Quilltap was not designed with a plugin system bolted on afterward. The plugin system is the delivery mechanism. Every LLM provider, every theme, every authentication method, every tool, every search backend, every moderation service, and every system prompt arrives as a plugin. There are no hardcoded provider lists, no conditional imports based on which service you happen to use. Adding or removing a capability means adding or removing a plugin.

The provider plugins keep pace with the models beneath them. The Anthropic plugin now speaks to the newest Claude generation—Sonnet 5, Opus 4.7 and 4.8, and the Fable and Mythos models—which changed how sampling and extended thinking are requested; the plugin recognizes the family and asks for each the way the new models expect. And across the whole Estate, every LLM call now honors its connection profile’s provider-specific parameters—a model’s thinking or reasoning-effort settings among them—whether it is a main chat turn or one of the background utility tasks the cheap LLM system dispatches. A reasoning model set to a particular thinking mode actually respects it now, instead of falling back to a provider default and spending its budget on hidden reasoning. The bundled provider plugins are kept current with their upstream SDKs as those evolve.

One small note for the accounts, since the Foundryman would rather you heard it from him than from an invoice. The 4.9 system prompt gained a standing-instructions section, and a prompt cache is keyed on the shape of the prompt rather than on its good intentions— so every provider cache rolls cold exactly once at the upgrade. Nothing is required of you. The first turn on each character afterward is merely a little dearer than the second, and the second is as cheap as it ever was.

A turn could sit on “Recalling Amy’s memories…” for ten minutes with nothing wrong locally. The far end had accepted the request and then said nothing—and a provider library, given no instruction to the contrary, will wait a full ten minutes before admitting as much. One silent call was clocked at 622,451 milliseconds for a memory recap whose healthy runtime is about nine seconds, and it left no trace, because a call is only written to the ledger when it finishes. The Foundryman does not care for machinery that stalls with a straight face.

Requests are now bounded, and the ceiling follows who is waiting. A background call gets 90 seconds against a remote provider, or 120 for the three compression tasks; anything awaited inline while a turn assembles keeps the shorter 45, or 75 for compression, since there the budget protects the operator rather than the work. A local provider keeps its 3 minutes whatever the errand (a cold model loading being slow, not stalled), and exceeding any of them degrades through the existing failure path with a log line naming the provider, model, task, and elapsed time. The memory recap is awaited inline and so takes the shorter figure, with a minute bounding the pair of calls it makes in sequence. And all ten text providers now accept a hard per-request budget they may not retry past, so a stalled request is dropped at the socket. Streaming answers are handled with care: where a provider’s timeout would bound the whole response rather than the wait for its first word, no default is imposed.

One honest limitation, stated plainly, because the Foundryman does not sell you a lock that isn’t there: an abandoned request is not cancelled. Nothing at that layer can cancel it. It runs to completion, it is billed, and its answer is thrown away. What stops is the waiting.

In 4.0 the Foundry concluded—after some thought, and over breakfast—that an estate which has grown to include a furnace room, a generating station, and a guest-facing parlour is no longer usefully one building. The desktop application moved to its own residence at quilltap-shell: the splash screen, the container management, the auto-updater, the native window chrome, and the Electron-based packaging that produces installers for macOS, Windows, and Linux. The Foundry—this repository—produces what it has always been best at producing: the Next.js server, the API, the bundled plugins, and a standalone tarball that the shell consumes. Two buildings, one estate, cleaner responsibilities, simpler builds.

To keep the buildings from accidentally disagreeing about the state of the furniture, .dbkey files now carry a minServerVersion field. The shell reads it on startup and politely refuses to open a database created by a server it does not understand—better to tell you the lock does not fit than to let you in and discover the rooms have been rearranged.

The active runtime is displayed in the application footer alongside the data directory path, plus the shell version and the composite backend mode (Electron or Electron+Docker) when running under the desktop app. Localhost URL rewriting transparently routes localhost and 127.0.0.1 URLs to the host gateway, so provider connections and MCP servers work without manual network configuration. Resolution is two strategies and no more: an explicit QUILLTAP_HOST_IP, then host.docker.internal inside Docker. The elaborate fallbacks that once read /proc/net/route and /etc/hosts were written for Lima and were, in a container, positively misleading—the bridge gateway they return does not reach a service sitting on the host’s loopback. In a virtual machine of your own making, QUILLTAP_HOST_IP is the supported route: it both turns the rewriting on and says where to point it.

A container sees only what was bound into it when it was made, which for some time meant it could not see your filesystem document stores at all. The startup script now enumerates an instance’s filesystem and Obsidian stores before creating the container and binds each path-identically (-v /host/vault:/host/vault), so a store’s recorded location means the same thing on both sides of the wall. Three flags cover the awkward cases: --instance NAME resolves and unlocks an instance from the registry, --recreate replaces an existing container (binds being fixed at creation, it is the only way to change them), and --no-store-mounts declines the whole business. quilltap docs docker-mounts [--format args|json] prints the same plan for a hand-assembled docker run. It is a plan and not a list: stores sharing a vault collapse to one bind, a store nested inside another is dropped rather than shadowing its parent, and a path that does not exist is skipped and reported—Docker would otherwise fabricate the missing source as an empty root-owned directory and present a hollow store as a sound one. Two arrangements only warn (a macOS path outside Docker Desktop’s shared folders, a Linux uid that does not match the container’s) and one is refused outright, a Windows host path having no way to mean the same thing inside a Linux container. Failure to enumerate is never fatal: it warns and starts without store binds.

Containers also keep local time now. A container honored its configured timezone when printing a timestamp and nowhere else, so every subsystem that consults the clock directly went on living in Greenwich. TZ—or QUILLTAP_TIMEZONE, which wins where the two disagree—is now applied to the process clock itself, so scheduled autonomous rooms, daily token-budget rollover, and the “today” and “yesterday” of episodic recall all keep your own calendar. The startup scripts detect the host zone and pass it along, since a setting nothing sets is not a setting; an explicit choice always wins, and a container started by hand with neither variable still runs on UTC.

The largest structural change the Foundry has shipped is also the least visible in a feature list, because it is not a feature so much as a floor plan. The application is now a two-pane workspace of tabs. Every open surface—a Salon conversation, a document, a terminal, the character grid, Settings, the Brahma Console, the Wardrobe—is a tab that stays mounted whether or not you are looking at it. Switching tabs reloads nothing; a conversation streaming in one goes right on streaming while you read a document in another. Tabs reorder by dragging, move between panes, and split the view down the middle, where a draggable, keyboard-nudgeable divider decides how the space is shared. Your arrangement—which tabs, in which pane, in what order, at what split—is remembered between visits.

It was built as eight quiet phases behind a flag and then, once it had earned its keep, promoted to the default in 4.8. Old bookmarks and deep links still answer the bell: /salon/[id], /aurora, /prospero, /scriptorium, /settings and the rest redirect into the workspace and open the tab you asked for, laid over your restored layout rather than clobbering it. If you should want the old building back, NEXT_PUBLIC_WORKSPACE_TABS=0 returns every surface to its former standalone route exactly as it was.

A great deal of the work was the unglamorous business of ensuring that nothing in the application secretly hard-navigates out of the workspace and tears down your live tabs behind your back. Chat cards, the sidebar footer, autonomous-room badges, in-help links, the character editor, the new-chat flow, the terminal’s pop-out button—each used to route away and remount the world. A single document-level link interceptor now catches any link that maps to a tab and opens it in place, and the stubborn holdouts were converted one by one. In the same spirit, the persisted layout no longer discards your entire arrangement because one saved tab carried a kind it did not recognize; a stray tab now drops only itself.

Quilltap runs on SQLite exclusively. No MongoDB, no PostgreSQL, no external database container. Your entire data store is a file in your data directory, encrypted at rest with ChaCha20-Poly1305 under a 256-bit key by way of the SQLite3 Multiple Ciphers extension, and hardened with the quiet thoroughness of someone who has already lost data once and has no intention of doing it again. (These pages long said “SQLCipher (AES-256)”, which was never true of the bytes on disk; the Vault of Secrets makes the correction properly, and compares the two.)

And there is now a way back in when the lock itself goes missing. A .dbkey file merely wraps the master secret; the secret is the actual key. Anyone holding it could always have rebuilt the wrapper, but the only door was an endpoint on a running server—which is no help whatsoever to the person staring at a locked screen that will accept nothing but a passphrase he no longer has. npx quilltap instances restore-key writes the key file with the server down. The secret comes from the environment or from a hidden prompt and never from a flag, a command line being a thing that lands in shell history and in the process table for anyone who cares to look. And before it writes anything at all it opens every encrypted database in the directory with the candidate secret and refuses outright if a single one declines—because a key file holding the wrong secret is worse than none: the server unwraps it perfectly happily, hands the cipher a key that decrypts nothing, and reports an entirely sound database as corrupt.

All of Quilltap’s data—database, files, logs, everything—resides in a single directory on your machine. The desktop shell lets you manage multiple named data directories from its splash screen, switching between them with a stop-and-start of the runtime. Each directory is self-contained: back it up by copying a folder, migrate it by moving one.

Platform-specific defaults follow OS conventions: ~/Library/Application Support/Quilltap on macOS, %APPDATA%\Quilltap on Windows, ~/.quilltap on Linux, and /app/quilltap in Docker (mounted from host). A QUILLTAP_DATA_DIR environment variable overrides all of them.

Files are stored on disk as themselves—real directories, original filenames, no hashed artifacts, no sidecar metadata files. A filesystem watcher detects changes in real time. Backup archives capture everything in a single ZIP, including plugin configurations and npm-installed plugins. Since 4.6, backup and restore also preserve your global text replacement rules— the full rule set, not merely the master switch—so a restored instance arrives with all its editorial corrections intact. The Foundryman believes your data should be legible, portable, and yours.

The .qtap export used to write memory embeddings as JSON—an object keyed by index, some 30 KB per memory—so a real characters export ran to 791 MB, of which about 2.5 were content. Worse, a vector means nothing except against the model that produced it, so carrying one into a corpus with a different embedding standard silently poisons search. Exports now carry no embeddings: the writer omits them, the reader discards them from old archives, and an import re-embeds what it inserted against your own default profile. The export picker, meanwhile, grew from offering some types to fifteen—projects, groups, and document stores (writable all along but never offered), plus the general file library, prompt templates, provider models, plugin configurations, and instance settings—and the list is now exhaustive by construction. Plugin configurations are redacted on the way out, always: password-typed fields are dropped, and the import preview is told what was removed.

Three further corrections to what an archive carries. A characters export had never carried the character’s vault—only the row, the wardrobe, the plugin data, and the memories—and since a portrait and its avatar overrides are pointers into that vault, every cross-instance character import had been arriving faceless, with no photographs and no mail, and nothing anywhere to say so. Exports now carry the whole vault, an import repoints the face onto the rows it actually created, and an override that cannot be repointed is dropped rather than written broken. Instance settings travel as a whole minus a short, deliberately named list of keys that mean nothing anywhere else—the mount-point pointers, the maintenance clock, and the version guard, an imported value in which could lock a healthy instance out of its own database. And a .qtap export now excludes archive bundles and the shelf they sit on, on the reasoning that an export carrying every trunk in the attic, base64-inflated, serves nobody.

Backups gain an opt-in compact mode that nulls memory embeddings and omits the six rebuildable caches; a compact archive says so in its manifest, and a restore from one queues the reindex. And—since a release whose upgrade steps begin with “take a backup” had better restore one—this one now can. Three faults on the restore path are repaired, all on the reading side, so archives you already hold are restorable: mount points and file links were refused on the way in; the archived-file lookup was gated on a backup format two generations old, so no file was ever found; and files were restored before the stores meant to receive them existed. A fourth, older fault is fixed too—memories used to come back under new names, so the Commonplace Book returned as a heap of unconnected notes. Memories now keep the identities they were backed up under.

The release workflow, triggered on version tags, builds everything the Foundry produces in parallel: a Turbopack-compiled standalone tarball (with native modules included), multi-architecture Docker images (amd64 and arm64), and the quilltap CLI npm package. The rootfs tarballs that once fed the shell’s managed Linux VMs are no longer built and no longer attached to a release, the VM modes having been retired from both buildings in 4.9. A final job creates the GitHub Release with all assets attached, and the desktop installers are built downstream by quilltap-shell from the standalone tarball it consumes. The 4.6 cycle brought version bumps across every bundled provider plugin—Anthropic, OpenAI, Google, Grok, Z.AI, OpenRouter, and Ollama—for dependency updates and the cache-read normalization work described above.

All API access goes through /api/v1/ endpoints with an action dispatch pattern (?action=). Consistent response formats, centralized middleware, and Zod schema validation throughout. The API is the contract between the frontend and the backend—every feature, from chat streaming to plugin management to file operations, passes through it. 4.0 finished pulling ZodError formatting and unhandled-error catching out of sixty individual route files (some ninety-seven try-catch blocks, roughly 1,084 lines of boilerplate) and into the middleware itself. Routes that do nothing unusual with their errors no longer need to catch them.

Beside the API, and emphatically not in place of it, there is now a realtime layer: one multiplexed WebSocket per browser tab, carrying invalidation hints of roughly forty bytes apiece. A hint says what changed. It never says what it changed to. The client takes the hint, throws away the queries it affects, and re-reads through the REST API in the ordinary way—so the API remains the single source of truth, a reconnect is nothing more interesting than “invalidate everything and refetch,” and there is no second copy of your data taking a shortcut through a socket. Behind it sits a parent-process fan-out bus with a mandatory quarter-second debounce, so a dozen errands enqueued in the same instant arrive as one frame rather than a dozen. An older tab meeting a newer server ignores topics it has never heard of rather than breaking, which is the courtesy one extends to a guest who has been away.

Both WebSocket handlers—the terminal’s and the new one—pass through a single gate that wants three things before it will let an upgrade through: a live session, an unlocked instance, and a same-origin request. Saquel Ytzama’s page explains why that third condition carries rather more weight than it appears to. The Foundryman’s only remark on the matter is that he does not consider a door which opens for anyone who knocks to be a door.

The cheap LLM system orchestrates background work: memory extraction, context compression, chat titling, scene state tracking, danger classification, and housekeeping tasks, each routed to the lowest-cost provider path with live and fallback pricing data. Connection profiles carry capability flags, model metadata, and per-profile usage tracking (tokens, messages, estimated cost). Provider models are cached in the database and refreshed from provider APIs, so the model list is always current.

Each profile also carries a model class—Compact, Standard, Extended, or Deep—summarizing what the model can do in a vocabulary that does not require memorizing the context windows of forty different services. The class drives the budget-driven compression system: maxContext − 2 × maxTokens is the available room, conversation history compresses at 50% of that, recalled memories at 20%, and each phase reports its own status. An auto-configure button searches the web for your model’s specifications, sends the results through your default LLM for structured analysis, and applies optimal maxContext, maxTokens, temperature, topP, and class settings without your having to look any of it up. For reasoning models (gpt-5-nano, Gemini 3.x), a strictMaxTokens flag tells providers to cap the thinking budget so cheap-LLM tasks no longer return empty after burning thirty seconds on hidden reasoning. As of 4.6, cache-read tokens—prompt-cache hits—are excluded from normalized token usage across every provider plugin. Cached input no longer counts toward autonomous-room per-run token caps, daily user-token caps, or per-chat token and cost aggregates. Each plugin subtracts cache reads at the source according to its own convention (Anthropic reports them separately; the OpenAI family folds them in and the plugin subtracts). One caveat for the accountant in the back: the cost estimator carries no cache-discount tier, so estimated cost omits cache-read tokens entirely rather than charging them at full input rate.

The chat orchestrator—previously a single sizeable module responsible for routing, calling, tool-handling, failover, and persistence—was decomposed in 4.0 into five focused services (turn chain, message finalizer, danger routing, provider failover, streaming state). It also emits granular status events phase by phase: initializing, resolving, loading tools, gathering, generating recap, preparing, validating, sending. Long operations no longer look like hangs.

The capabilities report was last rebuilt in March, as a portrait of a 4.0 instance. Everything since—character content, wardrobe, custom tools, photographs, mail, scenarios—had quietly migrated into the mount-index database, a book the report had never once opened. It is now the Almanack, and it has been taught to read the whole house.

You will find it where you always did—Settings → AI Providers → Capabilities Report—behind a button that now reads Compile the Almanack. It walks the house in seven named phases: Taking the measure of the premises (the machine, the databases, the backups), Cataloguing the machinery (plugins, providers, models, keys, themes), Auditing the ledgers (the main database’s census), Touring the Scriptorium (the document stores, where most of your data actually lives), Assembling the dramatis personae (characters, projects, groups), Reading the wire records (the LLM logs), and Binding the volume. Previous editions are still listed, viewable, downloadable and deletable, and the result is still meant to be safe to paste into a bug report.

It gained a Scriptorium section—document-store blobs are the largest single consumer of disk in a mature instance, and had been entirely absent: stores by kind, wedged scans and conversions, blobs by type, hard-link groups and the deduplication they buy, character-vault health, wardrobe by tier, the Post Office, photo albums, scenarios, the state cascade, and Pascal’s Workbench inventory down to the definitions that failed to parse. Alongside it sits a dramatis personae—the ten busiest characters, every project, every group with its members named—and a much-expanded wire-records section: requests by type, per-profile usage with average and median latency, and prompt-cache hits and misses by provider and profile. Generating it shows a progress bar naming its phase, and buffers as it goes, so you can collapse the card mid-run and reopen it later without losing your place.

A number of faults are set right in the reading, and the largest is this: the lifetime and windowed token-usage figures had always returned zero—a filter reading != NULL in SQL, which is unknown, not false, and therefore matches nothing, ever—which is the long-standing “0 tokens logged” complaint, finally traced to its source. In the same pass the logs learned which connection and image profile served each request and how long it took, and the great many call sites that had never recorded a duration—the entire shared cheap-LLM path among them, and the character optimizer, which wrote a hardcoded zero and thereby poisoned every average taken over the column—now measure. Where a figure is estimated from older rows the Almanack says so, and every latency prints the count it was averaged over.

Three further ledgers were found to be reporting fiction, all in the same quiet direction. The embedding-failure census counted a status the system can never hold, so that cell was structurally zero forever; it now counts the real terminal state and says plainly that a failure is permanent only for the profile presently in force. The cast-sizes histogram grouped by the raw list of participants rather than by how many there were, so every distinct cast became its own row and no histogram ever emerged. And the wardrobe-permission counts asked who had been explicitly granted permission, where the house’s actual rule is that silence means yes—so every character in the default state went uncounted. Four smaller indignities went with them: a freshly generated report’s Download link 404’d every time, because the report announced one identity and was filed under another; memory counting ran one query per character; custom tools were filed under Pascal’s dice, which is a different subsystem wearing a similar hat; and database security and backup status both believed the instance had two databases when it has three.

Quilltap is open source. The Foundry lives at github.com/foundry-9/quilltap-server (renamed in 4.1 when the desktop application moved to its own carriage house at foundry-9/quilltap-shell). The plugin SDK is published to npm. The theme development kit includes a Storybook preset. The API is documented. The help files ship with every installation. The Foundryman does not build things to keep them to himself—he builds things because building things is what he does, and open blueprints mean other people can build on top of them.

There is no Quilltap cloud, no analytics telemetry, no training pipeline consuming your conversations. This is not a philosophical stance masquerading as a feature. It is the architecture itself. The Foundryman built a machine that runs on your machine, stores its data on your machine, and connects to the providers you choose. Everything else follows from that decision.