feat(summarizer): move local fallback off koala to iguana/gemma4-26b

koala now carries other GPU loads, so the first fallback should not run there.
Change the default chain to koala/phi4-mini → iguana/gemma4-26b → berget/mistral-small:
the local fallback now runs on iguana (M2 Ultra headroom, different host = different
egress IP for the rare fallback fetch). gemma4-26b is the brain-validated homelab
general-purpose model (agentsquad H2/H3 executor) and returned valid summary JSON on
the real prompt in a smoke test (~37s incl. cold-load — fine for a fallback path).

Pure config default (TAPIR_FALLBACK_MODEL); chain mechanism (ADR-022) unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -827,10 +827,18 @@ The fix is resilience around it, not replacing it.
 **Decision.**
 1. **Ordered endpoint chain (`summarizer.NewChain`).** Endpoints are tried in order; the first to
    return a *parseable* summary wins. Default chain:
-   `koala/phi4-mini` (primary, local) → `koala/phi4-14b` (fallback, local) →
-   `berget/mistral-small` (worst-case, external). All three are reached through the **one** LiteLLM
-   gateway by alias — the gateway already fronts both llama-swap and berget — so a fallback is a
-   different alias, not a second client config.
+   `koala/phi4-mini` (primary, local) → `iguana/gemma4-26b` (fallback, local on a
+   *different host*) → `berget/mistral-small` (worst-case, external). All three are reached through
+   the **one** LiteLLM gateway by alias — the gateway already fronts both llama-swap and berget — so
+   a fallback is a different alias, not a second client config.
+
+   **Update 2026-06-11:** the local fallback moved from `koala/phi4-14b` to `iguana/gemma4-26b`.
+   koala now carries other GPU loads, so keeping the fallback on koala competed with them; iguana
+   (M2 Ultra) has the headroom, and a different host is also a different egress IP for the rare
+   fallback fetch. `gemma4-26b` is the brain-validated homelab general-purpose model (agentsquad
+   H2/H3 executor) and returned valid summary JSON on the real prompt in a smoke test
+   (~37s incl. cold-load — fine for a path hit only when the fast primary fails). Pure config:
+   `TAPIR_FALLBACK_MODEL`.
 2. **A parse failure advances the chain, same as a transport error.** "Reliably summarized" means
    *parseable summary returned*, not *HTTP 200*. This is the behaviour the old Primary→Fallback
    shape missed.

docs/homelab-integration.md

@@ -30,7 +30,9 @@ it** — endpoints and aliases drift, and this file is a snapshot (2026-06-06),
 - **Summarizer fallback chain (ADR-022).** The primary alias is the *first* of an ordered chain;
   on failure or unparseable output the summarizer advances to the next model. All reached through
   the same gateway by alias.
-  - `TAPIR_FALLBACK_MODEL` — local fallback. **Default `koala/phi4-14b`.** Empty disables it.
+  - `TAPIR_FALLBACK_MODEL` — local fallback. **Default `iguana/gemma4-26b`** — on iguana, NOT
+    koala, so the fallback does not compete with koala's other GPU loads (and runs from a different
+    egress IP). Empty disables it.
   - `TAPIR_CLOUD_FALLBACK_MODEL` — worst-case EXTERNAL fallback. **Default `berget/mistral-small`.**
     **Set this empty (`""`) for any client/NDA deployment** so content never leaves the local
     stack — the chain then contains only local endpoints.

internal/adapters/store/store_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"path/filepath"
 	"testing"
 
 	embeddedpostgres "github.com/fergusstrange/embedded-postgres"
@@ -24,11 +25,22 @@ var _ ports.Sink = (*store.Store)(nil)
 var dsn string
 
 func TestMain(m *testing.M) {
-	const port = 54329
+	// Port + runtime/data dirs are per-process (PID-derived) so two concurrent
+	// `go test` invocations — e.g. a push-run and a tag-run firing together in CI —
+	// don't collide on a fixed port or a shared data dir (which silently failed
+	// both runs). CachePath is shared so the PG archive is downloaded once, not
+	// per process. Base 54000 keeps this package's range distinct from web's.
+	port := uint32(54000 + os.Getpid()%1000)
 	dsn = fmt.Sprintf("postgres://postgres:postgres@localhost:%d/postgres?sslmode=disable", port)
 
+	rt := filepath.Join(os.TempDir(), fmt.Sprintf("tapir-epg-store-%d", os.Getpid()))
 	pg := embeddedpostgres.NewDatabase(
-		embeddedpostgres.DefaultConfig().Port(port),
+		embeddedpostgres.DefaultConfig().
+			Port(port).
+			RuntimePath(rt).
+			DataPath(filepath.Join(rt, "data")).
+			BinariesPath(filepath.Join(rt, "bin")).
+			CachePath(filepath.Join(os.TempDir(), "tapir-epg-cache")),
 	)
 	if err := pg.Start(); err != nil {
 		fmt.Fprintf(os.Stderr, "embedded-postgres start: %v\n", err)
@@ -40,6 +52,7 @@ func TestMain(m *testing.M) {
 	if err := pg.Stop(); err != nil {
 		fmt.Fprintf(os.Stderr, "embedded-postgres stop: %v\n", err)
 	}
+	_ = os.RemoveAll(rt)
 	os.Exit(code)
 }
 

internal/config/config.go

@@ -33,7 +33,10 @@ type Config struct {
 	SummarizerModel string
 	// FallbackModel is the LOCAL fallback alias tried when the primary fails or
 	// returns unparseable output (ADR-022). Kept local so content stays on the
-	// homelab stack. Empty disables it. Default a bigger-context local model.
+	// homelab stack. Default is an IGUANA model (not koala) so the fallback runs
+	// on a different host than the koala primary — koala carries other loads, and
+	// a different host also means a different egress IP for the (rare) fallback.
+	// Empty disables it.
 	FallbackModel string
 	// CloudFallbackModel is the worst-case EXTERNAL fallback alias, tried only
 	// after every local endpoint has failed (ADR-022). For client deployments set
@@ -148,7 +151,7 @@ func (c Config) DexConfigured() bool { return strings.TrimSpace(c.OIDCIssuer) !=
 const (
 	defaultGatewayURL            = "http://koala:30401/v1"
 	defaultSummarizerModel       = "koala/phi4-mini"
-	defaultFallbackModel         = "koala/phi4-14b"
+	defaultFallbackModel         = "iguana/gemma4-26b"
 	defaultCloudFallbackModel    = "berget/mistral-small"
 	defaultSummaryMaxTokens      = 1500
 	defaultMaxTranscriptChars    = 18000

internal/web/handlers_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -26,10 +27,22 @@ import (
 var dsn string
 
 func TestMain(m *testing.M) {
-	const port = 54330 // distinct from the store package's embedded PG (54329)
+	// Per-process port + dirs so concurrent `go test` runs (e.g. a push-run and a
+	// tag-run in CI) never collide on a fixed port or shared data dir. Base 55000
+	// keeps web's range distinct from the store package (54000). Shared CachePath
+	// downloads the PG archive once.
+	port := uint32(55000 + os.Getpid()%1000)
 	dsn = fmt.Sprintf("postgres://postgres:postgres@localhost:%d/postgres?sslmode=disable", port)
 
-	pg := embeddedpostgres.NewDatabase(embeddedpostgres.DefaultConfig().Port(port))
+	rt := filepath.Join(os.TempDir(), fmt.Sprintf("tapir-epg-web-%d", os.Getpid()))
+	pg := embeddedpostgres.NewDatabase(
+		embeddedpostgres.DefaultConfig().
+			Port(port).
+			RuntimePath(rt).
+			DataPath(filepath.Join(rt, "data")).
+			BinariesPath(filepath.Join(rt, "bin")).
+			CachePath(filepath.Join(os.TempDir(), "tapir-epg-cache")),
+	)
 	if err := pg.Start(); err != nil {
 		fmt.Fprintf(os.Stderr, "embedded-postgres start: %v\n", err)
 		os.Exit(1)
@@ -38,6 +51,7 @@ func TestMain(m *testing.M) {
 	if err := pg.Stop(); err != nil {
 		fmt.Fprintf(os.Stderr, "embedded-postgres stop: %v\n", err)
 	}
+	_ = os.RemoveAll(rt)
 	os.Exit(code)
 }