memory: snapshot — eRP dual-seat overhaul landed (MeroMero + Dark-Scarlett @ 256K); next = infra+access

persistent-memory.md

@@ -109,9 +109,11 @@ no longer deployed sidecars here. See Recent decisions.)
 
 ## Current state / in-flight
 
-_As of 2026-08-12 — the secrets-broker + stonehenge-park work LANDED (detail in Recent decisions). **wgtunnel** moved OUT to its own repo (pre-seeded, verification done)._
+_As of 2026-08-12 — **eRP dual-seat overhaul LANDED** (both char-rp seats live at 256K, compose-ified); **wgtunnel DEPLOYED** by tunnel-dev + stack mirrored; secrets-broker + stonehenge-park landed. **NEXT PROJECT (operator, queued for the next session): infra setup with additional access.**_
 
-- **⟳ wgtunnel — OWN REPO (`vh/wgtunnel`, private); `/vor-plan` DONE, build underway by `tunnel-dev`.** WireGuard-over-wstunnel WSS/443 tunnel for captive-portal/DPI networks (plane, hotel, DPI firewall); design bundle in the repo's `docs/design/`. Host = **`boring.phasefinal.com`** (innocuous SNI, operator's call). Endpoint verified: `ana-wg` UDP/31337, traefik on ana-docker terminates TLS :443, edge `38.120.12.44`. **Phase-0 DNS DONE 2026-08-12** — `boring` CNAME → `ana-srv1` (DNS-only) published + verified (resolves 38.120.12.44 both authoritative NS + 1.1.1.1); wstunnel ACME can proceed once Unit 1 deploys. infra-ops role = infra + DNS; the build lives in `~/development/wgtunnel` (tunnel-dev's session), not here.
+- **✅ eRP DUAL-SEAT OVERHAUL — DONE + LIVE (2026-08-12).** Two home-quantized NVFP4A16 vLLM seats on ana-ml2 replace the legacy char-rp seats: **`char-rp` :8016 GPU0 = MeroMero-v2-31B** (Gemma-4, non-thinking PROSE, **multimodal/vision**) + **`char-rp-reasoning` :8018 GPU1 = Dark-Scarlett-v1.0-27B** (Qwen3.6, THINKING). Both full **256K** (MeroMero util 0.52 → GPU0 ~4.6 GB free, 2.07×; DS util 0.44, 1.62×). Compose-ified (`stacks/meromero-charrp` + `stacks/darkscarlett-charrp-reasoning`, commit `f08b6cb`) → reboot-durable. Old GGUF/heretic2 seats stopped-but-retained. Full arc + all lessons (wrapper-config fix, vision reconstruction, GPU swap, ModelOpt/SGLang dead-ends) → Recent decisions `[2026-08-12] eRP dual-seat overhaul`. ⚠ OPEN: the LiteLLM granite-retire + `summarizer`/`classifier`→gen repoint is **server-only, NOT version-controlled**; MTP deferred; DS thinks verbosely (needs generous `max_tokens`).
+
+- **⟳ wgtunnel — DEPLOYED + accepted (tunnel-dev).** WG-over-wstunnel WSS/443 for captive-portal/DPI networks. `wgtunnel-wstunnel-1` live on ana-docker (`erebe/wstunnel v10.6.2`, behind traefik, Host `boring.phasefinal.com`, Mode-A `anaprod` cert), `--restrict-to ana-wg:31337` (not an open relay). infra-ops did Phase-0 DNS (`boring` CNAME → `ana-srv1`, DNS-only) + mirrored the stack into eshpfi `stacks/wgtunnel/` (`398b58a`). Full project in `vh/wgtunnel` (tunnel-dev's repo/session).
 
 - **SECRETS-BROKER — LIVE.** Per-box credential store over Vaultwarden; the `secret` CLI (`put/get/list/rm/backfill`) on PATH at `~/.local/bin/secret`, 25 nh3-dev secrets backfilled + verified. Standing directive now global: **vault is the credential source of truth — store in it AND `secret get` creds FROM it.** Detail → Recent decisions `[2026-08-10→12]`.
 
@@ -133,11 +135,13 @@ _As of 2026-08-12 — the secrets-broker + stonehenge-park work LANDED (detail i
 
 **althing monitor** ARMED (handle `infra-ops`, task `b1uat4njl`; herald up). ⚠️ Re-arm ONLY after a real FIRE (`<task-notification> completed rc0`), NEVER after a plain operator turn (bounces rc3); spawn `althing-wake-listener` as its OWN `run_in_background` task, **NEVER chained with `&`/`&&`** (orphans it to init — bit me this session; reclaim with `althing-cli stop-monitor` then re-arm cleanly).
 
-**eshpfi push state:** `origin/main` well behind — this session added the dots.tts arc + the **secrets-broker arc** (`41359ea` CLI, `850a197` backfill, `a249073` rm+warn, `a1304b7` contract note) + dots-tts v3/extract (`a80f6e9`/`62672c9`) on top of prior unpushed work. **Push is the operator's call.** (Dotfiles + stonehenge-park are SEPARATE repos, both pushed this session.) `graphify-out/GRAPH_REPORT.md` churns every commit (ignore); `stacks/heretic2-charrp-reasoning/` UNTRACKED (pre-existing, operator's).
+**eshpfi push state:** `origin/main` well behind — this session added the **eRP dual-seat arc** (`7bd7375` research doc, `f08b6cb` the two char-rp compose stacks), the **wgtunnel mirror** (`398b58a`), memory updates (`a8c6d85`/`69597cb`) — on top of the earlier dots.tts + secrets-broker arcs (still unpushed). **Push is the operator's call.** ⚠ The LiteLLM **granite-retire + `summarizer`/`classifier`→gen** change lives **server-only** on ana-docker (`/opt/docker/conf/litellm/config.yaml` + timestamped `.bak-pre-granite-down-*`), NOT in this repo. `graphify-out/GRAPH_REPORT.md` churns every commit (ignore); `stacks/heretic2-charrp-reasoning/` UNTRACKED (pre-existing, operator's — now superseded by `darkscarlett-charrp-reasoning`).
 
 
 ## Recent decisions
 
+- `[2026-08-12]` **eRP dual-seat overhaul: MeroMero-v2 (`char-rp`) + Dark-Scarlett (`char-rp-reasoning`), both NVFP4A16 @ 256K on ana-ml2; granite retired.** Replaced the GGUF/heretic2 RP seats with two home-quantized vLLM seats. The DS blocker (an `AutoModelForCausalLM` save wrote a flat `Qwen3_5TextConfig` that **both vLLM AND SGLang reject**) was fixed by re-quanting via the `Qwen3_5ForConditionalGeneration` **wrapper class**; ModelOpt was a version deadlock, SGLang lacked the impl (but revealed the fix). MeroMero vision reconstructed by extracting `preprocessor_config.json` from `processor_config.json`. Both models KV-efficient (Gemma-4 sliding-window / Qwen3.6 hybrid linear-attn) → full 256K; GPU-swapped for headroom; compose-ified + committed `f08b6cb`. granite downed + LiteLLM `summarizer`/`classifier`→gen. Full arc, lessons, dead-ends → `persistent-memory.d/2026-08-12-erp-dual-seat-overhaul.md`
+
 - `[2026-08-12]` **infra-ops now holds an all-zones Cloudflare DNS-edit token (vaulted) + wgtunnel Phase-0 DNS landed.** Operator handed over a `Zone·DNS·Edit` (all zones) CF token → `secret put nh3-dev/.config/cloudflare/infra-ops-dns-token` (round-trip verified; /tmp drop shredded). Fleet DNS is now self-serve for infra-ops (⚠ HIGH blast radius — all zones). First use: created `boring.phasefinal.com` CNAME → `ana-srv1.phasefinal.com`, **DNS-only** (proxied:false), verified resolving to 38.120.12.44 on both authoritative NS (louis/wren) + 1.1.1.1 — NOT Cloudflare-proxied. Unblocks wgtunnel's wstunnel ACME cert. phasefinal.com zone id `f812ba74ed9a75cf21bbe7ce9188db50`. auto-memory `reference_infra_ops_cloudflare_dns_token`. (Earlier gap: the only prior vaulted CF token, jackdaw's, had `zone:read`+`worker:edit` but no `dns_records:edit`.)
 
 - `[2026-08-12]` **wgtunnel stood up as its own repo (`vh/wgtunnel`, private) after a live endpoint-verification pass.** Operator directed own-repo (mirrors stonehenge-park/tts-stack). Verified off the fleet before seeding: `ana-wg` WG server = **UDP/31337** (not 51820), subnet 10.30.10.0/24, MTU 1420, active roaming peer proves the public UDP DNAT works; traefik on ana-docker **terminates TLS :443** (ACME `anaprod` http-challenge, docker+file providers, CrowdSec bouncer) → confirms the clean design (wstunnel container on `traefik-net`, Host-routed, WS→UDP to `ana-wg:31337`); edge `38.120.12.44` direct-A, `tunnel.phasefinal.com` free (⚠ must be **direct**, NOT Cloudflare-proxied like vaultwarden). Repo pre-seeded (README/CLAUDE/persistent-memory/ROADMAP + `docs/verified-infrastructure.md` = ground truth) + pushed; commit `9584d38`, Vuong-attributed. vh gitea token pulled from the vault (`secret get`), not persisted to `.git/config`. **NEXT = `/vor-plan` or `/vor` (operator's call, interactive).** Deps to line up in the plan: DNS A-record, FortiGate :443 host-routing, a new ana-wg peer for the laptop, client tooling.