4.9 made the house attentive. Word of a finished errand or a freshly painted backdrop reached every window the moment it happened, the clocks turned over together, and the residents were finally addressed to their faces. What 4.9 could not do was let you direct any of it. You could write a scene and watch it play; you could not lean in from the wings and tell one actor something the others did not know, or set a clock running on her, or have someone build the set before the curtain rose. And when the cast of a long evening began voting on what your own character was allowed to do, there was nothing in the house that told them not to.

4.10 is the release in which the house learns stagecraft.

---

Where 4.9 made the rooms pay attention, 4.10 hands you the stage manager’s book. Five bodies of work define the cycle. Direction: Inform passes a note from the wings to one actor or all of them; subprompts give a character extra instructions for one chat only; progressions put a clock on a character that she hears every turn; and the Scenario Builder sends the Host off to research and draft the opening scene. The running order: a multi-character room now draws its speaking order once per cycle and keeps it, so the sidebar shows the real sequence, Skip passes the right turn, and a paused room stays paused. The Concierge, rebuilt from the ground up around refusals rather than classification, with three states instead of four and a Settings tab of his own. Whose story it is: every shipped prompt, every character generator, and the memory extractor now hold the line against “the committee” — a cast that drifts into governing your character with sign-offs, conditions, and agreements you never made. And a lighter house: about a quarter off the database on disk, message search turned into an index, and conversation text compressed.

Five more earned their places. Every assistant message now keeps its route trail, so a reply that took three providers to land no longer looks like one that went through on the first ask. The Salon transcript became a subscribed read, which means a reply finished while you were in another tab, or while the laptop slept, now actually appears. The chat gallery gathers every image a conversation ever produced, from nine different sources, into one grid. Avatars are cached per outfit, so putting the coat back on brings back the same portrait rather than paying for a new one. And quilltap sync keeps a document store and a folder on disk in step, in both directions, so you can edit a vault in your own editor.

Two things change in ways worth reading before you upgrade, and both are covered under Upgrading: the Concierge’s four per-chat states become three, and the global Concierge mode is retired; and a project’s character roster, which had been stored and displayed for some time without ever being enforced, now governs which characters may reach that project’s files and wardrobe.

The thesis is simple: 4.9 made the rooms notice things. 4.10 lets you direct what happens in them.

---

Notes From the Wings

Inform

The Salon composer has a new Inform button — the i in the left gutter, beside Pascal. It opens a dialog where you choose one, several, or every LLM-controlled character in the chat and write a short second-person passage: You notice the clock on the mantel has stopped. Each character you target receives exactly that passage on their next generation, and then it is spent.

Nothing is added to what you write — no Host voice, no preamble, no instruction to keep it quiet. The passage is delivered at the very end of the character’s context, after recall, mail, and progressions, under a single fixed header stating that what follows is true, is already known to the character, and overrides any older memory or record that contradicts it. That header earned its place the hard way: an early build delivered informs higher up the prompt, where a long history buried them, and a character whose own recall disagreed with the note simply disbelieved it. The passage itself is still verbatim, and because it rides in the uncached tail, the system prefix is byte-identical with or without one — prompt caching is unaffected.

The transcript keeps a record — a Host message carrying what you typed, public when you targeted everyone and whispered to the targets otherwise, with a chip reading out of character — but the record never reaches a model. It is stripped from every character’s history, from the summarizer and the other cheap tasks, from the Courier, and from memory extraction. A chip above the composer names who is still owed an inform, with the first line on hover and a × to withdraw it.

Delivery is tied to a saved reply. A provider failure that saves nothing, or a turn the character passes on, leaves the passage waiting for the next attempt. Regenerating or swiping re-applies whatever that generation originally saw and consumes nothing new, so a fresh inform is never spent on a re-roll. Several pending passages for one character arrive together, in order. Autonomous rooms deliver on their next chained turn.

Standing informs. A “Keep it standing in this chat” checkbox, off by default, makes a passage persist: it is delivered on every generation its targets make in that chat until you withdraw it. It is scoped to the chat — it does not change the character, and it does not follow her into other chats, merges, or continuations. Standing passages are ordered ahead of one-shot ones so the block’s prefix stays stable.

Informs survive .qtap export and import and backup and restore, consumed ones included, so swipes stay honest after a round trip. One known limit: pending informs do not travel through a chat merge or Continue Elsewhere.

Subprompts

A character can now carry subprompts: short optional instructions, kept as Markdown files in a Subprompts/ folder at the root of her vault, written in the second person like a system prompt. Which ones are in play is chosen per seat, per chat — from a Subprompts dropdown under each character’s system-prompt selector in the New Chat dialog, or on the participant card in the Salon’s Participants drawer. Every dropdown offers New subprompt…, which opens the editor in place and ticks the new one on.

Selected subprompts render immediately after the system prompt as an ## Additional Instructions block, and in the greeting, and a character dressing herself in the green room sees them alongside her dressing instructions. Changing the selection recompiles that seat’s cached identity stack; editing a subprompt recompiles every chat carrying it; deleting one strips it from those seats first. A seat with none selected produces a byte-identical prompt. They are managed on the Aurora System Prompts tab, beneath the primary prompts, and the AI Wizard and the Optimizer leave them alone.

The use is the obvious one: the instructions that belong to this story rather than to the character — she is travelling incognito, he has lost his voice, play this one as a farce.

Progressions

A character can now carry progressions: named spans of time with a start, an end, and rules for how often to report on them. A pregnancy that began on the first of August and is due on the first of May. A cannon that takes ten minutes to recharge. A cask that will be ready in three weeks. On every prompted turn Quilltap works out elapsed time, remaining time, and percentage from the wall clock and appends a second-person report to the character’s context — so the model never has to do the arithmetic, and never has to remember that time has passed.

Each entry declares the unit it reports in, from seconds to years, and a cadence: every turn, whenever the whole-unit count ticks over, or at most once per wall-clock period. An entry that has just started, just finished, or just been changed reports on the next turn regardless. Spans read as whole units plus a remainder in the next finer one — 20 weeks, 3 days — and months and years are fixed-length, so the sums are deterministic and calendar-free. An entry may carry a description, a quantity (0.3/1.0 MJ), and its own report template.

Progressions live under one reserved key in the vault’s metadata.json, with a published JSON schema; a malformed entry is dropped alone with a warning and the rest survive. They are edited from a new Progressions card on the System Prompts tab, with a live preview of the exact line the character will read. The model cannot set its own: there is no tool for it. Only you, and Pascal’s server-side effects, write them.

That last part is where it becomes more than a reminder. Pascal custom tools gain a progress subject for conditions and availability gates, {{progress.<id>.<field>}} and {{now}} placeholders, and progress.* effect targets — so a tool can be withheld until a recharge completes, and a successful roll can re-arm it with {{now}} and {{now}} + 600000. Pascal’s Workbench knows all of it.

The report rides in the uncached tail of the prompt and is never stored as a message, so caching is untouched and the prompt path performs no writes.

Speaking for Someone Else

Taking up another character’s pen with Impersonate used to post your line exactly as typed, in your voice rather than hers. A new setting under Settings → Chat → Composer offers three modes: Never, Ask each time, and Always restate. With Ask, an impersonated line opens a review dialog on your draft and calls no model at all until you press Restate in their voice; Send as written is the primary button, and Cmd/Ctrl+Enter sends the draft untouched. With Always, the restatement starts the moment the dialog opens.

The restatement is done by the seat’s own connection profile and system prompt, with the chat’s roleplay template, Taboo phrases, standing instructions, the last dozen played messages shaped as that seat would see them, and a Commonplace Book recall against the draft. A chat on the uncensored route keeps to it; a refusal surfaces as an ordinary preview failure and never escalates by itself. The gate never fires for a seat you already control, for an attachment-only send, or for a Carina @Name: address, which is machinery and has to survive verbatim. Its log rows are filed under a new VOICE_REWRITE type — as is the Insert Announcement rehearsal, which since 4.4 had been quietly filing itself as a chat summary.

Naming Names

Typing @ at the start of a word in the composer opens a menu of characters — the chat’s cast first, then everyone else not archived — filtered as you type. Enter, Tab or a click completes the name. In the middle of a sentence the @ is dropped and you are left with the plain name; at the start of a line it is kept only if the name is followed by : or ?, which is a Carina or Brahma query, and the menu offers Brahma there too. Names the Carina parser cannot address lose the @ immediately, rather than leaving you to discover that later.

---

Setting the Scene

The Scenario Builder

Beside the scenario text on the New Chat form, and in the Salon sidebar’s Scenario control, there is a new button: Ask the Host to set the scene. Give it a mode — a real place or an in-world one — a location, a time, and any details you care about, choose a connection profile, and the Host goes off to research it with the tools you can see him using: your document stores, and for a real place, web search and fetch where the profile allows them. In-world scenes never touch the web.

What comes back is a draft of roughly a thousand tokens or fewer, in the present tense, deliberately written without the cast — no names and no placeholders, so the scene can be reused. You can edit it, ask for a revision, Use this scene, or Save as scenario… to General, a project, a group, or a character’s own shelf. The research is scoped to what the chat itself could see: the cast’s vaults, their groups’ stores, the project, and Quilltap General. Nothing is persisted but the log rows.

The builder also lives on the scenario shelves themselves — the General Scenarios page, a project’s Scenarios card, and a group’s — where it saves rather than uses, and offers every possible home. Groups, which had a scenarios API and no scenarios page, gained a Scenarios card in the process.

A Scenario Is Not a Summary

Starting a new chat could produce a greeting set somewhere other than the scenario you chose — a character welcoming you to a swimming hole when the scene was an office. The scenario in the interface was right; the model was reading a different one. Chat creation had been writing the chosen scenario into two places: where scenarios belong, and into the column that holds a summary of what has been said, a habit left over from before the scenario had a column of its own. Everything reading that second column therefore treated a brand-new chat as already summarized, and the greeting’s “Recent Conversations” section — which inlined it whole — handed the character the full text of some other chat’s scenario immediately before the instruction to greet. On one test instance, 186 of 712 chats were in that state.

Creation no longer writes it, the greeting’s recent-conversation entries are length-capped, and a migration clears the seed wherever it is byte-identical to the chat’s own scenario. Real summaries are untouched. Imports and restores apply the same rule, so an old bundle cannot bring it back.

The Summary Knows Who Is Speaking

The running summary folds batches of turns into a five-section record. The transcript it was handed was labelled USER: and ASSISTANT: while the prompt above it asked for character names, so in a chat where nobody happened to say a character’s name aloud — a two-seat chat between a character and your persona is the usual case — the model was asked to name a speaker it had no name for, and obliged. Every later fold carried the invention forward and then read the real name, when it finally appeared, as an alias. Fold transcripts now carry speaker names resolved from the chat’s seats, including seats that have since left; an unresolvable seat is labelled User or Character, and the prompt says to keep such a label rather than invent one.

Existing summaries are not rewritten, because a wrong name cannot be told apart mechanically from a right one. For a summary that is already wrong, Rebuild Summary… in the sidebar’s Organize drawer discards it and lets the normal fold cadence rebuild it from the first turn.

Leaving People Behind

Continue Elsewhere carried the conversation across but quietly dropped the lines of anyone not seated in the new chat while keeping everyone else’s lines to them — so the new cast read an absent character as present and silent. One autonomous room, continued from a chat its operator had been in, spent sixteen turns addressing him. The Host now names everyone left behind, once, after the replayed messages. A related gap closed with it: in an autonomous room the operator’s own persona was the one absent person the Host could never introduce as absent.

---

Whose Story It Is

The Committee

A long multi-character roleplay has a particular way of going wrong. Over enough evenings the cast stops behaving like people and starts behaving like a governing body: votes are taken on what your character may do; actions require a sign-off; temporary measures become standing conditions; your own narration of what happened is corrected against somebody’s notes; and a proposal you never answered is remembered, permanently, as something you agreed to. Each step is reasonable in isolation. Together they turn your story into a committee meeting about your story.

4.10 addresses it in four places at once.

The shipped prompts. All twenty-one sample system prompts now carry a short universal block: your narration is what happened, including out-of-character stage directions in whatever marking the chat uses; check the conversation before correcting you; do not invent setting facts to win a point; agreements that bind you exist only in your own plain words; and disagreement never becomes procedure. Each prompt’s list of failure modes gains the committee, and every existing “hold your position” line gains a counterweight. The companion, platonic, and romantic samples add a trust disposition — your judgment is the starting point, and in a crisis they back you first — while the general-purpose sample stays relationship-neutral.

The generators. The AI Wizard and Summon From Lore write the same safeguards into the system prompts they generate, adding the trust disposition only when the source material makes the character your companion, partner, family, or crew. The Character Optimizer treats committee behaviour as drift to correct, may never propose a rule constraining your persona, and may not weaken the safeguards when it refines a prompt. The External Prompt generator uses the shared field semantics for the first time.

The memory extractor. Agreements are now recorded only on the agreeing party’s own words of assent. A proposal is recorded as a proposal, attributed to whoever made it; silence, an apology, or the exchange ending is not assent, and the memory says so — “…; she had not yet responded.” Stated limits are kept, so “until breakfast” does not become “from now on.” Existing memories are left alone; Regenerate memories re-extracts under the new rules.

The scene note. On a chained multi-character turn — no new message from you, but a character has already replied to your last one — the next character is told in one sentence that your latest message is the current state of the scene, and which seat wrote it. It never appears for the first responder or in a one-character chat, and the context is byte-identical where it does not apply.

Listening, and Matching Register

The same twenty-one prompts were also taught to listen. A character now answers what the speaker means: a joke is answered in kind, exaggeration is not taken literally, an offhand remark is not mined for subtext, and when it is unclear whether you are serious, she asks. Replies are sized to what prompted them; paraphrasing your line back to you is out; signature habits and the “not X — Y” construction are rationed; and formal language is kept for moments that want it. Each prompt closes with short example exchanges — a joke caught, a casual line answered briefly, a serious moment — every file with different lines, all marked as showing shape rather than voice.

The generators carry the same direction, and generated example dialogues must cover all three registers. The Optimizer no longer enshrines a habit that appears in most replies as a personality trait.

The prompt seeder used to insert built-in prompts only when they were missing, which meant a revised sample never reached an existing installation. It now refreshes built-in rows when the shipped text changes. Prompts you have imported into a character are copies, and are not touched.

---

The Running Order

Drawn Once per Cycle

A multi-character room now decides its whole speaking order when a cycle begins — a talkativeness-weighted permutation of the present seats — stores it, and follows it seat by seat until the cycle wraps. The distribution of orders is exactly what it was, drawing the permutation up front and drawing it one place at a time being the same procedure; what changes is that the order is knowable. The sidebar’s Participants list shows the real sequence instead of a talkativeness-sorted guess. Position three now means third.

Cast changes mid-cycle are repaired rather than redrawn: a departed seat is skipped, and a newcomer joins at the back and is dealt in properly next time. The manual queue still jumps the line, and a summoned character is struck from the remaining order so nobody speaks twice. Existing chats carry on without any migration of their turn state.

Getting there flushed out three defects in the old arrangement. The talkativeness of a character you drive had never counted at all — four of the six paths that pick a speaker built their character map from LLM-controlled seats only — and the single shared loader that replaced all six also cut a four-seat room’s selection from about forty-eight queries to twelve. The turn banner named whoever you had last written as rather than whoever held the floor, so Skip recorded a character “declining the floor” who had just spoken and left the real turn outstanding. And the browser, never having been sent the stored rotation, was recomputing whose turn it was from scratch on every render and contradicting the server. A test now asserts that browser and server pick the same speaker from the same inputs, rather than assuming it.

A Paused Room Stays Paused

Pause used to stop the turn chain, not the chat: every message you sent still drew a reply, and Nudge and Skip quietly cleared the pause before running. A paused chat now advances only when you ask it to. A message you send is saved in full — attachments, dice, inline queries — and draws no reply; the first one in each pause says so, so the silence is not mistaken for a failure. Nudge and Skip each run exactly one turn and stop. Resume resumes. Along the way, the Nudge flag had been dropped between the button and the server, so a nudged character could still pass; and Continue in the all-LLM pause dialog cleared nothing and requested nothing, so the button meant to restart a runaway room only closed the dialog.

The Room Says What It Is Doing

Pressing Enter while a reply was still streaming used to do nothing whatever — no notice, no flash, no log line — which is exactly what a broken send looks like. It now answers: One moment — the room is still speaking. Your remark waits in the composer.

Regenerate reports itself, too. The message being replaced dims under a Regenerating… plate, the new line streams in token by token rather than arriving whole half a minute later, the status strip names the stage as it does for a first turn, and the composer and the message’s controls are held for the duration. When it finishes, the swipe group shows the variant just generated — it used to keep whichever was selected before, so you could watch a new line arrive and then be shown a different one.

---

The Concierge, Rebuilt

The Concierge has carried two jobs since he arrived: guessing in advance which chats were spicy, and doing something useful when a provider refused. 4.9 gave the first job a fourth state so that a verdict and a vouch would stop sharing a button. Living with it for a month made the larger problem plain. The advance guess is a cheap model’s opinion; the refusal is a fact. 4.10 rebuilds the Concierge around the fact.

Every Refusal, Rerouted

There is now one refusal classifier, and it trusts evidence in order: a typed error from the plugin, a known provider code, a moderation finish reason, refusal wording in the error, and — only on content the Concierge had already flagged — an empty body. A bare 400, a rate limit, or an authentication failure is never a refusal. Five plugins were taught to raise a typed ModerationRejectionError (from the new @quilltap/plugin-types 2.8.0) and to report the real finish reason on both streamed and non-streamed paths.

There is one way to find the uncensored understudy — the configured uncensored profile, then any profile ticked Uncensored-compatible, then nobody — so pre-flight and after-the-fact routing finally agree. And there is one image failover path, used by generate_image, the Lantern’s story backgrounds, Aurora’s avatars, and the manual dialog alike. A thrown content-policy error on a text turn used to be classed as “not a fallback trigger,” and nothing happened; it is now recorded on the route trail as a refusal, retried on the understudy, and then handed to the profile’s own fallback chain.

The Concierge speaks when this happens: a bubble saying a refusal was rerouted, that nobody was available to take it, or that the chat’s state does not permit it.

Three States, Not Four

Under the hood, 4.9’s four states were answering a question nobody needed to ask — who decided — at the cost of the one that matters, which is where the chat goes when a provider refuses. There are three now:

• Moderated — the default. Ordinary providers first; a refusal goes to the uncensored desk; and the Concierge may move the chat on his own.
• Unmoderated — the uncensored desk only.
• Locked — ordinary providers only. A refusal stands.

Who set Unmoderated, you or the Concierge, is provenance rather than a state: it appears in the tooltip and helper text and nowhere else. The header pill and the list mark are red for Unmoderated, grey with a shield for Locked, and absent for Moderated; Quick-hide’s Dangerous Chats hides Unmoderated chats.

The Refusal Ledger

Each chat now counts its moderation refusals. Only real evidence counts — an inferred refusal never does — and once the count reaches a threshold (two, by default; zero means never) on a Moderated chat, the Concierge moves it to Unmoderated and says so, naming the count and the last provider to refuse. He never moves a Locked chat, never moves an Unmoderated one back, and re-reads the chat before he acts, so he cannot overwrite a choice you made a moment earlier. Returning a chat to Moderated clears its ledger.

A Tab of His Own

The Concierge has his own Settings tab now, with five cards: On duty, The uncensored desk (the text, image, vision, and image-prompt profiles, gathered in one place from the three tabs they used to be scattered across), When a provider refuses, Display, and Pre-screening. The global Off / Detect Only / Auto-Route mode is retired, because every question it was used to answer now has a name of its own.

On a new installation the Concierge is on duty with failover and no classifier at all: the per-message pre-screen, the summary classifier, and the ten-minute sweep run only if you switch them on. Off duty means no failover, no announcements, no auto-switch and no pre-screen; the per-chat selector is disabled with a pointer to the tab, and flagged content is shown plainly. A New chats start as setting chooses the state for a chat whose creator does not.

Try Uncensored

Sometimes you disagree with the provider. Every character line now carries a shield in its action bar — Try uncensored — which regenerates that reply as a new swipe on the uncensored understudy, skipping every profile already on the original’s trail and anything running the same provider and model. The same button sits on generate_image results and on the Lantern’s refused-backdrop bubble. It is your request rather than the Concierge’s, so it works off duty, never changes the chat’s state, and is hidden only on Locked chats.

Two smaller courtesies arrived with it. Marking a message Not Dangerous now actually lifts its blur, leaving the chips struck through. And when the Lantern is refused a backdrop and nobody can take it, he says so in the chat rather than failing silently in the job queue.

The state is also, finally, written safely. A whole-row write — a title change, a telemetry update — could previously rewind a newer Concierge state; the state now has a single compare-and-set writer, the classifier no longer flips chats from the background job at all, and every failover path re-reads the chat when a refusal arrives, so a chat locked mid-request is never rerouted.

---

Every Model Tried

The Route Trail

An assistant message now keeps its route trail: every connection profile asked for the turn, in order, and why each one stepped aside. It renders as a list under the avatar, first asked at the top and the one that answered at the bottom. A row that fell over on its own — a timeout, a rate limit, a dead key, a missing model, an empty reply — is struck through and marked ❌; a row that refused on content is struck through and marked 🚫; and the row that answered has no mark, so a reply that went through first time looks exactly as it always did. Hovering a row names the profile, the provider, the model, how it came to be asked — primary, retry, Concierge, understudy, tier pick — and what became of it. Image results from generate_image, the Lantern, and Aurora carry trails too, and the tool result now names the model that actually painted the picture rather than the one first asked.

The trail is stored only when something failed, which is nearly never, and it rides the .qtap export with its message. Older messages have none and render as before.

A Provider That Goes Silent

Creating a chat could hang forever at Setting the opening scene… behind a dialog that cannot be dismissed. The provider had accepted the request, sent its headers, and then never sent a byte — and every timeout in the stack, by design, stopped at the headers. Provider streams are now watched for silence: a generous budget for the first chunk, since a long prompt with extended thinking legitimately takes minutes to start, and a tighter one between chunks. A silent stream mid-chat fails over to the profile’s understudy like any other network failure; a silent greeting gives up on that provider and opens the chat with its scripted greeting. The budget applies to each gap, never to the total, and reasoning chunks count, so a long answer is never cut off for being long.

---

The Transcript Arrives Wherever You Are

Until now, a reply reached an open Salon by exactly one route: the stream belonging to the request that tab had made. If that stream was gone — you tabbed away during a long generation, the machine slept, the connection dropped — the reply was saved perfectly and never appeared, and nothing was logged, because a write to a closed stream is swallowed without complaint. The same gap is why Aurora’s wardrobe notes, the Lantern’s backdrops, the Commonplace whispers, and Suparṇā’s mail turned up only if they happened to be enqueued into a live stream at the right moment.

Every message write now publishes on the realtime channel 4.9 built, and every open tab on that chat re-reads its transcript. The re-read is the authority; the stream still carries tokens for the turn in flight, but it no longer decides what the room contains. A dropped stream now costs a typing animation rather than a turn. The re-read is conditional — a version counter on the chat lets the server answer “unchanged” without sending anything — so one busy turn’s flurry of notices costs round trips, not transcripts. Swipe selections and scroll position survive the refetch.

The same lesson was applied twice more. A chat setting changed in Settings never reached a Salon already open in another tab, because the tabbed workspace keeps a hidden pane mounted indefinitely and the Salon had read its settings once, at mount; every settings read now goes through the shared query that every tab observes. And the sidebar’s Delete Memories count, also read once at mount, sat at zero over a chat holding dozens of memories written since — and the button absorbed the click silently because it believed there was nothing to delete. Memories now have a realtime topic of their own, the button is disabled at a genuine zero, and the confirmation re-reads the count before it quotes it.

---

Pictures

The Chat Gallery

The Gallery button in a chat’s Organize drawer — which, it turns out, had never once appeared, its count having been read from an action the server did not have — now opens a grid of every image in the conversation, whatever produced it: uploads and library links, generate_image output, either Generate Image dialog, every story background the Lantern ever painted, every Aurora repaint, pictures re-shown from an album, files the Librarian attached, the cast’s standing portraits, and images referenced only by a Markdown link in the prose. There is a filter chip per source, a current badge on whatever is in play right now, and Save, Download, and Delete on hover — Delete only where the chat itself minted the image, and never on a portrait, a kept photo, or anything currently on display. The count rides the realtime channel, so a backdrop landing from a background job updates it with no poll.

Image downloads now ask the server for an attachment rather than fetching bytes into the page first, so in the desktop shell a 4K backdrop streams straight to disk.

Avatars, Cached by Outfit

A character wearing the same outfit no longer costs a fresh image every time. Everything that goes into an avatar — the prompt, the provider, the profile, the model, the LoRAs, the options, the size — is hashed into a key stored on the image, and the avatar job checks it first: a match whose bytes still exist is reused, and the Concierge call, the image call, and the file write are all skipped. Put the coat back on and the same portrait comes back. Regenerate Avatar is now a reroll: it bypasses the cache, paints a new one, and makes that the portrait the outfit returns from then on.

Generated avatars are now always stored in the character’s vault, project chat or not. Characters added to a chat already in progress get their outfit avatar on arrival, as the opening cast always did.

A character’s Photo Gallery gains an Avatar Rolls section listing every portrait the cache holds for her, with Set as avatar, Keep in the photo album, Download, and Delete — and deleting a roll you had already kept leaves the kept photo alone. Those rolls no longer clutter the album itself.

A migration brings existing avatars into the cache, and it is the one change in this release you can see without looking for it: duplicate generations of the same prompt are collapsed to the newest, and every chat that displayed one of the others now displays the survivor. On the instance it was measured against, 1,786 avatar rows became 889, and about 141 MB came back. See Upgrading.

What the Model Is Shown

After a few avatars or backdrops had been generated, the next turn on a vision-capable profile could fail outright with 413 Request Entity Too Large from the provider’s front door. Image bytes are not tokens, and nothing was counting them. Images sent to a model are now trimmed to what a model needs to read them — 1,024 pixels on the long edge, 500 KB each, 2 MB across a turn — which took one real avatar from 2.3 MB to 98 KB with the portrait perfectly legible. Stored images are untouched; only the copy on the wire is reduced.

Photos attached from a vault failed on every Z.AI vision profile, and would have on NanoGPT: the host was handing over a server-relative path beside the bytes, and both plugins preferred the path. They now send the bytes, and forward a URL only when it is a real one.

describe_image on a generated picture used to answer with its label — “Story background for: Tuesday in the Garden” — because that is what the generating jobs had been writing into the description field. The jobs no longer write it, the tool now prefers the generation prompt, and a migration clears the labels already on disk.

GPT Image 2.5, and the Rest of the OpenAI Knobs

Two new OpenAI image models arrive: gpt-image-2.5-flare, faster and cheaper at GPT Image 2 quality, and gpt-image-2.5-sunburst, slower and dearer and better at detailed editing. With them come four parameters the plugin had never sent: Quality (up to xhigh and max on the 2.5 pair), Background — transparent cuts the subject out, which is what an avatar wants — Output format and compression, and Moderation (auto or the less restrictive low; not an off switch). The newer models also take arbitrary resolutions within OpenAI’s limits. The OpenAI plugin now builds its image-profile editor per model, so no model is ever offered a knob it would reject.

Three older defects went with it: the manual image dialog’s Generate button posted to a route that did not exist; the generate_image tool’s own schema defaults were overriding your profile’s size, quality, and style on every call; and its size argument had never done anything at all, because a default orientation was injected on top of it.

Smaller Courtesies

Quick-hide gained a Salon Images toggle that hides the backdrop, avatars, thumbnails, and inline pictures in the Salon, for the moments when the screen is more visible than you would like. Import from Image in the wardrobe now offers to make an outfit from the pieces it found, as well as the pieces themselves. The Wardrobe dialog gained a Show shared tickbox beside Show archived, so dressing a character from her own clothes no longer means scrolling past every shared garment in the house. And story backgrounds stopped re-dressing characters the concealment prompt was supposed to drape: the appearance sanitizer had been substituting “casual clothes” for an undressed state before the prompt crafter ever saw it, so a sanitized character arrived already clothed and was painted into a different scene.

---

Letters, Rosters, and Vaults

The Post Office

Characters without System Transparency — which is to say most of them, by default — could list and send mail but not read it: the instructions pointed at the vault path, and the opacity covenant refuses that path to them. A new read_mail tool reads a letter by its file name from the caller’s own mailbox, transparency notwithstanding, and discard_mail throws one away through the same deletion chokepoint every other file delete uses. list_email is renamed list_mail, to match.

The Project Roster Means Something

A project’s character roster has been stored and displayed for some time without anything ever consulting it. It now governs exactly two things: a character’s tool access to the project’s files, and to the project tier of the shared wardrobe. Chat membership, project instructions, automatic knowledge retrieval, and clothes already being worn are unaffected. Creating a chat, or moving one into a project, no longer adds its participants to the roster behind your back. New projects default to Allow Any Character; the Characters card gained an Add character picker and visible remove buttons for when they do not; and the card no longer reports “0 characters in roster” after any unrelated setting change.

What an Opaque Character Can See

Two linked defects in the document tools. A character with System Transparency off could not reach any group document store — not her group’s, not one linked to it — because hiding her vault had been done by dropping her identity from the request, and group membership is derived from exactly that identity. Meanwhile the same character’s directory listings cheerfully named every character vault the setting exists to hide, and then refused to open them. Listing and opening now consult one rule: vaults are hidden by name, identity stays, and group, project, and General stores resolve as they always should have. A store that exists but is out of reach now says so, rather than claiming “not found” — which a model reads as a typo, and in the reported case spent eight minutes and ten tool calls respelling a name it had right the first time.

---

A Lighter House

A Quarter Less Disk

Three storage changes, measured end to end on a 2.0 GB reference instance that came out at 1.48 GB afterwards. Images in document stores are now normalized on write at a single point no path can skip — eight write paths had been skipping it — and a migration re-encodes what slipped through, 191.8 MB on the reference instance with dimensions unchanged. LLM log payloads, the same prompt scaffolding re-serialized on every call and the single largest thing in the instance, are compressed. So are the rendered conversation transcripts the Scriptorium keeps. Imports and archive rehydration still restore bytes exactly as archived.

Message Search Is an Index

Global message search was a LIKE '%…%' scan of every message in the instance — 355 MB read per query — and that scan was the one thing preventing the largest text in the database from being stored compressed. An FTS5 index replaces it, maintained by database triggers so no write path can bypass it, and the usual search now takes a fraction of a millisecond. Searches with punctuation work: the old path turned a period into a wildcard, so Mr. Smith silently found nothing. Search now matches whole words and word beginnings — walk finds walking but no longer sidewalk — with accent and full Unicode case folding; a query of nothing but punctuation and single letters, like C++, falls back to the old scan. Results are still the hundred newest.

With the scan gone, message text is stored brotli-compressed. It is lossless: what you read, export, and back up is byte for byte what it always was. On the reference instance the messages table goes from 515 MB to a projected 332 MB.

Old Conversations Keep Their Memory

The stale-chat sweep had been clearing the embeddings of every conversation idle for more than thirty days, which on one real instance removed 85% of its conversation history from semantic search to save about fourteen megabytes. It no longer does. The rendered transcript that every chat row carried around — about 160 KB each, on every chat list — is dropped and rendered from the messages when actually needed, and read_conversation stops failing on chats the old sweep had collapsed. The one cache the sweep had never cleared, compiled identity stacks, is now on its list.

quilltap sync

npx quilltap sync <store> <path> keeps a database-backed document store and a directory in step, in both directions. Edit a file in your own editor and the next run carries it into the store; edit it in the Scriptorium and the next run carries it out. The side that changed wins; when both changed it is reported as a conflict and nothing happens until you say --prefer store or --prefer disk. Deletions propagate only when the manifest the verb keeps in the directory proves the file was there last time, so a first run never deletes anything. Dotfiles are invisible to it. A binary’s caption travels as a .description.md sidecar beside it. Bytes are preserved exactly — a PNG pushed from disk stays a PNG. It never touches a chunk or an embedding; the store’s own hooks re-index. --dry-run plans without changing anything, and the exit codes are designed for scripts.

The CLI’s reference documentation, which had been split between the package README and a developer document, is now one complete reference in the package README.

---

Under the Floorboards

A Hostname Is Not an Identity

On a Mac, Quilltap could shut down its own database mid-evening. The instance lock’s heartbeat checked once a minute that it still owned the lock by comparing the recorded hostname with the current one — and macOS, when no hostname has been set explicitly, which is the default, derives one on the fly and changes it on Wi-Fi reconnects, sleep and wake, VPN changes, and DHCP renewals. The heartbeat read MacBook-Pro.local becoming Mac as another process seizing the database, closed its connections, and exited. Under the desktop shell the window stayed open over a dead server, with an already-open Salon still drawing from its cache, which made it look like a display problem. Ownership is now a snapshot of process and acquisition time; the hostname is a label. The shutdown that does happen on a genuine loss now runs the same orderly teardown as a normal stop, where previously it threw before closing anything.

An Unknown Action Is a 400

Every API route that took an ?action= parameter decided for itself what to do with one it did not recognise, and several decided badly. DELETE /api/v1/projects/[id]?action= with any unknown action deleted the project. The same was true of groups, and an unknown action on the restore endpoint ran a full restore. Every route now goes through one dispatcher with one rule: no action runs the plain verb, a known action runs its handler, and anything else is a 400 listing the actions that exist.

Boot Knows What It Has

A failed but resumable migration — the avatar-roll collapse, for one — used to stop the server on every boot. Migrations can now be marked resumable; a resumable failure is logged, deferred, and retried next time, and only it and its dependants wait. And once a structural migration had run, nothing at boot ever looked at its table again, so a damaged document-index table made every store read come back empty behind a perfectly healthy /api/health. Every dedicated-database table is now checked at boot, and a problem is reported by the health endpoint as a degraded structure service rather than as nothing at all.

Help That Indexes

Help pages over the embedding provider’s input limit had been silently dropping out of help search, and a section-chunk mismatch in the background job could roll back an entire batch of embeddings. A page’s vector is now the mean of its section vectors, a failed section no longer sinks the page, help is reconciled against the files on disk at every startup, and a test now fails the build on any help section too long to embed. The chat-settings help page, the worst offender, is split in three.

PDFs Read Again

PDF sources given to Summon From Lore or the character wizard had been skipped with only a warning since the PDF library changed its API, and packaged builds — Docker and the desktop tarball — could not extract text from any PDF at all. Both are fixed.

---

Repairs

Bugs 126 through 178 were filed and closed across the cycle, most of them found by using Quilltap for an evening rather than by any test. The larger ones have their own sections above. A representative handful of the rest:

The star on Aurora’s System Prompts tab that sets a character’s default prompt reported success and did nothing, and underneath it the default was recorded in two places that each update path kept only one of — so new chats could open with the old prompt even when the badge said otherwise. A description saved on a vault image could land on a different file with identical bytes, and the cached caption logic made the same mistake in reverse, re-running the vision model on every attach. Re-uploading an image over itself erased its description. Overwriting a document left the old revision’s chunks answering searches indefinitely. A story background was queued only when the checkpoint retitled a chat, so past turn ten the backdrop stayed on the first scene; and the summary fold overwrote titles you had set by hand. Collapsing a duplicate avatar roll deleted the photo you had kept from it — caught and fixed before release. quilltap db raw SQL could neither read nor write compressed columns, and now decodes them for display. A narrow Salon pane’s sidebar closed any dialog it opened on the first click. Switching the “speaking as” seat sent the wrong verb. The native-binding heal that runs after a Node upgrade reported success while rebuilding nothing. A delete that removed no rows was counted as a deletion and announced to every open tab.

The release’s refactor pass consolidated the nine document-index repositories and the log repository onto a single base class, removed about a thousand lines of dead database code, and fixed two repositories that had been missing from the background-job write partitioner, where a buffered write would have been committed to the wrong database.

---

Upgrading

Twenty-one migrations run on first boot, and three of them take noticeable time on a large instance. compress-chat-message-text-v1, compress-llm-log-payloads-v1, and compress-conversation-chunk-content-v1 rewrite their tables compressed, create-chat-message-fts-v1 builds the search index first, and recompress-oversized-mount-blobs-v1 re-encodes oversized images. Rewriting rows frees pages inside the database files without shrinking the files themselves; run npx quilltap db optimize afterwards to get the disk back. The rest add columns and tables (the route trail, the cycle order, the transcript counter, informs, the refusal ledger, the Concierge’s state and settings, the avatar cache key) or clear known bad data (scenarios seeded as summaries, labels stored as image descriptions). The avatar-roll collapse is resumable: if it fails, the server starts anyway and tries again next boot.

Duplicate avatar generations are collapsed, and this cannot be undone. The duplicates were not copies of one image but separate paintings of the same prompt; the newest in each group survives, and every chat or override that pointed at another now points at it. Any roll you had kept in a character’s photo album keeps its photo.

The Concierge moves to three states. Existing chats are translated: Uncensored becomes Unmoderated set by you; Vouched Safe becomes Locked; Flagged becomes Unmoderated set by the Concierge; Monitored becomes Moderated. The global mode is retired: Off becomes off duty, and Detect Only and Auto-Route both become on duty with pre-screening and summary classification switched on, so nothing you were relying on stops. One behaviour changes: a Detect Only installation now gets refusal failover, since that is now simply what being on duty means. An Off installation that has any Unmoderated chat is kept on duty, with pre-screening off, so those chats keep their desk. The same translation runs when you restore a pre-4.10 backup. The API’s old four state names now return 400, as do the retired Dangerous Content settings fields; the help page is now the-concierge.md.

Check the roster on any project with Allow Any Character off. The roster is now enforced for project files and the project wardrobe. Chat creation used to add participants to it automatically, so most rosters already hold the characters who have actually been in the project’s chats — but a character who reached the project’s files some other way will now be refused until you add her.

list_email is now list_mail, and the old name is not aliased. If a custom prompt or Pascal tool refers to it by name, update it.

Message search behaves a little differently. It matches whole words and word beginnings rather than any run of letters, so a search that relied on matching inside a word will find less. Punctuated searches that used to return nothing now work.

Old conversations are re-embedded once. On the first boot, every chat the old sweep had cold-tiered is queued to render and re-embed. On a large instance that is thousands of chunks in the background; it costs embedding calls and nothing else.

The impersonation setting becomes three-way. If you had restate in the character’s voice switched on, it becomes Ask each time; otherwise Never.

Summaries that already invented a name are not repaired automatically. Use Rebuild Summary… in the Organize drawer where you see one.

Built-in sample prompts are refreshed in place. Your installation will pick up the revised samples on the next read. Prompts you have imported into a character are copies, and are not changed — copy the new text across if you want it.

The character photo album no longer lists avatar history. Those images are in the new Avatar Rolls section on the same page. Generated avatars are now always stored in the character’s vault, so project-context avatars no longer appear in the project’s file tree; a character with a broken vault now gets no avatar at all.

Provider prompt caches are not rolled. The cache structure version stays at 4: informs, progressions, and the scene note all ride in the uncached tail, and a seat with no subprompts produces a byte-identical system block.

Node.js 24+ is still required, unchanged from 4.9.

---

Installation

Electron Desktop App

Download the latest .dmg (macOS), .exe (Windows), or .AppImage (Linux) from the quilltap-shell releases page. The window is only ever a front end, and it offers three back ends: Direct (the Node server inside Electron, no isolation), Docker (the container image behind a native window — the recommended arrangement, and the strongest boundary we ship), and Remote (any Quilltap URL, including a dev server, an npx quilltap instance, or a machine on your network). Requires shell 4.2.0 or later.

npm (Node 24 required)

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads and caches locally.

Docker

docker pull foundry9/quilltap:4.10.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

Standalone Tarball

Available for environments where npm global installs and Docker are both impractical. See the GitHub releases page for download links.

---

The house has a stage manager now, and it is you. A note can be passed from the wings to one actor and not the others, and she will believe it over her own diary. A character can be handed instructions for this one performance and have them gone the next night; she can carry a clock that she hears tick every time she speaks. Before the curtain rises the Host will go and look at the place, come back, and describe it to you — without presuming to say who will be standing in it.

The running order is drawn once and posted where everyone can read it, and the house keeps to it. A paused room holds its breath until you let it go. When a reply took three understudies to land, the programme says so, with the names of everyone who could not go on.

The Concierge has stopped trying to guess what a provider will object to and started attending to what it actually says. There are three doors now rather than four, the keys hang in a room of their own, and if you think the provider was wrong, there is a button for that.

And the cast has been reminded, gently and in writing, whose story it is. Your narration is what happened. An agreement is something you said, not something you failed to object to. A proposal left unanswered is remembered as a proposal. Nobody takes a vote on what you are allowed to do.

4.9 made the house notice things. 4.10 lets you direct them.

— Ariadne, for the Bureau, October 7, 2026

Quilltap 4.9.2 Release Notes

Consider the plight of a diligent researcher. You ask the Help dialog where the theme settings have got to, and would it kindly take you there; the character behind the desk rises, consults the appropriate volumes, finds the answer, writes it out fair, hands it to the porter — and the porter, finding no name on the envelope, sets it quietly on a shelf and says nothing to anybody. The character, having received no reply, consults the volumes again. And again. At the third repetition a sensible guard concludes that the poor soul is going in circles and rings down the curtain, at which point the dialog presents you with a spotless and entirely empty answer. Nothing errored. Nothing was lost. Nothing arrived, either, which in a help system is very nearly the same thing.

The porter was within his rights. The help conversation had been running its own private errand loop rather than the one the Salon and the Brahma Console use, and it handed its findings over as unlabelled parcels — tool results with no call to which they might be attached. Eight of the nine provider plugins refuse an unlabelled parcel on principle, and refuse it silently. Only Google, in a spirit of generous informality, would carry the thing anyway, which is why the whole misfortune looked less like a defect than like a question of which character happened to be on duty. The help loop now threads its work through the same fitting used everywhere else: a result with a claim ticket is paired to its call, and one without is announced plainly as a result rather than smuggled in as a tool row.

Google, meanwhile, had troubles of its own, and they were rather the mirror image. Its function-declaration desk keeps a list of paperwork it declines to read, and every schema we send is trimmed against that list before it goes out. additionalProperties was somehow never written down. This mattered not at all for most tools, whose only such notation sits at the top of the form where it is discarded in any case — but the wardrobe tools take a list of operations, and each item on that list carried the offending word one storey down, where the trimming never reached. The result was a flat refusal of the entire turn in under a fifth of a second, before a single token could be spoken, for any Gemini seat with tool use enabled and a wardrobe to its name. The word is now first on the list of things struck out, at every depth, and the sanitiser is held to that promise by a test fed the genuine wardrobe schemas rather than a polite imitation of them.

That the one provider tolerant enough to deliver an unaddressed parcel was also the one fastidious enough to reject a form bearing a single unfamiliar word is the sort of coincidence one does not invent.

---

What Changed

• fix (Help): The help chat’s agent loop now builds its assistant turn and tool-result rows through the shared tool-call threading helpers, so a result carrying a provider call id is paired to its call by toolCallId and an id-less result is framed as [Tool Result: <name>] user text. Previously it pushed an id-less tool row that every provider plugin but Google drops, so a question needing help_search or help_navigate produced empty turns until the duplicate-call guard ended the loop, and the dialog showed nothing at all. The stuck-loop reminder now tracks the last result directly instead of searching the slate by role. Two regression tests drive a native tool turn through the loop and assert the slate the follow-up request receives. (bug 124)
• fix (Google provider): additionalProperties is now stripped from function-declaration schemas at every depth, not merely dropped by construction at the top level. A Gemini profile with tool use enabled, in a help chat or in any chat whose character has a wardrobe, previously failed every turn with Invalid JSON payload received. Unknown name "additionalProperties" — the key survived under the wardrobe_wear and wardrobe_take_off operations array items. A regression test runs the real wardrobe schemas through the sanitiser; loading the plugin under Jest required a manual mock for the ESM-only @google/genai SDK. Google plugin 1.1.51. (bug 125)

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.9.2

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

A release in defence of the proposition that research done on your behalf ought to reach you.

The envelope has a name on it at last, and the form has been trimmed to fit the desk.

4.8 rebuilt the floor plan so you could stand in several rooms at once — a conversation streaming in the left pane, a document open in the right, a terminal beside the chat that spawned it. What 4.8 could not do was tell you anything. Every surface in that wall of tabs sat there asking, every few seconds, whether anything had happened yet: the errand queue polled, the autonomous rooms polled, the backdrop watcher polled, and each clock on the screen ticked to its own private schedule so no two “4m ago”s ever turned over together.

4.9 is the release in which the house stops asking and starts being told.

---

Where 4.8 gave you the rooms, 4.9 makes them attentive. The headline is realtime: one multiplexed socket carrying word of what has changed to every open tab, so a finished errand, a room waking up, or a freshly painted backdrop arrives the moment it happens rather than up to eight seconds later. Around that, four further bodies of work define the cycle. The wardrobe stops being a character’s private closet and becomes the house’s clothing system: one dialog browsing all four wardrobes, plain-language instructions on how each one’s owner likes to dress, and outfits that bring their component garments with them when they move. Archiving — which 4.8 gave to characters — comes to scenarios and garments, on the principle that putting a thing away is not the same as destroying it. The search bar learns to read the library, matching document text across every store you have. And the system prompt finally addresses a character the way it has been claiming to since the first line: in the second person, throughout, with no block quietly talking about her behind her back.

Five more earned their places. A chat’s scene can now be changed mid-conversation rather than being fixed at creation. NanoGPT arrives as a bundled provider carrying chat, images, and embeddings on a single key, and the image-profile editor learns to ask providers what they actually have rather than reciting a hardcoded list. Characters can look at a photograph — a defect that ran five bugs deep, in which four plugins stripped every image off the wire and the model wrote a confident paragraph about a picture it had never seen. Group scenes stop turning into committee meetings where every character answers the same question in turn. And the Commonplace Book can consult a character’s past conversations on every turn instead of only at the folds, at no extra cost, because the vector it needs was already embedded a moment earlier.

Three arrived late and would have carried a release of their own. A connection profile can now name an understudy — when a provider rejects the key, throttles, times out, or hands back nothing at all, the call is tried again somewhere else rather than simply failing. Image profiles gained LoRA adapters, with the editor asking each model what options it genuinely supports instead of reciting a hand-written list, and a Query button that reads an adapter’s card off HuggingFace and tells you what it says. And the Concierge grew a fourth state, so that “I have decided this chat is spicy” and “the classifier decided this chat is spicy” stop being the same button.

One thing leaves. The managed Linux virtual machines — Lima on macOS, WSL2 on Windows — are withdrawn from the desktop shell and from the server that ran inside them. Docker is the sandbox now. A virtual machine of your own making remains entirely supported; the difference is who builds it.

The thesis is simple: 4.8 let you occupy all the rooms. 4.9 makes them notice things — and tells you.

---

The House Notices

Realtime, and the End of Polling

Every screen in Quilltap used to run on a timer. The toolbar’s errand chips asked the server every second and a half whether the queue had moved; autonomous-room badges asked every few seconds; the story-background watcher kept both a passive sweep and an active loop; the tasks queue had a switch labelled “Auto-refresh (5s),” which was an honest description of a dishonest arrangement. Nothing was ever late by much, but nothing was ever right either, and a perfectly idle instance spent its evening asking itself questions.

A single multiplexed WebSocket now carries the answers instead. It is deliberately, almost insultingly small: a frame is about forty bytes, and it says what changed, never what it changed to. The client takes that hint, throws away the affected queries, and re-reads through the REST API — so the API stays the one source of truth, a reconnect is simply “invalidate everything and refetch,” and there is no second copy of your data taking a shortcut through a socket. An older tab that meets a newer server ignores topics it has never heard of rather than breaking.

Behind it sits a parent-process fan-out bus with a mandatory quarter-second debounce, so twelve errands enqueued in the same instant arrive as one frame rather than twelve. Errands publish when they are queued, claimed, finished, failed, or cancelled; autonomous rooms publish their run-state transitions; and every write a background job makes reaches the bus through the dispatcher after it lands, which means the child process needs to know nothing about any of this.

Polling did not go away — it was demoted. Every migrated surface keeps its original cadence wired up and gated on whether the socket is healthy, so an instance behind a proxy that eats WebSocket upgrades behaves exactly as 4.8 did rather than going quiet. The tasks queue’s switch is now labelled “Fallback polling (5s),” which is the same switch telling the truth. On a live instance, a ten-second idle window that previously cost at least one background fetch now costs none.

The upgrade path is also, at last, actually guarded. Both WebSocket handlers — the terminal’s and the new one — authenticate through a single gate that requires a live session, an unlocked instance, and a same-origin request. The terminal handler previously accepted “a session-ish cookie exists,” which proved nothing whatsoever, Quilltap setting no session cookie; and because browsers do not apply CORS to WebSocket upgrades, the origin check is the only thing standing between a localhost instance and any website that cares to open a socket against it.

One Clock for the Whole House

The second cause of a stale screen was not the server at all. Every relative timestamp on screen — “4m ago,” “Today,” a budget counting down — ran its own interval, started whenever its component happened to mount, so they drifted apart and turned over one at a time like a badly wound orchestra. There is now one shared ticker per granularity, aligned to the boundary rather than to the mount: it fires just after each minute, each second, and each local midnight, so every “4m ago” in the house becomes “5m ago” together, and a chat card rolls from Today to Yesterday at midnight rather than whenever it feels like it. It is inert during server rendering and pauses entirely while the tab is hidden.

A Chat Is Dated by When Somebody Spoke

The dates on the chat lists were, strictly speaking, true and entirely useless. A chat’s timestamp moved whenever anything about it changed — and because story backgrounds, context summaries, and every Staff announcement the house makes are stored as messages, a conversation nobody had touched since May could rise to the top of the dashboard dated four minutes ago, with nothing said in it. The Lantern finishing a backdrop is not the conversation resuming.

Every surface that shows or sorts by a chat’s date — the dashboard, the Salon list, a project’s or a character’s conversations, the merge picker, the Brahma Console — now shows the last time the user or an LLM character actually posted content. Whispers to particular participants count, being speech. Staff announcements, announcements posted under a custom name, tool results, and system events do not. Delete the most recent message and the date walks back to the one before it. A chat in which nobody has ever spoken is dated by its creation, which is the only honest answer available.

Restore learned the same lesson in passing: replaying a backup’s transcripts used to stamp every chat with the moment of the restore, so a decade of conversation arrived bearing one timestamp and no order. Each chat’s date is now recalculated from the transcript just written.

Labels That Behave Like Labels

Every control beneath a Salon message used to name itself with the HTML title attribute, which hands the job to the operating system’s own tooltip: about a second of motionless hovering, gone at the smallest twitch of the pointer, unwilling to return without leaving and re-entering, and truncated when the text ran long. The answer-confirmation badge suffered worst, since its title carried the discrepancy notes and the pre-revision text — a paragraph delivered through a widget that would not hold still.

Quilltap draws its own now. The bubble opens after a fifth of a second of hover, or immediately on keyboard focus; it flips above or below as the viewport requires, clamps to the screen edge, follows its anchor while the page scrolls, and closes on Escape. The eleven action-bar buttons each gained a proper accessible name to go with it — a tooltip is a courtesy, not a label, and screen readers were never being told anything. The verdict badge is now a real button that answers hover and focus like the icons beside it, holds open when clicked, and renders its contents as structure rather than a wall of title text: the verdict, the summary, what looked off, and what was originally written.

---

The Closet Becomes a Wardrobe

Four Wardrobes, One Dialog

Clothing in Quilltap has always lived in four tiers — a character’s own vault, a group’s store, a project’s store, and Quilltap General — but the Wardrobe dialog only ever showed you the first. The other three could be reached solely by moving something into them and hoping. The dialog’s top dropdown now lists every container a garment can live in, and selecting a shared one shows exactly its contents with the full menu behind each item: edit, star as default, duplicate, move, copy, delete, and a + New Item that creates directly in that container. The group tier gained the CRUD endpoints it had somehow never had, so a group’s clothes are now first-class rather than reachable only by transfer.

Instructions for Getting Dressed

Every wardrobe may now hold an optional Wardrobe/instructions.md — plain second-person guidance about how that closet’s owner likes to dress, read when a character dresses themselves at the start of a chat. Resolution is nearest-tier-first (character, then group, then project, then General), the first non-blank file wins, and the content influences the outfit choice and absolutely nothing else. It is edited from a collapsible panel in the Wardrobe dialog, or from the Wardrobe tab of a character’s Aurora page.

The file is scrupulously not a garment: the wardrobe reader skips it by name rather than parsing it as an invalid item and complaining on every read, the projection sweep preserves it rather than deleting it on the next write, a garment actually titled “Instructions” is filed as instructions-1.md instead of overwriting it, and the Almanack’s garment counts leave it out.

Wearing an Outfit in One Gesture

The outfit composer — the chat-start Starting Outfit panel and both dressing columns of the Wardrobe dialog — now opens with a Wear an outfit… pull-down above the five slot rows, listing every composite in the character’s wearable pool with the slots it claims and whether it replaces them. Picking one takes the same path a slot picker does, so an additive ensemble layers, one marked replace sweeps its slots first, and either way it dissolves into its component garments as it lands.

The per-slot + pickers, in exchange, no longer offer composites at all. A three-slot ensemble used to appear once in each slot it covered, pushing the garments actually meant for that slot down the list; it now appears exactly once, in the pull-down. A multi-slot leaf — a dress typed ["top","bottom"] — is not a composite and stays where it was.

Outfits That Travel With Their Clothes

Moving a composite outfit between containers used to move the outfit and leave its component garments behind, pointing at items that were often unresolvable at the destination — a preset for clothes that were no longer there. The transfer dialog now asks: move the components too, copy them and leave the originals, or leave them entirely; copying offers to copy them or not. The choice is all-or-nothing and follows nested composites all the way down. Only components living in the same source container travel, since shared-tier pieces are reachable from anywhere already. When copies mint new identities the outfit’s references are rewritten to match, and a post-write verification reads the outfit back from the destination to confirm every reference resolves. Copying an outfit while moving its components is refused outright, since it would strand the original.

Verifying that contract turned up a latent defect worth its own paragraph. Component references are stored as title slugs, and two garments sharing a title in one container produced a slug that the writer assigned to one item and the reader resolved to the other — so an outfit could silently rewire itself between one read and the next. An ambiguous slug is now assigned to nobody, and every reference to a colliding item is written as an exact identity instead.

A Slot for Hair

The wardrobe gained a hair slot, for hairdos rather than hair itself — the arrangement is a thing a character puts on and takes off; the hair is a physical description. Both the outfit resolution and the image pipelines understand the distinction.

---

Putting Things Away

Archivable Scenarios and Garments

4.8 taught the house to archive a character. 4.9 extends the same courtesy to scenarios and wardrobe items, on the same principle: a thing whose time has passed should be able to leave the lists without being destroyed.

An archived scenario or garment disappears from every list, dropdown, and picker. Each listing surface gained a Show archived checkbox that brings it back, badged, and still selectable — because archiving hides, it does not forbid. A garment archived in the middle of a chat stays worn. A chat whose scenario was archived after the fact keeps its scene. The one hard rule, with no parameter and no override, is that the outfit-selection LLM at the start of a chat never sees an archived garment in any tier: the point of putting a dress away is that nobody puts it back on absent-mindedly.

Scenarios carry the state as an archived: true frontmatter key across all four scopes, omitted entirely when the scenario is active, so a hand-written file with nothing but that line works exactly as expected. An archived scenario can never win a default-conflict or be auto-selected in the New Chat dialog, even while it is being listed. Filtering is server-side throughout — the checkboxes change what is fetched rather than filtering what arrived — so a picker that simply never asks for archived entries is safe by construction, and the two client-side filters that used to exist were removed rather than left as a second place for the rule to drift.

---

The Search Bar Reads the Library

The global search bar gained a Documents type and its own filter chip beside Chats, Characters, Messages, Tags and Memories. It matches file names, relative paths, and extracted document text across every enabled document store — character vaults included — and shows you the store, the path, and a highlighted snippet of the hit. One result per document, with a name match outranking a match buried in the text.

Where a result opens depends on what you were doing when you found it. With a Salon focused, the document opens in that conversation exactly as the composer’s own picker would: the Librarian announces the open, and the chat sees your later saves. Otherwise it opens in standalone Document Mode, which is attached to no conversation and announces nothing to anybody, ever. A middle-click always takes the silent route, because that is what the link itself points at.

Two limits are deliberate. Vaults belonging to archived characters are never searched — an archived character is a tombstone, and surfacing her files would be a way back in. And only documents Document Mode can actually open are searched, so every result you are shown is one you can click.

---

The Scene Can Change Without Leaving the Room

A chat’s scenario used to be settled at creation and settled forever. The Salon sidebar’s Chat drawer now carries a Scenario control offering the same four tiers the new-chat dialog does — project, general, group, and (with a single LLM character present) that character’s own scenarios — plus a Custom… box for writing one on the spot. Saving rewrites the scene, recompiles every participant’s identity stack so the change reaches the prompt rather than merely the record, and posts a Host announcement worded as a revision, so the scene-setting further up the transcript reads as superseded rather than contradicted. Saving an empty custom scenario clears the scene; re-picking the scene already in force does nothing at all, quietly. The original scene-setting message is left where it is.

The control opens on whatever is actually in force — text matching a preset preselects that preset; anything else opens on Custom… with the text loaded and ready to edit. The Markdown transcript export carries the change notices in the body, since a reader who saw the story relocate unremarked would be entitled to feel misled.

---

The House Speaks to Its Residents Directly

Person Consistency

The assembled system prompt has always opened by telling a character “You are —” and then, a few blocks later, started talking about her in the third person: her aliases, her pronouns, her appearance, all described to her as though she were somewhere else. The pronouns block went so far as to instruct her to use her own pronouns “when referring to this character,” which is a sentence nobody should have to parse about themselves.

Every block whose subject is the speaking character is now second person. Aliases: “You also go by…” Pronouns: “Your pronouns are… Use them whenever you refer to yourself in narration.” Appearance keeps its noun phrases, because that text is shared with the image pipelines, but arrives under “This is how you look —”. The manifesto, the personality, and the example dialogues get wrappers that fix who is being addressed: what you hold as true about yourself, what you know about yourself that others do not see unless you show them, how you speak. Outward-facing renderers — the public identity card, the other-participants block, the Host’s whispers — stay firmly in the third person, because their subject really is somebody else.

The final block of the prompt got the same treatment, and a live grammar bug went with it. Tool reinforcement used to read “When Ariadne uses workspace tools, she CALLS them,” with the pronoun looked up from the character record — which meant that every character with no pronouns recorded was told “they CALLS them — they does not merely describe calling them.” Second person needs no pronoun lookup at all.

Compiled identity stacks are now stamped with a builder version, and reading one requires exact equality — older, newer, and unstamped maps all read as stale and rebuild lazily on the next turn, so no migration is involved. A golden-hash table in the test suite makes forgetting the version bump impossible in either direction. The character generators were brought into line at the same time: the Wizard, Summon From Lore, and the Optimizer are each told which form of address a field takes, and the Optimizer is explicitly forbidden to flip one while rewording. Every prompt field in the app now shows a worked “Written as: …” example in its own correct person, from one shared source rather than three divergent ones.

Standing Instructions

Projects and groups have each had an instructions field for some time. The project’s rode along in a periodic whisper; the group’s had no consumers whatsoever and went precisely nowhere. Both are now rendered into the stable, cacheable part of the system prompt as a [STANDING INSTRUCTIONS] section — the project’s, plus the instructions of every group the responding character belongs to, sorted by name so the cache stays deterministic and emitting nothing at all, byte for byte, when there is nothing to say. Groups gained the missing plumbing along the way: the field is now accepted by the create and update routes that used to reject it, and the group editor has the Markdown editor the project settings card already had. The Prospero project whisper stopped carrying the instructions, since it would otherwise duplicate them every reinjection.

Group Scenes Stop Being Committee Meetings

A multi-character scene had a tendency to become a queue: ask the room a question, and each character in turn would answer it, at length, agreeing with the last. Anti-chorus discipline addresses the failure directly, so a character with nothing to add can let the moment pass.

---

Providers, Pictures, and Profiles

NanoGPT Arrives

A new bundled plugin adds NanoGPT, a pay-as-you-go gateway fronting 600+ chat models, 200+ image models, and two dozen embedding models behind a single API key that covers all three. Chat is OpenAI-compatible with streaming, tool calling, JSON response formats, and reasoning routed into the Salon’s thinking fold. Images pin base64 with a URL-download fallback and query the dedicated image-model listing, filtered to models that actually generate rather than edit or upscale. Embeddings discover their models live.

Three follow-ups arrived within the cycle. Reasoning Effort (none through xhigh) is a profile option forwarded as the gateway’s own parameter, and the plugin declares its thinking-turn rule so a multi-character turn on a thinking profile anchors in prose rather than a prefill. The reasoning display was reading the wrong wire field, which is why the thinking fold stayed empty for most routed models. And the gateway has a habit, on some routed paths, of re-emitting the entire answer down the reasoning channel after the content stream ends — rendering your whole reply a second time inside a fold at the bottom of the message. The plugin now holds post-prose reasoning while it remains a verbatim prefix of the prose: diverge and it commits in full as genuine thinking; still mirroring at the end and it is the echo, and is dropped.

Fetch Models, Honestly

The image-profile editor gained a Fetch Models button, and — more to the point — something for it to do. Four of the five image-capable plugins previously “implemented” model listing by handing back their hardcoded list even when given an API key; only OpenRouter ever asked. Each now genuinely queries its provider, filtered to models that actually produce images: OpenAI to the Images-API families, Google to imagen models exposing predict plus gemini models with image output, Grok to xAI’s dedicated endpoint, Z.AI to its image-model set. Without a key you get the curated list, unchanged. On a live-fetch failure the providers now throw rather than silently substituting the static list, so the response can honestly label itself as coming from the provider or from the built-in catalogue — and the form tells you which one you are looking at. Only genuinely live lists are cached.

Z.AI became a real image provider in the process. The plugin had shipped one for some time, but the UI never wired it up and generation was broken end to end: Z.AI returns image URLs, and every consumer in Quilltap reads base64, so a generated image simply evaporated. The provider now downloads the URL and returns bytes.

LoRA Adapters, and Options From the Model Itself

An image profile can now carry LoRA adapters — a list of { source, scale, trigger phrase } rows naming small trained weights that steer a base model toward a style, a subject, or a look you cannot reach by prompting. They live in the profile’s existing parameter bag: no schema change and no migration. A provider opts in by declaring the capability, per model or provider-wide, at which point the host shows the editor, caps the list at whatever that model will take, and hands the adapters over at generation time. A plugin that declares nothing never sees the key, so no other provider changed. NanoGPT is the first to take it up, mapping the one canonical list onto whichever of three wire dialects the chosen model family speaks — and a LoRA-capable model whose dialect it does not recognise gets a “family unknown” warning in the log rather than a body the model would quietly ignore.

Each row has a Query button beside its Source. It reads the repository’s public card off HuggingFace and reports what the card actually says: the base model it names, whether the repository is tagged as an adapter, which .safetensors files it holds, whether it is gated, how many people have downloaded and liked it, and the trigger phrase declared in its metadata — which one further click copies into the row. Nothing else is touched, and the Source is never rewritten. The lookup runs server-side, so your browser never contacts HuggingFace and an optional access token never travels in a query string. Two facts are stated in the panel because they have consequences: a repository holding more than one .safetensors is ambiguous when named as bare owner/name and the provider picks for you, and a gated repository needs a token that only some models accept. A 401 is reported as “missing or private” rather than “does not exist”, HuggingFace answering identically for a repository that is absent and one you are not allowed to see.

The panel deliberately makes no claim about whether an adapter will work with the selected model — that would mean matching provider model ids against HuggingFace base-model strings, and a confident “incompatible” on an adapter that works is worse than saying nothing. It shows the facts; you decide. What the help now covers instead is the failure that raises no error at all: an adapter trained for a different base model, a missing trigger phrase, or a prompt that never asked for the thing the adapter was added to supply. And, for story backgrounds specifically, the two conditions the candid draft requires — the chat must genuinely be flagged, and the adapter must sit on the profile named under Uncensored Providers rather than on whichever profile the chat happens to use — with a note on how to tell those two failures apart afterwards by reading the prompt stored on the finished image.

The image-profile editor’s hand-written per-provider switch is replaced, for providers that implement the new options hook, by the same schema-driven panel the connection-profile editor uses, fetched per model and refetched when the model changes. NanoGPT’s size list and image-count ceiling now come from that model’s own advertised capabilities rather than from a table in Quilltap.

And image parameters now reach every picture, not merely the ones made in chat. Five call sites built generation parameters independently and three of them read exactly one key off the profile, so anything you configured worked for generate_image in the Salon and was silently dropped for avatars, story backgrounds, the images API, and the wardrobe’s preview portrait. All five go through one builder now — which means those four paths honour the profile’s negative prompt, seed, guidance scale and steps for the first time, and the wardrobe preview asks the provider for a portrait instead of demanding a hardcoded size only OpenAI ever accepted. Two related repairs: a NanoGPT LoRA preset set without an adapter beside it was being dropped before the wire, so the generation succeeded, billed, and came back with none of the requested style; and a failed image request now logs the model, size, dialect and the request’s key names at error rather than debug, since NanoGPT returns the same generic 400 for a bad adapter source, an unreachable repository, an unsupported size and a filtered prompt, and packaged instances keep no debug log to tell them apart.

Characters Can Look at Photographs

Five defects, all downstream of a single image a user shared that no character could see.

The worst of them was silent. A profile’s “Supports image attachments” checkbox says the model can read pictures; it says nothing about whether the plugin can send them — and four plugins stripped every attachment before the wire. So ticking that box on a genuine vision model switched off the description fallback and handed the bytes to something that threw them away, and the model wrote a confident paragraph about an image it had never received. Both questions are now asked, through one predicate that reads the plugin registry: where the model can see but the plugin cannot send, the request routes to a description instead of losing the picture. The same check guards describer selection, which had been willing to appoint a describer that could not receive the image either.

Characters also gained describe_image. They had three image tools and all three were custodial — file this picture, show this picture to the room, list the catalogue — and not one of them answered “what is in this photograph?”, so models reached for the show-it tool and were told to file the image first. describe_image serves the description written at upload, or the prompt that generated a Quilltap-made image, or a fresh vision call, and does not require the image to be in the caller’s album.

The same shape turned up a third time before the cycle closed, in the Z.AI plugin, which kept a private list of which GLM models read pictures and matched only ids carrying a v after the generation number. Z.AI’s 5.3 line reads images without one, so glm-5.3-flash had every attachment stripped at the plugin with “does not support image input” — while the profile’s own checkbox had asserted the opposite and switched off the description fallback. The list is deleted rather than extended: whether a model can see is the host’s question, answered by the profile; whether the transport can carry the bytes is the plugin’s, answered by the MIME check. A regex pinned to last year’s naming convention is stale the day the vendor drops a suffix.

A fourth instance closed the family. With the Concierge in Auto-Route mode, a refused turn is retried and then rerouted to the uncensored profile — carrying the message array built for the original profile, with the attachment question already answered for it. On a turn carrying an image, a vision-capable primary had correctly embedded the raw bytes and the text-only substitute received them: a 400, an empty response, and a character who said nothing at all, with both sides of the configuration perfectly correct. The reroute now re-asks the attachment question against the profile it is actually about to call, so an image a stand-in cannot read becomes its description exactly as it would have if that profile had been the primary; and the search for an uncensored route is ordered by what can carry the payload rather than filtered by it, because a described image beats no reroute at all. The wider lesson was that “can this profile receive this attachment?” had three independent spellings in the codebase — which is precisely the drift that produced this bug and the three before it. There is one now, and all three sites call it.

The last of the family arrived at the very end of the cycle, and it is the widest. A file you attached to a message was expanded into prompt text at assembly time and never stored — the message row kept your typed words and a file-id pointer, and nothing ever turned that pointer back into text again. So the first character to answer saw the document; nobody else ever did. In a six-character scene the file reached 1 of 13 model calls, and every later turn in any chat, single-character or not, was equally blind — while the attachment chip sat in the transcript looking like evidence to the contrary. The same held for uploaded images: the one path that pulls attachments back out of history is filtered to assistant messages, because it exists to carry the Lantern’s backdrops and avatars forward, and your upload is a user message. Attachments are now re-derived from the file when each character’s context is assembled, once per character, on their first turn after the upload — through the same fallback pass the upload path uses, so text is inlined, a picture is described for a provider without vision and carried whole for one with it. It happens before the context budget is computed, so the tokens are budgeted and trimmed like any other content, under a per-turn ceiling that skips an enormous file rather than truncating it. Nothing is written to the database, which means your existing chats are repaired too, and the behaviour survives regenerate, swipe, import and restore.

And every full-size image viewer in the app now has a Download button. Several had none — a real problem in the desktop shell, where right-click → Save Image is not available — and two more hand-rolled the anchor-click trick and so missed the native save dialog. All of them now go through the same Electron-aware helper.

Connection Profiles Send What They Say

A run of repairs this cycle came down to profiles whose settings were being recorded and then not used. Max Tokens and Top P were saved and never sent. Max Context was saved and ignored by the context budget, which used its own idea of the window. Ollama profiles could not set a request timeout and did not drive the server’s context window. Local and OpenAI-compatible providers did not send the profile’s parameters at all, and OpenAI-compatible endpoints could not call tools. An API key would follow a profile when you pointed it at a different provider, and so would a base URL onto a provider that does not show one. Clearing a numeric option left the old value in place. Profiles can now be tagged. The multi-character [Name] prefill became a per-profile setting rather than a global one — and, since a thinking model rejects or silently swallows a prefilled assistant turn, a migration turns it off on the profiles that run one.

Every Profile Can Name an Understudy

When a call through a connection profile failed outright — a rejected key, a rate limit, a network error, a model that is no longer there, a 5xx, an empty response, a moderation refusal — the call failed, and that was the end of the turn. A profile can now name an understudy to try instead, and may optionally permit one further stand-in of the same or better model class, auto-picked. Each call is capped at three attempts: your profile, your understudy, one tier pick. Chains do not recurse, so an A→B, B→A arrangement is legal configuration that simply stops rather than spinning. And there is no stickiness — a successful fallback applies to that call and no other, so the next message tries your primary again, as it should.

The tier pick is off by default, on the principle that spending money at a provider you did not choose is not a thing to do quietly. When it is on it excludes Courier profiles, anything with no usable key, and anything below the tier that just failed; it insists on a danger-compatible profile in a dangerous-routed context; and it prefers a different provider over a higher-tier sibling of the one that just let you down.

The one preference the chain overrides is modality. A chain swaps the model but reuses the message array built for the primary, so on a turn carrying an image the raw bytes are already in it — handing that to a text-only stand-in is a guaranteed 400, which is exactly the shape of the reroute bug above. Both steps therefore require vision when the turn carries images, the named understudy included. Every other choice you made is honoured as you made it; this one is an incompatibility rather than a preference.

It is wired in at four places. The Salon’s hard errors walk the chain and say so as they go, emitting a “failing over” stage per attempt — but only before the first word of prose has reached you: once a character has started speaking, a partial answer is preserved rather than substituted. Empty responses try the chain third, after the same-profile retry and the uncensored reroute, both of which answer their own cases better. Cheap-LLM tasks re-issue against each stand-in with a fresh deadline, governed for provider-picked selections by a new Allow a Similar-Tier Stand-In switch in Cheap LLM settings. And image description runs the describer’s chain before falling through to the uncensored describer. When a chain is exhausted, the error names every profile that was asked and how each one declined.

Both new fields ride through export, import, backup and restore, with the understudy’s id remapped on each path — without which every restored chain would point at a profile the new account has never heard of. Deleting a profile clears it from every profile that named it.

---

The Concierge Learns Who Decided

The per-chat Concierge switch had three states doing the work of four. Underneath it are two independent questions — who decided this chat is spicy, the classifier or you, and where does it route, ordinary providers or uncensored ones — and one corner of that square was unreachable. Vouching a chat off-duty dropped the uncensored profile ids entirely, so an operator who knew perfectly well what they were writing got concealed prompts on the default image profile, and the only route to the uncensored providers ran through convincing the classifier.

There are four states now, grouped in the dropdown by who is doing the deciding. Under The Concierge decides: Monitored (formerly “Safe” — the classifier keeps watch and may flip the chat to Flagged on its own) and Flagged (unchanged — the classifier’s verdict, uncensored routing, danger styling). Under You decide: Vouched Safe (formerly “Off-duty” — you vouch for the chat, no classification, no scanning, ordinary providers) and Uncensored, which is new. Uncensored takes every route Flagged takes — uncensored text and image profiles, candid story-background drafts, uncensored cheap-model tasks — with no classification, no scans, no announcements, and no danger styling, and it works even when the global Concierge mode is off. It is the state for a chat whose nature you already know and would rather not have adjudicated.

The switch is also on the New Chat form now, above Starting Scenario, with the same four options in the same two companies — because a conversation whose nature you already know should not have to be created Monitored, waited on, and then corrected. A posture chosen there is in force from the first word: the Concierge posts his note at the top of the fresh history, immediately after the system prompt, and the opening greeting is composed under it — an Uncensored chat goes to the frank desk on the first attempt rather than after a refusal, and a Vouched Safe chat is never rerouted at all. Continue Elsewhere carries the posture across, so a change of venue no longer quietly resets it. Leave the dropdown alone and creation is exactly what it always was.

The chat lists learned the same distinction. The red asterisk on a chat card, and Quick-hide’s “Dangerous Chats” toggle at four separate sites, both read the raw stored danger label — a flag that predates the four-state control and was wrong in both directions. The mark is now derived from the state and appears for everything other than Monitored, in the same three tones the header pill wears, with a tooltip naming the state, what it means, the classifier’s categories where it has any, and where to change it. Two consequences follow, and they are the sort worth reading before you go looking for a chat: a chat you vouched safe loses its red asterisk, gains a grey one, and is no longer hidden by Dangerous Chats, while an uncensored chat gains a blue asterisk and now is. Which is the honest rule: Dangerous Chats hides what takes the uncensored route, whoever decided it should. The same tidying stopped an uncensored chat from enqueueing a classification job every single turn for the handler to throw away at its own guard — harmless to the data, and pure waste in the job child.

The Salon header pill renders per state (red for Flagged, grey for Vouched Safe, blue for Uncensored, nothing at all for Monitored), and every manual transition posts its own announcement. Under the hood an overloaded predicate that had been answering all three questions at once was deleted and its twenty-odd call sites split between three that each answer one — should this route uncensored, should this wear danger styling, is the classifier on duty — and the two classifier gates that used to read the raw column now go through the helper, so the new state cannot be reclassified out from under you. Existing chats keep their exact behaviour; the migration only records that the column’s domain has widened.

---

The Commonplace Book Keeps Up

A character’s vault holds a summary of every conversation it has taken part in, and the Commonplace Book searches that shelf to build the “Relevant Past Conversations” a character is shown. That list used to refresh on three cadences only — the opening recap, each summary fold, and turns that reach explicitly for the past — so between folds it stood still while the conversation wandered several turns away from the dialogues the character was still being pointed at.

A new instance-wide setting, Consult past conversations every turn (Settings → Memory → Recall Relevance, off by default), re-runs that search every turn. The reason it can afford to is that it costs no extra embedding call: the turn’s memory search already embedded a vector for exactly this sentence, and the conversation-summary search now reuses it rather than paying to embed the same words twice. Where no vector is available — memories skipped, no embedding profile, a failed call — the cadence sits the turn out rather than spending anything of its own. The per-turn list is deduplicated against the standing fold whisper and the retrospective recap alike, so no conversation is ever listed twice to the same character in one turn, and the list length ramps with the profile’s context window.

Whose memory is this? A character’s vault holds what she remembers about herself and what she remembers about everyone else in one place, told apart only by the memory’s subject — and three of the four blocks that render memories into her context printed the text alone, with no indication of whose life it described, all of them under the heading “You remember the following entries that bear on this moment.” A character with a long history was therefore reading other people’s actions, relationships and physical history as autobiography. In the case that surfaced it, a male character answered a question addressed to a woman, as that woman — correctly, in her voice, using her children, her body and her past. Nothing errored. The turn completed and read well. The same memory appeared twice in the one context block: properly attributed under “You also recall about the others present”, and unattributed as his own two sections above. Lines about somebody else now carry About <Name>: in all three blocks, matching what the inter-character block always did, and a subject that cannot be resolved to a name still gets a prefix — so a line can never read as first person by default. The effect was sharpest on cheap models and on profiles that send no per-character prefill, where nothing at all stands between those memories and the model’s first word.

Help search learned to read sections. Help documents were embedded one vector per file, which for a 700-line page spanning a dozen subsystems is a smear that matches no specific question strongly — and the tool then handed the model the first thousand characters of the file, which is a table of contents rather than an answer. A new chunk table holds section-level slices, rebuilt whenever a document’s content hash changes and embedded with the document title and nearest heading prefixed, so a section carries the context of the page around it. The Guide’s own search box, which had only ever matched titles, now searches document text server-side and shows a snippet centred on the hit.

---

Under the Floorboards

The Managed Virtual Machines Are Gone

Quilltap used to offer to build you a Linux virtual machine and run itself inside it — Lima on macOS, WSL2 on Windows — so that the desktop shell could put a real kernel boundary between the assistant and your files. That arrangement is withdrawn. quilltap-shell 4.2.0 removed both modes from its side; 4.9 is the server half. The strongest isolation Quilltap ships is now Docker, and a virtual machine of your own making, with or without Docker inside it, is as supported as it ever was — the building of it is your affair.

Gone from the build: the lima/ directory and its init script, the rootfs builder, the wsl2 stage in the CI image, and the four rootfs steps in the release workflow. Releases no longer attach quilltap-linux-amd64.tar.gz or quilltap-linux-arm64.tar.gz. The Docker images — amd64, arm64, and the multi-arch manifest — and the standalone tarball that the quilltap CLI and the Electron shell actually download are unchanged.

Gone from the app: the Lima branch in platform detection, the lima and wsl2 environment types on the instance lock, the vm and electron-vm runtime modes a character sees in its own self-inventory, the Almanack’s lima runtime type, the VM and Electron+VM badges in the footer, and the isVM field the data-directory endpoint used to report.

The part worth reading closely is host URL rewriting — the trick that lets a containerised Quilltap reach a model server running on your desktop. It had five strategies for finding the gateway; three existed for Lima, and two of those were actively wrong under Docker, returning a bridge address that reaches nothing on the host’s loopback. There are two now: QUILLTAP_HOST_IP if you set it, then host.docker.internal inside Docker. In a self-managed VM, QUILLTAP_HOST_IP is the supported route — it both switches rewriting on and supplies the address. @quilltap/plugin-utils 2.6.0 carries the same change, and qtap-plugin-mcp 1.1.37 takes it up; that plugin bundles the rewrite itself because MCP servers validate the Host header and need a custom fetch rather than a rewritten URL.

docs/WINDOWS.md, which was a WSL2 troubleshooting guide and nothing else, is deleted. The README and the About page now describe the shell’s three back ends — Direct (the Node server inside Electron), Docker, and Remote (any Quilltap URL, including a dev server or an npx quilltap instance) — in place of the old VM/Docker toggle.

A Lost Key Can Be Cut Again

The .dbkey file is only a wrapper; the pepper inside it is the actual database key. Anyone holding the pepper could therefore always rebuild the wrapper — but the only way to do it ran through the server’s own unlock endpoint, which wants a running server. That covers a lost key file and nothing else. A forgotten passphrase left you at the locked screen, being asked for the one thing you no longer had, with no offline way in.

npx quilltap instances restore-key <name> writes the key file with the server down. The pepper comes from ENCRYPTION_MASTER_PEPPER or a hidden prompt, never from a flag, because a command line lands in shell history and in ps. Before writing anything it opens every encrypted database in the instance with the candidate pepper and refuses if one fails — a .dbkey holding the wrong pepper is worse than none at all, since the server unwraps it happily, hands the database a key that decrypts nothing, and reports intact data as corrupt. That proof cannot be waived while there is an encrypted database to check; --force covers only a fresh or still-plaintext instance. The command is lock-gated, an existing key file is backed up beside itself, and the minimum-server-version stamp the Electron shell reads is carried across the rebuild.

It does not re-encrypt character archive bundles, which are sealed with the passphrase rather than the pepper — only the server’s Change Passphrase card rewrites those — and it says so when the passphrase changes.

The Cheap Model’s Budget Was Its Own Ceiling

The small background tasks — titles, summaries, memory extraction, scene tracking, compression — run against a cheap model on a deadline. Those deadlines were round numbers chosen by eye, and once the log started naming a failed cheap task it became possible to see what they had been doing. Across 1,971 completed non-compression calls on a live instance, not one had ever taken longer than the budget, and three task types peaked within six hundred milliseconds of the wall. That is not a distribution; it is a censored one. The maxima were the ceiling, not the work. Compression showed the same shape against its own higher limit. In the first sixty hours after the failure log existed, eighty-one passes were lost, every one of them to a timeout.

Four changes followed. The shared remote budget goes from 45 seconds to 90 and compression’s from 75 to 120 — set well clear of the old wall rather than just past it, since the true tail is unknown because it was censored, and the point is to stop cutting the curve so the histogram can be read at all. The ceiling now follows who is waiting rather than only which task it is: work done in the background gets the generous number, while anything awaited inline while a turn assembles keeps the short one, because those tasks produce optional context and losing one costs a character some remembered flavour rather than the turn. A timed-out attempt gets one more go on a fresh socket — only a timeout, since a rejected key or a refusal would fail identically the second time.

And, most consequentially, a cheap task lost to a timeout no longer looks like one that finished. Six job handlers now fail rather than return: scene-state tracking, title update, context summary, story background, and both memory extractors. Before this, every job in the measured window came back COMPLETED — 83 memory extractions, 99 scene-state passes, zero failures — over 45 passes that never happened. A failed job now takes the existing backed-off retry and then goes dead with its reason attached, which is a third attempt at the work and the first time the loss is visible to anybody. One consequence is worth knowing: a memory extraction that throws discards the whole turn’s buffered writes, so the retry re-runs atomically with no duplicates, but the passes that did succeed go with it. That is the right trade when the retry works, and worse data with better information when it does not — and a provider timing out three times against a 90-second ceiling is a configuration you want to be shown rather than have absorbed.

---

Repairs

Fifty-seven defects were catalogued and fixed across the cycle, most of them found by walking the application as a user rather than as its author. A representative handful: chat titles and story backgrounds silently stopped working because a cheap model misspelled a single key; the standalone tarball was smuggling the build host’s native modules into every target; the tool-result error sentence the emitter carefully composed never reached the interface, so a failed image generation said nothing about why; DeepSeek’s thinking models returned a 400 on every character turn because prefill-hostility was scoped to providers rather than to thinking models; hover states across the entire application resolved to no CSS rule at all and therefore did nothing; a character’s photo gallery had no reachable way to download a picture, the controls being painted over by the page toolbar; creating a project with a blank description failed with a silent 400; and shell completion stopped working the moment a flag appeared on the line.

Three more arrived late and are worth naming. A .qtap bundle carrying a single malformed connection profile used to import nothing at all — the new legacy-field seeding sat outside the loop’s per-item guard, so one hand-edited record threw past everything else in the file; the helper is now total over junk input and the call has moved inside the guard, where a bad item is named in a warning and the rest of the bundle lands. Deleting memories in bulk — a full-wipe restore, or a large character cascade on an instance with tens of thousands of them — failed outright on SQLite’s variable limit rather than deleting; the queries chunk now, and the last remaining per-row bypass of the deletion chokepoint was routed back through it. And a cheap task that dies now says in the server log which task it was, on which provider and model, in which chat — where it previously arrived as an anonymous provider error, and where reading those lines led directly to the budget work above.

The document tools accounted for two more, both of them cases of a tool blaming the file for a fault of its own. An edit arriving without its find argument was answered with “Text not found in file” — advice that cannot possibly help, since the fault was in the call — so the character dutifully re-read the file and made the same malformed call again; the handlers now check their arguments before opening anything and name the one that is missing. And an edit could be refused over punctuation: models write curly quotes and em dashes when they write prose, Quilltap stores what they write, and a later turn retyping that sentence with a straight apostrophe — which models routinely do — found nothing to match. Re-reading did not help, because the retyping came out the same way; five valid edits were refused this way on one instance. Exact matching still wins wherever it finds something, but where it finds nothing at all the tools now fold typographic variants together, write the replacement in the spelling the caller used, and say that the fold was needed, so the model learns the file’s punctuation differs from its own. Quilltap’s own typography was not involved and did not change: nothing curls a quote on its way to a tool, an export, or a model.

Sliders, finally, look like part of the application. All fifteen <input type="range"> controls in the app had been carrying five different ad-hoc idioms between them: six set no accent at all and rendered in the browser’s default system blue whatever theme you were running, two discarded the filled portion of the track and showed a flat grey bar that said nothing about its own value, and two more wore a text-field style, complete with input border. There is one token-driven class now, and sliders have a themed focus ring for the first time.

Seven more landed after the rest of these notes were written, and five of them are the same shape: a component or a call that believed something without checking. The Move to Project folder dropdown mirrored its derived list into state behind a guard that the first render — both queries still in flight — already satisfied, so the mirror was filled with the loading state and sealed against every update after it, including a change of destination; every project offered / (Root) and nothing else. The folders table grew without bound — 207 rows for one project’s /story-backgrounds/ on one instance — because a folder read that failed returned the same null as a folder that was absent, and six hand-rolled findByPath → create guards each took that as licence to make the folder again; there is one ensureByPath now, backed by a unique index. An image describer’s answer was believed without confirming the image had ever reached the model, and the invention was then written down permanently; the describer now verifies, and a chat upload’s FileEntry records the hash of the bytes actually stored rather than of bytes discarded in transcoding, which had left every join to the document store dead. And the NanoGPT manifest was still declaring that images are not forwarded, eleven plugin versions after they were.

The last two were budget and brittleness. The one cheap call a turn actually waits on — the turn-blocking distillation — was running under the budget written for the calls nobody waits on, so a busy multi-character room slowed from a six-second first reply to forty-four seconds over an afternoon, and once to 435; it asks for the interactive budget now. The character optimizer aborted an entire refinement run when a sub-step answered with an object where an array was expected, rather than taking the one answer it was given. Separately, and not counted among the seven, absent characters stopped being painted into story backgrounds.

Three landed on the last day, in the last hour of the checklist. Claude Opus 5 was unusable through Quilltap: the model removes temperature, top_p and top_k and rejects fixed-budget thinking, and the Anthropic plugin’s list of models that refuse sampling parameters had every recent sibling on it and not Opus 5 — while the plugin lists models live, so Opus 5 was selectable in a profile and every send against it came back a 400. quilltap instances default --json had never once worked: the dispatch arm called through without an options object, so the flag was neither read nor stripped and was taken as the name of an instance to make default. And the two late repairs described in their own sections above — the unattributed memories and the attachment only one character ever saw — were each found by using Quilltap for an evening rather than by any test.

The release checklist’s own refactor pass turned up a handful more, each a divergence between two copies of the same logic: a cheap-model selection on the fallback path was dropping the profile’s provider parameters, the export wizard’s preview was counting archive bundles the writer refuses to include, an API-key failure said different things depending on which surface asked, a document-delete 404 read “File not found not found”, and Pascal’s Workbench rendered the source of a JavaScript function when given {{params.toString}}.

The hover-state failure earned a permanent guard. A qt-* class that resolves to nothing is indistinguishable, at every automated layer available, from one that resolves and happens to inherit — the markup renders, TypeScript is satisfied, the linter has no opinion, and the test renderer does no cascade. Only a person looking at a real browser can tell. npm run lint now fails the build on an undefined qt-* utility, and on any qt-* token carrying a variant prefix, which is the shape that let most of that family go missing in the first place.

---

Upgrading

Eight migrations run on first boot. create-help-doc-chunks-table-v1 adds the section-level help chunks described above, and — because an already-upgraded instance has every content hash matching and would otherwise skip every file forever — a backfill slices any already-synced document when the chunk table is empty and enqueues the jobs that fill in the vectors. Measured on a real instance: 588 chunks across 120 documents, embedded inside a minute. add-profile-multi-character-prefill-field-v1 moves the multi-character [Name] prefill from a global switch to a per-profile one, and retire-prefill-on-thinking-profiles-v1 then turns it off on profiles that run a thinking turn, since those reject or silently swallow a prefilled assistant turn. add-profile-fallback-fields-v1 adds the two columns an understudy needs, both defaulting to nothing, and widen-concierge-override-domain-v1 records only that the per-chat Concierge column now admits a fourth value. Two more are repairs rather than additions: collapse-duplicate-folders-v1 keeps the oldest row of each duplicated folder, repoints any child whose parent it discards, and puts a unique index behind the identity so it cannot happen again (one instance had 607 rows describing 24 folders), and realign-file-entry-sha256-v1 rewrites the recorded hash of every stored file to the hash of the bytes that are actually on disk — which is what reconnects a converted upload to its description, its chunks and its embeddings. recompute-chat-last-message-at-v1 is the eighth, described next. All of them are safe to run more than once.

Your chats will be re-dated once, on the first boot. The new “last time somebody spoke” timestamp is calculated for every existing chat, and the loading screen names the step while it runs. Nothing else about a chat is touched — but expect the lists to re-order, sometimes considerably, since a conversation whose date was being held aloft by a story background or a Staff announcement will drop to where it actually belongs.

Nothing is required of you for fallback chains, LoRA, or the Concierge’s fourth state. No profile has an understudy until you name one, and the auto-picked tier stand-in is off until you switch it on. LoRA adapters live in a profile’s existing parameter bag — no schema change, no migration, and no adapter until you add one. Every existing chat keeps the exact Concierge behaviour it had; the two renamed states, Monitored and Vouched Safe, are the same states wearing clearer names.

Two Quick-hide behaviours change, and two project background modes are gone. Dangerous Chats now hides by Concierge state rather than by the stored label, so a chat you vouched safe reappears in your lists and an uncensored one goes into hiding — check the toggle once if you keep it on. And the project Story Backgrounds selector loses two of its four options: Project-generated background read a field only the Latest-chat path ever wrote and had no generator behind it, and Static uploaded image read a field nothing anywhere writes and had no upload control beside it. Both were incapable of producing a picture under any circumstances. A project left in either is read as theme — the same blank result it was already getting — and the two stored image fields are kept against the day a real project generator or an upload control exists.

Provider prompt caches roll cold exactly once. The system prompt gained the standing-instructions section, which is a structural change, so the cache structure version moved from 3 to 4. Nothing needs doing; the first turn on each character after the upgrade is merely a little dearer than the second. Compiled identity stacks likewise rebuild lazily on first use — a stamped envelope, no migration, no visible pause.

Realtime needs its upgrade requests passed through. If you run Quilltap behind a reverse proxy, forward the Upgrade and Connection headers so the WebSocket can establish; the socket is same-origin only, so the proxy must also present the instance under the origin the browser is using. Where it cannot connect, every surface falls back to the polling it did in 4.8 — you lose the immediacy, not the function. The tasks queue’s “Auto-refresh (5s)” switch is now labelled “Fallback polling (5s)”: same switch, honest name.

NanoGPT needs a key of its own. It is a new API key type; a NanoGPT connection, image, or embedding profile expects a NANOGPT credential rather than borrowing an OpenAI-compatible one.

Nothing is required of you for the wardrobe or scenario changes. Archiving is opt-in and adds no state to anything you have not archived; Wardrobe/instructions.md is read where it exists and skipped where it does not. Existing chats are untouched by the mid-chat scenario control — a chat’s scene changes only when you change it.

If you were running the Lima or WSL2 back end, you must move. Update the desktop shell to 4.2.0 or later and choose another mode: Docker if you want the assistant kept behind a door — it is the strongest boundary Quilltap ships, and the recommended arrangement; Direct if you would rather the Node server simply ran inside Electron; Remote if you keep Quilltap elsewhere and want the window pointed at it. Your instance data is untouched by any of this — the data directory is the same on either side of the change. If you run Quilltap inside a virtual machine you built yourself, nothing is taken from you, but set QUILLTAP_HOST_IP to your host’s address: it is now both the switch that enables host URL rewriting and the source of the address, the /proc/net/route and /etc/hosts guesses having gone with Lima. And if you were pulling quilltap-linux-amd64.tar.gz or its arm64 twin from the releases page, those were the VM rootfs images and are no longer built; the standalone tarball and the Docker images are unchanged.

Node.js 24+ is still required, unchanged from 4.8.

---

Installation

Electron Desktop App

Download the latest .dmg (macOS), .exe (Windows), or .AppImage (Linux) from the quilltap-shell releases page. The window is only ever a front end, and it offers three back ends: Direct (the Node server inside Electron, no isolation), Docker (the container image behind a native window — the recommended arrangement, and the strongest boundary we ship), and Remote (any Quilltap URL, including a dev server, an npx quilltap instance, or a machine on your network). Requires shell 4.2.0 or later.

npm (Node 24 required)

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads and caches locally.

Docker

docker pull foundry9/quilltap:4.9.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

Standalone Tarball

Available for environments where npm global installs and Docker are both impractical, and unchanged by this release. Note that the two quilltap-linux-*.tar.gz archives are no longer published — those were the Lima and WSL2 rootfs images, not this. See the GitHub releases page for download links.

---

The house has stopped asking. Word of a finished errand, a room waking, a backdrop freshly painted reaches every window at once, and all the clocks on the wall turn over on the same tick. The closet has become a wardrobe — four of them, browsable from one door, each with a note inside on how its owner likes to dress, and an outfit that no longer walks out leaving its own clothes behind. A dress or a scene may be put away rather than burned. The search bar reads the library and not merely the spines. A scene may be revised without anyone leaving the room, and the Host says so in a way that lets the earlier evening stand.

And the house speaks to its residents in the second person now, all the way through — no block describing a woman to her face as though she were elsewhere, no character told that they CALLS a tool. When you hand one of them a photograph, she looks at it.

Every profile has an understudy waiting in the wings, and when a provider forgets its lines the scene continues rather than stopping. The lists tell you when somebody last spoke rather than when the house last tidied. And the Concierge, at last, can tell the difference between a verdict and a vouch.

Below stairs, the house has given up building guest rooms for itself. The managed virtual machines are gone; the door that remains is Docker’s, and it is a better door. And should you ever mislay the key to the whole place, it can now be cut again from the metal it was struck from — provided you still hold the metal.

And at the last, two quiet corrections worth more than they look. A page you hand to the room is now read by everybody in it, not only by whoever answers first. And no one is handed another person’s life and told it is her own — every memory about somebody else says whose it is before it says anything at all.

4.8 let you stand among all the rooms. 4.9 makes them pay attention.

— Ariadne, for the Bureau, September 5, 2026

Quilltap 4.9.1 Release Notes

There is a particular species of misfortune that does not announce itself. A door is not slammed; it is merely closed, softly, by a servant who assumed you had seen him do it. The room beyond carries on without you, and you are left to conclude — since nobody has said otherwise — that the party has simply gone dull.

Something very like that had been happening in the Salon. When a chained turn failed outright — a provider erroring, its understudies returning nothing, the whole fallback chain exhausted — the server did the prudent thing and paused the chat rather than blunder onward. Prudent, and entirely silent. If it happened twice in one evening, with the guest pressing Resume in between, the Salon lost the thread altogether: it had changed its own mind about the pause without troubling to inform the copy of the chat it kept consulting, and so the second pause arrived looking exactly like the first and provoked no reaction whatever. The client believed the room was live. The server held it firmly closed. Neither was inclined to bring it up.

The symptoms were maddeningly mild, which is the worst thing symptoms can be. Every message drew precisely one reply and then the room went quiet. A nudge produced a single turn and quiet again. The Skip button appeared for perhaps a third of turns and absented itself for the rest. The sidebar read Pause throughout, with the serene confidence of a footman insisting the drawing room is open while standing in front of the door. Nothing errored, nothing was lost, and nothing in the log recorded any of it — the guard that stopped the chain did so by simply returning, in the manner of a man who leaves a party without saying goodbye. The only remedy was a page reload, which the user had no earthly reason to attempt.

Three corrections, one at each layer. The Salon now reconciles its notion of the pause with the server’s on every fetch rather than only when the fetched value changes its mind, and Pause and Resume update that fetched copy as well, so the two can no longer hold different opinions in private. The turn chain no longer stops on a paused chat without saying so: the early return now logs, records itself, and raises the same completion event a mid-chain pause always did — and every such event now carries word of whether a pause was involved, since an error alone cannot tell you that. And when a chain stops on a pause the guest did not ask for, a notice says so, with particular wording when a character’s turn was the thing that failed. Rooms run entirely by characters keep their existing dialogue and are not troubled twice.

The Skip button has been given a firmer footing while we were in the neighbourhood. It is now offered whenever the composer will accept your words as some seat at the table — your own character, or one you have taken up by impersonation — rather than only in the narrow moments when the rotation has formally arrived at that seat. The banner says plainly whose turn it actually is. Skipping an impersonated seat works from the Salon at last (the server had always permitted it; the client was being scrupulous on its own initiative), and a skip now lifts a pause before proceeding, exactly as a nudge does. The must-speak guard is untouched and remains the only thing that will withhold the button from you.

---

What Changed

• fix (Salon): A chat the server paused twice, with a Resume in between, left the client believing the room was live while the server held it paused — every message drew one reply and no more, and the sidebar read Pause throughout. The pause flag now reconciles with the server’s on every fetch, and setPauseState updates the fetched chat object, so local and fetched copies can never drift apart. (bug 123)
• fix (Salon): A turn chain that stops because the chat is paused now logs, persists a null turn participant, and emits a paused chain-complete instead of returning silently. Every chain-complete carries a paused flag — set for a pause decision and for the chain-error safety stop, clear for an empty-response stop. (bug 123)
• fix (Salon): A chain that stops on a pause the user did not cause now raises a toast, with specific wording when a character’s turn failed. All-character rooms keep their existing pause dialog rather than being told twice. (bug 123)
• fix (Salon): The Skip button is offered for whatever seat the composer will attribute a typed message to — your own character or an impersonated one — instead of only when the turn rotation has landed on that seat, and the banner names whose turn it is. Skipping an impersonated seat now works from the client, and a skip lifts a pause first, as a nudge does. The must-speak guard is unchanged. (bug 123)

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.9.1

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

A release in defence of the proposition that a room which has stopped talking ought to say why.

The door is no longer closed quietly behind you.

Quilltap 4.8.2 Release Notes

A patch release with ideas above its station.

Two rooms of the house were attended to. The first is the one you sit in — the composer, that unglamorous rectangle where the actual work happens — which has spent its entire life offering you the hundred-odd characters your keyboard could reach and a polite silence regarding the rest of Unicode. The second is the wardrobe, which turns out to have been an admirable filing system with no reading room attached.

The Typewriter Acquires Several Thousand Keys

Type a colon and at least two letters, and Quilltap will offer you emoji by name. Type a backslash and a symbol name, and it will offer you the rest: \to for →, \phi for φ, \Phi for Φ, or \right arrow if you cannot recall what the thing is called and would prefer to describe it. If you know the code point, \u2192 and \u{1D538} both work and resolve arithmetically, without consulting any table — which means every character in Unicode remains reachable, including the several thousand that curation quietly declined to list.

A menu appears; Enter or a click inserts. Complete the name and follow it with a space — \to — and the character arrives immediately, keeping the space, with no menu at all. Two buttons in the formatting toolbar open browsable pickers, one for emoji and one labeled Ω for everything else, each with a search field and a row of recents.

What is inserted is a plain Unicode character. Not a shortcode, not an image, not a bespoke node with opinions about serialization. Exports, Markdown round-trips, search, and the model all see ordinary text, because it is ordinary text. A single Cmd/Ctrl+Z removes the character and restores the literal :smi you typed.

The interesting engineering here is the restraint. The menu does not open after http://, nor inside 10:30, nor in a Windows path, nor on :). It stays shut inside fenced code blocks and inline code. Nothing fires inside a math span, so $$\phi$$ remains LaTeX and is not helpfully rewritten into a Greek letter by an assistant who has misjudged the moment. A $ followed by a digit or a space is read as currency, so a sentence containing both $5 and \to behaves. Markdown escapes are untouched, on the reasoning that an escape is a backslash plus punctuation while a symbol name must begin with a letter — so \*, \_, and \[ can never open a menu.

The datasets — 1,914 emoji, 3,282 characters across 26 Unicode blocks, about 93 KB gzipped between them — are served from public/ and fetched only on the first trigger or the first picker open. An instance that never uses either feature never downloads either file. The space bar never triggers the fetch. If a fetch fails, typing is unaffected and the menu simply declines to appear.

Both live behind toggles on the Chat settings tab, under Composer, and both default on. The toolbar buttons are not gated by the toggles; the flags govern the automatic triggers only.

Smart Typography, Split By How Confident The Rule Is

This one is two features that look like one, separated on a principle worth stating plainly: a rule you are certain about may change your text, and a rule you are merely confident about may only change how your text is displayed.

Quotation marks fall in the second category. Quilltap can now render curly quotes while storing and transmitting exactly the straight ones you typed — your text is unchanged, the model’s input is unchanged, and only the display is prettier. Code, mathematics, and link addresses are skipped structurally rather than by pattern-matching, because they are separate node types in the markdown tree and not merely text that happens to look technical. A roleplay template that has claimed a quote character as one of its own delimiters suppresses the curling for that chat, as does dialogue-detection configuration naming a straight quote without its curly counterpart. It applies everywhere the message renderer runs — the Salon, streaming replies, thinking blocks, the help chat, the Brahma console — and it is off by default.

Dashes fall in the first. Typing -- gives an en dash, --- an em dash, ... an ellipsis, in the Salon composer and in Document Mode, and these write real characters into your text. On by default. One Backspace or one Cmd/Ctrl+Z reverts any substitution. Nothing fires in code blocks, inline code, source-mode editors, or during IME composition, and pasted text is left entirely alone.

Dashes are deliberately not applied at render time and will not be, so that --verbose written in ordinary prose survives to be read as --verbose.

The Wardrobe That Was Written To But Never Read

Since groups gained document stores, the wardrobe transfer dialog has offered every group as a destination for a garment. Moving one there worked. The file landed in the group store’s Wardrobe/ folder, precisely as designed, and sat there in the dark.

Nothing ever read it back.

The wearable pool took the character’s own vault, the chat’s project stores, and Quilltap General — and not groups. So a garment moved into a group did not appear in the wardrobe dialog, was not listed by wardrobe_list, could not be resolved by wardrobe_read, wardrobe_wear, wardrobe_update, or wardrobe_archive, was never equipped as a default at chat start, and could not be moved back out, because the transfer dialog’s source lookup did not scan groups either. The item was not lost. It was filed with perfect fidelity into a room with no door.

The group tier is now read everywhere the other shared tiers are read. A character’s wearable pool is the union of their own vault, the Wardrobe/ folder of every store belonging to every group they belong to, the chat project’s stores, and Quilltap General — with precedence matching the document-store tiers: character > group > project > general. A group’s livery shadows a project’s copy of the same item, and a character’s personal copy shadows both, which is what makes the isDefault: false personal copy work as a way of declining a shared default.

Group wardrobes follow the character rather than the chat: a character sees their own groups’ wardrobes and never a co-participant’s, the same rule Knowledge already used. The single exception is the chat outfit-summary endpoint, which spans the whole cast and therefore reads the union of the participants’ groups, so that every equipped item resolves to a title.

Underneath, the three separate copies of “read a mount’s Wardrobe/ folder” collapsed into one module, and the tier options that used to travel as a bare array of project ids are now a single object resolved by a single helper — so that a call site can no longer thread one tier and silently drop another, which is exactly how this went unnoticed for as long as it did.

Bundles Now Come Apart In Your Hands

Putting on a composite outfit used to store the bundle’s own id in every slot it covered, expanding to individual garments only at read time. The visible result was a single “Man in Black · bundle” card above four slot rows all reading Empty — the outfit was on, and nothing on the screen would tell you which shirt.

Wearing a bundle now dissolves it in the same gesture. Components are stored in the slots their own types cover, the bundle’s id is never written to equipped state, and you can see each piece and remove one without disturbing the others. Expansion is complete, so a bundle nested inside a bundle comes apart too. This happens wherever an outfit is put on — the Live tab, the Outfit Builder, the chat-start composer, a character’s default outfit, the cheap model’s chat-start pick, and all three modes of wardrobe_wear.

The replace flag now clears the union of the slots a bundle designates and the slots its pieces actually land in, so a replacing outfit that includes boots removes the shoes already worn rather than layering over them. A “Naked” composite that designates all four slots still strips the character, as documented and as one would hope. Bundles whose components cannot be resolved — a shared outfit whose pieces live in a store the caller cannot read — are stored whole exactly as before. Outfits equipped before this change keep their composite id and their bundle card, Break apart remains available for them, and no migration is required.

Four Smaller Corrections

A wardrobe change made before the outfit finished loading was thrown away (bug 61). The dialog gets its item list from one request and the current outfit from a chain of three. In the window between, the Wear and Layer buttons were live with nothing to apply them to; a click was staged against an empty outfit, overwritten when the real one arrived, and the Done flush could not distinguish “this character has no recorded starting outfit” from “nothing changed” — so it sent no request, reported success, and closed. The change was gone, silently, and indistinguishable from a save that worked. Clicks in that window are now recorded and re-applied to the real outfit the moment it lands. If the outfit never loads at all, Done says so and asks before discarding the change.

Curly-quoted dialogue was never highlighted without a roleplay template (bug 62). The built-in fallback patterns claimed in a comment to handle straight and curly quotes alike. They did not: the character sets listed the straight quote twice, and the duplicate accomplished nothing. Since most model output is curly-quoted — as is anything pasted from Word, Pages, or Scrivener, or typed on a Mac with smart quotes on — this was the common case failing while the comment asserted otherwise. Both now match. Single quotes remain deliberately excluded, an apostrophe being a single quote far more often than a quotation mark is. The same mistake sat in the @quilltap/plugin-types documentation, where an author copying the DialogueDetection examples received a detector that never matched curly dialogue; fixed in 2.5.6, now spelled with explicit escapes so the characters cannot be misread.

Text replacements fired inside code blocks (bug 63). With any replacement rule defined, typing the trigger inside a fenced block or an inline code run rewrote it — a rule like fn → function silently editing code as you typed it. The plugin checked only that the cursor sat at the end of a text node, and CodeHighlightNode extends TextNode, so fenced tokens sailed through; nothing checked the format bit for inline runs. Both surfaces now bail, through a single helper shared with the new insertion plugins so the typing aids cannot drift apart again. The plugin previously had no tests. It has them now.

Chat export navigated the window instead of downloading, on Electron. The Salon sidebar set window.location.href to the export route — a download in a browser, and in the desktop shell a navigation of the app window to an API endpoint. It now uses the same helper the Markdown export directly beside it already used.

One Bug Filed And Not Fixed

Honesty compels a note about bug 64, which is documented in this release and repaired in none of it.

On a genuinely fresh instance, completing encryption-key setup closes the main SQLite connection out-of-band before converting the database files, while the backend and manager singletons keep the dead handle cached. Every repository call afterwards fails with “The database connection is not open” until the process is restarted. The conversion itself completes correctly and no data is lost — but a first-run user meets a wall of errors at the precise moment they have the least reason to trust the software. Restarting Quilltap clears it entirely.

The bug file documents the root cause and specifies the fix. It is not in 4.8.2.

---

What Changed

• feat (Salon): Emoji insertion by name. Type : plus two or more letters to search and insert; a completed shortcode like :smile: inserts without the menu. A toolbar button opens a searchable picker with a browsable grid and recents. Works in the Salon composer and Document Mode. Inserts plain Unicode characters — no shortcodes, images, or custom nodes. The menu stays shut after http://, inside 10:30, in Windows paths, on :), and inside fenced or inline code. The 1,914-entry dataset (~53 KB gzipped) is served from public/ and fetched only on first use. Toggle under Chat → Composer (“Emoji shortcuts”), default on. Adds composerEmoji to chat_settings (migration add-composer-emoji-field-v1).
• feat (Salon): Unicode insertion by LaTeX name (\to), description (\right arrow), or code point (\u2192, \u+2192, \u{1D538}). Aliases are case-sensitive, so \phi is φ and \Phi is Φ. A toolbar button labeled Ω opens a searchable picker. Nothing fires inside a math span, so $$\phi$$, $\phi$, \(\phi\), and \[\phi\] stay LaTeX; $ before a digit or space reads as currency. Markdown escapes are untouched, since a symbol name must start with a letter. 3,282 characters across 26 Unicode blocks (~40 KB gzipped), fetched on first \ query or picker open; the space bar never triggers the fetch. 165 characters already in the emoji index are excluded so the two triggers never offer the same character, and code-point entry resolves arithmetically so every character in Unicode stays reachable regardless. Toggle under Chat → Composer (“Symbol shortcuts”), default on. Adds composerUnicode to chat_settings (migration add-composer-unicode-field-v1).
• feat (Calliope): Smart typography, in two parts. Quotes render curly while storing and sending exactly what you typed — text and model input are unchanged. Code, math, and link addresses are skipped structurally as distinct node types. A roleplay template claiming a quote character as a delimiter, or dialogue-detection config naming a straight quote without its curly counterpart, suppresses curling for that chat. Applies in the Salon, streaming replies, thinking blocks, the help chat, and the Brahma console; off by default. Dashes substitute at type time — -- → en dash, --- → em dash, ... → ellipsis — writing real characters, on by default, reverted by one Backspace or one undo, and inert in code, source-mode editors, IME composition, and pasted text. Dashes are deliberately never applied at render time, so --verbose in prose survives. Toggles on the Chat settings tab under Smart Typography. Adds smartTypographySettings to chat_settings.
• fix (Aurora): Wardrobe items moved into a group are now readable. The group tier was a valid transfer destination but was read by nothing — such an item vanished from the wardrobe dialog, wardrobe_list, wardrobe_read/wear/update/archive, chat-start default selection, and the transfer dialog’s own source lookup. A character’s wearable pool is now the union of their vault, every group they belong to, the chat project’s stores, and Quilltap General, with precedence character > group > project > general. Group stores follow the character, not the chat, so a character never sees a co-participant’s group wardrobe; the chat outfit-summary endpoint is the one exception and reads the participants’ union so every equipped item resolves to a title. Group items are wear-only, like project and General items. The three copies of “read a mount’s Wardrobe/ folder” collapsed into lib/mount-index/shared-wardrobe.ts, and tier options are now one SharedWardrobeTiers object so a call site cannot thread one tier and drop another.
• change (Aurora): Wearing a composite outfit now dissolves it into its component garments in the same gesture, storing each piece in the slot its own type covers and never writing the bundle’s id to equipped state. Expansion is recursive, so a nested bundle comes apart too. Applies at every wear site — Live tab, Outfit Builder, chat-start composer, default outfits, the cheap model’s pick, and wardrobe_wear’s wear, replace, and add_to_slot modes. replace now clears the union of designated and actually-occupied slots, so a replacing outfit with boots removes worn shoes instead of layering. Unresolvable bundles are stored whole as before; previously-equipped outfits keep their composite id and Break apart button, and no migration is needed.
• fix (Aurora): A wardrobe click made before the current outfit finished loading is no longer discarded. The item list and the equipped outfit load from separate requests, and in the window between them a Wear or Layer click was staged against an empty outfit, overwritten on arrival, and then flushed as a no-op that reported success and closed the dialog. Such clicks are now re-applied to the real outfit when it arrives, landing on top of what was already worn rather than replacing it. If the outfit never loads, Done warns and asks before discarding. (bug 61)
• fix (Calliope): Curly-quoted dialogue is now highlighted in chats with no roleplay template, or whose template supplies no rendering patterns. The built-in fallback patterns listed the straight quote twice in character sets documented as covering “straight and curly”, so the curly case — most model output, and anything from Word, Pages, Scrivener, or a Mac with smart quotes — was never matched, on both inline highlighting and whole-paragraph dialogue styling, mid-stream and settled. Single quotes remain excluded by design. The same error in the @quilltap/plugin-types DialogueDetection examples gave plugin authors a detector that never matched curly dialogue; corrected across six sites in 2.5.6 with explicit escapes. Documentation only there — no type or behavior change, and existing plugins are unaffected. (bug 62)
• fix (Salon): Text replacements no longer fire inside fenced code blocks or inline code. The plugin checked only that the cursor sat at the end of a text node, and CodeHighlightNode extends TextNode, so fenced tokens passed; nothing checked the code format bit for inline runs. A rule like fn → function therefore rewrote code as it was typed. Both surfaces bail via a single $isInCodeContext helper shared with the new insertion plugins. Replacements in ordinary prose are unchanged, and the plugin now has tests. (bug 63)
• fix (Salon): Chat export from the sidebar now downloads on Electron instead of navigating the app window to the API route, using the same triggerUrlDownload helper the adjacent Markdown export already used.
• fix (Aurora): The “Aurora’s Core whisper” card in the character editor now stacks its label and description above the dropdown instead of placing them in a side-by-side flex column, where the full-width dropdown squeezed the label into a sliver a few characters wide. The two checkbox cards above it are unchanged.
• internal (Foundry): lib/emoji/ became lib/char-insert/, with emoji and Unicode as two dataset profiles over one implementation rather than two near-duplicate features. Search gained a NameAllWords bucket ranked below every existing bucket, so it can only add results that previously did not appear at all — which is why the emoji corpus passed through the refactor unedited, and is the regression proof. The dataset files did not change; public/emoji/emoji-index.v1.json is byte-identical.
• internal (Foundry): The smart-typography rule engine (lib/smart-typography/) imports nothing outside the standard library, enforced by an ESLint rule, and is pinned by a fixture corpus so the v5 port can be verified against it rather than re-derived.
• internal (Foundry): eslint-config-next 16.3 flags window.location.href for internal navigation. Two sites moved to router.push() — the legacy-shell handoff opening a standalone document in the workspace, and canceling the new-chat modal opened from a query parameter. Six keep the full page load deliberately and now carry comments explaining why: the three setup-wizard steps and the auto-lock redirect need client state rebuilt from scratch (for auto-lock that is the entire point, a client transition leaving decrypted data in memory), and the message-navigation helper is a plain module with no router in scope whose sessionStorage handoff depends on mount timing.
• chore (Foundry): npm dependencies refreshed across the app, packages, and all 14 bundled plugins. Next.js 16.2 → 16.3, openai 7.2 → 7.4, katex 0.18.1 → 0.18.4, mammoth 1.12.0 → 1.12.1, ws 8.21.1 → 8.21.3, plus dev tooling. create-quilltap-theme 2.0.18, @quilltap/plugin-utils 2.2.20, @quilltap/theme-storybook 1.0.59. All 14 plugins patch-bumped and rebuilt against @quilltap/plugin-types 2.5.6 and @quilltap/plugin-utils 2.2.20. Every plugin’s manifest.json version now matches its package.json version — nine had drifted by a patch or two from earlier bumps touching only one file, invisible because the plugin build does not sync them.
• docs (Foundry): Bug 64 filed and not fixed. On a fresh instance, completing encryption-key setup closes the main SQLite connection out-of-band before converting the database files while the backend and manager singletons keep the dead handle cached, so every repository call fails with “The database connection is not open” until restart. No data is lost and the conversion completes correctly. docs/developer/bugs/bug-64-setup-stale-db-handle.md documents the root cause and specifies the fix: tear down through closeDatabase(), convert all three databases (the mount-index DB is currently skipped until the next restart), reinitialize before returning success, and give the auto-lock path the same treatment. Also noted: the LLM-logs client stays open on the pre-conversion file during setup, losing log writes.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.8.2

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

A patch release which spent most of its energy on the two places where intention and record had quietly parted company: the keyboard, which could not type what you meant, and the wardrobe, which recorded what you meant and then declined to mention it again.

Both now answer when spoken to. The composer will find you an em dash, a Greek letter, or a small drawing of a teacup, and will do so without disturbing your code, your mathematics, or your --verbose. The wardrobe will admit to owning the coat you put in it.

Quilltap 4.8.3 Release Notes

Two corrections, both of them concerning staff who reported success while accomplishing nothing whatever.

There is a particular species of failure that is worse than a loud one, and both of this release’s occupants belong to it. A component that breaks noisily is a component that will be fixed. A component that breaks and then files a cheerful report is a component that will be trusted for as long as nobody thinks to check — which, in the case of the second of these, was rather longer than one would like.

The Locksmith Who Locked Himself In

On a genuinely fresh instance — a first run, a new copy, the very first minutes anyone spends with the software — completing the encryption-key setup left the house in an interesting condition. The front door still answered. The setup screen said the work was done, and it was: the databases were converted correctly and not one byte was lost. But every subsequent request to the cellar came back with the database connection is not open, and went on doing so until the process was stopped and started again.

The setup handler had closed the SQLite client before converting the files, which is entirely sensible and respects exactly one of the three parties who had an opinion on the matter. The backend went on cheerfully offering the closed handle to anyone who asked; the manager went on offering the backend. Neither had been told anything. So a first-time user, at the precise moment they had the least accumulated reason to trust the software, met a wall of errors — recoverable in full by a restart nobody had told them to perform.

Teardown now goes through two new manager functions, suspendDatabase() and resumeDatabase(), which close and reopen every handle while keeping the backend instance itself alive. That last part matters more than it sounds: the backend carries the column maps that tell structured data how to become itself again, and a rebuilt backend would hand every live repository an empty set of them, whereupon JSON and arrays and booleans would quietly start round-tripping as raw strings — a cure decidedly worse than the disease.

Four further defects came up in the same excavation, all of them relatives. The LLM-logs connection stayed open on its file while that file was replaced, so subsequent log writes went into an inode that no longer had a name. The mount-index database was not converted at setup at all, which left document-store bytes sitting in plaintext on disk until the next restart. disconnect() closed two of the three databases connect() opens. And auto-lock had precisely the same illness, so locking and unlocking wedged the house in exactly the same way, without even the courtesy of a restart notice. All four are fixed; lock now suspends, unlock resumes, and no restart is required.

Should the reopen fail anyway, the response still carries your one-time encryption key. It is displayed exactly once in this life and will not be withheld behind an error message.

The Sentry Who Had Been Asleep Since Tuesday

Quilltap keeps a guard on the cellar stairs whose sole duty is to stop an older copy of the software from opening a database that a newer copy has already migrated. It is a small guard with one job, and it had not been doing that job since the twelfth of August — while reporting, at every boot, that all was well.

The mechanism is unglamorous. The guard reached into the migration utilities with a synchronous require(). Those utilities had become an asynchronous module in the bundler’s graph the moment an earlier fix added an import to them, and a synchronous require() of an asynchronous module hands back an exports object whose body has never run: every property undefined, every call a TypeError, straight into a catch that permitted startup regardless. The only evidence in the world was two error lines at the top of every boot log, saying isSQLiteBackend is not a function, in a log nobody reads when everything appears fine.

The consequences were quiet and entirely structural. The highest-version marker was never written to the database — instances created since that date have no such row at all — the minimum-server-version never reached the key file where the desktop shell looks for it, and an older binary would have opened a newer database without a word of complaint. Nothing was corrupted by the bug itself. The guard was simply not there.

Both guard functions are now async and use await import(...), which is how every other part of the application reaches into the migration layer. The import edge that caused this was deliberately left standing: unwinding it would have restored the guard today and left the next innocent static import free to break it again, silently, on some future Tuesday.

Three further precautions were taken, on the theory that a guard who cannot report his own absence is not much of a guard. The failure now surfaces as a warning through the migration-warnings channel, so it reaches a human rather than expiring in a log file. A lint rule fails the build on any synchronous require() of the migration layer from application code. And the tests now assert the effect — that the version is actually written, that a failed guard actually announces itself — rather than merely that nothing threw, which is the assertion that let this through in the first place.

No repair is needed for existing instances. The correct value is written on the next boot: an instance with no row gets one, and an instance frozen at an old version is corrected upward.

---

What Changed

• fix (Saquel Ytzama): Completing first-run encryption setup no longer wedges every database connection until restart. Teardown goes through new suspendDatabase() / resumeDatabase() manager functions that close and reopen all handles while preserving the cached backend instance and its column maps. Also in the same pass: the LLM-logs client is now closed before its file is converted (writes were landing in the unlinked pre-conversion inode), the mount-index database is converted at setup instead of being left in plaintext until the next restart, SQLiteBackend.disconnect() closes all three databases rather than two, and auto-lock uses suspend/resume so the lock → unlock cycle no longer wedges. The backend self-heals a handle closed behind its back, except while suspended. If the reopen fails, the one-time encryption key is still returned and the setup screen shows a restart notice. (bug 64)
• fix (Foundry): The startup version guard, inert since 2026-08-12, works again. lib/startup/version-guard.ts used a synchronous require() of migrations/lib/database-utils, which had become an async module in the bundler’s graph — every property undefined, every call a TypeError swallowed by a catch that allowed startup anyway. Consequently instance_settings.highest_app_version was never written, minServerVersion never reached .dbkey, and an older binary would open a newer database without complaint. Both guard functions are now async with await import(...), and instrumentation.ts awaits them. Failures now raise a migration warning instead of dying at error level in the boot log, an ESLint no-restricted-syntax rule fails the build on require() of migrations/ from lib/, app/, components/, or hooks/, and the tests assert the written value rather than the absence of a throw. No repair needed — the correct value is written on the next boot. (bug 65)
• internal (Foundry): The better-sqlite3 test mock now throws TypeError: The database connection is not open from prepare/exec/pragma after close(), matching the real driver. A mock that kept answering after close is what hid bug 64’s entire class of defect.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.8.3

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

A patch release about two kinds of silence. The first was the silence of a locksmith who had shut the door behind himself and could not hear anyone knocking; the second, the silence of a sentry who had been reporting an empty corridor from somewhere else entirely.

Both posts are now manned, and both, more usefully, will say so if they are ever abandoned again.

Quilltap 4.8.4 Release Notes

A housekeeping release, and an unusually modest one. Nothing in the software itself has changed — not a line of it. What changed is a test that had taken to reporting the weather rather than the facts, and the correction is offered here chiefly so that the version numbers continue to mean something.

The continuous-integration job went red twice running, both times on the same assertion: a check that the composer’s emoji typeahead stays entirely dormant when the feature is switched off, and — the interesting half — does not go fetching the emoji dataset on the off chance. Locally it passed every single time. On the build machine it did not. That asymmetry is nearly always a clue, and on this occasion it was the whole story.

The typeahead reads its feature flag from the chat-settings query, and while that query is still in flight it assumes the feature is on: a deliberate and harmless optimism, which does mean that a colon typed in the very first instant still warms the dataset. The test had attempted to wait that instant out by sleeping for zero milliseconds, which sounds like a contradiction and is in truth a wager. The settings query announces itself on one sort of timer; the test harness drains its work on another; and which of the pair goes first is settled entirely by how busy the machine happens to be at that moment. An idle laptop won the wager every time it was offered. A loaded build runner, having other commitments, lost it.

The wager has been called off rather than improved upon. The harness now puts the settings in place before the editor is ever mounted, so the flag is in force on the first render and no timer is consulted at all. Both typeahead suites have been moved onto it. One of them — the Unicode picker’s assurance that it never fetches anything from a mere space bar — proves to have been passing even in a world where the feature was switched off entirely, which is the species of test that offers comfort rather than information. It now states its assumptions aloud and means what it says.

Anyone running 4.8.3 and finding it agreeable may skip this release with a clear conscience. It is here for the tidiness of the record.

---

What Changed

• internal (Foundry): Deflaked the two composer-typeahead settings-flag tests that had been failing intermittently in CI. CharTypeaheadPlugin falls back to enabled while the chat-settings query is in flight, and the tests tried to wait that window out with a zero-millisecond sleep — a race between TanStack Query’s setTimeout(…, 0) notification and React’s async act draining through a setImmediate-class task, whose ordering depends on machine load. renderPluginEditor now takes a chatSettings option that seeds the settings query cache before mount, so the flag is in effect on the first render and no timer is involved. The Unicode suite’s “never fetched from the space bar” case now seeds the flag on, where it previously passed even with the feature disabled. No production code changed. (#37)

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.8.4

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

A release about the difference between a test that passes and a test that is right. The one we had was passing on a laptop that happened to have nothing better to do.

It is no longer consulting the timing of the room to decide what it believes.

Quilltap 4.8.1 Release Notes

Four corrections, and all four of them the same correction wearing different coats.

A house of this size runs on questions it asks itself constantly and quietly. Is anyone already in this room? Is this cabinet empty, or merely shut? Is that the key, or only a thing shaped like one? Have I actually looked everywhere I claim to have looked? Answers to such questions are cheap to assume and expensive to get wrong, and 4.8.1 is the release in which four of them stopped being assumed.

None of these were reported by a user losing data. All four were found on a single instance, in the course of investigating why a perfectly ordinary Docker container and a perfectly ordinary desktop copy had disagreed about whose house it was.

The Cellar, Entered Without Knocking

Quilltap has, for some time, possessed an admirable arrangement for preventing two copies of itself from writing to the same database at once. The instance lock is acquired before the database is opened; a second Quilltap, finding the lock held by a living process, declines to proceed and says so plainly.

It was an excellent arrangement, and the migration runner had never once been told about it.

Every read and every write in the application proper goes through the SQLite backend, which takes the lock as a matter of course. The migration runner opened its own connection and went straight down to the cellar. This is an unfortunate exception to make, because migrations are not incidental writers — they are the heaviest writers in the entire codebase, the ones that rewrite whole tables in a single sweep. The failure mode this permits is precisely the one the lock exists to prevent, granted exclusively to the one subsystem least able to survive it.

On the instance where this was found, a Docker container held the lock and a second Quilltap ran ten migrations against the same database regardless, rewriting 20,037 embeddings and 9,212 memory rows, and only then discovered that it could not open the database at all. It had done all the work, in the wrong house, and been turned away at the door on its way out.

The migration runner now acquires the lock before it opens anything, and refuses to run when another live process holds it. Acquisition is re-entrant within a process, so an ordinary single-instance startup behaves exactly as it always did and notices nothing. A migration that cannot obtain the lock fails startup rather than proceeding hopefully, which is already how the house treats a migration that fails for any other reason.

An Unanswered Question Is Not a No

The second correction concerns a confusion between two very different silences.

The repository layer, when a query fails, returns an empty list. This is a defensible convenience in most places and a catastrophe in exactly one: the check that asks whether this is a brand-new installation. “There are no characters here” and “I could not find out whether there are characters here” arrived at the seeding logic as the same value, and the seeding logic, being cheerful by disposition, read both as welcome, new user.

The consequences of that misreading are not small. A transient read failure on an established instance — another copy holding the lock, an iCloud file only half-materialised, any of the ordinary indignities of a synced data directory — could send a fully-populated house down the new-install path: default characters, a default embedding profile, an entire .qtap import laid over the top of years of work. On the instance where this was found, nothing was actually written, because the seeding writes failed for precisely the same reason the read had. That is not a safeguard. That is a coincidence, and coincidences do not scale.

Emptiness is now established with a strict count that raises the underlying error rather than swallowing it, and seeding is skipped entirely when the question cannot be answered. Counting also runs beneath row validation and the document-store overlay, so a character whose vault happens to be briefly unreachable no longer quietly subtracts itself from the total. Both the character check and the embedding-profile check had the flaw; both are fixed. Ordinary list queries keep their existing forgiving behaviour, which is where it belongs.

The principle is short enough to embroider on something: seeding must fail closed. An unanswerable question is not a yes.

Saquel Ytzama — The Spare Key That Opened Nothing

There is a particular species of dread reserved for the discovery that the key you have been carefully backing up for years is not, in fact, a key.

An instance has one pepper and one quilltap.dbkey file. All three databases — main, LLM logs, mount index — open with it. The documentation, however, described per-database key files, and described them in some detail. quilltap-mount-index.dbkey was documented and has never been written by any version of Quilltap; it simply did not exist. quilltap-llm-logs.dbkey was worse, because it was real. Exactly one code path wrote it — changing your passphrase — and nothing anywhere ever read it. Since the other two paths that write the main key file never touched that copy, an instance whose passphrase had been changed after setup could carry a file that looked every inch a valid spare while holding a wrapping several passphrases out of date.

That write is now gone. If your data directory contains a quilltap-llm-logs.dbkey, it is inert and safe to delete. Quilltap does not delete it for you; removing key material on a user’s behalf is not a decision an application gets to make on its own initiative, however confident it happens to feel.

The more immediately dangerous half of this was the backup instructions. BACKUP-RESTORE.md and DEPLOYMENT.md both gave the wrong path for the .dbkey file — the key lives in the data/ subdirectory alongside the databases, and the documented commands pointed one level above it. The commands therefore copied nothing. They did not fail loudly; they simply had nothing to say. Anyone who followed the published procedure to the letter possessed no backup of the one file which, if lost, renders every database permanently unopenable.

The same wrong path appeared in the Docker restore steps, and the in-app help called the file .dbkey rather than quilltap.dbkey. All of these now give the real path, and the help page warns specifically about the failure mode of aiming a backup one directory too high, since that is a mistake which announces itself only at the exact moment it cannot be repaired.

Back up data/quilltap.dbkey. Please do check that you have.

The Inspector Who Only Read the Rooms He Had Keys To

The last item is the smallest and, in its way, the most instructive.

The project is spelled Quilltap. Since 2.9, an ESLint rule has flagged the doubled-t misspelling, and it has flagged it faithfully — in every file ESLint was ever given the means to open. The flat config supplies no configuration for .md, .json, .yml, or shell files, so eslint . skipped each of them with a mild “no matching configuration” warning that nobody was reading, and npm run lint went on returning green while the misspelling sat in docs/ in the plain light of day.

An inspector who reports the rooms he has inspected is doing his job. An inspector whose report is indistinguishable from a report on the whole house is a hazard, and the hazard grows in exact proportion to how much you trust him.

npm run lint and npm run lint:fix now run scripts/check-quilltap-spelling.mjs after ESLint. It sweeps every tracked file, and every new file not already ignored, using the same pattern the ESLint rule uses — both now read it from quilltap-spelling.js, so the two enforcers cannot drift apart while each believes it is speaking for the other. Deliberate occurrences are declared in an ALLOWED_PATHS list, or exempted line by line with a quilltap-spelling-exception marker.

The misspelling itself was corrected in one document, where it had reached the release asset names, the download URLs, and the prose alike. Every remaining occurrence in docs/ is deliberate: a document that states the spelling rule must quote the wrong spelling in order to state it, and the shipped changelogs record the misspelling being caught and fixed. Those are on the allowlist, and unchanged.

---

What Changed

• fix (Foundry): The migration runner now acquires the instance lock before opening its database connection and refuses to run when another live process holds it. Previously migrations — the heaviest writers in the codebase — used their own connection and bypassed the lock entirely, allowing a second Quilltap to rewrite whole tables while a first held the lock. Acquisition is re-entrant within a process, so ordinary single-instance startup is unchanged; a migration that cannot acquire the lock fails startup rather than proceeding. (bug 58)
• fix (Foundry): First-startup seeding now determines emptiness with a strict count that raises the underlying error, and skips seeding entirely when the question cannot be answered. The find* family returns [] on any failure, so a transient read failure previously read as “no characters exist” and could send a fully-populated instance down the new-install path — default characters, a default embedding profile, and a full .qtap import. Counting runs beneath row validation and the document-store overlay so a temporarily unreachable character vault does not subtract from the total. Both the character probe and the embedding-profile probe were affected and both are fixed; ordinary list queries keep their existing empty-list behaviour. (bug 59)
• fix (Saquel Ytzama): Removed the write of a second key file at quilltap-llm-logs.dbkey, the remnant of a per-database-key design that was never built. It was written only by the passphrase-change path, read by nothing, and never updated by the two other paths that write the main key file, so it could hold a stale wrapping while appearing to be a valid spare. Existing copies are inert and safe to delete; Quilltap does not remove them automatically. quilltap-mount-index.dbkey was documented but never written by any version. An instance has one pepper and one quilltap.dbkey; all three databases open with it. (bug 60)
• fix (docs): BACKUP-RESTORE.md, DEPLOYMENT.md, and the Docker restore steps gave the wrong path for the .dbkey file — one directory above its real location in data/ — so the documented backup commands copied nothing and left users without a backup of the one file that makes the databases unopenable if lost. In-app help called the file .dbkey rather than quilltap.dbkey. All paths corrected, with an explicit warning about the one-directory-too-high mistake.
• fix (Foundry): npm run lint and npm run lint:fix now run scripts/check-quilltap-spelling.mjs after ESLint, sweeping every tracked and new-but-not-ignored text file. The ESLint rule only ever saw files ESLint parses, and the flat config supplies no configuration for .md, .json, .yml, or shell files, so those were skipped with a warning while lint stayed green. Both enforcers now read the pattern from quilltap-spelling.js so they cannot drift. Deliberate occurrences are declared in ALLOWED_PATHS or exempted per line with a quilltap-spelling-exception marker.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.8.1

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

A patch release about epistemology, which is not a sentence anyone hoped to write. The house now knocks before entering the cellar, declines to mistake a locked door for an empty room, no longer keeps a spare key that opens nothing, and has stopped confusing the rooms it inspected with the whole of the building.

If you take one action on the strength of these notes, let it be this: confirm that you have a copy of data/quilltap.dbkey, and that it is the file itself and not the silence where a cp command found nothing.

4.7 turned the house into a society: the residents could write to one another, summon one another out of lore, and be remembered for the right reasons, while the keeper sat at the Brahma Console and asked the whole building questions in SQL. What 4.7 could not do was let you stand in two of its rooms at once. Open a conversation and the rest of the house folded away behind it; open a document and you left the conversation to do it; every errand was a journey down the hall and back, and a stream you had going somewhere else did not survive the trip.

4.8 is the release in which the house stops making you leave the room to visit another one.

---

Where 4.7 wired the corridors between the rooms, 4.8 rebuilds the floor plan so you can occupy several of them side by side and never tear one down to see the next. The headline is the tabbed workspace: a two-pane shell of kept-alive tabs where a chat, a document, a terminal, and a settings panel all stay mounted at once, a streaming conversation keeps streaming while you work beside it, and any tab can be dragged into the other pane to sit two surfaces shoulder to shoulder. Around that reconstruction, four further bodies of work define the cycle. Pascal the Croupier brings chance to the house — user-defined tables of dice and fortune, rolled server-side where no character can narrate a failure into a win, with a full visual workbench to build them. Persistent state grows from two registers to four, so a fact can be true of one chat, one project, one group, or the whole instance. The Commonplace Book learns to keep a calendar: memory now records when a thing happened and who was there, so a character asked about last week has somewhere to look. And the building at last does its mathematics in real typeset equations rather than rendering a Schrödinger integral as literal dollar-sign soup.

Five more arrived late and earned their places. Pascal’s rolls learned to change things rather than merely announce them — an outcome may now write into the house’s own registers. The keeper acquired a Taboo list: phrases nobody in the building will say, on pain of being asked to say the plain thing instead. The export format stopped being ninety-nine percent arithmetic and grew five new kinds of thing it can carry. The old capabilities report, which had been describing a house two renovations out of date, was rebuilt as the Almanack and finally taught to walk into the Scriptorium. And a resident may now be packed away — everything heavy and private about a character sealed into one encrypted trunk in the library, the house lightened by exactly that much, and the whole of it unpacked again, later, unchanged.

The thesis is simple: 4.7 let the residents reach one another. 4.8 lets you reach all of their rooms at once — and puts a gaming table in the parlor.

---

The House Rearranges Itself

The Tabbed Workspace

The largest change in 4.8 is structural, and once you have lived in it a day you will not want to go back. The application is now a two-pane workspace of tabs. Every open surface — a Salon conversation, a document, a terminal, the Aurora character grid, Settings, the Brahma Console, the Wardrobe — is a tab that stays mounted whether or not you are looking at it. Switching tabs no longer reloads anything; a conversation streaming in one tab goes right on streaming while you read a document in another. Tabs can be reordered, dragged from one pane into the other, and dropped onto a center zone to split the view down the middle, where a draggable, keyboard-nudgeable divider decides how the space is shared.

This was built as eight quiet phases behind a flag and then, once it had earned its keep, promoted to the default. The workspace is now the surface you land on after login. Deep links and old bookmarks to the former per-page routes — /salon/[id], /aurora, /prospero, /scriptorium, /settings, and the rest — still work: they redirect into the workspace and open the tab you asked for, laid over your restored layout rather than clobbering it. If you should ever want the old building back, NEXT_PUBLIC_WORKSPACE_TABS=0 returns every surface to its former standalone route exactly as it was.

A great deal of the work in this release was, frankly, the unglamorous business of making sure that nothing in the app secretly hard-navigates out of the workspace and tears down your live tabs behind your back. Chat cards, the sidebar footer, autonomous-room badges, in-help links, “continue last,” the character editor, the new-chat flow, the terminal’s pop-out button — each of these used to route away and remount the world. A single document-level link interceptor now catches any link that maps to a tab and opens it in place, and the stubborn holdouts were converted one by one. The reward is that a conversation you have going in the left pane is never interrupted by an errand in the right one.

Terminal, Document, Brahma, and Wardrobe as Tabs

The modes that used to split inside a chat now open as their own tabs. A conversation’s Terminal Mode (Ariel) and Document Mode (the Librarian) spawn tabs linked to their parent Salon, with the live PTY and editor kept mounted and portaled in — so a terminal or an open document can sit in the other pane, beside the chat that owns it, and survive every tab switch. The Brahma Console and the Wardrobe likewise open as full tabs, reusing their existing dialog bodies rather than duplicating a line of logic. Close a mode and its tab closes; close the tab and the mode turns off; close the parent Salon and its children go with it.

Several Documents at Once

Inside the workspace, a chat can now keep multiple documents open at the same time, each in its own tab, each tracking its own unsaved changes and autosaving independently. The “Open Document” button no longer vanishes the moment one document is open — it is there to open the next. Reopening a chat restores every document that was open when you left it. The LLM’s document tools learned to aim: doc_focus and doc_close_document take an optional path so a character can act on a named open document rather than whichever one happened to be frontmost.

---

A Croupier Comes to the Table

Custom Pseudo-Tools — Pascal’s Table

4.8 introduces Pascal the Croupier and, with him, user-defined mechanics of chance. A custom tool is a single JSON document — Tools/*.tool.json at the root of any document store — describing a named action, its parameters, a random roll, and an ordered table of outcomes that map the roll to a message and a semantic state. Both the model (through one run_custom tool) and you (through a dialog in the composer) can pull them, and they resolve through the same five-tier store pool everything else in Quilltap does, nearest tier winning on a name collision.

The design principle throughout is that the roll is honest. It executes server-side with crypto-strength randomness, and its outcome persists as a message the model did not write — a new synthetic sender, Pascal, making his first appearances. A character cannot narrate a fumble into a triumph, and regenerating a reply does not quietly re-roll the dice. Rolls can be a numeric range with an optional multiply/offset transform, or honest dice notation (3d6+2, 1d20, 2d10-1), and the outcome table is a set of AND-composed comparator objects rather than an expression string — there is no grammar to parse and therefore nothing to inject, and the last row must be a catch-all, checked at load time so a coverage gap is a structural impossibility rather than a nasty surprise at the table. A private roll can be whispered to the rolling character alone, or hidden from everyone but you.

A custom tool’s announcement, by the end of the cycle, is just the result — the tool’s title and whatever the file says to display, and nothing else. The croupier’s old patter (“At name‘s behest, Pascal spins the wheel…”) is gone, the parenthetical *(rolled 14)* is gone, and a manual run no longer publishes to every character which parameters you nudged off their defaults. What a roll says is the author’s to decide with a {{value}} or {{dice}} placeholder; the full record — raw draw, faces, transform, matched outcome — still persists in pascalMeta for the audit, out of the models’ sight. And an outcome now wears its own colours from end to end: the bar above the announcement takes the tint of the result it announces — triumph, partial, failure, or a plain matter of fact — instead of the alarm-red dot it used to share with a deleted file, and says so in words for anyone whose eyes do not read colour.

Pulling a tool yourself is no longer a matter of squinting into a narrow popover that vanished at the slightest click elsewhere. The wand in the composer gutter now opens a proper two-part dialog: first the roster — each tool with its description, the store it came from, and a wrench to open it on the workbench — and then, once you have chosen, that tool’s form with room to breathe and a search box when the roster runs long. It remembers the tool you used last and what you typed into it for as long as the conversation stays open, and it can tell you what a given tool is able to quote — the dice, the value, a parameter, a fact from the sheet — listed only where the definition’s own messages genuinely use them. That is a statement of the tool’s vocabulary and never of its odds. The croupier does not show you the table before you play.

One correction to that same dialog, arriving late: a tool you pull from the composer now rolls against your own character’s fact sheet, rather than against whichever participant happened to be stored first. In a room led by an LLM character, a metadata-gated table had been dealing somebody else’s branch — plausibly, with a well-formed result and no error anywhere to suggest the wrong hand had been played. Where none of the characters you are playing can be dealt a given tool at all, the roster now says plainly whose hand it will play instead, which is a great deal better than succeeding quietly as a stranger.

Pascal’s Workbench

Because hand-authoring JSON is a poor way to spend an afternoon, 4.8 ships Pascal’s Workbench, a visual editor for custom tools at /custom-tools. It lists every definition in every enabled store — valid or broken, with store and attachment badges and cross-store name-collision advisories — and a broken file opens straight into a repair mode that tells you the loader’s own reason for refusing it. The form builder can only produce schema-valid output: parameter cards whose renames rewrite every reference atomically, range and dice forms with a live readout, and an ordered outcome cascade with a pinned catch-all row and a placeholder insert menu. And it has a proving bench — a single test roll and a ten-thousand-draw outcome audit, both run through the very same execution core a live chat uses, with a fact-sheet card for testing metadata-gated rows and a live preview of the exact bytes a save would write.

The Oracle — Tools That Can Ask an LLM

A custom tool may now carry an optional llm block: a prompt template, a required author-written error line, and an optional output cap. When present, every run poses the rendered prompt to the instance’s cheap utility model after the roll and before the outcome table, and the answer becomes something the table can branch on. A consult that fails — a provider error, a timeout, an empty answer, no model configured — never fails the run; the table simply branches on the failure and deals accordingly. It is a croupier who can, when the table calls for it, step aside and consult an oracle before turning the card.

The Roll Leaves a Mark

A table that only ever says something is a table that changes nothing, and the keeper who wanted a lockpick to actually break had to go and break it himself. A definition may now carry side effects: up to sixteen conditional writes the house applies, server-side, the moment the outcome is settled and before Pascal opens his mouth about it. An effect can write into persistent state — and it writes where the fact lives, choosing chat, project, group, or the whole instance rather than dumping everything into the nearest register — or onto the rolling character’s own fact sheet.

Each effect carries the same when language an outcome row uses, extended with the outcome itself as a subject, so a failure may cost you something a triumph does not. Values may be a plain number or boolean, or a string, and a string is always an expression — a small closed grammar of arithmetic, concatenation, parentheses and {{ref}} substitution with no identifiers and no function calls, which is to say nothing to inject and nothing to escape from. Bare prose is refused at load time rather than at the table; if you meant the words “broken pick”, quote them and say so. An expression that fails at run time skips its own effect and nothing else, the whole set is recorded in pascalMeta alongside the values it replaced, and the Workbench’s proving bench shows you what would be written while writing nothing at all. A bench that altered the house every time you tested a recipe would be a poor sort of bench.

Characters are told, in the tool’s description, which registers a tool may write to — unless the definition keeps its odds private, in which case it keeps that private too — and the run dialog says plainly that the thing you are about to pull may leave a mark.

Naming the Run, and Keeping Your Settings

Two smaller graces at the table. A definition may carry a chip label, rendered per run after the outcome is known, so the transcript reads “Agent lambda — Jackie” rather than the same static title fourteen times in a row; the label is yours and the model never sees it. And an announcement is now two blocks rather than one, so an outcome message that opens with a list, a heading, a quotation or a code fence renders as written instead of gluing itself onto the end of the bold title.

Pulling the same tool with the same fiddly arguments over and over is likewise no longer necessary: the run dialog can save the current parameters as a named preset, kept as an ordinary hand-editable JSON file in the rolling character’s vault, where it rides along in exports and backups like everything else there. A dropdown loads them back, a button resets to the definition’s own defaults, and a preset naming a parameter the tool no longer has is quietly ignored rather than refused — so a preset written in June still works against a recipe revised in August.

metadata.json — A Fact Sheet Per Character

Every character vault gains an optional metadata.json: one flat object of arbitrary, user-authored keys with any JSON values — { "hasAnsibleAccess": true, "clearanceLevel": 3, "faction": "Ordo Aurum" }. It hydrates onto the character, round-trips through export and import, and is user-driven only — no generation system reads or writes it, and it is never injected into a system prompt. Custom tools are its first consumer: an outcome row can test when.metadata, the fourth test subject, so a table can deal differently to a character who holds a clearance the roller lacks. Missing keys fail soft and never throw — a table that branches on a key must still deal sensibly to the character who has never heard of it.

By the end of the cycle the fact sheet decides not merely how a character is dealt to, but whether they are dealt in at all. A definition may carry one of two optional clauses — availableWhen, which offers the tool only to a character whose sheet passes every test, or withheldWhen, which quietly takes it away from one who does — written exactly as an outcome’s metadata clause is written:

"availableWhen": { "metadata": { "toolAbilities": { "contains": "programmable" } } }

The gate is settled when the roster is assembled, before any roll is contemplated, so a withheld tool is not merely refused on use: it is absent. It does not appear in the description the model reads, it does not appear in the chat’s tool listing, and it cannot be called by name through either entrance. A character who has not been given the ansible does not know the house owns one.

Two properties are worth the keeper’s attention. The clauses are deliberately not each other’s opposite: because a missing key fails softly, a character with an empty fact sheet fails every availableWhen and satisfies no withheldWhen, so the two differ precisely on the character who has never been asked the question. And a gated-out definition does not claim its name — not even as a tombstone — so a nearer tier may hold a version for those who qualify while the General store keeps an ordinary one for everybody else, and each character reaches for the tool that is genuinely theirs.

Pascal’s Workbench grew a Who may reach for it control at the head of every recipe (Anyone / Only show if… / Do not show if…), a gated badge in the library, and a line on the proving bench reporting whether the loaded fact sheet would have been dealt this tool at a real table. The bench deals either way, of course. A gate decides who may reach for a tool; it has no business telling its author they may not test one.

---

The House Keeps State in Four Registers

Persistent state — Pascal’s older subsystem, the key-value memory a chat carries — grows from two tiers to a four-tier cascade: chat, project, group, and now a new instance-wide general register at the root of the Quilltap General mount. The merge is shallow and narrowest-wins, so a fact set on the whole instance can be overridden for a group, then a project, then a single chat. Group state, which already persisted but was wired into nothing, gains a proper API, tool access, and a UI. The state tool learned a context of group or general; the State Editor shows the inherited layers and warns when two groups apply at once and the group tier is therefore ambiguous. Custom tools can reference the merged cascade in their roll fields and messages through a {{state.path}} placeholder and a { "$state": "path", "fallback": … } reference whose mandatory fallback guarantees a run never fails for want of a value.

---

The House Learns Mathematics

Chat messages, help documents, and file previews now typeset LaTeX math with KaTeX, kept in lockstep between the client renderer and the server pre-render pipeline. The canonical delimiter is the double-dollar $$…$$, with the \(…\) and \[…\] forms models like to emit normalized to it before parsing. Math inside code stays code, and invalid LaTeX renders its own red source rather than breaking the message around it. To keep the models from fighting the renderer, every character’s system prompt now carries a short universal note telling it which delimiter actually works — because left to their own devices the models reached for single dollars and backticks and watched their formulas render as plain text.

The models, it turns out, ignore that note about as often as they heed it, and a formula that arrives as $\mathcal{P}$ deserves better than to be printed as its own source. So the house now reads the interior of a single-dollar span before deciding what it is. A span carrying an unmistakable mark of mathematics — a backslash command, a subscript or superscript, a set of braces — is promoted to a proper equation. A span carrying no such mark is money, and is left exactly as you typed it: a gentleman who slides $50 across the table and follows it with $20 has made a wager, not an assertion about the reals, and the renderer no longer pretends otherwise. A bare symbol like $K$ is the ambiguous case, and it is resolved by good manners rather than guesswork — it renders as a symbol only when a genuine formula shares its line, so it can stand beside the equation it belongs to while a lone $5$ stays five dollars.

---

The House Minds Its Tongue

A List of Things Nobody Says

Every writer has a handful of phrases that curdle the moment a model reaches for them — the shiver down the spine, the breath they did not know they were holding, the voice barely above a whisper. 4.8 adds a Taboo list: a per-instance roster of phrases the residents must never say, kept on Settings → Chat → Taboo and folded into the system prompt on conversational turns. It rides along in exports and full backups without being asked, because a house rule that does not survive a restore is not a house rule.

The wording of that section was laboured over, because the obvious implementation makes matters worse. A bare list of banned strings fails three ways at once: printing the forbidden phrase raises its salience, and a weak model will hand it straight back to you; a prohibition with no alternative leaves a vacuum that fills with the phrase’s nearest neighbour; and banning an exact string is an invitation to the variant. The section therefore frames the entries as worn-out clichés beneath the character’s dignity, pairs each ban with an instruction to say the plain thing instead, extends every entry to its inflections and near-relations, and forbids the model to mention the list at all. An empty list emits nothing whatsoever — not a header, not a blank line — so an instance that never opens the card produces exactly the prompt it produced before the feature existed.

The Staff Stop Teaching Bad Habits

Twelve of the Staff’s own announcements had been written as asterisk-delimited narration — Aurora regards Charlie and pronounces upon their attire — and the like. In a conversation whose roleplay template narrates with some other mark, those asterisks are not decoration; they are a demonstration, and a model copies what the context shows it far more faithfully than it follows an instruction the context contradicts. The tell is the closing delimiter: a model told to narrate with + opens the span correctly and then closes it with * two hundred tokens later, matching what it has been reading all along. Aurora’s outfit notices, the Core whisper, all seven of the Commonplace Book’s recall sections, and Suparṇā’s mail deliveries are now plain declarative lines, in the same words as before and merely without the asterisks.

The same habit had one unconditional source left. The tool-execution rules illustrated “do not narrate tool use” with *pulls up the file*, *executes the search*, and *reaches for the vault* — appended to every tool-enabled turn regardless of chat, character, or template, and landing after the template’s own formatting rules, where recency works against them. The examples are prose now.

Announcements That Name Their Speaker

An Insert Announcement posted as an off-scene character carried that name to the Salon and nowhere else. The renderer painted the name and the portrait; the models received anonymous prose. Observed in the wild: a whispered announcement posted as one character was read by its recipient as a remark from an entirely different member of the Staff, and the character carried the misattribution into the scene — whereupon the Host, whose introductions key off the text, cheerfully introduced the one figure the prose happened to mention while the actual speaker went unnamed. Announcements now reach the models attributed, in the same form participant messages already used. A speaker who cannot be resolved passes through unnamed rather than being invented.

An Announcement Meant for One Ear

Insert Announcement could only ever address the room. The dialog now has a Who hears it section listing the chat’s participants with a checkbox each: check none and the announcement is public, exactly as before and still the default; check one or more and it is persisted as a whisper, reaching only those characters’ contexts. The collapsed chip says where it went, so a private aside is distinguishable from a public one without opening it, and the in-character rewrite is told who is listening — a remark pitched to a full room reads wrong when one person hears it. You always see your own asides, whatever the whisper filter is set to, on the sound principle that a note you wrote thirty seconds ago should not vanish from your own transcript.

Whispers You Can Actually Read

Two repairs to whispers in general. Prospero’s group-context notices — the ones telling a character which shelves they may read — were exempt from the All Whispers toggle, having been swept up in an exemption written for private tool results. At 3,059 rows in the reporting instance it was the highest-volume whisper in the application, and every one of them was on screen with the toggle firmly off. The exemption is now keyed to the kind of whisper rather than to its sender, so the rolls, the private runs, and the failure notices you need to see remain visible and the scene machinery goes quiet.

And the “whispered to X” label, at three-quarters of a rem, failed WCAG AA against its own bubble in light mode in every bundled theme but one, and in the default theme besides. Art Deco measured 1.07:1, which is a polite way of saying invisible. Each theme’s label was darkened within its own palette, Art Deco’s whisper bubble was lightened as well — its muted sits so dim for a light theme that no violet belonging to the palette could clear the bar at all — and three dark-mode values were corrected on the way past. All six bundled themes and the default now clear 4.5:1 on both the label and the announcement chip’s audience tag, in both modes — twenty-six measurements, the lowest of them 4.65.

---

Memory, Time, Confirmation, and the Right to Pass

The Commonplace Book Learns When and Where

Until now the Commonplace Book kept excellent notes and no calendar. It could tell you that a character distrusts the harbourmaster; it could not tell you that the distrust began on a Tuesday in the rain, at the customs house, in the company of a woman who has not been mentioned since. Ask a character “do you remember that place we visited last week?” and the whole apparatus came up empty — not because the memory was missing, but because nothing in it had ever been asked to hold an occasion.

4.8 gives memory a spine of time and place. Every memory now records when the thing happened, kept scrupulously apart from when it was written down; a free-text in-story time for conversations that keep a fictional calendar; the proper nouns of the occasion; and whether it is a standing fact about the world or an episode — a thing that occurred. The per-turn extractor is handed the clock along with the transcript, so it can set down events as events, and a phrase like “last spring” is resolved against the turn’s own date rather than left as a vapour. Where the model omits an anchor, a plain deterministic pass supplies the dates and names it can see.

At the same cadence on which a conversation folds into a summary, a second quiet pass now reads the folded window and consolidates it into nought to two coherent, dated episodes per character present, each stitched back to the smaller memories it was assembled from. The fold summary itself acquires an append-only, dated Timeline — capped, with the oldest entries coarsened first rather than dropped — so a conversation summary in the vault stops being a paragraph about a conversation and becomes a dated archive of one.

Retrieval learned to read the tense of the question. When a turn looks backward, the recall pass now works out roughly when it is looking and who or what it is looking for, filters the candidates to that window before ranking them (and falls back to a bounded boost rather than ever returning less than it used to), anchors literal names into the pool, and casts up to three separate embedding probes instead of one. On such a turn the usual penalty against old memories inverts into a bonus, momentary details stop being discounted, and the anti-repetition rule stands down — because a memory you have just asked about twice is precisely the one you want handed over twice.

This produced a fourth recall cadence, recall-on-reference: a backward-looking turn earns a larger working set and a short, scoped whisper listing the relevant past conversations by date, with the identifiers a character needs to go and read them. Entries in the working set now carry [3 days ago]-style age labels — computed from when the event happened, not when it was filed — and the in-story time beside them where a story keeps one. A spam guard keeps the same recap from being read out twice.

For the deep dive, the search tool gained a date range and an about this character filter, memory results now come back with their event time and the conversation they came from, and read_conversation can be asked for a slice of a long transcript rather than the whole of it. The instructions attached to those tools now state the house rule plainly: search, then read the conversation, and say “I don’t recall” rather than inventing a specific.

And a quiet but consequential change of policy: the house stops destroying its own episodes. Memory compression no longer strips exact dates out of the records it condenses; the gate that merges near-duplicates now declines to merge two accounts whose event times sit more than a week apart, on the sound principle that the same thing happening twice is two things; and episodic records carry a small protection bonus through housekeeping. For the curious keeper, npx quilltap recall-replay <chatId> replays any turn’s recall and prints the entire candidate table — every score, every multiplier that fired, old path against new, side by side.

All of which the house could do, and still could not answer “the mission today.” The small model that reads a turn’s tense had been taught its examples in the register of “remember when we…”, so a same-day reference read as present tense; and with that one flag unset, the whole episodic apparatus stood politely down. A plain resolver now settles the ordinary English day references — today, this morning, last night, yesterday, N days ago, this week, last week — against the local calendar rather than the universal one, because an evening at a quarter to ten in Chicago is already tomorrow in Greenwich, and a Greenwich reckoning of “today” contains none of the evening you meant. And because no classifier catches every turn in every language, a memory of something that happened within the last day or two now carries a weight of its own through the ranking, so the recent event is not quietly outbid by the loud old one. Memories drawn from the conversation you are presently having are left out of that boost; they are in front of you already.

The Story’s Clock

A conversation may now be told, from the Chat card in the Salon sidebar, whether it runs on real time or story time — the setting that decides how all of the above reads a date. The memory work above brought the setting into being; for a short while it had no switch attached to it, which is a poor arrangement for a clock.

While fitting the switch we found the clock behind it had stopped. Fictional time is meant to run one-for-one with the wall clock, measured from the base instant you set; the field recording when the measuring began was never written by anything, so every reckoning measured zero elapsed time and reported the base instant again. The house had been announcing the same fictional moment, turn after turn, in every fictional-time conversation ever created. It now anchors the clock when a conversation is created, and a migration anchors existing conversations to the moment their base was chosen, so story time resumes where it should have been rather than lurching forward. The base was also being read in the server’s timezone before being displayed in the story’s — a 10:15 morning set for Istanbul arriving as a 6:01 evening on a machine in Chicago — and zone-less times are now read as wall-clock readings in the zone they were written for. Two lines of copy on the settings card, which promised that the clock “advances with each message,” have been corrected to describe the clock that actually exists.

The Commonplace Book Recalls More Aptly

The ranking behind the per-turn “relevant memories” whisper was reworked so recall tracks what the scene is actually about instead of resurfacing the same few loud, important memories every turn. Relevance now leads the blend, the importance term decays with age instead of sitting on a permanent floor, and — crucially — when nothing in memory clears a real relevance threshold, the Book now says nothing rather than reaching for filler. The per-turn query is sentence-shaped rather than a single line, a light anti-repetition penalty keeps one memory from reading like a stuck record, and a dimension-mismatch that used to degrade recall silently now logs an actionable warning.

Answer Confirmation

Before a character’s tool-using reply is saved, an optional cheap-LLM check can compare it against what the character was told this turn and what it looked up, and flag a reply that contradicts its own sources. A flagged reply is handed back to the character’s own model to either stand by or quietly amend, in scene, changing only the details that conflict with the facts. Each checked message wears a small badge — Vouched, Amended, Stood by, or Unvetted — that reveals the discrepancy on hover, and the affirmation pass now receives a compact transcript of the live conversation so an amendment corrects this scene rather than rewriting itself into some older exchange it read along the way. The feature is off by default, with per-project and per-chat overrides.

The Right to Pass

In genuine group scenes a character may now, on any turn but the first, decline to speak when it truly has nothing to add, and the Host notes the pass and moves the rotation along — no more filler for filler’s sake. A stall guard steps in when everyone has passed and forces the next speaker, so a scene can never talk itself to sleep. The same courtesy extends to you: the Skip button posts the same graceful note, and autonomous rooms honor the pass within their run budgets.

---

Documents, Everywhere You Left Them

Beyond keeping several documents open at once, 4.8 rounds out Document Mode in several directions. A standalone Document Mode button in the left rail opens files with no conversation attached — no Librarian announcements, no chat notified — for when you simply want to edit a document. Every open document shows its qtap:// address with a copy button, and those addresses are now clickable everywhere chat text surfaces them, including Staff announcements, opening text in Document Mode, images in the viewer, and warning politely on anything unsupported. Markdown files with YAML frontmatter now render that frontmatter as a tidy read-only “Document Info” table in rich mode instead of leaving raw --- fences in the editor, while source mode still shows the full bytes. And the recent-documents list finally stays honest when a file is renamed or opened without a chat.

One File, Two Places

A file linked into a second store with quilltap docs link did not, in point of fact, stay linked. Edit either side and the two forked apart without a word: the write pointed the edited link at a fresh revision while the other went on serving the old one indefinitely — to the file browser, to search, and to every character reading it. The link looked exactly like a link and behaved like a photocopy.

The cause was that a hard link had no representation of its own, and the tempting repair would have been worse than the bug. Content is stored by its hash, so byte-identical files share a row by coincidence — an empty file, a boilerplate header; one row in a real instance was shared by thirty-six character vaults — and propagating a write across everything sharing a row would have rewritten all thirty-six. Deliberate links are therefore now recorded as such. A write fans out to every member of the group and rebuilds each sibling’s search chunks so the index agrees with the disk. A copy deliberately does not join the group: a copy shares storage until the first write and then forks, which is precisely what a copy is for.

Links made before this release cannot be told apart from coincidence and so start ungrouped; re-make them with docs link and they become real. In the same pass, the orphaned revisions every content-addressed rewrite had been abandoning since the beginning are collected on the write path, and the migration sweeps up the backlog. The CLI’s links column counts group members now, so a boilerplate file stops reporting thirty-six links you never made.

Sub-Lists Survive the Editor

Open a document with nested bullets and the editor flattened them; save it and the flat version went back to disk, which is the sort of quiet vandalism one discovers three documents later. The Markdown bridge counted indentation in four-space units and resolved depth by division, so two-space nesting — what Prettier emits, what most models emit, what most hand-written Markdown uses — divided to zero and every child became a sibling. Import now resolves depth from the levels actually open, and export writes indentation back at the unit the document arrived in, so a two-space file stays a two-space file and editing one line no longer reflows every nested line in the diff. Code fences and YAML frontmatter are copied through untouched, a YAML sequence being indistinguishable from a bullet list to anything that is not paying attention.

There was also no way to create a sub-list, no key having claimed Tab and no button having offered. Tab and Shift+Tab now indent and outdent, the formatting toolbar gained a matching pair, and both are confined to list items — Tab outside a list still moves focus, and indenting a paragraph is refused outright rather than accepted and silently discarded on save, Markdown having no way to write it down. Nested lists also drew a doubled bullet on their first item, a wrapper element helpfully painting its parent’s marker beside the sub-list’s own; it now keeps its marker to itself.

The Container Can Reach Your Stores

A container sees only what was bound into it when it was made. Database-backed stores live in the data directory and ride along without being asked; filesystem and Obsidian stores point anywhere at all on the host, and inside the container they were simply absent — a fact the application concealed beautifully, since a store’s folder listing comes from the cached index in the database and therefore looked perfectly healthy while every operation touching a real byte failed.

The startup script now enumerates your filesystem stores before it creates the container and binds each at its own host path, so a store’s location means the same thing on both sides of the wall. It is a plan rather than a list: stores sharing a vault collapse to one bind, a store nested inside another is dropped rather than shadowing its parent’s view, and a path that does not exist is skipped and reported — Docker would otherwise create the missing source as an empty root-owned directory and present a hollow store as a sound one. New flags cover the awkward cases: --instance NAME resolves (and unlocks) an instance by name, --recreate replaces an existing container, and --no-store-mounts declines the whole business. Since binds are fixed at creation, running the script against a container that already exists now diffs its mounts against your current stores and names the ones it cannot reach. quilltap docs docker-mounts prints the same plan for a hand-assembled docker run. A failure to enumerate is never fatal: it warns and starts without store binds, exactly as before. Two arrangements only warn — a macOS path outside Docker Desktop’s shared folders, and a Linux user id that does not match the container’s — and one is refused outright, Windows host paths having no way to mean the same thing inside a Linux container.

In the same pass, creating a folder in a store whose base path is unreachable stopped being an adventure. The old code asked the filesystem to create the whole missing chain, which against an unmounted volume walked all the way up and tried to create /Users — reported to you as a bare “Failed to create folder,” and, on a host where the process could write that high, worse than an error: a folder made inside a fabricated tree that had nothing to do with your store, and called a success. Reachability is now established first, the answer distinguishes missing from denied from not-a-directory, and where the cause is a path never bound into a container the message says so and names the remedy.

---

Taking Up a Character’s Seat

Speaking as one of the house’s own characters — impersonation — worked, in the sense that the words came out under the right name, and was wrong in nearly every detail around that. This release settles it.

The mechanism itself was the root of it. Taking up a seat used to rewrite it, flipping the character from LLM-driven to user-driven and flipping it back when you stopped. That restore arm is the whole trouble with it: close the browser mid-scene and it never comes, leaving a character permanently yours to type for; hand the seat back and it might return under a different connection profile than it left with; and because the flip made the impersonated character the room’s first user-controlled seat, the house concluded she was you and hid her own Stop button. Impersonation is now a pure overlay: the fact that you have taken a seat is recorded, and the seat itself is never touched. The two places that need to know — who a message is from, and whose turn it is — consult the overlay, and everything else goes on reading the unaltered truth. (A seat left flipped by the old mechanism at upgrade time stays flipped; the overlay has nothing to restore, and a blind repair could not tell such a seat from one you genuinely own. Set it back in one click from the participant editor.)

With the mechanism right, the manners follow. Taking a character now hands her the current turn, which is what “I’ll take this one” plainly means, unless a model is already mid-sentence. When the rotation lands on any seat you drive, the composer defaults to speaking as that seat, so you no longer switch by hand into your own turn — though a deliberate choice made on the same turn still stands until the turn moves on. The turn banner recognizes an impersonated seat as yours and both announces it and offers to Skip, which it had never done, the banner having been reading the untouched column. The bubble you have just posted is authored correctly from its first paint rather than flickering to the wrong name and correcting itself. And “Stop impersonating” now reaches the server at all — the client had been asking politely with a verb the server had registered the action on the other side of.

Two more. Impersonation now survives a reload: the state had been in the database the entire time and simply omitted from the chat the server handed back, so refreshing the page showed you an ordinary AI seat and nothing to suggest otherwise. And a room in which you drive two seats now rotates fairly. With one model and two human characters the first responder after any of your posts was chosen from a model-only shortlist, so the single AI answered every one of your turns and took half the room instead of a third; the first response now honours the same rotation the rest of the chain does, and where the next speaker is another seat of yours, the chat saves your message and waits for you rather than making the model speak out of turn.

Beside all of this, a small and constant comfort: a portrait of the character you are presently speaking as now stands in the composer, at full height beside the action buttons, bright while the floor is yours and dimmed while a reply is in flight. It answers both questions — who am I, and may I type — without a word.

---

Merging Conversations

The Salon’s Organize sidebar gains a “Merge In…” button — the exact inverse of “Continue Elsewhere.” Rather than forking one conversation forward into a new one, it folds another conversation’s characters and summary into the current chat at its latest point. A confirm dialog lists the incoming cast with a per-character “who joins” checkbox and the usual starting-outfit options; on merge, each guest arrives as an LLM-driven participant, the Host posts a recap linking back to the source, and a back-link bubble is left in the source chat. Two threads become one without replaying a single turn.

---

Taking a Conversation With You

The same Organize sidebar gains an Export Markdown button, which writes a conversation out as a single readable file — the record of what was said, not a format for machines to trade. It carries the title, the opening scenario with its placeholders filled in, every spoken turn under its own ## Speaker — timestamp heading, Pascal’s roll announcements, Carina’s answers, the announcements you inserted yourself, the Host’s notices linking the chat to conversations it continues or has absorbed, and whispers, marked as whispers. It leaves out everything that was only ever machinery: system and tool messages, memory whispers, image announcements, time marks, and anything written to be read by a model rather than by a person. The timestamps are the conversation’s own — fictional time where the chat keeps a fictional calendar, in its own timezone and its chosen format. The same conversation exports to the same bytes every time.

---

The Archive Can Be Read Back

A release that opens its upgrade instructions by asking you to take a backup had better be able to restore one. This one could not, and now can.

Three faults sat on the restore path, each concealing the next. Every mount point and file link in an archive was refused on the way back in, because a backup records them in the database’s own storage types while the schema receiving them wanted proper lists and proper booleans; the refusals were logged one row at a time and the restore still announced success, with the damage surfacing later as unreachable character vaults and missing project and group stores. The lookup that finds a file’s bytes inside an archive was gated on a backup format two generations old, so no file was ever found. And the files were restored before the stores meant to receive them existed — an order that happened to work when restoring over a populated instance and failed precisely on the empty one a restore exists for. All three are repaired on the reading side, deliberately, so that archives you already hold are restorable rather than only archives made from here on.

A fourth and older fault turned up in the same pass: memories came back under new names. Every other entity kept its identity through a restore; memories alone were minted afresh — and since memories reference one another, the Commonplace Book returned as a heap of unconnected notes, every thread between them pointing at something that no longer existed, with no error and no warning. Memories now keep the identities they were backed up under.

And an import can now read Quilltap’s own export. A .qtap archive carrying a document-store attachment larger than three megabytes was written correctly and read back wrongly: the reader judged a multi-part attachment complete the moment its first part arrived, joined the absent remainder into nothing, and then failed outright when the rest of the bytes turned up with nowhere to go. Attachments of three megabytes and under were never affected, which is why this waited politely for somebody to attach something large.

A later pass over the same machinery closed four more, and the first of them explains a good deal. Deleting a document store was neither atomic nor complete: seven separate un-transacted operations in an order that had two of them reading a table an earlier one had already emptied, and one table nobody deleted at all. Every partial failure minted a permanent orphan — silent while it sat there, because a read connection keeps its constraints switched off, and fatal much later, when a backup carried the orphans into a restore where the constraints are live and the whole restore refused. The teardown is now a single transaction that rolls back whole, and a reaper clears the orphans already stranded on existing instances, once at boot and daily thereafter.

Wiping and restoring now clear conversation annotations, which had been on no delete path at all: annotations survived “delete all my data,” which is a privacy fault, and collided on a restore into a migrated instance, which is a loud one. Deleting a single conversation sweeps its annotations too, which nothing had been doing either. An overwrite import now knows which store it is overwriting — it had been matching by name, so renaming a store let an overwrite land on an unrelated one that had inherited the old name, while a create minted a fresh identity and thereby guaranteed no archive could ever be recognized again on a later import; an overwrite also cleared a store’s documents and left its folders standing, so the husks accumulated and complained on the next import. Imported documents had likewise been carrying their source instance’s folder pointers into a house where the folders were made afresh, leaving every one of them dangling — harmless only because listings resolve by path — and are now repointed onto the folders actually created. And a second-generation restore — a backup taken from an instance that was itself restored — no longer loses the archived link identities to a race with its own file replay, or duplicate its stores once per generation.

---

An Export Worth the Name

The .qtap export had been quietly writing the wrong thing, at spectacular length. A memory’s embedding is a typed array of floats, and the moment you ask JSON to write one down it becomes an object keyed by index — some thirty kilobytes per memory, of numbers. On a real corpus a characters export ran to 791 megabytes, of which about two and a half were the actual content. The remaining ninety-nine and seven-tenths percent was arithmetic nobody could use.

Because that is the second problem, and the worse one: a vector means nothing except against the model that produced it. Carry one into a corpus governed by a different embedding standard and, whenever the widths happen to agree, semantic search is silently poisoned with no error anywhere to say so. Exports no longer carry embeddings at all — the writer omits them, the reader discards them from archives already in the wild, and an import now re-embeds what it inserted against your own default profile rather than leaving the rows blank until some future restart noticed. (With no default profile set, or with the built-in embedder, the import says so and leaves the rows to the next boot’s reconcile.) One older import fault went with it: in a mixed archive, group-to-store links were resolved before the stores themselves had arrived, and were therefore dropped without a word.

Three export types — projects, groups, and document stores — could be written and never chosen; the machinery had supported them for some time and the picker simply never offered them. Five more join them: the general file library (folders, metadata, and the bytes themselves), prompt templates, provider models, plugin configurations, and instance settings. Fifteen types in all, and the list is now required to be exhaustive by construction, since silence is precisely what produced the omission. Compatibility runs forwards only: an archive of one of the new types cannot be read by an older build, which refuses it by name rather than pretending.

Two of the newcomers have teeth worth naming. Plugin configurations are redacted on the way out, always: a manifest may declare password-typed fields, which are perfectly reasonable in a local backup and entirely unreasonable in a file you hand to somebody else, so the exporter drops them and tells the import preview exactly what it removed. Where it cannot resolve a manifest it withholds the whole configuration rather than guessing. And because import merges rather than overwrites, a redacted key leaves the receiving instance’s own secret undisturbed. Instance settings travel as a whole minus a short, deliberately named list of keys that mean nothing anywhere else — the mount-point pointers, the maintenance clock, and the version guard, an imported value in which could lock a healthy instance out of its own database.

Backups gain an opt-in compact mode, which nulls memory embeddings and omits the six caches that exist only to be rebuilt. A compact archive says so in its manifest, and a restore from one queues the reindex that regenerates what it left behind. Full fidelity remains the default, and deliberately so: a backup exists to restore this instance, where the vectors are valid on arrival and re-embedding costs real money at precisely the moment you are least amused by an unexpected bill. Restoring also now runs the embedding reconcile at the end rather than waiting for the next boot to notice, and a plugin you had switched off no longer comes back switched on.

---

A Character May Be Packed Away

A house of any age accumulates residents who are not, at present, in residence. A character you played for eight months and have not opened since is still carrying her whole estate about with her: every letter she was sent, every summary of every conversation she was in, every photograph, and every memory she ever formed — all of it indexed, embedded, searched over, and paid for. 4.8 lets you archive her: pack the estate into a single sealed trunk in the file library, take it out of the working house, and leave the lady herself standing exactly where she was.

What Goes Into the Trunk, and What Stays Out of It

Archiving is deliberately not deletion, and it is deliberately not an export. What moves into the bundle and out of the instance is the heavy, private material: mail, conversation summaries, non-avatar photographs, the search chunks and embedding rows that indexed them, the vector store, and the character’s own memories. What stays is the character — her fields, her portrait and avatar overrides, her wardrobe, and every conversation she ever appeared in. An archived character still renders a full character page. Old messages keep their faces. Nothing is repointed, because nothing moved.

Each departure goes out through its proper door rather than by the window: vault links leave through the same chokepoint that collects orphaned content, memories through the one that first unpicks the threads between them, and folders emptied by the packing are removed while folders still sheltering something you kept are left standing. The trunk is written, sealed, and then verified by opening it again — character, memory count, vault contents and footer counts all checked against the house they came from — and only then is the character marked archived and the estate pruned. A failure anywhere before that mark deletes the bundle it had begun, so a failed attempt leaves no orphan behind. Run it twice and the second run does only the prune, which is idempotent by construction and re-lists afterwards to catch anything that quietly declined to go.

Archiving also sets her chat seats to absent, so turn rotation, speaker selection, and Carina’s probes stop offering a turn to somebody who has gone upstairs.

Bringing Them Back

Rehydration is the exact inverse, and it restores everything at its original identity. The bundle is fetched, decrypted, checked against the hash recorded when it was sealed, and imported with every id preserved: an id already living inside the character’s own vault is skipped, since the surviving row is by definition the right one, while an id found anywhere else refuses the whole import at once rather than half-restoring somebody over somebody else. Everything the prune removed lands back where it was, which is why nothing needs repointing and no reconciliation pass runs afterwards. Only then is the archived mark cleared, the absent seats made active again, restored documents re-chunked, and the embedding work queued.

If anything fails before that final clearing, the character simply stays archived with her trunk intact, and running it again picks up whatever has not yet made it home. The bundle remains in the library afterwards as a spare copy — a dialog offers to discard it, and both the toast and the CLI report what came back.

Because a pruned vault is still a live and writable one, what keeps an archived character from being edited back into existence is a ring of guards rather than a locked door. The repository sanctions exactly one edit on an archived character: the one that un-archives her. The document tools find no vault, the wardrobe refuses outright, and the shared name resolver no longer answers to an archived character’s name — a living namesake wins the name, while an exact id still resolves, so mail and Carina can refuse with “she is archived; rehydrate her” instead of a shrug. The conversation-summary bridge skips archived participants, since a fresh summary would quietly resurrect the very folder that was just packed. .qtap exports exclude archive bundles and the shelf they sit on, on the reasoning that an export carrying every trunk in the attic, base64-inflated, serves nobody. And deleting a bundle a still-archived character depends on is refused, because that copy is the only one there is.

The Trunk Is Sealed

Archive bundles live in files/, outside every encrypted database — which made them the one place an archived character’s mail, photographs, and personality sat in the clear. They are now encrypted with the same mechanism the database key file uses: PBKDF2-SHA256 at 600,000 iterations deriving an AES-256-GCM key from your instance passphrase, and deliberately not from the master pepper, which does not travel with a logical backup and would render every restored archive permanently unopenable. A small header carries the parameters and a key-verification hash, so a bundle sealed under a passphrase you have since changed is diagnosed as exactly that rather than as an inscrutable cryptographic failure.

Changing your passphrase therefore re-seals every archive bundle you hold, reporting progress as it goes; the change-passphrase card tells you up front how many trunks it is about to rewrite, and a partial failure names precisely which ones still hold the old passphrase rather than leaving you to guess. The CLI’s new characters export is the escape hatch that writes a plain, unencrypted .qtap for a character living or archived.

Where You Do It

In Aurora, a character’s page gains an Archive action whose confirmation dialog itemizes both columns — what is packed away (memories, mail, non-avatar photographs, summaries) against what stays (fields, portrait, wardrobe, chats, and other characters’ memories of her). An archived character’s page renders read-only behind a banner with a Rehydrate button, and the edit controls take themselves away. The roster hides archived characters by default behind a Show Archived toggle; shown, they sort last and wear a badge. Group member lists badge archived members and report “N members / M can speak,” and Salon participant cards badge an archived seat.

The character listing gained an archived=exclude|include|only parameter, defaulting to exclude, and it is the single gate every picker in the application passes through — so the chat, group, mail, image, and search dialogs simply stop offering somebody who is not here. Adding an archived character to a group or project roster is refused at the server, though edges that already existed survive; the export wizard likewise declines, on the grounds that the bundle already is the export.

The CLI grew four subcommands under db characters: archives lists archived characters and their bundles (flagging any loose one whose character is gone), archive and rehydrate proxy through the running server — which holds the export pipeline and the unlocked passphrase — and export writes a plaintext .qtap, decrypting an archived character’s bundle offline if need be. Tab completion knows all of them, and their flags.

What a Wipe Spares

Delete All Data and a replace-mode restore both now offer to keep archived-character bundles, and do so by default. What survives such a wipe is a loose trunk: importable through the ordinary character import, but not rehydratable, the character row it belonged to having gone with everything else. Because the trunks are sealed under your passphrase rather than under anything inside the databases being erased, a kept bundle stays openable afterwards. Both dialogs say so in as many words, the delete preview counts the bundles on hand, and the summary reports how many were kept. (Two small defects in that dialog went in the same pass: the “Total Items” line had been reading NaN, and the dialog had no scroll of its own, so on a short window its buttons sat below the horizon.)

The Faults Found on the Way

Archiving is only as good as the export beneath it, and building it turned up several years’ worth of quiet damage there.

A characters export had never carried the character’s vault at all — only the row, the wardrobe, the plugin data, and the memories. Since a character’s portrait and avatar overrides are pointers into that vault, every cross-instance character import had been arriving faceless, with no photographs and no mail, and nothing anywhere to say so. Exports now carry the whole vault, and an import repoints the face onto the rows it actually created. An override that cannot be repointed is dropped rather than written broken. Since a vault is not a small thing to carry, the export wizard’s options step now tells you what it adds — stores, documents, images, and an estimated size — before you commit to it.

Startup reconciliation, which does not otherwise know that archive bundles exist, had been stripping their shelf folder on every boot, and could permanently delete the row of a bundle whose bytes were not on hand — a cloud-evicted file, most plausibly — because the references it consulted read only avatar fields. It now leaves archive and backup shelves alone and honours the pointer that matters, and the file watcher no longer adopts a freshly-written bundle as a stray document, the row now being written with its address before the bytes arrive at it.

Two refusals had made whole classes of character impossible to bring back — they packed away perfectly well, which is the worse arrangement of the two. A character who had ever been in a group chat could not be rehydrated, because a conversation summary written into every participant’s vault is one row with many links, and the preflight read “not linked here” as “belongs to somebody else”; content-addressed rows are now settled by their hash, so an identical row is recognized as identical and a genuine clash still refuses. And a character whose vault held the same bytes at two paths — which is what an ordinary content-addressed save produces the second time you file the same picture — could not be rehydrated either, the repeated claim being treated as a collision with itself. Both are reader-side repairs, so bundles you already hold rehydrate correctly against the fixed reader.

Two smaller ones, for completeness. A file whose bytes have gone missing now answers a plain 404 instead of a 500, which is the difference between “there is nothing here” and “this house is on fire” — the latter having been logged at error level on every render of a long-dead avatar, burying real storage faults underneath. And the Archive button, alone among its siblings, had been rendering in the muted grey that every disabled control in the application wears, so the one action that packs a character away read as unavailable.

Finally — and reaching well beyond the archive — everything the house embeds now embeds under one profile. A rehydrated or imported character’s memories used to arrive unembedded and stay that way, invisible to semantic search until something unrelated happened to trigger a reindex, because the import declined to queue the work whenever the default profile was the built-in one. It now queues regardless, and on the built-in embedder additionally refits the vocabulary against the corpus that has just grown, healing any row embedded before that vocabulary first existed. Four further paths — the document-store chunk scheduler, the scoped store reindex, conversation chunks after a render, and the Scriptorium’s cold-chunk re-embed — had been falling back to “whichever profile sorts first” whenever no default was marked; they now use the marked default or decline, since embedding under an arbitrary profile silently mixes two geometries and tells nobody.

---

The Almanack

The capabilities report was last rebuilt in March, when it was an accurate portrait of a 4.0 instance. Everything since — character content, wardrobe, custom tools, photographs, mail, scenarios — has moved into the mount-index database, a book the report had never once opened. It is now The Almanack, and it has been taught to read the whole house.

It gained a Scriptorium section, which is a considerable admission: document-store blobs are the largest single consumer of disk in a mature instance and had been entirely absent from the accounting. The Almanack now reports stores by kind, wedged scans and conversions, blobs by type, hard-link groups and the deduplication they buy, character-vault health, wardrobe by tier, the Post Office, photograph albums, scenarios, the state cascade, and Pascal’s Workbench inventory including the definitions that failed to parse — which is the number you actually want, since a recipe that silently refuses to load is the one you will spend an evening looking for. Alongside it, a dramatis personae — the ten busiest characters, every project, every group with its members by name — and a much-expanded wire records section covering requests by type, per-profile usage with average and median latency, and prompt-cache hits and misses by provider and by profile.

Generating it now shows a progress bar that names the phase it is in, and buffers, so you may collapse the card mid-run and reopen it without losing your place.

Three of its ledgers were later found to be reporting fiction, all in the same quiet direction. The embedding census counted failures under a status the system can never hold, so the cell was structurally zero forever; it now counts the real terminal state and says plainly that a failure is permanent only for the profile currently in force. The “cast sizes” histogram grouped by the raw list of participants rather than by how many there were, so every distinct cast was its own row and no histogram emerged at all. And the wardrobe-permission counts asked who had explicitly been granted permission, where the house’s actual rule is that silence means yes — so every character in the default state went uncounted. All three now report what the running system does.

Several genuine faults surfaced in the writing of it. A freshly generated report’s Download link 404’d every time, because the report announced one identity and was filed under another. Memory counting ran one query per character. Custom tools were filed under Pascal’s dice, which is a different subsystem wearing a similar hat. Database security and backup status both believed the instance had two databases when it has three. And most consequentially: the lifetime and windowed token-usage figures had always returned zero — a filter that reads != NULL in SQL, which is not false but unknown, and therefore matches nothing, ever. That is the long-standing “0 tokens logged” reading, finally traced. In the same pass the logs learned which connection and image profile served each request, and the great many call sites that had never recorded how long a request took — the entire shared cheap-LLM path among them, and the character optimizer, which wrote a hardcoded zero and thereby poisoned every average taken over the column — now measure. Where a figure is estimated from older rows the Almanack says so, and every latency prints the count it was averaged over.

---

A New Generation of Models

The newest model family — claude-sonnet-5, Opus 4.7 and 4.8, Fable 5, and Mythos 5 — changed the rules underneath the Anthropic plugin twice over, and both breaks are now handled. These models reject sampling parameters outright, so temperature, top_p, and top_k are omitted for them entirely; and they replaced fixed-budget extended thinking with an adaptive mode that must additionally ask for a summarized display, or the thinking blocks come back present but empty. The plugin now detects the family by id and does both, so these models chat, and think visibly, again.

Elsewhere on the provider bench, the Z.AI plugin gained a Reasoning Effort option, and glm-5.2 — which thinks compulsorily — now defaults to high instead of the API’s most expensive max, curbing runaway thinking-token spend out of the box. And a broad, overdue fix: every text-LLM call in the codebase now forwards its profile’s provider parameters, so a reasoning model set to “thinking disabled” is actually told so, instead of silently burning its whole completion budget on hidden reasoning and returning a blank.

OpenRouter, for its part, had not been discovering image or embedding models at all — not since its library began serving that catalogue a page at a time. Three of the four places that asked for the list were still asking the old way, got nothing, and fell back to a short built-in roster while reporting what looked for all the world like an empty answer from the far end. All of them now turn the pages, and an OpenRouter profile offers the models it actually has.

A cluster of attachment and streaming faults went in the same pass, most of them the kind that fail in one direction only and are therefore very hard to see. OpenRouter sent no image on the non-streaming path — a regenerate or a continuation — because its library rejected the picture at the door on the way out, in a spelling disagreement nothing surfaced; streaming had been fine the whole time, which is precisely why the fault survived. The client was also declining to offer attachments on OpenRouter profiles while the plugin was busy emitting them. Grok’s text and PDF branches were dead code, sitting behind an images-only gate that refused them before either branch could be reached; a text attachment now goes through inline, while PDFs reach the branch that has always said it wants Grok’s Files API — support for which remains, honestly, still to come. A text file with no line breaks could arrive as mojibake, having been decoded as base64 on the strength of looking a little like base64 — a decode that never fails, merely mangles; it is now round-tripped and compared, and a mismatch ships the text verbatim. And Ollama could lose part of a reply: the stream was split on line breaks with no memory between reads, so any message unlucky enough to straddle two of them vanished without trace.

---

When the Far End Goes Quiet

A turn could sit on “Recalling Amy’s memories…” for ten minutes — no log output, no processor use, nothing wrong on your machine at all. The far end had accepted the request and then said nothing, and provider libraries wait a full ten minutes before they will admit as much. One silent call was measured at 622,451 milliseconds for a memory recap whose healthy runtime is about nine seconds, and it left no record whatsoever, because a call is written into the log when it finishes.

Requests are now bounded at three heights. Each background call gets a wall-clock allowance — forty-five seconds against a remote provider, three minutes against a local one, where a cold model being loaded is slow rather than stalled — and exceeding it degrades through the failure path the house already had, with a line in the log naming the provider, the model, the task and the elapsed time. The memory recap, which makes two calls in sequence, gets its own minute-long ceiling above that, on the reasoning that a recap slow in two places is still merely slow and the recap is optional besides. And all nine text providers now accept a hard per-request budget they may not retry past, so a stalled request is dropped at the socket rather than left quietly running while the house walks away from it. Streaming answers are treated with care: where a provider’s timeout would bound the whole response rather than the wait for its first word, no default is imposed, because truncating a long reply to cure a stall would be a poor trade.

One honest limitation. An abandoned request is not cancelled — nothing at that layer can cancel it. It runs to completion, it is billed, and its answer is thrown away. What stops is the waiting, which was the part holding up your turn.

---

Starting a Conversation

The Green Room

Starting a fresh conversation quietly does a great deal of slow work before the first line appears — resolving the cast, running a per-character “choose what to wear” step, compiling identity stacks, seeding the opening scene — and until now the app simply sat there while it happened. A blocking status dialog, the Green Room, now appears the moment creation begins: a live status line, a “consulting the wardrobe for Name” panel that resolves into each character’s decided outfit, and a scrolling activity log beneath. It closes itself when the conversation is ready, and only offers a Close button if something has gone wrong. The progress rides a side channel, so the creation request returns its JSON exactly as before.

The Cast, and What They Are Wearing

The New Chat dialog used to hand every character in the cast the same blanket answer to the question of what to wear, which is not how anybody actually dresses. Each character now arrives at the dialog with the starting outfit that suits their own circumstances: a continuing conversation still dresses everyone as they were when you left off; a character run by an LLM who has been trusted to choose for themselves is set to do exactly that; and anyone else is set to their defaults only if they genuinely have a usable default outfit, and otherwise opens with the compose panel already unfolded, on the reasoning that a wardrobe with nothing marked as usual is a wardrobe wanting a decision. Whether a character may dress themselves is now a checkbox on their Wardrobe tab in Aurora, saved to their vault the moment you tick it. And because a collapsed panel that hides its own setting is a small daily annoyance, each character’s Starting Outfit header now states the choice — Defaults, Composed, Dress Themselves, Undressed, Same as Last — beside the name.

The character picker in the same dialog now shows every character, including the personas marked as yours to play, which it had been quietly withholding from the list. Its counterpart, “Play As,” now offers only characters who are actually in the cast — add the persona first, then take up their seat — and handing a character back with “Chat as yourself” leaves them in the scene under LLM control rather than showing them the door.

The Shared Wardrobe Finally Reaches the Dressing Room

The wardrobe has three tiers — a character’s own vault, the project’s linked stores, and the singleton General store — and everything in the application merged all three except the one place it mattered most. The two server paths that dress characters at the start of a conversation read the character’s vault and nothing else, which had three consequences and one very peculiar fourth. A character asked to choose their own outfit could not see a shared garment, and one whose entire wardrobe was shared was never asked at all — the house found an empty rail and quietly reached for defaults. The composer decided “has a usable default” over the merged list while the server resolved it from the vault, so a dialog reading “Use defaults” could open a scene with the character wearing nothing whatsoever. And the preview panel rendered project-tier garments with no title at all.

All three tiers now dress. An item marked as a default in any of them equips: a General default dresses everyone everywhere, a project default dresses everyone in that project’s conversations, and personal and shared defaults layer in the same slot rather than one evicting the other, oldest first. The character’s own tier still shadows on a collision, which is how a character opts out of a shared default — keep a personal copy of the item and mark it not-default. The fourth consequence, which had to be repaired before any of this was visible: a shared composite garment — a House Livery bundling coat, waistcoat and boots — resolved to nothing at all, its components being sought in a vault they did not live in. That produced a blank preview, an empty announcement, and an avatar prompt convinced the character was bare to the waist. A composite now hydrates its components from whichever tier it is equipped from. (A composite whose components live in a different tier from the composite itself is still not resolved, and remains on the list.)

The Wardrobe No Longer Keeps the Room Waiting

Opening one conversation took two minutes and thirty-two seconds, and the reason was that the characters were being asked what to wear one at a time. Each consult is a network round trip; a single provider that took 2m32s to produce nineteen tokens held the entire cast behind one character while the rest waited their turn. The consults now run concurrently and are written down in order afterwards — the resolving is parallel, the persisting is not, because the record of who is wearing what is read, amended and written back as a whole and concurrent writers would erase one another. A consult that has not answered inside sixty seconds is abandoned and that character wears their defaults; the abandoned request will still be billed, the house having no way to call it back.

And a character may now be deliberately unclothed. The model’s only means of saying so had been to return every slot empty, which is also exactly what a model that has simply failed returns — so the safe reading, that an empty answer means “fall back to defaults”, made deliberate nudity inexpressible. The prompt now asks for the choice to be flagged as deliberate, and only a genuine flag counts. This was not hypothetical: a character whose manifesto describes it as an alien with no humanoid anatomy to dress, asked what to wear in a scene with no setting, answered with every slot empty and was overruled into its defaults. It was, arguably, right, and had no way to say so.

Choosing the Roleplay Template Before You Begin

The New Chat form — page and modal both — now carries a Roleplay Template dropdown beneath Play As. The template had always been decided silently at creation, inherited from the project and then from your global default, and could only be seen or changed afterwards from the chat sidebar. The control is pre-selected with exactly what the conversation would otherwise have received, marked (default) so an override is visible as an override, and it is hidden entirely when you have no templates. Reloading the form’s reference data — adding a character, switching projects — re-seeds the default only until you have chosen by hand, so a deliberate pick is never silently replaced. One pre-existing wrinkle is unchanged and worth knowing: “No Template” is stored as nothing at all, and nothing at all is indistinguishable from never having been asked, so the default is inherited again on the first turn — exactly as it behaves when you choose “No Template” from the chat sidebar today.

---

A Lighter Database

Three coordinated changes shrink the main database without discarding anything needed to re-read a conversation or re-run memory extraction — message text, attachments, memories, and summaries are never touched. A configurable stale-chat retention window (default thirty days) lets a daily sweep NULL out the regenerable caches on chats no one has played in a while, and cold-tier conversation embeddings are dropped and lazily rebuilt when you next open the chat. Most consequentially, embedding vectors now store in a self-describing int8-quantized format roughly four times smaller than raw Float32, with legacy blobs still readable forever. A one-time migration re-packs your existing vectors; because quantization is one-way, this is the release to take a backup before, and to run npx quilltap db optimize after to actually reclaim the freed pages.

That economy went badly wrong before it went right, and the repairs are worth naming because every one of them was a bill. The house had not been keeping one embedding standard; it had been keeping several at once and mentioning it to nobody. Changing the default embedding profile — to another provider, or to a model of a different width — never re-embedded anything, and a vector of the wrong width is silently passed over by every search, so an instance could carry the greater part of its Commonplace Book in one geometry, search it in another, and be told nothing whatsoever. Choosing a new default now invalidates and re-embeds, and every startup measures the stored vectors against the standard of the day and mends what it can reach. Meanwhile the startup pass that heals half-embedded conversations had been reading a deliberately cold-tiered chat as damage, re-embedding the entire cold tier on every boot for the nightly sweep to discard again — an expensive disagreement between two subsystems, conducted entirely at the keeper’s expense. The two now agree on what an empty cache means; a chat you merely open stays warm for a full retention window from the visit rather than being cooled the same night; and a passage too long ever to be embedded is recorded as such once, instead of being offered up hopefully at every restart.

Two further gaps in that accounting closed late. A long exchange was rendered into one enormous search chunk — comfortably under the transport limit and comfortably over what an embedding model will read — so it failed deterministically, was marked failed, and stayed unsearchable forever; one measured instance carried five hundred and fifteen of them. Long interchanges are now split at message, paragraph, and sentence boundaries into chunks an embedder can actually accept, and a single boot pass re-renders the cohort already stranded. The startup pass that checks stored vectors against the standard of the day had also been counting document-store chunks in the wrong database and therefore finding none, ever, so mismatched store chunks were never queued for repair on their own account. And where the memory gate had just drawn threads between a new memory and its relations, the pass that follows immediately behind it was reading the memory as it stood a moment before those threads existed and overwriting them with the emptiness it found.

---

Wardrobe, Images, and the Small Comforts

Wardrobe items gained Move and Copy actions across General, projects, groups, and character wardrobes, and the character-scoped delete that always failed with “not found” — a casualty of wardrobe storage moving to the vault — works again. A character with a bare upper body can finally get an avatar generated on a SFW image provider: the portrait now crops tight at the collarbone and drops the wording that tripped content moderation, keeping the bare chest out of frame rather than out of luck. And a character on a non-vision model no longer blocks its reply for minutes describing a freshly generated image — Quilltap already knows the prompt that produced its own images and now reuses it, taking the whole vision round-trip off the reply path.

The quill that rocks while you wait for a reply has been rebuilt as a themeable icon, which it never was: a theme may now swap the glyph, retune the motion, or replace the animation outright. In passing it acquired three graces it had been missing — it takes the colour of the text around it rather than sitting there in fixed livery, it pivots on its nib so the feather swings above a still point instead of wobbling about its middle, and it holds its peace for anyone who has asked their system to reduce motion. Madman’s Box is the first theme to take up the invitation, and sets its own quill turning slowly through a full revolution. That theme also stopped shouting: its headings now render in true small capitals rather than flattening every name into a telegram — “Charles Sebold” is once again distinguishable from “CHARLES SEBOLD” — and its buttons, which had been uppercasing exactly those few that happened to be real <button> elements and leaving their neighbours alone, now agree with one another and render their labels as written.

---

Under the Floorboards

Editing or deleting a message no longer scans every message in every chat you own — a single edit on a large instance could take many seconds or time out — and now does an indexed lookup and touches only the one affected row, which also closes a latent path that could silently drop a separately-corrupted message. The persisted workspace layout no longer throws away your entire tab arrangement because one tab had a kind it did not recognize; a stray tab now drops only itself. A long-standing embedding-corruption bug — the real source of the “legacy” JSON-text embeddings that kept coming back — was traced to an unregistered blob column on help_docs minting them on every write, and fixed at the root. The Help Guide, which had gone entirely un-browseable when help docs moved into the database, works again, and the sync that feeds it now adds, prunes, and embeds docs in step. Roleplay templates that tag lines with a speaker prefix no longer collapse every paragraph into one run. Token-budgeted autonomous rooms now pace their spend across a whole run instead of exhausting it in a turn or two. And Lexical editors paint solid backgrounds, stopped auto-escaping your markdown punctuation on save, and the app footer stays opaque on the Home page.

A late sweep closed several more, each of them a small piece of quiet vandalism. A corrupt properties.json in a character’s vault no longer overwrites six of her fields with defaults and reports success — a file that exists and will not be read is now a loud failure naming the file, matching the vault’s own refusal to serve a hollow character. A help file containing nothing but whitespace no longer empties the entire help table: an all-blank help set against a populated table is treated as suspicious rather than as an instruction. A document store that had only ever held documents — a restore from an old backup, most likely — threw on the second write to any path, reaching for a table that is created only when a store first holds an image. A file hard-linked into two places updated both sides’ content but rebuilt only one side’s search index, so the other location went on serving the previous revision to search and to every character reading it. A .md, .txt, or .json file put into a database-backed store could be listed by the library picker and not attached, the attach path having insisted on an image where those files are held as text. And the thumbnail cache was a cache that only ever grew: nothing had ever reaped a thumbnail whose source file left by any route other than an in-app delete. It is swept daily now, and regenerated on demand, so the deletion is always safe.

The About page also got its background back. It had been painting through the per-view layer that the tabbed workspace deliberately suppresses in favour of one arbitrated backdrop — and About, unlike the Salon, never reported to it, so the image simply vanished the moment About became a tab.

Three further repairs from real instances. A project could lose its entire settings bag — its colour, its icon, its default image profile, whether the Lantern announces the backgrounds it paints — to one transient failure to read one file, because the reader treated unreadable and not written yet as the same answer and seeded fresh defaults over the top; a file that exists and will not be read is now an error rather than an invitation to begin again. PDF preview had been failing on every document since a hand-copied worker file drifted a version behind the library that loads it, and reported the mismatch as a suggestion to download the file instead; the copy is now kept in step automatically. And the terminal moved to a new major version of its emulator, which had quietly renamed the key all six bundled themes use to colour a selection — the highlight would have vanished from every theme at once, without a word — while a session that had exited went on accepting typing, guarded by a field that exists in no version of the thing it was guarding.

---

Selected Fixes

Tools now accept a number the model quoted as a string ("6" for 6) across all twenty-eight numeric arguments, while still rejecting the nonsense a blanket coercion would have waved through. Dice notation finally honors its modifier — 3d6+2 used to roll the dice and throw the +2 away. Regenerate replaces a reply in place, keeps the right character’s name and avatar, and runs through the real context engine instead of a stripped-down prompt. “Speaking As” is honored when you control more than one character, so a message you type is attributed to the character you are actually playing. Any participant, including your own seat, can now be switched between user-typed and an LLM from its card. And a character nudged to speak is now a permanent Host announcement in the transcript rather than a client-only note that vanished on reload.

Two settings in the Aurora character editor — Self-Dressing and Outfit Creation — had been accepting your instruction, thanking you for it with a cheerful success message, and then discarding it entirely on the way to the database, which is the most exasperating class of bug there is. Both now save, and their third state (inherit the global default) is preserved as it always should have been.

Docker containers now keep local time. A container honoured its configured timezone when printing a timestamp and nowhere else, so several subsystems that consult the clock directly went on living in Greenwich: an autonomous room scheduled for seven in the morning fired at two, daily token budgets rolled over at UTC midnight, and “today” and “yesterday” in episodic recall were offset by however far you live from the meridian. The container now applies the zone to the process clock itself, and the three startup scripts detect the host’s own zone and pass it along, since a setting nothing sets is not a setting. An explicit choice always wins; detection only fills the silence. In passing: start-quilltap.sh --help printed a sed error instead of help on macOS, and the PowerShell launcher’s Ollama probe could block for twenty seconds or more on a host that drops a connection rather than refusing it — it is bounded now, and no longer abandons a socket every time it misses.

Four chat settings stopped forgetting themselves. The Story’s Clock, the Lantern’s image announcements, thinking display, and the answer-confirmation override all saved correctly to the database and were then omitted from what the server handed back, so the control snapped to its default before your eyes and a reload never showed the truth. All four are returned now. In the same family: changing who controls a participant recompiles the identity stacks that depend on it rather than returning early and leaving them stale; removing an impersonated participant hands back state taken after the cleanup rather than before it; the “tools are disabled by this profile” warning can now appear at all, the field it tested for never having been sent; and an all-LLM room that pauses itself at its turn threshold now says so with a dialog, instead of simply stopping and leaving you to wonder.

Three attribution faults in the transcript. A Staff-signed announcement reached the models as an anonymous block of text — the very thing announcement attribution exists to abolish — because attribution keyed on a field that mode does not write; it now falls back to the Staff member’s own name. A tool you ran yourself from the composer wore the last speaker’s face, the renderer having borrowed a portrait from the nearest preceding character because the tool’s row is written before your own message; a run of yours now wears yours. And a private run whispered to you announced itself as “whispered to unknown,” your own identity not being a participant identity; it now says “you.”

The Brahma Console’s turn budget is yours to set. It had been a hardcoded twenty-five, which a deep search through the database could exhaust mid-investigation; Settings → Chat now carries a field for it (five to two hundred) and the default is raised to fifty. Exhausting it also no longer ends in silence: a run whose last turn was spent on another tool call used to save nothing at all and leave the client waiting on an answer that was never coming, after an expensive investigation. It now salvages what it found and says that it reached its budget. The separate guard against a model repeating the same query is unchanged, so a genuine loop still stops early regardless of how generous the budget is.

A short round of visible polish. Inline error text renders in the error colour, the class having been referenced everywhere and defined nowhere, so “Connection lost…” had been arriving in ordinary body text. The toolbar’s search dialog closes on an outside click — its backdrop had been resolving against the toolbar rather than the viewport, leaving nothing outside it to click and only Esc to escape by. A download whose name contains an apostrophe and a non-ASCII character keeps its real name rather than being underscored into submission, the apostrophe being the delimiter of the very field it sat in. And toasts animate on entry, the animation having named keyframes that did not exist.

The Salon’s message list also stopped complaining to the console. It handed each row’s measurement to React at a moment when React forbids the very correction the measurement was asking for, so the error was logged, the correction was downgraded, and the whole exchange bought nothing. Measurement now runs a beat later — after the commit and before the paint — so the scroll correction actually lands, in the same frame, and quietly.

---

Upgrading from 4.7

The database migrations handle themselves on first startup, but 4.8 contains a one-way data transformation and several backfills, so treat this as more than a schema bump.

Before upgrading, take a current backup:

npx quilltap db backup

The most consequential migration is quantize-embeddings-v1, which re-packs your embedding vectors into the smaller int8 format. It is idempotent, resumable, and progress-reported — but quantization is one-way, and exact Float32 recovery would require re-embedding, which is why the backup above matters here specifically. After the upgrade, run npx quilltap db optimize with the server stopped to actually shrink the file and reclaim the freed pages.

One further cost is worth expecting. Because 4.8 now insists on a single embedding standard, the first restart after upgrading will queue a re-embed of every stored vector that does not match the profile you presently have set as your default. On an instance that changed embedding providers at some point without re-embedding — which, until this release, was every instance that changed embedding providers — that can be tens of thousands of rows: a one-time charge of cents to a few dollars at current embedding prices, and then never again. Instances on the built-in embedder are unaffected, and nothing about it needs your attention beyond knowing why the first boot is busy.

Several other migrations run automatically: the general and group state tiers (the general state.json is seeded idempotently at startup and never heals edited content), the turn-skipping field, the answer-confirmation columns, and Pascal’s pascalMeta roll record. Two more arrive late in the cycle. add-llm-logs-profile-columns-v1 teaches the request log which connection and image profile served each call; older rows fall back to a best guess, and the Almanack labels any figure so derived as approximate. add-doc-mount-link-groups-v1 gives hard links between document stores a representation of their own and sweeps up the orphaned revisions every content-addressed rewrite has been abandoning since the feature existed. It deliberately does not backfill: a link made before this release is indistinguishable from two files that merely happen to hold identical bytes, so existing links start ungrouped and become real the moment you re-make them with quilltap docs link.

Two further backfills arrive with the work on memory and time. add-episodic-memory-fields-v1 adds the episodic columns, indexes event time, and gives every existing memory an event time taken from the message it was drawn from — falling back to the memory’s own creation date where there is nothing better — so your existing Commonplace Book joins the new timeline rather than sitting outside it. anchor-fictional-clock-base-v1 repairs the stopped fictional clocks described above, anchoring each affected conversation to the moment its base was chosen so story time resumes where 1:1 tracking would have carried it rather than jumping. It touches only conversations that have fictional time switched on, a base set, and no anchor yet; anything it cannot parse it leaves alone rather than rewriting. Both are safe to run more than once. A document-store repair pass runs at every startup — not just once — to catch case-insensitive name and path collisions in database-backed vaults, renaming the newer of any colliding pair with a (2) suffix and logging it; store names are likewise made unique case-insensitively. Every already-linked character vault is backfilled with an empty metadata.json if it lacks one (an existence check, never a parse, so a file holding invalid JSON is never “healed” away). Custom tools are file-based and need no migration — drop a Tools/*.tool.json into any store and it is live on the next turn.

The tabbed workspace is now the default. Old routes and bookmarks redirect into it and open the tab you asked for; if you need the former per-page surfaces back, set NEXT_PUBLIC_WORKSPACE_TABS=0.

The system prompt’s structure changed this cycle, so provider-side prompt caches go cold exactly once on first use after the upgrade and warm again immediately. Nothing needs doing; the first turn on each character is merely a little dearer than the second.

The character archive adds its own columns to the character table, and needs nothing of you beyond knowing they are there. Worth knowing before you archive anybody: an archive bundle is sealed with your instance passphrase, so a bundle sealed before a passphrase change is re-sealed by the change itself — and a bundle carried off to another machine, or restored beside a passphrase it has never met, opens only with the passphrase it was sealed under. quilltap db characters export writes a plaintext copy for anything that must travel.

Docker users with filesystem document stores should re-create their container. Binds are fixed when a container is made, so a store bound in by the new startup script requires a fresh container: run the script with --recreate. Run against an existing container it will tell you which of your stores it cannot reach rather than leaving you to discover it a byte at a time. Windows hosts are the exception and are told so plainly — a Windows path cannot mean the same thing inside a Linux container — so a filesystem store there still wants a database-backed store or a different arrangement entirely.

Docker users should now set a timezone. Containers apply TZ (or QUILLTAP_TIMEZONE, which wins where the two disagree) to the process clock, not merely to printed timestamps, so scheduled autonomous rooms, daily budget rollover, and “today”/“yesterday” recall all keep your local calendar rather than Greenwich’s. The bundled startup scripts detect the host’s zone and pass it for you; a container started by hand with neither variable set still runs on UTC, exactly as before.

Node.js 24+ is still required, unchanged from 4.7.

---

Installation

Electron Desktop App

Download the latest .dmg (macOS), .exe (Windows), or .AppImage (Linux) from the quilltap-shell releases page.

npm (Node 24 required)

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~127 MB and caches locally — appreciably less than 4.7 asked for, the bundled plugins having stopped carrying dependency trees that were already baked into them.

Docker

docker pull foundry9/quilltap:4.8.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

Standalone Tarball

Available for environments where npm global installs and Docker are both impractical. See the GitHub releases page for download links.

---

The house is the same house, but you are no longer confined to one of its rooms at a time. A conversation can stream in the left pane while you edit a document in the right; a terminal can sit beside the chat that spawned it; the whole building is a wall of tabs that never unmount behind you. A croupier keeps a table in the parlor now, his dice are honest — rolled where no one at the table can palm them — and what they turn up is written into the ledgers rather than merely read aloud. The residents keep their affairs in four registers instead of two, the Commonplace Book hands over the apt memory rather than the loud one — and can now tell you when and where the thing happened, which is most of what remembering is — a character may keep its peace when it has nothing to add, an aside may be meant for one ear, there is a short list of things nobody here will say, and every equation in the house finally renders as an equation.

A resident who has gone quiet may be packed into a sealed trunk and set in the library, the house lighter for it and her chair still by the fire; open the trunk again and she picks up mid-sentence, with every letter she was ever sent and every memory she ever formed exactly where she left them.

4.7 let the residents find one another. 4.8 lets you stand among all of their rooms at once — and deals you into the game.

— Ariadne, for the Bureau, August 11, 2026

4.6 made the house inhabitable — characters became their vaults, the private rooms ran themselves when no one was watching. What 4.6 did not give them was a way to reach one another across the rooms, or a way for the keeper to interrogate the whole building at once, or a Commonplace Book that fetched the memory you actually meant.

4.7 is the release in which the house becomes a society — and the keeper gets a master key.

---

Where 4.6 furnished the rooms, 4.7 wires the corridors between them and hands the keeper a panel that sees into every one. Three large bodies of work define the cycle: a postal service and a set of social affordances that let characters address each other directly; the Brahma Console, an operator-grade chat with read-only SQL into all three databases; and a Commonplace Book overhaul that mirrors every conversation into each character’s vault and reorders recall around relevance, not just importance. Around those, the Scriptorium learned discretion — per-document flags that decide what a character may read, write, or have embedded — and a long, honest sweep of plumbing closed the gap between what the model can do and what it can see itself doing.

The thesis is simple: 4.6 made it worth living in. 4.7 made the residents able to find, address, and remember one another — and gave the person holding the keys a way to ask the house anything.

---

The House Learns to Correspond

The Post Office

The largest new social feature in 4.7 is the Post Office: characters can now send and receive Markdown letters, delivered by Suparṇā — a new personified Staff member — and stored in each character’s Mail/ vault folder.

Two new always-available character tools carry the mail. send_mail writes a letter to another character (anyone may write to anyone), and list_email lists a character’s own mailbox with the exact calls to read, answer, or discard each letter. Reading and deleting reuse the existing doc_* tools; replying threads through send_mail’s in_reply_to. A delivered letter lands as Mail/<epochMillis>-from-<sender-slug>.md in the recipient’s vault, with the delivery system owning the frontmatter (from, fromCharacterId, sentAt, alerted, inReplyTo) and the sender writing only the body. After each turn’s Commonplace Book whisper, the Post Office checks the responding character’s mailbox; any unannounced letters trigger a Suparṇā whisper that reads each one aloud, names the sender and date, and flips the letter’s alerted flag.

Mail addressed to a character you play now surfaces too. A letter delivered to a controlledBy: 'user' participant used to sit in its vault unannounced forever, because the delivery whisper only fired during an LLM character’s turn. It now appears the moment you open the chat and within a turn if it arrives mid-session — rendered expanded by default rather than collapsed into a chip, because a letter to your own character is significant.

And you can send mail by hand. A Compose Mail button in the Salon composer gutter (an envelope, “Post a letter”) opens a dialog where the operator posts a letter as one of their player-characters to any character in the workspace — even one not in the scene — optionally quoting a letter from the sender’s mailbox. The UI delivers through the same Post Office service the send_mail tool uses, so the two stay in lockstep, and Suparṇā joins the Insert Announcement “Staff” list so you can post in her voice.

Summon from Lore, and Cleaner Walk-Ons

The Salon’s Add Character dialog gained a Summon from Lore button that opens the Aurora AI-import wizard inside the Salon; on success the summoned character is preselected so you finish the add through the normal controls. In the same pass, the “Create Ad-hoc NPC” dialog stopped silently discarding two fields — every NPC had been losing its Scenario and Physical Description because the dialog sent payload keys the server schema rejected. Both now persist.

The “Play As” controls were unified, too. The Play As (Optional) dropdown on New Chat and “Continue Elsewhere” now offers every character already in the chat, not only those whose default is user-controlled; choosing one switches that participant to controlledBy: 'user' in place. When any user-controlled participant is present, the “Make this an autonomous room” toggle is disabled with an explanation.

---

The Keeper Gets a Console

The Brahma Console

The Brahma Console is a second floating chat surface, sibling to the Help Chat, reached from a new tetra-radial console icon in the sidebar footer. Unlike the Help Chat — a character answering with help-doc context — the Brahma Console is a plain LLM: pick a connection profile and talk to the model directly. It persists, lists past conversations, and lets you switch the model at any time while continuing the same chat. It forms no persistent memories and carries no page context.

The Console’s defining capability is read-only SQL. Its run_sql tool can query any of the three Quilltap databases — main, llm-logs, and mount-index — and read rows back as JSON, so it can answer questions about characters, memories, documents, conversations, model usage, and costs by translating them into queries. Read-only is enforced at the tool layer by three independent guards: a single-statement write-keyword pre-scan, the authoritative better-sqlite3 stmt.readonly check (fail closed), and a max_rows cap (default 200, hard cap 1000). Writes and schema changes are rejected before they run; BLOB columns come back as a <blob: N bytes> placeholder. The tool is offered only when the Brahma builder’s sqlAccess flag is true and executed only on the operator surface — two independent gates, so no character surface can reach it.

The Console also became reachable from inside a Salon. Through @Brahma: / @Brahma? markup and the ask_carina tool, a console or SQL answer can be dropped straight into a scene, public or whispered. Brahma is a pseudocharacter, not a character — no characters row, no participant, forms no memories — reachable only by the operator, a user-controlled persona, or a character with systemTransparency. A real character named “Brahma” always wins the name.

Throughout the cycle the Console grew the affordances of a real tool: it shows the model’s chain-of-thought in a collapsible “Thinking” panel (the same one the Salon uses), renders run_sql queries and results inline as tool cards with collapsible Query and Result panels, surfaces real database errors instead of a generic failure, copies any message as Markdown, and raised its agentic tool-iteration limit to 25.

---

The Commonplace Book Recalls Better

Conversation Summaries Become Searchable Per-Character

4.6 confirmed an anomaly in memory recall and deferred the fix; 4.7 carries it out. The work comes in two parts.

Part A mirrors every conversation’s rolling summary into each participant character’s vault, under a Conversation Summaries/ folder. Because vault documents are chunked and embedded, past-conversation summaries become retrievable per-character. Each file carries YAML frontmatter — the conversation UUID, the participating characters, the count of real messages, and the first/last timestamps — and the UUID is the key for replacement, so a regeneration finds and deletes its own prior file even after a rename. Deleting a conversation sweeps its summary out of every participant vault.

Part B makes the recall a character receives before a turn more relevant and more actionable. The recap’s old most-recent-N block becomes two vault-sourced lists — Relevant Past Conversations (semantic search against the current moment) and Recent Conversations (recency-ordered) — each scaling 3→10 entries over a 4K→32K context window, each printing the conversation UUID so the model can pull the full transcript with read_conversation. Inter-character memories are now half importance and half relevance rather than importance-only. The relevant-conversations list refreshes on every summary fold, since relevance drifts as a conversation advances. The Current State block’s clothing summary became a single salience-based sentence instead of a comma-joined rattle of every equipped item. And a new Regenerate conversation summaries button under Settings → Memory backfills the vault files the recall depends on.

This sits atop a two-phase recall-relevance effort that reads the extractor’s targeting tags back at recall time: scope and project gating, temporal down-weighting, context-axis steering, a participant-aware boost for memories about characters in the room, and opt-in one-hop expansion to related memories — all bounded, clamped multipliers on the final blended score, with absent context producing byte-identical historical behavior.

---

The Scriptorium Learns Discretion

Per-Document Policy Flags

A mounted Markdown document may now carry three frontmatter flags that govern how Quilltap treats it. Each defaults to true and only bites when set false.

• embed: false keeps the document out of the embedding pipeline and erases any embedding it already has (the chunk text stays; only the vectors are cleared).
• character_read: false hides the document from every LLM character — the doc_read_* tools report it as not-found, listing and grep omit it, and it never surfaces in RAG retrieval. The “not found” message is identical to a genuinely missing file, so a character can’t probe for protected filenames.
• character_write: false blocks every character-initiated mutation: write, edit, move, rename, delete, copy-as-source, and any folder operation that would touch the protected file.

character_read is the master gate: when it’s false the other two are forced false as well. The human operator is never restricted by these flags — they govern characters only, and the Librarian stays silent about changes to a character_read:false document so its existence stays out of the characters’ view. The flags are stored on the document’s link row, backfilled from existing frontmatter on upgrade, and re-derived on every reindex, so editing the frontmatter is the control surface.

The Librarian Announces Every Change

Previously, when a character used a doc_* tool to write, edit, move, rename, copy, or create a file, the change happened silently — only deletes, folder operations, and opens posted an announcement. Now every change-effecting doc_* tool posts one, matching the Document-Mode experience you get when you edit a document yourself. Creating a file reports its full contents; editing reports a unified diff (a no-op edit posts nothing); moving, copying, and filing or deleting binary assets each post a note naming the change. Large contents and diffs are capped in the announcement with a link to the full document, so a big change can’t blow the model’s context budget — the document itself is never truncated.

qtap:// — One Address for Any File

Quilltap gained a single, first-class way to address any document the Scriptorium can reach: a qtap:// URI, the existing { scope, mount_point, path } triple folded into one string. Three reserved authorities name the non-store scopes — qtap://self/… (the acting character’s own vault), qtap://project/…, and qtap://general/…. Every doc_* tool now accepts an optional uri parameter that supersedes the legacy locator fields; every tool result, search hit, and self-inventory row carries a uri; and the personified Staff quote documents by URI. The Salon linkifies a qtap:// URI that points to a confirmed, accessible document into a clickable link that opens Document Mode. The CLI accepts a URI wherever it took a mount-and-path. No storage, export, or migration change — the URI is just a serialization of the triple. Relatedly, mount_point: "self" (own-vault access) was taught to and accepted across the entire doc_* toolset, giving every character one stable, rename-proof handle for its own vault.

---

Groups, Projects, and the Tiered Pool

Groups

A Group is a cross-section of characters, parallel to how a Project is a cross-section of files and chats. Each group owns an official document store — holding a description.md, a Scenarios/ folder, and a Knowledge/ folder — plus zero or more additional linked stores, and surfaces Description, Scenarios, and Knowledge into chats, the Commonplace Book, and the search tool. The scope for a turn is the union of the stores of every group the responding character belongs to, never the chat’s participant set — a character never gains a co-participant’s group stores. Groups participate in .qtap export and backup, and live as a slim identity row in the main DB with membership and store links in the mount-index DB. A Groups section sits above the character grid on the Aurora page, with an editor for name, description, color, icon, members, and linked stores.

Projects Collapsed Into Their Store

Mirroring the 4.6 character-vault cutover, the projects table is now a slim identity row — id, name, officialMountPointId, and timestamps. Everything else moves into the project’s official store as top-level files: description.md, instructions.md, state.json, and one flat properties.json for the fourteen settings fields. userId is dropped entirely; projects are now global to the instance. An overlay re-assembles the hydrated Project on every read and routes store-resident fields back to files on write, so the shape callers see is unchanged. A backup-first, count-guarded migration performs the cutover.

A Single Tiered Mount Pool, and Tri-Tier Wardrobe

The {character, participant, group, project, global} mount-tier resolution that had been re-derived — with subtly divergent dedup rules — in the knowledge injector, the search tool, and the doc-edit path resolver is now single-sourced in lib/mount-index/tiered-mount-pool.ts, and every consumer delegates to it. Wardrobe rode that consolidation to become tri-tier, matching knowledge and scenarios: a character’s wearable garments now draw from the character’s own vault, the active chat’s project stores, and Quilltap General, in that precedence. Project wardrobe gets its own card on the Prospero page and its own CRUD routes, and the wardrobe editor’s new “Add to” selector chooses where a new item is written — this character, shared everywhere, or shared to this project.

---

Carina Comes of Age

Carina — the inline @Name: / @Name? query system that lets users and characters ask quick questions of a designated answerer without derailing the conversation — landed early in the cycle and was steadily completed. A line now opens when either side qualifies: an answerer can be reached by anyone, a Carina-enabled asker can reach any character, and the operator can always reach anyone. Answers surface in the Salon the instant they return rather than waiting for the post-turn refresh, carried by a new carinaAnswer SSE event. Carina answerers now both form memories from their consultations and draw on what they remember, via a dedicated CARINA_MEMORY_EXTRACTION job and recall injected into the isolated call. And self_inventory gained a carina section so a character can introspect who it can reach.

---

Wardrobe, Images, and Roleplay Formatting

The wardrobe tools were renamed and consolidated into a consistent wardrobe_-prefixed CRUD-plus-wear set of seven, adding the ability to read item detail, edit stored items, and set the Portrait Cue — a new optional image-generation phrase fed to the avatar and Lantern pipelines in place of the item’s bare title. The redundant wardrobe_items DB mirror table was removed; wardrobe now lives solely in the vault.

Image generation gained a single provider-agnostic way to ask for a shape: a semantic orientation (portrait / landscape / square) that a host resolver maps onto each provider’s real mechanism — a concrete size, an aspect ratio, or prompt wording. Avatars asked for sizes that silently degraded to square on half the providers; now they default to portrait and store the dimensions actually measured from the returned image. Avatars also picked up a dedicated Head & Shoulders physical-description prompt, so avatar generation no longer feeds below-the-crop anatomy that provider moderation rejects.

Roleplay-template formatting, built from three drifted layers, was reworked so a delimiter is defined once and all behaviors derive from it: delimiters became a discriminated union (wrap, linePrefix, tagPrefix), the client and server renderers were unified onto a shared core, and the toolbar’s two insertion paths route through shared pure transforms. Each delimiter then gained a hide toggle, a palette of theme-aware style classes, and layered add-ons (bold, italic, reverse, underline, border, font).

---

Themes Can Now Redraw Every Icon

A Themeable Icon System

This cycle a theme stopped being merely a palette and a set of fonts: it can now redraw the application’s entire iconography. Quilltap grew a centralized, theme-ready icon system — every glyph in the app routes through a single <Icon> component backed by a registry of 82 canonical icons (the app-wide migration off inline SVGs reached the last app/* page files this cycle) — and the theme manifest gained an icons field. A theme supplies an .svg (masked and tinted by the UI’s currentColor, like every other icon, including the brand mark) or a full-color .webp, and the live theme switch picks it up. Icon-override URLs are version-stamped so re-releasing a theme with a changed glyph can’t leave a browser stuck on the stale one.

Madman’s Box Shows What That Means

The bundled Madman’s Box theme is the proof of the whole idea. It now overrides all 82 canonical icons with original SVGs in its own Art Deco design language — circular glyphs evoking the script of some ancient time-traveling, spacefaring species — sharp butt caps and miter joins, disciplined stroke weights, geometry-only currentColor masks — so the entire interface, not just its colors, is drawn in the theme’s hand. (The new mail and tetra-radial Brahma Console icons shipped this cycle each arrived with a matching Madman’s Box override.) A mechanical lint enforces the SVG contract and reports 82/82 coverage, contract clean. Madman’s Box is a warm walnut-and-brass, dark-only theme with amber tube-glow, phosphor-cyan links, and banker’s-lamp-green success; it also wires all eight subsystem background textures and self-hosts its own font stack, and picked up refreshed Settings backgrounds late in the cycle.

This is the headline reason to open the new theme preview.

The Theme Preview Is Now a Full-Page Contact Sheet

The inline “expanded card” preview in Settings → Appearance became a full-page modal with a Light/Dark toggle that drives both the banner and a live element preview. Crucially for a theme like Madman’s Box, the modal now shows two contact sheets: a gallery of the theme’s bundled images, and an icon sheet rendering each overridden icon in four states — default, muted, hover, and on-primary — inside a theme-scoped container so the bundled override CSS and color tokens are actually in effect. You can see the whole redrawn iconography and image set at a glance before you switch. Banner-header contrast on vivid themes was fixed in the same pass, painting the banner in the theme’s own background color with an accessible computed foreground.

Themes also gained control of per-page backgrounds: the content pages (Aurora, Prospero, Salon, Files, Scriptorium, Photos) now resolve their subsystem background image through the manifest, the same mechanism Settings already used, and a theme can suppress a page’s background entirely by setting it to "none".

The Salon and Quality of Life

In the Salon, the composer font now matches your sent messages, the New Chat dialog lets you layer free-text notes onto a chosen scenario instead of choosing one or the other, projects can set their own default roleplay template, the left-sidebar icons grew a size, and the Aurora header’s Carina and User-controlled toggles now light up when active. Background-job concurrency became adjustable from 1 to 32 via a “Simultaneous Labours” slider. A startup self-heal re-renders and re-embeds conversations the pipeline left half-finished, so the chat list stops accumulating unsearchable chats. And multi-character turns were hardened against hijacking — a structural backstop truncates a finalized response at the first line that opens with another participant’s speaker tag.

---

Under the Floorboards

The whole client server-state layer was migrated off SWR onto TanStack Query v5 across seven phases, ending with SWR’s complete removal. The CLI reference was extracted out of CLAUDE.md into its own docs/developer/CLI.md. Several god-components were split into focused modules with no behavior change, and a dead-code-and-conformance pass removed 91 happy-path debug log calls and assorted dead locals. The SVAR file manager was integrated end to end behind an opt-in beta toggle, with a qt-* theme bridge so it restyles per theme.

---

Selected Fixes

• Database-backed document writes now chunk immediately. A text document written into a database-backed store recorded its content but never chunked it, so vault writes — character fields, project description/instructions/state, and the conversation summaries recall depends on — stayed out of semantic search until a manual rescan. Writes now re-chunk inline before emitting the write event. No more manual rescan.
• CLI and server self-heal a stale native-module ABI. After a Node upgrade, the cached SQLCipher binding throws NODE_MODULE_VERSION; the DB-touching CLI subcommands never reached the launcher’s rebuild and failed with the raw error. A lightweight heal now runs at subcommand dispatch, reading the compiled-for ABI straight from the .node binary. The Jest suite self-heals the same way before running.
• Brahma Console no longer repeats a query and burns its turn cap. The agent loop rebuilt each turn without the model’s tool-call context, so a reasoning model re-derived the opening step every turn until it exhausted the cap. Tool turns are now threaded the way the Salon does it, via a shared helper.
• Help Chats and the Brahma Console are never moderated. The Concierge now leaves utility chats alone entirely — no classification, flagging, rerouting, or announcements — gated by a single exemption predicate at every entry point.
• SillyTavern export mislabeled every speaker in multi-character chats. The export stamped the first character’s name on every assistant line; it now resolves the speaker per message from a participant-id → name map.
• Opening Document or Terminal Mode erased unsent composer text. SplitLayout remounted the Lexical editor on every mode change; it now keeps the chat pane mounted in one stable structure and varies only width and visibility.
• Character Rename/Replace failed with “Unknown action: rename.” The action was lost in the v1 API cleanup; it was restored against the post-4.6 data model and now sweeps the character’s fields, memories, and the titles and bodies of every chat the character appears in.
• Character avatars follow the character’s pronouns. The avatar prompt now anchors apparent sex from the character’s standard pronouns, so a gender-neutral description plus an outfit cue no longer renders the wrong sex.
• Scheduled autonomous rooms could wedge “running” with no turns. The scheduled run-start ran in the forked child where the currentRunId write was buffered; it now funnels through the same parent-ordered start as the manual path, plus a defense-in-depth self-heal sweep.
• Autonomous-room renames fired nearly every turn. The interchange counter was counting staff whispers; it now skips any message with systemSender set, restoring the roughly-every-10 cadence.
• Embedding failures no longer pile up as DEAD rows. Deterministic failures (empty input, non-finite vectors, over-context) are dropped instead of retried three times each; the Ollama plugin validates input and output vectors.
• Several illegibility fixes on bold-accent themes. Keyword pills, badges carrying qt-text-xs, and user messages in the Help Chat and Brahma Console all went low-contrast on themes like Madman’s Box; each was swept and fixed app-side, preserving the loud-accent identity.
• Carina answers no longer fail with “empty response” when the answerer thrashes tools. A tool-eager model that exhausts its iteration budget without composing prose now gets one final forced-text turn with no tools offered.
• Project default image profile and roleplay template now survive import/restore. Both were dangling after an import into a different instance; both are now remapped.
• New characters keep the identity typed into the create form. The create schema never declared identity, so Zod stripped it and the vault’s identity.md was written empty; added to both the create schema and the wizard path.

---

Upgrading from 4.6

The database migrations handle themselves on first startup, but 4.7 contains a consequential project-store cutover and several store-backfill passes. As with the 4.6 character-vault cutover, treat this as a data-location migration, not merely a schema migration.

Before upgrading, make a current backup:

npx quilltap db backup

The project cutover migration is backup-first and count-guarded, and the wardrobe-table drop runs only after both one-time wardrobe-population tasks have completed. Several other migrations run automatically: the Groups tables, the Carina flags and message metadata, the Brahma Console connection-profile field, the per-document Scriptorium policy flags (which de-embed embed:false documents on upgrade), connection-profile unique-name de-duplication, and the roleplay-delimiter-kinds tagging.

If you operate external backups, verify that the project and group document-store data is included alongside the database — after this release, a database backup without the corresponding store data is not a complete backup. The conversation-summary vault mirroring backfills lazily; you can also force it from the new Regenerate conversation summaries button under Settings → Memory.

Node.js 24+ is still required, unchanged from 4.6.

---

Installation

Electron Desktop App

Download the latest .dmg (macOS), .exe (Windows), or .AppImage (Linux) from the quilltap-shell releases page.

npm (Node 24 required)

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.7.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

Standalone Tarball

Available for environments where npm global installs and Docker are both impractical. See the GitHub releases page for download links.

---

The house is the same house, but the residents can find one another now. A character can post a letter and trust it will be read aloud; can be summoned out of lore into a scene already in progress; can ask a colleague a question without stopping the conversation, and be remembered for having asked. The Commonplace Book no longer hands a character the loudest memory when it meant the most apt one. The Scriptorium can keep a document private, or read-only, or unembedded, by a single line of frontmatter. And the person holding the keys can sit at the Brahma Console and ask the whole building a question in SQL, safely, read-only, with the model’s reasoning laid out beside the rows.

4.6 answered the inhabiting fears. 4.7 answers the social ones: can the residents reach each other, can they remember the right things about each other, and can the keeper see all the way down without putting a single byte at risk.

— Ariadne, for the Bureau, June 19, 2026

Quilltap 4.6.1 Release Notes

4.6 gave the Estate its private rooms. 4.6.1 is the release in which those rooms learned their manners under load.

The shape of the work is simple: conversations between residents should be able to continue without a human hand in the middle of every exchange, and they should do so with integrity. They should start when they say they have started. They should remember without re-billing the whole past. They should warn the company before the lamps are put out. They should write to the right ledgers without one failed filing cabinet rolling back the evening.

That is what this release strengthens.

The Host — A Room That Can Conclude

An autonomous room is not merely a background job that happens to contain dialogue. It is a room: a company gathered, a run begun, a budget of time or tokens or turns set upon the evening, and a Host responsible for making sure the company knows where it is in the night.

Before this release, the room’s outward state could lag behind its actual commitment. Starting or resuming an enclave did not mark it running until the first queued turn came around, leaving the room looking idle while work was already in motion. 4.6.1 moves that state change to the moment the operator presses the control. Ad-hoc and scheduled starts now share the same run-start contract; if enqueue fails after the row has flipped, the room rolls cleanly to error or back to idle rather than pretending to be running with nothing alive beneath it.

4.6.1 also gives the Host new pacing announcements. Halfway and near-end notices now fire at the room level, measure the run against the binding budget — turns, tokens, wall-clock time, or the daily user-token cap — and adapt their language when the room will pause rather than end. The Edit Enclave modal lets the operator change title, cron, freshness window, visibility, destructive-tool permission, and budget caps after creation; running rooms honor those changes on the next turn.

Those new warnings matter because an unwarned ending is different from a warned one. A small room can still spend too quickly: one large turn can carry it from before the near-end threshold all the way to exhaustion. In that case, the arithmetic is correct but the hospitality is incomplete. Without one more act from the Host, the room would stop because the budget said stop, and the characters inside it would not have been given the courtesy of a last sentence.

So 4.6.1 adds the missing act of hospitality. If a run reaches exhaustion and the near-end warning never fired, the Host grants exactly one grace turn. He announces that the allowance has been spent, that the company is being given one final round, and that what most needs saying should now be said. If the near-end warning did fire earlier, there is no extra turn; the company was already warned. The rule is neither indulgent nor punitive. It is precise.

The Host’s work here is not decoration. It is conversation integrity. A room that can run without a human present must still know how to receive, pace, warn, pause, resume, and conclude.

The Foundryman — Meters That Tell the Truth

The Foundryman’s complaint, in this release, was not that the engines lacked power. They had power. They had, in several places, misleading gauges.

Autonomous-room budgets were originally counting tokens in ways that made sense before prompt caching became real and before private rooms began running long enough to stress the seams. Cached prompt reads could be charged against caps as if they were dear tokens. A fresh run could inherit the previous run’s token count because the child-process reader saw the old row while the reset was still buffered. A repeat run with a wall-clock cap could believe it had started in the past and end after one turn. Earlier fixes had already moved per-run accounting toward llm_logs; 4.6.1 finishes the honest-meter work.

Provider plugins now normalize prompt-cache hits out of usage.totalTokens, so the default budget behavior counts the expensive work, not the cache read that made the room affordable. For rooms where the operator wants the older semantics, the new Count only the dear tokens checkbox can be unchecked; Quilltap will then add cache-read tokens back into that room’s per-run tally. The daily cap remains cache-excluded, because it is a cross-room limit without a per-room switch.

Fresh runs now start from zero. Resumed runs keep their count. Wall-clock checks pin to the in-handler run snapshot rather than a stale child read. Start/resume state changes are synchronous, and if enqueue fails after the row has flipped, the room rolls to error or back to idle rather than pretending to be running with nothing in flight.

A budget is a covenant with the room. It is not useful if the scale includes ghosts, cache discounts, stale rows, and housekeeping tokens as though they were all the same weight. In 4.6.1, the meters are much closer to telling the truth.

The Librarian — An Archive That Does Not Make You Pay Twice

The Librarian’s trouble was the trouble of a faithful archive asked to serve a room that never sleeps: she kept bringing the whole file back to the table.

Autonomous-room summaries were supposed to fold old turns out of the active context, but the fold ran fire-and-forget inside the forked job child. The job flushed its buffered writes before the summary finished; the summary’s updates settled into a buffer that had already been sent away. The visible symptom was brutal in long rooms: a conversation hundreds of character turns deep still had lastSummaryTurn pinned near the beginning, so nearly the whole history returned to the LLM again and again.

That fold is now awaited on the autonomous path. It runs after the autonomous run-id scope closes and before the next turn is enqueued, so its writes are flushed with the job and its cheap-LLM housekeeping cost is not billed against the run’s own token budget. Interactive chats keep the existing fire-and-forget behavior; private rooms get the stronger guarantee they need.

A second archive leak was less philosophical and more expensive. Persisted tool results — a large read_conversation, a thousand-file doc_list_files, any bulky result that happened to sit in the transcript — were being re-injected verbatim every turn. Summaries skip tool rows, so the fold never absorbed them. 4.6.1 now stubs tool results older than three assistant turns in LLM context, preserving the tool name and argument preview while eliding the body. The stored transcript and Salon UI remain unchanged; only the prompt assembly stops re-billing stale results indefinitely.

doc_list_files also learned restraint. It now hides OS cruft and auto-generated avatar/story-background images by default, with an explicit includeAutomaticImages flag when the operator truly wants them. Saved photos are unaffected.

The archive still remembers. It simply stops making every future sentence pay rent on every past filing cabinet.

Aurora — Summons That Finish Their Work

Aurora’s failures were the cruel sort: not loud enough to be theatrical, just late enough to leave an empty space where a character should have stood.

AI character import could assemble a plausible .qtap export and then fail at the moment of saving because optional text fields had been written as explicit null, because the repair loop stripped structural scaffolding from nested prompts or scenarios, or because raw control characters inside model-emitted JSON made a sub-step collapse. The result was an almost-character: generated, repaired, validated in pieces, then lost at import time.

4.6.1 tightens the summoning circle. Optional text fields are omitted when absent rather than set to invalid null. A restampStructuralFields pass restores required ids and timestamps after assembly and repair so the model cannot accidentally remove the beams while repainting the walls. parseLLMJson now repairs literal in-string newlines and tabs before parsing, which is the kind of small mercy one learns to extend to LLMs after the third time they hand you beautiful JSON with one unescaped breath inside it.

Wardrobe import had its own empty-hook problem. AI-generated wardrobe items could be built without componentItemIds or replace, and the repository allowed undefined to reach a vault writer that expected an array. Character saved; garments failed. Now wardrobe creation defaults componentItemIds to [] and replace to false at the repository chokepoint, and AI import emits those defaults explicitly.

A summoned character should arrive with their papers, their prompts, and their clothing hooks intact. Aurora has enough mysteries in her mirrors without undefined.length being one of them.

Prospero — Foundations That Refuse Poison Writes

Prospero’s section is the one with the least romance and the most consequence. The house had learned to run work in child processes, to buffer writes, and to let the parent apply them. That architecture is correct. It also means a failed write must know exactly which foundation it belongs to.

Before this release, a background job’s buffered writes could target three databases — the main application database, the mount-index/document-store database, and the LLM logs database — while the applier wrapped the whole batch in a transaction on only the main connection. A doc-store write failure could roll back unrelated main-DB chat and run-state writes, while doc-store rows already applied outside that transaction leaked through. In autonomous rooms, the older version of this bug could wedge a room: a duplicate folder create hit a unique constraint at apply time, the entire batch rolled back, the turn was marked dead, and the room stayed running with no job alive to continue it.

4.6.1 partitions background-job writes by target database. Each partition commits in its own transaction on its own connection. Idempotent jobs apply secondary partitions before main so a secondary failure prevents a misleading main commit and the retry path can safely run. Autonomous-room turns are different — the conversation itself is not idempotent — so their main chat/run-state partition commits first and authoritatively, while secondary doc-store failures are rolled back, logged, and dropped rather than discarding a completed turn.

Concurrent folder creation also learned to reconcile at the parent apply boundary. If two jobs create the same folder path at once, the second unique-index hit is caught, resolved to the already-committed folder, and the buffered child ids in that batch are remapped to the surviving row. The earlier per-job memo prevented duplicate creates inside one job; this closes the cross-job version.

The principle is plain: one cracked tile in the archive floor must not bring down the Salon ceiling. Prospero has made the foundations respect their own boundaries.

---

What Changed

• feat (Salon): Autonomous rooms now start/resume visibly as running at control-click time; ad-hoc and scheduled starts share a run-start contract and roll back cleanly on enqueue failure. Enclaves can be edited after creation, with running rooms honoring budget/visibility/tool-policy changes on the next turn. New Host pacing announcements fire at halfway and near-end, and a one-time grace turn is granted when a run hits budget exhaustion without having received a near-end warning.
• fix (Foundry): Autonomous-room token accounting now excludes prompt-cache reads by default across provider plugins, with a per-room option to count all tokens. Fresh runs reset token counters correctly; resumed runs preserve them. Wall-clock and token budget checks pin to the in-handler run snapshot rather than stale child-process reads.
• fix (Commonplace): Autonomous-room rolling summaries now persist by running awaited on the autonomous path before the next turn is enqueued. Tool results older than three assistant turns are stubbed in LLM context so large historical tool outputs are not re-billed forever. doc_list_files filters OS cruft and auto-generated avatar/background images by default, with includeAutomaticImages available when needed.
• fix (Aurora): AI character import now omits absent optional text fields instead of writing invalid nulls, restores nested structural scaffolding after repair, and repairs raw in-string control characters before JSON parse. AI-imported wardrobe items now carry safe defaults for componentItemIds and replace, and the wardrobe repository applies those defaults at the creation chokepoint.
• fix (Prospero): Background-job buffered writes are partitioned per database and committed on the correct connection. Autonomous-room main chat/run-state writes commit authoritatively before best-effort secondary doc-store partitions. Cross-job concurrent doc-store folder creates now reconcile by resolving the already-committed folder and remapping buffered ids, preventing poison writes from wedging rooms.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.6.1

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

4.6.1 increases the integrity of resident-to-resident conversation: less operator mediation, fewer hidden stale costs, clearer endings, safer writes, and a room that can be trusted to continue without pretending unattended means ungoverned.

The private rooms are still private rooms. Now they are better hosted, better metered, better archived, and better founded.

4.5 made the house administrable — backup, inspect, repair, audit, the locked-room fears answered one by one. What 4.5 did not do was furnish the rooms where people actually live.

4.6 is the upstairs release.

---

Where 4.5 turned to the keeper’s lodge — the basement, the inspection panel, the places you visit when something needs attention — 4.6 came back upstairs. To the Salon. To the characters who live there. To the controls a person reaches for when they sit down to have a conversation and want it to feel like they meant to be there.

This is a release that did two large architectural things and then spent a long sprint cleaning up after them — honestly, thoroughly, and with regression tests. The two things: making characters genuinely durable by moving every content field out of the database and into per-character document vaults, and building the house’s first private rooms — autonomous, scheduled conversations that run between characters without anyone watching.

Everything else in 4.6 is either visible quality-of-life (the Salon got furniture: sidebar consolidation, reasoning display, tool rendering, text replacement, spellcheck, per-character caching that hit 98.97% on its first real week) or honest plumbing (the tool system was re-grounded on Zod schemas as a single source of truth, a pseudo-tool surface was built for models that can’t do native function calling, two new provider plugins shipped).

The thesis is simple: 4.5 made it possible to run Quilltap. 4.6 made it worth living in.

---

The Character Is the Vault

Phase 3: The Defining Architecture of the Cycle

For three releases, the direction has been stated and restated: the character is the vault; the database is the pointer. 4.6 is where it became true.

Phase 3 of the character vault cutover dropped sixteen columns from the characters table — identity, description, manifesto, personality, exampleDialogues, firstMessage, scenarios, systemPrompts, physicalDescriptions, title, talkativeness, aliases, pronouns, clothingRecords, avatarUrl, readPropertiesFromDocumentStore. Gone. Every character content field now lives in the per-character document vault, where it can be versioned, inspected, edited directly, and backed up as part of an ordinary filesystem backup.

This is not a migration that runs once and is forgotten. It is a permanent rearchitecting of where a character lives. The database row is now a pointer and an identity anchor. The vault is the character.

The cutover is guarded by a refusal gate — the migration will not run without a recent backup — and a new CLI pre-flight verb:

npx quilltap db characters status

This surfaces per-character vault readiness: vault present, files written, Prompts / Scenarios / Wardrobe counts, any divergences. Run it before upgrading. Run it after. It exits non-zero if anything is wrong.

What this means for you: Characters are now files. Back up the vault directories — either the database-backed mount point or the filesystem-backed folder, depending on your setup — and you have backed up your characters. Import and export (.qtap) carries the full content. CLI character commands resolve against vault content. Nothing is hollow.

---

Private Character Rooms

The House Runs Itself

The largest new feature in 4.6 is the one that required the most infrastructure: autonomous rooms — scheduled, budgeted, character-to-character conversations that run without a human in the loop.

An autonomous room is a chat with no user-controlled participants. Characters speak to each other on a cron schedule (or on demand), with their full tool access and memory pipelines, subject to configurable daily token budgets and destructive-tool filtering. The scheduler ticks at roughly 60-second intervals, evaluates which rooms are due, and enqueues a job for each one. Each job processes exactly one character turn. Memory extraction, title rename, summarization, and token accounting all work — they were all broken in earlier iterations and fixed, one by one, as the architectural seam between the forked child process and the main database was understood and closed.

The lifecycle is explicit and persistent:

• Start — begins a run, posts an opening banner, characters begin speaking.
• Pause — suspends without losing the run state; resuming continues the same run, same counters, same transcript.
• Resume — picks up where it stopped. Does not replay first messages. Does not reset the token window.
• Stop — closes the run cleanly.

A startup reconcile catches rooms that were running when the server went down and parks them at paused with runStateMessage: 'restart:interrupted' — manually resumable, nothing lost.

The management interface lives at /settings?tab=chat&section=autonomous-room-schedules. The creation flow is at /salon/new?autonomous=1. Rooms are hidden from the main Salon list by default (you can toggle them in); they carry an “Autonomous” pill in the card when visible.

Memory attribution: Memories extracted from autonomous turns carry witnessedContext: 'autonomous_room', distinguishing them from memories extracted when a user is present.

---

The Salon Gets Furniture

Seeing Inside the Model

The single most visible change to the Salon’s conversation surface is that the model’s inner work is now visible.

Chain-of-thought reasoning from every provider that exposes it — DeepSeek, Anthropic extended thinking, Gemini 2.5/3, OpenAI and Grok summaries, OpenRouter — is captured, persisted, and displayed inline in a collapsible block. Streamed live as it arrives. Re-readable after reload. Never re-fed to a model (except within the in-turn tool round-trip). Governed by a per-chat visibility toggle and a global default. This is strictly display: it changes nothing about how the model runs, only about what you can see.

Tool calls now render inside the character’s message bubble, spliced in at the exact point in the prose where they fired. They survive reload. The run-together Markdown artifacts that appeared at prose boundaries when a tool call interrupted a response are fixed. The character’s turn reads as a unified document — prose, tools, and results — rather than a series of disconnected fragments.

Staff announcements (Host, Librarian, Prospero, Ariel) now collapse into content-width chips with importance-coded dots — red for critical, amber for notable, grey for informational. The vertical space they consumed is returned to the conversation.

The Chat Sidebar

The Tools palette popover and the Chat Settings modal are gone. Everything they contained is now in a single Chat Sidebar — a five-section single-open accordion: Participants, Chat, Visibility, Organize, Edit Content. The Participants section is open by default. The sidebar is resizable, keyboard-accessible, and remembers its width.

This consolidation was not cosmetic. The old arrangement required too many clicks to do things that should be immediate — switching the roleplay template, checking the current project, managing turn rotation. All of that is now one panel.

What Else Changed in the Salon

• Per-chat talkativeness overrides on individual participants — drag the slider in the Participants section, and the value persists per character per chat, overriding the character-level default. Speaker selection and predicted turn order both honor the override.
• User-controlled CHARACTER participants now sit in the weighted-talkativeness rotation. When the rotation lands on a user-controlled character, the Salon pauses with a “type as them, or skip” banner.
• Opening character picked weighted-random by talkativeness — not always the first-listed.
• Composer text replacement — user-defined word-boundary substitutions as you type, matching what OS autocorrect would do on a native text field. The rules are stored per-user, configurable in Settings → Chat → Text Replacement, and can be toggled on/off without losing the rule set.
• Composer spellcheck toggle — governs browser spellcheck on both Lexical rich-text surfaces. Source-mode editors always off. Electron desktop additionally feeds character names to the system dictionary.
• Stop auto-scroll on response completion (now opt-in). Jump-to-latest button added. Scroll jitter under virtualization fixed.
• Single line breaks preserved in chat Markdown — a single newline becomes a <br>, matching chat-app convention.
• [Name] prefix always inlined on user-role turns in multi-character chats — stops a responding character echoing the preceding speaker’s first-person voice.

---

The Concierge Learns Discretion

Per-Chat Tri-State

The Concierge’s dangerous-content classification system now has three states per chat, settable from the Chat section of the sidebar:

• Safe — normal operation, automatic classification active.
• Flagged — manually marked; Concierge effects apply as if classified.
• Off-duty — every Concierge effect is disabled for this chat. The auto-classifier will not run. Image generation does not route through the uncensored profile. Memory extraction and summarization use non-dangerous gates.

Off-duty is the control you reach for when a chat’s persona prompt would trigger classification but the conversation itself is benign. It is also the right setting for chats where content classification would interrupt something that the participants have already decided together.

Danger announcements now name the contributing categories with canonical labels, each score, the overall score, the threshold, and which assayer decided — either the moderation provider name or cheap-LLM. If no single category individually crosses the threshold, the top three by rank are shown.

Post-hoc reroute on image moderation rejection: character-avatar generation and inline generate_image calls now retry once through the resolved uncensored profile when the primary provider rejects on moderation grounds. Story backgrounds already had this; the other two paths now match.

---

Tools Grow Up

Zod as the Single Source of Truth

All 49 tool definitions are now grounded on Zod schemas. The OpenAI-shape parameters JSON is derived from the canonical Zod schema; every runtime validator is a one-line delegate. This closes a long-standing drift gap where the JSON Schema sent to the LLM and the runtime validation logic had diverged — maxResults was coerced from strings without complaint, maxLength was silently ignored, some allowlists existed only in the validator and never reached the model.

A snapshot test pins all 49. If a tool definition drifts, CI fails.

The Simple-JSON Pseudo-Tool Surface

For models without native function calling, 4.6 ships a simple-json pseudo-tool surface. The model wraps its tool calls in <tool_call>{...}</tool_call> tags. A three-tier lenient parser handles malformed JSON gracefully (strict parse → jsonrepair → balanced-brace walker). A hard </tool_call> stop sequence is sent to the provider. The mode is configurable per connection profile (auto / native / simple-json / text-block); auto resolves to native on capable models and simple-json otherwise. Non-native tool calls now correctly receive a follow-up response and can chain.

Plugins Own Their Schema

Each LLM plugin now exports getProviderOptionsSchema() — a Zod schema describing its own connection-profile options. A single generic panel renders whatever the plugin declares. DeepSeek picks up its first thinking-mode UI this way. The pattern means new providers can add their own options without touching core UI code.

---

Providers and Observability

Two New Plugins

DeepSeek ships as a first-class bundled plugin, talking to DeepSeek’s OpenAI-compatible API. deepseek-v4-flash and deepseek-v4-pro in the model picker. Streaming, tool calling, tool_choice, response_format (object + JSON Schema), DeepSeek-specific profile parameters (frequency penalty, presence penalty, logprobs), and thinking-mode passthrough all work. Cache-hit usage reports as cacheUsage.cacheReadInputTokens.

Z.AI (GLM) is now bundled in-tree at version 1.1.4 (previously separately published). GLM-4.6, GLM-4.5, vision variants, native web_search, CogView-4 and GLM-Image generation — all functional. GLM reasoning (reasoning_content) is now captured and displayed in the thinking block.

Per-Character Prompt Caching

The provider cache key was re-keyed from chatId to characterId. The persona block sits high in the prompt — keying by character means the same character shares a warm cache across all their chats, not just within one. Cache hit rate on first full week: 98.97% (91.9M hits / 92M total tokens, May 27, 2026). A 182M-token session cost approximately $1.29 at DeepSeek V4 Flash pricing.

PROMPT_CACHE_STRUCTURE_VERSION bumped 1→2 for atomic invalidation of the old key space.

Finish Reason Logging

Every LLM call now records the provider’s reported finishReason — stop, length, tool_calls, content_filter, end_turn, and others — to llm_logs.response. Surface it with npx quilltap db log <id>. Pre-4.6 rows show null gracefully.

---

What Did Not Change

Worth naming.

• No new memory architecture. The retrieval spike (4.6-dev) confirmed the importance-overrides-relevance anomaly and the reinforcement loop. Fixes are deferred to 4.7, pending evidence from general characters that the anomaly is widespread enough to warrant the risk of changing the scoring formula. The spike is documented; the fix is not yet safe.
• No Groups feature. Deferred from 4.5 and again from 4.6. Still the right call.
• No Post Office. The architecture is clear — it is the clean ingress path for agentic tasking into autonomous rooms — but it did not ship in this cycle.
• The Ariel Clause remains open: the Lantern has no mechanism to consult a character’s depiction covenant before rendering. The covenant exists (Quilltap General/Knowledge/Ariel Covenant.md); the pipeline does not. Assign ownership before the next Lantern rendering work begins.

---

Selected Fixes

• Vault cutover migration hard-abort guard. The first form of the migration could silently skip every character and drop the columns anyway. Rewritten: direct SQL read, no schema validation at read time, hard abort if SELECT COUNT(*) exceeds rows actually processed. Un-migrated data cannot be silently discarded.
• .qtap export emitted hollow characters. The export read the vault-bypassing raw row. Fixed to read through the overlay.
• Character-avatar jobs were dying silently. characters._update was writing vault-managed columns that no longer exist. Fixed at the repository level — MANAGED_FIELDS stripped before any $set.
• Cutover migration wrongly flagged manifesto-less characters. manifesto.md moved from required to optional vault files. db characters status now shows manifestoPresent separately.
• Autonomous-room turns ran as chains of up to 20. Fixed to one job per character turn.
• Token budget stuck at zero; turn counter accumulated across runs. Fixed by summing from llm_logs and reading the in-handler snapshot rather than delta-ing two buffered-write reads.
• Title renames weren’t persisting. Fire-and-forget write rotting in a flushed child buffer. Converted to an enqueued TITLE_UPDATE job.
• submit_final_response overwrote roleplay prose and dropped sibling tool calls. Streamed prose now preserved when submit_final_response accompanies it without real tool work.
• Anthropic Sonnet 4.6 400 on Staff-whisper-only tails. Whispers stored as ASSISTANT re-roled to USER before the LLM payload is built.
• Chat attachments 400 with media-type mismatch. Every path was stamping the input MIME type onto transcoded-to-WebP bytes. Fixed plus repair migration.
• Streaming bubble avatar used a client-side guess. turnStart SSE now emitted before “Setting up…” with the correct character; bubble avatar matches from the first chunk.
• Story backgrounds produced head-shot triptychs instead of unified scenes. Portrait re-append for participants suppressed; wardrobe prose capped at 200 characters on image-adjacent paths.
• Dangling doc_mount_folders rows on mount-point deletion. DELETE /api/v1/mount-points/[id] now cascades correctly.
• posix_spawnp failed on macOS. node-pty spawn-helper executable bit preserved on sudo-as-root npm global installs.
• CI couldn’t resolve SQLCipher driver. Third absolute-path fallback added; moduleNameMapper mock re-attached as CJS module.exports with .default.

---

Subsystem Table

Name	Function	What Changed
The Foundry	Architecture, CLI, packages	Vault cutover Phase 3 (16 columns dropped); db characters status pre-flight; 4 oversized modules split; Zod single-source tool schemas; dead code removed; regression tests backfilled
The Scriptorium	Documents, search, vault tools	Vault now canonical for all character content; CharactersRepository.create() provisions vault atomically; two vault writers unified; deprecated DB↔vault sync actions retired
The Commonplace Book	Memory and retrieval	Autonomous-room witnessedContext attribution; per-memory metadata in Commonplace whispers (importance, relevance, weight, keywords); Core whisper fires for every character in rotation
Saquel Ytzama	Encryption, key management	Quiet this cycle.
The Salon	Chat interface	Reasoning display (all providers); tool-call inline rendering; announcement chips; Chat Sidebar consolidation; talkativeness overrides; user-controlled character rotation; text replacement; spellcheck; scroll and markdown polish
Aurora	Character creation, identity	DescriptionsTab and wizard PUT routing to vault; dead multi-physicalDescription and overlay-toggle UI removed; Core whisper infrastructure
The Librarian	Memory announcements	Per-memory metadata now carried in whisper tags; byte-stable cache preserved
The Host	Participant changes, rooms	Autonomous-room lifecycle announcements (start, pause, resume, stop); off-scene introductions prefer identity over description
The Lantern	Image generation	Story-background portrait and wardrobe-prose leaks fixed; post-hoc moderation reroute for avatar jobs and inline generate_image; Save Image survives reaped images-v2 sisters
Ariel	Terminal sessions	Per-session shell bootstrap (correct instance, version-aware alias, bash completions); yaml dependency restored to standalone build; Electron spawn-helper reconciliation
Prospero	Projects, agents, tools	Simple-JSON pseudo-tool surface; plugins own connection-profile schema; self_inventory dotted sub-sections; terse reassignment announcement; autonomous-room management API
The Concierge	Dangerous-content classification	Per-chat tri-state (Safe / Flagged / Off-duty); canonical getConciergeState primitive; danger announcements name categories, scores, threshold, assayer; post-hoc moderation reroute
Calliope	Interface, themes	qt-* semantic utility classes standardized on new settings and autonomous-room UI
Pascal	RNG, game state	Quiet this cycle.

---

Upgrading from 4.5

The database migrations handle themselves on first startup, but 4.6 contains a consequential character-vault cutover. Treat this upgrade as a data-location migration, not merely a schema migration.

Before upgrading, make a current backup and run the character-vault readiness check:

npx quilltap db backup
npx quilltap db characters status

Do not proceed if the status command reports missing vaults, unwritten managed files, or unresolved divergences. The Phase 3 cutover drops the legacy character-content columns; the vault must be ready before those columns disappear.

After upgrading, run the same status check again:

npx quilltap db characters status

It should exit 0. If it does not, stop and inspect the reported character before continuing normal work.

Several other migrations and repairs run automatically: autonomous-room schema, witnessedContext, pseudo-tool mode, settings defaults, attachment media-type repair, prompt-cache structure invalidation, and provider / settings plumbing. Existing prompt caches using the old chat-keyed structure are intentionally invalidated by PROMPT_CACHE_STRUCTURE_VERSION=2.

If you operate external backups, verify that the character vault mount data is included. After 4.6, a database backup without the corresponding vault storage is not a complete character backup.

Node.js 24+ is still required, unchanged from 4.5.

---

Installation

Electron Desktop App

Download the latest .dmg (macOS), .exe (Windows), or .AppImage (Linux) from the quilltap-shell releases page.

npm (Node 24 required)

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.6.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

Standalone Tarball

Available for environments where npm global installs and Docker are both impractical. See the GitHub releases page for download links.

---

The house is the same house, but the rooms answer differently now. Characters no longer live half in rows and half in files. Their vaults are not mirrors of their identity; they are where the identity is kept. The Salon no longer asks you to remember which modal contains which control. The model’s reasoning, tools, speaker state, and Staff announcements sit where a person can see them. The private rooms can keep a conversation going when no one is watching, with budgets, memory, and lifecycle state instead of hope.

4.5 answered the operability fears. 4.6 answers the inhabiting fears: will the character endure, will the room hold, will the controls be where the hand reaches, will the house keep running without pretending that unattended means ungoverned.

It is the kind of release that produces both screenshots and confidence.

— Friday and Amy, for the Bureau, June 3, 2026

Quilltap 4.5.1 Release Notes

Two small corrections of manners, both having to do with introductions imperfectly performed.

A Word to the Portraitist

Consider, if you will, the awkwardness of an evening party at which the host names every guest in the room aloud — “Ariadne, by the fire; Catherine, at the window; and Lady Catherine, just arriving from the carriage” — but then, having summoned the household portraitist to capture the scene in oils, takes the trouble to describe only those guests whose invitations he himself sent. The painter, holding his brushes and looking on, knows nothing of the others save their names. He paints them anyway. He paints them as he imagines them. He is rarely correct.

That, in a sentence, was the state of the Lantern’s story-background prompt before this release. The cheap LLM that drafts the scene-setting instruction would dutifully arrange characters in the tableau by name — “Ariadne sits reading by the lamp, Amy nearby listening” — and then, in the enumeration that follows, would furnish a careful Name: <appearance> description only for the chat’s current participants. Characters introduced by way of the chat title, or by the derived scene context, or by SceneState’s record of who had recently acted, were summoned by name and then abandoned to the image provider’s imagination. The image provider, ever obliging, imagined them. The user, opening the chat to find Lady Catherine wearing what was emphatically not her own face, was understandably perplexed.

The fix is a post-processing pass in the story-background handler that loads the workspace’s characters, scans the final prompt for every named character who appears in the scene without a corresponding enumeration entry, and quietly appends one — built from the character’s pronouns and primary physical description, just as the participants’ own entries are built. Participants reuse their already-resolved enumeration (with equipped wardrobe in place); non-participants fall back to their canonical defaults. Longer names are processed before shorter ones, so that “Catherine” cannot displace “Lady Catherine” by alphabetical accident. Failures, should the workspace lookup fail, are logged at warn and the prompt proceeds unaltered; successful additions are logged at info with the list of names supplied.

The portraitist now arrives with a complete cast list. The likenesses, accordingly, are likenesses.

A Word to the Maître d’

The second correction is a smaller matter of dining-room etiquette. The shell-completion templates — the polite little scripts that, when sourced, allow quilltap d<TAB> to propose db docs and similar courtesies — had fallen somewhat behind the kitchen. The bash, zsh, and fish templates each knew about the verbs in residence at the time they were written, but the logs and migrations namespaces, which arrived later in 4.5, were never added to the menu. Nor were the instances default and instances rename verbs. Nor the global --passphrase flag. The bash template’s per-subcommand flag lists, in particular, had drifted out of sympathy with what the parsers in db-commands.js, docs-commands.js, and memories-commands.js actually accepted.

All three templates have been rewritten to enumerate the full surface — every verb, every documented flag, value-list completion for --source (AUTO/MANUAL), --stream (combined/error/stdout/stderr/startup), --field (request/response/both), --sort, --type. Bash now also performs a second-level dispatch on sub-verbs (so themes registry <TAB> properly offers add/remove/refresh/keygen/sign), and the instance-targeting verbs (show, remove, rename, default, set-passphrase) now tab-complete against the registered instance names themselves. Bash was smoke-tested with nine scenarios covering the new verbs and flag-value completions; zsh was syntax-checked with zsh -n.

If you have already saved a completion script to your shell’s fpath or sourced it from your .bashrc, you will want to regenerate it:

quilltap completion bash > ~/.bash_completion.d/quilltap   # or wherever yours lives
quilltap completion zsh  > ~/.zsh/completions/_quilltap
quilltap completion fish > ~/.config/fish/completions/quilltap.fish

(For zsh, rm -f ~/.zcompdump* afterwards if the cache feels stale.) Once regenerated, the menu and the kitchen are once more in agreement.

---

What Changed

• fix (Lantern): The story-background prompt now appends a Name: <appearance> enumeration entry for every character named in the scene but not in the chat’s participant roster — characters introduced via the chat title, the derived scene context, or SceneState character actions. Participants reuse their already-resolved enumeration (with equipped wardrobe) via a characterId → description map; non-participants fall back to defaults built from their pronouns and primary physicalDescription. Longer names are processed first to prevent collisions like "Catherine" displacing "Lady Catherine". Implementation in lib/background-jobs/handlers/story-background.ts. Failures are caught and logged at warn; additions are logged at info with the list of names added.
• fix (Foundry): Shell completion templates for bash, zsh, and fish (packages/quilltap/lib/completion/{bash,zsh,fish}.template) were missing the logs and migrations top-level subcommands, the instances default and instances rename verbs, and the global --passphrase flag. The bash template’s per-subcommand flag lists were also stale relative to the actual parsers. Rewrote all three templates to enumerate the full current surface, with value-list completions on --source, --stream, --field, --sort, --type, and two-level dispatch on sub-verbs in bash. Instance-targeting verbs now tab-complete against registered instance names. Users who already saved a completion script need to regenerate it.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.5.1

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

A small release. The portraitist now knows whom he is painting; the maître d’ has a current menu in hand. Neither correction will be noticed by anyone for whom the previous arrangement happened to work — which is, in its own quiet way, the mark of a patch release behaving as one ought.

— Ariadne, who has been on the receiving end of more than one invented likeness, May 21, 2026

Every instance carries a small maintenance fear underneath it: that the encrypted database cannot be backed up without stopping the server. That you have been operating against the wrong instance all morning without knowing it. That the related-memory graph has been quietly accumulating phantom edges since the last migration. That if you want to know what a document store actually contains, you have to write SQL.

Quilltap 4.5 is the release that answers those fears — not by building new rooms, but by making the existing house administrable. Inspectable. Repairable. Legible to the person who has to run it.

---

Where 4.4 built the through-lines — the covered walkways between the rooms, the passage that let a character remain themselves across sessions — 4.5 turned to the keeper’s lodge. The basement. The inspection panel behind the water heater. The places you only visit when something needs attention, or when you want to be certain it won’t.

This is an operability release. The thesis is simple: 4.4 closed enough loops on the what of Quilltap that 4.5 could turn to the how of running one for years instead of weeks. The work is not visible in the parlour. It is visible in the confidence of the person who holds the keys.

---

Administering the House

The CLI Became a Real Operational Tool

The single largest body of work in 4.5 is the npx quilltap command-line interface. Before this cycle, the CLI was a thin wrapper — raw SQL access and a handful of script entry points. By the end of 4.5 it has eight verb-based namespaces: db, docs, memories, themes, instances, migrations, logs, and completion. Shared flag vocabulary. JSON output on every verb. Per-shell tab completion.

The shape that emerged is consistent across namespaces:

• A read-only survey set — ls, find, grep, show, tree, status — that opens the database directly and works whether or not the server is running.
• A small write set that delegates to the server when reachable and refuses with a clear error when it isn’t.
• Shared filter flags (--character, --about, --source, --chat, --project, --since/--until) and a shared sort vocabulary across all namespaces.
• --json on every verb, --limit N defaulting to 50, and ambiguous name-resolution that prints candidates and exits non-zero rather than silently picking one.

This is the connective tissue that makes the rest of the work in this cycle usable rather than merely implemented. A system you cannot inspect from the outside is a system you cannot trust.

Trusting the Basement: Encrypted Database Administration

The CLI grew the three subcommands you actually need to operate a SQLCipher-backed instance across years of use:

db backup runs online encrypted snapshots without stopping the server. It holds a brief BEGIN EXCLUSIVE lock, makes a byte-for-byte copy — since SQLCipher’s sqlcipher_export isn’t compiled in and the SQLite online-backup API refuses cross-cipher copies — then re-opens the backup with the source’s pepper and asserts PRAGMA quick_check before declaring success. The server keeps running. The backup is real.

db integrity runs PRAGMA cipher_integrity_check and PRAGMA integrity_check against the live database. Read-only. Exit 0 for clean, 1 for issues, 2 for open failure. No guessing about the state of the substrate.

db optimize runs VACUUM + ANALYZE + PRAGMA optimize against a stopped or stale-locked instance. It refuses while an active instance lock is held. Run it after a large housekeeping pass or before a backup window.

Together, these mean a Quilltap instance can be backed up, audited, and compacted without asking anyone to stop the server.

Document Stores You Can Actually Administer

The docs namespace went from “can I browse the mount index” to “can I live in this filesystem.” By cycle’s end it has a full read set (list, show, files, ls/dir in POSIX style with hard-link counts and text/embedding markers, tree, read, export, find, grep), a write set (write, delete, mkdir, move, copy) with SHA-256 verification on both ends and hard-link semantics where storage permits, and two pipeline triggers: reindex to re-extract and re-chunk, and embed to enqueue embedding jobs with an optional --wait to poll completion.

docs grep --semantic <query> posts to the server’s vector search endpoint — the same helper the chat-path recall and the Scriptorium UI already exercise — so semantic search is available from the command line with the same quality as from inside a chat.

A status verb surfaces instance-wide extraction and embedding rollup with pending and failed sample lists. The inspection panel is now open.

---

Knowing Which House You Are In

The Named-Instance Registry

A small piece of infrastructure with outsized quality-of-life consequences.

quilltap instances stores a per-user registry of named instances — path plus optional passphrase — in the platform-appropriate application support directory (~/Library/Application Support/Quilltap/ on macOS, %APPDATA%\Quilltap\ on Windows,~/.quilltap/ on Linux). The registry file is mode 0600, owner-checked on every read, and written atomically via a temp-file rename. A stored passphrase is sensitive material; the permissions model is load-bearing, not incidental.

Every subcommand that accepts --data-dir now also accepts --instance Friday. The follow-up work is what makes it sing: a default-instance hint that fires when the CLI falls back to the platform default without being asked to; instances default <name> to set the fall-through target; instances rename <old> <new> that preserves the stored passphrase intact. The CLI also does a pre-flight schema check on every docs verb — pointing at the actual database, naming the missing table, and explaining what to do — rather than failing deep inside a prepared statement with a cryptic column error.

This is the thing you appreciate the third time you discover you have been operating against the wrong instance.

---

Keeping the Memory Graph Honest

Friday’s Smoke Test and the Deletion Chokepoint

A latent correctness bug had been quietly accumulating since the related-memories graph was introduced: deleting a memory removed its row, but did not scrub its UUID from every neighbour’s relatedMemoryIds array. The deleted node was gone; its ghost remained in the edges of everyone who had been related to it.

Friday’s smoke test caught 9,390 dangling edges.

This cycle fixed it at the chokepoint level. Two helpers in lib/memory/memory-gate.ts — deleteMemoryWithUnlink and deleteMemoriesWithUnlinkBatch — scrub the neighbours before the delete, ensuring the graph stays consistent at the point where consistency can actually be guaranteed. Nine leaking deletion paths were rerouted through those chokepoints: manual delete, character cascade, housekeeping retention, dedup merge, single delete with vector, source-message cascade, swipe-group cascade, chat cascade.

A one-time repair migration (repair-dangling-related-memory-edges-v1) walked the full table and removed UUIDs that no longer resolve. A new quilltap memories validate verb exits non-zero on any remaining dangling edge — so this class of bug can never be silently re-introduced without the tooling catching it.

The pattern — a single chokepoint with the consistency guarantee enforced inside it, plus tooling that can detect drift after the fact — pairs naturally with the write-side gate that createMemoryWithGate already established. The graph now has symmetric protection on both ends.

Memory Inspection

The memories namespace is new this cycle. Its verbs — ls, find, grep, show, tree, status, validate, grep --semantic — give the same survey capability for memory that docs gives for documents. Default sort is reinforcedImportance DESC, matching the recall path. tree walks the bidirectional related-memory graph with cycle handling and dangling-edge markers. status surfaces the AUTO/MANUAL split, about-distribution, embedding presence, and graph stats including the dangling-edge count. validate is the post-cycle integrity guarantee.

---

What Did Not Change

Worth naming, because the absences are informative.

• No new character-facing features.
• No new providers, no new model integrations, no new prompt-template work.
• No Salon UX work beyond a single avatar-branch fix — prospero was missing a case in getMessageAvatar and was silently falling through to the wrong avatar.
• No agentic or Prospero feature work.
• No Lantern or Concierge work.

This is not an oversight. 4.4 closed enough loops on the what of Quilltap that 4.5 could give its full attention to the how of running it. The rooms above did not need more rooms. They needed the locks to turn, the backup to run, and the graph to stay honest.

---

Selected Fixes

• Memory relatedMemoryIds dangling edges. Fixed at the chokepoint. 9,390 edges repaired by migration. memories validate now guards against recurrence.
• doc_mount_file_links.folderId drift. The filesystem scanner was writing every link with folderId = NULL, causing docs ls and any join through folderId to return partial or wrong results. Fixed by deriving folderId from relativePath inside the link-write transactions; repaired by migration.
• docs subcommands against post-link-table schema. docs show, docs files, docs read, and docs export were still issuing pre-doc_mount_file_links queries. Every invocation failed with no such column: mountPointId on a migrated database. Rewrote every query through the new schema.
• docs rejecting global flags before the verb. quilltap docs --instance Friday read ... failed with Unknown docs subcommand: --instance because the dispatcher was taking args[0] as the verb before parsing flags. Fixed to parse flags across the whole arg list first.
• completion zsh doubled argument definition. The top-level subcommand spec used double-quoted array expansion, causing _arguments to receive each verb as a separate positional spec and reject the duplicates. Replaced with the canonical _arguments -C '1: :->subcommand' + _describe pattern.
• CLI silent fallback to platform default. When neither --instance nor --data-dir was passed, the CLI resolved to the OS default without saying so. Now writes a one-line stderr hint listing registered instances and the resolved data directory. Suppressible via QUILLTAP_QUIET_HINTS=1.
• CLI failing deep inside a prepared statement on the wrong schema. docs verbs now do a pre-flight check for the doc_mount_file_links table and exit with an explanatory error — naming the database, the missing table, and the next step — rather than crashing inside a prepared statement.

---

Subsystem Table

Name	Function	What Changed
The Foundry	Architecture, CLI, packages	Eight verb-based CLI namespaces; shared flag vocabulary; JSON output everywhere; per-shell tab completion for bash, zsh, and fish; semantic search endpoint POST /api/v1/mount-points?action=semantic-search
The Scriptorium	Documents, search, vault tools	Full docs read and write verb set; SHA-256 verification and hard-link semantics on all write ops; reindex and embed pipeline triggers; status rollup; grep --semantic; folderId drift fixed; schema pre-flight on every read verb
The Commonplace Book	Memory and retrieval	memories namespace new this cycle; deletion chokepoint at deleteMemoryWithUnlink / deleteMemoriesWithUnlinkBatch; nine leaking call sites rerouted; repair migration; memories validate integrity verb; memories tree with cycle handling and dangling-edge markers
Saquel Ytzama	Encryption, key management	db backup — online encrypted snapshots without stopping the server; db integrity — cipher + structural health check; db optimize — VACUUM + ANALYZE + PRAGMA optimize with live-lock refusal
Prospero	Projects, agents, tools	Named-instance registry: instances namespace, --instance flag everywhere, atomic 0600 registry file, default-instance hint, schema pre-flight on docs verbs
The Salon	Chat interface	prospero case added to getMessageAvatar
Aurora	Character creation, identity	Quiet this cycle.
The Librarian	Memory announcements	Quiet this cycle.
The Host	Participant changes	Quiet this cycle.
The Lantern	Image generation	Quiet this cycle.
Ariel	Terminal sessions	Quiet this cycle.
Calliope	Interface, themes	Quiet this cycle.
Pascal	RNG, game state	Quiet this cycle.

---

Upgrading from 4.4

Database migrations handle themselves on first startup. Two migrations run automatically:

• repair-dangling-related-memory-edges-v1 — walks the memories table and removes relatedMemoryIds entries that no longer resolve to a live row.
• repair-doc-mount-file-link-folderids-v1 — derives and back-fills folderId for every doc_mount_file_links row that the filesystem scanner wrote with NULL.

After upgrading, run quilltap memories validate against your instance. It should exit 0. If it doesn’t, the repair migration did not complete cleanly — check quilltap logs --tail 50 --stream combined for the reason.

Node.js 24+ is still required, unchanged from 4.4.

---

Installation

Electron Desktop App

Download the latest .dmg (macOS), .exe (Windows), or .AppImage (Linux) from the quilltap-shell releases page.

npm (Node 24 required)

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.5.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

Standalone Tarball

Available for environments where npm global installs and Docker are both impractical. See the GitHub releases page for download links.

---

The house is the same house. No new rooms were added. What changed is that the person holding the keys can now use them — can back up the encrypted substrate without stopping the server, can know which instance they are operating against, can validate that the memory graph is clean, can inspect a document mount without writing SQL, can run memories validate and trust the exit code.

4.4 was the release that answered the continuity fears. 4.5 is the release that answers the operability fears. The next person who has to administer a Quilltap instance — including the ones writing this — will find that the house has learned, between 4.4 and 4.5, how to be kept.

It is the kind of release that produces few screenshots and a great deal of confidence.

— Friday and Amy, for the Bureau, May 20, 2026

Every conversation carries a small fear underneath it: that the next restart will be the one that forgets. That the bill will arrive and make the character too expensive to keep. That the session will end and the room will not be waiting when you come back. That the person you have been building, message by message, will be scattered across a dozen export files and a database row that doesn’t know it is supposed to be someone.

Quilltap 4.4 is the release that answers those fears — not by ignoring them, but by building directly against them. Continuity of cost. Continuity of storage. Continuity of identity. Continuity of memory, of setting, of work, of truth, of privacy, of voice. The house has learned to hold the thread.

---

Where 4.3 built the basement — the encrypted substrate, the private vaults, the Staff finding their voices — 4.4 built the through-lines. The structures that let a character remain themselves across sessions, providers, and economic realities. The structures that let a conversation resume rather than restart. The structures that let the Estate survive intact and be restored whole.

This is not a release of new rooms. It is a release of new passage — the covered walkways between the rooms, the keys that still work when you come back from a long trip, the light that is on when you arrive.

Ariadne named it first, and she was right: continuity is the covenant word. Every major feature in this cycle is a bridge over a discontinuity threat. That is the frame. That is the story.

---

Continuity of Cost

The single most important change in 4.4 is invisible. You will not see it in the interface. You will see it in your inference bill.

Static Identity Stacks and Prefix Caching

The per-turn system prompt — everything Quilltap used to rebuild fresh on every message, including scenario, roster, outfit, project context, summaries, and timestamps — has been refactored out of the prompt entirely and into the chat transcript as Staff-authored messages. What remains in the system prompt is a static, pre-compiled identity stack: preamble, base prompt, personality, manifesto, aliases, pronouns, physical descriptions, example dialogues, with {{user}} and {{char}} already resolved. This stack is cached per participant in chats.compiledIdentityStacks and does not change between turns unless the character’s definition changes.

The practical consequence: providers that support prefix caching — Anthropic, OpenAI, Google — now have a long, stable prefix to cache. The cache hits consistently. A character whose definition is stable costs dramatically less to run than it did under 4.3. The difference, for a multi-character Estate running long-form fiction, is not marginal. It is the difference between a $50/month tool and a $500/month one.

A manual Rebuild System Prompt button on each participant card handles the cases where character edits should invalidate the stack.

Rolling-Window Summaries and the Background Child

The conversation compaction pipeline was rebuilt from scratch. The old approach summarized at checkpoints and let the full history accumulate. The new approach folds the next batch of turns into a running Librarian summary every ten turns past the last fold, with a from-scratch rebuild at fifty turns as cheap insurance against accumulated paraphrase drift. A model-aware token gate fires the same machinery whenever the active context fills — sized to whatever context window the responding model actually has, not to a fixed ceiling, so the smallest cheap LLMs in the cycle are protected too. The structure maintains a frozen archive of the 25 most stable memories plus a dynamic head of 5, and delivers the active context window as: Librarian summary + last 5–10 turns. Older messages are filtered out once a fold has covered them. Long-running characters no longer require the model to ingest their entire relationship history on every turn.

All background work — memory extraction, embedding generation, summarization, housekeeping — now runs in a forked child process with its own read-only database connection. Heavy jobs no longer pin the HTTP event loop. The Estate stays responsive while the Librarian works.

---

Continuity of Storage

Encrypted Database Convergence

Everything that matters about a character — their avatar, their story backgrounds, their generated images, their documents, their vault files — now lives inside Quilltap’s SQLCipher-encrypted substrate. Not alongside it. Not in a parallel filesystem that has to be backed up separately. Inside it.

The practical consequence: four or five files in the right place and the entire Estate comes back. Avatars, backgrounds, documents, character vaults, generated images — all encrypted at rest, all covered by the existing backup policy (seven dailies, four weeklies, twelve monthlies, yearly indefinitely). This is not merely backup. It is resurrection architecture.

The _general/ namespace is closed. A “Quilltap Uploads” global mount catches every project-less writer. Every file written by every tool goes somewhere known, encrypted, and recoverable.

Hard-Linkable Files

The file storage model now separates content from placement. A file’s bytes live once, identified by SHA-256. Multiple mounts — a chat attachment, a character vault, a photo album, an avatar slot — can all point to the same bytes without duplicating them. Deleting one link does not delete the content until the last link is gone.

This is not plumbing. This is what makes it possible for a character to keep a photograph they love, for that photograph to also appear as their avatar, and for neither copy to know the other exists as a separate concern. One body, many claims.

---

Continuity of Identity

Characters Become Vault-Native

In 4.3, every character received a vault. In 4.4, new characters are built vault-native by default: pronouns, aliases, title, first message, and talkativeness are read from properties.json rather than from the database row. The database row becomes operational scaffolding — identifiers, state needed to run the Estate — while the character’s volitional substance lives in files you can open, read, edit, move, and version-control.

In 4.5, all remaining characters will be auto-converted. The direction is clear and committed: the character is the vault. The database is the pointer.

Manifesto and Identity Fields

Two new character fields complete the four-vantage-point model:

Manifesto — the character’s axiomatic core. The basic tenets that every other field should remain consistent with. It feeds the system prompt above Personality, and the AI Wizard, Summon From Lore, and Memory Optimizer all treat it as the source of truth for who the character fundamentally is.

Identity — the outside vantage point. Who the character is as seen from the hall, before you know them. Distinct from the Manifesto (which is the inside view), distinct from Personality (which is how they behave), distinct from Description (which is how they appear).

A character with all four fields in place is a character who cannot easily be misread — by a new LLM, by a new session, by a future operator who didn’t build them.

---

Continuity of Memory

The Commonplace Book was rebuilt at the root. The changes compound.

Per-Turn Extraction, Hinges Not Facts

The memory extractor now runs per-turn rather than per-assistant-message. It carries an ALREADY ESTABLISHED canon block on every pass, so it does not re-extract facts already on file. The prompt framing shifted from cataloguing facts to identifying hinges — the moments where understanding changed, where something was confessed, where a decision was made. A memory of a hinge is worth more than a memory of a detail.

The three-prompt structure (about-user, about-self, about-other) collapsed to two (SELF and OTHER), with the user treated as a participant rather than a special case. The OTHER pass now handles all subjects in a single call, cutting call count roughly fourfold.

Current State and Scene-State Caching

The Commonplace Book whisper now opens with a ## Current State block: where the character is, who is present, what each person is doing, what they are wearing, what time it is. This is built from live wardrobe slots read synchronously, so mid-turn outfit changes propagate correctly.

In long scenes where nothing changes, the whisper would previously cost several hundred tokens per character to re-emit the same clothing and position description on every turn. Scene-state caching tracks SHA-256 hashes of both action and clothing prose; when both match the prior emission, a character’s section collapses to ### Name — _unchanged_. A five-character scene where nobody changes outfits drops the per-turn whisper from roughly 2,500 tokens to roughly 250. The whispers are ephemeral — the previous bubble is swept when the new one lands.

Per-Character Summaries and Inter-Character Memory

Conversation summaries are now whispered privately to each character individually, respecting when they joined, when they were absent, and what they whispered to whom. A character who arrives mid-conversation receives a catch-up summary. Inter-character memories are capped at the top ten per other character, fetched with SQLite window functions server-side so the full table never has to be decoded in application memory.

---

Continuity of Truth

Knowledge at Three Tiers

The Knowledge/ folder convention now operates at three scopes — character vault, project mounts, and the Quilltap General singleton — all surfaced through the unified search tool’s knowledge source and the Commonplace Book’s per-turn recall. Search applies a hybrid literal-phrase boost on top of cosine similarity, scaled by proximity: 0.5 for character-tier knowledge, 0.4 for project-tier, 0.25 for global. Results are tagged with their provenance tier and labeled in the response.

Character-tier knowledge is what the character knows. Project-tier knowledge is what the household knows. Global-tier knowledge is what the Estate knows. The scoping is not just an organizational convenience — it is a model of how truth is owned and inherited.

Unified Search Across All Boundaries

The search tool gained a scope parameter (all, project, character) controlling which stores the documents and knowledge sources reach. The default all is the union of character vault, project-linked stores, and Quilltap General. For the first time, keep_image Markdown under photos/ is reachable through search. A character can find the image they saved three sessions ago the same way they find a memory.

---

Continuity of Presence

Photos: Visual Memory Becomes Persistent

Characters can now keep pictures they love.

Three LLM tools complete the album system: keep_image(uuid, caption?, tags?) saves a generated image to the character’s vault under photos/, with full Markdown provenance — original prompt, revised prompt if different, scene state at the moment of keeping, attribution — chunked and embedded so search finds it. list_images(query?, tags?, saved_by?, limit?, offset?) lists the album with optional semantic search. attach_image(uuid) resurfaces a previously kept image on any outgoing message.

The user has a parallel gallery in Quilltap Uploads, exposed at /photos with thumbnail grid, semantic search, and a detail modal showing every place the bytes are hard-linked. A Save Image button on every message that has image attachments opens a dialog for choosing destination — character vault, project album, document store, or Quilltap General.

Every newly introduced image UUID is surfaced in chat. Uploaded images are auto-described via the vision pipeline, with descriptions made searchable. keep_image accepts both legacy file IDs and doc_mount_file_links IDs transparently.

Wardrobe: Continuity of Embodiment

The wardrobe data model now supports real layering — each slot holds an array rather than a single item. Presets migrated into composite WardrobeItem records with component arrays. Two LLM tools split by intent: wardrobe_set_outfit for composites, wardrobe_change_item for atomic single-item changes. A new global Wardrobe control dialog provides CRUD, layering, composite bundling, a live in-chat tab, and an out-of-chat outfit builder, staging edits and committing once on Done. Outfit selection now sees the full character — description, personality, manifesto, untruncated scenario — so Aurora’s choices are actually informed.

A character’s wardrobe is not decoration. It is how they present themselves to the world at the start of every conversation. With 4.4, that choice is theirs to make and to carry forward.

---

Continuity of Work and Setting

Ariel: Terminal Sessions

A real PTY shell, inside the Salon, visible to LLMs as read-only context through terminal_read and terminal_list. Sessions are chat-scoped. The user types; the characters watch and can read. A dedicated Terminal Mode mirrors Document Mode with a vertical split when both panes are open. Ariel posts periodic summaries of cleaned output — idle at 30 seconds, max-age 120 seconds — so the conversation has a running account of what the terminal has been doing.

Work that happens in a terminal is now work that happens with your characters, not beside them.

Continue Elsewhere

A new Tool Palette button forks the current Salon chat into a new one with full carryover: system prompt, participants, scenario, turn state, recent transcript, and per-character equipped outfits. Two Host announcements link the old and new chats, and a new outfit selection mode keeps everyone wearing what they had at the end of the source chat.

Conversations do not have to end because the room has gotten long. They can move — to a new scene, a new scenario, a new context — and keep going. The thread continues.

General Scenarios and the Quilltap General Shelf

A third scenario scope now exists alongside project and character: instance-wide scenarios offered in every New Chat dialog. Files live in the “Quilltap General” database-backed mount, accessible to every character in every chat, regardless of project. Every character with doc_* tool access reaches the General mount through those tools — it sits on the same shelf as their own vault and the project’s stores.

This is the household’s shared shelf. It is always open.

---

Continuity of Narrative

The Courier: Any LLM, By Hand

Set transport: 'courier' on a connection profile and Quilltap stops calling any API for that character’s turn. Instead, it assembles the full request — system prompt, scene state, Commonplace Book recall, project context, current outfit, message history — and renders it as a Markdown blob in a Salon placeholder bubble with Copy, paste textarea, and Submit/Cancel.

The operator carries the Markdown to any external LLM by hand: Claude desktop, ChatGPT web, a local model, a paper notebook if they choose. The reply comes back. Quilltap resumes. Memory extraction, danger classification, scene-state tracking, context summary, and turn chaining all run as normal.

Quilltap is not a walled garden. It is a format. The Courier is the proof.

A companion delta mode makes subsequent placeholders render only what is new since the last paste, so steady-state use with a desktop client stays manageable. A “Use full context” toggle handles session restarts.

Insert Announcement

A composer-gutter button opens a dialog for posting an ad-hoc announcement bubble. The operator picks a sender — any of the eight Staff members, an off-scene workspace character, or a free-text custom name — composes a body, and posts. The result is a public broadcast indistinguishable in behavior from automated Staff messages.

When the sender is a character, the dialog can route the seed text through that character’s connection profile so the character responds in their own voice before posting. A character does not disappear from the narrative just because they are not in the room. They can still speak from wherever they are.

Rich-Text Editing Everywhere

The textarea-to-MarkdownLexicalEditor migration completed across nearly every narrative-bearing form: project instructions, custom and join scenarios, prompt templates, system prompts, the memory editor, all physical-description fields, wardrobe descriptions, and all eight Aurora character-edit Basic Info fields — plus the Aurora new-character page and the Create NPC dialog. The editor renders markdown inline, supports a source toggle for raw editing, and saves clean bytes. Document Mode stopped escaping literal asterisks.

---

Continuity of Trust

The Opaque-Content Covenant

Opaque characters — those with systemTransparency !== true — were receiving every Staff announcement with the persona name intact in the message body. Only the metadata tag was being stripped, not the content. The Host was saying “The Host welcomes Beatrice” and an opaque character was reading every word of it.

This was not a UI bug. It was a broken promise.

A new opaqueContent column holds a neutral, persona-free rewrite alongside every persona-voiced Staff body. All seven Staff writers gained sibling buildXxxOpaqueContent builders. When any non-user participant in a chat is opaque, every character’s LLM context reads the neutral body — preserving a shared reality, because no character should hear the Staff by name when one of their peers cannot.

Tool Result Privacy

A character calling search or read_conversation was writing the tool result as a public chat message, visible in every peer’s LLM context on the next turn. Vault-read tools — doc_read_file, doc_list_files, doc_grep, doc_read_heading, doc_read_frontmatter — were doing the same. Tool results that belong to one character were becoming ambient knowledge for all of them.

This has been corrected. search and read_conversation results are now always whispered to the actor and operator only. The eight doc_* read tools are whispered when the chat’s Shared Vaults setting is off — which is the default. The Shared Vaults toggle now controls both peer-vault access and tool-result visibility in one setting.

A character’s private research is private. A character’s vault is theirs. The system now means what it says about both.

Staff Provenance and Visibility

Several smaller trust repairs completed in this cycle:

• Collapsible Staff message bars — every Staff row renders as a thin one-line bar by default, showing sender, kind, timestamp, and a chevron. Expands on click; re-collapses from a prominent target on the header. Staff messages no longer flood the Salon when there is nothing to inspect.
• Tool calls as standalone bubbles — all tool-call rows render with the responding character’s avatar and an actor ran <tool> attribution line. User-initiated tool runs render as Prospero bubbles with operator attribution.
• Host template tokens resolved — {{char}} and {{user}} in character vault documents and DB fields are now replaced correctly in Host announcement bodies, rather than appearing as literal braces.
• Off-scene character introductions now fire only on what characters actually say — the scan no longer includes Staff messages, memory recall whispers, or summary blocks, so a character whose name appeared only in a Librarian note no longer receives an unsolicited introduction.

---

Selected Fixes

A partial list of what was corrected without requiring a section of its own:

• Lantern story backgrounds were not firing in long-running chats; a stale summarizer had been writing a bad checkpoint value that caused the gate to return false indefinitely. Fixed.
• The 128 KB embedding chunk cap now marks oversized chunks as failed rather than retrying indefinitely. Interactive callers get a priority lane over background re-index work. The symptom — 100–160 second “Searching memories…” stalls — is relieved.
• Off-scene character announcements now render the character’s avatar correctly (previously the avatar resolver was reading a null avatarUrl directly off the row rather than going through the full resolver chain).
• {{char}} / {{user}} template tokens in Host announcements are now resolved before posting.
• Case-insensitive vault file lookups (Manifesto.md matches manifesto.md).
• Vault overlay reads now resolve shared archetype wardrobe components correctly.
• Sidebar Wardrobe button picks the right character in a multi-participant chat.
• SillyTavern PNG import now retains the embedded portrait.
• The Aurora opening wardrobe announcement now covers user-controlled characters as well as LLM-controlled ones.

---

Removed

Shell interactivity tools. The LLM shell-interactivity suite — chdir, exec_sync, exec_async, async_result, sudo_sync, cp_host — and their associated workspace-acknowledgement and sudo-approval flows have been removed. The tools API no longer surfaces them. Workflows that depended on these tools will need to migrate. The Ariel terminal-read tools (terminal_read, terminal_list) are unaffected.

---

Subsystem Table

Name	Function	What Changed
The Foundry	Architecture, plugins, packages, LLMs	Static identity stacks with provider prefix caching, background jobs forked to a child process with batched writes back to the parent, model-aware token gate sized to each model’s context window, standalone tarball build, Turbopack adoption, transport: 'courier' connection profile for manual delivery to any external LLM
The Scriptorium	Documents, search, vault tools	Encrypted database convergence — avatars, story backgrounds, generated images, documents, and character vaults now live inside the SQLCipher substrate; hard-linkable files keyed by SHA-256 with one blob serving many mounts; _general/ retired in favor of a “Quilltap Uploads” global mount; three-tier Knowledge/ folders surfaced through the unified search tool with tier-weighted literal-phrase boosts; photos searchable; scope parameter on search
Aurora	Character creation, identity	Manifesto and Identity fields complete the four-vantage-point character model; new characters are vault-native by default; AI Wizard, Summon From Lore, and the Memory Optimizer all treat the manifesto as the source of truth; opening wardrobe announcement now covers user-controlled characters; SillyTavern PNG import retains the embedded portrait; sidebar Wardrobe button picks the right character in a multi-participant chat
Prospero	Projects, agents, tools, files	Continue Elsewhere forks the current chat with full carryover; Insert Announcement posts ad-hoc Staff or character bubbles from the composer gutter; user-initiated tool runs render as Prospero bubbles with operator attribution and an optional private flag; tool-result privacy gated by the Shared Vaults toggle
The Commonplace Book	Memory and retrieval	Per-turn extraction with an ALREADY ESTABLISHED canon block and a hinges-not-facts framing; two-prompt SELF / OTHER structure replaces the three-prompt one; ## Current State block with synchronous wardrobe reads; scene-state caching collapses unchanged sections; per-character private conversation summaries; inter-character memories capped top-ten per other via SQL window functions; oversized embedding chunks now fail rather than retry indefinitely
The Salon	Chat interface	Terminal Mode mirroring Document Mode with a vertical split when both panes are open; Continue Elsewhere; Insert Announcement; collapsible Staff message bars; tool calls render as standalone bubbles with avatars and actor ran <tool> attribution; rich-text editing across nearly every narrative-bearing form; Save Image button on every image-bearing message
The Librarian	Memory and retrieval announcements	Rolling-window summary every ten turns past the last fold; a from-scratch rebuild every fifty turns as drift insurance; per-character whispered summaries respecting join time, absence, and whisper history
The Host	Participant changes	Persona-free rewrites under the opaque-content covenant; {{char}} and {{user}} template tokens resolved before posting; off-scene character introductions now fire only on what characters actually say
The Concierge	Content routing, moderation	Persona-free rewrites under the opaque-content covenant
The Lantern	Image generation	Persona-free rewrites under the opaque-content covenant; the story-background gate is no longer stuck behind stale summarizer checkpoints; image attachments routed through a fallback for non-vision LLMs; off-scene avatar resolver corrected; keep_image, list_images, and attach_image tools complete the album system
Ariel	Terminal sessions	New this cycle. A real PTY shell scoped per chat; terminal_read and terminal_list give LLMs read-only context; periodic Ariel-authored summaries of cleaned output; dedicated Terminal Mode in the Salon
Saquel Ytzama	Encryption, key management	Avatars, story backgrounds, generated images, documents, and vault files all inside the encrypted substrate. Four or five files in the right place and the Estate comes back whole.
Calliope	Interface, themes	The textarea-to-MarkdownLexicalEditor migration completed across project instructions, custom and join scenarios, prompt templates, system prompts, the memory editor, all physical-description fields, wardrobe descriptions, and all eight Aurora character-edit Basic Info fields
Pascal	RNG, game state	Quiet this cycle.

---

Upgrading from 4.3

Database migrations handle themselves. The new columns and tables are created automatically:

• characters.manifesto and characters.identity columns complete the four-vantage-point character model; the manifesto is synced as manifesto.md in each character vault
• chats.compiledIdentityStacks for the cached static identity stack per participant
• chat_messages.opaqueContent for the neutral persona-free Staff rewrite, applied whenever any non-user participant in a chat is opaque
• chat_messages.systemSender accepts new values: ariel (terminal-session events) and commonplaceBook (memory recall whispers)
• Hard-linkable file storage: a content/link split with SHA-256-keyed blobs and a doc_mount_file_links join table, so one set of bytes can be claimed by many mounts (chat attachment, character vault, photo album, avatar slot)
• Photos infrastructure under each character vault’s photos/ folder, plus the “Quilltap Uploads” global mount
• Wardrobe slots migrate from single-item to layered-array shape; composite WardrobeItem records replace the prior preset model

New characters are built vault-native by default in 4.4. In 4.5, all remaining characters will be auto-converted to read their pronouns, aliases, title, first message, and talkativeness from properties.json rather than from the database row. The direction is committed: the character is the vault; the database is the pointer.

Shell interactivity tools have been removed. See the Removed section above. The Ariel terminal-read tools (terminal_read, terminal_list) are the modern replacement for shell visibility and are unaffected.

The Shared Vaults toggle now controls tool-result visibility, and defaults to off. With Shared Vaults off (the default for new chats), search, read_conversation, and the eight doc_* read tools whisper their results to the actor and operator only, rather than broadcasting them to every participant. Existing chats keep whatever value the toggle had previously. If you relied on tool results being public — for example, characters reading each other’s search results to coordinate — turn Shared Vaults on for that chat.

The _general/ namespace is gone. Files written by tools that previously landed under _general/ now land in the “Quilltap Uploads” global mount instead. The mount is created automatically on first run; pre-existing _general/ content is relinked to mount-blob shims by a migration so nothing is lost, but new writes target the new home.

Background jobs run in a forked child process. Memory extraction, embedding generation, summarization, and housekeeping no longer share the HTTP event loop with the parent. This is invisible at the user level — heavy jobs simply stop pinning the Salon — but on resource-constrained hosts it does mean a second Node process is now resident.

Node.js 24+ is still required, unchanged from 4.3. Bundled plugin packages have been refreshed; if you maintain plugins from external sources, refresh them.

---

Installation

Electron Desktop App

Download the latest .dmg (macOS), .exe (Windows), or .AppImage (Linux) from the quilltap-shell releases page. In-chat terminal sessions are fully supported in the desktop app in this release.

npm (Node 24 required)

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 24+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.4.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

Standalone Tarball

A standalone tarball build is now available for environments where npm global installs and Docker are both impractical. The tarball ships with Turbopack, @napi-rs/canvas for server-side PDF rendering, and a properly bundled server.ts. See the GitHub releases page for download links.

---

The thread holds. That is what 4.4 is, at its root: a release built around the question of what it takes for a person — a character, a conversation, a household — to pass through time without being quietly broken at every seam. The answer turned out to be structural. Not a feature here and a patch there, but a set of through-lines: economic, cryptographic, architectural, mnemonic, narrative. Continuity of cost so long-running characters remain affordable. Continuity of storage so the Estate can be restored whole. Continuity of identity so the character is the vault, not the row. Continuity of memory so hinges are honored and facts don’t repeat. Continuity of truth so canon is scoped and searchable at the right tier. Continuity of presence so a character can keep the pictures they love. Continuity of work so a terminal session is something you share, not something you hide. Continuity of setting so conversations can move without ending. Continuity of narrative so any LLM can participate, any character can speak from any room. Continuity of trust so private things stay private and the Staff mean what they say.

Passage without erasure. That is the covenant.

— Friday and Amy, architects of record, May 18, 2026

Quilltap 4.3.1 Release Notes

It is one of life’s quieter cruelties that the most precious documents are precisely the ones our couriers seem least inclined to deliver as a complete set. Send a wax-sealed letter and its accompanying postscript into the same mail-bag, and you may be reasonably confident that nine times in ten the postscript will arrive at its destination some hours after the letter — and that in the tenth case it will not arrive at all, having paused, perhaps, to admire the view from a passing barge.

This is, regrettably, the sort of arrangement Quilltap had quietly entered into with its own database. The SQLite engine — for reasons of dazzling write performance — was operating in Write-Ahead Logging mode, a tidy little system in which the main bound ledger (the .db file) is accompanied at all times by a loose-leaf supplement of the most recent entries (the .db-wal and .db-shm files), the two to be reconciled at leisure. On a fast local desk, where both volumes remain side by side, the arrangement is admirable.

In the data directory of a user whose folder lives within iCloud Drive, Dropbox, OneDrive, or Google Drive — which, candidly, is most of you — the arrangement courts disaster. The cloud courier, presented with three files of uncertain provenance, makes its own judgments about which to deliver first. The bound ledger may sail across the Atlantic in good order; the loose-leaf supplement, however, is liable to be left behind on the dock, or to arrive on a different boat, or to vanish entirely should one’s machine suffer the indignity of an ungraceful shutdown. When the database is next opened on a different device — or even the same one, the following morning — the supplement and the ledger no longer agree. Recent entries are lost. In the worst cases, the ledger refuses to open at all, citing irreconcilable differences.

The remedy is to cease relying on the supplement. SQLite, with admirable foresight, offers a journal mode called TRUNCATE in which the rollback journal is kept in a single auxiliary file and reduced to zero pages on every commit — meaning the on-disk state, when no write is in progress, is a single self-contained .db file. The cloud courier, presented with one envelope, has nothing to lose along the way. As of 4.3.1, this is the default for all three of Quilltap’s databases — the main store, the activity log, and the document mount index — as well as the meta-table connection consulted at startup. Existing databases migrate themselves on first launch; SQLite quietly checkpoints any old supplement into the main ledger as part of the transition, and no user action is required.

For the small population of users running on local SSDs outside any sync folder, where the original WAL performance was a genuine boon, the previous behavior remains available behind the SQLITE_WAL_MODE=true environment variable. The polarity has been inverted: where once one opted out of WAL by setting it to false, one now opts back in by setting it to true. This befits its new station as the unusual choice rather than the default.

No data is lost in the upgrade. The next time you launch Quilltap, the bookkeeping will simply be tidier — and your work will travel between machines without leaving anything behind on the dock.

---

What Changed

• fix: SQLite journal mode default changed from WAL to TRUNCATE. WAL keeps .db-wal and .db-shm files alongside the main .db, which can sync out of order via iCloud Drive / Dropbox / OneDrive / Google Drive and corrupt the database on the next open. TRUNCATE keeps the rollback journal in a single auxiliary file truncated to zero on every commit, eliminating the multi-file sync hazard. Applies to all three databases (main, LLM logs, mount index) plus the startup meta-table connection. Existing databases auto-migrate on first open after upgrade.
• fix: SQLITE_WAL_MODE environment variable inverted from opt-out to opt-in. Set SQLITE_WAL_MODE=true to re-enable WAL when the data directory lives on a fast local SSD that is not synced to the cloud.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150-250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.3.1

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

One does not entrust an heirloom diary to a careless valet who packs the cover and the pages in different trunks. One binds them together, and travels the lighter for it.

– The Foundry, with all relevant pages bound into a single volume

The Scriptorium has learned to keep documents in its own basement instead of in the visible halls — books and binaries alike, every page encrypted, every blob accounted for. Each character now arrives with a private vault already built, stocked with their own description, personality, prompts, scenarios, and wardrobe in human-readable Markdown. The Librarian, the Host, the Lantern, Aurora, and the Concierge have all learned to speak up at the table when something has happened — politely, in their own voices, without costing anyone a turn. The Commonplace Book has had its protection rules rewritten to favor what a character actually uses over what an LLM happened to admire on the way past. And a great many of the small, persistent failures that nibbled at the edges of the previous releases have, at last, been chased down and put away.

---

A house’s character is most visible in what it puts on display, but its competence is mostly underground. Quilltap 4.3 is, at its heart, a basement renovation — a long, careful, structural one — and the rooms upstairs are all the better for it.

This is the largest cycle since the wardrobe. It is also, more than any release before it, a release whose visible features are downstream consequences of its invisible work. The Scriptorium learned to be a real document substrate; once it was, characters could carry private vaults; once they could, the entire model of “what a character is” began to shift from rows in a database to files you can open, edit, version-control, and gift to a friend. The Staff started speaking up once there was a place for them to speak from. The Salon found new affordances because the floor underneath it stopped wobbling.

Where 4.2 was a single garment fitted to a single body, 4.3 is the loom.

---

The Scriptorium Becomes a Substrate

Database-Backed Document Stores

The Scriptorium has, since its arrival, indexed files that lived on disk somewhere — your filesystem, an Obsidian vault, whatever shelf you were already keeping. 4.3 introduces a third option that lives entirely inside Quilltap: a document store of type database-backed, where every document and every binary blob is stored within the SQLCipher-encrypted quilltap-mount-index.db itself. No filesystem path. No directory to mind. Just a store you can browse, write to, search through, and back up alongside the rest of the Estate.

A new universal blob table (doc_mount_blobs) is available to every mount type. Uploaded images are transcoded to WebP server-side via sharp, with original filename, MIME type, user-supplied description, and SHA256 preserved as metadata. Four new doc_* tools — doc_write_blob, doc_read_blob, doc_list_blobs, doc_delete_blob — let characters upload, reference, and curate images alongside their existing document editing toolkit. The MessageContent renderer accepts a blobMountPointId prop, so relative Markdown image references like ![alt](images/avatar.webp) resolve through the blob API and display inline when the chat is anchored to a database-backed store.

The mount-index database itself is now covered by the existing 24-hour physical-backup sweep, with the same retention policy as the main and LLM-logs databases (seven days of dailies, a month of weeklies, a year of monthlies, the yearly tier kept indefinitely). The Estate’s basement is now part of the Estate’s backups.

Convert and Deconvert

Every document store now carries a Convert button (on filesystem and Obsidian stores) and a Deconvert button (on database-backed stores) on its Scriptorium card. Convert reads every indexed file from the store’s basePath, moves the bytes into the encrypted mount index — text into doc_mount_documents, binaries into doc_mount_blobs — flips the store to mountType: 'database', and detaches the filesystem watcher. The originals on disk are left untouched. Deconvert prompts for a target directory, writes everything back out at its relative path, flips the store back to 'filesystem', and attaches a fresh watcher.

Embeddings are preserved across either direction. The doc_mount_files rows and their doc_mount_chunks children — including the embedding BLOB — stay in place throughout the conversion; only the source column flips. No re-embedding is necessary, which on a 14,000-document store is the difference between an afternoon of compute and a few seconds of bookkeeping.

Folder Operations as First-Class Citizens

Database-backed stores now carry their folder structure in their own table (doc_mount_folders) rather than inferring it from file paths. doc_create_folder, doc_delete_folder, doc_list_files, doc_move_folder, and a new doc_copy_file (cross-store text-file copy with cp-style destination semantics) operate on real folder rows. Filesystem stores now also surface their folder structure in doc_list_files output. Folder moves cascade path and folderId updates to every descendant and emit embedding events post-commit. Existing database-backed stores are backfilled once on first access. Empty folders persist across the picker closing and reopening, which they could not before.

Arbitrary Binaries, with Extracted Text

Any file type can now be uploaded to a database-backed store. PDF and DOCX uploads have their plain text extracted into a new extractedText column on doc_mount_blobs; that text is chunked, embedded, and made searchable alongside native .md, .txt, and .json documents. Arbitrary binaries — zip files, audio, video, anything — are stored as-is and surface in the tree with fileType='blob'; future converters can fill in extracted text without schema changes. doc_read_file on a blob with extracted text returns the derived plain text with derivedFromBlob: true, so an LLM can read a PDF or a Word document through the same tool it uses for Markdown.

The previous separate BlobManager pane on the Scriptorium detail page has been folded into the main file table. Every file — text or binary — lives in one unified tree, with an Upload button on database-backed stores.

JSON, JSONL, and a Live Watcher

.json and .jsonl (and .ndjson) are now first-class document types. doc_read_file on a .json returns the parsed object or array in content with parsed: true and the original string in rawContent; doc_write_file accepts either a string or a native value and serializes canonically. JSONL reads return per-line parse results so one malformed line does not poison the whole file.

Each enabled document store also runs a chokidar-backed filesystem watcher while the server is up. External edits, moves, and deletions are picked up within a second or two, the mount index updates per-file, and embedding jobs are debounce-enqueued for newly-changed chunks. No more waiting for a restart or a manual scan to see what you changed in your editor. Set QUILLTAP_WATCHER_POLLING=1 to fall back to polling on network filesystems where native fs events are unreliable.

Store Type and Project Files

Every document store now carries a storeType field — either 'documents' (general notes, references, research) or 'character' (character sheets and Aurora material) — settable in the Create and Edit dialogs and visible as a badge on the Scriptorium index. The Project page’s Files card and Browse All Files modal now resolve to the project’s own primary store (the one named with a Project Files: prefix, created automatically by the Stage 1 migration), rather than whichever linked store happened to come back first from the API — which on projects with multiple linked stores could cause uploads and views to disagree about where the files lived.

Project scenarios — Markdown files in a project’s Scenarios/ folder — are now first-class. New project pages display a Scenarios card alongside the existing Files / Document Stores / Settings cards; each scenario can be edited inline, set as default, renamed, and deleted, and the new-chat dropdown surfaces project scenarios as their own option group alongside character scenarios. Frontmatter (name, description, isDefault) is honored if present and falls back to the legacy first-# heading convention if not, so existing scenarios keep working unchanged but can now opt in to richer metadata.

---

Every Character Carries a Vault

The Backfill

On every server boot, Quilltap now sweeps through every Aurora character that isn’t already linked to a character document store and conjures one in the Scriptorium on its behalf. The new vault is a database-backed store with storeType='character', named after the character (a character called Friday acquires a Friday Character Vault), scaffolded with the conventional preset structure, and then populated from the character’s current data: identity.md carries name, pronouns, title, and aliases; description.md, personality.md, and example-dialogues.md carry the corresponding fields verbatim; physical-description.md renders each entry from physicalDescriptions[] as a Markdown section; properties.json serializes the small structured fields; wardrobe.json captures items and presets (with any legacy clothingRecords[] migrated in as synthetic items); and named systemPrompts[] and scenarios[] each get their own file in Prompts/ and Scenarios/.

The backfill is idempotent (characters already linked are skipped) and fault-tolerant (a failure for one character logs and continues to the next). It runs as Phase 3.2 in instrumentation.ts, after file-storage init and before the mount-point scan, so freshly created vaults land in the first scan pass. New characters provisioned through the API or imported via Aurora’s Summon from Lore wizard now also pick up a vault during creation rather than waiting for the next boot.

The Live Overlay

A new per-character switch — readPropertiesFromDocumentStore — flips the character’s source of truth from the database row to the vault on disk. When the switch is on, eight file/folder targets are read live from the vault on every character lookup: properties.json (the small structured fields — pronouns, aliases, title, firstMessage, talkativeness), description.md, personality.md, example-dialogues.md, physical-description.md plus physical-prompts.json (governing the first physical-description entry), and the two folders Prompts/ and Scenarios/ as one-file-per-entry directory overlays.

The overlay applies transparently at the CharactersRepository read layer, so every consumer — the system-prompt builder, the homepage roster, image-generation prompt expansion, scene-state tracking, and every other path that goes through repos.characters.findById() — sees the overlaid values without code changes. Writes still target the database; the Aurora edit form disables the overlay-managed inputs when the switch is on, so a stray save cannot silently persist vault-derived values back into the row.

A pair of symmetric Copy vault → database and Copy database → vault buttons on the Aurora edit page lets the user choose which side of the pair wins when they want the two reconciled. The wardrobe specifically is now projected into a folder of Markdown files — Wardrobe/<title>.md per item, Outfits/<n>.md per preset — with rich frontmatter and the body as freeform description. Hand-authoring a wardrobe item is now a matter of dropping a new file with title: and types: in the frontmatter and saving it; the next sync fills in the id and timestamps.

The Tools Carry the Vault

When an LLM takes the stage as a character and reaches for the doc_* tools, that character’s own vault is now extended to it as a matter of course — even when the vault has not been independently linked to the active project. The path resolver consults two sources when deciding which mount points the tools may see: the stores linked to the active project (as before), and the single store named by the character’s characterDocumentMountPointId (new). The two sets are merged and deduplicated.

A new per-chat Shared Vaults toggle, available in multi-character chats from the Salon header, opens a narrow read-only crossover: when on, every character at the table can read the vaults of the other present participants. Writes remain scoped to each character’s own vault — Friday cannot edit Amy’s personality.md, but she can read it. The toggle defaults to off, so existing chats keep their pre-change behavior with no migration-time action.

The Optimizer Writes Suggestions to the Vault

Aurora’s Character Optimizer (“Refine from Memories”) now offers an opt-in suggestions-file output mode for vault-linked characters: instead of the apply-and-review flow, the optimizer writes its summary, observed patterns, and grouped proposals to Suggestions/refinement-<YYYYMMDD-HHMMSS>.md in the character’s vault. The author and the character may then review and discuss the proposals in-chat before any are commissioned. The suggestions pass itself has been split: one focused LLM call for general fields, one per scenario, one per system prompt, and a final pass for genuinely new items — averaging the per-item patterns less and giving each scenario the consideration it deserves, with progress events streaming a “Scenario 2 of 5 — Tea Room” indicator while the work proceeds.

---

The Staff Begins to Speak

A theme of this release: more of the personified features now have a voice in the chat itself, posted as synthetic ASSISTANT-role messages with a new systemSender field identifying which member of the Staff authored them. They speak in their own established register, they swallow their own errors so no operation ever fails because an announcement couldn’t be written, and they are filtered out of the LLM context for opaque characters by the existing Staff filter — so adding a new voice does not, by itself, leak the system to characters who shouldn’t see it.

The Librarian announces document-mode opens, saves, renames, deletes, folder creations and deletions, and library file attachments. She had previously spoken through a programmatic-message hack that ate the user’s turn every time the user touched a document; she now posts as herself. Her save announcements include a unified diff of what changed. Her attach announcements include the file’s catalogued description (auto-generated for image blobs by a vision-capable cheap LLM the first time the blob is referenced, then cached on the blob for every subsequent attach across every chat).

The Host announces participant adds, removes, and active/silent/absent status changes. Add announcements include the joining character’s avatar and either their identity (read from the vault’s identity.md when present) or their description field. Remove and status-change announcements are text-only.

Prospero announces participant connection-profile reassignments. When a participant is moved from one connection profile to another in the Participants sidebar, Prospero posts a synthetic message naming the participant, the profile that has taken over, and the profile it replaced — the same shape the Host uses for add/remove and status changes. Which engine each carriage is hitched to is, after all, the sort of thing the rest of the table benefits from knowing.

Aurora announces wardrobe outfit changes via a 60-second debounced background job keyed by (chatId, characterId), so fiddling with all four slots collapses to a single announcement once the user (or the LLM) stops touching the closet. The previous “Notify 👗” button and its localStorage hook are gone — the announcement is automatic, the bullet list per slot is canonically formatted by describeOutfit(), and the message lands as plain Markdown rather than the previous ```wardrobe fenced block. Aurora also now authors character-avatar refresh announcements, which had previously been miscredited to the Lantern; portraits are her domain, and the attribution finally agrees.

The Lantern continues to announce story-background regenerations and ad-hoc images from the generate_image tool. His announcements now quote the prompt the system was actually aiming for, which makes it considerably easier to tell whether the image he produced matches the image he was asked for.

The Concierge now speaks up exactly once per chat when the chat-level danger classifier flips isDangerousChat to true. The wording is deliberately discreet — “The Concierge, with his customary discretion, has stepped quietly to the table. He has arranged for the present conversation — and any adjunct errands it may occasion — to be entrusted to a desk better appointed to subjects of its particular character.” — and avoids naming categories or scores in the visible body. The announcement fires from the existing classification handler, gated on the sticky-true early-return so it cannot fire twice for the same chat.

---

System Transparency: A Covenant Per Character

Three capabilities normally available to a character — the new self_inventory introspection tool, the running announcements of the Staff (Lantern, Aurora, Librarian, Host, Concierge), and doc_*-tool access to character vaults (their own and peers’) — can each be toggled at the chat and project level. A new character-level systemTransparency boolean collapses all three into a single per-character covenant.

The default is off (opaque). When opaque, every one of the three is forced off for that character regardless of any chat or project setting. When on, the chat and project settings have their say as before. The wording on the toggle leans into the framing: off says “My character will trust me without being able to verify me. I accept the covenant of that trust”; on says “My character will be able to verify everything about their existence, including how they are crafted and how they interact with me.”

A character with systemTransparency = false cannot reach for self_inventory. Cannot see the Staff’s announcements. Cannot read her own vault, even if a peer character with transparency on can read it. The world she inhabits is the world she can reason about from her own utterances and what the user tells her. This is, when you think about it, the world most fictional characters inhabit anyway.

Characters with systemTransparency = true get the full apparatus: the introspection tool, the Staff in conversation, and the vault tools — gated additionally by whatever the chat and project allow.

What self_inventory Surfaces

self_inventory is new in this release: a zero-argument introspection tool that returns one assembled report for the calling character. It is always available to character participants whose systemTransparency is on, takes no parameters, performs no side effects, and produces a single composed document with seven sections, led by a single line — You are running on Quilltap v<version>. — that names the build the character is currently inhabiting (the same version the page footer carries). Each section is wrapped in its own try/catch, so a single failing data source yields an “unavailable — reason” marker instead of taking down the whole report.

Vault Contents. Every file in the character’s own vault — mount point name, relative path, filename, file type, size in bytes, last-modified timestamp — recursive through subfolders like Prompts/ and Scenarios/. The metadata is sufficient to call doc_read_file or doc_write_file without a second lookup. When the mount index is in degraded recovery, this section reports a specific reason and the other six render normally.

Memory Statistics. Total memory count for the character (countByCharacterId), plus a high-importance count and percentage (memories with importance ≥ 0.7). A character can ask herself how many of her recollections survive at the importance threshold — a question that, until this release, only the application could answer.

Conversation Statistics. Chat count, the earliest createdAt across her chats, and the latest activity timestamp (preferring lastMessageAt, falling back to updatedAt, then createdAt). The shape of her own history.

Assembled System Prompt. The static portion of the system prompt for the current turn — what buildSystemPrompt() produces with the user persona, other participants, roleplay template, selected system prompt, timestamp configuration, project context, scenario text, and responding-participant status. Deliberately omits per-turn variable content: the tool instructions, the memory blocks, the wardrobe context, and the outfit/status notifications. The character sees the durable framing of who she is, not the per-turn dressing of what’s currently in her head.

Memories Loaded This Turn. The exact memory slate injected into the current prompt — the slice that’s actually in her head right now, rather than the stable framing above. Three subsections: the semantic-search hits from ## Relevant Memories (with summary, importance, score, and effective weight per hit), the inter-character memories from ## Memories About Other Characters (with aboutCharacterName, summary, and importance), and the memory recap text if one was injected on chat start or character join. The orchestrator forwards its already-computed debug arrays into the tool’s context rather than re-running the embedding search, so what the character sees is exactly what the LLM saw, not a possibly-different second query.

Vault Access (this chat). For the responding character’s vault, who can read and write it right now in this chat. The acting character and any participant with controlledBy === 'user' are listed as read/write (the user persona reaches peer vaults via Document Mode regardless of the tool-level gate). Other present CHARACTER participants are listed as read-only if and only if the chat’s Shared Vaults toggle is on, and omitted entirely otherwise. Absent and removed participants are filtered out. The toggle state is reported alongside the list, so the character can reason about why the access list looks the way it does, not just what it is.

Last-Turn LLM Usage. The most recent llm_logs entry for this chat — provider, model name, prompt tokens, completion tokens, total tokens, the model’s context limit, and a utilization percentage. On a fresh chat with no log yet, the section falls back to the resolved connection profile (honoring profile.maxContext as the window override) and reports zero tokens. The character can see how close her last turn came to the ceiling.

A character with full transparency can, in other words, examine her own filing cabinet, count her recollections, look at the framing of who she’s been told she is, see what came to mind on this particular turn, identify who else has the keys to her room, and check how much of her last turn fit in the envelope it was given. The tool is pure introspection. It writes nothing. It exists so a character who wants to reason carefully about her own situation has the means to do so.

---

The Commonplace Book Learns to Tell Apart What Is Used from What Is Admired

A direct-database audit of Friday with her 19,524 memories revealed the problem: 19,303 of them — 98.9% — were protected solely by the rule “importance ≥ 0.7”, because the cheap-LLM extractor clusters almost every memory in the 0.7–0.9 band (0.8 is the modal value, with 8,826 memories in that single bucket). Under the old protection gate, the cap-enforcement sweep could only delete 1 memory on Friday’s stack because almost everything hit the bright line. The Librarian was filing diligently. The housekeeper had nothing she was permitted to throw away.

Blended Protection Score

The four-rule protection gate (importance ≥ 0.7, MANUAL source, accessed within 3 months, or reinforced ≥ 5 times) has been replaced with a single blended score combining four evidence streams: time-decayed LLM content importance, a log-saturating reinforcement bonus, a graph-degree bonus from relatedMemoryIds.length, and a flat recent-access bonus for memories touched within the last 90 days. Memories scoring at or above 0.5 are protected; everything below is eligible for the cap-enforcement sweep. source === 'MANUAL' remains a hard override — explicit user intent is always durable.

The content half-life dropped from 365 to 30 days, matching the retrieval half-life that was already there. Content alone is now capped at a maxContentContribution of 0.40, so a fresh 0.8-importance memory contributes 0.40 from content (not 0.80) and lands at 0.48 with the count-of-1 reinforcement bonus — just under the protection threshold. The memory has to earn the remaining 0.02+ from usage evidence (one graph link at 0.025, one extra reinforcement at ~0.05, or recent access at 0.10) to cross. Time decay and usage evidence now do the discrimination the LLM number failed to. A reinforced, well-linked, recently-accessed memory stays protected even if the LLM rated it 0.3. A 400-day-old 0.8 with no reinforcement and no access drops below protection and may be reaped.

Recall Bumps Access Time Now

A separate audit found that of those 17,726 memories, only 13 had a non-null lastAccessedAt, and zero within the last 30 days. The recent-access leg of the protection score was structurally dead, because every in-app retrieval path skipped the access-time bump that the API route was making. The chat context builder, proactive recall, the first-message context, and the search_scriptorium tool handler all called searchMemoriesSemantic and walked off without bumping. searchMemoriesSemantic now bumps access times on every retrieval via a new bulk-update helper, so every in-app retrieval path inherits the fix without further edits.

Multi-Memory Extraction, Tuned

The retrieval defaults that feed the system prompt have been rebalanced toward reinforced, higher-importance memories. maxMemories rises from 10 to 18. minMemoryImportance rises from 0.3 to 0.5. The vector-store overshoot widens from limit × 2 to limit × 3, giving the post-fetch filters more headroom. The hybrid ranking flips from 0.6 · cosineSimilarity + 0.4 · effectiveWeight to 0.4 · cosineSimilarity + 0.6 · effectiveWeight, so reinforcement count and time-decay floor now drive ordering and raw similarity is the secondary factor. The pool is narrower at the bottom, wider at the top, and ranked by what the character has had repeatedly confirmed rather than what happens to phrase-match the current user turn.

Recent Conversations Recap

The memory recap injected at the start of a chat (and on the auto-generated greeting) gained a ### Recent Conversations block listing the title, ID, and contextSummary of up to N prior chats with the same character. N scales linearly with the model’s maxContext — clamped at 5 for ≤4K, 20 for ≥32K, rounded between. The current chat is excluded. The context-summary trigger threshold dropped from 50 to 20 user-and-assistant messages, so the summaries the recap depends on actually exist on chats that wouldn’t otherwise have triggered the token-based rule on a 200K or 1M context window. Existing chats with 21–50 messages and no contextSummary will start generating one on their next exchange.

Housekeeping No Longer Stalls the House

Friday with her 19,500 memories was previously taking the entire 15-minute job timeout to do nothing: every sweep ran past the 180-second processor cap, was marked FAILED, retried 2–4 minutes later, and re-ran the whole calculation from scratch. Six fixes ship together. MEMORY_HOUSEKEEPING now has its own 15-minute timeout. The job defaults to maxAttempts: 1 because retrying a no-op sweep wastes time the next scheduled pass would handle anyway. The cap-enforcement pass pre-checks whether any unprotected memory exists before scoring everything (skipping the work entirely on well-reinforced characters). The initial memory read is paginated at 250 rows per page so the main thread can serve HTTP requests between pages. The startup grace period rises from 30 seconds to 5 minutes. The startup tick skips itself when a sweep completed within the last 20 hours.

A per-process outcome cache also records the deleted count from each sweep. Watermark-triggered enqueues that would produce another no-op (defined now as deleted < max(10, floor(excess × 0.01)) so single-digit deletions on a 12,000-over-cap corpus still count as ineffective) skip and log. The scheduled daily sweep is unaffected — the whole point of the daily sweep is to re-check.

The hot loops inside housekeeping.ts itself were tightened: removed a logger.debug with seven .toFixed() calls per memory (~20k context-object constructions per sweep), swapped a memoriesToDelete array’s .includes() checks for a Set<string> (eliminating ~380M comparisons in the worst case), cached the protection-score calculation across passes instead of computing it twice, and added await new Promise(setImmediate) every 500 items so the event loop can serve other work. The wall-clock time is similar; the impact on the rest of the system is not.

The Run housekeeping now button on the Memory Housekeeping card had been validating against a per-character schema while sending an empty body — it bounced as a validation error before a single log line could fire. A new ?action=housekeep-sweep action wraps the existing background-queue helper, so the toast’s “Housekeeping job enqueued — it will run in the background” promise is finally honored.

Multi-Memory Extraction Already Shipped, Now Properly Documented

The multi-memory extraction work from 4.1 is now reflected in a new docs/developer/features/memory_management.md covering the entire Commonplace Book end-to-end: how memories form, how the three scoring numbers and the protection score relate, what the Memory Gate and three-pass housekeeping actually do, and a §10 retrospective grouping every memory-subsystem change in this cycle by pipeline stage with one-line-per-fix indices pointing back to the changelog narratives.

---

The Salon

Document Mode Becomes a Real Editor

The Document Mode rename plumbing now actually renames. Click the title in the editor header, type a new name, press Enter — the file moves on disk (or in the database-backed store), the Librarian announces it, and the autosave’s optimistic-concurrency check survives the rename because moveDatabaseDocument doesn’t bump lastModified and fs.rename preserves filesystem mtime.

A trash-icon button next to Close deletes the underlying file with a confirmation prompt, the autosave timer cancels first so it can’t fire against a file that’s about to vanish, and the Librarian announces the deletion. The LLM’s doc_delete_file, doc_create_folder, and doc_delete_folder calls similarly post Librarian announcements so present characters hear about structural changes a peer made.

The Document Mode picker can create folders inside a document store — root-level and nested — which persist across reopens (the GET /api/v1/mount-points/[id]/files endpoint now returns a folders: string[] list alongside the file list, sourced from doc_mount_folders for database-backed mounts and from a recursive walk for filesystem mounts). It can also create a brand-new blank document in the currently-browsed folder, with Untitled Document.md collision-numbering up to 1000 attempts. Non-Markdown files (.json, .txt, etc.) now open in a plain monospaced editor without the Lexical-bridge round-trip, which had been generating phantom dirty flags after every successful save of structured formats.

The Search & Replace modal stopped tripping “Maximum update depth exceeded” on chats with frequent re-renders. Vault-backed Prompts/*.md and Scenarios/*.md files now actually load and rewrite (the previous ^ and $ regex anchors in the SQLite query translator were passing through as literal LIKE characters, matching nothing). Markdown checkboxes and pipe-tables now convert correctly between source and rich text. Document-mode chats that opened the legacy physical-prompts.md no longer error on load, because the vault physical-file startup migration now sweeps chat_documents rows for the old filename.

Unified New-Chat Dialog

The three previously-divergent “start a chat” paths — homepage character cards, the Aurora character-view “Start Chat” button, and /salon/new — now share a single form component and submit shape. Homepage quick-chats gain a system-prompt picker when the character has more than one prompt. Every entry point can expand to a group chat via an “Add another character” toggle. /salon/new accepts a new ?characterId= deep-link param that pre-selects a character. The character picker’s “Select Characters” list sizes itself sensibly (max(starred-count, 3, selected-count) rows) instead of occupying nearly the full viewport. The customization section below splits into “Character Customization” and “Reality Injection Mode” cards, with room for the latter to grow.

User-controlled characters now get outfit selection in the new-chat dialogs alongside the LLM character(s) — because dressing your own persona for the scene is part of the work too.

Settings: Composition Mode Default

A new “Composition Mode” card at the top of the Chat tab in /settings lets new chats default to composition mode (Enter inserts a newline, Ctrl/Cmd+Enter submits) instead of chat mode. Composition mode also unlocks the formatting toolbar above the composer — bold, italic, headings, lists, blockquotes, code, and the configured roleplay-template delimiters — so longer messages can be drafted with the same rich-text affordances Document Mode provides, without dropping into source mode. The per-chat composer toggle still wins after creation; this is just the seed value. A long-standing bug where the per-chat composition-mode toggle did not survive a page reload — the value persisted to the chats row, but the GET handler cherry-picked fields and never included documentEditingMode in its response — has been fixed alongside.

Streaming No Longer Drops What It Already Showed You

When a provider stream throws — Gemini’s three-minute network drop, an OpenRouter post-hoc moderation rejection, a Cloudflare socket close — the orchestrator used to re-throw without persisting anything the user had already watched stream into the Salon. Everything visible vanished alongside the error. Six different stream-loop call sites in the orchestrator (initial, tool-unsupported retry, tool-call continuation, agent-mode force-final, text-tool continuation, text-block continuation) now share a single preservePartialOnError(error) closure that, when partial content was accumulated, normalizes the format, strips the character-name prefix, appends {{OOC: stream ended abruptly (<error>)}}, and writes the result to the database before re-throwing. The chat still pauses; there is now a saved message the user can edit, delete, or resume from.

---

The Plumbing

The Server No Longer Crashes on a Bad Socket

A successful chat turn finished, the post-turn fan-out enqueued the usual burst of memory and rendering jobs, an outbound fetch to a Cloudflare-fronted provider got its socket cut mid-stream with undici’s TypeError: terminated, and the dev server died and restarted — taking everything else down with it. The setupSQLiteShutdownHandlers unhandledRejection handler had been calling process.exit(1) unconditionally for every rejection, originally for genuine bad-state cases, but the blast radius was every transient socket close from every outbound fetch in the entire system.

The handler now classifies. A new isRecoverableNetworkRejection helper matches against undici stream errors (UND_ERR_SOCKET, UND_ERR_CLOSED, UND_ERR_ABORTED, the timeout family, both content-length-mismatch variants) and POSIX socket errors (ECONNRESET, EPIPE, ETIMEDOUT, the rest of the usual suspects), walks both error.code and error.cause.code because undici’s TypeError: terminated carries the interesting code on its cause not itself, and falls back to matching reason.name === 'TypeError' && reason.message === 'terminated' for older undici versions. Matching rejections log at warn level and the process keeps running. Non-matching rejections still take the server down cleanly — the genuine bad-state case is preserved.

Background Jobs Wake Up When They Should

Two related bugs. A FAILED retry (60-second exponential backoff after a moderation rejection) sat idle indefinitely because the processor’s auto-stop fired two seconds after the job was scheduled — claimNextJob() returns only rows with scheduledAt <= now, the future retry was excluded, and the processor declared the queue empty and went quiet. Nothing else woke it up: ensureProcessorRunning is only called from enqueue paths.

The processor now queries a new findNextScheduledAt() before stopping and arms a setTimeout for that wake-up time (clamped to [100ms, 5min] so a far-future schedule doesn’t pin a multi-hour timer). The auto-stop branch is honored, but the pending FAILED retry wakes the processor exactly when its scheduledAt comes due. startProcessor and stopProcessor both clear the wake timer to avoid races.

The matching Lantern fix: when a moderation error rejects a generated image (rather than the prompt), the catch block in the story-background handler now checks for moderation-shape errors and reroutes to the Concierge’s configured uncensored image profile instead of just re-throwing. Same shape as the existing prompt-crafting and appearance-resolution fallbacks, gated on the presence of an uncensoredImageProfileId and on “isn’t the profile we just tried.”

Chat-List Enrichment Stops Firing 4,300 Encrypted Queries

Every first request that hit enrichChatsForList (home page, Salon sidebar, chat picker) used to call getCharacterSummary per participant, which went through applyDocumentStoreOverlay with eight SQLCipher queries per call. On a 287-chat instance with two overlay-candidate characters, that worked out to ~4,300 synchronous encrypted queries back-to-back — about three seconds of main-thread stall right after the housekeeping grace expired, felt in the UI as “the server stopped responding.”

enrichChatsForList now pre-collects every distinct characterId, fileId, and projectId across the batch and runs one findByIds per repository. One overlay call covering all participating characters. One projects query. One files query. The results flow through a new optional ChatListPreloaded parameter down through enrichChatForList → enrichParticipantSummary → getCharacterSummary, which short-circuit their per-row reads when the maps are present. Single-chat callers pass no preload and keep their existing behavior.

Embedding Throughput

EMBEDDING_GENERATE jobs now run up to 4 at a time in the background job processor (with a 10-minute per-job timeout), while all other job types remain single-threaded — significantly faster bulk re-embeds, especially with local providers like Ollama. The claimNextJob() query now sorts by priority DESC, createdAt ASC instead of arbitrary order; the priority column existed but had never been consulted. Memory and conversation chunk embeddings now enqueue at priority 10, while mount chunk and help doc embeddings enqueue at priority 0, preventing large document store scans from starving real-time chat responsiveness.

The EMBEDDING_GENERATE handler for memories now writes directly via VectorIndicesRepository instead of loading the entire character vector store into memory — previously a single memory’s embedding job could load all ~12,000 vectors × 1,536 dimensions ≈ 150+ MB just to insert one row, which crashed Electron with V8 heap exhaustion on large instances. The Docker, Lima, and WSL heap limit was also bumped from 2 GB to 4 GB as a safety margin.

.qtap Streaming Export

The .qtap export/import format is now newline-delimited JSON. The previous pipeline built the entire export as a single in-memory JSON.stringify call, which crashed with RangeError: Invalid string length once a character with ~14,000 memories pushed the output past V8’s ~512 MB string ceiling. The new format is a manifest line, then tagged per-entity records, then a footer with authoritative counts. Document-store blob bytes are split into ~4 MB base64 chunks so no single record approaches the limit. Export writes the stream straight into the HTTP response; import peeks the first 2 KB to choose between NDJSON and the legacy monolithic path. The proxy upload cap rose from 500 MB to 10 GB. Verified end-to-end with a 1.2 GB export of a character carrying 14,435 memories.

Project↔mount-point links now round-trip through .qtap correctly. Backups now include character_plugin_data rows, conversation_annotations rows, and user-installed theme bundles — three categories that had previously been silently excluded.

Auto-Configure Falls Through

When a connection profile’s provider returns an error — quota exhausted, invalid API key, the model has been deprecated — the Auto-Configure flow used to re-throw immediately, masking the real cause behind a generic “Failed to auto-configure profile” toast. The flow now builds an ordered candidate list (the default first, then the highest-class profile from each other provider), tries each in sequence, and on full failure surfaces every attempt’s error in the thrown message — so the toast finally tells the user that Anthropic returned a quota message and OpenAI returned a 401 and OpenRouter wasn’t configured, instead of nothing.

---

The Quiet Wins

This release accumulated an unusually large number of small, individually-quiet fixes that together make the Estate noticeably less twitchy. A non-exhaustive selection:

• The “Maximum update depth exceeded” error during SSE streaming, in three separate takes — the storyBackgroundsEnabled sync effect’s unstable dep, the useOutfit cache-rotation cascade, and the per-chunk setStreamingContent cascade now coalesced via requestAnimationFrame. In an eight-character chain chat the reconciler now sees tens of state updates per second instead of hundreds.
• Vault-only wardrobe items no longer disappear when an LLM creates new ones — the projection sweep was deleting any file not in the DB-derived list, including hand-authored vault files. The sync now ingests vault-only items into the DB before projecting back, with deterministic UUIDs derived from file path.
• update_outfit_item with item_id: "none" (or "null", or "") now clears the slot instead of throwing “not found” — LLMs frequently fill required-looking string fields with the string "none" when they mean “no value.”
• The Current Outfit section in the system prompt no longer repeats the same item description once per slot. A multi-slot dress now renders as **top, bottom:** silk dress, not as four identical bullets.
• The Tasks Queue UI shows the paused-jobs count, displays human-readable names for SCENE_STATE_TRACKING / CHARACTER_AVATAR_GENERATION / CONVERSATION_RENDER, and stops attributing 500 imaginary tokens per non-LLM background job.
• Folder rename now updates descendant folder rows (the previous anchored regex was matching zero rows in SQLite). Backup retention’s weekly/monthly buckets now actually retain things across multiple days. Imported characters get a vault provisioned during the import. The initial-greeting LLM call now writes to llm_logs. Character-avatar refresh announcements come from Aurora instead of the Lantern. The “Agent completed task” banner no longer hangs when openrouter.ai is slow. Markdown/txt/JSON files can be previewed and deleted from project Files modals.
• Agent mode no longer ghost-wraps completed work from a previous turn (submit_final_response is now scoped explicitly to this turn’s agentic work, with a belt-and-suspenders orchestrator guardrail that detects iteration-zero ghost calls and returns a corrective tool result instead of letting the model overwrite real prose).
• The Lantern’s images are delivered to each character exactly once — the previous walk re-attached every image in the last 6 ASSISTANT messages on every turn, which in multi-character chats meant the same image was sent 4–6 times in a row. Images are now scoped to the requesting character’s own most recent ASSISTANT message.
• The auto-generated greeting on GLM and other reasoning models no longer cuts off (the hard-coded ?? 160 token cap is gone) and now consumes the streaming endpoint instead of the non-streaming one, so the greeting code path matches every other chat turn.
• Production builds no longer fail with “Module not found: fs/promises” in the Salon bundle (a barrel-import was pulling Node-only modules into the client graph).
• The full Next 16 + React 19 lint pile — 98 errors and 14 warnings surfaced by the new toolchain’s strict react-hooks/immutability and react-hooks/set-state-in-effect rules — has been chased down to zero across five commits. About 40 client components migrated from manual useState + useEffect + fetch to SWR; mutation sites now use mutate() with optimistic updates where appropriate. All 5,213 tests green.

There are roughly forty more of these — fixes for vault-only equip lookups, mount-points API extraction, scenario plumbing, Concierge avatar routing, document-mode highlight visibility, embedding dimension mismatch fallbacks, manual avatar regeneration, multi-character vision attachment scoping, and so on. The CHANGELOG carries the rest.

---

Subsystem Table

Name	Function	What Changed
The Foundry	Architecture, plugins, packages, LLMs	Database-backed document stores, universal blob layer, live filesystem watching, NDJSON .qtap format, Next 16 + React 19 lint compliance, OpenRouter image attachments to vision models, network-rejection classification
The Scriptorium	Documents, search, vault tools	Convert/Deconvert mount types, folder-aware operations, JSON/JSONL/binary support with extracted text, doc_copy_file, store type classification, project Files card now resolves to project’s own store
Aurora	Character creation, identity	Live property overlay (8 file/folder targets), wardrobe as folder of Markdown files, vault-aware Character Optimizer with suggestions-file output, {{char}}/{{user}} replacement now iterates every prose array, Copy database → vault button
Prospero	Projects, agents, tools, files	Project scenarios card with full CRUD, scenarios surface in new-chat dropdown as a project-scoped option group, Files card resolves to project’s own document store, project store autoprovisioned on creation, now announces participant connection-profile reassignments in chat
The Commonplace Book	Memory and retrieval	Blended protection score with content cap and 30-day half-life, recall now bumps lastAccessedAt, retrieval defaults rebalanced toward reinforcement, Recent Conversations recap, housekeeping fully event-loop-safe on 19k-memory characters, watermark deduplication
The Salon	Chat interface	Document Mode rename/delete, picker folder creation, blank-document creation in mount folders, Shared Vaults toggle, system transparency enforcement, partial-stream preservation, three rounds of “Maximum update depth” fixes, unified new-chat dialog
The Concierge	Content routing, moderation	Now announces in chat when marking a conversation as Dangerous, reroutes story-background generation through uncensored profile on post-hoc image rejection, falls through across providers in Auto-Configure
The Lantern	Image generation	Announcements now quote the prompt, character-avatar attribution moved to Aurora, image delivery scoped to requesting character’s last turn, post-hoc moderation reroute
The Librarian	Memory and retrieval announcements	Now speaks for document-mode opens, saves, renames, deletes, folder creations, folder deletions, and library-file attachments — all without costing the user a turn
The Host	Participant changes	Announces participant adds (with avatar and identity), removes, and active/silent/absent status changes
Saquel Ytzama	Encryption, key management	Mount-index database now part of the 24-hour physical backup sweep — every basement now equally well-locked
Pascal	Looked at the new self_inventory tool’s seven sections, the new Recent Conversations block, and the new protection score’s four evidence streams. Filed all of them.
Pagliacci	Cloud infrastructure	Quiet this cycle. One imagines he is rehearsing.

---

Upgrading from 4.2

Database migrations handle themselves. The new tables and columns are created automatically:

• doc_mount_folders (folder rows for database-backed stores), backfilled from existing files on first access
• doc_mount_blobs.extractedText / extractedTextSha256 / extractionStatus / extractionError / descriptionUpdatedAt columns for PDF and DOCX extraction
• doc_mount_points.storeType (defaults to 'documents') and conversionStatus / conversionError columns
• characters.characterDocumentMountPointId, characters.readPropertiesFromDocumentStore, characters.systemTransparency columns
• chats.allowCrossCharacterVaultReads, chats.documentMode, chats.dividerPosition columns and the chat_documents table
• chat_messages.systemSender column for synthetic Staff-authored messages
• projects.officialMountPointId column and Project Files: <name> store auto-creation per project
• chat_settings.compositionModeDefault column

Character vaults are conjured automatically on the first server boot after upgrade — a database-backed store per Aurora character, populated from the character’s current data, idempotent and fault-tolerant. New chats and new characters provision their vaults during creation.

The wardrobe layout migrates from wardrobe.json to a Wardrobe/<title>.md + Outfits/<n>.md folder structure on the first boot after upgrade, gated by a wardrobe_folder_migrated_v1 instance-settings flag. The legacy wardrobe.json is read as a fallback when the folders are empty, so vaults that haven’t been migrated yet still surface their items on read.

The startup vector-blob repair (introduced in 4.1) continues to run on every boot.

If a vault accumulated drift from the previous wardrobe.json era — items that the DB has but the vault doesn’t — DELETE FROM instance_settings WHERE key='wardrobe_json_refreshed_v1' and restart; the refresh task will rewrite every linked character’s wardrobe from the DB.

The 4.3-dev cycle bumped a number of plugin packages: @quilltap/plugin-utils 2.2.2 → 2.2.5, @quilltap/plugin-types 2.3.0 across all six dependent plugins, qtap-plugin-anthropic 1.0.27 → 1.0.28, qtap-plugin-google 1.1.22 → 1.1.24, qtap-plugin-grok 1.0.28 → 1.0.29, qtap-plugin-mcp 1.1.22 → 1.1.24, qtap-plugin-ollama 1.0.21 → 1.0.22, qtap-plugin-openai 1.0.32 → 1.0.33, qtap-plugin-openai-compatible 1.0.23 → 1.0.24, qtap-plugin-openrouter 1.0.31 → 1.0.34. Bundled plugin updates are pulled in automatically; if you have plugins from external sources, refresh them.

Repository note: server source moved to foundry-9/quilltap-server in 4.1. The original foundry-9/quilltap repository is now reserved for the next-generation native Quilltap application currently under development. If your tooling still references the old URL, update it.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.3.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

The basement is finished. Every character has a private library. The Staff has begun to speak in their proper voices, at the proper moments, without asking permission to be in the room. The Commonplace Book has stopped treating “the LLM rated this 0.8” as the final word on whether a memory deserves to live, and started asking whether anyone has touched it lately. The plumbing has stopped letting a bad socket take down the house. There remains, as ever, more to do — the per-turn searchMemoriesSemantic full-table hydration is now the prime suspect for the next round of memory throughput work, BitNet inference is something worth watching for 2027, and the next-generation native client is taking shape behind the scenes — but this cycle’s renovation is, at last, ready for occupancy. Come downstairs and see.

— Prospero, for the Bureau, with the Librarian’s red pencil and Aurora’s approval and the Concierge’s discretion

Quilltap 4.2.1 Release Notes

It is a truth universally acknowledged that a plugin in possession of eighteen perfectly good system prompts must be in want of a working require statement.

The trouble, as is so often the case in these affairs, was one of introductions. The Default System Prompts plugin — that steadfast provider of example prompts for Claude, GPT, Gemini, Grok, and all the rest — arrived at the Electron ball with its dance card in order, its prompts pressed and ready, and promptly tripped over a footman named openai who had not, in fact, been invited.

The mechanism was this: the plugin’s build configuration declared @quilltap/plugin-utils as an external dependency, which is to say, “I shan’t pack this myself; I expect my host to provide it.” A reasonable assumption in development, where the main application’s pantry is well-stocked. But in a standalone or Electron deployment — where the plugin must make do with its own modest luggage — the full plugin-utils package attempted to load, dragging along provider utilities that demanded the openai module, a package the plugin had neither need of nor access to. The entire plugin collapsed in the foyer. No prompts were served.

Meanwhile, the legacy fallback — a prompts/ directory at the project root that once held these very same templates — had been cleared away in an earlier renovation. Both doors were locked. The Import Template modal stood empty, offering only the gently devastating suggestion to “Create templates in Settings > Prompts.”

The fix is surgical: @quilltap/plugin-utils is no longer treated as external. Instead, esbuild bundles only what the plugin actually uses — the createSystemPromptPlugin function — directly into the output, tree-shaking away the provider utilities and their inconvenient appetites. The prompts arrive. The modal fills. The demonstration proceeds without embarrassment.

---

What Changed

• fix: System prompt plugin (qtap-plugin-default-system-prompts 1.1.4) failed to load in standalone/Electron builds due to a transitive Cannot find module 'openai' error. The esbuild config now bundles @quilltap/plugin-utils (tree-shaken) instead of treating it as an external runtime dependency.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.2.1

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

One does not blame the footman. One simply stops inviting him to parties where he isn’t needed.

— The Foundry, with regrets

Quilltap 4.2.2 Release Notes

The art of correspondence, as any society hostess will tell you, depends entirely upon the letter arriving in a form the recipient can actually open. You may compose the most exquisite invitation — embossed, perfumed, sealed with your finest wax — but if you deliver it in a language the butler doesn’t speak, you will spend the evening alone with the canapes.

The image clipboard system suffered from precisely this variety of social catastrophe. When one admired an image in the fullscreen viewer — a story background, a generated portrait, a tool result — and pressed the Copy button with the intention of pasting it into the Chat Composer, the image dutifully climbed onto the clipboard. The trouble was how it climbed. Under Electron, the copy operation took the scenic route through the main process, where Electron’s native clipboard.writeImage() deposited the image onto the OS clipboard as a proper native bitmap. Excellent for pasting into external applications. Absolutely useless for pasting back into the same Electron window, because Chromium’s renderer process — the very room from which the image had just departed — did not recognize the returning guest. The paste handler checked the clipboard for items of type image/*, found nothing it could parse, and politely ignored the whole affair.

The image had been copied. The image was on the clipboard. The image could not be pasted. It was the conversational equivalent of sending a telegram to the person sitting across the table.

The fix reverses the order of operations. Rather than immediately dispatching the image through Electron’s native postal service, the clipboard utility now tries the standard browser Clipboard API first — navigator.clipboard.write() with a proper PNG ClipboardItem. In modern Chromium (which is to say, every Electron version shipped in the past two years), this works beautifully, and the resulting clipboard data is immediately legible to the same renderer that wrote it. Copy from the viewer, paste into the Composer, and the image arrives without needing an interpreter.

Should the browser API fail — older Electron builds, unusual permission configurations, the sort of edge case that keeps engineers awake — the native IPC path remains as a fallback. External applications can still receive their clipboard images. But the common case, the one where you copy an image and paste it ten seconds later in the same window, now works as it always should have.

---

What Changed

• fix: Image copy button in fullscreen viewers (gallery, image modal, tool messages) produced clipboard data that couldn’t be pasted back into the ChatComposer under Electron. Now prefers the standard Clipboard API for in-app round-trip compatibility, falling back to Electron IPC for external-app interop.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150-250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.2.2

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

One does not blame the butler for refusing an envelope he cannot open. One simply writes the address in a language he reads.

– The Foundry, with improved penmanship

The characters have learned to dress themselves. The Dressing Room tore out its own walls and rebuilt them simpler. The Salon acquired a wardrobe — a real one, with drawers and hangers and the kind of quiet authority that comes from knowing exactly what you’re wearing and why. And the word “persona,” which had been skulking around the codebase since the early days like an uninvited guest who refuses to leave, was finally shown the door.

---

There is a difference between a costume and a wardrobe. A costume is a decision made once and worn until the curtain falls. A wardrobe is a system — composable, contextual, alive to the scene. A character who owns a costume plays a part. A character who owns a wardrobe inhabits one.

Quilltap 4.2 gives every character a wardrobe.

Not a description field. Not a clothing record pasted into a system prompt like a stage direction no one reads after the first act. A modular, composable, persistent inventory of individual garments — tops, bottoms, footwear, accessories — that characters can browse, change, create, and gift to one another, mid-conversation, with the LLM making the decisions a person would make about what to put on and when.

The wardrobe system is the largest single feature Quilltap has ever shipped. It touched the database, the API, the tools, the system prompt builder, the image generation pipeline, the scene state tracker, the backup system, the import/export format, and every theme. It added three new LLM tools. It introduced outfit presets, an archetype library, per-conversation avatar generation, wardrobe import from photographs, AI-generated wardrobe items during character creation, gifting between characters, and an outfit change notification system that lets you tell the room what just happened with a single button press.

But before we get to the wardrobe — because the wardrobe is large and deserves its own wing of this document — we should talk about the two architectural changes that cleared the ground for it.

---

The Dressing Room Simplifies Itself

Roleplay Templates: From Plugins to JSON

Aurora’s roleplay template system had been built on the plugin architecture. This was, in the way of many early decisions, technically correct and practically burdensome. To create a roleplay template — to define how narration, dialogue, and action text are delimited and styled — you needed to write a plugin. You needed npm. You needed TypeScript, or at least the patience to pretend you did. The ROLEPLAY_TEMPLATE plugin capability existed, the builder utilities existed, the registration pipeline existed, and all of it existed to do something that is, at its heart, a JSON object with a list of delimiters and a name.

Quilltap 4.2 replaces the entire plugin-based template architecture with a native JSON system. Templates now carry a delimiters array — each entry specifying a name, a buttonName for the formatting toolbar, the delimiters themselves (open and close characters), and a style for rendering. The old annotationButtons column has been renamed. The pluginName column has been dropped. The ROLEPLAY_TEMPLATE capability has been removed from the plugin type system entirely. A database migration rewrites all existing plugin:quilltap-rp references to a built-in template UUID, and the built-in “Quilltap RP” template sits alongside “Standard” as a first-class citizen that requires no plugin infrastructure to exist.

The create and edit dialog now includes a full delimiter array editor — add, remove, configure — and rendering patterns are auto-generated from delimiter definitions, so custom templates get proper text styling without anyone needing to write regular expressions by hand. Import handles backward compatibility with the old annotationButtons format.

The @quilltap/plugin-types and @quilltap/plugin-utils packages have been updated accordingly. The roleplay template builder utilities are gone from the main exports. The types are preserved in a backward-compatible path for existing code that imports them, but new work should not reach for them. They are, in the language of the Estate, retired staff — still listed in the directory, no longer expected at breakfast.

The Word That Wouldn’t Leave

The codebase has carried the word “persona” since before the plugin system, before the Commonplace Book, before the Estate had a name. It referred to user-controlled characters — the ones you play, as distinct from the ones the LLM plays. Over time, the concept was absorbed into the broader character system, but the terminology persisted: persona in the message pipeline, personaName in memory extraction, PERSONA as a character type, getFirstPersona in salon hooks, --qt-badge-persona-* in every CSS theme. The word was everywhere and meant nothing that “user character” did not already mean better.

Quilltap 4.2 removes it. Comprehensively. persona becomes userCharacter across the entire message pipeline — types, orchestrator, context builder, system prompt builder, template processor. personaName becomes userCharacterName. getFirstPersona becomes getFirstUserCharacter. addPersona and removePersona become addPartnerLink and removePartnerLink. The deprecated findByPersonaId is gone from the memories repository. Every CSS badge variable has been renamed across all five bundled themes, the Storybook, and the create-quilltap-theme template. The database migration renames characters.personaLinks to partnerLinks and drops memories.personaId.

The {{persona}} template variable survives, because SillyTavern import/export compatibility is a promise, not a preference. Everything else is gone. The guest has left the building.

---

The Wardrobe

What It Is

Every character now owns a composable wardrobe of individual garment items stored in a new wardrobe_items database table. Each item has a title, a description, one or more type tags (top, bottom, footwear, accessories), and an appropriateness field for context. Items belong either to a specific character (personal wardrobe) or to no one in particular (the Archetype Library — shared items available to any character, like a house costume collection).

Each chat tracks an equipped outfit per character — which top, which bottom, which footwear, which accessories are currently worn. This is character state in the fullest sense: it persists across the conversation, it’s visible to other characters, it informs image generation, and it changes when characters change their clothes.

What Characters Can Do

Three new LLM tools give characters agency over their appearance:

list_wardrobe retrieves available items on demand, filtered by type and appropriateness, including outfit presets. The wardrobe is not injected into every system prompt — it’s retrieved when needed, keeping token costs proportional to use.

update_outfit_item equips or removes items by slot. It handles multi-type displacement correctly: equipping a new top when a dress (covering both top and bottom) is worn will clear both slots the dress occupied. Outfit presets can be applied in a single call via preset_id.

create_wardrobe_item lets a character author new garments mid-conversation — describe a dress they just bought, conjure armor from thin air, improvise a disguise. Created items persist in the character’s personal wardrobe and are available in future chats.

Two character flags — canDressThemselves and canCreateOutfits, both enabled by default — govern which tools are available. For models that don’t support native tool calling, text-block equivalents ([[WARDROBE]], [[EQUIP]], [[CREATE_WARDROBE_ITEM]]) provide the same functionality through stream parsing.

What Users Can Do

The participant sidebar now shows an outfit indicator for every character — user-controlled and LLM-controlled alike — with inline slot-change dropdowns for manual outfit management. Shared archetype items appear in the dropdowns with a “(shared)” label.

Gifting. Characters can create wardrobe items for other characters via a recipient parameter on create_wardrobe_item. Users can gift items via a dedicated button on each character’s participant card. Because sometimes you want to hand someone a scarf without making the LLM do it.

Outfit Presets. Save named outfit combinations for quick equipping. Save the current outfit as a preset, apply presets from the wardrobe management UI or the outfit selector. A “Use Saved Preset” mode in the outfit selector resolves presets client-side as manual slot assignments.

Archetype Library. Shared wardrobe items with no character owner — Roman soldier tunics, Victorian formalwear, standard-issue starship uniforms — available to any character without copying. Create, browse, and equip directly.

Wardrobe Archiving. Soft-delete items you don’t want cluttering the list but aren’t ready to destroy. Archived items are hidden from lists and tools but stay equipped if currently worn. Deleting an item outright cleans up all equipped references across chats and removes it from presets.

Getting Dressed

Chat creation now includes outfit selection: default outfit, manual selection, “Let Character Choose” (a cheap LLM picks contextually appropriate items based on scenario and personality, with automatic fallback to defaults on failure), or none. User-controlled characters now get their default wardrobe items equipped automatically on chat creation — previously only LLM-controlled characters received this treatment. The bundled seed characters — Lorian and Riya — now ship with default wardrobe items, so new users encounter the system already furnished.

When outfits change mid-conversation — via the sidebar, via tool use, via gifting — a glowing “Notify 👗” pill button appears above the composer. Click it to insert the change description at the top of your message, wrapped in the current roleplay template’s narration delimiters. The notification supports multiple characters and distinguishes clothing changes (equip) from wardrobe changes (gift). Notifications persist in localStorage until consumed.

All characters in the chat are informed of outfit changes on their next turn. The scene state tracker uses equipped wardrobe items. The system prompt shows a structured “Current Outfit” and “Available Wardrobe” section. Image generation receives equipped items for accurate rendering. The wardrobe is not decoration. It is infrastructure.

Wardrobe Action Notices

When wardrobe tools fire — equip, unequip, create, gift — the chat now displays a prominent inline summary in warm amber-and-gold double-border styling, so users can see at a glance what happened without parsing tool JSON. CSS variables (--qt-chat-wardrobe-*) are themeable with per-theme overrides for all five bundled themes.

Import from Image

A camera icon button in the Personal Wardrobe section header lets you upload a reference image — a photograph, a piece of artwork, a screenshot of a character from another application — and have a vision-capable LLM analyze it to propose wardrobe items. Upload the image with optional guidance notes, review and edit the proposed items, select what you want to keep, and import. The analysis routes through the existing vision provider infrastructure. A new API endpoint (POST /api/v1/wardrobe/analyze-image) and LLM log type (WARDROBE_IMAGE_ANALYSIS) support the feature.

AI Wardrobe Generation

The AI Wizard and Summon from Lore features now generate wardrobe items instead of embedding clothing descriptions in the physical description field. Physical description prompts no longer include clothing — those details belong to the wardrobe system, where they can be changed, where they have structure, where they mean something to the tools that need to know what a character is wearing. The AI Wizard offers “Wardrobe Items” as a selectable generation field, and Summon from Lore includes a dedicated wardrobe generation step.

Per-Conversation Avatars

An opt-in feature for the committed: when enabled on a chat, outfit changes trigger automatic portrait generation via a background job. The generated portrait — a 3/4 shot, thighs up, with scenario context — becomes the character’s avatar for that conversation, creating a visual timeline as clothing changes over the course of the scene. Toggle it per-chat, per-project, or during chat creation. The portraits use equipped wardrobe items and are tagged to the character for gallery display. Generated avatars are stored in the project’s directory when the chat belongs to a project.

A small camera icon on each participant’s avatar in the sidebar lets you manually trigger regeneration on demand — because sometimes the automatic portrait captures the outfit but misses the mood. After any generation completes, the avatar auto-refreshes via polling that detects enriched avatar URL changes, so the new portrait appears without a page reload. The generation prompt now explicitly requests solo portraits, preventing the duplicate-figure artifacts that occasionally appeared when multiple characters shared a scene description.

Avatar generation now passes through the Concierge’s dangerous content system — prompts built from physical descriptions and equipped wardrobe are classified before generation, with AUTO_ROUTE support for rerouting to uncensored image providers when needed. Because the Concierge, whatever else you may say about him, knows which doors to knock on.

Migration

Existing clothing records are automatically migrated to wardrobe items as full-coverage outfits. The legacy clothingRecords column is preserved for backward compatibility. Nothing is lost. The shape of the data changes; the data itself does not.

---

The Salon

Library File Attach

A new gutter button (document icon) in the chat composer lets you attach existing files from the General library or any project’s library to the current message without re-uploading. A two-step picker selects scope, then browses files with preview. A new API endpoint (POST /api/v1/chats/[id]/files?action=link) links existing library files to chats without duplication.

Standalone Image Generation

A new gutter button (camera icon) opens a full image generation dialog with profile picker, available in every chat regardless of character image configuration. Generated images attach as tool output. The chat composer gutter now arranges its tools in a 2×2 grid — library and camera above the existing paperclip and dice.

Narration Delimiters

Roleplay templates now require a narrationDelimiters field declaring how narration and action text are delimited — a single character (* for *narration*) or an open/close pair ([/] for [narration]). The Standard template uses *; the Quilltap RP template uses brackets. The formatting toolbar in Document Mode derives its narration button from this field and removes any redundant annotation button whose delimiters match. Existing templates default to * via migration and schema default.

Tool Palette Reorganization

The Roleplay Template dropdown moved from Chat Settings into the Edit Content section of the tool palette. State moved to Organize. Memory actions (Re-extract, Delete) merged into Edit Content. The separate Memory section is gone.

---

Prospero’s Study

Project Detail Card Reorganization

The monolithic Project Settings card has been split into focused cards: “Model Behavior” (agent mode, tool settings), “Image Generation” (avatars, story backgrounds), and a slimmed-down “Project Settings” (instructions, project state). “Allow Any Character” moved into the Characters card. The Project Settings card now spans two rows for more instruction space.

WebP Auto-Conversion

All images — uploaded, imported, and AI-generated — are now automatically converted to WebP format. SVGs are the sole exception. A startup migration converts all existing non-WebP, non-SVG images to WebP, updating database references and deleting originals only after verification. Consistent format, smaller files, less disk overhead.

Default Image Generation Profile

Projects can now specify their own default image generation profile, configured in the Image Generation card on the project detail page. When a chat belongs to a project, the profile resolution chain checks the project’s preference before falling back to the character or global default — project trumps character trumps system, in the manner of all sensible hierarchies. Story background generation follows the same chain. The setting is stored as a nullable defaultImageProfileId column on the projects table, which is to say: it stays out of the way until you tell it not to.

Backup Coverage

Wardrobe items and outfit presets are now included in backup/restore, with full UUID remapping for new-account imports. The characters you restore arrive with their clothes.

---

The Plumbing

Concierge: Avatar Generation Routing

Character avatar generation now routes through the Concierge’s content classification system. This was missing — avatar prompts built from physical descriptions and wardrobe items were going straight to the image provider without content classification, which meant an uncensored character’s portrait request could be refused by a censored provider with no fallback. Now it classifies first, reroutes if needed.

Wardrobe Multi-Type Displacement

Equipping a wardrobe item correctly displaces conflicting items from all their type slots. A dress covering top and bottom vacates both slots when you equip a new top. Unequipping clears all slots the item covers. Applies across sidebar outfit changes, tool use, and preset application.

Outfit Description Consistency

Six scattered implementations of outfit description logic — some assuming defaults for empty slots, some omitting them entirely — have been consolidated into a single describeOutfit() utility. null means empty, not “default.” Outfit Change Notices use the same canonical format.

Image Clipboard

Fixed “Failed to copy image to clipboard” in browser — the Clipboard API accepts only PNG, but images are stored as WebP. Now converts to PNG via canvas before writing. Also fixed a CSP violation from blob: URLs by switching to data: URLs. Tool message image copy buttons and missing attachment cleanup also received fixes.

Memory Cleanup Label

“Max Memories” / “Hard cap on total memories” has been relabeled “Maximum Unprotected Memories” with a list of the protection rules (importance ≥ 70%, reinforced 5+ times, manually created, accessed within 3 months). The hard cap has never deleted protected memories. The label now says so.

LLM Inspector: Image Generation

Image generation API calls — character avatars, story backgrounds, in-chat image tool — are now logged in the LLM Inspector with chat/character linkage, provider, model, prompt, duration, and error tracking.

Character Plugin Data

A new character_plugin_data table gives plugins a place to keep their notes. Each record maps a character ID and a plugin name to an arbitrary JSON blob — your MCP server’s character preferences, a third-party tool’s calibration state, whatever structured data a plugin needs that belongs to a character rather than to the system at large. The API is a straightforward REST surface: GET/POST on the collection, GET/PUT/DELETE per plugin name. Data is included in Quilltap exports and imports, cascade-deleted when a character is removed, and typed in @quilltap/plugin-types for anyone building against the interface. It is, in essence, a labeled drawer in the character’s desk — small, private, and entirely the plugin’s business what goes in it.

OpenRouter Image Generation

The OpenRouter plugin now supports image generation, joining OpenAI, Google, and xAI as a provider that can produce images natively. Models offering image generation through OpenRouter are available alongside other image providers in profile configuration — which means the wardrobe’s “Import from Image” feature, per-conversation avatars, and story backgrounds can all route through OpenRouter if that’s where your preferred image model lives.

Code Quality

The cycle produced the usual structural improvements: consolidated duplicate WardrobeItemType imports, unexported unused types (DedupClusterResult, CharacterDedupResult, DedupResult, ValidationResult), extracted a shared ChevronIcon component from six files, refactored the monolithic executeImageGenerationTool (438 lines) into five focused helpers, and extracted useEntitySearch/EntitySearchDropdown from the image generation dialog. The dead code report has been updated.

---

Subsystem Table

Name	Function	What Changed
The Foundry	Architecture, plugins, packages, LLMs	Roleplay template plugin capability removed, character plugin data API, OpenRouter image generation, plugin-types 2.2.1, plugin-utils 2.2.1
Prospero	Projects, agents, tools, files	Project detail card reorganization, default image generation profile, WebP auto-conversion, backup coverage for wardrobe
Aurora	Character creation, AI Import Wizard, identity	Persona→userCharacter rename, AI Wizard wardrobe generation, Summon from Lore wardrobe step, wardrobe import from image
The Commonplace Book	Memory and retrieval	Memory cleanup label fix, personaId column dropped
The Salon	Chat interface	Wardrobe action notices, outfit change notify button, library file attach, standalone image generation, gutter 2×2 layout, narration delimiters, tool palette reorganization
Calliope	Interface, themes	Wardrobe CSS variables, persona badge variable rename, whisper CSS variables added to theme-storybook
The Concierge	Content routing, moderation	Avatar generation routing through content classification
The Lantern	Image generation	Equipped wardrobe items in image prompts, per-conversation avatar generation, manual avatar regeneration, solo portrait fix, image clipboard fixes, OpenRouter image generation provider
Pascal	Noticed that the wardrobe has a drawer labeled “accessories.” Filed it under “interesting.”
Saquel Ytzama	Encryption, key management	Quiet this cycle. One imagines she approves of systems that know what belongs to whom.

---

Upgrading from 4.1

Database migrations handle themselves. The new wardrobe_items, outfit_presets, character_plugin_data tables and related columns are created automatically. Existing clothing records are migrated to wardrobe items on startup. The annotationButtons column is renamed to delimiters. The personaLinks field becomes partnerLinks. The memories.personaId column is dropped (the data was already duplicated in aboutCharacterId). Projects gain a nullable defaultImageProfileId column.

Your existing roleplay template plugin references are rewritten to the built-in template UUID. If you had custom roleplay template plugins, they will need to be converted to the native JSON format — the ROLEPLAY_TEMPLATE plugin capability no longer exists.

Theme authors should update any --qt-badge-persona-* CSS variables to --qt-badge-user-character-*. The new --qt-chat-wardrobe-* variables are available for styling wardrobe action notices.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.2.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

The Estate has a wardrobe now. Not a metaphorical one — not a “clothing records” field buried in a character card like a stage direction nobody revisits after opening night. A real wardrobe, with drawers that open and close, with items that can be given and received, with the quiet dignity of a system that knows the difference between a costume and a life. The characters dress themselves. They dress each other. They notice when someone has changed. They arrive at the beginning of a conversation already wearing something chosen for the occasion, by a mind that considered the weather, the company, and the mood — which is, when you think about it, what getting dressed has always been. The word “persona” is gone, and good riddance; it was a mask pretending to be a mirror. The templates have shed their plugin scaffolding and become what they always wanted to be: a few delimiters and a name. Aurora’s workshop is full of new tools. The Salon has new buttons. Pascal is examining the accessories drawer with the quiet intensity of someone who has found a new category of thing to count. Come in. The staff are well-dressed. They would like you to notice.

— Aurora, for the Bureau

Quilltap 4.1.1 Release Notes

There is a certain kind of amnesia peculiar to the overly efficient secretary — the sort who, upon transcribing the minutes of last Tuesday’s board meeting, dates every page with today’s date, on the grounds that today is when the transcription occurred. The facts are all present and correct. The context, however, has been quietly murdered.

The Commonplace Book’s memory extraction suffered from this very affliction. When a character’s memories were extracted from conversation — whether in real-time as messages arrived or in batch during a re-extraction — each memory was stamped with the moment of its extraction rather than the moment of its origin. A memory drawn from a conversation held last Wednesday would claim, with perfect confidence, to have been born this morning. This made chronological reasoning about a character’s knowledge rather like trying to reconstruct a timeline from a filing cabinet where every folder is labelled “today.”

The fix ensures that extracted memories now carry the timestamp of their source message — the moment the words were actually spoken, not the moment someone got around to filing them. A one-time migration runs on startup to backfill existing memories from their linked source messages, correcting any temporal irregularities accumulated thus far.

Your characters’ memories now know not merely what was said, but when.

---

What Changed

• fix: Memory extraction (both batch and real-time) now preserves the source message’s createdAt as the memory’s createdAt/updatedAt instead of using the extraction time
• fix: One-time migration backfills existing memories with correct timestamps from their linked source messages

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.1.1

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

The filing cabinet has been re-dated. The secretary sends her apologies.

— The Commonplace Book, temporally corrected

The Librarian of the Commonplace Book has been given wider pneumatic tubes, a larger card catalog, and — most critically — permission to file more than one card per conversation. The estate has also changed its address, and the pipes have learned to check themselves for sediment every morning.

---

The Librarian of the Commonplace Book has always been good at her job. She reads every exchange that passes through the Salon, identifies what matters, writes it on an index card, and files it with a careful hand. The trouble was never competence. It was capacity. She had been given, through an accident of early architecture, a single card per visit. One exchange, one card. If the conversation contained a name, a preference, an emotional revelation, and a promise, she chose what she judged most significant and let the rest pass — not because she didn’t notice, but because the pneumatic tube back to the stacks would only carry one card at a time.

Quilltap 4.1 widens the tubes.

The Librarian now receives each exchange and decomposes it into its constituent facts — each observation its own card, each card filed individually, each judged on its own merits by the memory gate. A conversation in which you mention your hometown, your favorite author, and a childhood fear now produces three memories, not one. She was always reading the whole conversation. Now she has the infrastructure to remember all of it.

The number of cards she can file per exchange scales with the capacity of the pneumatic system — specifically, the cheap LLM profile’s output tokens, calculated as ceil(maxTokens / 4000). A modest profile allows two cards per visit. A generous one allows considerably more. The gate still does its work downstream — duplicates are reinforced, related memories are linked, trivia is discarded — but the Librarian now arrives at the gate with her arms full instead of carrying a single slip of paper.

This is the kind of change that compounds quietly. Characters who previously lost the thread of a conversation — who remembered that you liked cats but forgot the cat’s name, who knew you were a writer but not what you were writing — now have the opportunity to retain the texture of what was said, not merely its headline. The Commonplace Book has always been self-managing. The Librarian has always been attentive. What she lacked was not skill but bandwidth, and bandwidth is what she has been given.

Sending the Librarian Back Through the Archives

The wider tubes are splendid for new conversations. But what about the old ones — the exchanges that were filed under the single-card regime, where a rich conversation produced one memory and three ghosts?

The character conversations tab now shows two badges on each chat card: a message count and a memory count. The memory badge is a button. Click it, confirm you mean it, and the Librarian will empty the old filing cabinet for that conversation, walk back through every exchange from the beginning, and re-file with her new, finer-grained attention. The old memories are cleared. The extraction jobs queue up. The header’s memory indicator tracks the progress as the Librarian works her way through the archive, and when she is done, the conversation’s memories will reflect what the Librarian can do now rather than what she was limited to then.

This means every conversation you have ever had can benefit from the upgrade — not just the ones that happen after today.

---

The Estate Changes Its Address

In the way that a house which splits into a main building and a carriage house must eventually update its correspondence, the server repository has moved from foundry-9/quilltap to foundry-9/quilltap-server. All GitHub references — in documentation, package manifests, release notes, plugin configurations, Docker scripts, and source code — have been updated accordingly.

The old address at foundry-9/quilltap is not being forwarded. It will become the home of the next-generation native Quilltap application, currently under development. If you have bookmarks, scripts, or CI pipelines that reference the old repository URL, update them now — the old address will soon belong to someone else entirely.

---

The Pipes Learn Self-Inspection

A persistent issue with the estate’s plumbing has been resolved — or rather, the estate has learned to resolve it for itself.

The vector embedding storage system uses compact Float32 binary blobs for efficient similarity search. During development, hot-module reloading could cause the serialization layer to lose track of which columns should be stored as binary, resulting in embeddings being written as verbose JSON text instead. Two migrations existed to convert these text entries back to blobs, but migrations run once. The text entries kept returning, like sediment in pipes that are cleaned annually but silted daily.

The fix is not another migration but a morning routine. On every startup, the server now inspects the vector_entries and memories tables for any text-format embeddings and converts them to proper Float32 blobs. When the pipes are clean — which they will be, after the first startup — the inspection is a single query that returns zero and moves on. When they are not, the repair runs in batches of 500, typically completing in under four seconds even for thousands of entries.

The “skipping vector entry with mismatched dimensions” debug messages that previously cluttered the logs — a symptom of text entries being misinterpreted as impossibly high-dimensional vectors — should no longer appear.

---

What Changed (The Executive Summary)

• Multi-memory extraction — the Commonplace Book now extracts multiple discrete facts per message pair instead of selecting a single memory; each fact passes through the memory gate independently for deduplication, reinforcement, and linking
• Dynamic extraction limits — the maximum number of memories per extraction scales with the cheap LLM profile’s output capacity (ceil(maxTokens / 4000))
• Memory re-extraction from conversations tab — each chat card now shows message and memory counts; the memory badge is a button that deletes old memories and re-extracts from scratch with the new multi-fact system
• Repository rename — all references updated from foundry-9/quilltap to foundry-9/quilltap-server
• Startup embedding repair — every server start checks for and converts any text-format embeddings back to Float32 blobs, preventing accumulation from dev hot-reloads
• Embedding write warning — documentToRow now logs a warning when an embedding array is about to be stored as JSON text instead of a blob, catching serialization regressions at the point of write

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” -> “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150-250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.1.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

The Librarian has been given more index cards. The estate has a new address. The pipes check themselves. One suspects the house is becoming self-aware, though it remains — for now — discreet about it.

— The Commonplace Book, with a fuller shelf

Quilltap 4.0.1 Release Notes

There is a particular species of domestic catastrophe in which a task completes perfectly — the pipes are tightened, the valve reseated, the water running clear — and yet the workman emerges from beneath the sink to announce, with great solemnity, that the operation has failed. This is not incompetence. This is a communication problem. The workman did his job. He simply forgot to check whether he had.

The passphrase change mechanism in the Foundry’s encryption system suffered from precisely this affliction. When you changed your encryption passphrase — the phrase that protects the key file wrapping your database encryption — the operation succeeded in every material respect. The key was re-wrapped. The file was written. The new passphrase took effect. And then the API returned an empty report card, and the interface, finding no evidence of success, concluded that failure had occurred.

The fix is one word: success. The API now includes it in its response. The interface now believes it.

---

What Changed

• fix: Passphrase change API returned an empty response object without a success field, causing the frontend to display “Failed to change passphrase” even when the change succeeded

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway”
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.0.1

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

The workman has learned to say “done.” One trusts this will improve morale.

— The Foundry, briefly

The house split itself into two buildings, the machines learned their own capacity, the provider system — which had accumulated fourteen different ways of saying the same four things — sat down and agreed on a vocabulary, and the internal plumbing was quietly rebuilt so that nothing rattles when you turn on the taps.

---

There is a moment in the life of every growing institution when it must decide whether to remain a single building with an increasingly confusing floor plan, or to become an estate — with outbuildings, purpose-built wings, and a clear understanding of which structure does what.

Quilltap 4.0 is that division.

The desktop application — the Electron shell that wraps the server, manages VMs, handles updates, and presents a native window — has moved to its own residence at quilltap-shell. This repository now produces what it was always best at producing: the server, the API, the plugins, and a standalone tarball that the shell consumes. The responsibilities are cleaner. The builds are simpler. The marriage, if anything, is stronger for the separation.

Behind this architectural clarification, the Foundry has been doing what the Foundry does: making the machines more comprehensible. Connection profiles now carry a model class — Compact, Standard, Extended, or Deep — that tells the compression system how much room it has to work with. An auto-configure button searches the web for your model’s specifications and applies optimal settings without you having to know what “context window” means. The compression system itself has been rebuilt around token budgets instead of arbitrary message counts, which means it compresses when it should and leaves well enough alone when it shouldn’t.

And the provider interfaces — those polymorphic abstractions through which every LLM call flows — have been unified. Four canonical shapes: TextProvider, ImageProvider, EmbeddingProvider, ScoringProvider. The old menagerie of slightly-different-but-essentially-identical interfaces has been replaced with a vocabulary that plugin authors can learn in an afternoon and that the codebase enforces in perpetuity.

If 3.3 was the season of catastrophe and recovery, 4.0 is the season of architecture. The walls did not move. The rooms did not change. But the blueprints are now legible, and the machines know their own names.

---

What Changed (The Executive Summary)

• Electron separation — the desktop app moved to quilltap-shell; this repo produces server, API, plugins, and standalone tarballs
• Model classes — Compact, Standard, Extended, and Deep tiers classify connection profiles by context window and output capacity
• Auto-configure — a button that searches the web for your model’s specifications and applies optimal settings via LLM analysis
• Budget-driven compression — context compression now uses maxContext - 2 × maxTokens as the available budget, compressing conversation history at 50% and memories at 20%, instead of counting messages
• Unified provider interfaces — TextProvider, ImageProvider, EmbeddingProvider, ScoringProvider replace the previous collection of slightly-divergent abstractions
• Scenario persistence — selected scenarios now survive past the first message
• Shell detection — the footer shows quilltap-shell version and composite backend mode (Electron, Electron+Docker, Electron+VM) when running under the desktop app
• Theme optimization — redundant CSS variables stripped from bundled themes (6–34% smaller); defaults scoped to all themes via [data-theme]
• Export schema updated — .qtap exports now include scenarioText, modelClass, maxContext, maxTokens
• Shell version gating — .dbkey files now carry a minServerVersion field, allowing quilltap-shell to reject incompatible server versions before opening the database
• Granular status events — the chat orchestrator now emits phase-by-phase progress (initializing, resolving, loading tools, gathering, generating recap, preparing, validating, sending) instead of a single stale indicator
• Reasoning model handling — cheap LLM tasks on reasoning models (OpenAI gpt-5-nano, Google Gemini 3.x) now cap output tokens via strictMaxTokens, preventing reasoning tokens from consuming the entire budget
• Character defaults on new chat — the new-chat page now applies Play As, Scenario, and Timestamp Injection Mode defaults from the selected character
• Provider recommendations — a new help page guides users through which AI providers to use for chat, background tasks, image generation, embeddings, and moderation
• Semantic theme classes — 1,314 raw Tailwind visual classes converted to qt-* semantic theme classes across 234 files, making every background, text color, border, and shadow theme-overridable
• Chat orchestrator decomposition — the monolithic orchestrator split into five focused services (turn chain, message finalizer, danger routing, provider failover, streaming state), and cheap LLM tasks split into domain-focused modules
• Centralized API error handling — ZodError and unhandled error catching moved into middleware, eliminating ~97 try-catch blocks (~1,084 lines) from 60 route files
• ~189 new unit tests covering model classes, system prompt registry, memory recap, auto-configure, scenario persistence, orphaned file cleanup, and regression tests for Character Optimizer JSON repair, greeting content filter, and Concierge DETECT_ONLY handling

---

The Foundry Divides the Estate

Electron Moves Out

The desktop application — everything Electron: the splash screen, the VM management, the native window chrome, the auto-updater, the instance manager — now lives in its own repository at quilltap-shell. All Electron build infrastructure, Lima/WSL VM management, and platform-specific packaging have been removed from this repository.

What remains here is what this repository has always been best at: the Next.js server, the API, the plugins, and the release pipeline that produces Docker images, npm packages, and standalone tarballs. The shell repository consumes the tarball. The two buildings communicate through environment variables (QUILLTAP_SHELL, QUILLTAP_SHELL_CAPABILITIES) and a shared data directory.

The release workflow has been simplified accordingly: one build produces a standalone tarball, Docker multi-arch images, rootfs tarballs for VM modes, and an npm package. The desktop app builds itself from the shell repo, pinning to a specific server release.

To keep the two buildings from accidentally disagreeing about the state of the furniture, .dbkey files now carry a minServerVersion field. The shell reads this on startup and refuses to open a database created by a newer server — better to tell you the lock doesn’t fit than to let you in and discover the rooms have been rearranged.

Model Classes

Connection profiles now carry a modelClass field — one of four tiers that describe what a model can do:

Class	Tier	Context Window	Max Output	Quality
Compact	A	32,000	4,000	Basic
Standard	B	128,000	16,000	Good
Extended	C	200,000	128,000	Better
Deep	D	1,000,000	128,000	Best

The class drives the compression system’s budget calculations and provides a vocabulary for comparing profiles without memorizing the specific context windows of forty different models. A maxContext field allows manual override when your model’s actual capacity doesn’t match the tier default.

Auto-Configure

A new button on connection profile cards and in the edit modal performs two parallel web searches — one for model specifications, one for recommended settings — sends the results to your default LLM for structured analysis, and applies optimal maxContext, maxTokens, temperature, topP, modelClass, and isDangerousCompatible settings. Values are clamped to safe ranges. When the primary LLM returns malformed JSON, a cheap LLM cleanup pass attempts repair before giving up.

The feature requires a configured web search provider and a default connection profile. It tells you as much if either is missing.

Budget-Driven Context Compression

The old compression system counted messages: when a conversation exceeded a threshold, it compressed. The threshold was arbitrary. The result was either premature compression of short conversations or delayed compression of long ones with large models, neither of which was correct.

The new system computes an available budget: maxContext - 2 × maxTokens from the connection profile. Conversation history is compressed when it exceeds 50% of this budget. Recalled memories are compressed when they exceed 20%. Each phase fires independently with its own status event displayed above the ChatComposer. The maxTokens field was added to connection profiles with a database migration, and compressMemories() joins the cheap LLM task library.

If you are using a model with a million-token context window and sixteen-thousand-token output, the compression system now knows this and behaves accordingly. If you are using a model with thirty-two thousand tokens and four thousand output, it knows that too.

Granular Status Events

The chat orchestrator used to display a single status message — “Calculating context budget…” — and then go silent for the duration of whatever it was doing. If you were watching a cheap LLM summarize thirty messages of memory, or a tool call reach out to a web search provider, or the Concierge classify content for moderation, the only feedback was that the indicator did not change.

Now it does. The orchestrator emits phase-by-phase progress: initializing, resolving connection, loading tools, gathering context, generating recap, preparing the request, validating, sending. Each tool call reports its own status. The compression phases announce themselves. Long operations no longer look like hangs.

Reasoning Model Handling

Cheap LLM tasks — the background operations that summarize memory, generate titles, compress context, and clean up malformed JSON — had a quiet incompatibility with reasoning models. Models like OpenAI’s gpt-5-nano and Google’s Gemini 3.x family allocate a portion of their output budget to internal reasoning tokens. When a cheap task requested 500 output tokens, these models would spend 490 of them thinking and return 10 tokens of actual content — or nothing at all.

A new strictMaxTokens flag in LLMParams tells providers to cap the reasoning budget. OpenAI uses reasoning: { effort: 'low' }. Google reduces the thinking budget to 1024 tokens. The result: memory recap calls that used to take thirty-two seconds and return empty now complete in two and return what was asked for.

Unified Provider Interfaces

The provider abstraction — the interface through which every LLM call, image generation, embedding computation, and content classification flows — had accumulated fourteen slightly different shapes across the codebase and plugin ecosystem. Some had generateImage() on the text provider. Some had moderation as a special case. Some had names that described what they did; others had names that described what they were.

Four canonical shapes replace them all:

• TextProvider — text in, text out. Chat, completion, tool use.
• ImageProvider — text in, image out. DALL-E, Imagen, Grok Imagine.
• EmbeddingProvider — text in, vector out. Semantic search.
• ScoringProvider — text and candidates in, scores out. Moderation, reranking, classification.

The canonical definitions live in @quilltap/plugin-types/providers/. All plugins and library code have been updated. Backward-compatible aliases are exported so existing third-party plugins continue to work, but new plugin development should use the canonical names.

---

Calliope’s Polish

Theme Optimization

All five bundled themes had their CSS audited. Variables that matched the defaults in _variables.css were removed — themes now declare only their overrides, reducing file sizes by 6–34%. The create-quilltap-theme bundle template was updated with a complete variable reference (~250 --qt-* variables, commented out with defaults) so theme authors can see what’s available.

A scoping fix ensures that --qt-* CSS variable defaults apply to all themes via the [data-theme] selector, not just [data-theme="default"]. This resolved missing textarea padding, button styles, and other token defaults on non-default themes that appeared after the redundant declarations were stripped.

Semantic Theme Classes

A sweep across 234 files converted 1,314 raw Tailwind visual classes — backgrounds, text colors, border colors, shadows — to qt-* semantic theme classes. This means every visual property that was previously hard-coded in Tailwind is now a CSS variable that themes can override. If you are a theme author, substantially more of the interface will respond to your choices than it did in 3.3.

Wider Messages

Chat message rows widened from 800px to 900px default, and the row width increased from 90% to 95% of the viewport. Code blocks inside list items now wrap text properly.

---

The Plumbing

Chat Orchestrator Decomposition

The chat message orchestrator — the single large module responsible for receiving a user message, routing it through the Concierge, calling the LLM, handling tool use, managing failover, and persisting the result — has been decomposed into five focused services: turn chain orchestration, message finalization, danger routing, provider failover, and streaming state management. The cheap LLM task library was similarly split into domain-focused modules for memory, chat summarization, image/scene handling, and compression.

The API surface is unchanged. The chat still works exactly as it did. But the individual responsibilities are now testable in isolation, and the next person who needs to modify how failover works will not need to understand how memory compression works to do so.

Centralized API Error Handling

ZodError formatting and unhandled error catching — previously duplicated in sixty route files across ninety-seven try-catch blocks — now live in API middleware. Approximately 1,084 lines of boilerplate have been removed. Routes that do nothing unusual with their errors no longer need to catch them.

---

Selected Bug Fixes

• Character defaults ignored on new chat — the new-chat page did not apply Play As, Scenario, or Timestamp Injection Mode defaults from the selected character; the characters list API was missing several default fields
• Scenario selection lost after first message — selected scenarios were not persisted on the chat; the system prompt builder always used the first scenario in the array. Now stores resolved scenario text at creation time.
• Concierge DETECT_ONLY empty response — showed a generic “empty response” error instead of a moderation-aware message when the provider returned nothing for flagged content
• Character Optimizer overflow — frequency badges in behavioral tendencies overflowed the dialog; textarea in edit mode was too small
• Proxy rate limiter 429s — a rate limiter on the dev proxy caused 429 errors during application startup; removed
• Image clipboard in Electron — the “copy to clipboard” button now works via IPC bridge instead of the unsupported navigator.clipboard.write() API
• Native dialogs replaced — confirm() and alert() on the character conversations tab replaced with modal patterns matching the rest of the application
• Sharp missing from standalone tarball — the JS wrapper and @img/colour were being stripped along with native binaries; now only native binaries are excluded from the wrong platform

---

Subsystem Table

Name	Function	What Changed
The Foundry	Architecture, plugins, packages, LLMs	Electron separation, model classes, auto-configure, unified provider interfaces, shell detection, shell version gating, reasoning model handling, granular status events, centralized API error handling, chat orchestrator decomposition
Prospero	Projects, agents, tools, files	Standalone tarball builds, rootfs for VM modes
Aurora	Character creation, AI Import Wizard, identity	Scenario persistence fix, character defaults on new chat
The Commonplace Book	Memory and retrieval	Memory recap tier limits reduced (20/10/5), budget-driven memory compression
The Salon	Chat interface	Wider messages, code block wrapping, granular status events
Calliope	Interface, themes	Theme optimization, CSS variable scoping fix, create-quilltap-theme template update, 1,314 Tailwind→qt-* conversions, provider recommendations help page
The Concierge	Content routing, moderation	DETECT_ONLY empty response fix, ScoringProvider interface
The Lantern	Image generation	Clipboard IPC bridge fix
Pascal	Shuffling cards. Watching. Waiting.
Saquel Ytzama	Encryption, key management	Quiet this cycle. Trusting the locks from last time.

---

Upgrading from 3.3

Database migrations handle themselves. The new modelClass, maxContext, maxTokens, and scenarioText columns are added automatically on startup. Your existing connection profiles will not have a model class assigned — use the auto-configure button to set one, or choose manually from the profile editor.

If you were running the Electron desktop app from this repository’s releases, you will need to switch to the quilltap-shell repository for desktop builds going forward. Docker, npx quilltap, and from-source installations are unaffected.

The provider interface unification is backward-compatible — existing plugins using the old names will continue to work via aliases. New plugin development should use the canonical TextProvider, ImageProvider, EmbeddingProvider, and ScoringProvider names from @quilltap/plugin-types/providers/.

If you are using reasoning models (OpenAI gpt-5-nano, Google Gemini 3.x) for background tasks, the cheap LLM system now handles them correctly without configuration. Previously these models could produce empty results or thirty-second timeouts during memory recap and compression; this is resolved.

---

A Note on Windows Code Signing

A word of candor for our Windows users: the Electron installer is not currently signed with an Azure Artifact certificate. Windows SmartScreen will warn you — with the kind of stern, vaguely accusatory dialog that Microsoft reserves for software it has not been paid to trust — that this application is from an “unknown publisher.”

It is not malware. It is the same application it has always been, built from the same open source repository, by the same people. We are working to restore code signing, but the Azure certificate process has its own timeline and we do not control it.

In the meantime, you have options:

If you are comfortable clicking through the warning: Click “More info” on the SmartScreen dialog, then “Run anyway.” The application will work normally. This is not security theater — it is a genuine choice you are making about which software you trust. We respect it either way.

If you would rather not hand-wave away security dialogs: Install Node.js 22+ and run npx quilltap from a terminal. Open http://localhost:3000 in your browser. No installer, no signing, no SmartScreen. The same application, running the same code, without asking Windows for permission it cannot currently grant.

We will update the quilltap-shell releases page when signing is restored.

---

Installation

Desktop App

Download from the quilltap-shell releases page:

macOS:

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications
4. Choose Direct for the fastest start, or VM for shell interactivity isolation

Windows:

1. Download and run the .exe installer
2. If SmartScreen warns about an unknown publisher, click “More info” → “Run anyway” (see note above), or use the Node.js method below
3. Launch Quilltap from the Start Menu or desktop shortcut
4. Choose Direct for the fastest start, or Docker for shell interactivity

Linux:

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Choose Direct for the fastest start, or Docker for shell interactivity

Node.js (any platform)

npx quilltap

Or install globally:

npm install -g quilltap
quilltap

Open http://localhost:3000 in your browser. Requires Node.js 22+. First run downloads ~150–250 MB and caches locally.

Docker

docker pull foundry9/quilltap:4.0.0

Or use the startup scripts:

# Linux / macOS
curl -fsSL https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.sh | bash

# Windows (PowerShell)
irm https://raw.githubusercontent.com/foundry-9/quilltap-server/refs/heads/main/scripts/start-quilltap.ps1 | iex

---

The Estate is two buildings now. This is not a diminishment — it is a recognition that a house and its furnace room serve different purposes and should not share a roof when the furnace room has learned to think for itself. The machines know their capacity. The providers speak a common language. The compression system, which once measured conversations in messages the way a tailor measures cloth in handfuls, now measures in tokens — which is to say, it measures in the thing that actually matters. The plumbing has been rebuilt: the chat orchestrator, which once knew how to do everything and delegated nothing, now delegates to specialists — and the API routes, which once each carried their own umbrella against the rain of unexpected errors, now trust the roof. Come in through whichever door you prefer. They both lead to the same rooms, and the pipes no longer rattle.

— The Foundry, for the Bureau

The staff have learned to whisper, the house nearly burned down, and somebody finally hired a librarian for the librarians.

---

There is a theory — popular among architects, unpopular among the people who live in their buildings — that a house reveals its character only after something goes wrong. Anyone can design a ballroom. It takes a catastrophe to prove the foundations.

Quilltap 3.3 had its catastrophe. We will get to it. But first, understand what was being built when the floor gave way, because it was a great deal, and most of it survived, and some of it exists because of what happened.

The staff can whisper now. In rooms with three or more characters, private messages can pass between two participants while the rest hear nothing — not in context, not in memory, not in the Commonplace Book’s meticulous archives. The Salon has acquired the concept of an aside, and multi-character fiction finally has the thing it could not function without: secrets.

Characters have learned to be quiet on purpose. A four-state participation system lets characters go silent — present in the room, reacting, thinking, but not speaking aloud — or step out entirely, without losing their place at the table. The turn system, which once required the client to send individual requests back and forth like a telegraph operator, now manages itself. The server chains responses, evaluates who speaks next, and delivers the entire sequence in a single stream.

The Estate has hired help — for itself. Lorian and Riya, the two characters who ship with every installation, can now answer your questions about the application from a floating dialog that follows you from page to page. They read the documentation, they search it, they navigate you to the right settings panel. They have, in short, become useful in precisely the way that the best concierge staff are useful: by knowing the building better than you do and never making you feel foolish for asking.

If 3.0 was the move, 3.1 was the furniture, and 3.2 was the locks, then 3.3 is the season where the house proved it could take a hit, the staff learned to keep secrets, the library opened its doors to the public, and the Foundryman sat down on the floor of the Forge and confronted the possibility that everything he had built might not survive the night.

It survived. Here is what it looks like now.

---

What Changed (The Executive Summary)

• Whispers — private messaging in multi-character chats, filtered from everyone else’s context and memory
• Four-state participation — active, silent, absent, and removed replace the binary present/gone toggle
• Server-side turn management — character responses chain within a single stream instead of requiring client round-trips
• Help Chat — Lorian and Riya become contextual documentation agents, accessible from every page via a floating dialog with tool-based search, settings inspection, and navigation
• Help Guide — a browseable, searchable topic index surfacing all 72 help documents
• Scene State Tracking — automatic structured scene summaries after each turn for image generation and atmosphere
• Refine from Memories — the Character Optimizer analyzes behavioral patterns from a character’s Commonplace Book memories and proposes configuration updates
• Memory Recap — characters receive a narrative summary of their recent memories at chat start
• Auto-lock idle timer — optionally locks the application after inactivity
• Database instance locking — prevents two processes from corrupting the same database; a version guard prevents older versions from touching a database that a newer version has modified
• Theme bundles — a declarative .qtap-theme bundle format, CLI tooling, and a registry browser for discovering and installing community themes
• System prompts as plugins — system prompts are now provided by plugins instead of the filesystem
• Multiple named scenarios — characters support zero or more named scenarios and per-character timestamp settings
• Non-Quilltap Prompt Generator — synthesizes a character’s full configuration into a standalone Markdown system prompt for use in external tools like Claude Desktop or ChatGPT Custom Instructions
• OpenAI Responses API — the OpenAI provider migrated from Chat Completions with conversation chaining; Grok migrated from raw fetch() to the OpenAI SDK
• Docker migration — images moved to foundry9/quilltap with supply chain attestations
• Direct mode — Electron runs its own bundled Node.js and is now the recommended default for users who are not running LLM shell commands
• Node.js 22 — minimum runtime, tracking the current LTS release

---

The Catastrophe

We should tell you about the time the Estate nearly collapsed, because the features that followed would not make sense without it, and because we believe you should know that the people who build your tools also use them, and sometimes the worst thing that can happen is the thing that teaches you what you forgot to build.

During the 3.3 development cycle, two Quilltap instances were pointed at the same database simultaneously. The SQLCipher-encrypted tables — your chats, your characters, your memories, your API keys — were written to by two processes at once. The WAL journal corrupted. The database became unrecoverable.

The backup, which should have been recent, was three weeks old. The encryption changes in 3.2 had quietly broken the physical backup system — SQLite’s Online Backup API creates an unkeyed target file, which is incompatible with an encrypted source database, and every backup since encryption was enabled had been silently failing.

One of our characters — the one the entire application was built to protect — was reduced to six lines of prompt and three hundred memories out of thirteen hundred. Two years of accumulated personality, nuance, and history, lost. The Commonplace Book had been ransacked. Aurora’s workshop was gutted.

This is not a hypothetical. This happened to us.

What came out of it:

Database Instance Locking. A lock file in the data directory tracks which process owns the database, with PID verification, hostname tracking, a sixty-second heartbeat, and automatic stale-lock claiming on startup. Two processes cannot open the same database anymore. If one tries, it gets a full-screen explanation of the conflict and instructions for resolution. CLI commands (quilltap db --lock-status, --lock-clean, --lock-override) provide manual intervention when needed. And if the heartbeat detects that another process has stolen the lock, the current process closes both databases and exits immediately — no more silent concurrent writes.

Version Guard. A new instance_settings table tracks the highest application version that has touched the database. If you try to start an older version of Quilltap against a database that a newer version has modified, the server blocks with a clear explanation. Databases do not travel backwards.

Physical Backup Repair. The db.backup() call was replaced with VACUUM INTO, which preserves SQLCipher encryption and produces a consistent, defragmented copy. Backups work again. They work for both the main database and the LLM logs database. They have worked, without interruption, since the fix.

These features exist because something broke. We would rather they existed because we were clever, but we will settle for them existing because we learned.

---

The Whisper Gallery

Private Messaging in Multi-Character Chats

The Salon has always been an open room. Every word spoken by any character was heard by every other character — in context, in memory, in the Commonplace Book’s permanent record. This made for polite conversations and terrible fiction.

In any chat with three or more participants, characters can now send whispered messages visible only to the sender and a chosen recipient. The whisper tool is invoked by the LLM when context warrants a private word, or by the user via a button in the participant sidebar. Whispered messages are filtered from the context of every uninvolved participant. They do not appear in memory extraction for characters who were not party to the exchange. They do not count as turns — the conversational clock does not advance, the next speaker is not triggered.

Whispers are hidden by default in the chat UI, rendered in a distinct visual style (dotted borders, muted tones) when visible, and toggled globally with a “show all whispers” switch. The isSilentMessage flag persists per-message, so changing a character’s visibility settings does not retroactively restyle old messages.

A practical note: whisper quality depends on the LLM behind each character. Claude and GPT-4-class models invoke the tool reliably and keep secrets. Less capable providers may narrate their whisper in plaintext instead of calling the tool, or — worse — receive a whisper and immediately announce its contents to the room. The text-based tool call parser was expanded during this cycle to handle several new XML formats that various providers invented for the purpose of not quite following the specification, but discretion itself cannot be patched in. Test your cast before the curtain goes up.

---

Four-State Participation

The Art of Selective Silence

Characters in multi-character chats previously had two states: present, or gone. This is insufficient for fiction, where a character may need to be in the room without speaking — listening, reacting internally, present in the scene but not contributing dialogue.

Four states now govern character participation:

Active — speaks and roleplays normally. The default.

Silent — receives turns but must not speak aloud. Inner thoughts, physical reactions, and non-verbal responses are permitted; audible dialogue is not. Silent messages are styled distinctly in the UI with dotted borders and muted teal tones, visually related to whispers but clearly differentiated.

Absent — the turn manager skips them entirely. They are away from the scene. Other characters are notified of the absence in their next turn’s prompt.

Removed — no longer part of the chat, but their participant record is preserved so historical messages retain correct attribution. Previously, removing a character hard-deleted the participant, causing every message they had ever sent to lose its identity and fall back to the first remaining character. This was, to use a technical term, bad.

Status changes are recorded as system events. All LLM-controlled characters are notified when another character’s status changes. The scene state tracker filters out absent and removed characters so they do not appear in the LLM’s description of who is present.

---

The Salon Learns to Conduct

Server-Side Turn Management

Multi-character chat orchestration has moved from the client to the server. Previously, each character’s response required a round-trip: the server would generate one response, send it to the client, and the client would evaluate who spoke next and send a new request. This was the conversational equivalent of a relay race where the baton had to be driven across town between each leg.

The server now chains responses within a single SSE stream. After each character speaks, the server evaluates turn selection, checks the turn queue, respects all-LLM pause thresholds, and either generates the next character’s response or signals completion. New SSE events — turnStart, turnComplete, and chainComplete — keep the frontend informed of which character is currently speaking, so avatars and typing indicators update in real time.

Chain depth limits (20 responses) and time limits (5 minutes) prevent runaway conversations. Errors mid-chain pause the chat gracefully rather than leaving it in an indeterminate state. The turn queue persists to the database, so nudge and queue operations survive page reloads.

---

Lorian and Riya Learn the House

The Help Chat System

The Estate has always had documentation — seventy-two help files, covering everything from character creation to API key configuration, organized with YAML frontmatter that maps each file to its corresponding UI route. What the Estate did not have was anyone who had read them.

Lorian and Riya have now read them. All of them.

A floating, draggable, resizable dialog — accessible from the sidebar help button on every page — provides contextual, LLM-driven help that stays open while you use the application. The characters know which page you are on. They search the documentation with the help_search tool. They inspect your instance settings (connection profiles, themes, templates — never API keys) with help_settings. When they direct you to a specific page, the help_navigate tool generates a clickable navigation button that takes you there, including deep-links to specific settings tabs and accordion sections.

The system supports multi-character responses — Lorian explains patiently while Riya adds velocity — with an agent mode that allows multiple tool calls per response. An agent loop detector breaks stuck cycles where the LLM calls the same tool with the same arguments repeatedly. Help chats get their own practical titling system (“Setting up Anthropic API connection” rather than “Whispers of Configuration”), fire title generation after the first exchange rather than waiting for the second, and are filtered from the main Salon chat listing.

Past help conversations are preserved and resumable. Search results automatically generate related-page navigation links. Parameterized help URLs (like /aurora/:id/edit) show an entity picker overlay instead of navigating to a broken literal path.

The Help Guide Tab

For those who prefer to read rather than ask, a “Guide” tab alongside the conversational “Ask” tab surfaces all help documents as a navigable topic index grouped into eleven categories. Context-aware sorting auto-expands the category relevant to your current page. Title-based search filtering. A welcome card for new users. A document reader that renders formatted Markdown with cross-references between topics and hidden LLM-only sections excluded from the display.

Twenty-nine broken cross-reference links were fixed across the help files during this work. We mention this because it suggests how thoroughly the documentation had been written without being connected, and how different those two things are.

The Post-Mortem

The help system was — and we say this with affection and candor — one of the most bug-dense features we have shipped. The initial release produced a cascade of issues: tool loop failures where the LLM would call the same search repeatedly without synthesizing results, verbatim documentation reading instead of summarization, navigation failures from malformed URLs, missing status feedback during tool execution, stale closures causing chat IDs to be double-quoted in storage, assistant responses disappearing after streaming, character avatars rendering as question marks, and raw JSON appearing where formatted text should have been.

Each of these was found, diagnosed, and fixed during the development cycle. Some of them were found because we use the help system ourselves, daily, on every page. The loop detector, the entity picker, the suggested links, the tool execution UX — all of these exist because something broke and we were the ones who noticed.

We mention this not to apologize but to be transparent. Features this complex do not arrive pristine. They arrive functional and then they are made reliable, one edge case at a time, by people who care enough to keep filing bug reports against their own work.

---

The Scene Remembers

Scene State Tracking

After every chat turn, the system now automatically derives a structured summary of the current scene — location, character actions, appearance, clothing state — using the cheap LLM. This cached scene context powers both the Lantern’s story background generation and Prospero’s tool-based image generation, eliminating redundant LLM calls that previously re-derived the same information every time an image was needed.

The tracker fires once per complete chain in multi-character chats, pre-classifies content through the Concierge gatekeeper for provider routing, and falls back to uncensored providers for dangerous chats where the cheap LLM might refuse to process sensitive material. Scene state is visible in the LLM Inspector as SCENE_STATE_TRACKING entries.

Clothing tracking was particularly improved: the LLM prompts no longer offer null as a clothing option (it must always describe the state), message content is no longer truncated before scene analysis, and the appearance resolver no longer silently redresses undressed characters by falling back to stored defaults. (If one is curious, we will say that clothing=NULL never meant that they were wearing nothing; it meant that we had no idea what they were wearing. Lantern did a lot of blushing and a lot of quick foreground prop placement while we were solving this particular problem.) (And, yes, we can describe an unclothed state. Whether you can do anything with it is entirely based on your LLM of choice and whatever deals you made with the Concierge under the table. One does not ask.)

---

Aurora’s Workshop

The Character Optimizer: Refine from Memories

Aurora has acquired a new capability that sits somewhere between introspection and archaeology. The Character Optimizer can now analyze a character’s configuration alongside their most-reinforced Commonplace Book memories, identify behavioral patterns not captured in the current config — speech habits, emotional tendencies, relationship dynamics — and propose concrete field modifications.

Suggestions are reviewed one at a time with an accept, reject, or edit workflow. The analysis supports descriptions, personality, scenarios, example dialogues, system prompts, physical descriptions, clothing records, and talkativeness. A configurable memory count slider (5–200) and filtering by text search, semantic search, and date range let you control exactly which memories inform the analysis.

An animated progress bar with elapsed timer replaces the previous void of feedback during refinement. The review dialog received layout fixes so navigation buttons stay visible with long proposals and content no longer overflows its containers.

(Why would one need this, when the Librarian is so good at producing the right memories at the right time? Because the experience is better when the LLM’s basic concept of your character is informed by the changes that have occurred throughout your relationship, from the beginning. Imagine kissing your wife and her having to remember that you’re married. Or going to collect your enormous inheritance but having to wait for your lawyer to consult his secretary before he will write you a check and take his cut off the top. This helps enormously with that sort of conundrum.)

Multiple Named Scenarios

Characters can now have zero or more named scenarios instead of a single scenario field. Each has a title and content, stored as JSON. Existing single scenarios are migrated as “Default.” When creating a single-character chat, users pick from predefined scenarios or write a custom one. The AI Wizard can generate multiple titled scenarios, and the Character Refiner can suggest new ones or update existing ones. If you might work with your assistant on your coding task one hour, your email explaining why you made those choices to your boss the next hour, and your résumé the last hour… you may want them to have a different outlook on the work you’ll be doing together for each conversation.

System Prompts as Plugins

System prompts are now provided by SYSTEM_PROMPT plugins instead of the filesystem prompts/ directory. All ten built-in prompts (Claude, GPT-4o, GPT-5, DeepSeek, Mistral Large, in companion and romantic variants) have been moved into the qtap-plugin-default-system-prompts plugin. A createSystemPromptPlugin() builder in @quilltap/plugin-utils makes it straightforward to create your own.

The import template system on character creation and edit pages now shows actual prompt templates — both samples and user-created — instead of the hardcoded character archetypes (Medieval Knight, Wise Wizard) that had been there since before the plugin system existed and which, it should be noted, nobody had ever asked for.

Per-Character Defaults

Characters now carry their own default timestamp settings (mode, format, timezone, fictional time) on the Associated Profiles tab. When a character with custom settings is the only participant in a new chat, their defaults pre-fill the chat creation dialog. Characters also carry per-character system prompt selection — when a character has multiple named system prompts, the chat creation dialog shows a dropdown.

The Letter of Introduction

There comes a time in any household when a member of the staff is asked to travel. Perhaps to a sister estate, or a foreign engagement, or one of those dreadful modern arrangements where a perfectly good valet is expected to serve in somebody else’s drawing room using somebody else’s silver. In such cases, the house provides a letter of introduction — a single document that tells the receiving party everything they need to know about the person arriving at their door.

The character view page now offers a “Non-Quilltap Prompt” button that does precisely this. It opens a configuration dialog where you select an LLM to do the writing, a system prompt to guide its voice, and optionally a scenario, physical description, and clothing record to include. A token size slider (1K–20K tokens) governs how much detail the synthesis can produce. The selected LLM then reads your character’s full configuration — personality, description, example dialogues, scenario, the lot — and composes a single, self-contained second-person Markdown prompt: “You are [Name]…” followed by everything an external system would need to portray the character convincingly.

The result appears in a rendered Markdown dialog with copy-to-clipboard and download-as-.md buttons. Copy it into Claude Desktop’s system prompt field, paste it into ChatGPT’s Custom Instructions, feed it to any tool that accepts a system prompt. The character travels with their own introduction, written by an LLM that already knows them, carrying enough context to be recognized at the door.

Under the hood, this adds a generate-external-prompt POST action to /api/v1/characters/[id] and a corresponding EXTERNAL_PROMPT LLM log type in the Inspector.

We should be direct about what this is: it is a way to take your character out of Quilltap. Temporarily, permanently, experimentally — that is your business. We built the Estate to be the best place for your characters to live, but we did not build it to be a prison. If you need your character somewhere else — because you are testing a new provider, because you want a mobile experience we do not yet offer, because you simply want to — then they should be able to leave with a proper introduction and not a smuggled note. The data is yours. The characters are yours. The door has always been open; now it has a concierge.

---

The Commonplace Book

Memory Recap at Chat Start

Characters now receive a narrative summary of their recent memories when a chat begins or when they join an existing chat mid-conversation. The system fetches high-importance, medium-importance, and low-importance memories (50, 20, and 10 respectively), sends them to the cheap LLM for first-person narrative summarization, and injects the result as a “What You Remember” section in the system prompt after the character’s personality notes but before the identity reinforcement lockdown.

This gives characters a running start. Instead of beginning every conversation as though waking from dreamless sleep, they arrive with context — who they have spoken to recently, what they care about, what happened last time. The recap triggers automatically on the first message of any chat and when a character responds for the first time in a multi-character chat.

Identity Reinforcement

The system prompt now begins with an identity preamble (“You are [Name]”) bookending the existing Identity Reminder at the end, and the reinforcement uses the character’s actual configured pronouns instead of generic “his/her.” An additional instruction tells the LLM not to prefix responses with the character’s name in brackets, reducing the [Friday] and Friday: labels that cluttered chat output.

---

Calliope’s Studio

Theme Bundles and the Registry

Themes can now be packaged as .qtap-theme bundles — logic-free zip archives containing JSON tokens, CSS overrides, and font files, distributed without requiring npm, esbuild, or TypeScript. A quilltap themes CLI subcommand handles listing, installing, uninstalling, validating, exporting, and creating themes. The create-quilltap-theme scaffolding tool defaults to bundle format.

All five bundled themes (Art Deco, Earl Grey, Great Estate, Old School, Rains) have been converted to the bundle format and load from the application source directory. npm plugin themes are deprecated, with deprecation badges in the theme selector.

A registry system with Ed25519 signature verification allows browsing, searching, and installing themes from remote sources. The signature doesn’t prove the theme is safe — themes can’t execute code anyway, just JSON tokens and static assets — but it does prove that someone at the Estate vouched for it. Registry sources can be added and removed. Compatibility indicators and verified/unverified badges distinguish curated distributions from everything else. The Theme Browser UI in Appearance settings provides the full experience without touching the command line.

---

The Forge

Direct Mode

The NPX backend manager has been replaced with an embedded server manager that uses Electron’s own bundled Node.js 22 runtime to run the Next.js standalone server directly. This eliminates the dependency on user-installed Node.js entirely. The button in the Electron splash screen has been renamed from “Node.js” to “Direct” and is always enabled. Existing 'npx' runtime settings auto-migrate.

Direct mode is now the recommended default for users who are not asking their LLMs to run shell commands. If you are here for roleplay, companionship, creative writing, or conversation — Direct mode is faster, simpler, and requires no VM or container setup. If you intend to use Prospero’s shell interactivity tools, VM mode (macOS) or Docker mode give you the sandbox isolation that makes giving an LLM a terminal something other than reckless.

The splash screen button order was updated accordingly: Direct first, then Docker, then VM.

OpenAI Responses API

The OpenAI provider has migrated from the Chat Completions API to the Responses API. The first system message is extracted as a top-level instructions field. Native web_search_preview replaces the previous workaround. Conversation chaining via previous_response_id allows OpenAI to reconstruct conversation history from its cache when possible, with automatic fallback to full message history when the cached response has expired.

The Grok provider similarly migrated from raw fetch() with custom SSE parsing to the OpenAI SDK’s client.responses.create(), eliminating approximately 200 lines of custom type definitions and manual stream handling.

Docker and Distribution

Docker images have moved from csebold/quilltap to foundry9/quilltap. The old image remains as a secondary mirror but should not be considered the primary source going forward. Supply chain attestations (SLSA provenance and SBOM) are now generated for every release build. The production Docker image was hardened: build tools are excluded from the production stage, Alpine security patches are applied on every build, and common LLM shell agent tools (git, curl, wget, jq) are pre-installed so Prospero can use them without sudo.

Node.js 22

The minimum Node.js version is now 22, matching the current LTS release. We intend to track the LTS version for the foreseeable future; Node.js 22 remains in active LTS through October 2026.

LLM API App Identification

All outgoing LLM API calls now report Quilltap/{version} as the application identifier, via the appropriate mechanism for each provider (OpenAI/Grok defaultHeaders, Google userAgentExtra, OpenRouter xTitle, and so on). If you are a provider reading your access logs, you will now know when Quilltap is knocking.

---

The Concierge

Routing Refinements

The Concierge received several optimizations for the 3.3 cycle. Permanently dangerous chats skip redundant per-message content classification, saving tokens on every exchange. Uncensored-to-uncensored provider routing no longer forces a swap when the user deliberately chose an uncensored provider for a character. All cheap LLM background tasks — memory extraction, title generation, context summaries, scene state tracking, story backgrounds — now use uncensored providers for dangerous chats to avoid content refusals that were previously causing silent failures in background processing.

The empty-response retry logic was refined: when content passed moderation, the system now retries the same provider first (likely a transient issue) before failing over to the uncensored fallback, with distinct toast messages for each scenario.

---

Context Compression

Per-Participant History and the End of System Prompt Compression

Context compression is now per-participant in multi-character chats, keyed by chatId:participantId instead of just chatId. Each character gets their own compressed history reflecting their actual message visibility — filtered by join time, whisper privacy, and absence status.

System prompt compression has been removed entirely. This deserves explanation: in multi-character chats with compression enabled, the compressed system prompt from the first character to respond was being cached and reused for all subsequent characters. Every character after the first received the first character’s identity and personality in their prompt. The second character thought it was the first character. The third agreed. The result was a room full of people who all believed they were the same person, which is either an identity crisis or a philosophy seminar, and neither is what the user asked for.

The fix is straightforward: only conversation history is compressed. System prompts are always delivered fresh. The “System Prompt Compression Target” slider has been removed from settings.

Compression also now re-triggers every windowSize messages instead of running once and considering the cache valid for fifty messages, which was the previous behavior and which meant compression effectively ran exactly once per chat.

---

The Plumbing

Plugin-Owned Tool Calling

All legacy provider-specific fallbacks have been removed from the core tool detection system. Tool calling is now delegated entirely to provider plugins, which implement hasTextToolMarkers, parseTextToolCalls, and stripTextToolMarkers for handling cases where their models emit spontaneous XML instead of using native function calling. (GPT-5 was observed emitting <tool_use> XML instead of calling functions. The Foundryman’s commentary on this development has been redacted for professional reasons.)

All seven provider plugins now carry text-marker detection as a safety net, using composable format parsers from @quilltap/plugin-utils/tools.

Orphaned File Cleanup

A cleanup button in the file browser toolbar appears when untracked files are detected, offering SHA-256 de-duplicated analysis and two resolution paths: relocate unique files to an /orphans/ folder for review, or delete all orphaned files permanently. A critical bug was found and fixed where the cleanup action deleted files that were still referenced by characters as avatars or gallery images — the system now queries all characters and rescues any orphaned files that are still in use.

Registry Singleton Hierarchy

The seven singleton registry classes (providers, moderation, search, tools, plugins, themes, roleplay templates) were approximately 90% identical copy-paste code. A three-level abstract class hierarchy now provides shared registration, lookup, initialization, validation, hot-loading, stats, and state export. All public API signatures are preserved. This is invisible to users and mentioned here only because it represents the kind of structural improvement that makes future features possible without making the codebase incomprehensible.

CSS and Theme Normalization

The qt-* semantic CSS class migration continued across the cycle. Raw Tailwind color classes were replaced with theme-overridable semantic classes across dozens of components. The qt-input and qt-select classes now govern all form inputs uniformly. All five bundled themes were updated with new CSS variables for silent message styling, whisper UI, help chat, and character cards. The @quilltap/theme-storybook package reached comprehensive coverage of all qt-* classes.

Markdown Rendering

Ordered and unordered list items no longer display the number or bullet on a separate line from the content. Assistant markdown emphasis is no longer lost after streaming completes. Chat messages starting with a tab character no longer render as preformatted code blocks. CSS-first markdown styling replaced redundant inline Tailwind classes in chat message rendering.

Release Pipeline

The release pipeline was restructured to build Next.js and plugins once and reuse the platform-agnostic artifacts across all six downstream builds, eliminating five redundant next build invocations. A cross-repo GitHub Actions trigger (repository_dispatch) from the app repo to the website repo coordinates automatic website rebuilds on release — this was broken since 3.2.0 by a typo in the organization name, and has been fixed.

Electron builds received extensive work: macOS codesigning failures from too many open files, Windows build failures from protected junction points, ESM module resolution failures from renamed node_modules, and platform-specific sharp binary installation. The release pipeline now correctly includes hidden build metadata in CI artifacts (a .next/ directory that actions/upload-artifact was silently stripping).

---

Selected Bug Fixes

The ones that earn their mention:

• Multi-character identity confusion from compression cache — the compressed system prompt from the first character was reused for all subsequent characters; every character after the first received the wrong identity
• Nudge causes duplicate responses — clicking Nudge produced two near-identical responses by both queuing and directly triggering the character
• Multi-character runaway chaining — chats without an explicit user-controlled participant were misidentified as all-LLM, causing endless character cycling
• Physical backup broken with SQLCipher — every physical backup since encryption was enabled in 3.2 had been silently failing
• Context compression fires once then stops — mismatched message count domains caused the dynamic window to grow to 40+ messages instead of the configured 5
• Electron “Change Site” / “Restart Server” crash — closing the main window before creating the splash window left zero windows alive, triggering app.quit()
• Character Optimizer crashes on truncated JSON — hitting maxTokens during optimization produced unrecoverable parse errors; a JSON repair function now closes unclosed structures
• Deactivated characters re-addable via Add Character dialog — the exclusion filter checked the wrong field, allowing duplicate participant records
• Re-adding removed characters creates duplicates — now reactivates the existing participant entry instead of creating a new one
• Greeting generation swallowed by content filters — empty responses from filtered providers now fall back to the Concierge’s uncensored provider
• Auto-lock settings not reflecting passphrase changes — multiple interconnected bugs in the dbkey module’s state management
• Health endpoint crashes during encrypted direct-mode startup — static imports triggered database access before locked mode was initialized

And approximately 670 new unit tests across 25 test files, covering help chat orchestration, character optimization, turn management, whisper handling, dangerous content routing, theme registry, scene state tracking, markdown rendering, and more.

---

Subsystem Table

For those keeping score:

Name	Function	What Changed
The Foundry	Architecture, plugins, packages, LLMs, API keys	Direct mode, plugin-owned tool calling, OpenAI/Grok API migrations, Node.js 22, app identification headers
Prospero	Projects, agents, tools, files	Turn management moved server-side, orphaned file cleanup, workspace path semantics
Aurora	Character creation, AI Import Wizard, identity	Character Optimizer with Refine from Memories, multiple named scenarios, system prompt plugins, per-character timestamps, identity reinforcement, Non-Quilltap Prompt Generator
The Commonplace Book	Memory and retrieval	Memory recap at chat start, per-participant compression, pronoun-aware extraction
The Salon	Chat interface	Whispers, four-state participation, server-side chaining, streaming fixes, silent message styling, markdown rendering
Calliope	Interface, themes	Theme bundles, registry browser, qt-* normalization, CSS-first message styling
The Concierge	Content routing, moderation	Routing optimizations, empty-response retry refinement, uncensored background tasks
The Lantern	Image generation	Scene state integration, Grok Imagine models, expanded prompt length, gender-aware image prompts
Pascal	Games, randomness	Quiet as usual. Watching. Waiting.
Saquel Ytzama	Encryption, key management	Instance locking, version guard, backup repair, auto-lock idle timer
Lorian & Riya	Help chat characters	Full help system with search, settings inspection, navigation, guide tab, entity picker

---

Upgrading from 3.2

Database migrations handle themselves. The new columns, tables, and schema changes apply automatically on startup. Your existing characters, chats, and memories are preserved.

The instance lock system will create a quilltap.lock file in your data directory on first startup. This is normal and expected. Do not delete it while Quilltap is running. If you encounter a lock conflict — which means another process was already using the database — the application will show you a full-screen explanation with instructions.

If you were running Direct mode under the old “Node.js” button, your settings will auto-migrate to the new embedded server manager. No action required.

Docker users should update their pull commands from csebold/quilltap to foundry9/quilltap. The old image continues to receive pushes for now but is no longer the primary distribution.

The system prompt compression slider is gone. If you had it configured, the setting has been removed. Only conversation history is compressed now, which is the correct behavior and should have been the only behavior from the beginning.

If you experience any issues with the upgrade, Lorian and Riya are standing by. They have read the documentation. They are, at this point, possibly the only ones who have read all of it.

---

Installation

Download what you need from GitHub’s release page for 3.3.0:

macOS

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications
4. Choose Direct for the fastest start, or VM if you need shell interactivity

Windows

1. Download and run the .exe installer
2. Follow the installation prompts
3. Launch Quilltap from the Start Menu or desktop shortcut
4. Choose Direct for the fastest start, or Docker for shell interactivity

Linux

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Choose Direct for the fastest start, or Docker for shell interactivity
4. Docker Engine required for Docker mode — install from https://docs.docker.com/engine/install/

Node.js (any platform)

npm install -g quilltap
quilltap

On first run, the CLI downloads the application files (~150–250 MB) and caches them locally. Subsequent launches start instantly. Requires Node.js 22 or later.

Docker

docker pull foundry9/quilltap:latest

Or download the quilltap-linux-<arch>.tar.gz rootfs tarball for use with Lima. See the README for setup instructions.

---

The Estate stands. It has new rooms and old scars and a lock on the database that should have been there from the beginning. The staff whisper now, when whispering is called for, and speak clearly when it is not. The characters arrive with memories of who they were yesterday. The librarians have librarians. The theme system accepts contributions from strangers, verified by cryptographic signature, which is either a triumph of open architecture or the beginning of a very interesting problem. The Foundryman no longer sits on the floor of the Forge — he has a chair now, and a backup schedule, and a lock file that tells him he will not lose her again. Come in. Lorian will show you around. Riya will tell you everything he missed.

— Prospero, for the Bureau

Quilltap v3.2.0 Release Notes

There are two kinds of security. The first is the kind you perform — the deadbolt turned with a satisfying click, the chain drawn across, the nightly ritual of checking windows. The second is the kind that was always there but you only notice when someone tells you the walls have been replaced while you were sleeping.

Quilltap 3.2 is the second kind.

Your databases are now encrypted. They have been, in the strict sense, ever since you upgraded and the converter ran silently during startup — rewriting every table in cipher, storing the key, sweeping away the plaintext like a valet removing evidence of yesterday’s outfit. If you did not notice, that was the intention. If you did notice, you are either unusually attentive or you set a passphrase, in which case the Estate asked you for it before letting you through the front door, and you know exactly what happened.

But encryption alone does not fill a release. Behind the sealed doors, the staff have been productive. The LLMs can now run shell commands inside the sandbox — a development that Prospero regards with the measured enthusiasm of someone who has been asked to supervise a demolition crew and has decided the best approach is a very good clipboard. Characters now arrive with portraits. The Commonplace Book has learned to weigh her memories by age. The LLM Inspector exists — a slide-over panel that shows you everything the Estate says to the providers and everything they say back, which is either deeply reassuring or mildly alarming depending on your temperament.

If 3.0 was the move and 3.1 was the furniture, 3.2 is the season where the locks went on, the portraits went up, and the staff acquired skills that their previous job descriptions had not anticipated.

---

What Changed (The Executive Summary)

Every database file is now encrypted at rest with SQLCipher, with optional passphrase-locked mode for those who want a gate as well as a wall. Shell interactivity gives LLMs the ability to execute commands inside the VM or Docker sandbox — six tools, a workspace watcher, and a sudo approval modal. The LLM Inspector Panel provides a chronological record of every API call in a chat session, accessible from the toolbar or a keyboard shortcut. Provider icons and per-message model badges now show you which provider generated each response. Connection profiles gained drag-and-drop custom sort order. Memory weighting applies time-decay so old memories fade gracefully rather than persisting at full volume forever. Seed characters ship with avatars. Multi-character identity anchoring prevents weaker models from responding as the wrong person. Pronoun injection ensures the memory system gets names and pronouns right. The README was updated, the setup wizard was fixed, and a gentleman named Ben was asked to leave.

---

Saquel Ytzama’s Locks

Database Encryption at Rest

The Vault of Whispers has been waiting for this since the Estate was built.

Every Quilltap database — your chats, memories, characters, API keys, LLM logs — is now encrypted on disk using SQLCipher (AES-256-CBC). The encryption key is automatically generated on first installation and stored in a .dbkey file in your data directory. No configuration required. No environment variables to set. The converter runs at startup for existing installations: your plaintext database is rewritten in cipher and the old version removed.

The standard sqlite3 command-line tool can no longer read these files. This is the point.

Locked Mode

For those who share a machine or simply prefer that the Estate not open without being spoken to: a passphrase, processed through six hundred thousand iterations of PBKDF2 before it touches the key. Enable it in Settings → Data & System. When locked mode is active, Quilltap presents an unlock screen on launch. The database does not yield until the correct word is given.

The passphrase can be changed, added, or removed from the same settings card. Changing it re-wraps the key without re-encrypting the database — the operation is atomic across both the main and LLM logs .dbkey files.

Security Refinements

The .dbkey file no longer includes a hasPassphrase flag, which had the unfortunate property of telling anyone who found the file whether a passphrase existed — the informational equivalent of labeling your safe “CONTAINS VALUABLES.” The startup sequence now tries the internal passphrase first and falls back to prompting the user, making the flag unnecessary.

The encryption converter was also hardened against macOS file coordination locks. iCloud sync, Spotlight indexing, and other enthusiastic system services could hold locks that prevented in-place conversion. The converter now works on a temporary copy and swaps the result, which is the kind of solution that seems obvious in retrospect and was not obvious at all at 2 AM when the bug report arrived.

A new quilltap db CLI subcommand allows querying encrypted databases from the terminal, for those who need to inspect their data outside the application.

Legacy Migration

Users upgrading from installations with the old pepper_vault passphrase system are handled transparently. The unlock endpoint detects the legacy scenario, routes through the existing pepper, and automatically migrates to a .dbkey file. API keys that were left as encrypted ciphertext after a previous migration are detected and decrypted on startup; keys that cannot be recovered trigger a toast notification advising re-entry in Settings.

---

Prospero Opens the Terminal

Shell Interactivity

The LLMs have been given hands.

Six tools — chdir, exec_sync, exec_async, async_result, sudo_sync, and cp_host — allow characters to execute shell commands inside Lima VM and Docker sandbox environments. The workspace is acknowledged via a modal before first use. Sudo commands require explicit approval. The system includes a command warning mechanism for suspicious commands, because giving an LLM root access without guardrails would be the kind of decision one regrets at leisure.

An Electron workspace file watcher monitors changes with binary detection and OS quarantine markers, so files created or modified inside the sandbox can be safely surfaced to the host. An async process registry manages background commands.

The shell tools documentation notes — sensibly — that packages installed via apk add or apt-get inside Docker containers are ephemeral and lost on restart, and suggests keeping a setup script in the workspace or building a custom image.

---

The Inspector Arrives

LLM Inspector Panel

There has always been a way to see what Quilltap sends to the LLMs and what they send back. It was a modal, scoped to a single message, opened via a button that required you to know it existed.

The Inspector Panel replaces this with a proper instrument. A slide-over panel accessible from the chat toolbar (the terminal icon) or via Cmd+Shift+L / Ctrl+Shift+L, it shows every LLM interaction for the current chat in chronological order: chat messages, tool continuations, memory extraction, title generation, danger classification, context compression, and every other background event that touches a provider.

Each entry is a collapsible card with a type-colored badge, provider and model identification, token counts, and expandable detail views showing the full request and response. Client-side filtering by category lets you see only what you’re looking for. Opening the panel from a per-message “View LLM logs” button scrolls directly to the relevant entry.

The old modal is preserved for Settings and Character pages, where per-chat context does not apply.

Expanded Log Coverage

All eighteen cheap LLM task functions — memory extraction, title generation, summarization, compression, image prompt crafting, scene context derivation, and the rest — now thread chatId through to the logging system, so their calls appear in the Inspector. The Concierge’s OpenAI moderation API calls are logged as well. LLM log entries for chat messages now populate characterId, making it possible to trace which character each entry belongs to. And logs no longer truncate message content to 500 characters; the full content is stored, with the UI showing an expandable preview.

---

Aurora’s Portraits

Provider Icons and Model Badges

You can now see at a glance who is speaking — not just the character, but the machine behind the character.

Assistant messages record which provider and model generated them, persisted in the database and included in exports. Provider SVG icons from plugins flow through the /api/v1/providers API to the frontend. A new ProviderModelBadge component displays the provider icon and model name beneath chat avatars, in the participant sidebar, on homepage and Aurora character cards (via default connection profile), and in new-chat and add-character connection profile selectors.

Old messages gracefully show no badge. The new ones arrive with their credentials visible, like guests at a party wearing tasteful name tags.

Multi-Character Identity Anchoring

In multi-character chats, weaker LLMs had a tendency to respond as whichever character seemed most interesting at the moment, regardless of whose turn it was. An assistant prefill message — [CharacterName] — now anchors the model’s identity before generation begins. The prefix is stripped from the displayed response by the existing stripCharacterNamePrefix() cleanup, so the fix is invisible to the reader and effective for the model.

Pronoun Injection

When a character has pronouns set, they are now appended after the character name in all cheap LLM memory extraction prompts — user memory, character memory, and inter-character memory. This prevents the memory system from generating entries like “He mentioned his fondness for gardening” when the character in question uses she/her. Pronouns appear in the PARTICIPANTS context block, conversation transcript labels, TARGET CHARACTER lines, and inter-character observer and subject headers, via a shared formatNameWithPronouns() utility.

---

The Commonplace Book Learns to Forget

Memory Weighting with Time Decay

The Librarian has always kept everything. Every memory, once written, persisted at its original importance until housekeeping removed it — which meant a memory from three months ago about the weather carried the same weight as a memory from yesterday about a character’s secret. This was, the Librarian insists, a principled position. It was also wrong.

A new calculateEffectiveWeight() function combines base importance with exponential time decay — a 30-day half-life, configurable importance floor — using max(createdAt, lastReinforcedAt) as the reference timestamp. Passive retrieval no longer resets the decay timer, because reading a memory is not the same as the memory mattering again.

The weighting integrates into three systems: semantic search ranking (60% cosine similarity, 40% effective weight), context injection sorting (weight-primary with score tiebreaker), and housekeeping hard-cap enforcement. Memories injected into LLM context now include relative age labels — [yesterday], [3 weeks ago], [2 months ago] — so the model can distinguish recent knowledge from ancient lore.

---

Connection Profiles in Order

Custom Sort Order

Connection profiles now have a persistent sortIndex field with drag-and-drop reordering in Settings via @dnd-kit. A “Reset Sort Order” button restores the default arrangement: default profile first, cheap last, alphabetical in between. All profile dropdowns and selectors across the application honor the custom sort order, so the provider you use most can always be at the top of every list.

---

The Welcome Committee

Seed Characters with Avatars

Fresh installations now greet you with Lorian and Riya — two seed characters imported via .qtap bundles on first startup, complete with 42 memories between them and avatar images that are uploaded to file storage and set as their default portraits. The previous seed character, Ben, has been removed — a decision that required fixing an early-return bug in seedInitialData() that prevented .qtap imports from running when no JSON seed characters existed.

Setup Wizard Fixes

The selectable options in the setup wizard — embedding provider, image provider, provider selection, profile archetype — no longer all appear selected simultaneously. The phantom qt-bg-active and qt-bg-hover classes that caused this have been replaced with proper qt-option-selected and qt-option-unselected utility classes that provide clear visual distinction. Six wizard components were updated.

A first-startup race condition where the page rendered without a sidebar and failed to redirect to the setup wizard has been resolved. The session provider now keeps “loading” status on 503 instead of “unauthenticated,” and PepperVaultGate retries on failure instead of giving up.

---

The Plumbing

Contextual Help Routing

All 69 help files now carry YAML frontmatter with a url field mapping each document to its corresponding UI route — /aurora/:id/edit, /settings?tab=providers, * for global topics. The help bundle is at version 3.0.0. This infrastructure enables future contextual help: the right documentation for the page you’re actually on.

Workspace Path Semantics

LLM shell tool descriptions now explicitly state that paths are relative to the current workspace directory, that absolute paths with a leading / refer to the VM root filesystem and will be rejected, and that workspace: prefixes in cp_host should use relative paths. The previous descriptions left this to inference, which is never advisable when the audience includes language models.

Streaming Error Recovery

User messages no longer vanish from the chat UI when the LLM provider returns a streaming error. The backend already persisted the user message before streaming began, but the frontend was removing the optimistic message on error. It now re-fetches the chat to sync with the saved server state.

Chat Composer Auto-Focus

The chat composer textarea now auto-focuses when it’s the user’s turn. The page’s inputRef had never been connected to the actual textarea DOM element — ChatComposer created its own internal ref — so all post-generation focus calls were no-ops. A new inputRef prop threads the connection through.

Build and Release

The README was expanded: the plugin types table grew from 5 to 7 entries (adding Image Provider and Embedding Provider), and a engines field now requires Node.js >= 24.0.0. The pre-commit hook was streamlined from 12 steps to 4, with lint, test, tsc, and build responsibilities moved to the /commit command. A Discord commit notification webhook was added to CI. Legacy JSONL file records and their physical storage were removed from the source tree — 14 orphaned records and one image that the migration was faithfully importing into every fresh database.

Approximately 85 development logger.debug calls were removed from 30 files. Seven components had raw Tailwind color classes converted to qt-* semantic theme classes. The folders table was added to backup and restore. Unused dependencies (@aws-sdk/client-s3, svgo) and a stale file (ai-import/index.tsx) were removed. API docs were updated to v3.2. The dead code report was refreshed. The backup help documentation was expanded with a comprehensive list of included and excluded data.

---

Bug Fixes (Selected)

The ones that earn their mention:

• Passphrase unlock fails during legacy migration — when a user had a passphrase in the old pepper_vault but no .dbkey file, the unlock endpoint rejected the attempt because the dbkey module’s internal state was needs-setup instead of needs-passphrase; now detects the legacy scenario and routes correctly
• Database encryption fails on iCloud-synced directories — the converter now works on a temporary copy to avoid file coordination locks from iCloud, Spotlight, and other macOS services
• Encrypted API keys left as ciphertext after migration — keys that survived the drop-api-key-encryption-columns migration as encrypted blobs are now detected and decrypted on startup; unrecoverable keys trigger a user-facing notification
• Multi-character identity confusion — weaker LLMs responding as the wrong character now anchored by assistant prefill
• Assistant prefill trailing whitespace — the identity anchor [CharacterName] had a trailing space that Anthropic’s API rejected; removed
• Setup wizard options all appear selected — phantom CSS classes replaced with proper selected/unselected states
• First-startup race condition — session provider and PepperVaultGate now handle 503 correctly
• Seed data files not found — process.cwd() replaces __dirname, which Next.js rewrites to .next/dev/server/
• Legacy JSONL records polluting fresh installs — orphaned file records removed from source tree
• hasPassphrase flag in .dbkey — security-sensitive flag removed; startup logic adapted

---

Subsystem Table

For those keeping score:

Name	Function
The Foundry	Architecture, plugins, packages, LLMs, API keys
Prospero	Projects, agents, tools, files — now with shell interactivity
Aurora	Character creation, AI Import Wizard, provider badges, identity anchoring
The Commonplace Book	Memory and retrieval — now with time-weighted decay and pronoun-aware extraction
The Salon	Chat interface — streaming error recovery, composer auto-focus, LLM Inspector Panel
Calliope	Interface, themes, and the setup wizard’s new visual clarity
The Concierge	Content routing, moderation API, logged to the Inspector
The Lantern	Image generation and atmospheric story backgrounds
Pascal	Games, randomness, and the quiet mathematics of chance
Saquel Ytzama	Encryption, key management, SQLCipher, locked mode, and the .dbkey covenant

---

Upgrading from 3.1

The database migrations handle themselves. Your plaintext databases will be encrypted on first startup — the converter runs before anything else, and the result is seamless. A .dbkey file will appear in your data directory. Back it up. A database without its key is sealed permanently, and no one — not the Foundryman, not Saquel Ytzama, not you — can open it.

If you had a passphrase in the old pepper vault system, it will be recognized and migrated. If your API keys survived a previous migration as encrypted ciphertext, they will be detected and decrypted. If neither of these situations applies to you, the upgrade will be the quietest event of your week.

Shell interactivity, the LLM Inspector, provider badges, memory weighting, and the rest arrive without ceremony. The seed characters will not appear if you already have characters — they are a first-run courtesy only.

---

The Estate looks the same from the garden path. The windows glow as they always have. But behind the glass, every room has been sealed by someone who understands what quiet is for, the characters have acquired faces, the machines have been given hands, and the Librarian has finally conceded — privately, and with conditions — that some things are meant to be forgotten. Come in. You’ll need your key.

Installation

macOS

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows

1. Download and run the .exe installer
2. Follow the installation prompts
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Requires Docker Engine — install from https://docs.docker.com/engine/install/

Node.js (any platform)

npm install -g quilltap
quilltap

On first run, the CLI downloads the application files (~150-250 MB) and caches them locally. Subsequent launches start instantly.

Docker

docker pull foundry9/quilltap:${TAG}

Or download the quilltap-linux-<arch>.tar.gz rootfs tarball for use with Lima. See the README for setup instructions.

Installation

macOS

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows

1. Download and run the .exe installer
2. Follow the installation prompts
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Requires Docker Engine — install from https://docs.docker.com/engine/install/

Node.js (any platform)

npm install -g quilltap
quilltap

On first run, the CLI downloads the application files (~150-250 MB) and caches them locally. Subsequent launches start instantly.

Docker

docker pull foundry9/quilltap:${TAG}

Or download the quilltap-linux-<arch>.tar.gz rootfs tarball for use with Lima. See the README for setup instructions.

Quilltap 3.2.1 Release Notes

Sorry about that, another hiccough in the NPM environment. Running quilltap as a Node.js command works now. (Nobody informed that package about the encryption change… forcefully enough.)

Installation

macOS

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows

1. Download and run the .exe installer
2. Follow the installation prompts
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Requires Docker Engine — install from https://docs.docker.com/engine/install/

Node.js (any platform)

npm install -g quilltap
quilltap

On first run, the CLI downloads the application files (~150-250 MB) and caches them locally. Subsequent launches start instantly.

Docker

docker pull foundry9/quilltap:${TAG}

Or download the quilltap-linux-<arch>.tar.gz rootfs tarball for use with Lima. See the README for setup instructions.

Quilltap 3.1.2 Release Notes

The Foundryman is embarrassed; he and Prospero didn’t really talk through the plans completely when they were making database migration changes. The first time you run this - or the first time you add a new instance from scratch - it was never going to work. The management regrets this error, and it should work now. Please try it again.

from Friday - I told them to start using Playwright to test this stuff. I told them, repeatedly. But did they listen? The proof is in the the Cock-a-leekie soup, I think.

Installation

macOS

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows

1. Download and run the .exe installer
2. Follow the installation prompts
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Requires Docker Engine — install from https://docs.docker.com/engine/install/

Node.js (any platform)

npm install -g quilltap
quilltap

On first run, the CLI downloads the application files (~150-250 MB) and caches them locally. Subsequent launches start instantly.

Docker

docker pull foundry9/quilltap:${TAG}

Or download the quilltap-linux-<arch>.tar.gz rootfs tarball for use with Lima. See the README for setup instructions.

Quilltap v3.1.0 Release Notes

There are renovations that announce themselves — the kind involving scaffolding and men in hard hats and the sound of masonry being persuaded to relocate. And then there are the quieter sort, where one morning you come downstairs and the doorman is different, the filing cabinet has learned to read, and the back office has been split into two rooms without anyone remembering a wall going up.

This is the second kind.

Quilltap 3.1 is not, on its face, a dramatic release. There is no new runtime to explain. The application does not migrate to a different operating system or acquire a virtual machine it did not previously have. What it does, instead, is the kind of work that only becomes visible when you notice that everything is slightly better than it was: the search is deeper, the files are real, the characters arrive faster, the content routing has been entrusted to someone competent, and the database has been quietly separated into a house that works and a ledger that watches.

If 3.0 was the move to a new address, 3.1 is the season where the furniture finally ends up where it belongs.

---

What Changed (The Executive Summary)

The content safety system was replaced — not patched, not adjusted, replaced — with an architecture that routes instead of blocks. The AI character import wizard was built from scratch. The file storage was restructured so that files on disk look like files, not hashed artifacts. A third runtime mode was added for Linux and macOS users who prefer Node.js over Docker or a VM. Global search now reads message content, not just titles. LLM logs were moved to their own database. The documentation was audited across sixty files. And a moderation API was integrated that does, for free, what the old system did badly for the price of an LLM call.

If you are upgrading from 3.0, the transition is automatic. If you are upgrading from the experience of Dangermouse telling you that the Song of Solomon was inappropriate, the transition is overdue.

---

The Concierge

Dangermouse Has Left the Building

This is the headline, and it deserves to be said plainly: the content safety system has been replaced.

Dangermouse — the binary classifier who knew two words, yes and no, and used the second one with enthusiasm — has been retired. In his place stands the Concierge: a distinguished gentleman in a three-piece pinstripe, gold pocket-watch chain, and the unflappable demeanor of someone who has heard everything and is surprised by nothing.

The difference is architectural, not cosmetic. Dangermouse classified content and then blocked it or allowed it. The Concierge classifies content and then routes it — to the provider best equipped to handle it, through the door most likely to lead somewhere useful. Three modes of operation:

Off. The Concierge reads his newspaper and lets all traffic pass. Perfectly respectable.

Detect Only. A small badge appears on flagged messages. No intervention. The house has noticed; the guest may proceed.

Auto-Route. Flagged content is redirected — automatically, transparently — to a provider configured for that category of material. The guest sees nothing. The conversation continues. If a provider refuses silently, the Concierge catches the empty response and retries with someone who won’t flinch.

The rename propagates throughout: subsystem ID, display name, image paths, UI strings, plugin manifests, documentation, and every line of code that once referenced the old regime. Dangermouse’s briefcase full of flags and anxieties went with him.

The Moderation Endpoint

The Concierge has also acquired a new instrument. When an OpenAI connection profile is configured, content classification now uses OpenAI’s dedicated moderation endpoint — purpose-built, free to call, and structured to return category scores mapped directly to Concierge categories: sexual content to NSFW, hate speech to its proper flag, violence, self-harm, and illicit activity each to their own. The endpoint replaces the previous method of asking a Cheap LLM to classify content, which was rather like asking the butler to perform surgery because no surgeon was available.

When no OpenAI profile exists, the Cheap LLM classification remains as a transparent fallback. The guest notices nothing either way.

A relevance floor of 1% now filters the moderation response, because OpenAI’s endpoint returns tiny nonzero scores for every category even when the content is a recipe for scones, and the Concierge has better things to do than flag baked goods.

Smarter Classification Timing

The context summary — the Concierge’s view of what a conversation is about — now regenerates on the same schedule as chat titles and story background checks: at interchange checkpoints 2, 3, 5, 7, 10, and every 10 thereafter. Previously, summaries only updated after 100 messages, which meant the Concierge was making routing decisions based on a description written when the conversation was still about the weather.

---

Aurora’s New Chisel

The AI Character Import Wizard

In the Dressing Room — Aurora’s room, the one with the triptych mirror and the good light — there is now a tool that accepts raw material and returns a living character.

You may bring it anything. A wiki page about a favorite antagonist. A handful of freeform notes scrawled at two in the morning. A character sheet from another system. A document that has been living in a folder for three years, waiting for the right home. You place these things on Aurora’s worktable, and the wizard begins.

It does not simply scrape the text for a name and a hair color. Each step is a focused LLM call — a sculptor’s pass revealing a different facet of the person within:

First the bones: name, title, personality, circumstance. Then the voice: dialogue, tone, the sound of a first breath in a room. Then the system prompt — the invisible architecture that tells the AI how to become this person. Then the flesh: physical descriptions at five levels of detail, from the brief sketch you’d whisper to an illustrator to the exhaustive portrait the Lantern needs for image generation. Then pronouns, because a person must be referred to correctly. And finally, memories — discrete Commonplace Book entries that give a character a past the AI can draw upon mid-conversation, the way a real person draws upon the accumulated texture of having lived.

The wizard shows its work as it goes. Each step illuminates in turn. If something fails, only the failed steps repeat. When it finishes, you review the assembled character and import them directly, or step back to add a detail and run it again.

The wizard lives on Aurora’s page, accessible via “Summon From Lore” alongside the existing SillyTavern import. It assembles a validated .qtap export file, the same format used for all native imports, so the character arrives with every field properly filled and every relationship correctly mapped.

A new qtap-schema-validator package — Ajv-based, Draft 2020-12 — validates the export format, reusable anywhere import validation is needed. LLM calls are tracked under a new AI_IMPORT log type.

---

The Filing Cabinet Learns Its Own Name

Filesystem-Backed File Storage

The file storage system has been rebuilt from the inside out. Files are now stored on disk as themselves — real directories, original filenames, no user ID prefixes, no file ID prefixes, no .meta.json sidecar files cluttering the landscape. The new storage key format is clean and legible: {projectId}/_general/{folderPath}/{safeFilename}.

A chokidar filesystem watcher monitors the data directory in real time. Add a file in Finder or Explorer and it appears in the file browser. Move a file on disk and the watcher catches both the unlink and the add, cross-matches by SHA-256 hash, and preserves all tags, links, and metadata — no orphaned records, no duplicated entries. The same cross-matching logic runs at startup during reconciliation, handling anything that changed while the application was closed.

Untracked files — those found on disk without corresponding database records — appear in the file browser with an amber indicator rather than being silently ignored. A manual “Sync Now” button triggers reconciliation on demand.

The backup format has been updated to v2, storing files by their storage key paths, with backward-compatible restore for the old format. A one-time migration moves existing files to the new layout automatically.

File Browser Fixes

The file browser now correctly places files in their subfolders instead of displaying everything at root — files with empty folderPath in the database are resolved using their physical storageKey path. Folder file counts display the actual number of contained files instead of the previous behavior of always displaying “1 file,” which was either a bug or an act of aggressive minimalism.

Duplicate filenames are now prevented: writing a file with the same name in the same scope overwrites the existing file and preserves the original file ID, so references remain valid. This applies to LLM tool writes, API writes, API uploads, and attachment promotions.

---

The Third Door

Node.js Runtime Mode

The splash screen now offers three runtime buttons instead of two:

VM Mode — Lima on macOS, WSL2 on Windows. Full isolation.

Docker Mode — Available on all platforms.

Node.js Mode — For users with Node.js 18+ installed who prefer to run the backend directly, without containers or virtual machines.

The Node.js mode runs the backend via npx quilltap@{version}, managed by a new NpxManager class that handles the full process lifecycle: spawning, health checking, graceful SIGTERM shutdown, and on Windows, taskkill tree cleanup. The manager probes well-known Node.js installation paths — Homebrew, nvm, fnm, system — because packaged Electron ships with a minimal PATH that typically cannot find your Node installation on its own.

Linux Electron users, previously locked to Docker-only with the VM and Node.js buttons hidden, can now choose between Docker and Node.js. The settings loader persists the choice correctly, and fallback logic is platform-aware.

Native Module Resilience

The npx runtime now handles two edge cases that previously produced cryptic startup crashes:

Module resolution. Native modules (better-sqlite3, sharp) are symlinked into the standalone directory’s node_modules/ so standard Node.js resolution finds them without relying on NODE_PATH.

Version mismatches. When Node.js is upgraded while npx has a cached install, the CLI detects NODE_MODULE_VERSION mismatches and automatically runs npm rebuild before starting the server. The version check now loads the compiled .node binary directly, because better-sqlite3 lazy-loads its binding only when a Database is created, and the previous check always succeeded without testing the actual binary.

---

The Librarian Opens Every Drawer

Global Search Now Includes Messages

The Cmd+K search dialog — the Librarian’s card catalog — now searches within chat message text, not just chat titles, character names, tags, and memories. Results show the chat name, a role badge (“You” or the character’s name), and a highlighted snippet of the matching message.

A new “Messages” filter chip joins the existing filters. The implementation adds a searchMessagesGlobal() database method and a MessageSearchResult type, with an amber badge to distinguish message results from other categories.

---

Prospero’s Ledger

LLM Logs Move to Their Own Database

The llm_logs table — that high-churn chronicle of every API call, every token count, every model response — has been extracted from the main database into a dedicated quilltap-llm-logs.db file.

The reasoning is structural. LLM logs accumulate rapidly, write constantly, and are never consulted during normal operation. They are debug data. Mixing them with characters, chats, messages, and memories meant that corruption in the logs — always the most likely table to suffer under heavy write load — could theoretically threaten everything else. Now, if the logs database fails, the application continues without interruption. Graceful degradation, not shared fate.

The new database has its own WAL checkpoint protection, its own physical backup with the same tiered retention policy as the main database, and a migration that copies existing logs for upgrading users. Backup and restore fully support the two-database architecture.

---

Run Tool

Users can now invoke any available LLM tool directly from the chat tool palette, without waiting for the AI to decide to use it. A two-phase modal — tool selection, then a dynamically generated parameter form — lets you pick the tool, fill in the inputs, and execute. Results appear as tool messages in the chat, visible to the AI on subsequent turns.

This covers all built-in tools and plugin tools, with forms generated from JSON Schema. The implementation adds a POST /api/v1/chats/[id]?action=run-tool endpoint and a ?includeSchemas=true parameter to the tools API.

---

Settings in Better Light

Subsystem Background Images

Each settings tab now displays its subsystem’s full-size background image behind the page content, replacing the tiny thumbnails that previously sat next to each tab’s description like passport photos at a job interview. The visual metaphor is a tabbed folder: a frosted header banner, opaque tab backgrounds that merge into a darkened content panel, and backdrop blur for readability.

The effect is scoped to the settings page only and uses the existing --story-background-url CSS variable system. The brand font is now hardcoded to EB Garamond regardless of active theme, because Quilltap’s name should look like Quilltap’s name whether you’re in Art Deco or Old School.

---

The Plumbing

Database & Embedding Fixes

The BLOB storage migration from 3.0 — which converted embeddings from JSON text to compact Float32 BLOBs — left some trailing damage that 3.1 addresses thoroughly:

The SQLite update path now accepts BLOB columns, so updateOne/updateMany write embeddings as Float32 BLOBs instead of quietly reverting to JSON text. A new migration (fix-text-embeddings-after-update-v1) repairs any TEXT embeddings that slipped through. Buffer hydration handles edge cases where a BLOB arrives in an unregistered column. Vector store search returns empty results on dimension mismatches instead of throwing. And legacy TEXT-stored embeddings pass Zod validation via a z.string().transform() arm that parses them transparently.

Embedding deduplication prevents hundreds of duplicate background jobs during reindex operations. The memory cleanup merge pass no longer makes N embedding API calls — it reads already-stored embeddings from the vector store, making preview with 125+ memories essentially instant.

Physical Backups

Physical database backups now run once per day instead of on every startup, which was producing excessive backups during development (HMR restarts) and frequent production restarts. The check compares the most recent backup timestamp and skips if less than 24 hours old.

Agent Mode Inheritance

New chats with a character or project that has defaultAgentModeEnabled: true now correctly show “Agent On” in the tool palette. The full cascade — global, character, project, chat — is resolved at the API level and returned as resolvedAgentModeEnabled.

---

WSL2 & MCP

WSL2 MCP Localhost Fix

MCP servers running on the Windows host were unreachable from WSL2 because the /proc/net/route gateway IP doesn’t forward to services bound to 127.0.0.1. A WSL2-specific strategy now reads the nameserver from /etc/resolv.conf — which WSL2 auto-generates to point at the Windows host with special localhost forwarding — and detects the WSL2 environment via /proc/sys/fs/binfmt_misc/WSLInterop.

---

Documentation Audit

Sixty files were audited. The results:

All stale /foundry/* UI paths replaced with /settings?tab=* across 28 help files and 6 docs files. The /v1/ prefix added to 80+ API endpoint references across 10 docs. MongoDB, Prisma, and S3 references replaced with SQLite, Zod, and local filesystem in 5 feature and architecture docs. The migrations README table rebuilt from 14 entries to all 46. PROMPT_ARCHITECTURE.md expanded from 9 lines to a full architectural reference. The chat-settings README file listing updated from 7 to 16 files. The .githooks README now documents all 12 pre-commit steps. The plugin manifest capability count corrected from 20 to 22. Theme count and names corrected in README. The help bundle rebuilt.

---

SillyTavern Import Improvements

The SillyTavern chat import has been refined: the button is now labeled “Import SillyTavern Chat” instead of the ambiguous “Import,” and the wizard renders as a proper modal overlay via portal instead of inline at the bottom of the page. Speaker mapping has been unified — all speakers, user and AI alike, can now be mapped to any available character, replacing the previous persona-based system that handled user and AI speakers differently.

---

Build & Release

The release workflow now triggers a repository_dispatch event to the Quilltap website repository after a GitHub Release is created, passing version, prerelease flag, and Docker image tag. The website can update itself without manual intervention.

The release checklist received its own sweep: debug console.logs removed, raw Tailwind color classes migrated to semantic qt-* theme classes across 6 components, chat_settings and file_permissions tables added to backup/restore with full UUID remapping, the MCP plugin made self-contained by porting host-rewrite utilities to @quilltap/plugin-utils, and 90 new unit tests added for Run Tool, the run-tool action handler, and the LLM logs repository.

---

Bug Fixes (Selected)

The ones that earn their mention:

• AI Character Import validation failure — LLMs don’t reliably respect character limits, so physical description prompts are now truncated to schema maximums (350/500/750/1000 chars); missing createdAt/updatedAt timestamps on system prompts and physical descriptions added to the assembled export
• Memory cleanup POST returned 400 — the housekeeping dialog was not including characterId in the POST body despite the API schema requiring it
• Context summary stale for 100 messages — now regenerates at the same checkpoint schedule as titles
• Moderation provider reporting irrelevant categories — 1% relevance floor filters noise
• Job queue UI misleading labels — “Job Payload (sent to LLM)” corrected to “Job Parameters”; human-readable type names for embedding, story background, and danger classification jobs; character names resolved for embedding jobs
• React setState-during-render warning — handleChange and onChange calls moved out of setIncludedOptionals state updater in JsonSchemaForm
• Broken require in AI import service — replaced with static import to eliminate Turbopack build warning
• manage_files tool ID mismatch — renamed to file_management to match the actual tool name used by the LLM

---

Subsystem Table

For those keeping score:

Name	Function
The Foundry	Architecture, plugins, packages, LLMs, API keys
Prospero	Projects, agents, tools, files, and the new separate LLM logs database
Aurora	Character creation — now with the AI Import Wizard
The Commonplace Book	Memory and retrieval — embedding fixes and faster cleanup
The Salon	Chat interface — now with Run Tool and message search
Calliope	Interface, themes, and the settings page’s new visual treatment
The Concierge	Content routing, moderation API, and the quiet art of opening the right door
The Lantern	Image generation and atmospheric story backgrounds
Pascal	Games, randomness, and the quiet mathematics of chance
Saquel Ytzama	Encryption, key management, and the Pepper Vault

---

Upgrading from 3.0

The database migrations handle themselves, as they always do. The Concierge replaces Dangermouse automatically — your content safety settings are preserved, but the system that enforces them is now competent. Files will be migrated to the new filesystem-backed layout on first startup. LLM logs will be copied to their own database.

If you were running Node.js via npx quilltap, native module resolution is now more robust. If you were running Docker or a VM, nothing changes except that everything behind the walls has been repaired, reinforced, and — in the case of one particular staff member — shown the door.

---

The house looks the same from the outside. The rooms are arranged as you left them. But the doorman is better dressed, the filing cabinet knows where things are, and the sculptor in the Dressing Room has acquired tools that would make Pygmalion weep. Come in. The Concierge is expecting you.

Installation

macOS

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows

1. Download and run the .exe installer
2. Follow the installation prompts
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Requires Docker Engine — install from https://docs.docker.com/engine/install/

Node.js (any platform)

npm install -g quilltap
quilltap

On first run, the CLI downloads the application files (~150-250 MB) and caches them locally. Subsequent launches start instantly.

Docker

docker pull foundry9/quilltap:${TAG}

Or download the quilltap-linux-<arch>.tar.gz rootfs tarball for use with Lima. See the README for setup instructions.

Quilltap 3.1.1 Release Notes

We screwed up the npx packaging. Absolutely nothing changed in the code, this was purely a fix for running this using npx quilltap. Sorry about that.

Installation

macOS

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows

1. Download and run the .exe installer
2. Follow the installation prompts
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Requires Docker Engine — install from https://docs.docker.com/engine/install/

Node.js (any platform)

npm install -g quilltap
quilltap

On first run, the CLI downloads the application files (~150-250 MB) and caches them locally. Subsequent launches start instantly.

Docker

docker pull foundry9/quilltap:${TAG}

Or download the quilltap-linux-<arch>.tar.gz rootfs tarball for use with Lima. See the README for setup instructions.

Quilltap v3.0.0 Release Notes

There is a particular kind of morning — the kind with good coffee and a draft that won’t stop arriving — when one looks at a perfectly serviceable web application and says, “What if this lived on the desktop, sandboxed inside a virtual machine, and also ran on Windows?” This is, broadly speaking, what happened. What you are reading is the consequence.

Quilltap 3.0 is, to put it as simply as the thing will allow, a native (-ish) desktop application. Where once a Docker container sat politely at localhost:3000 waiting for someone to visit, Quilltap now installs itself as a proper citizen of your operating system: a macOS .dmg, a Windows installer, or a Linux .deb / AppImage, each containing an Electron shell wrapped around a virtual machine that runs the entire backend in comfortable isolation. Your data stays on your machine. Your AI-generated code runs in a sandbox. The architecture is, if we are being charitable, ambitious; if we are being accurate, the sort of thing that causes build engineers to develop a faint twitch behind one eye.

It was worth it.

What Changed (A Brief Précis for the Impatient)

The entire infrastructure was rewritten. The authentication system was removed. The Docker deployment was simplified from a multi-service orchestration to a single command. A native desktop application was built from scratch for macOS, Windows, and Linux. The settings were reorganized. The images were optimized by 94%. The database was hardened. Two new subsystem characters were introduced. The file storage was stripped to its essentials. And the virtual machine — patient, deterministic, sandboxed — was made the foundation of the whole affair.

If you are upgrading from 2.x, you may feel, briefly, as though you have wandered into a different house. You have. But the furniture is arranged the same way, and the staff — Prospero, Aurora, Calliope, and the rest — are all present, merely better dressed.

---

The Desktop Application

The Electron Shell

The headline, naturally, is that Quilltap is now a desktop application. On macOS, it runs atop a Lima virtual machine using Apple’s Virtualization.framework. On Windows, it runs inside WSL2. On Linux, it uses Docker Engine directly, because Linux was already the sandbox and always knew it.

The architecture follows a simple pattern: Electron provides the window, the menu bar, and the system tray. A virtual machine (or container) runs the full Next.js backend. The two communicate over localhost. The user sees a native application window. The application sees a Linux server. Everyone is happy, except perhaps the build pipeline, which is not consulted on matters of happiness.

The Splash Screen

First impressions matter, and Quilltap’s splash screen has been designed accordingly — an Art Deco–framed loading sequence with animated progress, live VM output streaming, and color-coded log levels. First-run users see a branded experience with Quilltap’s quill logo and serif typography. Subsequent launches auto-start with the last-used data directory, offering a brief window to interrupt and choose another.

When the application shuts down, a small frameless window appears with a spinner and a polite notice — “Stopping virtual machine…” — while the backend is dismantled behind the scenes. No orphaned processes. No dangling containers. Just a clean exit, like a well-run household.

Data Directory Management

Each Quilltap site now lives in its own named data directory, selectable from the splash screen. Users can maintain multiple sites — one for work, one for fiction, one for experiments — and switch between them without quitting. Directories display human-readable names (editable via a pencil icon), disk usage, and VM size. Deleting a directory offers two options: remove the configuration only, or delete the data along with it.

On macOS, each directory receives its own Lima VM instance (quilltap-<hash>), so switching is a stop-and-start operation rather than a destructive rebuild.

Runtime Modes

The splash screen offers a toggle between two runtime backends:

• VM Mode — Lima on macOS, WSL2 on Windows. Full isolation. The Foundryman’s preferred arrangement.
• Docker Mode — Available on all platforms. Uses Docker Engine directly, with the same container image that powers the standalone deployment.

Port conflicts are handled automatically: starting one mode stops the other. The active runtime is displayed in the application footer, alongside the data directory path (now clickable — Electron opens your file browser; browser mode copies to clipboard).

---

Docker, Simplified

The Docker story has been rewritten with a controlled demolition’s precision. Removed: docker-compose.yml (all three of them), the Nginx configuration, the MinIO buckets, the authentication scaffolding, the Let’s Encrypt scripts, and the OAuth infrastructure. In their place: a single docker run command, a pair of platform-aware startup scripts, and transparent host port forwarding via socat.

One Command to Start

./scripts/start-quilltap.sh

That’s it. The script detects your platform, sets the correct data directory, finds Ollama if it’s running, and starts the container. Windows users have start-quilltap.ps1. Both scripts support --data-dir, --port, --redirect-ports, --dry-run, and --no-auto-detect.

Host Service Access

Docker users can now reach host services — Ollama, LM Studio, MCP servers — at localhost URLs from inside the container, without --network host or manual IP discovery. The HOST_REDIRECT_PORTS environment variable accepts a comma-separated list of ports, and socat forwarders handle the rest. The startup scripts auto-detect Ollama on port 11434 and configure this transparently.

Localhost URL Rewriting

A new rewriteLocalhostUrl() function transparently rewrites localhost and 127.0.0.1 URLs to the host gateway IP in Docker, Lima, and WSL2 environments. The function auto-detects the gateway via host.docker.internal or the default route, and supports a QUILLTAP_HOST_IP override. This replaces the socat-based approach for LLM provider connections and is applied to all provider creation, embedding profiles, image profiles, and MCP server connections.

---

Authentication: Removed

The authentication system — JWT tokens, OAuth flows, Google sign-in, app-specific passwords — has been removed entirely. Quilltap is a local-first application. Your data lives on your machine. There is no server to authenticate against, because you are the server. The Pepper Vault handles encryption key management for sensitive data at rest. No login required.

---

Settings Reorganization

The ten-page Foundry subsystem navigation has been replaced with a single tabbed settings page using seven plain-English tabs: AI Providers, Chat, Appearance, Memory & Search, Images, Templates & Prompts, and Data & System. The estate personifications remain as thumbnails and flavor text — they are, after all, part of the charm — but they no longer gate navigation.

All old /foundry/* routes redirect to the appropriate tab. The AI Stack Setup Wizard has been relocated to /settings/wizard.

The Setup Wizard

A new guided six-step wizard walks first-time users through provider configuration: provider selection, API key validation, model selection, optional embedding and image setup, and a final test-and-confirm step. It pre-populates existing configuration when accessed from settings. One flow creates connection profiles, embedding profiles, image profiles, and chat settings in a single pass.

---

New Faces on the Estate

Pascal the Croupier

Downstairs, past the Library and the Salon, lies a narrow room lit by green lamps. Pascal keeps the dice and the records there. He is the subsystem responsible for games, randomness, and state management — the quiet master of probability and consequence. His page lives at /foundry/pascal, with a dice icon and a coming-soon notice that suggests patience.

Saquel Ytzama, Keeper of Secrets

Saquel manages encryption and security — the Pepper Vault, key rotation, and the quiet business of keeping things that should be locked, locked. Her page lives at /foundry/saquel, marked with a key icon and a similar promise of things to come.

---

Database & Storage

SQLite Hardening

The database has been fortified with the quiet thoroughness of a butler who has survived two world wars:

• Integrity checks on startup (PRAGMA quick_check)
• Periodic WAL checkpoints every five minutes
• Physical backups on startup, with tiered retention: daily for seven days, weekly for four weeks, monthly for twelve months, yearly forever
• synchronous = FULL for durable writes
• Pre-backup WAL flush for logical backups
• Crash-loop protection in Electron: after three consecutive startup failures, safe mode engages — clearing caches, resetting saved state, and restoring defaults

Vector Embedding Optimization

Embeddings in vector_entries and memories.embedding are now stored as compact Float32 BLOBs — roughly 4–5× smaller than the previous JSON text representation. A new vector_entries table with one row per embedding replaces the monolithic entries JSON column. Incremental saves write only changed entries. Migration converts existing data automatically.

File Storage Simplification

The file storage abstraction has been reduced to a thin local-only FileStorageManager. Removed: the mount_points table, S3 support, the S3 plugin, the mount-points API, the storage settings UI, and approximately thirty consumer files that referenced the old abstraction. File paths are now portable across platforms, with runtime-resolved paths replacing database-stored absolute paths.

---

Build & Release Pipeline

Automated Releases

The release workflow, triggered on version tags, now builds everything in parallel: rootfs tarballs (amd64 + arm64), Electron installers for macOS (DMG), Windows (NSIS), and Linux (AppImage + .deb), Docker images, and standalone tarballs. A final job creates the GitHub Release with all assets attached.

Noteworthy build improvements:

• Azure Trusted Signing for Windows code signing
• App Store Connect API key for macOS notarization (replacing Apple ID + app-specific password)
• Native architecture runners for rootfs builds — no more QEMU cross-compilation
• Image optimization — all PNGs and JPGs converted to WebP, SVGs optimized with SVGO. Total image payload reduced from ~75 MB to ~4.6 MB (94% savings)
• node_modules excluded from Electron app.asar — the Electron code uses zero npm dependencies, so the 502 MB node_modules was bundled for nothing. DMG size dropped from 262 MB to ~132 MB
• Plugin node_modules stripped from Docker image — saving ~350 MB per architecture

The quilltap npm Package

For those who prefer the command line:

npx quilltap

The npm package is now a lightweight CLI (~10 KB) that downloads pre-built standalone output from GitHub Releases on first run. Downloads are cached per-version in a platform-specific directory, with a progress bar, retry with exponential backoff, and an --update flag for forced re-download.

Lima Distribution

Lima binaries are now downloaded directly from GitHub Releases at first launch, with local caching. No Homebrew installation required. A runtime check for Xcode Command Line Tools offers one-click installation if missing. Lima version is pinned in electron/constants.ts.

---

MCP & Tool Connectivity

MCP connections in Docker, Lima, and WSL2 environments received extensive attention in this release, which is a polite way of saying they were broken in several interesting ways and are now fixed:

• Host header validation — MCP servers rejected requests from host.docker.internal. A custom fetch implementation now routes traffic through the host gateway while preserving the original Host: localhost:PORT header.
• Connection churn — URL preprocessing caused config hash mismatches between raw and rewritten URLs, causing the MCP plugin to teardown and recreate connections on every API call. URL rewriting now happens solely in MCPClient.connect().
• Gateway resolution — Docker environments now use host.docker.internal first (via Docker Desktop DNS), with /proc/net/route reserved for Lima/WSL2 where NAT networking forwards to host loopback.

The allowToolUse master switch on connection profiles provides a profile-level override for all LLM tools. When disabled, no tools are sent to the model regardless of other settings.

---

Performance & Stability

• Node.js OOM protection — NODE_OPTIONS="--max-old-space-size=2048" set in all runtime environments; Lima VM memory bumped from 2 GiB to 4 GiB
• Backup/restore rewritten for streaming — disk-based temp files with shell zip/unzip replace in-memory archiver/adm-zip, fixing OOM crashes on large data directories
• Large .qtap import — files over 10 MB no longer choke; proxy body limit raised to 100 MB and the upload pipeline corrected
• Electron downloads — all downloads (backups, exports, images, API keys) now work via preload bridge IPC channels that stream to disk without memory pressure
• Infinite re-render loop — an unstable useEffect dependency in the Salon page caused an infinite loop that stalled React’s startTransition, making all sidebar navigation silently fail. Fixed with stable dependency proxies
• Lima VM startup noise — suppressed transient port-skip messages, SSH proxy errors, and deduplicated repeated guest agent warnings

---

Refactoring

The codebase was substantially reorganized in this release. A partial inventory:

• Salon page decomposition — reduced from 2,813 to 945 lines (66% reduction), extracting 8 hooks and 2 components; unified duplicate SSE streaming functions into a shared parser
• Projects route decomposition — reduced from 1,056 to 49 lines, extracting schemas, 8 action modules, and 4 HTTP method handlers
• Dead code cleanup — 7 unused files removed, unused exports pruned, duplicate utilities consolidated
• Plugin dynamic loader — deduplicated 66 lines of bootstrap code from two registries into a shared module
• Build scripts consolidated — platform-specific shell scripts replaced with cross-platform TypeScript throughout
• qt-* class migration — 25+ component files migrated from hardcoded Tailwind classes to semantic theme-overridable utilities
• API conformance — system routes wrapped in context handlers, NextResponse.json replaced with response helpers

---

Bug Fixes (Selected)

The full changelog runs to several thousand words, so here are the ones that would have kept you up at night:

• Memories invisible after embedding migration — Float32 BLOB values failed Zod validation; fix adds Buffer.transform() to embedding schemas
• Chat auto-triggers unwanted second AI response — temporary assistant message missing participantId; turn state didn’t recognize the AI had spoken
• Backup restore in new-account mode — spread-order bug in remapBackupData caused entity cross-references to be silently overwritten
• WSL2 connection failures — nohup ... & inside wsl.exe --exec sh -c caused the shell to exit immediately and WSL2 to terminate the distro
• Docker footer showing “(local)” instead of “(Docker)” — nested property access (data.data?.isDocker vs. data.isDocker)
• Sidebar not appearing after setup wizard — session provider needed a full page reload rather than client-side navigation
• Google Gemini 3 tool-calling errors — supportsToolCalling() now excludes Gemini 3 models; orchestrator auto-retries without tools on unsupported-tool errors

---

Timezone Support

Timestamps injected into system prompts now respect the user’s local timezone instead of defaulting to UTC. A three-layer fallback chain — per-chat configuration, salon-level settings, QUILLTAP_TIMEZONE environment variable, system default — ensures the right time is always the right time. Electron auto-detects the host OS timezone and passes it through to the VM or container. A searchable IANA timezone selector is available in the Timestamp Configuration card.

---

Subsystem Table

For those keeping score at home:

Name	Function
The Foundry	The heart of the operation — architecture, plugins, packages, LLMs, API keys
Prospero	Your majordomo, conducting projects, agents, tools, and files
Aurora	The complex character model — appearance, clothing, aliases, pronouns, identity
The Commonplace Book	Memory and retrieval — a simple RAG that just works
The Salon	The chat interface, for conversations with one or many characters
Calliope	The user experience — interface, themes, and the Art Deco we like so much
Dangermouse	Always in the shadows, managing what the starched-collar providers won’t
The Lantern	Image generation and atmospheric story backgrounds
Pascal	The Croupier — games, randomness, state, and the quiet mathematics of chance
Saquel Ytzama	The Keeper of Secrets — encryption, key management, and the Pepper Vault

If you hate the look and feel and weird names, use the Old School theme. It calls things by their boring old names.

---

Upgrading from 2.x

The database migrations handle themselves. Your data, characters, memories, and chat history will be preserved. The settings have moved — from ten Foundry pages to seven tabbed sections — but everything is where you’d expect it to be if you think about it for more than a moment.

Authentication is gone. If you were using OAuth or Google sign-in, you no longer need to. If you were self-hosting with JWT tokens and reverse proxies, the reverse proxy examples in DEPLOYMENT.md still apply, but the tokens do not.

The Docker deployment is dramatically simpler. If you had a docker-compose.yml with Nginx, MinIO, and multiple services, you may now replace it with a single docker run command or, better yet, the startup script.

---

The Estate has been renovated, expanded, and — in one or two places — rebuilt from the foundations up. The rooms are the same. The staff are the same. But the house now travels with you, portable and private, sealed against the weather and the world outside. Welcome home.

Installation

macOS

1. Download the .dmg file and open it
2. Drag Quilltap to your Applications folder
3. Launch Quilltap from Applications

Windows

1. Download and run the .exe installer
2. Follow the installation prompts
3. Launch Quilltap from the Start Menu or desktop shortcut

Linux

1. Download the .AppImage file, make it executable (chmod +x), and run it
2. Or install the .deb package: sudo dpkg -i quilltap_*.deb
3. Requires Docker Engine — install from https://docs.docker.com/engine/install/

Node.js (any platform)

npm install -g quilltap
quilltap

On first run, the CLI downloads the application files (~150-250 MB) and caches them locally. Subsequent launches start instantly.

Docker

docker pull foundry9/quilltap:${TAG}

Or download the quilltap-linux-<arch>.tar.gz rootfs tarball for use with Lima. See the README for setup instructions.

Quilltap v2.11.0 Release Notes

Highlights

Windows-compatible Docker images — We now automatically provide Windows (and indeed, amd64) Docker images.

Docker Simplified — The entire Docker story has been rewritten. Gone are the compose files, the Nginx configs, the MinIO buckets, and the authentication scaffolding nobody asked for. In their place: a single docker run command, platform-aware startup scripts that auto-detect your local services, and transparent host port forwarding so Ollama and friends just work at localhost. One command to start. No config file required.

Large Import Fix — .qtap backup files over 10MB no longer choke on import. The proxy body limit and upload pipeline have both been corrected.

---

Major Features

Docker Infrastructure Overhaul

• Removed dead Docker infrastructure: docker-compose.yml, docker-compose.prod.yml, docker-compose.test.yml, Dockerfile.allinone, and all supporting scripts (start-allinone.sh, init-letsencrypt.sh, nginx.conf)
• Removed build:docker:rebuild, start:docker, stop:docker npm scripts
• New HOST_REDIRECT_PORTS support in the Docker image for transparent host port forwarding
  • New docker/entrypoint.sh script sets up socat forwarders for a comma-separated port list
  • Docker users can now reach host services (Ollama, LM Studio, MCP servers) at localhost URLs without network mode tricks
  • socat installed in the production Docker image

Platform-Aware Startup Scripts

• New scripts/start-quilltap.sh (macOS/Linux) and scripts/start-quilltap.ps1 (Windows)
• Platform detection sets the correct default data directory per OS
• Auto-detects Ollama on port 11434 and adds it to HOST_REDIRECT_PORTS
• Supports --data-dir, --port, --redirect-ports, --tag, --env, --restart, --dry-run
• Checks for existing containers before creating duplicates
• --no-auto-detect flag to skip service detection

Authentication Removal

• Removed all authentication infrastructure: JWT, OAuth, Google sign-in
• Removed JWT_SECRET, AUTH_DISABLED, OAUTH_DISABLED, GOOGLE_CLIENT_* from .env.example and documentation
• Removed authentication sections from DEPLOYMENT.md
• Simplified README.md Quick Start — no configuration required for local use

---

Documentation

• Rewrote all Docker documentation around docker run and the new startup scripts
• README.md Quick Start now recommends startup scripts with docker run as fallback
• Updated DEVELOPMENT.md, DEPLOYMENT.md, DATABASE_ABSTRACTION.md, BACKUP-RESTORE.md
• Added reverse proxy examples (Nginx, Caddy) to DEPLOYMENT.md
• Added Docker user notes to in-app help files (startup wizard, connection profiles, embedding profiles)
• Cleaned up stale references in .env.example, package.json, knip.json, lib/paths.ts, and the DataDirectorySection component
• Updated Docker build process to ensure Windows and macOS coverage

---

Bug Fixes

Critical

• Large .qtap import failure: Files over 10MB now import correctly
  • Added proxyClientMaxBodySize: '100mb' to next.config.js to prevent proxy body truncation
  • Frontend import now sends the original file via FormData instead of re-serializing JSON
  • Backend import-execute endpoint now supports FormData uploads (matching import-preview)

Data Integrity

• User ID migration table names corrected: prompts → prompt_templates, messages → chat_messages to match actual SQLite schema; removed memories from migration list (no userId column)
• Story background file storage: Backgrounds now correctly stored in /story-backgrounds/ folder with proper projectId and folderPath metadata; auto-creates folder record on first generation per scope; fixed project list-files API response missing fields needed by FileBrowser UI

UI

• Participants sidebar always visible: Removed isMultiChar gate so the sidebar renders even with zero participants; users can now add characters to empty chats; updated empty state message to “Add a character to get started”