# Expanded Safe Model Discovery

M8 discovery uses the official Hugging Face provider for live metadata, file inventory and exact
commit resolution. Popularity is a discovery signal only. Each shortlisted candidate records safe
artifact availability, byte size, license capture, runtime expectations, storage/GPU fit and a
typed outcome. Blocked candidates retain unknown quality rather than receiving a synthetic zero.

The bounded shortlist was:

| Candidate | Exact revision | Safe evidence | Outcome |
| --- | --- | --- | --- |
| Qwen3-Embedding-4B | `5cf2132abc99cad020ac570b19d031efec650f2b` | Safetensors, Apache-2.0 metadata, 8,059,503,129 bytes | `discovery_gpu_fit_blocked` |
| BAAI/bge-m3 | `5617a9f61b028005a4858fdac845db406aefb181` | Required weights/heads include `.bin`/`.pt` pickle-risk files | `discovery_security_blocked` |
| multilingual-e5-large-instruct | `274baa43b0e13e37fafa6428dbc7938e62e5c439` | 15 selected safe paths, 11 unique blobs, 1,164,135,840 bytes | fully evaluated |
| multilingual-e5-base | `d128750597153bb5987e10b1c3493a34e5a4502a` | safe Safetensors variant, 1,156,508,130 bytes | preflight only; not selected |

Only E5-large-instruct was downloaded because it passed preflight and was the strongest justified
bounded experiment. E5-base was not downloaded after that choice. Qwen 4B was not forced into VRAM;
BGE-M3 policy was not weakened.