PyPI - capsule-engine - Versions diffs - 0.1.0__py3-none-any.whl - Mend

capsule-engine 0.1.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (288) hide show

capsule_engine/__init__.py +17 -0
capsule_engine/bundle_viewer/__init__.py +21 -0
capsule_engine/bundle_viewer/static/offline_shell.html +1509 -0
capsule_engine/bundle_viewer/viewer.py +57 -0
capsule_engine/cli/__init__.py +5 -0
capsule_engine/cli/bundle_cmd.py +269 -0
capsule_engine/cli/console_cmd.py +70 -0
capsule_engine/cli/constraints_cmd.py +74 -0
capsule_engine/cli/format.py +173 -0
capsule_engine/cli/guard_cmds.py +361 -0
capsule_engine/cli/init_cmds.py +169 -0
capsule_engine/cli/main.py +120 -0
capsule_engine/cli/packs_cmds.py +96 -0
capsule_engine/cli/telemetry_cmd.py +80 -0
capsule_engine/cli/tenant_cmds.py +199 -0
capsule_engine/cli/verify_cmd.py +110 -0
capsule_engine/compiler/__init__.py +13 -0
capsule_engine/compiler/effect_model.py +79 -0
capsule_engine/compiler/vocabulary.py +253 -0
capsule_engine/console/__init__.py +10 -0
capsule_engine/console/api.py +251 -0
capsule_engine/console/components.css +406 -0
capsule_engine/console/console.css +130 -0
capsule_engine/console/console.html +51 -0
capsule_engine/console/console.js +330 -0
capsule_engine/console/gallery.html +274 -0
capsule_engine/console/server.py +137 -0
capsule_engine/console/tokens.css +68 -0
capsule_engine/conversation/__init__.py +88 -0
capsule_engine/conversation/capsules.py +268 -0
capsule_engine/conversation/exchange.py +279 -0
capsule_engine/conversation/merkle.py +80 -0
capsule_engine/conversation/session.py +101 -0
capsule_engine/envcompat.py +15 -0
capsule_engine/events/__init__.py +14 -0
capsule_engine/events/capsule.py +133 -0
capsule_engine/examples/__init__.py +9 -0
capsule_engine/examples/data/tau2_airline/LICENSE-tau2-bench +21 -0
capsule_engine/examples/data/tau2_airline/PROVENANCE.json +70 -0
capsule_engine/examples/data/tau2_airline/hand_labels.json +893 -0
capsule_engine/examples/data/tau2_airline/pilot1_live_gemini-2-5-flash_airline_shift1.jsonl +190 -0
capsule_engine/examples/data/tau2_airline/tau2_committed_claude-3-7-sonnet_airline_trial0.jsonl +556 -0
capsule_engine/examples/data/tau2_airline/tau2_committed_gpt-4-1-mini_airline_trial0.jsonl +480 -0
capsule_engine/examples/data/tau2_airline/tau2_committed_gpt-4-1_airline_trial0.jsonl +496 -0
capsule_engine/examples/data/tau2_airline/tau2_committed_o4-mini_airline_trial0.jsonl +392 -0
capsule_engine/examples/data/tau2_airline/tau2_conversations_claude-3-7-sonnet_airline_4trials.jsonl +200 -0
capsule_engine/examples/tau2_airline_reference.py +460 -0
capsule_engine/examples/tau2_conversation_exchange.py +92 -0
capsule_engine/folds/__init__.py +104 -0
capsule_engine/folds/account_core.py +89 -0
capsule_engine/folds/approval_latency.py +86 -0
capsule_engine/folds/catalog.py +79 -0
capsule_engine/folds/catalog_defs/actions.count_by_developer.yaml +10 -0
capsule_engine/folds/catalog_defs/actions.executed_count.yaml +16 -0
capsule_engine/folds/catalog_defs/actions.last_decision.yaml +12 -0
capsule_engine/folds/catalog_defs/counterparty.seen_before.v2.yaml +34 -0
capsule_engine/folds/catalog_defs/counterparty.seen_before.v3.yaml +38 -0
capsule_engine/folds/catalog_defs/counterparty.seen_before.yaml +28 -0
capsule_engine/folds/catalog_defs/disclosure.class_seen.yaml +29 -0
capsule_engine/folds/catalog_defs/disclosure.statement_seen.yaml +32 -0
capsule_engine/folds/catalog_defs/hold.active_exposure.yaml +44 -0
capsule_engine/folds/catalog_defs/spend.weekly.v2.yaml +38 -0
capsule_engine/folds/catalog_defs/spend.weekly.v3.1.yaml +71 -0
capsule_engine/folds/catalog_defs/spend.weekly.v3.yaml +76 -0
capsule_engine/folds/catalog_defs/spend.weekly.yaml +33 -0
capsule_engine/folds/counterparty_signals.py +179 -0
capsule_engine/folds/definition.py +421 -0
capsule_engine/folds/duration.py +16 -0
capsule_engine/folds/engine.py +436 -0
capsule_engine/folds/errors.py +44 -0
capsule_engine/folds/loader.py +24 -0
capsule_engine/folds/ordering.py +143 -0
capsule_engine/folds/paths.py +25 -0
capsule_engine/folds/record_type_coverage.py +58 -0
capsule_engine/folds/reducers.py +75 -0
capsule_engine/folds/retention_continuity.py +117 -0
capsule_engine/folds/set_membership.py +59 -0
capsule_engine/folds/taxonomy.py +231 -0
capsule_engine/guards/__init__.py +59 -0
capsule_engine/guards/action.py +446 -0
capsule_engine/guards/action_taxonomy.json +27 -0
capsule_engine/guards/action_taxonomy_v2.json +27 -0
capsule_engine/guards/action_taxonomy_v3.json +27 -0
capsule_engine/guards/action_taxonomy_v4.json +27 -0
capsule_engine/guards/action_taxonomy_v5.json +27 -0
capsule_engine/guards/capsule.py +377 -0
capsule_engine/guards/checks/__init__.py +268 -0
capsule_engine/guards/checks/action_class_gate.py +199 -0
capsule_engine/guards/checks/base.py +33 -0
capsule_engine/guards/checks/caps.py +517 -0
capsule_engine/guards/checks/channel_change.py +64 -0
capsule_engine/guards/checks/commitment.py +41 -0
capsule_engine/guards/checks/counterparty_identity_change.py +95 -0
capsule_engine/guards/checks/counterparty_list.py +176 -0
capsule_engine/guards/checks/counterparty_seen_before.py +160 -0
capsule_engine/guards/checks/credential_pattern.py +73 -0
capsule_engine/guards/checks/dedupe.py +259 -0
capsule_engine/guards/checks/destination_rail.py +120 -0
capsule_engine/guards/checks/field_change_count.py +100 -0
capsule_engine/guards/checks/offer_expiry.py +134 -0
capsule_engine/guards/checks/plan_containment.py +180 -0
capsule_engine/guards/checks/price_floor.py +211 -0
capsule_engine/guards/checks/promise_never.py +236 -0
capsule_engine/guards/checks/promise_requires_approval.py +214 -0
capsule_engine/guards/checks/recipient_role.py +117 -0
capsule_engine/guards/checks/recurring_charge.py +49 -0
capsule_engine/guards/checks/refundability.py +46 -0
capsule_engine/guards/checks/release_on_acceptance.py +286 -0
capsule_engine/guards/checks/required_disclosure.py +233 -0
capsule_engine/guards/checks/single_commitment.py +221 -0
capsule_engine/guards/checks/task_authority.py +182 -0
capsule_engine/guards/checks/upfront_amount.py +71 -0
capsule_engine/guards/checks/verify_before_dispatch.py +75 -0
capsule_engine/guards/classes.py +393 -0
capsule_engine/guards/engine.py +926 -0
capsule_engine/guards/history_state.py +127 -0
capsule_engine/guards/plan.py +237 -0
capsule_engine/guards/revocation.py +120 -0
capsule_engine/guards/signing.py +60 -0
capsule_engine/guards/statements.py +62 -0
capsule_engine/guards/tool_call.py +83 -0
capsule_engine/guards/wickets/__init__.py +23 -0
capsule_engine/guards/wickets/catalog.py +75 -0
capsule_engine/guards/wickets/catalog_defs/action_class_gate.v1.1.yaml +38 -0
capsule_engine/guards/wickets/catalog_defs/action_class_gate.v1.2.yaml +52 -0
capsule_engine/guards/wickets/catalog_defs/action_class_gate.yaml +34 -0
capsule_engine/guards/wickets/catalog_defs/caps.v2.yaml +30 -0
capsule_engine/guards/wickets/catalog_defs/caps.v3.yaml +49 -0
capsule_engine/guards/wickets/catalog_defs/caps.v4.yaml +45 -0
capsule_engine/guards/wickets/catalog_defs/caps.v5.1.yaml +53 -0
capsule_engine/guards/wickets/catalog_defs/caps.v5.yaml +43 -0
capsule_engine/guards/wickets/catalog_defs/caps.yaml +17 -0
capsule_engine/guards/wickets/catalog_defs/caps_holds.yaml +18 -0
capsule_engine/guards/wickets/catalog_defs/channel_change.v1.1.yaml +18 -0
capsule_engine/guards/wickets/catalog_defs/channel_change.yaml +10 -0
capsule_engine/guards/wickets/catalog_defs/counterparty_identity_change.yaml +9 -0
capsule_engine/guards/wickets/catalog_defs/counterparty_list.yaml +20 -0
capsule_engine/guards/wickets/catalog_defs/counterparty_seen_before.v2.yaml +15 -0
capsule_engine/guards/wickets/catalog_defs/counterparty_seen_before.v3.yaml +23 -0
capsule_engine/guards/wickets/catalog_defs/counterparty_seen_before.v4.yaml +26 -0
capsule_engine/guards/wickets/catalog_defs/counterparty_seen_before.yaml +14 -0
capsule_engine/guards/wickets/catalog_defs/credential_pattern.yaml +14 -0
capsule_engine/guards/wickets/catalog_defs/dedupe.yaml +19 -0
capsule_engine/guards/wickets/catalog_defs/destination_rail.seller.v1.1.yaml +32 -0
capsule_engine/guards/wickets/catalog_defs/destination_rail.seller.yaml +10 -0
capsule_engine/guards/wickets/catalog_defs/destination_rail.yaml +9 -0
capsule_engine/guards/wickets/catalog_defs/hold_reconcile.yaml +14 -0
capsule_engine/guards/wickets/catalog_defs/material_fields_changed.v1.1.yaml +22 -0
capsule_engine/guards/wickets/catalog_defs/material_fields_changed.yaml +14 -0
capsule_engine/guards/wickets/catalog_defs/offer_expiry.v1.1.yaml +31 -0
capsule_engine/guards/wickets/catalog_defs/offer_expiry.yaml +24 -0
capsule_engine/guards/wickets/catalog_defs/offer_fields_changed.v1.1.yaml +22 -0
capsule_engine/guards/wickets/catalog_defs/offer_fields_changed.yaml +10 -0
capsule_engine/guards/wickets/catalog_defs/price_floor.yaml +32 -0
capsule_engine/guards/wickets/catalog_defs/promise_never.v1.1.yaml +64 -0
capsule_engine/guards/wickets/catalog_defs/promise_never.yaml +16 -0
capsule_engine/guards/wickets/catalog_defs/promise_requires_approval.v1.1.yaml +26 -0
capsule_engine/guards/wickets/catalog_defs/promise_requires_approval.yaml +21 -0
capsule_engine/guards/wickets/catalog_defs/recipient_role.seller.v1.1.yaml +23 -0
capsule_engine/guards/wickets/catalog_defs/recipient_role.seller.v1.2.yaml +24 -0
capsule_engine/guards/wickets/catalog_defs/recipient_role.seller.yaml +10 -0
capsule_engine/guards/wickets/catalog_defs/recipient_role.v1.1.yaml +26 -0
capsule_engine/guards/wickets/catalog_defs/recipient_role.yaml +11 -0
capsule_engine/guards/wickets/catalog_defs/recipient_seen_before.yaml +16 -0
capsule_engine/guards/wickets/catalog_defs/recurring_charge.yaml +9 -0
capsule_engine/guards/wickets/catalog_defs/refundability.v1.1.yaml +15 -0
capsule_engine/guards/wickets/catalog_defs/refundability.yaml +7 -0
capsule_engine/guards/wickets/catalog_defs/release_on_acceptance.seller.v1.1.yaml +44 -0
capsule_engine/guards/wickets/catalog_defs/release_on_acceptance.seller.v1.2.yaml +63 -0
capsule_engine/guards/wickets/catalog_defs/release_on_acceptance.seller.yaml +36 -0
capsule_engine/guards/wickets/catalog_defs/required_disclosure.v1.1.yaml +36 -0
capsule_engine/guards/wickets/catalog_defs/required_disclosure.v1.2.yaml +42 -0
capsule_engine/guards/wickets/catalog_defs/required_disclosure.yaml +25 -0
capsule_engine/guards/wickets/catalog_defs/single_commitment.seller.yaml +14 -0
capsule_engine/guards/wickets/catalog_defs/task_authority.v1.1.yaml +20 -0
capsule_engine/guards/wickets/catalog_defs/task_authority.yaml +8 -0
capsule_engine/guards/wickets/catalog_defs/upfront_amount.v1.1.yaml +19 -0
capsule_engine/guards/wickets/catalog_defs/upfront_amount.yaml +11 -0
capsule_engine/guards/wickets/catalog_defs/verify_before_dispatch.yaml +9 -0
capsule_engine/guards/wickets/definition.py +164 -0
capsule_engine/guards/wickets/errors.py +18 -0
capsule_engine/guards/wickets/loader.py +26 -0
capsule_engine/guards/wickets/retired.py +62 -0
capsule_engine/holds/__init__.py +35 -0
capsule_engine/holds/capsules.py +266 -0
capsule_engine/holds/engine.py +476 -0
capsule_engine/holds/errors.py +29 -0
capsule_engine/holds/policy.py +62 -0
capsule_engine/holds/scope.py +47 -0
capsule_engine/mcp/__init__.py +16 -0
capsule_engine/mcp/config.py +117 -0
capsule_engine/mcp/server.py +338 -0
capsule_engine/mcp/tools.py +424 -0
capsule_engine/packaging.py +60 -0
capsule_engine/packs/__init__.py +45 -0
capsule_engine/packs/backfill_coverage.py +238 -0
capsule_engine/packs/catalog/airline-engagement/AI-BOOTSTRAP.md +53 -0
capsule_engine/packs/catalog/airline-engagement/folds/session_close.yaml +8 -0
capsule_engine/packs/catalog/airline-engagement/pack.yaml +146 -0
capsule_engine/packs/catalog/eu-ai-act/fixtures/trace/good_execution.json +36 -0
capsule_engine/packs/catalog/eu-ai-act/fixtures/trace/oversight_declared.json +36 -0
capsule_engine/packs/catalog/eu-ai-act/fixtures/trace/tampered_execution.json +36 -0
capsule_engine/packs/catalog/eu-ai-act/fixtures/trace/trusted_issuer.jwk.json +5 -0
capsule_engine/packs/catalog/eu-ai-act/obligations-pack-note.md +68 -0
capsule_engine/packs/catalog/eu-ai-act/obligations-register.yaml +761 -0
capsule_engine/packs/catalog/eu-ai-act/pack.yaml +88 -0
capsule_engine/packs/catalog/eu-ai-act/register.yaml +96 -0
capsule_engine/packs/catalog/eu-ai-act-deterministic/fixtures/synthetic_internal_assist_sample.jsonl +6 -0
capsule_engine/packs/catalog/eu-ai-act-deterministic/pack.yaml +580 -0
capsule_engine/packs/catalog/everyday/AI-BOOTSTRAP.md +194 -0
capsule_engine/packs/catalog/everyday/fixtures/mini_ledger.jsonl +45 -0
capsule_engine/packs/catalog/everyday/pack.yaml +480 -0
capsule_engine/packs/catalog/payments-safety/AI-BOOTSTRAP.md +83 -0
capsule_engine/packs/catalog/payments-safety/fixtures/mini_ledger.jsonl +8 -0
capsule_engine/packs/catalog/payments-safety/folds/spend_weekly.yaml +29 -0
capsule_engine/packs/catalog/payments-safety/pack.yaml +112 -0
capsule_engine/packs/catalog/seller/fixtures/mini_ledger.jsonl +83 -0
capsule_engine/packs/catalog/seller/pack.yaml +503 -0
capsule_engine/packs/catalog/standard-vendor/AI-BOOTSTRAP.md +70 -0
capsule_engine/packs/catalog/standard-vendor/folds/session_close.yaml +8 -0
capsule_engine/packs/catalog/standard-vendor/pack.yaml +466 -0
capsule_engine/packs/contract_diff.py +809 -0
capsule_engine/packs/contract_validate.py +185 -0
capsule_engine/packs/corpus_verify.py +126 -0
capsule_engine/packs/enforce.py +81 -0
capsule_engine/packs/errors.py +159 -0
capsule_engine/packs/eu_ai_act_trace_field_map.py +46 -0
capsule_engine/packs/install.py +266 -0
capsule_engine/packs/loader.py +1462 -0
capsule_engine/packs/measurability_report.py +280 -0
capsule_engine/packs/obligation_results.py +72 -0
capsule_engine/packs/pins.py +92 -0
capsule_engine/packs/schema.py +1053 -0
capsule_engine/packs/thresholds.py +146 -0
capsule_engine/packs/trace_attainment.py +188 -0
capsule_engine/packs/trace_reader.py +104 -0
capsule_engine/policy/__init__.py +37 -0
capsule_engine/policy/activation.py +87 -0
capsule_engine/policy/catalog_defs/default.yaml +23 -0
capsule_engine/policy/catalog_defs/holds.yaml +27 -0
capsule_engine/policy/errors.py +46 -0
capsule_engine/policy/limits.py +287 -0
capsule_engine/policy/loader.py +26 -0
capsule_engine/policy/manifest.py +289 -0
capsule_engine/policy/profile.py +281 -0
capsule_engine/policy/resolve.py +224 -0
capsule_engine/register/__init__.py +39 -0
capsule_engine/register/compiler.py +219 -0
capsule_engine/register/errors.py +40 -0
capsule_engine/register/loader.py +247 -0
capsule_engine/register/schema.py +129 -0
capsule_engine/registry/__init__.py +19 -0
capsule_engine/registry/conventions.json +162 -0
capsule_engine/registry/conventions.py +188 -0
capsule_engine/registry/cpb_registry.json +78 -0
capsule_engine/report/__init__.py +62 -0
capsule_engine/report/build.py +267 -0
capsule_engine/report/coverage.py +777 -0
capsule_engine/report/errors.py +35 -0
capsule_engine/report/live_check.py +126 -0
capsule_engine/report/live_history.py +420 -0
capsule_engine/report/model.py +95 -0
capsule_engine/report/render.py +467 -0
capsule_engine/report/replay.py +1677 -0
capsule_engine/report/result.py +504 -0
capsule_engine/report/result_from_folds.py +222 -0
capsule_engine/report/result_from_layers.py +670 -0
capsule_engine/report/sale_bundle.py +864 -0
capsule_engine/report/static/verify.js +451 -0
capsule_engine/schemas/evidence-contract-v0.json +383 -0
capsule_engine/schemas/vendor/epistemic-types.json +21 -0
capsule_engine/schemas/vendor/evidence-result-v0.json +463 -0
capsule_engine/telemetry/__init__.py +9 -0
capsule_engine/telemetry/consent.py +39 -0
capsule_engine/telemetry/events.py +93 -0
capsule_engine/telemetry/fixtures/synthetic_events.jsonl +45 -0
capsule_engine/telemetry/funnel.py +147 -0
capsule_engine/telemetry/record.py +106 -0
capsule_engine/telemetry/sink.py +61 -0
capsule_engine/telemetry/state.py +60 -0
capsule_engine/tenants.py +327 -0
capsule_engine-0.1.0.dist-info/METADATA +47 -0
capsule_engine-0.1.0.dist-info/RECORD +288 -0
capsule_engine-0.1.0.dist-info/WHEEL +5 -0
capsule_engine-0.1.0.dist-info/entry_points.txt +2 -0
capsule_engine-0.1.0.dist-info/licenses/LICENSE +202 -0
capsule_engine-0.1.0.dist-info/licenses/capsule_engine/examples/data/tau2_airline/LICENSE-tau2-bench +21 -0
capsule_engine-0.1.0.dist-info/top_level.txt +1 -0

capsule_engine/bundle_viewer/static/offline_shell.html ADDED Viewed

@@ -0,0 +1,1509 @@
+<!--
+  Vendored from action-state-group/scitt-cose, hosted_profiles/hosted.py,
+  render_bundle_page(offline=True), commit 32e93a03966d63cf4698fbaa0d4f3bc7ee8438c3.
+  Apache-2.0, same license as this repo. Do not hand-edit -- re-run
+  scripts/vendor_bundle_viewer.py against a scitt-cose checkout instead.
+  The one inline <script> tag right after <body> that sets the page's
+  bundle-fragment global is the real embed slot, swapped in at
+  bundle-creation time by capsule_ledger/bundle_viewer/viewer.py with the
+  real bundle fragment. Other appearances of that same placeholder text
+  further down are BUNDLE_JS's own placeholder-detection/re-splice logic
+  (the download button) -- do not touch those when substituting.
+-->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Ledger bundle verifier — capsule-ledger</title>
+<style>
+  :root{
+    --ink:#0B0E14; --ink-2:#161B25; --paper:#FCFCFA; --paper-2:#F4F4F0;
+    --line:#E3E3DC; --line-2:#2A313F;
+    --muted:#5C6573; --muted-2:#9AA3B2;
+    --accent:#3A5BD9; --accent-soft:#EAEEFC;
+    --pass:#127A52; --pass-soft:#E6F2EC;
+    --fail:#B3261E; --fail-soft:#FBEAE8;
+    --mono:'IBM Plex Mono',ui-monospace,SFMono-Regular,Menlo,monospace;
+  }
+  *{margin:0;padding:0;box-sizing:border-box}
+  body{font-family:system-ui,sans-serif;background:var(--paper);color:var(--ink);line-height:1.6;-webkit-font-smoothing:antialiased}
+  a{color:inherit}
+  .wrap{max-width:980px;margin:0 auto;padding:0 32px}
+  .mono{font-family:var(--mono)}
+  nav{position:sticky;top:0;z-index:50;background:rgba(252,252,250,0.9);backdrop-filter:blur(10px);border-bottom:1px solid var(--line)}
+  .nav-in{max-width:980px;margin:0 auto;padding:14px 32px;display:flex;align-items:center;justify-content:space-between;gap:18px}
+  .brand{display:flex;align-items:center;gap:10px;font-weight:600;font-size:15px;letter-spacing:-0.2px;text-decoration:none;color:var(--ink)}
+  .brand .glyph{width:22px;height:22px;border:1.5px solid var(--ink);border-radius:5px;position:relative;flex-shrink:0}
+  .brand .glyph::after{content:'';position:absolute;inset:4px;border-left:1.5px solid var(--accent);border-bottom:1.5px solid var(--accent);transform:rotate(-45deg) translate(1px,-1px)}
+  .brand .svc{font-family:var(--mono);font-size:11px;font-weight:500;letter-spacing:1px;text-transform:uppercase;color:var(--muted);border-left:1px solid var(--line);padding-left:10px;margin-left:2px}
+  .nav-links{display:flex;gap:22px;align-items:center}
+  .nav-links a{font-size:13.5px;color:var(--muted);text-decoration:none;transition:color .15s;white-space:nowrap}
+  .nav-links a:hover{color:var(--ink)}
+  .nav-links a.active{color:var(--ink);font-weight:600}
+  .nav-ghost{font-family:var(--mono);font-size:13px;border:1px solid var(--line);padding:7px 14px;border-radius:7px;color:var(--ink)!important}
+  .nav-ghost:hover{border-color:var(--ink)}
+  .hero{padding:46px 0 26px}
+  .pill{display:inline-flex;align-items:center;gap:8px;font-family:var(--mono);font-size:12px;letter-spacing:.5px;text-transform:uppercase;color:var(--pass);background:var(--pass-soft);padding:6px 13px;border-radius:100px;margin-bottom:18px}
+  .hero h1{font-size:clamp(26px,3.6vw,38px);letter-spacing:-1px;font-weight:700;line-height:1.12;max-width:22ch;margin-bottom:14px}
+  .hero p{font-size:16.5px;color:var(--muted);max-width:64ch}
+  .tool{border:1px solid var(--line);border-radius:16px;background:#fff;overflow:hidden;margin:28px 0 8px;box-shadow:0 2px 18px rgba(11,14,20,.04)}
+  .tool-head{display:flex;border-bottom:1px solid var(--line)}
+  .tab{flex:1;padding:14px 18px;font-size:13.5px;font-weight:500;color:var(--muted);background:var(--paper-2);border:none;cursor:pointer;border-right:1px solid var(--line);font-family:inherit;transition:all .15s}
+  .tab:last-child{border-right:none}
+  .tab.active{background:#fff;color:var(--ink);box-shadow:inset 0 -2px 0 var(--accent)}
+  .tool-body{padding:24px}
+  .panel{display:none;flex-direction:column;gap:16px}
+  .panel.active{display:flex}
+  .field label{display:block;font-size:13px;font-weight:600;margin-bottom:6px}
+  .field label .opt{font-weight:400;color:var(--muted-2);font-family:var(--mono);font-size:11px;margin-left:6px}
+  .field .hint{font-size:12px;color:var(--muted);margin-top:5px}
+  textarea{width:100%;min-height:84px;resize:vertical;font-family:var(--mono);font-size:12.5px;line-height:1.5;color:var(--ink);background:var(--paper);border:1px solid var(--line);border-radius:9px;padding:11px 13px;outline:none;transition:border-color .15s}
+  textarea:focus{border-color:var(--accent)}
+  textarea::placeholder{color:var(--muted-2)}
+  .filerow{display:flex;align-items:center;gap:10px;margin-top:7px}
+  .fbtn{font-family:var(--mono);font-size:12px;border:1px solid var(--line);background:#fff;border-radius:7px;padding:6px 12px;cursor:pointer;color:var(--ink)}
+  .fbtn:hover{border-color:var(--ink)}
+  .fname{font-family:var(--mono);font-size:12px;color:var(--muted)}
+  .actions{display:flex;align-items:center;gap:14px;margin-top:4px}
+  .verify-btn{display:inline-flex;align-items:center;gap:9px;background:var(--ink);color:var(--paper);border:none;font-size:14.5px;font-weight:600;font-family:inherit;padding:13px 26px;border-radius:10px;cursor:pointer;transition:background .15s}
+  .verify-btn:hover{background:var(--accent)}
+  .verify-btn:disabled{opacity:.55;cursor:default}
+  .clear-btn{font-size:13px;color:var(--muted);background:none;border:none;cursor:pointer;font-family:inherit;text-decoration:underline;text-underline-offset:2px}
+  .verdict{display:none;margin-top:20px;border-radius:14px;overflow:hidden;border:1px solid var(--line)}
+  .verdict.show{display:block}
+  .vhead{padding:18px 22px;display:flex;align-items:center;gap:14px}
+  .vhead .badge{font-family:var(--mono);font-weight:600;font-size:13px;letter-spacing:.5px;padding:7px 15px;border-radius:8px}
+  .vhead .vtext{font-size:15px;font-weight:600}
+  .verdict.ok .vhead{background:var(--pass-soft)} .verdict.ok .badge{background:var(--pass);color:#fff} .verdict.ok .vtext{color:var(--pass)}
+  .verdict.no .vhead{background:var(--fail-soft)} .verdict.no .badge{background:var(--fail);color:#fff} .verdict.no .vtext{color:var(--fail)}
+  .verdict.err .vhead{background:var(--paper-2)} .verdict.err .badge{background:var(--muted);color:#fff} .verdict.err .vtext{color:var(--muted)}
+  .vbody{padding:8px 22px 20px;background:#fff}
+  .vcard{border-top:1px solid var(--line);padding:16px 0}
+  .vcard:first-child{border-top:none}
+  .vcard h4{font-family:var(--mono);font-size:11px;letter-spacing:1px;text-transform:uppercase;color:var(--muted);margin-bottom:10px}
+  .kv{display:grid;grid-template-columns:150px 1fr;gap:6px 14px;font-size:13px}
+  .kv dt{color:var(--muted);font-family:var(--mono);font-size:12px}
+  .kv dd{font-family:var(--mono);font-size:12.5px;word-break:break-all}
+  .kv dd.t{color:var(--pass);font-weight:600} .kv dd.f{color:var(--fail);font-weight:600}
+  .reasons{list-style:none;display:flex;flex-direction:column;gap:7px}
+  .reasons li{font-size:13px;color:var(--ink);padding-left:18px;position:relative;font-family:var(--mono)}
+  .reasons li::before{content:'!';position:absolute;left:0;color:var(--fail);font-weight:700}
+  .verdict.ok .reasons li::before{content:'✓';color:var(--pass)}
+  section.band{padding:48px 0;border-top:1px solid var(--line)}
+  .sec-eyebrow{font-family:var(--mono);font-size:12px;font-weight:500;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);margin-bottom:12px}
+  .sec-title{font-size:21px;font-weight:700;letter-spacing:-0.4px;margin-bottom:18px}
+  table.boundary{border-collapse:collapse;width:100%;font-size:13.5px;border:1px solid var(--line);border-radius:10px;overflow:hidden}
+  table.boundary th,table.boundary td{padding:11px 14px;text-align:left;vertical-align:top;border-bottom:1px solid var(--line)}
+  table.boundary thead th{font-family:var(--mono);font-size:10.5px;letter-spacing:.06em;text-transform:uppercase;color:var(--muted);background:var(--paper-2)}
+  table.boundary tbody th{font-weight:600;white-space:nowrap;width:160px}
+  table.boundary tbody td{font-family:var(--mono);font-size:12.5px;color:var(--muted)}
+  table.boundary tr:last-child th,table.boundary tr:last-child td{border-bottom:none}
+  .twocol{display:grid;grid-template-columns:1fr 1fr;gap:24px;margin-top:6px}
+  .lst h5{font-size:13px;font-weight:600;margin-bottom:10px}
+  .lst ul{list-style:none;display:flex;flex-direction:column;gap:8px}
+  .lst li{font-size:13.5px;color:var(--muted);padding-left:18px;position:relative}
+  .lst.does li::before{content:'+';position:absolute;left:0;color:var(--pass);font-weight:700}
+  .lst.dont li::before{content:'–';position:absolute;left:0;color:var(--muted-2);font-weight:700}
+  .note{background:var(--paper-2);border:1px solid var(--line);border-left:3px solid var(--accent);border-radius:8px;padding:14px 18px;font-size:14px;color:var(--ink);margin-top:6px}
+  .note code{font-family:var(--mono);font-size:12.5px;background:#fff;border:1px solid var(--line);border-radius:5px;padding:1px 6px}
+  .privacy-lst{list-style:none;display:flex;flex-direction:column;gap:8px;margin-top:10px}
+  .privacy-lst li{font-size:13px;color:var(--muted);padding-left:18px;position:relative;font-family:var(--mono)}
+  .privacy-lst li::before{content:'+';position:absolute;left:0;color:var(--pass);font-weight:700}
+  footer{padding:48px 0 56px}
+  .foot-in{display:flex;justify-content:space-between;gap:24px;flex-wrap:wrap;align-items:flex-start}
+  .foot-brand{max-width:38ch}
+  .foot-brand p{font-size:13px;color:var(--muted);margin-top:12px}
+  .foot-cols{display:flex;gap:48px;flex-wrap:wrap}
+  .foot-col h5{font-family:var(--mono);font-size:11px;letter-spacing:1px;text-transform:uppercase;color:var(--muted-2);margin-bottom:14px}
+  .foot-col a{display:block;font-size:13.5px;color:var(--muted);text-decoration:none;margin-bottom:9px}
+  .foot-col a:hover{color:var(--ink)}
+  .foot-note{margin-top:40px;padding-top:24px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted-2);font-family:var(--mono)}
+  @media(max-width:780px){
+    .twocol{grid-template-columns:1fr}
+    .kv{grid-template-columns:1fr}
+    .kv dt{margin-top:6px}
+    .nav-in{gap:12px}
+    .nav-links{gap:16px;overflow-x:auto;-webkit-overflow-scrolling:touch;scrollbar-width:none}
+    .nav-links::-webkit-scrollbar{display:none}
+  }
+.anchor-banner{padding:12px 18px;border-radius:10px;font-size:13.5px;margin-bottom:20px;border:1px solid var(--line)}
+.anchor-banner.anchor-ok{background:var(--pass-soft);border-color:var(--pass);color:var(--pass)}
+.anchor-banner.anchor-none{background:var(--paper-2);color:var(--muted)}
+.anchor-banner.anchor-offline{background:var(--paper-2);color:var(--muted);border-style:dashed}
+.anchor-banner.anchor-loading{color:var(--muted);background:var(--paper-2)}
+.anchor-banner.anchor-fail{background:var(--fail-soft);border-color:var(--fail);border-width:2px;color:var(--fail);font-weight:700}
+.anchor-banner.rung-standalone{background:var(--paper-2);color:var(--muted)}
+.anchor-banner.rung-countersigned{background:var(--paper-2);color:var(--muted)}
+.anchor-banner.rung-local-anchored{background:var(--pass-soft);border-color:var(--pass);color:var(--pass)}
+.anchor-banner.rung-counterparty-visible{background:var(--pass-soft);border-color:var(--pass);color:var(--pass)}
+.anchor-banner.rung-publicly-anchored{background:var(--pass-soft);border-color:var(--pass);color:var(--pass)}
+.anchor-ok{color:var(--pass);font-weight:700}
+.anchor-offline{color:var(--muted);font-weight:600}
+.anchor-none{color:var(--muted)}
+.anchor-fail{color:var(--fail);font-weight:700}
+.anchor-fail-detail{font-family:var(--mono);font-size:11.5px;color:var(--fail);margin-top:6px;word-break:break-all;font-weight:400}
+.ritual-stages{border:1px solid var(--line);border-radius:12px;overflow:hidden}
+.ritual-stage{display:flex;align-items:baseline;gap:10px;padding:10px 16px;border-bottom:1px solid var(--line);font-size:13px}
+.ritual-stage:last-child{border-bottom:none}
+.ritual-mark{width:16px;height:16px;border-radius:4px;display:inline-flex;align-items:center;justify-content:center;font-size:10px;font-weight:700;flex-shrink:0}
+.ritual-pass .ritual-mark{background:var(--pass);color:#fff}
+.ritual-fail .ritual-mark{background:var(--fail);color:#fff}
+.ritual-skip .ritual-mark{background:transparent;border:1.5px solid var(--line);color:var(--muted-2)}
+.ritual-name{font-weight:600;width:110px;flex-shrink:0}
+.ritual-detail{color:var(--muted);font-weight:400}
+.ritual-fail .ritual-detail{color:var(--fail)}
+.finding-panel{margin-top:16px;border-radius:12px;padding:14px 18px;border:1px solid var(--line)}
+.finding-panel.finding-fail{background:var(--fail-soft);border-color:var(--fail)}
+.finding-panel.finding-gap{background:var(--fail-soft);border-color:var(--fail)}
+.finding-panel.finding-summary{background:transparent;border-color:var(--line)}
+.finding-summary .finding-label{color:var(--muted)}
+.finding-label{font-family:var(--mono);font-size:11px;font-weight:600;letter-spacing:1px;text-transform:uppercase;color:var(--fail);margin-bottom:6px}
+.finding-text{font-size:13.5px;color:var(--ink);margin-bottom:6px}
+.finding-meta{font-family:var(--mono);font-size:11.5px;color:var(--muted)}
+.records-table{border-collapse:collapse;width:100%;font-size:12.5px}
+.records-table th,.records-table td{padding:8px 10px;border:1px solid var(--line);text-align:left}
+.records-table th{background:var(--paper-2);font-family:var(--mono);font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:.05em}
+.rec-row.rec-altered{background:var(--fail-soft)}
+.rec-row.rec-flagged{background:rgba(179,38,30,0.03)}
+.rec-row.rec-gap{background:var(--fail-soft);font-style:italic;color:var(--muted)}
+.g-nodes{display:flex;flex-wrap:wrap;gap:10px;margin-bottom:20px}
+.gn{border:1px solid var(--line);border-radius:10px;padding:12px 16px;min-width:200px;max-width:340px;background:#fff}
+.gn-capsule{border-color:var(--accent);background:var(--accent-soft)}
+.gn-offer_terms{border-color:var(--pass);background:var(--pass-soft)}
+.gn-wicket_manifest{border-color:#f59e0b;background:#fffbeb}
+.gn-opaque{border-style:dashed;opacity:.85}
+.gn-type{display:block;font-family:var(--mono);font-size:11px;font-weight:600;letter-spacing:.5px;text-transform:uppercase;color:var(--muted);margin-bottom:6px}
+.gn-digest{display:block;font-size:11px;word-break:break-all;color:var(--ink)}
+.opaque-badge{font-size:10px;font-weight:700;letter-spacing:.5px;background:var(--muted);color:#fff;padding:1px 6px;border-radius:4px;vertical-align:middle}
+.opaque-note{font-size:12px;color:var(--muted);margin-top:6px;font-style:normal}
+.g-edges{margin-top:4px}
+.etable{border-collapse:collapse;width:100%;font-size:12.5px;margin-bottom:20px}
+.etable th,.etable td{padding:6px 10px;border:1px solid var(--line);text-align:left}
+.etable th{background:var(--paper-2);font-family:var(--mono);font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:.05em}
+.etype{font-family:var(--mono);font-weight:600}
+.etype-attests_over{color:var(--pass)}
+.etype-chains_to{color:var(--accent)}
+.etype-commits_to{color:#f59e0b}
+.etype-effect_response{color:var(--muted)}
+.pltable{border-collapse:collapse;width:100%;font-size:12.5px}
+.pltable th,.pltable td{padding:7px 10px;border:1px solid var(--line);text-align:left;vertical-align:top}
+.pltable th{background:var(--paper-2);font-family:var(--mono);font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:.05em}
+.pl-withheld{color:#f59e0b;font-weight:700;font-family:var(--mono);font-size:12px}
+.pl-revealed{color:var(--pass);font-weight:600;font-family:var(--mono);font-size:12px}
+.pl-match{color:var(--pass);font-weight:700;font-family:var(--mono);font-size:12px}
+.pl-mismatch{color:var(--fail);font-weight:700;font-family:var(--mono);font-size:12px}
+.pl-ctx{color:var(--muted);font-family:var(--mono);font-size:11px}
+.pl-payload{max-width:340px}
+.pl-payload-details summary{cursor:pointer;color:var(--muted);font-family:var(--mono);font-size:11.5px}
+.pl-payload-details summary code{color:var(--ink)}
+.pl-payload-full{margin-top:6px}
+.pl-payload-full pre{white-space:pre-wrap;word-break:break-word;background:var(--paper-2);border:1px solid var(--line);border-radius:8px;padding:8px 10px;font-size:11.5px;max-height:280px;overflow:auto;margin:0}
+.pl-payload-truncated{color:#f59e0b;font-size:11px;margin:6px 0 0}
+.pl-payload-digests{display:flex;flex-direction:column;gap:2px;margin-top:6px;font-size:11px;color:var(--muted);font-family:var(--mono)}
+.pl-payload-digests code{color:var(--ink)}
+.chain-table{border-collapse:collapse;width:100%;font-size:13px;margin-bottom:16px}
+.chain-table th,.chain-table td{padding:8px 12px;border:1px solid var(--line);text-align:left;vertical-align:middle}
+.chain-table th{background:var(--paper-2);font-family:var(--mono);font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:.05em}
+.chain-table tr.chain-row{cursor:pointer}
+.chain-table tr.chain-active td{background:var(--accent-soft);font-weight:600}
+.chain-table tr.chain-row:hover td{background:var(--paper-2)}
+.chain-nav-btns{display:flex;align-items:center;gap:16px;margin-top:12px}
+.chain-pos{font-size:13px;color:var(--muted);flex:1;text-align:center}
+.gn-capsule-prev .gn-digest{color:var(--accent);text-decoration:underline;cursor:pointer}
+.reg-panel{margin:24px 0;border:1px solid var(--line);border-radius:12px;overflow:hidden}
+.reg-panel summary{padding:14px 18px;cursor:pointer;font-size:14px;font-weight:600;background:var(--paper-2);list-style:none;display:flex;align-items:center;gap:10px;user-select:none}
+.reg-panel summary::-webkit-details-marker{display:none}
+.reg-panel summary::before{content:'▶';font-size:10px;color:var(--muted);transition:transform .15s;flex-shrink:0}
+.reg-panel[open] summary::before{transform:rotate(90deg)}
+.reg-panel-body{padding:16px 18px}
+.reg-disclaimer{font-size:12.5px;color:var(--muted);font-style:italic;margin-bottom:14px;padding-bottom:10px;border-bottom:1px solid var(--line)}
+.reg-table{border-collapse:collapse;width:100%;font-size:12.5px}
+.reg-table th,.reg-table td{padding:8px 10px;border:1px solid var(--line);text-align:left;vertical-align:top}
+.reg-table th{background:var(--paper-2);font-family:var(--mono);font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:.05em}
+.reg-prop{font-family:var(--mono);font-size:11px;background:var(--paper-2);border:1px solid var(--line);border-radius:4px;padding:1px 5px;white-space:nowrap;display:inline-block;margin-bottom:2px}
+.share-row{display:flex;align-items:center;justify-content:space-between;gap:16px;flex-wrap:wrap;margin-bottom:20px}
+.share-row .mono{font-size:11.5px;color:var(--muted);word-break:break-all}
+.share-row .btnrow{display:flex;gap:10px;flex-shrink:0}
+.completeness-card{border:1px solid var(--line);border-radius:12px;padding:16px 20px;margin-bottom:20px}
+.completeness-card.status-pass{background:var(--pass-soft);border-color:var(--pass)}
+.completeness-card.status-fail{background:var(--fail-soft);border-color:var(--fail)}
+.completeness-card.status-skip{background:var(--paper-2);color:var(--muted)}
+.completeness-title{font-family:var(--mono);font-size:11px;font-weight:700;letter-spacing:1px;text-transform:uppercase;margin-bottom:6px}
+.completeness-card.status-pass .completeness-title{color:var(--pass)}
+.completeness-card.status-fail .completeness-title{color:var(--fail)}
+.completeness-card.status-skip .completeness-title{color:var(--muted)}
+.completeness-detail{font-size:13.5px;color:var(--ink)}
+.bundle-empty{border:1px dashed var(--line);border-radius:12px;padding:28px;text-align:center;color:var(--muted);font-size:14px;margin-bottom:20px}
+</style>
+</head>
+<body>
+<script>window.__BUNDLE_FRAGMENT_B64U__="@@BUNDLE_FRAGMENT@@";</script>
+<nav>
+  <div class="nav-in">
+    <a class="brand" href="https://agentactioncapsule.org">
+      <span class="glyph"></span> Agent Action Capsule <span class="svc">Verifier</span>
+    </a>
+    <div class="nav-links">
+      <a href="https://agentactioncapsule.org">Standard</a>
+      <a href="https://anchor.agentactioncapsule.org">Transparency Log</a>
+      <a href="/">Verifier</a>
+      <a href="/bundle" class="active">Bundle</a>
+      <a href="https://agentactioncapsule.org/docs/">Docs</a>
+    </div>
+  </div>
+</nav>
+<div class="wrap" style="padding:32px 0 16px">
+  <div class="pill">ledger bundle · completeness certificate</div>
+  <h1 style="margin-top:12px">Ledger bundle verifier</h1>
+  <p class="mono" id="bundleSummary" style="font-size:13px;color:var(--muted);margin-top:6px">No bundle loaded yet.</p>
+</div>
+<div class="wrap">
+  <div class="share-row">
+    <span class="mono" id="permalinkText">(open a bundle to see its permalink)</span>
+    <span class="btnrow">
+      <button class="verify-btn" id="copyLinkBtn" disabled style="opacity:.5;padding:9px 16px;font-size:13px">Copy permalink</button>
+      <button class="verify-btn" id="downloadBtn" disabled style="opacity:.5;padding:9px 16px;font-size:13px">Download self-contained copy</button>
+    </span>
+  </div>
+</div>
+<div class="wrap" id="emptyState" style="display:none">
+  <div class="bundle-empty">No bundle data in this URL. Open the full shared link (the part after
+    <code class="mono">#</code>) that <code class="mono">capsule bundle</code> printed, or paste bundle
+    JSON below — this viewer never fetches bundle data from a server.</div>
+</div>
+<div class="wrap" id="completenessMount"></div>
+<section id="ritualSection" class="band" style="padding-top:16px">
+  <div class="wrap">
+    <div class="sec-eyebrow">Verification ritual</div>
+    <h2 class="sec-title">Integrity · Sequence · Completeness · Cross-check</h2>
+    <p style="font-size:14px;color:var(--muted);margin-bottom:16px">
+      Failure is precise: the stage that failed is named, and everything that still verifies keeps its
+      verdict. A missing completeness certificate is reported honestly as unavailable, never as a pass.
+    </p>
+    <div id="ritualMount"></div>
+    <div style="margin-top:16px" id="recordsTableContent"></div>
+  </div>
+</section>
+<section id="privlogSection" class="band" style="display:none">
+  <div class="wrap">
+    <div class="sec-eyebrow">Privilege Log</div>
+    <h2 class="sec-title">Disclosed vs. withheld artifacts — all records</h2>
+    <p style="font-size:14px;color:var(--muted);margin-bottom:16px">
+      WITHHELD = digest committed in the record; payload not provided here.<br>
+      REVEALED = payload provided; hash recomputed and checked against the committed digest.
+    </p>
+    <div id="privlogContent"></div>
+  </div>
+</section>
+<section class="band">
+  <div class="wrap">
+    <div class="sec-eyebrow">Bundle data</div>
+    <h2 class="sec-title">Paste bundle JSON to render</h2>
+    <p style="font-size:14px;color:var(--muted);margin-bottom:16px">
+      The JSON goes into the URL fragment only — never sent to this server.
+    </p>
+    <div class="tool">
+      <div class="tool-body">
+        <div class="field">
+          <label>Bundle JSON <span class="opt">output of <code>capsule bundle</code></span></label>
+          <textarea id="bundleJson" style="min-height:120px"
+            placeholder='{"bundle_version":"1","records":[...],"range":[1,4],"checkpoint":{"tree_size":4}}'></textarea>
+        </div>
+        <p id="parseErr" style="color:var(--fail);font-family:var(--mono);font-size:12px;margin:8px 0;min-height:18px"></p>
+        <div class="actions">
+          <button class="verify-btn" id="loadBtn">Load bundle &#x2192;</button>
+        </div>
+      </div>
+    </div>
+  </div>
+</section>
+<footer>
+  <div class="wrap">
+    <div class="foot-in">
+      <div class="foot-brand">
+        <a class="brand" href="https://agentactioncapsule.org">
+          <span class="glyph"></span> Agent Action Capsule <span class="svc">Verifier</span>
+        </a>
+        <p>Stateless public verification surface for capsule-ledger bundles.
+        Free and neutral for any capsule-ledger installation — self-hosted or hosted, no account, no gating.</p>
+      </div>
+      <div class="foot-cols">
+        <div class="foot-col">
+          <h5>Standard</h5>
+          <a href="https://agentactioncapsule.org">Overview</a>
+          <a href="https://agentactioncapsule.org/docs/">Docs</a>
+        </div>
+        <div class="foot-col">
+          <h5>Services</h5>
+          <a href="https://anchor.agentactioncapsule.org">Transparency Log</a>
+          <a href="/">Verifier</a>
+        </div>
+        <div class="foot-col">
+          <h5>Privacy</h5>
+          <a href="https://github.com/action-state-group/scitt-cose">Source &#x2197;</a>
+        </div>
+      </div>
+    </div>
+    <div class="foot-note">Stateless &#xb7; retains nothing &#xb7; Apache-2.0 &#xb7; Action State Group</div>
+  </div>
+</footer>
+<script>
+var MMR = (function(){
+"use strict";
+var DIGEST_LEN = 32;
+var MAX_MMR_SIZE = Math.pow(2, 50);
+function MmrError(msg){ this.message = msg; this.name = "MmrError"; }
+MmrError.prototype = Object.create(Error.prototype);
+function isNonNegInt(n){ return typeof n === "number" && Number.isInteger(n) && n >= 0; }
+function requireNonNegInt(n, what){
+  if(!isNonNegInt(n)) throw new MmrError(what + " must be a non-negative integer: " + n);
+}
+function hexToBytes(hex){
+  if(typeof hex !== "string" || hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)){
+    throw new MmrError("not a valid hex string");
+  }
+  var out = new Uint8Array(hex.length / 2);
+  for(var i = 0; i < out.length; i++){
+    out[i] = parseInt(hex.substr(i * 2, 2), 16);
+  }
+  return out;
+}
+function bytesToHex(bytes){
+  var s = "";
+  for(var i = 0; i < bytes.length; i++){
+    s += bytes[i].toString(16).padStart(2, "0");
+  }
+  return s;
+}
+function assertDigest(b, what){
+  if(!(b instanceof Uint8Array) || b.length !== DIGEST_LEN){
+    throw new MmrError((what || "digest") + " must be " + DIGEST_LEN + " bytes");
+  }
+}
+function parseDigestHex(h){
+  if(typeof h !== "string") throw new MmrError("proof element is not a hex string");
+  var b = hexToBytes(h);
+  if(b.length !== DIGEST_LEN) throw new MmrError("proof element has wrong digest length: " + b.length);
+  return b;
+}
+function concatBytes(){
+  var total = 0;
+  for(var i = 0; i < arguments.length; i++) total += arguments[i].length;
+  var out = new Uint8Array(total);
+  var off = 0;
+  for(var j = 0; j < arguments.length; j++){
+    out.set(arguments[j], off);
+    off += arguments[j].length;
+  }
+  return out;
+}
+function bytesEqual(a, b){
+  if(a.length !== b.length) return false;
+  for(var i = 0; i < a.length; i++){ if(a[i] !== b[i]) return false; }
+  return true;
+}
+async function sha256(bytes){
+  var digest = await crypto.subtle.digest("SHA-256", bytes);
+  return new Uint8Array(digest);
+}
+/* be64(n) -- big-endian 8-byte encoding. n stays well within
+ * Number.MAX_SAFE_INTEGER (our domain is < MAX_MMR_SIZE = 2**50), so plain
+ * float division/modulo is exact -- no BigInt needed. */
+function beU64(n){
+  var bytes = new Uint8Array(8);
+  var v = n;
+  for(var i = 7; i >= 0; i--){
+    bytes[i] = v % 256;
+    v = Math.floor(v / 256);
+  }
+  return bytes;
+}
+/* leaf_hash = sha256(0x00 || body_digest) */
+async function leafHash(bodyDigest){
+  assertDigest(bodyDigest, "body_digest");
+  return sha256(concatBytes(new Uint8Array([0x00]), bodyDigest));
+}
+/* interior_hash = sha256(be64(position+1) || left || right) */
+async function interiorHash(left, right, position){
+  assertDigest(left, "left");
+  assertDigest(right, "right");
+  requireNonNegInt(position, "position");
+  return sha256(concatBytes(beU64(position + 1), left, right));
+}
+/* root = bagged peaks, right-to-left, NO domain-separator byte */
+async function rootFromPeaks(peakHashes){
+  if(!peakHashes.length) return new Uint8Array(DIGEST_LEN);
+  for(var i = 0; i < peakHashes.length; i++) assertDigest(peakHashes[i], "peak");
+  var hashes = peakHashes.slice();
+  while(hashes.length > 1){
+    var right = hashes.pop();
+    var left = hashes.pop();
+    hashes.push(await sha256(concatBytes(right, left)));
+  }
+  return hashes[0];
+}
+function popcount(n){
+  var c = 0;
+  while(n > 0){
+    c += (n % 2 === 1) ? 1 : 0;
+    n = Math.floor(n / 2);
+  }
+  return c;
+}
+function heightAt(pos){
+  requireNonNegInt(pos, "pos");
+  var pos1 = pos + 1, h = 0;
+  while(Math.pow(2, h + 1) - 1 < pos1) h += 1;
+  while(h > 0){
+    var size = Math.pow(2, h + 1) - 1;
+    if(pos1 === size) return h;
+    var leftSize = Math.pow(2, h) - 1;
+    if(pos1 > leftSize) pos1 -= leftSize;
+    h -= 1;
+  }
+  return 0;
+}
+function nodeCount(leafCount_){
+  requireNonNegInt(leafCount_, "leaf_count");
+  return 2 * leafCount_ - popcount(leafCount_);
+}
+function peaks(size){
+  if(!isNonNegInt(size) || size >= MAX_MMR_SIZE) throw new MmrError("invalid MMR size: " + size);
+  var result = [], remaining = size, offset = 0, prevHeight = Infinity;
+  while(remaining > 0){
+    var h = 0;
+    while(Math.pow(2, h + 2) - 1 <= remaining) h += 1;
+    if(h >= prevHeight) throw new MmrError("invalid MMR size (not a valid node count): " + size);
+    var mSize = Math.pow(2, h + 1) - 1;
+    offset += mSize;
+    result.push(offset - 1);
+    remaining -= mSize;
+    prevHeight = h;
+  }
+  return result;
+}
+function leafCountFromSize(size){
+  var pks = peaks(size), total = 0;
+  for(var i = 0; i < pks.length; i++) total += Math.pow(2, heightAt(pks[i]));
+  return total;
+}
+function leafIndexToPos(leafIndex){
+  requireNonNegInt(leafIndex, "leaf_index");
+  var pos = nodeCount(leafIndex);
+  if(pos >= MAX_MMR_SIZE) throw new MmrError("leaf_index too large: " + leafIndex);
+  return pos;
+}
+function findContainingPeak(pos, peakPositions){
+  for(var i = 0; i < peakPositions.length; i++){
+    var peakPos = peakPositions[i];
+    var h = heightAt(peakPos);
+    var mSize = Math.pow(2, h + 1) - 1;
+    var start = peakPos - mSize + 1;
+    if(start <= pos && pos <= peakPos) return i;
+  }
+  return -1;
+}
+/* Bottom-up sibling path from targetPos up to (but excluding) the mountain
+ * root at rootPos (height `height`). Mirrors core.py's _locate_path. */
+function locatePath(rootPos, height, targetPos){
+  var topDown = [];
+  var curRoot = rootPos, curHeight = height;
+  while(curHeight > 0 && curRoot !== targetPos){
+    var parentPos = curRoot;
+    var leftSize = Math.pow(2, curHeight) - 1;
+    var leftChildRoot = curRoot - leftSize - 1;
+    var rightChildRoot = curRoot - 1;
+    var step;
+    if(targetPos <= leftChildRoot){
+      step = {siblingPos: rightChildRoot, targetIsRight: false, parentPos: parentPos};
+      curRoot = leftChildRoot;
+    }else{
+      step = {siblingPos: leftChildRoot, targetIsRight: true, parentPos: parentPos};
+      curRoot = rightChildRoot;
+    }
+    topDown.push(step);
+    curHeight -= 1;
+  }
+  topDown.reverse();
+  return topDown;
+}
+/* Pure, total-order-stable inclusion verification. Never throws -- any
+ * malformed input resolves to false. */
+async function verifyInclusion(rootHex, size, leafIndex, bodyDigestHex, proof){
+  try{
+    var root = hexToBytes(rootHex);
+    var bodyDigest = hexToBytes(bodyDigestHex);
+    assertDigest(root, "root");
+    assertDigest(bodyDigest, "body_digest");
+    if(!proof || proof.v !== 1 || proof.kind !== "inclusion") return false;
+    if(proof.size !== size || proof.leaf_index !== leafIndex) return false;
+    if(!isNonNegInt(size) || size >= MAX_MMR_SIZE) return false;
+    if(!isNonNegInt(leafIndex)) return false;
+    if(!Array.isArray(proof.witness) || !Array.isArray(proof.peaks_left) || !Array.isArray(proof.peaks_right)){
+      return false;
+    }
+    var lc = leafCountFromSize(size);
+    if(leafIndex >= lc) return false;
+    var leafPos = leafIndexToPos(leafIndex);
+    var pks = peaks(size);
+    var peakIdx = findContainingPeak(leafPos, pks);
+    if(peakIdx === -1) return false;
+    var peakPos = pks[peakIdx];
+    var peakHeight = heightAt(peakPos);
+    var path = locatePath(peakPos, peakHeight, leafPos);
+    if(proof.witness.length !== path.length) return false;
+    if(proof.peaks_left.length !== peakIdx) return false;
+    if(proof.peaks_right.length !== pks.length - peakIdx - 1) return false;
+    var witnessBytes = proof.witness.map(parseDigestHex);
+    var peaksLeftBytes = proof.peaks_left.map(parseDigestHex);
+    var peaksRightBytes = proof.peaks_right.map(parseDigestHex);
+    var acc = await leafHash(bodyDigest);
+    for(var i = 0; i < path.length; i++){
+      var step = path[i], sib = witnessBytes[i];
+      acc = step.targetIsRight
+        ? await interiorHash(sib, acc, step.parentPos)
+        : await interiorHash(acc, sib, step.parentPos);
+    }
+    var allPeaks = peaksLeftBytes.concat([acc]).concat(peaksRightBytes);
+    var computedRoot = await rootFromPeaks(allPeaks);
+    return bytesEqual(computedRoot, root);
+  }catch(e){
+    return false;
+  }
+}
+/* Pure consistency verification. Never throws. */
+async function verifyConsistency(rootAHex, sizeA, rootBHex, sizeB, proof){
+  try{
+    var rootA = hexToBytes(rootAHex);
+    var rootB = hexToBytes(rootBHex);
+    assertDigest(rootA, "root_a");
+    assertDigest(rootB, "root_b");
+    if(!proof || proof.v !== 1 || proof.kind !== "consistency") return false;
+    if(proof.size_a !== sizeA || proof.size_b !== sizeB) return false;
+    if(!isNonNegInt(sizeA)) return false;
+    if(!isNonNegInt(sizeB) || sizeB < sizeA) return false;
+    if(!Array.isArray(proof.old_peaks) || !Array.isArray(proof.new_peaks) || !Array.isArray(proof.witness)){
+      return false;
+    }
+    var oldPeakPositions = peaks(sizeA);
+    var newPeakPositions = peaks(sizeB);
+    if(proof.old_peaks.length !== oldPeakPositions.length) return false;
+    if(proof.new_peaks.length !== newPeakPositions.length) return false;
+    if(proof.witness.length !== oldPeakPositions.length) return false;
+    var oldPeaksBytes = proof.old_peaks.map(parseDigestHex);
+    var newPeaksBytes = proof.new_peaks.map(parseDigestHex);
+    var computedRootA = await rootFromPeaks(oldPeaksBytes);
+    if(!bytesEqual(computedRootA, rootA)) return false;
+    var computedRootB = await rootFromPeaks(newPeaksBytes);
+    if(!bytesEqual(computedRootB, rootB)) return false;
+    for(var i = 0; i < oldPeakPositions.length; i++){
+      var p = oldPeakPositions[i];
+      var containingIdx = findContainingPeak(p, newPeakPositions);
+      if(containingIdx === -1) return false;
+      var newPeakPos = newPeakPositions[containingIdx];
+      var newPeakHeight = heightAt(newPeakPos);
+      var path = locatePath(newPeakPos, newPeakHeight, p);
+      var w = proof.witness[i];
+      if(!Array.isArray(w) || w.length !== path.length) return false;
+      var wBytes = w.map(parseDigestHex);
+      var acc = oldPeaksBytes[i];
+      for(var j = 0; j < path.length; j++){
+        var step = path[j], sib = wBytes[j];
+        acc = step.targetIsRight
+          ? await interiorHash(sib, acc, step.parentPos)
+          : await interiorHash(acc, sib, step.parentPos);
+      }
+      if(!bytesEqual(acc, newPeaksBytes[containingIdx])) return false;
+    }
+    return true;
+  }catch(e){
+    return false;
+  }
+}
+/* Rebuilds the hash of the subtree rooted at `pos` (height `height`,
+ * covering leaf indices [leafStart, leafStart + 2**height - 1]) from
+ * `bodyDigestsByIndex` for any leaf inside [lo, hi] and one witness hash
+ * per maximal subtree wholly outside [lo, hi] -- recursing into any
+ * subtree the range only partially covers. `cursor` is a one-element
+ * array used as a mutable int (JS has no pass-by-reference for numbers).
+ * Mirrors cll.checkpoint.core._reconstruct_range_subtree. */
+async function reconstructRangeSubtree(pos, height, leafStart, lo, hi, bodyDigestsByIndex, witnessBytes, cursor){
+  var leafEnd = leafStart + Math.pow(2, height) - 1;
+  if(leafEnd < lo || leafStart > hi){
+    if(cursor[0] >= witnessBytes.length) throw new MmrError("range proof witness exhausted");
+    var w = witnessBytes[cursor[0]];
+    cursor[0] += 1;
+    return w;
+  }
+  if(height === 0){
+    return await leafHash(bodyDigestsByIndex[leafStart]);
+  }
+  var half = Math.pow(2, height - 1);
+  var left = await reconstructRangeSubtree(pos - Math.pow(2, height), height - 1, leafStart, lo, hi, bodyDigestsByIndex, witnessBytes, cursor);
+  var right = await reconstructRangeSubtree(pos - 1, height - 1, leafStart + half, lo, hi, bodyDigestsByIndex, witnessBytes, cursor);
+  return interiorHash(left, right, pos);
+}
+/* Pure range-membership verification. Never throws. Mirrors
+ * cll.checkpoint.index.verify_range / cll.checkpoint.core.verify_range:
+ * rebuilds every peak the range touches from `bodyDigestHexes` (one per
+ * leaf, bodyDigestHexes[i] for seq fromSeq + i) folded with `proof`'s
+ * witness hashes -- an altered, deleted, or replaced interior leaf
+ * changes the peak it falls under and is caught here, unlike a
+ * two-boundary inclusion check that never looks at any leaf strictly
+ * between the two endpoints. */
+async function verifyRange(rootHex, fromSeq, toSeq, bodyDigestHexes, proof){
+  try{
+    var root = hexToBytes(rootHex);
+    assertDigest(root, "root");
+    if(!proof || proof.from_seq !== fromSeq || proof.to_seq !== toSeq) return false;
+    if(fromSeq < 1 || toSeq < fromSeq) return false;
+    if(leafCountFromSize(proof.size) !== toSeq) return false;
+    var size = proof.size;
+    var fromIndex = proof.from_index, toIndex = proof.to_index;
+    if(fromIndex !== fromSeq - 1 || toIndex !== toSeq - 1) return false;
+    if(!Array.isArray(proof.witness)) return false;
+    if(!Array.isArray(bodyDigestHexes)) return false;
+    if(bodyDigestHexes.length !== toIndex - fromIndex + 1) return false;
+    var bodyDigestsByIndex = {};
+    for(var i = 0; i < bodyDigestHexes.length; i++){
+      var d = hexToBytes(bodyDigestHexes[i]);
+      assertDigest(d, "body_digest");
+      bodyDigestsByIndex[fromIndex + i] = d;
+    }
+    var witnessBytes = proof.witness.map(parseDigestHex);
+    var pks = peaks(size);
+    var cursor = [0];
+    var leafStart = 0;
+    var reconstructedPeaks = [];
+    for(var pi = 0; pi < pks.length; pi++){
+      var p = pks[pi];
+      var h = heightAt(p);
+      reconstructedPeaks.push(await reconstructRangeSubtree(p, h, leafStart, fromIndex, toIndex, bodyDigestsByIndex, witnessBytes, cursor));
+      leafStart += Math.pow(2, h);
+    }
+    if(cursor[0] !== witnessBytes.length) return false; // unconsumed witnesses -- malformed/oversized proof
+    var computedRoot = await rootFromPeaks(reconstructedPeaks);
+    return bytesEqual(computedRoot, root);
+  }catch(e){
+    return false;
+  }
+}
+return {
+  DIGEST_LEN: DIGEST_LEN,
+  MAX_MMR_SIZE: MAX_MMR_SIZE,
+  hexToBytes: hexToBytes,
+  bytesToHex: bytesToHex,
+  leafHash: leafHash,
+  interiorHash: interiorHash,
+  rootFromPeaks: rootFromPeaks,
+  heightAt: heightAt,
+  nodeCount: nodeCount,
+  peaks: peaks,
+  leafCountFromSize: leafCountFromSize,
+  leafIndexToPos: leafIndexToPos,
+  verifyInclusion: verifyInclusion,
+  verifyConsistency: verifyConsistency,
+  verifyRange: verifyRange
+};
+})();
+if(typeof globalThis !== "undefined"){ globalThis.MMR = MMR; }
+</script>
+<script>
+/* === PORTED FROM CAPSULE_JS (verbatim) — see test_bundle_js_shared_helpers_match_capsule_js === */
+var KNOWN_TYPES={"capsule":1,"offer_terms":1,"wicket_manifest":1,"response":1,
+  "gate_checks":1,"subject":1,"bilateral_subject":1,"compute_attestation":1,
+  "agent_input":1,"agent_output":1};
+function isH64(s){return typeof s==="string"&&s.length===64&&/^[0-9a-f]+$/i.test(s);}
+/* Disclosure Envelope unwrap: {"capsule":{...unmodified...},"disclosures":{...}} ->
+ * the unmodified capsule. A bare capsule (no "capsule" wrapper key, or a
+ * bilateral binding with buyer_capsule/seller_capsule) passes through unchanged. */
+function unwrapEnvelope(item){return(item&&typeof item==="object"&&item.capsule&&typeof item.capsule==="object")?item.capsule:item;}
+function sh(d){return d.slice(0,8)+"…"+d.slice(-4);}
+function safe(s){return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");}
+/* ---------- disclosed-payload rendering (shared helper — same canonicalization as
+ * the digest recompute; see test_bundle_js_shared_helpers_match_capsule_js). The
+ * bytes hashed against the committed digest and the bytes shown to the reader MUST
+ * come from the same function -- a display that re-serializes by a different rule
+ * than JSON.stringify(p, Object.keys(p).sort()) could show content that doesn't
+ * match what was actually verified. */
+var PAYLOAD_TRUNCATE_BYTES=8192;
+function canonicalPayloadText(payload){
+  return typeof payload==="string"?payload:JSON.stringify(payload,Object.keys(payload).sort());
+}
+function payloadPreview(payload){
+  var t=canonicalPayloadText(payload);
+  return t.length>80?t.slice(0,80)+"…":t;
+}
+function payloadCellHtml(entry,recomputedDigest){
+  if(entry.withheld||entry._revPayload==null||entry.matchOk!==true)return"";
+  var full=typeof entry._revPayload==="string"
+    ?entry._revPayload
+    :JSON.stringify(entry._revPayload,Object.keys(entry._revPayload).sort(),2);
+  var bytes=new TextEncoder().encode(full);
+  var truncated=bytes.length>PAYLOAD_TRUNCATE_BYTES;
+  var shown=truncated?new TextDecoder("utf-8").decode(bytes.slice(0,PAYLOAD_TRUNCATE_BYTES)):full;
+  var note=truncated?"<p class='pl-payload-truncated'>truncated for display, full payload is in the URL fragment</p>":"";
+  return"<details class='pl-payload-details'><summary><code>"+safe(payloadPreview(entry._revPayload))+"</code></summary>"
+    +"<div class='pl-payload-full'><pre>"+safe(shown)+"</pre>"+note
+    +"<div class='pl-payload-digests'><div>committed <code>"+safe(entry.digest)+"</code></div>"
+    +"<div>recomputed <code>"+safe(recomputedDigest||"")+"</code></div></div></div></details>";
+}
+/* === PORTED FROM CAPSULE_JS (verbatim) — capsule_id recompute (RFC 8785 JCS
+ * + SHA-256), see test_bundle_js_shared_helpers_match_capsule_js === */
+var CHAIN_LINKAGE_FIELDS={"capsule_id":1,"chain":1};
+function CapsuleIdError(msg){this.message=msg;this.name="CapsuleIdError";}
+function _capIdNormalize(v){
+  if(Array.isArray(v))return v.map(_capIdNormalize);
+  if(v&&typeof v==="object"){
+    var out={};
+    Object.keys(v).forEach(function(k){
+      var nv=_capIdNormalize(v[k]);
+      if(nv===null||nv===undefined)return;
+      if(Array.isArray(nv)&&nv.length===0)return;
+      if(nv&&typeof nv==="object"&&!Array.isArray(nv)&&Object.keys(nv).length===0)return;
+      out[k]=nv;
+    });
+    return out;
+  }
+  return v;
+}
+function _capIdJcsString(s){
+  var out=['"'];
+  for(var ch of s){
+    var o=ch.codePointAt(0);
+    if(ch==='"')out.push('\\"');
+    else if(ch==="\\")out.push("\\\\");
+    else if(o===0x08)out.push("\\b");
+    else if(o===0x09)out.push("\\t");
+    else if(o===0x0A)out.push("\\n");
+    else if(o===0x0C)out.push("\\f");
+    else if(o===0x0D)out.push("\\r");
+    else if(o<0x20)out.push("\\u"+o.toString(16).padStart(4,"0"));
+    else out.push(ch);
+  }
+  out.push('"');
+  return out.join("");
+}
+function _capIdJcsValue(v){
+  if(v===null||v===undefined)return"null";
+  if(v===true)return"true";
+  if(v===false)return"false";
+  if(typeof v==="string")return _capIdJcsString(v);
+  if(typeof v==="number"){
+    if(!Number.isInteger(v))throw new CapsuleIdError("float in digest-bearing field");
+    if(v>Number.MAX_SAFE_INTEGER||v<-Number.MAX_SAFE_INTEGER)throw new CapsuleIdError("integer outside safe range");
+    return String(v);
+  }
+  if(Array.isArray(v))return"["+v.map(_capIdJcsValue).join(",")+"]";
+  if(typeof v==="object"){
+    var keys=Object.keys(v).sort();
+    return"{"+keys.map(function(k){return _capIdJcsString(k)+":"+_capIdJcsValue(v[k]);}).join(",")+"}";
+  }
+  throw new CapsuleIdError("value not JSON-serializable: "+typeof v);
+}
+async function _capIdSha256Hex(bytes){
+  var buf=await crypto.subtle.digest("SHA-256",bytes);
+  return Array.from(new Uint8Array(buf)).map(function(b){return b.toString(16).padStart(2,"0");}).join("");
+}
+async function computeCapsuleId(capsule){
+  if(!capsule||typeof capsule!=="object"||Array.isArray(capsule))throw new CapsuleIdError("capsule must be a JSON object");
+  var canonical={};
+  Object.keys(capsule).forEach(function(k){if(!CHAIN_LINKAGE_FIELDS[k])canonical[k]=capsule[k];});
+  var jcsStr=_capIdJcsValue(_capIdNormalize(canonical));
+  return await _capIdSha256Hex(new TextEncoder().encode(jcsStr));
+}
+async function verifyCapsuleId(cap){
+  var c=unwrapEnvelope(cap);
+  var stated=(c&&c.capsule_id)||"";
+  if(!isH64(stated))return{ok:null,stated:stated,recomputed:null};
+  if(typeof crypto==="undefined"||!crypto.subtle)return{ok:null,stated:stated,recomputed:null};
+  try{
+    var recomputed=await computeCapsuleId(c);
+    return{ok:recomputed===stated,stated:stated,recomputed:recomputed};
+  }catch(ex){
+    return{ok:false,stated:stated,recomputed:null,error:ex.message};
+  }
+}
+function parseAac(data){
+  var nodes=[],edges=[],privlog=[],unk=[],seen={};
+  var isB=!!(data.buyer_capsule&&data.seller_capsule);
+  function addN(id,type,label,withheld,payload){
+    if(seen[id])return false;seen[id]=true;
+    var k=!!KNOWN_TYPES[type];
+    if(!k&&unk.indexOf(type)<0)unk.push(type);
+    nodes.push({id:id,type:type,label:label,digest:id,isKnown:k,withheld:withheld!==false,payload:payload||null});
+    return true;
+  }
+  function addArt(digest,type,label,ctx){
+    if(!isH64(digest)||!addN(digest,type,label,true,null))return;
+    privlog.push({id:label,type:type,digest:digest,withheld:true,isKnown:!!KNOWN_TYPES[type],matchOk:null,ctx:ctx});
+  }
+  function addEdge(f,t,lbl){
+    var k="_e_"+f+"_"+t+"_"+lbl;if(seen[k])return;seen[k]=true;
+    edges.push({from:f,to:t,label:lbl});
+  }
+  /* disclosures: the Disclosure Envelope's out-of-band {agent_input, agent_output}
+   * object for this capsule (draft-mih-scitt-agent-action-capsule-disclosure-envelope-00).
+   * NEVER read from cap.model_attestation.compute_attestation — that region is
+   * digest-committed, so embedding a payload there would change capsule_id. */
+  function extractCap(cap,capId,pfx,disclosures){
+    disclosures=disclosures||{};
+    var p=pfx?pfx+".":"";
+    var chain=cap.chain||{};
+    var prior=chain.parent_capsule_id||"";
+    if(isH64(prior)&&addN(prior,"capsule","prior capsule "+sh(prior),false,null))
+      addEdge(capId,prior,"chains_to");
+    var ma=cap.model_attestation||{},ca=ma.compute_attestation||{},subj=ca.subject_digest||"";
+    if(isH64(subj)){addArt(subj,"subject","subject",p+"compute_attestation.subject_digest");addEdge(capId,subj,"attests_over");}
+    var _actxW=p+"compute_attestation — payload not carried in the record";
+    var _actxR="payload carried in fragment; recomputed against committed digest";
+    var ai=ca.agent_input_digest||"",aiPre=disclosures.agent_input,aiRev=aiPre!=null;
+    if(isH64(ai)&&addN(ai,"agent_input","agent input "+sh(ai),!aiRev,aiRev?aiPre:null)){
+      privlog.push({id:"agent input",type:"agent_input",digest:ai,withheld:!aiRev,isKnown:true,matchOk:null,
+                    ctx:aiRev?_actxR:_actxW,_revPayload:aiRev?aiPre:null});addEdge(capId,ai,"attests_over");}
+    var ao=ca.agent_output_digest||"",aoPre=disclosures.agent_output,aoRev=aoPre!=null;
+    if(isH64(ao)&&addN(ao,"agent_output","agent output "+sh(ao),!aoRev,aoRev?aoPre:null)){
+      privlog.push({id:"agent output",type:"agent_output",digest:ao,withheld:!aoRev,isKnown:true,matchOk:null,
+                    ctx:aoRev?_actxR:_actxW,_revPayload:aoRev?aoPre:null});addEdge(capId,ao,"attests_over");}
+    var eff=cap.effect||{},resp=eff.response_digest||"";
+    if(isH64(resp)){addArt(resp,"response","response",p+"effect.response_digest");addEdge(capId,resp,"effect_response");}
+    (cap.constraints||[]).forEach(function(c){
+      var ev=c.evidence_digest||"",cid=c.id||"constraint";
+      if(isH64(ev)){addArt(ev,"wicket_manifest","manifest ["+cid+"]",p+"constraints["+cid+"].evidence_digest");addEdge(capId,ev,"commits_to");}
+    });
+  }
+  if(isB){
+    var bc=data.buyer_capsule||{},sc=data.seller_capsule||{};
+    var bid=bc.capsule_id||"",sid=sc.capsule_id||"",sth=data.sealed_terms_hash||"",terms=data.terms;
+    var bDisc=(data.disclosures&&data.disclosures.buyer)||{},sDisc=(data.disclosures&&data.disclosures.seller)||{};
+    if(isH64(bid))addN(bid,"capsule","buyer capsule "+sh(bid),false,null);
+    if(isH64(sid))addN(sid,"capsule","seller capsule "+sh(sid),false,null);
+    if(isH64(sth)){
+      var rev=terms!=null;
+      addN(sth,"offer_terms","offer terms "+sh(sth),!rev,rev?terms:null);
+      privlog.push({id:"sealed_terms_hash",type:"offer_terms",digest:sth,withheld:!rev,
+                    isKnown:true,matchOk:null,ctx:"binding.sealed_terms_hash",_revPayload:rev?terms:null});
+      if(isH64(bid))addEdge(bid,sth,"attests_over");
+      if(isH64(sid))addEdge(sid,sth,"attests_over");
+    }
+    if(isH64(bid)&&isH64(sid))addEdge(sid,bid,"chains_to");
+    if(isH64(bid))extractCap(bc,bid,"buyer",bDisc);
+    if(isH64(sid))extractCap(sc,sid,"seller",sDisc);
+  }else{
+    /* Disclosure Envelope wrapper: {"capsule":{...unmodified...},"disclosures":{...}}.
+     * A bare capsule (no "capsule" wrapper key) is the legacy/WITHHELD-only shape —
+     * still fully supported, just with no disclosures to read. */
+    var envCap=(data.capsule&&typeof data.capsule==="object")?data.capsule:data;
+    var envDisc=(data.capsule&&typeof data.capsule==="object")?(data.disclosures||{}):{};
+    var cid=envCap.capsule_id||"";
+    if(isH64(cid)){addN(cid,"capsule","capsule "+sh(cid),false,null);extractCap(envCap,cid,"",envDisc);}
+  }
+  return{nodes:nodes,edges:edges,privlog:privlog,unk:unk,isB:isB};
+}
+function _capMismatched(cap){
+  var g=parseAac(cap);
+  return g.privlog.some(function(e){return e.matchOk===false;});
+}
+function findChainGaps(capsules){
+  /* Unwrap first: a Disclosure-Envelope-wrapped bundle item carries capsule_id
+   * and chain nested under "capsule", not at the top level — without this,
+   * every envelope-wrapped item is invisible to gap detection. */
+  var caps=capsules.map(unwrapEnvelope);
+  var ids={};
+  caps.forEach(function(c){if(isH64(c.capsule_id))ids[c.capsule_id]=true;});
+  var gaps=[];
+  for(var i=1;i<caps.length;i++){
+    var parent=((caps[i].chain)||{}).parent_capsule_id||"";
+    if(isH64(parent)&&!ids[parent])gaps.push({beforeIdx:i-1,afterIdx:i,missingParent:parent});
+  }
+  return gaps;
+}
+function annotateRecords(capsules,integrity){
+  /* Same unwrap as findChainGaps — _capMismatched still receives the raw
+   * (possibly enveloped) item, since parseAac needs the sibling "disclosures"
+   * key to check revealed-payload digests. */
+  var caps=capsules.map(unwrapEnvelope);
+  var alteredIds={};
+  capsules.forEach(function(c,i){
+    var cid=caps[i].capsule_id||"";
+    if(!isH64(cid))return;
+    var idr=integrity&&integrity[i];
+    if((idr&&idr.ok===false)||_capMismatched(c))alteredIds[cid]=true;
+  });
+  var byId={};
+  caps.forEach(function(c){if(isH64(c.capsule_id))byId[c.capsule_id]=c;});
+  return caps.map(function(cap){
+    var cid=cap.capsule_id||"";
+    if(alteredIds[cid])return{note:"digest_mismatch",isAltered:true,citesAltered:false};
+    var cites=false,seen={},cur=cap;
+    while(true){
+      var parent=((cur.chain)||{}).parent_capsule_id||"";
+      if(!isH64(parent)||seen[parent])break;
+      seen[parent]=true;
+      if(alteredIds[parent]){cites=true;break;}
+      cur=byId[parent];if(!cur)break;
+    }
+    return{note:cites?"cites an altered record":"verifies",isAltered:false,citesAltered:cites};
+  });
+}
+/* === END PORTED FROM CAPSULE_JS === */
+/* Everything from here down to the render/DOM section is pure (no
+ * document/window access) and directly callable from a Node harness --
+ * see tests/js_harness_bundle.mjs / tests/test_bundle_page.py. */
+/* ---------- base64url fragment codec ----------
+ * capsule-ledger's `capsule bundle` encodes the fragment as
+ * base64.urlsafe_b64encode(json.dumps(bundle, separators=(",",":"), sort_keys=True)).rstrip("=")
+ * -- URL-safe alphabet, no padding. Not the same alphabet plain atob/btoa use,
+ * so this is decoded/encoded explicitly rather than reusing capsule.js's
+ * plain-base64 helpers. */
+function b64uToStd(s){return s.replace(/-/g,"+").replace(/_/g,"/");}
+function stdToB64u(s){return s.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"");}
+function decodeFragment(hash){
+  var std=b64uToStd(hash);
+  var pad=std.length%4; if(pad)std+="=".repeat(4-pad);
+  var bin=atob(std);
+  var bytes=new Uint8Array(bin.length);
+  for(var i=0;i<bin.length;i++)bytes[i]=bin.charCodeAt(i);
+  return JSON.parse(new TextDecoder("utf-8").decode(bytes));
+}
+function encodeFragment(obj){
+  var bytes=new TextEncoder().encode(JSON.stringify(obj));
+  var bin="";
+  for(var i=0;i<bytes.length;i++)bin+=String.fromCharCode(bytes[i]);
+  return stdToB64u(btoa(bin));
+}
+/* ---------- completeness certificate ----------
+ * Optional bundle field this viewer knows how to check (capsule-ledger's
+ * `capsule bundle` does not populate it yet as of this viewer shipping --
+ * a bundle without one is handled honestly as "not available", never a
+ * fabricated pass. Schema, mirroring cll.checkpoint.index.MmrLedger's own
+ * RangeProof/ConsistencyProof shapes 1:1 so capsule-engine's CLI populates
+ * it directly from that module's own output:
+ *
+ * completeness_certificate: {
+ *   v: 1,
+ *   range_proof: {from_seq, to_seq, size, from_index, to_index, witness: [hex, ...]},
+ *   range_root: "<hex>",         // MMR root at `range_proof.size` (the tree as it stood right after to_seq)
+ *   checkpoint_size: <int>,      // MMR node_count(checkpoint.tree_size); omitted/equal to range_proof.size if no growth since
+ *   checkpoint_root: "<hex>",    // MMR root at checkpoint_size
+ *   consistency_proof: <ConsistencyProof> | null   // bridges range_root/size -> checkpoint_root/size; null if they coincide
+ * }
+ *
+ * `range_proof` is exactly the JSON shape cll.checkpoint.index.RangeProof
+ * serializes to -- a flat, seq-indexed per-record membership proof (every
+ * leaf in [from_seq, to_seq] participates in rebuilding the root, not just
+ * the two boundary leaves) -- see mmr.js's/this file's verifyRange.
+ * `consistency_proof` is exactly the JSON shape cll.checkpoint.core's
+ * ConsistencyProof dataclass serializes to (v, kind, size_a, size_b,
+ * old_peaks, witness, new_peaks) -- see verifyConsistency. Boundary leaf
+ * body digests are the bundle's own record capsule_ids (hex) -- MmrLedger
+ * indexes leaf i's body_digest as bytes.fromhex(record.capsule_id), so no
+ * extra data is needed beyond what bundle.records already carries. */
+async function checkCompleteness(bundle){
+  var cc=bundle.completeness_certificate;
+  var records=bundle.records||[];
+  if(!records.length)return{status:"skip",detail:"empty bundle — nothing to certify"};
+  if(!cc){
+    return{status:"skip",detail:"no completeness certificate in this bundle — the claimed record "+
+      "range and checkpoint are producer-asserted only, not cryptographically proven here. "+
+      "Every capsule that IS present still verifies on its own (see Integrity, above)."};
+  }
+  try{
+    var rp=cc.range_proof;
+    if(!rp||!Array.isArray(rp.witness))return{status:"fail",detail:"malformed completeness certificate: missing range_proof"};
+    if(records.length!==rp.to_seq-rp.from_seq+1){
+      return{status:"fail",detail:"bundle holds "+records.length+" records but the range proof claims "+
+        (rp.to_seq-rp.from_seq+1)+" (seq "+rp.from_seq+"–"+rp.to_seq+")"};
+    }
+    var bodyDigests=records.map(function(r){return r.capsule_id;});
+    var okRange=await MMR.verifyRange(cc.range_root,rp.from_seq,rp.to_seq,bodyDigests,rp);
+    if(!okRange){
+      return{status:"fail",detail:"range proof did not verify — this bundle's claimed records "+
+        rp.from_seq+"–"+rp.to_seq+" are not provably present and unaltered under its cited root"};
+    }
+    if(cc.consistency_proof){
+      var okC=await MMR.verifyConsistency(cc.range_root,rp.size,cc.checkpoint_root,cc.checkpoint_size,cc.consistency_proof);
+      if(!okC){
+        return{status:"fail",detail:"checkpoint consistency proof did not verify — the cited checkpoint "+
+          "does not provably extend this range's root"};
+      }
+    }
+    var ckpt=bundle.checkpoint||{};
+    return{status:"pass",detail:"records "+rp.from_seq+"–"+rp.to_seq+" are present, unaltered, and bound to checkpoint "+
+      cc.range_root.slice(0,12)+"…"+(cc.consistency_proof?(" · extends to checkpoint #"+(ckpt.tree_size!=null?ckpt.tree_size:cc.checkpoint_size)):"")+
+      " — this does not show that no other records exist"};
+  }catch(e){
+    return{status:"fail",detail:"completeness certificate malformed or unverifiable: "+e.message};
+  }
+}
+/* ---------- authoritative digest verification (async — crypto.subtle) ----------
+ * parseAac's privlog entries carry matchOk:null until a REVEALED field's
+ * payload is actually hashed and compared against its committed digest.
+ * This is the single, awaited source of truth for that comparison — both
+ * the displayed privilege log (buildBundlePrivlog) and the verdict logic
+ * (crossCheckSelfReport, evaluateBundleRitual's Integrity stage) call this
+ * rather than each re-deriving (or worse, silently skipping) it. A prior
+ * version of this file computed the digest only inside the DOM-rendering
+ * path — after the ritual/cross-check verdicts had already been decided —
+ * so a genuine digest mismatch could never flip either verdict. Fixed here:
+ * a verification check that can't reject anything isn't a check. */
+async function verifyCapsuleDigests(cap,disclosures){
+  var g=parseAac(disclosures?{capsule:cap,disclosures:disclosures}:cap);
+  if(typeof crypto==="undefined"||!crypto.subtle)return g;  // no WebCrypto: leave matchOk null (skip, not a fabricated pass)
+  for(var i=0;i<g.privlog.length;i++){
+    var e=g.privlog[i];
+    if(e.withheld||e._revPayload==null)continue;
+    var bytes=new TextEncoder().encode(canonicalPayloadText(e._revPayload));
+    var buf=await crypto.subtle.digest("SHA-256",bytes);
+    var hex=Array.from(new Uint8Array(buf)).map(function(b){return b.toString(16).padStart(2,"0");}).join("");
+    e.matchOk=(hex===e.digest);
+    e._recomputedDigest=hex;
+  }
+  return g;
+}
+/* ---------- cross-check against the bundle's own self-reported verification ----------
+ * capsule-ledger's `capsule bundle` already runs each capsule through its own
+ * structural verifier (agent_action_capsule.verify) and embeds the verdict
+ * in bundle.verification[capsule_id] -- but a recipient should never just
+ * trust a producer's self-report. This cross-checks it against OUR OWN
+ * independent digest recompute (verifyCapsuleDigests, above) and flags any
+ * disagreement as its own finding, rather than silently preferring either
+ * source. */
+async function crossCheckSelfReport(bundle,records){
+  var selfReport=bundle.verification||{};
+  var bundleDisclosures=bundle.disclosures||{};
+  var disagreements=[];
+  for(var idx=0;idx<records.length;idx++){
+    var cap=records[idx];
+    var cid=cap.capsule_id;
+    if(!isH64(cid))continue;
+    var g=await verifyCapsuleDigests(cap,bundleDisclosures[cid]);
+    var ours=!g.privlog.some(function(e){return e.matchOk===false;});
+    var reported=selfReport[cid];
+    if(reported&&typeof reported.ok==="boolean"&&reported.ok!==ours){
+      disagreements.push({capsule_id:cid,ours:ours,reported:reported.ok});
+    }
+  }
+  if(!disagreements.length){
+    var n=Object.keys(selfReport).length;
+    return{status:"pass",detail:n?("producer self-report agrees with independent recompute for all "+n+" record(s)"):"no producer self-report present; independent recompute is the only signal (see Integrity)"};
+  }
+  return{status:"fail",detail:disagreements.length+" record(s) where the producer's self-reported verdict "+
+    "disagrees with this viewer's own independent recompute — trust the recompute, investigate the bundle"};
+}
+/* ---------- plain-language summary (renders on EVERY bundle) ----------
+ * The ritual answers "does this verify". It does not answer "what happened",
+ * and until now a clean bundle said almost nothing — four terse stage lines and
+ * no prose. A stranger handed a permalink could see green checks without ever
+ * learning what the records claim, or which claims carry weaker assurance.
+ * This states, in English, what the records say AND what they don't establish.
+ * It never asserts more than the fields carry. */
+function describeBundle(capsules){
+  var caps=capsules.map(unwrapEnvelope).filter(function(c){return c&&c.capsule_id;});
+  if(!caps.length)return null;
+  var n=caps.length,parts=[];
+  var ts=caps.map(function(c){return c.timestamp;}).filter(Boolean).sort();
+  var when=ts.length?(ts[0]===ts[ts.length-1]?("at "+ts[0]):("between "+ts[0]+" and "+ts[ts.length-1])):null;
+  var ops={};caps.forEach(function(c){if(c.operator)ops[c.operator]=1;});
+  var opNames=Object.keys(ops);
+  parts.push(n+" record"+(n===1?"":"s")+(when?", "+when:"")
+    +(opNames.length===1?", from operator “"+opNames[0]+"”":
+      opNames.length>1?", from "+opNames.length+" operators":"")+".");
+  var kinds={};caps.forEach(function(c){var t=c.action_type||"unspecified";kinds[t]=(kinds[t]||0)+1;});
+  var kindBits=Object.keys(kinds).map(function(k){
+    var label=k==="fyi"?"informational":k==="decide"?"decision":k==="act"?"action":k;
+    return kinds[k]+" "+label+(kinds[k]===1?"":"s");
+  });
+  if(kindBits.length)parts.push(kindBits.join(", ")+".");
+  var accepted=0,rejected=0,human=0;
+  caps.forEach(function(c){
+    var d=c.disposition||{};
+    if(d.decision==="accept")accepted++;
+    else if(d.decision==="reject"||d.decision==="deny")rejected++;
+    if(d.human_disposed===true)human++;
+  });
+  if(rejected)parts.push(rejected+" of "+n+" "+(rejected===1?"was":"were")+" refused.");
+  if(accepted===n&&n>0)parts.push("All were accepted.");
+  parts.push(human===0
+    ? "No human approved any of them — every disposition was made by policy."
+    : human+" of "+n+" carried a recorded human disposition.");
+  /* Assurance is the part a reader cannot infer and most needs. */
+  var selfAtt=0,unconfirmed=0;
+  caps.forEach(function(c){
+    var a=c.assurance||{};
+    if(a.attestation_mode==="self_attested")selfAtt++;
+    if(a.effect_mode==="dispatched_unconfirmed")unconfirmed++;
+  });
+  if(unconfirmed)parts.push(unconfirmed+" record"+(unconfirmed===1?"":"s")+" report"+(unconfirmed===1?"s":"")
+    +" the effect as dispatched but unconfirmed — the runtime says it sent the action; nothing here confirms it landed.");
+  if(selfAtt===n&&n>0)parts.push("Every record is self-attested: the same party took the action and wrote the record.");
+  var withheld=0;
+  caps.forEach(function(c){
+    var ca=((c.model_attestation||{}).compute_attestation)||{};
+    if(ca.agent_input_digest||ca.agent_output_digest)withheld++;
+  });
+  if(withheld)parts.push("Inputs and outputs are committed as digests only — the payloads are not in "
+    +(withheld===n?"these records":"all of these records")+", so their contents cannot be read here, only matched if someone later discloses them.");
+  return{code:"summary",label:"What these records say",text:parts.join(" "),
+    meta:"plain-language summary of the fields carried; it makes no claim the ritual did not check"};
+}
+/* ---------- ritual: Integrity / Sequence / Completeness / Cross-check ---------- */
+async function evaluateBundleRitual(records,completeness,crossCheck,integrity,disclosures){
+  var stages=[],finding=null;
+  var alteredIds={},firstMismatch=null,firstMismatchIsBody=false;
+  disclosures=disclosures||{};
+  for(var idx=0;idx<records.length;idx++){
+    var c=records[idx];
+    if(!isH64(c.capsule_id))continue;
+    var idr=integrity&&integrity[idx];
+    if(idr&&idr.ok===false){
+      alteredIds[c.capsule_id]=true;
+      if(!firstMismatch){firstMismatch=idr;firstMismatchIsBody=true;}
+    }
+    var g=await verifyCapsuleDigests(c,disclosures[c.capsule_id]);
+    var bad=g.privlog.filter(function(e){return e.matchOk===false;});
+    if(bad.length){alteredIds[c.capsule_id]=true;if(!firstMismatch){firstMismatch=bad[0];firstMismatchIsBody=false;}}
+  }
+  if(Object.keys(alteredIds).length){
+    if(firstMismatchIsBody){
+      stages.push({name:"Integrity",status:"fail",
+        detail:"capsule_id does not match the recomputed digest of its own body — stated "+sh(firstMismatch.stated)+", recomputed "+(firstMismatch.recomputed?sh(firstMismatch.recomputed):"(could not be computed)")});
+      finding={label:"The finding",
+        text:"This capsule's content does not hash to its stated capsule_id. The body has been altered after the id was assigned — they no longer content-address to each other.",
+        meta:"failed stage: capsule_id_mismatch · stated capsule_id "+firstMismatch.stated+" · recomputed "+(firstMismatch.recomputed||"(error)")};
+    }else{
+      stages.push({name:"Integrity",status:"fail",
+        detail:"record fails at stage digest_mismatch — "+firstMismatch.ctx+" no longer matches its fingerprint"});
+      finding={label:"The finding",
+        text:firstMismatch.id+" ("+firstMismatch.ctx+") is not the value that was sealed.",
+        meta:"failed stage: digest_mismatch · field group: "+firstMismatch.ctx+" · digest "+firstMismatch.digest.slice(0,8)+"…"};
+    }
+  }else{
+    stages.push({name:"Integrity",status:"pass",detail:"every record matches its fingerprint"});
+  }
+  /* Same three-valued Sequence as the capsule surface: a bundle where nothing
+   * declares a parent must not render as "unbroken". See CAPSULE_JS. */
+  var _capsForSeq=records.map(unwrapEnvelope);
+  var _declared=0;
+  _capsForSeq.forEach(function(c){
+    if(isH64(((c.chain)||{}).parent_capsule_id||""))_declared++;
+  });
+  var _expectedLinks=Math.max(0,_capsForSeq.length-1);
+  var gaps=findChainGaps(records);
+  if(_capsForSeq.length<2){
+    stages.push({name:"Sequence",status:"skip",detail:"single record — nothing to sequence"});
+  }else if(_declared===0){
+    stages.push({name:"Sequence",status:"skip",
+      detail:"not checked — no record here declares a parent, so the order shown is presentation order, not an attested sequence"});
+  }else if(gaps.length){
+    var g0=gaps[0];
+    stages.push({name:"Sequence",status:"fail",
+      detail:"gap between record "+(g0.beforeIdx+1)+" and record "+(g0.afterIdx+1)+" — record "+(g0.afterIdx+1)+" names a parent that is not here"});
+    if(!finding){
+      finding={label:"The finding",
+        text:"Whatever sits between record "+(g0.beforeIdx+1)+" and record "+(g0.afterIdx+1)+" is not in this bundle.",
+        meta:"failed stage: chain_gap · missing parent "+g0.missingParent.slice(0,8)+"…"};
+    }
+  }else if(_declared<_expectedLinks){
+    stages.push({name:"Sequence",status:"skip",
+      detail:"partial — "+_declared+" of "+_expectedLinks+" expected links declared; the undeclared positions are not attested as adjacent"});
+  }else{
+    stages.push({name:"Sequence",status:"pass",detail:"unbroken — every record names the one before it"});
+  }
+  stages.push({name:"Completeness",status:completeness.status,detail:completeness.detail});
+  stages.push({name:"Cross-check",status:crossCheck.status,detail:crossCheck.detail});
+  return{stages:stages,finding:finding,summary:describeBundle(records)};
+}
+/* ---------- privilege log (aggregated across every record) ----------
+ * Awaits verifyCapsuleDigests per record first, so every REVEALED row's
+ * matchOk is already resolved true/false by the time this returns — the
+ * displayed log and the ritual/cross-check verdicts read the same, single
+ * digest-verification pass, never two independent (and divergent) ones. */
+async function buildBundlePrivlog(records,disclosures){
+  var rows=[];
+  disclosures=disclosures||{};
+  for(var i=0;i<records.length;i++){
+    var g=await verifyCapsuleDigests(records[i],disclosures[records[i].capsule_id]);
+    g.privlog.forEach(function(e){
+      rows.push({record_index:i,capsule_id:records[i].capsule_id||"",entry:e});
+    });
+  }
+  return rows;
+}
+/* ---------- render/DOM section: everything below touches document/window --------- */
+(function(){"use strict";
+function $(id){return document.getElementById(id);}
+function renderPrivlog(rows){
+  var el=$("privlogContent");if(!el)return;
+  if(!rows.length){el.innerHTML="<p style='color:var(--muted);font-size:13px'>No committed artifacts found across these records.</p>";return;}
+  var h="<table class='pltable'><thead><tr><th>#</th><th>artifact</th><th>type</th><th>digest</th><th>status</th><th>payload</th><th>context</th></tr></thead><tbody>";
+  rows.forEach(function(r,idx){
+    var e=r.entry;
+    var st=e.withheld?"<span class='pl-withheld'>WITHHELD</span>":
+            e.matchOk===true?"<span class='pl-match'>REVEALED · ✓ match</span>":
+            e.matchOk===false?"<span class='pl-mismatch'>REVEALED · ✗ MISMATCH</span>":
+            "<span class='pl-revealed'>REVEALED</span>";
+    h+="<tr data-idx='"+idx+"' data-dig='"+safe(e.digest)+"'><td>"+(r.record_index+1)+"</td><td>"+safe(e.id)+"</td>"+
+      "<td>"+safe(e.type)+(e.isKnown?"":' <em class="opaque-badge">OPAQUE</em>')+"</td>"+
+      "<td><code>"+safe(e.digest.slice(0,16))+"…</code></td><td class='pl-st'>"+st+"</td>"+
+      "<td class='pl-payload'>"+payloadCellHtml(e,e._recomputedDigest)+"</td><td class='pl-ctx'>"+safe(e.ctx)+"</td></tr>";
+  });
+  h+="</tbody></table>";
+  el.innerHTML=h;
+  $("privlogSection").style.display="block";
+  // matchOk is already resolved (buildBundlePrivlog awaits
+  // verifyCapsuleDigests before this is called) -- no second, independent
+  // digest pass here; the table above already reflects the real verdict.
+}
+function renderRecordsTable(records,integrity){
+  var el=$("recordsTableContent");if(!el)return;
+  var notes=annotateRecords(records,integrity);
+  var gaps=findChainGaps(records),gapAt={};
+  gaps.forEach(function(g){gapAt[g.afterIdx]=g;});
+  var h="<table class='records-table'><thead><tr><th>#</th><th>capsule_id</th><th>action_type</th><th>note</th></tr></thead><tbody>";
+  records.forEach(function(cap,i){
+    if(gapAt[i]){
+      var gp=gapAt[i];
+      h+="<tr class='rec-row rec-gap'><td>—</td><td colspan='2'>gap — missing parent <code>"+safe(gp.missingParent.slice(0,8))+"…</code></td><td>⌗ chain_gap</td></tr>";
+    }
+    var n=notes[i];
+    var noteText=n.note==="digest_mismatch"?"✕ digest_mismatch":
+      n.note==="cites an altered record"?"✓ verifies · cites an altered record":"✓ verifies";
+    h+="<tr class='rec-row"+(n.isAltered?" rec-altered":(n.citesAltered?" rec-flagged":""))+"'>"+
+      "<td>"+(i+1)+"</td><td><code>"+safe((cap.capsule_id||"").slice(0,16))+"…</code></td>"+
+      "<td><code>"+safe(cap.action_type||"")+"</code></td><td>"+noteText+"</td></tr>";
+  });
+  h+="</tbody></table>";
+  el.innerHTML=h;
+}
+function renderRitual(summary){
+  var mount=$("ritualMount");if(!mount)return;
+  var marks={pass:"✓",fail:"✕",skip:"–"};
+  var h="<div class='ritual-stages'>";
+  summary.stages.forEach(function(s){
+    h+="<div class='ritual-stage ritual-"+s.status+"'><span class='ritual-mark'>"+marks[s.status]+"</span>"+
+      "<span class='ritual-name'>"+safe(s.name)+"</span><span class='ritual-detail'>"+safe(s.detail)+"</span></div>";
+  });
+  h+="</div>";
+  if(summary.summary){
+    var sm=summary.summary;
+    h+="<div class='finding-panel finding-summary'><div class='finding-label'>"+safe(sm.label)+"</div>"+
+      "<p class='finding-text'>"+safe(sm.text)+"</p><div class='finding-meta'>"+safe(sm.meta)+"</div></div>";
+  }
+  if(summary.finding){
+    var f=summary.finding;
+    h+="<div class='finding-panel finding-fail'><div class='finding-label'>"+safe(f.label)+"</div>"+
+      "<p class='finding-text'>"+safe(f.text)+"</p><div class='finding-meta'>"+safe(f.meta)+"</div></div>";
+  }
+  mount.innerHTML=h;
+}
+function renderCompletenessCard(c){
+  var mount=$("completenessMount");if(!mount)return;
+  var label=c.status==="pass"?"Completeness — verified":c.status==="fail"?"Completeness — FAILED":"Completeness — not available";
+  mount.innerHTML="<div class='completeness-card status-"+c.status+"'><div class='completeness-title'>"+safe(label)+
+    "</div><div class='completeness-detail'>"+safe(c.detail)+"</div></div>";
+}
+/* ---------- load + permalink + offline download ---------- */
+var _bundleData=null,_fragmentB64u=null;
+function permalinkBase(){
+  if(location.protocol==="file:"||location.protocol==="blob:")return "https://verify.agentactioncapsule.org/bundle";
+  return location.origin+location.pathname;
+}
+async function loadBundle(data,fragmentB64u){
+  _bundleData=data;
+  _fragmentB64u=fragmentB64u||encodeFragment(data);
+  var records=data.records||[];
+  var range=data.range||[0,-1];
+  var ckpt=data.checkpoint||{};
+  $("emptyState")&&($("emptyState").style.display="none");
+  $("pasteSection")&&($("pasteSection").style.display="none");
+  var summaryEl=$("bundleSummary");
+  if(summaryEl){
+    summaryEl.textContent=records.length+" record(s) · range "+range[0]+"–"+range[1]+
+      " · checkpoint #"+(ckpt.tree_size!=null?ckpt.tree_size:"?");
+  }
+  var permalinkEl=$("permalinkText");
+  if(permalinkEl)permalinkEl.textContent=permalinkBase()+"#"+_fragmentB64u.slice(0,24)+"…";
+  var dl=$("downloadBtn");if(dl){dl.disabled=false;dl.style.opacity="1";}
+  var cp=$("copyLinkBtn");if(cp){cp.disabled=false;cp.style.opacity="1";}
+  var integrity=await Promise.all(records.map(verifyCapsuleId));
+  var privlog=await buildBundlePrivlog(records,data.disclosures);
+  renderPrivlog(privlog);
+  renderRecordsTable(records,integrity);
+  var completeness=await checkCompleteness(data);
+  renderCompletenessCard(completeness);
+  var crossCheck=await crossCheckSelfReport(data,records);
+  var ritual=await evaluateBundleRitual(records,completeness,crossCheck,integrity,data.disclosures);
+  renderRitual(ritual);
+  try{ history.replaceState(null,"",location.pathname+location.search+"#"+_fragmentB64u); }catch(ex){}
+}
+function bootstrapLoad(){
+  if(typeof window!=="undefined"&&window.__BUNDLE_FRAGMENT_B64U__&&window.__BUNDLE_FRAGMENT_B64U__!=="@@BUNDLE_FRAGMENT@@"){
+    try{
+      var frag=window.__BUNDLE_FRAGMENT_B64U__;
+      loadBundle(decodeFragment(frag),frag);
+      return;
+    }catch(ex){ $("parseErr")&&($("parseErr").textContent="Embedded bundle decode error: "+ex.message); }
+  }
+  var hash=location.hash.slice(1);
+  if(hash){
+    try{ loadBundle(decodeFragment(hash),hash); return; }
+    catch(ex){ $("parseErr")&&($("parseErr").textContent="Fragment decode error: "+ex.message); }
+  }
+  $("emptyState")&&($("emptyState").style.display="block");
+}
+$("loadBtn")&&$("loadBtn").addEventListener("click",function(){
+  var txt=$("bundleJson").value.trim();
+  try{ loadBundle(JSON.parse(txt)); }
+  catch(ex){ $("parseErr").textContent="JSON error: "+ex.message; }
+});
+$("copyLinkBtn")&&$("copyLinkBtn").addEventListener("click",function(){
+  if(!_fragmentB64u||!navigator.clipboard)return;
+  navigator.clipboard.writeText(permalinkBase()+"#"+_fragmentB64u).then(function(){
+    var b=$("copyLinkBtn");var old=b.textContent;b.textContent="Copied!";setTimeout(function(){b.textContent=old;},2000);
+  });
+});
+$("downloadBtn")&&$("downloadBtn").addEventListener("click",function(){
+  if(!_fragmentB64u)return;
+  fetch("/bundle/offline-shell").then(function(r){return r.text();}).then(function(html){
+    var out=html.replace("@@BUNDLE_FRAGMENT@@",_fragmentB64u);
+    var blob=new Blob([out],{type:"text/html"});
+    var a=document.createElement("a");
+    a.href=URL.createObjectURL(blob);
+    a.download="bundle-viewer.html";
+    document.body.appendChild(a);a.click();document.body.removeChild(a);
+    URL.revokeObjectURL(a.href);
+  }).catch(function(){
+    var b=$("downloadBtn");if(b){var old=b.textContent;b.textContent="Offline copy unavailable";setTimeout(function(){b.textContent=old;},2500);}
+  });
+});
+bootstrapLoad();
+})();
+</script>
+</body>
+</html>