frank-small: repoint the deployer payload gate and unit seam at the Ornith-1.5-9B payload

The 17:47 Ornith-1.5-9B swap (77decb5) updated frank-small.env and
serve-frank-small.sh but left two consumers on the MiMo-Q6K paths:
deploy-remote.sh's LLM_SMALL_MODEL_FILE/LLM_SMALL_MMPROJ defaults (the
payload-existence gate checked files the unit no longer loads) and
frank_small_unit.bats (stubs + env assertion), which held the whole
bats suite red. Both now point at the Ornith-Q8 payload; docs updated
with the conditional frankbook e2e project.

AGENTS.md

@@ -90,7 +90,14 @@ A deploy is **not complete** when `deploy.sh` exits green. It requires:
 2. the Playwright e2e suite (`tests/e2e/run.sh`) — runs **automatically** as
    the `[3/3]` gate at the end of `deploy.sh` against the LIVE fleet; a
    behavior-affecting deploy that fails it exits `DEPLOY INCOMPLETE`. Bypass
-   only with `--skip-e2e` in an emergency.
+   only with `--skip-e2e` in an emergency. The gate runs the conditional
+   `frankbook` Playwright project (the `*arr`/qBittorrent walk,
+   `tests/e2e/specs/19-frankbook.spec.ts`) ONLY when a frankbook blast-radius
+   path changed since origin/main — that spec, `frankbook-pro/**`,
+   `shared/homepage/services.json`, or the `dankclaw/Caddyfile` serving the
+   arr vhosts — so a sleeping FrankBook-Pro never fails an unrelated deploy.
+   The default project set excludes it everywhere else (`E2E_INCLUDE_FRANKBOOK=1`
+   opts in; see `serverAppConfigs-docs/Architecture/E2E Suite.md`).
 
 ```mermaid
 graph LR

serverAppConfigs-docs/Architecture/E2E Suite.md

@@ -20,11 +20,12 @@ user sees it; the `bats` seams assert config shape, not behavior.
 
 | Path | Role |
 |------|------|
-| `playwright.config.ts` | four projects (below), real-browser UA, trace on failure |
+| `playwright.config.ts` | five projects (below), real-browser UA, trace on failure |
 | `specs/00-auth.setup.ts` | setup project: two real authentik logins, saves storage states |
 | `specs/10-homepage.spec.ts` | user panel set + open links derived from `services.json` (registry-derived — no hardcoded service lists) |
 | `specs/11-admin.spec.ts` | `admin` project: admin grid + `/admin/` RBAC (403 for standard user, members-only 200) |
 | `specs/12-crawl.spec.ts` | every user open link reaches its real app through the guard chain |
+| `specs/19-frankbook.spec.ts` | `frankbook` project: walks the six admin links that terminate on FrankBook-Pro (192.168.0.112) — conditional, see below |
 | `specs/13-sso.spec.ts` | direct guarded-vhost visits resolve silently with ONLY the homepage session (single-login enforcement) |
 | `specs/14-guard.spec.ts` | `guest` project, no storage state: unauthenticated traffic lands on the IdP login |
 | `lib/login.ts` | `akLogin` helper (two-stage flow, shadow-DOM locators) |
@@ -38,7 +39,16 @@ user sees it; the `bats` seams assert config shape, not behavior.
   `.auth/qa-e2e{,-admin}.json` storage states.
 - **standard** — 10/12/13 with the user state.
 - **admin** — 11 with the admin state.
-- **guest** — 14 with an empty state.
+- **guest** — 14/15 with an empty state.
+- **frankbook** — 19 with the admin state. **Excluded from every default run**: the
+  *arr/qBittorrent links terminate on FrankBook-Pro, which sleeps when idle, and a
+  sleeping Mac mini must never fail an unrelated deploy. The project joins only
+  when `E2E_INCLUDE_FRANKBOOK=1` (set by `scripts/deploy.sh` when a frankbook
+  trigger path changed: `tests/e2e/specs/19-frankbook.spec.ts`, `frankbook-pro/**`,
+  `shared/homepage/services.json`, or the `dankclaw/Caddyfile` serving the arr
+  vhosts) or when an explicit `--project` argument names it. An `11-admin` edit
+  that touches the arr links must therefore be paired with a `19-frankbook` run
+  against an awake host before it is trusted live.
 
 Credentials live in `tests/e2e/.env.local` (git-ignored; placeholders in
 `.env.local.example`). The scaffold bats seam fails the commit if creds or
@@ -47,8 +57,9 @@ auth states are ever tracked.
 ## Run
 
 ```bash
-cd tests/e2e && npx playwright test            # all projects
-npx playwright test --project=standard 12-crawl.spec.ts   # one slice
+tests/e2e/run.sh                          # default set — frankbook project excluded
+E2E_INCLUDE_FRANKBOOK=1 tests/e2e/run.sh  # default set + the frankbook walk
+cd tests/e2e && npx playwright test       # ALL projects, frankbook included
 ```
 
 Requires LAN reachability of `www.franksdank.cloud` (Pi-hole DNS or public).

serverAppConfigs-docs/log.md

@@ -1,6 +1,26 @@
 # Bundle Change Log
 
 ## 2026-10-05
+- **e2e: the FrankBook-Pro leg scoped to its own trigger-gated Playwright
+  project.** The `11-admin` walk included the six `*arr`/qBittorrent admin
+  links that terminate on 192.168.0.112, so every deploy gate died there when
+  the Mac mini slept (Caddy 502 on the five vhosts, connection timeout on the
+  raw Sonarr link). Split: those links moved to
+  `tests/e2e/specs/19-frankbook.spec.ts` under a `frankbook` project;
+  `tests/e2e/run.sh` excludes it from the default project set, and
+  `scripts/deploy.sh` computes a trigger from the same BASE..HEAD range the
+  plan uses (the spec, `frankbook-pro/**`, `shared/homepage/services.json`,
+  the `dankclaw/Caddyfile` arr vhosts) and sets `E2E_INCLUDE_FRANKBOOK=1`.
+  Verified live with the host asleep: full suite 33/33 in 1.1 min, the admin
+  walk back to 5.4 s; `--project=frankbook --list` proves the selection.
+  Live pass of the frankbook walk itself is deferred to the next deploy with
+  an awake host.
+  - **Catch while verifying: the 17:47 Ornith-1.5-9B swap (`77decb5`) had
+    left `frank_small_unit.bats` and the deployer's payload gate stale** —
+    the seam still expected MiMo-Q6K names and `deploy-remote.sh` gated
+    `LLM_SMALL_MODEL_FILE`/`LLM_SMALL_MMPROJ` on files the unit no longer
+    loads (the anti-drift seam doing its job). Both repointed to the
+    Ornith-Q8 paths; full `./tests/run.sh` back to green (366 tests).
 - **frank-small: compute-buffer pair doubled to 4096/2048, and the prefill win
   measured rather than assumed.** Frank asked for the batch and ubatch doubled.
   The blocker was on record: the Q5_K_M predecessor documented **"ubatch 2048