---
title: "MGS1043: a remote spell's lock entry is missing or stale"
description: Fires when magus.yaml declares a remote spell that magus.lock does not pin, or pins for a different tag than magus.yaml now tracks. Only the update charm resolves a tag, so an ordinary run refuses instead of resolving it.
tags: [MGS1043, magusfile, spells, imports, remote, oci, magus.lock, lockfile, update]
---

# MGS1043: a remote spell's lock entry is missing or stale

`magus.yaml` declares a remote spell, and `magus.lock` has no digest for it, or has one
written for another tag:

```text
[error] [MGS1043] spell ghcr.io/team/spells/lint: magus.yaml tracks tag "1.4" but
magus.lock was written for "1.3"; run the target that writes magus.lock with the update
charm (`magus run spell-lock:update`), or `magus spell lock --update` when that magusfile
imports this spell itself
```

## Why

A tag is a pointer its publisher can move. Only the update charm asks a registry what a
tag names now; every other run reads the digest the lock recorded, so two runs of one
commit execute the same bytes. When the declaration and the lock disagree, the run has
no digest it may use: resolving the tag itself would be the moving target the lock
exists to prevent, and serving the old digest would run a version `magus.yaml` no longer
asks for.

The failure is held against the one import, not the workspace. Every magusfile that
does not import the spell still loads, including the one owning the lock target.

## What to do

Run the target that declares `magus.lock` as its output with the update charm:

```sh
magus run spell-lock:update
```

It resolves every declared tag, pulls and verifies each manifest, and rewrites the lock.
If that target's own magusfile imports the stale spell, it cannot load until the lock is
repaired; run the command it wraps directly:

```sh
magus spell lock --update
```

Review the lock diff and commit it with the `magus.yaml` change. See
[Remote spells](../../remote-spells.md).