diff --git a/CHANGELOG.md b/CHANGELOG.md
index e90ba0d..e47979e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,21 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-25 — Groundwork for the script library `api 2.1.5` `web 2.1.9`
+
+**Nothing changes on screen.** These builds carry the first part of the script library — scripts
+written and stored in Jarvis, then run on many machines at once — and it stays hidden until it is
+finished: no page, no menu entry, and its addresses answer 404. The published configuration gains
+`SCRIPTS_PREVIEW: "false"`; `true` shows the unfinished library and is meant for the Jarvis team's
+own test platform only. Leave it at `false`.
+
+**The database gains the library's tables.** The api adds them on its own when it starts, and changes
+nothing that exists. An earlier 2.x api still starts on the database afterwards.
+
+Update the web image first, or both images at once — not the api alone: this api sends rights that an
+older web does not know, and that web signs out the platform's owners and super-admins. No agent
+update is required.
+
 ## 2026-10-23 — A command is never run twice when a machine's connection moves `api 2.1.4`
 
 **A command, a service restart or an agent update reaches the machine once.** With several API
diff --git a/kubernetes/02-config.yaml b/kubernetes/02-config.yaml
index da48f73..9175bb7 100644
--- a/kubernetes/02-config.yaml
+++ b/kubernetes/02-config.yaml
@@ -70,6 +70,11 @@ data:
   # first decides whether a restart leaves a closed transcript or a half-written one.
   RUN_SHUTDOWN_GRACE_SEC: "25"
 
+  # The script library is being built release by release, and every surface it adds stays hidden and
+  # every route it adds answers 404 until its milestone ships. "true" shows the unfinished area; it is
+  # for the team's own dev stack, never a customer platform.
+  SCRIPTS_PREVIEW: "false"
+
   # The browser service — a separate pod on purpose, see 09-browser.yaml. COMMENTED OUT to match
   # that file: with no browser deployed, setting this only turns "unavailable" into a timeout.
   # BROWSER_URL: "http://jarvis-browser:3000"