[jgfoster]

Grail (#1721, #1722) and mcp_server (0.9.0, #57) became Rowan projects on 2026-10-19: Tonel packages with a Rowan project, loaded by a Rowan load instead of filed in. The MCP server's Python toolset, which GemDB serves, loads only through Rowan. Rowan can't be added to an image afterwards, so GemDB now creates its database from the engine's Rowan image. This supersedes #163, and the changelog in #164.

What changes

The database starts from the Rowan image.

• createDatabase copies bin/extent0.rowan3.dbf (INITIAL_EXTENT) and records it in conf/image.
• build-test-extent.sh uses the same image.

An earlier database is refused, with a sentence.

• assertDatabaseHasRowan refuses a database without that record: one GemDB 1.8 or earlier made from extent0.dbf. Its message says to delete db/ and start again, and to copy out anything needed first.
• It runs in the same two places as assertDatabaseMatchesEngine (setup, and before the stone starts). The engine version is the same (a5), so the version guard can't tell these databases apart.
• An external database is skipped here, since its image is its administrator's.
• Moving a non-Rowan database across is therefore manual, as you asked.

Grail installs through Rowan. install-grail.sh:

• probes for Rowan first, which catches an external database too, and exits with a clear message if it's absent;
• then runs Grail's scripts/install_rowan.gs with Grail's GEM_TEMPOBJ_CACHE_SIZE, in place of src/smalltalk/install.gs (which is gone);
• still deploys gemdb and unicodedata afterwards.

It needs no new privileges: it loads as gemdb.

The MCP server installs through Rowan. GemDB still runs the payload's own install.sh --grail --no-auth. In 0.9.0 that is a Rowan load.

Bundling and packaging:

• bundle-grail.sh and bundle-mcp.sh ship rowan/ and require the load specs.
• They check every package (and doit) the Rowan components name, in place of scanning input lines, of which none remain.
• check-vsix.sh asserts the Rowan files ship.

Docs: docs/grail.md, docs/mcp-server.md, docs/automation-boundary.md and CLAUDE.md are updated. The changelog has a [Unreleased] entry saying to start fresh, plus the runtime and MCP changes.

Pins

• Grail: a78e8c0 → c8cbc92 (main, 31 commits, 8 PRs). This range also includes #1723, which fixes #1667: a bare import flask no longer dirties every fresh session. It also includes #1725, so a Flask request writes nothing.
• mcp_server: d836520 → 7ab1067 (0.9.0, 20 commits, 9 PRs).
• The engine (4.0.0.a5) and GemDB Stats (1.1.1) were already current.

Verified locally

On arm64.Darwin against 4.0.0.a5:

• bundle:grail: 12 Rowan packages present. bundle:mcp: 6 present.
• bundle:stats, and test:extent built through Rowan.
• npm test: 1066 passed, including 5 new tests for the image record and the guard.
• test:integration: 12 files, 148 passed, plus the existing expected-fail and todo. mcp.test.ts installed the MCP server and its Python toolset through Rowan.
• package.sh: passed check-vsix.sh.
• lint, format, both typechecks and lint:toolchain: clean.

grail.test.ts, which creates a database from the Rowan image and installs Grail into it, runs in 18 s. The cost is size: the Rowan image is 117 MB against 48 MB.

The Rowan load prints about 30 COMPILE WARNINGs (unused temporaries, shadowed names). They are Grail's own, reported by install_rowan.gs by design, and harmless.

Not verified here: linux-x64 and linux-arm64. This PR's CI is the check for both.

🤖 Generated with Claude Code