From 210b715a6f34eaaac7a71760304423993fb1df32 Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Tue, 22 Sep 2026 20:18:00 -0400
Subject: [PATCH] Share admin dashboard views through isolated read-only
 visitor access

---
 app/globals.css             |  2 +
 app/page.tsx                | 37 +++++++--------
 app/visitor/page.tsx        |  3 ++
 docs/spectator-monitor.md   | 25 +++++++++-
 scripts/spectator-server.py | 91 +++++++++++++++++++++++++++++++++++--
 scripts/test-spectator.py   | 20 ++++++--
 6 files changed, 152 insertions(+), 26 deletions(-)
 create mode 100644 app/visitor/page.tsx

diff --git a/app/globals.css b/app/globals.css
index 99802d5..2bc31c3 100644
--- a/app/globals.css
+++ b/app/globals.css
@@ -6,3 +6,5 @@
 *{box-sizing:border-box}body{margin:0;background:var(--background);color:var(--foreground);font-family:Arial,Helvetica,sans-serif;font-size:16px}button,input,textarea{font:inherit}button{cursor:pointer}button:disabled{cursor:not-allowed}h1,h2,h3,p{margin:0}h1{font:500 34px Georgia,serif;letter-spacing:.01em}h2{font-size:17px;font-weight:600}h3{font-size:16px;font-weight:600}small{font-size:13px;color:var(--muted)}svg{flex-shrink:0}.app-main{flex:1;min-width:0}.brand{display:flex;align-items:center;gap:12px;padding:27px 22px 25px}.brand-mark{font:38px Georgia,serif;color:#e3bb70}.brand strong{font:26px Georgia,serif;color:#e3bb70}.brand small{display:block;letter-spacing:2px;font-size:10px;margin-top:6px}.nav-section{color:#6f829b;letter-spacing:1.8px;font-size:11px;padding:24px 16px 10px}.nav-button{height:45px!important;margin-bottom:4px;padding:0 14px!important;font-size:14px!important}.nav-button svg{width:18px!important;height:18px!important}.sidebar-bottom{border-top:1px solid var(--border);padding:20px;margin:16px 8px 0;line-height:1.6;font-size:13px;color:var(--muted)}.topbar{height:65px;display:flex;align-items:center;justify-content:space-between;border-bottom:1px solid var(--border);padding:0 32px;background:#0d1622}.crumb{color:var(--muted);font-size:14px;display:flex;align-items:center;gap:12px}.top-right{display:flex;align-items:center;gap:16px;font-size:13px}.sim-badge{color:#e3bb70;border:1px solid #715b30;background:#30271b;padding:5px 10px;border-radius:5px;font-size:12px;white-space:nowrap}.content{padding:30px 32px;max-width:1800px;margin:auto}.page-heading{display:flex;justify-content:space-between;gap:20px;align-items:center;margin-bottom:26px}.eyebrow{font-size:11px;letter-spacing:2px;color:#c7a667;text-transform:uppercase;margin-bottom:9px}.subtitle{color:var(--muted);font-size:14px;margin-top:9px;line-height:1.6}.actions{display:flex;align-items:center;gap:9px;flex-wrap:wrap}.panel{background:linear-gradient(125deg,#121e2d,#0e1824);border:1px solid var(--border);border-radius:8px;overflow:hidden}.panel-head{padding:18px 21px;display:flex;align-items:center;justify-content:space-between;gap:12px;border-bottom:1px solid var(--border)}.panel-head h2{display:flex;gap:10px;align-items:center}.panel-head svg{color:#93a9c8;width:18px}.panel-body{padding:21px}.stats{display:grid;grid-template-columns:repeat(4,1fr);gap:16px;margin-bottom:23px}.stat{padding:21px;position:relative}.stat-label{font-size:14px;color:var(--muted);display:flex;align-items:center;justify-content:space-between}.stat-value{font-size:32px;font-weight:600;margin:13px 0 7px;font-variant-numeric:tabular-nums}.stat small{font-size:12px}.stat svg{color:#7aa4df;width:20px}.dashboard-grid{display:grid;grid-template-columns:minmax(0,1.55fr) minmax(280px,1fr);gap:22px}.span-all{grid-column:1/-1}.director-strip{background:linear-gradient(110deg,#243143,#141f2c);border-color:#526072;display:flex;justify-content:space-between;align-items:center;gap:20px;padding:24px;margin-bottom:23px}.director-strip h2{font:22px Georgia,serif;margin-bottom:9px}.director-strip p{font-size:14px;line-height:1.6;color:#b0bfd1}.director-icon{width:48px;height:48px;color:#e3bb70;flex-shrink:0}.director-content{display:flex;align-items:center;gap:20px}.tag{display:inline-block;border:1px solid #314a67;border-radius:4px;padding:3px 7px;font-size:12px;color:#9cbdee;background:#192b42}.tag.online{color:#80d9af;border-color:#285e49;background:#15372d}.tag.paused{color:#e0bf78;border-color:#5a4c2d;background:#302a1f}.tag.offline,.tag.retired{color:#a1aec1;background:#202937;border-color:#394251}.event-row{display:grid;grid-template-columns:51px 77px 1fr;gap:12px;align-items:start;font-size:14px;line-height:1.5;padding:15px 20px;border-bottom:1px solid #202d3c}.event-row:last-child{border:0}.event-time{font:12px monospace;color:#788da6;padding-top:4px}.event-kind{font-size:11px;line-height:24px;color:#98b9ef;text-transform:capitalize}.event-kind.error{color:#fb8994}.event-kind.memory{color:#b8a5e8}.event-kind.lifecycle{color:#7ec9aa}.bot-name{display:flex;align-items:center;gap:12px}.avatar{width:37px;height:40px;border:1px solid #526084;border-radius:7px;display:grid;place-items:center;font:20px Georgia,serif;color:#c7b7ee;background:linear-gradient(140deg,#333555,#19263b)}.avatar.Warrior,.avatar.Paladin{color:#e3bb70;border-color:#786040;background:linear-gradient(140deg,#453a2b,#282b32)}.avatar.Rogue{color:#88cba9;border-color:#3b715e}.bot-name strong{font-size:14px}.bot-name small{display:block;margin-top:4px;font-size:12px}.data-table th{font-size:11px;text-transform:uppercase;letter-spacing:1px;color:#8297b1;padding:14px 20px}.data-table td{padding:15px 20px;font-size:14px}.data-table tbody tr{cursor:pointer}.data-table tbody tr:hover{background:#192738}.recipe-grid{display:grid;grid-template-columns:repeat(2,1fr);gap:18px}.recipe-card{padding:22px;cursor:pointer;text-align:left;width:100%;transition:border-color .2s}.recipe-card:hover{border-color:#7093c5}.recipe-card h3{margin:14px 0 10px}.recipe-card p{color:var(--muted);font-size:14px;line-height:1.6;min-height:46px}.recipe-card .tags{margin-top:18px;display:flex;gap:6px;flex-wrap:wrap}.recipe-symbol{width:40px;height:40px;border:1px solid #4b5674;background:#202c40;display:grid;place-items:center;border-radius:8px;color:#b5c9eb}.section-grid{display:grid;grid-template-columns:1fr 1fr;gap:22px}.form-grid{display:grid;grid-template-columns:1fr 1fr;gap:17px}.field{display:flex;flex-direction:column;gap:8px;font-size:14px}.field.full{grid-column:1/-1}.field input,.field textarea{background:#0b1420;border:1px solid #35465c;border-radius:5px;padding:10px;width:100%;color:#e1e9f4}.field textarea{min-height:84px;resize:vertical}.field [data-slot=select-trigger]{width:100%;height:42px;background:#0b1420}.form-footer{display:flex;justify-content:flex-end;gap:10px;margin-top:23px}.range-label{display:flex;justify-content:space-between;font-size:14px;margin-bottom:13px}.range-row{margin:18px 0}.choice-row{display:flex;align-items:center;gap:10px;font-size:14px}.choices{display:grid;grid-template-columns:1fr 1fr;gap:14px}.detail-header{padding:24px 0;display:flex;gap:16px;align-items:center}.detail-header .avatar{width:57px;height:63px;font-size:30px}.detail-header h2{font:27px Georgia,serif}.detail-block{padding:20px 0;border-bottom:1px solid var(--border)}.detail-block h3{margin-bottom:13px}.detail-block p{font-size:14px;color:#b1bfd0;line-height:1.7}.memory{padding:13px;background:#0c1622;border-left:2px solid #8c79b5;margin:12px 0}.memory small{display:block;margin-top:7px}.list-muted{color:var(--muted);font-size:14px;line-height:1.7}.zone-row{display:flex;align-items:center;gap:15px;font-size:14px;margin-bottom:20px}.zone-row .bar{flex:1;height:5px;background:#243449;border-radius:5px}.zone-row .bar i{display:block;height:100%;background:#759acc;border-radius:5px}.zone-row .zone-label{width:116px}.engine-box{display:flex;gap:14px;padding:18px;border:1px solid var(--border);border-radius:6px;margin-bottom:15px}.engine-box svg{color:#d2af73}.engine-box p{font-size:14px;color:var(--muted);line-height:1.6;margin-top:6px}.notice{padding:15px 18px;background:#1e2939;border:1px solid #3b506a;border-radius:6px;font-size:14px;line-height:1.6;color:#b7c8df;margin-bottom:20px}.empty-note{padding:32px;text-align:center;color:var(--muted)}.toolbar{display:flex;gap:12px;align-items:center;margin-bottom:20px}.toolbar input{max-width:330px}.health-row{display:flex;justify-content:space-between;padding:12px 0;font-size:14px;border-bottom:1px solid var(--border)}.health-row span{color:var(--muted)}.status-message{margin-top:15px;color:#b7c8df;font-size:14px}.fineprint{font-size:12px;line-height:1.7;color:#8296b0;margin-top:16px}.mobile-trigger{display:none}.screen-loading{padding:40px}.mobile-zone{display:none}@media(max-width:1100px){.content{padding:24px}.dashboard-grid{grid-template-columns:1fr}.stats{gap:10px}.stat{padding:16px}.section-grid{grid-template-columns:1fr}.director-strip{align-items:flex-start}.topbar{padding:0 24px}}@media(max-width:767px){.mobile-trigger{display:inline-flex}.content{padding:20px 15px}.topbar{padding:0 15px}.top-right>span:last-child{display:none}.page-heading{align-items:flex-start;flex-direction:column;gap:15px}h1{font-size:29px}.stats{grid-template-columns:1fr 1fr}.stat-value{font-size:27px}.director-strip{flex-direction:column;padding:18px}.director-icon{display:none}.recipe-grid,.form-grid{grid-template-columns:1fr}.field.full{grid-column:auto}.event-row{grid-template-columns:42px 1fr;gap:8px}.event-kind{display:none}.recipe-card p{min-height:0}.topbar .crumb{font-size:12px}.panel-head{padding:16px}.panel-body{padding:17px}}
 .gm-preview{font-family:monospace;font-size:13px;line-height:1.8;margin:20px 0;padding:16px;background:#080e17;border-left:2px solid #688ee3}.gm-preview span{color:#79a9ff}.gm-preview code{color:#b7bfce}.console-output{min-height:390px;max-height:570px;overflow:auto;background:#060c14;padding:25px;font:14px/1.7 monospace}.console-welcome{color:#79a7f5;letter-spacing:1px;margin-bottom:20px}.console-welcome span{color:#a0adc1;font-size:12px;letter-spacing:0}.console-muted{color:#788ba6;margin-bottom:20px}.console-entry{border-top:1px solid #1c2737;padding:14px 0;color:#9ccef2}.console-entry pre{white-space:pre-wrap;overflow-wrap:anywhere;font:13px/1.7 monospace;margin-top:8px}.console-error{color:#ec8e9c}.console-input{display:flex;gap:10px;align-items:center;padding:16px;background:#101b29}.console-input>span{color:#83adf8;font:20px monospace}.console-input input{font-family:monospace}.gm-shortcut{display:flex;justify-content:space-between;gap:15px;border:1px solid #2b3a4e;border-radius:5px;padding:12px;width:100%;margin-bottom:10px;font-size:14px;text-align:left}.gm-shortcut:hover{background:#203047}.gm-shortcut code{font-size:12px;color:#8eafe4}
 *,::before,::after{border-color:var(--border)}
+
+.readonly-fieldset{border:0;padding:0;margin:0;min-width:0}fieldset[disabled] button,fieldset[disabled] input,fieldset[disabled] textarea{cursor:default}
diff --git a/app/page.tsx b/app/page.tsx
index 036810e..3704a6e 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -24,45 +24,46 @@ const options=(items:string[])=>items.map(value=>({value,label:value}));
 function Avatar({bot}:{bot:Bot}){return <div className={`avatar ${bot.role}`} aria-hidden="true">{bot.name.slice(0,1)}</div>}
 function Panel({title,icon:Icon,children,action,className=''}:any){return <section className={`panel ${className}`}><div className="panel-head"><h2>{Icon&&<Icon/>}{title}</h2>{action}</div>{children}</section>}
 function Events({events}:{events:RealmEvent[]}){return <div>{events.length?[...events].reverse().map(e=><div className="event-row" key={e.id}><span className="event-time">{new Date(e.at).toLocaleTimeString([],{hour:'2-digit',minute:'2-digit'})}</span><span className={`event-kind ${e.kind}`}>{e.kind}</span><span>{e.message}</span></div>):<div className="empty-note">No events match this filter.</div>}</div>}
-export default function Home(){
+export default function Home({readOnly=false}:{readOnly?:boolean}){
  const [state,setState]=useState<State|null>(null),[page,setPage]=useState('Dashboard'),[error,setError]=useState(''),[busy,setBusy]=useState(false),[query,setQuery]=useState(''),[filter,setFilter]=useState('all'),[botId,setBotId]=useState<string|null>(null),[createOpen,setCreateOpen]=useState(false),[recipe,setRecipe]=useState<Recipe|null>(null),[recipeOpen,setRecipeOpen]=useState(false),[confirm,setConfirm]=useState<{title:string;description:string;action:any}|null>(null),[capabilities,setCapabilities]=useState<any>({}),[monitor,setMonitor]=useState<any>(null);
  const refresh=useCallback(async()=>{try{const r=await fetch('/api/state');const d:any=await r.json();if(!r.ok)throw new Error(d.error);setState(d);setError('');}catch(e){setError(e instanceof Error?e.message:'Could not load realm');}},[]);
  useEffect(()=>{void refresh();void fetch('/api/health').then(r=>r.json()).then(setCapabilities).catch(()=>{});const timer=setInterval(refresh,5000);return()=>clearInterval(timer);},[refresh]);
  useEffect(()=>{if(page!=='World Monitor')return;let cancelled=false;const load=async()=>{try{const r=await fetch('/api/world-monitor');const d=await r.json();if(!cancelled)setMonitor(d);}catch{if(!cancelled)setMonitor(null);}};void load();const timer=setInterval(load,3000);return()=>{cancelled=true;clearInterval(timer);};},[page]);
- const act=useCallback(async(action:any)=>{setBusy(true);try{const r=await fetch('/api/actions',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(action)});const d:any=await r.json();if(!r.ok)throw new Error(d.error);await refresh();return d;}catch(e){toast.error(e instanceof Error?e.message:'Action failed');await refresh();throw e;}finally{setBusy(false);}},[refresh]);
+ const act=useCallback(async(action:any)=>{if(readOnly)throw new Error('Visitor access is read-only');setBusy(true);try{const r=await fetch('/api/actions',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(action)});const d:any=await r.json();if(!r.ok)throw new Error(d.error);await refresh();return d;}catch(e){toast.error(e instanceof Error?e.message:'Action failed');await refresh();throw e;}finally{setBusy(false);}},[refresh,readOnly]);
  const perform=(action:any)=>{void act(action).catch(()=>{});};
- useEffect(()=>{const context=(document as any).modelContext;if(!context?.registerTool)return;const controller=new AbortController();const register=(tool:any)=>{try{Promise.resolve(context.registerTool(tool,{signal:controller.signal})).catch(()=>{});}catch{}};
+ useEffect(()=>{if(readOnly)return;const context=(document as any).modelContext;if(!context?.registerTool)return;const controller=new AbortController();const register=(tool:any)=>{try{Promise.resolve(context.registerTool(tool,{signal:controller.signal})).catch(()=>{});}catch{}};
  register({name:'azerothai_read_realm',description:'Read current bot identities, recipes, director settings and recent events.',inputSchema:{type:'object',properties:{},additionalProperties:false},annotations:{readOnlyHint:true},execute:async()=>{const r=await fetch('/api/state');if(!r.ok)throw new Error('Realm unavailable');return r.json();}});
- register({name:'azerothai_create_bot',description:'Create an offline bot identity; does not spawn it in game.',inputSchema:{type:'object',properties:{name:{type:'string'},role:{type:'string'},race:{type:'string'},recipeId:{type:'string'},goal:{type:'string'}},required:['name','role','race','recipeId','goal'],additionalProperties:false},annotations:{readOnlyHint:false},execute:async(input:any)=>act({...input,type:'createBot'})});return()=>controller.abort();},[act]);
+ register({name:'azerothai_create_bot',description:'Create an offline bot identity; does not spawn it in game.',inputSchema:{type:'object',properties:{name:{type:'string'},role:{type:'string'},race:{type:'string'},recipeId:{type:'string'},goal:{type:'string'}},required:['name','role','race','recipeId','goal'],additionalProperties:false},annotations:{readOnlyHint:false},execute:async(input:any)=>act({...input,type:'createBot'})});return()=>controller.abort();},[act,readOnly]);
  function nav(p:string){setPage(p);setQuery('');setFilter('all');}
  const selected=state?.bots.find(b=>b.id===botId);
  const visible=state?.bots.filter(b=>(`${b.name} ${b.role} ${b.zone}`.toLowerCase().includes(query.toLowerCase()))&&(filter==='all'||b.status===filter))??[];
  function botTable(bots:Bot[]){return <Table className="data-table"><TableHeader><TableRow><TableHead>Character</TableHead><TableHead>Status</TableHead><TableHead>Location</TableHead><TableHead>Recipe</TableHead><TableHead/></TableRow></TableHeader><TableBody>{bots.map(b=><TableRow key={b.id} onClick={()=>setBotId(b.id)}><TableCell><div className="bot-name"><Avatar bot={b}/><div><button onClick={()=>setBotId(b.id)}><strong>{b.name}</strong></button><small>Lv. {b.level} · {b.race} {b.role}</small></div></div></TableCell><TableCell><span className={`tag ${b.status}`}>{b.status}</span></TableCell><TableCell>{b.zone}</TableCell><TableCell><small>{b.personality.name.replace('The ','')}</small></TableCell><TableCell><ArrowRight size={15}/></TableCell></TableRow>)}</TableBody></Table>}
- return <SidebarProvider style={{'--sidebar-width':'228px'} as React.CSSProperties}><Sidebar><SidebarHeader className="p-0"><div className="brand"><span className="brand-mark">A</span><div><strong>AzerothAI</strong><small>YOUR WORLD. ALIVE.</small></div></div></SidebarHeader><SidebarContent className="px-3"><div className="nav-section">REALM MANAGEMENT</div><SidebarMenu>{NAV.map(([name,Icon])=><SidebarMenuItem key={name}><SidebarMenuButton className="nav-button" isActive={page===name} onClick={()=>nav(name)}><Icon/><span>{name}</span></SidebarMenuButton></SidebarMenuItem>)}</SidebarMenu></SidebarContent><SidebarFooter><div className="sidebar-bottom"><Shield size={20} color="#d9b77a"/><p style={{marginTop:10,color:'#d6dfec'}}>Realm administrator</p><small>Prototype 0.1 · Private realm</small><p style={{marginTop:20,fontFamily:'Georgia',fontStyle:'italic'}}>“What if Azeroth never felt empty?”</p></div></SidebarFooter></Sidebar><main className="app-main"><header className="topbar"><div className="crumb"><SidebarTrigger className="mobile-trigger"/>Living Realm <span>/</span> <span style={{color:'#d8e2f0'}}>{page}</span></div><div className="top-right"><span className="sim-badge">{capabilities.aleActiveRecently?'AZEROTHCORE LIVE':state?.settings.connector==='azerothcore'?'AzerothCore bridge':'SIMULATION REALM'}</span><span>GM workspace</span></div></header><div className="content">
- <div className="page-heading"><div><div className="eyebrow">{page==='GM Console'?'THE WORLD IS YOUR SANDBOX':'AZEROTHAI CONTROL PLANE'}</div><h1>{page==='Dashboard'?'Your realm, alive.':page}</h1><p className="subtitle">{({'Dashboard':'The people, personalities, and stories that make your world.','World Monitor':'Watch Azeroth breathe: population, activity, systems, and the lives unfolding right now.','Realm Director':'Shape the adventure around you. Let your characters bring it to life.','World & Housing':'Homes, routines, simulation bands, and believable population flow.','Bots':'Give every character a purpose, then let their story unfold.','Bot Recipes':'Same model. Different personalities. A world of possibilities.','Memory & Bonds':'A shared history makes the next encounter matter.','Event Stream':'Follow the decisions and changes happening across your realm.','GM Console':'Pull up a chair. Put on the blue robe. Run your world.','Server & Models':'Connect the game engine and the minds behind your characters.'} as any)[page]}</p></div><div className="actions">{page==='Bot Recipes'?<Button onClick={()=>{setRecipe(null);setRecipeOpen(true)}}><Plus size={16}/>Create recipe</Button>:<><Button variant="outline" disabled={busy} onClick={()=>void refresh()}><RefreshCw size={15}/>Refresh</Button><Button onClick={()=>setCreateOpen(true)}><Plus size={16}/>Create bot</Button></>}</div></div>
+ return <SidebarProvider style={{'--sidebar-width':'228px'} as React.CSSProperties}><Sidebar><SidebarHeader className="p-0"><div className="brand"><span className="brand-mark">A</span><div><strong>AzerothAI</strong><small>YOUR WORLD. ALIVE.</small></div></div></SidebarHeader><SidebarContent className="px-3"><div className="nav-section">REALM MANAGEMENT</div><SidebarMenu>{NAV.map(([name,Icon])=><SidebarMenuItem key={name}><SidebarMenuButton className="nav-button" isActive={page===name} onClick={()=>nav(name)}><Icon/><span>{name}</span></SidebarMenuButton></SidebarMenuItem>)}</SidebarMenu></SidebarContent><SidebarFooter><div className="sidebar-bottom"><Shield size={20} color="#d9b77a"/><p style={{marginTop:10,color:'#d6dfec'}}>{readOnly?'Realm visitor · Read only':'Realm administrator'}</p><small>{readOnly?'Live realm monitor':'Prototype 0.1 · Private realm'}</small><p style={{marginTop:20,fontFamily:'Georgia',fontStyle:'italic'}}>“What if Azeroth never felt empty?”</p></div></SidebarFooter></Sidebar><main className="app-main"><header className="topbar"><div className="crumb"><SidebarTrigger className="mobile-trigger"/>Living Realm <span>/</span> <span style={{color:'#d8e2f0'}}>{page}</span></div><div className="top-right"><span className="sim-badge">{capabilities.aleActiveRecently?'AZEROTHCORE LIVE':state?.settings.connector==='azerothcore'?'AzerothCore bridge':'SIMULATION REALM'}</span><span>{readOnly?'Visitor · Read only':'GM workspace'}</span></div></header><div className="content">
+ <div className="page-heading"><div><div className="eyebrow">{page==='GM Console'?'THE WORLD IS YOUR SANDBOX':'AZEROTHAI CONTROL PLANE'}</div><h1>{page==='Dashboard'?'Your realm, alive.':page}</h1><p className="subtitle">{({'Dashboard':'The people, personalities, and stories that make your world.','World Monitor':'Watch Azeroth breathe: population, activity, systems, and the lives unfolding right now.','Realm Director':'Shape the adventure around you. Let your characters bring it to life.','World & Housing':'Homes, routines, simulation bands, and believable population flow.','Bots':'Give every character a purpose, then let their story unfold.','Bot Recipes':'Same model. Different personalities. A world of possibilities.','Memory & Bonds':'A shared history makes the next encounter matter.','Event Stream':'Follow the decisions and changes happening across your realm.','GM Console':'Pull up a chair. Put on the blue robe. Run your world.','Server & Models':'Connect the game engine and the minds behind your characters.'} as any)[page]}</p></div><div className="actions">{readOnly?<Button variant="outline" onClick={()=>void refresh()}><RefreshCw size={15}/>Refresh</Button>:page==='Bot Recipes'?<Button onClick={()=>{setRecipe(null);setRecipeOpen(true)}}><Plus size={16}/>Create recipe</Button>:<><Button variant="outline" disabled={busy} onClick={()=>void refresh()}><RefreshCw size={15}/>Refresh</Button><Button onClick={()=>setCreateOpen(true)}><Plus size={16}/>Create bot</Button></>}</div></div>
  {error&&<div className="notice" role="alert">{error} <Button variant="outline" onClick={()=>void refresh()}>Retry</Button></div>}
  {!state?<div className="stats">{[1,2,3,4].map(n=><Skeleton key={n} className="h-32"/>)}</div>:<>
- {page==='Dashboard'&&<><div className="stats">{[[Users,'Active bots',state.bots.filter(b=>b.status==='online'&&(state.settings.connector==='simulation'||b.autonomy?.managed)).length,'Online in the simulation'],[BookOpen,'Bot recipes',state.recipes.length,'Distinct ways to experience the world'],[Brain,'Memories',state.bots.reduce((n,b)=>n+b.memories.length,0),'Stories carried into future decisions'],[Network,'Relationships',state.bots.reduce((n,b)=>n+b.relationships.length,0),'Directed bonds between characters']].map(([Icon,label,value,note]:any)=><div className="panel stat" key={label}><div className="stat-label">{label}<Icon/></div><div className="stat-value">{value}</div><small>{label==='Active bots'&&state.settings.connector!=='simulation'?'Acknowledged by the game bridge':note}</small></div>)}</div><section className="panel director-strip"><div className="director-content"><Compass className="director-icon"/><div><div className="eyebrow">YOUR NEXT ADVENTURE</div><h2>{state.director.experience}</h2><p>{state.director.zone} · {state.director.brief}</p></div></div><Button variant="outline" onClick={()=>nav('Realm Director')}>Shape the experience <ArrowRight size={15}/></Button></section><div className="dashboard-grid"><Panel title="Your characters" icon={Users} action={<Button variant="ghost" size="sm" onClick={()=>nav('Bots')}>Manage bots <ArrowRight size={14}/></Button>}>{botTable(state.bots.slice(0,5))}</Panel><Panel title="Realm pulse" icon={Radio}><div className="panel-body">{Array.from(new Set(state.bots.filter(b=>b.status==='online').map(b=>b.zone))).map(zone=>{const n=state.bots.filter(b=>b.status==='online'&&b.zone===zone).length;return <div className="zone-row" key={zone}><span className="zone-label">{zone}</span><span className="bar"><i style={{width:`${n/Math.max(1,state.bots.filter(b=>b.status==='online').length)*100}%`}}/></span><span>{n}</span></div>})}<p className="fineprint">Bot locations from the selected connector. Simulation locations are illustrative.</p><div className="engine-box" style={{marginTop:25,marginBottom:0}}><Brain size={23}/><div><h3>{state.settings.provider==='deterministic'?'Personality simulator':state.settings.model}</h3><p>{state.settings.provider==='deterministic'?'No model required. Try a decision from any online bot.':'Local model selected. Each decision includes identity and memories.'}</p></div></div></div></Panel><Panel title="Recent activity" icon={Activity} action={<Button variant="ghost" size="sm" onClick={()=>nav('Event Stream')}>View stream <ArrowRight size={14}/></Button>}>{<Events events={state.events.slice(-5)}/>}</Panel><Panel title="The Game Master’s chair" icon={Shield}><div className="panel-body"><p className="list-muted">Set the scene. Announce a gathering. Move a character to the next chapter of their story.</p><div className="gm-preview"><span>&lt;GM&gt; AzerothAI</span><p>Welcome to your world.</p><code>.announce An adventure awaits...</code></div><Button variant="outline" onClick={()=>nav('GM Console')}>Open GM console <Terminal size={15}/></Button></div></Panel></div></>}
+ {page==='Dashboard'&&<><div className="stats">{[[Users,'Active bots',state.bots.filter(b=>b.status==='online'&&(state.settings.connector==='simulation'||b.autonomy?.managed)).length,'Online in the simulation'],[BookOpen,'Bot recipes',state.recipes.length,'Distinct ways to experience the world'],[Brain,'Memories',state.bots.reduce((n,b)=>n+b.memories.length,0),'Stories carried into future decisions'],[Network,'Relationships',state.bots.reduce((n,b)=>n+b.relationships.length,0),'Directed bonds between characters']].map(([Icon,label,value,note]:any)=><div className="panel stat" key={label}><div className="stat-label">{label}<Icon/></div><div className="stat-value">{value}</div><small>{label==='Active bots'&&state.settings.connector!=='simulation'?'Acknowledged by the game bridge':note}</small></div>)}</div><section className="panel director-strip"><div className="director-content"><Compass className="director-icon"/><div><div className="eyebrow">YOUR NEXT ADVENTURE</div><h2>{state.director.experience}</h2><p>{state.director.zone} · {state.director.brief}</p></div></div><Button variant="outline" onClick={()=>nav('Realm Director')}>{readOnly?'View realm direction':'Shape the experience'} <ArrowRight size={15}/></Button></section><div className="dashboard-grid"><Panel title="Your characters" icon={Users} action={<Button variant="ghost" size="sm" onClick={()=>nav('Bots')}>{readOnly?'View bots':'Manage bots'} <ArrowRight size={14}/></Button>}>{botTable(state.bots.slice(0,5))}</Panel><Panel title="Realm pulse" icon={Radio}><div className="panel-body">{Array.from(new Set(state.bots.filter(b=>b.status==='online').map(b=>b.zone))).map(zone=>{const n=state.bots.filter(b=>b.status==='online'&&b.zone===zone).length;return <div className="zone-row" key={zone}><span className="zone-label">{zone}</span><span className="bar"><i style={{width:`${n/Math.max(1,state.bots.filter(b=>b.status==='online').length)*100}%`}}/></span><span>{n}</span></div>})}<p className="fineprint">Bot locations from the selected connector. Simulation locations are illustrative.</p><div className="engine-box" style={{marginTop:25,marginBottom:0}}><Brain size={23}/><div><h3>{state.settings.provider==='deterministic'?'Personality simulator':state.settings.model}</h3><p>{state.settings.provider==='deterministic'?'No model required. Try a decision from any online bot.':'Local model selected. Each decision includes identity and memories.'}</p></div></div></div></Panel><Panel title="Recent activity" icon={Activity} action={<Button variant="ghost" size="sm" onClick={()=>nav('Event Stream')}>View stream <ArrowRight size={14}/></Button>}>{<Events events={state.events.slice(-5)}/>}</Panel><Panel title="The Game Master’s chair" icon={Shield}><div className="panel-body"><p className="list-muted">Set the scene. Announce a gathering. Move a character to the next chapter of their story.</p><div className="gm-preview"><span>&lt;GM&gt; AzerothAI</span><p>Welcome to your world.</p><code>.announce An adventure awaits...</code></div><Button variant="outline" onClick={()=>nav('GM Console')}>Open GM console <Terminal size={15}/></Button></div></Panel></div></>}
  {page==='World Monitor'&&<WorldMonitor state={state} monitor={monitor} capabilities={capabilities} openBot={setBotId}/>}
  {page==='Bots'&&<><div className="toolbar"><Input aria-label="Search bots" placeholder="Search name, class, or location…" value={query} onChange={e=>setQuery(e.target.value)}/><Choice label="Bot status" value={filter} onChange={setFilter} items={options(['all','online','paused','offline','retired'])}/><small>{visible.length} characters</small></div><Panel title="Bot lifecycle" icon={Users}>{visible.length?botTable(visible):<div className="empty-note">No matching bots. Create a character or adjust your filters.</div>}</Panel></>}
- {page==='Bot Recipes'&&<><div className="notice">Recipes are versioned. Saving a recipe preserves existing bots’ personalities until you explicitly apply the new version.</div><div className="recipe-grid">{state.recipes.map((r,i)=><button key={r.id} className="panel recipe-card" onClick={()=>{setRecipe(r);setRecipeOpen(true)}}><div style={{display:'flex',justifyContent:'space-between'}}><span className="recipe-symbol">{i%2?<Compass size={23}/>:<BookOpen size={23}/>}</span><small>VERSION {r.version}</small></div><h3>{r.name}</h3><p>{r.description}</p><div className="tags">{r.tags.map(t=><span className="tag" key={t}>{t}</span>)}</div><div style={{display:'flex',justifyContent:'space-between',marginTop:21}}><small>{state.bots.filter(b=>b.recipeId===r.id).length} bot identities</small><small style={{color:'#9abef7'}}>Edit recipe →</small></div></button>)}</div></>}
- {page==='Realm Director'&&<Director state={state} act={act} busy={busy}/>}
+ {page==='Bot Recipes'&&<><div className="notice">Recipes are versioned. Saving a recipe preserves existing bots’ personalities until you explicitly apply the new version.</div><div className="recipe-grid">{state.recipes.map((r,i)=><button key={r.id} className="panel recipe-card" onClick={()=>{setRecipe(r);setRecipeOpen(true)}}><div style={{display:'flex',justifyContent:'space-between'}}><span className="recipe-symbol">{i%2?<Compass size={23}/>:<BookOpen size={23}/>}</span><small>VERSION {r.version}</small></div><h3>{r.name}</h3><p>{r.description}</p><div className="tags">{r.tags.map(t=><span className="tag" key={t}>{t}</span>)}</div><div style={{display:'flex',justifyContent:'space-between',marginTop:21}}><small>{state.bots.filter(b=>b.recipeId===r.id).length} bot identities</small><small style={{color:'#9abef7'}}>{readOnly?'View recipe →':'Edit recipe →'}</small></div></button>)}</div></>}
+ {page==='Realm Director'&&<fieldset disabled={readOnly} className="readonly-fieldset"><Director state={state} act={act} busy={busy||readOnly}/></fieldset>}
+ {page==='World & Housing'&&<fieldset disabled={readOnly} className="readonly-fieldset"><WorldHousing state={state} act={act} busy={busy||readOnly}/></fieldset>}
  {page==='Memory & Bonds'&&<div className="recipe-grid">{state.bots.map(b=><Panel key={b.id} title={b.name} icon={Heart} action={<Button variant="ghost" size="sm" onClick={()=>setBotId(b.id)}>Open profile</Button>}><div className="panel-body"><p className="list-muted">{b.memories.length} memories · {b.relationships.length} relationships</p><div className="memory"><p>{b.memories.at(-1)?.text??'No memories yet.'}</p></div>{b.relationships.map(r=><p className="list-muted" key={r.targetId}>{state.bots.find(x=>x.id===r.targetId)?.name} · {r.affinity>0?'+':''}{r.affinity} affinity<br/>{r.note}</p>)}</div></Panel>)}</div>}
- {page==='Social Life'&&<CommunityPanel state={state} act={act} busy={busy}/>}
- {page==='System Health'&&<OperationsPanel state={state} act={act} busy={busy}/>}
- {page==='Event Stream'&&<EventStream state={state}/>}
- {page==='Server & Models'&&<Settings state={state} act={act} busy={busy} capabilities={capabilities}/>}
- {page==='GM Console'&&<GM state={state} act={act} busy={busy} capabilities={capabilities} setConfirm={setConfirm}/>}
+ {page==='Social Life'&&<CommunityPanel state={state} act={act} busy={busy||readOnly}/>}
+ {page==='System Health'&&<OperationsPanel state={state} act={act} busy={busy||readOnly}/>}
+ {page==='Event Stream'&&<EventStream state={state} readOnly={readOnly}/>}
+ {page==='Server & Models'&&<fieldset disabled={readOnly} className="readonly-fieldset"><Settings state={state} act={act} busy={busy||readOnly} capabilities={capabilities}/></fieldset>}
+ {page==='GM Console'&&<fieldset disabled={readOnly} className="readonly-fieldset"><GM state={state} act={act} busy={busy||readOnly} capabilities={capabilities} setConfirm={setConfirm}/></fieldset>}
  </>}
  <p className="fineprint" style={{textAlign:'center',marginTop:28}}>AzerothAI shapes identity and intent. AzerothCore owns the rules of the world.</p></div></main>
  <Dialog open={createOpen} onOpenChange={setCreateOpen}><DialogContent className="sm:max-w-xl"><DialogHeader><DialogTitle>Create a character</DialogTitle><DialogDescription>Start with an identity and recipe. Spawn when you’re ready.</DialogDescription></DialogHeader>{state&&<CreateBot state={state} busy={busy} act={act} close={()=>setCreateOpen(false)}/>}</DialogContent></Dialog>
- <Dialog open={recipeOpen} onOpenChange={setRecipeOpen}><DialogContent className="sm:max-w-2xl max-h-[90vh] overflow-y-auto"><DialogHeader><DialogTitle>{recipe?'Edit bot recipe':'Create bot recipe'}</DialogTitle><DialogDescription>Traits guide high-level decisions. They never override game rules.</DialogDescription></DialogHeader><RecipeEditor key={recipe?.id??'new'} recipe={recipe} busy={busy} act={act} close={()=>setRecipeOpen(false)}/></DialogContent></Dialog>
- <Sheet open={!!selected} onOpenChange={o=>{if(!o)setBotId(null)}}><SheetContent className="w-full sm:max-w-xl overflow-y-auto p-6"><SheetHeader className="p-0"><SheetTitle>Bot profile</SheetTitle><SheetDescription>Identity, intent, and the story so far.</SheetDescription></SheetHeader>{selected&&state&&<BotProfile key={selected.id} bot={selected} state={state} busy={busy} act={act} perform={perform} confirm={setConfirm}/>}</SheetContent></Sheet>
+ <Dialog open={recipeOpen} onOpenChange={setRecipeOpen}><DialogContent className="sm:max-w-2xl max-h-[90vh] overflow-y-auto"><DialogHeader><DialogTitle>{readOnly?'Bot recipe':recipe?'Edit bot recipe':'Create bot recipe'}</DialogTitle><DialogDescription>Traits guide high-level decisions. They never override game rules.</DialogDescription></DialogHeader><fieldset disabled={readOnly} className="readonly-fieldset"><RecipeEditor key={recipe?.id??'new'} recipe={recipe} busy={busy} act={act} close={()=>setRecipeOpen(false)}/></fieldset></DialogContent></Dialog>
+ <Sheet open={!!selected} onOpenChange={o=>{if(!o)setBotId(null)}}><SheetContent className="w-full sm:max-w-xl overflow-y-auto p-6"><SheetHeader className="p-0"><SheetTitle>Bot profile</SheetTitle><SheetDescription>Identity, intent, and the story so far.</SheetDescription></SheetHeader>{selected&&state&&<BotProfile readOnly={readOnly} key={selected.id} bot={selected} state={state} busy={busy} act={act} perform={perform} confirm={setConfirm}/>}</SheetContent></Sheet>
  <AlertDialog open={!!confirm} onOpenChange={o=>{if(!o)setConfirm(null)}}><AlertDialogContent><AlertDialogHeader><AlertDialogTitle>{confirm?.title}</AlertDialogTitle><AlertDialogDescription>{confirm?.description}</AlertDialogDescription></AlertDialogHeader><AlertDialogFooter><AlertDialogCancel>Cancel</AlertDialogCancel><AlertDialogAction onClick={()=>{if(confirm)perform(confirm.action);setConfirm(null)}}>Confirm</AlertDialogAction></AlertDialogFooter></AlertDialogContent></AlertDialog><Toaster theme="dark" richColors position="bottom-right"/></SidebarProvider>;
 }
 function CreateBot({state,act,busy,close}:any){const [name,setName]=useState(''),[role,setRole]=useState('Priest'),[race,setRace]=useState('Human'),[recipeId,setRecipeId]=useState(state.recipes[0].id),[goal,setGoal]=useState(`Support ${state.director.experience.toLowerCase()} in ${state.director.zone}`);return <form onSubmit={async e=>{e.preventDefault();try{await act({type:'createBot',name,role,race,recipeId,goal});toast.success('Character created');close();}catch{}}}><div className="form-grid"><label className="field">Character name<Input required minLength={2} maxLength={24} value={name} onChange={e=>setName(e.target.value)} placeholder="A name worth remembering"/></label><label className="field">Class<Choice label="Class" value={role} onChange={setRole} items={options(['Priest','Warrior','Mage','Rogue','Hunter','Paladin','Warlock','Druid','Shaman'])}/></label><label className="field">Race<Choice label="Race" value={race} onChange={setRace} items={options(['Human','Night Elf','Dwarf','Orc','Undead','Tauren','Gnome','Troll','Blood Elf','Draenei'])}/></label><label className="field">Bot recipe<Choice label="Bot recipe" value={recipeId} onChange={setRecipeId} items={state.recipes.map((r:Recipe)=>({value:r.id,label:r.name}))}/></label><label className="field full">Personal goal<textarea required maxLength={200} value={goal} onChange={e=>setGoal(e.target.value)}/></label></div><p className="fineprint">The live game bridge validates race/class combinations when spawning.</p><div className="form-footer"><Button disabled={busy} type="submit">Create identity</Button></div></form>}
 function RecipeEditor({recipe,act,busy,close}:any){const [r,setR]=useState<Recipe>(recipe??{name:'',description:'',tags:['Curious'],sociability:50,aggression:20,curiosity:70,economy:30,activities:['explore','quest']});const [tags,setTags]=useState(r.tags.join(', '));return <form onSubmit={async e=>{e.preventDefault();try{await act({type:'saveRecipe',recipe:{...r,tags:tags.split(',').map(t=>t.trim()).filter(Boolean)}});toast.success('Recipe saved');close();}catch{}}}><div className="form-grid"><label className="field full">Recipe name<Input required minLength={2} maxLength={80} value={r.name} onChange={e=>setR({...r,name:e.target.value})}/></label><label className="field full">Personality description<textarea maxLength={500} value={r.description} onChange={e=>setR({...r,description:e.target.value})}/></label><label className="field full">Tags, separated by commas<Input value={tags} onChange={e=>setTags(e.target.value)}/></label></div><div className="section-grid" style={{gap:25,marginTop:20}}><div>{(['sociability','aggression','curiosity','economy'] as const).map(key=><div className="range-row" key={key}><div className="range-label"><span style={{textTransform:'capitalize'}}>{key}</span><span>{r[key]}</span></div><Slider aria-label={key} min={0} max={100} step={1} value={[r[key]]} onValueChange={v=>setR({...r,[key]:v[0]})}/></div>)}</div><div><h3 style={{margin:'15px 0'}}>Preferred activities</h3><div className="choices">{ACTIVITIES.map(a=><label className="choice-row" key={a}><Checkbox checked={r.activities.includes(a)} onCheckedChange={v=>setR({...r,activities:v?[...r.activities,a]:r.activities.filter(x=>x!==a)})}/>{a}</label>)}</div></div></div><div className="form-footer">{recipe&&<Button type="button" variant="outline" disabled={busy} onClick={async()=>{try{const {id,version,...copy}=r;void id;void version;await act({type:'saveRecipe',recipe:{...copy,name:`${copy.name} copy`.slice(0,80)}});close();}catch{}}}><Copy size={15}/>Duplicate</Button>}<Button disabled={busy||!r.activities.length}>Save recipe</Button></div></form>}
-function BotProfile({bot:b,state,act,busy,perform,confirm}:any){const [memory,setMemory]=useState(''),[importance,setImportance]=useState(7),[target,setTarget]=useState(state.bots.find((x:Bot)=>x.id!==b.id)?.id??''),[affinity,setAffinity]=useState(40),[note,setNote]=useState(''),[recipeId,setRecipeId]=useState(b.recipeId);const actions=b.status==='online'?['pause','despawn']:b.status==='paused'?['resume','despawn']:b.status==='offline'?['spawn','retire']:[];return <><div className="detail-header"><Avatar bot={b}/><div><h2>{b.name}</h2><p className="subtitle">Level {b.level} {b.race} {b.role}</p></div><span className={`tag ${b.status}`} style={{marginLeft:'auto'}}>{b.status}</span></div><div className="actions">{actions.map(a=><Button key={a} size="sm" variant={a==='spawn'?'default':'outline'} disabled={busy} onClick={()=>a==='retire'?confirm({title:`Retire ${b.name}?`,description:'The identity and memories remain in your realm, but this bot cannot spawn again in this prototype.',action:{type:'lifecycle',botId:b.id,action:a}}):perform({type:'lifecycle',botId:b.id,action:a})}>{a==='pause'?<Pause size={14}/>:a==='spawn'||a==='resume'?<Play size={14}/>:null}{a.charAt(0).toUpperCase()+a.slice(1)}</Button>)}<Button size="sm" disabled={busy||b.status!=='online'} onClick={()=>perform({type:'think',botId:b.id})}><Brain size={15}/>{busy?'Working…':'Run decision'}</Button></div><Tabs defaultValue="identity" className="mt-6"><TabsList className="w-full"><TabsTrigger value="identity">Identity</TabsTrigger><TabsTrigger value="memory">Memory</TabsTrigger><TabsTrigger value="bonds">Relationships</TabsTrigger></TabsList><TabsContent value="identity"><div className="detail-block"><h3>Current goal</h3><p>{b.goal}</p><p style={{marginTop:12,display:'flex',gap:7,alignItems:'center'}}><MapPin size={15}/>{b.zone}</p></div><div className="detail-block"><h3>{b.personality.name} <small>v{b.recipeVersion}</small></h3><p>{b.personality.description}</p><div className="actions" style={{marginTop:12}}>{b.personality.tags.map((t:string)=><span className="tag" key={t}>{t}</span>)}</div><div className="field" style={{marginTop:20}}><Choice label="Apply recipe" value={recipeId} onChange={setRecipeId} items={state.recipes.map((r:Recipe)=>({value:r.id,label:`${r.name} · v${r.version}`}))}/><Button variant="outline" disabled={busy} onClick={()=>perform({type:'applyRecipe',botId:b.id,recipeId})}>Apply current recipe version</Button></div></div><div className="detail-block"><h3>Latest decision</h3><p>{b.lastDecision?`${b.lastDecision.action}: ${b.lastDecision.reason}`:'No decisions yet. Run a decision while this bot is online.'}</p><small>{b.decisions} decisions acknowledged</small></div></TabsContent><TabsContent value="memory"><form className="detail-block" onSubmit={async e=>{e.preventDefault();try{await act({type:'memory',botId:b.id,text:memory,importance});setMemory('');}catch{}}}><label className="field">Add a memory<textarea required value={memory} maxLength={1000} onChange={e=>setMemory(e.target.value)} placeholder="What should this character remember?"/></label><div className="range-row"><div className="range-label">Importance <span>{importance}/10</span></div><Slider aria-label="Memory importance" min={1} max={10} value={[importance]} onValueChange={v=>setImportance(v[0])}/></div><Button disabled={busy}>Save memory</Button></form>{[...b.memories].reverse().map((m:any)=><div className="memory" key={m.id}><p className="list-muted">{m.text}</p><small>{m.source} · Importance {m.importance}/10 · {new Date(m.at).toLocaleDateString()}</small></div>)}</TabsContent><TabsContent value="bonds"><p className="fineprint">Bonds are directional. One character’s trust does not imply the other’s.</p><form className="detail-block" onSubmit={async e=>{e.preventDefault();try{await act({type:'relationship',botId:b.id,targetId:target,affinity,note});setNote('');}catch{}}}><div className="field"><label>Other character</label><Choice label="Other character" value={target} onChange={setTarget} items={state.bots.filter((x:Bot)=>x.id!==b.id).map((x:Bot)=>({value:x.id,label:x.name}))}/></div><div className="range-row"><div className="range-label">Affinity <span>{affinity>0?'+':''}{affinity}</span></div><Slider aria-label="Affinity" min={-100} max={100} value={[affinity]} onValueChange={v=>setAffinity(v[0])}/></div><label className="field">Why this bond exists<textarea required maxLength={300} value={note} onChange={e=>setNote(e.target.value)}/></label><Button className="mt-4" disabled={busy||!target}>Save relationship</Button></form>{b.relationships.map((r:any)=><div className="memory" key={r.targetId}><h3>{state.bots.find((x:Bot)=>x.id===r.targetId)?.name} <span className="tag">{r.affinity>0?'+':''}{r.affinity}</span></h3><p className="list-muted">{r.note}</p></div>)}</TabsContent></Tabs></>}
+function BotProfile({bot:b,state,act,busy,perform,confirm,readOnly=false}:any){const [memory,setMemory]=useState(''),[importance,setImportance]=useState(7),[target,setTarget]=useState(state.bots.find((x:Bot)=>x.id!==b.id)?.id??''),[affinity,setAffinity]=useState(40),[note,setNote]=useState(''),[recipeId,setRecipeId]=useState(b.recipeId);const actions=b.status==='online'?['pause','despawn']:b.status==='paused'?['resume','despawn']:b.status==='offline'?['spawn','retire']:[];return <><div className="detail-header"><Avatar bot={b}/><div><h2>{b.name}</h2><p className="subtitle">Level {b.level} {b.race} {b.role}</p></div><span className={`tag ${b.status}`} style={{marginLeft:'auto'}}>{b.status}</span></div><fieldset disabled={readOnly} className="readonly-fieldset"><div className="actions">{actions.map(a=><Button key={a} size="sm" variant={a==='spawn'?'default':'outline'} disabled={busy} onClick={()=>a==='retire'?confirm({title:`Retire ${b.name}?`,description:'The identity and memories remain in your realm, but this bot cannot spawn again in this prototype.',action:{type:'lifecycle',botId:b.id,action:a}}):perform({type:'lifecycle',botId:b.id,action:a})}>{a==='pause'?<Pause size={14}/>:a==='spawn'||a==='resume'?<Play size={14}/>:null}{a.charAt(0).toUpperCase()+a.slice(1)}</Button>)}<Button size="sm" disabled={busy||b.status!=='online'} onClick={()=>perform({type:'think',botId:b.id})}><Brain size={15}/>{busy?'Working…':'Run decision'}</Button></div></fieldset><Tabs defaultValue="identity" className="mt-6"><TabsList className="w-full"><TabsTrigger value="identity">Identity</TabsTrigger><TabsTrigger value="memory">Memory</TabsTrigger><TabsTrigger value="bonds">Relationships</TabsTrigger></TabsList><TabsContent value="identity"><div className="detail-block"><h3>Current goal</h3><p>{b.goal}</p><p style={{marginTop:12,display:'flex',gap:7,alignItems:'center'}}><MapPin size={15}/>{b.zone}</p></div><div className="detail-block"><h3>{b.personality.name} <small>v{b.recipeVersion}</small></h3><p>{b.personality.description}</p><div className="actions" style={{marginTop:12}}>{b.personality.tags.map((t:string)=><span className="tag" key={t}>{t}</span>)}</div><fieldset disabled={readOnly} className="field" style={{marginTop:20}}><Choice label="Apply recipe" value={recipeId} onChange={setRecipeId} items={state.recipes.map((r:Recipe)=>({value:r.id,label:`${r.name} · v${r.version}`}))}/><Button variant="outline" disabled={busy} onClick={()=>perform({type:'applyRecipe',botId:b.id,recipeId})}>Apply current recipe version</Button></fieldset></div><div className="detail-block"><h3>Latest decision</h3><p>{b.lastDecision?`${b.lastDecision.action}: ${b.lastDecision.reason}`:'No decisions yet. Run a decision while this bot is online.'}</p><small>{b.decisions} decisions acknowledged</small></div></TabsContent><TabsContent value="memory"><fieldset disabled={readOnly} className="readonly-fieldset"><form className="detail-block" onSubmit={async e=>{e.preventDefault();try{await act({type:'memory',botId:b.id,text:memory,importance});setMemory('');}catch{}}}><label className="field">Add a memory<textarea required value={memory} maxLength={1000} onChange={e=>setMemory(e.target.value)} placeholder="What should this character remember?"/></label><div className="range-row"><div className="range-label">Importance <span>{importance}/10</span></div><Slider aria-label="Memory importance" min={1} max={10} value={[importance]} onValueChange={v=>setImportance(v[0])}/></div><Button disabled={busy}>Save memory</Button></form></fieldset>{[...b.memories].reverse().map((m:any)=><div className="memory" key={m.id}><p className="list-muted">{m.text}</p><small>{m.source} · Importance {m.importance}/10 · {new Date(m.at).toLocaleDateString()}</small></div>)}</TabsContent><TabsContent value="bonds"><p className="fineprint">Bonds are directional. One character’s trust does not imply the other’s.</p><fieldset disabled={readOnly} className="readonly-fieldset"><form className="detail-block" onSubmit={async e=>{e.preventDefault();try{await act({type:'relationship',botId:b.id,targetId:target,affinity,note});setNote('');}catch{}}}><div className="field"><label>Other character</label><Choice label="Other character" value={target} onChange={setTarget} items={state.bots.filter((x:Bot)=>x.id!==b.id).map((x:Bot)=>({value:x.id,label:x.name}))}/></div><div className="range-row"><div className="range-label">Affinity <span>{affinity>0?'+':''}{affinity}</span></div><Slider aria-label="Affinity" min={-100} max={100} value={[affinity]} onValueChange={v=>setAffinity(v[0])}/></div><label className="field">Why this bond exists<textarea required maxLength={300} value={note} onChange={e=>setNote(e.target.value)}/></label><Button className="mt-4" disabled={busy||!target}>Save relationship</Button></form></fieldset>{b.relationships.map((r:any)=><div className="memory" key={r.targetId}><h3>{state.bots.find((x:Bot)=>x.id===r.targetId)?.name} <span className="tag">{r.affinity>0?'+':''}{r.affinity}</span></h3><p className="list-muted">{r.note}</p></div>)}</TabsContent></Tabs></>}
 function WorldMonitor({state,monitor,capabilities,openBot}:any){
  const living:Bot[]=state.bots.filter((b:Bot)=>b.status!=='dead'&&b.status!=='retired');
  const active=living.filter((b:Bot)=>b.status==='online');
@@ -132,7 +133,7 @@ function WorldHousing({state,act,busy}:any){
  return <><div className="stats">{[[House,'Homes',state.homes.length,'Persistent places residents return to'],[Users,'Foreground',foreground,`Max ${state.settings.population.foregroundMax}`],[Activity,'Background',background,`Max ${state.settings.population.backgroundMax}`],[Pause,'Dormant',dormant,'Sleeping or cheaply simulated']].map(([Icon,label,value,note]:any)=><div className="panel stat" key={label}><div className="stat-label">{label}<Icon/></div><div className="stat-value">{value}</div><small>{note}</small></div>)}</div><div className="section-grid"><Panel title="World Population Director" icon={Compass}><form className="panel-body" onSubmit={async e=>{e.preventDefault();try{await act({type:'worldTrigger',kind,zone,playerName,detail});toast.success('World trigger evaluated');}catch{}}}><div className="form-grid"><label className="field">Trigger<Choice label="World trigger" value={kind} onChange={setKind} items={options(['zone-change','interaction','time','manual'])}/></label><label className="field">Zone<Input required value={zone} onChange={e=>setZone(e.target.value)}/></label><label className="field">Player name<Input value={playerName} onChange={e=>setPlayerName(e.target.value)}/></label><label className="field full">Context<textarea maxLength={500} value={detail} onChange={e=>setDetail(e.target.value)} placeholder="What happened in the world?"/></label></div><div className="form-footer"><Button disabled={busy}><Sparkles size={16}/>Evaluate population</Button></div><p className="fineprint">AzerothAI prefers existing residents with a believable reason to be here. It does not create disposable identities to fill a zone.</p></form></Panel><Panel title="Latest population plan" icon={Activity}><div className="panel-body">{plan?<><div className="health-row"><span>Trigger</span><strong>{plan.trigger.kind} · {plan.trigger.zone}</strong></div><div className="health-row"><span>Zone target</span><strong>{plan.target}</strong></div><div className="health-row"><span>Already active</span><strong>{plan.activeBefore}</strong></div><div className="health-row"><span>Requested</span><strong>{plan.requested}</strong></div><div className="health-row"><span>Capacity available</span><strong>{plan.capacity}</strong></div><div className="health-row"><span>Residents selected</span><strong>{plan.selectedBotIds.length}</strong></div>{plan.selectedBotIds.length>0&&<p className="list-muted" style={{marginTop:16}}>{plan.selectedBotIds.map((id:string)=>state.bots.find((b:Bot)=>b.id===id)?.name).filter(Boolean).join(', ')}</p>}{plan.rejectedReasons.map((x:string)=><p className="fineprint" key={x}>{x}</p>)}</>:<div className="empty-note">No population trigger has been evaluated yet.</div>}</div></Panel></div><Panel title="Housing registry" icon={House} className="mt-5"><Table className="data-table"><TableHeader><TableRow><TableHead>Home</TableHead><TableHead>Zone</TableHead><TableHead>Type</TableHead><TableHead>Residents</TableHead><TableHead>Safety</TableHead></TableRow></TableHeader><TableBody>{state.homes.map((h:any)=><TableRow key={h.id}><TableCell><strong>{h.name}</strong><small style={{display:'block'}}>{h.description}</small></TableCell><TableCell>{h.zone}</TableCell><TableCell>{h.type}</TableCell><TableCell>{h.residentIds.map((id:string)=>state.bots.find((b:Bot)=>b.id===id)?.name).filter(Boolean).join(', ')||'Vacant'} <small>({h.residentIds.length}/{h.capacity})</small></TableCell><TableCell>{h.safety}/100</TableCell></TableRow>)}</TableBody></Table></Panel></>
 }
 function Director({state,act,busy}:any){const [d,setD]=useState(state.director);return <div className="section-grid"><Panel title="Set the scene" icon={Compass}><form className="panel-body" onSubmit={async e=>{e.preventDefault();try{await act({type:'director',...d});toast.success('Direction saved and bot goals updated');}catch{}}}><div className="form-grid"><label className="field full">What kind of session do you want?<Choice label="Experience" value={d.experience} onChange={experience=>setD({...d,experience})} items={options(['Adventuring companions','A lively town','Exploration and discovery','Rivalries and tension'])}/></label><label className="field">Your character name<Input value={d.playerName} maxLength={40} onChange={e=>setD({...d,playerName:e.target.value})} placeholder="Optional"/></label><label className="field">Focus zone<Input required value={d.zone} maxLength={100} onChange={e=>setD({...d,zone:e.target.value})}/></label><label className="field full">Your direction<textarea required maxLength={500} value={d.brief} onChange={e=>setD({...d,brief:e.target.value})} style={{minHeight:140}}/></label></div><div className="form-footer"><Button disabled={busy}><Sparkles size={16}/>Apply realm direction</Button></div><p className="fineprint">Updates the goals of all non-retired bots. Run individual decisions from a bot profile to act on this direction.</p></form></Panel><Panel title="You play. The world responds." icon={Shield}><div className="panel-body"><div className="engine-box"><Users size={24}/><div><h3>Characters, not background noise</h3><p>A healer who remembers you. A trader with an agenda. A familiar rival on the road.</p></div></div><div className="engine-box"><Compass size={24}/><div><h3>Direction, not a scripted outcome</h3><p>Your brief goes into bot goals. Personality, memory, and available actions influence their next choice.</p></div></div><div className="engine-box"><Shield size={24}/><div><h3>The game stays the game</h3><p>The game connector translates intent. AzerothCore resolves movement, combat, loot, and progression.</p></div></div><div className="notice">Live Playerbots continue playing under AzerothCore even with no human online. AzerothAI periodically adds personality-, memory-, and goal-driven high-level intentions for authoritatively observed residents.</div></div></Panel></div>}
-function EventStream({state}:any){const [events,setEvents]=useState<RealmEvent[]>(state.events),[paused,setPaused]=useState(false),[kind,setKind]=useState('all'),[connection,setConnection]=useState('Connecting');useEffect(()=>{if(paused){setConnection('Paused');return;}setEvents(state.events);const source=new EventSource(`/api/events?after=${state.sequence}`);source.addEventListener('realm',(e:MessageEvent)=>{const event=JSON.parse(e.data);setEvents(old=>old.some(x=>x.id===event.id)?old:[...old,event].slice(-500));setConnection('Connected');});source.addEventListener('gap',()=>void fetch('/api/state').then(r=>r.json()).then((s:any)=>setEvents(s.events)));source.onopen=()=>setConnection('Connected');source.onerror=()=>setConnection('Reconnecting');return()=>source.close();},[paused]);return <><div className="toolbar"><Choice label="Event category" value={kind} onChange={setKind} items={options(['all','system','lifecycle','decision','memory','relationship','recipe','gm','death','housing','population','error'])}/><Button variant="outline" onClick={()=>setPaused(!paused)}>{paused?<Play size={15}/>:<Pause size={15}/>} {paused?'Resume stream':'Pause stream'}</Button><small>{connection}</small></div><Panel title="Realm event stream" icon={Activity} action={<small>Latest 500 events · replay on reconnect</small>}><Events events={events.filter(e=>kind==='all'||e.kind===kind)}/></Panel></>}
+function EventStream({state,readOnly=false}:any){const [events,setEvents]=useState<RealmEvent[]>(state.events),[paused,setPaused]=useState(false),[kind,setKind]=useState('all'),[connection,setConnection]=useState('Connecting');useEffect(()=>{if(paused){setConnection('Paused');return;}setEvents(state.events);if(readOnly){setConnection('Live · read only');return;}const source=new EventSource(`/api/events?after=${state.sequence}`);source.addEventListener('realm',(e:MessageEvent)=>{const event=JSON.parse(e.data);setEvents(old=>old.some(x=>x.id===event.id)?old:[...old,event].slice(-500));setConnection('Connected');});source.addEventListener('gap',()=>void fetch('/api/state').then(r=>r.json()).then((s:any)=>setEvents(s.events)));source.onopen=()=>setConnection('Connected');source.onerror=()=>setConnection('Reconnecting');return()=>source.close();},[paused,readOnly,state.sequence]);return <><div className="toolbar"><Choice label="Event category" value={kind} onChange={setKind} items={options(['all','system','lifecycle','decision','memory','relationship','recipe','gm','death','housing','population','error'])}/><Button variant="outline" onClick={()=>setPaused(!paused)}>{paused?<Play size={15}/>:<Pause size={15}/>} {paused?'Resume stream':'Pause stream'}</Button><small>{connection}</small></div><Panel title="Realm event stream" icon={Activity} action={<small>Latest 500 events · replay on reconnect</small>}><Events events={events.filter(e=>kind==='all'||e.kind===kind)}/></Panel></>}
 function Settings({state,act,busy,capabilities}:any){
  const [s,setS]=useState(state.settings),[health,setHealth]=useState('');
  const brains=s.brains;
diff --git a/app/visitor/page.tsx b/app/visitor/page.tsx
new file mode 100644
index 0000000..d4b9a27
--- /dev/null
+++ b/app/visitor/page.tsx
@@ -0,0 +1,3 @@
+'use client';
+import Home from '../page';
+export default function Visitor(){return <Home readOnly/>;}
diff --git a/docs/spectator-monitor.md b/docs/spectator-monitor.md
index 00a817e..0a98ed7 100644
--- a/docs/spectator-monitor.md
+++ b/docs/spectator-monitor.md
@@ -11,8 +11,8 @@ observed bot parties; guild goals and progress; confirmed social activity.
 Only autonomous bot-to-bot reply transcripts are public. Human conversations,
 whispers, memories, account/character IDs, tokens, configuration and PC telemetry
 are excluded. All text is rendered with textContent, never HTML interpolation.
-The HTTP service allows only explicit static paths and `/api/realm`, `/health`,
-`/robots.txt`. Mutation methods return 405; admin paths return 404.
+The HTTP service allows explicit public assets and read-only projections described
+below. Mutation methods return 405; administrative command paths return 404.
 
 ## Install and publish
 
@@ -58,3 +58,24 @@ After changing spectator source or assets, restart its service:
 ```sh
 systemctl --user restart azerothai-spectator
 ```
+
+## Shared dashboard (visitor edition)
+
+The public root now serves the application's `/visitor` route, which uses the
+same React dashboard and CSS as the administrator. Navigation, filters, profiles,
+recipe details and the world monitor remain usable. Editing forms and GM inputs
+are disabled; the action dispatcher also refuses writes in visitor mode.
+The public server independently rejects every mutation method, including server
+actions, and never proxies a viewer-selected backend route or request headers.
+
+`/api/state` is an explicit public projection shaped for the shared UI. Bot memory
+views contain confirmed shared social history, not private player conversations
+or operator-injected memories. The event stream is a polling view of that public
+history. `/api/health`, `/api/world-monitor` and `/api/operations` return selected
+read-only indicators. Native account identifiers, raw command queues, credentials,
+endpoint URLs and private maintenance logs are omitted. Built JavaScript/CSS/font
+assets are served from `dist/client` with traversal and source-map requests denied.
+
+Build with `pnpm build` before restarting `azerothai-runtime` and
+`azerothai-spectator`. The existing Funnel address and private admin address stay
+separate. No cache actions are added.
diff --git a/scripts/spectator-server.py b/scripts/spectator-server.py
index 7fbd4fc..8f7d8ac 100644
--- a/scripts/spectator-server.py
+++ b/scripts/spectator-server.py
@@ -64,6 +64,58 @@ def project(state):
             'parties': list(parties.values()), 'guilds': guilds, 'feed': feed[-60:][::-1]}
 
 
+def public_state(state):
+    """Admin-shaped data for the shared read-only UI, with an explicit allowlist."""
+    def pick(obj, keys):
+        return {k: obj[k] for k in keys.split() if k in obj and isinstance(obj[k], (str, int, float, bool))}
+    def recipe(r):
+        return {**pick(r, 'id name description sociability aggression curiosity economy version'),
+                'tags': [text(t, 80) for t in r.get('tags', [])],
+                'activities': [a for a in r.get('activities', []) if a in ['quest','explore','trade','rest','socialize']]}
+    projected = project(state)
+    feed = [{**e, 'id': 'public-'+str(i), 'status': 'confirmed'} for i, e in enumerate(reversed(projected['feed']))]
+    bots = []
+    for b in state.get('bots', []):
+        if not b.get('autonomy', {}).get('managed'):
+            continue
+        bot = pick(b, 'id name role race level zone status tier mortal plotArmorHpFloor simulationBand homeId recipeId recipeVersion goal decisions')
+        bot['personality'] = recipe(b.get('personality', {}))
+        bot['routine'] = {**pick(b.get('routine', {}), 'wakeHour sleepHour'), 'preferredZones': b.get('routine', {}).get('preferredZones', [])}
+        bot['autonomy'] = {'managed': True, **pick(b.get('autonomy', {}), 'observedAt lastIntentAt nextIntentAt')}
+        world = b.get('world') or {}
+        bot['world'] = {**pick(world, 'at team guildId guildName guildRank groupId inCombat x y mapId stationarySince'),
+                        'groupNames': [n for n in world.get('groupNames', []) if any(x['name']==n for x in state['bots'] if x.get('autonomy',{}).get('managed'))], 'nearby': []}
+        bot['relationships'] = [pick(r, 'targetId affinity note') for r in b.get('relationships', [])]
+        # Show shared history, never personal whispers or operator-injected memories.
+        bot['memories'] = [{'id': e['id'], 'text': e['text'], 'at': e['at'], 'source': 'observation', 'importance': 5}
+                           for e in feed if b['name'] in e['names']]
+        if b.get('death'):
+            bot['death'] = pick(b['death'], 'id at zone level cause killer source verified')
+        if b.get('lastDecision'):
+            bot['lastDecision'] = {'action': b['lastDecision']['action'], 'reason': 'Following the resident’s current activity.', 'goal': bot.get('goal','')}
+        bots.append(bot)
+    settings = state.get('settings') or {}
+    return {'revision': state.get('revision',0), 'sequence': state.get('sequence',0), 'aleRosterAt': state.get('aleRosterAt',0),
+            'bots': bots, 'recipes': [recipe(r) for r in state.get('recipes',[])],
+            'homes': [{**pick(h,'id name zone type capacity storageSlots safety description'), 'ownerIds':h.get('ownerIds',[]), 'residentIds':h.get('residentIds',[])} for h in state.get('homes',[])],
+            'events': [{'id':e['id'],'seq':i,'at':e['at'],'kind':'relationship' if e['kind']=='relationship' else 'lifecycle','message':e['text'],'mode':'azerothcore'} for i,e in enumerate(feed)],
+            'settings': {**pick(settings,'connector provider model'),
+                         'brains':pick(settings.get('brains',{}),'enabled residentModel heroModel backgroundUseLLM residentMemoryLimit heroMemoryLimit residentMaxTokens heroMaxTokens'),
+                         'hardcore':pick(settings.get('hardcore',{}),'enabled requireVerifiedDeath memorialize'),
+                         'population':pick(settings.get('population',{}),'defaultZoneTarget zoneMax serverMax foregroundMax backgroundMax')},
+            'director':{**pick(state.get('director',{}),'experience zone brief'),'playerName':''}, 'population':{}, 'operations':{},
+            'opsRetentionDays':state.get('opsRetentionDays',7),
+            'community':{'feed':feed,'evidence':[],'guilds':[{**g,'id':i} for i,g in enumerate(projected['guilds'])],
+                         'partiesEnabled':state.get('community',{}).get('partiesEnabled',True),
+                         'guildsEnabled':state.get('community',{}).get('guildsEnabled',True)}}
+
+
+def local_get(path):
+    opener = urllib.request.build_opener(NoRedirect(), urllib.request.ProxyHandler({}))
+    with opener.open('http://127.0.0.1:8787'+path, timeout=10) as response:
+        return response.read(8 * 1024 * 1024)
+
+
 class Snapshot:
     def __init__(self):
         self.lock = threading.Lock()
@@ -81,7 +133,8 @@ class Snapshot:
                         raw = response.read(8 * 1024 * 1024 + 1)
                         if len(raw) > 8 * 1024 * 1024:
                             raise ValueError('State too large')
-                        self.data = project(json.loads(raw))
+                        state = json.loads(raw)
+                        self.data = {**project(state), "state": public_state(state)}
                     self.failed = False
                 except Exception:
                     self.failed = True
@@ -119,14 +172,46 @@ class Handler(BaseHTTPRequestHandler):
         self.send_header('X-Frame-Options', 'DENY')
         self.send_header('Referrer-Policy', 'no-referrer')
         self.send_header('X-Robots-Tag', 'noindex, nofollow')
-        self.send_header('Content-Security-Policy', "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'")
+        self.send_header('Content-Security-Policy', "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'")
         self.end_headers()
         if self.command != 'HEAD':
             self.wfile.write(body)
 
     def do_GET(self):
         path = self.path.split('?', 1)[0]
-        if path in ASSETS:
+        if path in ('/', '/visitor', '/visitor/'):
+            try:
+                self.reply(200, local_get('/visitor'), 'text/html; charset=utf-8')
+            except Exception:
+                self.reply(503, b'{"error":"Realm temporarily unavailable"}')
+        elif path == '/api/state':
+            data = SNAPSHOT.get()
+            self.reply(200 if data else 503, json.dumps(data['state'] if data else {'error':'Realm unavailable'}).encode())
+        elif path == '/api/health':
+            data = SNAPSHOT.get()
+            self.reply(200, json.dumps({'ok':bool(data),'aleConfigured':True,'aleActiveRecently':bool(data and not data['stale']), 'llmConfigured':bool(data and data['state']['settings'].get('provider')!='deterministic')}).encode())
+        elif path == '/api/world-monitor':
+            data = SNAPSHOT.get()
+            at = data['rosterAt'] if data else 0
+            from datetime import datetime, timezone
+            self.reply(200, json.dumps({'ok':bool(data),'ale':{'lastEventAt':datetime.fromtimestamp(at,timezone.utc).isoformat() if at else None,'activeRecently':bool(data and not data['stale'])},'events':[],'commands':{}}).encode())
+        elif path == '/api/operations':
+            try:
+                health = json.loads(local_get('/api/operations'))
+                samples = [{k:v for k,v in row.items() if k in ('host','at','cpuPercent','memoryTotalMB','memoryAvailableMB','diskFreeGB','databaseMB','logsMB','modelAvailable','runtimeService')} for row in health.get('samples',[])]
+                self.reply(200, json.dumps({'samples':samples,'stuck':[{k:v for k,v in row.items() if k in ('name','zone','minutes')} for row in health.get('stuck',[])]}).encode())
+            except Exception:
+                self.reply(503,b'{"error":"Health data unavailable"}')
+        elif path.startswith(('/assets/', '/_vinext/', '/_next/')):
+            # Built public assets only. No source maps, dotfiles or traversal.
+            import mimetypes
+            root = ROOT.parent / 'dist/client'
+            asset = (root / path.lstrip('/')).resolve()
+            if '%' in path or '..' in path or not asset.is_relative_to(root.resolve()) or asset.suffix not in ('.js','.css','.woff','.woff2','.png','.svg','.ico') or not asset.is_file():
+                self.reply(404,b'{"error":"Not found"}')
+            else:
+                self.reply(200,asset.read_bytes(),mimetypes.guess_type(str(asset))[0] or 'application/octet-stream')
+        elif path in ASSETS:
             filename, content_type = ASSETS[path]
             self.reply(200, (ROOT / filename).read_bytes(), content_type)
         elif path == '/api/realm':
diff --git a/scripts/test-spectator.py b/scripts/test-spectator.py
index 6878938..e3aff8f 100644
--- a/scripts/test-spectator.py
+++ b/scripts/test-spectator.py
@@ -3,6 +3,7 @@ import importlib.util
 import json
 import threading
 import unittest
+from unittest.mock import patch
 import urllib.error
 import urllib.request
 from pathlib import Path
@@ -22,7 +23,11 @@ class SpectatorTests(unittest.TestCase):
                                    ('social-1', ['A', 'B'], 'SYNTHETIC_PROMPT'),
                                    ('social-1:reply', ['A', 'B'], 'Hello friend'),
                                    ('social-2:reply', ['HumanPlayer', 'A'], 'NOT_BOT_CHAT')]]
-        projected = m.project({'bots': bots, 'settings': {'token': 'SECRET'}, 'community': {'feed': feed}})
+        source={'bots': bots, 'settings': {'token': 'SECRET'}, 'community': {'feed': feed}}
+        projected = m.project(source)
+        public = m.public_state(source)
+        for forbidden in ['PRIVATE_MEMORY','PRIVATE_WHISPER','SYNTHETIC_PROMPT','NOT_BOT_CHAT','SECRET','accountId']:
+            self.assertNotIn(forbidden,json.dumps(public))
         serialized = json.dumps(projected)
         for private in ['PRIVATE_MEMORY', 'PRIVATE_WHISPER', 'SYNTHETIC_PROMPT', 'NOT_BOT_CHAT', 'HumanPlayer', 'SECRET', 'accountId', 'internal-guid']:
             self.assertNotIn(private, serialized)
@@ -35,18 +40,27 @@ class SpectatorTests(unittest.TestCase):
         worker.start()
         base = 'http://127.0.0.1:' + str(server.server_port)
         try:
-            for route in ['/', '/app.js', '/style.css', '/health']:
+            for route in ['/app.js', '/style.css', '/health']:
                 with urllib.request.urlopen(base + route) as response:
                     self.assertEqual(response.status, 200)
                     self.assertIn("default-src 'none'", response.headers['Content-Security-Policy'])
-            for path in ['/api/state', '/api/actions', '/api/ale/operator', '/api/operations', '/.dev.vars', '/../.dev.vars', '/%2e%2e/.dev.vars', '//api/state']:
+            for path in ['/api/actions', '/api/ale/operator', '/.dev.vars', '/../.dev.vars', '/%2e%2e/.dev.vars', '/api/bridge/ale/poll', '/assets/../../.dev.vars', '/assets/private.map']:
                 with self.assertRaises(urllib.error.HTTPError) as error:
                     urllib.request.urlopen(base + path)
                 self.assertEqual(error.exception.code, 404)
+                error.exception.close()
+            with patch.object(m,'local_get',return_value=b'<html>Visitor</html>') as upstream:
+                with urllib.request.urlopen(base+'/') as response:
+                    self.assertEqual(response.read(),b'<html>Visitor</html>')
+                upstream.assert_called_once_with('/visitor')
+            with patch.object(m.SNAPSHOT,'get',return_value={'state':{'bots':[]}}):
+                with urllib.request.urlopen(base+'/api/state') as response:
+                    self.assertEqual(json.load(response),{'bots':[]})
             for method in ['POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'TRACE']:
                 with self.assertRaises(urllib.error.HTTPError) as error:
                     urllib.request.urlopen(urllib.request.Request(base + '/api/actions', method=method, data=b'{}'))
                 self.assertEqual(error.exception.code, 405)
+                error.exception.close()
         finally:
             server.shutdown()
             server.server_close()