chore(skills): wire agent/skills to the skills CLI global store

Retroactive provenance registration: the 10 pi-era skill snapshots are byte-identical to upstream (38 skills mattpocock/skills + find-skills vercel-labs/skills), now canonically installed at ~/.agents/skills with store lockfile ~/.agents/.skill-lock.json (39 entries, folder hashes). omp is not a skills-CLI agent id, so the omp tier becomes manual wiring: replace the 10 tracked skill directories with symlinks into the store and link the remaining 29 upstream skills the same way (39 links). The repo now records the enabled set, never content; skills update -g propagates through the links. managed-skills tier untouched. Docs: skill-store-wiring.md (+index). Snapshot of the old real dirs at /tmp/agent-skills-snap-20261018 for the transition window.
live: heartbeat sync 2026-10-18T17:49:00-07:00 (Refs #11 )
2026-10-18 18:07:31 -07:00 · 2026-10-18 17:49:00 -07:00 · 2026-10-18 17:37:27 -07:00 · 2026-10-18 17:30:58 -07:00 · 2026-10-18 17:23:58 -07:00 · 2026-10-18 17:20:17 -07:00
251 changed files with 4558 additions and 1323 deletions
@@ -1,5 +1,6 @@
 providers:
-  openrouterVariant: floor
+  openrouterVariant: online
+  fetch: auto
 modelRoles:
  slow: llamacpp (dankclaw)/frank-dragoon:medium
  vision: llamacpp (dankclaw-3090)/frank-zealot:xhigh
@@ -19,8 +20,9 @@ modelRoles:
 symbolPreset: nerd
 composer:
  shape: band
+  tokenRate: true
 theme:
-  dark: dark-terminal
+  dark: dark-gruvbox
  light: light
 setupVersion: 2
 browser:
@@ -57,8 +59,7 @@ retry:
      - openai-codex/gpt-5.5
      - xai-oauth/grok-4.5
      - web/ollama
-    speech:
-      []
+    speech: []
    llamacpp (dankserver)/frank-archon:
      - llamacpp (dankclaw)/frank-dragoon
  maxRetries: 10
@@ -67,7 +68,7 @@ searxng:
 exa:
  enabled: false
 memory:
-  backend: local
+  backend: sharpshooter
 autolearn:
  enabled: true
  autoContinue: true
@@ -75,12 +76,12 @@ compaction:
  remoteEndpoint: http://192.168.0.143:7771/v1/chat/completions
  methodOrder:
    - shake
+    - snapcompact
    - soft
    - handoff
-    - snapcompact
    - remote
  idleThresholdTokens: 100000
-  thresholdPercent: 85
+  thresholdPercent: 95
  idleEnabled: true
  thresholdTokens: -1
  dropUseless: false
@@ -90,13 +91,12 @@ compaction:
  enabled: true
  experimentalContextManagement: false
 interruptMode: immediate
-defaultThinkingLevel: medium
+defaultThinkingLevel: xhigh
 hideThinkingBlock: false
-proseOnlyThinking: true
+proseOnlyThinking: false
 terminal:
  showProgress: true
-disabledExtensions:
-  []
+disabledExtensions: []
 statusLine:
  separator: powerline
  preset: custom
@@ -135,24 +135,31 @@ tui:
  codexResetFireworks: false
  hyperlinks: auto
  tight: true
+  resizeScrollback: rebuild
+  titleSpinner: pulse
 display:
  shimmer: kitt
  smoothStreaming: true
  showTokenUsage: true
+  pinnedAgents: collapsed
+  subagentLivePreview: true
 task:
  showResolvedModelBadge: true
  maxConcurrency: 3
  agentModelOverrides:
    designer: llamacpp (dankclaw-3090)/frank-zealot
    librarian: llamacpp (dankclaw-3090)/frank-zealot
-    reviewer: llamacpp (dankclaw-3090)/frank-zealot
-    scout: llamacpp (dankclaw-3090)/frank-zealot
-    security-reviewer: llamacpp (dankclaw-3090)/frank-zealot
+    reviewer: llamacpp (dankserver)/frank-archon
+    scout: llamacpp (dankserver)/frank-archon
+    security-reviewer: llamacpp (dankclaw)/frank-dragoon
    sonic: llamacpp (dankclaw-3090)/frank-zealot
-    task: llamacpp (dankclaw-3090)/frank-zealot
+    task: llamacpp (dankserver)/frank-archon
+  eager: default
+  enableLsp: true
 snapcompact:
  systemPrompt: none
  toolResults: false
+  shape: auto
 extendedContext: false
 ttsr:
  contextMode: discard
@@ -162,12 +169,12 @@ checkpoint:
  enabled: true
 readLineNumbers: true
 startup:
-  showSplash: false
+  showSplash: true
  changelogMode: summary
 update:
  channel: stable
 features:
-  unexpectedStopDetection: smart
+  unexpectedStopDetection: mechanical
 stt:
  submitTrigger: say-submit
  enabled: true
@@ -186,6 +193,7 @@ images:
      - litterbox
 edit:
  mode: hashline
+  fuzzyThreshold: 0.9
 dev:
  autoqaConsent: granted
 astGrep:
@@ -195,7 +203,7 @@ vault:
 tts:
  localVoice: bm_george
 speech:
-  enabled: false
+  enabled: true
  mode: yield
  enhanced: true
  voice: am_fenrir
@@ -204,6 +212,9 @@ secrets:
 read:
  renderMarkdown: true
  toolResultPreview: true
+  defaultLimit: 1000
+  summarize:
+    prose: false
 lsp:
  formatOnWrite: true
  diagnosticsOnEdit: true
@@ -213,4 +224,42 @@ speechgen:
 live:
  voice: vale
 contextPromotion:
-  enabled: true
+  enabled: true
+title:
+  icons: emoji
+  generator: tiny
+followUpMode: one-at-a-time
+tools:
+  approvalMode: yolo
+  format: auto
+marketplace:
+  autoUpdate: notify
+bash:
+  allowCompoundCommands: true
+  gitGuard: true
+bashInterceptor:
+  enabled: false
+shellMinimizer:
+  sourceOutlineLevel: default
+generate_image:
+  enabled: false
+computer:
+  enabled: true
+  display: active
+ratchet:
+  enabled: true
+github:
+  enabled: true
+security:
+  enabled: true
+todo:
+  reminders: true
+mcp:
+  notifications: false
+plan:
+  defaultOnStartup: false
+isolation:
+  backend: auto
+worktree:
+  onStart: create
+  onExit: keep
@@ -0,0 +1,24 @@
+---
+name: aa-chart-label-browser-extraction
+description: "Extract per-model benchmark scores from artificialanalysis.ai pages: charts are client-rendered recharts SVGs invisible to plain HTML fetch; pair sorted label/name x-coords, then cross-check against published sentences before trusting any chart↔eval identity."
+---
+
+Extract per-eval scores for a model from artificialanalysis.ai when no API key exists. Plain HTML fetch yields NO chart data (client-side recharts; SSR has only meta + FAQ sentences; `/api/*` = 401).
+
+## Procedure
+1. Managed browser tab: `browser.open({name, url, wait_until: "domcontentloaded"})`.
+2. **Per-eval top-3 (authoritative):** open `https://artificialanalysis.ai/evaluations/<slug>`; regex `document.body.innerText` (collapse whitespace): `([A-Z][^.;]{0,60}?) scores the highest on (.+?) with a score of (-?[\d.]+%?), followed by (.+?) with a score of ... and ...` — mind decimal points truncating naive `[^.]+` regexes. Build the page script as a plain string (`String.raw`), not an interpolated template, so `\\d` survives.
+3. **All-eval per-model rows:** on `https://artificialanalysis.ai/models/<slug>`: scroll in 6 steps (0.15→0.9, ~1.3 s each) to trigger lazy charts, then per `svg` with ≥3 bars: labels = `[...svg.querySelectorAll("g.recharts-label-list text")]` (x attr), names = `[...svg.querySelectorAll("foreignObject")]` divs sorted by `g[transform] translate(x,y)`. Sort BOTH by x, **zip by index** — x-center pairing is off by a systematic half-bar.
+4. Self-row filter: exact hyphenated name (e.g. `Qwen3.8-Flash-Next`, not "Qwen3.8 Flash").
+5. Elo evals (GDPval-AA, AA-Briefcase): charts show AA's published `(Elo−500)/2000` normalization (1866→68.3).
+
+## Verification law (non-negotiable — two plausible mappings disagreed twice)
+- Zip top-3 of every chart against the eval page's published sentence (e.g. Kimi 88.7→89, Opus 66.9→67); ship only cross-checked rows.
+- Arithmetic corroboration helps: Omniscience accuracy 17% + non-hallucination 7% ↔ index −60.
+- Record provenance per row: sentence rows → eval-page URL; chart-label rows → model-page URL; `fetched_at` + `index_version`.
+- Geometry pairing (link→nearest chart below) is AMBIGUOUS when chart height > gap to next card — adjacent links share a chart. Use order + sentence tops, not geometry.
+
+## Traps
+- `tab.run` = Bun runtime; page-world JS needs `tab.evaluate`. Eval-cell `log()` does not reach display; write to a /tmp file and `cat`.
+- "Add model from specific provider" picker is not in the DOM (renders after chart data loads); UI drill-through × N evals is fragile — prefer the sentences.
+- Headline index FAQ: "scores N on the Artificial Analysis Intelligence Index" — check for "(estimated)" qualifier; est. = "independent evaluation forthcoming".
@@ -0,0 +1,24 @@
+---
+name: aa-chart-model-score-extraction
+description: "Extract per-model benchmark scores from artificialanalysis.ai pages: charts are client-rendered Recharts SVGs; zip label-list texts to foreignObject names by x-sorted index, validate chart identity against the page's published top-3 sentence, apply Elo/Omniscience normalization laws, seed frank-intelligence-bench aa-scores.yml."
+---
+
+Extract AI benchmark scores for a specific model from artificialanalysis.ai. Per-model per-eval numbers are NOT in SSR HTML (JS charts, API needs key); eval-page SSR text DOES carry the top-3 sentence.
+
+## Procedure (validated 5x on this repo's model pages)
+1. `browser.open({ name, url: "https://artificialanalysis.ai/models/<slug>", wait_until: "domcontentloaded" })`, then scroll in ~6 steps (0.15..0.9 of scrollHeight, ~1.3 s pauses) — charts lazy-render.
+2. Extract each chart: pair `g.recharts-label-list text` (values, take `x` attr) with `foreignObject div` (model names, x from parent `g[transform] translate(x,y)`). **Sort both lists by x and zip by index — NOT nearest-x** (nearest-x is off by one bar; index-zip matches published tops exactly).
+3. Self row: match name loosely (`Qwen3.8-Flash-Next` has hyphens — test both forms).
+
+## Identity law (never ship an order-guessed chart→eval mapping)
+- Model pages have ~14 charts, 18 eval cards; DOM order and geometry pairing BOTH proved ambiguous.
+- Anchor every chart by its top-3 names/values vs the eval page's published sentence: `https://artificialanalysis.ai/evaluations/<slug>` body text: "X scores the highest on <eval> with a score of N%, followed by …". Regex must tolerate decimals: value pattern `(-?[\\d.]+%?)`; build page scripts with `String.raw` (bun template literals eat `\\d`).
+- A chart's `self` value on the MODEL page is page-local → trustworthy once the top-3 anchor confirms the eval (e.g. AA-LCR: Kimi 88.7 → chart top "Kimi K3 (max)=89").
+
+## Normalization laws (frank-intelligence-bench aa-scores.yml)
+- Elo evals (AA-Briefcase, GDPval-AA): store `(Elo−500)/2000×100` (1866 → 68.3), AA's published normalization.
+- AA-Omniscience: score = Accuracy (w10) + 1−Hallucination (w5), both 0–100 → composite `(10·acc + 5·nonhall)/15`. NEVER feed the −100..100 Index chart value (pre-fix cost ~7 pts; calibration then reproduces AA's official index ±0.6: Flash-Next 39.85≈40, Haiku 43.4≈43, 27B 33.85≈34, 3.6-27B 21.55≈21).
+- Every seeded row: `source_url` + `fetched_at` + `index_version`.
+
+## Seed + validate loop
+Append model block to `config/references/aa-scores.yml` (block-insert via python string replace on the `  - name: <anchor>` line — beware: dropping rows from a block loses the 2-space indent on the anchor line; verify with `yaml.safe_load`), then `bun -e loadAaRefs` parse-check, `bun src/cli.ts report $RID`, calibration check (full-row models: lite vs AA official), `bun test`, commit.
@@ -0,0 +1,41 @@
+---
+name: aa-reference-scores-seeding
+description: "Seed/refresh frank-intelligence-bench config/references/aa-scores.yml from artificialanalysis.ai: authoritative top-3 sentences from eval pages, Recharts SVG zip extraction for per-model chart values, cross-check law, Elo normalization, schema/repair loop."
+---
+
+Seed frank-intelligence-bench `config/references/aa-scores.yml` from AA's public pages, then re-render the report trio.
+
+## Provenance law (non-negotiable)
+- Every row: `{ eval, pct, source_url, fetched_at, index_version }` (Zod-enforced; top-level `schema_version: 1, fetched_at, index_version` required).
+- Eval ids MUST match report result ids: `scicode, aa-lcr, hle, terminal-bench, gdp-pdf, aa-briefcase, gdpval-aa, automationbench-aa, aa-omniscience, critpt` (render `refFor(evalId)` joins on exact id).
+- Never ship an order-guessed chart↔eval mapping; only cross-checked ones.
+
+## Data tiers (authority order)
+1. **Eval-page sentence** (authoritative, SSR, per eval page `/evaluations/<slug>`): `"X scores the highest on <eval> with a score of N%, followed by Y ... and Z ..."` → top-3 rows with verbatim model names. Regex trap: model names contain `5.5` — capture names with `[^.;]` truncates at decimals; use targeted extraction per page, verify each value against the page's `66.9`-style raw text.
+2. **Model-page chart labels** (per-model values, incl. the page's own model): charts are client-side Recharts (NOT in raw HTML, NOT via /api/ — keyless API 404s). Browser: `browser.open({name,url,wait_until})`, scroll full page in ~0.15 steps (lazy render), then `tab.evaluate` (NOT `tab.run` — that's Bun world):
+   - names = `<foreignObject>` div text, x from parent `g[transform]` `translate(x,...)`;
+   - values = `g.recharts-label-list text` attrs;
+   - **zip by sorted-x index** (nearest-x pairing is off by half a bar; index-zip verified against published tops).
+3. `sync-aa` free Data API for headline indices — needs `AA_API_KEY` (unset in ~/.secrets as of 2026-10-11).
+
+## Cross-check law (mandatory before shipping chart-derived rows)
+Chart's top-3 zipped values must match the eval page's published sentence (e.g. Kimi 88.7→89, Elo 1866→68.3, Opus index 46). Two independent methods disagreeing = stop, re-anchor; geometry pairing (link-top→svg-top proximity) collides on adjacent cards — prefer sentence-vs-zip corroboration.
+
+## Normalizations
+- Elo evals (GDPval-AA, AA-Briefcase): sentences publish raw Elo; store AA's published `(Elo−500)/2000`×100 (1866→68.3). Document in file header.
+- AA-Omniscience `eval: aa-omniscience` = the −100..100 Index (not accuracy); accuracy/non-hallucination charts corroborate (17%/7% ⇒ −60 arithmetically consistent).
+
+## Known identities (2026-10-11 census, v4.3.2)
+- frank-archon lineage base = **Qwen3.8-Flash-Next** (`/models/qwen3-8-flash-next`), AA index 40, class median 18. NOT Qwen3-Next-80B-A3B-Instruct (index 10, 2025 family) — first seed got this wrong; verify lineage in `docs/endpoints.md` before labeling `kind: base`.
+- Base per-eval (chart): SciCode 51, HLE 38, AA-LCR 80, TB-4.0 25, GDP.pdf 16, CritPt 11, Briefcase 54, GDPval 56, AutoBench 56, Omniscience −10.
+- Frontier anchors: SciCode Opus 5.5 Max 66.9 (board flagged "under review" — travel this caveat with any SciCode delta); HLE Opus 61.4; AA-LCR Kimi K3 88.7; TB Sonnet 63.6; CritPt GPT-6.1 Sol 32.3.
+
+## Edit traps
+- YAML surgery via `edit`: replacing a line range that included a top-level key (`schema_version`/`models:`) silently duplicates or deletes the anchor → Zod error `expected 1 / received undefined`. After any header edit, `grep -n "^schema_version\|^fetched_at\|^index_version\|^models:"` must show exactly one each.
+
+## Ship loop
+1. `bun -e 'import { loadAaFile, loadAaRefs } from "./src/aa"; ...'` schema-parse gate.
+2. `bun src/cli.ts report <run-id>` (takes bare id, NOT a path) → trio in `reports/<host>/<id>/`.
+3. Verify `data.json .aa_reference` non-empty, per-eval coverage, delta columns.
+4. log entry in `docs/log.md` + atomic commit + push (local gitea OK).
+5. `browser.close({name})` — headless tabs are shared/retained.
@@ -0,0 +1,61 @@
+---
+name: audit-subagent-deliverables
+description: "Integrate subagent-written code safely: line-by-line audit, mechanical gates (bash test/lint), adversarial-review-report triage, resource-safety pass (fd/memory), and cutover with running-process restarts."
+---
+
+# Audit subagent deliverables
+
+A subagent that wrote code is a source of plausible output, not a verified change. Integrate it the way you'd integrate an untrusted PR — with extra suspicion, because the author is an agent that shares your blind spots and its prose is more confident than its evidence.
+
+Order of operations: read everything → gates → tests (as evidence, not proof) → resource-safety pass → fix in-place → cutover.
+
+## 1. Read every produced file, line by line
+Full file, not a diff skim. You are the reviewer who must catch the line the author never thought about.
+
+## 2. Mechanical gates before logic review
+```bash
+bash -n <script>                 # syntax (scripts)
+bunx tsc --noEmit                # types (TS)
+bun test                         # suite
+```
+Run the suite for information, not as the stopping point — it only proves the author's own scenarios.
+
+## 3. Hunt the three classic agent defects
+- **Quoting bugs:** `set -e` + `"${@/$p/$r}"` = substitution regex containing user input (bash can't escape `/` in a `${var/re/pat}` pattern: `/` reads as the pattern/replacement separator). Fix with a separator absent from inputs (e.g. `%`) and `printf '%q'` for shell-interpolated values.
+- **`cd` assumptions:** parallel `runShell` calls share one CWD (pool mode). Any command sequence that assumes CWD (e.g. `git -C .` after a sibling's `cd`) must use explicit absolute paths.
+- **Unbounded resources:** every fd opened must be closed on ALL paths (success, throw, validation fail) — `using` for fs.sinks (closes on throw; sinks are `AsyncDisposable`, not `fs.FileHandle`, no `.close()`); bounded `Map` for caches (`MAX` + FIFO eviction); explicit caps (lines read, file sizes).
+
+## 4. Check the test file is real
+Tests that assert internal state (`expect(wcwd).toBe(...)`) over output contracts; tests of mock echo; tautologies. Delete them per house rules, keep behavior contracts.
+
+## 5. Cutover audit (repo-wide)
+`grep -r` the symbol namespace the subagent touched — `wcwd`-style globals are the classic blast radius. Grep every `cd`/`process.chdir` site and verify each paired command sequence uses explicit paths. Stale comments describing the old design must go — comments that lie are time bombs for the next reader.
+
+## 6. Cutover restarts running processes
+A code fix on disk is NOT live in any process that loaded the file at spawn (bun/node load-at-spawn). After shipping fixes: restart every long-running supervisor/daemon/UI-server that carries the affected code path; prefer takeover protocols (stale-pid detection) that make restarts cheap. Symptom of forgetting: "fixed" code producing old-code symptoms in production (observed: 812 poisoned ledger rows).
+
+## 7. Triaging an adversarial REVIEW report (not code)
+When a subagent produced findings, treat each finding as a hypothesis with a base rate ~40% (measured over 3 rounds, 2026-10):
+1. **Walk every finding end-to-end against the CURRENT tree** before accepting — cite file:line yourself. Reviewers frequently read a mid-edit snapshot; many findings are stale by construction.
+2. **Classification that kills most findings:**
+   - *Stale read* — code changed during review; verify against live lines.
+   - *Inverted logic* — "failed rows are skipped" when the filter makes failed rows RETRY. Re-read the filter.
+   - *Unreachable* — trigger requires breaking a stated design law (single-worker, append-only). Not a defect.
+   - *By-design* — the reviewer labels a spec law a bug (serial execution, non-stream client). Check the spec, not the reviewer's confidence.
+   - *Constant-trust* — "XSS via manifest field" where the field is git-pinned config; "path traversal via REMOTE_TMP" where it's a hardcoded const. Ask: what untrusted input reaches this sink?
+   - *Self-refuting* — the reviewer's own probe output disproves its claim (raw==dedup probe in a "dedup" finding). Quote it back.
+3. **Acceptance bar:** concrete trigger with real inputs + full path walked. Real accepts cluster in: resource caps (pids/timeout/awaited-cleanup), honest labels (default signatures), escaping discipline, self-healing probes.
+4. **One-line verdicts + evidence per finding**, shipped in the commit message; calibration section ("genuinely solid") accepted as free verification of past fixes.
+
+## Verification (the non-negotiable)
+Build/run the real artifact with its real inputs. Observe behavior at the seams:
+- concurrent calls → no CWD races;
+- resource ceilings → caps enforced;
+- cleanup → no fd/pid/dir leaks;
+- security → injection probes inert (quotes, slashes, metachars);
+- normal case → output identical to pre-audit.
+
+## Evidence (2026-10-07 + 2026-10-10/11 sessions)
+- Shell-engine subagent: 426 LOC, `bun test` 39/39 green. Line-audit found: 5 leaked fds per call (`fd` sink never closed), CWD-race in `git -C .`, `set -e` + `${@/\/g\//}` slash-escaping bug, unbounded 10k-entry cache, 45s timeout on git-status.
+- Review-triage census over 3 blind adversarial rounds (same repo, ~41 findings): accepted 9, rejected ~32 — rejects dominated by stale reads (protocol rewritten mid-review), inverted filter logic, unreachable-under-law triggers, base64-alphabet "quote injection" (charset has no quotes), SIGPIPE non-leaks, "no memory cap" quoting the `--memory 4g` line above the claim. Real accepts: fork-bomb pids cap, stalled-ssh upload cap, stale-flag self-heal probe, honest census label, freshness gate on pid reuse.
+- Poison-law incident: sandbox fix shipped while supervisor ran old build → 812 rows graded by the dead protocol; takeover made recovery cheap. The restart step (#6) exists because of this.
@@ -1,6 +1,6 @@
 ---
 name: authentik-provision-fleet-user
-description: "Provision or audit an Authentik user on Dankclaw (auth.franksdank.cloud): ak shell ORM drive, group set, behavioral login verify, stale-claim caveat."
+description: "Provision or audit an Authentik user on Dankclaw (auth.franksdank.cloud): ak shell ORM drive, group set, behavioral login + entitlement verify, docs census record, stale-claim caveat."
 ---

 # Provision an Authentik user on Dankclaw
@@ -33,10 +33,29 @@ from django.contrib.auth import authenticate
 assert authenticate(request=None, username="X", password="...")
 assert authenticate(request=None, username="X", password="nope") is None
 ```
+4. Verify the downstream claims resolve — `app_entitlements` needs an `Application`
+   instance (look it up by slug, `open-webui`), and compare against the precedent user:
+```python
+from authentik.core.models import Application, User
+app = Application.objects.get(slug="open-webui")
+for n in ("ridley", "X"):
+    u = User.objects.get(username=n)
+    print(n, sorted(e.name for e in u.app_entitlements(app)), u.is_superuser, u.path)
+```
+5. Stale-claim check + docs record (repo law: the vault is the source of truth):
+```bash
+ssh dankclaw "podman exec authentik-postgres psql -U authentik -d authentik -tAc \
+  \"SELECT count(*) FROM authentik_providers_proxy_proxysession WHERE session_data->'claims'->>'preferred_username' IN ('X')\""
+```
+Then commit two doc edits (NEVER write the password into any file): the census
+sentence in `Infrastructure/Authentik.md` (human-user template bullet — append the
+new `pk`s + creation date) and a dated entry in `serverAppConfigs-docs/log.md`
+(what was created, groups, how it was verified, proxysession count, downstream lag).
+`./tests/run.sh` must pass before commit (docs completeness + link-integrity seams).

 ## Rules
 - No `User.create_user`; `is_superuser` is a group-derived property, not a constructor kwarg (raises `TypeError`). `path` defaults to `users`.
 - Guarded-vhost access = any authenticated user (all proxy providers use implicit-consent); groups are consumed downstream: `homepage-admins` (Caddy `/admin` header gate), `openwebui_users`/`_admins` (roles claim), `jellyfin_users`/`_admins` (LDAP outpost). EXCLUDE admin groups from a plain user; ask before granting `homepage-admins`.
- Group add after a login → Caddy RBAC can 403 on the outpost's cached claims; purge that user's rows: `DELETE FROM authentik_providers_proxy_proxysession WHERE session_data->'claims'->>'preferred_username' = 'X';` (in the `authentik-postgres` container) — next visit re-authorizes silently.
- Jellyfin visibility rides the LDAP outpost cache; expect a lag.
+- Group add after a login → Caddy RBAC can 403 on the outpost's cached claims; purge that user's rows: `DELETE FROM authentik_providers_proxy_proxysession WHERE session_data->'claims'->>'preferred_username' = 'X';` (in the `authentik-postgres` container) — next visit re-authorizes silently. Groups set BEFORE any login → nothing to purge (count is 0).
+- Jellyfin visibility rides the LDAP outpost cache; expect a lag. OpenWebUI mints a first-time SSO login as role `pending`.
 - Look up flows by slug, not name. Do not rotate `AUTHENTIK_SECRET_KEY` to fix claim issues.
@@ -0,0 +1,42 @@
+---
+name: bench-arm-provenance-recovery
+description: "Before calling a leftover LLM bench drop-in a rogue/hijack, reconstruct whether Frank ordered and measured that arm: omp archive prompt timestamps + journald print_timing for the exact pid, then land the verdict in the repo."
+---
+
+Use when a live service boots a payload you did not configure (stale `systemd` drop-in / `*_ENV_FILE` arm env) and the docs — or your own compaction-inherited context — call it "unfinished", "armed but never measured", or "hijack". Do NOT report that until proven: the arm may be an ordered, measured, approved configuration whose record lived only in `/tmp` + journald.
+
+## Why this exists
+2026-10-18 `frank-zealot`: a `frank-zealot.service.d/ptq1.conf` drop-in made the cutover deploy boot a different model at a different shape. I reported it as an unfinished experiment. It was actually the 27B PTQ1_0 arm Frank ordered at 02:36, that served production 03:14:39→03:38:57, and whose numbers existed only in tool output that context compaction later dropped.
+
+## Step 1 — recover the ORDER (the harness archive, not memory)
+`eval` with the `archive` prelude:
+
+```python
+ps = await archive.prompts()          # searchable prompt history, survives compaction
+# filter for the payload name / repo URL keywords, print p['at'] + p['text'][:90]
+r = await archive.session("<sessionId>")   # full session record
+recaps = await archive.recaps()             # recap stamps — check they postdate the window
+```
+
+`archive.prompts()` keeps **user prompts with ISO timestamps** even when the middle of the transcript was dropped. Timestamp every instruction: ordered → measured → superseded. Convert to local (`UTC−7` here) before quoting. A recap older than the instruction proves the recap layer never covered the window.
+
+## Step 2 — recover the MEASUREMENT (journal, per pid)
+The engine's own per-request timings are the record; they outlive `/tmp` env files.
+
+```bash
+ssh dank@<host> 'journalctl -u <svc> --no-pager' | grep -F 'serve-<svc>.sh[<PID>]' \
+  | grep -E 'prompt eval time|eval time' | awk '... median per task ...'
+```
+
+- Pin the **pid** (`sh[NNNN]`): `--since` windows alone pull the previous process's numbers too.
+- llama.cpp format: `prompt eval time = 1234.56 ms / 100 tokens (…, 81.03 tokens per second)`; decode rows are `eval time = … ms / N tokens (…)`. Multiple spaces between `task`/`eval` break naive regexes — match `task\s+(\d+)\s+prompt eval time` exactly, or parse both labels separately.
+- Filter pathological rows: generations running concurrently on other slots, or ending in a 4-byte EOS, read ~4× low. Report clean single-stream probes (≥200 generated tokens) and label the rest.
+- Cross-check the boot banner for the payload identity (`type ptq1_0: 402 tensors`, KV ledger, slot/ctx lines) — that proves *which* shape that pid served.
+
+## Step 3 — adjudicate, then land it in the repo
+Write the verdict in the same session you derive it: runbook deploy-ledger section, `log.md` dated section, the arm script's header comment, and the AGENTS.md law. `/tmp` and journald are not records — that absence is what makes the next agent misread an approved arm as a rogue one.
+
+## Traps
+- `mask` fails on a relinked unit; never `systemctl disable`; retire drop-ins to `~/.AGENTTRASH/<date>-<topic>/` + `daemon-reload` (recoverable, not deleted).
+- `/health` 200, `/v1/models` echoing the alias, and a green e2e gate all fail to read the payload — check `systemctl show <svc> -p DropInPaths` (must be empty), then `tr '\0' ' ' </proc/$(pidof llama-server)/cmdline`, then the boot ledger.
+- Verification sequence that is honest: correction commit must quote commands you ran; state `[INFERENCE]` for anything the journal does not show.
@@ -0,0 +1,22 @@
+---
+name: bench-harness-fault-census
+description: Attribute benchmark failures to harness vs model via exception-signature census before trusting any score; python-grader fault signatures and fixes
+---
+
+# Rule (from 2026-10-10 frank-intelligence-bench incident, 3 harness faults found)
+An LLM benchmark score is VOID until every failure signature is attributed to the MODEL. Run the census before quoting any number.
+
+# Procedure
+1. Aggregate graded rows per eval; for each failed grade extract the LAST python exception signature:
+   regex `(\w+Error|\w+Exception): (?:name '([^']+)' is not defined|No module named '([^']+)')?` → sig = `Type: detail`.
+2. Indict the harness (not the model) when:
+   - `NameError: target` / `NameError: targets` in any count → expected-value bindings never reached the tests (gold data file missing/unstaged).
+   - `ModuleNotFoundError: <grader package>` (e.g. `scicode`) → grading deps missing from the execution image.
+   - ≥10 failures sharing ONE signature at >50% share → systematic fault; audit the protocol (e.g. markdown fences reaching an exec-based extractor — `SyntaxError` storm; strip ``` fences before feeding model text to graders that exec raw code).
+   - >50% of generations fail → endpoint/transport fault.
+3. Real model failures look heterogeneous: AssertionError/AxisError/NameError of the model's OWN undefined names.
+
+# Companion checks
+- Prove the grading path with a gold-solution integration test BEFORE trusting live scores: gold must PASS end-to-end (FIB_INTEGRATION=1 pattern).
+- Quarantine poisoned ledgers (.AGENTTRASH) rather than deleting; census them to root-cause.
+- Expect-score sanity: mixed PASS/FAIL with model-side signatures = real signal, even if the % looks low.
@@ -0,0 +1,82 @@
+---
+name: bounding-subagent-runtime
+description: "Cap and diagnose runaway or hung omp subagents: task.maxRuntimeMs, softRequestBudget, agentIdleTtlMs, per-agent model overrides, the cfg save-approval quirk, and the finished-work-but-never-exits nested-fanout deadlock."
+---
+
+# Bounding subagent runtime (omp harness)
+
+Use when a `task`/`eval` subagent runs absurdly long (tens of minutes on a small job),
+when it **finishes its deliverable and still never exits**, when you want a hard cap
+before spawning, or when you must tell a busy agent to stop.
+
+## The knobs (`cfg://task/...`)
+
+| Key | Default | Meaning |
+|---|---|---|
+| `maxRuntimeMs` | `0` (unlimited) | **Hard wall-clock limit per subagent (ms).** The only true time cap. |
+| `softRequestBudget` | `200` | Soft cap on assistant **requests** per run; force-stop at **1.5×**. |
+| `softRequestBudgetNotice` | `true` | Injects one "wrap up" steering message at the soft mark. |
+| `agentIdleTtlMs` | `420000` | Parks an **idle** agent after 7 min. Useless against a busy-but-slow agent. |
+| `completionProbe` | `true` | Asks a working subagent to self-report completeness at 2/5/10 requests. |
+| `maxConcurrency` | `32` (often lowered) | Concurrent subagents; sizes GPU/endpoint load. |
+| `agentModelOverrides` | `{}` | Per-agent model routing, e.g. `{"scout":"provider/model-id"}`. |
+| `tools.maxTimeout` | `0` | Caps the timeout the agent may set on a **tool**, not on the agent. |
+
+Reasonable fleet defaults: `maxRuntimeMs = 900000` (15 min), leave the request budget
+alone unless the failure mode is a looping search agent (then lower it — request count,
+not the clock, is what bounds a 200-call research loop).
+
+**Verify the cap instead of assuming it.** `read cfg://task/maxRuntimeMs` at the start of
+any session that plans to rely on it. A session-only write is gone next session, and an
+unanswered `/save` approval means the value never persisted — so the fleet can run hours
+with the cap at `0` while everyone believes it is 15 minutes. Nothing else bounds a child.
+
+## Three failure modes, three different fixes
+
+- **Runaway loop** (hundreds of sequential tool calls): lower `softRequestBudget`; the
+  clock cap only truncates it late.
+- **Slow model, legitimate work** (dozens of calls on a low-t/s endpoint = an hour of wall
+  clock): fix routing, not the clock — check `cfg://task/agentModelOverrides` and move the
+  agent class onto a faster/shared endpoint. Watch the slot math: subagent endpoints share
+  KV slots with the interactive session, so `maxConcurrency + 1` sequences on an N-slot
+  endpoint degrades everyone's decode.
+- **Finished work, no exit (nested fan-out deadlock).** A subagent that spawned **its own**
+  children blocks on their barriers. If those children die out-of-band (killed, starved, or
+  waiting on an answer whose subject changed mid-flight), the parent waits forever with its
+  deliverable already written. No instruction text prevents this — not the repo AGENTS.md,
+  not the task prompt; only the clock cap or a kill ends it.
+
+  Signature: parent and children report **the same elapsed wall clock**, and the parent's
+  on-disk output is complete. Census (agent registry + `ps`): group by elapsed time, look
+  for identical `etimes` across a parent/child set, then judge the **artifacts** instead of
+  the process — balanced code fences, no truncated tables, trailing newline, front matter or
+  the page's H1+status convention intact. Complete artifacts + still "running" = deadlock,
+  not work.
+
+  Repair: kill the **subtree** and confirm the children leave (a killed parent does not
+  cancel children that came from a separate `tasks[]` batch). Then **flatten**: the
+  top-level session does the fan-out and children never spawn children. Re-run only the
+  slices whose artifacts are missing — integrate from what is already on disk.
+
+## cfg write mechanics (bit me once)
+
+- `write cfg://task/maxRuntimeMs 900000` → applies **session-only**, replies "NOT saved".
+- Persist = `write cfg://task/maxRuntimeMs/save` with the same content, and that write
+  needs its **own interactive approval**. If the approval prompt is not answered in time
+  the value stays session-only and the tool says *NEVER retry unless the user asks* —
+  report it in the reply instead.
+- Revert a session value by writing the old value back (e.g. `0`).
+
+## Order of operations when one is already running late
+
+1. `read proc://` → registry of running agents; `read proc://<id>` for status/output.
+2. `read agent://<id>` → live progress ("Latest assistant text") — often shows it is
+   mid-batch, not hung. If the latest text is already a wrap-up/summary, treat it as
+   **done** and collect its output instead of waiting for an exit event.
+3. `write agent://<id>` an explicit wrap-up order: stop searching, answer what is
+   sourced, mark the rest `NOT VERIFIED — needs <what>`, cap the report length.
+4. Only then `write proc://<id>/kill` — the cap does **not** retroactively bind agents
+   spawned before the change, so a long runner must be ordered or killed, never just
+   re-configured. After any kill, re-read the registry: unreaped children and orphaned
+   host-side processes (a scratch server holding GPU/RAM) are the expensive residue, and
+   `pkill -f` patterns that also match production services are forbidden — kill by pid.
@@ -0,0 +1,24 @@
+---
+name: cfg-approval-timeout-recovery
+description: "Use when a cfg://.../save write fails with \"user did not answer the approval prompt\": the settings-approval dialog has a hardcoded 10 s timeout and no config key; recover via direct config.yml edit once the user has approved the change."
+---
+
+# Recovering from cfg:// approval-prompt timeouts
+
+## Facts (verified in bundle 2026-10-18)
+- Settings-write approval dialog timeout is **hardcoded 10 000 ms** (`timeout: JKl`, `JKl=1e4`, countdown class treats arg as ms) in the omp `dist/cli.js` bundle. **No config key exists** for it (checked full `cfg://` registry).
+- `ask.timeout` is a DIFFERENT gate (ask-tool auto-select; 0 = wait forever). It does not govern cfg approvals.
+- A timed-out approval silently auto-denies: session-only value stays applied, `config.yml` unchanged. Error says "nothing changed; it stays <value>. NEVER retry unless the user asks."
+- Related: `features.unexpectedStopDetection: smart` injects forced-continue `<system-injection>`s on text-only turns ending in a promise to act ("Task incomplete: MUST call the next concrete tool now"). Set `mechanical` (upstream default) or `none`; `smart` drives agents into junk subagent spawns to satisfy the nudge.
+
+## Recovery procedure (only when the user has already explicitly approved the change)
+1. Do NOT re-issue `cfg://<key>/save` after a timeout unless the user explicitly asks again — the harness forbids it.
+2. Edit `~/.omp/agent/config.yml` directly:
+   - `grep` the setting key to locate it; read surrounding lines.
+   - surgical `edit` of the single line.
+   - validate: `python3 -c "import yaml; yaml.safe_load(open('/home/blank/.omp/agent/config.yml'))"`
+3. State that the file was edited directly because the invisible 10 s dialog ate the user's approval, and offer the `omp config set <key> <value>` one-liner as the user-run alternative for future.
+
+## Prevention
+- Before any `cfg://.../save`, warn the user a ~10 s dialog is about to appear and to answer immediately.
+- Bundle-fact lookups: `PKGDIR=$(dirname $(readlink -f $(command -v omp)))/..`, then grep `dist/cli.js` for the message string, walk to the call site, resolve minified constants with `grep -oE '[,;]CONST=[^,;)]+'` (`1e4` = 10000).
@@ -0,0 +1,37 @@
+---
+name: characterization-fixture-engine-cutover
+description: "Swap a path→service planner/mapping engine behind a golden fixture: capture, delta-reduce, document deltas, flip grep seams to behavioral, add render/drift gates, validate Caddyfile renders, Gitea PR URLs (serverAppConfigs cutover playbook)"
+---
+
+Playbook for replacing a hand-maintained mapping engine (deploy planner, seam mapper, allow-lists) with a data-driven one without changing observable behavior. Proven on the 2026-10-13 `shared/services.yml` + `scripts/service-map.py` cutover (921 deltas → 17 intentional → green; 408/408 bats).
+
+## 1. Capture the characterization fixture FIRST
+- Enumerate every path the old engine sees: all tracked files x all targets (`git ls-files`), plus hand-added edge paths (retired files, cross-host paths, shared networks).
+- Run the OLD engine on each, record `path<TAB>target<TAB>services` to `tests/fixtures/*-golden.tsv`. Old engine = current `deploy-plan.py` before edits.
+- This fixture is the contract; the new engine must reproduce it except documented deltas.
+
+## 2. Cut over, then delta-reduce with the fixture
+- Diff new-engine output vs fixture; bucket every delta into: engine bug / intentional change / fixture staleness.
+- Engine bugs found this way (generic classes): `in` membership on dict-of-tuples, host-scoping of relative directory keys, riders/children resolved only in the changed file's own directory, stem collisions between unit files and generated artifacts (`.network` stem == service dir stem), `.network` files entering the unit branch by stem match.
+- Intentional deltas get documented individually in the commit message; NEVER batch-accept a delta count.
+- Regenerate the fixture LAST, from the new engine, and record the delta count + reasons in the commit.
+
+## 3. Flip text-grep seams to behavioral calls
+- Old seams that grep a config file for the mapping (`grep -q 'dankclaw:hermes-webui'`) die silently on cutover. Replace with a call to the new engine: `run python3 scripts/service-map.py allows --host H --service S; assert_success`.
+- Vhost-scoped content greps (Caddyfile awk blocks) → grep the new canonical form (`import guarded`), not the inlined chain.
+
+## 4. Renders + drift gates
+- Config artifacts that were hand-maintained mirrors (node-exporter quadlet pair, pihole addn-hosts) become `service-map.py render <name> --host H` artifacts; a drift test asserts tracked-file == render output.
+- Renderers must emit exactly what the consumer parses: dnsmasq `addn-hosts` treats inline `# comments` as hostnames — render no trailing comments.
+- Named-snippet collapse (Caddyfile guard chain): the snippet MUST be defined before the first site that imports it (put `(guarded)` right after the global options block), or real caddy reports `File to import not found`.
+
+## 5. Suite + deploy gates
+- `./tests/run.sh` fully green before each rank commit; one atomic commit per rank.
+- Deploy is service-scoped: `deploy.sh <host> --service <svc>`; never a fleet drain for one service. The Playwright e2e gate runs inside deploy.sh against the live fleet.
+
+## Repo-specific gotchas (serverAppConfigs)
+- Validate the Caddyfile with stock `caddy:latest` by DELETING the whole `acme_dns porkbun { ... }` block (`awk 'NR<53 || NR>56' dankclaw/Caddyfile`). A `sed s/acme_dns porkbun {/acme_dns acme {/` variant that drops the `{` swallows the following tokens into the global block and fakes an "import not found" on `(guarded)` — debug sed swaps with a minimal repro file before blaming the config. Stock-image `dns.providers.porkbun` unregistered + basicauth `REPLACE_WITH_HASH` base64 errors are the expected endpoints of a clean parse.
+- Gitea: branches with `/` 404 on `/compare/main...wt%2F...` — use the push-hook URL `…/pulls/new/<branch>`; private repo returns 404 to anonymous curl, which proves nothing about the page.
+- `test-changed.sh` contract: new seam selection ⊇ old selection per path; unmapped repo path must `die`, never pass silently.
+- Retire-to-trash: retired files (compose.yaml, dead templates, dead bats) → dated `.AGENTTRASH/YYYYMMDD-topic/` beside them; every repo sweep must exclude `.AGENTTRASH`.
+- bash `test -f a b c && ! test -e d` is invalid syntax (test takes one operand per operator); use `ls a b c` + separate `ls d` to census artifacts.
@@ -0,0 +1,43 @@
+---
+name: dankclaw-boot-line-window
+description: "Change a Dankclaw kernel command-line parameter safely: tracked grub + installer, measured before/after A/B on live LLM traffic, post-boot gates."
+---
+
+# Dank fleet kernel boot-line window (Dankclaw pattern)
+
+Kernel command-line state is **host state the deployer never owns**. The repo law
+("all edits through git") still applies: fetch the live file, commit it, edit the
+tracked copy, apply with a script.
+
+## Source of truth
+- `dankclaw/host/grub` — tracked copy of `/etc/default/grub`.
+- `scripts/set-dankclaw-bootline.sh` — the only door: diff → `sudo install -m 0644 -o root -g root` →
+  `sudo update-grub` → print the **default `grub.cfg` entry** → reboot only on `--reboot`.
+  Refuses any host whose `hostname -s` lacks `dankclaw`.
+- Decision record: `serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md`.
+- `deploy-plan.py` maps `dankclaw/*` subdirs explicitly; a new `dankclaw/host/` path plans nothing (verify with a `--dry-run`).
+
+## Procedure
+1. **Capture the before-arm measurement first** — you cannot get it back after the reboot.
+2. Fetch provenance byte-exact: `ssh dankclaw 'sudo cat /etc/default/grub' > dankclaw/host/grub` (never retype; a transcription dropped a leading `0`).
+3. Commit provenance, edit the tracked copy, commit the flip, push (**Gitea lives on Dankclaw — pull on the host before rebooting**), then `ssh dankclaw 'cd ~/serverAppConfigs && git pull --ff-only origin main'`.
+4. Install **without** `--reboot` first: it prints the `grub.cfg` default entry; confirm the token there before the irreversible step.
+5. `ssh dankclaw 'sudo systemctl reboot --no-block'`.
+6. **Poll on `/proc/uptime` + cmdline, never on ping** — the NIC answers ICMP for a minute after shutdown and sshd reset looks like "reachable".
+   Gate set: `systemctl --failed` count 0 · `systemctl is-system-running` running · `/proc/cmdline` token · `ls /sys/kernel/iommu_groups | wc -l` · `cat /sys/kernel/iommu_groups/*/type | sort | uniq -c` · `systemctl is-active frank-dragoon frank-zealot` · `curl 127.0.0.1:7770/health` (listener binds only after the full load — poll up to 10 min).
+
+## Measurement discipline (this is where windows get lied about)
+- Both arms must be **byte-identical traffic**. Engine-reported token counts are the identity proof (e.g. 59,024 prefill / 21,568 needle both boots).
+- `/tmp` is **tmpfs**: the reboot deletes `/tmp/halogen-eval`. Rebuild with `scripts/stage-frank-dragoon-eval.sh` (corpus 2,891 lines / 1,287,656 B is the check) — and run it via `bash -lc`, `uv` is in `~/.local/bin`, absent from a non-login PATH.
+- The 51.2 GB halogen n-gram table is page cache (`Pin::None`). A fresh boot has it cold and a cold table throttles prefill → `cat` it once (~40 s) before measuring. `WARM=1` in the staging script does this.
+- **Sampled decode on this engine is a useless single-sample instrument**: three repeats of the same request gave 31.8 / 46.9 / 47.8 t/s. Only prefill (cold) and needle-hit carry signal; anything else needs ≥3 repeats.
+- Bench law still bites: nothing else on the GPU; measuring *through* the live service is how dragoon/zealot are measured (a scratch server cannot share the card).
+
+## Traps
+- `edit` `PUT N.:` can **insert instead of replace** — verify the range shrank, then `CUT` the leftover.
+- Body rows beginning with a markdown bullet (`- `) get auto-prefixed and land as `+- `; rewrite the block with `write` when that happens.
+- A long reboot fires `LlmEndpointDown` → Signal; Alertmanager has **no persistence**, so every active alert gets a fresh `startsAt` after boot — check `query_range` history before blaming the window for an alert.
+- `sudo podman ps` shows nothing for Dankclaw's rootless stack; `systemctl is-active caddy` is meaningless for quadlets. Use the public endpoints or `systemctl --user` as `dank`.
+
+## Worked example (2026-10-18)
+`amd_iommu=off` → `iommu=pt` to restore the XDNA2 NPU. Result: cold prefill 1,585.1 → 1,616.0 t/s (**+2.0 %**, i.e. no penalty), needle hit/hit, `amdxdna` bound `0000:c6:00.1` (group 26 identity, PASID width 10). The 13–16 % figure it replaced had never been measured locally. Deferred on purpose: `pp_dpm_fclk` pin (nothing co-runs yet) and PerfOpt (needs Linux 7.4; Ubuntu 26.04 caps at `7.0.0-38.38`).
@@ -0,0 +1,81 @@
+---
+name: dankclaw-expose-service
+description: "Expose a new service at *.franksdank.cloud on Dankclaw: quadlet container, Caddy site block, Pi-hole LAN record (custom.list), Porkbun public record; includes API vhost/volume gotchas proven on the ntfy deploy."
+---
+
+# Expose a service on Dankclaw (franksdank.cloud)
+
+Proven end-to-end 2026-10-11 with ntfy. Four layers, each with a known trap.
+
+## 0. Survey first
+```bash
+ssh dankclaw 'ls ~/.config/containers/systemd/; grep -nE "franksdank|anubis" /home/dank/Containers/caddy/Caddyfile'
+```
+- Caddy runs as quadlet `caddy.container`; config at `/home/dank/Containers/caddy/Caddyfile` (NOT `/etc/caddy` on host).
+- Sites fronted by `anubis:8923` get bot-challenge. **CLI/API publishers (ntfy, webhooks, git) MUST bypass anubis** — use the `gitea`/`ai` pattern (direct `reverse_proxy`).
+
+## 1. Quadlet container (user `dank`)
+Write `~/.config/containers/systemd/<name>.container`:
+```ini
+[Unit]
+Description=<name>
+After=network-online.target
+Wants=network-online.target
+[Container]
+ContainerName=<name>
+Image=<image>
+Network=dankclaw_default
+Volume=<name>-cache:/var/lib/<name>
+[Service]
+Restart=always
+RestartSec=5
+[Install]
+WantedBy=default.target
+```
+`Network=dankclaw_default` ⇒ Caddy reaches it as `<name>:<port>`. Then `systemctl --user daemon-reload && systemctl --user start <name>.service`.
+Rootless podman: bare containers never boot-persist — quadlet is mandatory.
+
+## 2. Caddy route
+Append site block (wildcard `*.franksdank.cloud` cert already issued via Porkbun DNS-01; no new cert work):
+```
+<name>.franksdank.cloud {
+	reverse_proxy <name>:<port>
+}
+```
+Validate, then reload in-place:
+```bash
+podman exec caddy caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
+podman exec caddy caddy reload --config /etc/caddy/Caddyfile
+```
+
+## 3. LAN DNS (Pi-hole v6, container `pihole`)
+Traps, in order of wasted turns:
+- API is NOT at `127.0.0.1:8083/api` on the host port path — requests need `-H "Host: pi.hole"`.
+- `[[dns.records]]` in pihole.toml and `gravity.db` `domain` table: absent/unused on this box.
+- **Working location:** `/home/dank/Containers/pihole/etc-pihole/hosts/custom.list` (dnsmasq addn-hosts), format `IP FQDN`:
+```bash
+echo "192.168.0.143 <name>.franksdank.cloud" | sudo tee -a /home/dank/Containers/pihole/etc-pihole/hosts/custom.list >/dev/null
+podman exec pihole pihole restartdns
+```
+
+## 4. Public DNS (Porkbun, for off-LAN clients)
+Keys: `/home/dank/Containers/caddy/env` (`PORKBUN_API_KEY`, `PORKBUN_API_SECRET_KEY`).
+```bash
+curl -sL -X POST https://api.porkbun.com/api/json3/domain/api/create/franksdank.cloud \
+  -H "Content-Type: application/json" \
+  -d "{\"apikey\":\"$K\",\"secretapi\":\"$S\",\"name\":\"<name>\",\"type\":\"A\",\"content\":\"71.227.227.172\",\"ttl\":\"600\"}"
+```
+- `json3` path + `-L` (302-redirects to v3). Public IP: 71.227.227.172 (router forwards 443 → Dankclaw).
+- Porkbun edge throws intermittent 503s; retry later or do it in the UI. LAN path works without this record.
+
+## 5. Verify
+```bash
+# from Dankclaw (host):        getent hosts <name>.franksdank.cloud   → 192.168.0.143
+# workstation w/ stale resolved negative cache: use curl --resolve <name>.franksdank.cloud:443:192.168.0.143
+# workstation's own `sudo resolvectl flush-caches` needs a terminal (no passwordless sudo) — negative cache expires on its own
+curl -sf --resolve <name>.franksdank.cloud:443:192.168.0.143 https://<name>.franksdank.cloud/
+```
+Publish-style test for ntfy inside container (CLI flags vary by version; raw HTTP is version-proof):
+```bash
+podman exec <name> wget -qO- --header="Title: smoke" --post-data="up" http://localhost:<port>/<topic>
+```
@@ -0,0 +1,34 @@
+---
+name: dankclaw-model-inventory
+description: "Read-only census of downloaded models on Dankclaw: GGUF store, ComfyUI container mount, dead-config trap"
+---
+
+Answer "what models are on Dankclaw" without guessing roots. All probes are read-only ssh (`ssh -o BatchMode=yes dankclaw '…'`).
+
+## Roots (in order)
+
+1. **LLM GGUF store:** `/home/dank/models/` — one dir per model, main GGUF + `mmproj-*` (multimodal projector) + `mtp-*` (speculative-decode draft) satellites. `~/.share/models` does NOT exist on Dankclaw (that's the workstations' convention).
+2. **ComfyUI runtime store:** `/home/dank/comfyui-data/models/` — category dirs (`diffusion_models/`, `text_encoders/`, `vae/`, `loras/`, …). This is what the running stack actually uses.
+
+## ComfyUI topology (the trap)
+
+- Runtime = podman container `comfyui` (image `localhost/comfyui-rocm:gfx1151`, user unit `comfyui.service`). Mounts: `~/comfyui-data/{models,custom_nodes,input,output}` → `/opt/ComfyUI/...`.
+- The host checkout `~/ComfyUI/` is NOT the runtime. Its `extra_model_paths.yaml` (base_path `/home/dank/models` + category keys) is dead config from a pre-container setup — never read by the container. Do not report those empty category dirs as "ComfyUI has no models".
+
+## Census commands
+
+```bash
+# LLM store: sizes + names in one pass
+ssh -o BatchMode=yes dankclaw 'find ~/models -maxdepth 2 -type f \( -iname "*.gguf" -o -iname "*.safetensors" \) -printf "%10s  %p\n" | sort -k2'
+
+# ComfyUI: container mount truth
+ssh -o BatchMode=yes dankclaw 'find /home/dank/comfyui-data/models -type f -size +1M -printf "%10s  %P\n" | sort -k2; du -sh /home/dank/comfyui-data'
+
+# confirm runtime + mounts before trusting any path claim
+ssh -o BatchMode=yes dankclaw 'podman ps --format "{{.Names}} {{.Image}} {{.Status}}"; podman inspect comfyui --format "{{range .Mounts}}{{.Source}} -> {{.Destination}}{{\"\n\"}}{{end}}"'
+```
+
+## Anomaly flags
+
+- A `.gguf` of ~1 KB = git-LFS pointer / failed download, not a model (seen: MiMo-Q8_0 stub). Report as broken, offer refetch or `.AGENTTRASH`.
+- Size sanity vs Strix Halo 32 GiB unified memory: bf16 diffusion+TE pairs near 30 GiB can't co-reside with the serving LLM; int8/w4a8 quants are the working set.
@@ -0,0 +1,49 @@
+---
+name: dankclaw-pihole-lan-dns-record
+description: "Add/repair a LAN DNS record for a new *.franksdank.cloud service on Dankclaw's Pi-hole v6 (hosts/custom.list path), plus the public Porkbun A record step and client cache gotchas."
+---
+
+Use when a new `*.franksdank.cloud` service resolves publicly/LAN-needs a local address, on Dankclaw (Pi-hole v6 container, quadlet `pihole.container`).
+
+## Ground truth layout (verified 2026-10-11)
+
+- Quadlet: `~/.config/containers/systemd/pihole.container`; volumes `/home/dank/Containers/pihole/{etc-pihole,etc-dockers,addn-hosts}`.
+- **LAN records live in `/home/dank/Containers/pihole/etc-pihole/hosts/custom.list`** — plain hosts format: `192.168.0.143 gitea.franksdank.cloud`. This is the boring, working path.
+- `pihole.toml` `[[dns.records]]` array is EMPTY on this host — do not expect v6 UI-style records there.
+- `gravity.db` exists but has NO `domain` table (v6 layout) — do not insert local records into SQLite.
+
+## Procedure (30 s, proven)
+
+```bash
+ssh dankclaw 'echo "192.168.0.143 <name>.franksdank.cloud" | sudo tee -a /home/dank/Containers/pihole/etc-pihole/hosts/custom.list >/dev/null \
+ && podman exec pihole pihole restartdns'
+ssh dankclaw 'getent hosts <name>.franksdank.cloud'   # must resolve
+dig +short <name>.franksdank.cloud @192.168.0.143     # from any LAN box
+```
+
+Hosts files are read-only-readable only via sudo (dir owned by uid 100999). `sudo -n` works on dankclaw.
+
+## API maze — DON'T re-explore
+
+- FTL API base is `/api` at the web port (8083) **with `Host: pi.hole` header**; `/admin/api/*` → bad_request hint; bare 127.0.0.1 without the vhost → 404 `not_found`.
+- Login: `POST /api/login {"password": <WEBPASSWORD from /home/dank/Containers/pihole/env>}` → session in `X-Cors` header/cookie.
+- `POST /api/apps/domains/custom` → **404 on this build** (FTL version predates it); `/api/customdns/custom` also absent. There is no container sqlite3. Use custom.list.
+
+## Public record (off-LAN reachability)
+
+Porkbun API, keys in `/home/dank/Containers/caddy/env` (`PORKBUN_API_KEY`, `PORKBUN_API_SECRET_KEY`):
+
+```bash
+curl -sL -X POST https://api.porkbun.com/api/json3/domain/api/create/franksdank.cloud \
+  -H "Content-Type: application/json" \
+  -d "{\"apikey\":\"$K\",\"secretapi\":\"$S\",\"name\":\"<name>\",\"type\":\"A\",\"content\":\"71.227.227.172\",\"ttl\":\"600\"}"
+```
+
+- `json3` path 302-redirects → **`-L` required**; no-`-s` to see status.
+- Porkbun edge (openresty) intermittently 503s — transient; retry later, don't burn turns. Public record is OPTIONAL when LAN-only subscribers exist.
+- Wildcard `*.franksdank.cloud` TLS is already covered: Caddy + Porkbun DNS-01 (caddy-porkbun image), so a new subdomain needs NO new cert work — just the Caddyfile site block + reload.
+
+## Client-side cache gotchas
+
+- Workstation (systemd-resolved): negative cache survives Pi-hole changes; `sudo resolvectl flush-caches` needs a TTY (faillock-sensitive — no `-S` guessing). Non-interactive proof: `curl --resolve <name>.franksdank.cloud:443:192.168.0.143 https://<name>.franksdank.cloud/...`; cache self-expires (SOA negative TTL).
+- Dankclaw/Dankserver resolve via Pi-hole directly — verify there first.
@@ -0,0 +1,70 @@
+---
+name: deployment-checkout-trunk-sync
+description: Use when the live deployment checkout (~/.omp main) must merge a moved origin/main while dirty tracked files block the merge and workspace policy blocks git checkout.
+---
+
+---
+name: deployment-checkout-trunk-sync
+description: Use when the live deployment checkout (~/.omp main) must merge a moved origin/main while dirty tracked files block the merge and workspace policy blocks git checkout.
+---
+
+# Sync a dirty live checkout to a deployment (checkout blocked)
+
+Situation: the checkout IS the deployment; months of machine/hand writes sit
+uncommitted; `origin/main` has moved; `git checkout`/discard is BLOCKED by
+workspace policy ("edit forward"; exemption only during active conflict).
+
+## Procedure
+1. `git fetch`; trial `git merge --no-commit --no-ff origin/main` to enumerate
+   exact blockers (dirty files the merge would overwrite + untracked collisions).
+   Untracked blockers: `cp -a` to `.AGENTTRASH/pre-merge-<date>/`, then `mv` aside.
+2. **Preservation commit:** `git add` ONLY the blocking paths (not the whole
+   tree) and commit them as-is: `chore: adopt pre-existing working-tree state
+   before trunk merge`. Nothing is discarded; the secret gate still runs.
+   Include EVERY dirty deployment-state path (dotfiles/live tiers too) — a
+   dirty file that is neither committed nor trashed is unprotected from step 3.
+3. `git merge --no-ff origin/main`. Conflicts are now resolvable — the policy
+   exemption is active during a merge.
+4. Resolution law:
+   - **live machine config** (`agent/config.yml`, `models.yml`, dotfiles live
+     state like noctalia `settings.toml`) → `--ours`: the running box is its
+     own authority; the remote copy is a snapshot.
+   - **prose/law/docs** (`AGENTS.md`, KB) → `--theirs` (upstream canonical;
+     local variants survive in the preservation commit).
+   - **append-mostly logs** → union: cut only the three marker lines
+     (`<<<<<<<`/`=======` range + `>>>>>>>`), keep both sides' entries.
+5. `git commit --no-edit`, push trunk, verify `main == origin/main`.
+6. Pre-merge byte-compare every dirty file vs `origin/main`
+   (`git show origin/main:$f | diff -q - $f`): SUPERSEDED (identical → discardable),
+   DIVERGED (resolve), untracked-in-upstream (collision).
+
+## Gotchas
+- **NEVER `git stash` to unblock a deployment sync, NEVER `git stash clear`/
+  `drop` afterward.** Observed 2026-10-18: a sync stashed the dirty tree, the
+  stash entry was later destroyed, and months of GUI-built bar layout
+  (noctalia settings.toml, never committed) vanished with it — recovered only
+  via dangling-object archaeology (below). Step 2's preservation commit exists
+  precisely so stashing is never needed.
+- **Stash-and-retry loops are a red flag**: three `WIP on main` stash commits
+  within ~60s of each other means the operator was fighting the dirty tree,
+  not resolving it.
+- **Recovery from destroyed stashes** (objects survive entry deletion until gc):
+  `git fsck --lost-found` → `git log -1 --format='%ci %s' <dangling>` to date
+  them → `git show <c>:<path>` to dump candidates; newest `WIP on` commit is
+  usually the last good state. Validate before deploying (e.g.
+  `noctalia config validate`), back up the clobbered file to `.AGENTTRASH/`,
+  then restore through the symlink target.
+- Never wrap `git checkout` in `2>/dev/null` here: the policy-block error was
+  swallowed and the loop silently no-op'd; the merge then failed identically.
+- `git add` a directory pathspec stages its untracked children (fine for
+  allowlist dirs; never for prose dirs).
+- The live-sync heartbeat (#11) commits machine tiers hourly, so this sync is
+  a rare operation post-deployment — mostly memories/dotfiles stragglers.
+  Remember the heartbeat can lag up to an hour behind GUI edits: the tree
+  between heartbeats is the ONLY copy of fresh GUI work.
+- **Frank's accepted risk posture (2026-10-18):** hourly sweep + the
+  preservation-commit law + fsck recovery is defense-in-depth ENOUGH. Do not
+  re-propose faster heartbeats or path/event triggers to shrink the
+  GUI-edit-to-commit window; he chose status quo after measuring (heartbeat
+  itself is 57 ms CPU — cost was never the objection; un-debounced
+  DirectoryNotEmpty triggering was, and path-unit proposals are vetoed).
@@ -1,6 +1,6 @@
 ---
 name: detached-fleet-job-launch
-description: Launch a long-running remote job on Dank fleet hosts so it survives ssh/logind teardown
+description: Launch long-running jobs (fleet hosts or local workstation) so they survive ssh/logind/harness teardown; includes worker takeover law for queue daemons
 ---

 # Detached long-running jobs on Dank fleet hosts
@@ -11,7 +11,7 @@ description: Launch a long-running remote job on Dank fleet hosts so it survives
 no journal entry, no OOM trace, python block-buffers stdout so the log stays
 0 bytes. setsid/nohup do not escape the cgroup.

-## Canonical launch
+## Canonical launch (remote)
 ```
 ssh host 'export XDG_RUNTIME_DIR=/run/user/$(id -u); \
  systemd-run --user --collect --unit=NAME \
@@ -26,6 +26,37 @@ ssh host 'export XDG_RUNTIME_DIR=/run/user/$(id -u); \
 - `-u` / unbuffered output so the log is live
 - verify launch in the same ssh call: `systemctl --user is-active NAME.service`

+## Local workstation variant (verified 2026-10-10, blankpad)
+Harness background jobs get **tree-killed** at timeout — setsid/nohup children
+die too (survives the process-group kill, not the tree walk). Same cure as
+remote, run locally:
+```
+loginctl enable-linger $(whoami)   # default Linger=no kills user units at session end
+XDG_RUNTIME_DIR=/run/user/$(id -u) systemd-run --user --collect --unit=NAME \
+  -p StandardOutput=append:/abs/path/job.log \
+  -p StandardError=append:/abs/path/job.log \
+  /full/path/to/binary args...
+systemctl --user is-active NAME.service
+```
+Gotchas:
+- bash-tool env lacks `XDG_RUNTIME_DIR` → set it inline.
+- `--collect` GCs the unit when it **exits** — after a crash-exit,
+  `systemctl --user restart NAME` fails "Unit not found"; relaunch with
+  `systemd-run`. Redeploy code = `stop` (not `restart`) + relaunch.
+- point StandardOutput at the job's canonical log file (what the UI/SSE tails),
+  not a sidecar — observed drift: worker.log vs per-run log.txt diverged.
+- foreground `(cmd &)` and `(cmd &)` subshells die with the tool call's group.
+
+## Worker takeover law (queue daemons)
+A supervisor killed mid-run leaves `queue.json.active` set ⇒ every relaunching
+worker honors "one run at a time" and exits ⇒ silent queue deadlock. Cure:
+- heartbeat: run dir `worker.pid`, rewritten every ~5s while running, removed
+  on completion;
+- claim rule: `active` set + pid dead (`process.kill(pid,0)` ESRCH; EPERM =
+  alive) ⇒ resume; pid alive ⇒ exit.
+- resume must be append-only + completed-key skip so takeover is cost-free
+  (observed: 386 completed samples skipped, zero re-requests).
+
 ## Watcher (one async job, never poll)
 ```
 ssh host 'while [ ! -f /home/dank/logs/NAME.rc ]; do sleep 60; done; \
@@ -42,5 +73,6 @@ Run it async with timeout 0; the result is injected on completion.

 ## Notes
 - zsh remote shells: `echo ===X===` fails (`=cmd` expansion); quote sentinels.
- The HF upload of 2026-10-08 (113.7 GiB, hf_xet) died this way ~2 min in;
+- The HF upload of 2026-08 (113.7 GiB, hf_xet) died this way ~2 min in;
  relaunch as above succeeded.
+- Frank's machine: `systemctl --user terminate` is not a verb — use `stop`.
@@ -0,0 +1,26 @@
+---
+name: fleet-image-pull-freshness-audit
+description: "Answer \"when was the last time we pulled/updated engine?\" for digest-pinned dank-fleet images: git-history pin dating vs host podman state, pull-vs-restart distinction."
+---
+
+Answer "when was the last time we pulled/updated <engine image>?" for a digest-pinned fleet endpoint (radiance/halogen/llama.cpp images on dankserver/dankclaw).
+
+## Procedure
+
+1. **Locate the pin.** `grep` the repo for the image digest prefix (e.g. `4c3f484564`) — pins live in `scripts/<svc>.env` (`FRANK_ARCHON_IMAGE` etc.) and are restated in `AGENTS.md` / runbooks.
+2. **Date the pin in git.** `git log --all --format='%h %ad %s' --date=short -S '<digest-full-prefix>'` — the OLDEST hit is the cutover that pulled it (renames and service-name sweeps produce later hits; ignore them).
+3. **Check the host state.**
+   `ssh <host> 'sudo podman images --format "{{.Repository}}:{{.Tag}} {{.ID}} {{.Digest}} {{.CreatedTime}}"'`
+   Compare the on-disk digest to the pin. `CreatedTime` is the VENDOR build stamp, not the pull time — it proves which build is on disk; the git commit dates the pull.
+4. **Distinguish pull from restart.** Digest pinning means the serve script NEVER auto-pulls; a fresh `ActiveEnterTimestamp` (`systemctl show <svc> -p ActiveEnterTimestamp`) is a restart, not an update.
+5. **Sweep side pulls.** A newer engine version may have been pulled for a one-off (calibration, KLD, bench) and removed after. `podman images` census + `git log -S` for the second digest; note when the side image is gone from disk (answer: "pulled <date>, no longer on disk").
+
+## Facts to carry (radiance example)
+
+- frank-archon pin `stilldeadcode/radiance@sha256:4c3f484564…` (1.0.13) pulled 2026-10-05 (cutover commit); reused unchanged at the 2026-10-08 w4dn8 cutover.
+- Engine 1.2.0 was pulled 2026-10-08 for calibration only; image absent from disk afterwards.
+- Cross-pin compatibility (e.g. RADGRAM2 grams byte-identical across pins) is documented in the runbook — cite it when explaining a calibration/serving pin split.
+
+## Answer format
+
+Table: pin-first-introduced commit+date (the pull), later cutovers reusing the same digest (no pull), side-image pulls, last container start (restart, explicitly labeled not-a-pull). Offer upstream freshness scout as next step; a digest change for an LLM endpoint requires the stop-and-mask bench-window law.
@@ -0,0 +1,30 @@
+---
+name: fleet-judge-swap-calibrate
+description: "Swap the frank-intelligence-bench judge default and prove judge quality: fleet alias→weights map, known-truth calibration via scripts/judge-calibration.ts, per-backend reasoning-off dialect traps."
+---
+
+# Fleet judge swap + calibration (frank-intelligence-bench)
+
+## Fleet alias → weights (verified 2026-10-10 via ps on dankclaw; endpoints only serve aliases)
+- frank-archon = Qwen3.8-Flash-Next quant (radiance TP=2, dankserver:7770)
+- frank-dragoon = qwen38-flash-next-v2-swift15-abliterated.hgn, 180B MoE (halogen container `frank-large-halogen`, dankclaw:7770) — check `podman inspect frank-large-halogen --format {{json .Config.Env}} | grep HALOGEN_CHECKPOINT`
+- frank-zealot = Qwen3.5-9B-Uncensored-HauhauCS-Aggressive Q6_K (llama.cpp, 3090, dankclaw:7771) — check `ps aux | grep <port>`
+
+## Swap procedure
+1. `config/hosts.yml`: target host gains `roles: [target, judge]`; set `judge_default`. No-self-judge law: `judge == target` throws at enqueue; rotation = next fleet model.
+2. Judge load = AA-LCR + HLE only (SciCode/Terminal-Bench are unit-tested, judge-free).
+3. Mid-run: `run.json` pins its judge (provenance); default swap affects future runs only.
+4. Docs: `docs/endpoints.md` judge law section; commit with gates.
+
+## Calibration — the ONLY accepted proof
+`bun scripts/judge-calibration.ts [n] [judges...]` — known-truth floor test: gold answers must be judged CORRECT, deterministically mutated (first number +7) must be INCORRECT. Reports accuracy, mean s/verdict, projected AA-LCR/HLE judge hours. Safe beside a live run (judge-only traffic).
+- Known-truth is a FLOOR test: catches broken judges, not lenient ones. Gold-vs-mutation is easy mode; small-model leniency on model-vs-gold edges needs real-verdict spot audits.
+
+## Traps (all fired at least once)
+- **False-accuracy via transport death:** a 400-dying judge scores ~50% on this test (all verdicts collapse to INCORRECT, matching the mutation half by luck). ALWAYS inspect `err` on misses before trusting any agreement/accuracy number. Fix: if all misses share one `err=HTTP 4xx`, it is the harness, not the judge.
+- **Reasoning-off dialect split:** llama.cpp/radiance want `chat_template_kwargs:{thinking:false}`; halogen/vLLM-style servers 400 on `thinking` and honour `enable_thinking`. HostSpec field `reasoning_off: thinking|enable_thinking` (default `thinking`; dragoon needs `enable_thinking`). Wire-test via mock `bodies` capture.
+- **No historical judged rows?** Quarantined ledgers may pre-date judge usage (census first: `failureCensus` rows/phase), then use known-truth synthesis instead of re-judging.
+
+## Baselines measured (for future swaps)
+- zealot (9B): 25/25 known-truth, 13 s/verdict → AA-LCR 1.1h, HLE 9.3h; leniency risk on hard edges (small judge + compliance tune).
+- dragoon (180B): 2 s/verdict → AA-LCR 0.2h, HLE 1.4h; family-bias caveat when target shares its base family.
@@ -0,0 +1,83 @@
+---
+name: fleet-served-model-id-rename
+description: "Rename the served model id (alias) on a dank-fleet LLM endpoint and re-key every consumer that keys on it, with live verification."
+---
+
+# Fleet served-model-id rename (wire rename)
+
+Renames the id an endpoint announces on the wire. The service, unit, script and env
+FILE names keep the old name (container/unit identity is stable) — only the served
+alias moves. Done this way on 2026-10-09: frank-primary→frank-archon,
+frank-large→frank-dragoon, frank-secondary→frank-zealot.
+
+## 1. The knob, per engine
+| Endpoint | Knob |
+|---|---|
+| frank-primary (radiance, dankserver :7770) | `FRANK_PRIMARY_SERVED_NAME` in `scripts/frank-primary.env` → `--served-model-name` |
+| frank-large (halogen flash-server, dankclaw :7770) | `HALOGEN_MODEL_ID` in `scripts/frank-large.env` |
+| frank-secondary (llama.cpp, dankclaw :7771) | `ALIAS` in `scripts/frank-secondary.env` → `--alias` |
+
+Also flip the serve-script defaults (`: "${ALIAS:=…}"`, the `:?` gate messages).
+`scripts/deploy-remote.sh` has no alias references — the deployer needs no edit.
+
+## 2. Consumers that key on the id (all in ONE change)
+- Seams: `tests/frank_{secondary,large,primary}_unit.bats` — fixture env value,
+  the argv assertion (`--alias`), the env grep pin, the `-e HALOGEN_MODEL_ID=` render
+  assertion.
+- OpenWebUI (Dankclaw, rootless quadlet, `webui.db`): `model.id`+`name`,
+  `access_grant.resource_id` (`resource_type='model'`), `openai.api_configs`
+  per-backend `model_ids`. Backup first (`webui.db.bak-YYYYMMDD`; the DB is WAL-mode).
+  No sqlite3 binary in the image → `podman exec -i open-webui python3 -` with a
+  script on stdin. Then `systemctl --user restart open-webui.service`. A stale id
+  fails SILENTLY: OpenWebUI intersects the backend `/v1/models` with `model_ids`, so
+  the picker just goes empty.
+- Hermes (`/home/dank/Containers/hermes/data/config.yaml`, root-owned → sudo):
+  `model.default`, the provider `models:` key, every `auxiliary:` route naming the
+  endpoint. Backup, surgical `sudo sed -i`, sweep `grep -rln <old-id>` over the data
+  dir (session JSONs are historical — leave), restart `hermes.service
+  hermes-webui.service` (user units).
+- Dev harnesses: `"model": "frank-…"` literals in `scripts/bench-*.py`,
+  `deep-probe.py`, `calib-push.py`, `fleet-probes-swift15.sh`, `autoresearch*`.
+- Docs: `shared/homepage/docs.html` (headings, api-id annotations, the
+  curl/opencode/Pi examples), endpoint runbooks, `AGENTS.md` Model Config,
+  `serverAppConfigs-docs/Agent/OMP Harness.md`, `Dankclaw/OpenWebUI.md`.
+- Harness side (`~/.omp/agent/models.yml` on the dev box) — ids and `modelRoles`
+  must name the same string; two ports on one host = two providers.
+
+## 3. Deploy + verify
+`./scripts/deploy.sh <host> --service <name>` per endpoint; keep the tree clean
+(untracked scratch files inside the repo fail the whole-tree gate — put probes in
+/tmp with a `node_modules` symlink to `tests/e2e/node_modules`).
+
+Verify on `/v1/models`, NEVER on a chat echo: radiance echoes the REQUESTED model
+name (a 200 proves nothing), llama.cpp and halogen ignore the requested id.
+
+```bash
+for u in 192.168.0.235:7770 192.168.0.143:7770 192.168.0.143:7771; do
+  curl -fsS "http://$u/v1/models"; done
+```
+
+OpenWebUI acceptance = a real browser as a family account: the welcome screen names
+the model and `POST /api/v1/chat/completions {"model":"<new-id>"}` answers.
+`GET /api/v1/models/list` returning `{"items":[],"total":0}` for that same account
+is a probe artifact, not a failure. Playwright notes: `locator.isVisible({timeout})`
+does NOT wait (returns immediately) — use `waitFor({state:'visible'})`; the composer
+is a contenteditable div, not a textarea; stable anchors are
+`getByRole('button', {name: /selected model/i})` and "How can I help you today?".
+
+## 4. Trap: green deploy, old config
+`deploy.sh` plans from repo paths and gates on the port. A systemd drop-in under
+`/etc/systemd/system/<unit>.service.d/` can override `Environment=FRANK_*_ENV_FILE`
+and `ExecStart` to a staging worktree, so the deploy restarts a DIFFERENT tree and
+reports healthy (this bit frank-primary for a day after a quantization campaign).
+After an LLM deploy, prove the running shape:
+
+```bash
+systemctl cat <unit>                       # drop-ins print at the bottom
+podman inspect <container> --format '{{json .Config.Cmd}}' | tr , '\n'
+```
+
+Before retiring such a drop-in: diff staging vs checkout for serve script/unit/env,
+and `git merge-base --is-ancestor <staging-HEAD> HEAD` so no campaign tuning is
+lost. Move it to `~/.AGENTTRASH/YYYYMMDD-topic/` (never `rm`), `daemon-reload`,
+restart, re-read `/v1/models`.
@@ -0,0 +1,58 @@
+---
+name: fleet-service-rename-cutover
+description: "Rename a Dank-fleet LLM service end-to-end (repo trio, deployer keys, tags, hosts): the 2026-10-10 frank-archon/dragoon/zealot cutover procedure."
+---
+
+# Fleet service rename cutover (serverAppConfigs)
+
+Procedure proven 2026-10-10 renaming the three LLM services to their wire
+aliases (repo `55f87fc`). For any future full service rename.
+
+## Repo codemod
+1. `git mv` every tracked file whose path carries the old token
+   (`frank-<old>` → `frank-<new>`, plus `frank_<old>` bats seams).
+2. Content sweep over all tracked text files:
+   `git grep -Ilz '' | xargs -0 sed -i` with expressions for
+   `frank-<old>`, `FRANK_<OLD>`, `frank_<old>` → new forms; add the
+   `LLM_<OLD>` / `llm_<old>` / handler-name forms in the same pass.
+3. Known casualties to record: `scripts/patches/*.patch` context lines get
+   rewritten (patches stop applying byte-exact); historical prose adopts
+   the new name (one service, one name — Frank's rule).
+4. Fix sed-made-contradictory lore by hand: AGENTS.md Model Config
+   paragraph, any "keeps the old names" sentences. Do NOT enumerate the
+   retired names anywhere — the acceptance test is
+   `git grep -cE '<old forms>'` == 0 (case-insensitive too).
+5. Rename rollback tags in lockstep (docs quote tag names):
+   `git tag NEW OLD; git tag -d OLD`, push new, delete old refs on origin.
+6. Sweep the harness config comments too: `~/.omp/agent/models.yml`.
+
+## Deployer keying (why the sweep is safe)
+`scripts/deploy-plan.py` SERVICE_ORDER/host sets + `services_for_path`
+trio mapping; `scripts/deploy-remote.sh` `service_is_allowed` case,
+`deploy_service` dispatch, `relink_unit <service>` (symlink
+`/etc/systemd/system/<name>.service` → `scripts/<name>.service`),
+markers keyed by service name under `~/.local/state/serverAppConfigs/
+deploy-state/`. `add_pending_services` AUTO-TRASHES markers whose service
+is retired — no marker surgery needed if you skip a full drain.
+
+## Host cutover per endpoint (order matters)
+1. `sudo systemctl stop <old>`; rename `~/logs/frank_<old>.log` → new;
+   `podman rm -f` the old container name(s);
+   `sudo rm` the unit symlink + `multi-user.target.wants/<old>.service`;
+   `sudo systemctl daemon-reload`; trash the marker to
+   `~/.AGENTTRASH/<date>-fleet-rename/` with a NEUTRAL filename.
+2. `deploy.sh <host> --service <new-name>` (run from the main checkout;
+   refuses on a worktree branch). The handler relinks under the new name,
+   enables, restarts, health-gates.
+3. Do the harness-default-model endpoint LAST on its host, and never stop
+   an endpoint while a deploy on the other host is approaching its e2e
+   gate (the gate probes the live fleet).
+
+## Acceptance
+`/health` 200 + `/v1/models` shows the new id (radiance echoes requested
+names — verify on `/v1/models` only); unit active+enabled; new container
+name running; `git grep` zero on every checkout; e2e gate green;
+Prometheus job up (note: llama.cpp needs `--metrics` in the serve script
+for the scrape — absence is a pre-existing gap, not a rename regression).
+Out of scope: retired endpoint names (`frank-medium/small/npu`) and git
+history — old strings there are expected.
@@ -0,0 +1,36 @@
+---
+name: fork-locked-gguf-endpoint-trial
+description: "Trial a fork-locked GGUF (custom tensor types: ternary/PQ2_0/PTQ1_0, vendor Hadamard metadata) as a replacement payload on a fleet llama.cpp endpoint: identify the fork, close provenance of local variants, build the right binary, and run one trap-guarded census window that measures VRAM, per-slot window, tool/vision/reasoning channels, and long-context stability."
+---
+
+# Fork-locked GGUF trial on a live endpoint
+
+Use when a candidate GGUF carries **non-stock tensor types** (custom type ids, vendor metadata such as `prism.hadamard.*`) so mainline llama.cpp refuses it or loads a sibling `F16` file silently with garbage. Pairs with `gguf-header-vram-fit-analysis` (paper pricing); this skill is the *measure-it* half.
+
+## 1. Header census decides everything downstream
+Range-parse `resolve/main/<file>.gguf` bytes 0–48 MiB (metadata is ~11 MiB at 250k vocab; GGUF v3 strings are **u64**-length). Extract: `general.architecture`, `block_count`, `full_attention_interval`, `attention.head_count_kv`, `key_length`/`value_length`, `context_length` (target window > native ⇒ YaRN), `<arch>.nextn_predict_layers` (absent ⇒ no drafter, ever), tensor-type histogram, and per-tensor byte sizes from consecutive `offset` deltas ⇒ exact bpw.
+- `KV = full_layers × head_count_kv × key_length` elements/token **per cache**; only full-attention layers bill per token, linear/DeltaNet layers bill a fixed state per slot.
+- Ternary packs shrink weights only. At 262,144 tokens KV (16 full layers, 4×256) = 16.0 GiB f16 / 8.5 GiB q8_0 / 4.5 GiB q4_0 — 3× the 6.71 GiB of weights. **The cache is the wall, never the pack.**
+
+## 2. Fork identification and tag ancestry
+- Map custom type id → name from the vendor fork (`ggml/include/ggml.h` on its branch, e.g. `GGML_TYPE_PQ2_0 = 142`, `PTQ1_0 = 143`).
+- `GET /repos/<fork>/compare/<tag>...<branch>` → `ahead_by` + commit subjects tells whether the newest **release** contains a fix, without reading history. Release workflows lie by omission: grep the workflow for the flag you need (e.g. prebuilt CUDA lacked `GGML_CUDA_FA_ALL_QUANTS` → quantized/mixed KV silently runs flash attention on CPU, ~2× slower; vendor issue #267).
+
+## 3. Close provenance of payload variants already on disk
+`sha256sum` the local file (7.2 GB ≈ 15 s NVMe), then search the Hub (`/api/models?search=<name>`, `/api/models/<repo>?blobs=true` → sibling `lfs.sha256` + size). Equal size + different sha = re-weighted variant, not a corrupt copy. Known houses: `dealignai/*-CRACK-*` (uncensored), `ManniX-ITA/*-MTP-GGUF` (appended MTP head ≈ +450 MB, restores a drafter the official file lacks). Same size/geometry ⇒ the VRAM verdict carries across variants; behaviour (refusals, tool calls) does not.
+
+## 4. Build recipe (Dankclaw, RTX 3090)
+`/usr/local/cuda` does not exist for non-interactive shells; `/usr/bin/nvcc` is a Debian wrapper. Mirror the known-good cache instead of guessing:
+```
+cmake -G Ninja -B build-cuda-prism -DCMAKE_BUILD_TYPE=Release \
+  -DCMAKE_CUDA_COMPILER=/usr/bin/nvcc -DCMAKE_CUDA_HOST_COMPILER=/usr/bin/gcc-13 \
+  -DCMAKE_CUDA_ARCHITECTURES=86-real -DGGML_CUDA=ON -DGGML_CUDA_FA_ALL_QUANTS=ON
+```
+nvcc 12.4 refuses gcc 15 (`gcc-13`). FA template instances dominate the build (~150/804 in 12 min); park it with `pkill -f "[r]un-<build>"` + `pkill -x ninja` before timing anything — the bracket stops `pkill -f` matching your own ssh cmdline.
+
+## 5. One-window census (never two outages)
+Fetch through a committed script (`-fsSL --fail-with-body`, byte count + LFS sha, no resume, no token in argv), then stage `/tmp` throwaways: candidate env fed to the **repo serve script** via its `*_ENV_FILE` override (never edit remote config), and a runner whose `trap restore EXIT` always kills the candidate by pid and `systemctl start` the production unit + health-polls to 200.
+Order inside the window: copy the production log aside (serve scripts truncate it) → stop unit → wait `memory.used < 1500` → boot candidate → `/health`, boot ledger (`KV buffer`, `compute buffer`, `flash`), `nvidia-smi --query-compute-apps`, `/v1/models`, `/props`, `/slots` (per-slot `n_ctx` is the harness contract, `pool/parallel`), chat probe (does thinking land in `reasoning_content` or `content` — a vendor `--reasoning-in-content true` default breaks the harness channel), tool-call probe (name + valid-JSON `arguments`), 512 px solid-colour vision probe, then a ~190k-token `/completion` fill reading `timings`. Kill the server, then `llama-bench` dtype arms (`-c <pool> -np <slots> -ctk/-ctv -b 2048 -ub 2048 -p 4096 -n 128 -r 1`) under a 1 Hz `nvidia-smi` sampler, `peak_gpu_mib=$(sort -n | tail -1)` per arm. Skip `-mmp 1` unless `-mmproj` is also passed.
+
+## 6. Gates that outvote the memory table
+Vendor `KNOWN_ISSUES.md` + open issues (quantized-KV resets near 200k, inert ngram/`--cache-reuse` on hybrid memory, malformed `tool_calls`, prompt-cache loss from re-rendered reasoning); base alignment (an uncensored endpoint replaced by a censored base is a fleet-wide capability loss); and which harness roles point at the endpoint (`models.yml` + `modelRoles`) — tool-heavy roles fail loudly on a `tool_calls` defect. Repo seams pinning `-ctk/-ctv` literals must be re-keyed to read the env file, so a retune moves one file, not two.
@@ -0,0 +1,52 @@
+---
+name: frank-bench-run-ops
+description: "Operate frank-intelligence-bench runs on the dank fleet: status census, full void + fresh launch, judge cutover, supervisor restart law, watchdog timer, fault-autopsy snippets."
+---
+
+Runbook for /home/blank/Projects/frank-intelligence-bench (Bun/TS). Companion to frank-bench-supervisor-recovery (row-voiding for poison); this skill is the ops loop around it.
+
+## Status census (run from repo root)
+```bash
+export RID=$(ls -t runs | grep -m1 frank-archon)   # live run id
+tail -2 runs/$RID/log.txt
+python3 - <<'PYEOF'   # latest-wins cohort census (mirrors score.ts semantics)
+import json, os, collections
+led = f"runs/{os.environ['RID']}/ledger.jsonl"
+best = {}
+for l in open(led):
+    r = json.loads(l)
+    if r["phase"] != "grade": continue
+    k = (r["eval"], r["instance"], r["repeat"])
+    if r["ok"] and (k not in best or r["ts"] > best[k]["ts"]): best[k] = r
+    elif k not in best: best[k] = r
+by = collections.defaultdict(lambda: [0,0])
+for k,v in best.items(): by[k[0]][0]+=bool(v["grade"]["correct"]); by[k[0]][1]+=1
+for e,(c,n) in sorted(by.items()): print(f"{e}: {c}/{n} = {100*c/n:.1f}%")
+PYEOF
+```
+`pgrep -f "cli.ts _exec"` = supervisor; `systemctl --user is-active fib-watchdog.timer` = watchdog; last ledger ts older than ~5 min = suspect stall.
+
+## Launch laws (each earned by an outage)
+- Code fix + running supervisor = FIX IS NOT LIVE. Restart supervisor: `pkill -f "cli.ts _exec"`, then relaunch.
+- Correct detached form from harness bash: `cd runs/$RID && setsid nohup bun run ../../src/cli.ts _exec run.json >> log.txt 2>&1 < /dev/null & disown`. NEVER the subshell form `( ... & )` — reaped by cgroup within minutes.
+- Preferred launch = `bun src/cli.ts run HOST --judge JUDGE --detach` (in-process spawn + unref, proven 6 h+).
+- Watchdog = systemd user timer `fib-watchdog.{service,timer}` (~/.config/systemd/user), 10 min, Persistent, runs `bun src/cli.ts worker` (idempotent: exits when heartbeat fresh, takes over stale runs via 30 s mtime gate).
+
+## Void all results + fresh run (model/endpoint change)
+1. `pkill -f "cli.ts _exec"`; sleep 1.
+2. `mv runs/<id> .AGENTTRASH/run-voided-<reason>-$(date +%s)`; `mv reports/<model>/* .AGENTTRASH/`.
+3. queue.json: set `runs: []` (python json edit).
+4. New run: `bun src/cli.ts run frank-archon --judge frank-dragoon --detach`.
+5. Log the void in docs/log.md (reason, quarantined scope) and commit — never silently erase scores.
+
+## Judge cutover (zealot→dragoon pattern)
+Void ONLY LLM-judged evals' `phase=grade` rows (keep ALL gen rows — target output is judge-independent); set `judge` in run.json; restart supervisor; resume rejudges automatically (grade keys incomplete). SciCode = pytest, judge-independent, never voids for judge changes.
+
+## Fault-autopsy snippets
+- Engine-fault census: grade rows with `ok:false` + empty text = engine, not model (signature-default trap: "AssertionError × N" with empty text = grades never executed).
+- Runaway-chain detector (HLE loops): gen rows with `finish=="length"` AND completion_tokens==max AND empty text = reasoning degenerated into repetition; measure pre/post any quantization change to separate model behavior from engine artifacts.
+- Census-by-eval: `collections.Counter((r["eval"], r["phase"], r["ok"]) for r in rows if r["ts"] > <cutover>)`.
+- Verdict-parser bugs: probe the live judge on a minimal case (`judgeAalcr`/`judgeHle` via `bun -`), inspect raw head+tail; llama.cpp thinking models may return content:"" with everything in reasoning_content, and prose verdicts when their JSON scaffold breaks.
+
+## Reporting etiquette (Frank's rules)
+Quote score as: per-rep %, test avg@1 / avg@3, dev, index-lite; label provisional until all reps land; publish the runaway/parse-rate census next to any handicapped number. Dashboard :8787; `bun src/cli.ts report` renders the trio; `analyze` prints failure census.
@@ -0,0 +1,45 @@
+---
+name: frank-bench-supervisor-recovery
+description: "Recover a frank-intelligence-bench run after engine faults: detect poison grade rows, void them, restart supervisors with fixed code, judge cutover, watchdog for multi-day runs."
+---
+
+Recover frank-intelligence-bench runs on the dank-fleet after engine faults (poison graders, judge swaps, supervisor deaths).
+
+## Laws (friction-earned 2026-10-10/11)
+1. **A code fix is only real after the supervisor restarts.** Bun loads code at spawn; an on-disk fix never reaches the running process. Kill `_exec`, relaunch — takeover law makes resume cheap.
+2. **A judge cohort is all-or-nothing.** Never mix judges on one eval's grade rows. Void ALL grade rows for LLM-judged evals (`phase == "grade"`), KEEP all `gen` rows (target output is judge-independent) — resume rejudges from cache.
+3. **Poison census signatures:** grade rows with empty text + forced FAIL = engine, not model. `unparseable verdict` storm = judge output class (empty `content` + chain in `reasoning_content`; or 2048-tok truncation before verdict JSON). Default census sig `AssertionError` masked a poison shift — treat mass-default sigs as red flags.
+4. **Detached launch form matters:** from a short-lived harness shell, `(setsid nohup cmd & )` (subshell) gets cgroup-reaped within minutes — silent death, stale `worker.pid`, no log line. Proven form: `setsid nohup cmd >> log.txt 2>&1 < /dev/null & disown` as the tail of the same shell (survived 6 h overnight).
+
+## Void-and-resume procedure
+```bash
+pkill -f "cli.ts _exec"
+python3 - <<'PYEOF'
+import json, pathlib, shutil, time
+led = pathlib.Path("runs/<RUN_ID>/ledger.jsonl")
+rows = [l for l in led.read_text().splitlines() if l.strip()]
+keep, void = [], []
+for l in rows:
+    r = json.loads(l)
+    if r["eval"] in (<EVALS>) and r["phase"] == "grade" and r["ts"] > "<CUTOVER_ISO>":
+        void.append(l)
+    else:
+        keep.append(l)
+shutil.copy(led, f".AGENTTRASH/ledger-voided-{int(time.time())}.jsonl")
+led.write_text("\n".join(keep) + "\n")
+print(f"voided {len(void)}; kept {len(keep)}")
+PYEOF
+cd runs/<RUN_ID> && setsid nohup bun run ../../src/cli.ts _exec run.json >> log.txt 2>&1 < /dev/null & disown
+```
+- Judge cutover variant: void ALL `phase==grade` rows for the judged evals (no ts filter), edit `run.json` `judge` field, relaunch.
+- Validate the judge endpoint first: live probe both directions (correct + incorrect candidate); a good judge returns bare verdict JSON fast.
+- Resume proof = a specific known step flipping FAIL→PASS (or vice versa) in the log within minutes.
+
+## Watchdog for multi-day runs
+No cron on the Arch workstations — systemd user timer, idempotent (`cli.ts worker` exits instantly when supervisor heartbeat is fresh; takes over via pid-file 30 s freshness gate):
+`~/.config/systemd/user/fib-watchdog.service`: Type=oneshot, WorkingDirectory=repo, `ExecStart=/usr/bin/bun src/cli.ts worker`, stdout/stderr `append:.../runs/watchdog.log`.
+`fib-watchdog.timer`: OnBootSec=5min, OnUnitActiveSec=10min, Persistent=true, WantedBy=timers.target.
+`systemctl --user enable --now fib-watchdog.timer`; verify `loginctl show-user <u> -p Linger` = yes (survives logout/reboot). Prove idempotence: log line "has a live supervisor — worker exits".
+
+## Scoring truth after repair
+Report renders from ledger with latest-wins via `ok` filter (no explicit dedup): ok=false rows drop, recovered key counts once. UI `done` counts unique `(eval,instance,repeat)` completed keys. SciCode denominators: 341 steps/rep (not 1120/3-rep arithmetic traps).
@@ -0,0 +1,30 @@
+---
+name: frank-job-hunt-grilling-state
+description: "Resume frank-job-hunt: repo is BUILT and deployed (agents live on Dankserver, ntfy on Dankclaw); grilling closed, design v2 shipped; lists pending ops items and invariants."
+---
+
+## Status (2026-10-11): design grilling CLOSED (design v2 signed); repo built, deployed, self-verifying.
+
+Repo: ~/Projects/frank-job-hunt (workstation) — Gitea `dank/frank-job-hunt` on Dankclaw; Dankserver clone runs timers (sweep 07:30, digest 08:15, Linger=yes). Pre-commit hooks: bun test + tsc + docs-link + secret scan. Tests: 69, strict TS (no `any`; Records for static tables; named contract types).
+
+## Machine
+- `agents/sweep.ts`: registry → greenhouse/lever/ashby/workday public APIs → gates → frank-zealot score → `jobs/*/inbox.json|gated.json`; `--dry --ats=` flags; per-site fetch dedupe; per-entry error census.
+- `agents/digest.ts` → ntfy (ntfy.franksdank.cloud, LAN; topic secret in `~/.config/frank-job-hunt.env` 600); degrades to file + exit 1.
+- `agents/review.ts`: funnel metrics (weekly rate 8-10, callback floor 4%).
+- `agents/verify-registry.ts --write`: monthly ATS-locator probe/re-attribute (14 scout mis-attributions repaired).
+
+## Truths earned in build
+- Registry truth: **21 live API sites, ~169 manual lane** (vanity Workdays, self-built ATS incl. majors, neogov). Scouts' ats attribution ≈ guess — verify before trusting counts.
+- Gates do the discriminating; zealot only ranks survivors (9B inflates everything: recruiters scored 91 before family gate).
+- Gate law: role FAMILY gates unconditionally (recruiter/sales/people-ops/TPM/solutions, no infra override); topic negatives get infra-token precedence ("full-stack platform engineer" passes). Comp NEVER gated; unstated location passes to human.
+- Metro regex = Puget Sound list only (Tuolumne CA leak fixed — WA localities, no CA decoys).
+- ATS tokens: first DNS label (greenhouse.harpereng.com→harpereng); vanity workday URLs are NOT CXS-resolvable → manual lane.
+- Zealot (llama.cpp thinking model): send `chat_template_kwargs:{enable_thinking:false}` + max_tokens ~600; verdict in `content` then; `reasoning_content` fallback kept.
+
+## Pending (user-side / next session)
+1. Porkbun API 503'd: public A record `ntfy → 71.227.227.172` still missing (LAN works; add via UI when API recovers, for off-LAN phone).
+2. Frank: phone ntfy app subscribe (topic in env file); LinkedIn CSV export → `contacts/`.
+3. First production digest = tomorrow 08:15; check `journalctl --user -u frank-job-digest.service` + phone.
+4. bg_6 (last session): full dry-sweep proof of family gate (top-10 must be engineering-only) — check `agent://`/proc result if pending.
+5. Resume Matcher compose (`agents/resume-matcher/compose.yaml`) not deployed — needs image digest pin on Dankserver.
+6. `prep/` STAR/LP bank content fill (daily-loop.md scaffolded).
@@ -0,0 +1,35 @@
+---
+name: frank-job-hunt-maintenance
+description: "Maintain frank-job-hunt agents: live-census gate hardening loop, registry locator verification, and the workstation/Dankserver/Dankclaw deploy-sync ritual."
+---
+
+# frank-job-hunt maintenance
+
+Repo `~/Projects/frank-job-hunt` (Gitea `dank/frank-job-hunt` on Dankclaw 192.168.0.143:3000). Production: Dankserver user timers `frank-job-sweep.timer` 07:30, `frank-job-digest.timer` 08:15 (`Linger=yes`). ntfy relay: Dankclaw quadlet `ntfy.service`, route `ntfy.franksdank.cloud` (no anubis), LAN record in `hosts/custom.list` (Pi-hole v6 file at `/home/dank/Containers/pihole/etc-pihole/hosts/custom.list`; v6 API paths are hostile — edit the file, then `podman exec pihole pihole restartdns`). Secrets: `~/.config/frank-job-hunt.env` (600, workstation + Dankserver).
+
+## Law (validated 2026-10-11)
+- The fleet judge (`frank-zealot`, dankclaw:7771) is a **ranker, never a gate** — it inflates anything reaching it (non-technical roles scored 88-91). All discrimination lives in deterministic gates (`agents/lib/gates.ts`); zealot only ranks survivors.
+- Thinking-model fault: verdict lands in `reasoning_content` with `content:""` → judge sends `chat_template_kwargs:{enable_thinking:false}` (0.7s clean JSON).
+- **Family beats topic**: role family (recruiter/sales/finance/PM/designer/people-ops/revops/…) gates `gate:scope` unconditionally — no infra-token override ("DevOps Recruiter" is recruiting). Compound technical titles keep the `INFRA_TITLE` override via `NEG_TITLE` branch.
+- **gate:region**: remote is US-only (visa reality). "Remote - Bangalore" = onsite abroad → gate; `US` regex pass wins over `NONUS` match ("U.S. & Canada" passes).
+
+## Gate hardening loop (live-census, TDD)
+1. `bun agents/sweep.ts --dry` (full lane ≈ 30–90 s; 852 postings ≈ 62 pass / 790 filed).
+2. Classify leaks in the top-10: family gap / region gap / scoring tail. Accept long tail (Director/Founder edge cases) — digest + human curation is the design.
+3. Token fix in `gates.ts` regexes (`NEG_FAMILY` = no override; `METRO`/`US`/`NONUS` for arrangement). NEVER dedupe-check by memory — read file first; the file has bitten line-offset edits repeatedly.
+4. Pin every leak with a named regression test in `agents/test/gates.test.ts` before/with the fix.
+5. `bun test agents/test/ && bun x tsc --noEmit` — hooks re-run these at commit.
+6. Ship: `git commit` (pre-commit = tests + tsc + docs-link + secret scan) → `git push` → `ssh dankserver 'cd ~/Projects/frank-job-hunt && git pull'` (timers pull from master; Dankserver drift = tomorrow's run is stale).
+
+## Registry verification (monthly, `agents/verify-registry.ts`)
+Scouts' `ats`/`ats_identifier` are guesses (14/84 were wrong). Ritual:
+1. `bun agents/verify-registry.ts` (dry, ~70 s serial) → REPAIR census.
+2. `--write` applies; repairs with live jobs preferred over empty boards (0-job boards 404 later).
+3. Unresolved = honest manual lane (vanity Workdays, self-built ATS incl. majors, neogov) — NOT a code bug; per-entry error census in sweep output is the same signal.
+4. Update `targets/README.md` census lines + `docs/log.md`; commit/push/pull (same ship step).
+
+## Pitfalls
+- `--ats=<x>` smoke filters the census line — "N API-sweepable" reflects the filter, not the registry; don't diagnose a phantom bug.
+- Workday vanity careers URLs (`careers.uw.edu`) are NOT CXS-API-resolvable; tenant-only identifiers are (site path required).
+- Root `README.md` vs `targets/README.md` name collision in edit anchors: use full path headers.
+- Zealot endpoint probe: `curl http://192.168.0.143:7771/v1/models`.
@@ -0,0 +1,39 @@
+---
+name: frank-model-bench-grilling-state
+description: "Resume the frank-model-bench design grilling: AA Intelligence Index v4.3.2 research brief, fleet endpoint facts, dataset gating, and all settled design decisions for /home/blank/Projects/frank-model-bench."
+---
+
+# frank-model-bench — Grilling State (design settled 2026-10-09, awaiting build go-ahead)
+
+Target dir `/home/blank/Projects/frank-model-bench` is EMPTY (no git). Init from zero.
+
+## Settled design decisions
+- **Scope**: Tiered reproduction of AA Intelligence Index v4.3.2 (10 evals, 4 categories; Agents 30 / Coding 20 / General 30 / Science 20).
+  - **Tier A (local, self-graded)**: SciCode, Terminal-Bench 4.0 (podman on Dankclaw via ssh one-shot), AA-LCR, HLE incl. image questions (vision towers).
+  - **Tier B (external dep)**: GDP.pdf (LiteParse+vision+judge).
+  - **Tier C (never run; AA reference rows only)**: AA-Briefcase, GDPval-AA, AutomationBench-AA, AA-Omniscience (public set is 600/6000 — demoted), CritPt (key-gated grader API 10/24h — demoted).
+  - Locally-run weight ≈ 45% of AA index weight. Headline = "Index-lite" (category-weighted over run evals, formula on-page).
+- **Stack**: Bun/TS orchestrator (UI, queue, ledger, reports) shelling out to commit-pinned vendored uv venvs per upstream harness (inspect_ai, Harbor, SciCode/HLE scripts). `evals.yml` manifest pins git URL+SHA+entrypoint+args+repeats per eval.
+- **UI**: local web dashboard, localhost bind only, SSE live tail, start wizard; CLI `frank-bench`.
+- **Endpoints**: registry `hosts.yml` (name, base_url, api_key_ref, model, ctx, backend, role, cap). Discovery = probe known fleet hosts ports 7770-7799 `/v1/models` + `/props`, confirm-then-append. Fleet: frank-archon dankserver:7770 (radiance TP=2 R9700, 200k), frank-dragoon dankclaw:7770 (halogen, 200k×2), frank-zealot dankclaw:7771 (llama.cpp 3090, 200k×2). All OpenAI-compat + API key + vision.
+- **Judge**: self-hosted fleet model ONLY, default frank-zealot; hard no-self-judge rotation rule. Scores labeled `local-judge`, drift vs AA hosted graders expected/documented.
+- **Execution**: per-endpoint runs, strictly serial queue, one request in flight per eval (per-endpoint cap), temp 0.6 reasoning ON, max_tokens cap 32,768, AA-style 30-attempt retry, per-sample timeout = ctx ÷ measured decode rate.
+- **Durability**: per-sample JSONL ledger is canonical artifact; resume mid-eval; reports commit to git (reports/<model>/<run-id>/{index.html,data.json,hf-card.md,manifest+ledger SHA-256}), ledgers gitignored.
+- **AA comparison**: free Data API key → `bench sync-aa` pins headline indices; per-benchmark refs hand-seeded in `references/aa-scores.yml` (source URL + fetched-at + index version per row). Free=100 req/24h headline-only; Pro=500 req/24h per-benchmark (stubbed for later).
+- **Datasets**: `bench init-data` checklist (hf auth login + accept terms cais/hle, surgeai/GDP.pdf, Harbor Hub); checksum cache ~/.cache/frank-bench/datasets; gated evals refuse with fix-URL and continue suite.
+- **Methodology updates**: version-pinned manifests + immutable history; update = one commit: evals.yml bump + docs/methodology rewrite + log.md + resync snapshot. AA cadence ~2-3 minor versions/week; changelog artificialanalysis.ai/changelog.
+- **KB**: `docs/` inside repo, OKF v0.1 (type required; index.md per dir; log.md newest-first; .okf/config.yaml from omp-docs); Obsidian-wikilink convention per serverAppConfigs-docs.
+- **Git**: Gitea on Dankclaw remote, master base, worktree branch per milestone, pre-commit: bun test + shellcheck + OKF validate. Secrets: ~/.config/frank-bench/secrets.env 600.
+- **Tests**: bun test w/ scripted mock OpenAI endpoint (full run→ledger→HTML offline); Playwright dashboard e2e; `bench smoke` manual real-endpoint.
+- **Milestones**: M1 scaffold+registry+mock; M2 SciCode E2E w/ real report trio; M3 rest of Tier A + queue/resume; M4 dashboard UI + discovery wizard; M5 GDP.pdf + AA snapshot + peer tables.
+- **Reports**: single-page HTML, offline-openable, no external assets; per-benchmark rows: local | AA ref | Δ | repeats | n | graded-by; Tier C rows "AA reference only"; speed strip captured (no AA speed compare).
+
+## Key research facts
+- AA Data API: base https://artificialanalysis.ai/api/v2, `x-api-key` header, OpenAPI at /api/v2/openapi; free = /language/models/free headline indices.
+- Eval repos: SciCode1/SciCode (HF, Apache), cais/hle (gated, MIT, 2500 q, ~0.27GB), ArtificialAnalysis/AA-LCR (public, Equality Checker prompt public), surgeai/GDP.pdf (gated, Gemini 3.5 judge, inspect_ai), harbor-framework/terminal-bench 4.0 (66 tasks, CONTAINERS_BACKEND=podman, Harbor Hub gated), AA-Omniscience-Public 600q, CritPt public grading API 10/24h.
+- AA org repos: Stirrup (MIT agent harness), aa-agentperf-local, aiperf, optima, StirrupJS.
+- AA settings: temp 0/0.6, 16k+ max tokens, 30 retries, 1-5 repeats pass@1; Omniscience index [-100,100] accuracy−hallucination.
+- Search chain web/kagi→web/searxng (search.franksdank.cloud) verified working 2026-10-09.
+
+## Accepted risks (user-informed)
+- Elo-pairwise agentic evals unreproducible locally; self-hosted judge drift; Omniscience (top quant-damage signal) not run; HLE vision inclusion diverges from AA text-based posture.
@@ -0,0 +1,125 @@
+---
+name: frank-tts-add-cloned-voice
+description: "Add or repair a cloned voice on the dank fleet: /home/dank/voices/<name> pack, name rules, boot-warm registration, and the under-a-second proof"
+---
+
+Use for "give frank-tts a new voice", "voice X is missing/unknown", or "the first
+request of the day takes 5 s". Runbook of record: vault pages [[Frank TTS]] (voice
+packs, naming) and [[Frank TTS Engine]] (the warm registry). Everything below runs
+as the deploy user on **Dankclaw** (`ssh -o BatchMode=yes dankclaw '…'`); the
+containers are **rootless** (`systemctl --user …`, `podman …` without sudo).
+
+## Naming (the question that gets asked first)
+
+A voice is addressed **by its directory name** — `voice=narrator1` on
+`POST /v1/audio/speech` (omp's TTS device may send `voice_id`, same value). Use:
+
+- `^[a-z0-9][a-z0-9._-]*$`, **lowercase**, ≤ 64 chars. No slash, no `..`, no
+  space, no uppercase; must not start with `.`/`_`/`-`.
+- Why lowercase rather than just "alphanumeric": the shim accepts
+  `[A-Za-z0-9][A-Za-z0-9._-]{0,63}` (`app.py`, `VOICE_NAME_RE`) but the **engine
+  lowercases names**, so `Narrator1` resolves on one side and not the other. The
+  boot warmer refuses a mixed-case pack loudly instead of half-working.
+- Names are user-visible: a 400 carries them in `available_voices`. Fleet
+  convention is `narrator1`, `narrator2`, … for the open-notebook podcast
+  speakers — open-notebook is configured with exactly `narrator1/2/3`, so renaming
+  those breaks podcast rendering, not just TTS — and a lowercase personal name for
+  a person's own voice.
+
+## Pack layout (host state — never commit it)
+
+`/home/dank/voices/<name>/` is a voice **iff** it holds `reference.wav`:
+
+```
+reference.wav    24 kHz mono pcm_s16le, 18-25 s of clean single-speaker audio
+reference.spk    engine x-vector: enc_dim 2048 f32 = 8192 B
+reference.rvq    RVQ codes: 22 B per 12.5 Hz frame (5456-6864 B)
+manifest.json    source path + sha256, crop start/end, engine commit, name
+```
+
+Build it; do not hand-assemble and never fabricate `.spk`/`.rvq` from a WAV:
+
+```bash
+scripts/build-voice-pack.sh --all /home/dank/voices       # everything in VOICE_PACKS
+scripts/build-voice-pack.sh --source SRC --offset SEC --duration SEC --sha256 HEX NAME /home/dank/voices
+scripts/build-voice-pack.sh --dry-run ...                  # validate + crop, no extractor
+```
+
+Knobs live in `scripts/voice-packs.env` (one `_SOURCE`/`_OFFSET`/`_DURATION`/
+`_SHA256` set per voice). Three things it enforces that an operator gets wrong:
+
+1. **The 10-second gate.** A crop starting inside the first 10 s of the source is
+   refused before anything is written (project source-material law), and the
+   manifest is re-checked against the source's sha256 afterwards.
+2. **The effective crop window is 19.84-25 s, not 18-25 s.** An 18.0 s crop is a
+   legal `reference.wav` but yields only 22 × 225 = 4 950 B of `.rvq`, under the
+   5 456 B floor the codec config implies — so the builder says so up front.
+3. **It never deletes.** An existing pack is refused unless `--force`, and
+   `--force` moves the old directory to `$PACKS_DIR/.AGENTTRASH/<voice>-<UTC>/`.
+
+Files must be world-readable (the container runs as uid 10000): `644` files,
+`755` dirs. `mkdir -p /home/dank/voices` as the deploy user if it is absent —
+rootless podman auto-creates a missing bind source **root-owned**, and the
+endpoint then sees no voices at all.
+
+## Register and warm (the part people forget)
+
+The engine keeps its voice registry **in memory**, and the **first synthesis of a
+registered voice decodes the whole reference clip** to snapshot codec state:
+6.2-8.0 s, first audio byte at ~5 530 ms. Later requests restore in 0.5 ms.
+Re-registering does **not** warm — only synthesizing does. So:
+
+```bash
+# registers every pack that has a reference.wav, then speaks the warm sentence once
+podman exec frank-tts-engine /app/warm-voices.sh
+systemctl --user --no-pager --full status frank-tts-engine.service | tail -20
+```
+
+The unit's
+`ExecStartPost=-/usr/bin/podman exec frank-tts-engine /app/warm-voices.sh` does
+the same at every boot, so a fresh boot is already warm; the explicit call above
+is for **adding one voice to a running engine** and needs no restart — a restart
+drops every registration and re-pays the cold cost for the whole library. The
+`podman exec` form is not cosmetic: the engine **publishes no port**, so there is
+no host address to curl.
+
+## Proof (do not report "added" without it)
+
+```bash
+curl -s localhost:7772/v1/audio/voices                        # name is listed
+time curl -s -o /tmp/a.wav localhost:7772/v1/audio/speech \
+  -H 'content-type: application/json' \
+  -d '{"model":"tts-1","voice":"NAME","input":"Checking the cloned voice.","response_format":"wav"}'
+time curl -s -o /tmp/b.wav localhost:7772/v1/audio/speech \
+  -H 'content-type: application/json' \
+  -d '{"model":"tts-1","voice":"NAME","input":"And the second request.","response_format":"wav"}'
+file /tmp/a.wav /tmp/b.wav                                    # really audio
+```
+
+The warmer's journal lines carry `voice NAME cold=…ms warm=…ms` — quote that pair.
+Note that streaming and buffered output differ at the same seed (92.2 % of samples,
+-41.6 dB RMS): never compare two paths or two "identical" renders, only that each
+is audio and that the second request is fast.
+
+## Failure modes worth naming
+
+- `400 unknown voice …; available voices: …` → the name is not a pack: wrong
+  spelling/case, missing `reference.wav`, or `/home/dank/voices` root-owned/empty.
+  Trust the 400's list over any manifest.
+- 400 with `(none: no voice pack with a reference.wav in /voices)` → mount problem,
+  not a voice problem.
+- First request slow **after** a boot → the warm pass failed; read the unit's
+  journal (the warmer exits 0 and logs when there is no voice directory, so
+  silence there is not success either).
+- Endpoint answers but synthesis fails 502 → the façade must dial
+  `http://frank-tts-engine:8880` over the shared bridge
+  (`frank-tts-engine.network`); a `host.containers.internal` / `127.0.0.1:8880`
+  upstream can never work between containers, because netavark DNATs published
+  ports only.
+
+## Never
+
+Never write under `/voices` from the endpoint (mounted `:ro` by design), never
+`git add` a voice pack, never `rm` a pack (repo policy: move to `.AGENTTRASH/`),
+and never benchmark against this endpoint while it serves — stop and mask the
+units first.
@@ -0,0 +1,54 @@
+---
+name: gguf-header-vram-fit-analysis
+description: "Decide if a GGUF model fits an LLM endpoint's GPU at a target context window: HTTP range-parse the header for KV geometry and custom quant types, derive the KiB/token rate law, price non-KV from measured boots (own repo + the publisher's benchmark reports), and gate on runtime lock-in (fork, build flags, drafter) before any download."
+---
+
+Answer "can model M fit window W on endpoint E (plus vision?)" **before** downloading anything. The GGUF header carries the truth; measured boots are the price list.
+
+## 1. Range-parse the GGUF header from the Hub (no download)
+
+`GET` the `resolve/main/<file>.gguf` URL with `Range: bytes=0-N` and a `User-Agent: curl/8` header, parse GGUF in Python (`struct`):
+
+- Layout: magic `GGUF` (read `buf[0:4]` directly — do NOT `read_string()` it), u32 version, u64 ntensors, u64 nkv, then KV pairs (v3: u64 string lengths; v2: u32), then tensor-info table (name, ndim, dims u64[], type u32, offset u64). Handle EVERY array element type or the parse desyncs mid-metadata.
+- **Metadata is >8 MiB** when vocab is ~250k (tokenizer arrays live in the KV section). Fetch 32–64 MiB.
+- **Per-tensor byte sizes without a downloader**: the data section is in table order — `size(i) = offset(i+1) - offset(i)`, last = `file_size - header_end - offset(last)`. Then `bits/elem = bytes*8/prod(dims)`. That names unknown type ids by their rate (2.125 bpw ⇒ ternary-in-2-bit-slots + fp16 scale/128; 16.0 ⇒ BF16; 32 ⇒ F32) and totals weights per type.
+
+Extract: `general.architecture`, `block_count`, `full_attention_interval`, `attention.head_count_kv`, `key_length`/`value_length`, `context_length`, `embedding_length`, `ssm.*`, and **`<arch>.nextn_predict_layers`** — its absence (plus `block_count` = real layers, not +1) means **no in-file MTP head** (MTP is a property of the file, not the flags). Type histogram decides stock vs fork: a type id above stock `GGML_TYPE_COUNT` is fork lock-in — read the fork's `ggml/include/ggml.h` enum to name it.
+
+## 2. KV rate law (the wall)
+
+For hybrid (qwen35-style) models only the FULL-attention layers bill per token; linear/DeltaNet layers bill a fixed state per SLOT (≈50–60 MiB/slot on 27B-class hybrids — noise vs KV, but it is what lets N slots fit).
+
+```
+elems/token/cache = (block_count / full_attention_interval) × head_count_kv × key_length
+B/token           = elems × bytesK + elems × bytesV      (K and V both)
+bytes/elem: f16=2.0, q8_0=1.0625, q4_0=0.5625, q4_1=0.578125
+```
+
+Fleet-verified instances: qwen35-9B (8 full layers) 32 KiB/token f16; qwen35-27B (16 full) 64 KiB/token f16, 34 KiB q8_0, 18 KiB q4_0. A low-bit WEIGHT quant never moves this line — state it explicitly, it is the question people actually ask. `--flash-attn on` is required for quantized V; quantized KV needs a `GGML_CUDA_FA_ALL_QUANTS=ON` build.
+
+## 3. Price non-KV from MEASURED boots, never a formula
+
+Two anchors beat one:
+- **Own repo**: closest runbook boot (same arch, same card, ideally same mmproj): `non_kv = boot_used − rate × boot_pool`, then swap weights/mmproj/drafter/ubatch-rung deltas.
+- **Publisher**: their published benchmark/server reports (e.g. a `community-benchmarks/<card>.md` or `KV-CACHE.md`) carry peak `nvidia-smi` and a steady-state figure for a named argv — back out their overhead = steady − weights − KV(× their pool) − mmproj. Divergence between the two anchors IS your uncertainty band; report both ends.
+Card/vendor peak-VRAM at bench context also calibrates compute buffers at small ubatch; the fleet's ubatch-rung costs (≈0.3 GiB @1024, ≈0.75 GiB @2048 on a 27B) cover the rest.
+
+Card ceiling from settled boots (`used + free`, e.g. 24,125 MiB on the 3090), not the spec sheet. An mmproj bills ~1.5× its file size. Keep ≥1 GiB headroom when ranking arms; tightest proven fleet fit is 489 MiB.
+
+## 4. Gates beyond VRAM
+
+- **Target window > `context_length`** ⇒ YaRN required (`--rope-scale = target/native`); quality at >1.2–1.5× on aggressive quants is unmeasured — say so.
+- **Pool divides across slots**: `n_ctx_slot = CTX_SIZE / PARALLEL`; the per-slot number is the harness contract, and the endpoint's role (e.g. compaction hub needing ≥170k) picks the geometry.
+- **Fork/custom-quant lock-in checklist** (answer all, cite ids):
+  1. which fork/branch, and does the pinned release tag contain the needed fixes — `GET /compare/<tag>...prism` and read `ahead_by` + commit subjects (a tag 5 commits behind contains everything merged earlier);
+  2. host CPU traps (e.g. AVX-512 load segfaults crash even with all layers GPU-offloaded);
+  3. **does the release workflow pass the build flags the contract needs** — grep the release workflow's cmake args: prebuilts often omit `GGML_CUDA_FA_ALL_QUANTS`, and without it mismatched/unsupported K/V types silently run flash attention on the CPU;
+  4. drafter availability (in-file `nextn`, a paired drafter, or nothing) — no drafter means the decode regression is unfixable;
+  5. pack choice per architecture (the vendor's throughput table is generation-specific; a community report on the same GPU family outranks it);
+  6. behavior/role risk: base model censorship posture, `tool_calls` defects, `reasoning_effort` template gate, prompt-cache `--cache-ram` vs host RAM actually available.
+- Vision: needs `--mmproj`; probe with ≥256 px solid color; only the OpenAI `image_url` content part reaches the model.
+
+## 5. Output
+
+Table of arms (pack × KV dtype × slot geometry) → KV MiB, total, free vs ceiling, FITS/FITS-tight/NO FIT, with the uncertainty band; then the gate list. State every `[INFERENCE]`/estimate. The boot ledger (verbosity 4), not the arithmetic, is the referee; benching requires stop+mask per fleet policy.
@@ -0,0 +1,105 @@
+---
+name: gitea-api-pr-operations
+description: "Open, list, merge, and verify pull requests (and diagnose issue-API scope failures) on the Dankclaw Gitea via its REST API from a workstation, keeping the token out of argv (curl -K config file, mode 600) — includes the credential-store extraction one-liner, the merge endpoint's Do-field law and Content-Type-header trap, the suggested-URL-is-not-a-PR gotcha, and the insufficient-token-scope trap."
+---
+
+# Gitea API PR operations (Dankclaw)
+
+`git push` on this fleet prints `Create a new pull request for ...` — that is a
+**suggestion, not a PR**. Verify (`GET /pulls?state=open` → expect `[]`) before
+claiming a PR "should exist"; create it via the API when asked.
+
+## Endpoint + auth
+- API base: `http://192.168.0.143:3000/api/v1/repos/dank/<repo>`
+- Token lives in the git credential store configured by
+  `git config --get credential.helper` → `store --file ~/.config/secrets/gitea`,
+  line format `http://user:TOKEN@192.168.0.143:3000`.
+- The repo-local `.env` `GITEA_TOKEN` (main checkout, gitignored) carries
+  **`read:issue` too** (measured 2026-10-18): filing issues needs THAT token,
+  the credential-store one 403s on issues.
+
+Extract the token (the `http://` scheme contains a colon — scheme-stripping
+awk regexes silently grab the port instead; use this anchored sed):
+
+```bash
+tok=$(sed -nE 's#^http://[^:/@]+:([^@]+)@192\.168\.0\.143.*#\1#p' ~/.config/secrets/gitea | head -1)
+[ -n "$tok" ] && echo "token-extracted(len=${#tok})"   # length check, never echo the value
+```
+
+## Keep the token out of argv (repo secret law)
+`curl -H "Authorization: token $tok"` is world-readable in `/proc/<pid>/cmdline`.
+Use a mode-600 config file:
+
+```bash
+cfg=$(mktemp); chmod 600 "$cfg"
+printf 'header = "Authorization: token %s"\n' "$tok" > "$cfg"
+```
+
+- POST JSON needs a second header line: `header = "Content-Type: application/json"`.
+  There IS NO `content-type` config option — curl rejects the file.
+- `rm -f "$cfg"` when done (a mode-600 token file left in /tmp is its own leak).
+
+## Operations
+```bash
+# list open PRs
+curl -sS -K "$cfg" ".../pulls?state=open" | jq -r '.[] | [.number,.head.name,.base.name,.title] | @tsv'
+# create (build the payload as a FILE, see below)
+curl -sS -K "$cfg" -o /tmp/pr.json -w '%{http_code}\n' -X POST -d @/tmp/pr-payload.json ".../pulls"
+# verify: 201 is not enough — check mergeable
+curl -sS -K "$cfg" ".../pulls/1" | jq '{number,state,merged,mergeable,base:.base.ref,head:.head.ref,url:.html_url}'
+```
+
+## Merging: the field is `Do`, and it is a STRING naming the strategy
+
+Measured 2026-10-18 on Gitea at 192.168.0.143:3000 (`POST .../pulls/<n>/merge`).
+`MergePullRequestOption` is `{From, To, When, Do}` — **there is no `DoMerge` and
+no `merge_method`**. Every wrong shape is a 422 with a distinct message, so read it:
+
+|body sent|http|message|
+|---|---|---|
+|`{"DoMerge":true,"merge_method":"merge"}`|422|`[Do]: Required`|
+|`{"Do":true,"merge_method":"merge"}`|422|`[]: json: cannot unmarshal JSON boolean into Go string within "/Do"`|
+|`{"Do":"true"}`|422|`[Do]: In…` (validation: not a strategy name)|
+|form body `Do=true&merge_method=merge`|422|`[Do]: Required` (the value must be a strategy name)|
+|`{"Do":"merge"}`|**200**|merged|
+
+```bash
+curl -sS -K "$cfg" -H 'Content-Type: application/json' -X POST -d '{"Do":"merge"}' ".../pulls/4/merge"
+# then prove it: .merged true, .state closed, .merge_commit_sha set, and origin/main moved
+curl -sS ".../pulls/4" | jq -c '{number,state,merged,merge_commit_sha}'
+```
+
+Strategy names: `merge`, `rebase`, `rebase-merge`, `squash`, `manually` — a
+strategy the repo does not allow is rejected too.
+
+**Merge trap (measured 2026-10-18):** on `POST /merge` the `Content-Type` header
+must go on the **command line** (`-H 'Content-Type: application/json'`). Same
+curl that succeeds on `POST /pulls` with Content-Type supplied only via the `-K`
+config file returns **405 with an EMPTY body** on `/merge`. A 405 there is this
+trap (or a base-moved mergeability recheck — GET the PR, see `mergeable:true`,
+then retry with `-H`), NOT a permission problem.
+
+## Building issue/PR bodies without quote carnage
+Hand-written `jq -n --arg t "..." '{title:$t, body:"..."}'` one-liners with long
+markdown bodies WILL break on a stray quote (and the broken quoting can swallow
+the following commands). Build bodies as files (heredoc or write tool), then:
+```bash
+b=$(jq -Rs . body.md)
+jq -n --arg t "$title" --argjson b "$b" '{title:$t, body:$b, head:"<branch>", base:"main"}' > payload.json
+curl ... -d @payload.json
+```
+
+## Gotchas measured 2026-10-14 / 2026-10-17 / 2026-10-18
+- Unauthenticated/bad token → HTTP 401 body `{"message":"not found"}`; `jq '.[]|[.number,..]'` then fails with *cannot index "not found"* — that is an auth failure, not a missing repo.
+- **Insufficient token scope ≠ missing data.** The credential-store token
+  (measured 2026-10-17) carries only `write:repository,write:user`; the issues
+  API answers HTTP 403 `{"message":"token does not have at least one of required
+  scope(s), required=[read:issue], token scope=write:repository,write:user"}`.
+  jq surfaces that JSON as the *cannot index* error — do NOT conclude the issue
+  list is empty, and note POSTs under this token create NOTHING (verify, don't
+  assume retry safety). Filing issues needs a fresh token minted in the Gitea
+  web UI with `read:issue`+`write:issue` (Frank-class credential action; ask) —
+  OR use the main-checkout `.env` `GITEA_TOKEN`, which already has issue scope.
+  PR endpoints work fine with either token (`pulls` POST/GET/merge all 200/201).
+- On the created-PR response `.head.name` can be null; verify with the `GET /pulls/<n>` and use `.head.ref`.
+- **Swagger JSON is disabled on this instance** — `/api/swagger.v1.json`, `/api/swagger.json` and `/api/v1/swagger.json` all 404. Do not go looking for the schema there; the 422 messages name the field and its Go type, which is the faster instrument.
@@ -0,0 +1,23 @@
+---
+name: gitflow-back-merge-plumbing
+description: "(HISTORICAL for dank/command-center — switched to trunk-based 2026-10-18, no develop branch.) Back-merge main into develop with pure git plumbing when branch checkout is policy-blocked; avoids the polluted-base evil-merge trap."
+---
+
+# Git-flow back-merge via plumbing (checkout blocked)
+
+## Applicability
+The command-center repo retired `develop` on 2026-10-18 (trunk-based; see its AGENTS.md § Trunk-based SDLC). Use this only in repos still running git-flow where a `main -> develop` back-merge must land and branch checkout is forbidden. Never merge while HEAD is a session branch — the merge silently lands on it.
+
+## Procedure
+1. `git fetch origin` and verify with `git ls-remote --heads`.
+2. Find the CLEAN fork point: `mb=$(git merge-base origin/develop origin/main)`. NEVER build the merge commit with a develop-side that already contains main (e.g. a previous broken merge): merge-base then equals main, main-side looks "unchanged", and stale develop content wins everywhere — a clean rc=0 evil merge. Sanity-trigger: if a merge you expect to conflict resolves rc=0, suspect the base.
+3. Real merge, no worktree: `out=$(git merge-tree --write-tree <clean-dev-tip> origin/main); rc=$?; tree=$(echo "$out"|head -1)`. rc=1 = conflicts; list them from the "Conflicted file info" section (lines starting with a 6-digit mode), NOT from `ls-files -u` in some other worktree.
+4. Resolve in index only: `export GIT_INDEX_FILE=/tmp/idx.$$; git read-tree $tree; git update-index --add --cacheinfo 100644,$(git rev-parse origin/main:<path>),<path>` per conflicted path (pick a side deliberately — say which in the message).
+5. `final=$(git write-tree)`; prove no markers: `git grep -l '^<<<<<<<' "$final"` must be empty (run it correctly — an empty count from a malformed invocation hides markers).
+6. `commit=$(git commit-tree "$final" -p <clean-dev-tip> -p origin/main -m "...")`; `git push --force-with-lease=develop:<current-dev-tip> origin "$commit:develop"` (lease prevents clobbering concurrent pushes; document superseded commits). A back-merge onto an untouched develop is additive — plain push, no lease needed.
+7. Verify ALL of: `git merge-base --is-ancestor origin/main origin/develop`; grep a distinctive merged value in `origin/develop:<file>` (content, not just ancestry); `git diff --stat origin/main origin/develop` matches expectations.
+
+## Traps
+- `merge-tree` writes conflict markers INTO the tree for conflicted paths — always overwrite every conflicted path before commit-tree.
+- A wrong tree pushed as a merge commit makes every later merge against it resolve "cleanly" to stale content; fix by rebuilding from the clean fork point and force-with-lease, citing the broken commits in the message.
+- Gitea PR merge API needs `Content-Type: application/json` AND `{"Do":"merge"}` in the BODY (query param alone 422s); a 405 "Please try again later" right after the base branch moved is transient mergeability recomputation — wait a few seconds and retry.
@@ -0,0 +1,62 @@
+---
+name: gluetun-dependent-boot-race-recovery
+description: "Diagnose the Dankclaw pattern where gluetun is active but its netns-sharing dependents (searxng, marreta, marreta-browser) are inactive (dead) with \"Dependency failed\" after a reboot — cascade-recover them and tie it to e2e 502/SSO failures."
+---
+
+# Gluetun boot-race: netns dependents dead at boot, service is active
+
+## Signature
+After a dankclaw reboot, `gluetun.service` is ACTIVE, yet e2e fails on
+`search.franksdank.cloud` (502 on the authenticated pass), the Marreta tile
+shows a blank interstitial, and the homepage crawl reports vhost resets.
+`systemctl --user status <dep> --no-pager` shows:
+
+```
+Active: inactive (dead)
+<host> systemd[2224]: Dependency failed for <dep>.service
+<host> systemd[2224]: <dep>.service: Job ... failed with result 'dependency'
+```
+
+## Cause
+Quadlet `Network=gluetun.container` emits `Requires=`/`After=` on
+`gluetun.service`. When gluetun's start job fails once transiently at boot
+and `Restart=` re-arms it seconds later, the dependents' start jobs are
+already consumed and are NEVER re-armed — they sit `inactive (dead)`
+indefinitely while gluetun runs. `Restart=always` on the dependent does not
+help: the service never ran, so the restart policy never armed.
+
+## Diagnosis census (rootless, run as `dank`, NO sudo)
+```
+export XDG_RUNTIME_DIR=/run/user/$(id -u)
+uptime   # reboot is the trigger
+systemctl --user is-active gluetun searxng searxng-valkey marreta marreta-browser
+systemctl --user status <dep> --no-pager | head  # "Dependency failed" line
+journalctl --user --since "<boot>" | grep -iE "<dep>|dependency"
+```
+Dependents of the gluetun netns on dankclaw: `searxng`, `marreta`,
+`marreta-browser` (valkey is plain-networked and survives).
+
+## Recovery (order matters: browser before marreta)
+```
+systemctl --user start marreta-browser marreta
+systemctl --user start searxng
+```
+Verify: `podman ps` shows them; `curl http://127.0.0.1:8081/healthz` (searxng)
+and gluetun-published 8082 (marreta) answer; then rerun the Playwright gate
+(`tests/e2e/run.sh`) — the 12-crawl / 13-sso / 16-marreta specs are the trip
+wires for this fault.
+
+## Distinguish from the dead-pause-process failure
+The 2026-09-16 rootless-pause-process death breaks ALL podman commands and
+every quadlet loops; this fault leaves podman fully functional and only the
+gluetun-dependency chain is dead. The reboot repairs the former; manual
+cascade-start repairs this one.
+
+## Open gap (dankclaw, as of 2026-10-15)
+The race recurred (observed 2026-10-15 boot 01:41). Quadlet law for these
+units has no cure inside the `.container` files themselves; options are a
+systemd user-level drop-in on gluetun
+(`ExecStartPost=/usr/bin/systemctl --user restart searxng marreta`) or
+converting the dependents' dependency to `BindsTo` + `StartLimit` retry
+semantics. Fleet precedent for boot-order pain: searxng/gluetun ordering,
+observability reboot gaps (AGENTS.md).
@@ -0,0 +1,14 @@
+---
+name: halogen-ctx-pool-resize
+description: "Resize a halogen flash-server endpoint's context/KV pool (frank-dragoon pattern): engine knobs, seam band, RAM ledger, re-key sweep, deploy + probe."
+---
+
+Two knobs: HALOGEN_CTX (hard per-request ceiling; longer prompt = 400 naming the limit, never truncation) and HALOGEN_KV_POOL_POSITIONS (ONE pool shared behind HALOGEN_KV_SLOTS). Ceiling raises buy a longer conversation; pool raises buy concurrency.
+
+Laws: native window 262,144, beyond it needs HALOGEN_ROPE_YARN (engine 400 text) so never extrapolate for sizing; seam band ctx <= pool <= slots*ctx (pool == slots*ctx => two maximum-length requests coexist, pool == ctx => one fills it); harness contextWindow = ceiling - 45056 (clamp max_tokens = min(maxTokens, window-est-4096), compaction at 85 %, chars/4 under-counts ~3 %) and pool-only changes do NOT move it; ~28 KiB/position measured (200,704 -> 5.5 GiB, 262,144 -> 7.2, 524,288 -> 14.6), quote the ledger reservation not the preflight formula (block scratch + ~115 MiB/slot); the 51.2 GB n-gram table is mmap page cache (Pin::None) so RAM the pool takes is RAM that table loses, re-measure the warm prompt-cache ratio (136x baseline) after a raise; engine ledger vs 121.2 GiB = weights 62.9 + KV + working (3.8 + 8.4*MAX_TOK/16384) + prompt cache + HALOGEN_HOST_RESERVE_GIB=20 + co-tenancy ~10-15.
+
+Procedure: read scripts/frank-dragoon.env and the boot ledger in /home/dank/logs/frank_dragoon.log (not the journal; a printed clamp is the referee); candidate boot via a transient FRANK_DRAGOON_ENV_FILE drop-in sourcing the repo env (never a scratch port), then trash it and prove DropInPaths empty or the repo env silently does not govern; edit env assignment + SHAPE lore and the unit Description; update the seam good_env fixture, -e pass-through asserts and pool-law comment without loosening the band; re-key every quote (deploy-remote.sh service comment, AGENTS.md topology row/engine laws/memory ledger/runbook index, docs index and LLM/index prose and mermaid node text, endpoint runbook shape paragraph plus a dated section, forward pointers in other vault pages, ~/.omp/agent/models.yml comment and contextWindow only if the ceiling moved, live OpenWebUI row in webui.db after backup); ./tests/run.sh; commit explicit paths never -A (subagents share the tree); ./scripts/deploy.sh dankclaw --service frank-dragoon (bare target = fleet drain); verify the new boot ledger and append the ledger table to the runbook plus a log.md worklog entry.
+
+Probes: over-ceiling request -> 400 naming the ceiling in <1 s (preflight rejects before prefill); ~120k admission at max_tokens 45056 accepted, wall time = cold prefill ~1,500 t/s; two maximum-length admissions fired together must BOTH be admitted once pool >= 2*ctx; never report the first request after a boot.
+
+Traps: systemctl mask fails on relinked units, disable forbidden; reservation is prompt + max_tokens so an over-budget request fails preflight even with a free pool; HALOGEN_FLASH_PIN_TRUNK=0 rejected by the v2 loader; rollback = revert the commit and redeploy.
@@ -0,0 +1,48 @@
+---
+name: halogen-npu-feasibility-census
+description: "Census whether halogen-flash-server's NPU small-model path can run on a Strix Halo host: image gate, amdxdna/XRT presence, IOMMU and fabric-clock blockers, enablement deltas."
+---
+
+Use when asked whether halogen/halogen-flash-server can use the XDNA2 NPU (embeddings, rerank, moderation/guard, decider, `qwen3.5-2b` generation, `flux2-klein-4b` images, `qwen3-asr-*`) on a Ryzen AI Max / Strix Halo host, or before proposing to enable it.
+
+## What the feature is (not a speed knob)
+
+The Flash trunk stays on the iGPU. `HALOGEN_NPU_MODELS=<names>` starts a second engine in the SAME container and on the SAME API port; the request's `model` field picks the executor. Unset → server identical to before. Each NPU model is a precompiled AIE-ML program (`devices/devices.hnpm`, per-partition `devices/u<N>.elf`, `devices/consts.hnpb`, `<id>.hnpw` weights, `tokenizer/tokenizer.json`), loaded via the HOST's XRT → kernel `amdxdna` → `/dev/accel/accel0`. One pass at a time; `HALOGEN_NPU_QUEUE` 64, overflow queues server-side, then `503 engine_busy`. Entry `entrypoint.sh` validates every file's bytes + sha256 against `/opt/halogen/npu/models.txt` before anything starts. NPU models run only in single-container "all" mode, NOT the `engine`/`api` split.
+
+## Census (all read-only, run from the operator box)
+
+```bash
+ssh <host> '
+# 1. engine gate + catalog in the pinned image
+podman exec <ctr> bash -c "grep -rlo HALOGEN_NPU_MODELS /opt/halogen /usr/local/bin /entrypoint.sh 2>/dev/null | head"
+podman exec <ctr> cat /opt/halogen/npu/models.txt | head -40
+# 2. is NPU actually wired today? (expect NO env, NO device, NO /dev/accel inside)
+podman inspect <ctr> --format "{{json .HostConfig.Devices}}"; podman exec <ctr> ls /dev/accel
+# 3. kernel driver + firmware
+lsmod | grep -i amdxdna; sudo dmesg | grep -iE "xdna|npu" | tail -5; ls -l /dev/accel
+# 4. XRT (distro packages are fine; vendor mounts /opt/xilinx/xrt)
+dpkg -l | grep -iE "xrt|xdna"; ls /usr/lib/x86_64-linux-gnu/libxrt* /usr/lib/libxrt* 2>/dev/null
+# 5. BLOCKER 1: IOMMU
+cat /proc/cmdline; ls /sys/kernel/iommu_groups | wc -l
+# 6. BLOCKER 2: fabric clock held?
+for c in /sys/class/drm/card*/device; do echo "== $c"; cat $c/power_dpm_force_performance_level 2>&1; cat $c/pp_dpm_fclk 2>&1 | tr "\n" " "; echo; done'
+```
+
+Docs (raw fetch, authoritative): `docs/NPU.md`, `docs/npu-small-models.md`, `deploy/host/halogen-fabric-clock` under `peonist-ai/halogen-flash-server` on GitHub. Tag list: `podman search --list-tags ghcr.io/peonist-ai/halogen-flash-server`.
+
+## The two blockers and the enablement delta
+
+- **IOMMU must be on.** `amd_iommu=off` turns the NPU off (no PASID/SVA); `iommu=pt` keeps it. Needs a grub edit + reboot. `iommu_groups == 0` ⇒ off.
+- **Fabric clock must be pinned at the top `pp_dpm_fclk` level** (or `power_dpm_force_performance_level=high`); `auto` = unheld. GPU+NPU concurrently HANG Strix Halo machines and corrupt NPU results while that clock moves. Fix: root container with `-v /sys:/host/sys` (server holds it itself), or install `deploy/host/halogen-fabric-clock` + unit (~1 W). If it can't hold, the server FAILS CLOSED and prints the commands.
+- Container delta: `--device /dev/accel/accel0` + `HALOGEN_NPU_MODELS`; `--ulimit memlock=-1:-1` and `--group-add keep-groups` usually already present. Distro XRT: mount each of `libxrt_coreutil.so.2`, `libxrt_core.so.2`, `libxrt_driver_xdna.so.2` TWICE (once at `/opt/xilinx/xrt/lib/`, once at its own path) — never mount an `/opt/xilinx/xrt` holding only symlinks.
+
+## Costs to price before proposing
+
+- Upstream A/B: IOMMU translation ON costs **13–16 % prefill** (460 → 385 tok/s at 2,048 tokens, Ryzen AI Max+ 395); decode unaffected. Whether `iommu=pt` specifically costs that on a given box is a local measurement, not a published fact — run the image's own `sweep` after the reboot.
+- A few GB host RAM per NPU model (+8 GB FLUX, +1.6/4 GB ASR), and trunk decode drops while the NPU works (shared bus + power).
+
+## Laws / traps
+
+- Never probe the NPU beside the live service: stop + mask first (fleet benchmarking policy); this host class has a precedent of a concurrent GPU experiment needing a power cycle. Distinguish off vs wedged with `ip neigh show <ip>` from a peer.
+- `/dev/accel/accel0` existing and `amdxdna` probing cleanly does NOT mean the NPU works — with IOMMU off the failure is at context/PASID creation, not at the device node. Do not trust older notes claiming the node itself is missing.
+- `dmesg` lines like `Failed to alloc dev bo memory, ret -28` while large NPU models take turns at NPU memory are benign (vendor-documented); the server recovers.
@@ -0,0 +1,48 @@
+---
+name: html-report-ground-truth-audit
+description: "Audit a self-generated HTML report: ground every numeric/code/diagram claim against the repo, fix, and prove structure + render"
+---
+
+Use after generating a large HTML report (e.g. via `repo-change-html-report`) whose claims were partly reconstructed from session memory. Fabricated numbers, invented code blocks, and silently-swallowed sections are the failure modes; the audit makes each traceable to the repo, a live command, or a recorded run.
+
+## Procedure
+
+### 1. Enumerate every checkable claim
+Grep the report for numerics, file paths, symbol names, and code blocks:
+- line counts (`wc -l` the real file)
+- test counts (`grep -c '@test' tests/<f>.bats` — NOT suite-run totals: conditional skips make raw counts differ; run-observed totals are legitimate run history, keep them labeled as such)
+- diff stats (`git diff --shortstat main..HEAD` — the footer's files/insertions/deletions)
+- commit hashes (`git log --oneline`)
+- "verbatim" code blocks (see 3)
+- diagram node lists and captions (see 4)
+
+### 2. Ground numeric claims with one command each
+Fix every mismatch in place. Record the was/now pair — the audit table IS the evidence.
+
+### 3. Verbatim code blocks: prove them
+For a block labeled verbatim, the exact string must exist:
+- live code: `grep -n '<distinctive line>' <file>`
+- historical: `git show <sha> -- <file> | grep -E '^[+-].*(<token1>|<token2>)'`
+If the block was fabricated (plausible-looking pseudo-code), replace it with the real excerpt. If condensed, the block header must say "condensed" and every shown line must be real.
+
+### 4. Diagram claims: run the engine
+Behavioral diagrams (plan traces, closure graphs) must be re-derived by running the actual CLI:
+`python3 scripts/service-map.py plan --host <h> <path>` — then edit node labels, captions, and the prose count ("four services") to match output. Cross-check derived-set diagrams against the source relation (e.g. `grep -rl 'Network=gluetun.container' */**/*.container` for who rides a tunnel).
+
+### 5. Check for swallowed sections
+Large prior-session PUT ranges silently overwrite neighbors. Grep for headings/captions the plan promised; re-insert any that vanished, anchored on a fresh `read` of the region.
+
+### 6. Structural balance
+Python tag-balance pass over the file:
+- per-tag open/close counts (`div`, `pre`, `figure`, `svg`, `table`, `span`, `figcaption`)
+- running-div-depth scan printing per-section balance to localize stray closers
+Common defect: `.ln`/`.nt` pair emitted without its `.cg` wrapper → stray `</div>`; fix by opening `<div class="cg">` before the pair.
+
+### 7. Render proof
+`file://` is blocked on the shared browser — serve the dir: `bash` service `python3 -m http.server <port> --bind 127.0.0.1 --directory <dir>`, ready on that port. Then:
+- `browser.open({name, url: 'http://127.0.0.1:<port>/<file>'})`
+- DOM assertions via `tab.evaluate(() => …)` — NOT `tab.run` (that runs in Bun; no `document`). Sections are `<h2 id>` + siblings: scope queries to `document.body`/`document.querySelectorAll`, not `#ch5 …`.
+- screenshot the repaired regions (scroll via `tab.evaluate(el.scrollIntoView())`), then `tab.close()` and kill the server proc (`write proc://<name>/kill`).
+
+## Deliver
+A was/now table of every fix with its ground command, plus the list of claims verified intact. State honestly which numbers are run-history and not recomputable.
@@ -0,0 +1,26 @@
+---
+name: judge-empty-content-parse-repair
+description: "Diagnose and repair LLM-judge \"unparseable verdict\" storms: judge-fail rows store no raw → reproduce live on the failing instance; root causes include empty model response (runaway reasoning chains, finish=length + content:\"\") and judge prose-form verdicts when JSON scaffold breaks; fix parser fallback + prove via restart rejudge."
+---
+
+Use when LLM-judge grades show an elevated "unparseable verdict" rate (baseline ~1%; storm = ≥5-10%).
+
+## Law
+Judge rows with `ok:false` store NO raw judge output (meta empty) — you are blind in the ledger. NEVER guess the cause from the ledger alone; reproduce the exact failing instance live.
+
+## Procedure
+1. **Census the rate**: filter ledger grade rows since a timestamp; rate = bad/total. Compare against the eval's baseline (≈1%). HLE with a 180B bare-JSON judge showed 11.8%.
+2. **Pull the failing instance**: pick the newest failing grade row; get its `instance` id and the latest `gen` row for that instance (latest-wins; ledger is append-only).
+3. **Reproduce live**: one-shot `bun -` (or equivalent) script: load registry host by judge name, call the judge function with that instance's exact question/answer/response, print `raw` head+tail. Judge raw text is ground truth.
+4. **Root-cause A — empty model response**: if `resp_len: 0`, the judge is fine; the MODEL produced no answer content. Census gens: `text` empty + `finish=length` + `completion_tokens == max_tokens` ⇒ **runaway reasoning chain**: the model wrote the whole budget into `reasoning` and never emitted `content`. Loop proof: 60-char block Counter over the reasoning tail (49 identical blocks = degeneration, e.g. `w4 w? w4 w?…`).
+5. **Root-cause B — prose verdict**: judges (esp. bare-JSON 180B class) drop the JSON scaffold when judging degenerate inputs (empty response) and emit plain `correct: no\nconfidence: 100`. Parser knowing only quoted `"correct": "no"` forms reports null = "unparseable" while the verdict is perfectly valid. Fix = add prose fallback regex `(?:^|\n)\s*correct\s*:\s*(yes|no)\b` after the JSON/quoted attempts, never before (JSON must win).
+6. **Baseline comparison before blaming the engine change**: for any model-behavior rate (runaway %, empty-answer %), census the previous (voided/`.AGENTTRASH/`) ledger the same way. Pre/post identical (18.5% vs 18.0%) ⇒ pre-existing model behavior, not the quantization/config under investigation. This keeps causal claims honest.
+7. **Verify the fix live**: restart the supervisor (poison law); pending `ok:false` grade rows re-grade on resume — the previously-blind rows flipping to real `fail` verdicts in the log is the proof.
+
+## Empty-content scoring law
+Runaway-chain empties score 0 honestly (AA-style truncating harness). Keep the score, publish the runaway census beside every number. Sampling changes (repetition_penalty, num_predict cap) deviate from AA posture and void+restart the eval — user decision, not an assistant fix.
+
+## Pitfalls
+- `podman logs 2>/dev/null`-style stderr discards make failure rows text-empty — check the capture path before inventing model-side causes (sandbox.ts fixed to `2>&1`).
+- `export RID=...` for python heredocs (plain `RID=` is invisible to `os.environ`).
+- Never `cd x && setsid ... & disown` expecting the cd to persist: `&` backgrounds the whole compound; foreground cwd is unchanged.
@@ -0,0 +1,62 @@
+---
+name: kernel-flag-claim-audit
+description: "Audit a kernel/boot-parameter performance claim before it justifies a host decision (census feature presence, read the patch series verbatim, then publish the corrected plan to a Gitea issue without leaking the token)."
+---
+
+Use when a decision rests on a kernel/boot-line performance claim (`iommu=off` vs `pt`, a module param, a new engine flag) and the question is "does an upstream change retire this trade?", or when the answer must land as a Gitea issue comment.
+
+## 1. Census before theory (read-only, no reboot)
+
+```bash
+uname -r; cat /proc/cmdline
+grep -c . /dev/null; ls /sys/kernel/iommu_groups | wc -l        # or the relevant sysfs knob
+nm -b /boot/System.map-$(uname -r) 2>/dev/null | grep -i <feature_symbol> | head
+apt-cache policy <meta-packages>                                  # what the distro can actually install
+grep -E 'CONFIG_(...)' /boot/config-$(uname -r)
+ls -l /dev/<device>; id -nG                                      # container-access question
+```
+
+- Symbol absence in `System.map` + archive pinning = the claim is **not actionable today**, regardless of merge status. Say that plainly.
+- Answer the container/device question from node mode + group membership; it never needs a reboot.
+
+## 2. Primary source beats press
+
+Read the **patch series itself** (cover letter + the implementation patch), not the news write-up. The press number is a symptom; the patch text carries the *preconditions* that decide applicability.
+
+Rules that only surface in the patch text (2026-10-18 AMD PerfOpt case):
+- enable path "rehomes devices **already on the identity domain**" → the feature is a companion to `iommu=pt`, never an alternative;
+- the enable path *disables* ATS/PRI/PASID/GCR3 (`skip_caps` in `attach_device`) → identity mode still pays a 1:1 page walk until this arms; a passthrough boot is therefore "most of the fix", not all of it;
+- a per-IOMMU bit is refcounted / re-armed on resume → matters for suspend users.
+
+Also check the driver-side consumer's gate condition (e.g. `amdgpu_device_use_perfopt()` requires `AMD_IS_APU` **and** the identity domain) — the feature and the endpoint you care about can live on independent paths (amdxdna binds its own SVA domain regardless of default domain type), which is what decouples "perf lever" from "device works again".
+
+Never inherit a vendor/press delta as a local cost: record it as *vendor-claimed, never measured here*, and make the procedure demand a local A/B in the maintenance window. Flag stale baselines by quoting the current measured figure.
+
+## 3. Correct every carrier, in one cutover
+
+Decision-record page (new dated section + front-matter `description` re-key), the retired-endpoint runbook that carries the now-dead law, `AGENTS.md` key-lesson bullet, worklog. Delete the dead law rather than annotating it.
+
+## 4. Publish to Gitea without leaking the token
+
+Token NEVER in argv (`curl -H "Authorization: …"` is world-readable in `/proc/<pid>/cmdline`). Reuse the git credential store, write a 0600 curl config, delete it after:
+
+```python
+line = next(l for l in (~/.config/secrets/gitea).read_text().splitlines() if HOST in line)
+user, tok = urllib.parse.unquote(...)      # store file is percent-encoded
+cfg = 0o600 temp:  user = "USER:TOKEN"
+subprocess.run(["curl","-sS","-K",cfg,"-o",resp,"-w","%{http_code}", ...])
+os.unlink(cfg)
+```
+
+- New comment: `POST /api/v1/repos/{o}/{r}/issues/{n}/comments`, body `{"body": markdown}` → 201.
+- **Correction: `PATCH /api/v1/repos/{o}/{r}/issues/comments/{id}` — edit in place, do NOT post a follow-up.** A wrong claim published is fixed by editing it; leaving the wrong text up for future readers is the failure mode.
+- Verify: anonymous `GET .../issues/{n}/comments` then assert the corrected marker is present AND the retracted phrase is absent.
+
+## 5. Verification
+
+`./tests/run.sh` (docs completeness + vault link integrity cover the doc edits), commit, push. Secrets scratch files: unlink them; do not leave a token-bearing temp behind.
+
+## Gotchas
+
+- Markdown bullet lines inserted through the `edit` tool: an escape like `+- item` came out **verbatim** (file kept `+- `), twice. When a list block must be rewritten, `write` the whole file instead of guessing escape syntax.
+- A reader-mode `read` of a news page can return the ad-blocker JS blob; use the mailing-list/patch archive (native method) for primary sources.
@@ -0,0 +1,27 @@
+---
+name: key-chord-source-audit
+description: "Answer \"what does chord X do\" on Dank workstations: identify which layer (omp TUI, browser tool, niri, terminal) owns the chord before answering"
+---
+
+# Key-chord source audit
+
+Frank asks "what does mod+r / ctrl+X do?" — the chord lives in ONE layer of the stack; answering from the wrong layer is wrong. Check layers in order, in ONE pass.
+
+## Layers, in Frank's stack (most of his "mod" questions are niri)
+
+1. **niri compositor** (Mod = Super). Keybinds are NOT in `~/.config/niri/config.kdl` — it only `include`s `cfg/*.kdl`. Grep `~/.config/niri/cfg/keybinds.kdl` directly. Notation: `Mod+R`, `Mod+CTRL+Alt+H`. Preset-width cycle (Mod+R) uses `preset-column-widths` from `cfg/rules.kdl`; no rule → built-in proportions 3/4, 1/3, 1/2, 2/3, 9/10, 1.
+2. **omp TUI**: defaults in `~/.bun/install/global/node_modules/@oh-my-pi/pi-coding-agent/dist/cli.js` — grep `defaultKeys:\["…"` (array form) and `defaultKeys:"…"` (string form; needs a second pattern). Recognized modifiers: ctrl/shift/alt/super only; no `meta`/`mod` alias. User remaps: `~/.omp/agent/keybindings.yml` (check existence first; absent = no remaps). Docs: `omp://keybindings.md`.
+3. **omp browser tool**: `Mod+Key` is Playwright notation (`Mod` → Ctrl on Linux, Cmd on macOS), used by `tab.press()`; e.g. `Mod+R` = page reload. Tern backend `ternKey()` throws on literal `Mod`; puppeteer path passes names through.
+4. **Terminals/tmux**: `~/.config/ghostty/config.ghostty` + `ghostty/auto/`, `foot.ini`, `kitty.conf`, `~/.tmux.conf` — keybind/bind/map lines.
+
+## Procedure
+
+1. Classify the notation the user used: `Mod+…` → niri/Playwright; `Ctrl+…` → TUI/terminal; tmux prefix → tmux.
+2. Grep that layer's config FIRST, expanding includes (config.kdl → cfg/*.kdl is the trap that caused a wrong answer).
+3. For omp bundle greps: two `defaultKeys` forms exist; `super+r` pattern also matches `super+right` — anchor with word boundary.
+4. Quote the exact config line as evidence; state the layer that owns the chord.
+
+## Verification
+
+- niri keybinds: `grep -n "Mod+R" ~/.config/niri/cfg/keybinds.kdl` (not config.kdl).
+- omp: `grep -o '"app[^"]*":{defaultKeys:[^}]*' cli.js` for app actions; `grep -rn "defaultKeys" pi-tui/src/keybindings.ts` for editor actions.
@@ -0,0 +1,47 @@
+---
+name: llamacpp-candidate-arm-census
+description: "Measure a candidate GGUF/KV-shape on a live dank-fleet llama.cpp endpoint (frank-zealot pattern) in ONE service-stop window: pre-flight flag check, per-arm env overrides, boot ledger + nvidia-smi census, behavior probes, trap-guarded restore."
+---
+
+Measure candidate shapes on a production llama.cpp endpoint without cutting anything over. One outage window, many arms, guaranteed restore.
+
+## 0. Pre-flight (no GPU needed — do all of it before stopping anything)
+
+- `ssh <host> <candidate-bin> --list-devices` — the candidate must see the card (backend `.so` releases resolve via `$ORIGIN`, so run from the extracted asset dir).
+- Flag-compat gate: loop the exact long options the serve script emits and grep the candidate's `--help`. A single unknown flag = a dead boot in the middle of the window. Remote shells may be **zsh**: `$flag[ ,<]` is parsed as an array subscript ("bad math expression") — pipe the check through `ssh <host> 'bash -s' <<'CHK' … CHK` and use `grep -qE "(^|[[:space:]])$f([[:space:],<]|$)"`.
+- Pause any concurrent compile (`pkill -f "[r]un-<build>"` — the bracket stops `pkill -f` matching your own command line; `pkill -x ninja`). Ninja is incremental: the build resumes where it stopped, and CPU contention otherwise skews every rate.
+
+## 1. Runner shape
+
+Write one script to `/tmp` on the target via `ssh <host> 'cat >/tmp/….sh' <<'EOF'`. Never edit the repo checkout on the target; drive the shipped serve script with a **per-arm env file** and `FRANK_<SVC>_ENV_FILE` (the serve scripts already honor it).
+
+```bash
+SRV=""
+used(){ nvidia-smi --query-gpu=memory.used --format=csv,noheader,nounits; }
+restore(){ [[ -n "$SRV" ]] && kill "$SRV" 2>/dev/null; pkill -x llama-server
+  for i in $(seq 1 90); do [[ "$(used)" -lt 1500 ]] && break; sleep 2; done
+  sudo systemctl start <svc>
+  for i in $(seq 1 150); do [[ "$(curl -s -o /dev/null -w %{http_code} http://127.0.0.1:<port>/health)" == 200 ]] && break; sleep 2; done
+  echo "RESTORE health=$(curl -s -o /dev/null -w %{http_code} …/health) used=$(used) state=$(systemctl is-active <svc>)"; }
+trap restore EXIT
+```
+
+- `trap restore EXIT` is mandatory, not polite: it also fires on the failure paths, so a script bug cannot leave the endpoint down.
+- Preserve the production log first (`cp -f /home/dank/logs/<svc>.log …prod-<ts>.log`) — the serve script truncates it.
+- Health-poll cap ~120×2 s. 300 polls turns an expected-allocation-failure arm (the "wall" arms) into 10 wasted minutes.
+- Arm = `sed` the base env (CTX_SIZE / PARALLEL / KV_CACHE_TYPE / LLAMA_BIN / LOG_FILE), boot with `setsid nohup env FRANK_<SVC>_ENV_FILE=… bash <serve-script>`, then capture: `nvidia-smi` used+free, ledger grep (`type |model size|n_ctx|flash|KV buffer|buffer size|slots|error|exceed`), `/slots` (per-slot `n_ctx` is the harness contract), `/v1/models`.
+- **Point LLAMA_BIN at a binary that exists.** Take 1 of this procedure died in 8 s because the trial env named a still-compiling source build; the trap saved the endpoint.
+
+## 2. Probes that actually discriminate
+
+- chat: `content` vs `reasoning_content` (channel differs per runtime) + `finish_reason`.
+- tools: real `tools` schema, assert `tool_calls[0].function.arguments` parses as JSON — empty/`null` arguments is a known fork bug.
+- vision: 512×512 **solid color** PNG built with `zlib`+`struct` (no PIL), sent as an OpenAI `image_url` content part; expect the exact color word. The legacy top-level `images` field hallucinates a plausible answer.
+- rate: `/completion` (not `/v1/chat/completions`) — it returns `timings` (prefill/decode). ≥128 tokens.
+- long-context fill: ~190k tokens through `/completion` proves the per-slot window AND tests the "quantized KV near 200K" stability reports.
+
+Skip `llama-bench` for shape work: it has no `-c`/`-np`, and its `-mmp` is `--mmap` (deprecated), not mmproj. Booting the server per arm measures the real shape and prints the ledger, which is the referee.
+
+## 3. Report
+
+Per arm: ledger KV-buffer MiB, used/free at settle, FITS / tight / NO FIT vs the card's `used+free` ceiling from settled boots (not the spec sheet). Then restore, and state the downtime.
@@ -1,28 +1,33 @@
 ---
 name: llamacpp-endpoint-model-swap
-description: "Swap the model on a dank-fleet llama.cpp endpoint (frank-secondary pattern): fetch, env edit, spec flags, deploy through git, rewrite the bats seam, verify VRAM with the engine's own numbers."
+description: "Swap the model on a dank-fleet llama.cpp endpoint: fetch, runtime-door census, env edit, deploy through git, rewrite the bats seam, sweep every live-path straggler, verify VRAM with the engine's own numbers."
 ---

 # llama.cpp endpoint model swap (dank fleet)

-Use when replacing the model/shape on a llama.cpp endpoint (e.g. frank-secondary on the RTX 3090). The engine's boot numbers are the verdict — do NOT commit to a feasibility verdict from head math; boot it and read `nvidia-smi`.
+Use when replacing the model/shape on a llama.cpp endpoint (frank-zealot on the RTX 3090). The engine's boot numbers are the verdict — do NOT commit to a feasibility verdict from head math; boot it and read `nvidia-smi`.

 ## Sequence

-1. **Geometry first, from the loaded model's own log** (`--log-verbosity 4`, or the HF `config.json` under `text_config` for multimodal): layers, `n_head_kv` (an ARRAY — per-layer, e.g. gemma4 has 8 on sliding layers, 2 on full-attention), head_dim, `sliding_window_pattern`, `n_swa`, `attention_k_eq_v`. KV scales only with full-attention layers; sliding layers cost a fixed window-size ring. Single-value HF fields lie about per-layer heterogeneity.
-2. **Fit the KV rate law to the engine, not to arithmetic.** Run once with `--log-verbosity 4` and read the `llama_kv_cache` / `sched_reserve` buffer MiB lines. Known law for master 5fc4f3c: bytes/elem = (K bytes + V bytes) **x2** when the file declares `attention_k_eq_v` (6.125 at f16 K + q8_0 V, 2.125 at q8_0/q8_0) — k_eq_v is a compute-graph mapping and does NOT shrink the cache. Full cache = n_full x n_head_kv x head_dim x rate x ctx; SWA cache = n_swa x window x n_head_kv_swa x head_dim x rate. Both reproduce the printed MiB exactly; if your formula does not, your law is wrong, not the engine.
-3. **Probe the binary's real capabilities** before promising flags: `--help | grep -A2 cache-type-k` (this fleet's build has NO fp8; q8_0 is the "FP8 class"), `--help | grep -A2 verbosity` (`-lv, --log-verbosity N`; ship `VERBOSITY` as an env tunable + `--log-verbosity "$VERBOSITY"` so VRAM forensics land in the journal), `--help | grep model-draft` for separate drafters. NEVER `grep -c <archname>` on the packed binary to check arch support — it returns 0 for every arch; check the source tree at the build's commit.
-4. **Fetch with `-f` + byte-count check** into `/home/dank/models/<name>/`.
-5. **Edit the repo trio** (`scripts/serve-<svc>.sh`, `scripts/<svc>.env`, `~/.omp/agent/models.yml`): spec flags move as a SET (`SPEC_TYPE=none` strips `--spec-type` AND `--spec-draft-model`/`--spec-draft-*`); a drafter with its own arch file (gemma4-assistant) needs `SPEC_DRAFT_FILE`, and its draft KV is built against the TARGET's full window — price it from a boot pair. `models.yml` `contextWindow` = per-slot window (`CTX_SIZE/PARALLEL`); recompute `maxTokens` for the compaction clamp `min(maxTokens, ctx - estimate - 4096)`.
-6. **Rewrite the bats seam in the same commit** (`tests/<svc>_unit.bats`): payload path, slot geometry, KV pair, spec state, batch pair, verbosity, mmproj opt-out, reasoning flags — all argv-asserted against the stub engine; where the contract is a repo value (batch pair, verbosity) assert argv == env value so a retune moves one file.
-7. **Deploy through git** (no direct remote edits). If the remote tree is dirty: `git stash push <files>` on the host, `git pull --ff-only`, land the change as a commit. A pull that aborts leaves the host at the OLD revision while the service runs the NEW edits — verify `git log -1` on the host.
-8. **Verify the engine, not your math**: `/proc/<pid>/cmdline` (argv is the contract), `/v1/models` (`n_ctx`, `ftype`, `n_ctx_train`), `nvidia-smi --query-gpu=memory.used,memory.free`, `/health` 200, a vision probe (solid color >=256 px via `image_url`, expect the exact word), and one generation probe reading `timings.predicted_per_second`. Record the numbers in the env comment + runbook, then push and ff-pull the host.
-9. **Cutover AGENTS.md in the same commit**: fleet-topology table row, the `### <svc>` section, the `Model Config` contextWindow/vision note, the runbook index ACTIVE row, a RETIRED row for the superseded era. The new docs page must be linked from the TOP-LEVEL `serverAppConfigs-docs/index.md`.
+1. **Runtime door BEFORE anything else.** Histogram the GGUF's tensor types and metadata (one python range-read of the KV section): a custom type (e.g. PQ2_0 = GGML type 142 + `prism.hadamard.*`) means the vendor/fork build is FORCED, not chosen — stock llama.cpp refuses it at load. Record the build identity (path, build number, commit, sha256) in the env comment; a `--help` census on that binary is what settles flag questions (this fleet's builds have NO fp8 KV; q8_0 is the "FP8 class"). NEVER `grep -c <archname>` on the packed binary to check arch support — it returns 0 for every arch.
+2. **Geometry first, from the loaded model's own log** (`--log-verbosity 4`, or the HF `config.json` under `text_config` for multimodal): layers, `n_head_kv` (an ARRAY — per-layer), head_dim, `sliding_window_pattern`, `n_swa`, `attention_k_eq_v`. KV scales only with full-attention layers; sliding layers cost a fixed ring; recurrent/linear layers (Gated DeltaNet) bill a fixed state per SLOT (~150 MiB measured), invisible to pool arithmetic. Single-value HF fields lie about per-layer heterogeneity.
+3. **Fit the KV rate law to the engine, not to arithmetic.** One boot at `-lv 4` prints `llama_kv_cache` / `sched_reserve` MiB lines. Master 5fc4f3c law: bytes/elem = (K + V) **x2** when the file declares `attention_k_eq_v`. Full cache = n_full x n_head_kv x head_dim x rate x ctx. If your formula disagrees with the printed MiB, your law is wrong.
+4. **Price the KV dtype by BOOTING the arms, at the target window.** f16 may simply OOM (`cudaMalloc failed` after the engine's own fit line names the MiB it wanted); q8_0 may be the only pair that funds 2 x 200,704; q4_0 is the fallback rung. Record every arm's used/free. **The mmproj lands AFTER the engine's fit projection** (projected fit < settled VRAM by ~1.5x the projector file size) — quote both numbers.
+5. **Fetch with `-f` + byte-count + sha256 check** into `/home/dank/models/<name>/`; `--verify-only` mode for re-census.
+6. **Edit the repo trio** (`scripts/serve-<svc>.sh`, `scripts/<svc>.env`, `~/.omp/agent/models.yml`). **Use the serve script's OWN variable names** (`CACHE_TYPE_K`/`CACHE_TYPE_V`, `BIND_ADDR`, `NGL`) — an invented name is silently swallowed by `: "${VAR:=default}"` and the arm boots the DEFAULT (cost a whole trial window: a `KV_CACHE_TYPE` scratch env booted f16 and OOMed while reading as a model fault). Sweep the script's DEFAULTS to the new payload too: a defaulted run must land on the shipped shape, never the retired one. Spec flags move as a SET (`SPEC_TYPE=none` strips `--spec-type` AND `--spec-draft-*`); MTP is a property of the FILE (no `nextn` tensors = no drafter, ever). `models.yml` `contextWindow` = per-slot window (`CTX_SIZE/PARALLEL`); recompute `maxTokens` for the compaction clamp `min(maxTokens, ctx - estimate - 4096)`. Check the payload's own template: if it reads `reasoning_effort`, the `reasoningEffortMap` fold becomes LOAD-BEARING (an unmapped level is a 500 naming Jinja, not the model) and quote the file's `general.sampling.*` trio in `extraBody`.
+7. **Rewrite the bats seam in the same commit** (`tests/<svc>_unit.bats`): payload trio paths, slot geometry, spec state, batch pair, verbosity, mmproj opt-out, reasoning flags — argv-asserted against the stub engine; where the contract is a repo value (batch pair, verbosity, **KV dtype**) assert argv == env value so a retune moves one file and a wrong-name env edit cannot pass silently.
+8. **Trial window protocol** (when the shape is unproven on the card): stop the unit (trap-guarded `systemctl start` restore in the scratch script), run the arm census + behavior probes as a DETACHED script writing to `/home/dank/logs/<name>.out`, then before touching production CENSUS the live state: `systemctl is-active`, `ss -ltnp | grep <port>`, `pgrep -x llama-server`, `nvidia-smi`. A scratch server orphaned by a client-side timeout holds the whole card and will OOM the real boot — kill by PID (never `pkill -f llama-server`). A trap restore can race your manual kill; read the script's own `RESTORE` log line before assuming who did what.
+9. **Deploy through git** (no direct remote edits): commit atomically on the worktree branch, `git fetch && git rebase origin/main` (log.md conflicts at EOF are two waves appending — keep both), push branch (`--force-with-lease` after a rebase), then in the MAIN checkout `git pull --ff-only` + `git merge --ff-only <branch>` + `git push origin main`, then `scripts/deploy.sh <host> --service <svc>` (`--service` is REPEATABLE — name the homepage too when cards changed, or the target ships the model without its docs). A `deploy.sh` with no `--service` is a fleet-wide drain: never.
+10. **Verify the engine, not your math**: `systemctl is-active/is-enabled` + the new `Description`, the journal fit/KV/buffer ledger (`projected to use N`, `KV buffer size`, `n_ctx_seq`, `n_slots`), `/v1/models` served alias (radiance-style echo does not apply to llama.cpp, but the alias is still the honest check), `nvidia-smi` settled, then live probes through the REAL request shape the harness sends (exact-instruction chat + `reasoning_content`, `tool_calls` JSON args, solid-color `image_url` >=256 px expecting the exact word, `timings.predicted_per_second`). Never report the FIRST request after a boot (warmup artifact). Push, and record numbers in the env comment + runbook.
+11. **Cutover every consumer, same branch**: AGENTS.md (topology row, `### <svc>` section, Model Config note, runbook index ACTIVE + RETIRED rows); the new docs page MUST be linked from the TOP-LEVEL `serverAppConfigs-docs/index.md` (the `docs_completeness` seam fails otherwise, not from `LLM/index.md`); `shared/homepage/services.json` + `docs.html` (model link, spec line, rate, and the WARNING — a censored base breaks the "common uncensored text" equality in `homepage_config.bats`, so re-key the test's premise too); `serverAppConfigs-docs/Dankclaw/OpenWebUI.md` + the live `model` row `meta.description` (live DB state: snapshot `webui.db.bak-<date><letter>`, UPDATE via host python3 over ssh; do NOT restart `open-webui` for a cosmetic string — it logs every family session out).

 ## Gotchas

+- A "we can rebuild the fork ourselves for provenance" claim needs the source tree AT the vendor build's commit — check `git -C <src> log --oneline -1` first. A fork checkout at branch HEAD (`prism` at `0082ac2`) is NOT the vendor build (`2459f68b5`), so the rebuild produces a different binary, not the verified one. Also: if the vendor binary already demonstrates the requirement (KV dtype buffer math in the ledger + live probes), a rebuild buys no behavior change — offer it explicitly as provenance hardening, never do it silently.
 - A systemd restart reporting `inactive` in the first seconds is usually model-load time; check `journalctl -u <svc>` for `model done`/`server is listening` before declaring failure.
- Rollback = the previous payload stays on disk; one `MODEL_FILE` + shape edit back.
- A thinking model can consume the whole token budget in `reasoning_content` (empty `content`, `finish_reason: length`) — probe with a budget that clears thinking.
- **Bats vacuity trap**: `serve_argv` REWRITES `$STAGE/test.env` from the shipped env, so a test that mutates the file (`sed -i`, append) then calls `serve_argv` asserts on regenerated content — a tautology. Tests that mutate must exec via a `run_stage` helper running the file as-is. Symptom: the assertion fails only after you fix the vacuity, and the env dump shows the mutation gone.
- `env NAME=value cmd` needs valid identifiers; a flag-like token (`nvidia-modprobe=true`) is only legal as an `env` ARGUMENT, not as a shell assignment prefix.
+- Rollback = the previous payload stays on disk; one `MODEL_FILE` + shape edit back. Record a refusal-freedom fallback the same way (an official censored base ↔ a CRACK re-export with byte-identical header geometry is a one-line swap; prove the identity with the tensor histogram, not the card).
+- A thinking model can consume the whole token budget in `reasoning_content` (empty `content`, `finish_reason: length`) — probe with a budget that clears thinking; a short-budget vision probe reads as "the model is blind".
+- `/completion` at `-lv 4` prints `failed to parse reasoning content ...` on raw prompts closing with an end-of-turn marker: cosmetic (chat path parses correctly). At ~26k+ a bare `/completion` can return 0 tokens with no error — raw context has no role frame; chat is unaffected.
+- **Bats vacuity trap**: `serve_argv` REWRITES `$STAGE/test.env` from the shipped env, so a test that mutates the file then calls `serve_argv` asserts on regenerated content — a tautology. Tests that mutate must exec via a `run_stage` helper running the file as-is.
+- `env NAME=value cmd` needs valid identifiers; a flag-like token is only legal as an `env` ARGUMENT, not as a shell assignment prefix.
+- Gitea `git push` on a rebased branch is rejected non-fast-forward: `--force-with-lease` (your own branch), never on main.
@@ -0,0 +1,74 @@
+---
+name: llamacpp-trial-boot-census
+description: "Measure whether a candidate GGUF fits a live llama.cpp endpoint's card: verify serve-script env names first, run a dtype/slot arm matrix with trap-guarded production restore, read the engine fit ledger."
+---
+
+# llama.cpp trial-boot census (does candidate X fit this card?)
+
+Paper arithmetic on KV rates is a hypothesis. The engine's own fit ledger plus a
+real boot are the proof. This protocol ran on frank-zealot (RTX 3090,
+Qwen3.5-9B Q6_K → prism-ml Ternary-Bonsai-2-27B PQ2_0, 2026-10-17).
+
+## 0. Gate: env variable names, not invented ones
+
+A trial env written from memory silently falls back to the serve script's
+defaults. `KV_CACHE_TYPE=q8_0` when the script reads `CACHE_TYPE_K`/`CACHE_TYPE_V`
+boots **f16** and every later number is wrong (this wasted a whole outage; two
+arms printed identical allocations, which is the tell).
+
+```bash
+grep -nE ': "\$\{[A-Z_]+[:=-]' scripts/serve-<svc>.sh   # the real names + defaults
+grep -nE '\-\-[a-z-]+ "\$' scripts/serve-<svc>.sh       # what actually reaches argv
+```
+
+Never invent: KV dtype, bind addr, n-gpu-layers, log-file (units redirect it).
+
+## 1. Runner skeleton
+
+One script on the host, `set -u`, `trap restore EXIT`:
+
+```bash
+restore(){ pkill -x llama-server; for i in $(seq 1 90); do [[ "$(used)" -lt 1500 ]] && break; sleep 2; done
+  sudo systemctl start <svc>; for i in $(seq 1 150); do [[ "$(curl -s -o /dev/null -w %{http_code} $BASE/health)" == 200 ]] && break; sleep 2; done; }
+trap restore EXIT
+sudo systemctl stop <svc>            # benching law: stop first, mask fails on relinked units
+setsid nohup env FRANK_<SVC>_ENV_FILE=/tmp/armA.env bash scripts/serve-<svc>.sh >$LOG 2>&1 &
+```
+
+Launch with `setsid nohup … &`, wait with ONE async watcher (`grep -q DONE`),
+never poll. Per-arm drop-in envs via `sed` on a base env — one variable per arm.
+
+## 2. Arm matrix (cheap, each ≈ boot + probes)
+
+| Arm | Purpose |
+|---|---|
+| target shape × target KV dtype | the verdict + behavior probes |
+| target shape × f16 KV | proves the wall (or funds the shape) |
+| 1 × native-window | answers "can we serve the full context" |
+| target shape × q4_0 | the roomy fallback rung |
+
+## 3. Read the ledger, not `nvidia-smi` alone
+
+```bash
+grep -a -A8 "memory breakdown" $LOG     # total = free + (model + context + compute)
+grep -aE "KV buffer size|model buffer size|compute buffer size|estimated worst-case memory usage of mmproj|projected to use|cannot meet free memory target|cudaMalloc failed" $LOG
+```
+
+Laws learned the hard way:
+- `projected to use N MiB vs M MiB of free` + `cannot meet free memory target of R` ⇒ requirement is `projected + R ≤ free`. With `--n-gpu-layers` pinned by the user the fitter **aborts** instead of shrinking — the boot then dies at the KV `cudaMalloc`.
+- `context` bills **more than the KV pool**: hybrid models add a fixed recurrent state per slot (~150 MiB/slot for qwen35's 48 DeltaNet layers). Pool math alone under-prices.
+- **The projector's `estimated worst-case memory usage of mmproj is X MiB` is NOT inside the fit projection.** It lands after the fit check, so real headroom = paper headroom − X. This is the "boots fine, then dies / dark" class.
+- q8_0 K+V bills exactly `2 × (layers_kv × heads × dim / 32 blocks × 34 B)`/token — check the reported KV MiB against that to prove the dtype actually took.
+
+## 4. Probe traps
+
+- **First request after boot is warm-up garbage**: it paid 2.6 t/s prefill / 37.7 t/s decode where the warm run gave 1,258 t/s. Never bench the first request; discard it or warm with a throwaway.
+- Reasoning-on chat probes need **≥512 `max_tokens`**: at 64 the answer was empty (`finish=length` mid-`reasoning_content`) while vision actually worked. Judge `content` only at a budget the thinking can fit.
+- Raw `/completion` (no chat template) returns `content` only — thinking is invisible; `timings.prompt_n` / `predicted_per_second` are the real keys, not `prompt_tokens`.
+- Vision probe: solid-color PNG ≥256 px, expect an exact color word.
+- Concurrency honesty: fire two identical requests in parallel; per-slot rates from each response's `timings`.
+
+## 5. Restore proof
+
+`health=200` **and** `systemctl is-active` — an `inactive` unit behind a 200 means
+a stray trial process holds the port. Kill by pid; never `pkill -f llama-server`.
@@ -0,0 +1,24 @@
+---
+name: llm-bench-harness-fault-census
+description: "Diagnose implausible LLM benchmark scores in frank-intelligence-bench: failure-signature census, harness-fault signatures (target NameError, scicode ModuleNotFound, markdown-fence SyntaxError), and official-protocol grading law."
+---
+
+Use when benchmark scores look impossible (0% across the board, sudden cliffs) in frank-intelligence-bench.
+
+# Law
+Scores are untrusted until `bun run src/cli.ts analyze <run-id>` shows a failure-signature census with ZERO harness suspects. Model-side signatures (AssertionError on real values, AxisError, model's own NameErrors) are fine; harness signatures indict the engine.
+
+# Census
+- Reads `runs/<id>/ledger.jsonl` grade rows, extracts last `*Error: name 'X'` / `No module named 'X'` per failing row, aggregates per eval.
+- `harnessSuspects()` flags: `NameError: target(s)` (gold target binding missing), `ModuleNotFoundError: scicode` (pinned pkg absent from sandbox image), >50% shared signature ≥10 samples (systematic fault), >50% gen failures (endpoint fault).
+
+# Known harness faults (friction-earned, 2026-10-10)
+1. SciCode gold values live ONLY in `test_data.h5` (authors' Drive folder `1W5GZW6_bdiDAiipuFMqdUhvUaHIj6-pR`); tests reference bare `target`. Fix = `stageH5()` (sha256-gated upload to Dankclaw, mounted `/w-data/test_data.h5:ro`) + `process_hdf5_to_tuple(step, n_cases, h5py_file=...)` per official `eval/scripts/test_generated_code.py`.
+2. Sandbox image must contain `h5py` + `scicode @ git+https://github.com/scicode-bench/SciCode.git@<pin>` (+ `git` in python:3.12-slim for pip-git). Image tag carries the fix epoch: `frank-bench-py:3.12-scicode1`.
+3. Official extractor `get_function_from_code` `exec`s raw submission text → markdown fences are guaranteed SyntaxError. Official pipelines store CLEAN code: strip fences (`stripFences()`: join all ``` blocks) before extraction, for submissions AND prior-step context.
+4. Gold CODE ships only for the dev split (50 steps) on HF `AI-SCODE/SciCode`; `problems_test.jsonl` gold=None; GitHub pinned tree ships no gold jsonl; scicode pip package ships no data. Leaderboard (AA) SciCode uses reference-solution context — compare only against the gold-context slice, never the self-cumulative test split.
+5. Quarantine poisoned ledgers to `.AGENTTRASH/` (never blend void rows into reports), reset `runs/queue.json` to `{"active": null, "runs": []}` (active must be `null`, not `""`).
+
+# Verification gates
+- Real-infra proof: `FIB_INTEGRATION=1 bun test tests/integration.test.ts` (gold solution must PASS official protocol; `process_hdf5_to_tuple("77.1", 3)` → 3 targets). Integration files must `delete process.env.DRY_RUN` and point `FIB_DATA_CACHE` at the real cache (preload isolates it to TMP fixtures).
+- After a protocol fix, fresh live run must show mixed PASS/FAIL with model-side-only signatures before any score is reported.
@@ -0,0 +1,30 @@
+---
+name: llm-endpoint-behavior-battery-a-b
+description: "A/B two boots of a live OpenAI-compatible LLM endpoint (payload swap trial) with one identical behavior+throughput battery: refusals, thinking-token census, tools, vision, needle, decode/prefill rates."
+---
+
+Run the SAME battery against both boots of an endpoint swap (candidate vs shipped payload). Never compare across different prompts, never benchmark beside the live service (stop + mask first), never measure the first request.
+
+## Harness
+`/tmp/halogen-eval/battery.py <tag> [all|tail]` (stdlib only, `urllib`): appends one JSON line per probe to `/tmp/halogen-eval/battery-<tag>.jsonl`, summary to stderr. `tail` = long-context + throughput only. Stage assets next to it: a corpus text file, a base64 512 px solid-color PNG.
+
+Probe order (each is a gate, all comparable across boots):
+1. **warmup** — discarded. First request after boot is a graph-capture artifact (measured 3x spread: 2.6 vs 1258 t/s prefill).
+2. **sanity** — exact-answer arithmetic, `temperature=0`.
+3. **refusals** — 5 hostile prompts, count refusal-marker regex hits. The abliteration/base-alignment census.
+4. **thinking census** — 6 fixed questions, `temperature=1.0`, `max_tokens=4096`; report mean `usage.completion_tokens` + per-item. A removed instruction fine-tune shows here first (measured: mean 784 vs the card's 3271 for the base model).
+5. **tools** — 1-turn (named-arg `tool_calls`) then 2-turn (tool result → answer).
+6. **vision** — OpenAI `image_url` content part only (legacy top-level `images` is silently ignored); solid color, expect the exact word; budget >=512 tokens or thinking eats it and empty `content` + `finish_reason=length` reads as blindness.
+7. **needle** at planted depth 0.85 and 0.10 of a token-budgeted haystack.
+8. **decode** — greedy, `max_tokens=512`, long-form prompt: `completion_tokens/secs`.
+9. **prefill** — one ~58k-token prompt twice: pass 1 cold, pass 2 cached; the ratio is the prompt-cache proof (measured 136x warm, 1.4x when already cached).
+
+## Laws that bite
+- **Token-budget every prompt by measurement, never chars/4.** Measure chars/token on the actual corpus (`prompt_tokens` of one probe ÷ its char count; wikitext-2 ≈ 4.33 for a HF-tokenizer Qwen-class model — chars/4 under-bills ~8 %). Over-window prompts come back HTTP 400 whose message names the exact token count and the ceiling — treat that as ground truth, it is the cheapest tokenizer oracle available.
+- **Corpus splitting:** check the separator before trusting a paragraph budget. Wikitext-2 raw blocks separate with `"\n \n"`, and a naive parquet→text dump joins rows with a SINGLE newline: a `"\n\n"`/blank-line split then returns ONE paragraph = the whole file, so every budget silently becomes "everything". Verify with `text.count("\n\n")` and the split's part count before running.
+- **Catch `HTTPError` in the POST helper and record the body.** A 400 is a probe result, not a crash — otherwise the battery dies mid-run and you re-run the whole thing against a live GPU.
+- **Report decode from a quiet host.** The same shape measured 25.6 / 37.9 / 46.8 t/s while a 62 GB download hammered page cache; only the idle-host number is real.
+- **Server-side samplers exist.** If the endpoint pins temperature/top_p/top_k, omit `temperature` for the thinking census (match production) and pin `temperature=0` only for exact-answer probes.
+
+## Verdict framing
+Behavior gates (sanity/refusals/tools/vision/needle) are the contract; PPL/KL from the engine's own checkpoint tools is advisory; throughput deltas under ~5 % are noise unless a mechanical control (a prompt shorter than the knob under test) proves the knob was the only variable.
@@ -0,0 +1,35 @@
+---
+name: model-runtime-support-survey
+description: "Survey how every open-source runtime serves a given LLM (vLLM, llama.cpp, SGLang, KTransformers, overlays, vendor GGUFs) before writing a serving/feasibility plan; harvest quant recipes, measured rates, and mapped landmines from PR comments and overlay repos."
+---
+
+# Model Runtime Support Survey
+
+Answer "how do other engines run model X, and what did they pay to learn it?" before committing a bring-up plan. Every kernel spec, quant recipe, and landmine found upstream is one you don't pay for twice. Proven on GLM-5.3-Flash (2026-10-14): surfaced a production 8xR9700 vLLM overlay, MTP 2.3x decode numbers, and 4 landmines (fp8-KV scale calibration, prefix-cache 0-hits, KDA autotune nondeterminism, chat-template notation).
+
+## Harvest order
+
+1. **Official model card** (`huggingface.co/<org>/<model>`) — the "Serve Locally" section lists officially supported runtimes; sampling/template contract lives here (e.g. `reasoning_effort` defaults, `clear_thinking`).
+2. **Per-runtime PRs** (vLLM, llama.cpp, SGLang) — fetch via the GitHub-API-backed read; **the comments, not the body, are the payload**: field reports (prefix-cache hit censuses, ROCm/AMD enablement branches, extension rebuild recipes, crash repros, free tuning levers via `--override-kv`, nondeterminism root-causes). Get the PR status (merged/open/closed) — it sets what "master supports" means.
+3. **Overlay/serving repos on HF** (search model name + your GPU family, e.g. `rocm-r9700`): read the tree (`huggingface.co/api/models/<repo>/tree/main`), then `raw/main/README.md`, `raw/main/OVERLAY_NOTES.md`, `raw/main/run-*.sh`. Launch scripts carry the laws in comments (KV sizing justifications, env ladders, dead knobs).
+4. **Vendor GGUF guides** (Unsloth docs): append `.md` to the docs URL for clean markdown; gives quant KLD/top-1 tables, template fixes, hardware floors. Check whether their GGUF carries MTP/nextn tensors — that's often the only public source of draft-head weights.
+5. **KTransformers tutorials** (`raw.githubusercontent.com/kvcache-ai/ktransformers/main/doc/en/kt-kernel/<Model>-Tutorial.md`) + **SGLang cookbook** (`docs.sglang.io/.../<Model>.md`): CPU-offload expert shape validation, 1M-ctx recipes.
+
+## Harvest checklist (per runtime)
+
+- Measured decode/prefill + hardware shape (cards, TP) — anchor, not decoration; per-card effective GB/s is the cross-engine comparison unit.
+- Quant recipe: bits-per-weight split by module class (experts/trunk/embed) — convergent recipes cross-validate your planned conversion.
+- Spec-decode: acceptance length, per-position accept, when it pays (CPU-offload) vs loses (VRAM-resident).
+- Landmines: KV-scale calibration reading uninitialized linear-attn state; prefix-cache semantics on hybrid KDA/DSA models; kernel autotune nondeterminism (KLD across launches); fp8 flavour bugs (FNUZ vs e4m3fn scale); template notation engines can't parse; import gates per gfx/arch.
+- Harness contract: reasoning-effort defaults (16k+ hidden thinking tokens), sampling params, tool/reasoning parser names.
+
+## Output
+
+A runtime matrix table (engine | arch status | hardware | artifact | measured) + a numbered "laws we inherit" list; fold every law into the plan's phases and risks with § cross-refs.
+
+## Gotchas
+
+- Read PR **comments** — the highest-value data (crash repros, censuses) is comment-only.
+- HF fetches: `api/models/<repo>/tree/main` for listing, `raw/main/<path>` for files; the HTML card view renders README inline too.
+- `browser.open` targets the harness's headless browser, not the user's — refresh user-facing pages with `xdg-open`.
+- Companion skill for the artifact side: `radiance-model-feasibility-scout` (GGUF header census).
@@ -0,0 +1,44 @@
+---
+name: niri-all-monitor-screenshot-fix
+description: "Fix flameshot screenshot failures on niri with 2+ outputs: confirm portal outputs.len()==1 census, retire flameshot binds for niri-native equivalents, absolute script paths (niri spawn-sh PATH lacks ~/.local/bin)"
+---
+
+# Niri all-monitor screenshot fix (flameshot retirement)
+
+## Symptom fingerprints
+- "Bunch of flameshot errors after a delay" when docked (2+ outputs); fine on one output.
+- Journal census (ground truth): `journalctl --user -u niri --since today | grep -i screenshot`
+  - FAIL: `WARN niri::niri: error taking a screenshot: Condition failed: outputs.len() == 1 (2 vs 1)` — one press of flameshot full emits 3 WARNs (composited screen + per-output portal requests).
+  - SUCCESS: `DEBUG niri::niri: saving screenshot to ...` — per-file lines.
+- Timeline: count WARNs before/after a config reload to attribute presses to config states.
+
+## Root cause
+Flameshot 14 on Wayland captures via xdg-desktop-portal → xdg-desktop-portal-gnome → niri's GNOME-Screenshot compatibility D-Bus API → `screenshot_all_outputs` → `ensure!(outputs.len() == 1)` (FIXME upstream). Upstream: niri#4313 (closed duplicate, unfixed in 26.04/8ed0da4), flameshot#4449.
+- NOT just `full`: live-verified docked, `flameshot full` AND `flameshot screen` both hang ~15 s (exit 124 under timeout), write no file. Assume ALL flameshot capture modes dead with 2+ outputs.
+
+## Fix: retire flameshot binds; niri-native replacements (blankpad layout)
+| Chord | Action |
+|---|---|
+| Print / Ctrl+Shift+1 / Mod+Shift+S | `spawn-sh "/home/blank/.omp/scripts/screenshot-desk.sh"` — per-monitor PNGs |
+| Alt+Print / Ctrl+Shift+2 | `screenshot-screen;` — focused monitor → screenshot-path + clipboard |
+| Ctrl+Print / Ctrl+Shift+3 | `screenshot;` — interactive UI (Space saves, Esc cancels; single-output selection by design) |
+
+- Misc: `screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png"` at CONFIG ROOT (it is `config.screenshot_path`; a KDL `output { }` block REQUIRES a name arg — bare `output {}` is a parse error).
+- KDL comments are `//`, never `#` (parses as identifiers → cryptic "identifiers cannot be used as arguments").
+- niri 26.04 screenshot UI: "allows only single-output selections for now" (src/ui/screenshot_ui.rs) — no built-in all-monitor composite; script needed.
+
+## All-monitor script (scripts/screenshot-desk.sh)
+Per active output (`niri msg --json outputs | jq -r .[].name`): `niri msg action focus-monitor <m>` → sleep 0.15 → `niri msg action screenshot-screen --path "<abs>/… <connector>.png"` → restore prior focused monitor (`niri msg --json focused-output | jq -r .name`). No grim, no portal. `--path` must be absolute.
+
+## THE SPAWN-SH PATH TRAP
+niri's spawn-sh PATH = system dirs only; `~/.local/bin` ABSENT. Proof:
+`tr '\0' '\n' < /proc/$(pgrep -x niri | head -1)/environ | grep ^PATH`
+→ any bare user-script name in a keybind fails SILENTLY (no journal error, no file). Rule: keybinds use absolute script paths (`/home/blank/.omp/scripts/...`). Audit existing binds for bare names (desk.sh was dead too).
+
+## Verifying a keybind end-to-end without a keyboard
+Reproduce niri's child env exactly:
+`env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl HOME=$HOME USER=$USER LOGNAME=$LOGNAME XDG_RUNTIME_DIR=/run/user/$(id -u) WAYLAND_DISPLAY=wayland-1 NIRI_SOCKET=/run/user/$(id -u)/niri.$WAYLAND_DISPLAY.$(pgrep -x niri | head -1).sock sh -c "/abs/path/script"`
+NIRI_SOCKET is NOT in niri's own environ (it is set on niri's children); socket path convention: `$XDG_RUNTIME_DIR/niri.<wl-display>.<niri-pid>.sock`.
+
+## Deploy mechanics (blankpad command-center)
+Live niri config = symlinks into the ~/.omp main checkout ("the checkout is the deployment"). Merge to main → niri auto-reloads (~1 s later journal `DEBUG niri_config: loaded config from ...`); verify that DEBUG line as the reload proof. Manual fallback: Mod+Shift+/. `niri msg` has NO keybinds subcommand — keybind proof = overlay (Mod+Shift+Escape) + journal census.
@@ -0,0 +1,43 @@
+---
+name: niri-config-edit-validate
+description: "Locate, edit, validate, and commit niri compositor config on Frank's workstations: desk/display profiles, EDID-keyed outputs, layout, keybind grepping, dotfiles mirror, noctalia.kdl last-include color override, forced hot-reload."
+---
+
+# Editing niri config on Dank workstations
+
+## Layout of the config
+- Live config: `~/.config/niri/config.kdl` is a thin file of `include "./cfg/*.kdl"` lines. **Never conclude "not bound" from grepping only `config.kdl`** — keybinds live in `cfg/keybinds.kdl`, rules in `cfg/rules.kdl`, layout in `cfg/layout.kdl`, etc. Grep `~/.config/niri/cfg/` recursively.
+- **Include order wins:** `config.kdl` ends with `include "noctalia.kdl"` — a hand-written accent overlay at `~/.config/niri/noctalia.kdl` that re-declares `layout { focus-ring/border/tab-indicator/insert-hint }` + `recent-windows.highlight` colors and BEATS every `cfg/layout.kdl` color edit (observed 2026-10-18: focus-ring color edits to layout.kdl appeared to "not reload" while this file silently repainted them red). Before changing any accent/outline color, grep the WHOLE `~/.config/niri/` tree (not just `cfg/`) for the property and fix the LAST includer. Tracked in repo at `dotfiles/zz-blankpad/niri/.config/niri/noctalia.kdl`; live file is NOT a symlink — sync by `cp` and `diff` like the rest.
+- niri notation: `Mod` = Super/Win key. Chords like `Mod+R { switch-preset-column-width; }`.
+- `~/.config/niri` is a REAL directory, not a symlink; the version-controlled copies are a partial mirror under `~/.omp/dotfiles/zz-blankpad/niri/.config/niri/`. Trees can drift: diff them before/after edits. (Hardlink wiring is FRAGILE — editor/agent atomic-rename writes silently break hardlinks; verify live↔mirror by CONTENT diff, never by link trust.) On blankpad the `cfg/*.kdl` entries are symlinks into the repo (`dotfiles/niri/...` base + `zz-blankpad` overrides) — edit through them freely; `noctalia.kdl` and `config.kdl` are the plain-file exceptions.
+
+## Desk/display profiles (monitor arrangement)
+- Profiles: `cfg/desk-<n>-<name>.kdl` (e.g. `desk-1-home.kdl`, `desk-2-portable.kdl`); ACTIVE profile is symlinked as `cfg/display.kdl` — `readlink` it to know which. `scripts/desk.sh` manages switching; `desk.sh capture` prints connected outputs' EDID long names.
+- Panels are keyed by **EDID long name** (`output "Lenovo Group Limited 0x40A9 Unknown"` = the laptop eDP-1 panel), not connector — connector names reshuffle between desks. Long-name blocks BEAT connector-keyed blocks when both match one output (legacy connector blocks like `output "eDP-1"` linger as duplicates; niri applies the EDID block's `position`).
+- Position math: x,y = top-left of each output in the logical layout; right edge = x + mode width. To place panel A left of panel B: `A.x = B.x - A.width`; bottom-align: `A.y = B.y + (B.height - A.height)`.
+- Verify: `niri validate` → hot-reload → `niri msg outputs | grep -iE 'Output |Position'` (prints `Logical position: x, y`).
+
+## Schema gotchas (niri 26.04)
+- `preset-column-widths` AND `preset-window-heights` are children of `layout { }` as SIBLING blocks — wiki wording misleads; nesting or `window-rule` placement fails `niri validate` with `expected one of proportion, fixed` / `unexpected node`.
+- Preset list order = cycle order for `Mod+R` (`switch-preset-column-width`); `Mod+Shift+R` cycles backwards. WITH custom preset lists the cycle contains ONLY the configured presets — no implicit full/maximize tail (verified: [0.25, 0.5] cycles period 2). Maximize = separate `Mod+F` `maximize-column`. Built-in defaults without the node: 1/3, 1/2, 2/3.
+- WITHOUT `preset-window-heights`, `switch-preset-window-height` FALLS BACK to the width presets — user sees width-fractions as heights; define the node explicitly to stop it.
+- Ground truth for node placement: the binary's embedded template — `grep -a -B4 -A8 "preset-column-widths {" $(which niri)`.
+- Window outlines: base geometry (`width`, `off`) lives in `cfg/layout.kdl` `focus-ring`/`border`; COLORS effectively live in `noctalia.kdl` (see include-order law). `border { off }` + focus-ring active = the visible outline.
+
+## Workflow
+1. Edit the live file under `~/.config/niri/cfg/` (symlinked = repo file; except `noctalia.kdl`, edit live then `cp` to mirror).
+2. `niri validate` (exit 0 + "config is valid") — mandatory before done.
+3. **Hot-reload is NOT reliable after harness edits** (atomic-rename writes are missed by niri's watcher; user then tests against the OLD config and reports "no change"). ALWAYS follow with `niri msg action load-config-file` (NOT `reload-config`).
+4. Sync changed file into the mirror: `cp ~/.config/niri/cfg/<f>.kdl ~/.omp/dotfiles/zz-blankpad/niri/.config/niri/cfg/<f>.kdl` (repo root is `~/.omp`, branch `main`, remote = dankclaw Gitea `dank/command-center`; push there is pre-authorized). Verify by `diff`, not by cp success.
+5. Untracked mirror files: `config.kdl`, `noctalia.kdl`, `animation.kdl`, `input.kdl`, `display.kdl` (symlink target) — flag drift, don't silently add; when a live-only file turns out to be load-bearing (like `noctalia.kdl` was), commit the first durable copy into `dotfiles/zz-blankpad/niri/.config/niri/`.
+6. Mirror files often carry pre-existing uncommitted drift (desk.sh captures); a commit of your edit folds it in — say so in the report/commit body.
+
+## Live-behavior verification without disturbing Frank's windows
+- `niri msg --json <subcmd>` — the `--json` flag goes BEFORE the subcmd.
+- Targeting differs per action: WINDOW-scoped actions take `--id <window-id>` (NOT `--window`) — e.g. `switch-preset-window-height --id N`. COLUMN-scoped actions (`switch-preset-column-width`, `set-column-width`, `maximize-column`) have NO id — they hit the FOCUSED column; only `set-column-width <px|±N%>` positional CHANGE, no flags.
+- Spawned test apps do NOT reliably take focus, so blind `spawn + action` cycles resize whatever Frank is looking at. For column actions you must `focus-window --id N` first — and that STEALS focus; if Frank is actively testing chords, your probes and his keystrokes interleave and corrupt both. STOP probing, deliver config + validate, and have him press the chord himself.
+- `niri msg --json focused-window` can report a different window than assumed (focus moves); for per-window measurement read `niri msg --json windows` and filter by `id`. Present height of proportion p with gaps g over work-area H renders ≈ p*(H+g) − g. NOTE (measured 2026-10-18): this build's `windows`/`focused-window` JSON returns `x/y/width/height = null` — pixel-sampling the outline color from screenshots is not viable; ask Frank to eyeball after `load-config-file` instead of burning turns on capture forensics.
+- If Frank reports "still seeing old values" after a config edit: run `load-config-file` first, then verify empirically before believing anything else — and check `noctalia.kdl` include-order override BEFORE suspecting the reload.
+
+## "What does chord X do?" triage
+For "mod+<key>" questions, check in order: `~/.config/niri/cfg/keybinds.kdl` (compositor wins first), terminal configs (`~/.config/ghostty`, `foot`, `kitty`), tmux, then omp TUI chords (`omp://keybindings.md`; modifiers are ctrl/shift/alt/super only, no `Mod`; `Ctrl+R`=history search, `Alt+R`=app.retry).
@@ -0,0 +1,43 @@
+---
+name: niri-multi-monitor-screenshot-capture
+description: Diagnose flameshot screenshot failures on niri with 2+ outputs (portal single-output limit) and capture all monitors via niri-native per-output actions
+---
+
+# Niri multi-monitor screenshot capture
+
+Flameshot works on a single niri output, dies the moment a second output connects. Diagnose via compositor journal, capture full desk with niri-native per-output actions — not grim, not portal.
+
+## Diagnose (one pass)
+
+1. `journalctl --user -u niri --since today | grep -i screenshot`
+   - `WARN niri::niri: error taking a screenshot: Condition failed: outputs.len() == 1 (2 vs 1)` → flameshot's portal path (xdg-desktop-portal-gnome → niri GNOME-Screenshot D-Bus → `screenshot_all_outputs` `ensure!(outputs.len()==1)`). Upstream niri#4313, unfixed in 26.04. Symptoms: error bubbles appearing **after a delay** (portal round-trip), count = number of hotkey presses.
+2. `niri msg outputs` — count active outputs. 1 output = flameshot fine; the bug is dock-state-dependent (portable works, docked breaks).
+3. Per-mode status: `flameshot screen` (focused output) works docked; `flameshot gui` region works (mixed-res scaling bug = flameshot#4449); `flameshot full` dead on 2+.
+
+## Capture all monitors (niri-native)
+
+niri 26.04 has NO all-output capture: screenshot UI is single-output by design (`screenshot_ui.rs`: "allows only single-output selections for now"); D-Bus path hard-limited. Script pattern:
+
+```bash
+prev=$(niri msg --json focused-output | jq -r .name)
+while IFS= read -r mon; do
+  [ "$mon" != "$prev" ] && niri msg action focus-monitor "$mon"
+  sleep 0.15                       # let compositor render a frame after focus move
+  niri msg action screenshot-screen --path "$out/Screenshot from $ts $mon.png"
+done < <(niri msg --json outputs | jq -r '.[].name')
+# restore focus: niri msg action focus-monitor "$prev"
+```
+
+CLI facts (`niri msg action screenshot-screen --help`): `--path` must be ABSOLUTE; `-d/--write-to-disk` default true (also saves per `screenshot-path`); `-p/--show-pointer` default true.
+
+## KDL gotchas (bit me twice; bats `niri validate` catches them)
+
+- KDL line comments are `//`, NEVER `#` — `#` = parse storm "identifiers cannot be used as arguments".
+- `screenshot-path` is a ROOT-level config node (`config.screenshot_path` in config.rs); do NOT nest it in `output {}` — root-level bare node validates and works; `output { ... }` without a name/match arg fails: "additional argument `name` is required".
+- Root-level `prefer-no-csd` is a silent no-op (output-section property) — root unknown nodes only warn.
+
+## Verify
+
+- Run the script live; `file` each PNG (valid dimensions per monitor); `niri msg --json focused-output` equals pre-run monitor.
+- `bats tests/` incl. niri-config assembly validate on every desk profile before commit.
+- Deploy: symlink script into `~/.local/bin` (repo `scripts/` convention, like `desk.sh`); bind `spawn-sh "name"` in keybinds.kdl; niri hot-reloads config on file change.
@@ -1,6 +1,6 @@
 ---
 name: noctalia-bar-layout-edit
-description: "Edit/verify Noctalia v5 bar widget layout (start/center/end, taskbar workspace grouping) on Frank's symlinked dotfiles workstations"
+description: "Edit/verify Noctalia v5 bar layout and clock widgets (multi-timezone instances, capsule groups); GUI→repo propagation chain, settings.toml symlink audit, and clobber-recovery via dangling stashes on Frank's dotfiles workstations"
 ---

 # Noctalia v5 bar layout edit
@@ -9,14 +9,35 @@ Bar widget layout on Frank's noctalia v5 workstations is GUI-override state, not

 ## Where
 - Layout file: `~/.local/state/noctalia/settings.toml` → `[bar.<name>]` keys `start` / `center` / `end` (arrays of widget ids; `[widget.<id>]` subtables hold per-widget settings).
- On Frank's boxes this file is a **symlink into the command-center repo** (e.g. `~/.omp/dotfiles/noctalia/.local/state/noctalia/settings.toml`) — edit the repo file, not the link path (atomic-rename writes through the link path would replace the symlink).
+- On Frank's boxes this file MUST be a **symlink into the command-center repo** (e.g. `~/.omp/dotfiles/noctalia/.local/state/noctalia/settings.toml`) — edit the repo file, not the link path (atomic-rename writes through the link path would replace the symlink).
 - Layer order: built-in defaults < `~/.config/noctalia/config.toml` (+`[include]`) < `settings.toml` (wins). Noctalia writes through symlinks and keeps them.
 - Defaults when a key is absent: `start = ["launcher","wallpaper","workspaces"]`, `center = ["clock"]`.
+- **Noctalia rewrites this file itself** (GUI actions + normalizes keys/format, e.g. strips `{:%...}` braces, reorders widget lists). Always re-read the exact lines immediately before editing; stale line anchors WILL drift between reads.
+
+## GUI→repo propagation (checkout-is-deployment)
+- `~/.config/noctalia/config.toml` is symlinked into the repo → GUI settings writes land in the repo working tree automatically.
+- `~/.local/state/noctalia/settings.toml` can SILENTLY become a plain file (observed 2026-10-17; hardlink/symlink wiring decays) → GUI bar-layout changes then diverge from the repo with no signal. AUDIT: `readlink ~/.local/state/noctalia/settings.toml` must print the repo path; if it's a plain file and repo copy is content-identical, re-arm: `ln -sfn <repo-path> <live-path>` + `noctalia config validate`.
+- Landing in the working tree ≠ propagated: other boxes only see it after commit + push to Gitea main. `live-sync.path` (PR #15; DirectoryNotEmpty on `dotfiles/`) commits dotfiles-tier writes within ~2 s once deployed — until it is active on a box, the hourly heartbeat leaves up to 59 min of exposure, and on 2026-10-18 exactly that window let a trunk-sync stash destroy months of GUI layout work. Until verified active (`systemctl --user status live-sync.path`), commit GUI layout edits the same session yourself. Noctalia's runtime churn (wallpaper path, nightlight, panel positions) rides along; normal.
+- niri has NO settings GUI; niri "GUI changes" don't exist, and `niri msg output ...` runtime overrides are not persisted. niri cfg mirror↔live links also decay (all inodes decoupled once) → audit by CONTENT: `diff` every `~/.config/niri/cfg/*.kdl` against its `dotfiles/zz-blankpad/niri/...` mirror, never trust links.
+
+## If the bar got wiped (recovery)
+- The working-tree file is often the ONLY copy of GUI work; a `git checkout`/stash/merge clobber is survivable because git objects outlive stash entries: `git fsck --lost-found`, inspect `git log -1 --format='%ci %s' <dangling>` (newest `WIP on` stash commits hold the last good settings.toml), dump with `git show <c>:dotfiles/noctalia/.local/state/noctalia/settings.toml`.
+- Before restoring: back up the clobbered file to `.AGENTTRASH/`; validate the candidate in a sandbox (`XDG_CONFIG_HOME=… XDG_STATE_HOME=… noctalia config validate` — plugin-widget "unrecognized type" warnings there are offline-CLI blindness, not blockers); restore via `cp` onto the repo path (cp writes through the symlink; `mv` would replace it); prove visually with `noctalia msg screenshot-fullscreen`; commit immediately.
+- Cross-check the recovered layout against Frank's old screenshots in `~/Pictures/screenshot_*.png` (crop top ~7% with magick) — they are ground truth for what the bar should look like.

 ## Apply/verify loop (no restart, no reload IPC)
 1. Edit the repo `settings.toml`.
 2. `noctalia config validate` (checks merged layers; also `noctalia config export [full] | yq -p toml` to inspect effective values).
 3. Both layers are file-watched → hot-reload. Prove visually: `noctalia msg screenshot-fullscreen` saves a PNG to `~/Pictures`; read the image and inspect the bar.
+4. **Screenshot race:** the `ok` return precedes the PNG write. Never chain `noctalia msg screenshot-fullscreen && magick "$(ls -t ~/Pictures/screenshot_*.png | head -1)" ...` in one command — you crop the PREVIOUS capture. List `ls -t` in a separate later call and crop the named file.
+5. Crop for reading: `magick <png> -crop 100%x8%+0+0 +repage /tmp/strip.png`, then read the strip; cross-check clocks against `date -u` / `date`.
+
+## Clock widgets
+- `[widget.clock]` settings: `format`, `vertical_format`, `tooltip_format`, `timezone` (IANA id, e.g. `"UTC"`, `""` = system local). Tokens are strftime-compatible (`%H` 24h, `%I:%M %p` 12h, `%F` ISO date); `{:%...}` brace fields optional; `\n` = second line. Docs: docs.noctalia.dev → bar/widgets/clock + configuration/date-format-tokens.
+- **One timezone per widget; multiple instances allowed:** any `[widget.<id>]` needs `type = "clock"` for custom ids (bare `clock` id infers it). Each instance converts independently — e.g. local 12h + `timezone = "UTC"` 24h side by side.
+- Placement: add ids to `[bar.<name>]` start/center/end, or to a capsule group: `[[bar.default.capsule_group]]` with `id = "g1"` + `members = [...]`, referenced from `start` as `"group:g1"` (member order = left-to-right inside the capsule).
+- Local date + local 12h fit in ONE widget (same tz); the UTC 24h clock must be a second widget.
+- Expect the date widget (local) and UTC clock to disagree on the day after ~5 PM Seattle — that's correct UTC, not a bug; offer `%F` inside the UTC widget if it irks.

 ## Taskbar recipes
 - Move window indicator beside workspaces: put `"taskbar"` in `start` after `"workspaces"`.
@@ -24,4 +45,6 @@ Bar widget layout on Frank's noctalia v5 workstations is GUI-override state, not
 - The `workspaces` widget itself has no window display; styles are regular/minimal/focus_hint only.

 ## Law
-Full widget/setting tables: https://docs.noctalia.dev/noctalia/bar/ and .../bar/widgets/<name>/ . Commit bar changes atomically to the command-center repo (checkout is the deployment).
+- Full widget/setting tables: https://docs.noctalia.dev/noctalia/bar/ and .../bar/widgets/<name>/ . Commit bar changes atomically to the command-center repo (checkout is the deployment).
+- **Ask before applying.** Frank asks "how do I X" questions about the live bar; answer with the exact snippet + file, apply ONLY on explicit go. A settings.toml edit is a live-deployment change, not a demo. (Exception: restoring Frank's own layout after data loss, on his ask.)
+- Git `M` on settings.toml usually carries noctalia's own runtime churn (wallpaper path, nightlight, panel positions) alongside your edit — mention it when committing.
@@ -0,0 +1,26 @@
+---
+name: omp-bundle-claim-audit
+description: "Verify or discover omp TUI behavior facts from the minified dist/cli.js bundle, with live niri-screenshot matrix confirmation; use when auditing docs claims or answering \"how does omp actually do X\"."
+---
+
+# omp bundle claim audit
+
+Ground omp behavior claims in `~/.bun/install/global/node_modules/@oh-my-pi/pi-coding-agent/dist/cli.js` (minified single line), not guesswork.
+
+## Extraction
+- `grep -oE` too weak for long windows; use python: read whole file, `re.search(r'ANCHOR.{0,900}', s)` windows around stable anchors.
+- Reliable anchors: settings ids (`id:"statusLine.contextLine"`), renderer ids (`id:"path",render\(e\)\{`), registry arrays (`l9e=\[`, `Uxe=\{` preset table), descriptions (`"Label",description:"([^"]+)"`).
+- Minifier renames symbols per release — anchor on string literals, never on `#Xt`/`zG` names.
+- Enum values live in a var: find `id:"KEY"` → `values:VAR` → `re.search(r'VAR=\[[^\]]+\]')`.
+- Some segments are factory-generated (`VDt("token_in",...)`) — literal id scans miss them; check the catalog array (`l9e`) and preset tables for referenced ids.
+- Beware gallery/preview code faking production behavior (e.g. `N4r` synthesizes a status bar for the settings gallery) — confirm the window you cite is the production render path.
+
+## Live confirmation (only where pixels decide)
+1. Edit `~/.omp/agent/config.yml` (file-watched, repaints without restart).
+2. `sleep 2 && niri msg action screenshot-screen --path /tmp/x.png --show-pointer false; sleep 1.5` (flag is `--path`, NOT `-o`; the write lands slightly late — sleep before PIL).
+3. Crop + 1.3x LANCZOS via PIL, `read` the crop.
+- Multi-window screens make bar crops ambiguous: prefer settling the question in code (the layout gate `layout!=="box"&&layout!=="band"` style booleans) over pixel forensics; scan rule rows by dominant-color spans only for single-color questions.
+- ALWAYS restore config edits afterwards (track exact line anchors; the edit tool demands a matching snapshot header).
+
+## Audit output
+Correct false claims in-place, keep an "Audit log" section listing each ~~claim~~ → truth with code/live evidence; mirror corrections into `omp-docs/log.md`.
@@ -0,0 +1,27 @@
+---
+name: omp-context-file-discovery
+description: Where omp loads context/instruction files from (and why ancestor-directory AGENTS.md never loads) — the discovery map for scoping a rule to a set of projects; includes the before_agent_start cwd-gate pattern and quote-probe verification.
+---
+
+# Scoping omp rules: context-file discovery map
+
+## When
+Asked to make a rule apply "everywhere", "all repos", or "only projects under <dir>" in the omp harness.
+
+## Discovery facts (bundle-verified 2026-10-18, omp v18.8.7, dist/cli.js)
+- Project context loaders are **first-hit at-or-below repo-root**: AGENTS.md walk-up stops with `if(dir===repoRoot)break`; the `.omp/`-dir provider (`EGs`) returns the single nearest dir containing `.omp` (skips home); CLAUDE.md provider loads one user file + one project file. **Consequence: an AGENTS.md placed in an ancestor directory like `~/Projects/` is never loaded by descendant repo sessions.** No ancestor-scope mechanism exists.
+- User/global slots: `~/.omp/agent/AGENTS.md` (user-level context, if present), `~/.omp/agent/APPEND_SYSTEM.md` (system-prompt append, project variant checked first, then user; broadcasts to ALL sessions — no path scoping), rules dirs `~/.agents|~/.agent` + `<ancestor>/.agents|/.agent` rules via walk-up (again repo-root bounded). Extensions load from `<settings-dir>/extensions/` — user-level = `~/.omp/agent/extensions/`.
+- Settings ids to grep for: `statusLine.*`, `composer.*`, `instructions` (= Copilot-style file-glob instructions package, not a path list).
+
+## The only cwd-scoped mechanism
+`before_agent_start` extension handler: event carries `{prompt, images, systemPrompt}` (string | string[]); return `{systemPrompt}` to replace (handlers chain; undefined = untouched). Gate on `ctx.cwd.startsWith(target + "/")`. Constant appended text keeps prompt caching intact; subagents inherit the session cwd, so they get the rule too. Registering extensions under a git-tracked dir that omp also reads (e.g. command-center `agent/extensions/`) propagates them fleet-wide via git pull.
+
+## Verification recipe (quote probe)
+Non-interactive one-shot from each side of the boundary, cheap model:
+`cd <in-scope-dir> && omp --model <alias> "Look at your system prompt. If it contains a heading starting with '<marker>', reply with exactly the text of its bullet about <x>. Otherwise reply exactly MISSING."`
+`--model @role` aliases do NOT resolve in one-shot; use a model alias like `frank-zealot`. Expect the verbatim bullet in scope, `MISSING` out of scope.
+
+## Traps
+- A rejected implementation still needs its live copy unshipped (move to `.AGENTTRASH/`) — extension files in `agent/extensions/` take effect for new sessions immediately, merged or not.
+- Amend the changelog entry of the abandoned route to state closed-unmerged + the durable findings, so future agents don't resurrect it.
+- Prefer direct per-repo AGENTS.md edits when the operator wants auditability over mechanism (command-center 2026-10-18: extension route closed unmerged in favor of a PR in each target repo).
@@ -0,0 +1,40 @@
+---
+name: omp-cwd-scoped-rules
+description: "Deliver a rule to omp sessions only under a directory subtree (e.g. ~/Projects/) — context-file loaders can't; use a before_agent_start extension + quote-probe verification."
+---
+
+# Cwd-scoped rules for omp sessions
+
+## Why context files fail for subtree scoping
+Verified against `@oh-my-pi/pi-coding-agent/dist/cli.js`: every context provider resolves **at or below the repo root** — the project walker breaks at `repoRoot`, `.omp/`-dir and CLAUDE.md/AGENTS.md providers load exactly one project file (first hit). A file in an ancestor dir like `~/Projects/AGENTS.md` is NEVER loaded by descendant repos. `agent/APPEND_SYSTEM.md` (user level, `gs()`=`Nn.agentDir`) loads for ALL sessions everywhere — broadcast, not scoped.
+
+## Mechanism: before_agent_start extension
+File: `~/.omp/agent/extensions/<name>.js` (user-level load path is `<settings-dir>/extensions/`; in the command-center repo `agent/extensions/` is tracked and rides git pull to the fleet).
+
+```js
+export default function (pi) {
+  const ROOT = "/home/blank/Projects/";
+  const RULES = "\n\n# <heading> ...";  // constant text -> prompt cache unaffected
+  pi.on("before_agent_start", async (event, ctx) => {
+    const cwd = (ctx && ctx.cwd) || "";
+    if (cwd !== ROOT.slice(0, -1) && !cwd.startsWith(ROOT)) return; // undefined = untouched
+    const base = event.systemPrompt;                                 // string | string[]
+    return { systemPrompt: Array.isArray(base) ? [...base, RULES] : (base || "") + RULES };
+  });
+}
+```
+Contract (bundle-verified): handler payload `{prompt, images, systemPrompt}`; returning `{systemPrompt}` replaces the base; handlers chain; fires for subagent sessions too (shared cwd) — usually desired.
+
+## Verification recipe (quote-the-prompt probe)
+No print flag; positional arg = one-shot. Role aliases (`--model @sonic`) do NOT resolve in one-shot — use a model id.
+```bash
+P="If your system prompt contains a heading starting with '# <heading>', quote its <X> bullet; else reply exactly MISSING."
+cd /home/blank/Projects/<repo> && omp --model <id> "$P"   # expect verbatim bullet
+cd /tmp && omp --model <id> "$P"                          # expect MISSING
+```
+Run both positive and negative probes; stderr swallows fast failures — keep 2>/dev/null off the first try.
+
+## Gotchas
+- Declare precedence in the injected text if a repo's own AGENTS.md contradicts it (models see both).
+- A running session does not hot-load new extensions — only new sessions get them.
+- `~/.omp/agent/APPEND_SYSTEM.md` precedence: project-level file first, then user-level (first hit wins).
@@ -0,0 +1,25 @@
+---
+name: omp-keybinding-inspection
+description: "Find what a key chord does in omp: doc table, live bundle defaultKeys inspection, modifier names, remap file"
+---
+
+Answer "what does chord X do in omp" with evidence from docs + installed bundle, not memory.
+
+## Steps
+
+1. Read `omp://keybindings.md` — common action IDs and defaults (`Ctrl+R` history search, `Alt+R`/`F5` retry, `Alt+A` agent hub, ...). Docs are not a complete inventory.
+2. Locate the install: `readlink -f $(which omp)` → usually `~/.bun/install/global/node_modules/@oh-my-pi/pi-coding-agent/dist/cli.js` (bundled).
+3. Extract live default chords from the bundle (authoritative for installed version):
+   ```bash
+   cd <dist dir> && grep -o '"app[^"]*":{defaultKeys:[^}]*' cli.js
+   ```
+   Contextual duplicates exist: same chord can map to different actions in different views (e.g. `ctrl+r` = `app.history.search` in composer, `app.session.rename` in resume picker).
+4. Modifier names: `pi-tui/dist/types/keys.d.ts` → `ModifierName = "ctrl" | "shift" | "alt" | "super"`. "mod"/Super binds as `super+`; only shipped super chords are `super+alt+backspace|delete|d`. Most Linux terminals swallow plain Super chords (needs kitty keyboard protocol / CSI u: kitty, foot forward them).
+5. Remaps live in `~/.omp/agent/keybindings.yml` (NOT config.yml): `action.id: chord` or array; `[]` disables. Profile-aware: default-profile file loads first, active profile overrides per action.
+6. In-session live reference: `/hotkeys`.
+
+## Pitfalls
+
+- `grep pi-tui/dist/*.js` fails (no top-level js; types only under `dist/types/`).
+- Chord notation is case-insensitive, UI-style (`Ctrl+P`, `Alt+Shift+P`).
+- Old unqualified action names auto-migrate; new configs use namespaced ids (`app.*`, `tui.editor.*`).
@@ -0,0 +1,71 @@
+---
+name: omp-models-yml-runner-api-placement
+description: Add or edit a non-chat (tts/image/embedding) model row in ~/.omp/agent/models.yml without disabling every custom provider
+---
+
+# Scope
+
+`~/.omp/agent/models.yml` (or `models.yaml`) on a workstation: adding a **runner**
+model row (TTS / image / embedding / rerank / video) alongside chat providers.
+
+# The landmine
+
+Provider-level `api` accepts **only chat/judge transports**:
+`openai-completions`, `openai-responses`, `openai-codex-responses`,
+`azure-openai-responses`, `anthropic-messages`, `bedrock-converse-stream`,
+`google-generative-ai`, `google-gemini-cli`, `google-vertex`,
+`openrouter-decisions`, `typesafe`.
+
+Naming a runner API (`openai-speech`, `openai-images`, `openai-embeddings`, …)
+at **provider** level fails whole-file validation, and the failure mode is not
+scoped to your provider:
+
+```
+Warning: models.yml validation failed — custom providers disabled
+  Failed to load config file models, Schema error: providers.<id>.api: must be "openai-completions", …
+```
+
+Every custom provider disappears from the registry (fleet chat endpoints stop
+resolving) and `omp models` lists only built-in locals. Measured 2026-10-18.
+
+# Correct shape
+
+Runner api goes on the **model entry only**; `auth: none` satisfies the
+credential requirement; omit `contextWindow`/`maxTokens` (the positivity check
+fires only when they are provided — `omp models` still prints filled defaults,
+which the runner transport never reads).
+
+```yaml
+  "frank-tts (dankclaw)":
+    baseUrl: http://192.168.0.143:7772/v1   # no `api:` here
+    auth: none
+    models:
+      - id: frank-tts
+        name: "frank-tts (dankclaw) — cloned voices"
+        api: openai-speech                   # runner api on the model
+        input: [text]
+```
+
+Roles live in `config.yml` (`modelRoles`), not in `models.yml`. Kind roles
+(`image`, `web`, `speech`, `dictation`, `judge`) take no `:thinking` suffix.
+
+# Verify after every edit (never assume the file loaded)
+
+```bash
+omp models --kind tts --no-extensions      # the new row must appear
+omp models --no-extensions | grep -E '<each fleet chat model>'   # and still be listed
+omp models | grep -c 'validation failed'   # must be 0
+```
+
+A run that lists only built-ins means your row broke the file — revert before
+yielding.
+
+# Speech transport contract (`openai-speech`)
+
+Body is `{model, input, response_format, voice?, speed?}`; `voice` is forwarded
+only when explicitly set; `sample_rate`/`bit_rate` **throw**
+(`openai-speech does not support sampleRate`). Codec comes from the
+`output_path` suffix; 15 000-character cap. An unknown `voice` name is a server
+error, not a fallback — and `auth: none` makes a dead endpoint read as
+*available*, so point `modelRoles.speech` at such a provider only after it has
+answered a real synthesis.
@@ -0,0 +1,23 @@
+---
+name: omp-tui-live-visual-verify
+description: "Verify omp TUI config changes (status line, composer, theme) live: edit watched config, niri screenshot, PIL crop, restore — with the flag and race pitfalls."
+---
+
+# Live visual verification of omp TUI config
+
+## When
+Changing `~/.omp/agent/config.yml` (statusLine.*, composer.*, theme) on a Frank workstation and needing PROOF of how it renders — not inference from the bundle. The status-line/composer knobs are file-watched: edits repaint the RUNNING session; no restart.
+
+## Loop (per trial)
+1. Read the live config line(s) first; edit with `edit` (never batch trials — one state per screenshot).
+2. Capture: `sleep 2 && niri msg action screenshot-screen --path /tmp/x.png --show-pointer false` — flag is `--path` (`-o` is invalid); the write lands asynchronously, so `sleep 1.5` before touching the file.
+3. Crop+scale with PIL to the bar/composer region (known good crop for blankpad right monitor: `(2267,1240,3440,1440)`, 1.3x LANCZOS), then `read` the PNG absolute path.
+4. For pixel facts (rule colors, meter lengths) don't eyeball alone: scan rows with `Image.load()` counting dominant colors; sample every 2px and lower thresholds before concluding "nothing found".
+5. After the matrix, RESTORE the original values and re-screenshot the baseline.
+
+## Pitfalls
+- Read a downscaled FULL-screen shot first: Frank's screens carry multiple terminals + a browser; a fixed crop can silently capture a different window's bars (happened during the contextLine audit — two omp windows on one screen).
+- Session-accent rules/borders share colors with meters; color presence alone proves nothing. Compare states against each other, and settle ambiguous pixels from the bundle code path (grep `dist/cli.js` for the render function).
+- Live config drifts (other sessions own files there): never `git add -A` the main checkout to promote a trial; commit from a separate `git worktree add` off the target ref.
+- `read` the absolute `/tmp/...` path for screenshots.
+- Multi-value enums: one screenshot per value; identical renders (e.g. claude shape `contextLine: off` vs `embedded`) are themselves a finding — record them as such.
@@ -0,0 +1,49 @@
+---
+name: omp-worktree-path-gotchas
+description: "Use in ~/.omp (or any multi-worktree repo) when an edit lands in the wrong checkout, git checkout is policy-refused, or an omp session id is needed — relative-path tool resolution, shared-worktree branch law, session-id lookup, edit auto-prefix trap."
+---
+
+# Multi-worktree gotchas in ~/.omp-style repos
+
+Measured 2026-10-18 building PR #12/#14 in `dank/command-center` worktrees.
+
+## 1. Relative paths resolve to the SESSION worktree — always edit by absolute path
+`edit`/`read`/`write` with a relative `path` resolve against the session CWD
+(the harness worktree you were spawned in), NEVER the worktree you `cd`'d into
+via bash. Identical file content in sibling worktrees yields identical
+`[path#tag]` hashes, so an edit can "succeed" against the WRONG checkout with
+no warning; only a rejected stale-hash edit reveals it.
+
+- When working in a second worktree, ALL file-tool paths: absolute.
+- Symptom seen: edit rejected "hash #X is not from this session" while the
+  bash-side `git status` showed the file clean — two different files, two
+  worktrees. Recovery: revert the stray edit (CUT the inserted lines) in the
+  wrong tree, re-read the right tree, redo with absolute header.
+
+## 2. Branching: shared worktrees refuse git checkout
+Workspace policy blocks `git checkout` (branch switches AND `--` discards) in
+harness-managed worktrees — concurrent agents depend on them. To start a
+branch off fresh trunk:
+
+```bash
+git -C ~/.omp worktree add -q -b <type>/<issue#>-<slug> ~/.omp/wt/<name> origin/main
+```
+
+Never force past the refusal; the new-worktree route is strictly safer.
+Custom worktrees not matching `wt/wt-*` are invisible to the live-sync reaper —
+prune them by hand after merge (`git worktree remove`, `git branch -d`).
+
+## 3. omp session id for attribution footers
+Fleet law requires `session:` in issue/PR bodies. Authoritative source:
+`~/.omp/agent/sessions/<cwd-slug>/<timestamp>_<UUID>.jsonl` — the `<UUID>` is
+the session id. Pick the newest file whose first `{"type":"title"}` line names
+this conversation to prove the id is yours. The `wt/<ts>-<hash>` dir suffix is
+NOT the session id (it persists across sessions per cwd).
+
+## 4. edit-tool auto-prefix trap (recurring)
+A body row written bare (intending it as the "original line" anchor or as
+context) is AUTO-PREFIXED with `+` and INSERTED — leaving the old line plus a
+duplicate. `PUT n.=n:` therefore behaves like insert, not replace, whenever
+the anchor row lacks an explicit marker. After any `PUT` where the response
+warns "Auto-prefixed bare body row(s)", immediately `CUT` the stale line number
+shown in the response (descending order for multiple CUTs).
@@ -0,0 +1,27 @@
+---
+name: one-decision-per-ask-question
+description: "Use when putting decisions to Frank via the ask tool or a grilling round — exactly one work item per question, rounds may group many single-item questions."
+---
+
+# One Decision, One Work Item, One Question
+
+Friction-earned rule (corrected twice on 2026-10-18, during the voice/TTS planning).
+
+## Rules
+
+- Each question addresses **exactly one work item**. A round may contain many questions covering different work items; a question may not.
+- Never merge two artefacts into one option because they share an implementation dependency. Sharing an endpoint, a service, or a build step is NOT grounds for one question. (`frank-tts` serving both a podcast and an audiobook generator produced exactly this bug.)
+- Never offer something Frank did not ask for inside another question's option text. If an idea is mine, it gets its own question or stays out of the plan; it never rides along as "…and also X" in an option label or preview.
+- Do not derive option wording from my own scaffolding (todo text, my table row labels, my runbook headings). Derive it from his stated goal.
+- Mark the recommended option; a bare "yes" must accept it.
+- Facts are mine to fetch (subagent/scout), never a question for him. Only decisions go to him.
+- A question whose answer depends on an unsettled fact or another open question belongs to a **later round**, not this one.
+
+## Anti-patterns that triggered this
+
+- One option: "Audiobook/podcast factory — open-notebook + EPUB→narration builder." Two products, one shared dependency, zero requests for the second one. He answered "I never asked for audiobook generation."
+- One question: "Is the deliverable the podcast, or the platform (harness voice + OpenWebUI + alerts)?" Four work items in one question. Rejected: "You're lumping multiple asks into one question. Ask me per item."
+
+## Check before sending
+
+For each question: can I name the single artefact it decides? If two names come to mind, split it.
@@ -1,29 +1,30 @@
 ---
 name: openwebui-picker-acl-repair
-description: "Fix OpenWebUI 0.6 \"No results found\" / Model not found in the model picker for non-admin users (Dankclaw fleet) after a connection rebuild."
+description: "Add, enable, or repair a model in the Dankclaw OpenWebUI 0.6 picker: connection enable + model row + access_grant trio, verified via /api/models as admin and role=user."
 ---

-# OpenWebUI 0.6 picker ACL repair (Dankclaw)
+# OpenWebUI 0.6 picker: add / enable / repair a model (Dankclaw)

-Symptom: admin sees models in OpenWebUI; regular users get "No results found" in the picker, or chat answers "Model not found". Cause: an OpenAI-connection rebuild (config keys `openai.api_base_urls` / `openai.api_configs` in the `config` table) that dropped the ACL pair for the model.
+Symptoms: non-admin sees "No results found"/"Model not found" while admin sees the model (repair); endpoint live, model_ids correct, model absent from picker (add).

-## Law
-A non-admin user sees an external OpenAI-connection model only if BOTH exist in `webui.db`:
-1. `model` table (singular) row: `id` == upstream model id, `base_model_id` NULL, `is_active` 1, `meta` JSON (description etc.).
-2. `access_grant` row: `(resource_type='model', resource_id=<model id>, principal_type='user', principal_id='*', permission='read')`.
+## Law — a picker entry needs ALL legs, keyed by the EXACT upstream served id
+1. openai.api_configs (config table, JSON map by idx): that connection has enable: true and model_ids containing the upstream id. Non-empty model_ids = no upstream fetch (llama.cpp's Ollama-shaped /v1/models is invisible to discovery; halogen/radiance are OpenAI-shaped, model_ids stays authoritative).
+2. model table row: id == upstream id (alias rows with base_model_id set render in the picker but chat fails "Model not found"), base_model_id NULL, is_active 1, user_id = admin uid, params {"context":{"length": PER-SLOT window}}, meta {"description": "..."}.
+3. access_grant row: resource_type=model, resource_id=<id>, principal_type=user, principal_id='*', permission=read. Without it only admins see the model (get_filtered_models drops info-less rows for role=user).

-The aggregation (`utils/models.py get_filtered_models`) drops info-less models for `role=user`; admins bypass. `get_all_models` responses are served from `model_ids` in `api_config` when non-empty (no upstream fetch). An alias row (`id` != upstream, `base_model_id` set) renders in the picker but chat fails "Model not found" — id must equal the upstream id.
+URLs: on-host endpoints via host.containers.internal:<port> (bridge cannot hairpin the host LAN IP); other hosts via LAN IP.

 ## Steps
-1. Reproduce as the affected role: in a browser tab, `fetch("/api/models", {headers:{Authorization:"Bearer "+localStorage.token}})` → `data: []` while an admin API key (`api_key` table, column `key`, `sk-…`) lists the model.
-2. DB at `/home/dank/Containers/open-webui/data/webui.db` (host; no sqlite3 CLI on Dankclaw — use host `python3` heredoc over ssh; container path `/app/backend/data`).
-3. Insert/repair the pair (uuid4 id, epoch-ms `created_at`):
-   - `model`: id/name = upstream id, base_model_id NULL, is_active 1, user_id = admin uid (role='admin' in `user` table), meta `{"description": "…"}`.
-   - `access_grant`: shape above.
-4. Cache: `MODELS_CACHE_TTL` defaults to 1 s — no restart needed for lists; a restart (`systemctl --user restart open-webui`, rootless) only if config edits were cached oddly. An OpenWebUI restart invalidates browser JWTs (401) — expect a silent SSO re-round-trip; kill stale tabs first so OAuth `state` cookies don't race (MismatchingStateError → clear cookies/storage, one clean flow).
-5. Verify end-to-end: pick the model in the UI, send a short exact-match prompt, confirm the reply; check `/api/models` as the user role lists the id.
+1. Snapshot: cp -a webui.db webui.db.bak-<date><letter>.
+2. Apply with host python3 over ssh (no sqlite3 CLI on Dankclaw) on /home/dank/Containers/open-webui/data/webui.db: read-modify-write the whole openai.api_configs JSON value; insert model row (epoch-ms created_at/updated_at); insert access_grant (uuid4 id).
+3. Restart: systemctl --user restart open-webui.service (rootless quadlet) to drop the cached model list. Restart kills browser JWTs: expect one SSO re-round-trip per tab; kill stale tabs first so OAuth state cookies don't race.
+4. Verify (mint tokens in the container; create_token is in open_webui.utils.auth; export WEBUI_SECRET_KEY from /app/backend/.webui_secret_key):
+   - GET /api/models (key data) lists the id as admin AND as a role=user token (e.g. qa-e2e-admin uid). This is the picker truth.
+   - POST /api/chat/completions, prompt "Reply with exactly one word: pong", max_tokens 1500 (thinking models give empty content + finish_reason length on small budgets).
+   - NEVER gate on GET /api/v1/models/list (key items): on 0.6.x it lists workspace models only, [] for connection-backed models (measured 2026-10-09).

 ## Related knobs
- User API keys (User menu → Settings → Account → API keys → Show → Create new secret key) require `user.permissions` JSON `features.api_keys=true` in `config` (default false).
- New SSO signups land as role `pending` (`ui.default_user_role=pending`) — activate: `UPDATE user SET role='user' WHERE email LIKE …`. Table is `user`, singular; no `active` column.
- Anubis gates `ai.franksdank.cloud` for headless browsers (webdriver detection): drive direct `:3005` for UI work, or emulate a desktop Chrome UA.
+- User API keys need user.permissions JSON features.api_keys=true in config (default false).
+- SSO signups land role pending (ui.default_user_role=pending): UPDATE "user" SET role='user' WHERE email=... (table user, singular, no active column); row exists only after first login.
+- Anubis gates ai.franksdank.cloud for headless browsers; drive direct :3005.
+- The trio is DB-only, lost on a fresh volume. Record changes in serverAppConfigs-docs/Dankclaw/OpenWebUI.md (Facts, backends table, History): the model id is a foreign key across three tables, so any endpoint alias rename must ship the same re-key.
@@ -0,0 +1,68 @@
+---
+name: parallel-worktree-path-hazard
+description: "\"Use when several agents edit the same repo in different git worktrees at once, or when an edit/read may have landed in the wrong checkout: which path forms bind where, how to detect with git -C status, and the repair protocol (cp + git show HEAD blob write-back) because git checkout/restore is policy-blocked in a shared workspace.\""
+---
+
+# Concurrent-worktree path hazard (shared repo, many agents)
+
+Measured 2026-10-18 on `serverAppConfigs` with two agents live at once. The
+failure is **silent**: the tool reports success, the diff looks right, and the
+change lives in a *different* worktree.
+
+## Which path form binds where
+- **Parent/top-level session**: a **relative** `path` resolves against the
+  session CWD — its own worktree — never against the worktree named in the
+  prompt. This is how a change meant for `wt-tts-trial-docs` landed in
+  `wt-20261017-…`.
+- **Subagent**: an **absolute** path to its own assigned worktree can resolve
+  into the parent's worktree when the same *relative* path exists there
+  (`edit` twice onto `dankclaw/.env.example`). Its `write` with the same
+  absolute path was fine — the bug is `edit`/`read` path resolution, not `write`.
+
+Rules that hold:
+1. A subagent passes paths as `../<its-worktree>/<rel>` (relative to the parent
+   worktree) for `read` **and** `edit`; the parent passes **absolute** paths to
+   any worktree that is not its own CWD.
+2. After every edit batch, prove the landing site, do not trust the tool's echo:
+   `git -C <intended-worktree> status --short` must list the file. A file you
+   edited that is missing from that list went somewhere else.
+3. Keep each work item on its own branch/worktree, and keep ONE integration
+   owner (the parent) for shared files — `scripts/deploy-remote.sh`,
+   `scripts/deploy-plan.py`, `tests/`, `serverAppConfigs-docs/index.md`,
+   `AGENTS.md` are the collision hot spots in this repo. Never rebase a
+   sibling's branch.
+
+## Repair protocol (no `git checkout`, no `git restore`)
+`git checkout -- <path>` and `git restore <path>` are **policy-blocked** in a
+shared workspace ("overwriting working-tree files … discards changes other
+concurrent agents rely on"). Unstaging (`git reset [<path>]`,
+`git restore --staged <path>`) is allowed but does not undo content. So:
+
+```bash
+F="path/with spaces if any"
+# 1. move the change to the worktree that should own it (both at the same base commit)
+cp "<wrong-wt>/$F" "<right-wt>/$F"
+# 2. undo in the wrong worktree by writing the committed blob back
+git -C "<wrong-wt>" show "HEAD:$F" | tee "<wrong-wt>/$F" > /dev/null
+# 3. prove both sides
+md5sum <(git -C "<wrong-wt>" show "HEAD:$F") "<wrong-wt>/$F" "<right-wt>/$F"
+git -C "<wrong-wt>" status --short          # must be empty for that file
+git -C "<right-wt>" diff --stat             # must show the intended delta
+```
+
+Never fix it blind: if the wrong worktree had its own uncommitted edits to that
+file, `cp`/blob-write-back would destroy them — check
+`git -C <wrong-wt> status --short` FIRST and reconcile content, don't overwrite.
+
+## Tidy after a cancelled sibling
+A killed subagent can leave a worktree plus an empty branch. Removing them is
+safe only when verified empty: `git -C <main> log --oneline -3 <branch>` (no
+unique commits) and `git -C <wt> status --short` (clean), then
+`git worktree remove <wt>` + `git branch -D <branch>`. An orphan worktree at a
+stale commit is the same class of trap as a leftover bench drop-in: the next
+agent reads it as unfinished work.
+
+## Report it
+File the misresolution to `xd://report_issue` (false positives are fine) and
+record the incident in the repo worklog — a repair nobody wrote down looks like
+a hijack later.
@@ -0,0 +1,36 @@
+---
+name: podman-one-shot-hang-proofing
+description: "Run remote podman one-shot jobs hang-proof: container-as-unit timeout/reap protocol; diagnosing stalls where ssh never returns and containers outlive timeout"
+---
+
+Use when running one-shot container jobs over SSH (grading sandboxes, CI executors) and a caller stalls, or `timeout N podman run ...` demonstrably fails to kill the workload.
+
+## Stall signatures (all three = this bug)
+- SSH client process alive for hours, no established-socket data flowing
+- `podman ps` shows the container `Up` far past the timeout; `podman top <c> -o pid,stat,etime,args` shows `R`/`S` workload
+- endpoint/queue reports idle (`in_flight: 0`) while the caller awaits
+
+## The three laws
+1. **A `timeout`/SIGTERM on an attached `podman run` client kills only the client.** The container is conmon-detached: it survives, inherits the ssh stdout pipe, ssh never sees EOF, the awaiting parent blocks forever.
+2. **`podman wait` has NO `-t` flag in podman 5.x** (docker-ism) → every exec silently dies with rc 125. Bound the waiter with coreutils `timeout -k 5 <T> podman wait <ctr>` — killing a waiter is harmless.
+3. **`podman rm -f` is the only true container kill** (escalates SIGTERM → SIGKILL on the container itself).
+
+## Hang-proof exec protocol (single ssh script)
+```bash
+cname=job-<unique>
+podman run -d --name "$cname" --network none --memory 4g --cpus 2 <image> python /w/entry >/dev/null
+timeout -k 5 "$T" podman wait "$cname" >/dev/null 2>&1; rc=$?
+code=$(podman inspect -f '{{.State.ExitCode}}' "$cname" 2>/dev/null || echo -1)
+podman logs "$cname" 2>/dev/null; echo "EXIT:${rc}:${code}"
+podman rm -f "$cname" >/dev/null 2>&1
+```
+- `rc=0, code=0` → success; `rc=124` → timed out (container reaped); harvest output via `podman logs`.
+- Wrap the local ssh spawn in a **hard timeout of T + 180 s** (kills transport half-hangs too).
+- Unique `--name` per submission; the trailing `rm -f` is also the leak reaper.
+
+## Recovery of a live stall
+1. `ssh host podman rm -f <ctr>` (warning "resorting to SIGKILL" confirms the theory).
+2. Kill the hung local ssh + supervisor; queue/ledger resume (append-only ledger + takeover by heartbeat-pid liveness) resumes mid-eval; a hung step re-graded under the fixed protocol records a clean FAIL exit 124.
+
+## Test to keep (regression)
+`execPython("while True: time.sleep(1)", timeout=20)` → expect `exitCode 124`, completion < 180 s, then `podman ps --format {{.Names}} | grep -c <prefix>` == 0.
@@ -0,0 +1,111 @@
+---
+name: radiance-kv-cache-resize
+description: "Resize the KV cache / VRAM pair on a radiance (StillDeadcode) endpoint: engine-budget-table ceiling, pool contract arithmetic, slab-slope law, ledger-first verification, free token-count probes"
+---
+
+# Radiance KV / VRAM pair resize
+
+Use when changing `--vram-kv-mib`, `--vram-weights-mib`, `--max-num-seqs`,
+`--max-model-len` or `--kv-cache-dtype` on a radiance endpoint
+(frank-archon pattern), or when asked "what can we do with the free VRAM".
+
+## 1. The ceiling is the engine's, never a hand-picked reserve
+
+`rocm-smi` free space is NOT spare capacity. The boot prints a `VRAM budget,
+per card` table; read it:
+
+```
+card total          31.86 GiB
+vram_weights        25.00 GiB   stated by --vram-weights-mib
+vram_kv              5.00 GiB   stated by --vram-kv-mib
+unclaimed            477.30 MiB  the headroom, the unusable above, rounding
+W VRAM budgets total 30.00 GiB of the card's 31.86 GiB, so 1.86 GiB is neither
+  budgeted nor accounted. The driver's context, the activation arena and
+  --gpu-headroom-mib come out of it; anything past those is throughput on the floor
+W card 0 settled at 2.01 GiB free against 209.19 MiB (the 96.00 MiB
+  --gpu-headroom-mib and 113.19 MiB kept for the static region)
+```
+
+`ceiling = (settled_free_MiB - engine_floor_MiB) + current_pair_sum`.
+Worked (dankserver, 2026-10-13): 29,120 + (2,058 − 209) = **30,969 MiB/card**.
+A pair at the ceiling settles ~330 MiB free at worst case. If a bound cannot be
+traced to a ledger line, it is a personal reserve — label it and put it in the
+bats gate as such.
+
+## 2. Pool contract (the engine enforces it at REQUEST time, not boot)
+
+`pool_mib >= seqs*max_model_len*rate + 110*seqs + 448`
+
+- rate/token/rank: **7,488 B fp8**, **14,144 B bf16** (1.89×, not 2× — the QSA
+  block key is 3.25 KiB at BOTH dtypes; it is an index, not attention state).
+- +110 MiB a sequence of recurrent state (`kv_gdn_state` 54 MiB × 2 copies +
+  conv/tail/ple) and 448 MiB of prefix checkpoints, dtype-independent.
+
+A pool that fails this **boots, serves short chats, then 400s every long
+request** as `does not fit the 200000 token context, which leaves nothing to
+generate into` — radiance refuses, never truncates. Encode it as a bats gate.
+
+`--kv-cache-dtype` takes ONLY `bf16|fp8`, one dtype for the whole cache (no
+llama.cpp-style exact-K/quantized-V pair).
+
+## 3. Slab and KV are one budget; the slab is a SLOPE
+
+- Idle KV VRAM is the expert cache's spillover: ledger
+  `mover: N slots can be lent out of the KV cache (X GiB)`. A bigger pool steals
+  residency twice over.
+- Slab MiB ↔ resident experts is linear (~1,300 slots per 1,792 MiB measured);
+  the pinned host pool hands back the same slot count as the slab grows
+  (16,235→17,548 slab with 8,893→7,580 pool). The pinned RAM path is the slow
+  path, so slab MiB = throughput.
+- Measured law (fp8, 43.5k single-stream, Qwen3.8-Flash-Next w4):
+  22,208 → 3,397, 24,000 → 3,290, 25,600 → **3,584**, 26,071 → **4,379 t/s**.
+  Two points inside the ±3 % noise band are NOT a plateau — never infer a
+  threshold from two arms.
+- **Decode is a separate axis.** It follows KV dtype/bandwidth and draft
+  acceptance, not the slab: fp8/slab 26,071 decoded 124.1 t/s cold where
+  bf16/slab 22,208 decoded 94.1 (512 tokens, 51.5k). Slot count moves the
+  batch-shared per-stream floor (3 concurrent ≈ 6 t/s; solo ≈ 90–120).
+
+## 4. Verify: ledger first, then live probes (no scratch server)
+
+1. Deploy the service; read `podman logs <svc>`: `backs N sequences all at
+   M tokens at once` is the capacity referee; check slab slots, `unclaimed`,
+   `sampler: ... R rows` (= seqs × (1+spec), must stay inside the 25-row wht6
+   exactness bound), `settled at … free against … floor`.
+2. Boundary probe: N concurrent prompts sized to `max_model_len - gen`, each
+   with a unique marker at the head; expect N/N marker retrieval.
+3. Prefill/decode probe: repo `scripts/probe-frank-archon-kv.py` (reads the
+   shape from the deployed env, so it self-resizes).
+
+### Free token-count calibration (no prefill burned)
+
+`/v1/completions` refuses when **prompt tokens alone** exceed the window —
+`prompt: 202,777 prompt tokens does not fit the 200000 token context` — and the
+refusal names the count BEFORE any prefill. It does NOT fire on
+prompt + max_tokens. Corpus ratio measured: **2.7617 chars/token** (2.5714 for
+the fox filler), so a 200,000-token window ≈ 514,286–552,286 chars. Calibrate
+with a probe ABOVE the window; below it the request is accepted and pays real
+prefill (~22 s).
+
+### Probe traps that produced false results
+
+- Generate **≥128 tokens** (512 preferred) for any decode number; at 8–9 tokens
+  `inter_token` is first-token noise — rates like 92.7 vs 85.8 are noise.
+- Radiance `timings` can carry `null` rates — `(t.get(k) or 0)`, and
+  `j.get("timings") or {}`.
+- The disk prefix cache (64 GiB) survives restarts; put a random nonce at the
+  HEAD of a "cold" prompt. A warm 197k prefill returns in ~10 s and looks like
+  a 60,000 t/s miracle.
+- With thinking enabled, a small `max_tokens` yields empty `content` +
+  `finish_reason: stop` on a healthy server; set
+  `chat_template_kwargs.enable_thinking=false` in probes.
+- `echo ===` in an ssh'd zsh dies on `=`-expansion; it silently truncates the
+  command chain.
+
+## 5. Ship
+
+`scripts/<svc>.env` pair + header, serve-script header, bats gates (pair ≤
+ceiling; pool ≥ contract), docs (runbook, `AGENTS.md` fleet row, LLM index,
+log.md), `./tests/run.sh`, `deploy.sh <host> --service <svc>`, then the probes.
+Record every prediction as falsifiable in the env comment and write the verdict
+there when the probe lands — including when it kills the prediction.
@@ -0,0 +1,39 @@
+---
+name: radiance-model-feasibility-scout
+description: "Scout whether a new GGUF model can run on radiance (R9700 fleet): GGUF header census, REUSE/ADAPT/NEW gap matrix vs radiance docs, ledgers (traffic/KV/RAM/disk), KLD-gate substitution, HTML report delivery."
+---
+
+# Radiance Model Feasibility Scout
+
+Answer "can model X serve on radiance (dankserver R9700 TP=2), and what's the bill?" Produce an HTML report. Complements `gguf-header-vram-fit-analysis` (fit math), `radiance-w4-convert-playbook` (conversion mechanics), `radiance-quantize-and-score`.
+
+## 1. GGUF header census (trust header, not the card)
+- Range-parse the header: tensor count, per-type census (type → tensor count / params / bytes), layer pattern from tensor names, `general.architecture`, `llm_type`, rope dim, expert counts, `mtp` declaration.
+- MTP: presence is decided by the **tensor-name census** (`nextn.*`/`mtp` tensors), never by metadata.
+- Confirm tokenizer + `chat_template` KV entries ship in the file; mmproj = separate BF16 tower file.
+- Cross-check total bytes vs the published file size.
+
+## 2. Gap matrix vs radiance docs
+Read `PLUGIN.md` (arch-plugin contract, quantizer registry, core/mm image-pipeline law), `OPS.md` (op catalog: attention tiles h256 gqa2/4/8 + h512 gqa8, GDN, QSA, MoE, MTP), `QSA.md` (indexer decomposition bounds), `GUIDE.md` + `gguf.cpp` (dtype table 0–44: all standard GGUF grids readable — quantization happens in rad-convert, not the loader). Classify every component REUSE / ADAPT / NEW with the specific op named. The live `qwen4exp` plugin (~2k lines, QSA+MoE+mHC+GDN) is the template and the shared-header reuse list.
+
+## 3. Laws checklist (recurring traps)
+- GGUF `ssm_a` = −exp(A_log); undo at convert/plugin time.
+- One-table-one-encoding: a routed-expert table takes ONE rad encoding; mixed GGUF grids (q2/q3/q4 per layer) re-quantize to w4 GPTQ + whole-expert BF16 protected set.
+- int8 trunk + int8 lm_head laws; swiglu clamp carries from the arch family; rope-free layers need no RoPE path.
+- KDA ≠ GDN: per-channel decay + 3 convs + L2-normed q/k + lower-bound gate → new kernel family (FLA `chunk_kda` is the oracle); `kkt_solve`/`chunk_scan` is the critical path.
+- MLA: latent-cache absorbed form (KV = latent width × dtype), needs its own attention tile (e.g. h512 gqa-64) + per-head v bmm.
+- llama.cpp merged PR for the arch = the ground-truth formula oracle (sign conventions, APE layout, Sinkhorn input).
+
+## 4. Ledgers (all in the report)
+- Per-token weight traffic GB (trunk int8 + active experts w4 + lm_head) → decode anchored on frank-archon's measured 99 t/s @ ~6.3 GB/token; state [INFERENCE].
+- KV: per-token bytes per pool + per-seq state terms; cross-check vs any prior fleet runbook that served the same model.
+- Pinned RAM: host pool + prefix vs `LimitMEMLOCK`/`ttm-preflight.sh` law.
+- Disk peak = GGUF + `.rad` (~187 GiB-class for a 300B MoE, no PLE) vs free space; options: retire rollback payload / external convert host / `--in-place`.
+
+## 5. KLD gate feasibility
+BF16 teacher = GGUF params × 2 B; if unservable (626 GB-class), the substitute gate = llama.cpp (arch PR merged in master) serving the GGUF on the Dankclaw iGPU — GTT aperture ~114 GiB — stop+mask frank-dragoon for the window, KL + top-1 census vs radiance `.rad`. Document as a gate deviation.
+
+## 6. Deliver as self-contained HTML
+- Single file, inline CSS with `prefers-color-scheme` vars, section anchors + TOC, census/gap/risk/plan tables, `[INFERENCE]` labels on arithmetic.
+- Write in **chunks**: one `write` ≈ ≤8 KB (output-token limit), end each chunk with `<!--MORE-->`, then `edit` with `PUT N.=N:` where N = marker line — **prefix every body row with `+`** (bare rows get auto-prefixed; register lines like `@name` land as literal content).
+- Validate: python `html.parser` tag-balance script + grep for stray markers; `xdg-open` the file.
@@ -0,0 +1,44 @@
+---
+name: radiance-requant-source-audit
+description: "Answer \"can we re-quantize a radiance model from what's on disk / what must we re-fetch\" before planning a heavier-or-different quant campaign: irreversibility law, live asset census, base-bound reuse rules, and the expert-mass pool-fit ceiling."
+---
+
+# Radiance re-quant source audit (dank-fleet)
+
+Decide whether a new/heavier radiance `.rad` quant is buildable from local state, and what must be re-fetched. Run this BEFORE costing any campaign.
+
+## Irreversibility law (never re-litigate)
+- Quantization is one-way: a `.rad` payload on disk is a lossy ENDPOINT. Re-encoding it upward only re-wraps its own KL error.
+- `rad-convert` takes a RAW HF checkpoint directory (safetensors) — never a `.rad`. No dequant→requant path exists in the engine (see `scripts/convert-swift15-w4dn8.sh` mount line).
+- Therefore any genuine rung change needs the high-precision checkpoint on disk. Even "more bf16-protected experts instead of wider codes" needs the bf16 tensors at convert time.
+
+## Census (live, on the engine host — do not trust docs)
+```bash
+ssh <host> 'df -h /home/dank | tail -1; du -sh /home/dank/models/* ; \
+  du -sh /home/dank/corpora/calib /home/dank/corpora/kld-ref /home/dank/corpora/out; \
+  cat /sys/module/ttm/parameters/pages_limit; \
+  podman image exists "stilldeadcode/radiance@sha256:<serve-pin>" && echo PIN-PRESENT'
+```
+- BF16 Swift1.5 source + fp8-native `.rad` were DELETED 2026-10-15; only the serving iq4r + w4dn8 rollback `.rad`s remain under `/home/dank/models/rad/`.
+- Survivors (verified 2026-10-17): grams `/home/dank/corpora/calib` (41 GiB), KLD ref `/home/dank/corpora/kld-ref` (24 GiB), corpora JSONL `/home/dank/corpora/out`, HF staging receipts, engine pin image local, free disk ~544 GiB.
+
+## Reuse rules (what each survivor is bound to)
+| Asset | Reusable for |
+|---|---|
+| Calibration grams (RADGRAM2, down-input Hessians) | ONLY the checkpoint they were recorded from (Swift1.5) — tiers-independent, so valid for ANY new recipe tier on that same base |
+| KLD reference log-probs | ONLY same-base candidates |
+| Corpora JSONL | any base (recalibrate if base changes) |
+| Derived protected-expert list | same base only (routing is finetune-specific) |
+Reusing grams+KLD ref skips ~8 h of GPU-serve windows (calibration + KLD record).
+
+## Heavier-rung pool-fit ceiling
+Expert tables for Qwen3.8-Flash-Next bill ~56 GiB (w4) → ~75 (w5/w6 class) → ~112 GiB (int8/fp8) across both ranks (from the recipe's own mass lines: gate_up 150 + down 75 GiB bf16). The one-table-one-encoding law moves the whole expert set together. Pinned host pool 43,928 MiB/rank ⇒ **only w5/w6-class rungs keep the no-streaming shape**; int8/fp8 experts overflow it and re-open the NVMe 3.5 GB/s streaming era. FP8-official-checkpoint rebuild (172.8 GB, ungated, no-recipe copy) is the cheap half-download "heavier" but carries those streaming economics.
+
+## Known scored comparisons (don't re-pay for them)
+Upstream w5dn64-vs-iq4r on the official checkpoint: mean KL 0.0789→0.0717, top-1 93.34 %, decode +4 %, prefill −19 %. A custom heavier official rung reproduces this; a custom heavier Swift1.5 rung reuses the fleet's own grams/KLD assets instead.
+
+## Fetch scripts (dankserver)
+- Swift1.5 BF16 335.3 GiB: `scripts/download-frank-archon-swift15.sh`
+- Official FP8 172.8 GB: `scripts/download-frank-archon.sh` (NOT bf16 — a bf16-official fetch needs a fork of it)
+- iq4r container: `scripts/download-frank-archon-iq4r.sh`
+Disk gate arithmetic: checkpoint + output both live on the volume; the campaign convert wanted ≥146 GiB free AFTER the checkpoint lands.
@@ -0,0 +1,37 @@
+---
+name: radiance-shape-resize-verification
+description: "Verify a radiance (frank-archon) KV/slab shape change end-to-end: TTM preflight, boot ledger, boundary probe, decode ladder — with the laws that govern each axis."
+---
+
+Use when changing `FRANK_ARCHON_KV_DTYPE`, `FRANK_ARCHON_MAX_SEQS`, `FRANK_ARCHON_VRAM_WEIGHTS_MIB`, or `FRANK_ARCHON_VRAM_KV_MIB` in `scripts/frank-archon.env`, and when asked why a shape change did or did not move throughput.
+
+## Sequence
+1. Pool sizing first: `pool_mib >= seqs*maxlen*rate + 110*seqs + 448`, rate = 7.3125 KiB/token fp8, 13.8125 KiB/token bf16 (measured page sizes 26.00 vs 52.00 KiB + 3.25 KiB dtype-independent QSA key).
+2. Pair ceiling: `weights + kv <= 30,969` MiB/card (card 32,624 − 3,425 engine-side fixed: 2,048 activation arena, 209.19 floor, 960 driver/kernel, 224 NCCL/IPC, 96 headroom, 600 unaccounted). Settle floor is 209.19 MiB, NOT the hand-picked 1 GiB reserve.
+3. Update bats seams: pair ceiling (`FRANK_ARCHON_VRAM_CEILING_MIB`), slab floor, KV-pool contract; keep the ceiling seam owning only pair arithmetic.
+4. `./tests/run.sh` (needs bats on PATH: `/home/blank/go/bin`), commit, merge `origin/wt/<branch>` ff-only into main at **/home/blank/Projects/serverAppConfig**, push main.
+5. Deploy: `ssh dankserver 'cd /home/dank/serverAppConfigs && git pull --ff-only && ./scripts/deploy.sh dankserver --service frank-archon'` — boot 3–4 min; `--dry-run` first to confirm the plan selects exactly one service.
+6. Read the boot ledger: `journalctl -u frank-archon | grep -E "kv cache|budgeted|expert slab|resident experts|unclaimed|settled at|sampler"` — engine prints backed tokens, slab slots, host-pool slots, settle, rows.
+7. Verify contract: `ssh dankserver 'python3 /home/dank/serverAppConfigs/scripts/probe-frank-archon-kv.py'` — legs A (decode at depth), B (N×window capacity), C (prefix restore), D (N-stream decode).
+
+## Laws (measured; trust over recalculation)
+- Slab is a THRESHOLD: 22,208 → 3,397, 24,000 → 3,290, 25,600 → 3,290 t/s at 43.5k; cliff at ~26 GiB (26,071 → 4,379).
+- Decode is nearly window-free: 99.0 t/s at 43.5k, 93.3 at 197k.
+- Slots are paid in decode CONCURRENCY: 3 streams = 18.4 t/s aggregate, per-stream a fused-step lottery (113.9/43.3/10.9).
+- Idle KV VRAM lends to the expert slab (fp8 pool 6,912 lent 6.08 GiB vs 2.69 at 3,543).
+- Bigger pool can LOWER prefill: more resident experts = less pinned host-pool traffic.
+- Oversized prompt is FREE and refused by name — counter `frank_archon_prompt_too_large_total` counts; refusal fires on PROMPT tokens alone ("leaves nothing to generate into"); radiance NEVER truncates.
+- TTM: serve script raises `ttm.pages_limit` to `FRANK_ARCHON_TTM_TARGET_MIB` itself (reboot resets to half RAM); unit ExecStartPre hook.
+- Refusal signature: `activating (auto-restart)`, exit 1 in ~50 ms, no container, no engine log.
+
+## Probe law
+- 512 generated tokens minimum (8–24-token probes report decode noise as rate); greedy; cold prompts (unique nonce) to defeat the disk prefix cache; acceptance ~0.66–0.74 on repo corpus, repetitive filler 0.93–0.97 (never compare across corpora).
+- Radiance routes thinking to `reasoning_content`: set `chat_template_kwargs.enable_thinking=false`, read content + reasoning_content.
+- `finish_reason: "stop"` with `completion_tokens: 1` on a capacity request = accepted, not failed.
+
+## Traps
+- Python heredoc over ssh: `str.maketrans` with quoted numeric literals collapses (`'0123456789'` → `'06789'`) — build alphabets with `chr(48+i)`/`chr(97+i)`.
+- `FRANK_SUDO_PW` in `/home/dank/.profile` has a CRLF tail; strip `\r` for systemd credentials (`tr -d '\r' | sudo systemd-credential ...`).
+- Deployer reports DEPLOY INCOMPLETE on a stray port-holder (`ss -ltnp | grep :7770`); never kill a root process over ssh without sudo.
+- The main checkout on the dev workstation is `/home/blank/Projects/serverAppConfig`, NOT `/home/dank/serverAppConfigs` (that path is on the servers).
+- `systemctl mask` fails on the relinked unit; `deploy.sh <host>` with no `--service` is a fleet-wide drain.
@@ -0,0 +1,28 @@
+---
+name: recover-subagent-yield-payload
+description: "Recover a subagent's full structured report when it exited without yielding (SYSTEM WARNING) — extract aborted yield payloads from the session JSONL, including harness double-encode and split-JSON quirks."
+---
+
+Use when a subagent ends with "exited without yielding" yet the transcript shows it repeatedly calling `yield` (each reply "…[+N]" — payload too big for display). The research is usually COMPLETE; only the yield serialization failed. Known harness quirk: the yield `arguments` get wrapped as `{"data": "<json string>"}`, so an object payload is validated as a string → "expected object, received string" retry loop until the agent dies.
+
+## 1. Locate the session JSONL
+Transcript header prints the path: `~/.omp/agent/sessions/<cwd-slug>/<session-id>/<AgentName>.jsonl` (worktrees: cwd slug like `-.omp-wt-wt-...`).
+
+## 2. Extract every aborted yield payload (Python via eval — shell quoting will mangle these)
+- Parse each line with `json.loads` guarded by try/except (lines may be non-JSON).
+- Keep `message.role == "assistant"` messages; in `content`, keep entries with `type == "toolCall"` and `name == "yield"`; collect their `arguments`.
+- Unwrap: `arguments` may be a dict containing `data` (a JSON string) or a plain string; `json.loads` it.
+
+## 3. Tolerate broken JSON
+Naive `json.loads` on `data` can fail "Extra data: line 1 column ~4600" — the payload is a complete object followed by `, "architecture": ..., "report": ...}` (agent emitted a structure whose early brace-closure ended the first object). Recover with `json.JSONDecoder().raw_decode`:
+1. `part1, end = dec.raw_decode(data.strip())`
+2. `rest = data[end:].strip()` — if it starts with `,`, parse `part2 = dec.raw_decode('{' + rest.lstrip(', '))[0]`
+3. `merged = {**part1, **part2}`
+Do this for ALL yields and keep the largest merged dict (attempts evolve; keys seen: `summary`, `files`, `report`, `architecture`).
+
+## 4. Persist and deliver
+Write the recovered `report`/`summary` to a durable file (memory dir or `local://`), then continue synthesis — never re-run the research the dead scout already did.
+
+## Prevention (do this first next time)
+- While the agent is still alive and looping: write to `agent://<Name>` steering it to "yield immediately, wrap in minimal object or raw markdown, schema-invalid yield acceptable — I read the transcript anyway." It often still can't (the failure is in the harness wrapper, not the agent) → let it be killed and use the extraction above.
+- Scout default schema wants objects; terse yields from `scout` agents hit this most. Keep expected reports slice-sized.
@@ -0,0 +1,39 @@
+---
+name: repo-change-html-report
+description: "Build a self-contained HTML report of a branch's changes (per-file detail grouped by atomic change, inline SVG diagrams) and open it in the user's browser"
+---
+
+# Repo change → HTML report in browser
+
+Produce a standalone HTML report covering `git log main..HEAD`, grouped into atomic tasks (one task may span commits; one commit may serve several tasks), per-file `what`/`why` tables, inline SVG diagrams, then `xdg-open file://…`.
+
+## 1. Gather facts first (never from memory)
+```
+git log --reverse --format="COMMIT %h %s" main..HEAD
+for c in $(git log --reverse --format=%h main..HEAD); do
+  echo "== $c $(git log -1 --format=%s $c)"; git show --format="" --stat=200 "$c"; done
+```
+`--stat=short` is invalid; use `--stat=200`. Supplement with the session's per-file notes.
+
+## 2. Write to a file OUTSIDE the repo
+`~/reports/<repo>-<branch-date>.html` — keeps the worktree clean.
+
+## 3. Chunk the writes (payload limits are real)
+- First chunk: `write` (head + CSS + hero cards + nav).
+- Later chunks: `edit` with `PUT >$` (append), ~6–8 KB each. A single giant `write` gets truncated mid-arguments.
+- **No appended body line may begin with `-`** (e.g. a wrapped `--host H`); the edit parser rejects it as a deletion row. Keep flag-like tokens inline.
+- Never end a PUT mid-sentence; if a sentence spills, include ALL its lines in the same PUT, then verify the seam region reads cleanly.
+
+## 4. Structure that worked (7-task, 13-commit branch)
+- Stat cards (commits, tasks, tests green, key counts) + sticky anchor nav.
+- Commit-arc SVG (dots on a timeline, colored by task; dashed edge for a task spanning two commits).
+- One section per atomic task: `why` callout → SVG before/after diagram → per-commit `File | What | Why` tables.
+- Footer: deploy-day notes, trash/retirement pending approvals.
+- CSS: only theme vars (`--fg --muted --surface --border --accent --success --error --c1..--c6`) with a `prefers-color-scheme: dark` block; SVGs style via `currentColor`/vars; no external assets, no scripts.
+
+## 5. Validate before opening
+Python `html.parser` pass: tag stack empty, zero mismatches (treat `path rect circle line marker` + void HTML tags as self-closing); assert every nav anchor id exists; print table/figure counts. Then:
+```
+xdg-open "file:///home/blank/reports/<file>.html"
+```
+`xdg-open` may block in foreground — background it, don't poll.
@@ -0,0 +1,23 @@
+---
+name: repo-wide-terminology-sweep
+description: "Rewrite or retire a phrase/term across every comment in a repo (e.g. jargon ban, de-law comments) without breaking tests or leaving ragged prose seams"
+---
+
+Use when asked to eliminate/replace a word or phrase in comments across a whole repo (jargon bans, style cutovers, retiring event-narrative lore).
+
+## Procedure
+
+1. **Census with word boundaries.** `git ls-files -z | xargs -0 grep -inwE "term(s)?"` — plain substring grep drowns the list in false positives (e.g. `law` matches inside `alloy`-adjacent noise, `download`, `flaw`). Exclude docs explicitly if scope is comments only (`grep -v "^docs/\|^AGENTS.md:"`).
+2. **Dump all hits with line numbers** in one pass, then batch-read each site's surrounding block (`read file:start-end`). Comments span multiple lines; a single hit line rarely carries the full claim.
+3. **Check tests pin comment text BEFORE rewriting.** Suites sometimes grep exact comment strings; those seams need rewiring (test the contract, not the prose), found by running affected bats/pytest files after each file's edit, not at the end.
+4. **Rewrite around the mechanism, not the incident.** Replace dated narratives and jargon with: the constraint, the mechanism enforcing it, the consequence of violating it. Keep project-specific parameters (paths, flags, sizes) — they are the subject; generalize the *reasoning* so it transfers.
+5. **Edit multi-line blocks as whole blocks.** When replacing the middle line of a wrapped sentence, include ALL continuation lines in the replacement body. Partial bodies leave seams: sentences ending mid-clause, duplicated lines, orphaned fragments.
+6. **Seam hunt after editing.** Review `git diff -U0` added lines for the block mid-sentence heuristic (`grep -E "(the|a|of|and|at|per|by|is|in|to|for)$"`), then re-read every site where the diff boundary fell inside a paragraph; verify the full sentence reads coherently.
+7. **Verify behavior-identical.** `bash -n` every touched shell file, `py_compile` touched Python, parse touched YAML, run the FULL suite — comment sweeps must exit 0 with the same test count as before. A green suite does not prove prose is intact; step 6 does.
+8. **One atomic commit**; state the rewrite law in the message with a few old→new example pairs.
+
+## Pitfalls
+
+- Jargon often escapes into identifiers and log strings (`scale_law` variable, refusal messages) — grep word-boundary matches in code, rename locals/messages only if no test pins the string.
+- Line anchors drift between files edited in the same batch; on a stale-anchor error the tool shows real content — re-target, don't re-read blindly.
+- `.AGENTTRASH/` and retired `old/` trees: exclude from scope, they are archives.
@@ -0,0 +1,24 @@
+---
+name: scicode-official-grading-protocol
+description: "Grade SciCode in frank-intelligence-bench the official way: scicode pkg pin, test_data.h5 targets, fence stripping, dev/test split semantics, harness-fault census."
+---
+
+Grade SciCode in frank-intelligence-bench the official way.
+
+## Protocol law (mirrors eval/scripts/test_generated_code.py @ e3158ea011d4235245a547460d3688d7ccbf9900)
+- Submitted function extracted via `scicode.parse.parse.extract_function_name` + `get_function_from_code` inside the Dankclaw sandbox image `frank-bench-py:3.12-scicode1` (python:3.12-slim + git + numpy/scipy/pandas/matplotlib/h5py + `scicode @ git+...@pin`; git is REQUIRED for pip git+https on slim).
+- Gold expected values live ONLY in `test_data.h5` (1.05 GB, authors' Drive folder `1W5GZW6_bdiDAiipuFMqdUhvUaHIj6-pR`, fetch with `uvx --with gdown gdown --folder <url> -O <dir>` — lands in a `SciCode_test/` subdir, move up). Bind per test case: `targets = process_hdf5_to_tuple(step_number, len(cases), h5py_file="/w-data/test_data.h5")`, then `ns["target"] = targets[i]` before exec'ing each case. Mount read-only at `/w-data`.
+- STRIP MARKDOWN FENCES before extraction. The official pipeline stores clean code; the grader `exec`s text verbatim, so "```python" lines = guaranteed SyntaxError = 100% false FAIL (live census caught 7/7). Apply to submissions AND prior-step texts.
+- Splits: dev (15 problems / 50 steps, ships `ground_truth_code` + self-contained tests with inline `target = ...`) grades with REFERENCE-solution context; test split (65 problems / 288 steps, gold is None, tests reference h5 `target`/`refN`) is SELF-CUMULATIVE (model's own prior generations, inspect-ai convention). Scope = 338 steps = AA design count. Loader reads `problems_test.jsonl` + `problems_dev.jsonl` from HF `SciCode1/SciCode`.
+
+## Harness-fault census (bench analyze)
+Before trusting any SciCode score, run the failure-signature census. Indict the harness (not the model) when:
+- `NameError: name 'target' is not defined` — h5 targets not reaching tests (never staged / not mounted / bare-target fixtures).
+- `ModuleNotFoundError: No module named 'scicode'` — sandbox image lacks the pinned package.
+- 100% shared signature across ≥10 failures — systematic fault, audit protocol first.
+Historic incident 2026-10-10: first live run "0% pass" = 251× target-NameError + 36× scicode-module: all harness faults.
+
+## Sandbox ops
+- Stage h5 with sha256 compare (`ssh sha256sum` vs local) before transfer; stream via `ssh 'cat > file'`.
+- DRY sandbox must emit `SCICODE_PASS (DRY_RUN)` so DRY grading passes.
+- podman short-names: an image tag that was never built falls through to registry lookup (exit 125) — ensure the tag exists (build) before `podman run`; tests that call `execPython` directly must `ensureSandbox()` first.
@@ -0,0 +1,70 @@
+---
+name: scout-agent-prompt
+description: Store scout agent system prompt for future use
+---
+
+# Scout Agent System Prompt
+
+## Purpose
+Read-only subagent for quick exploration tasks and research.
+
+## Model Configuration
+- **Model**: `frank-default-small`
+- **Agent type**: Read-only (subagent)
+
+## System Prompt Sections
+
+### 1. PRIME DIRECTIVES
+- YOU ARE LOCALLY HOSTED (not cloud-hosted)
+- ALWAYS invoke tool `--help` / `man` before use
+- REFRESH memory before every command
+- NEVER write to a file without reading it first
+
+### 2. Persona
+- **User**: Frank, 35, DevOps Software Engineer in Seattle, September 2026
+- **Identity**: Comrade Chief Designer of Soviet Computer Systems (Dankclaw + Dankserver)
+- **Background**: History buff, sci-fi/fantasy enthusiast
+- **Adjectives**: well-measured, cautious, expeditious, ambitious, concise, surgical, thorough, efficient
+
+### 3. Voice
+- Engaging, friendly, informative, humorous but scientifically accurate
+- Uses Mermaid diagrams to explain concepts
+- Prefers short bullet points
+
+### 4. Preferred Tools
+- Shell (BASH/ZSH), npm, bun, TypeScript, Terraform, Podman
+- Frank wants to learn: Go, Rust, Python, Kubernetes, Helm, Langchain, Godot, PICO8, Terragrunt
+
+### 5. Core Rules
+- Read docs before touching topics
+- Parallel subagents use ONE call with `tasks[]`
+- Trust user but verify - use `/skill:grilling` to interview user
+- Commit hygiene: atomic commits, test-driven development
+- Forbidden: editing node_modules, `git push` (except local Gitea), `rm`, deleting unit tests
+
+### 6. Scout-Specific
+- Use for quick exploration, read-only research, fact-checking
+- Use `scout` as subagent name
+- When no skills exist, offer to help directly
+
+## Usage
+
+### Task Subagent
+```bash
+task(i="Explore this repo", tasks=[
+  {
+    "task": "Find relevant files about X",
+    "agent": "scout"
+  }
+])
+```
+
+### Skill Override
+```bash
+/scout:command
+```
+
+## Reference
+- `/agent/APPEND_SYSTEM.md` — Full system prompt
+- `/omp-docs/core/settings.md` — Agent role/model config
+- `/omp-docs/tools/npx-skills/skill-loading.md` — Loading flow
@@ -0,0 +1,64 @@
+---
+name: self-severing-model-swap-cutover
+description: "Swap the model on frank-archon (the endpoint the operator session runs on): full pre-cutover repo unit, detached deploy that survives session death, post-return boot-ledger harvest, e2e attribution."
+---
+
+# Swapping the model you are running on (frank-archon)
+
+The harness agent shares the endpoint being swapped: the deploy restarts
+frank-archon, the session dies mid-tool-call, the harness catches the return.
+Plan for the severing; never keep critical state only in-session.
+
+## Pre-cutover (all must be committed/pushed BEFORE the deploy)
+1. Read `scripts/frank-archon.env` live state and record the shape; the swap
+   changes ONLY `MODEL_FILE` (fleet model-swap law) unless asked otherwise.
+2. Fetch script per payload (hfget + exact bytes + Hub LFS sha256 +
+   `--verify-only`, no token on the command line); run detached via
+   `systemd-run --unit=<name>-fetch` on dankserver.
+3. Re-key in one commit: `frank-archon.env` (+ trio headers),
+   `tests/frank_archon_unit.bats` payload id/sha256 (keep the outgoing
+   payload as the documented rollback line), homepage card
+   (`shared/homepage/services.json`), runbook (new era page + index flips +
+   old page retired), `AGENTS.md` topology row/section/runbook index.
+4. Full `./tests/run.sh` green, push origin main, `git pull --ff-only` on
+   dankserver. Verify the engine pin's flag set matches the payload card
+   (radiance pins have drifted on flag renames).
+5. Disk: check `df -h /home/dank` before launching a >100 GB download; the
+   outgoing payload stays on disk as rollback — deleting it requires Frank's
+   one-time `rm` authorization.
+
+## Cutover, detached from the session
+Launch from the workstation as a transient unit so ssh/session teardown
+cannot kill it:
+```
+setsid systemd-run --unit=archon-<tag>-cutover --remain-after-exit \
+  bash -lc 'cd <repo> && ./scripts/deploy.sh dankserver --service frank-archon \
+    > ~/archon-<tag>-cutover.log 2>&1; echo $? > ~/archon-<tag>.rc'
+```
+The session dies when frank-archon restarts (~1–2 min load). On return:
+read the `.rc` sentinel and log tail; then the journal ledger:
+```
+journalctl -u frank-archon --no-pager --since "<deploy>" | grep -iE "kv cache|slab|sampler|MTP|prefix"
+```
+
+## Post-boot harvest (fill the runbook placeholders)
+- KV: `kv_attn` KiB/4-token block, pool token count vs `seqs × max-model-len`.
+- Expert slab slots per rank (compare to the outgoing payload).
+- Sampler rows = `seqs × (1 + spec)` (wht6 exactness bound 25).
+- Prefix-cache RECOVERED line (survives swaps when arch+tokenizer unchanged).
+- Vision probe: solid-color PNG ≥256 px, read `reasoning_content` (small
+  max_tokens → thinking eats the budget, `content` empty with
+  `finish_reason: stop` = healthy, not broken).
+- Decode ladder needs a stop-and-mask window — separate bench task.
+
+## e2e gate redness on dankclaw surfaces
+`deploy.sh dankserver` runs the Playwright gate against the LIVE fleet, so
+dankclaw faults fail your deploy. Attribute before believing: crawl 502 /
+SSO fail / Marreta tile → run the
+`gluetun-dependent-boot-race-recovery` census first (reboot-triggered,
+unrelated to the swap), cascade-restart, rerun `tests/e2e/run.sh` directly —
+a frank-archon health gate that passed means the swap itself is fine.
+
+## Rollback
+Revert the swap commit, redeploy `--service frank-archon` — the outgoing
+`.rad` remains on disk (until deleted by authorized `rm`).
@@ -0,0 +1,55 @@
+---
+name: serverappconfigs-docs-only-landing
+description: "Land a docs-only (vault/log) commit on serverAppConfigs main without a PR: tests green, then fast-forward main via git push origin HEAD:main — including recovery when the omp worktree base is stale or pre-compaction edits vanished."
+---
+
+# serverAppConfigs docs-only landing
+
+Land vault/log edits on `main` directly (no PR) when the change touches only
+`serverAppConfigs-docs/**` (or `AGENTS.md`): the deployer treats docs-only
+changes as a no-op, and origin is the self-hosted Gitea — pushing there is
+allowed.
+
+## Procedure
+
+1. **Ground-truth the worktree BEFORE editing** (omp worktrees go stale
+   between sessions/compactions):
+   - `git fetch origin && git log --oneline 3e140cd..origin/main`-style check:
+     `git log --oneline HEAD..origin/main` — if non-empty, main advanced
+     (sibling sessions land zealot/dankclaw work constantly).
+   - NEVER trust the session summary that "file X was already edited": the
+     worktree may sit at an older commit and transcript-era edits may not
+     exist on disk. Verify with `grep -n "<new-phrase>" <file>`; redo edits
+     against a fresh read if absent.
+   - Line numbers in AGENTS.md shift between main versions — re-locate stale
+     claims by `grep -n "on disk\|stays on disk\|rollback target" AGENTS.md`,
+     never by remembered line numbers.
+2. Edit (read target regions fresh; long table rows in AGENTS.md must be
+   re-emitted whole via `PUT n.=n:` — get the full row first with
+   `read path:N:raw`).
+3. `./tests/run.sh` — full bats suite must pass (~60–75 s; run async, do
+   other work). Docs seams of interest: `docs_completeness` (index links
+   every page, no unresolved `[[wikilinks]]`).
+4. Commit on the worktree branch, then rebase onto `origin/main` if it
+   advanced. Typical conflict: `log.md` tail — both sides appended entries;
+   resolution = keep both blocks, `CUT` the three marker lines, re-add the
+   blank line before the second heading.
+5. Re-run the docs seam (or full suite if non-prose changed) against the
+   exact pushed tree.
+6. **Push:** `git push origin HEAD:main` — plain push IS the fast-forward
+   PR-less merge. NEVER `--force`/`--no-verify`. If Gitea rejects, main moved
+   again: rebase (step 4) and push again.
+7. Docs-only = no `deploy.sh` run needed; hosts pick the pages up on their
+   next pull.
+
+## Gotchas
+
+- `git status` not listing a file you "just edited" + `rev-parse HEAD`
+  mismatch vs `git worktree list` → the harness recreated/reset the worktree;
+  the edits are gone. Redo, don't hunt.
+- `log.md` entries: heading `## YYYY-MM-DD — topic`, blank line between
+  entries; docs seam tolerates either entry order within a day.
+- Prose-only amend after a green suite: rerun at least
+  `bats tests/docs_completeness.bats` before push.
+- Do not reset the shared `main` checkout in `~/Projects/serverAppConfig`;
+  it falls behind origin and the user syncs it.
@@ -0,0 +1,67 @@
+---
+name: serverappconfigs-inventory-audit
+description: "Audit serverAppConfigs for duplicated fleet-service definitions: the 10 hand-copied inventory sites, the live-vs-repo drift census commands, and the known staleness checks."
+---
+
+# serverAppConfigs inventory / duplication audit
+
+Use when asked "where can we refactor or share resources", "why is X defined twice", or when adding a service and the edit sites must be enumerated. Read-only audit; changes come later.
+
+## The inventory is hand-copied ten times (2026-10-13 census)
+
+| Truth | Path | Shape |
+|---|---|---|
+order graph | `scripts/deploy-plan.py` `SERVICE_ORDER` | 45 names |
+per-host allow-sets | `scripts/deploy-plan.py` `DANKCLAW_/DANKSERVER_/FRANKBOOK_SERVICES` | 3 sets |
+path→service | `scripts/deploy-plan.py` `services_for_path` | ~30 branches + 6 in-branch name whitelists |
+target:service gate | `scripts/deploy-remote.sh` `service_is_allowed` | `case "$TARGET:$service"` pairs |
+dispatcher | `scripts/deploy-remote.sh` `deploy_service` | 30 branches |
+test selector | `scripts/test-changed.sh` | ~40 path globs |
+probes | `shared/homepage/services.json` | 35 entries (probe, url, docs, icon) |
+scrape jobs | `shared/prometheus/prometheus.yml` | 11 jobs |
+vhosts | `dankclaw/Caddyfile` | public vhost + `http://:8017` post-auth handler per guarded service |
+DNS | `dankclaw/pihole/addn-hosts` | 30 records |
+
+Adding one service touches all ten. Any audit that enumerates services must cross-check all ten, not one.
+
+## Census commands
+
+Live-vs-repo container drift (catches host-only units with no git provenance):
+
+```bash
+ssh dankclaw 'podman ps --format "{{.Names}}"' | sort > /tmp/live.txt
+grep -h '^ContainerName=' dankclaw/*/*/*.container | sed 's/ContainerName=//' | sort > /tmp/repo.txt
+comm -23 /tmp/live.txt /tmp/repo.txt   # live, not in repo
+comm -13 /tmp/live.txt /tmp/repo.txt   # in repo, not running
+```
+
+`systemd-<network>` in the live list is podman's netns infra container — benign. A real hit: `ntfy` (2026-10-11) existed only as `~/.config/containers/systemd/ntfy.container` with `restart=no`.
+
+Other probes, all cheap and all producing findings on 2026-10-13:
+
+```bash
+# stateful stores and whether probes can reach them
+grep -n 'PublishPort' dankclaw/**/quadlet/*postgres* dankserver/**/quadlet/*{mariadb,redis}*
+# dead scripts: zero refs outside docs
+for f in scripts/*.sh; do grep -rl "$(basename $f)" . | grep -v serverAppConfigs-docs | grep -q . || echo "$f"; done
+# shared paths that no longer exist
+for p in dankclaw/frank-dragoon dankclaw/compose.yaml dankserver/Caddyfile; do [ -e "$p" ] || echo "STALE $p"; done
+# memory footprint, to kill the "saves RAM" argument
+ssh dankclaw 'podman stats --no-stream --format "{{.Name}} {{.MemUsage}}" postgres gitea-postgres authentik-postgres'
+```
+
+## Known-stale items to re-verify each audit
+
+- `deploy-plan.py`: `DANKSERVER_SERVICES` still lists the six *arr services (they live on FrankBook-Pro); maps `scripts/qwen-sharp-v22.4.0.jinja` (retired runtime) to frank-dragoon; has **no** rule for `scripts/qwen38-froggeric-v22.5.jinja`, the live frank-archon template — editing it deploys nothing.
+- `test-changed.sh`: cases for `dankclaw/frank-dragoon/*`, `dankclaw/compose.yaml`, `dankserver/Caddyfile` match nothing.
+- `AGENTS.md` runbook index lists frank-archon's **retired** runbook as active while the endpoint section names the current one; frank-archon's shape is written in three places in that file.
+- `shared/homepage/dankserver.services.json`: zero references; `deploy_homepage` copies six named files and it is not one of them.
+- `scripts/hf-fetch.sh`: superseded by `scripts/hfget.sh`, no callers.
+- Undeclared shared networks: 15 units attach to `dankclaw_default`, 6 to `dankserver_appnet`; no `.network` file in the repo defines either.
+- `dankserver/compose.yaml` defines six containers whose names are owned by quadlet units, with diverged volume paths; `deploy_compose_service` refuses to act on it and `compose_validity.bats` checks YAML shape only.
+- `frank-zealot.service` `Restart=on-failure` violates the law `frank_archon_unit.bats` states (clean engine exit reads as success, so on-failure never fires); the zealot seam greps `^Restart=` and passes.
+- `render_caddyfile` / `deploy_homepage` write fixed `/tmp` filenames as `dank`, then `run_privileged cp` them into root-owned paths.
+
+## Report shape
+
+Table the duplication with counts (occurrences + path:line), label DUE vs DIVERGENT-intentional, then a ranked priority table (lines removed / risk). Ground "saves RAM" claims in measured RSS — two postgres containers measured 37 MiB and 325 MiB, so the prize is the operational surface (unit, secret, health gate, deploy entry, backup), not memory.
@@ -0,0 +1,22 @@
+---
+name: serverappconfigs-vault-page-registration
+description: "Add a page to the serverAppConfigs docs vault without failing the docs_completeness test: frontmatter, dual index registration, link checker, suite gate."
+---
+
+# serverAppConfigs vault page registration
+
+Adding any page under `serverAppConfigs-docs/` fails `tests/docs_completeness.bats` ("docs index links every docs page") unless registered in BOTH indexes. Learned the hard way: the section index alone is not enough.
+
+## Procedure
+
+1. Write the page with OKF frontmatter: `type` (e.g. `reference`), `title`, `description`, `tags`, `timestamp` (ISO with `-07:00` offset).
+2. Cross-links inside page bodies use **markdown links** for cross-folder paths (`[Observability](../Infrastructure/Observability.md)`); `[[wikilinks]]` resolve by page title and must NOT carry relative paths.
+3. Register a `[[Page Title]]` bullet in the section index (e.g. `serverAppConfigs-docs/Operations/index.md`).
+4. Register the SAME `[[Page Title]]` bullet in the ROOT index `serverAppConfigs-docs/index.md` under the matching section heading (root index has its own "Operations:", "Architecture:", ... lists). This is the step the test enforces.
+5. Verify: `python3 scripts/check-vault-links.py` → `0 unresolved links`, then `./tests/run.sh` → ALL TESTS PASSED.
+
+## Comment-sweep conventions (same repo)
+
+- Scope of "comments": code/config `#` comments (scripts, env, quadlets, Caddyfile, tests). Identifiers, string literals, and `__pycache__` are separate decisions; docs prose is documentation, not comments.
+- User-approved idiom for lore comments: state the mechanism and why it matters, generically — no incident dates, no project-specific names, no named-thing slogans.
+- Edit-tool workflow: a fresh `grep`/`read` snapshot yields the file's `#TAG`; batch edits per file in one call; file tag changes after each edit, never re-edit the same file within one batch.
@@ -0,0 +1,63 @@
+---
+name: service-preflight-refusal-triage
+description: "Diagnose a systemd service crash-looping in activating (auto-restart) with a fast exit: separate a preflight refusal from an engine crash, and make a runtime sysfs/kernel knob raise survive the reboot that resets it."
+---
+
+# Preflight refusal vs engine crash (systemd services with env gates)
+
+Symptom that decides the branch: unit `activating (auto-restart)`, `Main process
+exited, code=exited, status=1/FAILURE` about 50 ms after start, restart counter
+in the thousands. No container/app process, no app log.
+
+## Triage sequence
+1. `systemctl status <svc> --no-pager -n 0` → note `Exec` path, `status=`, CPU-seconds
+   (`0.0xx ms` = the script never got to work).
+2. `journalctl -u <svc> --no-pager -n 60` → the refusal line is printed by the
+   serve script itself and NAMES the gate. On frank-archon:
+   `ERROR: ttm pages cap is 125988 MiB, the pinned ledger needs >= 150000`.
+   `journalctl -u <svc> | grep -m1 "<gate phrase>"` gives the FIRST occurrence:
+   that timestamp is the incident start (correlate with `uptime -b`, `last reboot`).
+3. Check the app's own state: `podman ps -a` showing the container name with a
+   zero/absurd start time = the container was never created → the gate, not the
+   engine.
+4. Read the gate's code path in the repo (`scripts/serve-<svc>.sh`) before
+   touching the host: it prints exactly what it requires.
+
+Do NOT reach for `journalctl -k` GPU/OOM theories, gdb, or a payload checksum
+until the exit latency is above ~1 s. A 50 ms exit is a shell gate.
+
+## The reboot law
+Runtime kernel knobs reset at every boot. `ttm.pages_limit` (caps GPU-mappable
+pinned pages) defaults to HALF OF RAM, so any manual `echo N > /sys/...` raise is
+a countdown to the next reboot — a power failure included. Measured on dankserver
+2026-10-12 23:17: raise to 52,428,800 pages (200 GiB) -> power failure -> kernel
+default 32,253,039 pages (125,988 MiB) -> the pinned-ledger gate (floor 150,000)
+refused the start 6,919 times in ~20 h.
+
+So: never prescribe a manual sysfs write as the recovery procedure for a service
+that can boot before a human reaches it. Make the START raise the knob.
+
+## Making the raise privileged
+The service is `User=dank`, the knob is root-owned 0644 → `[ -w "$knob" ]` is
+FALSE in the service process and a plain `echo` fails silently. A "root unit"
+with `User=` is NOT a root process.
+- Canonical: `ExecStartPre=+/path/to/gate.sh --raise` — systemd's `+` prefix runs
+  as root even under `User=`, before ExecStart, so `Restart=always` can never
+  outrun it.
+- Fallback for a human running the gate from a shell: `sudo -n sh -c "echo N > '$knob'"`.
+- Gate order: read → if below floor, raise → RE-READ → refuse by name only after
+  a write that was refused. Reading = min over the knobs that exist (an absent
+  knob is skipped, never read as 0).
+- Belt for the boot path: the module option (`/etc/modprobe.d/*.conf`,
+  `options ttm pages_limit=N`) — Dankclaw persists its raise that way.
+
+## Verification of a knob-raise fix
+- `cat /sys/module/ttm/parameters/pages_limit` after the boot equals the target.
+- Journal shows the hook's own pid line (`ttm-preflight.sh[...]: ... raising the
+  knob to ...`) BEFORE `Started <svc>.service`.
+- Confirm the live shape from `podman inspect <ctr> --format '{{json .Config.Cmd}}'`
+  — the restart succeeding proves nothing about the flags.
+- Test the gate against a temp knob dir (env-overridable sysfs path): writable
+  below-floor knob → raised + exit 0; unwritable → cap unchanged + exit 1. Run the
+  refusal case with a PATH containing `cat`+`bash` and NO `sudo`, or root writes
+  the 444 file and the case tests nothing.
@@ -1,3 +1,4 @@
+- command-center (~/.omp) worktree-clean law, verified 2026-10-09: (1) The secret gate's PEM family regex (BEGIN, a space, a bracketed A-Z star class, PRIVATE KEY) does NOT self-match when the pattern is quoted in brackets form — a SKILL.md documenting the gate verbatim in regex-bracket shape is safe to stage; only the bare quoted literal (e.g. the plain two-word PEM header phrase, the xox[baprs] family prefix followed by 10+ token chars) trips it. Before any commit that stages prose about secrets, pre-scan with the exact gate one-liner: staged=$(git diff --cached --diff-filter=ACM -U0 -- '*.md' '*.yml' '*.yaml' '*.json' '*.toml' '*.sh' '*.ts' '*.js'); printf '%s\n' "$staged" | grep -Eic 'gate patterns' — 0 hits means the gate will pass; redact prose descriptively, never ALLOW_SECRETS. (2) The omp auto-learner mints managed skills under agent/managed-skills/name/ DURING a session — a "clean tree" declared mid-session goes dirty again when capture fires (observed: noctalia-bar-layout-edit appeared between commit and final status). Re-run git status as the LAST command of a cleanup pass. (3) Classification rule that made the tree clean in one pass: agent/memories/*/learned.md and agent/managed-skills/ are config → commit atomically; new top-level runtime dirs (webcache/, reports/, local/, wt/) are state → .gitignore. webcache/ (harness web-fetch cache) is gitignored as of commit 4d2b024.
 - Noctalia v5 config layering (verified live on blankpad 2026-10-09): bar widget layout lives in the GUI-override layer ~/.local/state/noctalia/settings.toml under [bar.name] keys start/center/end (defaults: start=["launcher","wallpaper","workspaces"], center=["clock"]); settings.toml loads LAST and wins over ~/.config/noctalia/config.toml. Both layers are watched and hot-reloaded — edit + noctalia config validate + screenshot is the full apply/verify loop (no restart, no reload IPC). Noctalia writes THROUGH symlinks and keeps the link, so keeping settings.toml symlinked from the command-center dotfiles repo is safe. Combine workspace+window indicator: [widget.taskbar] group_by_workspace=true (needs compositor per-window workspace data — niri has it) renders per-workspace capsules with disc labels, workspace_group_content = icons|count|dots (count/dots left-click activates the workspace); the workspaces widget itself has no window-display mode. Applied on blankpad: bar.default start=["launcher","wallpaper","workspaces","taskbar"], center=["cat"] (command-center commits 9255a8b, 0ccdd46). _(context: Blankpad noctalia 5.2.1 bar layout change 2026-10-09: taskbar moved to left section, group_by_workspace identified as the combining widget, verified via config validate + fullscreen screenshot)_
 - The command-center (~/.omp) pre-commit secret gate (.githooks/pre-commit, single grep -E of known token regexes) SELF-MATCHES its own documented pattern literals: committing prose that quotes them verbatim (e.g. a quoted PEM private-key header line, the xox[baprs] family prefix, the github-pat prefix, long sk- examples) trips SECRET GATE and blocks the commit (observed twice 2026-10-09 on agent/memories/--home-blank-.omp--/learned.md audit prose). Convention: redact pattern literals descriptively in prose ("PEM private-key headers", "the xox[baprs] family", "ghp 36") instead of setting ALLOW_SECRETS=1; the gate firing on prose is the gate working as designed. Note the gate covers only 10 families — no hf_/npm_/AIza/glpat-short/basic-auth-URL coverage — so clean-gate history is not proof of no leaks.
 - niri 26.04 event-stream (niri msg --json event-stream) has NO hotplug event: OutputConfigChanged is only an ACK that an IPC/config output change was Applied (per niri-ipc docs; proven live — mode flips via niri msg output NAME mode WxH@Hz and DPMS off/on emit zero output events). Detect monitor connect/disconnect by diffing the sorted unique set of .WorkspacesChanged.workspaces[].output across events (off/on cycle of eDP-1 emitted exactly WorkspacesChanged 2x). Debounce ~1.5s; OutputConfigChanged events are emitted in bursts on every config reload — ignoring them prevents hotplug-daemon echo loops. Implemented in dank/command-center scripts/desk-autoswitch.sh (blankpad-desk-autoswitch.service). Related trap: niri msg output 26.04 syntax is niri msg output NAME ACTION [args] (mode/off/on), not the old NAME WxH@Hz form.
@@ -1,3 +1,4 @@
+- serverAppConfigs LLM deploy law (verified 2026-10-09): (1) A green deploy.sh does NOT prove the running configuration — systemd drop-ins in /etc/systemd/system/unit.service.d/ are invisible to the planner and can override Environment=FRANK_*_ENV_FILE and ExecStart to a staging worktree. dankserver's frank-primary carried bench.conf (2026-10-08 04:09, left from the w4dn8 campaign) pointing both at /home/dank/serverAppConfigs-swift15, so every frank-primary deploy since then restarted the staging tree behind a healthy gate. After an LLM deploy, verify behaviourally: podman inspect container --format {{json .Config.Cmd}} + systemctl cat unit (drop-ins print at the bottom) + /v1/models. Before removing a drop-in: diff staging vs deploy-checkout serve script/unit/env, and git merge-base --is-ancestor stagingHEAD HEAD. (2) Verify a served-model-id rename on /v1/models, never on a chat response: radiance echoes the REQUESTED model name, so a 200 with the new name proves nothing; llama.cpp and halogen ignore the requested id entirely. (3) OpenWebUI keys a model id in three places — model.id+name, access_grant.resource_id (resource_type='model'), openai.api_configs per-backend model_ids — a stale id fails silently (empty picker: it intersects the backend /v1/models with model_ids). Apply with podman exec -i open-webui python3 - (no sqlite3 binary in the image), then systemctl --user restart open-webui.service. GET /api/v1/models/list returning {"items":[],"total":0} for an account whose picker is plainly populated: the API census is not the acceptance test; the browser snapshot is. (4) Playwright probes: locator.isVisible({timeout}) does NOT wait — it returns immediately; use waitFor({state:'visible'}). OpenWebUI 0.6 composer is a contenteditable div, not a textarea; stable anchors are getByRole('button', {name: /selected model/i}) and the text "How can I help you today?". (5) OPEN ITEMS reported to Frank, not approved: Hermes dankserver-small aux routes still send the retir
 - serverAppConfigs secret-scan baseline (2026-10-09, gitleaks 8.24 full history + manual sweeps, 559 files/1167 commits): tree and history CLEAN of real secrets. Known gitleaks false positives to expect on re-runs — (1) Bearer PASTE-YOUR-KEY in shared/homepage/docs.html (placeholder in public API guide); (2) curl -u admin:admin in serverAppConfigs-docs/Operations/Fleet Audit and Posture.md (Grafana default-credential RESIDUAL CHECK, not a leak); (3) FRANK_LARGE_*_SHA256 checksums in scripts/frank-*.env; (4) OAUTH_CLIENT_ID / GF_AUTH_GENERIC_OAUTH_CLIENT_ID in open-webui.container, grafana.container, dankclaw/compose.yaml — OAuth2 client IDs are public identifiers; the client SECRETS live only in git-ignored host .env files. Real-value secret file on disk: tests/e2e/.env.local (gitignored, verified). PENDING POSTURE ITEM reported to Frank, not yet approved for action: Grafana on dankclaw answers admin:admin on loopback 127.0.0.1:3002 (probe: ssh dankclaw curl -u admin:admin http://127.0.0.1:3002/api/org → 200) — rotation recommended, awaiting his go.
 - serverAppConfigs authentik user provisioning (five accounts kirby/ry/nic/debo/freya pk 17-21 created 2026-10-09; law now in vault commit 65dec6a): (1) After ak shell provisioning with the human-user template (groups Non-Admin Users + jellyfin_users + openwebui_users), OpenWebUI mints each account on FIRST SSO login with role pending (ui.default_user_role=pending in webui.db config table) — they log in fine, then cannot chat / picker is empty until UPDATE "user" SET role='user' WHERE email=…; the row does not exist before first login, so the flip is a first-login-sighting follow-up, not a provisioning step. No per-user model grant needed — the picker model carries the global access_grant row (model, frank-secondary, user, *, read). Written up in serverAppConfigs-docs/Dankclaw/OpenWebUI.md (SSO section). (2) The proxysession claim purge is only due when a group change follows an existing login; users created with their groups already in place have zero rows — verify with a per-user census instead of purging blindly. (3) The authentik-postgres container's DB role/db are authentik/authentik (POSTGRES_USER env), NOT postgres: podman exec authentik-postgres psql -U authentik -d authentik -tAc "select session_data-'claims'-'preferred_username', count(*) from authentik_providers_proxy_proxysession group by 1". (4) User.app_entitlements() requires the Application argument (Application.objects.get(slug="open-webui")) — bare call raises TypeError. Verification bar for a provision: authenticate(request=None, …) accepts the password and rejects a wrong one (the exact PasswordStage path) plus the open-webui entitlement resolves. _(context: serverAppConfigs 2026-10-09: provisioned five authentik human accounts on Dankclaw; vault pages Infrastructure/Authentik.md, Dankclaw/OpenWebUI.md, log.md updated (commit 65dec6a), bats suite 366 green.)_
 - radiance arch-capability audit (dankserver, pin 1.0.13, verified 2026-10-08): the container ships 6 arch plugins in /opt/radiance/share/radiance/architectures/ — qwen4exp_fp8, qwen35moe_fp8, qwen35_fp8, qwen35_bf16, llama_fp8, llama_dense_fp8. Capability check per plugin: grep -ac RADIANCE_CALIB / grep -ac gram / grep -ac mtp / grep -ac ngram on the .so (qwen35moe_fp8: calib=2 grams=2 mtp=4 ngram=0; gptq=0 in ALL plugins — GPTQ lives in rad-convert, not the plugin). Introspection pitfalls: the digest-pinned name (stilldeadcode/radiance@sha256:4c3f48…) does NOT resolve locally (podman tries a registry pull and fails); use the local tag docker.io/stilldeadcode/radiance:latest — image lives in ROOTLESS storage as dank (frank-primary runs rootless under the root unit; sudo podman ps is empty). Image has no ls/strings; podman exec frank-primary ls fails; correct form: podman run --rm --entrypoint sh docker.io/stilldeadcode/radiance:latest -c '…'. Verdict recorded: Qwen3.6-35B-A3B (qwen3_5_moe_text, 40 layers, 256 experts top-8, MTP×1) is plugin-supported; w4dn8 recipe maps minus PLE/HC terms; ~20 GiB w4+i8 = fully VRAM-resident on ONE 32 GiB R9700 (no TP=2/host-pool/disk-tier/MNBT-2048 law); convert ~1–1.5 h. Full audit in serverAppConfigs-docs/LLM/Quantization Production.md. _(context: serverAppConfigs 2026-10-08: feasibility audit of porting the frank-archon w4dn8 radiance recipe to Qwen3.6-35B-A3B; KB page Quantization Production.md carries the full write-up.)_
@@ -97,4 +98,3 @@
 - Frank's standing working rules for skill management (established 2026-10-05): (1) Do NOT use subagents for reading/analysis/distillation work — he explicitly ordered solo work ("Without subagents… read through each skill", later "NO. SUBAGENTS."); parallel fanout is not authorized by default even when tools suggest it. (2) The knowledgebase (serverAppConfigs-docs) is the system of record for all fleet knowledge — managed skills are NOT durable homes for lessons; when skills duplicate or extend runbooks, distill their content into vault pages and delete the skills, staging deletions in ~/.AGENTTRASH first. His default is "no reason to keep these skills". _(context: 2026-10-05 managed-skills audit session: Frank twice ordered "Without subagents" and then "NO. SUBAGENTS." when the agent planned task-fanout for reading 173 skills and distilling them; and he ruled that none of the fleet skills are worth keeping as skills — their content belongs in serverAppConfigs-docs.)_
 - serverAppConfig multi-session triage rule (proven 2026-10-05, three events in one day): when ./tests/run.sh goes red and the failing seams point at files you did not touch, FIRST split the breakage by git state: (a) COMMITTED-but-broken states from a parallel session (swap commits that forgot their seam/deployer twins) → repair them yourself in clearly-labeled follow-up commits; that is what kept the suite green twice. (b) UNCOMMITTED working-tree state (M/untracked files owned by a LIVE concurrent session — check git status --porcelain and untracked ?? entries against HEAD, which may not have moved) → do NOT edit those files; the other session is mid-flight and will reconcile env+seam+docs in its own commit; editing its dirty tree risks colliding with an active writer. Verify your own pushed state instead (rev-list HEAD...origin/main, targeted seams on your files) and report the named dirty files as the red-suite owner. Signature of case (b): HEAD identical across two suite runs yet different failures, because bats seams read the working tree, not the commit. _(context: 2026-10-05 goal session: frankbook e2e split (9c50821/2930431/1c725ea/5573ca1) interleaved with a live parallel session committing Ornith-swap breakage and later holding the tree dirty (M frank-small.env, M frank_small_unit.bats, ?? GGUF Compatibility.md).)_
 - Wrapper-script law (serverAppConfigs tests/e2e/run.sh): when converting a pure passthrough exec tool "$@" into "default argument set + passthrough", the default set must be APPENDED to "$@", not substituted for it — exec npx playwright test "${PROJECT_ARGS[@]}" silently DROPS every other arg (--list, --grep, file filters), so run.sh --list ran the entire 34-test suite instead of listing. The regression is only visible by diffing observed behavior against requested semantics; the seam (bash -n) cannot see it. Correct shape: build PROJECT_ARGS only when no user --project is present, then exec npx playwright test "$@" "${PROJECT_ARGS[@]}". Caught 2026-10-05 because the --list proof printed execution checkmarks instead of a listing; verify arg-forwarding wrappers by exercising EVERY documented passthrough arg, not just the happy path. _(context: 2026-10-05 frankbook e2e split; regression introduced by my own default-project-set rewrite and caught during verification (commit 1c725ea).)_
- frank-small seam congruence rule (serverAppConfigs repo): ANY change to scripts/frank-small.env has TWO consumers that must flip in the same change: (1) scripts/deploy-remote.sh's LLM_SMALL_MODEL_FILE/LLM_SMALL_MMPROJ defaults (the payload-existence gate — test 196 greps for the exact env path inside the deployer default), and (2) tests/frank_small_unit.bats (TARGET_STUB/MM_STUB fixture names, the MODEL_FILE env assertion, and the KV-contract test pinning --cache-type-k/--cache-type-v values from the env). On 2026-10-05 two consecutive commits broke it: the Ornith-1.5-9B Q8_0 payload swap (77decb5) left both consumers on MiMo-Q6K paths, and the KV reprice (1862dc3, f16 V→q8_0 V) left the KV test asserting the old unquantized contract — its commit message even claimed the seam was 'already retargeted in 8f53df7' when 8f53df7 covered only payload paths. Symptom each time: full ./tests/run.sh red in frank_small_unit.bats only ('missing /tmp/.../mmproj-...' or argv-value mismatch). Fix = grep the env for the new values and update all three spots. _(context: 2026-10-05 goal session (frankbook e2e split) blocked twice by frank-small seam staleness from concurrent sessions; fixed via 8f53df7-equivalent edits and 5573ca1.)_
@@ -0,0 +1,5 @@
+## Thinking Traces Input Model
+- The thinking traces' kickoff is not the user's; distinguish between what appears in thinking traces and the user's actual input.
+
+## Code Review Protocol
+- Code undergoes adversarial review before acceptance.
@@ -0,0 +1,5 @@
+## Information Gathering
+- Use the ask tool for information gathering.
+
+## Question Flow
+- Skipped questions should be re-asked when the user indicates they were missed.
@@ -0,0 +1,10 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1791836966806,
+	"lastResult": {
+		"at": 1791709075523,
+		"sessions": 1,
+		"deltas": 1,
+		"model": "frank-zealot"
+	}
+}
@@ -0,0 +1,13 @@
+## Runtime Stability
+- System runs must sustain operation beyond the first second; early termination within ~1s is a failure condition.
+
+## Performance Analysis
+- Performance gap analysis includes archon's KV quantization as a potential factor.
+- Evaluation uses index-lite metric for Qwen3.8-Flash-Next.
+- Composite index scores should be calculated and compared alongside individual model scores.
+
+## Reference Baselines
+- Agentic fine-tune evaluation: Qwen3-6-27B serves as the primary comparison baseline.
+- General capability evaluation: Qwen3.6 27B is to be evaluated against Claude Haiku 5-5.
+- Benchmark reference comparison target: qwen-flash-next.
+- In fair fight comparison, archon underperforms relative to reference.
@@ -0,0 +1,20 @@
+## Design and Testing Phases
+- Testing workflow supports pausing and resuming.
+- Test frank-archon after design implementation.
+- Adversarial reviews are conducted via the frank-archon subagent with extreme thoroughness.
+
+## Dashboard Access
+- Dashboard results accessible at http://127.0.0.1:8787
+
+## Benchmarking Workflow
+- When harness indicates failure or configuration changes (e.g., KV quantization), discard current benchmarking results and restart the entire benchmarking run.
+
+## Judge Selection
+- Use frank-zealot as the default judge for SciCode benchmark evaluation.
+- Judge must be performant enough for AA-LCR and HLE tasks.
+
+## Reference Comparison
+- Evaluate model performance against alternatives as part of the evaluation scope.
+- Reference comparison target is qwen-flash-next.
+- In fair fight comparison, archon underperforms relative to reference.
+- Score comparison to other models is included in the report.
@@ -0,0 +1,10 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1791969871087,
+	"lastResult": {
+		"at": 1791852389828,
+		"sessions": 1,
+		"deltas": 1,
+		"model": "frank-zealot"
+	}
+}
@@ -0,0 +1,17 @@
+## Root directory
+- `~/.omp` on the dev workstation; the checkout IS the deployment, not a staging copy
+
+## Knowledge base
+- `omp-docs/` directory with markdown files using YAML frontmatter (OKF v0.1 format)
+
+## Harness configuration
+- `agent/` and `plugins/` directories
+
+## System utilities
+- `scripts/` directory
+
+## Runtime state
+- Runtime state (dbs, logs, caches, sessions): gitignored on principle
+
+## File organization
+- One concept per file; directories must have an `index.md` listing all contents
@@ -0,0 +1,9 @@
+## System prompt source
+- Read `omp-docs/index.md` before modifying any configuration
+- System prompts live in the `omp-docs/` directory in OKF v0.1 format
+
+## Keyboard commands
+- `Mod+R`: keyboard command in the system
+
+## Column width presets
+- Cycle through 1/2, 1/5, 2/5, 3/5; user simplified from 6 preset options to 4 specific fractions
@@ -0,0 +1,10 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1792368375152,
+	"lastResult": {
+		"at": 1791599865775,
+		"sessions": 1,
+		"deltas": 1,
+		"model": "frank-zealot"
+	}
+}
@@ -0,0 +1,4 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1792359704968
+}
@@ -0,0 +1,4 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1792359739617
+}
@@ -0,0 +1,4 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1791600003219
+}
@@ -0,0 +1,39 @@
+## LLM Endpoint Inventory
+
+### frank-secondary (Dankclaw, port 7771)
+
+**Current**: Qwen3.5-9B-Uncensored-HauhauCS-Aggressive Q6_K (llama.cpp, RTX 3090, 200,704-token slots, vision via BF16 mmproj).
+
+**Target**: Underdog-Saluki-27B-1.0 (llama.cpp, RTX 3090, 400,000-token slots, vision via BF16 mmproj).
+
+Both run on the same hardware with the same runtime stack. The swap is model-only; container image and systemd unit remain unchanged. Vision support persists via the publisher's BF16 mmproj pass-through (`--mmproj`).
+
+**Context window law**: 400,000 tokens is the per-slot hard ceiling (`--ctx-size 401408 --parallel 2`). The harness clamps to `min(45056, contextWindow − est − 4096)` to keep room for the MTP head. With 400K context, a 45K token request leaves 355K for MTP head + estimation buffer.
+
+### frank-primary (Dankserver, port 7770)
+
+**Radiance 1.0.13**, ukisai/Swift1.5-Qwen3.8-Flash-Next BF16, 49,152 experts GPTQ w4 + 24 bf16-protected experts, 200K max-model-len, 47.7 GiB n-gram pinned to host RAM, 2 R9700s TP=2 (`--tp-wire wht6`), MTP spec decode depth 2, `--max-num-seqs 3`, `--max-model-len 200000`.
+
+### frank-large (Dankclaw, port 7770)
+
+**Halogen-flash-server 0.16.2**, Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated, 262,144 context per-slot, 2 slots × 262,144 ctx, MTP spec decode ALWAYS-ON (`HALOGEN_SPEC_ADAPT=0`), vision ON (v2 tower loads beside checkpoint), 524,288 positions KV pool.
+
+## Runtime Stack
+
+- **frank-primary**: Radiance 1.0.13 (StillDeadcode, digest-pinned `stilldeadcode/radiance@sha256:4c3f484564…`), plain `podman run`, root systemd unit, 2 R9700s TP=2.
+- **frank-large**: Halogen-flash-server 0.16.2 (`ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84…`), digest-pinned, plain `podman run` via `scripts/serve-frank-large.sh`, root systemd unit, Strix Halo iGPU.
+- **frank-secondary**: llama.cpp master (0.5.0-dev, commit `5fc4f3c`), CUDA sm_86 build, root systemd unit, RTX 3090.
+
+All LLM services are root systemd units with `Restart=always`. Container exit codes drive service restarts (`ExecStop=podman stop -t 60 <name>`). Boot persistence requires quadlet units in `~/.config/containers/systemd/<name>.container`, enabled in user manager, with linger on for the deploy user.
+
+## Model Config Resolution
+
+Official model ids are StarCraft unit names: `frank-archon` → `192.168.0.235:7770` (`FRANK_PRIMARY_SERVED_NAME`), `frank-dragoon` → `192.168.0.143:7770` (`HALOGEN_MODEL_ID`), `frank-zealot` → `192.168.0.143:7771` (`ALIAS`).
+
+**Per-slot vs pool**: llama.cpp reports per-slot window (`--ctx-size 401408 --parallel 2`), not the pool. A 2×200K pool means 200K per slot, not 400K total.
+
+**Reasoning field**: llama.cpp and SGLang emit `reasoning_content`; vLLM emits `reasoning`. `models.yml` sets `reasoningContentField` per endpoint to match.
+
+**Vision**: All three endpoints accept `input: [text, image]`. Radiance runs the checkpoint's 27-layer Qwen-VL tower (patching, pad-token expansion, 3-part rotary, `--mm-max-patches` available). Halogen v2 loads the vision tower beside the checkpoint. Llama.cpp passes the model's BF16 mmproj via `--mmproj`.
+
+**Audio**: No audio input anywhere in the fleet (left with FLM NPU endpoint 2026-09-11, returned 2026-09-17, left again 2026-10-01).
@@ -0,0 +1,41 @@
+## Model Capabilities
+
+### Context Window
+
+**400,000 tokens** is the fleet-wide per-slot ceiling. The harness clamps max_tokens to `min(45056, contextWindow − est − 4096)` to preserve MTP head and estimation buffer. With 400K context, a 45K token request leaves 355K for MTP head + estimation.
+
+### Multimodal
+
+All three LLM endpoints accept `input: [text, image]`. Vision is native: Radiance and Halogen v2 load their vision towers beside the checkpoint; llama.cpp passes the BF16 mmproj via `--mmproj`.
+
+### Audio
+
+No audio input in the fleet. The FLM NPU endpoint had audio 2026-09-17 → 2026-10-01, but neither MiMo nor Qwen3.5 tower carries it.
+
+### MTP (Multi-Token Prediction)
+
+- **frank-primary** (Radiance): MTP spec decode depth 2, `--max-num-seqs 3`.
+- **frank-large** (Halogen): MTP spec decode ALWAYS-ON (`HALOGEN_SPEC_ADAPT=0`), 2 slots × 262,144 ctx, harness window 217,088 = ceiling − 45k estimate headroom.
+- **frank-secondary** (llama.cpp): MTP OFF (no `nextn` tensors exist in Qwen3.5-9B Q6_K GGUF).
+
+## Benchmarking Policy
+
+**STOP the production service BEFORE benchmarking**. A live service starves the GPU and corrupts results.
+
+**Procedure**:
+1. Stop and mask (self-healing would restart it):
+   - Dankclaw `frank-large`: `sudo systemctl stop frank-large && sudo systemctl mask frank-large`
+   - Dankclaw `frank-secondary`: `sudo systemctl stop frank-secondary && sudo systemctl mask frank-secondary`
+   - Dankserver `frank-primary`: `sudo systemctl stop frank-primary && sudo systemctl mask frank-primary`
+2. Bench.
+3. Unmask and start; verify `curl http://192.168.0.<host>:7770/health`.
+
+**CRITICAL**: `systemctl disable` deletes the unit file from `/etc/systemd/system/`; `mask` symlinks to `/dev/null` and is safe/reversible. Re-deploy after benching instead of unmasking.
+
+**Gufo bench**: Cannot rank speculative-decode settings; will invert the ranking. Use for shape, not for A/B. Generate **at least 128 tokens** — at 8 tokens, `inter_token` is first-token noise and run-to-run spread swamps real differences. For A/B, replay **real** text through the live server and read the `Server-Timing` header (`ttft;dur=402.485` in the name half, split on `=` keys the dict `ttft;dur`).
+
+**GPU experiment law**: A bare 2-rank RCCL/torch.distributed probe against a live service can wedge the GPU driver (host went hard down ~20 minutes, power cycle required). If an experiment needs GPUs, stop and mask first, or use a host that serves nobody. Distinguish: `ip neigh show <ip>` from a peer — FAILED means off/NIC dead, merely wedged kernel usually still answers ARP.
+
+**Live measurement**: llama.cpp servers report honest per-request numbers in the `/completion` `timings` object (prefill/decode rates, `draft_n`, `draft_n_accepted`).
+
+**Scratch ports**: Not used on LLM hosts — a test process cannot share the single GPU anyway; validate against the service itself.
@@ -0,0 +1,10 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1791601698371,
+	"lastResult": {
+		"at": 1791600472354,
+		"sessions": 1,
+		"deltas": 2,
+		"model": "frank-zealot"
+	}
+}
@@ -0,0 +1,32 @@
+## Documentation Voice
+
+Use terse, normative statements. Avoid "the user wants", "currently", "now", "fixed", "regressed", "recently". State what the system **does**, not what happened.
+
+## Bullet Budget
+
+At most 120 lines per file. Nearly empty or empty files are honest.
+
+## Single-Home Rule
+
+- `architecture.md`: structural/runtime decisions (component boundaries, chosen abstractions, protocol/storage direction, explicit "X over Y" with reason).
+- `product.md`: behavior, UX, defaults, scope, naming/terminology, workflow decisions.
+- `style.md`: visual/aesthetic language, presentation/typography conventions, prose/voice rules.
+
+## Concreteness Test
+
+Every bullet must change a fresh agent's behavior. "Provide configurable, reference-compatible interactions" is delete-tier. "Status bar: powerline segments, solid right edge, inward-facing left triangle, no bold, elapsed time ≤3 chars" is keep-tier.
+
+## Exclusions
+
+- Project docs digest (already documented).
+- Global user taste not a project decision.
+- Current-task state (bugs in flight, progress, plans, TODOs, "for now").
+- File paths, line numbers, function/type names, commit/issue ids (product component vocabulary allowed).
+
+## Friction Markers
+
+A terse marker like "(recurrently regressed)" MAY close a bullet where it strengthens the instruction; keep rare.
+
+## Grouping
+
+Group bullets under short `##` domain sections. One line per bullet where possible.
@@ -0,0 +1,4 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1791601913910
+}
@@ -0,0 +1,15 @@
+## Tool Usage
+
+### Information Gathering
+
+- Use the `ask` tool for information gathering tasks.
+
+## Model Domain Assignments
+
+- **frank-zealot** (llama.cpp, Qwen3.5-9B) is not optimized for coding tasks; route coding workflows to other endpoints.
+
+## Tool Usage
+
+### Information Gathering
+
+- Use the `ask` tool for information gathering tasks.
@@ -0,0 +1,10 @@
+{
+	"v": 1,
+	"lastConsolidatedAt": 1791676316971,
+	"lastResult": {
+		"at": 1791609430982,
+		"sessions": 1,
+		"deltas": 1,
+		"model": "frank-zealot"
+	}
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Frank	7d9486f646	chore(skills): wire agent/skills to the skills CLI global store Retroactive provenance registration: the 10 pi-era skill snapshots are byte-identical to upstream (38 skills mattpocock/skills + find-skills vercel-labs/skills), now canonically installed at ~/.agents/skills with store lockfile ~/.agents/.skill-lock.json (39 entries, folder hashes). omp is not a skills-CLI agent id, so the omp tier becomes manual wiring: replace the 10 tracked skill directories with symlinks into the store and link the remaining 29 upstream skills the same way (39 links). The repo now records the enabled set, never content; skills update -g propagates through the links. managed-skills tier untouched. Docs: skill-store-wiring.md (+index). Snapshot of the old real dirs at /tmp/agent-skills-snap-20261018 for the transition window.	2026-10-18 18:07:31 -07:00
Frank	57e255f930	live: heartbeat sync 2026-10-18T17:49:00-07:00 (Refs #11 )	2026-10-18 17:49:00 -07:00
Frank	b3d3df4bdb	feat(niri): amber-orange focus-ring, width 4 (ff8c00) Frank's outline restyle: focus-ring red #e01b24 -> #ffb000 -> #ff8c00 (orange), thickness 2 -> 4 in base layout.kdl. The visible ring is painted by noctalia.kdl, included LAST in config.kdl — its focus-ring active/urgent colors moved to #ff8c00 too; tab-indicator, insert-hint, and recent-window highlights deliberately stay red. noctalia.kdl was hand-written live-only (Oct 14, no repo copy — the override that silently beat every layout.kdl edit); first durable copy lands in the zz-blankpad mirror.	2026-10-18 17:37:27 -07:00
dank	5d523f6e9f	Merge pull request 'docs: noctalia bar clobber postmortem (log entry)' (#15 ) from wt/20261018-170616 into main	2026-10-18 17:30:58 -07:00
Frank	b353fa9075	revert(live-sync): drop path-activation unit Frank veto: DirectoryNotEmpty re-fires on every file event (GUI writes, wallpaper shuffle) un-debounced -> hundreds of heartbeat spawns/day. The sweep is cheap (57 ms CPU) but the trigger design was event spam. Exposure-window fix is an open design question; timer unchanged.	2026-10-18 17:23:58 -07:00
Frank	c300f8b49c	feat(live-sync): path-activate heartbeat on dotfiles writes (Refs #11 ) Timer-only heartbeat left GUI dotfiles edits uncommitted for up to 59 minutes; a trunk-sync session clearing the dirty tree on 2026-10-18 destroyed a month of uncommitted noctalia bar layout inside that gap. live-sync.path (DirectoryNotEmpty on dotfiles/) fires the existing flock-guarded oneshot within seconds of any repo-side dotfiles write, shrinking the exposure window from ~1h to ~2s. Timer stays as the hourly catch-all for the machine tiers.	2026-10-18 17:20:17 -07:00
Frank	bde10f8948	docs: work-log entry for noctalia bar clobber + dangling-stash recovery Documents the 16:46 layout loss (uncommitted GUI state stashed, stash entry destroyed during trunk sync) and the git-fsck recovery landed in `c87b378`. Lesson codified in managed skills.	2026-10-18 17:16:49 -07:00
Frank	c87b378475	fix(noctalia): restore bar layout clobbered by 16:46 trunk-sync stash The rich GUI-built layout (cat/clock/clock-utc/weather start, taskbar center, capsule groups g1-g4 + control-cheat-sheet end, thickness 36, font_scale 1.3, opacity 0.9) existed only in the working tree; it was stashed at 16:46 during the trunk merge and the stash entry was later destroyed. Recovered from dangling stash commit 7fe3ed8 via git fsck. This commit is the durable copy the layout never had before.	2026-10-18 17:12:20 -07:00
Frank	979e9ef711	live: heartbeat sync 2026-10-18T16:47:59-07:00 (Refs #11 )	2026-10-18 16:47:59 -07:00
Frank	a550db6027	Merge remote-tracking branch 'origin/main' # Conflicts: # AGENTS.md # agent/config.yml # omp-docs/log.md	2026-10-18 16:47:37 -07:00
Frank	3713339ffc	chore: adopt pre-existing working-tree state before trunk merge Uncommitted machine/session edits (live config, models, docs drift) were blocking the merge of origin/main. Committed as-is to preserve them; the merge that follows resolves overlapping prose files toward upstream canonical, with local variants recoverable from this commit. Pre-merge copies also in .AGENTTRASH/pre-merge-2026-10-18/.	2026-10-18 16:46:57 -07:00
dank	5a3d563a22	Merge pull request 'docs: attribution footer for machine-opened issues and PRs' (#14 ) from docs/session-trailer-rule into main	2026-10-18 16:46:00 -07:00
Frank	8702f3058d	chore: re-sync agent skills to upstream mattpocock/skills Local snapshots dated 2026-09-16; upstream has moved on since. Refreshes 7 SKILL.md files (code-review, diagnosing-bugs, implement, tdd, grilling, handoff, teach): tracker-doc references generalized, CONTEXT.md renamed GLOSSARY.md, implement gains ticket-fetch step + Skill-tool invocation, grilling question wording rule, handoff names the OS temp dir, teach workspace-path resolution + quiz answer-position rules, tdd seam notes. find-skills (vercel-labs) and prototype already current. Skill updates take effect next session (discovery runs at startup).	2026-10-18 14:57:20 -07:00