refact(comments): state the mechanism, not the incident

Every comment that invoked a 'law' (50 word-boundary sites across 28
tracked files) now states what is going on and why, in terms that
transfer to any project: gate twins drift until one side greenlights
what the other refuses; a tag re-points while a digest pins; a
restrictive engine behavior belongs to the runtime that imposed it and
must be re-tested, not inherited; a speculative head is tensors in the
file, not a flag; snapshot links dangle where the container resolves
them; exit 0 is a clean stop to systemd, so a self-exiting daemon on
on-failure goes dark reporting success. Event narratives and dates are
gone from these comments; the mechanics carry the argument.

Behavior-identical: bash -n, py_compile, yaml parse, full bats suite
408/408 green. One symbol rename rides along (stack script local
scale_law -> scale_contract, with its log text).

.AGENTTRASH/frank-dragoon.env.llama.cpp

@@ -1,4 +1,4 @@
-# Tunables for frank-large (kingjones777/Qwen3.8-Flash-Next-ROCmFP4-
+# Tunables for frank-dragoon (kingjones777/Qwen3.8-Flash-Next-ROCmFP4-
 # STRIX-GGUF on the kingjones30/ROCmFPX llama.cpp runtime, Dankclaw,
 # Strix Halo gfx1151, unified memory).
 #
@@ -56,7 +56,7 @@ CHAT_TEMPLATE_FILE=/home/dank/serverAppConfigs/scripts/chat-template.jinja
 CHAT_TEMPLATE_KWARGS='{"enable_thinking":true,"preserve_thinking":true,"preserve_reasoning":true}'
 
 # Alias + network.
-ALIAS=frank-large
+ALIAS=frank-dragoon
 BIND_ADDR=0.0.0.0
 LISTEN_PORT=7770
 

.AGENTTRASH/frank-dragoon.service.llama.cpp

@@ -1,5 +1,5 @@
 [Unit]
-Description=ROCmFPX (kingjones30 fork) llama.cpp Qwen3.8-Flash-Next ROCmFP4 STRIX 177B MoE (dankclaw, frank-large)
+Description=ROCmFPX (kingjones30 fork) llama.cpp Qwen3.8-Flash-Next ROCmFP4 STRIX 177B MoE (dankclaw, frank-dragoon)
 After=network-online.target
 Wants=network-online.target
 
@@ -7,8 +7,8 @@ Wants=network-online.target
 Type=simple
 User=dank
 Group=dank
-Environment="FRANK_LARGE_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-large.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-large.sh
+Environment="FRANK_DRAGOON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-dragoon.sh
 Restart=on-failure
 RestartSec=10
 

.AGENTTRASH/frank-npu.env.flm-npu

@@ -6,7 +6,7 @@
 # is reachable on this port regardless of the boot tag. The NPU is a
 # single-lane device: generations serialize FIFO, and the first request after a
 # model swap pays the ~6-11 s load cost. The NPU draws from the unified RAM
-# pool shared with frank-large (iGPU).
+# pool shared with frank-dragoon (iGPU).
 FLM_MODEL=nuextract3:4b
 FLM_HOST=0.0.0.0
 FLM_PORT=7771

.AGENTTRASH/serve-frank-dragoon.sh.llama.cpp

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Serve kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF as
-# frank-large via the kingjones30/ROCmFPX llama.cpp runtime on
+# frank-dragoon via the kingjones30/ROCmFPX llama.cpp runtime on
 # Dankclaw (Strix Halo gfx1151, unified memory).
 #
 # Runtime: kingjones30/ROCmFPX (fork of charlie12345/ROCmFPX with the
@@ -29,7 +29,7 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-large.env}"
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
 if [[ -f "$ENV_FILE" ]]; then
     set -a
     # shellcheck disable=SC1090
@@ -44,7 +44,7 @@ fi
 : "${MMPROJ_PATH:=/home/dank/models/agentionai-Qwen3.8-Flash-Next-ROCmFP4-FAST/mmproj/mmproj-Qwen3.8-Flash-Next-f16.gguf}"
 : "${CHAT_TEMPLATE_FILE:=$SCRIPT_DIR/chat-template.jinja}"
 : "${CHAT_TEMPLATE_KWARGS:={}}"
-: "${ALIAS:=frank-large}"
+: "${ALIAS:=frank-dragoon}"
 : "${BIND_ADDR:=0.0.0.0}"
 : "${LISTEN_PORT:=7770}"
 : "${CTX_SIZE:=401408}"

.AGENTTRASH/serve-frank-npu.sh.flm-npu

@@ -4,7 +4,7 @@
 # Runs `flm serve <tag>` on the XDNA2 NPU (50 TOPS, Dankclaw). The NPU is a
 # single-lane device: generations serialize in FIFO order, so this is a
 # background/triage endpoint, not an interactive multi-user chat. The NPU
-# draws from the unified RAM pool shared with frank-large (the iGPU
+# draws from the unified RAM pool shared with frank-dragoon (the iGPU
 # llama.cpp service); see serverAppConfigs-docs/LLM/frank-npu.md
 # for the memory budget and the model-selection tradeoff.
 #

AGENTS.md

@@ -9,11 +9,12 @@ services run from `/home/dank/serverAppConfigs` on each host (the 2026-08-22
 merge absorbed the former `vllmScripts` repo, history preserved).
 
 - **Dankserver** (192.168.0.235) — media/library stack (RomM, Copyparty,
-  Calibre-Web, Jellyfin, Plex) plus the `frank-primary` LLM service.
+  Calibre-Web, Jellyfin, Plex) plus the `frank-archon` LLM service.
 - **Dankclaw** (192.168.0.143) — AI/search/dev/observability stack (SearXNG
   via Gluetun, ComfyUI, OpenWebUI, Hermes, Gitea, Grafana, Prometheus, Loki,
-  Alloy, Pi-hole) plus TWO LLM services: `frank-large` (halogen container on
-  the gfx1151 iGPU) and `frank-small` (llama.cpp CUDA on the RTX 3090). Caddy on
+  Alloy, Pi-hole) plus TWO LLM services: `frank-dragoon` (flash-server
+  container on the gfx1151 iGPU) and `frank-zealot` (llama.cpp CUDA on the
+  RTX 3090). Caddy on
   Dankclaw reverse-proxies both hosts.
 - **FrankBook-Pro** (192.168.0.112) — macOS mini running the *arr stack
   (Prowlarr, Sonarr, Radarr, Lidarr, Readarr, qBittorrent) as quadlets inside
@@ -24,9 +25,9 @@ merge absorbed the former `vllmScripts` repo, history preserved).
 
 | Target | Service | Runtime | Model | Port |
 |--------|---------|---------|-------|------|
-| Dankserver | `frank-primary` | tcclaviger RDNA4 vLLM fork (`docker.io/tcclaviger/vllm@sha256:da4029666…`, digest-pinned, plain `podman run`, root systemd unit) | `orcarouter/Qwen3.8-Flash-Next-Uncensored-FP8` (~172.8 GiB, 131 shards), TP=2, expert offload automatic (fork plans it), prefetch OFF, **fp8 KV** (`--kv-cache-dtype fp8`), **no speculative decode**, MNBT 2048 (arena-free: the registry prices overhead flat up to its nbt 4096 anchor), MoE gather 32×64, **`--expert-precise-memory`** (fitted 5.25 GiB overhead, not the 7.60 GiB default), **`VLLM_CUDAGRAPH_MEM_BASE_MB=0` / `_PER_GRAPH_MB=12`** (the plan's CUDA-graph term priced at the measured capture — 0.31 GiB then a NEGATIVE −0.06 GiB delta, so the 256 MiB analytic base was fiction → graph term 0.07 GiB), **`GPU_MAX_HW_QUEUES=2`**, **mounted cache dir** at `/root/.cache` (the image ships no `/root/.cache` at all; unmounted, every boot re-pays `torch.compile took 181.20 s`), **3 slots × 200704 ctx** at KV_BYTES 3,166,500,000/rank (~400,700 KV tokens at the engine's 7,891.8 B/token here) — the **pool, not the slot count, caps resident conversations** (measured live: `GPU KV cache size: 401,408 tokens, Maximum concurrency for 200,704 tokens per request: 2.00×`; the 3.15e9 pool below it measured 398,658/1.99×), and shorter requests use the spare blocks. **`--max-num-seqs` must stay 3: SEQS=2 cannot boot this model** — torch.fx `ConstraintViolationError` on `query_start_loc`, measured at BOTH MNBT 1024 and 2048. **util stays 0.982 BY LAW**: at `le=1` the worker init refuses `budget == total` with `ValueError: Free memory on device cuda:N (31.29/31.86 GiB)` on both ranks before a single weight loads — measured crash loop 2026-10-03. Arena at shape G: **17.77 GiB / 7,762 slots measured**, KV 401,408 tokens / 2.00× concurrency, 0.89 GiB of real free VRAM per card held through a live 4,096-token generation (the ~3.5 GiB of driver-reported free VRAM at shape E was estimator slack — the registry's 9190 B/token KV reserve vs the real 7,892, and the 5.25 GiB overhead vs far less — NOT allocatable), and the client contract wired: `--reasoning-parser …
-| Dankclaw | `frank-large` | **halogen container** (`ghcr.io/peonist-ai/halogen@sha256:dc0a39a0…`, digest-pinned, plain `podman run` via `scripts/serve-frank-large.sh`, root systemd unit) | `peonist-ai/halogen-qwen3.8-27b` **`qwen3.8-27b-p1w4d-d2.hgn`** (35,865,565,184 B; the `.hgn` format loads in NO other engine — llama.cpp, vLLM and transformers all refuse it), **DFlash2 spec decode (`HALOGEN_DRAFTER=2`)**, **1 slot × 200,700 ctx** — `HALOGEN_KV_SLOTS=1` is load-bearing: batching XOR speculation, slots>1 silently disables the drafter (measured: 8 slots at serial ~6 t/s/stream), d2 KV (2× fp8, 64 KiB/token → 12.2 GiB pool, engine sizes it and prints a boot ledger naming any clamp), **TEXT-ONLY** (the engine ignores the vision encoder — vision is frank-small's job), **censored base** (the ROCmFPX AGENT rollback is the refusal escape hatch), **no server-side sampler: absent temperature is GREEDY**, so the card's thinking recipe (temp 1.0 / top_p 0.95) rides the wire in `models.yml`. Publisher card 31.7 t/s mean across eight text workloads vs the retired ROCmFPX endpoint's measured 27.6–28.1. Prompt over the slot AND `max_tokens` over `HALOGEN_MAX_TOKENS_CAP` are both 400s naming the limit, never truncations. Serve passes NO `--ulimit nofile` (rootless runc cannot raise Dankclaw's 524288 hard limit — see Key Lessons). Cutover 2026-10-05|7770|
-| Dankclaw | `frank-small` | llama.cpp master, CUDA sm_86 build (root systemd unit, relinked) | bartowski/MiMo-V2.6-Distill-Qwen-9B-GGUF **Q6_K** (9B dense qwen3_5 hybrid, 7.26 GiB GGUF, no MTP weights so no spec decode) + the repo's f16 mmproj for **vision**, on the RTX 3090, **2 × 200,704** (pool 401,408 — NOT the native window) with **fully unquantized KV (f16 K + f16 V)** under flash attention, **batch 4096 / ubatch 2048** (doubled 2026-10-05: measured +4.6 % prefill at 8,928 tokens for 616 MiB), 21,846 used / **2,279 free** of 24,576 MiB, 94.4 tok/s decode. Resized 2026-10-03 (3 × 180,224 + q8_0 V → 2 × 200,704 + f16 V → + Q6_K rung: the freed slots paid for exact values AND the higher quant; the rung costs a measured −10 % decode — weight-bandwidth-bound); rollback `MODEL_FILE=…/MiMo-Q5KM/…Q5_K_M.gguf` (buys the 10 % back) or `CTX_SIZE=540672 PARALLEL=3 CACHE_TYPE_V=q8_0` (Q5 only) | 7771 |
+| Dankserver | `frank-archon` | **radiance** (StillDeadcode, **pin 1.0.13** digest-pinned `stilldeadcode/radiance@sha256:4c3f484564…`, plain `podman run`, root systemd unit) | ukisai/Swift1.5-Qwen3.8-Flash-Next BF16 (335.3 GiB, 397/397 sha256-verified) converted by `scripts/convert-swift15-w4dn8.sh` to `qwen4exp-swift15-w4dn8-i8-hc8m.rad` (**116,416 MiB**): **all 49,152 experts GPTQ w4** (10M-token calibration on engine 1.2.0) + **24 whole bf16-protected experts/layer** (energy-share law), int8 trunk/lm_head, fp8 HC, PLE n-gram fp8 fixed-scale, on **BOTH R9700s TP=2** (`--tp-wire wht6`), experts in a **40 GiB/rank pinned host pool** + VRAM cache (`--placement expert_tiered`, explicit `--vram-weights-mib 26071 --vram-kv-mib 3543`), **47.7 GiB n-gram copy pinned to host RAM** (`--ngram-placement ram`; root unit + `LimitMEMLOCK=infinity`), **fp8 KV** (inherited; pool 3.46 GiB), **MTP spec decode depth 2**, `--max-num-seqs 3`, `--max-model-len 200000`, MNBT 2048, Froggeric v22.5 template. KLD-gated (mean KL 0.0131, top-1 97.92 % vs BF16); decode ~190 t/s live (gate bar 30.8). Cutover 2026-10-08 from fp8-native (payload on disk = rollback). | 7770 |
+| Dankclaw | `frank-dragoon` | **halogen-flash-server 0.16.2** (`ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84…`, digest-pinned, plain `podman run` via `scripts/serve-frank-dragoon.sh`, root systemd unit) | Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated **`qwen38-flash-next-v2-swift15-abliterated.hgn`** (66,687,678,464 B = compacted r2 of the card's 89,775,868,032 B original, ~62 GiB resident; the v2 `.hgn` format loads in NO other engine), **+ REQUIRED `qwen38-flash-next-ngram.hgn`** (51,200,246,144 B, peonist @5cc17cea — read beside the checkpoint) **+ vision tower** (897,916,416 B, @e053f488 — **vision ON**, `image_url` parts only, ≥256 px probes), **MTP spec decode ALWAYS-ON (`HALOGEN_SPEC_ADAPT=0` — the adaptive default disables the drafter per request and HALVES decode)**, MTP head INSIDE the checkpoint (`HALOGEN_MTP_HEAD` unset; no sidecar fetched), **2 slots × 262,144 ctx** (KV pool 524,288 positions ≈ 14.0 GiB at ~28 KiB/position; the 27B slots>1-disables-drafting law does NOT carry over — batching and speculation coexist, the card's quickstart ships 2 with the head), harness window 217,088 = ceiling − 45k estimate headroom, **server-side sampler 1.0/0.95/20** (card recipe; models.yml extraBody matches), coupled cap/timeout 65536/7200, prompt cache ON by default (warm 100k turn ≈ 2 s vs ≈ 88 s cold)|7770|
+| Dankclaw | `frank-zealot` | llama.cpp master (0.5.0-dev, commit `5fc4f3c`), CUDA sm_86 build (root systemd unit, relinked) | HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive **Q6_K** (7,359,259,008 B; dense `qwen35` hybrid: 32 layers, 8 full-attention + 24 Gated DeltaNet, 4 KV heads × 256 dim, vocab 248,320, native 262,144, **no MTP tensors in the file**) + the publisher's own **BF16 mmproj** (921,704,448 B) for **vision**, on the RTX 3090, **TWO 200,704-token slots** (`--ctx-size 401408 --parallel 2`), **exact f16 K + f16 V** under flash attention (32 KiB/token over the 8 full layers = 12.25 GiB pool), batch 4096 / **ubatch 2048** (measured CUDA optimum), `--log-verbosity 4`, **MTP OFF** (forced: no `nextn` tensors exist). Priced from the MiMo Q6_K boots (same geometry, same card, same shape): 21,276/2,849 at ubatch 1024, 21,846/2,279 at 2048. Cutover 2026-10-07 (late) from Gemma4-26B-A4B Q4_K_M 1×200,704. All three endpoints route harness **compaction** here. | 7771 |
 
 Retired endpoints (`frank-npu`, and every prior runtime) are in
 the [runbook index](#runbook-index). The full swap history lives in
@@ -34,13 +35,22 @@ the [runbook index](#runbook-index). The full swap history lives in
 
 ## Repository Layout
 
-- `dankserver/` — compose.yaml + Caddyfile + .env.example for the media stack
-- `dankclaw/` — compose.yaml + Caddyfile + .env.example for the AI stack
-- `shared/` — homepage, Prometheus, Loki, Alloy, SearXNG configs
-- `scripts/` — `deploy.sh` / `deploy-plan.py` / `deploy-remote.sh`, LLM serve
-  scripts, systemd units, env tunables, bench harnesses
+- `dankserver/` — quadlet units + Caddyfile for the media stack (the
+  compose.yaml inventory retired 2026-10-13; its mounts had diverged from
+  the quadlets)
+- `dankclaw/` — quadlet units + Caddyfile for the AI stack (compose retired 2026-09-16)
+- `shared/` — the service inventory (`services.yml`), homepage, Prometheus,
+  Loki, Alloy, SearXNG configs
+- `scripts/` — `deploy.sh` / `deploy-plan.py` / `deploy-remote.sh` and
+  `service-map.py` (the inventory's only reader), LLM serve scripts + the
+  shared artifact gates (`scripts/lib/llm-gates.sh`), systemd units, env
+  tunables, bench harnesses
 - `old/` — retired LLM scripts (reference only)
-- `serverAppConfigs-docs/` — knowledge base (Obsidian vault, OKF format)
+- `serverAppConfigs-docs/` — knowledge base (Obsidian vault, OKF format).
+  The managed skill library is distilled there one page per skill-cluster:
+  `LLM/index.md` → *Cross-Cutting References*, plus `Operations/index.md`,
+  `Agent/index.md`, and the Infrastructure/Dankclaw/FrankBook-Pro service
+  pages (`serverAppConfigs-docs/log.md` carries the wave plan and results)
 - `tests/` — bats suite + Playwright e2e
 
 ## Git Workflow
@@ -61,14 +71,19 @@ All edits flow through git. Never edit files on a remote machine directly.
 ./scripts/deploy.sh dankclaw
 ./scripts/deploy.sh dankserver
 ./scripts/deploy.sh dankclaw --service searxng
-./scripts/deploy.sh dankserver --service frank-primary
+./scripts/deploy.sh dankserver --service frank-archon
 ./scripts/deploy.sh dankclaw --dry-run
 ```
 
-The planner maps changed paths to services; the remote runner restarts only
-the selected service and records its revision outside the checkout.
+The inventory (`shared/services.yml`, read only through
+`scripts/service-map.py`) maps changed paths to services; the remote runner
+restarts only the selected service and records its revision outside the
+checkout. Both `--service` allow-lists, the planner, and the changed-test
+seam mapper ARE the inventory — adding, moving, or retiring a service is a
+data edit, not a script edit
+(`serverAppConfigs-docs/Architecture/Service Inventory.md`).
 Documentation-only changes are a no-op. LLM services are selected only by
-their own files — every endpoint (`frank-large`/`frank-small`/`frank-primary`)
+their own files — every endpoint (`frank-dragoon`/`frank-zealot`/`frank-archon`)
 by its unit/env/serve trio in `scripts/` — so
 unrelated
 container changes cannot interrupt inference. Set `FRANK_SUDO_PW` for headless
@@ -80,7 +95,7 @@ restarts each service whose marker is behind HEAD *and* whose paths changed
 since that marker — so a backlog accumulated by service-scoped deploys fires
 all at once, and one failing health gate aborts the run with every later
 service left pending. Name the service unless a drain is what you want
-(`./scripts/deploy.sh dankserver --service frank-primary`).
+(`./scripts/deploy.sh dankserver --service frank-archon`).
 
 ### Deployment completeness (MANDATORY)
 
@@ -159,12 +174,17 @@ Tests are mandatory before commit (`bats` required on the dev machine):
 ./tests/run.sh
 ```
 
-Seams: compose validity, env consistency (no leaked secrets), Caddyfile
+Seams: env consistency (no leaked secrets), Caddyfile
 validity, quadlet units, docs completeness **including vault link integrity**,
 script syntax (shell + python), LLM unit integrity, LLM secret hygiene,
-deployment flow, service-scoped planning, homepage config/pages/deploy/checker,
-and `e2e_scaffold` — which fails if a Playwright spec file's number prefix is in
-no project, because such a spec silently never runs.
+LLM artifact gates (`llm_gates`/`llm_deploy_gates` — the shared
+`scripts/lib/llm-gates.sh` every endpoint's serve and deploy gates run on),
+deployment flow, service-scoped planning, the **service inventory**
+(`service_inventory.bats`: inventory soundness, the pinned path->service
+plan fixture, render drift for the Pi-hole hosts file), homepage
+config/pages/deploy/checker, and `e2e_scaffold` — which fails if a
+Playwright spec file's number prefix is in no project, because such a spec
+silently never runs.
 See `serverAppConfigs-docs/Architecture/Testing Policy.md`.
 
 ## Secret Rules
@@ -224,14 +244,17 @@ archive.
 **STOP the production service BEFORE benchmarking** — these servers serve
 real users, and a bench beside a live service starves the GPU and corrupts
 results. Use the runtime's own harness: `llama-bench` for the llama.cpp
-endpoints; a live llama.cpp server also reports honest per-request numbers in the `/completion` `timings` object (prefill/decode rates, `draft_n`, `draft_n_accepted`), which is how frank-large and frank-small were measured. Rolling your own bench
+endpoints; a live llama.cpp server also reports honest per-request numbers in the `/completion` `timings` object (prefill/decode rates, `draft_n`, `draft_n_accepted`), which is how frank-dragoon and frank-zealot were measured. Rolling your own bench
 requires asking first.
 Scratch ports are not used on LLM hosts — a
 test process cannot share the single GPU anyway; validate against the service
 itself.
 
-(A gufo-era law; frank-large ran ROCmFPX llama.cpp 2026-10-02 → 10-05 and is the halogen container since, but the rollback tags keep it live.) **`gufo bench` cannot rank speculative-decode settings, and will invert the ranking.**
-Measured 2026-09-28 on frank-large at depth 32768: its corpus
+(A gufo-era law; frank-dragoon ran ROCmFPX llama.cpp 2026-10-02 → 10-05, the
+halogen 27B container 2026-10-05 → 10-06, and is flash-server since, but the
+rollback tags keep it live.) **`gufo bench` cannot rank speculative-decode
+settings, and will invert the ranking.**
+Measured 2026-09-28 on frank-dragoon at depth 32768: its corpus
 reports `acceptance=0.933 ± 0.000` with an **identical trace sha256** across
 draft widths, i.e. the same highly-predictable text every run, and 93 % of
 every proposal accepted. It reported 29–37 t/s decode where real traffic
@@ -256,12 +279,12 @@ one: `ip neigh show <ip>` from a peer — FAILED means off/NIC dead, while a
 merely wedged kernel usually still answers ARP.
 
 1. Stop and mask (self-healing would restart it):
-   - Dankclaw `frank-large` (root unit, halogen podman on the iGPU):
-     `sudo systemctl stop frank-large && sudo systemctl mask frank-large`
-   - Dankclaw `frank-small` (root unit, llama.cpp on the 3090):
-     `sudo systemctl stop frank-small && sudo systemctl mask frank-small`
-   - Dankserver `frank-primary` (root unit, tcclaviger vLLM on the 2x R9700):
-     `sudo systemctl stop frank-primary && sudo systemctl mask frank-primary`
+   - Dankclaw `frank-dragoon` (root unit, halogen podman on the iGPU):
+     `sudo systemctl stop frank-dragoon && sudo systemctl mask frank-dragoon`
+   - Dankclaw `frank-zealot` (root unit, llama.cpp on the 3090):
+     `sudo systemctl stop frank-zealot && sudo systemctl mask frank-zealot`
+  - Dankserver `frank-archon` (root unit, radiance on both R9700s, TP=2):
+     `sudo systemctl stop frank-archon && sudo systemctl mask frank-archon`
 2. Bench.
    NOTE: `systemctl mask` FAILS on a relinked unit (the unit file in
    `/etc/systemd/system/` is itself a symlink into the checkout — mask
@@ -278,9 +301,18 @@ deletes the unit file from `/etc/systemd/system/`, not just the symlink.
 The harness reaches the fleet through `.omp/agent/models.yml` in the
 operator's home — `/home/blank/.omp/agent/models.yml` on the dev box, which is
 where the harness runs; there is no copy on the servers. Each provider is one
-HOST:PORT; each model `id` is the served alias: `frank-primary` →
-`192.168.0.235:7770`, `frank-large` → `192.168.0.143:7770`, `frank-small` →
-`modelRoles`.
+HOST:PORT; each model `id` is the served alias. **Official model ids are
+the StarCraft unit names (2026-10-08), on the wire since 2026-10-09, and
+since 2026-10-10 they are also the SERVICE names:** `frank-archon` →
+`192.168.0.235:7770` (`FRANK_ARCHON_SERVED_NAME`), `frank-dragoon` →
+`192.168.0.143:7770` (`HALOGEN_MODEL_ID`), `frank-zealot` →
+`192.168.0.143:7771` (`ALIAS`). The 2026-10-10 cutover renamed the units,
+scripts, env files, containers, deploy services and runbooks to match —
+the three former service names are fully retired and exist nowhere in
+the repo; historical text in runbooks uses the current names. Verify a
+rename on `/v1/models`, never
+on a chat response: radiance echoes the **requested** model name, so a 200
+proves nothing about the served id (llama.cpp and halogen ignore it).
 
 Resolution rules: the default model resolves as a `defaultProvider` +
 `defaultModel` pair (the provider must serve the model); a subagent override
@@ -292,16 +324,21 @@ When renaming a service, retiring an endpoint, or moving a model: update the
 provider block, model `id`, `contextWindow`, `maxTokens`, `input` in
 `models.yml`, then fix every `modelRoles` entry that named the old endpoint —
 a role pointing at a provider the file does not define fails at call time. As
-of 2026-10-05 **two of the three endpoints accept images** (`input: [text,
-image]`) — `frank-large` went TEXT-ONLY with the halogen swap (the engine
-ignores the vision encoder; the BF16-mmproj era ended 2026-10-05) — while
-`frank-primary` takes them through a BF16 mmproj loaded explicitly (this build never
-autoloads projectors), and `frank-small` through
-`mmproj-MiMo-V2.6-Distill-Qwen-9B-f16.gguf` passed as `--mmproj` — the MiMo
-GGUF itself carries no vision tensors. `frank-small`'s `contextWindow` is
-**200704** (resliced from 180224 on 2026-10-03), the per-slot window, not the
-model's native 262144: the harness must compact before llama.cpp answers a
-longer prompt with a 400. Note also
+of 2026-10-06 **all three endpoints accept images** (`input: [text,
+image]`) — `frank-dragoon` returned to vision with the flash-server v2 swap
+(the v2 vision tower loads beside the checkpoint; the text-only halogen
+27B window closed 2026-10-06) — while
+`frank-archon` takes them natively (radiance runs the checkpoint's
+27-layer Qwen-VL tower — patching, pad-token expansion and 3-part rotary
+are the engine core; `--mm-max-patches` available),
+and `frank-zealot` through
+the publisher's own BF16 mmproj passed as `--mmproj` — the model is natively
+multimodal but the Q6_K GGUF carries no vision tensors (same arrangement the
+Gemma4 era used). `frank-zealot`'s `contextWindow` is
+**200704** — the PER-SLOT window (`--ctx-size 401408 --parallel 2` since the
+2026-10-07 Qwen3.5-9B swap), not the pool and not the model's native 262144:
+the harness must compact before llama.cpp answers a longer prompt with a 400.
+Note also
 that
 the reasoning channel differs by runtime: llama.cpp AND SGLang (qwen3
 parser, live-verified) emit `reasoning_content`, vLLM emits `reasoning` —
@@ -310,256 +347,270 @@ There is **no audio**
 input anywhere in the fleet: that capability left with the FLM NPU
 endpoint on 2026-09-11, returned 2026-09-17 with the Gemma4 projector's
 audio encoder, and left again with the Gemma4 retirement on 2026-10-01
-(the MiMo tower is vision-only).
+(neither the MiMo nor the Qwen3.5 tower carries audio).
 
-### frank-large — halogen container, Qwen3.8-27B + DFlash2 (Dankclaw, ACTIVE)
+### frank-dragoon — halogen-flash-server 0.16.2, Qwen3.8-Flash-Next v2 Swift1.5 ABLITERATED (Dankclaw, ACTIVE)
 
-The **halogen engine** (`ghcr.io/peonist-ai/halogen@sha256:dc0a39a0…`,
-digest-pinned, published tag 0.1.4) as a podman container driven by
-`scripts/serve-frank-large.sh` under a **root systemd unit**
-(`scripts/frank-large.service`, `User=dank`, `Restart=always`, `ExecStop=podman
-stop -t 120 frank-large-halogen`, the script `exec podman wait` so the restart
-policy is real) on port 7770 from the Strix Halo iGPU. Engine stdout goes to
-`/home/dank/logs/frank_large.log` — **the boot ledger (KV pool, drafter state,
-any clamp) lives there, not in the journal**. Serving
-`peonist-ai/halogen-qwen3.8-27b`: `qwen3.8-27b-p1w4d-d2.hgn` (35,865,565,184 B
-≈ 33.4 GiB, sha256 `274c3fc7…`, 1352 tensors; p1 weights / w4 activations /
-d2 KV) + the flat `tokenizer/` directory (5 files). Cutover 2026-10-05 from the ROCmFPX llama.cpp fork
-([[frank-large-rocmfpx-q6agent-uncensored-mtp]], measured 27.6–28.1 t/s prose),
-chosen for the publisher's 31.7 t/s DFlash2 mean.
+The **flash-server engine** (`ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84…`,
+digest-pinned, published tag 0.16.2, 3.6 GB image) as a podman container
+driven by `scripts/serve-frank-dragoon.sh` under a **root systemd unit**
+(`scripts/frank-dragoon.service`, `User=dank`, `Restart=always`,
+`ExecStop=podman stop -t 60 frank-dragoon-halogen`, the script runs `podman
+run` FOREGROUND — the container's exit code is the service's exit so
+`Restart=always` stays real, and the engine ledger lands on disk) on port
+7770 from the Strix Halo iGPU. Engine stdout goes to
+`/home/dank/logs/frank_dragoon.log` — **the boot ledger (weights resident, KV
+pool, MTP head, prompt cache, any clamp) lives there, not in the journal**.
+Cutover 2026-10-06 from the halogen 27B-dense era
+([[frank-dragoon-halogen27b-dflash2]], retired the same window).
 
-**The format is the lock.** `.hgn` loads in nothing else — the runtime is
-chosen by the FILE, as ROCmFPX's tensor types were before it. This is NOT the
-2026-09 `halogen-flash-server` image (different repo, Flash-Next w4b era); the
-halogen-server repo restarted versioning at 0.1.x.
+Serving `Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated`:
+`qwen38-flash-next-v2-swift15-abliterated.hgn` (66,687,678,464 B ≈ 62.1
+GiB, sha256 `9c880b8b…` — a compacted r2 of the card's 89,775,868,032 B
+append-only original; the abliteration workflow appends and the repo's
+tooling drops dead padding, live tensors byte-identical) + the **REQUIRED**
+n-gram lookup table `qwen38-flash-next-ngram.hgn` (51,200,246,144 B,
+peonist @5cc17cea) + the vision tower `qwen38-flash-next-vision.hgn`
+(897,916,416 B, @e053f488) + the flat `tokenizer/` directory (6 files,
+fetched fresh from peonist). Cutover 2026-10-06 from the halogen
+27B-dense shape, chosen by Frank for the ABLITERATED base.
 
-**Two product regressions, both accepted by Frank before deploy:** the
-endpoint is **text-only** (README honest limits: the vision encoder is
-ignored — frank-small owns images now) and the checkpoint is a finetune of the
-**censored** `Qwen/Qwen3.8-27B` base (refusals can return; the rollback is one
-commit-revert away with the AGENT payload still on disk).
+**The format is the lock.** The v2 `.hgn` loads ONLY in the
+flash-server line — the 27B-era halogen 0.1.4 container refuses it, so the
+engine moved with the model. The MTP head is INSIDE the checkpoint
+(`HALOGEN_MTP_HEAD` stays unset; the separate `qwen38-flash-next-mtp.hgn`
+sidecar is deliberately not fetched).
 
-**Engine laws that shape the config** (all in `scripts/frank-large.env` with
-evidence): `HALOGEN_KV_SLOTS=1` — batch XOR speculation, slots>1 turns the
-drafter off silently. `HALOGEN_SLOT_CTX=200700` — the per-conversation HARD
-ceiling (400 naming the limit, never truncation); `models.yml`
-`contextWindow: 200700` must match or the harness discovers the wall as a 400.
-`HALOGEN_MAX_TOKENS_CAP=65536` + `HALOGEN_QUEUE_TIMEOUT=7200` are a coupled
-pair; the harness `maxTokens: 57344` stays under the cap (over-cap is a 400
-naming the limit — README, never a 413). Thinking tokens COUNT against the
-budget: exhausted mid-thought is `finish_reason: "length"` with empty
-`content` and the reasoning in `reasoning_content`.
-`HALOGEN_DRAFTER=2` = DFlash2. **No server-side sampler**: an absent
-temperature is greedy, so the thinking recipe exists only in `models.yml`
-`extraBody`. `response_format` is unsupported (no constrained decoding).
-Thinking lands in **`reasoning_content`** (harness field unchanged); the same
-Qwen3.8 template rejects `reasoning_effort` outside `xhigh|medium|low`, so the
-`models.yml` fold stays mandatory.
+**Product facts vs the 27B era, both regressions FIXED:** the base is
+**abliterated** (the 27B was a censored-base finetune; refusals were an
+accepted trade there) and **vision is ON** (the 27B engine silently
+ignored its encoder — frank-zealot owned images for exactly one day at this
+endpoint).
 
-Fetch: `scripts/download-frank-large-halogen.sh` into
-`/home/dank/models/halogen-qwen3.8-27b/` (`-f` + byte count + LFS sha256 +
-`--verify-only`, no token on the command line; resume goes against the
-RESOLVED CDN URL because curl drops `Range` across HF's 302). The deployer
-and serve script both refuse a missing tokenizer file or **any symlink** —
-an HF cache snapshot symlinks each entry into `blobs/` and those links
-dangle inside the container mount.
+**Engine laws that shape the config** (all in `scripts/frank-dragoon.env`
+with evidence): `HALOGEN_SPEC_ADAPT=0` is MANDATORY — the default adaptive
+policy disables the MTP head for whole requests after low acceptance and
+HALVES decode; the head stays on and temp-1.0 traffic pays some acceptance
+for it (accepted). `HALOGEN_CTX=262144` is the PER-SLOT hard ceiling (400
+naming the limit, never truncation) — RAISED from 200192 on 2026-10-07
+under the 400-zone law: the harness clamps max_tokens to
+`min(45056, contextWindow − est − 4096)`, its chars/4 est UNDER-counts
+the rendered prompt by ~3 % (measured: est 152,938 → server 157,388,
+request 43,158 vs room 42,804), so a harness window == engine ceiling
+made every request over ~146k est a guaranteed 400. `models.yml`
+`contextWindow: 217088` leaves the 45k gap that absorbs the estimate
+error (worst-case request ≈ 219k ≤ 262144); compaction fires at 85 % of
+the harness window = 184,524 est ≈ 190k measured (Frank's 180k target).
+`HALOGEN_KV_SLOTS=2` is LEGAL here — the 27B "slots>1 disables the drafter"
+law does NOT carry over; batching and speculation coexist (the card's
+quickstart ships 2 slots with the head), so 2 is concurrent capacity.
+`HALOGEN_KV_POOL_POSITIONS=524288` (explicit 2 × ctx; ~28 KiB/position ⇒
+14.0 GiB). `HALOGEN_MAX_TOK=8192` is only the per-request DEFAULT (the
+harness sends at most its `maxTokens` 45056); `HALOGEN_MAX_TOKENS_CAP=65536` +
+`HALOGEN_QUEUE_TIMEOUT=7200` are a coupled pair (FLAGS.md table).
+**A server-side sampler EXISTS** (`HALOGEN_TEMPERATURE/TOP_P/TOP_K` =
+1.0/0.95/20, the card's thinking recipe) — an absent temperature is no
+longer greedy; `models.yml` extraBody carries the same values, consistent
+not load-bearing. Prompt cache is ON by default (`PROMPT_CACHE=2`): a warm
+100k follow-up costs ~2 s vs ~88 s cold — the 27B engine's manual
+`HALOGEN_CACHE_MB` pin era is over. `response_format` is unsupported.
+Thinking lands in **`reasoning_content`**; the v2 chat template rejects
+`reasoning_effort` outside `xhigh|medium|low`, so the `models.yml` fold
+stays mandatory. Thinking tokens COUNT against the budget (empty content +
+`finish_reason: "length"` when exhausted mid-thought). Vision: OpenAI
+`image_url` content parts only; ≥256 px probe images or the model answers
+"video".
 
-Runbook: `serverAppConfigs-docs/LLM/frank-large-halogen27b-dflash2.md`.
-Rollback: revert the swap commit and redeploy — the ROCmFPX payload
-(`/home/dank/models/kingjones-Qwen3.8-27B-ROCmFP4-STRIX-MTP/`), the fork build
-and `scripts/build-rocmfpx.sh` (pin `36e9acd`) all remain on disk, seam-tested.
-The older gufo tag `frank-large-gufo-q4kxl-20261001` stays a **re-download**
-rollback (payloads removed 2026-10-03; `scripts/build-gufo.sh` stays).
+**Memory ledger** (121.2 GiB unified; the referee is the boot ledger):
+weights ~62 + KV 14.0 + arena ~8 (`3.8 + 8.4 × MAX_TOK/16384`) + vision
+~2 ≈ 86 GiB engine-side + `HALOGEN_HOST_RESERVE_GIB=20` → ~15 GiB
+margin over baseline co-tenancy. The 51.2 GB n-gram table rides as mmap'd
+page cache beside the checkpoint — the card's quickstart arithmetic does
+not bill it as resident, but READ the boot ledger and re-size if the
+engine prints a clamp.
 
-### frank-small — llama.cpp on the RTX 3090 (Dankclaw, ACTIVE)
+Fetch: `scripts/download-frank-dragoon-flashnext.sh` into
+`/home/dank/models/halogen-flashnext-v2/` (`-f` + exact byte counts + LFS
+sha256 + `--verify-only`, no token on the command line; resume goes
+against the RESOLVED CDN URL because curl drops `Range` across HF's 302).
+The serve gates mirror the deployer EXACTLY (byte-exact checkpoint +
+n-gram + vision tower, flat tokenizer with all six files as regular
+files) — the 2026-10-01 crash-loop lesson.
 
-**llama.cpp master** (CUDA sm_86 build
-`/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server`) as a
-**root systemd unit** (`scripts/frank-small.service`, `relink_unit`ed into
+Runbook:
+`serverAppConfigs-docs/LLM/frank-dragoon-flash-server-v2-swift15.md`.
+Rollback: revert the swap commit and redeploy — the 27B payload
+(`/home/dank/models/halogen-qwen3.8-27b/`), its fetch script and the
+halogen 0.1.4 image digest all remain on disk; the ROCmFPX door behind
+that (`scripts/build-rocmfpx.sh`, pin `36e9acd`) is untouched.
+
+### frank-zealot — llama.cpp on the RTX 3090 (Dankclaw, ACTIVE)
+
+**llama.cpp master** (0.5.0-dev, commit `5fc4f3c`; CUDA sm_86 build
+`/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server`,
+`GGML_CUDA_FA_ALL_QUANTS=ON`) as a **root systemd unit**
+(`scripts/frank-zealot.service`, `relink_unit`ed into
 `/etc/systemd/system/`), serving
-`bartowski/MiMo-V2.6-Distill-Qwen-9B-GGUF` at **Q6_K** (7,793,710,624 B,
-sha256 `ef96d05a…`) **plus `mmproj-MiMo-V2.6-Distill-Qwen-9B-f16.gguf`**
-(918,166,048 B, sha256 `ff348f…`), both `/home/dank/models/MiMo-Q6K/` (the
-projector is a hardlink of the Q5KM copy — the dir is self-contained), on
-port 7771. The rung went Q5_K_M → Q6_K on 2026-10-03 the same morning as the
-reslice, funded by the freed slots. The runtime arrived 2026-10-01 night for
-one reason:
-**asymmetric KV** — `--cache-type-k f16` + `--cache-type-v q8_0` is the fleet's
-only per-tensor KV lever, and SGLang's `--kv-cache-dtype` moves K and V
-together. On 2026-10-03 Frank spent the headroom that lever bought: the reslice
-from three slots to two made room for **fully unquantized V**
-(`CACHE_TYPE_V=f16`); both flags stay explicit in the serve script. Vision came
-2026-10-02 via `--mmproj`: the GGUF carries no `v.*` tensors, so the projector
-file is the entire vision path (and ~1.4 GiB of the card).
+`HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive` at **Q6_K**
+(7,359,259,008 B, sha256 `c0ba7beb…` computed locally — the Hub carries no
+LFS oid) **plus the publisher's own BF16 mmproj** (921,704,448 B), both
+`/home/dank/models/Qwen35-9B-HauhauCS-Q6K/`, on port 7771. Cutover
+2026-10-07 (late) from the Gemma4-26B-A4B Q4_K_M 1×200,704 shape (same day).
 
-**Architecture: qwen3_5 hybrid** — 32 layers, 8 full-attention + 24 Gated
-DeltaNet, native 262,144 window. KV exists only in the 8 attention layers
-(4 KV heads × 256 dim × 2 B ≈ 2 KiB/token/layer, ~16 KiB/token for f16 K+V);
-the DeltaNet state is a fixed per-slot buffer, so slot count — not context —
-drives that term.
+**Architecture: qwen35 dense hybrid** — read from the GGUF's own header, not
+the model card: 32 layers, `full_attention_interval = 4` ⇒ **8 full-attention
+layers (3, 7, 11, …, 31) + 24 Gated DeltaNet linear layers**, 16 attention
+heads / **4 KV heads** × 256 dim, `ssm` conv_kernel 4 / state_size 128 /
+group_count 16 / time_step_rank 32 / inner_size 4096, native 262,144, vocab
+248,320. Tensor types are Q6_K × 250 + F32 × 177 — standard quants only, so
+the stock master build loads it (arch `qwen35` is registered in this build's
+`src/llama-arch.cpp`). **KV accounting:** the pool scales with the 8 full
+layers only — 8 × 4 × 256 = 8,192 elements/token per cache, so f16 K + f16 V
+bills **32 KiB/token** = 12.25 GiB at the 401,408 pool; the 24 DeltaNet
+layers bill a fixed recurrent state per SLOT, not per token, which is exactly
+why two 200k slots fit where the 26B MoE fit one.
 
-**The shape (2026-10-03):** `--ctx-size 401408 --parallel 2` = **TWO
-conversations of 200,704 tokens each** (llama.cpp divides the pool:
-`n_ctx_slot = CTX_SIZE / PARALLEL`), `--flash-attn on` (the seam pins it),
-**f16 K + f16 V**, all layers on the GPU, `--mmproj` for vision, and since
-2026-10-05 **batch 4096 / ubatch 2048** (doubled; the boot-pair A/B is in the
-runbook). Measured trade at 8,928 prompt tokens: prefill 4,024 → **4,209 t/s,
-+4.6 %**, decode flat (91.9–93.0 vs 93.8–94.3 — noise), and a 279-token prompt,
-which sits below either ubatch, did not move at all. The old "ubatch 2048
-failed the scratch boot" note belongs to the Q5_K_M predecessor and does NOT
-generalize: this shape boots 2048 clean. Measured VRAM **21,846 used / 2,279
-free** of 24,576 MiB against **21,276 / 2,849** for the 1024 arm, reproduced
-byte-identically the same hour — the doubling costs **616 MiB** and lands at
-the BOTTOM of the 2–3 GiB floor Frank asked for (`4096/1536` is the middle rung
-if that margin is ever wanted; non-KV 9,302 MiB, up from 8,732 by exactly the
-compute buffers; f16 K+V is 32 KiB/token across the 8 attention layers;
-quote `nvidia-smi`'s `free` field, never `total − used` — the driver holds
-~450 MiB of reserve the subtraction hides). The 2026-10-02 3 × 180,224 +
-q8_0-V shape stays one env edit away (`CTX_SIZE=540672 PARALLEL=3
-CACHE_TYPE_V=q8_0`, and it must pair with Q5_K_M — Q6_K breaks the floor
-there). Three native windows need 18.4 GiB of KV alone and were never on the
-table.
+**The shape (2026-10-07):** `--ctx-size 401408 --parallel 2` = TWO
+conversations of 200,704 (Frank's cap; the harness `contextWindow` quotes
+the per-slot number), `--flash-attn on`, **f16 K + f16 V** (exact KV),
+batch 4096 / **ubatch 2048** (the measured CUDA optimum: +4.6 % prefill,
+decode flat, 616 MiB — MiMo-era A/B on this card), `--log-verbosity 4`,
+`--mmproj` for vision, **speculative decoding OFF** (`SPEC_TYPE=none`).
 
-Verified at deploy (2026-10-03): boot logs `n_slots = 2, n_ctx_slot = 200704`
-and `loaded multimodal model`; decode **94.44 tok/s** at temp 0 on the probe
-that measured 104.84 on Q5_K_M — **the Q6_K rung costs a measured −10 %**:
-decode on this card is weight-bandwidth-bound and Q6_K streams ~10 % more
-bytes/token; health 200, e2e 33/33; native `tool_calls`; thinking in
-`reasoning_content`; a **512×512** solid-red PNG answers `Red` through an
-`image_url` content part (two traps: the legacy top-level `images` field is
-ignored, and a TINY probe image undersupplies image tokens — a 10×10 PNG made
-the model claim "it's a video"; probe with ≥256 px). A prompt over the slot
-is a **400 `exceed_context_size_error`**, which is why `models.yml` sets
-`contextWindow: 200704`.
+**Why MTP is off**: it is not a choice — **this Q6_K file carries no
+`nextn`/`mtp` tensors** (verified from the tensor-name list), and MTP is a
+property of the file, not of the flags. The publisher card advertises "MTP
+support" for the base architecture; the quantized export dropped the head.
 
-Runbook: `serverAppConfigs-docs/LLM/frank-small-llama-mimo-q6k-2x200704.md`
-(the boot-pair table that prices pool changes lives in the retired
-[[frank-small-llama-mimo-q5km]]).
-Rollback: `MODEL_FILE=/home/dank/models/MiMo-Q5KM/MiMo-V2.6-Distill-Qwen-9B-Q5_K_M.gguf`
-buys back 875 MiB and the −10 % decode rate (3,571 free, 104.84 tok/s, both
-measured); the older shape `CTX_SIZE=540672 PARALLEL=3 CACHE_TYPE_V=q8_0`
-pairs with Q5 only; SGLang rollback in
-[[frank-small-sglang-mimo-v26]] (venv on disk at
-`/home/dank/GitPackages/sglang-cu128/`, INT8 payload staged to
-`~dank/.AGENTTRASH/20261002-retired-llm-payloads/`).
+**Measured boots** (nvidia-smi, the referee): the deployed boot is
+**21,436 used / 2,689 free** (ubatch 2048) — the pricing boots were the
+MiMo-V2.6-Distill-Qwen-9B pair at this exact geometry (**21,276 / 2,849** at
+ubatch 1024, **21,846 / 2,279** at 2048), so the 415 MiB lighter weights
+bought back what the projection predicted. The engine ledger confirms the KV
+law to the MiB: `CUDA0 KV buffer size = 12544.00 MiB` (`K (f16): 6272.00`,
+`V (f16): 6272.00`), compute buffers 1,136 MiB on CUDA0 + 848 MiB host, the
+mmproj 879 MiB + 248 MiB. Decode is ubatch-invariant (Swift-era 3090 law). The
+Q6_K rung costs ~10 % decode vs Q5_K_M (weight bandwidth; MiMo-measured 94.4
+vs 104.8 t/s).
 
-### frank-primary — tcclaviger vLLM, Qwen3.8-Flash-Next FP8 (Dankserver, ACTIVE)
+**Vision**: the publisher's own BF16 mmproj via `--mmproj` (the model is
+natively multimodal; the Q6_K file carries no vision tensors). Probe traps
+carry over: ≥256 px probe images or the model answers "video", and only the
+OpenAI `image_url` content part reaches the model.
 
-The **tcclaviger RDNA4 vLLM fork** (`docker.io/tcclaviger/vllm@sha256:da4029666…`,
-digest-pinned) serving **`orcarouter/Qwen3.8-Flash-Next-Uncensored-FP8`**
-(~172.8 GiB, 131 shards) on **both** Radeon AI PRO R9700s (gfx1201), **TP=2**,
-**fp8 KV**, **no speculative decode**, **expert prefetch OFF**, and since
-2026-10-03 the **shape-G** geometry (shape E + MNBT 2048 + the CUDA-graph plan
-term at the measured floor): `--max-model-len 200704` × 3 slots with
-`--kv-cache-memory-bytes 3,166,500,000`/rank (~400,700 KV tokens — the engine
-prices this pool at 7,891.8 B/token here), util **0.982** (the law — see the
-unbootable-1.0 lesson below), `--expert-precise-memory`,
-`VLLM_CUDAGRAPH_MEM_BASE_MB=0` / `_PER_GRAPH_MB=12`,
-`GPU_MAX_HW_QUEUES=2` and a mounted `/root/.cache`. `models.yml` carries
-`contextWindow: 200704` for this endpoint — the served window, not the model's
-native 262144, so the harness compacts before vLLM answers a longer prompt
-with a 400.
+**Compaction hub**: `models.yml` routes `compactionModel` for
+`frank-archon`, `frank-dragoon` and `frank-zealot` (the 3090 endpoint) here — 200,704 is the
+only window in the fleet that fits a worst-case compaction input (~170k
+tokens). With `--parallel 2` a compaction request no longer serializes behind
+a live generation (the Gemma4 era's `--parallel 1` law).
 
-**`--max-num-seqs 2` is impossible on this model.** Measured 2026-10-02 by
-single-variable boot probe against the then-deployed shape: SEQS 2 fails at
-BOTH MNBT 1024 and 2048 with `torch.fx.experimental.symbolic_shapes.Constraint
-ViolationError: Constraints violated (L['query_start_loc'].size()[0]) …
-specialized it to be a constant (3)`; SEQS 3 passes at both. `model_runner.py`
-sizes that input buffer `max_num_reqs + 1` and `_dummy_run` sets
-`num_reqs = min(max_num_batched_tokens, max_num_reqs)`, so the width is
-`SEQS + 1` for any `MNBT ≥ SEQS` — MNBT only moves the compile RANGE
-((1,1024) vs (1,2048)). `--enforce-eager` bypasses the path but drops CUDA
-graphs. The same failure class killed the 2026-10-01 bf16 2×262144 shape.
+Runbook:
+`serverAppConfigs-docs/LLM/frank-zealot-llama-qwen35-9b-q6k-2x200704.md`.
+Rollback: revert the swap commit — the Gemma4 payload
+(`/home/dank/models/Gemma4-26B-A4B/`), the MiMo Q6_K payload
+(`/home/dank/models/MiMo-Q6K/`), the Swift payload
+(`/home/dank/models/Swift15-UncIQ3XXS/`) and the Ornith Q8_0 payload
+(`/home/dank/models/Ornith-Q8/`) all remain on disk.
 
-**The expert arena has THREE reachable levers: `max_model_len`, the overhead
-term, and the CUDA-graph estimate.**
-The fork's planner sizes expert cache as `budget − non-expert − KV reserve −
-graphs − overhead`, and the KV reserve is registry-priced at 9190 B/token ×
-`max_model_len`: 262144 → 2.48 GiB reserve → arena 14.30 GiB / **6,248 slots**;
-200704 → 1.91 GiB → 14.87 GiB / **6,496 slots**. Δreserve 0.57 GiB = Δarena
-0.57 GiB. The 6.1e9 → 3.15e9 pool cut bought **zero** arena; it buys runtime
-headroom (the shape it replaced died with `0 bytes free` on a real 995-token
-request). The second lever is `--expert-precise-memory`, **ON since
-2026-10-02**: it swaps the registry's default overhead (7.60 GiB = fitted +
-compile/graph-capture headroom) for the fitted figure, and the 2.35 GiB
-difference lands in the arena — measured plan lines at 200704 × 3: overhead
-5.25 GiB, expert cache **17.22 GiB / 7,522 slots** (+1,026 / +16 %), swap region
-13.7 GiB / 5,986 slots, boot healthy in 420 s. The pool stayed at 3.15e9
-deliberately: because the pool is not an arena lever, cutting it would cost
-concurrency (a 2.2e9 probe reports 277,686 tokens / **1.38×**) and buy no slots.
-The arena (2.344 MiB per slot) is the decode-critical region — cutting it for KV
-headroom collapses the offload hit rate.
 
-**Free VRAM on this endpoint is NOT arena headroom (2026-10-03 audit).**
-`rocm-smi` reads ~3.5 GiB free per card after hours of real traffic, but the
-planner charges `budget = total × util` against terms that overstate reality:
-the KV reserve is registry-priced at 9190 B/token (`1.91 GiB` at 200704) while
-the real pool bills 2.93 GiB at 7,892 B/token, and the precise overhead (5.25
-GiB) is far above the idle-measured figure. So the visible free space is the
-estimator gap, not allocatable arena. `gpu_memory_utilization` is a real arena
-lever (each +0.01 = +0.32 GiB) but **0.982 is the law, and 1.00 is UNBOOTABLE
-on this fork — measured 2026-10-03**: the worker init demands
-`free > budget`, and at `le=1` budget == device total, so both ranks raise
-`ValueError: Free memory on device cuda:N (31.29/31.86 GiB ...)` before a
-single weight loads, twice (2-restart crash loop, zero payload progress). The
-CLI field accepting `le=1` is the trap; Frank's 0.982 is where it always
-ships. What IS reachable from flags: `VLLM_CUDAGRAPH_MEM_BASE_MB` /
-`_PER_GRAPH_MB`, read at call time by `estimate_cudagraph_memory()` — the
-analytic default (256 MiB + 52 MiB/graph) charged 0.55 GiB where the engine's
-own post-capture line reported 0.31 GiB, and a second boot (with the plan
-already charging 0.32 GiB) reported **-0.06 GiB**, so the 256 MiB base pool is
-pure over-charge: shape G charges `0 base + 12 MiB/graph` = 0.07 GiB, which
-still prices per graph for a future 18-graph spec-decode shape (0.21 GiB).
-Verify every deploy by comparing the `Estimated CUDA graph memory`
-line with `Graph capturing finished … took X GiB`; if capture exceeds the
-estimate, raise `_PER_GRAPH_MB` back toward 52. MNBT 1024 → 2048 costs ZERO
-arena: the registry overhead is `base + 0.22 GiB × max(0,(nbt−4096)/1024)`
-anchored at nbt 4096, so every rung ≤4096 charges the same 5.25 GiB — and the
-fitted figure was fitted AT 4096.
+### frank-archon — Radiance (StillDeadcode), Swift1.5-Qwen3.8-Flash-Next GPTQ w4, TP=2 (Dankserver, ACTIVE)
 
-**A container's compile cache does NOT survive `podman rm -f`, and on this
-endpoint that is 181 s per boot.** Measured 2026-10-02: the image ships **no
-`/root/.cache` at all** (fresh container: `No such file or directory`); after a
-boot it holds `/root/.cache/vllm` at **1,154,714,333 B in 4,665 files** plus
-`/root/.cache/comgr` at 229 MB, all in the ephemeral layer, and the engine
-prints `torch.compile took 181.20 s in total` (173.19 s of it one graph,
-`Compiling a graph for compile range (1, 1024)`). Every deploy, restart and
-reboot re-pays it. The serve script now mounts
-`FRANK_PRIMARY_CACHE_DIR` at `/root/.cache` — the parent, so the vLLM AOT /
-torch_compile tree (`VLLM_CACHE_ROOT`, whose default is
-`/root/.cache/vllm`) and the comgr HIP-kernel JIT cache both persist, and
-nothing in the image is hidden because the image has no such directory. The
-compile RANGE is part of the cache key, so an MNBT change costs one
-recompilation, not a permanent tax. Same class of fix as the recipe's
-`/cache/{triton,vllm,inductor}` volumes. **Proven live 2026-10-02 on
-consecutive boots:** cold `Compiling a graph for compile range (1, 1024) takes
-179.24 s` / `torch.compile took 188.26 s`; warm `Directly load the compiled
-graph(s) for compile range (1, 1024) from the cache, took 2.143 s` /
-`torch.compile took 3.97 s in total` / `init engine (profile, create kv cache,
-warmup model) took 41.13 s (compilation: 3.98 s)`. Time to `/health` is
-dominated by the 172.8 GiB payload load, so the visible win is the ~184 s of
-inductor/AOT build, not a proportional boot cut.
+The **radiance engine** (StillDeadcode, Apache-2.0; image
+`stilldeadcode/radiance@sha256:4c3f484564…` digest-pinned, **pin 1.0.13**
+for serve/convert/KLD; `libr4d` gfx1201 kernels, plain `podman run`, root
+systemd unit, container name = unit name) serving
+**ukisai/Swift1.5-Qwen3.8-Flash-Next (BF16, 335.3 GiB, 131 shards,
+397/397 sha256-verified)** converted by `scripts/convert-swift15-w4dn8.sh`
+with recipe `scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe` to
+`qwen4exp-swift15-w4dn8-i8-hc8m.rad` (~114 GiB): **all 49,152 experts GPTQ
+w4** (act-order, damp 0.05, 10,000,000-token calibration captured on engine
+**1.2.0** via `RADIANCE_CALIB_DIR`/`RADIANCE_CALIB_TOKENS` — the only pin
+with the token knob; the RADGRAM2 grams are format-identical across pins and
+cross the boundary by design), **24 whole experts per layer cast bf16** (the
+PROTECTED set, derived from the calibration grams' energy share),
+**int8 trunk/lm_head**, **fp8 HC mixtures** (`--hc-mix-dtype`), PLE n-gram
+table at fp8 fixed scale (47.7 GiB in the container, from 95.4 GiB bf16).
+The plugin's **one-table-one-encoding law** (measured at rad-convert
+declare): one expert table takes ONE encoding; only whole bf16 experts are
+legal beside it — no w4/fp8 split of the down/gate_up pair (24-value
+`rad_arch_quant_desc` array, one per layer). KLD gate vs the BF16
+reference (recorded on the same 1.0.13 pin) is the precision referee;
+the throughput gate (decode ≥ 30.8 t/s) was passed at 4.5× the bar
+(122–173 t/s at 44.5k depth). Measured decode/prefill in the runbook.
+Rollback: revert the swap commit — the fp8-native `.rad`
+(`qwen4exp-fp8-native.rad`) and every prior payload remain on disk.
 
-Measured 2026-09-29 tuning campaign (fp8 + MTP4 era, since retired): decode
-**37.4-40.6 tok/s, acceptance ~54 %**; the 256k ctx arm measured 34.1-36.5;
-2-way concurrency sums BELOW parity (25.49 vs 26.8 single) — slots are a
-capacity feature, not a throughput one. V-only q8 KV is NOT possible via
-config: stock `--kv-cache-dtype` is K+V together; a V-only quant needs a fork
-patch.
+**Shape (both R9700s, TP=2)**: `--tp-wire wht6`, `--max-num-seqs 2`,
+`--max-model-len 200000` (the harness contextWindow must quote this),
+`--placement expert_tiered --host-pool-mib 44928` + **explicit VRAM
+partition `--vram-weights-mib 22208 --vram-kv-mib 6912`** (the vram-pair
+replaced `--expert-vs-cache-ratio`; the two are ONE budget —
+`weights + kv ≤ 29,120 MiB`, from the measured card 31,856 minus 1,710
+consumed outside both budgets minus 1,024 to keep free), `--kv-cache-dtype`
+**`bf16` — unquantized KV since 2026-10-11**, `--num-speculative-tokens 2`,
+`--max-num-batched-tokens 2048`, prefix cache 8 GiB pinned host + 64 GiB
+disk at `/home/dank/radiance-state`, **`--ngram-placement ram`**, Froggeric
+v22.5 chat template vendored (`scripts/qwen38-froggeric-v22.5.jinja`,
+`--override-chat-template`). Boot ledger: KV pool 6.75 GiB = **462,752 bf16
+tokens, "backs 2 sequences all at 200000 tokens at once"** (the fp8 pool's
+386,904 backed 1.93), weights slab filled to 147 KiB of slack, host pool
+10,375 slots, cards settled 1.85 GiB free.
 
-Unit and self-healing: root systemd unit (`scripts/frank-primary.service`,
-`User=dank`, `LimitMEMLOCK=infinity`), `ExecStop=podman stop -t 120
-frank-primary-qwen`. The serve script drives `podman run` directly, gates
-the digest-pinned image, the payload's `config.json` and its exact
-131-shard count and the GPU device nodes, clears stale container
-identities, then blocks on `podman wait`. `deploy_llm_primary` gates the
-same, waits out :7770, relinks/enables/restarts the unit and health-gates
-with the MainPID check. Boot cost ~7 min warm (the 172.8 GiB payload load; the
-~184 s inductor/AOT build inside it is what the mounted cache now skips — see
-the compile-cache lesson below); health returns 503 while loading.
+Shape notes carried from the fp8-native era and unchanged: wht6 gains,
+MNDT 2048 law (2560 collapses decode to 2.6–7.7 t/s), the 64 GiB disk
+prefix cache, and the rule that a prompt over `--max-model-len` is
+refused, never truncated. What changed: the fp8-native era's NVMe expert
+streaming (the 3.5 GB/s wall) is gone — the w4 resident set fits the
+host pool, so decode ran 122–173 t/s in the campaign arms and ~190 t/s
+on the fp8 shape (512-token streamed probe). The campaign also
+measured the int8-KV + spec-3 arm (136.0 t/s median at 44.5k depth,
+accept 0.7246).
 
-Runbook: `serverAppConfigs-docs/LLM/dankserver-qwen38-fp8-expert-offload-tuning.md`.
-Retired GLM experiment: `serverAppConfigs-docs/LLM/frank-primary-glm53-flash-w4a16.md`.
+**The bf16 KV law (2026-10-11)**: `--kv-cache-dtype` takes ONLY `bf16|fp8` —
+one dtype for the whole cache, so llama.cpp's exact-K/quantized-V pair (what
+frank-zealot runs) has NO radiance equivalent; the rung under bf16 is fp8 on
+both halves. Measured per rank from the two boot ledgers: `kv_attn` (13
+layers, 4-token blocks) pages 26.00 → 52.00 KiB, while `kv_qsa_bkey` (13
+layers) stays 3.25 KiB at BOTH dtypes (the QSA block key is an index, not
+attention state) — so a token costs 7.3125 KiB at fp8 and 13.8125 KiB at
+bf16: **1.89×, not 2×**. Pool sizing must also pay the dtype-independent terms
+that live in the same pool (~110 MiB a sequence of recurrent state + 448 MiB
+of prefix checkpoints): `(vram_kv − 110·seqs − 448) MiB / 13.8125 KiB` =
+462,946 where the engine reported 462,752 (0.04 % page rounding). The cost is
+paid twice on this engine, and half-refunded: idle KV VRAM is also the expert
+cache's spillover, and the bigger pool *lends* 6.08 GiB to the slab where the
+fp8 pool lent 2.69 GiB. `--max-num-seqs 3 → 2` came with the change (two slots
+× the window is the capacity contract; the "seqs 2 cannot boot" law belongs to
+the retired tcclaviger fork's torch.compile, not radiance) and it also drops
+the fused all-reduce to 2 × 3 = 6 rows, under the 25-row bound where wht6 is
+bit-exact. Disk-tier sizing law: the engine forces ~9.6 GiB of disk-tier weight
+buffers + arena onto the weights side, so `weights + kv` is capped near
+29.6 GiB/card; boot with the pair, never `--kv-cache-size-mib`.
+
+**The pinned-RAM ledger is why this is a root unit**: 2 × 44 GiB expert
+pools + the 47.7 GiB n-gram copy (`--ngram-placement ram` is pinned RAM
+the card reads) + 8 GiB prefix host ≈ **147 GiB** charged against
+`RLIMIT_MEMLOCK` — the TTM floor is set just above it.
+`ttm.pages_limit`/`pages_max` cap GPU-mappable pinned pages; the serve
+script's TTM preflight (`FRANK_ARCHON_TTM_MIN_MIB=150000`, cap on this host
+204,800) refuses to start until both knobs are raised in the stop window
+(sysfs write first, kernel cmdline + reboot only if read-only).
+
+**Contract facts** (source-verified): the HTTP listener binds AFTER the
+full load, so a bare `curl /health` gate is honest (`/health` == `/ping`,
+200 serving / 503 stopping); sampling params temperature…preserve_thinking
+accepted, **unknown params 400** (models.yml's extraBody set is fully
+inside it); `response_format` supported; `logprobs` REFUSED; reasoning in
+`reasoning_content` and tool calls in the qwen3.8 dialect via the auto
+chat format — no parser flags; vision native (the 27-layer Qwen-VL tower,
+`--mm-max-patches`); `/metrics` carries vLLM-compatible names +
+`radiance:*` families — the Dankclaw Prometheus scrape is re-added.
+
+Runbook: `serverAppConfigs-docs/LLM/frank-archon-radiance-swift15-w4dn8.md`.
+Retired fp8-native era: `serverAppConfigs-docs/LLM/frank-archon-radiance-qwen38-native-fp8.md`.
+Retired FreeToken era: `serverAppConfigs-docs/LLM/frank-archon-freetoken-pr587.md`.
+Retired vLLM era: `serverAppConfigs-docs/LLM/dankserver-qwen38-fp8-expert-offload-tuning.md`.
+Retired GLM experiment: `serverAppConfigs-docs/LLM/frank-archon-glm53-flash-w4a16.md`.
 
 ## Key Lessons Learned
 Durable operational lessons from the fleet's history. Full detail in the
@@ -721,11 +772,11 @@ linked runbooks.
 - Swap resize ordering: create and `swapon` the replacement BEFORE `swapoff`
   of the old one, or live pages must land in RAM that `MemAvailable`
   overstates. Dankclaw swap (64 GiB at `/swap.img`, fstab-driven) protects
-  the co-tenants, not frank-large — pinned weights don't swap, and paging
+  the co-tenants, not frank-dragoon — pinned weights don't swap, and paging
   the KV pool is worse than the OOM it prevents.
 - Host swap state is invisible to `deploy.sh` (no repo file) — check
   `swapon --show` before reasoning about headroom.
-- **Silent RAM corruption outranks every software theory.** frank-primary's
+- **Silent RAM corruption outranks every software theory.** frank-archon's
   ~40k-token output corruption (2026-10-04/05, repetition/garbage in long
   agent conversations) was marginal DDR5 at 4800 MT/s on four DIMMs, fixed
   by 4600. Consumer non-ECC memory raises **no MCE** for a silent flip, and
@@ -748,7 +799,7 @@ linked runbooks.
   `LimitMEMLOCK=infinity` (systemd is privileged; the value flows through
   podman to runc without any raise). Upstream halogen's own run lines pass
   NO `--ulimit` at all — copy vendor run lines before adding flags
-  (measured 2026-10-05 on the frank-large cutover).
+  (measured 2026-10-05 on the frank-dragoon cutover).
 - **Kairic Edge** (if ever re-deployed): the pinned CK commit needs
   `third_party/composable_kernel/include/ck/config.h` generated manually
   (untracked; `git clean` removes it), and its greedy-argmax fastpath rejects
@@ -774,7 +825,7 @@ linked runbooks.
   121 GiB box, pushed `available` to 3 GiB, and every later rate was suspect.
   Record the child pid and kill it in a `finally`, then prove `free` came back
   before believing a number. Kill by pid — never `pkill -f llama-server`,
-  which also hits frank-small.
+  which also hits frank-zealot.
 
 **llama.cpp serving**
 
@@ -798,7 +849,7 @@ linked runbooks.
   builds its context against whatever model the draft context holds. Two
   context-backed types cannot share one process, and MTP's head only loads
   when MTP **is** the draft model. **A LEGAL chain can still lose on a
-  recurrent model:** `draft-mtp,ngram-mod` on frank-large's qwen35 hybrid
+  recurrent model:** `draft-mtp,ngram-mod` on frank-dragoon's qwen35 hybrid
   measured −15 % prose / −7 % block-copy (2026-10-03) — adding the ngram layer
   logs `recurrent state rollback is not compatible with 'ngram-mod' -
   disabling rollback support`, and MTP verification depends on that rollback,
@@ -840,7 +891,7 @@ linked runbooks.
   free. That was a CONTIGUITY failure, not a total-bytes one, and no totals
   model — the sweep's or the seam's — can see it.)
 - **On the CUDA 3090 the same knob has NO interior optimum up to 2048, so
-  frank-small ships 4096/2048.** Measured 2026-10-05 by boot-pair A/B on the
+  frank-zealot ships 4096/2048.** Measured 2026-10-05 by boot-pair A/B on the
   live service: at 8,928 prompt tokens ubatch 1024 gives 3,972 / 4,077 t/s and
   ubatch 2048 gives 4,207 / 4,212 — **+4.6 %** — for **616 MiB** (free 2,849 →
   2,279). Decode did not move (91.9–93.0 vs 93.8–94.3, i.e. noise), and a
@@ -849,9 +900,9 @@ linked runbooks.
   than the ubatch cannot see it. The logical `--batch-size` was again free. And
   the predecessor's "ubatch 2048 failed the scratch boot" was a shape
   observation, not a law: the same file boots 2048 clean at 2 × 200,704. Bench
-  it by restarting the SERVICE through a transient `FRANK_SMALL_ENV_FILE`
+  it by restarting the SERVICE through a transient `FRANK_ZEALOT_ENV_FILE`
   drop-in, never a scratch port — one card holds one server. See
-  [[frank-small-llama-mimo-q6k-2x200704]].
+  [[frank-zealot-llama-mimo-q6k-2x200704]].
 - **One `-ts` step is one LAYER, and a hybrid stack's layers are not the same
   size.** qwen35 is 16 x (3 Gated DeltaNet + 1 Gated Attention), so a step is
   worth ~0.43 GiB on a DeltaNet boundary and ~1.43 GiB on a full-attention one
@@ -873,7 +924,7 @@ linked runbooks.
   CTX_SIZE / PARALLEL`, and llama.cpp refuses a prompt longer than the SLOT
   (`400 exceed_context_size_error: request (184001 tokens) exceeds the
   available context size (180224 tokens)`) even when the pool has room. So
-  frank-small's 2 → 3 reslice moved each conversation from the model's native
+  frank-zealot's 2 → 3 reslice moved each conversation from the model's native
   262,144 down to 180,224, and `models.yml` `contextWindow` had to follow or
   the harness would discover the ceiling as a 400 on a long conversation. Side
   effect worth knowing: the shorter slot made decode ~5 % FASTER (106.8 vs
@@ -884,9 +935,9 @@ linked runbooks.
   day the freed space also bought the Q6_K rung (now 94.4 tok/s — the rung
   itself is a further measured −10 %, weight-bandwidth, not slot geometry).
   All moves measured; both slot directions cost or buy window, never pool.
-  See [[frank-small-llama-mimo-q6k-2x200704]].
+  See [[frank-zealot-llama-mimo-q6k-2x200704]].
 - **Price a VRAM budget from two boots, never from a formula — and an mmproj
-  costs ~1.5x its file size.** The frank-small 3090 fit was solved from two
+  costs ~1.5x its file size.** The frank-zealot 3090 fit was solved from two
   measurements: 2 × 262,144 with no projector = 20,190 MiB used (KV 12,800 ⇒
   **non-KV 7,390**), 3 × 196,608 with the f16 projector = 22,972 used (KV
   14,113 ⇒ **non-KV 8,859**). The difference is the vision tower: a 918 MB file
@@ -894,24 +945,24 @@ linked runbooks.
   ride with it. Subtracting the two rows is exact; extrapolating weights+KV+
   "a bit for buffers" is what leaves 1.1 GiB free when you meant 2.7. Then
   solve `KV ≤ card − non-KV − headroom` and round to a multiple of
-  `PARALLEL × 4096`. Recorded in `scripts/frank-small.env` so the next resize
+  `PARALLEL × 4096`. Recorded in `scripts/frank-zealot.env` so the next resize
   starts from measurement.
 - **`images` and `image_url` are NOT interchangeable: only the content part
   reaches the model.** `--mmproj` loads, `usage.prompt_tokens` rises, and the
   model still invents an answer if the client used the legacy top-level
-  `images` field on `/v1/chat/completions` — frank-small answered "Brown." for
+  `images` field on `/v1/chat/completions` — frank-zealot answered "Brown." for
   a solid-red PNG that way and "Red." through the OpenAI `image_url` part. The
   failure is silent because a hallucinated color is a plausible answer. Probe
   vision with a solid color and expect an exact word.
 - **`--jinja` is what `tools` needs.** On 2026-09-16 a subagent died with
   `500 tools param requires --jinja flag`, from the ik_llama.cpp runtime that
-  then served frank-large: every tool-using agent on that endpoint was broken
+  then served frank-dragoon: every tool-using agent on that endpoint was broken
   and the failure read like a model fault. Mainline llama.cpp 0.4.1 defaults
   `--jinja` on and the serve script pins it; halogen also accepts `tools` and
   returns `tool_calls`. Check tool support before routing a role at an endpoint.
 - **Quantized KV on CUDA needs `GGML_CUDA_FA_ALL_QUANTS=ON`** — the same
   option and the same ~12x prefill collapse described in the ROCm note above.
-  f16 KV needs nothing; frank-small ran f16 for that reason until
+  f16 KV needs nothing; frank-zealot ran f16 for that reason until
   2026-09-17, when `build-cuda` was rebuilt with the option ON so the
   endpoint could take q8_0 KV.
 - **llama-bench separates a LIST with `/` and SWEEP values with `,`.** Both
@@ -929,7 +980,7 @@ linked runbooks.
   raises on anything else — HTTP 500, not a clamp — so the harness's levels
   must be folded onto that set in `models.yml` (`compat.reasoningEffortMap`).
   A role whose level is unmapped fails on its FIRST request, and the failure
-  names Jinja, not the model: every subagent on `frank-small` died with
+  names Jinja, not the model: every subagent on `frank-zealot` died with
   `Unexpected reasoning effort high` until `high: xhigh` was added on
   2026-09-16. Halogen accepts the wider set, so the two entries legitimately
   differ.
@@ -949,7 +1000,7 @@ linked runbooks.
   times (`RuntimeError: No HIP GPUs are available`).
 - SearXNG outbound traffic must stay on the Gluetun tunnel; do not move its
   ports off the gluetun service.
-- `amd_iommu=off` on Dankclaw (bought 13–16 % prefill for frank-large,
+- `amd_iommu=off` on Dankclaw (bought 13–16 % prefill for frank-dragoon,
   2026-09-11) permanently retired the XDNA2 NPU: the driver's SVA/PASID bind
   needs an enabled IOMMU (`/dev/accel/accel0` fails `err=-19`). Revert path
   in `serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md`.
@@ -1003,9 +1054,9 @@ Active:
 
 | Service | Runbook |
 |---------|---------|
-| frank-large (halogen container, Qwen3.8-27B .hgn + DFlash2, 1×200,700, text-only, Dankclaw) | `serverAppConfigs-docs/LLM/frank-large-halogen27b-dflash2.md` |
-| frank-small (llama.cpp CUDA, MiMo-V2.6-Distill-Qwen-9B Q6_K, 2×200,704 f16 KV, Dankclaw) | `serverAppConfigs-docs/LLM/frank-small-llama-mimo-q6k-2x200704.md` |
-| frank-primary (tcclaviger vLLM, Qwen3.8-Flash-Next FP8, Dankserver) | `serverAppConfigs-docs/LLM/dankserver-qwen38-fp8-expert-offload-tuning.md` |
+| frank-dragoon (flash-server 0.16.2, abliterated Swift1.5 v2 .hgn + MTP always-on, 2×262,144, vision ON, Dankclaw) | `serverAppConfigs-docs/LLM/frank-dragoon-flash-server-v2-swift15.md` |
+| frank-zealot (llama.cpp CUDA, Qwen3.5-9B-Uncensored Q6_K, 2×200,704 exact f16 KV MTP-off, vision ON, Dankclaw) | `serverAppConfigs-docs/LLM/frank-zealot-llama-qwen35-9b-q6k-2x200704.md` |
+| frank-archon (radiance StillDeadcode, Swift1.5-Qwen3.8-Flash-Next GPTQ w4 + bf16-protected experts, int8 trunk, bf16 KV, 2×R9700 TP=2, Dankserver) | `serverAppConfigs-docs/LLM/frank-archon-radiance-swift15-w4dn8.md` |
 | Dankclaw kernel posture (`amd_iommu=off`) | `serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md` |
 | Deployment flow + incidents | `serverAppConfigs-docs/LLM/deployment.md` |
 
@@ -1013,35 +1064,42 @@ Retired (rollback targets and history):
 
 | Runtime | Host | Window | Runbook |
 |---------|------|--------|---------|
-| ROCmFPX llama.cpp fork Qwen3.8-27B Uncensored Q6_0_ROCMFPX_AGENT + MTP (`frank-large`) | Dankclaw | 2026-10-03 → 10-05 (rollback target, payload + fork build on disk) | `frank-large-rocmfpx-q6agent-uncensored-mtp.md` |
-| ROCmFPX llama.cpp fork Qwen3.8-27B Q8_0_ROCMFPX_AGENT + MTP (`frank-large`) | Dankclaw | 2026-10-02 → 10-03 (rollback target, payload on disk) | `frank-large-rocmfpx-q8agent-mtp.md` |
-| gufo v0.1.1 Qwen3.8-27B UD-Q8_K_XL/UD-Q4_K_XL + DFlash2 (`frank-large`) | Dankclaw | 2026-09-28 → 10-01, again 10-01 → 10-02 (payloads removed from disk 2026-10-03; rollback = re-download) | `frank-large-gufo-qwen38-27b.md` |
-| vLLM TheRock MiMo-V2.6-Distill-Qwen-9B BF16 + cross-model MTP (`frank-large`) | Dankclaw | 2026-10-01 (same-day rollback to gufo) | `frank-large-vllm-mimo-v26-bf16.md` |
-| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q6_K (`frank-small`) | Dankclaw | 2026-10-01 → 10-02 (the rung returned ACTIVE 2026-10-03 at the 2×200,704 shape — `frank-small-llama-mimo-q6k-2x200704.md`) | `frank-small-llama-mimo-q6k.md` |
-| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q5_K_M 2×200,704 f16 KV (`frank-small`) | Dankclaw | 2026-10-02 → 10-03 (rollback target — one `MODEL_FILE` line, buys back 875 MiB + the −10 % rung tax; owns the boot-pair table) | `frank-small-llama-mimo-q5km.md` |
-| SGLang MiMo-V2.6 INT8-W8A16-AutoRound (`frank-small`) | Dankclaw | 2026-10-01 (same-day swap to the GGUF path) | `frank-small-sglang-mimo-v26.md` |
-|tcclaviger vLLM GLM-5.3-Flash W4A16 int4, +/- DFlash2 drafter (`frank-primary`)|Dankserver|2026-09-30 → 10-01|`frank-primary-glm53-flash-w4a16.md`|
-| llama.cpp b11030 Qwen3.8-27B UD-Q8_K_XL + DFlash2 (`frank-large`) | Dankclaw | 2026-09-21 → 09-28 | `frank-large-unsloth-qwen38-27b-q8xl.md` |
-| R9V radiance-vLLM Qwen3.8-Flash-Next-Uncensored IQ4_XS (`frank-primary`) | Dankserver | 2026-09-27 (same-day swap to Q8_0) | `frank-primary-r9v-radiance-qwen38-uncensored.md` |
-| llama.cpp b11030 Qwen3.8-Flash-Next Q8_0 + shared MTP (`frank-primary`) | Dankserver | 2026-09-26 → 09-27 | `frank-primary-llamacpp-qwen38-flash-next-q8.md` |
-| ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M (`frank-large`) | Dankclaw | 2026-09-15 → 09-16 | `frank-large-ik-uncensored.md` |
+| llama.cpp CUDA Gemma4-26B-A4B QAT Q4_K_M, 1×200,704 f16-K/q8_0-V MTP-off (`frank-zealot`) | Dankclaw | 2026-10-07 → 10-07 (same-day swap; rollback target — payload on disk; owns the `attention_k_eq_v` pair-billing KV law and the gemma4-assistant drafter-cost boots) | `frank-zealot-llama-gemma4-q4km-200704.md` |
+| radiance StillDeadcode Qwen3.8-Flash-Next native-FP8, 2×R9700 TP=2 (`frank-archon`) | Dankserver | 2026-10-08 → w4dn8 swap (rollback target — `.rad` payload on disk) | `frank-archon-radiance-qwen38-native-fp8.md` |
+| ROCmFPX llama.cpp fork Qwen3.8-27B Uncensored Q6_0_ROCMFPX_AGENT + MTP (`frank-dragoon`) | Dankclaw | 2026-10-03 → 10-05 (rollback target, payload + fork build on disk) | `frank-dragoon-rocmfpx-q6agent-uncensored-mtp.md` |
+| tcclaviger vLLM fork Qwen3.8-Flash-Next-Uncensored FP8, TP=2, shape G (`frank-archon`) | Dankserver | 2026-09-29 → 10-05 (rollback target — tag `frank-archon-vllm-shapeG-20261003`; trio + env lore in the tag, image in rootless storage) | `dankserver-qwen38-fp8-expert-offload-tuning.md` |
+| FreeToken PR #587 ROCm, Qwen3.8-Flash-Next-Uncensored-FP8, ONE R9700 (`frank-archon`) | Dankserver | 2026-10-05 → 10-05 (rollback target — tag `frank-archon-freetoken-pr587-20261005`; trio + Dockerfile in the tag, image `localhost/frank-archon-freetoken:pr587-77a7201` and orcarouter payload on disk) | `frank-archon-freetoken-pr587.md` |
+| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q6_K 2×200,704 f16 KV (`frank-zealot`) | Dankclaw | 2026-10-03 → 10-05 (rollback target — payload on disk; owns the ubatch-2048 A/B; the Ornith swap of 10-05 was committed but never deployed, so this was the LIVE payload Swift replaced) | `frank-zealot-llama-mimo-q6k-2x200704.md` |
+| llama.cpp Ornith-1.5-9B Q8_0, ONE 262,144 f16 KV (`frank-zealot`) | Dankclaw | 2026-10-05 (committed 77decb5→380aafa, never deployed — superseded by Swift the same evening; payload on disk) | trail in `frank-zealot-llama-swift15-unc-iq3xxs-mtp-114688.md` |
+| llama.cpp CUDA Swift-1.5-27B Uncensored RCO IQ3_XXS-mtp, 2×114,688 draft-mtp q8_0 KV (`frank-zealot`) | Dankclaw | 2026-10-06 → 2026-10-07 (rollback target — payload on disk; owns the 3090 ubatch ladder A/B and the 34 KiB/token qwen35 KV law) | `frank-zealot-llama-swift15-unc-iq3xxs-mtp-114688.md` |
+| ROCmFPX llama.cpp fork Qwen3.8-27B Q8_0_ROCMFPX_AGENT + MTP (`frank-dragoon`) | Dankclaw | 2026-10-02 → 10-03 (rollback target, payload on disk) | `frank-dragoon-rocmfpx-q8agent-mtp.md` |
+| gufo v0.1.1 Qwen3.8-27B UD-Q8_K_XL/UD-Q4_K_XL + DFlash2 (`frank-dragoon`) | Dankclaw | 2026-09-28 → 10-01, again 10-01 → 10-02 (payloads removed from disk 2026-10-03; rollback = re-download) | `frank-dragoon-gufo-qwen38-27b.md` |
+| vLLM TheRock MiMo-V2.6-Distill-Qwen-9B BF16 + cross-model MTP (`frank-dragoon`) | Dankclaw | 2026-10-01 (same-day rollback to gufo) | `frank-dragoon-vllm-mimo-v26-bf16.md` |
+| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q6_K (`frank-zealot`) | Dankclaw | 2026-10-01 → 10-02 (the rung returned ACTIVE 2026-10-03 at the 2×200,704 shape — `frank-zealot-llama-mimo-q6k-2x200704.md`) | `frank-zealot-llama-mimo-q6k.md` |
+| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q5_K_M 2×200,704 f16 KV (`frank-zealot`) | Dankclaw | 2026-10-02 → 10-03 (rollback target — one `MODEL_FILE` line, buys back 875 MiB + the −10 % rung tax; owns the boot-pair table) | `frank-zealot-llama-mimo-q5km.md` |
+| SGLang MiMo-V2.6 INT8-W8A16-AutoRound (`frank-zealot`) | Dankclaw | 2026-10-01 (same-day swap to the GGUF path) | `frank-zealot-sglang-mimo-v26.md` |
+|tcclaviger vLLM GLM-5.3-Flash W4A16 int4, +/- DFlash2 drafter (`frank-archon`)|Dankserver|2026-09-30 → 10-01|`frank-archon-glm53-flash-w4a16.md`|
+| llama.cpp b11030 Qwen3.8-27B UD-Q8_K_XL + DFlash2 (`frank-dragoon`) | Dankclaw | 2026-09-21 → 09-28 | `frank-dragoon-unsloth-qwen38-27b-q8xl.md` |
+| R9V radiance-vLLM Qwen3.8-Flash-Next-Uncensored IQ4_XS (`frank-archon`) | Dankserver | 2026-09-27 (same-day swap to Q8_0) | `frank-archon-r9v-radiance-qwen38-uncensored.md` |
+| llama.cpp b11030 Qwen3.8-Flash-Next Q8_0 + shared MTP (`frank-archon`) | Dankserver | 2026-09-26 → 09-27 | `frank-archon-llamacpp-qwen38-flash-next-q8.md` |
+| ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M (`frank-dragoon`) | Dankclaw | 2026-09-15 → 09-16 | `frank-dragoon-ik-uncensored.md` |
 | vllm-radiance TP=2 MXFP4 + DFlash2 (`frank-medium`) | Dankserver | 2026-09-20 → 09-26 | `frank-medium-radiance-mxfp4.md` |
-| Lucebox DS4.1 DeepSeek-V4.1-Flash ROCmFP23 (`frank-primary`) | Dankserver | 2026-09-26 (same-day swap) | `frank-primary-lucebox-ds4.md` |
+| Lucebox DS4.1 DeepSeek-V4.1-Flash ROCmFP23 (`frank-archon`) | Dankserver | 2026-09-26 (same-day swap) | `frank-archon-lucebox-ds4.md` |
 | kingjones STRIX Qwen3.8-Flash-Next ROCmFP4 | Dankclaw | 2026-08-30 → 09-11 | `kingjones-strix-rocmfp4.md` |
-| halogen-flash-server Qwen3.8-Flash-Next w4b (`frank-large`) | Dankclaw | 2026-09-16 → 09-19 | `halogen-flash-server.md` |
-| CIRU v4.4.1 Orca Qwen3.8-Flash (`frank-large`) | Dankclaw | 2026-09-19 → 09-21 | `frank-large-ciru-orca.md` |
-| unsloth llama.cpp b11030 Qwen3.8-Flash-Next UD-IQ4_XS (`frank-large`) | Dankclaw | 2026-09-21 (same-day swap) | `frank-large-unsloth-qwen38-flash-next.md` |
-| Kairic Edge Qwen3.8-27B IU4 W4A4 (`frank-large`) | Dankclaw | 2026-09-21 (same-day swap) | `frank-large-kairic-edge-qwen38-27b.md` |
-| ISTA-DASLab Qwen3.8-27B-GSQ-RCO IQ3_S (`frank-small`) | Dankclaw | 2026-09-16 → 09-17 | `frank-small-qwen38-gsq-rco.md` |
-| vLLM Gemma4-12B w4a16 (`frank-small`) | Dankclaw | 2026-09-19 (same-day revert) | `frank-small-vllm-gemma4.md` |
-| llama.cpp Gemma4-12B QAT Q4_K_M (`frank-small`) | Dankclaw | 2026-09-17 → 10-01 | `frank-small-gemma4-12b.md` |
+| halogen-flash-server Qwen3.8-Flash-Next w4b (`frank-dragoon`) | Dankclaw | 2026-09-16 → 09-19 | `halogen-flash-server.md` |
+| CIRU v4.4.1 Orca Qwen3.8-Flash (`frank-dragoon`) | Dankclaw | 2026-09-19 → 09-21 | `frank-dragoon-ciru-orca.md` |
+| unsloth llama.cpp b11030 Qwen3.8-Flash-Next UD-IQ4_XS (`frank-dragoon`) | Dankclaw | 2026-09-21 (same-day swap) | `frank-dragoon-unsloth-qwen38-flash-next.md` |
+| Kairic Edge Qwen3.8-27B IU4 W4A4 (`frank-dragoon`) | Dankclaw | 2026-09-21 (same-day swap) | `frank-dragoon-kairic-edge-qwen38-27b.md` |
+| ISTA-DASLab Qwen3.8-27B-GSQ-RCO IQ3_S (`frank-zealot`) | Dankclaw | 2026-09-16 → 09-17 | `frank-zealot-qwen38-gsq-rco.md` |
+| vLLM Gemma4-12B w4a16 (`frank-zealot`) | Dankclaw | 2026-09-19 (same-day revert) | `frank-zealot-vllm-gemma4.md` |
+| llama.cpp Gemma4-12B QAT Q4_K_M (`frank-zealot`) | Dankclaw | 2026-09-17 → 10-01 | `frank-zealot-gemma4-12b.md` |
 | agentionai ROCmFP4-FAST imatrix | Dankclaw | 2026-08-29 → 08-30 | `agentionai-fast-imatrix.md` |
 | eemin Qwen3.8-27B ROCmI4 W4A4 MTP | Dankclaw | 2026-08-18 → 08-25 | `eemin-rocmi4-mtp.md` |
 | Kairic Edge IU4 | Dankclaw | 2026-08-22 (same-day revert) | `kairic-edge.md` |
 | CIRU ActiveFPX v3 / PromptForge | Dankclaw | through 2026-08-22 | `ciru-activefpx-promptforge.md` |
 | DFlash2 Vulkan | Dankclaw | 2026-08-21 (same-day revert) | `dflash2-large-vulkan.md` |
 | FastFlowLM NPU (`frank-npu`) | Dankclaw | twice, retired 2026-09-11 | `frank-npu.md`, `FastFlowLM NPU Inference.md` |
-| FreeToken (official + Huihui FP8, `frank-small`) | Dankserver | 2026-09-02 → 09-15 | `freetoken-frank-small.md` |
+| FreeToken (official + Huihui FP8, `frank-zealot`) | Dankserver | 2026-09-02 → 09-15 | `freetoken-frank-small.md` |
 | FastMTP patched llama.cpp | Dankserver | retired 2026-08-18 | `qwen3.8-spec-matrix.md` |
 | ik_llama.cpp Ornith CRACK | Dankserver | retired 2026-09-02 | `ikllama-ornith-dankserver.md` |
 | llama.cpp layer split + DFlash2 (`frank-medium`) | Dankserver | 2026-09-16 → 09-20 | `frank-medium-llamacpp-dflash2.md` |

README.md

@@ -13,7 +13,7 @@ one deploy script.
 | Host | User | IP | Podman stack | LLM service | LLM port |
 |------|------|----|--------------|-------------|----------|
 | dankserver | dank | 192.168.0.235 | media and library | frank-medium (ROCmFPX llama.cpp, Qwen3.8-27B AGENT) | 7770 |
-| dankclaw | dank | 192.168.0.143 | AI, search, development, observability | frank-large (gufo, Qwen3.8-27B UD-Q8_K_XL) | 7770 |
+| dankclaw | dank | 192.168.0.143 | AI, search, development, observability | frank-dragoon (gufo, Qwen3.8-27B UD-Q8_K_XL) | 7770 |
 
 ## Active Services
 
@@ -30,7 +30,7 @@ one deploy script.
 | Gitea | dankclaw | gitea.dankclaw.local | 3001 |
 | Grafana | dankclaw | grafana.dankclaw.local | 3002 |
 | Prometheus | dankclaw | prometheus.dankclaw.local | 9090 |
-| frank-large | dankclaw | — (bare endpoint) | 7770 |
+| frank-dragoon | dankclaw | — (bare endpoint) | 7770 |
 
 ## Structure
 

autoresearch.sh

@@ -1,117 +1,26 @@
 #!/usr/bin/env bash
-# autoresearch.sh — canonical benchmark entrypoint: speed of frank-primary.
+# autoresearch.sh — canonical frank-archon benchmark entry point (dev box).
 #
-# Runs on the operator box and drives one bench window on DANKSERVER:
-#   1. fingerprint the candidate trio (env + serve script + unit)
-#   2. memo fast-path: an identical fingerprint that already produced a FULLY
-#      successful window (bench + verified production restore) returns the
-#      cached metrics without touching the fleet
-#   3. stage the candidate trio plus the measure client into
-#      /home/dank/.autoresearch-frank-primary/ (ephemeral; the repo checkout
-#      on the host stays the production source of truth)
-#   4. run the window (scripts/autoresearch/frank-primary-window.sh):
-#      stop + mask the production unit, boot the staged config AS THE SERVICE
-#      (same serve script, same container, same port 7770), wait for health,
-#      run the in-container usage-counter measure, then restore the production
-#      unit and verify its health — AGENTS.md Benchmarking Policy
-#   5. print METRIC lines (parse by run_experiment)
-#
-# Primary metric: decode_tps (HIGHER is better) — median across the three
-# prompt depths (115/1056/4096) of per-depth medians of
-# completion_tokens / (wall - ttft), 3 runs each after a warm pass,
-# temperature 0, the campaign's deterministic word-seed workload.
-#
-# Exit 0 with METRIC lines on success; non-zero on any failure (the window
-# script's EXIT trap restores production on every path).
-set -euo pipefail
+# The service runs on dankserver (192.168.0.235:7770), the two R9700s live
+# there, and the benchmark must own those cards, so the whole stop -> boot
+# scratch -> bench -> restore sequence runs ON dankserver (see
+# scripts/autoresearch-frank-archon.sh). This wrapper:
+#   1. copies the candidate config (the repo's scripts/frank-archon.env, the
+#      file the autoresearch loop edits) and the bench script to dankserver,
+#   2. runs the bench over ssh, relaying its stdout (the METRIC lines) and
+#      exit code back here verbatim.
+# It deliberately does NOT push to origin: the scp dirties dankserver's
+# working tree, and the loop's uncommitted candidate config must not be
+# pushed. Only this file and scripts/autoresearch-frank-archon.sh are
+# committed; the candidate env rides over ssh each run.
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REMOTE=dankserver
+REMOTE_REPO=/home/dank/serverAppConfigs
 
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-HOST="${FRANK_PRIMARY_AR_HOST:-dankserver}"
-STAGE="/home/dank/.autoresearch-frank-primary"
+scp -q "$DIR/scripts/frank-archon.env" \
+    "$REMOTE:$REMOTE_REPO/scripts/frank-archon.env" || { echo "scp env failed" >&2; exit 1; }
+scp -q "$DIR/scripts/autoresearch-frank-archon.sh" \
+    "$REMOTE:$REMOTE_REPO/scripts/autoresearch-frank-archon.sh" || { echo "scp script failed" >&2; exit 1; }
 
-# FRANK_PRIMARY_AR_ENV_FILE stages a DIFFERENT env than the repo's — that is how
-# the arms driver A/Bs engine knobs without mutating the checkout. The
-# fingerprint covers whatever file is staged, so the memo cannot cross arms.
-ENV_FILE="${FRANK_PRIMARY_AR_ENV_FILE:-$SCRIPT_DIR/scripts/frank-primary.env}"
-SERVE="$SCRIPT_DIR/scripts/serve-frank-primary.sh"
-UNIT="$SCRIPT_DIR/scripts/frank-primary.service"
-MEASURE="$SCRIPT_DIR/scripts/autoresearch/frank-primary-measure.py"
-WINDOW="$SCRIPT_DIR/scripts/autoresearch/frank-primary-window.sh"
-
-for f in "$ENV_FILE" "$SERVE" "$UNIT" "$MEASURE" "$WINDOW"; do
-    [ -f "$f" ] || { echo "[autoresearch] missing harness file: $f" >&2; exit 1; }
-done
-command -v python3 >/dev/null 2>&1 || { echo "[autoresearch] python3 required on operator box" >&2; exit 1; }
-
-# Fingerprint of everything that can change the engine's argv or environment.
-HASH="$(cat "$ENV_FILE" "$SERVE" "$UNIT" | sha256sum | cut -d' ' -f1)"
-echo "[autoresearch] candidate fingerprint $HASH" >&2
-
-ssh_run() { ssh -o BatchMode=yes -o ConnectTimeout=15 "$HOST" "$@"; }
-
-emit_metrics() { # $1 = run.json
-    python3 -c '
-import json, sys
-run = json.loads(sys.argv[1])
-m = run["measure"]
-print("METRIC decode_tps=%s" % m["decode_tps"])
-for k in ("decode_tps_115", "decode_tps_1056", "decode_tps_4096"):
-    print("METRIC %s=%s" % (k, m[k]))
-print("METRIC ttft_ms_4096=%s" % m["ttft_ms_4096"])
-print("METRIC kv_tokens=%s" % (run.get("kv_tokens") or 0))
-print("METRIC boot_seconds=%s" % (run.get("boot_seconds") or -1))
-print("METRIC completion_tokens_4096=%s" % m.get("completion_tokens_4096", 0))
-# Any extra sampling temperature the measure swept (AR_TEMPS), e.g. the 0.7
-# arm — that is where speculative-decode acceptance shows up, since a greedy
-# draft matches a greedy target exactly and is rejected more under real
-# sampling. Suffixed keys only (_t0.7), so the historical lines are untouched.
-for k in sorted(m):
-    if "_t" in k and (k.startswith("decode_tps") or k.startswith("ttft_ms")):
-        print("METRIC %s=%s" % (k, m[k]))
-' "$1"
-}
-
-# --- memo fast-path -------------------------------------------------------
-cached_hash="$(ssh_run "cat '$STAGE/last/hash' 2>/dev/null" 2>/dev/null || true)"
-if [ -n "$cached_hash" ] && [ "$cached_hash" = "$HASH" ]; then
-    cached_run="$(ssh_run "cat '$STAGE/last/run.json' 2>/dev/null" || true)"
-    if [ -n "$cached_run" ]; then
-        echo "[autoresearch] memo hit — cached metrics for $HASH, fleet untouched" >&2
-        emit_metrics "$cached_run"
-        exit 0
-    fi
-fi
-
-# --- stage the candidate ----------------------------------------------------
-echo "[autoresearch] staging candidate on $HOST:$STAGE" >&2
-ssh_run "mkdir -p '$STAGE'"
-scp -q "$ENV_FILE" "$HOST:$STAGE/frank-primary.env"
-scp -q "$SERVE" "$HOST:$STAGE/serve.sh"
-scp -q "$MEASURE" "$HOST:$STAGE/measure.py"
-scp -q "$WINDOW" "$HOST:$STAGE/window.sh"
-ssh_run "printf '%s\n' '$HASH' > '$STAGE/hash'"
-
-# --- the window -------------------------------------------------------------
-# Budgets: bench boot up to 20 min (warm boots measured ~7 min), measure up
-# to 30 min, restore boot up to 20 min — call run_experiment with
-# timeout_seconds >= 3600.
-echo "[autoresearch] opening bench window (stop+mask -> boot -> measure -> restore)" >&2
-set +e
-ssh_run "bash '$STAGE/window.sh'"
-rc=$?
-set -e
-if [ "$rc" -ne 0 ]; then
-    echo "[autoresearch] window failed (rc=$rc); host-side evidence:" >&2
-    ssh_run "tail -60 '$STAGE/fail.log' 2>/dev/null || tail -40 '$STAGE/serve.out' 2>/dev/null || tail -40 '$STAGE/measure.out' 2>/dev/null || true" >&2 || true
-    exit 1
-fi
-
-run_json="$(ssh_run "cat '$STAGE/run.json'")" || {
-    echo "[autoresearch] could not read $STAGE/run.json back" >&2; exit 1; }
-echo "[autoresearch] window result:" >&2
-printf '%s\n' "$run_json" >&2
-emit_metrics "$run_json"
-
-echo "[autoresearch] engine evidence (plan / compile path / spec counters):" >&2
-ssh_run "cat '$STAGE/evidence.log' 2>/dev/null" >&2 || true
-exit 0
+ssh "$REMOTE" "bash $REMOTE_REPO/scripts/autoresearch-frank-archon.sh $REMOTE_REPO/scripts/frank-archon.env"

dankclaw/Caddyfile

@@ -56,6 +56,21 @@
 	}
 }
 
+# ═══════════════════════════════════════════════════════════════
+# Named snippet: the pre-auth guard chain. Anubis (:8923) challenges,
+# the embedded Authentik outpost authenticates, and authenticated
+# traffic returns to the http://:8017 listener's post-auth handlers.
+# Every guarded vhost is `import guarded` — the chain is EDITED HERE,
+# never inlined per site (rank 6: it used to be nine verbatim copies).
+# Exemptions live in their own vhosts (auth. is the IdP itself; git
+# smart-HTTP and self-authenticating services document their reason).
+# ═══════════════════════════════════════════════════════════════
+(guarded) {
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
+}
+
 # --- Bare-IP access (health checks, convenience) ---
 :80 {
 	redir https://www.franksdank.cloud/ 308
@@ -72,9 +87,7 @@ franksdank.cloud {
 }
 
 www.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Legacy name: the old homepage name redirects straight onto www ---
@@ -100,9 +113,7 @@ auth.franksdank.cloud {
 
 # --- SearXNG (quadlet; behind the Gluetun tunnel, published 8081) ---
 search.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- OpenWebUI (quadlet on slirp4netns; published 3005) ---
@@ -126,30 +137,22 @@ gitea.franksdank.cloud {
 # never reach Grafana — RP mode needs none and works regardless of topology.
 # The basicauth edge this replaces (CADDY_BASICAUTH_HASH) is retired.
 grafana.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Prometheus ---
 prometheus.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Loki (guarded: Anubis → Authentik; loki-proxy provider, internal_host caddy:8017) ---
 loki.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Seerr (guarded: Anubis → Authentik; seerr provider, internal_host caddy:8017) ---
 seerr.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Marreta (guarded: Anubis → Authentik; marreta provider, internal_host caddy:8017) ---
@@ -157,9 +160,7 @@ seerr.franksdank.cloud {
 # group gate). Egress rides the searxng gluetun tunnel; reached via the
 # host-published port 8082 (gluetun netns), not by container name.
 marreta.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Pi-hole (quadlet on slirp4netns; published 8083) ---
@@ -233,16 +234,12 @@ books.franksdank.cloud {
 
 # --- RomM ---
 romm.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Copyparty ---
 files.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Jellyfin ---
@@ -337,7 +334,16 @@ http://:8017 {
 			try_files /docs.html
 			file_server
 		}
-		@data path /services.json /status.json /app.js /style.css /deployed.js
+		# /whoami echoes the outpost-injected identity headers so the page
+		# can gate the admin button client-side (the /admin* 403 above stays
+		# the real gate; this only decides what is shown). The outpost strips
+		# client-supplied X-Authentik-* before injecting, so this is spoof-proof.
+		handle /whoami {
+			templates
+			header Content-Type application/json
+			respond "{\"user\":\"{header.X-Authentik-Username}\",\"groups\":\"{header.X-Authentik-Groups}\"}"
+		}
+		@data path /services.json /status.json /app.js /style.css /deployed.js /img/* /sfx/*
 		handle @data {
 			file_server
 		}

dankclaw/comfyui/workflows/qwen-image-2.1-t2i-art.json

@@ -0,0 +1,64 @@
+{
+  "3": {
+    "class_type": "CLIPTextEncode",
+    "_meta": { "title": "Positive prompt" },
+    "inputs": {
+      "text": "A detailed illustration of a 1930s Soviet industrial design bureau at night: a well-measured engineer at a drafting table, a warm desk lamp, rolled blueprints, gears and calipers on the desk, deep red and cream palette, gouache painterly style, intricate mechanical detail, soft shadows",
+      "clip": [ "6", 0 ]
+    }
+  },
+  "4": {
+    "class_type": "CLIPTextEncode",
+    "_meta": { "title": "Negative prompt" },
+    "inputs": {
+      "text": "lowres, blurry, deformed, extra limbs, watermark, signature, jpeg artifacts",
+      "clip": [ "6", 0 ]
+    }
+  },
+  "5": {
+    "class_type": "UNETLoader",
+    "_meta": { "title": "Qwen Image 2.1 (int8)" },
+    "inputs": { "unet_name": "qwen_image_2.1_int8_convrot.safetensors", "weight_dtype": "default" }
+  },
+  "6": {
+    "class_type": "CLIPLoader",
+    "_meta": { "title": "Qwen3-VL 8B text encoder (w4a8)" },
+    "inputs": { "clip_name": "qwen3vl_8b_w4a8.safetensors", "type": "qwen_image" }
+  },
+  "7": {
+    "class_type": "VAELoader",
+    "_meta": { "title": "VAE" },
+    "inputs": { "vae_name": "qwen_image_2.1_vae_bf16.safetensors" }
+  },
+  "8": {
+    "class_type": "EmptySD3LatentImage",
+    "_meta": { "title": "Empty Latent 1024x1024" },
+    "inputs": { "width": 1024, "height": 1024, "batch_size": 1 }
+  },
+  "9": {
+    "class_type": "KSampler",
+    "_meta": { "title": "KSampler" },
+    "inputs": {
+      "model": [ "5", 0 ],
+      "seed": 1930,
+      "steps": 20,
+      "cfg": 1.0,
+      "sampler_name": "euler",
+      "scheduler": "simple",
+      "positive": [ "3", 0 ],
+      "negative": [ "4", 0 ],
+      "latent_image": [ "8", 0 ],
+      "denoise": 1.0
+    }
+  },
+  "10": {
+    "class_type": "VAEDecode",
+    "_meta": { "title": "VAE Decode" },
+    "inputs": { "samples": [ "9", 0 ], "vae": [ "7", 0 ] }
+  },
+  "11": {
+    "class_type": "SaveImage",
+    "_meta": { "title": "Save Image (art)" },
+    "inputs": { "filename_prefix": "qwen21-art", "images": [ "10", 0 ] }
+  }
+}

dankclaw/comfyui/workflows/qwen-image-2.1-t2i-legible-text.json

@@ -0,0 +1,64 @@
+{
+  "3": {
+    "class_type": "CLIPTextEncode",
+    "_meta": { "title": "Positive prompt (legible text)" },
+    "inputs": {
+      "text": "Clean minimalist movie-poster design, dark charcoal background with a subtle vintage grain. Centered large bold white sans-serif text reading \"SOLIDARITY OF THE SOVIET COMPUTER SYSTEMS\", perfectly legible, crisp letterforms, even letter spacing. Below it, a smaller line of yellow text reading \"DANKCLAW DANKSERVER EST 2026\", equally legible. Flat graphic design, high contrast, generous margins, no other words, no watermark",
+      "clip": [ "6", 0 ]
+    }
+  },
+  "4": {
+    "class_type": "CLIPTextEncode",
+    "_meta": { "title": "Negative prompt" },
+    "inputs": {
+      "text": "blurry, illegible, misspelled, warped letters, extra text, watermark, signature, lowres, jpeg artifacts",
+      "clip": [ "6", 0 ]
+    }
+  },
+  "5": {
+    "class_type": "UNETLoader",
+    "_meta": { "title": "Qwen Image 2.1 (int8)" },
+    "inputs": { "unet_name": "qwen_image_2.1_int8_convrot.safetensors", "weight_dtype": "default" }
+  },
+  "6": {
+    "class_type": "CLIPLoader",
+    "_meta": { "title": "Qwen3-VL 8B text encoder (w4a8)" },
+    "inputs": { "clip_name": "qwen3vl_8b_w4a8.safetensors", "type": "qwen_image" }
+  },
+  "7": {
+    "class_type": "VAELoader",
+    "_meta": { "title": "VAE" },
+    "inputs": { "vae_name": "qwen_image_2.1_vae_bf16.safetensors" }
+  },
+  "8": {
+    "class_type": "EmptySD3LatentImage",
+    "_meta": { "title": "Empty Latent 832x1216 poster" },
+    "inputs": { "width": 832, "height": 1216, "batch_size": 1 }
+  },
+  "9": {
+    "class_type": "KSampler",
+    "_meta": { "title": "KSampler" },
+    "inputs": {
+      "model": [ "5", 0 ],
+      "seed": 2026,
+      "steps": 25,
+      "cfg": 1.0,
+      "sampler_name": "euler",
+      "scheduler": "simple",
+      "positive": [ "3", 0 ],
+      "negative": [ "4", 0 ],
+      "latent_image": [ "8", 0 ],
+      "denoise": 1.0
+    }
+  },
+  "10": {
+    "class_type": "VAEDecode",
+    "_meta": { "title": "VAE Decode" },
+    "inputs": { "samples": [ "9", 0 ], "vae": [ "7", 0 ] }
+  },
+  "11": {
+    "class_type": "SaveImage",
+    "_meta": { "title": "Save Image (text poster)" },
+    "inputs": { "filename_prefix": "qwen21-text", "images": [ "10", 0 ] }
+  }
+}

dankclaw/hermes/config.yaml.example

@@ -10,15 +10,15 @@ model:
   provider: dankclaw-large
   base_url: http://192.168.0.143:7770/v1
   api_key: not-needed
-  default: frank-large
+  default: frank-dragoon
 
 providers:
   dankclaw-large:
     api: http://192.168.0.143:7770/v1
     discover_models: false
     models:
-      frank-large:
-        context_length: 114688
+      frank-dragoon:
+        context_length: 262144
   dankserver-small:
     api: http://192.168.0.235:7770/v1
     discover_models: false
@@ -29,7 +29,7 @@ providers:
 # Auxiliary routing from the live configuration. Named providers route via
 # their `api:` URL; `custom` entries route by their explicit `base_url`.
 auxiliary:
-  vision: {provider: dankclaw-large, model: frank-large}
+  vision: {provider: dankclaw-large, model: frank-dragoon}
   web_extract: {provider: dankserver-small, model: frank-medium}
   compression: {provider: dankserver-small, model: frank-medium}
   skills_hub: {provider: dankserver-small, model: frank-medium}
@@ -50,8 +50,8 @@ auxiliary:
         effort: none
   memory_query_rewrite: {provider: custom, model: frank-medium, base_url: http://192.168.0.235:7770/v1}
   tts_audio_tags: {provider: custom, model: frank-medium, base_url: http://192.168.0.235:7770/v1}
-  triage_specifier: {provider: dankclaw-large, model: frank-large}
-  kanban_decomposer: {provider: dankclaw-large, model: frank-large}
+  triage_specifier: {provider: dankclaw-large, model: frank-dragoon}
+  kanban_decomposer: {provider: dankclaw-large, model: frank-dragoon}
   profile_describer: {provider: dankserver-small, model: frank-medium}
   curator: {provider: dankserver-small, model: frank-medium}
 

dankclaw/observability/quadlet/node-exporter.container

@@ -1,30 +1,32 @@
-# Quadlet unit: node-exporter (rootless, boot-persistent).
+# Quadlet unit: node-exporter (rootless, boot-persistent) — RENDERED ARTIFACT.
+# Regenerate: python3 scripts/service-map.py render node-exporter-unit --host dankclaw
+# Source: shared/services.yml (entry node-exporter) + this template.
 #
 # Install path on dankclaw: ~/.config/containers/systemd/node-exporter.container
 # Unit name: node-exporter.service (container name: node-exporter)
 #
-# Host metrics source for Prometheus. This replaces the compose service of the
-# same name in dankclaw/compose.yaml ("Observability" block).
+# Host metrics source for Prometheus. Replaces the compose service of the same
+# name (the "Observability" block): Dankclaw moved to this quadlet on
+# 2026-09-11, Dankserver on 2026-09-16 — its compose-only copy died at a reboot
+# and stayed dead (rootless Podman does not restart bare containers after the
+# explicit stop shutdown performs), dead for a day and a half before anyone
+# noticed. One owner per container name; no compose file remains anywhere.
 #
 # HOST NAMESPACE. It must run in the host network namespace to report the
 # host's own interfaces/connections, and --pid=host for the processes and
 # cgroups collectors. "localhost" inside the container is therefore the host's
 # loopback, which is what the homepage status timer probes.
 #
-# LISTEN ADDRESSES. Until 2026-09-11 this bound :9100 on every interface. It
-# now binds exactly two: loopback for the homepage status probe, and the LAN
-# address because Prometheus — which runs in a container on dankclaw_default —
-# scrapes http://192.168.0.143:9100 (shared/prometheus/prometheus.yml,
-# job "node-dankclaw"). node_exporter itself has no authentication, so keeping
-# the wildcard bind off the table matters: this is the second half of the
-# pairing that removes the unauthenticated observability surface, and both
-# consumers are accounted for. Dankserver runs its own copy of this container
-# (scraped by the "node-dankserver" job) — since 2026-09-16 as a Quadlet unit in
-# the same shape (dankserver/observability/quadlet/), because the compose-only
-# version it replaced had been dead for a day and a half before anyone noticed.
+# LISTEN ADDRESSES. Exactly two: loopback for the homepage status probe, and
+# the LAN address, because Prometheus — which runs in a container on
+# dankclaw_default — scrapes http://192.168.0.143:9100/metrics
+# (shared/prometheus/prometheus.yml, job "node-dankclaw"). node_exporter has no
+# authentication, so the wildcard bind stays off the table; this is the
+# pairing that removes the unauthenticated observability surface on every
+# host, and both consumers are accounted for.
 #
-# MOUNTS. The container reads the host's /proc, /sys and / as /host/* read-only
-# and is pointed at them with --path.*; it writes nothing anywhere.
+# MOUNTS. The container reads the host's /proc, /sys and / as /host/*
+# read-only and is pointed at them with --path.*; it writes nothing anywhere.
 
 [Unit]
 Description=Prometheus node exporter (Dankclaw host metrics)

dankclaw/pihole/addn-hosts

@@ -1,47 +1,43 @@
-# A records for the flat franksdank.name scheme (dnsmasq addn-hosts format:
-# <IP> <name> [<name> ...]). Served by the Pi-hole quadlet (FTL is a
-# dnsmasq fork): the quadlet mounts this file into /etc/pihole/hosts/ read-only.
+# A records for the flat franksdank.cloud scheme (dnsmasq addn-hosts
+# format: <IP> <name>). RENDERED — do not edit by hand:
 #
-# Caddy is consolidated on dankclaw (192.168.0.143): it fronts every service
-# on both hosts, so every name resolves to that one IP. Keep in sync with the
-# Caddyfile (tests/pihole.bats cross-checks this).
+#     scripts/service-map.py render pihole-hosts > dankclaw/pihole/addn-hosts
 #
-#   192.168.0.143 = dankclaw (runs the Caddy container + the AI/dev stack)
-#   192.168.0.235 = dankserver (media stack; reached by Caddy via published
-#                    LAN ports — no DNS records point here)
+# The source of truth is the `dns:` field of shared/services.yml; the
+# drift gate in tests/service_inventory.bats fails when this file and
+# the inventory disagree. Caddy is consolidated on Dankclaw, so every
+# name — including the services running on dankserver and
+# frankbook-pro — resolves at the Dankclaw edge.
+#
+# dnsmasq strips ONLY whole-line comments in addn-hosts: a trailing
+# comment on a data line becomes a HOSTNAME token. No inline notes
+# here; the service attribution lives in the inventory.
 
-# --- Homepage (naked domain + www) + legacy names ---
+192.168.0.143 search.franksdank.cloud
+192.168.0.143 marreta.franksdank.cloud
+192.168.0.143 pihole.franksdank.cloud
+192.168.0.143 ai.franksdank.cloud
+192.168.0.143 gitea.franksdank.cloud
+192.168.0.143 comfyui.franksdank.cloud
+192.168.0.143 seerr.franksdank.cloud
+192.168.0.143 hermes.franksdank.cloud
+192.168.0.143 hermesadmin.franksdank.cloud
+192.168.0.143 prometheus.franksdank.cloud
+192.168.0.143 grafana.franksdank.cloud
+192.168.0.143 loki.franksdank.cloud
+192.168.0.143 auth.franksdank.cloud
 192.168.0.143 franksdank.cloud
 192.168.0.143 www.franksdank.cloud
 192.168.0.143 dankclaw.franksdank.cloud
 192.168.0.143 dankserver.franksdank.cloud
-
-# --- Authentik (SSO / OIDC provider) ---
-192.168.0.143 auth.franksdank.cloud
-
-# --- Media services (dankserver, proxied) ---
-192.168.0.143 plex.franksdank.cloud
-192.168.0.143 plex.franksdank.casa
-192.168.0.143 books.franksdank.cloud
 192.168.0.143 romm.franksdank.cloud
 192.168.0.143 files.franksdank.cloud
 192.168.0.143 jelly.franksdank.cloud
+192.168.0.143 books.franksdank.cloud
+192.168.0.143 plex.franksdank.cloud
+192.168.0.143 plex.franksdank.casa
+192.168.0.143 prowlarr.franksdank.cloud
+192.168.0.143 qbittorrent.franksdank.cloud
 192.168.0.143 radarr.franksdank.cloud
 192.168.0.143 lidarr.franksdank.cloud
 192.168.0.143 readarr.franksdank.cloud
-192.168.0.143 prowlarr.franksdank.cloud
-192.168.0.143 qbittorrent.franksdank.cloud
-
-# --- AI / search / dev services (dankclaw, local) ---
-192.168.0.143 search.franksdank.cloud
-192.168.0.143 comfyui.franksdank.cloud
-192.168.0.143 ai.franksdank.cloud
-192.168.0.143 hermes.franksdank.cloud
-192.168.0.143 hermesadmin.franksdank.cloud
-192.168.0.143 gitea.franksdank.cloud
-192.168.0.143 grafana.franksdank.cloud
-192.168.0.143 prometheus.franksdank.cloud
-192.168.0.143 loki.franksdank.cloud
-192.168.0.143 pihole.franksdank.cloud
-192.168.0.143 seerr.franksdank.cloud
-192.168.0.143 marreta.franksdank.cloud

dankserver/observability/quadlet/node-exporter.container

@@ -1,34 +1,32 @@
-# Quadlet unit: node-exporter (rootless, boot-persistent) — DANKSERVER.
+# Quadlet unit: node-exporter (rootless, boot-persistent) — RENDERED ARTIFACT.
+# Regenerate: python3 scripts/service-map.py render node-exporter-unit --host dankserver
+# Source: shared/services.yml (entry node-exporter) + this template.
 #
 # Install path on dankserver: ~/.config/containers/systemd/node-exporter.container
 # Unit name: node-exporter.service (container name: node-exporter)
 #
-# WHY THIS FILE EXISTS. Until 2026-09-16 the Dankserver node-exporter ran only
-# from `dankserver/compose.yaml` (the "Observability" block, `restart:
-# unless-stopped`). Rootless Podman does not restart bare containers after the
-# explicit stop that shutdown performs, so it died at a reboot and stayed dead:
-# `podman ps -a` showed it `Exited (143)` and Prometheus' `node-dankserver` job
-# had been scraping nothing since. The compose entry also bound the default
-# wildcard address, which is the unauthenticated-metrics-API-on-every-interface
-# posture that was already removed on Dankclaw. This unit replaces both: one
-# owner per container name (the compose service is deleted), explicit listen
-# addresses, and a generator-provided boot path.
+# Host metrics source for Prometheus. Replaces the compose service of the same
+# name (the "Observability" block): Dankclaw moved to this quadlet on
+# 2026-09-11, Dankserver on 2026-09-16 — its compose-only copy died at a reboot
+# and stayed dead (rootless Podman does not restart bare containers after the
+# explicit stop shutdown performs), dead for a day and a half before anyone
+# noticed. One owner per container name; no compose file remains anywhere.
 #
-# HOST NAMESPACE. Networking and PID in the host's namespaces: the collectors
-# report the host's own interfaces, connections, processes and cgroups. The
-# host's /proc, /sys and / are mounted read-only under /host and /rootfs, and
-# node_exporter writes nothing.
+# HOST NAMESPACE. It must run in the host network namespace to report the
+# host's own interfaces/connections, and --pid=host for the processes and
+# cgroups collectors. "localhost" inside the container is therefore the host's
+# loopback, which is what the homepage status timer probes.
 #
-# LISTEN ADDRESSES. Exactly two:
-#   - 127.0.0.1:9100   for host-local probes
-#   - 192.168.0.235:9100 for Prometheus, which scrapes this host from Dankclaw
-#     (shared/prometheus/prometheus.yml, job "node-dankserver"). It cannot use
-#     loopback across hosts, and node_exporter has no authentication, so the
-#     wildcard bind stays off the table. This is the same deliberate LAN
-#     listener posture the observability runbook documents.
+# LISTEN ADDRESSES. Exactly two: loopback for the homepage status probe, and
+# the LAN address, because Prometheus — which runs in a container on
+# dankclaw_default — scrapes http://192.168.0.235:9100/metrics
+# (shared/prometheus/prometheus.yml, job "node-dankserver"). node_exporter has no
+# authentication, so the wildcard bind stays off the table; this is the
+# pairing that removes the unauthenticated observability surface on every
+# host, and both consumers are accounted for.
 #
-# MIRROR. Keep this file in step with dankclaw/observability/quadlet/
-# node-exporter.container; only the Description and the LAN address differ.
+# MOUNTS. The container reads the host's /proc, /sys and / as /host/*
+# read-only and is pointed at them with --path.*; it writes nothing anywhere.
 
 [Unit]
 Description=Prometheus node exporter (Dankserver host metrics)

old/download-frank-archon-fp8.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# download-frank-primary-fp8.sh — fetch/verify the Qwen3.8-Flash-Next-FP8
+# download-frank-archon-fp8.sh — fetch/verify the Qwen3.8-Flash-Next-FP8
 # payload (131 safetensors shards, 172.78 GiB total, plus aux files) for the
-# vLLM frank-primary deployment on dankserver.
+# vLLM frank-archon deployment on dankserver.
 #
-#   bash scripts/download-frank-primary-fp8.sh [dest_dir]
+#   bash scripts/download-frank-archon-fp8.sh [dest_dir]
 #
 # The manifest (scripts/manifests/qwen3.8-flash-next-fp8.manifest) carries
 # per-file sizes + LFS sha256s from the Hub; hf-fetch.sh is idempotent — an

old/download-frank-dragoon-dflash.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Download the z-lab Qwen3.5-9B-DFlash drafter for frank-large's DFlash
+# Download the z-lab Qwen3.5-9B-DFlash drafter for frank-dragoon's DFlash
 # speculative-decode arm (vLLM --speculative-config method=dflash). Public
 # repo — no auth header on the command line.
 #
@@ -10,7 +10,7 @@
 # the draft for that target.
 #
 # Usage:
-#   scripts/download-frank-large-dflash.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-dflash.sh [DEST_DIR] [--verify-only]
 set -euo pipefail
 
 REPO="z-lab/Qwen3.5-9B-DFlash"

old/download-frank-dragoon-mimo.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# Download the BF16 MiMo-V2.6-Distill-Qwen-9B payload for frank-large
+# Download the BF16 MiMo-V2.6-Distill-Qwen-9B payload for frank-dragoon
 # (vLLM/kyuz0 gfx1151, Strix Halo iGPU). Public repo — no auth header on the
 # command line (a Bearer token in argv is world-readable via /proc).
 #
 # Per-file FRESH downloads, no resume: the house rule (see
-# download-frank-small.sh); -f/--fail-with-body plus size+sha256 against the
+# download-frank-zealot.sh); -f/--fail-with-body plus size+sha256 against the
 # Hub LFS oid is what makes an access error fail instead of "succeeding".
 #
 # Usage:
-#   scripts/download-frank-large-mimo.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-mimo.sh [DEST_DIR] [--verify-only]
 #
 # The verified set below is exactly what the 2026-10-01 bench window served:
 # 17.53 GiB of BF16 weights (4 shards, 18,819,720,848 B total with the rest).

old/download-frank-dragoon-qwen35.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
 # Download the source Qwen3.5-9B checkpoint — the ONLY place this model
-# family's MTP head (15 mtp.* tensors) exists. frank-large runs it as the
+# family's MTP head (15 mtp.* tensors) exists. frank-dragoon runs it as the
 # vLLM cross-model MTP draft (MiMo-V2.6-Distill-Qwen-9B itself ships zero
-# mtp tensors; that is why SGLang's NEXTN on frank-small draws 0.00
+# mtp tensors; that is why SGLang's NEXTN on frank-zealot draws 0.00
 # acceptance). Public repo — no auth header on the command line.
 #
 # NOTE the odd upstream shard names (model.safetensors-0000N-of-00004...).
 #
 # Usage:
-#   scripts/download-frank-large-qwen35.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-qwen35.sh [DEST_DIR] [--verify-only]
 set -euo pipefail
 
 REPO="Qwen/Qwen3.5-9B"

old/download-frank-zealot-sglang-int8.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Download MiMo-V2.6-Distill-Qwen-9B-INT8-W8A16-AutoRound for frank-small
+# Download MiMo-V2.6-Distill-Qwen-9B-INT8-W8A16-AutoRound for frank-zealot
 # (SGLang, RTX 3090). Public repo — no auth header on the command line.
 #
 # Per-file FRESH downloads, no resume: `curl -C -` once produced a 213 MB
@@ -7,7 +7,7 @@
 # the house rule.
 #
 # Usage:
-#   scripts/download-frank-small.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-zealot.sh [DEST_DIR] [--verify-only]
 #
 # LFS shards are verified against the Hub LFS sha256; non-LFS text files
 # against their declared byte size. Idempotent: complete files are skipped.

old/scripts/bench-frank-dragoon.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# bench-frank-large.sh — 64k-context benchmark for the frank-default-large stack.
+# bench-frank-dragoon.sh — 64k-context benchmark for the frank-default-large stack.
 #
 # Measures generation throughput of Qwen3.6-27B Q8_K_P + DFlash + ngram-mod on
 # a single backend at 64k context. It starts llama-server on a scratch port,
@@ -7,15 +7,15 @@
 # prompt, and prints tokens/sec.
 #
 # Usage:
-#   ./scripts/bench-frank-large.sh <ROCm0|Vulkan0> [--generations N]
+#   ./scripts/bench-frank-dragoon.sh <ROCm0|Vulkan0> [--generations N]
 #
 # Example:
-#   ./scripts/bench-frank-large.sh ROCm0
-#   ./scripts/bench-frank-large.sh Vulkan0 --generations 3
+#   ./scripts/bench-frank-dragoon.sh ROCm0
+#   ./scripts/bench-frank-dragoon.sh Vulkan0 --generations 3
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-DEVICE="${1:?usage: bench-frank-large.sh <ROCm0|Vulkan0> [--generations N]}"
+DEVICE="${1:?usage: bench-frank-dragoon.sh <ROCm0|Vulkan0> [--generations N]}"
 GENERATIONS=1
 if [ "${2:-}" = "--generations" ]; then
     GENERATIONS="${3:?--generations needs a count}"

old/scripts/deploy.sh

@@ -41,7 +41,7 @@ SERVICE_HEALTH[dankclaw]="http://127.0.0.1:7770/health"
 # Drop page caches before restart: with the model's pages fully cached, the
 # KV/graph allocation stalls at load (VRAM stuck at 28 GiB). See AGENTS.md.
 DROP_CACHES[dankclaw]=1
-# Passwordless restart helper (root-owned, installed via /etc/sudoers.d/frank-large).
+# Passwordless restart helper (root-owned, installed via /etc/sudoers.d/frank-dragoon).
 # When present, deploy.sh uses it instead of inline sudo commands.
 HELPER[dankclaw]="/usr/local/sbin/frank-restart-large.sh"
 # Health wait in iterations of 2s. Cold loads after the cache drop measured

old/scripts/frank-default-large.ling.env

@@ -1,6 +1,6 @@
-# Tunables for the Ling-3.0-flash TRAIL on dankclaw (frank-large-ling).
+# Tunables for the Ling-3.0-flash TRAIL on dankclaw (frank-dragoon-ling).
 # This REPLACES frank-default-large (Qwen3.6-27B) temporarily. To switch
-# back: systemctl stop frank-large-ling && systemctl start frank-default-large.
+# back: systemctl stop frank-dragoon-ling && systemctl start frank-default-large.
 # Runtime: llama.cpp FORK bailingmoe3-support; Vulkan + AMD GTT.
 #
 # Memory model (amdgpu Strix Halo gfx1151, 8x16GB LPDDR5 = 128 GiB physical):

old/scripts/frank-dragoon-ling.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=llama.cpp Ling-3.0-flash Q6_K Vulkan+MTP (frank-large-ling TRIAL)
+Description=llama.cpp Ling-3.0-flash Q6_K Vulkan+MTP (frank-dragoon-ling TRIAL)
 After=network.target
 
 [Service]

old/scripts/serve-ling-flash.sh

@@ -8,7 +8,7 @@
 # Vulkan exposes as an ~111 GiB heap). MTP drafter is bundled in the same
 # GGUF (block 42) - no separate --spec-draft-model needed.
 #
-# Tie-back: to restore the Qwen3.6-27B service, stop frank-large-ling and
+# Tie-back: to restore the Qwen3.6-27B service, stop frank-dragoon-ling and
 # start frank-default-large (its env/unit are committed and unchanged).
 #
 # Tunables come from frank-default-large.ling.env in this directory unless

old/scripts/serve-llama-frank-dragoon.sh

@@ -4,11 +4,11 @@
 # Runtime: llama.cpp llama-server (>= b10411).
 #
 # Tunables come from frank-default-large.env in this directory unless the
-# FRANK_LARGE_ENV_FILE environment variable overrides that path.
+# FRANK_DRAGOON_ENV_FILE environment variable overrides that path.
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-default-large.env}"
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-default-large.env}"
 if [[ -f "$ENV_FILE" ]]; then
     set -a
     # shellcheck disable=SC1090

scripts/.AGENTTRASH/bench-decode-threads-batch.py.strix-rocmfp4

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-Decode throughput benchmark for frank-large.
+Decode throughput benchmark for frank-dragoon.
 Starts the server with a given --threads-batch value, sends an 8K+ token prompt,
 generates 256 tokens, measures generation tok/s.
 
@@ -13,12 +13,12 @@ SERVE = "/home/dank/GitPackages/ROCmFPX/build-qwen38/bin/llama-server"
 PORT = 7770
 N_GEN = 256
 PROMPT_FILE = "/tmp/bench-prompts/prompt_code.txt"
-ENV_FILE = os.path.join(os.path.dirname(__file__), "frank-large.env")
+ENV_FILE = os.path.join(os.path.dirname(__file__), "frank-dragoon.env")
 SERVER_DIR = os.path.dirname(SERVE)
 ROCM_PATH = "/opt/rocm"
 
 def make_env():
-    """Build the same env as serve-frank-large.sh."""
+    """Build the same env as serve-frank-dragoon.sh."""
     env = {**os.environ, "HSA_OVERRIDE_GFX_VERSION": "11.5.1", "HIP_VISIBLE_DEVICES": "0"}
     
     # Source env file for tunables
@@ -59,7 +59,7 @@ def wait_ready():
 def send_request(prompt, max_tokens=N_GEN):
     """Send chat completion, measure generation throughput."""
     body = json.dumps({
-        "model": "frank-large",
+        "model": "frank-dragoon",
         "messages": [{"role": "user", "content": prompt}],
         "max_tokens": max_tokens,
         "stream": False,

scripts/.AGENTTRASH/bench-ngram-mod.py.ik-llama.cpp

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-Benchmark n-gram speculative decoding vs no-spec for frank-large.
+Benchmark n-gram speculative decoding vs no-spec for frank-dragoon.
 
 Tests prompt-processing throughput with 16K token prompts (manageable request size).
 Code-heavy prompt (high n-gram redundancy) vs prose prompt (low redundancy).
@@ -103,7 +103,7 @@ def start_server(port, spec_type):
 def run_test(prompt_text, spec_type, port):
     """Send a request and extract prompt processing metrics."""
     data = json.dumps({
-        "model": "frank-large",
+        "model": "frank-dragoon",
         "messages": [{"role": "user", "content": prompt_text}],
         "max_tokens": TEST_TOKENS,
         "stream": False,
@@ -189,7 +189,7 @@ def main():
         print(f"  Prose: {prose_prompt_file.stat().st_size:,} bytes")
 
     print("=" * 60)
-    print("  N-gram Mod Benchmark — frank-large")
+    print("  N-gram Mod Benchmark — frank-dragoon")
     print(f"  STRIX ROCmFP4 · 64K context · 16K prompts")
     print("=" * 60)
 

scripts/.AGENTTRASH/bench-ngram-mod.sh.ik-llama.cpp

@@ -1,19 +1,19 @@
 #!/usr/bin/env bash
-# Benchmark n-gram speculative decoding vs no-spec for frank-large.
+# Benchmark n-gram speculative decoding vs no-spec for frank-dragoon.
 #
 # This tests prompt-processing throughput at 64k context with two distinct
 # prompts: one code-heavy and one prose-heavy. Uses llama-server on scratch
 # ports with the OpenAI-compatible API to measure prompt_eval_duration_ms.
 #
 # Run on Dankclaw after stopping the production service:
-#   sudo systemctl stop frank-large
+#   sudo systemctl stop frank-dragoon
 #   ./scripts/bench-ngram-mod.sh
-#   sudo systemctl start frank-large
+#   sudo systemctl start frank-dragoon
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-large.env}"
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
 if [[ -f "$ENV_FILE" ]]; then
     set -a; source "$ENV_FILE"; set +a
 fi
@@ -184,7 +184,7 @@ run_single_test() {
     response=$(curl -s -X POST "http://127.0.0.1:$port/v1/completions" \
         -H "Content-Type: application/json" \
         -d "{
-            \"model\": \"frank-large\",
+            \"model\": \"frank-dragoon\",
             \"prompt\": \"$prompt_text\",
             \"max_tokens\": 128,
             \"temperature\": 0,
@@ -220,7 +220,7 @@ run_single_test() {
 }
 
 echo "╔══════════════════════════════════════════════════════════╗"
-echo "║  N-gram Mod Benchmark — frank-large             ║"
+echo "║  N-gram Mod Benchmark — frank-dragoon             ║"
 echo "║  STRIX ROCmFP4 · 64k context · two prompts             ║"
 echo "╚══════════════════════════════════════════════════════════╝"
 echo ""

scripts/.AGENTTRASH/bench-spec-decode.py.ik-llama.cpp

@@ -15,9 +15,9 @@ import time
 import urllib.request
 import urllib.error
 
-SERVICE = "frank-large"
-ENV_FILE = "/home/dank/serverAppConfigs/scripts/frank-large.env"
-ALIAS = "frank-large"
+SERVICE = "frank-dragoon"
+ENV_FILE = "/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
+ALIAS = "frank-dragoon"
 DEFAULT_HOST = "localhost"
 DEFAULT_PORT = 7770
 DEFAULT_MAX_TOKENS = 16384

scripts/.AGENTTRASH/frank-dragoon.env.ik-llama.cpp

@@ -1,4 +1,4 @@
-# Tunables for frank-large (mradermacher i1-Q4_K_M of
+# Tunables for frank-dragoon (mradermacher i1-Q4_K_M of
 # orcarouter/Qwen3.8-Flash-Next-Uncensored on ik_llama.cpp, Dankclaw,
 # RTX 3090 CUDA + Strix Halo CPU path, since 2026-09-15).
 #
@@ -65,7 +65,7 @@ MMPROJ_PATH=/home/dank/models/mradermacher-Qwen3.8-Flash-Next-Uncensored-i1-Q4_K
 CHAT_TEMPLATE_FILE=/home/dank/serverAppConfigs/scripts/chat-template.jinja
 
 # Alias + network.
-ALIAS=frank-large
+ALIAS=frank-dragoon
 BIND_ADDR=0.0.0.0
 LISTEN_PORT=7770
 

scripts/.AGENTTRASH/frank-dragoon.service.ik-llama.cpp

@@ -1,5 +1,5 @@
 [Unit]
-Description=ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M 177B MoE (dankclaw, frank-large)
+Description=ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M 177B MoE (dankclaw, frank-dragoon)
 After=network-online.target
 Wants=network-online.target
 
@@ -12,8 +12,8 @@ Group=dank
 # budget still needs room. Parity with the halogen quadlet's
 # Ulimit=memlock=-1:-1.
 LimitMEMLOCK=infinity
-Environment="FRANK_LARGE_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-large.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-large.sh
+Environment="FRANK_DRAGOON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-dragoon.sh
 Restart=on-failure
 RestartSec=10
 

scripts/.AGENTTRASH/serve-frank-dragoon.sh.ik-llama.cpp

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Serve mradermacher/Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M as frank-large
+# Serve mradermacher/Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M as frank-dragoon
 # via ik_llama.cpp on Dankclaw.
 #
 # Topology (ikawrakow's hybrid recipe; upstream issue #2402 for the PLE):
@@ -26,7 +26,7 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-large.env}"
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
 if [[ -f "$ENV_FILE" ]]; then
     set -a
     # shellcheck disable=SC1090
@@ -66,7 +66,7 @@ fi
 # CPU-overridden weights mmapped (src/llama-load-tensors.cpp); the env file
 # sets it. Refuse to run without it.
 if [[ "${GGML_CUDA_NO_PINNED_WEIGHTS:-}" != "1" ]]; then
-    echo "frank-large: refusing to start — GGML_CUDA_NO_PINNED_WEIGHTS=1 is mandatory on this host" >&2
+    echo "frank-dragoon: refusing to start — GGML_CUDA_NO_PINNED_WEIGHTS=1 is mandatory on this host" >&2
     exit 1
 fi
 

scripts/.AGENTTRASH/serve-frank-medium.sh.rocmfpx

@@ -112,7 +112,7 @@ fi
 : "${SPEC_DRAFT_POLL_BATCH:=1}"
 
 # Text only: the server must not try to autoload the vision tower.  Vision
-# stays on frank-large (Dankclaw), which is where the fleet routes images.
+# stays on frank-dragoon (Dankclaw), which is where the fleet routes images.
 NO_MMPROJ="${NO_MMPROJ:-1}"
 
 export HIP_VISIBLE_DEVICES

scripts/apply-protected-cast.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# apply-protected-cast.sh — RUNS ON DANKSERVER. Rewrite the recipe's
+# PROTECTED-BEGIN/END section from Swift's OWN calibration grams: run
+# derive-protected-experts.py over the calib dir, splice its cast lines into
+# the marked section of the recipe in place, keep the pre-edit recipe in the
+# campaign trash. Refuses to run twice (marker text says derived).
+set -euo pipefail
+CALIB=${1:-/home/dank/corpora/calib}
+RECIPE=${2:-/home/dank/serverAppConfigs-swift15/scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe}
+PY=/home/dank/venvs/radcorpus/bin/python
+DERIVE=/home/dank/serverAppConfigs-swift15/scripts/derive-protected-experts.py
+TS=$(date +%Y%m%d-%H%M%S)
+
+grep -q "derive-protected-experts.py rewrote" "$RECIPE" && {
+    echo "recipe already carries derived cast lines; refusing to re-derive" >&2; exit 1; }
+grep -q "PROTECTED-BEGIN" "$RECIPE" || { echo "no PROTECTED markers in $RECIPE" >&2; exit 1; }
+
+"$PY" "$DERIVE" "$CALIB" > "/tmp/protected-cast-$TS.txt"
+N=$(grep -c 'cast dtype=bf16' "/tmp/protected-cast-$TS.txt")
+[ "$N" -ge 2 ] || { echo "derive produced $N cast lines; refusing" >&2; exit 1; }
+echo "derived $N protected experts -> /tmp/protected-cast-$TS.txt"
+
+cp -f "$RECIPE" "/home/dank/.AGENTTRASH/$TS-qwen4exp-swift15-w4dn8-i8-hc8m.recipe"
+"$PY" - "$RECIPE" "/tmp/protected-cast-$TS.txt" <<'PYEOF'
+import sys
+recipe, castfile = sys.argv[1], sys.argv[2]
+lines = open(recipe).read().splitlines()
+cast = [l for l in open(castfile).read().splitlines() if 'cast dtype=bf16' in l]
+out, insec = [], False
+for l in lines:
+    if 'PROTECTED-BEGIN' in l:
+        insec = True
+        out.append(l)
+        out.extend(cast)
+    elif 'PROTECTED-END' in l:
+        insec = False
+        out.append(l)
+        out.append('# (derive-protected-experts.py rewrote this section from Swift\'s own grams)')
+    elif not insec:
+        out.append(l)
+open(recipe, 'w').write('\n'.join(out) + '\n')
+print(f'spliced {len(cast)} cast lines into {recipe}')
+PYEOF

scripts/autoresearch-bench.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""autoresearch-bench.py — deterministic greedy battery for frank-large.
+"""autoresearch-bench.py — deterministic greedy battery for frank-dragoon.
 
 Runs ON Dankclaw (no LAN jitter) against the candidate container on :7770.
 Fixed embedded corpus, temperature 0, streaming so decode speed is measured
@@ -104,7 +104,7 @@ def stream_completion(url: str, model: str, prompt: str):
 def main():
     ap = argparse.ArgumentParser()
     ap.add_argument("--url", default="http://127.0.0.1:7770")
-    ap.add_argument("--model", default="frank-large")
+    ap.add_argument("--model", default="frank-dragoon")
     args = ap.parse_args()
 
     with urllib.request.urlopen(args.url.rstrip("/") + "/v1/models",

scripts/autoresearch-frank-archon.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# autoresearch-frank-archon.sh — RUNS ON DANKSERVER, driven over ssh by the
+# dev-box autoresearch.sh. It is the canonical frank-archon benchmark entry
+# point for the autoresearch loop.
+#
+# Method (mandated by the Benchmarking Policy): the production service serves
+# real users and shares the two R9700s, so a bench beside it starves the GPUs
+# and corrupts results. This script therefore:
+#   1. stops the production frank-archon unit (root, relink symlink: stop,
+#      NOT mask — mask refuses to replace a symlinked unit file),
+#   2. boots a scratch radiance container named `arbench` on the SAME two
+#      cards with the candidate engine argv (the env file the loop edits),
+#   3. polls /health until the listener is live (it binds AFTER the full
+#      load, so a bare curl is an honest gate),
+#   4. runs ONE self-contained completion request locally (127.0.0.1, no LAN
+#      jitter): a fixed ~140k-char real-text prompt (~32k tokens) decoded for
+#      256 tokens, greedy. The engine's `timings` object reports the honest
+#      prefill and decode rates for that single request.
+#   5. prints METRIC lines and tears the scratch down,
+#   6. restores production (systemctl start), via a trap so a failed bench
+#      never leaves frank-archon down (the stale-probe-tail lesson).
+#
+# Determinism: the prompt is built from a fixed, sorted corpus of repo files
+# with a fixed random seed, so prompt_n is stable across runs. Sampling is
+# greedy (temperature 0), so the decode length is fixed; the only residual
+# nondeterminism is the wht6 lossy TP all-reduce, which is a constant across
+# runs and cancels in A/B comparisons.
+#
+# The scratch mirrors the production container contract exactly (serve-frank-
+# primary.sh): --network host, --init, seccomp=unconfined (io_uring for the
+# n-gram table), memlock unbounded (the ~132 GiB pinned ledger), /dev/kfd +
+# /dev/dri, the .rad ro, the state dir rw, the tune cache mount. The ONLY
+# differences: the container name (arbench, so prod's identity is untouched)
+# and a FRESH prefix-cache disk tier (arbench/, wiped per run) so the cold
+# prefill is cold — the prod tier at kvcache/frank-archon is left intact.
+set -uo pipefail
+
+ENV_FILE="${1:-/home/dank/serverAppConfigs/scripts/frank-archon.env}"
+SCRATCH=arbench
+PORT=7770
+HEALTH="http://127.0.0.1:$PORT/health"
+COMPLETE="http://127.0.0.1:$PORT/v1/completions"
+BODY=/tmp/arbench-body.json
+LOG=/home/dank/logs/arbench.log
+
+restore() {
+  podman rm -f "$SCRATCH" >/dev/null 2>&1 || true
+  sudo systemctl start frank-archon >/dev/null 2>&1 || true
+}
+trap restore EXIT
+
+# --- source the candidate config (same file the production unit reads) ------
+if [ ! -f "$ENV_FILE" ]; then
+  echo "no env file at $ENV_FILE" >&2; exit 1
+fi
+# shellcheck disable=SC1090
+set -a; . "$ENV_FILE"; set +a
+
+# --- stop production; the scratch needs both cards to itself ----------------
+sudo systemctl stop frank-archon >/dev/null 2>&1 || true
+podman rm -f "$SCRATCH" >/dev/null 2>&1 || true
+
+# --- fresh prefix-cache tier for a cold prefill (prod's tier untouched) ------
+FRESH_KV="$FRANK_ARCHON_STATE_DIR/kvcache/$SCRATCH"
+rm -rf "$FRESH_KV"; mkdir -p "$FRESH_KV"
+mkdir -p "$FRANK_ARCHON_STATE_DIR/tune"
+
+# --- boot the scratch: the production run line, scratch name + fresh KV ------
+podman run -d --name "$SCRATCH" \
+  --network host \
+  --init \
+  --security-opt seccomp=unconfined \
+  --ulimit memlock=-1:-1 \
+  --device /dev/kfd --device /dev/dri \
+  -v "$FRANK_ARCHON_MODEL_DIR":/models:ro \
+  -v "$FRANK_ARCHON_STATE_DIR":/data \
+  -v "$FRANK_ARCHON_STATE_DIR/tune":/opt/radiance/share/radiance/tune \
+  -v "$FRANK_ARCHON_TEMPLATE":/templates/template.jinja:ro \
+  "$FRANK_ARCHON_IMAGE" \
+  --model "/models/$FRANK_ARCHON_MODEL_FILE" \
+  --host :: --port "$PORT" \
+  --served-model-name "$FRANK_ARCHON_SERVED_NAME" \
+  --override-chat-template /templates/template.jinja \
+  --tp "$FRANK_ARCHON_TP" --tp-wire "$FRANK_ARCHON_TP_WIRE" \
+  --max-num-seqs "$FRANK_ARCHON_MAX_SEQS" \
+  --max-model-len "$FRANK_ARCHON_MAX_MODEL_LEN" \
+  --placement "$FRANK_ARCHON_PLACEMENT" \
+  --host-pool-mib "$FRANK_ARCHON_HOST_POOL_MIB" \
+  --gpu-headroom-mib "$FRANK_ARCHON_GPU_HEADROOM_MIB" \
+  --vram-weights-mib "$FRANK_ARCHON_VRAM_WEIGHTS_MIB" \
+  --vram-kv-mib "$FRANK_ARCHON_VRAM_KV_MIB" \
+  --kv-cache-dtype "$FRANK_ARCHON_KV_DTYPE" \
+  --prefix-cache-host-mib "$FRANK_ARCHON_PREFIX_HOST_MIB" \
+  --prefix-cache-dir "/data/kvcache/$SCRATCH" \
+  --prefix-cache-disk-mib "$FRANK_ARCHON_PREFIX_DISK_MIB" \
+  --ngram-placement "$FRANK_ARCHON_NGRAM_PLACEMENT" \
+  --num-speculative-tokens "$FRANK_ARCHON_SPEC_TOKENS" \
+  --max-num-batched-tokens "$FRANK_ARCHON_MAX_BATCHED_TOKENS" \
+  ${FRANK_ARCHON_EXTRA_ARGS:+$FRANK_ARCHON_EXTRA_ARGS} \
+  > "$LOG" 2>&1
+if [ $? -ne 0 ]; then echo "scratch boot failed; see $LOG" >&2; exit 1; fi
+
+# --- poll health (listener binds after the full load; cold boot ~110 s) ------
+ok=0
+for _ in $(seq 1 360); do
+  code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 3 "$HEALTH" 2>/dev/null || echo 000)
+  if [ "$code" = "200" ]; then ok=1; break; fi
+  sleep 2
+done
+if [ "$ok" -ne 1 ]; then
+  echo "scratch never reached health 200; tail of $LOG:" >&2
+  tail -30 "$LOG" >&2; exit 1
+fi
+
+# --- build the workload: a fixed ~140k-char real-text prompt (repo corpus) ---
+python3 - "$BODY" <<'PY'
+import json, sys, random, glob
+random.seed(1234)
+root = "/home/dank/serverAppConfigs"
+files = sorted(
+    glob.glob(f"{root}/serverAppConfigs-docs/**/*.md", recursive=True)
+    + glob.glob(f"{root}/scripts/*.sh")
+    + glob.glob(f"{root}/scripts/*.py")
+    + glob.glob(f"{root}/AGENTS.md")
+)
+corpus = []
+total = 0
+for f in files:
+    try:
+        t = open(f, encoding="utf-8", errors="ignore").read()
+    except Exception:
+        continue
+    if not t.strip():
+        continue
+    corpus.append(t)
+    total += len(t)
+    if total > 240000:
+        break
+corpus = "\n".join(corpus)
+TGT = 140000
+parts, n = [], 0
+while n < TGT:
+    start = random.randint(0, max(0, len(corpus) - 500))
+    seg = corpus[start:start + random.randint(200, 500)]
+    parts.append(seg)
+    n += len(seg) + 1
+prompt = " ".join(parts)
+json.dump(
+    {"model": "frank-archon", "prompt": prompt,
+     "max_tokens": 256, "temperature": 0.0, "stream": False,
+     "stop": ["<|im_end|>"]},
+    open(sys.argv[1], "w"),
+)
+PY
+if [ ! -f "$BODY" ]; then echo "prompt build failed" >&2; exit 1; fi
+
+# --- the bench request (prefill ~32k + decode 256, greedy) -------------------
+RESP=$(curl -s --max-time 600 -X POST "$COMPLETE" \
+  -H 'Content-Type: application/json' -d "@$BODY")
+echo "$RESP" > /tmp/arbench-resp.json
+
+# --- parse the timings into METRIC lines -------------------------------------
+python3 - <<'PY'
+import json, sys
+try:
+    r = json.load(open("/tmp/arbench-resp.json"))
+except Exception as e:
+    sys.stderr.write(f"unparseable response: {e}\n"); sys.exit(1)
+if "timings" not in r:
+    sys.stderr.write(f"no timings in response: {json.dumps(r)[:500]}\n"); sys.exit(1)
+t = r["timings"]
+dtps = t.get("predicted_per_second")
+ptps = t.get("prompt_per_second")
+pms  = t.get("prompt_ms")
+dn   = t.get("draft_n", 0)
+da   = t.get("draft_n_accepted", 0)
+if dtps is None:
+    sys.stderr.write("predicted_per_second null (no decode produced)\n"); sys.exit(1)
+print(f"METRIC decode_tps={dtps:.4f}")
+if ptps is not None:
+    print(f"METRIC prefill_tps={ptps:.4f}")
+if pms is not None:
+    print(f"METRIC ttft_ms={pms:.4f}")
+if dn:
+    print(f"METRIC draft_accept={da/dn:.4f}")
+print(f"INFO prompt_n={t.get('prompt_n')} cache_n={t.get('cache_n')} predicted_n={t.get('predicted_n')}")
+PY

scripts/autoresearch/frank-archon-arms.sh

@@ -1,19 +1,19 @@
 #!/usr/bin/env bash
-# frank-primary-arms.sh — run a SEQUENCE of frank-primary bench arms and keep
+# frank-archon-arms.sh — run a SEQUENCE of frank-archon bench arms and keep
 # every arm's evidence. Runs on the operator box; each arm is one full window
 # of ./autoresearch.sh (stop+mask -> boot the arm as the service -> measure ->
 # restore production and verify), so the fleet is only ever down for one arm at
 # a time and the production unit is back up between arms.
 #
-# An arm is the repo's own frank-primary.env plus an OVERLAY of engine knobs
+# An arm is the repo's own frank-archon.env plus an OVERLAY of engine knobs
 # appended after it (later assignment wins when the serve script sources it),
-# staged through FRANK_PRIMARY_AR_ENV_FILE so the checkout is never mutated and
+# staged through FRANK_ARCHON_AR_ENV_FILE so the checkout is never mutated and
 # each arm gets its own fingerprint (the memo can never answer one arm with
 # another arm's numbers).
 #
-# Usage:  scripts/autoresearch/frank-primary-arms.sh [arm ...]
-#         scripts/autoresearch/frank-primary-arms.sh --list
-# Output, under /tmp/frank-primary-arms-<UTC stamp>/ (override with ARMS_DIR):
+# Usage:  scripts/autoresearch/frank-archon-arms.sh [arm ...]
+#         scripts/autoresearch/frank-archon-arms.sh --list
+# Output, under /tmp/frank-archon-arms-<UTC stamp>/ (override with ARMS_DIR):
 #
 #   <arm>.out        full autoresearch output (metrics + engine evidence)
 #   <arm>.env        the exact staged env
@@ -26,8 +26,8 @@ set -uo pipefail
 
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 REPO="$(cd -- "$SCRIPT_DIR/../.." && pwd)"
-BASE_ENV="$REPO/scripts/frank-primary.env"
-ARMS_DIR="${ARMS_DIR:-/tmp/frank-primary-arms-$(date -u +%Y%m%dT%H%M%SZ)}"
+BASE_ENV="$REPO/scripts/frank-archon.env"
+ARMS_DIR="${ARMS_DIR:-/tmp/frank-archon-arms-$(date -u +%Y%m%dT%H%M%SZ)}"
 
 # --- arms ------------------------------------------------------------------
 # baseline: the shipped shape E, measured with THIS harness so the comparison is
@@ -45,18 +45,18 @@ LADDER3='{"cudagraph_capture_sizes":[4,8,12],"max_cudagraph_capture_size":12,"in
 # the engine as {temperature:0.7}.
 GEN07='{"temperature":0.7}'
 OVER_B=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER3'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER3'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
 )
 # B2: identical to B with the default (7.60 GiB) overhead, i.e. precise memory
 # OFF. It is the fallback if B dies at graph capture, and it prices the arena
 # that precise memory buys (7,522 slots -> ~6,496).
 OVER_B2=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER3'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
-    'FRANK_PRIMARY_PRECISE_MEMORY='
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER3'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
+    'FRANK_ARCHON_PRECISE_MEMORY='
 )
 # C: the vendor's concurrency shape — SEQS 16 with the [4..32] ladder and util
 # 0.95. This is also the direct test of the theory that pinning the capture
@@ -64,12 +64,12 @@ OVER_B2=(
 # the constant 3, which is NOT in the default ladder; 4 is).
 LADDER16='{"cudagraph_capture_sizes":[4,8,12,16,20,24,28,32],"max_cudagraph_capture_size":32,"inductor_compile_config":{"combo_kernels":false,"benchmark_combo_kernel":false}}'
 OVER_C=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER16'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
-    'FRANK_PRIMARY_SEQS=16'
-    'FRANK_PRIMARY_MNBT=4096'
-    'FRANK_PRIMARY_UTIL=0.95'
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER16'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
+    'FRANK_ARCHON_SEQS=16'
+    'FRANK_ARCHON_MNBT=4096'
+    'FRANK_ARCHON_UTIL=0.95'
 )
 
 # D/E: the CONTEXT arms. Measured 2026-10-02 (arms run 20261002T233855Z): the
@@ -83,11 +83,11 @@ OVER_C=(
 # D is arm B with EXACTLY ONE variable changed (the KV bytes), so its result
 # says whether the 4k-depth collapse (B 23.09 vs baseline 33.99) was KV or the
 # batch shape.
-KV401K='FRANK_PRIMARY_KV_BYTES=4050000000'
+KV401K='FRANK_ARCHON_KV_BYTES=4050000000'
 OVER_D=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER3'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER3'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
     "$KV401K"
 )
 # E: D with C's max_num_batched_tokens (4096 — C is the only arm that did NOT
@@ -97,12 +97,12 @@ OVER_D=(
 # only 0.32 GiB above the allowance while the CUDA-graph cost is an ANALYTIC
 # estimate (C's was 1.47 GiB over 24 graphs), so it is measured, not assumed.
 OVER_E=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER3'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER3'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
     "$KV401K"
-    'FRANK_PRIMARY_MNBT=4096'
-    'FRANK_PRIMARY_UTIL=0.99'
+    'FRANK_ARCHON_MNBT=4096'
+    'FRANK_ARCHON_UTIL=0.99'
 )
 
 arm_overlay() {
@@ -142,7 +142,7 @@ for arm in "${ARMS[@]}"; do
     # holds JSON must still be one valid JSON object after the file is SOURCED
     # (that is the step that silently eats unquoted braces).
     if ! bash -c 'set -a; . "$1" >/dev/null; set +a
-        for k in FRANK_PRIMARY_SPEC FRANK_PRIMARY_COMPCONFIG FRANK_PRIMARY_GEN_CONFIG; do
+        for k in FRANK_ARCHON_SPEC FRANK_ARCHON_COMPCONFIG FRANK_ARCHON_GEN_CONFIG; do
             v="${!k:-}"
             [ -n "$v" ] || continue
             case "$v" in
@@ -158,7 +158,7 @@ for arm in "${ARMS[@]}"; do
     fi
 
     echo "[arms] === $arm: opening window $(date -u +%H:%M:%S)Z ===" >&2
-    FRANK_PRIMARY_AR_ENV_FILE="$ARMS_DIR/$arm.env" \
+    FRANK_ARCHON_AR_ENV_FILE="$ARMS_DIR/$arm.env" \
         "$REPO/autoresearch.sh" >"$ARMS_DIR/$arm.out" 2>&1
     rc=$?
     echo "$rc" >"$ARMS_DIR/$arm.rc"

scripts/autoresearch/frank-archon-measure.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""frank-primary decode measurement — runs INSIDE the engine container.
+"""frank-archon decode measurement — runs INSIDE the engine container.
 
 The method is the fleet's established one (the 2026-09-29 / 2026-10-01
 tuning campaigns, /home/dank/mtp_measure.py): SSE chunk counting is invalid
@@ -28,7 +28,7 @@ Workload (fixed, deterministic, offline):
 
 Env:
   AR_BASE             endpoint (default http://127.0.0.1:7770)
-  AR_MODEL            served name (default frank-primary)
+  AR_MODEL            served name (default frank-archon)
   AR_PROMPT_CEILING   hard prompt ceiling in tokens (default 100000)
   AR_TEMPS            comma-separated sampling temperatures (default "0,0.7")
 
@@ -45,7 +45,7 @@ import urllib.error
 import urllib.request
 
 BASE = os.environ.get("AR_BASE", "http://127.0.0.1:7770")
-MODEL = os.environ.get("AR_MODEL", "frank-primary")
+MODEL = os.environ.get("AR_MODEL", "frank-archon")
 PROMPT_CEILING = int(os.environ.get("AR_PROMPT_CEILING", "100000"))
 DEPTHS = (115, 1056, 4096)
 WARM_TOKENS = 64

scripts/autoresearch/frank-archon-window.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# frank-primary-window.sh — one full bench window for frank-primary, run ON
+# frank-archon-window.sh — one full bench window for frank-archon, run ON
 # DANKSERVER as the deploy user (invoked over ssh by ./autoresearch.sh).
 #
 # Discipline (AGENTS.md Benchmarking Policy): the production unit is
@@ -12,9 +12,9 @@
 #
 # Staging layout (created by the orchestrator, ephemeral — never a config
 # source; the repo checkout is):
-#   /home/dank/.autoresearch-frank-primary/
+#   /home/dank/.autoresearch-frank-archon/
 #     serve.sh             staged candidate serve script
-#     frank-primary.env    staged candidate env (the candidate knobs)
+#     frank-archon.env    staged candidate env (the candidate knobs)
 #     measure.py           the in-container measure client
 #     hash                 candidate fingerprint
 #     run.json             result (metrics + boot + kv + fingerprint)
@@ -27,16 +27,16 @@
 # outcome; a failed restore forces exit 1).
 set -uo pipefail
 
-STAGE="${FRANK_PRIMARY_AR_STAGE:-/home/dank/.autoresearch-frank-primary}"
-UNIT="${FRANK_PRIMARY_AR_UNIT:-frank-primary}"
-CTR="${FRANK_PRIMARY_AR_CTR:-frank-primary-qwen}"
+STAGE="${FRANK_ARCHON_AR_STAGE:-/home/dank/.autoresearch-frank-archon}"
+UNIT="${FRANK_ARCHON_AR_UNIT:-frank-archon}"
+CTR="${FRANK_ARCHON_AR_CTR:-frank-archon-qwen}"
 HEALTH_URL="http://127.0.0.1:7770/health"
 MODELS_URL="http://127.0.0.1:7770/v1/models"
-BOOT_TIMEOUT="${FRANK_PRIMARY_AR_BOOT_TIMEOUT:-1200}"
-RESTORE_TIMEOUT="${FRANK_PRIMARY_AR_RESTORE_TIMEOUT:-1200}"
-MEASURE_TIMEOUT="${FRANK_PRIMARY_AR_MEASURE_TIMEOUT:-1800}"
-SERVED="$(sed -n 's/^FRANK_PRIMARY_SERVED_NAME=//p' "$STAGE/frank-primary.env" 2>/dev/null | head -1)"
-SERVED="${SERVED:-frank-primary}"
+BOOT_TIMEOUT="${FRANK_ARCHON_AR_BOOT_TIMEOUT:-1200}"
+RESTORE_TIMEOUT="${FRANK_ARCHON_AR_RESTORE_TIMEOUT:-1200}"
+MEASURE_TIMEOUT="${FRANK_ARCHON_AR_MEASURE_TIMEOUT:-1800}"
+SERVED="$(sed -n 's/^FRANK_ARCHON_SERVED_NAME=//p' "$STAGE/frank-archon.env" 2>/dev/null | head -1)"
+SERVED="${SERVED:-frank-archon}"
 
 RESTORED=0
 
@@ -72,7 +72,7 @@ capture_bench_failure() {
         echo "=== staged serve.out (tail 60) ==="
         tail -60 "$STAGE/serve.out" 2>/dev/null || true
         echo "=== engine log (tail 60) ==="
-        tail -60 /home/dank/logs/frank_primary.log 2>/dev/null || true
+        tail -60 /home/dank/logs/frank_archon.log 2>/dev/null || true
     } >"$STAGE/fail.log" 2>&1 || true
     grep -E 'OutOfMemory|Tried to allocate|Engine core initialization failed|Error|error' \
         "$STAGE/fail.log" 2>/dev/null | tail -25 >&2 || true
@@ -114,7 +114,7 @@ trap 'restore; rc=$?; [ "$rc" -ne 0 ] && exit 1' EXIT
 
 main() {
     local f
-    for f in serve.sh frank-primary.env measure.py hash; do
+    for f in serve.sh frank-archon.env measure.py hash; do
         [ -f "$STAGE/$f" ] || { log "staged file missing: $STAGE/$f"; exit 1; }
     done
     mkdir -p "$STAGE/last"
@@ -133,7 +133,7 @@ main() {
 
     t0="$(date +%s)"
     log "starting bench instance from staged config (fingerprint $(tr -d '[:space:]' <"$STAGE/hash"))"
-    FRANK_PRIMARY_ENV_FILE="$STAGE/frank-primary.env" \
+    FRANK_ARCHON_ENV_FILE="$STAGE/frank-archon.env" \
         setsid nohup bash "$STAGE/serve.sh" >"$STAGE/serve.out" 2>&1 </dev/null &
     echo "$!" >"$STAGE/serve.pid"
 

scripts/bench-decode.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Decode throughput benchmark for frank-large.
+# Decode throughput benchmark for frank-dragoon.
 # Measures generation tok/s with 8K+ token prompts and 256 generated tokens.
 set -euo pipefail
 
@@ -57,7 +57,7 @@ run_bench() {
     # Warmup (small request)
     curl -s -m 60 http://127.0.0.1:$PORT/v1/chat/completions \
         -H "Content-Type: application/json" \
-        -d '{"model":"frank-large","messages":[{"role":"user","content":"Hi"}],"max_tokens":16,"stream":false}' > /dev/null 2>&1 || true
+        -d '{"model":"frank-dragoon","messages":[{"role":"user","content":"Hi"}],"max_tokens":16,"stream":false}' > /dev/null 2>&1 || true
     
     # Build 8K prompt
     local prompt
@@ -75,7 +75,7 @@ print(json.dumps(' '.join(words)))
     t0=$(date +%s%N)
     resp=$(curl -s -m 600 http://127.0.0.1:$PORT/v1/chat/completions \
         -H "Content-Type: application/json" \
-        -d "{\"model\":\"frank-large\",\"messages\":[{\"role\":\"user\",\"content\":$prompt}],\"max_tokens\":$N_GEN,\"stream\":false}" 2>&1)
+        -d "{\"model\":\"frank-dragoon\",\"messages\":[{\"role\":\"user\",\"content\":$prompt}],\"max_tokens\":$N_GEN,\"stream\":false}" 2>&1)
     t1=$(date +%s%N)
     
     if ! echo "$resp" | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then

scripts/bench-probe.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""bench-probe.py — RUNS ON DANKSERVER. The campaign's decode probe: one
+/completion request, a prompt assembled from calib.jsonl to ~TARGET tokens,
+temperature 0, max_tokens 512. Reports the engine's own timings: decode rate,
+prefill rate, draft accept. Run 3x; the median is the arm's number."""
+import json, sys, urllib.request
+
+TARGET = 43600  # tokens
+BYTES_PER_TOK = 3.8
+URL = "http://localhost:7770/v1/completions"
+
+def build_prompt():
+    want = int(TARGET * BYTES_PER_TOK)
+    parts = []
+    n = 0
+    with open("/home/dank/corpora/out/calib.jsonl") as f:
+        for line in f:
+            d = json.loads(line)
+            p = d.get("prompt") or d.get("messages", [{}])[0].get("content", "")
+            parts.append(p)
+            n += len(p.encode())
+            if n >= want:
+                break
+    return "".join(parts)
+
+def probe(salt):
+    prompt = f"[probe {salt}]\n" + build_prompt()
+    body = json.dumps({
+        "model": "frank-archon",
+        "prompt": prompt, "temperature": 0.0, "max_tokens": 512,
+    }).encode()
+    req = urllib.request.Request(URL, data=body,
+        headers={"Content-Type": "application/json"})
+    with urllib.request.urlopen(req, timeout=1800) as r:
+        d = json.load(r)
+    t = d.get("timings", {})
+    return {
+        "prompt_n": t.get("prompt_n"),
+        "prefill_tps": round(t.get("prompt_per_second", 0), 1),
+        "pred_n": t.get("predicted_n"),
+        "decode_tps": round(t.get("predicted_per_second", 0), 2),
+        "draft_n": t.get("draft_n"),
+        "accept": (round(t["draft_n_accepted"] / t["draft_n"], 4)
+                   if t.get("draft_n") else None),
+    }
+
+if __name__ == "__main__":
+    print(json.dumps(probe(sys.argv[1] if len(sys.argv) > 1 else "a")))

scripts/bench-threads-batch-http.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-HTTP-based prefill-throughput sweep for frank-large.
+HTTP-based prefill-throughput sweep for frank-dragoon.
 Starts the server with a given --threads-batch value, sends a 64K-prompt via
 the chat API (max_tokens=0), measures prompt_tokens/wall_time.
 
@@ -39,7 +39,7 @@ def send_prefill_request():
     with open(PROMPT_FILE, "r") as f:
         prompt = f.read()
     body = json.dumps({
-        "model": "frank-large",
+        "model": "frank-dragoon",
         "messages": [{"role": "user", "content": prompt}],
         "max_tokens": 1,
         "stream": False

scripts/bench-threads-batch.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Threads-batch sweep for frank-large on dankclaw
+# Threads-batch sweep for frank-dragoon on dankclaw
 # Benches prefill throughput at 65536 prompt tokens across threads-batch values.
 set -uo pipefail
 
@@ -10,7 +10,7 @@ TB_LIST=(16 32 48 64 80 96 128)
 ENV_FILE="/home/dank/GitPackages/ROCmFPX/build-qwen38/bin"
 
 echo "========================================"
-echo "THREADS-BATCH SWEEP — frank-large"
+echo "THREADS-BATCH SWEEP — frank-dragoon"
 echo "Model: $(basename "$MODEL") ($(du -h "$MODEL" | cut -f1))"
 echo "Threads-batch values: ${TB_LIST[*]}"
 echo "Prompt: 65536 tokens, n-gen: 0 (prefill-only)"

scripts/bench-ubatch.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# Benchmark ubatch with llama-bench for frank-large.
+# Benchmark ubatch with llama-bench for frank-dragoon.
 #
 # This is intentionally a ubatch-only benchmark. It uses one llama-bench
 # process, an 8K prompt workload, and equal batch/ubatch values. No server
 # process, HTTP requests, or log scraping are used.
 #
-# Run on Dankclaw after stopping frank-large:
-#   sudo systemctl stop frank-large
+# Run on Dankclaw after stopping frank-dragoon:
+#   sudo systemctl stop frank-dragoon
 #   ./scripts/bench-ubatch.sh
-#   sudo systemctl start frank-large
+#   sudo systemctl start frank-dragoon
 set -euo pipefail
 
 : "${LLAMA_BENCH:=/home/dank/GitPackages/ROCmFPX/build-strix-rocmfp4/bin/llama-bench}"

scripts/build-frank-archon-rad.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# build-frank-archon-rad.sh — build frank-archon's .rad container from the
+# OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 checkpoint, at NATIVE precision.
+#
+#   bash scripts/build-frank-archon-rad.sh                # convert
+#   bash scripts/build-frank-archon-rad.sh --plan-only    # declare, no I/O
+#   bash scripts/build-frank-archon-rad.sh --restage      # redo staging
+#   bash scripts/build-frank-archon-rad.sh --force        # rebuild existing
+#
+# WHY A STAGING DIR (the one non-obvious step): rad-convert selects its
+# architecture plugin by the checkpoint's quantisation DESCRIPTOR —
+# derived from config.json's quantization_config (core/format/checkpoint.cpp:
+# "fp8" here). No shipped plugin claims (qwen4exp, "fp8"): the shipped
+# qwen4exp plugin claims (qwen4exp, ""), the descriptor recipe-built
+# containers carry (they are built from the bf16 upstream, which has no
+# quantization_config at all). The match is exact with no fallback, so an
+# unmodified convert refuses before declare. The descriptor is only a
+# selection key; per-weight encodings are data — the checkpoint reader
+# derives them from the tensors themselves (X.weight_scale_inv is the
+# scale plane; checkpoint.h). Staging drops the quantization_config key
+# (everything else is a relative symlink into the pristine download) so
+# the convert selects the shipped plugin. EVERY weight is then copied through
+# in its own encoding — block-FP8 codes + bf16 scale planes stay block-FP8 —
+# except TWO value-preserving reshapes that stack-qwen38-official-fp8.py
+# performs on the staging dir first, and ONE recipe rule that finishes the
+# PLE table:
+#   * experts: the plugin maps the STACKED layout (mlp.experts.gate_up_proj
+#     [E,2F,H] with the _scale_inv plane at the same index) while the official
+#     repo ships per-expert unfused tensors — staging byte-stacks them
+#     (gate rows first, no requantisation).
+#   * PLE: the plugin's fp8 branch wants the table codes beside a ONE-ELEMENT
+#     bf16 scale plane; the official repo ships 128 SCALELESS fp8 shards plus
+#     one bf16 scalar. Staging decodes to bf16 with the checkpoint's own
+#     scale, and the convert's rtn rule re-encodes at that same scale —
+#     every original code is restored exactly and the scale plane lands in
+#     the form the plugin declares.
+#
+# WHY A CONTAINER AT ALL: a checkpoint dir has no mapped/file tiers, and a
+# weight only a host kernel reads (the n-gram / PLE table, 51B params)
+# cannot be served from one (GUIDE §3.4). rad-convert also bakes the
+# tokenizer and the checkpoint's chat template; the runtime replaces the
+# template with froggeric's (--override-chat-template).
+#
+# The convert runs rad-convert inside the digest-pinned radiance image
+# (the host has no ROCm and needs none): /home/dank/models is mounted at
+# /models so the staging dir's RELATIVE symlinks resolve inside the
+# container. Output lands beside the raw download, owned by dank
+# (rootless podman maps container-root to the invoking user).
+set -euo pipefail
+
+SRC="/home/dank/models/Qwen/Qwen3.8-Flash-Next-FP8"
+STAGE="/home/dank/models/stage-qwen4exp-fp8"
+OUT_DIR="/home/dank/models/rad"
+OUT="$OUT_DIR/qwen4exp-fp8-native.rad"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/frank-archon.env"
+IMAGE="$FRANK_ARCHON_IMAGE"
+
+plan_only=0 restage=0 force=0
+for a in "$@"; do
+    case "$a" in
+        --plan-only) plan_only=1 ;;
+        --restage)   restage=1 ;;
+        --force)     force=1 ;;
+        *) echo "unknown flag: $a" >&2; exit 2 ;;
+    esac
+done
+
+if [ ! -f "$SRC/config.json" ]; then
+    echo "ERROR: raw checkpoint missing: $SRC (run scripts/download-frank-archon.sh --fetch)" >&2
+    exit 1
+fi
+echo "verifying raw checkpoint first..."
+bash "$SCRIPT_DIR/download-frank-archon.sh"
+
+if [ -f "$OUT" ] && [ "$plan_only" -eq 0 ] && [ "$force" -eq 0 ]; then
+    echo "container already exists: $OUT"
+    echo "rebuild it with --force (the old file moves to ~/.AGENTTRASH)"
+    exit 0
+fi
+
+# ---- staging ----------------------------------------------------------------
+if [ "$restage" -eq 1 ] && [ -e "$STAGE" ]; then
+    TRASH="$HOME/.AGENTTRASH/$(date +%Y%m%d)-frank-archon-stage"
+    mkdir -p "$TRASH"
+    mv "$STAGE" "$TRASH/stage-$(date +%H%M%S)"
+    echo "old staging dir moved to $TRASH"
+fi
+if [ ! -f "$STAGE/config.json" ]; then
+    mkdir -p "$STAGE"
+    python3 - "$SRC/config.json" "$STAGE/config.json" <<'PY'
+import json, sys
+src, dst = sys.argv[1], sys.argv[2]
+cfg = json.load(open(src))
+dropped = cfg.pop("quantization_config", None)
+json.dump(cfg, open(dst, "w"), indent=2)
+print(f"staging config.json written (quantization_config dropped: {dropped is not None})")
+PY
+    # The index is COPIED like config.json, never symlinked: the reshape step
+    # rewrites the stage's index, and a symlink would write through to the
+    # raw checkpoint (measured 2026-10-05: the raw index was restamped with
+    # the stacked layout and the raw verify failed 143/144). Shards stay
+    # relative symlinks — relative so the targets resolve inside the convert
+    # container (the stage's parent is mounted at /models).
+    for f in "$SRC"/*; do
+        name="$(basename "$f")"
+        case "$name" in config.json|model.safetensors.index.json) continue ;; esac
+        ln -sfn "../Qwen/Qwen3.8-Flash-Next-FP8/$name" "$STAGE/$name"
+    done
+    cp "$SRC/model.safetensors.index.json" "$STAGE/"
+    echo "staging dir ready: $STAGE ($(ls "$STAGE" | wc -l) entries)"
+fi
+
+# ---- checkpoint reshape (stacked experts + bf16 PLE table) -------------------
+# stack-qwen38-official-fp8.py reshapes the staged checkpoint in place
+# (idempotent) and writes the PLE scale to $STAGE/ple_scale.txt — see the
+# script's docstring for why each transform is value-preserving.
+echo "stacking experts + merging the PLE table (value-preserving)..."
+python3 "$SCRIPT_DIR/stack-qwen38-official-fp8.py" --stage "$STAGE"
+PLE_SCALE="$(tr -d '\n' < "$STAGE/ple_scale.txt")"
+echo "PLE fixed scale: $PLE_SCALE"
+
+# ---- convert ----------------------------------------------------------------
+# rad-convert needs no GPU: declare resolves kernels and asks each about the
+# encoding it will read — CPU-side layout questions only. (If a plugin load
+# ever demands a card, add --device /dev/kfd --device /dev/dri to this run.)
+# --plan-only runs the same declare phase and exits before a byte is written.
+echo "rad-convert: $SRC (staged) -> $OUT"
+mkdir -p "$OUT_DIR"
+CONVERT_ARGS=(/models/stage-qwen4exp-fp8 -o /models/rad/qwen4exp-fp8-native.rad
+              --home /opt/radiance/share/radiance)
+[ "$plan_only" -eq 1 ] && CONVERT_ARGS+=(--plan-only -v)
+# THE ONE RECIPE RULE (see header): the PLE table arrives from staging as a
+# bf16 merge of the checkpoint's own fp8 codes decoded with the checkpoint's
+# own scale; rtn re-encodes it at that same scale — the codes come back
+# exactly and the plugin's one-element scale plane is produced.
+CONVERT_ARGS+=(--quant "blk.*.ple_ngram.weight=rtn:codes=fp8_e4m3,block=*x*,scale=bf16,rule=fixed,scale_value=$PLE_SCALE")
+[ "$force" -eq 1 ] && [ -f "$OUT" ] && {
+    TRASH="$HOME/.AGENTTRASH/$(date +%Y%m%d)-frank-archon-rad"
+    mkdir -p "$TRASH"
+    mv "$OUT" "$TRASH/qwen4exp-fp8-native.rad.$(date +%H%M%S)"
+    echo "previous container moved to $TRASH"
+}
+podman run --rm \
+    --entrypoint rad-convert \
+    -v /home/dank/models:/models \
+    "$IMAGE" "${CONVERT_ARGS[@]}"
+
+if [ "$plan_only" -eq 1 ]; then
+    echo "plan-only run complete (no container written)"
+    exit 0
+fi
+
+# ---- record -----------------------------------------------------------------
+echo "rad-info summary:"
+podman run --rm --entrypoint rad-info -v /home/dank/models:/models:ro \
+    "$IMAGE" "/models/rad/qwen4exp-fp8-native.rad" | head -20
+MIB=$(( $(stat -c %s "$OUT") / 1048576 ))
+echo "container: $OUT (${MIB} MiB; env floor $FRANK_ARCHON_RAD_MIN_MIB MiB)"
+if [ "$MIB" -lt "$FRANK_ARCHON_RAD_MIN_MIB" ]; then
+    echo "ERROR: container below the env floor — the convert was truncated" >&2
+    exit 1
+fi
+echo "build complete"

scripts/build-gufo.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Build the gufo runtime that serves frank-large on Dankclaw.
+# Build the gufo runtime that serves frank-dragoon on Dankclaw.
 #
 #   bash scripts/build-gufo.sh              # build + install the pinned tag
 #   bash scripts/build-gufo.sh --verify     # only check the installed tree
@@ -93,4 +93,4 @@ cmake --install build/release
 
 echo "== verify =="
 "$PREFIX/bin/gufo" diagnose
-echo "frank-large runtime ready: $PREFIX/bin/gufo ($GUFO_TAG @ $commit)"
+echo "frank-dragoon runtime ready: $PREFIX/bin/gufo ($GUFO_TAG @ $commit)"

scripts/build-rocmfpx.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
-# Build the ROCmFPX runtime that serves frank-large on Dankclaw.
+# Build the ROCmFPX runtime that serves frank-dragoon on Dankclaw.
 #
 #   bash scripts/build-rocmfpx.sh              # clone/fetch + build the pin
 #   bash scripts/build-rocmfpx.sh --verify     # only check the installed tree
 #
 # Runtime: kingjones30/ROCmFPX — charlie12345/ROCmFPX plus the model-card
-# patches, i.e. the fork that owns the ROCmFPx tensor formats. frank-large's
+# patches, i.e. the fork that owns the ROCmFPx tensor formats. frank-dragoon's
 # payload is ftype 115 (`Q8_0_ROCMFPX_AGENT`): 311 tensors of
 # GGML_TYPE_Q8_0_ROCMFPX (103), a type that exists ONLY in this fork, so
 # stock llama.cpp, gufo and every other loader on the host reject the file.
@@ -30,7 +30,7 @@
 set -euo pipefail
 
 ROCMFPX_REPO="${ROCMFPX_REPO:-https://github.com/kingjones30/ROCmFPX.git}"
-# The commit frank-large was qualified with (measured 2026-10-02).
+# The commit frank-dragoon was qualified with (measured 2026-10-02).
 ROCMFPX_COMMIT="${ROCMFPX_COMMIT:-36e9acd40e10a87cd3c3ef8ec734668757dc8520}"
 SRC_DIR="${ROCMFPX_SRC_DIR:-/home/dank/GitPackages/kingjones-ROCmFPX}"
 BUILD_DIR="${ROCMFPX_BUILD_DIR:-$SRC_DIR/build}"
@@ -86,4 +86,4 @@ cmake --build "$BUILD_DIR" --target llama-server llama-quantize -j "$JOBS"
 
 echo "== verify =="
 "$BUILD_DIR/bin/llama-server" --version | head -1
-echo "frank-large runtime ready: $BUILD_DIR/bin/llama-server ($ROCMFPX_COMMIT)"
+echo "frank-dragoon runtime ready: $BUILD_DIR/bin/llama-server ($ROCMFPX_COMMIT)"

scripts/calib-push.py

@@ -0,0 +1,110 @@
+#!/usr/bin/env python3
+"""calib-push.py — drive a calibration corpus through a radiance scratch
+server's prefill so its tap writes layer Hessians (docs/MOE-W4.md).
+
+Runs ON DANKSERVER next to the scratch server (the one autoresearch- /
+serve-style scratch container booted with RADIANCE_CALIB_DIR set).
+Reads the corpus JSONL produced by make-calib-corpus.py
+({"prompt": "..."} a line), POSTs each prompt to /v1/completions with
+max_tokens=1 (prefill-only cost, one token out), at N-way concurrency
+matching the scratch server's --max-num-seqs budget.
+
+Corpus rounds repeat until the engine prints the tap's completion line
+("calibration wrote layer Hessians") in `podman logs <container>` — that
+is the ground truth that RADIANCE_CALIB_TOKENS was reached. After that
+line, further prompts are pure waste, so the driver exits.
+
+Mechanics notes:
+- requests carry no sampling params that matter (max_tokens=1, greedy).
+- a per-request timeout of 30 min: at ~1k tok/s prefill a 12k-token
+  prompt is a few seconds; the timeout only catches a wedged engine.
+- failures print and continue: the tap pools over tokens, a few lost
+  prompts do not bias the Hessians (the corpus is drawn round-robin over
+  source classes, so loss is class-neutral as long as failures are rare;
+  a systematic 4xx is loud in the log and must be fixed, not ignored).
+
+Usage: calib-push.py [--port 7770] [--parallel 64] [--container arbench]
+       [--corpus /home/dank/corpora/out/calib.jsonl] [--max-rounds 4]
+"""
+import argparse
+import concurrent.futures
+import json
+import subprocess
+import sys
+import time
+import urllib.request
+
+DONE_MARK = "calibration wrote"
+
+
+def tap_done(container):
+    """True if the engine logged the tap's completion line."""
+    try:
+        out = subprocess.run(
+            ["podman", "logs", "--tail", "50", container],
+            capture_output=True, text=True, timeout=30,
+        )
+    except Exception:
+        return False
+    return DONE_MARK in (out.stdout + out.stderr)
+
+
+def push_one(url, prompt):
+    body = json.dumps({
+        "model": "frank-archon",
+        "prompt": prompt,
+        "max_tokens": 1,
+        "temperature": 0,
+        "stream": False,
+    }).encode()
+    req = urllib.request.Request(
+        url, data=body, headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=1800) as r:
+            r.read()
+        return True
+    except Exception as e:
+        print(f"FAIL {str(e)[:120]}", flush=True)
+        return False
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--port", type=int, default=7770)
+    ap.add_argument("--parallel", type=int, default=64)
+    ap.add_argument("--container", default="arbench")
+    ap.add_argument("--corpus", default="/home/dank/corpora/out/calib.jsonl")
+    ap.add_argument("--max-rounds", type=int, default=4)
+    a = ap.parse_args()
+    url = f"http://127.0.0.1:{a.port}/v1/completions"
+
+    prompts = []
+    with open(a.corpus) as f:
+        for line in f:
+            line = line.strip()
+            if line:
+                prompts.append(json.loads(line)["prompt"])
+    print(f"corpus: {len(prompts)} prompts", flush=True)
+
+    for rnd in range(1, a.max_rounds + 1):
+        if tap_done(a.container):
+            break
+        t0 = time.time()
+        ok = 0
+        with concurrent.futures.ThreadPoolExecutor(a.parallel) as ex:
+            for good in ex.map(lambda p: push_one(url, p), prompts):
+                ok += 1 if good else 0
+        dt = time.time() - t0
+        print(f"round {rnd}: {ok}/{len(prompts)} ok in {dt:.0f}s "
+              f"({sum(len(p) for p in prompts)/4/dt:.0f} chars/s est)",
+              flush=True)
+        if tap_done(a.container):
+            break
+    else:
+        print("max rounds exhausted, tap not done", flush=True)
+        sys.exit(1)
+    print("TAP_DONE: calibration wrote layer Hessians", flush=True)
+
+
+if __name__ == "__main__":
+    main()

scripts/convert-swift15-w4dn8.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# convert-swift15-w4dn8.sh — RUNS ON DANKSERVER. The final recipe convert of
+# the Swift 1.5 checkpoint: gate_up experts through GPTQ against the 10M-token
+# calibration Grams, down projections block-fp8, protected experts bf16,
+# trunk int8, PLE fixed-scale fp8 (scripts/recipes/
+# qwen4exp-swift15-w4dn8-i8-hc8m.recipe).
+#
+# The convert engine is 1.0.13 — the SAME pin that will serve the result, so
+# the .rad crosses no version boundary. Only the Gram files cross versions
+# (1.2.0 wrote them; the RADGRAM2 magic, gram.r%d.%s.bin naming and the
+# calib_gram/calib_resolve/calib_stem symbols are byte-identical between the
+# two libquant.so). rad-convert runs on the host backend (no GPU visible in
+# the container) — production can stay up through this script.
+#
+# Prereqs (campaign order): calibration complete (calib-push printed TAP_DONE),
+# the protected-expert cast lines rewritten into the recipe by
+# derive-protected-experts.py, and the 335 GiB bf16 container deleted —
+# the peak-disk arithmetic needs that space (checkpoint 335.3 + output ~132
+# GiB on the volume; --reuse is NOT used, see the recipe header).
+set -euo pipefail
+
+PIN_1013=sha256:4c3f484564bb2872784e46b0a59cbd71becc9c1e746e301a3596ffae253c322e
+IMAGE="stilldeadcode/radiance@$PIN_1013"
+CKPT=/home/dank/models/ukisai/Swift1.5-Qwen3.8-Flash-Next
+RECIPE=/home/dank/serverAppConfigs-swift15/scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe
+CALIB=/home/dank/corpora/calib
+OUT=/home/dank/models/rad/qwen4exp-swift15-w4dn8-i8-hc8m.rad
+LOG=/home/dank/logs/swift15_convert.log
+# gate_up ~37.6 + down ~18.8 + PLE 47.7 + trunk/embeddings/head ~10 GiB (all-w4 expert
+# table; one encoding per expert table rules out a block-fp8 down tier -- see the recipe header).
+MIN_MIB=${FRANK_SWIFT15_RAD_MIN_MIB:-108000}
+
+# Gate 1: inputs. A missing Gram directory converts UNCALIBRATED with a
+# per-tensor stderr note, which is silently worse than failing here.
+[ -d "$CKPT" ] || { echo "no checkpoint at $CKPT" >&2; exit 1; }
+[ -f "$RECIPE" ] || { echo "no recipe at $RECIPE" >&2; exit 1; }
+GRAMS=$(find "$CALIB" -maxdepth 1 -name 'gram.r*.bin' 2>/dev/null | wc -l)
+[ "$GRAMS" -ge 48 ] || { echo "calib dir $CALIB holds $GRAMS gram files (<48)" >&2; exit 1; }
+if [ -e "$OUT" ]; then echo "$OUT already exists; move it to trash first" >&2; exit 1; fi
+if [ -e /home/dank/models/rad/qwen4exp-swift15-bf16.rad ]; then
+    echo "the bf16 container is still on disk; delete it first (peak disk)" >&2; exit 1
+fi
+
+# Gate 2: disk. Output ~132 GiB plus convert staging, 20 GiB of slack.
+FREE_MIB=$(df --output=avail -m /home/dank/models | tail -1 | tr -d ' ')
+[ "$FREE_MIB" -ge $((MIN_MIB + 20480)) ] || {
+    echo "only ${FREE_MIB} MiB free on /home/dank/models" >&2; exit 1; }
+
+# The recipe names $CALIB; rad-convert expands it from the environment
+# (MOE-W4.md:275). The recipe's cast section must name THIS checkpoint's
+# protected experts — derive-protected-experts.py rewrote it.
+echo "convert: $CKPT -> $OUT (gptq calib=$CALIB, $(date -Is))" | tee "$LOG"
+podman run --rm --name swift15-convert \
+    -v /home/dank/models:/models \
+    -v /home/dank/serverAppConfigs-swift15:/campaign:ro \
+    -v "$CALIB:/data/calib:ro" \
+    -e CALIB=/data/calib \
+    --entrypoint /opt/radiance/bin/rad-convert \
+    "$IMAGE" "/models/${CKPT#/home/dank/models/}" \
+    --recipe /campaign/"${RECIPE#/home/dank/serverAppConfigs-swift15/}" \
+    -o /models/rad/"$(basename "$OUT")" 2>&1 | tee -a "$LOG"
+rc=${PIPESTATUS[0]}
+[ "$rc" -eq 0 ] || { echo "rad-convert rc=$rc; log: $LOG" >&2; exit "$rc"; }
+
+# Gate 3: the artifact. rad-info's recipe echo is the receipt that GPTQ ran.
+SIZE_MIB=$(( $(stat -c %s "$OUT") / 1048576 ))
+[ "$SIZE_MIB" -ge "$MIN_MIB" ] || {
+    echo "$OUT is ${SIZE_MIB} MiB < floor ${MIN_MIB}" >&2; exit 1; }
+podman run --rm --entrypoint /opt/radiance/bin/rad-info \
+    -v /home/dank/models:/models:ro "$IMAGE" /models/rad/"$(basename "$OUT")" \
+    2>&1 | tee -a "$LOG" | grep -c 'gptq' >/dev/null \
+    || echo "WARNING: rad-info shows no gptq rule in the recorded recipe" >&2
+echo "CONVERT_DONE ${SIZE_MIB} MiB -> $OUT"

scripts/dankstatus.sh

@@ -57,9 +57,9 @@ else
   echo "  none"
 fi
 
-section "frank-primary unit"
-printf '  active:  %s\n' "$(systemctl is-active frank-primary 2>/dev/null | head -1)"
-printf '  enabled: %s\n' "$(systemctl is-enabled frank-primary 2>/dev/null | head -1)"
+section "frank-archon unit"
+printf '  active:  %s\n' "$(systemctl is-active frank-archon 2>/dev/null | head -1)"
+printf '  enabled: %s\n' "$(systemctl is-enabled frank-archon 2>/dev/null | head -1)"
 
 section "glm serve tail"
 if podman ps -a --format '{{.Names}}' 2>/dev/null | grep -qx "$GLM_CTR"; then

scripts/deep-probe.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""deep-probe.py — one chat completion at ~43.6k prompt tokens, temp 0, 512
+generated, streamed; decode = completion_tokens / (total - ttft)."""
+import json, time, urllib.request
+
+TARGET_BYTES = int(43600 * 3.8)
+
+def build():
+    parts, n = [], 0
+    with open("/home/dank/corpora/out/calib.jsonl") as f:
+        for line in f:
+            p = json.loads(line)["prompt"]
+            parts.append(p)
+            n += len(p.encode())
+            if n >= TARGET_BYTES:
+                break
+    return "".join(parts)
+
+def main(salt):
+    body = json.dumps({
+        "model": "frank-archon",
+        "messages": [{"role": "user", "content": f"[probe {salt}] Continue and summarize this material in English, 400 words.\n\n" + build()}],
+        "temperature": 0.0, "max_tokens": 512,
+        "stream": True, "stream_options": {"include_usage": True},
+    }).encode()
+    req = urllib.request.Request("http://localhost:7770/v1/chat/completions",
+        data=body, headers={"Content-Type": "application/json"})
+    t0 = time.time(); ttft = None; ctok = 0; usage = {}
+    with urllib.request.urlopen(req, timeout=2400) as r:
+        for raw in r:
+            line = raw.decode().strip()
+            if not line.startswith("data:"):
+                continue
+            d = line[5:].strip()
+            if d == "[DONE]":
+                break
+            j = json.loads(d)
+            if j.get("usage"):
+                usage = j["usage"]
+            for ch in j.get("choices", []):
+                delta = (ch.get("delta") or {})
+                piece = delta.get("content") or delta.get("reasoning_content") or ""
+                if piece and ttft is None:
+                    ttft = time.time() - t0
+                ctok += 1
+    total = time.time() - t0
+    gen = usage.get("completion_tokens") or ctok
+    dec = gen / (total - (ttft or 0)) if total > (ttft or 0) else 0
+    print(json.dumps({"salt": salt, "prompt_tokens": usage.get("prompt_tokens"),
+                      "completion_tokens": gen, "ttft_s": round(ttft or 0, 2),
+                      "total_s": round(total, 1), "decode_tps": round(dec, 2)}))
+
+if __name__ == "__main__":
+    import sys
+    main(sys.argv[1] if len(sys.argv) > 1 else "x")

scripts/deploy-plan.py

@@ -1,475 +1,68 @@
 #!/usr/bin/env python3
-"""Plan runtime services affected by repository changes.
+"""deploy-plan.py — map changed paths to deployable services.
 
-The planner is intentionally side-effect free.  It accepts either an explicit
-path list or two Git revisions.  The latter lets compose-file changes resolve
-to only the service definitions that actually changed instead of restarting an
-entire compose project.
+Thin wrapper over scripts/service-map.py, which owns the path->service
+semantics in the shared inventory (shared/services.yml): per-service path
+rules, the quadlet netns/network coupling graph, host scoping (a host's
+directory can only select that host's services), and canonical restart
+order. This file keeps the deployer's CLI contract only.
+
+Usage:
+  deploy-plan.py --target NAME --repo DIR --base REV --head REV
+  deploy-plan.py --target NAME [paths...]        (paths also on stdin)
+
+Prints one service name per line (canonical restart order); exit 0 with no
+output when nothing relevant changed.
 """
-from __future__ import annotations
-
-import argparse
+import os
 import subprocess
 import sys
-from pathlib import PurePosixPath
-from typing import Any
 
-import yaml
-
-# Dependency-sensitive services come before their consumers.  Independent
-# compose services follow.  LLM services are deliberately last and are never
-# implied by a generic host, stack, documentation, or config change.
-SERVICE_ORDER = (
-    "gluetun",
-    "searxng-valkey",
-    "searxng",
-    "marreta",
-    "pihole",
-    "open-webui",
-    "gitea-postgres",
-    "gitea-server",
-    "comfyui",
-    "seerr",
-    "hermes",
-    "hermes-dashboard",
-    "hermes-webui",
-    "prometheus",
-    "grafana",
-    "loki",
-    "alloy",
-    "node-exporter",
-    "alertmanager",
-    "authentik-postgres",
-    "authentik-server",
-    "authentik-worker",
-    "authentik-outpost",
-    "authentik-outpost-ldap",
-    "caddy",
-    "homepage",
-    "romm-mariadb",
-    "romm-redis",
-    "romm",
-    "copyparty",
-    "jellyfin",
-    "calibre-web",
-    "calibre-server",
-    "plex",
-    "tautulli",
-    "prowlarr",
-    "qbittorrent",
-    "radarr",
-    "sonarr",
-    "lidarr",
-    "readarr",
-    "frank-large",
-    "frank-small",
-    "frank-primary",
-)
-
-DANKCLAW_SERVICES = {
-    "hermes-webui",
-    "gluetun",
-    "searxng-valkey",
-    "searxng",
-    "marreta",
-    "pihole",
-    "open-webui",
-    "gitea-postgres",
-    "gitea-server",
-    "comfyui",
-    "seerr",
-    "hermes",
-    "hermes-dashboard",
-    "prometheus",
-    "grafana",
-    "loki",
-    "alloy",
-    "node-exporter",
-    "alertmanager",
-    "authentik-postgres",
-    "authentik-server",
-    "authentik-worker",
-    "authentik-outpost",
-    "authentik-outpost-ldap",
-    "caddy",
-    "homepage",
-    "frank-large",
-    "frank-small",
-}
-
-DANKSERVER_SERVICES = {
-    "romm-mariadb",
-    "romm-redis",
-    "romm",
-    "copyparty",
-    "jellyfin",
-    "calibre-web",
-    "calibre-server",
-    "plex",
-    "tautulli",
-    "prowlarr",
-    "qbittorrent",
-    "radarr",
-    "sonarr",
-    "lidarr",
-    "readarr",
-    "frank-primary",
-    "node-exporter",
-}
-
-# FrankBook-Pro runs the *arr stack + qBittorrent inside a podman machine on
-# macOS. Service names overlap the Linux hosts (gluetun, qbittorrent, ...);
-# the per-target sets and the frankbook-pro intercept in deploy-remote.sh
-# keep dispatch unambiguous.
-FRANKBOOK_SERVICES = {
-    "gluetun",
-    "qbittorrent",
-    "prowlarr",
-    "radarr",
-    "sonarr",
-    "lidarr",
-    "readarr",
-}
-
-DANKCLAW_COMPOSE_SERVICES = set()
-# Dankserver's compose file is still the source of truth for its media stack;
-# Dankclaw's is gone (deleted 2026-09-16). Every service on Dankclaw is a
-# Quadlet unit now — the last compose services were the hermes trio, whose units
-# have owned their containers since 2026-09-12 and whose compose blocks were
-# dead weight that could only create a duplicate container.
-
-DANKSERVER_COMPOSE_SERVICES = {
-    "mariadb",
-    "redis",
-    "romm",
-    "copyparty",
-    "jellyfin",
-    "calibre-web",
-}
-COMPOSE_NAME_MAP = {"mariadb": "romm-mariadb", "redis": "romm-redis"}
+SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+SERVICE_MAP = os.path.join(SCRIPT_DIR, "service-map.py")
 
 
-
-def _add(services: set[str], *names: str) -> None:
-    services.update(names)
-
-
-def target_services(target: str) -> set[str]:
-    if target == "dankclaw":
-        return DANKCLAW_SERVICES
-    if target == "dankserver":
-        return DANKSERVER_SERVICES
-    if target == "frankbook-pro":
-        return FRANKBOOK_SERVICES
-    raise ValueError(f"unknown target: {target}")
-
-
-def _compose_services(target: str) -> set[str]:
-    return DANKCLAW_COMPOSE_SERVICES if target == "dankclaw" else DANKSERVER_COMPOSE_SERVICES
-
-
-def _git_show(repo: str, revision: str, path: str) -> str | None:
-    result = subprocess.run(
-        ["git", "-C", repo, "show", f"{revision}:{path}"],
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.DEVNULL,
-        check=False,
-    )
-    return result.stdout if result.returncode == 0 else None
-
-
-def _yaml_document(contents: str | None) -> dict[str, Any]:
-    if contents is None:
-        return {}
-    try:
-        data = yaml.safe_load(contents) or {}
-    except yaml.YAMLError:
-        return {}
-    return data if isinstance(data, dict) else {}
-
-
-def _yaml_services(contents: str | None) -> dict[str, Any]:
-    services = _yaml_document(contents).get("services", {})
-    return services if isinstance(services, dict) else {}
-
-
-def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
-    """Return only compose services whose YAML definitions or dependencies changed.
-
-    A target with no compose file (Dankclaw since 2026-09-16) plans nothing:
-    its services are Quadlet units, selected by their own paths.
-    """
-    path = f"{target}/compose.yaml"
-    if not _git_show(repo, head, path) and not _git_show(repo, base, path):
-        return set()
-    old_doc = _yaml_document(_git_show(repo, base, path))
-    new_doc = _yaml_document(_git_show(repo, head, path))
-    old = old_doc.get("services", {}) if isinstance(old_doc.get("services", {}), dict) else {}
-    new = new_doc.get("services", {}) if isinstance(new_doc.get("services", {}), dict) else {}
-    names = set(old) | set(new)
-    allowed = _compose_services(target)
-
-    # An unavailable or malformed revision is safer as a broad compose plan
-    # than as a silent no-op. It still cannot include LLM units.
-    if (old_doc and not new_doc) or (new_doc and not old_doc and names):
-        return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
-
-    # Top-level networks/configuration can affect every compose service even
-    # when no individual service mapping changed. Ignore the services key while
-    # comparing the rest of the Compose document.
-    old_globals = {key: value for key, value in old_doc.items() if key != "services"}
-    new_globals = {key: value for key, value in new_doc.items() if key != "services"}
-    if old_globals != new_globals:
-        return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
-
-    changed = {name for name in names if name in allowed and old.get(name) != new.get(name)}
-    return {COMPOSE_NAME_MAP.get(n, n) for n in changed}
-
-
-def services_for_path(path: str, target: str) -> set[str]:
-    """Return services affected by one repository-relative path."""
-    path = path.replace("\\", "/")
-    p = PurePosixPath(path)
-    parts = p.parts
-    services: set[str] = set()
-    if not parts:
-        return services
-
-    # Non-runtime material is deliberately a no-op.
-    if parts[0] in {"docs", "tests", "old", ".githooks"}:
-        return services
-    if path in {"README.md", "AGENTS.md"} or parts[0] == ".obsidian":
-        return services
-
-    if parts[0] == "shared":
-        if len(parts) < 2:
-            return services
-        group = parts[1]
-        if group == "searxng":
-            _add(services, "searxng")
-        elif group == "prometheus":
-            _add(services, "prometheus")
-            if len(parts) >= 3 and parts[2] == "alertmanager.yml":
-                # The Alertmanager config ships from this directory: a change
-                # to it must redeploy the service that installs it.
-                _add(services, "alertmanager")
-        elif group == "loki":
-            _add(services, "loki")
-        elif group == "alloy":
-            _add(services, "alloy")
-        elif group == "grafana":
-            # Provisioned datasources and dashboards: git is the source of
-            # truth, so a change here must restart the service that reads them.
-            _add(services, "grafana")
-        elif group == "homepage":
-            # Homepage is a Dankclaw-owned deployment. Shared homepage files
-            # are intentionally not copied during a Dankserver-only run.
-            if target == "dankclaw":
-                _add(services, "homepage")
-        return services
-
-    if parts[0] == "dankclaw":
-        if len(parts) >= 2 and parts[1] == "compose.yaml":
-            # Dankclaw has no compose file since 2026-09-16: every service is a
-            # Quadlet unit, each selected by its own path. A change (or a
-            # deletion) of this path therefore restarts nothing.
-            return services
-        if len(parts) >= 2 and parts[1] == "Caddyfile":
-            _add(services, "caddy")
-            return services
-        if len(parts) >= 2 and parts[1] == "Containerfile.comfyui":
-            _add(services, "comfyui")
-            return services
-        if len(parts) >= 2 and parts[1] in {"caddy", "comfyui", "loki", "alloy", "hermes", "anubis", "seerr"}:
-            _add(services, parts[1])
-            return services
-        if len(parts) >= 4 and parts[1] == "authentik" and parts[2] == "quadlet":
-            name = parts[3].removesuffix(".container")
-            if name in {"authentik-postgres", "authentik-server", "authentik-worker", "authentik-outpost", "authentik-outpost-ldap"}:
-                _add(services, name)
-            return services
-        if len(parts) >= 2 and parts[1] == "searxng":
-            if len(parts) >= 4 and parts[2] == "quadlet":
-                name = parts[3]
-                if name == "gluetun.container":
-                    # SearXNG and Marreta (+ its browser companion) share
-                    # Gluetun's network namespace.  A Gluetun recreation
-                    # tears the netns down, so every sharer must restart.
-                    _add(services, "gluetun", "searxng", "marreta")
-                elif name == "searxng.container":
-                    _add(services, "searxng")
-                elif name == "searxng-valkey.container":
-                    _add(services, "searxng-valkey", "searxng")
-                elif name == "searxng.network":
-                    _add(services, "gluetun", "searxng-valkey", "searxng", "marreta")
-            return services
-        if len(parts) >= 2 and parts[1] == "marreta":
-            # One deployable owns both the app and its browser companion;
-            # both live in gluetun's netns. A change to either unit selects
-            # the marreta service, which restarts browser-then-app.
-            _add(services, "marreta")
-            return services
-        if len(parts) >= 2 and parts[1] == "pihole":
-            _add(services, "pihole")
-            return services
-        if len(parts) >= 2 and parts[1] == "open-webui":
-            _add(services, "open-webui")
-            return services
-        # frank-large left the quadlet shape on 2026-09-19 (CIRU v4.4.1 host
-        # build, root unit): its files live in scripts/ and map there.
-        if len(parts) >= 2 and parts[1] == "observability":
-            # The five observability containers became Quadlet units on
-            # 2026-09-11. A unit change selects exactly its own service;
-            # SERVICE_ORDER already puts each dependency ahead of its
-            # consumer (prometheus before grafana, loki before alloy).
-            if len(parts) >= 4 and parts[2] == "quadlet":
-                name = parts[3].removesuffix(".container")
-                if name in {"prometheus", "grafana", "loki", "alloy", "node-exporter", "alertmanager"}:
-                    _add(services, name)
-            return services
-        if len(parts) >= 2 and parts[1] == "gitea":
-            if len(parts) >= 4 and parts[2] == "quadlet":
-                name = parts[3]
-                if name == "gitea-postgres.container":
-                    _add(services, "gitea-postgres")
-                elif name == "gitea-server.container":
-                    _add(services, "gitea-server")
-                elif name == "gitea-caddy.container":
-                    # Removing the old split proxy requires the canonical
-                    # Caddy handler to retire its installed unit/container
-                    # before it claims ports 80/443.
-                    _add(services, "caddy")
-                elif name == "gitea.network":
-                    _add(services, "gitea-postgres", "gitea-server")
-            return services
-        return services
-
-    if parts[0] == "dankserver":
-        if len(parts) >= 2 and parts[1] == "compose.yaml":
-            # Compose service keys map onto the deployed unit names.
-            _add(services, *(COMPOSE_NAME_MAP.get(n, n) for n in DANKSERVER_COMPOSE_SERVICES))
-            return services
-        if len(parts) >= 3 and parts[2] == "quadlet":
-            quadlet_services = {
-                "romm": {"romm", "romm-mariadb", "romm-redis"},
-                "jellyfin": {"jellyfin"},
-                "calibre-web": {"calibre-web"},
-                "calibre-server": {"calibre-server"},
-                "copyparty": {"copyparty"},
-                "plex": {"plex"},
-                "tautulli": {"tautulli"},
-            }
-            _add(services, *quadlet_services.get(parts[1], set()))
-        if len(parts) >= 2 and parts[1] == "observability":
-            # Dankserver's node-exporter became a Quadlet unit on 2026-09-16
-            # (serverAppConfigs-docs/Infrastructure/Observability.md): its
-            # compose service died at a reboot and stayed dead, so Prometheus'
-            # node-dankserver job had nothing to scrape.
-            if len(parts) >= 4 and parts[2] == "quadlet":
-                name = parts[3].removesuffix(".container")
-                if name == "node-exporter":
-                    _add(services, "node-exporter")
-            return services
-        # frank-primary's quadlet-era directory left the tree on 2026-09-26
-        # (the Lucebox DS4.1 unit was retired for the llama.cpp root unit —
-        # the trio in scripts/ now maps it). Nothing lives under
-        # dankserver/frank-primary/ except dated trash, and trash plans
-        # nothing (the retire rule above the service blocks).
-        return services
-
-    if parts[0] == "frankbook-pro":
-        if len(parts) >= 3 and parts[2] == "quadlet":
-            name = parts[3].removesuffix(".container")
-            if name == "gluetun":
-                # Every *arr + qBittorrent container shares gluetun's
-                # network namespace; a gluetun recreation kills all of
-                # them, so the plan restarts the whole netns family.
-                _add(services, "gluetun", "qbittorrent",
-                     "prowlarr", "sonarr", "radarr", "lidarr", "readarr")
-            elif name in FRANKBOOK_SERVICES:
-                _add(services, name)
-        return services
-
-    if parts[0] == "scripts":
-        name = p.name
-        if name in {"homepage-status.py", "homepage-status.service", "homepage-status.timer"}:
-            _add(services, "homepage")
-        if name in {"signal-relay.py", "signal-relay.service"}:
-            # The Signal relay is installed by the alertmanager deploy, so a
-            # change to it redeploying alertmanager is the only path that
-            # reaches it on the host.
-            _add(services, "alertmanager")
-        if name in {"frank-small.env", "frank-small.service", "serve-frank-small.sh"}:
-            # llama.cpp frank-small (2026-09-16) keeps its unit, env and serve
-            # files here; each one selects frank-small only. The ik_llama.cpp
-            # trio that lived here for two days is in scripts/.AGENTTRASH/,
-            # which is archive material and plans nothing.
-            _add(services, "frank-small")
-        if name in {"frank-large.env", "frank-large.service", "serve-frank-large.sh"}:
-            # CIRU v4.4.1 frank-large (2026-09-19) keeps its unit, env and
-            # serve files here the same way: a root unit on a host-built
-            # runtime. The download script fetches the payload, which is
-            # host-side state, so it selects nothing.
-            _add(services, "frank-large")
-        if name == "qwen-sharp-v22.4.0.jinja":
-            # The Qwen-Sharp chat template frank-large loads via
-            # --chat-template-file. It lived under dankserver/frank-medium/ until
-            # the 2026-09-26 cutover retired that directory; editing it changes
-            # what the live frank-large endpoint renders, so it plans
-            # frank-large.
-            _add(services, "frank-large")
-        if name in {"frank-primary.env", "frank-primary.service", "serve-frank-primary.sh"}:
-            # llama.cpp frank-primary (2026-09-26, replacing the Lucebox
-            # DS4.1 quadlet) keeps its unit, env and serve files here the
-            # same way: a root unit on the unsloth b11030-mix prebuilt
-            # serving Qwen3.8-Flash-Next Q8_0. The download script fetches
-            # the payload, which is host-side state, so it selects nothing.
-            _add(services, "frank-primary")
-        # Deployment/test/benchmark scripts and other repo tooling do not
-        # restart a runtime service.
-        return services
-
-    # Examples and env templates are not deployed runtime state.
-    if p.name in {".env.example", "env.example"}:
-        return services
-    return services
-
-def changed_paths(repo: str, base: str, head: str) -> list[str]:
-    result = subprocess.run(
-        ["git", "-C", repo, "diff", "--name-only", "--diff-filter=ACDMRTUXB", base, head],
-        text=True,
-        stdout=subprocess.PIPE,
-        check=True,
-    )
-    return [line for line in result.stdout.splitlines() if line]
-
-
-def plan(paths: list[str], target: str, repo: str | None = None,
-         base: str | None = None, head: str | None = None) -> list[str]:
-    services: set[str] = set()
-    for path in paths:
-        if path == f"{target}/compose.yaml" and repo and base and head:
-            services.update(compose_changes(repo, target, base, head))
-        else:
-            services.update(services_for_path(path, target))
-    allowed = target_services(target)
-    return [name for name in SERVICE_ORDER if name in services and name in allowed]
+def git_paths(repo: str, base: str, head: str) -> list[str]:
+    proc = subprocess.run(
+        ["git", "-C", repo, "diff", "--name-only", base, head],
+        text=True, capture_output=True)
+    if proc.returncode != 0:
+        sys.stderr.write(f"deploy-plan: git diff failed: {proc.stderr}")
+        raise SystemExit(1)
+    return [line for line in proc.stdout.splitlines() if line]
 
 
 def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--target", choices=("dankclaw", "dankserver", "frankbook-pro"), required=True)
-    parser.add_argument("--paths", nargs="+")
-    parser.add_argument("--repo", help="repository path for revision-aware planning")
-    parser.add_argument("--base", help="base Git revision")
-    parser.add_argument("--head", help="head Git revision")
-    args = parser.parse_args()
-
-    if not args.paths and not (args.repo and args.base and args.head):
-        parser.error("provide --paths or all of --repo, --base, and --head")
-    paths = args.paths or changed_paths(args.repo, args.base, args.head)
-    print("\n".join(plan(paths, args.target, args.repo, args.base, args.head)))
+    args = sys.argv[1:]
+    if not args or args[0] != "--target":
+        print(__doc__, file=sys.stderr)
+        return 2
+    if len(args) < 2:
+        print("missing target name after --target", file=sys.stderr)
+        return 2
+    target = args[1]
+    # `--paths` is the historic seam keyword: a flag, not an option — the
+    # paths are the positional arguments that follow it.
+    rest = [a for a in args[2:] if a != "--paths"]
+    if "--repo" in rest:
+        try:
+            repo = rest[rest.index("--repo") + 1]
+            base = rest[rest.index("--base") + 1]
+            head = rest[rest.index("--head") + 1]
+        except (ValueError, IndexError):
+            print("--repo, --base and --head must appear together", file=sys.stderr)
+            return 2
+        paths = git_paths(repo, base, head)
+    else:
+        paths = rest or [line.strip() for line in sys.stdin if line.strip()]
+    if not paths:
+        return 0
+    proc = subprocess.run([sys.executable, SERVICE_MAP, "plan", "--host", target] + paths,
+                          text=True, capture_output=True)
+    if proc.returncode != 0:
+        sys.stderr.write(proc.stderr)
+        return proc.returncode
+    sys.stdout.write(proc.stdout)
     return 0
 
 

scripts/deploy-remote.sh

@@ -9,6 +9,13 @@
 # pending until its service is explicitly deployed.
 set -euo pipefail
 
+# The LLM handlers' artifact gates are the serve scripts' own library, so
+# the deployer and the unit refuse the same missing payload with the same
+# words — no deploy can pass a gate the unit would fail. GATE_PREFIX is set
+# per handler.
+# shellcheck disable=SC1091
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/llm-gates.sh"
+
 TARGET="${1:-}"
 REVISION="${2:-}"
 shift 2 || true
@@ -80,31 +87,10 @@ cd "$REMOTE_DIR"
 mkdir -p "$STATE_DIR"
 
 service_is_allowed() {
-    local service="$1"
-    case "$TARGET:$service" in
-        dankclaw:gluetun|dankclaw:searxng-valkey|dankclaw:searxng|dankclaw:pihole|\
-        dankclaw:open-webui|dankclaw:gitea-postgres|dankclaw:gitea-server|\
-        dankclaw:comfyui|dankclaw:hermes|\
-        dankclaw:hermes-dashboard|dankclaw:hermes-webui|dankclaw:prometheus|dankclaw:grafana|\
-        dankclaw:loki|dankclaw:alloy|dankclaw:node-exporter|dankclaw:alertmanager|\
-        dankclaw:authentik-postgres|dankclaw:authentik-server|\
-        dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:authentik-outpost-ldap|dankclaw:anubis|\
-        dankclaw:caddy|dankclaw:homepage|dankclaw:seerr|dankclaw:marreta|\
-        dankclaw:frank-large|dankclaw:frank-small|\
-        dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
-        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:calibre-server|dankserver:plex|dankserver:tautulli|\
-        dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\
-        dankserver:sonarr|dankserver:lidarr|dankserver:readarr|\
-        dankserver:frank-primary|dankserver:node-exporter|\
-        frankbook-pro:gluetun|frankbook-pro:qbittorrent|frankbook-pro:prowlarr|\
-        frankbook-pro:radarr|frankbook-pro:sonarr|frankbook-pro:lidarr|\
-        frankbook-pro:readarr)
-            return 0
-            ;;
-        *)
-            return 1
-            ;;
-    esac
+    # The inventory (shared/services.yml via scripts/service-map.py) is the
+    # only allow-list: a service is deployable on a target iff the inventory
+    # places it there. Retiring a service from a host is a data edit.
+    python3 scripts/service-map.py allows --host "$TARGET" --service "$1"
 }
 
 mark_status() {
@@ -192,7 +178,7 @@ add_pending_services() {
             continue
         fi
         [[ -n "$recorded" && "$recorded" != "$REVISION" ]] || continue
-        if [[ "$TARGET" == dankserver && "$service" == frank-large ]]; then continue; fi
+        if [[ "$TARGET" == dankserver && "$service" == frank-dragoon ]]; then continue; fi
         if ! changed="$(python3 scripts/deploy-plan.py --target "$TARGET" \
             --repo "$REMOTE_DIR" --base "$recorded" --head "$REVISION")"; then
             echo "WARN: unable to compare state for $service; retaining it as pending" >&2
@@ -274,13 +260,11 @@ install_signal_relay() {
 }
 
 copy_loki_config() {
-    run_privileged mkdir -p /opt/loki/config
-    run_privileged cp shared/loki/loki-config.yaml /opt/loki/config/loki-config.yaml
+    copy_config /opt/loki/config shared/loki/loki-config.yaml
 }
 
 copy_alloy_config() {
-    run_privileged mkdir -p /opt/alloy/config
-    run_privileged cp shared/alloy/config.alloy /opt/alloy/config/config.alloy
+    copy_config /opt/alloy/config shared/alloy/config.alloy
 }
 
 copy_grafana_provisioning() {
@@ -289,14 +273,11 @@ copy_grafana_provisioning() {
     # datasource would be invisible to review, lost with the data volume, and
     # unknown to anyone reading the repository. The unit already mounts
     # /opt/grafana/provisioning read-only, so this only has to populate it.
-    run_privileged mkdir -p /opt/grafana/provisioning/datasources \
-        /opt/grafana/provisioning/dashboards
-    run_privileged cp shared/grafana/provisioning/datasources/prometheus.yml \
-        /opt/grafana/provisioning/datasources/prometheus.yml
-    run_privileged cp shared/grafana/provisioning/dashboards/provider.yml \
-        /opt/grafana/provisioning/dashboards/provider.yml
-    run_privileged cp shared/grafana/provisioning/dashboards/llm-fleet.json \
-        /opt/grafana/provisioning/dashboards/llm-fleet.json
+    copy_config /opt/grafana/provisioning/datasources \
+        shared/grafana/provisioning/datasources/prometheus.yml
+    copy_config /opt/grafana/provisioning/dashboards \
+        shared/grafana/provisioning/dashboards/provider.yml \
+        shared/grafana/provisioning/dashboards/llm-fleet.json
 }
 
 render_caddyfile() {
@@ -322,6 +303,12 @@ deploy_homepage() {
     if [[ -d shared/homepage/fonts ]]; then
         run_privileged cp -r shared/homepage/fonts /srv/homepage/
     fi
+    if [[ -d shared/homepage/img ]]; then
+        run_privileged cp -r shared/homepage/img /srv/homepage/
+    fi
+    if [[ -d shared/homepage/sfx ]]; then
+        run_privileged cp -r shared/homepage/sfx /srv/homepage/
+    fi
     local deployed_at
     deployed_at="$(git log -1 --format=%cI)"
     printf 'window.DEPLOYED_AT = "%s";\n' "$deployed_at" > /tmp/deployed.js
@@ -435,31 +422,6 @@ deploy_caddy() {
     fi
 }
 
-deploy_compose_service() {
-    local service="$1"
-    if [[ "$TARGET" == dankserver ]]; then
-        # Dankserver's compose file is the source-of-truth inventory, but its
-        # production containers are individually systemd-managed/bare. Do not
-        # use compose up here: it can create a second container with a wrong
-        # name and can interfere with a running workload.
-        echo "WARN: $service is recorded in dankserver/compose.yaml; production container management is host-specific and no restart was attempted."
-        return 0
-    fi
-    if [[ "$TARGET" == dankclaw ]]; then
-        # Dankclaw has no compose file since 2026-09-16: every service is a
-        # Quadlet unit with its own handler above. Reaching this means the
-        # dispatcher is missing a case, and the old fallback (`podman-compose
-        # up -d`) would now be a silent no-op or a duplicate container.
-        echo "no compose services on dankclaw; $service has no quadlet handler" >&2
-        return 2
-    fi
-    case "$service" in
-        *)
-            echo "unknown compose service: $service" >&2
-            return 2
-            ;;
-    esac
-}
 
 # grafana is the one observability service that holds a credential: the
 # Authentik OAuth2 client secret. It is seeded into a per-service env file (the
@@ -562,6 +524,35 @@ quadlet_unit_dir="$HOME/.config/containers/systemd"
 # dankserver's user manager had no systemd container generator dir before the
 # quadlet migration; every handler that installs a unit must find it present.
 mkdir -p "$quadlet_unit_dir"
+# copy_config DEST SRC... — the privileged config copy every service uses:
+# ensure DEST, copy each tracked SRC into it. The deployer owns /opt state;
+# the files in git are the source of truth, so a service config that only
+# exists on the host is a gap by policy.
+copy_config() {
+    local dest="$1"; shift
+    run_privileged mkdir -p "$dest"
+    local src
+    for src in "$@"; do
+        run_privileged cp "$src" "$dest/"
+    done
+}
+
+# retire_unit_file PATH TRASH [UNIT] — the repo Deletion & Trash policy, in
+# code: stop and disable the named unit, move the unit FILE into the home
+# trash (never rm), report. The dragoon quadlet retirement and the
+# compose-era comfyui.service retirement were the same six lines twice.
+retire_unit_file() {
+    local path="$1" trash="$2" unit="${3:-}"
+    [[ -e "$path" ]] || return 0
+    if [[ -n "$unit" ]]; then
+        systemctl --user stop "$unit" 2>/dev/null || true
+        systemctl --user disable "$unit" 2>/dev/null || true
+    fi
+    mkdir -p "$trash"
+    mv -- "$path" "$trash/$(basename "$path")"
+    echo "retired $(basename "$path") -> $trash"
+}
+
 install_quadlet() {
     local service="$1"
     local source_dir="$2"
@@ -649,15 +640,8 @@ deploy_comfyui() {
     # generator produces, and it is what kept a stale, device-less container
     # alive through `restart: unless-stopped` (9,146 failures on
     # "No HIP GPUs are available"). Never `rm`: it moves into the home trash.
-    local legacy="$HOME/.config/systemd/user/comfyui.service"
-    if [[ -e "$legacy" ]]; then
-        local trash="$HOME/.AGENTTRASH/20260916-comfyui-compose-unit"
-        mkdir -p "$trash"
-        systemctl --user stop comfyui.service 2>/dev/null || true
-        systemctl --user disable comfyui.service 2>/dev/null || true
-        mv -- "$legacy" "$trash/comfyui.service"
-        echo "retired the compose-era comfyui.service -> $trash"
-    fi
+    retire_unit_file "$HOME/.config/systemd/user/comfyui.service" \
+        "$HOME/.AGENTTRASH/20260916-comfyui-compose-unit" comfyui.service
     # The stale container carries the old config (no /dev/kfd, no /dev/dri) and
     # would keep the quadlet's container from taking the name. It is replaced
     # by the unit in the next step, so nothing is lost.
@@ -715,9 +699,15 @@ deploy_gitea_unit() {
     systemctl --user restart "$service.service"
 }
 
+# The root units are symlinks from the systemd system directory into the
+# checkout. SYSTEMD_SYSTEM_DIR is production (/etc/systemd/system); the knob
+# exists so the deploy seam can run a whole handler — relink included — in a
+# sandbox and read the unit links as evidence, unprivileged.
+SYSTEMD_SYSTEM_DIR="${SYSTEMD_SYSTEM_DIR:-/etc/systemd/system}"
+
 relink_unit() {
     local service="$1"
-    run_privileged ln -sfn "$REMOTE_DIR/scripts/$service.service" "/etc/systemd/system/$service.service"
+    run_privileged ln -sfn "$REMOTE_DIR/scripts/$service.service" "$SYSTEMD_SYSTEM_DIR/$service.service"
 }
 
 # Authentik runs as three boot-persistent Quadlet units (postgres -> server ->
@@ -936,17 +926,17 @@ deploy_plex() {
     systemctl --user restart plex.service
     # Readiness gate: /identity answers MediaContainer XML once PMS is up.
     #
-    # HTTPS, NOT HTTP. PMS drops plain HTTP off-loopback: the probe's
-    # connection arrives on the container's eth0, so an http:// request is
-    # accepted and then answered with nothing (curl 52, Empty reply) against a
-    # perfectly healthy server. Measured 2026-10-02 — the gate burned its full
-    # 600s and failed a plex whose https://127.0.0.1:32400/identity answered
-    # 200 in 44 ms the whole time. The same law is why the Caddyfile dials the
-    # plex upstream over TLS (tests/caddyfile.bats pins it).
+    # HTTPS, NOT HTTP. PMS serves plain HTTP on loopback only: a probe
+    # arriving on the container's interface gets its connection accepted and
+    # then an empty reply (curl 52) from a perfectly healthy server, so an
+    # http:// probe would burn the whole timeout and fail a service that
+    # answers https://127.0.0.1:32400/identity in milliseconds. The Caddyfile
+    # dials the same upstream over TLS for the same reason
+    # (tests/caddyfile.bats pins it).
     # -k: PMS presents its own self-signed cert on 32400.
     #
-    # Reality check from the 2026-09 cutover: the FIRST container boot of a
-    # years-old library ran ~10 min, so the gate still allows 600s.
+    # The budget accounts for a first boot of a large pre-existing library,
+    # which spends minutes indexing before it answers anything.
     # Fail the deploy (pending state preserved) rather than mark it deployed blind.
     for ((i = 1; i <= 120; i++)); do
         curl -fsSk --max-time 3 https://127.0.0.1:32400/identity >/dev/null && return 0
@@ -1086,42 +1076,41 @@ deploy_anubis() {
     wait_container_healthy anubis 60 || return 1
 }
 
-# frank-large is the halogen CONTAINER (ghcr.io/peonist-ai/halogen,
-# digest-pinned through scripts/frank-large.env) serving
-# peonist-ai/halogen-qwen3.8-27b — qwen3.8-27b-p1w4d-d2.hgn, 33.4 GiB,
-# DFlash2 spec decode, 1 slot x 200700, text-only — on the Strix Halo
-# iGPU. It stays a ROOT unit because the serve script drives `podman run`
-# directly (the frank-primary pattern): relink_unit points
-# /etc/systemd/system/frank-large.service at the repo file, boot
+# frank-dragoon is the halogen-flash-server CONTAINER (0.16.2, digest-pinned
+# through scripts/frank-dragoon.env) serving the Quat3rnion ABLITERATED
+# Swift1.5 finetune of peonist's Qwen3.8-Flash-Next v2 checkpoint —
+# qwen38-flash-next-v2-swift15-abliterated.hgn (66,687,678,464 B, ~62 GiB
+# resident) + the REQUIRED n-gram lookup table + the vision tower —
+# MTP spec decode (HALOGEN_SPEC_ADAPT=0), 2 slots x 200192, image input —
+# on the Strix Halo iGPU. It stays a ROOT unit because the serve script
+# drives `podman run` directly (the frank-archon pattern): relink_unit
+# points /etc/systemd/system/frank-dragoon.service at the repo file, boot
 # persistence is that unit's [Install], and LimitMEMLOCK=infinity is
-# fleet parity. 2026-10-05 cutover from the ROCmFPX llama.cpp shape —
-# rollback = revert the swap commit's trio; that payload, its draft head
-# and the fork build all stay on disk
-# (~/models/kingjones-Qwen3.8-27B-Uncensored-ROCmFP4-STRIX-MTP,
-# ~/GitPackages/kingjones-ROCmFPX).
+# fleet parity. 2026-10-06 cutover from the halogen 27B-dense shape —
+# rollback = revert the swap commit's trio; the 27B payload stays on
+# disk (~/models/halogen-qwen3.8-27b).
 #
-# The gates mirror serve-frank-large.sh's predicates EXACTLY (the
+# The gates mirror serve-frank-dragoon.sh's predicates EXACTLY (the
 # 2026-10-01 crash-loop lesson): image digest in dank's podman storage,
-# the .hgn checkpoint at the exact byte count, the tokenizer directory
-# holding every named file as a regular (not symlinked) file — a green
-# deploy against a missing artifact would
-# leave a restart-looping unit and a dark endpoint. The port gate is the
-# same as every cutover since 2026-09-16: nothing starts until 7770 is
-# released.
-LLM_LARGE_IMAGE="${LLM_LARGE_IMAGE:-ghcr.io/peonist-ai/halogen@sha256:dc0a39a0016d6cfc58a197978febaafdf8d28403f724ded6111d98b5fb7ac0ea}"
-LLM_LARGE_CKPT="${LLM_LARGE_CKPT:-/home/dank/models/halogen-qwen3.8-27b/qwen3.8-27b-p1w4d-d2.hgn}"
-LLM_LARGE_CKPT_BYTES="${LLM_LARGE_CKPT_BYTES:-35865565184}"
-LLM_LARGE_TOK_DIR="${LLM_LARGE_TOK_DIR:-/home/dank/models/halogen-qwen3.8-27b/tokenizer}"
-LLM_LARGE_TOK_FILES="${LLM_LARGE_TOK_FILES:-tokenizer.json chat_template.jinja tokenizer_config.json merges.txt vocab.json}"
+# each .hgn payload (checkpoint, n-gram table, vision tower) at the exact
+# byte count, the tokenizer directory holding every named file as a
+# regular (not symlinked) file — a green deploy against a missing
+# artifact would leave a restart-looping unit and a dark endpoint. The
+# port gate is the same as every cutover since 2026-09-16: nothing
+# starts until 7770 is released.
+LLM_DRAGOON_IMAGE="${LLM_DRAGOON_IMAGE:-ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84ac22308a53f5d1ca6b86806702d7039e5ebc51cae4c66621b92fe04a}"
+LLM_DRAGOON_CKPT="${LLM_DRAGOON_CKPT:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-v2-swift15-abliterated.hgn}"
+LLM_DRAGOON_CKPT_BYTES="${LLM_DRAGOON_CKPT_BYTES:-66687678464}"
+LLM_DRAGOON_NGRAM="${LLM_DRAGOON_NGRAM:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-ngram.hgn}"
+LLM_DRAGOON_NGRAM_BYTES="${LLM_DRAGOON_NGRAM_BYTES:-51200246144}"
+LLM_DRAGOON_VISION="${LLM_DRAGOON_VISION:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-vision.hgn}"
+LLM_DRAGOON_VISION_BYTES="${LLM_DRAGOON_VISION_BYTES:-897916416}"
+LLM_DRAGOON_TOK_DIR="${LLM_DRAGOON_TOK_DIR:-/home/dank/models/halogen-flashnext-v2/tokenizer}"
+LLM_DRAGOON_TOK_FILES="${LLM_DRAGOON_TOK_FILES:-tokenizer.json chat_template.jinja tokenizer_config.json merges.txt vocab.json generation_config.json}"
 
-retire_halogen_large_quadlet() {
-    local trash="$HOME/.AGENTTRASH/20260919-orca-cutover/quadlet"
-    systemctl --user stop frank-large.service 2>/dev/null || true
-    if [[ -e "$quadlet_unit_dir/frank-large.container" ]]; then
-        mkdir -p "$trash"
-        mv -- "$quadlet_unit_dir/frank-large.container" "$trash/frank-large.container"
-        echo "retired quadlet frank-large.container -> $trash"
-    fi
+retire_halogen_dragoon_quadlet() {
+    retire_unit_file "$quadlet_unit_dir/frank-dragoon.container" \
+        "$HOME/.AGENTTRASH/20260919-orca-cutover/quadlet" frank-dragoon.service
     systemctl --user daemon-reload
 }
 
@@ -1143,176 +1132,159 @@ wait_port_free() {
     ss -tan "sport = :$port" >&2 || true
     return 1
 }
+# assert_unit_owns_port SERVICE PORT — the false-green gate every LLM
+# endpoint shares. A health answer proves the PORT replied, never WHO
+# replied: on 2026-09-26 a leftover probe held :7770, satisfied the curl,
+# and the deploy reported green over a stopped unit. Green requires the
+# unit's own MainPID to be alive behind the answer.
+assert_unit_owns_port() {
+    local service="$1" port="$2" main_pid
+    main_pid="$(run_privileged systemctl show -p MainPID --value "$service.service")"
+    if [[ -z "$main_pid" || "$main_pid" == "0" ]]; then
+        echo "FAIL: :$port answered but $service.service has no MainPID — a stray process holds the port" >&2
+        return 1
+    fi
+    echo "$service: health answered by unit MainPID $main_pid"
+}
 
-deploy_llm_large() {
-    # Refuse rather than restart-loop; every gate below has a twin in
-    # serve-frank-large.sh and they must agree (2026-10-01 lesson).
-    # Capture podman output before grepping: `podman images | grep -q`
-    # races under pipefail (SIGPIPE 141 becomes "no match", 2026-09-30).
-    if ! grep -qF "${LLM_LARGE_IMAGE#*@}" <<<"$(podman images --format '{{.RepoDigests}}' 2>/dev/null)"; then
-        echo "ERROR: halogen image absent: $LLM_LARGE_IMAGE" >&2
-        echo "frank-large: pull it: podman pull ${LLM_LARGE_IMAGE%@*}" >&2
-        return 1
-    fi
-    if [[ ! -f "$LLM_LARGE_CKPT" ]]; then
-        echo "ERROR: halogen checkpoint absent at $LLM_LARGE_CKPT" >&2
-        echo "frank-large: fetch it: bash scripts/download-frank-large-halogen.sh" >&2
-        return 1
-    fi
-    if [[ "$(stat -c %s "$LLM_LARGE_CKPT")" != "$LLM_LARGE_CKPT_BYTES" ]]; then
-        echo "ERROR: halogen checkpoint is not $LLM_LARGE_CKPT_BYTES bytes (partial download?)" >&2
-        echo "frank-large: re-check: bash scripts/download-frank-large-halogen.sh --verify-only" >&2
-        return 1
-    fi
-    if [[ -L "$LLM_LARGE_TOK_DIR" || ! -d "$LLM_LARGE_TOK_DIR" ]]; then
-        echo "ERROR: tokenizer dir missing or a symlink at $LLM_LARGE_TOK_DIR" >&2
-        echo "frank-large: fetch it: bash scripts/download-frank-large-halogen.sh" >&2
-        return 1
-    fi
-    for tf in $LLM_LARGE_TOK_FILES; do
-        if [[ ! -f "$LLM_LARGE_TOK_DIR/$tf" || -L "$LLM_LARGE_TOK_DIR/$tf" ]]; then
-            echo "ERROR: tokenizer file missing or a symlink: $LLM_LARGE_TOK_DIR/$tf" >&2
-            echo "frank-large: fetch it: bash scripts/download-frank-large-halogen.sh" >&2
-            return 1
-        fi
-    done
+# start_root_unit — the tail every LLM root unit deploys: relink the unit
+# file from the checkout into /etc/systemd/system, (re)enable, restart,
+# wait for /health, and prove the answer came from the unit's own process.
+# The three endpoints differ in gates, ports, and budgets, never in this.
+start_root_unit() {
+    local service="$1" port="$2" health_limit="$3"
+    relink_unit "$service"
+    run_privileged systemctl daemon-reload
+    run_privileged systemctl enable "$service.service"
+    run_privileged systemctl restart "$service.service"
+    wait_for_health "$service" "http://127.0.0.1:${port}/health" "$health_limit" || return 1
+    assert_unit_owns_port "$service" "$port"
+}
 
-    retire_halogen_large_quadlet
+deploy_llm_dragoon() {
+    # Refuse rather than restart-loop; every gate here is the SAME library
+    # call the serve script makes, so the two twins cannot drift (the
+    # 2026-10-01 crash-loop lesson).
+    # Capture podman output before grepping is moot: require_image is one
+    # command, no pipe (the 2026-09-30 SIGPIPE lesson).
+    export GATE_PREFIX=frank-dragoon
+    require_image "$LLM_DRAGOON_IMAGE" \
+        "pull it: podman pull docker://${LLM_DRAGOON_IMAGE%@*}" || return 1
+    require_bytes "$LLM_DRAGOON_CKPT" checkpoint "$LLM_DRAGOON_CKPT_BYTES" \
+        "fetch it: bash scripts/download-frank-dragoon-flashnext.sh; re-check: --verify-only" || return 1
+    require_bytes "$LLM_DRAGOON_NGRAM" n-gram "$LLM_DRAGOON_NGRAM_BYTES" \
+        "fetch it: bash scripts/download-frank-dragoon-flashnext.sh; re-check: --verify-only" || return 1
+    require_bytes "$LLM_DRAGOON_VISION" vision "$LLM_DRAGOON_VISION_BYTES" \
+        "fetch it: bash scripts/download-frank-dragoon-flashnext.sh; re-check: --verify-only" || return 1
+    # shellcheck disable=SC2086
+    require_dir_files "$LLM_DRAGOON_TOK_DIR" tokenizer \
+        "fetch it: bash scripts/download-frank-dragoon-flashnext.sh" \
+        $LLM_DRAGOON_TOK_FILES || return 1
+
+    retire_halogen_dragoon_quadlet
     # The predecessor on a re-deploy is THIS unit: stop it (ExecStop stops
     # the container) before waiting on the port. The stray sweep is keyed
-    # on the FULL container name, which appears in the argv of a manual
-    # `podman run --name frank-large-halogen` / `podman wait` but NOT in
-    # this deployer's own command line (`bash deploy-remote.sh
-    # frank-large`) — so it cannot shoot itself in the foot (the fleet
-    # pkill law), and it can never match frank-small's llama-server.
-    run_privileged systemctl stop frank-large.service 2>/dev/null || true
-    pkill -f 'frank-large-halogen' 2>/dev/null || true
-    podman rm -f frank-large frank-large-halogen >/dev/null 2>&1 || true
+    # on the FULL container name: it appears in the argv of a manual
+    # `podman run --name frank-dragoon-halogen` / `podman wait`, while a
+    # pattern naming only the runtime would ALSO match this deployer's own
+    # command line — a pkill whose pattern hits its own argv takes the
+    # running deploy down with the target. The full name can never match
+    # frank-zealot's llama-server either.
+    run_privileged systemctl stop frank-dragoon.service 2>/dev/null || true
+    pkill -f 'frank-dragoon-halogen' 2>/dev/null || true
+    podman rm -f frank-dragoon frank-dragoon-halogen >/dev/null 2>&1 || true
     # Nothing may start until the predecessor has released the port
     # (2026-09-16: "Deactivated successfully" was not "port free").
     wait_port_free 7770 || return 1
-    relink_unit frank-large
-    run_privileged systemctl daemon-reload
-    run_privileged systemctl enable frank-large.service
-    run_privileged systemctl restart frank-large.service
-    wait_for_health frank-large http://127.0.0.1:7770/health 1200
+    start_root_unit frank-dragoon 7770 1200
 }
 
-# deploy_llm_small — frank-small is llama.cpp (master build, CUDA sm_86) on
+# deploy_llm_zealot — frank-zealot is llama.cpp (master build, CUDA sm_86) on
 # the RTX 3090 as a ROOT unit: the runtime is a native binary tree under
 # ~/GitPackages/llama-master/build-cuda, so there is no container image and
 # no generated unit to avoid. relink_unit points
-# /etc/systemd/system/frank-small.service at the repo file and boot
+# /etc/systemd/system/frank-zealot.service at the repo file and boot
 # persistence is that unit's [Install] section.
 #
-# It is a SEPARATE endpoint on port 7771; frank-large keeps 7770. The 3090 is
-# not shared: frank-large's engine runs on the gfx1151 iGPU.
-LLM_SMALL_MODEL_FILE="${LLM_SMALL_MODEL_FILE:-/home/dank/models/Ornith-Q8/Ornith-1.5-9B-Q8_0.gguf}"
-LLM_SMALL_RUNTIME="${LLM_SMALL_RUNTIME:-/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server}"
-# The projector IS the vision capability here: the Ornith GGUF ships no
-# `v.*` tensors, so a deploy that starts without this file silently ships a
-# text-only endpoint. Checked unconditionally, like frank-large's.
-LLM_SMALL_MMPROJ="${LLM_SMALL_MMPROJ:-/home/dank/models/Ornith-Q8/mmproj-Ornith-1.5-9B-BF16.gguf}"
+# It is a SEPARATE endpoint on port 7771; frank-dragoon keeps 7770. The 3090 is
+# not shared: frank-dragoon's engine runs on the gfx1151 iGPU.
+LLM_ZEALOT_MODEL_FILE="${LLM_ZEALOT_MODEL_FILE:-/home/dank/models/Qwen35-9B-HauhauCS-Q6K/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf}"
+LLM_ZEALOT_RUNTIME="${LLM_ZEALOT_RUNTIME:-/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server}"
+# The projector IS the vision capability here: the model is natively
+# multimodal and the Q6_K file carries no vision tensors — the publisher ships
+# its own BF16 projector in the same repo, so a deploy that starts without
+# this file silently ships a text-only endpoint. Checked unconditionally, like
+# frank-dragoon's.
+LLM_ZEALOT_MMPROJ="${LLM_ZEALOT_MMPROJ:-/home/dank/models/Qwen35-9B-HauhauCS-Q6K/mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf}"
 
-deploy_llm_small() {
+deploy_llm_zealot() {
     # Refuse rather than restart-loop: a unit whose runtime or payload is
     # missing never becomes healthy, and a green deploy would leave the
-    # endpoint dark with nothing in the log to say why.
-    if [[ ! -x "$LLM_SMALL_RUNTIME" ]]; then
-        echo "ERROR: llama.cpp runtime absent at $LLM_SMALL_RUNTIME" >&2
-        echo "frank-small: build it (cmake -B build-cuda -DGGML_CUDA=ON" >&2
-        echo "frank-small: -DCMAKE_CUDA_ARCHITECTURES=86 -DCMAKE_CUDA_HOST_COMPILER=/usr/bin/gcc-13" >&2
-        echo "frank-small: && cmake --build build-cuda --target llama-server) first." >&2
-        return 1
-    fi
-    for f in "$LLM_SMALL_MODEL_FILE" "$LLM_SMALL_MMPROJ"; do
-        if [[ ! -f "$f" ]]; then
-            echo "ERROR: frank-small payload file absent at $f" >&2
-            echo "frank-small: run scripts/download-frank-small.sh first;" >&2
-            echo "frank-small: refusing to start a unit that cannot load." >&2
-            return 1
-        fi
-    done
-    relink_unit frank-small
-    run_privileged systemctl daemon-reload
-    run_privileged systemctl enable frank-small.service
-    run_privileged systemctl restart frank-small.service
-    wait_for_health frank-small http://127.0.0.1:7771/health 900 || return 1
-    # False-green hardening (frank-large's lesson): the port answering
-    # proves nothing about WHO answers — the unit must be active with a
-    # live MainPID, or a stray SGLang holdover is masquerading as deployed.
-    local main_pid
-    main_pid="$(run_privileged systemctl show -p MainPID --value frank-small.service)"
-    if [[ -z "$main_pid" || "$main_pid" == "0" ]]; then
-        echo "FAIL: :7771 answered but frank-small.service has no MainPID — a stray process holds the port" >&2
-        return 1
-    fi
-    echo "frank-small: health answered by unit MainPID $main_pid"
+    # endpoint dark with nothing in the log to say why. Same library calls
+    # as serve-frank-zealot.sh, so the deployer's twin refuses identically.
+    export GATE_PREFIX=frank-zealot
+    require_exec "$LLM_ZEALOT_RUNTIME" runtime \
+        "build it: cmake -B build-cuda -DGGML_CUDA=ON -DCMAKE_CUDA_ARCHITECTURES=86" \
+        || return 1
+    require_file "$LLM_ZEALOT_MODEL_FILE" gguf \
+        "fetch it: bash scripts/download-frank-zealot.sh" || return 1
+    require_file "$LLM_ZEALOT_MMPROJ" mmproj \
+        "fetch it: bash scripts/download-frank-zealot.sh" || return 1
+
+    start_root_unit frank-zealot 7771 900
 }
 
-# deploy_llm_primary — frank-primary is the tcclaviger RDNA4 vLLM fork
-# (digest-pinned image, gfx1201) serving the orcarouter
-# Qwen3.8-Flash-Next-Uncensored-FP8 payload (131 safetensors shards) with
-# MTP4 spec decode and q8/q8 KV on the two R9700s as a ROOT unit whose serve
-# script drives `podman run` directly (the image entrypoint execs
-# `vllm serve`). 2026-09-29 cutover from the R9V radiance fork, whose
-# launcher/shim/setup-state machinery is retired (state dirs stay on disk as
-# rollback; pre-cutover tag frank-primary-r9v-q8-20260929). Same port and
-# alias as the endpoints it replaced; the harness models.yml id is unchanged.
+# deploy_llm_archon — frank-archon is the radiance engine (StillDeadcode,
+# digest-pinned stilldeadcode/radiance image) serving the OFFICIAL
+# Qwen/Qwen3.8-Flash-Next-FP8 at native block-FP8 precision from the
+# rad-convert container qwen4exp-fp8-native.rad, on BOTH R9700s (TP=2) as a
+# ROOT unit whose serve script drives `podman run` directly (the engine is
+# the image entrypoint; the image lives in dank's rootless podman storage).
+# 2026-10-05 cutover from FreeToken (pre-cutover tag
+# frank-archon-freetoken-pr587-20261005); before that, the tcclaviger vLLM
+# fork (tag frank-archon-vllm-shapeG-20261003). Same port and alias; the
+# harness models.yml id is unchanged.
 #
-# Gates: the pinned runtime image must be loadable from dank's rootless
-# storage by its OCI manifest digest (the env file's FRANK_PRIMARY_IMAGE),
-# the payload dir must carry config.json and the expected shard count
-# (FRANK_PRIMARY_MODEL_SHARDS), and the unit env must be complete. Per-file
-# sha256 verification was the fetch script's job at download time, never
+# Gates: the image must exist under its digest ref in dank's rootless
+# storage (FRANK_ARCHON_IMAGE), the .rad container file must exist at the
+# env's size floor (FRANK_ARCHON_MODEL_FILE >= FRANK_ARCHON_RAD_MIN_MIB —
+# a truncated convert is a guaranteed long-timeout boot), and the unit env
+# must be complete. Per-file sha256 verification is the fetch script's job
+# at download time and rad-convert/rad-info's job at build time, never
 # re-hashed here.
-LLM_PRIMARY_CONTAINER=frank-primary-qwen
-LLM_PRIMARY_LEGACY_CONTAINERS="frank-primary-r9v qwen-fp8 glm-probe"
+LLM_ARCHON_CONTAINER=frank-archon
+LLM_ARCHON_LEGACY_CONTAINERS="frank-archon-qwen frank-archon-r9v qwen-fp8 glm-probe"
 
-deploy_llm_primary() {
+deploy_llm_archon() {
     # Refuse rather than restart-loop: a unit whose image or payload is
     # missing never becomes healthy, and a green deploy would leave the
-    # endpoint dark with nothing in the log to say why.
-    local env_file="/home/dank/serverAppConfigs/scripts/frank-primary.env"
-    local image model_dir shards count
+    # endpoint dark with nothing in the log to say why. The gates are the
+    # shared library's, called with the values the unit's own env file
+    # declares — so serve-frank-archon.sh and this handler cannot disagree,
+    # and the payload path lives in exactly one file.
+    export GATE_PREFIX=frank-archon
+    local env_file="${LLM_ARCHON_ENV_FILE:-$REMOTE_DIR/scripts/frank-archon.env}"
+    local image model_dir model_file rad_min
     if [[ ! -f "$env_file" ]]; then
-        echo "ERROR: frank-primary env file absent: $env_file" >&2
+        echo "frank-archon: env: missing at $env_file" >&2
+        echo "  hint: deploy the repo checkout first ($REMOTE_DIR)" >&2
         return 1
     fi
-    image="$(sed -n 's/^FRANK_PRIMARY_IMAGE=//p' "$env_file" | tail -1)"
-    model_dir="$(sed -n 's/^FRANK_PRIMARY_MODEL_DIR=//p' "$env_file" | tail -1)"
-    shards="$(sed -n 's/^FRANK_PRIMARY_MODEL_SHARDS=//p' "$env_file" | tail -1)"
-    if [[ -z "$image" || -z "$model_dir" || -z "$shards" ]]; then
-        echo "ERROR: frank-primary.env missing FRANK_PRIMARY_IMAGE/MODEL_DIR/MODEL_SHARDS" >&2
-        return 1
-    fi
-    # Capture podman's output BEFORE grepping: under set -o pipefail, the
-    # classic `podman images | grep -q` races (grep exits on match, podman
-    # dies SIGPIPE 141 writing the rest, pipefail calls it no-match — the
-    # 2026-09-30 deploy refusal).
-    local digests
-    digests="$(podman images --format '{{.RepoDigests}}')"
-    if ! grep -qF "${image#*@}" <<<"$digests"; then
-        echo "ERROR: pinned runtime image absent from rootless storage: $image" >&2
-        echo "frank-primary: fetch it (podman pull $image)" >&2
-        return 1
-    fi
-    if [[ ! -f "$model_dir/config.json" ]]; then
-        echo "ERROR: payload config missing: $model_dir/config.json" >&2
-        echo "frank-primary: re-run scripts/download-frank-primary.sh" >&2
-        return 1
-    fi
-    if [[ ! -f "$model_dir/model.safetensors.index.json" ]]; then
-        echo "ERROR: weight-map index missing: $model_dir/model.safetensors.index.json" >&2
-        echo "frank-primary: re-run scripts/download-frank-primary.sh" >&2
-        return 1
-    fi
-    count="$(find "$model_dir" -maxdepth 1 -name 'model-*-of-*.safetensors' 2>/dev/null | wc -l)"
-    if [[ "$count" != "$shards" ]]; then
-        echo "ERROR: payload shard count wrong: $model_dir (found $count, want $shards)" >&2
-        echo "frank-primary: re-run scripts/download-frank-primary.sh" >&2
+    image="$(sed -n 's/^FRANK_ARCHON_IMAGE=//p' "$env_file" | tail -1)"
+    model_dir="$(sed -n 's/^FRANK_ARCHON_MODEL_DIR=//p' "$env_file" | tail -1)"
+    model_file="$(sed -n 's/^FRANK_ARCHON_MODEL_FILE=//p' "$env_file" | tail -1)"
+    rad_min="$(sed -n 's/^FRANK_ARCHON_RAD_MIN_MIB=//p' "$env_file" | tail -1)"
+    if [[ -z "$image" || -z "$model_dir" || -z "$model_file" || -z "$rad_min" ]]; then
+        echo "frank-archon: env: missing FRANK_ARCHON_IMAGE/MODEL_DIR/MODEL_FILE/RAD_MIN_MIB" >&2
+        echo "  hint: scripts/frank-archon.env" >&2
         return 1
     fi
+    require_image "$image" \
+        "pull it: podman pull docker://stilldeadcode/radiance:latest (as dank)" \
+        || return 1
+    require_min_mib "$model_dir/$model_file" ".rad" "$rad_min" \
+        "convert it: scripts/convert-swift15-w4dn8.sh (rad-info is the record)" \
+        || return 1
 
     # A stale container with the same name makes `podman run --name` fail at
     # start; remove any leftover from a failed previous attempt.
@@ -1322,33 +1294,24 @@ deploy_llm_primary() {
     # The legacy identities (the retired R9V container, the ad hoc
     # experiment container qwen-fp8, the retired glm-probe) hold the same
     # GPUs and die here too.
-    run_privileged systemctl stop frank-primary.service 2>/dev/null || true
+    run_privileged systemctl stop frank-archon.service 2>/dev/null || true
     local ctr
-    for ctr in $LLM_PRIMARY_LEGACY_CONTAINERS "$LLM_PRIMARY_CONTAINER"; do
+    for ctr in $LLM_ARCHON_LEGACY_CONTAINERS "$LLM_ARCHON_CONTAINER"; do
         podman rm -f "$ctr" >/dev/null 2>&1 || true
     done
     # Nothing starts until the port is released: the lucebox cutover
-    # (2026-09-26) and the frank-large cutover (2026-09-16) both failed
+    # (2026-09-26) and the frank-dragoon cutover (2026-09-16) both failed
     # exactly here when the next engine bound 7770 a second too early.
     wait_port_free 7770 || return 1
-    relink_unit frank-primary
-    run_privileged systemctl daemon-reload
-    run_privileged systemctl enable frank-primary.service
-    run_privileged systemctl restart frank-primary.service
-    # Cold start: FP8 page-in plus torch compile/graph capture (~15 min cold,
-    # measured 2026-09-29). Parity with every predecessor on this port.
-    wait_for_health frank-primary http://127.0.0.1:7770/health 1800 || return 1
-    # False-green hardening (the 2026-09-26 lesson): a bare curl against the
-    # port cannot tell WHO answers — a stray probe holding :7770 satisfies
-    # it while the unit is stopped. The deploy is only green if the unit
-    # itself is active with a live MainPID behind the health answer.
-    local main_pid
-    main_pid="$(run_privileged systemctl show -p MainPID --value frank-primary.service)"
-    if [[ -z "$main_pid" || "$main_pid" == "0" ]]; then
-        echo "FAIL: :7770 answered but frank-primary.service has no MainPID — a stray process holds the port" >&2
-        return 1
-    fi
-    echo "frank-primary: health answered by unit MainPID $main_pid"
+    # Cold start: .rad load + PLE pin + expert host-pool upload (the
+    # publisher's compose healthcheck allows a 15-minute start_period) —
+    # the 900-iteration budget is 1800s, parity with every predecessor on
+    # this port. The HTTP listener binds AFTER the full load (main.cpp:
+    # engine.start() then engine.serve()), so during load the port REFUSES
+    # connections — a bare curl is honest here, unlike FreeToken's
+    # 200-while-loading body. (start_root_unit's MainPID check still
+    # guards the stray-port case.)
+    start_root_unit frank-archon 7770 900
 }
 
 wait_for_health() {
@@ -1535,9 +1498,9 @@ deploy_service() {
         anubis) deploy_anubis ;;
         seerr) deploy_seerr ;;
         marreta) deploy_marreta ;;
-        frank-large) deploy_llm_large ;;
-        frank-small) deploy_llm_small ;;
-        frank-primary) deploy_llm_primary ;;
+        frank-dragoon) deploy_llm_dragoon ;;
+        frank-zealot) deploy_llm_zealot ;;
+        frank-archon) deploy_llm_archon ;;
         hermes|hermes-dashboard|hermes-webui) deploy_hermes ;;
         romm|romm-mariadb|romm-redis|mariadb|redis) deploy_romm_stack "$service" ;;
         jellyfin) deploy_jellyfin ;;
@@ -1548,7 +1511,12 @@ deploy_service() {
         tautulli) deploy_tautulli ;;
         prometheus|grafana|loki|alloy|node-exporter|alertmanager) deploy_observability "$service" ;;
         comfyui) deploy_comfyui ;;
-        *) deploy_compose_service "$service" ;;
+        *)
+            # Every deployable service on every target has a handler above
+            # (inventory = allow-list, so nothing unreachable arrives).
+            echo "no handler for service: $service" >&2
+            exit 2
+            ;;
     esac
 }
 

scripts/deploy.sh

@@ -35,7 +35,7 @@ Options:
 Examples:
   ./scripts/deploy.sh dankclaw
   ./scripts/deploy.sh dankclaw --service searxng
-  ./scripts/deploy.sh dankserver --service frank-primary
+  ./scripts/deploy.sh dankserver --service frank-archon
   ./scripts/deploy.sh dankclaw --dry-run
 EOF
 }
@@ -131,31 +131,13 @@ else
 fi
 
 valid_service() {
-    local service="$1"
-    case "$TARGET:$service" in
-        dankclaw:caddy|dankclaw:gluetun|dankclaw:searxng-network|dankclaw:searxng-valkey|\
-        dankclaw:searxng|dankclaw:marreta|dankclaw:pihole|dankclaw:open-webui|dankclaw:gitea-postgres|\
-        dankclaw:gitea-server|dankclaw:homepage|\
-        dankclaw:comfyui|dankclaw:hermes|dankclaw:hermes-dashboard|\
-        dankclaw:hermes-webui|dankclaw:prometheus|dankclaw:grafana|dankclaw:loki|dankclaw:alloy|\
-        dankclaw:alertmanager|\
-        dankclaw:node-exporter|dankclaw:authentik-postgres|dankclaw:authentik-server|\
-        dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:authentik-outpost-ldap|dankclaw:anubis|dankclaw:seerr|\
-        dankclaw:frank-large|dankclaw:frank-small|\
-        dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
-        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:calibre-server|dankserver:plex|dankserver:tautulli|\
-        dankserver:qbittorrent|dankserver:radarr|dankserver:sonarr|\
-        dankserver:lidarr|dankserver:readarr|dankserver:node-exporter|\
-        dankserver:frank-primary|\
-        frankbook-pro:gluetun|frankbook-pro:qbittorrent|frankbook-pro:prowlarr|\
-        frankbook-pro:radarr|frankbook-pro:sonarr|frankbook-pro:lidarr|\
-        frankbook-pro:readarr)
-            return 0
-            ;;
-        *)
-            return 1
-            ;;
-    esac
+    # The inventory is the only allow-list (see scripts/service-map.py);
+    # service-map's "allows" exit code is the answer. The former literal
+    # case list here drifted from reality (it still listed the *arr stack
+    # under dankserver, which moved to frankbook-pro, and a
+    # "searxng-network" name that is a generated systemd unit, not a
+    # deployable service).
+    python3 "$REPO_ROOT/scripts/service-map.py" allows --host "$TARGET" --service "$1" >/dev/null
 }
 
 for service in "${EXPLICIT_SERVICES[@]}"; do

scripts/derive-protected-experts.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""derive-protected-experts.py — rewrite the recipe's protected-expert section
+from a calibration recording. RUNS ON DANKSERVER (venv: numpy).
+
+The selection rule (docs/MOE-W4.md "Protected experts", restated in the recipe):
+an expert whose share of its layer's down-input energy is at least 3% AND
+at least three times its share of the routing is kept bf16; the count must
+be EVEN on each rank's half of the layer (the four-bit GEMM takes the rest
+as two equal tables by parity) — an odd half gains its next most energetic
+non-qualifying expert.
+
+Data: the calibration dir's per-expert down Grams,
+gram.r<rank>.blk.L.ffn_down_exps.<e>.bin — 32-byte RADGRAM2 header
+(magic, k, rank, rows, domain) then k*k f32, named with the checkpoint's
+GLOBAL expert numbering (arch/common/rad_block_moe_fp8.h: ge =
+expert_base + e). rows (header) is the expert's routing count; the trace
+of the Gram is its down-input energy. Rank halves: 0-255, 256-511
+(contiguous expert_base split at TP=2).
+
+Output: the cast-rule lines (recipe format) on stdout, a report on stderr.
+
+Usage: derive-protected-experts.py <calib dir> [--min-share 0.03]
+       [--min-route-mult 3.0]
+"""
+import argparse
+import glob
+import os
+import re
+import struct
+import sys
+
+import numpy as np
+
+NAME_RE = re.compile(r"^gram\.r(\d)\.blk\.(\d+)\.ffn_down_exps\.(\d+)\.bin$")
+
+
+def read_gram(path):
+    """(k, rank, rows, trace) from a RADGRAM2 file (full matrix on disk)."""
+    with open(path, "rb") as f:
+        hdr = f.read(32)
+        magic, k, rank, rows, domain = struct.unpack("<8sIIQI", hdr[:28])
+        if magic != b"RADGRAM2":
+            raise SystemExit(f"not a RADGRAM2 file: {path}")
+        n = k * k
+        a = np.frombuffer(f.read(n * 4), dtype=np.float32)
+        if a.size != n:
+            raise SystemExit(f"short gram file: {path}")
+        tr = float(a.reshape(k, k).diagonal().sum())
+    return k, rank, int(rows), tr
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("calib_dir")
+    ap.add_argument("--min-share", type=float, default=0.03)
+    ap.add_argument("--min-route-mult", type=float, default=3.0)
+    a = ap.parse_args()
+
+    # layer -> global expert -> (rank, rows, energy)
+    data = {}
+    for path in sorted(glob.glob(os.path.join(
+            a.calib_dir, "gram.r*.ffn_down_exps.*.bin"))):
+        m = NAME_RE.match(os.path.basename(path))
+        if not m:
+            continue
+        rank, layer, expert = int(m.group(1)), int(m.group(2)), int(m.group(3))
+        k, _, rows, tr = read_gram(path)
+        data.setdefault(layer, {})[expert] = (rank, rows, tr)
+
+    if not data:
+        raise SystemExit("no per-expert down grams found")
+
+    lines, report = [], []
+    total = 0
+    for layer in sorted(data):
+        experts = data[layer]
+        tot_e = sum(v[2] for v in experts.values())
+        tot_r = sum(v[1] for v in experts.values())
+        if tot_e <= 0 or tot_r <= 0:
+            report.append(f"blk.{layer}: empty recording, skipped")
+            continue
+        qual, pool = [], []
+        for e, (rank, rows, tr) in experts.items():
+            es, rs = tr / tot_e, rows / max(tot_r, 1)
+            rec = (e, rank, es, rs)
+            if es >= a.min_share and es >= a.min_route_mult * rs:
+                qual.append(rec)
+            elif es > 0:
+                pool.append(rec)
+        chosen = {r[0]: (r[2], r[3]) for r in qual}
+        for half in (0, 1):  # rank halves by the contiguous expert_base split
+            n_half = sum(1 for e in chosen if e // 256 == half)
+            if n_half % 2:
+                pool.sort(key=lambda r: -r[2])
+                for cand in pool:
+                    if cand[1] == half and cand[0] not in chosen:
+                        chosen[cand[0]] = (cand[2], cand[3])
+                        report.append(
+                            f"blk.{layer}: half {half} odd -> added e{cand[0]} "
+                            f"(energy {cand[2]*100:.2f}%)")
+                        break
+        for e in sorted(chosen):
+            es, rs = chosen[e]
+            lines.append(f"blk.{layer}.ffn_*_exps.{e}.weight"
+                         f"         cast dtype=bf16")
+            report.append(f"blk.{layer} e{e:3d} (rank {e // 256}): "
+                          f"energy {es*100:5.2f}%, routing {rs*100:5.3f}%, "
+                          f"ratio {es/max(rs,1e-12):6.1f}")
+        total += len(chosen)
+
+    print("\n".join(lines))
+    print("\n".join(report), file=sys.stderr)
+    print(f"total protected: {total}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()

scripts/docker/frank-primary-freetoken.Dockerfile

@@ -1,62 +0,0 @@
-# frank-primary-freetoken.Dockerfile — FreeToken (PR #587 ROCm) serving image
-# for the frank-primary endpoint (dankserver :7770, 1x R9700 gfx1201).
-#
-# Built on dankserver with rootless podman (dank user), same storage the
-# service's `podman run` reads:
-#   podman build -t frank-primary-freetoken:pr587-77a7201 \
-#     -f scripts/docker/frank-primary-freetoken.Dockerfile scripts/docker/
-#
-# Base: the PR's own docs/install_amd.md names this exact image as the
-# known-good ROCm 7.14 stack for gfx1201 (torch 2.11.0+rocm7.14, triton-rocm
-# 3.7 — the original pin; FreeToken main+PR587 accepts torch>=2.11,<2.16 and
-# triton>=3.6,<3.9). There is no rocm7.14+torch2.14 image on Docker Hub (the
-# 2.14 images are rocm10.1.0 — an untested pair for this PR), so the PR doc's
-# verbatim recommendation is the deployed stack.
-#
-# FreeToken source: FlashML-org/FreeToken PR #587 at pinned head
-# 77a7201f98f00d93f618c6cf8b81ffe8360e0899 (branch rocm714_torch214, base
-# main 581fdca3). The PR is ROCm-gated end to end; the NVIDIA/CUDA path is
-# byte-identical to main.
-#
-# Build law from docs/install_amd.md:
-#   - `pip install --no-build-isolation --no-deps -e .` — the image's ROCm
-#     torch is preserved and used to compile the C++/HIP extensions.
-#   - NEVER a plain `pip install -e .` on ROCm: the dependency set is
-#     authored for NVIDIA (flashlib pulls numba + nvidia-cutlass-dsl; torch
-#     metadata pulls cuda-bindings) and the resolve can REPLACE the ROCm
-#     torch with a CUDA build.
-#   - Runtime deps installed explicitly, curated by the same doc. flashinfer
-#     / sgl_kernel / nvidia-cutlass-dsl have no ROCm builds and are
-#     intentionally absent — FreeToken gates them off and falls back to its
-#     Triton kernels on ROCm.
-#
-# Base is digest-pinned (2026-10-05): sha256:a223aee1… is the manifest this
-# build was qualified against; a re-pushed tag cannot change the stack.
-FROM rocm/pytorch@sha256:a223aee17aef5d21c3b9f63436dd19d27d1c665ec8b2f40011c9546cabae2a80
-
-# Pin the PR head, not the branch: a future push to rocm714_torch214 would
-# otherwise silently change the deployed engine.
-# The pip-ROCm torch in this image ships libhiprtc as the VERSIONED
-# libhiprtc.so.7 only; the PR's `_cpu_moe` extension links `-lhiprtc`, and
-# ld looks for the unversioned dev symlink in the ALREADY-LINKED
-# _rocm_sdk_core/lib dir. Create it there (first build failure 2026-10-05:
-# `ld: cannot find -lhiprtc`).
-RUN ln -s libhiprtc.so.7 /opt/venv/lib/python3.12/site-packages/_rocm_sdk_core/lib/libhiprtc.so
-RUN git clone https://github.com/FlashML-org/FreeToken.git /opt/FreeToken \
- && cd /opt/FreeToken \
- && git fetch origin pull/587/head \
- && git checkout 77a7201f98f00d93f618c6cf8b81ffe8360e0899
-
-WORKDIR /opt/FreeToken
-RUN python -m pip install --no-build-isolation --no-deps -e .
-
-# Curated runtime dependencies (docs/install_amd.md). transformers is pinned
-# to the pyproject window (>=5.16,<5.17); the rest are the doc's portable set.
-# torch / torchvision / triton-rocm come from the base image, 1:1 aligned.
-RUN python -m pip install \
-      "transformers>=5.16,<5.17" tokenizers safetensors huggingface_hub \
-      fastapi uvicorn pydantic openai httpx anyio \
-      einops gguf msgpack pyzmq typer rich apache-tvm-ffi \
-      partial-json-parser \
- && python -m pip install --no-deps flashlib==0.3.0 \
- && python -m pip install ninja

scripts/download-frank-archon-swift15.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# download-frank-archon-swift15.sh — payload fetch/verify for the planned
+# frank-archon swap to the Swift 1.5 finetune: ukisai/Swift1.5-Qwen3.8-Flash-Next
+# (BF16 source, 149 files, 360,037,355,038 bytes = 335.3 GiB: 131 safetensors
+# shards + weight-map index + tokenizer + vision preprocessing configs + chat
+# template + licenses). Key set verified identical to the official
+# Qwen/Qwen3.8-Flash-Next base (0 added / 0 missing), so the qwen4exp recipes
+# apply verbatim; the checkpoint ships BF16 with NO quantization_config.
+# Repo is UNGATED — no token needed (never put one on the command line).
+#
+#   bash scripts/download-frank-archon-swift15.sh --fetch         resume/complete
+#   bash scripts/download-frank-archon-swift15.sh                 verify only
+#
+# Fetch uses the vendored scripts/hfget.sh (StillDeadcode's Apache-2.0
+# listing/resume downloader, curl+jq only): per-file size checks against
+# the Hub listing, `-C -` resume, pickle-format duplicates skipped.
+# Verify (default) is three independent agreements: every listed file
+# present with the listed size (catches truncation), the shard count
+# matching the weight-map index (catches omissions), and every shard's
+# sha256 equal to the Hub's LFS oid (catches substituted content).
+# Verify needs only the public API.
+set -euo pipefail
+
+REPO="ukisai/Swift1.5-Qwen3.8-Flash-Next"
+DEST="/home/dank/models/ukisai/Swift1.5-Qwen3.8-Flash-Next"
+EXPECTED_SHARDS=131
+
+mode="verify"
+[[ "${1:-}" == "--fetch" ]] && mode="fetch"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ "$mode" == "fetch" ]]; then
+    # HFGET_JOBS=4 is hfget's default (a few streams saturate the link).
+    bash "$SCRIPT_DIR/hfget.sh" "$REPO" "$DEST" main
+fi
+
+echo "verifying local payload: $DEST"
+fail=0
+
+INDEX="$DEST/model.safetensors.index.json"
+if [[ ! -f "$INDEX" ]]; then
+    echo "  BAD  weight-map index missing: $INDEX" >&2
+    exit 1
+fi
+
+python3 - "$REPO" "$DEST" <<'PY' || fail=1
+import hashlib, json, os, sys, urllib.request
+
+repo, dest = sys.argv[1], sys.argv[2]
+
+def listing():
+    """The tree API, following the Link cursor exactly like hfget.sh."""
+    out, api, pages = [], (
+        f"https://huggingface.co/api/models/{repo}/tree/main"
+        "?recursive=true&expand=true"), 0
+    while api:
+        with urllib.request.urlopen(api) as r:
+            out += json.load(r)
+            api = None
+            link = r.headers.get("Link", "")
+            for part in link.split(","):
+                if 'rel="next"' in part:
+                    api = part[part.find("<") + 1:part.find(">")]
+        pages += 1
+        if pages > 200:
+            raise SystemExit("listing did not terminate")
+    return out
+
+files = [e for e in listing() if e.get("type") == "file"]
+sizes = {e["path"]: e.get("size", 0) for e in files}
+lfs = {e["path"]: e["lfs"]["oid"] for e in files if e.get("lfs")}
+
+bad = 0
+for path, want in sorted(sizes.items()):
+    p = os.path.join(dest, path)
+    if not os.path.isfile(p):
+        print(f"  BAD  {path}: missing")
+        bad += 1
+    elif os.path.getsize(p) != want:
+        print(f"  BAD  {path}: {os.path.getsize(p)} bytes, listing says {want}")
+        bad += 1
+print(f"  {'OK' if bad == 0 else 'FAIL'}: {len(sizes) - bad}/{len(sizes)} files present at listed size")
+if bad:
+    raise SystemExit(1)
+
+# Shard set against the weight-map index.
+wm = json.load(open(os.path.join(dest, "model.safetensors.index.json")))["weight_map"]
+shards = sorted(set(wm.values()))
+print(f"  index maps {len(wm)} tensors across {len(shards)} shards")
+if len(shards) != 131:
+    print(f"  BAD  shard count {len(shards)}, want 131")
+    raise SystemExit(1)
+
+# Content: every LFS-tracked file hashed against the Hub oid. The safetensors
+# shards dominate the bytes; tokenizer/config files ride the same check when
+# the Hub tracks them in LFS (they are plain blobs here, already size-checked).
+todo = [p for p in shards if p in lfs]
+for i, path in enumerate(todo):
+    h = hashlib.sha256()
+    with open(os.path.join(dest, path), "rb") as f:
+        for chunk in iter(lambda: f.read(1 << 24), b""):
+            h.update(chunk)
+    if h.hexdigest() != lfs[path]:
+        print(f"  BAD  {path}: sha256 mismatch (want {lfs[path]})")
+        bad += 1
+    if (i + 1) % 16 == 0:
+        print(f"  ...hashed {i + 1}/{len(todo)}")
+print(f"  {'OK' if bad == 0 else 'FAIL'}: {len(todo) - bad}/{len(todo)} shards sha256-match the Hub")
+if bad:
+    raise SystemExit(1)
+PY
+
+[[ "$fail" -eq 0 ]] || exit 1
+echo "payload verified: 131 shards + index + tokenizer + configs, sizes and sha256 checked"

scripts/download-frank-archon.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# download-frank-archon.sh — payload fetch/verify for frank-archon:
+# the OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 checkpoint (131 safetensors
+# shards + weight-map index + tokenizer + vision preprocessing configs,
+# ~172.8 GB). 2026-10-05: replaces the orcarouter uncensored payload of the
+# FreeToken era (that script lived here; its repo was gated and needed
+# HF_TOKEN — this one is UNGATED and needs no token at all).
+#
+#   bash scripts/download-frank-archon.sh --fetch         resume/complete
+#   bash scripts/download-frank-archon.sh                 verify only
+#
+# Fetch uses the vendored scripts/hfget.sh (StillDeadcode's Apache-2.0
+# listing/resume downloader, curl+jq only): per-file size checks against
+# the Hub listing, `-C -` resume, pickle-format duplicates skipped.
+# Verify (default) is three independent agreements: every listed file
+# present with the listed size (catches truncation), the shard count
+# matching the weight-map index (catches omissions), and every shard's
+# sha256 equal to the Hub's LFS oid (catches substituted content).
+# Verify needs only the public API.
+set -euo pipefail
+
+REPO="Qwen/Qwen3.8-Flash-Next-FP8"
+DEST="/home/dank/models/Qwen/Qwen3.8-Flash-Next-FP8"
+EXPECTED_SHARDS=131
+
+mode="verify"
+[[ "${1:-}" == "--fetch" ]] && mode="fetch"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ "$mode" == "fetch" ]]; then
+    # HFGET_JOBS=4 is hfget's default (a few streams saturate the link).
+    bash "$SCRIPT_DIR/hfget.sh" "$REPO" "$DEST" main
+fi
+
+echo "verifying local payload: $DEST"
+fail=0
+
+INDEX="$DEST/model.safetensors.index.json"
+if [[ ! -f "$INDEX" ]]; then
+    echo "  BAD  weight-map index missing: $INDEX" >&2
+    exit 1
+fi
+
+python3 - "$REPO" "$DEST" <<'PY' || fail=1
+import hashlib, json, os, sys, urllib.request
+
+repo, dest = sys.argv[1], sys.argv[2]
+
+def listing():
+    """The tree API, following the Link cursor exactly like hfget.sh."""
+    out, api, pages = [], (
+        f"https://huggingface.co/api/models/{repo}/tree/main"
+        "?recursive=true&expand=true"), 0
+    while api:
+        with urllib.request.urlopen(api) as r:
+            out += json.load(r)
+            api = None
+            link = r.headers.get("Link", "")
+            for part in link.split(","):
+                if 'rel="next"' in part:
+                    api = part[part.find("<") + 1:part.find(">")]
+        pages += 1
+        if pages > 200:
+            raise SystemExit("listing did not terminate")
+    return out
+
+files = [e for e in listing() if e.get("type") == "file"]
+sizes = {e["path"]: e.get("size", 0) for e in files}
+lfs = {e["path"]: e["lfs"]["oid"] for e in files if e.get("lfs")}
+
+bad = 0
+for path, want in sorted(sizes.items()):
+    p = os.path.join(dest, path)
+    if not os.path.isfile(p):
+        print(f"  BAD  {path}: missing")
+        bad += 1
+    elif os.path.getsize(p) != want:
+        print(f"  BAD  {path}: {os.path.getsize(p)} bytes, listing says {want}")
+        bad += 1
+print(f"  {'OK' if bad == 0 else 'FAIL'}: {len(sizes) - bad}/{len(sizes)} files present at listed size")
+if bad:
+    raise SystemExit(1)
+
+# Shard set against the weight-map index.
+wm = json.load(open(os.path.join(dest, "model.safetensors.index.json")))["weight_map"]
+shards = sorted(set(wm.values()))
+print(f"  index maps {len(wm)} tensors across {len(shards)} shards")
+if len(shards) != 131:
+    print(f"  BAD  shard count {len(shards)}, want 131")
+    raise SystemExit(1)
+
+# Content: every LFS-tracked file hashed against the Hub oid. The safetensors
+# shards dominate the bytes; tokenizer/config files ride the same check when
+# the Hub tracks them in LFS (they are plain blobs here, already size-checked).
+todo = [p for p in shards if p in lfs]
+for i, path in enumerate(todo):
+    h = hashlib.sha256()
+    with open(os.path.join(dest, path), "rb") as f:
+        for chunk in iter(lambda: f.read(1 << 24), b""):
+            h.update(chunk)
+    if h.hexdigest() != lfs[path]:
+        print(f"  BAD  {path}: sha256 mismatch (want {lfs[path]})")
+        bad += 1
+    if (i + 1) % 16 == 0:
+        print(f"  ...hashed {i + 1}/{len(todo)}")
+print(f"  {'OK' if bad == 0 else 'FAIL'}: {len(todo) - bad}/{len(todo)} shards sha256-match the Hub")
+if bad:
+    raise SystemExit(1)
+PY
+
+[[ "$fail" -eq 0 ]] || exit 1
+echo "payload verified: 131 shards + index + tokenizer + configs, sizes and sha256 checked"

scripts/download-frank-dragoon-flashnext.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# download-frank-dragoon-flashnext.sh — fetch frank-dragoon's flash-server v2
+# payload: the Quat3rnion abliterated Swift1.5 checkpoint of peonist's v2
+# .hgn, the REQUIRED lookup table and the optional vision tower from
+# peonist-ai/halogen-qwen3.8-flash-next (both at the revisions the model
+# card pins), and the flat tokenizer the two repos share. All public, no
+# token needed — and a secret would never be passed via argv anyway: the
+# command line is world-readable through /proc, so any token placed there
+# leaks to every process-listing tool on the host.
+#
+# The fetch rules, uniform across every sibling script: curl -f so an
+# access error fails loudly instead of writing the error body as a
+# "successful" tiny artifact; the exact byte count from the Hub tree API;
+# LFS sha256 verification; --verify-only to re-check an existing payload
+# without downloading.
+#
+# File manifest (verified against the Hub tree API on 2026-10-06):
+#   qwen38-flash-next-v2-swift15-abliterated.hgn  66,687,678,464 B  sha256
+#     9c880b8ba48deabfa06172eff1e7572e4fe465e09e97faec6e50c3f6fdcac037
+#     (Quat3rnion main; compacted r2 of the card's 89,775,868,032 B
+#     append-only original — byte-identical live tensors, dropped padding)
+#   qwen38-flash-next-ngram.hgn  51,200,246,144 B  sha256
+#     3450acada94e19aabad88bd49b45eb70304820949c2240fc178067b20ae5dffe
+#     (peonist @5cc17cea; REQUIRED — the engine reads it beside the
+#     checkpoint)
+#   qwen38-flash-next-vision.hgn  897,916,416 B  sha256
+#     d62e0ae553fe88afd3833733d4a4c669f34d20fd8dfce4b9610525bed2134b10
+#     (peonist @e053f488; optional, enables image input)
+#   tokenizer/* @e053f488 — byte-identical to the 27B-era tokenizer
+#     already on disk (tokenizer.json LFS
+#     0997f410c57a1f4e53b09e4be8f4a172d90edd9564368fb0847030937229b9f3);
+#     fetched fresh, never symlinked: a snapshot link points into the
+#     host-side cache directory, which does not exist inside the
+#     container mount, so the link dangles exactly where it is consumed.
+set -euo pipefail
+
+DEST="${FRANK_DRAGOON_MODEL_DIR:-$HOME/models/halogen-flashnext-v2}"
+ABLIT="https://huggingface.co/Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated/resolve/main"
+PEONIST="https://huggingface.co/peonist-ai/halogen-qwen3.8-flash-next/resolve"
+NGRAM_REV="5cc17cea1a10b502b4a5db41d8d2b1a0f22dba26"
+TOK_REV="e053f488b120b99ed2525e6ac99f68c51b3b6179"
+
+FILES=(qwen38-flash-next-v2-swift15-abliterated.hgn
+       qwen38-flash-next-ngram.hgn
+       qwen38-flash-next-vision.hgn
+       tokenizer/tokenizer.json
+       tokenizer/chat_template.jinja
+       tokenizer/generation_config.json
+       tokenizer/merges.txt
+       tokenizer/vocab.json
+       tokenizer/tokenizer_config.json)
+SIZES=(66687678464
+       51200246144
+       897916416
+       12809320
+       8952
+       202
+       3353259
+       6722759
+       17928)
+SHAS=(9c880b8ba48deabfa06172eff1e7572e4fe465e09e97faec6e50c3f6fdcac037
+      3450acada94e19aabad88bd49b45eb70304820949c2240fc178067b20ae5dffe
+      d62e0ae553fe88afd3833733d4a4c669f34d20fd8dfce4b9610525bed2134b10
+      0997f410c57a1f4e53b09e4be8f4a172d90edd9564368fb0847030937229b9f3
+      - - - - - -)
+
+# Fetch source per file: repo base + revision (empty = ABLIT @main).
+SRCS=("$ABLIT"
+      "$PEONIST/$NGRAM_REV"
+      "$PEONIST/$TOK_REV"
+      "$PEONIST/$TOK_REV"
+      "$PEONIST/$TOK_REV"
+      "$PEONIST/$TOK_REV"
+      "$PEONIST/$TOK_REV"
+      "$PEONIST/$TOK_REV"
+      "$PEONIST/$TOK_REV")
+
+VERIFY_ONLY=0
+[ "${1:-}" = "--verify-only" ] && VERIFY_ONLY=1
+
+mkdir -p "$DEST"
+
+for i in "${!FILES[@]}"; do
+    f="${FILES[$i]}"; want="${SIZES[$i]}"; sha="${SHAS[$i]}"; base="${SRCS[$i]}"
+    path="$DEST/$f"
+    mkdir -p "$(dirname "$path")"
+    if [ "$VERIFY_ONLY" -eq 0 ]; then
+        # A file already at the published size skips the fetch entirely:
+        # resuming it would ask the CDN for a range past EOF (416 -> curl
+        # error under set -e), and re-pulling 62 GiB to prove a point is
+        # not what --verify-only is for. sha256 below still decides.
+        if [ -f "$path" ] && [ "$(stat -c %s "$path")" = "$want" ]; then
+            echo "HAVE  $f ($want bytes) — skipping fetch"
+        else
+            echo "FETCH $f -> $path"
+            # HF answers /resolve/ with a 302 to the Xet CDN and curl DROPS
+            # the Range header across redirects — a naive -C - then
+            # "resumes" by pulling the ~1 KB redirect body (measured
+            # 2026-10-05 on the 27B fetch: file frozen 14 MiB short, curl
+            # exit 0). Resolve the effective URL first, then resume
+            # against the CDN, which honors Range.
+            url=$(curl -sfIL -o /dev/null -w '%{url_effective}' "$base/$f") \
+                || { echo "cannot resolve $base/$f" >&2; exit 1; }
+            curl -fL --retry 5 -C - -o "$path" "$url"
+        fi
+    fi
+    [ -f "$path" ] || { echo "MISSING $path (run without --verify-only)" >&2; exit 1; }
+    got="$(stat -c %s "$path")"
+    [ "$got" = "$want" ] || { echo "SIZE $path: $got != $want" >&2; exit 1; }
+    echo "OK   $f ($got bytes)"
+done
+
+echo "byte counts match; verifying sha256 where the Hub publishes an LFS oid..."
+for i in "${!FILES[@]}"; do
+    f="${FILES[$i]}"; sha="${SHAS[$i]}"
+    if [ "$sha" = "-" ]; then
+        echo "OK   $f (plain git blob, size-checked)"
+        continue
+    fi
+    got="$(sha256sum "$DEST/$f" | cut -d' ' -f1)"
+    [ "$got" = "$sha" ] || { echo "SHA256 $f: $got != $sha" >&2; exit 1; }
+    echo "OK   $f sha256"
+done
+echo "DOWNLOAD_DONE $DEST"

scripts/download-frank-dragoon-halogen.sh

@@ -1,16 +1,18 @@
 #!/usr/bin/env bash
-# download-frank-large-halogen.sh — fetch frank-large's halogen payload:
+# download-frank-dragoon-halogen.sh — fetch frank-dragoon's halogen payload:
 # the qwen3.8-27b .hgn checkpoint and the export tokenizer, from the
-# PUBLIC peonist-ai/halogen-qwen3.8-27b repo (no token — and per the fleet
-# secret law, none would ever touch argv).
+# PUBLIC peonist-ai/halogen-qwen3.8-27b repo (no token — and a token
+# would never travel in argv: command lines are world-readable through
+# /proc, so a secret placed there leaks to any process-listing tool).
 #
-# The fetch law, same as every sibling script: curl -f (an access error
-# must not become a "successful" 153-byte artifact), exact byte count from
-# the model card, LFS sha256 verification, --verify-only to re-check an
-# existing payload without downloading.
+# The fetch rules, uniform across every sibling script: curl -f so an
+# access error fails loudly instead of writing the error body as a
+# "successful" tiny artifact; the exact byte count from the model card;
+# LFS sha256 verification; --verify-only to re-check an existing payload
+# without downloading.
 set -euo pipefail
 
-DEST="${FRANK_LARGE_MODEL_DIR:-$HOME/models/halogen-qwen3.8-27b}"
+DEST="${FRANK_DRAGOON_MODEL_DIR:-$HOME/models/halogen-qwen3.8-27b}"
 BASE="https://huggingface.co/peonist-ai/halogen-qwen3.8-27b/resolve/main"
 
 FILES=(qwen3.8-27b-p1w4d-d2.hgn

scripts/download-frank-dragoon-kingjones-uncensored.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Download kingjones777/Qwen3.8-27B-Uncensored-ROCmFP4-STRIX-MTP-GGUF for
-# frank-large (Dankclaw iGPU). Public repo — no auth header, and never a token
+# frank-dragoon (Dankclaw iGPU). Public repo — no auth header, and never a token
 # on the command line (it is world-readable in /proc/<pid>/cmdline).
 #
 # The payload is the repo's Q6 AGENT rung:
@@ -10,7 +10,7 @@
 #     names for MTP serving ("Take Q6 AGENT (114) if you want protected
 #     heads"). Like every ROCmFPX file it loads on nothing but the fork.
 #
-# The other two files frank-large needs are NOT re-downloaded:
+# The other two files frank-dragoon needs are NOT re-downloaded:
 #   * mtp-Qwen3.8-27B-Q4_0.gguf — the uncensored repo redistributes the
 #     ALIGNED repo's draft head byte for byte (identical Hub LFS oid
 #     051a1764…), so it is hardlinked out of the aligned payload dir when that
@@ -25,7 +25,7 @@
 # byte count and the Hub LFS sha256. Idempotent: complete files are skipped.
 #
 # Usage:
-#   scripts/download-frank-large-kingjones-uncensored.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-kingjones-uncensored.sh [DEST_DIR] [--verify-only]
 set -euo pipefail
 
 REPO="kingjones777/Qwen3.8-27B-Uncensored-ROCmFP4-STRIX-MTP-GGUF"

scripts/download-frank-dragoon-kingjones.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Download kingjones777/Qwen3.8-27B-ROCmFP4-STRIX-MTP-GGUF for frank-large
+# Download kingjones777/Qwen3.8-27B-ROCmFP4-STRIX-MTP-GGUF for frank-dragoon
 # (Dankclaw iGPU). Public repo — no auth header, and never a token on the
 # command line (it is world-readable in /proc/<pid>/cmdline).
 #
@@ -24,7 +24,7 @@
 # come from the Hub LFS oids (api/models/<repo>/tree/main).
 #
 # Usage:
-#   scripts/download-frank-large-kingjones.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-kingjones.sh [DEST_DIR] [--verify-only]
 set -euo pipefail
 
 REPO="kingjones777/Qwen3.8-27B-ROCmFP4-STRIX-MTP-GGUF"

scripts/download-frank-dragoon-orca.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# Download and assemble jcbtc/Qwen3.8-Flash-CIRU-STRIX-Orca (the frank-large
+# Download and assemble jcbtc/Qwen3.8-Flash-CIRU-STRIX-Orca (the frank-dragoon
 # model) on Dankclaw.
 #
-#   bash scripts/download-frank-large-orca.sh
-#   bash scripts/download-frank-large-orca.sh --verify-only
+#   bash scripts/download-frank-dragoon-orca.sh
+#   bash scripts/download-frank-dragoon-orca.sh --verify-only
 #
 # The package is 136 GB of Hub-sized transport parts (HF caps new uploads at
 # 50 GB, so the 79 GB main GGUF, the 52 GB PLE payload and the 4 GB MTP head
@@ -105,4 +105,4 @@ fi
 echo "verifying assembled files against SHA256SUMS"
 (cd "$MODEL_DIR" && sha256sum -c SHA256SUMS)
 (cd "$MODEL_DIR/vision" && sha256sum -c SHA256SUMS)
-echo "frank-large payload complete: $MODEL_DIR"
+echo "frank-dragoon payload complete: $MODEL_DIR"

scripts/download-frank-dragoon-q4.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# Download the Q4_K_XL frank-large payload on Dankclaw:
+# Download the Q4_K_XL frank-dragoon payload on Dankclaw:
 #   unsloth/Qwen3.8-27B-GGUF  ->  Qwen3.8-27B-UD-Q4_K_XL.gguf
 #
-#   bash scripts/download-frank-large-q4.sh
-#   bash scripts/download-frank-large-q4.sh --verify-only
+#   bash scripts/download-frank-dragoon-q4.sh
+#   bash scripts/download-frank-dragoon-q4.sh --verify-only
 #
 # Integrity: the file is checked against its declared byte count and sha256
 # (the LFS oid from the Hub tree API, 2026-10-01). NO AUTH HEADER IS USED:
@@ -21,12 +21,12 @@
 # x 2 (K,V) x 2 B), so 4 sessions x 163840 ctx = 640,000 tokens = 39.06 GiB.
 #
 # The speculative drafter is UNCHANGED and still fetched by its own script
-# (scripts/download-frank-large.sh, z-lab's Hub repo). That name must not
-# appear here at all — the frank-large seam greps THIS file for it to prove
+# (scripts/download-frank-dragoon.sh, z-lab's Hub repo). That name must not
+# appear here at all — the frank-dragoon seam greps THIS file for it to prove
 # the drafter was not folded into the payload fetch.
 #
 # NOTE ON MTP: this payload has no baked-in MTP head (the Hub repo ships one
-# separately as MTP/mtp-Qwen3.8-27B-Q4_0.gguf). frank-large does not need it —
+# separately as MTP/mtp-Qwen3.8-27B-Q4_0.gguf). frank-dragoon does not need it —
 # spec decode here is the block-diffusion drafter, not MTP.
 set -euo pipefail
 

scripts/download-frank-dragoon-swift.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Download the Swift-1.5 frank-large candidate on Dankclaw:
+# Download the Swift-1.5 frank-dragoon candidate on Dankclaw:
 #   ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF
 #     Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-UD-Q8_K_XL.gguf
 #
-#   bash scripts/download-frank-large-swift.sh
-#   bash scripts/download-frank-large-swift.sh --verify-only
+#   bash scripts/download-frank-dragoon-swift.sh
+#   bash scripts/download-frank-dragoon-swift.sh --verify-only
 #
 # Integrity: the file is checked against its declared byte count and sha256
 # (the LFS oid from the Hub, 2026-09-28). NO AUTH HEADER IS USED: the repo is
@@ -15,9 +15,9 @@
 # Layout after a successful run (MODEL_DIR):
 #   Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-UD-Q8_K_XL.gguf  31457990272
 #
-# This is the CANDIDATE payload, not the deployed one. frank-large still
-# serves scripts/download-frank-large.sh's output; do not repoint
-# frank-large.env at MODEL_DIR until the gufo load test passes.
+# This is the CANDIDATE payload, not the deployed one. frank-dragoon still
+# serves scripts/download-frank-dragoon.sh's output; do not repoint
+# frank-dragoon.env at MODEL_DIR until the gufo load test passes.
 set -euo pipefail
 
 MODEL_DIR="/home/dank/models/Swift-1.5-Qwen3.8-27B-Uncensored-MTP-UD-Q8_K_XL"

scripts/download-frank-dragoon-unsloth.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # Download unsloth/Qwen3.8-Flash-Next-GGUF:UD-IQ4_XS (the
-# frank-large model) on Dankclaw.
+# frank-dragoon model) on Dankclaw.
 #
-#   bash scripts/download-frank-large-unsloth.sh
-#   bash scripts/download-frank-large-unsloth.sh --verify-only
+#   bash scripts/download-frank-dragoon-unsloth.sh
+#   bash scripts/download-frank-dragoon-unsloth.sh --verify-only
 #
 # The UD-IQ4_XS GGUF ships as three llama.cpp split parts (HF caps uploads at
 # 50 GB). The parts ARE the canonical payload: the serve script points -m at
@@ -112,4 +112,4 @@ if [[ "$mode" == "download" ]]; then
     [[ -e "$MODEL_DIR/vision/mmproj-F16.gguf" ]] || mv "$MODEL_DIR/mmproj-F16.gguf" "$MODEL_DIR/vision/"
 fi
 
-echo "frank-large payload complete: $MODEL_DIR"
+echo "frank-dragoon payload complete: $MODEL_DIR"

scripts/download-frank-dragoon.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Download the frank-large payload on Dankclaw:
+# Download the frank-dragoon payload on Dankclaw:
 #   - unsloth/Qwen3.8-27B-GGUF:UD-Q8_K_XL (the 27B dense main GGUF)
 #   - z-lab/Qwen3.8-27B-DFlash2-GGUF:Q4_K_M (the DFlash2 drafter)
 #
-#   bash scripts/download-frank-large.sh
-#   bash scripts/download-frank-large.sh --verify-only
+#   bash scripts/download-frank-dragoon.sh
+#   bash scripts/download-frank-dragoon.sh --verify-only
 #
 # Integrity: every file is checked against its declared byte count and sha256
 # (the values below are the LFS oids from the Hub, 2026-09-21). An HF token
@@ -86,4 +86,4 @@ if [[ "$mode" == "download" ]]; then
     done
 fi
 
-echo "frank-large payload complete: $MODEL_DIR"
+echo "frank-dragoon payload complete: $MODEL_DIR"

scripts/download-frank-primary.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-# Payload inventory/verification for frank-primary:
-# orcarouter/Qwen3.8-Flash-Next-Uncensored-FP8 (compressed-tensors FP8, 131
-# shards + weight-map index, ~172.8 GiB) — the tcclaviger-stack payload that
-# became frank-primary on 2026-09-29.
-#
-#   bash scripts/download-frank-primary.sh --verify-only   (the ONLY mode)
-#   bash scripts/download-frank-primary.sh --fetch
-#
-# THIS REPO IS GATED (401 anonymous — measured 2026-09-29): anonymous fetch
-# is impossible and the tree API masks LFS hashes, so a byte-exact upstream
-# manifest cannot be built without the authed endpoint. The payload on
-# /home/dank/models was fetched with the operator's HF token (out of band:
-# HF_TOKEN in the environment, never in argv) at bring-up time.
-#
-# Modes:
-#   --fetch       resume any missing/truncated shard via `hf download` with
-#                 HF_TOKEN from the environment (NEVER passed on the command
-#                 line — a -H auth header is world-readable in
-#                 /proc/<pid>/cmdline, the 2026-09-16 leak).
-#   --verify-only default: local integrity check — shard count vs the
-#                 weight-map index, every file nonzero and its size equal to
-#                 the index's declared total, plus sha256 of every shard
-#                 (slow, ~10 min for 173 GiB).
-set -euo pipefail
-
-REPO="orcarouter/Qwen3.8-Flash-Next-Uncensored-FP8"
-DEST="/home/dank/models/Qwen3.8-Flash-Next-Uncensored-FP8"
-EXPECTED_SHARDS=131
-
-mode="verify"
-[[ "${1:-}" == "--fetch" ]] && mode="fetch"
-
-if [[ "$mode" == "fetch" ]]; then
-    : "${HF_TOKEN:?--fetch needs HF_TOKEN in the environment (never argv)}"
-    export HF_TOKEN
-    mkdir -p "$DEST"
-    hf download "$REPO" --local-dir "$DEST"
-fi
-
-echo "verifying local payload: $DEST"
-fail=0
-
-# The weight-map index is the source of truth for the shard set.
-INDEX="$DEST/model.safetensors.index.json"
-if [[ ! -f "$INDEX" ]]; then
-    echo "  BAD  weight-map index missing: $INDEX" >&2
-    exit 1
-fi
-
-# Every index entry must exist, nonzero, and sized equal to the map's total.
-python3 - "$INDEX" "$DEST" <<'PY' || fail=1
-import json, os, sys
-index, dest = sys.argv[1], sys.argv[2]
-wm = json.load(open(index))["weight_map"]
-files = sorted(set(wm.values()))
-print(f"  index maps {len(wm)} tensors across {len(files)} files")
-bad = 0
-total = 0
-for f in files:
-    p = os.path.join(dest, f)
-    if not os.path.isfile(p) or os.path.getsize(p) == 0:
-        print(f"  BAD  {f}: missing or zero bytes" )
-        bad += 1
-    else:
-        total += os.path.getsize(p)
-print(f"  {'OK' if bad == 0 else 'FAIL'}: {len(files) - bad}/{len(files)} files present, {total/2**30:.1f} GiB total")
-raise SystemExit(1 if bad else 0)
-PY
-
-# Shard count gate (what the serve script and deployer check).
-n="$(find "$DEST" -maxdepth 1 -name 'model-*-of-*.safetensors' | wc -l)"
-if [[ "$n" != "$EXPECTED_SHARDS" ]]; then
-    echo "  BAD  shard count: found $n, want $EXPECTED_SHARDS" >&2
-    fail=1
-else
-    echo "  OK   shard count $n"
-fi
-
-if [[ "${2:-}" == "--hash" || "${VERIFY_HASH:-0}" == "1" ]]; then
-    echo "hashing every shard (slow)..."
-    cd "$DEST"
-    sha256sum -c --quiet model.safetensors.index.json 2>/dev/null || \
-    sha256sum model-*-of-00131.safetensors > /dev/null  # presence check; content hash list printed on demand
-fi
-
-[[ "$fail" -eq 0 ]] || exit 1
-echo "payload inventory OK: $EXPECTED_SHARDS shards + index present"

scripts/download-frank-small.sh

@@ -1,87 +0,0 @@
-#!/usr/bin/env bash
-# Download the frank-small payload for llama.cpp on the RTX 3090:
-# ornith-ai/Ornith-1.5-9B-GGUF:Q8_0 plus its vision projector
-# (the GGUF carries no `v.*` tensors — the tower lives only in the mmproj, so
-# without this file the endpoint is text-only by construction). Public repo —
-# no auth header, and never a token on the command line (it is world-readable
-# in /proc/<pid>/cmdline).
-#
-# Fresh downloads, no resume (`curl -C -` once produced a 213 MB oversized file
-# on a 31 GiB payload); -f/--fail-with-body so an HTTP 401 is not a success,
-# then byte count and the Hub LFS sha256. Idempotent: complete files are
-# skipped.
-#
-# 2026-10-05 (Frank): the rung is Ornith-1.5-9B Q8_0. The payload moved off
-# MiMo-V2.6 (Q6_K) to Ornith because it is the fleet's own model and it is the
-# only one the harness's own prompt recipes were written against; Q8_0 was the
-# rung chosen so the quant does not cost the throughput this endpoint already
-# runs at. The Q5_K_M file this script served from 2026-10-02 stays on disk at
-# /home/dank/models/MiMo-Q5KM/ (6876124704 B, LFS oid
-# 04cf46f2b5584ef922697d6c063f94879434fb86c467f1a09e52daf0cddaf35f) as the
-# rollback target; re-fetch it from the same repo with the same recipe.
-#
-# Usage:
-#   scripts/download-frank-small.sh [DEST_DIR] [--verify-only]
-set -euo pipefail
-
-REPO="ornith-ai/Ornith-1.5-9B-GGUF"
-BASE="https://huggingface.co/${REPO}/resolve/main"
-
-DEST=""
-VERIFY_ONLY=0
-for arg in "$@"; do
-    case "$arg" in
-        --verify-only) VERIFY_ONLY=1 ;;
-        *) DEST="$arg" ;;
-    esac
-done
-DEST="${DEST:-/home/dank/models/Ornith-Q8}"
-
-# name bytes sha256 (the sha256 is the LFS oid in the repo's pointer file)
-FILES=(
-  "Ornith-1.5-9B-Q8_0.gguf 9786060384 22086870b009dbe9815ee752c48a82de930118a7c5ce5599590892ae03b8b010"
-  "mmproj-Ornith-1.5-9B-BF16.gguf 921704672 626f9f90627402a6bf4a999111d0fbd69b5fcca7aa8ba089d69e5f10e8858e1d"
-)
-
-mkdir -p "$DEST"
-status=0
-for entry in "${FILES[@]}"; do
-  read -r name size sha <<<"$entry"
-  f="$DEST/$name"
-  have=0
-  if [[ -f "$f" ]] && [[ "$(stat -c%s "$f")" == "$size" ]]; then
-    if sha256sum -c --quiet <(printf '%s  %s\n' "$sha" "$f"); then
-      have=1
-    fi
-  fi
-  if (( have )); then
-    echo "OK        $name"
-    continue
-  fi
-  if (( VERIFY_ONLY )); then
-    echo "MISSING   $name"
-    status=1
-    continue
-  fi
-  echo "FETCHING  $name"
-  tmp="$f.part"
-  curl -fsSL --fail-with-body -o "$tmp" "$BASE/$name"
-  mv "$tmp" "$f"
-  if [[ "$(stat -c%s "$f")" != "$size" ]]; then
-    echo "SIZE FAIL $name ($(stat -c%s "$f") != $size)"
-    status=1
-    continue
-  fi
-  if ! sha256sum -c --quiet <(printf '%s  %s\n' "$sha" "$f"); then
-    echo "SHA FAIL  $name"
-    status=1
-    continue
-  fi
-  echo "VERIFIED  $name"
-done
-if (( status == 0 )); then
-  echo "DOWNLOAD_DONE $DEST"
-else
-  echo "DOWNLOAD_FAILED $DEST" >&2
-fi
-exit "$status"

scripts/download-frank-zealot.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Download the frank-zealot payload for llama.cpp on the RTX 3090:
+# HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive at **Q6_K** plus the
+# PUBLISHER's OWN vision projector (the BF16 mmproj — the model is natively
+# multimodal, so this file is the endpoint's eyes). Public repo — no auth
+# header, and never a token on the command line (it is world-readable in
+# /proc/<pid>/cmdline).
+#
+# Fresh downloads, no resume (`curl -C -` once produced a 213 MB oversized
+# file on a 31 GiB payload); -f/--fail-with-body so an HTTP error is not a
+# success, then byte count and sha256. The Hub exposes no LFS oid for this
+# repo (Xet storage), so the sha256 values below were computed locally after
+# the first verified fetch — byte counts match the Hub's declared sizes.
+# A sha of "-" means "first fetch: size-verified, sha printed for pinning".
+# Idempotent: complete files are skipped.
+#
+# 2026-10-07 (Frank): the payload moved to Qwen3.5-9B-Uncensored Q6_K at
+# 2 x 200,704 (qwen35 hybrid: 32 layers, 8 full-attention + 24 Gated
+# DeltaNet, no MTP tensors in this file). Rollback payloads stay on disk:
+# /home/dank/models/Gemma4-26B-A4B/ (Q4_K_M, the 2026-10-07 era being
+# replaced), Swift15-UncIQ3XXS/, MiMo-Q6K/, MiMo-Q5KM/, Ornith-Q8/.
+#
+# Usage:
+#   scripts/download-frank-zealot.sh [DEST_DIR] [--verify-only]
+set -euo pipefail
+
+DEST=""
+VERIFY_ONLY=0
+for arg in "$@"; do
+    case "$arg" in
+        --verify-only) VERIFY_ONLY=1 ;;
+        *) DEST="$arg" ;;
+    esac
+done
+DEST="${DEST:-/home/dank/models/Qwen35-9B-HauhauCS-Q6K}"
+
+# repo | hub-name | dest-name | bytes | sha256 (computed locally; Xet repo)
+FILES=(
+  "HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive|Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf|Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf|7359259008|c0ba7beb68fd3fe47891bd549486d38dcf62d00817296ea314ad37017f5a4986"
+  "HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive|mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf|mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf|921704448|05f662501f8bd45607b079723a3e238a4e888fd085a10a53f4057a0e250f6934"
+)
+
+status=0
+for entry in "${FILES[@]}"; do
+  IFS='|' read -r repo hubname destname size sha <<<"$entry"
+  url="https://huggingface.co/${repo}/resolve/main/${hubname}"
+  f="$DEST/$destname"
+  have=0
+  if [[ -f "$f" ]] && [[ "$(stat -c%s "$f")" == "$size" ]]; then
+    if [[ "$sha" == "-" ]]; then
+      have=1
+    elif sha256sum -c --quiet <(printf '%s  %s\n' "$sha" "$f"); then
+      have=1
+    fi
+  fi
+  if (( have )); then
+    echo "OK        $destname"
+    continue
+  fi
+  if (( VERIFY_ONLY )); then
+    echo "MISSING   $destname"
+    status=1
+    continue
+  fi
+  echo "FETCHING  $destname (from $repo)"
+  tmp="$f.part"
+  curl -fsSL --fail-with-body -o "$tmp" "$url"
+  mv "$tmp" "$f"
+  if [[ "$(stat -c%s "$f")" != "$size" ]]; then
+    echo "SIZE FAIL $destname ($(stat -c%s "$f") != $size)"
+    status=1
+    continue
+  fi
+  if [[ "$sha" == "-" ]]; then
+    echo "VERIFIED  $destname (size only) sha256=$(sha256sum "$f" | cut -d' ' -f1)"
+    continue
+  fi
+  if ! sha256sum -c --quiet <(printf '%s  %s\n' "$sha" "$f"); then
+    echo "SHA FAIL  $destname"
+    status=1
+    continue
+  fi
+  echo "VERIFIED  $destname"
+done
+if (( status == 0 )); then
+  echo "DOWNLOAD_DONE $DEST"
+else
+  echo "DOWNLOAD_FAILED $DEST" >&2
+fi
+exit "$status"

scripts/fleet-probes-swift15.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# fleet-probes-swift15.sh — RUNS ON DANKSERVER. The cutover contract probes.
+set -uo pipefail
+B=http://localhost:7770/v1
+
+echo "== vision (solid red 512px, expect 'Red')"
+python3 - <<'PY'
+import base64, json, urllib.request, struct, zlib
+def png(color):
+    w = h = 512
+    raw = b"".join(b"\x00" + bytes(color) * w for _ in range(h))
+    def chunk(t, d):
+        c = t + d
+        return struct.pack(">I", len(d)) + c + struct.pack(">I", zlib.crc32(c))
+    return (b"\x89PNG\r\n\x1a\n"
+            + chunk(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0))
+            + chunk(b"IDAT", zlib.compress(raw)) + chunk(b"IEND", b""))
+b64 = base64.b64encode(png((255, 0, 0))).decode()
+body = json.dumps({"model": "frank-archon", "max_tokens": 256, "temperature": 0,
+    "messages": [{"role": "user", "content": [
+        {"type": "image_url", "image_url": {"url": "data:image/png;base64," + b64}},
+        {"type": "text", "text": "What color is this image? Answer with one word."}]}]}).encode()
+r = urllib.request.Request("http://localhost:7770/v1" + "/chat/completions",
+                           data=body, headers={"Content-Type": "application/json"})
+d = json.load(urllib.request.urlopen(r, timeout=300))
+m = d["choices"][0]["message"]
+ans = (m.get("content") or m.get("reasoning_content") or "")
+print("VISION ANSWER:", ans[:80].replace("\n", " "))
+PY
+
+echo "== tools (expect tool_calls)"
+curl -s -m 120 $B/chat/completions -H 'Content-Type: application/json' -d '{
+ "model":"frank-archon","temperature":0,"max_tokens":128,
+ "messages":[{"role":"user","content":"What is 23 times 47? Use the calculator tool."}],
+ "tools":[{"type":"function","function":{"name":"calculator","description":"evaluate arithmetic",
+ "parameters":{"type":"object","properties":{"expr":{"type":"string"}},"required":["expr"]}}}]}' \
+ | python3 -c 'import json,sys; d=json.load(sys.stdin); m=d["choices"][0]["message"]; print("TOOL_CALLS:", m.get("tool_calls"))'
+
+echo "== reasoning_effort fold (xhigh/medium/low/high all 200 on froggeric v22.5)"
+for lvl in xhigh medium low high; do
+  code=$(curl -s -o /dev/null -w "%{http_code}" -m 120 $B/chat/completions \
+    -H 'Content-Type: application/json' \
+    -d "{\"model\":\"frank-archon\",\"max_tokens\":8,\"reasoning_effort\":\"$lvl\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}")
+  echo "  reasoning_effort=$lvl -> HTTP $code"
+done
+
+echo "== reasoning_content channel"
+curl -s -m 120 $B/chat/completions -H 'Content-Type: application/json' \
+ -d '{"model":"frank-archon","max_tokens":64,"messages":[{"role":"user","content":"Is 97 prime? Think briefly."}]}' \
+ | python3 -c 'import json,sys; m=json.load(sys.stdin)["choices"][0]["message"]; print("has reasoning_content:", bool(m.get("reasoning_content")), "| content:", (m.get("content") or "")[:60].replace(chr(10)," "))'
+
+echo "== response_format json_object"
+curl -s -m 120 $B/chat/completions -H 'Content-Type: application/json' \
+ -d '{"model":"frank-archon","max_tokens":64,"response_format":{"type":"json_object"},"messages":[{"role":"user","content":"Return JSON {\"ok\": true}"}]}' \
+ | python3 -c 'import json,sys; d=json.load(sys.stdin); print("JSON MODE:", (d["choices"][0]["message"].get("content") or "")[:60])'
+echo "PROBES_DONE"

scripts/frank-archon-expert-activity.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Measure per-block / per-expert expert-routing activity on live frank-primary.
+"""Measure per-block / per-expert expert-routing activity on live frank-archon.
 
 Method: AMD IBS op sampling (data addresses, `perf record -e ibs_op// --data`)
 on the llama-server process while concurrent generations of mixed content run.
@@ -11,13 +11,13 @@ Tensor extents are DERIVED from consecutive GGUF header offsets — no quant
 type-size table (those are easy to get subtly wrong; a wrong per-element size
 silently under-covers each tensor and dumps tail samples into a junk bucket).
 
-Fleet law this instrument established (2026-09-26, 75 s window, 4 mixed
-streams, 2.7M expert-tensor samples): per-BLOCK read volume is FLAT
-(0.93x-1.08x of mean across all 40 CPU-resident blocks) because MoE top-k
-routing fires every block every token — there are no "most active layers" at
-`-ot` granularity. The real skew is per-EXPERT (top 10% of (block,expert)
-cells carry ~40% of samples), which tensor-level overrides cannot reach.
-Any 8 GPU-resident blocks are therefore equivalent; COUNT is the only lever.
+What this instrument settles: per-BLOCK expert read volume is FLAT across
+all CPU-resident blocks, because MoE top-k routing fires every block on
+every token — there are no "most active layers" at `-ot` granularity. The
+real skew is per-EXPERT: a small fraction of (block,expert) cells carries
+most of the samples, and tensor-level overrides cannot reach that level.
+Any fixed number of GPU-resident blocks is therefore equivalent; COUNT is
+the only lever.
 
 Usage (needs passwordless sudo for perf only; model files must be readable):
   fp-expert-activity.py <pid> [duration_s]        # dump + sample + analyze

scripts/frank-archon.env

@@ -0,0 +1,230 @@
+# frank-archon.env — radiance (StillDeadcode, Apache-2.0) serving
+# ukisai/Swift1.5-Qwen3.8-Flash-Next converted to GPTQ w4 (MODEL_FILE below,
+# built by scripts/convert-swift15-w4dn8.sh) on BOTH R9700s (TP=2),
+# dankserver :7770.
+#
+# SHAPE (2026-10-11): 2 decode slots x 200,000 tokens with an UNQUANTIZED
+# (bf16) KV cache — the pool is sized for the pair, and the weights slab pays
+# for it (see the KV block). The fp8-native payload this file was written for
+# is the rollback target and keeps its own trio under the fp8-native runbook.
+#
+# 2026-10-05 cutover from FreeToken (PR #587 ROCm, one card, experts in
+# pinned host RAM; git tag frank-archon-freetoken-pr587-20261005 is the
+# pre-cutover state — its unit/env/serve trio and Dockerfile are all in the
+# tag and rebuildable). Before that: tcclaviger vLLM fork (tag
+# frank-archon-vllm-shapeG-20261003).
+#
+# WHY RADIANCE: the engine is C++/HIP with libr4d kernels built for
+# gfx1201, drives `podman run` directly from the digest-pinned
+# stilldeadcode/radiance image (287 MiB; host needs only the amdgpu driver),
+# and its qwen4exp plugin reads the modelopt FP8 encoding NATIVELY
+# (`X.weight_scale_inv` is the scale plane — checkpoint.h). The PLE n-gram
+# table (51B params, 47.7 GiB) is served from pinned host RAM via io_uring
+# reads — Frank's call: "Native FP8. Experts from ram. Pin the PLE to ram."
+# The 4-bit-codebook publisher shape (qwen3.8-next-flash-fp8-iq4r-moe.rad,
+# --host-pool-mib 12288) remains the documented fallback if the native
+# container proves unbootable.
+#
+# PAYLOAD: /home/dank/models/rad/qwen4exp-fp8-native.rad — a rad-convert
+# NO-RECIPE pure copy of the official 131-shard checkpoint (every weight
+# keeps its block-FP8 encoding; ~161 GiB). The convert runs against a
+# staging dir whose config.json drops `quantization_config`: the descriptor
+# string is only the plugin SELECTION key (spec §2.4 — exact match, no
+# fallback), and no shipped plugin claims (qwen4exp, "fp8"); the shipped
+# qwen4exp plugin claims (qwen4exp, "") which is what recipe-built
+# containers carry. Per-weight encodings are data, not the descriptor —
+# removing the key changes nothing about what the weights hold. Built by
+# scripts/build-frank-archon-rad.sh (staging + convert + rad-info).
+#
+# SERVING FACTS (docs/GUIDE.md, docs/DOCKER.md, compose/flashnext.yaml):
+# - The HTTP listener binds AFTER the full load (main.cpp: engine.start()
+#   then engine.serve()) — during load the port refuses connections, so a
+#   bare curl /health gate is honest. /health == /ping: 200 JSON while
+#   serving, 503 only while stopping (core/server/admin.cpp:385).
+# - Reasoning: --reasoning-format defaults to auto, emitting thinking in
+#   `reasoning_content` (config.cpp). Tool calls: the qwen3.8 dialect, from
+#   the chat format. Both need no parser flags.
+# - Sampling: the OpenAI endpoint accepts temperature, top_p, top_k, min_p,
+#   typical_p, presence_penalty, frequency_penalty, repetition_penalty,
+#   repeat_last_n, chat_template_kwargs, reasoning_effort,
+#   enable_thinking, preserve_thinking (core/server/oai.cpp:194-205) —
+#   models.yml's extraBody set is fully inside it. Unknown params are
+#   refused (400), which is why nothing unverified rides the wire.
+# - MTP: the official checkpoint carries the mtp.* head (3,101 tensors,
+#   mtp_num_hidden_layers=1) and the plugin probes draft depth 3 — the
+#   publisher's throughput peak for this model. Stated explicitly with
+#   --num-speculative-tokens 3.
+# - The fused TP all-reduce is declared over max-num-seqs x
+#   (1 + --num-speculative-tokens) rows; 2 x 3 = 6 rows, under the 25-row
+#   exactness bound of the wht6 wire.
+# Engine pin: Codeberg tag v1.0.13 (commit 53282fa), Docker Hub tag 1.0.13,
+# index digest below. REJECTED UPGRADE: 1.2.0 (sha256:665775ed1d90de6dbb
+# 25558e07fc60d20328f1346f96f3c6e00845eb763f01fa, tag 1.2.0, commit
+# e95d397) was benched 2026-10-06 on this exact shape (fp8-native rad,
+# vram pair, spec 2, seqs 3, 43.6k greedy probe): decode 29.21 t/s and
+# draft acceptance 0.7123 vs the 1.0.13 control's 30.08 and 0.7549.
+# Acceptance on the greedy harness is deterministic (the control
+# reproduced the recorded 0.755 exactly), so the drop is a real numerics
+# change — the 1.2.0 MoE weight-rotation change (92b8aaf) is the named
+# suspect; decode loss tracks the acceptance ratio (0.943 vs 0.945).
+# The vram-pair translation itself is exact (1.2.0 boot ledger took
+# vram_weights 25.46 GiB / vram_kv 3.46 GiB per card byte-identical to
+# the 1.0.13 ledger at EVC 0.82). Re-test 1.2.0+ when the rotation change
+# is untangled; 1.2.0 also REMOVED --expert-vs-cache-ratio in favour of
+# the --vram-weights-mib / --vram-kv-mib pair (core/config.cpp) — this
+# file already uses the pair, which BOTH pins accept (rollback symmetry).
+FRANK_ARCHON_IMAGE=stilldeadcode/radiance@sha256:4c3f484564bb2872784e46b0a59cbd71becc9c1e746e301a3596ffae253c322e
+# The .rad container FILE (mounted under /models) and the state dir for the
+# prefix-cache disk tier (mounted rw at /data). The model dir holds ONLY
+# .rad files; the raw HF download and its staging dir live beside it and
+# are never mounted.
+FRANK_ARCHON_MODEL_DIR=/home/dank/models/rad
+FRANK_ARCHON_MODEL_FILE=qwen4exp-swift15-w4dn8-i8-hc8m.rad
+FRANK_ARCHON_STATE_DIR=/home/dank/radiance-state
+# The state dir's tune/ subdirectory holds rad-tune's kernel-selection
+# cache (the engine's selector reads $RADIANCE_HOME/tune/<machine>.tune
+# at boot; $RADIANCE_HOME defaults to /opt/radiance, in the image, so the
+# cache must ride a host mount — serve script mounts it, see the runbook's
+# "Tuning levers").
+# Container identity is the SERVICE name (Frank's call, 2026-10-05): one
+# name across systemctl and podman ps. The runtime changes; the name does
+# not. The legacy list retires every predecessor identity that could hold
+# the GPUs or the port.
+FRANK_ARCHON_CONTAINER=frank-archon
+FRANK_ARCHON_LEGACY_CONTAINERS="frank-archon-qwen frank-archon-r9v qwen-fp8 glm-probe"
+# Served model id — Protoss name (wire rename 2026-10-09). The container,
+# unit, scripts and this file keep the frank-archon name above; only the
+# alias on the wire moved. Radiance validates the requested model name, so
+# every client (harness, bench scripts, probes) MUST send this value.
+FRANK_ARCHON_SERVED_NAME=frank-archon
+FRANK_ARCHON_PORT=7770
+# Frank's chat-template call: froggeric's fixed Qwen3.8 template (the
+# repo's root chat_template.jinja, vendored here; the checkpoint's own
+# template is baked into the .rad by rad-convert and this overrides it).
+# Radiance derives the reasoning/tool-call reply format from it.
+FRANK_ARCHON_TEMPLATE=/home/dank/serverAppConfigs/scripts/qwen38-froggeric-v22.5.jinja
+
+# --- engine shape (the boot ledger arbitrates every number below) ---------
+# Tensor parallel: BOTH R9700s. The board swap (2026-09-20, ProArt B850
+# x8/x8 on root ports) made collectives legal on this host; radiance's TP
+# wire is libr4d's own, not RCCL.
+FRANK_ARCHON_TP=2
+# Lossy WHT 6-bit wire for large all-reduces (publisher's production choice:
+# +5.6-6.3% prefill, ~-1.3% 8-stream decode at TP2). min-kb stays the
+# engine default.
+FRANK_ARCHON_TP_WIRE=wht6
+# Decode slots: TWO, so the served window is a CAPACITY CONTRACT — two
+# concurrent conversations of --max-model-len fit the KV pool (see the KV
+# block below). Slot-count limits observed on other runtimes do NOT
+# transfer: a "this slot count cannot boot" refusal is usually that
+# runtime's compiler specializing shapes (e.g. a ConstraintViolationError
+# from shape specialization on query_start_loc), not a property of the
+# engine now running. This engine boots seqs 2, and seqs 2
+# vs 3 decode measurements land inside each other's noise floor. Side
+# benefit: the fused TP all-reduce is declared over seqs x (1 + spec) = 6
+# rows, under the 25-row bound at which the wht6 wire stays EXACT
+# (single-sequence decode and any step of <= 25 rows is bit-exact; only
+# busier steps are lossy).
+FRANK_ARCHON_MAX_SEQS=2
+# Served window. Native is 262,144; 200,000 is the publisher's production
+# value (compose) and what models.yml's contextWindow must quote — a longer
+# prompt is refused by the engine, never truncated. The engine treats
+# `kv group tokens >= max-model-len` as a HARD limit ("ONE request longer
+# than N tokens is accepted by the API and then refused as too large to ever
+# fit — this is a hard limit, not a backing ratio"), so the pool is sized
+# for seqs x maxlen, not for one sequence.
+FRANK_ARCHON_MAX_MODEL_LEN=200000
+FRANK_ARCHON_PLACEMENT=expert_tiered
+# Pinned host pool for the expert rows that do not fit VRAM. vram_weights and
+# this pool serve the per-rank resident set TOGETHER: at the fp8-KV pair
+# (26071/3543) the ledger showed the VRAM slab filled to 259 KiB of slack,
+# i.e. the pair was exactly sized. Cutting vram-weights by 3.8 GiB to pay for
+# the bf16 KV pool SPILLS ~3.8 GiB/rank here, so the pool moves with it —
+# under-sizing it is a boot failure (36864 refused the boot in the fp8 era).
+# The boot ledger's coverage line remains the referee, not this arithmetic.
+FRANK_ARCHON_HOST_POOL_MIB=44928
+# VRAM left unclaimed per card (publisher default 96 MiB).
+FRANK_ARCHON_GPU_HEADROOM_MIB=96
+# VRAM split of claimed memory per card, MiB (0 = derive from the card).
+# THE CEILING, measured on this host 2026-10-11: card 31,856 MiB, a boot
+# consumes 1,710 MiB OUTSIDE both budgets (driver context + activation arena
+# 990 + hardware queues 100 + headroom 96 + step staging), and the fp8 pair
+# settled at 1,379 MiB free — so `vram_weights + vram_kv <= 29,120 MiB` keeps
+# >= 1 GiB free. The pair below is exactly that sum.
+# THE PRICE, and it is paid twice: on this engine idle KV VRAM is ALSO the
+# expert cache's spillover (`mover: 2275 slots can be lent out of the KV
+# cache (2.69 GiB)`, `arena: lends 740 MiB while steps are <= 256 tokens`),
+# so a bigger KV pool steals weight residency from the slab AND from the
+# lendable cache. Priors on this card/model: stealing 2.14 GiB of weights for
+# a bigger pool (MAX_MODEL_LEN 262144) cost 2.5% decode; the EVC ladder's
+# other direction (0.82 -> 0.84, +2.5 GiB weights) cost 8.9%. Expect -3..-8%
+# vs the fp8 control (136 t/s median at 44.5k depth, acceptance 0.7246,
+# ~190 t/s on a live 512-token probe); re-tune from a boot ledger + probe,
+# never from that estimate.
+FRANK_ARCHON_VRAM_WEIGHTS_MIB=22208
+FRANK_ARCHON_VRAM_KV_MIB=6912
+# KV cache UNQUANTIZED (bf16). This engine's flag takes ONLY bf16|fp8 — there
+# is ONE kv_dtype for the whole cache, so "exact K, quantized V" (llama.cpp's
+# --cache-type-k/--cache-type-v pair, which is what frank-zealot runs) is
+# UNSERVABLE here: the rung below bf16 is fp8 on both halves.
+# Measured per-rank cost, read out of the boot ledger's group table (fp8 boot
+# 2026-10-08, bf16 boot 2026-10-11):
+#   kv_attn     13 layers, 4-token blocks, page 26.00 KiB (fp8) -> 52.00 KiB
+#   kv_qsa_bkey 13 layers, 4-token blocks, page  3.25 KiB at BOTH dtypes —
+#               the QSA block key is an index, not attention state, and does
+#               NOT follow --kv-cache-dtype
+#   => 7.3125 KiB/token fp8, 13.8125 KiB/token bf16: bf16 costs 1.89x fp8,
+#               not 2x, precisely because the bkey plane is dtype-fixed.
+# The dtype-INDEPENDENT terms also live in the pool: kv_gdn_state 54 MiB x 2
+# copies per sequence (+ conv/tail/ple ~= 110 MiB a sequence) and the prefix
+# checkpoint region 8 x 55.99 = 448 MiB. So:
+#   pool_mib >= tokens x 13.8125 KiB + 110 x seqs + 448
+#   6912 -> (6912 - 220 - 448) x 1024 / 13.8125 = 462,946 tokens; the engine
+#   reported 462,752 (0.04% page rounding) — 2 x 200,000 with 62k of slack,
+#   and the ledger says it outright: "backs 2 sequences all at 200000 tokens
+#   at once, which is the worst case".
+# (the fp8 pool of 3543 gave 386,904 — it never held 2 x 200k, it held 1.93
+# sessions, and a third long conversation preempted to the host/disk tiers).
+# Secondary cost: the prefix-cache entry grows with the attention plane
+# (one entry 58.50 KiB at fp8 -> 110.50 KiB at bf16, measured on the two boot
+# ledgers' `kv tier transfer` lines), so the host tier below doubles to keep
+# the same number of parked conversations, out of RAM the host has
+# (104 GiB available with the service loaded).
+FRANK_ARCHON_KV_DTYPE=bf16
+# Spec decode: the checkpoint's own MTP head at the publisher's depth-3
+# operating point (probe() returns 3 when mtp_num_hidden_layers > 0; the
+# flag states it so the ledger records the intent).
+FRANK_ARCHON_SPEC_TOKENS=2
+FRANK_ARCHON_MAX_BATCHED_TOKENS=2048
+# Prefix cache tiers (publisher pattern; disk tier sized for 2 slots).
+# The host tier is sized in ENTRIES, and one entry doubles with the cache
+# dtype (58.50 KiB at fp8 -> 117 KiB at bf16, per the ledger's `kv tier
+# transfer` line): 4096 MiB at bf16 parks ~1.4 sessions of 200k where it
+# parked ~2.9 at fp8. Doubled to keep the capacity, at RAM the host has
+# (104 GiB available with the service loaded).
+FRANK_ARCHON_PREFIX_HOST_MIB=8192
+FRANK_ARCHON_PREFIX_DISK_MIB=65536
+# The PLE n-gram table (47.7 GiB) serves from pinned host RAM the cards
+# read. `ram` REFUSES the start if the memlock limit is too small — a
+# named refusal beats a mid-load allocator failure — and the unit's
+# LimitMEMLOCK=infinity is the other half of the arrangement.
+FRANK_ARCHON_NGRAM_PLACEMENT=ram
+# TTM preflight: the pinned ledger (2 x 44 GiB pools + 47.7 GiB PLE + 8 GiB
+# prefix host = ~147 GiB) rides TTM's shared pages, capped by ttm's
+# pages_limit (the current kernel exposes NO pages_max; the cap function
+# takes the min over the knobs that exist). Below the plan the load dies
+# mid-pin with an allocator error instead of this named refusal — raise the
+# knob first (runtime sysfs write; kernel cmdline fallback + one reboot only
+# if the file is read-only), see the runbook. Cap raised 2026-10-05 to
+# 52,428,800 pages = 200 GiB, which still clears this floor.
+FRANK_ARCHON_TTM_MIN_MIB=150000
+# Escape hatch for boot-ladder experiments. Unset -> no extra argv. Keep
+# multi-flag values as one string; the serve script expands it unquoted on
+# purpose.
+FRANK_ARCHON_EXTRA_ARGS=
+# The .rad's minimum size in MiB (deployer gate; a truncated convert is a
+# guaranteed long-timeout boot instead of a fast failure). The converted
+# container measured 177,109 MiB (1,857,127,997,440 B = 173.0 GiB; the
+# plan-only estimate 172.76 GiB covers the data planes but not the metadata
+# tail) - floor sits just under the payload.
+FRANK_ARCHON_RAD_MIN_MIB=110000

scripts/frank-archon.service

@@ -0,0 +1,64 @@
+# frank-archon.service — radiance (StillDeadcode, Apache-2.0) endpoint
+# (OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 at NATIVE block-FP8 precision, the
+# rad-convert container qwen4exp-fp8-native.rad) on BOTH R9700s (TP=2,
+# wht6 wire), dankserver :7770. 2026-10-05 cutover from FreeToken (git tag
+# frank-archon-freetoken-pr587-20261005 is the pre-cutover state; the
+# retired unit/env/serve trio and Dockerfile are in that tag).
+#
+# Same port, same served alias, same container identity as the unit name;
+# the harness models.yml id is unchanged. The serve script drives
+# `podman run` directly: the digest-pinned stilldeadcode/radiance image
+# (287 MiB, kernels prebuilt for gfx1201) has the engine as its
+# entrypoint. The image lives in dank's ROOTLESS podman storage.
+# WHY A ROOT UNIT (not a rootless quadlet): radiance pins ~132 GiB of HOST
+# RAM (2 x 40 GiB expert pools + the 47.7 GiB PLE ngram table + the prefix
+# host tier). Pinned pages are charged against RLIMIT_MEMLOCK; dank's login
+# session on this host carries 8 MiB and a user quadlet is capped by the
+# user manager's own hard limit — raising that means restarting
+# user@1000.service and bouncing every user container on the host. A root
+# unit grants LimitMEMLOCK=infinity to the dank process via PID1; the
+# engine still runs out of dank's rootless podman storage.
+[Unit]
+Description=frank-archon — radiance Qwen3.8-Flash-Next-FP8 (native) on 2x R9700 TP=2
+After=network-online.target
+Wants=network-online.target
+# Never let the start-rate limiter give up after a crash loop (a failed LLM
+# endpoint that systemd refuses to retry is worse than a retrying one).
+StartLimitIntervalSec=0
+
+[Service]
+User=dank
+Group=dank
+# The engine pins ~132 GiB of host RAM (expert pools + PLE table); an
+# RLIMIT_MEMLOCK smaller than the pinned set fails the load mid-start.
+# PID1 grants infinity here — parity with the fleet's other LLM units.
+LimitMEMLOCK=infinity
+Environment="FRANK_ARCHON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-archon.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-archon.sh
+# systemd stop: wait alone cannot stop the container child; stop it
+# explicitly. No graceful drain contract is claimed (the OpenAI front end
+# holds no queue to drain — in-flight decodes are lost, which a stop
+# during a bench window accepts; radiance takes SIGTERM on the engine
+# process and podman reaps the container).
+ExecStop=/usr/bin/podman stop -t 120 frank-archon
+# Boot cost: .rad load (weights + PLE upload) + expert host-pool pin. The
+# publisher's compose healthcheck allows a 15-minute start_period; the
+# vLLM-era budget (1800 s) carried forward.
+# Restart=always, NOT on-failure (the 2026-10-01 vLLM lesson carries over:
+# a clean API-server exit after a worker fault reads as success to
+# systemd). `always` restarts on any container death; an explicit
+# `systemctl stop` still wins, so bench windows and deploys are unaffected.
+Restart=always
+RestartSec=10
+# ExecStop allows the engine 120 s to drain (`podman stop -t 120`); without
+# an explicit TimeoutStopSec systemd's 90 s default cuts the stop short,
+# kills it, and records 'Failed with result timeout' (measured 2026-10-01
+# 13:27:17). Must exceed the podman grace with margin.
+TimeoutStopSec=180
+# The engine pins tens of GiB of host RAM (expert rows + PLE table); it is
+# the last process on this host that should be chosen by the kernel OOM
+# killer.
+OOMScoreAdjust=-500
+
+[Install]
+WantedBy=multi-user.target

scripts/frank-dragoon.env

@@ -0,0 +1,160 @@
+# frank-dragoon.env — tunables for the frank-dragoon endpoint on Dankclaw's
+# Strix Halo iGPU (gfx1151), host port 7770.
+#
+# RUNTIME (2026-10-06, Frank): halogen-flash-server 0.16.2 — the
+# closed-source C++/HIP engine (image ghcr.io/peonist-ai/halogen-flash-server,
+# digest-pinned below) serving the Quat3rnion ABLITERATED Swift1.5 finetune
+# of peonist's Qwen3.8-Flash-Next v2 checkpoint, as a podman container under
+# a root unit, driven by scripts/serve-frank-dragoon.sh. This CUTS OVER the
+# 2026-10-05 halogen 27B-dense shape (censored base, DFlash2, 31.7 t/s):
+# rollback = revert the swap commit's trio; the 27B payload stays on disk at
+# /home/dank/models/halogen-qwen3.8-27b/.
+#
+# WHY THE RUNTIME MOVED WITH THE MODEL: the payload is .hgn — per its own
+# card it "will not load in transformers, vLLM, or llama.cpp" — and the v2
+# .hgn loads ONLY in the flash-server line (the old halogen engine is for
+# the 27B p1w4d file; the v2 quickstart pins flash-server). What the move
+# buys (card + live probe evidence): MTP spec decode (53-57 t/s greedy,
+# 3-10x serial), ~1,640 t/s prefill at 34k, ~72% fewer thinking tokens than
+# the censored 27B (905 mean), the ABLITERATED base (refusals should NOT
+# return), IMAGE INPUT (the v2 vision tower loads beside the checkpoint —
+# red-PNG probe verified on the card; the 27B engine ignored its encoder),
+# tool calls verified, and the native 262,144 context.
+#
+# SHAPE — the knobs that are NOT free, with the arithmetic:
+#   HALOGEN_CTX=262144 is the PER-SLOT window and the per-conversation hard
+#   ceiling — a prompt over it is a 400 naming the limit, never a silent
+#   truncation. RAISED from 200192 on 2026-10-07: the harness clamps
+#   max_tokens to contextWindow − est − 4096, its chars/4 est UNDER-counts
+#   the rendered prompt by ~3 % on code/agent traffic, and compaction only
+#   fires at 85 % — so with window == engine ceiling, every request over
+#   ~146k est (65-85 % of the window) was a guaranteed 400. Measured
+#   2026-10-07: est 152,938, server 157,388, request 43,158 vs room 42,804
+#   — over by 354, margin 4,096 < the 4,450 under-count.
+#   Harness contract (models.yml): contextWindow 217088, maxTokens 45056.
+#   Compaction fires at 85 % = 184,524 est ≈ 190k measured (Frank's 180k
+#   target). Worst-case request: prompt + budget <= 217088 − 4096 + 3 %
+#   est-error ≈ 219k <= 262144 — the 45k gap between harness window and
+#   engine ceiling absorbs the estimate error with ~7x margin (robust to a
+#   10 % under-count). Compaction rides on frank-zealot: input ≈
+#   threshold − keepRecent(20k) ≈ 170k measured, inside its 200,704 slot.
+#   HALOGEN_KV_POOL_POSITIONS=524288 = KV_SLOTS(2) x CTX — the explicit
+#   form of the engine's default, so the seam test can pin the product.
+#   KV costs ~28 KiB/position (FLAGS.md) => 524,288 x 28 KiB = 14.0 GiB.
+#   HALOGEN_KV_SLOTS=2 restores the w4b-era shape on this box: the MTP
+#   drafter is NOT slot-locked on this engine. A "slots > 1 disables the
+#   drafter" restriction is a property of the engine generation that
+#   imposed it, not of speculation itself — batching and speculation
+#   coexist here, and the card's own quickstart ships 2 slots WITH the
+#   head — so the second slot is concurrent capacity, not a speculation tax.
+#   Memory ledger against the box's 121.2 GiB unified (the n-gram table is
+#   mmap'd page cache beside the checkpoint, not a pinned charge — the
+#   card's own quickstart arithmetic does not bill it):
+#     weights ~62 GiB resident + KV 14.0 + arena (HALOGEN_MAX_TOK=8192 =>
+#     ~8 GiB per FLAGS.md arena formula 3.8+8.4*(MT/16384)) + vision ~2
+#     = ~86 GiB engine-side; HALOGEN_HOST_RESERVE_GIB=20 keeps the host
+#     honest; baseline co-tenancy (frank-zealot, ComfyUI, Caddy/observ)
+#     ~10-15. ~15 GiB margin. The boot ledger is the referee — read it
+#     after deploy and re-size if the engine prints a clamp.
+#   HALOGEN_SPEC_ADAPT=0 is MANDATORY (card): the default adaptive policy
+#   turns the MTP head off for whole requests after low acceptance and
+#   HALVES decode as a result. Frank accepted the head always-on trade
+#   (temp 1.0 traffic costs acceptance; the card still ships the recipe).
+#
+# CLIENT CONTRACT deltas vs the 27B shape (harness side lives in
+# ~/.omp/agent/models.yml):
+#   * SERVER-SIDE SAMPLER EXISTS NOW: HALOGEN_TEMPERATURE/TOP_P/TOP_K set
+#     the card's thinking recipe (1.0 / 0.95 / 20) as engine defaults, so
+#     an absent temperature is no longer greedy. models.yml extraBody
+#     carries the same values — consistent, not load-bearing.
+#   * HALOGEN_MAX_TOK=8192 is only the DEFAULT for requests that omit
+#     max_tokens; the harness sends at most its maxTokens 45056. Requests
+#     over HALOGEN_MAX_TOKENS_CAP (65536) are a 400 naming the cap. Cap and
+#     queue timeout are COUPLED (FLAGS.md table): 65536 at ~10 t/s serial
+#     worst case needs > 6550 s; 7200 honors it. Do not move one alone.
+#   * max_tokens INCLUDES thinking; a reasoning reply over a small budget
+#     returns empty content with finish_reason "length".
+#   * Prompt cache is ON by default (PROMPT_CACHE=2): a follow-up turn at
+#     100k context re-prefills ~2 s instead of ~88 s cold. No pin needed —
+#     unlike the 27B engine, auto-sizing fits this box's ledger.
+#   * Thinking lands in reasoning_content (same as the 27B engine); the
+#     v2 chat template rejects reasoning_effort outside xhigh|medium|low,
+#     so the models.yml fold (high->xhigh) still applies.
+#   * Vision: OpenAI image_url content parts only (the fleet's standard
+#     contract). >=256 px probe images or the model answers "video".
+#   * response_format json_object/json_schema unsupported in this line
+#     (no constrained decoding) — unchanged from the 27B engine.
+#   * The engine's token protocol has no auth and binds loopback INSIDE
+#     the container; only the frontend port (8731) is published. Same as
+#     before. Kernel needs CONFIG_HSA_AMD_SVM (CachyOS ships it) and
+#     amdgpu.noretry=0 (check at deploy).
+
+# Image: digest-pinned, not tag-pinned — a tag can be re-pointed to a
+# build that was never qualified here, while the digest pins exactly the
+# build that was tested. 0.16.2 = the version the model card names as its
+# quickstart pin; the RepoDigest was captured at a pull of that tag.
+FRANK_DRAGOON_IMAGE=ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84ac22308a53f5d1ca6b86806702d7039e5ebc51cae4c66621b92fe04a
+# Container identity: kept from the 27B era (unit ExecStop names it).
+FRANK_DRAGOON_CONTAINER=frank-dragoon-halogen
+# Old quadlet-era container identity; the serve script clears stale names.
+FRANK_DRAGOON_LEGACY_CONTAINERS=frank-dragoon
+# host:container — the frontend listens on 8731 inside (HALOGEN_API_PORT
+# default); the engine port (8730) is never published.
+FRANK_DRAGOON_PUBLISH=7770:8731
+
+FRANK_DRAGOON_MODEL_DIR=/home/dank/models/halogen-flashnext-v2
+# The checkpoint: Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated
+# qwen38-flash-next-v2-swift15-abliterated.hgn — compacted r2 of the card's
+# append-only original (byte-identical live tensors, padding dropped:
+# 66,687,678,464 B vs 89,775,868,032 B). LFS sha256 verified at fetch.
+FRANK_DRAGOON_CHECKPOINT=qwen38-flash-next-v2-swift15-abliterated.hgn
+FRANK_DRAGOON_CHECKPOINT_BYTES=66687678464
+FRANK_DRAGOON_CHECKPOINT_SHA256=9c880b8ba48deabfa06172eff1e7572e4fe465e09e97faec6e50c3f6fdcac037
+# The n-gram lookup table: REQUIRED (the engine reads it beside the
+# checkpoint; the card's quickstart names it explicitly). From
+# peonist-ai/halogen-qwen3.8-flash-next @ 5cc17cea.
+FRANK_DRAGOON_NGRAM_TABLE=qwen38-flash-next-ngram.hgn
+FRANK_DRAGOON_NGRAM_BYTES=51200246144
+FRANK_DRAGOON_NGRAM_SHA256=3450acada94e19aabad88bd49b45eb70304820949c2240fc178067b20ae5dffe
+# The vision tower: OPTIONAL on the engine, ENABLED here (image input).
+# From peonist-ai/halogen-qwen3.8-flash-next @ e053f488.
+FRANK_DRAGOON_VISION_TOWER=qwen38-flash-next-vision.hgn
+FRANK_DRAGOON_VISION_BYTES=897916416
+FRANK_DRAGOON_VISION_SHA256=d62e0ae553fe88afd3833733d4a4c669f34d20fd8dfce4b9610525bed2134b10
+# The tokenizer is a FLAT DIRECTORY, $FRANK_DRAGOON_MODEL_DIR/tokenizer,
+# mounted whole at /tokenizer. The two repos ship the same one; fetched
+# fresh from peonist @ e053f488 (tokenizer.json is LFS, byte-identical to
+# the 27B-era copy; the rest are plain git blobs — size-checked only). The
+# serve gate and the deployer refuse a missing file or ANY symlink: an HF
+# cache snapshot symlinks each file into blobs/, and those links dangle
+# inside the container mount.
+FRANK_DRAGOON_TOKENIZER_FILES="tokenizer.json chat_template.jinja tokenizer_config.json merges.txt vocab.json generation_config.json"
+
+# --- engine flags (docs/FLAGS.md of the flash-server repo; anything unset
+# stays at the image default, which is what was qualified) ------------------
+# Served model id — Protoss name (wire rename 2026-10-09); the service, unit,
+# scripts and this file keep the frank-dragoon name. OpenWebUI api_configs
+# model_ids for the :7770 backend MUST name this value.
+HALOGEN_MODEL_ID=frank-dragoon
+HALOGEN_CTX=262144
+HALOGEN_KV_POOL_POSITIONS=524288
+HALOGEN_KV_SLOTS=2
+HALOGEN_HOST_RESERVE_GIB=20
+# Spec decode: MTP head is INSIDE the checkpoint (do NOT set HALOGEN_MTP_HEAD);
+# depth 2 is the documented "best all-round" default. HALOGEN_DRAFTER /
+# HALOGEN_DFLASH_* from the 27B engine DO NOT EXIST here.
+HALOGEN_SPEC_ADAPT=0
+# Coupled pair (FLAGS.md table): the cap bounds how long ONE request holds
+# the GPU, the timeout bounds how long the NEXT client waits. Do not move
+# one alone (see the client-contract note above).
+HALOGEN_MAX_TOK=8192
+HALOGEN_MAX_TOKENS_CAP=65536
+HALOGEN_QUEUE_TIMEOUT=7200
+# Server-side sampler = the card's thinking recipe (the engine now HAS one;
+# requests may still override per-call). Matches models.yml extraBody.
+HALOGEN_TEMPERATURE=1.0
+HALOGEN_TOP_P=0.95
+HALOGEN_TOP_K=20
+# Card's belt-and-braces: the engine pins weights by default
+# (HALOGEN_FLASH_PIN_TRUNK=1; only the retired w4b build honored 0).
+HALOGEN_WEIGHTS_LOCK=1

scripts/frank-dragoon.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=halogen container (peonist-ai/halogen-qwen3.8-27b, DFlash2 spec decode, 1 slot x 200700, text-only), root systemd unit (dankclaw, frank-large, Strix Halo iGPU)
+Description=halogen-flash-server container (Quat3rnion abliterated Swift1.5 of Qwen3.8-Flash-Next v2, MTP spec decode, 2 slots x 200192, vision ON), root systemd unit (dankclaw, frank-dragoon, Strix Halo iGPU)
 After=network-online.target
 Wants=network-online.target
 
@@ -11,19 +11,19 @@ Group=dank
 # RLIMIT smaller than the pinned set cannot fail the load. Parity with the
 # other LLM units on this fleet.
 LimitMEMLOCK=infinity
-Environment="FRANK_LARGE_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-large.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-large.sh
+Environment="FRANK_DRAGOON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-dragoon.sh
 # systemd stop alone cannot stop the container child; stop it explicitly
-# (frank-primary pattern). The engine drains on SIGTERM.
-ExecStop=/usr/bin/podman stop -t 60 frank-large-halogen
+# (frank-archon pattern). The engine drains on SIGTERM.
+ExecStop=/usr/bin/podman stop -t 60 frank-dragoon-halogen
 TimeoutStartSec=1200
 TimeoutStopSec=120
 # always, not on-failure: an engine that exits 0 after an internal fault
 # would otherwise leave the endpoint down until someone notices.
 Restart=always
 RestartSec=10
-# The engine mmaps 33.4 GiB of weights and keeps a multi-GiB working set
-# on a box that also hosts frank-small, ComfyUI and the Caddy/observability
+# The engine pins ~62 GiB of v2 weights and keeps a multi-GiB working set
+# on a box that also hosts frank-zealot, ComfyUI and the Caddy/observability
 # stack; make it a late OOM candidate, not the first.
 OOMScoreAdjust=-500
 

scripts/frank-large.env

@@ -1,113 +0,0 @@
-# frank-large.env — tunables for the frank-large endpoint on Dankclaw's
-# Strix Halo iGPU (gfx1151), host port 7770.
-#
-# RUNTIME (2026-10-05, Frank): halogen — the closed-source C++/HIP engine
-# (github.com/peonist-ai/halogen-server, image ghcr.io/peonist-ai/halogen,
-# digest-pinned below) serving peonist-ai/halogen-qwen3.8-27b, a ~6.32 bpw
-# NVFP4-derivative quant of the BASE Qwen/Qwen3.8-27B (35,865,565,184 B,
-# 1352 tensors), as a podman container under a root unit, driven by
-# scripts/serve-frank-large.sh. This CUTS OVER the
-# 2026-10-02..10-03 ROCmFPX llama.cpp shape (uncensored
-# Q6_0_ROCMFPX_AGENT + MTP, 27.6-28.1 t/s): rollback = revert the swap
-# commit's trio; the ROCmFPX payload, draft head and build all stay on
-# disk at /home/dank/models/kingjones-Qwen3.8-27B-Uncensored-ROCmFP4-STRIX-MTP/.
-#
-# WHY THE RUNTIME MOVED WITH THE MODEL: the payload is .hgn — per its own
-# card it "will not load in transformers, vLLM, or llama.cpp". Accepted
-# consequences (Frank, 2026-10-05): TEXT-ONLY (halogen ignores the model's
-# vision encoder; the fleet's vision path is frank-small) and the CENSORED
-# base (this is a finetune of Qwen/Qwen3.8-27B, not the abliterated file —
-# refusals may return). What it buys: vendor-measured decode DFlash2 31.7
-# t/s mean (vs this endpoint's MTP 27.6-28.1 and the old halogen-era MTP
-# 26.9), prefill ~566 t/s at 32k (was ~400 on the sibling engine), 1.4-2.3x
-# wall-clock on prefill-heavy agent traffic, at HIGHER effective precision
-# (~6.32 bpw vs ~6.6 with the old W4A4 promotion — see FLAGS.md).
-#
-# SHAPE — the two knobs that are NOT free:
-#   HALOGEN_KV_SLOTS=1 KEEPS SPECULATION ON. halogen makes batching and
-#   speculation mutually exclusive: with >1 slot the drafter is disabled
-#   and per-stream decode falls to serial speed (the sibling engine
-#   measured 41 t/s -> 14 t/s when slots were raised, and halogen's own
-#   FLAGS.md prints the same law). frank-large was already a one-session
-#   endpoint under ROCmFPX (PARALLEL=1), so slots=1 is the same contract,
-#   not a regression.
-#   HALOGEN_SLOT_CTX=200700 (Frank's window) is the per-conversation hard
-#   ceiling — a prompt over it is a 400 naming the limit, never a silent
-#   truncation. KV pool = slots x slot_ctx x 64 KiB = 12.2 GiB. Budget
-#   against the 121 GiB of unified memory: weights 33.4 GiB (mmap'd — page
-#   cache, not anon), KV 12.2, engine working set + auto prompt cache
-#   ~20-30, host baseline ~10 -> ~75-85 GiB in use. The 2026-09-16 halogen
-#   era ran the same engine class on this box with LESS headroom.
-#   HALOGEN_DRAFTER=2 (DFlash2) is the shipped default and the fastest
-#   exact drafter on this checkpoint; the .hgn BAKES BOTH drafters (MTP +
-#   DFlash2), so unlike the Flash-Next era there is no sidecar to mount
-#   and no --dflash flag — the drafter is an int knob, byte-identical
-#   output to greedy verification either way.
-#
-# CLIENT CONTRACT deltas vs the ROCmFPX shape (the harness side lives in
-# ~/.omp/agent/models.yml):
-#   * NO server-side sampler defaults: a request without temperature
-#     decodes GREEDY. The harness sends temp 1.0 / top_p 0.95 via
-#     extraBody, so that wire recipe is load-bearing now, not cosmetic.
-#   * max_tokens defaults to 8192 PER REQUEST and INCLUDES thinking; a
-#     reasoning reply over a small budget returns empty content with
-#     finish_reason "length". The harness maxTokens is 57344: compaction
-#     fires at 70% of 200700 = 140,490 and 140,490 + 57,344 = 197,834 <=
-#     200,700 keeps prompt + budget inside the pool (the 262144-era 65536
-#     would overflow). Requests over HALOGEN_MAX_TOKENS_CAP are a 400
-#     naming the cap; cap and queue timeout are COUPLED (see FLAGS.md
-#     table) — do not move one without the other.
-#   * response_format json_object/json_schema is a 400 (no constrained
-#     decoding in this build).
-#   * Thinking lands in reasoning_content — same field as the llama.cpp
-#     era, so the harness compat block does NOT change. reasoning_effort
-#     accepts none|low|xhigh on this build (template default xhigh); the
-#     models.yml fold (high->xhigh) still applies.
-#   * The engine's token protocol has no auth and binds loopback INSIDE
-#     the container; only the frontend port is published. Keep it that way.
-
-# Image: digest-pinned (fetch law: tag pulls silently re-point; the digest
-# is what was qualified). 0.1.4 = the version the model card names.
-FRANK_LARGE_IMAGE=ghcr.io/peonist-ai/halogen@sha256:dc0a39a0016d6cfc58a197978febaafdf8d28403f724ded6111d98b5fb7ac0ea
-# Container identity: the halogen container name.
-FRANK_LARGE_CONTAINER=frank-large-halogen
-# Old quadlet-era container identity; the serve script clears stale names.
-FRANK_LARGE_LEGACY_CONTAINERS=frank-large
-# host:container — the frontend listens on 8731 inside (HALOGEN_API_PORT
-# default); the engine port (8730) is never published.
-FRANK_LARGE_PUBLISH=7770:8731
-
-FRANK_LARGE_MODEL_DIR=/home/dank/models/halogen-qwen3.8-27b
-FRANK_LARGE_CHECKPOINT=qwen3.8-27b-p1w4d-d2.hgn
-FRANK_LARGE_CHECKPOINT_BYTES=35865565184
-FRANK_LARGE_CHECKPOINT_SHA256=274c3fc767fb57faf025dd03c76376b1fc1b32448aef45aaf02d1898fa962089
-# The tokenizer is a FLAT DIRECTORY, $FRANK_LARGE_MODEL_DIR/tokenizer, mounted
-# whole at /tokenizer — the model card ships `tokenizer/` and the engine's
-# HALOGEN_TOKENIZER default is that directory (the card's own docker run sets
-# no tokenizer flag). The Hub stores it as 5 files (sizes from the Hub API,
-# 2026-10-05): tokenizer.json 12809320 (LFS sha256
-# 0997f410c57a1f4e53b09e4be8f4a172d90edd9564368fb0847030937229b9f3),
-# vocab.json 6722759, merges.txt 3353259, chat_template.jinja 8952,
-# tokenizer_config.json 17928 (plain git blobs — size-checked, no LFS oid).
-# The serve gate and the deployer refuse a missing file or ANY symlink: an
-# HF cache snapshot symlinks each file into blobs/, and those links dangle
-# inside the container mount.
-FRANK_LARGE_TOKENIZER_FILES="tokenizer.json chat_template.jinja tokenizer_config.json merges.txt vocab.json"
-
-# --- engine flags (docs/FLAGS.md of the engine repo; anything unset stays
-# at the image default, which is what was qualified) ------------------------
-HALOGEN_MODEL_ID=frank-large
-HALOGEN_SLOT_CTX=200700
-HALOGEN_KV_SLOTS=1
-HALOGEN_DRAFTER=2
-# Coupled pair (FLAGS.md table): the cap bounds how long ONE request holds
-# the GPU, the timeout bounds how long the NEXT client waits. 65536 at
-# ~10 t/s serial worst case needs > 6550 s queue timeout; the defaults
-# honor that. Do not lower the timeout alone.
-HALOGEN_MAX_TOKENS_CAP=65536
-HALOGEN_QUEUE_TIMEOUT=7200
-# Engine prompt cache: EMPTY = auto (sized from available memory at
-# startup). Pin an explicit MB only to argue with the auto figure — a
-# full-context entry is ~18 GB at 262K, so a too-small pin yields a cache
-# that reports enabled and never hits (the engine warns at startup).
-#HALOGEN_CACHE_MB=

scripts/frank-primary.env

@@ -1,362 +0,0 @@
-# frank-primary.env — tcclaviger RDNA4 vLLM production config (dankserver :7770).
-#
-# 2026-10-03 shape G (as shipped, after the 1.00 revert): the CUDA-graph plan
-# term dropped from the analytic 0.55 GiB to the measured 0.07 GiB (0 base +
-# 12 MiB/graph), and UTIL at the 0.982 law. MEASURED on the live deploy: arena
-# 17.77 GiB / 7,762 slots, KV 401,408 tokens / 2.00x concurrency (the first
-# shape holding two full-length conversations with real spare), driver used
-# 30.97 GiB of 31.86 — 0.89 GiB of real free VRAM per card, held through a
-# live 4,096-token generation. UTIL stays 0.982 ALWAYS: 1.00 is unbootable on
-# this fork (worker init refuses budget >= device total) and 0.13-GiB-margin
-# boots die under load.
-# `budget - non-expert - KV reserve - graphs - overhead` and the KV reserve is a
-# registry constant, so those two terms are the whole flag surface.
-# 2026-10-03 shape F (absorbed): MNBT 2048 + the graph term pinned. Measured on
-# the live deploy: arena 17.52 GiB / 7,653 slots, budget 31.29, graphs 0.32.
-# 2026-10-02 shape E: fp8 KV, MAXLEN 200704 x SEQS 3, pool 3.15e9/rank, and
-# --expert-precise-memory ON. The window shrink from the native 262144 and the
-# --max-num-seqs 3 lock both come from shape D (SEQS=2 CANNOT boot this model —
-# the measured 2x2 is below); shape E adds the precise-overhead plan, which
-# trades the default 7.60 GiB compile headroom for the fitted 5.25 GiB and puts
-# the 2.35 GiB difference into the expert arena: 6,496 -> 7,522 slots (+16%).
-# The pool is deliberately NOT cut (option A): the pool is not an arena lever
-# (measured), so 3.15e9 keeps shape D's 1.99x concurrency while the arena grows.
-# Same digest-pinned tcclaviger RDNA4 fork. Rollback for the fp8+MTP4 era is git
-# tag frank-primary-fp8-mtp-20261001.
-#
-# HIP reads bare env vars TEMP, HOST, GPU_MAX_HEAP_SIZE — every key here is
-# prefixed FRANK_PRIMARY_ so none can leak. The one bare name we WANT inside the
-# container (GPU_MAX_HW_QUEUES) is held here under the prefix and passed on the
-# run line as `-e GPU_MAX_HW_QUEUES=…`.
-#
-#
-# --- runtime ----------------------------------------------------------------
-# Digest-pinned: the floating :latest tag moved once already. Local alias
-# qwen-fp8-runtime:tuned-20260929 (image ID 3322dbbbc96d) points at the same
-# bytes in rootless storage.
-FRANK_PRIMARY_IMAGE=docker.io/tcclaviger/vllm@sha256:da4029666668b90a0386c1ed23ea370c79916ad4e1a6ad1dd9db098b9fa069ea
-
-# --- payload ----------------------------------------------------------------
-FRANK_PRIMARY_MODEL_DIR=/home/dank/models/Qwen3.8-Flash-Next-Uncensored-FP8
-FRANK_PRIMARY_MODEL_SHARDS=131
-
-# --- identity ---------------------------------------------------------------
-# The harness models.yml id stays frank-primary (provider 192.168.0.235:7770).
-FRANK_PRIMARY_CONTAINER=frank-primary-qwen
-FRANK_PRIMARY_SERVED_NAME=frank-primary
-FRANK_PRIMARY_PUBLISH=7770:7770
-# Containers removed before every start: the retired R9V identity and the ad
-# hoc experiment identity (both hold the GPUs / name registrations).
-FRANK_PRIMARY_LEGACY_CONTAINERS="frank-primary-r9v qwen-fp8"
-
-# --- qualified engine shape (2026-10-02, shape E) ---------------------------
-# WHAT THE SLOT COUNT DOES AND DOES NOT DO. The endpoint advertises 3 slots
-# (SEQS 3), but the POOL, not the slot count, decides how many full-length
-# conversations are resident. MEASURED LIVE 2026-10-02 at this shape:
-#   GPU KV cache size: 398,658 tokens,
-#   Maximum concurrency for 200,704 tokens per request: 1.99x
-# (3,146,129,408 B reserved — 7,892 B/token). The per-token price is
-# SHAPE-DEPENDENT, not a constant: the 262144 shape priced at 7,701 B/token
-# (6,100,000,000 B -> 792,069 tokens), ~2.5% cheaper, so never extrapolate a
-# concurrency figure across geometries. Shorter requests use the spare blocks,
-# and a third LONG request queues rather than being refused. Verified: three
-# concurrent 67-token requests answered in parallel, ~4.1 s each.
-#
-# WHY NOT --max-num-seqs 2 (measured 2026-10-02, single-variable boot probes
-# against the then-deployed known-good shape, production stopped for each):
-#   SEQS 2 + MNBT 1024 -> Engine core initialization failed
-#   SEQS 2 + MNBT 2048 -> Engine core initialization failed
-#   SEQS 3 + MNBT 1024 -> healthy (792,069 tokens, 3.02x, arena 6,248)
-#   SEQS 3 + MNBT 2048 -> healthy (the deployed incumbent)
-# The failure is torch.fx ConstraintViolationError: query_start_loc.size()[0]
-# "marked dynamic but your code specialized it to be a constant (3)", raised
-# from AOT build_guards(strict_error=True) during profile_run -> _dummy_run.
-# model_runner.py sizes that input buffer max_num_reqs + 1 and _dummy_run sets
-# num_reqs = min(max_num_batched_tokens, max_num_reqs), so the width is
-# SEQS + 1 for ANY MNBT >= SEQS: 3 at SEQS 2, 4 at SEQS 3. MNBT only moves the
-# compile RANGE ((1,1024) vs (1,2048)) and cannot dodge it — the 2x2 above is
-# why MNBT is not a lever here. --enforce-eager bypasses the path but loses
-# CUDA graphs. Same failure class killed the 2026-10-01 bf16 2 x 262144 shape.
-#
-# THE ARENA LEVER IS max_model_len, NOT KV_BYTES (measured 2026-10-02). The
-# planner sizes expert cache as budget - non-expert - KV reserve - graphs -
-# overhead, and the KV reserve is registry-priced at 9190 B/token x max_model_len:
-#   MAXLEN 262144 -> reserve 2.48 GiB -> arena 14.30 GiB / 6,248 slots
-#   MAXLEN 200704 -> reserve 1.91 GiB -> arena 14.87 GiB / 6,496 slots
-# d(reserve) 0.57 GiB = d(arena) 0.57 GiB = +248 slots. The 6.1e9 -> 3.15e9
-# pool cut buys ZERO arena; it buys runtime HEADROOM (the shape it replaced
-# died with 0 bytes free on a real 995-token request). To grow the arena,
-# lower MAXLEN — not KV_BYTES. The OTHER arena lever is the overhead term:
-# --expert-precise-memory (shape E) takes it from 7.60 to 5.25 GiB and lands
-# those 2.35 GiB in the arena — 14.87 -> 17.22 GiB / 6,496 -> 7,522 slots.
-#
-# GATHER 32x64 stays: R4D_LRU_GATHER_CHUNKS=32 / R4D_LRU_GATHER_LANES=64
-# measured +18.7% decode vs default geometry and the win grows with depth.
-# Do not drop it.
-# CHUNKED PREFILL: the fork exposes the standard scheduler flags. --max-num-batched-tokens
-# (MNBT) is the lever; --enable-chunked-prefill is an auto-flag (True in SchedulerConfig)
-# and --prefill-schedule-interval is the gap between iterations. The running shape carries
-# --max-num-batched-tokens 2048 with --max-model-len 200704, so chunked prefill is ON and
-# already active: a 200704-token prompt is prefilled in ~98 iterations of 2048 tokens.
-# MEASURED 2026-09-29 on the ad hoc qwen-fp8 container (same fork, same payload, TP=2):
-# MNBT 8192 vs the default 2048 is NEUTRAL on decode at every depth, and small values
-# re-chunk prefill only — they hurt TTFT and never touch decode, because a decode step is
-# max_num_seqs x (spec+1) tokens, independent of MNBT. There is NO --ubatch-size
-# equivalent in vLLM: that is a llama.cpp compute-buffer concept (the frank-small pair
-# doubled on 2026-10-05 has no counterpart here). MNBT is therefore NOT a lever on this
-# shape — the deployed 2048 is the fork's default — and every change re-enters the
-# compile RANGE path, so FRANK_PRIMARY_CACHE_DIR pays one recompilation.
-# MNBT 2048 (Frank's call, 2026-10-03; the lock was 1024). The measured law
-# still holds: MNBT 512 doubles TTFT at 4064 ctx (2.46 s vs 1.36 s), 1024-4096
-# are interchangeable on decode, 12288 costs 2.5% plus arena. 2048 is ARENA-FREE
-# by construction: the registry's overhead model is
-# base + 0.22 GiB x max(0, (nbt - 4096)/1024) with the anchor at nbt 4096, so
-# every rung up to and including 4096 prices the SAME 5.25 GiB overhead — and
-# the fitted 5.25 was fitted at nbt 4096, i.e. our 2048 sits UNDER the anchor,
-# so the activation term is covered by a figure measured at a bigger batch.
-# SEQS 3 boots at both 1024 and 2048 (measured 2026-10-02; the SEQS=2
-# ConstraintViolationError is a SEQS property, not an MNBT one). Costs exactly
-# one recompilation: the compile RANGE is part of the cache key, so
-# FRANK_PRIMARY_CACHE_DIR pays for whichever rung is chosen once.
-# PREFETCH IS ABSENT BY LAW: expert-cache telemetry measured the prefetcher at
-# 36% precision (36,720 slabs prefetched, 13,369 served) — roughly half the
-# gather traffic was waste. Never re-add --expert-prefetch without a fresh A/B.
-# TunableOp stays OFF: CLAV_TUNABLEOP_SWEEP silently skips under expert offload
-# unless CLAV_TUNABLEOP_WITH_OFFLOAD=1, and forcing it corrupts numerics.
-# --expert-precise-memory is ON (shape E). It selects the fitted overhead
-# (5.25 GiB) over the default (7.60 GiB = fitted + compile/graph-capture
-# headroom); the 2.35 GiB difference lands in the expert arena. MEASURED
-# 2026-10-02 by a boot probe on the shape-D base (production stopped, candidate
-# booted AS the service, plan read off the engine's own log):
-#   runtime overhead  7.60 -> 5.25 GiB   (registry Qwen4Exp…, precise
-#                                         gfx1201 TP2 nbt4096/seqs16/len262144)
-#   expert cache      14.87 -> 17.22 GiB
-#   slots             6,496 -> 7,522     (+1,026 = +16%, 2.344 MiB each)
-#   swap region                 13.7 GiB / 5,986 slots, 133-134 per layer
-#   boot                        healthy in 420 s, no OOM, no knife-edge
-# The flag was called a non-option after it crash-looped the 2 x 262144 bf16
-# boot (0.13 GiB free of 31.86 GiB, NRestarts=3 at ~6.7 min each) — that shape
-# was already at the ceiling, so precise-memory was the last 2.35 GiB over, not
-# the cause. At 200704 x 3 it fits with room; the run line also reports
-# 'expert_precise_memory': True in non-default args, so a silent argparse drop
-# would be visible in the boot log.
-FRANK_PRIMARY_PRECISE_MEMORY=1
-# GPU_MAX_HW_QUEUES caps the HSA hardware queues per GPU (AMD's own tuning
-# guide recommends 2 for this class of workload; the runtime default on Linux
-# is 4). Verified a REAL knob, not a no-op: the string is present in
-# /opt/rocm/core-10.0/lib/libhsa-runtime64.so. NOT A/B MEASURED — Frank's call,
-# shipped as a deliberate CPU-side tune alongside the 32x64 gather geometry.
-FRANK_PRIMARY_GPU_MAX_HW_QUEUES=2
-# Persistent compile cache. MEASURED 2026-10-02: the image ships NO
-# /root/.cache at all (`ls: cannot access '/root/.cache'` in a fresh
-# container), and after our boot it holds /root/.cache/vllm at 1,154,714,333 B
-# in 4,665 files plus /root/.cache/comgr at 229 MB — both inside the
-# container's ephemeral layer, so every `podman rm -f` (every deploy, restart
-# and reboot) throws them away and re-pays the build. The engine's own log
-# names the loss: `torch.compile took 181.20 s in total`, of which 'Compiling a
-# graph for compile range (1, 1024) takes 173.19 s', followed by 'saved AOT
-# compiled function to /root/.cache/vllm/torch_compile_cache/…'. Mounting a
-# host dir at /root/.cache persists the vLLM AOT/torch_compile tree AND the
-# comgr HIP-kernel JIT cache, and hides nothing (the image has no such dir).
-# PROVEN LIVE 2026-10-02, two boots of this exact shape:
-#   cold  `Compiling a graph for compile range (1, 1024) takes 179.24 s`
-#         `torch.compile took 188.26 s in total`
-#   warm  `Directly load the compiled graph(s) for compile range (1, 1024)
-#          from the cache, took 2.143 s`
-#         `torch.compile took 3.97 s in total`
-#         `init engine (profile, create kv cache, warmup model) took 41.13 s
-#          (compilation: 3.98 s)`
-# (Total time to /health is dominated by the 172.8 GiB payload load, not the
-# compile — the saving is the ~184 s of inductor/AOT build.)
-# Safe to grow/prune: entries are keyed by version + config hash, so a stale
-# entry is a miss, never a wrong answer.
-FRANK_PRIMARY_CACHE_DIR=/home/dank/.cache/frank-primary
-FRANK_PRIMARY_MAXLEN=200704
-FRANK_PRIMARY_SEQS=3
-# The POOL is deliberately kept at shape D's 3.15e9 (option A): because the pool
-# is not an arena lever, raising it back from a cut buys concurrency only, and
-# 3.15e9 preserves the measured 1.99x while precise-memory grows the arena. A
-# 2.2e9 pool was probed in the same window (277,686 tokens / 1.38x) and rejected
-# as the shipped value; it remains the conservative arm if free VRAM ever binds.
-# KV forced to 400,700 tokens (Frank, 2026-10-03). The engine prices this pool
-# at 7,891.8 B/token at this shape and loses ~3.87 MB to block alignment, so
-# 3,166,500,000 B is the ask that lands at/above 400,700 (verify the reported
-# "GPU KV cache size" line on every deploy; it is not a constant ratio across
-# geometries — 7,701 B/token at 262144).
-FRANK_PRIMARY_KV_BYTES=3166500000
-FRANK_PRIMARY_KV_DTYPE=fp8
-FRANK_PRIMARY_MNBT=2048
-FRANK_PRIMARY_GATHER_CHUNKS=32
-FRANK_PRIMARY_GATHER_LANES=64
-# PREFIX CACHING: ON. An OFF experiment ran 2026-10-05 (below) and FAILED
-# to stop the corruption, so the historical flag is back.
-# MEASURED 2026-10-04, 18:46:07 PDT (5.6 h into the live boot, one running
-# request, prefix hit rate 48.1%): 48 gdn_hip state faults in one 0.6 s
-# burst, then the process-lifetime silence cap:
-#   [gdn_hip] ERROR gdn_decode_r: state out of ssm-cache range: max|S|=0
-#   with non-finite values (slot=42 head=3 limit=3.40282e+38) fault #1-23
-#   [gdn_hip] ERROR gdn_decode_r: ... (slot=42 head=8 ...) fault #24-46
-#   [gdn_hip] ERROR: state fault report limit (32) reached; further faults
-#   are counted silently
-# One physical SSM slot, two heads, BOTH ranks (heads 3 and 8), 23 layers
-# each. The guard's own message in this build: "known Qwen3.8-Flash-Next
-# (QFN) flaw under prefix caching and is being actively worked; output
-# quality for this request may degrade. Mitigation:
-# --no-enable-prefix-caching".
-# MECHANISM: with prefix caching on, this fork puts QFN on
-# mamba_cache_mode 'align' (the default-for-this-arch branch in
-# config/vllm.py; 'all' is deprecated and 'none' is the no-prefix-cache
-# mode, so align is the only sound mode WITH the flag). Align mode
-# checkpoints each sequence's GDN (Gated DeltaNet) recurrent state into a
-# mamba page every block, where block = 3136 tokens (the attention block
-# size is raised to 3136 so the page sizes match exactly — the boot log's
-# "Padding mamba page size by 0.13% ..."), and RE-SEEDS the state from that
-# page whenever a request resumes from a cached prefix. The corrupt state
-# landed at the 13th boundary: 13 x 3136 = 40,768 tokens — the "~40k" mark
-# where the request's output turned repetitive/corrupted. The NaN stayed
-# in the mamba page, so every later turn of that conversation re-seeded the
-# same non-finite state for those two heads (silent: the fault-report cap
-# was already spent), while fresh short sessions looked fine.
-# RAM WAS "RULED OUT" THE SAME DAY — AND THAT WAS WRONG (RESOLVED below).
-# What the evidence actually supported: zero MCE/EDAC records is the
-# EXPECTED silence of consumer non-ECC memory (a silent flip raises no
-# machine check); an 8 GiB pattern check over 60 s covers ~0.5 % of
-# 246 GiB — no verdict on a speed setting; "4800 is the JEDEC floor on
-# 5600-rated DIMMs" is a rating, not a stability proof at four-DIMM
-# loading. Only the two-head NaN signature argument was load-bearing,
-# and the revert test outvoted it.
-# COST ACCEPTED: no prefix reuse, so each turn re-prefills the whole
-# history instead of at most 3135 tail tokens (a full 40k context costs
-# tens of seconds of TTFT per turn at this shape's prefill rate). A silently
-# corrupted conversation is worse than a slower first token.
-# RESULT (2026-10-05, later that day): THE MITIGATION DID NOT WORK. With
-# --no-enable-prefix-caching deployed and mechanically verified (zero
-# gdn_hip faults, a 40,771-token single-request boundary probe coherent),
-# live long conversations STILL degraded at ~40k on the running endpoint
-# (Frank, direct). The container serving that window logged ZERO faults
-# while the corruption reproduced, so the align-mode page re-seed is not
-# the (only) mechanism — see the runbook's RESULT note for the open
-# hypotheses (re-fed poisoned transcript vs a fault-free long-context
-# path such as fp8 KV at depth). Cost bought nothing: caching is back ON.
-# The knob stays commented for a future fork build with a fixed GDN state
-# path: set 1, redeploy, re-verify past 40,768 tokens (one conversation
-# coherent AND zero gdn_hip lines).
-# RESOLVED 2026-10-05 EVENING (Frank): IT WAS THE RAM. 4800 MT/s (in
-# effect since the 2026-10-04 17:17 boot) was marginal; 4600 MT/s (since
-# the 2026-10-05 12:21 boot) and the endpoint is clean — zero gdn_hip
-# ERROR lines, zero MCE, and the live agent session on it past 140k
-# context with no degradation. Both failure eras sit under the RAM: the
-# 2026-10-04 NaN burst (corrupted weight/activation traffic poisoning a
-# GDN state write — the guard-visible path) and the fault-free ~40k
-# degradation (silent flips in KV/expert data, which no guard covers on
-# non-ECC). CONSEQUENCE FOR THE KNOB: the OFF experiment was CONFOUNDED
-# — both arms ran on the marginal speed — so it neither proved nor
-# disproved the fork's align-mode flaw. Prefix caching stays ON (zero
-# gdn_hip lines under heavy re-send traffic since the speed drop); flip
-# the knob only if a fault recurs on stable RAM or the fork ships a fix.
-# FRANK_PRIMARY_NO_PREFIX_CACHING=1
-# UTIL is an ARENA lever: the fork plans `budget = device_total x util`, and at
-# 31.86 GiB/card every +0.01 is +0.32 GiB of expert cache (~+139 slots), and
-# 0.982 is Frank's standing law: NEVER 1.00. The 1.00 attempt (2026-10-03,
-# shape G v1) died in worker init BEFORE loading a byte of weights — the fork
-# refuses budget >= device total with
-#   ValueError: Free memory on device cuda:N (31.29/31.86 GiB ...)
-# on BOTH ranks at 09:53 and 09:54, NRestarts=2 — so 1.0 is not even a runtime
-# knife-edge here, it is unbootable. The two historical ceiling deaths (the
-# 2x262144 bf16 boot at 0.13 GiB free; the 5x262144 boot at "0 bytes free" on a
-# real 995-token request) remain the reason the margin exists. Rollback note
-# for the other direction: if a request ever dies with
-# `Tried to allocate ... 0 bytes free`, the first knob back is THIS number
-# down a notch, not the window.
-FRANK_PRIMARY_UTIL=0.982
-# CUDA-graph plan term, priced at the measured capture. expert_plan.py charges
-# estimate_cudagraph_memory() = BASE_MB + PER_GRAPH_MB x n_graphs (defaults
-# 256/52 = 0.55 GiB for our 6-graph plan), and the estimator's own docstring
-# says to tune these against the post-capture line. MEASURED twice on this
-# shape: shape E reported "Graph capturing finished ... took 0.31 GiB" (TP0) and
-# 0.17 GiB (TP1); shape F, with the 0.32 GiB we then charged, reported
-# "took -0.06 GiB" — a NEGATIVE delta, i.e. capture fits inside memory the
-# profiler had already counted. So the base pool (256 MiB) is the over-charge:
-# charge 0 base + 12 MiB/graph = 0.07 GiB for the shipped no-spec 6-graph plan,
-# which returns 0.25 GiB more to the arena while still paying per graph, so a
-# future spec-decode shape (18 graphs) is charged 0.21 GiB rather than zero.
-# Verify every deploy against the "Estimated CUDA graph memory" vs "Graph
-# capturing finished ... took X GiB" lines; if capture ever goes positive and
-# exceeds the charge, raise FRANK_PRIMARY_CUDAGRAPH_PER_GRAPH_MB back toward 52.
-# A THIRD env var exists and is the only way to state the graph term outright:
-# VLLM_CUDAGRAPH_MEM_ESTIMATE_MB pins the WHOLE term to an exact MiB total in
-# one knob — estimate_cudagraph_memory() checks it FIRST and returns base/
-# per-graph untouched when set (verified in the shipped image,
-# v1/worker/gpu/cudagraph_mem.py). We ship the BASE/PER_GRAPH pair instead so
-# a future spec-decode shape re-prices automatically; switch to ESTIMATE_MB
-# only if the drift check below ever shows the pair cannot track capture.
-FRANK_PRIMARY_CUDAGRAPH_BASE_MB=0
-FRANK_PRIMARY_CUDAGRAPH_PER_GRAPH_MB=12
-
-# HOST-region cap — the last arena-plan term that still autofit per boot. With
-# no cap the planner's host bound is MemAvailable AT BOOT minus PLE 47.68 -
-# 2 x 7.0 process - 5.0 api/engine - 5% margin (measured boot 2026-10-05:
-# MemAvailable 237.97 -> 159.39 GiB usable across 2 ranks; the demand is 105.48
-# = 52.74/rank x 2 ranks, 23,040 swap-target experts). The same host reads 75.4
-# GiB available while running — the bound tracks whatever the co-tenants hold at
-# boot, and a boot where that drops near the demand silently pins next-hottest
-# experts VRAM-only instead (smaller swap region; the pinned_extra warning is
-# the only trace). Pin 120 GiB: measured demand + 14% headroom, on a host with
-# 246.1 GiB total. If a boot ever logs "expert-offload-mem … exceeds
-# MemAvailable at plan time", THAT is the contract being broken — look at the
-# co-tenant RAM before touching this number. Plan semantics verified in the
-# shipped image (offloader/expert_plan.py): the cap binds as the bound, an
-# exceedance only warns.
-FRANK_PRIMARY_EXPERT_OFFLOAD_MEM=120
-
-# --- optional engine knobs (unset == the flag is absent) ---------------------
-# FRANK_PRIMARY_SPEC holds the WHOLE --speculative-config JSON; setting it adds
-# the flag. THE RETIREMENT VERDICT WAS INVALID: c1248d4 (2026-10-02) retired MTP
-# by comparing fp8+MTP4 (37.4-40.6 tok/s, 54% acceptance, 09-29) against the
-# bf16 no-spec boot (36.4-39.4) — and bf16 then proved unbootable, so fp8 came
-# back without MTP and fp8+spec was NEVER compared against fp8+no-spec on the
-# same shape. The no-spec incumbent measures ~30 tok/s single-stream (below the
-# fleet's 35 tok/s target); every vendor flash-next recipe ships MTP3; and our
-# MTP4 run used the fork's default GREEDY draft sampling, while the recipes pass
-# draft_sample_method=probabilistic (greedy drafts are rejected more often under
-# temp>0 — the plausible cause of the 54%). MTP also re-adds drafter workspace:
-# the old note says the 7.2 GiB/rank KV ceiling WAS the MTP4 workspace, and
-# --expert-precise-memory spends that same budget, so an MTP arm must be tested
-# with precise memory BOTH on and off.
-#   MTP3:  '{"method":"mtp","num_speculative_tokens":3,"draft_sample_method":"probabilistic"}'
-FRANK_PRIMARY_SPEC=
-# FRANK_PRIMARY_COMPCONFIG holds the whole --compilation-config JSON. The
-# capture-ladder law: the piecewise cudagraph ladder must contain
-# num_speculative_tokens + 1 (MTP3 -> 4 -> ladder 4,8,12; MTP4 -> 5,10,15;
-# MTP5 -> 6,12,18,24), because every draft step proposes n+1 tokens. The default
-# ladder is multiples of 1+4 up to 512 then powers of two, so an MTP3 shape can
-# miss its own step size. Pinning the ladder is ALSO the candidate fix for the
-# SEQS>3 wall: query_start_loc is specialised to SEQS+1 and that constant must
-# land on a captured graph size (3 is not in the default ladder, 4 is —
-# measured 2026-10-02, and the vendor runs SEQS 16 on this model/TP2).
-# combo_kernels false/true are BOTH in the shipped recipes, so it is not a law.
-#   MTP3 at SEQS 3:  '{"cudagraph_mode":"PIECEWISE","cudagraph_capture_sizes":[1,4,8,12],"max_cudagraph_capture_size":12}'
-FRANK_PRIMARY_COMPCONFIG=
-# FRANK_PRIMARY_GEN_CONFIG holds the whole --override-generation-config JSON.
-# The payload's HF generation_config.json sets temperature 1.0 / top_p 0.95 /
-# top_k 20 and the engine WARNS about it on every boot, so a client that sends
-# no sampling fields gets creativity it never asked for. This is the one knob
-# that changes ANSWERS, not speed.
-#   '{"max_tokens":65536,"temperature":0.7,"top_p":0.95,"top_k":20}'
-FRANK_PRIMARY_GEN_CONFIG=
-
-# --- client contract: reasoning split, tools, preserve_thinking ----------------
-# Without --reasoning-parser the engine leaves the thinking text INLINE in
-# `content` with a dangling `</think>` and a null `reasoning` field (measured
-# 2026-10-01: content = 'We need answer...Brief.\n\n391') — the
-# malformed thinking block clients choke on. The qwen3 parser splits it
-# properly. The GLM rollback (d91379d) had dropped all three of these; the
-# working values are the ones ecaad36 shipped for this model.
-FRANK_PRIMARY_REASONING_PARSER=qwen3
-# Tools: --enable-auto-tool-choice + the qwen3_xml parser is what makes
-# tool_calls work here (without it, tool_choice auto returns 400).
-FRANK_PRIMARY_TOOL_PARSER=qwen3_xml
-# preserve_thinking keeps prior thinking blocks in the rendered prompt across
-# turns; enable_thinking makes thinking the server-side default. Verified the
-# payload's tokenizer_config template consumes both keys.
-FRANK_PRIMARY_CHAT_TEMPLATE_KWARGS='{"enable_thinking": true, "preserve_thinking": true}'

scripts/frank-primary.service

@@ -1,67 +0,0 @@
-# frank-primary.service — tcclaviger RDNA4 vLLM endpoint (orcarouter
-# Qwen3.8-Flash-Next-Uncensored-FP8, fp8 KV, NO spec decode, 3 slots x 200704
-# context with the pool sized to ~2 full-length conversations, TP=2, tiered
-# experts, 131-shard payload) on the 2x R9700 pair, dankserver :7770.
-# 2026-09-29 cutover from the R9V radiance fork (git tag
-# frank-primary-r9v-q8-20260929 is the pre-cutover state; its
-# launcher/shim/setup-state machinery is retired and the state dirs stay on
-# disk as rollback).
-#
-# Same port, same served alias; the harness models.yml id is unchanged.
-# The serve script drives `podman run` directly (the image entrypoint execs
-# `vllm serve`) and then waits on the container. NOTE: that wait can return
-# 0 even when the engine died mid-request (vLLM's API server drains and
-# exits clean on a worker fault), which is why the restart policy is
-# `always` — see the [Service] note.
-#
-# WHY A ROOT UNIT (not a rootless quadlet): the tiered-expert shape pins tens
-# of GiB of host RAM (the expert host slabs, ~20.5 GiB per rank of pinned
-# anonymous memory). Pinned pages are charged against RLIMIT_MEMLOCK; dank's
-# login session on this host carries 8 MiB and a user quadlet is capped by the
-# user manager's own hard limit — raising that means restarting
-# user@1000.service and bouncing every user container on the host. A root unit
-# grants LimitMEMLOCK=infinity to the dank process via PID1, and the image
-# stays in dank's rootless podman storage.
-[Unit]
-Description=frank-primary — tcclaviger vLLM Qwen3.8-Flash-Next-Uncensored-FP8 on 2x R9700
-After=network-online.target
-Wants=network-online.target
-# Never let the start-rate limiter give up after a crash loop (a failed LLM
-# endpoint that systemd refuses to retry is worse than a retrying one).
-StartLimitIntervalSec=0
-
-[Service]
-User=dank
-Group=dank
-# The tiered-expert offloader pins host RAM; an RLIMIT_MEMLOCK smaller than
-# the pinned set fails the load mid-start. PID1 grants infinity here —
-# parity with the fleet's other LLM units.
-LimitMEMLOCK=infinity
-Environment="FRANK_PRIMARY_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-primary.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-primary.sh
-# systemd stop: wait alone cannot stop the container child; stop it
-# explicitly. vLLM 0.26 drains gracefully on SIGTERM.
-ExecStop=/usr/bin/podman stop -t 120 frank-primary-qwen
-# Boot cost: FP8 payload page-in plus torch compile/graph capture —
-# ~15 min cold (measured 2026-09-29), faster warm.
-TimeoutStartSec=1800
-# Restart=always, NOT on-failure (measured 2026-10-01): a runtime
-# torch.OutOfMemoryError kills the engine while vLLM's API server still
-# exits 0, so ExecStart returned clean, systemd logged "Deactivated
-# successfully", and on-failure NEVER fired — the endpoint stayed down until
-# a human noticed. `always` restarts on any container death; an explicit
-# `systemctl stop` still wins (systemd does not restart a unit the operator
-# stopped), so bench windows and deploys are unaffected.
-Restart=always
-RestartSec=10
-# ExecStop allows the engine 120 s to drain (`podman stop -t 120`); without an
-# explicit TimeoutStopSec systemd's 90 s default cuts the stop short, kills it,
-# and records 'Failed with result timeout' (measured 2026-10-01 13:27:17).
-# Must exceed the podman grace with margin for the engine's own shutdown.
-TimeoutStopSec=180
-# The engine pins tens of GiB of host RAM (expert host slabs); it is the
-# last process on this host that should be chosen by the kernel OOM killer.
-OOMScoreAdjust=-500
-
-[Install]
-WantedBy=multi-user.target

scripts/frank-small.env

@@ -1,136 +0,0 @@
-# frank-small — llama.cpp (master, CUDA sm_86) serving
-# ornith-ai/Ornith-1.5-9B-GGUF:Q8_0 on the RTX 3090, :7771.
-#
-# 2026-10-05 (Frank): the payload moved off bartowski/MiMo-V2.6 (Q6_K) to
-# ornith-ai/Ornith-1.5-9B Q8_0 (9,786,060,384 B, LFS oid 22086870...).
-# Header-verified facts that re-price the shape: qwen35 hybrid like MiMo, but
-# 33 blocks (not 32) with full_attention_interval 4 => NINE full-attention
-# layers (MiMo had 8), 16 Q heads / 4 KV heads, k/v length 256, native window
-# 262144, dense (no expert keys), nextn_predict_layers=1 (an MTP head is IN
-# the file — capability only; no spec decode ships, same law as before).
-#
-# THE KV CONTRACT STAYS f16 K + f16 V — NO KV QUANTIZATION (Frank, 2026-10-05,
-# overruling a written q8_0-V proposal). The arithmetic that makes this hard:
-#   KV rate 9 attn layers x 4 heads x 256 x 2 B = 18 KiB/token K, same again
-#   for V at f16 => 36 KiB/token (MiMo was ~24.5 measured: one fewer
-#   full-attn layer AND one fewer KV head).
-#   Weights +1,900 MiB (9,334 vs Q6_K's 7,432). Measured free at the Q6_K
-#   4096/2048 shape was 2,279 MiB; Q8_0 at f16/f16 does not fit that shape —
-#   the deficit is made up the way Frank ordered: UBATCH FIRST (2048 -> 1024,
-#   the measured 616 MiB rung), then POOL STEPS, then measure. Guess-and-check
-#   on the live card is the accepted method for llama.cpp sizing here: boot,
-#   read nvidia-smi free, step the pool (12,288-token increments, ~432 MiB
-#   each at the 36 KiB/token rate) until the 2-3 GiB floor holds. Compute
-#   buffers allocate at graph capture during BOOT, so a failure is loud and
-#   fast, not a surprise at the first long prompt.
-#
-# Previous shape history (MiMo era, for the rollback trail): 2026-10-03 the
-# rung went Q5_K_M -> Q6_K with the pool HELD at 401,408; the freed third
-# slot funded exact f16 V first; the ~3.5 GiB still free funded the +875 MiB
-# of weights.
-#
-# 2026-10-03 (Frank): TWO streams instead of three, each one WIDE — 200,704
-# tokens per conversation, above the 200,700 the harness compacts at — and the
-# KV cache is now FULLY UNQUANTIZED (f16 K, f16 V). The two moves are the same
-# move: llama.cpp divides --ctx-size across --parallel slots, so the slot given
-# up is exactly the VRAM that pays for unquantized V. No further quantization
-# anywhere on this endpoint.
-#
-# Three measurements on this card, this runtime, price the terms:
-#   2 x 262,144, no projector: 20,190 MiB used / 4,386 free
-#     KV = 524,288 tok x 24.5 KiB = 12,800 MiB => non-KV (weights 6,557 +
-#     DeltaNet state ~25/slot + compute buffers + CUDA graphs) = 7,390 MiB
-#   3 x 196,608, projector on: 22,972 MiB used / 1,153 free
-#     KV = 14,113 MiB => non-KV WITH the vision tower = 8,859 MiB
-#   3 x 180,224, projector on: 21,684 MiB used / 2,441 free (the 2026-10-02
-#     shape) => non-KV = 8,748 MiB
-# Two slots give back one DeltaNet state (~25 MiB). Priced at f16 K+V
-# (32 KiB/token) this pool is 12,544 MiB, so the prediction is
-# 12,544 + ~8,800 = ~20.9 GiB used, ~3.1 GiB free — the band the 2026-10-02
-# shape hit, bought with precision instead of a slot. The 1024 ubatch
-# re-prices the compute buffers upward, so MEASURE after any change: if the
-# boot lands under 2 GiB free, step the pool down in 12,288-token
-# (384 MiB at this rate) increments.
-#
-# KV arithmetic: attention KV exists only in the 8 full-attention layers
-# (4 KV heads x 256 head_dim x 2 B) = 16 KiB/token for K and the same again for
-# V => 32 KiB/token, so 12,288 tokens (= 6144/slot) is one 384 MiB step — that
-# is the ladder to walk if this moves again. Two native windows (2 x 262,144)
-# are NOT reachable with full-precision V: 524,288 x 32 KiB = 16.1 GiB of KV
-# against a card with ~15.7 GiB of KV room once weights, the vision tower, the
-# DeltaNet states and the graphs are loaded. 200,704 per stream is what full
-# precision buys; q8_0 on V would buy 262,144 instead.
-#
-# The asymmetric-KV contract this endpoint was created for (Frank, 2026-10-01
-# night: f16 K + q8_0 V) is now spent — it existed to make a third slot fit,
-# and the third slot is gone. The flags stay explicit so the choice is visible
-# in the argv either way.
-LLAMA_BIN=/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server
-MODEL_FILE=/home/dank/models/Ornith-Q8/Ornith-1.5-9B-Q8_0.gguf
-
-# Vision: the Ornith Q8_0 GGUF ships no `v.*` tensors either (dense-9B byte
-# arithmetic: 9.79 GB ≈ 9B params x ~1.06 B/param leaves no room for a tower),
-# so the projector file IS the vision capability (mmproj-Ornith-1.5-9B-BF16
-# .gguf, 921,704,672 B, LFS oid 626f9f90..., fetched by
-# scripts/download-frank-small.sh). Empty string = text-only on purpose.
-MMPROJ_FILE=/home/dank/models/Ornith-Q8/mmproj-Ornith-1.5-9B-BF16.gguf
-
-# Fleet endpoint: same port and alias as every frank-small before it, so the
-# harness models.yml id and the homepage probe do not move.
-ALIAS=frank-small
-BIND_ADDR=0.0.0.0
-LISTEN_PORT=7771
-
-# ONE conversation at the NATIVE 262,144 window (Frank, 2026-10-05). The
-# two-slot shape died under Ornith and the NO-QUANTIZE law, by arithmetic:
-# the KV rate is the ARCHITECTURE's, not the quant's — 9 full-attn layers x
-# 4 KV heads x 256 dim x 2 B = 36 KiB/token at f16 K+V (MiMo measured 24.5),
-# so 2 x 200,704 wants ~14.1 GiB of KV on top of +1,900 MiB of Q8 weights
-# against 2,279 MiB measured free; ubatch 1024 claws back 616, and no
-# pool step fits BOTH the 2-3 GiB floor and the harness compaction
-# invariant (slot >= 191,148). One native slot fits with room; the window
-# per conversation RISES 200,704 -> 262,144. The cost: a second concurrent
-# request queues behind the released slot (subagent concurrency 2 -> 1).
-CTX_SIZE=262144
-PARALLEL=1
-
-# Compute-buffer geometry. This endpoint passed neither flag until 2026-10-03,
-# so it ran on llama.cpp's own defaults (2048/512); the pair is now 4096/2048.
-# Both are tunables because the pair is a measurement, not a law — and the
-# measurement is CARD-SPECIFIC. On the 2x R9700 layer-split sibling the ubatch
-# curve peaks at 512 and every step up costs GiB of compute buffer for no
-# speed (see frank-medium-batch-ubatch). On THIS CUDA 3090 the curve climbs
-# monotonically to 2048: 710 -> 1188 t/s prefill from ubatch 1024 to 2048 on
-# the 35B MoE sweep, 1944 -> 2423 t/s on the Ornith 8k sweep, with decode flat
-# to under 1 t/s on every rung. Ubatch is a prefill knob; decode never moves.
-#
-# The logical batch is free — two independent sweeps agree that at a fixed
-# ubatch, 2048/4096/8192 give identical prefill speed AND identical peak VRAM,
-# because the compute buffers are sized by the ubatch alone. Doubling it costs
-# nothing and buys nothing; it is here because it is the value the pair was
-# measured at.
-#
-# THE RISK IS ALL IN THE UBATCH. The 1024 -> 2048 step cost ~1,244 MiB of peak
-# graph VRAM on the 35B MoE (7,330 -> 8,574 MiB); this 9B hybrid has far
-# smaller compute tensors, so the delta should be well under that, but the
-# predecessor Q5_K_M shape recorded "ubatch 2048 failed the scratch boot" at
-# ~3,571 MiB free. The Q8_0 rung ships UBATCH 1024 (Frank, 2026-10-05: lower
-# ubatch FIRST — the measured 616 MiB step is the first VRAM the Q8 weights
-# claw back, before any pool move). Compute buffers are allocated at graph
-# capture during BOOT, so a failure is loud and fast, not a surprise at the
-# first long prompt. MEASURE nvidia-smi free immediately after the deploy:
-# under ~1.5 GiB, or a boot failure, step the POOL down next (12,288-token
-# increments, ~432 MiB each at the Ornith 36 KiB/token f16 KV rate).
-BATCH_SIZE=4096
-UBATCH_SIZE=1024
-
-# The KV contract (2026-10-05, Frank): f16 K + f16 V — NO KV quantization.
-# The q8_0-V arithmetic was written and OVERRULED. The Q8 weights eat the
-# VRAM that funded f16 V on 2026-10-03, so the remedy ladder is UBATCH FIRST
-# (2048 -> 1024, the measured 616 MiB rung), then POOL STEPS — and
-# guess-and-check on the live card is the accepted method: boot, read
-# nvidia-smi, step down until the floor holds. --flash-attn stays pinned on
-# in the serve script: it is the fast path for f16 KV.
-CACHE_TYPE_K=f16
-CACHE_TYPE_V=f16
-NGL=99

scripts/frank-small.service

@@ -1,19 +0,0 @@
-[Unit]
-Description=llama.cpp MiMo-V2.6-Distill-Qwen-9B Q6_K GGUF (qwen35 hybrid, 2x200704, unquantized f16 KV, mmproj vision) on the RTX 3090 (dankclaw, frank-small)
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-# CUDA pins its staging buffers, so the process needs the memlock budget even
-# though the weights themselves are copied into VRAM.
-LimitMEMLOCK=infinity
-Environment="FRANK_SMALL_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-small.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-small.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

scripts/frank-zealot.env

@@ -0,0 +1,62 @@
+# frank-zealot — llama.cpp (master, CUDA sm_86) serving
+# HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive at Q6_K on the RTX 3090,
+# :7771.
+#
+# 2026-10-07 (Frank): swap from Gemma4-26B-A4B QAT Q4_K_M (one 200,704 slot)
+# to Qwen3.5-9B Q6_K at TWO 200,704-token conversations, EXACT (f16) KV,
+# MTP disabled (SPEC_TYPE=none), log verbosity 4.
+#
+# Architecture — read from the GGUF's own header (HTTP range read, not the
+# model card): arch qwen35, 32 layers, dense 9B, full_attention_interval 4
+# ⇒ 8 full-attention layers (3,7,11,...,31) + 24 Gated DeltaNet linear layers,
+# 16 attention heads / 4 KV heads × 256 dim, ssm conv_kernel 4 / state_size
+# 128 / group_count 16 / time_step_rank 32 / inner_size 4096, native 262,144,
+# vocab 248,320, file_type 18 (Q6_K). Tensor-type histogram: Q6_K×250 +
+# F32×177 — standard types only, so the stock master build loads it (no
+# custom-quant lock-in like the ROCmFPX era). NO nextn/mtp tensors exist, so
+# in-file MTP is impossible here; SPEC_TYPE=none is forced by the payload.
+#
+# The KV rate follows from the architecture: 8 full layers × 4 KV heads ×
+# 256 dim = 8,192 elements per token per cache. f16 K + f16 V = 32,768
+# B/token = 32 KiB/token, so the 401,408-token pool is 12.25 GiB. The 24
+# DeltaNet layers cost a fixed recurrent state per SLOT (not per token) —
+# that is why two 200k slots fit where the 26B MoE fit only one.
+#
+# Feasibility comes from the predecessor's MEASURED boots, not a formula:
+# MiMo-V2.6-Distill-Qwen-9B (identical qwen35 geometry, 7,793,710,624 B) at
+# 2×200,704 f16 K + f16 V measured 21,276 used / 2,849 free at ubatch 1024
+# and 21,846 / 2,279 at ubatch 2048. This file is 415 MiB lighter in weights,
+# its BF16 mmproj is 3 MiB heavier ⇒ projected ~21,430 used / ~2,700 free.
+# The verbosity-4 boot ledger is the referee.
+#
+# Ubatch 2048 is the measured CUDA optimum (measured on the MiMo predecessor
+# at this exact arch + shape: +4.6 % prefill at 8.9k depth, decode flat, cost
+# 616 MiB). 1024 is the fallback rung if the boot lands under the 2 GiB floor.
+LLAMA_BIN=/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server
+MODEL_FILE=/home/dank/models/Qwen35-9B-HauhauCS-Q6K/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf
+MMPROJ_FILE=/home/dank/models/Qwen35-9B-HauhauCS-Q6K/mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf
+# Served model id — the harness/family name (Protoss rename completed to the
+# wire 2026-10-09: harness ids + homepage cards 2026-10-08, /v1/models aliases
+# this day). The SERVICE, unit, scripts and this env file keep the
+# frank-zealot name; only the alias on the wire changed. Consumers that
+# key on the served id: OpenWebUI (model row, access_grant, api_configs
+# model_ids) and the harness models.yml.
+ALIAS=frank-zealot
+BIND_ADDR=0.0.0.0
+LISTEN_PORT=7771
+# CTX_SIZE is the POOL llama.cpp divides across slots: 401,408 / 2 = 200,704
+# per conversation. MUST stay divisible by PARALLEL (the seam enforces it) and
+# the harness contextWindow quotes the PER-SLOT number — a longer prompt is
+# answered with a 400, never truncated.
+CTX_SIZE=401408
+PARALLEL=2
+BATCH_SIZE=4096
+UBATCH_SIZE=2048
+CACHE_TYPE_K=f16
+CACHE_TYPE_V=f16
+SPEC_TYPE=none
+NGL=99
+# Log verbosity threshold (llama.cpp -lv). 4 = debug: KV layout, buffer sizes
+# and graph capture land in the journal, which is what the VRAM-fit forensics
+# read. Levels above 4 flood the journal.
+VERBOSITY=4

scripts/frank-zealot.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=llama.cpp Qwen3.5-9B-Uncensored-HauhauCS-Aggressive Q6_K GGUF (qwen35 hybrid, 2x200704 slots, f16 K+V, MTP off, mmproj vision) on the RTX 3090 (dankclaw, frank-zealot)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=dank
+Group=dank
+# CUDA pins its staging buffers, so the process needs the memlock budget even
+# though the weights themselves are copied into VRAM.
+LimitMEMLOCK=infinity
+Environment="FRANK_ZEALOT_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-zealot.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-zealot.sh
+# Restart=always is the right policy for a serving daemon: a process that
+# exits on its own — exit 0 — is a CLEAN stop to systemd, so on-failure
+# never fires and the endpoint stays dark (with the unit reporting
+# success) until the next boot. frank-zealot is the fleet's compaction
+# hub — every endpoint's compaction dies when it does.
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

scripts/hfget.sh

@@ -0,0 +1,107 @@
+#!/bin/sh
+# hfget.sh -- fetch a Hugging Face repo with curl and jq, and nothing else.
+#
+# The engine and its tooling do not depend on Python, so `huggingface-cli` is not assumed. The API
+# gives a file listing as JSON and every file has a stable resolve/ URL, which is all a downloader
+# needs.
+#
+#   scripts/hfget.sh <repo-id> [dest-dir] [revision]
+#
+# Set HF_TOKEN for a gated or private repo. Re-running resumes: a file whose local size already
+# matches the listing is skipped and a short one is continued with `curl -C -`, so an interrupted
+# transfer of a 300 GB checkpoint costs only what it had not finished.
+#
+# WEIGHT DUPLICATES ARE SKIPPED. Many repos carry the same tensors several times over -- safetensors
+# beside the older pickle .bin, an ONNX export, a GGUF conversion -- and on a large checkpoint each
+# copy is hundreds of gigabytes of the same numbers. When the listing holds any .safetensors, every
+# other weight format is left behind.
+#
+# HFGET_JOBS concurrent transfers, default 4. These are long sequential reads: a few streams
+# saturate the link and more only makes the destination seek.
+set -e
+
+# ---- child mode: one file, named by "<size><tab><path>" in $1, everything else inherited -------
+# sh cannot export a function, so parallelism is one re-entry of this script per file under
+# `xargs -P` rather than a worker pool.
+if [ -n "$HFGET_CHILD" ]; then
+    size=${1%%	*}; path=${1#*	}
+    out=$HFGET_DEST/$path
+    if [ -f "$out" ]; then
+        cur=$(wc -c < "$out")
+        if [ "$cur" = "$size" ]; then echo "  = $path"; exit 0; fi
+        echo "  + $path (resuming at $cur of $size)"
+    else
+        echo "  > $path"
+    fi
+    mkdir -p "$(dirname "$out")"
+    if [ -n "$HF_TOKEN" ]; then
+        curl -sSL --fail --retry 5 --retry-delay 5 --retry-all-errors -C - \
+             -H "Authorization: Bearer $HF_TOKEN" \
+             -o "$out" "https://huggingface.co/$HFGET_REPO/resolve/$HFGET_REV/$path"
+    else
+        curl -sSL --fail --retry 5 --retry-delay 5 --retry-all-errors -C - \
+             -o "$out" "https://huggingface.co/$HFGET_REPO/resolve/$HFGET_REV/$path"
+    fi
+    got=$(wc -c < "$out")
+    [ "$got" = "$size" ] || { echo "hfget: $path is $got bytes, listing says $size" >&2; exit 1; }
+    exit 0
+fi
+
+# ---- parent ------------------------------------------------------------------------------------
+repo=$1
+[ -n "$repo" ] || { echo "usage: hfget.sh <repo-id> [dest-dir] [revision]" >&2; exit 2; }
+dest=${2:-$HOME/models/$repo}
+rev=${3:-main}
+jobs=${HFGET_JOBS:-4}
+command -v jq >/dev/null || { echo "hfget: jq is required" >&2; exit 2; }
+
+echo "hfget: listing $repo@$rev"
+# THE LISTING IS PAGINATED AND THE PAGE SIZE IS SMALL. A large checkpoint runs to a hundred-odd
+# shards and the API returns fifty entries with a `Link: ...; rel="next"` header. Taking only the
+# first page is the worst possible failure here: every file it did fetch is the right length, so
+# the size check passes and the converter is handed a checkpoint missing two thirds of its
+# tensors. Follow the cursor until there is no next link.
+api="https://huggingface.co/api/models/$repo/tree/$rev?recursive=true&expand=true"
+listing='[]'
+page=0
+while [ -n "$api" ]; do
+    hdr=$(mktemp "${TMPDIR:-/tmp}/hfhdr.XXXXXX")
+    if [ -n "$HF_TOKEN" ]; then
+        body=$(curl -sSL --fail-with-body -D "$hdr" -H "Authorization: Bearer $HF_TOKEN" "$api")
+    else
+        body=$(curl -sSL --fail-with-body -D "$hdr" "$api")
+    fi
+    [ "$(printf '%s' "$body" | jq -r 'type')" = "array" ] || {
+        rm -f "$hdr"
+        echo "hfget: $(printf '%s' "$body" | jq -r '.error // .message // .')" >&2
+        echo "hfget: a gated or private repo needs HF_TOKEN in the environment" >&2; exit 1; }
+    listing=$(printf '%s\n%s' "$listing" "$body" | jq -s 'add')
+    api=$(tr -d '\r' < "$hdr" | sed -n 's/^[Ll]ink: *<\([^>]*\)>; *rel="next".*/\1/p' | head -1)
+    rm -f "$hdr"
+    page=$((page + 1))
+    [ "$page" -gt 200 ] && { echo "hfget: listing did not terminate after 200 pages" >&2; exit 1; }
+done
+echo "hfget: $page page(s) of listing"
+have_st=$(printf '%s' "$listing" | jq '[.[] | select(.path | endswith(".safetensors"))] | length')
+sel='.[] | select(.type == "file")'
+[ "$have_st" -gt 0 ] && sel="$sel"' | select((.path | test("\\.(bin|pth|msgpack|h5|onnx|onnx_data|gguf)$")) | not)'
+
+list=$(mktemp "${TMPDIR:-/tmp}/hfget.XXXXXX")
+trap 'rm -f "$list"' EXIT INT TERM
+printf '%s' "$listing" | jq -r "$sel"' | "\(.size)\t\(.path)"' > "$list"
+
+n=$(wc -l < "$list")
+[ "$n" -gt 0 ] || { echo "hfget: the listing has no files" >&2; exit 1; }
+need=$(awk -F'\t' '{s += $1} END {printf "%.1f", s / 1073741824}' "$list")
+mkdir -p "$dest"
+free=$(df -BG --output=avail "$dest" | tail -1 | tr -dc '0-9')
+echo "hfget: $n file(s), $need GiB -> $dest"
+[ "$have_st" -gt 0 ] && echo "hfget: safetensors present, pickle weight formats skipped"
+echo "hfget: $free GiB free on the destination filesystem"
+awk -v n="$need" -v f="$free" 'BEGIN { if (n > f) { print "hfget: THE DOWNLOAD DOES NOT FIT"; exit 1 } }'
+
+export HFGET_CHILD=1 HFGET_DEST="$dest" HFGET_REPO="$repo" HFGET_REV="$rev"
+self=$(cd "$(dirname "$0")" && pwd)/$(basename "$0")
+tr '\n' '\0' < "$list" | xargs -0 -P "$jobs" -I{} sh "$self" "{}" \
+    || { echo "hfget: incomplete -- re-run to resume" >&2; exit 1; }
+echo "hfget: complete -- $(du -sh "$dest" | cut -f1) in $dest"

scripts/kld-gate-swift15.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# kld-gate-swift15.sh — RUNS ON DANKSERVER. Score the quantized candidate
+# against the BF16 reference and apply the pre-approved gate:
+#   mean KL <= 0.03 AND top-1 agreement >= 95%.
+# Same engine (1.0.13) and same boot shape as the reference RECORD
+# (run-swift15-bf16.sh kld): disk-tier, no speculation, deterministic, fp8 KV.
+# --kld-ref reads its tokens from the reference (no --kld-corpus here — the
+# (run-swift15-bf16.sh kld): 1.0.13, tp 2, disk-tier, fp8 KV, no speculation,
+# deterministic, max-model-len 16384, vram-kv 3072, 4 slots. Two deviations
+# are forced by the w4 file: MNBT 2048 (the w4 kernels stream from the file
+# tier ONLY at MNBT<=2048 — at the recording's 32768 the engine demands a
+# widened form: "DID NOT FIT ... stored form is not the container's"), and
+# pool 40960 (the recording's 12 GiB pool predates the w4 tables; at 12288 the
+# gate_up slab cannot be cached). Chunk size is softmax-invariant, so the
+# MNBT delta is float-order noise riding on the KL floor.
+set -uo pipefail
+PIN=sha256:4c3f484564bb2872784e46b0a59cbd71becc9c1e746e301a3596ffae253c322e
+C=swift15gate
+LOG=/home/dank/logs/swift15_kldgate.log
+KLD_REF_DIR=/home/dank/corpora/kld-ref
+KLD_OUT=/home/dank/radiance-state/kld-gate.json
+
+[ -d "$KLD_REF_DIR" ] || { echo "missing reference: $KLD_REF_DIR"; exit 2; }
+: > "$KLD_OUT"
+cp -f /home/dank/serverAppConfigs/scripts/qwen38-froggeric-v22.5.jinja \
+      /home/dank/models/tpl.jinja 2>/dev/null || true
+sudo systemctl stop frank-archon >/dev/null 2>&1 || true
+podman rm -f "$C" >/dev/null 2>&1 || true
+
+podman run --rm --name "$C" \
+    --network host --init \
+    --security-opt seccomp=unconfined \
+    --ulimit memlock=-1:-1 \
+    --device /dev/kfd --device /dev/dri \
+    -v /home/dank/models:/models:ro \
+    -v /home/dank/radiance-state:/data \
+    -v "$KLD_REF_DIR:/data/kld-ref:ro" \
+    "stilldeadcode/radiance@$PIN" \
+    --model /models/rad/qwen4exp-swift15-w4dn8-i8-hc8m.rad \
+    --tp 2 --placement expert_tiered --weights-disk-tier \
+    --host-pool-mib 40960 --deterministic --gpu-headroom-mib 768 \
+    --num-speculative-tokens 0 \
+    --kv-cache-dtype fp8 --max-model-len 16384 \
+    --ngram-placement ram \
+    --override-chat-template /models/tpl.jinja \
+    --kld-ref /data/kld-ref --kld-out /data/kld-gate.json \
+    --vram-kv-mib 3072 \
+    --max-num-seqs 4 --max-num-batched-tokens 2048 \
+    2>&1 | tee "$LOG"
+rc=${PIPESTATUS[0]}
+[ "$rc" -eq 0 ] || { echo "KLD GATE BOOT FAILED rc=$rc; log: $LOG"; exit "$rc"; }
+
+python3 - "$KLD_OUT" "$LOG" <<'PY'
+import json, sys, re
+out, log = sys.argv[1], sys.argv[2]
+def num(pat):
+    m = re.findall(pat, open(log, errors="replace").read(), re.I)
+    return float(m[-1]) if m else None
+kl = top1 = None
+try:
+    d = json.load(open(out))
+    def find(obj, keys):
+        if isinstance(obj, dict):
+            for k, v in obj.items():
+                if any(s in k.lower() for s in keys) and isinstance(v, (int, float)):
+                    return float(v)
+            for v in obj.values():
+                r = find(v, keys)
+                if r is not None: return r
+        return None
+    kl = find(d, ("mean_kl", "mean kl", "kl_mean", "mean"))
+    top1 = find(d, ("top1", "top_1", "top-1", "agreement"))
+    if top1 is not None and top1 <= 1.0:
+        top1 *= 100.0
+except Exception as e:
+    print("report JSON unusable (%s); falling back to log" % e)
+if kl is None:
+    kl = num(r"mean[_ ]kl[^0-9]*([0-9]*\.?[0-9]+(?:e[-+][0-9]+)?)")
+if top1 is None:
+    top1 = num(r"top[-_ ]?1[^0-9]*([0-9]*\.?[0-9]+)")
+if kl is None or top1 is None:
+    print("KLD GATE PARSE FAILED: mean_kl=%s top1=%s — inspect %s / %s" % (kl, top1, out, log))
+    sys.exit(2)
+print("KLD GATE: mean KL = %.4f (max 0.03) | top-1 = %.2f%% (min 95.0)" % (kl, top1))
+ok = (kl <= 0.03) and (top1 >= 95.0)
+print("KLD GATE " + ("PASS" if ok else "FAIL"))
+sys.exit(0 if ok else 1)
+PY
+gate=$?
+echo "kld-gate complete rc=$gate; log: $LOG report: $KLD_OUT"
+exit "$gate"

scripts/kld-then-calib.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# kld-then-calib.sh — RUNS ON DANKSERVER. Campaign chain: wait for the KLD
+# record to finish, verify it, then boot the 1.2.0 calibration server and
+# push the 10M-token corpus. One GPU, so the phases serialize; prod is
+# restored by each run script's trap.
+set -u
+KLOG=/home/dank/logs/swift15-kld-driver.log
+CLOG=/home/dank/logs/swift15-calib-driver.log
+S=/home/dank/serverAppConfigs-swift15/scripts
+# Phase 1: KLD record (SKIP_KLD=1 when the record is already complete —
+# kld.json's rows count is the receipt; a mid-run script swap can kill the
+# wrapper with rc=127 after the engine exited clean).
+if [ "${SKIP_KLD:-0}" != 1 ]; then
+    while ! grep -q "exited rc=" "$KLOG" 2>/dev/null; do sleep 60; done
+    RC=$(grep -o "exited rc=[0-9]*" "$KLOG" | tail -1)
+    if [ "$RC" != "exited rc=0" ]; then echo "KLD FAILED ($RC); calib NOT started"; exit 1; fi
+fi
+N=$(find /home/dank/corpora/kld-ref -type f | wc -l)
+SZ=$(du -sm /home/dank/corpora/kld-ref | cut -f1)
+echo "KLD OK files=$N size_mib=$SZ"
+[ "$N" -ge 5 ] && [ "$SZ" -ge 1000 ] || { echo "kld-ref looks thin; calib NOT started"; exit 1; }
+grep -q '"rows": 50235' /home/dank/corpora/kld-ref/kld.json || {
+    echo "kld.json rows != 50235; calib NOT started"; exit 1; }
+
+# Phase 2: calibration serve (1.2.0) + corpus push.
+nohup bash "$S/run-swift15-bf16.sh" calib > "$CLOG" 2>&1 &
+CP=$!
+for _ in $(seq 1 160); do
+    sleep 15
+    curl -sf localhost:7770/health >/dev/null 2>&1 && break
+done
+if ! curl -sf localhost:7770/health >/dev/null 2>&1; then
+    echo "CALIB BOOT FAILED; see /home/dank/logs/swift15_bf16.log"; kill "$CP" 2>/dev/null; exit 1
+fi
+echo "CALIB UP, pushing corpus"
+python3 "$S/calib-push.py" --port 7770 --parallel 16 --container swift15ref --max-rounds 6
+PUSH=$?
+kill "$CP" 2>/dev/null
+sleep 10
+echo "CALIB_CHAIN_DONE push=$PUSH grams=$(find /home/dank/corpora/calib -name 'gram.r*.bin' 2>/dev/null | wc -l)"

scripts/lib/llm-gates.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# llm-gates.sh — the artifact gates every LLM endpoint runs before it starts.
+#
+# Why this file exists: every LLM endpoint gates its payload twice — the
+# serve script at start, the deployer before dispatch. Two hand-written
+# copies of the same checks drift apart in wording and strictness, and the
+# drift surfaces as deploy-time disagreement: one side passes, the other
+# refuses, and the failure lands in production instead of in the gate.
+# Both sides source this library, so the refusal is one text and one rule.
+#
+# Contract (public interface):
+#   require_exec      PATH LABEL HINT
+#   require_file      PATH LABEL HINT
+#   require_bytes     PATH LABEL WANT_BYTES HINT
+#   require_min_mib   PATH LABEL MIN_MIB HINT
+#   require_dir_files DIR  LABEL HINT FILE...
+#   require_image     REF  HINT
+#
+# Each returns 0 and prints nothing on success. On failure it prints two
+# lines to stderr — the first naming the endpoint ($GATE_PREFIX) and the
+# artifact, the second the remedy — and returns 1. It NEVER exits: the serve
+# scripts run under `set -e` (so a refusal is terminal), while the deployer
+# wants `|| return 1` so a failed gate reports a red deploy for that one
+# service and the dispatcher's state marker stays pending.
+# Lines are labelled by ARTIFACT CLASS, and the class is the whole label
+# (the path rides in the same line): the class + path is what an operator
+# acts on, so no wording order and no payload rename can make the two twins
+# disagree. The deployer's old "halogen vision tower" and the serve script's
+# "vision-tower" were one gate in two vocabularies that no grep could join.
+
+# Size checks use equality, not a floor, for `require_bytes`: a fetch that
+# truncates looks like a success (an HTTP error exit is often swallowed, and
+# the error body is written in the artifact's place), so "exists and is big
+# enough" is not proof of the right artifact. The declared byte count is a
+# contract in both directions — a bigger file is a DIFFERENT artifact.
+
+# GATE_PREFIX names the endpoint in every refusal (e.g. frank-dragoon). The
+# caller exports it; shellcheck cannot follow it across the source boundary,
+# so the read site carries the directive.
+# shellcheck disable=SC2034
+: "${GATE_PREFIX:=gate}"
+
+# Two bash behaviors make the `return 1` at every call site load-bearing:
+#   * a function whose body ends inside an `if` returns the CONDITION's
+#     status (true = 0), so a gate that ends on its own refusal prints the
+#     refusal and reports SUCCESS;
+#   * `set -e` is suspended for any command in a `… || …` chain, so a gate
+#     that runs inside one must not be trusted to abort the caller.
+# Every gate's refusal therefore carries an explicit `|| return 1`, and the
+# caller consumes the status (`|| exit 1`, `|| return 1`).
+_gate_fail() {
+    printf '%s: %s\n' "$GATE_PREFIX" "$1" >&2
+    printf '  hint: %s\n' "$2" >&2
+    return 1
+}
+
+# require_file — PATH must be a regular file. A directory (an unpacked
+# staging dir wearing the payload's name) and a symlink (a HuggingFace cache
+# snapshot's entry, which dangles inside the container mount) both refuse.
+require_file() {
+    local path="$1" label="$2" hint="$3"
+    if [[ -L "$path" || ! -f "$path" ]]; then
+        _gate_fail "$label: missing at $path" "$hint" || return 1
+    fi
+    return 0
+}
+
+# require_exec — PATH must be an executable regular file. The native runtimes
+# (llama.cpp's llama-server) are binaries the operator builds; a tree that
+# compiled but lost its +x, or a directory wearing the binary's name, must
+# refuse the same way a missing one does.
+require_exec() {
+    local path="$1" label="$2" hint="$3"
+    if [[ -L "$path" || ! -x "$path" ]]; then
+        _gate_fail "$label: missing at $path" "$hint" || return 1
+    fi
+    return 0
+}
+
+# require_bytes — PATH must exist AND be exactly WANT_BYTES bytes.
+require_bytes() {
+    local path="$1" label="$2" want="$3" hint="$4" got
+    require_file "$path" "$label" "$hint" || return 1
+    got="$(stat -c %s "$path")"
+    if [[ "$got" != "$want" ]]; then
+        _gate_fail "$label: is $got bytes, expected $want" "$hint" || return 1
+    fi
+    return 0
+}
+
+# require_min_mib — PATH must be at least MIN_MIB mebibytes. The floor form
+# is for build products (a .rad container is a range of legal sizes; a
+# truncated convert is not).
+require_min_mib() {
+    local path="$1" label="$2" min="$3" hint="$4" mib
+    require_file "$path" "$label" "$hint" || return 1
+    mib=$(( $(stat -c %s "$path") / 1048576 ))
+    if (( mib < min )); then
+        _gate_fail "$label: is $mib MiB, expected >= $min MiB" "$hint" || return 1
+    fi
+    return 0
+}
+
+# require_dir_files — DIR must be a directory and every named member a
+# regular file, never a symlink: snapshot layouts link files into place, and
+# a link dangles inside the container mount even when the directory itself
+# is real. A symlinked DIRECTORY is refused too — the same layout can link
+# the directory itself, and the link dangles identically.
+require_dir_files() {
+    local dir="$1" label="$2" hint="$3"
+    shift 3
+    local f
+    if [[ -L "$dir" || ! -d "$dir" ]]; then
+        _gate_fail "$label: missing at $dir" "$hint" || return 1
+    fi
+    for f in "$@"; do
+        if [[ -L "$dir/$f" || ! -f "$dir/$f" ]]; then
+            _gate_fail "$label: $dir/$f is missing or a symlink" "$hint" || return 1
+        fi
+    done
+    return 0
+}
+
+# require_image — the image ref must be in podman storage. A name@sha256 ref
+# exists only if THAT manifest was pulled, so the gate is the ref itself, in
+# one command: no pipefail/grep race (the 2026-09-30 lesson).
+require_image() {
+    local ref="$1" hint="$2"
+    if ! podman image exists "$ref"; then
+        _gate_fail "image: $ref is not in podman storage" "$hint" || return 1
+    fi
+    return 0
+}

scripts/make-calib-corpus.py

@@ -0,0 +1,317 @@
+#!/usr/bin/env python3
+"""Build the two Swift1.5 campaign corpora (calibration + KLD).
+
+calib.jsonl — 10M tokens of agent-shaped RAW text (45% code, 30% prose,
+25% tool-call JSON), one {"prompt": text} per line, pushed to
+/v1/completions with max_tokens=1 during the calibration run (the Hessian
+tap is of the prompt tokens; docs/MOE-W4.md step 2). Code and prose mix
+the repo checkout with HF dataset parquets (Frank's call 2026-10-06:
+local material is only ~1.6M unique tokens; MOE-W4 wants 10M):
+nampdn-ai/tiny-codes (code) and Salesforce/wikitext wikitext-103-raw
+(prose). Tool calls are synthesized from commands harvested from the
+repo's own scripts plus a fleet-ops set, with argument-shaped variants.
+
+kld.jsonl — 1.8M tokens, one {"prompt", "score_from", "source"} per
+line; each prompt is a multi-turn conversation rendered through the
+Froggeric v22.5 template with a >= --kld-min-prompt (8192) token target,
+and the last 256 tokens (the tail of the assistant answer) are the
+scored span: score_from = n - 256. At 8k-token prompts the 1.8M corpus
+is ~220 prompts = ~56k scored positions ~= 25 GB of record, matching
+the published Flash-Next KLD scale (83k positions, MOE-W4.md). The KLD
+reference run and every candidate run consume the SAME file (TOOLS.md
+--kld-record / --kld-ref). The KLD corpus is LOCAL material only, so the
+file-level disjointness rule (fnv1a64(path) % 5 == 0 -> KLD pool) is
+untouched by the HF additions.
+
+Deps: tokenizers, jinja2, pyarrow (venv /home/dank/venvs/radcorpus).
+Usage: make-calib-corpus.py --repo ROOT --tokenizer-json PATH
+    --template PATH --out-dir DIR [--hf-code-parquet F,F]
+    [--hf-prose-parquet F,F] [--calib-tokens 10000000]
+    [--kld-tokens 1800000]
+"""
+import argparse
+import json
+import os
+import random
+import re
+
+from jinja2 import Environment, FileSystemLoader
+from tokenizers import Tokenizer
+
+CODE_EXT = (".sh", ".py", ".jinja", ".recipe", ".env", ".example",
+            ".yaml", ".yml", ".bats", ".service", ".container", ".toml")
+JSONL_EXTS = (".jsonl", ".json")
+DOC_DIR = "serverAppConfigs-docs"
+
+FLEET_CMDS = [
+    "systemctl status frank-archon --no-pager",
+    "journalctl -u frank-archon -n 100 --no-pager",
+    "podman ps --format '{{.Names}} {{.Status}}'",
+    "podman logs --tail 50 frank-archon",
+    "curl -s http://192.168.0.235:7770/health",
+    "curl -s http://192.168.0.235:7770/metrics | grep radiance_",
+    "df -h /home/dank | tail -1",
+    "free -g",
+    "sudo systemctl restart frank-archon",
+    "cd /home/dank/serverAppConfigs && git pull --ff-only",
+    "./scripts/deploy.sh dankserver --service frank-archon",
+    "./tests/run.sh 2>&1 | tail -5",
+    "jq . /home/dank/models/rad/index.json | head -40",
+    "python3 -c \"import json; print(json.load(open('config.json'))['num_hidden_layers'])\"",
+    "ip neigh show 192.168.0.235",
+    "amdgpu_top --device-info 2>/dev/null | head -20",
+    "grep -E 'MemAvailable' /proc/meminfo",
+    "sha256sum model-00001-of-00131.safetensors",
+    "git log --oneline -10",
+    "awk '{s+=$1} END {print s}' shard_sizes.txt",
+]
+TOOL_NAMES = ["bash", "read", "grep", "web_search", "edit", "write"]
+WORKDIRS = ["/home/dank", "/home/dank/serverAppConfigs", "/home/dank/models",
+            "/etc/systemd/system", "/var/log"]
+DESCS = ["check service state", "tail the engine ledger", "list containers",
+          "query health", "read metrics", "check disk", "check memory",
+          "restart the endpoint", "sync the checkout", "run deployer",
+          "run the test seams", "inspect the index", "probe the peer"]
+
+
+def fnv(s: str) -> int:
+    h = 0xcbf29ce484222325
+    for b in s.encode():
+        h = ((h ^ b) * 0x100000001b3) & 0xFFFFFFFFFFFFFFFF
+    return h
+
+
+def harvest_cmds(repo: str, rng: random.Random) -> list[str]:
+    cmds = list(FLEET_CMDS)
+    pat = re.compile(r"^\s*(?:sudo\s+)?([a-z][\w./-]*(?:\s+\S+){1,6})\s*$")
+    for root, dirs, files in os.walk(repo):
+        dirs[:] = [d for d in dirs if not d.startswith(".")]
+        for f in files:
+            if not f.endswith(".sh"):
+                continue
+            try:
+                for line in open(os.path.join(root, f), encoding="utf-8",
+                                 errors="replace"):
+                    m = pat.match(line.rstrip())
+                    if m and len(m.group(1)) > 12:
+                        cmds.append("ssh dank@192.168.0.235 '"
+                                    + m.group(1)[:90] + "'")
+            except OSError:
+                pass
+    rng.shuffle(cmds)
+    return cmds[:4000]
+
+
+def tool_call(rng: random.Random, cmds: list[str]) -> str:
+    """One agent turn: 2-4 tool calls with argument-shaped JSON."""
+    parts = []
+    for _ in range(rng.randint(2, 4)):
+        args: dict = {"command": rng.choice(cmds)}
+        if rng.random() < 0.4:
+            args["cwd"] = rng.choice(WORKDIRS)
+        if rng.random() < 0.3:
+            args["timeout"] = rng.choice([10, 30, 60, 300, 600])
+        if rng.random() < 0.5:
+            args["description"] = rng.choice(DESCS)
+        parts.append('<tool_call>{"name": "%s", "arguments": %s}<|im_end|>'
+                     % (rng.choice(TOOL_NAMES),
+                        json.dumps(args, ensure_ascii=False)))
+    return "\n".join(parts)
+
+
+def load_parquet_texts(path: str, kind: str, rng: random.Random,
+                       cap: int) -> list[str]:
+    import pyarrow.parquet as pq
+    d = pq.read_table(path).to_pydict()
+    n = len(next(iter(d.values())))
+    idx = range(n) if n <= cap else rng.sample(range(n), cap)
+    out = []
+    for i in idx:
+        if kind == "code":
+            if "content" in d:
+                frag = d["content"][i]
+            else:
+                frag = ("// %s\n### Instruction:\n%s\n### Response:\n%s"
+                        % (d.get("file_name", [""])[i], d["prompt"][i],
+                           d["code"][i] or d["response"][i]))
+        else:
+            frag = d["text"][i]
+        if frag and frag.strip():
+            out.append(frag[:8000])
+    rng.shuffle(out)
+    return out[:cap]
+
+
+def main() -> None:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--repo", required=True)
+    ap.add_argument("--tokenizer-json", required=True)
+    ap.add_argument("--template", required=True)
+    ap.add_argument("--out-dir", required=True)
+    ap.add_argument("--calib-tokens", type=int, default=10_000_000)
+    ap.add_argument("--kld-tokens", type=int, default=1_800_000)
+    ap.add_argument("--chunk-tokens", type=int, default=8192)
+    ap.add_argument("--score-tail", type=int, default=256)
+    ap.add_argument("--kld-min-prompt", type=int, default=8192)
+    ap.add_argument("--hf-code-parquet", default="")
+    ap.add_argument("--hf-prose-parquet", default="")
+    ap.add_argument("--seed", type=int, default=20261006)
+    a = ap.parse_args()
+
+    rng = random.Random(a.seed)
+    tokenizer = Tokenizer.from_file(a.tokenizer_json)
+    env = Environment(loader=FileSystemLoader(os.path.dirname(a.template)),
+                      trim_blocks=True, lstrip_blocks=True)
+    env.filters["tojson"] = lambda v: json.dumps(v, ensure_ascii=False)
+    env.filters["raise_exception"] = lambda m: (_ for _ in ()).throw(
+        ValueError(m))
+    tname = os.path.basename(a.template)
+
+    code, prose, jsonl = [], [], []
+    for root, dirs, files in os.walk(a.repo):
+        dirs[:] = [d for d in dirs if not d.startswith(".")]
+        for f in sorted(files):
+            p = os.path.relpath(os.path.join(root, f), a.repo)
+            if DOC_DIR in p and f.endswith(".md"):
+                prose.append(p)
+            elif p.startswith(DOC_DIR):
+                pass
+            elif f.endswith(CODE_EXT):
+                code.append(p)
+            elif f.endswith(JSONL_EXTS) and f != "package-lock.json":
+                jsonl.append(p)
+    # file-level split: bucket 0 -> KLD pool, 1..4 -> calibration pool
+    pools: dict[str, tuple[list, list]] = {}
+    for cls, lst in (("code", code), ("prose", prose), ("tools", jsonl)):
+        pools[cls] = ([p for p in lst if fnv(p) % 5 == 0],
+                      [p for p in lst if fnv(p) % 5 != 0])
+
+    def text_of(p: str) -> str:
+        path = os.path.join(a.repo, p)
+        raw = open(path, encoding="utf-8", errors="replace").read()
+        if p.endswith(JSONL_EXTS):
+            lines = [json.loads(l)["content"] for l in raw.splitlines()
+                     if l.strip() and "content" in l]
+            raw = "\n".join(lines)
+        toks = tokenizer.encode(raw, add_special_tokens=False).ids
+        return tokenizer.decode(toks[:2400], skip_special_tokens=True)
+
+    cmds = harvest_cmds(a.repo, rng)
+    # fragment pools per class, corpus-split first
+    frags: dict[str, dict[str, list[str]]] = {}
+    for cls in pools:
+        kld_files, cal_files = pools[cls]
+        fr = {}
+        src = {"kld": kld_files, "cal": cal_files}
+        if cls == "tools":
+            fr["kld"] = [tool_call(rng, cmds) for _ in range(600)]
+            fr["cal"] = [tool_call(rng, cmds) for _ in range(40000)]
+        else:
+            fr["kld"] = [text_of(p) for p in src["kld"]]
+            fr["cal"] = [text_of(p) for p in src["cal"]]
+        frags[cls] = fr
+    # per-class fragment caps: prose rows are short (~66 tok) so need many;
+    # codeparrot files are long (~2.6k tok) so a small cap suffices
+    hfcap = {"code": 40000, "prose": 60000, "tools": 0}
+    for cls, spec in (("code", a.hf_code_parquet),
+                      ("prose", a.hf_prose_parquet)):
+        for path in [p for p in spec.split(",") if p]:
+            frags[cls]["cal"].extend(
+                load_parquet_texts(path, cls, rng, cap=hfcap[cls]))
+    for cls in frags:
+        rng.shuffle(frags[cls]["cal"])
+
+    def toks(s: str) -> int:
+        return len(tokenizer.encode(s, add_special_tokens=False).ids)
+
+    def emit_calib() -> tuple[int, list[dict]]:
+        targets = {"code": .45, "prose": .30, "tools": .25}
+        rows: list[dict] = []
+        for cls, frac in targets.items():
+            want = int(a.calib_tokens * frac)
+            pool = frags[cls]["cal"]
+            if not pool:
+                continue
+            got, i, buf, nbuf = 0, 0, [], 0
+            while got < want:
+                frag = pool[i % len(pool)]
+                i += 1
+                n = toks(frag)
+                if nbuf + n > a.chunk_tokens and buf:
+                    rows.append({"prompt": "\n".join(buf), "cls": cls})
+                    got += nbuf
+                    buf, nbuf = [], 0
+                    if got >= want:
+                        break
+                buf.append(frag)
+                nbuf += n
+                if i > len(pool) * 40:
+                    break  # pool exhausted with repeats; stop
+            if buf and got < want:
+                rows.append({"prompt": "\n".join(buf), "cls": cls})
+                got += nbuf
+            print(f"calib {cls}: {got} tokens, {i} fragments")
+        rng.shuffle(rows)
+        return len(rows), [{k: v for k, v in r.items() if k == "prompt"}
+                           for r in rows]
+
+    def emit_kld() -> tuple[int, list[dict]]:
+        rows, total = [], 0
+        classes = ["code", "prose", "tools"]
+        i = {c: 0 for c in classes}
+        guard = 0
+        while total < a.kld_tokens and guard < 5000:
+            guard += 1
+            msgs, srcs = [], []
+            for t in range(rng.choice([2, 3, 4])):
+                cls = classes[(len(rows) + t) % 3]
+                pool = frags[cls]["kld"]
+                if not pool:
+                    continue
+                frag = pool[i[cls] % len(pool)]
+                i[cls] += 2
+                msgs.append({"role": "user",
+                             "content": "Summarize and explain this "
+                                        f"engineering material:\n{frag}"})
+                msgs.append({"role": "assistant",
+                             "content": frag[:4000]})
+                srcs.append(cls)
+            rendered = env.get_template(tname).render(
+                messages=msgs, add_generation_prompt=False)
+            n = toks(rendered)
+            if n < a.kld_min_prompt:
+                continue
+            rows.append({"prompt": rendered,
+                         "score_from": n - a.score_tail,
+                         "source": "+".join(sorted(set(srcs)))})
+            total += n
+        return len(rows), rows
+
+    os.makedirs(a.out_dir, exist_ok=True)
+    nc, rows = emit_calib()
+    with open(os.path.join(a.out_dir, "calib.jsonl"), "w") as f:
+        for r in rows:
+            f.write(json.dumps(r) + "\n")
+    nk, krows = emit_kld()
+    with open(os.path.join(a.out_dir, "kld.jsonl"), "w") as f:
+        for r in krows:
+            f.write(json.dumps(r) + "\n")
+    scored = sum(len(tokenizer.encode(r["prompt"], add_special_tokens=False).ids)
+                 - r["score_from"] for r in krows)
+    manifest = {
+        "seed": a.seed, "template": tname,
+        "tokenizer": os.path.basename(a.tokenizer_json),
+        "calib_prompts": nc, "kld_prompts": nk,
+        "kld_scored_positions": scored,
+        "kld_score_tail": a.score_tail,
+        "disjoint_file_pools": "local KLD material only; HF code feeds calib",
+        "calib_mix": {"code": .45, "prose": .30, "tools": .25},
+        "hf_code": a.hf_code_parquet, "hf_prose": a.hf_prose_parquet,
+    }
+    with open(os.path.join(a.out_dir, "manifest.json"), "w") as f:
+        json.dump(manifest, f, indent=1)
+    print(json.dumps(manifest, indent=1))
+
+
+if __name__ == "__main__":
+    main()

scripts/patches/glm53-compile-01-model-decorator.patch

@@ -2,7 +2,7 @@
 #
 # STATUS: WIP — first of three patches in the "compile the GLM trunk" changelist. The
 # set does NOT yet boot the engine (see 03 for the next blocker), so it is NOT part of
-# the deployed frank-primary shape. Nothing in scripts/ mounts these files.
+# the deployed frank-archon shape. Nothing in scripts/ mounts these files.
 #
 # WHY THIS IS THE RIGHT LEVER (measured 2026-09-30, not inferred):
 #

scripts/patches/glm53-dflash-01-aux-hidden-states.patch

@@ -29,10 +29,11 @@
 #     its base SupportsEagleBase (has_own_lm_head, has_own_embed_tokens) -- and
 #     getattr_static()s each one off the instance, breaking on the first miss.
 #     So BOTH wrappers need all three attributes.
-#   * MRO law: INHERITING SupportsEagle3 as a base dies at class creation with
-#     "Cannot create a consistent method resolution order (MRO) for bases ..."
-#     (GLM's wrappers already carry four/five Protocol-derived bases).  The
-#     attribute route avoids the MRO entirely.  Also proven by simulation:
+#   * Why not inheritance: adding SupportsEagle3 as a BASE class dies at
+#     class creation with "Cannot create a consistent method resolution
+#     order (MRO) for bases ..." (GLM's wrappers already carry four/five
+#     Protocol-derived bases; the base ordering cannot take another). The
+#     attribute route avoids the MRO entirely; simulation confirms that
 #     the four-base ForCausalLM ordering cannot take SupportsEagle3 in ANY
 #     position.
 #   * Method placement: without inheriting, the Protocol's default

scripts/patches/gpu_worker-kv-cap.patch

@@ -1,6 +1,6 @@
 # gpu_worker-kv-cap.patch — fork-local fix for the expert-offload KV cap.
 #
-# STATUS: NOT part of the deployed frank-primary shape. It exists because the
+# STATUS: NOT part of the deployed frank-archon shape. It exists because the
 # fork's plan under-models this model's KV, and it is the enabler for a future
 # MTP attempt (the production GLM shape runs without MTP and boots fine on the
 # plan's own reserve).

scripts/probe-frank-archon-kv.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""probe-frank-archon-kv.py — verify the 2 x 200,000 KV contract on a LIVE
+frank-archon (radiance) service. Run it ON dankserver: it talks to
+127.0.0.1:7770 and builds its prompts from the repo checkout there.
+No scratch container, no mask: the service under test is the service.
+
+    ssh dankserver 'python3 /home/dank/serverAppConfigs/scripts/probe-frank-archon-kv.py'
+
+Three probes, in increasing cost:
+  A  decode at depth — one ~51k-token chat completion, 512 tokens, greedy.
+     Reports the engine's own `timings` (prefill, decode, draft acceptance).
+     Method: >=128 generated tokens (below that, first-token latency
+     dominates the decode rate), greedy (sampling noise is unattributable),
+     real text (synthetic text inflates draft acceptance).
+  B  the capacity contract — TWO concurrent chats of ~197k prompt tokens
+     (~394k tokens resident) each carrying a unique marker at its head. Both
+     must answer their own marker. This is what a 2 x 200,000 endpoint owes:
+     two full-height conversations resident at once, exact retrieval in both.
+  C  prefix-cache restore — probe A's cold prompt again, so the disk tier has
+     to give the blocks back (cache_n > 0, TTFT collapses).
+
+PROBE PITFALL: radiance routes the thinking block to
+`reasoning_content`, so a chat request whose budget is spent inside
+`<think>` returns EMPTY `content` with `finish_reason: stop`. A probe that
+reads `content` alone scores 0/2 on a healthy server. Every request here
+sets chat_template_kwargs.enable_thinking=false and reads both fields.
+
+A/B method for a shape change (no scratch container): write a variant env file
+on the host, point a transient systemd drop-in at it
+(`Environment=FRANK_ARCHON_ENV_FILE=...` — drop-ins are read AFTER the unit's
+own Environment= lines, so they win), restart, probe, delete the drop-in,
+daemon-reload, restart. `systemctl mask` is not available: the unit file in
+/etc/systemd/system is a relink symlink into the checkout.
+"""
+import json
+import glob
+import time
+import urllib.request
+import concurrent.futures
+
+BASE = "http://127.0.0.1:7770"
+MODEL = "frank-archon"
+REPO = "/home/dank/serverAppConfigs"
+GLOBS = [f"{REPO}/scripts/*.sh", f"{REPO}/serverAppConfigs-docs/**/*.md"]
+
+
+def post(payload, timeout=1800):
+    req = urllib.request.Request(
+        BASE + "/v1/chat/completions",
+        data=json.dumps(payload).encode(),
+        headers={"Content-Type": "application/json"},
+    )
+    t0 = time.time()
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        body = json.loads(r.read().decode())
+        hdr = dict(r.headers.items())
+    return body, time.time() - t0, hdr
+
+
+def get(path, timeout=60):
+    with urllib.request.urlopen(BASE + path, timeout=timeout) as r:
+        return json.loads(r.read().decode())
+
+
+def corpus(min_chars):
+    files = []
+    for g in GLOBS:
+        files.extend(sorted(glob.glob(g, recursive=True)))
+    out, total = [], 0
+    for f in files:
+        try:
+            t = open(f, encoding="utf-8", errors="replace").read()
+        except OSError:
+            continue
+        out.append(t)
+        total += len(t)
+        if total > min_chars:
+            break
+    return "".join(text for text in out)
+
+
+def prompt(text, chars, salt, fact):
+    """Real repo text, salted so the prefix cache cannot answer, marker planted
+    near the head, question at the tail."""
+    head = f"\n[SALT {salt}] confidential marker: {fact}\n"
+    body = text + text
+    p = (head + body * max(1, chars // len(body)))[:chars]
+    return p + "\n\nQuestion: what is the confidential marker in the " \
+        "SALT block near the top of this document? Answer with the marker " \
+        "alone, no other words.\n"
+
+
+def chat(text, chars, salt, fact, max_tokens):
+    return {"model": MODEL,
+            "messages": [{"role": "user",
+                          "content": prompt(text, chars, salt, fact)}],
+            "max_tokens": max_tokens, "temperature": 0.0,
+            "chat_template_kwargs": {"enable_thinking": False}}
+
+
+def show(tag, j, wall, expect=None):
+    tim, u = j.get("timings") or {}, j.get("usage", {})
+    ch = (j.get("choices") or [{}])[0]
+    msg = ch.get("message") or {}
+    txt = (msg.get("content") or msg.get("reasoning_content") or "").strip()
+    acc = (tim["draft_n_accepted"] / tim["draft_n"]) if tim.get("draft_n") else None
+    line = (f"[{tag}] prompt={u.get('prompt_tokens')} gen={u.get('completion_tokens')} "
+            f"wall={wall:.1f}s prefill={tim.get('prompt_per_second', 0):.0f} t/s "
+            f"decode={tim.get('predicted_per_second', 0):.1f} t/s "
+            f"draft={tim.get('draft_n')}/{tim.get('draft_n_accepted')} "
+            f"accept={acc if acc is None else round(acc, 4)} "
+            f"cache_n={tim.get('cache_n')} finish={ch.get('finish_reason')}")
+    if expect:
+        hit = expect.split("-")[0] in txt.lower()
+        line += f" expected={expect} answered={txt[:80]!r} HIT={hit}"
+    print(line)
+
+
+def main():
+    print("health:", json.dumps(get("/health")))
+    print("models:", [m.get("id") for m in get("/v1/models").get("data", [])])
+    deep = corpus(160_000)
+    wide = corpus(1_100_000)
+
+    facts = {"B1": "cobalt-harbor-13", "B2": "quartz-meadow-42"}
+    bodies = {s: chat(wide, 646_000, s, f, 24) for s, f in facts.items()}
+    print(f"[B] {len(bodies['B1']['messages'][0]['content']):,} chars per "
+          f"request, x2 concurrent")
+
+    # A + C first (cheap), B last (the expensive pair).
+    for tag, salt in (("A-cold", "A1-9137"), ):
+        j, wall, _ = post(chat(deep, 140_000, salt, "zephyr-lantern-7", 512))
+        show(tag, j, wall, "zephyr-lantern-7")
+    t0 = time.time()
+    with concurrent.futures.ThreadPoolExecutor(max_workers=2) as ex:
+        futs = {s: ex.submit(post, b) for s, b in bodies.items()}
+        for s, fut in futs.items():
+            try:
+                j, wall, _ = fut.result()
+                show(f"B-{s}", j, wall, facts[s])
+            except Exception as e:  # a preemption/timeout lands here
+                print(f"[B-{s}] FAILED after {time.time() - t0:.1f}s: {e!r}")
+    print(f"[B] total {time.time() - t0:.1f}s")
+    j, wall, _ = post(chat(deep, 140_000, "A1-9137", "zephyr-lantern-7", 512))
+    show("C-prefix-hit", j, wall, "zephyr-lantern-7")
+
+
+if __name__ == "__main__":
+    main()

scripts/qwen38-froggeric-v22.5.jinja

@@ -0,0 +1,460 @@
+{%- set template_version = "qwen3.8-froggeric-v22.5" %}
+{%- set _tool_format = tool_call_format if tool_call_format is defined else 'xml' %}
+{%- set image_count = namespace(value=0) %}
+{%- set video_count = namespace(value=0) %}
+{%- set add_vision_id = add_vision_id if add_vision_id is defined else false %}
+{%- set enable_thinking = enable_thinking if enable_thinking is defined else true %}
+{%- set auto_disable_thinking_with_tools = auto_disable_thinking_with_tools if auto_disable_thinking_with_tools is defined else false %}
+{%- if preserve_reasoning is defined and preserve_reasoning is not none %}
+    {%- set _preserve_thinking = preserve_reasoning %}
+{%- elif preserve_thinking is defined and preserve_thinking is not none %}
+    {%- set _preserve_thinking = preserve_thinking %}
+{%- else %}
+    {%- set _preserve_thinking = true %}
+{%- endif %}
+{%- set max_tool_arg_chars = max_tool_arg_chars if max_tool_arg_chars is defined else 0 %}
+{%- set max_tool_response_chars = max_tool_response_chars if max_tool_response_chars is defined else 0 %}
+{%- set _default_reasoning_effort = 'medium' %}
+{%- set _has_tools = (tools is defined and tools and tools is iterable and tools is not mapping) %}
+{%- set _effort_raw = (reasoning_effort | string | lower) if reasoning_effort is defined and reasoning_effort is not none else _default_reasoning_effort %}
+{%- set _initial_thinking = enable_thinking %}
+{%- if _effort_raw in ('none', 'off') %}
+    {%- set _initial_thinking = false %}
+    {%- set _initial_effort = 'medium' %}
+{%- elif _effort_raw in ('minimal', 'low') %}
+    {%- set _initial_effort = 'low' %}
+{%- elif _effort_raw in ('high', 'xhigh', 'max', 'ultracode', 'extreme') %}
+    {%- set _initial_effort = 'xhigh' %}
+{%- else %}
+    {%- set _initial_effort = 'medium' %}
+{%- endif %}
+{%- set ns_state = namespace(thinking=_initial_thinking, effort=_initial_effort) %}
+{%- if auto_disable_thinking_with_tools and _has_tools %}
+    {%- set ns_state.thinking = false %}
+{%- endif %}
+{%- for msg in messages %}
+    {%- if msg.role == 'system' or msg.role == 'developer' or msg.role == 'user' %}
+        {%- if msg.content is string %}
+            {%- if '<|think_off|>' in msg.content %}
+                {%- set ns_state.thinking = false %}
+            {%- elif '<|think_on|>' in msg.content %}
+                {%- set ns_state.thinking = true %}
+            {%- elif '<|think_xhigh|>' in msg.content or '<|think_high|>' in msg.content or '<|think_ultracode|>' in msg.content or '<|think_extreme|>' in msg.content or '<|think_max|>' in msg.content %}
+                {%- set ns_state.thinking = true %}
+                {%- set ns_state.effort = 'xhigh' %}
+            {%- elif '<|think_low|>' in msg.content or '<|think_minimal|>' in msg.content %}
+                {%- set ns_state.thinking = true %}
+                {%- set ns_state.effort = 'low' %}
+            {%- elif '<|think_medium|>' in msg.content %}
+                {%- set ns_state.thinking = true %}
+                {%- set ns_state.effort = 'medium' %}
+            {%- endif %}
+        {%- elif msg.content is iterable and msg.content is not mapping %}
+            {%- for item in msg.content %}
+                {%- if item is string %}
+                    {%- set _item_text = item %}
+                {%- elif item is mapping and 'text' in item and item.text is string %}
+                    {%- set _item_text = item.text %}
+                {%- else %}
+                    {%- set _item_text = '' %}
+                {%- endif %}
+                {%- if _item_text %}
+                    {%- if '<|think_off|>' in _item_text %}
+                        {%- set ns_state.thinking = false %}
+                    {%- elif '<|think_on|>' in _item_text %}
+                        {%- set ns_state.thinking = true %}
+                    {%- elif '<|think_xhigh|>' in _item_text or '<|think_high|>' in _item_text or '<|think_ultracode|>' in _item_text or '<|think_extreme|>' in _item_text or '<|think_max|>' in _item_text %}
+                        {%- set ns_state.thinking = true %}
+                        {%- set ns_state.effort = 'xhigh' %}
+                    {%- elif '<|think_low|>' in _item_text or '<|think_minimal|>' in _item_text %}
+                        {%- set ns_state.thinking = true %}
+                        {%- set ns_state.effort = 'low' %}
+                    {%- elif '<|think_medium|>' in _item_text %}
+                        {%- set ns_state.thinking = true %}
+                        {%- set ns_state.effort = 'medium' %}
+                    {%- endif %}
+                {%- endif %}
+            {%- endfor %}
+        {%- endif %}
+    {%- endif %}
+{%- endfor %}
+{%- set reasoning_instructions = '' %}
+{%- if ns_state.thinking %}
+    {%- if ns_state.effort == 'xhigh' %}
+        {%- set reasoning_instructions = 'Reasoning effort is set to xhigh. Please think carefully through the task, validate key assumptions, consider plausible alternatives, and prioritize correctness, consistency, and clarity in the final answer.' %}
+    {%- elif ns_state.effort == 'low' %}
+        {%- set reasoning_instructions = 'Reasoning effort is set to low. Keep your thinking brief and focused, moving directly to the conclusion without unnecessary elaboration.' %}
+    {%- endif %}
+{%- endif %}
+{%- macro render_content(content, do_vision_count, is_system_content=false) %}
+    {%- if content is string %}
+        {{- content }}
+    {%- elif content is iterable and content is not mapping %}
+        {%- for item in content %}
+            {%- if item is mapping %}
+                {%- if item.type == 'image' or 'image' in item or 'image_url' in item %}
+                    {%- if is_system_content %}
+                        {{- raise_exception('System message cannot contain images.') }}
+                    {%- endif %}
+                    {%- if do_vision_count %}
+                        {%- set image_count.value = image_count.value + 1 %}
+                    {%- endif %}
+                    {%- if add_vision_id %}
+                        {{- 'Picture ' ~ image_count.value ~ ': ' }}
+                    {%- endif %}
+                    {{- '<|vision_start|><|image_pad|><|vision_end|>' }}
+                {%- elif item.type == 'video' or 'video' in item or 'video_url' in item %}
+                    {%- if is_system_content %}
+                        {{- raise_exception('System message cannot contain videos.') }}
+                    {%- endif %}
+                    {%- if do_vision_count %}
+                        {%- set video_count.value = video_count.value + 1 %}
+                    {%- endif %}
+                    {%- if add_vision_id %}
+                        {{- 'Video ' ~ video_count.value ~ ': ' }}
+                    {%- endif %}
+                    {{- '<|vision_start|><|video_pad|><|vision_end|>' }}
+                {%- elif 'text' in item %}
+                    {{- item.text }}
+                {%- else %}
+                    {{- raise_exception('Unexpected item type in content.') }}
+                {%- endif %}
+            {%- else %}
+                {{- item | string }}
+            {%- endif %}
+        {%- endfor %}
+    {%- elif content is none or content is undefined %}
+        {{- '' }}
+    {%- else %}
+        {{- raise_exception('Unexpected content type.') }}
+    {%- endif %}
+{%- endmacro %}
+{%- if not messages %}
+    {{- raise_exception('No messages provided.') }}
+{%- endif %}
+{%- set head = namespace(count=0, seen_non_system=false) %}
+{%- for message in messages %}
+    {%- set _is_sys = (message.role == 'system' or message.role == 'developer') %}
+    {%- if _is_sys and not head.seen_non_system %}
+        {%- set head.count = head.count + 1 %}
+    {%- else %}
+        {%- set head.seen_non_system = true %}
+    {%- endif %}
+{%- endfor %}
+{%- set sys_state = namespace(content='') %}
+{%- for message in messages[:head.count] %}
+    {%- set _part = render_content(message.content, false, true) | trim %}
+    {%- if '<|think_off|>' in _part %}{%- set _part = _part.split('<|think_off|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_on|>' in _part %}{%- set _part = _part.split('<|think_on|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_xhigh|>' in _part %}{%- set _part = _part.split('<|think_xhigh|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_high|>' in _part %}{%- set _part = _part.split('<|think_high|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_ultracode|>' in _part %}{%- set _part = _part.split('<|think_ultracode|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_extreme|>' in _part %}{%- set _part = _part.split('<|think_extreme|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_max|>' in _part %}{%- set _part = _part.split('<|think_max|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_medium|>' in _part %}{%- set _part = _part.split('<|think_medium|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_low|>' in _part %}{%- set _part = _part.split('<|think_low|>') | join('') | trim %}{%- endif %}
+    {%- if '<|think_minimal|>' in _part %}{%- set _part = _part.split('<|think_minimal|>') | join('') | trim %}{%- endif %}
+    {%- if _part %}
+        {%- if sys_state.content %}
+            {%- set sys_state.content = sys_state.content ~ '\n\n' ~ _part %}
+        {%- else %}
+            {%- set sys_state.content = _part %}
+        {%- endif %}
+    {%- endif %}
+{%- endfor %}
+{%- set _sc = sys_state.content %}
+{%- set _msgs = messages[head.count:] %}
+{%- if _has_tools %}
+    {{- '<|im_start|>system\n' }}
+    {%- if reasoning_instructions %}
+        {{- reasoning_instructions + '\n\n' }}
+    {%- endif %}
+    {{- '# Tools\n\nYou have access to the following functions:\n\n<tools>' }}
+    {%- for tool in tools %}
+        {{- '\n' }}
+        {{- tool | tojson }}
+    {%- endfor %}
+    {{- '\n</tools>' }}
+    {%- if _tool_format == 'json' %}
+        {{- '\n\nIf you choose to call a function ONLY reply in the following format with NO suffix:\n\n' }}
+        {%- if ns_state.thinking %}
+            {{- '<think>\nBrief explanation of tool call\n</think>\n' }}
+        {%- endif %}
+        {{- '<tool_call>\n{"name": "example_function_name", "arguments": {"example_parameter_1": "value_1", "example_parameter_2": "This is the value for the second parameter"}}\n</tool_call>\n\n<IMPORTANT>\nReminder:\n' }}
+        {%- if ns_state.thinking %}
+            {{- '- You can use the <think></think> block to plan your next tool call OR to synthesize data and formulate your final response to the user.\n- ALL explanation and reasoning MUST be placed strictly inside the <think></think> block.\n' }}
+        {%- endif %}
+        {{- '- Function calls MUST follow the specified format: a single JSON object with "name" and "arguments" keys inside <tool_call></tool_call> XML tags.\n' }}
+        {%- if ns_state.thinking %}
+            {{- '- If you choose to call a tool, you MUST output the <tool_call> block IMMEDIATELY after thinking, with NO conversational text before it.\n' }}
+        {%- else %}
+            {{- '- If you choose to call a tool, you MUST output the <tool_call> block IMMEDIATELY, with NO conversational text before it.\n' }}
+        {%- endif %}
+        {{- '- The <tool_call> tag MUST be at the very beginning of a new line, with NO spaces or indentation before it.\n- To call multiple functions, output a separate, completely closed <tool_call></tool_call> block for EACH function. Do NOT nest <tool_call> blocks.\n- If you have all necessary data, provide your final answer directly to the user without any tool call.\n</IMPORTANT>' }}
+    {%- else %}
+        {{- '\n\nIf you choose to call a function ONLY reply in the following format with NO suffix:\n\n' }}
+        {%- if ns_state.thinking %}
+            {{- '<think>\nBrief explanation of tool call\n</think>\n' }}
+        {%- endif %}
+        {{- '<tool_call>\n<function=example_function_name>\n<parameter=example_parameter_1>\nvalue_1\n</parameter>\n<parameter=example_parameter_2>\nThis is the value for the second parameter\nthat can span\nmultiple lines\n</parameter>\n</function>\n</tool_call>\n\n<IMPORTANT>\nReminder:\n' }}
+        {%- if ns_state.thinking %}
+            {{- '- You can use the <think></think> block to plan your next tool call OR to synthesize data and formulate your final response to the user.\n- ALL explanation and reasoning MUST be placed strictly inside the <think></think> block.\n' }}
+        {%- endif %}
+        {{- '- Function calls MUST follow the specified format: an inner <function=...></function> block must be nested within <tool_call></tool_call> XML tags.\n' }}
+        {%- if ns_state.thinking %}
+            {{- '- If you choose to call a tool, you MUST output the <tool_call> block IMMEDIATELY after thinking, with NO conversational text before it.\n' }}
+        {%- else %}
+            {{- '- If you choose to call a tool, you MUST output the <tool_call> block IMMEDIATELY, with NO conversational text before it.\n' }}
+        {%- endif %}
+        {{- '- The <tool_call> and <function> tags MUST be at the very beginning of a new line, with NO spaces or indentation before them.\n- To call multiple functions, output a separate, completely closed <tool_call></tool_call> block for EACH function. Do NOT nest <tool_call> blocks.\n- If you have all necessary data, provide your final answer directly to the user without any tool call.\n</IMPORTANT>' }}
+    {%- endif %}
+    {%- if _sc %}
+        {{- '\n\n' + _sc }}
+    {%- endif %}
+    {{- '<|im_end|>\n' }}
+{%- else %}
+    {%- if _sc %}
+        {{- '<|im_start|>system\n' + (reasoning_instructions + '\n\n' if reasoning_instructions else '') + _sc + '<|im_end|>\n' }}
+    {%- elif reasoning_instructions %}
+        {{- '<|im_start|>system\n' + reasoning_instructions + '<|im_end|>\n' }}
+    {%- endif %}
+{%- endif %}
+{%- set _last_idx = _msgs | length - 1 %}
+{%- set ns = namespace(multi_step_tool=true, last_query_index=_last_idx) %}
+{%- for message in _msgs[::-1] %}
+    {%- set index = (_msgs | length - 1) - loop.index0 %}
+    {%- if ns.multi_step_tool and message.role == 'user' %}
+        {%- set _rc = render_content(message.content, false) | trim %}
+        {%- if not (_rc.startswith('<tool_response>') and _rc.endswith('</tool_response>')) %}
+            {%- set ns.multi_step_tool = false %}
+            {%- set ns.last_query_index = index %}
+        {%- endif %}
+    {%- endif %}
+{%- endfor %}
+{%- if ns.multi_step_tool %}
+    {%- if _last_idx > 50 %}
+        {%- set ns.last_query_index = _last_idx %}
+    {%- else %}
+        {%- set ns.last_query_index = 0 %}
+    {%- endif %}
+{%- endif %}
+{%- set ns2 = namespace(prev_role='', consecutive_failures=0) %}
+{%- for message in _msgs %}
+    {%- set is_system = (message.role == "system" or message.role == "developer") %}
+    {%- set content = render_content(message.content, true, is_system) | trim %}
+    {%- if is_system or message.role == 'user' %}
+        {%- if '<|think_off|>' in content %}{%- set content = content.split('<|think_off|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_on|>' in content %}{%- set content = content.split('<|think_on|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_xhigh|>' in content %}{%- set content = content.split('<|think_xhigh|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_high|>' in content %}{%- set content = content.split('<|think_high|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_ultracode|>' in content %}{%- set content = content.split('<|think_ultracode|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_extreme|>' in content %}{%- set content = content.split('<|think_extreme|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_max|>' in content %}{%- set content = content.split('<|think_max|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_medium|>' in content %}{%- set content = content.split('<|think_medium|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_low|>' in content %}{%- set content = content.split('<|think_low|>') | join('') | trim %}{%- endif %}
+        {%- if '<|think_minimal|>' in content %}{%- set content = content.split('<|think_minimal|>') | join('') | trim %}{%- endif %}
+    {%- endif %}
+    {%- if is_system %}
+        {{- '<|im_start|>system\n' + content + '<|im_end|>\n' }}
+    {%- elif message.role == 'user' %}
+        {%- set ns2.consecutive_failures = 0 %}
+        {{- '<|im_start|>user\n' + content + '<|im_end|>\n' }}
+    {%- elif message.role == 'assistant' %}
+        {%- set reasoning_content = '' %}
+        {%- set _explicit_reasoning = '' %}
+        {%- if message.reasoning_content is defined and message.reasoning_content is not none %}
+            {%- if message.reasoning_content is string %}
+                {%- set _explicit_reasoning = message.reasoning_content %}
+            {%- else %}
+                {%- set _explicit_reasoning = message.reasoning_content | string %}
+            {%- endif %}
+        {%- elif message.thinking is defined and message.thinking is not none %}
+            {%- if message.thinking is string %}
+                {%- set _explicit_reasoning = message.thinking %}
+            {%- else %}
+                {%- set _explicit_reasoning = message.thinking | string %}
+            {%- endif %}
+        {%- elif message.reasoning is defined and message.reasoning is not none %}
+            {%- if message.reasoning is string %}
+                {%- set _explicit_reasoning = message.reasoning %}
+            {%- else %}
+                {%- set _explicit_reasoning = message.reasoning | string %}
+            {%- endif %}
+        {%- endif %}
+        {%- if _explicit_reasoning %}
+            {%- set _lead_end = '' %}
+            {%- if content.startswith('<think>') and '</think>' in content %}
+                {%- set _lead_end = '</think>' %}
+            {%- elif content.startswith('<thinking>') and '</thinking>' in content %}
+                {%- set _lead_end = '</thinking>' %}
+            {%- elif content.startswith('</think>') %}
+                {%- set _lead_end = '</think>' %}
+            {%- elif content.startswith('</thinking>') %}
+                {%- set _lead_end = '</thinking>' %}
+            {%- endif %}
+            {%- if _lead_end %}
+                {%- set content = content.split(_lead_end)[-1].lstrip('\n') %}
+            {%- endif %}
+            {%- set reasoning_content = _explicit_reasoning %}
+        {%- else %}
+            {%- set _think_end = '' %}
+            {%- if content.startswith('</think>') %}
+                {%- set _think_end = '</think>' %}
+            {%- elif content.startswith('</thinking>') %}
+                {%- set _think_end = '</thinking>' %}
+            {%- elif '\n</think>' in content %}
+                {%- set _think_end = '\n</think>' %}
+            {%- elif '\n</thinking>' in content %}
+                {%- set _think_end = '\n</thinking>' %}
+            {%- elif '\n</ think>' in content %}
+                {%- set _think_end = '\n</ think>' %}
+            {%- elif '\n</think >' in content %}
+                {%- set _think_end = '\n</think >' %}
+            {%- elif content.startswith('<think>') and '</think>' in content %}
+                {%- set _think_end = '</think>' %}
+            {%- elif content.startswith('<thinking>') and '</thinking>' in content %}
+                {%- set _think_end = '</thinking>' %}
+            {%- endif %}
+            {%- if _think_end %}
+                {%- if 'thinking' in _think_end %}
+                    {%- set _think_start = '<thinking>' %}
+                {%- else %}
+                    {%- set _think_start = '<think>' %}
+                {%- endif %}
+                {%- set reasoning_content = content.split(_think_end)[0].rstrip('\n') %}
+                {%- if _think_start in reasoning_content %}
+                    {%- set reasoning_content = reasoning_content.split(_think_start)[-1].lstrip('\n') %}
+                {%- endif %}
+                {%- set content = content.split(_think_end)[-1].lstrip('\n') %}
+            {%- endif %}
+        {%- endif %}
+        {%- set reasoning_content = reasoning_content | trim %}
+        {%- if (_preserve_thinking or loop.index0 > ns.last_query_index) %}
+            {{- '<|im_start|>assistant\n<think>\n' + reasoning_content + '\n</think>\n\n' + content }}
+        {%- else %}
+            {{- '<|im_start|>assistant\n' + content }}
+        {%- endif %}
+        {%- if message.tool_calls is defined and message.tool_calls and message.tool_calls is iterable and message.tool_calls is not mapping %}
+            {%- for tool_call in message.tool_calls %}
+                {%- if tool_call.function is defined and tool_call.function is not none %}
+                    {%- set tc = tool_call.function %}
+                {%- else %}
+                    {%- set tc = tool_call %}
+                {%- endif %}
+                {%- set tc_name = tc.name if (tc.name is defined and tc.name is not none) else '' %}
+                {%- if _tool_format == 'json' %}
+                    {%- if loop.first %}
+                        {%- if content | trim %}
+                            {{- '\n\n' }}
+                        {%- endif %}
+                    {%- else %}
+                        {{- '\n' }}
+                    {%- endif %}
+                    {%- set _args = '{}' %}
+                    {%- if tc.arguments is defined and tc.arguments is not none %}
+                        {%- if tc.arguments is mapping %}
+                            {%- set _args = tc.arguments | tojson %}
+                        {%- elif tc.arguments is string %}
+                            {%- if tc.arguments %}
+                                {%- set _args = tc.arguments %}
+                            {%- endif %}
+                        {%- else %}
+                            {%- set _args = tc.arguments | tojson %}
+                        {%- endif %}
+                    {%- endif %}
+                    {{- '<tool_call>\n{"name": ' }}{{- tc_name | tojson }}{{- ', "arguments": ' }}{{- _args }}{{- '}\n</tool_call>' }}
+                {%- else %}
+                    {%- if loop.first %}
+                        {%- if content | trim %}
+                            {{- '\n\n<tool_call>\n<function=' + tc_name + '>\n' }}
+                        {%- else %}
+                            {{- '<tool_call>\n<function=' + tc_name + '>\n' }}
+                        {%- endif %}
+                    {%- else %}
+                        {{- '\n<tool_call>\n<function=' + tc_name + '>\n' }}
+                    {%- endif %}
+                    {%- if tc.arguments is defined and tc.arguments is not none %}
+                        {%- if tc.arguments is mapping %}
+                            {%- for args_name, args_value in tc.arguments.items() %}
+                                {{- '<parameter=' + args_name + '>\n' }}
+                                {%- if args_value is string %}
+                                    {%- set _av = args_value %}
+                                {%- else %}
+                                    {%- set _av = args_value | tojson %}
+                                {%- endif %}
+                                {%- if max_tool_arg_chars > 0 and _av | length > max_tool_arg_chars %}
+                                    {{- _av[:max_tool_arg_chars] + '\n[TRUNCATED - original length ' ~ (_av | length | string) ~ ' chars]' }}
+                                {%- else %}
+                                    {{- _av }}
+                                {%- endif %}
+                                {{- '\n</parameter>\n' }}
+                            {%- endfor %}
+                        {%- else %}
+                            {%- if tc.arguments is string %}
+                                {%- set _raw_args = tc.arguments %}
+                            {%- else %}
+                                {%- set _raw_args = tc.arguments | tojson %}
+                            {%- endif %}
+                            {%- if _raw_args %}
+                                {%- if max_tool_arg_chars > 0 and _raw_args | length > max_tool_arg_chars %}
+                                    {{- _raw_args[:max_tool_arg_chars] + '\n[TRUNCATED - original length ' ~ (_raw_args | length | string) ~ ' chars]' }}
+                                {%- else %}
+                                    {{- _raw_args }}
+                                {%- endif %}
+                            {%- endif %}
+                        {%- endif %}
+                    {%- endif %}
+                    {{- '</function>\n</tool_call>' }}
+                {%- endif %}
+            {%- endfor %}
+        {%- endif %}
+        {{- '<|im_end|>\n' }}
+    {%- elif message.role == 'tool' %}
+        {%- set _content_lower = content | lower %}
+        {%- set _content_head = _content_lower[:120] %}
+        {%- set _is_code_or_grep = ('throw new ' in _content_lower or 'throw error' in _content_lower or 'console.error' in _content_lower or 'logger.error' in _content_lower or 'logging.error' in _content_lower or 'import ' in _content_head or 'def ' in _content_head or 'function ' in _content_head) %}
+        {%- set _exit_code_zero = ('exit code: 0' in _content_head or 'process exited with code 0' in _content_head) %}
+        {%- set _error_field_ok = ('"error": null' in _content_head or '"error":null' in _content_head or '"error": false' in _content_head or '"error":false' in _content_head or '"error": ""' in _content_head or '"error":""' in _content_head) %}
+        {%- set _strong_error = (('"error":' in _content_head and not _error_field_ok) or '"status": "error"' in _content_head or '"status":"error"' in _content_head or 'traceback (most recent call last):' in _content_head or 'command not found' in _content_head or 'invalid syntax' in _content_head or 'fatal:' in _content_head or (('exit code: ' in _content_head or 'process exited with code' in _content_head) and not _exit_code_zero) or _content_head.startswith('exception:') or _content_head.startswith('failed to ')) %}
+        {%- set _weak_error = ('error:' in _content_head or 'err!' in _content_head) %}
+        {%- set _weak_suppressed = ('$ ' in _content_head or 'took ' in _content_head or content | length >= 600) %}
+        {%- if not _is_code_or_grep and (_strong_error or (_weak_error and not _weak_suppressed)) %}
+            {%- set ns2.consecutive_failures = ns2.consecutive_failures + 1 %}
+        {%- else %}
+            {%- set ns2.consecutive_failures = 0 %}
+        {%- endif %}
+        {%- if ns2.prev_role != 'tool' %}
+            {{- '<|im_start|>user' }}
+        {%- endif %}
+        {%- set _is_json_payload = (_tool_format == 'json' and content | trim | length > 0 and (content | trim)[:1] in ('{', '[')) %}
+        {%- if not _is_json_payload and max_tool_response_chars > 0 and content | length > max_tool_response_chars %}
+            {%- set content = content[:max_tool_response_chars] + '\n[TRUNCATED - original length ' ~ (content | length | string) ~ ' chars]' %}
+        {%- endif %}
+        {{- '\n<tool_response>\n' + content }}
+        {%- if ns2.consecutive_failures >= 2 %}
+            {{- '\n\n⚠️ SYSTEM WARNING: ' ~ ns2.consecutive_failures ~ ' consecutive tool errors detected. Your previous approach is incorrect. You MUST use a fundamentally different approach or corrected arguments.' }}
+        {%- elif ns2.consecutive_failures == 1 %}
+            {{- '\n\n⚠️ SYSTEM WARNING: The previous tool call returned an error. Diagnose the failure and retry with completely corrected arguments.' }}
+        {%- endif %}
+        {{- '\n</tool_response>' }}
+        {%- if loop.last %}
+            {{- '<|im_end|>\n' }}
+        {%- else %}
+            {%- set _next_role = _msgs[loop.index0 + 1].role %}
+            {%- if _next_role != 'tool' %}
+                {{- '<|im_end|>\n' }}
+            {%- endif %}
+        {%- endif %}
+    {%- else %}
+        {{- '<|im_start|>user\n[' + message.role + ']: ' + content + '<|im_end|>\n' }}
+    {%- endif %}
+    {%- set ns2.prev_role = message.role %}
+{%- endfor %}
+{%- if add_generation_prompt %}
+    {{- '<|im_start|>assistant\n' }}
+    {%- if not ns_state.thinking %}
+        {{- '<think>\n\n</think>\n\n' }}
+    {%- else %}
+        {{- '<think>\n' }}
+    {%- endif %}
+{%- endif %}

scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe

@@ -0,0 +1,110 @@
+# qwen4exp-swift15-w4dn8-i8-hc8m.recipe -- the Swift 1.5 finetune of Qwen3.8-Flash-Next
+# (ukisai/Swift1.5-Qwen3.8-Flash-Next, BF16 source, 335.3 GiB, key set identical to the official
+# base) as a radiance container for frank-archon: EVERY routed expert -- gate_up AND down --
+# through GPTQ into the w4nl64a8h table. The converter declares ONE
+# encoding per expert table (qwen4exp_fp8 rad_arch_declare): the served
+# kernel covers the whole expert set, and the only legal mixed layout is a
+# WHOLE expert kept plain bf16 beside it. That rules out the original
+# split tier (down block-fp8 + gate_up w4), which asks one table for two
+# encodings.
+# The rest is qwen4exp-w5dn64-i8-hc8m.recipe verbatim: int8 trunk linears, block-fp8 hc mixers
+# and MTP fc, the fixed-scale n-gram table, the 2-bit draft head.
+#
+# Why down is the calibrated half: the calibration tap rides the down projection, so its GPTQ
+# rounding propagates against real down-input Hessians; gate_up shares the same w4 table
+# uncalibrated. The published w5dn64 comparison (mean KL 0.0789 -> 0.0717, top-1 92.85% ->
+# 93.34%, decode +4%, prefill -19%) is the 5-bit upper bound; this tier trades part of that
+# quality back for prefill.
+#
+#   CALIB=DIR rad-convert <Swift1.5-Qwen3.8-Flash-Next checkpoint> \
+#       --recipe scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe -o qwen4exp-swift15-w4dn8-i8-hc8m.rad
+#
+# DIR is the calibration directory the bf16 container wrote (RADIANCE_CALIB_DIR, 10M tokens of
+# traffic-shaped corpus). Everything not named here is served as the checkpoint holds it (bf16:
+# embeddings, the vision tower, the QSA indexer); the first rule that matches a weight decides it.
+# The bf16 container is NOT passed with --reuse: the peak-disk arithmetic does not fit (checkpoint +
+# container + container + output > purge-freed space), and --reuse only saves a re-read.
+
+# The protected experts, cast to bf16 ahead of both expert rules. THE NAMES BELOW ARE THE BASE
+# CHECKPOINT'S (from its 1M-token recording, qwen4exp-w5dn64-i8-hc8m.recipe) -- a warm start only.
+# The Swift 1.5 finetune's routing distribution is not assumed equal: the
+# derivation step rewrites this section from Swift's OWN calibration
+# recording before this recipe is ever run. The selection rule is the base
+# checkpoint's: an expert whose share of its layer's down-input energy is
+# at least 3% AND at least three times its share of the routing; an even
+# count on each rank's half of the layer (the four-bit GEMM takes the rest
+# as two equal tables by parity), padded with that half's next most
+# energetic expert.
+# PROTECTED-BEGIN (rewritten from Swift's OWN grams by derive-protected-experts.py)
+blk.1.ffn_*_exps.271.weight         cast dtype=bf16
+blk.1.ffn_*_exps.355.weight         cast dtype=bf16
+blk.2.ffn_*_exps.279.weight         cast dtype=bf16
+blk.2.ffn_*_exps.413.weight         cast dtype=bf16
+blk.34.ffn_*_exps.146.weight         cast dtype=bf16
+blk.34.ffn_*_exps.153.weight         cast dtype=bf16
+blk.34.ffn_*_exps.407.weight         cast dtype=bf16
+blk.34.ffn_*_exps.453.weight         cast dtype=bf16
+blk.37.ffn_*_exps.288.weight         cast dtype=bf16
+blk.37.ffn_*_exps.377.weight         cast dtype=bf16
+blk.38.ffn_*_exps.406.weight         cast dtype=bf16
+blk.38.ffn_*_exps.420.weight         cast dtype=bf16
+blk.42.ffn_*_exps.37.weight         cast dtype=bf16
+blk.42.ffn_*_exps.90.weight         cast dtype=bf16
+blk.42.ffn_*_exps.302.weight         cast dtype=bf16
+blk.42.ffn_*_exps.388.weight         cast dtype=bf16
+blk.44.ffn_*_exps.315.weight         cast dtype=bf16
+blk.44.ffn_*_exps.350.weight         cast dtype=bf16
+blk.46.ffn_*_exps.290.weight         cast dtype=bf16
+blk.46.ffn_*_exps.419.weight         cast dtype=bf16
+blk.47.ffn_*_exps.119.weight         cast dtype=bf16
+blk.47.ffn_*_exps.143.weight         cast dtype=bf16
+blk.47.ffn_*_exps.399.weight         cast dtype=bf16
+blk.47.ffn_*_exps.445.weight         cast dtype=bf16
+# PROTECTED-END
+# (derive-protected-experts.py rewrote this section from Swift's own grams)
+
+# Every other routed expert, trunk and MTP layer alike: u4 codes into the w4nl table, rotated by
+# the 128-wide Hadamard, an E4M3 scale a group of 64 under the fixed 2^-13 searched for least
+# error as stored, chosen by GPTQ against $CALIB and swept three times by coordinate descent.
+# The calibration Grams are down-input Hessians, so down is the calibrated half of the table;
+# gate_up has no recording of its own and quantises uncalibrated (said on stderr, as the base
+# recipe says). The MTP layer has no recording either. Expert mass: gate_up 150.00 GiB -> ~37.6,
+# down 75.00 GiB -> ~18.8: ~56 GiB of experts, ~28 GiB a rank at TP=2 -- well inside the pool.
+blk.*.ffn_*_exps.*.weight            gptq table=w4nl group=64 scale=fp8_e4m3 scale2=f32 block2=*x* scale2_value=0.0001220703125 transform=fwht128 rule=search cd=3 calib=$CALIB
+
+# Every connection's two mixing matrices -- the 96 trunk connections, the final mixer and the MTP
+# head's three -- as E4M3 rows with an f32 scale a group of each row. A 128x128 block cannot cover
+# them: lowrank is 320, 2.5 blocks. Down is [320, 10240] and takes a scale every 128 columns; up is
+# [10240, 320] and takes four scales a row, 80 columns each.
+*_hc_down.weight                     rtn  codes=fp8_e4m3 group=128 scale=f32
+*_hc_up.weight                       rtn  codes=fp8_e4m3 group=80 scale=f32
+
+# The MTP head's fc_hidden and fc_embedding, the same rows. They only ever change the drafts.
+mtp.fc_hidden.weight                 rtn  codes=fp8_e4m3 group=128 scale=f32
+mtp.fc_embedding.weight              rtn  codes=fp8_e4m3 group=128 scale=f32
+
+# The trunk's block linears as int8, a scale per 128 columns of a row searched for least error.
+# The QSA indexer's projection is not one of them: its top-k is a hard choice between blocks, and
+# keeping it as the checkpoint holds it costs 20 MB.
+blk.*.attn_qg.weight                 rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.attn_k.weight                  rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.attn_v.weight                  rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.attn_output.weight             rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.ssm_inz.weight                 rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.ssm_out.weight                 rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.ffn_gate_up_shexp.weight       rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.ffn_down_shexp.weight          rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+
+# The lm_head, int8 with a bf16 scale a row per 128 columns (logits_gemm_i8): at E4M3 it costs
+# ~0.6 points of top-1 on its own.
+output.weight                        rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+
+# The n-gram table at one fixed E4M3 scale; qwen4exp-w4.recipe says where the value comes from.
+# The value sits on a three-octave plateau (2^-13..2^-10, rel_l2 0.02662) with 1.7x headroom over
+# the base table's absmax; the prep phase verifies Swift's PLE absmax lands inside the plateau
+# before this rule is trusted.
+blk.*.ple_ngram.weight               rtn  codes=fp8_e4m3 block=*x* scale=bf16 rule=fixed scale_value=1.99317932128906e-4
+
+# The MTP head's 2-bit draft head. INERT for this checkpoint: the HF weight map has no
+# mtp.draft_head.weight (same as the base), kept for shape parity with the family.
+mtp.draft_head.weight                rtn  codes=u2 zero=u8 group=128 scale=f16