deploy(hf): sync szl-holdings/a11oy@a040ffd0038e0474fb4ee3b10fc77fba9366c43a derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy a040ffd0038e0474fb4ee3b10fc77fba9366c43a.
Files: 1298 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

a11oy_landing.html

@@ -356,6 +356,12 @@
   .chip.simulated .dot{background:var(--gray)}
   .chip.unavailable{color:var(--down);border-color:rgba(232,116,110,0.35);background:rgba(232,116,110,0.07)}
   .chip.unavailable .dot{background:var(--down)}
+  /* Genome catalog tag slot: visually subordinate to the kernel chip so the
+     catalog count can never be mistaken for the Lean-8 kernel count. */
+  .tier .genome-note{margin-top:10px;padding-top:10px;border-top:1px solid var(--border);
+    font-size:.82rem;color:var(--ghost)}
+  .tier .genome-note .n{font-family:var(--mono);color:var(--sub)}
+  .product-card .kc-note{margin-top:10px;font-size:.84rem;color:var(--ghost)}
   .product-card .lam{margin-top:auto;padding-top:14px}
   .honesty .lambda-line{margin:24px 0 0;display:flex;gap:12px;flex-wrap:wrap;align-items:center}
   .honesty .lambda-line .muted{max-width:640px}
@@ -524,11 +530,17 @@
       <div class="status-row">
         <span class="chip software"><span class="dot"></span>SOFTWARE</span>
         <span class="chip simulated"><span class="dot"></span>SIMULATED effectors</span>
+        <span class="chip down" id="kc-runtime"><span class="dot"></span>RUNTIME UNAVAILABLE</span>
       </div>
+      <p class="kc-note" id="kc-runtime-note">This document carries no live reading of the
+        killinchu Space runtime, so the runtime is labelled <b>UNAVAILABLE</b>. The in-page
+        probe below only reports REACHABLE on an actual HTTP 200 this visit; if the request
+        is refused or has timed out, the label stays UNAVAILABLE. The Hugging Face Space hub
+        page is the honest entry point while the runtime is down — it is not a live product
+        surface.</p>
       <div class="lam"><span class="val" id="v-defense">—</span><span class="cap">advisory Λ</span><span id="v-defense-chip"></span></div>
       <div class="golinks">
-        <a class="go" href="/killinchu">Open killinchu →</a>
-        <a class="go" href="https://huggingface.co/spaces/SZLHOLDINGS/killinchu" rel="noopener">Space →</a>
+        <a class="go" href="https://huggingface.co/spaces/SZLHOLDINGS/killinchu" rel="noopener">killinchu Space hub →</a>
       </div>
     </article>
     <article class="card product-card" id="product-forge">
@@ -618,10 +630,14 @@
   <div class="grid g4">
     <div class="tier locked">
       <div class="tnum" id="pt-locked">—</div>
-      <div class="tname">LOCKED-PROVEN</div>
+      <div class="tname">LOCKED-PROVEN · KERNEL</div>
       <p>Lean-8 kernel count from <code>/honest</code> <code>locked_formula_count</code>
         (show 8 or N/A). Not genome catalog LOCKED-PROVEN. F18 is Reed-Solomon
         parity (erasure tolerance), not "DSSE seal".</p>
+      <p class="genome-note">Genome catalog tag LOCKED-PROVEN (a different count, from
+        <code>/api/a11oy/v1/genome</code> <code>tier_counts</code>):
+        <span class="n" id="pt-genome-locked">—</span> of 144 catalog entries. Catalog tag,
+        not the kernel chip above.</p>
     </div>
     <div class="tier semantic">
       <div class="tnum" id="pt-semantic">—</div>
@@ -910,30 +926,61 @@
   }
 
   function setTiers(t){
-    // Catalog tiers only. Kernel Lean-8 chip is loadLockedKernel() from /honest
+    // Catalog tiers only. Kernel Lean-8 chip is loadKernelLocked() from /honest
     // locked_formula_count. Never genome LOCKED-PROVEN. Never proof_tiers.locked.
     $("pt-semantic").textContent   = (num(t.semantic)   === null) ? "N/A" : t.semantic;
     $("pt-evidence").textContent   = (num(t.evidence)   === null) ? "N/A" : t.evidence;
     $("pt-conjecture").textContent = (num(t.conjecture) === null) ? "N/A" : t.conjecture;
   }
-  async function loadLockedKernel(){
+  // Kernel locked-proven chip (#pt-locked) is bound ONLY to the honest kernel
+  // count. It is never bound to a genome catalog tier (tier_counts['LOCKED-PROVEN']
+  // is 25 of 144 — a catalog tag, not the Lean-8 kernel).
+  async function loadKernelLocked(){
     try{
       const h = await getJSON("/api/a11oy/v1/honest");
       const n = num(h && h.locked_formula_count);
       $("pt-locked").textContent = (n === 8) ? "8" : "N/A";
     }catch(e){ $("pt-locked").textContent = "N/A"; }
   }
+  // Genome catalog tag count, rendered in its own slot so it can never be read
+  // as the kernel chip.
   function setCatalogNote(n){
-    let el = $("pt-catalog");
-    if(!el){
-      const grid = document.querySelector("#proof .grid");
-      if(!grid) return;
-      el = document.createElement("p");
-      el.id = "pt-catalog";
-      el.className = "intro";
-      grid.insertAdjacentElement("afterend", el);
+    const el = $("pt-genome-locked");
+    if(!el) return;
+    el.textContent = (num(n)===null) ? "N/A" : String(n);
+  }
+
+  // ---- killinchu runtime honesty ------------------------------------------
+  // The killinchu Space runtime is labelled UNAVAILABLE unless THIS visit gets a
+  // real HTTP 200 from its health endpoint. A refused or timed-out probe is
+  // never read as "live"; nothing about the runtime is asserted from markup.
+  const KC_RUNTIME_PROBE = "https://szlholdings-killinchu.hf.space/api/health";
+  function markKillinchuUnavailable(reason){
+    const chip = $("kc-runtime");
+    if(chip){
+      chip.className = "chip down";
+      chip.innerHTML = '<span class="dot"></span>RUNTIME UNAVAILABLE' + (reason ? (" \u00b7 " + esc(reason)) : "");
+    }
+  }
+  function markKillinchuReachable(){
+    const chip = $("kc-runtime");
+    if(chip){
+      chip.className = "chip live";
+      chip.innerHTML = '<span class="dot"></span>RUNTIME REACHABLE \u00b7 live read this visit';
+    }
+  }
+  async function probeKillinchuRuntime(){
+    const ctl = ("AbortController" in window) ? new AbortController() : null;
+    const timer = ctl ? setTimeout(function(){ ctl.abort(); }, 4000) : null;
+    try{
+      const r = await fetch(KC_RUNTIME_PROBE, { signal: ctl ? ctl.signal : undefined, cache: "no-store" });
+      if(timer) clearTimeout(timer);
+      if(r && r.ok){ markKillinchuReachable(); return; }
+      markKillinchuUnavailable("HTTP " + (r ? r.status : "no response"));
+    }catch(e){
+      if(timer) clearTimeout(timer);
+      markKillinchuUnavailable((e && e.name === "AbortError") ? "probe timed out" : "runtime unreachable");
     }
-    el.textContent = (num(n)===null) ? "" : ("Genome catalog LOCKED-PROVEN = "+n+" (catalog, not kernel). Lean-8 is the kernel; genome-144 is the catalog.");
   }
 
   function setVerticals(v){
@@ -1115,7 +1162,9 @@
   (async function(){
     loadEstatePulse();
     loadOverclaimMetrics();
-    loadLockedKernel();
+    loadKernelLocked();
+    markKillinchuUnavailable();
+    probeKillinchuRuntime();
     const ov = await loadOverview();
     const filled = {
       tiers: $("proof-src").innerHTML.trim() !== "",

pages/console.html

@@ -16313,8 +16313,12 @@ window.warboard_init=warboard_init; window.warboard_all=warboard_all;
   }
 
   async function renderPublications(c){
-    var lockedTxt='8';
-    try{ var g=await window.getJSON(window.API+'/v1/genome'); var lp=(g&&g.tier_counts&&g.tier_counts['LOCKED-PROVEN']); if(typeof lp==='number'&&lp>0) lockedTxt=String(lp); }catch(e){}
+    // The locked-8 kernel count is bound to the honest kernel endpoint
+    // (locked_formula_count over {F1,F4,F7,F11,F12,F18,F19,F22}). It is NEVER
+    // bound to a genome catalog tier count — that catalog tag is a different
+    // number (25 of 144) and rendering it here would misstate the kernel.
+    var lockedTxt='N/A';
+    try{ var hk=await window.getJSON(window.API+'/v1/honest'); var kn=(hk&&hk.locked_formula_count); if(typeof kn==='number'&&kn>0) lockedTxt=String(kn); }catch(e){}
     var h='<div class="pz-wrap">';
     h+='<div class="pz-lead">The shoulders we stand on. SZL’s own program is DOI-pinned on Zenodo; the work it builds on is cited in full with a one-line note on exactly what we adapt. Honest tiers throughout: <b style="color:var(--teal)">'+esc(lockedTxt)+' locked-proven</b> {F1,F4,F7,F11,F12,F18,F19,F22}; Λ-uniqueness = <b style="color:#7e8aa3">Conjecture 1</b> (never green); Khipu BFT safety = Conjecture 2. Every formula’s proof tier is verifiable in <a href="#genome" onclick="go(\'genome\');return false;" style="color:var(--teal)">Genome</a> against <code>/api/a11oy/v1/genome</code>.</div>';
 
@@ -16889,5 +16893,227 @@ window.a11oyInvestor = (function(){
 })();
 </script>
 
+<script>
+/* try-khipu-panel — additive, Command-Center-ONLY "Try Khipu" panel.
+   Doctrine v11. Adds NO nav entry (tabs.json 139-tab gate is untouched) and no
+   new view key: it wraps V.command.render and appends itself to the Command
+   Center body only. Deep links (?view=) are honored so it never mounts on a
+   non-command surface (e.g. Investor View).
+
+   Wire: GET /api/a11oy/v1/khipu/status  (pin + honesty, never signs)
+         POST /api/a11oy/v1/khipu/chat   (same-origin CPU-lab proxy)
+   Honesty rules enforced here:
+     - lab_status is shown verbatim: READY / FAILED / UNAVAILABLE (probe did not
+       resolve THIS request). Never a fabricated READY.
+     - elapsed_ms is MEASURED (server-side wall clock). Token counts are shown
+       only as the lab's own REPORTED usage. No throughput marketing number is
+       computed or displayed anywhere in this panel.
+     - signature is UNSIGNED unless the lab returns a real signature; the
+       receipt hash is shown as record_sha256, UNKNOWN when absent.
+     - the pinned GGUF digest is a SNAPSHOT (pin), GPU inference is ROADMAP,
+       energy attestation is 8/8 SIMULATED (never MEASURED without a live meter).
+     - the inference lab is a CPU inference lab: not a trainer, not Serve Studio,
+       and Ask & Act is not a live control plane.
+     - the proxy authenticates to the lab with the dummy Bearer not-a-secret;
+       no user or repo token is ever put in the browser.
+     - Λ = Conjecture 1 (advisory, gray) — never a theorem, never green.
+*/
+(function(){
+  'use strict';
+  var STATUS_URL='/api/a11oy/v1/khipu/status';
+  var CHAT_URL='/api/a11oy/v1/khipu/chat';
+  var LOCKED_LAB_V1='https://szlholdings-szl-model-inference-lab.hf.space/v1';
+  var HOST_ID='tk-panel-host';
+
+  function esc(s){ return String(s==null?'':s).replace(/[&<>"']/g,function(ch){
+    return ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'})[ch]; }); }
+  function E(id){ return document.getElementById(id); }
+  function H(id,html){ var n=E(id); if(n) n.innerHTML=html; }
+
+  /* 1396 owns ?view= deep links (Investor View). Read the query param FIRST,
+     then the hash, so this panel mounts on the Command Center only. */
+  function currentView(){
+    var q='';
+    try{ q=new URLSearchParams(window.location.search||'').get('view')||''; }catch(e){ q=''; }
+    if(q) return String(q).split('/')[0];
+    var h=String(window.location.hash||'').replace(/^#/,'');
+    if(h) return h.split('/')[0];
+    return 'command';
+  }
+
+  function tone(state){
+    if(state==='READY') return 'tk-ok';
+    if(state==='FAILED'||state==='UNAVAILABLE'||state==='UNKNOWN') return 'tk-warn';
+    return 'tk-dim';
+  }
+  function chip(text,state,title){
+    return '<span class="tk-chip '+tone(state||text)+'"'+(title?' title="'+esc(title)+'"':'')+'>'+esc(text)+'</span>';
+  }
+
+  function shell(){
+    return ''
+      +'<style>'
+      +'#'+HOST_ID+'{margin-top:1.1rem;border:1px solid rgba(201,183,135,.34);border-radius:10px;'
+      +'background:rgba(12,16,18,.45);padding:.95rem 1rem 1.05rem}'
+      +'#'+HOST_ID+' h2{margin:0 0 .15rem;font-size:15px;letter-spacing:.02em;color:var(--cream,#e8e2d4)}'
+      +'#'+HOST_ID+' .tk-sub{margin:.1rem 0 .75rem;font-size:11.5px;line-height:1.65;color:var(--paragraph,#a8a294)}'
+      +'#'+HOST_ID+' .tk-chip{display:inline-block;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;'
+      +'font-size:10px;letter-spacing:.06em;padding:.1rem .38rem;border-radius:4px;margin:0 .25rem .25rem 0;'
+      +'border:1px solid rgba(201,183,135,.4);color:#c9b787}'
+      +'#'+HOST_ID+' .tk-ok{border-color:rgba(95,179,163,.55);color:#5fb3a3}'
+      +'#'+HOST_ID+' .tk-warn{border-color:rgba(201,183,135,.65);color:#c9b787}'
+      +'#'+HOST_ID+' .tk-dim{border-color:rgba(160,160,160,.35);color:#9a958a}'
+      +'#'+HOST_ID+' .tk-grid{display:grid;gap:.5rem;grid-template-columns:repeat(auto-fit,minmax(190px,1fr));margin:.5rem 0}'
+      +'#'+HOST_ID+' .tk-cell{border:1px solid rgba(255,255,255,.07);border-radius:7px;padding:.45rem .55rem}'
+      +'#'+HOST_ID+' .tk-k{font-family:ui-monospace,Menlo,monospace;font-size:9.5px;letter-spacing:.09em;color:#8f8a7e}'
+      +'#'+HOST_ID+' .tk-v{font-family:ui-monospace,Menlo,monospace;font-size:11.5px;color:#e8e2d4;word-break:break-all}'
+      +'#'+HOST_ID+' textarea{width:100%;box-sizing:border-box;min-height:62px;background:rgba(0,0,0,.35);'
+      +'color:#e8e2d4;border:1px solid rgba(255,255,255,.13);border-radius:7px;padding:.45rem .55rem;font-size:12.5px}'
+      +'#'+HOST_ID+' button{margin-top:.45rem;background:rgba(95,179,163,.16);color:#cfe9e2;'
+      +'border:1px solid rgba(95,179,163,.5);border-radius:7px;padding:.35rem .8rem;font-size:12px;cursor:pointer}'
+      +'#'+HOST_ID+' button[disabled]{opacity:.55;cursor:progress}'
+      +'#'+HOST_ID+' .tk-note{font-family:ui-monospace,Menlo,monospace;font-size:10px;line-height:1.7;color:#8f8a7e;margin-top:.55rem}'
+      +'#'+HOST_ID+' pre{white-space:pre-wrap;font-size:12px;line-height:1.6;color:#e8e2d4;margin:.4rem 0 0}'
+      +'</style>'
+      +'<h2>Try Khipu <span id="tk-state">'+chip('PROBING','PROBING')+'</span></h2>'
+      +'<p class="tk-sub">A same-origin proxy to the pinned CPU inference lab '
+      +'(<code>'+esc(LOCKED_LAB_V1)+'</code>). This is an inference lab: '
+      +'<b>not a trainer</b>, <b>not Serve Studio</b>, and Ask &amp; Act on this console is '
+      +'<b>not a live control plane</b>. Prompts go to '
+      +'<code>'+esc(CHAT_URL)+'</code>; posture comes from <code>'+esc(STATUS_URL)+'</code>. '
+      +'Throughput is not reported — we publish only what the lab measures.</p>'
+      +'<div class="tk-grid" id="tk-pin"></div>'
+      +'<label class="tk-k" for="tk-prompt">PROMPT · CLAMPED SERVER-SIDE (max_tokens 32 · temperature 0)</label>'
+      +'<textarea id="tk-prompt" placeholder="What is a khipu receipt?"></textarea>'
+      +'<div><button type="button" id="tk-run">&#9654; Ask the lab</button></div>'
+      +'<div id="tk-out"></div>'
+      +'<p class="tk-note" id="tk-honesty"></p>';
+  }
+
+  function renderPin(d){
+    var pin=(d&&d.pin)||{}, hon=(d&&d.honesty)||{}, doc=(d&&d.doctrine)||{};
+    var st=(d&&d.lab_status)||'UNAVAILABLE';
+    H('tk-state',chip(st,st,'lab posture read from '+STATUS_URL+' this request'));
+    var cells=[
+      ['LAB POSTURE',chip(st,st)+' '+chip(st==='READY'?'probe resolved':'no live probe','')],
+      ['PINNED GGUF sha256','<span class="tk-v">'+esc(pin.gguf_sha256||'UNKNOWN')+'</span> '+chip('SNAPSHOT','SNAPSHOT')],
+      ['GPU INFERENCE ENDPOINT',chip(pin.gpu_inference_endpoint||'ROADMAP','ROADMAP')+' '+chip('CPU lab only today','')],
+      ['ENERGY ATTESTED RUNS','<span class="tk-v">'+esc(hon.energy_attested_runs||pin.energy_attested_runs||'8/8 SIMULATED')+'</span> '+chip('SIMULATED','SIMULATED')+chip('not MEASURED — no live meter','')],
+      ['LOCKED LAB v1','<span class="tk-v">'+esc(pin.locked_lab_v1||LOCKED_LAB_V1)+'</span>'],
+      ['DOCTRINE','<span class="tk-v">locked-'+esc(doc.locked_formulas!=null?doc.locked_formulas:8)+' &middot; \u039b='+esc(doc.lambda||'Conjecture 1')+'</span> '+chip('Conjecture 1','')]
+    ];
+    H('tk-pin',cells.map(function(c){
+      return '<div class="tk-cell"><div class="tk-k">'+esc(c[0])+'</div><div>'+c[1]+'</div></div>';
+    }).join(''));
+    H('tk-honesty','Lab role: '+esc(hon.forge_lab||pin.forge_lab_role||'CPU inference lab \u2014 not a trainer, not Serve Studio')
+      +'<br>Ask &amp; Act: '+esc(hon.ask_and_act||'not a live control plane')
+      +'<br>Auth: the proxy calls the lab with the dummy header <code>Bearer not-a-secret</code>; no repo or user token reaches the browser.'
+      +'<br>Throughput: not reported \u2014 token counts below are the lab\u2019s own REPORTED usage, elapsed time is MEASURED server-side.');
+  }
+
+  function renderUnavailable(msg){
+    H('tk-state',chip('UNAVAILABLE','UNAVAILABLE','status probe did not resolve this request'));
+    H('tk-pin','<div class="tk-cell"><div class="tk-k">LAB POSTURE</div><div>'
+      +chip('UNAVAILABLE','UNAVAILABLE')+'<div class="tk-v">'+esc(msg||'status probe did not resolve')
+      +'</div></div></div>'
+      +'<div class="tk-cell"><div class="tk-k">LOCKED LAB v1</div><div class="tk-v">'+esc(LOCKED_LAB_V1)+'</div></div>'
+      +'<div class="tk-cell"><div class="tk-k">PINNED GGUF sha256</div><div>'+chip('SNAPSHOT','SNAPSHOT')
+      +' '+chip('UNKNOWN','UNKNOWN')+'</div></div>'
+      +'<div class="tk-cell"><div class="tk-k">GPU INFERENCE ENDPOINT</div><div>'+chip('ROADMAP','ROADMAP')+'</div></div>'
+      +'<div class="tk-cell"><div class="tk-k">ENERGY ATTESTED RUNS</div><div class="tk-v">8/8 SIMULATED</div></div>');
+    H('tk-honesty','Lab role: CPU inference lab \u2014 not a trainer, not Serve Studio.'
+      +'<br>Ask &amp; Act: not a live control plane.'
+      +'<br>Auth: dummy header <code>Bearer not-a-secret</code> is used server-side only.'
+      +'<br>Throughput: not reported. \u039b = Conjecture 1 (advisory, never a theorem).');
+  }
+
+  async function loadStatus(){
+    try{
+      var r=await fetch(STATUS_URL,{headers:{accept:'application/json'}});
+      if(!r.ok) throw new Error('HTTP '+r.status);
+      renderPin(await r.json());
+    }catch(e){ renderUnavailable(String(e&&e.message||e)); }
+  }
+
+  async function ask(){
+    var btn=E('tk-run'); var ta=E('tk-prompt');
+    var prompt=((ta&&ta.value)||'').trim();
+    if(!prompt){ H('tk-out','<p class="tk-note">Enter a prompt \u2014 the proxy rejects an empty body (422), it does not invent one.</p>'); return; }
+    if(btn){ btn.disabled=true; btn.textContent='asking the lab\u2026'; }
+    H('tk-out','<p class="tk-note">POST '+esc(CHAT_URL)+' \u2014 waiting on the CPU lab\u2026</p>');
+    try{
+      var r=await fetch(CHAT_URL,{method:'POST',headers:{'content-type':'application/json',accept:'application/json'},
+        body:JSON.stringify({prompt:prompt,max_tokens:32,temperature:0})});
+      var d={}; try{ d=await r.json(); }catch(e){ d={}; }
+      var st=d.lab_status||(r.ok?'READY':'FAILED');
+      var sig=d.signature||'UNSIGNED';
+      var rec=d.record_sha256||'UNKNOWN';
+      var usage=d.usage||{};
+      var el=(d.elapsed_ms!=null?d.elapsed_ms+' ms':'UNKNOWN');
+      var body=(d.ok&&d.text)?('<pre>'+esc(d.text)+'</pre>')
+        :('<p class="tk-note">No completion returned \u2014 shown honestly as '+esc(st)+', nothing fabricated.'
+          +(d.error?(' Lab detail: '+esc(String(d.error).slice(0,200))):'')+'</p>');
+      H('tk-out',body
+        +'<div class="tk-grid">'
+        +'<div class="tk-cell"><div class="tk-k">LAB RESULT</div><div>'+chip(st,st)+' '+chip(d.ok?'ok':'no completion','')+'</div></div>'
+        +'<div class="tk-cell"><div class="tk-k">SIGNATURE</div><div>'+chip(sig,sig==='UNSIGNED'?'UNAVAILABLE':sig)
+        +'<div class="tk-v">'+(sig==='UNSIGNED'?'no in-image signing key in this runtime \u2014 honest UNSIGNED':'as returned by the lab')+'</div></div></div>'
+        +'<div class="tk-cell"><div class="tk-k">record_sha256</div><div class="tk-v">'+esc(rec)+'</div></div>'
+        +'<div class="tk-cell"><div class="tk-k">ELAPSED</div><div class="tk-v">'+esc(el)+'</div>'
+        +'<div>'+chip(d.elapsed_ms_label||'MEASURED','MEASURED','server-side wall clock for this request')+'</div></div>'
+        +'<div class="tk-cell"><div class="tk-k">USAGE (LAB-REPORTED)</div><div class="tk-v">prompt '
+        +esc(usage.prompt_tokens!=null?usage.prompt_tokens:'\u2014')+' &middot; completion '
+        +esc(usage.completion_tokens!=null?usage.completion_tokens:'\u2014')+' &middot; total '
+        +esc(usage.total_tokens!=null?usage.total_tokens:'\u2014')+'</div><div>'
+        +chip(d.usage_label||'REPORTED','')+chip('no throughput number derived','')+'</div></div>'
+        +'<div class="tk-cell"><div class="tk-k">\u039b</div><div>'+chip((d.honesty&&d.honesty.lambda)||'Conjecture 1','')
+        +'<div class="tk-v">advisory \u2014 gray, never green, never a theorem</div></div></div>'
+        +'</div>');
+    }catch(e){
+      H('tk-out','<p class="tk-note">'+chip('UNAVAILABLE','UNAVAILABLE')+' request did not resolve: '
+        +esc(String(e&&e.message||e))+' \u2014 no answer, no signature, no record_sha256 fabricated.</p>');
+    }
+    if(btn){ btn.disabled=false; btn.innerHTML='&#9654; Ask the lab'; }
+    loadStatus();
+  }
+
+  /* Mount into the Command Center body only. */
+  function mount(host){
+    if(!host) return;
+    if(currentView()!=='command') return;
+    if(host.querySelector('#'+HOST_ID)) return;
+    var sec=document.createElement('section');
+    sec.id=HOST_ID;
+    sec.setAttribute('aria-label','Try Khipu');
+    sec.innerHTML=shell();
+    host.appendChild(sec);
+    var btn=E('tk-run'); if(btn) btn.addEventListener('click',ask);
+    loadStatus();
+  }
+
+  function wrap(){
+    var V=window.VIEWS;
+    if(!V||!V.command||typeof V.command.render!=='function') return false;
+    if(V.command.__tryKhipuWrapped) return true;
+    var prev=V.command.render;
+    V.command.render=async function(c){
+      try{ await prev.call(this,c); }catch(e){ /* upstream render owns its own honesty */ }
+      try{ mount(c); }catch(e){}
+      return undefined;
+    };
+    V.command.__tryKhipuWrapped=true;
+    /* Command Center may already be painted (first load) — mount once now. */
+    try{ if(currentView()==='command') mount(document.getElementById('vbody')); }catch(e){}
+    return true;
+  }
+
+  var tries=0;
+  var iv=setInterval(function(){ tries++; if(wrap()||tries>200) clearInterval(iv); },100);
+  if(document.readyState!=='loading'){ wrap(); }
+  else { document.addEventListener('DOMContentLoaded',function(){ wrap(); }); }
+})();
+/* end try-khipu-panel */
+</script>
+
 </body>
 </html>

pages/landing.html

@@ -362,12 +362,15 @@ img,svg,canvas,video{max-width:100%;height:auto;}
         <p class="ds-card__body">Policy, reasoning, operator and counter-UAS in one console. Live gates, signed receipts, and the halt button.</p>
         <span class="ds-btn ds-btn--primary" style="margin-top:8px;align-self:flex-start;">Enter the platform <span class="ds-btn__arrow">→</span></span>
       </a>
-      <a class="ds-card" href="https://szlholdings-killinchu.hf.space/" style="cursor:pointer;">
+      <a class="ds-card" href="https://huggingface.co/spaces/SZLHOLDINGS/killinchu" rel="noopener" style="cursor:pointer;">
         <span class="ds-card__id">// KILLINCHU</span>
         <h3 class="ds-card__title">Drones &amp; Vessels</h3>
         <div class="ds-card__rule"></div>
         <p class="ds-card__body">The maritime &amp; airspace surface: track drones and vessels, run counter-UAS cued engagements through the same governed, signed loop.</p>
-        <span class="ds-btn" style="margin-top:8px;align-self:flex-start;">Open Drones &amp; Vessels <span class="ds-btn__arrow">→</span></span>
+        <p class="ds-card__body"><b>Runtime: UNAVAILABLE.</b> This page holds no live reading of the
+          killinchu Space runtime, so it is not presented as live and the link goes to the Space
+          hub page rather than a runtime that has timed out.</p>
+        <span class="ds-btn" style="margin-top:8px;align-self:flex-start;">Open the killinchu Space hub <span class="ds-btn__arrow">→</span></span>
       </a>
       <a class="ds-card" href="/lyte" style="cursor:pointer;">
         <span class="ds-card__id">// LYTE · BIND</span>
@@ -392,8 +395,8 @@ img,svg,canvas,video{max-width:100%;height:auto;}
       </div>
       <div class="ds-footer__cols">
         <div class="ds-footer__col"><h4>Platform</h4><a href="/console">Command Console</a><a href="/benchmark">Benchmark</a><a href="#what">What it is</a><a href="#diff">Receipts</a><a href="#proof">Proof</a></div>
-        <div class="ds-footer__col"><h4>Surfaces</h4><a href="/console">a11oy</a><a href="https://szlholdings-killinchu.hf.space/">killinchu</a><a href="/lyte">LYTE lattice</a></div>
-        <div class="ds-footer__col"><h4>Live</h4><a href="/api/a11oy/v1/observability/summary">Observability</a><a href="/api/a11oy/v1/lambda">Trust score</a><a href="/api/a11oy/v1/gates">Gates</a></div>
+        <div class="ds-footer__col"><h4>Surfaces</h4><a href="/console">a11oy</a><a href="https://huggingface.co/spaces/SZLHOLDINGS/killinchu" rel="noopener">killinchu (runtime UNAVAILABLE)</a><a href="/lyte">LYTE lattice</a></div>
+        <div class="ds-footer__col"><h4>Endpoints</h4><a href="/api/a11oy/v1/observability/summary">Observability</a><a href="/api/a11oy/v1/lambda">Trust score</a><a href="/api/a11oy/v1/gates">Gates</a></div>
       </div>
     </div>
     <div class="ds-footer__bottom">
@@ -505,6 +508,14 @@ img,svg,canvas,video{max-width:100%;height:auto;}
     var el=document.getElementById(id); if(!el)return;
     el.textContent=val; el.classList.remove("is-loading");
   }
+  // Honest label for a read that produced no live value: name the state, never
+  // paint a fabricated number or a live-looking zero.
+  function unavailableKpi(id,state){
+    var el=document.getElementById(id); if(!el)return;
+    el.textContent=(String(state||"UNAVAILABLE").toUpperCase()==="OBSERVED")?"UNAVAILABLE":("UNAVAILABLE · "+String(state||"UNAVAILABLE"));
+    el.classList.remove("is-loading","is-live");
+    el.style.color="var(--muted)"; el.style.fontSize="16px";
+  }
   function unreachable(id){
     var el=document.getElementById(id); if(!el)return;
     el.textContent="probe slow"; el.classList.remove("is-loading");
@@ -514,11 +525,16 @@ img,svg,canvas,video{max-width:100%;height:auto;}
   // services up + (lambda_status echoed in observability too)
   fetchJSON("/api/a11oy/v1/observability/summary",8000).then(function(j){
     var m=(j&&j.melt&&j.melt.metrics)||{};
-    if(typeof m.organs_reachable==="number"&&typeof m.organs_total==="number"){
+    // organs_reachable is a live count ONLY when the summary's own
+    // observation_state says it was observed this read. An inventory/idle/
+    // UNAVAILABLE state is reported as UNAVAILABLE, never as a live zero.
+    var state=(j&&(j.observation_state||j.state))||"UNAVAILABLE";
+    var observed=String(state).toUpperCase()==="OBSERVED";
+    if(observed&&typeof m.organs_reachable==="number"&&typeof m.organs_total==="number"){
       setKpi("kpiServices",m.organs_reachable+" / "+m.organs_total);
-    } else { unreachable("kpiServices"); }
+    } else { unavailableKpi("kpiServices",state); }
     if(j&&j.honesty){var h=document.getElementById("liveHonesty"); if(h)h.textContent=j.honesty;}
-  }).catch(function(){unreachable("kpiServices");});
+  }).catch(function(){unavailableKpi("kpiServices","UNAVAILABLE");});
 
   // trust score (lambda)
   fetchJSON("/api/a11oy/v1/lambda",8000).then(function(j){

serve.py

@@ -81,6 +81,36 @@ def gov_envelope(payload=None, status="REAL", citations=None, reason=None, **ext
 # console/ there.  Local verification must resolve the same source tree rather
 # than trying to return a container-only path (which turns an otherwise honest
 # 404 or history fallback into a 500).
+# SOURCE-ROOT RESOLUTION (identity-lock root cause). Document handlers used to
+# hardcode /app/<file>. In the HF Docker image /app IS this source tree, but on
+# any other host /app may be absent OR a symlink to a DIFFERENT (stale) checkout,
+# so the handlers silently fell back to the SPA shell and served a document that
+# did not match the repo — /trust lost its product canonical https://a-11-oy.com/trust
+# and "/" served a stale landing. Resolve documents against the running module's
+# own directory FIRST (which IS /app inside the image, so behaviour there is
+# unchanged), and only then against the image path. Honest: the bytes served are
+# always the bytes of the source that is running.
+_SZL_SRC_ROOT = Path(__file__).resolve().parent
+_SZL_IMAGE_ROOT = Path("/app")
+
+
+def _szl_doc(rel: str) -> Path:
+    """Return the readable path for a repo-relative document.
+
+    Prefers the running source tree; falls back to the image root. Returns the
+    source-relative candidate when neither exists so callers keep their honest
+    is_file() guard and their existing SPA/404 fallback.
+    """
+    rel = rel.lstrip("/")
+    local = _SZL_SRC_ROOT / rel
+    if local.is_file():
+        return local
+    image = _SZL_IMAGE_ROOT / rel
+    if image.is_file():
+        return image
+    return local
+
+
 _IMAGE_STATIC_DIR = Path("/app/static")
 _LOCAL_STATIC_DIR = Path(__file__).resolve().parent / "console"
 STATIC_DIR = _IMAGE_STATIC_DIR if (_IMAGE_STATIC_DIR / "index.html").is_file() else _LOCAL_STATIC_DIR
@@ -3926,7 +3956,10 @@ app.add_middleware(
     allow_origins=_CORS_ALLOWED_ORIGINS,
     allow_origin_regex=_CORS_ALLOWED_ORIGIN_REGEX,
     allow_credentials=False,
-    allow_methods=["GET", "POST", "OPTIONS"],
+    # HEAD is declared explicitly: crawlers and uptime monitors HEAD the document
+    # routes, and every document route accepts HEAD, so the CORS preflight answer
+    # must say so instead of implying HEAD is unsupported.
+    allow_methods=["GET", "HEAD", "POST", "OPTIONS"],
     allow_headers=["Content-Type", "Authorization", "X-Requested-With"],
 )
 
@@ -4025,7 +4058,7 @@ from fastapi.responses import RedirectResponse as _PTG_Redirect
 
 _PTG_IMAGE_WEB = Path("/app/web")
 _PTG_LOCAL_WEB = Path(__file__).resolve().parent / "web"
-_PTG_WEB = _PTG_IMAGE_WEB if _PTG_IMAGE_WEB.is_dir() else _PTG_LOCAL_WEB
+_PTG_WEB = _PTG_LOCAL_WEB if _PTG_LOCAL_WEB.is_dir() else _PTG_IMAGE_WEB
 
 def _ptg_serve(filename: str):
     async def _h() -> Response:
@@ -11894,7 +11927,7 @@ async def spa_root():
     # vendored Three.js r160, live receipt/mesh weave-ins + in-browser WebCrypto
     # verify), then the cathedral hero, then the console SPA, then the SPA index.
     # All fallbacks preserved so a missing file never white-screens "/".
-    for _cand in (Path("/app/a11oy_landing.html"), Path("/app/cathedral.html"),
+    for _cand in (_szl_doc("a11oy_landing.html"), _szl_doc("cathedral.html"),
                   PAGES_DIR / "console.html", INDEX_HTML):
         try:
             _cp = Path(_cand)
@@ -12005,7 +12038,7 @@ async def _energy3d_app_js() -> Response:
 
 
 # --- Doctrine v13 organ page routes (ADDITIVE; explicit, win over SPA catch-all) ---
-PAGES_DIR = Path("/app/pages")
+PAGES_DIR = _SZL_SRC_ROOT / "pages" if (_SZL_SRC_ROOT / "pages").is_dir() else Path("/app/pages")
 
 # === ADDITIVE (Yachay CTO + Perplexity Computer Agent, 2026-06-02): wire orphaned ===
 # === genius pages that were BUILT but never registered (fell to SPA shell = a lie). ===
@@ -12042,7 +12075,7 @@ except Exception as _br_e:  # noqa: BLE001
 # only the /api/a11oy/v4/predict* JSON routes. Explicit route wins over SPA catch-all.
 @app.get("/predict")
 async def predict_page() -> Response:
-    f = Path("/app/predict.html")
+    f = _szl_doc("predict.html")
     if f.is_file():
         return FileResponse(f, media_type="text/html")
     return FileResponse(INDEX_HTML, media_type="text/html")
@@ -12052,7 +12085,7 @@ async def predict_page() -> Response:
 # now COPYed to /app/web/canonical.html by the Dockerfile (added in this same commit).
 @app.get("/canonical")
 async def canonical_page() -> Response:
-    f = Path("/app/web/canonical.html")
+    f = _szl_doc("web/canonical.html")
     if f.is_file():
         return FileResponse(f, media_type="text/html")
     return FileResponse(INDEX_HTML, media_type="text/html")
@@ -12062,7 +12095,7 @@ async def canonical_page() -> Response:
 # /app/web/status.html by the Dockerfile already; just needs an explicit route.
 @app.get("/status")
 async def status_page() -> Response:
-    f = Path("/app/web/status.html")
+    f = _szl_doc("web/status.html")
     if f.is_file():
         return FileResponse(f, media_type="text/html")
     return FileResponse(INDEX_HTML, media_type="text/html")
@@ -12081,7 +12114,7 @@ async def status_page() -> Response:
 # Signed-off-by: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
 @app.get("/proof")
 async def proof_replay_page() -> Response:
-    f = Path("/app/web/proof.html")
+    f = _szl_doc("web/proof.html")
     if f.is_file():
         return FileResponse(f, media_type="text/html")
     return FileResponse(INDEX_HTML, media_type="text/html")
@@ -12098,7 +12131,7 @@ async def proof_replay_page() -> Response:
 # Registered BEFORE the SPA /{full_path:path} catch-all so it wins the ordered match.
 @app.get("/trust")
 async def trust_page() -> Response:
-    f = Path("/app/web/trust.html")
+    f = _szl_doc("web/trust.html")
     if f.is_file():
         return FileResponse(f, media_type="text/html")
     return FileResponse(INDEX_HTML, media_type="text/html")
@@ -12210,21 +12243,32 @@ async def _elite_redirect() -> Response:
 app.add_api_route("/elite", _elite_redirect, methods=["GET"], include_in_schema=False)
 
 
-# /killinchu — canonical path bridge. Without an explicit route this path falls
-# through to the A11OY SPA shell and returns a misleading HTTP 200. Keep the
-# bridge server-side so it works without JavaScript at every mobile viewport,
-# and preserve subpaths/query strings for direct links into the live product.
-_KILLINCHU_CANONICAL = "https://szlholdings-killinchu.hf.space"
+# /killinchu — path bridge, honestly labelled. Without an explicit route this path
+# falls through to the A11OY SPA shell and returns a misleading HTTP 200. Keep the
+# bridge server-side so it works without JavaScript at every mobile viewport, and
+# preserve subpaths/query strings.
+#
+# HONESTY (identity-lock): the killinchu Space RUNTIME is not up — a request to
+# szlholdings-killinchu.hf.space times out / errors, so redirecting a visitor there
+# implies a live product that is not serving. The bridge therefore targets the
+# Hugging Face HUB page for the Space (which is always readable and states the
+# runtime's own state), stamps X-SZL-Route-State: UNAVAILABLE_RUNTIME, and links
+# the hub as rel="alternate" — NEVER rel="canonical" (this app does not hand its
+# canonical to a third-party host; product canonical stays on a-11-oy.com).
+_KILLINCHU_HUB = "https://huggingface.co/spaces/SZLHOLDINGS/killinchu"
+_KILLINCHU_RUNTIME_STATE = "UNAVAILABLE_RUNTIME"
 
 
 async def _killinchu_redirect(request: Request, full_path: str = "") -> Response:
-    suffix = f"/{full_path}" if full_path else "/"
-    target = f"{_KILLINCHU_CANONICAL}{suffix}"
-    if request.url.query:
-        target = f"{target}?{request.url.query}"
-    response = _PTG_Redirect(url=target, status_code=307)
-    response.headers["X-SZL-Route-State"] = "CANONICAL_REDIRECT"
-    response.headers["Link"] = f'<{_KILLINCHU_CANONICAL}/>; rel="canonical"'
+    # Deep links cannot be honoured while the runtime is down (no runtime = no
+    # subpath), so every /killinchu/* request lands on the hub page and the
+    # requested subpath is echoed in a header instead of being faked upstream.
+    response = _PTG_Redirect(url=_KILLINCHU_HUB, status_code=307)
+    response.headers["X-SZL-Route-State"] = _KILLINCHU_RUNTIME_STATE
+    response.headers["X-SZL-Killinchu-Hub"] = _KILLINCHU_HUB
+    if full_path:
+        response.headers["X-SZL-Killinchu-Requested-Path"] = f"/{full_path}"
+    response.headers["Link"] = f'<{_KILLINCHU_HUB}>; rel="alternate"'
     return response
 
 
@@ -12248,7 +12292,7 @@ app.add_api_route(
 # baked (Dockerfile COPY) but lacked a route -> soft-404'd to the SPA shell.
 @app.get("/estate-hologram")
 async def estate_hologram_page() -> Response:
-    f = Path("/app/web/estate-hologram.html")
+    f = _szl_doc("web/estate-hologram.html")
     if f.is_file():
         return FileResponse(f, media_type="text/html")
     return FileResponse(INDEX_HTML, media_type="text/html")
@@ -14422,10 +14466,24 @@ except Exception as _ftiers_e:
     _A11OY_FTIERS_DIAG = {"status": "FAILED", "error": repr(_ftiers_e)}
 
 # ============================================================================
-# Canonical host: a-11-oy.com. a11oy.net is SUNSET — app-level 301 redirect so the
-# public URL converges on a-11-oy.com. Read-path-safe (pure Location response, no
-# receipt, no signing). Registered before uvicorn.run so the middleware stack is
-# built with it; passes through the HF Space host + localhost untouched.
+# AYNI IDENTITY LOCK — canonical host: a-11-oy.com (product). a11oy.net is the
+# PROOF REGISTRY, not a sunset domain: this app emits NO .net 301 and exports no
+# SUNSET_DOMAIN. a11oy_canonical_domain.register() only adds the host-aware
+# product Link rel="canonical" header — https://a-11-oy.com/<path> — computed by
+# the app, not Cloudflare, and never huggingface.co/spaces.
+#
+# DNS facts this app records but does NOT change (no DNS is edited from here):
+#   * The apex stays proxied — orange-cloud. Do not grey-cloud the apex; the
+#     grey-cloud path drops the proxy that terminates TLS for the Space.
+#   * The Hugging Face runtime.domains entry for a-11-oy.com may report PENDING
+#     while Cloudflare still serves the apex. PENDING is KALLPA/Stephen DNS; it
+#     is never stamped "domain LIVE" and never rewrites HTML canonicals.
+#   * www.a-11-oy.com GET / is Cloudflare HTTP 404 today — UNAVAILABLE until a
+#     Cloudflare 301 www → apex exists. We do not fabricate a working www.
+#   * Do not add a second HF custom domain. Do not merge PR 1363.
+# Read-path-safe (pure header/Location response, no receipt, no signing).
+# Registered before uvicorn.run so the middleware stack is built with it; passes
+# through the HF Space host + localhost untouched.
 # ============================================================================
 try:
     import a11oy_canonical_domain as _canon_mod