@zerwiz/ymir 0.1.26 → 0.1.28

package/docs/fixes/agents/unversioned-2026-09-17-every-figure-loads-the-agent-directory-was-never-read.md

@@ -0,0 +1,25 @@
+## agents · unversioned · 2026-09-17 — every figure loads: the agent directory was never read
+
+### Why
+- **The bug, stated plainly.** Twenty agent profiles existed, twenty symlinks
+  pointed at them, and every gate was green — yet OpenCode loaded **three**
+  agents. The symlinks lived in `.opencode/agent/` (SINGULAR). OpenCode reads
+  `.opencode/agents/` (PLURAL). Twenty correct links sat in a directory no loader
+  opened, so only `brokk` and `hnoss` — the two declared by hand in
+  `opencode.json` — ever appeared.
+- **The directory is fixed and migrated.** `.opencode/agent/` → `.opencode/agents/`
+  (20 links, all resolving). `bin/valknut-load.sh` now writes the plural path and
+  **migrates a legacy singular dir forward**, so an old home heals instead of
+  silently keeping its agents invisible.
+- **The roster now declares what it names.** `bin/agents-config.sh apply` only
+  touched an agent already present in `opencode.json` (`if a in ablock`), so a
+  figure the roster knew but the config had never seen stayed undeclared. The
+  roster is the source of truth; a name in it now reaches the harness config.
+- **A new gate catches the class.** `compliance-check.sh` gains **`roster`**: the
+  roster (`config/agents.yaml.example`) and the canonical tree
+  (`.agents/agents/*.md`) must name the same figures. A figure in the tree but not
+  the roster falls to `default_model` and is never declared; a figure in the
+  roster with no profile is a phantom. This is the check that would have caught
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/agents/unversioned-2026-09-17-pi-gets-its-agents-and-a-dead-extension-comes-back.md

@@ -0,0 +1,26 @@
+## agents · unversioned · 2026-09-17 — Pi gets its agents, and a dead extension comes back
+
+### Why
+- **Pi has no agent loader.** Agent loading in Pi is a *package* (`pi-agents`,
+  `pi-agent-mode`, `pi-simple-agents`), never a core feature — and Ymir installs
+  none. So `.pi/agents/` held twenty correct profile links that **nothing in Pi
+  ever read**. The same failure as OpenCode's singular `.opencode/agent/`,
+  arrived at from the other side.
+- **The fix ships in this repo, not a root-pi package.**
+  `.pi/shared/extensions/ymir-subagents.ts` discovers the canonical
+  `.agents/agents/*.md` tree itself and registers a `subagent` tool. A call runs
+  the chosen figure as a nested model call in the current session: the figure's
+  markdown body is its system prompt, its frontmatter `model:` picks the model
+  where the machine serves it. `subagent({})` and `/subagents` list the roster.
+- **It imports nothing.** `@earendil-works/pi-coding-agent` is not installed as a
+  package, so an extension importing its types cannot load at all. This one takes
+  `pi` as `any` and declares `parameters` as a plain JSON schema — the pattern
+  every working extension in the tree already uses.
+- **A rename that left a reader behind.** `skuld-branch-supervision.ts` imported
+  `calmTranscriptClassIsVisible` / `CalmPresentationState` from
+  `./lib/ro-visibility.ts`, but that module exports `roTranscriptClassIsVisible` /
+  `RoPresentationState`. Pi refuses the **whole extension** at load, so Skuld's
+  s
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/agents/unversioned-2026-09-17-the-well-as-tools-ymir-s-first-custom-pi-extension.md

@@ -0,0 +1,20 @@
+## agents · unversioned · 2026-09-17 — the well as tools: Ymir's first custom pi extension
+
+### Why
+- **Why the extension tree was failing, from the upstream law:** pi auto-discovers
+  extensions from BOTH the global home and the project-local tree. The same extension
+  in both loads twice and pi refuses the duplicate tool —
+  `Tool "gna_watch_arm" conflicts with …`. Ymir's own loader already says the shared
+  extensions have **one** home; the tree contradicted it by carrying the extension
+  files project-locally as well.
+- **Built: `ymir-well`** — the well, as tools inside every pi session.
+  `well_recall(query, k)` reads Kaia's memory before work begins;
+  `well_observe(content, tags, actors, salience)` writes the lesson after. Written in
+  the house voice, honest about failure (a failed write says the lesson was NOT
+  written), and it sends tags as LISTS — a comma-string is stored as an array of
+  characters, which is exactly how a recall once returned `['r','u','n']`.
+- Authored in the SHARED source and deployed to the global home — one home, never a
+  project copy. That is the pattern every future Ymir extension follows.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/gate/0.1.28-fixes-guard-replaces-the-changelog-gate.md

@@ -0,0 +1,7 @@
+## gate · 0.1.28 · 2026-09-18 — fixes-guard replaces the changelog gate
+
+### Why
+changelog-guard passed if a range merely touched CHANGELOG.md, and the hook folded fragments mid-push. The new gate only reads: a push must carry a note under docs/fixes/<component>/. It refused its own first push, which is the proof it has teeth.
+
+### Files
+- `bin/fixes-guard.sh`

package/docs/fixes/gate/0.1.28-the-changelog-system-is-replaced-by-fix-notes.md

@@ -0,0 +1,8 @@
+## gate · 0.1.28 · 2026-09-18 — the changelog system is replaced by fix notes
+
+### Why
+Both failed us: a monolith fed by fragments, folded at push time, guarded by a check that a stray line satisfied.
+
+### Files
+- `bin/fixes.sh`
+- `CHANGELOG.d/`

package/docs/fixes/gate/0.1.28-the-frozen-changelog-becomes-per-component-notes.md

@@ -0,0 +1,9 @@
+## gate · 0.1.28 · 2026-09-18 — the frozen changelog becomes per-component notes
+
+### Why
+142 entries of history, one file per fix now, in the component each belongs to. The old file stays frozen — Rule 06 — with a line saying so.
+
+### Files
+- `docs/fixes/`
+- `CHANGELOG.md`
+- `bin/fixes-guard.sh`

package/docs/fixes/hlidskjalf/unversioned-2026-09-11-automate-the-install-consent-gate-self-healing-prereqs-v.md

@@ -0,0 +1,21 @@
+## hlidskjalf · unversioned · 2026-09-11 — Automate the install: consent gate, self-healing prereqs, visualizer-ready
+
+### Why
+- **Consent gate:** a real install now prints its plan and waits for the operator
+  to accept (`[y/N]`). Declining changes nothing (exit 3). `--check` still previews
+  without asking; non-interactive callers must pass `--yes`.
+- **New `bin/prereq-ensure.sh`:** self-healing prerequisites in USER SPACE —
+  installs `bun` and `uv` via their official installers, `mcp<2>` via pip, and can
+  fetch a specific Python (e.g. `3.12`) with uv for packages that need one.
+- **New `bin/smidja-bootstrap.sh`:** creates `smidja/smidja_data/smidja.db` from
+  the tracer's own schema and seeds a bootstrap session, so the Smíðja visualizer
+  has data from the first install. Fixed: it now bootstraps on a bare call
+  instead of printing help, and reports failure honestly when the DB is absent.
+- **`bin/ymir-install.sh`:** new `smidja` step; prerequisites delegated to the
+  self-healing helper; `engram` reported as an honest optional `SKIP` with the
+  exact next command; docker-group-permission and build-failure distinguished.
+- **Verified:** consent refuse/accept/decline paths; smidja db created and read
+  back (8 tables, bootstrap session); compliance 8/8.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-11-single-tenant-workspaces-shipped.md

@@ -0,0 +1,15 @@
+## hlidskjalf · unversioned · 2026-09-11 — Single-tenant workspaces shipped
+
+### Why
+- **First setup:** `bin/ymir-install.sh` (8 steps) + `bin/workspace-provision.sh`.
+- **Model:** single tenant; workspaces (personal|work) over domains; houses = brands.
+- **UI:** Login onboarding (name/kind/domains), Topbar workspace chip, AccountMenu/Profile relabelled.
+- **Engines:** treehouse → `yggdrasil.sh pool`; sandcastle → `utgard.sh sandcastle`; no-mistakes → Mjollnir gate.
+- **GitHub:** `bin/project-git.sh` reads `workspace/projects.yaml` `git{}`.
+- **Verified:** build green, compliance 8/8, smoke 8/8, lint 4/4.
+
+All significant runtime, policy, and architectural changes for the Ymir platform.
+Entries are appended chronologically; never rewritten.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-13-the-cloth-reaches-all-three-halls-hlidskjalf-sm-ja-the-s.md

@@ -0,0 +1,25 @@
+## hlidskjalf · unversioned · 2026-09-13 — the cloth reaches all three halls (Hlidskjalf · Smíðja · the seat)
+
+### Why
+- **One look, one source.** The carved cloth (the landing page's `:root`) now
+  dresses every hall, each through its own thin adapter, and `docs/design.md`
+  gained §0 *The cloth* plus the re-cut §4.1/§4.2 tables — the contract, not a
+  wish. `midgard/design-system/tokens.css` keeps every `--ymir-*` **name** and
+  changes only the values: stone `#0e0c09`/`#151209`/`#1a1610`/`#221d14`, bone
+  text `#cfc3a9`/`#9a8f75`/`#6b6250`, bronze `#c9973f` accent with `#7d5f2a` as
+  the brass rule, blood `#c2584a` danger, steel `#96a0a8` ok, brass bevel
+  `inset 0 0 0 1px rgba(201,151,79,.12)`.
+- **Type.** Cormorant (display), Newsreader (body), IBM Plex Mono (data) — the
+  landing's three faces — with Noto Sans Runic appended to every stack so runes
+  fall through to the rune family. Hlidskjalf loads them from Google Fonts; the
+  visualizer bundles them from `@fontsource` (its `@fontsource/play` is gone).
+- **Hlidskjalf:** 24 old-palette `rgba()` literals and every role hex in the
+  stylesheets now read tokens (`color-mix(… var(--ymir-ok) …)`); workspace tints
+  are cloth (work bronze, personal steel); the `HallsChooser` cards no longer name
+  two tokens that never existed (`--ymir-line`/`--ymir-panel`); the login's GitHub
+  button is a bone plate; the realm-tint fallbacks in `global.css` follow.
+- **Smíðja's eye:** the default theme is **fensalir** (the titlebar toggle cycles
+  fensalir →
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-16-one-login-for-every-app-on-the-web-the-gate-fronts-them-.md

@@ -0,0 +1,24 @@
+## hlidskjalf · unversioned · 2026-09-16 — one login for every app on the web; the gate fronts them all
+
+### Why
+- **Every app host is gated**, not just Smíðja. The gate now routes by host from
+  an `APP_HOSTS` table and fronts each one: unauthenticated visitors get that
+  app's own sign-in page, an API path gets 401, and the desktop seat (loopback +
+  marker) walks straight in. Verified: `smidjadell…` → *Smíðja — Sign in*,
+  `odrerirdell…` → *Óðrerir — Sign in*, API 401, desktop seat 200 (the hall).
+- **Every public hostname points at the gate (:3889)** — never at an app's own
+  port. That was a hole straight past the login: `gjallarhorn-expose.sh` had been
+  exposing each app on its own port, so the app answered the world directly.
+- **The gate learns the host map at start** (`state/gjallarhorn-hosts.env`,
+  written by the expose script and sourced by `scripts/start.sh`), so routing is
+  not an accident of whoever launched it last.
+- **No guessed credentials.** The generated tunnel config wrote
+  `credentials-file: …/ymir.json`; cloudflared names that file for the tunnel's
+  UUID, so it refused to start and the world got 530. The line is gone —
+  cloudflared resolves a named tunnel's own credentials.
+- Verified through the tunnel: `https://ymirdell.zerwiz.org/` → 200. The app
+  hostnames still answer 530: their DNS routes were made against an earlier
+  tunnel and need re-creating (`cloudflared tunnel route dns ymir <host>`).
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-16-the-credential-reaches-the-gate-and-the-hall-stops-leaki.md

@@ -0,0 +1,23 @@
+## hlidskjalf · unversioned · 2026-09-16 — the credential reaches the gate, and the hall stops leaking an IP
+
+### Why
+Setting the operator password had **no effect**. This is the bug that made that
+true, and the runtime state that leaked a private address.
+
+- **`scripts/start.sh` never loaded the platform env for the gate.** The gate is
+  `bun run apps/hlidskjalf/server/index.ts`, and the server reads
+  `process.env.HLIDSKJALF_AUTH` — but the launcher passed only `PORT`, and nothing
+  sourced `.env.local`. So a credential written by `bin/ymir-setup-auth.sh`
+  (correctly: `0600`, gitignored) never arrived, and because the gate treats an
+  empty `GATE_AUTH` as authenticated (`authed: GATE_AUTH ? … : true`) the gate
+  stayed **open**. `start.sh` now loads `.env.local` once, before the ports, for
+  every service it raises — the gate, Bifrost and Mimir.
+- **`apps/odrerir/.astro/dev.json` was tracked.** Astro rewrites it on every
+  start with the live `pid` and the host's own addresses (LAN + tailnet) — a
+  private-IP leak into a public tree. It is now untracked and gitignored; the
+  generated types beside it stay tracked.
+- `galdr-reread`: `assets/hlidskjalf-ui.md` (the gate must receive the credential)
+  and `assets/odrerir-hall.md` (`.astro/dev.json` is runtime state).
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-16-the-delivery-gates-install-themselves-rename-drift-mende.md

@@ -0,0 +1,22 @@
+## hlidskjalf · unversioned · 2026-09-16 — the delivery gates install themselves; rename drift mended
+
+### Why
+- **Install seam.** `bin/ymir-install.sh` gains step **`gates`** (after
+  `loaders`): `bin/secret-guard.sh --install` seats the pre-commit guard and
+  `bin/changelog-guard.sh --install` the pre-push (branch + changelog). A fresh
+  clone now gets the delivery gate without a manual step — `--check` reports it
+  as `gates OK|WARN`, the consent preamble names it, and
+  `assets/installation.md` carries the row in the same change.
+- **Drift mended — found by the compliance gate, not by me.** Two symlinks
+  still pointed at the retired `galdr-cli` skill, so the last rename was not in
+  fact complete: `.agents/agents/galdr.md` (Galdr's agent surface was a **dead
+  link**) and `.agents/skills/tyr-check/assets`. Both repointed at
+  `galdr-ymirsystem`, which is where the skill and its assets live.
+- **`AGENTS.md` TOON mend.** The `security[4]` block carried a rule wrapped
+  across two lines, which the checker counted as a fifth row. Joined to one
+  line; the block now declares and holds exactly four.
+- **Compliance.** All ten Galdr gates green: toon · naming · mocks · syntax ·
+  json · sync · surfaces · assets · duplicates · governed.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-16-the-panels-that-crashed-the-gate-that-lied-and-the-well-.md

@@ -0,0 +1,25 @@
+## hlidskjalf · unversioned · 2026-09-16 — the panels that crashed, the gate that lied, and the well that would not open
+
+### Why
+- **Statistics now reports the HARNESSES** (pi + opencode), not the smithy's runs.
+  `bin/hlidskjalf-usage.sh` aggregates opencode's SQLite token store and both pi
+  stores, and emits the numbers under the names the gate renders (`gate{}`):
+  totals, usage, providers local/online with per_model, by_chain, by_model.
+  Verified: 21,497 runs (opencode 21,422 · pi 75) · 331.5M tokens ·
+  local 239,623 / online 331,289,420 · cache-hit 91.5%.
+- **A failed fetch no longer takes the hall down.** Endpoints answering `{error}`
+  were handed to panels as data — Rail read `.filter` on an object, Stats read
+  `.totals` on a string, and both crashed. The store now runs every bootstrap
+  answer through `ok()`: an error keeps the last good value.
+- **`/api/usage` was answering with a traceback** while the script passed by hand:
+  the gate process had been started before the fix and caches a failure for 60s.
+  Restarted; the endpoint serves the harness numbers.
+- **The engram MCP (`-32000: Connection closed`) is mended.** Not config, not the
+  engram package: `python3.12 -c "import mcp"` failed because the system
+  `python3-rpds-py` ships without its compiled `rpds.rpds` module, which
+  `jsonschema` (inside `mcp` 1.x) imports. Mended with
+  `python3.12 -m pip install --user --break-system-packages --force-reinstall rpds-py`
+  (plus `mcp<2` under python3.12). The server now starts and waits on s
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-17-0-1-14-the-panels-reach-the-gate-and-the-fourth-window-s.md

@@ -0,0 +1,9 @@
+## hlidskjalf · unversioned · 2026-09-17 — 0.1.14: the panels reach the gate, and the fourth window ships
+
+### Why
+- **`@zerwiz/hlidskjalf` 0.1.1** — the package now declares its own `name`, `files` and the absence of `private`, and ships **`vite.config.ts`**. Without that config a packaged SPA is served by `vite preview` with **no `/api` proxy**, so every panel answered `index.html` and died on `Unexpected token '<'<`. That was the whole panel fault.
+- **`@zerwiz/odrerir` 0.1.1** — ships its **`electron/`** half, so the fourth hall can have a window; its name is `@zerwiz/odrerir` and it is no longer marked private (npm refuses those, EPRIVATE).
+- Both apps declared what ships **in their own repos**, instead of a manifest rewritten at publish time — which is how the wrong things shipped in the first place.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-17-models-providers-and-paths-are-the-user-s-and-the-gate-s.md

@@ -0,0 +1,26 @@
+## hlidskjalf · unversioned · 2026-09-17 — models, providers, and paths are the user's — and the gate says so
+
+### Why
+- **The law, amended (Rule 07).** Two clauses appended, the rule itself untouched:
+  - **A. Models and providers live in the hoard, per user, read from YAML.**
+    Every operator's differ, so there is **no global model or provider** — a
+    shipped default naming a model is a claim about someone else's machine. The
+    user's own live in `$YMIR_HOME/hodd/`, read from a YAML file there; the repo
+    ships a template.
+  - **B. No hardcoded absolute file paths.** No `$HOME<user>/…`, no
+    `/Users/<user>/…`, no `C:\Users\…`. A path is relative to a resolved root or
+    comes from env/config with one documented default.
+- **The gate, `config`.** `compliance-check.sh` gains a check that fails on a
+  model id or provider name used as a **value** in shipped code or a tracked
+  config, and on an absolute path naming a user. Comments, `*.example` templates,
+  `CHANGELOG*`, and `assets/reference/` are exempt by intent — they document,
+  they do not configure. **192 files clean.**
+- **Three real violations found and fixed:**
+  - `.agents/config/eindri-dispatch.json` — three dispatch rules named
+    `opencode-go/deepseek-v4.1-flash`. Now a template with `<your-model-id>`.
+  - `.agents/skills/galdr-ymirsystem/assets/pi-boot/pi-profile.yml` — the PI boot
+    profile named `lmstudio/qwen3.6-35b-a3b`. Now a placeholder.
+  - `bin/bootstrap-macos.sh` — `$HOME/Documents/Ymir`. Now resolve
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hlidskjalf/unversioned-2026-09-17-the-northstar-gate-runs-nightly-the-platform-door-it-cau.md

@@ -0,0 +1,16 @@
+## hlidskjalf · unversioned · 2026-09-17 — the NorthStar gate runs nightly; the platform door it caught is mended
+
+### Why
+- **`bin/nornir-job-nsr-compliance.sh` (02:30)** runs every
+  `.compliance/gates/check_*.sh` (danger · env · paths · platform · wiring)
+  and carves the verdict — `nsr.compliance` clean, or `nsr.compliance.failed`
+  (exit 1) naming the broken gate, so the 07:00 briefing reads it at sunrise.
+- **The gate it caught, mended:** `scripts/electron.sh` used `kill -9`, which
+  the platform gate rightly refuses as non-portable. It now uses `kill -KILL`
+  (the house idiom already in `scripts/stop.sh`) — the NSR round is 5/5 green.
+
+galdr-reread: `.agents/skills/galdr-ymirsystem/assets/nornir-jobs.md` — new
+§3.5 (hall snapshot) and §3.6 (NSR round) rows.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-16-every-app-wears-its-own-rune.md

@@ -0,0 +1,27 @@
+## hoard · unversioned · 2026-09-16 — every app wears its own rune
+
+### Why
+The icon set is runecoded (`midgard/design-system/icons.md`): an Elder Futhark
+rune, stroked at the chisel bevel, tinted by the app's house colour. The apps were
+wearing the generic Ymir mark — or, worse, the old **blue** logo.
+
+- **`bin/design-icon.sh`** mints an app's icon from a glyph plus a house tint: a
+  stone tile with the rune stroked in bronze. `list` shows the mapping.
+- Minted and wired: **Hlidskjalf** `ehwaz` ᛖ (the seat), **Óðrerir** `valhalla` ᚹ
+  (the hall), **Sessrúmnir** `sowilo` ᛊ (the sun), **Smíðja** `ansuz` ᚨ (Odin's
+  breath — the forge). Óðrerir already carried a forge-coloured favicon set.
+- **The blue logo is retired**: `public/logo.svg` removed, and Smíðja's *inline*
+  copy in `App.vue` — the mark in its own header, still `#0f172a`/`#1e293b` —
+  replaced with the ansuz rune in bronze. Rebuilt; no blue in the bundle.
+
+### The hearth stays, and spreads
+
+Sessrúmnir's background fire is **`EmberBackground`** — 26 embers rising with a
+gentle sway on a canvas, *"the hearth of the landing page, carried into the
+chat"* — used by its home screen and chat panel. It stays. Next: one shared
+ember (a framework-neutral `midgard/design-system/ember.js` with a
+`prefers-reduced-motion` guard) so Hlidskjalf's shell, the login screen,
+Óðrerir's hall and the Smíðja chrome can warm the same fire.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-16-hodd-lives-outside-the-repo-and-the-installer-makes-it-s.md

@@ -0,0 +1,24 @@
+## hoard · unversioned · 2026-09-16 — Hodd lives outside the repo, and the installer makes it so
+
+### Why
+- **One resolver.** `bin/hoard-lib.sh` (`hoard_root`) is now the single answer to
+  *where private data lives*: `$YMIR_HOARD`, else `$YMIR_HOME`, else
+  `$HOME/Documents/Ymir` — never the checkout. Rule 07's one documented default,
+  in one place.
+- **The inward default is gone.** `bin/mimir-ingest.sh`, `bin/project-git.sh` and
+  `bin/workspace-provision.sh` each fell back to `$ROOT/hodd`, so on a machine
+  with neither `YMIR_HOARD` nor `YMIR_HOME` exported, memory ingest, the project
+  registry and workspace provisioning wrote private data **inside the repo**.
+  All three (plus `bin/hodd.sh` and the installer) now resolve through the lib.
+- **The misplaced document is out.** `0003-private-data-separation.md`, which had
+  come to rest in the repo at `hodd/docs/plans/`, now lives in the hoard at
+  `$YMIR_HOME/docs/plans/`. The repo's `hodd/` holds exactly the guard, the
+  README and `AGENTS.example.md` — Rule 04's scaffold set, and nothing else.
+- **Installed, not assumed.** `bin/ymir-install.sh` step `tree` now raises the
+  hoard layout *outside* the repo (`bin/hodd.sh init`) and seeds an empty
+  `secrets/platform.env` (mode 0600), so `bin/hodd.sh emit secrets/platform.env`
+  resolves on a fresh machine instead of failing with "not readable".
+  `assets/installation.md` and `assets/memory-well.md` updated in the same change.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-16-the-icons-are-real-runes-now-eight-of-them-were-drawings.md

@@ -0,0 +1,33 @@
+## hoard · unversioned · 2026-09-16 — the icons are real runes now (eight of them were drawings)
+
+### Why
+The Allfather looked at the icons and said what no check had: *"the icons must be
+based on real runes."* He was right, and the fault was in the **glyph set**, not
+just in the two icons I had minted.
+
+`midgard/design-system/icons.md` claims every glyph is an Elder Futhark rune and
+gives each its unicode. **Eight of the twenty-one files were drawings** — a hall
+(`valhalla`, which Óðrerir was wearing), a horn, a shield, a spear, a well, a
+squirrel, a gate, a world-tree. Replaced with the real runes their own rows
+declare:
+
+```
+gjallarhorn ᚷ Gebo · gungnir ᚦ Thurisaz · heimdall ᚺ Hagall · mimirsbrunn ᛜ Ingwaz
+ratatoskr ᛒ Berkanan · utgard ᚢ Uruz · valhalla ᚹ Wunjo · yggdrasil ᛃ Jera
+```
+
+Gungnir was claiming Gebo, which Gjallarhorn already holds, so it takes
+**Thurisaz** (the thorn — the spear) and `icons.md` is corrected to match.
+
+**Five apps, five different runes:** Hlidskjalf `ehwaz`, mobile `raidho` (the
+road), Óðrerir `valhalla`→ now genuinely `ᚹ Wunjo`, Sessrúmnir `sowilo`, Smíðja
+`kaunan` (the torch). The install table drives both mint and install now — it had
+been guessing paths, which is why the Smíðja visualizer had been given
+Hlidskjalf's icon.
+
+Also this pass: the visualizer gained its furniture (description, canonical,
+manifest, OG + Twitter), Óðrerir's Electron shell asks for a window icon, and the
+apple-touch PNGs are rasterised (ImageMagick is present).
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-17-0-1-26-published-and-the-vault-door-named.md

@@ -0,0 +1,8 @@
+## hoard · unversioned · 2026-09-17 — 0.1.26: published, and the vault door named
+
+### Why
+- **@zerwiz/ymir@0.1.26 is on the registry** — the latest main, published as `zerwiz`. The token was in the encrypted vault all along; `age` was missing from this machine, and `bin/hodd.sh emit` returns empty, so every reader reported the token absent. The door is the fix, not the key.
+- **The bump clears the registry**: main carried 0.1.18 while the registry served 0.1.25 (other sessions published past main).
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-17-one-well-in-the-hoard-every-reader-of-kaia-s-memory-reso.md

@@ -0,0 +1,23 @@
+## hoard · unversioned · 2026-09-17 — one well, in the hoard: every reader of Kaia's memory resolves the hoard store
+
+### Why
+- **The memory is ONE store and it lives in the hoard** —
+  `$YMIR_HOME/hodd/memory/kaia.engram` — never in the tree, never in a
+  migrated copy. `bin/hoard-lib.sh` gains `hoard_memory_store` (the one
+  resolver); every reader honors it or an explicit `ENGRAM_DB`:
+  `mimir-bridge.sh`/`mimir-bridge.py`, `mimir-reflect.sh`, `a2a-mcp.sh`,
+  `ymir-install.sh` step_memory, and the rendered `.pi/mcp.json.example`
+  (`__YMIR_HOME__/hodd/memory/kaia.engram`).
+- **The duplicate is dead.** The old store (`$YMIR_HOME/memory/kaia.engram`,
+  plus the migration seed copy) is struck from this machine and the vault;
+  its 8 episodes were seeded into the hoard store first. The public ymir
+  repo's `.agents/memory/kaia.engram*` leftovers are deleted (already guarded
+  by `.gitignore`) and the 0003 migration now copies INTO the hoard.
+- The Allfather's decision, accepted and recorded everywhere: the well must
+  travel between his computers, so it rides the private vault as one store.
+
+galdr-reread: `.agents/skills/galdr-ymirsystem/assets/memory-well.md` — the
+Store row, MCP command, law #4, and the Python recipe now name the hoard path.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-17-skrymir-opens-the-hoard-not-the-checkout.md

@@ -0,0 +1,18 @@
+## hoard · unversioned · 2026-09-17 — Skrymir opens the hoard, not the checkout
+
+### Why
+- **The file browser was rooted in the wrong tree.** `workspaceRoot()` built every
+  realm path under `ROOT` — the checkout — so `work` resolved to a directory that does
+  not exist and the walk fell back to the repo's `docs/`. That is why Skrymir showed
+  `lore.md`, `Architecture.md`, `research/`, `runbooks/`, and why a file it had just
+  listed answered **"not found"**: the listing came from one tree and the read from
+  another.
+- **The hoard first now (Rule 04):** `$YMIR_HOME/svartalfaheim/<realm>` → company
+  container → `$YMIR_HOME/workspace/<realm>` → the checkout only as legacy. An empty
+  realm shows the hoard's home, never the repo's docs. Verified: `work` lists
+  `memory/daily/2026-09-13.md` and `workspace/`, and a read returns its body.
+- Note for the next hand: the gate runs **without** `--watch` — a server edit is on
+  disk and not in the process until `scripts/start.sh` raises it again.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-17-the-hoard-encrypts-its-secrets-at-rest.md

@@ -0,0 +1,20 @@
+## hoard · unversioned · 2026-09-17 — the hoard encrypts its secrets at rest
+
+### Why
+- **`bin/hodd.sh` decrypts transparently.** `load`, `emit`, and `tenant` now
+  accept a plaintext file *or* an `.age` ciphertext with the sibling plaintext
+  absent. A shared `resolve_secret` finds the readable form; when it decrypts,
+  it uses a mode-600 temp and removes it afterward. An agent asks for the
+  resolved path and never handles ciphertext directly.
+- **Secrets stay encrypted at rest.** `hodd/secrets/platform.env.age` is the
+  committed form; the plaintext is scratch and gitignored. Round-trip verified
+  byte-identical before the plaintext was untracked.
+- **The vault invariant, written down.** The age key and the ciphertext travel
+  together in the private `ymirhome` repo, so a dead disk loses nothing — and
+  `ymirhome` **must never be made public**. Stated in `hodd/docs/secrets-vault.md`.
+- **The honest limit.** This is encryption-at-rest, not encryption-against-yourself:
+  on a single-user machine, a process running as the operator can read what the
+  operator can read. What it buys is the *file* and the *repo*, not the *account*.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-17-the-hoard-gets-a-guard-and-rule-04-stops-contradicting-t.md

@@ -0,0 +1,19 @@
+## hoard · unversioned · 2026-09-17 — the hoard gets a guard, and Rule 04 stops contradicting the disk
+
+### Why
+- **Eir gains a `hoard` surface.** Private data drifting outside the hoard is
+  now caught rather than discovered by asking "where did that go?". The check
+  fails on two things: a `.ymir-layout.yaml` entry naming a directory that does
+  not exist (a stale map is what lets private work land outside the hoard), and
+  a flat `$YMIR_HOME/{identity,data,docs,secrets,tenants}` sitting beside
+  `hodd/`. `fix` merges a flat duplicate into the hoard without clobbering, then
+  repoints any stale layout entry at the hoard.
+- **Rule 04 corrected, append-only.** The rule's mapping table read as if
+  `hodd/x/` and `$YMIR_HOME/x/` were two locations; on a real home that produced
+  two parallel stores which drifted. The appended correction states the truth:
+  `$YMIR_HOME/hodd/` **is** the private data path, `bin/hoard-lib.sh` is the one
+  source of truth for it, and `.ymir-layout.yaml` must name only paths that
+  exist. Nothing above the correction was rewritten.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-17-the-home-s-re-laid-layout-taught-to-the-system.md

@@ -0,0 +1,17 @@
+## hoard · unversioned · 2026-09-17 — the home's re-laid layout taught to the system
+
+### Why
+- **The layout changed (2026-09-17):** plans filed by domain under
+  `$YMIR_HOME/memory/plans/<domain>/`, live plans in `hodd/plans/`,
+  workspaces under `hodd/workspaces/`, dropped-from-git material in
+  `hodd/state/stale-*`. The hodd example (`hodd/AGENTS.example.md`) now
+  teaches the new shape.
+- **AGENTS.md** — the private-home tree block, the outputs table
+  (`hodd/workspaces/work/`, `hodd/workspaces/personal/`), and the Ratatoskr
+  plan pointer updated to the new homes.
+- **bin/nornir-job-daily-briefing.sh** — the morning brief's masterplan and
+  plan-status reads follow the new layout (`hodd/docs/masterplan.md`,
+  `memory/plans`) with `BROKK_MASTERPLAN`/`BROKK_PLANS_DIR` overrides.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-17-the-private-home-gets-the-ward-it-never-had.md

@@ -0,0 +1,25 @@
+## hoard · unversioned · 2026-09-17 — the private home gets the ward it never had
+
+### Why
+- **Six guards watched the public repo; the home had none — yet the home is where
+  every private byte lives.** The one real leak of this day (`platform.env.prev-fill`,
+  44 credentials) happened *there*, in a scratch backup swept up by `git add -A`,
+  with nothing watching. `bin/hoard-guard.sh` closes that.
+- **It is a hook, not a script.** Seated as `$YMIR_HOME/.git/hooks/pre-commit`,
+  **git runs it on every commit** — including one made in a hurry, by a loop, or by
+  an agent that has never heard of it. Verified by attempting a real `git commit`
+  with no guard invoked: git refused, exit 1.
+- **It catches what actually leaked**, verified by planting each: a scratch-backup
+  name (`*.prev-*`, `*.bak`, `*.orig`), a plaintext secret filename, a secret shape,
+  and — the evasion that would have hidden a key — **a base64 blob whose decode
+  contains a PEM header**, under an innocent filename.
+- **`bin/ymir-install.sh` seats it at both repos** (the `hoard-gate` step reports
+  the home separately, so a dormant vault is visible), on every install layer.
+- **A bypass is logged, not silent.** `hoard-guard.sh --log-bypass` appends to the
+  Runes ledger when a `--no-verify` commit is detected.
+- **Two stale flat paths fixed in the guards themselves.** `bin/docs-guard.sh` told
+  an operator to move private docs to `$YMIR_HOME/docs/` — a path that no longer
+  exists — and `bin/groa-updat
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/hoard/unversioned-2026-09-17-the-schedule-is-the-user-s-cron-leaves-the-tree-lives-in.md

@@ -0,0 +1,27 @@
+## hoard · unversioned · 2026-09-17 — the schedule is the user's: cron leaves the tree, lives in the home
+
+### Why
+- **The tracked tree no longer carries the live cron schedule.** The Nornir
+  scheduler now resolves the schedule in this order: `BROKK_CONFIG_OVERRIDE`
+  (explicit) → **the home's own `$YMIR_HOME/config/cron.yaml`** (users set
+  their jobs there) → the repo's `config/cron.yaml.example` (a template, never
+  the live list). `bin/nornir-cron-start.sh` resolves the home through
+  `bin/hoard-lib.sh`, the one answer the whole runtime shares.
+- `config/cron.yaml` → `config/cron.yaml.example` (the tracked template stays;
+  the live schedule lives in the operator's home).
+- **The marketing stack can be provisioned on any computer** —
+  `bin/ymir-marketing-stack.sh up|status|down|doors` stands Mautic + Postiz +
+  Activepieces (+ optionally Forgejo) from the same OSS engines the server
+  runs, env-driven, ports virtualized, secrets generated once into the home
+  (never inline); agents (Bragi · Sindri) provision it for any user.
+- **Bragi's scrape round, honest to Firecrawl** — `bin/nornir-job-bragi-scrape.sh`
+  reads the operator's `config/scrape-sources.yaml` and scrapes with the real
+  Firecrawl SDK (scrape/search + markdown, BYOK key from the home's secrets),
+  landing clean markdown in the marketing workspace and carving a Rune.
+
+galdr-reread: `.agents/skills/galdr-ymirsystem/assets/nornir-jobs.md` — §2
+rewritten (the schedule is the user's; example template; the four-inputs
+contract
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/install/0.1.28-a-stale-install-can-no-longer-hide.md

@@ -0,0 +1,8 @@
+## install · 0.1.28 · 2026-09-18 — a stale install can no longer hide
+
+### Why
+npm install -g reported 'changed 200 packages' while changing nothing: it resolved a cached latest.
+
+### Files
+- `bin/ymir.js`
+- `install.sh`

package/docs/fixes/install/unversioned-2026-09-11-desktop-shell-tunnel-and-temporary-auth.md

@@ -0,0 +1,14 @@
+## install · unversioned · 2026-09-11 — Desktop shell, tunnel, and temporary auth
+
+### Why
+- **Electron:** `apps/hlidskjalf/electron` + `scripts/electron.sh` open Hlidskjalf
+  (and Smiðja) as a native window; raises the stack if down.
+- **Tunnel:** `ymirdell.zerwiz.org` → `:3889` via `bin/gjallarhorn-tunnel.sh`
+  (cloudflared config in `midgard/infrastructure/ingress/cloudflared-ymir.yml`).
+- **Auth:** hardcoded HTTP Basic (`zerwiz:allfather`, `HLIDSKJALF_AUTH`) on the
+  gate API, which now also serves the built SPA. Temporary — move to Heimdall +
+  `.env.local`.
+- **Mobile:** PWA manifest added; recommended APK = Capacitor over the tunnel.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*