ui/tokens.css from the server's dev (tokens.lock.json; repin to the beta tag at release). scripts/fetch-vendor.sh copies the server's vendored CodeMirror and Lezer modules into ui/vendor/, each checked against the server's own pin first, with the bare module names rewritten to sibling files (the page has no import map); vendor.lock.json records both hashes, and the script with no argument verifies the copy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>