fix(6872): a verdict or write-path stamp on a vanished shape revives its row instead of inserting a duplicate

classify_shapes(repo=...) and the write-path hook looked only at live rows,
so a shape whose row had vanished got a second provisional row under the
same (project, repo, path, symbol, kind). The unique constraint refused it,
and the whole classify batch was lost as a tool error.

provisional_row() now finds the row under that identity, vanished or not.
A vanished row is revived with a reappeared event and keeps its judgment.
A new row is inserted inside a savepoint, so a concurrent insert of the
same identity falls back to that row instead of failing the transaction.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -1,12 +1,12 @@
 {
-  "name": "scribe-plugin",
+  "name": "grimoire-plugin",
   "owner": { "name": "Bryan Van Deusen" },
-  "description": "Scribe ships its own Claude Code plugin from this repo, versioned in lockstep with the app + the /api/plugin/context contract.",
+  "description": "Grimoire ships its own Claude Code plugin from this repo, versioned in lockstep with the app + the /api/plugin/context contract.",
   "plugins": [
     {
-      "name": "scribe",
+      "name": "grimoire",
       "source": "./plugin",
-      "description": "Scribe second brain: MCP tools + session-start push channel + universal process-skills."
+      "description": "Grimoire second brain: MCP tools + session-start push channel + universal process-skills."
     }
   ]
 }

.env.example

@@ -1,4 +1,9 @@
+# An install created before the rename from Scribe keeps its database by
+# setting these, and PGDATA_VOLUME, to the names it was created with.
 POSTGRES_USER=fabled
 POSTGRES_PASSWORD=fabled
-POSTGRES_DB=scribe
-SECRET_KEY=dev-secret-change-me
+POSTGRES_DB=grimoire
+# PGDATA_VOLUME=grimoire_pgdata
+# Grimoire keeps its own SECRET_KEY in the /data volume. Set one here only to
+# use a key you manage yourself; it then wins over the kept one.
+# SECRET_KEY=

.forgejo/workflows/ci.yml

@@ -55,7 +55,7 @@ permissions:
 
 env:
   REGISTRY: git.fabledsword.com
-  IMAGE: git.fabledsword.com/bvandeusen/fabledscribe
+  IMAGE: git.fabledsword.com/bvandeusen/fabledgrimoire
 
 jobs:
   typecheck:
@@ -99,7 +99,7 @@ jobs:
       # version check diffs two trees, so a depth-1 fetch of main is enough.
       - uses: actions/checkout@v6
 
-      # Per-job rather than in the image: Scribe is shellcheck's only consumer.
+      # Per-job rather than in the image: Grimoire is shellcheck's only consumer.
       # Install nothing else here; the hooks use only POSIX tools, and the
       # smoke test runs on a bare image to prove it.
       - name: Install shell tooling
@@ -193,11 +193,11 @@ jobs:
         # Same image as the shipped compose files: Postgres 17 with pgvector.
         image: pgvector/pgvector:pg17
         env:
-          POSTGRES_USER: scribe
+          POSTGRES_USER: grimoire
           POSTGRES_PASSWORD: ci_integration
-          POSTGRES_DB: scribe_test
+          POSTGRES_DB: grimoire_test
         options: >-
-          --health-cmd "pg_isready -U scribe"
+          --health-cmd "pg_isready -U grimoire"
           --health-interval 10s
           --health-timeout 5s
           --health-retries 10
@@ -235,7 +235,7 @@ jobs:
           test "$(printf '%s\n' "$PG" | grep -c .)" -eq 1
           PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG")
           test -n "$PG_IP"
-          export DATABASE_URL="postgresql+asyncpg://scribe:ci_integration@${PG_IP}:5432/scribe_test"
+          export DATABASE_URL="postgresql+asyncpg://grimoire:ci_integration@${PG_IP}:5432/grimoire_test"
           # Wait for Postgres. The run: shell is dash (no bash /dev/tcp), so use Python.
           /opt/venv/bin/python - "$PG_IP" <<'PY'
           import socket, sys, time
@@ -315,12 +315,10 @@ jobs:
           echo "build_key=$BUILD_KEY" >> $GITHUB_OUTPUT
           echo "channel=$CHANNEL" >> $GITHUB_OUTPUT
 
-      - name: Free disk space
-        # Prunes unused containers and images, and caps the BuildKit cache at
-        # 5 GB so the package caches survive but old layers don't pile up.
-        run: |
-          docker system prune -af || true
-          docker builder prune --keep-storage 5g -f || true
+      # No disk-space prune step: the runner's Docker daemon is shared, and
+      # `docker system prune -af` here deleted images other repos' jobs had
+      # just pulled and were about to start (CI-runner #16). The runner host
+      # prunes nightly instead.
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

Dockerfile

@@ -31,7 +31,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # alembic and hypercorn in CMD have to be found there.
 ENV PATH="/app/.venv/bin:$PATH"
 
-COPY --from=build-frontend /build/dist/ src/scribe/static/
+COPY --from=build-frontend /build/dist/ src/grimoire/static/
 COPY alembic.ini .
 COPY alembic/ alembic/
 
@@ -56,5 +56,9 @@ ENV APP_BUILD_KEY=$BUILD_KEY
 ENV APP_CHANNEL=$BUILD_CHANNEL
 ENV APP_COMMIT=$BUILD_COMMIT
 
+# The instance's own SECRET_KEY, the model cache and diagnostics live here.
+# Mount a volume on it so they outlive the container.
+RUN mkdir -p /data
+
 EXPOSE 5000
-CMD ["sh", "-c", "alembic upgrade head && hypercorn 'scribe.app:create_app()' --bind 0.0.0.0:5000 --keep-alive 600"]
+CMD ["sh", "-c", "alembic upgrade head && hypercorn 'grimoire.app:create_app()' --bind 0.0.0.0:5000 --keep-alive 600"]

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

Makefile

@@ -3,22 +3,22 @@
 # --- Docker ---
 
 build:
-	docker compose build
+	docker compose -f docker-compose.dev.yml build
 
 up:
-	docker compose up -d
+	docker compose -f docker-compose.dev.yml up -d
 
 down:
-	docker compose down
+	docker compose -f docker-compose.dev.yml down
 
 logs:
-	docker compose logs -f
+	docker compose -f docker-compose.dev.yml logs -f
 
 health:
 	curl -s http://localhost:5000/api/health
 
 migrate:
-	docker compose exec app alembic upgrade head
+	docker compose -f docker-compose.dev.yml exec app alembic upgrade head
 
 # --- Local dev (requires: uv sync --extra dev and cd frontend && npm ci) ---
 

README.md

@@ -1,42 +1,150 @@
-# Fabled Scribe
+<p align="center">
+  <img src="frontend/public/favicon.svg" width="96" alt="">
+</p>
 
-A self-hosted work system-of-record for software projects, built to be driven by Claude Code. Notes, tasks, issues, projects, milestones, rules, and stored processes — reachable from Claude via a built-in MCP endpoint and a bundled Claude Code plugin, with a clean web UI for humans. No in-app LLM; Claude is the sole assistant.
+<h1 align="center">Fabled Grimoire</h1>
+
+<p align="center">A self-hosted system of record for the work you do with Claude Code.</p>
+
+Claude records what it learned, decided and built in Grimoire, and that record reaches the next session, so a solution is recalled instead of reinvented. Notes, tasks, plans, rules, lessons and reusable code live in one place. Claude reaches them through a built-in MCP endpoint and the bundled Claude Code plugin, and people read and edit the same records in the web UI. There is no language model inside Grimoire: Claude is the only assistant.
+
+## Deploy
+
+You need Docker with Compose. Save this as `docker-compose.yml` (it is the [`docker-compose.yml`](docker-compose.yml) in this repository), then run `docker compose up -d` beside it:
+
+```yaml
+# Fabled Grimoire: the app and its database.
+#   docker compose up -d
+# Then open http://localhost:5000. The first account registered becomes admin.
+#
+# Keep both volumes. app_data holds the instance's own SECRET_KEY, which seals
+# saved credentials; pgdata holds everything else.
+
+services:
+  app:
+    image: git.fabledsword.com/bvandeusen/fabledgrimoire:latest
+    ports:
+      - "5000:5000"
+    environment:
+      DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-grimoire}:${POSTGRES_PASSWORD:-grimoire}@db:5432/${POSTGRES_DB:-grimoire}"
+      LOG_LEVEL: "${LOG_LEVEL:-INFO}"
+      # Port 5000 is published straight to clients, so no proxy is trusted.
+      # Behind a reverse proxy, set 1 (one per proxy) and BASE_URL:
+      TRUSTED_PROXY_HOPS: "0"
+      # BASE_URL: "https://grimoire.example.com"
+    volumes:
+      - app_data:/data
+    depends_on:
+      - db
+    restart: unless-stopped
+
+  db:
+    # Postgres 17 with the vector extension Grimoire needs.
+    image: pgvector/pgvector:pg17
+    stop_grace_period: 120s
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-grimoire}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-grimoire}
+      POSTGRES_DB: ${POSTGRES_DB:-grimoire}
+    restart: unless-stopped
+
+volumes:
+  app_data:
+  pgdata:
+```
+
+Open `http://localhost:5000`. The first account you register becomes the admin.
+
+Nothing has to be set first. On its first start Grimoire makes its own `SECRET_KEY` and keeps it in the `app_data` volume, so restarts, reboots and updates all use the same key.
+
+To connect Claude, create an API key under **Settings → MCP Access**, then in Claude Code:
+
+```
+/plugin marketplace add https://git.fabledsword.com/bvandeusen/FabledGrimoire.git
+/plugin install grimoire@grimoire-plugin
+```
+
+The plugin asks for your Grimoire URL and the API key. Settings → MCP Access shows the exact commands for your instance.
+
+## Configuration
+
+Everything is optional. Set these in the environment or in a `.env` file beside the compose file:
+
+| Variable | When | What it does |
+|----------|------|--------------|
+| `BASE_URL` | Behind a proxy | The public URL, used in email links and SSO redirects |
+| `TRUSTED_PROXY_HOPS` | Rarely | The starting count of reverse proxies in front of Grimoire (default `1`; the compose file above sets `0` because it publishes the port directly). Check and change it in **Settings → Config → Reverse proxy**, which shows what each count reads for your own request; behind Cloudflare it is usually `2` |
+| `POSTGRES_PASSWORD` | Before the first start | The database password (defaults to `grimoire`; the database is reachable only inside the compose network). Postgres takes it once, when the volume is created |
+| `SECRET_KEY` | Rarely | A key you manage yourself, instead of the one Grimoire keeps. It wins over the kept key; remove it to go back |
+
+Everything else (registration, email, SSO, git forge connections, retrieval tuning, backups) is in **Settings**, or listed in [Configuration](docs/configuration.md).
+
+## Setup pitfalls
+
+- **Keep both volumes.** `pgdata` holds everything Grimoire stores. `app_data` holds the instance's key, and forge tokens and the backup bucket's secret are sealed under it. If the key is lost, Settings asks you to enter those credentials again; nothing else is lost.
+- **The embedding model downloads on first use**, into the `app_data` volume. Without internet access, semantic search falls back to keyword search until the model is in place.
+- **Behind a reverse proxy, turn off response buffering** for `/mcp`, because MCP responses stream. [Configuration](docs/configuration.md#behind-a-reverse-proxy) has an Nginx example.
+
+## Updating and backups
+
+```bash
+docker compose pull
+docker compose up -d
+```
+
+Database migrations run when the app starts, and the key stays in its volume. Claude Code updates the plugin from its marketplace; run `/reload-plugins` after an update.
+
+**Settings → Data → Scheduled backups** writes a daily backup of the database to a folder or an S3-compatible bucket, and Settings → Data → Restore from Backup rolls the instance back to one, or brings a new instance back from it. See [Backups](docs/backups.md).
 
 ## Features
 
-Notes, tasks and issues; projects with milestones as plans; rules that reach Claude when its work matches them or at a moment of work; lessons, snippets of prior art and a ledger of the code they account for; design systems; ideas shared across projects on the same platform; and stored processes. Semantic search feeds both Claude's recall and the plugin's context injection. A knowledge graph, sharing with users and groups, and scheduled backups round it out. See [Features](docs/features.md).
+**Working with Claude**
+- Claude enters a project and gets a short primer: its goal, current plans, open tasks and areas.
+- Your rules reach Claude when its work matches them, or at a moment of work such as finishing a task or pushing code.
+- Before Claude writes a file or runs a command, the plugin shows it the rules, lessons and reusable code that may apply.
+- Stored procedures, such as a drift audit, become Claude Code skills.
 
-## Quick Start
+**Recording the work**
+- Notes in a Markdown editor, with wikilinks, tags and version history.
+- Tasks, issues and time-boxed investigations, with work logs that the next session reads first.
+- Plans as milestones: a design plus ordered steps.
+- Lessons learned the hard way, linked to the rules they illustrate.
+- Duplicate checks, so a new record that matches an existing one updates it instead.
 
-**Prerequisites:** Docker and Docker Compose. No GPU or local model needed — Claude is the sole assistant, reached over MCP.
+**Reusing code**
+- Snippets of reusable code, each with when to reach for it and where it lives in the repo.
+- With a git forge connected, Grimoire tracks every function and style in your repos and shows which ones are still unaccounted for.
+- Ideas shared across projects on the same platform, with each project's answer recorded.
+- Design systems with tokens, inheritance and a generated stylesheet.
 
-Download [`docker-compose.quickstart.yml`](docker-compose.quickstart.yml) from this repo, then:
+**For people**
+- A web UI to browse, search and edit everything, plus a graph of how notes connect.
+- Sharing with users and groups, as viewer, editor or admin.
+- Email and password sign-in, optional SSO through OIDC, and invite links.
+- Personal export to Markdown or JSON, and admin backup and restore.
+
+The full list is in [Features](docs/features.md).
+
+## Troubleshooting
+
+| What you see | Why | Fix |
+|--------------|-----|-----|
+| `SECRET_KEY is set to the public placeholder` at startup | `SECRET_KEY` is `dev-secret-change-me` or `change-me-in-production` | Remove `SECRET_KEY`, or set a real one |
+| Settings asks for forge tokens or the backup secret again | The instance's key changed: the `app_data` volume was replaced, or `SECRET_KEY` was set or removed | Enter them again, or restore the previous key |
+| `Can't locate revision identified by '…'` at startup | An older image is running against a database a newer one has already migrated | Run the newer image; migrations only move forward |
+| The plugin's tools are missing in Claude Code | The plugin isn't installed, or Claude Code hasn't reloaded it | `/plugin` to install or update it, then `/reload-plugins` |
+| Search finds only exact words | The embedding model hasn't downloaded yet | Give the app internet access once, or wait for the first download to finish |
+
+## Development
 
 ```bash
-# Optional but recommended — set a secret key
-export SECRET_KEY=your-random-secret-here
-
-docker compose -f docker-compose.quickstart.yml up -d
+docker compose -f docker-compose.dev.yml up --build
 ```
 
-Open `http://localhost:5000`. The first user to register becomes admin. To connect Claude, create an API key under **Settings → MCP Access** and install the Claude Code plugin — see [API Keys & MCP](docs/api-keys-and-mcp.md).
+[Development](docs/development.md) covers checks, migrations, the plugin and CI. [Architecture](docs/architecture.md) describes how it is built, and the [API reference](docs/api-reference.md) lists every REST endpoint.
 
-> **Development:** To build from source, see [Development](docs/development.md).
+## Licence
 
-## Documentation
-
-| Doc | Contents |
-|-----|----------|
-| [Architecture](docs/architecture.md) | Stack, design decisions, data models, key services |
-| [Configuration](docs/configuration.md) | Environment variables, Docker Compose, production setup, security |
-| [Features](docs/features.md) | Detailed feature breakdown and keyboard shortcuts |
-| [Development](docs/development.md) | Dev workflow, CI/CD, migrations, release process |
-| [API Keys & MCP](docs/api-keys-and-mcp.md) | API keys and installing the Claude Code plugin |
-| [SSO / OAuth](docs/sso-oauth.md) | OIDC setup for Authentik, Keycloak, and other providers |
-| [Backups](docs/backups.md) | Scheduled backups to a folder or S3, and restoring from one |
-| [Design system](docs/design-system.md) | The FabledSword house style and how Scribe applies it |
-| [API Reference](docs/api-reference.md) | All REST API endpoints |
-
-## License
-
-This project is privately maintained.
+Fabled Grimoire is free software under the [GNU Affero General Public License v3.0 only](LICENSE) (`AGPL-3.0-only`). If you run a modified version for other people over a network, the licence requires you to offer them its source.

alembic/env.py

@@ -4,9 +4,9 @@ from logging.config import fileConfig
 from alembic import context
 from sqlalchemy.ext.asyncio import create_async_engine
 
-from scribe.config import Config
-from scribe.models import Base
-from scribe.services.db_ready import wait_for_database
+from grimoire.config import Config
+from grimoire.models import Base
+from grimoire.services.db_ready import wait_for_database
 
 config = context.config
 if config.config_file_name is not None:

alembic/versions/0122_seal_forge_tokens.py

@@ -43,7 +43,7 @@ _LABEL_V1 = b"scribe.secrets.v1\x00"
 def _fernet():
     from cryptography.fernet import Fernet
 
-    from scribe.config import Config
+    from grimoire.config import Config
 
     digest = hashlib.sha256(_LABEL_V1 + Config.SECRET_KEY.encode()).digest()
     return Fernet(base64.urlsafe_b64encode(digest))

alembic/versions/0123_drop_user_profiles.py

@@ -0,0 +1,64 @@
+"""drop user_profiles
+
+Revision ID: 0123
+Revises: 0122
+Create Date: 2026-10-22
+
+The Profile settings page asked for a display name, job title, expertise,
+response style, tone, interests and a work schedule, and said an assistant
+used them to personalise chat and a daily journal. Nothing in the app read
+any of it: the page saved to this table and the backup carried it, and that
+was all. The page, its API and the backup section are gone, and the table
+goes with them.
+
+Downgrade recreates the empty table, so the schema steps back cleanly; the
+rows themselves do not come back.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import ARRAY, JSONB
+
+revision = "0123"
+down_revision = "0122"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.drop_index("ix_user_profiles_user_id", table_name="user_profiles")
+    op.drop_table("user_profiles")
+
+
+def downgrade() -> None:
+    op.create_table(
+        "user_profiles",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+            unique=True,
+        ),
+        sa.Column("display_name", sa.Text(), nullable=True),
+        sa.Column("job_title", sa.Text(), nullable=True),
+        sa.Column("industry", sa.Text(), nullable=True),
+        sa.Column("expertise_level", sa.Text(), nullable=True),
+        sa.Column("response_style", sa.Text(), nullable=True),
+        sa.Column("tone", sa.Text(), nullable=True),
+        sa.Column("interests", ARRAY(sa.Text()), nullable=True),
+        sa.Column("work_schedule", JSONB(), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+    )
+    op.create_index("ix_user_profiles_user_id", "user_profiles", ["user_id"], unique=True)

alembic/versions/0124_skill_names_follow_the_plugin.py

@@ -0,0 +1,45 @@
+"""skill names follow the plugin's name
+
+Revision ID: 0124
+Revises: 0123
+Create Date: 2026-10-22
+
+The plugin is named `grimoire`, so its skills reach a session as
+`grimoire:<skill>` and stored processes as `grimoire-proc-<slug>`. A rule
+mounted on one of those skills, a judgment about that mount, and an install's
+own action mapping all store the skill's name, and a stored name the harness no
+longer sends never matches again. This rewrites the plugin's earlier prefixes,
+`scribe:` and `scribe-proc-`, to the current ones.
+
+Cost: three small tables, each one row per mount, judgment or mapping.
+"""
+from alembic import op
+
+revision = "0124"
+down_revision = "0123"
+branch_labels = None
+depends_on = None
+
+_MOMENT_TABLES = ("rule_moments", "rule_moment_judgments", "moment_mappings")
+
+
+def _rename(old: str, new: str) -> None:
+    for table in _MOMENT_TABLES:
+        op.execute(
+            f"UPDATE {table} SET moment = regexp_replace(moment, "
+            f"'^skill\\.{old}(:|-proc-)', 'skill.{new}\\1') "
+            f"WHERE moment ~ '^skill\\.{old}(:|-proc-)'"
+        )
+    op.execute(
+        f'UPDATE moment_mappings SET "match" = regexp_replace("match", '
+        f"'skill={old}(:|-proc-)', 'skill={new}\\1', 'g') "
+        f"WHERE \"match\" ~ 'skill={old}(:|-proc-)'"
+    )
+
+
+def upgrade() -> None:
+    _rename("scribe", "grimoire")
+
+
+def downgrade() -> None:
+    _rename("grimoire", "scribe")

alembic/versions/0125_drop_cross_project_reference_uses.py

@@ -0,0 +1,35 @@
+"""drop machine-written uses edges that cross projects
+
+Revision ID: 0125
+Revises: 0124
+Create Date: 2026-10-26
+
+A `uses` edge with basis `reference` is the proposer's by-name reading: the
+shape's body names a canon's symbol. A body never calls a function defined in
+another project's repository, so such an edge across projects is a common
+word matched, not a call. The proposer no longer writes them, and this removes
+the ones it wrote before. Edges a person or an audit judged keep their own
+basis and are left alone. Rows within one project are re-read on the next
+coverage refresh, which replaces their reference edges under the same rule.
+
+Downgrade restores nothing: the removed edges were never facts.
+"""
+from alembic import op
+
+revision = "0125"
+down_revision = "0124"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute(
+        "DELETE FROM code_shape_uses u USING code_shapes s, notes n "
+        "WHERE u.shape_id = s.id AND u.snippet_id = n.id "
+        "AND u.basis = 'reference' "
+        "AND n.project_id IS NOT NULL AND n.project_id <> s.project_id"
+    )
+
+
+def downgrade() -> None:
+    pass

alembic/versions/0126_drop_cross_project_hook_uses.py

@@ -0,0 +1,34 @@
+"""drop write-path uses edges that cross projects
+
+Revision ID: 0126
+Revises: 0125
+Create Date: 2026-10-26
+
+The write path records a `uses` edge with basis `hook` when a session pulled a
+snippet and then wrote code naming its symbol. That is by-name evidence, like
+the proposer's `reference` edges 0125 removed, and a body never calls a
+function defined in another project's repository. The write path now applies
+the same by-name test, so it writes no such edge; this removes the ones it
+wrote before. Judged edges keep their own basis and are left alone.
+
+Downgrade restores nothing: the removed edges were never facts.
+"""
+from alembic import op
+
+revision = "0126"
+down_revision = "0125"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute(
+        "DELETE FROM code_shape_uses u USING code_shapes s, notes n "
+        "WHERE u.shape_id = s.id AND u.snippet_id = n.id "
+        "AND u.basis = 'hook' "
+        "AND n.project_id IS NOT NULL AND n.project_id <> s.project_id"
+    )
+
+
+def downgrade() -> None:
+    pass

alembic/versions/0127_instance_identity.py

@@ -0,0 +1,39 @@
+"""instance identity — the id lineage a backup carries
+
+Revision ID: 0127
+Revises: 0126
+Create Date: 2026-11-05
+
+One row naming this database's id lineage. Every full backup carries it, a
+restore into a fresh instance adopts it (the restore keeps the original ids),
+and rolling a live instance back requires the backup's to match, so a backup's
+ids never land on unrelated rows. Made here with a random value, so every
+instance has one before its first account exists.
+"""
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0127"
+down_revision = "0126"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "instance_identity",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("instance_id", sa.Text(), nullable=False),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), nullable=False,
+            server_default=sa.func.now(),
+        ),
+        sa.CheckConstraint("id = 1", name="ck_instance_identity_single_row"),
+    )
+    op.execute(
+        "INSERT INTO instance_identity (id, instance_id) VALUES (1, gen_random_uuid()::text)"
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("instance_identity")

ci-requirements.md

@@ -1,4 +1,4 @@
-# CI Requirements — FabledScribe
+# CI Requirements — FabledGrimoire
 
 > Spec lives in [`docs/process.md`](https://git.fabledsword.com/bvandeusen/CI-runner/src/branch/main/docs/process.md)
 > in the CI-Runner repo.
@@ -29,7 +29,7 @@ Anything CI installs at job time that isn't in the image. Promotion
 candidates if more than one project needs them.
 
 - `shellcheck` — apt-installed in the **plugin** job, which lints the
-  Claude Code hook scripts and runs their fail-open smoke test. Scribe is
+  Claude Code hook scripts and runs their fail-open smoke test. Grimoire is
   its only consumer, so per `docs/process.md` it stays per-job. It is small
   (~20 MB) and a promotion candidate once another project lints shell.
 

docker-compose.dev.yml

@@ -0,0 +1,35 @@
+# Grimoire built from this checkout, for development:
+#   docker compose -f docker-compose.dev.yml up --build
+
+services:
+  app:
+    build: .
+    ports:
+      - "5000:5000"
+    depends_on:
+      - db
+    restart: unless-stopped
+    volumes:
+      - app_data:/data
+      # Or a bind mount, for direct host access to the app's data:
+      # - ./data:/data
+    environment:
+      DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-grimoire}:${POSTGRES_PASSWORD:-grimoire}@db:5432/${POSTGRES_DB:-grimoire}"
+      # Optional: a SearXNG instance to list as the web-search backend in Integrations.
+      # SEARXNG_URL: "http://searxng:8080"
+
+  db:
+    # Postgres 17 with the vector extension Grimoire needs.
+    image: pgvector/pgvector:pg17
+    stop_grace_period: 120s
+    restart: unless-stopped
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-grimoire}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-grimoire}
+      POSTGRES_DB: ${POSTGRES_DB:-grimoire}
+
+volumes:
+  pgdata:
+  app_data:

docker-compose.prod.yml

@@ -1,31 +1,39 @@
 services:
   app:
-    image: git.fabledsword.com/bvandeusen/fabledscribe:latest
+    image: git.fabledsword.com/bvandeusen/fabledgrimoire:latest
     environment:
-      DATABASE_URL: "postgresql+asyncpg://scribe:${DB_PASSWORD}@db:5432/scribe"
+      DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-grimoire}:${DB_PASSWORD}@db:5432/${POSTGRES_DB:-grimoire}"
+      # A Swarm can start the app on another node, away from the key kept in
+      # a node-local /data volume, so a stack sets its key itself (or mounts
+      # a Docker secret and sets SECRET_KEY_FILE to its path).
       SECRET_KEY: "${SECRET_KEY}"
       LOG_LEVEL: "${LOG_LEVEL:-INFO}"
-      TRUST_PROXY_HEADERS: "true"
-      SECURE_COOKIES: "true"
+      # Proxies in front of the app (Traefik = 1). The client address and
+      # HTTPS are read from that far in from the right of X-Forwarded-*.
+      TRUSTED_PROXY_HOPS: "1"
+    volumes:
+      - app_data:/data
     networks:
-      - scribe_backend
+      - backend
 
   db:
-    # Postgres 17 with the vector extension Scribe needs.
+    # Postgres 17 with the vector extension Grimoire needs.
     image: pgvector/pgvector:pg17
     stop_grace_period: 120s
     volumes:
       - pgdata:/var/lib/postgresql/data
     environment:
-      POSTGRES_USER: scribe
+      POSTGRES_USER: ${POSTGRES_USER:-grimoire}
       POSTGRES_PASSWORD: "${DB_PASSWORD}"
-      POSTGRES_DB: scribe
+      POSTGRES_DB: ${POSTGRES_DB:-grimoire}
     networks:
-      - scribe_backend
+      - backend
 
 volumes:
   pgdata:
+    name: ${PGDATA_VOLUME:-grimoire_pgdata}
+  app_data:
 
 networks:
-  scribe_backend:
+  backend:
     driver: overlay

docker-compose.quickstart.yml

@@ -1,36 +0,0 @@
-# Fabled Scribe from the pre-built image:
-#   docker compose -f docker-compose.quickstart.yml up -d
-# Then open http://localhost:5000 (the first account registered becomes admin)
-# and connect Claude from Settings → MCP Access.
-
-services:
-  app:
-    image: git.fabledsword.com/bvandeusen/fabledscribe:latest
-    ports:
-      - "5000:5000"
-    environment:
-      DATABASE_URL: "postgresql+asyncpg://scribe:scribe@db:5432/scribe"
-      # Set SECRET_KEY in the environment or a .env file beside this one.
-      SECRET_KEY: "${SECRET_KEY:-change-me-in-production}"
-      LOG_LEVEL: "${LOG_LEVEL:-INFO}"
-    volumes:
-      - app_data:/data
-    depends_on:
-      - db
-    restart: unless-stopped
-
-  db:
-    # Postgres 17 with the vector extension Scribe needs.
-    image: pgvector/pgvector:pg17
-    stop_grace_period: 120s
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-    environment:
-      POSTGRES_USER: scribe
-      POSTGRES_PASSWORD: scribe
-      POSTGRES_DB: scribe
-    restart: unless-stopped
-
-volumes:
-  app_data:
-  pgdata:

docker-compose.yml

@@ -1,33 +1,40 @@
+# Fabled Grimoire: the app and its database.
+#   docker compose up -d
+# Then open http://localhost:5000. The first account registered becomes admin.
+#
+# Keep both volumes. app_data holds the instance's own SECRET_KEY, which seals
+# saved credentials; pgdata holds everything else.
+
 services:
   app:
-    build: .
+    image: git.fabledsword.com/bvandeusen/fabledgrimoire:latest
     ports:
       - "5000:5000"
+    environment:
+      DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-grimoire}:${POSTGRES_PASSWORD:-grimoire}@db:5432/${POSTGRES_DB:-grimoire}"
+      LOG_LEVEL: "${LOG_LEVEL:-INFO}"
+      # Port 5000 is published straight to clients, so no proxy is trusted.
+      # Behind a reverse proxy, set 1 (one per proxy) and BASE_URL:
+      TRUSTED_PROXY_HOPS: "0"
+      # BASE_URL: "https://grimoire.example.com"
+    volumes:
+      - app_data:/data
     depends_on:
       - db
     restart: unless-stopped
-    volumes:
-      - app_data:/data
-      # Or a bind mount, for direct host access to the app's data:
-      # - ./data:/data
-    environment:
-      DATABASE_URL: "postgresql+asyncpg://${POSTGRES_USER:-scribe}:${POSTGRES_PASSWORD:-scribe}@db:5432/${POSTGRES_DB:-scribe}"
-      SECRET_KEY: "${SECRET_KEY:-dev-secret-change-me}"
-      # Optional: a SearXNG instance to list as the web-search backend in Integrations.
-      # SEARXNG_URL: "http://searxng:8080"
 
   db:
-    # Postgres 17 with the vector extension Scribe needs.
+    # Postgres 17 with the vector extension Grimoire needs.
     image: pgvector/pgvector:pg17
     stop_grace_period: 120s
-    restart: unless-stopped
     volumes:
       - pgdata:/var/lib/postgresql/data
     environment:
-      POSTGRES_USER: ${POSTGRES_USER:-scribe}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-scribe}
-      POSTGRES_DB: ${POSTGRES_DB:-scribe}
+      POSTGRES_USER: ${POSTGRES_USER:-grimoire}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-grimoire}
+      POSTGRES_DB: ${POSTGRES_DB:-grimoire}
+    restart: unless-stopped
 
 volumes:
-  pgdata:
   app_data:
+  pgdata:

docs/api-keys-and-mcp.md

@@ -1,8 +1,8 @@
-# API Keys and Scribe MCP
+# API Keys and Grimoire MCP
 
 ## API Keys
 
-API keys let external tools access your Scribe data without a browser session. Each key is scoped to a single user — it can only access data that user owns or has been shared with them.
+API keys let external tools access your Grimoire data without a browser session. Each key is scoped to a single user — it can only access data that user owns or has been shared with them.
 
 ### Scopes
 
@@ -22,7 +22,7 @@ Admin-level operations (log access, user management) require a `write`-scoped ke
 5. Copy the key immediately — it is shown only once (the token is `fmcp_`-prefixed)
 
 Paste the key into the `Authorization: Bearer <key>` header of your MCP client
-config (see **Scribe MCP Server** below).
+config (see **Grimoire MCP Server** below).
 
 ### Revoking a Key
 
@@ -30,12 +30,12 @@ Click **Revoke** next to the key in the keys table and confirm. Revoked keys are
 
 ---
 
-## Scribe MCP Server
+## Grimoire MCP Server
 
-Scribe exposes itself as a set of MCP tools that Claude (and other MCP clients)
+Grimoire exposes itself as a set of MCP tools that Claude (and other MCP clients)
 can use to read and write your notes, tasks, projects, rulebooks, and more. The
 server is **built into the app** — it is mounted as a streamable-HTTP endpoint
-at **`/mcp`** on the running Scribe instance (`src/scribe/mcp/server.py`). There
+at **`/mcp`** on the running Grimoire instance (`src/grimoire/mcp/server.py`). There
 is nothing to install: no wheel, no separate package, no CLI. You connect a
 client straight to the URL with a Bearer token.
 
@@ -50,14 +50,14 @@ without a read-shaped name are spelled out here. A `write`-scoped key may call e
 
 ### Claude Code: the plugin (recommended)
 
-The plugin connects the MCP server and adds the hooks and skills that put Scribe's records in front of Claude as it works. Install it from this repo:
+The plugin connects the MCP server and adds the hooks and skills that put Grimoire's records in front of Claude as it works. Install it from this repo:
 
 ```
-/plugin marketplace add https://git.fabledsword.com/bvandeusen/FabledScribe.git
-/plugin install scribe@scribe-plugin
+/plugin marketplace add https://git.fabledsword.com/bvandeusen/FabledGrimoire.git
+/plugin install grimoire@grimoire-plugin
 ```
 
-It asks for your Scribe base URL, an API key (kept in your OS keychain) and, optionally, a project id. Settings → MCP Access shows the exact command for your instance. [`plugin/README.md`](../plugin/README.md) describes each hook.
+It asks for your Grimoire base URL, an API key (kept in your OS keychain) and, optionally, a project id. Settings → MCP Access shows the exact command for your instance. [`plugin/README.md`](../plugin/README.md) describes each hook.
 
 ### Claude Code without the plugin
 
@@ -67,9 +67,9 @@ your instance's `/mcp` endpoint:
 ```json
 {
   "mcpServers": {
-    "scribe": {
+    "grimoire": {
       "type": "http",
-      "url": "https://your-scribe-instance.example.com/mcp",
+      "url": "https://your-grimoire-instance.example.com/mcp",
       "headers": {
         "Authorization": "Bearer fmcp_your-api-key"
       }
@@ -90,7 +90,7 @@ specific project at a dev instance or an admin key.
 ### Available Tools
 
 There are well over a hundred tools and they change with the app, so the
-registration in **`src/scribe/mcp/tools/`** is the reference. By family:
+registration in **`src/grimoire/mcp/tools/`** is the reference. By family:
 
 | Family | Examples | Purpose |
 |--------|----------|---------|
@@ -111,4 +111,4 @@ registration in **`src/scribe/mcp/tools/`** is the reference. By family:
 Server-level usage guidance — when to reach for each entity, the
 recall-before-acting reflex, and the rulebook conventions — is delivered to the
 client automatically via the MCP server's `instructions` block (defined in
-`src/scribe/mcp/server.py`).
+`src/grimoire/mcp/server.py`).

docs/api-reference.md

@@ -219,11 +219,10 @@ endpoint at `/mcp`, not these REST routes.
 | POST | `/api/notifications/:id/read` | Mark one read |
 | POST | `/api/notifications/read-all` | Mark all read |
 
-## Profile and Settings
+## Settings
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET / PUT | `/api/profile` | Read / update the per-user profile |
 | GET / PUT | `/api/settings` | Read / update key-value settings |
 | GET | `/api/settings/search` | SearXNG configuration status |
 | GET / POST | `/api/settings/forge-connections` | Your git forge connections / add one |
@@ -252,6 +251,7 @@ These serve the plugin's hooks.
 | POST | `/api/plugin/rule-opened` | Records that a session opened a rule it was shown |
 | GET | `/api/plugin/shape-check` | The end-of-turn question about what this turn wrote |
 | GET | `/api/plugin/claim-session` · `/release-session` | Bind a session to its task claims / release them at session end |
+| GET | `/api/plugin/write-scope` | Which projects a pending act would change (a directory, or an MCP call's `tool` and `input`), and whether a session in its own project may do it. Filing an issue elsewhere is allowed; every other cross-project write is answered `allowed: false` with the reason the operator is asked |
 | GET | `/api/plugin/processes` | Stored Processes for skill-stub sync |
 | GET | `/api/plugin/prior-art` | Write-path hint for the plugin hooks (params: `path`, `code`, `repo`, `shapes`, `exclude_ids`, `exclude_sync_ids`, `exclude_derive`); returns `context`, `note_ids`, `sync_note_ids`, `stamped`, `divergence`, `derive`, `derive_keys` |
 | GET / POST | `/api/projects/<id>/coverage`, `…/coverage/refresh` | Shape-ledger accounting (`pattern_coverage` line, counts, `derive_groups` — css groups carry `consumers`, `derive_new`, `unused_css`, `divergence`, `recheck`) |
@@ -273,12 +273,15 @@ These serve the plugin's hooks.
 | Method | Path | Description |
 |--------|------|-------------|
 | GET | `/api/admin/backup` | Export backup (format v4; `?scope=user` for own data) |
-| POST | `/api/admin/restore` | Restore from a backup |
+| GET | `/api/admin/restore/sources` | The backups at the backup destination, newest first |
+| POST | `/api/admin/restore/preview` | What restoring a backup (`?source=<name>` or an uploaded file) would change; 409 with the reason when it can't apply here |
+| POST | `/api/admin/restore?confirm=rollback` | Put the whole instance back to that backup, after saving the current state |
 | GET / DELETE | `/api/admin/users` · `/api/admin/users/:id` | List / delete users |
 | GET / PUT | `/api/admin/registration` | Get / toggle registration |
 | GET / PUT | `/api/admin/smtp` · POST `/api/admin/smtp/test` | SMTP config + test email |
 | GET | `/api/admin/logs` · `/api/admin/logs/stats` | Log entries + category counts |
 | GET / PUT | `/api/admin/base-url` | Get / set the public base URL |
+| GET / PUT | `/api/admin/proxy` | Get / set how many reverse proxies stand in front of Grimoire (`{"hops": n}`, or `null` for the environment's count), with what each count would read for this request |
 | GET / PUT | `/api/admin/db-maintenance` (+ `/health`, POST `/run`) | VACUUM schedule, health, manual run |
 | POST / GET / DELETE | `/api/admin/invitations` (+ `/:id`) | Create / list / revoke invite links |
 | GET / PUT | `/api/admin/backups` | Scheduled backups: destination, schedule and recent runs |
@@ -292,10 +295,10 @@ These serve the plugin's hooks.
 |--------|------|-------------|
 | POST | `/api/webhooks/forge` | Push events from a git forge, verified with `FORGE_WEBHOOK_SECRET` **(public)** |
 
-## Scribe MCP
+## Grimoire MCP
 
 Claude clients connect to the built-in MCP server at `POST /mcp` (streamable HTTP,
-Bearer auth with an `fmcp_` key), served by `src/scribe/mcp/`. It is not a REST
+Bearer auth with an `fmcp_` key), served by `src/grimoire/mcp/`. It is not a REST
 surface — it exposes the same data as typed tools (`create_note`, `create_task`,
 `start_planning`, `search`, `enter_project`, …) with
 server-level usage guidance delivered in the MCP `instructions` block. See

docs/architecture.md

@@ -1,6 +1,6 @@
 # Architecture
 
-Scribe is one app container and one PostgreSQL container. There is no language model in the stack: Claude works with Scribe from outside, through the MCP endpoint and the Claude Code plugin, and people use the web UI.
+Grimoire is one app container and one PostgreSQL container. There is no language model in the stack: Claude works with Grimoire from outside, through the MCP endpoint and the Claude Code plugin, and people use the web UI.
 
 ## Stack
 
@@ -24,10 +24,10 @@ Scribe is one app container and one PostgreSQL container. There is no language m
 ```
 
 - **The web UI** is a Vue single-page app, built into the image and served by Quart. Every unknown path that isn't under `/api/` falls back to `index.html`; `/api/*` always answers JSON.
-- **The REST API** (`src/scribe/routes/`) backs the UI, one blueprint per resource.
-- **The MCP server** (`src/scribe/mcp/`) is how Claude reads and writes records. Each module in `mcp/tools/` registers its tools, and the server's instructions and each tool's docstring are the contract an agent reads. Requests authenticate with an API key as a Bearer token.
+- **The REST API** (`src/grimoire/routes/`) backs the UI, one blueprint per resource.
+- **The MCP server** (`src/grimoire/mcp/`) is how Claude reads and writes records. Each module in `mcp/tools/` registers its tools, and the server's instructions and each tool's docstring are the contract an agent reads. Requests authenticate with an API key as a Bearer token.
 - **The plugin** (`plugin/`) runs in the user's Claude Code. Its hooks call `/api/plugin/*` to put the right context in front of Claude at the right moment: the project at session start, matching rules and prior art before a prompt or a tool call, the rules mounted on a moment of work, and a check on the reply that ends a turn. Its skills describe the working practices. See [API Keys & MCP](api-keys-and-mcp.md) to install it.
-- **Services** (`src/scribe/services/`) hold the logic both doors share. Routes and MCP tools stay thin: parse the request, check access, call a service, return a plain dict.
+- **Services** (`src/grimoire/services/`) hold the logic both doors share. Routes and MCP tools stay thin: parse the request, check access, call a service, return a plain dict.
 
 ## Data model
 
@@ -69,25 +69,25 @@ Every database wait on startup has a deadline. Migrations wait for the database
 
 ## Authentication
 
-- **Sessions**: `HttpOnly`, `SameSite=Lax` cookies, `Secure` when `SECURE_COOKIES=true`. Changing a password bumps the user's session version and signs out their other sessions.
+- **Sessions**: `HttpOnly`, `SameSite=Lax` cookies, `Secure` on a request the trusted proxy reports as HTTPS, which also gets HSTS (`grimoire/proxy.py`). Changing a password bumps the user's session version and signs out their other sessions.
 - **API keys**: `Authorization: Bearer fmcp_...`, stored hashed. A `read` key may only call read endpoints and read MCP tools.
 - **OIDC** single sign-on with PKCE, optionally replacing local logins ([SSO / OAuth](sso-oauth.md)).
-- **Rate limits** on register, login and forgot-password, per client IP (`TRUST_PROXY_HEADERS` reads the IP from the proxy's headers).
+- **Rate limits** on register, login and forgot-password, per client IP, read from `X-Forwarded-For` by `TRUSTED_PROXY_HOPS`.
 
-Credentials Scribe stores for outside services (forge tokens, the backup destination's S3 secret) are sealed under a key derived from `SECRET_KEY`.
+Credentials Grimoire stores for outside services (forge tokens, the backup destination's S3 secret) are sealed under a key derived from `SECRET_KEY`, which the instance makes on first start and keeps in `/data/secret_key` unless one is set.
 
 ## Repository layout
 
 ```
 ├── alembic/versions/      database migrations
-├── src/scribe/
+├── src/grimoire/
 │   ├── app.py             app factory, blueprints, startup and shutdown
 │   ├── config.py          environment configuration
 │   ├── models/            SQLAlchemy models
 │   ├── routes/            REST blueprints
 │   ├── mcp/               MCP server and its tool modules
 │   ├── services/          shared logic
-│   └── restore.py         `python -m scribe.restore` for a fresh instance
+│   └── restore.py         `python -m grimoire.restore`: the restore, from the command line
 ├── frontend/src/          views, components, stores, composables, api client
 ├── plugin/                Claude Code hooks, skills and commands
 ├── scripts/               CI checks and the plugin version minter

docs/backups.md

@@ -1,7 +1,7 @@
 # Backups
 
-Scribe can back itself up every day to a **folder** or an **S3-compatible
-bucket**. Each run adds one file; Scribe never deletes an old one. Keeping and
+Grimoire can back itself up every day to a **folder** or an **S3-compatible
+bucket**. Each run adds one file; Grimoire never deletes an old one. Keeping and
 thinning the history is the destination's job.
 
 Set it up under **Settings → Data → Scheduled backups** (admins only).
@@ -11,24 +11,28 @@ Set it up under **Settings → Data → Scheduled backups** (admins only).
 One file per run, named for the moment it was taken in UTC:
 
 ```
-scribe-20261015T020000Z.tar
+grimoire-20261015T020000Z.tar
 ```
 
+Backups written while the app was called Scribe are named `scribe-…tar`.
+They are counted with the rest and restore the same way.
+
 It is a plain, **uncompressed** tar:
 
-- `manifest.json` comes first. It holds the backup format version, the Scribe
+- `manifest.json` comes first. It holds the backup format version, the Grimoire
   version, when the backup was taken, and how many rows each table has.
 - Then there is one `<table>.jsonl` per table, one row per line.
 
 It holds everything the admin **Full Backup** download holds, laid out
 differently. It does **not** hold:
 
-- **Search indexes.** They are rebuilt from the records when Scribe starts.
+- **Search indexes.** They are rebuilt from the records when Grimoire starts.
 - **Sharing:** groups, project shares and note shares.
 - **Credentials:** API keys and forge connections. After a restore, issue new
   API keys and add forge connections again. (Forge tokens are also sealed under
   `SECRET_KEY` in the database itself, so a copy of the database doesn't carry
-  them in readable form either.)
+  them in readable form either. The key lives in `/data/secret_key`, outside
+  the database.)
 - **Logs and notifications.**
 - **The backup destination's own S3 secret.**
 
@@ -61,16 +65,16 @@ file again.
 
 ### A folder
 
-A path **inside the Scribe container**, normally a share mounted there:
+A path **inside the Grimoire container**, normally a share mounted there:
 
 ```yaml
 services:
-  scribe:
+  grimoire:
     volumes:
-      - /nfs/backup/scribe:/backups
+      - /nfs/backup/grimoire:/backups
 ```
 
-Scribe writes each file under a hidden name (`.scribe-….tar.part`) and renames
+Grimoire writes each file under a hidden name (`.grimoire-….tar.part`) and renames
 it once it is complete. A program watching the folder never sees half a
 backup.
 
@@ -79,14 +83,17 @@ backup.
 You need four things:
 
 - **Address:** the service itself, like `https://backup.example.com`. Don't
-  include the bucket; Scribe addresses buckets by path.
+  include the bucket; Grimoire addresses buckets by path.
 - **Bucket.**
 - **Access key.**
 - **Secret key.**
 
-Scribe uploads and lists; it never deletes. A key that may **only add
-objects** is therefore enough, and it is the safer key to hand out: a stolen
-one cannot wipe the history.
+Grimoire uploads and lists, and reads a backup back when you restore from the
+bucket; it never deletes. A key that may **add and read objects but not
+delete them** is therefore enough, and it is the safer key to hand out: a
+stolen one cannot wipe the history. A key that may only add objects still
+takes backups; restore then works by uploading a file or from the command
+line.
 
 The secret is stored encrypted, under a key derived from `SECRET_KEY`. It is
 never shown again, and never included in a backup. If an instance's
@@ -115,46 +122,74 @@ page asks for the secret again.
 [Fabled Archives](https://git.fabledsword.com/bvandeusen/fabledarchives)
 keeps service backups as "backup targets". Either destination works with it.
 
-1. On Archives' **Backups** page, make a target for Scribe, named `scribe`
+1. On Archives' **Backups** page, make a target for Grimoire, named `grimoire`
    for example.
-2. Choose how Scribe's files arrive:
-   - **S3**: turn on the S3 way in for the target and make an **append-only**
-     S3 key. In Scribe, choose **An S3 bucket**:
+2. Choose how Grimoire's files arrive:
+   - **S3**: turn on the S3 way in for the target and make an S3 key that
+     may add and read objects but not delete them (an **append-only** key
+     takes backups too, but then Grimoire can't restore from the bucket). In
+     Grimoire, choose **An S3 bucket**:
      - address: Archives' backup address (`http://<archives>:8081`);
      - bucket: the target's name;
      - access key and secret key: the key you just made.
-   - **A folder**: mount the share Archives watches into Scribe as
-     `/backups/scribe`, and point the target at that folder. In Scribe, choose
-     **A folder** with `/backups/scribe`.
+   - **A folder**: mount the share Archives watches into Grimoire as
+     `/backups/grimoire`, and point the target at that folder. In Grimoire, choose
+     **A folder** with `/backups/grimoire`.
 3. Set the target's **Retention** to **Archives**. Archives then keeps the
-   newest backups and thins the rest by day, week and month. Scribe only adds.
+   newest backups and thins the rest by day, week and month. Grimoire only adds.
 4. Give the target an expected cadence of **daily**, so a missed backup turns
-   it late in Archives as well as overdue in Scribe.
+   it late in Archives as well as overdue in Grimoire.
 5. Add an off-site **restic** replication job for the target. The uncompressed
    layout above is what lets that job send only what changed each day.
 
 ## Restoring
 
-### Into a fresh instance
+A restore puts the **whole instance** back to the moment a backup was taken,
+for every user:
 
-Start Scribe on an empty database, copy the backup file into the container,
-and run:
+- records edited since go back to how they were;
+- records deleted since come back;
+- anything made since is removed.
 
-```sh
-docker exec -it scribe python -m scribe.restore /backups/scribe-20261015T020000Z.tar
-```
+It matches records by their ids, so a live instance only restores a backup **of
+its own**. Each instance has an id, and every backup records the one it came
+from. A backup from another instance, or one made before backups recorded it,
+only goes into a new, empty instance, which takes it as it is.
 
-- The command refuses a database that already has an account. A restore
-  re-creates everything with new ids, so on a live instance it would add a
-  second copy instead of replacing anything.
-- Nothing limits the file's size.
-- It also reads the JSON from the admin **Full Backup** download.
+Before changing anything, the restore saves the current state as one more
+backup. It goes to the backup destination when scheduled backups are on, and
+otherwise to `/data/pre-restore`. The result says which file it is, so a
+restore can itself be undone.
 
-Afterwards, **restart Scribe** so the search indexes are rebuilt. Then issue
-new API keys, add forge connections again, and set up any sharing.
+What a backup doesn't carry stays as it is wherever its owner survives the
+restore: API keys, forge connections, sharing, logs, and the destination's S3
+secret. The trash isn't in backups, so anything in the trash when the backup
+was taken is gone afterwards. Everyone is signed out, and search is rebuilt.
 
 ### From the web
 
-**Settings → Data → Restore from Backup** takes the `.tar` as well as the
-JSON download. The upload is held to the server's request-size limit. For a
-bigger file, use the command above.
+**Settings → Data → Restore from Backup** lists the backups at the backup
+destination. You can pick one of those, or upload a `.tar` or the JSON
+**Full Backup** download (uploads are held to the server's request-size
+limit). The restore then shows what would change: when the backup was taken,
+and how many accounts, projects, plans, notes and rules there are now and will
+be afterwards. Type `roll back` to run it. Then sign in again.
+
+To read backups back from an S3 bucket, the key needs read access as well as
+write. Grimoire never deletes from the bucket.
+
+### From the command line
+
+For a file with no size limit, or a new instance with no backup destination
+yet, copy the file into the container and run:
+
+```sh
+docker exec -it grimoire python -m grimoire.restore /backups/grimoire-20261015T020000Z.tar
+```
+
+It prints what would change and stops. Add `--yes` to restore. It reads the
+JSON download too. Afterwards, **restart Grimoire** so the search indexes are
+rebuilt.
+
+After restoring into a new instance, issue new API keys, add forge connections
+again, and set up any sharing: none of them travel in a backup.

docs/configuration.md

@@ -1,8 +1,8 @@
 # Configuration
 
-Scribe reads its configuration from environment variables. Most settings people change day to day (registration, SMTP, retrieval thresholds, backups, forge connections) live in **Settings** in the web UI instead.
+Grimoire reads its configuration from environment variables. Most settings people change day to day (registration, SMTP, retrieval thresholds, backups, forge connections) live in **Settings** in the web UI instead.
 
-Any variable marked *secret* can also be read from a file: set `<NAME>_FILE` to the path, for example a Docker secret at `/run/secrets/scribe_key`.
+Any variable marked *secret* can also be read from a file: set `<NAME>_FILE` to the path, for example a Docker secret at `/run/secrets/grimoire_key`.
 
 ## Environment variables
 
@@ -10,11 +10,11 @@ Any variable marked *secret* can also be read from a file: set `<NAME>_FILE` to
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `DATABASE_URL` *(secret)* | `postgresql+asyncpg://scribe:scribe@localhost:5432/scribe` | PostgreSQL connection string, using the `asyncpg` driver |
-| `SECRET_KEY` *(secret)* | `dev-secret-change-me` | Signs sessions and seals stored credentials. Set it before first use and keep it (see below) |
+| `DATABASE_URL` *(secret)* | `postgresql+asyncpg://grimoire:grimoire@localhost:5432/grimoire` | PostgreSQL connection string, using the `asyncpg` driver |
+| `SECRET_KEY` *(secret)* | kept in `DATA_DIR` | Signs sessions and seals stored credentials. Unset, the instance makes its own on first start and keeps it in `DATA_DIR/secret_key`. Set it only to manage the key yourself; it wins over the kept one (see below) |
+| `DATA_DIR` | `/data` | Where the instance keeps its own `SECRET_KEY`. Mount a volume here |
 | `BASE_URL` | `http://localhost:5000` | Public URL, used in email links and OIDC redirects |
-| `SECURE_COOKIES` | `false` | `true` when Scribe is served over HTTPS |
-| `TRUST_PROXY_HEADERS` | `false` | `true` behind a reverse proxy, to read the client IP from `X-Forwarded-For` / `X-Real-IP` |
+| `TRUSTED_PROXY_HOPS` | `1` | The starting count of reverse proxies in front of Grimoire. **Settings → Config → Reverse proxy** is where the count is checked and set, and a count saved there wins over this. The client address and the scheme are read that many entries in from the right of `X-Forwarded-For` and `X-Forwarded-Proto`; `0` ignores both headers. See [Behind a reverse proxy](#behind-a-reverse-proxy) |
 | `LOG_LEVEL` | `INFO` | `DEBUG`, `INFO`, `WARNING` or `ERROR` |
 | `LOG_RETENTION_DAYS` | `90` | Days of app logs to keep |
 | `FASTEMBED_CACHE_DIR` | `/data/fastembed-cache` | Where the embedding model is stored after its first download |
@@ -42,7 +42,7 @@ Admins can set SMTP in **Settings**; these are the defaults until they do.
 | `SMTP_USERNAME` | — |
 | `SMTP_PASSWORD` *(secret)* | — |
 | `SMTP_FROM_ADDRESS` | — |
-| `SMTP_FROM_NAME` | `Fabled Scribe` |
+| `SMTP_FROM_NAME` | `Fabled Grimoire` |
 | `SMTP_USE_TLS` | `true` |
 
 ### Integrations
@@ -56,50 +56,55 @@ Admins can set SMTP in **Settings**; these are the defaults until they do.
 
 ## Running it
 
-### Quick start
+### Docker Compose
 
-[`docker-compose.quickstart.yml`](../docker-compose.quickstart.yml) runs the published image with its own database:
+[`docker-compose.yml`](../docker-compose.yml) runs the published image with its own database, and needs nothing set:
 
 ```bash
-SECRET_KEY=$(python3 -c 'import secrets; print(secrets.token_hex(32))') \
-  docker compose -f docker-compose.quickstart.yml up -d
+docker compose up -d
 ```
 
 Open `http://localhost:5000`. The first account registered becomes the admin; after that, registration stays closed until an admin opens it in Settings or sends an invite.
 
+Update with `docker compose pull && docker compose up -d`. The key and the data stay in their volumes.
+
 ### From source
 
 ```bash
-cp .env.example .env   # then set SECRET_KEY
-docker compose up --build
+docker compose -f docker-compose.dev.yml up --build
 ```
 
 ### Docker Swarm
 
-[`docker-compose.prod.yml`](../docker-compose.prod.yml) is a stack file: the app and database on a private overlay network, with `SECURE_COOKIES` and `TRUST_PROXY_HEADERS` on. Provide `DB_PASSWORD` and `SECRET_KEY` in the environment:
+[`docker-compose.prod.yml`](../docker-compose.prod.yml) is a stack file: the app and database on a private overlay network, trusting one proxy (`TRUSTED_PROXY_HOPS: "1"`). A Swarm can move the app to another node, away from a node-local `/data` volume, so the stack sets its own key: provide `DB_PASSWORD` and `SECRET_KEY` in the environment (or mount a Docker secret and set `SECRET_KEY_FILE`):
 
 ```bash
-DB_PASSWORD=... SECRET_KEY=... docker stack deploy -c docker-compose.prod.yml scribe
+DB_PASSWORD=... SECRET_KEY=... docker stack deploy -c docker-compose.prod.yml grimoire
 ```
 
+The database user, database and volume default to `grimoire`. An install created under the name Scribe keeps its data by setting `POSTGRES_USER`, `POSTGRES_DB` and `PGDATA_VOLUME` to the names it was created with.
+
 The shipped files leave out healthchecks and restart policies on purpose. The app waits for its database on startup, and the orchestrator's defaults restart it if it ever exits.
 
 ### Volumes
 
-- **Database** (`pgdata`): everything Scribe stores.
-- **App data** (`/data`): the embedding model cache and diagnostics. Losing it costs a re-download, nothing else.
+- **Database** (`pgdata`): everything Grimoire stores.
+- **App data** (`/data`): the instance's own `SECRET_KEY`, the embedding model cache and diagnostics. Losing it costs the key: Settings then asks for saved forge tokens and the backup secret again, and the model downloads again.
 
-Back up the database with **Settings → Data → Scheduled backups** ([Backups](backups.md)).
+Back up the database with **Settings → Data → Scheduled backups** ([Backups](backups.md)). A database backup doesn't carry the key; to move sealed credentials to a new instance, copy `/data/secret_key` with it.
 
 ## Behind a reverse proxy
 
-Scribe doesn't terminate TLS. Put it behind Nginx, Traefik or Caddy, forward to port 5000, and keep port 5000 off the internet. Set `SECURE_COOKIES=true`, `TRUST_PROXY_HEADERS=true` and `BASE_URL`.
+Grimoire doesn't terminate TLS. Put it behind Nginx, Traefik or Caddy, forward to port 5000, and keep port 5000 off the internet. Set `BASE_URL`, then set the proxy count to the number of proxies a request passes through: one proxy is `1`, the default; Cloudflare's proxied DNS in front of your own proxy is `2`.
+
+**Settings → Config → Reverse proxy** sets the count and checks it against your own request. It shows the address Grimoire reads you as, and what each count from 0 to 3 would read. Pick the count that shows your own address. When a request comes through Cloudflare, the section names the count that reads the address Cloudflare reports, with a button that sets it. `TRUSTED_PROXY_HOPS` in the environment is only the starting value: a count saved in Settings wins, and **Use the environment's** goes back to it.
+
+A count that is too low makes every visitor read as the proxy, so they share one sign-in rate limit and a few bad sign-ins block everyone. The "too many attempts" message says so and points here. The block on sign-ins lifts after a minute; an admin who is already signed in can fix the count at once.
 
 ```nginx
 location / {
     proxy_pass http://127.0.0.1:5000;
     proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
 
@@ -109,12 +114,16 @@ location / {
 }
 ```
 
-With `TRUST_PROXY_HEADERS=true`, make sure the proxy replaces any `X-Forwarded-For` the client sends.
+Each proxy appends its entry to `X-Forwarded-For` and `X-Forwarded-Proto`, so Grimoire reads the entry that many in from the right: the one your own proxy wrote. Whatever a client puts to the left of it is ignored. A header with fewer entries than that (a LAN road with one proxy beside a Cloudflare road with two) is read at its leftmost entry, the one the first proxy wrote.
+
+When that entry says `https`, the session cookie is marked `Secure` and the response carries `Strict-Transport-Security: max-age=31536000`. Over plain HTTP neither is sent, and Grimoire never redirects to HTTPS, so a LAN install keeps working.
+
+A hop count higher than the real number of proxies lets a client choose its own address, so count them. With `0`, the headers are ignored and the socket peer is the client: use it when clients reach port 5000 directly.
 
 ## Security checklist
 
-- **Set a strong `SECRET_KEY`, and keep it.** Forge tokens and the backup destination's S3 secret are sealed under a key derived from it, so a copy of the database alone can't read them. If the key changes (say, a restore onto an instance with a different key), Settings marks those credentials and asks for them again; nothing else breaks. The app logs a warning at startup while the default key is in use, and refuses to start with it when `SECURE_COOKIES=true`.
-- **`SECURE_COOKIES=true`** whenever Scribe is served over HTTPS.
+- **Keep the key.** Forge tokens and the backup destination's S3 secret are sealed under a key derived from `SECRET_KEY`, so a copy of the database alone can't read them. Unset, the instance makes a random key and keeps it in `/data/secret_key`, readable by its owner only; keep that volume. If the key changes (say, a restore onto an instance with a different key), Settings marks those credentials and asks for them again; nothing else breaks. The app warns at startup when `SECRET_KEY` is a public placeholder or `/data` is not a mounted volume, and refuses to start with a placeholder key (`dev-secret-change-me`, `change-me-in-production`).
+- **The proxy count** (Settings → Config → Reverse proxy) matches the number of proxies in front of Grimoire, so rate limits and the audit log see the real client and the cookie is `Secure` over HTTPS. The section shows whether it does.
 - **Registration** is open only for the first account. Invite people, or open it briefly from Settings.
 - **Signing everyone else out**: changing a password ends that user's other sessions; Settings → Account has a button for it too.
 - **API keys** are per user, shown once, and can be read-only. Revoke any you no longer use under Settings → MCP Access.

docs/design-system.md

@@ -53,7 +53,7 @@ Parchment is intentionally not pure white — it's slightly warm to feel like ag
 | Bronze | `#8B7355` | Secondary action buttons (Cancel-but-not-destructive, alternate paths) |
 | Pewter | `#3F4651` | Tertiary/ghost buttons |
 
-**Critical rule:** Action button colors are universal across all apps. A Save button in Scribe and a Save button in Minstrel look identical. Per-app accents do not appear on buttons.
+**Critical rule:** Action button colors are universal across all apps. A Save button in Grimoire and a Save button in Minstrel look identical. Per-app accents do not appear on buttons.
 
 ### Semantic colors
 
@@ -71,7 +71,7 @@ Parchment is intentionally not pure white — it's slightly warm to feel like ag
 
 | App | Hex | Mood |
 |---|---|---|
-| Fabled Scribe | `#5B4A8A` | Dusty violet — ink, manuscripts |
+| Fabled Grimoire | `#5B4A8A` | Dusty violet — ink, manuscripts |
 | Minstrel | `#4A6B5C` | Forest teal — music, performance |
 | Fabled Forge | `#8B5A2B` | Forge bronze — creation, craft |
 | Roundtable | `#4A5D7E` | Slate blue — stewardship, infrastructure |
@@ -80,7 +80,7 @@ Parchment is intentionally not pure white — it's slightly warm to feel like ag
 **Accent usage rules:**
 - The accent appears on the app's wordmark and icon.
 - The accent indicates active/current state in nav (the selected page, the active tab).
-- The accent is the cursor color and text-selection color in long-form surfaces (Scribe notes, Forge story drafts).
+- The accent is the cursor color and text-selection color in long-form surfaces (Grimoire notes, Forge story drafts).
 - The accent does NOT appear on primary or secondary action buttons.
 - The accent does NOT appear in body text or chrome.
 - One accent per app. Don't mix accents within a single app.
@@ -101,6 +101,8 @@ All text-on-surface combinations meet WCAG AA at minimum. Parchment on Obsidian
 | Inter | Body, UI, labels | Google Fonts |
 | JetBrains Mono | Code, terminal output, monospaced data | Google Fonts |
 
+All three are served by the app itself, from `frontend/src/assets/fonts/`, with every subset Google Fonts publishes for them. A page never asks a font host for anything, so an instance with no internet still draws in its own type. They are under the SIL Open Font License; the licences sit beside the files.
+
 ### Why this pairing
 
 Fraunces is a contemporary serif with personality — it has the warmth and authority of a book serif without feeling like costume. It signals "this is considered" without signaling "this is a fantasy product." Inter is the workhorse — neutral, ubiquitous, designed for screens, doesn't compete with the serif. JetBrains Mono is the natural choice for any developer-adjacent product and supports ligatures.
@@ -124,7 +126,7 @@ Fraunces is a contemporary serif with personality — it has the warmth and auth
 - **Sentence case everywhere.** Never Title Case for headings, never ALL CAPS except for the Tiny micro-label style.
 - **Two weights only:** 400 regular and 500 medium. Never 600 or 700 — they read heavy in dark mode.
 - **Fraunces only at 18px and above.** Below that it loses too much detail and feels fragile. For h3 and below, use Inter.
-- **Line height** 1.5 for body, 1.3 for headings, 1.7 for long-form reading surfaces (Scribe notes, Forge drafts).
+- **Line height** 1.5 for body, 1.3 for headings, 1.7 for long-form reading surfaces (Grimoire notes, Forge drafts).
 - **Letter-spacing** at default for everything except the Tiny micro-label, which gets `0.08em` letter-spacing and uppercase styling.
 
 ---
@@ -173,7 +175,7 @@ Padding: `8px 16px` for default, `6px 12px` for compact, `10px 20px` for promine
 
 Used for tags, hashtags, code spans, status badges. Background is the accent color at ~15% opacity, text is the accent at full strength. Border-radius 4px, padding `2px 8px`, Inter 11px/500.
 
-In Scribe specifically, hashtags and tags use the dusty violet accent. In Minstrel, they'd use forest teal. The pattern is shared; the color follows the app.
+In Grimoire specifically, hashtags and tags use the dusty violet accent. In Minstrel, they'd use forest teal. The pattern is shared; the color follows the app.
 
 ### Cards
 
@@ -272,9 +274,9 @@ Use **Lucide** (https://lucide.dev) as the base icon set — it matches this sty
 
 ## Per-app application
 
-### Fabled Scribe (#5B4A8A — dusty violet)
+### Fabled Grimoire (#5B4A8A — dusty violet)
 
-A second-brain notes and task management tool. The accent appears in: the wordmark, hashtags and tag pills, the active nav item, text selection color, and the cursor in the editor. Notes are presented on Iron-surfaced cards with generous reading line-height. The hashtag system uses Scribe's accent for visual continuity.
+A second-brain notes and task management tool. The accent appears in: the wordmark, hashtags and tag pills, the active nav item, text selection color, and the cursor in the editor. Notes are presented on Iron-surfaced cards with generous reading line-height. The hashtag system uses Grimoire's accent for visual continuity.
 
 ### Minstrel (#4A6B5C — forest teal)
 
@@ -332,7 +334,7 @@ Home server management. The accent appears on: the wordmark, healthy/online stat
 }
 
 /* Per-app accent — set ONE of these on the root for each app */
-[data-app="scribe"]    { --fs-accent: #5B4A8A; }
+[data-app="grimoire"]    { --fs-accent: #5B4A8A; }
 [data-app="minstrel"]  { --fs-accent: #4A6B5C; }
 [data-app="forge"]     { --fs-accent: #8B5A2B; }
 [data-app="roundtable"]{ --fs-accent: #4A5D7E; }
@@ -354,11 +356,11 @@ If using Tailwind, extend the theme with these tokens rather than relying on def
 
 ---
 
-# Scribe
+# Grimoire
 
-The design system Scribe renders with is stored in Scribe itself: **Scribe**, which inherits **FabledSword**, edited at `/design-systems`. `frontend/src/assets/theme.css` is generated from it, and CI rejects a `var()` the sheet doesn't define. Where this page and the stored system differ, the stored system is right. Scribe applies the baseline above with these choices:
+The design system Grimoire renders with is stored in Grimoire itself: **Grimoire**, which inherits **FabledSword**, edited at `/design-systems`. `frontend/src/assets/theme.css` is generated from it, and CI rejects a `var()` the sheet doesn't define. Where this page and the stored system differ, the stored system is right. Grimoire applies the baseline above with these choices:
 
-- **Accent footprint.** Dusty violet marks Scribe's own moments: the wordmark, active navigation, the editor's cursor and selection, tags and wikilinks, in-progress status, focus rings, and the call to action that starts something new (a first note, say). Operating the software uses the action colours: Moss to save or confirm, Bronze for alternatives, Oxblood with an icon to delete, Pewter ghost for tertiary actions.
+- **Accent footprint.** Dusty violet marks Grimoire's own moments: the wordmark, active navigation, the editor's cursor and selection, tags and wikilinks, in-progress status, focus rings, and the call to action that starts something new (a first note, say). Operating the software uses the action colours: Moss to save or confirm, Bronze for alternatives, Oxblood with an icon to delete, Pewter ghost for tertiary actions.
 - **Light and dark.** Both are supported. Light mode is warm parchment (`#F5F1E8` page, `#FBF8F0` cards, `#14171A` text) rather than white, with a cool wash on code blocks so syntax colours stay readable. The accent, action and semantic colours are the same in both.
 - **Status and priority.** Status: todo Pewter, in progress the accent, done Moss, cancelled Ash, paused Warning. Priority runs cool to warm: low Info, medium Warning, high Error. Overdue uses Error. Each has a low-alpha `-bg` companion.
 - **Type.** Inter for UI and body, Fraunces at 18px and up (display, H1, H2), JetBrains Mono for code. Two weights only, 400 and 500. Line height 1.5 for body, 1.3 for headings, 1.7 on reading surfaces such as a note.

docs/development.md

@@ -3,9 +3,9 @@
 ## Running it
 
 ```bash
-docker compose up --build          # app + PostgreSQL at http://localhost:5000
-docker compose up --build app      # rebuild after a change
-docker compose down -v             # stop and wipe the database
+docker compose -f docker-compose.dev.yml up --build       # app + PostgreSQL at http://localhost:5000
+docker compose -f docker-compose.dev.yml up --build app   # rebuild after a change
+docker compose -f docker-compose.dev.yml down -v          # stop and wipe the database
 ```
 
 The image builds the frontend, so a frontend change needs a rebuild too. For quicker frontend work, run Vite against the running app; it proxies `/api` to port 5000:
@@ -32,7 +32,7 @@ Unit tests run without a database. Tests marked `integration` need a real Postgr
 The container runs `alembic upgrade head` on every start, after waiting for the database to accept connections.
 
 ```bash
-docker compose exec app alembic revision -m "short_description"
+docker compose -f docker-compose.dev.yml exec app alembic revision -m "short_description"
 ```
 
 - Number revisions sequentially (`0123_...`). Revision ids must fit in 32 characters, the width of `alembic_version.version_num`.
@@ -45,7 +45,7 @@ docker compose exec app alembic revision -m "short_description"
 
 `plugin/` ships straight from git: installs fetch it through `.claude-plugin/marketplace.json`, and there is no build step. After changing anything under `plugin/` or `.claude-plugin/`, run `make mint-plugin` before committing. Claude Code only refreshes an installed plugin when its version changes, and CI fails a plugin change that didn't bump it.
 
-The hooks must run on a bare machine: POSIX shell, awk, sed and the usual coreutils, plus `git` and `curl`. They fail open, so a slow or unreachable Scribe never blocks Claude Code.
+The hooks must run on a bare machine: POSIX shell, awk, sed and the usual coreutils, plus `git` and `curl`. They fail open, so a slow or unreachable Grimoire never blocks Claude Code.
 
 ## CI and releases
 
@@ -57,7 +57,7 @@ CI runs on Gitea Actions (workflow in `.forgejo/workflows/ci.yml`) in the shared
 | `main` | `:latest`, `:<sha>` |
 | a `v*` tag | `:latest`, `:<version>`, `:<sha>` |
 
-`:<sha>` never moves, so it is the rollback point. Images publish to `git.fabledsword.com/bvandeusen/fabledscribe`, with a registry layer cache at `:cache`. The build needs the `REGISTRY_USER` and `REGISTRY_TOKEN` (a token with `write:packages`) repository secrets.
+`:<sha>` never moves, so it is the rollback point. Images publish to `git.fabledsword.com/bvandeusen/fabledgrimoire`, with a registry layer cache at `:cache`. The build needs the `REGISTRY_USER` and `REGISTRY_TOKEN` (a token with `write:packages`) repository secrets.
 
 Work happens on `dev`. A release merges `dev` into `main` with a plain merge commit; a dated `vYYYY.MM.DD.HHMM` tag, matching the version the image reports, can mark it.
 
@@ -65,7 +65,7 @@ Work happens on `dev`. A release merges `dev` into `main` with a plain merge com
 
 ### Backend
 
-- Services open their own session: `async with async_session() as session:` (from `scribe.models`).
+- Services open their own session: `async with async_session() as session:` (from `grimoire.models`).
 - Routes and MCP tools stay thin; the logic lives in `services/`, shared by both.
 - Access checks go through `services/access.py`, never inline ownership checks.
 - Every wait on something outside the process has a deadline.

docs/features.md

@@ -1,6 +1,6 @@
 # Features
 
-Scribe is a self-hosted system of record for the work you do with Claude Code. Claude records what it learned, decided and built, and that record reaches the next session, so a solution is recalled rather than reinvented. There is no language model inside Scribe: Claude reaches it through the MCP endpoint and the Claude Code plugin, and the web UI is where people read and edit the same records.
+Grimoire is a self-hosted system of record for the work you do with Claude Code. Claude records what it learned, decided and built, and that record reaches the next session, so a solution is recalled rather than reinvented. There is no language model inside Grimoire: Claude reaches it through the MCP endpoint and the Claude Code plugin, and the web UI is where people read and edit the same records.
 
 ## Notes
 
@@ -40,8 +40,8 @@ A task is a note with a status (`todo`, `in_progress`, `done`, `cancelled`), plu
 ## Snippets and the shape ledger
 
 - **Snippets** are recorded prior art: a reusable piece of code with when to reach for it, its signature and its canonical location in a repo. Claude searches them before building and is shown matching ones before it writes a file.
-- **Forge integration**: with a git forge connected, Scribe checks a snippet's cached body against its source and marks it current or diverged. Push webhooks keep that fresh.
-- **The shape ledger**: Scribe extracts the code shapes from a bound repo and tracks how each is accounted for: an instance of a snippet, a deliberate variant with its reason, or a one-off. Coverage shows what is still unclassified.
+- **Forge integration**: with a git forge connected, Grimoire checks a snippet's cached body against its source and marks it current or diverged. Push webhooks keep that fresh.
+- **The shape ledger**: Grimoire extracts the code shapes from a bound repo and tracks how each is accounted for: an instance of a snippet, a deliberate variant with its reason, or a one-off. Coverage shows what is still unclassified.
 
 ## Family canon
 
@@ -49,11 +49,11 @@ Projects on the same platform (Android apps, Go services, ...) share good ideas.
 
 ## Design systems
 
-Tokens (colour, type, space, motion, ...) and written guidance, with inheritance: a project's design system can extend a house style and record where it departs. Scribe generates a stylesheet from it, checks code snippets against it, and gives Claude the values to use before it writes UI. `/design-systems` edits them.
+Tokens (colour, type, space, motion, ...) and written guidance, with inheritance: a project's design system can extend a house style and record where it departs. Grimoire generates a stylesheet from it, checks code snippets against it, and gives Claude the values to use before it writes UI. `/design-systems` edits them.
 
 ## Stored processes
 
-Saved procedures, such as a drift audit or a DRY pass. The plugin syncs each one into a Claude Code skill (`/scribe:sync`), which fetches the live procedure when it is invoked.
+Saved procedures, such as a drift audit or a DRY pass. The plugin syncs each one into a Claude Code skill (`/grimoire:sync`), which fetches the live procedure when it is invoked.
 
 ## Search and context injection
 
@@ -65,8 +65,9 @@ Saved procedures, such as a drift audit or a DRY pass. The plugin syncs each one
 
 The whole store is reachable through the MCP endpoint at `/mcp`, authenticated with an API key. The Claude Code plugin in this repo adds:
 
-- hooks for session start, each prompt, before and after tool calls, the end of a turn, compaction and session end, all failing open if Scribe is unreachable;
-- skills for the working practices: using Scribe, writing plans, systematic debugging, verification, brainstorming, reporting back, reusing code, shape accounting and family canon;
+- hooks for session start, each prompt, before and after tool calls, the end of a turn, compaction and session end, all failing open if Grimoire is unreachable;
+- a project fence: a session belongs to the project its starting directory is bound to. Toward any other project it can read anything and file an issue. Editing that project's files, committing or pushing in its repo, or changing its records first asks you, in every permission mode;
+- skills for the working practices: using Grimoire, writing plans, systematic debugging, verification, brainstorming, reporting back, reusing code, shape accounting and family canon;
 - your stored processes as skills.
 
 See [API Keys & MCP](api-keys-and-mcp.md).
@@ -85,8 +86,8 @@ Share a project, note or task with users or groups, as viewer, editor or admin.
 ## Export and backup
 
 - **Personal export**: your notes and tasks as a Markdown ZIP (with YAML frontmatter) or JSON.
-- **Admin backup and restore**, with ids remapped so a backup restores onto another instance.
-- **Scheduled backups**: a daily, dated, uncompressed tar to a folder or an S3-compatible bucket, laid out so a deduplicating tool such as restic stores only what changed. `python -m scribe.restore` brings a fresh instance back from one. See [Backups](backups.md).
+- **Admin backup and restore**: a restore rolls the whole instance back to one of its own backups, after saving the current state, or brings a new instance back from any backup.
+- **Scheduled backups**: a daily, dated, uncompressed tar to a folder or an S3-compatible bucket, laid out so a deduplicating tool such as restic stores only what changed. Restoring is in Settings, or `python -m grimoire.restore`. See [Backups](backups.md).
 
 ## Sign-in
 
@@ -98,12 +99,11 @@ Email and password, plus optional OIDC single sign-on (Authentik, Keycloak, ...)
 |-----|----------|
 | General | Timezone, trash retention, retrieval thresholds, moments, reply shapes |
 | Account | Email, password, active sessions |
-| Profile | About you, response preferences, interests, work schedule |
 | Notifications | Email notifications |
 | Integrations | SearXNG, git forge connections |
 | Data | Export, backup and restore, scheduled backups (admin) |
 | MCP Access | API keys and the command to connect Claude |
-| Config (admin) | What's running, application URL, plugin marketplace, database maintenance, SMTP, forge webhook |
+| Config (admin) | What's running, reverse proxy count (checked against your own request), application URL, plugin marketplace, database maintenance, SMTP, forge webhook |
 | Shared areas (admin) | The canonical areas systems map to |
 | Platforms (admin) | The platform catalogue family canon is grouped by |
 | Users (admin) | Registration, invites, users |

docs/sso-oauth.md

@@ -1,6 +1,6 @@
 # OAuth / OIDC SSO Setup
 
-Scribe supports single sign-on via any OpenID Connect provider.
+Grimoire supports single sign-on via any OpenID Connect provider.
 This guide covers Authentik, but the same pattern works with Keycloak, Authelia, Zitadel, etc.
 
 ## 1. Create the provider in Authentik
@@ -8,7 +8,7 @@ This guide covers Authentik, but the same pattern works with Keycloak, Authelia,
 1. Log in to the Authentik admin UI.
 2. Go to **Applications → Providers → Create → OAuth2/OpenID Provider**.
 3. Fill in:
-   - **Name:** `Scribe` (or whatever you like)
+   - **Name:** `Grimoire` (or whatever you like)
    - **Authorization flow:** your default authorization flow
    - **Client type:** `Confidential`
    - **Redirect URIs:** `https://your-fabled-domain/api/auth/oauth/callback`
@@ -20,7 +20,7 @@ This guide covers Authentik, but the same pattern works with Keycloak, Authelia,
    https://auth.example.com/application/o/fabled-assistant/
    ```
 
-## 2. Configure Scribe
+## 2. Configure Grimoire
 
 Add the following environment variables to the `app` service in `docker-compose.yml`:
 
@@ -64,7 +64,7 @@ docker compose up --build -d
 
 ## 4. Account Linking
 
-When a user logs in via OAuth for the first time, Scribe checks in this order:
+When a user logs in via OAuth for the first time, Grimoire checks in this order:
 
 1. **Existing OAuth sub** — returns that user immediately.
 2. **Matching email** — if a local account already exists with the same email, the OAuth identity is linked to it automatically. The user retains all their notes and tasks.
@@ -92,4 +92,4 @@ The backend will reject any `POST /api/auth/login` or `POST /api/auth/register`
 | Zitadel | `https://your-instance.zitadel.cloud` |
 | Google | `https://accounts.google.com` |
 
-The OIDC discovery endpoint (`<issuer>/.well-known/openid-configuration`) must be publicly reachable from the Scribe container (server-to-server call at login time).
+The OIDC discovery endpoint (`<issuer>/.well-known/openid-configuration`) must be publicly reachable from the Grimoire container (server-to-server call at login time).

frontend/index.html

@@ -4,13 +4,14 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <link rel="apple-touch-icon" href="/apple-touch-icon.png">
     <link rel="manifest" href="/manifest.json">
-    <meta name="theme-color" content="#6c63ff">
+    <meta name="theme-color" content="#14171A">
     <meta name="mobile-web-app-capable" content="yes">
     <meta name="apple-mobile-web-app-capable" content="yes">
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
-    <meta name="apple-mobile-web-app-title" content="Scribe">
-    <title>Fabled Scribe</title>
+    <meta name="apple-mobile-web-app-title" content="Grimoire">
+    <title>Fabled Grimoire</title>
   </head>
   <body>
     <div id="app"></div>

frontend/package-lock.json

@@ -1,12 +1,13 @@
 {
-  "name": "scribe-frontend",
+  "name": "grimoire-frontend",
   "version": "0.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "scribe-frontend",
+      "name": "grimoire-frontend",
       "version": "0.1.0",
+      "license": "AGPL-3.0-only",
       "dependencies": {
         "@fullcalendar/core": "^6.1.20",
         "@fullcalendar/daygrid": "^6.1.20",

frontend/package.json

@@ -1,6 +1,7 @@
 {
-  "name": "scribe-frontend",
+  "name": "grimoire-frontend",
   "private": true,
+  "license": "AGPL-3.0-only",
   "version": "0.1.0",
   "type": "module",
   "scripts": {

frontend/public/favicon.svg

@@ -1,33 +1,18 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" width="32" height="32">
-  <style>
-    .book { fill: #6366f1; stroke: #4f46e5; }
-    .spine { stroke: #4f46e5; }
-    .lines { stroke: #a5b4fc; }
-    @media (prefers-color-scheme: dark) {
-      .book { fill: #e2e8f0; stroke: #cbd5e0; }
-      .spine { stroke: #cbd5e0; }
-      .lines { stroke: #4a5568; }
-    }
-  </style>
-  <!-- Book body -->
-  <path class="book" d="M4 7 C4 7 8 5 16 6 C24 5 28 7 28 7 L28 26 C28 26 24 24 16 25 C8 24 4 26 4 26 Z" stroke-width="0.5"/>
-  <!-- Book spine -->
-  <line class="spine" x1="16" y1="6" x2="16" y2="25" stroke-width="0.8"/>
-  <!-- Left page lines -->
-  <line class="lines" x1="7" y1="11" x2="14" y2="10.5" stroke-width="0.6" stroke-linecap="round"/>
-  <line class="lines" x1="7" y1="14" x2="14" y2="13.5" stroke-width="0.6" stroke-linecap="round"/>
-  <line class="lines" x1="7" y1="17" x2="14" y2="16.5" stroke-width="0.6" stroke-linecap="round"/>
-  <line class="lines" x1="7" y1="20" x2="12" y2="19.5" stroke-width="0.6" stroke-linecap="round"/>
-  <!-- Right page lines -->
-  <line class="lines" x1="18" y1="10.5" x2="25" y2="11" stroke-width="0.6" stroke-linecap="round"/>
-  <line class="lines" x1="18" y1="13.5" x2="25" y2="14" stroke-width="0.6" stroke-linecap="round"/>
-  <line class="lines" x1="18" y1="16.5" x2="25" y2="17" stroke-width="0.6" stroke-linecap="round"/>
-  <!-- Magic spark -->
-  <g transform="translate(24, 5)">
-    <path d="M0 -4 L1 -1 L4 0 L1 1 L0 4 L-1 1 L-4 0 L-1 -1 Z" fill="#f6ad55"/>
-    <path d="M0 -2.5 L0.6 -0.6 L2.5 0 L0.6 0.6 L0 2.5 L-0.6 0.6 L-2.5 0 L-0.6 -0.6 Z" fill="#fbd38d"/>
-  </g>
-  <!-- Secondary sparkles -->
-  <circle cx="20" cy="3" r="0.7" fill="#f6ad55" opacity="0.7"/>
-  <circle cx="27" cy="8" r="0.5" fill="#fbd38d" opacity="0.6"/>
+  <!-- page block, seen at the fore-edge -->
+  <path d="M8.5 4.5 H25.5 Q27 4.5 27 6 V27 Q27 28.5 25.5 28.5 H8.5 Z" fill="#E9DFC6"/>
+  <path d="M25 7 V26.5" stroke="#C9BB97" stroke-width="0.6"/>
+  <!-- cover -->
+  <path d="M5 4 Q5 3 6 3 H24 Q25.5 3 25.5 4.5 V26.5 Q25.5 28 24 28 H6 Q5 28 5 27 Z" fill="#5B4A8A"/>
+  <!-- spine band -->
+  <rect x="5" y="3" width="3.2" height="25" rx="0.6" fill="#47396E"/>
+  <!-- corner fittings -->
+  <path d="M21.5 3 H24 Q25.5 3 25.5 4.5 V7 Z" fill="#D4A94E"/>
+  <path d="M21.5 28 H24 Q25.5 28 25.5 26.5 V24 Z" fill="#D4A94E"/>
+  <!-- clasp across the fore-edge -->
+  <rect x="22.5" y="14" width="5.5" height="3.6" rx="0.8" fill="#D4A94E"/>
+  <circle cx="26.4" cy="15.8" r="0.7" fill="#8A6A22"/>
+  <!-- sigil: a four-pointed star in a ring -->
+  <circle cx="15.5" cy="15.5" r="5.2" fill="none" stroke="#D4A94E" stroke-width="0.9"/>
+  <path d="M15.5 11.4 L16.5 14.5 L19.6 15.5 L16.5 16.5 L15.5 19.6 L14.5 16.5 L11.4 15.5 L14.5 14.5 Z" fill="#F1D48A"/>
 </svg>

frontend/public/manifest.json

@@ -1,17 +1,27 @@
 {
-  "name": "Fabled Scribe",
-  "short_name": "Scribe",
-  "description": "Your self-hosted second brain with AI assistance",
+  "name": "Fabled Grimoire",
+  "short_name": "Grimoire",
+  "description": "A self-hosted work system-of-record for software projects, built to be driven by Claude Code.",
   "start_url": "/",
   "display": "standalone",
-  "background_color": "#1a1a2e",
-  "theme_color": "#6c63ff",
+  "background_color": "#14171A",
+  "theme_color": "#14171A",
   "orientation": "portrait-primary",
   "icons": [
     {
-      "src": "/favicon.ico",
+      "src": "/favicon.svg",
       "sizes": "any",
-      "type": "image/x-icon"
+      "type": "image/svg+xml"
+    },
+    {
+      "src": "/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png"
+    },
+    {
+      "src": "/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png"
     }
   ]
 }

frontend/src/App.vue

@@ -13,11 +13,10 @@ import { fetchVersion } from "@/api/version";
 useTheme();
 
 const router = useRouter();
-// THREE states, not two (#3127 checklist 12). `null` is "not answered yet" and
-// renders nothing; a string renders; `appVersionFailed` renders its own thing.
-// This used to default to the literal "dev" and swallow the error, which meant
-// an instance that could not answer was indistinguishable from a local build
-// that genuinely reports "dev" — a blank standing in for `unknown`, in the one
+// THREE states, not two. `null` is "not answered yet" and renders nothing; a
+// string renders; `appVersionFailed` renders its own thing. Defaulting to the
+// literal "dev" and swallowing the error would make an instance that cannot
+// answer indistinguishable from a local build that genuinely reports "dev" — a blank standing in for `unknown`, in the one
 // readout whose whole job is to say what is running.
 const appVersion = ref<string | null>(null);
 const appVersionFailed = ref(false);

frontend/src/api/backups.ts

@@ -1,4 +1,4 @@
-import { apiGet, apiPost, apiPut } from "@/api/client";
+import { apiGet, apiPost, apiPostRaw, apiPut } from "@/api/client";
 
 /**
  * Scheduled backups — `/api/admin/backups`. One dated,
@@ -71,3 +71,72 @@ export function checkBackupDestination(
 export function runBackupNow(): Promise<{ status: string }> {
   return apiPost<{ status: string }>("/api/admin/backups/run", {});
 }
+
+
+// ── Restore: put the whole instance back to a full backup ─────────────────
+
+export interface StoredBackup {
+  name: string;
+  size_bytes: number;
+}
+
+export interface RestoreCount {
+  kind: string;
+  now: number;
+  after: number;
+}
+
+export interface RestorePreview {
+  /** "fresh": an empty instance takes the backup. "rollback": this instance
+   *  goes back to its own earlier backup. */
+  mode: "fresh" | "rollback";
+  exported_at: string | null;
+  counts: RestoreCount[];
+}
+
+export interface RestoreResult extends RestorePreview {
+  status: "ok";
+  restored: Record<string, number>;
+  safety_backup: { file: string; size_bytes: number; where: string; note?: string };
+}
+
+/** A backup at the destination, by name, or a file picked from this computer. */
+export type RestoreFrom = { source: string } | { file: File };
+
+// Reading, checking and writing the whole store is slow by design; bounded,
+// but in minutes.
+const RESTORE_TIMEOUT_MS = 10 * 60 * 1000;
+
+export function listRestoreSources(): Promise<{ backups: StoredBackup[]; error?: string }> {
+  return apiGet("/api/admin/restore/sources", { timeoutMs: 60_000 });
+}
+
+async function restoreCall<T>(path: string, from: RestoreFrom, query: Record<string, string> = {}): Promise<T> {
+  const params = new URLSearchParams(query);
+  if ("source" in from) {
+    params.set("source", from.source);
+    return apiPostRaw<T>(`${path}?${params}`, null, null, { timeoutMs: RESTORE_TIMEOUT_MS });
+  }
+  const qs = params.toString() ? `?${params}` : "";
+  const isTar = from.file.name.toLowerCase().endsWith(".tar");
+  // The JSON download is parsed first, so a damaged file fails here, before
+  // the upload.
+  const body = isTar ? from.file : JSON.stringify(JSON.parse(await from.file.text()));
+  return apiPostRaw<T>(`${path}${qs}`, body, isTar ? "application/x-tar" : "application/json",
+                       { timeoutMs: RESTORE_TIMEOUT_MS });
+}
+
+export function previewRestore(from: RestoreFrom): Promise<RestorePreview> {
+  return restoreCall<RestorePreview>("/api/admin/restore/preview", from);
+}
+
+export function restoreBackup(from: RestoreFrom): Promise<RestoreResult> {
+  return restoreCall<RestoreResult>("/api/admin/restore", from, { confirm: "rollback" });
+}
+
+/** When a backup named `grimoire-20261015T020000Z.tar` was taken. */
+export function backupTakenAt(name: string): Date | null {
+  const m = /(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z/.exec(name);
+  if (!m) return null;
+  return new Date(Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6]));
+}

frontend/src/api/client.ts

@@ -41,8 +41,8 @@ async function handleResponse<T>(res: Response, path: string): Promise<T> {
 /**
  * The server's `{"error": "..."}` message from a failed call, or `fallback`
  * when the failure carried none (network error, non-JSON body). The one place
- * the error envelope is unpacked on the client — views used to restate this
- * as a six-line `"body" in e` branch at every catch site.
+ * the error envelope is unpacked on the client, so no view restates it as a
+ * `"body" in e` branch at its catch site.
  */
 export function apiErrorMessage(e: unknown, fallback: string): string {
   if (e && typeof e === "object" && "body" in e) {
@@ -61,15 +61,14 @@ export function apiErrorMessage(e: unknown, fallback: string): string {
  * surface can show for "pending forever" that is not a lie.
  *
  * 30s is chosen to be longer than anything healthy: it has to clear a cold
- * embedding call and a list view under connection-pool contention (#2384 had
- * /api/projects fanning 25 concurrent sessions at a 15-connection pool), so
+ * embedding call and a list view under connection-pool contention, so
  * tripping it means something is genuinely wrong rather than merely busy. Slow
  * BY DESIGN is a different case and passes its own value — see the callers in
  * SettingsView that do.
  */
 const DEFAULT_TIMEOUT_MS = 30_000;
 
-/** HTTP 408. Not a status any Scribe route returns, so it unambiguously means
+/** HTTP 408. Not a status any Grimoire route returns, so it unambiguously means
  *  "the client gave up" rather than anything the server said. */
 const CLIENT_TIMEOUT_STATUS = 408;
 
@@ -157,6 +156,15 @@ export function apiPost<T>(path: string, body: unknown, opts?: RequestOpts): Pro
   return request<T>(path, { method: "POST", headers: JSON_HEADERS, body: JSON.stringify(body) }, opts);
 }
 
+/** A POST whose body is sent as it is (a file, or text already serialised),
+ *  under the same deadline and error handling as every other call. */
+export function apiPostRaw<T>(
+  path: string, body: BodyInit | null, contentType: string | null, opts?: RequestOpts,
+): Promise<T> {
+  const headers = contentType ? { "Content-Type": contentType } : undefined;
+  return request<T>(path, { method: "POST", headers, body }, opts);
+}
+
 export function apiPut<T>(path: string, body: unknown, opts?: RequestOpts): Promise<T> {
   return request<T>(path, { method: "PUT", headers: JSON_HEADERS, body: JSON.stringify(body) }, opts);
 }
@@ -501,24 +509,6 @@ export const createApiKey = (name: string, scope: 'read' | 'write') =>
 
 export const revokeApiKey = (id: number) => apiDelete(`/api/api-keys/${id}`)
 
-// ── User Profile ─────────────────────────────────────────────────────────────
-
-export interface UserProfile {
-  display_name: string
-  job_title: string
-  industry: string
-  expertise_level: 'novice' | 'intermediate' | 'expert'
-  response_style: 'concise' | 'balanced' | 'detailed'
-  tone: 'casual' | 'professional' | 'technical'
-  interests: string[]
-  work_schedule: { days?: string[]; start?: string; end?: string }
-}
-
-export const getProfile = () => apiGet<UserProfile>('/api/profile')
-export const updateProfile = (data: Partial<UserProfile>) =>
-  apiPut<UserProfile>('/api/profile', data)
-
-
 // ── Note Versions (pinning) ──────────────────────────────────────────────────
 
 import type { NoteVersion } from '../types/task'

frontend/src/api/designSystems.ts

@@ -1,5 +1,5 @@
 /**
- * Design systems — the stylesheet held as records (milestone #254).
+ * Design systems — the stylesheet held as records.
  *
  * A design system is a named set of tokens with an optional parent. A system
  * with no parent is a "family"; one with a parent holds ONLY what it changes,
@@ -82,8 +82,8 @@ export interface StarterRoleGroup {
 }
 
 /** The starter token ROLES offered at creation — names and purposes, never
- *  values. A default palette would be one install's taste shipped as product
- *  (rule #115), so the values are always the operator's to fill. */
+ *  values. A default palette would be one install's taste shipped as product,
+ *  so the values are always the operator's to fill. */
 export const listStarterRoleGroups = () =>
   apiGet<{ groups: StarterRoleGroup[]; default_prefix: string }>(
     "/api/design-systems/starter-roles",

frontend/src/api/lessons.ts

@@ -88,7 +88,7 @@ export interface Lesson {
   no_rule?: { why: string; judged_at: string | null };
   /** Sent by a create or update that recorded "no rule fits" when that answer
    *  completes a group: lessons with no rule that keep landing in one
-   *  situation, which may want a rule written for it (#4634). */
+   *  situation, which may want a rule written for it. */
   convergence?: { lessons: { id: number; title: string }[] };
   /** Set when another user owns this record. */
   shared?: boolean;

frontend/src/api/moments.ts

@@ -44,6 +44,14 @@ export interface RemovedDefault {
   created_at: string | null;
 }
 
+export interface MomentRuleUsage {
+  rule_id: number;
+  /** Null for a rule deleted since it was delivered. */
+  title: string | null;
+  delivered: number;
+  opened: boolean;
+}
+
 export interface MomentUsage {
   /** How many times a mounted rule arrived at this moment. */
   delivered: number;
@@ -53,6 +61,8 @@ export interface MomentUsage {
    *  the door, not the line that prompted it. */
   opened: number;
   last_delivered_at: string | null;
+  /** Each rule delivered here, most delivered first. */
+  by_rule: MomentRuleUsage[];
 }
 
 export interface MomentsPayload {

frontend/src/api/replyShapes.ts

@@ -1,7 +1,7 @@
 import { apiGet } from "@/api/client";
 
 /**
- * The reply shapes Scribe ships — `GET /api/retrieval/reply-shapes`.
+ * The reply shapes Grimoire ships — `GET /api/retrieval/reply-shapes`.
  * The same catalog the `list_reply_shapes` MCP tool returns, plus what only
  * the operator's view needs: the preferences mounted on each shape's moment,
  * and how often each shape was delivered.

frontend/src/api/snippets.ts

@@ -30,7 +30,7 @@ export interface SnippetFields {
    *  no `locations`/`tags` predates that attribution and cannot be un-merged. */
   merged_from: { id: number; locations?: SnippetLocation[]; tags?: string[] }[];
   code: string;
-  /** Free text that is not the situation — why, history, caveats (#4378).
+  /** Free text that is not the situation — why, history, caveats.
    *  Kept out of `when_to_use`, which the snippet is ranked on. */
   notes: string;
 }
@@ -62,7 +62,7 @@ export interface Snippet {
 export type SnippetUsage = RecordUsage;
 
 /** Result of the last drift check — does the recorded location and code still
- *  match source? The check runs agent-side (Scribe has no checkout); this is the
+ *  match source? The check runs agent-side (Grimoire has no checkout); this is the
  *  remembered verdict. `current` is false once the snippet has been edited since
  *  the check, at which point the verdict describes code that's no longer there. */
 export interface SnippetVerification {
@@ -188,7 +188,7 @@ export async function findDuplicateSnippets(
 }
 
 /** Record a drift-check verdict. The check itself runs where the code is — an
- *  agent with the working tree — since Scribe has no checkout. This stores what
+ *  agent with the working tree — since Grimoire has no checkout. This stores what
  *  was found, and is how the UI clears a stale marker after a manual fix. */
 export async function verifySnippet(
   id: number,

frontend/src/api/systems.ts

@@ -24,7 +24,7 @@ export interface System {
   open_issue_count: number;
   /**
    * How often this area's rulings were shown to a session because its files
-   * were touched (`surfaced_count`), and how often it was opened (#4769).
+   * were touched (`surfaced_count`), and how often it was opened.
    * Present on the list and detail reads; optional because a System returned
    * by a create or update carries none.
    */
@@ -45,7 +45,7 @@ export async function listSystems(projectId: number): Promise<System[]> {
  * caller to accept or ignore.
  *
  * A same-named System in this project is a 409 ApiError carrying
- * `{duplicate, existing_id}` — the same gate the MCP door enforces (#2482).
+ * `{duplicate, existing_id}` — the same gate the MCP door enforces.
  */
 export interface CreatedSystem extends System {
   canonical_suggestion?: CanonicalMatch;

frontend/src/api/version.ts

@@ -2,7 +2,7 @@ import { apiGet } from "./client";
 
 /**
  * What `/api/version` answers — the client's half of `build_version_payload`
- * (`src/scribe/routes/api.py`), which is where the reasoning for the shape is
+ * (`src/grimoire/routes/api.py`), which is where the reasoning for the shape is
  * written down.
  *
  * EVERY FIELD BUT `version` IS OPTIONAL, and an absent one means "this build

frontend/src/assets/fonts/OFL-fraunces.txt

@@ -0,0 +1,93 @@
+Copyright 2018 The Fraunces Project Authors (https://github.com/undercasetype/Fraunces)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

frontend/src/assets/fonts/OFL-inter.txt

@@ -0,0 +1,93 @@
+Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

frontend/src/assets/fonts/OFL-jetbrainsmono.txt

@@ -0,0 +1,93 @@
+Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

frontend/src/assets/fonts/fonts.css

@@ -0,0 +1,401 @@
+/* The three typefaces the design system names: Fraunces for display, Inter for
+   body text, JetBrains Mono for code. They are served from the app itself, so a
+   page never asks a font host for anything and an instance with no internet
+   still draws in its own type.
+
+   Every subset Google Fonts publishes for these families is here, not only
+   latin. Each face carries a unicode-range, so a browser downloads only the
+   subsets the page's text uses.
+
+   All three are under the SIL Open Font License 1.1; the OFL-*.txt files beside
+   this one are their licences. */
+
+/* Fraunces, italic, vietnamese */
+@font-face {
+  font-family: 'Fraunces';
+  font-style: italic;
+  font-weight: 300 900;
+  font-display: swap;
+  src: url(./fraunces-italic-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+
+/* Fraunces, italic, latin-ext */
+@font-face {
+  font-family: 'Fraunces';
+  font-style: italic;
+  font-weight: 300 900;
+  font-display: swap;
+  src: url(./fraunces-italic-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* Fraunces, italic, latin */
+@font-face {
+  font-family: 'Fraunces';
+  font-style: italic;
+  font-weight: 300 900;
+  font-display: swap;
+  src: url(./fraunces-italic-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+/* Fraunces, normal, vietnamese */
+@font-face {
+  font-family: 'Fraunces';
+  font-style: normal;
+  font-weight: 300 900;
+  font-display: swap;
+  src: url(./fraunces-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+
+/* Fraunces, normal, latin-ext */
+@font-face {
+  font-family: 'Fraunces';
+  font-style: normal;
+  font-weight: 300 900;
+  font-display: swap;
+  src: url(./fraunces-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* Fraunces, normal, latin */
+@font-face {
+  font-family: 'Fraunces';
+  font-style: normal;
+  font-weight: 300 900;
+  font-display: swap;
+  src: url(./fraunces-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+/* Inter, italic, cyrillic-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-italic-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+
+/* Inter, italic, cyrillic */
+@font-face {
+  font-family: 'Inter';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-italic-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+
+/* Inter, italic, greek-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-italic-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+
+/* Inter, italic, greek */
+@font-face {
+  font-family: 'Inter';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-italic-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+
+/* Inter, italic, vietnamese */
+@font-face {
+  font-family: 'Inter';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-italic-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+
+/* Inter, italic, latin-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-italic-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* Inter, italic, latin */
+@font-face {
+  font-family: 'Inter';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-italic-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+/* Inter, normal, cyrillic-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+
+/* Inter, normal, cyrillic */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+
+/* Inter, normal, greek-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-normal-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+
+/* Inter, normal, greek */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+
+/* Inter, normal, vietnamese */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+
+/* Inter, normal, latin-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* Inter, normal, latin */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./inter-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+/* Inter, normal, cyrillic-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(./inter-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+
+/* Inter, normal, cyrillic */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(./inter-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+
+/* Inter, normal, greek-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(./inter-normal-greek-ext.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+
+/* Inter, normal, greek */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(./inter-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+
+/* Inter, normal, vietnamese */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(./inter-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+
+/* Inter, normal, latin-ext */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(./inter-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* Inter, normal, latin */
+@font-face {
+  font-family: 'Inter';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(./inter-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+/* JetBrains Mono, italic, cyrillic-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-italic-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+
+/* JetBrains Mono, italic, cyrillic */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-italic-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+
+/* JetBrains Mono, italic, greek */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-italic-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+
+/* JetBrains Mono, italic, vietnamese */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-italic-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+
+/* JetBrains Mono, italic, latin-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-italic-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* JetBrains Mono, italic, latin */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-italic-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+
+/* JetBrains Mono, normal, cyrillic-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-normal-cyrillic-ext.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+
+/* JetBrains Mono, normal, cyrillic */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-normal-cyrillic.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+
+/* JetBrains Mono, normal, greek */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-normal-greek.woff2) format('woff2');
+  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
+}
+
+/* JetBrains Mono, normal, vietnamese */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-normal-vietnamese.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+
+/* JetBrains Mono, normal, latin-ext */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-normal-latin-ext.woff2) format('woff2');
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C4, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+
+/* JetBrains Mono, normal, latin */
+@font-face {
+  font-family: 'JetBrains Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(./jetbrains-mono-normal-latin.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}

frontend/src/assets/sweep-shared.css

@@ -1,4 +1,4 @@
-/* The sweep-row visual language (#3207).
+/* The sweep-row visual language.
  *
  * A "sweep" is a pane that lists records in the order they most need a human
  * — the note verification sweep, the rule sweep, preference drift — as one

frontend/src/assets/theme.css

@@ -1,20 +1,18 @@
-@import url('https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300..900;1,9..144,300..900&family=Inter:ital,wght@0,400;0,500;1,400&family=JetBrains+Mono:ital,wght@0,400;1,400&display=swap');
-
 /* ==========================================================================
-   GENERATED FROM THE DESIGN SYSTEM — Scribe (design system 2), which inherits
+   GENERATED FROM THE DESIGN SYSTEM — Grimoire (design system 2), which inherits
    the FabledSword house style (design system 1).
 
    Do not hand-edit the --fs-* block below. Edit the design system in the app
    and regenerate: /design-systems -> Master stylesheet -> Copy.
 
    DARK IS THE BASE LAYER. The kit is dark-mode-first, so :root carries the dark
-   palette and [data-theme="light"] overrides it. That is the inverse of how this
-   file used to read, and it is deliberate: the light palette was never specified
-   by any rule, so it is recorded as a departure rather than as the default.
+   palette and [data-theme="light"] overrides it. No rule specifies the light
+   palette, so it is written as an override of the dark one rather than as the
+   default.
 
-   The -fg tokens are a badge's TEXT colour, added because the ladder used its
-   raw hue as text on a 12% tint of the same hue — measured 1.60-2.97:1 on the
-   dark palette against the kit's AA floor of 4.5. Each is the hue mixed toward
+   The -fg tokens are a badge's TEXT colour. A raw hue as text on a 12% tint of
+   the same hue measures 1.60-2.97:1 on the dark palette, under the kit's AA
+   floor of 4.5, so each -fg token is the hue mixed toward
    --fs-text-primary until it clears 4.5:1 worst-case over surface-raised and
    surface-hover in BOTH modes. Mixing toward that token is what makes one
    declaration cover both: it inverts, so the text follows the mode.
@@ -26,7 +24,7 @@
 
 :root {
   /* accent */
-  --fs-accent: #5B4A8A;  /* Scribe's signature colour */
+  --fs-accent: #5B4A8A;  /* Grimoire's signature colour */
   --fs-accent-soft: color-mix(in srgb, var(--fs-accent) 15%, transparent);  /* Pill, tag and badge backgrounds */
   --fs-accent-faint: color-mix(in srgb, var(--fs-accent) 8%, transparent);  /* The faintest accent wash */
   --fs-accent-deep: color-mix(in srgb, var(--fs-accent) 70%, black);  /* The accent, darkened */

frontend/src/components/AppHeader.vue

@@ -39,7 +39,7 @@ router.afterEach(() => {
       <!-- Left: brand -->
       <router-link to="/" class="nav-brand">
         <AppLogo :size="34" />
-        <span class="brand-text">Scribe</span>
+        <span class="brand-text">Grimoire</span>
       </router-link>
 
       <!-- Center: primary navigation (desktop) -->
@@ -132,11 +132,10 @@ router.afterEach(() => {
 }
 /* Three tracks, not a flex row with an absolutely-centred overlay.
  *
- * The pill bar used to be `position: absolute; left: 50%`, which meant it did
- * not participate in layout: when the header ran out of room it OVERLAPPED the
- * brand and the utility cluster rather than pushing them, and nothing wrapped
- * or scrolled to signal it. A sixth link reached that point at ~1270px, which
- * is an ordinary window on any monitor.
+ * A pill bar at `position: absolute; left: 50%` does not participate in
+ * layout: when the header runs out of room it OVERLAPS the brand and the
+ * utility cluster rather than pushing them, and nothing wraps or scrolls to
+ * signal it — at an ordinary window width on any monitor.
  *
  * `1fr auto 1fr` fixes it structurally. A `1fr` track has an AUTO minimum, so
  * neither side can be squeezed below its content, and the two side tracks stay
@@ -327,7 +326,7 @@ router.afterEach(() => {
   margin-top: 0.25rem;
 }
 
-/* The grid above means running out of room can no longer cause a collision —
+/* The grid above means running out of room cannot cause a collision —
    but it can still make the header wider than the window, and a horizontally
    scrolling header is its own defect. So shed width before that happens. The
    wordmark goes first: the logo beside it says the same thing and is still the

frontend/src/components/AppLogo.vue

@@ -3,6 +3,8 @@ defineProps<{ size?: number }>();
 </script>
 
 <template>
+  <!-- The clasped grimoire, the same drawing as public/favicon.svg. Its colours
+       are the mark's own and stay fixed in both themes, like the tab icon. -->
   <svg
     class="app-logo"
     xmlns="http://www.w3.org/2000/svg"
@@ -11,45 +13,21 @@ defineProps<{ size?: number }>();
     :height="size ?? 24"
     aria-hidden="true"
   >
-    <defs>
-      <linearGradient id="logo-gradient" x1="0" y1="0" x2="1" y2="1">
-        <stop offset="0%" stop-color="var(--fs-accent)" />
-        <stop offset="100%" stop-color="var(--fs-accent-deep)" />
-      </linearGradient>
-    </defs>
-    <!-- Book body -->
-    <path class="logo-book" d="M4 7 C4 7 8 5 16 6 C24 5 28 7 28 7 L28 26 C28 26 24 24 16 25 C8 24 4 26 4 26 Z" stroke-width="0.5"/>
-    <!-- Book spine -->
-    <line class="logo-spine" x1="16" y1="6" x2="16" y2="25" stroke-width="0.8"/>
-    <!-- Left page lines -->
-    <line class="logo-lines" x1="7" y1="11" x2="14" y2="10.5" stroke-width="0.6" stroke-linecap="round"/>
-    <line class="logo-lines" x1="7" y1="14" x2="14" y2="13.5" stroke-width="0.6" stroke-linecap="round"/>
-    <line class="logo-lines" x1="7" y1="17" x2="14" y2="16.5" stroke-width="0.6" stroke-linecap="round"/>
-    <line class="logo-lines" x1="7" y1="20" x2="12" y2="19.5" stroke-width="0.6" stroke-linecap="round"/>
-    <!-- Right page lines -->
-    <line class="logo-lines" x1="18" y1="10.5" x2="25" y2="11" stroke-width="0.6" stroke-linecap="round"/>
-    <line class="logo-lines" x1="18" y1="13.5" x2="25" y2="14" stroke-width="0.6" stroke-linecap="round"/>
-    <line class="logo-lines" x1="18" y1="16.5" x2="25" y2="17" stroke-width="0.6" stroke-linecap="round"/>
-    <!-- Magic spark -->
-    <g transform="translate(24, 5)">
-      <path d="M0 -4 L1 -1 L4 0 L1 1 L0 4 L-1 1 L-4 0 L-1 -1 Z" fill="#f6ad55"/>
-      <path d="M0 -2.5 L0.6 -0.6 L2.5 0 L0.6 0.6 L0 2.5 L-0.6 0.6 L-2.5 0 L-0.6 -0.6 Z" fill="#fbd38d"/>
-    </g>
-    <!-- Secondary sparkles -->
-    <circle cx="20" cy="3" r="0.7" fill="#f6ad55" opacity="0.7"/>
-    <circle cx="27" cy="8" r="0.5" fill="#fbd38d" opacity="0.6"/>
+    <!-- page block, seen at the fore-edge -->
+    <path d="M8.5 4.5 H25.5 Q27 4.5 27 6 V27 Q27 28.5 25.5 28.5 H8.5 Z" fill="#E9DFC6"/>
+    <path d="M25 7 V26.5" stroke="#C9BB97" stroke-width="0.6"/>
+    <!-- cover -->
+    <path d="M5 4 Q5 3 6 3 H24 Q25.5 3 25.5 4.5 V26.5 Q25.5 28 24 28 H6 Q5 28 5 27 Z" fill="#5B4A8A"/>
+    <!-- spine band -->
+    <rect x="5" y="3" width="3.2" height="25" rx="0.6" fill="#47396E"/>
+    <!-- corner fittings -->
+    <path d="M21.5 3 H24 Q25.5 3 25.5 4.5 V7 Z" fill="#D4A94E"/>
+    <path d="M21.5 28 H24 Q25.5 28 25.5 26.5 V24 Z" fill="#D4A94E"/>
+    <!-- clasp across the fore-edge -->
+    <rect x="22.5" y="14" width="5.5" height="3.6" rx="0.8" fill="#D4A94E"/>
+    <circle cx="26.4" cy="15.8" r="0.7" fill="#8A6A22"/>
+    <!-- sigil: a four-pointed star in a ring -->
+    <circle cx="15.5" cy="15.5" r="5.2" fill="none" stroke="#D4A94E" stroke-width="0.9"/>
+    <path d="M15.5 11.4 L16.5 14.5 L19.6 15.5 L16.5 16.5 L15.5 19.6 L14.5 16.5 L11.4 15.5 L14.5 14.5 Z" fill="#F1D48A"/>
   </svg>
 </template>
-
-<style scoped>
-.logo-book {
-  fill: url(#logo-gradient);
-  stroke: color-mix(in srgb, var(--fs-accent) 70%, transparent);
-}
-.logo-spine {
-  stroke: var(--fs-text-secondary);
-}
-.logo-lines {
-  stroke: var(--fs-text-tertiary);
-}
-</style>

frontend/src/components/BackupScheduleSettings.vue

@@ -187,9 +187,9 @@ async function backUpNow() {
       </ul>
 
       <p class="intro">
-        Each run adds one dated file, <code>scribe-&lt;date&gt;.tar</code>, holding every table
+        Each run adds one dated file, <code>grimoire-&lt;date&gt;.tar</code>, holding every table
         as plain lines. It is not compressed, so a deduplicating tool such as restic stores only what
-        changed since the day before. Scribe never deletes old backups — the destination keeps and
+        changed since the day before. Grimoire never deletes old backups — the destination keeps and
         thins the history. Sharing, API keys and forge connections are not included.
       </p>
 
@@ -223,7 +223,7 @@ async function backUpNow() {
           <span>Folder</span>
           <input v-model.trim="form.folder_path" class="fs-input" placeholder="/backups" />
           <span class="field-hint">
-            A path inside the Scribe container — usually a share mounted there that a backup
+            A path inside the Grimoire container — usually a share mounted there that a backup
             service watches.
           </span>
         </label>
@@ -237,7 +237,7 @@ async function backUpNow() {
         </label>
         <label class="field">
           <span>Bucket</span>
-          <input v-model.trim="form.s3_bucket" class="fs-input" placeholder="scribe" />
+          <input v-model.trim="form.s3_bucket" class="fs-input" placeholder="grimoire" />
         </label>
         <label class="field">
           <span>Access key</span>

frontend/src/components/HistoryPanel.vue

@@ -1,466 +0,0 @@
-<script setup lang="ts">
-import { ref, computed, onMounted } from "vue";
-import { apiGet, pinNoteVersion, unpinNoteVersion } from "@/api/client";
-import DiffView from "@/components/DiffView.vue";
-import { computeDiff, type DiffLine } from "@/utils/diff";
-import { fmtStamp } from "@/utils/dateFormat";
-
-interface NoteVersion {
-  id: number;
-  note_id: number;
-  title: string;
-  tags: string[];
-  body?: string;
-  pin_kind: "auto" | "manual" | null;
-  pin_label: string | null;
-  created_at: string;
-}
-
-const props = defineProps<{
-  noteId: number;
-  currentBody: string;
-}>();
-
-const emit = defineEmits<{
-  (e: 'restore', body: string, tags: string[]): void;
-  (e: 'close'): void;
-}>();
-
-const versions = ref<NoteVersion[]>([]);
-const selectedVersion = ref<NoteVersion | null>(null);
-const loading = ref(false);
-const loadingDetail = ref(false);
-
-const diff = computed<DiffLine[]>(() => {
-  if (!selectedVersion.value?.body) return [];
-
-  return computeDiff(props.currentBody, selectedVersion.value.body);
-});
-
-async function loadVersions() {
-  loading.value = true;
-  try {
-    const data = await apiGet<{ versions: NoteVersion[] }>(
-      `/api/notes/${props.noteId}/versions`
-    );
-    versions.value = data.versions;
-    if (versions.value.length > 0) {
-      await selectVersionItem(versions.value[0]);
-    }
-  } catch {
-    // silent
-  } finally {
-    loading.value = false;
-  }
-}
-
-async function selectVersionItem(v: NoteVersion) {
-  if (v.body !== undefined) {
-    selectedVersion.value = v;
-    return;
-  }
-  loadingDetail.value = true;
-  try {
-    const full = await apiGet<NoteVersion>(
-      `/api/notes/${props.noteId}/versions/${v.id}`
-    );
-    // Cache body back onto list item
-    const listItem = versions.value.find(x => x.id === v.id);
-    if (listItem) listItem.body = full.body;
-    selectedVersion.value = full;
-  } catch {
-    // silent
-  } finally {
-    loadingDetail.value = false;
-  }
-}
-
-function restore() {
-  if (!selectedVersion.value?.body) return;
-  emit('restore', selectedVersion.value.body, selectedVersion.value.tags ?? []);
-}
-
-// ── Pin / unpin / edit-label state ──────────────────────────────────────────
-
-const editingLabel = ref(false);
-const draftLabel = ref("");
-const pinSaving = ref(false);
-
-function startEditLabel() {
-  if (!selectedVersion.value) return;
-  draftLabel.value = selectedVersion.value.pin_label ?? "";
-  editingLabel.value = true;
-}
-
-function cancelEditLabel() {
-  editingLabel.value = false;
-  draftLabel.value = "";
-}
-
-async function savePin() {
-  if (!selectedVersion.value || pinSaving.value) return;
-  pinSaving.value = true;
-  try {
-    const updated = await pinNoteVersion(
-      props.noteId, selectedVersion.value.id, draftLabel.value || null,
-    );
-    // Reflect server state in the local list + selected version.
-    const idx = versions.value.findIndex(v => v.id === updated.id);
-    if (idx >= 0) {
-      versions.value[idx].pin_kind = updated.pin_kind;
-      versions.value[idx].pin_label = updated.pin_label;
-    }
-    if (selectedVersion.value) {
-      selectedVersion.value.pin_kind = updated.pin_kind;
-      selectedVersion.value.pin_label = updated.pin_label;
-    }
-    editingLabel.value = false;
-  } catch {
-    // silent — leaving the form open lets the user retry
-  } finally {
-    pinSaving.value = false;
-  }
-}
-
-async function unpinSelected() {
-  if (!selectedVersion.value || pinSaving.value) return;
-  pinSaving.value = true;
-  try {
-    await unpinNoteVersion(props.noteId, selectedVersion.value.id);
-    const idx = versions.value.findIndex(v => v.id === selectedVersion.value!.id);
-    if (idx >= 0) {
-      versions.value[idx].pin_kind = null;
-      versions.value[idx].pin_label = null;
-    }
-    if (selectedVersion.value) {
-      selectedVersion.value.pin_kind = null;
-      selectedVersion.value.pin_label = null;
-    }
-  } catch {
-    // silent
-  } finally {
-    pinSaving.value = false;
-  }
-}
-
-onMounted(loadVersions);
-</script>
-
-<template>
-  <teleport to="body">
-    <div class="modal-overlay" @click.self="emit('close')">
-      <div class="modal-card history-modal">
-        <div class="history-header">
-          <h3 class="history-title">Version History</h3>
-          <button class="history-close" aria-label="Close version history" @click="emit('close')">&times;</button>
-        </div>
-
-        <div class="history-body">
-          <!-- Left: version list -->
-          <div class="history-list">
-            <div v-if="loading" class="history-empty">Loading...</div>
-            <div v-else-if="!versions.length" class="history-empty">No versions yet.</div>
-            <div
-              v-for="v in versions"
-              :key="v.id"
-              :class="['history-item', { selected: selectedVersion?.id === v.id }]"
-              @click="selectVersionItem(v)"
-            >
-              <div class="history-item-title">
-                <span
-                  v-if="v.pin_kind === 'manual'"
-                  class="pin-badge pin-badge-manual"
-                  :title="v.pin_label || 'Pinned'"
-                  aria-label="manually pinned"
-                >●</span>
-                <span
-                  v-else-if="v.pin_kind === 'auto'"
-                  class="pin-badge pin-badge-auto"
-                  :title="v.pin_label || 'Auto-pinned (stable)'"
-                  aria-label="auto-pinned"
-                >◐</span>
-                {{ v.title || 'Untitled' }}
-              </div>
-              <div
-                v-if="v.pin_kind === 'manual' && v.pin_label"
-                class="history-item-label"
-              >{{ v.pin_label }}</div>
-              <div class="history-item-date">{{ fmtStamp(v.created_at) }}</div>
-            </div>
-          </div>
-
-          <!-- Right: diff -->
-          <div class="history-diff">
-            <div v-if="loadingDetail" class="history-empty">Loading version...</div>
-            <div v-else-if="!selectedVersion" class="history-empty">Select a version to compare.</div>
-            <template v-else>
-              <div class="version-pin-controls">
-                <!-- Label editor -->
-                <div v-if="editingLabel" class="pin-label-form">
-                  <input
-                    v-model="draftLabel"
-                    maxlength="500"
-                    type="text"
-                    class="pin-label-input"
-                    placeholder="Optional label (e.g. 'post-network-refresh runbook')"
-                  />
-                  <button class="btn-pin-save" :disabled="pinSaving" @click="savePin">
-                    {{ pinSaving ? "Saving…" : "Save" }}
-                  </button>
-                  <button class="btn-pin-cancel" @click="cancelEditLabel">Cancel</button>
-                </div>
-
-                <!-- Default: kind-aware action row -->
-                <div v-else class="pin-actions">
-                  <span v-if="selectedVersion.pin_kind === 'manual'" class="pin-state">
-                    <span class="pin-badge pin-badge-manual">●</span>
-                    Manually pinned{{ selectedVersion.pin_label ? `: ${selectedVersion.pin_label}` : '' }}
-                  </span>
-                  <span v-else-if="selectedVersion.pin_kind === 'auto'" class="pin-state">
-                    <span class="pin-badge pin-badge-auto">◐</span>
-                    Auto-pinned{{ selectedVersion.pin_label ? `: ${selectedVersion.pin_label}` : '' }}
-                  </span>
-
-                  <button
-                    v-if="selectedVersion.pin_kind === null"
-                    class="btn-pin"
-                    :disabled="pinSaving"
-                    @click="startEditLabel"
-                  >Pin version</button>
-                  <button
-                    v-else-if="selectedVersion.pin_kind === 'manual'"
-                    class="btn-pin-edit"
-                    :disabled="pinSaving"
-                    @click="startEditLabel"
-                  >Edit label</button>
-                  <button
-                    v-else
-                    class="btn-pin"
-                    :disabled="pinSaving"
-                    @click="startEditLabel"
-                  >Pin permanently</button>
-                  <button
-                    v-if="selectedVersion.pin_kind === 'manual'"
-                    class="btn-unpin"
-                    :disabled="pinSaving"
-                    @click="unpinSelected"
-                  >Unpin</button>
-                </div>
-              </div>
-              <DiffView :diff="diff" />
-            </template>
-          </div>
-        </div>
-
-        <div class="history-footer">
-          <button
-            class="btn-primary"
-            :disabled="!selectedVersion?.body"
-            @click="restore"
-          >Restore this version</button>
-          <button class="modal-btn" @click="emit('close')">Close</button>
-        </div>
-      </div>
-    </div>
-  </teleport>
-</template>
-
-<style scoped>
-.history-modal {
-  max-width: 900px;
-  width: 95%;
-  height: 80vh;
-  max-height: 700px;
-  display: flex;
-  flex-direction: column;
-  padding: 0;
-}
-
-.history-header {
-  flex-shrink: 0;
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  padding: 0.9rem 1.25rem;
-  border-bottom: 1px solid var(--fs-border-color);
-}
-
-.history-title {
-  margin: 0;
-  font-size: 1rem;
-}
-
-.history-close {
-  background: none;
-  border: none;
-  font-size: 1.25rem;
-  cursor: pointer;
-  color: var(--fs-text-tertiary);
-  line-height: 1;
-  padding: 0.1rem 0.3rem;
-}
-.history-close:hover { color: var(--fs-text-primary); }
-
-.history-body {
-  flex: 1;
-  min-height: 0;
-  display: flex;
-  overflow: hidden;
-}
-
-.history-list {
-  width: 220px;
-  flex-shrink: 0;
-  border-right: 1px solid var(--fs-border-color);
-  overflow-y: auto;
-}
-
-.history-item {
-  padding: 0.6rem 0.9rem;
-  cursor: pointer;
-  border-left: 3px solid transparent;
-  border-bottom: 1px solid var(--fs-border-color);
-}
-.history-item:hover { background: var(--fs-surface-raised); }
-.history-item.selected {
-  border-left-color: var(--fs-accent);
-  background: var(--fs-surface-raised);
-}
-
-.history-item-title {
-  font-size: 0.85rem;
-  font-weight: 500;
-  color: var(--fs-text-primary);
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.history-item-date {
-  font-size: 0.75rem;
-  color: var(--fs-text-tertiary);
-  margin-top: 0.15rem;
-}
-
-.history-diff {
-  flex: 1;
-  min-width: 0;
-  overflow: hidden;
-  display: flex;
-  flex-direction: column;
-  padding: 0.5rem;
-}
-
-.history-empty {
-  padding: 1rem;
-  font-size: 0.85rem;
-  color: var(--fs-text-tertiary);
-}
-
-.history-footer {
-  flex-shrink: 0;
-  display: flex;
-  gap: 0.5rem;
-  justify-content: flex-end;
-  padding: 0.75rem 1.25rem;
-  border-top: 1px solid var(--fs-border-color);
-}
-
-
-/* ── Pin badges + label rendering ───────────────────────────────────────── */
-.pin-badge {
-  display: inline-block;
-  width: 0.7rem;
-  text-align: center;
-  margin-right: 0.35rem;
-  font-size: 0.85em;
-  line-height: 1;
-}
-.pin-badge-manual { color: var(--fs-accent); }
-.pin-badge-auto { color: var(--fs-text-tertiary); }
-
-.history-item-label {
-  font-size: 0.72rem;
-  color: var(--fs-accent);
-  font-style: italic;
-  margin-top: 0.15rem;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-/* ── Pin controls above the diff ────────────────────────────────────────── */
-.version-pin-controls {
-  padding: 0.4rem 0.5rem 0.5rem;
-  border-bottom: 1px solid var(--fs-border-color);
-  font-size: 0.82rem;
-}
-.pin-actions {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  flex-wrap: wrap;
-}
-.pin-state {
-  font-style: italic;
-  color: var(--fs-text-tertiary);
-  flex: 1;
-  min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-.btn-pin, .btn-pin-edit, .btn-unpin {
-  padding: 0.25rem 0.7rem;
-  font-size: 0.78rem;
-  background: transparent;
-  color: inherit;
-  border: 1px solid var(--fs-border-color);
-  border-radius: 999px;
-  cursor: pointer;
-}
-.btn-pin:hover:not(:disabled), .btn-pin-edit:hover:not(:disabled) {
-  background: rgba(99, 102, 241, 0.12);
-  border-color: var(--fs-accent);
-}
-.btn-unpin:hover:not(:disabled) {
-  background: rgba(239, 68, 68, 0.10);
-  border-color: rgba(239, 68, 68, 0.5);
-}
-.pin-label-form {
-  display: flex;
-  gap: 0.4rem;
-  align-items: center;
-}
-.pin-label-input {
-  flex: 1;
-  padding: 0.3rem 0.5rem;
-  font-size: 0.85rem;
-  background: var(--fs-surface-page);
-  border: 1px solid var(--fs-border-color);
-  border-radius: var(--fs-radius-sm);
-  color: inherit;
-}
-.pin-label-input:focus {
-  outline: none;
-  border-color: var(--fs-accent);
-}
-.btn-pin-save, .btn-pin-cancel {
-  padding: 0.3rem 0.7rem;
-  font-size: 0.78rem;
-  background: transparent;
-  color: inherit;
-  border: 1px solid var(--fs-border-color);
-  border-radius: var(--fs-radius-sm);
-  cursor: pointer;
-}
-.btn-pin-save:hover:not(:disabled) {
-  background: rgba(99, 102, 241, 0.12);
-  border-color: var(--fs-accent);
-}
-.btn-pin-save:disabled, .btn-pin-cancel:disabled,
-.btn-pin:disabled, .btn-pin-edit:disabled, .btn-unpin:disabled {
-  opacity: 0.5;
-  cursor: progress;
-}
-</style>

frontend/src/components/InlineAssistPanel.vue

@@ -1,258 +0,0 @@
-<script setup lang="ts">
-import { ref, computed } from "vue";
-import { renderMarkdown } from "@/utils/markdown";
-import type { DiffLine } from "@/composables/useAssist";
-
-const props = defineProps<{
-  phase: "streaming" | "review";
-  label: string;
-  streamingText: string;
-  diff: DiffLine[];
-  proposedText: string;
-}>();
-
-const emit = defineEmits<{
-  accept: [];
-  reject: [];
-  cancel: [];
-}>();
-
-const showFullText = ref(false);
-
-const renderedStreaming = computed(() => renderMarkdown(props.streamingText));
-const renderedProposed = computed(() => renderMarkdown(props.proposedText));
-
-const markers: Record<DiffLine["type"], string> = {
-  equal: " ",
-  delete: "−",
-  insert: "+",
-};
-</script>
-
-<template>
-  <!-- ── Streaming ───────────────────────────────────────────────── -->
-  <div v-if="phase === 'streaming'" class="iap iap-streaming">
-    <div class="iap-header">
-      <span class="iap-pulse"></span>
-      <span class="iap-label">{{ label }}</span>
-      <button class="iap-btn-cancel" @click="emit('cancel')">Cancel</button>
-    </div>
-    <div class="iap-stream-preview prose" v-html="renderedStreaming"></div>
-    <div v-if="!streamingText" class="iap-waiting">Waiting for model…</div>
-  </div>
-
-  <!-- ── Review ─────────────────────────────────────────────────── -->
-  <div v-else-if="phase === 'review'" class="iap iap-review">
-    <div class="iap-header">
-      <span class="iap-review-title">Proposed changes</span>
-      <button class="iap-btn-toggle" @click="showFullText = !showFullText">
-        {{ showFullText ? "Show diff" : "Show full text" }}
-      </button>
-      <div class="iap-actions">
-        <button class="iap-btn-accept" @click="emit('accept')">✓ Accept</button>
-        <button class="iap-btn-reject" @click="emit('reject')">✗ Reject</button>
-      </div>
-    </div>
-
-    <!-- Diff view -->
-    <div v-if="!showFullText" class="iap-diff">
-      <div
-        v-for="(line, i) in diff"
-        :key="i"
-        :class="['iap-diff-line', `iap-diff-${line.type}`]"
-      >
-        <span class="iap-diff-marker">{{ markers[line.type] }}</span>
-        <span class="iap-diff-text">{{ line.text }}</span>
-      </div>
-      <div v-if="!diff.length" class="iap-diff-empty">No changes.</div>
-    </div>
-
-    <!-- Full text view -->
-    <div v-else class="iap-full-text prose" v-html="renderedProposed"></div>
-  </div>
-</template>
-
-<style scoped>
-.iap {
-  border-radius: var(--fs-radius-sm);
-  margin-bottom: 0.75rem;
-  overflow: hidden;
-  border: 1px solid var(--fs-border-color);
-  background: var(--fs-surface-page);
-}
-
-/* ── Header ── */
-.iap-header {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  padding: 0.45rem 0.75rem;
-  font-size: 0.85rem;
-  border-bottom: 1px solid var(--fs-border-color);
-  background: var(--fs-surface-raised);
-}
-
-/* ── Streaming ── */
-.iap-streaming {
-  border-color: var(--fs-accent);
-}
-.iap-streaming .iap-header {
-  background: color-mix(in srgb, var(--fs-accent) 8%, var(--fs-surface-raised));
-}
-
-.iap-pulse {
-  display: inline-block;
-  width: 8px;
-  height: 8px;
-  border-radius: 50%;
-  background: var(--fs-accent);
-  flex-shrink: 0;
-  animation: iap-pulse 1.2s ease-in-out infinite;
-}
-@keyframes iap-pulse {
-  0%, 100% { opacity: 1; transform: scale(1); }
-  50%       { opacity: 0.4; transform: scale(0.8); }
-}
-
-.iap-label {
-  flex: 1;
-  font-weight: 500;
-  color: var(--fs-text-primary);
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.iap-btn-cancel {
-  background: none;
-  border: 1px solid var(--fs-border-color);
-  color: var(--fs-text-secondary);
-  border-radius: var(--fs-radius-sm);
-  padding: 0.15rem 0.5rem;
-  cursor: pointer;
-  font-size: 0.8rem;
-  font-family: inherit;
-  flex-shrink: 0;
-}
-.iap-btn-cancel:hover {
-  border-color: var(--fs-error);
-  color: var(--fs-error);
-}
-
-.iap-stream-preview {
-  padding: 0.75rem;
-  font-size: 0.9rem;
-  min-height: 2.5rem;
-  max-height: 320px;
-  overflow-y: auto;
-}
-
-.iap-waiting {
-  padding: 0.75rem;
-  font-size: 0.85rem;
-  color: var(--fs-text-tertiary);
-}
-
-/* ── Review ── */
-.iap-review-title {
-  flex: 1;
-  font-weight: 600;
-  color: var(--fs-text-primary);
-}
-
-.iap-btn-toggle {
-  background: none;
-  border: 1px solid var(--fs-border-color);
-  color: var(--fs-text-secondary);
-  border-radius: var(--fs-radius-sm);
-  padding: 0.15rem 0.5rem;
-  cursor: pointer;
-  font-size: 0.78rem;
-  font-family: inherit;
-}
-.iap-btn-toggle:hover {
-  border-color: var(--fs-accent);
-  color: var(--fs-accent);
-}
-
-.iap-actions {
-  display: flex;
-  gap: 0.35rem;
-}
-
-.iap-btn-accept,
-.iap-btn-reject {
-  border: none;
-  border-radius: var(--fs-radius-sm);
-  padding: 0.2rem 0.65rem;
-  cursor: pointer;
-  font-size: 0.8rem;
-  font-family: inherit;
-  font-weight: var(--fs-weight-medium);
-}
-.iap-btn-accept {
-  background: var(--fs-success);
-  color: var(--fs-text-on-action);
-}
-.iap-btn-accept:hover { opacity: 0.85; }
-
-.iap-btn-reject {
-  background: var(--fs-surface-raised);
-  color: var(--fs-text-secondary);
-  border: 1px solid var(--fs-border-color);
-}
-.iap-btn-reject:hover {
-  border-color: var(--fs-error);
-  color: var(--fs-error);
-}
-
-/* ── Diff ── */
-.iap-diff {
-  font-family: ui-monospace, "Cascadia Code", "Fira Mono", monospace;
-  font-size: 0.82rem;
-  line-height: 1.6;
-  max-height: 440px;
-  overflow-y: auto;
-  padding: 0.4rem 0;
-}
-
-.iap-diff-line {
-  display: flex;
-  gap: 0.5rem;
-  padding: 0 0.75rem;
-  white-space: pre-wrap;
-  word-break: break-word;
-}
-
-.iap-diff-equal  { color: var(--fs-text-tertiary); }
-.iap-diff-delete {
-  background: color-mix(in srgb, var(--fs-error) 10%, transparent);
-  color: var(--fs-error-fg);
-}
-.iap-diff-insert {
-  background: color-mix(in srgb, var(--fs-success) 10%, transparent);
-  color: var(--fs-success-fg);
-}
-
-.iap-diff-marker {
-  width: 1ch;
-  flex-shrink: 0;
-  font-weight: 700;
-  user-select: none;
-}
-
-.iap-diff-empty {
-  padding: 0.75rem;
-  color: var(--fs-text-tertiary);
-  font-size: 0.85rem;
-  font-family: inherit;
-}
-
-/* ── Full text ── */
-.iap-full-text {
-  padding: 0.75rem;
-  font-size: 0.9rem;
-  max-height: 440px;
-  overflow-y: auto;
-}
-</style>

frontend/src/components/LessonsTaughtPanel.vue

@@ -12,8 +12,7 @@
  * A COMPONENT rather than markup inside the task editor, because the same
  * question is worth answering on any record a lesson can cite — an issue, a
  * spike, a dev-log. One panel, mounted wherever that is true, instead of the
- * shape being written a second time the first time someone wants it on notes
- * (#3207).
+ * shape being written a second time the first time someone wants it on notes.
  *
  * SILENT WHEN EMPTY. Most records taught no lesson, and a panel that renders
  * "None yet" on every page is a panel people learn to skip — which costs the

frontend/src/components/MomentRuleUsage.vue

@@ -0,0 +1,37 @@
+<script setup lang="ts">
+import type { MomentRuleUsage } from "@/api/moments";
+
+/**
+ * Which rules a moment delivered, and whether an agent went on to read each.
+ * The moment's own counts cannot say this once two rules are mounted there.
+ * Closed by default: the counts in the row above are what most visits want.
+ */
+defineProps<{ rules: MomentRuleUsage[] }>();
+</script>
+
+<template>
+  <details v-if="rules.length" class="moment-rules">
+    <summary>Rules delivered here</summary>
+    <ul class="delivered-list">
+      <li v-for="r in rules" :key="r.rule_id" class="delivered-row">
+        <span class="delivered-title">{{ r.title ?? `Rule ${r.rule_id} (deleted)` }}</span>
+        <span class="delivered-count">delivered {{ r.delivered }}</span>
+        <span :class="r.opened ? 'delivered-opened' : 'delivered-unopened'">
+          {{ r.opened ? "opened" : "not opened" }}
+        </span>
+      </li>
+    </ul>
+  </details>
+</template>
+
+<style scoped>
+.moment-rules { margin-top: var(--fs-space-2); font-size: var(--fs-size-tiny); }
+.moment-rules summary { cursor: pointer; color: var(--fs-text-tertiary); }
+.delivered-list { list-style: none; margin: var(--fs-space-1) 0 0; padding: 0; display: flex; flex-direction: column; gap: var(--fs-space-1); }
+.delivered-row { display: flex; flex-wrap: wrap; align-items: baseline; gap: var(--fs-space-2); font-variant-numeric: tabular-nums; }
+.delivered-title { color: var(--fs-text-primary); font-size: var(--fs-size-body-sm); }
+.delivered-count { color: var(--fs-text-secondary); }
+.delivered-opened { color: var(--fs-text-secondary); }
+/* Not read is a fact about this window, not a fault: quiet, like "nothing mounted". */
+.delivered-unopened { color: var(--fs-text-tertiary); font-style: italic; }
+</style>

frontend/src/components/MomentsSettings.vue

@@ -2,6 +2,7 @@
 import { computed, onMounted, ref } from "vue";
 import { useMomentsStore } from "@/stores/moments";
 import MomentProposals from "@/components/MomentProposals.vue";
+import MomentRuleUsage from "@/components/MomentRuleUsage.vue";
 import type { MomentAction, MomentUsage } from "@/api/moments";
 import { fmtDate } from "@/utils/dateFormat";
 
@@ -153,7 +154,7 @@ onMounted(() => store.load(true));
               v-for="a in actionsFor(m.name)"
               :key="`${a.via}:${a.tool}:${a.match}`"
               :class="['action-chip', { 'is-install': a.via === 'install' }]"
-              :title="a.via === 'install' ? 'Added on this install' : 'Ships with Scribe'"
+              :title="a.via === 'install' ? 'Added on this install' : 'Ships with Grimoire'"
             >
               <code>{{ actionLabel(a) }}</code>
               <button
@@ -167,6 +168,7 @@ onMounted(() => store.load(true));
               >×</button>
             </span>
           </div>
+          <MomentRuleUsage v-if="usage(m.name)" :rules="usage(m.name)!.by_rule" />
         </li>
       </ul>
 
@@ -186,6 +188,7 @@ onMounted(() => store.load(true));
                 </template>
               </span>
             </div>
+            <MomentRuleUsage v-if="usage(name)" :rules="usage(name)!.by_rule" />
           </li>
         </ul>
       </template>

frontend/src/components/NoteCard.vue

@@ -1,168 +0,0 @@
-<script setup lang="ts">
-import { useRouter } from "vue-router";
-import type { Note } from "@/types/note";
-import TagPill from "@/components/TagPill.vue";
-import { relativeTime } from "@/composables/useRelativeTime";
-import { renderPreview } from "@/utils/markdown";
-
-const props = defineProps<{ note: Note; compact?: boolean }>();
-const emit = defineEmits<{ "tag-click": [tag: string] }>();
-const router = useRouter();
-
-function onTagClick(tag: string) {
-  emit("tag-click", tag);
-}
-
-function goEdit() {
-  router.push(`/notes/${props.note.id}/edit`);
-}
-</script>
-
-<template>
-  <router-link :to="`/notes/${note.id}`" :class="['note-card', { compact }]">
-
-    <!-- Compact: single row -->
-    <template v-if="compact">
-      <span class="note-title-compact">{{ note.title || "Untitled" }}</span>
-      <div class="note-tags-compact">
-        <TagPill
-          v-for="tag in note.tags.slice(0, 3)"
-          :key="tag"
-          :tag="tag"
-          @click.stop="onTagClick(tag)"
-        />
-      </div>
-      <span class="timestamp-compact">{{ relativeTime(note.updated_at) }}</span>
-    </template>
-
-    <!-- Full: original layout -->
-    <template v-else>
-      <div class="note-top">
-        <h3 class="note-title">{{ note.title || "Untitled" }}</h3>
-        <button class="btn-edit" title="Edit" @click.prevent.stop="goEdit">Edit</button>
-      </div>
-      <div v-if="note.body" class="note-preview prose" v-html="renderPreview(note.body)"></div>
-      <div class="note-meta">
-        <TagPill
-          v-for="tag in note.tags"
-          :key="tag"
-          :tag="tag"
-          @click.stop="onTagClick(tag)"
-        />
-        <span class="timestamp">{{ relativeTime(note.updated_at) }}</span>
-      </div>
-    </template>
-
-  </router-link>
-</template>
-
-<style scoped>
-.note-card {
-  display: block;
-  padding: 1rem;
-  border-radius: var(--fs-radius-lg);
-  text-decoration: none;
-  color: inherit;
-  background: var(--fs-surface-raised);
-  box-shadow: 0 1px 4px rgba(0, 0, 0, 0.06), 0 0 0 1px color-mix(in srgb, var(--fs-accent) 6%, transparent);
-  transition: box-shadow 0.2s, transform 0.18s ease;
-}
-.note-card:hover {
-  box-shadow: 0 4px 16px rgba(0, 0, 0, 0.10), 0 0 0 1px color-mix(in srgb, var(--fs-accent) 14.0%, transparent);
-  transform: translateY(-2px);
-}
-
-/* Compact single-row layout */
-.note-card.compact {
-  display: flex;
-  align-items: center;
-  gap: 0.6rem;
-  padding: 0.45rem 0.75rem;
-  background: var(--fs-surface-raised);
-  box-shadow: none;
-  border-radius: 0;
-  border-bottom: 1px solid var(--fs-border-color);
-  transform: none !important;
-}
-.note-card.compact:first-child {
-  border-top: 1px solid var(--fs-border-color);
-}
-.note-card.compact:hover {
-  box-shadow: none;
-  background: color-mix(in srgb, var(--fs-accent) 4%, transparent);
-  transform: none;
-}
-.note-title-compact {
-  font-size: 0.9rem;
-  font-weight: 500;
-  flex: 1;
-  min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-.note-tags-compact {
-  display: flex;
-  gap: 0.3rem;
-  flex-shrink: 0;
-}
-.timestamp-compact {
-  font-size: 0.72rem;
-  color: var(--fs-text-tertiary);
-  flex-shrink: 0;
-  white-space: nowrap;
-}
-
-/* Full layout */
-.note-top {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.5rem;
-  margin-bottom: 0.25rem;
-}
-.note-title {
-  margin: 0;
-  font-size: 1.1rem;
-  min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-.btn-edit {
-  flex-shrink: 0;
-  padding: 0.25rem 0.6rem;
-  font-size: 0.8rem;
-  background: var(--fs-surface-raised);
-  color: var(--fs-text-secondary);
-  border: 1px solid var(--fs-border-color);
-  border-radius: var(--fs-radius-sm);
-  cursor: pointer;
-  transition: color 0.15s, border-color 0.15s;
-}
-.btn-edit:hover {
-  color: var(--fs-accent);
-  border-color: var(--fs-accent);
-}
-.note-preview {
-  margin: 0 0 0.5rem;
-  color: var(--fs-text-secondary);
-  font-size: 0.9rem;
-  max-height: 7.5em;
-  overflow: hidden;
-  position: relative;
-  -webkit-mask-image: linear-gradient(to bottom, black 60%, transparent 100%);
-  mask-image: linear-gradient(to bottom, black 60%, transparent 100%);
-}
-.note-meta {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  flex-wrap: wrap;
-}
-.timestamp {
-  margin-left: auto;
-  font-size: 0.75rem;
-  color: var(--fs-text-tertiary);
-}
-</style>

frontend/src/components/ProjectDesignTab.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 /**
- * A project's own code, checked against the design system it is bound to (#2432).
+ * A project's own code, checked against the design system it is bound to.
  *
  * This is what the design surface is FOR: a project's recorded components
  * measured against the sheet they are supposed to use. The check itself is not
@@ -15,7 +15,7 @@
  * someone changes the shared value and half the components don't move.
  *
  * SCOPE, and it is a limit rather than an omission: this reads RECORDED code —
- * snippets — because that is the code Scribe holds. A repository's own sources
+ * snippets — because that is the code Grimoire holds. A repository's own sources
  * are checked where they live, by that project's CI.
  */
 import { onMounted, ref, watch } from "vue";
@@ -38,7 +38,7 @@ async function run() {
   } catch {
     // Said out loud rather than rendered as an empty result. "Couldn't check"
     // and "nothing to report" look identical if you let them, and that is how
-    // a check comes to sit dead without anyone noticing (#2419).
+    // a check comes to sit dead without anyone noticing.
     failed.value = true;
   } finally {
     loading.value = false;

frontend/src/components/ProjectStatusBadge.vue

@@ -4,7 +4,7 @@
  *
  * Deliberately not StatusBadge. That component is typed to TaskStatus and
  * speaks a different vocabulary; these two only ever shared a CSS class name,
- * which is what made them look like one shape that had drifted (#3132).
+ * which is what makes them look like one shape that has drifted.
  *
  * Extracted because ProjectView and ProjectListView really were spelling the
  * same pill twice, with the differences you get from two hands rather than
@@ -49,7 +49,7 @@ const label = (s: string) => LABELS[s] ?? s;
    Measured worst-case over raised and hover in both modes: active 4.82:1,
    paused 4.63:1, completed 4.78:1, archived 4.84:1.
    No new design tokens: four values used by one component are the kind of
-   growth Scribe's own design-system note warns about ("if this system grows
+   growth Grimoire's own design-system note warns about ("if this system grows
    past a handful of tokens, that is worth noticing rather than
    accommodating"). The derivation is stated once, here. */
 .project-status--active {

frontend/src/components/ReplyShapesSettings.vue

@@ -6,7 +6,7 @@ import type { RulePreset } from "@/api/rulebooks";
 import RuleEditorSlideOver from "@/components/rules/RuleEditorSlideOver.vue";
 
 /**
- * The reply shapes Scribe ships, and the operator's adjustments to each
+ * The reply shapes Grimoire ships, and the operator's adjustments to each
  * A shape is product, so its text is read-only here;
  * what the operator owns is the preferences mounted on the shape's moment,
  * which arrive beside it and win where they differ. "Adjust this" opens the
@@ -39,7 +39,7 @@ const delivered = computed(() =>
 const verdict = computed(() => {
   if (!data.value) return "";
   const n = shapes.value.length;
-  const parts = [`${n} ${n === 1 ? "shape ships" : "shapes ship"} with Scribe`];
+  const parts = [`${n} ${n === 1 ? "shape ships" : "shapes ship"} with Grimoire`];
   parts.push(adjusted.value
     ? `${adjusted.value} adjusted by your preferences`
     : "none adjusted — the defaults stand");
@@ -126,7 +126,7 @@ onMounted(load);
           </button>
 
           <div v-if="open === s.key" :id="`shape-${s.key}`" class="shape-body">
-            <h4 class="body-label">Ships with Scribe · at <code>{{ s.moment }}</code></h4>
+            <h4 class="body-label">Ships with Grimoire · at <code>{{ s.moment }}</code></h4>
             <div class="shape-text">{{ s.text }}</div>
 
             <h4 class="body-label">Your adjustments</h4>

frontend/src/components/RestoreBackupDialog.vue

@@ -0,0 +1,278 @@
+<script setup lang="ts">
+/**
+ * Restore: put the whole instance back to a full backup.
+ *
+ * Choose a backup (one at the backup destination, or a file from this
+ * computer), see what it would change, type the confirmation, run it. On a
+ * live instance this is a rollback to the instance's own earlier backup; on a
+ * new, empty one it takes the backup in. Either way the server backs up the
+ * current state first and signs everyone out afterwards.
+ */
+import { computed, onMounted, ref } from "vue";
+import { apiErrorMessage } from "@/api/client";
+import {
+  backupTakenAt, listRestoreSources, previewRestore, restoreBackup,
+  type RestoreFrom, type RestorePreview, type RestoreResult, type StoredBackup,
+} from "@/api/backups";
+import { formatBytes } from "@/utils/bytes";
+
+const emit = defineEmits<{ close: [] }>();
+
+const CONFIRM_WORDS = "roll back";
+
+type Step = "choose" | "checking" | "preview" | "running" | "done";
+const step = ref<Step>("choose");
+const sources = ref<StoredBackup[]>([]);
+const sourcesError = ref("");
+const sourcesLoading = ref(true);
+const chosen = ref<RestoreFrom | null>(null);
+const chosenLabel = ref("");
+const preview = ref<RestorePreview | null>(null);
+const result = ref<RestoreResult | null>(null);
+const error = ref("");
+const typed = ref("");
+const fileInput = ref<HTMLInputElement | null>(null);
+
+const confirmed = computed(() => typed.value.trim().toLowerCase() === CONFIRM_WORDS);
+
+function when(value: Date | string | null | undefined): string {
+  if (!value) return "an unknown date";
+  const date = typeof value === "string" ? new Date(value) : value;
+  return Number.isNaN(date.getTime()) ? "an unknown date" : date.toLocaleString();
+}
+
+onMounted(async () => {
+  try {
+    const answer = await listRestoreSources();
+    sources.value = answer.backups;
+    sourcesError.value = answer.error ?? "";
+  } catch (e) {
+    sourcesError.value = apiErrorMessage(e, "Could not list the backups at the destination.");
+  } finally {
+    sourcesLoading.value = false;
+  }
+});
+
+async function check(from: RestoreFrom, label: string) {
+  chosen.value = from;
+  chosenLabel.value = label;
+  error.value = "";
+  typed.value = "";
+  step.value = "checking";
+  try {
+    preview.value = await previewRestore(from);
+    step.value = "preview";
+  } catch (e) {
+    error.value = apiErrorMessage(e, "That backup could not be read.");
+    step.value = "choose";
+  }
+}
+
+function pickFile(event: Event) {
+  const file = (event.target as HTMLInputElement).files?.[0];
+  if (fileInput.value) fileInput.value.value = "";
+  if (file) check({ file }, file.name);
+}
+
+async function run() {
+  if (!chosen.value || !confirmed.value) return;
+  error.value = "";
+  step.value = "running";
+  try {
+    result.value = await restoreBackup(chosen.value);
+    step.value = "done";
+  } catch (e) {
+    error.value = apiErrorMessage(e, "The restore failed. Nothing was changed.");
+    step.value = "preview";
+  }
+}
+
+function finish() {
+  // Every session ended with the restore, this one included.
+  window.location.assign("/login");
+}
+</script>
+
+<template>
+  <teleport to="body">
+    <div class="modal-overlay" @click="step === 'running' || step === 'done' ? null : emit('close')">
+      <div class="modal-card restore-card" @click.stop>
+        <template v-if="step === 'choose' || step === 'checking'">
+          <h3 class="modal-title">Restore from a backup</h3>
+          <p class="modal-message">
+            Puts the whole instance back to the moment the backup was taken, for every user.
+            You'll see what changes before anything happens.
+          </p>
+          <p v-if="error" class="restore-error" role="alert">{{ error }}</p>
+
+          <h4 class="restore-subhead">At the backup destination</h4>
+          <p v-if="sourcesLoading" class="restore-muted">Looking for backups…</p>
+          <p v-else-if="sourcesError" class="restore-muted">{{ sourcesError }}</p>
+          <p v-else-if="!sources.length" class="restore-muted">No backups there yet.</p>
+          <ul v-else class="restore-sources">
+            <li v-for="b in sources" :key="b.name">
+              <button
+                class="restore-source"
+                :disabled="step === 'checking'"
+                @click="check({ source: b.name }, when(backupTakenAt(b.name)))"
+              >
+                <span>{{ when(backupTakenAt(b.name)) }}</span>
+                <span class="restore-muted">{{ formatBytes(b.size_bytes) }}</span>
+              </button>
+            </li>
+          </ul>
+
+          <h4 class="restore-subhead">From this computer</h4>
+          <p class="restore-muted">
+            A backup file (.tar) or the Full Backup download (.json). Uploads are size-limited;
+            a large file restores from the destination above, or with
+            <code>python -m grimoire.restore</code>.
+          </p>
+          <div class="modal-actions restore-actions-left">
+            <button class="modal-btn" :disabled="step === 'checking'" @click="fileInput?.click()">
+              Choose a file…
+            </button>
+            <input ref="fileInput" type="file" accept=".json,.tar" class="hidden-file-input" @change="pickFile" />
+          </div>
+
+          <p v-if="step === 'checking'" class="restore-muted">Reading {{ chosenLabel }}…</p>
+          <div class="modal-actions">
+            <button class="modal-btn" @click="emit('close')">Cancel</button>
+          </div>
+        </template>
+
+        <template v-else-if="(step === 'preview' || step === 'running') && preview">
+          <h3 class="modal-title">
+            {{ preview.mode === "rollback" ? "Roll back to this backup?" : "Restore this backup?" }}
+          </h3>
+          <p class="modal-message">
+            <template v-if="preview.mode === 'rollback'">
+              Everything goes back to {{ when(preview.exported_at) }}, for every user. Anything made
+              since is removed, edits since are undone, and records deleted since come back.
+            </template>
+            <template v-else>
+              This instance has no records yet, so it takes the backup from {{ when(preview.exported_at) }} as it is.
+            </template>
+            The current state is backed up first, and everyone is signed out afterwards.
+          </p>
+          <table class="restore-counts">
+            <thead><tr><th></th><th>Now</th><th>After</th></tr></thead>
+            <tbody>
+              <tr v-for="c in preview.counts" :key="c.kind">
+                <td>{{ c.kind }}</td><td>{{ c.now }}</td><td>{{ c.after }}</td>
+              </tr>
+            </tbody>
+          </table>
+          <p v-if="error" class="restore-error" role="alert">{{ error }}</p>
+          <label class="restore-confirm">
+            Type <strong>{{ CONFIRM_WORDS }}</strong> to continue
+            <input v-model="typed" class="fs-input input" :disabled="step === 'running'" autocomplete="off" />
+          </label>
+          <div class="modal-actions">
+            <button class="modal-btn" :disabled="step === 'running'" @click="step = 'choose'">Back</button>
+            <button
+              class="modal-btn modal-btn-danger"
+              :disabled="!confirmed || step === 'running'"
+              @click="run"
+            >{{ step === "running" ? "Restoring…" : preview.mode === "rollback" ? "Roll back" : "Restore" }}</button>
+          </div>
+        </template>
+
+        <template v-else-if="step === 'done' && result">
+          <h3 class="modal-title">Restored</h3>
+          <p class="modal-message">
+            The instance is back to {{ when(result.exported_at) }}.
+            The state it replaced was saved as <code>{{ result.safety_backup.file }}</code>
+            in {{ result.safety_backup.where }}.
+            <template v-if="result.safety_backup.note"> {{ result.safety_backup.note }}</template>
+            Search is being rebuilt in the background. Everyone has been signed out, so sign in again.
+          </p>
+          <div class="modal-actions">
+            <button class="modal-btn modal-btn-primary" @click="finish">Sign in again</button>
+          </div>
+        </template>
+      </div>
+    </div>
+  </teleport>
+</template>
+
+<style scoped>
+.restore-card {
+  max-width: 34rem;
+  max-height: 85vh;
+  overflow-y: auto;
+}
+.restore-subhead {
+  margin: 1rem 0 0.4rem;
+  font-size: 0.9rem;
+}
+.restore-muted {
+  font-size: 0.85rem;
+  color: var(--fs-text-secondary);
+  margin: 0 0 0.5rem;
+}
+.restore-error {
+  font-size: 0.85rem;
+  color: var(--fs-action-destructive);
+  margin: 0 0 0.75rem;
+}
+.restore-sources {
+  list-style: none;
+  margin: 0 0 0.5rem;
+  padding: 0;
+  max-height: 14rem;
+  overflow-y: auto;
+  border: 1px solid var(--fs-border-color);
+  border-radius: var(--fs-radius-sm);
+}
+.restore-source {
+  display: flex;
+  justify-content: space-between;
+  width: 100%;
+  padding: 0.45rem 0.7rem;
+  border: none;
+  border-bottom: 1px solid var(--fs-border-color);
+  background: none;
+  color: var(--fs-text-primary);
+  font: inherit;
+  font-size: 0.875rem;
+  text-align: left;
+  cursor: pointer;
+}
+.restore-sources li:last-child .restore-source {
+  border-bottom: none;
+}
+.restore-source:hover:not(:disabled) {
+  background: var(--fs-surface-hover);
+}
+.restore-actions-left {
+  justify-content: flex-start;
+  margin-bottom: 1rem;
+}
+.restore-counts {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.875rem;
+  margin: 0 0 1rem;
+}
+.restore-counts th,
+.restore-counts td {
+  text-align: right;
+  padding: 0.25rem 0.5rem;
+  border-bottom: 1px solid var(--fs-border-color);
+}
+.restore-counts th:first-child,
+.restore-counts td:first-child {
+  text-align: left;
+}
+.hidden-file-input {
+  display: none;
+}
+.restore-confirm {
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+  font-size: 0.875rem;
+  margin: 0 0 1rem;
+}
+</style>

frontend/src/components/ReverseProxySettings.vue

@@ -0,0 +1,309 @@
+<script setup lang="ts">
+import { computed, onMounted, ref } from "vue";
+import { apiGet, apiPut, apiErrorMessage } from "@/api/client";
+import { useToastStore } from "@/stores/toast";
+
+/**
+ * How many reverse proxies stand in front of Grimoire, checked against the
+ * admin's own request.
+ *
+ * Each proxy appends to X-Forwarded-For, and Grimoire reads the entry this many
+ * in from the right as the visitor's address. Every sign-in rate limit and
+ * audit line keys on that address, and the scheme read the same way decides
+ * whether the session cookie is Secure. Too low a count makes every visitor
+ * read as the proxy, so they share one rate limit and one bad sign-in run
+ * blocks everyone. Behind Cloudflare's proxied DNS the usual count is 2.
+ */
+interface ReadoutRow { hops: number; client: string; https: boolean }
+interface Readout {
+  peer: string;
+  forwarded_for: string[];
+  forwarded_proto: string[];
+  cloudflare: boolean;
+  cloudflare_client: string | null;
+  rows: ReadoutRow[];
+  suggested: number | null;
+}
+interface ProxyConfig {
+  hops: number;
+  source: "setting" | "env" | "default";
+  env_hops: number;
+  max_hops: number;
+  readout: Readout;
+}
+
+const toast = useToastStore();
+const config = ref<ProxyConfig | null>(null);
+const loadError = ref("");
+const draft = ref<number>(1);
+const saving = ref(false);
+const saved = ref(false);
+
+async function load() {
+  loadError.value = "";
+  try {
+    config.value = await apiGet<ProxyConfig>("/api/admin/proxy");
+    draft.value = config.value.hops;
+  } catch (e) {
+    loadError.value = apiErrorMessage(e, "The proxy settings could not be loaded.");
+  }
+}
+
+async function save(hops: number | null) {
+  saving.value = true;
+  saved.value = false;
+  try {
+    config.value = await apiPut<ProxyConfig>("/api/admin/proxy", { hops });
+    draft.value = config.value.hops;
+    saved.value = true;
+    setTimeout(() => (saved.value = false), 2000);
+  } catch (e) {
+    toast.show(apiErrorMessage(e, "Failed to save the proxy count"), "error");
+  } finally {
+    saving.value = false;
+  }
+}
+
+const readout = computed(() => config.value?.readout ?? null);
+const inForce = computed(() => readout.value?.rows.find((r) => r.hops === config.value?.hops) ?? null);
+
+// The verdict that leads the section. A Cloudflare request names the count to
+// set, since Cloudflare reports the visitor's address; any other road can only
+// show the address read and let the admin judge whether it is theirs.
+const verdict = computed<"set-suggested" | "cloudflare-unmatched" | "check" | null>(() => {
+  const r = readout.value;
+  if (!r || !config.value) return null;
+  if (r.cloudflare && r.suggested !== null && r.suggested !== config.value.hops) return "set-suggested";
+  if (r.cloudflare && r.suggested === null) return "cloudflare-unmatched";
+  return "check";
+});
+
+const sourceLabel = computed(() => {
+  const c = config.value;
+  if (!c) return "";
+  if (c.source === "setting") return "Saved here.";
+  if (c.source === "env") return `From TRUSTED_PROXY_HOPS in the environment (${c.env_hops}).`;
+  return "The default.";
+});
+
+const draftValid = computed(() =>
+  Number.isInteger(draft.value) && draft.value >= 0 && draft.value <= (config.value?.max_hops ?? 5),
+);
+
+onMounted(load);
+</script>
+
+<template>
+  <div class="proxy-settings">
+    <p v-if="loadError" class="error-msg">
+      {{ loadError }}
+      <button type="button" class="btn-ghost btn-compact" @click="load">Try again</button>
+    </p>
+    <p v-else-if="!config" class="state-msg">Reading this request&hellip;</p>
+
+    <template v-else-if="readout">
+      <div v-if="verdict === 'set-suggested'" class="proxy-warning" role="alert">
+        <p class="proxy-warning-title">Set the proxy count to {{ readout.suggested }}</p>
+        <p class="proxy-warning-body">
+          This request came through Cloudflare, which reports your address as
+          <code>{{ readout.cloudflare_client }}</code>. At {{ config.hops }}, Grimoire reads
+          <code>{{ inForce?.client }}</code> instead, so visitors share Cloudflare's addresses
+          and one sign-in limit.
+        </p>
+        <button type="button" class="btn-primary" :disabled="saving" @click="save(readout.suggested)">
+          Use {{ readout.suggested }}
+        </button>
+      </div>
+      <div v-else-if="verdict === 'cloudflare-unmatched'" class="proxy-warning" role="alert">
+        <p class="proxy-warning-title">This request came through Cloudflare</p>
+        <p class="proxy-warning-body">
+          No count reads the address Cloudflare reports for you. Check the forwarding chain below,
+          and that your own proxy passes Cloudflare's <code>X-Forwarded-For</code> on.
+        </p>
+      </div>
+      <p v-else class="proxy-verdict">
+        Grimoire reads this request as coming from <code>{{ inForce?.client || "an unknown address" }}</code>
+        <template v-if="inForce?.https"> over HTTPS</template>. If that is your address, the count
+        is right. If it is your proxy's, raise the count.
+      </p>
+
+      <div class="field proxy-field">
+        <label for="proxy-hops">Proxies in front of Grimoire</label>
+        <div class="proxy-input-row">
+          <input
+            id="proxy-hops"
+            v-model.number="draft"
+            type="number"
+            min="0"
+            :max="config.max_hops"
+            step="1"
+            class="fs-input input proxy-hops-input"
+          />
+          <button
+            type="button"
+            class="btn-primary"
+            :disabled="saving || !draftValid || draft === config.hops"
+            @click="save(draft)"
+          >
+            {{ saving ? "Saving..." : "Save" }}
+          </button>
+          <button
+            v-if="config.source === 'setting'"
+            type="button"
+            class="btn-ghost"
+            :disabled="saving"
+            @click="save(null)"
+          >
+            Use the environment's ({{ config.env_hops }})
+          </button>
+          <span v-if="saved" class="saved-msg">Saved. It applies to the next request.</span>
+        </div>
+        <p class="field-hint">
+          {{ sourceLabel }} One proxy (Traefik, Nginx, Caddy) is 1. Cloudflare in front of your own
+          proxy is 2. 0 ignores the forwarding headers and uses the connecting address.
+        </p>
+      </div>
+
+      <table class="proxy-table">
+        <caption>What each count makes of this request</caption>
+        <thead>
+          <tr><th class="num">Count</th><th>Reads you as</th><th>HTTPS</th><th></th></tr>
+        </thead>
+        <tbody>
+          <tr
+            v-for="row in readout.rows"
+            :key="row.hops"
+            :class="{ 'proxy-row-current': row.hops === config.hops }"
+          >
+            <td class="num">{{ row.hops }}</td>
+            <td><code>{{ row.client || "unknown" }}</code></td>
+            <td>{{ row.https ? "yes" : "no" }}</td>
+            <td class="proxy-row-tags">
+              <span v-if="row.hops === config.hops" class="proxy-tag">in force</span>
+              <span v-if="row.hops === readout.suggested && row.hops !== config.hops" class="proxy-tag proxy-tag-suggested">
+                suggested
+              </span>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+
+      <dl class="proxy-chain">
+        <dt>Connecting address</dt>
+        <dd><code>{{ readout.peer || "unknown" }}</code></dd>
+        <dt>X-Forwarded-For</dt>
+        <dd v-if="readout.forwarded_for.length"><code>{{ readout.forwarded_for.join(", ") }}</code></dd>
+        <dd v-else class="proxy-absent">not sent</dd>
+        <dt>X-Forwarded-Proto</dt>
+        <dd v-if="readout.forwarded_proto.length"><code>{{ readout.forwarded_proto.join(", ") }}</code></dd>
+        <dd v-else class="proxy-absent">not sent</dd>
+      </dl>
+    </template>
+  </div>
+</template>
+
+<style scoped>
+.proxy-warning {
+  margin-bottom: var(--fs-space-4);
+  padding: var(--fs-space-3);
+  border: 1px solid var(--fs-warning);
+  border-radius: var(--fs-radius-md);
+  background: color-mix(in srgb, var(--fs-warning) 12%, var(--fs-surface-raised));
+}
+.proxy-warning-title {
+  margin: 0 0 var(--fs-space-2);
+  font-weight: 600;
+  color: var(--fs-warning-fg);
+}
+.proxy-warning-body {
+  margin: 0 0 var(--fs-space-3);
+  font-size: var(--fs-size-body-sm);
+  color: var(--fs-text-primary);
+}
+.proxy-verdict {
+  margin: 0 0 var(--fs-space-4);
+  font-size: var(--fs-size-body-sm);
+  color: var(--fs-text-primary);
+}
+.proxy-field {
+  margin-bottom: var(--fs-space-4);
+}
+.proxy-input-row {
+  display: flex;
+  align-items: center;
+  gap: var(--fs-space-3);
+  flex-wrap: wrap;
+}
+.proxy-hops-input {
+  width: 5rem;
+}
+.proxy-table {
+  width: 100%;
+  max-width: 560px;
+  border-collapse: collapse;
+  font-size: var(--fs-size-body-sm);
+  margin-bottom: var(--fs-space-4);
+}
+.proxy-table caption {
+  text-align: left;
+  font-size: var(--fs-size-label);
+  color: var(--fs-text-secondary);
+  margin-bottom: var(--fs-space-2);
+}
+.proxy-table th,
+.proxy-table td {
+  text-align: left;
+  padding: var(--fs-space-1) var(--fs-space-3);
+  border-bottom: 1px solid var(--fs-border-color);
+}
+.proxy-table th {
+  font-size: var(--fs-size-tiny);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--fs-text-tertiary);
+  font-weight: 500;
+}
+.proxy-table .num {
+  text-align: right;
+  font-variant-numeric: tabular-nums;
+  width: 4rem;
+}
+.proxy-row-current td {
+  background: var(--fs-surface-hover);
+  font-weight: 600;
+}
+.proxy-row-tags {
+  white-space: nowrap;
+}
+.proxy-tag {
+  display: inline-block;
+  padding: 0 var(--fs-space-2);
+  border-radius: var(--fs-radius-pill);
+  font-size: var(--fs-size-tiny);
+  font-weight: 500;
+  color: var(--fs-text-secondary);
+  border: 1px solid var(--fs-border-active);
+}
+.proxy-tag-suggested {
+  color: var(--fs-warning-fg);
+  border-color: var(--fs-warning);
+}
+.proxy-chain {
+  display: grid;
+  grid-template-columns: max-content 1fr;
+  gap: var(--fs-space-1) var(--fs-space-4);
+  margin: 0;
+  font-size: var(--fs-size-body-sm);
+}
+.proxy-chain dt {
+  color: var(--fs-text-secondary);
+}
+.proxy-chain dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+.proxy-absent {
+  font-style: italic;
+  color: var(--fs-text-tertiary);
+}
+</style>

frontend/src/components/ScrollSentinel.vue

@@ -0,0 +1,96 @@
+<script setup lang="ts">
+/**
+ * The end of a server-paged list: asks for the next page as the reader nears
+ * it, in place of a "Load more" button. The parent keeps the paging — what the
+ * next page is keyed on, whether one is in flight, whether the last one
+ * failed — and this owns the observing.
+ *
+ *   <ScrollSentinel :cursor="more ? String(rows.length) : ''"
+ *                   :loading="loadingMore" :failed="moreFailed" @more="loadMore" />
+ *
+ * An empty cursor means the list is complete, and nothing renders.
+ */
+import { onBeforeUnmount, ref, watch } from "vue";
+
+const props = defineProps<{ cursor: string; loading: boolean; failed?: boolean }>();
+const emit = defineEmits<{ more: [] }>();
+
+const sentinel = ref<HTMLElement | null>(null);
+const visible = ref(false);
+
+// One request per page. The observer reports every crossing, and a short last
+// page leaves the sentinel on screen for good, so the cursor last asked for is
+// remembered: a page is asked for once, and a failed one is not retried on
+// every scroll, because a failure leaves the cursor where it was. Only
+// Try again asks for it again.
+let asked = "";
+
+function pump() {
+  if (!visible.value || props.loading || props.failed || !props.cursor) return;
+  if (props.cursor === asked) return;
+  asked = props.cursor;
+  emit("more");
+}
+
+function retry() {
+  asked = props.cursor;
+  emit("more");
+}
+
+let observer: IntersectionObserver | undefined;
+
+function observe(el: HTMLElement | null) {
+  observer?.disconnect();
+  observer = undefined;
+  if (!el) {
+    // Visibility and the cursor asked for go with the element. A list that
+    // starts over must not inherit "the end is on screen" from the one it
+    // replaced, and an offset cursor repeats from list to list, so "50" asked
+    // of the old list must not stop the new one asking for its own "50".
+    visible.value = false;
+    asked = "";
+    return;
+  }
+  observer = new IntersectionObserver(
+    (entries) => {
+      visible.value = entries.some((e) => e.isIntersecting);
+      pump();
+    },
+    // Extends the watched area a screen below the viewport, so the next page is
+    // asked for before the reader reaches the end rather than when they do.
+    { rootMargin: "0px 0px 100% 0px" },
+  );
+  observer.observe(el);
+}
+
+// flush: "post": the template ref is only set once the DOM is patched.
+watch(sentinel, observe, { flush: "post" });
+
+// A page that lands without pushing the end off screen gives the observer
+// nothing new to report, so carry on from the props, or the list stops early.
+watch([() => props.cursor, () => props.loading, () => props.failed], pump);
+
+onBeforeUnmount(() => observer?.disconnect());
+</script>
+
+<template>
+  <div v-if="cursor" class="sentinel">
+    <!-- The one case with a button: an observer re-firing on a failure would be
+         a request loop. -->
+    <p v-if="failed" class="sentinel-note sentinel-failed" role="alert">
+      Couldn’t load more.
+      <button type="button" class="btn-secondary btn-sm" @click="retry">Try again</button>
+    </p>
+    <template v-else>
+      <div ref="sentinel" class="sentinel-mark" aria-hidden="true"></div>
+      <p v-if="loading" class="sentinel-note" role="status">Loading more…</p>
+    </template>
+  </div>
+</template>
+
+<style scoped>
+.sentinel { grid-column: 1 / -1; padding: 0.75rem 0; text-align: center; }
+.sentinel-mark { height: 1px; }
+.sentinel-note { margin: 0; font-size: 0.8rem; color: var(--fs-text-tertiary); }
+.sentinel-failed { display: flex; align-items: center; justify-content: center; gap: 0.75rem; }
+</style>

frontend/src/components/StarterRolePicker.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 /**
- * The starter token ROLES offered when a design system is created (#2349).
+ * The starter token ROLES offered when a design system is created.
  *
  * WHY THIS IS A COMPONENT
  * DesignSystemsView has two creation forms — the empty state and the one inside
@@ -11,7 +11,7 @@
  * WHAT IT OFFERS
  * Names and purposes, never values. A role is a question the operator answers
  * with their own palette; a default palette would be one install's taste
- * shipped as product (rule #115). Every group is individually skippable —
+ * shipped as product. Every group is individually skippable —
  * an operator who wants three tokens should get three.
  *
  * All groups are checked by default. That default lives HERE rather than in the