feat: DuckDB quantiles in-process (gcc CGO), not Ladybug.

OQ3: internal/duckstats + bin/qa/stats.go. Zig stays Ladybug-only.
mikefarah/yq for small structured slices. Gitea #30.

docs/README.md

@@ -20,7 +20,7 @@ Evidence-first knowledge graph. Facts need proof or they are
 | explanation | [roadmap](roadmap.md) — gap to v1 (epic #16) |
 | howto | [picoclaw](picoclaw.md) — MCP agent profile |
 | howto | [reasoner](reasoner.md) — CPU bake-off (D18) |
-| reference | [PLAN.md](../PLAN.md) — decisions D1–D21 |
+| reference | [PLAN.md](../PLAN.md) — decisions D1–D22 |
 
 Decisions the public face must name: **D3** SearXNG compose, **D6** Go service /
 Python write sidecar, **D14** `bin/{subject}/{method}.go`, **D15** Gitea origin,

docs/picoclaw.md

@@ -1,18 +1,34 @@
 # PicoClaw profile (reference agent)
 
-2dph is the memory/fact gate. PicoClaw (or any MCP client) is the agent loop
-and is **not** shipped in this repo.
+2dph is the memory/fact gate. Compose profile `picoclaw` runs the official
+PicoClaw gateway (`docker.io/sipeed/picoclaw:v0.3.1`) plus `brain-mcp` and the
+CPU reasoner. Default agent model is `qwen3.5:9b` (RAM path, D18). Weights stay
+in the reasoner volume, not in the 2dph image.
+No secrets in git: Ollama needs no key; MCP is local HTTP.
 
 ```bash
-docker compose --profile picoclaw up brain-mcp
+docker compose --profile picoclaw up -d
+# already serving :8630 / :11435:
+docker compose --profile picoclaw up -d --no-deps picoclaw
 ```
 
-The API listens on `127.0.0.1:8630`. Point the agent at
-`http://127.0.0.1:8630/mcp` using [deploy/picoclaw/mcp.json.example](../deploy/picoclaw/mcp.json.example).
+Gateway: `127.0.0.1:18790`. Brain MCP: `http://127.0.0.1:8630/mcp`.
+Cursor-style clients can use [deploy/picoclaw/mcp.json.example](../deploy/picoclaw/mcp.json.example).
+PicoClaw itself uses [deploy/picoclaw/config.json](../deploy/picoclaw/config.json)
+(`127.0.0.1` + host network — loopback publishes are not reachable via docker0).
 
 OpenAPI: `GET http://127.0.0.1:8630/openapi.json`.
 
 Before a factual reply: `search` → `get` → `audit`. `throttled` is not a
 negative finding. See `skills/picoclaw/SKILL.md`.
 
-No Cursor required. A live PicoClaw binary/image is an operator choice.
+System performance (MCP gates + qwen3.5:9b tool_call + PicoClaw gateway):
+
+```bash
+./qa/system_perf.py --json | yq '.gates'
+REASONER_MODEL=qwen3.5:9b ./qa/system_perf.py --reasoner --picoclaw --json | yq '.reasoner'
+```
+
+The default agent model is `qwen3.5:9b`. PicoClaw `context_window` is 8192
+(heuristic `max_tokens*4` at 512 is 2048, too small for MCP tool schemas).
+`request_timeout` is 600s for a CPU turn (tool_call + MCP search + answer).

docs/reasoner.md

@@ -1,8 +1,8 @@
 # Reasoner bake-off (D18)
 
 Pluggable OpenAI-compatible URL. 2dph does not ship weights. PicoClaw is
-not in this repo; the bake-off hits the same tool names PicoClaw would
-(`search` → `get` → `audit` from `internal/httpapi.Ops`).
+compose profile `picoclaw` (`sipeed/picoclaw`); the bake-off hits the same
+tool names (`search` → `get` → `audit` from `internal/httpapi.Ops`).
 
 ```bash
 docker compose --profile reasoner up -d reasoner
@@ -11,6 +11,8 @@ REASONER_BASE_URL=http://127.0.0.1:11435/v1 REASONER_MODEL=qwen3.5:9b \
   ./bin/reasoner/bakeoff.go --json
 ```
 
+JSON includes `latency_p50_ms` / `latency_p95_ms` from DuckDB (`internal/duckstats`, D22).
+
 Host Ollama on `:11434` is left alone. This sidecar binds `127.0.0.1:11435`
 with `OLLAMA_NUM_GPU=0` (CPU). Measure RSS (`/api/ps` `size`), not VRAM.
 

docs/roadmap.md

@@ -36,14 +36,14 @@ Epic [#16](https://git.produktor.io/eSlider/2dph/issues/16) closed.
 
 ## v2
 
-[#6](https://git.produktor.io/eSlider/2dph/issues/6) OCR — `pdftotext` then
-`pdftoppm` + tesseract `eng+deu`. Optional `ocr-paddle`.
+[#6](https://git.produktor.io/eSlider/2dph/issues/6) OCR — **in**.
+[#30](https://git.produktor.io/eSlider/2dph/issues/30) OQ3 duckdb-go — **in**.
 [#29](https://git.produktor.io/eSlider/2dph/issues/29) OQ1 contradiction
-resolution. [#30](https://git.produktor.io/eSlider/2dph/issues/30) OQ3 duckdb-md.
+resolution.
 
 ## Blockers
 
-None for epic #16 (closed). Remaining v2: OQ1, OQ3, OQ4.
+None for epic #16 (closed). Remaining v2: OQ1, OQ4.
 
 ```
 question
@@ -58,8 +58,8 @@ question
 
 ## Not v1
 
-OQ1 contradiction resolution, OQ3 duckdb-md export, OQ4 YAML-first leafs.
-OCR (OQ2) is in: tesseract, not docling.
+OQ1 contradiction resolution, OQ4 YAML-first leafs.
+OCR (OQ2) and duckdb-go (OQ3/D22) are in.
 
 ## Close epic #16 when