The cluster serves SafeTensor only, so a checkpoint without one cannot be loaded —
and since paid loading is how a non-resident checkpoint generates at all, it cannot
generate either. `covered` must be false for it rather than "covered but never
offered a load", because the model detail page's Create button reads canGenerate.
Scoped to checkpoints, on the view's checkpoint disjunct rather than its shared
EXISTS. Loading is a checkpoint-only feature, and applying the rule to every type
would drop 3,287 covered textual inversions carrying 1.39 billion lifetime
generations — embeddings ship as PickleTensor and are not served by the loader.
`checkLoadable` is scoped the same way for the same reason.
Measured against the production replica, 2026-09-09: covered checkpoints
33,811 -> 31,569, total view rows 933,851 -> 931,609, every row of the delta a
checkpoint. 834 of the 2,242 have generation history (6.5M lifetime, 0.43% of
checkpoint generation); none is offered by the live GenerationCoverage and none
generated in the last month, so applying the migration ahead of any UI is safe.
An allow-list, not the deny-list the shared clause uses: `format` is free text and
frequently unset, so `<> ALL (...)` cannot promise SafeTensor while `= 'SafeTensor'`
is null-safe in the intended direction.
This reverses part of the 2026-09-08 Diffusers ruling for checkpoints only (174
versions); recorded in paid-model-loading-decisions.md as an open question for
Justin rather than left in a migration comment. CoveredCheckpoint returns as a
disjunct — not the conjunct it was — excusing 6 auction-resident checkpoints from
the requirement until the auction is retired.
Refusals now say which of the two reasons applies. The old copy told every
unloadable resource it "runs through an external provider", which is false for a
GGUF checkpoint; the moderator page hardcoded that same wrong string separately.
`no-divergent-safetensor-rule` pins the two halves together: nothing executes the
view (the suite mocks $queryRaw wholesale), so a text guard over the shared literals
and the checkpoint scoping is the enforceable shape. Mutation-probed three ways.
Migration is NOT auto-applied — run it manually where you want it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
briant
2c9957e149