docs(openwebui): re-key the model rows at swap time; default is frank-archon

The picker's decoration rows carried two payload-swap drifts: frank-dragoon
still named halogen 0.16.2 (live 0.18.20) and frank-zealot build 10777 /
3x262,144 / MTP off (live build 12118 / 3x200,704 / draft-mtp armed). Worse,
their params.context.length values had swapped, so OpenWebUI advertised more
window than the zealot slot grants and gave up 61k tokens on dragoon. Live
rows re-keyed through the admin API and ui.default_models set to
frank-archon; the swap procedure in AGENTS.md now names the re-key step.

AGENTS.md

@@ -278,7 +278,10 @@ archive.
 **Swap the model. Do not instrument it.** A payload change is: edit the trio
 (env / serve script / unit) → `scripts/deploy.sh <host> --service <svc>` →
 `/health` answers → one chat turn, one tool call, and one vision probe on an
-endpoint that serves images. That is the entire procedure.
+endpoint that serves images → re-key that endpoint's OpenWebUI `model` row
+(`meta.description` + `params.context.length`, API door in [[OpenWebUI]]). That is
+the entire procedure — no deployer step touches `webui.db`, and a stale
+`context.length` makes OpenWebUI advertise a window the endpoint does not grant.
 
 - **No benchmarking unless Frank orders it.** No pre-swap baseline battery,
   no A/B arms, no decode/prefill ladders, no acceptance tables, no numbers

serverAppConfigs-docs/Dankclaw/OpenWebUI.md

@@ -109,6 +109,39 @@ The Ollama connection is disabled (`ollama.enable=false`).
 > connection here only hides it from this picker — the endpoint itself keeps
 > serving every other client (the harness, Hermes, API consumers).
 
+## Default model, descriptions, and the admin API door
+
+**The default model is `ui.default_models`** — one row of the config table, a
+comma-separated **string**, not a list. Live value `frank-archon` since
+2026-11-04 (per Frank). The front end resolves the picker as *the browser's own
+stored pick, else `config.default_models.split(",")`*, so the value decides what
+a fresh profile or a cleared-storage session lands on; after a user picks
+something themselves, their pick keeps winning. Verified 2026-11-04 in a clean
+browser: signed in with `localStorage` empty → the pill reads
+`Selected model: frank-archon`.
+
+Two admin-token doors, both driven against loopback `:3005` — service-to-service
+traffic never rides the public vhost:
+
+- **Config:** `POST /api/v1/configs/import` with
+  `{"config":{"ui.default_models":"frank-archon"}}` — the general per-key setter
+  (no `PATCH /configs/{key}` route exists in 0.12.5; verified against
+  `routers/` + `main.py`), and it returns the whole config so the write reads
+  back in the same call.
+- **A model row:** `POST /api/v1/models/model/update` with a full `ModelForm`
+  (`id`, `name`, `meta`, `params`, `is_active`). **`meta` and `params` REPLACE,
+  they do not merge:** read the row first, change one field, send everything
+  back — a partial payload silently drops `meta.capabilities` and the
+  profile/background images.
+
+**An API key is not accepted everywhere.** Routes guarded by `get_human_user`
+(`/api/v1/auths/`, `utils/auth.py`) answer **403 `A human session is required.`**
+for any token whose `typ` is not `session` — that is not a dead key. The two
+mutation doors above take `get_admin_user` / `get_verified_user`, which do accept
+the key. Prove a key on `GET /api/v1/models` with **no trailing slash**:
+`/api/v1/models/` falls through to the SPA and answers `200` + `text/html`, which
+looks like success and parses as nothing.
+
 ## Container introspection (DB and backend python)
 
 - Working dir for imports: `/app/backend`; package name `open_webui`
@@ -431,6 +464,21 @@ with frank-tts logging `speech voice=wilwheaton`.
   app process env; the `.webui_secret_key` file happens to equal it — use it
   explicitly, `podman exec -e`).
 
+- **2026-11-04 — decoration rows drifted again; default model set to
+  `frank-archon`.** Two payload swaps had gone by without anyone touching the
+  picker: `frank-dragoon`'s row still advertised halogen `0.16.2`, and
+  `frank-zealot`'s still said `build 10777` / `3×262,144` / *MTP off* — live is
+  `0.18.20`, `build 12118`, `3 × 200,704`, MTP armed. The prose is cosmetic; the
+  `params.context.length` values had **swapped**, and that one bites:
+  `frank-zealot` advertised 262,144 while the endpoint refuses anything past its
+  200,704 slot, so a long zealot chat rides the endpoint's 400 instead of
+  compacting, and `frank-dragoon` advertised 200,704 against a 262,144 ceiling,
+  giving up 61k tokens of window for nothing. Both rows re-keyed through the API
+  door in [Default model, descriptions, and the admin API door](#default-model-descriptions-and-the-admin-api-door),
+  descriptions rewritten from the env files, and `ui.default_models` set to
+  `frank-archon`. **Law: a model swap is not finished until that endpoint's
+  `model` row is re-keyed as well — no deployer step touches `webui.db`.**
+
 ## See Also
 
 - [[Dankclaw Stack]]