Build guided setup and the LLooM browser experience

[data-angel]

LLooM now opens guided browser setup on the first interactive run and gives installed gateways Live, Models, Machines, Clients, and Settings views. Observed requests animate the topology. The Models view shows proportional blocks for backend memory, system/other apps, and free space, with protected headroom inside the free block. Pointer, keyboard-focus, and selection previews animate a model’s expected memory impact on its own machine. Normal use starts models automatically; optional manual preparation and memory release live under Options & details.

Setup and model installation use reviewed, expiring plans and observable jobs. Backend and download commands remain fixed through apply and retry. Custom Hugging Face imports require immutable commit links and staged acquisition verification. Setup publishes configuration exclusively and verifies a model response through the gateway before reporting readiness. CLI, offline, and scripted paths remain available.

Admission now counts live host memory even when policy specifies only a reserve or absolute budget. Newly launched local backends are monitored through loading and warmup. A threshold breach or unavailable telemetry aborts the load and cleans up only its owned process tree or Docker container. An independent supervisor process checks memory before spawning, and the manager waits for that check before accepting health. Forced starts cannot bypass the guard. Explicit runtimePolicy.memorySafety.mode: "yolo" disables memory admission and the load guard, with a persistent dashboard warning. The guard polls in userspace; it is not a kernel allocation quota. Automatic retries remain blocked until a manual retry or gateway restart; persistent suspension survives restarts.

Memory attribution uses bounded passive process observations with a five-second cache and overlapping process-tree deduplication. macOS reads physical footprint, including charged Metal/compressed memory, with RSS fallback. Known local model-cache observations distinguish a healthy service from a loaded model. Estimates are marked, remote safety policies stay node-specific, and routing/admission status skips local dashboard sampling.

The streaming stall watchdog rechecks elapsed time if its timer wakes early, preventing a premature event from being ignored by stall classification.

Readiness preferences persist without restarting active models. Changes wait for admission, queued restores recheck intent, and pending hard pins protect models from eviction. Browser management rejects foreign origins and rebound loopback hosts; remote writes require an admin credential.

Validation:

• Full npm test passed locally on macOS / Node 22 with the memory map and Mac footprint sampler. After review fixes, all 36 memory-map/sampler tests and 33 maintenance tests passed, plus cluster, runtime policy, dashboard-status, and the 29-test UX suite. GitHub CI passed on Node 20 and Node 22 at 2609b87, including full tests, dependency audit, interchange, and package installation. The memory safety and supervisor suites passed all 16 cases, including pressure during load and warmup, process-tree cleanup, immutable Docker ownership, independent cutoff, stale health, and the supervisor startup race.
• Check, lint, formatting, interchange, and packaged-install validation passed. Lint retains one pre-existing unused-variable warning in research-worker tests.
• The clean package from 2609b87 was installed on the Mac and its installed sources were verified against the running service (artifact SHA-256 ea526b1df64f59c83e18913267cf08b9f131b7386ad77bf8e46f24a82db0f64e). Configuration was preserved; enforcement reports a 12 GiB reserve, 90% ceiling, and 250 ms polling. An isolated test of the installed HTTP API returned 503 runtime_memory_safety_abort before spawning its tiny fixture, despite force: true and disabled predictive policy.
• Visually checked the real installed dashboard with all 21 visible models: the embedding process tree reports 5.7 GiB from physical-footprint accounting, and focusing FLUX animates its roughly 32 GiB incoming estimate without starting it. Desktop and 390px checks covered memory blocks, keyboard focus, persistent selection, mobile controls, unknown and over-budget models, and node-specific previews. A read-only two-machine fixture exercised remote reserve behavior.
• Bonsai remains persistently suspended following the reported memory incident. No Spark deployment was performed.

A signed public installer and automatic nearby discovery/pairing remain separate work. Configured federation is available; independent nodes do not pair automatically in this change.