Merge pull request 'fix(qwen38): the preflight asks whether the pin is ONE of an image's digests' (#92) from fix/quant-pipeline-hardening into main

scripts/qwen38-preflight.sh

@@ -43,13 +43,16 @@ fi
 
 # 2. image — resolve the REF to a digest. A stale local `:latest` is a different model of the world.
 if command -v podman >/dev/null 2>&1; then
-    got="$(podman image inspect -f '{{index .RepoDigests 0}}' "$IMAGE_REF" 2>/dev/null | sed 's/.*@//')"
-    if [ -z "$got" ]; then
-        bad image "$IMAGE_REF is not present on this host (podman has no digest for it)"
-    elif [ "$got" = "$WANT_DIGEST" ]; then
-        ok image "$IMAGE_REF resolves to ${got:0:19}…"
+    # An image carries EVERY digest it was pulled under (a tag plus the by-digest pull), so this
+    # asks whether the pin is one of them — reading RepoDigests[0] reports a healthy image as wrong.
+    got="$(podman image inspect -f '{{range .RepoDigests}}{{println .}}{{end}}' "$IMAGE_REF" 2>/dev/null \
+           | sed 's/.*@//' | grep -c "^${WANT_DIGEST}$")"
+    if [ "${got:-0}" -ge 1 ]; then
+        ok image "$IMAGE_REF carries ${WANT_DIGEST:0:19}…"
+    elif podman image exists "$IMAGE_REF" 2>/dev/null; then
+        bad image "$IMAGE_REF is present but does not carry $WANT_DIGEST (a retagged or older pull)"
     else
-        bad image "$IMAGE_REF resolves to $got, expected $WANT_DIGEST"
+        bad image "$IMAGE_REF is not present on this host"
     fi
 else
     skip image "podman not on PATH — cannot resolve $IMAGE_REF"

serverAppConfigs-docs/LLM/frank-archon.md

@@ -571,6 +571,16 @@ vllm-radiance era (this table opens on 09-26; the era page claims 10-10).
   of falling through its health wait. All three exist because on 2026-10-29 the unguarded chain's
   rig boot died of an OOM, the health loop expired without failing, and the pusher fed four rounds
   of 10M tokens into **restored production** — 86 minutes of live prefill that recorded nothing.
+- **A calibration step has an OPTIMUM, and it is not the widest step that boots.** The tap's cost is
+  expert re-reads per document (a 7,168-token document cut into four 2,048-token steps re-streams
+  each layer's routed expert union four times), which argues for the widest step — but the measured
+  curve turns over: at the 32,768 calibration window one 2-way prefill of the same document ran
+  **106 tok/s at an 8,192-token step and 76 tok/s at 16,384**, with the computed activation arena
+  growing 3.39 → 4.50 GiB, so the wider step pays more compute than it saves in reads. The
+  200,000-window `QSA score plane` refusal that made the wide step look impossible is an artifact of
+  serving the production window: the same 16,384-token step needs a 512 MiB plane at 32,768.
+  `Q38_CALIB_MNBT` is the only knob — the KL modes keep production's step, because their numbers are
+  only comparable at one shape.
 - **A container that exists, a port that answers, and a `/health` 200 are three different claims —
   bind identity before believing any of them.** Measured 2026-10-30: `podman inspect` named the rig
   while the port still belonged to the *dying* production process (`health ok waited=0s`, window dead

tests/qwen38_campaign.bats

@@ -851,7 +851,9 @@ preflight_fixture() {
     cat > "$PF/bin/podman" <<'EOS'
 #!/usr/bin/env bash
 case "$1" in
-  image) echo "${STUB_IMAGE_DIGEST:-sha256:69add58f7de1ed2bca2b1e20a4cc75717557df3f73569a178eca5aafe8c44093}" ;;
+  image) # an image carries every digest it was pulled under; the pin is one of them
+         printf '%s\n' "docker.io/stilldeadcode/radiance@sha256:4beb81eea874e3e308fbffbe1a9402a2f845c19e68ea612ba949b43bd5cb7cb0"
+         printf '%s\n' "docker.io/stilldeadcode/radiance@${STUB_IMAGE_DIGEST:-sha256:69add58f7de1ed2bca2b1e20a4cc75717557df3f73569a178eca5aafe8c44093}" ;;
   top)   echo HPID; echo "${STUB_PROD_PIDS:-4242}" ;;
 esac
 EOS
@@ -881,7 +883,7 @@ run_preflight() {
     run run_preflight
     [ "$status" -eq 0 ]
     [[ "$output" == *"PREFLIGHT PASSED"* ]]
-    [[ "$output" == *"resolves to sha256:69add58f"* ]]
+    [[ "$output" == *"carries sha256:69add58f"* ]]
 }
 
 @test "preflight accepts the service's own process on the port, not just any answer" {
@@ -897,7 +899,7 @@ run_preflight() {
     export STUB_IMAGE_DIGEST="sha256:deadbeefdeadbeef"
     run run_preflight
     [ "$status" -eq 2 ]
-    [[ "$output" == *"expected sha256:69add58f"* ]]
+    [[ "$output" == *"does not carry sha256:69add58f"* ]]
 }
 
 @test "preflight fails when :7770 belongs to a host pid the service does not own" {