deploy(hf): sync szl-holdings/a11oy@main derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy main.
Files: 1061 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

research/SOVEREIGN_MESH_RUNBOOK.md

@@ -0,0 +1,268 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+(c) 2026 Lutar, Stephen P. - SZL Holdings - ORCID 0009-0001-0110-4173 - Doctrine v11
+-->
+
+# Sovereign Mesh Runbook — harness the 2-box GPU mesh behind ONE endpoint
+
+**You are at the LAPTOP (`betterwithage`, RTX 5050) right now.** These are your hands —
+the cloud agent cannot reach your LAN. Follow the PowerShell baby-steps in order.
+Copy-paste one block at a time and read the "you should see" line before moving on.
+
+**What we are building:** the cloud a11oy Space calls **ONE** endpoint
+(`gateway.a-11-oy.com`, model `sovereign-llm`); a **LiteLLM** gateway load-balances
+your two Windows GPU boxes (tower `omen` RTX 4060 Ti + this laptop `betterwithage`
+RTX 5050), both running **Ollama**. Everything is durable (boot-persistent tasks) and
+self-healing (restart policies + LiteLLM node cooldown). Cloudflare = public ingress,
+Tailscale = private transport, Docker = the stateless sidecars only.
+
+```
+a11oy Space (cloud)
+   |  HTTPS + Bearer + CF-Access-Client-*    (ONE endpoint)
+   v
+Cloudflare edge (Access service token)  ->  gateway.a-11-oy.com
+   v  (cloudflared, outbound-only tunnel)
+LiteLLM :4000  (model "sovereign-llm")
+   |  Tailscale (private, tailnet-only :11434)
+   +--> omen         Ollama  (llama3.1:8b)
+   +--> betterwithage Ollama (glm-4.7-flash + the #789 energy probe)
+```
+
+> **HONESTY (Doctrine v11).** Nothing below "goes green" on faith. A node is only
+> `wired`/`live` when a **real** call to it succeeds THIS request. Joules are
+> **MEASURED** only from a real NVML delta (the #789 probe); otherwise the honest
+> `MEASURED_SHARED_BOUNDED` / `UNAVAILABLE` empty-state stands. A truthful BLOCKED
+> beats a fake green. **Ollama's `:11434` is never public.**
+
+---
+
+## 0. Prerequisites (one-time, on the laptop)
+
+```powershell
+# Confirm the driver + GPU are visible (native, no Docker).
+nvidia-smi
+# you should see: your RTX 5050 listed, a driver version (want 535+), and power draw.
+
+# Confirm Ollama, Tailscale, cloudflared, python are installed.
+ollama --version
+tailscale version
+cloudflared --version
+python --version    # or: py --version
+```
+
+If `nvidia-smi` shows the GPU but `power.draw` is `N/A` (some laptop GPUs do), the
+#789 probe will honestly emit `UNAVAILABLE` rather than a fake joule — that is fine,
+the mesh still works, you just do not get MEASURED joules from this box.
+
+---
+
+## Step (a) — pull glm-4.7-flash + start the #789 energy probe on the laptop
+
+```powershell
+# 1. Pull the laptop's model.
+ollama pull glm-4.7-flash
+
+# 2. Make sure Ollama accepts the tunneled Host header + binds for the tailnet.
+#    (These are the machine-level env the persist script sets; safe to set now.)
+[System.Environment]::SetEnvironmentVariable("OLLAMA_ORIGINS","*","Machine")
+[System.Environment]::SetEnvironmentVariable("OLLAMA_HOST","0.0.0.0:11434","Machine")
+
+# 3. Start the #789 per-inference energy probe in a LOOP (refreshes every 60s).
+#    Writes ~/.a11oy_ollama_energy.json which omen_joule_exporter.py merges as models[].
+$env:OLLAMA_MODEL = "glm-4.7-flash:latest"
+python box-scripts\ollama_energy_probe.py --loop 60
+# you should see: a line per cycle with joules + a VERBATIM label
+#   (MEASURED_SHARED_BOUNDED by default; MEASURED only if you assert exclusivity;
+#    UNAVAILABLE if NVML/power.draw cannot be read — never a fabricated number).
+```
+
+Leave that window running. (For the durable version, `box-scripts\laptop_persist.ps1`
+registers Ollama + the exporter + the `laptop-szl` tunnel as AtStartup tasks — run it
+**as Administrator** once you have verified the manual path works.)
+
+> **Clean MEASURED (optional):** only if *nothing else* uses the GPU during the window:
+> `$env:OLLAMA_GPU_EXCLUSIVE = "1"` before launching the probe. Otherwise keep the
+> honest `MEASURED_SHARED_BOUNDED` upper bound — do not upgrade the label.
+
+---
+
+## Step (b) — start LiteLLM (the unified gateway)
+
+Run LiteLLM on the **always-on** box. If the laptop is your always-on box for now,
+run it here; normally it lives on `omen`. Two ways — pick ONE.
+
+### (b-native) Native Python — simplest, no Docker/WSL2 (RECOMMENDED to start)
+
+```powershell
+pip install "litellm[proxy]"
+
+# Bearer the Space must send (generate a real random key; keep it secret).
+$env:LITELLM_MASTER_KEY   = "sk-REPLACE-with-a-real-random-key"
+# The shared pool model (must fit BOTH cards for true load-balancing).
+$env:SOVEREIGN_POOL_MODEL = "llama3.1:8b"
+# Tailscale MagicDNS names (or 100.x IPs from `tailscale ip -4` on each box).
+$env:OMEN_OLLAMA_URL      = "http://omen:11434"
+$env:BWA_OLLAMA_URL       = "http://betterwithage:11434"
+$env:OMEN_MODEL           = "llama3.1:8b"
+$env:BWA_MODEL            = "glm-4.7-flash:latest"
+
+litellm --config box-scripts\litellm_config.yaml --port 4000
+# you should see: "Uvicorn running on http://0.0.0.0:4000".
+```
+
+Verify locally (new PowerShell window):
+
+```powershell
+curl.exe -s http://localhost:4000/health/liveliness
+# you should see: {"status":"healthy"...}
+
+curl.exe -s http://localhost:4000/v1/models -H "Authorization: Bearer $env:LITELLM_MASTER_KEY"
+# you should see: sovereign-llm, omen-llama, betterwithage-glm in the list.
+
+curl.exe -s http://localhost:4000/v1/chat/completions `
+  -H "Authorization: Bearer $env:LITELLM_MASTER_KEY" `
+  -H "Content-Type: application/json" `
+  -d '{"model":"sovereign-llm","messages":[{"role":"user","content":"say ok"}]}'
+# you should see: a real completion (proves LiteLLM reached a live Ollama node).
+```
+
+### (b-docker) Containerized sidecars — Ollama STILL native
+
+> **WSL2 GPU passthrough is fragile.** Only the *sidecars* go in Docker; Ollama and
+> the #789 probe stay native (Step a). If `dcgm-exporter` cannot get the GPU, comment
+> it out and rely on the native probe for joules — the meter path does not need it.
+
+```powershell
+# .env next to the compose file (NEVER commit it):
+#   LITELLM_MASTER_KEY=sk-...      CF_TUNNEL_TOKEN_GPU=...(if using token mode)
+#   OMEN_OLLAMA_URL=http://host.docker.internal:11434   (native Ollama on THIS box)
+#   BWA_OLLAMA_URL=http://betterwithage:11434            (tailnet)
+docker compose -f box-scripts\docker-compose.yml up -d litellm prometheus grafana
+docker compose -f box-scripts\docker-compose.yml ps
+# you should see: litellm (healthy). On the laptop, use docker-compose.laptop.yml
+# which is telemetry-only (dcgm-exporter).
+```
+
+---
+
+## Step (c) — verify meter2 `models[]` appears
+
+The #789 probe (Step a) writes energy JSON; `omen_joule_exporter.py` (engine name
+`betterwithage` on the laptop) merges it as top-level `models[]` and serves it on
+`:9471`, tunneled as `meter2.a-11-oy.com`.
+
+```powershell
+# Local exporter (if not already running via laptop_persist.ps1):
+$env:OMEN_ENGINE_NAME = "betterwithage"
+python box-scripts\omen_joule_exporter.py     # serves 0.0.0.0:9471
+
+# Local check:
+curl.exe -s http://localhost:9471/ | python -m json.tool
+# you should see: engines[] with engine "betterwithage" AND a top-level models[]
+#   entry for glm-4.7-flash with joules_per_token + a VERBATIM label
+#   (or an UNAVAILABLE null if NVML/power.draw is not readable — honest, not fake).
+
+# Public check (through the laptop-szl tunnel):
+curl.exe -s https://meter2.a-11-oy.com/ | python -m json.tool
+# you should see: the same models[] payload.
+```
+
+If `models[]` is missing: the probe is not running (Step a) or the energy JSON is
+stale (>300s, `OLLAMA_ENERGY_MAX_AGE_S`) → it is intentionally surfaced as
+`UNAVAILABLE`, never a stale/fake number.
+
+---
+
+## Step (d) — point the Space at the LiteLLM gateway
+
+Expose LiteLLM publicly as `gateway.a-11-oy.com` via cloudflared (see
+`box-scripts/cloudflared_ingress.example.yml` — the real `~/.cloudflared/config.yml`
+is on-box, not committed). Then set the **Space secrets**:
+
+| Space secret | Value | Effect |
+|---|---|---|
+| `SZL_LOCAL_LLM_URL` | `https://gateway.a-11-oy.com` | Points the sovereign-local path at the gateway (single endpoint). |
+| `A11OY_SOVEREIGN_GATEWAY_URL` | `https://gateway.a-11-oy.com` | *Preferred.* Takes precedence over `SZL_LOCAL_LLM_URL`; the brain/anatomy use the unified LiteLLM endpoint. **Unset ⇒ falls back to `SZL_LOCAL_LLM_URL` (unchanged).** |
+| `A11OY_SOVEREIGN_GATEWAY_KEY` | your `LITELLM_MASTER_KEY` | Bearer sent to the gateway. Secret is never logged/returned. (Fallback name: `SZL_LOCAL_LLM_KEY`.) |
+| `SZL_LOCAL_LLM_MODEL` | `sovereign-llm` | The model name LiteLLM load-balances across both nodes. |
+
+> Only **one** of `A11OY_SOVEREIGN_GATEWAY_URL` / `SZL_LOCAL_LLM_URL` is required.
+> Set the gateway one to prefer the unified endpoint; both unset ⇒ honest stub.
+> If Cloudflare Access is in front, also set the Space's `CF-Access-Client-Id` /
+> `CF-Access-Client-Secret` (service token) — layered auth (bearer **and** Access).
+
+---
+
+## Step (e) — verify the Space wired to the mesh
+
+```powershell
+# 1. Registry wired_count should increment (sovereign_local now wired).
+curl.exe -s "https://szlholdings-a11oy.hf.space/api/a11oy/v1/llm/registry?probe=1" | python -m json.tool
+# you should see: wired_count >= 1, "sovereign_local" in wired_model_ids, and its
+#   badge {wired:true, base_url: the gateway}. local_live:true ONLY if the node
+#   answered THIS request.
+
+# 2. Sovereign health: live + served models THIS request.
+curl.exe -s "https://szlholdings-a11oy.hf.space/api/a11oy/v1/llm/sovereign/health" | python -m json.tool
+# you should see: env_present:true, live:true, served_models includes sovereign-llm.
+
+# 3. Route a real prompt to the mesh.
+curl.exe -s -X POST "https://szlholdings-a11oy.hf.space/api/a11oy/v1/llm/route" `
+  -H "Content-Type: application/json" `
+  -d '{"prompt":"one sentence: why sovereign inference matters","task_hint":"sovereign"}'
+# you should see: routed_via "sovereign_local (...)", a REAL response, and a
+#   lambda_receipt (Λ = Conjecture 1, advisory). If the node is down you get an
+#   HONEST STUB — the tier selection + Λ + receipt are still real.
+```
+
+`/brain/ask` (Wave 1/2) then routes its grounded prompt to `sovereign-llm` through the
+same gateway when `A11OY_SOVEREIGN_GATEWAY_URL` (or `SZL_LOCAL_LLM_URL`) is set;
+otherwise it honestly returns the retrieved subgraph with "no local model wired".
+
+---
+
+## Security (Doctrine v11 — non-negotiable)
+
+1. **Ollama is NEVER public.** `:11434` is served over the tailnet only. It is not in
+   any cloudflared ingress rule. Ollama has no built-in auth — the network IS its auth.
+2. **Layered auth on the ONE public endpoint** (`gateway.a-11-oy.com`):
+   - **LiteLLM bearer** (`master_key`) required on every request, **and**
+   - **Cloudflare Access service token** in front of the tunnel hostname, **and**
+   - **Tailnet ACL** (`box-scripts/tailscale_acl.json`, deny-by-default): only
+     `tag:llm-gateway` may reach `tag:llm-gpu:11434`. A leaked bearer alone, or a
+     leaked Access token alone, is insufficient.
+3. **Never use Tailscale Funnel** for Ollama (no funnel grant exists in the ACL).
+4. **Pin image tags** on GPU-facing containers; do not auto-update them unattended.
+5. **Never commit a key.** `LITELLM_MASTER_KEY`, tunnel tokens, and the gateway bearer
+   live only in the shell/`.env`/Space secrets — never in the tree.
+
+## Self-healing / durability
+
+| Layer | Mechanism |
+|---|---|
+| Ollama (native Win) | `laptop_persist.ps1` / `omen_boot_persist.ps1` — AtStartup task, `RestartCount 999`, `-AllowStartIfOnBatteries`. |
+| #789 probe + exporter | Same persist scripts (AtStartup, auto-restart). |
+| Tailscale (Win) | "Run unattended" mode; Startup Type = Automatic. |
+| cloudflared / litellm / prometheus / grafana / dcgm-exporter | `restart: unless-stopped` + healthchecks (docker-compose). |
+| LiteLLM ↔ node failure | `cooldown_time: 30`, `num_retries: 2`, least-busy routing auto-skips a down node. |
+
+## Native-Windows fallback (the honest default)
+
+WSL2 GPU-in-Docker is fragile (driver-version sensitivity, "restart Docker Desktop
+fully" gotchas, silent CPU fallback). So the **model-serving path stays native**:
+run Ollama + the #789 probe natively (Steps a, c), and containerize only the
+stateless sidecars (LiteLLM / Prometheus / Grafana / cloudflared / dcgm-exporter).
+If `dcgm-exporter` cannot acquire the GPU in its container, drop it and rely on the
+native NVML probe for MEASURED joules — the mesh and the meter both still work.
+
+## Troubleshooting
+
+- **`gpu2`/tunnel 403** → set `OLLAMA_ORIGINS=*` and `OLLAMA_HOST=0.0.0.0:11434` at
+  machine level (Step a), then restart Ollama.
+- **LiteLLM 401 from the Space** → the Space's `A11OY_SOVEREIGN_GATEWAY_KEY` (bearer)
+  must equal `LITELLM_MASTER_KEY`; if Access is on, also send the CF service token.
+- **`wired_count` did not increment** → `SZL_LOCAL_LLM_URL` / `A11OY_SOVEREIGN_GATEWAY_URL`
+  not set as a Space secret, or the gateway is unreachable (honest stub — not a bug).
+- **`models[]` missing on meter2** → the #789 probe is not looping, or the reading is
+  stale/`UNAVAILABLE` (NVML/power.draw not readable). Honest empty-state, never faked.
+</content>

static/3d/holographic.html

@@ -34,9 +34,11 @@
     collapsible CATEGORY dropdowns. Replaces the old flat wall of ~84 pills so the flagship
     surfaces stand out and the rest group behind one-tap dropdowns. Accents are proof-teal
     (0x3af4c8) — NEVER purple (doctrine v11 palette). */
- .tabs{display:flex;flex-direction:column;gap:6px;padding:8px 12px;border-bottom:1px solid var(--line);
-  background:#070d15;flex:0 0 auto}
- .navrow{display:flex;gap:6px;flex-wrap:wrap;align-items:center}
+ .tabs{display:flex;flex-direction:column;gap:0;padding:8px 12px;border-bottom:1px solid var(--line);
+  background:#070d15;flex:0 0 auto;position:relative;z-index:18}
+ .navrow{display:flex;gap:6px;flex-wrap:nowrap;align-items:center;overflow-x:auto;
+  -webkit-overflow-scrolling:touch;scrollbar-width:none;padding-bottom:2px}
+ .navrow::-webkit-scrollbar{display:none}
  .navlabel{font:9.5px ui-monospace,monospace;color:var(--para);letter-spacing:.6px;
   text-transform:uppercase;opacity:.7;margin-right:2px;flex:0 0 auto}
  .tab{font:11.5px ui-monospace,monospace;padding:6px 12px;border-radius:7px;border:1px solid var(--line);
@@ -60,9 +62,31 @@
  .catbtn[data-hasactive="true"]{box-shadow:0 0 0 1px var(--proof) inset}
  .catbtn .count{font-size:9px;color:var(--para);opacity:.7}
  /* Drop panel: the tabs of the currently-open category (only one open at a time). */
- .panel{display:none;gap:6px;flex-wrap:wrap;padding:8px;margin-top:2px;
-  border:1px solid var(--line);border-radius:9px;background:#08111a}
+ .panel{display:none;gap:6px;flex-wrap:wrap;padding:8px;margin-top:2px;max-height:180px;
+  overflow-y:auto;border:1px solid var(--line);border-radius:9px;background:#08111a}
  .panel[data-open="true"]{display:flex}
+ .navtools{display:grid;grid-template-columns:minmax(260px,1fr) minmax(210px,auto) auto auto;
+  gap:7px;align-items:center;min-height:34px}
+ .surface-search{width:100%;min-width:0;border:1px solid var(--line);border-radius:8px;
+  background:#08111a;color:var(--cream);padding:7px 10px;font:11.5px ui-monospace,monospace;
+  outline:none;letter-spacing:.2px}
+ .surface-search:focus{border-color:var(--proof);box-shadow:0 0 0 1px var(--proof)}
+ .surface-search::placeholder{color:#70818e}
+ .navmeta{font:10px ui-monospace,monospace;color:var(--para);white-space:nowrap}
+ .navmode{border:1px solid var(--line);border-radius:8px;background:#0a121b;color:var(--para);
+  padding:7px 10px;font:10.5px ui-monospace,monospace;cursor:pointer;white-space:nowrap}
+ .navmode:hover{border-color:var(--proof);color:var(--cream)}
+ .active-surface{display:flex;align-items:center;gap:7px;min-width:0;padding:0 8px;
+  border-left:1px solid var(--line);font:10px ui-monospace,monospace;color:var(--para)}
+ .active-surface span{font-size:9px;letter-spacing:.8px;color:var(--proof)}
+ .active-surface strong{font-weight:500;color:var(--cream);overflow:hidden;text-overflow:ellipsis;
+  white-space:nowrap;max-width:32vw}
+ .surface-browser{display:none;position:absolute;left:12px;right:12px;top:calc(100% + 1px);
+  padding:9px;border:1px solid var(--line);border-top-color:#20323e;border-radius:0 0 10px 10px;
+  background:rgba(7,13,21,.98);box-shadow:0 18px 40px rgba(0,0,0,.56);z-index:20}
+ .tabs[data-browse="true"] .surface-browser{display:flex;flex-direction:column;gap:7px}
+ #search-panel{position:absolute;left:12px;right:12px;top:calc(100% + 1px);z-index:22;
+  margin:0;box-shadow:0 18px 40px rgba(0,0,0,.56)}
  #stage-wrap{position:relative;flex:1 1 auto;min-height:0;width:100%}
  #stage{position:absolute;inset:0}
  #stage canvas{display:block;width:100%;height:100%;touch-action:none}
@@ -85,13 +109,15 @@
   header .badge{font-size:9.5px;padding:2px 6px}
   #three-rev-badge,#cdn-badge{display:none}
   .tabs{padding:7px 10px;gap:5px}
+  .navtools{grid-template-columns:minmax(0,1fr) auto}
+  .navmeta,.active-surface{display:none}
   /* Featured + category rows each scroll horizontally so they never build a tall wall;
      the tapped-open panel wraps below, height-capped so it never shoves the stage off. */
-  .navrow{flex-wrap:nowrap;overflow-x:auto;-webkit-overflow-scrolling:touch;scrollbar-width:thin}
-  .navrow::-webkit-scrollbar{height:4px}
-  .navrow::-webkit-scrollbar-thumb{background:var(--line);border-radius:4px}
+  .navrow{flex-wrap:nowrap;overflow-x:auto;-webkit-overflow-scrolling:touch;scrollbar-width:none}
+  .navrow::-webkit-scrollbar{display:none}
   .navlabel{position:sticky;left:0;background:#070d15;z-index:1}
   .tab,.catbtn{padding:7px 11px;font-size:11px;flex:0 0 auto}
+  .surface-browser{left:8px;right:8px;max-height:52vh;overflow:auto}
   .panel[data-open="true"]{flex-wrap:wrap;max-height:34vh;overflow-y:auto}
   footer{font-size:9px;padding:5px 10px}
   /* Give the 3D stage a guaranteed usable share of the screen on phones (100dvh-safe). */
@@ -160,10 +186,21 @@
  <a href="/verify" class="badge" title="Public receipt verifier — paste a signed Khipu receipt / DSSE envelope for a PASS/FAIL panel">✓ verify</a>
  <a href="/" style="margin-left:auto;font:11px ui-monospace,monospace">← a11oy</a>
 </header>
-<nav class="tabs" id="tabs" role="tablist" aria-label="Estate surfaces">
- <div class="navrow" id="featured-row"><span class="navlabel">★ Featured</span></div>
- <div class="navrow" id="cat-row"><span class="navlabel">Categories</span></div>
- <div id="cat-panels"></div>
+<nav class="tabs" id="tabs" role="tablist" aria-label="Estate surfaces" data-browse="false">
+ <div class="navtools">
+  <input class="surface-search" id="surface-search" type="search"
+   placeholder="Find a surface (Ctrl/⌘ K)" autocomplete="off" spellcheck="false"
+   aria-label="Find an estate surface" aria-controls="search-panel"/>
+  <div class="active-surface" id="active-surface" aria-live="polite"><span>ACTIVE</span><strong>Loading surface</strong></div>
+  <span class="navmeta" id="surface-results-count">All surfaces indexed</span>
+  <button class="navmode" id="nav-mode" type="button" aria-expanded="false" aria-controls="surface-browser">Browse surfaces</button>
+ </div>
+ <div class="panel" id="search-panel" role="group" aria-label="Surface search results" data-open="false"></div>
+ <div class="surface-browser" id="surface-browser">
+  <div class="navrow" id="featured-row"><span class="navlabel">★ Featured</span></div>
+  <div class="navrow" id="cat-row"><span class="navlabel">Categories</span></div>
+  <div id="cat-panels"></div>
+ </div>
 </nav>
 <div id="stage-wrap">
  <div id="stage"></div>
@@ -219,6 +256,7 @@ import * as THREE from "three";
 
 // The 9 surface slots the other devs fill. Lazy-loaded per tab.
 const SURFACES = [
+  { id: "integritycontrol", cat: "governance", short: "Integrity Control Plane", title: "Integrity Control Plane · read-only Waqay Security Loop + Claim Integrity manifests · PROPOSAL_ONLY boundary · effectors=0 · signatures honestly UNSIGNED until a real signer and external verifier exist", mod: "/static/3d/surfaces/integritycontrol.js" },
   { id: "atlas", cat: "map", flag: true,       title: "Atlas",       mod: "/static/3d/surfaces/atlas.js" },
   { id: "frontier", cat: "map",    title: "Frontier",    mod: "/static/3d/surfaces/frontier.js" },
   { id: "neuromorphic", cat: "more", title: "Neuromorphic", mod: "/static/3d/surfaces/neuromorphic.js" },
@@ -474,9 +512,32 @@ const catOf = (s) => s.cat || "more";
 const featuredRow = document.getElementById("featured-row");
 const catRow = document.getElementById("cat-row");
 const catPanels = document.getElementById("cat-panels");
+const searchInput = document.getElementById("surface-search");
+const searchPanel = document.getElementById("search-panel");
+const searchCount = document.getElementById("surface-results-count");
+const navMode = document.getElementById("nav-mode");
+const activeSurface = document.querySelector("#active-surface strong");
 const _panels = {};   // cat -> drop-panel element
 const _catBtns = {};  // cat -> dropdown button
 
+function _clearSearch() {
+  if (searchInput) searchInput.value = "";
+  if (searchPanel) { searchPanel.textContent = ""; searchPanel.dataset.open = "false"; }
+  if (searchCount) searchCount.textContent = SURFACES.length + " surfaces indexed";
+}
+
+// Command-center default: the graph owns the viewport. The complete registry remains one
+// click away in an overlay drawer and every surface remains indexed by the search field.
+function _setBrowser(open) {
+  const on = !!open;
+  tabsEl.dataset.browse = String(on);
+  if (navMode) {
+    navMode.setAttribute("aria-expanded", String(on));
+    navMode.textContent = on ? "Close browser" : "Browse surfaces";
+  }
+  if (!on) openCategory("", false);
+}
+
 // Short pill label: first 1-2 " · "-separated segments of the honest title, capped.
 // The FULL honest title is preserved verbatim in the tooltip (b.title) and in the
 // footer caption when the surface is selected — nothing is dropped, only de-cluttered.
@@ -504,6 +565,9 @@ function _makeTab(s, feat) {
   }
   b.addEventListener("click", () => {
     selectSurface(s.id);
+    _clearSearch();
+    _setBrowser(false);
+    openCategory(catOf(s), false);
     // On the mobile horizontal strips, keep the tapped tab in view.
     try { b.scrollIntoView({ behavior: "smooth", inline: "center", block: "nearest" }); } catch (_) {}
   });
@@ -537,21 +601,65 @@ CATS.forEach(([cat, label]) => {
   const panel = document.createElement("div");
   panel.className = "panel"; panel.dataset.cat = cat; panel.dataset.open = "false";
   items.forEach((s) => panel.appendChild(_makeTab(s, false)));
-  btn.addEventListener("click", () => openCategory(cat, panel.dataset.open !== "true"));
+  btn.addEventListener("click", () => {
+    _clearSearch();
+    openCategory(cat, panel.dataset.open !== "true");
+  });
   catRow.appendChild(btn);
   catPanels.appendChild(panel);
   _panels[cat] = panel; _catBtns[cat] = btn;
 });
 
+// Indexed surface finder: every surface stays reachable without a permanent wall of pills.
+// Matching is deterministic over id, title and category; nothing is generated.
+if (searchInput && searchPanel) {
+  const renderSearch = () => {
+    const q = searchInput.value.trim().toLowerCase();
+    searchPanel.textContent = "";
+    if (!q) { _clearSearch(); return; }
+    _setBrowser(false);
+    openCategory("", false);
+    const matches = SURFACES.filter((s) =>
+      (s.id + " " + s.title + " " + catOf(s)).toLowerCase().includes(q));
+    matches.slice(0, 36).forEach((s) => searchPanel.appendChild(_makeTab(s, false)));
+    searchPanel.dataset.open = "true";
+    if (searchCount) searchCount.textContent = matches.length + " match" + (matches.length === 1 ? "" : "es");
+  };
+  searchInput.addEventListener("input", renderSearch);
+  searchInput.addEventListener("keydown", (ev) => {
+    if (ev.key === "Escape") { _clearSearch(); _setBrowser(false); searchInput.blur(); }
+    if (ev.key === "Enter") {
+      const first = searchPanel.querySelector("[data-id]");
+      if (first) first.click();
+    }
+  });
+  document.addEventListener("keydown", (ev) => {
+    if ((ev.ctrlKey || ev.metaKey) && ev.key.toLowerCase() === "k") {
+      ev.preventDefault(); searchInput.focus(); searchInput.select();
+    }
+  });
+  _clearSearch();
+}
+
+if (navMode) {
+  navMode.addEventListener("click", () => {
+    _clearSearch();
+    _setBrowser(tabsEl.dataset.browse !== "true");
+  });
+}
+
 // Mark every tab button carrying `id` as selected (a flagship is in both the Featured row
 // and its category panel), auto-open the active surface's category, and proof-teal-flag the
 // owning dropdown button so the current location is always legible.
 function _highlight(id) {
   const def = SURFACES.find((s) => s.id === id);
   const cat = def ? catOf(def) : null;
+  if (activeSurface) {
+    activeSurface.textContent = def ? _shortLabel(def) : id;
+    activeSurface.title = def ? def.title : id;
+  }
   tabsEl.querySelectorAll("[data-id]").forEach((t) =>
     t.setAttribute("aria-selected", String(t.dataset.id === id)));
-  if (cat && _panels[cat]) openCategory(cat, true);
   Object.keys(_catBtns).forEach((c) =>
     _catBtns[c].setAttribute("data-hasactive", String(c === cat)));
 }

static/3d/surfaces/_showcase.js

@@ -308,6 +308,9 @@ export function createShowcase(ctx, opts = {}) {
 //   fadeNear  : number                   camera distance at full opacity (default 8)
 //   fadeFar   : number                   camera distance at min opacity  (default 60)
 //   minOpacity: number                   floor opacity for far labels (default 0.15)
+//   avoidOverlap: boolean                suppress lower-ranked colliding labels
+//   minGap    : number                   collision padding in CSS pixels (default 8)
+//   maxLength : number                   persistent-label character cap (hover stays full)
 //   container : DOM                      overlay host (default ctx.container)
 // ---------------------------------------------------------------------------
 export function createSceneLabels(ctx, opts = {}) {
@@ -329,6 +332,9 @@ export function createSceneLabels(ctx, opts = {}) {
   const fadeNear = opts.fadeNear != null ? opts.fadeNear : 8;
   const fadeFar = opts.fadeFar != null ? opts.fadeFar : 60;
   const minOpacity = opts.minOpacity != null ? opts.minOpacity : 0.15;
+  const avoidOverlap = opts.avoidOverlap === true;
+  const minGap = Math.max(0, opts.minGap != null ? opts.minGap : 8);
+  const maxLength = Math.max(12, opts.maxLength || 54);
 
   const layer = document.createElement("div");
   layer.className = "szl-lbl-layer";
@@ -387,7 +393,18 @@ export function createSceneLabels(ctx, opts = {}) {
     canvas.addEventListener("pointerleave", _onLeave, { passive: true });
   }
 
-  function _place(el, obj, text, isHover) {
+  function _visibleText(text, isHover) {
+    const raw = String(text || "");
+    if (isHover || raw.length <= maxLength) return raw;
+    return raw.slice(0, maxLength - 1).replace(/\s+\S*$/, "") + "…";
+  }
+
+  function _overlaps(a, b) {
+    return !(a.right + minGap <= b.left || b.right + minGap <= a.left ||
+      a.bottom + minGap <= b.top || b.bottom + minGap <= a.top);
+  }
+
+  function _place(el, obj, text, isHover, occupied) {
     if (!obj) { el.style.display = "none"; return; }
     obj.getWorldPosition(proj);
     const dist = camera.position.distanceTo(proj);
@@ -399,24 +416,41 @@ export function createSceneLabels(ctx, opts = {}) {
     // fade with distance, size-capped (font stays fixed → size cap)
     let op = 1;
     if (dist > fadeNear) op = Math.max(minOpacity, 1 - (dist - fadeNear) / Math.max(1, fadeFar - fadeNear));
-    el.textContent = text;
+    el.textContent = _visibleText(text, isHover);
     el.style.left = x + "px";
     el.style.top = y + "px";
     el.style.opacity = String(isHover ? Math.max(op, 0.9) : op);
     el.style.display = "block";
+    // Persistent labels are processed in descending importance. When two labels would
+    // collide, retain the higher-ranked one and suppress the lower-ranked label. Hover
+    // remains full-fidelity and is never suppressed.
+    if (avoidOverlap && occupied && !isHover && el.getBoundingClientRect) {
+      const er = el.getBoundingClientRect();
+      const lr = layer.getBoundingClientRect();
+      const box = {
+        left: er.left - lr.left, right: er.right - lr.left,
+        top: er.top - lr.top, bottom: er.bottom - lr.top,
+      };
+      if (occupied.some((prior) => _overlaps(box, prior))) {
+        el.style.display = "none";
+        return;
+      }
+      occupied.push(box);
+    }
   }
 
   function update() {
     const objs = getObjects();
     // persistent top-N by weight
     if (topN) {
+      const occupied = [];
       const ranked = objs
         .map((o) => ({ o, w: getWeight(o) }))
         .sort((a, b) => b.w - a.w)
         .slice(0, topN);
       for (let i = 0; i < pool.length; i++) {
         const item = ranked[i];
-        if (item && item.o) _place(pool[i], item.o, getText(item.o) || "", false);
+        if (item && item.o) _place(pool[i], item.o, getText(item.o) || "", false, occupied);
         else pool[i].style.display = "none";
       }
     }

static/3d/surfaces/brain.js

@@ -65,9 +65,9 @@ const LAYER_R = { "-1": 8.5, "0": 4.2, "1": 2.0, "2": 3.2, "3": 1.6 };
 // render budget (LOD): keep the estate core + this many top-connected leaders
 const FIELD_TOP  = 480;   // default top-connected field leaders
 const MAX_NODES  = 1650;  // hard cap on rendered nodes (mobile-safe)
-const LABEL_MESH_MAX = 220; // nodes drawn as individual meshes (labelable)
-const MAX_EDGES  = 6500;  // rendered edge cap
-const FIRE_MAX   = 220;   // simultaneous firing pulses
+const LABEL_MESH_MAX = 144; // bounded interactive leaders; long tail stays instanced
+const MAX_EDGES  = 5200;  // visual edge cap (the API still exposes the complete graph)
+const FIRE_MAX   = 160;   // simultaneous firing pulses
 
 let _stage = null, _THREE = null, _ctx = null, _group = null, _show = null;
 let _badge = null, _polls = [], _frameReg = false, _t0 = 0;
@@ -140,10 +140,12 @@ function _nodeColor(n) {
 }
 function _nodeRadius(n) {
   const deg = n.degree || 0;
-  let r = 0.14 + 0.055 * Math.sqrt(deg);
-  if (n.locked) r = Math.max(r, 0.42);
-  if (n.kind === "estate") r = Math.max(r, 0.55);
-  return Math.min(r, 0.9);
+  // Log degree prevents a handful of hubs from occluding the graph. Degree still controls
+  // size, but the visual cannot turn a popular node into an opaque wall.
+  let r = 0.08 + 0.035 * Math.log2(1 + deg);
+  if (n.locked) r = Math.max(r, 0.22);
+  if (n.kind === "estate") r = Math.max(r, 0.28);
+  return Math.min(r, 0.30);
 }
 
 // -------------------------------------------------------------------------- //
@@ -152,6 +154,9 @@ function _nodeRadius(n) {
 function mount(ctx) {
   _ctx = ctx; _stage = ctx.stage; _THREE = ctx.THREE;
   _group = new _THREE.Group();
+  // Center the bounded graph in the viewport left by the compact evidence card.
+  _group.position.x = 1.0;
+  _group.scale.setScalar(0.66);
   _stage.scene.add(_group);
   _t0 = (typeof performance !== "undefined" ? performance.now() : Date.now());
   _sphereGeo = new _THREE.SphereGeometry(1, 10, 8);
@@ -173,7 +178,8 @@ function mount(ctx) {
       objects: () => _labelMeshes,
       text: (o) => (o.userData && o.userData.node && (o.userData.node.title || o.userData.node.id)) || "",
       weight: (o) => (o.userData && o.userData.node && o.userData.node.degree) || 0,
-      topN: 12, hover: true, fadeNear: 10, fadeFar: 70,
+      topN: 3, hover: true, fadeNear: 12, fadeFar: 55,
+      avoidOverlap: true, minGap: 10, maxLength: 38,
     });
   }
 

static/3d/surfaces/integritycontrol.js

@@ -0,0 +1,360 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Stephen P. Lutar Jr. / SZL Holdings
+//
+// Integrity Control Plane -- a compact, read-only view of two local contracts:
+//   GET /api/a11oy/v1/waqay/security-loop/manifest
+//   GET /api/a11oy/v1/claim-integrity/info
+//
+// This surface does not invoke an action route. A successful fetch means only that the
+// contract manifest was read. It does NOT mean that a deployer, rollback mechanism, model,
+// signer, repository writer, or any other effector is live. The view reports the API fields
+// verbatim and treats any boundary mismatch as a violation rather than rounding it up.
+
+import { createShowcase } from "./_showcase.js";
+
+const ID = "integritycontrol";
+const TITLE = "Integrity Control Plane · proposal boundaries";
+const SECURITY_EP = "/api/a11oy/v1/waqay/security-loop/manifest";
+const CLAIM_EP = "/api/a11oy/v1/claim-integrity/info";
+
+const C_TEAL = 0x3af4c8;
+const C_BLUE = 0x5b8dee;
+const C_AMBER = 0xe8c074;
+const C_RED = 0xff5964;
+const C_DIM = 0x42505d;
+const C_GRID = 0x1b3a44;
+
+let _ctx = null;
+let _stage = null;
+let _THREE = null;
+let _group = null;
+let _show = null;
+let _polls = [];
+let _frameRegistered = false;
+let _core = null;
+let _ring = null;
+let _nodes = [];
+let _links = [];
+let _boundaryPill = null;
+
+const S = {
+  security: null,
+  claim: null,
+  fetch: { security: "init", claim: "init" },
+  mode: null,
+  effectors: null,
+  signing: null,
+  verdict: "AWAITING-CONTRACTS",
+};
+
+function _isObject(v) { return !!v && typeof v === "object" && !Array.isArray(v); }
+function _upper(v) { return v == null ? null : String(v).trim().toUpperCase(); }
+function _number(v) { return typeof v === "number" && Number.isFinite(v) ? v : null; }
+
+// Pure boundary reducer. No fallback values are invented: a field is known only after the
+// corresponding endpoint supplies it. Exported so contract tests can pin the reducer.
+export function deriveIntegrityBoundary(security, claim) {
+  const sec = _isObject(security) ? security : null;
+  const clm = _isObject(claim) ? claim : null;
+  const complete = !!sec && !!clm;
+
+  const securityMode = sec ? _upper(sec.mode) : null;
+  const claimMode = clm ? _upper(clm.decision_state) : null;
+  const securityEffectors = sec ? _number(sec.effectors) : null;
+  const claimEffectors = clm ? _number(clm.effectors_enabled) : null;
+  const externalMutations = sec ? _upper(sec.external_mutations) : null;
+
+  const secReceipt = sec && _isObject(sec.receipt) ? sec.receipt : null;
+  const signatureDefault = secReceipt ? _upper(secReceipt.signature_default) : null;
+  const claimMissing = clm && Array.isArray(clm.not_implemented_here)
+    ? clm.not_implemented_here.map(_upper) : [];
+  const signingAbsent = !!signatureDefault && signatureDefault.includes("UNSIGNED") &&
+    claimMissing.includes("SIGNING");
+
+  const proposalOnly = complete && securityMode === "PROPOSAL_ONLY" &&
+    claimMode === "PROPOSAL_ONLY";
+  const zeroEffectors = complete && securityEffectors === 0 && claimEffectors === 0;
+  const mutationsDisabled = complete && externalMutations === "DISABLED";
+
+  let verdict = "AWAITING-CONTRACTS";
+  if (complete) {
+    verdict = proposalOnly && zeroEffectors && mutationsDisabled
+      ? "BOUNDARIES-INTACT"
+      : "BOUNDARY-VIOLATION";
+  }
+
+  return {
+    complete,
+    securityMode,
+    claimMode,
+    securityEffectors,
+    claimEffectors,
+    externalMutations,
+    signing: signingAbsent ? "UNSIGNED" : (complete ? "UNKNOWN" : null),
+    proposalOnly,
+    zeroEffectors,
+    mutationsDisabled,
+    verdict,
+  };
+}
+
+function _derive() {
+  const d = deriveIntegrityBoundary(S.security, S.claim);
+  S.mode = d.proposalOnly ? "PROPOSAL_ONLY" :
+    (d.complete ? `${d.securityMode || "UNKNOWN"} / ${d.claimMode || "UNKNOWN"}` : null);
+  S.effectors = d.zeroEffectors ? 0 :
+    (d.complete ? `${d.securityEffectors ?? "?"} / ${d.claimEffectors ?? "?"}` : null);
+  S.signing = d.signing;
+  S.verdict = d.verdict;
+  _paint();
+}
+
+export function mount(ctx) {
+  _ctx = ctx;
+  _stage = ctx.stage;
+  _THREE = ctx.THREE;
+  _group = new _THREE.Group();
+  _stage.scene.add(_group);
+  _stage.camera.position.set(0, 5.5, 16);
+  try {
+    if (_stage.controls && _stage.controls.target) {
+      _stage.controls.target.set(0, 1.5, 0);
+      _stage.controls.update();
+    }
+  } catch (_) {}
+  try { _stage.setBloom(true); } catch (_) {}
+
+  _buildScene();
+  _buildOverlay();
+  if (!_frameRegistered) { _stage.onFrame(_onFrame); _frameRegistered = true; }
+
+  _polls.push(ctx.live.poll(SECURITY_EP, 10000, (j) => {
+    S.security = j;
+    _derive();
+  }, {
+    onState: (m) => {
+      S.fetch.security = m.state;
+      if (m.state !== "live" && m.state !== "degraded") S.security = null;
+      _derive();
+    },
+  }));
+  _polls.push(ctx.live.poll(CLAIM_EP, 10000, (j) => {
+    S.claim = j;
+    _derive();
+  }, {
+    onState: (m) => {
+      S.fetch.claim = m.state;
+      if (m.state !== "live" && m.state !== "degraded") S.claim = null;
+      _derive();
+    },
+  }));
+
+  _paint();
+  return { id: ID, started: true };
+}
+
+function _buildScene() {
+  const THREE = _THREE;
+  const grid = new THREE.GridHelper(32, 32, C_GRID, 0x0f2027);
+  grid.material.opacity = 0.15;
+  grid.material.transparent = true;
+  _group.add(grid);
+
+  _core = new THREE.Mesh(
+    new THREE.IcosahedronGeometry(1.15, 1),
+    new THREE.MeshStandardMaterial({
+      color: C_DIM, emissive: C_DIM, emissiveIntensity: 0.2,
+      transparent: true, opacity: 0.78, wireframe: true,
+    }),
+  );
+  _core.position.y = 1.6;
+  _group.add(_core);
+
+  _ring = new THREE.Mesh(
+    new THREE.TorusGeometry(4.25, 0.035, 8, 96),
+    new THREE.MeshBasicMaterial({ color: C_BLUE, transparent: true, opacity: 0.38 }),
+  );
+  _ring.rotation.x = Math.PI / 2;
+  _ring.position.y = 1.6;
+  _group.add(_ring);
+
+  // Six points mirror the manifest's proposal-state topology. They are structural nodes,
+  // never active deployers. No per-node text is rendered, keeping the scene uncluttered.
+  const count = 6;
+  for (let i = 0; i < count; i += 1) {
+    const a = (i / count) * Math.PI * 2;
+    const node = new THREE.Mesh(
+      new THREE.OctahedronGeometry(0.28, 0),
+      new THREE.MeshStandardMaterial({
+        color: C_BLUE, emissive: C_BLUE, emissiveIntensity: 0.2,
+        transparent: true, opacity: 0.8,
+      }),
+    );
+    node.position.set(Math.cos(a) * 4.25, 1.6, Math.sin(a) * 4.25);
+    _group.add(node);
+    _nodes.push(node);
+
+    const linkGeo = new THREE.BufferGeometry().setFromPoints([
+      new THREE.Vector3(0, 1.6, 0), node.position.clone(),
+    ]);
+    const link = new THREE.Line(linkGeo, new THREE.LineBasicMaterial({
+      color: C_GRID, transparent: true, opacity: 0.28,
+    }));
+    _group.add(link);
+    _links.push(link);
+  }
+}
+
+function _buildOverlay() {
+  _show = createShowcase(_ctx, {
+    id: ID,
+    title: TITLE,
+    accent: "#3af4c8",
+    chips: [
+      {
+        label: "STRUCTURAL-ONLY",
+        text: "read-only manifests",
+        name: "honesty",
+        title: "Contract structure read from two same-origin endpoints; not an operational effector.",
+      },
+    ],
+    description:
+      "A compact view of the <b>Waqay Security Loop</b> and <b>Claim Integrity</b> " +
+      "contracts. It reads two same-origin GET endpoints and checks their control boundaries " +
+      "without invoking a deploy, rollback, write, model, signer, or repository action. " +
+      "<b>LIVE</b> here can only mean a manifest fetch succeeded; it never means effectors are live.",
+    citations:
+      "SZL-native clean-room control plane · read-only contract manifests · " +
+      "no copied third-party interface, branding, or implementation.",
+    plain: {
+      label: "◑ boundary meaning",
+      html: () =>
+        "<b>What this means:</b> The system exposes the rules that a future security workflow " +
+        "would have to obey. Today it may produce proposals only. The reported effector count " +
+        "must be zero, external mutations must be disabled, and signatures remain unsigned " +
+        "unless a real signer and independent verification are added. A manifest is a contract, " +
+        "not proof that production automation exists.",
+    },
+  });
+
+  _boundaryPill = document.createElement("span");
+  _boundaryPill.setAttribute("data-integrity-boundary", "awaiting");
+  Object.assign(_boundaryPill.style, {
+    display: "inline-block", font: "600 10.5px ui-monospace,monospace",
+    letterSpacing: ".35px", padding: "2px 8px", borderRadius: "5px",
+    color: "#111820", background: "#e8c074", border: "1px solid rgba(255,255,255,.12)",
+  });
+  _show.pills.appendChild(_boundaryPill);
+
+  _show.addField("control state", "mode");
+  _show.addField("effectors (security / claim)", "effectors");
+  _show.addField("external mutations", "mutations");
+  _show.addField("signature boundary", "signing");
+  _show.addField("contract endpoints", "feeds");
+  _show.addField("allowed output", "output");
+}
+
+function _field(key, value, color) {
+  if (!_show) return;
+  const el = _show.field(key);
+  if (!el) return;
+  el.textContent = value;
+  if (color) el.style.color = color;
+}
+
+function _paint() {
+  if (!_show) return;
+  const d = deriveIntegrityBoundary(S.security, S.claim);
+  const fetched = [S.fetch.security, S.fetch.claim].filter((v) => v === "live").length;
+
+  let color = "#e8c074";
+  let bg = "#e8c074";
+  let text = "AWAITING CONTRACTS";
+  if (d.verdict === "BOUNDARIES-INTACT") {
+    color = "#3af4c8";
+    bg = "#3af4c8";
+    text = "READ-ONLY BOUNDARIES INTACT";
+  } else if (d.verdict === "BOUNDARY-VIOLATION") {
+    color = "#ff5964";
+    bg = "#ff5964";
+    text = "BOUNDARY VIOLATION";
+  }
+
+  if (_boundaryPill) {
+    _boundaryPill.dataset.integrityBoundary = d.verdict.toLowerCase();
+    _boundaryPill.textContent = text;
+    _boundaryPill.style.background = bg;
+  }
+  if (_core && _core.material) {
+    const hex = d.verdict === "BOUNDARIES-INTACT" ? C_TEAL :
+      (d.verdict === "BOUNDARY-VIOLATION" ? C_RED : C_AMBER);
+    _core.material.color.setHex(hex);
+    _core.material.emissive.setHex(hex);
+  }
+  _nodes.forEach((node) => {
+    const hex = d.verdict === "BOUNDARY-VIOLATION" ? C_RED :
+      (d.verdict === "BOUNDARIES-INTACT" ? C_TEAL : C_DIM);
+    node.material.color.setHex(hex);
+    node.material.emissive.setHex(hex);
+  });
+
+  _field("mode", d.complete ? (d.proposalOnly ? "PROPOSAL_ONLY" :
+    `${d.securityMode || "UNKNOWN"} / ${d.claimMode || "UNKNOWN"}`) : "NO-LIVE-DATA", color);
+  _field("effectors", d.complete ?
+    `${d.securityEffectors ?? "?"} / ${d.claimEffectors ?? "?"}` : "NO-LIVE-DATA",
+    d.zeroEffectors ? "#3af4c8" : color);
+  _field("mutations", d.complete ? (d.externalMutations || "UNKNOWN") : "NO-LIVE-DATA",
+    d.mutationsDisabled ? "#3af4c8" : color);
+  _field("signing", d.signing || "NO-LIVE-DATA", d.signing === "UNSIGNED" ? "#e8c074" : color);
+  _field("feeds", `${fetched}/2 fetched`, fetched === 2 ? "#3af4c8" : "#e8c074");
+  _field("output", d.proposalOnly ? "proposal only · no action" : "NO ACTION", "#9fb1bf");
+}
+
+function _onFrame() {
+  const t = performance.now();
+  if (_ring) _ring.rotation.z = t * 0.00008;
+  if (_core) {
+    _core.rotation.x = t * 0.00017;
+    _core.rotation.y = t * 0.00023;
+    _core.material.emissiveIntensity = 0.22 + 0.08 * (0.5 + 0.5 * Math.sin(t * 0.002));
+  }
+  _nodes.forEach((node, i) => {
+    node.rotation.x = t * 0.00028 + i;
+    node.rotation.y = t * 0.00019 + i;
+  });
+}
+
+export function unmount() {
+  _polls.forEach((p) => { try { p.stop(); } catch (_) {} });
+  _polls = [];
+  try { if (_show) _show.destroy(); } catch (_) {}
+  try {
+    if (_group && _stage) {
+      _group.traverse((o) => {
+        if (o.geometry && o.geometry.dispose) o.geometry.dispose();
+        if (o.material) {
+          const mats = Array.isArray(o.material) ? o.material : [o.material];
+          mats.forEach((m) => { if (m && m.dispose) m.dispose(); });
+        }
+      });
+      _stage.scene.remove(_group);
+    }
+  } catch (_) {}
+
+  _ctx = _stage = _THREE = _group = _show = _core = _ring = _boundaryPill = null;
+  _nodes = [];
+  _links = [];
+  _frameRegistered = false;
+  S.security = S.claim = null;
+  S.fetch.security = S.fetch.claim = "init";
+  S.mode = S.effectors = S.signing = null;
+  S.verdict = "AWAITING-CONTRACTS";
+}
+
+export default {
+  id: ID,
+  title: TITLE,
+  endpoints: [SECURITY_EP, CLAIM_EP],
+  mount,
+  unmount,
+};