[Lightheartdevs]

Summary

Registered native profiles hardcode q4_0 K/V cache, so choosing f16 currently requires editing runtime code and can invalidate memory assumptions. Add an explicit cacheType: "f16" contract for non-MTP CPU models; omitted or explicit q4_0 retains existing behavior. This is separate from the reasoning-mode fix in #8169 and does not close #8168.

The shared resolver projects cache arguments and admits f16 against complete GGUF metadata and fresh RAM before native startup/restart stops a process. Host activation uses the same admission before snapshots or writes and requires the Windows native host launcher; WSL-owned tasks, containers, macOS and GPU offload refuse. Catalog overrides cannot change its admitted zero-layer/f16 projection. The active context must be a supported decimal value (4096–262144); malformed or out-of-range values refuse before launch preparation can fall back to a smaller registered estimate. Valid CTX_SIZE, MAX_CONTEXT, and registered-default precedence remain aligned with the launcher.

Baseline-only authoring and registration bind artifact hashes, context, argv and cache precision without claiming measured fit. Retained legacy memory qualifications and f16+MTP refuse; the dashboard cannot present incompatible measured proof as verified.

AI Assistance

Codex inspected production paths, implemented the change, wrote regression controls, and reviewed source/test receipts. A local model supplied a partial review; useful claims were checked against full source and reproduced before repair. Maintainer review and physical acceptance remain required.

Release Lane

• Stable hotfix targeting release/2.6.x
• Mainline change targeting main
• Next-minor work targeting the next feature/minor release
• Not sure; reviewer should help classify

Stable hotfix reason: not applicable.

Changed Surface

• Docs only
• Tests only
• Dashboard UI
• Dashboard API / host agent
• Installer / bootstrap / lifecycle
• Docker Compose / service manifests
• Model routing / Hermes / capabilities
• Network exposure / auth / proxy
• Dependencies / runtime wiring

No dependency versions or reasoning flags change; runtime selection and lifecycle admission are the affected surfaces.

Risk And Validation

• Risk level: High (model memory admission and host lifecycle).
• Validation run:
  • git diff --check
  • Markdown/link sanity for docs
  • Focused tests listed below
  • Dashboard lint/test/build
  • Extension audit / compose validation
  • Release-grade fleet or scoped hardware validation
  • Stable-lane patch validation, if targeting release/2.6.x

Commands/results:

python -m pytest -q tests/test_native_cache_contract.py tests/test_model_stores.py tests/test_model_mtp.py tests/test_model_memory.py tests/test_model_activate.py tests/test_wsl_managed_model_activation.py
  731 passed (isolated no-network image; final source hashes match commit)
powershell -NoProfile -File ods/tests/test-windows-model-stores.ps1
  68 passed: actual production start/restart/resolver/argv functions,
  real Windows RAM observation; process effects and runtime --help are inert
Ruff + Python 3.9 syntax + test wiring + build-context pins + diff check: pass
mypy 2.4.0 ratchets: zero new errors (415 existing API / 20 existing scripts)

Initial new controls failed 12/13 before implementation. The review regression additionally reproduces CPU admission followed by GPU planning when backend metadata changes between reads; final controls refuse before snapshots. Positive controls preserve the native zero-layer/f16 projection despite conflicting catalog values. An actual Windows resolver/argv control also reproduced CTX_SIZE=1048576 being estimated at 4096 while argv used 1048576. Final controls reject that mismatch before key writes or stop/start, exercise both context boundaries, and preserve q4 compatibility and read-only stop identity.

The broader earlier run had 1,284 passes and four installer image-pull fixture failures. All four reproduce on unchanged base; two optional macOS qualifier fixture failures also reproduce there. These are retained limitations, not claimed passes; no baseline or assertion was weakened. Full hosted CI remains required.

Operational Change Check

• This is not an operational change.
• This is an operational change and validation is recorded above.
• This is an operational change and validation is intentionally deferred for: exact-package physical CPU generation and lifecycle qualification. Keep this PR draft until that evidence and hosted CI are reviewed. The existing f16 diagnostic used edited fixture source and did not meet its complete-response oracle; it is not acceptance for this PR.

Notes For Reviewers

Review head e30d5861aaf0627d4ec51323ad6b7f4dfd844b4b, based on 7f5c6c2232c86e2a8ce28d43855a651315aa9f86.

F16 support is limited to recognized dense CPU layouts, zero GPU layers, no projector and no MTP. GPU/Metal, hybrid layouts and measured f16 qualification are deferred. Capacity is the smaller of fresh available RAM and the existing CPU selector budget; it is an estimate, not a reservation, and gives no credit for stopping the current model.

No installed model/profile is migrated automatically. Before reverting code on an installation that opted into f16, stop its owned runtime and restore its previously qualified q4 profile/configuration; do not leave a new f16 row to an older reader that ignores it. No live activation, fleet acceptance or universal quality improvement is claimed here.