Cartethyia 2.7.0

Removed

• The process-wide concurrency cap. Admission now governs in-flight requests alone: the tenant ceiling and each key's own limit, both set in Settings. The second ceiling was derived from the memory limit, was never a number an operator set, and was the smaller of the two — so a tenant configured to 100 was refused by a constant the Settings page never mentions. CARTETHYIA_PROCESS_CONCURRENCY_LIMIT is gone.
• The model-abuse strike and ban layer. Ten invalid-model requests inside thirty minutes banned a caller for six hours with 403 model_abuse_banned, by a counter no setting exposes and the rate ceiling does not interact with. Removed, along with the four CARTETHYIA_MODEL_STRIKE_* / CARTETHYIA_MODEL_BAN_* knobs.

Fixed

• The memory limit no longer pretends every host without a cgroup is a 512 MiB container; the fallback is the host's real memory.
• Qoder tool calls carry their arguments: tool history is sent in the shape INTL reads, messages carry {role, content} only, model_config declares format: "openai", and a named tool_choice is a bare string.
• Qoder recovers a call written into its thinking, including leftover closing tags without the DSML marker, and salvages an echo whose inner quotes were left unescaped.

Added

• The in-flight snapshot reports oldestAgeMs, so a growing age beside a flat count shows a sweep that is not running.
• cartethyia_ip_abuse_refusals_total records why the abuse layer refuses.

Changed

• Tailscale requires a live serve before reporting a tunnel active, and names the address or says why there is none.

npm: npm i -g cartethyia@2.7.0