feat(inventory): one service inventory drives planner, allow-lists, and seams

rank 3. shared/services.yml is the single source of truth for every
deployable service (hosts, unit dirs, units, path claims, tests, scrape/
dns/probe facts, aliases, stacks); scripts/service-map.py is its only
reader (hosts/services/allows/plan/seams/owner/units/stack/get/render/
check). deploy-plan.py becomes a thin CLI wrapper; both --service
allow-lists (deploy.sh, deploy-remote.sh) and the changed-test mapper are
the inventory. Selection semantics: host scoping (a host's tree selects
only its own services), the quadlet netns/network coupling graph resolved
across directories (gluetun's riders live in their own dirs), stacks, and
canonical restart order.

Against the pinned old-planner fixture: 921 raw deltas reduced to 17, all
intentional (anubis now maps; cross-host paths select nothing; the retired
qwen-sharp template plans nothing and the live froggeric template plans
frank-archon; dankserver/romm/romm.container, missed by the old filename
rule, plans the romm trio). The fixture is regenerated as the new pin.

Integrity gates: schema, unit claims, quadlet-file ownership, path-glob
liveness, Pi-hole hosts / Prometheus jobs / DNS / homepage probes drift.
tests/service_inventory.bats pins all of it plus the plan fixture and the
deploy-plan CLI. Allow-list grep seams in hermes_webui/observability_quadlet
become behavioral allows calls.

AGENTS.md

@@ -35,11 +35,16 @@ the [runbook index](#runbook-index). The full swap history lives in
 
 ## Repository Layout
 
-- `dankserver/` — compose.yaml + Caddyfile + .env.example for the media stack
-- `dankclaw/` — compose.yaml + Caddyfile + .env.example for the AI stack
-- `shared/` — homepage, Prometheus, Loki, Alloy, SearXNG configs
-- `scripts/` — `deploy.sh` / `deploy-plan.py` / `deploy-remote.sh`, LLM serve
-  scripts, systemd units, env tunables, bench harnesses
+- `dankserver/` — quadlet units + Caddyfile for the media stack (the
+  compose.yaml inventory retired 2026-10-13; its mounts had diverged from
+  the quadlets)
+- `dankclaw/` — quadlet units + Caddyfile for the AI stack (compose retired 2026-09-16)
+- `shared/` — the service inventory (`services.yml`), homepage, Prometheus,
+  Loki, Alloy, SearXNG configs
+- `scripts/` — `deploy.sh` / `deploy-plan.py` / `deploy-remote.sh` and
+  `service-map.py` (the inventory's only reader), LLM serve scripts + the
+  shared artifact gates (`scripts/lib/llm-gates.sh`), systemd units, env
+  tunables, bench harnesses
 - `old/` — retired LLM scripts (reference only)
 - `serverAppConfigs-docs/` — knowledge base (Obsidian vault, OKF format).
   The managed skill library is distilled there one page per skill-cluster:
@@ -70,8 +75,13 @@ All edits flow through git. Never edit files on a remote machine directly.
 ./scripts/deploy.sh dankclaw --dry-run
 ```
 
-The planner maps changed paths to services; the remote runner restarts only
-the selected service and records its revision outside the checkout.
+The inventory (`shared/services.yml`, read only through
+`scripts/service-map.py`) maps changed paths to services; the remote runner
+restarts only the selected service and records its revision outside the
+checkout. Both `--service` allow-lists, the planner, and the changed-test
+seam mapper ARE the inventory — adding, moving, or retiring a service is a
+data edit, not a script edit
+(`serverAppConfigs-docs/Architecture/Service Inventory.md`).
 Documentation-only changes are a no-op. LLM services are selected only by
 their own files — every endpoint (`frank-dragoon`/`frank-zealot`/`frank-archon`)
 by its unit/env/serve trio in `scripts/` — so
@@ -164,12 +174,17 @@ Tests are mandatory before commit (`bats` required on the dev machine):
 ./tests/run.sh
 ```
 
-Seams: compose validity, env consistency (no leaked secrets), Caddyfile
+Seams: env consistency (no leaked secrets), Caddyfile
 validity, quadlet units, docs completeness **including vault link integrity**,
 script syntax (shell + python), LLM unit integrity, LLM secret hygiene,
-deployment flow, service-scoped planning, homepage config/pages/deploy/checker,
-and `e2e_scaffold` — which fails if a Playwright spec file's number prefix is in
-no project, because such a spec silently never runs.
+LLM artifact gates (`llm_gates`/`llm_deploy_gates` — the shared
+`scripts/lib/llm-gates.sh` every endpoint's serve and deploy gates run on),
+deployment flow, service-scoped planning, the **service inventory**
+(`service_inventory.bats`: inventory soundness, the pinned path->service
+plan fixture, render drift for the Pi-hole hosts file), homepage
+config/pages/deploy/checker, and `e2e_scaffold` — which fails if a
+Playwright spec file's number prefix is in no project, because such a spec
+silently never runs.
 See `serverAppConfigs-docs/Architecture/Testing Policy.md`.
 
 ## Secret Rules
@@ -1041,7 +1056,7 @@ Active:
 |---------|---------|
 | frank-dragoon (flash-server 0.16.2, abliterated Swift1.5 v2 .hgn + MTP always-on, 2×262,144, vision ON, Dankclaw) | `serverAppConfigs-docs/LLM/frank-dragoon-flash-server-v2-swift15.md` |
 | frank-zealot (llama.cpp CUDA, Qwen3.5-9B-Uncensored Q6_K, 2×200,704 exact f16 KV MTP-off, vision ON, Dankclaw) | `serverAppConfigs-docs/LLM/frank-zealot-llama-qwen35-9b-q6k-2x200704.md` |
-| frank-archon (radiance StillDeadcode, Qwen3.8-Flash-Next-FP8 native, 2×R9700 TP=2, Dankserver) | `serverAppConfigs-docs/LLM/frank-archon-radiance-qwen38-native-fp8.md` |
+| frank-archon (radiance StillDeadcode, Swift1.5-Qwen3.8-Flash-Next GPTQ w4 + bf16-protected experts, int8 trunk, bf16 KV, 2×R9700 TP=2, Dankserver) | `serverAppConfigs-docs/LLM/frank-archon-radiance-swift15-w4dn8.md` |
 | Dankclaw kernel posture (`amd_iommu=off`) | `serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md` |
 | Deployment flow + incidents | `serverAppConfigs-docs/LLM/deployment.md` |
 
@@ -1050,6 +1065,7 @@ Retired (rollback targets and history):
 | Runtime | Host | Window | Runbook |
 |---------|------|--------|---------|
 | llama.cpp CUDA Gemma4-26B-A4B QAT Q4_K_M, 1×200,704 f16-K/q8_0-V MTP-off (`frank-zealot`) | Dankclaw | 2026-10-07 → 10-07 (same-day swap; rollback target — payload on disk; owns the `attention_k_eq_v` pair-billing KV law and the gemma4-assistant drafter-cost boots) | `frank-zealot-llama-gemma4-q4km-200704.md` |
+| radiance StillDeadcode Qwen3.8-Flash-Next native-FP8, 2×R9700 TP=2 (`frank-archon`) | Dankserver | 2026-10-08 → w4dn8 swap (rollback target — `.rad` payload on disk) | `frank-archon-radiance-qwen38-native-fp8.md` |
 | ROCmFPX llama.cpp fork Qwen3.8-27B Uncensored Q6_0_ROCMFPX_AGENT + MTP (`frank-dragoon`) | Dankclaw | 2026-10-03 → 10-05 (rollback target, payload + fork build on disk) | `frank-dragoon-rocmfpx-q6agent-uncensored-mtp.md` |
 | tcclaviger vLLM fork Qwen3.8-Flash-Next-Uncensored FP8, TP=2, shape G (`frank-archon`) | Dankserver | 2026-09-29 → 10-05 (rollback target — tag `frank-archon-vllm-shapeG-20261003`; trio + env lore in the tag, image in rootless storage) | `dankserver-qwen38-fp8-expert-offload-tuning.md` |
 | FreeToken PR #587 ROCm, Qwen3.8-Flash-Next-Uncensored-FP8, ONE R9700 (`frank-archon`) | Dankserver | 2026-10-05 → 10-05 (rollback target — tag `frank-archon-freetoken-pr587-20261005`; trio + Dockerfile in the tag, image `localhost/frank-archon-freetoken:pr587-77a7201` and orcarouter payload on disk) | `frank-archon-freetoken-pr587.md` |