@zerwiz/ymir 0.1.26 → 0.1.28

package/docs/fixes/runtime/unversioned-2026-09-12-fleet-preferences.md

@@ -0,0 +1,11 @@
+## runtime · unversioned · 2026-09-12 — Fleet preferences
+
+### Why
+- `data/fleet.md` (gitignored) holds fleet-wide per-user settings (`ro: on|off`).
+- `bin/fleet-apply.sh` applies them to this home + every registered Eindri-home
+  (into each home's gitignored `state/`; remote routes reported).
+- `bin/brokk-update.sh` re-applies fleet preferences on every sweep — one setting
+  reaches the whole fleet, no tracked tree dirtied.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-12-house-law-rules-and-the-grein-naming.md

@@ -0,0 +1,11 @@
+## runtime · unversioned · 2026-09-12 — House law (RULES/) and the Grein naming
+
+### Why
+- New `RULES/` (the house law): `01-domains.md` (house = company; domain = a
+  **Grein**/**Greinar**; Eindri = specialists), `02-agents.md` (agents live only
+  in `.agents/agents`; harness dirs are symlinks; no mock agents), `03-houses.md`
+  (a house is a company — WayOf; the eight Labs are domains, never houses).
+- Live Fleet de-mocked (real domain/model/status; seeded stats only in demo).
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-12-r-preference-moved-out-of-the-tracked-tree.md

@@ -0,0 +1,10 @@
+## runtime · unversioned · 2026-09-12 — Ró preference moved out of the tracked tree
+
+### Why
+- `.agents/config/ro` was a **git-tracked** per-user toggle (calm on/off); any
+  toggle dirtied the tree and made `bin/brokk-update.sh` refuse. It now lives in
+  the gitignored `state/ro`; `YMIR_RO`/`BROKK_RO` set a default; the legacy
+  `config/ro` is read once for upgrade then never written. Tracked file removed.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-12-the-dashboards-stop-crash-looping-on-the-igpu.md

@@ -0,0 +1,20 @@
+## runtime · unversioned · 2026-09-12 — The dashboards stop crash-looping on the iGPU
+
+### Why
+- **`scripts/electron.sh` decides its own GPU path.** Both dashboards appeared to
+  work while `coredumpctl` filled with SIGSEGV cores from
+  `electron --type=gpu-process`. An iGPU backs its graphics memory with system
+  RAM (GTT), a local model served on that same iGPU held 5.8-8.0 GiB of it, and
+  the amdgpu driver then failed the desktop's command submissions — which
+  Electron turned into a NULL dereference at a constant offset. Only the GPU
+  process died, so the windows stayed up and the failure was easy to miss.
+  `igpu_vram_small()` now reads the render device's VRAM carve-out and switches
+  to software rendering under `YMIR_IGPU_VRAM_SMALL_MIB` (default 2048). The old
+  comment promised this auto-detect; now it exists. `YMIR_DESKTOP_DISABLE_GPU`
+  still overrides, both ways.
+- **Verified:** with the fix, the amdgpu submission errors stop and the
+  gpu-process runs SwiftShader (`--use-angle=swiftshader-webgl`) rather than the
+  hardware path; no new cores.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-12-the-well-actually-installs-it-never-did.md

@@ -0,0 +1,23 @@
+## runtime · unversioned · 2026-09-12 — The well actually installs (it never did)
+
+### Why
+- **The memory engine was never installed by the installer.** `bin/prereq-ensure.sh`
+  had no `engram` target at all, and `bin/ymir-install.sh` only *checked* for it
+  and printed `SKIP "optional — install engine then run bin/mimir-bridge.sh"`. A
+  SKIP never blocks, so the well was silently down on every install.
+- **The hint named the wrong package.** PyPI's `engram` is an unrelated
+  *rendering* library (mitsuba/drjit/torch): following the hint pulled gigabytes
+  of CUDA wheels and still left no engine. The memory engine's distribution is
+  **`engdbram`**; its module is `engram`. The pre-swap append-only log had the
+  right answer all along (`PyPI engdbram, v2.2.1`).
+- **Now it installs.** `prereq-ensure.sh engram` installs `engdbram` into an
+  interpreter that can run it (>=3.11; uv supplies 3.12 here), records that
+  interpreter in `~/.config/ymir/engram-python`, and `bin/mimir-bridge.sh` reuses
+  it for both the check and the run. The installer provisions rather than hints,
+  and reports WARN instead of a silent SKIP when it cannot.
+- **Verified:** `curl 127.0.0.1:4602/health` -> `{"status": "up", "store":
+  ".agents/memory/kaia.engram"}`; `.agents/skills/lifecycle/smoke_test.sh` exits 0
+  with all five checks green.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-12-updater-forged-credential-moved-to-env.md

@@ -0,0 +1,12 @@
+## runtime · unversioned · 2026-09-12 — Updater forged + credential moved to env
+
+### Why
+- **`bin/brokk-update.sh`** — the sanctioned, guarded updater the `ymir-update`
+  skill calls: fast-forward only, refuses a dirty/diverged tree, `--yes` to
+  stash+restore, `--check` to report. Never force-pushes.
+- **Credential law:** the gate login (`HLIDSKJALF_AUTH`) no longer has an inline
+  default; it is read from `.env.local` (Bun auto-loads it). Server falls back to
+  an open gate only when unset (dev), with the key added to `.env.example`.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-14-a-vacant-helm-is-entered-not-punted-watcher-wake-repair.md

@@ -0,0 +1,24 @@
+## runtime · unversioned · 2026-09-14 — A vacant helm is entered, not punted (watcher wake repair)
+
+### Why
+- **Problem:** a watcher wake reported the Pi extension could not restore
+  continuity — "this session no longer owns the lock". Root cause found by
+  inspection: an **empty/truncated** machine lock (`~/.local/state/ymir/brokk.lock`)
+  was classified by `gna-pi-watch.ts` `lockOwnership()` as `other` (another
+  live session) and by `bin/syn-watch-arm.sh`'s gate as read-only — so a helm
+  with *no verifiably-live holder* was refused and punted to a manual
+  `saga-session-start.sh` reclaim.
+- **Fix (both seams in one change):** the extension now classifies an empty
+  lock as `missing`, so `gna_watch_arm`'s reclaim takes the helm in place; the
+  arm script, on finding no owner (or an owner verifiably gone), runs
+  `gleipnir_lock_acquire` itself — which refuses only a genuinely live other
+  session — instead of printing read-only. The "run saga-session-start.sh"
+  punt is gone; a vacant helm is entered by the watcher's own hand.
+- **Verified:** scratch-state test — empty machine lock → `watcher: started`,
+  lock bound to the session pid + starttime sidecar, `.supervision-armed`
+  touched; `gleipnir-machine-lock.test.sh` ALL PASS (zombie, recycled,
+  migration); compliance 10/10; harness-integration asset updated in the same
+  change (the governed rule).
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-14-the-echo-guard-no-wake-flood-through-gn-s-door.md

@@ -0,0 +1,18 @@
+## runtime · unversioned · 2026-09-14 — The echo guard: no wake flood through Gná's door
+
+### Why
+- **Problem:** during a loud stretch (stale wake lines + the FM runner's
+  durable queue holding ten old check-wakes), the watcher re-armed and
+  re-signalled "signal: wake queue" across many generations; every actionable
+  close queued one pi follow-up wake (`sendWake`, no dedup), which then
+  dripped at the Allfather one per prompt — a long echo flood after the
+  sources were drained.
+- **Fix:** `gna-pi-watch.ts` `sendWake` is **echo-guarded**: an identical
+  watcher message is delivered at most once per drained state — when both
+  durable doors (`state/.wake-queue` and the FM runner's
+  `.agents/state/.wake-queue`) are empty, a repeat carry is the same drained
+  news and is skipped. Genuine new content (different message, or a door with
+  a line) always delivers. Harness asset updated in the same change.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-app-packaging-prepared-under-the-ymir-scope-amendment-c-.md

@@ -0,0 +1,23 @@
+## runtime · unversioned · 2026-09-16 — app packaging prepared under the @ymir scope (Amendment C, part one)
+
+### Why
+- **Scoped names.** `apps/odrerir` was `ymir-odrerir` and `apps/sessrumnir` was
+  bare `sessrumnir`; both are now `@ymir/odrerir` and `@ymir/sessrumnir`.
+- **Publishable metadata on all four apps** (hlidskjalf, hlidskjalf-mobile,
+  odrerir, sessrumnir): `license`, `repository`, `publishConfig.access: public`,
+  a `files` surface, and `prepublishOnly` where a build exists.
+- **Measured with `npm pack --dry-run --ignore-scripts`:** hlidskjalf 1.3 MB /
+  21 files, odrerir 2.3 MB / 15, sessrumnir 4.0 MB / 116, hlidskjalf-mobile
+  2.0 kB / 4 (source only — it has no build script). `dist/ymir.apk` is excluded
+  by `!dist/*.apk`: it took the hlidskjalf tarball from 1.3 MB to 14.5 MB, and
+  npm is not an APK channel.
+- **`private: true` stays until the Allfather's word** — nothing can publish by
+  accident; the flip is one line per app.
+- The app repos were already registered in `$YMIR_HOME/identity/projects.yaml`
+  (`zerwiz/{hlidskjalf,hlidskjalf-mobile,odrerir,sessrumnir,smidja}`).
+- `no-mistakes` is initialized for this repo (`no-mistakes init`): the clean-PR
+  gate now has its local remote. The vendored skill copy stays — it is the
+  canonical tree the skill index names.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-four-readers-that-still-pointed-at-the-pre-split-world.md

@@ -0,0 +1,26 @@
+## runtime · unversioned · 2026-09-16 — four readers that still pointed at the pre-split world
+
+### Why
+The app split and the hoard migration moved things; four readers never followed.
+None failed loudly — each reported a clean PASS, a wrong SKIP, or a silent loss.
+
+- **`bin/ymir-install.sh` wrote during `--check`.** The step chain ran
+  `bin/ymir-migrate.sh apply` unconditionally, so a preview that promises *"report
+  only, no writes"* actually **moved private data**. Migrations now apply only on
+  a real run: `if [ "$CHECK" = 0 ]; then ... apply; fi`.
+- **`.agents/migrations/0003-private-data-separation.sh` skipped every directory.**
+  It pre-creates its target dirs, then its `copy` refused any target that already
+  existed — so `data/` (and every other directory source) was silently dropped.
+  The realm declaration never arrived and `0004` fell back to a neutral realm.
+  `copy` now **merges** a directory into its target (never overwriting a file) and
+  copies a single file only when it is absent.
+- **`bin/smidja-bootstrap.sh` looked for the smithy at the old root.** `sys.path`
+  pointed at `smidja/`, but the split moved it to `apps/smidja/`, so the DB seed
+  died with `ModuleNotFoundError: No module named 'smidja_modules'`. It now
+  searches `apps/smidja` then `smidja`, so either layout works.
+- **`bin/ymir-validate.sh` read the ledger from the pre-move path.** It looked at
+  `$YMIR_HOME/memory/`, but `0004-hoard-and-realms` put the ledger at
+  `$YMIR_HOME/hodd/memory/` — a fa
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-no-blue-the-forge-language-replaces-the-old-blue.md

@@ -0,0 +1,26 @@
+## runtime · unversioned · 2026-09-16 — NO BLUE: the forge language replaces the old blue
+
+### Why
+The blue had a name. It was the platform's own house tint, `--ymir-house-ymirlabs:
+#38bdf8`, carried into every surface that wears Ymir's colours — the login, the
+emblem, the realm data, the Smíðja chrome. The design doctrine (homepage repo,
+`DESIGN-UNIFICATION-PLAN.md`) says the landing page **is** the language, and that
+language is **forge**: stone ground (`#0e0c09`), bronze accent (`#c9973f`), bone
+text (`#cfc3a9`).
+
+- `midgard/design-system/tokens.css` — the house tint is bronze now, with the
+  reason recorded in the token itself.
+- The blue's footprints removed: `Emblem.tsx`, `state/store.ts`, `data/realms.ts`
+  (Hlidskjalf), `style.css` (Smíðja visualizer), and Sessrúmnir's terminal accent
+  fallback.
+- Both built stylesheets rebuilt and verified: **zero blue** in the CSS the browser
+  actually receives (`apps/hlidskjalf/dist`, the visualizer's `dist`).
+- The visualizer's build was failing on my own earlier edit (unused imports left
+  when I moved `repoRootOf` into `db.ts`) — fixed, so `bun run build` is green.
+
+The canonical token home is answered by what already exists: `midgard/design-system/`
+(tokens, icons, `ymir-mark.svg`, `icons.md`) — one source the apps import, so a
+colour changes once.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-omarchy-first-host-aware-windows-and-macos-get-a-door.md

@@ -0,0 +1,25 @@
+## runtime · unversioned · 2026-09-16 — Omarchy-first, host-aware: Windows and macOS get a door
+
+### Why
+- **`bin/host-sense.sh`** — the one place that looks before anything acts. It
+  reports THIS machine: distro and family, kernel, arch, platform (linux · wsl ·
+  macos · windows), session (Wayland/X11), desktop, compositor, package manager,
+  and what the desktop can actually *do* — `placement`, `launcher`, `tray`. No
+  layer may assert a machine it is not standing on.
+- **Omarchy stays first-class, and is now gated.** `bin/omarchy-sense.sh` opens
+  by asserting *"Ymir runs on an Omarchy host"*; on any other host it now skips
+  cleanly and points at `bin/host-sense.sh`, rather than recording the wrong
+  machine. That is Rule 05's own rule: a layer is gated on its host.
+- **Windows has a door:** `bin/bootstrap-windows.ps1` — enables WSL2, installs
+  Ubuntu, then hands the work to `bin/ymir-install.sh` inside the distro. It is
+  honest about needing elevation and about the one reboot a fresh machine needs.
+- **macOS has a door:** `bin/bootstrap-macos.sh` — raises Ubuntu in a Lima VM and
+  installs Ymir inside it, plus `packaging/macos/Ymir Installer.command`, a
+  double-clickable launcher for an operator who should not need a terminal.
+- **The installers themselves:** `packaging/build.sh --exe|--mac|--check`, the
+  NSIS script `packaging/windows/ymir-setup.nsi` (→ `Ymir-Setup.exe`), and
+  `.github/workflows/ymir-installers.yml`, which builds the exe on an Ubuntu
+  runner (NSIS is 
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-smi-ja-moves-into-the-app-tree.md

@@ -0,0 +1,17 @@
+## runtime · unversioned · 2026-09-16 — Smiðja moves into the app tree
+
+### Why
+- **The smithy is an app.** Its 148 source files moved from
+  `.agents/skills/smidja-factory/` to `apps/smidja-factory/`, joining
+  hlidskjalf, odrerir and sessrumnir under `apps/`.
+- **Path-transparent.** `.agents/skills/smidja-factory` is now a symlink to
+  `../../apps/smidja-factory`, so every existing path resolves unchanged —
+  `scripts/start.sh`, `bin/ymir-install.sh`, `bin/ymir-validate.sh`, and the
+  skill loader (`.agents/skills` is a skills path). `node_modules/` stays
+  gitignored and is not carried.
+- **Still open** (recorded, not done): the root `smidja/` runtime tree
+  Amendment A would move to `apps/smidja/`, and Amendment C's per-app GitHub
+  repos and npm publishing.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-the-changelog-guard-no-push-ships-untold.md

@@ -0,0 +1,19 @@
+## runtime · unversioned · 2026-09-16 — the changelog guard: no push ships untold
+
+### Why
+- **Every push carries a CHANGELOG entry.** `bin/changelog-guard.sh` installs a
+  pre-push hook that reads the refs git hands it, resolves the range being
+  pushed, and refuses the push when `CHANGELOG.md` is untouched in that range.
+  A change that ships is a change that was told; the record can no longer lag
+  silently behind the code.
+- **Rule 08 extracted and versioned.** The protected-branch check that lived
+  only inside the ad-hoc `.git/hooks/pre-push` is now `bin/branch-guard.sh`, so
+  the delivery gate is reproducible: `bin/changelog-guard.sh --install` writes
+  the pre-push that runs both guards.
+- **Escape hatch, deliberate and loud.** `YMIR_SKIP_CHANGELOG_GUARD=1 git push`
+  when an entry truly does not belong.
+- Checks by hand: `bin/changelog-guard.sh --range A..B`,
+  `bin/branch-guard.sh --branch main`.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-the-core-senses-the-real-host-not-omarchy-s-shadow.md

@@ -0,0 +1,23 @@
+## runtime · unversioned · 2026-09-16 — the core senses the real host, not Omarchy's shadow
+
+### Why
+- **`bin/ymir-install.sh` `step_host` ran the wrong sensor.** The core host step
+  called `bin/omarchy-sense.sh` — the **Omarchy-only** sensor — so on any
+  non-Omarchy host it learnt nothing and printed the sensor's own SKIP row as a
+  host snapshot: `host snapshot:   sensor,SKIP,not an Omarchy host…`. On a Fedora
+  workstation that is the whole discovery step, reporting a skip as fact.
+- **Now it senses THIS machine with `bin/host-sense.sh`** — the portable sensor
+  (the same one behind `ymir sense`) — on **every** host (Rule 05). Recording
+  stays the Omarchy layer's job: `omarchy-sense observe`, the post-update hook,
+  desktop placement, the plugin offer, and the alarm channel remain gated behind
+  `step_omarchy`. Nothing here assumes Omarchy; nothing here skips the core
+  machine either.
+- `step_host` no longer branches on `--check`; it senses once and reports once:
+  `host sensed: <os> / <id> / <family> / <session> / <desktop>`.
+- The owning asset reflects it in the same change:
+  `.agents/skills/galdr-ymirsystem/assets/installation.md` — the `host` step row,
+  the Verify list, the two-layer table (recording, not learning), and the
+  "Omarchy branches" note.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-the-hearth-spreads-one-fire-three-more-surfaces.md

@@ -0,0 +1,25 @@
+## runtime · unversioned · 2026-09-16 — the hearth spreads: one fire, three more surfaces
+
+### Why
+Sessrúmnir's fire is now shared rather than copied. `midgard/design-system/ember.js`
+is the framework-neutral original (the land page's Ginnungagap embers: 30 rising
+with a gentle sway over six drifting haze pools), with `ember.d.ts` for TypeScript
+consumers and a reader who asked for less motion gets a **still frame** instead of
+an animation.
+
+Wired, and built:
+
+- **Hlidskjalf** — `src/components/EmberBackground.tsx` imports the shared module;
+  mounted behind the *login* and behind the *shell*, so the door and the hall burn
+  over one hearth.
+- **Smíðja visualizer** — a `<canvas class="ember-bg">` behind every view.
+- **Óðrerir** — a `data-ember` canvas in its shell, so the hall warms too.
+- Sessrúmnir keeps its own React port untouched (two ports of one fire, the same
+  physics; consolidating them on the shared module is the next tidy).
+
+And the reference for the missing furniture: **Óðrerir already carries it all** —
+four favicons, `mask-icon` in bronze, `site.webmanifest`, canonical, description,
+theme-colour and Open Graph. The other apps should be brought up to *it*.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-the-loader-stops-deleting-merge-never-overwrite.md

@@ -0,0 +1,27 @@
+## runtime · unversioned · 2026-09-16 — the loader stops deleting: merge, never overwrite
+
+### Why
+- **Root cause of the Apodex-provider loss, mended at the source.** Two writers
+  share the untracked `opencode.json`: `bin/valknut-load.sh` (structure, from
+  `opencode.json.example`) and `bin/agents-config.sh apply` (the roster —
+  providers and per-agent models, from `config/agents.yaml`). The loader
+  re-rendered with `sed` + `mv`, so because the example carried only
+  `llama.cpp`, **every loader run silently deleted the Apodex provider** that
+  lived only in the live file. `config_out` now merges deep and
+  `setdefault`-style: missing keys are added, existing ones are never
+  overwritten, and the skills path is ensured. Verified by wiping the provider
+  by hand: the next run reports `merged(provider.apodex)` and restores it, while
+  an unrelated hand-added key survives untouched. Seeding happens only when the
+  file is absent.
+- **The changelog guard still bites, without punishing a follow-up.** The
+  pre-push guard now accepts either the pushed range touching `CHANGELOG.md` or
+  the branch's whole range since it left the trunk touching it — a commit that
+  merely lands a file the record already tells needs no micro-entry. A branch
+  whose entire range leaves untold is still refused.
+- `bin/valknut-load.sh --status` reports the config outcome
+  (`seeded` · `merged(…)` · `unchanged` · `kept`), so a silent stomp can never
+  hide behind a "rendered" line again.
+- `harness-int
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-16-the-mesh-reaches-teams-and-anchor-and-show-stops-guessin.md

@@ -0,0 +1,24 @@
+## runtime · unversioned · 2026-09-16 — the mesh reaches Teams and Anchor, and `show` stops guessing
+
+### Why
+`bin/a2a-mcp.sh` wired only the well (`engram`) and the mesh (`a2abridge`). The
+**Teams** plane and **Anchor** memory existed only in the operator's personal
+harness config, so no agent *inside* Ymir could see tickets or anchored memory —
+and `a2a-mcp.sh show` insisted on a **fixed** server list, reporting
+`wayofteams-mcp not on PATH` even when the plane was wired and working.
+
+- **Remote MCP servers, URL-driven.** `bin/a2a-mcp.sh` now wires `wayofteams`
+  (from `WAYOFTEAMS_MCP_URL`) and `way-of-anchor-sse` (from `ANCHOR_MCP_URL`).
+  OpenCode gets them natively (`type: remote`); Pi, which has no remote
+  transport, gets them through the `mcp-remote` stdio bridge. A URL wins over a
+  local `wayofteams-mcp` binary when both exist. The URLs are credential-ish and
+  live in the private platform env — never the tracked tree.
+- **`show` reports what is actually wired.** It enumerates every key present in
+  Pi's `mcpServers` and OpenCode's `mcp` (union with what this run would add), so
+  a hand-added or previously-installed server is visible, and the hint only fires
+  when Teams/Anchor is genuinely absent.
+- `galdr-reread`: `assets/harness-integration/README.md` — the MCP scope is now
+  well · mesh · Teams · Anchor, with the two env keys named.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-0-1-10-the-hall-answers-on-its-port-and-the-marks-land.md

@@ -0,0 +1,15 @@
+## runtime · unversioned · 2026-09-17 — 0.1.10: the hall answers on its port, and the marks land
+
+### Why
+- **The SPA listens where it is asked.** A bare `npm run dev` let Vite take 5173,
+  so `:3888` answered nothing in either shape; a packaged tree now serves its built
+  `./dist` and every shape passes `--port "$HLIDSKJALF_PORT" --strictPort`.
+- **Óðrerir resolves** through `bin/app-lib.sh` instead of the clone's `apps/`.
+- **The launcher entries and rune icons land on any Linux desktop** — the
+  freedesktop half of desktop integration is no longer behind Omarchy's gate, so a
+  GNOME operator gets marks at all.
+- **The version a user went from and to** is said once, on the first run after an
+  update: *the tree moved 0.1.9 → 0.1.10*.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-0-1-11-four-surfaces-their-marks-and-a-door-that-mends.md

@@ -0,0 +1,18 @@
+## runtime · unversioned · 2026-09-17 — 0.1.11: four surfaces, their marks, and a door that mends
+
+### Why
+- **All four surfaces rise from one npm install** — Hlidskjalf `:3888`, Óðrerir
+  `:4322`, the board `:8437`, and Sessrúmnir in its own window; the installer's
+  desktop step opens one window per surface.
+- **All four launcher marks land** — the rune glyphs ship in the package
+  (`midgard/design-system/`), the mint resolves a packaged app, the apps'
+  templates are written before the rune marks so the themed name stands, and a
+  retired name is swept from the launcher.
+- **`ymir hlidskjalf` mends the Electron runtime itself** before refusing, because
+  npm gates install scripts and a fresh user could otherwise have no window at all.
+- **Every notice can be silenced once and remembered** — `ymir config notice
+  version|patience|next|hints off`.
+- **Óðrerir serves its build** from a package, and says what failed when it cannot.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-glitnir-stops-hanging-and-one-process-is-one-row.md

@@ -0,0 +1,15 @@
+## runtime · unversioned · 2026-09-17 — Glitnir stops hanging, and one process is one row
+
+### Why
+- **`/api/reviews` ran two 60-second shell checks on every poll**, so the review board
+  hung for a minute and read as a dead surface. It is memoised for a minute now, the
+  same discipline the usage endpoint already follows: a board a human reads does not
+  need an answer fresher than its own usefulness.
+- **`/api/processes` returns the same id twice** — `systemd:dbus` arrives from two
+  sources, 45 entries for 44 processes. The panel dedupes by id, so a repeated process
+  renders as the one process it is, and React is no longer handed a duplicate key.
+  The duplicate at the source is recorded, not hidden.
+- `/api/stream` answers 200; the live stream is not broken, it was the window.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-main-is-repaired-and-the-report-wears-the-cloth.md

@@ -0,0 +1,25 @@
+## runtime · unversioned · 2026-09-17 — main is repaired, and the report wears the cloth
+
+### Why
+- **Main was broken and nobody had noticed.** A merge resolved by hand
+  (`4dd7273`, from a parallel branch) kept *both* sides of a conflict in
+  `bin/ymir-install.sh` and `scripts/start.sh`: a stray `<`, a duplicated step
+  line, orphaned comments, an `if` with no `fi`. The installer could not parse at
+  all — `bash -n` failed on main — and PR #53's merge carried the breakage
+  forward. Both files are restored from the last revision that parses (`5b7fc66`),
+  with the two fixes that revision predated re-applied: the `--phase` value is
+  consumed, and `--yes | --non-interactive | --accept-all-defaults` are one thing.
+  Every runtime script parses again; the installer's plan runs.
+- **The lesson worth keeping:** a merge is not a place to guess. When both sides
+  of a conflict are real, the resolution is a decision — and `bash -n` on every
+  runtime script is cheap enough to be part of it.
+- **The validate report wears the cloth** — the same rows rendered for the eye on
+  stderr (marks, colour, and a verdict with the next step) while the TOON stays
+  the data on stdout. It found real drift while it was being written: the SPA down
+  on `:3888`, Nornir cron stopped, `sessrumnir`, `mcp` and `hoard` broken.
+- **Eir watches the shells.** A new surface reports the desktop shells' runtime
+  through `bin/electron-lib.sh` — a *partial* Electron runtime is exactly the
+  quiet failure Eir e
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-not-again-and-four-surfaces-in-one-raise.md

@@ -0,0 +1,26 @@
+## runtime · unversioned · 2026-09-17 — "not again", and four surfaces in one raise
+
+### Why
+- **Every notice can be silenced.** A line is information once and noise the
+  tenth: the version that moved, the long-hour words, the next-steps block, the
+  hints. Each now says so **once** in the cloth's faint voice — *not again:
+  `ymir config notice version off`* — and the preference is recorded in the
+  operator's settings, honoured by the shell cloth and the CLI alike. `ymir config
+  show` is the door; four keys: `version · patience · next · hints`.
+- **The package carries the design system.** It never shipped `midgard/`, so the
+  rune glyphs — the icons themselves — were absent and every mark failed with
+  *no glyph ansuz*. `midgard/design-system/` is in `files[]` now: 30 files, 22
+  glyphs.
+- **The marks are written in the right order.** The apps' own launcher templates
+  landed *after* the rune marks and overwrote the themed name with an absolute
+  `.png`; the templates go first now and the rune marks stand over them.
+- **Óðrerir rises from a package.** Its published tarball carries `dist` and a
+  `dev` command that calls a script it does not carry, so `npm run dev` could never
+  work from a package — the hall serves its **build** (`astro preview`) where there
+  is one, exactly as the SPA does. And its dependencies' absence is no longer
+  silent: the hall says what failed and why.
+- **Four surfaces, one raise.** `ymir raise` lifts the SPA, Óðrerir, the board and
+  Ses
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-smoke-test-all-ui-two-checks-that-lied-about-their-own-s.md

@@ -0,0 +1,20 @@
+## runtime · unversioned · 2026-09-17 — smoke test all UI: two checks that lied about their own subjects
+
+### Why
+- **The truth gate failed on my own change.** It demanded the connector's total equal
+  the herdr pane count; the connector is roster-first now, so it legitimately reports
+  agents AND seats (33 vs 13 panes). Panes are a subset of what the board must show.
+  Corrected: a FAIL now means FEWER entries than panes — a standing seat hidden from
+  the board — which is the fault worth catching. **Verdict: PASS.**
+- **The smoke test reported a present database absent.** It looked for the smithy's db
+  at the repo path; the runtime keeps it under `$YMIR_HOME/smidja/`, which is where
+  the bootstrap and the gate both resolve it. Same wound as Skrymir and the well: the
+  check and the owner disagreeing about where the record lives. **Now: OK, 8 tables.**
+- **Smoke test all UI: 5/5 OK** — spa, api, well, smidja-db, loaders. Truth gate: PASS.
+
+Also mended in the same pass: `StatusChip` read `STATUS_META[status].tone`, and the
+fleet now reports a status it was never taught (`seated`), so an unknown status threw
+and killed the gate. An unknown status can no longer take a panel down.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-the-changelog-stops-conflicting-fragments-folded-by-a-sc.md

@@ -0,0 +1,25 @@
+## runtime · unversioned · 2026-09-17 — the changelog stops conflicting: fragments, folded by a script
+
+### Why
+- **The problem, measured.** `CHANGELOG.md` is one file and every branch appends
+  at the same position — the top. Git sees two branches inserting different lines
+  at the same spot and calls it a conflict, so **every merge re-conflicts every
+  open branch**. Sixteen open PRs were each resolved by hand for this reason
+  alone, and each merge re-conflicted the rest: O(N²) meaningless conflicts.
+- **The fix — `CHANGELOG.d/`.** A change adds **one file with a unique name**
+  (`<YYYY-MM-DD>-<slug>.md`) instead of editing the ledger. Two branches never
+  touch the same fragment, so the collision cannot occur.
+- **`bin/changelog-assemble.sh`** folds fragments into `CHANGELOG.md` — newest
+  first, above everything already recorded. Folding is an **append**: existing
+  entries are copied verbatim, never reordered, never rewritten. `--dry-run`
+  shows what would fold; `--check` exits 1 when fragments are unfolded.
+- **The pre-push hook folds first.** `bin/changelog-guard.sh --install` now
+  writes a hook that runs the assembler before the guards, so a push never leaves
+  fragments unfolded; if folding changes the ledger the push is refused until the
+  fold is committed.
+- **The guard accepts either form.** A push satisfies the duty by appending to
+  `CHANGELOG.md` **or** by adding a fragment. The refusal message now names both.
+- **Rule 06 is amended, append-only** — the clause stands; 
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-the-doors-written-down-where-a-user-will-find-them.md

@@ -0,0 +1,20 @@
+## runtime · unversioned · 2026-09-17 — the doors, written down where a user will find them
+
+### Why
+- **`README.md` gains "After it installs — the doors"**: the two commands on PATH,
+  the twelve doors on `ymir`, the lawless name that answers once and points at the
+  lawful one, the patience words in full, and a section on **both shapes** — a
+  clone and a package, with one resolver and one rule (colour for the eye, TOON
+  for the pipe).
+- **The skills that must know are taught.** Galdr's `assets/installation.md` gains
+  the shape table, the eighteen converted call sites, and the trap that named
+  itself (`printf -v` writes to the function's scope — scratch names are
+  function-prefixed for that reason). The `ymir-host` skill's `assets/install.md`
+  gains the doors and how to exercise the *other* shape without a second machine
+  (`YMIR_ROOT_DIR`). The `groa-update` skill gains the step that matters after
+  every update: **re-check where the apps live** — a shape assumption is a bug
+  that only shows itself on the other shape — and say the long hour in the house's
+  voice.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-the-duplicate-extensions-removed-from-the-project-tree.md

@@ -0,0 +1,17 @@
+## runtime · unversioned · 2026-09-17 — the duplicate extensions removed from the project tree
+
+### Why
+- **The fault, now measured exactly.** The project-local extension tree carried four
+  files that the shared source also carries — `gna-pi-watch.ts`, `ro.ts`,
+  `skuld-branch-supervision.ts`, `syn-turnend-guard.ts`. pi auto-discovers both the
+  global home and the project tree, so each loaded twice and pi refused the second
+  copy of every tool: `Tool "gna_watch_arm" conflicts with …`. Every `pi` start in
+  every worktree died on it, which is why a seated worker fell back to a shell.
+- **The fix:** those four files are gone from the project tree. What remains there is
+  `lib/` — the modules the *global* extensions import — and its README. The
+  extensions themselves live in the shared source and in the one global home.
+- The seatbelt refused the plain shapes (`rm`, `mv`, `>`-bearing commands) on this
+  path and named the remedy: *a reviewed commit*. This is that commit.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-the-extensions-deployed-without-their-modules.md

@@ -0,0 +1,23 @@
+## runtime · unversioned · 2026-09-17 — the extensions deployed without their modules
+
+### Why
+- **pi would not start a seated worker, and the reason was a half-deploy.**
+  The four shared pi extensions all reported
+  `Failed to load extension: Cannot find module ./lib/<module>.ts` — and every one
+  of those modules was present in the repo, one level away under the extensions'
+  own `lib/`. The loader copied the top-level extension files and never their
+  supporting modules.
+- **Mended in two places.** (1) The missing modules are now beside the deployed
+  extensions, so a running pi loads all four. (2) `bin/valknut-load.sh` — the
+  loader — now deploys that lib alongside the extensions, idempotently (identical
+  files untouched), so a fresh machine cannot hit it. A deploy that copies a file
+  but not the module it imports is not a deploy.
+- **What this cost:** the Forseti audit was seated on a **local** model, and the
+  pane fell back to a bare shell when pi could not start — which is why the brief
+  was typed at a prompt and answered `bash: syntax error near unexpected token '('`.
+  With the extensions mended, pi's remaining blocker is the model: the llama-router
+  has no raisable seat tonight (`:8080` unbound, and the installed llama.cpp cannot
+  load the Apodex weights), so a local-first dispatch has nothing to reach.
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*

package/docs/fixes/runtime/unversioned-2026-09-17-the-feed-follows-brokk-s-thinking-past-the-composer.md

@@ -0,0 +1,17 @@
+## runtime · unversioned · 2026-09-17 — the feed follows Brokk's thinking past the composer
+
+### Why
+- **Sessrúmnir's auto-scroll never counted streamed THINKING as growth.**
+  `useChatScroll` watched `messages` and `streamingContent` only, so a
+  reasoning-heavy turn (thinking before any visible content) grew the feed
+  without moving it — the thinking block ended up below the floating composer,
+  behind it, and the Allfather had to scroll down to read it.
+- **The growth signal now also includes `streamingThinking` and streaming tool
+  calls.** While Brokk reasons, the feed keeps the thinking tail in view above
+  the composer (still only when Auto Scroll is on and the reader is at the
+  bottom — scrolling up to re-read never gets yanked).
+- Live hall updated: rebuilt renderer delivered to the running Sessrúmnir and
+  the app restarted via `bin/sessrumnir.sh` (window back on workspace 8).
+
+### Files
+- *(carried from the frozen CHANGELOG.md)*