MGS1043: a remote spell's lock entry is missing or stale

magus.yaml declares a remote spell, and magus.lock has no digest for it, or has one written for another tag:

[error] [MGS1043] spell ghcr.io/team/spells/lint: magus.yaml tracks tag "1.4" but
magus.lock was written for "1.3"; run the target that writes magus.lock with the update
charm (`magus run spell-lock:update`), or `magus spell lock --update` when that magusfile
imports this spell itself

Why

A tag is a pointer its publisher can move. Only the update charm asks a registry what a tag names now; every other run reads the digest the lock recorded, so two runs of one commit execute the same bytes. When the declaration and the lock disagree, the run has no digest it may use: resolving the tag itself would be the moving target the lock exists to prevent, and serving the old digest would run a version magus.yaml no longer asks for.

The failure is held against the one import, not the workspace. Every magusfile that does not import the spell still loads, including the one owning the lock target.

What to do

Run the target that declares magus.lock as its output with the update charm:

magus run spell-lock:update

It resolves every declared tag, pulls and verifies each manifest, and rewrites the lock. If that target's own magusfile imports the stale spell, it cannot load until the lock is repaired; run the command it wraps directly:

magus spell lock --update

Review the lock diff and commit it with the magus.yaml change. See Remote spells.