@miller-tech/uap 2.16.7 → 2.19.5

package/dist/self-tuning/profiles/qwen38.js

@@ -5,21 +5,20 @@
  * Carried over from QWEN36_PROFILE unchanged EXCEPT for concurrency, which is
  * not a preference here but a property of the server.
  *
- * CORRECTED 2026-09-21. This header said the model was served by
- * `ninfer-serve --max-concurrency 1` and that there was ONE rail. That engine
- * is not what runs: the backend is buun-llama-cpp behind
- * uap-gsq-rco-server.service with `-np 2`, and the proxy was raised to match
- * (PROXY_CONCURRENCY_LIMIT / UAP_MODEL_SLOTS / PROXY_SESSION_ADMISSION_LIMIT
- * all 2). The reasoning below still holds, only the number changed: slots must
- * track what the server and proxy will actually run in parallel. Declaring
- * MORE than that does not get more in flight — it gets one running and the
- * rest queued, the extra slots buy latency and a longer wedge window rather
- * than throughput, and the adaptive controller then reads the queueing delay
- * as backpressure and throttles a server that was never saturated.
+ * HISTORY: corrected 2026-09-21 (ninfer-serve -> buun-llama-cpp, 1 -> 2
+ * rails), then SUPERSEDED 2026-10-04 — the backend is now the strata serve
+ * layer on :8080 (flash-next IQ3_XXS pack), which runs ONE rail over a
+ * 131072-cell pool. Slots drop 2 -> 1 for the same reason they rose 1 -> 2:
+ * slots must track what the server and proxy will actually run in parallel.
+ * Declaring MORE than that does not get more in flight — it gets one running
+ * and the rest queued, the extra slots buy latency and a longer wedge window
+ * rather than throughput, and the adaptive controller then reads the
+ * queueing delay as backpressure and throttles a server that was never
+ * saturated.
  *
- * Whether the second rail EARNS anything is a separate question from whether
- * it exists: check llamacpp:n_busy_slots_per_decode in /metrics (>1 means
- * requests genuinely overlapped), or `uap inference health`.
+ * Whether a future second strata rail EARNS anything is a separate question
+ * from whether it exists: `uap inference health` (backend strata) answers it
+ * once one does.
  *
  * Everything else is deliberately identical to the qwen36 seed: nothing has
  * been re-measured on 3.8 yet, and the tuning loop's job is to beat this seed,
@@ -38,10 +37,10 @@ export const QWEN38_PROFILE = {
     'handsfree.enabled': true,
     'handsfree.intensity': 'aggressive',
     UAP_HANDSFREE_STAGNATION_LIMIT: 6,
-    // Concurrency: TWO rails (see the header) — matches `-np 2` on the server
-    // and the proxy's concurrency/admission limits. Adaptive stays on so a
-    // genuinely overloaded server still backs off.
-    'modelConcurrency.slots': 2,
+    // Concurrency: ONE rail (see the header) — matches the strata server's
+    // single slot and the proxy's concurrency/admission limits. Adaptive stays
+    // on so a genuinely overloaded server still backs off.
+    'modelConcurrency.slots': 1,
     'modelConcurrency.adaptive': true,
     // Memory: bigger short-term window + pattern RAG compensate for weak planning.
     'memory.shortTerm.maxEntries': 80,

package/dist/self-tuning/profiles/qwen38.js.map

@@ -1 +1 @@
-{"version":3,"file":"qwen38.js","sourceRoot":"","sources":["../../../src/self-tuning/profiles/qwen38.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,yEAAyE;IACzE,iBAAiB,EAAE,IAAI;IACvB,gBAAgB,EAAE,QAAQ;IAC1B,6BAA6B,EAAE,GAAG;IAClC,iBAAiB,EAAE,CAAC;IACpB,wBAAwB,EAAE,KAAK;IAC/B,yEAAyE;IACzE,mBAAmB,EAAE,IAAI;IACzB,qBAAqB,EAAE,YAAY;IACnC,8BAA8B,EAAE,CAAC;IACjC,0EAA0E;IAC1E,uEAAuE;IACvE,+CAA+C;IAC/C,wBAAwB,EAAE,CAAC;IAC3B,2BAA2B,EAAE,IAAI;IACjC,+EAA+E;IAC/E,6BAA6B,EAAE,EAAE;IACjC,2BAA2B,EAAE,IAAI;IACjC,uEAAuE;IACvE,wBAAwB,EAAE,IAAI;IAC9B,kEAAkE;IAClE,iCAAiC,EAAE,EAAE;IACrC,kBAAkB,EAAE,IAAI;IACxB,iBAAiB,EAAE,IAAI;CACxB,CAAC"}
+{"version":3,"file":"qwen38.js","sourceRoot":"","sources":["../../../src/self-tuning/profiles/qwen38.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,yEAAyE;IACzE,iBAAiB,EAAE,IAAI;IACvB,gBAAgB,EAAE,QAAQ;IAC1B,6BAA6B,EAAE,GAAG;IAClC,iBAAiB,EAAE,CAAC;IACpB,wBAAwB,EAAE,KAAK;IAC/B,yEAAyE;IACzE,mBAAmB,EAAE,IAAI;IACzB,qBAAqB,EAAE,YAAY;IACnC,8BAA8B,EAAE,CAAC;IACjC,uEAAuE;IACvE,2EAA2E;IAC3E,uDAAuD;IACvD,wBAAwB,EAAE,CAAC;IAC3B,2BAA2B,EAAE,IAAI;IACjC,+EAA+E;IAC/E,6BAA6B,EAAE,EAAE;IACjC,2BAA2B,EAAE,IAAI;IACjC,uEAAuE;IACvE,wBAAwB,EAAE,IAAI;IAC9B,kEAAkE;IAClE,iCAAiC,EAAE,EAAE;IACrC,kBAAkB,EAAE,IAAI;IACxB,iBAAiB,EAAE,IAAI;CACxB,CAAC"}

package/dist/types/mission.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Mission ledger types — the durable goal layer above deliver runs.
+ *
+ * A mission is a user-level goal with FROZEN acceptance criteria (the
+ * statement-immutability analog): the hash is taken at creation and every
+ * later change is an explicit, recorded replan. Missions link to durable
+ * deliver runs and survive reboots, crashes, and session boundaries — the
+ * orchestrator daemon polls this ledger to keep incomplete missions moving
+ * until their acceptance criteria are verified met.
+ */
+export type MissionStatus = 'active' | 'paused' | 'delivered' | 'failed';
+/** What one launch/execution attempt of (part of) a mission ended as. */
+export type MissionAttemptOutcome = 'launched' | 'delivered' | 'failed' | 'interrupted';
+export type SalvageStatus = 'proposed' | 'approved' | 'rejected';
+export interface Mission {
+    id: number;
+    goal: string;
+    /** Acceptance criteria text, frozen at creation (see acceptanceHash). */
+    acceptance: string;
+    /** sha256 of the trimmed acceptance text at freeze time. */
+    acceptanceHash: string;
+    status: MissionStatus;
+    /** Model preset the mission's runs should use (optional). */
+    presetId?: string;
+    /** Durable deliver run most recently attached to this mission. */
+    latestRunId?: string;
+    /** Total launches (fresh + resume). Drives the relaunch backoff. */
+    launchCount: number;
+    /** Resume launches after an interruption. Drives the relaunch backoff. */
+    relaunchCount: number;
+    /** ISO time of the last launch — the backoff's anchor. */
+    lastLaunchAt?: string;
+    /** pid of the launch we spawned — the provenance anchor for run linkage. */
+    launchPid?: number;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface MissionAttempt {
+    id: number;
+    missionId: number;
+    /** Deliver run id this attempt executed (absent for a whole-mission note). */
+    runId?: string;
+    /** Epic/phase/task ref the attempt targeted (absent = the whole run). */
+    taskRef?: string;
+    outcome: MissionAttemptOutcome;
+    /** One-line harness-owned summary (what happened / what remains). */
+    summary?: string;
+    /**
+     * What this observation saw (run.updatedAt / exit.at). Dedupes identical
+     * RE-observations while letting genuinely new failures of the same run
+     * accumulate into the struggle metric.
+     */
+    observedAt?: string;
+    createdAt: string;
+}
+/**
+ * Choir-style salvage: a failed attempt's residue — what it learned, what
+ * partial work exists — seeded as a follow-up. Proposals are APPROVAL-GATED:
+ * nothing is scheduled until a human or the overseer approves.
+ */
+export interface SalvageProposal {
+    id: number;
+    missionId: number;
+    fromAttemptId?: number;
+    taskRef?: string;
+    proposal: string;
+    status: SalvageStatus;
+    createdAt: string;
+    decidedAt?: string;
+}
+/** An explicit supersede of a mission's frozen acceptance criteria. */
+export interface AcceptanceRevision {
+    id: number;
+    missionId: number;
+    priorAcceptance: string;
+    priorHash: string;
+    reason: string;
+    createdAt: string;
+}
+//# sourceMappingURL=mission.d.ts.map

package/dist/types/mission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission.d.ts","sourceRoot":"","sources":["../../src/types/mission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzE,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAC;AAExF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjE,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/types/mission.js

@@ -0,0 +1,12 @@
+/**
+ * Mission ledger types — the durable goal layer above deliver runs.
+ *
+ * A mission is a user-level goal with FROZEN acceptance criteria (the
+ * statement-immutability analog): the hash is taken at creation and every
+ * later change is an explicit, recorded replan. Missions link to durable
+ * deliver runs and survive reboots, crashes, and session boundaries — the
+ * orchestrator daemon polls this ledger to keep incomplete missions moving
+ * until their acceptance criteria are verified met.
+ */
+export {};
+//# sourceMappingURL=mission.js.map

package/dist/types/mission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission.js","sourceRoot":"","sources":["../../src/types/mission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/docs/architecture/adr/0003-mission-orchestrator.md

@@ -0,0 +1,99 @@
+# ADR 0003: The mission orchestrator — a durable goal layer above deliver runs
+
+- Status: Accepted
+- Date: 2026-10-03 (branch `feature/331-mission-orchestrator`, Choir-uplift PR 1 of 2)
+- Guide: `docs/guides/MISSIONS.md` · Visual: `docs/visual/mission-orchestrator.html`
+
+## Context
+
+`uap deliver` runs converge against real gates and survive their tool call
+(detached missions), but nothing owns the **goal** across process lifetimes:
+a reboot, a crashed service, or a run that quietly died leaves the work
+incomplete with nothing to resume it. The Choir protocol (Weber-GeoML,
+Apache-2.0; arXiv 2609.31903) contributes the key insight: the loop clock and
+the state must be durable and external to any agent process.
+
+UAP already had every inner mechanism (durable run state, resume cursors, a
+watch-don't-drive supervisor, convergence loops, an in-deliver blackboard
+orchestrator, epic controller). What was missing was the outer loop and its
+durable state: a mission ledger plus a poll daemon that keeps incomplete
+missions moving until their frozen acceptance criteria are met.
+
+## Decision
+
+1. **A mission ledger, separate from the coordination DB.** Missions are
+   operator-owned durable goals (months), coordination state is per-session
+   agent registry (minutes). Different lifecycles, different owners; merging
+   them would couple a long-lived artifact to session hygiene. Stored at
+   `.uap/missions.db` (SQLite, WAL, `PRAGMA user_version = 1`, `foreign_keys ON`).
+2. **Frozen acceptance criteria (statement immutability).** sha256 of the
+   trimmed acceptance text at creation; every change is an explicit
+   `uap mission replan` that records the prior text, hash, and reason in
+   `acceptance_revisions`. A replan RESETS the run link and backoff counters:
+   the prior run embeds the old criteria and must not deliver against
+   superseded acceptance. The acceptance travels inside every run
+   instruction with `--acceptance`, so the behavioral judge grades the frozen
+   text. PR 2's merge gate will verify this same hash before any merge.
+3. **The run marker embeds the acceptance hash.** `[mission:#N:<hash8>]` in
+   the instruction links a deliver run back to its mission. Because the
+   hash slice is replan-scoped, an old-criteria run can never be relinked
+   after a replan, and goal text mentioning another mission's marker cannot
+   collide. The marker prefix also pins the argv injection posture (the
+   positional token can never begin with `-`).
+4. **Linkage is provenance-checked.** Run-state files are untrusted input
+   (the loader sanitizes format, not intent). A discovered run links only
+   when its instruction carries the mission's marker AND its pid matches the
+   pid the orchestrator itself spawned (recorded by `claimLaunch`/
+   `setLaunchPid`). A planted state file cannot know a future child pid, so
+   it can never steer the daemon into resuming it or closing the mission.
+5. **A pure decision table + a seam-injected executor.** `decideMissionActions`
+   (`poll-cycle.ts`) is PURE and unit-tested; `runPollCycle`
+   (`poll-executor.ts`) applies its actions through injected seams
+   (supervisor, spawner, board), matching the project's house style
+   (`plan.ts`, `deliver.ts`). A cycle never throws — a bad state produces a
+   report note, not a dead daemon.
+6. **Launches are claimed atomically.** `claimLaunch` is a single-statement
+   conditional UPDATE (60-second window), so the daemon poll and
+   `uap mission create --launch` cannot both spawn the same mission.
+7. **Backoff: first relaunch immediate, then exponential (15·2^n, cap 1 day).**
+   A clean interruption is the healthy case; repeated failures back off.
+   Struggle (failed/interrupted attempts per mission) is deduped per
+   (mission, run, outcome, taskRef, observedAt) — identical re-observations
+   dedupe, genuinely new failures accumulate — and 3+ struggle turns salvage
+   proposals into escalation asks. Salvage is APPROVAL-GATED (the Choir
+   overseer split): the orchestrator proposes, the human rules
+   (`uap mission salvage approve|reject`).
+8. **The daemon is systemd-owned.** `uap-orchestrator.service` runs
+   `uap mission poll --loop --interval 300` (hidden alias: `uap orch poll` —
+   deliberately distinct from `uap orchestrator on|off`, which toggles the
+   in-deliver blackboard orchestrator). Node and the CLI entrypoint are
+   captured absolute at install time; `uap doctor` probes the unit against
+   its declared RSS budget in `config/capacity-policy.json`.
+
+## Consequences
+
+- A mission survives reboots, crashes, session teardown, and context
+  exhaustion: the daemon re-decides every active mission every 300 s.
+- The launch grace window (10 min) prevents double-launching before
+  `uap deliver` registers its run state; discovery then links the run.
+- fd hygiene matters in daemon mode (the parent closes the spawn log fd;
+  the child holds a dup) and log files use 0600 like supervisor state.
+- The attempt ledger is the struggle metric; whole-mission notes (no runId)
+  are never deduped so launch-loops escalate instead of retrying silently.
+- PR 2 (merge gate) consumes exactly: `verifyAcceptanceHash`,
+  `hashAcceptance`, the revision history, and the mission↔run linkage — it
+  must never parse acceptance text out of the instruction string.
+
+## Alternatives considered
+
+- **Fold missions into the coordination DB** — rejected: lifecycle mismatch
+  (see Decision 1).
+- **Let deliver own the goal loop** — rejected: deliver already owns
+  in-run orchestration (blackboard, epics); the goal layer must survive the
+  run process, so it lives above it.
+- **Adopt Choir itself as the backend** — deferred: single-machine today;
+  the protocol's distributed-worker surface (GitHub issues, forks) is a
+  follow-up if distribution becomes a requirement.
+- **Auto-execute approved escalations** — rejected: salvage and escalation
+  are approval-gated by user decision (2026-10-03); the daemon proposes,
+  never schedules.

package/docs/architecture/adr/0004-deterministic-merge-gate.md

@@ -0,0 +1,127 @@
+# ADR 0004: The deterministic merge gate — evidence, not testimony
+
+- Status: Accepted
+- Date: 2026-10-03 (branch `feature/332-merge-gate`, Choir-uplift PR 2 of 2)
+- Guide: `docs/guides/MISSIONS.md` (Merge gate section) · Visual: `docs/visual/merge-gate.html`
+- Builds on: ADR-0003 (mission orchestrator; this gate is the landing half of the seam ADR-0003 documented)
+
+## Context
+
+ADR-0003's orchestrator keeps a mission moving until a deliver run reports DONE
+against frozen acceptance. But a DONE report is **testimony**, not evidence:
+a run can claim delivery with a stub still in the diff, with its final
+iteration actually failing, under acceptance criteria a later replan has
+superseded, or — worst case — in a diff that also rewrites the very gates that
+would judge it. Choir's merge discipline contributes the closing insight: the
+merge is the moment to recompute the verdict deterministically from recorded
+evidence, before the work becomes irreversible.
+
+The merge queue (`uap merge queue`) already serializes landings and re-syncs
+impacted PRs, but its pre-merge check was only `gh pr checks` — CI greenness.
+CI cannot see mission semantics at all.
+
+## Decision
+
+Four deterministic checks run between a mission-linked PR and master. All four
+are recomputed from recorded evidence at gate time — no model calls (the
+acceptance judge already ran inside deliver; the gate verifies its recorded
+outcome, it does not re-judge), and no parsing of acceptance text out of
+instruction strings (the ADR-0003 seam: `verifyAcceptanceHash`, the marker
+hash, the attempt ledger).
+
+1. **Provenance / statement immutability.** The PR's `[mission:#N:<hash8>]`
+   marker must match the mission's CURRENT frozen acceptance hash. A PR cut
+   before a replan was built to superseded criteria — it fails, even though
+   its CI is green. Independently, the ledger itself must be intact: the stored
+   acceptance text must still hash to the stored hash (`verifyAcceptanceHash`),
+   so a hand-edited `.uap/missions.db` cannot launder acceptance.
+2. **Green recompute.** Tier 1: the gate-evidence artifact deliver records on
+   success (`.uap/evidence/<candidateSha>.json`, uplift 1.4) — every gate's
+   exit code bound to the exact HEAD it proved. Production delivered runs
+   persist WITHOUT a run checkpoint (deliver clears it on success), so the
+   artifact, not run-state history, is the seam that survives a real
+   delivery; a present-but-invalid artifact (red gate exit, environment
+   hatch, candidate-sha drift, malformed JSON) is a hard failure. Tier 2:
+   when no artifact was checked, run-state history must show a passing final
+   iteration (and 100% acceptance when the judge ran). Tier 3 is refused:
+   a bare `delivered` status with no artifact and no history is testimony,
+   not evidence. Status is read FRESH from disk, and when both pids are
+   known the run-state pid must match the pid the orchestrator spawned
+   (PR-1 provenance discipline). No salvage proposal may await a ruling —
+   landing past an open proposal would bypass the approval gate. Note: a
+   `history`-tier run whose `acceptanceMet` is undefined also covers the
+   case where the acceptance judge itself errored mid-deliver (the
+   convergence loop fails open and records no fraction) — closing that
+   ambiguity is PR-1 follow-up, tracked there.
+3. **Sorry-delta.** The ADDED lines of the diff (never removed lines —
+   deleting a TODO is progress) are scanned for stub markers (`todo!()`,
+   `NotImplementedError`, TODO/FIXME, placeholder implementations) in
+   non-test, non-docs files (tests stub seams by design; docs quote the
+   markers they describe), and for apology/escape phrasing ("sorry",
+   "I couldn't", "unable to complete") in added lines and the run's
+   declared summaries. Lines longer than 8 KB are skipped — a bounded-gap
+   placeholder pattern was quadratic on adversarial multi-megabyte lines
+   (security review).
+4. **Axiom-honesty.** The diff may not touch gate infrastructure — enforcer
+   hooks, CI workflows, policy enforcers, the quality baseline, the
+   version-bump script, capacity policy, the merge gate and queue
+   themselves, their evidence gatherer, and the mission ledger functions the
+   first two checks consume — without explicit acknowledgment. DELETED,
+   RENAMED, and BINARY gate-infra files are captured too (`git rm` on a
+   hook is the purest form of weakening it). The prefix list is hard-coded
+   in the gate's own source, not a config file: an externalized list could
+   be edited by the very PR it judges, while any edit to the list trips
+   axiom-honesty against the gate itself — the list protects itself by
+   being the gate. A PR may not weaken (or rewrite) the checks that judge
+   it. Acknowledgment is operator-visible: `--allow-gate-infra` on the CLI,
+   or a `gate-infra` PR label in the queue. There is deliberately NO
+   environment escape hatch (`UAP_*_OFF` is not consulted), and the queue's
+   `--force` flag skips stale CI checks but NOT this gate — a force flag is
+   exactly the gate-off escape this check exists to refuse.
+
+The pure decision core is `evaluateMergeGate` (`src/delivery/merge-gate.ts`);
+evidence gathering (`gatherGateEvidence`) and PR wiring (`gatePr`) live in
+`src/cli/merge-gate.ts`. The queue gates only PRs carrying a mission marker;
+unmarked PRs proceed as before (the gate is opt-in by provenance, not a tax
+on every PR).
+
+## Consequences
+
+- `uap merge gate <missionId>` is the operator surface (also `--json` for CI).
+- The queue skips (never force-merges) a PR whose gate fails, listing every
+  failed check so an operator sees all reasons at once — the core reports a
+  full finding list, not first-fail. A transient `gh pr diff` failure maps
+  to a per-PR skip (`gate: error`), never a crash of the whole batch; the
+  diff is fetched lazily, so marker-less PRs cost no extra `gh` calls.
+- A delivered run's recorded history is trusted only in aggregate: status,
+  final-iteration pass, acceptance fraction. The gate never trusts summaries
+  as evidence of completion — summaries are scanned for apologies, which is
+  the opposite direction of trust.
+- Honest limits, recorded so the messages are not oversold: `verifyAcceptanceHash`
+  detects only INCONSISTENT hand-edits (text edited without recomputing the
+  stored hash); an attacker who edits both passes — it is a consistency
+  check, not a signature. The PR marker is author-asserted: any collaborator
+  can paste a green mission's marker into an unrelated PR, though doing so
+  only ever ADDS checks (an omitted marker faces none), and the queue warns
+  loudly about unmarked agent-style PRs on worktree-pattern branches. The
+  residual trust bottom is the agent-writable `state.json`/evidence files
+  themselves; the pid corroboration and the ledger-side attempt history
+  narrow, but do not eliminate, that surface.
+- A single marker gates only the mission it names; multi-mission PRs are
+  follow-up work (extract all markers, require all linked missions to pass).
+
+## Alternatives considered
+
+- **Re-run the acceptance judge at merge time** — rejected: a model call at
+  the gate makes the gate non-deterministic and re-bills the most expensive
+  step to guard against a claim that was already judged once. The recorded
+  fraction plus the stub/infra scans close the honest-failure modes
+  deterministically.
+- **Gate every PR through mission semantics** — rejected: PRs without
+  missions (docs, chores) have no acceptance to verify; forcing a marker
+  would create the exact kind of ceremony agents learn to game. Provenance
+  opts a PR in.
+- **Block gate-infra changes outright** — rejected: legitimate work sometimes
+  IS the gate system (this PR). The requirement is acknowledgment, not
+  prohibition — and the acknowledgment is recorded in the PR's labels where
+  a reviewer sees it.

package/docs/guides/CAPACITY_POLICY.md

@@ -32,6 +32,55 @@ the project, then `~/.config/uap/capacity-policy.json`.
 }
 ```
 
+## HTTP-probed services (no systemd unit)
+
+Since 2026-10-04 a service may declare an **`http`** probe instead of
+`systemd` — exactly one of the two, never both (which one would be the
+truth?). This exists for the strata serve layer, the local Qwen3.8 backend:
+launched by a plain script and reparented to `systemd --user`, it has no
+unit to show, no `NRestarts`, no `MemoryCurrent` — before this, `uap doctor`
+simply could not see the backend at all.
+
+```json
+{
+  "name": "strata-server",
+  "http": {
+    "url": "http://127.0.0.1:8080",
+    "kind": "strata",
+    "metricsMustMatch": { "kv": "int8", "max_context": 131072 }
+  },
+  "budget": { "note": "…which flags run-iq3_xxs.sh launches it with…" },
+  "headroom": { "gpuMinFreeMiB": 600 }
+}
+```
+
+- **Liveness** is "it answers `/metrics` as the declared kind". Not answering
+  at all is DARK (absent, not degraded); the probe tool failing (no curl,
+  timeout) is UNKNOWN — the same fail-open posture as a missing `systemctl`.
+  A server that answers but is *not* the declared document (a llama.cpp
+  Prometheus body behind the port, say) is DARK too: that is exactly the
+  wrong-engine misroute this check exists to catch.
+- **`http.metricsMustMatch`** is `execStartMustContain` for a service with no
+  ExecStart: `engine.<key>` values that must equal the live document. A
+  missing key is RED (unverified, not quietly compliant), a mismatch is RED
+  (configuration drift). Put the load-bearing numbers from the `note` here —
+  kv kind and pool size — or they will drift the way `note` did.
+- **`headroom`** works exactly as for unit services (one shared
+  nvidia-smi probe per run). There is no RSS budget or restartBudget: with
+  no unit there is no `MemoryCurrent` and no `NRestarts`; liveness IS the
+  probe. Declaring `budget.rssMiB` or `restartBudget` on an http service is
+  now a **parse error**, not a silently-ignored field — a budget that cannot
+  be verified is the anti-pattern this policy exists to prevent.
+- **URL validation is strict** — http(s) base URL only, no userinfo, query,
+  fragment, or path — because the probe passes it to curl as a positional
+  argument. That is the same first-wall doctrine as the unit-name charset.
+  The URL must also be **canonical**: a raw spelling that only *looks*
+  parseable (percent-encoded dot-segments, `/a/..`, a bare `?`, leading
+  whitespace) is rejected, because curl must fetch exactly the form that
+  was validated.
+
+## Fields
+
 - **budget** — what the service is configured to stay inside (free-text
   `note` records the provenance: which incident, which flag).
   - `budget.vramMiB` declares the service's *own* allocator limit (e.g.

package/docs/guides/INFERENCE_HEALTH.md

@@ -16,13 +16,55 @@ uap inference health --json         # for monitors and dashboards
 uap inference health --strict       # exit 1 on WARN or RED
 ```
 
+## Two backends, auto-detected
+
+Since 2026-10-04 the local Qwen3.8 backend is the **strata serve layer**
+(one rail, a 131072-cell int8 pool, MTP speculative decoding, no systemd
+unit). The command fetches `/metrics` once and classifies the backend: a
+JSON document with an `engine` block is strata; Prometheus text with
+`llamacpp:` counters is a llama.cpp server. `--backend llamacpp|strata`
+forces the choice.
+
+The strata path reads two sources:
+
+- **`/metrics` (JSON)** — the `engine` block gives pool size, KV kind and
+  reserve-aware free VRAM; `live` gives the in-flight request; `requests` is
+  a bounded ring of completed requests (observed: 12) with real timestamps.
+- **the serve log** (`--strata-log` or `$UAP_STRATA_LOG`, e.g.
+  `/home/cogtek/dev/strata/strata-iq3_xxs.log`) — one `strata serve: prompt
+  …` line per completed request, for the process's whole life. These lines
+  carry **no timestamps**, so samples use a monotonic line-index clock: good
+  enough for the early/recent trend split (the log is one process's life),
+  never windowable by `--since`/`--until`. A replay therefore uses the
+  timestamped ring only, **filtered to the requested window** — an unfiltered
+  ring would analyse the current process's last few requests under the
+  REPLAY banner — and honestly reports thin samples.
+
+Strata adds checks the llama.cpp path cannot have (its journal never logs
+decode rate):
+
+| Check | Code | Why it exists |
+| --- | --- | --- |
+| Decode throughput decay | `decode-decay` | Decode speed depends on prompt DEPTH, so samples bucket by depth — the same compare-like-with-like rule prefill uses. |
+| Prefix-cache failure | `cache-miss` | Strata reports reuse as a fact (`R reused`); under half the prompt served from cache means the conversation cache is not tracking. One honest 0% turn right after a client compaction does not fire it — the mean over the window must be low. |
+| VRAM headroom | `vram-headroom` | The backend's own reserve-aware free-VRAM reading, catching another process eating the card from under it. |
+
+The 2026-10-04 bug worth remembering: an *inactive* systemd unit still
+reports its `ExecStart` to `systemctl`, and the old probe trusted it — the
+dead gsq-rco unit's `-c 229376` printed as the live pool while strata served
+131072. Unit flags now count only when the unit is ACTIVE; `/slots` is the
+live geometry otherwise.
+
 ## What it looks at
 
 | Check | Code | Why it exists |
 | --- | --- | --- |
 | Prefill throughput decay | `prefill-decay` | A long-lived process can get slower without failing. Only visible when samples are bucketed by prompt size. |
-| Checkpoint starvation | `checkpoint-starved` | `--ctx-checkpoints` is **per slot**. Too few, and the checkpoint cannot track a growing conversation, so the same prefix is re-prefilled every turn. |
-| KV pinned at the VBR floor | `kv-at-floor` | The pool is saturated and the cache has silently dropped to its lowest quality tier. |
+| Checkpoint starvation | `checkpoint-starved` | `--ctx-checkpoints` is **per slot**. Too few, and the checkpoint cannot track a growing conversation, so the same prefix is re-prefilled every turn. (llama.cpp only — strata has no checkpoint allowance.) |
+| KV pinned at the VBR floor | `kv-at-floor` | The pool is saturated and the cache has silently dropped to its lowest quality tier. (llama.cpp VBR only — strata's int8 KV is a fixed tier, no floor to pin at.) |
+| Decode throughput decay | `decode-decay` | Strata: same decay question for decode, bucketed by depth. |
+| Prefix-cache failure | `cache-miss` | Strata: the conversation cache re-reading most of the prompt. |
+| VRAM headroom | `vram-headroom` | Strata: the backend's own free-VRAM reading under the floor. |
 | Client-visible timeouts | `generation-timeouts` | The symptom users actually feel, counted from the proxy journal. |
 | Window spans a restart | `spans-restart` | A trend across a restart compares two process lifetimes, not decay within one. |
 | Rail/pool geometry | `shared-pool` | Informational (never a fault). Under `--kv-unified` the pool is *shared*, so N rails each believing they own it is an overcommit waiting to happen. |
@@ -32,12 +74,18 @@ A fabricated GREEN is precisely what let the original incident run all day, so
 every probe fails open and any that could not run is listed explicitly as
 `unverified (probe unavailable)`.
 
-`UNKNOWN` requires *all three* sampled signals to be missing — no usable
-throughput trend, no checkpoint samples, and no KV reading. Losing one of them
-does not suppress the rest. An **actionable finding always wins**: timeouts are
-counted from the proxy journal and can fire with none of the sampled signals
-present, and a RED finding must never be masked by an `UNKNOWN` rollup — which
-would let it pass `--strict` with exit 0.
+`GREEN` means the sampled evidence is **present and nothing crossed a
+threshold**. An early draft required a finding to exist before the rollup
+could say GREEN — and since only multi-rail llama.cpp emits an info finding
+(`shared-pool`), a healthy single-rail or strata stack read UNKNOWN,
+indistinguishable from a blind probe for monitors parsing `--json`.
+
+`UNKNOWN` requires *all* sampled signals to be missing — no usable throughput
+trend, no checkpoint or reuse samples, no KV or VRAM reading. Losing one of
+them does not suppress the rest. An **actionable finding always wins**:
+timeouts are counted from the proxy journal and can fire with none of the
+sampled signals present, and a RED finding must never be masked by an
+`UNKNOWN` rollup — which would let it pass `--strict` with exit 0.
 
 ## Why prompt-size bucketing matters
 
@@ -99,6 +147,15 @@ one in the window. An early version did attribute the current
 `--ctx-checkpoints 4` to a window in which it had been `1`, and recommended
 the wrong remedy as a result.
 
+Strata replays have one extra rule: the ring is the only timestamped source,
+so it is **filtered to the window** — an early version analysed the current
+process's last dozen requests under the REPLAY banner. Draft records carry no
+timestamp, so a strata replay shows no acceptance rate, and an unparseable
+window expression is disclosed in `unverified (probe unavailable)` rather
+than silently widening the window. A live (non-replay) run against the serve
+log cannot apply `--since` (the log has no timestamps) and says so in the
+same list.
+
 ## Reading the output
 
 ```