Fixed in 44fce65 using the issue's documented-invariant option. Buffer::view now carries a SAFETY contract naming native/metal/ds4_metal.m:7916-7940, including bounds checks, ARC retention of the…
Fixed in 8f91a06. Each runtime command now runs behind a panic boundary; a panic fails that request, drops the loaded GPU generator, records failure/unload metrics, and leaves the worker alive for…
Fixed in 9040070. The local endpoint now caps concurrent request threads at 64, releases slots structurally, enforces a 30 s total request deadline with 10 s per-I/O and write timeouts, reports…
Fixed in 429cbc7. Model downloads now enforce a 10 s connect timeout plus 30 s response/body stall timeouts, and production downloads are HTTPS-only. Added a loopback regression test proving a…
Fixed in 218c947. ActiveGeneration now cancels its worker when the handle is dropped, covering every early-exit path. Added a regression test for the drop behavior. Verified with cargo fmt, Clippy…
Implemented in d456458.
The deferred-persistence half of this issue was already done in 51c1b2a: a new session lives only in the UI until its first chat turn is stored, so empty sessions never…