fix(webui): print the checkpoint's real name as its display name

[inureyes]

Part of epic #1910.

Summary

• identity.display_name is now the model's inference id with no character rewriting. The catalog no longer turns - and _ into spaces. Cache and preset entries keep their full name (mlx-community/Qwen3-4B-4bit), models-dir entries keep the directory name, and single-model entries keep the last / segment of the served id, as the issue decided. qwen3-0.6b-4bit and qwen3_0.6b_4bit are two distinct rows again. Every surface that prints display_name (library row, inspector heading, toolbar pill, Chat and Activity selectors, operation titles, settings selectors, dialogs) now shows the name passed to -m and the API. The Rust change is the display_name helper in src/server/webui/catalog_metadata.rs and its two call sites.
• ModelIdentity.display_name.maxLength in docs/webui/api.yaml goes from 128 to 256 to match inference_id, because a cache owner/name can be 193 characters. The field's new description gives the rule for each source. schema_version stays webui.ui-api.v1, and the generated ui-api.d.ts is unchanged.
• The delete dialog still accepts only identity.id as its token, and the fence test is byte-identical to main. The body now says to type the model ID shown below, not the model name. The field label reads "Opaque model ID shown above (starts with mdl_)" in English and "위에 표시된 모델 ID (mdl_로 시작)" in Korean. The tests/fixtures/webui/strings.json copies of both strings, which had drifted, now match strings.ts.
• Long ids wrap. The dialog body paragraph and the model names listed in the capacity-recovery dialog now carry models-wrap, like the id already did. Without it, a verbatim underscore name has no break point: at 390px the capacity dialog measured scrollWidth 523 against clientWidth 356.
• Fixtures and tests that used space-separated names now use hyphenated ids. That includes identity-collision.json, which still collides on inference_id, and the performance fixtures and specs. The models.long_name gallery string is now a long hyphenated id, the same in en and ko. docs/webui/catalog.md and docs/webui/catalog.ko.md describe the new meaning. The committed bundle is regenerated.

Premises checked

• Search already found the real name before this change: inventory() and the server q filter both match inference_id, which already held qwen3-0.6b-4bit. What changes is that the matched row now prints that name.
• The issue expected a trailing / to fall back to the whole name through the existing unwrap_or(name), but it never did. "x/".rsplit('/').next() is Some(""), so the old helper returned an empty string. The new helper skips the empty segment, and the test covers that case.
• The issue did not say how to treat presets; this PR keeps their names whole. A preset's inference id is its section name (config.model_alias = name), and an overlay-only preset takes over a cache owner/name, which the last-segment rule would shorten.
• Single-model mode keeps the last-segment rule, as the issue specified. The id there is either --alias or the checkpoint directory's file_name(), never a path, so the rule only changes an alias that contains / (for example --alias Qwen/Qwen3-8B displays as Qwen3-8B). The docs and the api.yaml description say so. Showing the alias whole would be a one-line change if that is preferred.

Changes during review

• Implementation review: the capacity-dialog list items got the wrap class. The capacity-recovery unit test now checks the listed names and the class, and fails without them.
• Implementation review: the api.yaml description and both catalog docs now give the rule for each source. The earlier wording said "verbatim" everywhere, which is not true for single-model aliases. The Korean confirm label dropped "불투명", a word Settings already uses for the visual Opaque material.
• Security and performance review: performance.spec.ts searched the 1000-entry catalog for '0999', which only matched the old padded label, so the WebUI bundle engine smoke timed out on every engine. It now searches for perf-model-999. The review found no injection or path exposure: names render as React text or escaped attributes, and display_name is always equal to inference_id or a substring of it. The delete fence still requires the exact id and revision.

Revert-and-fail

With the catalog_metadata.rs change alone reverse-applied, the new contract test fails:

test server::webui::catalog::tests::catalog_contract_tests::display_name_is_the_inference_id_verbatim ... FAILED
panicked at src/server/webui/catalog_contract_tests.rs:543:5:
assertion `left == right` failed
  left: [("Meta-Llama-3.1-8B-Instruct_4bit", "Meta Llama 3.1 8B Instruct 4bit"), ("mlx-community/Qwen3-4B-4bit", "Qwen3 4B 4bit"), ("qwen3-0.6b-4bit", "qwen3 0.6b 4bit"), ("qwen3_0.6b_4bit", "qwen3 0.6b 4bit"), ("team/qwen3-preset", "qwen3 preset")]
 right: [("Meta-Llama-3.1-8B-Instruct_4bit", "Meta-Llama-3.1-8B-Instruct_4bit"), ("mlx-community/Qwen3-4B-4bit", "mlx-community/Qwen3-4B-4bit"), ("qwen3-0.6b-4bit", "qwen3-0.6b-4bit"), ("qwen3_0.6b_4bit", "qwen3_0.6b_4bit"), ("team/qwen3-preset", "team/qwen3-preset")]
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 8596 filtered out

With the patch re-applied, all 34 catalog tests pass. The check was run twice, once by the implementer and once independently. The frontend check was done the same way. Reverting api.yaml, strings.ts and dialogs.tsx makes the new 193-character schema-bound test and the delete-dialog wording test fail. Removing the capacity-list wrap class makes the capacity-recovery test fail.

Test plan

This branch is rebased onto origin/main at fd33ff1, which includes #1921 (catalog backend column) and #1922 (i18n catalog consolidation). The committed bundle was rebuilt by build_bundle.py at each rebased commit rather than merged by hand. One rebase conflict needed both sides: the performance spec's Chat option now reads perf-model-0 · Ready, combining this PR's name with #1922's localized state label. No test or fixture added by #1922 uses a space-separated model name. Results on the rebased head:

• cargo test --profile test-fast --features metal,accelerate -p mlxcel --lib server::webui: 78 passed, 0 failed, including display_name_is_the_inference_id_verbatim
• cargo clippy -p mlxcel --lib --tests --features metal,accelerate -- -D warnings and cargo fmt --all -- --check: clean
• pnpm --dir webui run typecheck and eslint: clean
• pnpm --dir webui run unit: node 18/18, vitest 340/340 in 39 files
• Playwright chromium default suite: 30/30. Engines config (engines.spec.ts and performance.spec.ts), chromium: 7/7. All runs used a private port with --strictPort, never the preview server shared with other worktrees
• check_webui_contract.py (49 fixtures), build_bundle.py --verify, check_binary_assets.py, check_cross_repo_refs.py: pass

Before the rebase, the same gates also passed server::router_server (63 passed, 1 ignored) and the engines config in firefox (7/7).

Real-binary acceptance

The orchestrator built mlxcel-server from 3082e1d, the pre-rebase head carrying the same change (--profile test-fast --features metal,accelerate), and ran it with --webui --models-dir models/mlx --no-models-autoload against the real checkpoint store and the default managed cache. I drove the bundled WebUI in Chromium at 1440px with a read-only Playwright script that aborts any load, unload, download, delete or refresh request. It recorded no mutating request.

• Hyphenated models-dir entry: qwen3-0.6b-4bit prints as qwen3-0.6b-4bit in the library row, the inspector heading and the toolbar pill (qwen3-0.6b-4bit · Unloaded).
• Underscored models-dir entry: stablelm-2-1_6b-chat-4bit prints unchanged in the same three places.
• Cache entry: mlx-community/Qwen3-0.6B-4bit prints as the full owner/name in the row, the inspector heading and the pill. It also appears as mlx-community/Qwen3-0.6B-4bit · unloaded in the Chat "Model for next turn" picker and as mlx-community/Qwen3-0.6B-4bit in the Activity selector (225 options).
• Search: qwen3-0.6b-4bit returns the qwen3-0.6b-4bit row, plus mlx-community/Qwen3-0.6B-4bit, which contains the same text in a case-insensitive match. qwen3_0.6b_4bit returns no rows ("No matching local models").
• Delete dialog, opened on the cache entry and cancelled without typing: the body ends "To confirm, type the model ID shown below, not the model name.", the mdl_ id is printed below it, the field label reads "Opaque model ID shown above (starts with mdl_)", and Confirm stays disabled while the field is empty. The long cache name wraps inside the dialog.

Merge with main and CI

• origin/main 5616f86 (refactor(webui): adopt every shared @lablup/ui-common component #1924, ui-common components) was merged into this branch as 7e40c01 by the epic epic: make the bundled WebUI usable, on the shared ui-common foundation #1910 orchestrator. Only the generated bundle conflicted; it was regenerated with scripts/webui/build_bundle.py (--verify digest 711cbf2a) and not hand-merged. On the merged tree: typecheck, eslint, unit (Vitest 362 in 47 files), and Chromium Playwright on a private port (models, ui-common-shell, ui-common-components, browser, chat, activity, settings: 56 passed) all pass. The merged Rust tree was checked earlier: server::webui 78 passed, models::registry 10 passed.
• The GB10 WebUI installed artifact job's Activity performance gate reported investigate on four consecutive attempts at the pre-merge heads while every other step passed: two-visible median decode degradation -0.35 (baseline CV 5.63), +0.20 (CV 5.45), +2.74 (CV 3.38), and one-visible +3.38 (CV 4.22). The gate flags a median above 2 percent or a baseline CV above 5 percent over five pairs. On the same runner, main after refactor(webui): key screen copy in the catalog and drop window.confirm #1922 failed the same gate (two-visible -6.76, CV 7.45) and passed on rerun, and fix(server): record streamed chat completions in Metrics #1919 failed it once (+3.19) and passed on its next head. This change only alters the catalog label string and a few UI strings, which do not touch decode or the Activity polling path, so these are read as runner noise. Per the maintainer's decision for this epic, the PR merges with this evidence recorded rather than with the gate relaxed; stabilizing the gate is tracked in ci(webui): the Activity performance gate fails on runner noise #1925.

Closes #1912

[inureyes]

Implementation Review Summary

Intent

identity.display_name is the inference id verbatim on every WebUI surface, with the delete dialog wording pointing at the opaque model ID.

Findings Addressed

• Capacity recovery dialog listed loaded models in <li> items with no wrap rule. Verbatim underscore names have no break points, so at 390px the modal scrolled sideways (Chromium: dialog scrollWidth 523 vs clientWidth 356). The items now carry models-wrap (356 vs 356), the capacity unit test asserts it and fails without it, and the bundle is rebuilt. Commit 69b3ba7. (HIGH)

Remaining Items

• Single-model mode with a / in --alias (for example --alias Qwen/Qwen3-8B) still prints only Qwen3-8B, while the new api.yaml description says the field is the inference id verbatim. Single-model inference ids are --alias or the checkpoint basename, never a path, so the last-segment rule only ever strips an operator-chosen owner. Left as is because the issue and the brief keep that rule; either make SingleModel verbatim or qualify the description. (MEDIUM)
• Korean confirm label 위에 표시된 불투명 모델 ID (mdl_로 시작): 불투명 is already the Settings translation of the visual "Opaque" material, so it reads oddly for an identifier. 위에 표시된 모델 ID (mdl_로 시작) is clearer. Left because it is wording only and strings.json is shared with refactor(webui): move every user-facing string into the i18n catalog and remove native confirm dialogs #1913. (LOW)

Verification

• All stated requirements implemented (real-binary acceptance still pending orchestrator verification)
• No placeholder/mock code remaining
• Integrated into project code flow
• Project conventions followed
• Existing modules reused where applicable
• No unintended structural changes
• Tests pass

Also checked: no client code rewrites names; the preset rule matches model_alias = name in router_models.rs; the fence test is byte-identical to main; the catalog_metadata.rs diff is only the helper and its two call sites. After the fix: typecheck, eslint, unit (node 18/18, vitest 319/319), build_bundle.py --verify, check_binary_assets.py, the contract check, and Playwright models.spec.ts 3/3 all pass.

[inureyes]

Security and performance review of f6a1db7. One fix pushed in 3082e1d.

Fixed (HIGH, merge-blocking): webui/tests/performance.spec.ts:332 searched the 1000-entry catalog for 0999, which only matched the old padded label. After the fixture rename to perf-model-${index} it matched no row, and the WebUI bundle job failed that test on chromium, firefox and webkit-headed-performance on every retry. It now searches perf-model-999. Locally on chromium all four performance tests pass (search-to-paint 14.4 ms, budget 100 ms).

Checked, no finding:

• Injection: every display_name sink is React text or a React-set attribute (aria-label, toolbar title, option labels). Neither webui/src nor @lablup/ui-common uses dangerouslySetInnerHTML or innerHTML, and t() interpolates through a replacer function. A browser probe rendered a markup-shaped name as literal text.
• Paths: display_name never carries more than inference_id in the same object. Models-dir names come from file_name(); single-model ids from file_name() or the operator's alias.
• Delete fence: still token === identity.id plus instance and revision checks. The fence test is unchanged and passes.
• Length: display_name is schema-valid exactly when inference_id is, so 256 adds no new rejection and removes the old one for 129-255 character directory names. A 256-character unbroken name at 390 and 1440 px caused no horizontal scroll in the library, inspector, delete dialog, Chat, Activity or Settings. Without models-wrap the dialog body overflows, so the class is load-bearing.

Left (pre-existing, out of scope): operator-supplied names are not bidi-isolated, so U+202E can reorder the rest of the delete sentence (the id fence still holds). One inference id over 256 code points still rejects the whole catalog page.

WebUI installed artifact failed at link time on the self-hosted runner's shared target (undefined reference in a stale rlib), unrelated to this diff.