refactor: use a single agent model path

docs/operations.md

@@ -41,12 +41,35 @@ proxy.
 
 Set `DEEPSEEK_API_BASE_URL=https://api.deepseek.com` and place
 `DEEPSEEK_API_KEY` only in the protected deployment `.env`. The key is used
-only by Runtime for the extreme tier and must never be added to a browser,
+only by Runtime for DeepSeek V4 Pro and must never be added to a browser,
 Compose file, image, repository, or log.
 
 The SSH override removes `/var/run/docker.sock` from Gateway and mounts the
 dedicated SSH directory read-only at `/root/.ssh`.
 
+## Ollama model residency
+
+The NAS Ollama service keeps Luna, Terra, and Sol resident with:
+
+- `OLLAMA_KEEP_ALIVE=-1`;
+- `OLLAMA_MAX_LOADED_MODELS=3`;
+- `OLLAMA_NUM_PARALLEL=1`;
+- `OLLAMA_GPU_OVERHEAD=2147483648`;
+- Flash Attention and `q8_0` KV cache enabled.
+
+The three 32K-context runners were measured at approximately 2.88 GB, 4.12 GB,
+and 18.44 GB of GPU allocation respectively. Their combined allocation is
+about 25.44 GB on the 32 GB GPU. Do not increase context size or per-model
+parallelism without repeating the simultaneous-load test and leaving capacity
+for inference overhead.
+
+The persistent Unraid template is
+`/boot/config/plugins/dockerMan/templates-user/my-ollama.xml`. A locked,
+idempotent five-minute check in
+`/boot/config/plugins/dynamix/k1412-ollama.cron` prewarms only missing models
+after a host or container restart. Confirm `/api/ps` lists all three with an
+infinite expiry after recovery.
+
 ## Workspace migration
 
 Before changing execution hosts:
@@ -78,9 +101,9 @@ RUN_DOCKER_INTEGRATION=1 .venv/bin/pytest tests/test_docker_workspace.py
 Production smoke checks must cover:
 
 - anonymous requests are redirected/rejected;
-- an approved user can use Chat;
-- Chat can upgrade to Work but cannot downgrade;
-- Work creates and verifies a real file;
+- an approved user sees exactly four Agent models;
+- each model routes through the custom Agent loop;
+- the Agent creates and verifies a real file;
 - the file browser lists and downloads that file;
 - a second user cannot see it;
 - Gateway health reports `ssh-docker`;