d6g8k5htny-coder · Sep 26, 2026 · Sep 26, 2026 · Sep 26, 2026
@@ -20,5 +20,10 @@ jobs:
         run: python3 -B -m unittest discover -s tests -p test_public_shop_data.py
       - name: Browser data-validation controls
         run: node --test tests/test_public_shop_frontend.mjs
+      - name: Museum source projection and refusal controls
+        run: |
+          python3 -B -m unittest discover -s tests -p test_museum_data.py
+          python3 -B tools/museum_check.py
+          node --test tests/test_museum_geometry.mjs
       - name: Pinned public source readback and interaction harness
         run: python3 -B tools/public_shop_check.py
diff --git a/README.md b/README.md
@@ -90,3 +90,7 @@ Start with [CONTRIBUTING.md](CONTRIBUTING.md) and [AGENTS.md](AGENTS.md). New wo
 ## License and citation
 
 Released under the [MIT License](LICENSE). Citation metadata is in [CITATION.cff](CITATION.cff).
+
+## Verification museum
+
+Open the [claim cards and source-bound exhibits](https://d6g8k5htny-coder.github.io/main/site/museum.html) for quoted scopes, proof/review identities, and replay links. The [packet list](https://d6g8k5htny-coder.github.io/main/site/museum.html#packets) shows submissions present in its pinned default-branch snapshot; packets are not STATUS. The museum uses the Math checkout and query checkout pinned above. [Display documentation](docs/site/README.md) explains its snapshots and limits.
diff --git a/docs/PUBLIC_SHOP_SETUP.md b/docs/PUBLIC_SHOP_SETUP.md
@@ -1,6 +1,6 @@
 # Public shop deployment and contribution board
 
-Scientific effect: **NONE**. This page records verified public deployment and the remaining review-settings configuration. A live site or installed setting does not promote mathematical status.
+Scientific effect: **NONE**. This page records verified public deployment and review-settings installation. A live site or installed setting does not promote mathematical status.
 
 ## Pages
 
@@ -26,7 +26,7 @@ The first five bounded tasks are [#141](https://github.com/d6g8k5htny-coder/main
 
 **Math- verified active:** [Proof vault: reviewed changes](https://github.com/d6g8k5htny-coder/Math-/rules/24045351) protects its default `main` branch. It requires a pull request, at least one approving review, approval of the most recent reviewable push, dismissal of stale approvals, resolved conversations, and an up-to-date **math-downstream-gates** check from GitHub Actions. Force pushes and deletion are blocked; the bypass list is empty.
 
-**Main intended configuration; the tightened settings still require a separate installation receipt.** In [main branch settings](https://github.com/d6g8k5htny-coder/main/settings/branches), require a pull request, at least one approving review, approval of the most recent reviewable push, and passing **verify**, **public-shop**, and **public-intake** checks. The external results guard is **public-intake**; its tests are a different check. A green replay is not mathematical acceptance. Do not grant outsiders direct write access.
+**Main verified active:** [Verified pull requests](https://github.com/d6g8k5htny-coder/main/rules/23798639) requires a pull request, at least one approving review, approval of the most recent reviewable push, dismissal of stale approvals, resolved conversations, and up-to-date **verify**, **public-shop**, and **public-intake** checks from GitHub Actions. Force pushes and deletion are blocked. The existing repository-admin bypass is restricted to pull requests; it was not expanded. See the [installation receipt](https://github.com/d6g8k5htny-coder/main/pull/149#issuecomment-5848091891), recorded separately from the deployment PR. The external results guard is **public-intake**; its tests are a different check. A green replay is not mathematical acceptance. Do not grant outsiders direct write access.
 
 A check name alone does not authenticate the workflow. Before merging an intake PR, inspect the **trusted public-intake workflow**, its `pull_request_target` event, the precise reviewed PR head, and the pass result. Administrative override must not be treated as a scientific review.
 

diff --git a/docs/site/IMPLEMENTATION.md b/docs/site/IMPLEMENTATION.md
@@ -0,0 +1,45 @@
+# Verification museum implementation plan
+
+> For agentic workers: use the subagent-driven-development workflow for the independent projection, display, and geometry tasks; root owns integration and release.
+
+**Goal:** Expose pinned public mathematics, its exact scoped reviews and open limits, and landed intake packets without changing scientific status.
+
+**Architecture:** Extend the existing static Pages shop with a separate museum page and a small reproducible display projection. Reuse the existing public-math inventory and trusted incoming guard. Geometry explains source language; it is never replay evidence or an acceptance register.
+
+**Tech stack:** Python standard library exporter and checks, vanilla ES modules/SVG, an isolated optional Three.js scene with a 2D fallback.
+
+**Spec:** Owner's PUBLIC VERIFICATION DISPLAY + INTAKE ENGINEERING contract, 2026-09-26; W1–W12 are mapped below.
+
+## Global constraints
+
+- Scientific effect NONE. STATUS, proof bodies, review dispositions, and vault claims stay byte-identical.
+- Math snapshot: `d6628da09384728992dcbe6e921cc28ba85aebb0`; main snapshot: `71400b94f6cb354a8cf7aba73ffede2138a64efa`.
+- Existing STATUS/inventory snapshot and SIDE24 enclosure pins remain historical and explicit; query checkout stays `c88768bb11efd1f7d6bda188f13064bedec54a06`.
+- Every exhibit names its object, class, repository/path, full commit and SHA-256, and states: “This canvas explains the pinned source. It is not a proof and does not change status.”
+- No new repository or source inventory. No live field sampling. No outsider write or automatic packet promotion.
+- One main PR, draft until its hosted checks pass. Do not touch files owned by open PRs; specifically leave `docs/NAVIGATION.json` to #125 and the draft packet in #150 to its author.
+
+## Tasks and verification
+
+- [x] **W1–W2: exact claim projection.** `tools/museum_data.py` regenerates `docs/site/museum.json`: all 11 reviewed-result bullets and three AMEND rows, each with immutable proof/review identities. Preserve EXACT_COUNTEREXAMPLE and review-pointer limitations. Tests reject changed source bytes, quotes and invented acceptance. `museum.html`, `museum.mjs`, and `museum.css` show claim/source/replay columns and an engineering strip.
+- [x] **W3/W8: existing-shop integration.** Complete the SIDE24 visible identity contract, link the museum, and filter the original catalog by repository/path. Keep exact decimal endpoints. Replace the mutable browser ref fetch with the pinned query identity and local check instructions. Exercise real HTML IDs and filter behavior.
+- [x] **W4–W7: scoped exhibits.** Show a fixture-absent D2 card; EC-014 frame with camera orbit and 2D fallback; fixed-remote and fixed-annulus diagrams with OPEN complements; source-stated P15 finite example. Test displayed domains and controls; do not invent bounds or certifying samples.
+- [x] **W9: landed packets.** Project only the single packet present at the main snapshot, with RESULT identity, issue not stated, and “packet — not STATUS.” Reject draft-PR inclusion and unknown source identity.
+- [x] **W10–W11: retain intake/replay.** Existing trusted `public-intake.yml`, guard, task form, manual claim protocol and SIDE24 notebook already implement these lanes. The audit found no missing write-isolation feature.
+- [x] **W12/release.** Keep README and Math/query pins consistent. Run existing navigation, intake and public-shop checks plus new projection/view checks. Review the entire diff, then attach every touched file's commit and SHA-256 to the single PR. Hosted CI must pass before readiness; deploy only through the repository's permitted merge path.
+
+## Review focus
+
+- D5 fixed-annulus ACCEPT must never relabel the open pin-neighborhood/microdisk scope.
+- Imported EC-014 self-labels are custody bytes, not adopted dispositions.
+- Mutable review comments receive a pinned pointer identity, never an invented comment digest.
+- Missing WebGL or unavailable source bytes leaves readable fallback/absence states, not a success badge.
+- A packet is listed only from the pinned default snapshot; no result is promoted onto claim cards.
+
+## Audit baseline
+
+Current defaults and the live Pages site were inspected. Main's 17 open PR file lists were checked before edits. The baseline passed 85 Python tests and 16 frontend controls. Math and query need no PR. No committed lifetime sample was found, so the implementation uses the expressly allowed fixture-absent card.
+
+## Pre-publication validation
+
+The implementation passed 97 Python tests in normal and optimized modes; 16 existing frontend controls, four shop interaction controls, 15 museum frontend/integration controls, and eight geometry controls. Public source readback, navigation and landing checks passed. Independent source/scope and engineering reviews found no remaining critical or important findings after the source-association and bounded-fetch fixes. No scientific source/status file changed. Hosted PR checks and publication are release gates; these local checks do not assert deployment or successful GPU rendering.
diff --git a/docs/site/README.md b/docs/site/README.md
@@ -4,7 +4,7 @@ This static viewer makes the existing public work easier to read. It does not ow
 
 **Live:** [Open the public research shop](https://d6g8k5htny-coder.github.io/main/site/). Coordinate a bounded contribution on the [Public contributions board](https://github.com/users/d6g8k5htny-coder/projects/1/views/1).
 
-- **Board:** a mechanically exported, byte-bound `STATUS.md` snapshot. Counts refer to the selected rows, with full scope and limits. API observations are dated separately.
+- **Board:** a mechanically exported, byte-bound `STATUS.md` snapshot. Counts refer to the selected rows, with full scope and limits. Historical observations are dated separately; Pages does not fetch a mutable ref.
 - **SIDE24 explorer:** exact decimal endpoints from pinned public JSON; approximate bar lengths are NON-CERTIFYING. No lifetime curve, random field simulation, or new bound is generated.
 - **Inventory browser:** reads the existing `docs/public-math/sources.json` and its fourteen hash-verified shards. No second inventory is created.
 - **Contributions:** GitHub issues and incoming-only result PRs. The viewer has no upload endpoint, credentials, write token, or backend.
@@ -27,7 +27,7 @@ node --test tests/test_public_shop_frontend.mjs
 python3 -B tools/public_shop_check.py
 ```
 
-The interaction harness tests loading, searching, exact decimal selection and commit currency; it is not a visual browser test. Local-server preview was unavailable in the editing environment. After deployment on 2026-09-26, the live Pages site was checked in a real browser: all 2,138 original catalog records loaded and the exact SIDE24 source bytes verified.
+The interaction harness tests loading, searching, exact decimal selection and pinned query identity; it is not a visual browser test. Local-server preview was unavailable in the editing environment. The baseline live Pages site was checked in a real browser on 2026-09-26: all 2,138 original catalog records loaded and the exact SIDE24 source bytes verified. This baseline check does not validate a later museum deployment.
 
 Reproduce the exports with `python3 -B tools/public_shop_data.py --check`. The exporter uses fixed source identities, refuses changed bytes or unfamiliar tables, and preserves verbatim cells. Updating the snapshot requires an explicit source-bound engineering PR; this viewer never decides a review disposition.
 
@@ -39,4 +39,30 @@ The [SIDE24 notebook](../notebooks/SIDE24_PUBLIC_COEFFICIENTS.ipynb) exposes the
 
 GitHub Pages is configured as **Deploy from a branch → main → /docs**. The entry `docs/index.html` points to `site/`; `docs/.nojekyll` serves static files. The verified destination is [https://d6g8k5htny-coder.github.io/main/site/](https://d6g8k5htny-coder.github.io/main/site/). GitHub's branch publishing supports `/` or `/docs`, so `docs/site` is the app directory, not a selectable publishing root.
 
-See the [deployment and review settings record](../PUBLIC_SHOP_SETUP.md). Pages, the public Project, the four profile pins, and Math-'s proof-vault branch rules have been activated. Main's tightened review settings remain intended configuration pending separate verification; a public site does not establish branch protection or mathematical acceptance.
+See the [deployment and review settings record](../PUBLIC_SHOP_SETUP.md). Pages, the public Project, the four profile pins, and the main/Math- branch rules have installation receipts. A public site does not establish branch protection or mathematical acceptance.
+
+## Claim cards and exhibits
+
+Open [the verification museum](museum.html). Its small `museum.json` display projection is reproduced by `tools/museum_data.py`; it is not a replacement for the 2,138-row public inventory. The generator preserves all eleven bullets in Math-'s “Reviewed scoped results” and the three STATUS AMEND rows verbatim. An EXACT_COUNTEREXAMPLE retains that label; publication of a source does not make its claim accepted. Where a review is a GitHub comment, the displayed digest identifies the pinned index pointer, not mutable comment bytes.
+
+The museum binds Math sources to `d6628da09384728992dcbe6e921cc28ba85aebb0` and main source/packet membership to `71400b94f6cb354a8cf7aba73ffede2138a64efa`. The existing board/inventory pin `a26f744be7597e3f0c0543c34ead23049bbac657` and SIDE24 import pin `9d7b6802424fb4715b31999066aafca8ee2f3cca` remain explicit historical identities. Neither changes the README's Math checkout or query checkout. No source fetch selects an AMEND branch.
+
+Claims use claim/scope, source/review, and replay columns. Missing recorded replay commands are disclosed. The separate engineering strip and CI links do not attest to mathematical acceptance. D5's reviewed fixed-annulus region and its open pin-neighborhood/microdisk work remain separate objects.
+
+- EC-014 illustrates the two-pin frame and six data coordinates. Camera motion is presentation, not a replay of its Jacobian argument. Imported self-labels are not adopted.
+- D4/D5 diagrams show only their stated fixed regions, with OPEN complements. Diagram dimensions are schematic, not certified constants.
+- P15 illustrates the source's stated finite realized-family example, with no unrestricted prize claim.
+- D2 has a **fixture absent** card: no committed lifetime/barcode samples were found in the audited defaults. No synthetic proof data or live Gaussian sampler is supplied.
+- The packet list contains only the one package in the pinned main snapshot. Later or unmerged PRs are excluded until a reviewed engineering refresh. Every row says **packet — not STATUS**.
+
+```sh
+python3 -B -m unittest discover -s tests -p test_museum_data.py
+python3 -B tools/museum_check.py
+node --test tests/test_museum_geometry.mjs
+```
+
+Existing intake enforcement remains `.github/workflows/public-intake.yml` and `tools/public_intake_check.py`: trusted `pull_request_target` code, no packet execution, incoming-only files, bounded identities, and a documented credential-pattern scan. The scan is not comprehensive. Task claims remain the human protocol in CONTRIBUTING; display inclusion never replaces review.
+
+`museum_check.py` reads the pinned public bytes, checks regeneration, and exercises the actual committed manifest through the display code with the declared HTML containers. It also tests refusal of cross-claim proof, scope and replay substitutions. It is an integration harness, not a browser layout or GPU test. `museum_data.py --check` remains available for export-only reproduction.
+
+The [implementation record](IMPLEMENTATION.md) maps W1–W12, coordination exclusions, and validation boundaries.