e2e: crawl reset survives app navigation; dragoon docs carry the cut ledger

Two faces of the same verification round.

12-crawl returned to the homepage between links with a bare page.goto, and Plex
Web (signed out, so it renders its own sign-in iframe for its Plex-account flow)
keeps redirecting the top frame: Chromium cancelled our goto with
net::ERR_ABORTED, outside the try, so the whole crawl died — once as a 420 s
timeout in the deploy gate, once at 5.4 s on the same link. backHome() tolerates
that one error class and re-issues; any other error still propagates, and the
per-app verdict (guard settled, hostname, no authentik uidField, status < 500)
is unchanged. Plex was healthy throughout (container up 2 days, 32400 answering
HTTPS 401 / plain-HTTP empty reply), so this was app behaviour, not a fault —
recorded as gotcha 6 on the E2E page.

The 200,704 boot printed 5.5 GiB reserved and 74.1 GiB in all (not the ~5.4/~74
my arithmetic predicted), so every prose figure is re-keyed to the ledger, and
the runbook gains the second production-boot section: marker revision, pool
reservation, shape line, prompt-cache entry size, and the refusal contract at the
new ceiling (400 in 0.86 s naming 200704 and the 96,405-token overage, before any
prefill). Cost stated (two maximum-length conversations never coexist; the 180k
compaction target is unreachable inside a 155,648 window) and purchase stated
(1.7 GiB of page cache, 9.1 GiB against the 2026-10-06 shape).

serverAppConfigs-docs/Architecture/E2E Suite.md

@@ -82,3 +82,10 @@ real IdP credentials.
 5. **Solve-once cookie.** Since Anubis v1.27.0 + `COOKIE_DOMAIN` (see
    [[Anubis]]), one PoW per fresh context covers every guarded vhost — crawl
    and SSO specs complete in ~0.5 s per vhost instead of a PoW each.
+6. **Apps navigate too.** `12-crawl` returns to the homepage between links, and
+   Plex Web (signed out, so it shows its own *"would like to sign in to your
+   Plex account"* iframe) keeps redirecting the top frame — Chromium cancels our
+   `goto("/")` with `net::ERR_ABORTED`, which used to abort the whole crawl
+   (once as a 420 s timeout, once at 5 s on the same link). `backHome()` re-issues
+   the navigation; the app itself was already judged, so the abort is the app's
+   behaviour, not a guard-chain failure.

serverAppConfigs-docs/LLM/frank-dragoon-flash-server-v2-native.md

@@ -99,8 +99,10 @@ printed `pinned 62.11 GiB in 1 range(s) in 1.6 s (41.0 GB/s)` trunk,
 `0.84 GiB` vision tower, `reserving the KV pool, 262144 positions (about
 7.2 GiB)`, and the engine's own sum: `memory: 62.9 GiB of weights locked in
 RAM (0.8 of them the vision tower's), 7.2 GiB of KV pool, …, 75.8 GiB in
-all`. After the same-evening ctx/pool cut to 200,704 the reservation is ~5.4
-GiB and the total ~74. The n-gram table rides as page cache — `mapped 51.2 GB,
+all`. The cut boot printed the same shape at the new size: `reserving the KV
+pool, 200704 positions (about 5.5 GiB)` and `… 5.5 GiB of KV pool, 5.7 GiB of
+working memory, 74.1 GiB in all`.
+The n-gram table rides as page cache — `mapped 51.2 GB,
 NOT pinned (Pin::None)` — which is exactly why every pool cut is a *double*
 saving. FLAGS.md law: **RAM the pool takes is RAM that table loses**; the ~9
 GiB the two cuts together handed back is page cache for the 47.68 GiB table
@@ -225,3 +227,45 @@ on the FIRST request after boot, i.e. the warmup artifact; the trial's settled
 figure is 50.0. OpenWebUI's `frank-dragoon` row description re-keyed to the
 native payload (backup `webui.db.bak-20261017b`; no container restart forced —
 forcing it logs every family session out for one cosmetic string).
+
+## Ceiling lowered to 200,704 — the second production boot (`7c4dbeb`)
+
+The same evening, after the ledger above was read: `HALOGEN_CTX` and
+`HALOGEN_KV_POOL_POSITIONS` 262144 → **200704** (49 × 4096, the per-slot rung
+the llama.cpp endpoint frank-zealot already runs). The checkpoint's native
+window is 262,144 and the engine serves anything below it, so this is a RAM
+decision, not a capability limit. Nothing in the fleet asks for the bigger
+window; the harness moved WITH the ceiling (400-zone law), `models.yml`
+`contextWindow: 155648`.
+
+|Line|Figure|
+|---|---|
+|marker|`revision=7c4dbeb…`, `status=deployed`; unit `active`, `/health` 200|
+|KV pool|`reserving the KV pool, 200704 positions (about 5.5 GiB)`|
+|shape|`2 slots over ONE 200704-position KV pool, each request up to 200704 (it reserves prompt + max_tokens), max_tok 8192 … MTP depth-2 selectable (drafter 1…)`|
+|working|5.7 GiB (unchanged — it scales with `HALOGEN_MAX_TOK`, not the window)|
+|total|`62.9 GiB of weights locked … 5.5 GiB of KV pool, 5.7 GiB of working memory, 74.1 GiB in all`|
+|prompt cache|ON, resume-anywhere, 12 entries, chunk 32768, **111 MiB each at ctx 200704**|
+|clamps|none — requested pool == delivered pool|
+
+The refusal contract at the new ceiling, asked for explicitly (the 1.29 MB
+wikitext corpus through `/v1/chat/completions`):
+
+```
+HTTP 400 {"error":{"message":"the prompt does not fit: it is 297109 tokens and
+the context is 200704, 96405 tokens over. Shorten the prompt, or raise the
+context (HALOGEN_CTX, and HALOGEN_ROPE_YARN for more than the native 262144).",
+"type":"invalid_request_error"}}
+```
+
+Refused in 0.86 s — the preflight rejects before any prefill, so probing the
+ceiling costs the endpoint nothing. OpenWebUI's `frank-dragoon` row description
+re-keyed to "ONE 200,704-position KV pool at ctx 200,704" (still no container
+restart; `webui.db.bak-20261017b` holds the pre-cutover row).
+
+**What the cut cost:** with pool == ctx one maximum-length request fills the
+pool, so two 200k conversations never coexist (two of ≤100 k do), and the
+harness window is now 155,648 — the 180 k compaction target of the 262,144 era
+is unreachable because the window itself is smaller. **What it bought:** 1.7
+GiB back as page cache for the 47.68 GiB n-gram table (9.1 GiB against the
+2026-10-06 shape's 524,288 pool), and a smaller prompt-cache entry.

serverAppConfigs-docs/LLM/index.md

@@ -89,8 +89,8 @@ frank-zealot, port 7771]
   3.968 with mean KL 0.155 against the Swift1.5 logits on the same corpus).
   `HALOGEN_CTX=200704` over `HALOGEN_KV_POOL_POSITIONS=200704`: **one pool
   behind two slots** (the card ships 262,144/262,144 = 7.2 GiB; Frank took the
-  RAM the same evening — ~5.4 GiB, one maximum-length request filling the
-  pool), and the freed RAM becomes page cache for the n-gram
+  RAM the same evening — 5.5 GiB reserved, one maximum-length request filling
+  the pool), and the freed RAM becomes page cache for the n-gram
   table. MTP head always on, sampler 1.0/0.95/20, coupled cap/timeout
   65536/7200, prompt cache ON, vision ON. Measured against the Swift1.5
   boot: cold prefill +12.6 %, decode 50.0 vs 46.8 t/s, NIAH 18/18 vs 17/18,