[andersalm]

Runtime admits a local model against observed memory and disk, gives one engine owner per OS account, and keeps a bounded cancelable queue. Idle release, cancellation, crash recovery and shutdown preserve ownership until engine cleanup is confirmed. Launch and admission share batch128 bounds and disabled prompt/checkpoint caches.

The Linux CI journey uses fresh installed CPU fixtures in finite1GiB refusal and4GiB lifecycle services. It verifies the complete global cgroup hierarchy, numeric limits, the Runtime account, source/tree, built and installed Runtime/provider, test executable, both complete engine bundles and pinned GGUF. The refusal checks its error and recovery text before a guard starts; the lifecycle checks reply, shared busy, idle release, crash cleanup, reuse and final descendants before service cleanup. Safe receipts include measured step time; raw logs remain private.

Validation at07c6f4f7:249 unit tests,10 production-process tests,15 policy tests,10 refused-case harness tests and four basic gates passed. Two independent gpt-6.1-sol high reviews passed. Normal merges preserve verified PR153f6 and current developc7cc9804. Exact installed Linux CI follows the push.

Owning issue:#98. This draft retains installed human acceptance, #97/#133, reviewed#155 integration and Irzhy's current-candidate approval. Backend/Home peak-memory qualification, supported Qwen profiles and Jetson acceptance remain separate gates. Source proof and the retained Mac proof establish their recorded scope only.

[andersalm]

Independent adversarial review (Claude Opus via elastos-pr-review, 2026-10-02), head 77dd1c9.
VERDICT: FAIL

Blocking findings:

1. elastos/crates/elastos-server/src/setup.rs:347-349: verify_arm64_model_host(&platform)? runs inside the "Components to install" loop. llama-server is in the default home profile (components.json:1568), and install.sh:762 runs plain setup. On ARM64 Linux hosts without FP16 and dot-product support, such as the Raspberry Pi 4 or other Cortex-A72 hosts, the whole Home setup now stops before it installs anything. Before this PR, linux-arm64 used source-build and setup skipped the engine. Setup should skip the model engine and still install Home. No test covers this refused host.
2. capsules/model-provider/src/local_resources.rs:13-17,38-44: the account lease uses a predictable name in shared /tmp (/tmp/elastos-local-model-<euid>.lock). Any other local account can create that file first. The victim's open then fails, or the uid/mode check fails, and every local model run returns Failed, which the user sees as "model backend failed". The user has no recovery, because the sticky bit stops them deleting the file. This breaks the account boundary that docs/MODEL_PROVIDER.md promises ("Other OS accounts … have separate ownership"). The lease should live in a directory that only the account owns.

Non-blocking notes:

1. Admission now fails closed on cgroup v1 or hybrid hosts, WSL2 and containers. Those hosts get "This model's resource profile is unavailable", which points at the model when the cause is the host.
2. No test forces a disk refusal. host_observation_and_small_fixture_admission accepts Ok, memory refusal or disk refusal alike, so the 10% disk-floor refusal is never asserted.
3. The ubuntu-22.04-arm job still reports under the ubuntu-24.04-arm check name, which misstates what the check ran on.

Not checked: I ran no tests or builds. I did not check the CI results for this commit, the installed Linux, Mac or Jetson runs, or whether the published release contains the linux-arm64 engine archive. I also did not check whether the Mac free+inactive estimate, which counts weights twice and reserves 10% for Home, refuses Qwen models that work today.

[andersalm]

Superseded by #322 (alpha.13): free-memory admission, one engine, 60 s idle release, batch 128 and the ARM64 setup skip were ported; the account lease and cgroup CI services were dropped (one Runtime per OS account is the boundary, see MODEL_PROVIDER.md).