@staix/agent-hub 0.22.0 → 0.23.1

package/docs/verification/2026-10-30-model-operational-settings.md

@@ -0,0 +1,211 @@
+# Model relay and inference operational settings audit
+
+H0/source audit for issue #489, task #447 (H6). Source inspected at `473d0d6363166ac8c92dfc50fcef996c03900761`. The seven-value scope and restart apply class follow the planner ruling; implementation verification is recorded separately in the PR. No tests, builds, installs, native model calls or account access were run.
+
+## Provenance and reconciliation
+
+- Frozen H0 source: `docs/verification/2026-10-24-hardcoded-values.md`; classification identities: `scripts/inventory-hardcoded-values.classifications.json`; generator: `scripts/inventory-hardcoded-values.ts`, `areaFor()`.
+- The first area rule includes `src/models/`, `src/omniroute/`, and files named `inference.ts`, `facts.ts`, `code-facts.ts`, `execution-budget.ts`. Its broad support-file grouping does not expand this card's implementation paths.
+- All 169 unique classified identities reconcile with 189 detailed H0 markdown occurrences and 169 unique location rows: 95 operational, 39 safety floor, 23 contract, 12 test seam. Repeated appearances are not extra constants.
+- Seven H0 identities consume the existing H1 descriptor/schema/settings/default-pin mechanism; 162 are excluded from the current scope. Two of the seven are metadata registration of already configurable digest thresholds, not new controls.
+- Frozen coordinates below identify H0 evidence, not current source line numbers. A tuple repeated under several contexts lists all matching frozen coordinates; stable JSON context/occurrence remains the identity.
+
+## Approved conversion scope
+
+| H0 identity | Default and bounds | Apply point |
+| --- | --- | --- |
+| relay COOLDOWN_FAILURES | 3; integer 1..100 | Restart; capture at relay creation |
+| relay COOLDOWN_MS | 30 seconds; integer 1..300 seconds | Restart; capture at relay creation; same value controls failing-window exclusion |
+| relay COOLDOWN_CAP_MS | 300 seconds; integer 300..3600 seconds | Restart; capture at relay creation; fixed factor2 and twice-cap streak reset derive from it |
+| relay JOURNAL_LIMIT | 1000 rows; integer 1..1000 | Restart; capture at relay creation; terminal close prunes, never in-flight evidence |
+| inference BACKOFF_MS | 5 minutes; integer 1..60 minutes | Restart-bound Inference configuration; capture offUntil at failure, preserve interactive exemption |
+| inference.digest_min_items | Existing5; existing integer 1..100000 | Reuse existing restart-bound InferenceConfig and H1 row, no parallel key |
+| inference.digest_min_chars | Existing8000; existing integer 1..10000000 | Reuse existing restart-bound InferenceConfig and H1 row, no parallel key |
+
+The new leaves are `model_relay.cooldown_failures`, `model_relay.cooldown_s`, `model_relay.cooldown_cap_s`, `model_relay.terminal_history_limit` and `inference.backoff_min`. All seven descriptors require daemon restart. No new configuration file, environment knob, per-call override or conductor authority is added.
+
+## Caller and contract constraints
+
+- `src/models/relay.ts:upstream` acquires MLX startup/slot or gateway base before constructing its180s upstream timer. `MlxHandle.acquire` defaults120s. Bun relay idleTimeout remains255s, so240s is not justified by subtracting from255;120+240 already exceeds255 without startup/probe work. The current scope leaves REQUEST_DEADLINE_MS fixed. Execution remainingMs still clamps downward; do not change budget/move cut classification.
+- A relay is cached in daemon `modelRelays` and is closed at daemon shutdown, not at each native peer restart. "Capture at relay creation" must not be documented as "next peer start" unless lifecycle changes explicitly recreate it. Existing cooldown until timestamps and in-flight deadlines must not be retimed by reload.
+- The ordinary inference default8s is already an injectable dependency/helper deadline. Screen8+triage8+brief4 is the documented20s proposal chain under the30s plugin caller. The planner refused an8..10s range because it reopens the fixed control budgets. Interactive ask45s and split60s keep their trusted overrides, allowed checks and campus-only transport.
+- PII screen8s/device share0.6/32-token outputs are a coupled fail-closed privacy policy. Keep onCampus positive proof, device-slot cancellation, unknown-as-PII, input/summary bounds, request generation and served-model identity unchanged.
+- Model-routing weights/windows/state eviction need their existing provenance/promotion owner. Existing mlx and routing budget keys remain authoritative; duplicate fallback literals are not separate knobs.
+
+## Complete H0 identity ledger
+
+| Stable classification identity | Frozen H0 location(s) | H0 class | H6 disposition | Specific reason |
+| --- | --- | --- | --- | --- |
+| `src/hub/code-facts.ts:<anonymous>:inline:control.length>64=64#0` | src/hub/code-facts.ts:131:70 | operational | Excluded: code-facts proof safety | control.length>64 bounds filter-environment keys, control-channel framing or enclosing-symbol chain before accepting native evidence. H0 operational label does not permit weakening parser/provenance proof. |
+| `src/hub/code-facts.ts:<anonymous>:inline:node.children.length>32=32#0` | src/hub/code-facts.ts:201:177 | operational | Excluded: code-facts proof safety | node.children.length>32 bounds filter-environment keys, control-channel framing or enclosing-symbol chain before accepting native evidence. H0 operational label does not permit weakening parser/provenance proof. |
+| `src/hub/code-facts.ts:MAX_FILES:constant:MAX_FILES=4096#0` | src/hub/code-facts.ts:27:51 | operational | Excluded: code-facts support follow-up | MAX_FILES bounds optional code-evidence inventory (4096); overflow yields unknown, never partial known. Outside accepted model/inference source paths; preserve completeness/host ceilings for separate bounded-evidence review. |
+| `src/hub/code-facts.ts:MAX_OUTPUT:constant:MAX_OUTPUT=256 * 1024#0` | src/hub/code-facts.ts:27:7 | safety floor | Excluded: code-facts input/resource safety | MAX_OUTPUT/MAX_OUTPUT bounds native output, tree/file bytes, XML count/depth, cached queries or symbol text; outside task paths and not loosenable through model settings. |
+| `src/hub/code-facts.ts:MAX_SYMBOLS:constant:MAX_SYMBOLS=256#0` | src/hub/code-facts.ts:27:32 | operational | Excluded: code-facts support follow-up | MAX_SYMBOLS bounds optional code-evidence inventory (256); overflow yields unknown, never partial known. Outside accepted model/inference source paths; preserve completeness/host ceilings for separate bounded-evidence review. |
+| `src/hub/code-facts.ts:MAX_TREE_BYTES:constant:MAX_TREE_BYTES=32 * 1024 * 1024#0` | src/hub/code-facts.ts:27:69 | safety floor | Excluded: code-facts input/resource safety | MAX_TREE_BYTES/MAX_TREE_BYTES bounds native output, tree/file bytes, XML count/depth, cached queries or symbol text; outside task paths and not loosenable through model settings. |
+| `src/hub/code-facts.ts:changed:inline:a.at.length<9=9#0` | src/hub/code-facts.ts:62:165 | contract | Excluded: code-facts framing contract | changed/a.at.length<9 fixes minimum abbreviated SHA length or newline byte delimiter; leave parser/wire format unchanged. |
+| `src/hub/code-facts.ts:changed:inline:a.base_sha.length<9=9#0` | src/hub/code-facts.ts:62:235 | contract | Excluded: code-facts framing contract | changed/a.base_sha.length<9 fixes minimum abbreviated SHA length or newline byte delimiter; leave parser/wire format unchanged. |
+| `src/hub/code-facts.ts:end:inline:bytes.indexOf=10#0` | src/hub/code-facts.ts:160:33 | contract | Excluded: code-facts framing contract | end/bytes.indexOf fixes minimum abbreviated SHA length or newline byte delimiter; leave parser/wire format unchanged. |
+| `src/hub/code-facts.ts:finish:inline:Bun.sleep=500#0` | src/hub/code-facts.ts:120:74 | operational | Excluded: code-facts owned cleanup | finish/Bun.sleep controls verified ripwire child shutdown/pipe cleanup; outside model task paths, preserve retained child handle until cleanup is confirmed. |
+| `src/hub/code-facts.ts:killMs:inline:killMs=500#0` | src/hub/code-facts.ts:90:83, src/hub/code-facts.ts:122:71 | operational | Excluded: code-facts owned cleanup | killMs/killMs controls verified ripwire child shutdown/pipe cleanup; outside model task paths, preserve retained child handle until cleanup is confirmed. |
+| `src/hub/code-facts.ts:killMs:inline:killMs=500#1` | src/hub/code-facts.ts:90:83, src/hub/code-facts.ts:122:71 | operational | Excluded: code-facts owned cleanup | killMs/killMs controls verified ripwire child shutdown/pipe cleanup; outside model task paths, preserve retained child handle until cleanup is confirmed. |
+| `src/hub/code-facts.ts:nativeEnv:inline:keys.length>128=128#0` | src/hub/code-facts.ts:104:20 | operational | Excluded: code-facts proof safety | keys.length>128 bounds filter-environment keys, control-channel framing or enclosing-symbol chain before accepting native evidence. H0 operational label does not permit weakening parser/provenance proof. |
+| `src/hub/code-facts.ts:neighbours:inline:depth=1#0` | src/hub/code-facts.ts:222:58 | contract | Excluded: code graph hop contract | Defaultdepth1 is the implemented one-hop graph query semantics; no deeper traversal claim or new authority in H6. |
+| `src/hub/code-facts.ts:query:inline:this.cache.size>128=128#0` | src/hub/code-facts.ts:189:24 | safety floor | Excluded: code-facts input/resource safety | query/this.cache.size>128 bounds native output, tree/file bytes, XML count/depth, cached queries or symbol text; outside task paths and not loosenable through model settings. |
+| `src/hub/code-facts.ts:relations:inline:includes=0#0` | src/hub/code-facts.ts:207:227 | contract | Excluded: code graph wire contract | 0/1/false/true counts_floor enumeration and positive unique definition count are ripwire wire proof, not runtime thresholds; ambiguity remains unknown. |
+| `src/hub/code-facts.ts:relations:inline:includes=1#0` | src/hub/code-facts.ts:207:229 | operational | Excluded: code graph wire contract | 0/1/false/true counts_floor enumeration and positive unique definition count are ripwire wire proof, not runtime thresholds; ambiguity remains unknown. |
+| `src/hub/code-facts.ts:relations:inline:v.defs<1=1#0` | src/hub/code-facts.ts:207:63 | contract | Excluded: code graph wire contract | 0/1/false/true counts_floor enumeration and positive unique definition count are ripwire wire proof, not runtime thresholds; ambiguity remains unknown. |
+| `src/hub/code-facts.ts:termMs:inline:termMs=50#0` | src/hub/code-facts.ts:90:73, src/hub/code-facts.ts:122:61 | operational | Excluded: code-facts owned cleanup | termMs/termMs controls verified ripwire child shutdown/pipe cleanup; outside model task paths, preserve retained child handle until cleanup is confirmed. |
+| `src/hub/code-facts.ts:termMs:inline:termMs=50#1` | src/hub/code-facts.ts:90:73, src/hub/code-facts.ts:122:61 | operational | Excluded: code-facts owned cleanup | termMs/termMs controls verified ripwire child shutdown/pipe cleanup; outside model task paths, preserve retained child handle until cleanup is confirmed. |
+| `src/hub/code-facts.ts:text:inline:cap=512#0` | src/hub/code-facts.ts:29:33 | safety floor | Excluded: code-facts input/resource safety | text/cap bounds native output, tree/file bytes, XML count/depth, cached queries or symbol text; outside task paths and not loosenable through model settings. |
+| `src/hub/code-facts.ts:timeout:inline:timeout=5000#0` | src/hub/code-facts.ts:96:121, src/hub/code-facts.ts:156:188 | operational | Excluded: code-facts bounded host seam | 5s Git/native operation ceiling (with existing options.timeoutMs clamped1..5000) bounds optional evidence work. Outside model task paths; do not create model timing control for Git/proof execution. |
+| `src/hub/code-facts.ts:timeout:inline:timeout=5000#1` | src/hub/code-facts.ts:96:121, src/hub/code-facts.ts:156:188 | operational | Excluded: code-facts bounded host seam | 5s Git/native operation ceiling (with existing options.timeoutMs clamped1..5000) bounds optional evidence work. Outside model task paths; do not create model timing control for Git/proof execution. |
+| `src/hub/code-facts.ts:timer:inline:Math.max=1#0` | src/hub/code-facts.ts:127:46 | operational | Excluded: code-facts bounded host seam | 5s Git/native operation ceiling (with existing options.timeoutMs clamped1..5000) bounds optional evidence work. Outside model task paths; do not create model timing control for Git/proof execution. |
+| `src/hub/code-facts.ts:timer:inline:Math.min=5000#0` | src/hub/code-facts.ts:127:57 | operational | Excluded: code-facts bounded host seam | 5s Git/native operation ceiling (with existing options.timeoutMs clamped1..5000) bounds optional evidence work. Outside model task paths; do not create model timing control for Git/proof execution. |
+| `src/hub/code-facts.ts:timer:inline:this.options.timeoutMs ?? 5000=5000#0` | src/hub/code-facts.ts:127:88 | operational | Excluded: code-facts bounded host seam | 5s Git/native operation ceiling (with existing options.timeoutMs clamped1..5000) bounds optional evidence work. Outside model task paths; do not create model timing control for Git/proof execution. |
+| `src/hub/code-facts.ts:tree:inline:size>4*1024*1024=4*1024*1024#0` | src/hub/code-facts.ts:162:17 | safety floor | Excluded: code-facts input/resource safety | tree/size>4*1024*1024 bounds native output, tree/file bytes, XML count/depth, cached queries or symbol text; outside task paths and not loosenable through model settings. |
+| `src/hub/code-facts.ts:xml:inline:++count>4096=4096#0` | src/hub/code-facts.ts:42:81 | safety floor | Excluded: code-facts input/resource safety | xml/++count>4096 bounds native output, tree/file bytes, XML count/depth, cached queries or symbol text; outside task paths and not loosenable through model settings. |
+| `src/hub/code-facts.ts:xml:inline:stack.length>16=16#0` | src/hub/code-facts.ts:42:102 | safety floor | Excluded: code-facts input/resource safety | xml/stack.length>16 bounds native output, tree/file bytes, XML count/depth, cached queries or symbol text; outside task paths and not loosenable through model settings. |
+| `src/hub/execution-budget.ts:configure:inline:input.id.length > 200=200#0` | src/hub/execution-budget.ts:55:40 | operational | Excluded: execution admission identity safety | 200-character execution budget id bound validates task/run ledger identity. H0 operational label is not a tunable spending budget; keep admission schema unchanged. |
+| `src/hub/facts.ts:EXPANDED_KEPT:constant:EXPANDED_KEPT=200#0` | src/hub/facts.ts:52:7 | operational | Excluded: facts support owner | 200 directory-expanded files bounds coverage and reports truncated expansion; outside model task paths. |
+| `src/hub/facts.ts:HASHED_BYTES:constant:HASHED_BYTES=64 * 1024 * 1024#0` | src/hub/facts.ts:26:7 | safety floor | Excluded: facts safety bound | HASHED_BYTES/HASHED_BYTES caps input file/hash bytes or pending pre-tool snapshots; preserve bounded privacy-screened facts evidence, outside model task paths. |
+| `src/hub/facts.ts:MAX_BYTES:constant:MAX_BYTES=256 * 1024#0` | src/hub/facts.ts:24:7 | safety floor | Excluded: facts safety bound | MAX_BYTES/MAX_BYTES caps input file/hash bytes or pending pre-tool snapshots; preserve bounded privacy-screened facts evidence, outside model task paths. |
+| `src/hub/facts.ts:MAX_LINES:constant:MAX_LINES=60#0` | src/hub/facts.ts:44:14 | operational | Excluded: facts support owner | 60 changed lines is advisory fact rendering capacity; outside model task paths, future facts settings must preserve omitted counts. |
+| `src/hub/facts.ts:NAMES_SHOWN:constant:NAMES_SHOWN=20#0` | src/hub/facts.ts:54:7 | operational | Excluded: facts support owner | 20 displayed names preserves explicit remaining-count reporting; outside model task paths. |
+| `src/hub/facts.ts:OFFERS_KEPT:constant:OFFERS_KEPT=8#0` | src/hub/facts.ts:55:7 | operational | Excluded: facts support owner | 8 pending fact offers bounds acknowledgement history; changing it affects replay/ack evidence, outside model task paths. |
+| `src/hub/facts.ts:RACY_BURST_BYTES:constant:RACY_BURST_BYTES=16 * 1024 * 1024#0` | src/hub/facts.ts:42:7 | operational | Excluded: facts support owner | 16MiB per-event-loop hash budget protects daemon responsiveness; do not loosen it as an inference budget. |
+| `src/hub/facts.ts:RACY_HASH_MAX_BYTES:constant:RACY_HASH_MAX_BYTES=4 * 1024 * 1024#0` | src/hub/facts.ts:41:7 | operational | Excluded: facts support owner | 4MiB per-file hash cap bounds synchronous host hashing; past the cap evidence remains stat-only/unknown. |
+| `src/hub/facts.ts:RACY_MS:constant:RACY_MS=2000#0` | src/hub/facts.ts:40:7 | operational | Excluded: facts support owner | 2s racy stat window covers coarse filesystem timestamps; lowering it can miss same-size rewrites, not a model timer. |
+| `src/hub/facts.ts:READ_LINES:constant:READ_LINES=2000#0` | src/hub/facts.ts:46:7 | operational | Excluded: facts support owner | 2000 lines mirrors native Claude Read default, used to determine known-complete read evidence. |
+| `src/hub/facts.ts:READ_LINE_CHARS:constant:READ_LINE_CHARS=2000#0` | src/hub/facts.ts:47:7 | operational | Excluded: facts support owner | 2000 characters per line mirrors native Claude Read truncation, used for evidence completeness. |
+| `src/hub/facts.ts:TOUCHED_KEPT:constant:TOUCHED_KEPT=64#0` | src/hub/facts.ts:49:7 | operational | Excluded: facts support owner | 64 tracked files bounds peer facts coverage and unknown/evicted warnings; outside model task paths. |
+| `src/hub/facts.ts:TRANSITIONS_KEPT:constant:TRANSITIONS_KEPT=64#0` | src/hub/facts.ts:50:7 | operational | Excluded: facts support owner | 64 transitions bounds effect attribution history and explicitly records evicted evidence; outside model task paths. |
+| `src/hub/facts.ts:preTool:inline:this.before.size > 256=256#0` | src/hub/facts.ts:548:30 | safety floor | Excluded: facts safety bound | preTool/this.before.size > 256 caps input file/hash bytes or pending pre-tool snapshots; preserve bounded privacy-screened facts evidence, outside model task paths. |
+| `src/hub/facts.ts:timeout:inline:timeout=3000#0` | src/hub/facts.ts:226:182 | operational | Excluded: facts support owner | 3s bounds Git check-ignore metadata read before fact capture; outside model task paths. |
+| `src/hub/facts.ts:wrote:inline:[...(files.get(file) ?? []), Date.now()].slice=-16#0` | src/hub/facts.ts:311:68 | operational | Excluded: facts support owner | Last16 write timestamps support effect attribution; retention changes evidence coverage, outside model task paths. |
+| `src/hub/inference.ts:<anonymous>:inline:e.id.slice=8#0` | src/hub/inference.ts:105:152 | contract | Excluded: envelope identity display | 8-character envelope source prefix is the digest identity display contract; never reinterpret it as retention or routing policy. |
+| `src/hub/inference.ts:BACKOFF_MS:constant:BACKOFF_MS=5 * 60000#0` | src/hub/inference.ts:22:7 | operational | Registered H1 value | Optional inference failure backoff: default5min, bounds1..60min. Existing Inference captures cfg at daemon start, so apply class restart; never rewrite an already scheduled offUntil or apply to interactive calls. |
+| `src/hub/inference.ts:DEVICE_SHARE:constant:DEVICE_SHARE=0.6#0` | src/hub/inference.ts:186:7 | operational | Excluded: PII screen policy | Fixed8s screen deadline,0.6 device share and32-token closed-verdict calls preserve privacy handoff and proposal latency. Failures remain unknown/PII; do not expose ordinary inference timing or output controls here. |
+| `src/hub/inference.ts:SCREEN_MAX_BYTES:constant:SCREEN_MAX_BYTES=6000#0` | src/hub/inference.ts:192:14 | safety floor | Excluded: inference privacy/input bound | SCREEN_MAX_BYTES/SCREEN_MAX_BYTES bounds model input, sanitized backoff reason or rendered summary text. Keep original6000 bound; no loosenable privacy/output cap. |
+| `src/hub/inference.ts:SCREEN_TIMEOUT_MS:constant:SCREEN_TIMEOUT_MS=8000#0` | src/hub/inference.ts:184:7 | operational | Excluded: PII screen policy | Fixed8s screen deadline,0.6 device share and32-token closed-verdict calls preserve privacy handoff and proposal latency. Failures remain unknown/PII; do not expose ordinary inference timing or output controls here. |
+| `src/hub/inference.ts:SUMMARY_CAP:constant:SUMMARY_CAP=1500#0` | src/hub/inference.ts:23:7 | safety floor | Excluded: inference privacy/input bound | SUMMARY_CAP/SUMMARY_CAP bounds model input, sanitized backoff reason or rendered summary text. Keep original1500 bound; no loosenable privacy/output cap. |
+| `src/hub/inference.ts:TIMEOUT_MS:constant:TIMEOUT_MS=8000#0` | src/hub/inference.ts:21:7 | operational | Excluded: outer deadline and existing seam | Default8s complete deadline already has InferenceDeps.timeoutMs and trusted complete options; screen8+triage8+brief4 fits plugin30s. Proposed8..10s would fit documented22s chain but requires explicit ruling; keep8s for current scope. Interactive ask45s and split60s retain their overrides. |
+| `src/hub/inference.ts:backOff:inline:why.slice=120#0` | src/hub/inference.ts:67:79 | safety floor | Excluded: inference privacy/input bound | backOff/why.slice bounds model input, sanitized backoff reason or rendered summary text. Keep original120 bound; no loosenable privacy/output cap. |
+| `src/hub/inference.ts:complete:inline:this.backOff=1000#0` | src/hub/inference.ts:60:99 | contract | Excluded: unit conversion contract | 1000 converts milliseconds into seconds in diagnostic text; it is not an independent timeout. |
+| `src/hub/inference.ts:detail:inline:detail.slice=2000#0` | src/hub/inference.ts:123:76 | safety floor | Excluded: inference privacy/input bound | detail/detail.slice bounds model input, sanitized backoff reason or rendered summary text. Keep original2000 bound; no loosenable privacy/output cap. |
+| `src/hub/inference.ts:digest_min_chars:inline:digest_min_chars=8000#0` | src/hub/inference.ts:16:107 | operational | Registered existing leaf | Already configurable in InferenceConfig. Register its existing key/default/bounds through H1, not a new control: digest_min_items5 (1..100000), digest_min_chars8000 (1..10000000); preserve existing restart-bound cfg and strict greater-than trigger. |
+| `src/hub/inference.ts:digest_min_items:inline:digest_min_items=5#0` | src/hub/inference.ts:16:86 | operational | Registered existing leaf | Already configurable in InferenceConfig. Register its existing key/default/bounds through H1, not a new control: digest_min_items5 (1..100000), digest_min_chars8000 (1..10000000); preserve existing restart-bound cfg and strict greater-than trigger. |
+| `src/hub/inference.ts:max_tokens:inline:max_tokens=32#0` | src/hub/inference.ts:236:82, src/hub/inference.ts:254:75 | operational | Excluded: PII screen policy | Fixed8s screen deadline,0.6 device share and32-token closed-verdict calls preserve privacy handoff and proposal latency. Failures remain unknown/PII; do not expose ordinary inference timing or output controls here. |
+| `src/hub/inference.ts:max_tokens:inline:max_tokens=32#1` | src/hub/inference.ts:236:82, src/hub/inference.ts:254:75 | operational | Excluded: PII screen policy | Fixed8s screen deadline,0.6 device share and32-token closed-verdict calls preserve privacy handoff and proposal latency. Failures remain unknown/PII; do not expose ordinary inference timing or output controls here. |
+| `src/hub/inference.ts:text:inline:e.body.slice=4000#0` | src/hub/inference.ts:101:90 | safety floor | Excluded: inference privacy/input bound | text/e.body.slice bounds model input, sanitized backoff reason or rendered summary text. Keep original4000 bound; no loosenable privacy/output cap. |
+| `src/hub/inference.ts:title:inline:title.slice=500#0` | src/hub/inference.ts:123:46 | safety floor | Excluded: inference privacy/input bound | title/title.slice bounds model input, sanitized backoff reason or rendered summary text. Keep original500 bound; no loosenable privacy/output cap. |
+| `src/models/mlx.ts:GENERATION_DB_BUSY_TIMEOUT_MS:constant:GENERATION_DB_BUSY_TIMEOUT_MS=100#0` | src/models/mlx.ts:76:7 | operational | Excluded: slot database contention guard | 100ms synchronous SQLite busy ceiling is fixed per database opening and supports crash-safe shared generation ownership; do not loosen event-loop/slot-lock blocking through H6. |
+| `src/models/mlx.ts:acquireGeneration:inline:maxConcurrency < 1=1#0` | src/models/mlx.ts:247:61 | contract | Excluded: slot schema minimum | maxConcurrency minimum1 is a validity condition for the slot ledger; never configure zero or claim absent capacity. |
+| `src/models/mlx.ts:acquireGeneration:inline:waitMs=120_000#0` | src/models/mlx.ts:246:187 | test seam | Excluded: existing slot seam | acquireGeneration waitMs defaults120s and is already supplied by acquire(signal, waitMs); cancellation reaches slot wait. Keep existing host/test seam and no new per-call override. |
+| `src/models/mlx.ts:ensureMlx:inline:AbortSignal.timeout=500#0` | src/models/mlx.ts:375:58, src/models/mlx.ts:409:49 | operational | Excluded: bounded MLX readiness observation | 500ms startup health probes,100ms polling and1s inspect health probe are coupled readiness mechanics, not independent model deadlines.100 attempts can await probes as well as sleeps; raising them would invalidate caller assumptions and no owner proof may be bypassed. |
+| `src/models/mlx.ts:ensureMlx:inline:AbortSignal.timeout=500#1` | src/models/mlx.ts:375:58, src/models/mlx.ts:409:49 | operational | Excluded: bounded MLX readiness observation | 500ms startup health probes,100ms polling and1s inspect health probe are coupled readiness mechanics, not independent model deadlines.100 attempts can await probes as well as sleeps; raising them would invalidate caller assumptions and no owner proof may be bypassed. |
+| `src/models/mlx.ts:ensureMlx:inline:Bun.sleep=100#0` | src/models/mlx.ts:376:23, src/models/mlx.ts:421:23 | operational | Excluded: bounded MLX readiness observation | 500ms startup health probes,100ms polling and1s inspect health probe are coupled readiness mechanics, not independent model deadlines.100 attempts can await probes as well as sleeps; raising them would invalidate caller assumptions and no owner proof may be bypassed. |
+| `src/models/mlx.ts:ensureMlx:inline:Bun.sleep=100#1` | src/models/mlx.ts:376:23, src/models/mlx.ts:421:23 | operational | Excluded: bounded MLX readiness observation | 500ms startup health probes,100ms polling and1s inspect health probe are coupled readiness mechanics, not independent model deadlines.100 attempts can await probes as well as sleeps; raising them would invalidate caller assumptions and no owner proof may be bypassed. |
+| `src/models/mlx.ts:healthy:inline:AbortSignal.timeout=1_000#0` | src/models/mlx.ts:341:84 | operational | Excluded: bounded MLX readiness observation | 500ms startup health probes,100ms polling and1s inspect health probe are coupled readiness mechanics, not independent model deadlines.100 attempts can await probes as well as sleeps; raising them would invalidate caller assumptions and no owner proof may be bypassed. |
+| `src/models/mlx.ts:maxConcurrency:inline:options.maxConcurrency ?? 1=1#0` | src/models/mlx.ts:331:52, src/models/mlx.ts:355:52 | operational | Excluded: existing MLX config | Fallback1 concurrency and16000 input tokens already use options.maxConcurrency/maxInputTokens, supplied by mlx config. Duplicate occurrences are inspect/start defaults, not independent controls. |
+| `src/models/mlx.ts:maxConcurrency:inline:options.maxConcurrency ?? 1=1#1` | src/models/mlx.ts:331:52, src/models/mlx.ts:355:52 | operational | Excluded: existing MLX config | Fallback1 concurrency and16000 input tokens already use options.maxConcurrency/maxInputTokens, supplied by mlx config. Duplicate occurrences are inspect/start defaults, not independent controls. |
+| `src/models/mlx.ts:maxInputTokens:inline:options.maxInputTokens ?? 16_000=16_000#0` | src/models/mlx.ts:330:52, src/models/mlx.ts:354:52 | operational | Excluded: existing MLX config | Fallback1 concurrency and16000 input tokens already use options.maxConcurrency/maxInputTokens, supplied by mlx config. Duplicate occurrences are inspect/start defaults, not independent controls. |
+| `src/models/mlx.ts:maxInputTokens:inline:options.maxInputTokens ?? 16_000=16_000#1` | src/models/mlx.ts:330:52, src/models/mlx.ts:354:52 | operational | Excluded: existing MLX config | Fallback1 concurrency and16000 input tokens already use options.maxConcurrency/maxInputTokens, supplied by mlx config. Duplicate occurrences are inspect/start defaults, not independent controls. |
+| `src/models/mlx.ts:timer:inline:setTimeout=50#0` | src/models/mlx.ts:268:50 | operational | Excluded: cancellation-aware slot polling | 50ms retries acquisition under the caller signal and existing wait deadline; retain bounded shared-slot contention without new polling policy. |
+| `src/models/mlx.ts:waitForExit:inline:Bun.sleep=50#0` | src/models/mlx.ts:282:21 | operational | Excluded: owner cleanup observation | 50ms observes verified native owner disappearance during bounded stop; retain process signature/liveness proof and cleanup bound. |
+| `src/models/ollama.ts:DEFAULT_CONCURRENCY:constant:DEFAULT_CONCURRENCY=1#0` | src/models/ollama.ts:13:7 | test seam | Excluded: existing runtime seam | DEFAULT_CONCURRENCY1 is already overridden by options.maxConcurrency and H0 classifies the default as a seam. |
+| `src/models/ollama.ts:DEFAULT_INPUT:constant:DEFAULT_INPUT=6000#0` | src/models/ollama.ts:11:7 | operational | Excluded: existing Ollama/MLX config | Defaults6000 input,2048 output,8192 context already use mlx.maxInputTokens/maxTokens/contextWindow; preserve positive bounds and input+output<=context validation. |
+| `src/models/ollama.ts:DEFAULT_OUTPUT:constant:DEFAULT_OUTPUT=2048#0` | src/models/ollama.ts:12:7 | operational | Excluded: existing Ollama/MLX config | Defaults6000 input,2048 output,8192 context already use mlx.maxInputTokens/maxTokens/contextWindow; preserve positive bounds and input+output<=context validation. |
+| `src/models/ollama.ts:DEFAULT_PORT:constant:DEFAULT_PORT=11434#0` | src/models/ollama.ts:8:7 | contract | Excluded: native endpoint/schema contract | DEFAULT_PORT/DEFAULT_PORT is port11434 or positive context/input/output/concurrency/port-range validation; preserve native transport and model budget contracts. |
+| `src/models/ollama.ts:assertModel:inline:model.length > 256=256#0` | src/models/ollama.ts:39:32 | safety floor | Excluded: local model name safety | 256-character name bound plus slash/cloud/URL refusal prevents selecting remote model paths; leave fixed. |
+| `src/models/ollama.ts:contextWindow:inline:options.contextWindow ?? 8192=8192#0` | src/models/ollama.ts:48:50 | operational | Excluded: existing Ollama/MLX config | Defaults6000 input,2048 output,8192 context already use mlx.maxInputTokens/maxTokens/contextWindow; preserve positive bounds and input+output<=context validation. |
+| `src/models/ollama.ts:signal:inline:AbortSignal.timeout=2_000#0` | src/models/ollama.ts:75:125 | operational | Excluded: model locality/metadata proof | 2s per-loopback request bounds tags/ps/show inspections used to prove local model availability, recipe context and no cloud indirection; no loosenable proof timeout in current scope. |
+| `src/models/ollama.ts:validateOllamaOptions:inline:contextWindow < 1=1#0` | src/models/ollama.ts:55:59 | contract | Excluded: native endpoint/schema contract | validateOllamaOptions/contextWindow < 1 is port11434 or positive context/input/output/concurrency/port-range validation; preserve native transport and model budget contracts. |
+| `src/models/ollama.ts:validateOllamaOptions:inline:maxConcurrency < 1=1#0` | src/models/ollama.ts:58:61 | contract | Excluded: native endpoint/schema contract | validateOllamaOptions/maxConcurrency < 1 is port11434 or positive context/input/output/concurrency/port-range validation; preserve native transport and model budget contracts. |
+| `src/models/ollama.ts:validateOllamaOptions:inline:maxInputTokens < 1=1#0` | src/models/ollama.ts:57:61 | contract | Excluded: native endpoint/schema contract | validateOllamaOptions/maxInputTokens < 1 is port11434 or positive context/input/output/concurrency/port-range validation; preserve native transport and model budget contracts. |
+| `src/models/ollama.ts:validateOllamaOptions:inline:maxTokens < 1=1#0` | src/models/ollama.ts:56:51 | contract | Excluded: native endpoint/schema contract | validateOllamaOptions/maxTokens < 1 is port11434 or positive context/input/output/concurrency/port-range validation; preserve native transport and model budget contracts. |
+| `src/models/ollama.ts:validateOllamaOptions:inline:port > 65535=65535#0` | src/models/ollama.ts:54:53 | contract | Excluded: native endpoint/schema contract | validateOllamaOptions/port > 65535 is port11434 or positive context/input/output/concurrency/port-range validation; preserve native transport and model budget contracts. |
+| `src/models/relay.ts:COOLDOWN_CAP_MS:constant:COOLDOWN_CAP_MS=300000#0` | src/models/relay.ts:211:52 | operational | Registered H1 value | 300s exponential cooldown cap, bounds300..3600s; twice this cap remains the failure-streak age reset. Capture primitive policy at relay creation; retain counted failure classes, HTTP-answer reset and fixed factor2 recurrence. |
+| `src/models/relay.ts:COOLDOWN_FAILURES:constant:COOLDOWN_FAILURES=3#0` | src/models/relay.ts:211:7 | operational | Registered H1 value | 3 consecutive qualifying transport/startup failures, bounds1..100. Capture primitive policy at relay creation; retain counted failure classes, HTTP-answer reset and fixed factor2 recurrence. |
+| `src/models/relay.ts:COOLDOWN_MS:constant:COOLDOWN_MS=30000#0` | src/models/relay.ts:211:30 | operational | Registered H1 value | 30s base/failing window, bounds1..300s; also controls failed-dispatch load exclusion. Capture primitive policy at relay creation; retain counted failure classes, HTTP-answer reset and fixed factor2 recurrence. |
+| `src/models/relay.ts:JOURNAL_LIMIT:inline:JOURNAL_LIMIT=1000#0` | src/models/relay.ts:441:25 | operational | Registered H1 value | Closed request metadata history default1000, bounds1..1000. Capture at relay creation; prune on terminal close only, preserving per-request identity and onRequest notification for every closed record. |
+| `src/models/relay.ts:MOVE_FIRST_BYTE_MS:constant:MOVE_FIRST_BYTE_MS=15000#0` | src/models/relay.ts:216:7 | operational | Excluded: existing host seam and measured move policy | Existing ModelRelayOptions.moveFirstByteMs default15s already injectable; applies only response headers of opt-in moved attempts after base discovery. Preserve #199 measurement/underBudget suppression; no duplicate setting in current scope. |
+| `src/models/relay.ts:REQUEST_DEADLINE_MS:constant:REQUEST_DEADLINE_MS=180000#0` | src/models/relay.ts:213:7 | operational | Excluded: chained request deadline | 180s timer starts after MLX startup/slot acquisition or gateway discovery. Fixed255s HTTP idle setting cannot justify180..240: default120s slot wait alone plus240s exceeds it. Keep fixed pending a coordinated end-to-end budget design; existing execution remainingMs still clamps downward. |
+| `src/models/relay.ts:SURFACE_CAP:constant:SURFACE_CAP=64#0` | src/models/relay.ts:74:7 | safety floor | Excluded: relay metadata/input safety | SURFACE_CAP/SURFACE_CAP bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep64 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:canonical:inline:++nodes > 8192=8192#0` | src/models/relay.ts:86:19 | safety floor | Excluded: relay metadata/input safety | canonical/++nodes > 8192 bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep8192 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:canonical:inline:depth > 20=20#0` | src/models/relay.ts:86:35 | safety floor | Excluded: relay metadata/input safety | canonical/depth > 20 bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep20 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:canonical:inline:keys.length > 256=256#0` | src/models/relay.ts:97:25 | safety floor | Excluded: relay metadata/input safety | canonical/keys.length > 256 bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep256 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:canonical:inline:keys.slice=256#0` | src/models/relay.ts:98:47 | safety floor | Excluded: relay metadata/input safety | canonical/keys.slice bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep256 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:canonical:inline:value.length > 256=256#0` | src/models/relay.ts:91:26 | safety floor | Excluded: relay metadata/input safety | canonical/value.length > 256 bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep256 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:canonical:inline:value.length > 8192=8192#0` | src/models/relay.ts:89:57 | safety floor | Excluded: relay metadata/input safety | canonical/value.length > 8192 bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep8192 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:configuredMaxTokens:inline:options.mlx?.maxTokens ?? 2048=2048#0` | src/models/relay.ts:645:71 | operational | Excluded: existing MLX config | Fallback2048 output,8192 context and provider-specific6000/16000 input already come from mlx.maxTokens/contextWindow/maxInputTokens. Preserve context sum checks and caller max_tokens; do not create parallel defaults. |
+| `src/models/relay.ts:contextWindow:inline:options.mlx?.contextWindow ?? 8192=8192#0` | src/models/relay.ts:644:69 | operational | Excluded: existing MLX config | Fallback2048 output,8192 context and provider-specific6000/16000 input already come from mlx.maxTokens/contextWindow/maxInputTokens. Preserve context sum checks and caller max_tokens; do not create parallel defaults. |
+| `src/models/relay.ts:deadline:inline:Math.max=1#0` | src/models/relay.ts:565:93 | operational | Excluded: minimum timer clamp | Math.max1 is the positive minimum when execution budget remainingMs bounds a request; never turn an exhausted/unknown budget into extra time. |
+| `src/models/relay.ts:dgxMaxInputTokens:inline:options.dgxMaxInputTokens ?? 262_144=262_144#0` | src/models/relay.ts:428:58 | operational | Excluded: existing routing config | 262144 input fallback is already supplied from routing.pi.dgx_max_context_tokens by daemon; keep that authority and provider context constraints. |
+| `src/models/relay.ts:failed:inline:this.now() - entry.countedAt > 2 * COOLDOWN_CAP_MS=2 * COOLDOWN_CAP_MS#0` | src/models/relay.ts:247:73 | operational | Excluded: derived cooldown arithmetic | Twice the cooldown cap ages out old streaks; factor2 is exponential recurrence. Follow selected cap/threshold as arithmetic, never expose a second independently configurable multiplier. |
+| `src/models/relay.ts:fetch:inline:(requestedMaxTokens as number) < 1=1#0` | src/models/relay.ts:647:96 | contract | Excluded: request schema contract | Positive max_tokens minimum1 is request validation, not an operational output default. |
+| `src/models/relay.ts:idleTimeout:inline:idleTimeout=255#0` | src/models/relay.ts:607:18 | operational | Excluded: outer HTTP transport bound | 255s is the relay server idle transport limit, not the180s upstream request clock. Preserve it while no coordinated slot/startup/end-to-end deadline change is in scope. |
+| `src/models/relay.ts:inputBudget:inline:options.mlx?.maxInputTokens ?? (options.mlx?.provider === ollama ? 6000 : 16_000)=16_000#0` | src/models/relay.ts:642:125 | operational | Excluded: existing MLX config | Fallback2048 output,8192 context and provider-specific6000/16000 input already come from mlx.maxTokens/contextWindow/maxInputTokens. Preserve context sum checks and caller max_tokens; do not create parallel defaults. |
+| `src/models/relay.ts:inputBudget:inline:options.mlx?.maxInputTokens ?? (options.mlx?.provider === ollama ? 6000 : 16_000)=6000#0` | src/models/relay.ts:642:118 | operational | Excluded: existing MLX config | Fallback2048 output,8192 context and provider-specific6000/16000 input already come from mlx.maxTokens/contextWindow/maxInputTokens. Preserve context sum checks and caller max_tokens; do not create parallel defaults. |
+| `src/models/relay.ts:inspect:inline:inspectBuffer.length > 64_000=64_000#0` | src/models/relay.ts:372:32 | safety floor | Excluded: relay metadata/input safety | inspect/inspectBuffer.length > 64_000 bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep64_000 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:inspect:inline:inspectBuffer.slice=-64_000#0` | src/models/relay.ts:372:76 | safety floor | Excluded: relay metadata/input safety | inspect/inspectBuffer.slice bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep-64_000 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:lastError:inline:error.message.slice=160#0` | src/models/relay.ts:528:104, src/models/relay.ts:575:102, src/models/relay.ts:714:153 | safety floor | Excluded: relay metadata/input safety | lastError/error.message.slice bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep160 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:lastError:inline:error.message.slice=160#1` | src/models/relay.ts:528:104, src/models/relay.ts:575:102, src/models/relay.ts:714:153 | safety floor | Excluded: relay metadata/input safety | lastError/error.message.slice bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep160 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:lastError:inline:error.message.slice=160#2` | src/models/relay.ts:528:104, src/models/relay.ts:575:102, src/models/relay.ts:714:153 | safety floor | Excluded: relay metadata/input safety | lastError/error.message.slice bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep160 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:max_tokens:inline:request.max_tokens ?? options.mlx!.maxTokens ?? 2048=2048#0` | src/models/relay.ts:561:85 | operational | Excluded: existing MLX config | Fallback2048 output,8192 context and provider-specific6000/16000 input already come from mlx.maxTokens/contextWindow/maxInputTokens. Preserve context sum checks and caller max_tokens; do not create parallel defaults. |
+| `src/models/relay.ts:ms:inline:2 ** (entry.failures - COOLDOWN_FAILURES)=2#0` | src/models/relay.ts:251:56 | operational | Excluded: derived cooldown arithmetic | Twice the cooldown cap ages out old streaks; factor2 is exponential recurrence. Follow selected cap/threshold as arithmetic, never expose a second independently configurable multiplier. |
+| `src/models/relay.ts:result:inline:value.slice=256#0` | src/models/relay.ts:92:37 | safety floor | Excluded: relay metadata/input safety | result/value.slice bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep256 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/relay.ts:safeHeader:inline:value.length < 256=256#0` | src/models/relay.ts:299:90 | safety floor | Excluded: relay metadata/input safety | safeHeader/value.length < 256 bounds untrusted tool-surface recursion/cardinality/text, SSE inspection bytes, safe model/header labels or diagnostic text. Keep256 fixed and preserve journal evidence unknown on malformed input. |
+| `src/models/route/advisor.ts:bound:inline:this.entries.size >= 1024=1024#0` | src/models/route/advisor.ts:91:33 | operational | Excluded: bounded advisor state policy | this.entries.size >= 1024 caps entries/stalled scopes at1024. Eviction can reset judge-review/stall memory, so it is a behavior/cost policy requiring separate route-state review, not an isolated capacity knob. |
+| `src/models/route/advisor.ts:bound:inline:this.stalled.size >= 1024=1024#0` | src/models/route/advisor.ts:96:33 | operational | Excluded: bounded advisor state policy | this.stalled.size >= 1024 caps entries/stalled scopes at1024. Eviction can reset judge-review/stall memory, so it is a behavior/cost policy requiring separate route-state review, not an isolated capacity knob. |
+| `src/models/route/advisor.ts:buildAdvisorJudgeRequest:inline:maxOutputTokens=2048#0` | src/models/route/advisor.ts:37:123 | test seam | Excluded: existing route seam | buildAdvisorJudgeRequest/maxOutputTokens already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/advisor.ts:gateStallTurns:inline:gateStallTurns=0#0` | src/models/route/advisor.ts:22:51 | operational | Excluded: existing routing config | Default0 stall gate is already supplied by hub_routes.*.gate_stall_turns; preserve the route-specific setting and its model-routing promotion owner. |
+| `src/models/route/config.ts:parseHubRoutes:inline:Number(n) < (field === hold_turns \|\| field.startsWith(gate_) ? 0 : field === transcript_max_chars ? 256 : 1)=1#0` | src/models/route/config.ts:31:171 | contract | Excluded: routing schema contract | Existing hub_routes validators encode zero/positive minima,256 transcript floor,200000 maximum or confidence<=1; do not weaken the route schema through H1 tuning. |
+| `src/models/route/config.ts:parseHubRoutes:inline:Number(n) < (field === hold_turns \|\| field.startsWith(gate_) ? 0 : field === transcript_max_chars ? 256 : 1)=256#0` | src/models/route/config.ts:31:165 | contract | Excluded: routing schema contract | Existing hub_routes validators encode zero/positive minima,256 transcript floor,200000 maximum or confidence<=1; do not weaken the route schema through H1 tuning. |
+| `src/models/route/config.ts:parseHubRoutes:inline:Number(n) > 200_000=200_000#0` | src/models/route/config.ts:31:189 | contract | Excluded: routing schema contract | Existing hub_routes validators encode zero/positive minima,256 transcript floor,200000 maximum or confidence<=1; do not weaken the route schema through H1 tuning. |
+| `src/models/route/config.ts:parseHubRoutes:inline:r.confidence_threshold > 1=1#0` | src/models/route/config.ts:33:195 | contract | Excluded: routing schema contract | Existing hub_routes validators encode zero/positive minima,256 transcript floor,200000 maximum or confidence<=1; do not weaken the route schema through H1 tuning. |
+| `src/models/route/escalation.ts:<anonymous>:inline:truncateCodepoints=1_000#0` | src/models/route/escalation.ts:37:157, src/models/route/escalation.ts:42:147 | safety floor | Excluded: route input/privacy bound | <anonymous>/truncateCodepoints caps input transcript/request text, normalized diagnostics or session keys. Keep existing bound/override and PII size-observation exclusion; do not loosen host/context protection. |
+| `src/models/route/escalation.ts:buildEscalationJudgeRequest:inline:maxOutputTokens=256#0` | src/models/route/escalation.ts:79:138 | test seam | Excluded: existing route seam | buildEscalationJudgeRequest/maxOutputTokens already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/escalation.ts:messageCap:inline:options.windowMessageChars ?? 500=500#0` | src/models/route/escalation.ts:36:97 | safety floor | Excluded: route input/privacy bound | messageCap/options.windowMessageChars ?? 500 caps input transcript/request text, normalized diagnostics or session keys. Keep existing bound/override and PII size-observation exclusion; do not loosen host/context protection. |
+| `src/models/route/escalation.ts:requestCap:inline:options.maxRequestChars ?? 18_000=18_000#0` | src/models/route/escalation.ts:36:142 | test seam | Excluded: existing route seam | requestCap/options.maxRequestChars ?? 18_000 already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/escalation.ts:summarizeForEscalation:inline:truncateCodepoints=1_000#0` | src/models/route/escalation.ts:37:157, src/models/route/escalation.ts:42:147 | safety floor | Excluded: route input/privacy bound | summarizeForEscalation/truncateCodepoints caps input transcript/request text, normalized diagnostics or session keys. Keep existing bound/override and PII size-observation exclusion; do not loosen host/context protection. |
+| `src/models/route/escalation.ts:windowSize:inline:options.recentTurnWindow ?? 28=28#0` | src/models/route/escalation.ts:36:50 | operational | Excluded: existing escalation helper seam | recentTurnWindow28 already comes from helper options; it determines judge evidence selection, so retain existing builder/request caps and calibrate model-routing evidence changes separately. |
+| `src/models/route/judge.ts:advisorJudgeRequest:inline:maxOutputTokens=2048#0` | src/models/route/judge.ts:13:133 | test seam | Excluded: existing route seam | advisorJudgeRequest/maxOutputTokens already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/judge.ts:escalationJudgeRequest:inline:maxOutputTokens=256#0` | src/models/route/judge.ts:16:129 | test seam | Excluded: existing route seam | escalationJudgeRequest/maxOutputTokens already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/plan-execute.ts:MAX_EXECUTING_SESSIONS:constant:MAX_EXECUTING_SESSIONS=4096#0` | src/models/route/plan-execute.ts:9:14 | operational | Excluded: existing plan-state seam | 4096 execution-session markers already have options.maxSessions. Eviction can return an old scope to plan/handoff; changing this belongs to route-state semantics, not generic relay timing. |
+| `src/models/route/relay-selector.ts:confidenceThreshold:inline:confidenceThreshold=0.5#0` | src/models/route/relay-selector.ts:48:118 | operational | Excluded: existing route confidence input | Default0.5 is the selector argument, sourced through route confidence policy; do not add another general confidence threshold. |
+| `src/models/route/relay-selector.ts:context:inline:this.options.mlx?.contextWindow ?? 8192=8192#0` | src/models/route/relay-selector.ts:93:71 | operational | Excluded: existing model limits | 8192 context,6000/16000 input and2048 output fallbacks repeat options.mlx values; preserve shared mlx budget authority rather than introduce selector-specific settings. |
+| `src/models/route/relay-selector.ts:inputLimit:inline:this.options.mlx?.maxInputTokens ?? (this.options.mlx?.provider === ollama ? 6000 : 16_000)=16_000#0` | src/models/route/relay-selector.ts:96:110 | operational | Excluded: existing model limits | 8192 context,6000/16000 input and2048 output fallbacks repeat options.mlx values; preserve shared mlx budget authority rather than introduce selector-specific settings. |
+| `src/models/route/relay-selector.ts:inputLimit:inline:this.options.mlx?.maxInputTokens ?? (this.options.mlx?.provider === ollama ? 6000 : 16_000)=6000#0` | src/models/route/relay-selector.ts:96:103 | operational | Excluded: existing model limits | 8192 context,6000/16000 input and2048 output fallbacks repeat options.mlx values; preserve shared mlx budget authority rather than introduce selector-specific settings. |
+| `src/models/route/relay-selector.ts:maxOutput:inline:this.options.mlx?.maxTokens ?? 2048=2048#0` | src/models/route/relay-selector.ts:94:54 | operational | Excluded: existing model limits | 8192 context,6000/16000 input and2048 output fallbacks repeat options.mlx values; preserve shared mlx budget authority rather than introduce selector-specific settings. |
+| `src/models/route/relay-selector.ts:select:inline:key.length <= 512=512#0` | src/models/route/relay-selector.ts:35:70 | safety floor | Excluded: route input/privacy bound | select/key.length <= 512 caps input transcript/request text, normalized diagnostics or session keys. Keep existing bound/override and PII size-observation exclusion; do not loosen host/context protection. |
+| `src/models/route/runtime.ts:HubRouteRuntime:inline:judgeTimeoutMs=8000#0` | src/models/route/runtime.ts:34:83 | test seam | Excluded: existing route seam | HubRouteRuntime/judgeTimeoutMs already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/runtime.ts:discardedChars:inline:config.transcript_max_chars ?? 200_000=200_000#0` | src/models/route/runtime.ts:112:233 | safety floor | Excluded: route input/privacy bound | discardedChars/config.transcript_max_chars ?? 200_000 caps input transcript/request text, normalized diagnostics or session keys. Keep existing bound/override and PII size-observation exclusion; do not loosen host/context protection. |
+| `src/models/route/runtime.ts:judge:inline:maxTokens=2048#0` | src/models/route/runtime.ts:146:110 | test seam | Excluded: existing route seam | judge/maxTokens already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/signals.ts:<anonymous>:inline:recentResults.map=-1#0` | src/models/route/signals.ts:211:110 | contract | Excluded: parsing/index contract | <anonymous>/recentResults.map is JSON fence slicing or latest-result sentinel indexing; it is arithmetic/format semantics, not an operational threshold. |
+| `src/models/route/signals.ts:CRITICAL:constant:CRITICAL=1#0` | src/models/route/signals.ts:11:14 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/signals.ts:DEFAULT_RECENT_WINDOW:constant:DEFAULT_RECENT_WINDOW=3#0` | src/models/route/signals.ts:8:14 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/signals.ts:HARD:constant:HARD=0.7#0` | src/models/route/signals.ts:10:14 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/signals.ts:SOFT:constant:SOFT=0.3#0` | src/models/route/signals.ts:9:14 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/signals.ts:latestFailure:inline:recentResults.map((r,i)=>failureSeverity(r.text,r.isError).severity>0\|\|r.isError?i:-1).filter(i=>i>=0).at=-1#0` | src/models/route/signals.ts:211:133 | contract | Excluded: parsing/index contract | latestFailure/recentResults.map((r,i)=>failureSeverity(r.text,r.isError).severity>0\|\|r.isError?i:-1).filter(i=>i>=0).at is JSON fence slicing or latest-result sentinel indexing; it is arithmetic/format semantics, not an operational threshold. |
+| `src/models/route/signals.ts:normalized:inline:[...diagnostic.split(/\s+/u).map((word) => word.startsWith(/) \|\| word.includes(/src/) \|\| word.includes(/tmp/) ? <path> : word.replace(/\d+/gu, #)).join( )].slice=240#0` | src/models/route/signals.ts:190:199 | safety floor | Excluded: route input/privacy bound | normalized/[...diagnostic.split(/\s+/u).map((word) => word.startsWith(/) \|\| word.includes(/src/) \|\| word.includes(/tmp/) ? <path> : word.replace(/\d+/gu, #)).join( )].slice caps input transcript/request text, normalized diagnostics or session keys. Keep existing bound/override and PII size-observation exclusion; do not loosen host/context protection. |
+| `src/models/route/signals.ts:window:inline:Math.max=1#0` | src/models/route/signals.ts:205:27 | operational | Excluded: derived signal minimum | Math.max1 clamps recent-window length; no independent setting or permission should derive from changing a minimum. |
+| `src/models/route/stage.ts:HARD_SEVERITY:constant:HARD_SEVERITY=0.7#0` | src/models/route/stage.ts:27:7 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/stage.ts:SCORE_GAIN:constant:SCORE_GAIN=5#0` | src/models/route/stage.ts:26:7 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/stage.ts:SEVERITY_CRITICAL:constant:SEVERITY_CRITICAL=1#0` | src/models/route/stage.ts:29:7 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/stage.ts:SIGNAL_UNIT:constant:SIGNAL_UNIT=0.1#0` | src/models/route/stage.ts:28:7 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/stage.ts:STALL_MIN_TURN_DEPTH:constant:STALL_MIN_TURN_DEPTH=8#0` | src/models/route/stage.ts:25:7 | operational | Excluded: calibrated routing algorithm | Severity labels0.3/0.7/1, recent-window3, stall-depth8, gain5 and signal-unit0.1 are coupled Switchyard signal/score defaults. Keep provenance, severity-scale agreement and model-routing promotion separate; do not misrepresent them as latency knobs. |
+| `src/models/route/stage.ts:max_switch_prefill_tokens:inline:max_switch_prefill_tokens=32_000#0` | src/models/route/stage.ts:108:106 | operational | Excluded: existing stay/switch config | Default32000 already uses routing.max_switch_prefill_tokens; changes belong to existing model-routing promotion/receipt path. |
+| `src/models/route/stage.ts:pickTier:inline:confidenceThreshold=0.5#0` | src/models/route/stage.ts:55:101 | test seam | Excluded: existing route seam | pickTier/confidenceThreshold already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/stage.ts:selectStage:inline:options.confidenceThreshold??0.5=0.5#0` | src/models/route/stage.ts:82:66 | test seam | Excluded: existing route seam | selectStage/options.confidenceThreshold??0.5 already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/state.ts:SessionState:inline:ttlMs=60 * 60 * 1000#0` | src/models/route/state.ts:33:76 | test seam | Excluded: existing route seam | SessionState/ttlMs already exposes judge token limit, judge timeout, selection confidence, request-character cap or state TTL through a trusted constructor/helper option. Keep existing seam and routing receipt policy; no parallel generic control. |
+| `src/models/route/text.ts:stripJsonFence:inline:value.slice=-3#0` | src/models/route/text.ts:48:49 | contract | Excluded: parsing/index contract | stripJsonFence/value.slice is JSON fence slicing or latest-result sentinel indexing; it is arithmetic/format semantics, not an operational threshold. |
+| `src/omniroute/client.ts:chat:inline:(await res.text()).slice=300#0` | src/omniroute/client.ts:176:103 | safety floor | Excluded: gateway diagnostic safety | 300-character upstream error-body cap bounds untrusted provider diagnostic text; credentials and Access headers remain private. |
+| `src/omniroute/client.ts:max_tokens:inline:max_tokens=1#0` | src/omniroute/client.ts:150:131 | operational | Excluded: availability probe contract | One output token makes the credential/model availability call minimal and model-free of user work; not a model output budget setting. |
+| `src/omniroute/client.ts:signal:inline:AbortSignal.timeout=10_000#0` | src/omniroute/client.ts:150:166 | operational | Excluded: native availability proof bound | 10s bounds model usability check before attachment; preserve proof semantics, not a generic model-generation deadline. |
+| `src/omniroute/client.ts:signal:inline:AbortSignal.timeout=4000#0` | src/omniroute/client.ts:115:157, src/omniroute/client.ts:139:156 | operational | Excluded: gateway discovery/inventory follow-up | 4s health rounds (at most two rounds) or authenticated model inventory affect campus selection/start caller latency. Support path outside accepted conversion; preserve preferred concurrent probe order and Access/privacy refusal. |
+| `src/omniroute/client.ts:signal:inline:AbortSignal.timeout=4000#1` | src/omniroute/client.ts:115:157, src/omniroute/client.ts:139:156 | operational | Excluded: gateway discovery/inventory follow-up | 4s health rounds (at most two rounds) or authenticated model inventory affect campus selection/start caller latency. Support path outside accepted conversion; preserve preferred concurrent probe order and Access/privacy refusal. |
+| `src/omniroute/usage.ts:safeModelLabel:inline:label.length <= 160=160#0` | src/omniroute/usage.ts:37:46 | safety floor | Excluded: model label safety | 160-character safe model label bounds untrusted provider metadata before usage/request identity projection; preserve unknown on invalid labels. |
+
+## Verification state
+
+This document reconciles the frozen inventory and records static source/caller analysis only. Focused tests, typecheck, bundle freshness, changed gate, exact-head CI and native/account execution remain unverified. No safety floor or wire/storage schema changes.