fix(kernel,server,tui,inference): generic resource gauge + F-002/F-003/F-004

- generic SystemResourceProbe: owner-agnostic /proc/meminfo system RAM
  overlaid on the vendor GPU probe, wired on both managed and static paths
  so the VRAM/GPU/RAM gauge renders with an external llama-server (was dormant)
- F-002: classify provider 4xx (e.g. llama.cpp 400) as terminal, not retryable
  (except 408/429); stops retrying deterministic request failures to exhaustion
- F-003: FileSystemPromptLoader expands leading ~ / ~/ to user home
- F-004: map InferenceFailedEvent + RetryAttemptedEvent to new
  ServerMessage.InferenceFailed / RetryAttempted, decoded+rendered in tui-go;
  ArtifactContentStoredEvent explicitly mapped to null (internal, no warn)
- tests: tilde expansion, SystemResourceProbe (static/managed/fail-soft)

qa/audit-report-2026-06-08.md

@@ -94,7 +94,9 @@ repo `docs/schemas/` were stale relative to live — a clean-checkout reproducti
   identical 400s within ~80ms, then `WorkflowFailedEvent retryExhausted=true`.
 - **suspected cause:** retry classifier treats all provider failures as retryable. A 400
   `invalid_request_error` is deterministic request-construction failure → should be terminal.
-- **status:** confirmed
+- **status:** FIXED (2026-06-10) — `SessionOrchestrator.isRetryableFailure` parses the
+  provider status from the failure reason; 4xx is terminal (except 408/429), 5xx/network/
+  unknown stay retryable. So a 400 now fails fast instead of burning the retry budget.
 
 ### F-003 — `~` not expanded in default_system prompt path
 - **subsystem:** core/kernel (prompt loading) / core/config
@@ -103,7 +105,8 @@ repo `docs/schemas/` were stale relative to live — a clean-checkout reproducti
   Prompt not found (searched: .../prompts/~/.config/correx/prompts/default_system.md)` —
   tilde concatenated literally onto the config dir. Logged ERROR on every attempt.
   Non-fatal (run proceeds) but noisy + the default system prompt is silently absent.
-- **status:** confirmed
+- **status:** FIXED (2026-06-10) — `FileSystemPromptLoader.expandTilde` resolves a leading
+  `~`/`~/` to the user home before lookup (unit-tested).
 
 ### F-005 — file_read jails relative paths against process cwd, not the workspace
 - **invariant/contract:** functional (tool jailing) / two-plane consistency (#9)
@@ -192,9 +195,10 @@ repo `docs/schemas/` were stale relative to live — a clean-checkout reproducti
 - **evidence:** `DomainEventMapper: unmapped payload type=InferenceFailedEvent` and
   `=RetryAttemptedEvent` repeated. Operator sees failure only via router narration, not a
   structured failure/retry surface in the TUI.
-- **status:** confirmed
-- **note:** `ArtifactContentStoredEvent` is also unmapped (`DomainEventMapper: unmapped
-  payload type=ArtifactContentStoredEvent`) — same class of gap, new event added this session.
+- **status:** FIXED (2026-06-10) — new `ServerMessage.InferenceFailed` /
+  `RetryAttempted` variants; `DomainEventMapper` arms map `InferenceFailedEvent` /
+  `RetryAttemptedEvent`; tui-go decodes + renders them as session events. The internal
+  `ArtifactContentStoredEvent` is now explicitly mapped to null (no operator surface, no warn).
 
 ### F-008 — stage `token_budget` not propagated to provider `max_tokens` → truncation
 - **invariant/contract:** functional (workflows run end-to-end) / #7 (validatable output)
@@ -326,8 +330,9 @@ repo `docs/schemas/` were stale relative to live — a clean-checkout reproducti
   contents) were cut off mid-generation, burning all retries → `did not produce patch`.
 - **root cause:** `OrchestrationConfig.stageTimeoutMs` defaults to `60_000L` and is hardcoded
   in `Main` (`defaultOrchestrationConfig`) with no config wiring.
-- **status:** PARTIAL — raised to `180_000L` in `Main`. Should be surfaced as a config knob
-  (TODO left at the patch site).
+- **status:** FIXED — now a real config knob `orchestration.stage_timeout_ms`
+  (`CorrexConfig.OrchestrationKnobs`, default 180s), parsed by `ConfigLoader`, written by
+  `CorrexConfigWriter`, live-editable via `EditableConfig`, wired in `Main.kt`.
 
 ### F-017 (observation, not a correx defect) — local model does not reliably issue write tools
 - **invariant/contract:** n/a (model capability)