@harness-engineering/orchestrator 0.9.2 → 0.11.1

package/dist/index.mjs

@@ -3766,6 +3766,7 @@ var AgentRunner = class {
 };
 
 // src/agent/local-model-resolver.ts
+import { poolStateToCandidates } from "@harness-engineering/local-models";
 var DEFAULT_PROBE_INTERVAL_MS = 3e4;
 var MIN_PROBE_INTERVAL_MS = 1e3;
 var DEFAULT_API_KEY = "lm-studio";
@@ -3822,6 +3823,7 @@ var LocalModelResolver = class {
   endpoint;
   apiKey;
   configured;
+  poolState;
   probeIntervalMs;
   fetchModels;
   logger;
@@ -3850,6 +3852,9 @@ var LocalModelResolver = class {
       this.apiKey = opts.apiKey;
     }
     this.configured = [...opts.configured];
+    if (opts.poolState !== void 0) {
+      this.poolState = opts.poolState;
+    }
     const interval = opts.probeIntervalMs ?? DEFAULT_PROBE_INTERVAL_MS;
     this.probeIntervalMs = Math.max(MIN_PROBE_INTERVAL_MS, interval);
     const timeoutMs = opts.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
@@ -3863,13 +3868,21 @@ var LocalModelResolver = class {
     return {
       available: this.available,
       resolved: this.resolved,
-      configured: [...this.configured],
+      configured: this.candidates(),
       detected: [...this.detected],
       lastProbeAt: this.lastProbeAt,
       lastError: this.lastError,
       warnings: [...this.warnings]
     };
   }
+  /**
+   * Effective candidate list. With a poolState port present the list derives
+   * from pool entries (currentScore desc → ollamaName); otherwise the static
+   * `configured` list is returned unchanged (byte-identical to pre-Phase-4).
+   */
+  candidates() {
+    return this.poolState ? poolStateToCandidates(this.poolState.snapshot()) : [...this.configured];
+  }
   onStatusChange(handler) {
     this.listeners.add(handler);
     return () => {
@@ -3893,11 +3906,12 @@ var LocalModelResolver = class {
       this.detected = [...detected];
       this.lastError = null;
       this.lastProbeAt = (/* @__PURE__ */ new Date()).toISOString();
-      const match = this.configured.find((id) => detected.includes(id)) ?? null;
+      const candidates = this.candidates();
+      const match = candidates.find((id) => detected.includes(id)) ?? null;
       this.resolved = match;
       this.available = match !== null;
       this.warnings = match ? [] : [
-        `No configured local model is loaded. Configured: [${this.configured.join(", ")}]. Detected: [${detected.join(", ")}].`
+        `No configured local model is loaded. Configured: [${candidates.join(", ")}]. Detected: [${detected.join(", ")}].`
       ];
     } catch (err) {
       const message = err instanceof Error ? err.message : "probe failed";
@@ -3946,7 +3960,7 @@ var LocalModelResolver = class {
     return JSON.stringify({
       available: this.available,
       resolved: this.resolved,
-      configured: this.configured,
+      configured: this.candidates(),
       detected: this.detected,
       lastError: this.lastError,
       warnings: this.warnings
@@ -3954,6 +3968,20 @@ var LocalModelResolver = class {
   }
 };
 
+// src/orchestrator.ts
+import {
+  PoolStateStore,
+  PoolManager,
+  OllamaInstallAdapter,
+  HardwareDetector,
+  RefreshScheduler,
+  runRefreshTick,
+  createNativeRecommender,
+  loadFrozenCandidates,
+  selectCandidates as selectCandidates2
+} from "@harness-engineering/local-models";
+import { createModelProposal as createModelProposal2, listProposals as listProposals2 } from "@harness-engineering/core";
+
 // src/agent/config-migration.ts
 var MIGRATION_GUIDE = "docs/guides/multi-backend-routing.md";
 var CASE1_ALWAYS_SUPPRESS = /* @__PURE__ */ new Set(["agent.backend"]);
@@ -8334,10 +8362,10 @@ function checkDiff(diff) {
 function deriveFindings(proposal) {
   const findings = [];
   findings.push(...checkName(proposal.content.name));
-  if (proposal.kind === "new-skill") {
+  if (proposal.skillKind === "new-skill") {
     findings.push(...checkSkillYaml(proposal.content.skillYaml ?? ""));
     findings.push(...checkSkillMd(proposal.content.skillMd ?? ""));
-  } else if (proposal.kind === "refinement") {
+  } else if (proposal.skillKind === "refinement") {
     findings.push(...checkDiff(proposal.content.diff ?? ""));
   }
   return findings;
@@ -8345,6 +8373,9 @@ function deriveFindings(proposal) {
 async function runGate(projectPath, proposalId) {
   const proposal = await getProposal(projectPath, proposalId);
   if (!proposal) throw new ProposalNotFoundError(proposalId);
+  if (proposal.kind !== "skill") {
+    throw new GateRunError(`gate applies to skill proposals only (got ${proposal.kind})`);
+  }
   if (proposal.status === "approved" || proposal.status === "rejected") {
     throw new GateRunError(
       `proposal ${proposalId} is already ${proposal.status}; cannot re-run the gate`
@@ -8474,8 +8505,11 @@ async function promoteRefinement(projectPath, proposal) {
 async function promote(projectPath, proposalId, decidedBy) {
   const proposal = await getProposal2(projectPath, proposalId);
   if (!proposal) throw new ProposalNotFoundError2(proposalId);
+  if (proposal.kind !== "skill") {
+    throw new PromotionError("only skill proposals are promotable to the catalog");
+  }
   assertGateReady(proposal);
-  const out = proposal.kind === "new-skill" ? await promoteNewSkill(projectPath, proposal) : await promoteRefinement(projectPath, proposal);
+  const out = proposal.skillKind === "new-skill" ? await promoteNewSkill(projectPath, proposal) : await promoteRefinement(projectPath, proposal);
   await updateProposal2(projectPath, proposalId, {
     status: "approved",
     decision: {
@@ -8498,7 +8532,7 @@ function emit3(bus, topic, data) {
 function emitProposalCreated(bus, proposal) {
   const data = {
     id: proposal.id,
-    kind: proposal.kind,
+    kind: proposal.skillKind,
     name: proposal.content.name,
     proposedBy: proposal.proposedBy,
     justification: proposal.source.justification
@@ -8509,7 +8543,7 @@ function emitProposalCreated(bus, proposal) {
 function emitProposalApproved(bus, proposal) {
   const data = {
     id: proposal.id,
-    kind: proposal.kind,
+    kind: proposal.skillKind,
     name: proposal.content.name,
     decidedBy: proposal.decision?.decidedBy ?? "(unknown)"
   };
@@ -8519,7 +8553,7 @@ function emitProposalApproved(bus, proposal) {
 function emitProposalRejected(bus, proposal) {
   const data = {
     id: proposal.id,
-    kind: proposal.kind,
+    kind: proposal.skillKind,
     name: proposal.content.name,
     decidedBy: proposal.decision?.decidedBy ?? "(unknown)",
     reason: proposal.decision?.reason ?? "(no reason given)"
@@ -8527,6 +8561,163 @@ function emitProposalRejected(bus, proposal) {
   emit3(bus, "proposal.rejected", data);
 }
 
+// src/proposals/model-handlers.ts
+function isInUse(deps, ollamaName) {
+  return deps.isModelInUse ? deps.isModelInUse(ollamaName) : false;
+}
+var MODEL_PROPOSAL_TOPIC = "local-models:proposal";
+var MODEL_POOL_TOPIC = "local-models:pool";
+function decisionOf(deps, action, reason) {
+  return {
+    decidedAt: (deps.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
+    decidedBy: deps.decidedBy ?? "orchestrator",
+    action,
+    ...reason !== void 0 ? { reason } : {}
+  };
+}
+function emitApproved(deps, proposal) {
+  deps.bus.emit(MODEL_PROPOSAL_TOPIC, {
+    id: proposal.id,
+    status: "approved",
+    action: proposal.model.action,
+    target: proposal.model.target.ollamaName
+  });
+}
+async function deferEviction(deps, proposal, deferredName, event, evicted) {
+  deps.pool.markPendingEviction(deferredName);
+  const updated = await deps.updateProposal(proposal.id, {
+    status: "approved",
+    decision: decisionOf(deps, "approved")
+  });
+  deps.bus.emit(MODEL_POOL_TOPIC, event);
+  emitApproved(deps, proposal);
+  return { status: "approved", proposal: updated, evicted };
+}
+async function onApproveModelProposal(deps, proposal) {
+  const { model } = proposal;
+  if (model.action === "evict") {
+    return applyEvictOnly(deps, proposal);
+  }
+  const installResult = await deps.pool.install({
+    hfRepoId: model.target.hfRepoId,
+    ollamaName: model.target.ollamaName,
+    ...model.replaces !== void 0 ? { replaces: model.replaces.ollamaName } : {},
+    ...model.diskImpactGb > 0 ? { sizeOnDiskGb: model.diskImpactGb } : {}
+  });
+  if (installResult.status === "error") {
+    if (installResult.code === "failed_target_missing") {
+      const updated2 = await deps.updateProposal(proposal.id, {
+        status: "failed_target_missing"
+      });
+      deps.bus.emit(MODEL_PROPOSAL_TOPIC, {
+        id: proposal.id,
+        status: "failed_target_missing",
+        action: model.action,
+        target: model.target.ollamaName
+      });
+      return { status: "failed_target_missing", proposal: updated2 };
+    }
+    return { status: "error", code: installResult.code, message: installResult.message };
+  }
+  const evicted = [...installResult.evicted];
+  if (model.action === "swap" && model.replaces !== void 0) {
+    const replacesName = model.replaces.ollamaName;
+    if (isInUse(deps, replacesName)) {
+      return deferEviction(
+        deps,
+        proposal,
+        replacesName,
+        {
+          id: proposal.id,
+          action: model.action,
+          installed: model.target.ollamaName,
+          phase: "evict_deferred",
+          deferred: replacesName,
+          ...installResult.evicted.length > 0 ? { evicted: installResult.evicted.map((e) => e.ollamaName) } : {}
+        },
+        evicted
+      );
+    }
+    const evictResult = await deps.pool.evict({ ollamaName: replacesName });
+    if (evictResult.status === "error") {
+      deps.bus.emit(MODEL_POOL_TOPIC, {
+        id: proposal.id,
+        action: model.action,
+        installed: model.target.ollamaName,
+        phase: "swap_evict_failed"
+      });
+      return { status: "error", code: evictResult.code, message: evictResult.message };
+    }
+    if (evictResult.removed !== null) {
+      evicted.push(evictResult.removed);
+    }
+  }
+  const updated = await deps.updateProposal(proposal.id, {
+    status: "approved",
+    decision: decisionOf(deps, "approved")
+  });
+  const evictedNames = [
+    ...installResult.evicted.map((e) => e.ollamaName),
+    ...model.replaces !== void 0 ? [model.replaces.ollamaName] : []
+  ];
+  deps.bus.emit(MODEL_POOL_TOPIC, {
+    id: proposal.id,
+    action: model.action,
+    installed: model.target.ollamaName,
+    ...evictedNames.length > 0 ? { evicted: evictedNames } : {}
+  });
+  emitApproved(deps, proposal);
+  return { status: "approved", proposal: updated, evicted };
+}
+async function applyEvictOnly(deps, proposal) {
+  const targetName = proposal.model.target.ollamaName;
+  if (isInUse(deps, targetName)) {
+    return deferEviction(
+      deps,
+      proposal,
+      targetName,
+      { id: proposal.id, action: "evict", phase: "evict_deferred", deferred: targetName },
+      []
+    );
+  }
+  const evictResult = await deps.pool.evict({ ollamaName: targetName });
+  if (evictResult.status === "error") {
+    return { status: "error", code: evictResult.code, message: evictResult.message };
+  }
+  const updated = await deps.updateProposal(proposal.id, {
+    status: "approved",
+    decision: decisionOf(deps, "approved")
+  });
+  deps.bus.emit(MODEL_POOL_TOPIC, {
+    id: proposal.id,
+    action: "evict",
+    // XP-2: `evicted` is string[] at EVERY local-models:pool emit site (swap/add
+    // list multiple removals) — the evict-only path wraps its single removal in
+    // an array too, so consumers never branch on string-vs-array.
+    evicted: [proposal.model.target.ollamaName]
+  });
+  emitApproved(deps, proposal);
+  return {
+    status: "approved",
+    proposal: updated,
+    evicted: evictResult.removed !== null && evictResult.removed !== void 0 ? [evictResult.removed] : []
+  };
+}
+async function onRejectModelProposal(deps, proposal, reason) {
+  const updated = await deps.updateProposal(proposal.id, {
+    status: "rejected",
+    decision: decisionOf(deps, "rejected", reason)
+  });
+  deps.bus.emit(MODEL_PROPOSAL_TOPIC, {
+    id: proposal.id,
+    status: "rejected",
+    target: proposal.model.target.ollamaName,
+    replaces: proposal.model.replaces?.ollamaName,
+    reason
+  });
+  return updated;
+}
+
 // src/server/routes/v1/proposals.ts
 var LIST_RE = /^\/api\/v1\/proposals(?:\?.*)?$/;
 var SINGLE_RE = /^\/api\/v1\/proposals\/([^/?]+)(?:\?.*)?$/;
@@ -8552,6 +8743,20 @@ function getDecidedBy(req, deps) {
   const token = req._authToken;
   return token?.id ?? "unknown";
 }
+function modelHandlerDeps(deps, req) {
+  return {
+    pool: deps.modelPool,
+    bus: deps.bus,
+    // Core's `updateProposal` patch type intersects the skill+model status
+    // enums, which statically excludes model-only statuses like
+    // `failed_target_missing`. The runtime parses through `ProposalSchema` (the
+    // model variant accepts that status), so the cast is sound — only the
+    // intersection type is too narrow.
+    updateProposal: (id, patch) => updateProposal3(deps.projectPath, id, patch),
+    decidedBy: getDecidedBy(req, deps),
+    ...deps.isModelInUse ? { isModelInUse: deps.isModelInUse } : {}
+  };
+}
 function parseStatusFromQuery(url) {
   const queryIdx = url.indexOf("?");
   if (queryIdx === -1) return void 0;
@@ -8596,11 +8801,31 @@ async function handleRunGate(res, deps, id) {
   }
 }
 async function handleApprove(req, res, deps, id) {
+  const existing = await getProposal3(deps.projectPath, id);
+  if (!existing) {
+    sendJSON8(res, 404, { error: "Proposal not found" });
+    return;
+  }
+  if (existing.kind === "model") {
+    if (!deps.modelPool) {
+      sendJSON8(res, 501, { error: "model proposal handlers not configured" });
+      return;
+    }
+    if (existing.status === "approved" || existing.status === "rejected" || existing.status === "failed_target_missing") {
+      sendJSON8(res, 409, {
+        error: `proposal already ${existing.status}; cannot approve`
+      });
+      return;
+    }
+    const outcome = await onApproveModelProposal(modelHandlerDeps(deps, req), existing);
+    sendJSON8(res, outcome.status === "error" ? 422 : 200, outcome);
+    return;
+  }
   const decidedBy = getDecidedBy(req, deps);
   try {
     const result = await promote(deps.projectPath, id, decidedBy);
     const proposal = await getProposal3(deps.projectPath, id);
-    if (proposal) emitProposalApproved(deps.bus, proposal);
+    if (proposal && proposal.kind === "skill") emitProposalApproved(deps.bus, proposal);
     sendJSON8(res, 200, { promotion: result, proposal });
   } catch (err) {
     if (err instanceof ProposalNotFoundError3) {
@@ -8652,6 +8877,19 @@ async function handleReject(req, res, deps, id) {
     });
     return;
   }
+  if (proposal.kind === "model") {
+    if (!deps.modelPool) {
+      sendJSON8(res, 501, { error: "model proposal handlers not configured" });
+      return;
+    }
+    const updated2 = await onRejectModelProposal(
+      modelHandlerDeps(deps, req),
+      proposal,
+      parsed.data.reason
+    );
+    sendJSON8(res, 200, updated2);
+    return;
+  }
   const decidedBy = getDecidedBy(req, deps);
   const updated = await updateProposal3(deps.projectPath, id, {
     status: "rejected",
@@ -8662,7 +8900,7 @@ async function handleReject(req, res, deps, id) {
       reason: parsed.data.reason
     }
   });
-  emitProposalRejected(deps.bus, updated);
+  if (updated.kind === "skill") emitProposalRejected(deps.bus, updated);
   sendJSON8(res, 200, updated);
 }
 async function handleEdit(req, res, deps, id) {
@@ -8690,6 +8928,10 @@ async function handleEdit(req, res, deps, id) {
     sendJSON8(res, 404, { error: "Proposal not found" });
     return;
   }
+  if (existing.kind !== "skill") {
+    sendJSON8(res, 422, { error: "edit applies to skill proposals only" });
+    return;
+  }
   if (existing.status === "approved" || existing.status === "rejected") {
     sendJSON8(res, 409, {
       error: `proposal already ${existing.status}; cannot edit`
@@ -8755,17 +8997,331 @@ function handleV1ProposalsRoute(req, res, deps) {
   return false;
 }
 
+// src/server/routes/v1/local-models.ts
+import {
+  isTickHardFailure
+} from "@harness-engineering/local-models";
+var REFRESH_RE = /^\/api\/v1\/local-models\/refresh(?:\?.*)?$/;
+var HARDWARE_RE = /^\/api\/v1\/local-models\/hardware(?:\?.*)?$/;
+var POOL_RE = /^\/api\/v1\/local-models\/pool(?:\?.*)?$/;
+var RECS_RE = /^\/api\/v1\/local-models\/recommendations(?:\?.*)?$/;
+var PROPOSALS_RE = /^\/api\/v1\/local-models\/proposals(?:\?.*)?$/;
+var RECOMMENDATION_PROFILES = ["general", "coding", "reasoning"];
+function sendJSON9(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function handleV1LocalModelsRoute(req, res, deps) {
+  const url = req.url ?? "";
+  const method = req.method ?? "GET";
+  if (method === "GET") {
+    if (HARDWARE_RE.test(url)) {
+      void runGet(res, () => handleHardware(res, deps));
+      return true;
+    }
+    if (POOL_RE.test(url)) {
+      void runGet(res, () => handlePool(res, deps));
+      return true;
+    }
+    if (RECS_RE.test(url)) {
+      void runGet(res, () => handleRecommendations(res, url, deps));
+      return true;
+    }
+    if (PROPOSALS_RE.test(url)) {
+      void runGet(res, () => handleProposals(res, deps));
+      return true;
+    }
+    return false;
+  }
+  if (method !== "POST" || !REFRESH_RE.test(url)) return false;
+  const scheduler = deps.getRefreshScheduler();
+  if (scheduler === null) {
+    sendJSON9(res, 503, { error: "LMLM disabled" });
+    return true;
+  }
+  void runForceRefresh(res, scheduler, deps);
+  return true;
+}
+async function runGet(res, handler) {
+  try {
+    await handler();
+  } catch (err) {
+    sendJSON9(res, 500, {
+      error: "local-models route failed",
+      detail: err instanceof Error ? err.message : "unknown"
+    });
+  }
+}
+async function handleHardware(res, deps) {
+  const pending = deps.getHardwareProfile?.() ?? null;
+  if (pending === null) {
+    sendJSON9(res, 503, { error: "LMLM disabled" });
+    return;
+  }
+  sendJSON9(res, 200, await pending);
+}
+async function handlePool(res, deps) {
+  const pool = deps.getModelPool?.() ?? null;
+  if (pool === null) {
+    sendJSON9(res, 503, { error: "LMLM disabled" });
+    return;
+  }
+  sendJSON9(res, 200, pool.viewState?.() ?? pool.snapshot());
+}
+var MAX_RECOMMENDATION_TOP = 100;
+async function handleRecommendations(res, url, deps) {
+  if (deps.getRecommendations === void 0) {
+    sendJSON9(res, 503, { error: "LMLM disabled" });
+    return;
+  }
+  const params = new URLSearchParams(url.split("?")[1] ?? "");
+  const topRaw = params.get("top");
+  let top = 10;
+  if (topRaw !== null) {
+    const n = Number(topRaw);
+    if (!Number.isInteger(n) || n <= 0) {
+      sendJSON9(res, 400, { error: "invalid top: expected a positive integer" });
+      return;
+    }
+    if (n > MAX_RECOMMENDATION_TOP) {
+      sendJSON9(res, 400, { error: `invalid top: exceeds maximum of ${MAX_RECOMMENDATION_TOP}` });
+      return;
+    }
+    top = n;
+  }
+  const profileRaw = params.get("profile");
+  let profile = "general";
+  if (profileRaw !== null) {
+    if (!isRecommendationProfile(profileRaw)) {
+      sendJSON9(res, 400, {
+        error: `invalid profile: expected one of ${RECOMMENDATION_PROFILES.join(", ")}`
+      });
+      return;
+    }
+    profile = profileRaw;
+  }
+  sendJSON9(res, 200, await deps.getRecommendations({ top, profile }));
+}
+async function handleProposals(res, deps) {
+  if (deps.listModelProposals === void 0) {
+    sendJSON9(res, 503, { error: "LMLM disabled" });
+    return;
+  }
+  sendJSON9(res, 200, await deps.listModelProposals());
+}
+function isRecommendationProfile(value) {
+  return RECOMMENDATION_PROFILES.includes(value);
+}
+async function runForceRefresh(res, scheduler, deps) {
+  let result;
+  try {
+    result = await scheduler.forceRefresh();
+  } catch (err) {
+    sendJSON9(res, 500, {
+      error: "refresh tick failed",
+      detail: err instanceof Error ? err.message : "unknown"
+    });
+    return;
+  }
+  if (isTickHardFailure(result)) {
+    sendJSON9(res, 503, {
+      error: "refresh hard failure: HuggingFace unreachable and no benchmark snapshot loaded",
+      emitted: result.proposalsEmitted,
+      warnings: result.warnings,
+      errors: result.errors
+    });
+    return;
+  }
+  const proposals = deps.listModelProposals ? await deps.listModelProposals() : [];
+  sendJSON9(res, 200, {
+    emitted: result.proposalsEmitted,
+    reconciledRemoved: result.reconciledRemoved,
+    proposals,
+    warnings: result.warnings
+  });
+}
+
+// src/server/routes/v1/local-models-pool-mutation.ts
+import { createModelProposal, updateProposal as updateProposal4 } from "@harness-engineering/core";
+var INSTALL_RE = /^\/api\/v1\/local-models\/pool\/install(?:\?.*)?$/;
+var REMOVE_RE = /^\/api\/v1\/local-models\/pool\/remove(?:\?.*)?$/;
+var RESOLVE_TOP = 50;
+function sendJSON10(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function decidedByOf(deps, req) {
+  if (deps.getDecidedBy) return deps.getDecidedBy(req);
+  const token = req._authToken;
+  return token?.id ?? "operator";
+}
+function handlerDeps(deps, req, pool) {
+  return {
+    pool,
+    bus: deps.bus,
+    updateProposal: (id, patch) => updateProposal4(deps.projectPath, id, patch),
+    decidedBy: decidedByOf(deps, req),
+    ...deps.isModelInUse ? { isModelInUse: deps.isModelInUse } : {}
+  };
+}
+async function readJsonBody(req) {
+  try {
+    const raw = await readBody(req);
+    if (raw.length === 0) return {};
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function handleInstall(req, res, deps) {
+  const pool = deps.getModelPool();
+  if (pool === null) return sendJSON10(res, 503, { error: "LMLM disabled" });
+  const body = await readJsonBody(req);
+  if (body === void 0) return sendJSON10(res, 400, { error: "invalid JSON body" });
+  const hfRepoId = typeof body.hfRepoId === "string" ? body.hfRepoId : "";
+  if (hfRepoId.length === 0) return sendJSON10(res, 400, { error: "hfRepoId is required" });
+  const quant = typeof body.quant === "string" ? body.quant : void 0;
+  if (!deps.getRecommendations) {
+    return sendJSON10(res, 503, { error: "recommendations unavailable" });
+  }
+  const ranked = await deps.getRecommendations({ top: RESOLVE_TOP, profile: "general" });
+  const match = ranked.find(
+    (r) => r.hfRepoId === hfRepoId && (quant === void 0 || r.quant === quant)
+  );
+  if (!match) {
+    return sendJSON10(res, 404, {
+      error: `no recommendation for ${hfRepoId}${quant ? ` @ ${quant}` : ""}`
+    });
+  }
+  if (!match.ollamaName) {
+    return sendJSON10(res, 422, { error: `${hfRepoId} has no known Ollama mirror to install` });
+  }
+  const content = {
+    action: "add",
+    target: { hfRepoId: match.hfRepoId, ollamaName: match.ollamaName },
+    scoreDelta: match.score,
+    justification: {
+      summary: `Operator-initiated install of ${match.ollamaName} (${match.quant}).`,
+      benchmarkBasis: [],
+      hardwareFit: match.fitsHardware ? "fits detected hardware" : "may not fit detected hardware",
+      evidence: match.evidence,
+      freshness: `snapshot ${match.benchmarkSnapshot}`
+    },
+    // 0 → the installer resolves the true on-disk size via `inspect` before the
+    // budget check, rather than trusting an estimate.
+    diskImpactGb: 0
+  };
+  const record = await createModelProposal(deps.projectPath, content, {
+    proposedBy: decidedByOf(deps, req)
+  });
+  const outcome = await onApproveModelProposal(handlerDeps(deps, req, pool), record);
+  if (outcome.status === "approved") {
+    const result = {
+      disposition: "installed",
+      proposalId: record.id,
+      evicted: outcome.evicted.map((e) => e.ollamaName)
+    };
+    return sendJSON10(res, 200, result);
+  }
+  if (outcome.status === "failed_target_missing") {
+    return sendJSON10(res, 404, {
+      error: `${hfRepoId} is no longer available on HuggingFace`,
+      proposalId: record.id
+    });
+  }
+  const status = outcome.code === "not_allowed" || outcome.code === "budget_exceeded" ? 409 : 502;
+  return sendJSON10(res, status, {
+    error: outcome.message,
+    code: outcome.code,
+    proposalId: record.id
+  });
+}
+async function handleRemove(req, res, deps) {
+  const pool = deps.getModelPool();
+  if (pool === null) return sendJSON10(res, 503, { error: "LMLM disabled" });
+  const body = await readJsonBody(req);
+  if (body === void 0) return sendJSON10(res, 400, { error: "invalid JSON body" });
+  const ollamaName = typeof body.ollamaName === "string" ? body.ollamaName : "";
+  if (ollamaName.length === 0) return sendJSON10(res, 400, { error: "ollamaName is required" });
+  const entry = pool.snapshot().entries.find((e) => e.ollamaName === ollamaName);
+  if (!entry) return sendJSON10(res, 404, { error: `${ollamaName} is not in the pool` });
+  const content = {
+    action: "evict",
+    target: { hfRepoId: entry.hfRepoId, ollamaName },
+    scoreDelta: 0,
+    justification: {
+      summary: `Operator-initiated removal of ${ollamaName}.`,
+      benchmarkBasis: [],
+      hardwareFit: "",
+      evidence: "operator",
+      freshness: ""
+    },
+    diskImpactGb: entry.sizeOnDiskGb
+  };
+  const record = await createModelProposal(deps.projectPath, content, {
+    proposedBy: decidedByOf(deps, req)
+  });
+  const outcome = await onApproveModelProposal(handlerDeps(deps, req, pool), record);
+  if (outcome.status === "error") {
+    return sendJSON10(res, 502, {
+      error: outcome.message,
+      code: outcome.code,
+      proposalId: record.id
+    });
+  }
+  if (outcome.status === "failed_target_missing") {
+    return sendJSON10(res, 500, {
+      error: "unexpected failed_target_missing on evict",
+      proposalId: record.id
+    });
+  }
+  if (outcome.evicted.length > 0) {
+    const result2 = {
+      disposition: "removed",
+      proposalId: record.id,
+      evicted: outcome.evicted.map((e) => e.ollamaName)
+    };
+    return sendJSON10(res, 200, result2);
+  }
+  const stillPresent = pool.snapshot().entries.some((e) => e.ollamaName === ollamaName);
+  if (stillPresent) {
+    const result2 = {
+      disposition: "deferred",
+      proposalId: record.id,
+      evicted: [],
+      message: "model is in use; it will be removed after the current run"
+    };
+    return sendJSON10(res, 202, result2);
+  }
+  const result = { disposition: "removed", proposalId: record.id, evicted: [] };
+  return sendJSON10(res, 200, result);
+}
+function handleV1LocalModelsMutationRoute(req, res, deps) {
+  const url = req.url ?? "";
+  if ((req.method ?? "GET") !== "POST") return false;
+  if (INSTALL_RE.test(url)) {
+    void handleInstall(req, res, deps);
+    return true;
+  }
+  if (REMOVE_RE.test(url)) {
+    void handleRemove(req, res, deps);
+    return true;
+  }
+  return false;
+}
+
 // src/server/routes/v1/routing.ts
 import { z as z14 } from "zod";
 var CONFIG_RE = /^\/api\/v1\/routing\/config(?:\?.*)?$/;
 var DECISIONS_RE = /^\/api\/v1\/routing\/decisions(?:\?.*)?$/;
 var TRACE_RE = /^\/api\/v1\/routing\/trace(?:\?.*)?$/;
-function sendJSON9(res, status, body) {
+function sendJSON11(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
 function unavailable(res) {
-  sendJSON9(res, 503, { error: "BackendRouter not available" });
+  sendJSON11(res, 503, { error: "BackendRouter not available" });
   return true;
 }
 function resolveChain(value, backends) {
@@ -8802,7 +9358,7 @@ function buildResolvedChains(routing, backends) {
 }
 function handleConfig(res, deps) {
   if (!deps.router || !deps.routing || !deps.backends) return unavailable(res);
-  sendJSON9(res, 200, {
+  sendJSON11(res, 200, {
     routing: deps.routing,
     resolvedChains: buildResolvedChains(deps.routing, deps.backends),
     backends: Object.keys(deps.backends)
@@ -8830,7 +9386,7 @@ function parseDecisionsQuery(url) {
 function handleDecisions(req, res, deps) {
   if (!deps.bus) return unavailable(res);
   const filter = parseDecisionsQuery(req.url ?? "");
-  sendJSON9(res, 200, { decisions: deps.bus.recent(filter) });
+  sendJSON11(res, 200, { decisions: deps.bus.recent(filter) });
   return true;
 }
 var UseCaseSchema = z14.discriminatedUnion("kind", [
@@ -8862,19 +9418,19 @@ async function handleTrace(req, res, deps) {
   try {
     raw = await readBody(req);
   } catch {
-    sendJSON9(res, 400, { error: "body read failed" });
+    sendJSON11(res, 400, { error: "body read failed" });
     return true;
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    sendJSON9(res, 400, { error: "invalid JSON body" });
+    sendJSON11(res, 400, { error: "invalid JSON body" });
     return true;
   }
   const r = TraceBodySchema.safeParse(parsed);
   if (!r.success) {
-    sendJSON9(res, 400, { error: r.error.message });
+    sendJSON11(res, 400, { error: r.error.message });
     return true;
   }
   const opts = r.data.invocationOverride !== void 0 ? { invocationOverride: r.data.invocationOverride } : void 0;
@@ -8887,9 +9443,9 @@ async function handleTrace(req, res, deps) {
       r.data.useCase,
       opts
     );
-    sendJSON9(res, 200, { decision, def: { type: def.type } });
+    sendJSON11(res, 200, { decision, def: { type: def.type } });
   } catch (err) {
-    sendJSON9(res, 500, { error: String(err) });
+    sendJSON11(res, 500, { error: String(err) });
   }
   return true;
 }
@@ -9130,7 +9686,7 @@ var CreateBodySchema = z16.object({
   tenantId: z16.string().optional(),
   expiresAt: z16.string().datetime().optional()
 });
-function sendJSON10(res, status, body) {
+function sendJSON12(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
@@ -9140,19 +9696,19 @@ async function handlePost(req, res, store) {
     raw = await readBody(req);
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Failed to read body";
-    sendJSON10(res, 413, { error: msg });
+    sendJSON12(res, 413, { error: msg });
     return;
   }
   let json;
   try {
     json = JSON.parse(raw);
   } catch {
-    sendJSON10(res, 400, { error: "Invalid JSON body" });
+    sendJSON12(res, 400, { error: "Invalid JSON body" });
     return;
   }
   const parsed = CreateBodySchema.safeParse(json);
   if (!parsed.success) {
-    sendJSON10(res, 422, { error: "Invalid body", issues: parsed.error.issues });
+    sendJSON12(res, 422, { error: "Invalid body", issues: parsed.error.issues });
     return;
   }
   try {
@@ -9165,37 +9721,37 @@ async function handlePost(req, res, store) {
     if (parsed.data.expiresAt !== void 0) input.expiresAt = parsed.data.expiresAt;
     const result = await store.create(input);
     const publicRecord = AuthTokenPublicSchema.parse(result.record);
-    sendJSON10(res, 200, {
+    sendJSON12(res, 200, {
       ...publicRecord,
       token: result.token
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Failed to create token";
     if (msg.includes("already exists")) {
-      sendJSON10(res, 409, { error: msg });
+      sendJSON12(res, 409, { error: msg });
       return;
     }
-    sendJSON10(res, 500, { error: "Internal error creating token" });
+    sendJSON12(res, 500, { error: "Internal error creating token" });
   }
 }
 async function handleList3(res, store) {
   try {
     const list = await store.list();
-    sendJSON10(res, 200, list);
+    sendJSON12(res, 200, list);
   } catch {
-    sendJSON10(res, 500, { error: "Internal error listing tokens" });
+    sendJSON12(res, 500, { error: "Internal error listing tokens" });
   }
 }
 async function handleDelete2(res, store, id) {
   try {
     const ok = await store.revoke(id);
     if (!ok) {
-      sendJSON10(res, 404, { error: "Token not found" });
+      sendJSON12(res, 404, { error: "Token not found" });
       return;
     }
-    sendJSON10(res, 200, { deleted: true });
+    sendJSON12(res, 200, { deleted: true });
   } catch {
-    sendJSON10(res, 500, { error: "Internal error revoking token" });
+    sendJSON12(res, 500, { error: "Internal error revoking token" });
   }
 }
 var DELETE_PATH_RE2 = /^\/api\/v1\/auth\/tokens\/([^/?]+)(?:\?.*)?$/;
@@ -9220,12 +9776,12 @@ function handleAuthRoute(req, res, store) {
       return true;
     }
   }
-  sendJSON10(res, 405, { error: "Method not allowed" });
+  sendJSON12(res, 405, { error: "Method not allowed" });
   return true;
 }
 
 // src/server/routes/local-model.ts
-function sendJSON11(res, status, body) {
+function sendJSON13(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
@@ -9233,30 +9789,30 @@ function handleLocalModelRoute(req, res, getStatus) {
   const { method, url } = req;
   if (url !== "/api/v1/local-model/status") return false;
   if (method !== "GET") {
-    sendJSON11(res, 405, { error: "Method not allowed" });
+    sendJSON13(res, 405, { error: "Method not allowed" });
     return true;
   }
   if (!getStatus) {
-    sendJSON11(res, 503, { error: "Local backend not configured" });
+    sendJSON13(res, 503, { error: "Local backend not configured" });
     return true;
   }
   const status = getStatus();
   if (!status) {
-    sendJSON11(res, 503, { error: "Local backend not configured" });
+    sendJSON13(res, 503, { error: "Local backend not configured" });
     return true;
   }
-  sendJSON11(res, 200, status);
+  sendJSON13(res, 200, status);
   return true;
 }
 function handleLocalModelsRoute(req, res, getStatuses) {
   const { method, url } = req;
   if (url !== "/api/v1/local-models/status") return false;
   if (method !== "GET") {
-    sendJSON11(res, 405, { error: "Method not allowed" });
+    sendJSON13(res, 405, { error: "Method not allowed" });
     return true;
   }
   const statuses = getStatuses ? getStatuses() : [];
-  sendJSON11(res, 200, statuses);
+  sendJSON13(res, 200, statuses);
   return true;
 }
 
@@ -9623,6 +10179,60 @@ var V1_BRIDGE_ROUTES = [
     scope: "read-telemetry",
     description: "Prompt-cache hit/miss snapshot (rolling window)."
   },
+  // ── LMLM Phase 6 — force-refresh (background scheduler tick, out of band) ──
+  // Reuses `manage-proposals`: a forced refresh emits model proposals, so the
+  // same write scope that governs approve/reject governs triggering the tick.
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/local-models\/refresh(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Force a background-scheduler refresh tick and return emitted proposals (O4)."
+  },
+  // ── LMLM dashboard pool mutation — operator-initiated install/remove ──
+  // Modeled as auto-approved model proposals, so the same `manage-proposals`
+  // write scope that governs approve/reject governs these too.
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/local-models\/pool\/install(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Install a recommended model into the local pool (auto-approved proposal)."
+  },
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/local-models\/pool\/remove(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Remove a model from the local pool (auto-approved proposal)."
+  },
+  // ── LMLM Phase 7 — read surface (hardware/pool/recommendations/proposals) ──
+  // Load-bearing: `local-models` is in `V1_WRAPPABLE`, so without these entries
+  // the `/api/v1` rewrite shim would rewrite `/api/v1/local-models/<name>` →
+  // `/api/local-models/<name>` and misroute it to the legacy status handler.
+  // `isV1Bridge` short-circuits the rewrite; `requiredBridgeScope` supplies the
+  // default-deny read scope. All four are read-only observability (`read-status`).
+  {
+    method: "GET",
+    pattern: /^\/api\/v1\/local-models\/hardware(?:\?.*)?$/,
+    scope: "read-status",
+    description: "Current detected HardwareProfile (RAM/VRAM/GPU)."
+  },
+  {
+    method: "GET",
+    pattern: /^\/api\/v1\/local-models\/pool(?:\?.*)?$/,
+    scope: "read-status",
+    description: "Live PoolState view, including transient pendingEviction flags."
+  },
+  {
+    method: "GET",
+    pattern: /^\/api\/v1\/local-models\/recommendations(?:\?.*)?$/,
+    scope: "read-status",
+    description: "Hardware-ranked model recommendations (top/profile query params)."
+  },
+  {
+    method: "GET",
+    pattern: /^\/api\/v1\/local-models\/proposals(?:\?.*)?$/,
+    scope: "read-status",
+    description: "Open model-kind proposals (pending review queue)."
+  },
   // ── Spec B Phase 5 routing observability ──
   // D-OP-1: all three reuse `read-telemetry` — matches the cacheMetrics
   // precedent (read-only observability). A dedicated `read-routing`
@@ -9765,7 +10375,19 @@ var OrchestratorServer = class {
   getRoutingDecisionBusFn = null;
   getRoutingConfigFn = null;
   getBackendsFn = null;
+  // LMLM Phase 6 — live model pool + refresh scheduler accessors.
+  getModelPoolFn = null;
+  getRefreshSchedulerFn = null;
+  // LMLM Phase 7 — hardware / recommendations / model-proposal read accessors.
+  getHardwareProfileFn = null;
+  getRecommendationsFn = null;
+  listModelProposalsFn = null;
+  // LMLM Phase 7 / S1 — in-use probe threaded into kind:'model' approve.
+  isModelInUseFn = null;
   routingDecisionUnsubscribe = null;
+  // LMLM Phase 7 — bus→WS fan-out listeners for the model proposal/pool topics.
+  modelProposalListener = null;
+  modelPoolListener = null;
   recorder = null;
   planWatcher = null;
   tokenStore;
@@ -9810,6 +10432,12 @@ var OrchestratorServer = class {
     this.getRoutingDecisionBusFn = deps?.getRoutingDecisionBus ?? null;
     this.getRoutingConfigFn = deps?.getRoutingConfig ?? null;
     this.getBackendsFn = deps?.getBackends ?? null;
+    this.getModelPoolFn = deps?.getModelPool ?? null;
+    this.getRefreshSchedulerFn = deps?.getRefreshScheduler ?? null;
+    this.getHardwareProfileFn = deps?.getHardwareProfile ?? null;
+    this.getRecommendationsFn = deps?.getRecommendations ?? null;
+    this.listModelProposalsFn = deps?.listModelProposals ?? null;
+    this.isModelInUseFn = deps?.isModelInUse ?? null;
   }
   wireEvents() {
     this.stateChangeListener = (snapshot) => {
@@ -9826,6 +10454,10 @@ var OrchestratorServer = class {
         this.broadcaster.broadcast("routing:decision", decision);
       });
     }
+    this.modelProposalListener = (data) => this.broadcaster.broadcast(MODEL_PROPOSAL_TOPIC, data);
+    this.modelPoolListener = (data) => this.broadcaster.broadcast(MODEL_POOL_TOPIC, data);
+    this.orchestrator.on(MODEL_PROPOSAL_TOPIC, this.modelProposalListener);
+    this.orchestrator.on(MODEL_POOL_TOPIC, this.modelPoolListener);
   }
   /**
    * Broadcast a new interaction to all WebSocket clients.
@@ -9994,9 +10626,38 @@ var OrchestratorServer = class {
       // upstream by V1_BRIDGE_ROUTES; this dispatcher only handles
       // business logic. `projectPath` defaults to process.cwd() — that is
       // where `.harness/proposals/` lives in every deployment we ship.
-      (req, res) => handleV1ProposalsRoute(req, res, {
+      (req, res) => {
+        const modelPool = this.getModelPoolFn?.() ?? null;
+        return handleV1ProposalsRoute(req, res, {
+          projectPath: this.projectPath,
+          bus: this.orchestrator,
+          ...modelPool ? { modelPool } : {},
+          // S1: thread the in-use probe so an approved swap/evict of a model an
+          // agent could be using is deferred (marked pendingEviction) not applied.
+          ...this.isModelInUseFn ? { isModelInUse: this.isModelInUseFn } : {}
+        });
+      },
+      // LMLM dashboard pool mutation — POST /pool/install + /pool/remove.
+      // Operator-initiated install/remove via auto-approved proposals; reuses
+      // the same mutation pool + bus + in-use probe the proposals route uses.
+      // Registered before the read surface so /pool/install|remove match first.
+      (req, res) => handleV1LocalModelsMutationRoute(req, res, {
         projectPath: this.projectPath,
-        bus: this.orchestrator
+        bus: this.orchestrator,
+        getModelPool: () => this.getModelPoolFn?.() ?? null,
+        ...this.getRecommendationsFn ? { getRecommendations: this.getRecommendationsFn } : {},
+        ...this.isModelInUseFn ? { isModelInUse: this.isModelInUseFn } : {}
+      }),
+      // LMLM Phase 6/7 — POST /refresh + the GET read surface
+      // (hardware/pool/recommendations/proposals). Registered before the
+      // chat-proxy fallback so it owns the path. Each accessor is spread in
+      // only when configured so absent ones surface as 503 (LMLM disabled).
+      (req, res) => handleV1LocalModelsRoute(req, res, {
+        getRefreshScheduler: this.getRefreshSchedulerFn ?? (() => null),
+        getModelPool: () => this.getModelPoolFn?.() ?? null,
+        ...this.getHardwareProfileFn ? { getHardwareProfile: this.getHardwareProfileFn } : {},
+        ...this.getRecommendationsFn ? { getRecommendations: this.getRecommendationsFn } : {},
+        ...this.listModelProposalsFn ? { listModelProposals: this.listModelProposalsFn } : {}
       }),
       // Chat proxy route (spawns Claude Code CLI — no API key required)
       (req, res) => handleChatProxyRoute(req, res, this.claudeCommand)
@@ -10100,6 +10761,14 @@ var OrchestratorServer = class {
       this.routingDecisionUnsubscribe();
       this.routingDecisionUnsubscribe = null;
     }
+    if (this.modelProposalListener) {
+      this.orchestrator.removeListener(MODEL_PROPOSAL_TOPIC, this.modelProposalListener);
+      this.modelProposalListener = null;
+    }
+    if (this.modelPoolListener) {
+      this.orchestrator.removeListener(MODEL_POOL_TOPIC, this.modelPoolListener);
+      this.modelPoolListener = null;
+    }
     if (this.planWatcher) {
       this.planWatcher.stop();
       this.planWatcher = null;
@@ -11015,8 +11684,50 @@ var ENVELOPE_DERIVERS = {
       summary: truncate(data.reason ?? "No reason provided.", 240),
       severity: "warning"
     };
-  }
+  },
+  // LMLM Phase 7 — model-proposal lifecycle. Delegated to a status-keyed
+  // lookup (below) so each status branch is its own small function and the
+  // deriver stays under the cyclomatic-complexity gate.
+  "local-models.proposal": (event) => deriveModelProposalEnvelope(event)
+};
+var MODEL_PROPOSAL_ENVELOPES = {
+  created: (data) => {
+    const label = `${data.action ?? "change"} ${data.target ?? "(unknown model)"}`;
+    return {
+      title: `New model proposal: ${label}`,
+      summary: `A model proposal (${label}) is awaiting review.`,
+      severity: "info"
+    };
+  },
+  approved: (data) => {
+    const label = `${data.action ?? "change"} ${data.target ?? "(unknown model)"}`;
+    return {
+      title: `Model proposal approved: ${label}`,
+      summary: `The model proposal (${label}) was approved and applied to the pool.`,
+      severity: "success"
+    };
+  },
+  rejected: (data) => ({
+    title: "Model proposal rejected",
+    summary: truncate(data.reason ?? "No reason provided.", 240),
+    severity: "warning"
+  }),
+  failed_target_missing: (data) => ({
+    title: "Model proposal target missing",
+    summary: `The proposed model ${data.target ?? "(unknown model)"} is no longer available; the proposal was closed.`,
+    severity: "error"
+  })
 };
+function deriveModelProposalEnvelope(event) {
+  const data = asObj(event.data);
+  const build = MODEL_PROPOSAL_ENVELOPES[data.status ?? ""];
+  if (build) return build(data);
+  return {
+    title: `Model proposal update: ${data.target ?? "(unknown model)"}`,
+    summary: `Model proposal status: ${data.status ?? "(unknown)"}.`,
+    severity: "info"
+  };
+}
 function truncate(s, max) {
   return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
 }
@@ -11063,7 +11774,9 @@ var NOTIFICATION_TOPICS = [
   // Hermes Phase 4 — skill proposal lifecycle.
   "proposal.created",
   "proposal.approved",
-  "proposal.rejected"
+  "proposal.rejected",
+  // LMLM Phase 7 — model-proposal lifecycle (colon→dot ⇒ 'local-models.proposal').
+  "local-models:proposal"
 ];
 function newEventId3() {
   return `evt_${randomBytes7(8).toString("hex")}`;
@@ -13156,6 +13869,45 @@ var Orchestrator = class extends EventEmitter {
    * so this map is the single source of truth post-migration.
    */
   localResolvers = /* @__PURE__ */ new Map();
+  /** Phase 4 (D5): pool-state port shared by all local/pi resolvers. Null when LMLM disabled. */
+  poolStateProvider = null;
+  poolStateStore = null;
+  /**
+   * LMLM Phase 6: live model pool + its installer. Constructed only when
+   * `localModels.enabled` and a real `PoolStateStore` exists (not a test
+   * override). Exposed to the server via `getModelPool()`, which retires the
+   * proposals-route 501 stub for `kind: 'model'` approve/reject. Null when LMLM
+   * is disabled. `PoolManager` reads `store.snapshot()` lazily, so constructing
+   * before `store.load()` (in initLocalModelAndPipeline) is safe.
+   */
+  modelPool = null;
+  modelInstaller = null;
+  /**
+   * S1 drain re-entrancy guard (P7-SUG-DRAIN-REENTRANCY). `drainDeferredEvictions`
+   * is fired fire-and-forget from `emitWorkerExit` (and, since P7-SUG-DRAIN-LIVENESS,
+   * piggybacked on each refresh tick). Two overlapping drains would both read the
+   * same `listPendingEvictions()` snapshot, both re-check `isLocalModelInUse`, and
+   * both `await pool.evict` the SAME name — double-calling the installer and
+   * broadcasting a duplicate `evict_completed` frame. The single-threaded event
+   * loop makes a plain boolean sufficient: a drain that arrives while one is
+   * running returns early rather than double-processing.
+   */
+  draining = false;
+  /**
+   * LMLM Phase 6: single per-instance background refresh scheduler. Started in
+   * `initLocalModelAndPipeline` when the pool exists; stopped in `stop()`. Null
+   * when LMLM is disabled. Exposed to the server via `getRefreshScheduler()`.
+   */
+  refreshScheduler = null;
+  /**
+   * LMLM Phase 7: the hardware-aware recommender bound at scheduler start. Reused
+   * by `GET /api/v1/local-models/recommendations`. Null when LMLM is disabled (no
+   * pool → scheduler never armed). Ranks the (currently empty) candidate set —
+   * see the Phase 2 candidate-parser gap noted on `startRefreshScheduler`.
+   */
+  modelRecommender = null;
+  /** Test seam: injected timer/clock for the scheduler so no real 24h timer runs. */
+  schedulerTimerOverride;
   /**
    * Spec B Phase 3: skill catalog (name + cognitiveMode) read once at
    * construction from `projectRoot/agents/skills/`. Consulted by
@@ -13246,6 +13998,7 @@ var Orchestrator = class extends EventEmitter {
    */
   constructor(config, promptTemplate, overrides) {
     super();
+    this.schedulerTimerOverride = overrides?.schedulerTimer ?? null;
     this.setMaxListeners(50);
     this.config = config;
     this.promptTemplate = promptTemplate;
@@ -13293,6 +14046,16 @@ var Orchestrator = class extends EventEmitter {
       this
     );
     this.analysisArchive = new AnalysisArchive(path21.join(config.workspace.root, "..", "analyses"));
+    const localModelsEnabled = this.config.localModels?.enabled === true;
+    if (overrides?.poolState) {
+      this.poolStateProvider = overrides.poolState;
+    } else if (localModelsEnabled) {
+      this.poolStateStore = new PoolStateStore({
+        onWarn: (message, cause) => this.logger.warn(message, cause !== void 0 ? { cause } : void 0)
+      });
+      this.poolStateProvider = this.poolStateStore;
+      this.initModelPool(this.poolStateStore);
+    }
     const backendsMap = this.config.agent.backends ?? {};
     for (const [name, def] of Object.entries(backendsMap)) {
       if (def.type === "local" || def.type === "pi") {
@@ -13303,6 +14066,7 @@ var Orchestrator = class extends EventEmitter {
         };
         if (def.apiKey !== void 0) resolverOpts.apiKey = def.apiKey;
         if (def.probeIntervalMs !== void 0) resolverOpts.probeIntervalMs = def.probeIntervalMs;
+        if (this.poolStateProvider !== null) resolverOpts.poolState = this.poolStateProvider;
         this.localResolvers.set(name, new LocalModelResolver(resolverOpts));
       }
     }
@@ -13414,7 +14178,26 @@ var Orchestrator = class extends EventEmitter {
         roadmapPath: config.tracker.filePath ?? null,
         dispatchAdHoc: this.dispatchAdHoc.bind(this),
         getLocalModelStatus: () => this.getFirstLocalModelStatus(),
-        getLocalModelStatuses: () => this.buildLocalModelStatuses()
+        getLocalModelStatuses: () => this.buildLocalModelStatuses(),
+        // LMLM Phase 6: expose the live pool so kind:'model' approve/reject
+        // reaches PoolManager (retiring the 501). Null when LMLM is disabled.
+        getModelPool: () => this.modelPool,
+        // LMLM Phase 7 / S1: conservative in-use probe so an approved swap/evict
+        // of a model an agent could be using is DEFERRED, not applied mid-request
+        // (ADR 0060). Agent-run-coarse; may over-defer (safe).
+        isModelInUse: (ollamaName) => this.isLocalModelInUse(ollamaName),
+        // LMLM Phase 6: expose the refresh scheduler for POST /local-models/refresh.
+        getRefreshScheduler: () => this.refreshScheduler,
+        // LMLM Phase 7 read surface — hardware / recommendations / model proposals.
+        // Each returns null/[] when LMLM is disabled so the route renders 503/[].
+        getHardwareProfile: () => this.modelPool ? this.detectLmlmHardware() : null,
+        getRecommendations: async ({ top }) => {
+          if (this.modelRecommender === null) return [];
+          const hardware = await this.detectLmlmHardware();
+          const { ranked } = await this.modelRecommender(hardware);
+          return ranked.slice(0, top);
+        },
+        listModelProposals: () => listProposals2(this.projectRoot, { status: "open", kind: "model" })
       });
       this.server.setRecorder(this.recorder);
       this.interactionQueue.onPush((interaction) => {
@@ -13472,6 +14255,60 @@ var Orchestrator = class extends EventEmitter {
     }
     return out;
   }
+  /**
+   * S1 conservative in-use probe (ADR 0060). Returns `true` when ANY agent run
+   * is live AND `ollamaName` is a currently-resolved (or last-detected) local
+   * model — i.e. an agent could be routing inference to it right now.
+   *
+   * This signal is AGENT-RUN-COARSE, not per-request: `state.running` is keyed
+   * by GitHub issue (spawned agent runs), NOT by inference call, and no
+   * per-model request counter exists today. The probe therefore MAY OVER-DEFER
+   * (a swap waits until the pool is idle). Over-deferral is exactly S1's
+   * intended safe failure — never yank a model mid-request; occasionally wait
+   * longer than strictly necessary. A fine-grained per-request signal is an
+   * explicit deferred gap (ADR 0060).
+   */
+  isLocalModelInUse(ollamaName) {
+    if (this.state.running.size === 0) return false;
+    return this.buildLocalModelStatuses().some(
+      (s) => s.resolved === ollamaName || s.detected.includes(ollamaName)
+    );
+  }
+  /**
+   * S1 drain (ADR 0060): complete any eviction that was DEFERRED because its
+   * target was in use, now that the probe reports it idle. Best-effort — called
+   * from the run-completion path; it never blocks dispatch and swallows
+   * per-model errors (a failed or still-busy evict stays pending for the next
+   * drain). `pendingEviction` is a transient overlay, so a missed drain simply
+   * leaves the flag set until the next completion re-checks it.
+   */
+  async drainDeferredEvictions() {
+    const pool = this.modelPool;
+    if (pool === null) return;
+    if (this.draining) return;
+    this.draining = true;
+    try {
+      for (const ollamaName of pool.listPendingEvictions()) {
+        if (this.isLocalModelInUse(ollamaName)) continue;
+        try {
+          const result = await pool.evict({ ollamaName });
+          if (result.status === "error") continue;
+          pool.clearPendingEviction(ollamaName);
+          this.emit("local-models:pool", {
+            action: "evict",
+            // XP-2: `evicted` is uniformly string[] across all local-models:pool
+            // emit sites — the drain wraps its single completed eviction in an
+            // array to match the swap/add multi-evict shape.
+            evicted: [ollamaName],
+            phase: "evict_completed"
+          });
+        } catch {
+        }
+      }
+    } finally {
+      this.draining = false;
+    }
+  }
   createTracker() {
     if (this.config.tracker.kind === "github-issues") {
       const trackerCfg = {
@@ -14318,6 +15155,7 @@ ${messages}`);
       error,
       (effect) => this.handleEffect(effect)
     );
+    void this.drainDeferredEvictions();
     this.emit("state_change", this.getSnapshot());
   }
   /**
@@ -14405,6 +15243,120 @@ ${messages}`);
    * before constructing the intelligence pipeline. Subscribes the dashboard
    * broadcast stub to status changes. Called exactly once from start().
    */
+  /**
+   * LMLM Phase 6: construct the live `PoolManager` (Ollama installer + the
+   * loaded pool-state store) and stash it for `getModelPool()`. Defensive
+   * config fallbacks: `ollamaEndpoint → http://localhost:11434`. The pool reads
+   * `store.snapshot()` lazily, so this runs safely at construction time before
+   * `store.load()`.
+   */
+  initModelPool(store) {
+    const onWarn = (message, cause) => this.logger.warn(message, cause !== void 0 ? { cause } : void 0);
+    const installerCfg = this.config.localModels?.installer;
+    this.modelInstaller = new OllamaInstallAdapter({
+      baseUrl: installerCfg?.ollamaEndpoint ?? "http://localhost:11434",
+      onWarn
+    });
+    this.modelPool = new PoolManager({ store, installer: this.modelInstaller, onWarn });
+  }
+  /**
+   * LMLM Phase 7 wiring: apply the operator's configured pool bounds (disk
+   * budget + org/family allowlist) from `localModels.pool` to the live pool.
+   * Called after `PoolStateStore.load()` so config wins over persisted bounds
+   * (D2, declarative precedence). No-op when the pool is null (LMLM disabled)
+   * or no `pool` block is configured, so it is safe to call unconditionally
+   * on the startup path.
+   */
+  async applyConfiguredPoolBounds() {
+    const pool = this.modelPool;
+    const bounds = this.config.localModels?.pool;
+    if (pool === null || !bounds) return;
+    await pool.configurePool({
+      diskBudgetGb: bounds.diskBudgetGb,
+      allowedOrgs: bounds.allowedOrgs,
+      allowedFamilies: bounds.allowedFamilies
+    });
+  }
+  /**
+   * LMLM Phase 6: arm the single background refresh scheduler over the live
+   * pool. No-op when LMLM is disabled (`modelPool` null). Each tick runs
+   * hardware→recommend→reconcile(D12 drift)→diff→emit→score-writeback.
+   *
+   * NOTE (deferred): the recommender is seeded with an empty candidate set —
+   * Phase 2's live-HF→RankerCandidate parser was never built, so autonomous
+   * swap-proposal discovery is out of scope here (flagged concern). The tick
+   * still performs F10 drift reconciliation, O1 logging, and re-ranks/dedups
+   * whatever candidates are supplied — the wiring is complete and candidate
+   * breadth is the only piece deferred to the Phase 2 recommender.
+   */
+  startRefreshScheduler() {
+    if (this.modelPool === null) return;
+    const pool = this.modelPool;
+    const refreshCfg = this.config.localModels?.refresh;
+    const frozen = loadFrozenCandidates();
+    const candidates = selectCandidates2(frozen.candidates, this.config.localModels?.pool);
+    for (const warning of frozen.warnings) {
+      this.logger.warn("LMLM frozen candidate snapshot degraded", { warning });
+    }
+    if (candidates.length === 0) {
+      this.logger.warn("LMLM recommender has no candidates", {
+        frozenCount: frozen.candidates.length,
+        allowedOrgs: this.config.localModels?.pool?.allowedOrgs ?? []
+      });
+    }
+    const recommend = createNativeRecommender({ candidates });
+    this.modelRecommender = recommend;
+    this.refreshScheduler = new RefreshScheduler({
+      runTick: () => runRefreshTick({
+        detectHardware: () => this.detectLmlmHardware(),
+        recommend,
+        poolManager: pool,
+        dedupSource: () => this.lmlmDedupSource(),
+        // Phase 7: after persisting the proposal, emit `local-models:proposal`
+        // (== MODEL_PROPOSAL_TOPIC) on the bus so it fans out to WS clients and
+        // notification sinks. Literal to avoid a proposals/model-handlers cycle.
+        emitProposal: (c) => createModelProposal2(this.projectRoot, c).then((record) => {
+          this.emit("local-models:proposal", {
+            id: record.id,
+            status: "created",
+            action: c.action,
+            target: c.target.ollamaName
+          });
+        }),
+        proposalThreshold: refreshCfg?.proposalThreshold ?? 5
+      }).then((result) => {
+        void this.drainDeferredEvictions();
+        return result;
+      }),
+      intervalMs: refreshCfg?.intervalMs ?? 864e5,
+      jitterMs: refreshCfg?.jitterMs ?? 6e5,
+      logger: this.logger,
+      ...this.schedulerTimerOverride ?? {}
+    });
+    this.refreshScheduler.start();
+  }
+  /** Resolve the hardware profile for a refresh tick (operator override wins). */
+  async detectLmlmHardware() {
+    const override = this.config.localModels?.hardware?.override;
+    const detector = new HardwareDetector(override !== void 0 ? { override } : {});
+    return (await detector.detect()).profile;
+  }
+  /** Map the on-disk model-proposal queue to F7 dedup pairs (open→pending, rejected→rejected). */
+  async lmlmDedupSource() {
+    const proposals = await listProposals2(this.projectRoot, { kind: "model" });
+    const pending = [];
+    const rejected = [];
+    for (const p of proposals) {
+      if (p.kind !== "model") continue;
+      const pair = {
+        target: p.model.target.ollamaName,
+        ...p.model.replaces ? { replaces: p.model.replaces.ollamaName } : {}
+      };
+      if (p.status === "open") pending.push(pair);
+      else if (p.status === "rejected") rejected.push(pair);
+    }
+    return { pending, rejected };
+  }
   async initLocalModelAndPipeline() {
     if (this.localResolvers.size > 0) {
       const backends = this.config.agent.backends ?? {};
@@ -14427,10 +15379,15 @@ ${messages}`);
         });
         this.localModelStatusUnsubscribes.push(unsubscribe);
       }
+      if (this.poolStateStore !== null) {
+        await this.poolStateStore.load();
+        await this.applyConfiguredPoolBounds();
+      }
       for (const resolver of this.localResolvers.values()) {
         await resolver.start();
       }
     }
+    this.startRefreshScheduler();
     this.pipeline = this.createIntelligencePipeline();
     this.server?.setPipeline(this.pipeline);
   }
@@ -14506,6 +15463,8 @@ ${messages}`);
     for (const resolver of this.localResolvers.values()) {
       resolver.stop();
     }
+    this.refreshScheduler?.stop();
+    this.refreshScheduler = null;
     if (this.maintenanceScheduler) {
       this.maintenanceScheduler.stop();
       this.maintenanceScheduler = null;