@zerwiz/ymir 0.1.5 → 0.1.7

package/bin/public-guard.sh

@@ -43,8 +43,9 @@ leaks() {  # stdin → prints masked hits, returns 1 on any
 scan_one() {  # $1 = path in the index; prints a finding, returns 1 when clean
   local f="$1" out
   # This file necessarily contains the patterns it looks for; scanning it would
-  # always fail. Exempt by name, and keep the patterns here honest.
-  case "$f" in bin/public-guard.sh|bin/secret-guard.sh) return 0 ;; esac
+  # always fail. The same is true of every guard whose job is to name a secret
+  # shape, so all three are exempt by name — and the patterns in them stay honest.
+  case "$f" in bin/public-guard.sh|bin/secret-guard.sh|bin/hoard-guard.sh) return 0 ;; esac
   printf '%s\n' "$f" | grep -Eq "$PUBLIC" || return 0
   printf '%s\n' "$f" | grep -Eq "$APPEND_ONLY" && return 0
   out="$(git -C "$ROOT" show ":$f" 2>/dev/null | leaks)" || true

package/bin/sessrumnir-ensure.sh

@@ -90,7 +90,7 @@ case "$CMD" in
     if [ "$DO_INSTALL" = 1 ]; then
       npm_install || true
       ensure_electron_binary || true
-      [ "$built_present" ] || build_app || true
+      built_present || build_app || true
       status
       exit $?
     fi

package/bin/sessrumnir.sh

@@ -14,9 +14,22 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 APP="$ROOT/apps/sessrumnir"
-PID_FILE="$ROOT/state/sessrumnir.pid"
-LOG_FILE="$ROOT/state/sessrumnir.log"
+PID_FILE="$YMIR_STATE_DIR/sessrumnir.pid"
+LOG_FILE="$YMIR_STATE_DIR/sessrumnir.log"
 
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help|"") sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
 ACTION="${1:-start}"; shift || true
@@ -72,7 +85,7 @@ fi
   exit 1
 }
 
-mkdir -p "$ROOT/state"
+mkdir -p "$YMIR_STATE_DIR"
 args=()
 [ -n "$WORKSPACE" ] && args+=("$WORKSPACE")
 

package/bin/smidja-bootstrap.sh

@@ -69,7 +69,11 @@ if command -v uv >/dev/null 2>&1; then
       python3 -c '
 import os, sys
 from pathlib import Path
-sys.path.insert(0, str(Path.cwd() / "smidja"))
+root = Path.cwd()
+for sub in ("apps/smidja", "smidja"):
+    p = root / sub
+    if (p / "smidja_modules").is_dir():
+        sys.path.insert(0, str(p)); break
 from smidja_modules.tracer import Tracer
 db = os.environ["SMIDJA_BS_DB"]
 events = str(Path(db).parent / "sessions" / "bootstrap" / "events.jsonl")

package/bin/syn-asset-pretool-check.sh

@@ -16,7 +16,20 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-READS="${SYN_ASSET_READS:-$ROOT/state/asset-reads}"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+READS="${SYN_ASSET_READS:-$YMIR_STATE_DIR/asset-reads}"
 TARGET=""; NOTE=""
 while [ $# -gt 0 ]; do
   case "$1" in

package/bin/syn-spawn-pretool-check.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# syn-spawn-pretool-check.sh - PreToolUse seatbelt for spawning and for typing.
+#
+# Sýn guards how workers are raised. The failure this exists to end, observed
+# live: an agent (me) hand-fired `herdr-run.sh eindri`, then delivered the brief
+# by TYPING it into the pane — and when the agent had already exited the brief
+# was typed into **bash**, where it sat as a command. Workers were "sent" and
+# never started, and text was executed in a shell. One door exists for this and
+# it is `bin/einherjar-spawn.sh` (firstmate's `fm-spawn.sh`, ported): it creates
+# the worktree, records `state/<id>.meta`, and fails closed on an unverified
+# harness.
+#
+# Usage: syn-spawn-pretool-check.sh --command <bash command>
+# Exit:  0 = allow, 2 = block (stderr carries the reason and the remedy)
+set -u
+
+command_text=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --command) command_text=${2-}; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+# 1. Never type into a pane. A brief is not keystrokes: typing lands in whatever
+#    owns the pane, and when the agent has exited that is the shell.
+case "$command_text" in
+  *"pane input"*|*"send-keys"*|*"pane type"*)
+    printf 'denied: do not type into a pane — a brief delivered as keystrokes lands in whatever owns it (a shell, once the agent has exited)\n' >&2
+    printf 'help: seat the worker through the door: bin/einherjar-spawn.sh <task-id> <project-dir> --mode local-only --harness opencode --model <model> --backend herdr\n' >&2
+    exit 2 ;;
+esac
+
+# 2. Never hand-raise an Eindri. `herdr-run.sh run` (a command in a pane) is
+#    fine; raising a WORKER by hand is not — it skips the worktree, the meta
+#    record, and the harness verification.
+case "$command_text" in
+  *"herdr-run.sh eindri"*|*"herdr-run.sh agent"*)
+    printf 'denied: an Eindri is raised through the door, not by hand — herdr-run.sh eindri skips the worktree, state/<id>.meta, and the harness check\n' >&2
+    printf 'help: bin/einherjar-spawn.sh <task-id> <project-dir> --mode <direct-PR|local-only|no-mistakes> [--harness <name>] [--model <name>] [--backend tmux|herdr]\n' >&2
+    exit 2 ;;
+esac
+
+# 3. A LOCAL model needs a live local server. Requesting one while the router is
+#    down is how a seat came up, errored, and left a shell behind.
+case "$command_text" in
+  *"einherjar-spawn.sh"*)
+    case "$command_text" in
+      *"llama-cpp/"*|*"llama.cpp/"*|*"lmstudio/"*|*"ollama/"*)
+        if ! (exec 3<>/dev/tcp/127.0.0.1/8080) 2>/dev/null; then
+          printf 'denied: a local model was requested but no local server answers on :8080 — the worker will start, fail, and leave a shell\n' >&2
+          printf 'help: raise the llama-router (bin/models-detect.sh reports what is served), or seat the worker on an online model\n' >&2
+          exit 2
+        fi ;;
+    esac ;;
+esac
+
+exit 0

package/bin/tailscale-sync.sh

@@ -16,7 +16,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-CFG="${YMIR_TAILSCALE_SYNC:-$ROOT/config/tailscale-sync.yaml}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+CFG="${YMIR_TAILSCALE_SYNC:-$YMIR_SETTINGS_DIR/tailscale-sync.yaml}"
 DRY=0; ACTION=""; PEER=""
 
 for a in "$@"; do
@@ -62,7 +75,7 @@ except Exception: pass' 2>/dev/null)"
 fi
 
 if [ "$ACTION" = init ]; then
-  TPL="$ROOT/config/tailscale-sync.example.yaml"
+  TPL="$YMIR_SETTINGS_DIR/tailscale-sync.example.yaml"
   if [ -r "$CFG" ]; then printf 'tailscale-sync[1]{action,state}:\n  "init","kept — %s exists"\n' "$CFG"; exit 0; fi
   [ -r "$TPL" ] || { printf 'error: template missing: %s\n' "$TPL" >&2; exit 1; }
   cp "$TPL" "$CFG" && printf 'tailscale-sync[1]{action,path}:\n  "init","%s"\n' "$CFG"

package/bin/telegram-bot.sh

@@ -12,7 +12,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+ENV_FILE="${BROKK_ENV_FILE:-$YMIR_ENV_FILE}"
 
 case "${1-}" in
   -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;

package/bin/ui-truth-check.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# ui-truth-check.sh — the panel's number must equal the machine's number.
+#
+# The wiring order's last row, and the one that makes the rest trustworthy: a
+# board can render beautifully and still lie. This compares what the UI is SERVED
+# against what the machine actually holds, per source, and FAILS on a mismatch.
+#
+#   bin/ui-truth-check.sh          # compare, TOON, exit 0/1
+#   bin/ui-truth-check.sh --help
+#
+# It reads endpoints as the DESKTOP SEAT (loopback + the marker), which is the
+# trusted seat rule 09 allows — the web door would answer 401 and prove nothing
+# about the data.
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+GATE="${HLIDSKJALF_API_PORT:-3889}"
+# shellcheck source=bin/hoard-lib.sh
+. "$SCRIPT_DIR/hoard-lib.sh"
+
+case "${1-}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help) sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+
+have() { command -v "$1" >/dev/null 2>&1; }
+have curl || { printf 'error: curl is required\nhelp: install curl\n' >&2; exit 1; }
+
+json_len() { python3 -c 'import json,sys
+try: print(len(json.load(sys.stdin)))
+except Exception: print(0)' 2>/dev/null || echo 0; }
+
+verdict="PASS"; details=""
+
+# ── the fleet: herdr vs the connector vs the endpoint ─────────────────────────
+SRC_JSON="$("$SCRIPT_DIR/hlidskjalf-agents.sh" 2>/dev/null || printf '[]')"
+src_n=$(printf '%s' "$SRC_JSON" | json_len)
+UI_JSON="$(curl -s --max-time 8 -H 'x-ymir-surface: desktop' "http://127.0.0.1:${GATE}/api/agents" 2>/dev/null || printf '[]')"
+ui_n=$(printf '%s' "$UI_JSON" | json_len)
+if have "${HERDR_BIN_PATH:-herdr}"; then
+  herd_n="$("${HERDR_BIN_PATH:-herdr}" pane list 2>/dev/null | python3 -c 'import json,sys
+try: d=json.load(sys.stdin)
+except Exception: print(0); raise SystemExit
+panes=(d.get("result") or {}).get("panes") or d.get("panes") or []
+print(sum(1 for p in panes if p.get("agent")))' 2>/dev/null || echo 0)"
+else
+  herd_n="unknown"
+fi
+[ "$src_n" = "$ui_n" ] || { verdict="FAIL"; details="$details fleet:connector=$src_n,served=$ui_n"; }
+# The connector is ROSTER-FIRST: it reports the agents (the who) and the seats (the
+# where), so its total legitimately exceeds the pane count. What must not happen is
+# FEWER entries than panes - a standing seat hidden from the board. Panes are a subset.
+[ "$herd_n" = "unknown" ] || [ "$src_n" -ge "$herd_n" ] || { verdict="FAIL"; details="$details fleet:connector=$src_n,herdr=$herd_n"; }
+
+# ── the ledger: the hoard's, against what the gate serves ─────────────────────
+hoard_root _hoard
+LEDGER="$_hoard/memory/runes_audit.md"
+ledger_n=0
+[ -r "$LEDGER" ] && ledger_n=$(grep -c '^[[:space:]]*{' "$LEDGER" 2>/dev/null || echo 0)
+UI_RUNES="$(curl -s --max-time 8 -H 'x-ymir-surface: desktop' "http://127.0.0.1:${GATE}/api/runes" 2>/dev/null || printf '[]')"
+ui_runes_n=$(printf '%s' "$UI_RUNES" | json_len)
+[ "$ledger_n" = "$ui_runes_n" ] || { verdict="FAIL"; details="$details ledger=$ledger_n,served=$ui_runes_n"; }
+
+printf 'ui_truth[6]{source,count,note}:\n'
+printf '  "herdr panes","%s","what the machine holds"\n' "$herd_n"
+printf '  "the connector","%s","bin/hlidskjalf-agents.sh"\n' "$src_n"
+printf '  "the endpoint","%s","/api/agents as the desktop seat"\n' "$ui_n"
+printf '  "ledger entries","%s","the hoard'"'"'s ledger"\n' "$ledger_n"
+printf '  "ledger served","%s","/api/runes as the desktop seat"\n' "$ui_runes_n"
+printf '  "verdict","%s","%s"\n' "$verdict" "$([ -n "$details" ] && printf 'mismatch:%s' "$details" || printf 'the board may be believed')"
+
+[ "$verdict" = "PASS" ] || { printf 'error: the UI and the machine disagree\nhelp: %s\n' "${details:-see the rows above}" >&2; exit 1; }
+exit 0

package/bin/valknut-load.sh

@@ -26,7 +26,7 @@ PI_GLOBAL="${HOME}/.pi/agent/agents"
 # seated. This loader DEPLOYS that source into the single home.
 PI_EXT_SRC="$ROOT/.pi/shared/extensions"
 PI_EXT_HOME="${HOME}/.pi/agent/extensions"
-OC_LOCAL="$ROOT/.opencode/agent"
+OC_LOCAL="$ROOT/.opencode/agents"
 SKILLS="$ROOT/.agents/skills"
 
 usage() {
@@ -167,6 +167,18 @@ fi
 
 if [ "$MODE_OPENCODE" = 1 ]; then
   add opencode-config "$ROOT/opencode.json" "$(config_out "$ROOT/opencode.json.example" "$ROOT/opencode.json")"
+  # OpenCode reads `.opencode/agents/` (PLURAL). The singular `.opencode/agent/`
+  # was never read by the harness at all — twenty correct symlinks in a directory
+  # no loader opens, which is why only the agents declared by hand in
+  # opencode.json ever appeared. Migrate a legacy singular dir forward so an old
+  # home heals instead of silently keeping its agents invisible.
+  if [ -d "$ROOT/.opencode/agent" ] && [ ! -e "$ROOT/.opencode/agents" ]; then
+    mv "$ROOT/.opencode/agent" "$ROOT/.opencode/agents" 2>/dev/null \
+      && add opencode-migrate "$ROOT/.opencode/agents" "legacy .opencode/agent/ moved to .opencode/agents/" \
+      || add opencode-migrate "$ROOT/.opencode/agents" "ERROR could not migrate"
+  fi
+  # Count what is bound here; the binding itself happens further down, after
+  # `link_agents` is defined (this block runs before that definition).
   if [ -d "$OC_LOCAL" ]; then
     n=$(ls "$OC_LOCAL"/*.md 2>/dev/null | wc -l | tr -d ' ')
     add opencode "$OC_LOCAL" "native ($n agents)"
@@ -190,6 +202,17 @@ if [ "$MODE_PI" = 1 ]; then
   # Deploy the shared extensions into their single home. Copy, not link: a
   # broken link would silently disable a tool, and pi reads the file directly.
   # Idempotent — identical files are left untouched.
+  # The CONTRACT, deployed globally: pi reads an AGENTS.md from its agent home in
+  # every session, whatever the workspace. Without this, Sessrumnir (or any pi
+  # session) started in another project loads THAT project's rules and knows
+  # nothing of Ymir - no Brokk, no laws, no lore. Symlink, so the tree stays the
+  # single source and an update is picked up with no re-install.
+  if [ -d "$HOME/.pi/agent" ]; then
+    ln -sfn "$ROOT/AGENTS.md" "$HOME/.pi/agent/AGENTS.md" 2>/dev/null \
+      && add pi-global-contract "$HOME/.pi/agent/AGENTS.md" "the Ymir contract, loaded in every pi session" \
+      || add pi-global-contract "$HOME/.pi/agent/AGENTS.md" "ERROR"
+  fi
+
   if [ -d "$PI_EXT_SRC" ]; then
     mkdir -p "$PI_EXT_HOME" 2>/dev/null
     dep_n=0
@@ -199,7 +222,22 @@ if [ "$MODE_PI" = 1 ]; then
       if [ -f "$PI_EXT_HOME/$b" ] && cmp -s "$f" "$PI_EXT_HOME/$b"; then continue; fi
       cp -f "$f" "$PI_EXT_HOME/$b" && dep_n=$((dep_n+1))
     done
-    add pi-extensions "$PI_EXT_HOME" "$dep_n deployed (shared single home)"
+    # Their supporting modules are one level away, under the extensions' own lib:
+    # the shared extensions require sibling lib modules, and deploying the
+    # top-level files ALONE ships extensions that cannot load. That is exactly
+    # what pi reported: Failed to load extension, Cannot find module ./lib/....
+    # A deploy that copies a file but not the module it imports is not a deploy.
+    PI_EXT_LIB="$ROOT/.pi/extensions/lib"
+    if [ -d "$PI_EXT_LIB" ]; then
+      mkdir -p "$PI_EXT_HOME/lib" 2>/dev/null
+      for f in "$PI_EXT_LIB"/*; do
+        [ -e "$f" ] || continue
+        b=$(basename "$f")
+        if [ -f "$PI_EXT_HOME/lib/$b" ] && cmp -s "$f" "$PI_EXT_HOME/lib/$b"; then continue; fi
+        cp -f "$f" "$PI_EXT_HOME/lib/$b" && dep_n=$((dep_n+1))
+      done
+    fi
+    add pi-extensions "$PI_EXT_HOME" "$dep_n deployed (shared single home, lib included)"
   fi
 fi
 
@@ -248,8 +286,8 @@ if [ "$MODE_STATUS" = 0 ]; then
     add "${hd#.}-agents" "$ROOT/$hd/agents" "bound ($n)"
   done
   if [ -d "$ROOT/.opencode" ]; then
-    n=$(link_agents "$ROOT/.opencode/agent" short) || n=0
-    add opencode-agents "$ROOT/.opencode/agent" "bound ($n)"
+    n=$(link_agents "$OC_LOCAL" short) || n=0
+    add opencode-agents "$OC_LOCAL" "bound ($n)"
   fi
 fi
 

package/bin/wedge-notify.sh

@@ -20,7 +20,20 @@ CHANNEL="${1:-unknown}"
 SUMMARY="${2:-}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-STATE_DIR="${BROKK_STATE_OVERRIDE:-$ROOT/state}"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+STATE_DIR="${BROKK_STATE_OVERRIDE:-$YMIR_STATE_DIR}"
 LOG="$STATE_DIR/wedge-alarm.log"
 
 # "discard" is the library-mode default so no test posts a real notification.

package/bin/workspace-rag.sh

@@ -16,8 +16,21 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 STORE="$ROOT/.agents/memory/well/workspace.jsonl"
-REALM_FILE="$ROOT/data/realm.md"
+REALM_FILE="$YMIR_DATA_DIR/realm.md"
 DEFAULT_REALM="$(head -n1 "$REALM_FILE" 2>/dev/null | tr -d '[:space:]')"
 # Never assume the company's slug: resolve the operator's realm neutrally.
 if [ -z "$DEFAULT_REALM" ]; then . "$SCRIPT_DIR/realm-lib.sh"; ymir_active_realm "$ROOT" DEFAULT_REALM; fi