refact(comments): state the mechanism, not the incident

Every comment that invoked a 'law' (50 word-boundary sites across 28
tracked files) now states what is going on and why, in terms that
transfer to any project: gate twins drift until one side greenlights
what the other refuses; a tag re-points while a digest pins; a
restrictive engine behavior belongs to the runtime that imposed it and
must be re-tested, not inherited; a speculative head is tensors in the
file, not a flag; snapshot links dangle where the container resolves
them; exit 0 is a clean stop to systemd, so a self-exiting daemon on
on-failure goes dark reporting success. Event narratives and dates are
gone from these comments; the mechanics carry the argument.

Behavior-identical: bash -n, py_compile, yaml parse, full bats suite
408/408 green. One symbol rename rides along (stack script local
scale_law -> scale_contract, with its log text).

.AGENTTRASH/frank-dragoon.env.llama.cpp

@@ -1,4 +1,4 @@
-# Tunables for frank-large (kingjones777/Qwen3.8-Flash-Next-ROCmFP4-
+# Tunables for frank-dragoon (kingjones777/Qwen3.8-Flash-Next-ROCmFP4-
 # STRIX-GGUF on the kingjones30/ROCmFPX llama.cpp runtime, Dankclaw,
 # Strix Halo gfx1151, unified memory).
 #
@@ -56,7 +56,7 @@ CHAT_TEMPLATE_FILE=/home/dank/serverAppConfigs/scripts/chat-template.jinja
 CHAT_TEMPLATE_KWARGS='{"enable_thinking":true,"preserve_thinking":true,"preserve_reasoning":true}'
 
 # Alias + network.
-ALIAS=frank-large
+ALIAS=frank-dragoon
 BIND_ADDR=0.0.0.0
 LISTEN_PORT=7770
 

.AGENTTRASH/frank-dragoon.service.llama.cpp

@@ -1,5 +1,5 @@
 [Unit]
-Description=ROCmFPX (kingjones30 fork) llama.cpp Qwen3.8-Flash-Next ROCmFP4 STRIX 177B MoE (dankclaw, frank-large)
+Description=ROCmFPX (kingjones30 fork) llama.cpp Qwen3.8-Flash-Next ROCmFP4 STRIX 177B MoE (dankclaw, frank-dragoon)
 After=network-online.target
 Wants=network-online.target
 
@@ -7,8 +7,8 @@ Wants=network-online.target
 Type=simple
 User=dank
 Group=dank
-Environment="FRANK_LARGE_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-large.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-large.sh
+Environment="FRANK_DRAGOON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-dragoon.sh
 Restart=on-failure
 RestartSec=10
 

.AGENTTRASH/frank-npu.env.flm-npu

@@ -6,7 +6,7 @@
 # is reachable on this port regardless of the boot tag. The NPU is a
 # single-lane device: generations serialize FIFO, and the first request after a
 # model swap pays the ~6-11 s load cost. The NPU draws from the unified RAM
-# pool shared with frank-large (iGPU).
+# pool shared with frank-dragoon (iGPU).
 FLM_MODEL=nuextract3:4b
 FLM_HOST=0.0.0.0
 FLM_PORT=7771

.AGENTTRASH/serve-frank-dragoon.sh.llama.cpp

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Serve kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF as
-# frank-large via the kingjones30/ROCmFPX llama.cpp runtime on
+# frank-dragoon via the kingjones30/ROCmFPX llama.cpp runtime on
 # Dankclaw (Strix Halo gfx1151, unified memory).
 #
 # Runtime: kingjones30/ROCmFPX (fork of charlie12345/ROCmFPX with the
@@ -29,7 +29,7 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-large.env}"
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
 if [[ -f "$ENV_FILE" ]]; then
     set -a
     # shellcheck disable=SC1090
@@ -44,7 +44,7 @@ fi
 : "${MMPROJ_PATH:=/home/dank/models/agentionai-Qwen3.8-Flash-Next-ROCmFP4-FAST/mmproj/mmproj-Qwen3.8-Flash-Next-f16.gguf}"
 : "${CHAT_TEMPLATE_FILE:=$SCRIPT_DIR/chat-template.jinja}"
 : "${CHAT_TEMPLATE_KWARGS:={}}"
-: "${ALIAS:=frank-large}"
+: "${ALIAS:=frank-dragoon}"
 : "${BIND_ADDR:=0.0.0.0}"
 : "${LISTEN_PORT:=7770}"
 : "${CTX_SIZE:=401408}"

.AGENTTRASH/serve-frank-npu.sh.flm-npu

@@ -4,7 +4,7 @@
 # Runs `flm serve <tag>` on the XDNA2 NPU (50 TOPS, Dankclaw). The NPU is a
 # single-lane device: generations serialize in FIFO order, so this is a
 # background/triage endpoint, not an interactive multi-user chat. The NPU
-# draws from the unified RAM pool shared with frank-large (the iGPU
+# draws from the unified RAM pool shared with frank-dragoon (the iGPU
 # llama.cpp service); see serverAppConfigs-docs/LLM/frank-npu.md
 # for the memory budget and the model-selection tradeoff.
 #

AGENTS.md

@@ -9,11 +9,11 @@ services run from `/home/dank/serverAppConfigs` on each host (the 2026-08-22
 merge absorbed the former `vllmScripts` repo, history preserved).
 
 - **Dankserver** (192.168.0.235) — media/library stack (RomM, Copyparty,
-  Calibre-Web, Jellyfin, Plex) plus the `frank-primary` LLM service.
+  Calibre-Web, Jellyfin, Plex) plus the `frank-archon` LLM service.
 - **Dankclaw** (192.168.0.143) — AI/search/dev/observability stack (SearXNG
   via Gluetun, ComfyUI, OpenWebUI, Hermes, Gitea, Grafana, Prometheus, Loki,
-  Alloy, Pi-hole) plus TWO LLM services: `frank-large` (flash-server
-  container on the gfx1151 iGPU) and `frank-secondary` (llama.cpp CUDA on the
+  Alloy, Pi-hole) plus TWO LLM services: `frank-dragoon` (flash-server
+  container on the gfx1151 iGPU) and `frank-zealot` (llama.cpp CUDA on the
   RTX 3090). Caddy on
   Dankclaw reverse-proxies both hosts.
 - **FrankBook-Pro** (192.168.0.112) — macOS mini running the *arr stack
@@ -25,9 +25,9 @@ merge absorbed the former `vllmScripts` repo, history preserved).
 
 | Target | Service | Runtime | Model | Port |
 |--------|---------|---------|-------|------|
-| Dankserver | `frank-primary` | **radiance** (StillDeadcode v1.0.7 line; image `stilldeadcode/radiance@sha256:4c3f484564…` digest-pinned INDEX digest, 287 MiB, `libr4d` gfx1201 kernels, plain `podman run`, root systemd unit) | `Qwen/Qwen3.8-Flash-Next-FP8` official (172.8 GB, 131 shards, sha256-verified) converted **no-recipe** to `qwen4exp-fp8-native.rad` (177,109 MiB measured = 173.0 GiB) — **native modelopt block-FP8, no requantisation** — on **BOTH R9700s TP=2** (`--tp-wire wht6`), experts in a **40 GiB/rank pinned host pool** + VRAM cache (`--placement expert_tiered`, `--expert-vs-cache-ratio 0.82` = the 99 %-hit point), **PLE 47.7 GiB pinned to host RAM** (`--ngram-placement ram`; root unit + `LimitMEMLOCK=infinity`), **fp8 KV 7.32 KiB/token**, **MTP spec decode depth 3**, *…
-| Dankclaw | `frank-large` | **halogen-flash-server 0.16.2** (`ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84…`, digest-pinned, plain `podman run` via `scripts/serve-frank-large.sh`, root systemd unit) | Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated **`qwen38-flash-next-v2-swift15-abliterated.hgn`** (66,687,678,464 B = compacted r2 of the card's 89,775,868,032 B original, ~62 GiB resident; the v2 `.hgn` format loads in NO other engine), **+ REQUIRED `qwen38-flash-next-ngram.hgn`** (51,200,246,144 B, peonist @5cc17cea — read beside the checkpoint) **+ vision tower** (897,916,416 B, @e053f488 — **vision ON**, `image_url` parts only, ≥256 px probes), **MTP spec decode ALWAYS-ON (`HALOGEN_SPEC_ADAPT=0` — the adaptive default disables the head per request and HALVES decode)**, MTP head INSIDE the checkpoint (`HALOGEN_MTP_HEAD` unset; no sidecar fetched), **2 slots × 200,192 ctx** (KV pool 400,384 positions ≈ 10.7 GiB at ~28 KiB/position; the 27B slots>1-disables-drafting law does NOT carry over — batching and speculation coexist, the card's quickstart ships 2 with the head), **server-side sampler 1.0/0.95/20** (card recipe; models.yml extraBody matches), coupled cap/timeout 65536/7200, prompt cache ON by default (warm 100k turn ≈ 2 s vs ≈ 88 s cold) | 7770 |
-| Dankclaw | `frank-secondary` | llama.cpp master (0.5.0-dev, commit `5fc4f3c`), CUDA sm_86 build (root systemd unit, relinked) | ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF **RCO-IQ3_XXS -mtp** (27B dense qwen3_5 hybrid, 10,442,827,392 B; a per-tensor allocation mix of stock types; the MTP head in the file **drafted** — **spec ON** (draft-mtp depth 3) since 2026-10-06 evening, ngram skipped on the recurrent-rollback law) + the publisher's own **BF16 mmproj** for **vision**, on the RTX 3090, **2 × 114,688** (Frank's 112k cap each since the 2026-10-06 late reshape, cut from 131,072 to fund the **ubatch ladder 512 → 1024 → 2048** — **1,005 MiB free at boot, 763 settled after a vision probe** (encoder buffers resident)) with **q8_0 K + q8_0 V (FP8 class, 34 KiB/token)** under flash attention, batch 4096 / **ubatch 2048** (the ceiling for this shape — 4096 would not fit); **prefill 1,209 t/s @ 3,760 tokens; ~52–58 t/s recipe decode** (MTP acceptance 34–54 %, temp-1.0 noise; decode is ubatch-invariant). Renamed from `frank-small` 2026-10-06 (87721ab). Supersedes the same-morning IQ3_S-mtp payloads: the two-slot no-spec shape and the one-slot MTP shape (both 2026-10-06; payload on disk).|7771|
+| Dankserver | `frank-archon` | **radiance** (StillDeadcode, **pin 1.0.13** digest-pinned `stilldeadcode/radiance@sha256:4c3f484564…`, plain `podman run`, root systemd unit) | ukisai/Swift1.5-Qwen3.8-Flash-Next BF16 (335.3 GiB, 397/397 sha256-verified) converted by `scripts/convert-swift15-w4dn8.sh` to `qwen4exp-swift15-w4dn8-i8-hc8m.rad` (**116,416 MiB**): **all 49,152 experts GPTQ w4** (10M-token calibration on engine 1.2.0) + **24 whole bf16-protected experts/layer** (energy-share law), int8 trunk/lm_head, fp8 HC, PLE n-gram fp8 fixed-scale, on **BOTH R9700s TP=2** (`--tp-wire wht6`), experts in a **40 GiB/rank pinned host pool** + VRAM cache (`--placement expert_tiered`, explicit `--vram-weights-mib 26071 --vram-kv-mib 3543`), **47.7 GiB n-gram copy pinned to host RAM** (`--ngram-placement ram`; root unit + `LimitMEMLOCK=infinity`), **fp8 KV** (inherited; pool 3.46 GiB), **MTP spec decode depth 2**, `--max-num-seqs 3`, `--max-model-len 200000`, MNBT 2048, Froggeric v22.5 template. KLD-gated (mean KL 0.0131, top-1 97.92 % vs BF16); decode ~190 t/s live (gate bar 30.8). Cutover 2026-10-08 from fp8-native (payload on disk = rollback). | 7770 |
+| Dankclaw | `frank-dragoon` | **halogen-flash-server 0.16.2** (`ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84…`, digest-pinned, plain `podman run` via `scripts/serve-frank-dragoon.sh`, root systemd unit) | Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated **`qwen38-flash-next-v2-swift15-abliterated.hgn`** (66,687,678,464 B = compacted r2 of the card's 89,775,868,032 B original, ~62 GiB resident; the v2 `.hgn` format loads in NO other engine), **+ REQUIRED `qwen38-flash-next-ngram.hgn`** (51,200,246,144 B, peonist @5cc17cea — read beside the checkpoint) **+ vision tower** (897,916,416 B, @e053f488 — **vision ON**, `image_url` parts only, ≥256 px probes), **MTP spec decode ALWAYS-ON (`HALOGEN_SPEC_ADAPT=0` — the adaptive default disables the drafter per request and HALVES decode)**, MTP head INSIDE the checkpoint (`HALOGEN_MTP_HEAD` unset; no sidecar fetched), **2 slots × 262,144 ctx** (KV pool 524,288 positions ≈ 14.0 GiB at ~28 KiB/position; the 27B slots>1-disables-drafting law does NOT carry over — batching and speculation coexist, the card's quickstart ships 2 with the head), harness window 217,088 = ceiling − 45k estimate headroom, **server-side sampler 1.0/0.95/20** (card recipe; models.yml extraBody matches), coupled cap/timeout 65536/7200, prompt cache ON by default (warm 100k turn ≈ 2 s vs ≈ 88 s cold)|7770|
+| Dankclaw | `frank-zealot` | llama.cpp master (0.5.0-dev, commit `5fc4f3c`), CUDA sm_86 build (root systemd unit, relinked) | HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive **Q6_K** (7,359,259,008 B; dense `qwen35` hybrid: 32 layers, 8 full-attention + 24 Gated DeltaNet, 4 KV heads × 256 dim, vocab 248,320, native 262,144, **no MTP tensors in the file**) + the publisher's own **BF16 mmproj** (921,704,448 B) for **vision**, on the RTX 3090, **TWO 200,704-token slots** (`--ctx-size 401408 --parallel 2`), **exact f16 K + f16 V** under flash attention (32 KiB/token over the 8 full layers = 12.25 GiB pool), batch 4096 / **ubatch 2048** (measured CUDA optimum), `--log-verbosity 4`, **MTP OFF** (forced: no `nextn` tensors exist). Priced from the MiMo Q6_K boots (same geometry, same card, same shape): 21,276/2,849 at ubatch 1024, 21,846/2,279 at 2048. Cutover 2026-10-07 (late) from Gemma4-26B-A4B Q4_K_M 1×200,704. All three endpoints route harness **compaction** here. | 7771 |
 
 Retired endpoints (`frank-npu`, and every prior runtime) are in
 the [runbook index](#runbook-index). The full swap history lives in
@@ -35,11 +35,16 @@ the [runbook index](#runbook-index). The full swap history lives in
 
 ## Repository Layout
 
-- `dankserver/` — compose.yaml + Caddyfile + .env.example for the media stack
-- `dankclaw/` — compose.yaml + Caddyfile + .env.example for the AI stack
-- `shared/` — homepage, Prometheus, Loki, Alloy, SearXNG configs
-- `scripts/` — `deploy.sh` / `deploy-plan.py` / `deploy-remote.sh`, LLM serve
-  scripts, systemd units, env tunables, bench harnesses
+- `dankserver/` — quadlet units + Caddyfile for the media stack (the
+  compose.yaml inventory retired 2026-10-13; its mounts had diverged from
+  the quadlets)
+- `dankclaw/` — quadlet units + Caddyfile for the AI stack (compose retired 2026-09-16)
+- `shared/` — the service inventory (`services.yml`), homepage, Prometheus,
+  Loki, Alloy, SearXNG configs
+- `scripts/` — `deploy.sh` / `deploy-plan.py` / `deploy-remote.sh` and
+  `service-map.py` (the inventory's only reader), LLM serve scripts + the
+  shared artifact gates (`scripts/lib/llm-gates.sh`), systemd units, env
+  tunables, bench harnesses
 - `old/` — retired LLM scripts (reference only)
 - `serverAppConfigs-docs/` — knowledge base (Obsidian vault, OKF format).
   The managed skill library is distilled there one page per skill-cluster:
@@ -66,14 +71,19 @@ All edits flow through git. Never edit files on a remote machine directly.
 ./scripts/deploy.sh dankclaw
 ./scripts/deploy.sh dankserver
 ./scripts/deploy.sh dankclaw --service searxng
-./scripts/deploy.sh dankserver --service frank-primary
+./scripts/deploy.sh dankserver --service frank-archon
 ./scripts/deploy.sh dankclaw --dry-run
 ```
 
-The planner maps changed paths to services; the remote runner restarts only
-the selected service and records its revision outside the checkout.
+The inventory (`shared/services.yml`, read only through
+`scripts/service-map.py`) maps changed paths to services; the remote runner
+restarts only the selected service and records its revision outside the
+checkout. Both `--service` allow-lists, the planner, and the changed-test
+seam mapper ARE the inventory — adding, moving, or retiring a service is a
+data edit, not a script edit
+(`serverAppConfigs-docs/Architecture/Service Inventory.md`).
 Documentation-only changes are a no-op. LLM services are selected only by
-their own files — every endpoint (`frank-large`/`frank-secondary`/`frank-primary`)
+their own files — every endpoint (`frank-dragoon`/`frank-zealot`/`frank-archon`)
 by its unit/env/serve trio in `scripts/` — so
 unrelated
 container changes cannot interrupt inference. Set `FRANK_SUDO_PW` for headless
@@ -85,7 +95,7 @@ restarts each service whose marker is behind HEAD *and* whose paths changed
 since that marker — so a backlog accumulated by service-scoped deploys fires
 all at once, and one failing health gate aborts the run with every later
 service left pending. Name the service unless a drain is what you want
-(`./scripts/deploy.sh dankserver --service frank-primary`).
+(`./scripts/deploy.sh dankserver --service frank-archon`).
 
 ### Deployment completeness (MANDATORY)
 
@@ -164,12 +174,17 @@ Tests are mandatory before commit (`bats` required on the dev machine):
 ./tests/run.sh
 ```
 
-Seams: compose validity, env consistency (no leaked secrets), Caddyfile
+Seams: env consistency (no leaked secrets), Caddyfile
 validity, quadlet units, docs completeness **including vault link integrity**,
 script syntax (shell + python), LLM unit integrity, LLM secret hygiene,
-deployment flow, service-scoped planning, homepage config/pages/deploy/checker,
-and `e2e_scaffold` — which fails if a Playwright spec file's number prefix is in
-no project, because such a spec silently never runs.
+LLM artifact gates (`llm_gates`/`llm_deploy_gates` — the shared
+`scripts/lib/llm-gates.sh` every endpoint's serve and deploy gates run on),
+deployment flow, service-scoped planning, the **service inventory**
+(`service_inventory.bats`: inventory soundness, the pinned path->service
+plan fixture, render drift for the Pi-hole hosts file), homepage
+config/pages/deploy/checker, and `e2e_scaffold` — which fails if a
+Playwright spec file's number prefix is in no project, because such a spec
+silently never runs.
 See `serverAppConfigs-docs/Architecture/Testing Policy.md`.
 
 ## Secret Rules
@@ -229,17 +244,17 @@ archive.
 **STOP the production service BEFORE benchmarking** — these servers serve
 real users, and a bench beside a live service starves the GPU and corrupts
 results. Use the runtime's own harness: `llama-bench` for the llama.cpp
-endpoints; a live llama.cpp server also reports honest per-request numbers in the `/completion` `timings` object (prefill/decode rates, `draft_n`, `draft_n_accepted`), which is how frank-large and frank-secondary were measured. Rolling your own bench
+endpoints; a live llama.cpp server also reports honest per-request numbers in the `/completion` `timings` object (prefill/decode rates, `draft_n`, `draft_n_accepted`), which is how frank-dragoon and frank-zealot were measured. Rolling your own bench
 requires asking first.
 Scratch ports are not used on LLM hosts — a
 test process cannot share the single GPU anyway; validate against the service
 itself.
 
-(A gufo-era law; frank-large ran ROCmFPX llama.cpp 2026-10-02 → 10-05, the
+(A gufo-era law; frank-dragoon ran ROCmFPX llama.cpp 2026-10-02 → 10-05, the
 halogen 27B container 2026-10-05 → 10-06, and is flash-server since, but the
 rollback tags keep it live.) **`gufo bench` cannot rank speculative-decode
 settings, and will invert the ranking.**
-Measured 2026-09-28 on frank-large at depth 32768: its corpus
+Measured 2026-09-28 on frank-dragoon at depth 32768: its corpus
 reports `acceptance=0.933 ± 0.000` with an **identical trace sha256** across
 draft widths, i.e. the same highly-predictable text every run, and 93 % of
 every proposal accepted. It reported 29–37 t/s decode where real traffic
@@ -264,12 +279,12 @@ one: `ip neigh show <ip>` from a peer — FAILED means off/NIC dead, while a
 merely wedged kernel usually still answers ARP.
 
 1. Stop and mask (self-healing would restart it):
-   - Dankclaw `frank-large` (root unit, halogen podman on the iGPU):
-     `sudo systemctl stop frank-large && sudo systemctl mask frank-large`
-   - Dankclaw `frank-secondary` (root unit, llama.cpp on the 3090):
-     `sudo systemctl stop frank-secondary && sudo systemctl mask frank-secondary`
-  - Dankserver `frank-primary` (root unit, radiance on both R9700s, TP=2):
-     `sudo systemctl stop frank-primary && sudo systemctl mask frank-primary`
+   - Dankclaw `frank-dragoon` (root unit, halogen podman on the iGPU):
+     `sudo systemctl stop frank-dragoon && sudo systemctl mask frank-dragoon`
+   - Dankclaw `frank-zealot` (root unit, llama.cpp on the 3090):
+     `sudo systemctl stop frank-zealot && sudo systemctl mask frank-zealot`
+  - Dankserver `frank-archon` (root unit, radiance on both R9700s, TP=2):
+     `sudo systemctl stop frank-archon && sudo systemctl mask frank-archon`
 2. Bench.
    NOTE: `systemctl mask` FAILS on a relinked unit (the unit file in
    `/etc/systemd/system/` is itself a symlink into the checkout — mask
@@ -286,9 +301,18 @@ deletes the unit file from `/etc/systemd/system/`, not just the symlink.
 The harness reaches the fleet through `.omp/agent/models.yml` in the
 operator's home — `/home/blank/.omp/agent/models.yml` on the dev box, which is
 where the harness runs; there is no copy on the servers. Each provider is one
-HOST:PORT; each model `id` is the served alias: `frank-primary` →
-`192.168.0.235:7770`, `frank-large` → `192.168.0.143:7770`, `frank-secondary` →
-`modelRoles`.
+HOST:PORT; each model `id` is the served alias. **Official model ids are
+the StarCraft unit names (2026-10-08), on the wire since 2026-10-09, and
+since 2026-10-10 they are also the SERVICE names:** `frank-archon` →
+`192.168.0.235:7770` (`FRANK_ARCHON_SERVED_NAME`), `frank-dragoon` →
+`192.168.0.143:7770` (`HALOGEN_MODEL_ID`), `frank-zealot` →
+`192.168.0.143:7771` (`ALIAS`). The 2026-10-10 cutover renamed the units,
+scripts, env files, containers, deploy services and runbooks to match —
+the three former service names are fully retired and exist nowhere in
+the repo; historical text in runbooks uses the current names. Verify a
+rename on `/v1/models`, never
+on a chat response: radiance echoes the **requested** model name, so a 200
+proves nothing about the served id (llama.cpp and halogen ignore it).
 
 Resolution rules: the default model resolves as a `defaultProvider` +
 `defaultModel` pair (the provider must serve the model); a subagent override
@@ -301,18 +325,20 @@ provider block, model `id`, `contextWindow`, `maxTokens`, `input` in
 `models.yml`, then fix every `modelRoles` entry that named the old endpoint —
 a role pointing at a provider the file does not define fails at call time. As
 of 2026-10-06 **all three endpoints accept images** (`input: [text,
-image]`) — `frank-large` returned to vision with the flash-server v2 swap
+image]`) — `frank-dragoon` returned to vision with the flash-server v2 swap
 (the v2 vision tower loads beside the checkpoint; the text-only halogen
 27B window closed 2026-10-06) — while
-`frank-primary` takes them natively (radiance runs the checkpoint's
+`frank-archon` takes them natively (radiance runs the checkpoint's
 27-layer Qwen-VL tower — patching, pad-token expansion and 3-part rotary
 are the engine core; `--mm-max-patches` available),
-and `frank-secondary` through
-the publisher's own `mmproj-BF16.gguf` passed as `--mmproj` — the Swift
-GGUF itself carries no vision tensors. `frank-secondary`'s `contextWindow` is
-**114688** (cut from 131072 on 2026-10-06 late to fund the ubatch ladder to 2048), the
-per-slot window, not the model's native 262144: the harness must compact
-before llama.cpp answers a longer prompt with a 400. Note also
+and `frank-zealot` through
+the publisher's own BF16 mmproj passed as `--mmproj` — the model is natively
+multimodal but the Q6_K GGUF carries no vision tensors (same arrangement the
+Gemma4 era used). `frank-zealot`'s `contextWindow` is
+**200704** — the PER-SLOT window (`--ctx-size 401408 --parallel 2` since the
+2026-10-07 Qwen3.5-9B swap), not the pool and not the model's native 262144:
+the harness must compact before llama.cpp answers a longer prompt with a 400.
+Note also
 that
 the reasoning channel differs by runtime: llama.cpp AND SGLang (qwen3
 parser, live-verified) emit `reasoning_content`, vLLM emits `reasoning` —
@@ -321,22 +347,22 @@ There is **no audio**
 input anywhere in the fleet: that capability left with the FLM NPU
 endpoint on 2026-09-11, returned 2026-09-17 with the Gemma4 projector's
 audio encoder, and left again with the Gemma4 retirement on 2026-10-01
-(the MiMo tower is vision-only).
+(neither the MiMo nor the Qwen3.5 tower carries audio).
 
-### frank-large — halogen-flash-server 0.16.2, Qwen3.8-Flash-Next v2 Swift1.5 ABLITERATED (Dankclaw, ACTIVE)
+### frank-dragoon — halogen-flash-server 0.16.2, Qwen3.8-Flash-Next v2 Swift1.5 ABLITERATED (Dankclaw, ACTIVE)
 
 The **flash-server engine** (`ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84…`,
 digest-pinned, published tag 0.16.2, 3.6 GB image) as a podman container
-driven by `scripts/serve-frank-large.sh` under a **root systemd unit**
-(`scripts/frank-large.service`, `User=dank`, `Restart=always`,
-`ExecStop=podman stop -t 60 frank-large-halogen`, the script runs `podman
+driven by `scripts/serve-frank-dragoon.sh` under a **root systemd unit**
+(`scripts/frank-dragoon.service`, `User=dank`, `Restart=always`,
+`ExecStop=podman stop -t 60 frank-dragoon-halogen`, the script runs `podman
 run` FOREGROUND — the container's exit code is the service's exit so
 `Restart=always` stays real, and the engine ledger lands on disk) on port
 7770 from the Strix Halo iGPU. Engine stdout goes to
-`/home/dank/logs/frank_large.log` — **the boot ledger (weights resident, KV
+`/home/dank/logs/frank_dragoon.log` — **the boot ledger (weights resident, KV
 pool, MTP head, prompt cache, any clamp) lives there, not in the journal**.
 Cutover 2026-10-06 from the halogen 27B-dense era
-([[frank-large-halogen27b-dflash2]], retired the same window).
+([[frank-dragoon-halogen27b-dflash2]], retired the same window).
 
 Serving `Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated`:
 `qwen38-flash-next-v2-swift15-abliterated.hgn` (66,687,678,464 B ≈ 62.1
@@ -358,22 +384,29 @@ sidecar is deliberately not fetched).
 **Product facts vs the 27B era, both regressions FIXED:** the base is
 **abliterated** (the 27B was a censored-base finetune; refusals were an
 accepted trade there) and **vision is ON** (the 27B engine silently
-ignored its encoder — frank-secondary owned images for exactly one day at this
+ignored its encoder — frank-zealot owned images for exactly one day at this
 endpoint).
 
-**Engine laws that shape the config** (all in `scripts/frank-large.env`
+**Engine laws that shape the config** (all in `scripts/frank-dragoon.env`
 with evidence): `HALOGEN_SPEC_ADAPT=0` is MANDATORY — the default adaptive
 policy disables the MTP head for whole requests after low acceptance and
 HALVES decode; the head stays on and temp-1.0 traffic pays some acceptance
-for it (accepted). `HALOGEN_CTX=200192` is the PER-SLOT hard ceiling (400
-naming the limit, never truncation); `models.yml` `contextWindow: 200192`
-must match, and compaction at 70 % = 140,134 + 57,344 budget = 197,478 fits.
+for it (accepted). `HALOGEN_CTX=262144` is the PER-SLOT hard ceiling (400
+naming the limit, never truncation) — RAISED from 200192 on 2026-10-07
+under the 400-zone law: the harness clamps max_tokens to
+`min(45056, contextWindow − est − 4096)`, its chars/4 est UNDER-counts
+the rendered prompt by ~3 % (measured: est 152,938 → server 157,388,
+request 43,158 vs room 42,804), so a harness window == engine ceiling
+made every request over ~146k est a guaranteed 400. `models.yml`
+`contextWindow: 217088` leaves the 45k gap that absorbs the estimate
+error (worst-case request ≈ 219k ≤ 262144); compaction fires at 85 % of
+the harness window = 184,524 est ≈ 190k measured (Frank's 180k target).
 `HALOGEN_KV_SLOTS=2` is LEGAL here — the 27B "slots>1 disables the drafter"
 law does NOT carry over; batching and speculation coexist (the card's
 quickstart ships 2 slots with the head), so 2 is concurrent capacity.
-`HALOGEN_KV_POOL_POSITIONS=400384` (explicit 2 × ctx; ~28 KiB/position ⇒
-~10.7 GiB). `HALOGEN_MAX_TOK=8192` is only the per-request DEFAULT (the
-harness always sends 57,344); `HALOGEN_MAX_TOKENS_CAP=65536` +
+`HALOGEN_KV_POOL_POSITIONS=524288` (explicit 2 × ctx; ~28 KiB/position ⇒
+14.0 GiB). `HALOGEN_MAX_TOK=8192` is only the per-request DEFAULT (the
+harness sends at most its `maxTokens` 45056); `HALOGEN_MAX_TOKENS_CAP=65536` +
 `HALOGEN_QUEUE_TIMEOUT=7200` are a coupled pair (FLAGS.md table).
 **A server-side sampler EXISTS** (`HALOGEN_TEMPERATURE/TOP_P/TOP_K` =
 1.0/0.95/20, the card's thinking recipe) — an absent temperature is no
@@ -389,14 +422,14 @@ stays mandatory. Thinking tokens COUNT against the budget (empty content +
 "video".
 
 **Memory ledger** (121.2 GiB unified; the referee is the boot ledger):
-weights ~62 + KV ~10.7 + arena ~8 (`3.8 + 8.4 × MAX_TOK/16384`) + vision
-~2 ≈ 82.7 GiB engine-side + `HALOGEN_HOST_RESERVE_GIB=20` → ~18 GiB
+weights ~62 + KV 14.0 + arena ~8 (`3.8 + 8.4 × MAX_TOK/16384`) + vision
+~2 ≈ 86 GiB engine-side + `HALOGEN_HOST_RESERVE_GIB=20` → ~15 GiB
 margin over baseline co-tenancy. The 51.2 GB n-gram table rides as mmap'd
 page cache beside the checkpoint — the card's quickstart arithmetic does
 not bill it as resident, but READ the boot ledger and re-size if the
 engine prints a clamp.
 
-Fetch: `scripts/download-frank-large-flashnext.sh` into
+Fetch: `scripts/download-frank-dragoon-flashnext.sh` into
 `/home/dank/models/halogen-flashnext-v2/` (`-f` + exact byte counts + LFS
 sha256 + `--verify-only`, no token on the command line; resume goes
 against the RESOLVED CDN URL because curl drops `Range` across HF's 302).
@@ -405,164 +438,163 @@ n-gram + vision tower, flat tokenizer with all six files as regular
 files) — the 2026-10-01 crash-loop lesson.
 
 Runbook:
-`serverAppConfigs-docs/LLM/frank-large-flash-server-v2-swift15.md`.
+`serverAppConfigs-docs/LLM/frank-dragoon-flash-server-v2-swift15.md`.
 Rollback: revert the swap commit and redeploy — the 27B payload
 (`/home/dank/models/halogen-qwen3.8-27b/`), its fetch script and the
 halogen 0.1.4 image digest all remain on disk; the ROCmFPX door behind
 that (`scripts/build-rocmfpx.sh`, pin `36e9acd`) is untouched.
 
-### frank-secondary — llama.cpp on the RTX 3090 (Dankclaw, ACTIVE)
+### frank-zealot — llama.cpp on the RTX 3090 (Dankclaw, ACTIVE)
 
 **llama.cpp master** (0.5.0-dev, commit `5fc4f3c`; CUDA sm_86 build
 `/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server`,
 `GGML_CUDA_FA_ALL_QUANTS=ON`) as a **root systemd unit**
-(`scripts/frank-secondary.service`, `relink_unit`ed into
-`/etc/systemd/system/`), serving `ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF`
-at **RCO-IQ3_XXS -mtp** (10,442,827,392 B, sha256 `e13d3e74…`) **plus
-the publisher's own `mmproj-BF16.gguf`** (931,145,888 B, sha256
-`19acd7fc…`), both `/home/dank/models/Swift15-UncIQ3XXS/`, on port 7771.
-Cutover 2026-10-05 (evening) on Frank's explicit contract: **128k
-context cap, KV at FP8, vision on, as many 128k contexts as fit**;
-reshaped three times on 2026-10-06 — morning to two 131,072 slots
-no-spec, evening to this UNCERSED RCO-IQ3_XXS payload with MTP back
-on, late the RENAME to **frank-secondary** (87721ab) at two 114,688
-slots with the ubatch ladder climbing 512 → 1024 → 2048 (f2575a1,
-d8da7a9). The
-same-day payloads it supersedes: the LIVE MiMo-V2.6 Q6_K shape and the
-Ornith-1.5-9B Q8_0 swap that was committed (77decb5..380aafa) but never
-deployed (blocked at the docs gate; the docs debt is what this section
-settles).
+(`scripts/frank-zealot.service`, `relink_unit`ed into
+`/etc/systemd/system/`), serving
+`HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive` at **Q6_K**
+(7,359,259,008 B, sha256 `c0ba7beb…` computed locally — the Hub carries no
+LFS oid) **plus the publisher's own BF16 mmproj** (921,704,448 B), both
+`/home/dank/models/Qwen35-9B-HauhauCS-Q6K/`, on port 7771. Cutover
+2026-10-07 (late) from the Gemma4-26B-A4B Q4_K_M 1×200,704 shape (same day).
 
-**Architecture: qwen3_5 hybrid, bigger** — block_count 65 (64 real layers +
-the blk.64 MTP head), `full_attention_interval 4` ⇒ **16 full-attention +
-48 Gated DeltaNet**, native 262,144 window, dense. KV exists only in the 16
-attention layers (4 KV heads × 256 dim): 64 KiB/token at f16, **34 KiB/token
-at q8_0**. The DeltaNet state is a fixed per-slot buffer (~150 MiB/slot at
-48 linear layers × 48 value heads). Header facts were read from the Hub
-file by HTTP range + struct parse before anything was downloaded.
+**Architecture: qwen35 dense hybrid** — read from the GGUF's own header, not
+the model card: 32 layers, `full_attention_interval = 4` ⇒ **8 full-attention
+layers (3, 7, 11, …, 31) + 24 Gated DeltaNet linear layers**, 16 attention
+heads / **4 KV heads** × 256 dim, `ssm` conv_kernel 4 / state_size 128 /
+group_count 16 / time_step_rank 32 / inner_size 4096, native 262,144, vocab
+248,320. Tensor types are Q6_K × 250 + F32 × 177 — standard quants only, so
+the stock master build loads it (arch `qwen35` is registered in this build's
+`src/llama-arch.cpp`). **KV accounting:** the pool scales with the 8 full
+layers only — 8 × 4 × 256 = 8,192 elements/token per cache, so f16 K + f16 V
+bills **32 KiB/token** = 12.25 GiB at the 401,408 pool; the 24 DeltaNet
+layers bill a fixed recurrent state per SLOT, not per token, which is exactly
+why two 200k slots fit where the 26B MoE fit one.
 
-**The shape (2026-10-06 midnight; Frank's tight-fit order, MTP back on
-in the evening, per-slot cut + ubatch climbed to 2048):** `--ctx-size
-229376 --parallel 2` = **TWO 114,688-token conversations** (Frank's
-112k cap each; `n_ctx_slot = CTX_SIZE / PARALLEL`; cut from 131,072 to
-fund the ubatch rungs), `--flash-attn on` pinned, **q8_0 K + q8_0 V**
-(llama.cpp's FP8 class — no true fp8 KV dtype exists; 8.5 effective
-bits; supersedes the same-day f16/f16 rule written for the Ornith 9B
-fit), all layers on the GPU, `--mmproj` for vision, batch 4096 /
-ubatch 2048. **Speculative decoding is ON** (draft-mtp, depth 3): the
--mtp file's head is drafted against the main model's own weights;
-ngram-mod skipped on purpose — on a qwen35 hybrid ngram disables
-recurrent-state rollback, so a rejected draft corrupts the DeltaNet
-state.
+**The shape (2026-10-07):** `--ctx-size 401408 --parallel 2` = TWO
+conversations of 200,704 (Frank's cap; the harness `contextWindow` quotes
+the per-slot number), `--flash-attn on`, **f16 K + f16 V** (exact KV),
+batch 4096 / **ubatch 2048** (the measured CUDA optimum: +4.6 % prefill,
+decode flat, 616 MiB — MiMo-era A/B on this card), `--log-verbosity 4`,
+`--mmproj` for vision, **speculative decoding OFF** (`SPEC_TYPE=none`).
 
-**Measured at the midnight boot (2026-10-06, 2 × 114,688 / ubatch
-2048): 23,120 used / 1,005 MiB free, settling 763 MiB after a vision
-probe** (`nvidia-smi` free; the encoder buffers stay resident on this
-boot) — the per-slot cut freed ~1.05 GiB of KV and both ubatch rungs
-spent it back (~0.3 + ~0.75 GiB measured; the 1024 rung had landed
-22,374/1,751, the 2048 rung cost 746 MiB, ~130 over the 616 the rung
-measured on the MiMo shape). The MTP draft ctx costs **~2.4 GiB
-measured** (23,636 − 22,728 + 1,561 at the 262,144 draft window) — ~6×
-the ~0.4 GiB the one-slot era assumed, because the drafter's KV is
-built against the target's FULL context, not the 3-token proposal
-depth; the lighter RCO-IQ3_XXS quant (−1.56 GiB vs IQ3_S-mtp) funds it.
-**Prefill 1,209 t/s @ 3,760 tokens; decode 52.0–58.2 tok/s (recipe
-temp 1.0) / 66.9 (temp 0)**, acceptance 34.2–54.4 % — decode is
-ubatch-invariant, the spread is temp-1.0 acceptance noise.
-`reasoning_effort` probe unchanged: `xhigh` 200, `high` → 500 Jinja
-raise (the models.yml fold stays mandatory).
+**Why MTP is off**: it is not a choice — **this Q6_K file carries no
+`nextn`/`mtp` tensors** (verified from the tensor-name list), and MTP is a
+property of the file, not of the flags. The publisher card advertises "MTP
+support" for the base architecture; the quantized export dropped the head.
 
-**Vision with the publisher's own projector**: ajgazin's repo SHIPS
-`mmproj-BF16.gguf` in the same repo (the IQ3_S era's unsloth mmproj was
-built from the SHARED BASE `Qwen/Qwen3.8-27B`, legal because Swift-1.5's
-vision stack was hash-proven byte-identical to the base). The probe
-traps carry over: ≥256 px probe images or the model answers "video";
-only the OpenAI `image_url` content part reaches the model. **New on
-this payload: the uncensored model thinks more than the censored
-Swift 1.5** — a 64-token budget is eaten entirely by
-`reasoning_content` (empty `content`); 128 tokens clears the vision
-probe.
+**Measured boots** (nvidia-smi, the referee): the deployed boot is
+**21,436 used / 2,689 free** (ubatch 2048) — the pricing boots were the
+MiMo-V2.6-Distill-Qwen-9B pair at this exact geometry (**21,276 / 2,849** at
+ubatch 1024, **21,846 / 2,279** at 2048), so the 415 MiB lighter weights
+bought back what the projection predicted. The engine ledger confirms the KV
+law to the MiB: `CUDA0 KV buffer size = 12544.00 MiB` (`K (f16): 6272.00`,
+`V (f16): 6272.00`), compute buffers 1,136 MiB on CUDA0 + 848 MiB host, the
+mmproj 879 MiB + 248 MiB. Decode is ubatch-invariant (Swift-era 3090 law). The
+Q6_K rung costs ~10 % decode vs Q5_K_M (weight bandwidth; MiMo-measured 94.4
+vs 104.8 t/s).
 
-The RCO-IQ3_XXS tier is a **per-tensor allocation mix** of stock quant
-types (IQ3_S 97 / BF16 96 / IQ3_XXS 83 / IQ2_S 72 / IQ4_XS 33 / IQ2_XS 32
-/ IQ2_XXS 30 / Q2_K 28 / Q4_K 19 / Q6_K 8 / IQ1_S 4 / IQ1_M 4) — stock
-llama.cpp loads it; the tensor-type histogram is the law (see Key
-Lessons). Publisher KLD vs Swift BF16: mean 0.002631 / 90th 0.042136 /
-max 34.49 — RCO is the publisher's "more experimental" family, and the
-payload is the UNCECERSED Swift 1.5 (23/100 refusals vs Swift 1.5's
-98/100, KL 0.0884).
+**Vision**: the publisher's own BF16 mmproj via `--mmproj` (the model is
+natively multimodal; the Q6_K file carries no vision tensors). Probe traps
+carry over: ≥256 px probe images or the model answers "video", and only the
+OpenAI `image_url` content part reaches the model.
+
+**Compaction hub**: `models.yml` routes `compactionModel` for
+`frank-archon`, `frank-dragoon` and `frank-zealot` (the 3090 endpoint) here — 200,704 is the
+only window in the fleet that fits a worst-case compaction input (~170k
+tokens). With `--parallel 2` a compaction request no longer serializes behind
+a live generation (the Gemma4 era's `--parallel 1` law).
 
 Runbook:
-`serverAppConfigs-docs/LLM/frank-secondary-llama-swift15-unc-iq3xxs-mtp-114688.md`.
-Rollback: `/home/dank/models/Swift15-IQ3S/` (the IQ3_S-mtp payload live
-until the 2026-10-06 evening swap — revert da36fa3 for the two-slot
-no-spec shape) or `/home/dank/models/MiMo-Q6K/` (revert to the
-2×200,704 f16 shape — [[frank-secondary-llama-mimo-q6k-2x200704]]) or
-`/home/dank/models/Ornith-Q8/` (the committed-never-deployed Q8_0;
-revert to 380aafa's tree).
+`serverAppConfigs-docs/LLM/frank-zealot-llama-qwen35-9b-q6k-2x200704.md`.
+Rollback: revert the swap commit — the Gemma4 payload
+(`/home/dank/models/Gemma4-26B-A4B/`), the MiMo Q6_K payload
+(`/home/dank/models/MiMo-Q6K/`), the Swift payload
+(`/home/dank/models/Swift15-UncIQ3XXS/`) and the Ornith Q8_0 payload
+(`/home/dank/models/Ornith-Q8/`) all remain on disk.
 
-### frank-primary — Radiance (StillDeadcode), Qwen3.8-Flash-Next FP8 native, TP=2 (Dankserver, ACTIVE)
+
+### frank-archon — Radiance (StillDeadcode), Swift1.5-Qwen3.8-Flash-Next GPTQ w4, TP=2 (Dankserver, ACTIVE)
 
 The **radiance engine** (StillDeadcode, Apache-2.0; image
-`stilldeadcode/radiance@sha256:4c3f484564bb2872784e4…` digest-pinned,
-287 MiB, `libr4d@0.5.0` kernels prebuilt for gfx1201, engine as the image
-entrypoint) serving the **official `Qwen/Qwen3.8-Flash-Next-FP8`
-checkpoint at NATIVE precision** — modelopt block-FP8 throughout, no
-requantisation, no calibration. Plain `podman run` through
-`scripts/serve-frank-primary.sh` under the root systemd unit
-(`frank-primary.service`, `User=dank`, `LimitMEMLOCK=infinity`); the
-container name is the unit name (`frank-primary`). Cutover LIVE 2026-10-06
-00:55 (chain built 2026-10-05/06);
-rollback tag `frank-primary-freetoken-pr587-20261005` (the FreeToken trio
-+ Dockerfile are in the tag; the image and the orcarouter payload stay on
-disk until the window closes), older rollback `frank-primary-vllm-shapeG-20261003`.
+`stilldeadcode/radiance@sha256:4c3f484564…` digest-pinned, **pin 1.0.13**
+for serve/convert/KLD; `libr4d` gfx1201 kernels, plain `podman run`, root
+systemd unit, container name = unit name) serving
+**ukisai/Swift1.5-Qwen3.8-Flash-Next (BF16, 335.3 GiB, 131 shards,
+397/397 sha256-verified)** converted by `scripts/convert-swift15-w4dn8.sh`
+with recipe `scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe` to
+`qwen4exp-swift15-w4dn8-i8-hc8m.rad` (~114 GiB): **all 49,152 experts GPTQ
+w4** (act-order, damp 0.05, 10,000,000-token calibration captured on engine
+**1.2.0** via `RADIANCE_CALIB_DIR`/`RADIANCE_CALIB_TOKENS` — the only pin
+with the token knob; the RADGRAM2 grams are format-identical across pins and
+cross the boundary by design), **24 whole experts per layer cast bf16** (the
+PROTECTED set, derived from the calibration grams' energy share),
+**int8 trunk/lm_head**, **fp8 HC mixtures** (`--hc-mix-dtype`), PLE n-gram
+table at fp8 fixed scale (47.7 GiB in the container, from 95.4 GiB bf16).
+The plugin's **one-table-one-encoding law** (measured at rad-convert
+declare): one expert table takes ONE encoding; only whole bf16 experts are
+legal beside it — no w4/fp8 split of the down/gate_up pair (24-value
+`rad_arch_quant_desc` array, one per layer). KLD gate vs the BF16
+reference (recorded on the same 1.0.13 pin) is the precision referee;
+the throughput gate (decode ≥ 30.8 t/s) was passed at 4.5× the bar
+(122–173 t/s at 44.5k depth). Measured decode/prefill in the runbook.
+Rollback: revert the swap commit — the fp8-native `.rad`
+(`qwen4exp-fp8-native.rad`) and every prior payload remain on disk.
 
-**Payload chain**: official checkpoint → staging dir whose `config.json`
-drops `quantization_config` → `stack-qwen38-official-fp8.py` (two
-value-preserving reshapes: experts byte-stacked into the plugin's stacked
-`gate_up_proj`/`down_proj` layout with `_scale_inv` at the same index — 49
-stacks × 512 experts, no requantisation; PLE's 128 scaleless fp8 shards
-decoded to one bf16 shard with the checkpoint's own bf16 scale
-1.9931793212890625e-04) → `rad-convert` with ONE `--quant` rule — pure
-copy for every weight, and the rtn rule re-encodes the bf16 PLE at that
-same fixed scale, an exact round-trip that restores the original codes and
-lands the plugin's one-element scale plane →
-`/home/dank/models/rad/qwen4exp-fp8-native.rad` (177,109 MiB measured,
-floor `FRANK_PRIMARY_RAD_MIN_MIB=177000`). The staging drop is the plugin
-SELECTION law (spec §2.4): the descriptor is `(arch_id, quant)` matched
-exactly, no shipped plugin claims `(qwen4exp, "fp8")`, the shipped
-`qwen4exp_fp8` plugin claims `(qwen4exp, "")` — and the descriptor is only
-the selection key, per-weight encodings are data, so nothing else is
-requantised.
-Raw serve AND unmodified convert both refuse; that is the design. The
-checkpoint itself is sha256-verified against the Hub (131/131 shards,
-2026-10-05). Built by `scripts/build-frank-primary-rad.sh` (`--plan-only`
-first — its declare phase is the engine's own, so a resolving plan boots).
+**Shape (both R9700s, TP=2)**: `--tp-wire wht6`, `--max-num-seqs 2`,
+`--max-model-len 200000` (the harness contextWindow must quote this),
+`--placement expert_tiered --host-pool-mib 44928` + **explicit VRAM
+partition `--vram-weights-mib 22208 --vram-kv-mib 6912`** (the vram-pair
+replaced `--expert-vs-cache-ratio`; the two are ONE budget —
+`weights + kv ≤ 29,120 MiB`, from the measured card 31,856 minus 1,710
+consumed outside both budgets minus 1,024 to keep free), `--kv-cache-dtype`
+**`bf16` — unquantized KV since 2026-10-11**, `--num-speculative-tokens 2`,
+`--max-num-batched-tokens 2048`, prefix cache 8 GiB pinned host + 64 GiB
+disk at `/home/dank/radiance-state`, **`--ngram-placement ram`**, Froggeric
+v22.5 chat template vendored (`scripts/qwen38-froggeric-v22.5.jinja`,
+`--override-chat-template`). Boot ledger: KV pool 6.75 GiB = **462,752 bf16
+tokens, "backs 2 sequences all at 200000 tokens at once"** (the fp8 pool's
+386,904 backed 1.93), weights slab filled to 147 KiB of slack, host pool
+10,375 slots, cards settled 1.85 GiB free.
 
-**Shape (both R9700s, TP=2)**: `--tp-wire wht6` (fused lossy all-reduce,
-+5.6–6.3 % prefill / ~−1.3 % 8-stream decode at TP2), `--max-num-seqs 2`
-(Frank's first boot; raise from the ledger + slot occupancy), `--max-model-len
-200000` (native 262,144; the harness contextWindow must quote this — a longer
-prompt is refused, never truncated), `--placement expert_tiered
---host-pool-mib 40960` (native FP8 experts are 112.8 GiB total, 56.4 GiB
-per rank slice — the pinned pool is the price of native precision),
-`--expert-vs-cache-ratio 0.82` (the measured 99 %-hit point; 0.87 collapses
-to 0 %), `--kv-cache-dtype fp8` (**7.32 KiB/token**; a 200K sequence is
-1.43 GiB), `--num-speculative-tokens 3` (the checkpoint's own MTP head —
-3,101 `mtp.*` tensors, probe depth 3), `--max-num-batched-tokens 2048`,
-prefix cache 4 GiB pinned host + 64 GiB disk at
-`/home/dank/radiance-state`, and **`--ngram-placement ram`**: the 47.7 GiB
-PLE n-gram table (51.2 GB = 29 % of all parameters) serves from pinned
-host RAM. Froggeric v22.5 chat template vendored
-(`scripts/qwen38-froggeric-v22.5.jinja`, `--override-chat-template`).
+Shape notes carried from the fp8-native era and unchanged: wht6 gains,
+MNDT 2048 law (2560 collapses decode to 2.6–7.7 t/s), the 64 GiB disk
+prefix cache, and the rule that a prompt over `--max-model-len` is
+refused, never truncated. What changed: the fp8-native era's NVMe expert
+streaming (the 3.5 GB/s wall) is gone — the w4 resident set fits the
+host pool, so decode ran 122–173 t/s in the campaign arms and ~190 t/s
+on the fp8 shape (512-token streamed probe). The campaign also
+measured the int8-KV + spec-3 arm (136.0 t/s median at 44.5k depth,
+accept 0.7246).
 
-**The pinned-RAM ledger is why this is a root unit**: 2 × 40 GiB pools +
-47.7 GiB PLE + 4 GiB prefix host ≈ **134 GiB** charged against
-`RLIMIT_MEMLOCK`. `ttm.pages_limit`/`pages_max` cap GPU-mappable pinned
-pages (pre-cutover cap 123 GiB — BELOW the plan); the serve script's
-TTM preflight (`FRANK_PRIMARY_TTM_MIN_MIB=140000`) refuses to start until
-both knobs are raised in the stop window (sysfs write first, kernel
-cmdline + reboot only if read-only).
+**The bf16 KV law (2026-10-11)**: `--kv-cache-dtype` takes ONLY `bf16|fp8` —
+one dtype for the whole cache, so llama.cpp's exact-K/quantized-V pair (what
+frank-zealot runs) has NO radiance equivalent; the rung under bf16 is fp8 on
+both halves. Measured per rank from the two boot ledgers: `kv_attn` (13
+layers, 4-token blocks) pages 26.00 → 52.00 KiB, while `kv_qsa_bkey` (13
+layers) stays 3.25 KiB at BOTH dtypes (the QSA block key is an index, not
+attention state) — so a token costs 7.3125 KiB at fp8 and 13.8125 KiB at
+bf16: **1.89×, not 2×**. Pool sizing must also pay the dtype-independent terms
+that live in the same pool (~110 MiB a sequence of recurrent state + 448 MiB
+of prefix checkpoints): `(vram_kv − 110·seqs − 448) MiB / 13.8125 KiB` =
+462,946 where the engine reported 462,752 (0.04 % page rounding). The cost is
+paid twice on this engine, and half-refunded: idle KV VRAM is also the expert
+cache's spillover, and the bigger pool *lends* 6.08 GiB to the slab where the
+fp8 pool lent 2.69 GiB. `--max-num-seqs 3 → 2` came with the change (two slots
+× the window is the capacity contract; the "seqs 2 cannot boot" law belongs to
+the retired tcclaviger fork's torch.compile, not radiance) and it also drops
+the fused all-reduce to 2 × 3 = 6 rows, under the 25-row bound where wht6 is
+bit-exact. Disk-tier sizing law: the engine forces ~9.6 GiB of disk-tier weight
+buffers + arena onto the weights side, so `weights + kv` is capped near
+29.6 GiB/card; boot with the pair, never `--kv-cache-size-mib`.
+
+**The pinned-RAM ledger is why this is a root unit**: 2 × 44 GiB expert
+pools + the 47.7 GiB n-gram copy (`--ngram-placement ram` is pinned RAM
+the card reads) + 8 GiB prefix host ≈ **147 GiB** charged against
+`RLIMIT_MEMLOCK` — the TTM floor is set just above it.
+`ttm.pages_limit`/`pages_max` cap GPU-mappable pinned pages; the serve
+script's TTM preflight (`FRANK_ARCHON_TTM_MIN_MIB=150000`, cap on this host
+204,800) refuses to start until both knobs are raised in the stop window
+(sysfs write first, kernel cmdline + reboot only if read-only).
 
 **Contract facts** (source-verified): the HTTP listener binds AFTER the
 full load, so a bare `curl /health` gate is honest (`/health` == `/ping`,
@@ -574,10 +606,11 @@ chat format — no parser flags; vision native (the 27-layer Qwen-VL tower,
 `--mm-max-patches`); `/metrics` carries vLLM-compatible names +
 `radiance:*` families — the Dankclaw Prometheus scrape is re-added.
 
-Runbook: `serverAppConfigs-docs/LLM/frank-primary-radiance-qwen38-native-fp8.md`.
-Retired FreeToken era: `serverAppConfigs-docs/LLM/frank-primary-freetoken-pr587.md`.
+Runbook: `serverAppConfigs-docs/LLM/frank-archon-radiance-swift15-w4dn8.md`.
+Retired fp8-native era: `serverAppConfigs-docs/LLM/frank-archon-radiance-qwen38-native-fp8.md`.
+Retired FreeToken era: `serverAppConfigs-docs/LLM/frank-archon-freetoken-pr587.md`.
 Retired vLLM era: `serverAppConfigs-docs/LLM/dankserver-qwen38-fp8-expert-offload-tuning.md`.
-Retired GLM experiment: `serverAppConfigs-docs/LLM/frank-primary-glm53-flash-w4a16.md`.
+Retired GLM experiment: `serverAppConfigs-docs/LLM/frank-archon-glm53-flash-w4a16.md`.
 
 ## Key Lessons Learned
 Durable operational lessons from the fleet's history. Full detail in the
@@ -739,11 +772,11 @@ linked runbooks.
 - Swap resize ordering: create and `swapon` the replacement BEFORE `swapoff`
   of the old one, or live pages must land in RAM that `MemAvailable`
   overstates. Dankclaw swap (64 GiB at `/swap.img`, fstab-driven) protects
-  the co-tenants, not frank-large — pinned weights don't swap, and paging
+  the co-tenants, not frank-dragoon — pinned weights don't swap, and paging
   the KV pool is worse than the OOM it prevents.
 - Host swap state is invisible to `deploy.sh` (no repo file) — check
   `swapon --show` before reasoning about headroom.
-- **Silent RAM corruption outranks every software theory.** frank-primary's
+- **Silent RAM corruption outranks every software theory.** frank-archon's
   ~40k-token output corruption (2026-10-04/05, repetition/garbage in long
   agent conversations) was marginal DDR5 at 4800 MT/s on four DIMMs, fixed
   by 4600. Consumer non-ECC memory raises **no MCE** for a silent flip, and
@@ -766,7 +799,7 @@ linked runbooks.
   `LimitMEMLOCK=infinity` (systemd is privileged; the value flows through
   podman to runc without any raise). Upstream halogen's own run lines pass
   NO `--ulimit` at all — copy vendor run lines before adding flags
-  (measured 2026-10-05 on the frank-large cutover).
+  (measured 2026-10-05 on the frank-dragoon cutover).
 - **Kairic Edge** (if ever re-deployed): the pinned CK commit needs
   `third_party/composable_kernel/include/ck/config.h` generated manually
   (untracked; `git clean` removes it), and its greedy-argmax fastpath rejects
@@ -792,7 +825,7 @@ linked runbooks.
   121 GiB box, pushed `available` to 3 GiB, and every later rate was suspect.
   Record the child pid and kill it in a `finally`, then prove `free` came back
   before believing a number. Kill by pid — never `pkill -f llama-server`,
-  which also hits frank-secondary.
+  which also hits frank-zealot.
 
 **llama.cpp serving**
 
@@ -816,7 +849,7 @@ linked runbooks.
   builds its context against whatever model the draft context holds. Two
   context-backed types cannot share one process, and MTP's head only loads
   when MTP **is** the draft model. **A LEGAL chain can still lose on a
-  recurrent model:** `draft-mtp,ngram-mod` on frank-large's qwen35 hybrid
+  recurrent model:** `draft-mtp,ngram-mod` on frank-dragoon's qwen35 hybrid
   measured −15 % prose / −7 % block-copy (2026-10-03) — adding the ngram layer
   logs `recurrent state rollback is not compatible with 'ngram-mod' -
   disabling rollback support`, and MTP verification depends on that rollback,
@@ -858,7 +891,7 @@ linked runbooks.
   free. That was a CONTIGUITY failure, not a total-bytes one, and no totals
   model — the sweep's or the seam's — can see it.)
 - **On the CUDA 3090 the same knob has NO interior optimum up to 2048, so
-  frank-secondary ships 4096/2048.** Measured 2026-10-05 by boot-pair A/B on the
+  frank-zealot ships 4096/2048.** Measured 2026-10-05 by boot-pair A/B on the
   live service: at 8,928 prompt tokens ubatch 1024 gives 3,972 / 4,077 t/s and
   ubatch 2048 gives 4,207 / 4,212 — **+4.6 %** — for **616 MiB** (free 2,849 →
   2,279). Decode did not move (91.9–93.0 vs 93.8–94.3, i.e. noise), and a
@@ -867,9 +900,9 @@ linked runbooks.
   than the ubatch cannot see it. The logical `--batch-size` was again free. And
   the predecessor's "ubatch 2048 failed the scratch boot" was a shape
   observation, not a law: the same file boots 2048 clean at 2 × 200,704. Bench
-  it by restarting the SERVICE through a transient `FRANK_SECONDARY_ENV_FILE`
+  it by restarting the SERVICE through a transient `FRANK_ZEALOT_ENV_FILE`
   drop-in, never a scratch port — one card holds one server. See
-  [[frank-secondary-llama-mimo-q6k-2x200704]].
+  [[frank-zealot-llama-mimo-q6k-2x200704]].
 - **One `-ts` step is one LAYER, and a hybrid stack's layers are not the same
   size.** qwen35 is 16 x (3 Gated DeltaNet + 1 Gated Attention), so a step is
   worth ~0.43 GiB on a DeltaNet boundary and ~1.43 GiB on a full-attention one
@@ -891,7 +924,7 @@ linked runbooks.
   CTX_SIZE / PARALLEL`, and llama.cpp refuses a prompt longer than the SLOT
   (`400 exceed_context_size_error: request (184001 tokens) exceeds the
   available context size (180224 tokens)`) even when the pool has room. So
-  frank-secondary's 2 → 3 reslice moved each conversation from the model's native
+  frank-zealot's 2 → 3 reslice moved each conversation from the model's native
   262,144 down to 180,224, and `models.yml` `contextWindow` had to follow or
   the harness would discover the ceiling as a 400 on a long conversation. Side
   effect worth knowing: the shorter slot made decode ~5 % FASTER (106.8 vs
@@ -902,9 +935,9 @@ linked runbooks.
   day the freed space also bought the Q6_K rung (now 94.4 tok/s — the rung
   itself is a further measured −10 %, weight-bandwidth, not slot geometry).
   All moves measured; both slot directions cost or buy window, never pool.
-  See [[frank-secondary-llama-mimo-q6k-2x200704]].
+  See [[frank-zealot-llama-mimo-q6k-2x200704]].
 - **Price a VRAM budget from two boots, never from a formula — and an mmproj
-  costs ~1.5x its file size.** The frank-secondary 3090 fit was solved from two
+  costs ~1.5x its file size.** The frank-zealot 3090 fit was solved from two
   measurements: 2 × 262,144 with no projector = 20,190 MiB used (KV 12,800 ⇒
   **non-KV 7,390**), 3 × 196,608 with the f16 projector = 22,972 used (KV
   14,113 ⇒ **non-KV 8,859**). The difference is the vision tower: a 918 MB file
@@ -912,24 +945,24 @@ linked runbooks.
   ride with it. Subtracting the two rows is exact; extrapolating weights+KV+
   "a bit for buffers" is what leaves 1.1 GiB free when you meant 2.7. Then
   solve `KV ≤ card − non-KV − headroom` and round to a multiple of
-  `PARALLEL × 4096`. Recorded in `scripts/frank-secondary.env` so the next resize
+  `PARALLEL × 4096`. Recorded in `scripts/frank-zealot.env` so the next resize
   starts from measurement.
 - **`images` and `image_url` are NOT interchangeable: only the content part
   reaches the model.** `--mmproj` loads, `usage.prompt_tokens` rises, and the
   model still invents an answer if the client used the legacy top-level
-  `images` field on `/v1/chat/completions` — frank-secondary answered "Brown." for
+  `images` field on `/v1/chat/completions` — frank-zealot answered "Brown." for
   a solid-red PNG that way and "Red." through the OpenAI `image_url` part. The
   failure is silent because a hallucinated color is a plausible answer. Probe
   vision with a solid color and expect an exact word.
 - **`--jinja` is what `tools` needs.** On 2026-09-16 a subagent died with
   `500 tools param requires --jinja flag`, from the ik_llama.cpp runtime that
-  then served frank-large: every tool-using agent on that endpoint was broken
+  then served frank-dragoon: every tool-using agent on that endpoint was broken
   and the failure read like a model fault. Mainline llama.cpp 0.4.1 defaults
   `--jinja` on and the serve script pins it; halogen also accepts `tools` and
   returns `tool_calls`. Check tool support before routing a role at an endpoint.
 - **Quantized KV on CUDA needs `GGML_CUDA_FA_ALL_QUANTS=ON`** — the same
   option and the same ~12x prefill collapse described in the ROCm note above.
-  f16 KV needs nothing; frank-secondary ran f16 for that reason until
+  f16 KV needs nothing; frank-zealot ran f16 for that reason until
   2026-09-17, when `build-cuda` was rebuilt with the option ON so the
   endpoint could take q8_0 KV.
 - **llama-bench separates a LIST with `/` and SWEEP values with `,`.** Both
@@ -947,7 +980,7 @@ linked runbooks.
   raises on anything else — HTTP 500, not a clamp — so the harness's levels
   must be folded onto that set in `models.yml` (`compat.reasoningEffortMap`).
   A role whose level is unmapped fails on its FIRST request, and the failure
-  names Jinja, not the model: every subagent on `frank-secondary` died with
+  names Jinja, not the model: every subagent on `frank-zealot` died with
   `Unexpected reasoning effort high` until `high: xhigh` was added on
   2026-09-16. Halogen accepts the wider set, so the two entries legitimately
   differ.
@@ -967,7 +1000,7 @@ linked runbooks.
   times (`RuntimeError: No HIP GPUs are available`).
 - SearXNG outbound traffic must stay on the Gluetun tunnel; do not move its
   ports off the gluetun service.
-- `amd_iommu=off` on Dankclaw (bought 13–16 % prefill for frank-large,
+- `amd_iommu=off` on Dankclaw (bought 13–16 % prefill for frank-dragoon,
   2026-09-11) permanently retired the XDNA2 NPU: the driver's SVA/PASID bind
   needs an enabled IOMMU (`/dev/accel/accel0` fails `err=-19`). Revert path
   in `serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md`.
@@ -1021,9 +1054,9 @@ Active:
 
 | Service | Runbook |
 |---------|---------|
-| frank-large (flash-server 0.16.2, abliterated Swift1.5 v2 .hgn + MTP always-on, 2×200,192, vision ON, Dankclaw) | `serverAppConfigs-docs/LLM/frank-large-flash-server-v2-swift15.md` |
-| frank-secondary (llama.cpp CUDA, Swift-1.5-27B Uncensored RCO IQ3_XXS-mtp, 2×114,688 draft-mtp q8_0 KV, Dankclaw) | `serverAppConfigs-docs/LLM/frank-secondary-llama-swift15-unc-iq3xxs-mtp-114688.md` |
-| frank-primary (radiance StillDeadcode, Qwen3.8-Flash-Next-FP8 native, 2×R9700 TP=2, Dankserver) | `serverAppConfigs-docs/LLM/frank-primary-radiance-qwen38-native-fp8.md` |
+| frank-dragoon (flash-server 0.16.2, abliterated Swift1.5 v2 .hgn + MTP always-on, 2×262,144, vision ON, Dankclaw) | `serverAppConfigs-docs/LLM/frank-dragoon-flash-server-v2-swift15.md` |
+| frank-zealot (llama.cpp CUDA, Qwen3.5-9B-Uncensored Q6_K, 2×200,704 exact f16 KV MTP-off, vision ON, Dankclaw) | `serverAppConfigs-docs/LLM/frank-zealot-llama-qwen35-9b-q6k-2x200704.md` |
+| frank-archon (radiance StillDeadcode, Swift1.5-Qwen3.8-Flash-Next GPTQ w4 + bf16-protected experts, int8 trunk, bf16 KV, 2×R9700 TP=2, Dankserver) | `serverAppConfigs-docs/LLM/frank-archon-radiance-swift15-w4dn8.md` |
 | Dankclaw kernel posture (`amd_iommu=off`) | `serverAppConfigs-docs/LLM/dankclaw-iommu-translation-off.md` |
 | Deployment flow + incidents | `serverAppConfigs-docs/LLM/deployment.md` |
 
@@ -1031,40 +1064,42 @@ Retired (rollback targets and history):
 
 | Runtime | Host | Window | Runbook |
 |---------|------|--------|---------|
-| halogen 0.1.4 Qwen3.8-27B p1w4d-d2 + DFlash2 (`frank-large`) | Dankclaw | 2026-10-05 → 10-06 (rollback target — payload + fetch script + image digest on disk; owns the prompt-cache pin and FA-tile lessons) | `frank-large-halogen27b-dflash2.md` |
-| ROCmFPX llama.cpp fork Qwen3.8-27B Uncensored Q6_0_ROCMFPX_AGENT + MTP (`frank-large`) | Dankclaw | 2026-10-03 → 10-05 (rollback target, payload + fork build on disk) | `frank-large-rocmfpx-q6agent-uncensored-mtp.md` |
-| tcclaviger vLLM fork Qwen3.8-Flash-Next-Uncensored FP8, TP=2, shape G (`frank-primary`) | Dankserver | 2026-09-29 → 10-05 (rollback target — tag `frank-primary-vllm-shapeG-20261003`; trio + env lore in the tag, image in rootless storage) | `dankserver-qwen38-fp8-expert-offload-tuning.md` |
-| FreeToken PR #587 ROCm, Qwen3.8-Flash-Next-Uncensored-FP8, ONE R9700 (`frank-primary`) | Dankserver | 2026-10-05 → 10-05 (rollback target — tag `frank-primary-freetoken-pr587-20261005`; trio + Dockerfile in the tag, image `localhost/frank-primary-freetoken:pr587-77a7201` and orcarouter payload on disk) | `frank-primary-freetoken-pr587.md` |
-| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q6_K 2×200,704 f16 KV (`frank-secondary`) | Dankclaw | 2026-10-03 → 10-05 (rollback target — payload on disk; owns the ubatch-2048 A/B; the Ornith swap of 10-05 was committed but never deployed, so this was the LIVE payload Swift replaced) | `frank-secondary-llama-mimo-q6k-2x200704.md` |
-| llama.cpp Ornith-1.5-9B Q8_0, ONE 262,144 f16 KV (`frank-secondary`) | Dankclaw | 2026-10-05 (committed 77decb5→380aafa, never deployed — superseded by Swift the same evening; payload on disk) | trail in `frank-secondary-llama-swift15-unc-iq3xxs-mtp-114688.md` |
-| ROCmFPX llama.cpp fork Qwen3.8-27B Q8_0_ROCMFPX_AGENT + MTP (`frank-large`) | Dankclaw | 2026-10-02 → 10-03 (rollback target, payload on disk) | `frank-large-rocmfpx-q8agent-mtp.md` |
-| gufo v0.1.1 Qwen3.8-27B UD-Q8_K_XL/UD-Q4_K_XL + DFlash2 (`frank-large`) | Dankclaw | 2026-09-28 → 10-01, again 10-01 → 10-02 (payloads removed from disk 2026-10-03; rollback = re-download) | `frank-large-gufo-qwen38-27b.md` |
-| vLLM TheRock MiMo-V2.6-Distill-Qwen-9B BF16 + cross-model MTP (`frank-large`) | Dankclaw | 2026-10-01 (same-day rollback to gufo) | `frank-large-vllm-mimo-v26-bf16.md` |
-| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q6_K (`frank-secondary`) | Dankclaw | 2026-10-01 → 10-02 (the rung returned ACTIVE 2026-10-03 at the 2×200,704 shape — `frank-secondary-llama-mimo-q6k-2x200704.md`) | `frank-secondary-llama-mimo-q6k.md` |
-| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q5_K_M 2×200,704 f16 KV (`frank-secondary`) | Dankclaw | 2026-10-02 → 10-03 (rollback target — one `MODEL_FILE` line, buys back 875 MiB + the −10 % rung tax; owns the boot-pair table) | `frank-secondary-llama-mimo-q5km.md` |
-| SGLang MiMo-V2.6 INT8-W8A16-AutoRound (`frank-secondary`) | Dankclaw | 2026-10-01 (same-day swap to the GGUF path) | `frank-secondary-sglang-mimo-v26.md` |
-|tcclaviger vLLM GLM-5.3-Flash W4A16 int4, +/- DFlash2 drafter (`frank-primary`)|Dankserver|2026-09-30 → 10-01|`frank-primary-glm53-flash-w4a16.md`|
-| llama.cpp b11030 Qwen3.8-27B UD-Q8_K_XL + DFlash2 (`frank-large`) | Dankclaw | 2026-09-21 → 09-28 | `frank-large-unsloth-qwen38-27b-q8xl.md` |
-| R9V radiance-vLLM Qwen3.8-Flash-Next-Uncensored IQ4_XS (`frank-primary`) | Dankserver | 2026-09-27 (same-day swap to Q8_0) | `frank-primary-r9v-radiance-qwen38-uncensored.md` |
-| llama.cpp b11030 Qwen3.8-Flash-Next Q8_0 + shared MTP (`frank-primary`) | Dankserver | 2026-09-26 → 09-27 | `frank-primary-llamacpp-qwen38-flash-next-q8.md` |
-| ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M (`frank-large`) | Dankclaw | 2026-09-15 → 09-16 | `frank-large-ik-uncensored.md` |
+| llama.cpp CUDA Gemma4-26B-A4B QAT Q4_K_M, 1×200,704 f16-K/q8_0-V MTP-off (`frank-zealot`) | Dankclaw | 2026-10-07 → 10-07 (same-day swap; rollback target — payload on disk; owns the `attention_k_eq_v` pair-billing KV law and the gemma4-assistant drafter-cost boots) | `frank-zealot-llama-gemma4-q4km-200704.md` |
+| radiance StillDeadcode Qwen3.8-Flash-Next native-FP8, 2×R9700 TP=2 (`frank-archon`) | Dankserver | 2026-10-08 → w4dn8 swap (rollback target — `.rad` payload on disk) | `frank-archon-radiance-qwen38-native-fp8.md` |
+| ROCmFPX llama.cpp fork Qwen3.8-27B Uncensored Q6_0_ROCMFPX_AGENT + MTP (`frank-dragoon`) | Dankclaw | 2026-10-03 → 10-05 (rollback target, payload + fork build on disk) | `frank-dragoon-rocmfpx-q6agent-uncensored-mtp.md` |
+| tcclaviger vLLM fork Qwen3.8-Flash-Next-Uncensored FP8, TP=2, shape G (`frank-archon`) | Dankserver | 2026-09-29 → 10-05 (rollback target — tag `frank-archon-vllm-shapeG-20261003`; trio + env lore in the tag, image in rootless storage) | `dankserver-qwen38-fp8-expert-offload-tuning.md` |
+| FreeToken PR #587 ROCm, Qwen3.8-Flash-Next-Uncensored-FP8, ONE R9700 (`frank-archon`) | Dankserver | 2026-10-05 → 10-05 (rollback target — tag `frank-archon-freetoken-pr587-20261005`; trio + Dockerfile in the tag, image `localhost/frank-archon-freetoken:pr587-77a7201` and orcarouter payload on disk) | `frank-archon-freetoken-pr587.md` |
+| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q6_K 2×200,704 f16 KV (`frank-zealot`) | Dankclaw | 2026-10-03 → 10-05 (rollback target — payload on disk; owns the ubatch-2048 A/B; the Ornith swap of 10-05 was committed but never deployed, so this was the LIVE payload Swift replaced) | `frank-zealot-llama-mimo-q6k-2x200704.md` |
+| llama.cpp Ornith-1.5-9B Q8_0, ONE 262,144 f16 KV (`frank-zealot`) | Dankclaw | 2026-10-05 (committed 77decb5→380aafa, never deployed — superseded by Swift the same evening; payload on disk) | trail in `frank-zealot-llama-swift15-unc-iq3xxs-mtp-114688.md` |
+| llama.cpp CUDA Swift-1.5-27B Uncensored RCO IQ3_XXS-mtp, 2×114,688 draft-mtp q8_0 KV (`frank-zealot`) | Dankclaw | 2026-10-06 → 2026-10-07 (rollback target — payload on disk; owns the 3090 ubatch ladder A/B and the 34 KiB/token qwen35 KV law) | `frank-zealot-llama-swift15-unc-iq3xxs-mtp-114688.md` |
+| ROCmFPX llama.cpp fork Qwen3.8-27B Q8_0_ROCMFPX_AGENT + MTP (`frank-dragoon`) | Dankclaw | 2026-10-02 → 10-03 (rollback target, payload on disk) | `frank-dragoon-rocmfpx-q8agent-mtp.md` |
+| gufo v0.1.1 Qwen3.8-27B UD-Q8_K_XL/UD-Q4_K_XL + DFlash2 (`frank-dragoon`) | Dankclaw | 2026-09-28 → 10-01, again 10-01 → 10-02 (payloads removed from disk 2026-10-03; rollback = re-download) | `frank-dragoon-gufo-qwen38-27b.md` |
+| vLLM TheRock MiMo-V2.6-Distill-Qwen-9B BF16 + cross-model MTP (`frank-dragoon`) | Dankclaw | 2026-10-01 (same-day rollback to gufo) | `frank-dragoon-vllm-mimo-v26-bf16.md` |
+| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q6_K (`frank-zealot`) | Dankclaw | 2026-10-01 → 10-02 (the rung returned ACTIVE 2026-10-03 at the 2×200,704 shape — `frank-zealot-llama-mimo-q6k-2x200704.md`) | `frank-zealot-llama-mimo-q6k.md` |
+| llama.cpp master MiMo-V2.6-Distill-Qwen-9B Q5_K_M 2×200,704 f16 KV (`frank-zealot`) | Dankclaw | 2026-10-02 → 10-03 (rollback target — one `MODEL_FILE` line, buys back 875 MiB + the −10 % rung tax; owns the boot-pair table) | `frank-zealot-llama-mimo-q5km.md` |
+| SGLang MiMo-V2.6 INT8-W8A16-AutoRound (`frank-zealot`) | Dankclaw | 2026-10-01 (same-day swap to the GGUF path) | `frank-zealot-sglang-mimo-v26.md` |
+|tcclaviger vLLM GLM-5.3-Flash W4A16 int4, +/- DFlash2 drafter (`frank-archon`)|Dankserver|2026-09-30 → 10-01|`frank-archon-glm53-flash-w4a16.md`|
+| llama.cpp b11030 Qwen3.8-27B UD-Q8_K_XL + DFlash2 (`frank-dragoon`) | Dankclaw | 2026-09-21 → 09-28 | `frank-dragoon-unsloth-qwen38-27b-q8xl.md` |
+| R9V radiance-vLLM Qwen3.8-Flash-Next-Uncensored IQ4_XS (`frank-archon`) | Dankserver | 2026-09-27 (same-day swap to Q8_0) | `frank-archon-r9v-radiance-qwen38-uncensored.md` |
+| llama.cpp b11030 Qwen3.8-Flash-Next Q8_0 + shared MTP (`frank-archon`) | Dankserver | 2026-09-26 → 09-27 | `frank-archon-llamacpp-qwen38-flash-next-q8.md` |
+| ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M (`frank-dragoon`) | Dankclaw | 2026-09-15 → 09-16 | `frank-dragoon-ik-uncensored.md` |
 | vllm-radiance TP=2 MXFP4 + DFlash2 (`frank-medium`) | Dankserver | 2026-09-20 → 09-26 | `frank-medium-radiance-mxfp4.md` |
-| Lucebox DS4.1 DeepSeek-V4.1-Flash ROCmFP23 (`frank-primary`) | Dankserver | 2026-09-26 (same-day swap) | `frank-primary-lucebox-ds4.md` |
+| Lucebox DS4.1 DeepSeek-V4.1-Flash ROCmFP23 (`frank-archon`) | Dankserver | 2026-09-26 (same-day swap) | `frank-archon-lucebox-ds4.md` |
 | kingjones STRIX Qwen3.8-Flash-Next ROCmFP4 | Dankclaw | 2026-08-30 → 09-11 | `kingjones-strix-rocmfp4.md` |
-| halogen-flash-server Qwen3.8-Flash-Next w4b (`frank-large`) | Dankclaw | 2026-09-16 → 09-19 | `halogen-flash-server.md` |
-| CIRU v4.4.1 Orca Qwen3.8-Flash (`frank-large`) | Dankclaw | 2026-09-19 → 09-21 | `frank-large-ciru-orca.md` |
-| unsloth llama.cpp b11030 Qwen3.8-Flash-Next UD-IQ4_XS (`frank-large`) | Dankclaw | 2026-09-21 (same-day swap) | `frank-large-unsloth-qwen38-flash-next.md` |
-| Kairic Edge Qwen3.8-27B IU4 W4A4 (`frank-large`) | Dankclaw | 2026-09-21 (same-day swap) | `frank-large-kairic-edge-qwen38-27b.md` |
-| ISTA-DASLab Qwen3.8-27B-GSQ-RCO IQ3_S (`frank-secondary`) | Dankclaw | 2026-09-16 → 09-17 | `frank-secondary-qwen38-gsq-rco.md` |
-| vLLM Gemma4-12B w4a16 (`frank-secondary`) | Dankclaw | 2026-09-19 (same-day revert) | `frank-secondary-vllm-gemma4.md` |
-| llama.cpp Gemma4-12B QAT Q4_K_M (`frank-secondary`) | Dankclaw | 2026-09-17 → 10-01 | `frank-secondary-gemma4-12b.md` |
+| halogen-flash-server Qwen3.8-Flash-Next w4b (`frank-dragoon`) | Dankclaw | 2026-09-16 → 09-19 | `halogen-flash-server.md` |
+| CIRU v4.4.1 Orca Qwen3.8-Flash (`frank-dragoon`) | Dankclaw | 2026-09-19 → 09-21 | `frank-dragoon-ciru-orca.md` |
+| unsloth llama.cpp b11030 Qwen3.8-Flash-Next UD-IQ4_XS (`frank-dragoon`) | Dankclaw | 2026-09-21 (same-day swap) | `frank-dragoon-unsloth-qwen38-flash-next.md` |
+| Kairic Edge Qwen3.8-27B IU4 W4A4 (`frank-dragoon`) | Dankclaw | 2026-09-21 (same-day swap) | `frank-dragoon-kairic-edge-qwen38-27b.md` |
+| ISTA-DASLab Qwen3.8-27B-GSQ-RCO IQ3_S (`frank-zealot`) | Dankclaw | 2026-09-16 → 09-17 | `frank-zealot-qwen38-gsq-rco.md` |
+| vLLM Gemma4-12B w4a16 (`frank-zealot`) | Dankclaw | 2026-09-19 (same-day revert) | `frank-zealot-vllm-gemma4.md` |
+| llama.cpp Gemma4-12B QAT Q4_K_M (`frank-zealot`) | Dankclaw | 2026-09-17 → 10-01 | `frank-zealot-gemma4-12b.md` |
 | agentionai ROCmFP4-FAST imatrix | Dankclaw | 2026-08-29 → 08-30 | `agentionai-fast-imatrix.md` |
 | eemin Qwen3.8-27B ROCmI4 W4A4 MTP | Dankclaw | 2026-08-18 → 08-25 | `eemin-rocmi4-mtp.md` |
 | Kairic Edge IU4 | Dankclaw | 2026-08-22 (same-day revert) | `kairic-edge.md` |
 | CIRU ActiveFPX v3 / PromptForge | Dankclaw | through 2026-08-22 | `ciru-activefpx-promptforge.md` |
 | DFlash2 Vulkan | Dankclaw | 2026-08-21 (same-day revert) | `dflash2-large-vulkan.md` |
 | FastFlowLM NPU (`frank-npu`) | Dankclaw | twice, retired 2026-09-11 | `frank-npu.md`, `FastFlowLM NPU Inference.md` |
-| FreeToken (official + Huihui FP8, `frank-secondary`) | Dankserver | 2026-09-02 → 09-15 | `freetoken-frank-small.md` |
+| FreeToken (official + Huihui FP8, `frank-zealot`) | Dankserver | 2026-09-02 → 09-15 | `freetoken-frank-small.md` |
 | FastMTP patched llama.cpp | Dankserver | retired 2026-08-18 | `qwen3.8-spec-matrix.md` |
 | ik_llama.cpp Ornith CRACK | Dankserver | retired 2026-09-02 | `ikllama-ornith-dankserver.md` |
 | llama.cpp layer split + DFlash2 (`frank-medium`) | Dankserver | 2026-09-16 → 09-20 | `frank-medium-llamacpp-dflash2.md` |

README.md

@@ -13,7 +13,7 @@ one deploy script.
 | Host | User | IP | Podman stack | LLM service | LLM port |
 |------|------|----|--------------|-------------|----------|
 | dankserver | dank | 192.168.0.235 | media and library | frank-medium (ROCmFPX llama.cpp, Qwen3.8-27B AGENT) | 7770 |
-| dankclaw | dank | 192.168.0.143 | AI, search, development, observability | frank-large (gufo, Qwen3.8-27B UD-Q8_K_XL) | 7770 |
+| dankclaw | dank | 192.168.0.143 | AI, search, development, observability | frank-dragoon (gufo, Qwen3.8-27B UD-Q8_K_XL) | 7770 |
 
 ## Active Services
 
@@ -30,7 +30,7 @@ one deploy script.
 | Gitea | dankclaw | gitea.dankclaw.local | 3001 |
 | Grafana | dankclaw | grafana.dankclaw.local | 3002 |
 | Prometheus | dankclaw | prometheus.dankclaw.local | 9090 |
-| frank-large | dankclaw | — (bare endpoint) | 7770 |
+| frank-dragoon | dankclaw | — (bare endpoint) | 7770 |
 
 ## Structure
 

autoresearch.sh

@@ -1,26 +1,26 @@
 #!/usr/bin/env bash
-# autoresearch.sh — canonical frank-primary benchmark entry point (dev box).
+# autoresearch.sh — canonical frank-archon benchmark entry point (dev box).
 #
 # The service runs on dankserver (192.168.0.235:7770), the two R9700s live
 # there, and the benchmark must own those cards, so the whole stop -> boot
 # scratch -> bench -> restore sequence runs ON dankserver (see
-# scripts/autoresearch-frank-primary.sh). This wrapper:
-#   1. copies the candidate config (the repo's scripts/frank-primary.env, the
+# scripts/autoresearch-frank-archon.sh). This wrapper:
+#   1. copies the candidate config (the repo's scripts/frank-archon.env, the
 #      file the autoresearch loop edits) and the bench script to dankserver,
 #   2. runs the bench over ssh, relaying its stdout (the METRIC lines) and
 #      exit code back here verbatim.
 # It deliberately does NOT push to origin: the scp dirties dankserver's
 # working tree, and the loop's uncommitted candidate config must not be
-# pushed. Only this file and scripts/autoresearch-frank-primary.sh are
+# pushed. Only this file and scripts/autoresearch-frank-archon.sh are
 # committed; the candidate env rides over ssh each run.
 set -uo pipefail
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REMOTE=dankserver
 REMOTE_REPO=/home/dank/serverAppConfigs
 
-scp -q "$DIR/scripts/frank-primary.env" \
-    "$REMOTE:$REMOTE_REPO/scripts/frank-primary.env" || { echo "scp env failed" >&2; exit 1; }
-scp -q "$DIR/scripts/autoresearch-frank-primary.sh" \
-    "$REMOTE:$REMOTE_REPO/scripts/autoresearch-frank-primary.sh" || { echo "scp script failed" >&2; exit 1; }
+scp -q "$DIR/scripts/frank-archon.env" \
+    "$REMOTE:$REMOTE_REPO/scripts/frank-archon.env" || { echo "scp env failed" >&2; exit 1; }
+scp -q "$DIR/scripts/autoresearch-frank-archon.sh" \
+    "$REMOTE:$REMOTE_REPO/scripts/autoresearch-frank-archon.sh" || { echo "scp script failed" >&2; exit 1; }
 
-ssh "$REMOTE" "bash $REMOTE_REPO/scripts/autoresearch-frank-primary.sh $REMOTE_REPO/scripts/frank-primary.env"
+ssh "$REMOTE" "bash $REMOTE_REPO/scripts/autoresearch-frank-archon.sh $REMOTE_REPO/scripts/frank-archon.env"

dankclaw/Caddyfile

@@ -56,6 +56,21 @@
 	}
 }
 
+# ═══════════════════════════════════════════════════════════════
+# Named snippet: the pre-auth guard chain. Anubis (:8923) challenges,
+# the embedded Authentik outpost authenticates, and authenticated
+# traffic returns to the http://:8017 listener's post-auth handlers.
+# Every guarded vhost is `import guarded` — the chain is EDITED HERE,
+# never inlined per site (rank 6: it used to be nine verbatim copies).
+# Exemptions live in their own vhosts (auth. is the IdP itself; git
+# smart-HTTP and self-authenticating services document their reason).
+# ═══════════════════════════════════════════════════════════════
+(guarded) {
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
+}
+
 # --- Bare-IP access (health checks, convenience) ---
 :80 {
 	redir https://www.franksdank.cloud/ 308
@@ -72,9 +87,7 @@ franksdank.cloud {
 }
 
 www.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Legacy name: the old homepage name redirects straight onto www ---
@@ -100,9 +113,7 @@ auth.franksdank.cloud {
 
 # --- SearXNG (quadlet; behind the Gluetun tunnel, published 8081) ---
 search.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- OpenWebUI (quadlet on slirp4netns; published 3005) ---
@@ -126,30 +137,22 @@ gitea.franksdank.cloud {
 # never reach Grafana — RP mode needs none and works regardless of topology.
 # The basicauth edge this replaces (CADDY_BASICAUTH_HASH) is retired.
 grafana.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Prometheus ---
 prometheus.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Loki (guarded: Anubis → Authentik; loki-proxy provider, internal_host caddy:8017) ---
 loki.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Seerr (guarded: Anubis → Authentik; seerr provider, internal_host caddy:8017) ---
 seerr.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Marreta (guarded: Anubis → Authentik; marreta provider, internal_host caddy:8017) ---
@@ -157,9 +160,7 @@ seerr.franksdank.cloud {
 # group gate). Egress rides the searxng gluetun tunnel; reached via the
 # host-published port 8082 (gluetun netns), not by container name.
 marreta.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Pi-hole (quadlet on slirp4netns; published 8083) ---
@@ -233,16 +234,12 @@ books.franksdank.cloud {
 
 # --- RomM ---
 romm.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Copyparty ---
 files.franksdank.cloud {
-	reverse_proxy anubis:8923 {
-		header_up X-Real-Ip {remote_host}
-	}
+	import guarded
 }
 
 # --- Jellyfin ---
@@ -337,7 +334,16 @@ http://:8017 {
 			try_files /docs.html
 			file_server
 		}
-		@data path /services.json /status.json /app.js /style.css /deployed.js
+		# /whoami echoes the outpost-injected identity headers so the page
+		# can gate the admin button client-side (the /admin* 403 above stays
+		# the real gate; this only decides what is shown). The outpost strips
+		# client-supplied X-Authentik-* before injecting, so this is spoof-proof.
+		handle /whoami {
+			templates
+			header Content-Type application/json
+			respond "{\"user\":\"{header.X-Authentik-Username}\",\"groups\":\"{header.X-Authentik-Groups}\"}"
+		}
+		@data path /services.json /status.json /app.js /style.css /deployed.js /img/* /sfx/*
 		handle @data {
 			file_server
 		}

dankclaw/hermes/config.yaml.example

@@ -10,15 +10,15 @@ model:
   provider: dankclaw-large
   base_url: http://192.168.0.143:7770/v1
   api_key: not-needed
-  default: frank-large
+  default: frank-dragoon
 
 providers:
   dankclaw-large:
     api: http://192.168.0.143:7770/v1
     discover_models: false
     models:
-      frank-large:
-        context_length: 114688
+      frank-dragoon:
+        context_length: 262144
   dankserver-small:
     api: http://192.168.0.235:7770/v1
     discover_models: false
@@ -29,7 +29,7 @@ providers:
 # Auxiliary routing from the live configuration. Named providers route via
 # their `api:` URL; `custom` entries route by their explicit `base_url`.
 auxiliary:
-  vision: {provider: dankclaw-large, model: frank-large}
+  vision: {provider: dankclaw-large, model: frank-dragoon}
   web_extract: {provider: dankserver-small, model: frank-medium}
   compression: {provider: dankserver-small, model: frank-medium}
   skills_hub: {provider: dankserver-small, model: frank-medium}
@@ -50,8 +50,8 @@ auxiliary:
         effort: none
   memory_query_rewrite: {provider: custom, model: frank-medium, base_url: http://192.168.0.235:7770/v1}
   tts_audio_tags: {provider: custom, model: frank-medium, base_url: http://192.168.0.235:7770/v1}
-  triage_specifier: {provider: dankclaw-large, model: frank-large}
-  kanban_decomposer: {provider: dankclaw-large, model: frank-large}
+  triage_specifier: {provider: dankclaw-large, model: frank-dragoon}
+  kanban_decomposer: {provider: dankclaw-large, model: frank-dragoon}
   profile_describer: {provider: dankserver-small, model: frank-medium}
   curator: {provider: dankserver-small, model: frank-medium}
 

dankclaw/observability/quadlet/node-exporter.container

@@ -1,30 +1,32 @@
-# Quadlet unit: node-exporter (rootless, boot-persistent).
+# Quadlet unit: node-exporter (rootless, boot-persistent) — RENDERED ARTIFACT.
+# Regenerate: python3 scripts/service-map.py render node-exporter-unit --host dankclaw
+# Source: shared/services.yml (entry node-exporter) + this template.
 #
 # Install path on dankclaw: ~/.config/containers/systemd/node-exporter.container
 # Unit name: node-exporter.service (container name: node-exporter)
 #
-# Host metrics source for Prometheus. This replaces the compose service of the
-# same name in dankclaw/compose.yaml ("Observability" block).
+# Host metrics source for Prometheus. Replaces the compose service of the same
+# name (the "Observability" block): Dankclaw moved to this quadlet on
+# 2026-09-11, Dankserver on 2026-09-16 — its compose-only copy died at a reboot
+# and stayed dead (rootless Podman does not restart bare containers after the
+# explicit stop shutdown performs), dead for a day and a half before anyone
+# noticed. One owner per container name; no compose file remains anywhere.
 #
 # HOST NAMESPACE. It must run in the host network namespace to report the
 # host's own interfaces/connections, and --pid=host for the processes and
 # cgroups collectors. "localhost" inside the container is therefore the host's
 # loopback, which is what the homepage status timer probes.
 #
-# LISTEN ADDRESSES. Until 2026-09-11 this bound :9100 on every interface. It
-# now binds exactly two: loopback for the homepage status probe, and the LAN
-# address because Prometheus — which runs in a container on dankclaw_default —
-# scrapes http://192.168.0.143:9100 (shared/prometheus/prometheus.yml,
-# job "node-dankclaw"). node_exporter itself has no authentication, so keeping
-# the wildcard bind off the table matters: this is the second half of the
-# pairing that removes the unauthenticated observability surface, and both
-# consumers are accounted for. Dankserver runs its own copy of this container
-# (scraped by the "node-dankserver" job) — since 2026-09-16 as a Quadlet unit in
-# the same shape (dankserver/observability/quadlet/), because the compose-only
-# version it replaced had been dead for a day and a half before anyone noticed.
+# LISTEN ADDRESSES. Exactly two: loopback for the homepage status probe, and
+# the LAN address, because Prometheus — which runs in a container on
+# dankclaw_default — scrapes http://192.168.0.143:9100/metrics
+# (shared/prometheus/prometheus.yml, job "node-dankclaw"). node_exporter has no
+# authentication, so the wildcard bind stays off the table; this is the
+# pairing that removes the unauthenticated observability surface on every
+# host, and both consumers are accounted for.
 #
-# MOUNTS. The container reads the host's /proc, /sys and / as /host/* read-only
-# and is pointed at them with --path.*; it writes nothing anywhere.
+# MOUNTS. The container reads the host's /proc, /sys and / as /host/*
+# read-only and is pointed at them with --path.*; it writes nothing anywhere.
 
 [Unit]
 Description=Prometheus node exporter (Dankclaw host metrics)

dankclaw/pihole/addn-hosts

@@ -1,47 +1,43 @@
-# A records for the flat franksdank.name scheme (dnsmasq addn-hosts format:
-# <IP> <name> [<name> ...]). Served by the Pi-hole quadlet (FTL is a
-# dnsmasq fork): the quadlet mounts this file into /etc/pihole/hosts/ read-only.
+# A records for the flat franksdank.cloud scheme (dnsmasq addn-hosts
+# format: <IP> <name>). RENDERED — do not edit by hand:
 #
-# Caddy is consolidated on dankclaw (192.168.0.143): it fronts every service
-# on both hosts, so every name resolves to that one IP. Keep in sync with the
-# Caddyfile (tests/pihole.bats cross-checks this).
+#     scripts/service-map.py render pihole-hosts > dankclaw/pihole/addn-hosts
 #
-#   192.168.0.143 = dankclaw (runs the Caddy container + the AI/dev stack)
-#   192.168.0.235 = dankserver (media stack; reached by Caddy via published
-#                    LAN ports — no DNS records point here)
+# The source of truth is the `dns:` field of shared/services.yml; the
+# drift gate in tests/service_inventory.bats fails when this file and
+# the inventory disagree. Caddy is consolidated on Dankclaw, so every
+# name — including the services running on dankserver and
+# frankbook-pro — resolves at the Dankclaw edge.
+#
+# dnsmasq strips ONLY whole-line comments in addn-hosts: a trailing
+# comment on a data line becomes a HOSTNAME token. No inline notes
+# here; the service attribution lives in the inventory.
 
-# --- Homepage (naked domain + www) + legacy names ---
+192.168.0.143 search.franksdank.cloud
+192.168.0.143 marreta.franksdank.cloud
+192.168.0.143 pihole.franksdank.cloud
+192.168.0.143 ai.franksdank.cloud
+192.168.0.143 gitea.franksdank.cloud
+192.168.0.143 comfyui.franksdank.cloud
+192.168.0.143 seerr.franksdank.cloud
+192.168.0.143 hermes.franksdank.cloud
+192.168.0.143 hermesadmin.franksdank.cloud
+192.168.0.143 prometheus.franksdank.cloud
+192.168.0.143 grafana.franksdank.cloud
+192.168.0.143 loki.franksdank.cloud
+192.168.0.143 auth.franksdank.cloud
 192.168.0.143 franksdank.cloud
 192.168.0.143 www.franksdank.cloud
 192.168.0.143 dankclaw.franksdank.cloud
 192.168.0.143 dankserver.franksdank.cloud
-
-# --- Authentik (SSO / OIDC provider) ---
-192.168.0.143 auth.franksdank.cloud
-
-# --- Media services (dankserver, proxied) ---
-192.168.0.143 plex.franksdank.cloud
-192.168.0.143 plex.franksdank.casa
-192.168.0.143 books.franksdank.cloud
 192.168.0.143 romm.franksdank.cloud
 192.168.0.143 files.franksdank.cloud
 192.168.0.143 jelly.franksdank.cloud
+192.168.0.143 books.franksdank.cloud
+192.168.0.143 plex.franksdank.cloud
+192.168.0.143 plex.franksdank.casa
+192.168.0.143 prowlarr.franksdank.cloud
+192.168.0.143 qbittorrent.franksdank.cloud
 192.168.0.143 radarr.franksdank.cloud
 192.168.0.143 lidarr.franksdank.cloud
 192.168.0.143 readarr.franksdank.cloud
-192.168.0.143 prowlarr.franksdank.cloud
-192.168.0.143 qbittorrent.franksdank.cloud
-
-# --- AI / search / dev services (dankclaw, local) ---
-192.168.0.143 search.franksdank.cloud
-192.168.0.143 comfyui.franksdank.cloud
-192.168.0.143 ai.franksdank.cloud
-192.168.0.143 hermes.franksdank.cloud
-192.168.0.143 hermesadmin.franksdank.cloud
-192.168.0.143 gitea.franksdank.cloud
-192.168.0.143 grafana.franksdank.cloud
-192.168.0.143 prometheus.franksdank.cloud
-192.168.0.143 loki.franksdank.cloud
-192.168.0.143 pihole.franksdank.cloud
-192.168.0.143 seerr.franksdank.cloud
-192.168.0.143 marreta.franksdank.cloud

dankserver/observability/quadlet/node-exporter.container

@@ -1,34 +1,32 @@
-# Quadlet unit: node-exporter (rootless, boot-persistent) — DANKSERVER.
+# Quadlet unit: node-exporter (rootless, boot-persistent) — RENDERED ARTIFACT.
+# Regenerate: python3 scripts/service-map.py render node-exporter-unit --host dankserver
+# Source: shared/services.yml (entry node-exporter) + this template.
 #
 # Install path on dankserver: ~/.config/containers/systemd/node-exporter.container
 # Unit name: node-exporter.service (container name: node-exporter)
 #
-# WHY THIS FILE EXISTS. Until 2026-09-16 the Dankserver node-exporter ran only
-# from `dankserver/compose.yaml` (the "Observability" block, `restart:
-# unless-stopped`). Rootless Podman does not restart bare containers after the
-# explicit stop that shutdown performs, so it died at a reboot and stayed dead:
-# `podman ps -a` showed it `Exited (143)` and Prometheus' `node-dankserver` job
-# had been scraping nothing since. The compose entry also bound the default
-# wildcard address, which is the unauthenticated-metrics-API-on-every-interface
-# posture that was already removed on Dankclaw. This unit replaces both: one
-# owner per container name (the compose service is deleted), explicit listen
-# addresses, and a generator-provided boot path.
+# Host metrics source for Prometheus. Replaces the compose service of the same
+# name (the "Observability" block): Dankclaw moved to this quadlet on
+# 2026-09-11, Dankserver on 2026-09-16 — its compose-only copy died at a reboot
+# and stayed dead (rootless Podman does not restart bare containers after the
+# explicit stop shutdown performs), dead for a day and a half before anyone
+# noticed. One owner per container name; no compose file remains anywhere.
 #
-# HOST NAMESPACE. Networking and PID in the host's namespaces: the collectors
-# report the host's own interfaces, connections, processes and cgroups. The
-# host's /proc, /sys and / are mounted read-only under /host and /rootfs, and
-# node_exporter writes nothing.
+# HOST NAMESPACE. It must run in the host network namespace to report the
+# host's own interfaces/connections, and --pid=host for the processes and
+# cgroups collectors. "localhost" inside the container is therefore the host's
+# loopback, which is what the homepage status timer probes.
 #
-# LISTEN ADDRESSES. Exactly two:
-#   - 127.0.0.1:9100   for host-local probes
-#   - 192.168.0.235:9100 for Prometheus, which scrapes this host from Dankclaw
-#     (shared/prometheus/prometheus.yml, job "node-dankserver"). It cannot use
-#     loopback across hosts, and node_exporter has no authentication, so the
-#     wildcard bind stays off the table. This is the same deliberate LAN
-#     listener posture the observability runbook documents.
+# LISTEN ADDRESSES. Exactly two: loopback for the homepage status probe, and
+# the LAN address, because Prometheus — which runs in a container on
+# dankclaw_default — scrapes http://192.168.0.235:9100/metrics
+# (shared/prometheus/prometheus.yml, job "node-dankserver"). node_exporter has no
+# authentication, so the wildcard bind stays off the table; this is the
+# pairing that removes the unauthenticated observability surface on every
+# host, and both consumers are accounted for.
 #
-# MIRROR. Keep this file in step with dankclaw/observability/quadlet/
-# node-exporter.container; only the Description and the LAN address differ.
+# MOUNTS. The container reads the host's /proc, /sys and / as /host/*
+# read-only and is pointed at them with --path.*; it writes nothing anywhere.
 
 [Unit]
 Description=Prometheus node exporter (Dankserver host metrics)

echo_request.json

@@ -1 +1 @@
-{"model": "frank-large", "prompt": "Below is a telemetry API schema, labeled SCHEMA A. Later in this message the same schema is repeated word for word, labeled SCHEMA B.\nTask: output SCHEMA B verbatim, with no commentary and no reformatting, starting immediately with the opening brace.\n\nSCHEMA A:\n{\"version\":\"2.3.1\",\"endpoints\":[{\"id\":\"ep-000\",\"path\":\"/v2/telemetry/gw5978x49\",\"method\":\"GET\",\"latency_ms\":219,\"owner\":\"team-0\",\"limit\":{\"burst\":221,\"sustained\":149}},{\"id\":\"ep-001\",\"path\":\"/v2/telemetry/gw6279x77\",\"method\":\"POST\",\"latency_ms\":456,\"owner\":\"team-1\",\"limit\":{\"burst\":227,\"sustained\":173}},{\"id\":\"ep-002\",\"path\":\"/v2/telemetry/gw4501x82\",\"method\":\"PUT\",\"latency_ms\":488,\"owner\":\"team-2\",\"limit\":{\"burst\":407,\"sustained\":189}},{\"id\":\"ep-003\",\"path\":\"/v2/telemetry/gw3780xA8\",\"method\":\"DELETE\",\"latency_ms\":90,\"owner\":\"team-3\",\"limit\":{\"burst\":146,\"sustained\":132}},{\"id\":\"ep-004\",\"path\":\"/v2/telemetry/gw6491x17\",\"method\":\"GET\",\"latency_ms\":842,\"owner\":\"team-4\",\"limit\":{\"burst\":488,\"sustained\":193}},{\"id\":\"ep-005\",\"path\":\"/v2/telemetry/gw4848xAC\",\"method\":\"POST\",\"latency_ms\":321,\"owner\":\"team-5\",\"limit\":{\"burst\":116,\"sustained\":51}},{\"id\":\"ep-006\",\"path\":\"/v2/telemetry/gw3414x06\",\"method\":\"PUT\",\"latency_ms\":51,\"owner\":\"team-6\",\"limit\":{\"burst\":126,\"sustained\":122}},{\"id\":\"ep-007\",\"path\":\"/v2/telemetry/gw2193x74\",\"method\":\"DELETE\",\"latency_ms\":428,\"owner\":\"team-0\",\"limit\":{\"burst\":454,\"sustained\":162}},{\"id\":\"ep-008\",\"path\":\"/v2/telemetry/gw4185xB7\",\"method\":\"GET\",\"latency_ms\":717,\"owner\":\"team-1\",\"limit\":{\"burst\":197,\"sustained\":127}},{\"id\":\"ep-009\",\"path\":\"/v2/telemetry/gw7547x3E\",\"method\":\"POST\",\"latency_ms\":155,\"owner\":\"team-2\",\"limit\":{\"burst\":336,\"sustained\":177}},{\"id\":\"ep-010\",\"path\":\"/v2/telemetry/gw1090xE4\",\"method\":\"PUT\",\"latency_ms\":772,\"owner\":\"team-3\",\"limit\":{\"burst\":441,\"sustained\":198}},{\"id\":\"ep-011\",\"path\":\"/v2/telemetry/gw2746xC7\",\"method\":\"DELETE\",\"latency_ms\":439,\"owner\":\"team-4\",\"limit\":{\"burst\":113,\"sustained\":46}},{\"id\":\"ep-012\",\"path\":\"/v2/telemetry/gw9486x76\",\"method\":\"GET\",\"latency_ms\":55,\"owner\":\"team-5\",\"limit\":{\"burst\":286,\"sustained\":64}},{\"id\":\"ep-013\",\"path\":\"/v2/telemetry/gw2988x74\",\"method\":\"POST\",\"latency_ms\":140,\"owner\":\"team-6\",\"limit\":{\"burst\":411,\"sustained\":119}},{\"id\":\"ep-014\",\"path\":\"/v2/telemetry/gw9702xFC\",\"method\":\"PUT\",\"latency_ms\":576,\"owner\":\"team-0\",\"limit\":{\"burst\":305,\"sustained\":82}},{\"id\":\"ep-015\",\"path\":\"/v2/telemetry/gw8251x9C\",\"method\":\"DELETE\",\"latency_ms\":838,\"owner\":\"team-1\",\"limit\":{\"burst\":369,\"sustained\":130}},{\"id\":\"ep-016\",\"path\":\"/v2/telemetry/gw7991xD4\",\"method\":\"GET\",\"latency_ms\":565,\"owner\":\"team-2\",\"limit\":{\"burst\":229,\"sustained\":41}},{\"id\":\"ep-017\",\"path\":\"/v2/telemetry/gw8777x73\",\"method\":\"POST\",\"latency_ms\":269,\"owner\":\"team-3\",\"limit\":{\"burst\":385,\"sustained\":64}},{\"id\":\"ep-018\",\"path\":\"/v2/telemetry/gw5543xC4\",\"method\":\"PUT\",\"latency_ms\":800,\"owner\":\"team-4\",\"limit\":{\"burst\":267,\"sustained\":125}},{\"id\":\"ep-019\",\"path\":\"/v2/telemetry/gw4919x46\",\"method\":\"DELETE\",\"latency_ms\":454,\"owner\":\"team-5\",\"limit\":{\"burst\":40,\"sustained\":183}},{\"id\":\"ep-020\",\"path\":\"/v2/telemetry/gw5681x3C\",\"method\":\"GET\",\"latency_ms\":282,\"owner\":\"team-6\",\"limit\":{\"burst\":172,\"sustained\":82}},{\"id\":\"ep-021\",\"path\":\"/v2/telemetry/gw9849x14\",\"method\":\"POST\",\"latency_ms\":145,\"owner\":\"team-0\",\"limit\":{\"burst\":78,\"sustained\":60}},{\"id\":\"ep-022\",\"path\":\"/v2/telemetry/gw7275xB1\",\"method\":\"PUT\",\"latency_ms\":160,\"owner\":\"team-1\",\"limit\":{\"burst\":362,\"sustained\":55}},{\"id\":\"ep-023\",\"path\":\"/v2/telemetry/gw2052x6A\",\"method\":\"DELETE\",\"latency_ms\":421,\"owner\":\"team-2\",\"limit\":{\"burst\":170,\"sustained\":139}},{\"id\":\"ep-024\",\"path\":\"/v2/telemetry/gw8633x6A\",\"method\":\"GET\",\"latency_ms\":67,\"owner\":\"team-3\",\"limit\":{\"burst\":106,\"sustained\":108}},{\"id\":\"ep-025\",\"path\":\"/v2/telemetry/gw7381xE7\",\"method\":\"POST\",\"latency_ms\":792,\"owner\":\"team-4\",\"limit\":{\"burst\":300,\"sustained\":179}},{\"id\":\"ep-026\",\"path\":\"/v2/telemetry/gw1320xDB\",\"method\":\"PUT\",\"latency_ms\":787,\"owner\":\"team-5\",\"limit\":{\"burst\":295,\"sustained\":98}},{\"id\":\"ep-027\",\"path\":\"/v2/telemetry/gw8814x01\",\"method\":\"DELETE\",\"latency_ms\":364,\"owner\":\"team-6\",\"limit\":{\"burst\":153,\"sustained\":193}},{\"id\":\"ep-028\",\"path\":\"/v2/telemetry/gw7389xDA\",\"method\":\"GET\",\"latency_ms\":859,\"owner\":\"team-0\",\"limit\":{\"burst\":215,\"sustained\":138}},{\"id\"Line truncated
+{"model": "frank-dragoon", "prompt": "Below is a telemetry API schema, labeled SCHEMA A. Later in this message the same schema is repeated word for word, labeled SCHEMA B.\nTask: output SCHEMA B verbatim, with no commentary and no reformatting, starting immediately with the opening brace.\n\nSCHEMA A:\n{\"version\":\"2.3.1\",\"endpoints\":[{\"id\":\"ep-000\",\"path\":\"/v2/telemetry/gw5978x49\",\"method\":\"GET\",\"latency_ms\":219,\"owner\":\"team-0\",\"limit\":{\"burst\":221,\"sustained\":149}},{\"id\":\"ep-001\",\"path\":\"/v2/telemetry/gw6279x77\",\"method\":\"POST\",\"latency_ms\":456,\"owner\":\"team-1\",\"limit\":{\"burst\":227,\"sustained\":173}},{\"id\":\"ep-002\",\"path\":\"/v2/telemetry/gw4501x82\",\"method\":\"PUT\",\"latency_ms\":488,\"owner\":\"team-2\",\"limit\":{\"burst\":407,\"sustained\":189}},{\"id\":\"ep-003\",\"path\":\"/v2/telemetry/gw3780xA8\",\"method\":\"DELETE\",\"latency_ms\":90,\"owner\":\"team-3\",\"limit\":{\"burst\":146,\"sustained\":132}},{\"id\":\"ep-004\",\"path\":\"/v2/telemetry/gw6491x17\",\"method\":\"GET\",\"latency_ms\":842,\"owner\":\"team-4\",\"limit\":{\"burst\":488,\"sustained\":193}},{\"id\":\"ep-005\",\"path\":\"/v2/telemetry/gw4848xAC\",\"method\":\"POST\",\"latency_ms\":321,\"owner\":\"team-5\",\"limit\":{\"burst\":116,\"sustained\":51}},{\"id\":\"ep-006\",\"path\":\"/v2/telemetry/gw3414x06\",\"method\":\"PUT\",\"latency_ms\":51,\"owner\":\"team-6\",\"limit\":{\"burst\":126,\"sustained\":122}},{\"id\":\"ep-007\",\"path\":\"/v2/telemetry/gw2193x74\",\"method\":\"DELETE\",\"latency_ms\":428,\"owner\":\"team-0\",\"limit\":{\"burst\":454,\"sustained\":162}},{\"id\":\"ep-008\",\"path\":\"/v2/telemetry/gw4185xB7\",\"method\":\"GET\",\"latency_ms\":717,\"owner\":\"team-1\",\"limit\":{\"burst\":197,\"sustained\":127}},{\"id\":\"ep-009\",\"path\":\"/v2/telemetry/gw7547x3E\",\"method\":\"POST\",\"latency_ms\":155,\"owner\":\"team-2\",\"limit\":{\"burst\":336,\"sustained\":177}},{\"id\":\"ep-010\",\"path\":\"/v2/telemetry/gw1090xE4\",\"method\":\"PUT\",\"latency_ms\":772,\"owner\":\"team-3\",\"limit\":{\"burst\":441,\"sustained\":198}},{\"id\":\"ep-011\",\"path\":\"/v2/telemetry/gw2746xC7\",\"method\":\"DELETE\",\"latency_ms\":439,\"owner\":\"team-4\",\"limit\":{\"burst\":113,\"sustained\":46}},{\"id\":\"ep-012\",\"path\":\"/v2/telemetry/gw9486x76\",\"method\":\"GET\",\"latency_ms\":55,\"owner\":\"team-5\",\"limit\":{\"burst\":286,\"sustained\":64}},{\"id\":\"ep-013\",\"path\":\"/v2/telemetry/gw2988x74\",\"method\":\"POST\",\"latency_ms\":140,\"owner\":\"team-6\",\"limit\":{\"burst\":411,\"sustained\":119}},{\"id\":\"ep-014\",\"path\":\"/v2/telemetry/gw9702xFC\",\"method\":\"PUT\",\"latency_ms\":576,\"owner\":\"team-0\",\"limit\":{\"burst\":305,\"sustained\":82}},{\"id\":\"ep-015\",\"path\":\"/v2/telemetry/gw8251x9C\",\"method\":\"DELETE\",\"latency_ms\":838,\"owner\":\"team-1\",\"limit\":{\"burst\":369,\"sustained\":130}},{\"id\":\"ep-016\",\"path\":\"/v2/telemetry/gw7991xD4\",\"method\":\"GET\",\"latency_ms\":565,\"owner\":\"team-2\",\"limit\":{\"burst\":229,\"sustained\":41}},{\"id\":\"ep-017\",\"path\":\"/v2/telemetry/gw8777x73\",\"method\":\"POST\",\"latency_ms\":269,\"owner\":\"team-3\",\"limit\":{\"burst\":385,\"sustained\":64}},{\"id\":\"ep-018\",\"path\":\"/v2/telemetry/gw5543xC4\",\"method\":\"PUT\",\"latency_ms\":800,\"owner\":\"team-4\",\"limit\":{\"burst\":267,\"sustained\":125}},{\"id\":\"ep-019\",\"path\":\"/v2/telemetry/gw4919x46\",\"method\":\"DELETE\",\"latency_ms\":454,\"owner\":\"team-5\",\"limit\":{\"burst\":40,\"sustained\":183}},{\"id\":\"ep-020\",\"path\":\"/v2/telemetry/gw5681x3C\",\"method\":\"GET\",\"latency_ms\":282,\"owner\":\"team-6\",\"limit\":{\"burst\":172,\"sustained\":82}},{\"id\":\"ep-021\",\"path\":\"/v2/telemetry/gw9849x14\",\"method\":\"POST\",\"latency_ms\":145,\"owner\":\"team-0\",\"limit\":{\"burst\":78,\"sustained\":60}},{\"id\":\"ep-022\",\"path\":\"/v2/telemetry/gw7275xB1\",\"method\":\"PUT\",\"latency_ms\":160,\"owner\":\"team-1\",\"limit\":{\"burst\":362,\"sustained\":55}},{\"id\":\"ep-023\",\"path\":\"/v2/telemetry/gw2052x6A\",\"method\":\"DELETE\",\"latency_ms\":421,\"owner\":\"team-2\",\"limit\":{\"burst\":170,\"sustained\":139}},{\"id\":\"ep-024\",\"path\":\"/v2/telemetry/gw8633x6A\",\"method\":\"GET\",\"latency_ms\":67,\"owner\":\"team-3\",\"limit\":{\"burst\":106,\"sustained\":108}},{\"id\":\"ep-025\",\"path\":\"/v2/telemetry/gw7381xE7\",\"method\":\"POST\",\"latency_ms\":792,\"owner\":\"team-4\",\"limit\":{\"burst\":300,\"sustained\":179}},{\"id\":\"ep-026\",\"path\":\"/v2/telemetry/gw1320xDB\",\"method\":\"PUT\",\"latency_ms\":787,\"owner\":\"team-5\",\"limit\":{\"burst\":295,\"sustained\":98}},{\"id\":\"ep-027\",\"path\":\"/v2/telemetry/gw8814x01\",\"method\":\"DELETE\",\"latency_ms\":364,\"owner\":\"team-6\",\"limit\":{\"burst\":153,\"sustained\":193}},{\"id\":\"ep-028\",\"path\":\"/v2/telemetry/gw7389xDA\",\"method\":\"GET\",\"latency_ms\":859,\"owner\":\"team-0\",\"limit\":{\"burst\":215,\"sustained\":138}},{\"idLine truncated

old/download-frank-archon-fp8.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# download-frank-primary-fp8.sh — fetch/verify the Qwen3.8-Flash-Next-FP8
+# download-frank-archon-fp8.sh — fetch/verify the Qwen3.8-Flash-Next-FP8
 # payload (131 safetensors shards, 172.78 GiB total, plus aux files) for the
-# vLLM frank-primary deployment on dankserver.
+# vLLM frank-archon deployment on dankserver.
 #
-#   bash scripts/download-frank-primary-fp8.sh [dest_dir]
+#   bash scripts/download-frank-archon-fp8.sh [dest_dir]
 #
 # The manifest (scripts/manifests/qwen3.8-flash-next-fp8.manifest) carries
 # per-file sizes + LFS sha256s from the Hub; hf-fetch.sh is idempotent — an

old/download-frank-dragoon-dflash.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Download the z-lab Qwen3.5-9B-DFlash drafter for frank-large's DFlash
+# Download the z-lab Qwen3.5-9B-DFlash drafter for frank-dragoon's DFlash
 # speculative-decode arm (vLLM --speculative-config method=dflash). Public
 # repo — no auth header on the command line.
 #
@@ -10,7 +10,7 @@
 # the draft for that target.
 #
 # Usage:
-#   scripts/download-frank-large-dflash.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-dflash.sh [DEST_DIR] [--verify-only]
 set -euo pipefail
 
 REPO="z-lab/Qwen3.5-9B-DFlash"

old/download-frank-dragoon-mimo.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# Download the BF16 MiMo-V2.6-Distill-Qwen-9B payload for frank-large
+# Download the BF16 MiMo-V2.6-Distill-Qwen-9B payload for frank-dragoon
 # (vLLM/kyuz0 gfx1151, Strix Halo iGPU). Public repo — no auth header on the
 # command line (a Bearer token in argv is world-readable via /proc).
 #
 # Per-file FRESH downloads, no resume: the house rule (see
-# download-frank-secondary.sh); -f/--fail-with-body plus size+sha256 against the
+# download-frank-zealot.sh); -f/--fail-with-body plus size+sha256 against the
 # Hub LFS oid is what makes an access error fail instead of "succeeding".
 #
 # Usage:
-#   scripts/download-frank-large-mimo.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-mimo.sh [DEST_DIR] [--verify-only]
 #
 # The verified set below is exactly what the 2026-10-01 bench window served:
 # 17.53 GiB of BF16 weights (4 shards, 18,819,720,848 B total with the rest).

old/download-frank-dragoon-qwen35.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
 # Download the source Qwen3.5-9B checkpoint — the ONLY place this model
-# family's MTP head (15 mtp.* tensors) exists. frank-large runs it as the
+# family's MTP head (15 mtp.* tensors) exists. frank-dragoon runs it as the
 # vLLM cross-model MTP draft (MiMo-V2.6-Distill-Qwen-9B itself ships zero
-# mtp tensors; that is why SGLang's NEXTN on frank-secondary draws 0.00
+# mtp tensors; that is why SGLang's NEXTN on frank-zealot draws 0.00
 # acceptance). Public repo — no auth header on the command line.
 #
 # NOTE the odd upstream shard names (model.safetensors-0000N-of-00004...).
 #
 # Usage:
-#   scripts/download-frank-large-qwen35.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-qwen35.sh [DEST_DIR] [--verify-only]
 set -euo pipefail
 
 REPO="Qwen/Qwen3.5-9B"

old/download-frank-zealot-sglang-int8.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Download MiMo-V2.6-Distill-Qwen-9B-INT8-W8A16-AutoRound for frank-secondary
+# Download MiMo-V2.6-Distill-Qwen-9B-INT8-W8A16-AutoRound for frank-zealot
 # (SGLang, RTX 3090). Public repo — no auth header on the command line.
 #
 # Per-file FRESH downloads, no resume: `curl -C -` once produced a 213 MB
@@ -7,7 +7,7 @@
 # the house rule.
 #
 # Usage:
-#   scripts/download-frank-secondary.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-zealot.sh [DEST_DIR] [--verify-only]
 #
 # LFS shards are verified against the Hub LFS sha256; non-LFS text files
 # against their declared byte size. Idempotent: complete files are skipped.

old/scripts/bench-frank-dragoon.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# bench-frank-large.sh — 64k-context benchmark for the frank-default-large stack.
+# bench-frank-dragoon.sh — 64k-context benchmark for the frank-default-large stack.
 #
 # Measures generation throughput of Qwen3.6-27B Q8_K_P + DFlash + ngram-mod on
 # a single backend at 64k context. It starts llama-server on a scratch port,
@@ -7,15 +7,15 @@
 # prompt, and prints tokens/sec.
 #
 # Usage:
-#   ./scripts/bench-frank-large.sh <ROCm0|Vulkan0> [--generations N]
+#   ./scripts/bench-frank-dragoon.sh <ROCm0|Vulkan0> [--generations N]
 #
 # Example:
-#   ./scripts/bench-frank-large.sh ROCm0
-#   ./scripts/bench-frank-large.sh Vulkan0 --generations 3
+#   ./scripts/bench-frank-dragoon.sh ROCm0
+#   ./scripts/bench-frank-dragoon.sh Vulkan0 --generations 3
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-DEVICE="${1:?usage: bench-frank-large.sh <ROCm0|Vulkan0> [--generations N]}"
+DEVICE="${1:?usage: bench-frank-dragoon.sh <ROCm0|Vulkan0> [--generations N]}"
 GENERATIONS=1
 if [ "${2:-}" = "--generations" ]; then
     GENERATIONS="${3:?--generations needs a count}"

old/scripts/deploy.sh

@@ -41,7 +41,7 @@ SERVICE_HEALTH[dankclaw]="http://127.0.0.1:7770/health"
 # Drop page caches before restart: with the model's pages fully cached, the
 # KV/graph allocation stalls at load (VRAM stuck at 28 GiB). See AGENTS.md.
 DROP_CACHES[dankclaw]=1
-# Passwordless restart helper (root-owned, installed via /etc/sudoers.d/frank-large).
+# Passwordless restart helper (root-owned, installed via /etc/sudoers.d/frank-dragoon).
 # When present, deploy.sh uses it instead of inline sudo commands.
 HELPER[dankclaw]="/usr/local/sbin/frank-restart-large.sh"
 # Health wait in iterations of 2s. Cold loads after the cache drop measured

old/scripts/frank-default-large.ling.env

@@ -1,6 +1,6 @@
-# Tunables for the Ling-3.0-flash TRAIL on dankclaw (frank-large-ling).
+# Tunables for the Ling-3.0-flash TRAIL on dankclaw (frank-dragoon-ling).
 # This REPLACES frank-default-large (Qwen3.6-27B) temporarily. To switch
-# back: systemctl stop frank-large-ling && systemctl start frank-default-large.
+# back: systemctl stop frank-dragoon-ling && systemctl start frank-default-large.
 # Runtime: llama.cpp FORK bailingmoe3-support; Vulkan + AMD GTT.
 #
 # Memory model (amdgpu Strix Halo gfx1151, 8x16GB LPDDR5 = 128 GiB physical):

old/scripts/frank-dragoon-ling.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=llama.cpp Ling-3.0-flash Q6_K Vulkan+MTP (frank-large-ling TRIAL)
+Description=llama.cpp Ling-3.0-flash Q6_K Vulkan+MTP (frank-dragoon-ling TRIAL)
 After=network.target
 
 [Service]

old/scripts/serve-ling-flash.sh

@@ -8,7 +8,7 @@
 # Vulkan exposes as an ~111 GiB heap). MTP drafter is bundled in the same
 # GGUF (block 42) - no separate --spec-draft-model needed.
 #
-# Tie-back: to restore the Qwen3.6-27B service, stop frank-large-ling and
+# Tie-back: to restore the Qwen3.6-27B service, stop frank-dragoon-ling and
 # start frank-default-large (its env/unit are committed and unchanged).
 #
 # Tunables come from frank-default-large.ling.env in this directory unless

old/scripts/serve-llama-frank-dragoon.sh

@@ -4,11 +4,11 @@
 # Runtime: llama.cpp llama-server (>= b10411).
 #
 # Tunables come from frank-default-large.env in this directory unless the
-# FRANK_LARGE_ENV_FILE environment variable overrides that path.
+# FRANK_DRAGOON_ENV_FILE environment variable overrides that path.
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-default-large.env}"
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-default-large.env}"
 if [[ -f "$ENV_FILE" ]]; then
     set -a
     # shellcheck disable=SC1090

prose_request.json

@@ -1 +1 @@
-{"model": "frank-large", "prompt": "# Subsurface Aquifer Monitoring Network - System Design Document (Revision 7)\n\nThis document describes the deployment of a subsurface aquifer monitoring network for the Cascadia sedimentary basin. It is written for the operations crew and the regional water authority. Every sensor node, relay, aggregation service, calibration procedure, and failure mode below carries a stable alphanumeric identifier that appears in every table and in the field notes.\n\n## Sensor nodes\nNode SN-000-08B9 sits in a discharge lens at 359.0 m below datum and reports a salinity of 2.38 ppt with the fractured interval reading 5.40 degC at dawn and the wellhead porous 1.72 m3/d while the electrode pair returns 3157 uS/cm.\nNode SN-001-0A65 sits in a percolate lens at 25.9 m below datum and steps down to a salinity of 2.13 ppt with the diapir interval reading 8.55 degC at dawn and the wellhead silty 0.67 m3/d while the electrode pair returns 979 uS/cm.\nNode SN-002-0571 sits in a diapir lens at 287.8 m below datum and peaks at a salinity of 7.63 ppt with the karst interval reading 4.26 degC at dawn and the wellhead spooned 11.50 m3/d while the electrode pair returns 2987 uS/cm.\nNode SN-003-0CE9 sits in a confining lens at 169.5 m below datum and logs a salinity of 0.96 ppt with the alluvial interval reading 5.03 degC at dawn and the wellhead salinized 12.08 m3/d while the electrode pair returns 2607 uS/cm.\nNode SN-004-0E2A sits in a freshened lens at 70.4 m below datum and settles near a salinity of 8.68 ppt with the spooned interval reading 4.88 degC at dawn and the wellhead siphon 4.38 m3/d while the electrode pair returns 2707 uS/cm.\nNode SN-005-0DDD sits in a percolate lens at 44.6 m below datum and reports a salinity of 6.25 ppt with the alluvial interval reading 10.85 degC at dawn and the wellhead brackish 13.99 m3/d while the electrode pair returns 3618 uS/cm.\nNode SN-006-0EFC sits in a till lens at 309.5 m below datum and reports a salinity of 3.49 ppt with the lacustrine interval reading 7.38 degC at dawn and the wellhead spooned 3.21 m3/d while the electrode pair returns 1253 uS/cm.\nNode SN-007-0B02 sits in a recharge lens at 262.0 m below datum and steps down to a salinity of 2.38 ppt with the discharge interval reading 8.18 degC at dawn and the wellhead perched 4.05 m3/d while the electrode pair returns 3900 uS/cm.\nNode SN-008-0448 sits in a karst lens at 406.5 m below datum and reports a salinity of 7.32 ppt with the upconing interval reading 6.17 degC at dawn and the wellhead fluvial 0.75 m3/d while the electrode pair returns 1448 uS/cm.\nNode SN-009-043C sits in a alluvial lens at 159.3 m below datum and flags a salinity of 6.20 ppt with the percolate interval reading 7.60 degC at dawn and the wellhead brackish 13.01 m3/d while the electrode pair returns 2025 uS/cm.\nNode SN-010-0FF5 sits in a karst lens at 264.2 m below datum and flags a salinity of 7.05 ppt with the freshened interval reading 7.88 degC at dawn and the wellhead siphon 8.41 m3/d while the electrode pair returns 1635 uS/cm.\nNode SN-011-098A sits in a drain lens at 365.7 m below datum and reports a salinity of 8.11 ppt with the wedge interval reading 5.51 degC at dawn and the wellhead glacial 2.52 m3/d while the electrode pair returns 2916 uS/cm.\nNode SN-012-0AE8 sits in a till lens at 259.6 m below datum and steps down to a salinity of 9.13 ppt with the recharge interval reading 11.60 degC at dawn and the wellhead spooned 0.46 m3/d while the electrode pair returns 3077 uS/cm.\nNode SN-013-0B83 sits in a salinized lens at 171.2 m below datum and peaks at a salinity of 2.83 ppt with the lacustrine interval reading 5.56 degC at dawn and the wellhead discharge 0.35 m3/d while the electrode pair returns 3083 uS/cm.\nNode SN-014-032E sits in a drain lens at 249.6 m below datum and flags a salinity of 1.09 ppt with the salinized interval reading 9.58 degC at dawn and the wellhead perched 12.00 m3/d while the electrode pair returns 2221 uS/cm.\nNode SN-015-004F sits in a aeolian lens at 264.4 m below datum and reports a salinity of 7.34 ppt with the salinized interval reading 8.76 degC at dawn and the wellhead perched 0.31 m3/d while the electrode pair returns 1483 uS/cm.\nNode SN-016-07C6 sits in a aeolian lens at 155.9 m below datum and reports a salinity of 0.64 ppt with the mineralized interval reading 11.75 degC at dawn and the wellhead diluted 13.46 m3/d while the electrode pair returns 524 uS/cm.\nNode SN-017-06C5 sits in a salinized lens at 72.1 m below datum and averages a salinity of 4.52 ppt with the siphon interval reading 8.93 degC at dawn and the wellhead confining 3.98 m3/d while the electrode pair returns 3687 uS/cm.\nNode SN-018-0E64 sits in a siphon lens at 334.9 m below datum and steps down to a salinity of 6.73 ppt with the salinized interval reading 7.63 degC at dawn and the wellhead freshened 9.64 m3/d while the electrode pair returns 1681 uS/cm.\nNode SN-019-0122 sits in a spooned lens at 1Line truncated
+{"model": "frank-dragoon", "prompt": "# Subsurface Aquifer Monitoring Network - System Design Document (Revision 7)\n\nThis document describes the deployment of a subsurface aquifer monitoring network for the Cascadia sedimentary basin. It is written for the operations crew and the regional water authority. Every sensor node, relay, aggregation service, calibration procedure, and failure mode below carries a stable alphanumeric identifier that appears in every table and in the field notes.\n\n## Sensor nodes\nNode SN-000-08B9 sits in a discharge lens at 359.0 m below datum and reports a salinity of 2.38 ppt with the fractured interval reading 5.40 degC at dawn and the wellhead porous 1.72 m3/d while the electrode pair returns 3157 uS/cm.\nNode SN-001-0A65 sits in a percolate lens at 25.9 m below datum and steps down to a salinity of 2.13 ppt with the diapir interval reading 8.55 degC at dawn and the wellhead silty 0.67 m3/d while the electrode pair returns 979 uS/cm.\nNode SN-002-0571 sits in a diapir lens at 287.8 m below datum and peaks at a salinity of 7.63 ppt with the karst interval reading 4.26 degC at dawn and the wellhead spooned 11.50 m3/d while the electrode pair returns 2987 uS/cm.\nNode SN-003-0CE9 sits in a confining lens at 169.5 m below datum and logs a salinity of 0.96 ppt with the alluvial interval reading 5.03 degC at dawn and the wellhead salinized 12.08 m3/d while the electrode pair returns 2607 uS/cm.\nNode SN-004-0E2A sits in a freshened lens at 70.4 m below datum and settles near a salinity of 8.68 ppt with the spooned interval reading 4.88 degC at dawn and the wellhead siphon 4.38 m3/d while the electrode pair returns 2707 uS/cm.\nNode SN-005-0DDD sits in a percolate lens at 44.6 m below datum and reports a salinity of 6.25 ppt with the alluvial interval reading 10.85 degC at dawn and the wellhead brackish 13.99 m3/d while the electrode pair returns 3618 uS/cm.\nNode SN-006-0EFC sits in a till lens at 309.5 m below datum and reports a salinity of 3.49 ppt with the lacustrine interval reading 7.38 degC at dawn and the wellhead spooned 3.21 m3/d while the electrode pair returns 1253 uS/cm.\nNode SN-007-0B02 sits in a recharge lens at 262.0 m below datum and steps down to a salinity of 2.38 ppt with the discharge interval reading 8.18 degC at dawn and the wellhead perched 4.05 m3/d while the electrode pair returns 3900 uS/cm.\nNode SN-008-0448 sits in a karst lens at 406.5 m below datum and reports a salinity of 7.32 ppt with the upconing interval reading 6.17 degC at dawn and the wellhead fluvial 0.75 m3/d while the electrode pair returns 1448 uS/cm.\nNode SN-009-043C sits in a alluvial lens at 159.3 m below datum and flags a salinity of 6.20 ppt with the percolate interval reading 7.60 degC at dawn and the wellhead brackish 13.01 m3/d while the electrode pair returns 2025 uS/cm.\nNode SN-010-0FF5 sits in a karst lens at 264.2 m below datum and flags a salinity of 7.05 ppt with the freshened interval reading 7.88 degC at dawn and the wellhead siphon 8.41 m3/d while the electrode pair returns 1635 uS/cm.\nNode SN-011-098A sits in a drain lens at 365.7 m below datum and reports a salinity of 8.11 ppt with the wedge interval reading 5.51 degC at dawn and the wellhead glacial 2.52 m3/d while the electrode pair returns 2916 uS/cm.\nNode SN-012-0AE8 sits in a till lens at 259.6 m below datum and steps down to a salinity of 9.13 ppt with the recharge interval reading 11.60 degC at dawn and the wellhead spooned 0.46 m3/d while the electrode pair returns 3077 uS/cm.\nNode SN-013-0B83 sits in a salinized lens at 171.2 m below datum and peaks at a salinity of 2.83 ppt with the lacustrine interval reading 5.56 degC at dawn and the wellhead discharge 0.35 m3/d while the electrode pair returns 3083 uS/cm.\nNode SN-014-032E sits in a drain lens at 249.6 m below datum and flags a salinity of 1.09 ppt with the salinized interval reading 9.58 degC at dawn and the wellhead perched 12.00 m3/d while the electrode pair returns 2221 uS/cm.\nNode SN-015-004F sits in a aeolian lens at 264.4 m below datum and reports a salinity of 7.34 ppt with the salinized interval reading 8.76 degC at dawn and the wellhead perched 0.31 m3/d while the electrode pair returns 1483 uS/cm.\nNode SN-016-07C6 sits in a aeolian lens at 155.9 m below datum and reports a salinity of 0.64 ppt with the mineralized interval reading 11.75 degC at dawn and the wellhead diluted 13.46 m3/d while the electrode pair returns 524 uS/cm.\nNode SN-017-06C5 sits in a salinized lens at 72.1 m below datum and averages a salinity of 4.52 ppt with the siphon interval reading 8.93 degC at dawn and the wellhead confining 3.98 m3/d while the electrode pair returns 3687 uS/cm.\nNode SN-018-0E64 sits in a siphon lens at 334.9 m below datum and steps down to a salinity of 6.73 ppt with the salinized interval reading 7.63 degC at dawn and the wellhead freshened 9.64 m3/d while the electrode pair returns 1681 uS/cm.\nNode SN-019-0122 sits in a spooned lens atLine truncated

scripts/.AGENTTRASH/bench-decode-threads-batch.py.strix-rocmfp4

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-Decode throughput benchmark for frank-large.
+Decode throughput benchmark for frank-dragoon.
 Starts the server with a given --threads-batch value, sends an 8K+ token prompt,
 generates 256 tokens, measures generation tok/s.
 
@@ -13,12 +13,12 @@ SERVE = "/home/dank/GitPackages/ROCmFPX/build-qwen38/bin/llama-server"
 PORT = 7770
 N_GEN = 256
 PROMPT_FILE = "/tmp/bench-prompts/prompt_code.txt"
-ENV_FILE = os.path.join(os.path.dirname(__file__), "frank-large.env")
+ENV_FILE = os.path.join(os.path.dirname(__file__), "frank-dragoon.env")
 SERVER_DIR = os.path.dirname(SERVE)
 ROCM_PATH = "/opt/rocm"
 
 def make_env():
-    """Build the same env as serve-frank-large.sh."""
+    """Build the same env as serve-frank-dragoon.sh."""
     env = {**os.environ, "HSA_OVERRIDE_GFX_VERSION": "11.5.1", "HIP_VISIBLE_DEVICES": "0"}
     
     # Source env file for tunables
@@ -59,7 +59,7 @@ def wait_ready():
 def send_request(prompt, max_tokens=N_GEN):
     """Send chat completion, measure generation throughput."""
     body = json.dumps({
-        "model": "frank-large",
+        "model": "frank-dragoon",
         "messages": [{"role": "user", "content": prompt}],
         "max_tokens": max_tokens,
         "stream": False,

scripts/.AGENTTRASH/bench-ngram-mod.py.ik-llama.cpp

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-Benchmark n-gram speculative decoding vs no-spec for frank-large.
+Benchmark n-gram speculative decoding vs no-spec for frank-dragoon.
 
 Tests prompt-processing throughput with 16K token prompts (manageable request size).
 Code-heavy prompt (high n-gram redundancy) vs prose prompt (low redundancy).
@@ -103,7 +103,7 @@ def start_server(port, spec_type):
 def run_test(prompt_text, spec_type, port):
     """Send a request and extract prompt processing metrics."""
     data = json.dumps({
-        "model": "frank-large",
+        "model": "frank-dragoon",
         "messages": [{"role": "user", "content": prompt_text}],
         "max_tokens": TEST_TOKENS,
         "stream": False,
@@ -189,7 +189,7 @@ def main():
         print(f"  Prose: {prose_prompt_file.stat().st_size:,} bytes")
 
     print("=" * 60)
-    print("  N-gram Mod Benchmark — frank-large")
+    print("  N-gram Mod Benchmark — frank-dragoon")
     print(f"  STRIX ROCmFP4 · 64K context · 16K prompts")
     print("=" * 60)
 

scripts/.AGENTTRASH/bench-ngram-mod.sh.ik-llama.cpp

@@ -1,19 +1,19 @@
 #!/usr/bin/env bash
-# Benchmark n-gram speculative decoding vs no-spec for frank-large.
+# Benchmark n-gram speculative decoding vs no-spec for frank-dragoon.
 #
 # This tests prompt-processing throughput at 64k context with two distinct
 # prompts: one code-heavy and one prose-heavy. Uses llama-server on scratch
 # ports with the OpenAI-compatible API to measure prompt_eval_duration_ms.
 #
 # Run on Dankclaw after stopping the production service:
-#   sudo systemctl stop frank-large
+#   sudo systemctl stop frank-dragoon
 #   ./scripts/bench-ngram-mod.sh
-#   sudo systemctl start frank-large
+#   sudo systemctl start frank-dragoon
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-large.env}"
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
 if [[ -f "$ENV_FILE" ]]; then
     set -a; source "$ENV_FILE"; set +a
 fi
@@ -184,7 +184,7 @@ run_single_test() {
     response=$(curl -s -X POST "http://127.0.0.1:$port/v1/completions" \
         -H "Content-Type: application/json" \
         -d "{
-            \"model\": \"frank-large\",
+            \"model\": \"frank-dragoon\",
             \"prompt\": \"$prompt_text\",
             \"max_tokens\": 128,
             \"temperature\": 0,
@@ -220,7 +220,7 @@ run_single_test() {
 }
 
 echo "╔══════════════════════════════════════════════════════════╗"
-echo "║  N-gram Mod Benchmark — frank-large             ║"
+echo "║  N-gram Mod Benchmark — frank-dragoon             ║"
 echo "║  STRIX ROCmFP4 · 64k context · two prompts             ║"
 echo "╚══════════════════════════════════════════════════════════╝"
 echo ""

scripts/.AGENTTRASH/bench-spec-decode.py.ik-llama.cpp

@@ -15,9 +15,9 @@ import time
 import urllib.request
 import urllib.error
 
-SERVICE = "frank-large"
-ENV_FILE = "/home/dank/serverAppConfigs/scripts/frank-large.env"
-ALIAS = "frank-large"
+SERVICE = "frank-dragoon"
+ENV_FILE = "/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
+ALIAS = "frank-dragoon"
 DEFAULT_HOST = "localhost"
 DEFAULT_PORT = 7770
 DEFAULT_MAX_TOKENS = 16384

scripts/.AGENTTRASH/frank-dragoon.env.ik-llama.cpp

@@ -1,4 +1,4 @@
-# Tunables for frank-large (mradermacher i1-Q4_K_M of
+# Tunables for frank-dragoon (mradermacher i1-Q4_K_M of
 # orcarouter/Qwen3.8-Flash-Next-Uncensored on ik_llama.cpp, Dankclaw,
 # RTX 3090 CUDA + Strix Halo CPU path, since 2026-09-15).
 #
@@ -65,7 +65,7 @@ MMPROJ_PATH=/home/dank/models/mradermacher-Qwen3.8-Flash-Next-Uncensored-i1-Q4_K
 CHAT_TEMPLATE_FILE=/home/dank/serverAppConfigs/scripts/chat-template.jinja
 
 # Alias + network.
-ALIAS=frank-large
+ALIAS=frank-dragoon
 BIND_ADDR=0.0.0.0
 LISTEN_PORT=7770
 

scripts/.AGENTTRASH/frank-dragoon.service.ik-llama.cpp

@@ -1,5 +1,5 @@
 [Unit]
-Description=ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M 177B MoE (dankclaw, frank-large)
+Description=ik_llama.cpp Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M 177B MoE (dankclaw, frank-dragoon)
 After=network-online.target
 Wants=network-online.target
 
@@ -12,8 +12,8 @@ Group=dank
 # budget still needs room. Parity with the halogen quadlet's
 # Ulimit=memlock=-1:-1.
 LimitMEMLOCK=infinity
-Environment="FRANK_LARGE_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-large.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-large.sh
+Environment="FRANK_DRAGOON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-dragoon.sh
 Restart=on-failure
 RestartSec=10
 

scripts/.AGENTTRASH/serve-frank-dragoon.sh.ik-llama.cpp

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Serve mradermacher/Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M as frank-large
+# Serve mradermacher/Qwen3.8-Flash-Next-Uncensored i1-Q4_K_M as frank-dragoon
 # via ik_llama.cpp on Dankclaw.
 #
 # Topology (ikawrakow's hybrid recipe; upstream issue #2402 for the PLE):
@@ -26,7 +26,7 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-large.env}"
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
 if [[ -f "$ENV_FILE" ]]; then
     set -a
     # shellcheck disable=SC1090
@@ -66,7 +66,7 @@ fi
 # CPU-overridden weights mmapped (src/llama-load-tensors.cpp); the env file
 # sets it. Refuse to run without it.
 if [[ "${GGML_CUDA_NO_PINNED_WEIGHTS:-}" != "1" ]]; then
-    echo "frank-large: refusing to start — GGML_CUDA_NO_PINNED_WEIGHTS=1 is mandatory on this host" >&2
+    echo "frank-dragoon: refusing to start — GGML_CUDA_NO_PINNED_WEIGHTS=1 is mandatory on this host" >&2
     exit 1
 fi
 

scripts/.AGENTTRASH/serve-frank-medium.sh.rocmfpx

@@ -112,7 +112,7 @@ fi
 : "${SPEC_DRAFT_POLL_BATCH:=1}"
 
 # Text only: the server must not try to autoload the vision tower.  Vision
-# stays on frank-large (Dankclaw), which is where the fleet routes images.
+# stays on frank-dragoon (Dankclaw), which is where the fleet routes images.
 NO_MMPROJ="${NO_MMPROJ:-1}"
 
 export HIP_VISIBLE_DEVICES

scripts/apply-protected-cast.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# apply-protected-cast.sh — RUNS ON DANKSERVER. Rewrite the recipe's
+# PROTECTED-BEGIN/END section from Swift's OWN calibration grams: run
+# derive-protected-experts.py over the calib dir, splice its cast lines into
+# the marked section of the recipe in place, keep the pre-edit recipe in the
+# campaign trash. Refuses to run twice (marker text says derived).
+set -euo pipefail
+CALIB=${1:-/home/dank/corpora/calib}
+RECIPE=${2:-/home/dank/serverAppConfigs-swift15/scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe}
+PY=/home/dank/venvs/radcorpus/bin/python
+DERIVE=/home/dank/serverAppConfigs-swift15/scripts/derive-protected-experts.py
+TS=$(date +%Y%m%d-%H%M%S)
+
+grep -q "derive-protected-experts.py rewrote" "$RECIPE" && {
+    echo "recipe already carries derived cast lines; refusing to re-derive" >&2; exit 1; }
+grep -q "PROTECTED-BEGIN" "$RECIPE" || { echo "no PROTECTED markers in $RECIPE" >&2; exit 1; }
+
+"$PY" "$DERIVE" "$CALIB" > "/tmp/protected-cast-$TS.txt"
+N=$(grep -c 'cast dtype=bf16' "/tmp/protected-cast-$TS.txt")
+[ "$N" -ge 2 ] || { echo "derive produced $N cast lines; refusing" >&2; exit 1; }
+echo "derived $N protected experts -> /tmp/protected-cast-$TS.txt"
+
+cp -f "$RECIPE" "/home/dank/.AGENTTRASH/$TS-qwen4exp-swift15-w4dn8-i8-hc8m.recipe"
+"$PY" - "$RECIPE" "/tmp/protected-cast-$TS.txt" <<'PYEOF'
+import sys
+recipe, castfile = sys.argv[1], sys.argv[2]
+lines = open(recipe).read().splitlines()
+cast = [l for l in open(castfile).read().splitlines() if 'cast dtype=bf16' in l]
+out, insec = [], False
+for l in lines:
+    if 'PROTECTED-BEGIN' in l:
+        insec = True
+        out.append(l)
+        out.extend(cast)
+    elif 'PROTECTED-END' in l:
+        insec = False
+        out.append(l)
+        out.append('# (derive-protected-experts.py rewrote this section from Swift\'s own grams)')
+    elif not insec:
+        out.append(l)
+open(recipe, 'w').write('\n'.join(out) + '\n')
+print(f'spliced {len(cast)} cast lines into {recipe}')
+PYEOF

scripts/autoresearch-bench.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""autoresearch-bench.py — deterministic greedy battery for frank-large.
+"""autoresearch-bench.py — deterministic greedy battery for frank-dragoon.
 
 Runs ON Dankclaw (no LAN jitter) against the candidate container on :7770.
 Fixed embedded corpus, temperature 0, streaming so decode speed is measured
@@ -104,7 +104,7 @@ def stream_completion(url: str, model: str, prompt: str):
 def main():
     ap = argparse.ArgumentParser()
     ap.add_argument("--url", default="http://127.0.0.1:7770")
-    ap.add_argument("--model", default="frank-large")
+    ap.add_argument("--model", default="frank-dragoon")
     args = ap.parse_args()
 
     with urllib.request.urlopen(args.url.rstrip("/") + "/v1/models",

scripts/autoresearch-frank-archon.sh

@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
-# autoresearch-frank-primary.sh — RUNS ON DANKSERVER, driven over ssh by the
-# dev-box autoresearch.sh. It is the canonical frank-primary benchmark entry
+# autoresearch-frank-archon.sh — RUNS ON DANKSERVER, driven over ssh by the
+# dev-box autoresearch.sh. It is the canonical frank-archon benchmark entry
 # point for the autoresearch loop.
 #
 # Method (mandated by the Benchmarking Policy): the production service serves
 # real users and shares the two R9700s, so a bench beside it starves the GPUs
 # and corrupts results. This script therefore:
-#   1. stops the production frank-primary unit (root, relink symlink: stop,
+#   1. stops the production frank-archon unit (root, relink symlink: stop,
 #      NOT mask — mask refuses to replace a symlinked unit file),
 #   2. boots a scratch radiance container named `arbench` on the SAME two
 #      cards with the candidate engine argv (the env file the loop edits),
@@ -18,7 +18,7 @@
 #      prefill and decode rates for that single request.
 #   5. prints METRIC lines and tears the scratch down,
 #   6. restores production (systemctl start), via a trap so a failed bench
-#      never leaves frank-primary down (the stale-probe-tail lesson).
+#      never leaves frank-archon down (the stale-probe-tail lesson).
 #
 # Determinism: the prompt is built from a fixed, sorted corpus of repo files
 # with a fixed random seed, so prompt_n is stable across runs. Sampling is
@@ -32,10 +32,10 @@
 # /dev/dri, the .rad ro, the state dir rw, the tune cache mount. The ONLY
 # differences: the container name (arbench, so prod's identity is untouched)
 # and a FRESH prefix-cache disk tier (arbench/, wiped per run) so the cold
-# prefill is cold — the prod tier at kvcache/frank-primary is left intact.
+# prefill is cold — the prod tier at kvcache/frank-archon is left intact.
 set -uo pipefail
 
-ENV_FILE="${1:-/home/dank/serverAppConfigs/scripts/frank-primary.env}"
+ENV_FILE="${1:-/home/dank/serverAppConfigs/scripts/frank-archon.env}"
 SCRATCH=arbench
 PORT=7770
 HEALTH="http://127.0.0.1:$PORT/health"
@@ -45,7 +45,7 @@ LOG=/home/dank/logs/arbench.log
 
 restore() {
   podman rm -f "$SCRATCH" >/dev/null 2>&1 || true
-  sudo systemctl start frank-primary >/dev/null 2>&1 || true
+  sudo systemctl start frank-archon >/dev/null 2>&1 || true
 }
 trap restore EXIT
 
@@ -57,13 +57,13 @@ fi
 set -a; . "$ENV_FILE"; set +a
 
 # --- stop production; the scratch needs both cards to itself ----------------
-sudo systemctl stop frank-primary >/dev/null 2>&1 || true
+sudo systemctl stop frank-archon >/dev/null 2>&1 || true
 podman rm -f "$SCRATCH" >/dev/null 2>&1 || true
 
 # --- fresh prefix-cache tier for a cold prefill (prod's tier untouched) ------
-FRESH_KV="$FRANK_PRIMARY_STATE_DIR/kvcache/$SCRATCH"
+FRESH_KV="$FRANK_ARCHON_STATE_DIR/kvcache/$SCRATCH"
 rm -rf "$FRESH_KV"; mkdir -p "$FRESH_KV"
-mkdir -p "$FRANK_PRIMARY_STATE_DIR/tune"
+mkdir -p "$FRANK_ARCHON_STATE_DIR/tune"
 
 # --- boot the scratch: the production run line, scratch name + fresh KV ------
 podman run -d --name "$SCRATCH" \
@@ -72,30 +72,31 @@ podman run -d --name "$SCRATCH" \
   --security-opt seccomp=unconfined \
   --ulimit memlock=-1:-1 \
   --device /dev/kfd --device /dev/dri \
-  -v "$FRANK_PRIMARY_MODEL_DIR":/models:ro \
-  -v "$FRANK_PRIMARY_STATE_DIR":/data \
-  -v "$FRANK_PRIMARY_STATE_DIR/tune":/opt/radiance/share/radiance/tune \
-  -v "$FRANK_PRIMARY_TEMPLATE":/templates/template.jinja:ro \
-  "$FRANK_PRIMARY_IMAGE" \
-  --model "/models/$FRANK_PRIMARY_MODEL_FILE" \
+  -v "$FRANK_ARCHON_MODEL_DIR":/models:ro \
+  -v "$FRANK_ARCHON_STATE_DIR":/data \
+  -v "$FRANK_ARCHON_STATE_DIR/tune":/opt/radiance/share/radiance/tune \
+  -v "$FRANK_ARCHON_TEMPLATE":/templates/template.jinja:ro \
+  "$FRANK_ARCHON_IMAGE" \
+  --model "/models/$FRANK_ARCHON_MODEL_FILE" \
   --host :: --port "$PORT" \
-  --served-model-name "$FRANK_PRIMARY_SERVED_NAME" \
+  --served-model-name "$FRANK_ARCHON_SERVED_NAME" \
   --override-chat-template /templates/template.jinja \
-  --tp "$FRANK_PRIMARY_TP" --tp-wire "$FRANK_PRIMARY_TP_WIRE" \
-  --max-num-seqs "$FRANK_PRIMARY_MAX_SEQS" \
-  --max-model-len "$FRANK_PRIMARY_MAX_MODEL_LEN" \
-  --placement "$FRANK_PRIMARY_PLACEMENT" \
-  --host-pool-mib "$FRANK_PRIMARY_HOST_POOL_MIB" \
-  --gpu-headroom-mib "$FRANK_PRIMARY_GPU_HEADROOM_MIB" \
-  --expert-vs-cache-ratio "$FRANK_PRIMARY_EXPERT_VS_CACHE" \
-  --kv-cache-dtype "$FRANK_PRIMARY_KV_DTYPE" \
-  --prefix-cache-host-mib "$FRANK_PRIMARY_PREFIX_HOST_MIB" \
+  --tp "$FRANK_ARCHON_TP" --tp-wire "$FRANK_ARCHON_TP_WIRE" \
+  --max-num-seqs "$FRANK_ARCHON_MAX_SEQS" \
+  --max-model-len "$FRANK_ARCHON_MAX_MODEL_LEN" \
+  --placement "$FRANK_ARCHON_PLACEMENT" \
+  --host-pool-mib "$FRANK_ARCHON_HOST_POOL_MIB" \
+  --gpu-headroom-mib "$FRANK_ARCHON_GPU_HEADROOM_MIB" \
+  --vram-weights-mib "$FRANK_ARCHON_VRAM_WEIGHTS_MIB" \
+  --vram-kv-mib "$FRANK_ARCHON_VRAM_KV_MIB" \
+  --kv-cache-dtype "$FRANK_ARCHON_KV_DTYPE" \
+  --prefix-cache-host-mib "$FRANK_ARCHON_PREFIX_HOST_MIB" \
   --prefix-cache-dir "/data/kvcache/$SCRATCH" \
-  --prefix-cache-disk-mib "$FRANK_PRIMARY_PREFIX_DISK_MIB" \
-  --ngram-placement "$FRANK_PRIMARY_NGRAM_PLACEMENT" \
-  --num-speculative-tokens "$FRANK_PRIMARY_SPEC_TOKENS" \
-  --max-num-batched-tokens "$FRANK_PRIMARY_MAX_BATCHED_TOKENS" \
-  ${FRANK_PRIMARY_EXTRA_ARGS:+$FRANK_PRIMARY_EXTRA_ARGS} \
+  --prefix-cache-disk-mib "$FRANK_ARCHON_PREFIX_DISK_MIB" \
+  --ngram-placement "$FRANK_ARCHON_NGRAM_PLACEMENT" \
+  --num-speculative-tokens "$FRANK_ARCHON_SPEC_TOKENS" \
+  --max-num-batched-tokens "$FRANK_ARCHON_MAX_BATCHED_TOKENS" \
+  ${FRANK_ARCHON_EXTRA_ARGS:+$FRANK_ARCHON_EXTRA_ARGS} \
   > "$LOG" 2>&1
 if [ $? -ne 0 ]; then echo "scratch boot failed; see $LOG" >&2; exit 1; fi
 
@@ -145,7 +146,7 @@ while n < TGT:
     n += len(seg) + 1
 prompt = " ".join(parts)
 json.dump(
-    {"model": "frank-primary", "prompt": prompt,
+    {"model": "frank-archon", "prompt": prompt,
      "max_tokens": 256, "temperature": 0.0, "stream": False,
      "stop": ["<|im_end|>"]},
     open(sys.argv[1], "w"),

scripts/autoresearch/frank-archon-arms.sh

@@ -1,19 +1,19 @@
 #!/usr/bin/env bash
-# frank-primary-arms.sh — run a SEQUENCE of frank-primary bench arms and keep
+# frank-archon-arms.sh — run a SEQUENCE of frank-archon bench arms and keep
 # every arm's evidence. Runs on the operator box; each arm is one full window
 # of ./autoresearch.sh (stop+mask -> boot the arm as the service -> measure ->
 # restore production and verify), so the fleet is only ever down for one arm at
 # a time and the production unit is back up between arms.
 #
-# An arm is the repo's own frank-primary.env plus an OVERLAY of engine knobs
+# An arm is the repo's own frank-archon.env plus an OVERLAY of engine knobs
 # appended after it (later assignment wins when the serve script sources it),
-# staged through FRANK_PRIMARY_AR_ENV_FILE so the checkout is never mutated and
+# staged through FRANK_ARCHON_AR_ENV_FILE so the checkout is never mutated and
 # each arm gets its own fingerprint (the memo can never answer one arm with
 # another arm's numbers).
 #
-# Usage:  scripts/autoresearch/frank-primary-arms.sh [arm ...]
-#         scripts/autoresearch/frank-primary-arms.sh --list
-# Output, under /tmp/frank-primary-arms-<UTC stamp>/ (override with ARMS_DIR):
+# Usage:  scripts/autoresearch/frank-archon-arms.sh [arm ...]
+#         scripts/autoresearch/frank-archon-arms.sh --list
+# Output, under /tmp/frank-archon-arms-<UTC stamp>/ (override with ARMS_DIR):
 #
 #   <arm>.out        full autoresearch output (metrics + engine evidence)
 #   <arm>.env        the exact staged env
@@ -26,8 +26,8 @@ set -uo pipefail
 
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 REPO="$(cd -- "$SCRIPT_DIR/../.." && pwd)"
-BASE_ENV="$REPO/scripts/frank-primary.env"
-ARMS_DIR="${ARMS_DIR:-/tmp/frank-primary-arms-$(date -u +%Y%m%dT%H%M%SZ)}"
+BASE_ENV="$REPO/scripts/frank-archon.env"
+ARMS_DIR="${ARMS_DIR:-/tmp/frank-archon-arms-$(date -u +%Y%m%dT%H%M%SZ)}"
 
 # --- arms ------------------------------------------------------------------
 # baseline: the shipped shape E, measured with THIS harness so the comparison is
@@ -45,18 +45,18 @@ LADDER3='{"cudagraph_capture_sizes":[4,8,12],"max_cudagraph_capture_size":12,"in
 # the engine as {temperature:0.7}.
 GEN07='{"temperature":0.7}'
 OVER_B=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER3'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER3'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
 )
 # B2: identical to B with the default (7.60 GiB) overhead, i.e. precise memory
 # OFF. It is the fallback if B dies at graph capture, and it prices the arena
 # that precise memory buys (7,522 slots -> ~6,496).
 OVER_B2=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER3'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
-    'FRANK_PRIMARY_PRECISE_MEMORY='
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER3'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
+    'FRANK_ARCHON_PRECISE_MEMORY='
 )
 # C: the vendor's concurrency shape — SEQS 16 with the [4..32] ladder and util
 # 0.95. This is also the direct test of the theory that pinning the capture
@@ -64,12 +64,12 @@ OVER_B2=(
 # the constant 3, which is NOT in the default ladder; 4 is).
 LADDER16='{"cudagraph_capture_sizes":[4,8,12,16,20,24,28,32],"max_cudagraph_capture_size":32,"inductor_compile_config":{"combo_kernels":false,"benchmark_combo_kernel":false}}'
 OVER_C=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER16'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
-    'FRANK_PRIMARY_SEQS=16'
-    'FRANK_PRIMARY_MNBT=4096'
-    'FRANK_PRIMARY_UTIL=0.95'
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER16'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
+    'FRANK_ARCHON_SEQS=16'
+    'FRANK_ARCHON_MNBT=4096'
+    'FRANK_ARCHON_UTIL=0.95'
 )
 
 # D/E: the CONTEXT arms. Measured 2026-10-02 (arms run 20261002T233855Z): the
@@ -83,11 +83,11 @@ OVER_C=(
 # D is arm B with EXACTLY ONE variable changed (the KV bytes), so its result
 # says whether the 4k-depth collapse (B 23.09 vs baseline 33.99) was KV or the
 # batch shape.
-KV401K='FRANK_PRIMARY_KV_BYTES=4050000000'
+KV401K='FRANK_ARCHON_KV_BYTES=4050000000'
 OVER_D=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER3'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER3'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
     "$KV401K"
 )
 # E: D with C's max_num_batched_tokens (4096 — C is the only arm that did NOT
@@ -97,12 +97,12 @@ OVER_D=(
 # only 0.32 GiB above the allowance while the CUDA-graph cost is an ANALYTIC
 # estimate (C's was 1.47 GiB over 24 graphs), so it is measured, not assumed.
 OVER_E=(
-    "FRANK_PRIMARY_SPEC='$SPEC3'"
-    "FRANK_PRIMARY_COMPCONFIG='$LADDER3'"
-    'FRANK_PRIMARY_GEN_CONFIG='"'$GEN07'"
+    "FRANK_ARCHON_SPEC='$SPEC3'"
+    "FRANK_ARCHON_COMPCONFIG='$LADDER3'"
+    'FRANK_ARCHON_GEN_CONFIG='"'$GEN07'"
     "$KV401K"
-    'FRANK_PRIMARY_MNBT=4096'
-    'FRANK_PRIMARY_UTIL=0.99'
+    'FRANK_ARCHON_MNBT=4096'
+    'FRANK_ARCHON_UTIL=0.99'
 )
 
 arm_overlay() {
@@ -142,7 +142,7 @@ for arm in "${ARMS[@]}"; do
     # holds JSON must still be one valid JSON object after the file is SOURCED
     # (that is the step that silently eats unquoted braces).
     if ! bash -c 'set -a; . "$1" >/dev/null; set +a
-        for k in FRANK_PRIMARY_SPEC FRANK_PRIMARY_COMPCONFIG FRANK_PRIMARY_GEN_CONFIG; do
+        for k in FRANK_ARCHON_SPEC FRANK_ARCHON_COMPCONFIG FRANK_ARCHON_GEN_CONFIG; do
             v="${!k:-}"
             [ -n "$v" ] || continue
             case "$v" in
@@ -158,7 +158,7 @@ for arm in "${ARMS[@]}"; do
     fi
 
     echo "[arms] === $arm: opening window $(date -u +%H:%M:%S)Z ===" >&2
-    FRANK_PRIMARY_AR_ENV_FILE="$ARMS_DIR/$arm.env" \
+    FRANK_ARCHON_AR_ENV_FILE="$ARMS_DIR/$arm.env" \
         "$REPO/autoresearch.sh" >"$ARMS_DIR/$arm.out" 2>&1
     rc=$?
     echo "$rc" >"$ARMS_DIR/$arm.rc"

scripts/autoresearch/frank-archon-measure.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""frank-primary decode measurement — runs INSIDE the engine container.
+"""frank-archon decode measurement — runs INSIDE the engine container.
 
 The method is the fleet's established one (the 2026-09-29 / 2026-10-01
 tuning campaigns, /home/dank/mtp_measure.py): SSE chunk counting is invalid
@@ -28,7 +28,7 @@ Workload (fixed, deterministic, offline):
 
 Env:
   AR_BASE             endpoint (default http://127.0.0.1:7770)
-  AR_MODEL            served name (default frank-primary)
+  AR_MODEL            served name (default frank-archon)
   AR_PROMPT_CEILING   hard prompt ceiling in tokens (default 100000)
   AR_TEMPS            comma-separated sampling temperatures (default "0,0.7")
 
@@ -45,7 +45,7 @@ import urllib.error
 import urllib.request
 
 BASE = os.environ.get("AR_BASE", "http://127.0.0.1:7770")
-MODEL = os.environ.get("AR_MODEL", "frank-primary")
+MODEL = os.environ.get("AR_MODEL", "frank-archon")
 PROMPT_CEILING = int(os.environ.get("AR_PROMPT_CEILING", "100000"))
 DEPTHS = (115, 1056, 4096)
 WARM_TOKENS = 64

scripts/autoresearch/frank-archon-window.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# frank-primary-window.sh — one full bench window for frank-primary, run ON
+# frank-archon-window.sh — one full bench window for frank-archon, run ON
 # DANKSERVER as the deploy user (invoked over ssh by ./autoresearch.sh).
 #
 # Discipline (AGENTS.md Benchmarking Policy): the production unit is
@@ -12,9 +12,9 @@
 #
 # Staging layout (created by the orchestrator, ephemeral — never a config
 # source; the repo checkout is):
-#   /home/dank/.autoresearch-frank-primary/
+#   /home/dank/.autoresearch-frank-archon/
 #     serve.sh             staged candidate serve script
-#     frank-primary.env    staged candidate env (the candidate knobs)
+#     frank-archon.env    staged candidate env (the candidate knobs)
 #     measure.py           the in-container measure client
 #     hash                 candidate fingerprint
 #     run.json             result (metrics + boot + kv + fingerprint)
@@ -27,16 +27,16 @@
 # outcome; a failed restore forces exit 1).
 set -uo pipefail
 
-STAGE="${FRANK_PRIMARY_AR_STAGE:-/home/dank/.autoresearch-frank-primary}"
-UNIT="${FRANK_PRIMARY_AR_UNIT:-frank-primary}"
-CTR="${FRANK_PRIMARY_AR_CTR:-frank-primary-qwen}"
+STAGE="${FRANK_ARCHON_AR_STAGE:-/home/dank/.autoresearch-frank-archon}"
+UNIT="${FRANK_ARCHON_AR_UNIT:-frank-archon}"
+CTR="${FRANK_ARCHON_AR_CTR:-frank-archon-qwen}"
 HEALTH_URL="http://127.0.0.1:7770/health"
 MODELS_URL="http://127.0.0.1:7770/v1/models"
-BOOT_TIMEOUT="${FRANK_PRIMARY_AR_BOOT_TIMEOUT:-1200}"
-RESTORE_TIMEOUT="${FRANK_PRIMARY_AR_RESTORE_TIMEOUT:-1200}"
-MEASURE_TIMEOUT="${FRANK_PRIMARY_AR_MEASURE_TIMEOUT:-1800}"
-SERVED="$(sed -n 's/^FRANK_PRIMARY_SERVED_NAME=//p' "$STAGE/frank-primary.env" 2>/dev/null | head -1)"
-SERVED="${SERVED:-frank-primary}"
+BOOT_TIMEOUT="${FRANK_ARCHON_AR_BOOT_TIMEOUT:-1200}"
+RESTORE_TIMEOUT="${FRANK_ARCHON_AR_RESTORE_TIMEOUT:-1200}"
+MEASURE_TIMEOUT="${FRANK_ARCHON_AR_MEASURE_TIMEOUT:-1800}"
+SERVED="$(sed -n 's/^FRANK_ARCHON_SERVED_NAME=//p' "$STAGE/frank-archon.env" 2>/dev/null | head -1)"
+SERVED="${SERVED:-frank-archon}"
 
 RESTORED=0
 
@@ -72,7 +72,7 @@ capture_bench_failure() {
         echo "=== staged serve.out (tail 60) ==="
         tail -60 "$STAGE/serve.out" 2>/dev/null || true
         echo "=== engine log (tail 60) ==="
-        tail -60 /home/dank/logs/frank_primary.log 2>/dev/null || true
+        tail -60 /home/dank/logs/frank_archon.log 2>/dev/null || true
     } >"$STAGE/fail.log" 2>&1 || true
     grep -E 'OutOfMemory|Tried to allocate|Engine core initialization failed|Error|error' \
         "$STAGE/fail.log" 2>/dev/null | tail -25 >&2 || true
@@ -114,7 +114,7 @@ trap 'restore; rc=$?; [ "$rc" -ne 0 ] && exit 1' EXIT
 
 main() {
     local f
-    for f in serve.sh frank-primary.env measure.py hash; do
+    for f in serve.sh frank-archon.env measure.py hash; do
         [ -f "$STAGE/$f" ] || { log "staged file missing: $STAGE/$f"; exit 1; }
     done
     mkdir -p "$STAGE/last"
@@ -133,7 +133,7 @@ main() {
 
     t0="$(date +%s)"
     log "starting bench instance from staged config (fingerprint $(tr -d '[:space:]' <"$STAGE/hash"))"
-    FRANK_PRIMARY_ENV_FILE="$STAGE/frank-primary.env" \
+    FRANK_ARCHON_ENV_FILE="$STAGE/frank-archon.env" \
         setsid nohup bash "$STAGE/serve.sh" >"$STAGE/serve.out" 2>&1 </dev/null &
     echo "$!" >"$STAGE/serve.pid"
 

scripts/bench-decode.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Decode throughput benchmark for frank-large.
+# Decode throughput benchmark for frank-dragoon.
 # Measures generation tok/s with 8K+ token prompts and 256 generated tokens.
 set -euo pipefail
 
@@ -57,7 +57,7 @@ run_bench() {
     # Warmup (small request)
     curl -s -m 60 http://127.0.0.1:$PORT/v1/chat/completions \
         -H "Content-Type: application/json" \
-        -d '{"model":"frank-large","messages":[{"role":"user","content":"Hi"}],"max_tokens":16,"stream":false}' > /dev/null 2>&1 || true
+        -d '{"model":"frank-dragoon","messages":[{"role":"user","content":"Hi"}],"max_tokens":16,"stream":false}' > /dev/null 2>&1 || true
     
     # Build 8K prompt
     local prompt
@@ -75,7 +75,7 @@ print(json.dumps(' '.join(words)))
     t0=$(date +%s%N)
     resp=$(curl -s -m 600 http://127.0.0.1:$PORT/v1/chat/completions \
         -H "Content-Type: application/json" \
-        -d "{\"model\":\"frank-large\",\"messages\":[{\"role\":\"user\",\"content\":$prompt}],\"max_tokens\":$N_GEN,\"stream\":false}" 2>&1)
+        -d "{\"model\":\"frank-dragoon\",\"messages\":[{\"role\":\"user\",\"content\":$prompt}],\"max_tokens\":$N_GEN,\"stream\":false}" 2>&1)
     t1=$(date +%s%N)
     
     if ! echo "$resp" | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then

scripts/bench-probe.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""bench-probe.py — RUNS ON DANKSERVER. The campaign's decode probe: one
+/completion request, a prompt assembled from calib.jsonl to ~TARGET tokens,
+temperature 0, max_tokens 512. Reports the engine's own timings: decode rate,
+prefill rate, draft accept. Run 3x; the median is the arm's number."""
+import json, sys, urllib.request
+
+TARGET = 43600  # tokens
+BYTES_PER_TOK = 3.8
+URL = "http://localhost:7770/v1/completions"
+
+def build_prompt():
+    want = int(TARGET * BYTES_PER_TOK)
+    parts = []
+    n = 0
+    with open("/home/dank/corpora/out/calib.jsonl") as f:
+        for line in f:
+            d = json.loads(line)
+            p = d.get("prompt") or d.get("messages", [{}])[0].get("content", "")
+            parts.append(p)
+            n += len(p.encode())
+            if n >= want:
+                break
+    return "".join(parts)
+
+def probe(salt):
+    prompt = f"[probe {salt}]\n" + build_prompt()
+    body = json.dumps({
+        "model": "frank-archon",
+        "prompt": prompt, "temperature": 0.0, "max_tokens": 512,
+    }).encode()
+    req = urllib.request.Request(URL, data=body,
+        headers={"Content-Type": "application/json"})
+    with urllib.request.urlopen(req, timeout=1800) as r:
+        d = json.load(r)
+    t = d.get("timings", {})
+    return {
+        "prompt_n": t.get("prompt_n"),
+        "prefill_tps": round(t.get("prompt_per_second", 0), 1),
+        "pred_n": t.get("predicted_n"),
+        "decode_tps": round(t.get("predicted_per_second", 0), 2),
+        "draft_n": t.get("draft_n"),
+        "accept": (round(t["draft_n_accepted"] / t["draft_n"], 4)
+                   if t.get("draft_n") else None),
+    }
+
+if __name__ == "__main__":
+    print(json.dumps(probe(sys.argv[1] if len(sys.argv) > 1 else "a")))

scripts/bench-threads-batch-http.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-HTTP-based prefill-throughput sweep for frank-large.
+HTTP-based prefill-throughput sweep for frank-dragoon.
 Starts the server with a given --threads-batch value, sends a 64K-prompt via
 the chat API (max_tokens=0), measures prompt_tokens/wall_time.
 
@@ -39,7 +39,7 @@ def send_prefill_request():
     with open(PROMPT_FILE, "r") as f:
         prompt = f.read()
     body = json.dumps({
-        "model": "frank-large",
+        "model": "frank-dragoon",
         "messages": [{"role": "user", "content": prompt}],
         "max_tokens": 1,
         "stream": False

scripts/bench-threads-batch.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Threads-batch sweep for frank-large on dankclaw
+# Threads-batch sweep for frank-dragoon on dankclaw
 # Benches prefill throughput at 65536 prompt tokens across threads-batch values.
 set -uo pipefail
 
@@ -10,7 +10,7 @@ TB_LIST=(16 32 48 64 80 96 128)
 ENV_FILE="/home/dank/GitPackages/ROCmFPX/build-qwen38/bin"
 
 echo "========================================"
-echo "THREADS-BATCH SWEEP — frank-large"
+echo "THREADS-BATCH SWEEP — frank-dragoon"
 echo "Model: $(basename "$MODEL") ($(du -h "$MODEL" | cut -f1))"
 echo "Threads-batch values: ${TB_LIST[*]}"
 echo "Prompt: 65536 tokens, n-gen: 0 (prefill-only)"

scripts/bench-ubatch.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# Benchmark ubatch with llama-bench for frank-large.
+# Benchmark ubatch with llama-bench for frank-dragoon.
 #
 # This is intentionally a ubatch-only benchmark. It uses one llama-bench
 # process, an 8K prompt workload, and equal batch/ubatch values. No server
 # process, HTTP requests, or log scraping are used.
 #
-# Run on Dankclaw after stopping frank-large:
-#   sudo systemctl stop frank-large
+# Run on Dankclaw after stopping frank-dragoon:
+#   sudo systemctl stop frank-dragoon
 #   ./scripts/bench-ubatch.sh
-#   sudo systemctl start frank-large
+#   sudo systemctl start frank-dragoon
 set -euo pipefail
 
 : "${LLAMA_BENCH:=/home/dank/GitPackages/ROCmFPX/build-strix-rocmfp4/bin/llama-bench}"

scripts/build-frank-archon-rad.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
-# build-frank-primary-rad.sh — build frank-primary's .rad container from the
+# build-frank-archon-rad.sh — build frank-archon's .rad container from the
 # OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 checkpoint, at NATIVE precision.
 #
-#   bash scripts/build-frank-primary-rad.sh                # convert
-#   bash scripts/build-frank-primary-rad.sh --plan-only    # declare, no I/O
-#   bash scripts/build-frank-primary-rad.sh --restage      # redo staging
-#   bash scripts/build-frank-primary-rad.sh --force        # rebuild existing
+#   bash scripts/build-frank-archon-rad.sh                # convert
+#   bash scripts/build-frank-archon-rad.sh --plan-only    # declare, no I/O
+#   bash scripts/build-frank-archon-rad.sh --restage      # redo staging
+#   bash scripts/build-frank-archon-rad.sh --force        # rebuild existing
 #
 # WHY A STAGING DIR (the one non-obvious step): rad-convert selects its
 # architecture plugin by the checkpoint's quantisation DESCRIPTOR —
@@ -55,8 +55,8 @@ OUT="$OUT_DIR/qwen4exp-fp8-native.rad"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/frank-primary.env"
-IMAGE="$FRANK_PRIMARY_IMAGE"
+source "$SCRIPT_DIR/frank-archon.env"
+IMAGE="$FRANK_ARCHON_IMAGE"
 
 plan_only=0 restage=0 force=0
 for a in "$@"; do
@@ -69,11 +69,11 @@ for a in "$@"; do
 done
 
 if [ ! -f "$SRC/config.json" ]; then
-    echo "ERROR: raw checkpoint missing: $SRC (run scripts/download-frank-primary.sh --fetch)" >&2
+    echo "ERROR: raw checkpoint missing: $SRC (run scripts/download-frank-archon.sh --fetch)" >&2
     exit 1
 fi
 echo "verifying raw checkpoint first..."
-bash "$SCRIPT_DIR/download-frank-primary.sh"
+bash "$SCRIPT_DIR/download-frank-archon.sh"
 
 if [ -f "$OUT" ] && [ "$plan_only" -eq 0 ] && [ "$force" -eq 0 ]; then
     echo "container already exists: $OUT"
@@ -83,7 +83,7 @@ fi
 
 # ---- staging ----------------------------------------------------------------
 if [ "$restage" -eq 1 ] && [ -e "$STAGE" ]; then
-    TRASH="$HOME/.AGENTTRASH/$(date +%Y%m%d)-frank-primary-stage"
+    TRASH="$HOME/.AGENTTRASH/$(date +%Y%m%d)-frank-archon-stage"
     mkdir -p "$TRASH"
     mv "$STAGE" "$TRASH/stage-$(date +%H%M%S)"
     echo "old staging dir moved to $TRASH"
@@ -138,7 +138,7 @@ CONVERT_ARGS=(/models/stage-qwen4exp-fp8 -o /models/rad/qwen4exp-fp8-native.rad
 # exactly and the plugin's one-element scale plane is produced.
 CONVERT_ARGS+=(--quant "blk.*.ple_ngram.weight=rtn:codes=fp8_e4m3,block=*x*,scale=bf16,rule=fixed,scale_value=$PLE_SCALE")
 [ "$force" -eq 1 ] && [ -f "$OUT" ] && {
-    TRASH="$HOME/.AGENTTRASH/$(date +%Y%m%d)-frank-primary-rad"
+    TRASH="$HOME/.AGENTTRASH/$(date +%Y%m%d)-frank-archon-rad"
     mkdir -p "$TRASH"
     mv "$OUT" "$TRASH/qwen4exp-fp8-native.rad.$(date +%H%M%S)"
     echo "previous container moved to $TRASH"
@@ -158,8 +158,8 @@ echo "rad-info summary:"
 podman run --rm --entrypoint rad-info -v /home/dank/models:/models:ro \
     "$IMAGE" "/models/rad/qwen4exp-fp8-native.rad" | head -20
 MIB=$(( $(stat -c %s "$OUT") / 1048576 ))
-echo "container: $OUT (${MIB} MiB; env floor $FRANK_PRIMARY_RAD_MIN_MIB MiB)"
-if [ "$MIB" -lt "$FRANK_PRIMARY_RAD_MIN_MIB" ]; then
+echo "container: $OUT (${MIB} MiB; env floor $FRANK_ARCHON_RAD_MIN_MIB MiB)"
+if [ "$MIB" -lt "$FRANK_ARCHON_RAD_MIN_MIB" ]; then
     echo "ERROR: container below the env floor — the convert was truncated" >&2
     exit 1
 fi

scripts/build-gufo.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Build the gufo runtime that serves frank-large on Dankclaw.
+# Build the gufo runtime that serves frank-dragoon on Dankclaw.
 #
 #   bash scripts/build-gufo.sh              # build + install the pinned tag
 #   bash scripts/build-gufo.sh --verify     # only check the installed tree
@@ -93,4 +93,4 @@ cmake --install build/release
 
 echo "== verify =="
 "$PREFIX/bin/gufo" diagnose
-echo "frank-large runtime ready: $PREFIX/bin/gufo ($GUFO_TAG @ $commit)"
+echo "frank-dragoon runtime ready: $PREFIX/bin/gufo ($GUFO_TAG @ $commit)"

scripts/build-rocmfpx.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
-# Build the ROCmFPX runtime that serves frank-large on Dankclaw.
+# Build the ROCmFPX runtime that serves frank-dragoon on Dankclaw.
 #
 #   bash scripts/build-rocmfpx.sh              # clone/fetch + build the pin
 #   bash scripts/build-rocmfpx.sh --verify     # only check the installed tree
 #
 # Runtime: kingjones30/ROCmFPX — charlie12345/ROCmFPX plus the model-card
-# patches, i.e. the fork that owns the ROCmFPx tensor formats. frank-large's
+# patches, i.e. the fork that owns the ROCmFPx tensor formats. frank-dragoon's
 # payload is ftype 115 (`Q8_0_ROCMFPX_AGENT`): 311 tensors of
 # GGML_TYPE_Q8_0_ROCMFPX (103), a type that exists ONLY in this fork, so
 # stock llama.cpp, gufo and every other loader on the host reject the file.
@@ -30,7 +30,7 @@
 set -euo pipefail
 
 ROCMFPX_REPO="${ROCMFPX_REPO:-https://github.com/kingjones30/ROCmFPX.git}"
-# The commit frank-large was qualified with (measured 2026-10-02).
+# The commit frank-dragoon was qualified with (measured 2026-10-02).
 ROCMFPX_COMMIT="${ROCMFPX_COMMIT:-36e9acd40e10a87cd3c3ef8ec734668757dc8520}"
 SRC_DIR="${ROCMFPX_SRC_DIR:-/home/dank/GitPackages/kingjones-ROCmFPX}"
 BUILD_DIR="${ROCMFPX_BUILD_DIR:-$SRC_DIR/build}"
@@ -86,4 +86,4 @@ cmake --build "$BUILD_DIR" --target llama-server llama-quantize -j "$JOBS"
 
 echo "== verify =="
 "$BUILD_DIR/bin/llama-server" --version | head -1
-echo "frank-large runtime ready: $BUILD_DIR/bin/llama-server ($ROCMFPX_COMMIT)"
+echo "frank-dragoon runtime ready: $BUILD_DIR/bin/llama-server ($ROCMFPX_COMMIT)"

scripts/calib-push.py

@@ -0,0 +1,110 @@
+#!/usr/bin/env python3
+"""calib-push.py — drive a calibration corpus through a radiance scratch
+server's prefill so its tap writes layer Hessians (docs/MOE-W4.md).
+
+Runs ON DANKSERVER next to the scratch server (the one autoresearch- /
+serve-style scratch container booted with RADIANCE_CALIB_DIR set).
+Reads the corpus JSONL produced by make-calib-corpus.py
+({"prompt": "..."} a line), POSTs each prompt to /v1/completions with
+max_tokens=1 (prefill-only cost, one token out), at N-way concurrency
+matching the scratch server's --max-num-seqs budget.
+
+Corpus rounds repeat until the engine prints the tap's completion line
+("calibration wrote layer Hessians") in `podman logs <container>` — that
+is the ground truth that RADIANCE_CALIB_TOKENS was reached. After that
+line, further prompts are pure waste, so the driver exits.
+
+Mechanics notes:
+- requests carry no sampling params that matter (max_tokens=1, greedy).
+- a per-request timeout of 30 min: at ~1k tok/s prefill a 12k-token
+  prompt is a few seconds; the timeout only catches a wedged engine.
+- failures print and continue: the tap pools over tokens, a few lost
+  prompts do not bias the Hessians (the corpus is drawn round-robin over
+  source classes, so loss is class-neutral as long as failures are rare;
+  a systematic 4xx is loud in the log and must be fixed, not ignored).
+
+Usage: calib-push.py [--port 7770] [--parallel 64] [--container arbench]
+       [--corpus /home/dank/corpora/out/calib.jsonl] [--max-rounds 4]
+"""
+import argparse
+import concurrent.futures
+import json
+import subprocess
+import sys
+import time
+import urllib.request
+
+DONE_MARK = "calibration wrote"
+
+
+def tap_done(container):
+    """True if the engine logged the tap's completion line."""
+    try:
+        out = subprocess.run(
+            ["podman", "logs", "--tail", "50", container],
+            capture_output=True, text=True, timeout=30,
+        )
+    except Exception:
+        return False
+    return DONE_MARK in (out.stdout + out.stderr)
+
+
+def push_one(url, prompt):
+    body = json.dumps({
+        "model": "frank-archon",
+        "prompt": prompt,
+        "max_tokens": 1,
+        "temperature": 0,
+        "stream": False,
+    }).encode()
+    req = urllib.request.Request(
+        url, data=body, headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=1800) as r:
+            r.read()
+        return True
+    except Exception as e:
+        print(f"FAIL {str(e)[:120]}", flush=True)
+        return False
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--port", type=int, default=7770)
+    ap.add_argument("--parallel", type=int, default=64)
+    ap.add_argument("--container", default="arbench")
+    ap.add_argument("--corpus", default="/home/dank/corpora/out/calib.jsonl")
+    ap.add_argument("--max-rounds", type=int, default=4)
+    a = ap.parse_args()
+    url = f"http://127.0.0.1:{a.port}/v1/completions"
+
+    prompts = []
+    with open(a.corpus) as f:
+        for line in f:
+            line = line.strip()
+            if line:
+                prompts.append(json.loads(line)["prompt"])
+    print(f"corpus: {len(prompts)} prompts", flush=True)
+
+    for rnd in range(1, a.max_rounds + 1):
+        if tap_done(a.container):
+            break
+        t0 = time.time()
+        ok = 0
+        with concurrent.futures.ThreadPoolExecutor(a.parallel) as ex:
+            for good in ex.map(lambda p: push_one(url, p), prompts):
+                ok += 1 if good else 0
+        dt = time.time() - t0
+        print(f"round {rnd}: {ok}/{len(prompts)} ok in {dt:.0f}s "
+              f"({sum(len(p) for p in prompts)/4/dt:.0f} chars/s est)",
+              flush=True)
+        if tap_done(a.container):
+            break
+    else:
+        print("max rounds exhausted, tap not done", flush=True)
+        sys.exit(1)
+    print("TAP_DONE: calibration wrote layer Hessians", flush=True)
+
+
+if __name__ == "__main__":
+    main()

scripts/convert-swift15-w4dn8.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# convert-swift15-w4dn8.sh — RUNS ON DANKSERVER. The final recipe convert of
+# the Swift 1.5 checkpoint: gate_up experts through GPTQ against the 10M-token
+# calibration Grams, down projections block-fp8, protected experts bf16,
+# trunk int8, PLE fixed-scale fp8 (scripts/recipes/
+# qwen4exp-swift15-w4dn8-i8-hc8m.recipe).
+#
+# The convert engine is 1.0.13 — the SAME pin that will serve the result, so
+# the .rad crosses no version boundary. Only the Gram files cross versions
+# (1.2.0 wrote them; the RADGRAM2 magic, gram.r%d.%s.bin naming and the
+# calib_gram/calib_resolve/calib_stem symbols are byte-identical between the
+# two libquant.so). rad-convert runs on the host backend (no GPU visible in
+# the container) — production can stay up through this script.
+#
+# Prereqs (campaign order): calibration complete (calib-push printed TAP_DONE),
+# the protected-expert cast lines rewritten into the recipe by
+# derive-protected-experts.py, and the 335 GiB bf16 container deleted —
+# the peak-disk arithmetic needs that space (checkpoint 335.3 + output ~132
+# GiB on the volume; --reuse is NOT used, see the recipe header).
+set -euo pipefail
+
+PIN_1013=sha256:4c3f484564bb2872784e46b0a59cbd71becc9c1e746e301a3596ffae253c322e
+IMAGE="stilldeadcode/radiance@$PIN_1013"
+CKPT=/home/dank/models/ukisai/Swift1.5-Qwen3.8-Flash-Next
+RECIPE=/home/dank/serverAppConfigs-swift15/scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe
+CALIB=/home/dank/corpora/calib
+OUT=/home/dank/models/rad/qwen4exp-swift15-w4dn8-i8-hc8m.rad
+LOG=/home/dank/logs/swift15_convert.log
+# gate_up ~37.6 + down ~18.8 + PLE 47.7 + trunk/embeddings/head ~10 GiB (all-w4 expert
+# table; one encoding per expert table rules out a block-fp8 down tier -- see the recipe header).
+MIN_MIB=${FRANK_SWIFT15_RAD_MIN_MIB:-108000}
+
+# Gate 1: inputs. A missing Gram directory converts UNCALIBRATED with a
+# per-tensor stderr note, which is silently worse than failing here.
+[ -d "$CKPT" ] || { echo "no checkpoint at $CKPT" >&2; exit 1; }
+[ -f "$RECIPE" ] || { echo "no recipe at $RECIPE" >&2; exit 1; }
+GRAMS=$(find "$CALIB" -maxdepth 1 -name 'gram.r*.bin' 2>/dev/null | wc -l)
+[ "$GRAMS" -ge 48 ] || { echo "calib dir $CALIB holds $GRAMS gram files (<48)" >&2; exit 1; }
+if [ -e "$OUT" ]; then echo "$OUT already exists; move it to trash first" >&2; exit 1; fi
+if [ -e /home/dank/models/rad/qwen4exp-swift15-bf16.rad ]; then
+    echo "the bf16 container is still on disk; delete it first (peak disk)" >&2; exit 1
+fi
+
+# Gate 2: disk. Output ~132 GiB plus convert staging, 20 GiB of slack.
+FREE_MIB=$(df --output=avail -m /home/dank/models | tail -1 | tr -d ' ')
+[ "$FREE_MIB" -ge $((MIN_MIB + 20480)) ] || {
+    echo "only ${FREE_MIB} MiB free on /home/dank/models" >&2; exit 1; }
+
+# The recipe names $CALIB; rad-convert expands it from the environment
+# (MOE-W4.md:275). The recipe's cast section must name THIS checkpoint's
+# protected experts — derive-protected-experts.py rewrote it.
+echo "convert: $CKPT -> $OUT (gptq calib=$CALIB, $(date -Is))" | tee "$LOG"
+podman run --rm --name swift15-convert \
+    -v /home/dank/models:/models \
+    -v /home/dank/serverAppConfigs-swift15:/campaign:ro \
+    -v "$CALIB:/data/calib:ro" \
+    -e CALIB=/data/calib \
+    --entrypoint /opt/radiance/bin/rad-convert \
+    "$IMAGE" "/models/${CKPT#/home/dank/models/}" \
+    --recipe /campaign/"${RECIPE#/home/dank/serverAppConfigs-swift15/}" \
+    -o /models/rad/"$(basename "$OUT")" 2>&1 | tee -a "$LOG"
+rc=${PIPESTATUS[0]}
+[ "$rc" -eq 0 ] || { echo "rad-convert rc=$rc; log: $LOG" >&2; exit "$rc"; }
+
+# Gate 3: the artifact. rad-info's recipe echo is the receipt that GPTQ ran.
+SIZE_MIB=$(( $(stat -c %s "$OUT") / 1048576 ))
+[ "$SIZE_MIB" -ge "$MIN_MIB" ] || {
+    echo "$OUT is ${SIZE_MIB} MiB < floor ${MIN_MIB}" >&2; exit 1; }
+podman run --rm --entrypoint /opt/radiance/bin/rad-info \
+    -v /home/dank/models:/models:ro "$IMAGE" /models/rad/"$(basename "$OUT")" \
+    2>&1 | tee -a "$LOG" | grep -c 'gptq' >/dev/null \
+    || echo "WARNING: rad-info shows no gptq rule in the recorded recipe" >&2
+echo "CONVERT_DONE ${SIZE_MIB} MiB -> $OUT"

scripts/dankstatus.sh

@@ -57,9 +57,9 @@ else
   echo "  none"
 fi
 
-section "frank-primary unit"
-printf '  active:  %s\n' "$(systemctl is-active frank-primary 2>/dev/null | head -1)"
-printf '  enabled: %s\n' "$(systemctl is-enabled frank-primary 2>/dev/null | head -1)"
+section "frank-archon unit"
+printf '  active:  %s\n' "$(systemctl is-active frank-archon 2>/dev/null | head -1)"
+printf '  enabled: %s\n' "$(systemctl is-enabled frank-archon 2>/dev/null | head -1)"
 
 section "glm serve tail"
 if podman ps -a --format '{{.Names}}' 2>/dev/null | grep -qx "$GLM_CTR"; then

scripts/deep-probe.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""deep-probe.py — one chat completion at ~43.6k prompt tokens, temp 0, 512
+generated, streamed; decode = completion_tokens / (total - ttft)."""
+import json, time, urllib.request
+
+TARGET_BYTES = int(43600 * 3.8)
+
+def build():
+    parts, n = [], 0
+    with open("/home/dank/corpora/out/calib.jsonl") as f:
+        for line in f:
+            p = json.loads(line)["prompt"]
+            parts.append(p)
+            n += len(p.encode())
+            if n >= TARGET_BYTES:
+                break
+    return "".join(parts)
+
+def main(salt):
+    body = json.dumps({
+        "model": "frank-archon",
+        "messages": [{"role": "user", "content": f"[probe {salt}] Continue and summarize this material in English, 400 words.\n\n" + build()}],
+        "temperature": 0.0, "max_tokens": 512,
+        "stream": True, "stream_options": {"include_usage": True},
+    }).encode()
+    req = urllib.request.Request("http://localhost:7770/v1/chat/completions",
+        data=body, headers={"Content-Type": "application/json"})
+    t0 = time.time(); ttft = None; ctok = 0; usage = {}
+    with urllib.request.urlopen(req, timeout=2400) as r:
+        for raw in r:
+            line = raw.decode().strip()
+            if not line.startswith("data:"):
+                continue
+            d = line[5:].strip()
+            if d == "[DONE]":
+                break
+            j = json.loads(d)
+            if j.get("usage"):
+                usage = j["usage"]
+            for ch in j.get("choices", []):
+                delta = (ch.get("delta") or {})
+                piece = delta.get("content") or delta.get("reasoning_content") or ""
+                if piece and ttft is None:
+                    ttft = time.time() - t0
+                ctok += 1
+    total = time.time() - t0
+    gen = usage.get("completion_tokens") or ctok
+    dec = gen / (total - (ttft or 0)) if total > (ttft or 0) else 0
+    print(json.dumps({"salt": salt, "prompt_tokens": usage.get("prompt_tokens"),
+                      "completion_tokens": gen, "ttft_s": round(ttft or 0, 2),
+                      "total_s": round(total, 1), "decode_tps": round(dec, 2)}))
+
+if __name__ == "__main__":
+    import sys
+    main(sys.argv[1] if len(sys.argv) > 1 else "x")

scripts/deploy-plan.py

@@ -1,475 +1,68 @@
 #!/usr/bin/env python3
-"""Plan runtime services affected by repository changes.
+"""deploy-plan.py — map changed paths to deployable services.
 
-The planner is intentionally side-effect free.  It accepts either an explicit
-path list or two Git revisions.  The latter lets compose-file changes resolve
-to only the service definitions that actually changed instead of restarting an
-entire compose project.
+Thin wrapper over scripts/service-map.py, which owns the path->service
+semantics in the shared inventory (shared/services.yml): per-service path
+rules, the quadlet netns/network coupling graph, host scoping (a host's
+directory can only select that host's services), and canonical restart
+order. This file keeps the deployer's CLI contract only.
+
+Usage:
+  deploy-plan.py --target NAME --repo DIR --base REV --head REV
+  deploy-plan.py --target NAME [paths...]        (paths also on stdin)
+
+Prints one service name per line (canonical restart order); exit 0 with no
+output when nothing relevant changed.
 """
-from __future__ import annotations
-
-import argparse
+import os
 import subprocess
 import sys
-from pathlib import PurePosixPath
-from typing import Any
 
-import yaml
-
-# Dependency-sensitive services come before their consumers.  Independent
-# compose services follow.  LLM services are deliberately last and are never
-# implied by a generic host, stack, documentation, or config change.
-SERVICE_ORDER = (
-    "gluetun",
-    "searxng-valkey",
-    "searxng",
-    "marreta",
-    "pihole",
-    "open-webui",
-    "gitea-postgres",
-    "gitea-server",
-    "comfyui",
-    "seerr",
-    "hermes",
-    "hermes-dashboard",
-    "hermes-webui",
-    "prometheus",
-    "grafana",
-    "loki",
-    "alloy",
-    "node-exporter",
-    "alertmanager",
-    "authentik-postgres",
-    "authentik-server",
-    "authentik-worker",
-    "authentik-outpost",
-    "authentik-outpost-ldap",
-    "caddy",
-    "homepage",
-    "romm-mariadb",
-    "romm-redis",
-    "romm",
-    "copyparty",
-    "jellyfin",
-    "calibre-web",
-    "calibre-server",
-    "plex",
-    "tautulli",
-    "prowlarr",
-    "qbittorrent",
-    "radarr",
-    "sonarr",
-    "lidarr",
-    "readarr",
-    "frank-large",
-    "frank-secondary",
-    "frank-primary",
-)
-
-DANKCLAW_SERVICES = {
-    "hermes-webui",
-    "gluetun",
-    "searxng-valkey",
-    "searxng",
-    "marreta",
-    "pihole",
-    "open-webui",
-    "gitea-postgres",
-    "gitea-server",
-    "comfyui",
-    "seerr",
-    "hermes",
-    "hermes-dashboard",
-    "prometheus",
-    "grafana",
-    "loki",
-    "alloy",
-    "node-exporter",
-    "alertmanager",
-    "authentik-postgres",
-    "authentik-server",
-    "authentik-worker",
-    "authentik-outpost",
-    "authentik-outpost-ldap",
-    "caddy",
-    "homepage",
-    "frank-large",
-    "frank-secondary",
-}
-
-DANKSERVER_SERVICES = {
-    "romm-mariadb",
-    "romm-redis",
-    "romm",
-    "copyparty",
-    "jellyfin",
-    "calibre-web",
-    "calibre-server",
-    "plex",
-    "tautulli",
-    "prowlarr",
-    "qbittorrent",
-    "radarr",
-    "sonarr",
-    "lidarr",
-    "readarr",
-    "frank-primary",
-    "node-exporter",
-}
-
-# FrankBook-Pro runs the *arr stack + qBittorrent inside a podman machine on
-# macOS. Service names overlap the Linux hosts (gluetun, qbittorrent, ...);
-# the per-target sets and the frankbook-pro intercept in deploy-remote.sh
-# keep dispatch unambiguous.
-FRANKBOOK_SERVICES = {
-    "gluetun",
-    "qbittorrent",
-    "prowlarr",
-    "radarr",
-    "sonarr",
-    "lidarr",
-    "readarr",
-}
-
-DANKCLAW_COMPOSE_SERVICES = set()
-# Dankserver's compose file is still the source of truth for its media stack;
-# Dankclaw's is gone (deleted 2026-09-16). Every service on Dankclaw is a
-# Quadlet unit now — the last compose services were the hermes trio, whose units
-# have owned their containers since 2026-09-12 and whose compose blocks were
-# dead weight that could only create a duplicate container.
-
-DANKSERVER_COMPOSE_SERVICES = {
-    "mariadb",
-    "redis",
-    "romm",
-    "copyparty",
-    "jellyfin",
-    "calibre-web",
-}
-COMPOSE_NAME_MAP = {"mariadb": "romm-mariadb", "redis": "romm-redis"}
+SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+SERVICE_MAP = os.path.join(SCRIPT_DIR, "service-map.py")
 
 
-
-def _add(services: set[str], *names: str) -> None:
-    services.update(names)
-
-
-def target_services(target: str) -> set[str]:
-    if target == "dankclaw":
-        return DANKCLAW_SERVICES
-    if target == "dankserver":
-        return DANKSERVER_SERVICES
-    if target == "frankbook-pro":
-        return FRANKBOOK_SERVICES
-    raise ValueError(f"unknown target: {target}")
-
-
-def _compose_services(target: str) -> set[str]:
-    return DANKCLAW_COMPOSE_SERVICES if target == "dankclaw" else DANKSERVER_COMPOSE_SERVICES
-
-
-def _git_show(repo: str, revision: str, path: str) -> str | None:
-    result = subprocess.run(
-        ["git", "-C", repo, "show", f"{revision}:{path}"],
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.DEVNULL,
-        check=False,
-    )
-    return result.stdout if result.returncode == 0 else None
-
-
-def _yaml_document(contents: str | None) -> dict[str, Any]:
-    if contents is None:
-        return {}
-    try:
-        data = yaml.safe_load(contents) or {}
-    except yaml.YAMLError:
-        return {}
-    return data if isinstance(data, dict) else {}
-
-
-def _yaml_services(contents: str | None) -> dict[str, Any]:
-    services = _yaml_document(contents).get("services", {})
-    return services if isinstance(services, dict) else {}
-
-
-def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
-    """Return only compose services whose YAML definitions or dependencies changed.
-
-    A target with no compose file (Dankclaw since 2026-09-16) plans nothing:
-    its services are Quadlet units, selected by their own paths.
-    """
-    path = f"{target}/compose.yaml"
-    if not _git_show(repo, head, path) and not _git_show(repo, base, path):
-        return set()
-    old_doc = _yaml_document(_git_show(repo, base, path))
-    new_doc = _yaml_document(_git_show(repo, head, path))
-    old = old_doc.get("services", {}) if isinstance(old_doc.get("services", {}), dict) else {}
-    new = new_doc.get("services", {}) if isinstance(new_doc.get("services", {}), dict) else {}
-    names = set(old) | set(new)
-    allowed = _compose_services(target)
-
-    # An unavailable or malformed revision is safer as a broad compose plan
-    # than as a silent no-op. It still cannot include LLM units.
-    if (old_doc and not new_doc) or (new_doc and not old_doc and names):
-        return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
-
-    # Top-level networks/configuration can affect every compose service even
-    # when no individual service mapping changed. Ignore the services key while
-    # comparing the rest of the Compose document.
-    old_globals = {key: value for key, value in old_doc.items() if key != "services"}
-    new_globals = {key: value for key, value in new_doc.items() if key != "services"}
-    if old_globals != new_globals:
-        return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
-
-    changed = {name for name in names if name in allowed and old.get(name) != new.get(name)}
-    return {COMPOSE_NAME_MAP.get(n, n) for n in changed}
-
-
-def services_for_path(path: str, target: str) -> set[str]:
-    """Return services affected by one repository-relative path."""
-    path = path.replace("\\", "/")
-    p = PurePosixPath(path)
-    parts = p.parts
-    services: set[str] = set()
-    if not parts:
-        return services
-
-    # Non-runtime material is deliberately a no-op.
-    if parts[0] in {"docs", "tests", "old", ".githooks"}:
-        return services
-    if path in {"README.md", "AGENTS.md"} or parts[0] == ".obsidian":
-        return services
-
-    if parts[0] == "shared":
-        if len(parts) < 2:
-            return services
-        group = parts[1]
-        if group == "searxng":
-            _add(services, "searxng")
-        elif group == "prometheus":
-            _add(services, "prometheus")
-            if len(parts) >= 3 and parts[2] == "alertmanager.yml":
-                # The Alertmanager config ships from this directory: a change
-                # to it must redeploy the service that installs it.
-                _add(services, "alertmanager")
-        elif group == "loki":
-            _add(services, "loki")
-        elif group == "alloy":
-            _add(services, "alloy")
-        elif group == "grafana":
-            # Provisioned datasources and dashboards: git is the source of
-            # truth, so a change here must restart the service that reads them.
-            _add(services, "grafana")
-        elif group == "homepage":
-            # Homepage is a Dankclaw-owned deployment. Shared homepage files
-            # are intentionally not copied during a Dankserver-only run.
-            if target == "dankclaw":
-                _add(services, "homepage")
-        return services
-
-    if parts[0] == "dankclaw":
-        if len(parts) >= 2 and parts[1] == "compose.yaml":
-            # Dankclaw has no compose file since 2026-09-16: every service is a
-            # Quadlet unit, each selected by its own path. A change (or a
-            # deletion) of this path therefore restarts nothing.
-            return services
-        if len(parts) >= 2 and parts[1] == "Caddyfile":
-            _add(services, "caddy")
-            return services
-        if len(parts) >= 2 and parts[1] == "Containerfile.comfyui":
-            _add(services, "comfyui")
-            return services
-        if len(parts) >= 2 and parts[1] in {"caddy", "comfyui", "loki", "alloy", "hermes", "anubis", "seerr"}:
-            _add(services, parts[1])
-            return services
-        if len(parts) >= 4 and parts[1] == "authentik" and parts[2] == "quadlet":
-            name = parts[3].removesuffix(".container")
-            if name in {"authentik-postgres", "authentik-server", "authentik-worker", "authentik-outpost", "authentik-outpost-ldap"}:
-                _add(services, name)
-            return services
-        if len(parts) >= 2 and parts[1] == "searxng":
-            if len(parts) >= 4 and parts[2] == "quadlet":
-                name = parts[3]
-                if name == "gluetun.container":
-                    # SearXNG and Marreta (+ its browser companion) share
-                    # Gluetun's network namespace.  A Gluetun recreation
-                    # tears the netns down, so every sharer must restart.
-                    _add(services, "gluetun", "searxng", "marreta")
-                elif name == "searxng.container":
-                    _add(services, "searxng")
-                elif name == "searxng-valkey.container":
-                    _add(services, "searxng-valkey", "searxng")
-                elif name == "searxng.network":
-                    _add(services, "gluetun", "searxng-valkey", "searxng", "marreta")
-            return services
-        if len(parts) >= 2 and parts[1] == "marreta":
-            # One deployable owns both the app and its browser companion;
-            # both live in gluetun's netns. A change to either unit selects
-            # the marreta service, which restarts browser-then-app.
-            _add(services, "marreta")
-            return services
-        if len(parts) >= 2 and parts[1] == "pihole":
-            _add(services, "pihole")
-            return services
-        if len(parts) >= 2 and parts[1] == "open-webui":
-            _add(services, "open-webui")
-            return services
-        # frank-large left the quadlet shape on 2026-09-19 (CIRU v4.4.1 host
-        # build, root unit): its files live in scripts/ and map there.
-        if len(parts) >= 2 and parts[1] == "observability":
-            # The five observability containers became Quadlet units on
-            # 2026-09-11. A unit change selects exactly its own service;
-            # SERVICE_ORDER already puts each dependency ahead of its
-            # consumer (prometheus before grafana, loki before alloy).
-            if len(parts) >= 4 and parts[2] == "quadlet":
-                name = parts[3].removesuffix(".container")
-                if name in {"prometheus", "grafana", "loki", "alloy", "node-exporter", "alertmanager"}:
-                    _add(services, name)
-            return services
-        if len(parts) >= 2 and parts[1] == "gitea":
-            if len(parts) >= 4 and parts[2] == "quadlet":
-                name = parts[3]
-                if name == "gitea-postgres.container":
-                    _add(services, "gitea-postgres")
-                elif name == "gitea-server.container":
-                    _add(services, "gitea-server")
-                elif name == "gitea-caddy.container":
-                    # Removing the old split proxy requires the canonical
-                    # Caddy handler to retire its installed unit/container
-                    # before it claims ports 80/443.
-                    _add(services, "caddy")
-                elif name == "gitea.network":
-                    _add(services, "gitea-postgres", "gitea-server")
-            return services
-        return services
-
-    if parts[0] == "dankserver":
-        if len(parts) >= 2 and parts[1] == "compose.yaml":
-            # Compose service keys map onto the deployed unit names.
-            _add(services, *(COMPOSE_NAME_MAP.get(n, n) for n in DANKSERVER_COMPOSE_SERVICES))
-            return services
-        if len(parts) >= 3 and parts[2] == "quadlet":
-            quadlet_services = {
-                "romm": {"romm", "romm-mariadb", "romm-redis"},
-                "jellyfin": {"jellyfin"},
-                "calibre-web": {"calibre-web"},
-                "calibre-server": {"calibre-server"},
-                "copyparty": {"copyparty"},
-                "plex": {"plex"},
-                "tautulli": {"tautulli"},
-            }
-            _add(services, *quadlet_services.get(parts[1], set()))
-        if len(parts) >= 2 and parts[1] == "observability":
-            # Dankserver's node-exporter became a Quadlet unit on 2026-09-16
-            # (serverAppConfigs-docs/Infrastructure/Observability.md): its
-            # compose service died at a reboot and stayed dead, so Prometheus'
-            # node-dankserver job had nothing to scrape.
-            if len(parts) >= 4 and parts[2] == "quadlet":
-                name = parts[3].removesuffix(".container")
-                if name == "node-exporter":
-                    _add(services, "node-exporter")
-            return services
-        # frank-primary's quadlet-era directory left the tree on 2026-09-26
-        # (the Lucebox DS4.1 unit was retired for the llama.cpp root unit —
-        # the trio in scripts/ now maps it). Nothing lives under
-        # dankserver/frank-primary/ except dated trash, and trash plans
-        # nothing (the retire rule above the service blocks).
-        return services
-
-    if parts[0] == "frankbook-pro":
-        if len(parts) >= 3 and parts[2] == "quadlet":
-            name = parts[3].removesuffix(".container")
-            if name == "gluetun":
-                # Every *arr + qBittorrent container shares gluetun's
-                # network namespace; a gluetun recreation kills all of
-                # them, so the plan restarts the whole netns family.
-                _add(services, "gluetun", "qbittorrent",
-                     "prowlarr", "sonarr", "radarr", "lidarr", "readarr")
-            elif name in FRANKBOOK_SERVICES:
-                _add(services, name)
-        return services
-
-    if parts[0] == "scripts":
-        name = p.name
-        if name in {"homepage-status.py", "homepage-status.service", "homepage-status.timer"}:
-            _add(services, "homepage")
-        if name in {"signal-relay.py", "signal-relay.service"}:
-            # The Signal relay is installed by the alertmanager deploy, so a
-            # change to it redeploying alertmanager is the only path that
-            # reaches it on the host.
-            _add(services, "alertmanager")
-        if name in {"frank-secondary.env", "frank-secondary.service", "serve-frank-secondary.sh"}:
-            # llama.cpp frank-secondary (2026-09-16) keeps its unit, env and serve
-            # files here; each one selects frank-secondary only. The ik_llama.cpp
-            # trio that lived here for two days is in scripts/.AGENTTRASH/,
-            # which is archive material and plans nothing.
-            _add(services, "frank-secondary")
-        if name in {"frank-large.env", "frank-large.service", "serve-frank-large.sh"}:
-            # CIRU v4.4.1 frank-large (2026-09-19) keeps its unit, env and
-            # serve files here the same way: a root unit on a host-built
-            # runtime. The download script fetches the payload, which is
-            # host-side state, so it selects nothing.
-            _add(services, "frank-large")
-        if name == "qwen-sharp-v22.4.0.jinja":
-            # The Qwen-Sharp chat template frank-large loads via
-            # --chat-template-file. It lived under dankserver/frank-medium/ until
-            # the 2026-09-26 cutover retired that directory; editing it changes
-            # what the live frank-large endpoint renders, so it plans
-            # frank-large.
-            _add(services, "frank-large")
-        if name in {"frank-primary.env", "frank-primary.service", "serve-frank-primary.sh"}:
-            # llama.cpp frank-primary (2026-09-26, replacing the Lucebox
-            # DS4.1 quadlet) keeps its unit, env and serve files here the
-            # same way: a root unit on the unsloth b11030-mix prebuilt
-            # serving Qwen3.8-Flash-Next Q8_0. The download script fetches
-            # the payload, which is host-side state, so it selects nothing.
-            _add(services, "frank-primary")
-        # Deployment/test/benchmark scripts and other repo tooling do not
-        # restart a runtime service.
-        return services
-
-    # Examples and env templates are not deployed runtime state.
-    if p.name in {".env.example", "env.example"}:
-        return services
-    return services
-
-def changed_paths(repo: str, base: str, head: str) -> list[str]:
-    result = subprocess.run(
-        ["git", "-C", repo, "diff", "--name-only", "--diff-filter=ACDMRTUXB", base, head],
-        text=True,
-        stdout=subprocess.PIPE,
-        check=True,
-    )
-    return [line for line in result.stdout.splitlines() if line]
-
-
-def plan(paths: list[str], target: str, repo: str | None = None,
-         base: str | None = None, head: str | None = None) -> list[str]:
-    services: set[str] = set()
-    for path in paths:
-        if path == f"{target}/compose.yaml" and repo and base and head:
-            services.update(compose_changes(repo, target, base, head))
-        else:
-            services.update(services_for_path(path, target))
-    allowed = target_services(target)
-    return [name for name in SERVICE_ORDER if name in services and name in allowed]
+def git_paths(repo: str, base: str, head: str) -> list[str]:
+    proc = subprocess.run(
+        ["git", "-C", repo, "diff", "--name-only", base, head],
+        text=True, capture_output=True)
+    if proc.returncode != 0:
+        sys.stderr.write(f"deploy-plan: git diff failed: {proc.stderr}")
+        raise SystemExit(1)
+    return [line for line in proc.stdout.splitlines() if line]
 
 
 def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--target", choices=("dankclaw", "dankserver", "frankbook-pro"), required=True)
-    parser.add_argument("--paths", nargs="+")
-    parser.add_argument("--repo", help="repository path for revision-aware planning")
-    parser.add_argument("--base", help="base Git revision")
-    parser.add_argument("--head", help="head Git revision")
-    args = parser.parse_args()
-
-    if not args.paths and not (args.repo and args.base and args.head):
-        parser.error("provide --paths or all of --repo, --base, and --head")
-    paths = args.paths or changed_paths(args.repo, args.base, args.head)
-    print("\n".join(plan(paths, args.target, args.repo, args.base, args.head)))
+    args = sys.argv[1:]
+    if not args or args[0] != "--target":
+        print(__doc__, file=sys.stderr)
+        return 2
+    if len(args) < 2:
+        print("missing target name after --target", file=sys.stderr)
+        return 2
+    target = args[1]
+    # `--paths` is the historic seam keyword: a flag, not an option — the
+    # paths are the positional arguments that follow it.
+    rest = [a for a in args[2:] if a != "--paths"]
+    if "--repo" in rest:
+        try:
+            repo = rest[rest.index("--repo") + 1]
+            base = rest[rest.index("--base") + 1]
+            head = rest[rest.index("--head") + 1]
+        except (ValueError, IndexError):
+            print("--repo, --base and --head must appear together", file=sys.stderr)
+            return 2
+        paths = git_paths(repo, base, head)
+    else:
+        paths = rest or [line.strip() for line in sys.stdin if line.strip()]
+    if not paths:
+        return 0
+    proc = subprocess.run([sys.executable, SERVICE_MAP, "plan", "--host", target] + paths,
+                          text=True, capture_output=True)
+    if proc.returncode != 0:
+        sys.stderr.write(proc.stderr)
+        return proc.returncode
+    sys.stdout.write(proc.stdout)
     return 0
 
 

scripts/deploy-remote.sh

@@ -9,6 +9,13 @@
 # pending until its service is explicitly deployed.
 set -euo pipefail
 
+# The LLM handlers' artifact gates are the serve scripts' own library, so
+# the deployer and the unit refuse the same missing payload with the same
+# words — no deploy can pass a gate the unit would fail. GATE_PREFIX is set
+# per handler.
+# shellcheck disable=SC1091
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/llm-gates.sh"
+
 TARGET="${1:-}"
 REVISION="${2:-}"
 shift 2 || true
@@ -80,31 +87,10 @@ cd "$REMOTE_DIR"
 mkdir -p "$STATE_DIR"
 
 service_is_allowed() {
-    local service="$1"
-    case "$TARGET:$service" in
-        dankclaw:gluetun|dankclaw:searxng-valkey|dankclaw:searxng|dankclaw:pihole|\
-        dankclaw:open-webui|dankclaw:gitea-postgres|dankclaw:gitea-server|\
-        dankclaw:comfyui|dankclaw:hermes|\
-        dankclaw:hermes-dashboard|dankclaw:hermes-webui|dankclaw:prometheus|dankclaw:grafana|\
-        dankclaw:loki|dankclaw:alloy|dankclaw:node-exporter|dankclaw:alertmanager|\
-        dankclaw:authentik-postgres|dankclaw:authentik-server|\
-        dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:authentik-outpost-ldap|dankclaw:anubis|\
-        dankclaw:caddy|dankclaw:homepage|dankclaw:seerr|dankclaw:marreta|\
-        dankclaw:frank-large|dankclaw:frank-secondary|\
-        dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
-        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:calibre-server|dankserver:plex|dankserver:tautulli|\
-        dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\
-        dankserver:sonarr|dankserver:lidarr|dankserver:readarr|\
-        dankserver:frank-primary|dankserver:node-exporter|\
-        frankbook-pro:gluetun|frankbook-pro:qbittorrent|frankbook-pro:prowlarr|\
-        frankbook-pro:radarr|frankbook-pro:sonarr|frankbook-pro:lidarr|\
-        frankbook-pro:readarr)
-            return 0
-            ;;
-        *)
-            return 1
-            ;;
-    esac
+    # The inventory (shared/services.yml via scripts/service-map.py) is the
+    # only allow-list: a service is deployable on a target iff the inventory
+    # places it there. Retiring a service from a host is a data edit.
+    python3 scripts/service-map.py allows --host "$TARGET" --service "$1"
 }
 
 mark_status() {
@@ -192,7 +178,7 @@ add_pending_services() {
             continue
         fi
         [[ -n "$recorded" && "$recorded" != "$REVISION" ]] || continue
-        if [[ "$TARGET" == dankserver && "$service" == frank-large ]]; then continue; fi
+        if [[ "$TARGET" == dankserver && "$service" == frank-dragoon ]]; then continue; fi
         if ! changed="$(python3 scripts/deploy-plan.py --target "$TARGET" \
             --repo "$REMOTE_DIR" --base "$recorded" --head "$REVISION")"; then
             echo "WARN: unable to compare state for $service; retaining it as pending" >&2
@@ -274,13 +260,11 @@ install_signal_relay() {
 }
 
 copy_loki_config() {
-    run_privileged mkdir -p /opt/loki/config
-    run_privileged cp shared/loki/loki-config.yaml /opt/loki/config/loki-config.yaml
+    copy_config /opt/loki/config shared/loki/loki-config.yaml
 }
 
 copy_alloy_config() {
-    run_privileged mkdir -p /opt/alloy/config
-    run_privileged cp shared/alloy/config.alloy /opt/alloy/config/config.alloy
+    copy_config /opt/alloy/config shared/alloy/config.alloy
 }
 
 copy_grafana_provisioning() {
@@ -289,14 +273,11 @@ copy_grafana_provisioning() {
     # datasource would be invisible to review, lost with the data volume, and
     # unknown to anyone reading the repository. The unit already mounts
     # /opt/grafana/provisioning read-only, so this only has to populate it.
-    run_privileged mkdir -p /opt/grafana/provisioning/datasources \
-        /opt/grafana/provisioning/dashboards
-    run_privileged cp shared/grafana/provisioning/datasources/prometheus.yml \
-        /opt/grafana/provisioning/datasources/prometheus.yml
-    run_privileged cp shared/grafana/provisioning/dashboards/provider.yml \
-        /opt/grafana/provisioning/dashboards/provider.yml
-    run_privileged cp shared/grafana/provisioning/dashboards/llm-fleet.json \
-        /opt/grafana/provisioning/dashboards/llm-fleet.json
+    copy_config /opt/grafana/provisioning/datasources \
+        shared/grafana/provisioning/datasources/prometheus.yml
+    copy_config /opt/grafana/provisioning/dashboards \
+        shared/grafana/provisioning/dashboards/provider.yml \
+        shared/grafana/provisioning/dashboards/llm-fleet.json
 }
 
 render_caddyfile() {
@@ -322,6 +303,12 @@ deploy_homepage() {
     if [[ -d shared/homepage/fonts ]]; then
         run_privileged cp -r shared/homepage/fonts /srv/homepage/
     fi
+    if [[ -d shared/homepage/img ]]; then
+        run_privileged cp -r shared/homepage/img /srv/homepage/
+    fi
+    if [[ -d shared/homepage/sfx ]]; then
+        run_privileged cp -r shared/homepage/sfx /srv/homepage/
+    fi
     local deployed_at
     deployed_at="$(git log -1 --format=%cI)"
     printf 'window.DEPLOYED_AT = "%s";\n' "$deployed_at" > /tmp/deployed.js
@@ -435,31 +422,6 @@ deploy_caddy() {
     fi
 }
 
-deploy_compose_service() {
-    local service="$1"
-    if [[ "$TARGET" == dankserver ]]; then
-        # Dankserver's compose file is the source-of-truth inventory, but its
-        # production containers are individually systemd-managed/bare. Do not
-        # use compose up here: it can create a second container with a wrong
-        # name and can interfere with a running workload.
-        echo "WARN: $service is recorded in dankserver/compose.yaml; production container management is host-specific and no restart was attempted."
-        return 0
-    fi
-    if [[ "$TARGET" == dankclaw ]]; then
-        # Dankclaw has no compose file since 2026-09-16: every service is a
-        # Quadlet unit with its own handler above. Reaching this means the
-        # dispatcher is missing a case, and the old fallback (`podman-compose
-        # up -d`) would now be a silent no-op or a duplicate container.
-        echo "no compose services on dankclaw; $service has no quadlet handler" >&2
-        return 2
-    fi
-    case "$service" in
-        *)
-            echo "unknown compose service: $service" >&2
-            return 2
-            ;;
-    esac
-}
 
 # grafana is the one observability service that holds a credential: the
 # Authentik OAuth2 client secret. It is seeded into a per-service env file (the
@@ -562,6 +524,35 @@ quadlet_unit_dir="$HOME/.config/containers/systemd"
 # dankserver's user manager had no systemd container generator dir before the
 # quadlet migration; every handler that installs a unit must find it present.
 mkdir -p "$quadlet_unit_dir"
+# copy_config DEST SRC... — the privileged config copy every service uses:
+# ensure DEST, copy each tracked SRC into it. The deployer owns /opt state;
+# the files in git are the source of truth, so a service config that only
+# exists on the host is a gap by policy.
+copy_config() {
+    local dest="$1"; shift
+    run_privileged mkdir -p "$dest"
+    local src
+    for src in "$@"; do
+        run_privileged cp "$src" "$dest/"
+    done
+}
+
+# retire_unit_file PATH TRASH [UNIT] — the repo Deletion & Trash policy, in
+# code: stop and disable the named unit, move the unit FILE into the home
+# trash (never rm), report. The dragoon quadlet retirement and the
+# compose-era comfyui.service retirement were the same six lines twice.
+retire_unit_file() {
+    local path="$1" trash="$2" unit="${3:-}"
+    [[ -e "$path" ]] || return 0
+    if [[ -n "$unit" ]]; then
+        systemctl --user stop "$unit" 2>/dev/null || true
+        systemctl --user disable "$unit" 2>/dev/null || true
+    fi
+    mkdir -p "$trash"
+    mv -- "$path" "$trash/$(basename "$path")"
+    echo "retired $(basename "$path") -> $trash"
+}
+
 install_quadlet() {
     local service="$1"
     local source_dir="$2"
@@ -649,15 +640,8 @@ deploy_comfyui() {
     # generator produces, and it is what kept a stale, device-less container
     # alive through `restart: unless-stopped` (9,146 failures on
     # "No HIP GPUs are available"). Never `rm`: it moves into the home trash.
-    local legacy="$HOME/.config/systemd/user/comfyui.service"
-    if [[ -e "$legacy" ]]; then
-        local trash="$HOME/.AGENTTRASH/20260916-comfyui-compose-unit"
-        mkdir -p "$trash"
-        systemctl --user stop comfyui.service 2>/dev/null || true
-        systemctl --user disable comfyui.service 2>/dev/null || true
-        mv -- "$legacy" "$trash/comfyui.service"
-        echo "retired the compose-era comfyui.service -> $trash"
-    fi
+    retire_unit_file "$HOME/.config/systemd/user/comfyui.service" \
+        "$HOME/.AGENTTRASH/20260916-comfyui-compose-unit" comfyui.service
     # The stale container carries the old config (no /dev/kfd, no /dev/dri) and
     # would keep the quadlet's container from taking the name. It is replaced
     # by the unit in the next step, so nothing is lost.
@@ -715,9 +699,15 @@ deploy_gitea_unit() {
     systemctl --user restart "$service.service"
 }
 
+# The root units are symlinks from the systemd system directory into the
+# checkout. SYSTEMD_SYSTEM_DIR is production (/etc/systemd/system); the knob
+# exists so the deploy seam can run a whole handler — relink included — in a
+# sandbox and read the unit links as evidence, unprivileged.
+SYSTEMD_SYSTEM_DIR="${SYSTEMD_SYSTEM_DIR:-/etc/systemd/system}"
+
 relink_unit() {
     local service="$1"
-    run_privileged ln -sfn "$REMOTE_DIR/scripts/$service.service" "/etc/systemd/system/$service.service"
+    run_privileged ln -sfn "$REMOTE_DIR/scripts/$service.service" "$SYSTEMD_SYSTEM_DIR/$service.service"
 }
 
 # Authentik runs as three boot-persistent Quadlet units (postgres -> server ->
@@ -936,17 +926,17 @@ deploy_plex() {
     systemctl --user restart plex.service
     # Readiness gate: /identity answers MediaContainer XML once PMS is up.
     #
-    # HTTPS, NOT HTTP. PMS drops plain HTTP off-loopback: the probe's
-    # connection arrives on the container's eth0, so an http:// request is
-    # accepted and then answered with nothing (curl 52, Empty reply) against a
-    # perfectly healthy server. Measured 2026-10-02 — the gate burned its full
-    # 600s and failed a plex whose https://127.0.0.1:32400/identity answered
-    # 200 in 44 ms the whole time. The same law is why the Caddyfile dials the
-    # plex upstream over TLS (tests/caddyfile.bats pins it).
+    # HTTPS, NOT HTTP. PMS serves plain HTTP on loopback only: a probe
+    # arriving on the container's interface gets its connection accepted and
+    # then an empty reply (curl 52) from a perfectly healthy server, so an
+    # http:// probe would burn the whole timeout and fail a service that
+    # answers https://127.0.0.1:32400/identity in milliseconds. The Caddyfile
+    # dials the same upstream over TLS for the same reason
+    # (tests/caddyfile.bats pins it).
     # -k: PMS presents its own self-signed cert on 32400.
     #
-    # Reality check from the 2026-09 cutover: the FIRST container boot of a
-    # years-old library ran ~10 min, so the gate still allows 600s.
+    # The budget accounts for a first boot of a large pre-existing library,
+    # which spends minutes indexing before it answers anything.
     # Fail the deploy (pending state preserved) rather than mark it deployed blind.
     for ((i = 1; i <= 120; i++)); do
         curl -fsSk --max-time 3 https://127.0.0.1:32400/identity >/dev/null && return 0
@@ -1086,21 +1076,21 @@ deploy_anubis() {
     wait_container_healthy anubis 60 || return 1
 }
 
-# frank-large is the halogen-flash-server CONTAINER (0.16.2, digest-pinned
-# through scripts/frank-large.env) serving the Quat3rnion ABLITERATED
+# frank-dragoon is the halogen-flash-server CONTAINER (0.16.2, digest-pinned
+# through scripts/frank-dragoon.env) serving the Quat3rnion ABLITERATED
 # Swift1.5 finetune of peonist's Qwen3.8-Flash-Next v2 checkpoint —
 # qwen38-flash-next-v2-swift15-abliterated.hgn (66,687,678,464 B, ~62 GiB
 # resident) + the REQUIRED n-gram lookup table + the vision tower —
 # MTP spec decode (HALOGEN_SPEC_ADAPT=0), 2 slots x 200192, image input —
 # on the Strix Halo iGPU. It stays a ROOT unit because the serve script
-# drives `podman run` directly (the frank-primary pattern): relink_unit
-# points /etc/systemd/system/frank-large.service at the repo file, boot
+# drives `podman run` directly (the frank-archon pattern): relink_unit
+# points /etc/systemd/system/frank-dragoon.service at the repo file, boot
 # persistence is that unit's [Install], and LimitMEMLOCK=infinity is
 # fleet parity. 2026-10-06 cutover from the halogen 27B-dense shape —
 # rollback = revert the swap commit's trio; the 27B payload stays on
 # disk (~/models/halogen-qwen3.8-27b).
 #
-# The gates mirror serve-frank-large.sh's predicates EXACTLY (the
+# The gates mirror serve-frank-dragoon.sh's predicates EXACTLY (the
 # 2026-10-01 crash-loop lesson): image digest in dank's podman storage,
 # each .hgn payload (checkpoint, n-gram table, vision tower) at the exact
 # byte count, the tokenizer directory holding every named file as a
@@ -1108,24 +1098,19 @@ deploy_anubis() {
 # artifact would leave a restart-looping unit and a dark endpoint. The
 # port gate is the same as every cutover since 2026-09-16: nothing
 # starts until 7770 is released.
-LLM_LARGE_IMAGE="${LLM_LARGE_IMAGE:-ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84ac22308a53f5d1ca6b86806702d7039e5ebc51cae4c66621b92fe04a}"
-LLM_LARGE_CKPT="${LLM_LARGE_CKPT:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-v2-swift15-abliterated.hgn}"
-LLM_LARGE_CKPT_BYTES="${LLM_LARGE_CKPT_BYTES:-66687678464}"
-LLM_LARGE_NGRAM="${LLM_LARGE_NGRAM:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-ngram.hgn}"
-LLM_LARGE_NGRAM_BYTES="${LLM_LARGE_NGRAM_BYTES:-51200246144}"
-LLM_LARGE_VISION="${LLM_LARGE_VISION:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-vision.hgn}"
-LLM_LARGE_VISION_BYTES="${LLM_LARGE_VISION_BYTES:-897916416}"
-LLM_LARGE_TOK_DIR="${LLM_LARGE_TOK_DIR:-/home/dank/models/halogen-flashnext-v2/tokenizer}"
-LLM_LARGE_TOK_FILES="${LLM_LARGE_TOK_FILES:-tokenizer.json chat_template.jinja tokenizer_config.json merges.txt vocab.json generation_config.json}"
+LLM_DRAGOON_IMAGE="${LLM_DRAGOON_IMAGE:-ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84ac22308a53f5d1ca6b86806702d7039e5ebc51cae4c66621b92fe04a}"
+LLM_DRAGOON_CKPT="${LLM_DRAGOON_CKPT:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-v2-swift15-abliterated.hgn}"
+LLM_DRAGOON_CKPT_BYTES="${LLM_DRAGOON_CKPT_BYTES:-66687678464}"
+LLM_DRAGOON_NGRAM="${LLM_DRAGOON_NGRAM:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-ngram.hgn}"
+LLM_DRAGOON_NGRAM_BYTES="${LLM_DRAGOON_NGRAM_BYTES:-51200246144}"
+LLM_DRAGOON_VISION="${LLM_DRAGOON_VISION:-/home/dank/models/halogen-flashnext-v2/qwen38-flash-next-vision.hgn}"
+LLM_DRAGOON_VISION_BYTES="${LLM_DRAGOON_VISION_BYTES:-897916416}"
+LLM_DRAGOON_TOK_DIR="${LLM_DRAGOON_TOK_DIR:-/home/dank/models/halogen-flashnext-v2/tokenizer}"
+LLM_DRAGOON_TOK_FILES="${LLM_DRAGOON_TOK_FILES:-tokenizer.json chat_template.jinja tokenizer_config.json merges.txt vocab.json generation_config.json}"
 
-retire_halogen_large_quadlet() {
-    local trash="$HOME/.AGENTTRASH/20260919-orca-cutover/quadlet"
-    systemctl --user stop frank-large.service 2>/dev/null || true
-    if [[ -e "$quadlet_unit_dir/frank-large.container" ]]; then
-        mkdir -p "$trash"
-        mv -- "$quadlet_unit_dir/frank-large.container" "$trash/frank-large.container"
-        echo "retired quadlet frank-large.container -> $trash"
-    fi
+retire_halogen_dragoon_quadlet() {
+    retire_unit_file "$quadlet_unit_dir/frank-dragoon.container" \
+        "$HOME/.AGENTTRASH/20260919-orca-cutover/quadlet" frank-dragoon.service
     systemctl --user daemon-reload
 }
 
@@ -1147,186 +1132,159 @@ wait_port_free() {
     ss -tan "sport = :$port" >&2 || true
     return 1
 }
+# assert_unit_owns_port SERVICE PORT — the false-green gate every LLM
+# endpoint shares. A health answer proves the PORT replied, never WHO
+# replied: on 2026-09-26 a leftover probe held :7770, satisfied the curl,
+# and the deploy reported green over a stopped unit. Green requires the
+# unit's own MainPID to be alive behind the answer.
+assert_unit_owns_port() {
+    local service="$1" port="$2" main_pid
+    main_pid="$(run_privileged systemctl show -p MainPID --value "$service.service")"
+    if [[ -z "$main_pid" || "$main_pid" == "0" ]]; then
+        echo "FAIL: :$port answered but $service.service has no MainPID — a stray process holds the port" >&2
+        return 1
+    fi
+    echo "$service: health answered by unit MainPID $main_pid"
+}
 
-deploy_llm_large() {
-    # Refuse rather than restart-loop; every gate below has a twin in
-    # serve-frank-large.sh and they must agree (2026-10-01 lesson).
-    # Capture podman output before grepping: `podman images | grep -q`
-    # races under pipefail (SIGPIPE 141 becomes "no match", 2026-09-30).
-    if ! grep -qF "${LLM_LARGE_IMAGE#*@}" <<<"$(podman images --format '{{.RepoDigests}}' 2>/dev/null)"; then
-        echo "ERROR: halogen image absent: $LLM_LARGE_IMAGE" >&2
-        echo "frank-large: pull it: podman pull ${LLM_LARGE_IMAGE%@*}" >&2
-        return 1
-    fi
-    if [[ ! -f "$LLM_LARGE_CKPT" ]]; then
-        echo "ERROR: halogen checkpoint absent at $LLM_LARGE_CKPT" >&2
-        echo "frank-large: fetch it: bash scripts/download-frank-large-flashnext.sh" >&2
-        return 1
-    fi
-    if [[ "$(stat -c %s "$LLM_LARGE_CKPT")" != "$LLM_LARGE_CKPT_BYTES" ]]; then
-        echo "ERROR: halogen checkpoint is not $LLM_LARGE_CKPT_BYTES bytes (partial download?)" >&2
-        echo "frank-large: re-check: bash scripts/download-frank-large-flashnext.sh --verify-only" >&2
-        return 1
-    fi
-    for gate in "$LLM_LARGE_NGRAM:$LLM_LARGE_NGRAM_BYTES:n-gram table" \
-                "$LLM_LARGE_VISION:$LLM_LARGE_VISION_BYTES:vision tower"; do
-        IFS=: read -r gpath gbytes gname <<<"$gate"
-        if [[ ! -f "$gpath" ]]; then
-            echo "ERROR: halogen $gname absent at $gpath" >&2
-            echo "frank-large: fetch it: bash scripts/download-frank-large-flashnext.sh" >&2
-            return 1
-        fi
-        if [[ "$(stat -c %s "$gpath")" != "$gbytes" ]]; then
-            echo "ERROR: halogen $gname is not $gbytes bytes (partial download?)" >&2
-            echo "frank-large: re-check: bash scripts/download-frank-large-flashnext.sh --verify-only" >&2
-            return 1
-        fi
-    done
-    if [[ -L "$LLM_LARGE_TOK_DIR" || ! -d "$LLM_LARGE_TOK_DIR" ]]; then
-        echo "ERROR: tokenizer dir missing or a symlink at $LLM_LARGE_TOK_DIR" >&2
-        echo "frank-large: fetch it: bash scripts/download-frank-large-flashnext.sh" >&2
-        return 1
-    fi
-    for tf in $LLM_LARGE_TOK_FILES; do
-        if [[ ! -f "$LLM_LARGE_TOK_DIR/$tf" || -L "$LLM_LARGE_TOK_DIR/$tf" ]]; then
-            echo "ERROR: tokenizer file missing or a symlink: $LLM_LARGE_TOK_DIR/$tf" >&2
-            echo "frank-large: fetch it: bash scripts/download-frank-large-flashnext.sh" >&2
-            return 1
-        fi
-    done
+# start_root_unit — the tail every LLM root unit deploys: relink the unit
+# file from the checkout into /etc/systemd/system, (re)enable, restart,
+# wait for /health, and prove the answer came from the unit's own process.
+# The three endpoints differ in gates, ports, and budgets, never in this.
+start_root_unit() {
+    local service="$1" port="$2" health_limit="$3"
+    relink_unit "$service"
+    run_privileged systemctl daemon-reload
+    run_privileged systemctl enable "$service.service"
+    run_privileged systemctl restart "$service.service"
+    wait_for_health "$service" "http://127.0.0.1:${port}/health" "$health_limit" || return 1
+    assert_unit_owns_port "$service" "$port"
+}
 
-    retire_halogen_large_quadlet
+deploy_llm_dragoon() {
+    # Refuse rather than restart-loop; every gate here is the SAME library
+    # call the serve script makes, so the two twins cannot drift (the
+    # 2026-10-01 crash-loop lesson).
+    # Capture podman output before grepping is moot: require_image is one
+    # command, no pipe (the 2026-09-30 SIGPIPE lesson).
+    export GATE_PREFIX=frank-dragoon
+    require_image "$LLM_DRAGOON_IMAGE" \
+        "pull it: podman pull docker://${LLM_DRAGOON_IMAGE%@*}" || return 1
+    require_bytes "$LLM_DRAGOON_CKPT" checkpoint "$LLM_DRAGOON_CKPT_BYTES" \
+        "fetch it: bash scripts/download-frank-dragoon-flashnext.sh; re-check: --verify-only" || return 1
+    require_bytes "$LLM_DRAGOON_NGRAM" n-gram "$LLM_DRAGOON_NGRAM_BYTES" \
+        "fetch it: bash scripts/download-frank-dragoon-flashnext.sh; re-check: --verify-only" || return 1
+    require_bytes "$LLM_DRAGOON_VISION" vision "$LLM_DRAGOON_VISION_BYTES" \
+        "fetch it: bash scripts/download-frank-dragoon-flashnext.sh; re-check: --verify-only" || return 1
+    # shellcheck disable=SC2086
+    require_dir_files "$LLM_DRAGOON_TOK_DIR" tokenizer \
+        "fetch it: bash scripts/download-frank-dragoon-flashnext.sh" \
+        $LLM_DRAGOON_TOK_FILES || return 1
+
+    retire_halogen_dragoon_quadlet
     # The predecessor on a re-deploy is THIS unit: stop it (ExecStop stops
     # the container) before waiting on the port. The stray sweep is keyed
-    # on the FULL container name, which appears in the argv of a manual
-    # `podman run --name frank-large-halogen` / `podman wait` but NOT in
-    # this deployer's own command line (`bash deploy-remote.sh
-    # frank-large`) — so it cannot shoot itself in the foot (the fleet
-    # pkill law), and it can never match frank-secondary's llama-server.
-    run_privileged systemctl stop frank-large.service 2>/dev/null || true
-    pkill -f 'frank-large-halogen' 2>/dev/null || true
-    podman rm -f frank-large frank-large-halogen >/dev/null 2>&1 || true
+    # on the FULL container name: it appears in the argv of a manual
+    # `podman run --name frank-dragoon-halogen` / `podman wait`, while a
+    # pattern naming only the runtime would ALSO match this deployer's own
+    # command line — a pkill whose pattern hits its own argv takes the
+    # running deploy down with the target. The full name can never match
+    # frank-zealot's llama-server either.
+    run_privileged systemctl stop frank-dragoon.service 2>/dev/null || true
+    pkill -f 'frank-dragoon-halogen' 2>/dev/null || true
+    podman rm -f frank-dragoon frank-dragoon-halogen >/dev/null 2>&1 || true
     # Nothing may start until the predecessor has released the port
     # (2026-09-16: "Deactivated successfully" was not "port free").
     wait_port_free 7770 || return 1
-    relink_unit frank-large
-    run_privileged systemctl daemon-reload
-    run_privileged systemctl enable frank-large.service
-    run_privileged systemctl restart frank-large.service
-    wait_for_health frank-large http://127.0.0.1:7770/health 1200
+    start_root_unit frank-dragoon 7770 1200
 }
 
-# deploy_llm_secondary — frank-secondary is llama.cpp (master build, CUDA sm_86) on
+# deploy_llm_zealot — frank-zealot is llama.cpp (master build, CUDA sm_86) on
 # the RTX 3090 as a ROOT unit: the runtime is a native binary tree under
 # ~/GitPackages/llama-master/build-cuda, so there is no container image and
 # no generated unit to avoid. relink_unit points
-# /etc/systemd/system/frank-secondary.service at the repo file and boot
+# /etc/systemd/system/frank-zealot.service at the repo file and boot
 # persistence is that unit's [Install] section.
 #
-# It is a SEPARATE endpoint on port 7771; frank-large keeps 7770. The 3090 is
-# not shared: frank-large's engine runs on the gfx1151 iGPU.
-LLM_SECONDARY_MODEL_FILE="${LLM_SECONDARY_MODEL_FILE:-/home/dank/models/Swift15-UncIQ3XXS/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-RCO-IQ3_XXS.gguf}"
-LLM_SECONDARY_RUNTIME="${LLM_SECONDARY_RUNTIME:-/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server}"
-# The projector IS the vision capability here: the GGUF carries no vision
-# tensors, and the publisher ships mmproj-BF16.gguf in the same repo, so a
-# deploy that starts without this file silently ships a text-only
-# endpoint. Checked unconditionally, like frank-large's.
-LLM_SECONDARY_MMPROJ="${LLM_SECONDARY_MMPROJ:-/home/dank/models/Swift15-UncIQ3XXS/mmproj-BF16.gguf}"
+# It is a SEPARATE endpoint on port 7771; frank-dragoon keeps 7770. The 3090 is
+# not shared: frank-dragoon's engine runs on the gfx1151 iGPU.
+LLM_ZEALOT_MODEL_FILE="${LLM_ZEALOT_MODEL_FILE:-/home/dank/models/Qwen35-9B-HauhauCS-Q6K/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf}"
+LLM_ZEALOT_RUNTIME="${LLM_ZEALOT_RUNTIME:-/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server}"
+# The projector IS the vision capability here: the model is natively
+# multimodal and the Q6_K file carries no vision tensors — the publisher ships
+# its own BF16 projector in the same repo, so a deploy that starts without
+# this file silently ships a text-only endpoint. Checked unconditionally, like
+# frank-dragoon's.
+LLM_ZEALOT_MMPROJ="${LLM_ZEALOT_MMPROJ:-/home/dank/models/Qwen35-9B-HauhauCS-Q6K/mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf}"
 
-deploy_llm_secondary() {
+deploy_llm_zealot() {
     # Refuse rather than restart-loop: a unit whose runtime or payload is
     # missing never becomes healthy, and a green deploy would leave the
-    # endpoint dark with nothing in the log to say why.
-    if [[ ! -x "$LLM_SECONDARY_RUNTIME" ]]; then
-        echo "ERROR: llama.cpp runtime absent at $LLM_SECONDARY_RUNTIME" >&2
-        echo "frank-secondary: build it (cmake -B build-cuda -DGGML_CUDA=ON" >&2
-        echo "frank-secondary: -DCMAKE_CUDA_ARCHITECTURES=86 -DCMAKE_CUDA_HOST_COMPILER=/usr/bin/gcc-13" >&2
-        echo "frank-secondary: && cmake --build build-cuda --target llama-server) first." >&2
-        return 1
-    fi
-    for f in "$LLM_SECONDARY_MODEL_FILE" "$LLM_SECONDARY_MMPROJ"; do
-        if [[ ! -f "$f" ]]; then
-            echo "ERROR: frank-secondary payload file absent at $f" >&2
-            echo "frank-secondary: run scripts/download-frank-secondary.sh first;" >&2
-            echo "frank-secondary: refusing to start a unit that cannot load." >&2
-            return 1
-        fi
-    done
-    relink_unit frank-secondary
-    run_privileged systemctl daemon-reload
-    run_privileged systemctl enable frank-secondary.service
-    run_privileged systemctl restart frank-secondary.service
-    wait_for_health frank-secondary http://127.0.0.1:7771/health 900 || return 1
-    # False-green hardening (frank-large's lesson): the port answering
-    # proves nothing about WHO answers — the unit must be active with a
-    # live MainPID, or a stray SGLang holdover is masquerading as deployed.
-    local main_pid
-    main_pid="$(run_privileged systemctl show -p MainPID --value frank-secondary.service)"
-    if [[ -z "$main_pid" || "$main_pid" == "0" ]]; then
-        echo "FAIL: :7771 answered but frank-secondary.service has no MainPID — a stray process holds the port" >&2
-        return 1
-    fi
-    echo "frank-secondary: health answered by unit MainPID $main_pid"
+    # endpoint dark with nothing in the log to say why. Same library calls
+    # as serve-frank-zealot.sh, so the deployer's twin refuses identically.
+    export GATE_PREFIX=frank-zealot
+    require_exec "$LLM_ZEALOT_RUNTIME" runtime \
+        "build it: cmake -B build-cuda -DGGML_CUDA=ON -DCMAKE_CUDA_ARCHITECTURES=86" \
+        || return 1
+    require_file "$LLM_ZEALOT_MODEL_FILE" gguf \
+        "fetch it: bash scripts/download-frank-zealot.sh" || return 1
+    require_file "$LLM_ZEALOT_MMPROJ" mmproj \
+        "fetch it: bash scripts/download-frank-zealot.sh" || return 1
+
+    start_root_unit frank-zealot 7771 900
 }
 
-# deploy_llm_primary — frank-primary is the radiance engine (StillDeadcode,
+# deploy_llm_archon — frank-archon is the radiance engine (StillDeadcode,
 # digest-pinned stilldeadcode/radiance image) serving the OFFICIAL
 # Qwen/Qwen3.8-Flash-Next-FP8 at native block-FP8 precision from the
 # rad-convert container qwen4exp-fp8-native.rad, on BOTH R9700s (TP=2) as a
 # ROOT unit whose serve script drives `podman run` directly (the engine is
 # the image entrypoint; the image lives in dank's rootless podman storage).
 # 2026-10-05 cutover from FreeToken (pre-cutover tag
-# frank-primary-freetoken-pr587-20261005); before that, the tcclaviger vLLM
-# fork (tag frank-primary-vllm-shapeG-20261003). Same port and alias; the
+# frank-archon-freetoken-pr587-20261005); before that, the tcclaviger vLLM
+# fork (tag frank-archon-vllm-shapeG-20261003). Same port and alias; the
 # harness models.yml id is unchanged.
 #
 # Gates: the image must exist under its digest ref in dank's rootless
-# storage (FRANK_PRIMARY_IMAGE), the .rad container file must exist at the
-# env's size floor (FRANK_PRIMARY_MODEL_FILE >= FRANK_PRIMARY_RAD_MIN_MIB —
+# storage (FRANK_ARCHON_IMAGE), the .rad container file must exist at the
+# env's size floor (FRANK_ARCHON_MODEL_FILE >= FRANK_ARCHON_RAD_MIN_MIB —
 # a truncated convert is a guaranteed long-timeout boot), and the unit env
 # must be complete. Per-file sha256 verification is the fetch script's job
 # at download time and rad-convert/rad-info's job at build time, never
 # re-hashed here.
-LLM_PRIMARY_CONTAINER=frank-primary
-LLM_PRIMARY_LEGACY_CONTAINERS="frank-primary-qwen frank-primary-r9v qwen-fp8 glm-probe"
+LLM_ARCHON_CONTAINER=frank-archon
+LLM_ARCHON_LEGACY_CONTAINERS="frank-archon-qwen frank-archon-r9v qwen-fp8 glm-probe"
 
-deploy_llm_primary() {
+deploy_llm_archon() {
     # Refuse rather than restart-loop: a unit whose image or payload is
     # missing never becomes healthy, and a green deploy would leave the
-    # endpoint dark with nothing in the log to say why.
-    local env_file="/home/dank/serverAppConfigs/scripts/frank-primary.env"
-    local image model_dir model_file rad_min mib
+    # endpoint dark with nothing in the log to say why. The gates are the
+    # shared library's, called with the values the unit's own env file
+    # declares — so serve-frank-archon.sh and this handler cannot disagree,
+    # and the payload path lives in exactly one file.
+    export GATE_PREFIX=frank-archon
+    local env_file="${LLM_ARCHON_ENV_FILE:-$REMOTE_DIR/scripts/frank-archon.env}"
+    local image model_dir model_file rad_min
     if [[ ! -f "$env_file" ]]; then
-        echo "ERROR: frank-primary env file absent: $env_file" >&2
+        echo "frank-archon: env: missing at $env_file" >&2
+        echo "  hint: deploy the repo checkout first ($REMOTE_DIR)" >&2
         return 1
     fi
-    image="$(sed -n 's/^FRANK_PRIMARY_IMAGE=//p' "$env_file" | tail -1)"
-    model_dir="$(sed -n 's/^FRANK_PRIMARY_MODEL_DIR=//p' "$env_file" | tail -1)"
-    model_file="$(sed -n 's/^FRANK_PRIMARY_MODEL_FILE=//p' "$env_file" | tail -1)"
-    rad_min="$(sed -n 's/^FRANK_PRIMARY_RAD_MIN_MIB=//p' "$env_file" | tail -1)"
+    image="$(sed -n 's/^FRANK_ARCHON_IMAGE=//p' "$env_file" | tail -1)"
+    model_dir="$(sed -n 's/^FRANK_ARCHON_MODEL_DIR=//p' "$env_file" | tail -1)"
+    model_file="$(sed -n 's/^FRANK_ARCHON_MODEL_FILE=//p' "$env_file" | tail -1)"
+    rad_min="$(sed -n 's/^FRANK_ARCHON_RAD_MIN_MIB=//p' "$env_file" | tail -1)"
     if [[ -z "$image" || -z "$model_dir" || -z "$model_file" || -z "$rad_min" ]]; then
-        echo "ERROR: frank-primary.env missing FRANK_PRIMARY_IMAGE/MODEL_DIR/MODEL_FILE/RAD_MIN_MIB" >&2
-        return 1
-    fi
-    # The image gate is the digest ref itself: a name@sha256 ref exists in
-    # storage only if THAT manifest was pulled. One command — no
-    # pipefail/grep race (the 2026-09-30 lesson).
-    if ! podman image exists "$image"; then
-        echo "ERROR: runtime image absent from storage: $image" >&2
-        echo "frank-primary: podman pull docker://stilldeadcode/radiance:latest" >&2
-        return 1
-    fi
-    if [[ ! -f "$model_dir/$model_file" ]]; then
-        echo "ERROR: .rad container missing: $model_dir/$model_file" >&2
-        echo "frank-primary: run scripts/build-frank-primary-rad.sh" >&2
-        return 1
-    fi
-    mib=$(( $(stat -c %s "$model_dir/$model_file") / 1048576 ))
-    if [[ "$mib" -lt "$rad_min" ]]; then
-        echo "ERROR: .rad container too small: $model_dir/$model_file is ${mib} MiB, want >= $rad_min" >&2
-        echo "frank-primary: rebuild it (scripts/build-frank-primary-rad.sh --force)" >&2
+        echo "frank-archon: env: missing FRANK_ARCHON_IMAGE/MODEL_DIR/MODEL_FILE/RAD_MIN_MIB" >&2
+        echo "  hint: scripts/frank-archon.env" >&2
         return 1
     fi
+    require_image "$image" \
+        "pull it: podman pull docker://stilldeadcode/radiance:latest (as dank)" \
+        || return 1
+    require_min_mib "$model_dir/$model_file" ".rad" "$rad_min" \
+        "convert it: scripts/convert-swift15-w4dn8.sh (rad-info is the record)" \
+        || return 1
 
     # A stale container with the same name makes `podman run --name` fail at
     # start; remove any leftover from a failed previous attempt.
@@ -1336,50 +1294,24 @@ deploy_llm_primary() {
     # The legacy identities (the retired R9V container, the ad hoc
     # experiment container qwen-fp8, the retired glm-probe) hold the same
     # GPUs and die here too.
-    run_privileged systemctl stop frank-primary.service 2>/dev/null || true
+    run_privileged systemctl stop frank-archon.service 2>/dev/null || true
     local ctr
-    for ctr in $LLM_PRIMARY_LEGACY_CONTAINERS "$LLM_PRIMARY_CONTAINER"; do
+    for ctr in $LLM_ARCHON_LEGACY_CONTAINERS "$LLM_ARCHON_CONTAINER"; do
         podman rm -f "$ctr" >/dev/null 2>&1 || true
     done
     # Nothing starts until the port is released: the lucebox cutover
-    # (2026-09-26) and the frank-large cutover (2026-09-16) both failed
+    # (2026-09-26) and the frank-dragoon cutover (2026-09-16) both failed
     # exactly here when the next engine bound 7770 a second too early.
     wait_port_free 7770 || return 1
-    relink_unit frank-primary
-    run_privileged systemctl daemon-reload
-    run_privileged systemctl enable frank-primary.service
-    run_privileged systemctl restart frank-primary.service
     # Cold start: .rad load + PLE pin + expert host-pool upload (the
-    # publisher's compose healthcheck allows a 15-minute start_period).
-    # Parity with every predecessor on this port. The HTTP listener binds
-    # AFTER the full load (main.cpp: engine.start() then engine.serve()),
-    # so during load the port REFUSES connections — a bare curl is honest
-    # here, unlike FreeToken's 200-while-loading body. (The MainPID check
-    # below still guards the stray-port case.)
-    local i ok=0
-    for ((i=1; i<=900; i++)); do
-        if curl -fsS http://127.0.0.1:7770/health 2>/dev/null >/dev/null; then
-            echo "frank-primary engine healthy after approximately $((i * 2))s"
-            ok=1
-            break
-        fi
-        sleep 2
-    done
-    if [[ "$ok" != 1 ]]; then
-        echo "FAIL: frank-primary /health never answered 200 in 1800s" >&2
-        return 1
-    fi
-    # False-green hardening (the 2026-09-26 lesson): a bare curl against the
-    # port cannot tell WHO answers — a stray probe holding :7770 satisfies
-    # it while the unit is stopped. The deploy is only green if the unit
-    # itself is active with a live MainPID behind the health answer.
-    local main_pid
-    main_pid="$(run_privileged systemctl show -p MainPID --value frank-primary.service)"
-    if [[ -z "$main_pid" || "$main_pid" == "0" ]]; then
-        echo "FAIL: :7770 answered but frank-primary.service has no MainPID — a stray process holds the port" >&2
-        return 1
-    fi
-    echo "frank-primary: health answered by unit MainPID $main_pid"
+    # publisher's compose healthcheck allows a 15-minute start_period) —
+    # the 900-iteration budget is 1800s, parity with every predecessor on
+    # this port. The HTTP listener binds AFTER the full load (main.cpp:
+    # engine.start() then engine.serve()), so during load the port REFUSES
+    # connections — a bare curl is honest here, unlike FreeToken's
+    # 200-while-loading body. (start_root_unit's MainPID check still
+    # guards the stray-port case.)
+    start_root_unit frank-archon 7770 900
 }
 
 wait_for_health() {
@@ -1566,9 +1498,9 @@ deploy_service() {
         anubis) deploy_anubis ;;
         seerr) deploy_seerr ;;
         marreta) deploy_marreta ;;
-        frank-large) deploy_llm_large ;;
-        frank-secondary) deploy_llm_secondary ;;
-        frank-primary) deploy_llm_primary ;;
+        frank-dragoon) deploy_llm_dragoon ;;
+        frank-zealot) deploy_llm_zealot ;;
+        frank-archon) deploy_llm_archon ;;
         hermes|hermes-dashboard|hermes-webui) deploy_hermes ;;
         romm|romm-mariadb|romm-redis|mariadb|redis) deploy_romm_stack "$service" ;;
         jellyfin) deploy_jellyfin ;;
@@ -1579,7 +1511,12 @@ deploy_service() {
         tautulli) deploy_tautulli ;;
         prometheus|grafana|loki|alloy|node-exporter|alertmanager) deploy_observability "$service" ;;
         comfyui) deploy_comfyui ;;
-        *) deploy_compose_service "$service" ;;
+        *)
+            # Every deployable service on every target has a handler above
+            # (inventory = allow-list, so nothing unreachable arrives).
+            echo "no handler for service: $service" >&2
+            exit 2
+            ;;
     esac
 }
 

scripts/deploy.sh

@@ -35,7 +35,7 @@ Options:
 Examples:
   ./scripts/deploy.sh dankclaw
   ./scripts/deploy.sh dankclaw --service searxng
-  ./scripts/deploy.sh dankserver --service frank-primary
+  ./scripts/deploy.sh dankserver --service frank-archon
   ./scripts/deploy.sh dankclaw --dry-run
 EOF
 }
@@ -131,31 +131,13 @@ else
 fi
 
 valid_service() {
-    local service="$1"
-    case "$TARGET:$service" in
-        dankclaw:caddy|dankclaw:gluetun|dankclaw:searxng-network|dankclaw:searxng-valkey|\
-        dankclaw:searxng|dankclaw:marreta|dankclaw:pihole|dankclaw:open-webui|dankclaw:gitea-postgres|\
-        dankclaw:gitea-server|dankclaw:homepage|\
-        dankclaw:comfyui|dankclaw:hermes|dankclaw:hermes-dashboard|\
-        dankclaw:hermes-webui|dankclaw:prometheus|dankclaw:grafana|dankclaw:loki|dankclaw:alloy|\
-        dankclaw:alertmanager|\
-        dankclaw:node-exporter|dankclaw:authentik-postgres|dankclaw:authentik-server|\
-        dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:authentik-outpost-ldap|dankclaw:anubis|dankclaw:seerr|\
-        dankclaw:frank-large|dankclaw:frank-secondary|\
-        dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
-        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:calibre-server|dankserver:plex|dankserver:tautulli|\
-        dankserver:qbittorrent|dankserver:radarr|dankserver:sonarr|\
-        dankserver:lidarr|dankserver:readarr|dankserver:node-exporter|\
-        dankserver:frank-primary|\
-        frankbook-pro:gluetun|frankbook-pro:qbittorrent|frankbook-pro:prowlarr|\
-        frankbook-pro:radarr|frankbook-pro:sonarr|frankbook-pro:lidarr|\
-        frankbook-pro:readarr)
-            return 0
-            ;;
-        *)
-            return 1
-            ;;
-    esac
+    # The inventory is the only allow-list (see scripts/service-map.py);
+    # service-map's "allows" exit code is the answer. The former literal
+    # case list here drifted from reality (it still listed the *arr stack
+    # under dankserver, which moved to frankbook-pro, and a
+    # "searxng-network" name that is a generated systemd unit, not a
+    # deployable service).
+    python3 "$REPO_ROOT/scripts/service-map.py" allows --host "$TARGET" --service "$1" >/dev/null
 }
 
 for service in "${EXPLICIT_SERVICES[@]}"; do

scripts/derive-protected-experts.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""derive-protected-experts.py — rewrite the recipe's protected-expert section
+from a calibration recording. RUNS ON DANKSERVER (venv: numpy).
+
+The selection rule (docs/MOE-W4.md "Protected experts", restated in the recipe):
+an expert whose share of its layer's down-input energy is at least 3% AND
+at least three times its share of the routing is kept bf16; the count must
+be EVEN on each rank's half of the layer (the four-bit GEMM takes the rest
+as two equal tables by parity) — an odd half gains its next most energetic
+non-qualifying expert.
+
+Data: the calibration dir's per-expert down Grams,
+gram.r<rank>.blk.L.ffn_down_exps.<e>.bin — 32-byte RADGRAM2 header
+(magic, k, rank, rows, domain) then k*k f32, named with the checkpoint's
+GLOBAL expert numbering (arch/common/rad_block_moe_fp8.h: ge =
+expert_base + e). rows (header) is the expert's routing count; the trace
+of the Gram is its down-input energy. Rank halves: 0-255, 256-511
+(contiguous expert_base split at TP=2).
+
+Output: the cast-rule lines (recipe format) on stdout, a report on stderr.
+
+Usage: derive-protected-experts.py <calib dir> [--min-share 0.03]
+       [--min-route-mult 3.0]
+"""
+import argparse
+import glob
+import os
+import re
+import struct
+import sys
+
+import numpy as np
+
+NAME_RE = re.compile(r"^gram\.r(\d)\.blk\.(\d+)\.ffn_down_exps\.(\d+)\.bin$")
+
+
+def read_gram(path):
+    """(k, rank, rows, trace) from a RADGRAM2 file (full matrix on disk)."""
+    with open(path, "rb") as f:
+        hdr = f.read(32)
+        magic, k, rank, rows, domain = struct.unpack("<8sIIQI", hdr[:28])
+        if magic != b"RADGRAM2":
+            raise SystemExit(f"not a RADGRAM2 file: {path}")
+        n = k * k
+        a = np.frombuffer(f.read(n * 4), dtype=np.float32)
+        if a.size != n:
+            raise SystemExit(f"short gram file: {path}")
+        tr = float(a.reshape(k, k).diagonal().sum())
+    return k, rank, int(rows), tr
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("calib_dir")
+    ap.add_argument("--min-share", type=float, default=0.03)
+    ap.add_argument("--min-route-mult", type=float, default=3.0)
+    a = ap.parse_args()
+
+    # layer -> global expert -> (rank, rows, energy)
+    data = {}
+    for path in sorted(glob.glob(os.path.join(
+            a.calib_dir, "gram.r*.ffn_down_exps.*.bin"))):
+        m = NAME_RE.match(os.path.basename(path))
+        if not m:
+            continue
+        rank, layer, expert = int(m.group(1)), int(m.group(2)), int(m.group(3))
+        k, _, rows, tr = read_gram(path)
+        data.setdefault(layer, {})[expert] = (rank, rows, tr)
+
+    if not data:
+        raise SystemExit("no per-expert down grams found")
+
+    lines, report = [], []
+    total = 0
+    for layer in sorted(data):
+        experts = data[layer]
+        tot_e = sum(v[2] for v in experts.values())
+        tot_r = sum(v[1] for v in experts.values())
+        if tot_e <= 0 or tot_r <= 0:
+            report.append(f"blk.{layer}: empty recording, skipped")
+            continue
+        qual, pool = [], []
+        for e, (rank, rows, tr) in experts.items():
+            es, rs = tr / tot_e, rows / max(tot_r, 1)
+            rec = (e, rank, es, rs)
+            if es >= a.min_share and es >= a.min_route_mult * rs:
+                qual.append(rec)
+            elif es > 0:
+                pool.append(rec)
+        chosen = {r[0]: (r[2], r[3]) for r in qual}
+        for half in (0, 1):  # rank halves by the contiguous expert_base split
+            n_half = sum(1 for e in chosen if e // 256 == half)
+            if n_half % 2:
+                pool.sort(key=lambda r: -r[2])
+                for cand in pool:
+                    if cand[1] == half and cand[0] not in chosen:
+                        chosen[cand[0]] = (cand[2], cand[3])
+                        report.append(
+                            f"blk.{layer}: half {half} odd -> added e{cand[0]} "
+                            f"(energy {cand[2]*100:.2f}%)")
+                        break
+        for e in sorted(chosen):
+            es, rs = chosen[e]
+            lines.append(f"blk.{layer}.ffn_*_exps.{e}.weight"
+                         f"         cast dtype=bf16")
+            report.append(f"blk.{layer} e{e:3d} (rank {e // 256}): "
+                          f"energy {es*100:5.2f}%, routing {rs*100:5.3f}%, "
+                          f"ratio {es/max(rs,1e-12):6.1f}")
+        total += len(chosen)
+
+    print("\n".join(lines))
+    print("\n".join(report), file=sys.stderr)
+    print(f"total protected: {total}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()

scripts/download-frank-archon-swift15.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# download-frank-archon-swift15.sh — payload fetch/verify for the planned
+# frank-archon swap to the Swift 1.5 finetune: ukisai/Swift1.5-Qwen3.8-Flash-Next
+# (BF16 source, 149 files, 360,037,355,038 bytes = 335.3 GiB: 131 safetensors
+# shards + weight-map index + tokenizer + vision preprocessing configs + chat
+# template + licenses). Key set verified identical to the official
+# Qwen/Qwen3.8-Flash-Next base (0 added / 0 missing), so the qwen4exp recipes
+# apply verbatim; the checkpoint ships BF16 with NO quantization_config.
+# Repo is UNGATED — no token needed (never put one on the command line).
+#
+#   bash scripts/download-frank-archon-swift15.sh --fetch         resume/complete
+#   bash scripts/download-frank-archon-swift15.sh                 verify only
+#
+# Fetch uses the vendored scripts/hfget.sh (StillDeadcode's Apache-2.0
+# listing/resume downloader, curl+jq only): per-file size checks against
+# the Hub listing, `-C -` resume, pickle-format duplicates skipped.
+# Verify (default) is three independent agreements: every listed file
+# present with the listed size (catches truncation), the shard count
+# matching the weight-map index (catches omissions), and every shard's
+# sha256 equal to the Hub's LFS oid (catches substituted content).
+# Verify needs only the public API.
+set -euo pipefail
+
+REPO="ukisai/Swift1.5-Qwen3.8-Flash-Next"
+DEST="/home/dank/models/ukisai/Swift1.5-Qwen3.8-Flash-Next"
+EXPECTED_SHARDS=131
+
+mode="verify"
+[[ "${1:-}" == "--fetch" ]] && mode="fetch"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ "$mode" == "fetch" ]]; then
+    # HFGET_JOBS=4 is hfget's default (a few streams saturate the link).
+    bash "$SCRIPT_DIR/hfget.sh" "$REPO" "$DEST" main
+fi
+
+echo "verifying local payload: $DEST"
+fail=0
+
+INDEX="$DEST/model.safetensors.index.json"
+if [[ ! -f "$INDEX" ]]; then
+    echo "  BAD  weight-map index missing: $INDEX" >&2
+    exit 1
+fi
+
+python3 - "$REPO" "$DEST" <<'PY' || fail=1
+import hashlib, json, os, sys, urllib.request
+
+repo, dest = sys.argv[1], sys.argv[2]
+
+def listing():
+    """The tree API, following the Link cursor exactly like hfget.sh."""
+    out, api, pages = [], (
+        f"https://huggingface.co/api/models/{repo}/tree/main"
+        "?recursive=true&expand=true"), 0
+    while api:
+        with urllib.request.urlopen(api) as r:
+            out += json.load(r)
+            api = None
+            link = r.headers.get("Link", "")
+            for part in link.split(","):
+                if 'rel="next"' in part:
+                    api = part[part.find("<") + 1:part.find(">")]
+        pages += 1
+        if pages > 200:
+            raise SystemExit("listing did not terminate")
+    return out
+
+files = [e for e in listing() if e.get("type") == "file"]
+sizes = {e["path"]: e.get("size", 0) for e in files}
+lfs = {e["path"]: e["lfs"]["oid"] for e in files if e.get("lfs")}
+
+bad = 0
+for path, want in sorted(sizes.items()):
+    p = os.path.join(dest, path)
+    if not os.path.isfile(p):
+        print(f"  BAD  {path}: missing")
+        bad += 1
+    elif os.path.getsize(p) != want:
+        print(f"  BAD  {path}: {os.path.getsize(p)} bytes, listing says {want}")
+        bad += 1
+print(f"  {'OK' if bad == 0 else 'FAIL'}: {len(sizes) - bad}/{len(sizes)} files present at listed size")
+if bad:
+    raise SystemExit(1)
+
+# Shard set against the weight-map index.
+wm = json.load(open(os.path.join(dest, "model.safetensors.index.json")))["weight_map"]
+shards = sorted(set(wm.values()))
+print(f"  index maps {len(wm)} tensors across {len(shards)} shards")
+if len(shards) != 131:
+    print(f"  BAD  shard count {len(shards)}, want 131")
+    raise SystemExit(1)
+
+# Content: every LFS-tracked file hashed against the Hub oid. The safetensors
+# shards dominate the bytes; tokenizer/config files ride the same check when
+# the Hub tracks them in LFS (they are plain blobs here, already size-checked).
+todo = [p for p in shards if p in lfs]
+for i, path in enumerate(todo):
+    h = hashlib.sha256()
+    with open(os.path.join(dest, path), "rb") as f:
+        for chunk in iter(lambda: f.read(1 << 24), b""):
+            h.update(chunk)
+    if h.hexdigest() != lfs[path]:
+        print(f"  BAD  {path}: sha256 mismatch (want {lfs[path]})")
+        bad += 1
+    if (i + 1) % 16 == 0:
+        print(f"  ...hashed {i + 1}/{len(todo)}")
+print(f"  {'OK' if bad == 0 else 'FAIL'}: {len(todo) - bad}/{len(todo)} shards sha256-match the Hub")
+if bad:
+    raise SystemExit(1)
+PY
+
+[[ "$fail" -eq 0 ]] || exit 1
+echo "payload verified: 131 shards + index + tokenizer + configs, sizes and sha256 checked"

scripts/download-frank-archon.sh

@@ -1,21 +1,22 @@
 #!/usr/bin/env bash
-# download-frank-primary.sh — payload fetch/verify for frank-primary:
+# download-frank-archon.sh — payload fetch/verify for frank-archon:
 # the OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 checkpoint (131 safetensors
 # shards + weight-map index + tokenizer + vision preprocessing configs,
 # ~172.8 GB). 2026-10-05: replaces the orcarouter uncensored payload of the
 # FreeToken era (that script lived here; its repo was gated and needed
 # HF_TOKEN — this one is UNGATED and needs no token at all).
 #
-#   bash scripts/download-frank-primary.sh --fetch         resume/complete
-#   bash scripts/download-frank-primary.sh                 verify only
+#   bash scripts/download-frank-archon.sh --fetch         resume/complete
+#   bash scripts/download-frank-archon.sh                 verify only
 #
 # Fetch uses the vendored scripts/hfget.sh (StillDeadcode's Apache-2.0
 # listing/resume downloader, curl+jq only): per-file size checks against
 # the Hub listing, `-C -` resume, pickle-format duplicates skipped.
-# Verify (default) is the AGENTS.md law in three parts: every listed file
-# present with the listed size, the shard count matches the weight-map
-# index, and every shard's sha256 equals the Hub's LFS oid. Verify needs
-# only the public API.
+# Verify (default) is three independent agreements: every listed file
+# present with the listed size (catches truncation), the shard count
+# matching the weight-map index (catches omissions), and every shard's
+# sha256 equal to the Hub's LFS oid (catches substituted content).
+# Verify needs only the public API.
 set -euo pipefail
 
 REPO="Qwen/Qwen3.8-Flash-Next-FP8"

scripts/download-frank-dragoon-flashnext.sh

@@ -1,15 +1,18 @@
 #!/usr/bin/env bash
-# download-frank-large-flashnext.sh — fetch frank-large's flash-server v2
+# download-frank-dragoon-flashnext.sh — fetch frank-dragoon's flash-server v2
 # payload: the Quat3rnion abliterated Swift1.5 checkpoint of peonist's v2
 # .hgn, the REQUIRED lookup table and the optional vision tower from
 # peonist-ai/halogen-qwen3.8-flash-next (both at the revisions the model
 # card pins), and the flat tokenizer the two repos share. All public, no
-# token — and per the fleet secret law, none would ever touch argv.
+# token needed — and a secret would never be passed via argv anyway: the
+# command line is world-readable through /proc, so any token placed there
+# leaks to every process-listing tool on the host.
 #
-# The fetch law, same as every sibling script: curl -f (an access error
-# must not become a "successful" 153-byte artifact), exact byte count from
-# the Hub tree API, LFS sha256 verification, --verify-only to re-check an
-# existing payload without downloading.
+# The fetch rules, uniform across every sibling script: curl -f so an
+# access error fails loudly instead of writing the error body as a
+# "successful" tiny artifact; the exact byte count from the Hub tree API;
+# LFS sha256 verification; --verify-only to re-check an existing payload
+# without downloading.
 #
 # File manifest (verified against the Hub tree API on 2026-10-06):
 #   qwen38-flash-next-v2-swift15-abliterated.hgn  66,687,678,464 B  sha256
@@ -26,10 +29,12 @@
 #   tokenizer/* @e053f488 — byte-identical to the 27B-era tokenizer
 #     already on disk (tokenizer.json LFS
 #     0997f410c57a1f4e53b09e4be8f4a172d90edd9564368fb0847030937229b9f3);
-#     fetched fresh rather than symlinked, per the no-symlink law.
+#     fetched fresh, never symlinked: a snapshot link points into the
+#     host-side cache directory, which does not exist inside the
+#     container mount, so the link dangles exactly where it is consumed.
 set -euo pipefail
 
-DEST="${FRANK_LARGE_MODEL_DIR:-$HOME/models/halogen-flashnext-v2}"
+DEST="${FRANK_DRAGOON_MODEL_DIR:-$HOME/models/halogen-flashnext-v2}"
 ABLIT="https://huggingface.co/Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated/resolve/main"
 PEONIST="https://huggingface.co/peonist-ai/halogen-qwen3.8-flash-next/resolve"
 NGRAM_REV="5cc17cea1a10b502b4a5db41d8d2b1a0f22dba26"

scripts/download-frank-dragoon-halogen.sh

@@ -1,16 +1,18 @@
 #!/usr/bin/env bash
-# download-frank-large-halogen.sh — fetch frank-large's halogen payload:
+# download-frank-dragoon-halogen.sh — fetch frank-dragoon's halogen payload:
 # the qwen3.8-27b .hgn checkpoint and the export tokenizer, from the
-# PUBLIC peonist-ai/halogen-qwen3.8-27b repo (no token — and per the fleet
-# secret law, none would ever touch argv).
+# PUBLIC peonist-ai/halogen-qwen3.8-27b repo (no token — and a token
+# would never travel in argv: command lines are world-readable through
+# /proc, so a secret placed there leaks to any process-listing tool).
 #
-# The fetch law, same as every sibling script: curl -f (an access error
-# must not become a "successful" 153-byte artifact), exact byte count from
-# the model card, LFS sha256 verification, --verify-only to re-check an
-# existing payload without downloading.
+# The fetch rules, uniform across every sibling script: curl -f so an
+# access error fails loudly instead of writing the error body as a
+# "successful" tiny artifact; the exact byte count from the model card;
+# LFS sha256 verification; --verify-only to re-check an existing payload
+# without downloading.
 set -euo pipefail
 
-DEST="${FRANK_LARGE_MODEL_DIR:-$HOME/models/halogen-qwen3.8-27b}"
+DEST="${FRANK_DRAGOON_MODEL_DIR:-$HOME/models/halogen-qwen3.8-27b}"
 BASE="https://huggingface.co/peonist-ai/halogen-qwen3.8-27b/resolve/main"
 
 FILES=(qwen3.8-27b-p1w4d-d2.hgn

scripts/download-frank-dragoon-kingjones-uncensored.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Download kingjones777/Qwen3.8-27B-Uncensored-ROCmFP4-STRIX-MTP-GGUF for
-# frank-large (Dankclaw iGPU). Public repo — no auth header, and never a token
+# frank-dragoon (Dankclaw iGPU). Public repo — no auth header, and never a token
 # on the command line (it is world-readable in /proc/<pid>/cmdline).
 #
 # The payload is the repo's Q6 AGENT rung:
@@ -10,7 +10,7 @@
 #     names for MTP serving ("Take Q6 AGENT (114) if you want protected
 #     heads"). Like every ROCmFPX file it loads on nothing but the fork.
 #
-# The other two files frank-large needs are NOT re-downloaded:
+# The other two files frank-dragoon needs are NOT re-downloaded:
 #   * mtp-Qwen3.8-27B-Q4_0.gguf — the uncensored repo redistributes the
 #     ALIGNED repo's draft head byte for byte (identical Hub LFS oid
 #     051a1764…), so it is hardlinked out of the aligned payload dir when that
@@ -25,7 +25,7 @@
 # byte count and the Hub LFS sha256. Idempotent: complete files are skipped.
 #
 # Usage:
-#   scripts/download-frank-large-kingjones-uncensored.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-kingjones-uncensored.sh [DEST_DIR] [--verify-only]
 set -euo pipefail
 
 REPO="kingjones777/Qwen3.8-27B-Uncensored-ROCmFP4-STRIX-MTP-GGUF"

scripts/download-frank-dragoon-kingjones.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Download kingjones777/Qwen3.8-27B-ROCmFP4-STRIX-MTP-GGUF for frank-large
+# Download kingjones777/Qwen3.8-27B-ROCmFP4-STRIX-MTP-GGUF for frank-dragoon
 # (Dankclaw iGPU). Public repo — no auth header, and never a token on the
 # command line (it is world-readable in /proc/<pid>/cmdline).
 #
@@ -24,7 +24,7 @@
 # come from the Hub LFS oids (api/models/<repo>/tree/main).
 #
 # Usage:
-#   scripts/download-frank-large-kingjones.sh [DEST_DIR] [--verify-only]
+#   scripts/download-frank-dragoon-kingjones.sh [DEST_DIR] [--verify-only]
 set -euo pipefail
 
 REPO="kingjones777/Qwen3.8-27B-ROCmFP4-STRIX-MTP-GGUF"

scripts/download-frank-dragoon-orca.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# Download and assemble jcbtc/Qwen3.8-Flash-CIRU-STRIX-Orca (the frank-large
+# Download and assemble jcbtc/Qwen3.8-Flash-CIRU-STRIX-Orca (the frank-dragoon
 # model) on Dankclaw.
 #
-#   bash scripts/download-frank-large-orca.sh
-#   bash scripts/download-frank-large-orca.sh --verify-only
+#   bash scripts/download-frank-dragoon-orca.sh
+#   bash scripts/download-frank-dragoon-orca.sh --verify-only
 #
 # The package is 136 GB of Hub-sized transport parts (HF caps new uploads at
 # 50 GB, so the 79 GB main GGUF, the 52 GB PLE payload and the 4 GB MTP head
@@ -105,4 +105,4 @@ fi
 echo "verifying assembled files against SHA256SUMS"
 (cd "$MODEL_DIR" && sha256sum -c SHA256SUMS)
 (cd "$MODEL_DIR/vision" && sha256sum -c SHA256SUMS)
-echo "frank-large payload complete: $MODEL_DIR"
+echo "frank-dragoon payload complete: $MODEL_DIR"

scripts/download-frank-dragoon-q4.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# Download the Q4_K_XL frank-large payload on Dankclaw:
+# Download the Q4_K_XL frank-dragoon payload on Dankclaw:
 #   unsloth/Qwen3.8-27B-GGUF  ->  Qwen3.8-27B-UD-Q4_K_XL.gguf
 #
-#   bash scripts/download-frank-large-q4.sh
-#   bash scripts/download-frank-large-q4.sh --verify-only
+#   bash scripts/download-frank-dragoon-q4.sh
+#   bash scripts/download-frank-dragoon-q4.sh --verify-only
 #
 # Integrity: the file is checked against its declared byte count and sha256
 # (the LFS oid from the Hub tree API, 2026-10-01). NO AUTH HEADER IS USED:
@@ -21,12 +21,12 @@
 # x 2 (K,V) x 2 B), so 4 sessions x 163840 ctx = 640,000 tokens = 39.06 GiB.
 #
 # The speculative drafter is UNCHANGED and still fetched by its own script
-# (scripts/download-frank-large.sh, z-lab's Hub repo). That name must not
-# appear here at all — the frank-large seam greps THIS file for it to prove
+# (scripts/download-frank-dragoon.sh, z-lab's Hub repo). That name must not
+# appear here at all — the frank-dragoon seam greps THIS file for it to prove
 # the drafter was not folded into the payload fetch.
 #
 # NOTE ON MTP: this payload has no baked-in MTP head (the Hub repo ships one
-# separately as MTP/mtp-Qwen3.8-27B-Q4_0.gguf). frank-large does not need it —
+# separately as MTP/mtp-Qwen3.8-27B-Q4_0.gguf). frank-dragoon does not need it —
 # spec decode here is the block-diffusion drafter, not MTP.
 set -euo pipefail
 

scripts/download-frank-dragoon-swift.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Download the Swift-1.5 frank-large candidate on Dankclaw:
+# Download the Swift-1.5 frank-dragoon candidate on Dankclaw:
 #   ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF
 #     Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-UD-Q8_K_XL.gguf
 #
-#   bash scripts/download-frank-large-swift.sh
-#   bash scripts/download-frank-large-swift.sh --verify-only
+#   bash scripts/download-frank-dragoon-swift.sh
+#   bash scripts/download-frank-dragoon-swift.sh --verify-only
 #
 # Integrity: the file is checked against its declared byte count and sha256
 # (the LFS oid from the Hub, 2026-09-28). NO AUTH HEADER IS USED: the repo is
@@ -15,9 +15,9 @@
 # Layout after a successful run (MODEL_DIR):
 #   Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-UD-Q8_K_XL.gguf  31457990272
 #
-# This is the CANDIDATE payload, not the deployed one. frank-large still
-# serves scripts/download-frank-large.sh's output; do not repoint
-# frank-large.env at MODEL_DIR until the gufo load test passes.
+# This is the CANDIDATE payload, not the deployed one. frank-dragoon still
+# serves scripts/download-frank-dragoon.sh's output; do not repoint
+# frank-dragoon.env at MODEL_DIR until the gufo load test passes.
 set -euo pipefail
 
 MODEL_DIR="/home/dank/models/Swift-1.5-Qwen3.8-27B-Uncensored-MTP-UD-Q8_K_XL"

scripts/download-frank-dragoon-unsloth.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # Download unsloth/Qwen3.8-Flash-Next-GGUF:UD-IQ4_XS (the
-# frank-large model) on Dankclaw.
+# frank-dragoon model) on Dankclaw.
 #
-#   bash scripts/download-frank-large-unsloth.sh
-#   bash scripts/download-frank-large-unsloth.sh --verify-only
+#   bash scripts/download-frank-dragoon-unsloth.sh
+#   bash scripts/download-frank-dragoon-unsloth.sh --verify-only
 #
 # The UD-IQ4_XS GGUF ships as three llama.cpp split parts (HF caps uploads at
 # 50 GB). The parts ARE the canonical payload: the serve script points -m at
@@ -112,4 +112,4 @@ if [[ "$mode" == "download" ]]; then
     [[ -e "$MODEL_DIR/vision/mmproj-F16.gguf" ]] || mv "$MODEL_DIR/mmproj-F16.gguf" "$MODEL_DIR/vision/"
 fi
 
-echo "frank-large payload complete: $MODEL_DIR"
+echo "frank-dragoon payload complete: $MODEL_DIR"

scripts/download-frank-dragoon.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# Download the frank-large payload on Dankclaw:
+# Download the frank-dragoon payload on Dankclaw:
 #   - unsloth/Qwen3.8-27B-GGUF:UD-Q8_K_XL (the 27B dense main GGUF)
 #   - z-lab/Qwen3.8-27B-DFlash2-GGUF:Q4_K_M (the DFlash2 drafter)
 #
-#   bash scripts/download-frank-large.sh
-#   bash scripts/download-frank-large.sh --verify-only
+#   bash scripts/download-frank-dragoon.sh
+#   bash scripts/download-frank-dragoon.sh --verify-only
 #
 # Integrity: every file is checked against its declared byte count and sha256
 # (the values below are the LFS oids from the Hub, 2026-09-21). An HF token
@@ -86,4 +86,4 @@ if [[ "$mode" == "download" ]]; then
     done
 fi
 
-echo "frank-large payload complete: $MODEL_DIR"
+echo "frank-dragoon payload complete: $MODEL_DIR"

scripts/download-frank-secondary.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-# Download the frank-secondary payload for llama.cpp on the RTX 3090:
-# ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF:RCO-IQ3_XXS
-# **with the MTP head in the file** (the -mtp variant), plus the
-# PUBLISHER's OWN vision projector (mmproj-BF16.gguf, same repo). Public
-# repo — no auth header, and never a token on the command line (it is
-# world-readable in /proc/<pid>/cmdline).
-#
-# Fresh downloads, no resume (`curl -C -` once produced a 213 MB oversized
-# file on a 31 GiB payload); -f/--fail-with-body so an HTTP error is not a
-# success, then byte count and sha256. This repo is on Xet storage, so
-# the Hub tree/blob APIs expose no LFS oid: the sha256 values below were
-# computed locally after the first verified fetch (byte counts match the
-# Hub's declared sizes). Idempotent: complete files are skipped. The
-# projector is stored under a self-documenting dest name; the URL name
-# and sha stay pinned in the table below.
-#
-# 2026-10-06 (Frank, evening): the payload moved to the UNCELERSED
-# Swift-1.5-Qwen3.8-27B at RCO-IQ3_XXS (1.56 GiB lighter than the
-# IQ3_S-mtp it replaced; the lighter quant funds the MTP draft ctx plus
-# the second 131,072 slot). Rollback payload stays on disk:
-# /home/dank/models/Swift15-IQ3S/ (the IQ3_S-mtp that was live until this
-# swap); earlier payloads Ornith-Q8/ and MiMo-Q6K/ as well. Their
-# re-fetch recipes are in git history (predecessors of this script).
-#
-# Usage:
-#   scripts/download-frank-secondary.sh [DEST_DIR] [--verify-only]
-set -euo pipefail
-
-DEST=""
-VERIFY_ONLY=0
-for arg in "$@"; do
-    case "$arg" in
-        --verify-only) VERIFY_ONLY=1 ;;
-        *) DEST="$arg" ;;
-    esac
-done
-DEST="${DEST:-/home/dank/models/Swift15-UncIQ3XXS}"
-
-# repo | hub-name | dest-name | bytes | sha256 (computed locally; Xet repo)
-FILES=(
-  "ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF|RCO/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-RCO-IQ3_XXS.gguf|Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-RCO-IQ3_XXS.gguf|10442827392|e13d3e7400b6c7f980ebd30c0edd6be43eb1865b50be8562a9db042706c7d803"
-  "ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF|mmproj-BF16.gguf|mmproj-BF16.gguf|931145888|19acd7fcf4ee504328566eddf0f8e603ef853a205b4830209d2a4908213abdea"
-)
-
-mkdir -p "$DEST"
-status=0
-for entry in "${FILES[@]}"; do
-  IFS='|' read -r repo hubname destname size sha <<<"$entry"
-  url="https://huggingface.co/${repo}/resolve/main/${hubname}"
-  f="$DEST/$destname"
-  have=0
-  if [[ -f "$f" ]] && [[ "$(stat -c%s "$f")" == "$size" ]]; then
-    if sha256sum -c --quiet <(printf '%s  %s\n' "$sha" "$f"); then
-      have=1
-    fi
-  fi
-  if (( have )); then
-    echo "OK        $destname"
-    continue
-  fi
-  if (( VERIFY_ONLY )); then
-    echo "MISSING   $destname"
-    status=1
-    continue
-  fi
-  echo "FETCHING  $destname (from $repo)"
-  tmp="$f.part"
-  curl -fsSL --fail-with-body -o "$tmp" "$url"
-  mv "$tmp" "$f"
-  if [[ "$(stat -c%s "$f")" != "$size" ]]; then
-    echo "SIZE FAIL $destname ($(stat -c%s "$f") != $size)"
-    status=1
-    continue
-  fi
-  if ! sha256sum -c --quiet <(printf '%s  %s\n' "$sha" "$f"); then
-    echo "SHA FAIL  $destname"
-    status=1
-    continue
-  fi
-  echo "VERIFIED  $destname"
-done
-if (( status == 0 )); then
-  echo "DOWNLOAD_DONE $DEST"
-else
-  echo "DOWNLOAD_FAILED $DEST" >&2
-fi
-exit "$status"

scripts/download-frank-zealot.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Download the frank-zealot payload for llama.cpp on the RTX 3090:
+# HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive at **Q6_K** plus the
+# PUBLISHER's OWN vision projector (the BF16 mmproj — the model is natively
+# multimodal, so this file is the endpoint's eyes). Public repo — no auth
+# header, and never a token on the command line (it is world-readable in
+# /proc/<pid>/cmdline).
+#
+# Fresh downloads, no resume (`curl -C -` once produced a 213 MB oversized
+# file on a 31 GiB payload); -f/--fail-with-body so an HTTP error is not a
+# success, then byte count and sha256. The Hub exposes no LFS oid for this
+# repo (Xet storage), so the sha256 values below were computed locally after
+# the first verified fetch — byte counts match the Hub's declared sizes.
+# A sha of "-" means "first fetch: size-verified, sha printed for pinning".
+# Idempotent: complete files are skipped.
+#
+# 2026-10-07 (Frank): the payload moved to Qwen3.5-9B-Uncensored Q6_K at
+# 2 x 200,704 (qwen35 hybrid: 32 layers, 8 full-attention + 24 Gated
+# DeltaNet, no MTP tensors in this file). Rollback payloads stay on disk:
+# /home/dank/models/Gemma4-26B-A4B/ (Q4_K_M, the 2026-10-07 era being
+# replaced), Swift15-UncIQ3XXS/, MiMo-Q6K/, MiMo-Q5KM/, Ornith-Q8/.
+#
+# Usage:
+#   scripts/download-frank-zealot.sh [DEST_DIR] [--verify-only]
+set -euo pipefail
+
+DEST=""
+VERIFY_ONLY=0
+for arg in "$@"; do
+    case "$arg" in
+        --verify-only) VERIFY_ONLY=1 ;;
+        *) DEST="$arg" ;;
+    esac
+done
+DEST="${DEST:-/home/dank/models/Qwen35-9B-HauhauCS-Q6K}"
+
+# repo | hub-name | dest-name | bytes | sha256 (computed locally; Xet repo)
+FILES=(
+  "HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive|Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf|Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf|7359259008|c0ba7beb68fd3fe47891bd549486d38dcf62d00817296ea314ad37017f5a4986"
+  "HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive|mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf|mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf|921704448|05f662501f8bd45607b079723a3e238a4e888fd085a10a53f4057a0e250f6934"
+)
+
+status=0
+for entry in "${FILES[@]}"; do
+  IFS='|' read -r repo hubname destname size sha <<<"$entry"
+  url="https://huggingface.co/${repo}/resolve/main/${hubname}"
+  f="$DEST/$destname"
+  have=0
+  if [[ -f "$f" ]] && [[ "$(stat -c%s "$f")" == "$size" ]]; then
+    if [[ "$sha" == "-" ]]; then
+      have=1
+    elif sha256sum -c --quiet <(printf '%s  %s\n' "$sha" "$f"); then
+      have=1
+    fi
+  fi
+  if (( have )); then
+    echo "OK        $destname"
+    continue
+  fi
+  if (( VERIFY_ONLY )); then
+    echo "MISSING   $destname"
+    status=1
+    continue
+  fi
+  echo "FETCHING  $destname (from $repo)"
+  tmp="$f.part"
+  curl -fsSL --fail-with-body -o "$tmp" "$url"
+  mv "$tmp" "$f"
+  if [[ "$(stat -c%s "$f")" != "$size" ]]; then
+    echo "SIZE FAIL $destname ($(stat -c%s "$f") != $size)"
+    status=1
+    continue
+  fi
+  if [[ "$sha" == "-" ]]; then
+    echo "VERIFIED  $destname (size only) sha256=$(sha256sum "$f" | cut -d' ' -f1)"
+    continue
+  fi
+  if ! sha256sum -c --quiet <(printf '%s  %s\n' "$sha" "$f"); then
+    echo "SHA FAIL  $destname"
+    status=1
+    continue
+  fi
+  echo "VERIFIED  $destname"
+done
+if (( status == 0 )); then
+  echo "DOWNLOAD_DONE $DEST"
+else
+  echo "DOWNLOAD_FAILED $DEST" >&2
+fi
+exit "$status"

scripts/fleet-probes-swift15.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# fleet-probes-swift15.sh — RUNS ON DANKSERVER. The cutover contract probes.
+set -uo pipefail
+B=http://localhost:7770/v1
+
+echo "== vision (solid red 512px, expect 'Red')"
+python3 - <<'PY'
+import base64, json, urllib.request, struct, zlib
+def png(color):
+    w = h = 512
+    raw = b"".join(b"\x00" + bytes(color) * w for _ in range(h))
+    def chunk(t, d):
+        c = t + d
+        return struct.pack(">I", len(d)) + c + struct.pack(">I", zlib.crc32(c))
+    return (b"\x89PNG\r\n\x1a\n"
+            + chunk(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0))
+            + chunk(b"IDAT", zlib.compress(raw)) + chunk(b"IEND", b""))
+b64 = base64.b64encode(png((255, 0, 0))).decode()
+body = json.dumps({"model": "frank-archon", "max_tokens": 256, "temperature": 0,
+    "messages": [{"role": "user", "content": [
+        {"type": "image_url", "image_url": {"url": "data:image/png;base64," + b64}},
+        {"type": "text", "text": "What color is this image? Answer with one word."}]}]}).encode()
+r = urllib.request.Request("http://localhost:7770/v1" + "/chat/completions",
+                           data=body, headers={"Content-Type": "application/json"})
+d = json.load(urllib.request.urlopen(r, timeout=300))
+m = d["choices"][0]["message"]
+ans = (m.get("content") or m.get("reasoning_content") or "")
+print("VISION ANSWER:", ans[:80].replace("\n", " "))
+PY
+
+echo "== tools (expect tool_calls)"
+curl -s -m 120 $B/chat/completions -H 'Content-Type: application/json' -d '{
+ "model":"frank-archon","temperature":0,"max_tokens":128,
+ "messages":[{"role":"user","content":"What is 23 times 47? Use the calculator tool."}],
+ "tools":[{"type":"function","function":{"name":"calculator","description":"evaluate arithmetic",
+ "parameters":{"type":"object","properties":{"expr":{"type":"string"}},"required":["expr"]}}}]}' \
+ | python3 -c 'import json,sys; d=json.load(sys.stdin); m=d["choices"][0]["message"]; print("TOOL_CALLS:", m.get("tool_calls"))'
+
+echo "== reasoning_effort fold (xhigh/medium/low/high all 200 on froggeric v22.5)"
+for lvl in xhigh medium low high; do
+  code=$(curl -s -o /dev/null -w "%{http_code}" -m 120 $B/chat/completions \
+    -H 'Content-Type: application/json' \
+    -d "{\"model\":\"frank-archon\",\"max_tokens\":8,\"reasoning_effort\":\"$lvl\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}")
+  echo "  reasoning_effort=$lvl -> HTTP $code"
+done
+
+echo "== reasoning_content channel"
+curl -s -m 120 $B/chat/completions -H 'Content-Type: application/json' \
+ -d '{"model":"frank-archon","max_tokens":64,"messages":[{"role":"user","content":"Is 97 prime? Think briefly."}]}' \
+ | python3 -c 'import json,sys; m=json.load(sys.stdin)["choices"][0]["message"]; print("has reasoning_content:", bool(m.get("reasoning_content")), "| content:", (m.get("content") or "")[:60].replace(chr(10)," "))'
+
+echo "== response_format json_object"
+curl -s -m 120 $B/chat/completions -H 'Content-Type: application/json' \
+ -d '{"model":"frank-archon","max_tokens":64,"response_format":{"type":"json_object"},"messages":[{"role":"user","content":"Return JSON {\"ok\": true}"}]}' \
+ | python3 -c 'import json,sys; d=json.load(sys.stdin); print("JSON MODE:", (d["choices"][0]["message"].get("content") or "")[:60])'
+echo "PROBES_DONE"

scripts/frank-archon-expert-activity.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Measure per-block / per-expert expert-routing activity on live frank-primary.
+"""Measure per-block / per-expert expert-routing activity on live frank-archon.
 
 Method: AMD IBS op sampling (data addresses, `perf record -e ibs_op// --data`)
 on the llama-server process while concurrent generations of mixed content run.
@@ -11,13 +11,13 @@ Tensor extents are DERIVED from consecutive GGUF header offsets — no quant
 type-size table (those are easy to get subtly wrong; a wrong per-element size
 silently under-covers each tensor and dumps tail samples into a junk bucket).
 
-Fleet law this instrument established (2026-09-26, 75 s window, 4 mixed
-streams, 2.7M expert-tensor samples): per-BLOCK read volume is FLAT
-(0.93x-1.08x of mean across all 40 CPU-resident blocks) because MoE top-k
-routing fires every block every token — there are no "most active layers" at
-`-ot` granularity. The real skew is per-EXPERT (top 10% of (block,expert)
-cells carry ~40% of samples), which tensor-level overrides cannot reach.
-Any 8 GPU-resident blocks are therefore equivalent; COUNT is the only lever.
+What this instrument settles: per-BLOCK expert read volume is FLAT across
+all CPU-resident blocks, because MoE top-k routing fires every block on
+every token — there are no "most active layers" at `-ot` granularity. The
+real skew is per-EXPERT: a small fraction of (block,expert) cells carries
+most of the samples, and tensor-level overrides cannot reach that level.
+Any fixed number of GPU-resident blocks is therefore equivalent; COUNT is
+the only lever.
 
 Usage (needs passwordless sudo for perf only; model files must be readable):
   fp-expert-activity.py <pid> [duration_s]        # dump + sample + analyze

scripts/frank-archon.env

@@ -0,0 +1,230 @@
+# frank-archon.env — radiance (StillDeadcode, Apache-2.0) serving
+# ukisai/Swift1.5-Qwen3.8-Flash-Next converted to GPTQ w4 (MODEL_FILE below,
+# built by scripts/convert-swift15-w4dn8.sh) on BOTH R9700s (TP=2),
+# dankserver :7770.
+#
+# SHAPE (2026-10-11): 2 decode slots x 200,000 tokens with an UNQUANTIZED
+# (bf16) KV cache — the pool is sized for the pair, and the weights slab pays
+# for it (see the KV block). The fp8-native payload this file was written for
+# is the rollback target and keeps its own trio under the fp8-native runbook.
+#
+# 2026-10-05 cutover from FreeToken (PR #587 ROCm, one card, experts in
+# pinned host RAM; git tag frank-archon-freetoken-pr587-20261005 is the
+# pre-cutover state — its unit/env/serve trio and Dockerfile are all in the
+# tag and rebuildable). Before that: tcclaviger vLLM fork (tag
+# frank-archon-vllm-shapeG-20261003).
+#
+# WHY RADIANCE: the engine is C++/HIP with libr4d kernels built for
+# gfx1201, drives `podman run` directly from the digest-pinned
+# stilldeadcode/radiance image (287 MiB; host needs only the amdgpu driver),
+# and its qwen4exp plugin reads the modelopt FP8 encoding NATIVELY
+# (`X.weight_scale_inv` is the scale plane — checkpoint.h). The PLE n-gram
+# table (51B params, 47.7 GiB) is served from pinned host RAM via io_uring
+# reads — Frank's call: "Native FP8. Experts from ram. Pin the PLE to ram."
+# The 4-bit-codebook publisher shape (qwen3.8-next-flash-fp8-iq4r-moe.rad,
+# --host-pool-mib 12288) remains the documented fallback if the native
+# container proves unbootable.
+#
+# PAYLOAD: /home/dank/models/rad/qwen4exp-fp8-native.rad — a rad-convert
+# NO-RECIPE pure copy of the official 131-shard checkpoint (every weight
+# keeps its block-FP8 encoding; ~161 GiB). The convert runs against a
+# staging dir whose config.json drops `quantization_config`: the descriptor
+# string is only the plugin SELECTION key (spec §2.4 — exact match, no
+# fallback), and no shipped plugin claims (qwen4exp, "fp8"); the shipped
+# qwen4exp plugin claims (qwen4exp, "") which is what recipe-built
+# containers carry. Per-weight encodings are data, not the descriptor —
+# removing the key changes nothing about what the weights hold. Built by
+# scripts/build-frank-archon-rad.sh (staging + convert + rad-info).
+#
+# SERVING FACTS (docs/GUIDE.md, docs/DOCKER.md, compose/flashnext.yaml):
+# - The HTTP listener binds AFTER the full load (main.cpp: engine.start()
+#   then engine.serve()) — during load the port refuses connections, so a
+#   bare curl /health gate is honest. /health == /ping: 200 JSON while
+#   serving, 503 only while stopping (core/server/admin.cpp:385).
+# - Reasoning: --reasoning-format defaults to auto, emitting thinking in
+#   `reasoning_content` (config.cpp). Tool calls: the qwen3.8 dialect, from
+#   the chat format. Both need no parser flags.
+# - Sampling: the OpenAI endpoint accepts temperature, top_p, top_k, min_p,
+#   typical_p, presence_penalty, frequency_penalty, repetition_penalty,
+#   repeat_last_n, chat_template_kwargs, reasoning_effort,
+#   enable_thinking, preserve_thinking (core/server/oai.cpp:194-205) —
+#   models.yml's extraBody set is fully inside it. Unknown params are
+#   refused (400), which is why nothing unverified rides the wire.
+# - MTP: the official checkpoint carries the mtp.* head (3,101 tensors,
+#   mtp_num_hidden_layers=1) and the plugin probes draft depth 3 — the
+#   publisher's throughput peak for this model. Stated explicitly with
+#   --num-speculative-tokens 3.
+# - The fused TP all-reduce is declared over max-num-seqs x
+#   (1 + --num-speculative-tokens) rows; 2 x 3 = 6 rows, under the 25-row
+#   exactness bound of the wht6 wire.
+# Engine pin: Codeberg tag v1.0.13 (commit 53282fa), Docker Hub tag 1.0.13,
+# index digest below. REJECTED UPGRADE: 1.2.0 (sha256:665775ed1d90de6dbb
+# 25558e07fc60d20328f1346f96f3c6e00845eb763f01fa, tag 1.2.0, commit
+# e95d397) was benched 2026-10-06 on this exact shape (fp8-native rad,
+# vram pair, spec 2, seqs 3, 43.6k greedy probe): decode 29.21 t/s and
+# draft acceptance 0.7123 vs the 1.0.13 control's 30.08 and 0.7549.
+# Acceptance on the greedy harness is deterministic (the control
+# reproduced the recorded 0.755 exactly), so the drop is a real numerics
+# change — the 1.2.0 MoE weight-rotation change (92b8aaf) is the named
+# suspect; decode loss tracks the acceptance ratio (0.943 vs 0.945).
+# The vram-pair translation itself is exact (1.2.0 boot ledger took
+# vram_weights 25.46 GiB / vram_kv 3.46 GiB per card byte-identical to
+# the 1.0.13 ledger at EVC 0.82). Re-test 1.2.0+ when the rotation change
+# is untangled; 1.2.0 also REMOVED --expert-vs-cache-ratio in favour of
+# the --vram-weights-mib / --vram-kv-mib pair (core/config.cpp) — this
+# file already uses the pair, which BOTH pins accept (rollback symmetry).
+FRANK_ARCHON_IMAGE=stilldeadcode/radiance@sha256:4c3f484564bb2872784e46b0a59cbd71becc9c1e746e301a3596ffae253c322e
+# The .rad container FILE (mounted under /models) and the state dir for the
+# prefix-cache disk tier (mounted rw at /data). The model dir holds ONLY
+# .rad files; the raw HF download and its staging dir live beside it and
+# are never mounted.
+FRANK_ARCHON_MODEL_DIR=/home/dank/models/rad
+FRANK_ARCHON_MODEL_FILE=qwen4exp-swift15-w4dn8-i8-hc8m.rad
+FRANK_ARCHON_STATE_DIR=/home/dank/radiance-state
+# The state dir's tune/ subdirectory holds rad-tune's kernel-selection
+# cache (the engine's selector reads $RADIANCE_HOME/tune/<machine>.tune
+# at boot; $RADIANCE_HOME defaults to /opt/radiance, in the image, so the
+# cache must ride a host mount — serve script mounts it, see the runbook's
+# "Tuning levers").
+# Container identity is the SERVICE name (Frank's call, 2026-10-05): one
+# name across systemctl and podman ps. The runtime changes; the name does
+# not. The legacy list retires every predecessor identity that could hold
+# the GPUs or the port.
+FRANK_ARCHON_CONTAINER=frank-archon
+FRANK_ARCHON_LEGACY_CONTAINERS="frank-archon-qwen frank-archon-r9v qwen-fp8 glm-probe"
+# Served model id — Protoss name (wire rename 2026-10-09). The container,
+# unit, scripts and this file keep the frank-archon name above; only the
+# alias on the wire moved. Radiance validates the requested model name, so
+# every client (harness, bench scripts, probes) MUST send this value.
+FRANK_ARCHON_SERVED_NAME=frank-archon
+FRANK_ARCHON_PORT=7770
+# Frank's chat-template call: froggeric's fixed Qwen3.8 template (the
+# repo's root chat_template.jinja, vendored here; the checkpoint's own
+# template is baked into the .rad by rad-convert and this overrides it).
+# Radiance derives the reasoning/tool-call reply format from it.
+FRANK_ARCHON_TEMPLATE=/home/dank/serverAppConfigs/scripts/qwen38-froggeric-v22.5.jinja
+
+# --- engine shape (the boot ledger arbitrates every number below) ---------
+# Tensor parallel: BOTH R9700s. The board swap (2026-09-20, ProArt B850
+# x8/x8 on root ports) made collectives legal on this host; radiance's TP
+# wire is libr4d's own, not RCCL.
+FRANK_ARCHON_TP=2
+# Lossy WHT 6-bit wire for large all-reduces (publisher's production choice:
+# +5.6-6.3% prefill, ~-1.3% 8-stream decode at TP2). min-kb stays the
+# engine default.
+FRANK_ARCHON_TP_WIRE=wht6
+# Decode slots: TWO, so the served window is a CAPACITY CONTRACT — two
+# concurrent conversations of --max-model-len fit the KV pool (see the KV
+# block below). Slot-count limits observed on other runtimes do NOT
+# transfer: a "this slot count cannot boot" refusal is usually that
+# runtime's compiler specializing shapes (e.g. a ConstraintViolationError
+# from shape specialization on query_start_loc), not a property of the
+# engine now running. This engine boots seqs 2, and seqs 2
+# vs 3 decode measurements land inside each other's noise floor. Side
+# benefit: the fused TP all-reduce is declared over seqs x (1 + spec) = 6
+# rows, under the 25-row bound at which the wht6 wire stays EXACT
+# (single-sequence decode and any step of <= 25 rows is bit-exact; only
+# busier steps are lossy).
+FRANK_ARCHON_MAX_SEQS=2
+# Served window. Native is 262,144; 200,000 is the publisher's production
+# value (compose) and what models.yml's contextWindow must quote — a longer
+# prompt is refused by the engine, never truncated. The engine treats
+# `kv group tokens >= max-model-len` as a HARD limit ("ONE request longer
+# than N tokens is accepted by the API and then refused as too large to ever
+# fit — this is a hard limit, not a backing ratio"), so the pool is sized
+# for seqs x maxlen, not for one sequence.
+FRANK_ARCHON_MAX_MODEL_LEN=200000
+FRANK_ARCHON_PLACEMENT=expert_tiered
+# Pinned host pool for the expert rows that do not fit VRAM. vram_weights and
+# this pool serve the per-rank resident set TOGETHER: at the fp8-KV pair
+# (26071/3543) the ledger showed the VRAM slab filled to 259 KiB of slack,
+# i.e. the pair was exactly sized. Cutting vram-weights by 3.8 GiB to pay for
+# the bf16 KV pool SPILLS ~3.8 GiB/rank here, so the pool moves with it —
+# under-sizing it is a boot failure (36864 refused the boot in the fp8 era).
+# The boot ledger's coverage line remains the referee, not this arithmetic.
+FRANK_ARCHON_HOST_POOL_MIB=44928
+# VRAM left unclaimed per card (publisher default 96 MiB).
+FRANK_ARCHON_GPU_HEADROOM_MIB=96
+# VRAM split of claimed memory per card, MiB (0 = derive from the card).
+# THE CEILING, measured on this host 2026-10-11: card 31,856 MiB, a boot
+# consumes 1,710 MiB OUTSIDE both budgets (driver context + activation arena
+# 990 + hardware queues 100 + headroom 96 + step staging), and the fp8 pair
+# settled at 1,379 MiB free — so `vram_weights + vram_kv <= 29,120 MiB` keeps
+# >= 1 GiB free. The pair below is exactly that sum.
+# THE PRICE, and it is paid twice: on this engine idle KV VRAM is ALSO the
+# expert cache's spillover (`mover: 2275 slots can be lent out of the KV
+# cache (2.69 GiB)`, `arena: lends 740 MiB while steps are <= 256 tokens`),
+# so a bigger KV pool steals weight residency from the slab AND from the
+# lendable cache. Priors on this card/model: stealing 2.14 GiB of weights for
+# a bigger pool (MAX_MODEL_LEN 262144) cost 2.5% decode; the EVC ladder's
+# other direction (0.82 -> 0.84, +2.5 GiB weights) cost 8.9%. Expect -3..-8%
+# vs the fp8 control (136 t/s median at 44.5k depth, acceptance 0.7246,
+# ~190 t/s on a live 512-token probe); re-tune from a boot ledger + probe,
+# never from that estimate.
+FRANK_ARCHON_VRAM_WEIGHTS_MIB=22208
+FRANK_ARCHON_VRAM_KV_MIB=6912
+# KV cache UNQUANTIZED (bf16). This engine's flag takes ONLY bf16|fp8 — there
+# is ONE kv_dtype for the whole cache, so "exact K, quantized V" (llama.cpp's
+# --cache-type-k/--cache-type-v pair, which is what frank-zealot runs) is
+# UNSERVABLE here: the rung below bf16 is fp8 on both halves.
+# Measured per-rank cost, read out of the boot ledger's group table (fp8 boot
+# 2026-10-08, bf16 boot 2026-10-11):
+#   kv_attn     13 layers, 4-token blocks, page 26.00 KiB (fp8) -> 52.00 KiB
+#   kv_qsa_bkey 13 layers, 4-token blocks, page  3.25 KiB at BOTH dtypes —
+#               the QSA block key is an index, not attention state, and does
+#               NOT follow --kv-cache-dtype
+#   => 7.3125 KiB/token fp8, 13.8125 KiB/token bf16: bf16 costs 1.89x fp8,
+#               not 2x, precisely because the bkey plane is dtype-fixed.
+# The dtype-INDEPENDENT terms also live in the pool: kv_gdn_state 54 MiB x 2
+# copies per sequence (+ conv/tail/ple ~= 110 MiB a sequence) and the prefix
+# checkpoint region 8 x 55.99 = 448 MiB. So:
+#   pool_mib >= tokens x 13.8125 KiB + 110 x seqs + 448
+#   6912 -> (6912 - 220 - 448) x 1024 / 13.8125 = 462,946 tokens; the engine
+#   reported 462,752 (0.04% page rounding) — 2 x 200,000 with 62k of slack,
+#   and the ledger says it outright: "backs 2 sequences all at 200000 tokens
+#   at once, which is the worst case".
+# (the fp8 pool of 3543 gave 386,904 — it never held 2 x 200k, it held 1.93
+# sessions, and a third long conversation preempted to the host/disk tiers).
+# Secondary cost: the prefix-cache entry grows with the attention plane
+# (one entry 58.50 KiB at fp8 -> 110.50 KiB at bf16, measured on the two boot
+# ledgers' `kv tier transfer` lines), so the host tier below doubles to keep
+# the same number of parked conversations, out of RAM the host has
+# (104 GiB available with the service loaded).
+FRANK_ARCHON_KV_DTYPE=bf16
+# Spec decode: the checkpoint's own MTP head at the publisher's depth-3
+# operating point (probe() returns 3 when mtp_num_hidden_layers > 0; the
+# flag states it so the ledger records the intent).
+FRANK_ARCHON_SPEC_TOKENS=2
+FRANK_ARCHON_MAX_BATCHED_TOKENS=2048
+# Prefix cache tiers (publisher pattern; disk tier sized for 2 slots).
+# The host tier is sized in ENTRIES, and one entry doubles with the cache
+# dtype (58.50 KiB at fp8 -> 117 KiB at bf16, per the ledger's `kv tier
+# transfer` line): 4096 MiB at bf16 parks ~1.4 sessions of 200k where it
+# parked ~2.9 at fp8. Doubled to keep the capacity, at RAM the host has
+# (104 GiB available with the service loaded).
+FRANK_ARCHON_PREFIX_HOST_MIB=8192
+FRANK_ARCHON_PREFIX_DISK_MIB=65536
+# The PLE n-gram table (47.7 GiB) serves from pinned host RAM the cards
+# read. `ram` REFUSES the start if the memlock limit is too small — a
+# named refusal beats a mid-load allocator failure — and the unit's
+# LimitMEMLOCK=infinity is the other half of the arrangement.
+FRANK_ARCHON_NGRAM_PLACEMENT=ram
+# TTM preflight: the pinned ledger (2 x 44 GiB pools + 47.7 GiB PLE + 8 GiB
+# prefix host = ~147 GiB) rides TTM's shared pages, capped by ttm's
+# pages_limit (the current kernel exposes NO pages_max; the cap function
+# takes the min over the knobs that exist). Below the plan the load dies
+# mid-pin with an allocator error instead of this named refusal — raise the
+# knob first (runtime sysfs write; kernel cmdline fallback + one reboot only
+# if the file is read-only), see the runbook. Cap raised 2026-10-05 to
+# 52,428,800 pages = 200 GiB, which still clears this floor.
+FRANK_ARCHON_TTM_MIN_MIB=150000
+# Escape hatch for boot-ladder experiments. Unset -> no extra argv. Keep
+# multi-flag values as one string; the serve script expands it unquoted on
+# purpose.
+FRANK_ARCHON_EXTRA_ARGS=
+# The .rad's minimum size in MiB (deployer gate; a truncated convert is a
+# guaranteed long-timeout boot instead of a fast failure). The converted
+# container measured 177,109 MiB (1,857,127,997,440 B = 173.0 GiB; the
+# plan-only estimate 172.76 GiB covers the data planes but not the metadata
+# tail) - floor sits just under the payload.
+FRANK_ARCHON_RAD_MIN_MIB=110000

scripts/frank-archon.service

@@ -1,8 +1,8 @@
-# frank-primary.service — radiance (StillDeadcode, Apache-2.0) endpoint
+# frank-archon.service — radiance (StillDeadcode, Apache-2.0) endpoint
 # (OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 at NATIVE block-FP8 precision, the
 # rad-convert container qwen4exp-fp8-native.rad) on BOTH R9700s (TP=2,
 # wht6 wire), dankserver :7770. 2026-10-05 cutover from FreeToken (git tag
-# frank-primary-freetoken-pr587-20261005 is the pre-cutover state; the
+# frank-archon-freetoken-pr587-20261005 is the pre-cutover state; the
 # retired unit/env/serve trio and Dockerfile are in that tag).
 #
 # Same port, same served alias, same container identity as the unit name;
@@ -19,7 +19,7 @@
 # unit grants LimitMEMLOCK=infinity to the dank process via PID1; the
 # engine still runs out of dank's rootless podman storage.
 [Unit]
-Description=frank-primary — radiance Qwen3.8-Flash-Next-FP8 (native) on 2x R9700 TP=2
+Description=frank-archon — radiance Qwen3.8-Flash-Next-FP8 (native) on 2x R9700 TP=2
 After=network-online.target
 Wants=network-online.target
 # Never let the start-rate limiter give up after a crash loop (a failed LLM
@@ -33,14 +33,14 @@ Group=dank
 # RLIMIT_MEMLOCK smaller than the pinned set fails the load mid-start.
 # PID1 grants infinity here — parity with the fleet's other LLM units.
 LimitMEMLOCK=infinity
-Environment="FRANK_PRIMARY_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-primary.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-primary.sh
+Environment="FRANK_ARCHON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-archon.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-archon.sh
 # systemd stop: wait alone cannot stop the container child; stop it
 # explicitly. No graceful drain contract is claimed (the OpenAI front end
 # holds no queue to drain — in-flight decodes are lost, which a stop
 # during a bench window accepts; radiance takes SIGTERM on the engine
 # process and podman reaps the container).
-ExecStop=/usr/bin/podman stop -t 120 frank-primary
+ExecStop=/usr/bin/podman stop -t 120 frank-archon
 # Boot cost: .rad load (weights + PLE upload) + expert host-pool pin. The
 # publisher's compose healthcheck allows a 15-minute start_period; the
 # vLLM-era budget (1800 s) carried forward.

scripts/frank-dragoon.env

@@ -1,11 +1,11 @@
-# frank-large.env — tunables for the frank-large endpoint on Dankclaw's
+# frank-dragoon.env — tunables for the frank-dragoon endpoint on Dankclaw's
 # Strix Halo iGPU (gfx1151), host port 7770.
 #
 # RUNTIME (2026-10-06, Frank): halogen-flash-server 0.16.2 — the
 # closed-source C++/HIP engine (image ghcr.io/peonist-ai/halogen-flash-server,
 # digest-pinned below) serving the Quat3rnion ABLITERATED Swift1.5 finetune
 # of peonist's Qwen3.8-Flash-Next v2 checkpoint, as a podman container under
-# a root unit, driven by scripts/serve-frank-large.sh. This CUTS OVER the
+# a root unit, driven by scripts/serve-frank-dragoon.sh. This CUTS OVER the
 # 2026-10-05 halogen 27B-dense shape (censored base, DFlash2, 31.7 t/s):
 # rollback = revert the swap commit's trio; the 27B payload stays on disk at
 # /home/dank/models/halogen-qwen3.8-27b/.
@@ -22,28 +22,39 @@
 # tool calls verified, and the native 262,144 context.
 #
 # SHAPE — the knobs that are NOT free, with the arithmetic:
-#   HALOGEN_CTX=200192 is the PER-SLOT window and the per-conversation hard
+#   HALOGEN_CTX=262144 is the PER-SLOT window and the per-conversation hard
 #   ceiling — a prompt over it is a 400 naming the limit, never a silent
-#   truncation. Harness compaction fires at 70% = 140,134, and 140,134 +
-#   57,344 (harness maxTokens) = 197,478 <= 200,192 keeps prompt + budget
-#   inside the slot. models.yml contextWindow must quote 200192 or the
-#   harness discovers the wall as a 400.
-#   HALOGEN_KV_POOL_POSITIONS=400384 = KV_SLOTS(2) x CTX — the explicit
+#   truncation. RAISED from 200192 on 2026-10-07: the harness clamps
+#   max_tokens to contextWindow − est − 4096, its chars/4 est UNDER-counts
+#   the rendered prompt by ~3 % on code/agent traffic, and compaction only
+#   fires at 85 % — so with window == engine ceiling, every request over
+#   ~146k est (65-85 % of the window) was a guaranteed 400. Measured
+#   2026-10-07: est 152,938, server 157,388, request 43,158 vs room 42,804
+#   — over by 354, margin 4,096 < the 4,450 under-count.
+#   Harness contract (models.yml): contextWindow 217088, maxTokens 45056.
+#   Compaction fires at 85 % = 184,524 est ≈ 190k measured (Frank's 180k
+#   target). Worst-case request: prompt + budget <= 217088 − 4096 + 3 %
+#   est-error ≈ 219k <= 262144 — the 45k gap between harness window and
+#   engine ceiling absorbs the estimate error with ~7x margin (robust to a
+#   10 % under-count). Compaction rides on frank-zealot: input ≈
+#   threshold − keepRecent(20k) ≈ 170k measured, inside its 200,704 slot.
+#   HALOGEN_KV_POOL_POSITIONS=524288 = KV_SLOTS(2) x CTX — the explicit
 #   form of the engine's default, so the seam test can pin the product.
-#   KV costs ~28 KiB/position (FLAGS.md) => 400,384 x 28 KiB = 10.7 GiB.
+#   KV costs ~28 KiB/position (FLAGS.md) => 524,288 x 28 KiB = 14.0 GiB.
 #   HALOGEN_KV_SLOTS=2 restores the w4b-era shape on this box: the MTP
-#   drafter is NOT slot-locked on this engine (batching and speculation
-#   coexist — DFlash-era slots>1 law does NOT carry over; the card's own
-#   quickstart ships 2 slots WITH the head), so the second slot is
-#   concurrent capacity, not a speculation tax.
+#   drafter is NOT slot-locked on this engine. A "slots > 1 disables the
+#   drafter" restriction is a property of the engine generation that
+#   imposed it, not of speculation itself — batching and speculation
+#   coexist here, and the card's own quickstart ships 2 slots WITH the
+#   head — so the second slot is concurrent capacity, not a speculation tax.
 #   Memory ledger against the box's 121.2 GiB unified (the n-gram table is
 #   mmap'd page cache beside the checkpoint, not a pinned charge — the
 #   card's own quickstart arithmetic does not bill it):
-#     weights ~62 GiB resident + KV 10.7 + arena (HALOGEN_MAX_TOK=8192 =>
+#     weights ~62 GiB resident + KV 14.0 + arena (HALOGEN_MAX_TOK=8192 =>
 #     ~8 GiB per FLAGS.md arena formula 3.8+8.4*(MT/16384)) + vision ~2
-#     = ~82.7 GiB engine-side; HALOGEN_HOST_RESERVE_GIB=20 keeps the host
-#     honest; baseline co-tenancy (frank-secondary, ComfyUI, Caddy/observ)
-#     ~10-15. ~18 GiB margin. The boot ledger is the referee — read it
+#     = ~86 GiB engine-side; HALOGEN_HOST_RESERVE_GIB=20 keeps the host
+#     honest; baseline co-tenancy (frank-zealot, ComfyUI, Caddy/observ)
+#     ~10-15. ~15 GiB margin. The boot ledger is the referee — read it
 #     after deploy and re-size if the engine prints a clamp.
 #   HALOGEN_SPEC_ADAPT=0 is MANDATORY (card): the default adaptive policy
 #   turns the MTP head off for whole requests after low acceptance and
@@ -57,8 +68,8 @@
 #     an absent temperature is no longer greedy. models.yml extraBody
 #     carries the same values — consistent, not load-bearing.
 #   * HALOGEN_MAX_TOK=8192 is only the DEFAULT for requests that omit
-#     max_tokens; the harness always sends 57344. Requests over
-#     HALOGEN_MAX_TOKENS_CAP (65536) are a 400 naming the cap. Cap and
+#     max_tokens; the harness sends at most its maxTokens 45056. Requests
+#     over HALOGEN_MAX_TOKENS_CAP (65536) are a 400 naming the cap. Cap and
 #     queue timeout are COUPLED (FLAGS.md table): 65536 at ~10 t/s serial
 #     worst case needs > 6550 s; 7200 honors it. Do not move one alone.
 #   * max_tokens INCLUDES thinking; a reasoning reply over a small budget
@@ -78,51 +89,55 @@
 #     before. Kernel needs CONFIG_HSA_AMD_SVM (CachyOS ships it) and
 #     amdgpu.noretry=0 (check at deploy).
 
-# Image: digest-pinned (fetch law: tag pulls silently re-point; the digest
-# is what was qualified). 0.16.2 = the version the model card names as its
-# quickstart pin; RepoDigest captured at pull on 2026-10-06.
-FRANK_LARGE_IMAGE=ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84ac22308a53f5d1ca6b86806702d7039e5ebc51cae4c66621b92fe04a
+# Image: digest-pinned, not tag-pinned — a tag can be re-pointed to a
+# build that was never qualified here, while the digest pins exactly the
+# build that was tested. 0.16.2 = the version the model card names as its
+# quickstart pin; the RepoDigest was captured at a pull of that tag.
+FRANK_DRAGOON_IMAGE=ghcr.io/peonist-ai/halogen-flash-server@sha256:0c61bf84ac22308a53f5d1ca6b86806702d7039e5ebc51cae4c66621b92fe04a
 # Container identity: kept from the 27B era (unit ExecStop names it).
-FRANK_LARGE_CONTAINER=frank-large-halogen
+FRANK_DRAGOON_CONTAINER=frank-dragoon-halogen
 # Old quadlet-era container identity; the serve script clears stale names.
-FRANK_LARGE_LEGACY_CONTAINERS=frank-large
+FRANK_DRAGOON_LEGACY_CONTAINERS=frank-dragoon
 # host:container — the frontend listens on 8731 inside (HALOGEN_API_PORT
 # default); the engine port (8730) is never published.
-FRANK_LARGE_PUBLISH=7770:8731
+FRANK_DRAGOON_PUBLISH=7770:8731
 
-FRANK_LARGE_MODEL_DIR=/home/dank/models/halogen-flashnext-v2
+FRANK_DRAGOON_MODEL_DIR=/home/dank/models/halogen-flashnext-v2
 # The checkpoint: Quat3rnion/halogen-swift1.5-qwen3.8-flash-next-v2-abliterated
 # qwen38-flash-next-v2-swift15-abliterated.hgn — compacted r2 of the card's
 # append-only original (byte-identical live tensors, padding dropped:
 # 66,687,678,464 B vs 89,775,868,032 B). LFS sha256 verified at fetch.
-FRANK_LARGE_CHECKPOINT=qwen38-flash-next-v2-swift15-abliterated.hgn
-FRANK_LARGE_CHECKPOINT_BYTES=66687678464
-FRANK_LARGE_CHECKPOINT_SHA256=9c880b8ba48deabfa06172eff1e7572e4fe465e09e97faec6e50c3f6fdcac037
+FRANK_DRAGOON_CHECKPOINT=qwen38-flash-next-v2-swift15-abliterated.hgn
+FRANK_DRAGOON_CHECKPOINT_BYTES=66687678464
+FRANK_DRAGOON_CHECKPOINT_SHA256=9c880b8ba48deabfa06172eff1e7572e4fe465e09e97faec6e50c3f6fdcac037
 # The n-gram lookup table: REQUIRED (the engine reads it beside the
 # checkpoint; the card's quickstart names it explicitly). From
 # peonist-ai/halogen-qwen3.8-flash-next @ 5cc17cea.
-FRANK_LARGE_NGRAM_TABLE=qwen38-flash-next-ngram.hgn
-FRANK_LARGE_NGRAM_BYTES=51200246144
-FRANK_LARGE_NGRAM_SHA256=3450acada94e19aabad88bd49b45eb70304820949c2240fc178067b20ae5dffe
+FRANK_DRAGOON_NGRAM_TABLE=qwen38-flash-next-ngram.hgn
+FRANK_DRAGOON_NGRAM_BYTES=51200246144
+FRANK_DRAGOON_NGRAM_SHA256=3450acada94e19aabad88bd49b45eb70304820949c2240fc178067b20ae5dffe
 # The vision tower: OPTIONAL on the engine, ENABLED here (image input).
 # From peonist-ai/halogen-qwen3.8-flash-next @ e053f488.
-FRANK_LARGE_VISION_TOWER=qwen38-flash-next-vision.hgn
-FRANK_LARGE_VISION_BYTES=897916416
-FRANK_LARGE_VISION_SHA256=d62e0ae553fe88afd3833733d4a4c669f34d20fd8dfce4b9610525bed2134b10
-# The tokenizer is a FLAT DIRECTORY, $FRANK_LARGE_MODEL_DIR/tokenizer,
+FRANK_DRAGOON_VISION_TOWER=qwen38-flash-next-vision.hgn
+FRANK_DRAGOON_VISION_BYTES=897916416
+FRANK_DRAGOON_VISION_SHA256=d62e0ae553fe88afd3833733d4a4c669f34d20fd8dfce4b9610525bed2134b10
+# The tokenizer is a FLAT DIRECTORY, $FRANK_DRAGOON_MODEL_DIR/tokenizer,
 # mounted whole at /tokenizer. The two repos ship the same one; fetched
 # fresh from peonist @ e053f488 (tokenizer.json is LFS, byte-identical to
 # the 27B-era copy; the rest are plain git blobs — size-checked only). The
 # serve gate and the deployer refuse a missing file or ANY symlink: an HF
 # cache snapshot symlinks each file into blobs/, and those links dangle
 # inside the container mount.
-FRANK_LARGE_TOKENIZER_FILES="tokenizer.json chat_template.jinja tokenizer_config.json merges.txt vocab.json generation_config.json"
+FRANK_DRAGOON_TOKENIZER_FILES="tokenizer.json chat_template.jinja tokenizer_config.json merges.txt vocab.json generation_config.json"
 
 # --- engine flags (docs/FLAGS.md of the flash-server repo; anything unset
 # stays at the image default, which is what was qualified) ------------------
-HALOGEN_MODEL_ID=frank-large
-HALOGEN_CTX=200192
-HALOGEN_KV_POOL_POSITIONS=400384
+# Served model id — Protoss name (wire rename 2026-10-09); the service, unit,
+# scripts and this file keep the frank-dragoon name. OpenWebUI api_configs
+# model_ids for the :7770 backend MUST name this value.
+HALOGEN_MODEL_ID=frank-dragoon
+HALOGEN_CTX=262144
+HALOGEN_KV_POOL_POSITIONS=524288
 HALOGEN_KV_SLOTS=2
 HALOGEN_HOST_RESERVE_GIB=20
 # Spec decode: MTP head is INSIDE the checkpoint (do NOT set HALOGEN_MTP_HEAD);

scripts/frank-dragoon.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=halogen-flash-server container (Quat3rnion abliterated Swift1.5 of Qwen3.8-Flash-Next v2, MTP spec decode, 2 slots x 200192, vision ON), root systemd unit (dankclaw, frank-large, Strix Halo iGPU)
+Description=halogen-flash-server container (Quat3rnion abliterated Swift1.5 of Qwen3.8-Flash-Next v2, MTP spec decode, 2 slots x 200192, vision ON), root systemd unit (dankclaw, frank-dragoon, Strix Halo iGPU)
 After=network-online.target
 Wants=network-online.target
 
@@ -11,11 +11,11 @@ Group=dank
 # RLIMIT smaller than the pinned set cannot fail the load. Parity with the
 # other LLM units on this fleet.
 LimitMEMLOCK=infinity
-Environment="FRANK_LARGE_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-large.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-large.sh
+Environment="FRANK_DRAGOON_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-dragoon.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-dragoon.sh
 # systemd stop alone cannot stop the container child; stop it explicitly
-# (frank-primary pattern). The engine drains on SIGTERM.
-ExecStop=/usr/bin/podman stop -t 60 frank-large-halogen
+# (frank-archon pattern). The engine drains on SIGTERM.
+ExecStop=/usr/bin/podman stop -t 60 frank-dragoon-halogen
 TimeoutStartSec=1200
 TimeoutStopSec=120
 # always, not on-failure: an engine that exits 0 after an internal fault
@@ -23,7 +23,7 @@ TimeoutStopSec=120
 Restart=always
 RestartSec=10
 # The engine pins ~62 GiB of v2 weights and keeps a multi-GiB working set
-# on a box that also hosts frank-secondary, ComfyUI and the Caddy/observability
+# on a box that also hosts frank-zealot, ComfyUI and the Caddy/observability
 # stack; make it a late OOM candidate, not the first.
 OOMScoreAdjust=-500
 

scripts/frank-primary.env

@@ -1,142 +0,0 @@
-# frank-primary.env — radiance (StillDeadcode, Apache-2.0) serving the
-# OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 checkpoint at NATIVE precision
-# (modelopt block-FP8 throughout, no requantisation) on BOTH R9700s (TP=2),
-# dankserver :7770.
-#
-# 2026-10-05 cutover from FreeToken (PR #587 ROCm, one card, experts in
-# pinned host RAM; git tag frank-primary-freetoken-pr587-20261005 is the
-# pre-cutover state — its unit/env/serve trio and Dockerfile are all in the
-# tag and rebuildable). Before that: tcclaviger vLLM fork (tag
-# frank-primary-vllm-shapeG-20261003).
-#
-# WHY RADIANCE: the engine is C++/HIP with libr4d kernels built for
-# gfx1201, drives `podman run` directly from the digest-pinned
-# stilldeadcode/radiance image (287 MiB; host needs only the amdgpu driver),
-# and its qwen4exp plugin reads the modelopt FP8 encoding NATIVELY
-# (`X.weight_scale_inv` is the scale plane — checkpoint.h). The PLE n-gram
-# table (51B params, 47.7 GiB) is served from pinned host RAM via io_uring
-# reads — Frank's call: "Native FP8. Experts from ram. Pin the PLE to ram."
-# The 4-bit-codebook publisher shape (qwen3.8-next-flash-fp8-iq4r-moe.rad,
-# --host-pool-mib 12288) remains the documented fallback if the native
-# container proves unbootable.
-#
-# PAYLOAD: /home/dank/models/rad/qwen4exp-fp8-native.rad — a rad-convert
-# NO-RECIPE pure copy of the official 131-shard checkpoint (every weight
-# keeps its block-FP8 encoding; ~161 GiB). The convert runs against a
-# staging dir whose config.json drops `quantization_config`: the descriptor
-# string is only the plugin SELECTION key (spec §2.4 — exact match, no
-# fallback), and no shipped plugin claims (qwen4exp, "fp8"); the shipped
-# qwen4exp plugin claims (qwen4exp, "") which is what recipe-built
-# containers carry. Per-weight encodings are data, not the descriptor —
-# removing the key changes nothing about what the weights hold. Built by
-# scripts/build-frank-primary-rad.sh (staging + convert + rad-info).
-#
-# SERVING FACTS (docs/GUIDE.md, docs/DOCKER.md, compose/flashnext.yaml):
-# - The HTTP listener binds AFTER the full load (main.cpp: engine.start()
-#   then engine.serve()) — during load the port refuses connections, so a
-#   bare curl /health gate is honest. /health == /ping: 200 JSON while
-#   serving, 503 only while stopping (core/server/admin.cpp:385).
-# - Reasoning: --reasoning-format defaults to auto, emitting thinking in
-#   `reasoning_content` (config.cpp). Tool calls: the qwen3.8 dialect, from
-#   the chat format. Both need no parser flags.
-# - Sampling: the OpenAI endpoint accepts temperature, top_p, top_k, min_p,
-#   typical_p, presence_penalty, frequency_penalty, repetition_penalty,
-#   repeat_last_n, chat_template_kwargs, reasoning_effort,
-#   enable_thinking, preserve_thinking (core/server/oai.cpp:194-205) —
-#   models.yml's extraBody set is fully inside it. Unknown params are
-#   refused (400), which is why nothing unverified rides the wire.
-# - MTP: the official checkpoint carries the mtp.* head (3,101 tensors,
-#   mtp_num_hidden_layers=1) and the plugin probes draft depth 3 — the
-#   publisher's throughput peak for this model. Stated explicitly with
-#   --num-speculative-tokens 3.
-# - The fused TP all-reduce is declared over max-num-seqs x
-#   (1 + --num-speculative-tokens) rows; 2 x 4 = 8 rows fits either wire.
-FRANK_PRIMARY_IMAGE=stilldeadcode/radiance@sha256:4c3f484564bb2872784e46b0a59cbd71becc9c1e746e301a3596ffae253c322e
-# The .rad container FILE (mounted under /models) and the state dir for the
-# prefix-cache disk tier (mounted rw at /data). The model dir holds ONLY
-# .rad files; the raw HF download and its staging dir live beside it and
-# are never mounted.
-FRANK_PRIMARY_MODEL_DIR=/home/dank/models/rad
-FRANK_PRIMARY_MODEL_FILE=qwen4exp-fp8-native.rad
-FRANK_PRIMARY_STATE_DIR=/home/dank/radiance-state
-# The state dir's tune/ subdirectory holds rad-tune's kernel-selection
-# cache (the engine's selector reads $RADIANCE_HOME/tune/<machine>.tune
-# at boot; $RADIANCE_HOME defaults to /opt/radiance, in the image, so the
-# cache must ride a host mount — serve script mounts it, see the runbook's
-# "Tuning levers").
-# Container identity is the SERVICE name (Frank's call, 2026-10-05): one
-# name across systemctl and podman ps. The runtime changes; the name does
-# not. The legacy list retires every predecessor identity that could hold
-# the GPUs or the port.
-FRANK_PRIMARY_CONTAINER=frank-primary
-FRANK_PRIMARY_LEGACY_CONTAINERS="frank-primary-qwen frank-primary-r9v qwen-fp8 glm-probe"
-FRANK_PRIMARY_SERVED_NAME=frank-primary
-FRANK_PRIMARY_PORT=7770
-# Frank's chat-template call: froggeric's fixed Qwen3.8 template (the
-# repo's root chat_template.jinja, vendored here; the checkpoint's own
-# template is baked into the .rad by rad-convert and this overrides it).
-# Radiance derives the reasoning/tool-call reply format from it.
-FRANK_PRIMARY_TEMPLATE=/home/dank/serverAppConfigs/scripts/qwen38-froggeric-v22.5.jinja
-
-# --- engine shape (first-boot conservative; the boot ledger arbitrates) --
-# Tensor parallel: BOTH R9700s. The board swap (2026-09-20, ProArt B850
-# x8/x8 on root ports) made collectives legal on this host; radiance's TP
-# wire is libr4d's own, not RCCL.
-FRANK_PRIMARY_TP=2
-# Lossy WHT 6-bit wire for large all-reduces (publisher's production choice:
-# +5.6-6.3% prefill, ~-1.3% 8-stream decode at TP2). min-kb stays the
-# engine default.
-FRANK_PRIMARY_TP_WIRE=wht6
-# Decode slots. 2 is Frank's first-boot value ("use parallelism = 2 to
-# start"); raise only after a real-traffic look at slot occupancy and the
-# KV pool's headroom line. The recurrent-state cost scales with it (54
-# MiB/copy/card, 2 copies with speculation).
-FRANK_PRIMARY_MAX_SEQS=3
-# Served window. Native is 262,144; 200,000 is the publisher's production
-# value (compose) and what models.yml's contextWindow must quote — a longer
-# prompt is refused by the engine, never truncated.
-FRANK_PRIMARY_MAX_MODEL_LEN=200000
-FRANK_PRIMARY_PLACEMENT=expert_tiered
-# Pinned host pool for the expert rows that do not fit VRAM. Native FP8
-# experts are 112.8 GiB total (56.4 GiB per rank slice) vs the 4-bit
-# publisher shape's ~29 GiB — this pool is the cost of native precision.
-# The boot ledger prints the pool's coverage ("the pool backs N% of the
-# worst case ... M full-length sessions"); resize from that line, not from
-# arithmetic.
-FRANK_PRIMARY_HOST_POOL_MIB=40960
-# VRAM left unclaimed per card (publisher default 96 MiB).
-FRANK_PRIMARY_GPU_HEADROOM_MIB=96
-# Weights share of claimed VRAM (publisher production value; higher = more
-# prefix-cache hit rate, less KV headroom).
-FRANK_PRIMARY_EXPERT_VS_CACHE=0.82
-# KV cache in FP8 (7.32 KiB/token at this model's 12 full-attention layers,
-# 2 KV heads, 256 head_dim, K+V).
-FRANK_PRIMARY_KV_DTYPE=fp8
-# Spec decode: the checkpoint's own MTP head at the publisher's depth-3
-# operating point (probe() returns 3 when mtp_num_hidden_layers > 0; the
-# flag states it so the ledger records the intent).
-FRANK_PRIMARY_SPEC_TOKENS=2
-FRANK_PRIMARY_MAX_BATCHED_TOKENS=2048
-# Prefix cache tiers (publisher pattern; disk tier sized for 2 slots).
-FRANK_PRIMARY_PREFIX_HOST_MIB=4096
-FRANK_PRIMARY_PREFIX_DISK_MIB=65536
-# Frank's pin law: the PLE n-gram table (47.7 GiB) serves from pinned host
-# RAM the cards read. `ram` REFUSES the start if the memlock limit is too
-# small — the unit's LimitMEMLOCK=infinity is the other half of this law.
-FRANK_PRIMARY_NGRAM_PLACEMENT=ram
-# TTM preflight: the pinned ledger (2 x 40 GiB pools + 47.7 GiB PLE + 4 GiB
-# prefix host) is ~132 GiB. ttm's pages_limit/pages_max cap the GPU-mappable
-# pinned pages; the current cap (32,252,917 pages = ~123 GiB) is BELOW the
-# plan, so the serve script refuses to start until both are raised. This is
-# the floor it enforces (in MiB), with ~8 GiB of margin.
-FRANK_PRIMARY_TTM_MIN_MIB=140000
-# Escape hatch for boot-ladder experiments. Unset -> no extra argv. Keep
-# multi-flag values as one string; the serve script expands it unquoted on
-# purpose.
-FRANK_PRIMARY_EXTRA_ARGS=
-# The .rad's minimum size in MiB (deployer gate; a truncated convert is a
-# guaranteed long-timeout boot instead of a fast failure). The converted
-# container measured 177,109 MiB (1,857,127,997,440 B = 173.0 GiB; the
-# plan-only estimate 172.76 GiB covers the data planes but not the metadata
-# tail) - floor sits just under the payload.
-FRANK_PRIMARY_RAD_MIN_MIB=177000

scripts/frank-secondary.env

@@ -1,98 +0,0 @@
-# frank-secondary — llama.cpp (master, CUDA sm_86) serving
-# ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF:RCO-IQ3_XXS
-# **with the MTP head in the file** on the RTX 3090, :7771.
-#
-# 2026-10-06 (Frank, evening): the payload moved to ajgazin's UNCELERSED
-# Swift-1.5-Qwen3.8-27B at RCO-IQ3_XXS (10,442,827,392 B) — 1.56 GiB
-# lighter than the IQ3_S-mtp it replaces — with MTP BACK ON (draft-mtp,
-# depth 3), TWO 131,072 slots, and ubatch 512. The uncensored finetune
-# changes behavior by design (publisher: 23/100 refusals vs Swift 1.5's
-# 98/100, KL 0.0884 from Swift 1.5) — Frank's order. The RCO tier is the
-# same per-tensor ALLOCATION recipe as the IQ3_S file (histogram: iq3_s
-# 97 / bf16 96 / iq3_xxs 83 / iq2_s 72 / iq4_xs 33 / iq2_xs 32 / iq2_xxs
-# 30 / q2_k 28 / q4_k 19 / q6_k 8 / iq1_s 4 / iq1_m 4 — all stock types,
-# stock llama.cpp loads it); publisher KLD: Mean 0.002631, 90 % 0.0421
-# (kld_results.csv). RCO files are "more experimental" per the README —
-# the quality floor is the IQ3_S rung, not a promise.
-#
-# The architecture is unchanged (same model family): qwen35 hybrid —
-# block_count 65 (64 real layers + the blk.64 MTP head),
-# full_attention_interval 4 => SIXTEEN full-attention layers, 24 Q heads
-# / 4 KV heads, k/v length 256, native window 262144, dense,
-# nextn_predict_layers=1. The MTP head ships in every main GGUF of this
-# repo (README); --spec-type draft-mtp loads it against the main model's
-# own weights.
-#
-# THE KV CONTRACT STAYS q8_0 K + q8_0 V (Frank, 2026-10-05): 34 KiB/token
-# (16 attn layers x 4 heads x 256 x 1.0625 B, K and V).
-#
-# Why TWO slots + MTP fits now (it did not under IQ3_S):
-#   card 24,576 MiB. Weights 9,963 MiB (10,442,827,392 B; IQ3_S was
-#   11,561). Projector ~1,290 MiB (the PUBLISHER's OWN mmproj-BF16.gguf,
-#   931,145,888 B, at the measured ~1.45x card law — no substitution).
-#   Compute buffers at ubatch 512 ~1.3 GiB. CUDA ctx ~500 MiB. DeltaNet
-#   state ~150 MiB/slot x 2. MTP draft ctx back: ~0.4 GiB. Non-KV ~13.9
-#   GiB. Two q8_0 slots = 8,704 MiB. Predicted free ~2.6-3.2 GiB — back
-#   over the old 2-3 GiB floor that the IQ3_S two-slot boot violated
-#   (measured there: 1,397 MiB free). MEASURE nvidia-smi free at boot
-#   (quote the free field) and let the runbook carry the number.
-#
-# Payload history (rollback trail): /home/dank/models/Swift15-IQ3S/ (the
-# IQ3_S-mtp that was live until this swap), Ornith-Q8/, MiMo-Q6K/ all
-# stay on disk; one MODEL_FILE + shape edit back each.
-LLAMA_BIN=/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server
-MODEL_FILE=/home/dank/models/Swift15-UncIQ3XXS/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-RCO-IQ3_XXS.gguf
-
-# Vision: the publisher SHIPS the projector — mmproj-BF16.gguf
-# (931,145,888 B) from the same repo, fetched by
-# scripts/download-frank-secondary.sh. No substitution needed for this
-# payload (the unsloth base-tower proof of 2026-10-05 remains the
-# fallback argument for the IQ3_S rollback payload).
-# Empty string = text-only on purpose.
-MMPROJ_FILE=/home/dank/models/Swift15-UncIQ3XXS/mmproj-BF16.gguf
-
-# Fleet endpoint: same port and alias as every frank-secondary before it, so the
-# harness models.yml id and the homepage probe do not move.
-ALIAS=frank-secondary
-BIND_ADDR=0.0.0.0
-LISTEN_PORT=7771
-
-# TWO conversations at Frank's 112k cap (2026-10-06 evening): --ctx-size is
-# the POOL llama.cpp divides across slots; 229376 / 2 = 114,688 per
-# conversation. Lowering from 128k (131,072) frees ~1 GiB of KV, which
-# funds the ubatch 512 -> 1024 increase (prefill throughput). The
-# per-slot window is the product contract, so models.yml follows to
-# 114,688.
-CTX_SIZE=229376
-PARALLEL=2
-
-# Compute-buffer geometry. Ubatch is a prefill knob (decode never moves);
-# the 1024 rung was the first A/B back once the per-slot context dropped
-# to 112k (2026-10-06 evening), and 2048 is the second (Frank, same night)
-# — the rung measured +4.6 % prefill for 616 MiB on the 3090 (2026-10-05
-# boot pair), affordable inside the 1,751 MiB the 112k cut freed. The pair
-# is a measurement, not a law (loud failure at graph capture if it does
-# not fit).
-BATCH_SIZE=4096
-UBATCH_SIZE=2048
-
-# The KV contract for this swap (Frank, 2026-10-05): q8_0 K + q8_0 V —
-# llama.cpp's FP8 class. The flags stay explicit so the choice is visible in
-# the argv either way, and --flash-attn stays pinned on in the serve script:
-# it is required for quantized V (the build carries
-# GGML_CUDA_FA_ALL_QUANTS=ON since 2026-09-17, so q8_0 KV is a real path,
-# not a silent f16 fallback).
-CACHE_TYPE_K=q8_0
-CACHE_TYPE_V=q8_0
-
-# Speculative decoding is ON (Frank, 2026-10-06 evening): draft-mtp at
-# depth 3 against the head IN the file (the -mtp variant ships the
-# blk.64.nextn.* tensors). ngram-mod stays skipped — on a qwen35 hybrid
-# it disables recurrent-state rollback, so a rejected draft would
-# corrupt the DeltaNet state; MTP needs no such bypass (its draft ctx
-# re-derives state from the target's own weights). The flags move as a
-# set: the serve script emits BOTH only when SPEC_TYPE names a drafter.
-SPEC_TYPE=draft-mtp
-SPEC_DRAFT_N_MAX=3
-
-NGL=99

scripts/frank-secondary.service

@@ -1,19 +0,0 @@
-[Unit]
-Description=llama.cpp Swift-1.5-Qwen3.8-27B Uncensored RCO IQ3_XXS GGUF (qwen35 hybrid, 2x131072 slots, q8_0 K+V, draft-mtp depth 3, mmproj vision) on the RTX 3090 (dankclaw, frank-secondary)
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=dank
-Group=dank
-# CUDA pins its staging buffers, so the process needs the memlock budget even
-# though the weights themselves are copied into VRAM.
-LimitMEMLOCK=infinity
-Environment="FRANK_SECONDARY_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-secondary.env"
-ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-secondary.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target

scripts/frank-zealot.env

@@ -0,0 +1,62 @@
+# frank-zealot — llama.cpp (master, CUDA sm_86) serving
+# HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive at Q6_K on the RTX 3090,
+# :7771.
+#
+# 2026-10-07 (Frank): swap from Gemma4-26B-A4B QAT Q4_K_M (one 200,704 slot)
+# to Qwen3.5-9B Q6_K at TWO 200,704-token conversations, EXACT (f16) KV,
+# MTP disabled (SPEC_TYPE=none), log verbosity 4.
+#
+# Architecture — read from the GGUF's own header (HTTP range read, not the
+# model card): arch qwen35, 32 layers, dense 9B, full_attention_interval 4
+# ⇒ 8 full-attention layers (3,7,11,...,31) + 24 Gated DeltaNet linear layers,
+# 16 attention heads / 4 KV heads × 256 dim, ssm conv_kernel 4 / state_size
+# 128 / group_count 16 / time_step_rank 32 / inner_size 4096, native 262,144,
+# vocab 248,320, file_type 18 (Q6_K). Tensor-type histogram: Q6_K×250 +
+# F32×177 — standard types only, so the stock master build loads it (no
+# custom-quant lock-in like the ROCmFPX era). NO nextn/mtp tensors exist, so
+# in-file MTP is impossible here; SPEC_TYPE=none is forced by the payload.
+#
+# The KV rate follows from the architecture: 8 full layers × 4 KV heads ×
+# 256 dim = 8,192 elements per token per cache. f16 K + f16 V = 32,768
+# B/token = 32 KiB/token, so the 401,408-token pool is 12.25 GiB. The 24
+# DeltaNet layers cost a fixed recurrent state per SLOT (not per token) —
+# that is why two 200k slots fit where the 26B MoE fit only one.
+#
+# Feasibility comes from the predecessor's MEASURED boots, not a formula:
+# MiMo-V2.6-Distill-Qwen-9B (identical qwen35 geometry, 7,793,710,624 B) at
+# 2×200,704 f16 K + f16 V measured 21,276 used / 2,849 free at ubatch 1024
+# and 21,846 / 2,279 at ubatch 2048. This file is 415 MiB lighter in weights,
+# its BF16 mmproj is 3 MiB heavier ⇒ projected ~21,430 used / ~2,700 free.
+# The verbosity-4 boot ledger is the referee.
+#
+# Ubatch 2048 is the measured CUDA optimum (measured on the MiMo predecessor
+# at this exact arch + shape: +4.6 % prefill at 8.9k depth, decode flat, cost
+# 616 MiB). 1024 is the fallback rung if the boot lands under the 2 GiB floor.
+LLAMA_BIN=/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server
+MODEL_FILE=/home/dank/models/Qwen35-9B-HauhauCS-Q6K/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf
+MMPROJ_FILE=/home/dank/models/Qwen35-9B-HauhauCS-Q6K/mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf
+# Served model id — the harness/family name (Protoss rename completed to the
+# wire 2026-10-09: harness ids + homepage cards 2026-10-08, /v1/models aliases
+# this day). The SERVICE, unit, scripts and this env file keep the
+# frank-zealot name; only the alias on the wire changed. Consumers that
+# key on the served id: OpenWebUI (model row, access_grant, api_configs
+# model_ids) and the harness models.yml.
+ALIAS=frank-zealot
+BIND_ADDR=0.0.0.0
+LISTEN_PORT=7771
+# CTX_SIZE is the POOL llama.cpp divides across slots: 401,408 / 2 = 200,704
+# per conversation. MUST stay divisible by PARALLEL (the seam enforces it) and
+# the harness contextWindow quotes the PER-SLOT number — a longer prompt is
+# answered with a 400, never truncated.
+CTX_SIZE=401408
+PARALLEL=2
+BATCH_SIZE=4096
+UBATCH_SIZE=2048
+CACHE_TYPE_K=f16
+CACHE_TYPE_V=f16
+SPEC_TYPE=none
+NGL=99
+# Log verbosity threshold (llama.cpp -lv). 4 = debug: KV layout, buffer sizes
+# and graph capture land in the journal, which is what the VRAM-fit forensics
+# read. Levels above 4 flood the journal.
+VERBOSITY=4

scripts/frank-zealot.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=llama.cpp Qwen3.5-9B-Uncensored-HauhauCS-Aggressive Q6_K GGUF (qwen35 hybrid, 2x200704 slots, f16 K+V, MTP off, mmproj vision) on the RTX 3090 (dankclaw, frank-zealot)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=dank
+Group=dank
+# CUDA pins its staging buffers, so the process needs the memlock budget even
+# though the weights themselves are copied into VRAM.
+LimitMEMLOCK=infinity
+Environment="FRANK_ZEALOT_ENV_FILE=/home/dank/serverAppConfigs/scripts/frank-zealot.env"
+ExecStart=/home/dank/serverAppConfigs/scripts/serve-frank-zealot.sh
+# Restart=always is the right policy for a serving daemon: a process that
+# exits on its own — exit 0 — is a CLEAN stop to systemd, so on-failure
+# never fires and the endpoint stays dark (with the unit reporting
+# success) until the next boot. frank-zealot is the fleet's compaction
+# hub — every endpoint's compaction dies when it does.
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

scripts/kld-gate-swift15.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# kld-gate-swift15.sh — RUNS ON DANKSERVER. Score the quantized candidate
+# against the BF16 reference and apply the pre-approved gate:
+#   mean KL <= 0.03 AND top-1 agreement >= 95%.
+# Same engine (1.0.13) and same boot shape as the reference RECORD
+# (run-swift15-bf16.sh kld): disk-tier, no speculation, deterministic, fp8 KV.
+# --kld-ref reads its tokens from the reference (no --kld-corpus here — the
+# (run-swift15-bf16.sh kld): 1.0.13, tp 2, disk-tier, fp8 KV, no speculation,
+# deterministic, max-model-len 16384, vram-kv 3072, 4 slots. Two deviations
+# are forced by the w4 file: MNBT 2048 (the w4 kernels stream from the file
+# tier ONLY at MNBT<=2048 — at the recording's 32768 the engine demands a
+# widened form: "DID NOT FIT ... stored form is not the container's"), and
+# pool 40960 (the recording's 12 GiB pool predates the w4 tables; at 12288 the
+# gate_up slab cannot be cached). Chunk size is softmax-invariant, so the
+# MNBT delta is float-order noise riding on the KL floor.
+set -uo pipefail
+PIN=sha256:4c3f484564bb2872784e46b0a59cbd71becc9c1e746e301a3596ffae253c322e
+C=swift15gate
+LOG=/home/dank/logs/swift15_kldgate.log
+KLD_REF_DIR=/home/dank/corpora/kld-ref
+KLD_OUT=/home/dank/radiance-state/kld-gate.json
+
+[ -d "$KLD_REF_DIR" ] || { echo "missing reference: $KLD_REF_DIR"; exit 2; }
+: > "$KLD_OUT"
+cp -f /home/dank/serverAppConfigs/scripts/qwen38-froggeric-v22.5.jinja \
+      /home/dank/models/tpl.jinja 2>/dev/null || true
+sudo systemctl stop frank-archon >/dev/null 2>&1 || true
+podman rm -f "$C" >/dev/null 2>&1 || true
+
+podman run --rm --name "$C" \
+    --network host --init \
+    --security-opt seccomp=unconfined \
+    --ulimit memlock=-1:-1 \
+    --device /dev/kfd --device /dev/dri \
+    -v /home/dank/models:/models:ro \
+    -v /home/dank/radiance-state:/data \
+    -v "$KLD_REF_DIR:/data/kld-ref:ro" \
+    "stilldeadcode/radiance@$PIN" \
+    --model /models/rad/qwen4exp-swift15-w4dn8-i8-hc8m.rad \
+    --tp 2 --placement expert_tiered --weights-disk-tier \
+    --host-pool-mib 40960 --deterministic --gpu-headroom-mib 768 \
+    --num-speculative-tokens 0 \
+    --kv-cache-dtype fp8 --max-model-len 16384 \
+    --ngram-placement ram \
+    --override-chat-template /models/tpl.jinja \
+    --kld-ref /data/kld-ref --kld-out /data/kld-gate.json \
+    --vram-kv-mib 3072 \
+    --max-num-seqs 4 --max-num-batched-tokens 2048 \
+    2>&1 | tee "$LOG"
+rc=${PIPESTATUS[0]}
+[ "$rc" -eq 0 ] || { echo "KLD GATE BOOT FAILED rc=$rc; log: $LOG"; exit "$rc"; }
+
+python3 - "$KLD_OUT" "$LOG" <<'PY'
+import json, sys, re
+out, log = sys.argv[1], sys.argv[2]
+def num(pat):
+    m = re.findall(pat, open(log, errors="replace").read(), re.I)
+    return float(m[-1]) if m else None
+kl = top1 = None
+try:
+    d = json.load(open(out))
+    def find(obj, keys):
+        if isinstance(obj, dict):
+            for k, v in obj.items():
+                if any(s in k.lower() for s in keys) and isinstance(v, (int, float)):
+                    return float(v)
+            for v in obj.values():
+                r = find(v, keys)
+                if r is not None: return r
+        return None
+    kl = find(d, ("mean_kl", "mean kl", "kl_mean", "mean"))
+    top1 = find(d, ("top1", "top_1", "top-1", "agreement"))
+    if top1 is not None and top1 <= 1.0:
+        top1 *= 100.0
+except Exception as e:
+    print("report JSON unusable (%s); falling back to log" % e)
+if kl is None:
+    kl = num(r"mean[_ ]kl[^0-9]*([0-9]*\.?[0-9]+(?:e[-+][0-9]+)?)")
+if top1 is None:
+    top1 = num(r"top[-_ ]?1[^0-9]*([0-9]*\.?[0-9]+)")
+if kl is None or top1 is None:
+    print("KLD GATE PARSE FAILED: mean_kl=%s top1=%s — inspect %s / %s" % (kl, top1, out, log))
+    sys.exit(2)
+print("KLD GATE: mean KL = %.4f (max 0.03) | top-1 = %.2f%% (min 95.0)" % (kl, top1))
+ok = (kl <= 0.03) and (top1 >= 95.0)
+print("KLD GATE " + ("PASS" if ok else "FAIL"))
+sys.exit(0 if ok else 1)
+PY
+gate=$?
+echo "kld-gate complete rc=$gate; log: $LOG report: $KLD_OUT"
+exit "$gate"

scripts/kld-then-calib.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# kld-then-calib.sh — RUNS ON DANKSERVER. Campaign chain: wait for the KLD
+# record to finish, verify it, then boot the 1.2.0 calibration server and
+# push the 10M-token corpus. One GPU, so the phases serialize; prod is
+# restored by each run script's trap.
+set -u
+KLOG=/home/dank/logs/swift15-kld-driver.log
+CLOG=/home/dank/logs/swift15-calib-driver.log
+S=/home/dank/serverAppConfigs-swift15/scripts
+# Phase 1: KLD record (SKIP_KLD=1 when the record is already complete —
+# kld.json's rows count is the receipt; a mid-run script swap can kill the
+# wrapper with rc=127 after the engine exited clean).
+if [ "${SKIP_KLD:-0}" != 1 ]; then
+    while ! grep -q "exited rc=" "$KLOG" 2>/dev/null; do sleep 60; done
+    RC=$(grep -o "exited rc=[0-9]*" "$KLOG" | tail -1)
+    if [ "$RC" != "exited rc=0" ]; then echo "KLD FAILED ($RC); calib NOT started"; exit 1; fi
+fi
+N=$(find /home/dank/corpora/kld-ref -type f | wc -l)
+SZ=$(du -sm /home/dank/corpora/kld-ref | cut -f1)
+echo "KLD OK files=$N size_mib=$SZ"
+[ "$N" -ge 5 ] && [ "$SZ" -ge 1000 ] || { echo "kld-ref looks thin; calib NOT started"; exit 1; }
+grep -q '"rows": 50235' /home/dank/corpora/kld-ref/kld.json || {
+    echo "kld.json rows != 50235; calib NOT started"; exit 1; }
+
+# Phase 2: calibration serve (1.2.0) + corpus push.
+nohup bash "$S/run-swift15-bf16.sh" calib > "$CLOG" 2>&1 &
+CP=$!
+for _ in $(seq 1 160); do
+    sleep 15
+    curl -sf localhost:7770/health >/dev/null 2>&1 && break
+done
+if ! curl -sf localhost:7770/health >/dev/null 2>&1; then
+    echo "CALIB BOOT FAILED; see /home/dank/logs/swift15_bf16.log"; kill "$CP" 2>/dev/null; exit 1
+fi
+echo "CALIB UP, pushing corpus"
+python3 "$S/calib-push.py" --port 7770 --parallel 16 --container swift15ref --max-rounds 6
+PUSH=$?
+kill "$CP" 2>/dev/null
+sleep 10
+echo "CALIB_CHAIN_DONE push=$PUSH grams=$(find /home/dank/corpora/calib -name 'gram.r*.bin' 2>/dev/null | wc -l)"

scripts/lib/llm-gates.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# llm-gates.sh — the artifact gates every LLM endpoint runs before it starts.
+#
+# Why this file exists: every LLM endpoint gates its payload twice — the
+# serve script at start, the deployer before dispatch. Two hand-written
+# copies of the same checks drift apart in wording and strictness, and the
+# drift surfaces as deploy-time disagreement: one side passes, the other
+# refuses, and the failure lands in production instead of in the gate.
+# Both sides source this library, so the refusal is one text and one rule.
+#
+# Contract (public interface):
+#   require_exec      PATH LABEL HINT
+#   require_file      PATH LABEL HINT
+#   require_bytes     PATH LABEL WANT_BYTES HINT
+#   require_min_mib   PATH LABEL MIN_MIB HINT
+#   require_dir_files DIR  LABEL HINT FILE...
+#   require_image     REF  HINT
+#
+# Each returns 0 and prints nothing on success. On failure it prints two
+# lines to stderr — the first naming the endpoint ($GATE_PREFIX) and the
+# artifact, the second the remedy — and returns 1. It NEVER exits: the serve
+# scripts run under `set -e` (so a refusal is terminal), while the deployer
+# wants `|| return 1` so a failed gate reports a red deploy for that one
+# service and the dispatcher's state marker stays pending.
+# Lines are labelled by ARTIFACT CLASS, and the class is the whole label
+# (the path rides in the same line): the class + path is what an operator
+# acts on, so no wording order and no payload rename can make the two twins
+# disagree. The deployer's old "halogen vision tower" and the serve script's
+# "vision-tower" were one gate in two vocabularies that no grep could join.
+
+# Size checks use equality, not a floor, for `require_bytes`: a fetch that
+# truncates looks like a success (an HTTP error exit is often swallowed, and
+# the error body is written in the artifact's place), so "exists and is big
+# enough" is not proof of the right artifact. The declared byte count is a
+# contract in both directions — a bigger file is a DIFFERENT artifact.
+
+# GATE_PREFIX names the endpoint in every refusal (e.g. frank-dragoon). The
+# caller exports it; shellcheck cannot follow it across the source boundary,
+# so the read site carries the directive.
+# shellcheck disable=SC2034
+: "${GATE_PREFIX:=gate}"
+
+# Two bash behaviors make the `return 1` at every call site load-bearing:
+#   * a function whose body ends inside an `if` returns the CONDITION's
+#     status (true = 0), so a gate that ends on its own refusal prints the
+#     refusal and reports SUCCESS;
+#   * `set -e` is suspended for any command in a `… || …` chain, so a gate
+#     that runs inside one must not be trusted to abort the caller.
+# Every gate's refusal therefore carries an explicit `|| return 1`, and the
+# caller consumes the status (`|| exit 1`, `|| return 1`).
+_gate_fail() {
+    printf '%s: %s\n' "$GATE_PREFIX" "$1" >&2
+    printf '  hint: %s\n' "$2" >&2
+    return 1
+}
+
+# require_file — PATH must be a regular file. A directory (an unpacked
+# staging dir wearing the payload's name) and a symlink (a HuggingFace cache
+# snapshot's entry, which dangles inside the container mount) both refuse.
+require_file() {
+    local path="$1" label="$2" hint="$3"
+    if [[ -L "$path" || ! -f "$path" ]]; then
+        _gate_fail "$label: missing at $path" "$hint" || return 1
+    fi
+    return 0
+}
+
+# require_exec — PATH must be an executable regular file. The native runtimes
+# (llama.cpp's llama-server) are binaries the operator builds; a tree that
+# compiled but lost its +x, or a directory wearing the binary's name, must
+# refuse the same way a missing one does.
+require_exec() {
+    local path="$1" label="$2" hint="$3"
+    if [[ -L "$path" || ! -x "$path" ]]; then
+        _gate_fail "$label: missing at $path" "$hint" || return 1
+    fi
+    return 0
+}
+
+# require_bytes — PATH must exist AND be exactly WANT_BYTES bytes.
+require_bytes() {
+    local path="$1" label="$2" want="$3" hint="$4" got
+    require_file "$path" "$label" "$hint" || return 1
+    got="$(stat -c %s "$path")"
+    if [[ "$got" != "$want" ]]; then
+        _gate_fail "$label: is $got bytes, expected $want" "$hint" || return 1
+    fi
+    return 0
+}
+
+# require_min_mib — PATH must be at least MIN_MIB mebibytes. The floor form
+# is for build products (a .rad container is a range of legal sizes; a
+# truncated convert is not).
+require_min_mib() {
+    local path="$1" label="$2" min="$3" hint="$4" mib
+    require_file "$path" "$label" "$hint" || return 1
+    mib=$(( $(stat -c %s "$path") / 1048576 ))
+    if (( mib < min )); then
+        _gate_fail "$label: is $mib MiB, expected >= $min MiB" "$hint" || return 1
+    fi
+    return 0
+}
+
+# require_dir_files — DIR must be a directory and every named member a
+# regular file, never a symlink: snapshot layouts link files into place, and
+# a link dangles inside the container mount even when the directory itself
+# is real. A symlinked DIRECTORY is refused too — the same layout can link
+# the directory itself, and the link dangles identically.
+require_dir_files() {
+    local dir="$1" label="$2" hint="$3"
+    shift 3
+    local f
+    if [[ -L "$dir" || ! -d "$dir" ]]; then
+        _gate_fail "$label: missing at $dir" "$hint" || return 1
+    fi
+    for f in "$@"; do
+        if [[ -L "$dir/$f" || ! -f "$dir/$f" ]]; then
+            _gate_fail "$label: $dir/$f is missing or a symlink" "$hint" || return 1
+        fi
+    done
+    return 0
+}
+
+# require_image — the image ref must be in podman storage. A name@sha256 ref
+# exists only if THAT manifest was pulled, so the gate is the ref itself, in
+# one command: no pipefail/grep race (the 2026-09-30 lesson).
+require_image() {
+    local ref="$1" hint="$2"
+    if ! podman image exists "$ref"; then
+        _gate_fail "image: $ref is not in podman storage" "$hint" || return 1
+    fi
+    return 0
+}

scripts/make-calib-corpus.py

@@ -0,0 +1,317 @@
+#!/usr/bin/env python3
+"""Build the two Swift1.5 campaign corpora (calibration + KLD).
+
+calib.jsonl — 10M tokens of agent-shaped RAW text (45% code, 30% prose,
+25% tool-call JSON), one {"prompt": text} per line, pushed to
+/v1/completions with max_tokens=1 during the calibration run (the Hessian
+tap is of the prompt tokens; docs/MOE-W4.md step 2). Code and prose mix
+the repo checkout with HF dataset parquets (Frank's call 2026-10-06:
+local material is only ~1.6M unique tokens; MOE-W4 wants 10M):
+nampdn-ai/tiny-codes (code) and Salesforce/wikitext wikitext-103-raw
+(prose). Tool calls are synthesized from commands harvested from the
+repo's own scripts plus a fleet-ops set, with argument-shaped variants.
+
+kld.jsonl — 1.8M tokens, one {"prompt", "score_from", "source"} per
+line; each prompt is a multi-turn conversation rendered through the
+Froggeric v22.5 template with a >= --kld-min-prompt (8192) token target,
+and the last 256 tokens (the tail of the assistant answer) are the
+scored span: score_from = n - 256. At 8k-token prompts the 1.8M corpus
+is ~220 prompts = ~56k scored positions ~= 25 GB of record, matching
+the published Flash-Next KLD scale (83k positions, MOE-W4.md). The KLD
+reference run and every candidate run consume the SAME file (TOOLS.md
+--kld-record / --kld-ref). The KLD corpus is LOCAL material only, so the
+file-level disjointness rule (fnv1a64(path) % 5 == 0 -> KLD pool) is
+untouched by the HF additions.
+
+Deps: tokenizers, jinja2, pyarrow (venv /home/dank/venvs/radcorpus).
+Usage: make-calib-corpus.py --repo ROOT --tokenizer-json PATH
+    --template PATH --out-dir DIR [--hf-code-parquet F,F]
+    [--hf-prose-parquet F,F] [--calib-tokens 10000000]
+    [--kld-tokens 1800000]
+"""
+import argparse
+import json
+import os
+import random
+import re
+
+from jinja2 import Environment, FileSystemLoader
+from tokenizers import Tokenizer
+
+CODE_EXT = (".sh", ".py", ".jinja", ".recipe", ".env", ".example",
+            ".yaml", ".yml", ".bats", ".service", ".container", ".toml")
+JSONL_EXTS = (".jsonl", ".json")
+DOC_DIR = "serverAppConfigs-docs"
+
+FLEET_CMDS = [
+    "systemctl status frank-archon --no-pager",
+    "journalctl -u frank-archon -n 100 --no-pager",
+    "podman ps --format '{{.Names}} {{.Status}}'",
+    "podman logs --tail 50 frank-archon",
+    "curl -s http://192.168.0.235:7770/health",
+    "curl -s http://192.168.0.235:7770/metrics | grep radiance_",
+    "df -h /home/dank | tail -1",
+    "free -g",
+    "sudo systemctl restart frank-archon",
+    "cd /home/dank/serverAppConfigs && git pull --ff-only",
+    "./scripts/deploy.sh dankserver --service frank-archon",
+    "./tests/run.sh 2>&1 | tail -5",
+    "jq . /home/dank/models/rad/index.json | head -40",
+    "python3 -c \"import json; print(json.load(open('config.json'))['num_hidden_layers'])\"",
+    "ip neigh show 192.168.0.235",
+    "amdgpu_top --device-info 2>/dev/null | head -20",
+    "grep -E 'MemAvailable' /proc/meminfo",
+    "sha256sum model-00001-of-00131.safetensors",
+    "git log --oneline -10",
+    "awk '{s+=$1} END {print s}' shard_sizes.txt",
+]
+TOOL_NAMES = ["bash", "read", "grep", "web_search", "edit", "write"]
+WORKDIRS = ["/home/dank", "/home/dank/serverAppConfigs", "/home/dank/models",
+            "/etc/systemd/system", "/var/log"]
+DESCS = ["check service state", "tail the engine ledger", "list containers",
+          "query health", "read metrics", "check disk", "check memory",
+          "restart the endpoint", "sync the checkout", "run deployer",
+          "run the test seams", "inspect the index", "probe the peer"]
+
+
+def fnv(s: str) -> int:
+    h = 0xcbf29ce484222325
+    for b in s.encode():
+        h = ((h ^ b) * 0x100000001b3) & 0xFFFFFFFFFFFFFFFF
+    return h
+
+
+def harvest_cmds(repo: str, rng: random.Random) -> list[str]:
+    cmds = list(FLEET_CMDS)
+    pat = re.compile(r"^\s*(?:sudo\s+)?([a-z][\w./-]*(?:\s+\S+){1,6})\s*$")
+    for root, dirs, files in os.walk(repo):
+        dirs[:] = [d for d in dirs if not d.startswith(".")]
+        for f in files:
+            if not f.endswith(".sh"):
+                continue
+            try:
+                for line in open(os.path.join(root, f), encoding="utf-8",
+                                 errors="replace"):
+                    m = pat.match(line.rstrip())
+                    if m and len(m.group(1)) > 12:
+                        cmds.append("ssh dank@192.168.0.235 '"
+                                    + m.group(1)[:90] + "'")
+            except OSError:
+                pass
+    rng.shuffle(cmds)
+    return cmds[:4000]
+
+
+def tool_call(rng: random.Random, cmds: list[str]) -> str:
+    """One agent turn: 2-4 tool calls with argument-shaped JSON."""
+    parts = []
+    for _ in range(rng.randint(2, 4)):
+        args: dict = {"command": rng.choice(cmds)}
+        if rng.random() < 0.4:
+            args["cwd"] = rng.choice(WORKDIRS)
+        if rng.random() < 0.3:
+            args["timeout"] = rng.choice([10, 30, 60, 300, 600])
+        if rng.random() < 0.5:
+            args["description"] = rng.choice(DESCS)
+        parts.append('<tool_call>{"name": "%s", "arguments": %s}<|im_end|>'
+                     % (rng.choice(TOOL_NAMES),
+                        json.dumps(args, ensure_ascii=False)))
+    return "\n".join(parts)
+
+
+def load_parquet_texts(path: str, kind: str, rng: random.Random,
+                       cap: int) -> list[str]:
+    import pyarrow.parquet as pq
+    d = pq.read_table(path).to_pydict()
+    n = len(next(iter(d.values())))
+    idx = range(n) if n <= cap else rng.sample(range(n), cap)
+    out = []
+    for i in idx:
+        if kind == "code":
+            if "content" in d:
+                frag = d["content"][i]
+            else:
+                frag = ("// %s\n### Instruction:\n%s\n### Response:\n%s"
+                        % (d.get("file_name", [""])[i], d["prompt"][i],
+                           d["code"][i] or d["response"][i]))
+        else:
+            frag = d["text"][i]
+        if frag and frag.strip():
+            out.append(frag[:8000])
+    rng.shuffle(out)
+    return out[:cap]
+
+
+def main() -> None:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--repo", required=True)
+    ap.add_argument("--tokenizer-json", required=True)
+    ap.add_argument("--template", required=True)
+    ap.add_argument("--out-dir", required=True)
+    ap.add_argument("--calib-tokens", type=int, default=10_000_000)
+    ap.add_argument("--kld-tokens", type=int, default=1_800_000)
+    ap.add_argument("--chunk-tokens", type=int, default=8192)
+    ap.add_argument("--score-tail", type=int, default=256)
+    ap.add_argument("--kld-min-prompt", type=int, default=8192)
+    ap.add_argument("--hf-code-parquet", default="")
+    ap.add_argument("--hf-prose-parquet", default="")
+    ap.add_argument("--seed", type=int, default=20261006)
+    a = ap.parse_args()
+
+    rng = random.Random(a.seed)
+    tokenizer = Tokenizer.from_file(a.tokenizer_json)
+    env = Environment(loader=FileSystemLoader(os.path.dirname(a.template)),
+                      trim_blocks=True, lstrip_blocks=True)
+    env.filters["tojson"] = lambda v: json.dumps(v, ensure_ascii=False)
+    env.filters["raise_exception"] = lambda m: (_ for _ in ()).throw(
+        ValueError(m))
+    tname = os.path.basename(a.template)
+
+    code, prose, jsonl = [], [], []
+    for root, dirs, files in os.walk(a.repo):
+        dirs[:] = [d for d in dirs if not d.startswith(".")]
+        for f in sorted(files):
+            p = os.path.relpath(os.path.join(root, f), a.repo)
+            if DOC_DIR in p and f.endswith(".md"):
+                prose.append(p)
+            elif p.startswith(DOC_DIR):
+                pass
+            elif f.endswith(CODE_EXT):
+                code.append(p)
+            elif f.endswith(JSONL_EXTS) and f != "package-lock.json":
+                jsonl.append(p)
+    # file-level split: bucket 0 -> KLD pool, 1..4 -> calibration pool
+    pools: dict[str, tuple[list, list]] = {}
+    for cls, lst in (("code", code), ("prose", prose), ("tools", jsonl)):
+        pools[cls] = ([p for p in lst if fnv(p) % 5 == 0],
+                      [p for p in lst if fnv(p) % 5 != 0])
+
+    def text_of(p: str) -> str:
+        path = os.path.join(a.repo, p)
+        raw = open(path, encoding="utf-8", errors="replace").read()
+        if p.endswith(JSONL_EXTS):
+            lines = [json.loads(l)["content"] for l in raw.splitlines()
+                     if l.strip() and "content" in l]
+            raw = "\n".join(lines)
+        toks = tokenizer.encode(raw, add_special_tokens=False).ids
+        return tokenizer.decode(toks[:2400], skip_special_tokens=True)
+
+    cmds = harvest_cmds(a.repo, rng)
+    # fragment pools per class, corpus-split first
+    frags: dict[str, dict[str, list[str]]] = {}
+    for cls in pools:
+        kld_files, cal_files = pools[cls]
+        fr = {}
+        src = {"kld": kld_files, "cal": cal_files}
+        if cls == "tools":
+            fr["kld"] = [tool_call(rng, cmds) for _ in range(600)]
+            fr["cal"] = [tool_call(rng, cmds) for _ in range(40000)]
+        else:
+            fr["kld"] = [text_of(p) for p in src["kld"]]
+            fr["cal"] = [text_of(p) for p in src["cal"]]
+        frags[cls] = fr
+    # per-class fragment caps: prose rows are short (~66 tok) so need many;
+    # codeparrot files are long (~2.6k tok) so a small cap suffices
+    hfcap = {"code": 40000, "prose": 60000, "tools": 0}
+    for cls, spec in (("code", a.hf_code_parquet),
+                      ("prose", a.hf_prose_parquet)):
+        for path in [p for p in spec.split(",") if p]:
+            frags[cls]["cal"].extend(
+                load_parquet_texts(path, cls, rng, cap=hfcap[cls]))
+    for cls in frags:
+        rng.shuffle(frags[cls]["cal"])
+
+    def toks(s: str) -> int:
+        return len(tokenizer.encode(s, add_special_tokens=False).ids)
+
+    def emit_calib() -> tuple[int, list[dict]]:
+        targets = {"code": .45, "prose": .30, "tools": .25}
+        rows: list[dict] = []
+        for cls, frac in targets.items():
+            want = int(a.calib_tokens * frac)
+            pool = frags[cls]["cal"]
+            if not pool:
+                continue
+            got, i, buf, nbuf = 0, 0, [], 0
+            while got < want:
+                frag = pool[i % len(pool)]
+                i += 1
+                n = toks(frag)
+                if nbuf + n > a.chunk_tokens and buf:
+                    rows.append({"prompt": "\n".join(buf), "cls": cls})
+                    got += nbuf
+                    buf, nbuf = [], 0
+                    if got >= want:
+                        break
+                buf.append(frag)
+                nbuf += n
+                if i > len(pool) * 40:
+                    break  # pool exhausted with repeats; stop
+            if buf and got < want:
+                rows.append({"prompt": "\n".join(buf), "cls": cls})
+                got += nbuf
+            print(f"calib {cls}: {got} tokens, {i} fragments")
+        rng.shuffle(rows)
+        return len(rows), [{k: v for k, v in r.items() if k == "prompt"}
+                           for r in rows]
+
+    def emit_kld() -> tuple[int, list[dict]]:
+        rows, total = [], 0
+        classes = ["code", "prose", "tools"]
+        i = {c: 0 for c in classes}
+        guard = 0
+        while total < a.kld_tokens and guard < 5000:
+            guard += 1
+            msgs, srcs = [], []
+            for t in range(rng.choice([2, 3, 4])):
+                cls = classes[(len(rows) + t) % 3]
+                pool = frags[cls]["kld"]
+                if not pool:
+                    continue
+                frag = pool[i[cls] % len(pool)]
+                i[cls] += 2
+                msgs.append({"role": "user",
+                             "content": "Summarize and explain this "
+                                        f"engineering material:\n{frag}"})
+                msgs.append({"role": "assistant",
+                             "content": frag[:4000]})
+                srcs.append(cls)
+            rendered = env.get_template(tname).render(
+                messages=msgs, add_generation_prompt=False)
+            n = toks(rendered)
+            if n < a.kld_min_prompt:
+                continue
+            rows.append({"prompt": rendered,
+                         "score_from": n - a.score_tail,
+                         "source": "+".join(sorted(set(srcs)))})
+            total += n
+        return len(rows), rows
+
+    os.makedirs(a.out_dir, exist_ok=True)
+    nc, rows = emit_calib()
+    with open(os.path.join(a.out_dir, "calib.jsonl"), "w") as f:
+        for r in rows:
+            f.write(json.dumps(r) + "\n")
+    nk, krows = emit_kld()
+    with open(os.path.join(a.out_dir, "kld.jsonl"), "w") as f:
+        for r in krows:
+            f.write(json.dumps(r) + "\n")
+    scored = sum(len(tokenizer.encode(r["prompt"], add_special_tokens=False).ids)
+                 - r["score_from"] for r in krows)
+    manifest = {
+        "seed": a.seed, "template": tname,
+        "tokenizer": os.path.basename(a.tokenizer_json),
+        "calib_prompts": nc, "kld_prompts": nk,
+        "kld_scored_positions": scored,
+        "kld_score_tail": a.score_tail,
+        "disjoint_file_pools": "local KLD material only; HF code feeds calib",
+        "calib_mix": {"code": .45, "prose": .30, "tools": .25},
+        "hf_code": a.hf_code_parquet, "hf_prose": a.hf_prose_parquet,
+    }
+    with open(os.path.join(a.out_dir, "manifest.json"), "w") as f:
+        json.dump(manifest, f, indent=1)
+    print(json.dumps(manifest, indent=1))
+
+
+if __name__ == "__main__":
+    main()

scripts/patches/glm53-compile-01-model-decorator.patch

@@ -2,7 +2,7 @@
 #
 # STATUS: WIP — first of three patches in the "compile the GLM trunk" changelist. The
 # set does NOT yet boot the engine (see 03 for the next blocker), so it is NOT part of
-# the deployed frank-primary shape. Nothing in scripts/ mounts these files.
+# the deployed frank-archon shape. Nothing in scripts/ mounts these files.
 #
 # WHY THIS IS THE RIGHT LEVER (measured 2026-09-30, not inferred):
 #

scripts/patches/glm53-dflash-01-aux-hidden-states.patch

@@ -29,10 +29,11 @@
 #     its base SupportsEagleBase (has_own_lm_head, has_own_embed_tokens) -- and
 #     getattr_static()s each one off the instance, breaking on the first miss.
 #     So BOTH wrappers need all three attributes.
-#   * MRO law: INHERITING SupportsEagle3 as a base dies at class creation with
-#     "Cannot create a consistent method resolution order (MRO) for bases ..."
-#     (GLM's wrappers already carry four/five Protocol-derived bases).  The
-#     attribute route avoids the MRO entirely.  Also proven by simulation:
+#   * Why not inheritance: adding SupportsEagle3 as a BASE class dies at
+#     class creation with "Cannot create a consistent method resolution
+#     order (MRO) for bases ..." (GLM's wrappers already carry four/five
+#     Protocol-derived bases; the base ordering cannot take another). The
+#     attribute route avoids the MRO entirely; simulation confirms that
 #     the four-base ForCausalLM ordering cannot take SupportsEagle3 in ANY
 #     position.
 #   * Method placement: without inheriting, the Protocol's default

scripts/patches/gpu_worker-kv-cap.patch

@@ -1,6 +1,6 @@
 # gpu_worker-kv-cap.patch — fork-local fix for the expert-offload KV cap.
 #
-# STATUS: NOT part of the deployed frank-primary shape. It exists because the
+# STATUS: NOT part of the deployed frank-archon shape. It exists because the
 # fork's plan under-models this model's KV, and it is the enabler for a future
 # MTP attempt (the production GLM shape runs without MTP and boots fine on the
 # plan's own reserve).

scripts/probe-frank-archon-kv.py

@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""probe-frank-archon-kv.py — verify the 2 x 200,000 KV contract on a LIVE
+frank-archon (radiance) service. Run it ON dankserver: it talks to
+127.0.0.1:7770 and builds its prompts from the repo checkout there.
+No scratch container, no mask: the service under test is the service.
+
+    ssh dankserver 'python3 /home/dank/serverAppConfigs/scripts/probe-frank-archon-kv.py'
+
+Three probes, in increasing cost:
+  A  decode at depth — one ~51k-token chat completion, 512 tokens, greedy.
+     Reports the engine's own `timings` (prefill, decode, draft acceptance).
+     Method: >=128 generated tokens (below that, first-token latency
+     dominates the decode rate), greedy (sampling noise is unattributable),
+     real text (synthetic text inflates draft acceptance).
+  B  the capacity contract — TWO concurrent chats of ~197k prompt tokens
+     (~394k tokens resident) each carrying a unique marker at its head. Both
+     must answer their own marker. This is what a 2 x 200,000 endpoint owes:
+     two full-height conversations resident at once, exact retrieval in both.
+  C  prefix-cache restore — probe A's cold prompt again, so the disk tier has
+     to give the blocks back (cache_n > 0, TTFT collapses).
+
+PROBE PITFALL: radiance routes the thinking block to
+`reasoning_content`, so a chat request whose budget is spent inside
+`<think>` returns EMPTY `content` with `finish_reason: stop`. A probe that
+reads `content` alone scores 0/2 on a healthy server. Every request here
+sets chat_template_kwargs.enable_thinking=false and reads both fields.
+
+A/B method for a shape change (no scratch container): write a variant env file
+on the host, point a transient systemd drop-in at it
+(`Environment=FRANK_ARCHON_ENV_FILE=...` — drop-ins are read AFTER the unit's
+own Environment= lines, so they win), restart, probe, delete the drop-in,
+daemon-reload, restart. `systemctl mask` is not available: the unit file in
+/etc/systemd/system is a relink symlink into the checkout.
+"""
+import json
+import glob
+import time
+import urllib.request
+import concurrent.futures
+
+BASE = "http://127.0.0.1:7770"
+MODEL = "frank-archon"
+REPO = "/home/dank/serverAppConfigs"
+GLOBS = [f"{REPO}/scripts/*.sh", f"{REPO}/serverAppConfigs-docs/**/*.md"]
+
+
+def post(payload, timeout=1800):
+    req = urllib.request.Request(
+        BASE + "/v1/chat/completions",
+        data=json.dumps(payload).encode(),
+        headers={"Content-Type": "application/json"},
+    )
+    t0 = time.time()
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        body = json.loads(r.read().decode())
+        hdr = dict(r.headers.items())
+    return body, time.time() - t0, hdr
+
+
+def get(path, timeout=60):
+    with urllib.request.urlopen(BASE + path, timeout=timeout) as r:
+        return json.loads(r.read().decode())
+
+
+def corpus(min_chars):
+    files = []
+    for g in GLOBS:
+        files.extend(sorted(glob.glob(g, recursive=True)))
+    out, total = [], 0
+    for f in files:
+        try:
+            t = open(f, encoding="utf-8", errors="replace").read()
+        except OSError:
+            continue
+        out.append(t)
+        total += len(t)
+        if total > min_chars:
+            break
+    return "".join(text for text in out)
+
+
+def prompt(text, chars, salt, fact):
+    """Real repo text, salted so the prefix cache cannot answer, marker planted
+    near the head, question at the tail."""
+    head = f"\n[SALT {salt}] confidential marker: {fact}\n"
+    body = text + text
+    p = (head + body * max(1, chars // len(body)))[:chars]
+    return p + "\n\nQuestion: what is the confidential marker in the " \
+        "SALT block near the top of this document? Answer with the marker " \
+        "alone, no other words.\n"
+
+
+def chat(text, chars, salt, fact, max_tokens):
+    return {"model": MODEL,
+            "messages": [{"role": "user",
+                          "content": prompt(text, chars, salt, fact)}],
+            "max_tokens": max_tokens, "temperature": 0.0,
+            "chat_template_kwargs": {"enable_thinking": False}}
+
+
+def show(tag, j, wall, expect=None):
+    tim, u = j.get("timings") or {}, j.get("usage", {})
+    ch = (j.get("choices") or [{}])[0]
+    msg = ch.get("message") or {}
+    txt = (msg.get("content") or msg.get("reasoning_content") or "").strip()
+    acc = (tim["draft_n_accepted"] / tim["draft_n"]) if tim.get("draft_n") else None
+    line = (f"[{tag}] prompt={u.get('prompt_tokens')} gen={u.get('completion_tokens')} "
+            f"wall={wall:.1f}s prefill={tim.get('prompt_per_second', 0):.0f} t/s "
+            f"decode={tim.get('predicted_per_second', 0):.1f} t/s "
+            f"draft={tim.get('draft_n')}/{tim.get('draft_n_accepted')} "
+            f"accept={acc if acc is None else round(acc, 4)} "
+            f"cache_n={tim.get('cache_n')} finish={ch.get('finish_reason')}")
+    if expect:
+        hit = expect.split("-")[0] in txt.lower()
+        line += f" expected={expect} answered={txt[:80]!r} HIT={hit}"
+    print(line)
+
+
+def main():
+    print("health:", json.dumps(get("/health")))
+    print("models:", [m.get("id") for m in get("/v1/models").get("data", [])])
+    deep = corpus(160_000)
+    wide = corpus(1_100_000)
+
+    facts = {"B1": "cobalt-harbor-13", "B2": "quartz-meadow-42"}
+    bodies = {s: chat(wide, 646_000, s, f, 24) for s, f in facts.items()}
+    print(f"[B] {len(bodies['B1']['messages'][0]['content']):,} chars per "
+          f"request, x2 concurrent")
+
+    # A + C first (cheap), B last (the expensive pair).
+    for tag, salt in (("A-cold", "A1-9137"), ):
+        j, wall, _ = post(chat(deep, 140_000, salt, "zephyr-lantern-7", 512))
+        show(tag, j, wall, "zephyr-lantern-7")
+    t0 = time.time()
+    with concurrent.futures.ThreadPoolExecutor(max_workers=2) as ex:
+        futs = {s: ex.submit(post, b) for s, b in bodies.items()}
+        for s, fut in futs.items():
+            try:
+                j, wall, _ = fut.result()
+                show(f"B-{s}", j, wall, facts[s])
+            except Exception as e:  # a preemption/timeout lands here
+                print(f"[B-{s}] FAILED after {time.time() - t0:.1f}s: {e!r}")
+    print(f"[B] total {time.time() - t0:.1f}s")
+    j, wall, _ = post(chat(deep, 140_000, "A1-9137", "zephyr-lantern-7", 512))
+    show("C-prefix-hit", j, wall, "zephyr-lantern-7")
+
+
+if __name__ == "__main__":
+    main()

scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe

@@ -0,0 +1,110 @@
+# qwen4exp-swift15-w4dn8-i8-hc8m.recipe -- the Swift 1.5 finetune of Qwen3.8-Flash-Next
+# (ukisai/Swift1.5-Qwen3.8-Flash-Next, BF16 source, 335.3 GiB, key set identical to the official
+# base) as a radiance container for frank-archon: EVERY routed expert -- gate_up AND down --
+# through GPTQ into the w4nl64a8h table. The converter declares ONE
+# encoding per expert table (qwen4exp_fp8 rad_arch_declare): the served
+# kernel covers the whole expert set, and the only legal mixed layout is a
+# WHOLE expert kept plain bf16 beside it. That rules out the original
+# split tier (down block-fp8 + gate_up w4), which asks one table for two
+# encodings.
+# The rest is qwen4exp-w5dn64-i8-hc8m.recipe verbatim: int8 trunk linears, block-fp8 hc mixers
+# and MTP fc, the fixed-scale n-gram table, the 2-bit draft head.
+#
+# Why down is the calibrated half: the calibration tap rides the down projection, so its GPTQ
+# rounding propagates against real down-input Hessians; gate_up shares the same w4 table
+# uncalibrated. The published w5dn64 comparison (mean KL 0.0789 -> 0.0717, top-1 92.85% ->
+# 93.34%, decode +4%, prefill -19%) is the 5-bit upper bound; this tier trades part of that
+# quality back for prefill.
+#
+#   CALIB=DIR rad-convert <Swift1.5-Qwen3.8-Flash-Next checkpoint> \
+#       --recipe scripts/recipes/qwen4exp-swift15-w4dn8-i8-hc8m.recipe -o qwen4exp-swift15-w4dn8-i8-hc8m.rad
+#
+# DIR is the calibration directory the bf16 container wrote (RADIANCE_CALIB_DIR, 10M tokens of
+# traffic-shaped corpus). Everything not named here is served as the checkpoint holds it (bf16:
+# embeddings, the vision tower, the QSA indexer); the first rule that matches a weight decides it.
+# The bf16 container is NOT passed with --reuse: the peak-disk arithmetic does not fit (checkpoint +
+# container + container + output > purge-freed space), and --reuse only saves a re-read.
+
+# The protected experts, cast to bf16 ahead of both expert rules. THE NAMES BELOW ARE THE BASE
+# CHECKPOINT'S (from its 1M-token recording, qwen4exp-w5dn64-i8-hc8m.recipe) -- a warm start only.
+# The Swift 1.5 finetune's routing distribution is not assumed equal: the
+# derivation step rewrites this section from Swift's OWN calibration
+# recording before this recipe is ever run. The selection rule is the base
+# checkpoint's: an expert whose share of its layer's down-input energy is
+# at least 3% AND at least three times its share of the routing; an even
+# count on each rank's half of the layer (the four-bit GEMM takes the rest
+# as two equal tables by parity), padded with that half's next most
+# energetic expert.
+# PROTECTED-BEGIN (rewritten from Swift's OWN grams by derive-protected-experts.py)
+blk.1.ffn_*_exps.271.weight         cast dtype=bf16
+blk.1.ffn_*_exps.355.weight         cast dtype=bf16
+blk.2.ffn_*_exps.279.weight         cast dtype=bf16
+blk.2.ffn_*_exps.413.weight         cast dtype=bf16
+blk.34.ffn_*_exps.146.weight         cast dtype=bf16
+blk.34.ffn_*_exps.153.weight         cast dtype=bf16
+blk.34.ffn_*_exps.407.weight         cast dtype=bf16
+blk.34.ffn_*_exps.453.weight         cast dtype=bf16
+blk.37.ffn_*_exps.288.weight         cast dtype=bf16
+blk.37.ffn_*_exps.377.weight         cast dtype=bf16
+blk.38.ffn_*_exps.406.weight         cast dtype=bf16
+blk.38.ffn_*_exps.420.weight         cast dtype=bf16
+blk.42.ffn_*_exps.37.weight         cast dtype=bf16
+blk.42.ffn_*_exps.90.weight         cast dtype=bf16
+blk.42.ffn_*_exps.302.weight         cast dtype=bf16
+blk.42.ffn_*_exps.388.weight         cast dtype=bf16
+blk.44.ffn_*_exps.315.weight         cast dtype=bf16
+blk.44.ffn_*_exps.350.weight         cast dtype=bf16
+blk.46.ffn_*_exps.290.weight         cast dtype=bf16
+blk.46.ffn_*_exps.419.weight         cast dtype=bf16
+blk.47.ffn_*_exps.119.weight         cast dtype=bf16
+blk.47.ffn_*_exps.143.weight         cast dtype=bf16
+blk.47.ffn_*_exps.399.weight         cast dtype=bf16
+blk.47.ffn_*_exps.445.weight         cast dtype=bf16
+# PROTECTED-END
+# (derive-protected-experts.py rewrote this section from Swift's own grams)
+
+# Every other routed expert, trunk and MTP layer alike: u4 codes into the w4nl table, rotated by
+# the 128-wide Hadamard, an E4M3 scale a group of 64 under the fixed 2^-13 searched for least
+# error as stored, chosen by GPTQ against $CALIB and swept three times by coordinate descent.
+# The calibration Grams are down-input Hessians, so down is the calibrated half of the table;
+# gate_up has no recording of its own and quantises uncalibrated (said on stderr, as the base
+# recipe says). The MTP layer has no recording either. Expert mass: gate_up 150.00 GiB -> ~37.6,
+# down 75.00 GiB -> ~18.8: ~56 GiB of experts, ~28 GiB a rank at TP=2 -- well inside the pool.
+blk.*.ffn_*_exps.*.weight            gptq table=w4nl group=64 scale=fp8_e4m3 scale2=f32 block2=*x* scale2_value=0.0001220703125 transform=fwht128 rule=search cd=3 calib=$CALIB
+
+# Every connection's two mixing matrices -- the 96 trunk connections, the final mixer and the MTP
+# head's three -- as E4M3 rows with an f32 scale a group of each row. A 128x128 block cannot cover
+# them: lowrank is 320, 2.5 blocks. Down is [320, 10240] and takes a scale every 128 columns; up is
+# [10240, 320] and takes four scales a row, 80 columns each.
+*_hc_down.weight                     rtn  codes=fp8_e4m3 group=128 scale=f32
+*_hc_up.weight                       rtn  codes=fp8_e4m3 group=80 scale=f32
+
+# The MTP head's fc_hidden and fc_embedding, the same rows. They only ever change the drafts.
+mtp.fc_hidden.weight                 rtn  codes=fp8_e4m3 group=128 scale=f32
+mtp.fc_embedding.weight              rtn  codes=fp8_e4m3 group=128 scale=f32
+
+# The trunk's block linears as int8, a scale per 128 columns of a row searched for least error.
+# The QSA indexer's projection is not one of them: its top-k is a hard choice between blocks, and
+# keeping it as the checkpoint holds it costs 20 MB.
+blk.*.attn_qg.weight                 rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.attn_k.weight                  rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.attn_v.weight                  rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.attn_output.weight             rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.ssm_inz.weight                 rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.ssm_out.weight                 rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.ffn_gate_up_shexp.weight       rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+blk.*.ffn_down_shexp.weight          rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+
+# The lm_head, int8 with a bf16 scale a row per 128 columns (logits_gemm_i8): at E4M3 it costs
+# ~0.6 points of top-1 on its own.
+output.weight                        rtn  codes=i8 group=128 scale=bf16 clamp=sym rule=search
+
+# The n-gram table at one fixed E4M3 scale; qwen4exp-w4.recipe says where the value comes from.
+# The value sits on a three-octave plateau (2^-13..2^-10, rel_l2 0.02662) with 1.7x headroom over
+# the base table's absmax; the prep phase verifies Swift's PLE absmax lands inside the plateau
+# before this rule is trusted.
+blk.*.ple_ngram.weight               rtn  codes=fp8_e4m3 block=*x* scale=bf16 rule=fixed scale_value=1.99317932128906e-4
+
+# The MTP head's 2-bit draft head. INERT for this checkpoint: the HF weight map has no
+# mtp.draft_head.weight (same as the base), kept for shape parity with the family.
+mtp.draft_head.weight                rtn  codes=u2 zero=u8 group=128 scale=f16

scripts/run-swift15-bf16.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# run-swift15-bf16.sh — RUNS ON DANKSERVER. Boot the no-recipe bf16 Swift1.5
+# container for the two offline campaign phases. The engine owns the GPUs, so
+# the production unit must be stopped first (this script does it and restores
+# on exit, autoresearch pattern: stop, never mask — relinked unit).
+#
+#   kld    --kld-record the reference logits from the bf16 model
+#          (runs the corpus and EXITS; engine writes DIR and leaves)
+#   calib  serve with the calibration tap; a separate driver
+#          (scripts/calib-push.py) pushes the corpus; the engine writes the
+#          Hessians at RADIANCE_CALIB_TOKENS and the tap switches itself off.
+#          Stop this script after calib-push prints TAP_DONE.
+#
+# Shape = the vendor's bf16 calibration lines (GUIDE.md §4.3:528 + MOE-W4.md
+# "calibrate the checkpoint as it ships"): expert_tiered + weights-disk-tier,
+# no speculation, deterministic. Large prefill steps because a disk-tier step
+# costs the same at 1 token as at 32K. The container declared --max-ctx 4096;
+# --max-model-len 16384 exceeds it on purpose (the KLD prompts run to 12,007
+# tokens, calib to 8,242) — the boot ledger arbitrates the QSA buffers; if
+# declare refuses, re-convert with a wider --max-ctx.
+set -uo pipefail
+
+MODE="${1:?usage: run-swift15-bf16.sh kld|calib}"
+PIN_1013=sha256:4c3f484564bb2872784e46b0a59cbd71becc9c1e746e301a3596ffae253c322e
+PIN_120=sha256:665775ed1d90de6dbb25558e07fc60d20328f1346f96f3c6e00845eb763f01fa
+RAD=/home/dank/models/rad/qwen4exp-swift15-bf16.rad
+C=swift15ref
+LOG=/home/dank/logs/swift15_bf16.log
+KLD_REF_DIR=/home/dank/corpora/kld-ref
+CALIB_DIR=/home/dank/corpora/calib
+KLD_CORPUS=/home/dank/corpora/out/kld.jsonl
+
+restore() { sudo systemctl start frank-archon >/dev/null 2>&1 || true; }
+trap restore EXIT
+sudo systemctl stop frank-archon >/dev/null 2>&1 || true
+podman rm -f "$C" >/dev/null 2>&1 || true
+
+ARGS=(--model /models/rad/qwen4exp-swift15-bf16.rad
+      --tp 2 --placement expert_tiered --weights-disk-tier
+      --host-pool-mib 12288 --deterministic --gpu-headroom-mib 768
+      --num-speculative-tokens 0
+      --kv-cache-dtype fp8 --max-model-len 16384
+      --ngram-placement ram
+      --override-chat-template /models/tpl.jinja)
+
+case "$MODE" in
+  kld)
+    # 1.0.13: the engine that will serve the candidate — the reference is
+    # recorded on the same engine that scores it. The weights slab DERIVES as
+    # card - headroom - kv, and the disk tier refuses under 9.57 GiB (4.21 of
+    # layer buffers + 5.36 fixed), so kv is explicit SMALL: recording is
+    # prefill-only, self-batched at MNBT 32768 = two 16k prompts at a time;
+    # 4 slots x 16k fp8 (29 KiB/pos, 1.7 GiB) + headroom fits 3072.
+    IMAGE="stilldeadcode/radiance@$PIN_1013"
+    mkdir -p "$KLD_REF_DIR"
+    ARGS+=(--kld-record /data/kld-ref --kld-corpus /data/kld.jsonl
+           --vram-kv-mib 3072
+           --max-num-seqs 4 --max-num-batched-tokens 32768)
+    ;;
+  calib)
+    # 1.2.0: the calibration tap (RADIANCE_CALIB_DIR + RADIANCE_CALIB_TOKENS)
+    # lives in the 1.2.0 qwen4exp plugin; 1.0.13 has only the DIR half with an
+    # unparameterisable threshold. Grams are bf16 activations — engine-invariant.
+    # Same KV ceiling as kld: the disk-tier weights floor (9.57 GiB) plus
+    # ~18 GiB of fixed per-rank claims cap the pool near 3.5 GiB on a 32 GiB
+    # card — pool minus the 2.17 GiB fixed holds ~237k fp8 tokens a rank, so
+    # the vendor's big-step calibration shape is affordable: MOE-W4.md:244
+    # measures 640 tok/s at a 32k step against 930 at 55k, and the doc's own
+    # run drives MNBT 65536. 8 slots x 16k = 131k resident tokens fits the
+    # pool; the step batches 65k. KLD's observed rate confirmed step size,
+    # not slot count, is the throughput lever.
+    IMAGE="stilldeadcode/radiance@$PIN_120"
+    mkdir -p "$CALIB_DIR"
+    ARGS+=(--port 7770 --vram-kv-mib 3072
+           --max-num-seqs 8 --max-num-batched-tokens 65536
+           --prefix-cache-dir /data/calib-kvcache)
+    ;;
+  probe)
+    IMAGE="stilldeadcode/radiance@$PIN_1013"
+    ARGS+=(--port 7770 --max-num-seqs 8 --max-num-batched-tokens 4096)
+    ;;
+  *) echo "unknown mode: $MODE" >&2; exit 2 ;;
+esac
+
+# The prod template copy, readable from the container: mount the models tree
+# ro plus the state dir rw (KLD record + prefix tier land there).
+cp -f /home/dank/serverAppConfigs/scripts/qwen38-froggeric-v22.5.jinja \
+      /home/dank/models/tpl.jinja 2>/dev/null || true
+
+KLD_MOUNT=()
+if [ "$MODE" = kld ]; then
+    # Nested under the /data mount, so these must come after it (line order
+    # in podman run below): the corpus read-only, the record dir writable.
+    KLD_MOUNT=(-v "$KLD_CORPUS:/data/kld.jsonl:ro"
+               -v "$KLD_REF_DIR:/data/kld-ref")
+fi
+EXTRA_ENV=()
+if [ "$MODE" = calib ]; then
+    EXTRA_ENV=(-v "$CALIB_DIR:/data/calib"
+               -e RADIANCE_CALIB_DIR=/data/calib
+               -e RADIANCE_CALIB_TOKENS=10000000)
+fi
+
+podman run --rm --name "$C" \
+    --network host --init \
+    --security-opt seccomp=unconfined \
+    --ulimit memlock=-1:-1 \
+    --device /dev/kfd --device /dev/dri \
+    -v /home/dank/models:/models:ro \
+    -v /home/dank/radiance-state:/data \
+    "${KLD_MOUNT[@]}" \
+    "${EXTRA_ENV[@]}" \
+    "$IMAGE" "${ARGS[@]}" 2>&1 | tee "$LOG"
+rc=${PIPESTATUS[0]}
+echo "swift15-bf16 $MODE exited rc=$rc; log: $LOG"
+exit "$rc"

scripts/serve-frank-archon.sh

@@ -0,0 +1,205 @@
+#!/usr/bin/env bash
+# serve-frank-archon.sh — frank-archon endpoint: radiance (StillDeadcode,
+# Apache-2.0) serving the OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 checkpoint at
+# NATIVE block-FP8 precision from a rad-convert container
+# (/home/dank/models/rad/qwen4exp-fp8-native.rad), on BOTH R9700s (TP=2,
+# wht6 wire), dankserver :7770. 2026-10-05 cutover from FreeToken (PR #587,
+# one card; git tag frank-archon-freetoken-pr587-20261005 is the
+# pre-cutover state).
+#
+# The run line below IS the engine argv: the image's entrypoint is the
+# engine and its tools sit beside it on PATH. Unlike every predecessor
+# there is no per-boot VRAM planner to second-guess: the boot ledger in the
+# log states every budget before anything is allocated (weights vs KV
+# split, the expert host pool's coverage of the worst case, the PLE pin,
+# the P2P answer per pair) — read it after every resize.
+# Deployed shape (2026-10-11): 2 decode slots x 200,000 tokens, bf16
+# (unquantized) KV in a 6,912 MiB pool, the weights slab cut to 22,208 MiB to
+# pay for it, 44 GiB/rank pinned expert pool, MTP depth 2, prefix cache host
+# 8 GiB + disk 64 GiB, PLE pinned in RAM.
+#
+# The root unit (scripts/frank-archon.service, User=dank,
+# LimitMEMLOCK=infinity) grants the pin budget: 2 x 44 GiB expert pools +
+# the 47.7 GiB PLE table + 8 GiB prefix host tier — ~147 GiB of pinned
+# pages, which is ALSO why this script refuses to start when ttm's
+# pages_limit/pages_max cap is under FRANK_ARCHON_TTM_MIN_MIB (see below).
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# The artifact gates are the shared library: the serve script and the
+# deployer gate the same payload, and two hand-written copies of the same
+# checks drift apart until one side passes what the other refuses. One
+# library, one refusal text, one rule.
+export GATE_PREFIX=frank-archon
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/llm-gates.sh"
+ENV_FILE="${FRANK_ARCHON_ENV_FILE:-$SCRIPT_DIR/frank-archon.env}"
+
+if [ ! -f "$ENV_FILE" ]; then
+    echo "ERROR: frank-archon env file absent: $ENV_FILE" >&2
+    exit 1
+fi
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+: "${FRANK_ARCHON_IMAGE:?FRANK_ARCHON_IMAGE must name the radiance image}"
+: "${FRANK_ARCHON_MODEL_DIR:?FRANK_ARCHON_MODEL_DIR must name the .rad dir}"
+: "${FRANK_ARCHON_MODEL_FILE:?FRANK_ARCHON_MODEL_FILE must name the .rad file}"
+: "${FRANK_ARCHON_STATE_DIR:?FRANK_ARCHON_STATE_DIR must name the /data state dir}"
+: "${FRANK_ARCHON_CONTAINER:?FRANK_ARCHON_CONTAINER must name the container}"
+: "${FRANK_ARCHON_SERVED_NAME:?FRANK_ARCHON_SERVED_NAME must name the alias}"
+: "${FRANK_ARCHON_PORT:?FRANK_ARCHON_PORT must be the port}"
+: "${FRANK_ARCHON_TEMPLATE:?FRANK_ARCHON_TEMPLATE must name the chat template}"
+: "${FRANK_ARCHON_TP:?FRANK_ARCHON_TP must be set}"
+: "${FRANK_ARCHON_TP_WIRE:?FRANK_ARCHON_TP_WIRE must be set}"
+: "${FRANK_ARCHON_MAX_SEQS:?FRANK_ARCHON_MAX_SEQS must be set}"
+: "${FRANK_ARCHON_MAX_MODEL_LEN:?FRANK_ARCHON_MAX_MODEL_LEN must be set}"
+: "${FRANK_ARCHON_PLACEMENT:?FRANK_ARCHON_PLACEMENT must be set}"
+: "${FRANK_ARCHON_HOST_POOL_MIB:?FRANK_ARCHON_HOST_POOL_MIB must be set}"
+: "${FRANK_ARCHON_GPU_HEADROOM_MIB:?FRANK_ARCHON_GPU_HEADROOM_MIB must be set}"
+: "${FRANK_ARCHON_VRAM_WEIGHTS_MIB:?FRANK_ARCHON_VRAM_WEIGHTS_MIB must be set}"
+: "${FRANK_ARCHON_VRAM_KV_MIB:?FRANK_ARCHON_VRAM_KV_MIB must be set}"
+: "${FRANK_ARCHON_KV_DTYPE:?FRANK_ARCHON_KV_DTYPE must be set}"
+: "${FRANK_ARCHON_SPEC_TOKENS:?FRANK_ARCHON_SPEC_TOKENS must be set}"
+: "${FRANK_ARCHON_MAX_BATCHED_TOKENS:?FRANK_ARCHON_MAX_BATCHED_TOKENS must be set}"
+: "${FRANK_ARCHON_PREFIX_HOST_MIB:?FRANK_ARCHON_PREFIX_HOST_MIB must be set}"
+: "${FRANK_ARCHON_PREFIX_DISK_MIB:?FRANK_ARCHON_PREFIX_DISK_MIB must be set}"
+: "${FRANK_ARCHON_NGRAM_PLACEMENT:?FRANK_ARCHON_NGRAM_PLACEMENT must be set}"
+: "${FRANK_ARCHON_TTM_MIN_MIB:?FRANK_ARCHON_TTM_MIN_MIB must be set}"
+: "${FRANK_ARCHON_RAD_MIN_MIB:?FRANK_ARCHON_RAD_MIN_MIB must be set}"
+
+# The image gate is the digest-pinned ref itself: a name@sha256 ref exists
+# in storage only if THAT manifest was pulled — a retagged look-alike or a
+# newer latest does not satisfy it. One command, no pipefail/grep race (the
+# 2026-09-30 lesson). Runs as dank: the unit's process uses dank's ROOTLESS
+# podman storage (root unit, User=dank — the fleet's frank-archon shape).
+require_image "$FRANK_ARCHON_IMAGE" \
+    "podman pull docker://stilldeadcode/radiance:latest (as dank)" || exit 1
+
+# The payload gate: the .rad container file, sized. A truncated convert
+# would otherwise buy a guaranteed long-timeout boot instead of this fast
+# failure. The staging dir / raw checkpoint are NOT this script's concern
+# (the convert script built the file; its rad-info output is the record).
+require_min_mib "$FRANK_ARCHON_MODEL_DIR/$FRANK_ARCHON_MODEL_FILE" \
+    container "$FRANK_ARCHON_RAD_MIN_MIB" \
+    "build it: scripts/convert-swift15-w4dn8.sh (rad-info is the record)" || exit 1
+
+require_file "$FRANK_ARCHON_TEMPLATE" template \
+    "the chat template is vendored: scripts/qwen38-froggeric-v22.5.jinja" || exit 1
+
+mkdir -p "$FRANK_ARCHON_STATE_DIR/kvcache/frank-archon"
+# The engine's create is NOT recursive: with only the state dir mounted, its
+# "cannot create /data/kvcache/frank-archon: No such file or directory"
+# left the SSD prefix tier off (measured 2026-10-06 boot ledger). Pre-create
+# the full path on the host so the tier opens on first boot.
+
+mkdir -p "$FRANK_ARCHON_STATE_DIR/tune"
+# rad-tune's kernel-selection cache (see the runbook's "Tuning levers"):
+# the engine's selector reads $RADIANCE_HOME/tune/<machine>.tune at boot;
+# $RADIANCE_HOME defaults to /opt/radiance, which lives in the image, so
+# the cache must ride a host mount or it dies with the --rm container
+# that wrote it. The dir is pre-created for the same reason as kvcache
+# (the engine's create is not recursive).
+
+# GPU access is mandatory; the node paths are knobs so the seam can drive
+# this gate on a box without AMD GPUs (production defaults).
+DEV_KFD="${FRANK_ARCHON_DEV_KFD:-/dev/kfd}"
+DEV_DRI="${FRANK_ARCHON_DEV_DRI:-/dev/dri}"
+if [ ! -e "$DEV_KFD" ] || [ ! -d "$DEV_DRI" ]; then
+    echo "ERROR: GPU device nodes absent ($DEV_KFD, $DEV_DRI)" >&2
+    exit 1
+fi
+
+# TTM preflight: the pinned ledger (~2 x 40 GiB pools + 47.7 GiB PLE + 4 GiB
+# prefix host = ~132 GiB) rides TTM's shared pages, capped by ttm's
+# pages_limit (the current kernel exposes NO pages_max; the cap function
+# takes the min over the knobs that exist). Below FRANK_ARCHON_TTM_MIN_MIB
+# the load dies mid-pin with an allocator error instead of this named
+# refusal — raise the knob first (runtime sysfs write; kernel cmdline
+# fallback + one reboot only if the file is read-only), see the runbook.
+# RAISED 2026-10-05 pre-cutover to 52,428,800 pages = 200 GiB.
+ttm_cap_mib() {
+    # min over the knobs THIS kernel exposes — the current kernel has
+    # pages_limit only (no pages_max); a knob that is absent is skipped,
+    # not a zero (a zero would refuse a healthy cap).
+    local v cur="" dir
+    dir="${FRANK_ARCHON_TTM_SYSFS:-/sys/module/ttm/parameters}"
+    for p in "$dir/pages_limit" "$dir/pages_max"; do
+        [ -r "$p" ] || continue
+        v="$(cat "$p" 2>/dev/null)" || continue
+        [ -n "$v" ] || continue
+        v=$(( v * 4 / 1024 ))
+        if [ "$v" -lt "${cur:-999999999}" ]; then cur=$v; fi
+    done
+    echo "${cur:-0}"
+}
+TTM_CAP="$(ttm_cap_mib)"
+if [ "$TTM_CAP" -lt "$FRANK_ARCHON_TTM_MIN_MIB" ]; then
+    echo "ERROR: ttm pages cap is ${TTM_CAP} MiB, the pinned ledger needs >= $FRANK_ARCHON_TTM_MIN_MIB" >&2
+    echo "frank-archon: raise /sys/module/ttm/parameters/pages_limit (and pages_max if the kernel exposes one) to >= $FRANK_ARCHON_TTM_MIN_MIB in 4 KiB pages" >&2
+    exit 1
+fi
+
+# A crashed/killed unit can leave the container name registered (systemd
+# SIGKILLs conmon before cleanup runs). Clear OUR name plus the legacy
+# identities (the FreeToken-era frank-archon-qwen, the retired R9V
+# container and the ad hoc experiment containers all hold this GPU); all
+# idempotent.
+for CTR in $FRANK_ARCHON_LEGACY_CONTAINERS "$FRANK_ARCHON_CONTAINER"; do
+    podman rm -f "$CTR" >/dev/null 2>&1 || true
+done
+
+LOG="${FRANK_ARCHON_LOG:-/home/dank/logs/frank_archon.log}"
+mkdir -p "$(dirname "$LOG")"
+
+# Publisher-vetted container contract (docs/DOCKER.md, compose/common.yaml):
+# --network host (the server binds the host's addresses directly, no NAT),
+# --init (the engine releases the cards on SIGTERM), seccomp=unconfined
+# (Docker/podman's default profile refuses io_uring, which the n-gram
+# table's reads go through, and the NUMA binding calls the ROCm runtime
+# makes for host memory), memlock unbounded (the pinned ledger — legal
+# because the root unit grants LimitMEMLOCK=infinity to this dank process),
+# /dev/kfd + /dev/dri (render/video groups are moot for a root container).
+# The template rides a single-file mount; the .rad dir is ro; /data holds
+# the prefix-cache disk tier.
+podman run -d --name "$FRANK_ARCHON_CONTAINER" \
+  --network host \
+  --init \
+  --security-opt seccomp=unconfined \
+  --ulimit memlock=-1:-1 \
+  --device /dev/kfd --device /dev/dri \
+  -v "$FRANK_ARCHON_MODEL_DIR":/models:ro \
+  -v "$FRANK_ARCHON_STATE_DIR":/data \
+  -v "$FRANK_ARCHON_STATE_DIR/tune":/opt/radiance/share/radiance/tune \
+  -v "$FRANK_ARCHON_TEMPLATE":/templates/template.jinja:ro \
+  "$FRANK_ARCHON_IMAGE" \
+  --model "/models/$FRANK_ARCHON_MODEL_FILE" \
+  --host :: --port "$FRANK_ARCHON_PORT" \
+  --served-model-name "$FRANK_ARCHON_SERVED_NAME" \
+  --override-chat-template /templates/template.jinja \
+  --tp "$FRANK_ARCHON_TP" --tp-wire "$FRANK_ARCHON_TP_WIRE" \
+  --max-num-seqs "$FRANK_ARCHON_MAX_SEQS" \
+  --max-model-len "$FRANK_ARCHON_MAX_MODEL_LEN" \
+  --placement "$FRANK_ARCHON_PLACEMENT" \
+  --host-pool-mib "$FRANK_ARCHON_HOST_POOL_MIB" \
+  --gpu-headroom-mib "$FRANK_ARCHON_GPU_HEADROOM_MIB" \
+  --vram-weights-mib "$FRANK_ARCHON_VRAM_WEIGHTS_MIB" \
+  --vram-kv-mib "$FRANK_ARCHON_VRAM_KV_MIB" \
+  --kv-cache-dtype "$FRANK_ARCHON_KV_DTYPE" \
+  --prefix-cache-host-mib "$FRANK_ARCHON_PREFIX_HOST_MIB" \
+  --prefix-cache-dir /data/kvcache/frank-archon \
+  --prefix-cache-disk-mib "$FRANK_ARCHON_PREFIX_DISK_MIB" \
+  --ngram-placement "$FRANK_ARCHON_NGRAM_PLACEMENT" \
+  --num-speculative-tokens "$FRANK_ARCHON_SPEC_TOKENS" \
+  --max-num-batched-tokens "$FRANK_ARCHON_MAX_BATCHED_TOKENS" \
+  ${FRANK_ARCHON_EXTRA_ARGS:+$FRANK_ARCHON_EXTRA_ARGS} \
+  > "$LOG" 2>&1
+
+# From here on, this script's lifetime IS the container's: wait returns the
+# container's exit code, so a crash is a nonzero ExecStart and the unit's
+# Restart=always is real. (systemd stop goes through ExecStop in the unit —
+# podman wait alone cannot stop the container child.)
+exec podman wait "$FRANK_ARCHON_CONTAINER"

scripts/serve-frank-dragoon.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
-# serve-frank-large.sh — frank-large endpoint: halogen-flash-server 0.16.2
+# serve-frank-dragoon.sh — frank-dragoon endpoint: halogen-flash-server 0.16.2
 # (closed-source engine, image ghcr.io/peonist-ai/halogen-flash-server,
-# digest-pinned in frank-large.env) serving the Quat3rnion abliterated
+# digest-pinned in frank-dragoon.env) serving the Quat3rnion abliterated
 # Swift1.5 finetune of peonist's Qwen3.8-Flash-Next v2 checkpoint on
 # Dankclaw's Strix Halo iGPU, host :7770. 2026-10-06 cutover from the
 # halogen 27B-dense shape — revert the swap commit's trio to roll back
 # (the 27B payload stays on disk).
 #
-# The engine is driven by `podman run` DIRECTLY (the fleet's frank-primary
+# The engine is driven by `podman run` DIRECTLY (the fleet's frank-archon
 # pattern): the image starts engine + OpenAI frontend in one container.
 # The frontend listens on 8731 inside (HALOGEN_API_PORT default) and is
 # published as host 7770; the engine's own token port (8730, no auth)
@@ -26,13 +26,20 @@
 # Why containers instead of a bare binary: the payload is .hgn and only
 # the flash-server line reads it; it ships as a container; the root unit
 # keeps LimitMEMLOCK=infinity for parity and to outlive the login session,
-# exactly like frank-primary's.
+# exactly like frank-archon's.
 set -euo pipefail
 
+# The artifact gates are the shared library — the serve script and the
+# deployer refuse the same missing/truncated payload with the same words
+# (the 2026-10-01 crash-loop was the two hand-written twins disagreeing).
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_LARGE_ENV_FILE:-$SCRIPT_DIR/frank-large.env}"
+export GATE_PREFIX=frank-dragoon
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/llm-gates.sh"
+
+ENV_FILE="${FRANK_DRAGOON_ENV_FILE:-$SCRIPT_DIR/frank-dragoon.env}"
 if [ ! -f "$ENV_FILE" ]; then
-    echo "frank-large: env file not found: $ENV_FILE" >&2
+    echo "frank-dragoon: env file not found: $ENV_FILE" >&2
     exit 1
 fi
 set -a
@@ -40,81 +47,65 @@ set -a
 source "$ENV_FILE"
 set +a
 
-: "${FRANK_LARGE_IMAGE:?FRANK_LARGE_IMAGE must name the digest-pinned image}"
-: "${FRANK_LARGE_CONTAINER:?FRANK_LARGE_CONTAINER must name the container}"
-: "${FRANK_LARGE_PUBLISH:?FRANK_LARGE_PUBLISH must be host:container}"
-: "${FRANK_LARGE_MODEL_DIR:?FRANK_LARGE_MODEL_DIR must name the payload dir}"
-: "${FRANK_LARGE_CHECKPOINT:?FRANK_LARGE_CHECKPOINT must name the .hgn inside it}"
-: "${FRANK_LARGE_CHECKPOINT_BYTES:?FRANK_LARGE_CHECKPOINT_BYTES must pin the size}"
-: "${FRANK_LARGE_NGRAM_TABLE:?FRANK_LARGE_NGRAM_TABLE must name the lookup table}"
-: "${FRANK_LARGE_NGRAM_BYTES:?FRANK_LARGE_NGRAM_BYTES must pin the table size}"
-: "${FRANK_LARGE_VISION_TOWER:?FRANK_LARGE_VISION_TOWER must name the tower}"
-: "${FRANK_LARGE_VISION_BYTES:?FRANK_LARGE_VISION_BYTES must pin the tower size}"
-: "${FRANK_LARGE_TOKENIZER_FILES:?FRANK_LARGE_TOKENIZER_FILES must list the tokenizer dir contents}"
-: "${HALOGEN_MODEL_ID:?HALOGEN_MODEL_ID must be the served alias (frank-large)}"
+: "${FRANK_DRAGOON_IMAGE:?FRANK_DRAGOON_IMAGE must name the digest-pinned image}"
+: "${FRANK_DRAGOON_CONTAINER:?FRANK_DRAGOON_CONTAINER must name the container}"
+: "${FRANK_DRAGOON_PUBLISH:?FRANK_DRAGOON_PUBLISH must be host:container}"
+: "${FRANK_DRAGOON_MODEL_DIR:?FRANK_DRAGOON_MODEL_DIR must name the payload dir}"
+: "${FRANK_DRAGOON_CHECKPOINT:?FRANK_DRAGOON_CHECKPOINT must name the .hgn inside it}"
+: "${FRANK_DRAGOON_CHECKPOINT_BYTES:?FRANK_DRAGOON_CHECKPOINT_BYTES must pin the size}"
+: "${FRANK_DRAGOON_NGRAM_TABLE:?FRANK_DRAGOON_NGRAM_TABLE must name the lookup table}"
+: "${FRANK_DRAGOON_NGRAM_BYTES:?FRANK_DRAGOON_NGRAM_BYTES must pin the table size}"
+: "${FRANK_DRAGOON_VISION_TOWER:?FRANK_DRAGOON_VISION_TOWER must name the tower}"
+: "${FRANK_DRAGOON_VISION_BYTES:?FRANK_DRAGOON_VISION_BYTES must pin the tower size}"
+: "${FRANK_DRAGOON_TOKENIZER_FILES:?FRANK_DRAGOON_TOKENIZER_FILES must list the tokenizer dir contents}"
+: "${HALOGEN_MODEL_ID:?HALOGEN_MODEL_ID must be the served alias (frank-dragoon)}"
 : "${HALOGEN_CTX:?HALOGEN_CTX must be set (per-slot window)}"
 : "${HALOGEN_KV_POOL_POSITIONS:?HALOGEN_KV_POOL_POSITIONS must be set}"
 : "${HALOGEN_KV_SLOTS:?HALOGEN_KV_SLOTS must be set}"
 : "${HALOGEN_SPEC_ADAPT:?HALOGEN_SPEC_ADAPT must be set (0 = head always on)}"
 
-# Capture podman's output BEFORE grepping: under `set -o pipefail` the
-# `podman images | grep -q` pattern races (grep exits on first match,
-# podman dies SIGPIPE 141, pipefail turns the 141 into "no match" — the
-# 2026-09-30 deploy refusal).
-DIGESTS="$(podman images --format '{{.RepoDigests}}')"
-if ! grep -qF "${FRANK_LARGE_IMAGE#*@}" <<<"$DIGESTS"; then
-    echo "frank-large: image $FRANK_LARGE_IMAGE not in podman storage;" >&2
-    echo "  pull it: podman pull ${FRANK_LARGE_IMAGE%@*}" >&2
-    exit 1
-fi
+# The image gate is the digest-pinned ref itself: `podman image exists` takes
+# a name@sha256 ref in one command, so a retagged look-alike or a newer
+# latest cannot satisfy it and there is no pipefail/SIGPIPE race with grep
+# (the 2026-09-30 deploy refusal). Runs as dank: the unit's process uses
+# dank's rootless storage.
+require_image "$FRANK_DRAGOON_IMAGE" \
+    "pull it: podman pull docker://$FRANK_DRAGOON_IMAGE" || exit 1
 
-# Size-exact gates on all three payload files: a truncated curl exits 0 on
-# some failures and a partial .hgn loads far enough to look alive, so the
-# byte counts from the Hub tree API are the contract (fleet fetch law).
-ck() {
-    # ck <env-name> <path> <expected-bytes>
-    if [ ! -f "$2" ]; then
-        echo "frank-large: $1 $2 missing;" >&2
-        echo "  fetch it: bash scripts/download-frank-large-flashnext.sh" >&2
-        exit 1
-    fi
-    local sz
-    sz="$(stat -c %s "$2")"
-    if [ "$sz" != "$3" ]; then
-        echo "frank-large: $1 is $sz bytes, expected $3 (partial download?)" >&2
-        exit 1
-    fi
-}
-ck checkpoint "$FRANK_LARGE_MODEL_DIR/$FRANK_LARGE_CHECKPOINT" "$FRANK_LARGE_CHECKPOINT_BYTES"
-ck n-gram-table "$FRANK_LARGE_MODEL_DIR/$FRANK_LARGE_NGRAM_TABLE" "$FRANK_LARGE_NGRAM_BYTES"
-ck vision-tower "$FRANK_LARGE_MODEL_DIR/$FRANK_LARGE_VISION_TOWER" "$FRANK_LARGE_VISION_BYTES"
+# Size-exact gates on all three payload files: a truncated download can
+# exit 0, and a partial .hgn loads far enough to look alive, so existence
+# proves nothing. The byte count published by the Hub tree API is the
+# contract: any other size is a different (broken) artifact.
+require_bytes "$FRANK_DRAGOON_MODEL_DIR/$FRANK_DRAGOON_CHECKPOINT" \
+    checkpoint "$FRANK_DRAGOON_CHECKPOINT_BYTES" \
+    "fetch it: bash scripts/download-frank-dragoon-flashnext.sh" || exit 1
+require_bytes "$FRANK_DRAGOON_MODEL_DIR/$FRANK_DRAGOON_NGRAM_TABLE" \
+    n-gram "$FRANK_DRAGOON_NGRAM_BYTES" \
+    "fetch it: bash scripts/download-frank-dragoon-flashnext.sh" || exit 1
+require_bytes "$FRANK_DRAGOON_MODEL_DIR/$FRANK_DRAGOON_VISION_TOWER" \
+    vision "$FRANK_DRAGOON_VISION_BYTES" \
+    "fetch it: bash scripts/download-frank-dragoon-flashnext.sh" || exit 1
 
 # The payload ships the tokenizer as a FLAT DIRECTORY. A HuggingFace cache
 # snapshot symlinks each file into a sibling blobs/, and those symlinks
 # dangle inside the container mount — so the directory must be real and
 # every named file must be a regular file, not a link.
-TOK_DIR="$FRANK_LARGE_MODEL_DIR/tokenizer"
-if [ -L "$TOK_DIR" ] || [ ! -d "$TOK_DIR" ]; then
-    echo "frank-large: tokenizer dir $TOK_DIR missing or a symlink (HF cache snapshot?);" >&2
-    echo "  fetch it: bash scripts/download-frank-large-flashnext.sh" >&2
-    exit 1
-fi
-for TF in $FRANK_LARGE_TOKENIZER_FILES; do
-    if [ ! -f "$TOK_DIR/$TF" ] || [ -L "$TOK_DIR/$TF" ]; then
-        echo "frank-large: tokenizer file $TOK_DIR/$TF missing or a symlink;" >&2
-        echo "  fetch it: bash scripts/download-frank-large-flashnext.sh" >&2
-        exit 1
-    fi
-done
+# The tokenizer file list is word-separated ON PURPOSE (one argument per
+# file), so the unquoted expansion below is the interface, not a slip.
+# shellcheck disable=SC2086
+require_dir_files "$FRANK_DRAGOON_MODEL_DIR/tokenizer" tokenizer \
+    "fetch it: bash scripts/download-frank-dragoon-flashnext.sh" \
+    $FRANK_DRAGOON_TOKENIZER_FILES || exit 1
 
 # GPU access is mandatory but the node paths are variables so the seam can
 # drive the gate on a box without an AMD GPU.
-DEV_KFD="${FRANK_LARGE_DEV_KFD:-/dev/kfd}"
-DEV_DRI="${FRANK_LARGE_DEV_DRI:-/dev/dri}"
+DEV_KFD="${FRANK_DRAGOON_DEV_KFD:-/dev/kfd}"
+DEV_DRI="${FRANK_DRAGOON_DEV_DRI:-/dev/dri}"
 if [ ! -e "$DEV_KFD" ] || [ ! -d "$DEV_DRI" ]; then
-    echo "frank-large: $DEV_KFD or $DEV_DRI missing — no gfx1151 to serve on" >&2
+    echo "frank-dragoon: $DEV_KFD or $DEV_DRI missing — no gfx1151 to serve on" >&2
     exit 1
 fi
+
 # Host-RAM preflight — the engine's pin gate, checked BEFORE podman run.
 # The engine refuses to pin when MemAvailable is below the checkpoint plus
 # a 16 GiB floor: pinned pages cannot be swapped, and under the floor the
@@ -125,15 +116,15 @@ fi
 # self-resolved in ~2 min when the dying 27B engine freed RAM. Check here and
 # WAIT for the RAM to clear, so a transient dip boots once instead of
 # crash-looping; if it never clears, refuse loudly.
-MEMINFO="${FRANK_LARGE_MEMINFO:-/proc/meminfo}"
-PIN_KB=$(( FRANK_LARGE_CHECKPOINT_BYTES / 1024 ))
+MEMINFO="${FRANK_DRAGOON_MEMINFO:-/proc/meminfo}"
+PIN_KB=$(( FRANK_DRAGOON_CHECKPOINT_BYTES / 1024 ))
 NEED_KB=$(( PIN_KB + 16 * 1048576 ))
 ram_avail_kb() { awk '/^MemAvailable:/{print $2; exit}' "$MEMINFO"; }
 MEMAVAIL_KB="$(ram_avail_kb)" || MEMAVAIL_KB=""
 if [ -n "$MEMAVAIL_KB" ] && [ "$MEMAVAIL_KB" -lt "$NEED_KB" ]; then
-    WAIT_S="${FRANK_LARGE_RAM_WAIT:-600}"
+    WAIT_S="${FRANK_DRAGOON_RAM_WAIT:-600}"
     GIB() { awk -v kb="$1" 'BEGIN{printf "%.2f", kb/1048576}'; }
-    echo "frank-large: host RAM below the pin gate — MemAvailable $(GIB "$MEMAVAIL_KB") GiB < needed $(GIB "$NEED_KB") GiB ($(GIB "$PIN_KB") GiB checkpoint + 16.00 GiB floor); waiting up to ${WAIT_S}s for host RAM to clear" >&2
+    echo "frank-dragoon: host RAM below the pin gate — MemAvailable $(GIB "$MEMAVAIL_KB") GiB < needed $(GIB "$NEED_KB") GiB ($(GIB "$PIN_KB") GiB checkpoint + 16.00 GiB floor); waiting up to ${WAIT_S}s for host RAM to clear" >&2
     deadline=$(( $(date +%s) + WAIT_S ))
     while [ "$(date +%s)" -lt "$deadline" ]; do
         sleep 5
@@ -143,16 +134,16 @@ if [ -n "$MEMAVAIL_KB" ] && [ "$MEMAVAIL_KB" -lt "$NEED_KB" ]; then
         fi
     done
     if [ -z "$MEMAVAIL_KB" ] || [ "$MEMAVAIL_KB" -lt "$NEED_KB" ]; then
-        echo "frank-large: MemAvailable $(GIB "${MEMAVAIL_KB:-0}") GiB after ${WAIT_S}s; refusing to start (the engine would refuse the pin)" >&2
+        echo "frank-dragoon: MemAvailable $(GIB "${MEMAVAIL_KB:-0}") GiB after ${WAIT_S}s; refusing to start (the engine would refuse the pin)" >&2
         exit 1
     fi
-    echo "frank-large: MemAvailable cleared to $(GIB "$MEMAVAIL_KB") GiB; starting" >&2
+    echo "frank-dragoon: MemAvailable cleared to $(GIB "$MEMAVAIL_KB") GiB; starting" >&2
 fi
-for CTR in ${FRANK_LARGE_LEGACY_CONTAINERS:-} "$FRANK_LARGE_CONTAINER"; do
+for CTR in ${FRANK_DRAGOON_LEGACY_CONTAINERS:-} "$FRANK_DRAGOON_CONTAINER"; do
     podman rm -f "$CTR" >/dev/null 2>&1 || true
 done
 
-LOG="${FRANK_LARGE_LOG:-/home/dank/logs/frank_large.log}"
+LOG="${FRANK_DRAGOON_LOG:-/home/dank/logs/frank_dragoon.log}"
 mkdir -p "$(dirname "$LOG")"
 # --ipc=host for the udev-granted supplementary group, seccomp unconfined
 # for the ROCm ioctl surface, and unbounded memlock (the unit's
@@ -163,17 +154,17 @@ mkdir -p "$(dirname "$LOG")"
 # and both sibling serve scripts pass no nofile either. No comment lines
 # inside the backslash chain — a mid-chain # terminates the continuation
 # (the 2026-10-05 exit-127 crash loop on the sibling serve script).
-podman run --name "$FRANK_LARGE_CONTAINER" \
-  --publish "$FRANK_LARGE_PUBLISH" \
+podman run --name "$FRANK_DRAGOON_CONTAINER" \
+  --publish "$FRANK_DRAGOON_PUBLISH" \
   --ipc=host \
   --ulimit memlock=-1:-1 \
   --device "$DEV_KFD" --device "$DEV_DRI" \
   --group-add keep-groups \
   --security-opt seccomp=unconfined \
   -e HALOGEN_MODEL_ID="$HALOGEN_MODEL_ID" \
-  -e HALOGEN_CHECKPOINT="/models/$FRANK_LARGE_CHECKPOINT" \
-  -e HALOGEN_NGRAM_TABLE="/models/$FRANK_LARGE_NGRAM_TABLE" \
-  -e HALOGEN_VISION_TOWER="/models/$FRANK_LARGE_VISION_TOWER" \
+  -e HALOGEN_CHECKPOINT="/models/$FRANK_DRAGOON_CHECKPOINT" \
+  -e HALOGEN_NGRAM_TABLE="/models/$FRANK_DRAGOON_NGRAM_TABLE" \
+  -e HALOGEN_VISION_TOWER="/models/$FRANK_DRAGOON_VISION_TOWER" \
   -e HALOGEN_TOKENIZER=/tokenizer \
   -e HALOGEN_CTX="$HALOGEN_CTX" \
   -e HALOGEN_KV_POOL_POSITIONS="$HALOGEN_KV_POOL_POSITIONS" \
@@ -187,9 +178,9 @@ podman run --name "$FRANK_LARGE_CONTAINER" \
   -e HALOGEN_TOP_P="${HALOGEN_TOP_P:-0.95}" \
   -e HALOGEN_TOP_K="${HALOGEN_TOP_K:-20}" \
   ${HALOGEN_WEIGHTS_LOCK:+-e HALOGEN_WEIGHTS_LOCK="$HALOGEN_WEIGHTS_LOCK"} \
-  -v "$FRANK_LARGE_MODEL_DIR:/models:ro" \
-  -v "$FRANK_LARGE_MODEL_DIR/tokenizer:/tokenizer:ro" \
-  "$FRANK_LARGE_IMAGE" \
+  -v "$FRANK_DRAGOON_MODEL_DIR:/models:ro" \
+  -v "$FRANK_DRAGOON_MODEL_DIR/tokenizer:/tokenizer:ro" \
+  "$FRANK_DRAGOON_IMAGE" \
   > "$LOG" 2>&1
 
 # FOREGROUND `podman run`: the engine's stdout/stderr are this script's

scripts/serve-frank-primary.sh

@@ -1,204 +0,0 @@
-#!/usr/bin/env bash
-# serve-frank-primary.sh — frank-primary endpoint: radiance (StillDeadcode,
-# Apache-2.0) serving the OFFICIAL Qwen/Qwen3.8-Flash-Next-FP8 checkpoint at
-# NATIVE block-FP8 precision from a rad-convert container
-# (/home/dank/models/rad/qwen4exp-fp8-native.rad), on BOTH R9700s (TP=2,
-# wht6 wire), dankserver :7770. 2026-10-05 cutover from FreeToken (PR #587,
-# one card; git tag frank-primary-freetoken-pr587-20261005 is the
-# pre-cutover state).
-#
-# The run line below IS the engine argv: the image's entrypoint is the
-# engine and its tools sit beside it on PATH. Unlike every predecessor
-# there is no per-boot VRAM planner to second-guess: the boot ledger in the
-# log states every budget before anything is allocated (weights vs KV
-# split, the expert host pool's coverage of the worst case, the PLE pin,
-# the P2P answer per pair) — read it after every resize. First-boot shape:
-# 2 decode slots (Frank's call), 40 GiB/rank pinned expert pool, fp8 KV,
-# MTP depth 3, prefix cache host 4 GiB + disk 64 GiB, PLE pinned in RAM.
-#
-# The root unit (scripts/frank-primary.service, User=dank,
-# LimitMEMLOCK=infinity) grants the pin budget: 2 x 40 GiB expert pools +
-# the 47.7 GiB PLE table + 4 GiB prefix host tier — ~132 GiB of pinned
-# pages, which is ALSO why this script refuses to start when ttm's
-# pages_limit/pages_max cap is under FRANK_PRIMARY_TTM_MIN_MIB (see below).
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_PRIMARY_ENV_FILE:-$SCRIPT_DIR/frank-primary.env}"
-
-if [ ! -f "$ENV_FILE" ]; then
-    echo "ERROR: frank-primary env file absent: $ENV_FILE" >&2
-    exit 1
-fi
-set -a
-# shellcheck disable=SC1090
-source "$ENV_FILE"
-set +a
-
-: "${FRANK_PRIMARY_IMAGE:?FRANK_PRIMARY_IMAGE must name the radiance image}"
-: "${FRANK_PRIMARY_MODEL_DIR:?FRANK_PRIMARY_MODEL_DIR must name the .rad dir}"
-: "${FRANK_PRIMARY_MODEL_FILE:?FRANK_PRIMARY_MODEL_FILE must name the .rad file}"
-: "${FRANK_PRIMARY_STATE_DIR:?FRANK_PRIMARY_STATE_DIR must name the /data state dir}"
-: "${FRANK_PRIMARY_CONTAINER:?FRANK_PRIMARY_CONTAINER must name the container}"
-: "${FRANK_PRIMARY_SERVED_NAME:?FRANK_PRIMARY_SERVED_NAME must name the alias}"
-: "${FRANK_PRIMARY_PORT:?FRANK_PRIMARY_PORT must be the port}"
-: "${FRANK_PRIMARY_TEMPLATE:?FRANK_PRIMARY_TEMPLATE must name the chat template}"
-: "${FRANK_PRIMARY_TP:?FRANK_PRIMARY_TP must be set}"
-: "${FRANK_PRIMARY_TP_WIRE:?FRANK_PRIMARY_TP_WIRE must be set}"
-: "${FRANK_PRIMARY_MAX_SEQS:?FRANK_PRIMARY_MAX_SEQS must be set}"
-: "${FRANK_PRIMARY_MAX_MODEL_LEN:?FRANK_PRIMARY_MAX_MODEL_LEN must be set}"
-: "${FRANK_PRIMARY_PLACEMENT:?FRANK_PRIMARY_PLACEMENT must be set}"
-: "${FRANK_PRIMARY_HOST_POOL_MIB:?FRANK_PRIMARY_HOST_POOL_MIB must be set}"
-: "${FRANK_PRIMARY_GPU_HEADROOM_MIB:?FRANK_PRIMARY_GPU_HEADROOM_MIB must be set}"
-: "${FRANK_PRIMARY_EXPERT_VS_CACHE:?FRANK_PRIMARY_EXPERT_VS_CACHE must be set}"
-: "${FRANK_PRIMARY_KV_DTYPE:?FRANK_PRIMARY_KV_DTYPE must be set}"
-: "${FRANK_PRIMARY_SPEC_TOKENS:?FRANK_PRIMARY_SPEC_TOKENS must be set}"
-: "${FRANK_PRIMARY_MAX_BATCHED_TOKENS:?FRANK_PRIMARY_MAX_BATCHED_TOKENS must be set}"
-: "${FRANK_PRIMARY_PREFIX_HOST_MIB:?FRANK_PRIMARY_PREFIX_HOST_MIB must be set}"
-: "${FRANK_PRIMARY_PREFIX_DISK_MIB:?FRANK_PRIMARY_PREFIX_DISK_MIB must be set}"
-: "${FRANK_PRIMARY_NGRAM_PLACEMENT:?FRANK_PRIMARY_NGRAM_PLACEMENT must be set}"
-: "${FRANK_PRIMARY_TTM_MIN_MIB:?FRANK_PRIMARY_TTM_MIN_MIB must be set}"
-: "${FRANK_PRIMARY_RAD_MIN_MIB:?FRANK_PRIMARY_RAD_MIN_MIB must be set}"
-
-# The image gate is the digest-pinned ref itself: a name@sha256 ref exists
-# in storage only if THAT manifest was pulled — a retagged look-alike or a
-# newer latest does not satisfy it. `podman image exists` takes a
-# name@digest ref in one command — no pipefail/grep race (the 2026-09-30
-# lesson). Runs as dank: the unit's process uses dank's ROOTLESS podman
-# storage (root unit, User=dank — the fleet's frank-primary shape).
-if ! podman image exists "$FRANK_PRIMARY_IMAGE"; then
-    echo "ERROR: radiance image absent: $FRANK_PRIMARY_IMAGE" >&2
-    echo "frank-primary: podman pull docker://stilldeadcode/radiance:latest (as dank)" >&2
-    exit 1
-fi
-
-# The payload gate: the .rad container file, sized. A truncated convert
-# would otherwise buy a guaranteed long-timeout boot instead of this fast
-# failure. The staging dir / raw checkpoint are NOT this script's concern
-# (scripts/build-frank-primary-rad.sh built the file; its rad-info output
-# is the record).
-RAD="$FRANK_PRIMARY_MODEL_DIR/$FRANK_PRIMARY_MODEL_FILE"
-if [ ! -f "$RAD" ]; then
-    echo "ERROR: .rad container missing: $RAD" >&2
-    echo "frank-primary: run scripts/build-frank-primary-rad.sh" >&2
-    exit 1
-fi
-RAD_MIB=$(( $(stat -c %s "$RAD") / 1048576 ))
-if [ "$RAD_MIB" -lt "$FRANK_PRIMARY_RAD_MIN_MIB" ]; then
-    echo "ERROR: .rad container too small: $RAD is ${RAD_MIB} MiB, want >= $FRANK_PRIMARY_RAD_MIN_MIB" >&2
-    echo "frank-primary: the convert was truncated — rebuild it" >&2
-    exit 1
-fi
-
-if [ ! -f "$FRANK_PRIMARY_TEMPLATE" ]; then
-    echo "ERROR: chat template missing: $FRANK_PRIMARY_TEMPLATE" >&2
-    exit 1
-fi
-
-mkdir -p "$FRANK_PRIMARY_STATE_DIR/kvcache/frank-primary"
-# The engine's create is NOT recursive: with only the state dir mounted, its
-# "cannot create /data/kvcache/frank-primary: No such file or directory"
-# left the SSD prefix tier off (measured 2026-10-06 boot ledger). Pre-create
-# the full path on the host so the tier opens on first boot.
-
-mkdir -p "$FRANK_PRIMARY_STATE_DIR/tune"
-# rad-tune's kernel-selection cache (see the runbook's "Tuning levers"):
-# the engine's selector reads $RADIANCE_HOME/tune/<machine>.tune at boot;
-# $RADIANCE_HOME defaults to /opt/radiance, which lives in the image, so
-# the cache must ride a host mount or it dies with the --rm container
-# that wrote it. The dir is pre-created for the same reason as kvcache
-# (the engine's create is not recursive).
-
-if [ ! -e /dev/kfd ] || [ ! -d /dev/dri ]; then
-    echo "ERROR: GPU device nodes absent (/dev/kfd, /dev/dri)" >&2
-    exit 1
-fi
-
-# TTM preflight: the pinned ledger (~2 x 40 GiB pools + 47.7 GiB PLE + 4 GiB
-# prefix host = ~132 GiB) rides TTM's shared pages, capped by ttm's
-# pages_limit (the current kernel exposes NO pages_max; the cap function
-# takes the min over the knobs that exist). Below FRANK_PRIMARY_TTM_MIN_MIB
-# the load dies mid-pin with an allocator error instead of this named
-# refusal — raise the knob first (runtime sysfs write; kernel cmdline
-# fallback + one reboot only if the file is read-only), see the runbook.
-# RAISED 2026-10-05 pre-cutover to 52,428,800 pages = 200 GiB.
-ttm_cap_mib() {
-    # min over the knobs THIS kernel exposes — the current kernel has
-    # pages_limit only (no pages_max); a knob that is absent is skipped,
-    # not a zero (a zero would refuse a healthy cap).
-    local v cur=""
-    for p in /sys/module/ttm/parameters/pages_limit /sys/module/ttm/parameters/pages_max; do
-        [ -r "$p" ] || continue
-        v="$(cat "$p" 2>/dev/null)" || continue
-        [ -n "$v" ] || continue
-        v=$(( v * 4 / 1024 ))
-        if [ "$v" -lt "${cur:-999999999}" ]; then cur=$v; fi
-    done
-    echo "${cur:-0}"
-}
-TTM_CAP="$(ttm_cap_mib)"
-if [ "$TTM_CAP" -lt "$FRANK_PRIMARY_TTM_MIN_MIB" ]; then
-    echo "ERROR: ttm pages cap is ${TTM_CAP} MiB, the pinned ledger needs >= $FRANK_PRIMARY_TTM_MIN_MIB" >&2
-    echo "frank-primary: raise /sys/module/ttm/parameters/pages_limit (and pages_max if the kernel exposes one) to >= $FRANK_PRIMARY_TTM_MIN_MIB in 4 KiB pages" >&2
-    exit 1
-fi
-
-# A crashed/killed unit can leave the container name registered (systemd
-# SIGKILLs conmon before cleanup runs). Clear OUR name plus the legacy
-# identities (the FreeToken-era frank-primary-qwen, the retired R9V
-# container and the ad hoc experiment containers all hold this GPU); all
-# idempotent.
-for CTR in $FRANK_PRIMARY_LEGACY_CONTAINERS "$FRANK_PRIMARY_CONTAINER"; do
-    podman rm -f "$CTR" >/dev/null 2>&1 || true
-done
-
-LOG=/home/dank/logs/frank_primary.log
-mkdir -p "$(dirname "$LOG")"
-
-# Publisher-vetted container contract (docs/DOCKER.md, compose/common.yaml):
-# --network host (the server binds the host's addresses directly, no NAT),
-# --init (the engine releases the cards on SIGTERM), seccomp=unconfined
-# (Docker/podman's default profile refuses io_uring, which the n-gram
-# table's reads go through, and the NUMA binding calls the ROCm runtime
-# makes for host memory), memlock unbounded (the pinned ledger — legal
-# because the root unit grants LimitMEMLOCK=infinity to this dank process),
-# /dev/kfd + /dev/dri (render/video groups are moot for a root container).
-# The template rides a single-file mount; the .rad dir is ro; /data holds
-# the prefix-cache disk tier.
-podman run -d --name "$FRANK_PRIMARY_CONTAINER" \
-  --network host \
-  --init \
-  --security-opt seccomp=unconfined \
-  --ulimit memlock=-1:-1 \
-  --device /dev/kfd --device /dev/dri \
-  -v "$FRANK_PRIMARY_MODEL_DIR":/models:ro \
-  -v "$FRANK_PRIMARY_STATE_DIR":/data \
-  -v "$FRANK_PRIMARY_STATE_DIR/tune":/opt/radiance/share/radiance/tune \
-  -v "$FRANK_PRIMARY_TEMPLATE":/templates/template.jinja:ro \
-  "$FRANK_PRIMARY_IMAGE" \
-  --model "/models/$FRANK_PRIMARY_MODEL_FILE" \
-  --host :: --port "$FRANK_PRIMARY_PORT" \
-  --served-model-name "$FRANK_PRIMARY_SERVED_NAME" \
-  --override-chat-template /templates/template.jinja \
-  --tp "$FRANK_PRIMARY_TP" --tp-wire "$FRANK_PRIMARY_TP_WIRE" \
-  --max-num-seqs "$FRANK_PRIMARY_MAX_SEQS" \
-  --max-model-len "$FRANK_PRIMARY_MAX_MODEL_LEN" \
-  --placement "$FRANK_PRIMARY_PLACEMENT" \
-  --host-pool-mib "$FRANK_PRIMARY_HOST_POOL_MIB" \
-  --gpu-headroom-mib "$FRANK_PRIMARY_GPU_HEADROOM_MIB" \
-  --expert-vs-cache-ratio "$FRANK_PRIMARY_EXPERT_VS_CACHE" \
-  --kv-cache-dtype "$FRANK_PRIMARY_KV_DTYPE" \
-  --prefix-cache-host-mib "$FRANK_PRIMARY_PREFIX_HOST_MIB" \
-  --prefix-cache-dir /data/kvcache/frank-primary \
-  --prefix-cache-disk-mib "$FRANK_PRIMARY_PREFIX_DISK_MIB" \
-  --ngram-placement "$FRANK_PRIMARY_NGRAM_PLACEMENT" \
-  --num-speculative-tokens "$FRANK_PRIMARY_SPEC_TOKENS" \
-  --max-num-batched-tokens "$FRANK_PRIMARY_MAX_BATCHED_TOKENS" \
-  ${FRANK_PRIMARY_EXTRA_ARGS:+$FRANK_PRIMARY_EXTRA_ARGS} \
-  > "$LOG" 2>&1
-
-# From here on, this script's lifetime IS the container's: wait returns the
-# container's exit code, so a crash is a nonzero ExecStart and the unit's
-# Restart=always is real. (systemd stop goes through ExecStop in the unit —
-# podman wait alone cannot stop the container child.)
-exec podman wait "$FRANK_PRIMARY_CONTAINER"

scripts/serve-frank-secondary.sh

@@ -1,120 +0,0 @@
-#!/usr/bin/env bash
-# Serve ajgazin/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-GGUF
-# (RCO-IQ3_XXS, **MTP head in the file**) as frank-secondary on Dankclaw's
-# RTX 3090 via llama.cpp (master build, CUDA sm_86).
-#
-# 2026-10-06 (Frank): TWO 131,072 conversations (262144 / 2) at the 128k
-# cap, ubatch 512, and MTP BACK ON (draft-mtp, depth 3 — the payload is
-# 1.56 GiB lighter than the IQ3_S-mtp it replaced, which is what funds
-# the draft ctx plus the second slot; ngram stays skipped — on a qwen35
-# hybrid it disables recurrent-state rollback). The q8_0 KV contract
-# (FP8 class) is unchanged; the per-tensor flags stay explicit either
-# way.
-#
-# Architecture: qwen35 hybrid — 64 real layers, 16 full-attention + 48
-# Gated DeltaNet (full_attention_interval 4), native 262144 window, plus
-# the blk.64 MTP head (nextn_predict_layers=1). KV lives only in the 16
-# attention layers (34 KiB/token at q8_0); the DeltaNet state is per-slot
-# fixed size.
-# Vision comes from the projector file (the GGUF carries no vision
-# tensors; the publisher SHIPS mmproj-BF16.gguf in the same repo), so
-# --mmproj is what gives this endpoint eyes; MMPROJ_FILE="" is the
-# documented text-only opt-out.
-#
-# Sampling: llama.cpp takes it per request (the fleet harness sends its
-# recipe from models.yml); greedy is the harness default.
-#
-# Tunables come from frank-secondary.env unless FRANK_SECONDARY_ENV_FILE overrides.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-ENV_FILE="${FRANK_SECONDARY_ENV_FILE:-$SCRIPT_DIR/frank-secondary.env}"
-if [[ -f "$ENV_FILE" ]]; then
-    set -a
-    # shellcheck disable=SC1090
-    source "$ENV_FILE"
-    set +a
-fi
-
-# --- defaults (used when the env file does not set them) -------------------
-: "${LLAMA_BIN:=/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server}"
-: "${MODEL_FILE:=/home/dank/models/Swift15-UncIQ3XXS/Swift-1.5-Qwen3.8-27B-Uncensored-Dynamic-MTP-RCO-IQ3_XXS.gguf}"
-: "${ALIAS:=frank-secondary}"
-: "${BIND_ADDR:=0.0.0.0}"
-: "${LISTEN_PORT:=7771}"
-# ctx-size is the POOL llama.cpp divides across slots: 262144 / 2 gives
-# TWO 131,072 conversations — Frank's 128k cap each. 2026-10-06 (Frank):
-# drop MTP, drop ubatch to 512, take two slots; the fit is tight by his
-# explicit order (frank-secondary.env carries the arithmetic and the floor
-# violation).
-: "${CTX_SIZE:=262144}"
-: "${PARALLEL:=2}"
-# Compute-buffer geometry. Ubatch is a prefill knob (decode never moves).
-# Frank's 2026-10-06 tight-fit order ships 4096/512 (claws back ~0.3 GiB
-# toward the second slot); ubatch 1024 is the first A/B back if a future
-# boot lands with headroom (a miss fails loud at graph capture). The
-# logical batch is VRAM- and throughput-neutral at a fixed ubatch.
-: "${BATCH_SIZE:=4096}"
-: "${UBATCH_SIZE:=512}"
-# KV at FP8 class = q8_0 on llama.cpp (1.0625 B/elem => 8.5 effective bits;
-# there is no true fp8 KV dtype). Explicit either way so the contract is
-# visible in the argv.
-: "${CACHE_TYPE_K:=q8_0}"
-: "${CACHE_TYPE_V:=q8_0}"
-# Speculative decoding is ON by default (Frank, 2026-10-06 evening):
-# draft-mtp against the head that is IN the file. SPEC_TYPE none strips
-# BOTH speculative flags (flags move as a set) — a no-spec baseline must
-# not carry half a spec pair.
-: "${SPEC_TYPE:=draft-mtp}"
-: "${SPEC_DRAFT_N_MAX:=3}"
-: "${NGL:=99}"
-# Vision projector. No colon on purpose: an explicitly empty value means
-# "text-only, on purpose" and must NOT be replaced by the default path.
-: "${MMPROJ_FILE=/home/dank/models/Swift15-UncIQ3XXS/mmproj-BF16.gguf}"
-
-# Fail loudly rather than half-loading: a missing file is a download that
-# has not finished, and Restart=always would turn it into a crash loop that
-# reads like a runtime fault.
-for path in "$LLAMA_BIN" "$MODEL_FILE"; do
-    [[ -e "$path" ]] || { echo "frank-secondary: missing $path" >&2; exit 1; }
-done
-EXTRA_ARGS=()
-if [[ -n "$MMPROJ_FILE" ]]; then
-    [[ -e "$MMPROJ_FILE" ]] || { echo "frank-secondary: missing $MMPROJ_FILE" >&2; exit 1; }
-    EXTRA_ARGS+=(--mmproj "$MMPROJ_FILE")
-fi
-
-# Speculative flags move as a set: they reach the argv ONLY when a drafter
-# is named. SPEC_TYPE=none (the shipped contract) strips both — a no-spec
-# baseline must not carry half a spec pair.
-if [[ -n "$SPEC_TYPE" && "$SPEC_TYPE" != "none" ]]; then
-    EXTRA_ARGS+=(--spec-type "$SPEC_TYPE" --spec-draft-n-max "$SPEC_DRAFT_N_MAX")
-fi
-
-# The UVM device node is created lazily by nvidia-modprobe on the first CUDA
-# open after boot; make sure it exists before the server needs it.
-nvidia-modprobe -u -c=0 2>/dev/null || true
-
-# Flash attention stays pinned on: it is REQUIRED for quantized V (q8_0),
-# and the build carries GGML_CUDA_FA_ALL_QUANTS=ON (since 2026-09-17), so
-# the q8_0 KV contract in frank-secondary.env is a real path — without this
-# flag or that build option the engine silently falls back and the
-# contract becomes a lie.
-ARGS=(
-    --model "$MODEL_FILE"
-    --alias "$ALIAS"
-    --host "$BIND_ADDR"
-    --port "$LISTEN_PORT"
-    --ctx-size "$CTX_SIZE"
-    --parallel "$PARALLEL"
-    --batch-size "$BATCH_SIZE"
-    --ubatch-size "$UBATCH_SIZE"
-    --n-gpu-layers "$NGL"
-    --flash-attn on
-    --cache-type-k "$CACHE_TYPE_K"
-    --cache-type-v "$CACHE_TYPE_V"
-    --jinja
-    --reasoning auto
-    --reasoning-format deepseek
-)
-exec "$LLAMA_BIN" "${ARGS[@]}" ${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}

scripts/serve-frank-zealot.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Serve HauhauCS/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive (Q6_K) as
+# frank-zealot on Dankclaw's RTX 3090 via llama.cpp (master build, CUDA sm_86).
+#
+# 2026-10-07 (Frank): Qwen3.5-9B swap at TWO 200,704-token conversations
+# (--ctx-size 401408 --parallel 2) with EXACT f16 KV — the 9B rung frees the
+# room the 26B MoE Gemma4 shape lacked, so quantized V retires. MTP stays off:
+# this GGUF carries no MTP tensors at all (verified from its tensor-name
+# list), so there is no in-file head to draft with. Verbosity 4 ships so the
+# VRAM-fit forensics (KV layout, buffer sizes, graph capture) land in the journal.
+#
+# Architecture: qwen35 — dense 9B, 32 layers with full_attention_interval 4
+# (8 full-attention layers at 3,7,...,31 + 24 Gated DeltaNet linear layers),
+# 16 heads / 4 KV heads × 256 dim, native 262,144, vocab 248,320. The KV pool
+# scales with the 8 full layers: 32 KiB/token at f16 K + f16 V (12.25 GiB at
+# the 401,408 pool); the DeltaNet layers cost a fixed recurrent state per
+# slot. Feasibility is priced from the MiMo-V2.6-Distill-Qwen-9B boots (same
+# geometry, same card, same shape): 21,276/2,849 at ubatch 1024, 21,846/2,279
+# at ubatch 2048 — the boot ledger, not arithmetic, is the referee.
+# Vision comes from the publisher's own BF16 projector (the model is natively
+# multimodal), so --mmproj is what gives this endpoint eyes; MMPROJ_FILE="" is
+# the documented text-only opt-out.
+#
+# Sampling: llama.cpp takes it per request (the fleet harness sends the
+# publisher recipe from models.yml: thinking temp 0.6 / top_p 0.95 / top_k 20).
+#
+# Tunables come from frank-zealot.env unless FRANK_ZEALOT_ENV_FILE overrides.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+
+# The artifact gates are the shared library (scripts/lib/llm-gates.sh): the
+# serve script and the deployer gate the same payload, and two hand-written
+# copies of the same checks drift apart until one side passes what the
+# other refuses.
+export GATE_PREFIX=frank-zealot
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/llm-gates.sh"
+ENV_FILE="${FRANK_ZEALOT_ENV_FILE:-$SCRIPT_DIR/frank-zealot.env}"
+if [[ -f "$ENV_FILE" ]]; then
+    set -a
+    # shellcheck disable=SC1090
+    source "$ENV_FILE"
+    set +a
+fi
+
+# --- defaults (used when the env file does not set them) -------------------
+: "${LLAMA_BIN:=/home/dank/GitPackages/llama-master/build-cuda/bin/llama-server}"
+: "${MODEL_FILE:=/home/dank/models/Qwen35-9B-HauhauCS-Q6K/Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q6_K.gguf}"
+: "${ALIAS:=frank-zealot}"
+: "${BIND_ADDR:=0.0.0.0}"
+: "${LISTEN_PORT:=7771}"
+# ctx-size is the POOL llama.cpp divides across slots: 401,408 / 2 = 200,704
+# per conversation, inside the model's trained 262,144. The harness
+# contextWindow MUST quote the PER-SLOT number — a longer prompt is answered
+# with a 400, never truncated.
+: "${CTX_SIZE:=401408}"
+: "${PARALLEL:=2}"
+# Compute-buffer geometry. Ubatch is a prefill knob (decode never moves).
+# 2048 is the measured CUDA optimum (MiMo era, same arch/shape: +4.6 % prefill
+# at 8.9k depth, decode flat, 616 MiB). The logical batch is VRAM- and
+# throughput-neutral at a fixed ubatch.
+: "${BATCH_SIZE:=4096}"
+: "${UBATCH_SIZE:=2048}"
+# Exact (unquantized) KV: f16 K + f16 V, restoring the MiMo-era contract that
+# the 26B Gemma4 shape could not afford. 32 KiB/token at this geometry
+# (8 full-attention layers × 4 KV heads × 256 dim); 12.25 GiB at the 401,408
+# pool. Explicit either way so the contract is visible in the argv, and
+# --flash-attn stays required for any quantized-V fallback (q8_0 = llama.cpp's
+# FP8 class; no true fp8 KV dtype exists in this build).
+: "${CACHE_TYPE_K:=f16}"
+: "${CACHE_TYPE_V:=f16}"
+# Speculative decoding is OFF: this Q6_K file carries NO nextn/mtp tensors,
+# so there is no in-file head — a speculative head is a property of the
+# model file, not of the flags; no flag creates tensors that are absent.
+# naming a drafter requires SPEC_DRAFT_FILE alongside SPEC_TYPE — the Gemma4
+# assistant on disk is arch gemma4-assistant and cannot drafter-match qwen35.
+: "${SPEC_TYPE:=none}"
+: "${SPEC_DRAFT_N_MAX:=3}"
+: "${SPEC_DRAFT_FILE:=}"
+: "${NGL:=99}"
+# Log verbosity threshold (llama.cpp -lv). 3 is the engine default (info);
+# 4 adds debug detail (KV layout, buffer sizes, graph capture) which is what
+# the VRAM-fit forensics need. Levels above 4 flood the journal.
+: "${VERBOSITY:=3}"
+# Vision projector. No colon on purpose: an explicitly empty value means
+# "text-only, on purpose" and must NOT be replaced by the default path.
+: "${MMPROJ_FILE=/home/dank/models/Qwen35-9B-HauhauCS-Q6K/mmproj-Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-BF16.gguf}"
+
+# Fail loudly rather than half-loading: a missing file is a download that
+# has not finished, and Restart=always would turn it into a crash loop that
+# reads like a runtime fault. The refusal text is the shared gate library's,
+# so the deployer's twin refuses identically.
+require_file "$LLAMA_BIN" runtime \
+    "build it: scripts/build-llama-master-cuda.sh" || exit 1
+require_file "$MODEL_FILE" gguf \
+    "fetch it: bash scripts/download-frank-zealot.sh" || exit 1
+if [[ -n "$MMPROJ_FILE" ]]; then
+    require_file "$MMPROJ_FILE" mmproj \
+        "fetch it: bash scripts/download-frank-zealot.sh" || exit 1
+fi
+EXTRA_ARGS=()
+if [[ -n "$MMPROJ_FILE" ]]; then
+    EXTRA_ARGS+=(--mmproj "$MMPROJ_FILE")
+fi
+
+# Speculative flags move as a set: they reach the argv ONLY when a drafter
+# is named. SPEC_TYPE=none (the shipped contract) strips both — a no-spec
+# baseline must not carry half a spec pair.
+if [[ -n "$SPEC_TYPE" && "$SPEC_TYPE" != "none" ]]; then
+    EXTRA_ARGS+=(--spec-type "$SPEC_TYPE" --spec-draft-n-max "$SPEC_DRAFT_N_MAX")
+if [[ -n "$SPEC_DRAFT_FILE" ]]; then
+    [[ -e "$SPEC_DRAFT_FILE" ]] || { echo "frank-zealot: missing $SPEC_DRAFT_FILE" >&2; exit 1; }
+    EXTRA_ARGS+=(--spec-draft-model "$SPEC_DRAFT_FILE")
+fi
+fi
+
+# The UVM device node is created lazily by nvidia-modprobe on the first CUDA
+# open after boot; make sure it exists before the server needs it.
+nvidia-modprobe -u -c=0 2>/dev/null || true
+
+# Flash attention stays pinned on: it is REQUIRED for quantized V (q8_0),
+# and the build carries GGML_CUDA_FA_ALL_QUANTS=ON (since 2026-09-17), so
+# the q8_0 KV contract in frank-zealot.env is a real path — without this
+# flag or that build option the engine silently falls back and the
+# contract becomes a lie.
+ARGS=(
+    --model "$MODEL_FILE"
+    --alias "$ALIAS"
+    --host "$BIND_ADDR"
+    --port "$LISTEN_PORT"
+    --ctx-size "$CTX_SIZE"
+    --parallel "$PARALLEL"
+    --batch-size "$BATCH_SIZE"
+    --ubatch-size "$UBATCH_SIZE"
+    --n-gpu-layers "$NGL"
+    --flash-attn on
+    --cache-type-k "$CACHE_TYPE_K"
+    --cache-type-v "$CACHE_TYPE_V"
+    --log-verbosity "$VERBOSITY"
+    --jinja
+    --reasoning auto
+    --reasoning-format deepseek
+)
+exec "$LLAMA_BIN" "${ARGS[@]}" ${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}

scripts/service-map.py

@@ -0,0 +1,750 @@
+#!/usr/bin/env python3
+"""service-map.py — the only reader of the service inventory.
+
+Four lists used to agree by discipline (the planner's path rules, the
+deployer's allow-list, the changed-test mapper, and the scrape/probe/DNS
+facts written by hand in three config files). They now all read
+`shared/services.yml` through this tool:
+
+  hosts                          the deploy targets
+  services [--host H]            deployables a target accepts, canonical order
+  allows --host H --service S    exit 0 when H accepts S (silent)
+  plan --host H PATH...          services selected by changed paths, order-safe
+  seams [--host H] PATH...       the Bats seams a changed path must re-run
+  owner --host H PATH            the service that owns a file (empty: none)
+  units --host H --service S     "<unit> <unit_dir>" lines the handler installs
+  stack --host H --service S     the deployable + members one handler deploys
+  get --service S [--host H] F   one field as JSON
+  render pihole-hosts            the Pi-hole addn-hosts file
+  check [NAME...]                integrity + drift gates (exit 1 on drift)
+
+Two rules the engine enforces structurally:
+
+* A path selects only services that RUN on the planned target. Path
+  matching that is host-blind (match first, filter later) lets a file on
+  one host plan a service on another; selection is scoped to the host the
+  path belongs to.
+* The netns family is DERIVED, never declared: a unit file that says
+  `Network=gluetun.container` rides that tunnel, so a gluetun change selects
+  every sharer. The unit files are the source of that coupling.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+from functools import lru_cache
+from pathlib import Path, PurePosixPath
+from typing import Any
+
+import yaml
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+DEFAULT_INVENTORY = REPO_ROOT / "shared" / "services.yml"
+
+REQUIRED_KEYS = ("name", "hosts", "kind", "tests")
+KINDS = {"quadlet", "root-unit", "vm-quadlet", "host"}
+UNIT_SUFFIXES = (".container", ".network")
+
+# Repo material that is never a deployed runtime's state.
+NON_RUNTIME_ROOTS = {"docs", "report", "old", ".githooks", ".obsidian", ".github",
+                     "tests", "serverAppConfigs-docs"}
+NON_RUNTIME_NAMES = {".env.example"}
+NON_RUNTIME_PATHS = {"README.md", "AGENTS.md", ".gitignore"}
+
+
+def is_trash(path: str) -> bool:
+    return ".AGENTTRASH" in PurePosixPath(path).parts
+
+
+# --------------------------------------------------------------------------
+# inventory
+# --------------------------------------------------------------------------
+class Inventory:
+    def __init__(self, doc: dict[str, Any], origin: str) -> None:
+        self.origin = origin
+        self.hosts: dict[str, dict[str, Any]] = doc["hosts"]
+        self.services: list[dict[str, Any]] = doc["services"]
+        self.unowned: dict[str, str] = doc.get("unowned", {})
+        for index, svc in enumerate(self.services):
+            svc["_index"] = index
+
+    @classmethod
+    def load(cls, path: str | Path = DEFAULT_INVENTORY) -> "Inventory":
+        doc = yaml.safe_load(Path(path).read_text())
+        if not isinstance(doc, dict) or "services" not in doc:
+            raise SystemExit(f"{path}: not a service inventory document")
+        return cls(doc, str(path))
+
+    def on(self, host: str) -> list[dict[str, Any]]:
+        return [s for s in self.services if host in s["hosts"]]
+
+    def named(self, host: str, name: str) -> list[dict[str, Any]]:
+        return [s for s in self.services if s["name"] == name and host in s["hosts"]]
+
+    def any_named(self, name: str) -> list[dict[str, Any]]:
+        return [s for s in self.services if s["name"] == name]
+
+    @property
+    def order(self) -> list[str]:
+        seen: list[str] = []
+        for svc in self.services:
+            if svc["name"] not in seen:
+                seen.append(svc["name"])
+        return seen
+
+    def edge_ip(self) -> str:
+        """The single address every DNS name resolves at (Caddy's edge)."""
+        for host in self.hosts.values():
+            if "dns_edge" in host:
+                return str(host["dns_edge"])
+        raise SystemExit(f"{self.origin}: no host declares dns_edge")
+
+    def service(self, name: str) -> dict | None:
+        for svc in self.services:
+            if svc["name"] == name:
+                return svc
+        return None
+
+    def unit_dirs(self, svc: dict[str, Any], host: str | None = None) -> list[str]:
+        """The repo dirs holding this service's unit files, for one host."""
+        dirs = svc.get("unit_dir")
+        if not dirs:
+            return []
+        if isinstance(dirs, dict):
+            if host is not None:
+                return [dirs[host]] if host in dirs else []
+            return [dirs[h] for h in svc["hosts"] if h in dirs]
+        return [dirs]
+
+    def owns_unit(self, svc: dict[str, Any], host: str, unit: str, directory: str) -> bool:
+        return unit in svc.get("units", []) and directory in self.unit_dirs(svc, host)
+
+
+# --------------------------------------------------------------------------
+# repo facts
+# --------------------------------------------------------------------------
+@lru_cache(maxsize=1)
+def tracked_files() -> tuple[str, ...]:
+    # Tracked + untracked (a check that only saw HEAD would ignore the very
+    # files a work-in-progress commit is adding).
+    out = subprocess.run(
+        ["git", "-C", str(REPO_ROOT), "ls-files", "--cached", "--others",
+         "--exclude-standard"],
+        text=True, stdout=subprocess.PIPE, check=True)
+    return tuple(line for line in out.stdout.splitlines() if line)
+
+
+def _network_values(container: Path) -> list[str]:
+    """Every `Network=` value a quadlet unit declares (comma lists included)."""
+    values: list[str] = []
+    try:
+        text = container.read_text()
+    except OSError:
+        return values
+    for line in text.splitlines():
+        if line.startswith("Network="):
+            values.extend(v.strip() for v in line[len("Network="):].split(",") if v.strip())
+    return values
+
+
+class Graph:
+    """The unit-file coupling, read out of the tree: netns + netns-net users.
+
+    Quadlet installs every user unit flat, so `Network=gluetun.container`
+    names a unit by name, not by path; the same host is the scope, which is
+    also the deployment scope.
+    """
+
+    def __init__(self, hosts: list[str]) -> None:
+        self.units: dict[tuple[str, str], str] = {}      # (host, unit) -> path
+        self.networks: dict[tuple[str, str], str] = {}   # (host, net) -> path
+        self.netns_children: dict[tuple[str, str], set[tuple[str, str]]] = {}
+        self.network_users: dict[tuple[str, str], set[tuple[str, str]]] = {}
+        for path in tracked_files():
+            parts = PurePosixPath(path).parts
+            if not parts or parts[0] not in hosts or is_trash(path):
+                continue
+            host, directory, name = parts[0], str(PurePosixPath(*parts[1:-1])), parts[-1]
+            if name.endswith(".container"):
+                self.units[(host, name[: -len(".container")])] = path
+            elif name.endswith(".network"):
+                self.networks[(host, name[: -len(".network")])] = path
+        for (host, unit), path in self.units.items():
+            for value in _network_values(REPO_ROOT / path):
+                if value.endswith(".container"):
+                    parent = (host, value[: -len(".container")])
+                    self.netns_children.setdefault(parent, set()).add((host, unit))
+                elif value.endswith(".network"):
+                    net = (host, value[: -len(".network")])
+                    self.network_users.setdefault(net, set()).add((host, unit))
+
+    def rides(self, start: list[tuple[str, str]]) -> set[tuple[str, str]]:
+        """The transitive netns closure: a unit, everything riding it, and
+        everything riding those (a netns inside a netns)."""
+        found: set[tuple[str, str]] = set()
+        frontier = list(start)
+        while frontier:
+            node = frontier.pop()
+            if node in found:
+                continue
+            found.add(node)
+            frontier.extend(self.netns_children.get(node, ()))
+        return found
+
+
+@lru_cache(maxsize=8)
+def graph_for(hosts: tuple[str, ...]) -> Graph:
+    return Graph(list(hosts))
+
+
+# --------------------------------------------------------------------------
+# selection
+# --------------------------------------------------------------------------
+def _owner_index(inv: Inventory) -> dict[tuple[str, str, int]]:
+    """(host, unit) -> service index, for unit-file ownership.
+
+    A quadlet unit name is unique per host (``check units`` enforces one
+    claim), so the coupling closure can resolve a riding unit that lives in
+    a DIFFERENT directory than the changed file — gluetun's netns children
+    are the point.
+    """
+    index: dict[tuple[str, str], int] = {}
+    for svc in inv.services:
+        for host in svc["hosts"]:
+            for unit in svc.get("units", []):
+                key = (host, unit)
+                if key in index and index[key] != svc["_index"]:
+                    raise SystemExit(
+                        f"{inv.origin}: unit {unit!r} on {host} claimed by "
+                        f"{inv.services[index[key]]['name']} and {svc['name']}"
+                    )
+                index[key] = svc["_index"]
+    return index
+
+
+def select(inv: Inventory, host: str, paths: list[str]) -> list[str]:
+    """Canonical-order service names the changed paths select for one host."""
+    if host not in inv.hosts:
+        raise SystemExit(f"{inv.origin}: no host {host!r}")
+    graph = graph_for(tuple(inv.hosts))
+    owners = _owner_index(inv)
+    hits: set[int] = set()
+
+    def add(index: int) -> None:
+        hits.add(index)
+
+    for raw in paths:
+        path = raw.replace("\\", "/")
+        parts = PurePosixPath(path).parts
+        if not parts or is_trash(path) or path in NON_RUNTIME_PATHS:
+            continue
+        if PurePosixPath(path).name in NON_RUNTIME_NAMES:
+            continue
+        head = parts[0]
+        if head in NON_RUNTIME_ROOTS:
+            continue
+        # A host's directory is the scope: a frankbook-pro file can never
+        # select a dankserver service.
+        scoped_host = head if head in inv.hosts else None
+        if scoped_host is not None and scoped_host != host:
+            continue
+
+        name = parts[-1]
+        directory = str(PurePosixPath(*parts[1:-1])) if len(parts) > 1 else ""
+
+        if scoped_host and name.endswith(UNIT_SUFFIXES):
+            stem = name.rsplit(".", 1)[0]
+            key = (scoped_host, stem)
+            if name.endswith(".network") and key in graph.networks:
+                users = graph.network_users.get(key, set())
+                for unit in graph.rides(sorted(users)):
+                    index = owners.get(unit)
+                    if index is not None:
+                        add(index)
+            elif key in graph.units:
+                for unit in graph.rides([key]):
+                    index = owners.get(unit)
+                    if index is not None:
+                        add(index)
+
+        for index in list(hits):
+            for dependent in inv.services[index].get("dependents", []):
+                for svc in inv.named(host, dependent):
+                    add(svc["_index"])
+
+        for svc in inv.on(host):
+            if path in svc.get("files", []):
+                add(svc["_index"])
+            if path in svc.get("retires", []):
+                add(svc["_index"])
+            for directory_rule in svc.get("dirs", []):
+                if path == directory_rule or path.startswith(directory_rule + "/"):
+                    add(svc["_index"])
+
+    return [svc["name"] for svc in sorted((inv.services[i] for i in hits),
+                                          key=lambda s: s["_index"])]
+
+
+def seams_for(inv: Inventory, host: str, paths: list[str]) -> list[str]:
+    """The Bats seams the selected services require, deduplicated, in order."""
+    seams: list[str] = []
+    for name in select(inv, host, paths):
+        for svc in inv.named(host, name):
+            for seam in svc.get("tests", []):
+                if seam not in seams:
+                    seams.append(seam)
+    if seams and "tests/deployment_scoping.bats" not in seams:
+        seams.append("tests/deployment_scoping.bats")
+    return seams
+
+
+# --------------------------------------------------------------------------
+# renderers + facts
+# --------------------------------------------------------------------------
+def render_pihole_hosts(inv: Inventory) -> str:
+    edge = inv.edge_ip()
+    lines = [
+        "# A records for the flat franksdank.cloud scheme (dnsmasq addn-hosts",
+        "# format: <IP> <name>). RENDERED — do not edit by hand:",
+        "#",
+        "#     scripts/service-map.py render pihole-hosts > dankclaw/pihole/addn-hosts",
+        "#",
+        "# The source of truth is the `dns:` field of shared/services.yml; the",
+        "# drift gate in tests/service_inventory.bats fails when this file and",
+        "# the inventory disagree. Caddy is consolidated on Dankclaw, so every",
+        "# name — including the services running on dankserver and",
+        "# frankbook-pro — resolves at the Dankclaw edge.",
+        "#",
+        "# dnsmasq strips ONLY whole-line comments in addn-hosts: a trailing",
+        "# comment on a data line becomes a HOSTNAME token. No inline notes",
+        "# here; the service attribution lives in the inventory.",
+        "",
+    ]
+    for svc in inv.services:
+        for name in svc.get("dns", []):
+            lines.append(f"{edge} {name}")
+    return "\n".join(lines) + "\n"
+
+
+def scrape_facts(inv: Inventory) -> list[dict[str, str]]:
+    facts = []
+    for svc in inv.services:
+        for job in svc.get("scrape", []):
+            facts.append({"job": job["job"], "target": job["target"],
+                          "metrics_path": job.get("metrics_path", "/")})
+    return facts
+
+
+def prometheus_facts(path: Path) -> list[dict[str, str]]:
+    doc = yaml.safe_load(path.read_text())
+    facts = []
+    for job in doc.get("scrape_configs", []):
+        for sc in job.get("static_configs", []):
+            for target in sc.get("targets", []):
+                facts.append({"job": job["job_name"], "target": target,
+                              "metrics_path": job.get("metrics_path", "/")})
+    return facts
+
+
+def probe_facts(inv: Inventory) -> list[str]:
+    facts: list[str] = []
+    for svc in inv.services:
+        probe = svc.get("probe")
+        if isinstance(probe, dict):
+            facts.extend(str(v) for v in probe.values())
+        elif probe:
+            facts.append(str(probe))
+    return facts
+
+
+def homepage_probes(path: Path) -> list[str]:
+    return sorted({s["probe"] for s in json.loads(path.read_text()) if s.get("probe")})
+
+
+# --------------------------------------------------------------------------
+# checks
+# --------------------------------------------------------------------------
+def check_ownership(inv: Inventory, graph: Graph) -> list[str]:
+    """Every repo file belongs to a service, a rule, or the unowned list."""
+    problems: list[str] = []
+    exact: set[str] = set()
+    directories: set[str] = set()
+    for svc in inv.services:
+        for host in svc["hosts"]:
+            for directory in inv.unit_dirs(svc, host):
+                for unit in svc.get("units", []):
+                    exact.add(f"{directory}/{unit}.container")
+        for field in ("files", "retires"):
+            exact.update(svc.get(field, []))
+        directories.update(svc.get("dirs", []))
+    # A shared network file is claimed by the units that ride it; the unit
+    # graph is the referrer, and check_units proves every reference resolves.
+    exact.update(graph.networks.values())
+
+    def is_claimed(path: str) -> bool:
+        if path in exact:
+            return True
+        first = PurePosixPath(path).parts[0]
+        if first in NON_RUNTIME_ROOTS or path in NON_RUNTIME_PATHS or is_trash(path):
+            return True
+        if PurePosixPath(path).name in NON_RUNTIME_NAMES:
+            return True
+        for owned in directories | set(inv.unowned):
+            if path == owned or path.startswith(owned + "/"):
+                return True
+        return False
+
+    for path in tracked_files():
+        if not is_claimed(path):
+            problems.append(f"file belongs to no service and is not in unowned: {path}")
+
+    # The reverse direction: an unowned entry that names nothing is stale.
+    for directory in inv.unowned:
+        if not any(p == directory or p.startswith(directory + "/") for p in tracked_files()):
+            problems.append(f"unowned entry names no tracked file: {directory}")
+
+    # Every inventory file/dir claim names a tracked file.
+    for svc in inv.services:
+        # `retires` names a file whose DELETION selects the service, so by
+        # definition it is not in the tree.
+        for field in ("files", "dirs"):
+            for entry in svc.get(field, []):
+                if entry not in tracked_files() and not any(
+                        p.startswith(entry + "/") for p in tracked_files()):
+                    problems.append(f"{svc['name']}: {field} entry names no tracked file: {entry}")
+    del graph
+    return problems
+
+
+def check_units(inv: Inventory, graph: Graph) -> list[str]:
+    """Every unit file has exactly one owner; every unit reference resolves."""
+    problems: list[str] = []
+    owners: dict[str, list[str]] = {}
+    for svc in inv.services:
+        for host in svc["hosts"]:
+            for directory in inv.unit_dirs(svc, host):
+                for unit in svc.get("units", []):
+                    path = f"{directory}/{unit}.container"
+                    owners.setdefault(path, []).append(f"{svc['name']}@{host}")
+                    if path not in tracked_files():
+                        problems.append(f"{svc['name']}: unit file is not tracked: {path}")
+    for path in tracked_files():
+        if not path.endswith(".container") or is_trash(path):
+            continue
+        found = owners.get(path, [])
+        if not found:
+            problems.append(f"unit file claimed by no service: {path}")
+        elif len(found) > 1:
+            problems.append(f"unit file claimed by {len(found)} services: {path}: {found}")
+
+    # Root units (scripts/*.service) are claimed by exactly one `files:` list.
+    for path in tracked_files():
+        if not (path.startswith("scripts/") and path.endswith(".service")) or is_trash(path):
+            continue
+        found = [s["name"] for s in inv.services if path in s.get("files", [])]
+        if not found:
+            problems.append(f"root unit claimed by no service: {path}")
+        elif len(found) > 1:
+            problems.append(f"root unit claimed by {found}: {path}")
+
+    # Every Network= reference in a unit file names a file on the same host.
+    for (host, unit), path in graph.units.items():
+        for value in _network_values(REPO_ROOT / path):
+            if value.endswith(".container"):
+                target = (host, value[: -len(".container")])
+                if target not in graph.units:
+                    problems.append(f"{path}: Network={value} names no unit on {host}")
+            elif value.endswith(".network"):
+                target = (host, value[: -len(".network")])
+                if target not in graph.networks:
+                    problems.append(f"{path}: Network={value} names no network on {host}")
+    return problems
+
+
+def check_config(inv: Inventory) -> list[str]:
+    problems: list[str] = []
+    for svc in inv.services:
+        label = f"{'+'.join(svc['hosts'])}/{svc['name']}"
+        for key in REQUIRED_KEYS:
+            if key not in svc:
+                problems.append(f"{label}: missing required key {key}")
+        if svc.get("kind") not in KINDS:
+            problems.append(f"{label}: kind {svc.get('kind')!r} not one of {sorted(KINDS)}")
+        unknown = set(svc.get("hosts", [])) - set(inv.hosts)
+        if unknown:
+            problems.append(f"{label}: undeclared hosts: {sorted(unknown)}")
+        if svc.get("units") and not svc.get("unit_dir"):
+            problems.append(f"{label}: units declared without unit_dir")
+        if svc.get("deployed_by") and not inv.any_named(svc["deployed_by"]):
+            problems.append(f"{label}: deployed_by names no service: {svc['deployed_by']}")
+        if (svc.get("health") and svc.get("wait") is None) or \
+                (svc.get("wait") is not None and not svc.get("health")):
+            problems.append(f"{label}: health and wait are a pair")
+        for seam in svc.get("tests", []):
+            if seam not in tracked_files():
+                problems.append(f"{label}: seam does not exist: {seam}")
+        for name in svc.get("dns", []):
+            if not str(name).replace(".", "").replace("-", "").isalnum():
+                problems.append(f"{label}: dns name is not a plain hostname: {name}")
+        if svc.get("kind") == "root-unit" and svc.get("unit_dir"):
+            problems.append(f"{label}: a root unit lives in scripts/, not unit_dir")
+    seen: set[str] = set()
+    for svc in inv.services:
+        key = (svc["name"], tuple(svc["hosts"]))
+        if key in seen:
+            problems.append(f"duplicate inventory entry: {svc['name']} on {svc['hosts']}")
+        seen.add(key)
+    return problems
+
+
+# --- node-exporter quadlet template (rank 6) --------------------------------
+# Parallel per-host copies kept in step by a comment drift apart; the
+# template is the single source, and `check` drift-gates every tracked
+# rendering against it.
+NODE_EXPORTER_TEMPLATE = """\
+# Quadlet unit: node-exporter (rootless, boot-persistent) — RENDERED ARTIFACT.
+# Regenerate: python3 scripts/service-map.py render node-exporter-unit --host {host}
+# Source: shared/services.yml (entry node-exporter) + this template.
+#
+# Install path on {host}: ~/.config/containers/systemd/node-exporter.container
+# Unit name: node-exporter.service (container name: node-exporter)
+#
+# Host metrics source for Prometheus. Replaces the compose service of the same
+# name (the "Observability" block): Dankclaw moved to this quadlet on
+# 2026-09-11, Dankserver on 2026-09-16 — its compose-only copy died at a reboot
+# and stayed dead (rootless Podman does not restart bare containers after the
+# explicit stop shutdown performs), dead for a day and a half before anyone
+# noticed. One owner per container name; no compose file remains anywhere.
+#
+# HOST NAMESPACE. It must run in the host network namespace to report the
+# host's own interfaces/connections, and --pid=host for the processes and
+# cgroups collectors. "localhost" inside the container is therefore the host's
+# loopback, which is what the homepage status timer probes.
+#
+# LISTEN ADDRESSES. Exactly two: loopback for the homepage status probe, and
+# the LAN address, because Prometheus — which runs in a container on
+# dankclaw_default — scrapes http://{lan}:{port}/metrics
+# (shared/prometheus/prometheus.yml, job "node-{host}"). node_exporter has no
+# authentication, so the wildcard bind stays off the table; this is the
+# pairing that removes the unauthenticated observability surface on every
+# host, and both consumers are accounted for.
+#
+# MOUNTS. The container reads the host's /proc, /sys and / as /host/*
+# read-only and is pointed at them with --path.*; it writes nothing anywhere.
+
+[Unit]
+Description=Prometheus node exporter ({title} host metrics)
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+ContainerName=node-exporter
+Image=docker.io/prom/node-exporter:latest
+Network=host
+PodmanArgs=--pid=host
+Exec=--path.procfs=/host/proc --path.sysfs=/host/sys --path.rootfs=/rootfs --web.listen-address=127.0.0.1:{port} --web.listen-address={lan}:{port}
+Volume=/proc:/host/proc:ro
+Volume=/sys:/host/sys:ro
+Volume=/:/rootfs:ro
+HealthCmd=wget --spider -q http://localhost:{port}/metrics
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+HealthStartPeriod=30s
+
+[Service]
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target
+"""
+
+
+def render_node_exporter_unit(inv: Inventory, host: str) -> str:
+    """The node-exporter quadlet for one host: shared template, per-host
+    title, LAN address from the hosts map, port from the scrape job."""
+    svc = inv.service("node-exporter")
+    if svc is None:
+        raise SystemExit("inventory has no node-exporter entry")
+    job = f"node-{host}"
+    port = next((str(e["target"]).rsplit(":", 1)[1] for e in svc.get("scrape", [])
+                 if e.get("job") == job), None)
+    if port is None:
+        raise SystemExit(f"node-exporter scrape declares no job {job}")
+    lan = inv.hosts[host]["address"]
+    return NODE_EXPORTER_TEMPLATE.format(host=host, title=host.capitalize(),
+                                         lan=lan, port=port)
+
+
+def check_drift(inv: Inventory) -> list[str]:
+    problems: list[str] = []
+    rendered = render_pihole_hosts(inv)
+    hosts_file = REPO_ROOT / "dankclaw" / "pihole" / "addn-hosts"
+    if hosts_file.read_text() != rendered:
+        problems.append("dankclaw/pihole/addn-hosts is not the render of the inventory "
+                        "(scripts/service-map.py render pihole-hosts > dankclaw/pihole/addn-hosts)")
+
+    want = sorted(json.dumps(f, sort_keys=True) for f in scrape_facts(inv))
+    have = sorted(json.dumps(f, sort_keys=True) for f in
+                  prometheus_facts(REPO_ROOT / "shared" / "prometheus" / "prometheus.yml"))
+    for extra in [f for f in have if f not in want]:
+        problems.append(f"prometheus scrapes a target the inventory does not declare: {extra}")
+    for missing in [f for f in want if f not in have]:
+        problems.append(f"inventory declares a scrape prometheus.yml lacks: {missing}")
+
+    svc = inv.service("node-exporter")
+    for host in (svc or {}).get("hosts", []):
+        for directory in inv.unit_dirs(svc, host):
+            path = REPO_ROOT / directory / "node-exporter.container"
+            if path.exists() and path.read_text() != render_node_exporter_unit(inv, host):
+                problems.append(
+                    f"{directory}/node-exporter.container is not the render of the "
+                    f"template (scripts/service-map.py render node-exporter-unit --host {host})")
+
+    probes_want = sorted(set(probe_facts(inv)))
+    probes_have = homepage_probes(REPO_ROOT / "shared" / "homepage" / "services.json")
+    for extra in [p for p in probes_have if p not in probes_want]:
+        problems.append(f"homepage probes a target the inventory does not declare: {extra}")
+    for missing in [p for p in probes_want if p not in probes_have]:
+        problems.append(f"inventory declares a probe homepage does not list: {missing}")
+    return problems
+
+
+CHECKS = {
+    "config": lambda inv, graph: check_config(inv),
+    "units": check_units,
+    "ownership": check_ownership,
+    "drift": lambda inv, graph: check_drift(inv),
+}
+
+
+def check(inv: Inventory, names: list[str]) -> list[str]:
+    graph = graph_for(tuple(inv.hosts))
+    problems: list[str] = []
+    for name in names or list(CHECKS):
+        problems.extend(CHECKS[name](inv, graph))
+    return problems
+
+
+# --------------------------------------------------------------------------
+# CLI
+# --------------------------------------------------------------------------
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__,
+                                     formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--inventory", type=Path, default=DEFAULT_INVENTORY)
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    sub.add_parser("hosts")
+    p = sub.add_parser("services")
+    p.add_argument("--host")
+    p = sub.add_parser("allows")
+    p.add_argument("--host", required=True)
+    p.add_argument("--service", required=True)
+    p = sub.add_parser("plan")
+    p.add_argument("--host", required=True)
+    p.add_argument("paths", nargs="+")
+    p = sub.add_parser("seams")
+    p.add_argument("--host")
+    p.add_argument("paths", nargs="+")
+    p = sub.add_parser("owner")
+    p.add_argument("--host", required=True)
+    p.add_argument("path")
+    p = sub.add_parser("units")
+    p.add_argument("--host", required=True)
+    p.add_argument("--service", required=True)
+    p = sub.add_parser("stack")
+    p.add_argument("--host", required=True)
+    p.add_argument("--service", required=True)
+    p = sub.add_parser("get")
+    p.add_argument("--host")
+    p.add_argument("--service", required=True)
+    p.add_argument("field")
+    p = sub.add_parser("render")
+    p.add_argument("artifact", choices=("pihole-hosts", "node-exporter-unit"))
+    p.add_argument("--host", choices=list(Hosts) if False else None)
+    p = sub.add_parser("check")
+    p.add_argument("names", nargs="*")
+
+    args = parser.parse_args(argv)
+    inv = Inventory.load(args.inventory)
+
+    if args.command == "hosts":
+        print("\n".join(inv.hosts))
+    elif args.command == "services":
+        services = inv.on(args.host) if args.host else inv.services
+        seen: list[str] = []
+        for svc in services:
+            if svc["name"] not in seen:
+                seen.append(svc["name"])
+        print("\n".join(seen))
+    elif args.command == "allows":
+        return 0 if inv.named(args.host, args.service) else 1
+    elif args.command == "plan":
+        print("\n".join(select(inv, args.host, args.paths)))
+    elif args.command == "seams":
+        if args.host is not None:
+            seams = seams_for(inv, args.host, args.paths)
+        else:
+            # No host: the union across every host (the dev machine's
+            # pre-commit mapper has no deployment target).
+            seams = []
+            for host in inv.hosts:
+                for seam in seams_for(inv, host, args.paths):
+                    if seam not in seams:
+                        seams.append(seam)
+        print("\n".join(seams))
+    elif args.command == "owner":
+        found = select(inv, args.host, [args.path])
+        print(found[-1] if found else "")
+    elif args.command == "units":
+        matches = inv.named(args.host, args.service)
+        if not matches:
+            print(f"no service {args.service} on {args.host}", file=sys.stderr)
+            return 2
+        for svc in matches:
+            for directory in inv.unit_dirs(svc, args.host):
+                for unit in svc.get("units", []):
+                    print(f"{unit} {directory}")
+    elif args.command == "stack":
+        matches = inv.named(args.host, args.service)
+        if not matches:
+            print(f"no service {args.service} on {args.host}", file=sys.stderr)
+            return 2
+        owner = matches[0].get("deployed_by") or args.service
+        print(owner)
+        for svc in inv.on(args.host):
+            if svc.get("deployed_by") == owner and svc["name"] != owner:
+                print(svc["name"])
+    elif args.command == "get":
+        matches = inv.on(args.host) if args.host else inv.services
+        matches = [s for s in matches if s["name"] == args.service]
+        if not matches:
+            print(f"no service {args.service}" + (f" on {args.host}" if args.host else ""),
+                  file=sys.stderr)
+            return 2
+        values = [s.get(args.field) for s in matches if args.field in s]
+        print(json.dumps(values[0] if len(values) == 1 else values))
+    elif args.command == "render":
+        if args.artifact == "pihole-hosts":
+            sys.stdout.write(render_pihole_hosts(inv))
+        else:
+            if not args.host:
+                print("render node-exporter-unit requires --host", file=sys.stderr)
+                return 2
+            sys.stdout.write(render_node_exporter_unit(inv, args.host))
+    elif args.command == "check":
+        problems = check(inv, args.names)
+        if problems:
+            for problem in problems:
+                print(f"FAIL: {problem}", file=sys.stderr)
+            return 1
+        print("OK: the service inventory is sound (schema, units, ownership, drift)")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/stack-qwen38-official-fp8.py

@@ -293,12 +293,12 @@ def main():
     ddt, dsh = meta[f"{pre0}.mlp.experts.0.down_proj.weight"][3:5]
     gsd, gssh = meta[f"{pre0}.mlp.experts.0.gate_proj.weight_scale_inv"][3:5]
     dsd, dssh = meta[f"{pre0}.mlp.experts.0.down_proj.weight_scale_inv"][3:5]
-    scale_law = (gdt == F8 and ddt == F8 and gsd == BF16 and dsd == BF16
+    scale_contract = (gdt == F8 and ddt == F8 and gsd == BF16 and dsd == BF16
                  and list(gssh) == [(gsh[0] + 127) // 128, (gsh[1] + 127) // 128]
                  and list(dssh) == [(dsh[0] + 127) // 128, (dsh[1] + 127) // 128])
-    if not scale_law:
+    if not scale_contract:
         log(f"ERROR: unexpected expert shapes: gate {gdt}{gsh} scale {gsd}{gssh} "
-            f"down {ddt}{dsh} scale {dsd}{dssh} (scale law 128x128)")
+            f"down {ddt}{dsh} scale {dsd}{dssh} (fp8 block scales cover 128x128 tiles)")
         return 2
     shapes = {"ffn2_h": (gsh[0] * 2, gsh[1]), "ffn": (dsh[1],),
               "gs": tuple(gssh), "ds": tuple(dssh)}