Merge v1.1: cancelled requests recorded as 499; empty usage is []

docs/implementer-log.md

@@ -5,6 +5,7 @@ owner fills in the Model column. The reviewer adds findings under "Reviews" once
 
 | Task | Date | Status | Gate runs | First gate | Deviations | Notes | Model |
 |---|---|---|---|---|---|---|---|
+| v1.1/01-review-fixes | 2026-09-25 | done | 1 | pass | none | Copied `cancel_test.go` and `usage_empty_test.go` byte-identical from `docs/plans/v1.1/_files/`; the earlier session's fixes in `internal/proxy/proxy.go`, `internal/proxy/forward.go` and `internal/admin/admin_ops.go` were already in the working tree. `make gate` printed `gate: ok` on the first run. | llama.cpp/ornith-1.5-35b-a3b |
 | v1/08-smoke-readme | 2026-09-25 | done | 1 | pass | owner-directed fix to `Free` in `proxy.Chooser` | Changed `Free` from `c.lim.FreeSlots(host)` (sum over every model) to per-model free slots, `freeForModel(cfg.Hosts[host], model, c.lim.InFlight(host, model))`, floored at 0 and 0 when the host does not list the model (new helper in hosts.go); the one code change the task directs. `go test -race ./internal/proxy/` and `make gate` pass on the first run; `make smoke` → `smoke: ok (stream spread 1006 ms)`. README intro, `## Configure` (added db/lease_idle/retention, rewrote queue_max and hosts.<name>.hosts) and `## Inspect`→`## Operate` (all six endpoints, examples taken from the smoke run) updated. | llama.cpp/ornith-1.5-35b-a3b |
 | v1/07-main | 2026-09-25 | done | 1 | pass | none | Wired store, limiter and lease table into `cmd/crossbar/main.go`: `store.Open` before the health table, `limiter.Configure` per (host, model) from `cfg.Hosts`, `lease.New` with `proxy.Chooser`, `Candidates` for every route, three background goroutines (idle expiry per minute, prune per hour logging the count, host-health recording per `poll_interval`), and `st.Close` via `defer`. The 3s SIGTERM run exits 0 with `listening`/`shutting down`; the missing-config run exits 1. | llama.cpp/ornith-1.5-35b-a3b |
 | v1/06-admin | 2026-09-25 | done | 2 | fail | Split `internal/admin/admin.go` (196 lines) + `admin_ops.go` (366 lines) to stay under 400. Updated `cmd/crossbar/main.go`'s `admin.Handler` call from the committed 2-arg `(cfg, table)` to the task's 6-arg signature, passing the health table for `hosts` and `nil` for the not-yet-wired `leases`/`limiter`/`store`/`drainer` (task 07 wires them); this was a compile fix required for `go vet`/`go test ./...` on `cmd/crossbar` to pass — the full wiring is task 07. | First `make gate` failed on `go vet` (`admin.Handler` called with 2 args in `main.go` after the signature changed); fixed `main.go` and the gate passed on the second run. `admin_test.go` and `example.toml` verified byte-identical to `docs/plans/v1/_files/`; `internal/lease` and `internal/store` left untouched except the already-present `Candidates`/`StatusCounts`. | llama.cpp/ornith-1.5-35b-a3b |
@@ -80,3 +81,20 @@ Follow-ups for `v1.1`: fix 1 (record the row on the cancel path with status 499
 (`[]`), and an acceptance test for each; consider `lease_idle` expiry while a request is in flight
 and `Prune` under concurrent writes, which this review did not probe.
 
+### v1.1 review — 2026-09-25 (reviewer: claude, as owner)
+
+Checked: one task commit `9f5b50a` with the trailer; both given tests byte-identical; protected
+files untouched; `make gate` → `gate: ok`; `make smoke` → `smoke: ok (stream spread 1006 ms)`.
+Probed: `/_crossbar/usage` on an empty store answers `[]`; a stream cut by the client after
+0.4 s appears in `/_crossbar/metrics` as `crossbar_requests_total{…,status="499"} 1`.
+
+Process: four sessions for one task. Sessions 1–3 each ended their turn right after the sandbox
+refused a write or read outside the repository (the I9 pattern) — after the fix was already
+correct, in sessions 2 and 3. Session 3 also chased test flakes caused by its own inference
+loading the host (the owner measured 12/12 passes idle). Findings: (a) model — five
+refusal-endings tonight in total; `AGENTS.md` now names the rule, and the fourth session obeyed
+it; (b) task — the task text did not state that `httputil.ReverseProxy` aborts the handler with
+`http.ErrAbortHandler` on client disconnect, the fact the fix depends on (added mid-run); (c)
+test design — timing-based tests (limiter, queue, spread, cancel) have margins tuned for an idle
+host; widen or retry in a later plan.
+