Skip to content

Owner console

Open vacancyd owner console from the Start menu as your ordinary Windows user. The window shows the local service's current lending decision, owner protection, resource observations, borrowing routes, installation versions and saved lending policy. The sidebar selects Overview, Hardware, Workloads, Installation or Settings. Only the selected view is displayed. The overview fits a normal desktop window; smaller windows, enlarged text and long resource/work lists scroll within that view.

Use Pause lending to refuse new work, or Resume lending to allow work when all owner and resource protections permit it. Hardware has a sharing switch for each resource. Each change asks for confirmation and displays the service's acknowledgement or an error. These are runtime switches: restarting the service restores the configured defaults. Pausing does not guarantee immediate upstream cancellation or freed GPU memory; existing work follows the reclaim policy.

Installation also has a Troubleshooting panel. Debug logging for 30 minutes makes the service log each GPU pressure decision and then return to its configured level by itself; the button shows the time left and can end the window early. Turning it on or off asks for administrator approval. Export diagnostics saves the service's diagnostics export to a file you choose. See logging and diagnostics.

Settings changes a whitelisted subset of the protected configuration. Task tabs cover owner protection, hardware, GPU pressure, workloads and service limits. Each separates standard controls from advanced options; search reveals and focuses a setting without losing edits. A save validates the complete staged configuration and preserves unexposed fields. After durable replacement, model and default capacity budgets apply to new admissions while existing work keeps its lease. Remaining policy requires a service restart, with a persistent notice until the running service reports the saved startup revision. Capacity-only saves do not require that restart. Discard changes and reload recovers from a stale edit; it discards unsaved form changes and asks first when there are any. A failed settings read shows a separate Retry outside the hidden form. The console does not restart the service.

The notification-area icon offers Open console, Pause/Resume lending and Quit console. Its menu and tooltip name the same state as the window's headline, including Preparing safe lending while pressure calibrates. Left-click restores the window; right-click opens the menu. Closing the window hides it to the tray. Quit exits the console only: the service and session reporter remain independent. Windows may initially place the icon in the notification overflow; its placement is controlled by Windows.

The MSI adds a separate vacancyd owner controls Startup entry. It opens the tray quietly at logon and does not replace the session agent. Windows Startup Apps can disable the console entry independently. Opening the console again restores the existing instance in that Windows session.

The Windows x86-64 console requires the Microsoft Edge WebView2 Runtime. If it cannot open, install the Evergreen Runtime from Microsoft and try again. The MSI does not download or install a browser runtime. See Microsoft's deployment guidance. The service and reporter can operate independently of this prerequisite.

The console reads http://127.0.0.1:9811/status and the whitelisted settings endpoint on the same fixed loopback address. It sends Pause, Resume, hardware switches and settings saves over the service's admin pipe as the signed-in Windows account. Any signed-in user may pause, and the account that paused may resume; resuming another account's pause, switching hardware and saving settings raise the Windows approval prompt (see local administration on Windows). An installation using a different API port, or disallowing anonymous loopback reads, cannot currently use the console. The renderer never reads a bearer token, the protected configuration file or raw TOML. The service returns only the typed policy fields documented in the settings contract.

  • Vacancy, amber: at least one configured borrowing route can admit work.
  • No vacancy, slate: borrowing is withheld, including normal owner presence.
  • Only exempt routes are lending: the owner veto is active, and a route configured with owner_scope = "resource" is still admitting or running borrowed work. It reads amber with VACANCY while that route can admit work, and slate while it is only finishing work it already accepted. The console never says Owner policy pauses new work while an exempt route is lending; it says so, with the route named, when an exempt route is idle.
  • Calibrating, slate: the service is preparing its pressure baseline.
  • Unavailable evidence, ember: the current answer cannot be trusted or the service cannot be reached. Previous measurements are cleared.

The sign's lettering stays lit in both normal states: the V of the mark and VACANCY stay amber, while NO lights only when borrowing is withheld. The sign goes dark only while the console has no readable answer from the service, including before the first one arrives. The surrounding status uses the colours above. An explicit screen-reader label and the adjacent status text carry the same decision; high contrast hides the unlit NO without moving VACANCY.

Resource lendability is distinct from overall admission: an otherwise usable GPU can remain withheld because the owner is present. When any route is exempt from the owner veto, the overview names it under the protection summary, and that route's card on Workloads says Owner presence: Exempt, with what can still stop it: owner pressure on its GPUs, or, for a dependency no pressure measurement watches, only free capacity. Its rows under Owner return by workload in Settings say those choices apply only when pressure reclaims it. The tray reads "Owner policy pauses new work; exempt routes still lending" in the same case. See resource-scoped upstreams. Upstream cards report admission and adapter capabilities separately from a read-only target HTTP check. They also report the observed direct-listener boundary as Loopback only, Listens on network, Unknown, or Not observable here. A network listener is not by itself a claim of Internet exposure, but requests made to it directly bypass vacancyd's owner protection and admission ledger. Treat Unknown as a prompt to inspect the upstream bind before relying on that boundary. Not observable here means vacancyd cannot match the configured target address to local listeners: it is not a loopback address, localhost, or an address of one of this machine's interfaces. Another host's bind, or a container's in its own network namespace, cannot be read from here, so check it where the upstream runs. The service samples the adapter's version/models/system-stats endpoint every ten seconds, without credentials or redirects, with a two-second limit. A successful response confirms HTTP reachability, not inference readiness or job completion. Checks older than thirty seconds are stale; retained response codes are hidden. Reporter age and version are shown for each applicable session.

Resources outside every borrowing route are labelled Not used. Their unknown observations do not override the service's machine-readiness verdict, and the console offers no sharing control for them. Resource cards include the stable resource ID and, when ready, the observed PCI mapping so identical GPU labels remain distinguishable. GPU utilization is labelled separately from available VRAM. Capacity, adapter-mapping and owner-pressure errors are shown as bounded diagnostics; they do not replace the daemon's admission decision.

Status polling is read-only, with one request in flight, a two-second total transport timeout and a 1 MiB response limit. Redirects and environment HTTP proxies are disabled. The renderer has status, lending switch and whitelisted settings commands. It cannot select another host, HTTP operation or file. Changes go over the admin pipe, which the service answers from the caller's Windows account, never from anything the renderer sends. Responses are bounded; ambiguous failures prompt a status refresh or settings reload, never an automatic retry. Controls remain unavailable when status is unknown. See the interaction contract and the settings contract. No shell, direct filesystem, credential, service-control or arbitrary HTTP plugin is registered. External navigation, new windows and downloads are refused. Fonts and images are embedded locally. Observed data is neither saved as history nor sent to an analytics service.

Use Tab to reach the sidebar links, owner controls and skip link. Enter selects a view; confirmation dialogs support Escape to cancel and restore focus. The layout reflows at narrow widths and honors reduced-motion settings. Body text has a 12px floor throughout, and WebView2's zoom hotkeys (Ctrl+plus/minus/wheel) are enabled so the owner can enlarge it further; whether WebView2 also honors the Windows Text size setting on its own is a native question the browser fixture tests cannot answer. Release qualification records native accessibility, Windows scaling and WebView2 behavior against an installed artifact; browser fixture tests alone do not establish those claims.

Building and checking

From the repository root, use Node 22, Rust 1.89 and the pinned lockfiles:

npm --prefix console/web ci --ignore-scripts
npm --prefix console/web run build
cargo build --locked --release --features windows-session
cargo build --locked --release -p vacancyd-console

The last command builds a supported GUI only for Windows. Existing WiX packaging consumes all three binaries from the same release directory; Tauri does not create a second installer or updater. Its host is pinned to Tauri 2.11.5 and tauri-build 2.6.3. The framework-free TypeScript renderer has no npm runtime dependencies; TypeScript and Playwright are development tools.

For browser fixtures, install the pinned Playwright Chromium build and run npm --prefix console/web test. These tests inject synthetic responses before the page opens; no test selector or fixture-loading route is shipped. To rebuild the Windows icon from the existing SVG mark, run node build-icon.mjs from console/web with that browser available. Its 16px frame drops the hanging rail, as the brand guide requires. Check in the resulting ICO.

The test screenshot, native artifact hashes, resource measurements, accessibility receipts and installer lifecycle evidence belong to the release qualification record.