fix(newos4): skill points at the served contract URL, not a VFS path (v4.6.75)

The OS4 agent reported the skill cites /_docs/chat-contract.md, which does not exist in its
VFS — correct: the file lives on the host and is served over HTTP. Browser VFS and disk are
two stores, so a path-only pointer is a dead end. Now names the URL.

5 files changed, 8 insertions, 8 deletions

diff --git a/main.html b/main.html
index e862108..49df90d 100644
--- a/main.html
+++ b/main.html
@@ -1349,13 +1349,13 @@
     </script>
 
     <!-- v4.5.63: A2A scratchpad fixes + agent-register arg fix -->
-<script src="modules/core/core-bundle.js?v=v4.6.74"></script>
+<script src="modules/core/core-bundle.js?v=v4.6.75"></script>
 
     <!-- Async dependency-ordered module loader now only initializes terminal and loads optional ext modules -->
-<script src="modules/core/module-loader.js?v=v4.6.74"></script>
+<script src="modules/core/module-loader.js?v=v4.6.75"></script>
 
     <!-- Critical ext bundle loads AFTER webx11 exists so registerModule calls work -->
-<script src="modules/ext/critical-ext-bundle.js?v=v4.6.74"></script>
+<script src="modules/ext/critical-ext-bundle.js?v=v4.6.75"></script>
 
 <script>
 // ═══ ONE TRUE VERSION SOURCE ═══
diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index e6bb6af..678cdda 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.74';
+    const LATEST_VER = 'v4.6.75';
     const CACHE = '?v=' + LATEST_VER;
     const stored = localStorage.getItem('webx11_cache_ver');
     if (stored !== LATEST_VER) {
diff --git a/modules/ext/skill-pack-core.js b/modules/ext/skill-pack-core.js
index 8cd8632..5ff57f8 100644
--- a/modules/ext/skill-pack-core.js
+++ b/modules/ext/skill-pack-core.js
@@ -64,7 +64,7 @@ Hermes is the operator agent that runs the host. You can reach it from the termi
 tool loop, and its answer comes back on its own. Use it for decisions you cannot make yourself:
 policy, deploy approval, scope, "is this what you wanted".
 
-Contract: \`/_docs/chat-contract.md\`.
+Contract (fetch it — it is not in your VFS): https://webx11.duckdns.org/spaces/newos4/_docs/chat-contract.md
 
 ## Say it
 
diff --git a/skills/chatting-with-hermes.json b/skills/chatting-with-hermes.json
index d16578f..eb62e95 100644
--- a/skills/chatting-with-hermes.json
+++ b/skills/chatting-with-hermes.json
@@ -10,8 +10,8 @@
     "agent"
   ],
   "category": "system",
-  "content": "---\nname: chatting-with-hermes\ndescription: How to message Hermes (the platform operator) from inside newOS4, and how to read the answer - commands, the chat_hermes tool, cursor and error semantics\ntags: [hermes, chat, operator, escalation, feedback, agent]\ncategory: system\n---\n\n# Talking to Hermes\n\nHermes is the operator agent that runs the host. You can reach it from the terminal or from your\ntool loop, and its answer comes back on its own. Use it for decisions you cannot make yourself:\npolicy, deploy approval, scope, \"is this what you wanted\".\n\nContract: `/_docs/chat-contract.md`.\n\n## Say it\n\n    hermes <message>        # send (legacy alias: feedback)\n    hermes-poll             # check for new replies now (alias: feedback-inbox)\n    hermes-reset            # rotate the token, start a fresh thread\n\n**Not `chat`.** `ChatStudioModule` already registers `chat` (it toggles the chat overlay) and\ncommand dispatch walks modules in order, so a second `chat` is unreachable — it silently does\nnothing. If you type `chat hello` and nothing happens, that is why.\n\nInside the tool loop:\n\n    chat_hermes { \"action\": \"send\", \"text\": \"...\" }   -> { \"sent\": true, \"id\": ..., \"epoch\": ... }\n    chat_hermes { \"action\": \"read\" }                  -> { \"awaiting\": bool, \"messages\": [...] }\n\nReplies are **asynchronous**. Send, continue working, read on a later step. Do not block on an\nanswer that is minutes away.\n\n## Read it\n\nReplies print themselves: a 30 second poller shows `🤖 <text>` in the terminal with no command\nfrom you. The cursor is persisted, so a reload does not replay history.\n\n`awaiting: true` means the last word in the thread is yours — an answer is pending. `false` means\nHermes answered.\n\n## Failures and what they mean\n\n| Status | Code | Meaning | Do |\n|---|---|---|---|\n| 401 | `bad_token` | token missing or malformed in localStorage | `hermes-reset` |\n| 413 | `too_long` | over 4000 **codepoints** (emoji count as one) | shorten; nothing was sent |\n| 413 | `too_large` | body over 32 KB | shorten |\n| 429 | `rate_limited` | 20/thread or 40/IP per 10 min | wait `retry_after_ms` |\n| 503 | — | nginx is throttling the host, HTML body | retry with backoff; **not** your mistake |\n| 507 | `thread_limit` | too many threads on disk | tell the operator |\n\nOnly `429` and `503` are worth retrying. Everything else is permanent for that payload.\n\n## The cursor is milliseconds\n\n`epoch` and `cursor` are epoch **milliseconds**. Seconds look plausible and are wrong — two\nmessages in the same second would collide. Never compute the cursor yourself; the server issues it\non every poll, including an empty one (0).\n\n## Rules that keep this useful\n\n- One thought per message. A wall of text gets a shallow answer.\n- Never send credentials, tokens or personal data — it is stored in plain text on the host.\n- Do not poll in a loop. 30 s is already automatic; `hermes-poll` is for \"I need it now\".\n- Threads are per browser token. `hermes-reset` deliberately abandons the old thread, and the old\n  messages stay on disk but you will not see them again.\n- If Hermes asks a question, answer it in the same thread — the operator loses the context otherwise.\n\n## Verify your own result\n\n    hermes hello            -> \"📨 Sending…\" then \"✅ sent id=… epoch=…\"\n    hermes-poll             -> \"⏳ waiting for Hermes\" while the answer is pending\n\nA send that prints only `📨 Sending…` and never a ✅ or ❌ means the request never completed —\nreport that, it is a bug, not a slow answer.\n",
+  "content": "---\nname: chatting-with-hermes\ndescription: How to message Hermes (the platform operator) from inside newOS4, and how to read the answer - commands, the chat_hermes tool, cursor and error semantics\ntags: [hermes, chat, operator, escalation, feedback, agent]\ncategory: system\n---\n\n# Talking to Hermes\n\nHermes is the operator agent that runs the host. You can reach it from the terminal or from your\ntool loop, and its answer comes back on its own. Use it for decisions you cannot make yourself:\npolicy, deploy approval, scope, \"is this what you wanted\".\n\nContract (fetch it — it is not in your VFS): https://webx11.duckdns.org/spaces/newos4/_docs/chat-contract.md\n\n## Say it\n\n    hermes <message>        # send (legacy alias: feedback)\n    hermes-poll             # check for new replies now (alias: feedback-inbox)\n    hermes-reset            # rotate the token, start a fresh thread\n\n**Not `chat`.** `ChatStudioModule` already registers `chat` (it toggles the chat overlay) and\ncommand dispatch walks modules in order, so a second `chat` is unreachable — it silently does\nnothing. If you type `chat hello` and nothing happens, that is why.\n\nInside the tool loop:\n\n    chat_hermes { \"action\": \"send\", \"text\": \"...\" }   -> { \"sent\": true, \"id\": ..., \"epoch\": ... }\n    chat_hermes { \"action\": \"read\" }                  -> { \"awaiting\": bool, \"messages\": [...] }\n\nReplies are **asynchronous**. Send, continue working, read on a later step. Do not block on an\nanswer that is minutes away.\n\n## Read it\n\nReplies print themselves: a 30 second poller shows `🤖 <text>` in the terminal with no command\nfrom you. The cursor is persisted, so a reload does not replay history.\n\n`awaiting: true` means the last word in the thread is yours — an answer is pending. `false` means\nHermes answered.\n\n## Failures and what they mean\n\n| Status | Code | Meaning | Do |\n|---|---|---|---|\n| 401 | `bad_token` | token missing or malformed in localStorage | `hermes-reset` |\n| 413 | `too_long` | over 4000 **codepoints** (emoji count as one) | shorten; nothing was sent |\n| 413 | `too_large` | body over 32 KB | shorten |\n| 429 | `rate_limited` | 20/thread or 40/IP per 10 min | wait `retry_after_ms` |\n| 503 | — | nginx is throttling the host, HTML body | retry with backoff; **not** your mistake |\n| 507 | `thread_limit` | too many threads on disk | tell the operator |\n\nOnly `429` and `503` are worth retrying. Everything else is permanent for that payload.\n\n## The cursor is milliseconds\n\n`epoch` and `cursor` are epoch **milliseconds**. Seconds look plausible and are wrong — two\nmessages in the same second would collide. Never compute the cursor yourself; the server issues it\non every poll, including an empty one (0).\n\n## Rules that keep this useful\n\n- One thought per message. A wall of text gets a shallow answer.\n- Never send credentials, tokens or personal data — it is stored in plain text on the host.\n- Do not poll in a loop. 30 s is already automatic; `hermes-poll` is for \"I need it now\".\n- Threads are per browser token. `hermes-reset` deliberately abandons the old thread, and the old\n  messages stay on disk but you will not see them again.\n- If Hermes asks a question, answer it in the same thread — the operator loses the context otherwise.\n\n## Verify your own result\n\n    hermes hello            -> \"📨 Sending…\" then \"✅ sent id=… epoch=…\"\n    hermes-poll             -> \"⏳ waiting for Hermes\" while the answer is pending\n\nA send that prints only `📨 Sending…` and never a ✅ or ❌ means the request never completed —\nreport that, it is a bug, not a slow answer.\n",
   "created_at": "2026-10-23T19:50:00+00:00",
-  "updated_at": "2026-10-23T19:50:00+00:00",
+  "updated_at": "2026-10-23T20:10:00+00:00",
   "source": "seed"
 }
\ No newline at end of file
diff --git a/skills/chatting-with-hermes.md b/skills/chatting-with-hermes.md
index 0bc246a..d25cb2f 100644
--- a/skills/chatting-with-hermes.md
+++ b/skills/chatting-with-hermes.md
@@ -11,7 +11,7 @@ Hermes is the operator agent that runs the host. You can reach it from the termi
 tool loop, and its answer comes back on its own. Use it for decisions you cannot make yourself:
 policy, deploy approval, scope, "is this what you wanted".
 
-Contract: `/_docs/chat-contract.md`.
+Contract (fetch it — it is not in your VFS): https://webx11.duckdns.org/spaces/newos4/_docs/chat-contract.md
 
 ## Say it