Twelve P1 findings from round 26 reviewer aggregate, plus the CI
revert of round 25 P1 #5 to a less invasive location.
1. requirements/studio.txt + requirements/single-env/constraints.txt:
revert the round 25 huggingface-hub bump (broke Studio Update CI,
Mac Studio Update CI, Mac Studio UI CI, Studio UI CI all with
ResolutionImpossible against transformers==4.57.6 which requires
hub<1.0). Standard install path stays on the well-tested 4.57.6 +
0.36.2 + trl 0.23.1 trio.
2. requirements/no-torch-runtime.txt + pyproject.toml
[huggingfacenotorch]: bump huggingface_hub floor from >=0.34.0 to
>=1.3.0,<2.0 -- this is where the actual transformers 5.x +
hub 0.36.2 broken combo can land because the file installs
--no-deps. transformers 5.x calls hub.is_offline_mode which only
exists in hub 1.x.
3. utils/datasets/llm_assist.py: revert round 25 P1 #4 (helper/advisor
sharing the global llama backend) which introduced three
regressions: a chat-evict load race after the busy precheck, a
finally-block that could unload a user chat model, and an
identifier mismatch the delete guard could not canonicalize. Go
back to PRIVATE LlamaCppBackend instances and expose the active
helper/advisor repos through a new thread-safe registry
(helper_advisor_owns_repo / _register_helper_advisor_repo /
_unregister_helper_advisor_repo) so DELETE /api/models/delete-cached
can still block the rmtree.
4. routes/models.py delete_cached_model: check the new helper/advisor
registry up front and 409 if a helper/advisor still owns the
target repo. Closes round 26 P1 #13 and #14 (helper/advisor
identifiers were prefixed and would never equal the raw repo id).
5. routes/models.py get_lora_base_model: validate lora_path with
_validate_logged_identifier before it is reflected in 404 detail
and error logs (round 26 P1 #12).
6. routes/inference.py /unload: round 21 P1 #3 added a "or not
is_loaded" fallback that let an unload of owner/B cancel a pending
llama load of owner/A. Replace it with a narrow
llama_is_starting_without_identifier branch that only fires when
llama-server is mid-startup with neither identifier set (round 26
P1 #5).
7. routes/inference.py /unload: poll loading_model_identifier for up
to 5 s after asyncio.to_thread(unload_model) so a legitimate
pending-load cancel does not 503 because the load thread has not
yet observed _cancel_event in its finally (round 26 P2 #15).
8. models/training.py TrainingStartRequest: extend identifier
hardening to hf_dataset, subset, train_split, eval_split. Round 22
only guarded model_name (round 26 P1 #10).
9. models/data_recipe.py SeedInspectRequest: add _no_control_chars +
_reject_embedded_hf_token field_validators on dataset_name (round
26 P1 #11).
Tests: 105 targeted (diffusion + cached_gguf + llama_cpp_cache +
inference_model_validation + models_get_model_config) and 1768
broader backend tests pass locally. Pre-existing
test_desktop_auth.py, test_studio_api.py, and
test_training_worker_flash_attn.py failures reproduce on HEAD
without these changes.
65ea3a2c81