diff --git a/.gitignore b/.gitignore
index cf3862e..e6ef3ac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@ workspace/scripts/*
 !workspace/scripts/.gitkeep
 workspace/.secretary/
 deploy.json
+workspace/fortress/
diff --git a/docs/superpowers/specs/2026-09-23-fortress-mcp-design.md b/docs/superpowers/specs/2026-09-23-fortress-mcp-design.md
index 75fd864..16bde1f 100644
--- a/docs/superpowers/specs/2026-09-23-fortress-mcp-design.md
+++ b/docs/superpowers/specs/2026-09-23-fortress-mcp-design.md
@@ -189,3 +189,18 @@ Record which one was used in the Dockerfile comment. Chromium runtime libraries
   - Pass-through includes only non-blank vars.
 - `system-prompt.test.ts`: the Fortress section is present when enabled and absent otherwise.
 - Manual smoke test: in the Docker image with `FORTRESS_ENABLED=true`, the startup log shows `fortress tools enabled (29 tools)` and a Telegram request "read https://quotes.toscrape.com/js" returns the quotes.
+
+## Implementation notes (2026-09-23)
+
+The real `tilion-mcp` (tilion 0.1.14, tilion-fortress 151.0.7908.0.post5) surfaced four things the design didn't anticipate:
+
+- **`mcp<2` pin.** tilion imports `mcp.server.fastmcp`, which the Python MCP SDK 2.x removed, and it doesn't pin the dependency. Install with `pip install "tilion[mcp]" "mcp<2"`.
+- **`FORTRESS_CHANNEL=latest` default.** The `stable` bundle (v149) unpacks to `tillion-fortress/tillion`, but tilion_fortress looks for `tilion-fortress/tilion`, so it re-downloads and never launches. The bridge sets `latest` (v151, correct layout), and `FORTRESS_CHANNEL` in `.env` still overrides it. The Docker image prefetches the `latest` bundle.
+- **Bridge hardening, which Playwright also gets:**
+  - `callTimeoutMs`: Fortress uses 180 s. The SDK default of 60 s timed out the first call while the engine warmed up.
+  - Pi's abort signal is forwarded to `callTool`, so `/stop` cancels a running call.
+  - stderr is subscribed before `connect`, and a failed handshake rethrows with the server's last 20 stderr lines.
+  - `stderrLevel`: Fortress logs at `debug`, because it writes a line per request.
+- **Screenshot guidance.** `screenshot_page` without a `path` returns images under about 150 KB as base64 text. The system prompt tells the agent to always pass a file name.
+
+The server reports 33 tools, not 29.