The Stack Report: Your Chosen Reviewers Got A French Address, And A Root Certificate Went Bad

The models you already picked, now hosted in France

Two models you settled on in the last month are now available on a cloud account you already have. On Thursday, Scaleway added DeepSeek V4.1 Flash and GLM 5.3 to its serverless Generative APIs. DeepSeek V4.1 Flash, with thinking off, is the editorial reviewer that T026 put first in September, and contentbuilder now recommends it as the review seat. GLM 5.3 is the paid third-family seat that exp 092 renewed for the final review panel. Until last week, using either one meant sending text to a provider outside the EU.

It is Wednesday, 21 October, a week to the day since the last one.

In August this show offered you an EU lane for a model you had not chosen yet. This week runs the other way. You made the choice first, by measurement, and now the lane exists. Your rule says EU when equal, and for the first time it has something to compare.

In the same week Scaleway added per-project rate limits and daily and monthly token budgets per user. That covers the first rule of Subprotocol S1: a hard cap set the moment you find a lane, enforced by the provider so you do not have to remember it. The setup would be one Scaleway project just for model seats, with its own scoped key the way podop got one, and a monthly ceiling.

Two things to settle before anything moves:

• Same model, same results? A second host serving the same model is a claim until you test it. Hosts quantize and template differently. Run the T026 twelve-text corpus through Scaleway's DeepSeek and compare against the scores you already have.
• Price. I have no Scaleway price for either model. DeepSeek direct is very cheap and has off-peak discounts, so EU hosting could cost several times more. Stats is your only pricing authority, so the new provider needs price rows in Stats before its first call. Without them, every call lands unpriced.

That is one session: a scoped key, the corpus rerun, and the price rows.

Traces from inside the Claude SDK

On the 14th, Anthropic launched OpenTelemetry export in beta. The Claude SDK now emits trace spans for API requests, in Python and six other languages. Popcorn2 already has the collector, the canonical guide and a gen_ai row in the telemetry register. What is missing is timing for each model call, unless every service builds its own. Ask PärKit, Capture's categorizer and the Builder all call Claude through the SDK. With this turned on, each Claude call would appear in the same trace as the request that triggered it, so you could see which call was slow and which one retried.

One caution, in Director's own words: telemetry can copy secrets across a trust boundary. Before turning it on, find out whether the spans carry prompt text, because Capture's prompts are your inbox. This also does not replace apilog. Apilog tracks money; this tracks time. Start with Ask, because it is the smallest. That is a session.

Image generation in the runtime you already run

MLX-VLM 0.7.9 added Flux-3 image generation and editing, plus a second image model, MOSS-Image-SFT. Today an image on disk means Recraft, fal, or podop renting a pod for Forge. Pargrafik uses the slash recraft command when code is not enough. If Flux-3 runs acceptably on the M5, some of that becomes free and local. Editing is the more interesting half, because you could fix an image you already have instead of regenerating it.

Three things are unknown: whether it fits in 32 GB, how fast it is, and whether its licence allows printing the results in Årebladet. As always, the weights wait for your yes.

The test: regenerate three assets you already made with Recraft and put both versions on a quickcheck page. That takes an afternoon. The same release fixes precision mismatches against MLX 0.32.4, so upgrade the two together. Storyteller already wrote that down as a rule.

Two corrections to last week

Last week's lead was EmbeddingGemma 2 in MLX-VLM 0.7.8. This week's 0.7.9 fixes how its processors read images, which means 0.7.8 had been computing image embeddings from wrongly arranged pixels. If you had run the ten-search test I suggested, the image side would have lost and you would have blamed the model. Nobody ran it, and on Monday Imagebook was parked anyway. When the test does run, 0.7.9 is the minimum version.

On Capture, Cohort D shipped on the 17th as a detector, and the local-decider comparison I kept pushing is filed as an arm in Capture's todo list, not yet run. That is where it belongs.

Two for voicelab and parocr

Transformers 5.20 adds MOSS-Transcribe-Diarize, a 0.9-billion-parameter model that does transcription, speaker labels and timestamps in a single pass, with hotword biasing and more than 50 languages. Ordagrant has just made KB the default after the Byevägen verdict of 14 out of 15, so a general multilingual model is unlikely to beat KB on Swedish words. The useful question is narrower. Does it label speakers better than ordagrant's separate diarization pass, and does hotword biasing fix names? File it in voicelab next to the Nemotron diarizer from two weeks ago, and run it on the same interview fixture.

The same release adds UnlimitedOcr from Baidu. It is a 3-billion-parameter model built on DeepSeek OCR, reads dozens of pages in one pass and returns region boxes. Parocr's compare mode exists to put a new engine next to the others. It is a Transformers port, and I have seen no MLX version. Adding it to parocr is a session.

Heads up

Root certificate compromise. An intermediate certificate under one of eMudhra's root authorities was compromised. uv 0.13.4 ships updated root certificates, FastMCP now requires a certifi release from 19 October or later, and FastMCP's own notice says that upgrading the library alone is not enough. It touches your estate in three places:

• This show's own fetcher. It pins certifi's bundle, because the standalone Python that uv installs has no system roots. Autocast trusts exactly what its locked certifi says.
• Every Python service. Each one locks its own certifi, and floor ships only the committed tree, so the fix is a commit in each repo.
• Popcorn2's container images. They carry their base image's certificate store, which changes only when the mirrored base image is updated.

The realistic risk to you is low, because exploiting this takes a targeted interception. Still, it is a sweep across the estate, not a single fix.

FastMCP, and a correction. Last week I said stay on 3.4.8. Since then there have been three releases on the 3 line:

• 3.4.9 limits how long regex tool search can run.
• 3.4.10 checks authorization after transforms, and stops a denied resource from being served through a matching template.
• 3.4.11 is the certificate pin.

Stay on the 3 line, at 3.4.11. The issuer binding in 4.1.2 belongs in the notes PärMCP keeps for its version 4 evaluation.

FastAPI shipped 24 releases in seven days, and about ten of them change behaviour:

• Unknown arguments now fail at startup. Passing an unknown argument to a query or path parameter is an error at import, so a service still using an old argument will not boot.
• Omitted checkboxes now read as false.
• Empty fields in form models now count as missing.
• Empty file pickers now count as missing.
• An explicit null no longer gets you the default value.

Most of these hit HTML forms, which means Deadline's booking pages and PartyPär's admin. Lockfiles keep you safe until someone refreshes them, and that is where the certificate sweep comes in. When you refresh certifi, refresh it alone. A blanket upgrade of everything would drag FastAPI across all ten changes at once, and Deadline is vital.

Xcode 27.1 is final. Last week I said to wait for the final release. The PärKit iOS tooling-currency burn item was put back as blocked because no newer stable Xcode existed. Codexburn remembers blocked items and skips them until someone edits the item, so the queue will never notice that 27.1 arrived. One edit to that item fixes it. Swift 6.4.1 shipped the same day.

The rest, briefly

• Codex 0.163 lets you steer a response while it is still being written, runs read-only lookups in parallel, and adds a searchable settings panel. Since you open Codex directly, steering is the change you will notice.
• MLX 0.32.4 fixes two GPU deadlocks, which matters for ordagrant's unmeasured memory soak. It also adds Python 3.15. Ordagrant's version cap stays until the rest of its stack catches up.
• ElevenLabs added audio effects to speech and dialogue, including reverb, distance, a looped background noise and stereo panning, at no extra cost. Your ElevenLabs credits expire every month, so if a series ever wants a voice that sounds like it is on the phone, this costs you nothing.
• OpenAI wired its Decisions interface into live voice sessions and added voices designed from a text description. That fits the two-way voice idea in your ideas file, not anything you are building this month.
• Not for you:
  • PostgreSQL 19: at release candidate stage, with general availability on 19 November. Popcorn2 runs 18.6, so there is no reason to chase it.
  • Astro 7.4: parallel prerendering and build timings, and your sites are Hugo.
  • Scaleway: the new client-address header for serverless containers. Popcorn2 is an instance.
  • Anthropic: Opus fast mode leaving preview.

If you look at one thing

Run Scaleway's DeepSeek through the T026 corpus. If the scores hold and the price is sane, the reviewer you already chose gets an EU address and a hard budget.