Made of little things.

# Remaining host gaps — soyLI 0.20.0

## Drawing-board config fails the check/capture pipeline

Reproduce in this project after `pnpm build`:

```sh
soyli check
```

Observed: `SOURCE_LIMIT: A source file exceeds the supported size or is not a regular file.` The failure occurs before Chromium loads the game.

The project has 16 boards (the supported maximum), each with a small valid drawing `dataSchema`. The checked-in `napplet.json` is below 16 KiB. `packages/publish/src/project.ts` expands the parsed config with `JSON.stringify(project, null, 2)`, creating more than 22 KiB. `apps/cli/src/publish-check.ts` writes that expanded config into its temporary capture project. The backend/preview config reader then applies its 16,384-byte limit again.

The source config is valid: `soyli dev` loads it, and local v2 score submissions, entry reads, revision checks and custom-level publication all pass through the real host. Avoid treating `soyli check` as passed or removing validation to hide this tool failure. The config writers and readers need consistent size handling, with a regression using all 16 attachment schemas. This also affects release checks and the fresh media capture path. No release was attempted.

## Preview chooses the score transport as the default level-storage relay

`apps/cli/src/preview/server.ts` prepends the isolated CVM relay to `info.relays`. The app-data policy defaults to the first relay. That minimal transport does not acknowledge kind-30078 storage events, so a default-helper publication times out.

The game uses the documented helper `relays` option to select its explicit runtime storage relay from `napplet.json`. The host still requires that destination to be configured and still requests consent. Tests replace it with an isolated loopback storage relay before building and block all non-loopback traffic. This makes both features work together without changing host authority or using direct networking.

A host-side improvement would keep app-data action/storage relays separate from temporary CVM routing.

## No dynamic per-level leaderboards

The service still permits 16 configured boards and has no app-facing registration flow for arbitrary player-created levels. The original four courses use all 16 combinations of course, Classic/Live Draw and Rigid/Bendy. Custom and challenge-pack levels therefore keep personal times, separated by exact terrain revision; sharing the level itself is supported.

The configured public provider advertises `soy.boards.v2` (verified read-only via `soyli backend status --json`). Public board registration, public level retention and the deployed website still need release verification. Local preview and a public release use separate level scopes.


## Release preparation, 2026-09-23

A temporary copy of the CLI at upstream commit `d8b4e7a` was used to test two compatibility fixes: compact project JSON serialization in the capture/publication writers, and strict recognition of historical public `.napplet-space/soy-backend.json` metadata. The latter accepts only the exact legacy path and bounded known public fields, validates its napplet address and provider, and then runs the normal credential scan. Other private paths and malformed/extra fields remain rejected. Git history is preserved.

The isolated tool passes 35 publication/configuration/security regression tests. The real host check and official recording pipeline pass with it. The installed soyLI 0.20.0 remains unchanged; future releases need the same fixes or an updated official CLI. The reviewed patch and its test source locations are kept in the private release journal, outside the published napplet source.