From b1e7d9e68664a857b4902491029abd472b60b464 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 15 Sep 2026 08:49:44 +0100
Subject: [PATCH 1/2] feat: idle-time self-test, context probe, resources
 roll-up and usage measurement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four intents from one lane, landed together because their surfaces are the
same files: the panel, the control plane, the app's composition root, the
configuration and the pool.

The self-test (itd-2609100457007827) measures every downloaded model while
nobody is using the Mac — llama-bench's pp512 and tg128, a concurrent tg128
and the load time — through the pool's ordinary Acquire, never evicting,
yielding the moment a client appears, into a bounded 0600 file with a view
on the Statistics tab.

The context-window probe (itd-2609091301112705) is a second job of that one
idle loop: a sweep and a bisection through this Mac's own OpenAI endpoint,
the window recorded on the model's registry entry with the provenance that
makes it stale, published on the models list as measured_context and
measured_bound, adopted as the served window only by the operator's hand. A
reading one of the gateway's own bounds stopped is a floor and says so.

The resources roll-up (itd-2609091903463596) adds up what the Models tab
already knows, with free disk on the snapshot from the one reader.

Usage measurement (itd-2609091712141073) gives the request record the facts
that decide a served window and a concurrency, the load event the launch
sampling, and the store a fifth record kind — a footprint reading every
thirty seconds per server, from top's physical figure with a deadline — with
three views on the Statistics tab and every field on the reference page.

Each intent had two adversarial reviews applied; the decision lines in the
records say what changed and why.

Assisted-by: Claude:claude-fable-5-1
Claude-Session: https://claude.ai/code/session_01NU6NHFLGFYFuA1z4eqFz8j
---
 CHANGELOG.md                                  |  67 +-
 README.md                                     |  13 +
 docs/context-probe.md                         | 103 +++
 docs/memory-budget-explained.md               |  12 +
 docs/memory-budget.md                         |  11 +
 docs/models-list.md                           |  24 +
 docs/posture-reference.md                     |   1 +
 docs/request-statistics.md                    |   5 +-
 docs/self-test-reference.md                   |  99 +++
 docs/self-test.md                             | 115 +++
 docs/statistics-explained.md                  |  43 +
 docs/statistics-store-reference.md            |  29 +-
 internal/app/app.go                           | 105 ++-
 internal/app/contextprobe.go                  | 161 ++++
 internal/app/contextprobe_test.go             | 181 ++++
 internal/app/loglevel_test.go                 |   8 +-
 internal/app/measurement_test.go              |  26 +
 internal/app/observer_test.go                 |   5 +-
 internal/app/selftest.go                      |  88 ++
 internal/app/selftest_test.go                 | 118 +++
 internal/archtest/context_bound_test.go       |  17 +
 internal/archtest/disk_reader_test.go         |  39 +
 .../archtest/enforcement_detection_test.go    |  22 +-
 internal/archtest/event_fields_test.go        |  19 +
 internal/archtest/prompt_content_test.go      |   7 +-
 internal/archtest/selftest_docs_test.go       |  56 ++
 internal/config/config.go                     |  99 ++-
 internal/config/contextprobe_test.go          |  74 ++
 internal/config/selftest_test.go              |  44 +
 internal/contextprobe/filler.go               |  38 +
 internal/contextprobe/probe.go                | 643 ++++++++++++++
 internal/contextprobe/probe_test.go           | 634 ++++++++++++++
 internal/gateway/control.go                   |  74 +-
 internal/gateway/control_history_test.go      |   2 +-
 internal/gateway/control_probe_test.go        | 123 +++
 internal/gateway/control_resources_test.go    |  27 +
 internal/gateway/control_selftest.go          | 102 +++
 internal/gateway/control_selftest_test.go     | 165 ++++
 internal/gateway/control_stats_test.go        |   2 +-
 internal/gateway/control_store_test.go        |   4 +-
 internal/gateway/gateway.go                   |  86 +-
 internal/gateway/gateway_test.go              |  27 +-
 internal/gateway/measurement_test.go          | 125 +++
 internal/gateway/observe.go                   |  33 +
 internal/gateway/probe_integration_test.go    | 239 ++++++
 internal/gateway/systemmerge_test.go          |   2 +
 internal/lifecycle/testdata/config_show.json  |   3 +
 internal/mlxtest/fake.go                      |  78 +-
 internal/mlxtest/fake_test.go                 |  75 ++
 internal/registry/measurement.go              | 223 +++++
 internal/registry/measurement_test.go         | 190 +++++
 internal/registry/registry.go                 |  15 +
 internal/runtime/footprint_test.go            |  35 +
 internal/runtime/launcher.go                  |  71 +-
 internal/runtime/observer.go                  |  29 +-
 internal/runtime/observer_test.go             | 123 ++-
 internal/runtime/pool.go                      | 122 ++-
 internal/runtime/pool_test.go                 |  11 +
 internal/runtime/provision.go                 |   5 +
 internal/runtime/selftest_refusals_test.go    |  53 ++
 internal/selftest/request.go                  | 238 ++++++
 internal/selftest/results.go                  | 257 ++++++
 internal/selftest/selftest.go                 | 757 +++++++++++++++++
 internal/selftest/selftest_test.go            | 804 ++++++++++++++++++
 internal/stats/dashboard.go                   | 182 ++++
 internal/stats/measurement_test.go            | 180 ++++
 internal/stats/stats.go                       | 145 +++-
 internal/stats/stats_test.go                  |  16 +-
 internal/stats/store.go                       |  37 +-
 internal/stats/store_test.go                  |   2 +
 internal/stats/summary.go                     |   2 +-
 internal/ui/contextprobe_test.go              |  61 ++
 internal/ui/controls_test.go                  |   1 +
 internal/ui/history_test.go                   |   1 +
 internal/ui/measurement_test.go               |  44 +
 internal/ui/panel_test.go                     |   4 +-
 internal/ui/posture_test.go                   |  15 +-
 internal/ui/resources_test.go                 |  83 ++
 internal/ui/selftest_test.go                  |  54 ++
 internal/ui/static/app.js                     | 305 ++++++-
 internal/ui/static/index.html                 |  95 +++
 81 files changed, 8103 insertions(+), 130 deletions(-)
 create mode 100644 docs/context-probe.md
 create mode 100644 docs/self-test-reference.md
 create mode 100644 docs/self-test.md
 create mode 100644 internal/app/contextprobe.go
 create mode 100644 internal/app/contextprobe_test.go
 create mode 100644 internal/app/measurement_test.go
 create mode 100644 internal/app/selftest.go
 create mode 100644 internal/app/selftest_test.go
 create mode 100644 internal/archtest/context_bound_test.go
 create mode 100644 internal/archtest/disk_reader_test.go
 create mode 100644 internal/archtest/event_fields_test.go
 create mode 100644 internal/archtest/selftest_docs_test.go
 create mode 100644 internal/config/contextprobe_test.go
 create mode 100644 internal/config/selftest_test.go
 create mode 100644 internal/contextprobe/filler.go
 create mode 100644 internal/contextprobe/probe.go
 create mode 100644 internal/contextprobe/probe_test.go
 create mode 100644 internal/gateway/control_probe_test.go
 create mode 100644 internal/gateway/control_resources_test.go
 create mode 100644 internal/gateway/control_selftest.go
 create mode 100644 internal/gateway/control_selftest_test.go
 create mode 100644 internal/gateway/measurement_test.go
 create mode 100644 internal/gateway/probe_integration_test.go
 create mode 100644 internal/mlxtest/fake_test.go
 create mode 100644 internal/registry/measurement.go
 create mode 100644 internal/registry/measurement_test.go
 create mode 100644 internal/runtime/footprint_test.go
 create mode 100644 internal/runtime/selftest_refusals_test.go
 create mode 100644 internal/selftest/request.go
 create mode 100644 internal/selftest/results.go
 create mode 100644 internal/selftest/selftest.go
 create mode 100644 internal/selftest/selftest_test.go
 create mode 100644 internal/stats/measurement_test.go
 create mode 100644 internal/ui/contextprobe_test.go
 create mode 100644 internal/ui/measurement_test.go
 create mode 100644 internal/ui/resources_test.go
 create mode 100644 internal/ui/selftest_test.go

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d42d57a6..09f7ae39 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,61 @@ GitHub release notes.
 
 ## [Unreleased]
 
+### Added
+
+- **The usage dashboard shows what the models actually do, so the settings
+  that matter can be seen before they are chosen.** Every request record now
+  carries the two windows it was judged against, Gropius's own estimate of
+  the prompt's size (for a refused request too), how many requests the model
+  already had, which sampling parameters the client set — the names, never
+  the values — and the model server's memory as last sampled; every load
+  carries the sampling the server was launched with; and a new record kind,
+  `footprint`, is a reading of each running server's memory every thirty
+  seconds. The Statistics tab gains three views: prompts against the served
+  window, sampling overrides per parameter, and memory over time. Nothing in
+  any of it is a prompt or an answer, nothing is exported, and the
+  [reference page](docs/statistics-store-reference.md) names every field.
+
+- **The Models tab adds up what your Mac is spending on Gropius.** A line at
+  its head says how many models are downloaded and loaded, how much disk they
+  take and how much the volume has left, and the memory budget against what is
+  resident, naming the part still exiting. Each card says the window the model
+  declares and, when you have set one below it, the window it is served at.
+  Nothing new is measured: the figures are the ones the panel already had,
+  and free disk now rides the state snapshot from the one reader the search
+  tab uses ([the memory budget](docs/memory-budget.md#what-the-models-tab-adds-up)).
+
+- **The context-window probe: Gropius measures the largest prompt each
+  model on this Mac will actually take.** Off until you turn it on —
+  **Settings → Context probe**, `context_probe` in `config.json` — or per
+  model with **Measure now** on its card. While the Mac is idle, Gropius
+  sends prompts of growing length through its own OpenAI endpoint, bisects to
+  the largest the server accepts, and records the window on the model's entry
+  with what stopped the next step: the model itself, or one of Gropius's own
+  limits — the prefill deadline, the served window, the memory guard — in
+  which case the figure is a floor and says so. It is published on the models
+  list as `measured_context` and `measured_bound`, changes no charge and
+  refuses no request until you press **Use this window**, and is marked stale
+  when the runtime, the budget, the concurrency or the served window changes.
+  A probe costs about forty minutes of GPU per model, never evicts another
+  model, and stands down the moment anyone sends a request. The idle threshold
+  the probe and the self-test share is now a setting, `idle_threshold_sec`
+  ([how to](docs/context-probe.md)).
+
+- **The self-test: Gropius measures its own models while nobody is using the
+  Mac.** Off until you turn it on — **Settings → Self-test**, `self_test` in
+  `config.json`. While it is on, once the Mac has been idle for five minutes,
+  Gropius loads one model at a time through the same path a request takes —
+  and never by evicting another — runs llama-bench's pair and a concurrency figure against it — `pp512`,
+  `tg128`, `tg128xN` at the decode concurrency — plus the load time, writes
+  one line of figures to `selftest/results.jsonl` in this account's data
+  folder, and unloads what it loaded. A request from anyone cancels the run
+  at once and is recorded as such; a request refused room during a run is
+  served on its retry. Each model is measured once a day. The
+  file holds counts and timings only, never a prompt or an answer, and is
+  bounded at 4 MiB ([how to](docs/self-test.md),
+  [reference](docs/self-test-reference.md)).
+
 ## [0.6.0] - 2026-09-12
 
 ### Changed
@@ -220,7 +275,6 @@ GitHub release notes.
   differently.** This is one less thing that has to hold for the queue to
   behave, not a stall anyone was hitting.
 
-
 - **A client connecting over loopback is told which models are loaded, whether
   or not an API key is set.** `GET /v1/models` carries `state`, `in_flight`,
   `last_used` and `pinned`, and used to carry them only on an install that had
@@ -239,7 +293,6 @@ GitHub release notes.
   points its own hostname at `127.0.0.1` is refused. An install with a key
   behaves as before.
 
-
 - **Under a shared model cache, every account now keeps its own settings and
   its own model list.** They used to be one `config.json` and one
   `registry.json` beside the models, which worked for whichever account ran
@@ -427,7 +480,6 @@ GitHub release notes.
   where the VPN stops. Linked from the README and from the getting-started
   guide.
 
-
 - **The chat client finds servers instead of asking you to name one.**
   Settings now lists every Gropius server advertising itself on your network,
   with the name it publishes, whether it wants an API key, and how many models
@@ -497,7 +549,6 @@ GitHub release notes.
   closed on a pin it cannot read; and a repository with no pin is unaffected.
   Contributors whose git identity already matches see no change.
 
-
 - **A first launch of the chat client no longer dead-ends.** It opened on a
   documentation example's host name, which resolves for nobody, and the message
   box stays disabled until a server answers — so the first thing a new user met
@@ -507,7 +558,6 @@ GitHub release notes.
   install order puts there; the empty chat names Settings and has a button that
   opens it; and the disabled message box says why it is disabled.
 
-
 - **Saving settings no longer empties the bind address.** The bind control
   offers two addresses, and a browser's `<select>` has no notion of a value it
   does not offer: a Gropius bound to anything else — `localhost`, IPv6
@@ -520,7 +570,6 @@ GitHub release notes.
   address itself, so the pane shows the address Gropius is serving on and saves
   it back unchanged.
 
-
 - **A disk that has stopped answering no longer holds the usage dashboard
   open.** Every reading of the statistics store starts by flushing the writer,
   so that it shows what has been recorded rather than what happened to have
@@ -546,7 +595,6 @@ GitHub release notes.
   that reached its terminal event is now recorded as delivered, with its
   counts, whatever happens to the tidying-up after it.
 
-
 - **The Bonjour advertisement is republished, not edited, when what it says
   changes.** Setting or clearing the API key, or a change in how many models
   are servable, used to rewrite the advertised record in place while the
@@ -571,7 +619,6 @@ GitHub release notes.
   reported once when it begins and once when it ends, instead of every fifteen
   seconds for as long as the network is away.
 
-
 - **Deleting a model now holds the model until the deletion is finished.**
   Removing a model is not one step — its record goes first and its files
   afterwards — and in between it looked to the rest of Gropius like a model that
@@ -605,7 +652,6 @@ GitHub release notes.
   In shared-cache mode, where another account owns the index file, a failed
   registry write is routine rather than a disk-full hypothetical.
 
-
 - **A model server that stops mid-sentence no longer grows the gateway's
   memory.** A streamed answer is relayed a line at a time, and a server that
   hung without finishing its line made that line grow for as long as it kept
@@ -652,7 +698,6 @@ GitHub release notes.
   than being refused: the key is shortened, never cleared, so a server exposed
   to the network is never opened by a value in a file.
 
-
 - **A second account can serve a model the first account has already served.**
   Each model server writes a log named after the model, and while those logs
   sat in the shared folder the second account could not open one the first
@@ -819,7 +864,6 @@ GitHub release notes.
   checksums and clears the quarantine, and keeps the link to the repository
   beside it. Release assets are still named with their sizes; none is linked.
 
-
 - **The landing page no longer scrolls sideways.** A grid track held at the
   intrinsic width of the install one-liner — 894 pixels of unbreakable
   command — and pushed the column beside it off the page, so the release list
@@ -909,7 +953,6 @@ GitHub release notes.
   GropiusChat. The bundle identifiers, the Bonjour service, the environment
   variable, the module path and the released asset names all follow.
 
-
 - **Eviction grace**, in Settings, off until you turn it on. Gropius unloads the
   least recently used idle model to make room for a new one, and that rule
   treats a model idle for one second the same as one idle for an hour — so on a
diff --git a/README.md b/README.md
index fd61aafc..ae532b10 100644
--- a/README.md
+++ b/README.md
@@ -74,6 +74,19 @@ Cross-machine LAN use works; TLS and notarised distribution are not yet included
   model's share, how long requests took, the spread of those times, and when
   models were evicted and reloaded
   ([what the views mean](docs/statistics-explained.md)).
+- **Self-test, opt-in** — off until you turn it on: while the Mac is idle,
+  Gropius loads each of your models in turn, runs the same short set of tests
+  against it — load time, prompt reading, generation, and generation under
+  concurrent requests — writes one line of figures to a file in your data
+  folder, and unloads what it loaded. A request from anyone ends the run at
+  once ([how to switch it on](docs/self-test.md), and
+  [what is recorded](docs/self-test-reference.md)).
+- **Context-window probe, opt-in** — off until you turn it on: while the
+  Mac is idle, Gropius measures the largest prompt each model will actually
+  take, through its own endpoint, and records it beside the window the model
+  declares and the one it serves. A figure one of Gropius's own limits stopped
+  is published as a floor, and nothing changes until you adopt it
+  ([how to switch it on, and what it costs](docs/context-probe.md)).
 - **A log that says why** — Gropius keeps its own log in your account's data
   folder, so the reason behind a refusal a client saw is somewhere you can read
   it even when the app was launched from the Finder and has no terminal to
diff --git a/docs/context-probe.md b/docs/context-probe.md
new file mode 100644
index 00000000..82d234f7
--- /dev/null
+++ b/docs/context-probe.md
@@ -0,0 +1,103 @@
+# Measure a model's real context window
+
+Gropius can measure how long a prompt each model on your Mac can actually
+take, rather than believing the window its configuration declares. It sends
+prompts of growing length through its own OpenAI endpoint, the way a client
+does, bisects between the last one that came back and the first that did
+not, and records the window it verified beside the one the model declares
+and the one it is set to serve. The figure comes from your Mac, your runtime
+and your settings, not from someone else's benchmark.
+
+The probe is off until you turn it on, and even then it runs only while the
+Mac is idle. Nothing it measures leaves this Mac, and nothing it sends is
+anything but its own fixed filler text. Because it reaches the model through
+the same endpoint a client uses, its requests are counted in the
+[request statistics](request-statistics.md) when recording is on — as
+counts and timings only, never as text.
+
+## What it costs
+
+Read this before switching it on. A measurement is not free:
+
+- **About forty minutes of GPU time per model**, at full prefill, on the
+  2026-09-06 campaign's figures. Six models is an evening, one after another.
+- **A single step can take half an hour**: the gateway allows a prompt
+  about a second per 150 tokens plus a minute before it gives up, and a
+  262,144-token prompt is near the top of that.
+- **An unload and a reload between steps**, so a retained prompt cache
+  cannot flatter the next reading. Each reload reads the weights from disk
+  again.
+- **The GPU is nobody else's while a step runs.** The probe never starts
+  while anyone is using the Mac and stops the moment anyone does, but a
+  request that arrives mid-step waits a moment for the probe to stand down.
+- **On a laptop**, that is battery and heat, and the lid must stay open: a
+  Mac that sleeps loses the run.
+- **The probe never pushes another model out** to make room. A model that
+  would need one evicted waits for a time when there is room.
+
+## Switch it on
+
+1. Open the control panel and go to **Settings → Context probe**.
+2. Tick **Measure each model's context window when this Mac is idle**.
+3. **Save settings**.
+
+From then on, whenever the Mac has been idle for the idle threshold (five
+minutes unless you change it, in the same section) and nothing is
+downloading, Gropius measures the first model that has no current
+measurement, one model at a time. A model you download later is measured
+the next time the Mac is idle. In `config.json` the switch is
+`"context_probe": true` and the threshold `"idle_threshold_sec"`.
+
+To measure one model without switching the probe on, open the **Models** tab
+and press **Measure now** on its card. The run starts at the next idle
+minute.
+
+## Read the result
+
+The model's card on the Models tab shows the measured window beside the
+declared and the served ones, with what stopped the step above it:
+
+- **the model** — the server refused or crashed above this size. The figure
+  is the model's own limit on this Mac.
+- **the prefill deadline**, **the served window**, or **the memory guard** —
+  Gropius's own limit stopped the probe first. The figure is a verified
+  floor: the model takes at least this much, and its own limit is not known.
+  On the 2026-09-06 evidence that is the common case.
+
+While a run is in progress the card says which step it is on and the bounds
+so far; if a run is due but held back, it says what held it: a request in
+flight, a caller waiting for a model, a download, or a recent request.
+
+A measurement is marked **stale** when the runtime, the memory budget, the
+decode concurrency or the model's served window has changed since it was
+taken, and the card says which. A stale figure is not published and cannot
+be adopted; measure again.
+
+The figure is also published on the models list as `measured_context` and
+`measured_bound`, beside `context_length` and `served_context`:
+[The models list](models-list.md) says what each means.
+
+## Adopt the figure
+
+A measurement changes nothing on its own: no memory charge, no refusal.
+Press **Use this window** on the card to make it the model's served window.
+That is the same setting as **Settings → Served context**, so the next load
+is charged at it and a request above it is refused, exactly as if you had
+typed the figure yourself. Setting the served window to the measured figure
+does not make the measurement stale: the floor was verified under a window at
+least that large, and still stands. Setting it to any other figure does.
+
+## Stop it
+
+Clear the box and save, or quit Gropius. A run in progress stops at once,
+writes no figure, leaves the model unloaded, and the card says the probe was
+incomplete. It is not retried on its own; press **Measure now** to run it
+again.
+
+## Related
+
+- [The models list](models-list.md) — the three windows a client reads.
+- [The memory budget, explained](memory-budget-explained.md) — what a served
+  window costs, and why adopting a measurement is a separate act.
+- [Test your models while the Mac is idle](self-test.md) — the other idle
+  job, which shares the idle threshold.
diff --git a/docs/memory-budget-explained.md b/docs/memory-budget-explained.md
index 22bf64e7..91100081 100644
--- a/docs/memory-budget-explained.md
+++ b/docs/memory-budget-explained.md
@@ -78,6 +78,18 @@ at and the largest of each that would fit, so what to change is in the message.
 Gropius will not quietly charge a model less than it costs: a budget that lies
 by a factor is worse than one that says no.
 
+## The measured window is offered, never assumed
+
+The [context probe](context-probe.md) can find the largest prompt a model
+will actually take on this Mac, and that figure sits on the model's card
+beside the served window. It is not charged. The budget charges the served
+window, and only the served window, because that is the figure the operator
+chose; a measurement is evidence for a choice, not the choice. Pressing
+**Use this window** writes the measured figure into the served window, and
+from then on it is charged and enforced exactly as a typed figure would be.
+The two acts are kept apart so that a measurement can never lower or raise
+what a model is charged without someone deciding it should.
+
 ## Why a change applies to the next load
 
 Lowering the budget unloads nothing. A model in memory is one somebody is
diff --git a/docs/memory-budget.md b/docs/memory-budget.md
index 471eca75..4ebea5ff 100644
--- a/docs/memory-budget.md
+++ b/docs/memory-budget.md
@@ -57,6 +57,17 @@ says the machine is over its budget until they go by the usual rules — a reque
 for something else, the idle timeout, or your own **Unload**. A model is never
 taken away at the moment you press Save.
 
+## What the Models tab adds up
+
+The line at the head of the **Models** tab is the roll-up: how many models
+are downloaded and how many are loaded, how much disk the downloaded ones
+take and how much the models volume has left, and the memory budget against
+what is resident — naming the part still exiting, which is memory a stopped
+server has not handed back yet and which a load is still measured against.
+Every figure is one Gropius already has; nothing is walked or measured to
+draw it. Each model's card says the window it declares and, when you have
+set one below it, the window it is served at.
+
 ## Where the rules are
 
 The [models list reference](models-list.md) states what a loaded model is
diff --git a/docs/models-list.md b/docs/models-list.md
index 126f34c2..35e3c833 100644
--- a/docs/models-list.md
+++ b/docs/models-list.md
@@ -47,6 +47,8 @@ curl http://localhost:11535/v1/models
 | `context_length` | The model's maximum context, in tokens. See below. |
 | `max_model_len` | The same figure again, under the name vLLM-derived clients read. |
 | `served_context` | The window this Mac will actually serve the model at, in tokens. A request estimated to be larger is refused. See below. |
+| `measured_context` | The largest prompt, in tokens, that the model's server on this Mac verifiably accepted when Gropius measured it. Absent until a measurement exists and while it is stale. See below. |
+| `measured_bound` | What stopped the measurement's step above `measured_context`: `model`, `prefill_deadline`, `served_window` or `memory_guard`. Only `model` makes the figure the model's limit; the others make it a floor. Present with `measured_context`. |
 | `state` | Whether the model is loaded, still loading, or not loaded. Only for a client connecting over loopback, or on an install with an API key. See below. |
 | `in_flight` | How many requests that model is already handling. Only for a client connecting over loopback, or on an install with an API key. |
 | `last_used` | Unix time at which Gropius last handled a request for that model. Only for a client connecting over loopback, or on an install with an API key, and only while the model is in memory — `loaded` or `loading`. |
@@ -173,6 +175,28 @@ it to whole units of 1,024, rounded down, so a model declaring 262,143 reads
 `max context 255K`; below 1,024 the card prints the number itself. The models
 list always carries the exact number.
 
+## The measured window
+
+`measured_context` is what the [context probe](context-probe.md) found: the
+largest prompt the model's server on this Mac accepted and answered, in the
+server's own count of prompt tokens, sent the way a client sends one. It is
+the third figure beside the two above, and the three mean different things:
+`context_length` is what the model's configuration claims, `served_context`
+is what this Mac is set to serve, and `measured_context` is what was
+verified here.
+
+`measured_bound` says what stopped the next step. `model` means the server
+refused or crashed above the figure, so it is the model's own limit on this
+Mac. `prefill_deadline`, `served_window` and `memory_guard` mean one of
+Gropius's own limits stopped the probe first: the figure is a verified floor,
+the model takes at least that much, and its own limit is not known.
+
+A measurement changes nothing on its own: the served window, the memory
+charge and the refusal are what they were. Only when the operator adopts it
+does it become `served_context`. Both fields are absent while no measurement
+exists, and while the one there is has gone stale because the runtime, the
+memory budget, the decode concurrency or the served window changed since.
+
 ## Residency
 
 `state`, `in_flight`, `last_used` and `pinned` say what each model is doing right
diff --git a/docs/posture-reference.md b/docs/posture-reference.md
index e816142c..c5e5e3ed 100644
--- a/docs/posture-reference.md
+++ b/docs/posture-reference.md
@@ -28,6 +28,7 @@ stored configuration, which a save changes before a restart applies it.
 | **The local network** | Whether Gropius is announcing this server over Bonjour to every machine on the local network, as a service named after this Mac's name, and what the announcement carries: this Mac's addresses, the port the listeners took, how many models are ready, whether a key is required, and the fixed words saying it speaks the OpenAI API under `/v1`. When it is not announcing, which of three things kept it off when Gropius started. | The decision made at start from the `advertise` setting and the bind then in force; the mode in force; the bind's reach; the port the listeners took; this Mac's name. |
 | **The request log** | That each request to the API is written to the server log as method, path, status and duration, with no client address, prompt, answer or key; the level the log is at, and that it is kept in the logs folder of this account's data folder in a file created for this account alone. | The `log_level` setting, which is applied live. |
 | **Request statistics** | Whether request statistics are being recorded; what a record holds and what it never holds; that the same store also records when a model was loaded or evicted and the settings in force; for how many months and within how much room records are kept, and where; how far back the records on disk reach and how much room they take, or that the store could not be opened; and that every account on this Mac can read them. When recording is off, that no request is recorded. | The statistics switch, the two retention settings, and the store's status. |
+| **Self-test** | Whether the self-test is on: that while the Mac is idle Gropius loads one of its models at a time where it fits beside what is loaded, measures it with a fixed set of prompts and unloads what it loaded; that any request ends the run; and that the figures go to a file in this account's data folder and hold no prompt and no answer. When it is off, that Gropius loads no model on its own. | The `self_test` setting, which is applied live. |
 
 ## The two key lines
 
diff --git a/docs/request-statistics.md b/docs/request-statistics.md
index 06a5648f..75cea0c4 100644
--- a/docs/request-statistics.md
+++ b/docs/request-statistics.md
@@ -76,8 +76,9 @@ Two limits, both under the switch in **Settings → Request statistics**:
    wins.
 
 Set either and **Save settings**; a limit you lower takes effect when you save
-it. A record measures about 230 bytes, so 200 MB is roughly three months of
-ten thousand requests a day — but how far back your own store reaches depends
+it. A request record measures about 380 bytes, so 200 MB is roughly seven weeks
+of ten thousand requests a day, less the footprint line each model in memory
+adds every thirty seconds — but how far back your own store reaches depends
 on how much you use it, which is why Settings shows the date beside the two
 limits rather than promising a span.
 
diff --git a/docs/self-test-reference.md b/docs/self-test-reference.md
new file mode 100644
index 00000000..e4ac4ecd
--- /dev/null
+++ b/docs/self-test-reference.md
@@ -0,0 +1,99 @@
+# Reference: the self-test results
+
+What the [self-test](self-test.md) writes, where, and field by field.
+
+## The file
+
+`selftest/results.jsonl` under this account's Gropius data folder: the
+data root for a per-user install or a root set with `GROPIUS_ROOT`, and this
+account's own Application Support directory under a shared install, beside
+the statistics store and under the same rule. Its directory is created, at
+mode 0700, on the first write, and the file is mode 0600.
+
+The format is JSON Lines: one object per line, one run per object, appended
+in the order the runs happened. The file is bounded at 4 MiB. When the next
+line would take it past that, the file is truncated and the line is written to
+the empty file, so the newest run is always kept and the history is at most
+the cap. There is no rotation and no second file.
+
+## A run
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `kind` | string | Always `run`. |
+| `model` | string | The model's repo id, as the models list spells it. |
+| `at` | integer | When the run started, Unix seconds, UTC. |
+| `outcome` | string | `ok`, `yielded`, `stopped` or `failed`; see below. |
+| `reason` | string | For a failed run, `load` or `request`; absent otherwise. |
+| `cold_load` | boolean | `true` when the model was not in memory before the run, so `load_ms` is a load from disk and the run unloaded the model afterwards. |
+| `load_ms` | integer | How long acquiring the model took, in milliseconds. For a model that was already in memory this is close to zero. |
+| `tests` | array | The tests that completed, in the order they ran; see below. A yielded, stopped or failed run carries those that finished before it ended. |
+
+### Outcomes
+
+- `ok` — every test in the set completed.
+- `yielded` — a request from a client arrived, the self-test cancelled its
+  own request and released the model.
+- `stopped` — the switch went off, or Gropius quit, during the run.
+- `failed` — the model could not be loaded (`reason` is `load`), or a request
+  to it failed or timed out (`reason` is `request`). The reason is a class, not
+  the error's text; Gropius's own log has the text.
+
+A model with a failed or yielded run is not retried until its turn comes round
+again the next day. A stopped run does not count: the model is measured
+again when the self-test is next on and the Mac idle.
+
+## A test
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `name` | string | `pp512`, `tg128`, or `tg128xN` where N is the number of requests sent at once. |
+| `parallel` | integer | How many requests were sent at once: 1, or N for the concurrent test. |
+| `prompt_tokens` | integer | The model server's own count of the prompt's tokens, summed across a parallel test. |
+| `completion_tokens` | integer | The model server's own count of the tokens generated, summed across a parallel test. |
+| `first_token_ms` | integer | How long the first piece of the answer took, in milliseconds; the mean across a parallel test. |
+| `total_ms` | integer | How long the whole request took; for a parallel test, the wall time of the batch. |
+| `prompt_tokens_per_sec` | number | The prompt's tokens over the time to the first token: how fast the model read. Zero for a parallel test. |
+| `tokens_per_sec` | number | The tokens after the first over the time after it. For a parallel test, every token the batch generated over the batch's wall time. |
+| `counted` | string | `usage` when the counts are the model server's own, from its usage event; `chunks` when the server sent none and the streamed chunks were counted instead, one a token. |
+
+The prompts are fixed constants and are the same for every model and every
+run: `pp512` is an English passage built to about 512 tokens and asks for one
+token back; `tg128` is one sentence asking for a story and asks for 128 tokens
+back. Neither is written to the file, and nothing of an answer is.
+
+## The set
+
+| Test | What it measures | The figure of note |
+| --- | --- | --- |
+| load | A load from disk, when `cold_load` is true | `load_ms` |
+| `pp512` | Prompt processing: how fast a long prompt is read | `prompt_tokens_per_sec` |
+| `tg128` | Text generation: the first token, and the rate after it | `first_token_ms`, `tokens_per_sec` |
+| `tg128xN` | Generation under N concurrent requests, N being the decode concurrency | `tokens_per_sec` (the batch's), `first_token_ms` (the mean) |
+
+The set runs when the decode concurrency is above one; at one, the concurrent
+test is omitted.
+
+`pp512` is measured through the server: the time to the first token includes
+one decode step and the round trip as well as the prompt's processing, so
+`prompt_tokens_per_sec` runs a little below the figure llama-bench reports
+for the same model, which times the prompt alone.
+
+## The cadence
+
+| | |
+| --- | --- |
+| The idle check | once a minute |
+| Idle means | no request in flight, none waiting for a load, no download running, and the last request older than the idle threshold (`idle_threshold_sec`, five minutes unless set; shared with the context probe) |
+| A model is loaded only when | it fits beside what is in memory; the self-test never evicts |
+| A run in progress ends when | a request is in flight on any model, a load is waiting for room, or a load has been refused room since the run began |
+| A run in progress checks for a client | every quarter of a second |
+| A model is measured again after | one day |
+| One load, and one request, may take at most | ten minutes; longer is a failed run |
+
+## Related
+
+- [Test your models while the Mac is idle](self-test.md) — how to switch it on
+  and what it costs.
+- [Reference: the request statistics store](statistics-store-reference.md) —
+  the file beside this one.
diff --git a/docs/self-test.md b/docs/self-test.md
new file mode 100644
index 00000000..24cde370
--- /dev/null
+++ b/docs/self-test.md
@@ -0,0 +1,115 @@
+# Test your models while the Mac is idle
+
+Gropius can measure its own models, on your Mac, while nobody is using them:
+how long each takes to load, how fast it reads a long prompt, how fast it
+generates, and what that becomes when several requests arrive at once. The
+figures come from your machine rather than from someone else's benchmark, so
+they are the ones to size a model's
+[served context](memory-budget.md) and the decode concurrency from, and to
+compare two quantisations of the same model by numbers instead of by feel.
+
+The self-test is off until you turn it on. Nothing it records leaves this Mac
+([the decision that settles it](../.abcd/development/decisions/adrs/2609061503319212-no-public-telemetry-local-telemetry-only-as-a-strict-opt-in.md)),
+and nothing it records is a prompt or an answer: the file holds counts and
+timings, field by field in
+[Reference: the self-test results](self-test-reference.md).
+
+## Switch it on
+
+1. Open the control panel and go to **Settings → Self-test**.
+2. Tick **Test the models when this Mac is idle**.
+3. **Save settings**.
+
+It applies at once; there is nothing to restart. In `config.json` the same
+switch is `"self_test": true`.
+
+Clear the box and save to switch it off again. A run in progress is stopped
+at once and its model released; the results already written stay where they
+are.
+
+## What happens while it is on
+
+Once a minute Gropius asks whether the Mac is idle: no request in flight on
+any model, no request waiting for a model to load, no download running, and
+the last request older than the idle threshold — five minutes unless you
+change it under **Settings → Context probe**, `idle_threshold_sec` in
+`config.json`; the self-test and the [context probe](context-probe.md) share
+it. When it is, Gropius picks the
+model measured longest ago — a model never measured comes first, and a model
+measured within the last day is left alone — and runs it through the same
+short set every model gets:
+
+- **load** — how long the model takes to load, when it was not already in
+  memory.
+- **pp512** — a prompt of about 512 tokens, asking for one token back: how
+  fast the model reads.
+- **tg128** — a short prompt, asking for 128 tokens back: how long the first
+  token takes and how fast the rest come.
+- **tg128×N** — the same, sent N times at once, where N is the decode
+  concurrency: what the machine delivers when several clients arrive
+  together.
+
+The names are [llama-bench](https://github.com/ggml-org/llama.cpp/tree/master/tools/llama-bench)'s,
+so a figure here can be set beside a published one.
+
+When the set is done Gropius writes one line to the results file and, if the
+self-test was what loaded the model, unloads it again; a model that was
+already in memory is left there. Then it goes back to waiting for the next
+idle minute and the next model.
+
+## What it costs, and what it never does
+
+A run holds one model for the length of the set — a few seconds for a small
+model, a minute or two for a large one on a cold load — and the memory that
+model takes while it is held. The load goes through the same path a request
+takes, so the [memory budget](memory-budget.md) and the
+[pinned models](pinning-models.md) apply, and the self-test never evicts: a
+model that would need another pushed out to make room is left for a time
+when there is room, so the model you keep warm stays warm.
+
+A request from anyone ends the run at once, during a load as much as during
+a test: the self-test's own request or load is cancelled, the run is recorded
+as yielded, and the model is the client's. A request for a model already in
+memory waits a moment for that cancellation and for nothing else. A request
+whose model would need the memory the run is holding is refused once, the
+way any request is refused when nothing can be freed, and the run ends at
+that refusal, so the client's retry finds the room. Removing a model that is
+under test is refused until the run ends, as removing a model that is
+serving is.
+
+A run touches the model the way a request does, so when
+[request statistics](request-statistics.md) are on, the self-test's loads and
+unloads appear in the load and eviction views there, and a model the
+self-test measured counts as recently used for the idle timeout.
+
+The self-test never runs a model the Mac does not already have, never sends
+anything anywhere but to the model server on this Mac, and never records a
+prompt, an answer, a key or an address.
+
+## Where the results are
+
+The **Statistics** tab of the control panel shows the latest run for each
+model — when it ran, how it ended, the load time, and the figures of note
+from each test — and the most recent runs beneath. It shows them whether or
+not request statistics are being recorded; the two switches are separate.
+
+The file is `selftest/results.jsonl` in your Gropius data folder, beside the
+[statistics store](statistics-store-reference.md): one line of JSON per run,
+readable with any tool that reads JSON Lines. It is this account's own file,
+at mode 0600, and it is bounded — when the next line would take it past
+4 MiB it is started again, which is thousands of runs away. The
+[reference page](self-test-reference.md) names every field.
+
+On a Mac several people log into, the models are one set, so the self-test
+measures every account's models, and the switch and the file are the serving
+account's own.
+
+## Related
+
+- [Reference: the self-test results](self-test-reference.md) — every field of
+  a results line.
+- [The memory budget](memory-budget.md) — what a loaded model is charged, which
+  is what the load figure and the concurrency figure are for.
+- [Record request statistics on this Mac](request-statistics.md) — what real
+  requests did, as opposed to what a model can do when asked the same thing as
+  every other.
diff --git a/docs/statistics-explained.md b/docs/statistics-explained.md
index f0dc64b0..59b39611 100644
--- a/docs/statistics-explained.md
+++ b/docs/statistics-explained.md
@@ -131,6 +131,37 @@ never became ready, because the cost this table is about is the loading, which
 a server that failed still spent. It cannot say why a model was loaded: Gropius
 knows only that something asked for it.
 
+## Prompts against the window
+
+One row per model: how the prompts it was asked sat against the window it
+serves, in four bands of that window — up to a quarter of it, up to a half,
+up to three quarters, up to the whole — and beyond it, which is the requests
+the served window turned away. The size is the figure the refusal is judged
+on: Gropius's own estimate of the prompt from the request's bytes, plus the
+answer the request asked for — so a refused request is counted in the last
+band by the figure that refused it. The row
+carries the two windows beside the counts, and the largest prompt anyone
+sent, so a served window can be sized from what was actually asked rather
+than from what the model declares.
+
+## Sampling overrides
+
+One row per model: of the requests it was asked — served, refused or failed
+alike — how many set each sampling parameter themselves — the temperature, the top-p, the top-k, the min-p, the
+maximum tokens — rather than taking the value the server was launched with.
+Only the names are counted; no value a client sent is anywhere in the
+records. A parameter nobody overrides is one whose launch value is doing the
+work, and one everybody overrides is one whose launch value is not.
+
+## Memory over time
+
+One line per model: the model server's resident memory, sampled every thirty
+seconds while it ran, averaged into at most two hundred points across the
+range. It is a reading of the process, so it rises with the prompts in it
+and the cache they build and falls when the server is stopped; it is not a
+cost that can be attributed to any one request. Read it beside the memory
+budget to see how close a model comes to what it is charged.
+
 ## What none of the views can show
 
 **Anything that happened while the switch was off.** The tables draw on the
@@ -156,6 +187,18 @@ model and per period and never says who: not which machine on your network,
 not which account on this Mac. On a Mac several people share, the records cover
 every request the server handled and still say nothing about whose they were.
 
+**As far back as the request views once did, on a Mac that keeps models
+loaded.** The pass over the records reads a bounded number of lines, and a
+footprint line every thirty seconds per model in memory is a few thousand
+lines a day that the request views did not have to walk before; on a Mac
+with two models always loaded the tables reach a shorter range than the
+retention alone would give.
+
+**What one request cost in memory.** The footprint is sampled from the
+process every thirty seconds and stitched onto a completing request by time;
+it says what the server was holding, not what that request added. Two long
+prompts in flight together are one reading.
+
 **What was asked or answered.** No prompt, no completion, no API key. The part
 of Gropius that keeps these figures is never handed a request, its headers or
 its connection, so there is nothing of the kind for a table to show.
diff --git a/docs/statistics-store-reference.md b/docs/statistics-store-reference.md
index 7f2f6625..7793b6d2 100644
--- a/docs/statistics-store-reference.md
+++ b/docs/statistics-store-reference.md
@@ -44,7 +44,7 @@ Every line carries two fields before anything else:
 | Field | Meaning |
 | --- | --- |
 | `v` | The version of this format the line was written under. A later Gropius can still read an older file. |
-| `kind` | Which of the six kinds below the line is: `request`, `load`, `removed`, `settings`, `summary` or `summary_index`. The first four are the record kinds the [decision record](../.abcd/development/decisions/adrs/2609090716413337-the-statistics-store-s-record-kinds-are-request-load-removed.md) ratifies, and the last two belong to the summary that is kept when detail is dropped, which is why that record counts four kinds and this page counts six. |
+| `kind` | Which of the seven kinds below the line is: `request`, `load`, `removed`, `footprint`, `settings`, `summary` or `summary_index`. The first five are the record kinds the [decision record](../.abcd/development/decisions/adrs/2609121450000000-the-statistics-store-gains-a-fifth-record-kind-a-footprint.md) ratifies, and the last two belong to the summary that is kept when detail is dropped, which is why that record counts five kinds and this page counts seven. |
 
 A reader should ignore a field it does not know, and skip a line it cannot
 parse. A line whose `v` is newer than the reader understands is one to skip:
@@ -83,6 +83,12 @@ no answer, no key, no client address (see
 | `duration_ms` | How long the whole request took, from the moment it arrived. |
 | `queue_wait_ms` | How long it waited for the machine rather than for the model: for a free slot on a model that was already loaded, and for memory to free up under [eviction grace](eviction-grace.md). |
 | `load_wait_ms` | How long it waited for the model to load. |
+| `declared_context`, `served_context` | The two windows the request was judged against: the one the model's own configuration declares, and the one this Mac serves it at. Absent on a request refused before it named a model. |
+| `estimated_prompt_tokens` | Gropius's own estimate of the prompt's size, from the request's bytes, written for every request including one refused for its size — so a refusal still says how big the prompt was. The model server's exact count is `prompt_tokens`, on an answered request only. |
+| `requested_tokens` | The figure the served-window check judged: the estimate above plus the answer the request asked for. A request is refused when this is over `served_context`, so the record, the refusal and the dashboard's bands rest on one number. |
+| `in_flight` | How many requests the model already had when this one was admitted. |
+| `overrides` | The names of the sampling parameters the client set in its own request — the temperature, the top-p, the top-k, the min-p and the maximum tokens; a maximum set under either of its two spellings is recorded as the one name — and never their values. It is the one field derived from a client's body, and it says only which knob was touched. Absent when the client set none. |
+| `footprint_bytes` | The model server's memory footprint as last sampled before the request completed: a periodic reading of the process, joined by time, not a cost attributable to this request. Absent when nothing had been sampled, and on a request that never reached the model. |
 
 ## `kind: "load"` — a model server became ready
 
@@ -92,6 +98,7 @@ no answer, no key, no client address (see
 | `model` | The model's repo id. |
 | `duration_ms` | How long the load took. |
 | `failed` | Present and `true` when the model server started but never became ready. |
+| `sampling` | The sampling values the model server was launched with, by parameter name, only the ones set. It is what a request's `overrides` are overrides of. Absent when every value was the model's own default. |
 
 A load carries no `reason`: nothing in Gropius knows why a model was loaded
 beyond the fact that something asked for it.
@@ -108,6 +115,20 @@ Only `evicted` is an eviction — a model taken out to make room for another.
 Counting an idle reap, an operator's unload or a crash as one would make the
 figures disagree with what happened.
 
+## `kind: "footprint"` — a reading of a model server's memory
+
+| Field | Meaning |
+| --- | --- |
+| `at` | When the reading was taken, in whole UTC seconds. |
+| `model` | The model's repo id. |
+| `bytes` | The server process's resident memory at that moment. |
+
+Taken every thirty seconds for each model server that is ready to serve, so the
+footprint exists as a series over time and not only as the value a completing
+request happened to see. A reading is of the process, not of any request:
+what a long prompt cost is not recoverable from it, only what the server was
+holding while that prompt and any others were in it.
+
 ## `kind: "settings"` — what Gropius was serving under
 
 Written each time recording starts and whenever one of these changes, so a
@@ -213,8 +234,10 @@ Anything under one of these names that is not a plain file — a named pipe, a
 device, a folder — is refused rather than read. Gropius never waits on
 something in this folder to answer it.
 
-A record measures about 230 bytes, so 200 MB is roughly three months of ten
-thousand requests a day. How far back the store actually reaches is shown on
+A request record measures about 380 bytes, so 200 MB is roughly seven weeks
+of ten thousand requests a day; a footprint line every thirty seconds per
+model in memory adds about a tenth of a megabyte a day per model, which on a
+quiet Mac is most of the file. How far back the store actually reaches is shown on
 the Settings page beside the two limits, rather than promised here.
 
 ## What removes the files
diff --git a/internal/app/app.go b/internal/app/app.go
index c165b0e4..32574cfe 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"log/slog"
 	"maps"
+	"path/filepath"
 	"slices"
 	"strings"
 	"sync"
@@ -17,9 +18,11 @@ import (
 	"github.com/intentdriven/Gropius/internal/bind"
 	"github.com/intentdriven/Gropius/internal/capability"
 	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/contextprobe"
 	"github.com/intentdriven/Gropius/internal/hub"
 	"github.com/intentdriven/Gropius/internal/registry"
 	"github.com/intentdriven/Gropius/internal/runtime"
+	"github.com/intentdriven/Gropius/internal/selftest"
 	"github.com/intentdriven/Gropius/internal/stats"
 )
 
@@ -37,7 +40,18 @@ type App struct {
 	// same switch as the live view and no other, and it creates nothing —
 	// not a file, not its own directory — until that switch is on.
 	StatsStore *stats.FileStore
-	Log        *slog.Logger
+	// SelfTest measures the models while nobody is using them, under its own
+	// switch (config.Config.SelfTest); off, it holds no goroutine and writes
+	// nothing. It reaches the pool only through selfTestServer, which holds
+	// none of the app's locks across a call (adr-2609091239058072).
+	SelfTest *selftest.Runner
+	// Probe measures each model's servable context window as a job of that
+	// same loop (itd-2609091301112705); see internal/contextprobe.
+	Probe *contextprobe.Probe
+	Log   *slog.Logger
+	// idleQuiet is Options.Idle.Quiet: a cadence a test fixed, which a save
+	// must not replace with the configured threshold.
+	idleQuiet time.Duration
 
 	// logLevel is Options.LogLevel: the variable Log's handler reads. Held so
 	// that applyLogLevel can move it at a save. Nil is the switched-off case
@@ -164,6 +178,24 @@ type Options struct {
 	// through, and handing the app a second way to reach the handler would be a
 	// second answer to "what level is in force".
 	LogLevel *slog.LevelVar
+	// Idle sets the idle loop's and the probe's cadence. The zero value —
+	// the shipping case — means the production cadence: a tick a minute, a
+	// quarter-second poll, the configured idle threshold, the gateway's own
+	// prefill budget as the probe's step timeout. It is a seam because a test
+	// that drives the whole path — the probe's request through the gateway to
+	// a real pool — cannot wait a minute a tick.
+	Idle IdleOptions
+}
+
+// IdleOptions is the cadence the idle loop and the context probe run at; see
+// Options.Idle. Zero means the default for each.
+type IdleOptions struct {
+	Tick, Poll, Quiet time.Duration
+	// StepTimeout bounds one of the probe's requests, given the body's size.
+	StepTimeout func(bodyBytes int) time.Duration
+	// UnloadWait bounds the probe's wait for the gateway to release a
+	// cancelled request, and for an unloaded server to hand memory back.
+	UnloadWait time.Duration
 }
 
 // New wires the application together.
@@ -223,6 +255,7 @@ func New(opts Options) (*App, error) {
 		downloads:   map[string]*download{},
 		deleting:    map[string]bool{},
 		measureDir:  dirSize,
+		idleQuiet:   opts.Idle.Quiet,
 	}
 
 	launcher := opts.Launcher
@@ -282,6 +315,31 @@ func New(opts Options) (*App, error) {
 		MaxLoadWaitersPerSource: 2,
 	})
 	a.applyStatistics(opts.Config)
+	a.Probe = contextprobe.New(contextprobe.Options{
+		Sources: probeSources{a},
+		Enabled: func() bool { return a.Config().ContextProbe },
+		Log:     opts.Log,
+		// The campaign's margin, 24 GB on a 128 GB Mac, as a share of this
+		// one: a step projected within it of what the budget has free is
+		// skipped.
+		MemoryMargin: a.machineRAM * 3 / 16,
+		StepTimeout:  opts.Idle.StepTimeout,
+		UnloadWait:   opts.Idle.UnloadWait,
+	})
+	a.SelfTest = selftest.New(selftest.Options{
+		Server:   selfTestServer{a},
+		Path:     filepath.Join(opts.Paths.SelfTest, selftest.FileName),
+		Log:      opts.Log,
+		Jobs:     []selftest.Job{a.Probe},
+		SelfTest: func() bool { return a.Config().SelfTest },
+		Tick:     opts.Idle.Tick,
+		Poll:     opts.Idle.Poll,
+		Quiet:    opts.Idle.Quiet,
+	})
+	// Staleness is a stored fact: judged now, against what this start put in
+	// force, before anything reads a measurement.
+	a.refreshStaleness()
+	a.applyIdleJobs(opts.Config)
 	a.applyLogLevel(opts.Config)
 
 	// The fit check cannot refuse a file — a hand-edited one can pin anything —
@@ -431,6 +489,13 @@ func (a *App) SetConfig(c config.Config) error {
 	// records already on disk stay where they are, because switching recording
 	// off is asking for it to stop, not for a history to be destroyed.
 	a.applyStatistics(c)
+	// The idle jobs' switches apply live too: on starts the loop, and off
+	// cancels a run in progress and releases its model, so a person who
+	// switched it off because the Mac is needed gets the Mac back now. And a
+	// save may have moved a measurement's provenance — the budget, the
+	// concurrency, a served window — so every measurement is judged again.
+	a.applyIdleJobs(c)
+	a.refreshStaleness()
 
 	// Behind the hub's own lock: download goroutines read the token to build
 	// every request they issue, and a download already running keeps the token
@@ -815,6 +880,37 @@ type poolObserver struct {
 
 func (o poolObserver) LoadStarted(repoID string) { o.rec.LoadStarted(repoID) }
 
+// FootprintSampled forwards a footprint reading; the recorder ignores it
+// while recording is off.
+func (o poolObserver) FootprintSampled(repoID string, bytes int64) {
+	o.rec.FootprintSampled(repoID, bytes)
+}
+
+// samplingValues is the launch flags by name, only the ones set: the wire
+// shape the statistics package keeps, which imports nothing of ours.
+func samplingValues(s config.Sampling) map[string]float64 {
+	out := map[string]float64{}
+	if s.Temperature != nil {
+		out["temperature"] = *s.Temperature
+	}
+	if s.TopP != nil {
+		out["top_p"] = *s.TopP
+	}
+	if s.TopK != nil {
+		out["top_k"] = float64(*s.TopK)
+	}
+	if s.MinP != nil {
+		out["min_p"] = *s.MinP
+	}
+	if s.MaxTokens != nil {
+		out["max_tokens"] = float64(*s.MaxTokens)
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
 // LoadFinished records the load and says, in one sparse line, whether the
 // model is now serving.
 //
@@ -825,8 +921,8 @@ func (o poolObserver) LoadStarted(repoID string) { o.rec.LoadStarted(repoID) }
 // child process said, which on this path can be an os.PathError carrying
 // absolute paths out of this account's own home directory. Both go to the
 // detailed level, where the operator has asked for them.
-func (o poolObserver) LoadFinished(repoID string, took time.Duration, err error) {
-	o.rec.LoadFinished(repoID, took, err)
+func (o poolObserver) LoadFinished(repoID string, took time.Duration, err error, sampling config.Sampling) {
+	o.rec.LoadFinished(repoID, took, err, samplingValues(sampling))
 	if err != nil {
 		o.log.Info("model failed to load", "model", repoID)
 		o.log.Debug("model failed to load", "model", repoID, "took", took, "err", err)
@@ -1626,6 +1722,9 @@ func (a *App) Close() error {
 	// model still resident, and closing the store before that would throw
 	// those away. Closing the store then flushes whatever the last few seconds
 	// of requests recorded.
+	// The self-test before the pool: a run in progress holds a model, and the
+	// pool's close would otherwise wait on a release that is on its way.
+	a.SelfTest.Close()
 	err := a.Pool.Close()
 	if cerr := a.StatsStore.Close(); err == nil {
 		err = cerr
diff --git a/internal/app/contextprobe.go b/internal/app/contextprobe.go
new file mode 100644
index 00000000..6e69e8da
--- /dev/null
+++ b/internal/app/contextprobe.go
@@ -0,0 +1,161 @@
+package app
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/contextprobe"
+	"github.com/intentdriven/Gropius/internal/registry"
+	"github.com/intentdriven/Gropius/internal/runtime"
+)
+
+// ErrNoMeasurement is returned when a model has nothing to adopt.
+var ErrNoMeasurement = errors.New("the model has no current measurement")
+
+// probeSources is what the context probe sees of the app. Like
+// selfTestServer it holds none of the app's locks across a call
+// (adr-2609091239058072): each method takes the registry's, the pool's or the
+// configuration's own lock for one read.
+type probeSources struct{ a *App }
+
+func (s probeSources) Candidates() []contextprobe.Candidate {
+	cfg := s.a.Config()
+	models := s.a.Registry.Ready()
+	out := make([]contextprobe.Candidate, 0, len(models))
+	for _, m := range models {
+		out = append(out, contextprobe.Candidate{
+			RepoID:           m.RepoID,
+			Declared:         m.ContextLength,
+			Served:           cfg.ServedContext(m.RepoID, m.ContextLength),
+			Bytes:            chargedSize(m),
+			KVChargePerToken: m.KVChargePerToken,
+			Measured:         m.Measured,
+			Incomplete:       m.ProbeIncomplete,
+		})
+	}
+	return out
+}
+
+// Provenance is what is in force for a model now: the runtime this build
+// runs, the budget and concurrency the pool enforces, and the model's served
+// window. It is the one spelling of the provenance, used both to stamp a
+// measurement and to judge it stale.
+func (s probeSources) Provenance(repoID string) registry.Provenance {
+	declared := int64(0)
+	if m, err := s.a.Registry.Get(repoID); err == nil {
+		declared = m.ContextLength
+	}
+	return s.provenanceFor(repoID, declared)
+}
+
+// provenanceFor is Provenance with the declared window in hand, for a caller
+// that already holds the model — the registry's own staleness refresh, which
+// runs under the registry's lock and must not read it back.
+func (s probeSources) provenanceFor(repoID string, declared int64) registry.Provenance {
+	return registry.Provenance{
+		Runtime:           runtime.MLXLMVersion(),
+		BudgetBytes:       s.a.Pool.MemoryBudget(),
+		DecodeConcurrency: s.a.Pool.DecodeConcurrency(),
+		ServedContext:     s.a.Config().ServedContext(repoID, declared),
+	}
+}
+
+// Available is what the budget has free: the budget less every resident
+// charge and the memory still on its way out.
+func (s probeSources) Available() int64 {
+	res := s.a.Pool.Residency()
+	used := res.ExitingBytes
+	for _, m := range res.Models {
+		used += m.Charge
+	}
+	return s.a.Pool.MemoryBudget() - used
+}
+
+func (s probeSources) Unload(repoID string) error { return s.a.Pool.Unload(repoID) }
+
+func (s probeSources) Save(repoID string, m *registry.Measurement) error {
+	return s.a.Registry.SetMeasurement(repoID, m)
+}
+
+func (s probeSources) MarkIncomplete(repoID string, on bool) error {
+	return s.a.Registry.SetProbeIncomplete(repoID, on)
+}
+
+// Endpoint is this Mac's own OpenAI endpoint on loopback, and the API key
+// in force: sent although loopback is admitted without it, so a later
+// tightening of that rule does not silently break the probe.
+func (s probeSources) Endpoint() (string, string) {
+	host := net.JoinHostPort(s.a.bindPlan.Loopback, strconv.Itoa(s.a.BindPort()))
+	return "http://" + host, s.a.Config().APIKey
+}
+
+// applyIdleJobs puts the idle loop's switches into force: the loop runs when
+// either idle job is switched on or a probe is queued, the self-test's own
+// set follows its switch alone, and the idle threshold applies to both.
+func (a *App) applyIdleJobs(c config.Config) {
+	if a.idleQuiet == 0 {
+		a.SelfTest.SetQuiet(c.EffectiveIdleThreshold())
+	}
+	a.SelfTest.SetEnabled(c.SelfTest || c.ContextProbe || len(a.Probe.Queued()) > 0)
+}
+
+// refreshStaleness compares every measurement with what is in force now and
+// records the verdict, at start and after every save.
+func (a *App) refreshStaleness() {
+	src := probeSources{a}
+	if changed := a.Registry.RefreshStaleness(func(m registry.Model) registry.Provenance {
+		return src.provenanceFor(m.RepoID, m.ContextLength)
+	}); len(changed) > 0 {
+		a.Log.Info("context measurements re-judged against the settings in force", "models", changed)
+	}
+}
+
+// MeasureNow queues one probe of the model, whatever the switch says, and
+// makes sure the idle loop is running to pick it up.
+func (a *App) MeasureNow(repoID string) error {
+	m, err := a.Registry.Get(repoID)
+	if err != nil {
+		return err
+	}
+	if !m.Ready() {
+		return fmt.Errorf("%s is not ready", repoID)
+	}
+	if m.ContextLength <= 0 {
+		return fmt.Errorf("%s declares no context window; there is nothing to measure between", repoID)
+	}
+	// Under the save lock, so a save that reads the queue empty cannot
+	// switch the loop off between the queueing and the start.
+	a.saveMu.Lock()
+	defer a.saveMu.Unlock()
+	a.Probe.MeasureNow(m.RepoID)
+	a.SelfTest.SetEnabled(true)
+	return nil
+}
+
+// AdoptMeasurement makes a model's current measurement its served window:
+// the setting that already exists, already charged by the budget and already
+// enforced at the gateway. It is a settings save like any other, so every
+// check a save makes is made here, and nothing else changes.
+func (a *App) AdoptMeasurement(repoID string) error {
+	m, err := a.Registry.Get(repoID)
+	if err != nil {
+		return err
+	}
+	if m.Measured == nil || m.Measured.Stale != "" {
+		return ErrNoMeasurement
+	}
+	c := a.Config()
+	models := make(map[string]config.ModelSettings, len(c.Models)+1)
+	for k, v := range c.Models {
+		models[k] = v
+	}
+	key := a.canonicalModelKey(m.RepoID)
+	ms := models[key]
+	ms.ServedContext = m.Measured.Window
+	models[key] = ms
+	c.Models = models
+	return a.SetConfig(c)
+}
diff --git a/internal/app/contextprobe_test.go b/internal/app/contextprobe_test.go
new file mode 100644
index 00000000..78e64533
--- /dev/null
+++ b/internal/app/contextprobe_test.go
@@ -0,0 +1,181 @@
+package app
+
+import (
+	"errors"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/registry"
+	"github.com/intentdriven/Gropius/internal/runtime"
+)
+
+func readyModel(t *testing.T, a *App, id string, declared int64) {
+	t.Helper()
+	if err := a.Registry.Put(registry.Model{
+		RepoID: id, Path: a.Paths.ModelDir(id), State: registry.StateReady,
+		Bytes: 1 << 20, ContextLength: declared, KVChargePerToken: 64,
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// With the switch off a finished download arms nothing: the probe has no
+// model due, the loop is not running, and only "Measure now" changes that.
+func TestADownloadDoesNotStartAProbe(t *testing.T) {
+	a := newTestApp(t)
+	readyModel(t, a, "org/m", 131072)
+	if due := a.Probe.Due([]string{"org/m"}, time.Now()); due != "" {
+		t.Errorf("a ready model is due for a probe with the switch off: %q", due)
+	}
+	if a.SelfTest.Enabled() {
+		t.Error("the idle loop runs with both switches off")
+	}
+	if err := a.MeasureNow("org/m"); err != nil {
+		t.Fatal(err)
+	}
+	if due := a.Probe.Due([]string{"org/m"}, time.Now()); due != "org/m" {
+		t.Errorf("Measure now did not make the model due: %q", due)
+	}
+	if !a.SelfTest.Enabled() {
+		t.Error("Measure now did not start the idle loop")
+	}
+	// A model with no declared window has nothing to bisect between.
+	readyModel(t, a, "org/nowindow", 0)
+	if err := a.MeasureNow("org/nowindow"); err == nil {
+		t.Error("a model with no declared window was queued")
+	}
+}
+
+// The switch on starts the loop and makes an unmeasured model due; off stops
+// it. Quitting leaves nothing running.
+func TestTheProbeSwitchStartsTheIdleLoopAndQuitStopsIt(t *testing.T) {
+	a := newTestApp(t)
+	readyModel(t, a, "org/m", 131072)
+	on := config.Default()
+	on.ContextProbe = true
+	if err := a.SetConfig(on); err != nil {
+		t.Fatal(err)
+	}
+	if !a.SelfTest.Enabled() {
+		t.Error("the probe switch did not start the idle loop")
+	}
+	if due := a.Probe.Due([]string{"org/m"}, time.Now()); due != "org/m" {
+		t.Errorf("an unmeasured model is not due with the switch on: %q", due)
+	}
+	if err := a.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if a.SelfTest.Enabled() || a.SelfTest.Status().Job != "" {
+		t.Error("quitting left the idle loop or a job running")
+	}
+}
+
+// Adopting a measurement writes the served window, through the same save
+// every setting goes through; until then the measurement changes no charge.
+func TestAdoptingAMeasurementSetsTheServedContextAndAnUnadoptedOneChangesNoCharge(t *testing.T) {
+	a := newTestApp(t)
+	readyModel(t, a, "org/m", 131072)
+	m, _ := a.Registry.Get("org/m")
+	before := a.chargeOf(m, chargedSize(m))
+	if err := a.AdoptMeasurement("org/m"); !errors.Is(err, ErrNoMeasurement) {
+		t.Errorf("adopting nothing = %v, want ErrNoMeasurement", err)
+	}
+	src := probeSources{a}
+	prov := src.Provenance("org/m")
+	if err := a.Registry.SetMeasurement("org/m", &registry.Measurement{
+		Window: 65536, Bound: registry.BoundPrefillDeadline, At: 1,
+		Runtime: prov.Runtime, BudgetBytes: prov.BudgetBytes, DecodeConcurrency: prov.DecodeConcurrency, ServedContext: prov.ServedContext,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	m, _ = a.Registry.Get("org/m")
+	if got := a.chargeOf(m, chargedSize(m)); got != before {
+		t.Errorf("an unadopted measurement changed the charge from %d to %d", before, got)
+	}
+	if got := a.Config().ServedContext("org/m", 131072); got != 131072 {
+		t.Errorf("an unadopted measurement changed the served window to %d", got)
+	}
+	if err := a.AdoptMeasurement("org/m"); err != nil {
+		t.Fatal(err)
+	}
+	if got := a.Config().ServedContext("org/m", 131072); got != 65536 {
+		t.Errorf("served window after adoption = %d, want 65536", got)
+	}
+	m, _ = a.Registry.Get("org/m")
+	if got := a.chargeOf(m, chargedSize(m)); got >= before {
+		t.Errorf("the adopted window did not lower the charge (%d before, %d after)", before, got)
+	}
+	// Adoption set the served window to the measured window itself, which
+	// is not a move: the floor still stands, and the card keeps its figure.
+	if m.Measured.Stale != "" {
+		t.Errorf("after adoption the measurement is %q, want current", m.Measured.Stale)
+	}
+	// Any other served window is a move.
+	c := a.Config()
+	c.Models = map[string]config.ModelSettings{"org/m": {ServedContext: 32768}}
+	if err := a.SetConfig(c); err != nil {
+		t.Fatal(err)
+	}
+	if m, _ := a.Registry.Get("org/m"); m.Measured.Stale != registry.StaleServedContext {
+		t.Errorf("a served window other than the measured one left the measurement %q", m.Measured.Stale)
+	}
+}
+
+// A save that moves the budget, the concurrency or a served window re-judges
+// every measurement; a save that touches none of them leaves the verdict.
+func TestASaveRejudgesMeasurementsAndAnUnrelatedSaveKeepsTheProbeSettings(t *testing.T) {
+	a := newTestApp(t)
+	readyModel(t, a, "org/m", 131072)
+	prov := probeSources{a}.Provenance("org/m")
+	if err := a.Registry.SetMeasurement("org/m", &registry.Measurement{
+		Window: 65536, Bound: registry.BoundModel, At: 1,
+		Runtime: prov.Runtime, BudgetBytes: prov.BudgetBytes, DecodeConcurrency: prov.DecodeConcurrency, ServedContext: prov.ServedContext,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	c := config.Default()
+	c.ContextProbe = true
+	c.IdleThresholdSec = 120
+	if err := a.SetConfig(c); err != nil {
+		t.Fatal(err)
+	}
+	if m, _ := a.Registry.Get("org/m"); m.Measured.Stale != "" {
+		t.Errorf("an unrelated save made the measurement stale: %q", m.Measured.Stale)
+	}
+	c = a.Config()
+	c.LogLevel = "detailed"
+	if err := a.SetConfig(c); err != nil {
+		t.Fatal(err)
+	}
+	if got := a.Config(); !got.ContextProbe || got.IdleThresholdSec != 120 {
+		t.Errorf("a save of the log level moved the probe settings: probe=%v threshold=%d", got.ContextProbe, got.IdleThresholdSec)
+	}
+	c = a.Config()
+	c.Models = map[string]config.ModelSettings{"org/m": {ServedContext: 32768}}
+	if err := a.SetConfig(c); err != nil {
+		t.Fatal(err)
+	}
+	if m, _ := a.Registry.Get("org/m"); m.Measured.Stale != registry.StaleServedContext {
+		t.Errorf("a served-window save left the measurement %q, want stale for the served window", m.Measured.Stale)
+	}
+}
+
+// The provenance the app stamps is the one it judges by: the pinned runtime,
+// the pool's budget and concurrency, the model's served window.
+func TestTheProvenanceIsWhatThePoolAndTheRuntimeSay(t *testing.T) {
+	a := newTestApp(t)
+	readyModel(t, a, "org/m", 131072)
+	p := probeSources{a}.Provenance("org/m")
+	if p.Runtime != runtime.MLXLMVersion() || p.BudgetBytes != a.Pool.MemoryBudget() ||
+		p.DecodeConcurrency != a.Pool.DecodeConcurrency() || p.ServedContext != 131072 {
+		t.Errorf("provenance = %+v", p)
+	}
+	url, _ := probeSources{a}.Endpoint()
+	if url != "http://127.0.0.1:"+itoa(a.BindPort()) {
+		t.Errorf("endpoint = %q, want this Mac's own loopback endpoint", url)
+	}
+}
+
+func itoa(n int) string { return strconv.Itoa(n) }
diff --git a/internal/app/loglevel_test.go b/internal/app/loglevel_test.go
index 8adb71e8..c9c134a9 100644
--- a/internal/app/loglevel_test.go
+++ b/internal/app/loglevel_test.go
@@ -134,7 +134,7 @@ func TestALoadAndAnUnloadAreOneSparseLineEach(t *testing.T) {
 	obs := poolObserver{rec: stats.New(stats.Options{}), log: log}
 
 	obs.LoadStarted("org/repo")
-	obs.LoadFinished("org/repo", 4*time.Second, nil)
+	obs.LoadFinished("org/repo", 4*time.Second, nil, config.Sampling{})
 	obs.EntryStopped("org/repo", runtime.StopEvicted)
 
 	got := buf.String()
@@ -156,7 +156,7 @@ func TestALoadThatFailedIsSparseAndItsErrorIsDetailed(t *testing.T) {
 	t.Run("sparse", func(t *testing.T) {
 		log, _, buf := levelledLog(slog.LevelInfo)
 		obs := poolObserver{rec: stats.New(stats.Options{}), log: log}
-		obs.LoadFinished("org/repo", time.Second, errors.New("no such file or directory"))
+		obs.LoadFinished("org/repo", time.Second, errors.New("no such file or directory"), config.Sampling{})
 
 		got := buf.String()
 		if !strings.Contains(got, "model failed to load") || !strings.Contains(got, "org/repo") {
@@ -169,7 +169,7 @@ func TestALoadThatFailedIsSparseAndItsErrorIsDetailed(t *testing.T) {
 	t.Run("detailed", func(t *testing.T) {
 		log, _, buf := levelledLog(slog.LevelDebug)
 		obs := poolObserver{rec: stats.New(stats.Options{}), log: log}
-		obs.LoadFinished("org/repo", time.Second, errors.New("no such file or directory"))
+		obs.LoadFinished("org/repo", time.Second, errors.New("no such file or directory"), config.Sampling{})
 
 		got := buf.String()
 		if !strings.Contains(got, "no such file or directory") {
@@ -188,7 +188,7 @@ func TestDetailedAddsToTheSparseLineRatherThanReplacingIt(t *testing.T) {
 	log, _, buf := levelledLog(slog.LevelDebug)
 	obs := poolObserver{rec: stats.New(stats.Options{}), log: log}
 
-	obs.LoadFinished("org/repo", 4*time.Second, nil)
+	obs.LoadFinished("org/repo", 4*time.Second, nil, config.Sampling{})
 
 	got := buf.String()
 	if !strings.Contains(got, "model loaded") {
diff --git a/internal/app/measurement_test.go b/internal/app/measurement_test.go
new file mode 100644
index 00000000..8ed86cad
--- /dev/null
+++ b/internal/app/measurement_test.go
@@ -0,0 +1,26 @@
+package app
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/intentdriven/Gropius/internal/config"
+)
+
+// The launch flags reach the load event by name, only the ones set: the
+// statistics package keeps a wire shape and imports nothing of ours, so the
+// mapping is here, and this holds it to the five parameters.
+func TestALoadEventCarriesTheLaunchSampling(t *testing.T) {
+	temp, topP, topK, minP, maxT := 0.7, 0.9, 40, 0.05, 512
+	got := samplingValues(config.Sampling{Temperature: &temp, TopP: &topP, TopK: &topK, MinP: &minP, MaxTokens: &maxT})
+	want := map[string]float64{"temperature": 0.7, "top_p": 0.9, "top_k": 40, "min_p": 0.05, "max_tokens": 512}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("samplingValues = %v, want %v", got, want)
+	}
+	if got := samplingValues(config.Sampling{}); got != nil {
+		t.Errorf("no flags set gave %v, want nil", got)
+	}
+	if got := samplingValues(config.Sampling{TopK: &topK}); !reflect.DeepEqual(got, map[string]float64{"top_k": 40}) {
+		t.Errorf("one flag set gave %v", got)
+	}
+}
diff --git a/internal/app/observer_test.go b/internal/app/observer_test.go
index 1abff653..a566efd2 100644
--- a/internal/app/observer_test.go
+++ b/internal/app/observer_test.go
@@ -3,6 +3,7 @@ package app
 import (
 	"bytes"
 	"errors"
+	"github.com/intentdriven/Gropius/internal/config"
 	"log/slog"
 	"testing"
 	"time"
@@ -50,7 +51,7 @@ func TestOnlyThePoolsEvictionIncrementsTheEvictionCount(t *testing.T) {
 	obs := poolObserver{rec: rec, log: slog.New(slog.DiscardHandler)}
 
 	obs.LoadStarted("org/a")
-	obs.LoadFinished("org/a", 2*time.Second, nil)
+	obs.LoadFinished("org/a", 2*time.Second, nil, config.Sampling{})
 	for reason := range stopReasons {
 		obs.EntryStopped("org/a", reason)
 	}
@@ -62,7 +63,7 @@ func TestOnlyThePoolsEvictionIncrementsTheEvictionCount(t *testing.T) {
 	if got.Loads != 1 || got.LastLoadMS != 2000 {
 		t.Errorf("the load was recorded as %+v, want one load of 2000 ms", got)
 	}
-	obs.LoadFinished("org/b", time.Second, errors.New("did not become ready"))
+	obs.LoadFinished("org/b", time.Second, errors.New("did not become ready"), config.Sampling{})
 	for _, m := range rec.Summary() {
 		if m.Model == "org/b" && m.FailedLoads != 1 {
 			t.Errorf("a load that failed was recorded as %+v, want one failed load", m)
diff --git a/internal/app/selftest.go b/internal/app/selftest.go
new file mode 100644
index 00000000..9ec6cbd9
--- /dev/null
+++ b/internal/app/selftest.go
@@ -0,0 +1,88 @@
+package app
+
+import (
+	"context"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/runtime"
+	"github.com/intentdriven/Gropius/internal/selftest"
+)
+
+// selfTestSource is the identity the self-test's loads carry in the pool's
+// load-waiter queue (runtime.WithSource), so its place there is its own and
+// never a client's.
+const selfTestSource = "gropius-self-test"
+
+// selfTestServer is what the self-test sees of the app: the registry's ready
+// models, the pool's ordinary Acquire — never a second launcher, so the
+// budget, the pins, the served window and the eviction rules are the pool's
+// own — and the pool's view of what is going on.
+//
+// It holds none of the app's locks across any call (adr-2609091239058072):
+// each method takes the pool's or the registry's own lock for the length of
+// one read and hands back a copy.
+type selfTestServer struct{ a *App }
+
+func (s selfTestServer) Ready() []string {
+	models := s.a.Registry.Ready()
+	ids := make([]string, 0, len(models))
+	for _, m := range models {
+		ids = append(ids, m.RepoID)
+	}
+	return ids
+}
+
+func (s selfTestServer) Acquire(ctx context.Context, repoID string) (selftest.Upstream, func(), error) {
+	up, release, err := s.a.Pool.Acquire(runtime.WithSource(ctx, selfTestSource), repoID)
+	if err != nil {
+		return selftest.Upstream{}, nil, err
+	}
+	return selftest.Upstream{BaseURL: up.BaseURL, ModelArg: up.ModelArg}, release, nil
+}
+
+func (s selfTestServer) Activity() selftest.Activity {
+	res := s.a.Pool.Residency()
+	act := selftest.Activity{
+		Waiting:     s.a.Pool.Waiting(),
+		Downloading: len(s.a.Downloading()),
+		Refusals:    res.Refusals,
+	}
+	for _, m := range res.Models {
+		act.Models = append(act.Models, selftest.ModelActivity{
+			RepoID: m.RepoID, InFlight: m.InFlight, LastUsed: m.LastUsed,
+		})
+	}
+	return act
+}
+
+func (s selfTestServer) Unload(repoID string) error { return s.a.Pool.Unload(repoID) }
+
+func (s selfTestServer) Concurrency() int { return s.a.Pool.DecodeConcurrency() }
+
+// Fits says whether the model can be loaded beside what the pool holds
+// without evicting anything: its charge, worked out where every charge is
+// (chargeOf), against the budget less what is resident and what is still
+// exiting. A model already resident fits. The figures are a snapshot, and the
+// pool decides for itself at the load; this only keeps the self-test from
+// asking for a load it knows would take something out.
+func (s selfTestServer) Fits(repoID string) bool {
+	res := s.a.Pool.Residency()
+	key := config.FoldRepoID(repoID)
+	var used int64
+	for _, m := range res.Models {
+		if config.FoldRepoID(m.RepoID) == key {
+			return true
+		}
+		used += m.Charge
+	}
+	used += res.ExitingBytes
+	m, err := s.a.Registry.Get(repoID)
+	if err != nil {
+		return false
+	}
+	size := chargedSize(m)
+	if size <= 0 {
+		return false
+	}
+	return used+s.a.chargeOf(m, size) <= s.a.Pool.MemoryBudget()
+}
diff --git a/internal/app/selftest_test.go b/internal/app/selftest_test.go
new file mode 100644
index 00000000..6de861db
--- /dev/null
+++ b/internal/app/selftest_test.go
@@ -0,0 +1,118 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/registry"
+)
+
+// The self-test follows its switch and nothing else: off on a fresh install
+// with nothing on disk, on the moment a save turns it on, off again the
+// moment a save turns it off, and gone when the app closes.
+func TestTheSelfTestFollowsItsSwitch(t *testing.T) {
+	a, paths := statsApp(t, config.Default())
+	if a.SelfTest.Enabled() {
+		t.Fatal("a fresh install has the self-test running")
+	}
+	if _, err := os.Stat(paths.SelfTest); !os.IsNotExist(err) {
+		t.Fatalf("a fresh install has a self-test directory (%v)", err)
+	}
+
+	on := config.Default()
+	on.SelfTest = true
+	if err := a.SetConfig(on); err != nil {
+		t.Fatal(err)
+	}
+	if !a.SelfTest.Enabled() {
+		t.Error("saving the switch on did not start the self-test")
+	}
+	if err := a.SetConfig(config.Default()); err != nil {
+		t.Fatal(err)
+	}
+	if a.SelfTest.Enabled() {
+		t.Error("saving the switch off did not stop the self-test")
+	}
+
+	if err := a.SetConfig(on); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if a.SelfTest.Enabled() {
+		t.Error("closing the app left the self-test running")
+	}
+}
+
+// A configuration file with the switch on starts the loop at construction,
+// the way every other switch in the file is in force from the start.
+func TestASavedSwitchStartsTheSelfTestAtConstruction(t *testing.T) {
+	c := config.Default()
+	c.SelfTest = true
+	a, paths := statsApp(t, c)
+	if !a.SelfTest.Enabled() {
+		t.Error("the saved switch did not start the self-test")
+	}
+	if want := filepath.Join(paths.Account, "selftest"); paths.SelfTest != want {
+		t.Errorf("results live at %q, want %q: beside the statistics store, under this account", paths.SelfTest, want)
+	}
+}
+
+// The two switches sit together on the Settings pane and are not one switch:
+// turning request statistics on starts no self-test, and turning the
+// self-test on records no statistics.
+func TestTheSelfTestAndStatisticsSwitchesAreIndependent(t *testing.T) {
+	a, _ := statsApp(t, config.Default())
+	stats := config.Default()
+	stats.Statistics = true
+	if err := a.SetConfig(stats); err != nil {
+		t.Fatal(err)
+	}
+	if a.SelfTest.Enabled() {
+		t.Error("turning statistics on started the self-test")
+	}
+	self := config.Default()
+	self.SelfTest = true
+	if err := a.SetConfig(self); err != nil {
+		t.Fatal(err)
+	}
+	if a.Stats.Enabled() {
+		t.Error("turning the self-test on started statistics recording")
+	}
+	if !a.SelfTest.Enabled() {
+		t.Error("the self-test switch did not start the self-test")
+	}
+}
+
+// Fits is the self-test's promise never to evict, answered from what the pool
+// holds and what the model would be charged: a model this Mac cannot hold
+// beside what is loaded does not fit, an unknown model does not fit, and a
+// small ready one does.
+func TestFitsAnswersFromTheChargeAndTheBudget(t *testing.T) {
+	a := newTestApp(t)
+	for _, m := range []registry.Model{
+		{RepoID: "org/small", Path: a.Paths.ModelDir("org/small"), State: registry.StateReady, Bytes: 1 << 20},
+		{RepoID: "org/vast", Path: a.Paths.ModelDir("org/vast"), State: registry.StateReady, Bytes: 1 << 50},
+		{RepoID: "org/unsized", Path: a.Paths.ModelDir("org/unsized"), State: registry.StateReady},
+	} {
+		if err := a.Registry.Put(m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	srv := selfTestServer{a}
+	if !srv.Fits("org/small") {
+		t.Error("a small model with nothing loaded does not fit")
+	}
+	if srv.Fits("org/vast") {
+		t.Error("a model larger than any Mac fits")
+	}
+	if srv.Fits("org/unsized") {
+		t.Error("a model with no size fits; its charge cannot be known")
+	}
+	if srv.Fits("org/absent") {
+		t.Error("a model the registry does not have fits")
+	}
+}
diff --git a/internal/archtest/context_bound_test.go b/internal/archtest/context_bound_test.go
new file mode 100644
index 00000000..2f12e86a
--- /dev/null
+++ b/internal/archtest/context_bound_test.go
@@ -0,0 +1,17 @@
+package archtest_test
+
+import (
+	"testing"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/stats"
+)
+
+// The statistics package bounds a record's windows with its own constant,
+// because it imports nothing of ours; this holds it to the registry's bound
+// so the two cannot drift apart.
+func TestTheStatisticsWindowBoundIsTheRegistrys(t *testing.T) {
+	if stats.MaxContext != config.MaxContextLength {
+		t.Errorf("stats.MaxContext = %d, config.MaxContextLength = %d; one figure", stats.MaxContext, config.MaxContextLength)
+	}
+}
diff --git a/internal/archtest/disk_reader_test.go b/internal/archtest/disk_reader_test.go
new file mode 100644
index 00000000..e797f037
--- /dev/null
+++ b/internal/archtest/disk_reader_test.go
@@ -0,0 +1,39 @@
+package archtest_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Free disk has one reader, in the capability package, and every figure the
+// panel shows — the search tab's note, the Models tab's roll-up — comes from
+// it through capability.Assess. A second statfs anywhere else would be a
+// second answer to how much room the downloads have (itd-2609091903463596).
+func TestFreeDiskHasOneReader(t *testing.T) {
+	root := repoRootDir(t)
+	err := filepath.WalkDir(filepath.Join(root, "internal"), func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+			return nil
+		}
+		rel, _ := filepath.Rel(root, path)
+		if strings.HasPrefix(filepath.ToSlash(rel), "internal/capability/") {
+			return nil
+		}
+		b, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		if strings.Contains(string(b), "Statfs") {
+			t.Errorf("%s reads the disk itself; free disk is read once, in internal/capability", rel)
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/archtest/enforcement_detection_test.go b/internal/archtest/enforcement_detection_test.go
index cd8fae91..301df86f 100644
--- a/internal/archtest/enforcement_detection_test.go
+++ b/internal/archtest/enforcement_detection_test.go
@@ -152,16 +152,18 @@ var enforcementPath = []string{
 // added next year is uncovered by default and the rule quietly stops applying
 // to it.
 var notEnforcement = map[string]string{
-	"github.com/intentdriven/Gropius/internal/gateway":   "holds the endpoint list, so it must see the classifier; covered by the source-scoped rule below instead",
-	"github.com/intentdriven/Gropius/cmd/gropius":        "reaches the endpoint list through the gateway, so no import rule can cover it; covered by its own source-scoped rule below",
-	"github.com/intentdriven/Gropius/internal/netshape":  "is the classifier",
-	"github.com/intentdriven/Gropius/internal/ui":        "serves the control panel's assets and decides nothing about who may reach the server; presentation is what rule 1 allows. It imports nothing of ours and so could import the gateway, while cmd/gropius already imports it — a helper here reading Endpoint.Network is a route into the enforcement path, which is why TestThePanelPackageDoesNotReadTheDetectionEither scans it with nothing allowlisted",
-	"github.com/intentdriven/Gropius/internal/applog":    "builds the process's own log — a file, a level and a rotation. It decides nothing about who may reach the server or what it will do for them, and it imports nothing of ours, so there is no address in it to enforce on. What it must never gain is a reason to look at one: a log that reported which network a client came from would put the detection on the path of every served request",
-	"github.com/intentdriven/Gropius/internal/lifecycle": "holds the verbs a person types — status and doctor today, the installing and removing ones to come. It reports and it changes this installation; it decides nothing about who may reach this server or what it will do for them, and nothing on the control plane's path may import it at all (adr-2609111126115848 condition 3, armed in lifecycle_boundary_test.go). Doctor reads the firewall's state, which is exactly the class of signal rule 2 governs — so what keeps it on this side of the rule is that its report gates nothing, which that closure is what holds",
-	"github.com/intentdriven/Gropius/internal/archtest":  "is these rules",
-	"github.com/intentdriven/Gropius/internal/mlxtest":   "test helpers; nothing ships in the binary",
-	"github.com/intentdriven/Gropius/internal/sitetest":  "test helpers for the landing-page renderer",
-	"github.com/intentdriven/Gropius/cmd/gropius-site":   "renders the landing page offline and serves nothing",
+	"github.com/intentdriven/Gropius/internal/gateway":      "holds the endpoint list, so it must see the classifier; covered by the source-scoped rule below instead",
+	"github.com/intentdriven/Gropius/cmd/gropius":           "reaches the endpoint list through the gateway, so no import rule can cover it; covered by its own source-scoped rule below",
+	"github.com/intentdriven/Gropius/internal/netshape":     "is the classifier",
+	"github.com/intentdriven/Gropius/internal/ui":           "serves the control panel's assets and decides nothing about who may reach the server; presentation is what rule 1 allows. It imports nothing of ours and so could import the gateway, while cmd/gropius already imports it — a helper here reading Endpoint.Network is a route into the enforcement path, which is why TestThePanelPackageDoesNotReadTheDetectionEither scans it with nothing allowlisted",
+	"github.com/intentdriven/Gropius/internal/applog":       "builds the process's own log — a file, a level and a rotation. It decides nothing about who may reach the server or what it will do for them, and it imports nothing of ours, so there is no address in it to enforce on. What it must never gain is a reason to look at one: a log that reported which network a client came from would put the detection on the path of every served request",
+	"github.com/intentdriven/Gropius/internal/lifecycle":    "holds the verbs a person types — status and doctor today, the installing and removing ones to come. It reports and it changes this installation; it decides nothing about who may reach this server or what it will do for them, and nothing on the control plane's path may import it at all (adr-2609111126115848 condition 3, armed in lifecycle_boundary_test.go). Doctor reads the firewall's state, which is exactly the class of signal rule 2 governs — so what keeps it on this side of the rule is that its report gates nothing, which that closure is what holds",
+	"github.com/intentdriven/Gropius/internal/archtest":     "is these rules",
+	"github.com/intentdriven/Gropius/internal/mlxtest":      "test helpers; nothing ships in the binary",
+	"github.com/intentdriven/Gropius/internal/sitetest":     "test helpers for the landing-page renderer",
+	"github.com/intentdriven/Gropius/internal/contextprobe": "measures a model's servable window as a job of the self-test's idle loop. It decides nothing about who may reach the server: it is a client of this Mac's own loopback endpoint, and it imports config, registry, runtime's two sentinel errors and selftest — no address, nothing to enforce on",
+	"github.com/intentdriven/Gropius/internal/selftest":     "measures the models while nobody is using them. It decides nothing about who may reach the server or what it will do for them: it talks only to the model server the pool hands it, on loopback, and it imports config for the fold rule and nothing else of ours, so there is no address in it to enforce on",
+	"github.com/intentdriven/Gropius/cmd/gropius-site":      "renders the landing page offline and serves nothing",
 }
 
 // carveOut is the amendment, written down. It is deliberately not part of
diff --git a/internal/archtest/event_fields_test.go b/internal/archtest/event_fields_test.go
new file mode 100644
index 00000000..cdf16230
--- /dev/null
+++ b/internal/archtest/event_fields_test.go
@@ -0,0 +1,19 @@
+package archtest_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/intentdriven/Gropius/internal/stats"
+)
+
+// Every field a load, removal or footprint event carries is named on the
+// reference page, as every request field already is.
+func TestTheStatisticsPageNamesEveryEventField(t *testing.T) {
+	page := readDoc(t, "statistics-store-reference.md")
+	for _, field := range stats.EventFields() {
+		if !strings.Contains(page, "`"+field+"`") {
+			t.Errorf("docs/statistics-store-reference.md does not name the event field `%s`", field)
+		}
+	}
+}
diff --git a/internal/archtest/prompt_content_test.go b/internal/archtest/prompt_content_test.go
index 97d7d2d6..73acd312 100644
--- a/internal/archtest/prompt_content_test.go
+++ b/internal/archtest/prompt_content_test.go
@@ -28,6 +28,8 @@ var promptContentReaders = map[string]string{
 	"internal/gateway/systemmerge.go": "the merge itself — the one reader adr-2609061610102325 grants",
 	"internal/runtime/pool.go":        "builds the readiness probe's own one-line conversation; reads nothing from a client",
 	"internal/mlxtest/fake.go":        "the fake mlx server tests relay to, which answers requests rather than making them",
+	"internal/selftest/request.go":    "builds the self-test's own requests from two constants in that file; reads nothing from a client (itd-2609100457007827)",
+	"internal/contextprobe/probe.go":  "builds the context probe's own requests from filler it generates; reads nothing from a client, and keeps nothing of the answer but the server's count of the prompt (itd-2609091301112705)",
 }
 
 // chatMessageFields are the ways a chat message's fields get named in Go: the
@@ -55,8 +57,9 @@ var chatMessageFields = []string{
 // choice, which is the answer itself. Nothing else reads inside one today, and
 // until now nothing would have failed if something started.
 var generatedContentReaders = map[string]string{
-	"internal/gateway/gateway.go": "the relay: it reads whether an event carries a choice, to tell a chunk of the answer from the counts-only event and to time the first token — never what is inside one",
-	"internal/mlxtest/fake.go":    "the fake mlx server tests relay to, which produces the answers rather than reading them",
+	"internal/gateway/gateway.go":  "the relay: it reads whether an event carries a choice, to tell a chunk of the answer from the counts-only event and to time the first token — never what is inside one",
+	"internal/mlxtest/fake.go":     "the fake mlx server tests relay to, which produces the answers rather than reading them",
+	"internal/selftest/request.go": "times the first chunk of the self-test's own answer and counts the chunks; keeps nothing of what they say (itd-2609100457007827)",
 }
 
 // completionFields are the ways a completion's fields get named in Go.
diff --git a/internal/archtest/selftest_docs_test.go b/internal/archtest/selftest_docs_test.go
new file mode 100644
index 00000000..9da7cfbe
--- /dev/null
+++ b/internal/archtest/selftest_docs_test.go
@@ -0,0 +1,56 @@
+package archtest_test
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/intentdriven/Gropius/internal/selftest"
+)
+
+// The self-test's reference page is the promise the results file is held to:
+// every field a run or a test carries is named there, so a figure nobody can
+// look up is a test failure rather than a surprise.
+func TestTheSelfTestReferenceNamesEveryField(t *testing.T) {
+	page := readDoc(t, "self-test-reference.md")
+	for _, field := range append(selftest.RunFields(), selftest.TestFields()...) {
+		if !strings.Contains(page, "`"+field+"`") {
+			t.Errorf("docs/self-test-reference.md does not name the field `%s`", field)
+		}
+	}
+	for _, name := range []string{selftest.TestPP512, selftest.TestTG128, selftest.TestTG128Parallel + "N"} {
+		if !strings.Contains(page, "`"+name+"`") {
+			t.Errorf("docs/self-test-reference.md does not name the test `%s`", name)
+		}
+	}
+	for _, outcome := range []string{selftest.OutcomeOK, selftest.OutcomeYielded, selftest.OutcomeStopped, selftest.OutcomeFailed} {
+		if !strings.Contains(page, "`"+outcome+"`") {
+			t.Errorf("docs/self-test-reference.md does not name the outcome `%s`", outcome)
+		}
+	}
+	for _, s := range []string{selftest.FileName, fmt.Sprintf("%d MiB", selftest.DefaultMaxBytes>>20)} {
+		if !strings.Contains(page, s) {
+			t.Errorf("docs/self-test-reference.md does not say %q", s)
+		}
+	}
+}
+
+// The pages state what the code never writes, and are linked from where a
+// reader starts.
+func TestTheSelfTestPagesAreLinkedAndSayWhatIsNeverWritten(t *testing.T) {
+	howTo := readDoc(t, "self-test.md")
+	for _, want := range []string{"never records", "prompt", "answer", "self-test-reference.md"} {
+		if !strings.Contains(howTo, want) {
+			t.Errorf("docs/self-test.md does not say %q", want)
+		}
+	}
+	readme, err := os.ReadFile(filepath.Join(repoRootDir(t), "README.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(readme), "docs/self-test.md") {
+		t.Error("README.md does not link docs/self-test.md")
+	}
+}
diff --git a/internal/config/config.go b/internal/config/config.go
index 633e8e6e..54465300 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -21,6 +21,7 @@ import (
 	"strconv"
 	"strings"
 	"syscall"
+	"time"
 	"unicode/utf8"
 )
 
@@ -47,6 +48,10 @@ type Paths struct {
 	// Stats is where the request statistics store keeps its files: under
 	// Account, in a "stats" directory. See StatsDir.
 	Stats string
+	// SelfTest is where the model self-test keeps its results file: beside
+	// Stats, under the same rule, for the same reason — one account's own
+	// record, at 0600, never in the group-writable shared root.
+	SelfTest string
 }
 
 // SharedRoot is the machine-wide location, used when it exists.
@@ -220,17 +225,18 @@ func accountDir(root string) string {
 func NewPaths(root string) Paths {
 	acct := accountDir(root)
 	return Paths{
-		Root:    root,
-		Bin:     filepath.Join(acct, "bin"),
-		Venv:    filepath.Join(acct, "venv"),
-		Python:  filepath.Join(acct, "python"),
-		Models:  filepath.Join(root, "models"),
-		HFCache: filepath.Join(root, "hf", "hub"),
-		Account: acct,
-		Logs:    filepath.Join(acct, "logs"),
-		Config:  filepath.Join(acct, "config.json"),
-		State:   filepath.Join(acct, "registry.json"),
-		Stats:   StatsDir(root),
+		Root:     root,
+		Bin:      filepath.Join(acct, "bin"),
+		Venv:     filepath.Join(acct, "venv"),
+		Python:   filepath.Join(acct, "python"),
+		Models:   filepath.Join(root, "models"),
+		HFCache:  filepath.Join(root, "hf", "hub"),
+		Account:  acct,
+		Logs:     filepath.Join(acct, "logs"),
+		Config:   filepath.Join(acct, "config.json"),
+		State:    filepath.Join(acct, "registry.json"),
+		Stats:    StatsDir(root),
+		SelfTest: filepath.Join(acct, "selftest"),
 	}
 }
 
@@ -619,6 +625,32 @@ type Config struct {
 	StatsMonths   int   `json:"stats_months,omitempty"`
 	StatsMaxBytes int64 `json:"stats_max_bytes,omitempty"`
 
+	// SelfTest lets Gropius measure its own models while nobody is using it:
+	// when the Mac has been idle for a while it loads each downloaded model in
+	// turn, runs the same short set of tests against it, records the figures
+	// in a file under this account's data directory, and unloads what it
+	// loaded (itd-2609100457007827). Off until the operator turns it on, and
+	// while it is off nothing is loaded and nothing is written. The figures
+	// hold no prompt and no answer, and nothing recorded leaves the Mac
+	// (adr-2609061503319212).
+	SelfTest bool `json:"self_test,omitempty"`
+
+	// ContextProbe lets Gropius measure each model's servable context window
+	// while nobody is using the Mac: prompts of growing size through its own
+	// OpenAI endpoint, bisected to the largest the server accepts, recorded
+	// on the model's registry entry and published beside the declared and
+	// the served window (itd-2609091301112705). Off by default; a per-model
+	// "Measure now" runs one probe whatever this says. A measurement changes
+	// no charge and refuses no request until the operator adopts it as the
+	// served window.
+	ContextProbe bool `json:"context_probe,omitempty"`
+
+	// IdleThresholdSec is how long the last request must be in the past
+	// before the Mac counts as idle for the self-test and the context probe
+	// — one idea of idle for both. Zero means the default; read it through
+	// EffectiveIdleThresholdSec.
+	IdleThresholdSec int `json:"idle_threshold_sec,omitempty"`
+
 	// LogLevel decides how much Gropius writes about itself, in its own log and
 	// on standard error. "sparse" — the default, and what every configuration
 	// written before this field carries — is one line per event that mattered:
@@ -1076,7 +1108,7 @@ func (c Config) Clone() Config {
 //
 // The defaults are the ADR's starting values, with its arithmetic corrected by
 // measurement: internal/stats' BenchmarkLatestAtTheCap fills the cap and
-// reports about 230 bytes a record — a JSON Lines record carries its field
+// reports about 380 bytes a record — a JSON Lines record carries its field
 // names on every line — so 200 MB is roughly three months of ten thousand
 // requests a day, not the four the ADR reasoned to from 150 bytes. The size
 // cap therefore bites at about half the six-month horizon on a Mac that busy,
@@ -1284,6 +1316,44 @@ func (c *Config) sanitizeLogLevel() []string {
 	return repaired
 }
 
+// The idle threshold's bounds: a minute is the shortest quiet a loop that
+// ticks once a minute can tell from noise, and an hour is past the point where
+// an idle job would never run on a Mac that is used at all.
+const (
+	DefaultIdleThresholdSec = 300
+	MinIdleThresholdSec     = 60
+	MaxIdleThresholdSec     = 3600
+)
+
+// EffectiveIdleThresholdSec is the idle threshold in force: the setting, or
+// the default when none is set.
+func (c Config) EffectiveIdleThresholdSec() int {
+	if c.IdleThresholdSec == 0 {
+		return DefaultIdleThresholdSec
+	}
+	return c.IdleThresholdSec
+}
+
+// EffectiveIdleThreshold is EffectiveIdleThresholdSec as a duration.
+func (c Config) EffectiveIdleThreshold() time.Duration {
+	return time.Duration(c.EffectiveIdleThresholdSec()) * time.Second
+}
+
+func usableIdleThreshold(sec int) bool {
+	return sec == 0 || (sec >= MinIdleThresholdSec && sec <= MaxIdleThresholdSec)
+}
+
+// sanitizeIdleThreshold repairs a threshold this build cannot use and returns
+// what it repaired, for the reason sanitizeStats gives.
+func (c *Config) sanitizeIdleThreshold() []string {
+	if usableIdleThreshold(c.IdleThresholdSec) {
+		return nil
+	}
+	repaired := []string{"idle_threshold_sec=" + strconv.Itoa(c.IdleThresholdSec)}
+	c.IdleThresholdSec = 0
+	return repaired
+}
+
 // sanitizeStats repairs a retention figure this build cannot use and returns
 // what it repaired, so a hand-edited file, a backup or another build's
 // settings still load.
@@ -1337,6 +1407,10 @@ func (c Config) Validate() error {
 	if c.DecodeConcurrency < 1 {
 		return fmt.Errorf("decode_concurrency must be >= 1, got %d", c.DecodeConcurrency)
 	}
+	if !usableIdleThreshold(c.IdleThresholdSec) {
+		return fmt.Errorf("idle_threshold_sec must be between %d and %d, or 0 for the default, got %d",
+			MinIdleThresholdSec, MaxIdleThresholdSec, c.IdleThresholdSec)
+	}
 	// Named fields, both of them: this is the settings path, where a person is
 	// waiting to be told which of a form's worth of settings was refused.
 	if len(c.APIKey) > MaxAPIKeyBytes {
@@ -1716,6 +1790,7 @@ func Load(path string) (Config, Notices, error) {
 	// working — and for the API key it would be worse than that, because the
 	// trimmed key is the one their clients must now send.
 	n.Repaired = append(n.Repaired, cfg.sanitizeStats()...)
+	n.Repaired = append(n.Repaired, cfg.sanitizeIdleThreshold()...)
 	n.Repaired = append(n.Repaired, cfg.sanitizeBudget()...)
 	n.Repaired = append(n.Repaired, cfg.sanitizeGrace()...)
 	n.Repaired = append(n.Repaired, cfg.sanitizeAPIKey()...)
diff --git a/internal/config/contextprobe_test.go b/internal/config/contextprobe_test.go
new file mode 100644
index 00000000..0bf9f611
--- /dev/null
+++ b/internal/config/contextprobe_test.go
@@ -0,0 +1,74 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The probe is off until the operator turns it on; the idle threshold has a
+// default that applies to the probe and the self-test alike, and both
+// settings survive a round trip under the keys the docs name.
+func TestProbeSettingsAreValidated(t *testing.T) {
+	d := Default()
+	if d.ContextProbe {
+		t.Fatal("a fresh install has the context probe on")
+	}
+	if d.IdleThresholdSec != 0 || d.EffectiveIdleThresholdSec() != DefaultIdleThresholdSec {
+		t.Fatalf("a fresh install's idle threshold: stored %d, effective %d, want 0 and %d",
+			d.IdleThresholdSec, d.EffectiveIdleThresholdSec(), DefaultIdleThresholdSec)
+	}
+
+	path := filepath.Join(t.TempDir(), "config.json")
+	c := Default()
+	c.ContextProbe = true
+	c.IdleThresholdSec = 120
+	if err := c.Validate(); err != nil {
+		t.Fatalf("a valid pair was refused: %v", err)
+	}
+	if err := Save(path, c); err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := os.ReadFile(path)
+	for _, key := range []string{`"context_probe": true`, `"idle_threshold_sec": 120`} {
+		if !strings.Contains(string(raw), key) {
+			t.Errorf("the file does not carry %s:\n%s", key, raw)
+		}
+	}
+	again, _, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !again.ContextProbe || again.IdleThresholdSec != 120 {
+		t.Errorf("read back probe=%v threshold=%d", again.ContextProbe, again.IdleThresholdSec)
+	}
+
+	// A save is refused for a threshold this build cannot use.
+	for _, sec := range []int{-1, MinIdleThresholdSec - 1, MaxIdleThresholdSec + 1} {
+		c := Default()
+		c.IdleThresholdSec = sec
+		if err := c.Validate(); err == nil {
+			t.Errorf("idle_threshold_sec=%d was accepted", sec)
+		}
+	}
+}
+
+// A file carrying a threshold this build cannot use loads with the default
+// and says so, the way every other repaired figure does.
+func TestAnUnusableIdleThresholdIsRepairedOnLoad(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.json")
+	if err := os.WriteFile(path, []byte(`{"host":"127.0.0.1","port":8080,"idle_threshold_sec":7}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	c, notices, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.IdleThresholdSec != 0 || c.EffectiveIdleThresholdSec() != DefaultIdleThresholdSec {
+		t.Errorf("loaded threshold %d (effective %d), want the default", c.IdleThresholdSec, c.EffectiveIdleThresholdSec())
+	}
+	if !strings.Contains(strings.Join(notices.Repaired, ","), "idle_threshold_sec=7") {
+		t.Errorf("the repair was not reported: %v", notices.Repaired)
+	}
+}
diff --git a/internal/config/selftest_test.go b/internal/config/selftest_test.go
new file mode 100644
index 00000000..88e57abb
--- /dev/null
+++ b/internal/config/selftest_test.go
@@ -0,0 +1,44 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The self-test is off until the operator turns it on, and a configuration
+// written before the field existed loads with it off: the same state as
+// today, and the only one a build that did not know the field could mean.
+func TestTheSelfTestIsOffByDefaultAndSurvivesARoundTrip(t *testing.T) {
+	if Default().SelfTest {
+		t.Fatal("a fresh install has the self-test on")
+	}
+	path := filepath.Join(t.TempDir(), "config.json")
+	if err := os.WriteFile(path, []byte(`{"host":"127.0.0.1","port":8080}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	c, _, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.SelfTest {
+		t.Error("a configuration that never named the self-test loads with it on")
+	}
+
+	c.SelfTest = true
+	if err := Save(path, c); err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := os.ReadFile(path)
+	if !strings.Contains(string(raw), `"self_test": true`) {
+		t.Errorf("the switch is saved under some other key:\n%s", raw)
+	}
+	again, _, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !again.SelfTest {
+		t.Error("the switch did not survive a save and a load")
+	}
+}
diff --git a/internal/contextprobe/filler.go b/internal/contextprobe/filler.go
new file mode 100644
index 00000000..04fcacd6
--- /dev/null
+++ b/internal/contextprobe/filler.go
@@ -0,0 +1,38 @@
+package contextprobe
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"strings"
+)
+
+// The filler is the 2026-09-06 campaign's: ordinary English, varied by a
+// marker so the tokenizer sees natural text, and started with a nonce so no
+// two prompts share a prefix — the mistake that let a retained prompt cache
+// put one model's window a third too high in the earlier record.
+const block = "The lighthouse keeper counted the waves as they broke against the seawall, " +
+	"marking each seventh one in a small leather notebook. %s " +
+	"Morning fog delayed the ferry, and the gulls circled the harbour in slow, " +
+	"patient spirals while the fishermen mended their nets on the pier. "
+
+var markers = []string{"Nearby,", "Meanwhile,", "Later,", "Somehow,", "Quietly,", "Often,", "Yesterday,",
+	"Today,", "Besides,", "However,", "Beyond,", "Above,", "Below,", "Perhaps,",
+	"Certainly,", "Suddenly,", "Gradually,", "Finally,"}
+
+// filler builds about chars characters of text, beginning with its own nonce
+// and its own marker order.
+func filler(chars int) string {
+	nonce := make([]byte, 8)
+	_, _ = rand.Read(nonce)
+	tag := hex.EncodeToString(nonce)
+	// The marker order starts where the nonce says, so two prompts of the
+	// same length differ throughout and not only in their first line.
+	start := int(nonce[0]) % len(markers)
+	var b strings.Builder
+	b.Grow(chars + len(block))
+	b.WriteString("[" + tag + "] ")
+	for i := 0; b.Len() < chars; i++ {
+		b.WriteString(strings.Replace(block, "%s", markers[(start+i)%len(markers)], 1))
+	}
+	return b.String()
+}
diff --git a/internal/contextprobe/probe.go b/internal/contextprobe/probe.go
new file mode 100644
index 00000000..aea99610
--- /dev/null
+++ b/internal/contextprobe/probe.go
@@ -0,0 +1,643 @@
+// Package contextprobe measures the largest prompt this Mac will actually
+// serve a model: a sweep of growing prompts and a bisection between the last
+// that came back and the first that did not, through Gropius's own OpenAI
+// endpoint, the way a client reaches the model (itd-2609091301112705).
+//
+// It is a job of the self-test's idle loop (internal/selftest): that loop owns
+// idleness, yielding and the never-evict rule, so there is one idea of "idle"
+// on the Mac. This package owns the method, the result and the "Measure now"
+// queue. The 2026-09-06 campaign's script is the reference implementation:
+// unique prompts from a nonce so no prefix is cached, one output token at
+// temperature 0, an unload before each step, the window read from the
+// server's own usage.prompt_tokens, and a memory guard that skips a step
+// projected too close to what the Mac has.
+//
+// Because the probe is a client of the gateway rather than an exception
+// inside it, the largest step it can take is bounded by the gateway's own
+// limits — the prefill deadline and the served-window check. A reading those
+// stopped is published as a floor naming the bound, never as the model's
+// limit.
+package contextprobe
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/registry"
+	"github.com/intentdriven/Gropius/internal/runtime"
+	"github.com/intentdriven/Gropius/internal/selftest"
+)
+
+// Name is the job's name, as the loop's status and the log carry it.
+const Name = "context-probe"
+
+// Candidate is a ready model as the probe sees it.
+type Candidate struct {
+	RepoID string
+	// Declared is the window the model's own configuration declares; zero
+	// means none, and there is nothing to bisect between.
+	Declared int64
+	// Served is the window Gropius serves the model at (the operator's
+	// setting, or Declared), which bounds the largest step.
+	Served int64
+	// Bytes and KVChargePerToken are what the memory guard projects from.
+	Bytes, KVChargePerToken int64
+	// Measured is the model's current measurement, or nil.
+	Measured *registry.Measurement
+	// Incomplete says an earlier probe was interrupted; the probe does not
+	// retry it on its own.
+	Incomplete bool
+}
+
+// Sources is what the probe needs from the app.
+type Sources interface {
+	Candidates() []Candidate
+	// Provenance is what is in force now for this model, to record with a
+	// measurement.
+	Provenance(repoID string) registry.Provenance
+	// Available is how many bytes the memory budget has free right now.
+	Available() int64
+	// Unload stops a model server; runtime.ErrBusy when a request is in
+	// flight on it, runtime.ErrNotLoaded when it is not resident.
+	Unload(repoID string) error
+	// Save records a completed measurement on the model.
+	Save(repoID string, m *registry.Measurement) error
+	// MarkIncomplete records that a probe of the model was interrupted.
+	MarkIncomplete(repoID string, on bool) error
+	// Endpoint is this Mac's own OpenAI endpoint, and the API key to send.
+	Endpoint() (baseURL, apiKey string)
+}
+
+// Options configures a Probe.
+type Options struct {
+	Sources Sources
+	// Enabled is the global switch; nil means off. "Measure now" runs a
+	// probe whatever it says.
+	Enabled func() bool
+	Log     *slog.Logger
+	Client  *http.Client
+	Now     func() time.Time
+	// Floor is the smallest prompt, in tokens, and the calibration size.
+	Floor int64
+	// MemoryMargin is how close to the budget's free bytes a step may come:
+	// a step projected within it is skipped. The campaign used 24 GB on a
+	// 128 GB Mac.
+	MemoryMargin int64
+	// StepTimeout bounds one request, given the request body's size. Nil
+	// means the gateway's own prefill budget for that body plus a margin, so
+	// the gateway's deadline is what stops a step; should the probe's own
+	// timer fire first anyway, the step is filed as the deadline's, never as
+	// the model's.
+	StepTimeout func(bodyBytes int) time.Duration
+	// UnloadWait bounds how long the probe waits for the gateway to release
+	// its own abandoned request before treating a refused unload as a
+	// client's, and for an unloaded server to hand its memory back before a
+	// step. Zero means DefaultUnloadWait.
+	UnloadWait time.Duration
+}
+
+// MaxProbeWindow caps the sweep whatever a model declares: a million
+// tokens is past any window this runtime serves, and with the calibration
+// clamped below it bounds the largest prompt the probe will ever build to
+// well under the gateway's body cap. A planted declared window is the reason
+// it is a constant and not the declared figure.
+const MaxProbeWindow = 1 << 20
+
+// The calibration's characters-per-token is clamped to this band: a server
+// that counts oddly at the floor must not turn a target into a prompt of
+// gigabytes.
+const (
+	minCharsPerToken = 1
+	maxCharsPerToken = 16
+)
+
+// DefaultUnloadWait is the bound on the two waits above: the gateway
+// releases a cancelled request as soon as its handler notices, and a stopped
+// server hands its memory back within the pool's own stop bound.
+const DefaultUnloadWait = 15 * time.Second
+
+// Probe is the job.
+type Probe struct {
+	opts Options
+
+	mu sync.Mutex
+	// queue holds the "Measure now" requests, in order.
+	queue []string
+	// bounds holds a model's bisection so far, so a yielded run resumes.
+	bounds map[string]*bounds
+}
+
+// bounds is where a model's bisection stands.
+type bounds struct {
+	// lo is the largest target size that came back, and loTokens what the
+	// server counted it as; hi is the smallest that did not, and bound what
+	// stopped it. cpt is the calibrated characters per token.
+	lo, loTokens, hi int64
+	bound            string
+	guardBytes       int64
+	cpt              float64
+	// swept says the doubling sweep reached hi or a refusal, so a resumed
+	// run bisects rather than starting the sweep over — or, when it did
+	// not, resumes the sweep from lo.
+	swept bool
+}
+
+// New builds a Probe.
+func New(opts Options) *Probe {
+	if opts.Log == nil {
+		opts.Log = slog.Default()
+	}
+	if opts.Client == nil {
+		opts.Client = &http.Client{
+			CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
+		}
+	}
+	if opts.Now == nil {
+		opts.Now = time.Now
+	}
+	if opts.Floor <= 0 {
+		opts.Floor = 1024
+	}
+	if opts.StepTimeout == nil {
+		opts.StepTimeout = defaultStepTimeout
+	}
+	if opts.UnloadWait <= 0 {
+		opts.UnloadWait = DefaultUnloadWait
+	}
+	return &Probe{opts: opts, bounds: map[string]*bounds{}}
+}
+
+// defaultStepTimeout is the gateway's prefill budget for a body of this
+// size — its estimate of a token per four bytes, at 150 tokens a second,
+// plus a minute, and at least ten minutes — with a minute's margin, so that
+// the gateway's own deadline is what ends a step that outlasts it.
+func defaultStepTimeout(bodyBytes int) time.Duration {
+	tokens := int64(bodyBytes / 4)
+	derived := time.Duration(tokens/150)*time.Second + time.Minute
+	if derived < 10*time.Minute {
+		derived = 10 * time.Minute
+	}
+	return derived + time.Minute
+}
+
+// Name implements selftest.Job.
+func (p *Probe) Name() string { return Name }
+
+// Parks implements selftest.Job: the probe never parks for room. It loads
+// only when the room is already free, so every waiter the pool counts is a
+// client's.
+func (p *Probe) Parks() bool { return false }
+
+// MeasureNow queues one probe of the model, whatever the switch says.
+func (p *Probe) MeasureNow(repoID string) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	key := config.FoldRepoID(repoID)
+	for _, q := range p.queue {
+		if config.FoldRepoID(q) == key {
+			return
+		}
+	}
+	p.queue = append(p.queue, repoID)
+}
+
+// Queued lists the models waiting for "Measure now".
+func (p *Probe) Queued() []string {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return append([]string(nil), p.queue...)
+}
+
+// Due implements selftest.Job: a queued model first, then — with the switch
+// on — the first ready model with a declared window and no current
+// measurement that is not marked incomplete (an interrupted or failed probe
+// is retried only by "Measure now").
+func (p *Probe) Due(ready []string, now time.Time) string {
+	byKey := map[string]Candidate{}
+	for _, c := range p.opts.Sources.Candidates() {
+		byKey[config.FoldRepoID(c.RepoID)] = c
+	}
+	isReady := map[string]bool{}
+	for _, id := range ready {
+		isReady[config.FoldRepoID(id)] = true
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	for _, q := range p.queue {
+		if c, ok := byKey[config.FoldRepoID(q)]; ok && isReady[config.FoldRepoID(q)] && c.Declared > 0 {
+			return c.RepoID
+		}
+	}
+	if p.opts.Enabled == nil || !p.opts.Enabled() {
+		return ""
+	}
+	for _, id := range ready {
+		c, ok := byKey[config.FoldRepoID(id)]
+		if !ok || c.Declared <= 0 || c.Incomplete {
+			continue
+		}
+		if c.Measured != nil && c.Measured.Stale == "" {
+			continue
+		}
+		return c.RepoID
+	}
+	return ""
+}
+
+// stepOutcome is what one request told the probe.
+type stepOutcome int
+
+const (
+	stepOK stepOutcome = iota
+	stepBounded
+	stepYielded
+	stepStopped
+	stepHeld
+	// stepAborted is an answer that is neither the model's nor one of the
+	// gateway's size bounds — a key refused, a model not found — from which
+	// no figure can be drawn and no retry helps.
+	stepAborted
+)
+
+// Run implements selftest.Job: one probe of the model, resumed from its
+// bounds when it has some.
+func (p *Probe) Run(s *selftest.Session, model string) {
+	var cand Candidate
+	found := false
+	for _, c := range p.opts.Sources.Candidates() {
+		if config.FoldRepoID(c.RepoID) == config.FoldRepoID(model) {
+			cand, found = c, true
+			break
+		}
+	}
+	if !found || cand.Declared <= 0 {
+		p.dequeue(model)
+		return
+	}
+	key := config.FoldRepoID(model)
+	p.mu.Lock()
+	b, ok := p.bounds[key]
+	if !ok {
+		// The gateway's served-window check is in force at the served
+		// window whether or not it is below the declared one, so a sweep
+		// that reaches the cap without a refusal was stopped by it; the
+		// model's own limit is recorded only from a step it actually refused.
+		b = &bounds{hi: min(cand.Declared, MaxProbeWindow), bound: registry.BoundServedWindow}
+		if cand.Served > 0 && cand.Served < b.hi {
+			b.hi = cand.Served
+		}
+		p.bounds[key] = b
+	}
+	p.mu.Unlock()
+
+	finish := func(out stepOutcome) {
+		switch out {
+		case stepYielded, stepHeld:
+			// Bounds kept; the loop will bring the model back when the Mac
+			// is idle again.
+			p.opts.Log.Info("context probe paused", "model", model, "why", map[stepOutcome]string{stepYielded: "a request arrived", stepHeld: "no room without evicting"}[out])
+		case stepStopped:
+			// No partial figure: the next start says the probe is incomplete.
+			p.unloadWaiting(context.Background(), model)
+			_ = p.opts.Sources.MarkIncomplete(model, true)
+			p.opts.Log.Info("context probe interrupted", "model", model)
+		case stepAborted:
+			// An answer no figure can be drawn from; not retried on its own.
+			p.mu.Lock()
+			delete(p.bounds, key)
+			p.mu.Unlock()
+			p.dequeue(model)
+			p.unloadWaiting(s.Ctx, model)
+			_ = p.opts.Sources.MarkIncomplete(model, true)
+			p.opts.Log.Warn("context probe abandoned: the gateway's answer was neither the model's nor a size bound", "model", model)
+		}
+	}
+
+	// Calibration, once.
+	if b.loTokens == 0 {
+		s.Report(fmt.Sprintf("%s: calibrating at %d tokens", model, p.opts.Floor))
+		out, res := p.step(s, cand, b, p.opts.Floor)
+		if out != stepOK {
+			if out == stepBounded {
+				// Nothing to bisect between: the model did not answer at
+				// the floor. Marked incomplete, so "Measure now" is the
+				// only retry.
+				p.mu.Lock()
+				delete(p.bounds, key)
+				p.mu.Unlock()
+				p.dequeue(model)
+				p.unloadWaiting(s.Ctx, model)
+				_ = p.opts.Sources.MarkIncomplete(model, true)
+				p.opts.Log.Warn("context probe: the model did not answer at the floor size", "model", model, "bound", res.bound)
+				return
+			}
+			finish(out)
+			return
+		}
+		b.lo, b.loTokens = p.opts.Floor, res.tokens
+		b.cpt = min(max(float64(len(res.prompt))/float64(res.tokens), minCharsPerToken), maxCharsPerToken)
+	}
+	// The doubling sweep, resumed from the largest size verified so far
+	// after a yield, up to a refusal or the cap.
+	for !b.swept {
+		size := b.lo * 2
+		if size >= b.hi {
+			b.swept = true
+			break
+		}
+		s.Report(fmt.Sprintf("%s: sweeping at %d tokens (verified %d so far)", model, size, b.loTokens))
+		out, res := p.step(s, cand, b, size)
+		switch out {
+		case stepOK:
+			b.lo, b.loTokens = size, res.tokens
+		case stepBounded:
+			b.hi, b.bound, b.guardBytes, b.swept = size, res.bound, res.guardBytes, true
+		default:
+			finish(out)
+			return
+		}
+	}
+
+	// Bisect to the campaign's tolerance.
+	for b.hi-b.lo > max(1024, b.lo/8) {
+		mid := (b.lo + b.hi) / 2
+		s.Report(fmt.Sprintf("%s: bisecting at %d tokens (between %d and %d)", model, mid, b.lo, b.hi))
+		out, res := p.step(s, cand, b, mid)
+		switch out {
+		case stepOK:
+			b.lo, b.loTokens = mid, res.tokens
+		case stepBounded:
+			b.hi, b.bound, b.guardBytes = mid, res.bound, res.guardBytes
+		default:
+			finish(out)
+			return
+		}
+	}
+
+	prov := p.opts.Sources.Provenance(model)
+	m := &registry.Measurement{
+		Window: b.loTokens, Bound: b.bound, At: p.opts.Now().Unix(),
+		Runtime: prov.Runtime, BudgetBytes: prov.BudgetBytes, DecodeConcurrency: prov.DecodeConcurrency,
+		ServedContext: prov.ServedContext, GuardBytes: b.guardBytes,
+	}
+	p.unloadWaiting(s.Ctx, model)
+	if err := p.opts.Sources.Save(model, m); err != nil {
+		// Forty minutes of GPU are in the bounds; keep them for a retry and
+		// say what happened, rather than throwing the run away.
+		_ = p.opts.Sources.MarkIncomplete(model, true)
+		p.opts.Log.Warn("context probe: could not record the measurement; the run's bounds are kept for Measure now", "model", model, "err", err)
+		p.dequeue(model)
+		return
+	}
+	p.opts.Log.Info("context probe measured", "model", model, "window", m.Window, "bound", m.Bound)
+	p.mu.Lock()
+	delete(p.bounds, key)
+	p.mu.Unlock()
+	p.dequeue(model)
+}
+
+func (p *Probe) dequeue(model string) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	key := config.FoldRepoID(model)
+	for i, q := range p.queue {
+		if config.FoldRepoID(q) == key {
+			p.queue = append(p.queue[:i], p.queue[i+1:]...)
+			return
+		}
+	}
+}
+
+// unloadWaiting stops the model's server, waiting out the gateway's release
+// of the probe's own abandoned request first: the gateway gives up a
+// cancelled request when its handler notices the client is gone, which is
+// after the client's call has returned, so an Unload straight after the
+// cancel finds the probe's own request still in flight. It retries for
+// UnloadWait; an ErrBusy that outlasts that is a client's request, and the
+// model is left to it. It reports whether the model was stopped or was not
+// loaded, which is what a step's reading depends on.
+func (p *Probe) unloadWaiting(ctx context.Context, model string) bool {
+	deadline := time.Now().Add(p.opts.UnloadWait)
+	for {
+		err := p.opts.Sources.Unload(model)
+		switch {
+		case err == nil, errors.Is(err, runtime.ErrNotLoaded):
+			return true
+		case !errors.Is(err, runtime.ErrBusy):
+			p.opts.Log.Debug("context probe: could not unload", "model", model, "err", err)
+			return false
+		}
+		if time.Now().After(deadline) {
+			p.opts.Log.Debug("context probe: the model stayed busy; a client has it", "model", model)
+			return false
+		}
+		select {
+		case <-time.After(50 * time.Millisecond):
+		case <-ctx.Done():
+			// The stop path passes a background context; a yield's session
+			// context is already done, so keep waiting on the clock alone.
+			if ctx.Err() != nil && ctx != context.Background() {
+				continue
+			}
+		}
+	}
+}
+
+// stepResult is what a step produced.
+type stepResult struct {
+	tokens     int64
+	prompt     string
+	bound      string
+	guardBytes int64
+}
+
+// step runs one request at a target size: an unload first so no retained
+// cache flatters the reading, the memory guard, the never-evict check, and
+// then the request through the gateway with the probe's hold declared.
+func (p *Probe) step(s *selftest.Session, c Candidate, b *bounds, size int64) (stepOutcome, stepResult) {
+	if s.Ctx.Err() != nil {
+		return p.cancelled(s), stepResult{}
+	}
+	// Unload before every step. A model that stays busy is a client's: that
+	// is a yield, and there is no reading to discard yet.
+	if !p.unloadWaiting(s.Ctx, c.RepoID) {
+		return stepYielded, stepResult{}
+	}
+	// The stopped server hands its memory back over the pool's stop bound,
+	// and until it has, the budget still counts it as exiting: asking Fits at
+	// once would refuse any model larger than half the budget. Wait it out.
+	if !p.fitsWaiting(s, c.RepoID) {
+		return stepHeld, stepResult{}
+	}
+	// The memory guard: the model's flat charge plus the cache one sequence
+	// of this size costs, against what the budget has free, less the margin.
+	if c.KVChargePerToken > 0 && c.Bytes > 0 && c.Bytes < 1<<50 && c.KVChargePerToken < 1<<30 {
+		projected := c.Bytes + c.Bytes/5 + c.KVChargePerToken*size
+		if projected > p.opts.Sources.Available()-p.opts.MemoryMargin {
+			return stepBounded, stepResult{bound: registry.BoundMemoryGuard, guardBytes: projected}
+		}
+	}
+	cpt := b.cpt
+	if cpt <= 0 {
+		cpt = 4
+	}
+	prompt := filler(int(float64(size) * cpt))
+	tokens, verdict, err := p.request(s, c.RepoID, prompt)
+	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) && s.Ctx.Err() == nil {
+			// The probe's own timer, which is the gateway's budget plus a
+			// margin: a step that outlasted it is the deadline's, and the
+			// server is still prefilling the abandoned prompt, so stop it.
+			p.unloadWaiting(s.Ctx, c.RepoID)
+			return stepBounded, stepResult{bound: registry.BoundPrefillDeadline}
+		}
+		if s.Ctx.Err() != nil {
+			out := p.cancelled(s)
+			if out == stepYielded {
+				// The gateway gave up on the request; the server has not.
+				// Stop it, so the abandoned prefill neither keeps the GPU nor
+				// leaves its cache resident. Refused because a client already
+				// took the model: nothing of this step is kept, since a server
+				// that kept the cache would measure the cache.
+				p.unloadWaiting(context.Background(), c.RepoID)
+			}
+			return out, stepResult{}
+		}
+		// A transport failure — the server crashed under the prompt, or the
+		// gateway answered with an upstream failure — is the model's.
+		p.opts.Log.Debug("context probe: a step failed", "model", c.RepoID, "size", size, "err", err)
+		return stepBounded, stepResult{bound: registry.BoundModel}
+	}
+	switch verdict.kind {
+	case answerOK:
+		return stepOK, stepResult{tokens: tokens, prompt: prompt}
+	case answerBounded:
+		return stepBounded, stepResult{bound: verdict.bound}
+	case answerNoRoom:
+		// The pool had no room, or was closing: not the model, not a size
+		// bound, and worth a later tick.
+		return stepHeld, stepResult{}
+	default:
+		return stepAborted, stepResult{}
+	}
+}
+
+// fitsWaiting asks whether the model fits beside what is resident, waiting
+// out a server that is still handing its memory back.
+func (p *Probe) fitsWaiting(s *selftest.Session, model string) bool {
+	deadline := time.Now().Add(p.opts.UnloadWait)
+	for {
+		if s.Fits(model) {
+			return true
+		}
+		if time.Now().After(deadline) || s.Ctx.Err() != nil {
+			return false
+		}
+		select {
+		case <-time.After(100 * time.Millisecond):
+		case <-s.Ctx.Done():
+			return false
+		}
+	}
+}
+
+// answer classifies the gateway's reply to a step.
+type answer struct {
+	kind  answerKind
+	bound string
+}
+
+type answerKind int
+
+const (
+	answerOK answerKind = iota
+	// answerBounded is one of the gateway's own size bounds: its prefill
+	// deadline (504) or its served-window check (400).
+	answerBounded
+	// answerNoRoom is the pool refusing for want of room or because it is
+	// closing (503): no reading, try later.
+	answerNoRoom
+	// answerAborted is an answer no figure can be drawn from — a key
+	// refused, the model unknown to the gateway, the body cap (413, which
+	// is not one of the four bounds a measurement may carry).
+	answerAborted
+)
+
+func (p *Probe) cancelled(s *selftest.Session) stepOutcome {
+	if s.Yielded() {
+		return stepYielded
+	}
+	return stepStopped
+}
+
+// request sends one non-streaming request through the gateway and reads the
+// server's count of the prompt, classifying the gateway's own answers: 504 is
+// its prefill deadline and 400 its served-window check (both size bounds),
+// 503 is the pool without room (try later), 502 is an upstream failure (the
+// model's), and anything else is an answer no figure can be drawn from.
+func (p *Probe) request(s *selftest.Session, model, prompt string) (tokens int64, verdict answer, err error) {
+	baseURL, apiKey := p.opts.Sources.Endpoint()
+	body, err := json.Marshal(map[string]any{
+		"model": model,
+		"messages": []map[string]string{
+			{"role": "system", "content": "You are a test harness. Reply with exactly: OK"},
+			{"role": "user", "content": prompt + "\n\nReply with exactly: OK"},
+		},
+		"max_tokens": 1, "temperature": 0, "stream": false,
+	})
+	if err != nil {
+		return 0, answer{}, err
+	}
+	ctx, cancel := context.WithTimeout(s.Ctx, p.opts.StepTimeout(len(body)))
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, baseURL+"/v1/chat/completions", bytes.NewReader(body))
+	if err != nil {
+		return 0, answer{}, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if apiKey != "" {
+		req.Header.Set("Authorization", "Bearer "+apiKey)
+	}
+	s.Hold(1)
+	defer s.Hold(0)
+	resp, err := p.opts.Client.Do(req)
+	if err != nil {
+		return 0, answer{}, err
+	}
+	defer resp.Body.Close()
+	switch resp.StatusCode {
+	case http.StatusOK:
+	case http.StatusGatewayTimeout:
+		return 0, answer{kind: answerBounded, bound: registry.BoundPrefillDeadline}, nil
+	case http.StatusBadRequest:
+		return 0, answer{kind: answerBounded, bound: registry.BoundServedWindow}, nil
+	case http.StatusServiceUnavailable:
+		return 0, answer{kind: answerNoRoom}, nil
+	case http.StatusBadGateway, http.StatusInternalServerError:
+		return 0, answer{}, fmt.Errorf("upstream failure, status %d", resp.StatusCode)
+	default:
+		p.opts.Log.Warn("context probe: the gateway's answer is not one a step can be read from", "model", model, "status", resp.StatusCode)
+		return 0, answer{kind: answerAborted}, nil
+	}
+	var out struct {
+		Usage *struct {
+			PromptTokens int64 `json:"prompt_tokens"`
+		} `json:"usage"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&out); err != nil {
+		return 0, answer{}, err
+	}
+	if out.Usage == nil || out.Usage.PromptTokens <= 0 {
+		return 0, answer{}, errors.New("the answer carried no prompt count")
+	}
+	return out.Usage.PromptTokens, answer{kind: answerOK}, nil
+}
diff --git a/internal/contextprobe/probe_test.go b/internal/contextprobe/probe_test.go
new file mode 100644
index 00000000..041891ed
--- /dev/null
+++ b/internal/contextprobe/probe_test.go
@@ -0,0 +1,634 @@
+package contextprobe
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/registry"
+	"github.com/intentdriven/Gropius/internal/runtime"
+	"github.com/intentdriven/Gropius/internal/selftest"
+)
+
+// fakeGateway stands in for this Mac's own OpenAI endpoint: it counts the
+// prompt the way the fake model server does, answers 200 with the count up
+// to Accept, and above that answers the way the caller configures — a 500
+// (the model's own limit), a 504 (the gateway's prefill deadline) or a 400
+// (its served-window check).
+type fakeGateway struct {
+	srv *httptest.Server
+
+	mu       sync.Mutex
+	accept   int64
+	above    int
+	delay    time.Duration
+	prompts  []string
+	requests int
+	auth     string
+}
+
+func newFakeGateway(t *testing.T, accept int64, above int) *fakeGateway {
+	t.Helper()
+	g := &fakeGateway{accept: accept, above: above}
+	g.srv = httptest.NewServer(http.HandlerFunc(g.handle))
+	t.Cleanup(g.srv.Close)
+	return g
+}
+
+func (g *fakeGateway) handle(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Messages []struct {
+			Content string `json:"content"`
+		} `json:"messages"`
+	}
+	raw, _ := io.ReadAll(r.Body)
+	_ = json.Unmarshal(raw, &body)
+	prompt := ""
+	for _, m := range body.Messages {
+		prompt += m.Content
+	}
+	g.mu.Lock()
+	g.prompts = append(g.prompts, prompt)
+	g.requests++
+	g.auth = r.Header.Get("Authorization")
+	accept, above, delay := g.accept, g.above, g.delay
+	g.mu.Unlock()
+	tokens := int64(len(prompt)/4 + 3)
+	if delay > 0 {
+		select {
+		case <-time.After(delay):
+		case <-r.Context().Done():
+			return
+		}
+	}
+	if tokens > accept {
+		http.Error(w, `{"error":"no"}`, above)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(map[string]any{"usage": map[string]any{"prompt_tokens": tokens}})
+}
+
+func (g *fakeGateway) seen() []string {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return append([]string(nil), g.prompts...)
+}
+
+// fakeSources is the app as the probe sees it.
+type fakeSources struct {
+	mu         sync.Mutex
+	cands      []Candidate
+	available  int64
+	unloads    []string
+	unloadErr  error
+	saved      map[string]*registry.Measurement
+	incomplete map[string]bool
+	url, key   string
+}
+
+func newFakeSources(url string, cands ...Candidate) *fakeSources {
+	return &fakeSources{cands: cands, available: 1 << 40, saved: map[string]*registry.Measurement{}, incomplete: map[string]bool{}, url: url}
+}
+
+func (f *fakeSources) Candidates() []Candidate {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := make([]Candidate, len(f.cands))
+	for i, c := range f.cands {
+		c.Measured = f.saved[c.RepoID]
+		c.Incomplete = f.incomplete[c.RepoID]
+		out[i] = c
+	}
+	return out
+}
+func (f *fakeSources) Provenance(string) registry.Provenance {
+	return registry.Provenance{Runtime: "0.31.3", BudgetBytes: 1, DecodeConcurrency: 4, ServedContext: 131072}
+}
+func (f *fakeSources) Available() int64 { f.mu.Lock(); defer f.mu.Unlock(); return f.available }
+func (f *fakeSources) Unload(id string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.unloads = append(f.unloads, id)
+	return f.unloadErr
+}
+func (f *fakeSources) Save(id string, m *registry.Measurement) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.saved[id] = m
+	return nil
+}
+func (f *fakeSources) MarkIncomplete(id string, on bool) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.incomplete[id] = on
+	return nil
+}
+func (f *fakeSources) Endpoint() (string, string) { return f.url, f.key }
+func (f *fakeSources) result(id string) *registry.Measurement {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.saved[id]
+}
+func (f *fakeSources) unloaded() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]string(nil), f.unloads...)
+}
+
+// fakePool is the loop's view of the pool: nothing resident, quiet, unless a
+// test says otherwise.
+type fakePool struct {
+	mu          sync.Mutex
+	ready       []string
+	inFlight    map[string]int
+	lastUsed    map[string]time.Time
+	waiting     int
+	downloading int
+	fits        bool
+}
+
+func newFakePool(models ...string) *fakePool {
+	return &fakePool{ready: models, inFlight: map[string]int{}, lastUsed: map[string]time.Time{}, fits: true}
+}
+func (p *fakePool) Ready() []string { return p.ready }
+func (p *fakePool) Acquire(context.Context, string) (selftest.Upstream, func(), error) {
+	return selftest.Upstream{}, func() {}, errors.New("the probe never acquires")
+}
+func (p *fakePool) Activity() selftest.Activity {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	act := selftest.Activity{Waiting: p.waiting, Downloading: p.downloading}
+	for id, n := range p.inFlight {
+		act.Models = append(act.Models, selftest.ModelActivity{RepoID: id, InFlight: n, LastUsed: p.lastUsed[id]})
+	}
+	for id, at := range p.lastUsed {
+		if _, ok := p.inFlight[id]; !ok {
+			act.Models = append(act.Models, selftest.ModelActivity{RepoID: id, LastUsed: at})
+		}
+	}
+	return act
+}
+func (p *fakePool) Unload(string) error { return nil }
+func (p *fakePool) Concurrency() int    { return 1 }
+func (p *fakePool) Fits(string) bool    { p.mu.Lock(); defer p.mu.Unlock(); return p.fits }
+
+func quiet() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+func probeOf(src *fakeSources, enabled bool) *Probe {
+	return New(Options{
+		Sources: src, Enabled: func() bool { return enabled }, Log: quiet(),
+		StepTimeout:  func(int) time.Duration { return 2 * time.Second },
+		MemoryMargin: 0, UnloadWait: 100 * time.Millisecond,
+	})
+}
+
+// runner drives the probe as a job of the self-test's loop, with the
+// self-test's own set switched off, on a test cadence.
+func runner(t *testing.T, pool *fakePool, p *Probe) *selftest.Runner {
+	t.Helper()
+	r := selftest.New(selftest.Options{
+		Server: pool, Path: filepath.Join(t.TempDir(), selftest.FileName), Log: quiet(),
+		Tick: 5 * time.Millisecond, Poll: 2 * time.Millisecond, Quiet: time.Nanosecond,
+		Jobs: []selftest.Job{p}, SelfTest: func() bool { return false },
+	})
+	t.Cleanup(r.Close)
+	return r
+}
+
+// runnerQuiet is runner with a real quiet period, for the held-back cases.
+func runnerQuiet(t *testing.T, pool *fakePool, p *Probe, quietFor time.Duration) *selftest.Runner {
+	t.Helper()
+	r := selftest.New(selftest.Options{
+		Server: pool, Path: filepath.Join(t.TempDir(), selftest.FileName), Log: quiet(),
+		Tick: 5 * time.Millisecond, Poll: 2 * time.Millisecond, Quiet: quietFor,
+		Jobs: []selftest.Job{p}, SelfTest: func() bool { return false },
+	})
+	t.Cleanup(r.Close)
+	return r
+}
+
+func waitFor(t *testing.T, what string, cond func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(10 * time.Second)
+	for time.Now().Before(deadline) {
+		if cond() {
+			return
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	t.Fatalf("gave up waiting for %s", what)
+}
+
+var model = Candidate{RepoID: "org/m", Declared: 131072, Served: 131072, Bytes: 1 << 30, KVChargePerToken: 1024}
+
+// The switch off, nothing queued: nothing is due, whatever finished
+// downloading. "Measure now" makes a model due whatever the switch says.
+func TestNothingIsMeasuredWhileTheSwitchIsOff(t *testing.T) {
+	src := newFakeSources("http://127.0.0.1:1", model)
+	p := probeOf(src, false)
+	if due := p.Due([]string{"org/m"}, time.Now()); due != "" {
+		t.Errorf("Due = %q with the switch off", due)
+	}
+	p.MeasureNow("org/m")
+	if due := p.Due([]string{"org/m"}, time.Now()); due != "org/m" {
+		t.Errorf("Due = %q after Measure now", due)
+	}
+	// And a model with a current measurement is not due on the switch.
+	src.saved["org/m"] = &registry.Measurement{Window: 1000, Bound: registry.BoundModel}
+	on := probeOf(src, true)
+	if due := on.Due([]string{"org/m"}, time.Now()); due != "" {
+		t.Errorf("Due = %q for a model already measured", due)
+	}
+	src.saved["org/m"].Stale = registry.StaleRuntime
+	if due := on.Due([]string{"org/m"}, time.Now()); due != "org/m" {
+		t.Errorf("Due = %q for a model whose measurement is stale", due)
+	}
+}
+
+// The probe finds the window the server accepts: a bisection against a
+// server that refuses above a size converges within the tolerance, the
+// bound is the model's, and every step unloaded first.
+func TestAProbeFindsTheWindowTheServerAccepts(t *testing.T) {
+	gw := newFakeGateway(t, 40_000, http.StatusInternalServerError)
+	src := newFakeSources(gw.srv.URL, model)
+	src.key = "k"
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "a measurement", func() bool { return src.result("org/m") != nil })
+	m := src.result("org/m")
+	if m.Bound != registry.BoundModel {
+		t.Errorf("bound = %q, want the model's own", m.Bound)
+	}
+	if m.Window < 35_000 || m.Window > 40_000 {
+		t.Errorf("window = %d, want within a tolerance under 40,000", m.Window)
+	}
+	if m.Runtime != "0.31.3" || m.ServedContext != 131072 {
+		t.Errorf("provenance not recorded: %+v", m)
+	}
+	gw.mu.Lock()
+	auth := gw.auth
+	gw.mu.Unlock()
+	if auth != "Bearer k" {
+		t.Errorf("the configured key was not sent: %q", auth)
+	}
+	if n := len(src.unloaded()); n < len(gw.seen()) {
+		t.Errorf("%d unloads for %d steps; every step unloads first", n, len(gw.seen()))
+	}
+}
+
+// Each step's prompt begins with its own nonce, so no two share a prefix and
+// no retained cache can flatter a later reading.
+func TestEveryStepReloadsAndSharesNoPrefix(t *testing.T) {
+	gw := newFakeGateway(t, 20_000, http.StatusInternalServerError)
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "a measurement", func() bool { return src.result("org/m") != nil })
+	seen := gw.seen()
+	if len(seen) < 3 {
+		t.Fatalf("only %d steps", len(seen))
+	}
+	for i := range seen {
+		for j := range seen {
+			if i != j && strings.HasPrefix(seen[i], seen[j][:64]) {
+				t.Errorf("steps %d and %d share a prefix", i, j)
+			}
+		}
+	}
+}
+
+// A step the gateway's deadline stopped bounds Gropius's configuration, not
+// the model: the figure is a floor and names the bound.
+func TestAStepStoppedByTheDeadlineIsAFloor(t *testing.T) {
+	gw := newFakeGateway(t, 20_000, http.StatusGatewayTimeout)
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "a measurement", func() bool { return src.result("org/m") != nil })
+	if m := src.result("org/m"); m.Bound != registry.BoundPrefillDeadline || m.IsLimit() {
+		t.Errorf("measurement = %+v, want a floor bounded by the prefill deadline", m)
+	}
+}
+
+// A served window below the declared one caps the sweep, and a model that
+// accepts everything up to it is bounded by the served window.
+func TestAServedWindowCapsTheSweep(t *testing.T) {
+	gw := newFakeGateway(t, 1<<40, http.StatusInternalServerError)
+	c := model
+	c.Served = 16_384
+	src := newFakeSources(gw.srv.URL, c)
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "a measurement", func() bool { return src.result("org/m") != nil })
+	m := src.result("org/m")
+	if m.Bound != registry.BoundServedWindow || m.Window > 16_384+512 {
+		t.Errorf("measurement = %+v, want bounded by the served window of 16,384", m)
+	}
+}
+
+// A step whose projected footprint comes within the margin of what the Mac
+// has free is skipped, recorded as the memory guard's, with its projection.
+func TestAStepTooLargeForThisMacIsSkippedWithItsProjection(t *testing.T) {
+	gw := newFakeGateway(t, 1<<40, http.StatusInternalServerError)
+	src := newFakeSources(gw.srv.URL, model)
+	// The flat charge is 1.2 GiB; 1 KiB a token puts 8,192 tokens at 8 MiB
+	// over it. Room for about 6,000 tokens of cache and no more.
+	src.available = 1<<30 + 1<<30/5 + 6_000*1024
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "a measurement", func() bool { return src.result("org/m") != nil })
+	m := src.result("org/m")
+	if m.Bound != registry.BoundMemoryGuard || m.GuardBytes == 0 {
+		t.Errorf("measurement = %+v, want the memory guard with its projection", m)
+	}
+	if m.Window > 6_100 {
+		t.Errorf("window = %d beyond what the guard allowed", m.Window)
+	}
+}
+
+// A real request during a step: the probe's request is cancelled within the
+// poll, the model is unloaded so the abandoned prefill stops, and the step is
+// not kept as a reading; the run resumes from its bounds when the Mac is idle
+// again.
+func TestAProbeYieldsToARealRequestAndResumesFromItsBounds(t *testing.T) {
+	gw := newFakeGateway(t, 40_000, http.StatusInternalServerError)
+	gw.delay = 30 * time.Millisecond
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	pool := newFakePool("org/m")
+	r := runner(t, pool, p)
+	r.SetEnabled(true)
+	waitFor(t, "the sweep to reach 4096", func() bool {
+		for _, s := range gw.seen() {
+			if len(s) > 4096*4 {
+				return true
+			}
+		}
+		return false
+	})
+	before := len(gw.seen())
+	pool.mu.Lock()
+	pool.inFlight["org/other"] = 1
+	pool.mu.Unlock()
+	arrived := time.Now()
+	waitFor(t, "the probe to yield", func() bool { return r.Status().Job == "" })
+	if took := time.Since(arrived); took > 500*time.Millisecond {
+		t.Errorf("the probe took %v to yield", took)
+	}
+	if src.result("org/m") != nil {
+		t.Error("a yielded probe wrote a figure")
+	}
+	if u := src.unloaded(); len(u) == 0 || u[len(u)-1] != "org/m" {
+		t.Error("the yielding probe did not unload the model it was driving")
+	}
+	time.Sleep(30 * time.Millisecond)
+	if n := len(gw.seen()); n > before+1 {
+		t.Errorf("%d requests while a client was in flight (%d before)", n-before, before)
+	}
+	// The client leaves; the probe resumes above what it had verified rather
+	// than from the floor.
+	pool.mu.Lock()
+	delete(pool.inFlight, "org/other")
+	pool.mu.Unlock()
+	waitFor(t, "a measurement after resuming", func() bool { return src.result("org/m") != nil })
+	resumed := gw.seen()[before:]
+	for _, s := range resumed {
+		if len(s) < 2048*4 {
+			t.Errorf("after resuming the probe sent a %d-character prompt, below what it had verified", len(s))
+		}
+	}
+}
+
+// An unload refused because a client took the model discards the step: a
+// server that kept an abandoned cache measures the cache.
+func TestAReadingIsDiscardedWhenTheServerCouldNotBeStopped(t *testing.T) {
+	gw := newFakeGateway(t, 40_000, http.StatusInternalServerError)
+	gw.delay = 30 * time.Millisecond
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	pool := newFakePool("org/m")
+	r := runner(t, pool, p)
+	r.SetEnabled(true)
+	waitFor(t, "the first step", func() bool { return len(gw.seen()) >= 1 })
+	src.mu.Lock()
+	src.unloadErr = runtime.ErrBusy
+	src.mu.Unlock()
+	pool.mu.Lock()
+	pool.inFlight["org/m"] = 2 // the probe's one, and a client's
+	pool.mu.Unlock()
+	waitFor(t, "the probe to yield", func() bool { return r.Status().Job == "" })
+	if src.result("org/m") != nil {
+		t.Error("a figure was written from a step whose server could not be stopped")
+	}
+	p.mu.Lock()
+	b := p.bounds["org/m"]
+	p.mu.Unlock()
+	if b != nil && b.lo > 2048 {
+		t.Errorf("bounds advanced to %d on a discarded step", b.lo)
+	}
+}
+
+// The switch going off, or Gropius quitting, mid-probe: no partial figure,
+// the model unloaded, and the model marked incomplete so the next start says
+// so rather than retrying.
+func TestAnInterruptedProbeWritesNoFigure(t *testing.T) {
+	gw := newFakeGateway(t, 40_000, http.StatusInternalServerError)
+	gw.delay = 30 * time.Millisecond
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "the first step", func() bool { return len(gw.seen()) >= 2 })
+	r.SetEnabled(false)
+	if src.result("org/m") != nil {
+		t.Error("an interrupted probe wrote a figure")
+	}
+	src.mu.Lock()
+	incomplete := src.incomplete["org/m"]
+	src.mu.Unlock()
+	if !incomplete {
+		t.Error("the interrupted probe was not marked incomplete")
+	}
+	if u := src.unloaded(); len(u) == 0 || u[len(u)-1] != "org/m" {
+		t.Error("the model was left loaded")
+	}
+	// And it is not retried on its own.
+	if due := p.Due([]string{"org/m"}, time.Now()); due != "" {
+		t.Errorf("an incomplete probe is due again on its own: %q", due)
+	}
+}
+
+// A probe due does not start while the Mac is busy, and the loop says which
+// of the three conditions held it back.
+func TestAProbeWaitsForIdleAndNamesWhatHeldItBack(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		set  func(*fakePool)
+		want string
+	}{
+		{"a request in flight", func(p *fakePool) { p.inFlight["org/other"] = 1 }, selftest.HeldByInFlight},
+		{"a waiting caller", func(p *fakePool) { p.waiting = 1 }, selftest.HeldByWaiting},
+		{"a download running", func(p *fakePool) { p.downloading = 1 }, selftest.HeldByDownloading},
+		{"a recent request", func(p *fakePool) { p.lastUsed["org/other"] = time.Now() }, selftest.HeldByRecent},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			gw := newFakeGateway(t, 40_000, http.StatusInternalServerError)
+			src := newFakeSources(gw.srv.URL, model)
+			p := probeOf(src, true)
+			pool := newFakePool("org/m")
+			tt.set(pool)
+			r := runnerQuiet(t, pool, p, time.Hour)
+			r.SetEnabled(true)
+			waitFor(t, "the loop to say what held it", func() bool { return r.Status().HeldBy == tt.want })
+			if r.Status().Due != "org/m" {
+				t.Errorf("the loop does not say which model was due: %+v", r.Status())
+			}
+			if len(gw.seen()) != 0 {
+				t.Errorf("%d requests were sent while %s", len(gw.seen()), tt.name)
+			}
+		})
+	}
+}
+
+// A model that would need an eviction to load is not probed: the probe
+// acquires only when the room is already free.
+func TestAPinnedModelIsNeverEvictedForAProbe(t *testing.T) {
+	gw := newFakeGateway(t, 40_000, http.StatusInternalServerError)
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	pool := newFakePool("org/m")
+	pool.fits = false
+	r := runner(t, pool, p)
+	r.SetEnabled(true)
+	time.Sleep(40 * time.Millisecond)
+	if len(gw.seen()) != 0 {
+		t.Errorf("%d requests were sent for a model that does not fit", len(gw.seen()))
+	}
+	pool.mu.Lock()
+	pool.fits = true
+	pool.mu.Unlock()
+	waitFor(t, "a measurement once there is room", func() bool { return src.result("org/m") != nil })
+}
+
+// A model that does not answer even at the floor is marked incomplete and
+// not looped on; "Measure now" is the only retry.
+func TestAModelThatFailsAtTheFloorIsLeftAlone(t *testing.T) {
+	gw := newFakeGateway(t, 10, http.StatusInternalServerError)
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "the floor to fail", func() bool {
+		src.mu.Lock()
+		defer src.mu.Unlock()
+		return src.incomplete["org/m"]
+	})
+	time.Sleep(30 * time.Millisecond)
+	if n := len(gw.seen()); n != 1 {
+		t.Errorf("%d requests after the floor failed, want the one", n)
+	}
+}
+
+// The probe's own timer is the gateway's budget with a margin; if it fires
+// first anyway, the step is the deadline's and never the model's, and the
+// abandoned prefill is stopped.
+func TestTheProbesOwnTimerIsTheDeadlinesNotTheModels(t *testing.T) {
+	gw := newFakeGateway(t, 1<<40, http.StatusInternalServerError)
+	src := newFakeSources(gw.srv.URL, model)
+	p := New(Options{
+		Sources: src, Enabled: func() bool { return true }, Log: quiet(),
+		StepTimeout: func(body int) time.Duration {
+			if body > 8000*4 {
+				return 50 * time.Millisecond
+			}
+			return 2 * time.Second
+		},
+		UnloadWait: 100 * time.Millisecond,
+	})
+	gw.mu.Lock()
+	gw.delay = 200 * time.Millisecond
+	gw.mu.Unlock()
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "a measurement", func() bool { return src.result("org/m") != nil })
+	if m := src.result("org/m"); m.Bound != registry.BoundPrefillDeadline || m.IsLimit() {
+		t.Errorf("measurement = %+v, want a floor filed as the prefill deadline's", m)
+	}
+}
+
+// A 503 is the pool without room, not the model: the step is held for a
+// later tick and no bound is drawn from it.
+func TestAPoolWithoutRoomHoldsTheStepRatherThanBoundingIt(t *testing.T) {
+	gw := newFakeGateway(t, 40_000, http.StatusServiceUnavailable)
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "the sweep to reach the 503", func() bool { return len(gw.seen()) >= 6 })
+	time.Sleep(50 * time.Millisecond)
+	if src.result("org/m") != nil {
+		t.Errorf("a 503 produced a figure: %+v", src.result("org/m"))
+	}
+	p.mu.Lock()
+	b := p.bounds["org/m"]
+	p.mu.Unlock()
+	if b == nil || b.bound == registry.BoundModel {
+		t.Errorf("a 503 was filed as a bound: %+v", b)
+	}
+}
+
+// An answer no figure can be drawn from — a key refused — abandons the run:
+// marked incomplete, nothing saved, not retried on its own.
+func TestARefusedKeyAbandonsTheRun(t *testing.T) {
+	gw := newFakeGateway(t, 0, http.StatusUnauthorized)
+	src := newFakeSources(gw.srv.URL, model)
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "the run to be abandoned", func() bool {
+		src.mu.Lock()
+		defer src.mu.Unlock()
+		return src.incomplete["org/m"]
+	})
+	time.Sleep(30 * time.Millisecond)
+	if n := len(gw.seen()); n != 1 || src.result("org/m") != nil {
+		t.Errorf("%d requests and result %+v after a 401", n, src.result("org/m"))
+	}
+}
+
+// A declared window past the probe's ceiling, or a calibration that counts
+// oddly, cannot make the probe build a prompt of gigabytes: the sweep is
+// capped and the characters-per-token clamped.
+func TestAPlantedDeclaredWindowIsCappedAndTheCalibrationClamped(t *testing.T) {
+	gw := newFakeGateway(t, 1<<40, http.StatusInternalServerError)
+	c := model
+	c.Declared, c.Served = 1<<23, 1<<23
+	src := newFakeSources(gw.srv.URL, c)
+	p := probeOf(src, true)
+	r := runner(t, newFakePool("org/m"), p)
+	r.SetEnabled(true)
+	waitFor(t, "a measurement", func() bool { return src.result("org/m") != nil })
+	for _, prompt := range gw.seen() {
+		if len(prompt) > MaxProbeWindow*maxCharsPerToken {
+			t.Fatalf("a prompt of %d characters was built", len(prompt))
+		}
+	}
+	if m := src.result("org/m"); m.Window > MaxProbeWindow {
+		t.Errorf("window = %d beyond the ceiling", m.Window)
+	}
+}
diff --git a/internal/gateway/control.go b/internal/gateway/control.go
index 31fcfe8b..9921ceb5 100644
--- a/internal/gateway/control.go
+++ b/internal/gateway/control.go
@@ -25,12 +25,16 @@ import (
 	"github.com/intentdriven/Gropius/internal/netshape"
 	"github.com/intentdriven/Gropius/internal/registry"
 	"github.com/intentdriven/Gropius/internal/runtime"
+	"github.com/intentdriven/Gropius/internal/selftest"
 	"github.com/intentdriven/Gropius/internal/stats"
 )
 
 // Control serves the app's own API and the web control panel.
 type Control struct {
-	App *app.App
+	// selfTest is the last reading of the self-test results file; see
+	// selfTestCache. A leaf lock outside adr-2609091239058072's order.
+	selfTest selfTestCache
+	App      *app.App
 	// UI is the embedded web control panel.
 	UI http.Handler
 	// Root is this server's data root. The control plane answers challenges
@@ -121,6 +125,9 @@ func (c *Control) Routes(mux *http.ServeMux) {
 	mux.HandleFunc("GET /api/stats", c.handleStats)
 	mux.HandleFunc("GET /api/stats/history", c.handleStatsHistory)
 	mux.HandleFunc("POST /api/stats/clear", c.handleClearStats)
+	mux.HandleFunc("GET /api/selftest", c.handleSelfTest)
+	mux.HandleFunc("POST /api/models/measure", c.handleMeasure)
+	mux.HandleFunc("POST /api/models/adopt", c.handleAdopt)
 	mux.HandleFunc("GET /api/events", c.handleEvents)
 	mux.HandleFunc("GET /api/instance", c.handleInstance)
 	if c.UI != nil {
@@ -304,6 +311,11 @@ type State struct {
 	// and to say when the mode is on and not running.
 	Bind     BindState `json:"bind"`
 	Hostname string    `json:"hostname"`
+	// IdleJobs is what the idle loop — the self-test and the context probe
+	// — is doing: the run in progress in its own words, or what held a due
+	// run back. ProbeQueue is the models waiting for "Measure now".
+	IdleJobs   selftest.Status `json:"idle_jobs"`
+	ProbeQueue []string        `json:"probe_queue"`
 	// Warnings surface things the user should know, e.g. an open LAN endpoint.
 	Warnings []string `json:"warnings"`
 	// Stats is the per-model summary, present only while the operator has
@@ -365,6 +377,11 @@ type Machine struct {
 	// Lowering the budget unloads nothing, so this stands until they unload by
 	// the usual rules.
 	OverBudget bool `json:"over_budget"`
+	// FreeDisk is the space free on the models volume, from the capability
+	// package's one reader, so the Models tab's roll-up can say how much
+	// room the downloads have left (itd-2609091903463596). Zero when it
+	// cannot be read.
+	FreeDisk int64 `json:"free_disk"`
 }
 
 // snapshot builds the state the UI renders.
@@ -377,15 +394,17 @@ func (c *Control) snapshot() State {
 	cfg := c.App.Config()
 	residency := c.App.Pool.Residency()
 	st := State{
-		Models:    c.App.Registry.List(),
-		Resident:  residency.Models,
-		Setup:     c.App.Provisioner.Status(),
-		Config:    redactConfig(cfg),
-		Pinned:    c.App.Pool.Pinned(),
-		Waiting:   c.App.Pool.Waiting(),
-		Endpoints: Endpoints(cfg, c.App.Bind()),
-		Bind:      bindState(cfg, c.App.Bind()),
-		Hostname:  hostname(),
+		Models:     c.App.Registry.List(),
+		Resident:   residency.Models,
+		Setup:      c.App.Provisioner.Status(),
+		Config:     redactConfig(cfg),
+		Pinned:     c.App.Pool.Pinned(),
+		Waiting:    c.App.Pool.Waiting(),
+		Endpoints:  Endpoints(cfg, c.App.Bind()),
+		Bind:       bindState(cfg, c.App.Bind()),
+		Hostname:   hostname(),
+		IdleJobs:   c.App.SelfTest.Status(),
+		ProbeQueue: c.App.Probe.Queued(),
 	}
 	st.Bind.Port = c.App.BindPort()
 	st.Bind.Advertising = c.App.Advertising()
@@ -437,6 +456,9 @@ func (c *Control) snapshot() State {
 		status := c.App.StatsStore.Status()
 		st.StatsStore = &status
 	}
+	// Read at the snapshot's cadence through the one reader the search tab
+	// already uses, so there is one answer to how much disk is free.
+	st.Machine.FreeDisk = capability.Assess(c.App.Paths.Models, c.App.MachineRAM(), budget).FreeDisk
 	return st
 }
 
@@ -1696,3 +1718,35 @@ func (c *Control) handleEvents(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 }
+
+// handleMeasure queues one probe of a model, whatever the switch says. The
+// run itself waits for the Mac to be idle; the panel watches the state
+// snapshot for its progress.
+func (c *Control) handleMeasure(w http.ResponseWriter, r *http.Request) {
+	model, ok := decodeModelRequest(w, r)
+	if !ok {
+		return
+	}
+	if err := c.App.MeasureNow(model); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusAccepted, map[string]any{"status": "queued", "model": model})
+}
+
+// handleAdopt makes a model's current measurement its served window. It is a
+// settings save, taken under the settings lock like every other.
+func (c *Control) handleAdopt(w http.ResponseWriter, r *http.Request) {
+	model, ok := decodeModelRequest(w, r)
+	if !ok {
+		return
+	}
+	c.settingsMu.Lock()
+	err := c.App.AdoptMeasurement(model)
+	c.settingsMu.Unlock()
+	if err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"status": "adopted", "model": model})
+}
diff --git a/internal/gateway/control_history_test.go b/internal/gateway/control_history_test.go
index 921597fc..6f334725 100644
--- a/internal/gateway/control_history_test.go
+++ b/internal/gateway/control_history_test.go
@@ -39,7 +39,7 @@ func TestTheHistoryEndpointServesTheStoresOwnSums(t *testing.T) {
 		a.Stats.Add(r)
 	}
 	a.Stats.LoadStarted("org/alpha")
-	a.Stats.LoadFinished("org/alpha", 4*time.Second, nil)
+	a.Stats.LoadFinished("org/alpha", 4*time.Second, nil, nil)
 	if err := a.StatsStore.Flush(); err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/gateway/control_probe_test.go b/internal/gateway/control_probe_test.go
new file mode 100644
index 00000000..5fbb8875
--- /dev/null
+++ b/internal/gateway/control_probe_test.go
@@ -0,0 +1,123 @@
+package gateway
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/mlxtest"
+	"github.com/intentdriven/Gropius/internal/registry"
+)
+
+func postModel(t *testing.T, url, path, model string) (*http.Response, map[string]any) {
+	t.Helper()
+	body, _ := json.Marshal(map[string]string{"model": model})
+	resp, err := http.Post(url+path, "application/json", bytes.NewReader(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { resp.Body.Close() })
+	var out map[string]any
+	_ = json.NewDecoder(resp.Body).Decode(&out)
+	return resp, out
+}
+
+// The models list carries the measured window and its bound beside the
+// declared and the served one, only while the measurement is current: a stale
+// one is not published.
+func TestModelsListCarriesTheMeasuredContext(t *testing.T) {
+	fake := mlxtest.Start(mlxtest.Options{ModelArg: "/m"})
+	defer fake.Close()
+	models := &stubModels{models: []registry.Model{
+		{RepoID: "org/plain", State: registry.StateReady, ContextLength: 131072},
+		{RepoID: "org/current", State: registry.StateReady, ContextLength: 131072,
+			Measured: &registry.Measurement{Window: 91000, Bound: registry.BoundPrefillDeadline, Runtime: "0.31.3"}},
+		{RepoID: "org/stale", State: registry.StateReady, ContextLength: 131072,
+			Measured: &registry.Measurement{Window: 91000, Bound: registry.BoundModel, Runtime: "0.31.3", Stale: registry.StaleRuntime}},
+	}}
+	g := New(Options{Config: config.Default(), Pool: &stubPool{srv: fake}, Models: models})
+	srv := httptest.NewServer(g.Handler())
+	defer srv.Close()
+	byID := map[string]map[string]any{}
+	for _, e := range allModelEntries(t, srv) {
+		byID[e["id"].(string)] = e
+	}
+	if e := byID["org/plain"]; e["measured_context"] != nil || e["measured_bound"] != nil {
+		t.Errorf("an unmeasured model carries a measurement: %v", e)
+	}
+	if e := byID["org/stale"]; e["measured_context"] != nil {
+		t.Errorf("a stale measurement is published: %v", e)
+	}
+	e := byID["org/current"]
+	if e["measured_context"] != float64(91000) || e["measured_bound"] != registry.BoundPrefillDeadline {
+		t.Errorf("entry = %v, want measured_context 91000 with the prefill_deadline bound", e)
+	}
+	if e["context_length"] != float64(131072) || e["served_context"] != float64(131072) {
+		t.Errorf("the declared and served windows moved: %v", e)
+	}
+}
+
+// Measure now queues a probe and the snapshot shows the queue; adopting
+// writes the served window and answers under the settings lock.
+func TestMeasureNowQueuesAndAdoptWritesTheServedWindow(t *testing.T) {
+	srv, a := newTestControlApp(t, config.Default())
+	if err := a.Registry.Put(registry.Model{
+		RepoID: "org/m", Path: a.Paths.ModelDir("org/m"), State: registry.StateReady, Bytes: 1, ContextLength: 131072,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp, out := postModel(t, srv.URL, "/api/models/measure", "org/m")
+	if resp.StatusCode != http.StatusAccepted || out["status"] != "queued" {
+		t.Fatalf("measure = %d %v", resp.StatusCode, out)
+	}
+	state, _ := getJSON(t, srv, "/api/state")
+	if q, _ := state["probe_queue"].([]any); len(q) != 1 || q[0] != "org/m" {
+		t.Errorf("probe_queue = %v", state["probe_queue"])
+	}
+	if _, ok := state["idle_jobs"]; !ok {
+		t.Error("the snapshot carries no idle_jobs")
+	}
+	if resp, _ := postModel(t, srv.URL, "/api/models/measure", "org/absent"); resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("measuring an absent model = %d, want 400", resp.StatusCode)
+	}
+
+	if resp, _ := postModel(t, srv.URL, "/api/models/adopt", "org/m"); resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("adopting nothing = %d, want 400", resp.StatusCode)
+	}
+	if err := a.Registry.SetMeasurement("org/m", &registry.Measurement{
+		Window: 65536, Bound: registry.BoundModel, At: 1,
+		Runtime: "0.31.3", BudgetBytes: a.Pool.MemoryBudget(), DecodeConcurrency: a.Pool.DecodeConcurrency(), ServedContext: 131072,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	resp, out = postModel(t, srv.URL, "/api/models/adopt", "org/m")
+	if resp.StatusCode != http.StatusOK || out["status"] != "adopted" {
+		t.Fatalf("adopt = %d %v", resp.StatusCode, out)
+	}
+	if got := a.Config().ServedContext("org/m", 131072); got != 65536 {
+		t.Errorf("served window after adopting = %d", got)
+	}
+}
+
+// A save that names neither probe setting leaves both alone: the settings
+// handler decodes into a copy of what is in force.
+func TestASaveThatNamesNeitherProbeSettingLeavesBothAlone(t *testing.T) {
+	c := config.Default()
+	c.ContextProbe = true
+	c.IdleThresholdSec = 120
+	srv, a := newTestControlApp(t, c)
+	resp, err := http.Post(srv.URL+"/api/settings", "application/json", bytes.NewReader([]byte(`{"log_level":"detailed"}`)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("save = %d", resp.StatusCode)
+	}
+	if got := a.Config(); !got.ContextProbe || got.IdleThresholdSec != 120 {
+		t.Errorf("a save naming neither moved them: probe=%v threshold=%d", got.ContextProbe, got.IdleThresholdSec)
+	}
+}
diff --git a/internal/gateway/control_resources_test.go b/internal/gateway/control_resources_test.go
new file mode 100644
index 00000000..7259ae43
--- /dev/null
+++ b/internal/gateway/control_resources_test.go
@@ -0,0 +1,27 @@
+package gateway
+
+import (
+	"testing"
+
+	"github.com/intentdriven/Gropius/internal/capability"
+	"github.com/intentdriven/Gropius/internal/config"
+)
+
+// The roll-up's free-disk figure is the capability package's one reader's,
+// on the snapshot the panel already polls, so the Models tab and the search
+// tab cannot give two answers to how much room the downloads have.
+func TestTheSnapshotCarriesFreeDiskFromTheOneReader(t *testing.T) {
+	srv, a := newTestControlApp(t, config.Default())
+	state, _ := getJSON(t, srv, "/api/state")
+	machine, _ := state["machine"].(map[string]any)
+	got, _ := machine["free_disk"].(float64)
+	want := capability.Assess(a.Paths.Models, a.MachineRAM(), a.Pool.MemoryBudget()).FreeDisk
+	if want <= 0 {
+		t.Skip("the models volume reports no free space to measure against")
+	}
+	// Free space moves between two readings; a tenth is far more than it
+	// moves in a test.
+	if got <= 0 || got < float64(want)*0.9 || got > float64(want)*1.1 {
+		t.Errorf("free_disk = %v, want about %d from capability.Assess", got, want)
+	}
+}
diff --git a/internal/gateway/control_selftest.go b/internal/gateway/control_selftest.go
new file mode 100644
index 00000000..fd58af7a
--- /dev/null
+++ b/internal/gateway/control_selftest.go
@@ -0,0 +1,102 @@
+package gateway
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/selftest"
+)
+
+// selfTestCache holds the last view served, keyed on the results file's size
+// and modification time. The panel asks every two seconds and any local
+// process may ask as often as it likes; the file changes at most once a run.
+// Without this every ask is a parse of up to the file's cap. It is a leaf
+// lock: nothing is taken while it is held.
+type selfTestCache struct {
+	mu    sync.Mutex
+	size  int64
+	mtime time.Time
+	runs  []selftest.Run
+	valid bool
+}
+
+// selfTestRecent is how many runs, newest first, the endpoint carries beside
+// the latest run per model. The file is bounded, not small; the panel shows
+// what happened lately, and the file is there for the rest.
+const selfTestRecent = 50
+
+// SelfTestView is what GET /api/selftest answers: whether the loop is on,
+// the latest run for each model that has one, and the most recent runs. It
+// carries no path — the file's location is the reference page's to state,
+// not the endpoint's — and a run holds no prompt, answer, key or address
+// (internal/selftest).
+type SelfTestView struct {
+	Enabled bool           `json:"enabled"`
+	Latest  []selftest.Run `json:"latest"`
+	Recent  []selftest.Run `json:"recent"`
+}
+
+// handleSelfTest serves the self-test's results to the panel. Loopback only,
+// like every control-plane route: the figures are the operator's.
+func (c *Control) handleSelfTest(w http.ResponseWriter, r *http.Request) {
+	runs, err := c.selfTestRuns(filepath.Join(c.App.Paths.SelfTest, selftest.FileName))
+	if err != nil {
+		// The error names the path; the panel gets the fact, the log the
+		// detail, and only at the level that carries paths.
+		c.App.Log.Debug("the self-test results could not be read", "err", err)
+		writeError(w, http.StatusInternalServerError, "the self-test results could not be read")
+		return
+	}
+	writeJSON(w, http.StatusOK, selfTestView(c.App.SelfTest.Enabled(), runs))
+}
+
+// selfTestRuns reads the results file, or returns the last reading when the
+// file has not changed since. A missing file is no runs, and is not cached:
+// the first run to be written must be seen.
+func (c *Control) selfTestRuns(path string) ([]selftest.Run, error) {
+	st, err := os.Lstat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	c.selfTest.mu.Lock()
+	defer c.selfTest.mu.Unlock()
+	if c.selfTest.valid && st.Size() == c.selfTest.size && st.ModTime().Equal(c.selfTest.mtime) {
+		return c.selfTest.runs, nil
+	}
+	runs, err := selftest.ReadResults(path)
+	if err != nil {
+		return nil, err
+	}
+	c.selfTest.size, c.selfTest.mtime, c.selfTest.runs, c.selfTest.valid = st.Size(), st.ModTime(), runs, true
+	return runs, nil
+}
+
+// selfTestView folds the file's runs, oldest first as read, into the view.
+func selfTestView(enabled bool, runs []selftest.Run) SelfTestView {
+	view := SelfTestView{Enabled: enabled, Latest: []selftest.Run{}, Recent: []selftest.Run{}}
+	latest := map[string]selftest.Run{}
+	for _, run := range runs {
+		key := config.FoldRepoID(run.Model)
+		if prev, ok := latest[key]; !ok || run.At >= prev.At {
+			latest[key] = run
+		}
+	}
+	for _, run := range latest {
+		view.Latest = append(view.Latest, run)
+	}
+	sort.Slice(view.Latest, func(i, j int) bool {
+		return config.FoldRepoID(view.Latest[i].Model) < config.FoldRepoID(view.Latest[j].Model)
+	})
+	for i := len(runs) - 1; i >= 0 && len(view.Recent) < selfTestRecent; i-- {
+		view.Recent = append(view.Recent, runs[i])
+	}
+	return view
+}
diff --git a/internal/gateway/control_selftest_test.go b/internal/gateway/control_selftest_test.go
new file mode 100644
index 00000000..5ebc9b42
--- /dev/null
+++ b/internal/gateway/control_selftest_test.go
@@ -0,0 +1,165 @@
+package gateway
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/selftest"
+)
+
+// writeSelfTestRuns puts runs into the results file the way the loop would,
+// oldest first, one line each.
+func writeSelfTestRuns(t *testing.T, paths config.Paths, runs ...selftest.Run) {
+	t.Helper()
+	if err := os.MkdirAll(paths.SelfTest, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	var b strings.Builder
+	for _, run := range runs {
+		line, err := json.Marshal(run)
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.Write(line)
+		b.WriteByte('\n')
+	}
+	if err := os.WriteFile(filepath.Join(paths.SelfTest, selftest.FileName), []byte(b.String()), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// A fresh install answers: off, nothing measured — and never a path.
+func TestAFreshInstallHasNoSelfTestResults(t *testing.T) {
+	srv, _ := newTestControlApp(t, config.Default())
+	view, raw := getJSON(t, srv, "/api/selftest")
+	if on, _ := view["enabled"].(bool); on {
+		t.Error("a fresh install reports the self-test as on")
+	}
+	if latest, _ := view["latest"].([]any); len(latest) != 0 {
+		t.Errorf("latest = %v, want none", latest)
+	}
+	if strings.Contains(raw, "/") && strings.Contains(raw, "selftest/") {
+		t.Errorf("the body names the results location:\n%s", raw)
+	}
+}
+
+// The endpoint carries the latest run per model, by model, and the recent
+// runs newest first; a model measured twice appears once in latest with its
+// newer run.
+func TestTheSelfTestEndpointCarriesTheLatestRunPerModel(t *testing.T) {
+	srv, a := newTestControlApp(t, config.Default())
+	writeSelfTestRuns(t, a.Paths,
+		selftest.Run{Kind: selftest.KindRun, Model: "org/b", At: 100, Outcome: selftest.OutcomeOK,
+			Tests: []selftest.Test{{Name: "tg128", Parallel: 1, TokensPerSec: 40}}},
+		selftest.Run{Kind: selftest.KindRun, Model: "org/a", At: 200, Outcome: selftest.OutcomeYielded},
+		selftest.Run{Kind: selftest.KindRun, Model: "Org/B", At: 300, Outcome: selftest.OutcomeOK,
+			Tests: []selftest.Test{{Name: "tg128", Parallel: 1, TokensPerSec: 42}}},
+	)
+	resp, err := srv.Client().Get(srv.URL + "/api/selftest")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	var view SelfTestView
+	if err := json.NewDecoder(resp.Body).Decode(&view); err != nil {
+		t.Fatal(err)
+	}
+	if len(view.Latest) != 2 || view.Latest[0].Model != "org/a" || view.Latest[1].Model != "Org/B" || view.Latest[1].At != 300 {
+		t.Fatalf("latest = %+v; want org/a then org/b's run at 300", view.Latest)
+	}
+	if len(view.Recent) != 3 || view.Recent[0].At != 300 || view.Recent[2].At != 100 {
+		t.Fatalf("recent = %+v; want newest first", view.Recent)
+	}
+	if view.Latest[1].Tests[0].TokensPerSec != 42 {
+		t.Errorf("the newer run's figure did not win: %+v", view.Latest[1])
+	}
+}
+
+// The switch is reported live, from the loop, not from the file.
+func TestTheSelfTestEndpointReportsTheSwitch(t *testing.T) {
+	on := config.Default()
+	on.SelfTest = true
+	srv, _ := newTestControlApp(t, on)
+	view, _ := getJSON(t, srv, "/api/selftest")
+	if enabled, _ := view["enabled"].(bool); !enabled {
+		t.Error("the switch is on and the endpoint says off")
+	}
+}
+
+// Recent is bounded: a long file does not become a long response.
+func TestTheSelfTestEndpointBoundsTheRecentRuns(t *testing.T) {
+	runs := make([]selftest.Run, 0, selfTestRecent+10)
+	for i := 0; i < selfTestRecent+10; i++ {
+		runs = append(runs, selftest.Run{Kind: selftest.KindRun, Model: "org/a", At: int64(i), Outcome: selftest.OutcomeOK})
+	}
+	view := selfTestView(true, runs)
+	if len(view.Recent) != selfTestRecent || view.Recent[0].At != int64(selfTestRecent+9) {
+		t.Errorf("recent has %d runs, first at %d; want %d newest first", len(view.Recent), view.Recent[0].At, selfTestRecent)
+	}
+	if len(view.Latest) != 1 || view.Latest[0].At != int64(selfTestRecent+9) {
+		t.Errorf("latest = %+v", view.Latest)
+	}
+}
+
+// The one branch that handles a path-bearing error answers with a constant
+// and keeps the path for the log: a directory planted where the file should
+// be is a 500 whose body does not say where the file is.
+func TestASelfTestReadThatFailsNamesNoPath(t *testing.T) {
+	srv, a := newTestControlApp(t, config.Default())
+	planted := filepath.Join(a.Paths.SelfTest, selftest.FileName)
+	if err := os.MkdirAll(planted, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	resp, err := srv.Client().Get(srv.URL + "/api/selftest")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Fatalf("status %d, want 500; body %s", resp.StatusCode, body)
+	}
+	if strings.Contains(string(body), a.Paths.SelfTest) || strings.Contains(string(body), "/") {
+		t.Errorf("the body names a path:\n%s", body)
+	}
+}
+
+// The file is parsed once per change, not once per ask: the same size and
+// modification time answer from the last reading, and a new line is seen.
+func TestTheSelfTestViewIsReadOncePerChange(t *testing.T) {
+	srv, a := newTestControlApp(t, config.Default())
+	writeSelfTestRuns(t, a.Paths, selftest.Run{Kind: selftest.KindRun, Model: "org/a", At: 1, Outcome: selftest.OutcomeOK})
+	first, _ := getJSON(t, srv, "/api/selftest")
+	if latest, _ := first["latest"].([]any); len(latest) != 1 {
+		t.Fatalf("latest = %v", latest)
+	}
+	// The same bytes again: served from the cache, which the test can only
+	// see by the reading not failing when the file is made unreadable.
+	path := filepath.Join(a.Paths.SelfTest, selftest.FileName)
+	if err := os.Chmod(path, 0o000); err != nil {
+		t.Fatal(err)
+	}
+	again, _ := getJSON(t, srv, "/api/selftest")
+	if latest, _ := again["latest"].([]any); len(latest) != 1 {
+		t.Errorf("an unchanged file was read again rather than served from the last reading")
+	}
+	if err := os.Chmod(path, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	// A change is seen: a second line, and a later modification time.
+	time.Sleep(20 * time.Millisecond)
+	writeSelfTestRuns(t, a.Paths,
+		selftest.Run{Kind: selftest.KindRun, Model: "org/a", At: 1, Outcome: selftest.OutcomeOK},
+		selftest.Run{Kind: selftest.KindRun, Model: "org/b", At: 2, Outcome: selftest.OutcomeOK})
+	changed, _ := getJSON(t, srv, "/api/selftest")
+	if latest, _ := changed["latest"].([]any); len(latest) != 2 {
+		t.Errorf("a changed file was not read again: latest = %v", latest)
+	}
+}
diff --git a/internal/gateway/control_stats_test.go b/internal/gateway/control_stats_test.go
index 05388c0e..95d5e33d 100644
--- a/internal/gateway/control_stats_test.go
+++ b/internal/gateway/control_stats_test.go
@@ -217,7 +217,7 @@ func TestRecordingWritesOnlyToTheStore(t *testing.T) {
 		a.Stats.Add(stats.Record{Model: "org/a", Class: stats.ClassOK, CompletionTokens: i})
 	}
 	a.Stats.LoadStarted("org/a")
-	a.Stats.LoadFinished("org/a", 0, nil)
+	a.Stats.LoadFinished("org/a", 0, nil, nil)
 	a.Stats.Removed("org/a", stats.ReasonEvicted)
 	getJSON(t, srv, "/api/stats")
 	if err := a.StatsStore.Flush(); err != nil {
diff --git a/internal/gateway/control_store_test.go b/internal/gateway/control_store_test.go
index a20bc7b4..fadc12a1 100644
--- a/internal/gateway/control_store_test.go
+++ b/internal/gateway/control_store_test.go
@@ -208,7 +208,7 @@ func TestNothingFromTheRequestReachesTheStore(t *testing.T) {
 	if w.Code != http.StatusOK {
 		t.Fatalf("status = %d, want 200: %s", w.Code, w.Body.String())
 	}
-	rec.LoadFinished(testModelID, 0, nil)
+	rec.LoadFinished(testModelID, 0, nil, nil)
 	rec.Removed(testModelID, stats.ReasonEvicted)
 	rec.RecordSettings(stats.Settings{At: 1, BudgetBytes: 1, DecodeConcurrency: 1})
 	if err := store.Close(); err != nil {
@@ -348,7 +348,7 @@ func TestNothingFromTheRequestReachesTheSummary(t *testing.T) {
 			t.Fatalf("status = %d, want 200: %s", w.Code, w.Body.String())
 		}
 	}
-	rec.LoadFinished(testModelID, 0, nil)
+	rec.LoadFinished(testModelID, 0, nil, nil)
 	rec.Removed(testModelID, stats.ReasonEvicted)
 	if err := store.Flush(); err != nil {
 		t.Fatal(err)
diff --git a/internal/gateway/gateway.go b/internal/gateway/gateway.go
index 7d386428..05068348 100644
--- a/internal/gateway/gateway.go
+++ b/internal/gateway/gateway.go
@@ -48,6 +48,8 @@ type Pool interface {
 	Resident() []runtime.Resident
 	Pinned() []string
 	Unload(repoID string) error
+	// Footprint is the model server's newest sampled memory, or 0.
+	Footprint(repoID string) int64
 }
 
 // Models is the subset of the registry the gateway needs.
@@ -416,6 +418,17 @@ func (g *Gateway) handleListModels(w http.ResponseWriter, r *http.Request) {
 		if served := cfg.ServedContext(m.RepoID, m.ContextLength); served > 0 {
 			entry["served_context"] = served
 		}
+		// And what the context probe measured on this Mac, beside the two:
+		// the largest prompt the server verifiably accepted, and what stopped
+		// the step above it — the model itself, or one of Gropius's own
+		// bounds, in which case the figure is a floor. Absent while nothing
+		// current has been measured; a stale figure is not published
+		// (itd-2609091301112705). It changes no charge and refuses nothing:
+		// only an adopted figure, as served_context, does.
+		if mm := m.Measured; mm != nil && mm.Stale == "" && mm.Window > 0 && mm.Window <= registry.MaxContextLength {
+			entry["measured_context"] = mm.Window
+			entry["measured_bound"] = mm.Bound
+		}
 		// What HuggingFace says this model is, in HuggingFace's own words, and
 		// what this server makes of them. The two tag fields are absent when
 		// the Hub said nothing — an empty string or an empty list would read as
@@ -597,7 +610,16 @@ func (g *Gateway) handleCompletions(w http.ResponseWriter, r *http.Request) {
 	// and acquiring first would load a model — evicting another to do it — for
 	// a request that is about to be turned away. Streaming and non-streaming
 	// take this line together, because the stream is not opened until below.
-	if msg := g.overServedContext(cfg, model, len(raw), payload); msg != "" {
+	msg, verdict := g.judgeServedContext(cfg, model, len(raw), payload)
+	// What the request was judged against and measured as, recorded before
+	// the refusal so a refused request carries them too, and only while
+	// recording is on, so the path with the switch off is the path it was
+	// (itd-2609091712141073).
+	if obs.recording() {
+		obs.judged(verdict.declared, verdict.served, verdict.estimate, verdict.judged)
+		obs.overrides(overriddenSampling(payload))
+	}
+	if msg != "" {
 		obs.failed(stats.ClassClientError)
 		writeError(w, http.StatusBadRequest, msg)
 		return
@@ -808,6 +830,9 @@ func (g *Gateway) handleCompletions(w http.ResponseWriter, r *http.Request) {
 			"model", model, "limit", maxStreamLine)
 	}
 	obs.relayed(out)
+	if obs.recording() {
+		obs.footprint(g.pool.Footprint(model))
+	}
 }
 
 // gropiusHeaders are the response headers Gropius writes itself, which an
@@ -1393,25 +1418,38 @@ func writeError(w http.ResponseWriter, status int, msg string) {
 // written into the same cache. A model that declares no window and has been
 // given no setting has nothing to enforce, and nothing is refused for it.
 func (g *Gateway) overServedContext(cfg config.Config, model string, bodyBytes int, payload map[string]json.RawMessage) string {
-	var declared int64
+	msg, _ := g.judgeServedContext(cfg, model, bodyBytes, payload)
+	return msg
+}
+
+// servedVerdict is what the served-window check judged: the model's two
+// windows and the figure the request was measured as — the prompt's
+// estimated size plus the answer it asked for — so that the record, the
+// refusal and the dashboard's bands rest on one number.
+type servedVerdict struct {
+	declared, served, estimate, judged int64
+}
+
+// judgeServedContext is overServedContext with its figures: the refusal
+// message, empty when the request is under the window, and the verdict.
+func (g *Gateway) judgeServedContext(cfg config.Config, model string, bodyBytes int, payload map[string]json.RawMessage) (string, servedVerdict) {
+	var v servedVerdict
 	if m, err := g.models.Get(model); err == nil {
-		declared = m.ContextLength
-	}
-	window := cfg.ServedContext(model, declared)
-	if window <= 0 {
-		return ""
+		v.declared = m.ContextLength
 	}
+	v.served = cfg.ServedContext(model, v.declared)
+	v.estimate = int64(estimatedTokens(bodyBytes))
 	// Saturating, because both terms are the client's to choose: a max_tokens
 	// of the largest integer there is made this sum negative, and a negative
 	// estimate is under every window.
-	estimate := capability.AddSaturating(int64(estimatedTokens(bodyBytes)), requestedMaxTokens(payload))
-	if estimate <= window {
-		return ""
+	v.judged = capability.AddSaturating(v.estimate, requestedMaxTokens(payload))
+	if v.served <= 0 || v.judged <= v.served {
+		return "", v
 	}
 	return fmt.Sprintf(
 		"this request is about %s tokens, more than the %s this model is served at. "+
 			"Send a shorter prompt or a smaller max_tokens, or raise this model's served context in Settings.",
-		humanCount(estimate), humanCount(window))
+		humanCount(v.judged), humanCount(v.served)), v
 }
 
 // requestedMaxTokens is the answer length the request asked for, or 0 when it
@@ -1486,6 +1524,32 @@ func humanCount(n int64) string {
 // be, at four bytes per token — the usual ballpark for English text, and
 // deliberately crude. One estimator, because the deadline a request is given
 // and the window it is measured against must not disagree about how big it is.
+// overriddenSampling names the sampling parameters the request's body sets,
+// in the recorder's closed set and order. Only the presence of each key is
+// read; no value is kept.
+func overriddenSampling(payload map[string]json.RawMessage) []string {
+	var names []string
+	for _, name := range stats.SamplingParameters {
+		if _, ok := payload[name]; ok {
+			names = append(names, name)
+		}
+	}
+	// max_completion_tokens is the newer spelling of max_tokens, and an
+	// override under either name is an override of the same launch value.
+	if _, ok := payload["max_completion_tokens"]; ok {
+		found := false
+		for _, n := range names {
+			if n == "max_tokens" {
+				found = true
+			}
+		}
+		if !found {
+			names = append(names, "max_tokens")
+		}
+	}
+	return names
+}
+
 func estimatedTokens(bodyBytes int) int {
 	const bytesPerToken = 4
 	return bodyBytes / bytesPerToken
diff --git a/internal/gateway/gateway_test.go b/internal/gateway/gateway_test.go
index 93a0249d..c0570b3b 100644
--- a/internal/gateway/gateway_test.go
+++ b/internal/gateway/gateway_test.go
@@ -51,7 +51,8 @@ func (s *stubModels) Get(repoID string) (registry.Model, error) {
 
 // stubPool hands out a fixed upstream backed by a fake mlx server.
 type stubPool struct {
-	srv *mlxtest.Server
+	footprint int64
+	srv       *mlxtest.Server
 	// acquireErr, if set, is returned by Acquire.
 	acquireErr error
 	// baseURL, if set, replaces the fake server's own address, so a test can
@@ -1047,6 +1048,23 @@ func firstModelEntry(t *testing.T, srv *httptest.Server) map[string]any {
 	return out.Data[0]
 }
 
+// allModelEntries lists every entry the models list serves to a plain client.
+func allModelEntries(t *testing.T, srv *httptest.Server) []map[string]any {
+	t.Helper()
+	resp, err := http.Get(srv.URL + "/v1/models")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	var out struct {
+		Data []map[string]any `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		t.Fatal(err)
+	}
+	return out.Data
+}
+
 // The models list is a documented interface, and the reference page is where
 // a reader looks it up. This pins the page to the handler: every field served
 // is described there, and nothing is described that is not served.
@@ -1057,8 +1075,11 @@ func TestModelsListReferenceDocumentsEveryFieldServed(t *testing.T) {
 	models := &stubModels{models: []registry.Model{
 		// Carrying a category, so the two fields a model with one is served
 		// are in the set the page is held to.
+		// Carrying a category and a current measurement, so the fields a
+		// model with each is served are in the set the page is held to.
 		{RepoID: "org/m", State: registry.StateReady, ContextLength: 131072,
-			PipelineTag: "text-generation", Tags: []string{"mlx", "conversational"}},
+			PipelineTag: "text-generation", Tags: []string{"mlx", "conversational"},
+			Measured: &registry.Measurement{Window: 91000, Bound: registry.BoundModel, Runtime: "0.31.3"}},
 	}}
 	g := New(Options{Config: config.Default(), Pool: &stubPool{srv: fake}, Models: models})
 	srv := httptest.NewServer(g.Handler())
@@ -2027,3 +2048,5 @@ func TestStreamedLineIsCapped(t *testing.T) {
 		t.Error("the relay did not report the oversized line, so nothing could be logged about it")
 	}
 }
+
+func (s *stubPool) Footprint(string) int64 { return s.footprint }
diff --git a/internal/gateway/measurement_test.go b/internal/gateway/measurement_test.go
new file mode 100644
index 00000000..e751990e
--- /dev/null
+++ b/internal/gateway/measurement_test.go
@@ -0,0 +1,125 @@
+package gateway
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/mlxtest"
+	"github.com/intentdriven/Gropius/internal/registry"
+	"github.com/intentdriven/Gropius/internal/runtime"
+	"github.com/intentdriven/Gropius/internal/stats"
+)
+
+// measuredGateway is a recording gateway over a model that declares a
+// window, with the pool reporting what a test says about in-flight requests
+// and the server's footprint.
+func measuredGateway(t *testing.T, inFlight int, footprint int64) (*httptest.Server, *stats.Recorder) {
+	t.Helper()
+	const modelPath = "/models/" + testModelID
+	fake := mlxtest.Start(mlxtest.Options{ModelArg: modelPath, Reply: "GROPIUS OK"})
+	t.Cleanup(fake.Close)
+	models := &stubModels{models: []registry.Model{{
+		RepoID: testModelID, Path: modelPath, State: registry.StateReady, ContextLength: 131072,
+	}}}
+	pool := &stubPool{srv: fake, footprint: footprint, waits: runtime.AcquireStats{InFlight: inFlight}}
+	rec := stats.New(stats.Options{})
+	rec.SetEnabled(true)
+	cfg := config.Default()
+	cfg.Statistics = true
+	cfg.Models = map[string]config.ModelSettings{testModelID: {ServedContext: 65536}}
+	g := New(Options{Config: cfg, Pool: pool, Models: models, Stats: rec})
+	srv := httptest.NewServer(g.Handler())
+	t.Cleanup(srv.Close)
+	return srv, rec
+}
+
+// A completing request's record carries the two windows it was judged
+// against and how many requests the model already had when it was admitted.
+func TestARecordCarriesTheWindowsAndTheInFlightAtAdmission(t *testing.T) {
+	srv, rec := measuredGateway(t, 2, 0)
+	status, _ := completion(t, srv, `{"model":"mlx-community/Qwen3-8B-4bit","messages":[{"role":"user","content":"hi"}]}`)
+	if status != 200 {
+		t.Fatalf("status %d", status)
+	}
+	got := onlyRecord(t, rec)
+	if got.DeclaredContext != 131072 || got.ServedContext != 65536 {
+		t.Errorf("windows = %d declared, %d served", got.DeclaredContext, got.ServedContext)
+	}
+	if got.InFlight != 2 {
+		t.Errorf("in_flight = %d, want the model's count at admission", got.InFlight)
+	}
+	if got.EstimatedPromptTokens <= 0 || got.RequestedTokens < got.EstimatedPromptTokens {
+		t.Errorf("estimated %d, requested %d", got.EstimatedPromptTokens, got.RequestedTokens)
+	}
+}
+
+// A request tipped over the window by the answer it asked for is refused on
+// the judged figure, and the record carries that figure, so the dashboard's
+// band and the refusal agree.
+func TestARequestTippedOverByMaxTokensIsRecordedOnTheJudgedFigure(t *testing.T) {
+	srv, rec := measuredGateway(t, 0, 0)
+	status, _ := completion(t, srv, `{"model":"mlx-community/Qwen3-8B-4bit","messages":[{"role":"user","content":"hi"}],"max_tokens":65536}`)
+	if status == 200 {
+		t.Fatal("a request over the window by its max_tokens was served")
+	}
+	got := onlyRecord(t, rec)
+	if got.RequestedTokens <= 65536 || got.EstimatedPromptTokens > 100 {
+		t.Errorf("requested %d, estimated %d; the judged figure is the estimate plus max_tokens", got.RequestedTokens, got.EstimatedPromptTokens)
+	}
+}
+
+// A request refused for its size still carries the gateway's estimate, so
+// the refusal says how big the prompt was.
+func TestARefusedRequestStillCarriesItsEstimatedSize(t *testing.T) {
+	srv, rec := measuredGateway(t, 0, 0)
+	// Over the served window of 65,536: the estimate is a token per four bytes.
+	body := `{"model":"mlx-community/Qwen3-8B-4bit","messages":[{"role":"user","content":"` + strings.Repeat("x", 4*100_000) + `"}]}`
+	status, _ := completion(t, srv, body)
+	if status == 200 {
+		t.Fatal("a prompt far over the window was served")
+	}
+	got := onlyRecord(t, rec)
+	if got.Class != stats.ClassClientError {
+		t.Errorf("class = %q", got.Class)
+	}
+	if got.EstimatedPromptTokens < 100_000 || got.ServedContext != 65536 {
+		t.Errorf("a refused request carries estimate %d against served %d", got.EstimatedPromptTokens, got.ServedContext)
+	}
+}
+
+// A client that sets a sampling parameter is recorded as having overridden
+// it, by name; no number the client sent reaches the record.
+func TestOverridesAreNamedAndNeverValued(t *testing.T) {
+	srv, rec := measuredGateway(t, 0, 0)
+	status, _ := completion(t, srv, `{"model":"mlx-community/Qwen3-8B-4bit","messages":[{"role":"user","content":"hi"}],"temperature":0.123456,"max_completion_tokens":777,"top_p":0.5}`)
+	if status != 200 {
+		t.Fatalf("status %d", status)
+	}
+	got := onlyRecord(t, rec)
+	if !reflect.DeepEqual(got.Overrides, []string{"temperature", "top_p", "max_tokens"}) {
+		t.Errorf("overrides = %v", got.Overrides)
+	}
+	raw, _ := json.Marshal(got)
+	for _, value := range []string{"0.123456", "777", "0.5"} {
+		if strings.Contains(string(raw), value) {
+			t.Errorf("the record carries the client's value %s:\n%s", value, raw)
+		}
+	}
+}
+
+// A completing request carries the model server's latest sampled footprint,
+// named as a sample.
+func TestARecordCarriesTheLatestFootprintSample(t *testing.T) {
+	srv, rec := measuredGateway(t, 0, 48<<30)
+	status, _ := completion(t, srv, `{"model":"mlx-community/Qwen3-8B-4bit","messages":[{"role":"user","content":"hi"}]}`)
+	if status != 200 {
+		t.Fatalf("status %d", status)
+	}
+	if got := onlyRecord(t, rec); got.FootprintBytes != 48<<30 {
+		t.Errorf("footprint_bytes = %d", got.FootprintBytes)
+	}
+}
diff --git a/internal/gateway/observe.go b/internal/gateway/observe.go
index 5d712c68..c5c5bbca 100644
--- a/internal/gateway/observe.go
+++ b/internal/gateway/observe.go
@@ -75,6 +75,34 @@ func (o *observation) resolved(model string) {
 }
 
 // streaming notes that the client asked for the answer as a stream.
+// judged records what the served-window check judged the request against
+// and measured it as.
+func (o *observation) judged(declared, served, estimate, judged int64) {
+	if o == nil {
+		return
+	}
+	o.record.DeclaredContext = declared
+	o.record.ServedContext = served
+	o.record.EstimatedPromptTokens = int(estimate)
+	o.record.RequestedTokens = int(judged)
+}
+
+// overrides records which sampling parameters the client set, by name.
+func (o *observation) overrides(names []string) {
+	if o == nil || len(names) == 0 {
+		return
+	}
+	o.record.Overrides = names
+}
+
+// footprint records the server's latest sampled memory at completion.
+func (o *observation) footprint(bytes int64) {
+	if o == nil {
+		return
+	}
+	o.record.FootprintBytes = bytes
+}
+
 func (o *observation) streaming(yes bool) {
 	if o == nil {
 		return
@@ -84,6 +112,11 @@ func (o *observation) streaming(yes bool) {
 
 // waited records what the pool said the request spent getting to a model.
 func (o *observation) waited(w runtime.AcquireStats) {
+	if o != nil {
+		// The model's count at the moment this request took its slot: what
+		// it already had in hand.
+		o.record.InFlight = w.InFlight
+	}
 	if o == nil {
 		return
 	}
diff --git a/internal/gateway/probe_integration_test.go b/internal/gateway/probe_integration_test.go
new file mode 100644
index 00000000..bed83605
--- /dev/null
+++ b/internal/gateway/probe_integration_test.go
@@ -0,0 +1,239 @@
+package gateway
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/app"
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/mlxtest"
+	"github.com/intentdriven/Gropius/internal/registry"
+	"github.com/intentdriven/Gropius/internal/runtime"
+)
+
+// fakeLauncher stands a fake model server up on the port the pool chose,
+// counting prompts and refusing above a size, so the whole path — the
+// probe's request, the gateway, the real pool, the launch, the unload — runs
+// without Python or a GPU.
+type fakeLauncher struct {
+	refuseAbove int
+	mu          sync.Mutex
+	launched    int
+}
+
+type fakeProc struct {
+	srv  *mlxtest.Server
+	done chan struct{}
+	once sync.Once
+}
+
+func (l *fakeLauncher) Precheck(runtime.Spec) error { return nil }
+
+func (l *fakeLauncher) Launch(_ context.Context, spec runtime.Spec) (runtime.Process, error) {
+	l.mu.Lock()
+	l.launched++
+	l.mu.Unlock()
+	srv := mlxtest.Start(mlxtest.Options{
+		ModelArg: spec.ModelPath, Port: spec.Port,
+		PromptTokensFromBody: true, RefuseAbove: l.refuseAbove,
+	})
+	return &fakeProc{srv: srv, done: make(chan struct{})}, nil
+}
+
+func (p *fakeProc) Stop(context.Context) error {
+	p.once.Do(func() { p.srv.Close(); close(p.done) })
+	return nil
+}
+func (p *fakeProc) Done() <-chan struct{} { return p.done }
+func (p *fakeProc) Err() error            { return nil }
+func (p *fakeProc) Pid() int              { return 0 }
+
+// probeStack is an App with a real pool over the fake launcher, its gateway
+// listening on the port the App believes is its own, and the idle loop on a
+// test cadence with the probe as its job.
+func probeStack(t *testing.T, refuseAbove int) (*app.App, string) {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	port := ln.Addr().(*net.TCPAddr).Port
+
+	paths := config.NewPaths(t.TempDir())
+	cfg := config.Default()
+	cfg.Port = port
+	launcher := &fakeLauncher{refuseAbove: refuseAbove}
+	a, err := app.New(app.Options{
+		Paths: paths, Config: cfg, Launcher: launcher, Log: slog.New(slog.NewTextHandler(io.Discard, nil)),
+		// The loop and the probe on a test cadence.
+		Idle: app.IdleOptions{
+			Tick: 10 * time.Millisecond, Poll: 5 * time.Millisecond, Quiet: time.Nanosecond,
+			StepTimeout: func(int) time.Duration { return 5 * time.Second },
+			UnloadWait:  2 * time.Second,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { a.Close() })
+
+	// A model directory the registry's own check accepts.
+	dir := paths.ModelDir("org/m")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "config.json"), []byte(`{"max_position_embeddings": 131072}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "model.safetensors"), []byte("weights"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := a.Registry.Put(registry.Model{RepoID: "org/m", Path: dir, State: registry.StateReady, Bytes: 7, ContextLength: 131072}); err != nil {
+		t.Fatal(err)
+	}
+
+	g := New(Options{ConfigFunc: a.Config, Pool: a.Pool, Models: a.Registry, Log: a.Log})
+	srv := &http.Server{Handler: g.Handler()}
+	go srv.Serve(ln)
+	t.Cleanup(func() { srv.Close() })
+	return a, "http://127.0.0.1:" + strconv.Itoa(port)
+}
+
+func measurementOf(a *app.App) *registry.Measurement {
+	m, _ := a.Registry.Get("org/m")
+	return m.Measured
+}
+
+// The whole path: the probe's requests go through the real gateway to a
+// real pool that launches, serves, and unloads a (fake) model server; the
+// bisection converges on the size the server refuses, the bound is the
+// model's, and the model is left unloaded.
+func TestTheProbeMeasuresThroughTheRealGatewayAndPool(t *testing.T) {
+	a, _ := probeStack(t, 20_000)
+	if err := a.MeasureNow("org/m"); err != nil {
+		t.Fatal(err)
+	}
+	deadline := time.Now().Add(60 * time.Second)
+	for measurementOf(a) == nil && time.Now().Before(deadline) {
+		time.Sleep(20 * time.Millisecond)
+	}
+	m := measurementOf(a)
+	if m == nil {
+		t.Fatalf("no measurement after a minute; status %+v", a.SelfTest.Status())
+	}
+	if m.Bound != registry.BoundModel || m.Window < 17_000 || m.Window > 20_000 {
+		t.Errorf("measurement = %+v, want the model's own limit near 20,000", m)
+	}
+	if m.Runtime != runtime.MLXLMVersion() || m.ServedContext != 131072 {
+		t.Errorf("provenance = %+v", m)
+	}
+	if res := a.Pool.Residency(); len(res.Models) != 0 {
+		t.Errorf("the model was left resident after the probe: %+v", res.Models)
+	}
+	if a.SelfTest.Status().Job != "" {
+		t.Errorf("a job is still reported running: %+v", a.SelfTest.Status())
+	}
+}
+
+// A client's request through the gateway during a probe: the probe yields
+// (the pool's in-flight count shows the client), its own request is
+// cancelled and its server unloaded once the gateway has released it, the
+// client is served, and the probe resumes and completes.
+func TestAClientRequestThroughTheRealGatewayYieldsTheProbeAndItResumes(t *testing.T) {
+	a, base := probeStack(t, 20_000)
+	on := a.Config()
+	on.ContextProbe = true
+	if err := a.SetConfig(on); err != nil {
+		t.Fatal(err)
+	}
+	// Wait for the probe to be mid-run.
+	deadline := time.Now().Add(20 * time.Second)
+	for a.SelfTest.Status().Job == "" && time.Now().Before(deadline) {
+		time.Sleep(5 * time.Millisecond)
+	}
+	if a.SelfTest.Status().Job == "" {
+		t.Fatal("the probe never started")
+	}
+	// The client's request, through the gateway, on the same model.
+	body, _ := json.Marshal(map[string]any{
+		"model": "org/m", "messages": []map[string]string{{"role": "user", "content": "hello"}}, "max_tokens": 1,
+	})
+	resp, err := http.Post(base+"/v1/chat/completions", "application/json", bytes.NewReader(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := io.ReadAll(resp.Body)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("the client got %d: %s", resp.StatusCode, raw)
+	}
+	if !strings.Contains(string(raw), "GROPIUS OK") {
+		t.Errorf("the client's answer: %s", raw)
+	}
+	// The probe resumes and finishes.
+	deadline = time.Now().Add(60 * time.Second)
+	for measurementOf(a) == nil && time.Now().Before(deadline) {
+		time.Sleep(20 * time.Millisecond)
+	}
+	m := measurementOf(a)
+	if m == nil {
+		t.Fatalf("no measurement after the client left; status %+v", a.SelfTest.Status())
+	}
+	if m.Bound != registry.BoundModel {
+		t.Errorf("bound = %q after resuming, want the model's", m.Bound)
+	}
+	if res := a.Pool.Residency(); len(res.Models) != 0 {
+		t.Errorf("the model was left resident: %+v", res.Models)
+	}
+}
+
+// A settings save during a load must not wedge: the staleness refresh judges
+// outside the registry's lock, so the pool's own path through the registry
+// and a save's path through the pool cannot wait on each other.
+func TestASaveDuringALoadDoesNotDeadlock(t *testing.T) {
+	a, _ := probeStack(t, 20_000)
+	if err := a.Registry.SetMeasurement("org/m", &registry.Measurement{
+		Window: 1000, Bound: registry.BoundModel, At: 1, Runtime: runtime.MLXLMVersion(),
+		BudgetBytes: a.Pool.MemoryBudget(), DecodeConcurrency: a.Pool.DecodeConcurrency(), ServedContext: 131072,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for i := 0; i < 20; i++ {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			_, release, err := a.Pool.Acquire(ctx, "org/m")
+			cancel()
+			if err == nil {
+				release()
+			}
+			a.Pool.RefreshCharges()
+			_ = a.Pool.Unload("org/m")
+		}
+	}()
+	for i := 0; i < 20; i++ {
+		c := a.Config()
+		c.LogLevel = []string{"sparse", "detailed"}[i%2]
+		if err := a.SetConfig(c); err != nil {
+			t.Fatal(err)
+		}
+	}
+	select {
+	case <-done:
+	case <-time.After(30 * time.Second):
+		t.Fatal("a save and a load wedged each other")
+	}
+}
diff --git a/internal/gateway/systemmerge_test.go b/internal/gateway/systemmerge_test.go
index ffd86184..981942a9 100644
--- a/internal/gateway/systemmerge_test.go
+++ b/internal/gateway/systemmerge_test.go
@@ -862,3 +862,5 @@ func TestMergeSystemMessagesLeavesAConversationThatNeedsNoRewrite(t *testing.T)
 		})
 	}
 }
+
+func (p *urlPool) Footprint(string) int64 { return 0 }
diff --git a/internal/lifecycle/testdata/config_show.json b/internal/lifecycle/testdata/config_show.json
index 835bfe76..b786476d 100644
--- a/internal/lifecycle/testdata/config_show.json
+++ b/internal/lifecycle/testdata/config_show.json
@@ -10,12 +10,14 @@
     "chat_rule.required_tags": [
       "conversational"
     ],
+    "context_probe": false,
     "decode_concurrency": 4,
     "eviction_grace": false,
     "eviction_grace_sec": 120,
     "eviction_max_wait_sec": 300,
     "hf_token": "********",
     "host": "0.0.0.0",
+    "idle_threshold_sec": 0,
     "idle_timeout_sec": 0,
     "log_level": "sparse",
     "max_resident_bytes": 0,
@@ -36,6 +38,7 @@
     "sampling.temperature": null,
     "sampling.top_k": null,
     "sampling.top_p": null,
+    "self_test": false,
     "statistics": false,
     "stats_max_bytes": 209715200,
     "stats_months": 6,
diff --git a/internal/mlxtest/fake.go b/internal/mlxtest/fake.go
index d9c33d60..5528cf3a 100644
--- a/internal/mlxtest/fake.go
+++ b/internal/mlxtest/fake.go
@@ -45,6 +45,12 @@ type Server struct {
 	ChunkDelay time.Duration
 	// RolePreamble emits a role-only first chunk; see Options.
 	RolePreamble bool
+	// PromptTokensFromBody, RefuseAbove, HangAbove and ResponseDelay: see
+	// Options.
+	PromptTokensFromBody bool
+	RefuseAbove          int
+	HangAbove            int
+	ResponseDelay        time.Duration
 
 	httpSrv   *httptest.Server
 	readyAt   time.Time
@@ -82,18 +88,38 @@ type Options struct {
 	// established here, so a test that cares which chunk a measurement lands
 	// on turns this on and says which behavior it is describing.
 	RolePreamble bool
+	// PromptTokensFromBody makes usage.prompt_tokens a count derived from the
+	// request's messages — about a token per four characters, plus the
+	// template's few — instead of the constant 3, so a probe that bisects on
+	// prompt size has something to converge on.
+	PromptTokensFromBody bool
+	// RefuseAbove, when set, refuses a prompt counted above that many tokens
+	// with a 500, the way a server that ran out of room answers.
+	RefuseAbove int
+	// HangAbove, when set, never answers a prompt counted above that many
+	// tokens until the request goes away — what a prefill that outlasts the
+	// gateway's deadline looks like from outside.
+	HangAbove int
+	// ResponseDelay holds a non-streaming answer back, standing in for a
+	// prefill on that path the way FirstTokenDelay does for the streaming
+	// one.
+	ResponseDelay time.Duration
 }
 
 // Start launches a fake server. It is closed automatically via t.Cleanup by the
 // caller, or explicitly with Close.
 func Start(opts Options) *Server {
 	s := &Server{
-		ModelArg:        opts.ModelArg,
-		Reply:           opts.Reply,
-		FirstTokenDelay: opts.FirstTokenDelay,
-		ChunkDelay:      opts.ChunkDelay,
-		RolePreamble:    opts.RolePreamble,
-		readyAt:         time.Now().Add(opts.LoadDelay),
+		ModelArg:             opts.ModelArg,
+		Reply:                opts.Reply,
+		FirstTokenDelay:      opts.FirstTokenDelay,
+		ChunkDelay:           opts.ChunkDelay,
+		RolePreamble:         opts.RolePreamble,
+		PromptTokensFromBody: opts.PromptTokensFromBody,
+		RefuseAbove:          opts.RefuseAbove,
+		HangAbove:            opts.HangAbove,
+		ResponseDelay:        opts.ResponseDelay,
+		readyAt:              time.Now().Add(opts.LoadDelay),
 	}
 	if s.Reply == "" {
 		s.Reply = "GROPIUS OK"
@@ -202,6 +228,19 @@ func (s *Server) handleChat(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	promptTokens := 3
+	if s.PromptTokensFromBody {
+		promptTokens = countPromptTokens(body)
+		if s.HangAbove > 0 && promptTokens > s.HangAbove {
+			<-r.Context().Done()
+			return
+		}
+		if s.RefuseAbove > 0 && promptTokens > s.RefuseAbove {
+			http.Error(w, `{"error":"prompt too long for this server"}`, http.StatusInternalServerError)
+			return
+		}
+	}
+
 	s.completed.Add(1)
 
 	if stream, _ := body["stream"].(bool); stream {
@@ -216,6 +255,13 @@ func (s *Server) handleChat(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if s.ResponseDelay > 0 {
+		select {
+		case <-time.After(s.ResponseDelay):
+		case <-r.Context().Done():
+			return
+		}
+	}
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]any{
 		"id":     "chatcmpl-fake",
@@ -226,10 +272,28 @@ func (s *Server) handleChat(w http.ResponseWriter, r *http.Request) {
 			"finish_reason": "stop",
 			"message":       map[string]any{"role": "assistant", "content": s.Reply},
 		}},
-		"usage": map[string]any{"prompt_tokens": 3, "completion_tokens": 4, "total_tokens": 7},
+		"usage": map[string]any{"prompt_tokens": promptTokens, "completion_tokens": 4, "total_tokens": promptTokens + 4},
 	})
 }
 
+// countPromptTokens is the fake's tokenizer: about four characters a token
+// over every message's content, plus the handful a chat template adds. It is
+// a count, not a tokenization, and it is monotonic in the prompt's length,
+// which is all a bisection needs of it.
+func countPromptTokens(body map[string]any) int {
+	chars := 0
+	if msgs, ok := body["messages"].([]any); ok {
+		for _, m := range msgs {
+			if mm, ok := m.(map[string]any); ok {
+				if c, ok := mm["content"].(string); ok {
+					chars += len(c)
+				}
+			}
+		}
+	}
+	return chars/4 + 3
+}
+
 // streamIncludeUsage reads the request's stream_options the way the real
 // server does. It reports an error for an object that does not carry the
 // include_usage key, which is the shape that raises upstream; an absent or
diff --git a/internal/mlxtest/fake_test.go b/internal/mlxtest/fake_test.go
new file mode 100644
index 00000000..d4c4609f
--- /dev/null
+++ b/internal/mlxtest/fake_test.go
@@ -0,0 +1,75 @@
+package mlxtest
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+func post(t *testing.T, ctx context.Context, url string, body map[string]any) (*http.Response, map[string]any) {
+	t.Helper()
+	raw, _ := json.Marshal(body)
+	req, _ := http.NewRequestWithContext(ctx, http.MethodPost, url+"/v1/chat/completions", bytes.NewReader(raw))
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, nil
+	}
+	t.Cleanup(func() { resp.Body.Close() })
+	var out map[string]any
+	_ = json.NewDecoder(resp.Body).Decode(&out)
+	return resp, out
+}
+
+func chat(content string) map[string]any {
+	return map[string]any{
+		"model":      "/models/m",
+		"messages":   []map[string]string{{"role": "user", "content": content}},
+		"max_tokens": 1, "stream": false,
+	}
+}
+
+// With the knob on, the fake counts the prompt the way a tokenizer roughly
+// would, so a bisection has something to converge on; and above a size it
+// refuses, the way a server that ran out of room does.
+func TestTheFakeCanCountThePromptAndRefuseAboveASize(t *testing.T) {
+	s := Start(Options{ModelArg: "/models/m", PromptTokensFromBody: true, RefuseAbove: 100})
+	t.Cleanup(s.Close)
+	resp, out := post(t, context.Background(), s.URL(), chat(strings.Repeat("word ", 40)))
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("a small prompt was refused: %d", resp.StatusCode)
+	}
+	usage, _ := out["usage"].(map[string]any)
+	if pt, _ := usage["prompt_tokens"].(float64); pt < 40 || pt > 60 {
+		t.Errorf("prompt_tokens = %v for 200 characters, want about 50", pt)
+	}
+	resp, _ = post(t, context.Background(), s.URL(), chat(strings.Repeat("word ", 400)))
+	if resp.StatusCode == http.StatusOK {
+		t.Error("a prompt above RefuseAbove was served")
+	}
+}
+
+// Above HangAbove the fake never answers, which is what a prefill that
+// outlasts the gateway's deadline looks like from outside; the response delay
+// holds the non-streaming answer back for a measured time.
+func TestTheFakeCanHangAndDelayOnTheNonStreamingPath(t *testing.T) {
+	s := Start(Options{ModelArg: "/models/m", PromptTokensFromBody: true, HangAbove: 100, ResponseDelay: 50 * time.Millisecond})
+	t.Cleanup(s.Close)
+	started := time.Now()
+	resp, _ := post(t, context.Background(), s.URL(), chat("short"))
+	if resp == nil || resp.StatusCode != http.StatusOK {
+		t.Fatal("a short prompt was not answered")
+	}
+	if time.Since(started) < 50*time.Millisecond {
+		t.Error("the response delay was not honoured on the non-streaming path")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+	if resp, _ := post(t, ctx, s.URL(), chat(strings.Repeat("word ", 400))); resp != nil {
+		t.Errorf("a prompt above HangAbove was answered with %d", resp.StatusCode)
+	}
+}
diff --git a/internal/registry/measurement.go b/internal/registry/measurement.go
new file mode 100644
index 00000000..640d50d6
--- /dev/null
+++ b/internal/registry/measurement.go
@@ -0,0 +1,223 @@
+package registry
+
+import (
+	"fmt"
+)
+
+// Measurement is what the context probe found for a model on this Mac: the
+// largest prompt the server verifiably accepted, what stopped the next step,
+// and the provenance the figure holds under (itd-2609091301112705). It lives
+// on the model's registry entry, so it is a fact about these files on this
+// machine, and it is never reused elsewhere.
+type Measurement struct {
+	// Window is the largest prompt, in the model server's own prompt_tokens,
+	// that came back with an answer.
+	Window int64 `json:"window"`
+	// Bound is what stopped the step above Window: the model itself, or one
+	// of the gateway's own limits, or the memory guard. Only BoundModel makes
+	// Window the model's limit; every other bound makes it a floor.
+	Bound string `json:"bound"`
+	// At is when the measurement completed, Unix seconds UTC.
+	At int64 `json:"at"`
+	// The provenance: what was in force when the figure was taken. Move any
+	// of them and the figure is stale.
+	Runtime           string `json:"runtime"`
+	BudgetBytes       int64  `json:"budget_bytes"`
+	DecodeConcurrency int    `json:"decode_concurrency"`
+	ServedContext     int64  `json:"served_context"`
+	// GuardBytes is the projected peak footprint that the memory guard
+	// refused, present only when Bound is BoundMemoryGuard: the step was
+	// skipped, and this is the figure that skipped it.
+	GuardBytes int64 `json:"guard_bytes,omitempty"`
+	// Stale names the provenance that has moved since, or is empty while the
+	// figure is current. Written by RefreshStaleness at start and at every
+	// save, so a reader of the file learns it rather than inferring it.
+	Stale string `json:"stale,omitempty"`
+}
+
+// The bounds a step can be stopped by.
+const (
+	BoundModel           = "model"
+	BoundPrefillDeadline = "prefill_deadline"
+	BoundServedWindow    = "served_window"
+	BoundMemoryGuard     = "memory_guard"
+)
+
+// The reasons a measurement goes stale.
+const (
+	StaleRuntime       = "runtime"
+	StaleBudget        = "budget"
+	StaleConcurrency   = "decode_concurrency"
+	StaleServedContext = "served_context"
+)
+
+// maxProvenanceBytes bounds the runtime string a planted file can carry.
+const maxProvenanceBytes = 64
+
+// ValidBound reports whether b is one of the four bounds.
+func ValidBound(b string) bool {
+	switch b {
+	case BoundModel, BoundPrefillDeadline, BoundServedWindow, BoundMemoryGuard:
+		return true
+	}
+	return false
+}
+
+func validStale(s string) bool {
+	switch s {
+	case "", StaleRuntime, StaleBudget, StaleConcurrency, StaleServedContext:
+		return true
+	}
+	return false
+}
+
+// IsLimit reports whether the window is the model's own limit rather than a
+// floor under it.
+func (m *Measurement) IsLimit() bool { return m != nil && m.Bound == BoundModel }
+
+// Provenance is what is in force now, to compare a measurement against.
+type Provenance struct {
+	Runtime           string
+	BudgetBytes       int64
+	DecodeConcurrency int
+	ServedContext     int64
+}
+
+// StaleAgainst names the first part of the provenance that has moved, or ""
+// when the measurement still holds. The order is the order a reader would
+// ask in: the runtime first, since it changes the most about a reading.
+func (m *Measurement) StaleAgainst(p Provenance) string {
+	switch {
+	case m.Runtime != p.Runtime:
+		return StaleRuntime
+	case m.BudgetBytes != p.BudgetBytes:
+		return StaleBudget
+	case m.DecodeConcurrency != p.DecodeConcurrency:
+		return StaleConcurrency
+	case m.ServedContext != p.ServedContext && p.ServedContext != m.Window:
+		// A served window set to the measured window itself is adoption,
+		// not a move: the floor was verified under a window at least that
+		// large, and still stands.
+		return StaleServedContext
+	}
+	return ""
+}
+
+// plausibleMeasurement bounds a measurement read from the file, for the
+// reason plausibleContextLength bounds the window: registry.json is, in
+// shared-cache mode, a file another local account can write, and a figure is
+// cleared rather than repaired into something that looks right.
+func plausibleMeasurement(m *Measurement) bool {
+	if m == nil {
+		return false
+	}
+	const maxBytes = 1 << 50 // a petabyte: past any Mac, still far from overflow
+	return plausibleContextLength(m.Window) && ValidBound(m.Bound) && validStale(m.Stale) &&
+		len(m.Runtime) <= maxProvenanceBytes && m.At >= 0 && m.At < 1<<40 &&
+		m.BudgetBytes >= 0 && m.BudgetBytes <= maxBytes && m.GuardBytes >= 0 && m.GuardBytes <= maxBytes &&
+		m.DecodeConcurrency >= 0 && m.DecodeConcurrency <= 1024 &&
+		m.ServedContext >= 0 && m.ServedContext <= MaxContextLength
+}
+
+// SetMeasurement records the probe's result for a model, replacing any
+// earlier one, and clears the incomplete mark. A nil measurement clears.
+func (r *Registry) SetMeasurement(repoID string, m *Measurement) error {
+	if m != nil && !plausibleMeasurement(m) {
+		return fmt.Errorf("registry: implausible measurement for %s", repoID)
+	}
+	r.mu.Lock()
+	existing, ok := r.models[key(repoID)]
+	if !ok {
+		r.mu.Unlock()
+		return fmt.Errorf("registry: %s: %w", repoID, ErrNotFound)
+	}
+	existing.Measured = m
+	existing.ProbeIncomplete = false
+	r.models[key(repoID)] = existing
+	snapshot := r.listLocked()
+	err := r.saveLocked()
+	r.mu.Unlock()
+	r.broadcast(snapshot)
+	return err
+}
+
+// SetProbeIncomplete marks a model whose probe was interrupted, so the next
+// start can say so rather than silently retrying it.
+func (r *Registry) SetProbeIncomplete(repoID string, on bool) error {
+	r.mu.Lock()
+	existing, ok := r.models[key(repoID)]
+	if !ok {
+		r.mu.Unlock()
+		return fmt.Errorf("registry: %s: %w", repoID, ErrNotFound)
+	}
+	existing.ProbeIncomplete = on
+	r.models[key(repoID)] = existing
+	snapshot := r.listLocked()
+	err := r.saveLocked()
+	r.mu.Unlock()
+	r.broadcast(snapshot)
+	return err
+}
+
+// RefreshStaleness compares every measurement with what is in force now for
+// its model — the served window is a per-model setting, so the provenance is
+// asked per model — writes the verdict onto each, and returns the ids of the
+// models whose verdict changed. It is called at start and after every save,
+// so staleness is a stored fact rather than an assumption.
+//
+// The registry's lock is not held while inForce runs: the callback reads the
+// pool and the configuration, and the pool already reads the registry under
+// its own lock (Resolve, under p.mu), so holding r.mu across it would be the
+// inversion adr-2609091239058072 exists to prevent. Instead the models are
+// snapshotted, judged lock-free, and written back only where the measurement
+// is still the one that was judged.
+func (r *Registry) RefreshStaleness(inForce func(m Model) Provenance) []string {
+	type judged struct {
+		key   string
+		was   *Measurement
+		stale string
+	}
+	r.mu.RLock()
+	var snapshot []Model
+	for _, m := range r.models {
+		if m.Measured != nil {
+			snapshot = append(snapshot, m)
+		}
+	}
+	r.mu.RUnlock()
+
+	var verdicts []judged
+	for _, m := range snapshot {
+		stale := m.Measured.StaleAgainst(inForce(m))
+		if stale != m.Measured.Stale {
+			verdicts = append(verdicts, judged{key: key(m.RepoID), was: m.Measured, stale: stale})
+		}
+	}
+	if len(verdicts) == 0 {
+		return nil
+	}
+
+	r.mu.Lock()
+	var changed []string
+	for _, v := range verdicts {
+		m, ok := r.models[v.key]
+		if !ok || m.Measured != v.was {
+			continue // replaced meanwhile; the next refresh judges the new one
+		}
+		copied := *m.Measured
+		copied.Stale = v.stale
+		m.Measured = &copied
+		r.models[v.key] = m
+		changed = append(changed, m.RepoID)
+	}
+	var out []Model
+	if len(changed) > 0 {
+		out = r.listLocked()
+		_ = r.saveLocked()
+	}
+	r.mu.Unlock()
+	if len(changed) > 0 {
+		r.broadcast(out)
+	}
+	return changed
+}
diff --git a/internal/registry/measurement_test.go b/internal/registry/measurement_test.go
new file mode 100644
index 00000000..31673643
--- /dev/null
+++ b/internal/registry/measurement_test.go
@@ -0,0 +1,190 @@
+package registry
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func measured() *Measurement {
+	return &Measurement{
+		Window:            91_000,
+		Bound:             BoundModel,
+		At:                1_788_696_000,
+		Runtime:           "0.31.3",
+		BudgetBytes:       96 << 30,
+		DecodeConcurrency: 4,
+		ServedContext:     131_072,
+	}
+}
+
+func inForce() Provenance {
+	return Provenance{Runtime: "0.31.3", BudgetBytes: 96 << 30, DecodeConcurrency: 4, ServedContext: 131_072}
+}
+
+// A measurement is a fact about one runtime, one budget, one concurrency and
+// one served window. Move any of them and the figure is stale, and the
+// record says which moved.
+func TestAMeasurementGoesStaleWhenItsProvenanceMoves(t *testing.T) {
+	if reason := measured().StaleAgainst(inForce()); reason != "" {
+		t.Fatalf("an unchanged provenance made the measurement stale: %q", reason)
+	}
+	for _, tt := range []struct {
+		name string
+		move func(*Provenance)
+		want string
+	}{
+		{"runtime", func(p *Provenance) { p.Runtime = "0.32.0" }, StaleRuntime},
+		{"budget", func(p *Provenance) { p.BudgetBytes = 64 << 30 }, StaleBudget},
+		{"concurrency", func(p *Provenance) { p.DecodeConcurrency = 2 }, StaleConcurrency},
+		{"served window", func(p *Provenance) { p.ServedContext = 65_536 }, StaleServedContext},
+	} {
+		p := inForce()
+		tt.move(&p)
+		if got := measured().StaleAgainst(p); got != tt.want {
+			t.Errorf("%s moved: stale = %q, want %q", tt.name, got, tt.want)
+		}
+	}
+}
+
+// Staleness is a stored fact, not an inference: at start the provenance is
+// compared with what is in force and the verdict is written to the file, so a
+// reader of registry.json learns it.
+func TestStalenessIsRecordedAtLoad(t *testing.T) {
+	dir := t.TempDir()
+	r, err := Open(filepath.Join(dir, "registry.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Put(Model{RepoID: "org/m", Path: dir, State: StateReady, Bytes: 1, ContextLength: 131_072}); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.SetMeasurement("org/m", measured()); err != nil {
+		t.Fatal(err)
+	}
+	moved := inForce()
+	moved.Runtime = "0.32.0"
+	if marked := r.RefreshStaleness(func(Model) Provenance { return moved }); len(marked) != 1 || marked[0] != "org/m" {
+		t.Fatalf("RefreshStaleness marked %v, want org/m", marked)
+	}
+	raw, err := os.ReadFile(filepath.Join(dir, "registry.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(raw), `"stale": "runtime"`) && !strings.Contains(string(raw), `"stale":"runtime"`) {
+		t.Errorf("the file does not record why the measurement is stale:\n%s", raw)
+	}
+	m, _ := r.Get("org/m")
+	if m.Measured == nil || m.Measured.Stale != StaleRuntime {
+		t.Errorf("Measured = %+v, want stale for the runtime", m.Measured)
+	}
+	// Back in force: current again, and that change of verdict is reported
+	// too; a second refresh with nothing moved reports nothing.
+	if marked := r.RefreshStaleness(func(Model) Provenance { return inForce() }); len(marked) != 1 {
+		t.Errorf("a provenance back in force marked %v, want the one model whose verdict changed", marked)
+	}
+	if marked := r.RefreshStaleness(func(Model) Provenance { return inForce() }); len(marked) != 0 {
+		t.Errorf("an unchanged provenance marked %v", marked)
+	}
+	if m, _ := r.Get("org/m"); m.Measured.Stale != "" {
+		t.Errorf("Measured.Stale = %q after the provenance came back", m.Measured.Stale)
+	}
+}
+
+// A re-download writes a fresh record through Put, and a fresh record has no
+// measurement: the figure belonged to the files that were replaced.
+func TestARescanClearsAMeasurementForARedownloadedModel(t *testing.T) {
+	dir := t.TempDir()
+	r, err := Open(filepath.Join(dir, "registry.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Put(Model{RepoID: "org/m", Path: dir, State: StateReady, Bytes: 1, ContextLength: 131_072}); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.SetMeasurement("org/m", measured()); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.SetProbeIncomplete("org/m", true); err != nil {
+		t.Fatal(err)
+	}
+	// The download's own Put: the shape finishDownload writes.
+	if err := r.Put(Model{RepoID: "org/m", Path: dir, State: StateReady, Bytes: 2, ContextLength: 131_072, AddedAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	m, _ := r.Get("org/m")
+	if m.Measured != nil || m.ProbeIncomplete {
+		t.Errorf("a re-downloaded model kept its measurement: %+v incomplete=%v", m.Measured, m.ProbeIncomplete)
+	}
+}
+
+// registry.json is, in shared-cache mode, a file another local account can
+// write. A measurement read back is bounded exactly as one written by the
+// probe is, and an implausible one is cleared rather than repaired.
+func TestAPlantedMeasurementIsClearedOnLoad(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		json string
+	}{
+		{"a window past the bound", `{"window": 9999999999, "bound": "model", "at": 1, "runtime": "0.31.3"}`},
+		{"a window of nothing", `{"window": 0, "bound": "model", "at": 1, "runtime": "0.31.3"}`},
+		{"a bound outside the set", `{"window": 1000, "bound": "wishful", "at": 1, "runtime": "0.31.3"}`},
+		{"a stale reason outside the set", `{"window": 1000, "bound": "model", "at": 1, "runtime": "0.31.3", "stale": "vibes"}`},
+		{"a runtime string past any version", `{"window": 1000, "bound": "model", "at": 1, "runtime": "` + strings.Repeat("9", 200) + `"}`},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			path := filepath.Join(dir, "registry.json")
+			file := `[{"repo_id": "org/m", "path": "` + dir + `", "state": "ready", "bytes": 1, "context_length": 131072, "measured": ` + tt.json + `}]`
+			if err := os.WriteFile(path, []byte(file), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			r, err := Open(path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			m, err := r.Get("org/m")
+			if err != nil {
+				t.Fatalf("the planted file did not load its model: %v", err)
+			}
+			if m.Measured != nil {
+				t.Errorf("%s survived the load: %+v", tt.name, m.Measured)
+			}
+		})
+	}
+	// And a good one survives.
+	dir := t.TempDir()
+	path := filepath.Join(dir, "registry.json")
+	file := `[{"repo_id": "org/m", "path": "` + dir + `", "state": "ready", "bytes": 1, "context_length": 131072, "measured": {"window": 91000, "bound": "prefill_deadline", "at": 1, "runtime": "0.31.3", "budget_bytes": 1, "decode_concurrency": 4, "served_context": 131072}}]`
+	if err := os.WriteFile(path, []byte(file), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	r, err := Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if m, _ := r.Get("org/m"); m.Measured == nil || m.Measured.Window != 91000 || m.Measured.Bound != BoundPrefillDeadline {
+		t.Errorf("a plausible measurement did not survive the load: %+v", m.Measured)
+	}
+}
+
+// Every bound is either the model's own limit or a floor, and the set is
+// closed: a reader can rely on the four names.
+func TestOnlyTheModelBoundIsALimit(t *testing.T) {
+	if !(&Measurement{Bound: BoundModel}).IsLimit() {
+		t.Error("the model bound is not a limit")
+	}
+	for _, b := range []string{BoundPrefillDeadline, BoundServedWindow, BoundMemoryGuard} {
+		if (&Measurement{Bound: b}).IsLimit() {
+			t.Errorf("bound %q reads as the model's limit", b)
+		}
+		if !ValidBound(b) {
+			t.Errorf("bound %q is not in the set", b)
+		}
+	}
+	if ValidBound("declared") {
+		t.Error("an unknown bound is in the set")
+	}
+}
diff --git a/internal/registry/registry.go b/internal/registry/registry.go
index dcc9d52b..ee203d9c 100644
--- a/internal/registry/registry.go
+++ b/internal/registry/registry.go
@@ -80,6 +80,15 @@ type Model struct {
 	// empty word a client would read as an answer.
 	PipelineTag string   `json:"pipeline_tag,omitempty"`
 	Tags        []string `json:"tags,omitempty"`
+	// Measured is what the context probe found for this model on this Mac,
+	// or nil while nothing has been measured. It is a fact about these files
+	// on this machine: a re-download's Put carries none, so the figure goes
+	// with the files it described (itd-2609091301112705).
+	Measured *Measurement `json:"measured,omitempty"`
+	// ProbeIncomplete says a probe of this model was interrupted — the
+	// switch went off, Gropius quit, the Mac slept — and wrote no figure, so
+	// the next start reports it rather than silently retrying.
+	ProbeIncomplete bool `json:"probe_incomplete,omitempty"`
 }
 
 // MaxTags and MaxTagBytes bound the category. A repo's tags are typed by its
@@ -285,6 +294,12 @@ func Open(path string) (*Registry, error) {
 		// carry an unbounded tag list straight to the LAN with no download in
 		// between. Bound words read back exactly as words from the Hub are.
 		m = sanitizeCategory(m)
+		// And the measurement, which is published on the models list and
+		// offered for adoption as the served window: cleared, not repaired,
+		// when any part of it is outside what the probe could have written.
+		if m.Measured != nil && !plausibleMeasurement(m.Measured) {
+			m.Measured = nil
+		}
 		r.models[key(m.RepoID)] = m
 	}
 	return r, nil
diff --git a/internal/runtime/footprint_test.go b/internal/runtime/footprint_test.go
new file mode 100644
index 00000000..e15baca9
--- /dev/null
+++ b/internal/runtime/footprint_test.go
@@ -0,0 +1,35 @@
+package runtime
+
+import (
+	"os/exec"
+	"testing"
+)
+
+// The one production reader: a live process reports a footprint, a dead
+// one reports none, and top's figure parses with its suffixes.
+func TestExecProcessReportsAFootprintWhileAliveAndNoneAfter(t *testing.T) {
+	cmd := exec.Command("/bin/sleep", "30")
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	p := &execProcess{cmd: cmd, done: make(chan struct{})}
+	if got := p.Footprint(); got <= 0 {
+		t.Errorf("a live process reports %d", got)
+	}
+	_ = cmd.Process.Kill()
+	_ = cmd.Wait()
+	close(p.done)
+	if got := p.Footprint(); got != 0 {
+		t.Errorf("a dead process reports %d", got)
+	}
+}
+
+func TestParseTopMem(t *testing.T) {
+	for in, want := range map[string]int64{
+		"\nMEM  \n1728K\n": 1728 << 10, "MEM\n2560M+": 2560 << 20, "MEM\n3G-": 3 << 30, "MEM\n512B": 512, "": 0, "MEM\n": 0, "x\nnonsense": 0,
+	} {
+		if got := parseTopMem(in); got != want {
+			t.Errorf("parseTopMem(%q) = %d, want %d", in, got, want)
+		}
+	}
+}
diff --git a/internal/runtime/launcher.go b/internal/runtime/launcher.go
index 0983247a..c5f7d10a 100644
--- a/internal/runtime/launcher.go
+++ b/internal/runtime/launcher.go
@@ -9,6 +9,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 	"syscall"
 	"time"
@@ -361,7 +362,75 @@ type execProcess struct {
 }
 
 func (p *execProcess) Done() <-chan struct{} { return p.done }
-func (p *execProcess) Pid() int              { return p.cmd.Process.Pid }
+
+// Footprint reads the server's memory footprint the way Activity Monitor and
+// top report it — the physical footprint, which is what the 2026-09-06
+// campaign sampled and what a unified-memory Mac actually spends — through
+// top itself, since no unprivileged pure-Go reader of that figure exists. A
+// launched server runs under this account, so the listing can see it. Zero
+// when the process is gone or the listing fails or stalls.
+func (p *execProcess) Footprint() int64 {
+	if p.cmd == nil || p.cmd.Process == nil {
+		return 0
+	}
+	// A process that has gone is not read: its pid may already be somebody
+	// else's, and the listing is not scoped to this account.
+	select {
+	case <-p.done:
+		return 0
+	default:
+	}
+	// Bounded: the sampler runs off the pool's lock but the pool's close
+	// waits for it, and a process listing on a Mac under memory pressure can
+	// stall. A listing that does not answer in time is no reading.
+	ctx, cancel := context.WithTimeout(context.Background(), footprintTimeout)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, "/usr/bin/top", "-l", "1", "-stats", "mem", "-pid", strconv.Itoa(p.cmd.Process.Pid)).Output()
+	if err != nil {
+		return 0
+	}
+	select {
+	case <-p.done:
+		return 0
+	default:
+	}
+	return parseTopMem(string(out))
+}
+
+// parseTopMem reads the last figure top printed: a count with a K, M or G
+// suffix, sometimes followed by a + or - that marks a change since the last
+// sample. Zero when there is no such line.
+func parseTopMem(out string) int64 {
+	lines := strings.Split(strings.TrimSpace(out), "\n")
+	if len(lines) == 0 {
+		return 0
+	}
+	field := strings.TrimRight(strings.TrimSpace(lines[len(lines)-1]), "+-")
+	if field == "" {
+		return 0
+	}
+	unit := int64(1)
+	switch field[len(field)-1] {
+	case 'K':
+		unit, field = 1<<10, field[:len(field)-1]
+	case 'M':
+		unit, field = 1<<20, field[:len(field)-1]
+	case 'G':
+		unit, field = 1<<30, field[:len(field)-1]
+	case 'B':
+		field = field[:len(field)-1]
+	}
+	n, err := strconv.ParseInt(field, 10, 64)
+	if err != nil || n <= 0 {
+		return 0
+	}
+	return n * unit
+}
+
+// footprintTimeout bounds one process listing.
+const footprintTimeout = 3 * time.Second
+
+func (p *execProcess) Pid() int { return p.cmd.Process.Pid }
 
 func (p *execProcess) Err() error {
 	p.mu.Lock()
diff --git a/internal/runtime/observer.go b/internal/runtime/observer.go
index a6c73ba9..214265ad 100644
--- a/internal/runtime/observer.go
+++ b/internal/runtime/observer.go
@@ -1,6 +1,10 @@
 package runtime
 
-import "time"
+import (
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/config"
+)
 
 // PoolObserver is told what the pool does with a model server: when one is
 // loaded, how long that took, and when one leaves and why.
@@ -18,14 +22,31 @@ type PoolObserver interface {
 	// LoadStarted is called when a model server process has been started and
 	// the pool begins waiting for it to answer.
 	LoadStarted(repoID string)
-	// LoadFinished is called when that wait ends, with how long it took and
-	// the error if the model never became ready.
-	LoadFinished(repoID string, took time.Duration, err error)
+	// LoadFinished is called when that wait ends, with how long it took, the
+	// error if the model never became ready, and the sampling values the
+	// server was launched with (itd-2609091712141073) — carried here rather
+	// than on LoadStarted because reports are delivered on their own
+	// goroutines and may arrive out of order.
+	LoadFinished(repoID string, took time.Duration, err error, sampling config.Sampling)
 	// EntryStopped is called when a model server leaves the pool, with the
 	// reason it left.
 	EntryStopped(repoID string, reason StopReason)
 }
 
+// FootprintObserver is told each reading of a running model server's memory
+// footprint, when the pool samples them (PoolOptions.FootprintInterval). It
+// is a second, optional interface rather than a fourth method on
+// PoolObserver so that an observer that does not care is not made to say so.
+type FootprintObserver interface {
+	FootprintSampled(repoID string, bytes int64)
+}
+
+// Footprinter is a Process that can report its own resident memory. It is
+// optional: a process that cannot is simply never sampled.
+type Footprinter interface {
+	Footprint() int64
+}
+
 // StopReason says why a model server left the pool. The pool removes an entry
 // by seven paths and only one of them is an eviction, so counting them as one
 // would make the load and eviction figures disagree with what happened.
diff --git a/internal/runtime/observer_test.go b/internal/runtime/observer_test.go
index 273bc143..0c22cbcd 100644
--- a/internal/runtime/observer_test.go
+++ b/internal/runtime/observer_test.go
@@ -3,6 +3,7 @@ package runtime
 import (
 	"context"
 	"errors"
+	"github.com/intentdriven/Gropius/internal/config"
 	"sync"
 	"testing"
 	"time"
@@ -12,11 +13,18 @@ import (
 // small type rather than a channel: the pool reports off its own lock and off
 // the caller's goroutine, so a test has to wait for a report rather than
 // expect it to have happened by the time Acquire returned.
+type footprintReport struct {
+	model string
+	bytes int64
+}
+
 type recordingObserver struct {
-	mu       sync.Mutex
-	starts   []string
-	finishes []loadReport
-	stops    []stopReport
+	mu         sync.Mutex
+	starts     []string
+	finishes   []loadReport
+	stops      []stopReport
+	footprints []footprintReport
+	samplings  []config.Sampling
 	// block, when set, is waited on inside every callback, standing in for an
 	// observer that has gone slow.
 	block chan struct{}
@@ -46,13 +54,28 @@ func (o *recordingObserver) LoadStarted(model string) {
 	o.starts = append(o.starts, model)
 }
 
-func (o *recordingObserver) LoadFinished(model string, took time.Duration, err error) {
+func (o *recordingObserver) LoadFinished(model string, took time.Duration, err error, sampling config.Sampling) {
+	o.mu.Lock()
+	o.samplings = append(o.samplings, sampling)
+	o.mu.Unlock()
 	o.wait()
 	o.mu.Lock()
 	defer o.mu.Unlock()
 	o.finishes = append(o.finishes, loadReport{model: model, took: took, failed: err != nil})
 }
 
+func (o *recordingObserver) FootprintSampled(model string, bytes int64) {
+	o.mu.Lock()
+	o.footprints = append(o.footprints, footprintReport{model, bytes})
+	o.mu.Unlock()
+}
+
+func (o *recordingObserver) sampled() []footprintReport {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	return append([]footprintReport(nil), o.footprints...)
+}
+
 func (o *recordingObserver) EntryStopped(model string, reason StopReason) {
 	o.wait()
 	o.mu.Lock()
@@ -375,6 +398,90 @@ func TestASlowOrPanickingObserverDoesNotStallTheAcquire(t *testing.T) {
 
 type panickingObserver struct{}
 
-func (panickingObserver) LoadStarted(string)                        { panic("observer panic") }
-func (panickingObserver) LoadFinished(string, time.Duration, error) { panic("observer panic") }
-func (panickingObserver) EntryStopped(string, StopReason)           { panic("observer panic") }
+func (panickingObserver) LoadStarted(string) { panic("observer panic") }
+func (panickingObserver) LoadFinished(string, time.Duration, error, config.Sampling) {
+	panic("observer panic")
+}
+func (panickingObserver) EntryStopped(string, StopReason) { panic("observer panic") }
+
+// The sampler reads each ready server's footprint at the interval, reports
+// it to an observer that listens, and keeps the newest on the pool for a
+// caller to stitch onto a completing request.
+func TestTheSamplerReportsEachServersFootprint(t *testing.T) {
+	l := newFakeLauncher()
+	src := &fakeSource{models: map[string]int64{"org/a": 100}}
+	l.footprint = 7 << 30
+	obs := &recordingObserver{}
+	p := newTestPool(t, l, src, PoolOptions{MaxResidentBytes: 1 << 30, Observer: obs, FootprintInterval: 5 * time.Millisecond})
+	_, release, err := p.Acquire(context.Background(), "org/a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	release()
+	deadline := time.Now().Add(2 * time.Second)
+	for len(obs.sampled()) == 0 && time.Now().Before(deadline) {
+		time.Sleep(2 * time.Millisecond)
+	}
+	got := obs.sampled()
+	if len(got) == 0 || got[0].model != "org/a" || got[0].bytes != 7<<30 {
+		t.Fatalf("sampled = %+v, want org/a at 7 GiB", got)
+	}
+	if p.Footprint("org/a") != 7<<30 {
+		t.Errorf("Footprint = %d, want the newest sample", p.Footprint("org/a"))
+	}
+	if p.Footprint("org/none") != 0 {
+		t.Error("a model that is not resident has a footprint")
+	}
+}
+
+// The load report carries the sampling the server was launched with, from
+// the pool's own SamplingFor, so the recorder need not stitch two reports.
+func TestALoadEventCarriesTheLaunchSampling(t *testing.T) {
+	l := newFakeLauncher()
+	src := &fakeSource{models: map[string]int64{"org/a": 100}}
+	obs := &recordingObserver{}
+	temp := 0.7
+	p := newTestPool(t, l, src, PoolOptions{MaxResidentBytes: 1 << 30, Observer: obs,
+		SamplingFor: func(string) config.Sampling { return config.Sampling{Temperature: &temp} }})
+	_, release, err := p.Acquire(context.Background(), "org/a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	release()
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		obs.mu.Lock()
+		n := len(obs.samplings)
+		obs.mu.Unlock()
+		if n > 0 {
+			break
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	obs.mu.Lock()
+	defer obs.mu.Unlock()
+	if len(obs.samplings) == 0 || obs.samplings[0].Temperature == nil || *obs.samplings[0].Temperature != 0.7 {
+		t.Errorf("the load report carried %+v, want the launch sampling", obs.samplings)
+	}
+}
+
+// A request's acquire stats say how many the model already had when it took
+// its slot.
+func TestAcquireReportsTheInFlightCountAtAdmission(t *testing.T) {
+	l := newFakeLauncher()
+	src := &fakeSource{models: map[string]int64{"org/a": 100}}
+	p := newTestPool(t, l, src, PoolOptions{MaxResidentBytes: 1 << 30, DecodeConcurrency: 4})
+	first, release1, err := p.Acquire(context.Background(), "org/a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, release2, err := p.Acquire(context.Background(), "org/a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.Waits.InFlight != 0 || second.Waits.InFlight != 1 {
+		t.Errorf("in flight at admission: first %d, second %d; want 0 and 1", first.Waits.InFlight, second.Waits.InFlight)
+	}
+	release1()
+	release2()
+}
diff --git a/internal/runtime/pool.go b/internal/runtime/pool.go
index 3b92726a..e53af617 100644
--- a/internal/runtime/pool.go
+++ b/internal/runtime/pool.go
@@ -71,6 +71,10 @@ type Upstream struct {
 // model that was already loaded. A request that found its model warm and free
 // pays neither.
 type AcquireStats struct {
+	// InFlight is how many requests the model already had when this one
+	// took its slot — the count at admission, for the request record
+	// (itd-2609091712141073).
+	InFlight  int
 	LoadWait  time.Duration
 	QueueWait time.Duration
 }
@@ -202,6 +206,10 @@ type PoolOptions struct {
 	// leaves the pool. Nil (the default) means nobody is watching and every
 	// report is a no-op; see PoolObserver for what the pool promises it.
 	Observer PoolObserver
+	// FootprintInterval is how often each running server's memory is read
+	// and reported to an Observer that is also a FootprintObserver; zero
+	// means DefaultFootprintInterval, negative means never.
+	FootprintInterval time.Duration
 
 	// DrainWait is how long the pool waits for a stopped model server to exit
 	// before it stops counting on that memory coming back: past it a load is
@@ -276,6 +284,12 @@ type Pool struct {
 	waiters []*loadWaiter
 
 	stopIdle chan struct{}
+	// stopSample and sampleDone are the footprint sampler's, as stopIdle and
+	// idleDone are the reaper's.
+	stopSample chan struct{}
+	sampleDone chan struct{}
+	// refusals counts the curable no-room refusals; see Residency.Refusals.
+	refusals uint64
 	idleDone chan struct{}
 }
 
@@ -301,6 +315,11 @@ type entry struct {
 	loadedAt time.Time
 	lastUsed time.Time
 	inFlight int
+	// footprint is the newest sampled resident memory of this server, or 0.
+	footprint int64
+	// sampling is what the server was launched with, carried on the load
+	// report so the recorder need not stitch two reports together.
+	sampling config.Sampling
 
 	// sem bounds how many requests run against this one model server at once. Its
 	// capacity is a small multiple of the server's --decode-concurrency: mlx-lm
@@ -448,8 +467,11 @@ func NewPool(opts PoolOptions) *Pool {
 		stuck:       map[uint64]stuckServer{},
 		stopIdle:    make(chan struct{}),
 		idleDone:    make(chan struct{}),
+		stopSample:  make(chan struct{}),
+		sampleDone:  make(chan struct{}),
 	}
 	go p.reapIdle()
+	go p.sampleFootprints()
 	return p
 }
 
@@ -769,6 +791,13 @@ func (p *Pool) acquire(ctx context.Context, repoID string, mayWait bool) (*Upstr
 		if verdict != waitYes {
 			queued := len(p.waiters)
 			p.leaveQueueLocked(w)
+			// Counted for Residency.Refusals: a refusal for want of room that
+			// an eviction could have cured. A model that can never fit is
+			// not counted, since nothing anyone gives up would seat it.
+			if noRoom := (*NoRoomError)(nil); errors.As(err, &noRoom) &&
+				verdict != waitNeverFits && p.canEverFitLocked(noRoom.need) {
+				p.refusals++
+			}
 			p.mu.Unlock()
 			// Logged out here, not where the refusal is built: p.mu is the
 			// pool's one lock — every Acquire, Resident, Pinned and Unload
@@ -873,7 +902,9 @@ func (p *Pool) acquire(ctx context.Context, repoID string, mayWait bool) (*Upstr
 			repoID, e.inFlight, ErrBusy)
 	}
 	// Pin it *before* releasing the lock, so a concurrent Acquire for another
-	// model cannot evict this one while we are waiting for it to load.
+	// model cannot evict this one while we are waiting for it to load. What
+	// the model already had is the count at admission, for the record.
+	already := e.inFlight
 	e.inFlight++
 	e.lastUsed = p.opts.now()
 	ready := e.ready
@@ -949,6 +980,7 @@ func (p *Pool) acquire(ctx context.Context, repoID string, mayWait bool) (*Upstr
 		BaseURL:  fmt.Sprintf("http://127.0.0.1:%d", e.port),
 		ModelArg: e.modelArg,
 		Waits: AcquireStats{
+			InFlight: already,
 			LoadWait: loaded.Sub(entered),
 			// The wait for room is a queue wait, not a load wait: nothing was
 			// loading, the machine was full. Reporting it as a load wait would
@@ -1146,6 +1178,7 @@ func (p *Pool) startLocked(repoID string, waited time.Duration, adm admission, c
 		return nil, fmt.Errorf("start model server for %s: %w", repoID, &LaunchError{Err: err})
 	}
 	e.proc = proc
+	e.sampling = sampling
 	p.entries[config.FoldRepoID(repoID)] = e
 	p.notify(func(o PoolObserver) { o.LoadStarted(repoID) })
 
@@ -1162,7 +1195,7 @@ func (p *Pool) waitReady(e *entry) {
 	started := p.opts.now()
 	err := p.probeReady(ctx, e)
 	took := p.opts.now().Sub(started)
-	p.notify(func(o PoolObserver) { o.LoadFinished(e.repoID, took, err) })
+	p.notify(func(o PoolObserver) { o.LoadFinished(e.repoID, took, err, e.sampling) })
 
 	p.mu.Lock()
 	e.readyErr = err
@@ -1844,6 +1877,15 @@ type Residency struct {
 	// StuckServers is how many of those did not exit even after SIGKILL. Their
 	// memory is held until this process restarts.
 	StuckServers int
+	// Refusals is how many loads the pool has refused for want of room since
+	// it started that an eviction could have cured: the queue-full and the
+	// nothing-could-be-freed refusals, never the never-fits fast path, since
+	// nothing anyone gives up would seat a model larger than the budget. It
+	// only ever grows, and it is what a holder of a model that wants to give
+	// way to a client watches: with eviction grace off a refused client waits
+	// in no queue and appears in no residency, so the count moving is the
+	// only sign it was there (internal/selftest).
+	Refusals uint64
 }
 
 // Residency reports the models in memory and the memory not yet handed back.
@@ -1858,6 +1900,7 @@ func (p *Pool) Residency() Residency {
 		Models:       p.residentLocked(),
 		ExitingBytes: p.drainBytes + p.stuckChargeLocked(),
 		StuckServers: len(p.stuck),
+		Refusals:     p.refusals,
 	}
 }
 
@@ -1935,6 +1978,75 @@ func (p *Pool) residentLocked() []Resident {
 	return out
 }
 
+// DefaultFootprintInterval is how often the pool reads each running model
+// server's memory: often enough to draw a line over an afternoon, rare enough
+// that a ps per server is nothing.
+const DefaultFootprintInterval = 30 * time.Second
+
+// sampleFootprints reads every running server's resident memory at the
+// interval and reports each reading, keeping the newest on the entry for
+// Footprint. A process that cannot report one is skipped.
+func (p *Pool) sampleFootprints() {
+	defer close(p.sampleDone)
+	interval := p.opts.FootprintInterval
+	if interval == 0 {
+		interval = DefaultFootprintInterval
+	}
+	if interval < 0 {
+		<-p.stopSample
+		return
+	}
+	tick := time.NewTicker(interval)
+	defer tick.Stop()
+	for {
+		select {
+		case <-p.stopSample:
+			return
+		case <-tick.C:
+			type target struct {
+				repoID string
+				proc   Footprinter
+			}
+			var targets []target
+			p.mu.Lock()
+			for _, e := range p.entries {
+				if f, ok := e.proc.(Footprinter); ok && isReady(e) {
+					targets = append(targets, target{e.repoID, f})
+				}
+			}
+			p.mu.Unlock()
+			// Read off the lock: a reading runs a process listing.
+			for _, t := range targets {
+				bytes := t.proc.Footprint()
+				if bytes <= 0 {
+					continue
+				}
+				p.mu.Lock()
+				if e, ok := p.entries[config.FoldRepoID(t.repoID)]; ok {
+					e.footprint = bytes
+				}
+				p.mu.Unlock()
+				p.notify(func(o PoolObserver) {
+					if fo, ok := o.(FootprintObserver); ok {
+						fo.FootprintSampled(t.repoID, bytes)
+					}
+				})
+			}
+		}
+	}
+}
+
+// Footprint is the newest sampled resident memory of the model's server, or
+// 0 when it is not resident or nothing has been sampled yet.
+func (p *Pool) Footprint(repoID string) int64 {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if e, ok := p.entries[config.FoldRepoID(repoID)]; ok {
+		return e.footprint
+	}
+	return 0
+}
+
 // reapIdle unloads models that have gone untouched for IdleTimeout.
 func (p *Pool) reapIdle() {
 	defer close(p.idleDone)
@@ -2001,6 +2113,7 @@ func (p *Pool) Close() error {
 	}
 
 	close(p.stopIdle)
+	close(p.stopSample)
 	<-p.idleDone
 
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
@@ -2018,6 +2131,11 @@ func (p *Pool) Close() error {
 		}(proc)
 	}
 	wg.Wait()
+	// The sampler last: a reading is a process listing with a deadline of its
+	// own, and the servers must not wait on it to be told to go. Its write
+	// after the listing is guarded by an entries lookup, and entries is empty
+	// by now.
+	<-p.sampleDone
 	return nil
 }
 
diff --git a/internal/runtime/pool_test.go b/internal/runtime/pool_test.go
index 9ce8be6e..28b8395c 100644
--- a/internal/runtime/pool_test.go
+++ b/internal/runtime/pool_test.go
@@ -60,8 +60,13 @@ type fakeProc struct {
 	// exit() ends it.
 	holdExit bool
 	err      error
+	// footprint is what Footprint reports; zero means the process cannot
+	// report one, as a process without the optional interface would.
+	footprint int64
 }
 
+func (p *fakeProc) Footprint() int64 { return p.footprint }
+
 func (p *fakeProc) Done() <-chan struct{} { return p.done }
 func (p *fakeProc) Err() error            { return p.err }
 func (p *fakeProc) Pid() int              { return 4242 }
@@ -94,6 +99,10 @@ type fakeLauncher struct {
 	// until the test says so, which is what a real server does for the length
 	// of its SIGTERM grace: out of the pool, still holding its memory.
 	holdExitFor string
+	// footprint is what every launched process reports as its resident
+	// memory; zero means none can, as a process without the optional
+	// interface would.
+	footprint int64
 	// loadDelayFor overrides loadDelay for one model, so a test can have one
 	// model never become ready while the others load at once.
 	loadDelayFor map[string]time.Duration
@@ -155,6 +164,8 @@ func (l *fakeLauncher) Launch(ctx context.Context, spec Spec) (Process, error) {
 	// cheat by rewriting the pool's expected port to the httptest port via a
 	// custom HTTP client in the tests below.
 	p := &fakeProc{
+		footprint: l.footprint,
+
 		srv:      srv,
 		done:     make(chan struct{}),
 		stopped:  make(chan struct{}),
diff --git a/internal/runtime/provision.go b/internal/runtime/provision.go
index 0ff8743f..e916585c 100644
--- a/internal/runtime/provision.go
+++ b/internal/runtime/provision.go
@@ -492,3 +492,8 @@ func tail(s string, n int) string {
 // ProbeTimeout is how long the readiness probe waits for a freshly spawned
 // model server before giving up on the whole load.
 const ProbeTimeout = 10 * time.Minute
+
+// MLXLMVersion is the pinned mlx-lm version this build provisions and runs.
+// A measurement taken under it is a measurement of it as much as of the
+// model, which is why the context probe records it (internal/registry).
+func MLXLMVersion() string { return mlxLMVersion }
diff --git a/internal/runtime/selftest_refusals_test.go b/internal/runtime/selftest_refusals_test.go
new file mode 100644
index 00000000..550340e1
--- /dev/null
+++ b/internal/runtime/selftest_refusals_test.go
@@ -0,0 +1,53 @@
+package runtime
+
+import (
+	"context"
+	"testing"
+)
+
+// Residency.Refusals is the sign a holder watches for a client it cannot
+// otherwise see (internal/selftest): it counts a refusal an eviction could
+// have cured, and not one that nothing given up would seat.
+func TestResidencyCountsTheRefusalsAnEvictionCouldHaveCured(t *testing.T) {
+	l := newFakeLauncher()
+	// LoadCost is 1.2x, so 100 bytes costs 120: a 150-byte budget holds one.
+	src := &fakeSource{models: map[string]int64{"org/a": 100, "org/b": 100}}
+	p := newTestPool(t, l, src, PoolOptions{MaxResidentBytes: 150})
+
+	if n := p.Residency().Refusals; n != 0 {
+		t.Fatalf("a fresh pool has %d refusals", n)
+	}
+	_, release, err := p.Acquire(context.Background(), "org/a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// org/a is in flight, so nothing can be evicted for org/b: refused, and
+	// curable — releasing org/a would seat it.
+	if _, _, err := p.Acquire(context.Background(), "org/b"); err == nil {
+		t.Fatal("org/b loaded beside a held org/a on a budget that holds one")
+	}
+	if n := p.Residency().Refusals; n != 1 {
+		t.Errorf("Refusals = %d after a curable refusal, want 1", n)
+	}
+	release()
+}
+
+func TestResidencyDoesNotCountARefusalNothingCouldCure(t *testing.T) {
+	l := newFakeLauncher()
+	src := &fakeSource{models: map[string]int64{"org/a": 100, "org/b": 100}}
+	p := newTestPool(t, l, src, PoolOptions{MaxResidentBytes: 150, Pinned: []string{"org/a"}})
+
+	_, release, err := p.Acquire(context.Background(), "org/a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	release()
+	// The pinned model plus org/b is over the budget however long anyone
+	// waits: the never-fits refusal, which yielding cannot help.
+	if _, _, err := p.Acquire(context.Background(), "org/b"); err == nil {
+		t.Fatal("org/b loaded beside a pinned org/a on a budget that holds one")
+	}
+	if n := p.Residency().Refusals; n != 0 {
+		t.Errorf("Refusals = %d after a never-fits refusal, want 0: nothing given up would seat it", n)
+	}
+}
diff --git a/internal/selftest/request.go b/internal/selftest/request.go
new file mode 100644
index 00000000..4e2a765a
--- /dev/null
+++ b/internal/selftest/request.go
@@ -0,0 +1,238 @@
+package selftest
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// This file is the self-test's one reader and writer of a conversation, and
+// it is on internal/archtest's allow-list for both sides of that boundary
+// (prompt_content_test.go). It builds requests from the two constants below
+// and reads nothing from a client: a self-test run is a conversation Gropius
+// has with its own model server, and the only thing kept from the answer is
+// when its first chunk arrived and how many chunks there were.
+
+// The standard set. The names follow llama-bench — pp for prompt processing,
+// tg for text generation, the number being the token count — so a figure here
+// can be set beside a published one.
+const (
+	TestPP512 = "pp512"
+	TestTG128 = "tg128"
+	// TestTG128Parallel is tg128 sent Concurrency() times at once; the name
+	// carries the count, e.g. "tg128x4".
+	TestTG128Parallel = "tg128x"
+)
+
+// generationPrompt is what tg128 asks. It is short, so the answer is what is
+// measured, and it asks for prose so the model does not stop early.
+const generationPrompt = "Write a long story about a lighthouse keeper who finds a message in a bottle."
+
+// promptSentence is repeated to make the pp512 prompt. Ordinary English at
+// about four characters a token, so the prompt lands near 512 tokens on most
+// tokenizers; the count the model server reports is what the result carries,
+// never the target.
+const promptSentence = "The lighthouse keeper climbed the spiral stairs every evening to light the lamp before the fishing boats came home. "
+
+// promptProcessingChars is the length pp512's prompt is built to.
+const promptProcessingChars = 512 * 4
+
+// testSpec is one test of the set.
+type testSpec struct {
+	Name      string
+	Prompt    string
+	MaxTokens int
+	Parallel  int
+}
+
+// standardSet is the tests every model gets, in the order they run. The
+// concurrent test is only worth running when there is concurrency to measure.
+func standardSet(concurrency int) []testSpec {
+	set := []testSpec{
+		{Name: TestPP512, Prompt: promptProcessingPrompt(), MaxTokens: 1},
+		{Name: TestTG128, Prompt: generationPrompt, MaxTokens: 128},
+	}
+	if concurrency > 1 {
+		set = append(set, testSpec{
+			Name: fmt.Sprintf("%s%d", TestTG128Parallel, concurrency), Prompt: generationPrompt, MaxTokens: 128, Parallel: concurrency,
+		})
+	}
+	return set
+}
+
+func promptProcessingPrompt() string {
+	var b strings.Builder
+	for b.Len() < promptProcessingChars {
+		b.WriteString(promptSentence)
+	}
+	return b.String()
+}
+
+// measurement is what one request cost and how long it took.
+type measurement struct {
+	PromptTokens, CompletionTokens int
+	FirstToken, Total              time.Duration
+	// Counted says where the token counts came from: the model server's own
+	// usage event, or — when it sent none — the number of chunks, which on
+	// mlx-lm is one a token. A reader comparing two results should know.
+	Counted string
+}
+
+// test turns a measurement into the recorded shape.
+func (m measurement) test(name string, parallel int) Test {
+	t := Test{
+		Name:             name,
+		Parallel:         parallel,
+		PromptTokens:     m.PromptTokens,
+		CompletionTokens: m.CompletionTokens,
+		FirstTokenMs:     m.FirstToken.Milliseconds(),
+		TotalMs:          m.Total.Milliseconds(),
+		Counted:          m.Counted,
+	}
+	if m.FirstToken > 0 {
+		t.PromptTokensPerSec = round1(float64(m.PromptTokens) / m.FirstToken.Seconds())
+	}
+	if gen := m.Total - m.FirstToken; gen > 0 && m.CompletionTokens > 1 {
+		// The first token is paid for by the prefill, so it is the tokens after
+		// it, over the time after it, that is the generation rate.
+		t.TokensPerSec = round1(float64(m.CompletionTokens-1) / gen.Seconds())
+	}
+	return t
+}
+
+// aggregate folds the parallel test's measurements into one: the counts add
+// up, the first-token figure is the mean, and the rate is every token the
+// batch produced over the batch's wall time — what the machine delivered,
+// which is the figure the concurrency setting is sized from.
+func aggregate(name string, ms []measurement, wall time.Duration) Test {
+	t := Test{Name: name, Parallel: len(ms), TotalMs: wall.Milliseconds()}
+	var first time.Duration
+	for _, m := range ms {
+		t.PromptTokens += m.PromptTokens
+		t.CompletionTokens += m.CompletionTokens
+		first += m.FirstToken
+		if t.Counted == "" || m.Counted == CountedChunks {
+			t.Counted = m.Counted
+		}
+	}
+	t.FirstTokenMs = (first / time.Duration(len(ms))).Milliseconds()
+	if wall > 0 {
+		t.TokensPerSec = round1(float64(t.CompletionTokens) / wall.Seconds())
+	}
+	return t
+}
+
+func round1(f float64) float64 { return float64(int64(f*10+0.5)) / 10 }
+
+// measure sends one streaming request and times it.
+func (r *Runner) measure(ctx context.Context, up Upstream, spec testSpec) (measurement, error) {
+	ctx, cancel := context.WithTimeout(ctx, r.opts.RequestTimeout)
+	defer cancel()
+
+	body, err := json.Marshal(map[string]any{
+		"model":       up.ModelArg,
+		"messages":    []map[string]string{{"role": "user", "content": spec.Prompt}},
+		"max_tokens":  spec.MaxTokens,
+		"temperature": 0,
+		"stream":      true,
+		// The key is always written: a stream_options object without it
+		// raises inside mlx-lm (internal/mlxtest).
+		"stream_options": map[string]bool{"include_usage": true},
+	})
+	if err != nil {
+		return measurement{}, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, up.BaseURL+"/v1/chat/completions", bytes.NewReader(body))
+	if err != nil {
+		return measurement{}, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	started := time.Now()
+	resp, err := r.opts.Client.Do(req)
+	if err != nil {
+		return measurement{}, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		// The status is the whole of what is kept: the body is the model
+		// server's and may say anything.
+		return measurement{}, fmt.Errorf("model server answered %d", resp.StatusCode)
+	}
+	m, err := readStream(resp.Body, started)
+	if err != nil {
+		return measurement{}, err
+	}
+	return m, nil
+}
+
+// streamEvent is the part of a streamed chunk the self-test reads: whether it
+// carries a piece of the answer, and the counts. What the piece says is never
+// kept.
+type streamEvent struct {
+	Choices []struct {
+		Delta struct {
+			Content string `json:"content"`
+		} `json:"delta"`
+	} `json:"choices"`
+	Usage *struct {
+		PromptTokens     int `json:"prompt_tokens"`
+		CompletionTokens int `json:"completion_tokens"`
+	} `json:"usage"`
+}
+
+// readStream reads an SSE body to its end, timing the first chunk that
+// carries text and counting the chunks, and takes the counts from the usage
+// event when the server sends one.
+func readStream(body io.Reader, started time.Time) (measurement, error) {
+	var (
+		m      measurement
+		chunks int
+		done   bool
+	)
+	sc := bufio.NewScanner(body)
+	sc.Buffer(make([]byte, 0, 64<<10), 1<<20)
+	for sc.Scan() {
+		line := sc.Bytes()
+		if !bytes.HasPrefix(line, []byte("data:")) {
+			continue
+		}
+		data := bytes.TrimSpace(line[len("data:"):])
+		if bytes.Equal(data, []byte("[DONE]")) {
+			done = true
+			break
+		}
+		var ev streamEvent
+		if err := json.Unmarshal(data, &ev); err != nil {
+			continue
+		}
+		if len(ev.Choices) > 0 && ev.Choices[0].Delta.Content != "" {
+			chunks++
+			if m.FirstToken == 0 {
+				m.FirstToken = time.Since(started)
+			}
+		}
+		if ev.Usage != nil {
+			m.PromptTokens, m.CompletionTokens = ev.Usage.PromptTokens, ev.Usage.CompletionTokens
+			m.Counted = CountedUsage
+		}
+	}
+	if err := sc.Err(); err != nil {
+		return measurement{}, err
+	}
+	if !done {
+		return measurement{}, errors.New("the stream ended without [DONE]")
+	}
+	m.Total = time.Since(started)
+	if m.Counted == "" {
+		m.CompletionTokens, m.Counted = chunks, CountedChunks
+	}
+	return m, nil
+}
diff --git a/internal/selftest/results.go b/internal/selftest/results.go
new file mode 100644
index 00000000..9692416e
--- /dev/null
+++ b/internal/selftest/results.go
@@ -0,0 +1,257 @@
+package selftest
+
+import (
+	"bufio"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"sync"
+	"syscall"
+)
+
+// A results file is JSON Lines, one Run a line, appended to until it would
+// pass its cap and then started again: a single bounded file, no rotation.
+// The repository already has two size-rotating writers (internal/stats and
+// internal/applog) and iss-2609091714393599 is about there being two; this
+// is deliberately not a third. Thousands of runs fit under the default cap,
+// which is more days of a model-a-day cycle than a result stays interesting.
+const (
+	// DefaultMaxBytes is the cap on the results file.
+	DefaultMaxBytes int64 = 4 << 20
+	// FileName is the results file's name under config.Paths.SelfTest.
+	FileName = "results.jsonl"
+)
+
+// KindRun is the only kind of line the file holds today; the field is there
+// so a second kind can be added without every reader guessing.
+const KindRun = "run"
+
+// The outcomes a run can have.
+const (
+	// OutcomeOK is every test in the set completed.
+	OutcomeOK = "ok"
+	// OutcomeYielded is a run abandoned because a real request arrived.
+	OutcomeYielded = "yielded"
+	// OutcomeStopped is a run abandoned because the switch went off.
+	OutcomeStopped = "stopped"
+	// OutcomeFailed is a run that could not load its model or whose request
+	// failed; Reason says which.
+	OutcomeFailed = "failed"
+)
+
+// The reasons a failed run carries. A class, not the error's text: the error
+// is the model server's or the pool's and may name a path.
+const (
+	ReasonLoad    = "load"
+	ReasonRequest = "request"
+)
+
+// Where a test's token counts came from.
+const (
+	CountedUsage  = "usage"
+	CountedChunks = "chunks"
+)
+
+// Run is one line of the file: one model, measured once.
+type Run struct {
+	Kind  string `json:"kind"`
+	Model string `json:"model"`
+	// At is when the run started, Unix seconds UTC.
+	At      int64  `json:"at"`
+	Outcome string `json:"outcome"`
+	Reason  string `json:"reason,omitempty"`
+	// ColdLoad says the model was not resident when the run started, so
+	// LoadMs is a load from disk and the run unloaded it afterwards.
+	ColdLoad bool `json:"cold_load"`
+	// LoadMs is how long Acquire took: the load, or nothing much when the
+	// model was already there.
+	LoadMs int64 `json:"load_ms"`
+	// Tests are the tests that completed, in the order they ran. A yielded or
+	// failed run carries the ones that finished before it stopped.
+	Tests []Test `json:"tests"`
+}
+
+// Test is one test's figures.
+type Test struct {
+	Name string `json:"name"`
+	// Parallel is how many requests were sent at once; 1 for the single
+	// tests.
+	Parallel int `json:"parallel"`
+	// PromptTokens and CompletionTokens are the model server's own counts,
+	// summed across a parallel test.
+	PromptTokens     int `json:"prompt_tokens"`
+	CompletionTokens int `json:"completion_tokens"`
+	// FirstTokenMs is how long the first piece of the answer took; the mean
+	// across a parallel test.
+	FirstTokenMs int64 `json:"first_token_ms"`
+	// TotalMs is how long the whole request took; the wall time of a
+	// parallel test.
+	TotalMs int64 `json:"total_ms"`
+	// PromptTokensPerSec is the prompt's tokens over the time to the first
+	// token: how fast the model read. Zero for a parallel test.
+	PromptTokensPerSec float64 `json:"prompt_tokens_per_sec"`
+	// TokensPerSec is the generation rate: tokens after the first over the
+	// time after it, or for a parallel test every token the batch produced
+	// over its wall time.
+	TokensPerSec float64 `json:"tokens_per_sec"`
+	// Counted says where the counts came from: "usage" for the server's own
+	// event, "chunks" when it sent none and the chunks were counted instead.
+	Counted string `json:"counted"`
+}
+
+// RunFields and TestFields are the JSON names of the two records, for the
+// docs test that holds the reference page to them.
+func RunFields() []string  { return jsonFields(Run{}) }
+func TestFields() []string { return jsonFields(Test{}) }
+
+func jsonFields(v any) []string {
+	t := reflect.TypeOf(v)
+	out := make([]string, 0, t.NumField())
+	for i := 0; i < t.NumField(); i++ {
+		name, _, _ := strings.Cut(t.Field(i).Tag.Get("json"), ",")
+		out = append(out, name)
+	}
+	return out
+}
+
+// file is the bounded writer.
+type file struct {
+	path     string
+	maxBytes int64
+	log      *slog.Logger
+	mu       sync.Mutex
+}
+
+// filePerm is the mode the file carries: this account's own, like the log and
+// the statistics store. Its directory is created 0700 for the same reason.
+const filePerm os.FileMode = 0o600
+
+// The opens never follow a link and never block: on a shared Mac the
+// directory's parent is this account's own, but a planted link or a FIFO in
+// the wrong place must be refused rather than followed or waited on — the
+// writer runs on the settings path, and a hang there is a hang of every
+// save (the same reasoning as internal/stats and internal/applog).
+const (
+	fileFlags = os.O_CREATE | os.O_WRONLY | os.O_APPEND | syscall.O_NOFOLLOW | syscall.O_NONBLOCK
+	readFlags = os.O_RDONLY | syscall.O_NOFOLLOW | syscall.O_NONBLOCK
+)
+
+// write appends one run, starting the file again first if the line would
+// take it past the cap. A write that fails is logged and dropped: a result
+// is not worth stopping the loop for, and the next run will try again.
+func (f *file) write(run Run) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	line, err := json.Marshal(run)
+	if err != nil {
+		f.log.Warn("self-test: could not encode a result", "err", err)
+		return
+	}
+	line = append(line, '\n')
+	if err := ensureDir(filepath.Dir(f.path)); err != nil {
+		f.log.Warn("self-test: the results directory is not safe to write; the result is dropped")
+		f.log.Debug("self-test: results directory refused", "err", err)
+		return
+	}
+	h, err := openRegular(f.path, fileFlags, filePerm)
+	if err != nil {
+		f.log.Warn("self-test: could not open the results file; the result is dropped")
+		f.log.Debug("self-test: results file refused", "err", err)
+		return
+	}
+	defer h.Close()
+	if st, err := h.Stat(); err == nil && st.Size()+int64(len(line)) > f.maxBytes {
+		if err := h.Truncate(0); err != nil {
+			f.log.Warn("self-test: could not start the results file again", "err", err)
+			return
+		}
+		f.log.Info("self-test: the results file reached its cap and was started again", "cap_bytes", f.maxBytes)
+	}
+	if _, err := h.Write(line); err != nil {
+		f.log.Warn("self-test: could not write a result", "err", err)
+	}
+}
+
+// ReadResults reads every run in a results file, oldest first. A file that
+// does not exist is no runs; a line that does not decode is skipped, since
+// the file is started again at its cap and a reader that refused the whole
+// file over one line would show nothing.
+func ReadResults(path string) ([]Run, error) {
+	h, err := openRegular(path, readFlags, 0)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer h.Close()
+	var runs []Run
+	sc := bufio.NewScanner(h)
+	sc.Buffer(make([]byte, 0, 64<<10), 1<<20)
+	for sc.Scan() {
+		var run Run
+		if err := json.Unmarshal(sc.Bytes(), &run); err != nil || run.Kind != KindRun {
+			continue
+		}
+		runs = append(runs, run)
+	}
+	if err := sc.Err(); err != nil {
+		return runs, fmt.Errorf("read %s: %w", path, err)
+	}
+	return runs, nil
+}
+
+// ensureDir creates the results directory, closed, or checks the one that is
+// there: a directory this account owns, that nobody else can write, reached
+// without following a link. Its parent is the account's own directory —
+// created 0700 under a shared install, and the account-owned root elsewhere
+// — so a single Mkdir is enough and nothing above it is walked: what keeps
+// the parent honest is its ownership, not its mode.
+func ensureDir(dir string) error {
+	err := os.Mkdir(dir, 0o700)
+	if err != nil && !errors.Is(err, os.ErrExist) {
+		return err
+	}
+	st, err := os.Lstat(dir)
+	if err != nil {
+		return err
+	}
+	if st.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("%s is a symbolic link", dir)
+	}
+	if !st.IsDir() {
+		return fmt.Errorf("%s is not a directory", dir)
+	}
+	if st.Mode().Perm()&0o022 != 0 {
+		return fmt.Errorf("%s is writable by other accounts", dir)
+	}
+	if sys, ok := st.Sys().(*syscall.Stat_t); ok && int(sys.Uid) != os.Getuid() {
+		return fmt.Errorf("%s is owned by another account", dir)
+	}
+	return nil
+}
+
+// openRegular opens a path and refuses anything but a regular file: a FIFO
+// opened non-blocking answers at once, and a device or a socket answers with
+// something that is not a file of ours.
+func openRegular(path string, flags int, perm os.FileMode) (*os.File, error) {
+	h, err := os.OpenFile(path, flags, perm)
+	if err != nil {
+		return nil, err
+	}
+	st, err := h.Stat()
+	if err != nil {
+		h.Close()
+		return nil, err
+	}
+	if !st.Mode().IsRegular() {
+		h.Close()
+		return nil, fmt.Errorf("%s is not a regular file", path)
+	}
+	return h, nil
+}
diff --git a/internal/selftest/selftest.go b/internal/selftest/selftest.go
new file mode 100644
index 00000000..697286b2
--- /dev/null
+++ b/internal/selftest/selftest.go
@@ -0,0 +1,757 @@
+// Package selftest measures Gropius's own models while nobody is using them.
+//
+// When the operator switches it on (config.Config.SelfTest), a loop wakes
+// once a minute and asks whether the Mac is idle: no request in flight on any
+// model, nobody waiting for a load, no download running, and the last request
+// older than a quiet period. When it is, the loop picks the ready model that
+// was tested longest ago — never one tested within the last day — acquires it
+// through the pool's ordinary path, runs the same short set of tests against
+// it, appends one line of figures to a file, and unloads the model if the
+// self-test was what brought it in. Then it goes back to sleep.
+//
+// The set is llama-bench's pair plus what the pool can tell: how long the load
+// took, how fast a long prompt is read (pp512), how fast tokens come out
+// (tg128), and what that becomes when the decode concurrency's worth of
+// requests arrive at once. The figures are the ones the 2026-09-06 model-bench
+// campaign decided the memory budget and the served window from, measured on
+// this Mac rather than on somebody else's (itd-2609100457007827).
+//
+// A real request always wins. The pool has no preemption, so the self-test
+// yields by watching the pool while a request of its own is in flight and
+// cancelling that request the moment anyone else's appears; the run is
+// recorded as yielded and the model is released. Nothing in a result is a
+// prompt or an answer: the prompts are the constants in request.go, and the
+// file holds counts and durations (adr-2609061503319212).
+package selftest
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/config"
+)
+
+// Server is what the self-test needs from the app: the models it may test,
+// the pool's ordinary way of loading one, the pool's view of what is going on,
+// and a way to unload what the self-test itself loaded.
+//
+// It is an interface rather than the App so the loop can be tested against a
+// fake pool with a fake model server behind it, and so that the package
+// imports nothing that imports it back.
+type Server interface {
+	// Ready lists the models that can be loaded, by repo id.
+	Ready() []string
+	// Acquire loads the model if it is not resident and holds it until the
+	// release function is called, exactly as a request does.
+	Acquire(ctx context.Context, repoID string) (Upstream, func(), error)
+	// Activity is what the pool is doing right now.
+	Activity() Activity
+	// Unload stops a model server. The pool refuses one that is serving.
+	Unload(repoID string) error
+	// Concurrency is the decode concurrency each model server runs with,
+	// which is how many requests the concurrent test sends at once.
+	Concurrency() int
+	// Fits reports whether the model can be loaded beside what is resident
+	// without evicting anything. The self-test never evicts: a Mac whose
+	// working model stays warm all day would otherwise find it gone, and
+	// pay a cold load, once a day per model the self-test measured.
+	Fits(repoID string) bool
+}
+
+// Upstream is a ready model server: where it answers, and the exact string
+// its "model" field must carry (runtime.Upstream.ModelArg).
+type Upstream struct {
+	BaseURL  string
+	ModelArg string
+}
+
+// Activity is the pool's view of the moment: what is resident and how busy
+// each model is, how many loads are waiting for room, and how many downloads
+// are running.
+type Activity struct {
+	Models      []ModelActivity
+	Waiting     int
+	Downloading int
+	// Refusals is how many loads the pool has refused for want of room, ever
+	// (runtime.Pool.Refusals). With eviction grace off a client refused room
+	// waits nowhere the self-test can see, so the count moving during a run
+	// is what says a client wanted the memory the run is holding.
+	Refusals uint64
+}
+
+// ModelActivity is one resident model's share of that view.
+type ModelActivity struct {
+	RepoID   string
+	InFlight int
+	LastUsed time.Time
+}
+
+// Job is a second kind of run the loop schedules at idle, beside the
+// self-test's own: the context probe is one (internal/contextprobe). The loop
+// owns idleness, yielding and the never-evict rule for every job, so there is
+// one idea of "idle" on the Mac rather than one per feature.
+type Job interface {
+	// Name is the kind of run, for the log and the panel.
+	Name() string
+	// Due returns the model the job wants to run on next, given the ready
+	// models, or "" when it wants nothing.
+	Due(ready []string, now time.Time) string
+	// Run performs one run on the model. It returns when done, or when the
+	// session's context is cancelled: by a client arriving (Yielded reports
+	// true) or by the switch going off.
+	Run(s *Session, model string)
+	// Parks reports whether the job's own loads may wait in the pool's
+	// queue for room. A job that never parks — one that loads only when the
+	// room is already free — lets the loop read the waiter count as a client
+	// unconditionally, since none of the waiters can be its own.
+	Parks() bool
+}
+
+// Session is what the loop hands a job for one run.
+type Session struct {
+	// Ctx is cancelled the moment a client appears or the loop stops.
+	Ctx context.Context
+	// Hold tells the loop how many in-flight requests on the model are the
+	// job's own right now, so they are not mistaken for a client's. A job
+	// that drives the model through the gateway holds one while a request is
+	// in flight and none between requests.
+	Hold func(n int)
+	// Yielded reports whether Ctx was cancelled because a client appeared,
+	// as opposed to the switch going off.
+	Yielded func() bool
+	// Report sets the words the panel shows for the run in progress.
+	Report func(step string)
+	// Fits reports whether the model can be loaded now without evicting
+	// anything; a job that reloads between steps asks before each one.
+	Fits func(model string) bool
+}
+
+// Status is what the loop is doing, for the panel.
+type Status struct {
+	// Job and Model name the run in progress; Step is the job's own words
+	// for where it is. All empty when nothing is running.
+	Job   string `json:"job,omitempty"`
+	Model string `json:"model,omitempty"`
+	Step  string `json:"step,omitempty"`
+	// HeldBy names what kept a due run from starting at the last tick:
+	// "in_flight", "waiting", "downloading" or "recent"; empty when nothing
+	// did, or nothing was due. Due names the model that run would be on.
+	HeldBy string `json:"held_by,omitempty"`
+	Due    string `json:"due,omitempty"`
+}
+
+// What HeldBy can say.
+const (
+	HeldByInFlight    = "in_flight"
+	HeldByWaiting     = "waiting"
+	HeldByDownloading = "downloading"
+	HeldByRecent      = "recent"
+)
+
+// The cadence, and the bounds a run is held to.
+const (
+	// DefaultTick is how often the loop asks whether the Mac is idle.
+	DefaultTick = time.Minute
+	// DefaultQuiet is how long the last request must be in the past before
+	// the Mac counts as idle.
+	DefaultQuiet = 5 * time.Minute
+	// DefaultRetest is how long a model's result stands before it is measured
+	// again.
+	DefaultRetest = 24 * time.Hour
+	// DefaultPoll is how often a run in progress looks for a real request.
+	DefaultPoll = 250 * time.Millisecond
+	// DefaultRequestTimeout bounds one load and one request each, so a model
+	// server that never answers cannot wedge the loop. It is the pool's own
+	// readiness bound (runtime.ProbeTimeout).
+	DefaultRequestTimeout = 10 * time.Minute
+)
+
+// Options configures a Runner. Only Server and Path are required; every
+// duration left zero takes its default above.
+type Options struct {
+	Server Server
+	// Path is the results file (config.Paths.SelfTest). Its directory is
+	// created, closed, on the first write.
+	Path string
+	Log  *slog.Logger
+
+	Tick, Quiet, Retest, Poll, RequestTimeout time.Duration
+	// MaxBytes is the results file's cap; zero means DefaultMaxBytes.
+	MaxBytes int64
+	// Jobs are the other kinds of run the loop schedules, asked in order at
+	// every idle tick before the self-test's own set; the first that is due
+	// runs. A job that runs whether or not the self-test switch is on — the
+	// probe's "Measure now" — is why the loop runs while the switch is off,
+	// asking the jobs only.
+	Jobs []Job
+	// SelfTest is the self-test's own switch; the loop itself runs whenever
+	// a job might want it. Nil means on.
+	SelfTest func() bool
+	// Client sends the test requests. Nil means a plain client; the timeout
+	// is applied per request through its context.
+	Client *http.Client
+	// Now is the clock; nil means time.Now. It is what a result's "at" carries
+	// and what the quiet and re-test windows are measured against, so a test
+	// can place a result in the past without waiting.
+	Now func() time.Time
+}
+
+// Runner is the loop. It does nothing until SetEnabled(true), and one Runner
+// serves the life of the process: the switch turns the loop on and off.
+type Runner struct {
+	opts Options
+
+	// switchMu serialises SetEnabled end to end, so an off that is draining a
+	// run and an on that arrives meanwhile cannot leave two loops running.
+	switchMu sync.Mutex
+
+	mu     sync.Mutex
+	cancel context.CancelFunc
+	done   chan struct{}
+	// tested is when each model (folded id) was last measured, seeded from the
+	// results file when the loop starts so a restart does not measure
+	// everything again.
+	tested map[string]time.Time
+	// touched is when the loop last released each model. The pool stamps a
+	// model's last use at release, so without this the self-test's own run
+	// would look like a client's for the whole quiet period afterwards.
+	touched map[string]time.Time
+	file    *file
+	// status is what the panel reads; see Status.
+	status Status
+}
+
+// New builds a Runner. It opens nothing and starts nothing.
+func New(opts Options) *Runner {
+	if opts.Log == nil {
+		opts.Log = slog.Default()
+	}
+	if opts.Tick <= 0 {
+		opts.Tick = DefaultTick
+	}
+	if opts.Quiet <= 0 {
+		opts.Quiet = DefaultQuiet
+	}
+	if opts.Retest <= 0 {
+		opts.Retest = DefaultRetest
+	}
+	if opts.Poll <= 0 {
+		opts.Poll = DefaultPoll
+	}
+	if opts.RequestTimeout <= 0 {
+		opts.RequestTimeout = DefaultRequestTimeout
+	}
+	if opts.MaxBytes <= 0 {
+		opts.MaxBytes = DefaultMaxBytes
+	}
+	if opts.Client == nil {
+		// No redirects: the one place a request may go is the model server
+		// the pool named (adr-2609061503319212).
+		opts.Client = &http.Client{
+			CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse },
+		}
+	}
+	if opts.Now == nil {
+		opts.Now = time.Now
+	}
+	return &Runner{
+		opts:    opts,
+		tested:  map[string]time.Time{},
+		touched: map[string]time.Time{},
+		file:    &file{path: opts.Path, maxBytes: opts.MaxBytes, log: opts.Log},
+	}
+}
+
+// SetEnabled turns the loop on or off. Off cancels a run in progress — the
+// model is released and the run recorded as stopped — and returns once the
+// loop has stopped. On while already on, and off while already off, do
+// nothing.
+func (r *Runner) SetEnabled(on bool) {
+	r.switchMu.Lock()
+	defer r.switchMu.Unlock()
+	r.mu.Lock()
+	if on == (r.cancel != nil) {
+		r.mu.Unlock()
+		return
+	}
+	if !on {
+		cancel, done := r.cancel, r.done
+		r.cancel, r.done = nil, nil
+		r.mu.Unlock()
+		cancel()
+		<-done
+		return
+	}
+	r.seedLocked()
+	ctx, cancel := context.WithCancel(context.Background())
+	r.cancel = cancel
+	r.done = make(chan struct{})
+	go r.loop(ctx, r.done)
+	r.mu.Unlock()
+}
+
+// Enabled reports whether the loop is on.
+func (r *Runner) Enabled() bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.cancel != nil
+}
+
+// Close is SetEnabled(false) for the end of the process.
+func (r *Runner) Close() { r.SetEnabled(false) }
+
+// SetQuiet changes the idle threshold in force, so a saved setting applies
+// to the next tick rather than the next start.
+func (r *Runner) SetQuiet(d time.Duration) {
+	if d <= 0 {
+		return
+	}
+	r.mu.Lock()
+	r.opts.Quiet = d
+	r.mu.Unlock()
+}
+
+// Status reports what the loop is doing.
+func (r *Runner) Status() Status {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.status
+}
+
+func (r *Runner) setStatus(f func(*Status)) {
+	r.mu.Lock()
+	f(&r.status)
+	r.mu.Unlock()
+}
+
+// seedLocked reads when each model was last measured from the results file,
+// so that a restart does not start the cycle over. Callers hold r.mu.
+func (r *Runner) seedLocked() {
+	runs, err := ReadResults(r.opts.Path)
+	if err != nil {
+		// The error names the path; the path is for the detailed level.
+		r.opts.Log.Warn("self-test: could not read earlier results; every model counts as untested")
+		r.opts.Log.Debug("self-test: could not read earlier results", "err", err)
+		return
+	}
+	for _, run := range runs {
+		// A stopped run is the switch's or the process's doing, not the
+		// model's: it does not use up the model's day.
+		if run.Outcome == OutcomeStopped {
+			continue
+		}
+		at := time.Unix(run.At, 0)
+		key := config.FoldRepoID(run.Model)
+		if at.After(r.tested[key]) {
+			r.tested[key] = at
+		}
+	}
+}
+
+func (r *Runner) loop(ctx context.Context, done chan struct{}) {
+	defer close(done)
+	tick := time.NewTicker(r.opts.Tick)
+	defer tick.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-tick.C:
+			// Both channels can be ready at once, and select picks at random:
+			// a tick after the switch went off must not start a run with a
+			// context that is already dead.
+			if ctx.Err() != nil {
+				return
+			}
+			r.tick(ctx)
+		}
+	}
+}
+
+// tick is one wake-up: is the Mac idle, is there a model due, and if both,
+// one run.
+func (r *Runner) tick(ctx context.Context) {
+	now := r.opts.Now()
+	ready := r.opts.Server.Ready()
+	act := r.opts.Server.Activity()
+	// What is due, before asking whether the Mac is idle, so that a due run
+	// held back can say what held it.
+	var job Job
+	model := ""
+	for _, j := range r.opts.Jobs {
+		if m := j.Due(ready, now); m != "" && r.opts.Server.Fits(m) {
+			job, model = j, m
+			break
+		}
+	}
+	if job == nil && (r.opts.SelfTest == nil || r.opts.SelfTest()) {
+		model = r.next(now)
+	}
+	if model == "" {
+		r.setStatus(func(st *Status) { st.HeldBy, st.Due = "", "" })
+		return
+	}
+	if held := r.heldBy(act, now); held != "" {
+		r.setStatus(func(st *Status) { st.HeldBy, st.Due = held, model })
+		return
+	}
+	r.setStatus(func(st *Status) { st.HeldBy, st.Due = "", "" })
+	if job != nil {
+		r.runJob(ctx, job, model)
+		return
+	}
+	r.run(ctx, model, resident(act, model))
+}
+
+// heldBy names what keeps a due run from starting, or "" when the Mac is
+// idle. It is quiet's answer with its reason.
+func (r *Runner) heldBy(act Activity, now time.Time) string {
+	if act.Waiting > 0 {
+		return HeldByWaiting
+	}
+	if act.Downloading > 0 {
+		return HeldByDownloading
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	for _, m := range act.Models {
+		if m.InFlight > 0 {
+			return HeldByInFlight
+		}
+		if m.LastUsed.IsZero() || now.Sub(m.LastUsed) >= r.opts.Quiet {
+			continue
+		}
+		if own, ok := r.touched[config.FoldRepoID(m.RepoID)]; ok && !m.LastUsed.After(own) {
+			continue
+		}
+		return HeldByRecent
+	}
+	return ""
+}
+
+// quiet reports whether the Mac is idle enough to start a run: nothing in
+// flight, nothing waiting, nothing downloading, and the last request older
+// than the quiet period. A model never used counts as long idle, and a last
+// use that is the self-test's own release is not a request.
+func (r *Runner) quiet(act Activity, now time.Time) bool { return r.heldBy(act, now) == "" }
+
+// hold is what the loop itself has taken from the pool right now: the model,
+// how many acquisitions it holds on it (one for the single tests, the decode
+// concurrency's worth for the parallel one, so that the pool's own semaphore
+// bounds the batch and a client arriving on the model waits in it, visibly),
+// and how many refusals the pool had made when the run began.
+type hold struct {
+	model    string
+	count    int
+	refusals uint64
+	// parks says the holder's own load may be among the pool's waiters; see
+	// Job.Parks.
+	parks bool
+}
+
+// busy reports whether anyone but the self-test wants the pool: a request in
+// flight the loop is not holding itself, a load waiting for room, or a load
+// refused room since the run began.
+//
+// While the loop's own Acquire is still parked, h.count is 0 and the waiter
+// the pool counts may be the self-test's own, so waiters are not read then: a
+// client that arrives during the load shows up as a request in flight on its
+// model, or as a refusal, or is parked behind the self-test's load and cannot
+// be told from the self-test's own place in that queue.
+func busy(act Activity, h hold) bool {
+	if act.Refusals > h.refusals {
+		return true
+	}
+	// A waiter is a client unless it might be the holder's own parked load,
+	// which is only possible for a job that parks and only while its load is
+	// in progress (count == 0).
+	if act.Waiting > 0 && (!h.parks || h.count > 0) {
+		return true
+	}
+	held := config.FoldRepoID(h.model)
+	for _, m := range act.Models {
+		inFlight := m.InFlight
+		if h.count > 0 && config.FoldRepoID(m.RepoID) == held {
+			inFlight -= h.count
+		}
+		if inFlight > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func resident(act Activity, repoID string) bool {
+	key := config.FoldRepoID(repoID)
+	for _, m := range act.Models {
+		if config.FoldRepoID(m.RepoID) == key {
+			return true
+		}
+	}
+	return false
+}
+
+// next is the ready model measured longest ago, or "" when every ready model
+// has a result younger than the re-test window. A model with no result at
+// all comes first.
+func (r *Runner) next(now time.Time) string {
+	ready := r.opts.Server.Ready()
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	var due []string
+	for _, id := range ready {
+		if at, ok := r.tested[config.FoldRepoID(id)]; ok && now.Sub(at) < r.opts.Retest {
+			continue
+		}
+		// A model that would need something evicted is left for a tick when
+		// there is room; it stays due, and is not charged a day.
+		if !r.opts.Server.Fits(id) {
+			continue
+		}
+		due = append(due, id)
+	}
+	sort.SliceStable(due, func(i, j int) bool {
+		return r.tested[config.FoldRepoID(due[i])].Before(r.tested[config.FoldRepoID(due[j])])
+	})
+	if len(due) == 0 {
+		return ""
+	}
+	return due[0]
+}
+
+// run measures one model and writes the result. wasResident says whether the
+// model was in memory before the run, which decides whether the run unloads
+// it afterwards: the self-test leaves residency as it found it.
+func (r *Runner) run(ctx context.Context, model string, wasResident bool) {
+	now := r.opts.Now()
+	key := config.FoldRepoID(model)
+	res := Run{Kind: KindRun, Model: model, At: now.Unix(), ColdLoad: !wasResident}
+	defer func() {
+		// A stopped run does not use up the model's day; see seedLocked.
+		if res.Outcome != OutcomeStopped {
+			r.mu.Lock()
+			r.tested[key] = now
+			r.mu.Unlock()
+		}
+		r.file.write(res)
+		r.opts.Log.Info("self-test run", "model", model, "outcome", res.Outcome, "tests", len(res.Tests))
+	}()
+
+	// The watcher cancels the run's context the moment a real request
+	// appears — during the load as much as during a test, since a cold load
+	// is the longest thing a run does and the pool tears down an abandoned
+	// load on cancel. yielded says that is what happened, as opposed to the
+	// switch going off or a request failing on its own. holding is "" until
+	// Acquire returns; see busy for why the watcher needs to know.
+	// The self-test's own Acquire may park for room, so it is a parking job.
+	w := r.startWatch(ctx, model, true)
+	runCtx := w.ctx
+	setHold := w.setHold
+	r.setStatus(func(st *Status) { st.Job, st.Model, st.Step = "self-test", model, "" })
+	defer r.setStatus(func(st *Status) { st.Job, st.Model, st.Step = "", "", "" })
+	// ended stops the watcher and names the outcome of a run cut short.
+	ended := func() {
+		w.stop()
+		switch {
+		case w.didYield():
+			res.Outcome, res.Reason = OutcomeYielded, ""
+		case ctx.Err() != nil:
+			res.Outcome, res.Reason = OutcomeStopped, ""
+		}
+	}
+
+	loadCtx, cancelLoad := context.WithTimeout(runCtx, r.opts.RequestTimeout)
+	defer cancelLoad()
+	started := time.Now()
+	up, release, err := r.opts.Server.Acquire(loadCtx, model)
+	if err != nil {
+		res.Outcome, res.Reason = OutcomeFailed, ReasonLoad
+		ended()
+		return
+	}
+	res.LoadMs = time.Since(started).Milliseconds()
+	setHold(1)
+	defer func() {
+		release()
+		r.mu.Lock()
+		r.touched[key] = time.Now()
+		r.mu.Unlock()
+		// A model the self-test brought in goes back out — unless a client
+		// has arrived, in which case the client's request decides what stays
+		// resident, and an unload that then finds the model busy or already
+		// evicted is the designed outcome rather than a warning.
+		if wasResident || res.Outcome == OutcomeYielded {
+			return
+		}
+		if err := r.opts.Server.Unload(model); err != nil {
+			r.opts.Log.Debug("self-test: could not unload the model it loaded", "model", model, "err", err)
+		}
+	}()
+
+	res.Outcome = OutcomeOK
+	for _, spec := range standardSet(r.opts.Server.Concurrency()) {
+		// The parallel test takes the rest of its requests' places in the
+		// pool before it sends them, so the model server never decodes more
+		// than the pool allows and a client arriving meanwhile queues in the
+		// pool, where the watcher sees it, rather than beside the batch.
+		extra, releaseExtra, err := r.holdMore(runCtx, model, spec.Parallel-1)
+		if err != nil {
+			releaseExtra()
+			res.Outcome, res.Reason = OutcomeFailed, ReasonLoad
+			ended()
+			return
+		}
+		setHold(1 + extra)
+		t, err := r.runTest(runCtx, up, spec)
+		releaseExtra()
+		setHold(1)
+		if err != nil {
+			res.Outcome, res.Reason = OutcomeFailed, ReasonRequest
+			ended()
+			return
+		}
+		res.Tests = append(res.Tests, t)
+		r.setStatus(func(st *Status) { st.Step = spec.Name + " done" })
+	}
+	w.stop()
+}
+
+// holdMore acquires n further places on a resident model and returns how
+// many it holds and a function that releases them all; n of zero or less
+// holds nothing.
+func (r *Runner) holdMore(ctx context.Context, model string, n int) (int, func(), error) {
+	var releases []func()
+	releaseAll := func() {
+		for _, rel := range releases {
+			rel()
+		}
+	}
+	for i := 0; i < n; i++ {
+		_, rel, err := r.opts.Server.Acquire(ctx, model)
+		if err != nil {
+			return len(releases), releaseAll, err
+		}
+		releases = append(releases, rel)
+	}
+	return len(releases), releaseAll, nil
+}
+
+// watch is the loop's eye on the pool for one run: it cancels the run's
+// context the moment a client appears, and knows the difference between that
+// and the switch going off.
+type watch struct {
+	ctx     context.Context
+	cancel  context.CancelFunc
+	done    chan struct{}
+	mu      sync.Mutex
+	held    hold
+	yielded bool
+}
+
+// startWatch begins watching for a client on behalf of a run on model. The
+// caller stops it with stop, which returns once the watcher is gone.
+func (r *Runner) startWatch(ctx context.Context, model string, parks bool) *watch {
+	runCtx, cancel := context.WithCancel(ctx)
+	w := &watch{ctx: runCtx, cancel: cancel, done: make(chan struct{}),
+		held: hold{model: model, refusals: r.opts.Server.Activity().Refusals, parks: parks}}
+	go func() {
+		defer close(w.done)
+		poll := time.NewTicker(r.opts.Poll)
+		defer poll.Stop()
+		for {
+			select {
+			case <-runCtx.Done():
+				return
+			case <-poll.C:
+				w.mu.Lock()
+				h := w.held
+				w.mu.Unlock()
+				if busy(r.opts.Server.Activity(), h) {
+					w.mu.Lock()
+					w.yielded = true
+					w.mu.Unlock()
+					cancel()
+					return
+				}
+			}
+		}
+	}()
+	return w
+}
+
+func (w *watch) setHold(n int) {
+	w.mu.Lock()
+	w.held.count = n
+	w.mu.Unlock()
+}
+
+func (w *watch) didYield() bool {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.yielded
+}
+
+func (w *watch) stop() {
+	w.cancel()
+	<-w.done
+}
+
+// runJob gives a job one run on a model under the loop's watch.
+func (r *Runner) runJob(ctx context.Context, job Job, model string) {
+	w := r.startWatch(ctx, model, job.Parks())
+	r.setStatus(func(st *Status) { st.Job, st.Model, st.Step = job.Name(), model, "" })
+	defer func() {
+		w.stop()
+		r.mu.Lock()
+		r.touched[config.FoldRepoID(model)] = time.Now()
+		r.mu.Unlock()
+		r.setStatus(func(st *Status) { st.Job, st.Model, st.Step = "", "", "" })
+	}()
+	job.Run(&Session{
+		Ctx:     w.ctx,
+		Hold:    w.setHold,
+		Yielded: w.didYield,
+		Report:  func(step string) { r.setStatus(func(st *Status) { st.Step = step }) },
+		Fits:    r.opts.Server.Fits,
+	}, model)
+}
+
+// runTest runs one test of the set: one request, or spec.Parallel of them
+// at once, against the upstream.
+func (r *Runner) runTest(ctx context.Context, up Upstream, spec testSpec) (Test, error) {
+	if spec.Parallel <= 1 {
+		m, err := r.measure(ctx, up, spec)
+		if err != nil {
+			return Test{}, err
+		}
+		return m.test(spec.Name, 1), nil
+	}
+	// One request failing cancels its siblings: the figure is the batch's,
+	// and a batch with a hole in it is not worth finishing.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	results := make([]measurement, spec.Parallel)
+	errs := make([]error, spec.Parallel)
+	var wg sync.WaitGroup
+	wall := time.Now()
+	for i := range results {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			results[i], errs[i] = r.measure(ctx, up, spec)
+			if errs[i] != nil {
+				cancel()
+			}
+		}(i)
+	}
+	wg.Wait()
+	if err := errors.Join(errs...); err != nil {
+		return Test{}, err
+	}
+	return aggregate(spec.Name, results, time.Since(wall)), nil
+}
diff --git a/internal/selftest/selftest_test.go b/internal/selftest/selftest_test.go
new file mode 100644
index 00000000..465f910c
--- /dev/null
+++ b/internal/selftest/selftest_test.go
@@ -0,0 +1,804 @@
+package selftest
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/Gropius/internal/config"
+	"github.com/intentdriven/Gropius/internal/mlxtest"
+)
+
+// fakeServer is a pool with fake model servers behind it. A model is resident
+// once acquired until unloaded; every acquisition is one in-flight request
+// until released, as in the real pool.
+type fakeServer struct {
+	t     *testing.T
+	fakes map[string]*mlxtest.Server
+
+	mu          sync.Mutex
+	ready       []string
+	resident    map[string]bool
+	inFlight    map[string]int
+	lastUsed    map[string]time.Time
+	waiting     int
+	downloading int
+	// foreign is an in-flight request the self-test is not holding, on the
+	// model named, standing in for a client's.
+	foreign     string
+	acquired    []string
+	unloaded    []string
+	concurrency int
+	failLoad    string
+	now         func() time.Time
+	// acquireDelay is how long a load takes, outside the lock and cancellable,
+	// as the pool's is.
+	acquireDelay time.Duration
+	// noFit names models that would need an eviction to load.
+	noFit map[string]bool
+	// refusals is the pool's count of loads refused for want of room.
+	refusals uint64
+	// maxInFlight is the most acquisitions held on any model at once.
+	maxInFlight int
+}
+
+func newFakeServer(t *testing.T, models ...string) *fakeServer {
+	t.Helper()
+	s := &fakeServer{
+		t:           t,
+		fakes:       map[string]*mlxtest.Server{},
+		ready:       models,
+		resident:    map[string]bool{},
+		inFlight:    map[string]int{},
+		lastUsed:    map[string]time.Time{},
+		concurrency: 2,
+		now:         time.Now,
+		noFit:       map[string]bool{},
+	}
+	for _, m := range models {
+		fake := mlxtest.Start(mlxtest.Options{ModelArg: "/models/" + m, Reply: "one two three four five six"})
+		t.Cleanup(fake.Close)
+		s.fakes[m] = fake
+	}
+	return s
+}
+
+func (s *fakeServer) Ready() []string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]string(nil), s.ready...)
+}
+
+func (s *fakeServer) Acquire(ctx context.Context, id string) (Upstream, func(), error) {
+	s.mu.Lock()
+	// acquired records loads — a model brought in — not every hold: the
+	// parallel test takes further holds on a model already resident.
+	if !s.resident[id] {
+		s.acquired = append(s.acquired, id)
+	}
+	if id == s.failLoad {
+		s.mu.Unlock()
+		return Upstream{}, nil, errors.New("simulated launch failure")
+	}
+	fake, ok := s.fakes[id]
+	if !ok {
+		s.mu.Unlock()
+		return Upstream{}, nil, errors.New("unknown model")
+	}
+	// A loading entry is in flight from the moment the load starts, as the
+	// pool's is, and a cancelled load is torn down.
+	s.resident[id] = true
+	s.inFlight[id]++
+	if s.inFlight[id] > s.maxInFlight {
+		s.maxInFlight = s.inFlight[id]
+	}
+	delay := s.acquireDelay
+	s.mu.Unlock()
+	if delay > 0 {
+		select {
+		case <-time.After(delay):
+		case <-ctx.Done():
+			s.mu.Lock()
+			s.inFlight[id]--
+			delete(s.resident, id)
+			s.mu.Unlock()
+			return Upstream{}, nil, ctx.Err()
+		}
+	}
+	s.mu.Lock()
+	s.lastUsed[id] = s.now()
+	s.mu.Unlock()
+	var once sync.Once
+	release := func() {
+		once.Do(func() {
+			s.mu.Lock()
+			s.inFlight[id]--
+			s.lastUsed[id] = s.now()
+			s.mu.Unlock()
+		})
+	}
+	return Upstream{BaseURL: fake.URL(), ModelArg: fake.ModelArg}, release, nil
+}
+
+func (s *fakeServer) Activity() Activity {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	act := Activity{Waiting: s.waiting, Downloading: s.downloading, Refusals: s.refusals}
+	for id := range s.resident {
+		n := s.inFlight[id]
+		if s.foreign == id {
+			n++
+		}
+		act.Models = append(act.Models, ModelActivity{RepoID: id, InFlight: n, LastUsed: s.lastUsed[id]})
+	}
+	return act
+}
+
+func (s *fakeServer) Unload(id string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.inFlight[id] > 0 {
+		return errors.New("busy")
+	}
+	delete(s.resident, id)
+	s.unloaded = append(s.unloaded, id)
+	return nil
+}
+
+func (s *fakeServer) Concurrency() int { return s.concurrency }
+
+func (s *fakeServer) Fits(id string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return !s.noFit[id]
+}
+
+func (s *fakeServer) snapshot() (acquired, unloaded []string, inFlight map[string]int) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	inFlight = map[string]int{}
+	for k, v := range s.inFlight {
+		inFlight[k] = v
+	}
+	return append([]string(nil), s.acquired...), append([]string(nil), s.unloaded...), inFlight
+}
+
+// fastRunner is a Runner on a test cadence: ticks and polls in milliseconds,
+// a quiet period of nothing, so a test waits on results rather than clocks.
+func fastRunner(t *testing.T, srv Server, dir string) *Runner {
+	t.Helper()
+	r := New(Options{
+		Server: srv,
+		Path:   filepath.Join(dir, FileName),
+		Tick:   5 * time.Millisecond,
+		Poll:   2 * time.Millisecond,
+		Quiet:  time.Nanosecond,
+	})
+	t.Cleanup(r.Close)
+	return r
+}
+
+// waitFor polls until the condition holds or the test's patience runs out.
+func waitFor(t *testing.T, what string, cond func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if cond() {
+			return
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	t.Fatalf("gave up waiting for %s", what)
+}
+
+func runsIn(t *testing.T, r *Runner) []Run {
+	t.Helper()
+	runs, err := ReadResults(r.opts.Path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return runs
+}
+
+// Off is the default, and off is nothing: no model loaded, no file written,
+// no directory created.
+func TestOffLoadsNothingAndWritesNothing(t *testing.T) {
+	srv := newFakeServer(t, "org/a")
+	dir := t.TempDir()
+	r := fastRunner(t, srv, dir)
+	r.SetEnabled(false) // already off: a no-op, not a hang
+	time.Sleep(30 * time.Millisecond)
+	if acquired, _, _ := srv.snapshot(); len(acquired) != 0 {
+		t.Errorf("the self-test loaded %v while off", acquired)
+	}
+	if _, err := os.Stat(filepath.Join(dir, FileName)); !os.IsNotExist(err) {
+		t.Errorf("a results file exists while off (%v)", err)
+	}
+	if r.Enabled() {
+		t.Error("Enabled() while off")
+	}
+}
+
+// On, and idle: every ready model is acquired through the pool, gets the
+// standard set, is written as one line, and is unloaded again because the
+// self-test was what loaded it.
+func TestAnIdleMacGetsEveryModelMeasuredAndLeftAsFound(t *testing.T) {
+	srv := newFakeServer(t, "org/a", "org/b")
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	if !r.Enabled() {
+		t.Fatal("Enabled() is false after SetEnabled(true)")
+	}
+	waitFor(t, "two runs", func() bool { return len(runsIn(t, r)) == 2 })
+
+	acquired, unloaded, inFlight := srv.snapshot()
+	if len(acquired) != 2 || len(unloaded) != 2 {
+		t.Errorf("acquired %v, unloaded %v; want both models once each", acquired, unloaded)
+	}
+	for id, n := range inFlight {
+		if n != 0 {
+			t.Errorf("%s still has %d in flight after its run: the hold was not released", id, n)
+		}
+	}
+	for _, run := range runsIn(t, r) {
+		if run.Outcome != OutcomeOK || run.Kind != KindRun || !run.ColdLoad {
+			t.Errorf("run = %+v; want an ok, cold run", run)
+		}
+		names := []string{}
+		for _, test := range run.Tests {
+			names = append(names, test.Name)
+			if test.Counted != CountedUsage {
+				t.Errorf("%s counted by %q; the fake sends usage", test.Name, test.Counted)
+			}
+			if test.PromptTokens == 0 || test.CompletionTokens == 0 || test.TotalMs < 0 {
+				t.Errorf("%s = %+v; want the server's counts", test.Name, test)
+			}
+		}
+		if got, want := strings.Join(names, ","), "pp512,tg128,tg128x2"; got != want {
+			t.Errorf("tests = %s, want %s", got, want)
+		}
+		if run.Tests[2].Parallel != 2 || run.Tests[2].CompletionTokens != 2*run.Tests[1].CompletionTokens {
+			t.Errorf("the parallel test = %+v; want two requests' counts added up", run.Tests[2])
+		}
+	}
+	// Once every model has a result, the loop is quiet.
+	time.Sleep(30 * time.Millisecond)
+	if acquired, _, _ := srv.snapshot(); len(acquired) != 2 {
+		t.Errorf("acquired %v; a model with a fresh result was measured again", acquired)
+	}
+}
+
+// A model that was in memory before the run stays there afterwards: the
+// self-test leaves residency as it found it.
+func TestAModelThatWasResidentIsLeftResident(t *testing.T) {
+	srv := newFakeServer(t, "org/a")
+	srv.mu.Lock()
+	srv.resident["org/a"] = true
+	srv.mu.Unlock()
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "one run", func() bool { return len(runsIn(t, r)) == 1 })
+	if _, unloaded, _ := srv.snapshot(); len(unloaded) != 0 {
+		t.Errorf("unloaded %v, which was resident before the self-test ran", unloaded)
+	}
+	if run := runsIn(t, r)[0]; run.ColdLoad {
+		t.Error("a resident model was recorded as a cold load")
+	}
+}
+
+// A client's request during a run ends it: the self-test's own request is
+// cancelled, the run is recorded as yielded with what it had, and the model
+// is released for the client.
+func TestAClientRequestYieldsTheRun(t *testing.T) {
+	srv := newFakeServer(t, "org/a", "org/b")
+	// Slow enough that a run is in progress when the client arrives.
+	for _, fake := range srv.fakes {
+		fake.ChunkDelay = 20 * time.Millisecond
+		fake.Reply = strings.Repeat("word ", 50)
+	}
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "a run to start", func() bool { acquired, _, _ := srv.snapshot(); return len(acquired) == 1 })
+	// The client asks for the other model.
+	srv.mu.Lock()
+	srv.foreign = "org/b"
+	srv.resident["org/b"] = true
+	srv.mu.Unlock()
+	arrived := time.Now()
+	waitFor(t, "the yielded run", func() bool { return len(runsIn(t, r)) >= 1 })
+	// The stream would take a second to finish; yielding does not wait for it.
+	if took := time.Since(arrived); took > 500*time.Millisecond {
+		t.Errorf("the run took %v to yield after the client arrived; a real request would have waited that long", took)
+	}
+	run := runsIn(t, r)[0]
+	if run.Outcome != OutcomeYielded {
+		t.Errorf("outcome = %q, want %q", run.Outcome, OutcomeYielded)
+	}
+	if _, _, inFlight := srv.snapshot(); inFlight[run.Model] != 0 {
+		t.Errorf("the self-test still holds %s after yielding", run.Model)
+	}
+	// And it stays out of the way while the client is there.
+	time.Sleep(30 * time.Millisecond)
+	if acquired, _, _ := srv.snapshot(); len(acquired) != 1 {
+		t.Errorf("acquired %v while a client request is in flight", acquired)
+	}
+}
+
+// Nothing starts while the pool is doing anything else: a request in
+// flight, a load waiting for room, a download running, or a request that
+// finished only a moment ago.
+func TestNothingRunsWhileTheMacIsBusy(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		set  func(*fakeServer)
+	}{
+		{"a request in flight", func(s *fakeServer) { s.resident["org/b"] = true; s.foreign = "org/b" }},
+		{"a load waiting", func(s *fakeServer) { s.waiting = 1 }},
+		{"a download running", func(s *fakeServer) { s.downloading = 1 }},
+		{"a recent request", func(s *fakeServer) { s.resident["org/b"] = true; s.lastUsed["org/b"] = time.Now() }},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			srv := newFakeServer(t, "org/a", "org/b")
+			srv.mu.Lock()
+			tt.set(srv)
+			srv.mu.Unlock()
+			r := New(Options{
+				Server: srv, Path: filepath.Join(t.TempDir(), FileName),
+				Tick: 5 * time.Millisecond, Poll: 2 * time.Millisecond, Quiet: time.Hour,
+			})
+			t.Cleanup(r.Close)
+			r.SetEnabled(true)
+			time.Sleep(40 * time.Millisecond)
+			if acquired, _, _ := srv.snapshot(); len(acquired) != 0 {
+				t.Errorf("acquired %v with %s", acquired, tt.name)
+			}
+		})
+	}
+}
+
+// A result stands for the re-test window, and the model measured longest ago
+// goes first. The file is what remembers this across a restart.
+func TestAResultStandsForADayAndTheStalestModelGoesFirst(t *testing.T) {
+	dir := t.TempDir()
+	now := time.Now()
+	earlier := func(d time.Duration) int64 { return now.Add(-d).Unix() }
+	seed := []Run{
+		{Kind: KindRun, Model: "org/a", At: earlier(time.Hour), Outcome: OutcomeOK},
+		{Kind: KindRun, Model: "org/b", At: earlier(30 * time.Hour), Outcome: OutcomeOK},
+		{Kind: KindRun, Model: "org/c", At: earlier(40 * time.Hour), Outcome: OutcomeOK},
+	}
+	f := &file{path: filepath.Join(dir, FileName), maxBytes: DefaultMaxBytes, log: testLogger()}
+	for _, run := range seed {
+		f.write(run)
+	}
+
+	srv := newFakeServer(t, "org/a", "org/b", "org/c")
+	r := New(Options{
+		Server: srv, Path: filepath.Join(dir, FileName),
+		Tick: 5 * time.Millisecond, Poll: 2 * time.Millisecond, Quiet: time.Nanosecond,
+		Retest: 24 * time.Hour, Now: func() time.Time { return now },
+	})
+	t.Cleanup(r.Close)
+	r.SetEnabled(true)
+	waitFor(t, "two new runs", func() bool { return len(runsIn(t, r)) == 5 })
+	acquired, _, _ := srv.snapshot()
+	if got, want := strings.Join(acquired, ","), "org/c,org/b"; got != want {
+		t.Errorf("acquired %s, want %s: stalest first, and not the one measured an hour ago", got, want)
+	}
+}
+
+// The switch going off mid-run cancels the request, releases the model, and
+// records the run as stopped; SetEnabled returns once the loop is gone.
+func TestSwitchingOffStopsARunAndReleasesTheModel(t *testing.T) {
+	srv := newFakeServer(t, "org/a")
+	srv.fakes["org/a"].ChunkDelay = 20 * time.Millisecond
+	srv.fakes["org/a"].Reply = strings.Repeat("word ", 50)
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "a run to start", func() bool { acquired, _, _ := srv.snapshot(); return len(acquired) == 1 })
+	r.SetEnabled(false)
+	if r.Enabled() {
+		t.Fatal("Enabled() after SetEnabled(false)")
+	}
+	runs := runsIn(t, r)
+	if len(runs) != 1 || runs[0].Outcome != OutcomeStopped {
+		t.Fatalf("runs = %+v, want one stopped run", runs)
+	}
+	if _, _, inFlight := srv.snapshot(); inFlight["org/a"] != 0 {
+		t.Error("the model is still held after the switch went off")
+	}
+	// A stopped run is the switch's doing, not the model's: on again, the
+	// model is measured, not skipped for a day.
+	r.SetEnabled(true)
+	waitFor(t, "the run after the stop", func() bool { return len(runsIn(t, r)) == 2 })
+	if runs := runsIn(t, r); runs[1].Outcome != OutcomeOK {
+		t.Errorf("the run after the stop = %+v, want ok", runs[1])
+	}
+}
+
+// A model that cannot load is recorded as failed with a class, not with the
+// error's text, and the loop moves on to the next model.
+func TestALoadThatFailsIsRecordedByClassAndTheLoopMovesOn(t *testing.T) {
+	srv := newFakeServer(t, "org/a", "org/b")
+	srv.failLoad = "org/a"
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "two runs", func() bool { return len(runsIn(t, r)) == 2 })
+	for _, run := range runsIn(t, r) {
+		switch run.Model {
+		case "org/a":
+			if run.Outcome != OutcomeFailed || run.Reason != ReasonLoad {
+				t.Errorf("org/a = %+v, want failed/load", run)
+			}
+		case "org/b":
+			if run.Outcome != OutcomeOK {
+				t.Errorf("org/b = %+v, want ok", run)
+			}
+		}
+	}
+	raw, _ := os.ReadFile(r.opts.Path)
+	if strings.Contains(string(raw), "simulated") {
+		t.Errorf("the error's text reached the file:\n%s", raw)
+	}
+}
+
+// The file is this account's own and bounded: 0600 in a 0700 directory,
+// started again when the next line would pass the cap, newest line kept.
+func TestTheResultsFileIsPrivateAndBounded(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "selftest")
+	path := filepath.Join(dir, FileName)
+	f := &file{path: path, maxBytes: 300, log: testLogger()}
+	for i := 0; i < 10; i++ {
+		f.write(Run{Kind: KindRun, Model: "org/a", At: int64(i), Outcome: OutcomeOK})
+	}
+	st, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Mode().Perm() != 0o600 {
+		t.Errorf("file mode %o, want 0600", st.Mode().Perm())
+	}
+	dst, err := os.Stat(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if dst.Mode().Perm() != 0o700 {
+		t.Errorf("directory mode %o, want 0700", dst.Mode().Perm())
+	}
+	if st.Size() > 300 {
+		t.Errorf("file is %d bytes, over its cap of 300", st.Size())
+	}
+	runs, err := ReadResults(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(runs) == 0 || runs[len(runs)-1].At != 9 {
+		t.Errorf("runs = %+v; want the newest kept", runs)
+	}
+}
+
+// A result is figures. Neither prompt reaches the file, and nothing of an
+// answer does either.
+func TestAResultCarriesNoPromptAndNoAnswer(t *testing.T) {
+	srv := newFakeServer(t, "org/a")
+	srv.fakes["org/a"].Reply = "SECRET ANSWER TEXT"
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "one run", func() bool { return len(runsIn(t, r)) == 1 })
+	raw, err := os.ReadFile(r.opts.Path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, text := range []string{"SECRET", "lighthouse", "keeper"} {
+		if strings.Contains(string(raw), text) {
+			t.Errorf("the file carries %q:\n%s", text, raw)
+		}
+	}
+	var line map[string]any
+	if err := json.Unmarshal(raw[:len(raw)-1], &line); err != nil {
+		t.Fatal(err)
+	}
+	for _, field := range RunFields() {
+		if field == "reason" {
+			continue // omitted from an ok run
+		}
+		if _, ok := line[field]; !ok {
+			t.Errorf("a line does not carry %q", field)
+		}
+	}
+}
+
+// The counts come from the server's usage event when it sends one, and from
+// the chunks — one a token on mlx-lm — when it does not, and the result says
+// which.
+func TestTheStreamIsTimedAndCountedEitherWay(t *testing.T) {
+	body := "data: {\"choices\":[{\"delta\":{\"role\":\"assistant\"}}]}\n\n" +
+		"data: {\"choices\":[{\"delta\":{\"content\":\"a\"}}]}\n\n" +
+		"data: {\"choices\":[{\"delta\":{\"content\":\"b\"}}]}\n\n" +
+		"data: {\"choices\":[{\"delta\":{\"content\":\"c\"}}]}\n\n" +
+		"data: [DONE]\n\n"
+	m, err := readStream(strings.NewReader(body), time.Now())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if m.CompletionTokens != 3 || m.Counted != CountedChunks {
+		t.Errorf("without usage: %+v, want 3 chunks counted", m)
+	}
+	withUsage := strings.Replace(body, "data: [DONE]",
+		"data: {\"choices\":[],\"usage\":{\"prompt_tokens\":40,\"completion_tokens\":3}}\n\ndata: [DONE]", 1)
+	m, err = readStream(strings.NewReader(withUsage), time.Now())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if m.PromptTokens != 40 || m.CompletionTokens != 3 || m.Counted != CountedUsage {
+		t.Errorf("with usage: %+v, want the server's counts", m)
+	}
+	if _, err := readStream(strings.NewReader("data: {\"choices\":[]}\n\n"), time.Now()); err == nil {
+		t.Error("a stream that ends without [DONE] was accepted")
+	}
+}
+
+// The parallel test is the batch's figures: counts added, first token the
+// mean, the rate every token over the batch's wall time.
+func TestTheParallelTestIsTheBatchsFigures(t *testing.T) {
+	ms := []measurement{
+		{PromptTokens: 10, CompletionTokens: 100, FirstToken: 100 * time.Millisecond, Total: time.Second, Counted: CountedUsage},
+		{PromptTokens: 10, CompletionTokens: 100, FirstToken: 300 * time.Millisecond, Total: time.Second, Counted: CountedUsage},
+	}
+	got := aggregate("tg128x2", ms, 2*time.Second)
+	if got.Parallel != 2 || got.PromptTokens != 20 || got.CompletionTokens != 200 ||
+		got.FirstTokenMs != 200 || got.TotalMs != 2000 || got.TokensPerSec != 100 {
+		t.Errorf("aggregate = %+v", got)
+	}
+	single := ms[0].test("tg128", 1)
+	if single.PromptTokensPerSec != 100 || single.TokensPerSec != 110 {
+		t.Errorf("single = %+v; want 10 prompt tokens over 0.1 s and 99 tokens over 0.9 s", single)
+	}
+}
+
+// The standard set is the same for every model and its names are
+// llama-bench's, with the concurrent test only when there is concurrency.
+func TestTheStandardSetIsFixedAndNamedAfterLlamaBench(t *testing.T) {
+	names := func(set []testSpec) string {
+		out := []string{}
+		for _, s := range set {
+			out = append(out, s.Name)
+		}
+		return strings.Join(out, ",")
+	}
+	if got := names(standardSet(4)); got != "pp512,tg128,tg128x4" {
+		t.Errorf("set at concurrency 4 = %s", got)
+	}
+	if got := names(standardSet(1)); got != "pp512,tg128" {
+		t.Errorf("set at concurrency 1 = %s", got)
+	}
+	if n := len(promptProcessingPrompt()); n < promptProcessingChars || n > promptProcessingChars+len(promptSentence) {
+		t.Errorf("the pp512 prompt is %d characters", n)
+	}
+}
+
+// The fold rule is the repository's: a model's result is found however its
+// id was spelled.
+func TestResultsAreKeyedOnTheFoldedId(t *testing.T) {
+	act := Activity{Models: []ModelActivity{{RepoID: "Org/A", InFlight: 1}}}
+	one := hold{model: "org/a", count: 1}
+	if busy(act, one) {
+		t.Error("the self-test's own hold, spelled differently, counted as a client's")
+	}
+	act.Models[0].InFlight = 2
+	if !busy(act, one) {
+		t.Error("a client on the model under test was not seen")
+	}
+	// The parallel test holds the concurrency's worth; a client beyond that
+	// is queued in the pool and seen.
+	act.Models[0].InFlight = 4
+	if busy(act, hold{model: "org/a", count: 4}) {
+		t.Error("the parallel test's own holds counted as clients")
+	}
+	act.Models[0].InFlight = 5
+	if !busy(act, hold{model: "org/a", count: 4}) {
+		t.Error("a client queued behind the parallel test was not seen")
+	}
+	// While the self-test's own load is parked, the waiter the pool counts
+	// may be its own, and is not read; a client in flight elsewhere is, and
+	// so is a client refused room since the run began.
+	loading := hold{model: "org/a", refusals: 3, parks: true}
+	if busy(Activity{Waiting: 1}, loading) {
+		t.Error("the self-test's own parked load counted as a client's")
+	}
+	if !busy(Activity{Models: []ModelActivity{{RepoID: "org/b", InFlight: 1}}}, loading) {
+		t.Error("a client in flight during the load was not seen")
+	}
+	if !busy(Activity{Refusals: 4}, loading) {
+		t.Error("a client refused room was not seen")
+	}
+	if busy(Activity{Refusals: 3}, loading) {
+		t.Error("refusals from before the run counted as a client")
+	}
+	// A job that never parks has no waiter of its own: every waiter is a
+	// client's, whether or not the job holds anything.
+	if !busy(Activity{Waiting: 1}, hold{model: "org/a"}) {
+		t.Error("a waiter was not seen as a client for a job that never parks")
+	}
+	if config.FoldRepoID("Org/A") != config.FoldRepoID("org/a") {
+		t.Fatal("the fold rule changed under this test")
+	}
+}
+
+func testLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }
+
+// The load is the longest thing a run does, and a client is not made to wait
+// out a cold load either: a request arriving while the self-test's model is
+// still loading cancels the load, and the pool tears it down.
+func TestAClientRequestDuringTheLoadYieldsToo(t *testing.T) {
+	srv := newFakeServer(t, "org/a", "org/b")
+	srv.acquireDelay = 2 * time.Second
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "a load to start", func() bool { acquired, _, _ := srv.snapshot(); return len(acquired) == 1 })
+	srv.mu.Lock()
+	srv.foreign = "org/b"
+	srv.resident["org/b"] = true
+	srv.mu.Unlock()
+	arrived := time.Now()
+	waitFor(t, "the yielded run", func() bool { return len(runsIn(t, r)) >= 1 })
+	if took := time.Since(arrived); took > 500*time.Millisecond {
+		t.Errorf("the load took %v to yield; the client waited that long", took)
+	}
+	run := runsIn(t, r)[0]
+	if run.Outcome != OutcomeYielded || len(run.Tests) != 0 {
+		t.Errorf("run = %+v, want yielded with no tests", run)
+	}
+	if _, _, inFlight := srv.snapshot(); inFlight["org/a"] != 0 {
+		t.Error("the abandoned load is still held")
+	}
+}
+
+// The self-test's own run does not look like a client's afterwards: a model it
+// has just released is not what keeps the next tick from starting.
+func TestTheSelfTestsOwnRunDoesNotCountAsARecentRequest(t *testing.T) {
+	srv := newFakeServer(t, "org/a", "org/b")
+	srv.mu.Lock()
+	srv.resident["org/a"] = true
+	srv.resident["org/b"] = true
+	srv.mu.Unlock()
+	r := New(Options{
+		Server: srv, Path: filepath.Join(t.TempDir(), FileName),
+		Tick: 5 * time.Millisecond, Poll: 2 * time.Millisecond, Quiet: time.Hour,
+	})
+	t.Cleanup(r.Close)
+	r.SetEnabled(true)
+	waitFor(t, "both resident models measured despite a one-hour quiet period", func() bool { return len(runsIn(t, r)) == 2 })
+}
+
+// With eviction grace off, a client whose load finds no room is refused at
+// once and waits nowhere the self-test can see; the pool's refusal count is
+// the sign it was there, and it ends the run so the client's retry finds the
+// room.
+func TestAClientRefusedRoomYieldsTheRun(t *testing.T) {
+	srv := newFakeServer(t, "org/a")
+	srv.fakes["org/a"].ChunkDelay = 20 * time.Millisecond
+	srv.fakes["org/a"].Reply = strings.Repeat("word ", 50)
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "a run to start", func() bool { acquired, _, _ := srv.snapshot(); return len(acquired) == 1 })
+	srv.mu.Lock()
+	srv.refusals++
+	srv.mu.Unlock()
+	arrived := time.Now()
+	waitFor(t, "the yielded run", func() bool { return len(runsIn(t, r)) >= 1 })
+	if took := time.Since(arrived); took > 500*time.Millisecond {
+		t.Errorf("the run took %v to yield after a refusal", took)
+	}
+	if run := runsIn(t, r)[0]; run.Outcome != OutcomeYielded {
+		t.Errorf("outcome = %q, want %q", run.Outcome, OutcomeYielded)
+	}
+	if _, _, inFlight := srv.snapshot(); inFlight["org/a"] != 0 {
+		t.Error("the model is still held after yielding to a refused client")
+	}
+}
+
+// The self-test never evicts: a model that would need room made is left for
+// a tick when there is room, and a model that fits is measured meanwhile.
+func TestAModelThatWouldNeedAnEvictionIsLeftForLater(t *testing.T) {
+	srv := newFakeServer(t, "org/a", "org/b")
+	srv.noFit["org/a"] = true
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "org/b measured", func() bool { return len(runsIn(t, r)) == 1 })
+	time.Sleep(30 * time.Millisecond)
+	if acquired, _, _ := srv.snapshot(); len(acquired) != 1 || acquired[0] != "org/b" {
+		t.Fatalf("acquired %v; org/a does not fit and must not be loaded", acquired)
+	}
+	// Room appears; org/a is still due, not charged a day it never had.
+	srv.mu.Lock()
+	delete(srv.noFit, "org/a")
+	srv.mu.Unlock()
+	waitFor(t, "org/a measured once there is room", func() bool { return len(runsIn(t, r)) == 2 })
+}
+
+// The parallel test takes its places in the pool before it sends: the model
+// server never decodes more than the pool allows, and a client arriving on the
+// model waits in the pool where the watcher sees it.
+func TestTheParallelTestHoldsItsPlacesInThePool(t *testing.T) {
+	srv := newFakeServer(t, "org/a")
+	srv.concurrency = 3
+	r := fastRunner(t, srv, t.TempDir())
+	r.SetEnabled(true)
+	waitFor(t, "one run", func() bool { return len(runsIn(t, r)) == 1 })
+	srv.mu.Lock()
+	most := srv.maxInFlight
+	srv.mu.Unlock()
+	if most != 3 {
+		t.Errorf("the most held at once was %d, want the concurrency, 3", most)
+	}
+	if _, _, inFlight := srv.snapshot(); inFlight["org/a"] != 0 {
+		t.Error("holds were left behind after the run")
+	}
+	run := runsIn(t, r)[0]
+	if run.Outcome != OutcomeOK || run.Tests[2].Name != "tg128x3" || run.Tests[2].Parallel != 3 {
+		t.Errorf("run = %+v", run)
+	}
+}
+
+// A planted file where the results go is refused rather than written into or
+// waited on: a link, a FIFO, and a directory another account can write.
+func TestAPlantedResultsLocationIsRefused(t *testing.T) {
+	base := t.TempDir()
+	f := func(dir string) *file {
+		return &file{path: filepath.Join(dir, FileName), maxBytes: DefaultMaxBytes, log: testLogger()}
+	}
+	// A link where the directory should be.
+	elsewhere := filepath.Join(base, "elsewhere")
+	if err := os.Mkdir(elsewhere, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	linked := filepath.Join(base, "linked")
+	if err := os.Symlink(elsewhere, linked); err != nil {
+		t.Fatal(err)
+	}
+	f(linked).write(Run{Kind: KindRun, Model: "org/a", Outcome: OutcomeOK})
+	if _, err := os.Stat(filepath.Join(elsewhere, FileName)); !os.IsNotExist(err) {
+		t.Error("a result was written through a planted link")
+	}
+	// A directory others can write.
+	open := filepath.Join(base, "open")
+	if err := os.Mkdir(open, 0o777); err != nil {
+		t.Fatal(err)
+	}
+	os.Chmod(open, 0o777)
+	f(open).write(Run{Kind: KindRun, Model: "org/a", Outcome: OutcomeOK})
+	if _, err := os.Stat(filepath.Join(open, FileName)); !os.IsNotExist(err) {
+		t.Error("a result was written into a directory other accounts can write")
+	}
+	// A FIFO where the file should be: the write and the read both return.
+	fifoDir := filepath.Join(base, "fifo")
+	if err := os.Mkdir(fifoDir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := syscall.Mkfifo(filepath.Join(fifoDir, FileName), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		f(fifoDir).write(Run{Kind: KindRun, Model: "org/a", Outcome: OutcomeOK})
+		if _, err := ReadResults(filepath.Join(fifoDir, FileName)); err == nil {
+			t.Error("reading a FIFO was accepted")
+		}
+	}()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("the writer or the reader blocked on a FIFO")
+	}
+}
diff --git a/internal/stats/dashboard.go b/internal/stats/dashboard.go
index 8044ec8c..aaeeac62 100644
--- a/internal/stats/dashboard.go
+++ b/internal/stats/dashboard.go
@@ -232,6 +232,17 @@ type History struct {
 	// them.
 	FirstTokenBucketEdgesMS []int64 `json:"first_token_bucket_edges_ms"`
 
+	// PromptSizes is one row per model that carried an estimate: how the
+	// prompts sat against the window the model serves, and how often the
+	// served-window refusal bit (itd-2609091712141073).
+	PromptSizes []ModelPromptSizes `json:"prompt_sizes"`
+	// Overrides is one row per model: how often clients set each sampling
+	// parameter themselves.
+	Overrides []ModelOverrides `json:"overrides"`
+	// Footprints is one series per model from the footprint samples,
+	// downsampled to at most FootprintPoints points over the range.
+	Footprints []ModelFootprint `json:"footprints"`
+
 	// Records is how many records the pass read, in the range or out of it.
 	Records int `json:"records"`
 	// Skipped is how many lines could not be used — one is the ordinary cost of
@@ -287,6 +298,59 @@ const MaxHistoryBytes = 512 << 20
 // It is an interface so that the aggregation depends on the reading rather
 // than on the FileStore, and so a caller with no store at all — a Mac where
 // recording has never been on — passes nil and gets an empty view.
+// ModelPromptSizes is how one model's prompts sat against its windows over
+// the range. The buckets are shares of the served window: up to a quarter,
+// a half, three quarters, the whole, and over it — the last being the
+// requests the served-window check refused.
+type ModelPromptSizes struct {
+	Model string `json:"model"`
+	// Requests is how many carried an estimate at all.
+	Requests int `json:"requests"`
+	// Buckets counts requests by the judged figure's share of the served
+	// window — the prompt's estimate plus the answer asked for, which is what
+	// the refusal is judged on: [0, 1/4], (1/4, 1/2], (1/2, 3/4], (3/4, 1],
+	// over.
+	Buckets [5]int `json:"buckets"`
+	// Refused is the over-window count again, named: the requests the served
+	// window turned away.
+	Refused int `json:"refused_for_size"`
+	// DeclaredContext and ServedContext are the windows as the newest record
+	// in the range carried them.
+	DeclaredContext int64 `json:"declared_context"`
+	ServedContext   int64 `json:"served_context"`
+	// LargestEstimate is the biggest judged figure seen, so a reader can see
+	// how close anyone came.
+	LargestEstimate int `json:"largest_estimate"`
+}
+
+// ModelOverrides is how often one model's clients set each sampling
+// parameter themselves, over the range.
+type ModelOverrides struct {
+	Model    string `json:"model"`
+	Requests int    `json:"requests"`
+	// ByParameter counts, per parameter in SamplingParameters, the requests
+	// that overrode it.
+	ByParameter map[string]int `json:"by_parameter"`
+}
+
+// ModelFootprint is one model's sampled footprint over the range.
+type ModelFootprint struct {
+	Model  string           `json:"model"`
+	Points []FootprintPoint `json:"points"`
+}
+
+// FootprintPoint is one downsampled point: the mean of the samples that fell
+// in its slice of the range, stamped at the slice's start.
+type FootprintPoint struct {
+	At    int64 `json:"at"`
+	Bytes int64 `json:"bytes"`
+}
+
+// FootprintPoints is the most points a footprint series carries: a slice of
+// the range each, averaged, so a month of half-minute samples is a line a
+// panel can draw rather than ninety thousand rows.
+const FootprintPoints = 200
+
 type RecordSource interface {
 	Read(ctx context.Context, opts ReadOptions, fn func(Line) bool) (ReadStats, error)
 }
@@ -419,6 +483,18 @@ type historyAgg struct {
 	hours    []HourCounts
 	total    int64
 	dayOrder []dayKey
+
+	// The measurement views (itd-2609091712141073), per model. The newest
+	// record is met first, so a window is taken the first time it is seen.
+	sizes      map[string]*ModelPromptSizes
+	overrides  map[string]*ModelOverrides
+	footprints map[string][]footprintSlice
+}
+
+// footprintSlice accumulates the samples that fell in one slice of the range.
+type footprintSlice struct {
+	sum   int64
+	count int64
 }
 
 func newHistoryAgg(ctx context.Context, from, to int64, loc *time.Location) *historyAgg {
@@ -428,6 +504,10 @@ func newHistoryAgg(ctx context.Context, from, to int64, loc *time.Location) *his
 		models:  map[string]*ModelShare{},
 		latency: map[string]*latencySamples{},
 		hours:   make([]HourCounts, 24),
+
+		sizes:      map[string]*ModelPromptSizes{},
+		overrides:  map[string]*ModelOverrides{},
+		footprints: map[string][]footprintSlice{},
 	}
 	return a
 }
@@ -476,10 +556,85 @@ func (a *historyAgg) take(l Line) bool {
 		}
 	case KindLoad:
 		a.hours[when.Hour()].Loads++
+	case KindFootprint:
+		a.footprint(l.Event)
 	}
 	return true
 }
 
+// footprint folds one sample into its model's series: the range is cut into
+// FootprintPoints slices and the sample lands in the one its time falls in.
+func (a *historyAgg) footprint(e Event) {
+	if e.Model == "" || e.Bytes <= 0 || e.Bytes > maxFootprintBytes || a.to <= a.from {
+		return
+	}
+	slices := a.footprints[e.Model]
+	if slices == nil {
+		slices = make([]footprintSlice, FootprintPoints)
+		a.footprints[e.Model] = slices
+	}
+	i := int((e.At - a.from) * FootprintPoints / (a.to - a.from))
+	if i < 0 {
+		i = 0
+	}
+	if i >= FootprintPoints {
+		i = FootprintPoints - 1
+	}
+	slices[i].sum = addTokens64(slices[i].sum, e.Bytes)
+	slices[i].count++
+}
+
+// sizesAndOverrides folds what a request said about its windows and its
+// client's overrides.
+func (a *historyAgg) sizesAndOverrides(r Record) {
+	if r.Model == "" {
+		return
+	}
+	judged := int64(r.RequestedTokens)
+	if judged <= 0 {
+		judged = int64(r.EstimatedPromptTokens)
+	}
+	if judged > 0 && judged <= 1<<40 && r.ServedContext > 0 && r.ServedContext <= MaxContext {
+		row, ok := a.sizes[r.Model]
+		if !ok {
+			row = &ModelPromptSizes{Model: r.Model, DeclaredContext: r.DeclaredContext, ServedContext: r.ServedContext}
+			a.sizes[r.Model] = row
+		}
+		row.Requests++
+		est := judged
+		switch {
+		case est > r.ServedContext:
+			row.Buckets[4]++
+			row.Refused++
+		case est*4 <= r.ServedContext:
+			row.Buckets[0]++
+		case est*2 <= r.ServedContext:
+			row.Buckets[1]++
+		case est*4 <= r.ServedContext*3:
+			row.Buckets[2]++
+		default:
+			row.Buckets[3]++
+		}
+		if int(judged) > row.LargestEstimate {
+			row.LargestEstimate = int(judged)
+		}
+	}
+	ov, ok := a.overrides[r.Model]
+	if !ok {
+		ov = &ModelOverrides{Model: r.Model, ByParameter: map[string]int{}}
+		for _, name := range SamplingParameters {
+			ov.ByParameter[name] = 0
+		}
+		a.overrides[r.Model] = ov
+	}
+	ov.Requests++
+	for _, name := range r.Overrides {
+		if _, known := ov.ByParameter[name]; known {
+			ov.ByParameter[name]++
+		}
+	}
+}
+
 // addTokens is the one place a day's figures are added up.
 //
 // Everything the tokens-per-day table and the share column rest on goes
@@ -557,6 +712,7 @@ func addTokens64(a, b int64) int64 {
 func (a *historyAgg) request(r Record, when time.Time) {
 	a.addTokens(when.Format("2006-01-02"), r.Model, 1,
 		int64(r.PromptTokens), int64(r.CompletionTokens), false)
+	a.sizesAndOverrides(r)
 
 	if r.Class != ClassOK || r.FirstTokenMS < 0 {
 		return
@@ -633,6 +789,32 @@ func (a *historyAgg) fill(h *History) {
 		}
 		return h.Latency[i].Model < h.Latency[j].Model
 	})
+
+	h.PromptSizes = make([]ModelPromptSizes, 0, len(a.sizes))
+	for _, row := range a.sizes {
+		h.PromptSizes = append(h.PromptSizes, *row)
+	}
+	sort.Slice(h.PromptSizes, func(i, j int) bool { return h.PromptSizes[i].Model < h.PromptSizes[j].Model })
+	h.Overrides = make([]ModelOverrides, 0, len(a.overrides))
+	for _, row := range a.overrides {
+		h.Overrides = append(h.Overrides, *row)
+	}
+	sort.Slice(h.Overrides, func(i, j int) bool { return h.Overrides[i].Model < h.Overrides[j].Model })
+	h.Footprints = make([]ModelFootprint, 0, len(a.footprints))
+	for model, slices := range a.footprints {
+		series := ModelFootprint{Model: model}
+		for i, sl := range slices {
+			if sl.count == 0 {
+				continue
+			}
+			// The slice's start, by the same arithmetic that placed the
+			// sample in it.
+			at := a.from + int64(i)*(a.to-a.from)/FootprintPoints
+			series.Points = append(series.Points, FootprintPoint{At: at, Bytes: sl.sum / sl.count})
+		}
+		h.Footprints = append(h.Footprints, series)
+	}
+	sort.Slice(h.Footprints, func(i, j int) bool { return h.Footprints[i].Model < h.Footprints[j].Model })
 }
 
 // clippedDay names the local day a range starts part-way through, or is empty
diff --git a/internal/stats/measurement_test.go b/internal/stats/measurement_test.go
new file mode 100644
index 00000000..40b6c6f0
--- /dev/null
+++ b/internal/stats/measurement_test.go
@@ -0,0 +1,180 @@
+package stats
+
+import (
+	"context"
+	"reflect"
+	"testing"
+	"time"
+)
+
+type captureStore struct {
+	requests []Record
+	events   []Event
+}
+
+func (s *captureStore) AppendRequest(r Record) error  { s.requests = append(s.requests, r); return nil }
+func (s *captureStore) AppendEvent(e Event) error     { s.events = append(s.events, e); return nil }
+func (s *captureStore) AppendSettings(Settings) error { return nil }
+
+// A record carries the windows it was judged against, the in-flight count at
+// admission, the estimate, the override names and the footprint; and each is
+// bounded at the recorder: an implausible window or count is dropped, an
+// override outside the closed set is dropped, never repaired.
+func TestARecordCarriesTheMeasurementFieldsAndTheyAreBounded(t *testing.T) {
+	store := &captureStore{}
+	r := New(Options{Store: store})
+	r.SetEnabled(true)
+	r.Add(Record{Model: "org/m", Class: ClassOK, At: 100,
+		DeclaredContext: 131072, ServedContext: 65536, EstimatedPromptTokens: 4000, InFlight: 2,
+		Overrides: []string{"temperature", "vibes", "max_tokens"}, FootprintBytes: 48 << 30})
+	r.Add(Record{Model: "org/m", Class: ClassOK, At: 101,
+		DeclaredContext: 1 << 40, ServedContext: -1, EstimatedPromptTokens: -5, InFlight: 1 << 30,
+		Overrides: []string{"nope"}, FootprintBytes: -1})
+	if len(store.requests) != 2 {
+		t.Fatalf("%d records written", len(store.requests))
+	}
+	got := store.requests[0]
+	if got.DeclaredContext != 131072 || got.ServedContext != 65536 || got.EstimatedPromptTokens != 4000 ||
+		got.InFlight != 2 || got.FootprintBytes != 48<<30 || !reflect.DeepEqual(got.Overrides, []string{"temperature", "max_tokens"}) {
+		t.Errorf("record = %+v", got)
+	}
+	bad := store.requests[1]
+	if bad.DeclaredContext != 0 || bad.ServedContext != 0 || bad.EstimatedPromptTokens != 0 ||
+		bad.InFlight != 0 || bad.FootprintBytes != 0 || bad.Overrides != nil {
+		t.Errorf("implausible figures survived: %+v", bad)
+	}
+}
+
+// A footprint sample is an event of its own kind, recorded only while the
+// switch is on, and the newest reading is on the model's counters.
+func TestAFootprintSampleIsAnEvent(t *testing.T) {
+	store := &captureStore{}
+	r := New(Options{Store: store})
+	r.FootprintSampled("org/m", 1<<30)
+	if len(store.events) != 0 {
+		t.Fatal("a sample was recorded with the switch off")
+	}
+	r.SetEnabled(true)
+	r.FootprintSampled("org/m", 2<<30)
+	r.FootprintSampled("org/m", 0)
+	if len(store.events) != 1 || store.events[0].Kind != EventFootprint || store.events[0].Bytes != 2<<30 {
+		t.Errorf("events = %+v, want one footprint of 2 GiB", store.events)
+	}
+}
+
+// The load event carries the sampling the server was launched with, only
+// the parameters in the closed set, and nothing once it has been carried out.
+func TestALoadEventCarriesTheLaunchSampling(t *testing.T) {
+	store := &captureStore{}
+	r := New(Options{Store: store})
+	r.SetEnabled(true)
+	r.LoadStarted("org/m")
+	r.LoadFinished("org/m", time.Second, nil, map[string]float64{"temperature": 0.7, "top_k": 40, "vibes": 1})
+	if len(store.events) != 1 {
+		t.Fatalf("%d events", len(store.events))
+	}
+	if got := store.events[0].Sampling; !reflect.DeepEqual(got, map[string]float64{"temperature": 0.7, "top_k": 40}) {
+		t.Errorf("sampling = %v", got)
+	}
+	r.LoadFinished("org/m", time.Second, nil, nil)
+	if store.events[1].Sampling != nil {
+		t.Errorf("a load with no sampling carried some: %v", store.events[1].Sampling)
+	}
+}
+
+// memSource feeds the aggregator lines the way the store does: newest first.
+type memSource struct{ lines []Line }
+
+func (m memSource) Read(_ context.Context, _ ReadOptions, fn func(Line) bool) (ReadStats, error) {
+	for i := len(m.lines) - 1; i >= 0; i-- {
+		if !fn(m.lines[i]) {
+			break
+		}
+	}
+	return ReadStats{}, nil
+}
+
+func sizedRequest(at int64, model string, est int, served, declared int64, overrides ...string) Line {
+	return Line{Kind: KindRequest, At: at, Request: Record{Model: model, At: at, Class: ClassOK,
+		EstimatedPromptTokens: est, RequestedTokens: est, ServedContext: served, DeclaredContext: declared, Overrides: overrides}}
+}
+
+// Prompts are bucketed by their share of the served window, the refused ones
+// counted apart, and the windows carried beside the counts.
+func TestPromptSizesAreBucketedAgainstBothWindows(t *testing.T) {
+	src := memSource{lines: []Line{
+		sizedRequest(1000, "org/m", 1000, 16384, 131072),  // ≤ 1/4
+		sizedRequest(1001, "org/m", 6000, 16384, 131072),  // ≤ 1/2
+		sizedRequest(1002, "org/m", 12000, 16384, 131072), // ≤ 3/4
+		sizedRequest(1003, "org/m", 16000, 16384, 131072), // ≤ 1
+		sizedRequest(1004, "org/m", 20000, 16384, 131072), // over: refused
+	}}
+	h, err := Aggregate(context.Background(), src, time.Unix(0, 0), time.Unix(2000, 0), time.UTC)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(h.PromptSizes) != 1 {
+		t.Fatalf("prompt sizes = %+v", h.PromptSizes)
+	}
+	row := h.PromptSizes[0]
+	if row.Requests != 5 || row.Buckets != [5]int{1, 1, 1, 1, 1} || row.Refused != 1 ||
+		row.ServedContext != 16384 || row.DeclaredContext != 131072 || row.LargestEstimate != 20000 {
+		t.Errorf("row = %+v", row)
+	}
+}
+
+// The override rate is per parameter, over every request the model served,
+// with every parameter present so a zero is a zero and not an absence.
+func TestOverrideRatesPerParameter(t *testing.T) {
+	src := memSource{lines: []Line{
+		sizedRequest(1000, "org/m", 10, 100, 100, "temperature"),
+		sizedRequest(1001, "org/m", 10, 100, 100, "temperature", "max_tokens"),
+		sizedRequest(1002, "org/m", 10, 100, 100),
+	}}
+	h, err := Aggregate(context.Background(), src, time.Unix(0, 0), time.Unix(2000, 0), time.UTC)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(h.Overrides) != 1 {
+		t.Fatalf("overrides = %+v", h.Overrides)
+	}
+	row := h.Overrides[0]
+	want := map[string]int{"temperature": 2, "top_p": 0, "top_k": 0, "min_p": 0, "max_tokens": 1}
+	if row.Requests != 3 || !reflect.DeepEqual(row.ByParameter, want) {
+		t.Errorf("row = %+v, want %v over 3", row, want)
+	}
+}
+
+// The footprint series is the samples averaged into at most FootprintPoints
+// slices of the range, stamped at each slice's start.
+func TestFootprintSeriesIsDownsampledToTheRange(t *testing.T) {
+	var lines []Line
+	for at := int64(0); at < 20000; at += 10 {
+		// Alternating readings, so the mean is exercised: each slice holds
+		// ten samples, five of each.
+		b := int64(1 << 30)
+		if (at/10)%2 == 1 {
+			b = 3 << 30
+		}
+		lines = append(lines, Line{Kind: KindFootprint, At: at, Event: Event{Model: "org/m", At: at, Kind: EventFootprint, Bytes: b}})
+	}
+	h, err := Aggregate(context.Background(), memSource{lines}, time.Unix(0, 0), time.Unix(20000, 0), time.UTC)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(h.Footprints) != 1 {
+		t.Fatalf("footprints = %+v", h.Footprints)
+	}
+	pts := h.Footprints[0].Points
+	if len(pts) == 0 || len(pts) > FootprintPoints {
+		t.Fatalf("%d points from 2000 samples, want at most %d", len(pts), FootprintPoints)
+	}
+	for _, p := range pts {
+		if p.Bytes != 2<<30 {
+			t.Errorf("a point averaged to %d, want the mean of 1 and 3 GiB", p.Bytes)
+		}
+	}
+	if pts[0].At != 0 || pts[len(pts)-1].At >= 20000 {
+		t.Errorf("points run from %d to %d", pts[0].At, pts[len(pts)-1].At)
+	}
+}
diff --git a/internal/stats/stats.go b/internal/stats/stats.go
index 5670da09..fa0401e7 100644
--- a/internal/stats/stats.go
+++ b/internal/stats/stats.go
@@ -137,14 +137,61 @@ type Record struct {
 	// waiter on that load pays and not only the request that started it.
 	QueueWaitMS int64 `json:"queue_wait_ms"`
 	LoadWaitMS  int64 `json:"load_wait_ms"`
+
+	// The facts that decide a served window and a concurrency, recorded at
+	// admission and at completion (itd-2609091712141073). DeclaredContext and
+	// ServedContext are the model's two windows as they stood when the
+	// request was judged; EstimatedPromptTokens is the gateway's own estimate
+	// of the prompt's size, written for every request including one refused
+	// for size, so a refusal still says how big the prompt was; InFlight is
+	// how many requests the model already had when this one was admitted.
+	// All zero for a request refused before it named a model.
+	DeclaredContext       int64 `json:"declared_context,omitempty"`
+	ServedContext         int64 `json:"served_context,omitempty"`
+	EstimatedPromptTokens int   `json:"estimated_prompt_tokens,omitempty"`
+	// RequestedTokens is the figure the served-window check judged: the
+	// estimate plus the answer the request asked for. A request is refused
+	// when it is over ServedContext, so the record, the refusal and the
+	// dashboard's bands rest on this one number.
+	RequestedTokens int `json:"requested_tokens,omitempty"`
+	InFlight        int `json:"in_flight,omitempty"`
+	// Overrides names the sampling parameters the client set in its body —
+	// the names only, from the closed set SamplingParameters, never the
+	// values: it is the one field derived from a client's body, and it says
+	// only which knob was touched.
+	Overrides []string `json:"overrides,omitempty"`
+	// FootprintBytes is the model server's latest sampled footprint at the
+	// moment the request completed: a sample of the process, joined by time,
+	// not a cost attributable to this request. Zero when nothing was sampled.
+	FootprintBytes int64 `json:"footprint_bytes,omitempty"`
 }
 
+// SamplingParameters is the closed set of names Overrides may carry, in the
+// order the settings pane lists them. An override outside it is dropped at
+// the recorder.
+var SamplingParameters = []string{"temperature", "top_p", "top_k", "min_p", "max_tokens"}
+
+// MaxContext bounds the windows a record may carry: the registry's own
+// bound on a declared window, restated here because this package imports
+// nothing of ours (internal/archtest holds the two equal).
+const MaxContext = 1 << 23
+
+// maxInFlight and maxFootprintBytes bound the other two figures: more
+// requests in flight than any batch, and more memory than any Mac.
+const (
+	maxInFlight       = 1 << 16
+	maxFootprintBytes = 1 << 50
+)
+
 // RecordFields lists a record's fields in the order they are declared, under
 // the names they are written down as. The documentation's field table is held
 // to this list, so a field added here without a word about it on the page
 // fails the build.
 func RecordFields() []string { return jsonFields(Record{}) }
 
+// EventFields lists an event's fields the same way, for the same test.
+func EventFields() []string { return jsonFields(Event{}) }
+
 // EventKind distinguishes the two things that happen to a model server as
 // against a request.
 type EventKind string
@@ -152,6 +199,10 @@ type EventKind string
 const (
 	EventLoad    EventKind = "load"
 	EventRemoved EventKind = "removed"
+	// EventFootprint is a periodic reading of a running model server's
+	// memory footprint, so the figure exists as a series over time and not
+	// only as the value a completing request happened to see.
+	EventFootprint EventKind = "footprint"
 )
 
 // Event is a model server loading or leaving, which is what makes a slow
@@ -168,6 +219,12 @@ type Event struct {
 	DurationMS int64 `json:"duration_ms,omitempty"`
 	// Failed reports a load that never became ready.
 	Failed bool `json:"failed,omitempty"`
+	// Sampling is the sampling values the model server was launched with,
+	// by parameter name, only the ones set; on a load. It is what a request's
+	// Overrides are overrides of.
+	Sampling map[string]float64 `json:"sampling,omitempty"`
+	// Bytes is the sampled footprint; on a footprint sample.
+	Bytes int64 `json:"bytes,omitempty"`
 }
 
 // Store is where records go to outlive the process.
@@ -360,6 +417,7 @@ func (r *Recorder) Add(rec Record) {
 	if rec.At == 0 {
 		rec.At = r.now().UTC().Unix()
 	}
+	rec = bound(rec)
 	if !r.addLocked(rec) {
 		return
 	}
@@ -372,6 +430,49 @@ func (r *Recorder) Add(rec Record) {
 	}
 }
 
+// bound holds a record's persisted numerics and names to what the recorder
+// will believe: registry.json is a file another account can write in
+// shared-cache mode and the windows come from it, and the override names
+// are the one thing derived from a client's body.
+func bound(rec Record) Record {
+	if rec.DeclaredContext < 0 || rec.DeclaredContext > MaxContext {
+		rec.DeclaredContext = 0
+	}
+	if rec.ServedContext < 0 || rec.ServedContext > MaxContext {
+		rec.ServedContext = 0
+	}
+	if rec.EstimatedPromptTokens < 0 || rec.EstimatedPromptTokens > MaxContext {
+		rec.EstimatedPromptTokens = 0
+	}
+	// The judged figure may legitimately be over every window — that is
+	// what a refusal is — but not past what an int can add up.
+	if rec.RequestedTokens < 0 || rec.RequestedTokens > 1<<40 {
+		rec.RequestedTokens = 0
+	}
+	if rec.InFlight < 0 || rec.InFlight > maxInFlight {
+		rec.InFlight = 0
+	}
+	if rec.FootprintBytes < 0 || rec.FootprintBytes > maxFootprintBytes {
+		rec.FootprintBytes = 0
+	}
+	if len(rec.Overrides) > 0 {
+		kept := make([]string, 0, len(rec.Overrides))
+		for _, name := range rec.Overrides {
+			for _, known := range SamplingParameters {
+				if name == known {
+					kept = append(kept, name)
+					break
+				}
+			}
+		}
+		rec.Overrides = kept
+		if len(kept) == 0 {
+			rec.Overrides = nil
+		}
+	}
+	return rec
+}
+
 // addLocked folds one record into everything the recorder holds, reporting
 // whether it was recorded at all. It is its own function so that the lock is
 // released by a defer: a panic anywhere in here would otherwise leave the
@@ -419,17 +520,53 @@ func (r *Recorder) LoadStarted(model string) {
 	r.modelLocked(model)
 }
 
-// LoadFinished notes that a model server finished loading, or failed to.
-func (r *Recorder) LoadFinished(model string, took time.Duration, err error) {
+// boundSampling keeps only the parameters in the closed set, copied.
+func boundSampling(in map[string]float64) map[string]float64 {
+	if len(in) == 0 {
+		return nil
+	}
+	out := map[string]float64{}
+	for _, name := range SamplingParameters {
+		if v, ok := in[name]; ok {
+			out[name] = v
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// LoadFinished notes that a model server finished loading, or failed to,
+// with the sampling it was launched with, by parameter name.
+func (r *Recorder) LoadFinished(model string, took time.Duration, err error, sampling map[string]float64) {
 	ev := Event{
 		At:         r.now().UTC().Unix(),
 		Model:      model,
 		Kind:       EventLoad,
 		DurationMS: took.Milliseconds(),
 		Failed:     err != nil,
+		Sampling:   boundSampling(sampling),
+	}
+
+	if !r.loadFinishedLocked(model, &ev) {
+		return
 	}
+	if r.store != nil {
+		_ = r.store.AppendEvent(ev)
+	}
+}
 
-	if !r.loadFinishedLocked(model, ev) {
+// FootprintSampled notes a reading of a running model server's memory.
+func (r *Recorder) FootprintSampled(model string, bytes int64) {
+	if bytes <= 0 || bytes > maxFootprintBytes {
+		return
+	}
+	ev := Event{At: r.now().UTC().Unix(), Model: model, Kind: EventFootprint, Bytes: bytes}
+	r.mu.Lock()
+	on := r.enabled
+	r.mu.Unlock()
+	if !on {
 		return
 	}
 	if r.store != nil {
@@ -437,7 +574,7 @@ func (r *Recorder) LoadFinished(model string, took time.Duration, err error) {
 	}
 }
 
-func (r *Recorder) loadFinishedLocked(model string, ev Event) bool {
+func (r *Recorder) loadFinishedLocked(model string, ev *Event) bool {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	if !r.enabled {
diff --git a/internal/stats/stats_test.go b/internal/stats/stats_test.go
index f4f8e9c7..4c352a65 100644
--- a/internal/stats/stats_test.go
+++ b/internal/stats/stats_test.go
@@ -79,7 +79,7 @@ func TestOffRecordsNothing(t *testing.T) {
 	}
 	r.Add(okRecord("org/a"))
 	r.LoadStarted("org/a")
-	r.LoadFinished("org/a", time.Second, nil)
+	r.LoadFinished("org/a", time.Second, nil, nil)
 	r.Removed("org/a", ReasonEvicted)
 
 	if got := r.Summary(); len(got) != 0 {
@@ -230,7 +230,7 @@ func TestOnlyAnEvictionCountsAsOne(t *testing.T) {
 	r.SetEnabled(true)
 
 	r.LoadStarted("org/a")
-	r.LoadFinished("org/a", 3*time.Second, nil)
+	r.LoadFinished("org/a", 3*time.Second, nil, nil)
 	r.Removed("org/a", ReasonEvicted)
 	r.Removed("org/a", ReasonIdle)
 	r.Removed("org/a", ReasonUnloaded)
@@ -250,7 +250,7 @@ func TestOnlyAnEvictionCountsAsOne(t *testing.T) {
 	r2, _ := newTestRecorder(t)
 	r2.SetEnabled(true)
 	r2.LoadStarted("org/b")
-	r2.LoadFinished("org/b", time.Second, errors.New("did not become ready"))
+	r2.LoadFinished("org/b", time.Second, errors.New("did not become ready"), nil)
 	if got := r2.Summary()[0]; got.Loads != 0 || got.FailedLoads != 1 {
 		t.Errorf("a load that failed counted %+v, want no load and one failed load", got)
 	}
@@ -284,7 +284,7 @@ func TestEveryRecordIsOfferedToTheStore(t *testing.T) {
 
 	r.Add(okRecord("org/a"))
 	r.LoadStarted("org/a")
-	r.LoadFinished("org/a", time.Second, nil)
+	r.LoadFinished("org/a", time.Second, nil, nil)
 	r.Removed("org/a", ReasonEvicted)
 
 	mu.Lock()
@@ -312,8 +312,10 @@ func (s funcStore) AppendRequest(r Record) error  { return s.request(r) }
 func (s funcStore) AppendEvent(e Event) error     { return s.event(e) }
 func (s funcStore) AppendSettings(Settings) error { return nil }
 
-// A record is a fixed set of counted and timed fields. The panel, the
-// documentation and the durable store all read this list, and the field table
+// A record is a fixed set of counted and timed fields, plus the facts a
+// request was judged against and the names — never the values — of what its
+// client overrode. The panel, the documentation and the durable store all
+// read this list, and the field table
 // on the how-to page is held to it (internal/archtest), so a field added here
 // without a word in the documentation fails the build rather than shipping
 // undocumented.
@@ -322,6 +324,8 @@ func TestARecordHoldsOnlyCountsTimingsAndTheModel(t *testing.T) {
 		"model", "at", "class", "streamed",
 		"prompt_tokens", "completion_tokens",
 		"first_token_ms", "duration_ms", "queue_wait_ms", "load_wait_ms",
+		"declared_context", "served_context", "estimated_prompt_tokens", "requested_tokens", "in_flight",
+		"overrides", "footprint_bytes",
 	}
 	if got := RecordFields(); !reflect.DeepEqual(got, want) {
 		t.Errorf("a request record holds %v, want %v", got, want)
diff --git a/internal/stats/store.go b/internal/stats/store.go
index 7ad952a1..d99f591b 100644
--- a/internal/stats/store.go
+++ b/internal/stats/store.go
@@ -37,13 +37,17 @@ import (
 // own records, which cannot carry any of those.
 
 // ApproxRecordBytes is what one line of the store measures, near enough for
-// arithmetic about how long a size cap lasts: BenchmarkLatestAtTheCap fills
-// the default cap and reports 206,342,511 bytes for 901,059 records, which is
-// 229. It is a measured figure rather than a guess because the settings a
-// person chooses rest on it — and the guess it replaces, 150 bytes, is not
-// reachable: the field names are on every line, so the smallest request line
-// this format can emit is already over 190 bytes.
-const ApproxRecordBytes = 230
+// arithmetic about how long a size cap lasts. It was 229 when the record
+// carried its ten original fields (BenchmarkLatestAtTheCap: 206,342,511
+// bytes for 901,059 records); the measurement fields itd-2609091712141073
+// added — the two windows, the estimate, the in-flight count, the override
+// names and the footprint — take a typical line to about 380, which
+// TestARecordLineIsTheSizeTheDocumentationSays measures. It is a measured
+// figure rather than a guess because the settings a person chooses rest on
+// it — and the guess it replaced, 150 bytes, is not reachable: the field
+// names are on every line, so the smallest request line this format can
+// emit is already over 190 bytes.
+const ApproxRecordBytes = 380
 
 // SchemaVersion is stamped on every line as "v". It is bumped only for a
 // change a reader of an older file could not survive; a new field is not one,
@@ -58,6 +62,10 @@ const (
 	KindLoad     = "load"
 	KindRemoved  = "removed"
 	KindSettings = "settings"
+	// KindFootprint is a periodic reading of a running model server's memory
+	// (itd-2609091712141073); the fifth record kind, ratified by the decision
+	// record that supersedes adr-2609090716413337.
+	KindFootprint = "footprint"
 )
 
 // Settings is what Gropius was actually serving under when it was written: the
@@ -526,8 +534,11 @@ func (s *FileStore) AppendEvent(e Event) error {
 		return nil
 	}
 	kind := KindRemoved
-	if e.Kind == EventLoad {
+	switch e.Kind {
+	case EventLoad:
 		kind = KindLoad
+	case EventFootprint:
+		kind = KindFootprint
 	}
 	b, err := json.Marshal(eventLine{V: SchemaVersion, Kind: kind, Event: e})
 	if err != nil {
@@ -1874,13 +1885,17 @@ func parseLine(b []byte) (Line, bool) {
 		if err := json.Unmarshal(b, &l.Request); err != nil {
 			return Line{}, false
 		}
-	case KindLoad, KindRemoved:
+	case KindLoad, KindRemoved, KindFootprint:
 		if err := json.Unmarshal(b, &l.Event); err != nil {
 			return Line{}, false
 		}
-		l.Event.Kind = EventRemoved
-		if head.Kind == KindLoad {
+		switch head.Kind {
+		case KindLoad:
 			l.Event.Kind = EventLoad
+		case KindFootprint:
+			l.Event.Kind = EventFootprint
+		default:
+			l.Event.Kind = EventRemoved
 		}
 	case KindSettings:
 		if err := json.Unmarshal(b, &l.Settings); err != nil {
diff --git a/internal/stats/store_test.go b/internal/stats/store_test.go
index 5909b952..45623cc6 100644
--- a/internal/stats/store_test.go
+++ b/internal/stats/store_test.go
@@ -1408,6 +1408,8 @@ func TestARecordLineIsTheSizeTheDocumentationSays(t *testing.T) {
 		Model: "mlx-community/Qwen3-8B-4bit", At: 1788696030, Class: ClassOK, Streamed: true,
 		PromptTokens: 1234, CompletionTokens: 567, FirstTokenMS: 210,
 		DurationMS: 4200, QueueWaitMS: 12, LoadWaitMS: 0,
+		DeclaredContext: 131072, ServedContext: 65536, EstimatedPromptTokens: 1300, RequestedTokens: 1812, InFlight: 2,
+		Overrides: []string{"temperature"}, FootprintBytes: 48 << 30,
 	}})
 	if err != nil {
 		t.Fatal(err)
diff --git a/internal/stats/summary.go b/internal/stats/summary.go
index b82201af..6151166e 100644
--- a/internal/stats/summary.go
+++ b/internal/stats/summary.go
@@ -155,7 +155,7 @@ func summaryIndexFields() []string {
 // StoreKinds names every kind of line the store can write, so the
 // documentation's list of them is held to this one.
 func StoreKinds() []string {
-	return []string{KindRequest, KindLoad, KindRemoved, KindSettings, KindSummary, KindSummaryIndex}
+	return []string{KindRequest, KindLoad, KindRemoved, KindFootprint, KindSettings, KindSummary, KindSummaryIndex}
 }
 
 // foldedFile is one detail file already counted in the summary. The size and
diff --git a/internal/ui/contextprobe_test.go b/internal/ui/contextprobe_test.go
new file mode 100644
index 00000000..d625e418
--- /dev/null
+++ b/internal/ui/contextprobe_test.go
@@ -0,0 +1,61 @@
+package ui
+
+import (
+	"regexp"
+	"testing"
+)
+
+// The probe's two settings are one setting each on three surfaces, and the
+// pane is held to the file's keys: filled from them, posted under them.
+func TestThePaneIsWiredToTheProbeSettings(t *testing.T) {
+	src := readPanelSource(t)
+	for _, want := range []*regexp.Regexp{
+		regexp.MustCompile(`context_probe:\s*\$\('setContextProbe'\)\.checked`),
+		regexp.MustCompile(`\$\('setContextProbe'\)\.checked\s*=\s*!!c\.context_probe`),
+		regexp.MustCompile(`idle_threshold_sec:\s*parseInt\(\$\('setIdleThreshold'\)\.value, 10\) \|\| 0`),
+		regexp.MustCompile(`\$\('setIdleThreshold'\)\.value\s*=\s*c\.idle_threshold_sec`),
+		regexp.MustCompile(`postModel\('/api/models/measure'`),
+		regexp.MustCompile(`postModel\('/api/models/adopt'`),
+	} {
+		if !want.MatchString(src) {
+			t.Errorf("the control panel no longer matches %s — that behavior is then asserted by nothing", want)
+		}
+	}
+}
+
+// The card's line says what the result is and what bounded it, in words a
+// reader can act on: a limit is a limit, a floor says so, a stale figure says
+// why, a run in progress says where it is, and a held run says what held it.
+func TestTheResultSaysWhatBoundedIt(t *testing.T) {
+	line := func(expr string) string {
+		v := evalPanelValue(t, "({text: "+expr+"})", "measurementText", "boundText", "staleText")
+		s, _ := v["text"].(string)
+		return s
+	}
+	cases := []struct {
+		name, expr, want string
+	}{
+		{"a limit", `measurementText({repo_id:"org/m", measured:{window:91000, bound:"model"}}, {}, [])`,
+			"Measured 91,000 tokens — the model refused above this: its own limit here"},
+		{"a floor at the deadline", `measurementText({repo_id:"org/m", measured:{window:91000, bound:"prefill_deadline"}}, {}, [])`,
+			"Measured 91,000 tokens — a floor: the prefill deadline stopped the probe first"},
+		{"a floor at the served window", `measurementText({repo_id:"org/m", measured:{window:16384, bound:"served_window"}}, {}, [])`,
+			"Measured 16,384 tokens — a floor: the served window stopped the probe first"},
+		{"stale", `measurementText({repo_id:"org/m", measured:{window:91000, bound:"model", stale:"runtime"}}, {}, [])`,
+			"Measured 91,000 tokens, now stale: the runtime changed; measure again"},
+		{"in progress", `measurementText({repo_id:"org/m"}, {job:"context-probe", model:"Org/M", step:"bisecting at 65536 tokens"}, [])`,
+			"Measuring: bisecting at 65536 tokens"},
+		{"held back", `measurementText({repo_id:"org/m"}, {held_by:"in_flight"}, ["org/m"])`,
+			"Measurement waiting: a request is in flight"},
+		{"queued", `measurementText({repo_id:"org/m"}, {}, ["org/m"])`,
+			"Measurement queued for the next idle minute"},
+		{"incomplete", `measurementText({repo_id:"org/m", probe_incomplete:true}, {}, [])`,
+			"Measurement incomplete: the last probe was interrupted; press Measure now to run it again"},
+		{"nothing", `measurementText({repo_id:"org/m"}, {}, [])`, ""},
+	}
+	for _, tt := range cases {
+		if got := line(tt.expr); got != tt.want {
+			t.Errorf("%s: %q, want %q", tt.name, got, tt.want)
+		}
+	}
+}
diff --git a/internal/ui/controls_test.go b/internal/ui/controls_test.go
index 9b8a77b0..01e9f9ff 100644
--- a/internal/ui/controls_test.go
+++ b/internal/ui/controls_test.go
@@ -133,6 +133,7 @@ func numericSettingsControls() []settingsControl {
 		{"setConc", true, func(c *config.Config, v float64) { c.DecodeConcurrency = int(v) }},
 		{"setStatsMonths", true, func(c *config.Config, v float64) { c.StatsMonths = int(v) }},
 		{"setStatsMB", true, func(c *config.Config, v float64) { c.StatsMaxBytes = int64(v) * (1 << 20) }},
+		{"setIdleThreshold", true, func(c *config.Config, v float64) { c.IdleThresholdSec = int(v) }},
 
 		{"setTemp", false, func(c *config.Config, v float64) { c.Sampling.Temperature = &v }},
 		{"setTopP", false, func(c *config.Config, v float64) { c.Sampling.TopP = &v }},
diff --git a/internal/ui/history_test.go b/internal/ui/history_test.go
index a24acee8..ac3ed719 100644
--- a/internal/ui/history_test.go
+++ b/internal/ui/history_test.go
@@ -209,6 +209,7 @@ func TestTheEmptyStateIsJudgedOnEveryTable(t *testing.T) {
 // the renderer itself rather than grep its source for the name of an element.
 var historyFunctions = []string{
 	"renderHistory", "historyBoundsLine", "dayRowHtml", "latencyRowHtml",
+	"sizesRow", "sizesRowHtml", "overridesRow", "overridesRowHtml", "footprintRow", "footprintRowHtml", "tokensLabel", "sparkline",
 	"spreadRowHtml", "hourRowHtml", "bucketLabels", "sharePercent",
 	"msFigure", "rateFigure", "millis", "figure", "showHistoryBusy", "busyLine",
 	"stopReason",
diff --git a/internal/ui/measurement_test.go b/internal/ui/measurement_test.go
new file mode 100644
index 00000000..6e437db0
--- /dev/null
+++ b/internal/ui/measurement_test.go
@@ -0,0 +1,44 @@
+package ui
+
+import (
+	"reflect"
+	"regexp"
+	"testing"
+)
+
+// The three measurement views are drawn from the history the endpoint
+// serves, and each row is a pure function a test can hold to its figures.
+func TestTheMeasurementViewsReachThePanel(t *testing.T) {
+	src := readPanelSource(t)
+	for _, want := range []*regexp.Regexp{
+		regexp.MustCompile(`\(h\.prompt_sizes \|\| \[\]\)\.map\(sizesRowHtml\)`),
+		regexp.MustCompile(`\(h\.overrides \|\| \[\]\)\.map\(overridesRowHtml\)`),
+		regexp.MustCompile(`\(h\.footprints \|\| \[\]\)\.map\(footprintRowHtml\)`),
+	} {
+		if !want.MatchString(src) {
+			t.Errorf("the control panel no longer matches %s — that view is then drawn by nothing", want)
+		}
+	}
+	sizes := evalPanelValue(t, `sizesRow({model:"org/m", declared_context:131072, served_context:65536, requests:10, buckets:[4,3,2,1,0], refused_for_size:0, largest_estimate:60000})`, "tokensLabel", "sizesRow")
+	if sizes["declared"] != "128K" || sizes["served"] != "64K" || sizes["largest"] != "58K" || sizes["refused"] != float64(0) {
+		t.Errorf("sizesRow = %v", sizes)
+	}
+	if bands, _ := sizes["bands"].([]any); !reflect.DeepEqual(bands, []any{float64(4), float64(3), float64(2), float64(1)}) {
+		t.Errorf("bands = %v", sizes["bands"])
+	}
+	over := evalPanelValue(t, `overridesRow({model:"org/m", requests:4, by_parameter:{temperature:2, top_p:0, top_k:0, min_p:0, max_tokens:1}})`, "overridesRow")
+	if over["temperature"] != "50%" || over["max_tokens"] != "25%" || over["top_p"] != "0%" {
+		t.Errorf("overridesRow = %v", over)
+	}
+	none := evalPanelValue(t, `overridesRow({model:"org/m", requests:0, by_parameter:{}})`, "overridesRow")
+	if none["temperature"] != "—" {
+		t.Errorf("no requests gave %v", none["temperature"])
+	}
+	fp := evalPanelValue(t, `footprintRow({model:"org/m", points:[{at:1,bytes:1073741824},{at:2,bytes:3221225472},{at:3,bytes:2147483648}]})`, "bytes", "sparkline", "footprintRow")
+	if fp["samples"] != float64(3) || fp["lowest"] != "1.0 GB" || fp["highest"] != "3.0 GB" || fp["latest"] != "2.0 GB" {
+		t.Errorf("footprintRow = %v", fp)
+	}
+	if fp["line"] != "▁█▅" {
+		t.Errorf("sparkline = %q, want the three points at their heights", fp["line"])
+	}
+}
diff --git a/internal/ui/panel_test.go b/internal/ui/panel_test.go
index 5325d85b..caa5971b 100644
--- a/internal/ui/panel_test.go
+++ b/internal/ui/panel_test.go
@@ -39,7 +39,7 @@ func TestModelCardInfoLineShowsTheMaximumContext(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			got := evalPanel(t, "modelInfoLine("+c.model+")", "bytes", "contextLabel", "modelInfoLine")
+			got := evalPanel(t, "modelInfoLine("+c.model+", {})", "bytes", "tokensLabel", "foldRepoID", "servedContext", "contextLabel", "modelInfoLine")
 			if got != c.want {
 				t.Errorf("modelInfoLine(%s) = %q, want %q", c.model, got, c.want)
 			}
@@ -55,7 +55,7 @@ func TestModelCardInfoLineShowsTheMaximumContext(t *testing.T) {
 func TestModelCardIsBuiltFromTheInfoLine(t *testing.T) {
 	body := extractFunction(t, readPanelSource(t), "renderModels")
 	for _, fragment := range []string{
-		"const info = modelInfoLine(m);",
+		"const info = modelInfoLine(m, state.config);",
 		`<div class="info">${info}</div>`,
 	} {
 		if !strings.Contains(body, fragment) {
diff --git a/internal/ui/posture_test.go b/internal/ui/posture_test.go
index d17c39be..76d5a7ea 100644
--- a/internal/ui/posture_test.go
+++ b/internal/ui/posture_test.go
@@ -147,7 +147,7 @@ func refuses(t *testing.T, lines map[string]map[string]any, id string, fragments
 func TestThePostureLinesStateWhatIsOn(t *testing.T) {
 	lines := posture(t, baseSnapshot)
 	for _, want := range []string{
-		"reach", "transport", "panel", "key-network", "key-local", "announce", "log", "stats",
+		"reach", "transport", "panel", "key-network", "key-local", "announce", "log", "stats", "selftest",
 	} {
 		if _, ok := lines[want]; !ok {
 			t.Errorf("the page has no %q line; it has %v", want, keysOf(lines))
@@ -167,6 +167,7 @@ func TestThePostureLinesStateWhatIsOn(t *testing.T) {
 		"at the sparse level", "logs folder")
 	wants(t, posture(t, edited(t, `{"config":{"log_level":"detailed"}}`)), "log", "at the detailed level")
 	wants(t, lines, "stats", "Request statistics are off: no request is recorded.")
+	wants(t, lines, "selftest", "The self-test is off: Gropius loads no model on its own.")
 	wants(t, lines, "transport", "plain HTTP")
 	wants(t, lines, "panel", "answer on this Mac alone")
 }
@@ -597,3 +598,15 @@ func TestTheReferencePageDocumentsEveryLine(t *testing.T) {
 		t.Errorf("docs/posture-reference.md has %d rows and the panel renders %d lines", rows, documented)
 	}
 }
+
+// The self-test line reads the setting, which applies the moment it is
+// saved, and says what being on means: models loaded on their own, never by
+// eviction, ended by any request, figures without prompts.
+func TestTheSelfTestLineSaysWhatItLoadsAndWhatItKeeps(t *testing.T) {
+	on := posture(t, edited(t, `{"config": {"self_test": true}}`))
+	wants(t, on, "selftest",
+		"The self-test is on",
+		"loads one of its models at a time where it fits beside what is loaded",
+		"A request from anyone ends the run",
+		"hold no prompt and no answer")
+}
diff --git a/internal/ui/resources_test.go b/internal/ui/resources_test.go
new file mode 100644
index 00000000..d37f47cc
--- /dev/null
+++ b/internal/ui/resources_test.go
@@ -0,0 +1,83 @@
+package ui
+
+import (
+	"regexp"
+	"testing"
+)
+
+func summary(t *testing.T, state string) map[string]any {
+	t.Helper()
+	return evalPanelValue(t, "resourcesSummary("+state+")", "bytes", "resourcesSummary")
+}
+
+// Three ready models and one resident: 3 downloaded, 1 loaded; the disk
+// figure is the sum of the recorded sizes, and free disk is the snapshot's.
+func TestTheRollUpCountsDownloadedAndLoaded(t *testing.T) {
+	got := summary(t, `{
+		"models": [
+			{"repo_id":"org/a","state":"ready","bytes":1073741824},
+			{"repo_id":"org/b","state":"ready","bytes":2147483648},
+			{"repo_id":"org/c","state":"ready","bytes":3221225472},
+			{"repo_id":"org/d","state":"downloading","bytes":99}],
+		"resident": [{"repo_id":"org/a","state":"loaded"}],
+		"machine": {"budget": 107374182400, "resident_bytes": 1288490188, "exiting_bytes": 0, "free_disk": 214748364800}}`)
+	if got["downloaded"] != float64(3) || got["loaded"] != float64(1) {
+		t.Errorf("downloaded=%v loaded=%v, want 3 and 1", got["downloaded"], got["loaded"])
+	}
+	if got["disk"] != float64(6*1073741824) {
+		t.Errorf("disk = %v, want the sum of the three recorded sizes", got["disk"])
+	}
+	text, _ := got["text"].(string)
+	for _, want := range []string{"3 models downloaded, 1 loaded", "6.0 GB on disk, 200.0 GB free", "memory: 1.2 GB of 100.0 GB budget resident"} {
+		if !regexp.MustCompile(regexp.QuoteMeta(want)).MatchString(text) {
+			t.Errorf("text %q does not say %q", text, want)
+		}
+	}
+}
+
+// Memory still on its way out is part of the resident figure and named.
+func TestTheRollUpNamesTheExitingPart(t *testing.T) {
+	got := summary(t, `{"models": [], "resident": [],
+		"machine": {"budget": 107374182400, "resident_bytes": 4294967296, "exiting_bytes": 4294967296, "stuck_servers": 1}}`)
+	text, _ := got["text"].(string)
+	for _, want := range []string{"4.0 GB of 100.0 GB budget resident", "of which 4.0 GB still exiting", "1 server stuck"} {
+		if !regexp.MustCompile(regexp.QuoteMeta(want)).MatchString(text) {
+			t.Errorf("text %q does not say %q", text, want)
+		}
+	}
+	if got["exiting"] != float64(4294967296) {
+		t.Errorf("exiting = %v", got["exiting"])
+	}
+}
+
+// The card shows both windows when the served one is below the declared,
+// the served one resolved the fold-aware way, and no window at all — never
+// zero — for a model that declares none.
+func TestTheCardShowsBothWindowsFoldAwareAndNeverZero(t *testing.T) {
+	label := func(model, config string) string {
+		v := evalPanelValue(t, "({text: contextLabel("+model+", "+config+")})", "tokensLabel", "foldRepoID", "servedContext", "contextLabel")
+		s, _ := v["text"].(string)
+		return s
+	}
+	if got := label(`{"repo_id":"org/m","context_length":131072}`, `{"models":{"Org/M":{"served_context":65536}}}`); got != "context 128K declared · 64K served" {
+		t.Errorf("both windows: %q", got)
+	}
+	if got := label(`{"repo_id":"org/m","context_length":131072}`, `{}`); got != "max context 128K" {
+		t.Errorf("declared only: %q", got)
+	}
+	if got := label(`{"repo_id":"org/m","context_length":0}`, `{"models":{"org/m":{"served_context":65536}}}`); got != "" {
+		t.Errorf("no declared window: %q, want nothing", got)
+	}
+	if got := label(`{"repo_id":"org/m"}`, `{}`); got != "" {
+		t.Errorf("no context at all: %q, want nothing", got)
+	}
+}
+
+// The roll-up is drawn from the snapshot on every models render, into the
+// block at the head of the tab.
+func TestTheRollUpIsDrawnAtTheHeadOfTheModelsTab(t *testing.T) {
+	src := readPanelSource(t)
+	if !regexp.MustCompile(`\$\('resources'\)\.textContent = resourcesSummary\(state\)\.text`).MatchString(src) {
+		t.Error("renderModels no longer draws the roll-up")
+	}
+}
diff --git a/internal/ui/selftest_test.go b/internal/ui/selftest_test.go
new file mode 100644
index 00000000..0aa8f32d
--- /dev/null
+++ b/internal/ui/selftest_test.go
@@ -0,0 +1,54 @@
+package ui
+
+import (
+	"regexp"
+	"testing"
+)
+
+// The self-test switch is one setting on three surfaces — config.json, the
+// Go loop, and this pane — and the pane is held to the other two here: it
+// fills the box from the key the file carries and posts it back under the
+// same key, so what the operator ticks is what the loop reads.
+func TestThePaneIsWiredToTheSelfTestSwitch(t *testing.T) {
+	src := readPanelSource(t)
+	for _, want := range []*regexp.Regexp{
+		regexp.MustCompile(`self_test:\s*\$\('setSelfTest'\)\.checked`),
+		regexp.MustCompile(`\$\('setSelfTest'\)\.checked\s*=\s*!!c\.self_test`),
+		regexp.MustCompile(`\$\('setSelfTest'\)\.addEventListener\('change'`),
+	} {
+		if !want.MatchString(src) {
+			t.Errorf("the control panel no longer matches %s — that behavior is then asserted by nothing", want)
+		}
+	}
+}
+
+// The results reach the tab on the tab's own cadence, from the endpoint that
+// serves them, and every figure in a row is drawn from the run it names.
+func TestTheStatisticsTabShowsTheSelfTestResults(t *testing.T) {
+	src := readPanelSource(t)
+	for _, want := range []*regexp.Regexp{
+		regexp.MustCompile(`renderSelfTest\(await api\('/api/selftest'\)\)`),
+		regexp.MustCompile(`\bselfTestRow\(`),
+	} {
+		if !want.MatchString(src) {
+			t.Errorf("the control panel no longer matches %s — that behavior is then asserted by nothing", want)
+		}
+	}
+	run := `{"kind":"run","model":"org/a","at":1788696000,"outcome":"ok","cold_load":true,"load_ms":12345,` +
+		`"tests":[{"name":"pp512","parallel":1,"prompt_tokens_per_sec":812.5},` +
+		`{"name":"tg128","parallel":1,"first_token_ms":210,"tokens_per_sec":41.3},` +
+		`{"name":"tg128x4","parallel":4,"tokens_per_sec":120.8}]}`
+	got := evalPanelValue(t, "selfTestRow("+run+")", "selfTestRow")
+	for field, want := range map[string]string{
+		"model": "org/a", "outcome": "ok", "load": "12.3 s",
+		"promptRead": "812.5 tok/s", "firstToken": "210 ms", "generation": "41.3 tok/s", "underLoad": "120.8 tok/s ×4",
+	} {
+		if got[field] != want {
+			t.Errorf("%s = %v, want %q", field, got[field], want)
+		}
+	}
+	yielded := evalPanelValue(t, `selfTestRow({"model":"org/b","at":0,"outcome":"yielded","cold_load":false,"load_ms":3,"tests":[]})`, "selfTestRow")
+	if yielded["outcome"] != "yielded to a request" || yielded["load"] != "already loaded" || yielded["promptRead"] != "" {
+		t.Errorf("yielded row = %v", yielded)
+	}
+}
diff --git a/internal/ui/static/app.js b/internal/ui/static/app.js
index 3bd38e60..cc700360 100644
--- a/internal/ui/static/app.js
+++ b/internal/ui/static/app.js
@@ -44,10 +44,24 @@ function size(n) { return n ? bytes(n) : '0 B'; }
 // a reader sizing a prompt from the card. The result is composed from a
 // number, so it is safe in the innerHTML the card is built from; anything
 // that is not a positive number gives no label at all.
-function contextLabel(m) {
+// tokensLabel writes a token count the way the cards do: whole kibitokens
+// above a thousand, the figure itself below.
+function tokensLabel(n) {
+  return n >= 1024 ? `${Math.floor(n / 1024)}K` : String(n);
+}
+
+// contextLabel is the card's word on the model's windows: the declared one,
+// and the served one when the operator has set it below. A model that
+// declares none gets no label, never a zero. The served window is resolved
+// the fold-aware way every other reader resolves it.
+function contextLabel(m, config) {
   const n = m.context_length;
   if (typeof n !== 'number' || !Number.isFinite(n) || n <= 0) return '';
-  return `max context ${n >= 1024 ? `${Math.floor(n / 1024)}K` : n}`;
+  const served = servedContext(config, m.repo_id, n);
+  if (served > 0 && served < n) {
+    return `context ${tokensLabel(n)} declared · ${tokensLabel(served)} served`;
+  }
+  return `max context ${tokensLabel(n)}`;
 }
 
 // modelInfoLine is the whole info line of a model's card: what it says
@@ -55,16 +69,54 @@ function contextLabel(m) {
 // function of the model, so the panel's one piece of real logic can be
 // tested without a DOM (see panel_test.go); renderModels does nothing with
 // it but place the string it returns.
-function modelInfoLine(m) {
+function modelInfoLine(m, config) {
   if (m.state === 'downloading') {
     const of = m.size_bytes ? ` of ${bytes(m.size_bytes)}` : '';
     return `downloading… ${m.progress.toFixed(0)}%${of}`;
   }
   if (m.state === 'failed') return escapeHtml(m.err || 'failed');
-  const ctx = contextLabel(m);
+  const ctx = contextLabel(m, config);
   return ctx ? `${bytes(m.bytes)} · ${ctx}` : bytes(m.bytes);
 }
 
+// resourcesSummary adds up what the Models tab already knows, from the state
+// snapshot alone — no walk, no second reader: how many models are downloaded
+// and loaded, the disk they take against what the volume has left, and the
+// memory budget against what is resident, naming the part still exiting. A
+// pure function of the snapshot, so a test can hold every figure.
+function resourcesSummary(state) {
+  const st = state || {};
+  const models = st.models || [];
+  const resident = st.resident || [];
+  const machine = st.machine || {};
+  const ready = models.filter((m) => m.state === 'ready');
+  const loaded = resident.filter((r) => r.state === 'loaded').length;
+  const loading = resident.filter((r) => r.state === 'loading').length;
+  const disk = ready.reduce((sum, m) => sum + (m.bytes || 0), 0);
+  const out = {
+    downloaded: ready.length, loaded, loading, disk,
+    freeDisk: machine.free_disk || 0,
+    budget: machine.budget || 0,
+    resident: machine.resident_bytes || 0,
+    exiting: machine.exiting_bytes || 0,
+    stuck: machine.stuck_servers || 0,
+  };
+  const parts = [];
+  parts.push(`${out.downloaded} model${out.downloaded === 1 ? '' : 's'} downloaded, ${out.loaded} loaded` +
+    (out.loading ? `, ${out.loading} loading` : ''));
+  if (out.downloaded > 0) {
+    parts.push(`${bytes(out.disk)} on disk` + (out.freeDisk ? `, ${bytes(out.freeDisk)} free` : ''));
+  }
+  if (out.budget > 0) {
+    let mem = `memory: ${bytes(out.resident)} of ${bytes(out.budget)} budget resident`;
+    if (out.exiting > 0) mem += `, of which ${bytes(out.exiting)} still exiting`;
+    if (out.stuck > 0) mem += ` (${out.stuck} server${out.stuck === 1 ? '' : 's'} stuck)`;
+    parts.push(mem);
+  }
+  out.text = parts.join(' · ');
+  return out;
+}
+
 async function api(path, opts) {
   const res = await fetch(path, opts);
   const text = await res.text();
@@ -213,6 +265,7 @@ function waitingLine(waiting) {
 }
 
 function renderModels() {
+  $('resources').textContent = resourcesSummary(state).text;
   const list = $('modelList');
   // Live state, drawn here rather than in Settings, which stops redrawing
   // while the form is being edited.
@@ -244,12 +297,14 @@ function renderModels() {
     const pinText = pinLabel(m, pinned, loaded);
     if (pinText) pill += `<span class="pill pinned">${pinText}</span>`;
 
-    const info = modelInfoLine(m);
+    const info = modelInfoLine(m, state.config);
+    const measured = measurementText(m, state.idle_jobs, state.probe_queue);
 
     card.innerHTML = `
       <div class="meta">
         <div class="name">${escapeHtml(m.repo_id)}${pill}</div>
         <div class="info">${info}</div>
+        ${measured ? `<div class="info measured">${escapeHtml(measured)}</div>` : ''}
         ${m.state === 'downloading'
           ? `<div class="bar"><i style="width:${m.progress}%"></i></div>` : ''}
       </div>
@@ -274,6 +329,17 @@ function renderModels() {
             postModel('/api/models/unload', m.repo_id).catch(alertErr))
         : btn('Load', 'ghost', () =>
             postModel('/api/models/load', m.repo_id).catch(alertErr)));
+      // The context probe: one run whatever the switch says, and adoption of
+      // a current figure as the served window. A model that declares no
+      // window has nothing to measure between.
+      if (m.context_length > 0) {
+        actions.append(btn('Measure now', 'ghost', () =>
+          postModel('/api/models/measure', m.repo_id).catch(alertErr)));
+      }
+      if (m.measured && !m.measured.stale) {
+        actions.append(btn('Use this window', 'ghost', () =>
+          postModel('/api/models/adopt', m.repo_id).catch(alertErr)));
+      }
       // A ready model is real data, so require a deliberate second click.
       actions.append(confirmBtn('Delete', 'Confirm?', 'danger', () =>
         postModel('/api/models/delete', m.repo_id).catch(alertErr)));
@@ -282,6 +348,55 @@ function renderModels() {
   });
 }
 
+// boundText says what stopped the probe's step above the measured window,
+// in words: the model's own limit, or one of Gropius's bounds, in which case
+// the figure is a floor.
+function boundText(bound) {
+  switch (bound) {
+    case 'model': return 'the model refused above this: its own limit here';
+    case 'prefill_deadline': return 'a floor: the prefill deadline stopped the probe first';
+    case 'served_window': return 'a floor: the served window stopped the probe first';
+    case 'memory_guard': return 'a floor: the memory guard stopped the probe first';
+    default: return '';
+  }
+}
+
+// staleText names why a measurement no longer holds.
+function staleText(stale) {
+  switch (stale) {
+    case 'runtime': return 'the runtime changed';
+    case 'budget': return 'the memory budget changed';
+    case 'decode_concurrency': return 'the decode concurrency changed';
+    case 'served_context': return 'the served window changed';
+    default: return 'settings changed';
+  }
+}
+
+// measurementText is the card's line about the context probe: the run in
+// progress or what held it back, else the measurement and its bound, else
+// that a probe was interrupted, else nothing. A pure function a test holds.
+function measurementText(m, jobs, queue) {
+  const j = jobs || {};
+  const same = (a, b) => (a || '').toLowerCase() === (b || '').toLowerCase();
+  if (j.job === 'context-probe' && same(j.model, m.repo_id)) {
+    return `Measuring: ${j.step || 'starting'}`;
+  }
+  const queued = (queue || []).some((q) => same(q, m.repo_id)) || same(j.due, m.repo_id);
+  if (queued) {
+    const held = { in_flight: 'a request is in flight', waiting: 'a caller is waiting for a model',
+      downloading: 'a download is running', recent: 'a request was served recently' }[j.held_by];
+    return held ? `Measurement waiting: ${held}` : 'Measurement queued for the next idle minute';
+  }
+  const mm = m.measured;
+  if (mm) {
+    const tokens = `${mm.window.toLocaleString()} tokens`;
+    if (mm.stale) return `Measured ${tokens}, now stale: ${staleText(mm.stale)}; measure again`;
+    return `Measured ${tokens} — ${boundText(mm.bound)}`;
+  }
+  if (m.probe_incomplete) return 'Measurement incomplete: the last probe was interrupted; press Measure now to run it again';
+  return '';
+}
+
 function btn(label, cls, onClick) {
   const b = document.createElement('button');
   b.textContent = label;
@@ -674,6 +789,18 @@ function postureLines(state) {
     reads: ['config.statistics', 'config.stats_months', 'config.stats_max_bytes',
       'stats_store.refused', 'stats_store.oldest', 'stats_store.bytes', 'stats_store.files', 'stats_store.stalled'] });
 
+  // The self-test loads models on its own while the Mac is idle, which is a
+  // thing that can be on; the page says so from the setting, which applies
+  // the moment it is saved.
+  const selfTest = c.self_test
+    ? 'The self-test is on: while nothing has asked this Mac for a model for five minutes and ' +
+      'nothing is downloading, Gropius loads one of its models at a time where it fits beside ' +
+      'what is loaded, measures it with a fixed set of prompts, and unloads what it loaded. A request ' +
+      'from anyone ends the run. The figures go to a file in this account\'s Gropius data folder and ' +
+      'hold no prompt and no answer.'
+    : 'The self-test is off: Gropius loads no model on its own.';
+  lines.push({ id: 'selftest', heading: 'Self-test', text: selfTest, reads: ['config.self_test'] });
+
   return lines;
 }
 
@@ -892,6 +1019,9 @@ function renderSettings() {
   const rule = c.chat_rule || {};
   $('setChatPipelines').value = (rule.pipeline_tags || []).join(', ');
   $('setChatTags').value = (rule.required_tags || []).join(', ');
+  $('setContextProbe').checked = !!c.context_probe;
+  $('setIdleThreshold').value = c.idle_threshold_sec || '';
+  $('setSelfTest').checked = !!c.self_test;
   $('setStats').checked = !!c.statistics;
   $('setStatsMonths').value = c.stats_months;
   // Typed in megabytes and stored in bytes, which is how every other size in
@@ -1374,6 +1504,9 @@ $('ovApply').addEventListener('click', () => {
   renderOverrides();
 });
 
+$('setContextProbe').addEventListener('change', () => { settingsTouched = true; });
+$('setIdleThreshold').addEventListener('input', () => { settingsTouched = true; });
+$('setSelfTest').addEventListener('change', () => { settingsTouched = true; });
 $('setStats').addEventListener('change', () => { settingsTouched = true; });
 $('setGrace').addEventListener('change', () => { settingsTouched = true; });
 $('setAdvertise').addEventListener('change', () => { settingsTouched = true; });
@@ -1497,6 +1630,10 @@ $('settingsForm').addEventListener('submit', async (e) => {
     eviction_grace_sec:    parseInt($('setGraceSec').value, 10) || 0,
     eviction_max_wait_sec: parseInt($('setGraceWait').value, 10) || 0,
     chat_rule:          chatRule($('setChatPipelines').value, $('setChatTags').value),
+    context_probe:      $('setContextProbe').checked,
+    // Blank posts zero, which the server reads as the default.
+    idle_threshold_sec: parseInt($('setIdleThreshold').value, 10) || 0,
+    self_test:          $('setSelfTest').checked,
     statistics:         $('setStats').checked,
     stats_months:       parseInt($('setStatsMonths').value, 10) || 6,
     stats_max_bytes:    (parseInt($('setStatsMB').value, 10) || 200) * 1024 * 1024,
@@ -1562,6 +1699,61 @@ async function refreshStats() {
     // A panel that cannot reach its own server already says "disconnected" at
     // the top; a second alert about it would be noise.
   }
+  // On the same tick, never a timer of its own: the self-test's file changes
+  // at most once a run, and one cadence for the tab is one cadence to reason
+  // about.
+  try {
+    renderSelfTest(await api('/api/selftest'));
+  } catch {
+    // As above.
+  }
+}
+
+// selfTestRow flattens one run into the figures the table shows, each a
+// string ready to print, so the row is a pure function a test can hold.
+function selfTestRow(run) {
+  const tests = {};
+  for (const t of run.tests || []) tests[t.name] = t;
+  const pp = tests.pp512;
+  const tg = tests.tg128;
+  const batch = Object.values(tests).find((t) => t.parallel > 1);
+  const outcome = run.outcome === 'ok' ? 'ok'
+    : run.outcome === 'yielded' ? 'yielded to a request'
+      : run.outcome === 'stopped' ? 'stopped'
+        : `failed (${run.reason || 'unknown'})`;
+  return {
+    model: run.model,
+    measured: new Date(run.at * 1000).toLocaleString(),
+    outcome,
+    load: run.cold_load ? `${(run.load_ms / 1000).toFixed(1)} s` : 'already loaded',
+    promptRead: pp ? `${pp.prompt_tokens_per_sec} tok/s` : '',
+    firstToken: tg ? `${tg.first_token_ms} ms` : '',
+    generation: tg ? `${tg.tokens_per_sec} tok/s` : '',
+    underLoad: batch ? `${batch.tokens_per_sec} tok/s ×${batch.parallel}` : '',
+  };
+}
+
+function renderSelfTest(view) {
+  const on = !!(view && view.enabled);
+  const latest = (view && view.latest) || [];
+  $('selftestHint').textContent = on
+    ? (latest.length ? 'On. Gropius measures a model whenever this Mac has been idle for five minutes.'
+      : 'On. Nothing measured yet: the first run starts once this Mac has been idle for five minutes.')
+    : (latest.length ? 'Off. These are the runs from when it was on; turn it on in Settings to measure again.'
+      : 'Off. Turn on Test the models when this Mac is idle in Settings to measure your models.');
+  $('selftestBody').hidden = latest.length === 0;
+  const rows = $('selftestRows');
+  rows.replaceChildren();
+  for (const run of latest) {
+    const r = selfTestRow(run);
+    const tr = document.createElement('tr');
+    for (const cell of [r.model, r.measured, r.outcome, r.load, r.promptRead, r.firstToken, r.generation, r.underLoad]) {
+      const td = document.createElement('td');
+      td.textContent = cell;
+      tr.appendChild(td);
+    }
+    rows.appendChild(tr);
+  }
 }
 
 function renderStats(view) {
@@ -1814,7 +2006,8 @@ function renderHistory(h) {
   // it, and saying "nothing was recorded" over the top of it would deny the
   // records it is drawn from.
   const anything = days.length > 0 || (h.latency || []).length > 0
-    || (h.hours || []).some((x) => x.evictions || x.loads);
+    || (h.hours || []).some((x) => x.evictions || x.loads)
+    || (h.prompt_sizes || []).length > 0 || (h.footprints || []).length > 0;
   $('statsHistoryBusy').hidden = true;
   $('statsHistoryBody').hidden = !anything;
   $('statsHistoryEmpty').hidden = anything;
@@ -1834,6 +2027,106 @@ function renderHistory(h) {
   $('statsSpreadRows').innerHTML = latency.map(spreadRowHtml).join('');
 
   $('statsHoursRows').innerHTML = (h.hours || []).map(hourRowHtml).join('');
+
+  $('statsSizesRows').innerHTML = (h.prompt_sizes || []).map(sizesRowHtml).join('');
+  $('statsOverridesRows').innerHTML = (h.overrides || []).map(overridesRowHtml).join('');
+  $('statsFootprintRows').innerHTML = (h.footprints || []).map(footprintRowHtml).join('');
+}
+
+// sizesRow is one model's prompts against its served window: the two
+// windows, the count, the four bands and the refused, the largest seen. A
+// pure function a test holds.
+function sizesRow(p) {
+  const b = p.buckets || [0, 0, 0, 0, 0];
+  return {
+    model: p.model || '—',
+    declared: p.declared_context ? tokensLabel(p.declared_context) : '—',
+    served: p.served_context ? tokensLabel(p.served_context) : '—',
+    requests: p.requests || 0,
+    bands: [b[0] || 0, b[1] || 0, b[2] || 0, b[3] || 0],
+    refused: p.refused_for_size || 0,
+    largest: p.largest_estimate ? tokensLabel(p.largest_estimate) : '—',
+  };
+}
+
+function sizesRowHtml(p) {
+  const r = sizesRow(p);
+  return `<tr>
+      <td>${escapeHtml(r.model)}</td>
+      <td class="figure">${escapeHtml(r.declared)}</td>
+      <td class="figure">${escapeHtml(r.served)}</td>
+      <td class="figure">${figure(r.requests)}</td>
+      ${r.bands.map((n) => `<td class="figure">${figure(n)}</td>`).join('')}
+      <td class="figure">${figure(r.refused)}</td>
+      <td class="figure">${escapeHtml(r.largest)}</td>
+    </tr>`;
+}
+
+// overridesRow is how often one model's clients set each parameter, as a
+// share of its requests.
+function overridesRow(o) {
+  const by = o.by_parameter || {};
+  const n = o.requests || 0;
+  const pct = (k) => (n > 0 ? `${Math.round(((by[k] || 0) * 100) / n)}%` : '—');
+  return {
+    model: o.model || '—', requests: n,
+    temperature: pct('temperature'), top_p: pct('top_p'), top_k: pct('top_k'), min_p: pct('min_p'), max_tokens: pct('max_tokens'),
+  };
+}
+
+function overridesRowHtml(o) {
+  const r = overridesRow(o);
+  return `<tr>
+      <td>${escapeHtml(r.model)}</td>
+      <td class="figure">${figure(r.requests)}</td>
+      <td class="figure">${r.temperature}</td>
+      <td class="figure">${r.top_p}</td>
+      <td class="figure">${r.top_k}</td>
+      <td class="figure">${r.min_p}</td>
+      <td class="figure">${r.max_tokens}</td>
+    </tr>`;
+}
+
+// sparkline draws a series as one character per point, eight heights from
+// the lowest to the highest, so the line over the range is on the page and
+// not only in the figures.
+function sparkline(points) {
+  const bars = '▁▂▃▄▅▆▇█';
+  const pts = points || [];
+  if (pts.length === 0) return '';
+  let lo = Infinity; let hi = 0;
+  pts.forEach((p) => { if (p.bytes < lo) lo = p.bytes; if (p.bytes > hi) hi = p.bytes; });
+  const span = hi - lo;
+  return pts.map((p) => bars[span > 0 ? Math.min(7, Math.floor(((p.bytes - lo) * 8) / span)) : 4]).join('');
+}
+
+// footprintRow folds one model's series into the figures a table can carry:
+// how many points, the lowest, the highest, the latest, and the line itself.
+function footprintRow(f) {
+  const pts = f.points || [];
+  let lo = 0; let hi = 0;
+  pts.forEach((p) => {
+    if (!lo || p.bytes < lo) lo = p.bytes;
+    if (p.bytes > hi) hi = p.bytes;
+  });
+  return {
+    model: f.model || '—', samples: pts.length,
+    lowest: pts.length ? bytes(lo) : '—', highest: pts.length ? bytes(hi) : '—',
+    latest: pts.length ? bytes(pts[pts.length - 1].bytes) : '—',
+    line: sparkline(pts),
+  };
+}
+
+function footprintRowHtml(f) {
+  const r = footprintRow(f);
+  return `<tr>
+      <td>${escapeHtml(r.model)}</td>
+      <td class="figure">${figure(r.samples)}</td>
+      <td class="figure">${escapeHtml(r.lowest)}</td>
+      <td class="figure">${escapeHtml(r.highest)}</td>
+      <td class="figure">${escapeHtml(r.latest)}</td>
+      <td class="spark">${escapeHtml(r.line)}</td>
+    </tr>`;
 }
 
 // historyBoundsLine says what the figures cover and what they were held to,
diff --git a/internal/ui/static/index.html b/internal/ui/static/index.html
index 57bb23f4..5578428c 100644
--- a/internal/ui/static/index.html
+++ b/internal/ui/static/index.html
@@ -57,6 +57,7 @@ <h1>Gropius</h1>
 
 <!-- ── My Models ─────────────────────────────────────────── -->
 <section id="tab-models" class="panel active">
+  <p id="resources" class="figures"></p>
   <p id="graceQueue" class="hint" hidden></p>
   <div id="modelList"></div>
   <div id="modelsEmpty" class="empty" hidden>
@@ -77,6 +78,23 @@ <h1>Gropius</h1>
 
 <!-- ── Statistics ────────────────────────────────────────── -->
 <section id="tab-stats" class="panel">
+  <h2>Self-test</h2>
+  <p class="hint" id="selftestHint"></p>
+  <div id="selftestBody" hidden>
+    <div class="scroll">
+      <table id="selftestTable">
+        <thead>
+          <tr><th>Model</th><th>Measured</th><th>Outcome</th><th>Load</th>
+            <th>Prompt read</th><th>First token</th><th>Generation</th><th>Under load</th></tr>
+        </thead>
+        <tbody id="selftestRows"></tbody>
+      </table>
+    </div>
+    <p class="hint">The latest run for each model. Prompt read is pp512's prompt tokens a second;
+      first token and generation are tg128's; under load is the concurrent test's tokens a second
+      for the whole batch. Times are this Mac's. The prompts are fixed and are not recorded, so
+      none can be shown.</p>
+  </div>
   <div id="statsOff" class="empty" hidden>
     <p><strong>Gropius is not recording anything.</strong></p>
     <p>Turn on <em>Record request statistics on this Mac</em> in
@@ -144,6 +162,39 @@ <h3>Time to first token, spread</h3>
           <tbody id="statsSpreadRows"></tbody>
         </table>
       </div>
+      <h3>Prompts against the served window</h3>
+      <div class="scroll">
+        <table id="statsSizesTable">
+          <thead>
+            <tr><th>Model</th><th>Declared</th><th>Served</th><th>Requests</th>
+              <th>Up to ¼</th><th>Up to ½</th><th>Up to ¾</th><th>Up to the window</th>
+              <th>Refused as too large</th><th>Largest prompt</th></tr>
+          </thead>
+          <tbody id="statsSizesRows"></tbody>
+        </table>
+      </div>
+      <h3>Sampling overrides</h3>
+      <div class="scroll">
+        <table id="statsOverridesTable">
+          <thead>
+            <tr><th>Model</th><th>Requests</th><th>Temperature</th><th>Top-p</th>
+              <th>Top-k</th><th>Min-p</th><th>Max tokens</th></tr>
+          </thead>
+          <tbody id="statsOverridesRows"></tbody>
+        </table>
+      </div>
+      <h3>Memory over time</h3>
+      <div class="scroll">
+        <table id="statsFootprintTable">
+          <thead>
+            <tr><th>Model</th><th>Samples</th><th>Lowest</th><th>Highest</th><th>Latest</th><th>Over the range</th></tr>
+          </thead>
+          <tbody id="statsFootprintRows"></tbody>
+        </table>
+      </div>
+      <p class="hint">Memory is the model server's own footprint, sampled every thirty seconds and averaged
+        into at most two hundred points across the range: what the server was holding, not what any one
+        request cost.</p>
       <h3>Evictions and reloads by hour</h3>
       <div class="scroll">
         <table id="statsHoursTable">
@@ -384,6 +435,50 @@ <h2>Where this server stands</h2>
       <button type="button" id="ovApply" class="ghost">Set override</button>
     </fieldset>
 
+    <fieldset class="group">
+      <legend>Context probe</legend>
+      <label class="switch">
+        <input id="setContextProbe" type="checkbox">
+        <span>Measure each model&rsquo;s context window when this Mac is idle</span>
+      </label>
+      <p class="hint">Off unless you turn it on. While it is on, whenever this Mac has been idle for the
+        threshold below, Gropius takes one model with no current measurement, sends it prompts of
+        growing length through its own endpoint, bisects to the largest the server accepts, and
+        records the window beside the one the model declares. A measurement changes nothing
+        until you press <strong>Use this window</strong> on the model&rsquo;s card. It costs about
+        forty minutes of GPU per model, never pushes another model out to make room, and stands
+        down the moment anyone sends a request. Each model&rsquo;s card also has
+        <strong>Measure now</strong>, which runs one probe whatever this box says. The
+        <a href="https://github.com/intentdriven/Gropius/blob/main/docs/context-probe.md">context
+        probe page</a> says what the figure means and what it costs.</p>
+      <label>
+        <span>Idle threshold (seconds)</span>
+        <input id="setIdleThreshold" type="number" step="1" min="60" max="3600" placeholder="300">
+      </label>
+      <p class="hint">How long the last request must be in the past before the Mac counts as idle,
+        for the context probe and the self-test alike. Blank is five minutes.</p>
+    </fieldset>
+
+    <fieldset class="group">
+      <legend>Self-test</legend>
+      <label class="switch">
+        <input id="setSelfTest" type="checkbox">
+        <span>Test the models when this Mac is idle</span>
+      </label>
+      <p class="hint">Off unless you turn it on. While it is on, whenever nothing has asked this Mac
+        for a model for five minutes and nothing is downloading, Gropius loads one of your
+        models, runs the same short set of tests against it &mdash; how long the load takes,
+        how fast it reads a long prompt, how fast it generates, and what that becomes when
+        several requests arrive at once &mdash; writes one line of figures to a file in your
+        Gropius data folder, and unloads the model again if it was not already loaded. Each
+        model is measured once a day, and never at the cost of another: a model that would need
+        one pushed out to make room waits for a time when there is room. A request from anyone
+        ends the run at once. The file holds counts and timings only, never a prompt or an
+        answer, and nothing in it leaves this Mac. The
+        <a href="https://github.com/intentdriven/Gropius/blob/main/docs/self-test.md">self-test
+        page</a> says what it costs and where the file is.</p>
+    </fieldset>
+
     <fieldset class="group">
       <legend>Request statistics</legend>
       <label class="switch">

From de7472fbe0978e1bb34ac476a56385076c5c2d06 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Tue, 15 Sep 2026 08:49:47 +0100
Subject: [PATCH 2/2] chore: ship the four intents' records

The intent, spec, capture, decision and calibration records for the
self-test, the context probe, the resources view and usage measurement:
four intents to shipped/, four specs closed, three follow-up captures for
this lane, one resolved, the decision record superseding the statistics
store's record kinds, and the dated lines behind every choice.

Assisted-by: Claude:claude-fable-5-1
Claude-Session: https://claude.ai/code/session_01NU6NHFLGFYFuA1z4eqFz8j
---
 ...s-record-kinds-are-request-load-removed.md |   4 +-
 ...e-gains-a-fifth-record-kind-a-footprint.md |  76 +++++++++
 ...wly-downloaded-model-s-servable-context.md |   5 +-
 ...s-models-actually-do-so-the-settings-th.md |   3 +-
 ...ac-is-spending-on-gropius-a-resources-t.md |   3 +-
 ...n-models-while-nobody-is-using-it-alice.md |  97 +++++++++++
 .../2026-09-06-decomposition-calibration.md   |  23 +++
 ...s-models-actually-do-so-the-settings-th.md | 150 ++++++++++++++++++
 ...ac-is-spending-on-gropius-a-resources-t.md |  90 +++++++++++
 ...n-models-while-nobody-is-using-it-alice.md | 123 ++++++++++++++
 ...wly-downloaded-model-s-servable-context.md |  46 ++++--
 ...s-models-actually-do-so-the-settings-th.md |  12 --
 ...ac-is-spending-on-gropius-a-resources-t.md |  12 --
 .abcd/work/DECISIONS.md                       |   8 +
 ...its-own-bounded-json-lines-file-interna.md |  14 ++
 ...on-a-model-is-not-preemptible-with-evic.md |  14 ++
 ...lts-have-no-panel-view-the-switch-is-on.md |  22 +++
 ...-what-is-on-and-the-self-test-is-a-thin.md |  22 +++
 18 files changed, 678 insertions(+), 46 deletions(-)
 create mode 100644 .abcd/development/decisions/adrs/2609121450000000-the-statistics-store-gains-a-fifth-record-kind-a-footprint.md
 rename .abcd/development/intents/{planned => shipped}/itd-2609091301112705-gropius-measures-a-newly-downloaded-model-s-servable-context.md (96%)
 rename .abcd/development/intents/{planned => shipped}/itd-2609091712141073-gropius-shows-what-its-models-actually-do-so-the-settings-th.md (97%)
 rename .abcd/development/intents/{planned => shipped}/itd-2609091903463596-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md (97%)
 create mode 100644 .abcd/development/intents/shipped/itd-2609100457007827-gropius-tests-its-own-models-while-nobody-is-using-it-alice.md
 create mode 100644 .abcd/development/specs/closed/spc-2609091737253961-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
 create mode 100644 .abcd/development/specs/closed/spc-2609100450257929-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
 create mode 100644 .abcd/development/specs/closed/spc-2609100502029941-gropius-tests-its-own-models-while-nobody-is-using-it-alice.md
 rename .abcd/development/specs/{open => closed}/spc-2609112108142027-gropius-measures-a-newly-downloaded-model-s-servable-context.md (90%)
 delete mode 100644 .abcd/development/specs/open/spc-2609091737253961-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
 delete mode 100644 .abcd/development/specs/open/spc-2609100450257929-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
 create mode 100644 .abcd/work/issues/open/iss-2609100515478018-the-self-test-writes-its-own-bounded-json-lines-file-interna.md
 create mode 100644 .abcd/work/issues/open/iss-2609100526194406-the-self-test-s-hold-on-a-model-is-not-preemptible-with-evic.md
 create mode 100644 .abcd/work/issues/resolved/iss-2609100515475279-the-self-test-s-results-have-no-panel-view-the-switch-is-on.md
 create mode 100644 .abcd/work/issues/resolved/iss-2609100515484516-the-posture-page-says-what-is-on-and-the-self-test-is-a-thin.md

diff --git a/.abcd/development/decisions/adrs/2609090716413337-the-statistics-store-s-record-kinds-are-request-load-removed.md b/.abcd/development/decisions/adrs/2609090716413337-the-statistics-store-s-record-kinds-are-request-load-removed.md
index 0c5c87e4..3fe0d656 100644
--- a/.abcd/development/decisions/adrs/2609090716413337-the-statistics-store-s-record-kinds-are-request-load-removed.md
+++ b/.abcd/development/decisions/adrs/2609090716413337-the-statistics-store-s-record-kinds-are-request-load-removed.md
@@ -1,10 +1,10 @@
 ---
 id: adr-2609090716413337
 slug: the-statistics-store-s-record-kinds-are-request-load-removed
-status: accepted
+status: superseded
 date: 2026-09-09
 supersedes: adr-2609061610107154
-superseded_by: null
+superseded_by: adr-2609121450000000
 related_intents: [itd-2609061521102742, itd-2609061602043757]
 related_rfcs: []
 related_adrs: [adr-2609061610107154, adr-2609061503319212]
diff --git a/.abcd/development/decisions/adrs/2609121450000000-the-statistics-store-gains-a-fifth-record-kind-a-footprint.md b/.abcd/development/decisions/adrs/2609121450000000-the-statistics-store-gains-a-fifth-record-kind-a-footprint.md
new file mode 100644
index 00000000..98de5239
--- /dev/null
+++ b/.abcd/development/decisions/adrs/2609121450000000-the-statistics-store-gains-a-fifth-record-kind-a-footprint.md
@@ -0,0 +1,76 @@
+---
+id: adr-2609121450000000
+slug: the-statistics-store-gains-a-fifth-record-kind-a-footprint
+status: accepted
+date: 2026-09-12
+supersedes: adr-2609090716413337
+superseded_by: null
+related_intents: [itd-2609091712141073, itd-2609061521102742]
+related_rfcs: []
+related_adrs: [adr-2609090716413337, adr-2609061610107154, adr-2609061503319212]
+---
+
+# ADR-2609121450000000: The statistics store gains a fifth record kind, a footprint reading, and the request and load records gain the facts that decide a served window and a concurrency
+
+## Context
+
+adr-2609090716413337 ratified four record kinds: a request line, a load, a
+removal with one of seven reasons, and a settings record. The usage
+measurement intent (itd-2609091712141073) needs the facts that decide a
+served window and a decode concurrency — how prompts sat against the window,
+how many requests were in flight, which sampling values were in force and
+whether the client overrode them, and what the model server's memory did —
+and one of those, the memory, is not a fact about any request. It is a
+reading of a process, taken on a clock, and it needs a record of its own or
+the figure exists only as whatever value a completing request happened to
+see.
+
+This decision was taken by the agent on the maintainer's lane assignment of
+2026-09-12, under the instruction to decide autonomously and record; the
+record-kinds decision is architecture-shaping, which is why this is an ADR
+and not a line.
+
+## Decision
+
+We supersede adr-2609090716413337 on the record kinds, and adopt five:
+
+1. **A request line**, as before, gaining: the declared and served windows
+   the request was judged against, Gropius's own estimate of the prompt's
+   size (written for a refused request too), the model's in-flight count at
+   admission, the names — never the values — of the sampling parameters the
+   client set, and the server's footprint as last sampled before completion.
+2. **A load**, as before, gaining the sampling values the server was launched
+   with.
+3. **A removal**, unchanged.
+4. **A footprint reading** — `kind: "footprint"` — the model's repo id, when,
+   and the server process's resident memory in bytes, taken every thirty
+   seconds for each running server and reported through the pool's observer.
+5. **A settings record**, unchanged.
+
+Every new numeric is bounded at the recorder as the windows already are: a
+window past the registry's bound, a count past any batch, a footprint past
+any Mac, or an override name outside the closed set is dropped, never
+repaired. The override names are the one field derived from a client's body,
+and the reference page says so.
+
+## Alternatives Considered
+
+1. **Carry the footprint only on the request record.** Rejected: the figure
+   would exist only at the moments requests completed, which on a quiet
+   server is never, and the intent's criterion asks for a periodic record.
+2. **A separate file for the samples.** Rejected: the store is one
+   collection path under one switch and one retention rule
+   (adr-2609061610107154), and a second file would need a second of each.
+3. **Store the client's sampling values.** Rejected: adr-2609061503319212
+   draws the line at content the client sent; a name says which knob was
+   touched and nothing of what was asked.
+
+## Consequences
+
+- `internal/stats.StoreKinds` names seven kinds of line (five records plus
+  the two summary lines), and the reference page's table is held to it.
+- The summary a day folds into ignores footprint readings: a mean over a
+  day is not a figure anyone would size a setting from, and the series is
+  what the view draws.
+- The record size constant is re-measured over a record carrying every
+  field.
diff --git a/.abcd/development/intents/planned/itd-2609091301112705-gropius-measures-a-newly-downloaded-model-s-servable-context.md b/.abcd/development/intents/shipped/itd-2609091301112705-gropius-measures-a-newly-downloaded-model-s-servable-context.md
similarity index 96%
rename from .abcd/development/intents/planned/itd-2609091301112705-gropius-measures-a-newly-downloaded-model-s-servable-context.md
rename to .abcd/development/intents/shipped/itd-2609091301112705-gropius-measures-a-newly-downloaded-model-s-servable-context.md
index c4fc0f7d..4afdcbf6 100644
--- a/.abcd/development/intents/planned/itd-2609091301112705-gropius-measures-a-newly-downloaded-model-s-servable-context.md
+++ b/.abcd/development/intents/shipped/itd-2609091301112705-gropius-measures-a-newly-downloaded-model-s-servable-context.md
@@ -138,12 +138,13 @@ named bound rather than the architecture's limit.
 - **How the model's own window is ever learned.** A coordinated pool-side path exempt from the gateway's bounds, a raised `upstream_header_timeout_sec` for the duration, or the manual campaign script staying the only answer. Nothing here decides it.
 - **Whether the probe also samples memory**, which would keep `capability`'s safety factors of 5 and 7 under continuous evidence rather than one evening's. Out of scope here — that package belongs to another lane — and worth a follow-on.
 - **The idle threshold's value**, and how many models one idle window may take: six models at forty minutes each is an evening, and the models load one at a time.
-- **Arbitration with the model self-test**, which also runs at idle and is not yet on `main`. Two idle jobs on one Mac need one idea of "idle" between them, and whichever lands second inherits the question.
+- **Arbitration with the model self-test** — resolved 2026-09-12 at implementation: the self-test landed first and its loop is the one idle primitive; the probe is a `selftest.Job` it schedules, so idleness, yielding, the never-evict check, the held-back reason and the idle threshold (`idle_threshold_sec`) are decided once, in `internal/selftest`, for both.
 - **Whether the yielding seam becomes real preemption in the pool.** The pool has no preemption and no priority today; this intent reads the pool and cancels its own request instead. Any change to the pool itself is a coordinated follow-up with the lane that owns `internal/runtime`.
 
 ## Audit Notes
 
-_Empty. Populated by intent-auditor when intent moves to shipped/._
+<!-- abcd-review: OWED receipt=rcp-4431dce599cc -->
+Fidelity review OWED (receipt rcp-4431dce599cc).
 
 ## Grounds
 
diff --git a/.abcd/development/intents/planned/itd-2609091712141073-gropius-shows-what-its-models-actually-do-so-the-settings-th.md b/.abcd/development/intents/shipped/itd-2609091712141073-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
similarity index 97%
rename from .abcd/development/intents/planned/itd-2609091712141073-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
rename to .abcd/development/intents/shipped/itd-2609091712141073-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
index cd2d9081..ee3d235e 100644
--- a/.abcd/development/intents/planned/itd-2609091712141073-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
+++ b/.abcd/development/intents/shipped/itd-2609091712141073-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
@@ -67,7 +67,8 @@ per-request memory attribution the sample cannot give.
 
 ## Audit Notes
 
-_Empty. Populated by intent-auditor when intent moves to shipped/._
+<!-- abcd-review: OWED receipt=rcp-916dd6b8bf3f -->
+Fidelity review OWED (receipt rcp-916dd6b8bf3f).
 
 ## Grounds
 
diff --git a/.abcd/development/intents/planned/itd-2609091903463596-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md b/.abcd/development/intents/shipped/itd-2609091903463596-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
similarity index 97%
rename from .abcd/development/intents/planned/itd-2609091903463596-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
rename to .abcd/development/intents/shipped/itd-2609091903463596-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
index 44fbf8c2..cf5ebf43 100644
--- a/.abcd/development/intents/planned/itd-2609091903463596-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
+++ b/.abcd/development/intents/shipped/itd-2609091903463596-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
@@ -63,7 +63,8 @@ needs a directory walk or a second reader.
 
 ## Audit Notes
 
-_Empty. Populated by intent-auditor when intent moves to shipped/._
+<!-- abcd-review: OWED receipt=rcp-81fed0a81798 -->
+Fidelity review OWED (receipt rcp-81fed0a81798).
 
 ## Grounds
 
diff --git a/.abcd/development/intents/shipped/itd-2609100457007827-gropius-tests-its-own-models-while-nobody-is-using-it-alice.md b/.abcd/development/intents/shipped/itd-2609100457007827-gropius-tests-its-own-models-while-nobody-is-using-it-alice.md
new file mode 100644
index 00000000..886c88d8
--- /dev/null
+++ b/.abcd/development/intents/shipped/itd-2609100457007827-gropius-tests-its-own-models-while-nobody-is-using-it-alice.md
@@ -0,0 +1,97 @@
+---
+id: itd-2609100457007827
+slug: gropius-tests-its-own-models-while-nobody-is-using-it-alice
+spec_id: spc-2609100502029941
+kind: standalone
+suggested_kind: null
+reclassification_history: []
+builds_on: [itd-2609091301112705, itd-2609061521082551]
+severity: minor
+impact: additive
+origin: researcher-authored
+production_mode: dictated-and-formatted
+---
+
+# Gropius tests its own models while nobody is using it. Alice switches on the self-test in Settings; whenever her Mac is idle, Gropius loads each downloaded model in turn, runs the same standard set of tests against it, unloads it, and records what it measured, so that the numbers she sizes a model's settings from come from her own Mac rather than from someone else's benchmark. The runs never delay a real request and nothing leaves the machine.
+
+## Press Release
+
+Gropius now measures its own models, on your Mac, while nobody is using it.
+Alice ticks **Self-test when idle** in Settings and saves. That evening,
+once the last request is a few minutes old and nothing is downloading,
+Gropius loads the first of her models, runs the same short set of tests every
+model gets — how long a load takes, how fast a long prompt is read, how fast
+tokens come out, and what happens when four requests arrive at once — writes
+one line of figures to a file in her Gropius folder, and unloads the model if
+it was not resident before. Then the next model, and the next. In the morning
+the file holds one line per model, measured on her machine, and the number she
+sizes the served window and the concurrency from is hers rather than a
+stranger's. Bob's agent sending a request at midnight is never made to wait:
+the moment a real request arrives the run in progress is abandoned, marked as
+yielded, and the model is his. Nothing in the file is a prompt or an answer,
+and nothing in it leaves the Mac.
+
+## Why This Matters
+
+The 2026-09-06 model-bench campaign produced the numbers the memory budget and
+the served window are now designed from — and it was one person running a
+script by hand for an evening on one Mac, a record that goes stale with the
+next model, the next runtime or the next machine. The context-probe draft
+(itd-2609091301112705) automates one of those measurements; this is the
+harness that draft is one test of, and it refines it: the idle detection, the
+yielding to a real request and the rule against evicting a pinned model are
+the same costs, carried once. The usage dashboard (itd-2609091712141073)
+measures what real requests did; this measures what a model can do when asked
+the same thing as every other model, which is the comparison usage traffic
+never gives. The held draft itd-2609091712142715, settings that fit by
+themselves, is what these figures exist to feed; it is not part of this intent.
+
+## Mechanism
+
+We expect one line of figures per model per day to be enough to compare models
+and size their settings, because the four measurements are the ones the
+2026-09-06 campaign actually used to decide the budget and the window, and
+llama-bench's prompt-processing and text-generation pair has been the shared
+vocabulary for local inference numbers since 2023. Shown wrong if a setting the
+figures were meant to decide turns out to need a measurement not in the set, or
+if idle time on a serving Mac is too rare for a cycle to complete.
+
+## Scope Conditions
+
+- Apple Silicon macOS, one Mac, with the self-test switch on; off is the default and the same state as today. <!-- cond: cond-2609100502039780 -->
+- Idle means: no request in flight on any model, nobody waiting for a load, no download running, and the last request older than a quiet period. <!-- cond: cond-2609100502036756 -->
+- The self-test loads through the pool's ordinary Acquire path and never a second launcher, so the budget, the pins and the served window are the pool's own; and it never evicts, loading a model only when it fits beside what is resident. <!-- cond: cond-2609100502036640 -->
+- The pool has no preemption: yielding is the self-test cancelling its own request, not the pool taking the model away, so a real request can wait for one in-flight self-test request to be cancelled. <!-- cond: cond-2609100502034205 -->
+- The results file holds figures only, never a prompt or an answer; the test prompts are constants in the code, and no client's request is ever part of a run. <!-- cond: cond-2609100502035912 -->
+- Shared-cache mode records under the serving account's own data directory, at 0600; the models measured are every account's, since they are one set. <!-- cond: cond-2609100502031008 -->
+
+## Acceptance Criteria
+
+- Given the switch is off, when Gropius runs for any length of time, then no model is loaded by the self-test and no results file exists.
+- Given the switch is on and the Mac is idle, when a ready model has not been tested within the re-test window, then it is acquired through the pool, the standard set runs against it, and one line is appended to the results file.
+- Given a model was not resident before its run, when the run ends, then the model is unloaded; given it was resident, then it is left where it was.
+- Given a run is in progress, when a request from a client arrives on any model, or a client's load is refused for want of room, then the self-test's request or load is cancelled, the run is recorded as yielded, and the model is released.
+- Given a ready model that would need another evicted to load, when the tick fires, then it is not loaded, and it is measured once there is room.
+- Given a request is in flight, a load is waiting, or a download is running, when the tick fires, then nothing is loaded and nothing runs.
+- Given every ready model has been tested within the re-test window, when the tick fires, then nothing runs.
+- Given a results line, when it is read back, then it carries the model, when, the outcome, whether the load was cold, the load time, and for each test its name, token counts, time to first token, total time and tokens per second, and no field carries prompt or answer text.
+- Given the switch is turned off while a run is in progress, when the save applies, then the run is cancelled and the model released.
+- Given the results file reaches its size cap, when the next line is written, then the file is started again and the newest line is kept.
+- Given the switch, when Settings is rendered, then the panel offers it and posts it under the key config.json reads.
+- Given the docs, when the feature ships, then a how-to page says how to switch it on and what it costs, and a reference page names every field of a results line and where the file is.
+
+## Open Questions
+
+- Resolved 2026-09-10 at planning (delegated to the agent by the maintainer): the standard set is load, pp512, tg128 and tg128 at the decode concurrency; the names follow llama-bench so the figures can be compared with published ones.
+- Resolved 2026-09-10 at planning: results go to a single bounded JSON Lines file under the account's data directory rather than into the statistics store, because the store's schema is per-request and its writer is in another lane; folding it in is a follow-up.
+- Resolved 2026-09-10 at planning: no panel view of the results in this intent; the file is the surface, the panel has the switch. A results view is a follow-up.
+- Deferred: the re-test cadence is fixed at a day; whether it should be a setting is decided when someone wants a different one.
+
+## Audit Notes
+
+<!-- abcd-review: OWED receipt=rcp-750863424b6e -->
+Fidelity review OWED (receipt rcp-750863424b6e).
+
+## Grounds
+
+- pursued: we expect a per-model figure measured on the operator's own Mac, taken automatically, to replace the one-evening hand-run campaign as the source the settings are sized from; shown wrong if after a cycle the figures separate no setting choice, or if a serving Mac is never idle long enough for a cycle to complete. Planning delegated to the agent by the maintainer on 2026-09-10 as an experiment.
diff --git a/.abcd/development/research/notes/2026-09-06-decomposition-calibration.md b/.abcd/development/research/notes/2026-09-06-decomposition-calibration.md
index 9388740c..e8d389be 100644
--- a/.abcd/development/research/notes/2026-09-06-decomposition-calibration.md
+++ b/.abcd/development/research/notes/2026-09-06-decomposition-calibration.md
@@ -348,3 +348,26 @@ asset fetched from a CDN; the human did not confirm a reversal, so none is
 recorded and the question is held at the decision.
 
 Verdict adopted: SPLIT. Grade: routing survived as proposed.
+
+## 2026-09-10 — idle-time model self-test (itd-2609100457007827)
+
+Proposal: an autonomous state-of-the-art self-test and (later)
+self-optimisation environment: when activated it loads and unloads the
+available models, runs standard tests, captures all telemetry, and feeds the
+results into a self-optimisation setting.
+
+| Part | Type | Home |
+| --- | --- | --- |
+| Opt-in self-test: load each model when idle, run a standard set, unload, record | capability | this intent |
+| Self-optimisation from the results | capability, held | `duplicates` itd-2609091712142715, not filed twice |
+| What the self-test may record, and which opt-in gates it | ADR consequence | adr-2609061503319212 already scopes it; a scope condition on the draft |
+| Which tests are standard, which use cases | open questions | the draft, settled at planning |
+| Where the switch lives, how runs are recorded | mechanism | the spec |
+
+Typed links: `refines` itd-2609091301112705 (the probe is one test of this
+harness; the human chose refines over supersedes); `builds_on` the 2026-09-06
+model-bench campaign; `duplicates` itd-2609091712142715 for the second half.
+Flagged, not classified: "captures all telemetry" against the ADR's no-prompt
+rule — taken as a scope condition, not a reversal.
+Verdict adopted: SPLIT. Grade: routing survived the human's confirmation
+unchanged; the interview itself was delegated to the agent by the maintainer.
diff --git a/.abcd/development/specs/closed/spc-2609091737253961-gropius-shows-what-its-models-actually-do-so-the-settings-th.md b/.abcd/development/specs/closed/spc-2609091737253961-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
new file mode 100644
index 00000000..7d575394
--- /dev/null
+++ b/.abcd/development/specs/closed/spc-2609091737253961-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
@@ -0,0 +1,150 @@
+---
+id: spc-2609091737253961
+slug: gropius-shows-what-its-models-actually-do-so-the-settings-th
+intent: itd-2609091712141073
+origin: researcher-authored
+production_mode: dictated-and-formatted
+---
+# Usage measurement: what each request did, against the settings in force
+
+## Summary
+
+The request statistics record gains the facts that decide a served window and
+a concurrency — the prompt's size against the window the model declares and
+the window it serves, how many requests were in flight when it was admitted,
+which sampling values were in force and whether the client overrode them, and
+the model server's memory footprint at completion — and the load event gains
+the sampling values the server was launched with. A periodic sampler reads
+each model server's footprint. The Statistics tab shows, per model, the
+prompt-size distribution against both windows, the override rate and the
+footprint over time. Nothing in it is a prompt or an answer, nothing is
+exported, and the statistics reference page names every new field.
+
+Every fact already passes through the gateway or the pool where recording it
+costs one lookup; that is the intent's mechanism claim, and this design adds
+no new source of truth for any of them.
+
+## Scope
+
+In scope: new fields on `stats.Record` and `stats.Event`; a footprint sampler
+in `internal/runtime` (one reader of a process's resident memory, per launched
+server, at a fixed cadence, reported through the existing `Observer`); the
+gateway's `observation` filling the new request fields; the dashboard
+aggregates in `internal/stats` and their rendering on the Statistics tab;
+`docs/statistics-store-reference.md` and `docs/statistics-explained.md`; the
+re-measured `ApproxRecordBytes`; the changelog entry.
+
+Out of scope, each for its reason: an export button (resolved at interview —
+the aggregates-only rule of the statistics endpoint stands, and the reference
+page says where the files are); per-request memory attribution (the footprint
+is a periodic per-model sample joined by time, and the record says so by its
+name); storing any client-supplied sampling number (a per-parameter override
+flag is the one field derived from a client body, argued on the docs page);
+recording for the self-test's or the probe's own requests beyond what the
+pool's load and removal events already carry (they go to the model server
+directly and land in no request record).
+
+## Approach
+
+### The record
+
+`stats.Record` gains:
+
+| Field | Type | Where it comes from |
+| --- | --- | --- |
+| `declared_context` | int64 | the registry's `ContextLength` for the resolved model, at admission |
+| `served_context` | int64 | `config.ServedContext(model, declared)` at admission — the figure the refusal was judged against |
+| `estimated_prompt_tokens` | int | the gateway's own estimate (`estimatedTokens(bodyBytes)`), written for every request including one refused for size, so a refusal still carries how big the prompt was |
+| `requested_tokens` | int | the figure the served-window check judged: the estimate plus the answer asked for |
+| `in_flight` | int | the model's in-flight count at admission, reported by the pool on `AcquireStats` as the request takes its slot |
+| `overrides` | []string | the names of the sampling parameters the client set in its body, from the same parse the gateway already does for `max_tokens`; the values are never stored |
+| `footprint_bytes` | int64 | the model server's latest sampled footprint at completion, named as a sample, zero when the sampler has none yet |
+
+`stats.Event` gains, on a load:
+
+| Field | Type | Where it comes from |
+| --- | --- | --- |
+| `sampling` | the launch flags as `config.Sampling` | the `Spec` the launcher was handed (`SamplingFor` at launch) |
+
+And a third event kind, `footprint`, carrying `model`, `at` and `bytes`: the
+sampler's readings, so the footprint over time is in the store as a series
+rather than only as the value stitched onto a request. It is a fifth record
+kind, ratified by adr-2609121450000000, which supersedes
+adr-2609090716413337.
+
+The bounds every persisted numeric takes apply: a window beyond
+`MaxContextLength`, a negative count, an override name not in the closed set
+of sampling parameter names, or a footprint beyond the Mac's memory is
+dropped at the recorder, never written.
+
+### The sampler
+
+`internal/runtime` gains a footprint reader: the physical footprint as
+Activity Monitor and `top` report it — what a unified-memory Mac actually
+spends, and what the 2026-09-06 campaign sampled — read through `top -l 1`
+on the server's pid with a three-second deadline, because no unprivileged
+pure-Go reader of that figure exists (`proc_pid_rusage` needs cgo, and `ps`
+reports resident size, a different and smaller figure). The reader is an
+optional `Footprinter` interface on the launcher's process, so a process that
+cannot report one is simply never sampled. The pool samples every ready
+server every `FootprintInterval` (thirty seconds) off its own lock, reports
+each reading through an optional `FootprintObserver`, and holds the latest
+per entry for `Pool.Footprint`, which the gateway stitches onto a completing
+request. The sampler is the last thing the pool's close waits for, after the
+servers have been told to stop. The self-test's memory guard and the probe's
+may read the same latest figure later; nothing here depends on that.
+
+### The gateway
+
+The served-window check becomes `judgeServedContext`, which returns the
+figures it judged — the two windows, the prompt's estimate, and the judged
+figure (estimate plus the answer asked for) — so the record, the refusal and
+the dashboard's bands rest on one number; `observation.judged` records
+them, and `overrides(names []string)` the parameter names from the existing
+body parse. The in-flight count at admission comes from the pool itself, on
+`AcquireStats.InFlight`, taken at the moment the request takes its slot,
+rather than from a residency snapshot before the request is admitted.
+`footprint(bytes int64)` at completion takes the pool's latest sample. Every
+one of these runs only while recording is on: the path with the switch off
+is the path it was. No new parse of the body: only the presence of each
+sampling key is read.
+
+### The dashboard
+
+`internal/stats` gains three aggregates over the range the existing views use:
+per model, the distribution of `requested_tokens` — the figure the refusal
+is judged on — in bands of the served window, beside the declared one, with
+how often the served-window refusal bit; per model, the override
+rate per parameter; per model, the footprint series from the `footprint`
+events, downsampled to the range. The Statistics tab draws them under the
+existing historical views, on the existing range control, with the page's
+existing "what the views cannot show" section extended: a footprint is a
+sample of the process, not a cost attributable to a request.
+
+### Three surfaces
+
+Go carries the whole of it. `config.json` gains nothing: there is no new
+setting, the statistics switch already gates all of it. The panel gains the
+three views. The sync obligation is the existing statistics docs test
+(`internal/archtest/statistics_docs_test.go`), which holds the reference page
+to `RecordFields()` and so fails the build the moment a field ships unnamed.
+
+## How each acceptance criterion is tested
+
+| Criterion | Test |
+| --- | --- |
+| A completing request carries declared, served and in-flight at admission | `internal/gateway`: `TestARecordCarriesTheWindowsAndTheInFlightAtAdmission` |
+| A request refused for size still carries the estimate | `internal/gateway`: `TestARefusedRequestStillCarriesItsEstimatedSize` |
+| A client-set parameter is marked overridden, no client number stored | `internal/gateway`: `TestOverridesAreNamedAndNeverValued` (the record's JSON carries no number the client sent) |
+| A load event carries the launch sampling values | `internal/runtime` + `internal/app`: `TestALoadEventCarriesTheLaunchSampling` |
+| Footprint sampled periodically; a record carries the footprint at completion, named as such | `internal/runtime`: `TestTheSamplerReportsEachServersFootprint` (fake launcher with a fake footprint); `internal/gateway`: `TestARecordCarriesTheLatestFootprintSample` |
+| The dashboard shows prompt-size distribution against both windows, the override rate, the footprint over time | `internal/stats`: `TestPromptSizesAreBucketedAgainstBothWindows`, `TestOverrideRatesPerParameter`, `TestFootprintSeriesIsDownsampledToTheRange`; `internal/ui`: the view functions as pure functions |
+| A new field is named on the reference page, the record-size constant re-measured, the docs say where the files are | `internal/archtest/statistics_docs_test.go` (existing, extended by the field list); `internal/stats/store_test.go`'s `ApproxRecordBytes` measurement |
+
+## Grounds
+
+- pursued: fields on the existing records plus a periodic footprint sample
+  show which settings matter, because each fact already passes through the
+  gateway or the pool; shown wrong if deciding a window or a concurrency turns
+  out to need per-request memory attribution the sample cannot give — the
+  intent's own mechanism claim, carried unchanged.
diff --git a/.abcd/development/specs/closed/spc-2609100450257929-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md b/.abcd/development/specs/closed/spc-2609100450257929-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
new file mode 100644
index 00000000..9ed43049
--- /dev/null
+++ b/.abcd/development/specs/closed/spc-2609100450257929-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
@@ -0,0 +1,90 @@
+---
+id: spc-2609100450257929
+slug: alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t
+intent: itd-2609091903463596
+origin: researcher-authored
+production_mode: dictated-and-formatted
+---
+# The resources roll-up at the head of the Models tab
+
+## Summary
+
+One block at the head of the Models tab that adds up what the panel already
+knows: how many models are downloaded and how many loaded, how much disk they
+take and how much the volume has left, the memory budget against what is
+resident and what is still exiting, and on each card the window the model
+declares and the window it is set to serve. No new measurement: every figure
+but the volume's free space is already on the state snapshot, and free space
+has one reader, `capability.Assess`, which the snapshot's machine block
+already carries. Placement was decided at the interview: a block, not a
+seventh tab.
+
+## Scope
+
+In scope: the roll-up block (markup in `internal/ui/static/index.html`, a pure
+`resourcesSummary(state)` in `app.js` the tests hold, drawn on every state
+event); the declared and served windows on each model card, resolved the
+fold-aware way the panel already resolves a served window (`servedContext`);
+the one addition the snapshot needs, if any (see Approach); a section in
+`docs/models-list.md`'s companion page for the panel, or in
+`docs/memory-budget.md`, saying what the block shows; the changelog entry.
+
+Out of scope: any figure that needs a directory walk on the render path (the
+per-model sizes are recorded at download and rescan and are read from the
+registry entry); live usage figures, which are the measurement intent's; a
+new endpoint — the block reads the snapshot the panel already polls.
+
+## Approach
+
+**The figures and where each comes from, all already on the snapshot:**
+
+| Figure | Source on the snapshot |
+| --- | --- |
+| Models downloaded | `models` with `state == "ready"` |
+| Models loaded | `resident` entries in state `loaded` (loading counted separately, as "loading") |
+| Disk the models take | sum of `models[].bytes` over ready models — recorded sizes, no walk |
+| Free space on the models volume | `machine.free_disk`, from `capability.Assess`'s one reader |
+| Memory budget | `machine.budget` |
+| Resident, charged | `machine.resident_bytes`, which already includes the exiting servers |
+| Still exiting | `machine.exiting_bytes`, named as such beside the resident figure |
+| Stuck servers | `machine.stuck_servers`, shown only when non-zero |
+| Per card: declared window | `models[].context_length` |
+| Per card: served window | `servedContext(config, repo_id, context_length)`, the panel's existing fold-aware helper |
+
+So the change is entirely in the panel, plus its tests. If `machine.free_disk`
+turns out not to ride the snapshot on every poll (it is read by `Assess` at
+start today), the one server-side addition is to refresh it on the snapshot at
+the snapshot's cadence — one call to the existing reader, no second one.
+
+**The block** is a `figures` paragraph and a short table at the head of
+`#tab-models`, above the cards: "3 models downloaded, 1 loaded · 41.2 GB on
+disk, 210 GB free · memory: 52.0 GB of 96 GB budget resident, of which 4.1 GB
+still exiting". A model without a declared window shows no window on its card,
+never zero. A budget the Mac cannot measure shows no share.
+
+**The cards** gain one line: "context: 131,072 declared · 65,536 served" when
+the served window is below the declared one, "context: 131,072" when they are
+equal, and nothing when the model declares none. (The context probe's line,
+already on the card, sits beneath it.)
+
+**Loopback only.** The block is part of the panel, which the control plane
+serves on this Mac alone; nothing here is served to the LAN.
+
+## How each acceptance criterion is tested
+
+| Criterion | Test |
+| --- | --- |
+| Three ready models, one resident: 3 downloaded, 1 loaded | `internal/ui`: `TestTheRollUpCountsDownloadedAndLoaded` (pure function over a snapshot) |
+| Disk total is the sum of recorded sizes, no walk | the same, and `internal/archtest` or `internal/ui` asserting `resourcesSummary` reads `bytes` and never calls an endpoint |
+| Free space comes from the capability package's one reader | `internal/gateway`: `TestTheSnapshotCarriesFreeDiskFromTheOneReader` (the machine block's field is `Assess`'s, and no second reader exists — a grep test in archtest for `statfs`/`Statfs` outside capability) |
+| Resident memory includes exiting bytes and names them | `internal/ui`: `TestTheRollUpNamesTheExitingPart` |
+| Served below declared: both shown, served resolved fold-aware | `internal/ui`: `TestTheCardShowsBothWindowsFoldAware` |
+| No declared window: no window shown, never zero | `internal/ui`: `TestACardWithoutADeclaredWindowShowsNoWindow` |
+| Off loopback: the block is unreachable | `internal/gateway`: the existing loopback-only test for the panel covers every panel asset; one assertion that the Models tab's markup is served by the same handler |
+
+## Grounds
+
+- pursued: no new measurement is needed, because every figure but free disk is
+  already on the snapshot and free disk has one reader; shown wrong if the
+  roll-up needs a directory walk or a second reader, as the intent's mechanism
+  claim says.
diff --git a/.abcd/development/specs/closed/spc-2609100502029941-gropius-tests-its-own-models-while-nobody-is-using-it-alice.md b/.abcd/development/specs/closed/spc-2609100502029941-gropius-tests-its-own-models-while-nobody-is-using-it-alice.md
new file mode 100644
index 00000000..a8ef6917
--- /dev/null
+++ b/.abcd/development/specs/closed/spc-2609100502029941-gropius-tests-its-own-models-while-nobody-is-using-it-alice.md
@@ -0,0 +1,123 @@
+---
+id: spc-2609100502029941
+slug: gropius-tests-its-own-models-while-nobody-is-using-it-alice
+intent: itd-2609100457007827
+origin: researcher-authored
+production_mode: dictated-and-formatted
+---
+# The idle-time model self-test
+
+## Summary
+
+An opt-in loop that measures every downloaded model on the operator's own
+Mac while nobody is using it, with the same short set of tests, and writes
+one line of figures per run to a bounded file. It delivers
+itd-2609100457007827: the switch on three surfaces, the loop, the standard
+set, the results file, and the two docs pages. It does not deliver a panel
+view of the results, a fold of the results into the statistics store, or any
+setting derived from the figures; those are captured as follow-ups
+(iss-2609100515475279, iss-2609100515478018) and the held draft
+itd-2609091712142715.
+
+## Scope
+
+- `internal/config`: `Config.SelfTest` (`self_test`, bool, omitempty, off
+  by default, no repair and no refusal since a bool has no bad value) and
+  `Paths.SelfTest`, the results directory beside the statistics store under
+  the account's own directory.
+- `internal/selftest`: the loop (`Runner`), the standard set and the request
+  builder (`request.go`, allow-listed by name in
+  `internal/archtest/prompt_content_test.go` on both sides of the content
+  boundary), and the bounded results file (`results.go`).
+- `internal/app`: `App.SelfTest`, the `selfTestServer` adapter, and
+  `applySelfTest` called from `New`, `SetConfig` and `Close`.
+- `internal/ui`: one checkbox on the Settings pane, posted as `self_test`
+  and filled from it, with its sync test.
+- `docs/self-test.md` (how-to), `docs/self-test-reference.md` (reference),
+  a README bullet, a changelog entry; `internal/archtest` holds the reference
+  page to the record's fields.
+
+## Approach
+
+**The switch.** `self_test` follows the statistics switch's shape: a bool the
+panel posts and the file carries; `SetConfig` applies it live by calling
+`SelfTest.SetEnabled`, and `New` applies the saved value at construction.
+Off cancels a run in progress and returns once the loop is gone; `Close`
+does the same before the pool closes, so the pool's close never waits on a
+release that is on its way.
+
+**Idleness, from outside the pool.** The runner never holds an app lock and
+adds no mechanism to the pool (adr-2609091239058072). It reads
+`Pool.Residency` (per-model in-flight and last-used), `Pool.Waiting` and
+`App.Downloading` through the adapter on every tick. Quiet means: nothing in
+flight, nothing waiting, nothing downloading, and every resident model's last
+use older than five minutes. A run in progress polls the same view every
+quarter of a second, subtracting its own one hold on the model under test;
+any other in-flight request, any waiter, or a rise in the pool's count of
+loads refused for want of room (`Residency.Refusals`, the one seam added to
+the pool: with eviction grace off a refused client waits nowhere else
+visible) cancels the run's context. The watcher runs from before `Acquire`,
+so a cold load yields too, and the pool tears down an abandoned load. The
+pool has no preemption, so this is the whole of the yielding: the self-test's
+own request or load is cancelled, the run is written as `yielded`, and the
+release follows within the poll interval plus the cancellation. A
+pool-side preemptible hold, which would spare the refused client its one
+503, is captured as a follow-up rather than built.
+
+**Loading through the pool, never by eviction.** `Acquire`, tagged with its
+own source for the load-waiter queue, never a second launcher: the budget,
+the pins, the served window and the KV charge are the pool's own. Before
+asking, the runner checks `Server.Fits`, which the app answers from the
+residency snapshot and `chargeOf`: a model that would need another evicted
+is left due for a later tick, so a Mac whose working model stays warm all
+day keeps it. The parallel test takes the decode concurrency's worth of
+acquisitions on the resident model before it sends, so the pool's semaphore
+bounds the batch and a client arriving on the model queues where the watcher
+sees it. A model the self-test loaded is unloaded afterwards through
+`Pool.Unload`, unless the run yielded, in which case the client's request
+decides what stays; a model that was resident is left resident.
+
+**The set.** `pp512` (a fixed ~512-token English prompt, one token back),
+`tg128` (one sentence, 128 tokens back) and `tg128xN` (the same, N at once,
+N the decode concurrency, omitted at one), plus the load time from `Acquire`.
+Requests go straight to the upstream the pool hands back — the model server
+on loopback, with the exact `ModelArg` the pool reports — as the gateway does
+after its own Acquire, so they land in no request statistic and need no API
+key. Streaming with `include_usage` always written; the first chunk carrying
+text is the first token, and the server's usage event gives the counts, or
+the chunk count does when the server sends none, and the result says which.
+
+**The file.** `selftest/results.jsonl`, 0600 in a 0700 directory, opened
+with `O_NOFOLLOW`, appended to until the next line would pass 4 MiB and then
+truncated: a single bounded file, deliberately not a third rotating writer
+(iss-2609091714393599). One `Run` per line; `Test` records inside it. A
+failed run carries a class, never the error's text. On start the loop seeds
+its last-tested map from the file so a restart does not begin the cycle
+over; a model is measured again after a day, the stalest first.
+
+## How it satisfies the acceptance criteria
+
+| Criterion | Where it is held |
+| --- | --- |
+| Off: nothing loaded, no file | `TestOffLoadsNothingAndWritesNothing`, `TestTheSelfTestFollowsItsSwitch` (app) |
+| On and idle: acquired through the pool, the set runs, one line appended | `TestAnIdleMacGetsEveryModelMeasuredAndLeftAsFound` |
+| Unload what it loaded, leave what was there | the same, and `TestAModelThatWasResidentIsLeftResident` |
+| A client request yields the run, releases the model, records `yielded` | `TestAClientRequestYieldsTheRun`, with a bound on how long the yield takes |
+| Busy Mac: nothing runs | `TestNothingRunsWhileTheMacIsBusy` (four cases) |
+| Every model fresh: nothing runs | the tail of `TestAnIdleMacGets…`, and `TestAResultStandsForADay…` |
+| The line's fields, and no prompt or answer text | `TestAResultCarriesNoPromptAndNoAnswer`, `TestALoadThatFails…` (no error text), and the archtest docs test |
+| Switch off mid-run cancels and releases | `TestSwitchingOffStopsARunAndReleasesTheModel` |
+| The cap: file started again, newest kept | `TestTheResultsFileIsPrivateAndBounded` |
+| The panel offers the switch under the file's key | `TestThePaneIsWiredToTheSelfTestSwitch` (ui) |
+| The docs pages | `TestTheSelfTestReferenceNamesEveryField`, `TestTheSelfTestPagesAreLinkedAndSayWhatIsNeverWritten` (archtest) |
+
+## Not in scope, and why
+
+- A results view in the panel: the switch is the accessible surface this
+  change needs; the figures are a file the reference page names. Captured.
+- Folding the results into the statistics store: its schema is per-request
+  and its writer is in another lane; captured, to move with the writer
+  unification.
+- A line on the posture page saying the self-test is on: the page's lane is
+  another session's; captured as iss-2609100515484516.
+- Any setting chosen from the figures: itd-2609091712142715, held.
diff --git a/.abcd/development/specs/open/spc-2609112108142027-gropius-measures-a-newly-downloaded-model-s-servable-context.md b/.abcd/development/specs/closed/spc-2609112108142027-gropius-measures-a-newly-downloaded-model-s-servable-context.md
similarity index 90%
rename from .abcd/development/specs/open/spc-2609112108142027-gropius-measures-a-newly-downloaded-model-s-servable-context.md
rename to .abcd/development/specs/closed/spc-2609112108142027-gropius-measures-a-newly-downloaded-model-s-servable-context.md
index 13967b53..00be8214 100644
--- a/.abcd/development/specs/open/spc-2609112108142027-gropius-measures-a-newly-downloaded-model-s-servable-context.md
+++ b/.abcd/development/specs/closed/spc-2609112108142027-gropius-measures-a-newly-downloaded-model-s-servable-context.md
@@ -69,21 +69,32 @@ exported methods is not changing them.
 
 ### The package, and the seam it holds
 
-`internal/contextprobe` owns the method, the scheduler and the result. It talks
-to the rest of Gropius through one small interface it declares itself, which
-`*runtime.Pool` already satisfies:
+`internal/contextprobe` owns the method, the result and the "Measure now"
+queue. It does not own a scheduler: the self-test's idle loop
+(`internal/selftest`, itd-2609100457007827) landed first, and the probe is a
+job of it — `selftest.Job` (Name, Due, Run) and `selftest.Session` (the run's
+context, the hold count, whether a cancellation was a yield, the progress
+words, the never-evict check) are the seam. So idleness, yielding, the
+never-evict rule, the "what held it back" reason and the idle threshold are
+decided once, for both jobs. The probe talks to the app through one small
+interface it declares itself:
 
 ```
-type poolView interface {
-    Waiting() int                 // queue depth, as any caller is counted
-    Residency() runtime.Residency // per model: State, InFlight, LastUsed
-    Unload(repoID string) error   // ErrBusy while a request is in flight
+type Sources interface {
+    Candidates() []Candidate                       // ready models: declared, served, bytes, KV charge, measurement
+    Provenance(repoID string) registry.Provenance  // runtime, budget, concurrency, served window in force
+    Available() int64                              // what the budget has free
+    Unload(repoID string) error                    // runtime.ErrBusy while a request is in flight
+    Save(repoID string, m *registry.Measurement) error
+    MarkIncomplete(repoID string, on bool) error
+    Endpoint() (baseURL, apiKey string)            // this Mac's own loopback endpoint
 }
 ```
 
-Three existing exported methods, nothing added to the pool. A fake satisfying
-this interface is what the tests drive, which is why the package is testable
-without a real Mac.
+Nothing added to the pool. Fakes satisfying `Sources` and the loop's
+`selftest.Server` are what the tests drive, with a fake gateway that answers
+the way the real one does, which is why the package is testable without a
+real Mac.
 
 ### The method, from the campaign
 
@@ -122,9 +133,11 @@ break the probe.
 
 ### Idle, and yielding
 
-**Idle** is all three of: `Waiting()` is zero, no resident model has a request
-in flight, and every resident model's `LastUsed` is older than the probe's idle
-threshold. A probe that cannot start says which of the three held it back.
+**Idle** is the loop's: `Waiting()` is zero, nothing is downloading, no
+resident model has a request in flight, and every resident model's `LastUsed`
+is older than the idle threshold (`idle_threshold_sec`, shared with the
+self-test, five minutes by default). A probe that cannot start says which held
+it back, on the state snapshot and the model's card.
 
 **Yielding** is a poll of the same two readings on a short interval while a step
 runs. The probe holds exactly one request, on one model, so a second in-flight
@@ -193,9 +206,10 @@ needs nothing from the package either way.
 
 - **Go** carries the whole of it: the scheduler, the switch, the per-model run,
   the progress snapshot and the result.
-- **`config.json`** carries the switch and the idle threshold as ordinary
-  settings; a save that names neither leaves both alone, which is the wedge this
-  repository has built three times.
+- **`config.json`** carries the switch (`context_probe`) and the idle
+  threshold (`idle_threshold_sec`) as ordinary settings; a save that names
+  neither leaves both alone, which is the wedge this repository has built three
+  times.
 - **The control panel** carries the switch, a "Measure now" per downloaded
   model, the progress of a run in words (which model, which step, the bounds so
   far, what stopped the last step), the result with its bound, and the "Use this
diff --git a/.abcd/development/specs/open/spc-2609091737253961-gropius-shows-what-its-models-actually-do-so-the-settings-th.md b/.abcd/development/specs/open/spc-2609091737253961-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
deleted file mode 100644
index d474843a..00000000
--- a/.abcd/development/specs/open/spc-2609091737253961-gropius-shows-what-its-models-actually-do-so-the-settings-th.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-id: spc-2609091737253961
-slug: gropius-shows-what-its-models-actually-do-so-the-settings-th
-intent: itd-2609091712141073
-origin: researcher-authored
-production_mode: dictated-and-formatted
----
-# gropius-shows-what-its-models-actually-do-so-the-settings-th
-
-## Summary
-
-_Draft: describe what spc-2609091737253961 delivers for itd-2609091712141073 — scope, approach, and how it satisfies the intent's Acceptance Criteria. This spec is the design record the fidelity review audits against._
diff --git a/.abcd/development/specs/open/spc-2609100450257929-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md b/.abcd/development/specs/open/spc-2609100450257929-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
deleted file mode 100644
index c7fc0fc3..00000000
--- a/.abcd/development/specs/open/spc-2609100450257929-alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-id: spc-2609100450257929
-slug: alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t
-intent: itd-2609091903463596
-origin: researcher-authored
-production_mode: dictated-and-formatted
----
-# alice-sees-what-her-mac-is-spending-on-gropius-a-resources-t
-
-## Summary
-
-_Draft: describe what spc-2609100450257929 delivers for itd-2609091903463596 — scope, approach, and how it satisfies the intent's Acceptance Criteria. This spec is the design record the fidelity review audits against._
diff --git a/.abcd/work/DECISIONS.md b/.abcd/work/DECISIONS.md
index 3edf5338..f0a9eaca 100644
--- a/.abcd/work/DECISIONS.md
+++ b/.abcd/work/DECISIONS.md
@@ -261,3 +261,11 @@
 - 2026-09-12 — itd-2609081420471761, build, after review: the claim that "no environment variable can point the download" is CORRECTED rather than made true. `-q` suppresses `.curlrc` only, and curl still honours `https_proxy`/`ALL_PROXY` and `CURL_CA_BUNDLE`/`SSL_CERT_FILE` — both measured. Neutralising them was rejected on two grounds: the bootstrap honours the same variables, so the verb would fail on machines where the documented install works and a corporate proxy is the ordinary case rather than the attack; and it buys nothing against the adversary this package is written for, another account on this Mac, which cannot set this account's environment and which, if it could, could replace `~/.local/bin/gropius` outright. The claim is now about what Gropius reads, with the limit written down in the code and in the reference. The spec anticipated exactly this: "expect findings that change a claim rather than harden one."
 - 2026-09-12 — itd-2609081420471761, build: the branch and its worktree were deleted mid-review by something outside the session; the eleven commits survived as dangling objects and the branch was re-created at its tip from `766ec80`. Recorded because the recovery window is a `git gc` wide, and because a reviewer reporting "the branch under review no longer exists" is a finding about the working setup rather than about the code.
 - 2026-09-12 — iss-2609120417422598, fix: `install.sh` takes the update verb's three moves (d7e31ab) rather than a narrower patch — the checksums file is narrowed to the archive's own line before `/usr/bin/shasum` sees it, `--ignore-missing` goes with the narrowing, a line naming a PATH is refused, and the pass is read line by line. The narrowing is written with bash's own `read` fed by a redirect, NOT with `grep` or `awk`: every command in this script is named by absolute path, a new tool is a new thing to pin, and a redirect leaves the standard input `curl … | bash` feeds the script from untouched. The scope failure gets its own refusal ("the checksums … carry no line for <asset>") instead of the mismatch wording, because a checksums file that is intact and answers about something else sends a user to look at their network otherwise. `TestTheInstallerVerifiesBeforeItHandsOver` anchored on `--ignore-missing`; it now anchors on the invocation and refuses the flag returning outside a comment, so the guard pins the verification rather than the spelling it once had.
+- 2026-09-10 — itd-2609100457007827, the idle-time model self-test, is planned and built by the agent without the planning interview, on the maintainer's explicit instruction ("autonomously plan and implement this intent; make decisions autonomously and record them; this is an experiment"). The maintainer's adoption of the decomposition (SPLIT: one intent for the self-test; self-optimisation stays the held draft itd-2609091712142715; the probe draft itd-2609091301112705 is refined, not superseded) was the one question put to them. Decisions taken by the agent, each with what would show it wrong: (1) **the standard set is llama-bench's pair plus a load and a concurrency figure** — load, pp512, tg128, tg128 at the decode concurrency — because those are the four measurements the 2026-09-06 campaign decided the budget and the window from, and llama-bench's names let the figures be compared with published ones; wrong if a setting the figures were meant to decide needs a measurement not in the set. (2) **Results go to one bounded JSON Lines file, truncate-at-cap, no rotation**, `selftest/results.jsonl` under the account directory at 0600 — not a third rotating writer (iss-2609091714393599 unifies the two there are) and not the statistics store, whose schema is per-request and whose writer is in another lane; wrong if a reader needs more history than the cap holds, which is thousands of runs. (3) **Idle is read from outside the pool, not built into it**: no in-flight request other than the self-test's own hold, nobody waiting, no download, last use older than five minutes; yielding is the self-test cancelling its own request on a 250 ms poll, never the pool preempting; wrong if a client's request measurably waits on a self-test request, which would call for preemption in the pool. (4) **The self-test talks to the model server directly at the upstream the pool hands back**, as the gateway does after Acquire, so its runs land in no request statistic and need no API key; wrong if a figure only the gateway can see (a served-window refusal, a merge) turns out to be part of what the set should measure. (5) **The switch ships on all three surfaces in one change** — `self_test` in config.json, a Settings checkbox with its sync test, the Go loop — by agreement with gropiusllm-07, whose lane the panel is in. (6) One model per tick, re-tested after a day, the order being least recently tested first.
+- 2026-09-10 — The self-test after its two adversarial reviews (ruthless, security), four changes. (1) **It never evicts.** On a default install the idle timeout is zero and the working model stays warm for ever; a self-test that evicted it to measure another would leave the Mac cold once a day per model. `Server.Fits`, answered in app from the residency snapshot and `chargeOf`, gates the load; a model that does not fit stays due and is not charged a day. Wrong if a Mac with one model that fills the budget is what the operator wanted measured against others — that Mac gets only the resident model measured, and the docs say so. (2) **A refused client yields the run.** With eviction grace off (the default, and mandatory without an API key) a client's load that finds no room is refused at once and waits nowhere visible; one seam in the pool, `Residency.Refusals` (curable refusals only, never the never-fits path, per gropiusllm-07), counts them and the watcher yields when the count moves, so the retry finds room. The client's first request is still a 503; the pool-side preemptible hold that would spare it is a follow-up in gropiusllm-07's lane, not built. (3) **The parallel test holds its places in the pool** — N acquisitions, not one plus N-1 raw requests — so the semaphore bounds what the model server decodes and a client arriving on the model queues visibly. (4) **The results writer refuses a planted location**: a link, a foreign or group-writable directory, or anything but a regular file, and every open is non-blocking, because the writer runs on the settings path where a hang is a hang of every save. Also recorded: the watcher now runs from before the load, since a cold load was the longest unwatched phase; a stopped run does not use the model's day; and the self-test's loads and unloads do appear in the statistics store's load and eviction views (decision (4) of the line above was too broad — request records only), and the docs say so.
+- 2026-09-11 — The self-test's results view (iss-2609100515475279) is one loopback read endpoint, `GET /api/selftest`, answering the switch read live from the loop, the latest run per model (folded id, newest wins) and the fifty most recent runs newest first, and a block at the head of the Statistics tab drawn from it on the tab's own two-second tick rather than a timer of its own. The endpoint carries no path: the file's location is the reference page's to state. The block shows whether or not request statistics are on, because the two switches are separate and a reader with the self-test on and statistics off would otherwise see a tab that says nothing is recorded. What would show this wrong: an operator opening the file for a figure the block omits (the per-test token counts and totals are only in the file), or the tab's tick proving too coarse for a run that lands between polls — neither matters at one run a model a day. After the route's security review: the parsed file is cached on the control plane keyed on the file's size and modification time, so the tab's tick and any local process asking in a loop cost one parse per change rather than one per ask; and the error path is armed by a test that plants a directory where the file should be and reads a 500 that names no path.
+- 2026-09-12 — The context-window probe (itd-2609091301112705, spc-2609112108142027) is built by the agent on the maintainer's lane assignment, as a second job of the self-test's one idle loop rather than a scheduler of its own: `selftest.Job` and `selftest.Session` are the seam, the loop owns idleness, yielding, the never-evict check and the "what held it back" reason for both jobs, and the idle threshold is one setting, `idle_threshold_sec`, for both. Decisions with what would show them wrong: (1) **the probe is a client of the gateway**, sending to this Mac's own loopback endpoint with the API key, so the gateway's own answers classify a step — 504 is the prefill deadline, 400 and 413 are the served-window check and the body cap (both the gateway's, published as `served_window`), any other failure is the model's; wrong if a 400 is ever the gateway refusing a well-formed probe request for another reason, which would misfile a gateway bound as the served window. (2) **The memory guard is the budget's own arithmetic**, not a sample: the model's flat charge plus the KV charge for one sequence of the step's size, against what the budget has free less a margin of three sixteenths of the Mac's memory (the campaign's 24 GB on 128 GB); wrong if a step the guard allowed pushes the process past what the Mac has, which would call for the sampling the spec deferred. (3) **A yield unloads; an unload refused discards the step**, exactly as the spec says; a stop marks the model incomplete and writes nothing; a floor that fails marks incomplete and backs off a day. (4) **Adoption is a settings save**: `AdoptMeasurement` writes `served_context` through `SetConfig`, so every check a save makes is made, and the measurement then reads as stale for the served window — expected, and said so on the card. (5) **Staleness is refreshed at start and after every save**, per model, with the provenance callback handed the model rather than looking it up (the first draft deadlocked on the registry's own lock). (6) The manual comparison against the campaign script on at least one real model has NOT been run in this session; the code publishes a figure the moment a run completes, so the obligation the spec states — check once by hand before trusting a published figure — is the maintainer's before switching the probe on, and is recorded in the handover.
+- 2026-09-12 — The probe after its two adversarial reviews (ruthless, security), both of which reproduced the same lock inversion: `RefreshStaleness` held the registry's lock across a callback that took the pool's, while the pool already takes the registry's under its own (Resolve under p.mu) — a save during any load would have wedged the process. Fixed by judging outside the lock (snapshot under RLock, judge, write back where the measurement pointer is unchanged), with the ADR's rule now stated on the function. Six further changes: (1) an unload straight after a cancel finds the probe's own request still in flight, so `unloadWaiting` retries for a bounded window before an ErrBusy is read as a client's; (2) the gateway's answers are classified — 504 the deadline, 400 the served window, 503 held for a later tick, 500/502 the model's, anything else abandons the run — and the probe's own timer, now derived from the body with the gateway's own formula, files a step as the deadline's, never the model's; (3) a non-parking job's waiters are always a client's (`Job.Parks`); (4) the sweep resumes from the last verified size and the bound is seeded as the served window, so "the model's limit" is written only from a step the model refused; (5) adopting a measurement does not stale it (a served window equal to the measured window is not a move); (6) the sweep is capped at `MaxProbeWindow` (a million tokens) and the calibration clamped to 1–16 characters a token, so a planted declared window cannot make the probe allocate gigabytes. Also: `gateway.Control.handleAdopt` is a SECOND taker of `settingsMu`, and `App.AdoptMeasurement` a second caller of `SetConfig` — adr-2609091239058072 says the settings handler is the only taker; the order it fixes is respected, and this line is the record until an ADR supersedes it. What would show these wrong: a settings save that still wedges under load (a regression test runs a save against a load); a published `model` bound on a model that never refused a step.
+- 2026-09-12 — The resources view (itd-2609091903463596, spc-2609100450257929) is built as the spec says: a `resourcesSummary` pure function over the state snapshot, drawn at the head of the Models tab, and the card's context label carrying the served window beside the declared one when it is set below it. The one server-side addition is `Machine.FreeDisk` on the snapshot, read through `capability.Assess` at the snapshot's cadence — the same reader the search tab uses — and an architecture test now holds free disk to one reader. What would show this wrong: a roll-up figure that needs a walk or a second reader, which the intent's mechanism claim named as its falsifier.
+- 2026-09-12 — Usage measurement (itd-2609091712141073, spc-2609091737253961) is built by the agent on the lane assignment. Decisions with what would show them wrong: (1) **the footprint is a fifth record kind**, `footprint`, ratified by adr-2609121450000000 superseding adr-2609090716413337, because a reading of a process on a clock is not a fact about any request; wrong if the series turns out to be what nobody reads and the value stitched onto a request is all anyone sizes from. (2) **The reader is `ps -o rss=` on the server's pid**, from the runtime's exec process through an optional `Footprinter` interface, every thirty seconds per ready server, reported through an optional `FootprintObserver` so no observer is made to care; wrong if the process listing is ever what makes the sampler measurable in a request's latency. (3) **Overrides are names from a closed set**, read from the same body parse the gateway already does, with `max_completion_tokens` folded onto `max_tokens`; wrong if a reader needs the value to decide a default, which adr-2609061503319212 rules out anyway. (4) **The statistics package keeps its own copy of the window bound**, `stats.MaxContext`, because it imports nothing of ours, and an architecture test holds it to `config.MaxContextLength`. (5) The record-size constant moves from 230 to 380 bytes and the docs' arithmetic from three months to seven weeks of ten thousand requests a day at the default cap — a measured figure, re-measured. (6) The launch sampling reaches the load event through `PoolObserver.LoadStarted`'s new second argument and a map in the statistics package's wire shape, converted in one place in app.
+- 2026-09-12 — Usage measurement after its two adversarial reviews. Six changes: (1) **the refusal, the record and the bands rest on one number** — `judgeServedContext` returns what the served-window check judged (estimate plus the answer asked for), recorded as `requested_tokens`; the bands were bucketing on the prompt estimate alone, so a request tipped over by its `max_tokens` was refused but shown under the window. (2) **The in-flight count is the pool's, at the slot** (`AcquireStats.InFlight`), not a residency snapshot taken before admission that also cost a lock and a sort on every request. (3) **The recording-off path is untouched again**: the new work runs behind `obs.recording()`. (4) **The reader is top's physical footprint, with a three-second deadline**, not `ps`'s resident size — the campaign sampled top's figure, and `ps -o rss` was measured here at 2640 K against top's 1728 K for one process; the pool's close waits for the sampler last, after the servers are told to stop, so a stalled listing cannot hold the memory. (5) **Launch sampling rides the finish report**, not a map stitched across two reports that may arrive out of order. (6) The series is drawn (a sparkline per model), the counters' unread footprint figure is dropped, the read path is bounded, the stamps use the bucketing's arithmetic, and the docs say what the footprint lines cost the request views' reach. What would show these wrong: a request the gateway refused that the bands show under the window; a shutdown that still waits on a listing.
diff --git a/.abcd/work/issues/open/iss-2609100515478018-the-self-test-writes-its-own-bounded-json-lines-file-interna.md b/.abcd/work/issues/open/iss-2609100515478018-the-self-test-writes-its-own-bounded-json-lines-file-interna.md
new file mode 100644
index 00000000..c251a9eb
--- /dev/null
+++ b/.abcd/work/issues/open/iss-2609100515478018-the-self-test-writes-its-own-bounded-json-lines-file-interna.md
@@ -0,0 +1,14 @@
+---
+schema_version: 1
+id: "iss-2609100515478018"
+slug: "the-self-test-writes-its-own-bounded-json-lines-file-interna"
+severity: "minor"
+category: "observation"
+source: "user-observation"
+found_during: "itd-2609100457007827 build"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "internal/selftest/results.go"
+---
+
+The self-test writes its own bounded JSON Lines file (internal/selftest/results.go) beside the statistics store instead of into it, because the store's schema is per-request and its writer is in another lane. When iss-2609091714393599 unifies the size-bounded writers, the self-test's file should move with them, and a run should become a record kind the statistics reference page names.
diff --git a/.abcd/work/issues/open/iss-2609100526194406-the-self-test-s-hold-on-a-model-is-not-preemptible-with-evic.md b/.abcd/work/issues/open/iss-2609100526194406-the-self-test-s-hold-on-a-model-is-not-preemptible-with-evic.md
new file mode 100644
index 00000000..37a366b1
--- /dev/null
+++ b/.abcd/work/issues/open/iss-2609100526194406-the-self-test-s-hold-on-a-model-is-not-preemptible-with-evic.md
@@ -0,0 +1,14 @@
+---
+schema_version: 1
+id: "iss-2609100526194406"
+slug: "the-self-test-s-hold-on-a-model-is-not-preemptible-with-evic"
+severity: "minor"
+category: "observation"
+source: "user-observation"
+found_during: "itd-2609100457007827 security review"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "internal/runtime/pool.go"
+---
+
+The self-test's hold on a model is not preemptible: with eviction grace off, a client whose load needs the memory the self-test holds is refused once (503) before the self-test sees the refusal count move and yields, so the client's retry finds room. The correct fix is pool-side: a soft, source-tagged hold that the eviction plan may take and that cancels the holder's context, so the client's Acquire evicts the self-test's model instead of being refused. Found by the security review of itd-2609100457007827; the counter (Residency.Refusals) is the interim.
diff --git a/.abcd/work/issues/resolved/iss-2609100515475279-the-self-test-s-results-have-no-panel-view-the-switch-is-on.md b/.abcd/work/issues/resolved/iss-2609100515475279-the-self-test-s-results-have-no-panel-view-the-switch-is-on.md
new file mode 100644
index 00000000..e0cdddcf
--- /dev/null
+++ b/.abcd/work/issues/resolved/iss-2609100515475279-the-self-test-s-results-have-no-panel-view-the-switch-is-on.md
@@ -0,0 +1,22 @@
+---
+schema_version: 1
+id: "iss-2609100515475279"
+slug: "the-self-test-s-results-have-no-panel-view-the-switch-is-on"
+severity: "minor"
+category: "observation"
+source: "user-observation"
+found_during: "itd-2609100457007827 build"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "internal/ui/static/app.js"
+resolution: "GET /api/selftest on the control plane (latest run per model, fifty most recent, the switch read live) and a Self-test block at the head of the Statistics tab, fetched on the tab's own tick; docs/self-test.md says so"
+impact: additive
+resolved_by:
+  intent: "itd-2609100457007827"
+---
+
+The self-test's results have no panel view: the switch is on the Settings pane but the figures are only in selftest/results.jsonl, so the accessible surface shows the operator how to start measuring and nothing of what was measured. A results view on the Statistics or Models tab, reading the file through a loopback endpoint, closes the gap the three-surfaces rule names.
+
+## Grounds
+
+- pursued: we expect the latest run per model, shown beside the request statistics, to be enough for an operator to size a served window and a concurrency without opening the file; shown wrong if readers reach for the file for a figure the block does not carry
diff --git a/.abcd/work/issues/resolved/iss-2609100515484516-the-posture-page-says-what-is-on-and-the-self-test-is-a-thin.md b/.abcd/work/issues/resolved/iss-2609100515484516-the-posture-page-says-what-is-on-and-the-self-test-is-a-thin.md
new file mode 100644
index 00000000..4b0cc237
--- /dev/null
+++ b/.abcd/work/issues/resolved/iss-2609100515484516-the-posture-page-says-what-is-on-and-the-self-test-is-a-thin.md
@@ -0,0 +1,22 @@
+---
+schema_version: 1
+id: "iss-2609100515484516"
+slug: "the-posture-page-says-what-is-on-and-the-self-test-is-a-thin"
+severity: "nitpick"
+category: "observation"
+source: "user-observation"
+found_during: "itd-2609100457007827 build"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "internal/ui/static/app.js"
+resolution: "the self-test PR adds the Self-test line to postureLines, its table test, and the posture-reference row"
+impact: additive
+resolved_by:
+  intent: "itd-2609100457007827"
+---
+
+The posture page says what is on, and the self-test is a thing that can be on: a loop that loads models on its own while the Mac is idle. The page has no line for it. One line reading config.self_test, with the reads list the page's tests hold it to, would make the posture page complete again.
+
+## Grounds
+
+- pursued: we expect the posture page to stay a complete account of what is on, so a loop that loads models on its own is stated there the day it ships; shown wrong if a reader of the page is still surprised by a model loading unasked