
 const CONTEXT_MARGIN_TOKENS = 96
 
 interface LoadedModel {
   modelId: LocalLlmModelId
   runner: LLMRunner
+  tokenizer: Tokenizer
+  countTokens: (tokenizer: Tokenizer, prompt: string) => Promise<number>
   template: Template
   stopTokens: string[]
   maxSeqLen: number
@@ -85,12 +94,18 @@ function generateWorklet(
   return {text, stats}
 }
 
+function countTokensWorklet(tokenizer: Tokenizer, prompt: string): number {
+  "worklet"
+  return tokenizer.encode(prompt).length
+}
+
 class LocalLlmProvider {
   private static instance: LocalLlmProvider
 
   private loaded: LoadedModel | null = null
   private loading: Promise<LoadedModel> | null = null
   private queue: Promise<unknown> = Promise.resolve()
+  private pendingCount = 0
   private idleTimer: number | null = null
   private rne: Rne | null = null
 
@@ -120,9 +135,24 @@ class LocalLlmProvider {
 
   /** Serve one neutral completion on-device. Throws when the model is missing or generation fails. */
   complete(request: LlmCompleteRequest): Promise<LocalLlmCompleteResult> {
-    const run = this.queue.then(() => this.completeInner(request))
+    if (this.pendingCount >= MAX_PENDING_REQUESTS) {
+      return Promise.reject(
+        new Error(`The on-device model is busy (${this.pendingCount} requests pending); try again shortly.`),
+      )
+    }
+    this.pendingCount += 1
+    const queuedAt = Date.now()
+    const run = this.queue.then(() => {
+      const waitedMs = Date.now() - queuedAt
+      if (waitedMs > QUEUE_WAIT_LIMIT_MS) {
+        throw new Error(`The on-device model was busy for ${Math.round(waitedMs / 1000)} s; request dropped.`)
+      }
+      return this.completeInner(request)
+    })
     this.queue = run.catch(() => undefined)
-    return run
+    return run.finally(() => {
+      this.pendingCount -= 1
+    })
   }
 
   /** Release the resident runner (idle, model switch, memory pressure). Safe to call repeatedly. */
@@ -150,6 +180,8 @@ class LocalLlmProvider {
       loaded.runner.dispose()
     } catch (error) {
       console.warn(`${LOG_TAG}: runner dispose failed:`, error)
+    } finally {
+      loaded.tokenizer.dispose()
     }
   }
 
@@ -159,21 +191,21 @@ class LocalLlmProvider {
       const model = await this.ensureLoaded()
       const jsonMode = request.jsonMode === true
       const tools = toTemplateTools(request.tools)
-      const toolTokens = tools ? estimateTokens(JSON.stringify(tools)) + 64 : 0
 
       const maxNewTokens = Math.max(
         16,
         Math.min(request.maxTokens ?? DEFAULT_MAX_NEW_TOKENS, MAX_NEW_TOKENS_CEILING, Math.floor(model.maxSeqLen / 4)),
       )
       const promptBudget = model.maxSeqLen - maxNewTokens - CONTEXT_MARGIN_TOKENS
-      const messages = fitToBudget(buildTemplateMessages({...request, jsonMode}), promptBudget, toolTokens)
-
-      const prompt = model.template.render({
-        messages,
-        tools,
-        add_generation_prompt: true,
-        enable_thinking: false,
-      })
+      const {prompt, promptTokens, truncated} = await fitPromptToContext(
+        buildTemplateMessages({...request, jsonMode}),
+        promptBudget,
+        (messages) => model.template.render({messages, tools, add_generation_prompt: true, enable_thinking: false}),
+        (text) => model.countTokens(model.tokenizer, text),
+      )
+      console.log(
+        `${LOG_TAG}: ${model.modelId} prompt=${promptTokens} budget=${promptBudget} context=${model.maxSeqLen} maxNewTokens=${maxNewTokens} truncated=${truncated}`,
+      )
 
       model.runner.reset(0)
       const deadline = BgTimer.setTimeout(() => {
@@ -189,6 +221,12 @@ class LocalLlmProvider {
           {maxNewTokens, temperature: request.temperature ?? 0.7},
           model.stopTokens,
         )
+      } catch (error) {
+        console.warn(
+          `${LOG_TAG}: generation failed: model=${model.modelId} prompt=${promptTokens} context=${model.maxSeqLen} maxNewTokens=${maxNewTokens}`,
+          error,
+        )
+        throw error
       } finally {
         BgTimer.clearTimeout(deadline)
       }
@@ -246,16 +284,28 @@ class LocalLlmProvider {
     const startedAt = Date.now()
     const createRunner = rne.wrapAsync(rne.llm.createLLMRunner)
     const runner = await createRunner(paths.model, paths.tokenizer, [])
-    const maxSeqLen = runner.getKVCacheState().maxSeqLen
-    console.log(`${LOG_TAG}: loaded ${modelId} (context ${maxSeqLen}) in ${Date.now() - startedAt} ms`)
-
-    return {
-      modelId,
-      runner,
-      template,
-      stopTokens: [...tokenizerConfig.stopTokens],
-      maxSeqLen,
-      generate: rne.wrapAsync(generateWorklet),
+    let tokenizer: Tokenizer | undefined
+    try {
+      const maxSeqLen = runner.getKVCacheState().maxSeqLen
+      if (!Number.isInteger(maxSeqLen) || maxSeqLen <= CONTEXT_MARGIN_TOKENS + 16) {
+        throw new Error(`On-device model ${modelId} reported an invalid context size: ${maxSeqLen}`)
+      }
+      tokenizer = await rne.wrapAsync(rne.nlp.loadTokenizer)(paths.tokenizer)
+      console.log(`${LOG_TAG}: loaded ${modelId} (context ${maxSeqLen}) in ${Date.now() - startedAt} ms`)
+      return {
+        modelId,
+        runner,
+        tokenizer,
+        countTokens: rne.wrapAsync(countTokensWorklet),
+        template,
+        stopTokens: [...tokenizerConfig.stopTokens],
+        maxSeqLen,
+        generate: rne.wrapAsync(generateWorklet),
+      }
+    } catch (error) {
+      tokenizer?.dispose()
+      runner.dispose()
+      throw error
     }
   }