docs(log): wire-rename wave — three served ids, OpenWebUI + Hermes re-key, bench drop-in retired

serverAppConfigs-docs/log.md

@@ -19,6 +19,61 @@
   the role-flip SQL, and the global `access_grant` (`principal_id='*'`) fact
   that makes the picker model visible to every `role='user'` account.
 
+- **Live — the Protoss rename finished on the wire (all three endpoints).**
+  Served model ids moved `frank-primary` → **frank-archon**
+  (`FRANK_PRIMARY_SERVED_NAME`), `frank-large` → **frank-dragoon**
+  (`HALOGEN_MODEL_ID`), `frank-secondary` → **frank-zealot** (`ALIAS`). The
+  services, units, scripts, env files and runbook pages keep the old names —
+  container/unit identity stays stable, only the alias moved. Deploys in order:
+  `dankclaw --service frank-secondary` (e2e gate 33/33 green), `dankclaw
+  --service frank-large` (healthy 30 s), `dankserver --service frank-primary`
+  (healthy 102 s), `dankclaw --service homepage`. Verified on `/v1/models`,
+  not on chat echoes: `frank-zealot` (`n_ctx 200704`, Q6_K), `frank-dragoon`
+  (`context_length 262144`), `frank-archon`.
+- **Live — OpenWebUI re-keyed in the same window** (snapshot
+  `webui.db.bak-20261009`): `model` row (`frank-secondary` → `frank-zealot`,
+  params + `meta.description` preserved), the `access_grant` row
+  (`model`/`frank-zealot`/`user`/`*`/`read`), and `openai.api_configs`
+  `model_ids` on all three backends; `systemctl --user restart
+  open-webui.service`. Family-account proof, in a real browser as `qa-e2e`:
+  the welcome screen selects `frank-zealot` and
+  `POST /api/v1/chat/completions {"model":"frank-zealot"}` answers
+  `zealous` with `"model":"frank-zealot"`. A `GET /api/v1/models/list`
+  probe returns `{"items":[],"total":0}` for that account while the picker
+  is plainly populated — the API census is not the acceptance test, the UI
+  snapshot is.
+- **Live — Hermes re-keyed** (`config.yaml` `frank-large` → `frank-dragoon`
+  in the provider block, `model.default` and the three `dankclaw-large`
+  auxiliary routes; backup `config.yaml.bak-20261009`; `hermes.service` +
+  `hermes-webui.service` restarted, gateway log clean, `/health` ok) and the
+  repo baseline `dankclaw/hermes/config.yaml.example` synced to the live
+  shape (context 262144). **Flagged, not fixed:** Hermes still routes its
+  `dankserver-small` auxiliary tasks at the id `frank-medium` on
+  `192.168.0.235:7770`, an endpoint that has served `frank-primary` since
+  2026-09-20 — those routes were dead before this rename and remain dead;
+  they need a routing decision (archon capacity), not a rename.
+- **Deployer blind spot found by accident:** every
+  `deploy.sh dankserver --service frank-primary` since 2026-10-08 04:09
+  restarted the **staging worktree**, not the deploy checkout — a campaign
+  drop-in `frank-primary.service.d/bench.conf` overrode `Environment=` and
+  `ExecStart`. The health gate went green each time. Verified parity before
+  removing it (serve script + unit byte-identical, env identical except the
+  alias, staging HEAD an ancestor of `main`), moved the drop-in to
+  `/home/dank/.AGENTTRASH/20261009-frank-primary-bench-dropin/`, and
+  restarted: `/v1/models` then answered `frank-archon`. Post-deploy
+  behavioural proof is now part of the runbook.
+- Repo: seams re-pinned (`frank_secondary`/`frank_large`/`frank_primary`
+  unit bats), fleet harnesses retargeted (`bench-probe`, `deep-probe`,
+  `calib-push`, `fleet-probes-swift15`, `autoresearch*`,
+  `bench-threads-batch-http`, `bench-decode`), `shared/homepage/docs.html`
+  now teaches the ids it ships (curl/opencode/Pi send `frank-zealot`),
+  `AGENTS.md`, [[OMP Harness]], [[Homepage]], [[OpenWebUI]] and the three
+  endpoint runbooks updated. Suites: `./tests/run.sh` 366 green.
+- **Transcript secret incident:** dumping `podman exec hermes-webui env`
+  printed the Porkbun API key + secret key into this session's transcript —
+  same class as the 2026-09-16 HF-token-in-`ps` leak. Not committed
+  anywhere; rotation is Frank's call.
+
 ## 2026-10-08
 - **frank-primary (Dankserver): Swift1.5-Qwen3.8-Flash-Next GPTQ w4 —
   the radiance quantization campaign.** ukisai's BF16 checkpoint (335.3