fix(author): the build page route hands over the source file, only the tool writes the .h5p

design/author.md

@@ -299,6 +299,14 @@ to 3,000. Twenty-four things the code does not say by itself:
   block and no link under the old text and the new (12 replies, half of them asked for a link to
   click), so the rule costs that position nothing, and what it changes in ChatGPT is not
   measured. No rule reaches a link copied wrong between the command's output and the reply.
+  An install that hangs is one that fails (2026-11-13): ChatGPT, asked why it had built nothing,
+  said its `npx` had timed out, and step 3's list named only errors. Haiku in a terminal whose
+  registry took each connection and never answered went on to the two files under the old text
+  and the new, 2 of 2 runs each, and built, so the words are for a model that reads the list to
+  the letter. An uploaded plugin is no way round the registry: a ChatGPT plugin that carried the
+  one-file tool and the whole pack, 15.6 MB, uploaded, and its code's `find /` found no file of
+  it, so the zips the organisation's site offers to install (missing-elements.github.io#40)
+  carry the skill's text and files only.
 - **A bundle per content type, where the pack cannot be installed** (2026-11-09, #166). The page
   leaves the last steps to the user, but ChatGPT's sandbox runs Node and fetches a file its
   browsing tool has opened: given the libraries as files, a chat builds and fixes its source
@@ -651,6 +659,28 @@ to 3,000. Twenty-four things the code does not say by itself:
   page; with the change, 5 of 5 again. It is for a model that reads step 5's list to the letter.
   In Claude Code's place it changed nothing: 2 of 2 Question Sets handed over the exact link
   alone, and the picture run no address and the preview command.
+
+  In that route the source goes over as a file too, where the chat can give one (2026-11-13).
+  ChatGPT with the skill as a plugin ran the link command and wrote its output out itself: 2 of
+  its 3 links broke, one with 43 characters of its own in place of 37 near its start, one at a
+  length base64 never has, while the `.source.json` it gave built at once on the page, which
+  since missing-elements.github.io#39 says a damaged link is damaged and offers to open that
+  file. Haiku in a sandbox told it had no network and could give files handed the file over
+  under the old text already, in 5 of 6 runs, as under the new; every link it gave was exact
+  and the reply's one web address.
+- **Only the build tool writes the `.h5p`** (2026-11-13). ChatGPT, asked to prove it could make
+  the file where it could not install the tool, zipped an `h5p.json` and a `content.json` it had
+  written: no library in it, and the content wrapped in a `params` key. The verifier fails it
+  for its missing libraries, and given the pack's it plays and draws "No question has been
+  added". Gemini, given the skill as an uploaded skill, said it held no steps to put a package
+  together. So the skill's opening says that only the tool writes one. With that sentence in a
+  test plugin, ChatGPT answered that it had written no `.h5p` and made none up: one run each
+  way. Haiku made none by hand under either text, 0 of 6 runs whose user asked for the file
+  itself, so the weak model shows no gain. It shows where the sentence leads: told its sandbox
+  had no network, 3 of 6 Haiku runs with it ran `npx` anyway, against 0 of 6 without, and built,
+  since this computer's npm answered. With npm cut off, 5 of 6 handed over the exact link and
+  the source file; the sixth, whose user wanted "not a link and not JSON", ended with the `npx`
+  command for the user, as one run of the old text had.
 - **The skill names no product** (2026-11-12, the owner's call). Its routes were told apart by
   the apps they were measured in; they now say what each needs: a shell that reaches the npm
   registry, Node and a download where npm cannot install, or nothing that runs or fetches. What a

skills/h5p-author/SKILL.md

@@ -10,7 +10,8 @@ You write a short source: the content type and only what its defaults cannot kno
 `@missing-elements/h5p-author` fills in the rest from the libraries, copies them, and checks
 every field. Needs Node 22 and a shell; nothing to install. Where `npx` cannot install, it builds
 from two downloaded files, or a page in the user's browser builds it (step 3), so never end with
-commands for the user to run.
+commands for the user to run. Only it writes the `.h5p`: never put one together yourself from
+`h5p.json` and `content.json`, since one made by hand carries no libraries and nothing checks it.
 Keep [LICENSE](./LICENSE) with the skill.
 
 With this text alone and none of its files beside it, open https://missing-elements.github.io/h5p/skill/
@@ -127,8 +128,9 @@ npx @missing-elements/h5p-author@latest build source.json course.h5p
 ```
 
 **If it cannot install here, build from files instead.** No network for npm (`EAI_AGAIN`,
-`ENOTFOUND`, a registry's 403, 404 or 503): do not retry, try another way to install it, or end
-with commands for the user to run once npm works. Where Node runs and you can fetch a file (where
+`ENOTFOUND`, a registry's 403, 404 or 503, or an install that hangs until the command times out):
+do not retry, try another way to install it, or end with commands for the user to run once npm
+works. Where Node runs and you can fetch a file (where
 the sandbox downloads only what a browsing tool has opened, open each address with that tool
 first, then download it), fetch the
 build tool and the bundle of the source's own `type`, the libraries a build of that type reads,
@@ -166,7 +168,9 @@ python3 -c "import base64,json,zlib;s=open('source.json','rb').read();f=[];json.
 **A link is only what one of these commands printed here, handed over whole: no command run, no
 link.** Never write a `#source=` link yourself, from memory or after an example, even when asked
 for one: its text is compressed, so it cannot be typed, and one wrong character leaves the page
-nothing to build.
+nothing to build. Where you can give the user a file, give them the source too, beside the link,
+under the activity's name with `.source.json` (`course.source.json`): the page opens it, and a
+link copied wrong into your reply builds nothing.
 
 Where nothing is built here and they print no link, with neither, or with no tool that runs
 anything at all (a chat's code tool can be unavailable for hours), give no link: the page sees
@@ -203,8 +207,9 @@ removing what fails. Without a browser, say the package is **unverified**.
 ## 5. Review and hand over
 
 Check answers and feedback against the material. Where nothing was built here, step 3's build
-page route is the whole hand-over: the link it printed, or the whole source and the page's
-address. Otherwise let the user play it in their browser:
+page route is the whole hand-over: the link it printed, with the source as a file where you can
+give one, or the whole source and the page's address. Otherwise let the user play it in their
+browser:
 
 ```bash
 npx @missing-elements/h5p-verify@latest course.h5p --preview