docs(backlog): record llama-probe registration (64a90e7) + event-store probe in RETRO

A§4 LLAMA_SERVER probe is now registered (gated on a llamacpp provider URL); EVENT_STORE
latency probe was already wired (266bbf0). Both move to RETRO. Remaining A§4: tokens/sec
throughput feed (health endpoint is reachability-only) + live health TUI pane.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

BACKLOG.md

@@ -28,7 +28,7 @@ matching bullets below are superseded; only the noted follow-ups remain live:
 
 - **G** turnId `/repo`↔`/repo2` collision + WorkspaceStateProbe newline fingerprint — `784accb`
 - **I** `.cs`/Godot-Mono symbols — `f715ffa`; structural `.tscn`/`.tres` validator — `0e251d6`
-- **A §4** EventStore latency probe (wired) + llama-server probe — `266bbf0` *(follow-up: llama probe live wiring)*
+- **A §4** EventStore latency probe (wired) + llama-server probe — `266bbf0`, **registered** `64a90e7` (gated on a configured `llamacpp` provider URL)
 - **B §6 + C-A3** `CritiqueFinding` type + calibration projection — `f783eed` *(follow-up: `CritiqueOutcomeCorrelatedEvent` producer)*
 - **C-A1** brief echo-back gate — `1df7af5` *(follow-up: `planner.md` brief_echo + `role_pipeline` metadata to activate)*
 - **C-A2** stage-level plan checkpointing — `1a1b5cc`
@@ -51,9 +51,12 @@ matching bullets below are superseded; only the noted follow-ups remain live:
 Metrics + CLI + TUI pane and the health backbone are shipped (fe94140, 4f6bfa8,
 f8fd260) — those are RETRO candidates once live-QA'd. Remaining:
 
-- [ ] **§4 LLAMA_SERVER health probe** — liveness + tokens/sec degradation trend
+- [x] **§4 LLAMA_SERVER health probe** — `266bbf0` (probe) + `64a90e7` (registered in the health
-      (session-scoped, needs HTTP). Same `HealthProbe` framework as the shipped disk probe.
+      monitor, gated on a `llamacpp` provider URL, via `HttpLlamaLivenessClient`). Liveness is live;
-- [ ] **§4 EVENT_STORE health probe** — append + fsync latency heartbeat.
+      tokens/sec degradation needs a throughput feed (the `/health` endpoint is reachability-only) —
+      that remainder noted in RETRO. → RETRO.
+- [x] **§4 EVENT_STORE health probe** — append + fsync latency heartbeat. `266bbf0`
+      (`EventStoreLatencyProbe.forStore`, wired into the health monitor). → RETRO.
 - [ ] **§4/§3 live health TUI pane** — deferred to follow the metrics cadence
       (projection + CLI first, then pane). `correx health` CLI already exists.
 - [ ] **§3 tier-2 stats** — full session-completion summary pane polish (basic pane shipped).

RETRO.md

@@ -35,12 +35,13 @@ Nine tracks, each compiled + unit-tested green before commit.
 | `4b0024f` | Batch source-list fetch-approval: `POST /sessions/{id}/approve-sources` → `SourceListHosts.extract` (java.net.URI, lower-cased, ports stripped, dossier-line tolerant) → one `EgressHostsGrantedEvent`; live allowlist then auto-clears those web_fetches (no per-URL T2) | D |
 | `f107ff5` | Idea-board → project-profile promotion: `IdeaPromotedEvent` (board tombstone, like discard) + `ProjectProfileWriter` (escape-aware TOML serialize/write) + `ProjectProfile.withConvention` (deduped) + server `PromoteIdea` handler (loads profile, appends idea text, writes `.correx/project.toml`); also made `SimpleToml`'s reader unescape `\\`/`\"` symmetrically with the writers (fixes pre-existing read/write asymmetry) | E |
 | `4e08510` | Architect contradiction-check **activation**: `ServerModule.start()` subscribes to the architect stage's `design` `ArtifactCreatedEvent`, resolves decision text (design-schema `approach` field, capped fallback), runs `ArchitectContradictionChecker.check`, appends the non-null `PossibleContradictionFlaggedEvent`. Live-only, never halts. Checker built in `Main.kt` (gated on `project.enabled`) and threaded into `ServerModule`. Replaces the `Main.kt` `TODO(wiring)` | B §4 (activation) |
+| `64a90e7` | Llama-probe **registration**: `LlamaServerHealthProbe` (266bbf0) wired into the health monitor when a `llamacpp` provider URL is configured — dedicated CIO client (3s timeout, shutdown-hook close) + `HttpLlamaLivenessClient`. Gated so a model-less box reports no spurious `LLAMA_SERVER` DEGRADED. Replaces the `Main.kt` `TODO(wiring)` | A §4 (activation) |
 
 ### Follow-ups created this pass (refiled into BACKLOG)
 - **C-A1 activation** — `planner.md` must emit a `brief_echo` block and `role_pipeline.toml` must set `briefEcho="true"` / `briefEchoSource` for the gate to fire live (model-dependent → live-QA).
 - **C-A3 producer** — nothing emits `CritiqueOutcomeCorrelatedEvent` yet; the calibration projection has no live feed until a reviewer-loop producer records finding outcomes.
 - **B §4 wiring** — ✅ DONE (`4e08510`): `ServerModule.start()` now subscribes to the architect `design` artifact and emits the flag. (In-session L3 embedding is NOT needed — the checker filters to PRIOR sessions by design, so it works against prior runs' distilled decisions.)
-- **A §4 llama wiring** — `LlamaServerHealthProbe` is unregistered: an `HttpClient` + tokens/sec telemetry aren't exposed to the health-monitor scope yet (`// TODO(wiring)` in `Main.kt`).
+- **A §4 llama wiring** — ✅ DONE (`64a90e7`): the probe is registered in the health monitor (gated on a configured `llamacpp` provider URL) via `HttpLlamaLivenessClient`. (tokens/sec telemetry still rides liveness-only — the `/health` endpoint reports reachability; a throughput feed remains future work but the spec's liveness probe is live.)
 - **D egress wiring** — ✅ DONE (`ab7e4be`): session egress state is now threaded into `ToolCallAssessmentInput` at `runPlane2Assessment`, so `NetworkHostRule` consults the live union. Batch fetch-approval ✅ DONE (`4b0024f`): `POST /sessions/{id}/approve-sources` emits one `EgressHostsGrantedEvent` for the whole source list.
 - **B §5 static_check stage** — runner/event/filter complete and the filter is live, but no workflow stage emits `StaticFindingsRecordedEvent` yet (`// TODO(wiring)` in `StaticAnalysisRunner.kt`); needs an event-emitting deterministic stage-type seam.
 - **E toolchain** — tui-go now builds via auto-downloaded go1.24.2 (`GOTOOLCHAIN=auto`). The committed directive fix assumes 1.26 was unintended; bump if a specific newer release is actually wanted.