@miller-tech/uap 2.11.0 → 2.16.2

package/dist/self-tuning/profiles/qwen38.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qwen38.d.ts","sourceRoot":"","sources":["../../../src/self-tuning/profiles/qwen38.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,cAAc,EAAE,UAwB5B,CAAC"}
+{"version":3,"file":"qwen38.d.ts","sourceRoot":"","sources":["../../../src/self-tuning/profiles/qwen38.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,cAAc,EAAE,UAyB5B,CAAC"}

package/dist/self-tuning/profiles/qwen38.js

@@ -3,14 +3,23 @@
  * raises toward Opus (successor to the qwen3.6-a3b seed in qwen36.ts).
  *
  * Carried over from QWEN36_PROFILE unchanged EXCEPT for concurrency, which is
- * not a preference here but a property of the server: this model is served by
- * `ninfer-serve --max-concurrency 1 --max-pending-requests 16`. There is ONE
- * rail. Requesting 4 slots does not get 4 in flight — it gets one running and
- * three queued behind it, so the extra slots buy latency and a longer wedge
- * window rather than throughput, and the adaptive controller then reads the
- * queueing delay as backpressure and throttles a server that was never
- * saturated. The qwen36 value of 4 was correct for llama.cpp `--parallel`; it
- * is wrong for this engine.
+ * not a preference here but a property of the server.
+ *
+ * CORRECTED 2026-09-21. This header said the model was served by
+ * `ninfer-serve --max-concurrency 1` and that there was ONE rail. That engine
+ * is not what runs: the backend is buun-llama-cpp behind
+ * uap-gsq-rco-server.service with `-np 2`, and the proxy was raised to match
+ * (PROXY_CONCURRENCY_LIMIT / UAP_MODEL_SLOTS / PROXY_SESSION_ADMISSION_LIMIT
+ * all 2). The reasoning below still holds, only the number changed: slots must
+ * track what the server and proxy will actually run in parallel. Declaring
+ * MORE than that does not get more in flight — it gets one running and the
+ * rest queued, the extra slots buy latency and a longer wedge window rather
+ * than throughput, and the adaptive controller then reads the queueing delay
+ * as backpressure and throttles a server that was never saturated.
+ *
+ * Whether the second rail EARNS anything is a separate question from whether
+ * it exists: check llamacpp:n_busy_slots_per_decode in /metrics (>1 means
+ * requests genuinely overlapped), or `uap inference health`.
  *
  * Everything else is deliberately identical to the qwen36 seed: nothing has
  * been re-measured on 3.8 yet, and the tuning loop's job is to beat this seed,
@@ -29,9 +38,10 @@ export const QWEN38_PROFILE = {
     'handsfree.enabled': true,
     'handsfree.intensity': 'aggressive',
     UAP_HANDSFREE_STAGNATION_LIMIT: 6,
-    // Concurrency: ONE rail (see the header). Adaptive stays on so a genuinely
-    // overloaded server still backs off.
-    'modelConcurrency.slots': 1,
+    // Concurrency: TWO rails (see the header) — matches `-np 2` on the server
+    // and the proxy's concurrency/admission limits. Adaptive stays on so a
+    // genuinely overloaded server still backs off.
+    'modelConcurrency.slots': 2,
     'modelConcurrency.adaptive': true,
     // Memory: bigger short-term window + pattern RAG compensate for weak planning.
     'memory.shortTerm.maxEntries': 80,

package/dist/self-tuning/profiles/qwen38.js.map

@@ -1 +1 @@
-{"version":3,"file":"qwen38.js","sourceRoot":"","sources":["../../../src/self-tuning/profiles/qwen38.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,yEAAyE;IACzE,iBAAiB,EAAE,IAAI;IACvB,gBAAgB,EAAE,QAAQ;IAC1B,6BAA6B,EAAE,GAAG;IAClC,iBAAiB,EAAE,CAAC;IACpB,wBAAwB,EAAE,KAAK;IAC/B,yEAAyE;IACzE,mBAAmB,EAAE,IAAI;IACzB,qBAAqB,EAAE,YAAY;IACnC,8BAA8B,EAAE,CAAC;IACjC,2EAA2E;IAC3E,qCAAqC;IACrC,wBAAwB,EAAE,CAAC;IAC3B,2BAA2B,EAAE,IAAI;IACjC,+EAA+E;IAC/E,6BAA6B,EAAE,EAAE;IACjC,2BAA2B,EAAE,IAAI;IACjC,uEAAuE;IACvE,wBAAwB,EAAE,IAAI;IAC9B,kEAAkE;IAClE,iCAAiC,EAAE,EAAE;IACrC,kBAAkB,EAAE,IAAI;IACxB,iBAAiB,EAAE,IAAI;CACxB,CAAC"}
+{"version":3,"file":"qwen38.js","sourceRoot":"","sources":["../../../src/self-tuning/profiles/qwen38.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,yEAAyE;IACzE,iBAAiB,EAAE,IAAI;IACvB,gBAAgB,EAAE,QAAQ;IAC1B,6BAA6B,EAAE,GAAG;IAClC,iBAAiB,EAAE,CAAC;IACpB,wBAAwB,EAAE,KAAK;IAC/B,yEAAyE;IACzE,mBAAmB,EAAE,IAAI;IACzB,qBAAqB,EAAE,YAAY;IACnC,8BAA8B,EAAE,CAAC;IACjC,0EAA0E;IAC1E,uEAAuE;IACvE,+CAA+C;IAC/C,wBAAwB,EAAE,CAAC;IAC3B,2BAA2B,EAAE,IAAI;IACjC,+EAA+E;IAC/E,6BAA6B,EAAE,EAAE;IACjC,2BAA2B,EAAE,IAAI;IACjC,uEAAuE;IACvE,wBAAwB,EAAE,IAAI;IAC9B,kEAAkE;IAClE,iCAAiC,EAAE,EAAE;IACrC,kBAAkB,EAAE,IAAI;IACxB,iBAAiB,EAAE,IAAI;CACxB,CAAC"}

package/dist/utils/model-slots.d.ts

@@ -14,13 +14,19 @@ export declare function configuredSlots(cwd?: string): number | undefined;
  *   - the endpoint is unreachable        -> we know nothing; 2 is a fair guess
  *   - the endpoint answered 404/405      -> this is NOT llama.cpp
  *
- * The second case is now the normal one here: the local backend is ninfer-serve
- * (`--max-concurrency 1`), which serves no `/slots` at all. Guessing 2 against a
- * server that runs ONE request and queues the rest does not double throughput —
- * it puts a second request in a queue and then lets the adaptive controller read
- * the queueing delay as backpressure on a server that was never saturated.
+ * A server that ANSWERS 404/405 is telling us something: it is not llama.cpp,
+ * and engines without a `--parallel` equivalent typically run one request and
+ * queue the rest. Guessing 2 there does not double throughput — it puts a
+ * second request in a queue and then lets the adaptive controller read the
+ * queueing delay as backpressure on a server that was never saturated.
  *
  * So a live server that denies knowing about `/slots` reports 1, not "unknown".
+ *
+ * NOTE (2026-09-21): this used to cite the local backend as the motivating
+ * example — "ninfer-serve, which serves no /slots at all". That is no longer
+ * the case: the local backend is buun-llama-cpp and /slots answers with two
+ * rails, so the 404 branch is now the FOREIGN-engine path, not the normal one.
+ * The logic is unchanged and still correct; only the example was stale.
  */
 export declare function probeSlots(base: string, timeoutMs?: number): Promise<number | null>;
 /**

package/dist/utils/model-slots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-slots.d.ts","sourceRoot":"","sources":["../../src/utils/model-slots.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,aAAa,IAAI,CAAC;AAY/B,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAoBlE,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAclD;AAED,wBAAgB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBvF;AAMD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,CAAC,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CA6BlE;AAED,gEAAgE;AAChE,wBAAsB,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAK3D;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}
+{"version":3,"file":"model-slots.d.ts","sourceRoot":"","sources":["../../src/utils/model-slots.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,aAAa,IAAI,CAAC;AAY/B,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAoBlE,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAclD;AAED,wBAAgB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBvF;AAMD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,CAAC,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CA6BlE;AAED,gEAAgE;AAChE,wBAAsB,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAK3D;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/dist/utils/model-slots.js

@@ -63,13 +63,19 @@ export function configuredSlots(cwd) {
  *   - the endpoint is unreachable        -> we know nothing; 2 is a fair guess
  *   - the endpoint answered 404/405      -> this is NOT llama.cpp
  *
- * The second case is now the normal one here: the local backend is ninfer-serve
- * (`--max-concurrency 1`), which serves no `/slots` at all. Guessing 2 against a
- * server that runs ONE request and queues the rest does not double throughput —
- * it puts a second request in a queue and then lets the adaptive controller read
- * the queueing delay as backpressure on a server that was never saturated.
+ * A server that ANSWERS 404/405 is telling us something: it is not llama.cpp,
+ * and engines without a `--parallel` equivalent typically run one request and
+ * queue the rest. Guessing 2 there does not double throughput — it puts a
+ * second request in a queue and then lets the adaptive controller read the
+ * queueing delay as backpressure on a server that was never saturated.
  *
  * So a live server that denies knowing about `/slots` reports 1, not "unknown".
+ *
+ * NOTE (2026-09-21): this used to cite the local backend as the motivating
+ * example — "ninfer-serve, which serves no /slots at all". That is no longer
+ * the case: the local backend is buun-llama-cpp and /slots answers with two
+ * rails, so the 404 branch is now the FOREIGN-engine path, not the normal one.
+ * The logic is unchanged and still correct; only the example was stale.
  */
 export async function probeSlots(base, timeoutMs = 1500) {
     try {

package/dist/utils/model-slots.js.map

@@ -1 +1 @@
-{"version":3,"file":"model-slots.js","sourceRoot":"","sources":["../../src/utils/model-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,iDAAiD;AACjF,MAAM,YAAY,GAAG,MAAM,CAAC;AAS5B,IAAI,MAAM,GAA+E,IAAI,CAAC;AAI9F,SAAS,GAAG,CAAC,GAAY;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAEzC,CAAC;QACT,OAAO,GAAG,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,0EAA0E;IAC1E,uEAAuE;IACvE,8EAA8E;IAC9E,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;QACjB,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1B,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC5B,uBAAuB,CAAC;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,MAAM,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,SAAS,GAAG,IAAI;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,wBAAwB;gBACxB,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,GAAY;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,OAA6C,EAAE;IAE/C,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,KAAa,CAAC;IAClB,IAAI,MAAoB,CAAC;IACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,KAAK,GAAG,QAAS,CAAC;QAClB,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,GAAG,QAAQ,CAAC;QACjB,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,GAAG,MAAM,CAAC;YACf,MAAM,GAAG,OAAO,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,aAAa,CAAC;YACtB,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,aAAa,CAAC;QACtB,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAY;IACpD,OAAO,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAC1E,OAAO,aAAa,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"model-slots.js","sourceRoot":"","sources":["../../src/utils/model-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,iDAAiD;AACjF,MAAM,YAAY,GAAG,MAAM,CAAC;AAS5B,IAAI,MAAM,GAA+E,IAAI,CAAC;AAI9F,SAAS,GAAG,CAAC,GAAY;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAEzC,CAAC;QACT,OAAO,GAAG,EAAE,gBAAgB,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,0EAA0E;IAC1E,uEAAuE;IACvE,8EAA8E;IAC9E,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;QACjB,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1B,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC5B,uBAAuB,CAAC;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,MAAM,CAAC,yBAAyB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,SAAS,GAAG,IAAI;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,wBAAwB;gBACxB,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,GAAY;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,OAA6C,EAAE;IAE/C,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,KAAa,CAAC;IAClB,IAAI,MAAoB,CAAC;IACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,KAAK,GAAG,QAAS,CAAC;QAClB,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,GAAG,QAAQ,CAAC;QACjB,MAAM,GAAG,QAAQ,CAAC;IACpB,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,GAAG,MAAM,CAAC;YACf,MAAM,GAAG,OAAO,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,aAAa,CAAC;YACtB,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,aAAa,CAAC;QACtB,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAY;IACpD,OAAO,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAC1E,OAAO,aAAa,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/docs/INDEX.md

@@ -1,6 +1,6 @@
 # UAP Documentation
 
-The complete documentation for the **Universal Agent Protocol** (`@miller-tech/uap` v1.224.0) — the discipline layer that turns a talented-but-unreliable AI coding agent into a dependable member of your software delivery line. 367 TypeScript modules across 26 subsystems, 459 vitest suites plus a ~1,200-test Python enforcer/proxy suite, 60 CLI command registrations, 32 executable policy enforcers, 9 supported agent harnesses.
+The complete documentation for the **Universal Agent Protocol** (`@miller-tech/uap` v2.11.0) — the discipline layer that turns a talented-but-unreliable AI coding agent into a dependable member of your software delivery line. 367 TypeScript modules across 26 subsystems, 459 vitest suites plus a ~1,200-test Python enforcer/proxy suite, 60+ CLI command registrations, 32 executable policy enforcers, 9 supported agent harnesses.
 
 > **Reviewing the system?** The reverse-engineered, code-verified reference set lives in
 > [`documentation/`](../documentation/architecture.md): architecture, flows, permissions
@@ -25,6 +25,7 @@ UAP is organized like a delivery line. If you know which part of the pipeline yo
 | **Coordination** — many workers, one floor | Parallel agents colliding, stale branches overwriting landed work | [Parallel Agents](guides/PARALLEL_AGENTS.md) · [Coordination](guides/COORDINATION.md) · [Deploy Batching](guides/DEPLOY_BATCHING.md) · [Semantic Supervisor](reference/semantic-supervisor.md) (`uap supervise`) |
 | **Shipping** — out the door safely | Regressions, red CI, skipped bumps | [Worktree Workflow](guides/WORKTREE_WORKFLOW.md) · [Policies](guides/POLICIES.md) |
 | **Capacity** — services inside their budgets | Silent OOMs, crash loops, headroom loss | [Capacity Policy](guides/CAPACITY_POLICY.md) (`uap doctor`) |
+| **Inference** — the model still doing useful work | Throughput decaying with uptime, starved checkpoints, KV at its quality floor | [Inference Health](guides/INFERENCE_HEALTH.md) (`uap inference health`) |
 | **Feedback** — the floor learns | The same mistake every session | [Memory](guides/MEMORY.md) · [Self-Harness](design/SELF_HARNESS.md) · [Self-Tuning](guides/SELF_TUNING.md) |
 | *Cross-cutting* — the whole line | Ignored rules, bloated context | [Policies](guides/POLICIES.md) · [MCP Router](guides/MCP_ROUTER.md) |
 
@@ -78,6 +79,7 @@ Full map: **[The UAP Delivery Pipeline](guides/DELIVERY_PIPELINE.md)**.
 | [Self-Harness](design/SELF_HARNESS.md) | Self-improving harness (shipped as `uap self-harness`): autonomous mine→propose→validate loop over a bounded Mod DSL; cross-model transfer, online mining |
 | [LLM Self-Tuning (analysis)](design/LLM_SELF_TUNING_ANALYSIS.md) | The design behind `uap tune`: quality signal, LLM-guided + Gaussian-process flag search, closed-loop validation, model profiles, real-time adaptation |
 | [Product Naming (analysis)](design/PRODUCT_NAMING.md) | UAP rename candidates: availability sweeps (npm/PyPI/domains), AI-space collision checks, railway-theme shortlist, recommendation. No decision committed; availability data is point-in-time |
+| [ADRs](architecture/adr/) | Architecture decision records: [0001 AutoMode risk floor](architecture/adr/0001-automode-risk-floor.md) (Python heuristic scorer ahead of the TS SYS1 head), [0002 Evidence-bound ship](architecture/adr/0002-evidence-bound-ship.md) (gate evidence bound to the candidate SHA) |
 
 ## Reference
 
@@ -92,6 +94,10 @@ Full map: **[The UAP Delivery Pipeline](guides/DELIVERY_PIPELINE.md)**.
 | [Platforms](reference/PLATFORMS.md) | The 9 supported harnesses + support matrix |
 | [Review Pre-Pass](reference/review-prepass.md) | Deterministic ruleset scanner (`uap review prepass`) that feeds line-anchored findings to the parallel review protocol |
 | [Visual Captures](reference/visual-captures.md) | Before/after capture binding for UI diffs (`uap review captures`) — ship-time gate 7 enforcement |
+| [System-1 Classifier](reference/system1-classifier.md) | `uap classify` — the local, airgap-pure assessment backend (noul/score/choice questions) behind the Wave 1 consumers; thresholds ship as policy config |
+| [Semantic Supervisor](reference/semantic-supervisor.md) | `uap supervise` — watchdog loop for `uap deliver` missions; nine assessment dimensions, deterministic safety-first policy, cooperative STOP only |
+| [AutoMode Risk](reference/automode-risk.md) | Pre-execution tool-call risk classification (`tools/agents/scripts/tool_risk.py`) — advisory only, ahead of the deterministic enforcer floor |
+| [Evidence-Bound Ship](reference/evidence-bound-ship.md) | Ship actions blocked unless `.uap/evidence/<head-sha>.json` proves the gates passed for the exact commit being shipped |
 | [Configuration](reference/CONFIGURATION.md) | All config files and env vars |
 | [**Configuration Reference**](reference/CONFIGURATION_REFERENCE.md) | Every setting `uap config` exposes — what it does, default, and a recommendation (generated from the registry); `uap config list/explain/set/doctor/wizard` ⭐ |
 | [Database Schema](reference/DATABASE_SCHEMA.md) | SQLite databases + Qdrant collections |

package/docs/guides/CAPACITY_POLICY.md

@@ -9,7 +9,8 @@ This generalizes the 2026-09-18 llama.cpp OOM fix: four SIGABRT crashes
 happened because a KV-cache budget was resolved against a GPU that also runs
 a desktop, and nothing declared that relationship. The fix held, but the
 *discipline* (declare budget + headroom + restart baseline, watch for
-violations) lived in a commit message. Now it is data.
+violations) lived only in a commit message; the capacity policy moves it
+into data.
 
 ## Policy file
 
@@ -41,12 +42,36 @@ the project, then `~/.config/uap/capacity-policy.json`.
     `MemoryCurrent`. Declaring it when systemd cannot report memory
     (cgroup accounting off) is RED — a declared budget that cannot be
     verified is not healthy.
+  - `budget.execStartMustContain` **is** enforced: literal strings that must
+    all appear in the unit's probed `ExecStart`, matched as plain substrings
+    so ordering and surrounding flags do not matter.
+
+    ```json
+    "budget": {
+      "vramMiB": 5120,
+      "note": "--vbr-vram 5120M, -c 229376, -np 2",
+      "execStartMustContain": ["-c 229376", "-np 2", "--vbr-vram 5120M"]
+    }
+    ```
+
+    It exists because `note` is prose and drifts silently. On 2026-09-20 a
+    note still read `-np 1` while the unit had been running `-np 2` for hours,
+    and the doctor stayed GREEN throughout — it probed only liveness
+    properties and never looked at `ExecStart`. Anything load-bearing enough
+    to write in the note belongs here too, where a mismatch is RED. As with
+    the other budgets, *unverifiable* is also RED: if `systemctl` reports no
+    `ExecStart`, the declaration is not quietly assumed satisfied.
 - **headroom.gpuMinFreeMiB** — free VRAM the *host* must keep; below it the
   service is in OOM territory even while running.
 - **restartBudget** — `knownRestarts` is the accepted historical baseline
   (e.g. crashes already fixed); `allowedNew` new crashes beyond that turn the
   service RED. Zero is the right default after a fix lands.
 
+`uap doctor` answers whether a service is up and inside its declared budget.
+Whether the local model is still doing useful *work* — throughput can decay
+~8x over a long-lived process while every one of these checks stays GREEN — is
+[`uap inference health`](INFERENCE_HEALTH.md).
+
 ## Health semantics
 
 | Health | Meaning |
@@ -73,9 +98,9 @@ elsewhere should ship their own `config/capacity-policy.json` (project) or
 `~/.config/uap/capacity-policy.json` (operator); the resolution order above
 makes the committed file the fallback only inside this repo.
 
-`uap doctor --strict` is the natural health source for the monitor service
-to consult before restarting anything, and for CI to refuse a deploy into a
-degraded host.
+`uap doctor --strict` is the health source the monitor service should
+consult before restarting anything, and CI can use it to refuse a deploy
+into a degraded host.
 
 ## Decisions
 

package/docs/guides/INFERENCE_HEALTH.md

@@ -0,0 +1,184 @@
+# Inference Health (`uap inference health`)
+
+`uap doctor` answers *"is the service up and inside its declared budget?"*
+This answers a different question: **is it still doing useful work?**
+
+The distinction is not academic. On 2026-09-21 a local llama.cpp server
+reported `active (running)` and GREEN from `uap doctor` for eighteen hours
+while its prefill throughput fell roughly eight-fold and five client requests
+blew a 1800-second deadline overnight. Nothing was down. Liveness checks had
+nothing to report, and the only visible symptom — slow turns — looked like the
+model being the model.
+
+```bash
+uap inference health                # the running process
+uap inference health --json         # for monitors and dashboards
+uap inference health --strict       # exit 1 on WARN or RED
+```
+
+## What it looks at
+
+| Check | Code | Why it exists |
+| --- | --- | --- |
+| Prefill throughput decay | `prefill-decay` | A long-lived process can get slower without failing. Only visible when samples are bucketed by prompt size. |
+| Checkpoint starvation | `checkpoint-starved` | `--ctx-checkpoints` is **per slot**. Too few, and the checkpoint cannot track a growing conversation, so the same prefix is re-prefilled every turn. |
+| KV pinned at the VBR floor | `kv-at-floor` | The pool is saturated and the cache has silently dropped to its lowest quality tier. |
+| Client-visible timeouts | `generation-timeouts` | The symptom users actually feel, counted from the proxy journal. |
+| Window spans a restart | `spans-restart` | A trend across a restart compares two process lifetimes, not decay within one. |
+| Rail/pool geometry | `shared-pool` | Informational (never a fault). Under `--kv-unified` the pool is *shared*, so N rails each believing they own it is an overcommit waiting to happen. |
+
+Health is `GREEN` / `WARN` / `RED`, or **`UNKNOWN` when there is no evidence**.
+A fabricated GREEN is precisely what let the original incident run all day, so
+every probe fails open and any that could not run is listed explicitly as
+`unverified (probe unavailable)`.
+
+`UNKNOWN` requires *all three* sampled signals to be missing — no usable
+throughput trend, no checkpoint samples, and no KV reading. Losing one of them
+does not suppress the rest. An **actionable finding always wins**: timeouts are
+counted from the proxy journal and can fire with none of the sampled signals
+present, and a RED finding must never be masked by an `UNKNOWN` rollup — which
+would let it pass `--strict` with exit 0.
+
+## Why prompt-size bucketing matters
+
+Prefill throughput depends strongly on prompt length, and agent conversations
+grow over a session. So an hourly average moves for reasons that have nothing
+to do with the server, and a naive before/after comparison manufactures
+trends that are not there.
+
+The trend is therefore computed **within a size bucket** (`<5k`, `5-15k`,
+`15-30k`, `>30k`), for every bucket with enough samples in both halves of the
+window. If none qualifies, it reports that it cannot compare like with like
+rather than guessing.
+
+Each bucket is split at **its own** median time, not the global one. That
+matters because agent conversations grow, so large prompts arrive late: on a
+live 6h journal the `15-30k` bucket had 2 samples before the global midpoint
+and 21 after, so the minimum-samples guard dropped it — while it had gone
+616 → 73 tok/s. An 8× collapse, invisible, with the report showing a benign
+`<5k` at 0.78 and emitting no finding at all. A bucket's own chronology is what
+"did this get slower" means for that prompt size.
+
+Findings are based on the **worst** bucket, and the others are named alongside
+it. Ranking by sample count instead would hide the problem: on the real
+incident window the `>30k` bucket had the most samples and sat at 0.52 (WARN),
+while `5-15k` had collapsed to 0.29 (RED). Reporting the fattest bucket
+understated the severity and flipped the remedy from *restart the server* to
+*watch it* — and a thin bucket collapsing tenfold produced no finding at all.
+
+## Replaying a past incident
+
+`--until` bounds the journal window, which turns the command into a
+post-incident tool:
+
+```bash
+uap inference health --since "2026-09-20 15:26:52" --until "2026-09-21 09:50:00"
+```
+
+```
+REPLAY  journal window 2026-09-20 15:26:52 .. 2026-09-21 09:50:00 — live readings below are omitted
+RED     findings for that window
+  prefill     628 → 205 tok/s ↓ in the 5-15k bucket (n=14/29)
+  reuse       20% of the reusable prefix restored (~17,373 tok/turn re-prefilled)
+
+RED     prefill in the 5-15k bucket fell 67% over this process's life (628 -> 205 tok/s); also down in <5k (54%), 15-30k (54%), >30k (49%)
+        → restart the inference server; if it returns within days, investigate the prompt cache and idle-slot caching
+WARN    checkpoints recover only 20% of the reusable prefix (~17,373 tokens re-prefilled per turn)
+RED     5 generation timeout(s) in the window — clients lost work
+```
+
+Pass **both** bounds. With `--until` alone the start would otherwise default to
+the *currently running* process — which for any past incident is later than the
+window's end, so `journalctl` returns nothing and the report is a clean
+`UNKNOWN` with no hint that the window was backwards. The default is a relative
+`-24h` in that case, but an explicit `--since` is what you want.
+
+In this mode the live readings — uptime, `kv_bpv`, the unit's current flags —
+are **dropped, not shown**. They describe the process running *now*, not the
+one in the window. An early version did attribute the current
+`--ctx-checkpoints 4` to a window in which it had been `1`, and recommended
+the wrong remedy as a result.
+
+## Reading the output
+
+```
+inference health: uap-gsq-rco-server.service
+GREEN   active, up 6m, 2 rail(s)
+  pool        229,376 cells shared (114,688/rail if split)
+  checkpoints 4 per slot
+  kv          8.125 bpv (floor 4.125)
+  prefill     682 → 766 tok/s ↑ in the 15-30k bucket (n=12/14)
+  reuse       94% of the reusable prefix restored (~2,600 tok/turn re-prefilled)
+  concurrency 1.058 busy slots/decode (>1 means the extra rail is actually being used)
+
+  · 2 rails share one 229,376-cell pool (114,688 each if evenly divided)
+  no problems detected
+```
+
+`pool ... shared` is deliberate wording. With a unified KV cache — which this
+fork **forces** whenever VBR runs above one rail, rather than it being a flag
+you set — `-c` is one shared pool and **`-np` does not divide it**. `/slots`
+reports the full `n_ctx` for every slot and any rail may address all of it. Two rails each
+believing they own the pool is an overcommit waiting to happen; the per-rail
+figure is what it *would* be if split evenly, not an allowance the server
+enforces.
+
+`concurrency` is the honest test of whether an extra rail is earning anything.
+A reading of `1.000` means requests never actually overlapped, so the second
+rail bought nothing — which is a workload fact, not a server fault.
+
+## Options
+
+| Flag | Meaning |
+| --- | --- |
+| `--server-unit <unit>` | systemd user unit for the inference server |
+| `--proxy-unit <unit>` | systemd user unit for the proxy (timeout counting) |
+| `--url <url>` | server base URL (default `http://127.0.0.1:8080`) |
+| `--since <expr>` | `journalctl --since` window (default: the server process start) |
+| `--until <expr>` | `journalctl --until` bound — replay a past incident |
+| `--json` | machine-readable, with a pinned `reportVersion` |
+| `--strict` | exit 1 on WARN or RED, for CI and monitor loops |
+
+The default window is **the server process's own start**, because throughput
+decay is a property of one process — spanning a restart would manufacture a
+cliff at the boundary. When `systemctl` is unavailable and that start time
+cannot be read, it falls back to `-24h`. If the window does end up spanning
+more than one server process, the report says so (`spans-restart`) rather than
+presenting the boundary as decay.
+
+In a replay (`--until`), the live readings are dropped from the analysis too,
+not merely hidden — including the unit's current `-np`/`-c`, which describe the
+process running now rather than the one in the window. The `shared-pool` line
+therefore does not appear in a replay.
+
+## Tuning checkpoints when KV sits at the floor
+
+`kv-at-floor` usually means the pool is saturated — and on this stack a common
+cause is the checkpoint allowance, because checkpoints are charged to the SAME
+`--vbr-vram` budget as live context, at ~190 MiB each **per slot**:
+
+| `--ctx-checkpoints` | cost across 2 rails | share of a 5120 MiB budget |
+| --- | --- | --- |
+| 4 | 1520 MiB | 30% |
+| 3 | 1140 MiB | 22% |
+| 2 | 760 MiB | 15% |
+
+`scripts/set-ctx-checkpoints.sh N` retunes it, backing up the unit and leaving
+the comment history intact:
+
+```bash
+bash scripts/set-ctx-checkpoints.sh 3        # stage only
+bash scripts/set-ctx-checkpoints.sh 3 --now  # stage and restart
+```
+
+There is no free direction. Raising it bought checkpoint recovery from 20% to
+69% of the reusable prefix on 2026-09-21 — roughly 32k tokens of prefill saved
+per turn — and cost KV quality, which settled at the 4.125 floor within six
+hours. `uap inference health` reports both sides: `reuse NN%` is the checkpoint
+value, `kv N.NNN bpv (floor …)` is the headroom it consumed.
+
+## Related
+
+- [Capacity Policy](CAPACITY_POLICY.md) (`uap doctor`) — liveness and declared
+  budgets, including the `budget.execStartMustContain` flag-drift check.
+- [Local Models](LOCAL_MODELS.md) — the serving stack itself.

package/docs/guides/PROXY.md

@@ -181,6 +181,7 @@ set is below.
 | **Recon-convergence** | `PROXY_RECON_CONVERGENCE_THRESHOLD` (40) | After N tool-using turns with **no** write/deliverable, inject "stop exploring, produce the deliverable"; escalates to stripping tools if it persists (0 disables) |
 | **Hard-finalize** | `PROXY_HARD_FINALIZE_TURNS` (40) | Absolute turn cap before a forced finalize |
 | **MANDATE-DELIVER** | `PROXY_MANDATE_DELIVER` (on) | On the delivery-enforcer block marker, pin `tool_choice` to `deliver` so the next turn *must* route through the gated path — makes routing binding for weak models |
+| **Lockstep escalation** | `PROXY_LOCKSTEP_BREAK` (on), `PROXY_LOCKSTEP_PIVOT_AT` (2), `PROXY_LOCKSTEP_HARD_AT` (4) | The identical tool call failing with the identical error: inject a pivot directive at streak 2, a final warning one fire later, then hard-fail the session (400) at streak 4 instead of drifting (both directives always precede the stop, so it lands at `max(HARD_AT, PIVOT_AT+2)`). Each tier appends to the loop-incident ledger (`UAP_LOOP_INCIDENTS`, default `~/.config/uap/loop-incidents.jsonl`, ~3 records per episode, no rotation) for `uap loops` to inspect and hand to `uap ideate`/`uap deliver`. A fresh human user turn re-arms the guard. Disarmed if `PROXY_ERROR_LOOP=off` or `PROXY_DOUBLING_BREAK=off` (their trackers feed it) |
 
 ### Context & compaction