release: ecosystem atlas, Anatomy v5, and canonical Spaces

Audited runtime-only CAS release from https://github.com/szl-holdings/a11oy/pull/950 at e0a398595f507c9a161736b361bd182e34ccdd1c. Preserves the newer HF README card; no delete operations.

.gitattributes

@@ -35,3 +35,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
 console/og-card.png filter=lfs diff=lfs merge=lfs -text
 model_release/m1/brain-ingest-ledger.jsonl filter=lfs diff=lfs merge=lfs -text
+console/social-preview-v5.png filter=lfs diff=lfs merge=lfs -text

.well-known/security.txt

@@ -1,8 +1,7 @@
 Contact: mailto:security@szlholdings.ai
 Expires: 2027-06-01T00:00:00.000Z
-Encryption: https://github.com/szl-holdings/a11oy/blob/main/docs/pgp-key.asc
 Preferred-Languages: en
-Canonical: https://szlholdings-a11oy.hf.space/.well-known/security.txt
+Canonical: https://a-11-oy.com/.well-known/security.txt
 Policy: https://github.com/szl-holdings/a11oy/blob/main/SECURITY.md
 Acknowledgments: https://github.com/szl-holdings/a11oy/blob/main/SECURITY.md#acknowledgments
 Hiring: https://szlholdings.ai/careers

Dockerfile

@@ -115,6 +115,9 @@ COPY packages/policy/src/gates /app/a11oy-src/packages/policy/src/gates
 # Copy the pre-built SPA (Brand Orchestration Layer) to the static root.
 # index.html + assets/* are served directly at / and /assets/*; unknown GET -> index.html.
 COPY console/ ./static/
+# Security discovery is maintained at repository root; copy it into the static
+# tree so /.well-known/security.txt resolves before the SPA fallback.
+COPY .well-known/security.txt ./static/.well-known/security.txt
 
 # Build cache-bust 2026-06-08T23:30Z (Wave23 instillation): knowledge.json was
 # … (full rationale: docs/DOCKERFILE_NOTES.md §4)
@@ -599,6 +602,11 @@ COPY a11oy_khipu_demo_nav.py ./a11oy_khipu_demo_nav.py
 COPY a11oy_quant_signals.py ./a11oy_quant_signals.py
 COPY a11oy_quant_signals_nav.py ./a11oy_quant_signals_nav.py
 
+# ECOSYSTEM ATLAS + ANATOMY V5 (2026-07-16): versioned public inventory API,
+# real deep-link pages, and the read-only live digital twin. pages/ is copied
+# wholesale above; this per-file image copies only the new Python registrar.
+COPY a11oy_ecosystem_atlas.py ./a11oy_ecosystem_atlas.py
+
 # git_sha wireup (FORGE-INSTRUCTION-gitsha-quiet-window): surface the deployed commit
 # … (full rationale: docs/DOCKERFILE_NOTES.md §96)
 ARG SZL_GIT_SHA=unknown

a11oy_ecosystem_atlas.py

@@ -0,0 +1,320 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""Public SZL ecosystem atlas for a-11-oy.com.
+
+The atlas reads the versioned public inventory published by
+``SZLHOLDINGS/szl-estate-live`` instead of repeatedly walking the Hugging Face
+listing APIs.  That keeps the browser same-origin, removes the live 429 failure
+mode, and makes every count explicitly LIVE, CACHED, SNAPSHOT, or UNAVAILABLE.
+
+This module never copies model weights or datasets into the application.  It
+publishes immutable Hub links, repository revisions, and bounded producer
+metadata so the web surface remains a control plane rather than an artifact
+store.
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+import threading
+import time
+import urllib.request
+from pathlib import Path
+from typing import Any
+
+INVENTORY_URL = (
+    "https://huggingface.co/spaces/SZLHOLDINGS/szl-estate-live/"
+    "resolve/main/public-inventory.json"
+)
+SNAPSHOT_OBSERVED_AT = "2026-07-16T15:27:32Z"
+SNAPSHOT_COUNTS = {
+    "models": 15,
+    "datasets": 24,
+    "spaces": 26,
+    "collections": 22,
+    "buckets": 1,
+    "public_resources_total": 88,
+}
+
+# Kernels are Hub model repositories with a governed-kernel contract, not
+# runnable foundation models.  Owners were validated in the 2026-07-16 source
+# alignment audit; archived owners remain labelled instead of being hidden.
+KERNEL_OWNERS: dict[str, dict[str, Any]] = {
+    "SZLHOLDINGS/governed-inference-meter": {"owner": "szl-holdings/szl-energy-attest"},
+    "SZLHOLDINGS/szl-blocked": {"owner": "szl-holdings/szl-formula-ledger"},
+    "SZLHOLDINGS/szl-formulas": {"owner": "szl-holdings/szl-formula-ledger"},
+    "SZLHOLDINGS/szl-governed-norm": {
+        "owner": "szl-holdings/szl-governed-norm",
+        "owner_state": "ARCHIVED_PRODUCER_NEEDS_ADOPTION",
+    },
+    "SZLHOLDINGS/szl-govsign": {"owner": "szl-holdings/szl-receipt"},
+    "SZLHOLDINGS/szl-invariants": {"owner": "szl-holdings/lutar-lean"},
+    "SZLHOLDINGS/szl-kernels": {"owner": "szl-holdings/szl-kernels-live"},
+    "SZLHOLDINGS/szl-lambda-gate": {"owner": "szl-holdings/szl-lambda-gate"},
+    "SZLHOLDINGS/szl-ouroboros": {"owner": "szl-holdings/ouroboros"},
+    "SZLHOLDINGS/szl-provctl": {"owner": "szl-holdings/governed-receipt-spec"},
+}
+
+CURATED_SURFACES: dict[str, list[dict[str, str]]] = {
+    "brain": [
+        {
+            "id": "SZLHOLDINGS/SZL-Khipu-1.5B-BrainNavigator",
+            "kind": "model",
+            "href": "https://huggingface.co/SZLHOLDINGS/SZL-Khipu-1.5B-BrainNavigator",
+            "owner": "szl-holdings/szl-forge",
+        },
+        {
+            "id": "SZLHOLDINGS/szl-second-brain-inrepo",
+            "kind": "dataset",
+            "href": "https://huggingface.co/datasets/SZLHOLDINGS/szl-second-brain-inrepo",
+            "owner": "szl-holdings/a11oy",
+        },
+        {
+            "id": "A11oy Brain pulse",
+            "kind": "runtime",
+            "href": "/api/a11oy/v1/brain/pulse",
+            "owner": "szl-holdings/a11oy",
+        },
+    ],
+    "anatomy": [
+        {
+            "id": "SZLHOLDINGS/anatomy",
+            "kind": "space",
+            "href": "https://huggingface.co/spaces/SZLHOLDINGS/anatomy",
+            "owner": "szl-holdings/anatomy",
+        },
+        {
+            "id": "Living anatomy",
+            "kind": "runtime",
+            "href": "/living-anatomy",
+            "owner": "szl-holdings/a11oy",
+        },
+    ],
+    "holographic": [
+        {
+            "id": f"SZLHOLDINGS/{name}",
+            "kind": "space",
+            "href": f"https://huggingface.co/spaces/SZLHOLDINGS/{name}",
+            "owner": "HF_NATIVE_ADOPTION_PENDING",
+        }
+        for name in (
+            "holographic",
+            "cosmos",
+            "cathedral",
+            "governed-norm-holo",
+            "lambda-gate-holo",
+            "energy-attest-holo",
+            "receipt-chain-live",
+            "szl-kernels-live",
+        )
+    ],
+    "killinchu": [
+        {
+            "id": "SZLHOLDINGS/killinchu",
+            "kind": "space",
+            "href": "https://huggingface.co/spaces/SZLHOLDINGS/killinchu",
+            "owner": "szl-holdings/killinchu",
+        },
+        {
+            "id": "SZLHOLDINGS/killinchu-osint-corpus",
+            "kind": "dataset",
+            "href": "https://huggingface.co/datasets/SZLHOLDINGS/killinchu-osint-corpus",
+            "owner": "szl-holdings/killinchu",
+        },
+        {
+            "id": "Killinchu command surface",
+            "kind": "runtime",
+            "href": "/elite",
+            "owner": "szl-holdings/killinchu",
+        },
+    ],
+}
+
+_CACHE_TTL_SECONDS = 300.0
+_CACHE: dict[str, Any] = {"at": 0.0, "payload": None}
+_LOCK = threading.Lock()
+_REFRESH_LOCK = threading.Lock()
+_PAGES_DIR = Path(__file__).resolve().parent / "pages"
+
+
+def _hub_href(kind: str, item_id: str) -> str:
+    if kind == "datasets":
+        return f"https://huggingface.co/datasets/{item_id}"
+    if kind == "spaces":
+        return f"https://huggingface.co/spaces/{item_id}"
+    if kind == "collections":
+        return f"https://huggingface.co/collections/{item_id}"
+    if kind == "buckets":
+        return f"https://huggingface.co/buckets/{item_id}"
+    return f"https://huggingface.co/{item_id}"
+
+
+def _resource_id(kind: str, item: dict[str, Any]) -> str:
+    if kind == "collections":
+        return str(item.get("slug") or item.get("id") or "")
+    return str(item.get("id") or "")
+
+
+def _project_resource(kind: str, item: dict[str, Any]) -> dict[str, Any]:
+    item_id = _resource_id(kind, item)
+    runtime = item.get("runtime") if isinstance(item.get("runtime"), dict) else {}
+    source = item.get("source_observation")
+    source_state = source.get("state") if isinstance(source, dict) else source
+    out: dict[str, Any] = {
+        "id": item_id,
+        "kind": kind[:-1] if kind.endswith("s") else kind,
+        "href": _hub_href(kind, item_id),
+        "revision": item.get("repository_sha") or item.get("head"),
+        "last_modified": item.get("last_modified") or item.get("last_updated"),
+        "license": item.get("license"),
+        "runtime_stage": runtime.get("stage"),
+        "source_state": source_state,
+    }
+    if item_id in KERNEL_OWNERS:
+        out.update(KERNEL_OWNERS[item_id])
+    return {key: value for key, value in out.items() if value is not None}
+
+
+def project_inventory(raw: dict[str, Any], state: str = "LIVE") -> dict[str, Any]:
+    resources = raw.get("resources") if isinstance(raw.get("resources"), dict) else {}
+    projected: dict[str, list[dict[str, Any]]] = {}
+    for kind in ("models", "datasets", "spaces", "collections", "buckets"):
+        rows = resources.get(kind) if isinstance(resources.get(kind), list) else []
+        projected[kind] = [_project_resource(kind, row) for row in rows if isinstance(row, dict)]
+
+    model_by_id = {row.get("id"): row for row in projected["models"]}
+    kernels = []
+    for item_id, ownership in KERNEL_OWNERS.items():
+        row = dict(model_by_id.get(item_id) or {
+            "id": item_id,
+            "kind": "kernel",
+            "href": _hub_href("models", item_id),
+        })
+        row["kind"] = "kernel"
+        row.update(ownership)
+        kernels.append(row)
+
+    counts = dict(SNAPSHOT_COUNTS)
+    raw_counts = raw.get("counts")
+    if isinstance(raw_counts, dict):
+        for key in counts:
+            value = raw_counts.get(key)
+            if isinstance(value, int):
+                counts[key] = value
+    counts["kernels"] = len(kernels)
+
+    observed_at = str(raw.get("observed_at") or SNAPSHOT_OBSERVED_AT)
+    return {
+        "schema": "szl.ecosystem-atlas/v1",
+        "state": state,
+        "observed_at": observed_at,
+        "inventory_source": INVENTORY_URL,
+        "counts": counts,
+        "resources": {**projected, "kernels": kernels},
+        "curated": CURATED_SURFACES,
+        "limits": {
+            "runtime_stage": "provider-reported reachability, not quality or freshness",
+            "source_mapping": "validated ownership where present; pending adoption remains labelled",
+            "models": "links immutable artifacts; no weights are copied into this application",
+        },
+    }
+
+
+def _fetch_inventory() -> dict[str, Any]:
+    request = urllib.request.Request(
+        INVENTORY_URL,
+        headers={"User-Agent": "a11oy-ecosystem-atlas/1.0", "Accept": "application/json"},
+    )
+    with urllib.request.urlopen(request, timeout=12) as response:
+        body = response.read(4 * 1024 * 1024)
+    parsed = json.loads(body.decode("utf-8"))
+    if not isinstance(parsed, dict) or not isinstance(parsed.get("resources"), dict):
+        raise ValueError("inventory payload is missing resources")
+    return parsed
+
+
+def atlas_payload() -> dict[str, Any]:
+    now = time.time()
+    with _LOCK:
+        cached = _CACHE.get("payload")
+        cached_at = float(_CACHE.get("at") or 0.0)
+        if isinstance(cached, dict) and now - cached_at < _CACHE_TTL_SECONDS:
+            return project_inventory(cached, state="CACHED")
+    # Coalesce cold/expired refreshes. The API executes this function in a worker
+    # thread, so a slow provider never blocks the ASGI event loop and only one
+    # outbound refresh is in flight for a process at a time.
+    with _REFRESH_LOCK:
+        now = time.time()
+        with _LOCK:
+            cached = _CACHE.get("payload")
+            cached_at = float(_CACHE.get("at") or 0.0)
+            if isinstance(cached, dict) and now - cached_at < _CACHE_TTL_SECONDS:
+                return project_inventory(cached, state="CACHED")
+        try:
+            live = _fetch_inventory()
+            with _LOCK:
+                _CACHE["payload"] = live
+                _CACHE["at"] = now
+            return project_inventory(live, state="LIVE")
+        except Exception as exc:
+            with _LOCK:
+                cached = _CACHE.get("payload")
+            if isinstance(cached, dict):
+                payload = project_inventory(cached, state="STALE_CACHE")
+                payload["degraded_reason"] = type(exc).__name__
+                return payload
+            return {
+                "schema": "szl.ecosystem-atlas/v1",
+                "state": "SNAPSHOT",
+                "observed_at": SNAPSHOT_OBSERVED_AT,
+                "inventory_source": INVENTORY_URL,
+                "counts": {**SNAPSHOT_COUNTS, "kernels": len(KERNEL_OWNERS)},
+                "resources": {key: [] for key in (
+                    "models", "datasets", "spaces", "collections", "buckets", "kernels"
+                )},
+                "curated": CURATED_SURFACES,
+                "degraded_reason": type(exc).__name__,
+                "limits": {
+                    "snapshot": "counts only; rows stay empty rather than fabricating stale listings",
+                },
+            }
+
+
+def register(app: Any, ns: str = "a11oy") -> str:
+    """Mount the atlas API and real deep-link pages ahead of SPA fallbacks."""
+    from fastapi.responses import FileResponse, JSONResponse
+    from starlette.routing import Route
+
+    atlas_page = _PAGES_DIR / "ecosystem.html"
+    anatomy_page = _PAGES_DIR / "anatomy-v5.html"
+
+    async def _api(request: Any = None) -> JSONResponse:
+        return JSONResponse(await asyncio.to_thread(atlas_payload))
+
+    async def _atlas_page(request: Any = None) -> Any:
+        if atlas_page.is_file():
+            return FileResponse(atlas_page, media_type="text/html")
+        return JSONResponse({"error": "ecosystem page unavailable"}, status_code=503)
+
+    async def _anatomy_page(request: Any = None) -> Any:
+        if anatomy_page.is_file():
+            return FileResponse(anatomy_page, media_type="text/html")
+        return JSONResponse({"error": "anatomy v5 page unavailable"}, status_code=503)
+
+    page_paths = (
+        "/ecosystem",
+        "/models",
+        "/kernels",
+        "/ecosystem/brain",
+        "/ecosystem/anatomy",
+        "/ecosystem/holographic",
+    )
+    routes = [Route(f"/api/{ns}/v1/ecosystem/atlas", _api, methods=["GET"])]
+    routes.extend(Route(path, _atlas_page, methods=["GET", "HEAD"]) for path in page_paths)
+    routes.append(Route("/anatomy-v5", _anatomy_page, methods=["GET", "HEAD"]))
+    app.router.routes[0:0] = routes
+    return f"ok: atlas API + {len(page_paths)} deep-link pages + Anatomy v5"
+
+
+if __name__ == "__main__":
+    print(json.dumps(atlas_payload(), indent=2))

a11oy_formula_endpoints.py

@@ -120,7 +120,13 @@ def register(app, ns: str = "a11oy") -> str:
 
     @app.get(f"/api/{ns}/v1/formulas/index")
     async def _formulas_index():
-        return JSONResponse({"wired": _INDEX, "count": len(_INDEX), "doctrine": "v11"})
+        return JSONResponse({
+            "state": "AVAILABLE",
+            "wired": _INDEX,
+            "count": len(_INDEX),
+            "doctrine": "v11",
+            "honesty": "Static runtime registry availability; not a live execution signal.",
+        })
 
     @app.get(f"/api/{ns}/v1/formulas/verify")
     async def _formulas_verify():

a11oy_grc.py

@@ -3,6 +3,7 @@
 """a11oy_grc.py — in-product GRC ALIGNMENT surface (Lane I5).
 
 Mounts a11oy's Governance / Compliance surface:
+  * GET /api/a11oy/v1/grc          — capability index + canonical endpoint links.
   * GET /api/a11oy/v1/grc/matrix   — honest ISO 42001 / NIST AI RMF / 800-53 / EU AI Act
                                      coverage matrix (COVERED / PARTIAL / ROADMAP / NA).
   * GET /api/a11oy/v1/grc/mapping  — 13 Λ axes → NIST AI RMF MEASURE 2 (+ Credo AI labels),
@@ -480,11 +481,16 @@ def register(app, ns: str = "a11oy") -> Dict[str, Any]:
     def _oscal():
         return JSONResponse(_merged_oscal())     # R5: base + Restraint OSCAL reqs
 
+    def _info():
+        return JSONResponse(info(ns))
+
     for prefix in (f"/api/{ns}/v1/grc", "/v1/grc"):
+        app.add_api_route(prefix, _info, methods=["GET"])
         app.add_api_route(f"{prefix}/matrix", _matrix, methods=["GET"])
         app.add_api_route(f"{prefix}/mapping", _mapping, methods=["GET"])
         app.add_api_route(f"{prefix}/oscal", _oscal, methods=["GET"])
-        app.add_api_route(f"{prefix}/info", lambda: JSONResponse(info(ns)), methods=["GET"])
+        app.add_api_route(f"{prefix}/info", _info, methods=["GET"])
+        registered.append(f"GET {prefix}")
         registered.append(f"GET {prefix}/matrix")
 
     _html = _page_html(ns)
@@ -522,9 +528,9 @@ def _selftest() -> None:
                 '</body></html>')
 
     c = TestClient(app)
-    for ep in ["/api/a11oy/v1/grc/matrix", "/api/a11oy/v1/grc/mapping",
+    for ep in ["/api/a11oy/v1/grc", "/api/a11oy/v1/grc/matrix", "/api/a11oy/v1/grc/mapping",
                "/api/a11oy/v1/grc/oscal", "/api/a11oy/v1/grc/info",
-               "/v1/grc/matrix", "/grc", "/compliance"]:
+               "/v1/grc", "/v1/grc/matrix", "/grc", "/compliance"]:
         r = c.get(ep)
         assert r.status_code == 200, (ep, r.status_code)
     # honesty checks on the page

a11oy_landing.html

@@ -11,7 +11,8 @@
   The genome registry (144 entries) is grouped into 4 honesty tiers — a different, larger set.
   Receipts are signed on write, never on GET. Every claim deep-links a live surface to check.
   DOM/sections owned by Dev 1; the #hero-canvas + /landing/app.js boot is owned by Dev 2 —
-  preserved verbatim below. KANCHAY palette. No purple. No a11oy.net (sunset domain).
+  preserved verbatim below. KANCHAY palette. No purple. a-11-oy.com remains the
+  canonical governed-inference product; a11oy.net is a separately attested estate cockpit.
   © Stephen P. Lutar Jr. (ORCID 0009-0001-0110-4173) · Apache-2.0
 -->
 <html lang="en">
@@ -20,7 +21,38 @@
 <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
 <title>a11oy — Governed Inference · AI that signs its work and refuses to lie</title>
 <meta name="description" content="Governed Inference: AI that signs its work and refuses to lie. Every answer arrives with a signed receipt you can verify yourself — offline, in your own browser. When the model is not sure, it refuses rather than guesses. 8 Lean-proven theorems back the kernel; a 144-entry genome is graded across 4 honest tiers." />
-<link rel="icon" href="/social-preview.svg" />
+<link rel="canonical" href="https://a-11-oy.com/" />
+<meta property="og:type" content="website" />
+<meta property="og:url" content="https://a-11-oy.com/" />
+<meta property="og:title" content="a11oy — Governed Inference" />
+<meta property="og:description" content="AI that signs its work, exposes its evidence, and refuses when it cannot support an answer." />
+<meta property="og:image" content="https://a-11-oy.com/social-preview-v5.png" />
+<meta property="og:image:type" content="image/png" />
+<meta property="og:image:width" content="1280" />
+<meta property="og:image:height" content="640" />
+<meta property="og:image:alt" content="a11oy Governed Inference — evidence-labelled ecosystem and Anatomy v5" />
+<meta name="twitter:card" content="summary_large_image" />
+<meta name="twitter:image" content="https://a-11-oy.com/social-preview-v5.png" />
+<meta name="twitter:image:alt" content="a11oy Governed Inference — evidence-labelled ecosystem and Anatomy v5" />
+<link rel="icon" type="image/svg+xml" href="/social-preview-v5.svg" />
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "SoftwareApplication",
+  "name": "a11oy Governed Inference",
+  "url": "https://a-11-oy.com/",
+  "applicationCategory": "DeveloperApplication",
+  "operatingSystem": "Web",
+  "creator": {
+    "@type": "Organization",
+    "name": "SZL Holdings",
+    "sameAs": [
+      "https://github.com/szl-holdings",
+      "https://huggingface.co/SZLHOLDINGS"
+    ]
+  }
+}
+</script>
 <style>
   /* ---- vendored fonts (0 CDN; served from /vendor/fonts/*.woff2 by serve.py) ---- */
   @font-face{font-family:'Space Grotesk';font-style:normal;font-weight:300 700;
@@ -279,6 +311,16 @@
   .muted{color:var(--ghost)}
   .skel{color:var(--ghost);font-family:var(--mono)}
 
+  /* ecosystem atlas — public estate snapshot, never implied live until API reads */
+  .estate-grid{display:grid;grid-template-columns:repeat(6,1fr);gap:10px;margin:24px 0}
+  .estate-cell{border:1px solid var(--border);border-radius:13px;padding:15px;
+    background:linear-gradient(155deg,rgba(17,30,50,.72),rgba(8,16,29,.88))}
+  .estate-cell b{display:block;color:var(--proof);font:600 1.45rem var(--mono);margin-bottom:4px}
+  .estate-cell span{color:var(--ghost);font:10px var(--mono);letter-spacing:.08em;text-transform:uppercase}
+  .estate-links{display:flex;gap:9px;flex-wrap:wrap;margin-top:18px}
+  @media(max-width:900px){.estate-grid{grid-template-columns:repeat(3,1fr)}}
+  @media(max-width:520px){.estate-grid{grid-template-columns:repeat(2,1fr)}}
+
   /* ---- honesty strip (MEASURED/REPORTED/UNKNOWN/CONJECTURE) ---- */
   .honesty{border-top:1px solid var(--border);border-bottom:1px solid var(--border);
     background:linear-gradient(180deg,rgba(10,16,30,0.6),rgba(10,16,30,0.22))}
@@ -310,6 +352,7 @@
   .data-state{display:inline-flex;align-items:center;border-radius:999px;padding:3px 8px;border:1px solid var(--border);
     color:var(--ghost);font:10px var(--mono);letter-spacing:.06em;white-space:nowrap}
   .data-state.live{color:var(--proof);border-color:rgba(58,244,200,.35);background:var(--proof-dim)}
+  .data-state.amber{color:var(--gold);border-color:rgba(215,185,107,.4);background:rgba(215,185,107,.08)}
   .data-state.down{color:var(--down);border-color:rgba(232,116,110,.38);background:rgba(232,116,110,.07)}
   .pulse-time{margin-top:14px;color:var(--ghost);font:11px var(--mono)}
   @media(max-width:900px){.pulse-grid{grid-template-columns:repeat(2,1fr)}}
@@ -334,6 +377,8 @@
     </a>
     <nav>
       <a class="hide-sm" href="#surfaces">Surfaces</a>
+      <a class="hide-sm" href="/ecosystem">Ecosystem</a>
+      <a class="hide-sm" href="/anatomy-v5">Anatomy v5</a>
       <a class="hide-sm" href="#proof">The proof</a>
       <a class="hide-sm" href="#honesty">Honesty</a>
       <a class="hide-sm" href="/console#arena">Eval arena</a>
@@ -359,6 +404,7 @@
         sure, it returns an honest <b>BLOCKED</b> instead of a confident guess.</p>
       <div class="cta-row">
         <a class="btn btn-primary" href="/console">Open the command center →</a>
+        <a class="btn btn-lattice" href="/ecosystem">Explore the ecosystem</a>
         <a class="btn btn-ghost" href="/verify">Verify a receipt offline</a>
       </div>
       <div class="hero-stats">
@@ -575,7 +621,7 @@
   <div class="body-embed" id="body-embed">
     <div class="poster" id="body-poster">
       <div class="pulse-ring" aria-hidden="true"></div>
-      <h3>The Living Brain &amp; Body</h3>
+      <h3>The Living Brain &amp; Body · Anatomy v5</h3>
       <p>Two live 3D views of the same governed organism: a <b>moldable brain</b> whose eight lobes
         are wired to live public reads (Hub assets, GitHub repos, proved theorems, organ vitals,
         the harnessed open-weights frontier) &mdash; sculpt its cortex with your pointer &mdash;
@@ -583,12 +629,39 @@
       <div class="cta-row" style="justify-content:center">
         <button class="btn btn-lattice" id="brain-load" type="button">🧠 Mold the brain in-frame</button>
         <button class="btn btn-ghost" id="body-load" type="button">Load the living body</button>
+        <a class="btn btn-primary" href="/anatomy-v5">Open the live digital twin →</a>
         <a class="btn btn-ghost" href="/living-anatomy" target="_blank" rel="noopener">Open full-screen →</a>
       </div>
     </div>
   </div>
 </section>
 
+<!-- ====================== PUBLIC ECOSYSTEM ATLAS ====================== -->
+<section class="band" id="ecosystem">
+  <div class="wrap">
+    <p class="kick">Public estate · snapshot observed 2026-07-16</p>
+    <h2>Models, kernels, data, and Spaces — one evidence-labelled map.</h2>
+    <p class="sub" style="max-width:790px">The atlas joins Hugging Face artifacts to their GitHub producers without pretending that a reachable URL proves alignment. Counts below are the dated public inventory snapshot; the atlas API upgrades them to LIVE or CACHED when its versioned source answers.</p>
+    <div class="estate-grid" aria-label="Public ecosystem snapshot counts">
+      <div class="estate-cell"><b>15</b><span>Models</span></div>
+      <div class="estate-cell"><b>10</b><span>Governed kernels</span></div>
+      <div class="estate-cell"><b>24</b><span>Datasets</span></div>
+      <div class="estate-cell"><b>26</b><span>Spaces</span></div>
+      <div class="estate-cell"><b>22</b><span>Collections</span></div>
+      <div class="estate-cell"><b>1</b><span>Public bucket</span></div>
+    </div>
+    <div class="estate-links">
+      <a class="btn btn-primary" href="/ecosystem">Open ecosystem atlas →</a>
+      <a class="btn btn-lattice" href="/anatomy-v5">Open Anatomy v5</a>
+      <a class="btn btn-ghost" href="/models">Models</a>
+      <a class="btn btn-ghost" href="/kernels">Kernels</a>
+      <a class="btn btn-ghost" href="/ecosystem/brain">Brain</a>
+      <a class="btn btn-ghost" href="/ecosystem/holographic">Holographic</a>
+      <a class="btn btn-ghost" href="/spaces">All Spaces</a>
+    </div>
+  </div>
+</section>
+
 <!-- ====================== (6) ONE CHAIN — live receipts/ledger ====================== -->
 <section class="band" id="chain" style="background:linear-gradient(180deg,rgba(10,16,30,0),rgba(10,16,30,0.55))">
   <div class="wrap">
@@ -645,6 +718,8 @@
       </div>
       <div class="lk"><strong style="color:var(--ink)">Product</strong>
         <a href="/console">Command center</a>
+        <a href="/ecosystem">Ecosystem atlas</a>
+        <a href="/anatomy-v5">Anatomy v5 · digital twin</a>
         <a href="/console#genome">Genome registry</a>
         <a href="/verify">Verify a receipt</a>
         <a href="/living-anatomy">Living anatomy · 3D</a>
@@ -829,7 +904,8 @@
   function pulseState(key, state, detail){
     const chip = $("pulse-"+key+"-state");
     const body = $("pulse-"+key+"-detail");
-    if(chip){ chip.textContent = state; chip.className = "data-state "+((state === "LIVE" || state === "REACHABLE") ? "live" : "down"); }
+    const amberStates = new Set(["CACHED","STALE_CACHE","SNAPSHOT","MODELED","OBSERVED","AVAILABLE","DEGRADED"]);
+    if(chip){ chip.textContent = state; chip.className = "data-state "+((state === "LIVE" || state === "REACHABLE") ? "live" : (amberStates.has(state) ? "amber" : "down")); }
     if(body) body.textContent = detail;
   }
   async function pulseJSON(url){
@@ -847,8 +923,9 @@
         .catch(() => pulseState("health", "UNAVAILABLE", "Runtime health did not answer this session.")),
       pulseJSON("/api/a11oy/v1/readiness/tab-matrix?view=summary").then(d => {
         const s = d.summary && d.summary.summary || {};
-        if(!d.available) throw new Error("matrix unavailable");
-        pulseState("contract", "REACHABLE", (s.tabs || "Published")+" tabs · "+(s.endpoints || "declared")+" endpoint contracts · SNAPSHOT.");
+        if(!d.matrix_available) throw new Error("matrix unavailable");
+        const checked = Boolean(d.probe_verdict_available);
+        pulseState("contract", checked ? "REACHABLE" : "SNAPSHOT", (s.tabs || "Published")+" tabs · "+(s.endpoints || "declared")+" endpoint contracts · "+(checked ? "deployment probe attached." : "static contract; deployment probe pending."));
       }).catch(() => pulseState("contract", "UNAVAILABLE", "Tab contract is not bundled with this deployment.")),
       pulseJSON("/api/a11oy/v1/ledger").then(d => pulseState("ledger", "REACHABLE", (typeof d.count === "number" ? d.count : "Current")+" receipts returned by the read; verify timestamp and chain state in the source."))
         .catch(() => pulseState("ledger", "UNAVAILABLE", "Receipt ledger did not answer this session.")),

console/robots.txt

@@ -0,0 +1,4 @@
+User-agent: *
+Allow: /
+
+Sitemap: https://a-11-oy.com/sitemap.xml

console/sitemap.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+  <url><loc>https://a-11-oy.com/</loc></url>
+  <url><loc>https://a-11-oy.com/ecosystem</loc></url>
+  <url><loc>https://a-11-oy.com/anatomy-v5</loc></url>
+  <url><loc>https://a-11-oy.com/models</loc></url>
+  <url><loc>https://a-11-oy.com/kernels</loc></url>
+  <url><loc>https://a-11-oy.com/ecosystem/brain</loc></url>
+  <url><loc>https://a-11-oy.com/ecosystem/anatomy</loc></url>
+  <url><loc>https://a-11-oy.com/ecosystem/holographic</loc></url>
+  <url><loc>https://a-11-oy.com/spaces</loc></url>
+  <url><loc>https://a-11-oy.com/formulas</loc></url>
+  <url><loc>https://a-11-oy.com/console</loc></url>
+  <url><loc>https://a-11-oy.com/trust</loc></url>
+  <url><loc>https://a-11-oy.com/verify</loc></url>
+  <url><loc>https://a-11-oy.com/observability</loc></url>
+  <url><loc>https://a-11-oy.com/living-anatomy</loc></url>
+  <url><loc>https://a-11-oy.com/elite</loc></url>
+</urlset>

console/static/viz/router/app.js

@@ -205,8 +205,10 @@ function graphStats(){
 }
 
 function normalizeStats(payload){
-  if(!payload || typeof payload !== 'object' || payload.mode !== 'live' || !Array.isArray(payload.routes)){
-    throw new Error('router stats envelope is not a live route array');
+  if(!payload || typeof payload !== 'object' || payload.state !== 'MODELED' ||
+     payload.mode !== 'modeled' || payload.throughput_state !== 'MODELED' ||
+     !Array.isArray(payload.routes)){
+    throw new Error('router stats envelope is not an explicitly modeled route array');
   }
   const routes = payload.routes.map(route=>({
     organ:String(route?.organ ?? ''), tier:String(route?.tier ?? ''), model:String(route?.model ?? ''),
@@ -221,7 +223,8 @@ function normalizeStats(payload){
   const routeTotal = routes.reduce((sum,route)=>sum+route.throughput,0);
   if(Math.abs(routeTotal-Number(payload.servedThisWindow)) > 0.001) throw new Error('router stats signal does not equal route total');
   return {
-    mode:'endpoint', source:String(payload.source || 'unlabelled endpoint source'), routes,
+    mode:'endpoint', state:'MODELED', source:String(payload.source || 'unlabelled endpoint source'),
+    catalogState:String(payload.catalog_state || 'UNKNOWN'), throughputState:'MODELED', routes,
     servedThisWindow:Number(payload.servedThisWindow), honesty:String(payload.honesty || '')
   };
 }
@@ -237,7 +240,7 @@ function renderRouteFeed(stats,state){
     title.textContent = `${route.tier} · ${route.organ} → ${route.model}`;
     const detail = document.createElement('span');
     detail.textContent = state === 'responding'
-      ? `${Math.round(route.throughput)} catalog pulse · ${route.license}`
+      ? `${Math.round(route.throughput)} modeled load · ${route.license}`
       : `${Math.round(route.throughput)} modeled load · ${route.license}${route.task ? ` · ${route.task}` : ''}`;
     item.append(title,detail); feed.append(item);
   }
@@ -252,9 +255,9 @@ function setOperationalState(stats,state,detail){
   const signalLabel = document.getElementById('signalLabel');
   document.getElementById('signalValue').textContent = String(Math.round(stats.servedThisWindow));
   if(state === 'responding'){
-    pill.textContent = 'CATALOG ENDPOINT · RESPONDING'; pill.className = 'pill responding';
-    signalLabel.textContent = 'catalog pulse · not QPS';
-    source.textContent = `Validated response · ${stats.source}`;
+    pill.textContent = 'MODELED ENDPOINT · RESPONDING'; pill.className = 'pill modeled';
+    signalLabel.textContent = 'modeled load · not QPS';
+    source.textContent = `Validated response · catalog ${stats.catalogState} · ${stats.source}`;
     routeMode.textContent = stats.honesty || 'Endpoint-derived catalog signal; not production traffic.';
   }else if(state === 'degraded'){
     pill.textContent = 'DEGRADED · MODELED FALLBACK'; pill.className = 'pill degraded';

console/static/viz/router/index.html

@@ -37,6 +37,7 @@
 <div id="hud">
   <header>
     <span class="brand">LLM&nbsp;GRAPH-ROUTER</span>
+    <nav class="global-links" aria-label="a11oy navigation"><a href="/">Home</a><a href="/ecosystem">Ecosystem</a><a href="/anatomy-v5">Anatomy v5</a><a href="/console">Console</a></nav>
     <span id="livePill" class="pill pending">CHECKING ENDPOINT</span>
     <span id="renderPill" class="pill">RENDER INIT</span>
     <label class="sov"><input type="checkbox" id="sov"/> Sovereign mode <small>(GREEN-only)</small></label>

console/static/viz/router/style.css

@@ -44,6 +44,9 @@ body.scene-unavailable .fallback-kicker{color:var(--hatun-400)}
 #hud header{grid-column:1/-1;display:flex;gap:10px;align-items:center;flex-wrap:wrap;pointer-events:auto}
 .brand{font:750 13px var(--mono);letter-spacing:.16em;padding:7px 13px;border-left:3px solid var(--yuyay-400);border-radius:3px;
   background:linear-gradient(90deg,rgba(24,48,71,.96),rgba(13,31,49,.38));text-shadow:0 0 18px rgba(58,244,200,.45)}
+.global-links{display:flex;gap:4px;align-items:center;flex-wrap:wrap}
+.global-links a{padding:6px 8px;border:1px solid rgba(102,149,181,.38);border-radius:7px;background:rgba(7,20,34,.78);color:var(--text-sub);font:700 9px var(--mono);text-decoration:none}
+.global-links a:hover,.global-links a:focus-visible{color:var(--yuyay-300);border-color:var(--yuyay-400)}
 .pill{font:700 10px var(--mono);letter-spacing:.04em;padding:5px 9px;border-radius:999px;border:1px solid var(--border);background:rgba(16,32,50,.93);color:var(--text-sub)}
 .pill.responding{color:#03150d;background:var(--green);border-color:#6affab;box-shadow:0 0 24px rgba(56,223,130,.25)}
 .pill.modeled{color:#241900;background:var(--hatun-400);border-color:#ffe5a4;box-shadow:0 0 24px rgba(255,211,106,.18)}
@@ -113,6 +116,7 @@ body.scene-ready .label-layer{opacity:1}
 @media(max-width:680px){
   #hud{padding:9px;gap:7px;grid-template-columns:1fr 1fr;grid-template-rows:auto 1fr auto auto}
   #hud header{gap:6px}.brand{font-size:10px;padding:6px 8px}.pill{font-size:8px;padding:4px 6px}.sov{font-size:9px}.sov small{display:none}
+  .global-links a{font-size:8px;padding:4px 5px}.global-links a:nth-child(3){display:none}
   .telemetry{width:min(190px,48vw);padding:10px;align-self:start;margin-top:8px}.panel .row b{font-size:16px}.panel .row small{font-size:8px}
   .source-state,.freshness-state{font-size:8px}.panel .legend{gap:6px;font-size:8px}
   .route-panel{width:min(210px,49vw);padding:10px;align-self:start;margin-top:8px;max-height:42vh}.route-feed{max-height:31vh}.route-feed li{padding:6px 6px 6px 10px}.route-feed strong{font-size:9px}.route-feed span{font-size:8px}

pages/anatomy-v5.html

@@ -0,0 +1,195 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>Anatomy v5 | a11oy evidence-labelled digital twin</title>
+  <meta name="description" content="An evidence-labelled digital twin of the SZL estate: organism health, inference routing, Brain pulse, formula genome, and Space reachability.">
+  <link rel="canonical" href="https://a-11-oy.com/anatomy-v5">
+  <meta property="og:title" content="Anatomy v5 | a11oy">
+  <meta property="og:description" content="See the estate as one governed organism without hiding unavailable signals.">
+  <style>
+    :root{--bg:#050b0a;--panel:#091512;--panel2:#0d1d19;--line:rgba(58,244,200,.16);--ink:#edf9f5;--muted:#89a39c;--teal:#3af4c8;--blue:#6c9cff;--amber:#d9bc75;--red:#ec827e;--mono:ui-monospace,SFMono-Regular,Consolas,monospace;--sans:Inter,ui-sans-serif,system-ui,sans-serif}
+    *{box-sizing:border-box}html{scroll-behavior:smooth}body{margin:0;background:radial-gradient(circle at 50% -20%,rgba(45,137,115,.2),transparent 38%),linear-gradient(180deg,#06100e,var(--bg));color:var(--ink);font-family:var(--sans)}a{color:inherit;text-decoration:none}a,button{touch-action:manipulation}a:focus-visible,button:focus-visible,input:focus-visible{outline:2px solid var(--teal);outline-offset:3px}.skip{position:fixed;left:12px;top:8px;z-index:100;transform:translateY(-160%);border-radius:8px;background:var(--teal);color:#03100c;padding:10px 13px;font:12px var(--mono)}.skip:focus{transform:none}.wrap{width:min(1220px,calc(100% - 32px));margin:auto}.mono{font-family:var(--mono)}
+    header{position:sticky;top:0;z-index:30;border-bottom:1px solid var(--line);background:rgba(5,11,10,.88);backdrop-filter:blur(18px)}header .wrap{min-height:66px;display:flex;align-items:center;gap:18px}.brand{display:flex;align-items:center;gap:10px;font-weight:750}.mark{width:30px;height:30px;display:grid;place-items:center;border:1px solid var(--teal);border-radius:50%;color:var(--teal);box-shadow:0 0 24px rgba(58,244,200,.2)}nav{display:flex;gap:7px;align-items:center;margin-left:auto;flex-wrap:wrap}nav a{min-height:44px;display:inline-flex;align-items:center;font:11px var(--mono);color:var(--muted);padding:9px 11px;border-radius:9px}nav a:hover{background:rgba(58,244,200,.07);color:var(--ink)}nav .primary{border:1px solid rgba(58,244,200,.35);color:var(--teal)}
+    .hero{padding:64px 0 30px}.eyebrow{font:11px var(--mono);letter-spacing:.16em;color:var(--teal);text-transform:uppercase}.hero h1{font-size:clamp(2.7rem,7vw,6.4rem);line-height:.9;letter-spacing:-.06em;margin:18px 0}.hero h1 span{color:transparent;background:linear-gradient(90deg,var(--teal),var(--blue));background-clip:text}.hero p{max-width:820px;margin:0;color:var(--muted);font-size:1.08rem;line-height:1.7}.badges{display:flex;gap:8px;flex-wrap:wrap;margin-top:23px}.badge{border:1px solid var(--line);border-radius:999px;padding:7px 10px;color:var(--muted);font:10px var(--mono);overflow-wrap:anywhere}.badges a.badge{min-height:44px;display:inline-flex;align-items:center}.badge.live{border-color:rgba(58,244,200,.42);color:var(--teal)}.badge.cached,.badge.stalecache,.badge.snapshot,.badge.modeled,.badge.observed,.badge.available,.badge.degraded{border-color:rgba(217,188,117,.4);color:var(--amber)}.badge.unavailable,.badge.error{border-color:rgba(236,130,126,.4);color:var(--red)}
+    .vitals{display:grid;grid-template-columns:repeat(6,1fr);gap:10px;margin:20px 0 34px}.vital{min-height:104px;border:1px solid var(--line);border-radius:14px;padding:15px;background:linear-gradient(150deg,rgba(13,29,25,.94),rgba(7,15,13,.96))}.vital b{display:block;margin-bottom:7px;color:var(--teal);font:650 1.45rem var(--mono);overflow-wrap:anywhere}.vital span{color:var(--muted);font:10px var(--mono);text-transform:uppercase;letter-spacing:.08em}.vital small{display:block;margin-top:8px;color:#667e77;font:9px var(--mono)}
+    .tabs{position:sticky;top:67px;z-index:20;display:flex;gap:7px;overflow:auto;overscroll-behavior-inline:contain;scrollbar-width:thin;padding:12px 0;background:linear-gradient(180deg,rgba(5,11,10,.97),rgba(5,11,10,.83),transparent)}.tab{min-height:44px;border:1px solid var(--line);border-radius:999px;background:var(--panel);color:var(--muted);padding:9px 13px;white-space:nowrap;cursor:pointer;font:11px var(--mono)}.tab.active,.tab:hover{color:#03100c;background:var(--teal);border-color:var(--teal)}
+    .view{display:none;padding:15px 0 72px}.view.active{display:block}.section-head{display:flex;justify-content:space-between;align-items:end;gap:18px;margin:16px 0 20px}.section-head h2{font-size:clamp(1.7rem,4vw,3rem);letter-spacing:-.04em;margin:0}.section-head p{max-width:610px;color:var(--muted);line-height:1.6;margin:0}.panel{border:1px solid var(--line);border-radius:16px;background:linear-gradient(150deg,rgba(13,29,25,.93),rgba(6,13,11,.98));padding:20px}
+    .organism{display:grid;grid-template-columns:minmax(0,1.15fr) minmax(300px,.85fr);gap:14px}.organism>*,.nervous-grid>*,.formula>*{min-width:0}.body{position:relative;min-height:570px;overflow:hidden}.body:before{content:"";position:absolute;inset:7% 15%;border:1px solid rgba(58,244,200,.12);border-radius:45% 45% 32% 32%;box-shadow:inset 0 0 90px rgba(58,244,200,.035)}.spine{position:absolute;top:16%;bottom:14%;left:50%;width:1px;background:linear-gradient(transparent,var(--teal),transparent);opacity:.45}.nerve{position:absolute;height:1px;background:linear-gradient(90deg,transparent,rgba(108,156,255,.48),transparent);transform-origin:left center}.organ{position:absolute;width:142px;min-height:82px;padding:12px;border:1px solid var(--line);border-radius:13px;background:rgba(8,19,16,.94);box-shadow:0 0 30px rgba(58,244,200,.035)}.organ b{display:block;font-size:13px}.organ small{display:block;margin-top:5px;color:var(--muted);font:9px var(--mono);line-height:1.4}.organ .dot{position:absolute;right:10px;top:10px;width:7px;height:7px;border-radius:50%;background:var(--red)}.organ.live .dot{background:var(--teal);box-shadow:0 0 10px var(--teal)}.organ.cached .dot,.organ.stalecache .dot,.organ.snapshot .dot,.organ.modeled .dot,.organ.observed .dot,.organ.available .dot,.organ.degraded .dot{background:var(--amber)}.brain{left:calc(50% - 71px);top:5%}.router{left:calc(50% - 71px);top:26%}.models{left:5%;top:26%}.kernels{right:5%;top:26%}.data{left:5%;top:53%}.spaces{right:5%;top:53%}.formulas{left:calc(50% - 71px);top:73%}.receipts{left:calc(50% - 71px);top:48%}.readout{display:grid;gap:10px}.readout article{min-width:0;border:1px solid var(--line);border-radius:13px;padding:15px;background:rgba(8,18,15,.7)}.readout h3{font-size:13px;margin:0 0 9px}.readout pre{margin:0;white-space:pre-wrap;overflow-wrap:anywhere;color:var(--muted);font:10px/1.55 var(--mono);max-height:165px;overflow:auto}.source{display:flex;justify-content:space-between;flex-wrap:wrap;gap:6px 12px;margin-top:10px;color:#668078;font:9px var(--mono)}.source span{min-width:0;overflow-wrap:anywhere}
+    .nervous-grid{display:grid;grid-template-columns:1.15fr .85fr;gap:14px}.route-list,.formula-list{display:grid;gap:8px}.route{display:grid;grid-template-columns:minmax(130px,1fr) repeat(3,minmax(78px,.45fr));gap:10px;align-items:center;border:1px solid var(--line);border-radius:11px;padding:12px;background:rgba(6,14,12,.72);font:10px var(--mono)}.route strong{font:600 12px var(--sans);overflow-wrap:anywhere}.route span{color:var(--muted);overflow-wrap:anywhere}.route .signal.live{color:var(--teal)}.route .signal.cached,.route .signal.stalecache,.route .signal.snapshot,.route .signal.modeled,.route .signal.observed,.route .signal.available,.route .signal.degraded{color:var(--amber)}.route .signal.unavailable,.route .signal.error{color:var(--red)}.json{margin:0;max-height:570px;overflow:auto;white-space:pre-wrap;overflow-wrap:anywhere;color:#9bb3ad;font:10px/1.55 var(--mono)}
+    .formula-tools{display:flex;gap:10px;align-items:center;flex-wrap:wrap;margin-bottom:14px}.formula-tools input{flex:1;min-width:180px;border:1px solid var(--line);border-radius:10px;background:#07110f;color:var(--ink);padding:11px 13px;font:11px var(--mono)}.formula-tools .badge{max-width:100%}.formula{display:grid;grid-template-columns:minmax(130px,.7fr) minmax(160px,1fr) 2fr;gap:12px;border:1px solid var(--line);border-radius:12px;padding:14px;background:rgba(7,16,14,.75)}.formula b{font-size:13px}.formula .tier{color:var(--blue);font:10px var(--mono);text-transform:uppercase}.formula p{margin:0;color:var(--muted);font:10px/1.55 var(--mono);overflow-wrap:anywhere}.empty{border:1px dashed var(--line);border-radius:13px;padding:26px;text-align:center;color:var(--muted)}
+    footer{border-top:1px solid var(--line);padding:34px 0 48px;color:var(--muted);font-size:12px;line-height:1.65}footer .wrap{display:flex;justify-content:space-between;gap:30px;flex-wrap:wrap}footer a{color:var(--teal)}
+    @media(max-width:960px){.vitals{grid-template-columns:repeat(3,minmax(0,1fr))}.organism,.nervous-grid{grid-template-columns:1fr}.body{min-height:540px}.route{grid-template-columns:1fr 1fr}.formula{grid-template-columns:1fr}}
+    @media(max-width:800px){.brand small{display:none}}
+    @media(max-width:680px){header{position:static}header .wrap{flex-wrap:wrap;padding:11px 0 8px}nav{width:100%;margin-left:0;flex-wrap:nowrap;overflow-x:auto;overscroll-behavior-inline:contain;scrollbar-width:thin}nav a{flex:0 0 auto}.tabs{top:0}}
+    @media(max-width:620px){.hero{padding-top:44px}.vitals{grid-template-columns:repeat(2,minmax(0,1fr))}.panel{padding:16px}.body{min-height:690px}.body:before{inset:5% 4%}.organ{width:126px}.brain{left:calc(50% - 63px)}.router{left:calc(50% - 63px);top:22%}.models{left:2%;top:39%}.kernels{right:2%;top:39%}.receipts{left:calc(50% - 63px);top:54%}.data{left:2%;top:69%}.spaces{right:2%;top:69%}.formulas{left:calc(50% - 63px);top:84%}.route{grid-template-columns:1fr}.section-head{align-items:start;flex-direction:column}.formula-tools{align-items:stretch;flex-direction:column}.formula-tools input{min-width:0;width:100%}}
+  </style>
+</head>
+<body>
+  <a class="skip" href="#main">Skip to content</a>
+  <header><div class="wrap">
+    <a class="brand" href="/"><span class="mark">A</span><span>a11oy <small class="mono" style="color:var(--muted);font-weight:400">/ Anatomy v5</small></span></a>
+    <nav aria-label="Primary"><a href="/ecosystem">Ecosystem</a><a href="/spaces">All Spaces</a><a href="/formulas">Formulas</a><a href="/living-anatomy">3D Anatomy</a><a class="primary" href="/console">Command center</a></nav>
+  </div></header>
+  <main id="main">
+    <section class="hero"><div class="wrap">
+      <div class="eyebrow">Real signals | one governed organism</div>
+      <h1>The estate is<br><span>alive and inspectable.</span></h1>
+      <p>Anatomy v5 joins the public inventory, Brain pulse, inference router, mesh, Space health, and full wired formula index. Each organ keeps its source and state; a failed probe stays visibly unavailable.</p>
+      <div class="badges" id="probe-badges" aria-live="polite"><span class="badge">CONNECTING TO SEVEN EVIDENCE SURFACES</span></div>
+    </div></section>
+    <div class="wrap">
+      <section class="vitals" id="vitals" aria-live="polite"><div class="vital"><b>--</b><span>Loading evidence</span><small>No placeholder is a claim.</small></div></section>
+      <div class="tabs" role="tablist" aria-label="Anatomy views">
+        <button class="tab active" id="tab-organism" data-view="organism" role="tab" aria-selected="true" aria-controls="view-organism" tabindex="0">Organism</button>
+        <button class="tab" id="tab-nervous" data-view="nervous" role="tab" aria-selected="false" aria-controls="view-nervous" tabindex="-1">Router nervous system</button>
+        <button class="tab" id="tab-genome" data-view="genome" role="tab" aria-selected="false" aria-controls="view-genome" tabindex="-1">Formula genome</button>
+        <button class="tab" id="tab-evidence" data-view="evidence" role="tab" aria-selected="false" aria-controls="view-evidence" tabindex="-1">Raw evidence</button>
+      </div>
+      <section class="view active" id="view-organism" role="tabpanel" aria-labelledby="tab-organism">
+        <div class="section-head"><div><div class="eyebrow">Digital twin</div><h2>One body, no hidden organs.</h2></div><p>Green means an endpoint explicitly reported LIVE for the relevant signal. Amber means available, observed, cached, modeled, degraded, or snapshot evidence. Red means unavailable; a successful HTTP response is not silently converted into a healthy state.</p></div>
+        <div class="organism">
+          <div class="panel body" aria-label="SZL ecosystem organism map">
+            <div class="spine"></div>
+            <article class="organ brain" data-probe="brain"><span class="dot"></span><b>Brain</b><small id="organ-brain">Pulse pending</small></article>
+            <article class="organ router" data-probe="router"><span class="dot"></span><b>Router</b><small id="organ-router">Routes pending</small></article>
+            <article class="organ models" data-probe="atlas"><span class="dot"></span><b>Models</b><small id="organ-models">Inventory pending</small></article>
+            <article class="organ kernels" data-probe="atlas"><span class="dot"></span><b>Kernels</b><small id="organ-kernels">Registry pending</small></article>
+            <article class="organ receipts" data-probe="mesh"><span class="dot"></span><b>Evidence mesh</b><small id="organ-receipts">Mesh pending</small></article>
+            <article class="organ data" data-probe="atlas"><span class="dot"></span><b>Data + memory</b><small id="organ-data">Inventory pending</small></article>
+            <article class="organ spaces" data-probe="spaces"><span class="dot"></span><b>Spaces</b><small id="organ-spaces">Health pending</small></article>
+            <article class="organ formulas" data-probe="genome"><span class="dot"></span><b>Formula genome</b><small id="organ-formulas">Genome pending</small></article>
+          </div>
+          <aside class="readout" id="readout"></aside>
+        </div>
+      </section>
+      <section class="view" id="view-nervous" role="tabpanel" aria-labelledby="tab-nervous" hidden>
+        <div class="section-head"><div><div class="eyebrow">Inference fabric</div><h2>The nervous system routes; policy decides.</h2></div><p>Routes are rendered from the current router catalog response. Load values remain MODELED, not traffic or QPS. Runtime reachability is not model quality, and a route listing is not a guarantee of inference capacity.</p></div>
+        <div class="nervous-grid"><div class="panel"><div class="route-list" id="routes"><div class="empty">Router evidence pending.</div></div></div><div class="panel"><div class="eyebrow" style="margin-bottom:12px">Mesh state</div><pre class="json" id="mesh-json">Waiting for mesh evidence...</pre></div></div>
+      </section>
+      <section class="view" id="view-genome" role="tabpanel" aria-labelledby="tab-genome" hidden>
+        <div class="section-head"><div><div class="eyebrow">Wired formulas</div><h2>Every served formula, one honest index.</h2></div><p>This view joins the genome snapshot with the runtime formula registry, deduplicating by formula name or identifier and labelling each row's wiring source. A citation or theorem name is provenance metadata; experimental entries remain labelled experimental.</p></div>
+        <div class="panel"><div class="formula-tools"><input id="formula-search" type="search" placeholder="Search formula, tier, citation, theorem..." aria-label="Search formula genome"><span class="badge" id="formula-count" aria-live="polite">PENDING</span></div><div class="formula-list" id="formula-list"><div class="empty">Formula evidence pending.</div></div></div>
+      </section>
+      <section class="view" id="view-evidence" role="tabpanel" aria-labelledby="tab-evidence" hidden>
+        <div class="section-head"><div><div class="eyebrow">Unmodified responses</div><h2>Inspect what the twin actually read.</h2></div><p>Payloads are capped for display but not reinterpreted as stronger evidence. Open each endpoint directly for the complete machine-readable response.</p></div>
+        <div class="panel"><pre class="json" id="raw-json">Waiting for evidence...</pre></div>
+      </section>
+    </div>
+  </main>
+  <footer><div class="wrap"><span>Anatomy v5 is a read-only digital twin. It does not train models, mutate datasets, or mint receipts on GET.</span><span><a href="/api/a11oy/v1/ecosystem/atlas">Atlas JSON</a> | <a href="/api/a11oy/v1/genome">Genome JSON</a> | <a href="/api/a11oy/v1/formulas/index">Wired formula JSON</a> | <a href="/.well-known/szl-source.json">Source attestation</a></span></div></footer>
+  <script>
+  (()=>{
+    'use strict';
+    const endpoints={
+      atlas:['/api/a11oy/v1/ecosystem/atlas'],
+      brain:['/api/a11oy/v1/brain/pulse'],
+      router:['/api/a11oy/v1/router/stats','/v1/router/stats'],
+      mesh:['/api/a11oy/v1/mesh/state'],
+      spaces:['/api/a11oy/v1/spaces/health'],
+      genome:['/api/a11oy/v1/genome'],
+      formulas:['/api/a11oy/v1/formulas/index']
+    };
+    const probes={};
+    const esc=v=>String(v??'').replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+    const simple=v=>v===null||['string','number','boolean'].includes(typeof v)?String(v??'--'):'--';
+    const EVIDENCE_STATES=Object.freeze(['LIVE','CACHED','STALE_CACHE','SNAPSHOT','MODELED','OBSERVED','AVAILABLE','DEGRADED','UNAVAILABLE','ERROR']);
+    const stateClass=s=>String(s||'').toLowerCase().replace(/[^a-z]/g,'');
+    const normalizedState=s=>String(s||'').trim().toUpperCase().replace(/[ -]+/g,'_');
+    const evidenceState=s=>{const normalized=normalizedState(s);return EVIDENCE_STATES.includes(normalized)?normalized:''};
+    const bounded=(v,n=2800)=>{const s=JSON.stringify(v,null,2);return s.length>n?s.slice(0,n)+'\n... display capped; open source endpoint for complete payload':s};
+    function classifyProbe(name,data){
+      const declared=evidenceState(data?.state||data?.status);
+      if(name==='brain'){
+        const pulse=evidenceState(data?.labels?.pulse);
+        return pulse||declared||'OBSERVED';
+      }
+      if(name==='router'){
+        const source=normalizedState(data?.source);const catalog=normalizedState(data?.catalog_state);const throughput=evidenceState(data?.throughput_state);
+        if(source==='HONEST_STUB_CATALOG'||catalog==='FALLBACK')return 'MODELED';
+        return declared||throughput||'OBSERVED';
+      }
+      if(name==='mesh'){
+        const wires=Object.values(data?.wires||{});const statuses=wires.map(w=>normalizedState(typeof w==='object'?w?.status:w));
+        const partial=statuses.some(s=>/(NOT_SERV|IN_PROCESS|PARTIAL|FALLBACK|STUB|UNAVAILABLE)/.test(s))||/stub|not wired|not served/i.test(String(data?.honesty||''));
+        if(partial)return 'DEGRADED';
+        if(declared&&declared!=='LIVE')return declared;
+        if(declared==='LIVE'&&statuses.length&&statuses.every(s=>s==='LIVE'))return 'LIVE';
+        return 'OBSERVED';
+      }
+      if(name==='spaces'){
+        if(declared)return declared;
+        const rows=Array.isArray(data?.spaces)?data.spaces:[];
+        if(rows.length&&rows.every(r=>!r?.app_reachable&&normalizedState(r?.stage)==='UNKNOWN'))return 'UNAVAILABLE';
+        if(rows.some(r=>!r?.app_reachable||normalizedState(r?.stage)!=='RUNNING'))return 'DEGRADED';
+        return 'OBSERVED';
+      }
+      if(name==='formulas'||name==='genome'){
+        return ['UNAVAILABLE','ERROR','DEGRADED'].includes(declared)?declared:'AVAILABLE';
+      }
+      return declared||'OBSERVED';
+    }
+    async function fetchPath(path){
+      const control=new AbortController();const timer=setTimeout(()=>control.abort(),9000);
+      try{const response=await fetch(path,{headers:{accept:'application/json'},signal:control.signal,cache:'no-store'});if(!response.ok)throw Error('HTTP '+response.status);return {data:await response.json(),endpoint:path};}
+      finally{clearTimeout(timer)}
+    }
+    async function probe(name,paths){
+      let last='unavailable';
+      for(const path of paths){try{const hit=await fetchPath(path);return {state:classifyProbe(name,hit.data),data:hit.data,endpoint:hit.endpoint,read_at:new Date().toISOString()};}catch(error){last=error?.name==='AbortError'?'timeout':String(error?.message||error)}}
+      return {state:'UNAVAILABLE',data:null,endpoint:paths[0],error:last,read_at:new Date().toISOString()};
+    }
+    function valueAt(obj,keys){for(const key of keys){const value=key.split('.').reduce((a,k)=>a&&a[k],obj);if(value!==undefined&&value!==null)return value}return null}
+    function arrayAt(obj,keys){const value=valueAt(obj,keys);return Array.isArray(value)?value:[]}
+    function paint(){
+      document.getElementById('probe-badges').innerHTML=Object.entries(probes).map(([name,p])=>`<a class="badge ${stateClass(p.state)}" href="${esc(p.endpoint)}">${esc(name.toUpperCase())}: ${esc(p.state)}</a>`).join('');
+      document.querySelectorAll('.organ').forEach(el=>{const p=probes[el.dataset.probe];el.className=el.className.replace(/\s(live|cached|stalecache|modeled|snapshot|observed|available|degraded|unavailable|error)\b/g,'')+' '+stateClass(p?.state||'UNAVAILABLE')});
+      const atlas=probes.atlas?.data||{};const counts=atlas.counts||{};const formulas=probes.formulas?.data||{};const genome=probes.genome?.data||{};const router=probes.router?.data||{};const brain=probes.brain?.data||{};const spaces=probes.spaces?.data||{};
+      const routes=arrayAt(router,['routes','tiers','data.routes']);const wiredRows=arrayAt(formulas,['wired','formulas','entries']);const genomeRows=arrayAt(genome,['entries','genome']);const spaceRows=arrayAt(spaces,['spaces','resources','results']);
+      const surfacesLit=valueAt(brain,['lit.surfaces_lit','surfaces_lit.count','surfaces_lit','surface_count']);
+      const organsLit=valueAt(brain,['lit.organs_lit','organs_lit.count','organs_lit']);
+      const vitals=[
+        [simple(counts.models),'Models',probes.atlas?.state],[simple(counts.kernels),'Governed kernels',probes.atlas?.state],[simple(genomeRows.length||genome.count),'Formula genome',probes.genome?.state],
+        [simple(routes.length),'Router routes',probes.router?.state],[simple(surfacesLit),'Brain-lit surfaces',probes.brain?.state],[simple(spaceRows.length||counts.spaces),'Spaces observed',probes.spaces?.state]
+      ];
+      document.getElementById('vitals').innerHTML=vitals.map(([v,l,s])=>`<div class="vital"><b>${esc(v)}</b><span>${esc(l)}</span><small>${esc(s||'UNAVAILABLE')} | source-derived</small></div>`).join('');
+      const brainLit=[surfacesLit!==null?surfacesLit+' surfaces':null,organsLit!==null?organsLit+' organs':null].filter(Boolean).join(' | ');
+      document.getElementById('organ-brain').textContent=brainLit||probes.brain?.state||'UNAVAILABLE';
+      document.getElementById('organ-router').textContent=routes.length?routes.length+' routes observed':(probes.router?.state||'UNAVAILABLE');
+      document.getElementById('organ-models').textContent=counts.models!==undefined?counts.models+' public models':(probes.atlas?.state||'UNAVAILABLE');
+      document.getElementById('organ-kernels').textContent=counts.kernels!==undefined?counts.kernels+' governed kernels':(probes.atlas?.state||'UNAVAILABLE');
+      document.getElementById('organ-data').textContent=counts.datasets!==undefined?counts.datasets+' datasets':(probes.atlas?.state||'UNAVAILABLE');
+      document.getElementById('organ-spaces').textContent=counts.spaces!==undefined?counts.spaces+' inventory entries':(probes.spaces?.state||'UNAVAILABLE');
+      document.getElementById('organ-formulas').textContent=genomeRows.length?genomeRows.length+' genome | '+wiredRows.length+' wired':(probes.genome?.state||'UNAVAILABLE');
+      document.getElementById('organ-receipts').textContent=probes.mesh?.state||'UNAVAILABLE';
+      const readoutKeys=['brain','router','atlas','spaces'];
+      document.getElementById('readout').innerHTML=readoutKeys.map(key=>{const p=probes[key];return `<article><h3>${esc(key[0].toUpperCase()+key.slice(1))} <span class="badge ${stateClass(p?.state)}">${esc(p?.state||'UNAVAILABLE')}</span></h3><pre>${esc(p?.data?bounded(p.data,620):(p?.error||'No response'))}</pre><div class="source"><span>${esc(p?.endpoint)}</span><span>${esc(p?.read_at||'')}</span></div></article>`}).join('');
+      renderRoutes(routes,router);renderFormulas(genomeRows,wiredRows);document.getElementById('mesh-json').textContent=probes.mesh?.data?bounded(probes.mesh.data,12000):(probes.mesh?.error||'UNAVAILABLE');
+      document.getElementById('raw-json').textContent=bounded(probes,32000);
+    }
+    function renderRoutes(rows,router={}){
+      const host=document.getElementById('routes');if(!rows.length){host.innerHTML='<div class="empty">Router did not expose a route array. Open the raw evidence view for its exact payload.</div>';return}
+      const throughputState=evidenceState(router?.throughput_state)||'MODELED';const throughputLabel=throughputState==='MODELED'?'modeled load':'throughput';
+      host.innerHTML=rows.map((r,i)=>{const name=r.model||r.organ||r.id||r.name||('route '+(i+1));const tier=r.tier||r.rank||r.provider||'--';const license=r.license||'not reported';const throughput=r.throughput??r.tokens_per_second??'not reported';return `<article class="route"><strong>${esc(name)}</strong><span>tier ${esc(tier)}</span><span>${esc(license)}</span><span class="signal ${stateClass(throughputState)}">${esc(throughputLabel)} ${esc(throughput)}</span></article>`}).join('');
+    }
+    let allGenome=[];let allWired=[];let allFormulas=[];
+    const formulaKey=(row,fallback)=>String(row?.name||row?.id||fallback).trim().toLowerCase();
+    function mergeFormulaRows(genome,wired){
+      const wiredMap=new Map();wired.forEach((row,i)=>wiredMap.set(formulaKey(row,'wired:'+i),row));
+      const seen=new Set();const merged=[];
+      genome.forEach((row,i)=>{const key=formulaKey(row,'genome:'+i);if(seen.has(key))return;seen.add(key);const runtime=wiredMap.get(key);merged.push({...row,runtime_wiring:runtime?'WIRED':'GENOME_ONLY',evidence_source:runtime?'genome + runtime registry':'genome',runtime_tier:runtime?.tier,runtime_citation:runtime?.citation,runtime_lean_theorem:runtime?.lean_theorem})});
+      wired.forEach((row,i)=>{const key=formulaKey(row,'wired:'+i);if(seen.has(key))return;seen.add(key);merged.push({...row,runtime_wiring:'WIRED_ONLY',evidence_source:'runtime registry; absent from genome snapshot'})});
+      return merged;
+    }
+    function renderFormulas(genome=allGenome,wired=allWired){allGenome=genome;allWired=wired;allFormulas=mergeFormulaRows(genome,wired);const q=(document.getElementById('formula-search').value||'').trim().toLowerCase();const shown=allFormulas.filter(r=>JSON.stringify(r).toLowerCase().includes(q));document.getElementById('formula-count').textContent=(probes.genome?.state||'UNAVAILABLE')+' | '+shown.length+' OF '+allFormulas.length+' UNION | '+genome.length+' GENOME | '+wired.length+' WIRED';const host=document.getElementById('formula-list');if(!shown.length){host.innerHTML='<div class="empty">No formula rows are available for this filter. No entries were invented.</div>';return}host.innerHTML=shown.map(r=>{const locations=Array.isArray(r.locations)?r.locations.map(x=>[x.repo,x.file,x.line].filter(Boolean).join(':')).join(' | '):'';const tier=r.tag||r.tier||r.runtime_tier||'tier not reported';const citation=r.citation||locations||r.runtime_citation||r.meaning||'citation not reported';const theorem=r.lean_theorem||r.theorem||r.lean_ref||r.runtime_lean_theorem||r.powers||'theorem metadata not reported';return `<article class="formula"><div><b>${esc(r.name||r.id||'unnamed')}</b><div class="tier">${esc(tier)} | ${esc(r.runtime_wiring)}</div></div><p>${esc(citation)}</p><p>${esc(theorem)} | source: ${esc(r.evidence_source)}</p></article>`}).join('')}
+    document.getElementById('formula-search').addEventListener('input',()=>renderFormulas(allGenome,allWired));
+    const tabButtons=[...document.querySelectorAll('.tab')];
+    function activateTab(button,{focus=false,updateHash=true}={}){tabButtons.forEach(tab=>{const selected=tab===button;tab.classList.toggle('active',selected);tab.setAttribute('aria-selected',String(selected));tab.tabIndex=selected?0:-1;const panel=document.getElementById(tab.getAttribute('aria-controls'));if(panel){panel.classList.toggle('active',selected);panel.hidden=!selected}});if(focus)button.focus();if(updateHash)history.replaceState(null,'','#'+button.dataset.view)}
+    tabButtons.forEach((button,index)=>{button.addEventListener('click',()=>activateTab(button,{updateHash:true}));button.addEventListener('keydown',event=>{let next;if(event.key==='ArrowRight')next=(index+1)%tabButtons.length;else if(event.key==='ArrowLeft')next=(index-1+tabButtons.length)%tabButtons.length;else if(event.key==='Home')next=0;else if(event.key==='End')next=tabButtons.length-1;else return;event.preventDefault();activateTab(tabButtons[next],{focus:true,updateHash:true})})});
+    const initial=location.hash.slice(1);const initialTab=tabButtons.find(tab=>tab.dataset.view===initial)||tabButtons[0];activateTab(initialTab,{focus:false,updateHash:false});
+    Promise.all(Object.entries(endpoints).map(async([name,paths])=>{probes[name]=await probe(name,paths);paint()})).then(paint);
+  })();
+  </script>
+</body>
+</html>

pages/ecosystem.html

@@ -0,0 +1,98 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>SZL Ecosystem Atlas · a11oy</title>
+  <meta name="description" content="Evidence-labelled map of SZL models, governed kernels, datasets, Spaces, Brain, Anatomy, Holographic surfaces, and source ownership.">
+  <link rel="canonical" href="https://a-11-oy.com/ecosystem">
+  <meta property="og:title" content="SZL Ecosystem Atlas · a11oy">
+  <meta property="og:description" content="Every public model, kernel, dataset, Space, collection, and governed surface in one evidence-labelled control plane.">
+  <style>
+    :root{--bg:#07100f;--panel:#0b1715;--panel2:#0e1d1a;--line:rgba(79,242,196,.17);--ink:#edf9f5;--muted:#8eaaa2;--teal:#3af4c8;--blue:#6c9cff;--gold:#d9bc75;--red:#ec827e;--mono:ui-monospace,SFMono-Regular,Consolas,monospace;--sans:Inter,ui-sans-serif,system-ui,sans-serif}
+    *{box-sizing:border-box}html{scroll-behavior:smooth}body{margin:0;background:radial-gradient(circle at 80% -10%,rgba(62,144,130,.2),transparent 36%),linear-gradient(180deg,#06100e,#081210 55%,#050b0a);color:var(--ink);font-family:var(--sans)}
+    a{color:inherit;text-decoration:none}a,button{touch-action:manipulation}a:focus-visible,button:focus-visible,input:focus-visible{outline:2px solid var(--teal);outline-offset:3px}.skip{position:fixed;left:12px;top:8px;z-index:100;transform:translateY(-160%);border-radius:8px;background:var(--teal);color:#03100c;padding:10px 13px;font:12px var(--mono)}.skip:focus{transform:none}.wrap{width:min(1180px,calc(100% - 32px));margin:auto}.mono{font-family:var(--mono)}
+    header{position:sticky;top:0;z-index:20;border-bottom:1px solid var(--line);background:rgba(6,16,14,.9);backdrop-filter:blur(18px)}
+    header .wrap{height:66px;display:flex;align-items:center;gap:18px}.brand{display:flex;align-items:center;gap:11px;font-weight:760}.mark{width:28px;height:28px;border:1px solid var(--teal);border-radius:50%;display:grid;place-items:center;color:var(--teal);box-shadow:0 0 28px rgba(58,244,200,.22)}
+    nav{margin-left:auto;display:flex;align-items:center;gap:8px;flex-wrap:wrap}nav a{min-height:44px;display:inline-flex;align-items:center;font-size:13px;color:var(--muted);padding:9px 11px;border-radius:9px}nav a:hover{background:rgba(58,244,200,.07);color:var(--ink)}.primary{border:1px solid rgba(58,244,200,.38);color:var(--teal)!important}
+    .hero{padding:72px 0 42px}.eyebrow{font:11px var(--mono);letter-spacing:.16em;color:var(--teal);text-transform:uppercase}.hero h1{font-size:clamp(2.6rem,6vw,5.6rem);line-height:.93;letter-spacing:-.055em;margin:18px 0}.hero h1 span{color:transparent;background:linear-gradient(90deg,var(--teal),var(--blue));background-clip:text}.hero p{max-width:760px;color:var(--muted);font-size:1.08rem;line-height:1.7}.statebar{display:flex;gap:12px;align-items:center;flex-wrap:wrap;margin-top:24px}.state{font:11px var(--mono);border:1px solid var(--line);border-radius:999px;padding:7px 10px;color:var(--muted)}.state[href]{min-height:44px;display:inline-flex;align-items:center}.state.live{color:var(--teal);border-color:rgba(58,244,200,.4)}.state.cached{color:var(--gold);border-color:rgba(217,188,117,.42)}.state.bad{color:var(--red);border-color:rgba(236,130,126,.4)}
+    .counts{display:grid;grid-template-columns:repeat(7,minmax(100px,1fr));gap:10px;margin:20px 0 46px}.count{background:linear-gradient(160deg,rgba(14,29,26,.96),rgba(8,17,15,.96));border:1px solid var(--line);border-radius:14px;padding:16px}.count b{display:block;font:650 1.55rem var(--mono);color:var(--teal)}.count span{font:10px var(--mono);letter-spacing:.09em;color:var(--muted);text-transform:uppercase}
+    .toolbar{display:flex;gap:12px;align-items:center;flex-wrap:wrap;margin-bottom:16px}.search{flex:1;min-width:230px;background:var(--panel);border:1px solid var(--line);color:var(--ink);border-radius:12px;padding:12px 14px;font:13px var(--mono)}.search:focus{outline:1px solid var(--teal)}
+    .tabs{display:flex;gap:7px;overflow:auto;overscroll-behavior-inline:contain;scrollbar-width:thin;padding-bottom:10px;margin-bottom:16px}.tab{min-height:44px;border:1px solid var(--line);background:rgba(11,23,21,.75);color:var(--muted);padding:9px 12px;border-radius:999px;font:11px var(--mono);white-space:nowrap;cursor:pointer}.tab.active,.tab:hover{color:#04100c;background:var(--teal);border-color:var(--teal)}
+    .brief{display:grid;grid-template-columns:1.5fr 1fr;gap:14px;margin:20px 0 26px}.brief>div{min-width:0;border:1px solid var(--line);border-radius:16px;background:linear-gradient(150deg,rgba(14,29,26,.9),rgba(7,15,13,.95));padding:22px}.brief h2{margin:0 0 9px;font-size:1.25rem}.brief p{margin:0;color:var(--muted);line-height:1.65}.links{display:flex;gap:9px;flex-wrap:wrap;margin-top:16px}.chip{min-height:44px;display:inline-flex;align-items:center;border:1px solid var(--line);border-radius:9px;padding:8px 10px;color:var(--teal);font:11px var(--mono)}
+    .grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:12px;padding-bottom:70px}.grid>*{min-width:0}.card{display:flex;flex-direction:column;min-height:178px;border:1px solid var(--line);border-radius:15px;background:linear-gradient(150deg,rgba(14,29,26,.9),rgba(7,15,13,.96));padding:18px;transition:.18s}.card:hover{border-color:rgba(58,244,200,.46);transform:translateY(-2px)}.kind{font:10px var(--mono);letter-spacing:.1em;color:var(--blue);text-transform:uppercase}.card h3{font-size:1rem;line-height:1.35;margin:10px 0;overflow-wrap:anywhere}.meta{display:grid;gap:6px;margin-top:auto;font:10.5px var(--mono);color:var(--muted)}.meta span{display:flex;justify-content:space-between;gap:12px;min-width:0}.meta b{min-width:0;font-weight:500;color:#c9dad5;text-align:right;overflow-wrap:anywhere}.open{margin-top:14px;color:var(--teal);font:11px var(--mono)}
+    .empty{grid-column:1/-1;border:1px dashed var(--line);border-radius:15px;padding:28px;color:var(--muted);text-align:center}.foot{border-top:1px solid var(--line);padding:35px 0 50px;color:var(--muted);font-size:12px;line-height:1.6}.foot .wrap{display:flex;justify-content:space-between;gap:30px;flex-wrap:wrap}.foot a{color:var(--teal)}
+    @media(max-width:900px){.counts{grid-template-columns:repeat(4,minmax(0,1fr))}.grid{grid-template-columns:repeat(2,minmax(0,1fr))}.brief{grid-template-columns:1fr}}
+    @media(max-width:800px){.brand small{display:none}}
+    @media(max-width:680px){header{position:static}header .wrap{height:auto;flex-wrap:wrap;padding:11px 0 8px}nav{width:100%;margin-left:0;flex-wrap:nowrap;overflow-x:auto;overscroll-behavior-inline:contain;scrollbar-width:thin}nav a{flex:0 0 auto}}
+    @media(max-width:620px){.hero{padding-top:45px}.counts{grid-template-columns:repeat(2,minmax(0,1fr))}.grid{grid-template-columns:1fr}.search{min-width:0;width:100%}.meta span{align-items:flex-start;flex-direction:column;gap:3px}.meta b{text-align:left}}
+  </style>
+</head>
+<body>
+  <a class="skip" href="#main">Skip to content</a>
+  <header><div class="wrap">
+    <a class="brand" href="/"><span class="mark">A</span><span>a11oy <small class="mono" style="color:var(--muted);font-weight:400">/ ecosystem atlas</small></span></a>
+    <nav aria-label="Primary"><a href="https://a11oy.net">Alloy cockpit</a><a href="/spaces">All Spaces</a><a href="/anatomy-v5">Anatomy v5</a><a href="/console">Command center</a><a class="primary" href="https://huggingface.co/SZLHOLDINGS">Hugging Face ↗</a></nav>
+  </div></header>
+  <main id="main">
+    <section class="hero"><div class="wrap">
+      <div class="eyebrow">SZL Holdings · public control plane</div>
+      <h1>One estate.<br><span>Every artifact visible.</span></h1>
+      <p>Models stay immutable. Kernels stay attributable. The Brain, Anatomy, Holographic surfaces, datasets, collections, Spaces, and GitHub producers meet here through one evidence-labelled registry.</p>
+      <div class="statebar"><span class="state" id="atlas-state" role="status" aria-live="polite">LOADING</span><span class="state" id="atlas-time">waiting for inventory</span><a class="state" href="/api/a11oy/v1/ecosystem/atlas">JSON evidence ↗</a></div>
+    </div></section>
+    <div class="wrap">
+      <section class="counts" id="counts"></section>
+      <section class="brief">
+        <div><h2>Control plane, not an artifact warehouse.</h2><p>The sites link signed or revision-pinned Hub artifacts. Training, conversion, and evaluation remain with their producer repositories; the router chooses eligible runtimes and the Brain supplies grounded context.</p><div class="links"><a class="chip" href="https://github.com/szl-holdings/szl-router">Router source ↗</a><a class="chip" href="https://github.com/szl-holdings/szl-forge">Forge source ↗</a><a class="chip" href="https://github.com/szl-holdings/lutar-lean">Proof kernel ↗</a></div></div>
+        <div><h2>Anatomy v5</h2><p>An evidence-labelled digital twin of the estate: organism health, inference nervous system, and the complete formula genome. Unavailable sources remain visibly unavailable.</p><div class="links"><a class="chip" href="/anatomy-v5">Open Anatomy v5 →</a><a class="chip" href="/living-anatomy">Current 3D anatomy →</a></div></div>
+      </section>
+      <section class="toolbar"><input class="search" id="search" type="search" placeholder="Search models, kernels, Spaces, owners, revisions…" aria-label="Search ecosystem"></section>
+      <section class="tabs" id="tabs" role="tablist" aria-label="Ecosystem categories"></section>
+      <section class="grid" id="grid" role="tabpanel" aria-label="Ecosystem resources" aria-live="polite" tabindex="0"><div class="empty">Loading the public estate inventory…</div></section>
+    </div>
+  </main>
+  <footer class="foot"><div class="wrap"><span>Counts and rows are labelled LIVE, CACHED, STALE_CACHE, SNAPSHOT, or UNAVAILABLE. Runtime stage proves reachability only.</span><span><a href="https://github.com/szl-holdings">GitHub</a> · <a href="https://huggingface.co/SZLHOLDINGS">Hugging Face</a> · <a href="/trust">Trust center</a></span></div></footer>
+  <script>
+    const API='/api/a11oy/v1/ecosystem/atlas';
+    const labels={models:'Models',kernels:'Kernels',brain:'Brain',anatomy:'Anatomy',holographic:'Holographic',datasets:'Datasets',spaces:'Spaces',collections:'Collections',buckets:'Buckets',killinchu:'Killinchu'};
+    const order=['models','kernels','brain','anatomy','holographic','datasets','spaces','collections','buckets','killinchu'];
+    let atlas=null, active='models', query='';
+    const pathKey=location.pathname.split('/').filter(Boolean).at(-1)||'models';
+    const hashKey=location.hash.slice(1);
+    if(order.includes(hashKey)) active=hashKey; else if(order.includes(pathKey)) active=pathKey;
+    function esc(v){return String(v??'').replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));}
+    function cardsFor(key){
+      if(!atlas)return[];
+      if(['brain','anatomy','holographic','killinchu'].includes(key))return atlas.curated?.[key]||[];
+      return atlas.resources?.[key]||[];
+    }
+    function renderCounts(){
+      const keys=['models','kernels','datasets','spaces','collections','buckets','public_resources_total'];
+      document.getElementById('counts').innerHTML=keys.map(k=>`<div class="count"><b>${esc(atlas?.counts?.[k]??'—')}</b><span>${esc(k.replaceAll('_',' '))}</span></div>`).join('');
+    }
+    function selectTab(key,{focus=false}={}){
+      active=key;history.replaceState(null,'','/ecosystem#'+active);renderTabs();renderGrid();if(focus)document.getElementById('tab-'+active)?.focus();
+    }
+    function renderTabs(){
+      document.getElementById('tabs').innerHTML=order.map(k=>`<button type="button" class="tab ${k===active?'active':''}" id="tab-${k}" data-tab="${k}" role="tab" aria-selected="${k===active}" aria-controls="grid" tabindex="${k===active?'0':'-1'}">${labels[k]} <span>${cardsFor(k).length||''}</span></button>`).join('');
+      document.getElementById('grid').setAttribute('aria-labelledby','tab-'+active);
+      const buttons=[...document.querySelectorAll('.tab')];buttons.forEach((button,index)=>{button.addEventListener('click',()=>selectTab(button.dataset.tab));button.addEventListener('keydown',event=>{let next;if(event.key==='ArrowRight')next=(index+1)%buttons.length;else if(event.key==='ArrowLeft')next=(index-1+buttons.length)%buttons.length;else if(event.key==='Home')next=0;else if(event.key==='End')next=buttons.length-1;else return;event.preventDefault();selectTab(buttons[next].dataset.tab,{focus:true})})});
+    }
+    function renderGrid(){
+      const rows=cardsFor(active).filter(r=>JSON.stringify(r).toLowerCase().includes(query));
+      const grid=document.getElementById('grid');
+      if(!rows.length){grid.innerHTML=`<div class="empty">${atlas?.state==='SNAPSHOT'?'The live inventory is unavailable; snapshot counts remain visible without fabricating rows.':'No matching resources.'}</div>`;return;}
+      grid.innerHTML=rows.map(r=>{
+        const id=r.id||r.title||'Untitled'; const rev=r.revision?String(r.revision).slice(0,12):null;
+        const owner=r.owner||r.source_state||'source mapping pending'; const stage=r.runtime_stage||r.owner_state||null;
+        return `<a class="card" href="${esc(r.href||'#')}" ${String(r.href||'').startsWith('http')?'target="_blank" rel="noopener"':''}><div class="kind">${esc(r.kind||active)}</div><h3>${esc(id)}</h3><div class="meta">${rev?`<span>revision<b>${esc(rev)}</b></span>`:''}<span>owner/source<b>${esc(owner)}</b></span>${stage?`<span>state<b>${esc(stage)}</b></span>`:''}${r.license?`<span>license<b>${esc(r.license)}</b></span>`:''}</div><span class="open">Open evidence →</span></a>`;
+      }).join('');
+    }
+    document.getElementById('search').addEventListener('input',e=>{query=e.target.value.trim().toLowerCase();renderGrid();});
+    fetch(API,{headers:{accept:'application/json'}}).then(r=>{if(!r.ok)throw Error('HTTP '+r.status);return r.json()}).then(d=>{
+      atlas=d;const state=document.getElementById('atlas-state');const normalized=String(d.state||'UNAVAILABLE').trim().toUpperCase().replace(/[ -]+/g,'_');const evidenceStates=['LIVE','CACHED','STALE_CACHE','SNAPSHOT','DEGRADED','MODELED','OBSERVED','AVAILABLE','UNAVAILABLE'];const displayState=evidenceStates.includes(normalized)?normalized:'UNAVAILABLE';const amberStates=['CACHED','STALE_CACHE','SNAPSHOT','DEGRADED','MODELED','OBSERVED','AVAILABLE'];state.textContent=displayState;state.classList.add(displayState==='LIVE'?'live':(amberStates.includes(displayState)?'cached':'bad'));document.getElementById('atlas-time').textContent='observed '+(d.observed_at||'unknown');renderCounts();renderTabs();renderGrid();
+    }).catch(e=>{document.getElementById('atlas-state').textContent='UNAVAILABLE';document.getElementById('atlas-state').classList.add('bad');document.getElementById('atlas-time').textContent='inventory request failed';document.getElementById('grid').innerHTML='<div class="empty">Atlas endpoint unavailable. No rows were fabricated.</div>';});
+  </script>
+</body>
+</html>

pages/observability.html

@@ -38,8 +38,9 @@
     .ribbon .sep{color:var(--dim);}
     .ribbon .teal{color:var(--teal);}
     .ribbon .live{display:inline-flex;align-items:center;gap:0.4rem;color:var(--cream);}
-    .ribbon a{margin-left:auto;color:var(--muted);text-decoration:none;}
-    .ribbon a:hover{color:var(--gold);}
+    .ribbon .navlinks{margin-left:auto;display:flex;gap:.8rem;align-items:center;}
+    .ribbon .navlinks a{color:var(--muted);text-decoration:none;}
+    .ribbon .navlinks a:hover{color:var(--gold);}
     .live-dot{width:6px;height:6px;border-radius:50%;background:var(--live);
       box-shadow:0 0 6px var(--live);animation:pulseDot 2.2s ease-in-out infinite;}
     @keyframes pulseDot{0%,100%{opacity:1;}50%{opacity:.35;}}
@@ -163,7 +164,7 @@
   <span>AI OBSERVABILITY</span><span class="sep">/</span>
   <span>MELT · SIGNED TRACES</span><span class="sep">/</span>
   <span class="live"><span class="live-dot"></span>LIVE · RT</span>
-  <a href="/warhacker">Warhacker &rarr;</a>
+  <nav class="navlinks" aria-label="a11oy navigation"><a href="/">Home</a><a href="/ecosystem">Ecosystem</a><a href="/anatomy-v5">Anatomy v5</a><a href="/console">Console</a></nav>
 </div>
 
 <section class="hero">

pages/superpowers.html

@@ -40,6 +40,9 @@
     .ribbon .sep{color:var(--dim);}
     .ribbon .teal{color:var(--teal);}
     .ribbon .live{display:inline-flex;align-items:center;gap:0.4rem;color:var(--cream);}
+    .ribbon .navlinks{margin-left:auto;display:flex;gap:.8rem;align-items:center;}
+    .ribbon .navlinks a{color:var(--muted);text-decoration:none;}
+    .ribbon .navlinks a:hover{color:var(--gold);}
     .live-dot{width:6px;height:6px;border-radius:50%;background:var(--live);
       box-shadow:0 0 6px var(--live);animation:pulseDot 2.2s ease-in-out infinite;}
     @keyframes pulseDot{0%,100%{opacity:1;}50%{opacity:.35;}}
@@ -138,6 +141,7 @@
   <span>DOCTRINE V11 · LOCKED</span><span class="sep">/</span>
   <span>REPLAY c7c0ba17</span><span class="sep">/</span>
   <span class="live"><span class="live-dot"></span>LIVE · RT</span>
+  <nav class="navlinks" aria-label="a11oy navigation"><a href="/">Home</a><a href="/ecosystem">Ecosystem</a><a href="/anatomy-v5">Anatomy v5</a><a href="/console">Console</a></nav>
 </div>
 
 <!-- ===== HERO ===== -->

serve.py

@@ -2894,17 +2894,25 @@ try:
                 "layer": "a11oy readiness tab-matrix",
                 "honest": True,
                 "available": False,
+                "matrix_available": False,
+                "probe_verdict_available": False,
                 "note": ("tabs.json not bundled with this deploy; generate it with "
                          "tools/readiness-harness/gen_tabs_matrix.py"),
                 "checked_at": _now,
             }, status_code=200)
-        if verdict is not None:
+        _verdict_available = verdict is not None
+        if _verdict_available:
             verdict = dict(verdict)
             verdict["available"] = True
         return _RDJSON({
             "layer": "a11oy readiness tab-matrix",
             "honest": True,
-            "available": True,
+            # ``available`` now means a deployment probe verdict is available,
+            # not merely that the static tab inventory was bundled.  Keep the
+            # two facts separate so a matrix can never become a green deploy.
+            "available": _verdict_available,
+            "matrix_available": True,
+            "probe_verdict_available": _verdict_available,
             "matrix": matrix,
             "verdict": verdict or {
                 "available": False,
@@ -6414,13 +6422,13 @@ print("[a11oy] PARITY BLOCK v2 registered BEFORE proxy: /api/a11oy/v1/{lambda,ho
 # ===========================================================================
 
 # ===========================================================================
-# ADDITIVE (FUNCTIONAL-PROOF squad, 2026-06-04): live /v1/router/stats.
+# ADDITIVE (FUNCTIONAL-PROOF squad, 2026-06-04): modeled /v1/router/stats.
 # The landing-page "LLM-Router Live" 3D scene (/static/viz/router/) polls
 # /v1/router/stats every 1s and otherwise renders "DEMO MODE". The endpoint
 # did not exist (404 -> the scene fell back to demo), so the advertised "live
-# data binding · sovereign mode" claim was unproven. This serves REAL router
-# state derived from the in-process szl_brain.TIERS catalog (no fabrication):
-# one route per tier, throughput = live token-bucket counter incremented per
+# data binding · sovereign mode" claim was unproven. This serves a REAL catalog
+# observation plus explicitly MODELED load derived from szl_brain.TIERS:
+# one route per tier, throughput = deterministic time-derived display signal per
 # poll, in the {routes:[{organ,tier,model,throughput,license}], servedThisWindow}
 # shape the scene's normalizeStats() consumes. Registered at BOTH the root path
 # (HF proxy strips /api/a11oy) and the /api/a11oy/v1 path, BEFORE the catch-all
@@ -6433,9 +6441,10 @@ print("[a11oy] PARITY BLOCK v2 registered BEFORE proxy: /api/a11oy/v1/{lambda,ho
 import time as _rtr_time
 
 def _a11oy_router_stats_payload() -> dict:
-    """Live per-tier router stats from the real szl_brain catalog. Deterministic
-    throughput from a time-seeded counter (honest: in-memory, resets on rebuild)."""
-    tiers = _a11oy_pr_brain.TIERS if _A11OY_BRAIN_OK else [
+    """Catalog-derived routes with explicitly MODELED, non-traffic throughput."""
+    _real_tiers = getattr(_a11oy_pr_brain, "TIERS", None) if _A11OY_BRAIN_OK else None
+    _catalog_live = isinstance(_real_tiers, list) and bool(_real_tiers)
+    tiers = _real_tiers if _catalog_live else [
         {"id": "claude_sonnet_4_6", "rank": 0},
         {"id": "gemini_3_1_pro", "rank": 1},
         {"id": "gpt_5_4", "rank": 2},
@@ -6464,21 +6473,24 @@ def _a11oy_router_stats_payload() -> dict:
         })
         served += tp
     return {
-        "mode": "live",
+        "state": "MODELED",
+        "mode": "modeled",
+        "catalog_state": "LIVE" if _catalog_live else "FALLBACK",
+        "throughput_state": "MODELED",
         "routes": routes,
         "servedThisWindow": served,
         "tiers": [f"T{int(t.get('rank', i))}" for i, t in enumerate(tiers)],
-        "source": "szl_brain.TIERS" if _A11OY_BRAIN_OK else "honest_stub_catalog",
+        "source": "szl_brain.TIERS" if _catalog_live else "honest_stub_catalog",
         "doctrine": "v11",
-        "honesty": ("Throughput is a live in-memory counter (resets on Space rebuild). "
-                    "Tier catalog + license classes are real; per-poll throughput is "
-                    "deterministic, not a production traffic meter."),
+        "honesty": ("Tier catalog state is reported separately. Throughput and "
+                    "servedThisWindow are deterministic MODELED display signals, not "
+                    "production traffic, measured QPS, or completed inference."),
     }
 
 @app.get("/api/a11oy/v1/router/stats")
 @app.get("/v1/router/stats")
 async def _a11oy_router_stats() -> JSONResponse:
-    """Live LLM-router per-tier stats (feeds the /static/viz/router/ 3D scene)."""
+    """Catalog routes plus modeled load (feeds the /static/viz/router/ 3D scene)."""
     return JSONResponse(_a11oy_router_stats_payload())
 
 print("[a11oy] router/stats registered BEFORE proxy: /api/a11oy/v1/router/stats + /v1/router/stats", file=sys.stderr)
@@ -8556,19 +8568,21 @@ def _r3d_loop_meta(r: dict):
 def _r3d_router_metrics_payload() -> dict:
     rs = _a11oy_router_stats_payload()
     routes = rs.get("routes", [])
-    live = rs.get("source") == "szl_brain.TIERS"
     return {
-        "data_kind": "live" if live else "sample",
-        "mode": rs.get("mode", "live"),
+        "state": "MODELED",
+        "data_kind": "modeled",
+        "mode": "modeled",
+        "catalog_state": rs.get("catalog_state", "FALLBACK"),
+        "throughput_state": "MODELED",
         "routes": routes,
         "tiers": routes,
         "servedThisWindow": rs.get("servedThisWindow", 0),
         "width_depth_available": False,
         "source": rs.get("source", ""),
         "doctrine": "v11",
-        "honesty": ("Per-tier throughput / model / license from the router catalog -- LIVE "
-                    "when the brain catalog (szl_brain.TIERS) is up, else honest_stub_catalog fallback "
-                    "with data_kind DOWNGRADED to sample. Model width/depth shape is NOT measured, so any "
+        "honesty": ("Per-tier model and license come from the router catalog; catalog_state says whether "
+                    "that catalog is live or fallback. Throughput and display load remain MODELED, never "
+                    "measured traffic or QPS. Model width/depth shape is NOT measured, so any "
                     "width/depth scaling point stays a clearly-labelled SAMPLE. "
                     "Lambda = Conjecture 1; locked-proven stays exactly 8 " + _R3D_LOCKED8 + "."),
     }
@@ -8582,10 +8596,12 @@ def _r3d_routing_graph_payload() -> dict:
     edges = [{"source": routes[i].get("tier"), "target": routes[i + 1].get("tier")}
              for i in range(len(routes) - 1)]
     ch = _r3d_chain(50)
-    live = rs.get("source") == "szl_brain.TIERS"
     return {
-        "data_kind": "live" if live else "sample",
-        "mode": rs.get("mode", "live"),
+        "state": "MODELED",
+        "data_kind": "modeled",
+        "mode": "modeled",
+        "catalog_state": rs.get("catalog_state", "FALLBACK"),
+        "throughput_state": "MODELED",
         "nodes": nodes,
         "edges": edges,
         "routes": routes,
@@ -8594,10 +8610,9 @@ def _r3d_routing_graph_payload() -> dict:
         "surface": ("GraphRouter routing-envelope score s = lambda*e_hat - (1-lambda)*c_hat "
                     "is a DERIVED heuristic, never a measured loss"),
         "doctrine": "v11",
-        "honesty": ("Routing nodes/edges are the /router/stats per-tier catalog -- LIVE when the "
-                    "brain catalog (szl_brain.TIERS) is up, else honest_stub_catalog fallback with "
-                    "data_kind DOWNGRADED to sample (real "
-                    "organ -> tier -> model escalation path); receipts are the real in-image "
+        "honesty": ("Routing nodes/edges use the /router/stats catalog; catalog_state distinguishes "
+                    "the live brain catalog from the honest fallback. Throughput remains MODELED, never "
+                    "traffic or QPS. The organ -> tier -> model escalation path is catalog data; receipts are the real in-image "
                     "chain. The manifold surface is a derived heuristic, never a measured loss. "
                     "Lambda = Conjecture 1; locked-proven stays exactly 8 " + _R3D_LOCKED8 + "."),
     }
@@ -13761,11 +13776,11 @@ try:
 
     _a11oy_source_observation = {
         "repository": "szl-holdings/a11oy",
-        "commit": "2ca22d0b337805a2d4e7e65af3f6738c401431a4",
+        "commit": "a077208dfa8b8be54b271a277b8c27092422c7e7",
         "path": "",
         "relation": "declared-source-with-hf-overlay",
         "state": "VERIFIED_REFERENCE",
-        "evidence_url": "https://github.com/szl-holdings/a11oy/commit/2ca22d0b337805a2d4e7e65af3f6738c401431a4",
+        "evidence_url": "https://github.com/szl-holdings/a11oy/commit/a077208dfa8b8be54b271a277b8c27092422c7e7",
     }
     _szl_source_result = _szl_source_attestation.register(
         app,
@@ -13843,6 +13858,26 @@ except Exception as _quant_signals_error:  # additive: never take down the SPA
     )
 
 
+# ============================================================================
+# ECOSYSTEM ATLAS + ANATOMY V5 (2026-07-16): one versioned public inventory
+# projection for models, governed kernels, datasets, Spaces, collections, and
+# buckets, plus real /ecosystem category deep links and the read-only Anatomy v5
+# digital twin. The API labels LIVE/CACHED/SNAPSHOT/UNAVAILABLE and leaves rows
+# empty when only snapshot counts exist. Front-inserted so these exact routes win
+# over the SPA fallback; additive and non-fatal.
+# ============================================================================
+try:
+    import a11oy_ecosystem_atlas as _a11oy_ecosystem_atlas
+
+    _ecosystem_atlas_result = _a11oy_ecosystem_atlas.register(app, ns="a11oy")
+    print(f"[a11oy] ecosystem atlas registered (front-moved): {_ecosystem_atlas_result}", file=sys.stderr)
+except Exception as _ecosystem_atlas_error:
+    print(
+        f"[a11oy] ecosystem atlas NOT registered (non-fatal): {_ecosystem_atlas_error!r}",
+        file=sys.stderr,
+    )
+
+
 if __name__ == "__main__":
     import uvicorn
     port = int(os.environ.get("PORT", "7860"))

szl_dark_surfaces_register.py

@@ -118,8 +118,17 @@ def register(app: Any, ns: str = "a11oy") -> List[str]:
         if callable(include_router):
             # Documented path: /api/<ns>/v1/ayni (+ /replay, /tinkuy). Resolves LOCALLY.
             app.include_router(_ayni_router, prefix=f"/api/{ns}")
-            # Legacy path: bare /v1/ayni — additive back-compat, breaks no caller.
-            app.include_router(_ayni_router)
+            # Legacy paths: current FastAPI versions de-duplicate a second inclusion
+            # of the same APIRouter object, even when its prefix differs.  Append the
+            # original APIRoute objects instead so the claimed bare /v1/* contract is
+            # actually present while the prefixed clones remain untouched.
+            existing_paths = {
+                getattr(route, "path", None) for route in app.router.routes
+            }
+            for route in getattr(_ayni_router, "routes", []):
+                if getattr(route, "path", None) not in existing_paths:
+                    app.router.routes.append(route)
+                    existing_paths.add(getattr(route, "path", None))
             included = True
         else:
             # Bare Starlette fallback: splice the router's routes onto app.router at

szl_spaces_proxy.py

@@ -1,444 +1,314 @@
 #!/usr/bin/env python3
 # SPDX-License-Identifier: Apache-2.0
 # © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173
-"""szl_spaces_proxy.py — surface the live HF Spaces estate under a-11-oy.com/spaces/*.
+"""Canonical-origin handoffs for the audited Hugging Face Spaces estate.
 
-ADDITIVE, self-contained, SHARED (byte-identical in a11oy + killinchu). Founder rule:
-"all the huggingface on my a-11-oy.com" with NO new subdomains. This module reverse-
-proxies each live Hugging Face Space to a same-origin path:
+This shared module keeps the historical ``/spaces/<slug>`` links working without
+executing another Space inside the a11oy or Killinchu origin:
 
-    GET/HEAD /spaces                 -> index (delegates to szl_spaces_surface tiles if
-                                        present; else a minimal honest index of the 11)
-    GET/HEAD /spaces/{name}          -> reverse-proxy of https://szlholdings-{name}.hf.space/
-    GET/HEAD /spaces/{name}/{path}   -> reverse-proxy of that Space's sub-paths/assets
+* ``GET/HEAD /spaces`` renders a minimal fallback index when the richer tiles
+  surface is not registered.
+* ``GET/HEAD /spaces/{name}`` returns a no-store 307 to the audited Space's
+  canonical Hugging Face application origin.
+* ``GET/HEAD /spaces/{name}/{path}`` preserves the suffix and raw query string
+  in the same no-store 307 handoff.
 
-The proxy is a SERVER-SIDE fetch over the app's shared httpx.AsyncClient (resolved
-lazily from serve.py's module global, like szl_engine_status), NOT a browser CDN load —
-so it satisfies the 0-runtime-CDN doctrine for the same reason a11oy_hf_assets.py states
-(server-side fetch, not a browser CDN). HTML responses get a <base href="/spaces/{name}/">
-injected so the Space's root-relative assets resolve back through this proxy.
+There is no upstream fetch path in this module. It never copies upstream HTML,
+JavaScript, response bytes, authentication state, or ``Set-Cookie`` into the
+host application. Interactive apps, streaming, cookies, and authentication stay
+isolated on Hugging Face. Unknown identifiers fail closed with 404, so these
+routes cannot become an open redirect.
 
-HONEST DEGRADE: upstream timeout / connect error / unreachable -> a clean 502 page
-("Space <name> is starting / unreachable — open directly: <hf.space url>"). NEVER a fake
-200. Hop-by-hop headers are stripped. The proxy is an ALLOWLIST of the known Space names
-only (no open proxy); unknown names -> 404. a11oy is NOT self-proxied (would loop) and
-killinchu is served on its own host — both are listed as TILES (by szl_spaces_surface)
-linking to their canonical hosts, but are NOT in the reverse-proxy allowlist here.
-
-No auth token is forwarded to HF — these are PUBLIC Spaces.
-
-Routes are inserted at the FRONT of app.router.routes (app.router.routes[0:0] = new)
-so they win over the /api/<ns>/{path:path} Node proxy + the /{full_path:path} SPA
-catch-all (the same route-to-front idiom a11oy_hf_assets.py uses).
-
-Doctrine v11: locked-proven = EXACTLY 8 {F1,F4,F7,F11,F12,F18,F19,F22} @ c7c0ba17;
-Λ = Conjecture 1; Khipu = Conjecture 2; trust never 100%; 0 runtime CDN (server-side
-fetch); no user-visible codenames (Space names are their own honest titles); never
-commits a key; additive-only; never weakens a gate; honest 502 beats a fake 200.
+Routes are front-inserted so exact compatibility links beat the application's
+SPA catch-all. The audited 26-Space identity list is static; runtime reachability
+continues to be measured honestly by ``szl_spaces_surface``.
 
 Signed-off-by: Stephen Lutar <stephenlutar2@gmail.com>
-Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>
 """
 from __future__ import annotations
 
+import html
 import sys
 from typing import Any
+from urllib.parse import quote
 
 _ORG_PREFIX = "szlholdings-"
-
-# The 11 live Spaces (all RUNNING). app URL pattern: https://szlholdings-<name>.hf.space
-# PROXY allowlist = the names we reverse-proxy under /spaces/<name>. We SKIP:
-#   - "a11oy"    : self-proxy would loop (a-11-oy.com IS the a11oy Space).
-#   - "killinchu": served on its own host; we link the tile to its host, never proxy it.
-# Both skipped names are still listed as TILES by szl_spaces_surface.
-ALL_SPACES = [
-    "immune", "sda", "anatomy", "cathedral", "energy", "yarqa",
-    "khipu-constellation", "llm-router-live", "hatun-mcp", "a11oy", "killinchu",
+_ORG = "SZLHOLDINGS"
+SPACE_HANDOFF_MODE = "canonical-redirect-only/v1"
+
+# Audited 26-Space public estate. Runtime state is deliberately absent here.
+# ``slug`` is the lowercase legacy route key; SDK selects the canonical app host.
+SPACE_INVENTORY: list[dict[str, str]] = [
+    {"name": "a11oy", "slug": "a11oy", "title": "a11oy — Command Center", "sdk": "docker"},
+    {"name": "anatomy", "slug": "anatomy", "title": "SZL Living Anatomy", "sdk": "docker"},
+    {"name": "cosmos", "slug": "cosmos", "title": "SZL Cosmos", "sdk": "docker"},
+    {"name": "david-leads", "slug": "david-leads", "title": "David Leads — Sovereign Insurance Intelligence", "sdk": "docker"},
+    {"name": "energy-attest-holo", "slug": "energy-attest-holo", "title": "Energy Attestation Holo", "sdk": "static"},
+    {"name": "energy-attested-runs", "slug": "energy-attested-runs", "title": "Energy-Attested Inference Runs", "sdk": "gradio"},
+    {"name": "governed-norm-holo", "slug": "governed-norm-holo", "title": "Governed Norms — WILLAY classifiers", "sdk": "static"},
+    {"name": "governed-receipt-verifier", "slug": "governed-receipt-verifier", "title": "Governed Receipt Verifier", "sdk": "static"},
+    {"name": "guardrail-receipt", "slug": "guardrail-receipt", "title": "Guardrail Decision-Receipt", "sdk": "gradio"},
+    {"name": "hatun-mcp", "slug": "hatun-mcp", "title": "hatun — MCP Server", "sdk": "docker"},
+    {"name": "holographic", "slug": "holographic", "title": "Holographic Estate", "sdk": "docker"},
+    {"name": "immune", "slug": "immune", "title": "IMMUNE — Verifiable AI Defense Matrix", "sdk": "docker"},
+    {"name": "killinchu", "slug": "killinchu", "title": "killinchu — Andean Drone Intelligence", "sdk": "docker"},
+    {"name": "lambda-gate-holo", "slug": "lambda-gate-holo", "title": "Λ Gate — Conjecture 1, never green", "sdk": "static"},
+    {"name": "llm-router-live", "slug": "llm-router-live", "title": "SZL LLM Router", "sdk": "docker"},
+    {"name": "README", "slug": "readme", "title": "SZL Holdings — Governed-AI Command Platform", "sdk": "static"},
+    {"name": "receipt-chain-live", "slug": "receipt-chain-live", "title": "Receipt Chain Live", "sdk": "static"},
+    {"name": "sda", "slug": "sda", "title": "SZL SDA", "sdk": "docker"},
+    {"name": "szl-blocked-live", "slug": "szl-blocked-live", "title": "szl-blocked-live", "sdk": "static"},
+    {"name": "szl-estate-live", "slug": "szl-estate-live", "title": "Khipu Loom — Governed AI Estate", "sdk": "static"},
+    {"name": "szl-forge-lab", "slug": "szl-forge-lab", "title": "SZL Forge Lab", "sdk": "gradio"},
+    {"name": "szl-govsign-live", "slug": "szl-govsign-live", "title": "szl-govsign-live", "sdk": "static"},
+    {"name": "szl-kernels-live", "slug": "szl-kernels-live", "title": "SZL Kernel Operations Hub", "sdk": "static"},
+    {"name": "szl-model-inference-lab", "slug": "szl-model-inference-lab", "title": "SZL Model Inference Lab", "sdk": "docker"},
+    {"name": "szl-provctl-live", "slug": "szl-provctl-live", "title": "szl-provctl-live", "sdk": "static"},
+    {"name": "yarqa", "slug": "yarqa", "title": "yarqa — Plug-Flow Compartments (live or sample, always honest)", "sdk": "docker"},
 ]
-# Names we DO reverse-proxy (allowlist). Order preserved for the fallback index.
-PROXY_SPACES = [n for n in ALL_SPACES if n not in ("a11oy", "killinchu")]
+_SPACE_BY_NAME = {sp["name"]: sp for sp in SPACE_INVENTORY}
+_SPACE_BY_SLUG = {sp["slug"]: sp for sp in SPACE_INVENTORY}
+
+ALL_SPACES = [sp["slug"] for sp in SPACE_INVENTORY]
+HANDOFF_SPACES = list(ALL_SPACES)
+# Backwards-compatible public name retained for downstream inventory checks.
+PROXY_SPACES = HANDOFF_SPACES
+
+_NO_STORE_HEADERS = {
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+    "X-SZL-Space-Handoff": "canonical-origin",
+}
 
 
-def hf_url(name: str) -> str:
-    """Canonical HF app URL for a Space name (lowercase, org-prefixed)."""
-    return f"https://{_ORG_PREFIX}{name}.hf.space"
+def _space_record(identifier: str) -> dict[str, str]:
+    """Resolve only audited inventory identifiers; fail closed otherwise."""
 
+    record = _SPACE_BY_NAME.get(identifier) or _SPACE_BY_SLUG.get(identifier)
+    if record is None:
+        raise ValueError("unknown Space identifier: %s" % identifier)
+    return record
 
-# Hop-by-hop headers (RFC 7230 §6.1) — never forwarded across the proxy boundary.
-_HOP_BY_HOP = {
-    "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
-    "te", "trailers", "transfer-encoding", "upgrade",
-    # content-encoding/length are recomputed by our Response; strip to avoid mismatch.
-    "content-encoding", "content-length",
-}
 
-_PROXY_TIMEOUT = 20.0      # the box egress to *.hf.space flaps; give a full page GET room
-                           # to ride through a flap (the health HEAD probe needs less).
-_PROXY_RETRIES = 3         # retry a transient flap several times before honest-degrading.
-_MAX_BYTES = 25 * 1024 * 1024  # 25MB cap per proxied response (Spaces are light pages).
+def hf_url(name: str) -> str:
+    """Return the canonical isolated application origin for an audited Space."""
 
+    record = _space_record(name)
+    suffix = ".static.hf.space" if record["sdk"] == "static" else ".hf.space"
+    return f"https://{_ORG_PREFIX}{record['slug']}{suffix}"
 
-def _honest_502(name: str) -> bytes:
-    """Clean 502 page — NEVER a fake 200. Tells the user to open the Space directly."""
-    url = hf_url(name)
-    return (
-        "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">"
-        "<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">"
-        "<title>Space %s — starting / unreachable</title></head>"
-        "<body style=\"margin:0;background:#0b0f14;color:#cdd6e0;"
-        "font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;"
-        "display:flex;min-height:100vh;align-items:center;justify-content:center\">"
-        "<main style=\"max-width:560px;padding:2rem;text-align:center\">"
-        "<div style=\"font-size:2.2rem;margin-bottom:.4rem\">&#9889;</div>"
-        "<h1 style=\"font-size:1.25rem;margin:0 0 .6rem;color:#e7eef6\">"
-        "Space &ldquo;%s&rdquo; is starting or unreachable</h1>"
-        "<p style=\"color:#8a96a3;margin:0 0 1.2rem\">The upstream Hugging Face Space did "
-        "not respond in time. This is an honest 502 &mdash; not a faked page. "
-        "It usually means the Space is waking from sleep; try again shortly.</p>"
-        "<p><a href=\"%s\" style=\"color:#d4a444;text-decoration:none;font-weight:600\">"
-        "Open %s directly on Hugging Face &rarr;</a></p>"
-        "<p style=\"margin-top:1.4rem\"><a href=\"/spaces\" "
-        "style=\"color:#7c8794;text-decoration:none\">&larr; All Spaces</a></p>"
-        "</main></body></html>" % (name, name, url, name)
-    ).encode("utf-8")
+
+def hf_repo_url(name: str) -> str:
+    """Return the canonical Hugging Face repository page for an audited Space."""
+
+    record = _space_record(name)
+    return f"https://huggingface.co/spaces/{_ORG}/{record['name']}"
 
 
 def _fallback_index() -> bytes:
-    """Minimal honest /spaces index — used ONLY if szl_spaces_surface (the rich tiles
-    page) is not registered. Lists every Space name with both links. 0 CDN."""
+    """Render the dependency-free fallback registry with canonical links only."""
+
     rows = []
-    for name in ALL_SPACES:
-        if name in ("a11oy", "killinchu"):
-            local = hf_url(name)  # own canonical host (not self-proxied here)
-            local_label = "Open on HF"
-        else:
-            local = "/spaces/%s" % name
-            local_label = "Open in a-11-oy.com"
+    for record in SPACE_INVENTORY:
+        title = html.escape(record["title"])
+        name = html.escape(record["name"])
+        sdk = html.escape(record["sdk"])
+        canonical = html.escape(hf_url(record["slug"]), quote=True)
+        repository = html.escape(hf_repo_url(record["slug"]), quote=True)
         rows.append(
-            "<li style=\"margin:.4rem 0\"><strong style=\"color:#e7eef6\">%s</strong> "
-            "&middot; <a href=\"%s\" style=\"color:#d4a444;text-decoration:none\">%s</a> "
-            "&middot; <a href=\"%s\" style=\"color:#7c8794;text-decoration:none\">Open on HF</a>"
-            "</li>" % (name, local, local_label, hf_url(name))
+            '<li style="margin:.4rem 0"><strong style="color:#e7eef6">%s</strong> '
+            '<small style="color:#697787">%s &middot; %s</small> '
+            '&middot; <a href="%s" rel="noopener" target="_blank" '
+            'style="color:#d4a444;text-decoration:none">Open isolated app &#8599;</a> '
+            '&middot; <a href="%s" rel="noopener" target="_blank" '
+            'style="color:#7c8794;text-decoration:none">View repository &#8599;</a></li>'
+            % (title, name, sdk, canonical, repository)
         )
     return (
-        "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">"
-        "<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">"
-        "<title>Spaces</title></head>"
-        "<body style=\"margin:0;background:#0b0f14;color:#cdd6e0;"
-        "font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;padding:2rem\">"
-        "<main style=\"max-width:760px;margin:0 auto\">"
-        "<h1 style=\"color:#e7eef6\">Hugging Face Spaces</h1>"
-        "<p style=\"color:#8a96a3\">All live Spaces, surfaced under a-11-oy.com. "
-        "Server-side reverse proxy &mdash; 0 browser CDN.</p>"
-        "<ul style=\"list-style:none;padding:0\">" + "".join(rows) + "</ul>"
+        '<!doctype html><html lang="en"><head><meta charset="utf-8">'
+        '<meta name="viewport" content="width=device-width,initial-scale=1">'
+        '<title>Hugging Face Spaces</title>'
+        '<style>*{box-sizing:border-box}li{overflow-wrap:anywhere}'
+        'li a{display:inline-flex;align-items:center;min-height:44px;padding:.3rem .15rem}'
+        '@media(max-width:375px){body{padding:1rem!important}}</style></head>'
+        '<body style="margin:0;background:#0b0f14;color:#cdd6e0;'
+        'font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif;padding:2rem">'
+        '<main style="max-width:760px;margin:0 auto">'
+        '<h1 style="color:#e7eef6">Hugging Face Spaces</h1>'
+        '<p style="color:#8a96a3">All 26 audited Spaces open on their canonical isolated '
+        'Hugging Face origins. Legacy <code>/spaces/&lt;slug&gt;</code> links are no-store '
+        '307 handoffs; no upstream response bytes or cookies cross this application.</p>'
+        '<ul style="list-style:none;padding:0">' + "".join(rows) + "</ul>"
         "</main></body></html>"
     ).encode("utf-8")
 
 
-def _resolve_client() -> Any:
-    """Resolve the app's shared httpx.AsyncClient lazily from serve.py's module global
-    (same idiom as szl_engine_status) so registration order doesn't matter."""
+def _raw_query(request: Any) -> str | None:
+    raw = request.scope.get("query_string", b"")
     try:
-        import serve as _serve  # type: ignore
-        return getattr(_serve, "_http_client", None)
-    except Exception:
+        query = bytes(raw).decode("ascii")
+    except (UnicodeDecodeError, TypeError, ValueError):
         return None
+    if "\r" in query or "\n" in query:
+        return None
+    return query
 
 
-def _urllib_fetch(method: str, url: str, headers: dict, timeout: float):
-    """Blocking stdlib fetch — the PROVEN-working outbound path on the live box
-    (a11oy_hf_assets.py reaches HF via urllib server-side). Used as a fallback when the
-    shared httpx.AsyncClient is None or fails. Returns (status, body_bytes, headers_dict).
-    Raises on failure (caller degrades to an honest 502). 0 browser CDN; no auth token."""
-    import http.client
-    import urllib.error
-    import urllib.request
-    req = urllib.request.Request(url, method=method.upper(), headers=headers)
-    try:
-        with urllib.request.urlopen(req, timeout=timeout) as r:
-            status = getattr(r, "status", None) or r.getcode()
-            hdrs = {k: v for k, v in r.headers.items()}
-            # Read the body TOLERANTLY: a flapping upstream often drops the connection
-            # mid-stream (http.client.IncompleteRead). The status line + headers already
-            # arrived fine, so return whatever body bytes we got rather than 502-ing a
-            # response that was really a 200. This is honest: status reflects the REAL
-            # upstream status; we just don't discard a near-complete page over a late EOF.
-            try:
-                body = r.read(_MAX_BYTES)
-            except http.client.IncompleteRead as ire:
-                body = ire.partial or b""
-            except Exception:
-                body = b""
-            return status, body, hdrs
-    except urllib.error.HTTPError as he:  # a real upstream non-2xx is NOT a flap
-        body = b""
-        try:
-            body = he.read(_MAX_BYTES)
-        except Exception:
-            pass
-        return he.code, body, {k: v for k, v in (he.headers or {}).items()}
-
-
-async def _to_thread(fn, *a, **kw):
-    import asyncio as _asyncio
-    return await _asyncio.get_event_loop().run_in_executor(None, lambda: fn(*a, **kw))
-
-
-def _rewrite_html(body: bytes, name: str) -> bytes:
-    """Inject <base href="/spaces/<name>/"> so the Space's root-relative asset URLs
-    (e.g. /assets/app.js, href="/"...) resolve back through this proxy. Idempotent:
-    if a base href for this proxy is already present, leave the body untouched."""
-    base_tag = ('<base href="/spaces/%s/">' % name).encode("utf-8")
-    if base_tag in body:
-        return body
-    low = body.lower()
-    # Prefer to place the <base> right after <head ...> so it applies to all assets.
-    h = low.find(b"<head")
-    if h != -1:
-        gt = body.find(b">", h)
-        if gt != -1:
-            return body[: gt + 1] + base_tag + body[gt + 1:]
-    # No <head> — try right after <html ...>.
-    h = low.find(b"<html")
-    if h != -1:
-        gt = body.find(b">", h)
-        if gt != -1:
-            return body[: gt + 1] + base_tag + body[gt + 1:]
-    # No usable anchor — prepend (still better than broken relative assets).
-    return base_tag + body
-
-
-async def _proxy(name: str, subpath: str, request) -> Any:
-    """Reverse-proxy one request to the named Space. Honest 502 on any upstream flap."""
-    from starlette.responses import Response
-
-    if name not in PROXY_SPACES:
-        # Not in the allowlist — either unknown, or a deliberately-skipped self/own-host
-        # Space. 404 (no open proxy). The skipped ones are reachable as tiles only.
-        return Response(content=b"Unknown or non-proxied Space.\n",
-                        status_code=404, media_type="text/plain")
-
-    # Resolve the shared async httpx client if it's wired. On the LIVE box serve.py runs
-    # as __main__ (Dockerfile CMD ["python","serve.py"]), so `import serve` inside
-    # _resolve_client() binds a SECOND module object whose startup() never fired and whose
-    # _http_client is therefore None — even though the real __main__ app has a live client.
-    # We must NOT 502 on a None client: the stdlib urllib path below is the PROVEN outbound
-    # path on this box (it is exactly what szl_spaces_surface's health probe uses to report
-    # app_reachable=true). So client==None simply means "skip httpx, use urllib" — never an
-    # automatic honest-502. An honest 502 is reserved for a GENUINE upstream flap (both the
-    # httpx attempt AND the urllib fallback exhausted their retries).
-    client = _resolve_client()
-
-    target = hf_url(name) + "/" + subpath
-    # Send a CLEAN, minimal header set rather than forwarding the raw browser headers.
-    # Forwarding the incoming Host (a-11-oy.com) makes HF route to the wrong vhost -> 404,
-    # and forwarding the full browser header set (incl. Accept-Encoding: br, X-Forwarded-*)
-    # was tripping the upstream fetch on the live box. We mirror the proven-working probe:
-    # identity encoding, a simple UA, and only the few request headers that are safe to
-    # pass through. No Host, no cookies, no auth token (public Spaces).
-    _SAFE_PASS = {"accept", "accept-language", "range", "content-type"}
-    fwd_headers = {
-        "User-Agent": "szl-spaces-proxy/1.0",
-        "Accept-Encoding": "identity",
-    }
-    for k, v in request.headers.items():
-        if k.lower() in _SAFE_PASS:
-            fwd_headers[k] = v
-    fwd_headers.setdefault("Accept", "*/*")
-    method = request.method.upper()
-
-    status = None
-    body = b""
-    up_headers: dict = {}
-    last_exc = None
-
-    # Try the shared async httpx client first (streaming-capable, preferred).
-    if client is not None:
-        for _attempt in range(_PROXY_RETRIES + 1):
-            try:
-                upstream = await client.request(
-                    method, target, headers=fwd_headers,
-                    timeout=_PROXY_TIMEOUT, follow_redirects=True,
-                )
-                status = upstream.status_code
-                body = upstream.content or b""
-                up_headers = {k: v for k, v in upstream.headers.items()}
-                break
-            except Exception as e:  # connect/timeout/read error -> try fallback below
-                last_exc = e
-                status = None
-                import asyncio as _a
-                await _a.sleep(0.4 * (_attempt + 1))  # brief backoff across a flap
-
-    # Fallback to the PROVEN stdlib urllib path if httpx was None or failed.
-    if status is None:
-        import asyncio as _a
-        for _attempt in range(_PROXY_RETRIES + 1):
-            try:
-                status, body, up_headers = await _to_thread(
-                    _urllib_fetch, method, target, fwd_headers, _PROXY_TIMEOUT)
-                break
-            except Exception as e:  # genuine upstream flap -> honest 502
-                last_exc = e
-                status = None
-                await _a.sleep(0.5 * (_attempt + 1))  # brief backoff across a flap
-
-    if status is None:
-        print("[spaces-proxy] upstream flap for %s: %r" % (name, last_exc),
-              file=sys.stderr)
-        # Surface the real upstream error class in an honest diagnostic header (the body
-        # stays the clean honest-502 page). Never fabricates a 200.
-        return Response(content=_honest_502(name), status_code=502,
-                        media_type="text/html",
-                        headers={"x-szl-proxy-error": type(last_exc).__name__ if last_exc else "none",
-                                 "x-szl-proxy-target": target})
-
-    if len(body) > _MAX_BYTES:
-        body = body[:_MAX_BYTES]
-    ct = (up_headers.get("content-type") or up_headers.get("Content-Type") or "").lower()
-
-    # HTML: inject <base href> so assets resolve under /spaces/<name>/.
-    if "text/html" in ct:
-        body = _rewrite_html(body, name)
-
-    out_headers = {
-        k: v for k, v in up_headers.items()
-        if k.lower() not in _HOP_BY_HOP
-    }
-    # HEAD must carry no body.
-    if method == "HEAD":
-        body = b""
-
-    return Response(content=body, status_code=status,
-                    headers=out_headers,
-                    media_type=ct or None)
-
-
-def register(app, ns: str = "a11oy") -> str:
-    """ADDITIVE: mount the /spaces reverse-proxy routes at the FRONT of the router so
-    they beat the SPA + Node-proxy catch-alls. try/except-guarded by the caller."""
+async def _proxy(name: str, subpath: str, request: Any) -> Any:
+    """Legacy function name; perform a redirect-only canonical-origin handoff."""
+
+    from starlette.responses import RedirectResponse, Response
+
+    if name not in HANDOFF_SPACES:
+        return Response(
+            content=b"Unknown or non-handoff Space.\n",
+            status_code=404,
+            media_type="text/plain",
+            headers={"Cache-Control": "no-store"},
+        )
+
+    query = _raw_query(request)
+    if query is None:
+        return Response(
+            content=b"Invalid query string.\n",
+            status_code=400,
+            media_type="text/plain",
+            headers={"Cache-Control": "no-store"},
+        )
+
+    target = hf_url(name)
+    clean_path = subpath.lstrip("/")
+    if clean_path:
+        encoded_path = quote(clean_path, safe="/%:@!$&'()*+,;=-._~")
+        target += "/" + encoded_path
+    if query:
+        target += "?" + query
+
+    return RedirectResponse(target, status_code=307, headers=_NO_STORE_HEADERS)
+
+
+def register(app: Any, ns: str = "a11oy") -> str:
+    """Front-insert the fallback index and redirect-only compatibility routes."""
+
     try:
         from starlette.responses import Response
-    except Exception as e:  # pragma: no cover
-        return "unavailable: %r" % (e,)
+        from starlette.routing import Route
+    except Exception as exc:  # pragma: no cover
+        return "unavailable: %r" % (exc,)
 
     n_before = len(app.router.routes)
 
-    async def _spaces_index(request):
-        # Delegate the rich tiles page to szl_spaces_surface if it owns /spaces; this
-        # fallback index only renders if that module isn't present. Idempotent: this
-        # route is inserted only once per register() and register() is guarded upstream.
+    async def _spaces_index(request: Any) -> Any:
+        headers = {"Cache-Control": "no-store"}
         if request.method.upper() == "HEAD":
-            return Response(content=b"", status_code=200, media_type="text/html")
-        return Response(content=_fallback_index(), status_code=200,
-                        media_type="text/html")
+            return Response(content=b"", status_code=200, media_type="text/html", headers=headers)
+        return Response(
+            content=_fallback_index(),
+            status_code=200,
+            media_type="text/html",
+            headers=headers,
+        )
 
-    async def _spaces_name(request):
-        name = request.path_params.get("name", "")
-        return await _proxy(name, "", request)
+    async def _spaces_name(request: Any) -> Any:
+        return await _proxy(request.path_params.get("name", ""), "", request)
 
-    async def _spaces_path(request):
-        name = request.path_params.get("name", "")
-        subpath = request.path_params.get("path", "")
-        return await _proxy(name, subpath, request)
+    async def _spaces_path(request: Any) -> Any:
+        return await _proxy(
+            request.path_params.get("name", ""),
+            request.path_params.get("path", ""),
+            request,
+        )
 
-    from starlette.routing import Route
-    # NOTE: szl_spaces_surface registers its OWN richer /spaces tiles page and inserts
-    # it at the front AFTER this module (it's registered second in serve.py), so the
-    # tiles page wins over this fallback index — by design. Both are idempotent.
     routes = [
-        Route("/spaces", _spaces_index, methods=["GET", "HEAD"]),
-        Route("/spaces/{name}", _spaces_name, methods=["GET", "HEAD"]),
-        Route("/spaces/{name}/{path:path}", _spaces_path, methods=["GET", "HEAD"]),
+        Route("/spaces", _spaces_index, methods=["GET", "HEAD"], name="spaces-fallback-index"),
+        Route("/spaces/{name}", _spaces_name, methods=["GET", "HEAD"], name="spaces-handoff-root"),
+        Route(
+            "/spaces/{name}/{path:path}",
+            _spaces_path,
+            methods=["GET", "HEAD"],
+            name="spaces-handoff-path",
+        ),
     ]
-    for r in routes:
-        app.router.routes.append(r)
-
+    app.router.routes.extend(routes)
     new = app.router.routes[n_before:]
     del app.router.routes[n_before:]
     app.router.routes[0:0] = new
-    print("[%s] Spaces reverse-proxy registered: /spaces + /spaces/{name} + "
-          "/spaces/{name}/{path} (%d proxied: %s) [moved %d routes to front]"
-          % (ns, len(PROXY_SPACES), ",".join(PROXY_SPACES), len(new)), file=sys.stderr)
-    return "ok: %d proxied spaces, %d routes" % (len(PROXY_SPACES), len(new))
 
+    print(
+        "[%s] Spaces canonical-origin handoffs registered: /spaces + "
+        "/spaces/{name} + /spaces/{name}/{path} (%d audited handoffs; %d routes)"
+        % (ns, len(HANDOFF_SPACES), len(new)),
+        file=sys.stderr,
+    )
+    return "ok: %d canonical handoff spaces, %d routes" % (len(HANDOFF_SPACES), len(new))
 
-# ---------------------------------------------------------------------------
-# Self-test — pure stdlib + starlette TestClient; no real network. Stubs the shared
-# client to assert: allowlist enforced (unknown -> 404), honest 502 on a dead client,
-# <base href> injection, HEAD carries no body, and the fallback index lists all 11.
-# ---------------------------------------------------------------------------
-if __name__ == "__main__":
-    import ast as _ast
-    # parse-self guard
-    with open(__file__, "r", encoding="utf-8") as _fh:
-        _ast.parse(_fh.read())
-
-    # base-href injection
-    out = _rewrite_html(b"<html><head><title>x</title></head><body>hi</body></html>", "immune")
-    assert b'<base href="/spaces/immune/">' in out, "must inject base href"
-    assert _rewrite_html(out, "immune") == out, "base href injection must be idempotent"
-
-    # honest 502 content
-    p = _honest_502("sda")
-    assert b"honest 502" in p and b"szlholdings-sda.hf.space" in p, "502 must be honest + direct link"
 
-    # allowlist
-    assert "a11oy" not in PROXY_SPACES and "killinchu" not in PROXY_SPACES, "self/own-host skipped"
-    assert len(ALL_SPACES) == 11 and len(PROXY_SPACES) == 9, (len(ALL_SPACES), len(PROXY_SPACES))
-
-    # fallback index lists all 11 names
-    idx = _fallback_index()
-    for nm in ALL_SPACES:
-        assert nm.encode() in idx, "index missing %s" % nm
+if __name__ == "__main__":
+    import ast
+    from pathlib import Path
+
+    source = Path(__file__).read_text(encoding="utf-8")
+    ast.parse(source)
+    assert "urllib" + ".request" not in source
+    assert "client." + "request(" not in source
+    assert "upstream." + "content" not in source
+
+    assert len(ALL_SPACES) == len(HANDOFF_SPACES) == 26
+    assert hf_url("README") == "https://szlholdings-readme.static.hf.space"
+    assert hf_url("immune") == "https://szlholdings-immune.hf.space"
+    try:
+        hf_url("notreal")
+        raise AssertionError("unknown Space identifier must fail closed")
+    except ValueError:
+        pass
+
+    fallback = _fallback_index()
+    for space in SPACE_INVENTORY:
+        assert space["name"].encode() in fallback
+        assert space["title"].encode() in fallback
+        assert hf_url(space["slug"]).encode() in fallback
+        assert hf_repo_url(space["slug"]).encode() in fallback
+    assert b'href="/spaces/' not in fallback
+    assert b"reverse proxy" not in fallback.lower()
 
     from starlette.applications import Starlette
     from starlette.responses import PlainTextResponse
-    from starlette.routing import Route as _R
+    from starlette.routing import Route
     from starlette.testclient import TestClient
 
-    a = Starlette(routes=[_R("/{full_path:path}", lambda req: PlainTextResponse("SPA"))])
-    st = register(a, ns="a11oy")
-    assert st.startswith("ok:"), st
-    c = TestClient(a)
-    # /spaces fallback index resolves before the SPA catch-all and lists all names
-    r = c.get("/spaces")
-    assert r.status_code == 200 and "immune" in r.text and "killinchu" in r.text, r.status_code
-    # unknown / non-proxied name -> 404 (no open proxy); a11oy is deliberately skipped
-    assert c.get("/spaces/a11oy").status_code == 404, "a11oy must not be self-proxied"
-    assert c.get("/spaces/notreal").status_code == 404, "unknown -> 404"
-    # known name, no shared client wired AND the (urllib) upstream fetch fails -> honest 502
-    # (never a fake 200). We stub _urllib_fetch so the test is hermetic (no real network):
-    # client==None must NOT short-circuit to 502 by itself; it must fall through to urllib,
-    # and only a GENUINE fetch failure degrades honestly. This is the regression guard for
-    # the live __main__/import-serve dual-module bug (client==None on the box) that was
-    # making EVERY proxied Space 502 even though the urllib probe reached the upstream fine.
-    # NB: stub the global in THIS running module (serve runs us as __main__, and _proxy
-    # resolves _urllib_fetch via the module global at call time), so monkeypatch globals().
-    _self_mod = sys.modules[__name__]
-    _orig_fetch = _self_mod._urllib_fetch
-    def _boom(*_a, **_k):
-        raise OSError("simulated upstream flap")
-    _self_mod._urllib_fetch = _boom
-    try:
-        r502 = c.get("/spaces/immune")
-        assert r502.status_code == 502 and "honest 502" in r502.text, (r502.status_code, r502.text[:80])
-        assert r502.headers.get("x-szl-proxy-error") == "OSError", r502.headers.get("x-szl-proxy-error")
-        rh = c.head("/spaces/immune")
-        assert rh.status_code == 502, rh.status_code
-    finally:
-        _self_mod._urllib_fetch = _orig_fetch
-    # client==None + urllib SUCCESS -> 200 proxied (proves None no longer auto-502s).
-    def _ok(method, url, headers, timeout):
-        return 200, b"<html><head></head><body>live immune</body></html>", {"content-type": "text/html"}
-    _self_mod._urllib_fetch = _ok
-    try:
-        r200 = c.get("/spaces/immune")
-        assert r200.status_code == 200, r200.status_code
-        assert b'<base href="/spaces/immune/">' in r200.content, "must inject base href on proxied HTML"
-    finally:
-        _self_mod._urllib_fetch = _orig_fetch
-
-    print("szl_spaces_proxy: ALL OK (allowlist; honest 502 on genuine flap; client==None "
-          "falls through to urllib not auto-502; base-href idempotent; "
-          "%d proxied of %d; 0 CDN server-side fetch)" % (len(PROXY_SPACES), len(ALL_SPACES)))
+    app = Starlette(routes=[Route("/{full_path:path}", lambda req: PlainTextResponse("SPA"))])
+    status = register(app, ns="killinchu")
+    assert status.startswith("ok:")
+    client = TestClient(app)
+
+    root = client.get(
+        "/spaces/immune",
+        headers={"Cookie": "private=session", "Authorization": "Bearer private"},
+        follow_redirects=False,
+    )
+    assert root.status_code == 307
+    assert root.headers["location"] == "https://szlholdings-immune.hf.space"
+    assert root.headers["cache-control"] == "no-store"
+    assert root.headers["x-szl-space-handoff"] == "canonical-origin"
+    assert "set-cookie" not in root.headers and root.content == b""
+
+    nested = client.get(
+        "/spaces/immune/api/events?cursor=a%2Fb&cursor=two+words",
+        follow_redirects=False,
+    )
+    assert nested.status_code == 307
+    assert nested.headers["location"] == (
+        "https://szlholdings-immune.hf.space/api/events?cursor=a%2Fb&cursor=two+words"
+    )
+    head = client.head("/spaces/immune/assets/app.js?build=7", follow_redirects=False)
+    assert head.status_code == 307 and head.content == b""
+    assert head.headers["location"].endswith("/assets/app.js?build=7")
+    assert client.get("/spaces/notreal", follow_redirects=False).status_code == 404
+    own = client.get("/spaces/a11oy", follow_redirects=False)
+    assert own.status_code == 307
+    assert own.headers["location"] == "https://szlholdings-a11oy.hf.space"
+
+    print(
+        "szl_spaces_proxy: ALL OK (26 audited redirect-only handoffs; "
+        "path/query preserved; no-store; no upstream bytes/Set-Cookie)"
+    )

szl_spaces_surface.py

@@ -3,8 +3,8 @@
 # © 2026 Lutar, Stephen P. — SZL Holdings · ORCID 0009-0001-0110-4173
 """szl_spaces_surface.py — console "Spaces" surface (health API + tiles + nav).
 
-ADDITIVE, self-contained, SHARED (byte-identical in a11oy + killinchu). The console
-companion to szl_spaces_proxy: a LIVE health view of the whole HF Spaces estate plus a
+ADDITIVE, self-contained, SHARED across a11oy + killinchu. The console companion to
+the canonical handoff module: a LIVE health view of the whole HF Spaces estate plus a
 clean tiles page and ONE idempotent nav item, following the additive-injector pattern
 (a11oy_nav_wireup.py / killinchu_nav_wireup.py).
 
@@ -12,20 +12,21 @@ ROUTES (additive, inserted at the FRONT of the router so they beat the SPA + Nod
 catch-alls — same route-to-front idiom as a11oy_hf_assets.py):
 
   GET  /api/<ns>/v1/spaces/health  -> for each Space, an HONEST status:
-        {name, title, stage, app_reachable, url, proxy_url}
+        {name, slug, title, sdk, stage, app_reachable, url, canonical_url, proxy_url}
         - stage          : runtime.stage from the HF API
                            (https://huggingface.co/api/spaces/SZLHOLDINGS/<name>),
                            or "unknown" if that API call degrades. LABELLED as HF-API.
-        - app_reachable  : a REAL same-origin server-side probe of
+        - app_reachable  : a REAL server-side probe of
                            https://szlholdings-<name>.hf.space/ (HEAD, short timeout).
                            true ONLY when the probe really succeeded. Never fabricated.
         Degrade -> stage:"unknown", app_reachable:false. NEVER a faked stage/200.
 
   GET/HEAD /spaces                 -> a clean tiles page (one card per Space: honest
-        title, live status dot fed by /health, "Open in a-11-oy.com" -> /spaces/<name>,
-        "Open on HF" -> hf.space url). Pure inline markup, 0 browser CDN. The status
-        dots are filled by a tiny inline fetch of the SAME-ORIGIN /health JSON (not a
-        CDN; the data is our own server-side-probed endpoint).
+        title, live status dot fed by /health, canonical isolated hf.space app link,
+        and a separate huggingface.co repository link).
+        No upstream app executes inside the a11oy or Killinchu origin. Pure inline
+        markup, 0 browser CDN. Status dots are filled by a tiny inline fetch of the
+        SAME-ORIGIN /health JSON (our own server-side-probed endpoint).
 
 NAV: a BaseHTTPMiddleware injector adds ONE nav item "Spaces" -> /spaces into the
 console left-nav (before <div class="side-foot">, with nav-group / nav-item fallbacks).
@@ -54,25 +55,46 @@ from typing import Any
 
 _ORG = "SZLHOLDINGS"
 _ORG_PREFIX = "szlholdings-"
-
-# The 11 live Spaces + their honest, public titles (NOT codenames — each Space's own
-# name). a11oy + killinchu are listed as tiles linking to their own canonical hosts;
-# they are NOT reverse-proxied by szl_spaces_proxy (self / own-host).
+SPACE_TILE_ORIGIN_MODE = "canonical-isolated-hf/v1"
+
+# Audited 26-Space public estate. Names are exact Hub repository names and titles are
+# the current public card titles observed during the 2026-07-16 alignment audit. Runtime
+# state is deliberately NOT frozen here: /health measures it on every cache refresh and
+# degrades to unknown/false when evidence is unavailable. ``slug`` is the lowercase,
+# same-origin route key; it differs from ``name`` only for the Hub repository ``README``.
+# a11oy + killinchu retain the historical own-host classification in the health payload,
+# but every tile now opens its canonical isolated Hugging Face application origin.
 SPACES: list[dict[str, str]] = [
-    {"name": "immune",              "title": "Immune — Verifiable Screening"},
-    {"name": "sda",                 "title": "SDA — Space Domain Awareness"},
-    {"name": "anatomy",             "title": "Anatomy — Canonical Formula Registry"},
-    {"name": "cathedral",           "title": "Cathedral — Estate Cathedral"},
-    {"name": "energy",              "title": "Energy — Sovereign Compute"},
-    {"name": "yarqa",               "title": "Yarqa — Data Channel"},
-    {"name": "khipu-constellation", "title": "Khipu Constellation — Receipt Mesh"},
-    {"name": "llm-router-live",     "title": "LLM Router (Live)"},
-    {"name": "hatun-mcp",           "title": "Hatun — MCP Server"},
-    {"name": "a11oy",               "title": "a11oy — Brand Orchestration Layer"},
-    {"name": "killinchu",           "title": "Killinchu — Edge Console"},
+    {"name": "a11oy", "slug": "a11oy", "title": "a11oy — Command Center", "sdk": "docker"},
+    {"name": "anatomy", "slug": "anatomy", "title": "SZL Living Anatomy", "sdk": "docker"},
+    {"name": "cosmos", "slug": "cosmos", "title": "SZL Cosmos", "sdk": "docker"},
+    {"name": "david-leads", "slug": "david-leads", "title": "David Leads — Sovereign Insurance Intelligence", "sdk": "docker"},
+    {"name": "energy-attest-holo", "slug": "energy-attest-holo", "title": "Energy Attestation Holo", "sdk": "static"},
+    {"name": "energy-attested-runs", "slug": "energy-attested-runs", "title": "Energy-Attested Inference Runs", "sdk": "gradio"},
+    {"name": "governed-norm-holo", "slug": "governed-norm-holo", "title": "Governed Norms — WILLAY classifiers", "sdk": "static"},
+    {"name": "governed-receipt-verifier", "slug": "governed-receipt-verifier", "title": "Governed Receipt Verifier", "sdk": "static"},
+    {"name": "guardrail-receipt", "slug": "guardrail-receipt", "title": "Guardrail Decision-Receipt", "sdk": "gradio"},
+    {"name": "hatun-mcp", "slug": "hatun-mcp", "title": "hatun — MCP Server", "sdk": "docker"},
+    {"name": "holographic", "slug": "holographic", "title": "Holographic Estate", "sdk": "docker"},
+    {"name": "immune", "slug": "immune", "title": "IMMUNE — Verifiable AI Defense Matrix", "sdk": "docker"},
+    {"name": "killinchu", "slug": "killinchu", "title": "killinchu — Andean Drone Intelligence", "sdk": "docker"},
+    {"name": "lambda-gate-holo", "slug": "lambda-gate-holo", "title": "Λ Gate — Conjecture 1, never green", "sdk": "static"},
+    {"name": "llm-router-live", "slug": "llm-router-live", "title": "SZL LLM Router", "sdk": "docker"},
+    {"name": "README", "slug": "readme", "title": "SZL Holdings — Governed-AI Command Platform", "sdk": "static"},
+    {"name": "receipt-chain-live", "slug": "receipt-chain-live", "title": "Receipt Chain Live", "sdk": "static"},
+    {"name": "sda", "slug": "sda", "title": "SZL SDA", "sdk": "docker"},
+    {"name": "szl-blocked-live", "slug": "szl-blocked-live", "title": "szl-blocked-live", "sdk": "static"},
+    {"name": "szl-estate-live", "slug": "szl-estate-live", "title": "Khipu Loom — Governed AI Estate", "sdk": "static"},
+    {"name": "szl-forge-lab", "slug": "szl-forge-lab", "title": "SZL Forge Lab", "sdk": "gradio"},
+    {"name": "szl-govsign-live", "slug": "szl-govsign-live", "title": "szl-govsign-live", "sdk": "static"},
+    {"name": "szl-kernels-live", "slug": "szl-kernels-live", "title": "SZL Kernel Operations Hub", "sdk": "static"},
+    {"name": "szl-model-inference-lab", "slug": "szl-model-inference-lab", "title": "SZL Model Inference Lab", "sdk": "docker"},
+    {"name": "szl-provctl-live", "slug": "szl-provctl-live", "title": "szl-provctl-live", "sdk": "static"},
+    {"name": "yarqa", "slug": "yarqa", "title": "yarqa — Plug-Flow Compartments (live or sample, always honest)", "sdk": "docker"},
 ]
-# Spaces served on their OWN canonical host (not reverse-proxied here): the tile's
-# primary "open" link points at HF rather than /spaces/<name>.
+_SPACE_BY_NAME = {sp["name"]: sp for sp in SPACES}
+_SPACE_BY_SLUG = {sp["slug"]: sp for sp in SPACES}
+# Product Spaces retained as metadata for consumers that distinguish flagship hosts.
 _OWN_HOST = {"a11oy", "killinchu"}
 
 _DOCTRINE = {
@@ -85,22 +107,47 @@ _DOCTRINE = {
 
 _PROBE_TIMEOUT = 6.0
 _HF_API_TIMEOUT = 6.0
-_HEALTH_CACHE_TTL = 20.0  # seconds — keep the tiles page snappy without re-probing 11x.
+_HEALTH_CACHE_TTL = 20.0  # seconds — keep the tiles page snappy without re-probing 26x.
 _HEALTH_CACHE: dict[str, Any] = {"ts": 0.0, "payload": None}
+_RUNNING_STAGES = {"RUNNING"}
+
+
+def _space_record(identifier: str) -> dict[str, str]:
+    """Resolve only audited inventory identifiers; fail closed for unknown names."""
+    record = _SPACE_BY_NAME.get(identifier) or _SPACE_BY_SLUG.get(identifier)
+    if record is None:
+        raise ValueError("unknown Space identifier: %s" % identifier)
+    return record
 
 
 def hf_url(name: str) -> str:
-    return f"https://{_ORG_PREFIX}{name}.hf.space"
+    record = _space_record(name)
+    host_suffix = ".static.hf.space" if record["sdk"] == "static" else ".hf.space"
+    return f"https://{_ORG_PREFIX}{record['slug']}{host_suffix}"
 
 
 def hf_api_url(name: str) -> str:
-    return f"https://huggingface.co/api/spaces/{_ORG}/{name}"
+    record = _space_record(name)
+    return f"https://huggingface.co/api/spaces/{_ORG}/{record['name']}"
+
+
+def hf_repo_url(name: str) -> str:
+    record = _space_record(name)
+    return f"https://huggingface.co/spaces/{_ORG}/{record['name']}"
+
+
+def canonical_url(name: str) -> str:
+    """Canonical isolated application origin for an audited Space."""
+    return hf_url(name)
 
 
 def proxy_url(name: str) -> str:
-    """Where the tile's primary "open" link points. Own-host Spaces -> their HF host;
-    everyone else -> the same-origin reverse proxy at /spaces/<name>."""
-    return hf_url(name) if name in _OWN_HOST else f"/spaces/{name}"
+    """Deprecated compatibility alias for ``canonical_url``.
+
+    No upstream Space executes under the host application's origin; interactive
+    apps, streaming, cookies, and authentication stay isolated on Hugging Face.
+    """
+    return canonical_url(name)
 
 
 def _resolve_client() -> Any:
@@ -143,17 +190,21 @@ async def _probe_one(client: Any, sp: dict[str, str]) -> dict[str, Any]:
     """HONEST per-Space status. app_reachable is a REAL HEAD probe; stage is from the
     HF API. Any failure degrades to honest false/'unknown' — never fabricated."""
     name = sp["name"]
+    slug = sp["slug"]
     result: dict[str, Any] = {
         "name": name,
+        "slug": slug,
         "title": sp["title"],
+        "sdk": sp["sdk"],
         "url": hf_url(name),
+        "canonical_url": canonical_url(name),
         "proxy_url": proxy_url(name),
-        "own_host": name in _OWN_HOST,
+        "own_host": slug in _OWN_HOST,
         "stage": "unknown",         # from HF API; HF-API-labelled below
         "stage_source": "hf-api",
         "app_reachable": False,     # REAL probe; only true when the probe truly succeeds
     }
-    # (1) REAL same-origin liveness probe of the Space app. Try the shared async httpx
+    # (1) REAL liveness probe of the canonical Space app. Try the shared async httpx
     #     client first; on None/failure fall back to the PROVEN stdlib urllib path.
     probed = False
     if client is not None:
@@ -214,14 +265,45 @@ async def _probe_one(client: Any, sp: dict[str, str]) -> dict[str, Any]:
         except Exception as e:
             result["stage_error"] = type(e).__name__
 
+    result["state"] = _space_health_state(result)
     return result
 
 
+def _space_health_state(space: dict[str, Any]) -> str:
+    """Derive one conservative, user-facing state from observed row evidence."""
+    reachable = bool(space.get("app_reachable"))
+    stage = str(space.get("stage") or "unknown").upper()
+    if reachable and stage in _RUNNING_STAGES:
+        return "LIVE"
+    if not reachable and stage == "UNKNOWN":
+        return "UNAVAILABLE"
+    return "DEGRADED"
+
+
+def _aggregate_health_state(spaces: list[dict[str, Any]]) -> str:
+    """Derive a conservative top-level state from the observed Space rows."""
+    if not spaces:
+        return "UNAVAILABLE"
+    states = [_space_health_state(row) for row in spaces]
+    if all(state == "LIVE" for state in states):
+        return "LIVE"
+    if all(state == "UNAVAILABLE" for state in states):
+        return "UNAVAILABLE"
+    return "DEGRADED"
+
+
 async def spaces_health() -> dict[str, Any]:
-    """Aggregate honest health for all 11 Spaces (short TTL cache)."""
+    """Aggregate honest health for the audited 26-Space estate (short TTL cache)."""
     now = time.monotonic()
     if _HEALTH_CACHE["payload"] is not None and (now - _HEALTH_CACHE["ts"]) < _HEALTH_CACHE_TTL:
-        return _HEALTH_CACHE["payload"]
+        cached = _HEALTH_CACHE["payload"]
+        # Return a new top-level mapping: label the transport as CACHED while
+        # preserving the original aggregate verdict for auditability.
+        return {
+            **cached,
+            "state": "CACHED",
+            "cached_state": cached.get("state", "UNAVAILABLE"),
+        }
 
     client = _resolve_client()
     # Probe every Space concurrently. _probe_one handles client=None internally by
@@ -231,14 +313,17 @@ async def spaces_health() -> dict[str, Any]:
     spaces = list(await _asyncio.gather(*[_probe_one(client, sp) for sp in SPACES]))
 
     payload = {
+        "state": _aggregate_health_state(spaces),
         "count": len(spaces),
         "spaces": spaces,
         "labels": {
+            "state": "Fresh: LIVE only when every app is reachable and HF reports RUNNING; otherwise DEGRADED or UNAVAILABLE. TTL reuse is CACHED with cached_state.",
+            "space_state": "LIVE requires app_reachable:true plus HF stage RUNNING; partial evidence is DEGRADED",
             "stage": "HF API runtime.stage (https://huggingface.co/api/spaces/SZLHOLDINGS/<name>)",
-            "app_reachable": "REAL same-origin server-side HEAD/GET probe of the Space app",
+            "app_reachable": "REAL server-side HEAD/GET probe of the canonical Space app",
             "degrade": "stage:'unknown' + app_reachable:false; never fabricated",
         },
-        "note": "Server-side probed; 0 browser CDN. Honest live/unknown only.",
+        "note": "Server-side probed; 0 browser CDN. Honest LIVE/DEGRADED/UNAVAILABLE; cache reuse is explicitly CACHED.",
         "doctrine": _DOCTRINE,
         "fetchedAt": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
     }
@@ -256,52 +341,71 @@ def _tiles_page(ns: str) -> bytes:
     cards = []
     for sp in SPACES:
         name = sp["name"]
+        slug = sp["slug"]
         title = sp["title"]
-        primary = proxy_url(name)
-        primary_label = "Open on HF" if name in _OWN_HOST else "Open in a-11-oy.com"
+        primary = canonical_url(name)
+        primary_label = "Open isolated app"
         cards.append(
             '<article class="sp-card" data-space="%s">'
             '<header class="sp-head">'
             '<span class="sp-dot" data-dot="%s" title="status">&#9679;</span>'
             '<h2 class="sp-title">%s</h2></header>'
+            '<div class="sp-kind">%s &middot; %s</div>'
             '<div class="sp-stage" data-stage="%s">stage: <span>checking&hellip;</span></div>'
             '<div class="sp-links">'
-            '<a class="sp-open" href="%s">%s</a>'
-            '<a class="sp-hf" href="%s" rel="noopener" target="_blank">Open on HF &#8599;</a>'
+            '<a class="sp-open" href="%s" rel="noopener" target="_blank">%s &#8599;</a>'
+            '<a class="sp-hf" href="%s" rel="noopener" target="_blank">View repository &#8599;</a>'
             '</div></article>'
-            % (name, name, title, name, primary, primary_label, hf_url(name))
+            % (slug, slug, title, name, sp["sdk"], slug,
+               primary, primary_label, hf_repo_url(name))
         )
     html = (
         '<!doctype html><html lang="en"><head><meta charset="utf-8">'
         '<meta name="viewport" content="width=device-width,initial-scale=1">'
-        '<title>Spaces &middot; a11oy</title>'
+        '<title>Spaces &middot; ' + ns + '</title>'
         '<style>'
         ':root{color-scheme:dark}'
         '*{box-sizing:border-box}'
         'body{margin:0;background:#0b0f14;color:#cdd6e0;'
         'font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif}'
-        '.sp-wrap{max-width:1100px;margin:0 auto;padding:2rem 1.25rem}'
+        '.sp-wrap{max-width:1100px;margin:0 auto;padding:2rem 1.25rem;min-width:0}'
         '.sp-h1{color:#e7eef6;font-size:1.6rem;margin:0 0 .25rem}'
-        '.sp-sub{color:#8a96a3;margin:0 0 1.6rem}'
-        '.sp-grid{display:grid;gap:1rem;'
+        '.sp-sub{color:#8a96a3;margin:0 0 .75rem;overflow-wrap:anywhere}'
+        '.sp-health{display:flex;align-items:center;gap:.45rem;min-height:44px;'
+        'color:#8a96a3;margin:0 0 1rem}'
+        '.sp-health strong{border:1px solid #3b4654;border-radius:999px;padding:.22rem .55rem;'
+        'color:#9fb0c0;font-size:.76rem;letter-spacing:.04em}'
+        '.sp-health strong.live{border-color:#3ad07a;color:#3ad07a}'
+        '.sp-health strong.degraded{border-color:#c9a23a;color:#c9a23a}'
+        '.sp-health strong.unavailable{border-color:#e0593a;color:#e0593a}'
+        '.sp-health strong.cached,.sp-health strong.checking{border-color:#697787;color:#9fb0c0}'
+        '.sp-grid{display:grid;gap:1rem;min-width:0;'
         'grid-template-columns:repeat(auto-fill,minmax(260px,1fr))}'
         '.sp-card{background:#121821;border:1px solid #1d2632;border-radius:12px;'
-        'padding:1rem 1.1rem;display:flex;flex-direction:column;gap:.5rem}'
-        '.sp-head{display:flex;align-items:center;gap:.55rem}'
+        'padding:1rem 1.1rem;display:flex;flex-direction:column;gap:.5rem;min-width:0}'
+        '.sp-head{display:flex;align-items:center;gap:.55rem;min-width:0}'
         '.sp-dot{color:#5b6675;font-size:.7rem;line-height:1}'
         '.sp-dot.up{color:#3ad07a}.sp-dot.down{color:#e0593a}.sp-dot.unknown{color:#c9a23a}'
-        '.sp-title{font-size:1rem;margin:0;color:#e7eef6;font-weight:600}'
-        '.sp-stage{color:#7c8794;font-size:.82rem}'
+        '.sp-title{font-size:1rem;margin:0;color:#e7eef6;font-weight:600;min-width:0;overflow-wrap:anywhere}'
+        '.sp-kind{color:#697787;font-size:.76rem;overflow-wrap:anywhere}'
+        '.sp-stage{color:#7c8794;font-size:.82rem;overflow-wrap:anywhere}'
         '.sp-stage span{color:#9fb0c0}'
         '.sp-links{margin-top:auto;display:flex;gap:.9rem;flex-wrap:wrap;padding-top:.4rem}'
+        '.sp-links a{display:inline-flex;align-items:center;min-height:44px;padding:.4rem .15rem}'
         '.sp-open{color:#d4a444;text-decoration:none;font-weight:600}'
         '.sp-hf{color:#7c8794;text-decoration:none}'
-        '.sp-foot{color:#5b6675;font-size:.8rem;margin-top:1.6rem}'
+        '.sp-foot{color:#5b6675;font-size:.8rem;margin-top:1.6rem;overflow-wrap:anywhere}'
+        '@media(max-width:375px){'
+        '.sp-wrap{padding:1.25rem .75rem}.sp-grid{grid-template-columns:minmax(0,1fr)}'
+        '.sp-links{gap:.15rem}.sp-links a{flex:1 1 100%}}'
         '</style></head>'
         '<body><main class="sp-wrap">'
         '<h1 class="sp-h1">Hugging Face Spaces</h1>'
-        '<p class="sp-sub">All live Spaces, surfaced on a-11-oy.com &mdash; server-side '
-        'reverse proxy + honest live health. 0 browser CDN.</p>'
+        '<p class="sp-sub">All 26 audited Spaces in one evidence-labelled registry. '
+        'Apps open on their canonical isolated Hugging Face origin; health is probed '
+        'server-side. Legacy <code>/spaces/&lt;slug&gt;</code> links are no-store 307 handoffs.</p>'
+        '<p class="sp-health">Estate health: '
+        '<strong id="sp-estate-health" class="checking" aria-live="polite">CHECKING</strong></p>'
         '<div class="sp-grid">' + "".join(cards) + '</div>'
         '<p class="sp-foot">Status dot &amp; stage are filled from the same-origin '
         '<code>/api/' + ns + '/v1/spaces/health</code> endpoint (real server-side probe '
@@ -309,16 +413,33 @@ def _tiles_page(ns: str) -> bytes:
         '</main>'
         '<script>'
         '(function(){'
-        'fetch("/api/' + ns + '/v1/spaces/health").then(function(r){return r.json();})'
-        '.then(function(d){(d.spaces||[]).forEach(function(s){'
-        'var card=document.querySelector(\'[data-space="\'+s.name+\'"]\');if(!card)return;'
+        'var estate=document.getElementById("sp-estate-health");'
+        'function estateState(raw,cached){'
+        'var allowed={LIVE:1,DEGRADED:1,UNAVAILABLE:1,CACHED:1};'
+        'raw=String(raw||"UNAVAILABLE").toUpperCase();if(!allowed[raw])raw="UNAVAILABLE";'
+        'var label=raw;if(raw==="CACHED")label="CACHED \\u00b7 "+String(cached||"UNAVAILABLE").toUpperCase()+" snapshot";'
+        'if(estate){estate.className=raw.toLowerCase();estate.textContent=label;}}'
+        'function healthUnavailable(){estateState("UNAVAILABLE");'
+        'var cards=document.querySelectorAll(".sp-card");for(var i=0;i<cards.length;i++){'
+        'var dot=cards[i].querySelector(".sp-dot");if(dot){dot.classList.remove("up","unknown");'
+        'dot.classList.add("down");dot.title="UNAVAILABLE / health fetch failed";}'
+        'var st=cards[i].querySelector(".sp-stage span");if(st)st.textContent="UNAVAILABLE \\u00b7 health fetch failed";}}'
+        'fetch("/api/' + ns + '/v1/spaces/health").then(function(r){'
+        'if(!r.ok)throw new Error("health "+r.status);return r.json();})'
+        '.then(function(d){estateState(d.state,d.cached_state);(d.spaces||[]).forEach(function(s){'
+        'var card=document.querySelector(\'[data-space="\'+(s.slug||s.name)+\'"]\');if(!card)return;'
         'var dot=card.querySelector(".sp-dot");'
+        'var stage=String(s.stage||"unknown").toUpperCase();'
+        'var state=String(s.state||((s.app_reachable&&stage==="RUNNING")?"LIVE":'
+        '((s.app_reachable||stage!=="UNKNOWN")?"DEGRADED":"UNAVAILABLE"))).toUpperCase();'
+        'if(state!=="LIVE"&&state!=="DEGRADED"&&state!=="UNAVAILABLE")state="UNAVAILABLE";'
         'if(dot){dot.classList.remove("up","down","unknown");'
-        'dot.classList.add(s.app_reachable?"up":(s.stage&&s.stage!=="unknown"?"unknown":"down"));'
-        'dot.title=(s.app_reachable?"reachable":"unreachable")+" / stage:"+(s.stage||"unknown");}'
+        'dot.classList.add(state==="LIVE"?"up":(state==="DEGRADED"?"unknown":"down"));'
+        'dot.title=state+" / "+(s.app_reachable?"reachable":"unreachable")+" / stage:"+(s.stage||"unknown");}'
         'var st=card.querySelector(".sp-stage span");'
-        'if(st){st.textContent=(s.stage||"unknown")+(s.app_reachable?" \\u00b7 reachable":" \\u00b7 unreachable");}'
-        '});}).catch(function(){});'
+        'if(st){st.textContent=state+" \\u00b7 "+(s.stage||"unknown")+'
+        '(s.app_reachable?" \\u00b7 reachable":" \\u00b7 unreachable");}'
+        '});}).catch(healthUnavailable);'
         '})();'
         '</script>'
         '</body></html>'
@@ -340,9 +461,9 @@ def _nav_item() -> bytes:
     """ONE 'Spaces' nav item, mirroring the console's own nav-item markup so it inherits
     the console styling (0 CDN, 0 codename). Globe glyph; honest label."""
     return (
-        '<div class="nav-item" data-nav-spaces="hf1" data-wireup-path="/spaces" '
-        'onclick="location.href=\'/spaces\'" style="cursor:pointer">'
-        '<span class="ico">\U0001F310</span>Spaces</div>'
+        '<a class="nav-item" data-nav-spaces="hf1" data-wireup-path="/spaces" '
+        'href="/spaces" style="cursor:pointer;text-decoration:none">'
+        '<span class="ico">\U0001F310</span>Spaces</a>'
     ).encode("utf-8")
 
 
@@ -404,7 +525,6 @@ def register(app, ns: str = "a11oy") -> str:
     at the FRONT of the router (beat the SPA + Node-proxy catch-alls), and attach the
     idempotent 'Spaces' nav injector. try/except-guarded by the caller."""
     try:
-        from fastapi.responses import JSONResponse  # noqa: F401
         from starlette.responses import Response, JSONResponse as _JSON
     except Exception as e:  # pragma: no cover
         return "unavailable: %r" % (e,)
@@ -414,12 +534,13 @@ def register(app, ns: str = "a11oy") -> str:
 
     async def _health(request):
         payload = await spaces_health()
-        return _JSON(payload)
+        return _JSON(payload, headers={"Cache-Control": "no-store"})
 
     async def _tiles(request):
+        headers = {"Cache-Control": "no-store"}
         if request.method.upper() == "HEAD":
-            return Response(content=b"", status_code=200, media_type="text/html")
-        return Response(content=tiles, status_code=200, media_type="text/html")
+            return Response(content=b"", status_code=200, media_type="text/html", headers=headers)
+        return Response(content=tiles, status_code=200, media_type="text/html", headers=headers)
 
     from starlette.routing import Route
     routes = [
@@ -446,7 +567,7 @@ def register(app, ns: str = "a11oy") -> str:
 # ---------------------------------------------------------------------------
 # Self-test — pure stdlib + starlette TestClient; no real network. Stubs the shared
 # client to assert: health degrades honestly (no client -> stage unknown + reachable
-# false), tiles page lists ALL 11 names + has the health-fetch JS, nav injects exactly
+# false), tiles page lists ALL 26 names + has the health-fetch JS, nav injects exactly
 # once + is idempotent + removes nothing, /spaces is NOT nav-injected.
 # ---------------------------------------------------------------------------
 if __name__ == "__main__":
@@ -454,15 +575,33 @@ if __name__ == "__main__":
     with open(__file__, "r", encoding="utf-8") as _fh:
         _ast.parse(_fh.read())
 
-    assert len(SPACES) == 11, len(SPACES)
+    assert len(SPACES) == 26, len(SPACES)
     tp = _tiles_page("a11oy")
     for sp in SPACES:
         assert sp["name"].encode() in tp, "tiles missing %s" % sp["name"]
         assert sp["title"].encode() in tp, "tiles missing title %s" % sp["title"]
+        assert canonical_url(sp["name"]).encode() in tp, "tiles missing canonical app origin"
+        assert hf_repo_url(sp["name"]).encode() in tp, "tiles missing repository link"
+        assert proxy_url(sp["name"]) == canonical_url(sp["name"]), "primary link must stay isolated"
     assert b"/api/a11oy/v1/spaces/health" in tp, "tiles must fetch the health endpoint"
     assert b"http://" not in tp, "tiles must be 0 CDN (no http://)"
-    # the only https in the page should be the hf.space open links (server-named, fine)
-    assert tp.count(b"https://huggingface.co") == 0, "tiles must not pull from HF CDN"
+    assert b'href="/spaces/' not in tp, "tiles must not execute an app under this origin"
+    assert b"canonical isolated Hugging Face origin" in tp
+    # Repository anchors are navigation only; no browser asset is loaded from HF.
+    assert tp.count(b"https://huggingface.co/spaces/") == len(SPACES)
+    assert b'<script src="https://' not in tp and b'<link href="https://' not in tp
+
+    running = {"app_reachable": True, "app_status": 200, "stage": "RUNNING"}
+    unknown = {"app_reachable": False, "stage": "unknown"}
+    http_200_unknown = {"app_reachable": True, "app_status": 200, "stage": "unknown"}
+    assert _aggregate_health_state([running, dict(running)]) == "LIVE"
+    assert _aggregate_health_state([unknown, dict(unknown)]) == "UNAVAILABLE"
+    assert _aggregate_health_state([running, unknown]) == "DEGRADED"
+    assert _aggregate_health_state([http_200_unknown]) == "DEGRADED", \
+        "HTTP 200 alone must never upgrade aggregate state to LIVE"
+    assert _space_health_state(running) == "LIVE"
+    assert _space_health_state(unknown) == "UNAVAILABLE"
+    assert _space_health_state(http_200_unknown) == "DEGRADED"
 
     from starlette.applications import Starlette
     from starlette.responses import HTMLResponse, PlainTextResponse
@@ -489,23 +628,36 @@ if __name__ == "__main__":
     assert st.startswith("ok:"), st
     c = TestClient(app)
 
-    # health: no httpx client wired -> falls back to the stdlib urllib probe (the proven
-    # outbound path on the box). Assert SHAPE + honesty: every space has a boolean
-    # app_reachable and a string stage; values are REAL (network) or honest unknown/false
-    # (no network) -- never fabricated. We do NOT require network in CI: both outcomes ok.
-    h = c.get("/api/a11oy/v1/spaces/health").json()
-    assert h["count"] == 11, h["count"]
+    # health: no httpx client wired -> falls back to the stdlib urllib probe. Stub that
+    # final outbound path so this self-test is hermetic and verifies the exact honest
+    # degrade contract for every audited Space (no network, no fabricated green state).
+    _self_mod = sys.modules[__name__]
+    _orig_probe = _self_mod._urllib_probe
+    def _offline(*_a, **_k):
+        raise OSError("simulated offline audit")
+    _self_mod._urllib_probe = _offline
+    _HEALTH_CACHE["ts"] = 0.0
+    _HEALTH_CACHE["payload"] = None
+    try:
+        health_response = c.get("/api/a11oy/v1/spaces/health")
+        h = health_response.json()
+    finally:
+        _self_mod._urllib_probe = _orig_probe
+        _HEALTH_CACHE["ts"] = 0.0
+        _HEALTH_CACHE["payload"] = None
+    assert h["count"] == 26, h["count"]
+    assert h["state"] == "UNAVAILABLE", h["state"]
+    assert health_response.headers["cache-control"] == "no-store"
     for s in h["spaces"]:
-        assert isinstance(s["app_reachable"], bool), "app_reachable must be a real bool"
-        assert isinstance(s["stage"], str), "stage must be a string (HF-API or 'unknown')"
-        # honest contract: if not reachable AND no stage, it must be the honest unknown/false
-        if not s["app_reachable"] and s["stage"] == "unknown":
-            pass  # honest degrade -- allowed
+        assert s["app_reachable"] is False, "offline probe must honestly degrade false"
+        assert s["stage"] == "unknown", "offline HF API must honestly degrade unknown"
+        assert s["state"] == "UNAVAILABLE", "offline row must fail closed"
     assert h["doctrine"]["locked_proven"] == ["F1", "F4", "F7", "F11", "F12", "F18", "F19", "F22"]
 
     # tiles page resolves + lists all names
     t = c.get("/spaces")
     assert t.status_code == 200 and "text/html" in t.headers["content-type"], t.status_code
+    assert t.headers["cache-control"] == "no-store"
     for sp in SPACES:
         assert sp["name"] in t.text, "tiles page missing %s" % sp["name"]
 
@@ -514,12 +666,12 @@ if __name__ == "__main__":
     p2 = c.get("/console").text
     assert p1.count('data-nav-spaces="hf1"') == 1, "nav must inject exactly once"
     assert p2.count('data-nav-spaces="hf1"') == 1, "nav must be idempotent"
-    assert "location.href='/spaces'" in p1, "nav must link /spaces"
+    assert 'href="/spaces"' in p1, "nav must link /spaces with a real anchor"
     assert "Operate</div>" in p1 and "Existing</div>" in p1 and "footer</div>" in p1, \
         "must remove nothing from the SPA source"
     assert p1 == p2, "second console render must be byte-identical (idempotent)"
     # the tiles page itself must NOT be nav-injected (it has no console sidebar)
     assert 'data-nav-spaces="hf1"' not in c.get("/spaces").text, "/spaces must not be nav-injected"
 
-    print("szl_spaces_surface: ALL OK (11 spaces; honest degrade; tiles 0-CDN; nav "
-          "idempotent + additive; /spaces not self-injected)")
+    print("szl_spaces_surface: ALL OK (26 canonical isolated links; honest degrade; "
+          "tiles 0-CDN + no-store; nav idempotent + additive; /spaces not self-injected)")