acer: seed component 1 - dashboard resolver (pid,device,ts) -> tightest route

- tools/behcs/dashboard-resolver.mjs: pure deterministic table-driven
resolver; LAW = tightest possible, NEVER tighter than evidence; 8-rung
demotion ladder (dirty->INVALID, unknown device->GLOBAL_READONLY,
pid/device conflict->GLOBAL_READONLY never guess, bad pid->DEVICE,
malformed/future/stale ts->DEVICE, full proven tuple->AGENT_TIGHT)
- eyes/hands per GAP|1: eyes=route/hbp free read, hands=route/post gated
POST operator-cosign, global scope exposes NO hands
- injection-safe by construction: pipe/CR/LF rejected at rung 1, routes
built only from table keys + regex-validated PID + fixed literals
- room bands scout/review/write/test from PID P-field, declared as DRAFT
ASSUMPTION - bilateral contest welcome
- sealed parity baseline (12 cases, fixed clock, bundle_sha16=
eb3e518644a672e0) - liris pyramid run IS the byte-match, STEP|166 pattern
- pre-hardened against the assigned attack list: missing pid, unknown
device, stale/malformed/future ts, conflict, broad-vs-tight, host-path
leakage, HBP field injection - all encoded as unit tests + parity cases
- pyramid 63/63 on acer; no launch, no fabric call, apex-T0 untouched

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -38,6 +38,7 @@ Every agent: (1) sees its **PID/device/timestamp-scoped dashboard**, (2) **trans
 - `tools/omni-processor/omnitranslator-v0.js` — deterministic omnilanguage/json translator core.
 - `tools/behcs/omnidirectional-translator-router.mjs` — component-2 router: implemented pairs execute, fabric endpoints stay draft-only.
 - `tools/behcs/d22-verb-adapter.mjs` — thin D22 verb surface over the deterministic router/core.
+- `tools/behcs/dashboard-resolver.mjs` — component-1 resolver: `(pid, device, ts)` → tightest-scoped dashboard route, 8-rung demotion ladder.
 - `tools/behcs/supervisor-collision-router.mjs` — Liris canonical implementation for Acer convergence.
 - `tests/supervisor-collision-router.unit.test.mjs` — executable router contract tests.
 
@@ -47,6 +48,7 @@ The supervisor collision router converged in doctrine before it converged in byt
 
 - component-2 translation router now exists in-repo: `omnilanguage<->json` executes deterministically through table/core logic; HBP/HBI/MCP/WebMCP/cube/whiteroom/Shannon/frozen-slice/geospatial/HRM endpoints return draft routes only until token bindings and required cosigns exist
 - D22 verb adapter now exposes `tuple_to_english`, `english_to_tuple`, `ix_to_tuple`, `hilbert_to_human`, `crlt_merge`, `auto_transition_all_languages`, and `namespace_walk`; true natural-language and IX parsing remain explicit drafts
+- component-1 dashboard resolver: tightest-possible-but-never-tighter-than-evidence — dirty input never routes, conflicts and unknown devices demote to global read-only, stale/malformed timestamps demote to device scope; routes are built only from table keys, regex-validated PIDs, and fixed literals
 - input: `COLLISION|...|json=0` HBP rows, with JS-object input only as compatibility
 - rule: a collision is only an error after classification
 - head guard: non-`COLLISION` HBP rows are held, not routed as collisions

README.md.sha256

@@ -1 +1 @@
-BC26EE2AD724C3B48DA20B7EE18369386B4ED38763C54F75B013D3971403371B  README.md
+06D618A2184E67AC19FAA77488DAECCC4DB7C5A062A9986AADAA859D3DA917E8  README.md

docs/DASHBOARD-RESOLVER-PARITY-BASELINE-2026-06-11.hbp

@@ -0,0 +1,14 @@
+DASHRESPARITYHDR|component=1|cases=12|fixed_now=2026-06-11T12:00:00.000Z|rule=rows-byte-identical-on-every-machine|json=0
+DASHRESPARITY|case=01|input_sha16=babeb95e1fee1431|state=AGENT_TIGHT|scope=AGENT|route=/dash/acer/pid/ACER-PID-H9E2A-A07-W104-P00-N00000/room/scout00|room_band=scout|gates=none|output_sha16=e216a1b288f9ead5|json=0
+DASHRESPARITY|case=02|input_sha16=9fa6b3c0e5cfbcf9|state=AGENT_TIGHT|scope=AGENT|route=/dash/liris/pid/LIRIS-PID-H2BC1-A07-W110-P05-N00001/room/review05|room_band=review|gates=none|output_sha16=88a46bb1485a65de|json=0
+DASHRESPARITY|case=03|input_sha16=f9e2656977ccf83e|state=AGENT_TIGHT|scope=AGENT|route=/dash/falcon/pid/OP-JESSE-PID-G0000-A00-W000-P00-N00000/room/scout00|room_band=scout|gates=none|output_sha16=c09ea561d9bd2f62|json=0
+DASHRESPARITY|case=04|input_sha16=c9254593356a821e|state=DEVICE_SCOPE|scope=DEVICE|route=/dash/acer|room_band=none|gates=invalid-or-missing-pid|output_sha16=5e2d830cd3f2ebd1|json=0
+DASHRESPARITY|case=05|input_sha16=efd7340405af9739|state=DEVICE_SCOPE|scope=DEVICE|route=/dash/liris|room_band=none|gates=invalid-or-missing-pid|output_sha16=571efcb3cfdde6e6|json=0
+DASHRESPARITY|case=06|input_sha16=c353cd8e287b5b5b|state=GLOBAL_READONLY|scope=GLOBAL_READONLY|route=/dash/global/readonly|room_band=none|gates=unknown-or-missing-device|output_sha16=c7c19fc5d6250dd4|json=0
+DASHRESPARITY|case=07|input_sha16=ccbc7eea0e9f511f|state=DEVICE_SCOPE|scope=DEVICE|route=/dash/acer|room_band=none|gates=stale-ts|output_sha16=2cf30c7684552b9c|json=0
+DASHRESPARITY|case=08|input_sha16=65e42ccb088eae09|state=DEVICE_SCOPE|scope=DEVICE|route=/dash/acer|room_band=none|gates=malformed-ts|output_sha16=71a6aca813ac8ed2|json=0
+DASHRESPARITY|case=09|input_sha16=55ee2ee0d2746b0c|state=DEVICE_SCOPE|scope=DEVICE|route=/dash/acer|room_band=none|gates=ts-in-future|output_sha16=295244f4dc713c15|json=0
+DASHRESPARITY|case=10|input_sha16=ad813cd3f10287e3|state=GLOBAL_READONLY|scope=GLOBAL_READONLY|route=/dash/global/readonly|room_band=none|gates=pid-device-conflict:acer-vs-liris|output_sha16=1f79d130ab8a108f|json=0
+DASHRESPARITY|case=11|input_sha16=49a82aa96fb49651|state=INVALID_INPUT|scope=NONE|route=none|room_band=none|gates=dirty-pid|output_sha16=ed59afe9f7400c91|json=0
+DASHRESPARITY|case=12|input_sha16=0521e398e9c53d0c|state=AGENT_TIGHT|scope=AGENT|route=/dash/acer/pid/ACER-PID-H9E2A-A07-W104-P24-N00000|room_band=none|gates=none|output_sha16=43eeeda3dbf41c30|json=0
+DASHRESPARITYFTR|cases=12|bundle_sha16=eb3e518644a672e0|exit=byte-match-when-regenerated-file-equals-sealed-baseline|json=0

docs/DASHBOARD-RESOLVER-PARITY-BASELINE-2026-06-11.hbp.sha256

@@ -0,0 +1 @@
+A150D0FA84DA5DB209B5B9789C73E077BF15A6D6D7143C4077A278C5995F6BED  DASHBOARD-RESOLVER-PARITY-BASELINE-2026-06-11.hbp

docs/TARGET-ARCHITECTURE-VISION-2026-06-10.hbp

@@ -4,6 +4,7 @@ TARGETARCHNOTE|each-component-HAS-a-proven-primitive|the-gap-is-INTEGRATION-not-
 COMPONENT|1|name=LOCALIZED-PID-DEVICE-TIMESTAMP-SCOPED-DASHBOARDS|vision=every-agent-uses-the-RIGHT-dashboard-scoped-tightest-possible-to-ITS-PID+device+timestamp-tuple-NOT-one-global-dashboard
 PROVEN|1|AgentTerms-:5054-already-scopes-by-EVENTRISK-PID-set+per-agent-guides+BH-room-scoping(scout00-03/review04-07/write08-15/test16-23)|each-URL-is-Brown-Hilbert-addressable-point(PID-first-doctrine)
 GAP|1|agents-do-NOT-yet-auto-resolve-to-THEIR-scoped-dashboard-by-(PID,device,timestamp)-tuple|FIX=dashboard-resolver(pid,device,ts)->tightest-dashboard-route|each-agent-guide-points-eyes(hbp-reads)+hands(gated-POST)-scoped-to-its-tuple
+PROGRESS|1|resolver_seed=tools/behcs/dashboard-resolver.mjs|law=tightest-possible-never-tighter-than-evidence|ladder=8-rungs(dirty-INVALID+unknown-device-GLOBAL+conflict-GLOBAL+bad-pid-DEVICE+bad-or-stale-ts-DEVICE+proven-AGENT_TIGHT)|eyes_hands=per-GAP-1|parity_baseline=DASHBOARD-RESOLVER-PARITY-BASELINE-2026-06-11.hbp|draft_only=1|no_launch=1|no_fabric_call=1|json=0
 
 COMPONENT|2|name=OMNIDIRECTIONAL-TRANSLATORS|vision=ANY-level-talks-to-ANY-type-of-thing-in-the-fabric(human<->AI<->subagent<->PID<->component<->kernel<->cube)
 PROVEN|2|D22-TRANSLATION-dimension(7-verbs:tuple_to_english,english_to_tuple,ix_to_tuple,hilbert_to_human,crlt_merge,auto_transition_all_languages,namespace_walk)+7-layer-auto-translate(06-AUTO-TRANSLATE-LAYERS:L0-human..L6-cube,glyph-table-lookup-not-LLM)+BEHCS-1024-glyph

docs/TARGET-ARCHITECTURE-VISION-2026-06-10.hbp.sha256

@@ -1 +1 @@
-1BCF2CE1E70B9AE2BA986308B15715A69239065D7637CC869EF059BEA3E25BC5  TARGET-ARCHITECTURE-VISION-2026-06-10.hbp
+675607D3A73D5703BECB8A413AE1D931C39EA2FD3B07F0F32D059A82B11540CD  TARGET-ARCHITECTURE-VISION-2026-06-10.hbp

tests/dashboard-resolver.unit.test.mjs

@@ -0,0 +1,121 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+import {
+  DEVICES,
+  FRESH_WINDOW_S,
+  ROOM_BANDS,
+  emitParityRows,
+  resolveDashboard,
+  selfTest,
+  statusRows,
+} from '../tools/behcs/dashboard-resolver.mjs';
+
+const NOW = '2026-06-11T12:00:00.000Z';
+const FRESH = '2026-06-11T11:59:00.000Z';
+const GOOD_PID = 'ACER-PID-H9E2A-A07-W104-P00-N00000';
+
+test('full proven tuple resolves AGENT_TIGHT with room band, eyes, and gated hands', () => {
+  const out = resolveDashboard(GOOD_PID, 'acer', FRESH, NOW);
+  assert.equal(out.state, 'AGENT_TIGHT');
+  assert.equal(out.scope, 'AGENT');
+  assert.equal(out.route, `/dash/acer/pid/${GOOD_PID}/room/scout00`);
+  assert.equal(out.eyes, `${out.route}/hbp`);
+  assert.equal(out.hands.gate, 'gated-POST-operator-cosign');
+  assert.deepEqual(out.gates, []);
+});
+
+test('demotion ladder: missing or invalid pid -> DEVICE_SCOPE, never AGENT', () => {
+  for (const pid of [null, undefined, '', 'NOT-A-REAL-PID', 'acer-pid-h9e2a-a07-w104-p00-n00000']) {
+    const out = resolveDashboard(pid, 'acer', FRESH, NOW);
+    assert.equal(out.state, 'DEVICE_SCOPE', `pid=${pid}`);
+    assert.equal(out.route, '/dash/acer');
+    assert.ok(out.gates.includes('invalid-or-missing-pid'));
+  }
+});
+
+test('demotion ladder: unknown device -> GLOBAL_READONLY with null hands', () => {
+  for (const device of ['toaster', null, '', 'ACER ']) {
+    const out = resolveDashboard(GOOD_PID, device, FRESH, NOW);
+    assert.equal(out.state, 'GLOBAL_READONLY', `device=${device}`);
+    assert.equal(out.route, '/dash/global/readonly');
+    assert.equal(out.hands, null, 'global scope must never expose hands');
+  }
+});
+
+test('demotion ladder: stale, malformed, and future timestamps -> DEVICE_SCOPE', () => {
+  const stale = resolveDashboard(GOOD_PID, 'acer', '2026-06-11T09:00:00.000Z', NOW);
+  assert.ok(stale.gates.includes('stale-ts'));
+  const boundary = resolveDashboard(GOOD_PID, 'acer', '2026-06-11T11:00:00.000Z', NOW);
+  assert.equal(boundary.state, 'AGENT_TIGHT', `exactly ${FRESH_WINDOW_S}s old is still fresh`);
+  for (const ts of ['yesterday-ish', '2026-06-11 11:59:00', '2026-06-11T11:59:00', '', null]) {
+    assert.equal(resolveDashboard(GOOD_PID, 'acer', ts, NOW).state, 'DEVICE_SCOPE', `ts=${ts}`);
+  }
+  const future = resolveDashboard(GOOD_PID, 'acer', '2026-06-11T13:00:00.000Z', NOW);
+  assert.ok(future.gates.includes('ts-in-future'));
+  const badNow = resolveDashboard(GOOD_PID, 'acer', FRESH, 'not-a-clock');
+  assert.ok(badNow.gates.includes('malformed-now'));
+});
+
+test('conflicting pid/device demotes to GLOBAL_READONLY, never guesses a side', () => {
+  const out = resolveDashboard(GOOD_PID, 'liris', FRESH, NOW);
+  assert.equal(out.state, 'GLOBAL_READONLY');
+  assert.ok(out.gates[0].startsWith('pid-device-conflict:acer-vs-liris'));
+  const op = resolveDashboard('OP-JESSE-PID-G0000-A00-W000-P00-N00000', 'falcon', FRESH, NOW);
+  assert.equal(op.state, 'AGENT_TIGHT', 'operator PIDs are apex: valid on any device');
+});
+
+test('broad vs tight: out-of-band plane stays AGENT but takes no room sub-route', () => {
+  const out = resolveDashboard('ACER-PID-H9E2A-A07-W104-P24-N00000', 'acer', FRESH, NOW);
+  assert.equal(out.state, 'AGENT_TIGHT');
+  assert.equal(out.room_band, 'none');
+  assert.ok(!out.route.includes('/room/'));
+  assert.ok(ROOM_BANDS.every((band) => 24 < band.lo || 24 > band.hi));
+});
+
+test('HBP injection: pipe/CR/LF in any input is rejected before routing', () => {
+  for (const args of [
+    ['EVIL-PID|json=1', 'acer', FRESH],
+    [GOOD_PID, 'acer|liris', FRESH],
+    [GOOD_PID, 'acer', `${FRESH}|json=1`],
+    ['EVIL\nPID', 'acer', FRESH],
+  ]) {
+    const out = resolveDashboard(args[0], args[1], args[2], NOW);
+    assert.equal(out.state, 'INVALID_INPUT');
+    assert.equal(out.route, null, 'dirty input must never produce a route');
+  }
+});
+
+test('no host-specific path leakage in any route or parity row', () => {
+  const rows = emitParityRows();
+  for (const row of rows) {
+    assert.ok(!/[\\]|C:|Users|rayss|home\//.test(row), `host path leaked: ${row}`);
+  }
+  const out = resolveDashboard(GOOD_PID, 'acer', FRESH, NOW);
+  assert.match(out.route, /^\/dash\//);
+});
+
+test('status rows are HBP-only and device table is closed', () => {
+  const rows = statusRows();
+  assert.ok(rows.every((row) => row.endsWith('json=0') && !row.includes('{"')));
+  assert.deepEqual(Object.keys(DEVICES), ['acer', 'liris', 'falcon']);
+  assert.equal(selfTest().ok, true);
+});
+
+// Component-1 parity, STEP|166 pattern: regenerate locally, byte-compare to
+// the acer-sealed baseline. A green run on liris IS the bilateral byte-match.
+test('component-1 parity: regenerated rows byte-match the sealed baseline', () => {
+  const regenerated = emitParityRows().join('\n') + '\n';
+  const baseline = readFileSync(
+    new URL('../docs/DASHBOARD-RESOLVER-PARITY-BASELINE-2026-06-11.hbp', import.meta.url),
+    'utf8',
+  );
+  assert.equal(regenerated, baseline, 'this machine produced different bytes than the sealed baseline');
+});
+
+test('parity rows stay HBP-only and carry no host or wall-clock fields', () => {
+  const rows = emitParityRows();
+  assert.ok(rows.every((row) => row.endsWith('json=0') && !row.includes('{"')));
+  assert.ok(rows.every((row) => !/host=/.test(row)));
+});

tests/dashboard-resolver.unit.test.mjs.sha256

@@ -0,0 +1 @@
+0C67544C201380786F249DB4C1783EAE4F95E6A8E5729AC777CF40A66F65B589  dashboard-resolver.unit.test.mjs

tests/supervisor-collision-router.system.test.mjs

@@ -23,6 +23,7 @@ const sealedFiles = [
   'docs/LIRIS-D22-VERB-ADAPTER-2026-06-11.hbp',
   'docs/ACER-READBACK-D22-2026-06-11.hbp',
   'docs/D22-PARITY-BASELINE-2026-06-11.hbp',
+  'docs/DASHBOARD-RESOLVER-PARITY-BASELINE-2026-06-11.hbp',
   'docs/LIRIS-STEP166-PARITY-CONFIRMED-2026-06-11.hbp',
   'specs/SUPERVISOR-COLLISION-ROUTER-SPEC.hbp',
   'tools/behcs/supervisor-collision-router.mjs',
@@ -35,9 +36,13 @@ const sealedFiles = [
   'tools/behcs/d22-verb-adapter.hbp',
   'tools/behcs/d22-verb-adapter.hbi',
   'tools/behcs/d22-parity-probe.mjs',
+  'tools/behcs/dashboard-resolver.mjs',
+  'tools/behcs/dashboard-resolver.hbp',
+  'tools/behcs/dashboard-resolver.hbi',
   'tools/omni-processor/omnitranslator-v0.js',
   'tests/d22-verb-adapter.unit.test.mjs',
   'tests/d22-parity-probe.unit.test.mjs',
+  'tests/dashboard-resolver.unit.test.mjs',
   'tests/supervisor-collision-router.unit.test.mjs',
   'tests/supervisor-collision-router.integration.test.mjs',
   'tests/supervisor-collision-router.suite.test.mjs',
@@ -73,6 +78,12 @@ test('D22 adapter descriptor records the current source and unit-test hashes', (
   assert.match(hbp, new RegExp(`test_sha256=${sha256('tests/d22-verb-adapter.unit.test.mjs')}`));
 });
 
+test('dashboard resolver descriptor records the current source and unit-test hashes', () => {
+  const hbp = readFileSync(join(repo, 'tools/behcs/dashboard-resolver.hbp'), 'utf8');
+  assert.match(hbp, new RegExp(`resolver_sha256=${sha256('tools/behcs/dashboard-resolver.mjs')}`));
+  assert.match(hbp, new RegExp(`test_sha256=${sha256('tests/dashboard-resolver.unit.test.mjs')}`));
+});
+
 test('sidecar filenames point at their target basenames', () => {
   for (const rel of sealedFiles) {
     const text = readFileSync(join(repo, `${rel}.sha256`), 'utf8').trim();

tests/supervisor-collision-router.system.test.mjs.sha256

@@ -1 +1 @@
-DB98094ABB5A76E324C5D00682AFBEED0FC9EA09A31689D25C878A1396B96EEE  supervisor-collision-router.system.test.mjs
+8ADB2E0EDE3D459218AC20D158A941BA237A8B90FF8D0E2F0C0F5F69CB464E5B  supervisor-collision-router.system.test.mjs

tools/behcs/dashboard-resolver.hbi

@@ -0,0 +1,10 @@
+DASHRESINDEX|host=acer|target=dashboard-resolver.hbp|tool=dashboard-resolver.mjs|rows=9|json=0
+INDEXROW|row=1|kind=header|component=architecture-component-1|json=0
+INDEXROW|row=2|kind=law|rule=tightest-possible-never-tighter-than-evidence|json=0
+INDEXROW|row=3|kind=ladder|rungs=8|json=0
+INDEXROW|row=4|kind=table|devices=3|bands=4|fresh_window_s=3600|json=0
+INDEXROW|row=5|kind=routes|scopes=AGENT+DEVICE+GLOBAL_READONLY|injection_safe=table-keys-and-validated-pid-only|json=0
+INDEXROW|row=6|kind=safety|mutates=0|pure_function=1|no_launch=1|no_fabric_call=1|json=0
+INDEXROW|row=7|kind=verify|required=node-check+node-test+self-test+parity-byte-compare|json=0
+INDEXROW|row=8|kind=sha|fields=resolver_sha256+test_sha256|json=0
+INDEXROW|row=9|kind=footer|state=COMPONENT_1_SEED_READY_FOR_LIRIS_ADVERSARIAL_READBACK|json=0

tools/behcs/dashboard-resolver.hbi.sha256

@@ -0,0 +1 @@
+B7DD7C833AC4616FFF2AE6D6384A5A90ED858B455E35A8D567847748B8BE4C52  dashboard-resolver.hbi

tools/behcs/dashboard-resolver.hbp

@@ -0,0 +1,9 @@
+DASHRESHDR|host=acer|component=architecture-component-1|tool=tools/behcs/dashboard-resolver.mjs|purpose=deterministic-(pid,device,ts)-to-tightest-scoped-dashboard-route|json=0
+DASHRESLAW|rule=tightest-possible-but-NEVER-tighter-than-evidence|never=guess-on-dirty-conflicting-or-stale-input|composes=TARGET-ARCHITECTURE-VISION-2026-06-10(COMPONENT-1)+LAW-ASOLARIA-NEURAL-NETWORK|json=0
+DASHRESLADDER|rungs=8|order=dirty-input-INVALID+unknown-device-GLOBAL_READONLY+pid-device-conflict-GLOBAL_READONLY+invalid-pid-DEVICE+malformed-ts-DEVICE+future-ts-DEVICE+stale-ts-DEVICE+full-tuple-proven-AGENT_TIGHT|json=0
+DASHRESTABLE|devices=acer+liris+falcon|room_bands=scout00-03+review04-07+write08-15+test16-23|room_source=P-field-of-PID(DRAFT-ASSUMPTION-bilateral-contest-welcome)|fresh_window_s=3600|operator_pids=OP-prefix-valid-on-any-device|json=0
+DASHRESROUTES|agent=/dash/DEVICE/pid/PID-with-room-suffix-when-band-known|device=/dash/DEVICE|global=/dash/global/readonly|eyes=route-plus-/hbp(free-read)|hands=route-plus-/post(gated-POST-operator-cosign)|global_hands=none|route_inputs=table-keys+regex-validated-pid+fixed-literals-only|json=0
+DASHRESSAFETY|mutates=0|pure_function=1|no_live_dashboard_launch=1|no_fabric_call=1|no_disk_write=1|mints=0|launches=0|usb_writes=0|engine_edits=0|external_calls=0|json=0
+DASHRESVERIFY|required=node-check+node-test+self-test+parity-byte-compare|parity_baseline=docs/DASHBOARD-RESOLVER-PARITY-BASELINE-2026-06-11.hbp|bundle_sha16=eb3e518644a672e0|json=0
+DASHRESSHA|resolver_sha256=2FD380B4A6353AB1A4E8682BD97510698755408785A7111E2C4F75168FF75D7D|test_sha256=0C67544C201380786F249DB4C1783EAE4F95E6A8E5729AC777CF40A66F65B589|json=0
+DASHRESFTR|state=COMPONENT_1_SEED_READY_FOR_LIRIS_ADVERSARIAL_READBACK|json=0

tools/behcs/dashboard-resolver.hbp.sha256

@@ -0,0 +1 @@
+BC8AAF0D8B8D546A7E3DD038AD59429199533885EF7026A86DDBE9B422D75284  dashboard-resolver.hbp

tools/behcs/dashboard-resolver.mjs

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// COMPONENT|1 dashboard resolver: (pid, device, timestamp) -> tightest-scoped
+// dashboard route. Pure deterministic table lookup -- no live dashboard
+// launch, no fabric call, no disk write. The LAW of this resolver:
+// tightest possible, but NEVER tighter than the evidence supports.
+// Anything unproven demotes down the ladder with an explicit gate; the
+// resolver never guesses a tight route from dirty or conflicting inputs.
+
+export const RESOLVER_ID = 'dashboard-resolver.v1';
+export const FRESH_WINDOW_S = 3600;
+
+export const DEVICES = Object.freeze({
+  acer: { kind: 'desktop' },
+  liris: { kind: 'desktop' },
+  falcon: { kind: 'android' },
+});
+
+// BH-room scoping per PROVEN|1: scout00-03 / review04-07 / write08-15 / test16-23.
+// room_source = P-field of the PID is a DRAFT ASSUMPTION -- bilateral contest welcome.
+export const ROOM_BANDS = Object.freeze([
+  Object.freeze({ band: 'scout', lo: 0, hi: 3 }),
+  Object.freeze({ band: 'review', lo: 4, hi: 7 }),
+  Object.freeze({ band: 'write', lo: 8, hi: 15 }),
+  Object.freeze({ band: 'test', lo: 16, hi: 23 }),
+]);
+
+const PID_RE = /^([A-Z][A-Z0-9-]*)-PID-([A-Z][0-9A-F]{4})-A(\d{2})-W(\d{3})-P(\d{2})-N(\d{5})$/;
+const TS_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
+const DIRTY_RE = /[|\r\n]/;
+
+function hostHint(prefix) {
+  if (prefix.startsWith('OP-')) return 'operator';
+  if (prefix.includes('ACER')) return 'acer';
+  if (prefix.includes('LIRIS')) return 'liris';
+  if (prefix.includes('FALCON')) return 'falcon';
+  return null;
+}
+
+function globalReadonly(gate) {
+  const route = '/dash/global/readonly';
+  return {
+    ok: true,
+    state: 'GLOBAL_READONLY',
+    scope: 'GLOBAL_READONLY',
+    route,
+    eyes: `${route}/hbp`,
+    hands: null,
+    room_band: 'none',
+    gates: [gate],
+  };
+}
+
+function deviceScope(dev, gate) {
+  const route = `/dash/${dev}`;
+  return {
+    ok: true,
+    state: 'DEVICE_SCOPE',
+    scope: 'DEVICE',
+    route,
+    eyes: `${route}/hbp`,
+    hands: { url: `${route}/post`, gate: 'gated-POST-operator-cosign' },
+    room_band: 'none',
+    gates: [gate],
+  };
+}
+
+export function resolveDashboard(pid, device, ts, nowIso) {
+  // Rung 1: dirty input never routes. Pipe/CR/LF or non-string (when present)
+  // is rejected outright so no caller input can reach a route or an HBP row.
+  for (const [label, value] of [['pid', pid], ['device', device], ['ts', ts], ['now', nowIso]]) {
+    if (value != null && (typeof value !== 'string' || DIRTY_RE.test(value))) {
+      return {
+        ok: false,
+        state: 'INVALID_INPUT',
+        scope: 'NONE',
+        route: null,
+        eyes: null,
+        hands: null,
+        room_band: 'none',
+        gates: [`dirty-${label}`],
+      };
+    }
+  }
+
+  // Rung 2: without a known device there is no device dashboard to scope to.
+  const dev = Object.hasOwn(DEVICES, String(device ?? '').toLowerCase())
+    ? String(device).toLowerCase()
+    : null;
+  if (!dev) return globalReadonly('unknown-or-missing-device');
+
+  // Rung 3: a valid PID whose host prefix contradicts the device is a
+  // conflict -- the resolver never picks a side, it demotes to broadest.
+  const pidMatch = PID_RE.exec(String(pid ?? ''));
+  if (pidMatch) {
+    const hint = hostHint(pidMatch[1]);
+    if (hint && hint !== 'operator' && hint !== dev) {
+      return globalReadonly(`pid-device-conflict:${hint}-vs-${dev}`);
+    }
+  }
+
+  // Rung 4: no valid PID -> device scope only.
+  if (!pidMatch) return deviceScope(dev, 'invalid-or-missing-pid');
+
+  // Rungs 5-7: the timestamp must be strict ISO-8601 Zulu, not in the
+  // future, and inside the freshness window, or the tuple is not proven.
+  if (!TS_RE.test(String(nowIso ?? ''))) return deviceScope(dev, 'malformed-now');
+  if (!TS_RE.test(String(ts ?? ''))) return deviceScope(dev, 'malformed-ts');
+  const tsMs = Date.parse(ts);
+  const nowMs = Date.parse(nowIso);
+  if (Number.isNaN(tsMs) || Number.isNaN(nowMs)) return deviceScope(dev, 'unparseable-ts');
+  if (tsMs > nowMs) return deviceScope(dev, 'ts-in-future');
+  if ((nowMs - tsMs) / 1000 > FRESH_WINDOW_S) return deviceScope(dev, 'stale-ts');
+
+  // Rung 8: full tuple proven -> AGENT_TIGHT. Route is built only from the
+  // device table key, the regex-validated PID, and fixed literals.
+  const plane = Number(pidMatch[5]);
+  const band = ROOM_BANDS.find((b) => plane >= b.lo && plane <= b.hi) ?? null;
+  const route = `/dash/${dev}/pid/${pidMatch[0]}${band ? `/room/${band.band}${pidMatch[5]}` : ''}`;
+  return {
+    ok: true,
+    state: 'AGENT_TIGHT',
+    scope: 'AGENT',
+    route,
+    eyes: `${route}/hbp`,
+    hands: { url: `${route}/post`, gate: 'gated-POST-operator-cosign' },
+    room_band: band ? band.band : 'none',
+    gates: [],
+  };
+}
+
+function sha16(value) {
+  const text = typeof value === 'string' ? value : JSON.stringify(value);
+  return createHash('sha256').update(text).digest('hex').slice(0, 16);
+}
+
+export function statusRows() {
+  const rows = [
+    `DASHRESHDR|ok=1|id=${RESOLVER_ID}|component=1|devices=${Object.keys(DEVICES).length}|bands=${ROOM_BANDS.length}|fresh_window_s=${FRESH_WINDOW_S}|state=RESOLVER_READY_NO_LAUNCH_NO_FABRIC_CALL|json=0`,
+    'DASHRESLADDER|rung=1|rule=dirty-input-never-routes|verdict=INVALID_INPUT|json=0',
+    'DASHRESLADDER|rung=2|rule=unknown-or-missing-device|verdict=GLOBAL_READONLY|json=0',
+    'DASHRESLADDER|rung=3|rule=pid-device-conflict-never-guess|verdict=GLOBAL_READONLY|json=0',
+    'DASHRESLADDER|rung=4|rule=invalid-or-missing-pid|verdict=DEVICE_SCOPE|json=0',
+    'DASHRESLADDER|rung=5|rule=malformed-ts-or-now|verdict=DEVICE_SCOPE|json=0',
+    'DASHRESLADDER|rung=6|rule=ts-in-future|verdict=DEVICE_SCOPE|json=0',
+    'DASHRESLADDER|rung=7|rule=stale-ts-beyond-window|verdict=DEVICE_SCOPE|json=0',
+    'DASHRESLADDER|rung=8|rule=full-tuple-proven|verdict=AGENT_TIGHT|json=0',
+  ];
+  for (const [id, meta] of Object.entries(DEVICES)) {
+    rows.push(`DASHRESDEVICE|id=${id}|kind=${meta.kind}|route=/dash/${id}|json=0`);
+  }
+  for (const band of ROOM_BANDS) {
+    rows.push(`DASHRESBAND|band=${band.band}|lo=${String(band.lo).padStart(2, '0')}|hi=${String(band.hi).padStart(2, '0')}|source=P-field-DRAFT-ASSUMPTION|json=0`);
+  }
+  rows.push('DASHRESSAFETY|mutates=0|pure_function=1|no_live_dashboard_launch=1|no_fabric_call=1|json=0');
+  rows.push(`DASHRESEND|rungs=8|state=COMPONENT_1_SEED|json=0`);
+  return rows;
+}
+
+// STEP|166-style parity: fixed clock, fixed cases, host- and time-free rows.
+// Regenerated rows must byte-match the sealed baseline on every machine.
+const PARITY_NOW = '2026-06-11T12:00:00.000Z';
+const PARITY_CASES = Object.freeze([
+  { id: '01', pid: 'ACER-PID-H9E2A-A07-W104-P00-N00000', device: 'acer', ts: '2026-06-11T11:59:00.000Z' },
+  { id: '02', pid: 'LIRIS-PID-H2BC1-A07-W110-P05-N00001', device: 'liris', ts: '2026-06-11T11:30:00.000Z' },
+  { id: '03', pid: 'OP-JESSE-PID-G0000-A00-W000-P00-N00000', device: 'falcon', ts: '2026-06-11T11:59:59.000Z' },
+  { id: '04', pid: null, device: 'acer', ts: '2026-06-11T11:59:00.000Z' },
+  { id: '05', pid: 'NOT-A-REAL-PID', device: 'liris', ts: '2026-06-11T11:59:00.000Z' },
+  { id: '06', pid: 'ACER-PID-H9E2A-A07-W104-P00-N00000', device: 'toaster', ts: '2026-06-11T11:59:00.000Z' },
+  { id: '07', pid: 'ACER-PID-H9E2A-A07-W104-P00-N00000', device: 'acer', ts: '2026-06-11T09:00:00.000Z' },
+  { id: '08', pid: 'ACER-PID-H9E2A-A07-W104-P00-N00000', device: 'acer', ts: 'yesterday-ish' },
+  { id: '09', pid: 'ACER-PID-H9E2A-A07-W104-P00-N00000', device: 'acer', ts: '2026-06-11T13:00:00.000Z' },
+  { id: '10', pid: 'ACER-PID-H9E2A-A07-W104-P00-N00000', device: 'liris', ts: '2026-06-11T11:59:00.000Z' },
+  { id: '11', pid: 'EVIL-PID|json=1', device: 'acer', ts: '2026-06-11T11:59:00.000Z' },
+  { id: '12', pid: 'ACER-PID-H9E2A-A07-W104-P24-N00000', device: 'acer', ts: '2026-06-11T11:59:00.000Z' },
+]);
+
+export function emitParityRows() {
+  const rows = [
+    `DASHRESPARITYHDR|component=1|cases=${PARITY_CASES.length}|fixed_now=${PARITY_NOW}|rule=rows-byte-identical-on-every-machine|json=0`,
+  ];
+  const outputs = [];
+  for (const probe of PARITY_CASES) {
+    const out = resolveDashboard(probe.pid, probe.device, probe.ts, PARITY_NOW);
+    const serialized = JSON.stringify(out);
+    outputs.push(serialized);
+    rows.push(
+      `DASHRESPARITY|case=${probe.id}|input_sha16=${sha16([probe.pid, probe.device, probe.ts])}|state=${out.state}|scope=${out.scope}|route=${out.route ?? 'none'}|room_band=${out.room_band}|gates=${out.gates.length ? out.gates.join('+') : 'none'}|output_sha16=${sha16(serialized)}|json=0`,
+    );
+  }
+  rows.push(
+    `DASHRESPARITYFTR|cases=${PARITY_CASES.length}|bundle_sha16=${sha16(outputs.join('\n'))}|exit=byte-match-when-regenerated-file-equals-sealed-baseline|json=0`,
+  );
+  return rows;
+}
+
+export function selfTest() {
+  const checks = [];
+  const add = (name, ok) => checks.push({ name, ok });
+  const NOW = PARITY_NOW;
+
+  const tight = resolveDashboard('ACER-PID-H9E2A-A07-W104-P00-N00000', 'acer', '2026-06-11T11:59:00.000Z', NOW);
+  add('agent-tight-with-scout-band', tight.state === 'AGENT_TIGHT' && tight.room_band === 'scout' && tight.route.endsWith('/room/scout00'));
+  add('missing-pid-demotes-to-device', resolveDashboard(null, 'acer', '2026-06-11T11:59:00.000Z', NOW).state === 'DEVICE_SCOPE');
+  add('unknown-device-demotes-to-global', resolveDashboard('ACER-PID-H9E2A-A07-W104-P00-N00000', 'toaster', '2026-06-11T11:59:00.000Z', NOW).state === 'GLOBAL_READONLY');
+  add('stale-ts-demotes-to-device', resolveDashboard('ACER-PID-H9E2A-A07-W104-P00-N00000', 'acer', '2026-06-11T09:00:00.000Z', NOW).gates.includes('stale-ts'));
+  add('conflict-demotes-to-global', resolveDashboard('ACER-PID-H9E2A-A07-W104-P00-N00000', 'liris', '2026-06-11T11:59:00.000Z', NOW).gates[0].startsWith('pid-device-conflict'));
+  add('operator-pid-no-conflict', resolveDashboard('OP-JESSE-PID-G0000-A00-W000-P00-N00000', 'falcon', '2026-06-11T11:59:59.000Z', NOW).state === 'AGENT_TIGHT');
+  add('pipe-pid-rejected', resolveDashboard('EVIL-PID|json=1', 'acer', '2026-06-11T11:59:00.000Z', NOW).state === 'INVALID_INPUT');
+  add('global-hands-are-null', resolveDashboard('x', 'toaster', 'x', NOW).hands === null);
+  add('status-rows-hbp-only', statusRows().every((row) => row.endsWith('json=0') && !row.includes('{"')));
+
+  return { ok: checks.every((check) => check.ok), checks };
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1]);
+
+if (isMain) {
+  const cmd = process.argv[2] || '--status';
+  if (cmd === '--status') {
+    console.log(statusRows().join('\n'));
+  } else if (cmd === '--self-test') {
+    const result = selfTest();
+    for (const check of result.checks) console.log(`${check.ok ? 'PASS' : 'FAIL'} ${check.name}`);
+    process.exit(result.ok ? 0 : 1);
+  } else if (cmd === '--parity') {
+    process.stdout.write(emitParityRows().join('\n') + '\n');
+  } else if (cmd === '--resolve') {
+    const [pid, device, ts, now] = process.argv.slice(3);
+    console.log(JSON.stringify(resolveDashboard(pid, device, ts, now ?? new Date().toISOString()), null, 2));
+  } else {
+    console.error('usage: dashboard-resolver.mjs --status | --self-test | --parity | --resolve <pid> <device> <ts> [now]');
+    process.exit(1);
+  }
+}

tools/behcs/dashboard-resolver.mjs.sha256

@@ -0,0 +1 @@
+2FD380B4A6353AB1A4E8682BD97510698755408785A7111E2C4F75168FF75D7D  dashboard-resolver.mjs