Studio diffusion (Phase 9) review round 2: correct prequant allowlist doc

Codex review: the transformer_prequant_path field description still told operators
to enable local checkpoints with UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH=1, but the
prior security fix made that variable a directory allowlist -- _allowed_prequant_roots
deliberately drops bare on/off toggle tokens (1/true/yes/...). An operator
following the documented =1 would have every transformer_prequant_path request
silently refused. The description now states it must name one or more allowlisted
directories and that a bare on/off value is not accepted.

Test: asserts the field help references UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH, does
not say =1, and describes an allowlist/directory (guards against doc drift).

studio/backend/models/inference.py

@@ -1746,7 +1746,10 @@ class DiffusionLoadRequest(BaseModel):
         "GPU (~half the load VRAM and a smaller download). null uses the family's hosted "
         "checkpoint if configured, else quantises the dense transformer at load time. "
         "Loading a local path unpickles the file (arbitrary code execution), so it is "
-        "ignored unless the operator sets UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH=1.",
+        "ignored unless the path resolves inside a directory the operator allowlisted "
+        "via UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH (one or more directories, separated by "
+        "the OS path separator). A bare on/off value such as '1' is deliberately not "
+        "accepted -- it must name an allowed directory.",
     )
 
 

studio/backend/tests/test_diffusion_routes.py

@@ -359,6 +359,19 @@ def test_transformer_prequant_path_threads_through(client, monkeypatch):
     assert backend.last_load_kwargs.get("transformer_prequant_path") == "/data/zimage_fp8.pt"
 
 
+def test_prequant_path_doc_describes_allowlist_not_toggle():
+    # The field help must match the code: UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH is a
+    # directory allowlist, not a =1 toggle (diffusion_prequant._allowed_prequant_roots
+    # drops bare on/off tokens), so operators following the doc don't get every
+    # request silently refused.
+    from models.inference import DiffusionLoadRequest
+
+    desc = DiffusionLoadRequest.model_fields["transformer_prequant_path"].description
+    assert "UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH" in desc
+    assert "=1" not in desc
+    assert "allowlist" in desc.lower() or "director" in desc.lower()
+
+
 def test_invalid_transformer_quant_returns_422_without_eviction(client):
     # An unsupported transformer_quant is rejected by the request schema (Literal), so
     # the GPU is never acquired and no chat model is evicted.