xALGO could not vote: 22 topics x 3 options over 6 escrows needed 309 opup inner
transactions, over what any group can pool. Measured on LocalNet with exec
traces, that vote burned 213,875 opcodes against a usable pooled ceiling of
roughly 171,800 — a hard AVM limit, not under-provisioning.

Store every tally flat: one cell per option across every topic, concatenated in
topic order. A nested uint32[][] pays an ARC-4 offset-table lookup plus a row
decode/encode on every element access, and the vote path is nothing but element
access across two unbounded axes. The same vote now burns 81,810 opcodes (-62%),
and a direct GGovPeriod.vote 4,545 instead of 15,414 (-71%). The instance
program shrank with it, 6,310 -> 5,442 bytes.

The period gains an 'l' box (topicLengths) so vote() can read the shape without
decoding the string-heavy options box; the instance reuses the topicOptionLengths
it already snapshots at syncPeriod.

The SDKs stay the boundary. They flatten ballots on the way in and re-row every
tally they read back, so callers keep [topic][option]: the frontend, the
storybook mocks, the pipeline and every existing test call site are unchanged.
Instance readers take the shape from a getPeriod call added to the same simulate
group (no extra round-trip); the registry's cross-instance reader resolves it per
instance app, cached.

GGovPeriod.vote now sizes its reference padding explicitly. Its ten references
(voter, registry app, four registry boxes, three period boxes) never fit one app
call's eight; that shortfall was covered by accident whenever the opcode-budget
prepend fired, and the flat ballot made a small vote cheap enough that it stopped
firing.

Knock-on constants:
- setReady's topic ceiling rises — 58 -> 78 at 3 options, 78 -> 117 at 2 —
  because the vote event drops 4 bytes per topic.
- Vote-record box MBR drops 1,600 uAlgo per topic.

voteBudget.e2e.spec.ts pins the xALGO shape: it asserts the group's measured
appBudgetConsumed stays under 120,000, then sends the vote, which is what
exercises the budget planner that refused xALGO outright.

BREAKING: the vote selector and the box encodings change together, so deployed
period and instance apps cannot be updated in place — they must be redeployed.

Driving claude in a tape needs an Enter per startup gate and a wait on
/ for [0-9]+s/ because the completion verb is randomised. Telling the model
to skip tools makes it announce that on camera. Wait+Screen only sees the
visible buffer. And an unknown modal is indistinguishable from a hang --
re-run with no waits and read the last frame instead of guessing.

ggov-sdk and frac-delegation-sdk carried byte-identical copies of the machinery
that sizes a write group before sending it - increaseBudget.ts, txnExecutor.ts,
groupUsageFee.ts and noteNonce.ts differed only in a "Verbatim copy of ..."
header. The duplication was always a placeholder: base.e2e.spec.ts pinned the two
copies' cost constants together "until the shared SDK package lands". This lands
it. A new projects/sdk-shared workspace package holds one implementation, plus
what it needs (spendable.ts, the three cost/group-size constants, SenderWithSigner
and SendResult). Both SDKs re-export from constants.ts, types.ts and
registry/index.ts, so no public API and no existing import site moves.

padForRefSlots is deleted from both SDKs. Reference slots are measured off the
same simulate that sizes the opcode budget, so the hand-counted call sites - five
in the frac instance SDK, one in ggov's importFracDelegations - become comments
naming what the executor now measures for itself.

The AVM13 rewrite that prompted this measured far more often than it needed to.
Tracing every simulate, including the one algokit runs inside builder.send(), the
worst case was 16 inside executeTxns, 22 once maker reruns were counted. It is
now 9, and the ordinary paths are measured and pinned by the new executor spec:
a write needing nothing costs 2, an inner-heavy 3-escrow vote 4, the same vote
from a writer below the probe headroom exactly 5.

Four things got it there:

- A ProbeContext caches the probe fee headroom and the min fee for one run. A
  low-balance sender used to rediscover its headroom on every probe - up to 6
  extra simulates and 7 accountInformation calls - and now pays for it once.

- A read cache threaded through the *MethodBuilderArgs interfaces. The executor
  owns one per run and escrowCountUpperBound memoises getEscrows (a simulate) in
  it, so the maker's reruns stop re-reading. Measured at -2 on the 3-escrow vote
  by disabling it and re-running.

- The opup count and the usage fee are both decided before the builder is touched
  again, collapsing three maker reruns into one.

- When the usage fee is owed and no probe has passed yet, the search spends its
  last slot on itxnsHi, which is safe by construction and therefore passes - so
  the fee read costs no simulate of its own. The send-time backstop re-prices
  from the rejection's own usage= figure rather than probing again.

Four bugs fixed. Two came out of review:

- txnCount held a Promise, because composer.count() was never awaited. builder is
  any, so tsc was happy, and the MAX_GROUP_SIZE guard silently compared NaN.

- staticFee undershot by (itxnsHi - itxns) * 1000 whenever the search narrowed,
  because it was read off a group built at itxnsHi. It is now the exact identity
  required - (groupFeesPaid - headroomFee), everything the group pays apart from
  txn 0, which holds whatever txn 0 was built with.

Two more only surfaced once ggov-sdk ran on this code - frac's own methods
happened to mask both:

- A dropped prepend. planGroupExtras re-solves with one prepend when the bare
  group is over budget, and that prepend's +700 drives itxnsHi back to 0 - but
  the bail-out guard only tested itxnsHi === 0, so it returned undefined and
  discarded the very prepend that made it zero. Every frac method needing an opup
  also needs reference pads, so padsForRefs > 0 kept the guard from firing there;
  ggov's addTopic and ingestGovs, over budget by less than one app call's worth
  and needing no pads, hit it immediately.

- An inner-txn ceiling that rejected working groups. The guard allowed 16 opup
  inners per transaction in the group, so a ggov vote across 78 topics - 135
  itxns, which the old sizing produced and the network accepted - was refused
  client-side. Opup inners are app calls sharing the group's 256-app-call
  allowance, not a per-transaction quota, and are sized against the group total
  now, consistent with MAX_GROUP_BUDGET = 700 * 256.

SenderWithSigner gains an optional emptyTxnSigner so the sizing simulates can
carry a post-quantum envelope: the v13 PQ premium is priced off the signature,
not the sender address, so a plain empty signer measures a PQ writer's group as
classic. writerFromAddressWithSigners adapts algosdk's PQ/Falcon signing accounts
to the writer shape. Degrades safely without it - the send-time fee retry catches
the shortfall at the cost of one round trip - which is what the frontend does,
since use-wallet exposes neither the scheme nor the public key.

Build orchestration: sdk-shared is registered in the workspace .algokit.toml
build list between contracts and the two SDKs that consume it, and carries its
own .algokit.toml so the unordered commands find it. CI's explicit --project-name
build lists would have failed without it (tsc cannot resolve types with no dist),
and its change-path filters used [^/]+-sdk, which does not match sdk-shared - a
change to the shared package would have skipped the contracts, committee-uploader
and pipeline jobs entirely. The frontend and storybook CDs now build with
pnpm --filter 'ggov-sdk...', whose trailing ellipsis pulls the dependency in
topologically instead of naming it again.

base.e2e.spec.ts's cross-SDK constant sync test is gone: one constant, one pin.

Rebased onto feat/testnet-mirror-seed, whose approval upload had meanwhile moved
to three pages. The two lines of work disagreed on a fact, and the disagreement
is settled by measurement rather than by picking a side: a box reference grants
2048 bytes of I/O budget, not 1024, ref-swept on localnet at every boundary
(2048 -> 1 ref, 2049 -> 2, 4096 -> 2, 4097 -> 3, 6145 -> 4), and resource
population does add more than one reference per distinct box - simulate reports
the shortfall as extraBoxRefs and the populator materialises them. So the
hand-computed machinery the three-page upload carried (BOX_IO_BYTES_PER_REF,
boxIoRefsFor, boxIoRefsPerCall spreading 12 references across companion calls,
approvalReadRefSlots padding the create path, and the probe -> staticFee round
trip) is redundant at best and 2x over-provisioned at worst. The three-page ABI
stays; the sizing goes to the executor, which measures what simulate actually
reports.

drawtext cards look like conference slides. The website promo's cards were
HTML rendered through headless chromium, which is why they looked better --
brass rule, spaced kicker, big statement with an amber payoff line, CSS
scanlines. make-card.sh makes that repeatable and scales the type to the
frame, so a card matches its tape size instead of being letterboxed.

Also record two things that cost a session each: vhs needs ttyd installed,
and a shell segment must set the terminal background to the brand ground or
the cut to a TUI segment visibly jumps.

Left column is the entity now (CLI, Explorer, keystore, templates, LocalNet);
the platform keychain details and the docker group note move to prose under
it, where they do not have to fit in a cell.

'Every write pauses for your approval first' is true in the Explorer and
false for `vibekit mcp`, which defaults to execute mode and signs through
the keystore without prompting. The homepage repeated it. Scope both to the
Explorer and name SIGNING=compose as the alternative.

Also: the skills count was 8 in two places on the homepage and is 5, and the
package subpath list omitted ./core.

Version pins in the installation reference pointed at alpha.0; the alpha
notices said 'the packages'; macOS is now verified by hand and the Windows
installer runs on a real runner every push.

Same tree as alpha.1 plus the formatter pass, so the tag points at a commit
that is actually on main. No behavior change.

Also ignore apps/web/next-env.d.ts: `next build` regenerates it in its own
style every run, so formatting it makes the next build a diff.

Flattened: everything after the alpha.0 tag, as one commit.

The ten published packages were one artifact in ten wrappers — lockstep
versions, ten manifests, ten release entries, and the workspace:* drift trap,
buying no consumer anything. `preset` pulled in six of them regardless.
Everything is now `packages/vibekit`, published as `@initlabs/vibekit` with
subpath exports; each old package is a directory under `src/`, and tests
mirror it under `test/`. The root export is the core contract, so `./preset`
no longer drags four third-party plugins into a types-only import.

  @initlabs/vibekit-core            -> @initlabs/vibekit
  @initlabs/vibekit-tools           -> @initlabs/vibekit/tools[, /views]
  @initlabs/vibekit-agent           -> @initlabs/vibekit/agent[, /config]
  @initlabs/vibekit-mcp             -> @initlabs/vibekit/mcp[, /stdio, /http]
  @initlabs/vibekit-signer-keystore -> @initlabs/vibekit/signer-keystore
  @initlabs/vibekit-preset          -> @initlabs/vibekit/preset
  @initlabs/vibekit-plugin-<name>   -> @initlabs/vibekit/plugins/<name>

The ten old names are unpublished. v1.0.0-alpha.1 is on npm and on GitHub
with binaries for four platforms.

Installers: the Windows PowerShell installer is restored and exercised on a
real runner every push; three of its bugs are fixed with a comment each
(Invoke-RestMethod collapsing a JSON array into one pipeline object, Join-Path
throwing on a null APPDATA, and bare `irm` defaulting to http). The hero
one-liner no longer resolves a stable channel that does not exist, and the
alpha channel no longer depends on GitHub hoisting a mislabelled release.

Tooling: `.prettierrc` pins the style the codebase was already written in
(single quotes, no semicolons, 100 columns) and the tree is formatted to it.
Without a config, `bun run format` silently rewrote every file to prettier's
defaults. Markdown is ignored — prose here is hand-wrapped, and prettier pads
tables to fixed widths and misaligns them on em-dashes.

Also: `doctor` reports a missing node/npm instead of surfacing it as an opaque
daemon timeout; the README gained a requirements table; PRODUCTION.md is cut
to the one deferred item that is still live.

Ten packages carried ~5,900 lines as one artifact in ten wrappers: lockstep
versions, ten manifests, ten release entries, and the workspace:* drift trap,
buying no consumer anything. `preset` pulled in six of them anyway.

Everything is now `packages/vibekit`, published as `@initlabs/vibekit` with
subpath exports. Each old package is a directory under `src/`; tests mirror it
under `test/`. The root export is the core contract, so `./preset` no longer
drags four third-party plugins into a types-only import.

- @initlabs/vibekit-core            -> @initlabs/vibekit
- @initlabs/vibekit-tools           -> @initlabs/vibekit/tools[, /views]
- @initlabs/vibekit-agent           -> @initlabs/vibekit/agent[, /config]
- @initlabs/vibekit-mcp             -> @initlabs/vibekit/mcp[, /stdio, /http]
- @initlabs/vibekit-signer-keystore -> @initlabs/vibekit/signer-keystore
- @initlabs/vibekit-preset          -> @initlabs/vibekit/preset
- @initlabs/vibekit-plugin-<name>   -> @initlabs/vibekit/plugins/<name>

verify-packed packs one tarball and drops the overrides block that pinned the
packages' own @initlabs peers. The changesets `fixed` group is gone.

Done now because the old names are hours old with zero dependents; after
anyone installs them this becomes a breaking change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Invoke-RestMethod emits a JSON array as ONE pipeline object, so
`Get-Releases | Where-Object` handed the whole array to $_. `-match` over an
array returns the matching elements rather than a boolean, so the array was
truthy and every release 'passed' the filter -- producing a download URL with
all 14 tags in it. Assign first, then iterate.

Also: Join-Path threw on a null $env:APPDATA when checking for pre-1.0 state.

CI now runs install.ps1 for real under Windows PowerShell 5.1 instead of only
parsing it. The parse check passed on every one of these bugs.

Bare 'irm getvibekit.ai/...' defaults to http, and Windows PowerShell will
not follow the 308 upgrade to https -- it reports the redirect as an error.
curl -L follows it silently, which is why this only broke on Windows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Signing needs node and building needs node 24+, which the install story did
not say plainly. README and the installation page now split what works with
nothing installed from what needs a toolchain.

PRODUCTION.md gets the prototype result: a compiled binary read the real OS
keychain with no node on PATH, blocked only by two upstream packaging details.
Also drops the install.ps1 and installation-docs entries, both now done.

The managed keystore CLI is a '#!/usr/bin/env node' program, so node must be
on PATH to run the daemon -- not just npm to install it. Without node the
spawn succeeded, the daemon died instantly, and the only trace of the real
cause was 'env: node: No such file or directory' in the log file.

doctor never checked node or npm at all, so a machine that could not sign
still reported 'No blocking problems found'.