Cached checkpoint repos (pickle weights) are excluded from background picks
like local checkpoint rows: forced-offline validation cannot consult the Hub
security scan and pickles can execute code on load. The worker keeps its
entire bootstrap offline under local-only (base resolution, transformers
activation, security gates, kernel probes and the initial load) and never
pip-installs SSM kernels for a background load; a missing fatal kernel fails
into candidate failover. The offline guard is refcounted so overlapping
local-only requests share one env override restored only when the last
exits, closing the race where one request finishing re-enabled network for
another still running. Snapshot resolution now prefers the newest snapshot
dir, the same selection the inventory scanner surfaces, before consulting
refs/main. MLX loads read config.path so the live-cache rewrite is honored.
Cached non-GGUF rows carry snapshot_size_bytes (the newest snapshot's weight
bytes) and the cascade orders on it instead of the all-revisions blob total,
so a small current revision no longer sinks behind larger candidates.
db64cd2ab4