frank-primary: swap Dankserver to llama.cpp Qwen3.8-Flash-Next Q8_0

The 2026-09-26 same-day cutover that ended the Lucebox DS4.1 detour:
Dankserver's :7770 endpoint is now unsloth llama.cpp (the b11030-mix
prebuilt, ROCm gfx120X, bundled runtime) serving
unsloth/Qwen3.8-Flash-Next-GGUF at Q8_0 — 175.30 GiB across six sha256-
verified split parts — on both Radeon AI PRO R9700s, as a ROOT unit (the
frank-large shape: no container, no generated unit).

The deployed contract:

- Placement law: layer split -ts 1,1 with -ngl 999; the routed experts
  and the 51B-param n-gram (PLE) table are COMPUTED in host RAM via
  -ot exps=CPU,ngram_embeddings=CPU (the x4-pair measurement: streaming
  over PCIe loses at 3.7 t/s, computing in RAM does not care).
  per_layer_token_embd.weight=CPU is required by the shared MTP head's
  borrow path (a GPU-resident borrow crashes the draft load).
  mmap stays on; --cache-ram 16384.
- Spec chain draft-mtp,ngram-mod: the shared Q8_0 MTP head
  (mtp-...-shared-Q8_0.gguf, 2,786,568,256 B) at depth 2, with the
  draftless ngram-mod matcher chained behind it — the only legal way to
  layer two spec implementations in one process.
- Vision explicit: --mmproj names the BF16 projector (this build never
  autoloads; a server without it comes up healthy and text-only).
- Reasoning: --reasoning-format deepseek → reasoning_content; the
  Qwen3.8 template's {xhigh, medium, low} reasoning_effort gate folded
  by reasoningEffortMap in models.yml.
- One stream, the model's full 262,144 context; greedy server default
  with Qwen-recommended sampling riding compat.extraBody.

The deployer's deploy_llm_primary is rewritten for the root unit: it
gates every artifact at its declared byte count (stat -c %s, never wc -c
— which read the whole 377 GiB lucebox file for minutes on 2026-09-26),
retires the lucebox user quadlet to dated home trash, waits out port
7770, relinks/enables/restarts the root unit and waits up to 1800 s for
/health. The quadlet-era tree under dankserver/frank-primary/ is
archived (dankserver/.AGENTTRASH/20260926-llamacpp-cutover/ on this
box; git history everywhere else) and its planner mapping replaced by
the scripts/ trio.

Observability flips back to the llamacpp namespace: a frank-primary
Prometheus job at 192.168.0.235:7770 (cross-host LAN — the netavark
published-port quirk that forces host.containers.internal for the two
Dankclaw endpoints is same-host only), the LlmEndpointDown runbook
text, and the dashboard description for three llama.cpp endpoints.

Docs: the new runbook (frank-primary-llamacpp-qwen38-flash-next-q8.md),
RETIRED banners on the lucebox and radiance runbooks and their index
entries, the AGENTS.md fleet section rewritten for the root-unit shape,
and the homepage frank-medium card renamed to frank-primary with the
Q8_0 Flash-Next spec (docs.html #models and the modality note updated:
images on frank-primary and frank-small, audio on frank-small only).

models.yml: the dankserver provider is "llamacpp (dankserver)" serving
frank-primary, contextWindow 262144, maxTokens 65536 (compaction-gap
law: 183,501 + 65,536 <= 262,144), input [text, image].

Suite: 346 green (frank_primary_unit.bats rewritten for the root unit —
16 tests pinning the placement law, the shared-head requirement, the
explicit projector, HIP env hygiene (BIND_HOST, never bare HOST), and
the deployer's byte-count gates; the quadlet-era planner and
changed-tests mappings rewritten for the trio; the observability scrape
test asserts three llamacpp jobs again).

Rollback: the lucebox image (localhost/lucebox-rocm:gfx1201) and the
378 GiB payload stay on the host; the Qwen payload stays fetched, so a
re-swap in either direction is a redeploy, not a refetch.

tests/observability_quadlet.bats

@@ -315,24 +315,29 @@ PAIRS
 
 @test "prometheus scrapes every LLM endpoint that exports metrics" {
     # The LLM endpoints are the services whose behaviour this fleet argues about
-    # most (KV pressure, prefix-cache reuse, queue depth). Only the two Dankclaw
-    # llama.cpp endpoints export metrics today: frank-primary (Dankserver, the
-    # Lucebox DS4.1 engine since the 2026-09-26 cutover) answers 404 on
-    # /metrics, so a job for it would be a permanently-down target — no job,
-    # and its LAN address must not sneak back in with one.
-    # The two scraped endpoints are HOST processes reached through
+    # most (KV pressure, prefix-cache reuse, queue depth). All three export
+    # the llamacpp:* family since 2026-09-26, when frank-primary (Dankserver)
+    # went back to llama.cpp — the unsloth b11030-mix prebuilt serving
+    # Qwen3.8-Flash-Next Q8_0 — after two days of the Lucebox DS4.1 engine,
+    # which exported nothing (404) and had no job.
+    # The two Dankclaw endpoints are HOST processes reached through
     # host.containers.internal: this Prometheus is a bridge-networked
     # container, and on this netavark host a container can only reach the
     # host's LAN IP at a PUBLISHED port — a host-process bind like
     # llama-server's 0.0.0.0:7770 is refused at 192.168.0.143:7770 while it
     # answers at 169.254.1.2:7770 (why frank-small stayed red by construction
-    # for days until the 2026-09-20 /targets audit).
+    # for days until the 2026-09-20 /targets audit). frank-primary is a
+    # DIFFERENT machine, so that quirk does not apply: plain LAN routing
+    # reaches 192.168.0.235:7770, and the job must say so (a gateway target
+    # would point at Dankclaw's own :7770 — frank-large — and double-scrape
+    # it under the wrong label).
     local cfg="$REPO_ROOT/shared/prometheus/prometheus.yml"
-    ! grep -q '"192.168.0.235:7770"' "$cfg" || { echo "frank-primary is scraped but exports no metrics"; return 1; }
-
     grep -q '"host.containers.internal:7771"' "$cfg" || { echo "frank-small not scraped"; return 1; }
     grep -q '"host.containers.internal:7770"' "$cfg" || { echo "frank-large not scraped"; return 1; }
-    for job in frank-small frank-large; do
+    grep -q '"192.168.0.235:7770"' "$cfg" || { echo "frank-primary not scraped"; return 1; }
+    grep -q '"host.containers.internal:7770,192.168.0.235:7770"' "$cfg" \
+        && { echo "frank-primary folded into a Dankclaw gateway target"; return 1; }
+    for job in frank-small frank-large frank-primary; do
         grep -q "job_name: \"$job\"" "$cfg" || { echo "no scrape job for $job"; return 1; }
     done
     # None of them is reached through a guarded vhost: Prometheus cannot solve