3D structure viewer for published entries

README.md

@@ -1,221 +1,221 @@
----
-title: Open Discovery Challenge
-emoji: 🧬
-colorFrom: green
-colorTo: blue
-sdk: docker
-app_port: 7860
-pinned: true
-# openid and profile come with hf_oauth by default; the extra scope list is for
-# permissions beyond that, and 'profile' is not a valid entry in it.
-hf_oauth: true
-short_description: Malaria drug leaderboard for AI-designed molecules
-tags:
-  - drug-discovery
-  - leaderboard
-  - malaria
-  - antimalarial
-  - chemistry
-  - cheminformatics
-  - admet
-  - molecular-docking
-  - ai-for-science
-  - benchmark
-  - smiles
-  - open-science
----
-
-# Open Discovery Challenge #1 — Malaria
-
-**An open leaderboard for AI-discovered malaria drug candidates.** Design a molecule with
-any AI model, submit it as SMILES, and it is scored automatically on potency, selectivity,
-ADMET and novelty — then ranked in the same table as approved antimalarial drugs.
-
-**Season #1 closes 30 September 2026. The top entry receives USD 1,000.**
-
----
-
-## What is this leaderboard?
-
-A public drug discovery leaderboard that answers one question: **is the molecule your AI
-just designed actually any good?**
-
-Large language models can propose thousands of drug candidates a day. Almost nobody can
-tell which of them are worth anything, because the tools that judge a candidate — docking,
-whole-cell activity prediction, ADMET, selectivity modelling — are not generally
-available. This leaderboard makes that judgement free and public.
-
-Every submission is scored by the same rubric, and **approved drugs and inert compounds
-are scored alongside the entries** so you can see the scale for yourself.
-
-| | |
-|---|---|
-| **Target** | PfDHODH — *Plasmodium falciparum* dihydroorotate dehydrogenase |
-| **Counter-target** | Human DHODH — must NOT be inhibited |
-| **Submission format** | SMILES or InChI |
-| **Score** | 0–100, computed automatically |
-| **Turnaround** | Minutes per entry (GPU queue) |
-| **Season #1 deadline** | 30 September 2026 |
-| **Prize** | USD 1,000 to the top-ranked entry |
-| **Who can enter** | Anyone with a Hugging Face account |
-| **Cost** | Free |
-
----
-
-## How the leaderboard works
-
-**1. Design a candidate with any AI model.**
-OpenAI, Claude, Gemini, Qwen, KIMI, DeepSeek, open-weight models, or by hand. The
-challenge does not restrict the tool — it records which model you used, so the leaderboard
-also shows *which AI models produce the best drug candidates*.
-
-**2. Submit the structure.**
-SMILES or InChI. Molecular formulas are not accepted — too many isomers to evaluate.
-Every entry is structure-checked on arrival for reactivity, PAINS motifs and duplicates.
-
-**3. It is scored and ranked automatically.**
-VIDRAFT's PharmaOS and CellOS compute binding, whole-cell antimalarial activity,
-selectivity over the human enzyme, ADMET, novelty and synthetic accessibility. Results
-appear on the leaderboard within minutes.
-
----
-
-## Scoring rubric
-
-| Axis | Points | What it measures |
-|---|---|---|
-| **Whole-cell activity** | 30 | Does the parasite actually die |
-| **Target binding** | 20 | Does it bind PfDHODH, efficiently for its size |
-| **Selectivity** | 20 | Binds the parasite enzyme, not the human one |
-| **ADMET** | 15 | Absorption, distribution, metabolism, toxicity |
-| **Novelty** | 10 | Structurally distinct from known antimalarials |
-| **Synthesis** | 5 | Can it actually be made |
-
-Three policies worth knowing before you submit:
-
-- **Novelty is multiplied by potency.** A novel but inactive molecule scores zero on this
-  axis. So does a potent analogue of a known drug.
-- **ADMET, novelty and synthesis scale with how much of a candidate the molecule is.** A
-  perfectly safe compound that does nothing has achieved nothing.
-- **Uncertain predictions score lower.** Entries are graded on a lower bound, so a
-  molecule the models cannot judge confidently is marked down.
-
-The full rubric, five ready-to-use AI prompts, and the list of rejection criteria are in
-the **Entrant guide** tab.
-
----
-
-## Why you can trust the scores
-
-**Approved drugs are on the leaderboard.** Not as decoration — as a calibration ladder you
-can read directly.
-
-| Reference compound | Score | What it is |
-|---|---|---|
-| **DSM265** | **50.9** | Clinical-stage antimalarial, PfDHODH inhibitor |
-| Brequinar | 4.0 | Inhibits the **human** enzyme — wrong target |
-| Teriflunomide | 2.8 | Approved drug, **human** DHODH — wrong target |
-| Ibuprofen | 1.9 | Inert control |
-| Caffeine | 1.8 | Inert control |
-
-If the clinical candidate sits at the top and caffeine sits at the bottom, the scorer
-discriminates. That is a claim you can check rather than one you have to accept.
-
-Hover any row to see **every axis score and the numbers behind it** — predicted potency
-against each enzyme, the selectivity ratio, similarity to the nearest known compound,
-synthetic difficulty. A score you cannot interrogate is a score you cannot trust.
-
-The predictive models behind the scoring hold **first place across 16 tracks of Polaris
-Hub**, the public benchmark for drug property prediction, spanning absorption,
-distribution, metabolism, toxicity, potency and kinase selectivity.
-
----
-
-## Your molecule stays yours
-
-**Ownership remains entirely with the entrant.** VIDRAFT scores your submission and
-displays it. We take no patent or ownership interest, pass nothing to third parties, and
-put nothing into our own pipeline.
-
-You choose whether the structure is published. Two things stated plainly:
-
-- **Private hides the structure from other entrants and the public — not from us.**
-  Scoring requires the structure, so it is stored and used for nothing else.
-- **Publishing a structure can cost you patentability.** Disclosure can bar a later patent
-  on that compound. **If you have commercial intent, keep it private and file first.**
-
----
-
-## Frequently asked questions
-
-**Do I need to be a chemist?**
-No. The Entrant guide provides five prompts you can paste into any AI model. Most entrants
-will get further by iterating on their score than by knowing organic chemistry.
-
-**Which AI model should I use?**
-Any. The leaderboard tracks per-model standings — best score, average and submission
-volume — so you can see which models are actually producing good candidates rather than
-just being popular.
-
-**How long does scoring take?**
-Minutes. Entries are queued and processed on GPU. Submissions are interleaved by entrant,
-so a high-volume entrant cannot monopolise the queue.
-
-**Is there a submission limit?**
-No. Duplicate structures are rejected, and the queue takes turns between entrants.
-
-**What gets rejected?**
-Unparseable structures, molecular formulas, covalent warheads (Season 1 is a non-covalent
-track), molecular weight over 550, PAINS motifs, and duplicates of an existing entry.
-
-**What gets relegated instead of rejected?**
-Predicted mutagenicity or extreme insolubility. Those entries are scored in full and
-displayed, but rank below every clean entry — a molecule that binds beautifully and is
-mutagenic is not a lead.
-
-**Does the score mean my compound works?**
-No. Scores are a **computational assessment of candidates**. They are not measurements,
-not claims about real efficacy or safety, and not a ranking against approved drugs.
-Experimental validation is a separate process.
-
-**Will there be other diseases?**
-Yes. Each season targets a different disease. Malaria is #1.
-
----
-
-## Why malaria first
-
-Malaria killed roughly **597,000 people in 2023**, and about three quarters of them were
-children under five (WHO World Malaria Report 2024). Not for want of chemistry — for want
-of a market, because the patients are poor.
-
-That is precisely the gap where people working from conviction rather than return can
-still change the outcome.
-
----
-
-## Prize
-
-The top-ranked entry at the close of each season receives a prize. Season #1 carries
-**USD 1,000**, denominated in USD with the payment method agreed with the recipient.
-Winners are announced in the Space community tab. Ties go to whoever submitted first.
-Should sponsors come on board, the amount increases.
-
-The prize does not pay for your time or tokens, and is not meant to. It is a way of saying
-that what you did had worth.
-
----
-
-## Built with
-
-**PharmaOS** — molecule and target: docking against the parasite and human enzymes,
-binding efficiency relative to molecular size, structural distance from known antimalarial
-chemical space, synthetic accessibility.
-
-**CellOS** — cell and organism: whole-cell antimalarial activity, ADMET, avoidance of the
-human enzyme, and uncertainty-aware scoring.
-
----
-
-**Open Discovery Challenge #1 — Malaria** · Season closes 30 September 2026
-Scores are computational predictions and not claims of efficacy or safety.
+---
+title: Open Discovery Challenge
+emoji: 🧬
+colorFrom: green
+colorTo: blue
+sdk: docker
+app_port: 7860
+pinned: true
+# openid and profile come with hf_oauth by default; the extra scope list is for
+# permissions beyond that, and 'profile' is not a valid entry in it.
+hf_oauth: true
+short_description: Malaria drug leaderboard for AI-designed molecules
+tags:
+  - drug-discovery
+  - leaderboard
+  - malaria
+  - antimalarial
+  - chemistry
+  - cheminformatics
+  - admet
+  - molecular-docking
+  - ai-for-science
+  - benchmark
+  - smiles
+  - open-science
+---
+
+# Open Discovery Challenge #1 — Malaria
+
+**An open leaderboard for AI-discovered malaria drug candidates.** Design a molecule with
+any AI model, submit it as SMILES, and it is scored automatically on potency, selectivity,
+ADMET and novelty — then ranked in the same table as approved antimalarial drugs.
+
+**Season #1 closes 30 September 2026. The top entry receives USD 1,000.**
+
+---
+
+## What is this leaderboard?
+
+A public drug discovery leaderboard that answers one question: **is the molecule your AI
+just designed actually any good?**
+
+Large language models can propose thousands of drug candidates a day. Almost nobody can
+tell which of them are worth anything, because the tools that judge a candidate — docking,
+whole-cell activity prediction, ADMET, selectivity modelling — are not generally
+available. This leaderboard makes that judgement free and public.
+
+Every submission is scored by the same rubric, and **approved drugs and inert compounds
+are scored alongside the entries** so you can see the scale for yourself.
+
+| | |
+|---|---|
+| **Target** | PfDHODH — *Plasmodium falciparum* dihydroorotate dehydrogenase |
+| **Counter-target** | Human DHODH — must NOT be inhibited |
+| **Submission format** | SMILES or InChI |
+| **Score** | 0–100, computed automatically |
+| **Turnaround** | Minutes per entry (GPU queue) |
+| **Season #1 deadline** | 30 September 2026 |
+| **Prize** | USD 1,000 to the top-ranked entry |
+| **Who can enter** | Anyone with a Hugging Face account |
+| **Cost** | Free |
+
+---
+
+## How the leaderboard works
+
+**1. Design a candidate with any AI model.**
+OpenAI, Claude, Gemini, Qwen, KIMI, DeepSeek, open-weight models, or by hand. The
+challenge does not restrict the tool — it records which model you used, so the leaderboard
+also shows *which AI models produce the best drug candidates*.
+
+**2. Submit the structure.**
+SMILES or InChI. Molecular formulas are not accepted — too many isomers to evaluate.
+Every entry is structure-checked on arrival for reactivity, PAINS motifs and duplicates.
+
+**3. It is scored and ranked automatically.**
+VIDRAFT's PharmaOS and CellOS compute binding, whole-cell antimalarial activity,
+selectivity over the human enzyme, ADMET, novelty and synthetic accessibility. Results
+appear on the leaderboard within minutes.
+
+---
+
+## Scoring rubric
+
+| Axis | Points | What it measures |
+|---|---|---|
+| **Whole-cell activity** | 30 | Does the parasite actually die |
+| **Target binding** | 20 | Does it bind PfDHODH, efficiently for its size |
+| **Selectivity** | 20 | Binds the parasite enzyme, not the human one |
+| **ADMET** | 15 | Absorption, distribution, metabolism, toxicity |
+| **Novelty** | 10 | Structurally distinct from known antimalarials |
+| **Synthesis** | 5 | Can it actually be made |
+
+Three policies worth knowing before you submit:
+
+- **Novelty is multiplied by potency.** A novel but inactive molecule scores zero on this
+  axis. So does a potent analogue of a known drug.
+- **ADMET, novelty and synthesis scale with how much of a candidate the molecule is.** A
+  perfectly safe compound that does nothing has achieved nothing.
+- **Uncertain predictions score lower.** Entries are graded on a lower bound, so a
+  molecule the models cannot judge confidently is marked down.
+
+The full rubric, five ready-to-use AI prompts, and the list of rejection criteria are in
+the **Entrant guide** tab.
+
+---
+
+## Why you can trust the scores
+
+**Approved drugs are on the leaderboard.** Not as decoration — as a calibration ladder you
+can read directly.
+
+| Reference compound | Score | What it is |
+|---|---|---|
+| **DSM265** | **50.9** | Clinical-stage antimalarial, PfDHODH inhibitor |
+| Brequinar | 4.0 | Inhibits the **human** enzyme — wrong target |
+| Teriflunomide | 2.8 | Approved drug, **human** DHODH — wrong target |
+| Ibuprofen | 1.9 | Inert control |
+| Caffeine | 1.8 | Inert control |
+
+If the clinical candidate sits at the top and caffeine sits at the bottom, the scorer
+discriminates. That is a claim you can check rather than one you have to accept.
+
+Hover any row to see **every axis score and the numbers behind it** — predicted potency
+against each enzyme, the selectivity ratio, similarity to the nearest known compound,
+synthetic difficulty. A score you cannot interrogate is a score you cannot trust.
+
+The predictive models behind the scoring hold **first place across 16 tracks of Polaris
+Hub**, the public benchmark for drug property prediction, spanning absorption,
+distribution, metabolism, toxicity, potency and kinase selectivity.
+
+---
+
+## Your molecule stays yours
+
+**Ownership remains entirely with the entrant.** VIDRAFT scores your submission and
+displays it. We take no patent or ownership interest, pass nothing to third parties, and
+put nothing into our own pipeline.
+
+You choose whether the structure is published. Two things stated plainly:
+
+- **Private hides the structure from other entrants and the public — not from us.**
+  Scoring requires the structure, so it is stored and used for nothing else.
+- **Publishing a structure can cost you patentability.** Disclosure can bar a later patent
+  on that compound. **If you have commercial intent, keep it private and file first.**
+
+---
+
+## Frequently asked questions
+
+**Do I need to be a chemist?**
+No. The Entrant guide provides five prompts you can paste into any AI model. Most entrants
+will get further by iterating on their score than by knowing organic chemistry.
+
+**Which AI model should I use?**
+Any. The leaderboard tracks per-model standings — best score, average and submission
+volume — so you can see which models are actually producing good candidates rather than
+just being popular.
+
+**How long does scoring take?**
+Minutes. Entries are queued and processed on GPU. Submissions are interleaved by entrant,
+so a high-volume entrant cannot monopolise the queue.
+
+**Is there a submission limit?**
+No. Duplicate structures are rejected, and the queue takes turns between entrants.
+
+**What gets rejected?**
+Unparseable structures, molecular formulas, covalent warheads (Season 1 is a non-covalent
+track), molecular weight over 550, PAINS motifs, and duplicates of an existing entry.
+
+**What gets relegated instead of rejected?**
+Predicted mutagenicity or extreme insolubility. Those entries are scored in full and
+displayed, but rank below every clean entry — a molecule that binds beautifully and is
+mutagenic is not a lead.
+
+**Does the score mean my compound works?**
+No. Scores are a **computational assessment of candidates**. They are not measurements,
+not claims about real efficacy or safety, and not a ranking against approved drugs.
+Experimental validation is a separate process.
+
+**Will there be other diseases?**
+Yes. Each season targets a different disease. Malaria is #1.
+
+---
+
+## Why malaria first
+
+Malaria killed roughly **597,000 people in 2023**, and about three quarters of them were
+children under five (WHO World Malaria Report 2024). Not for want of chemistry — for want
+of a market, because the patients are poor.
+
+That is precisely the gap where people working from conviction rather than return can
+still change the outcome.
+
+---
+
+## Prize
+
+The top-ranked entry at the close of each season receives a prize. Season #1 carries
+**USD 1,000**, denominated in USD with the payment method agreed with the recipient.
+Winners are announced in the Space community tab. Ties go to whoever submitted first.
+Should sponsors come on board, the amount increases.
+
+The prize does not pay for your time or tokens, and is not meant to. It is a way of saying
+that what you did had worth.
+
+---
+
+## Built with
+
+**PharmaOS** — molecule and target: docking against the parasite and human enzymes,
+binding efficiency relative to molecular size, structural distance from known antimalarial
+chemical space, synthetic accessibility.
+
+**CellOS** — cell and organism: whole-cell antimalarial activity, ADMET, avoidance of the
+human enzyme, and uncertainty-aware scoring.
+
+---
+
+**Open Discovery Challenge #1 — Malaria** · Season closes 30 September 2026
+Scores are computational predictions and not claims of efficacy or safety.

app.py

@@ -1,374 +1,412 @@
-# -*- coding: utf-8 -*-
-"""Open Discovery Challenge - submission intake and leaderboard.
-
-Deliberately thin. Nothing here computes a score.
-
-Scoring needs docking, docking needs a GPU, and a docking call takes minutes: the tunnel
-in front of this service cuts a request at ~125 s, and boltz spawns grandchildren that
-hold the stdout pipe open so a subprocess call never returns and wedges the whole worker.
-That combination already took the PharmaOS API down once. So submissions land in a ledger
-here, a worker on the GPU box picks them up, and results come back the same way. One
-entrant can never block the service.
-
-Endpoints
-    GET  /                  leaderboard page
-    POST /api/submit        accept a structure, run the gates, queue it
-    GET  /api/leaderboard   ranked table, structures masked
-    GET  /api/queue         how much work is outstanding
-
-The ledger is a private dataset, not a file in this container: a Space's filesystem does
-not survive a restart, and losing every submission to a rebuild is not acceptable when a
-prize depends on them. The worker reads that same dataset directly, so nothing here hands
-out work or accepts scores.
-"""
-import base64
-import hashlib
-import hmac
-import json
-import os
-import secrets
-import time
-import urllib.parse
-import urllib.request
-import uuid
-
-from fastapi import FastAPI, HTTPException, Request
-from fastapi.responses import FileResponse, JSONResponse, RedirectResponse
-from pydantic import BaseModel
-
-import gates
-import store
-
-HERE = os.path.dirname(os.path.abspath(__file__))
-ANCHORS = os.path.join(HERE, "data", "anchor_scores.json")
-CACHE = store.Cached(ttl=int(os.environ.get("ODC_CACHE_TTL", "20")))
-# Masked identifiers must not be reversible from the public table.
-SALT = os.environ.get("ODC_SALT", "odc-season1")
-
-# Hugging Face signs entrants in. Identity has to come from somewhere the entrant cannot
-# forge: a free-text name would let anyone post under someone else's handle, and the
-# per-model chart is only meaningful if entries cannot be stuffed under a rival's label.
-OAUTH_ID = os.environ.get("OAUTH_CLIENT_ID", "")
-OAUTH_SECRET = os.environ.get("OAUTH_CLIENT_SECRET", "")
-OAUTH_ISS = os.environ.get("OPENID_PROVIDER_URL", "https://huggingface.co")
-SPACE_HOST = os.environ.get("SPACE_HOST", "")
-COOKIE = "odc_session"
-# Served in an iframe from another origin, so our cookies are third-party. Lax ones are
-# discarded there; None requires Secure, which requires HTTPS - true on the Space, not on
-# a local http run.
-IN_FRAME = bool(SPACE_HOST)
-COOKIE_KW = ({"samesite": "none", "secure": True} if IN_FRAME
-             else {"samesite": "lax", "secure": False})
-SESSION_KEY = os.environ.get("ODC_SESSION_KEY") or secrets.token_hex(16)
-
-SEASON = {"name": "Open Discovery Challenge", "number": 1, "topic": "Malaria",
-          "target": "PfDHODH", "counter_target": "human DHODH",
-          # keyed by axis, not by a word - the page owns the wording in each language
-          "weights": {"activity": 30, "binding": 20, "selectivity": 20,
-                      "admet": 15, "novelty": 10, "synthesis": 5},
-          # Each season is a different disease; the prize is awarded when a season closes.
-          "closes": "2026-09-30", "prize_usd": 1000}
-
-app = FastAPI(title="Open Discovery Challenge")
-
-
-class Submission(BaseModel):
-    structure: str            # SMILES or InChI
-    display_name: str         # name, affiliation or handle - entrant's choice
-    model_name: str = ""      # which model proposed it; free text, blank allowed
-    rationale: str = ""       # optional design note
-    # The entrant owns the molecule and decides whether anyone else sees it. Private is
-    # the default because the reverse cannot be undone: a structure, once shown, is
-    # disclosed, and disclosure is what costs patentability.
-    visibility: str = "private"
-
-
-def _submissions():
-    """Every accepted entry. Ids come from the tree; the rollup carries the scores, so a
-    page load is two requests rather than one per entry."""
-    return CACHE.get("ids", lambda: store.listdir("submissions"))
-
-
-def _board():
-    return CACHE.get("board", lambda: store.read("leaderboard.json", default={}) or {})
-
-
-def public_id(inchikey):
-    """A stable public handle that cannot be walked back to the structure.
-
-    The skeleton block of an InChIKey is a hash of connectivity, so it is safe to show
-    and still lets anyone check two entries are the same compound. The full key and the
-    SMILES stay in the ledger."""
-    h = hashlib.sha256((SALT + inchikey).encode()).hexdigest()[:6].upper()
-    return "ODC-%s" % h
-
-
-def mask(rec):
-    """What the public table is allowed to see: enough to verify and compare, never
-    enough to reconstruct. Entrants keep their chemistry until they choose otherwise."""
-    pub = rec.get("visibility") == "public"
-    return {
-        "candidate_id": rec.get("candidate_id"),
-        "skeleton": (rec.get("inchikey") or "")[:14],
-        # released only where the entrant asked for it to be released
-        "visibility": rec.get("visibility", "private"),
-        "smiles": rec.get("smiles") if pub else None,
-        "display_name": rec.get("display_name"),
-        "hf_user": rec.get("hf_user"),
-        "model_name": rec.get("model_name"),
-        "mw_band": rec.get("mw_band"),
-        "status": rec.get("status"),
-        "total": rec.get("total"),
-        "axes": rec.get("axes_points"),
-        "tier": rec.get("tier", 1),
-        "relegate_reason": rec.get("relegate_reason") or [],
-        "submitted_at": rec.get("submitted_at"),
-    }
-
-
-def band(x, step=50):
-    if x is None:
-        return None
-    lo = int(x // step) * step
-    return "%d-%d" % (lo, lo + step)
-
-
-def _sign(payload):
-    raw = base64.urlsafe_b64encode(json.dumps(payload).encode()).decode().rstrip("=")
-    sig = hmac.new(SESSION_KEY.encode(), raw.encode(), hashlib.sha256).hexdigest()[:32]
-    return raw + "." + sig
-
-
-def _unsign(token):
-    try:
-        raw, sig = (token or "").rsplit(".", 1)
-    except ValueError:
-        return None
-    good = hmac.new(SESSION_KEY.encode(), raw.encode(), hashlib.sha256).hexdigest()[:32]
-    if not hmac.compare_digest(sig, good):
-        return None
-    pad = "=" * (-len(raw) % 4)
-    try:
-        return json.loads(base64.urlsafe_b64decode(raw + pad))
-    except Exception:
-        return None
-
-
-def current_user(request: Request):
-    return _unsign(request.cookies.get(COOKIE))
-
-
-def _redirect_uri(request: Request):
-    if SPACE_HOST:
-        return "https://%s/auth/callback" % SPACE_HOST
-    return str(request.base_url).rstrip("/") + "/auth/callback"
-
-
-@app.get("/")
-def index():
-    return FileResponse(os.path.join(HERE, "index.html"))
-
-
-@app.get("/api/me")
-def me(request: Request):
-    u = current_user(request)
-    return {"signed_in": bool(u), "user": u,
-            "oauth_configured": bool(OAUTH_ID and OAUTH_SECRET)}
-
-
-@app.get("/login")
-def login(request: Request):
-    if not (OAUTH_ID and OAUTH_SECRET):
-        raise HTTPException(503, "OAuth가 설정되지 않았습니다 (README에 hf_oauth 필요)")
-    state = secrets.token_urlsafe(16)
-    q = urllib.parse.urlencode({
-        "client_id": OAUTH_ID, "redirect_uri": _redirect_uri(request),
-        "response_type": "code", "scope": "openid profile", "state": state})
-    r = RedirectResponse("%s/oauth/authorize?%s" % (OAUTH_ISS.rstrip("/"), q))
-    # state is echoed back by the provider; comparing it to this cookie is what stops a
-    # third party from completing someone else's sign-in
-    r.set_cookie("odc_state", state, max_age=600, httponly=True, **COOKIE_KW)
-    return r
-
-
-@app.get("/auth/callback")
-def callback(request: Request, code: str = "", state: str = ""):
-    saved = request.cookies.get("odc_state")
-    if not code:
-        raise HTTPException(400, "인증 코드가 없습니다 — 로그인을 다시 시도해 주세요")
-    if not saved:
-        # the cookie was never stored, which is a browser policy problem, not tampering
-        raise HTTPException(400,
-                            "브라우저가 쿠키를 저장하지 못했습니다. 이 페이지를 "
-                            "새 탭에서 직접 열고(주소창의 .hf.space 주소) 다시 "
-                            "로그인해 주세요. 3자 쿠키 차단이 원인일 수 있습니다.")
-    if state != saved:
-        raise HTTPException(400, "로그인 상태값이 일치하지 않습니다 — 다시 시도해 주세요")
-    body = urllib.parse.urlencode({
-        "client_id": OAUTH_ID, "client_secret": OAUTH_SECRET,
-        "grant_type": "authorization_code", "code": code,
-        "redirect_uri": _redirect_uri(request)}).encode()
-    tok_req = urllib.request.Request(
-        OAUTH_ISS.rstrip("/") + "/oauth/token", data=body,
-        headers={"Content-Type": "application/x-www-form-urlencoded"})
-    with urllib.request.urlopen(tok_req, timeout=20) as r:
-        tok = json.loads(r.read().decode())
-    ui_req = urllib.request.Request(
-        OAUTH_ISS.rstrip("/") + "/oauth/userinfo",
-        headers={"Authorization": "Bearer " + tok["access_token"]})
-    with urllib.request.urlopen(ui_req, timeout=20) as r:
-        ui = json.loads(r.read().decode())
-    user = {"name": ui.get("preferred_username") or ui.get("name"),
-            "picture": ui.get("picture"), "at": int(time.time())}
-    resp = RedirectResponse("/")
-    resp.set_cookie(COOKIE, _sign(user), max_age=60 * 60 * 24 * 14,
-                    httponly=True, **COOKIE_KW)
-    resp.delete_cookie("odc_state")
-    return resp
-
-
-@app.get("/logout")
-def logout():
-    r = RedirectResponse("/")
-    r.delete_cookie(COOKIE)
-    return r
-
-
-@app.get("/api/season")
-def season():
-    return SEASON
-
-
-@app.post("/api/submit")
-def submit(s: Submission, request: Request):
-    user = current_user(request)
-    if (OAUTH_ID and OAUTH_SECRET) and not user:
-        raise HTTPException(401, "Hugging Face 로그인이 필요합니다")
-    if not s.display_name.strip():
-        raise HTTPException(400, "표시 ID를 입력하세요")
-    # Season 1's target is not a covalent-mechanism enzyme, so that rule is off here.
-    v = gates.check(s.structure, covalent_rule=False)
-    if not v["admitted"]:
-        return JSONResponse({"accepted": False, "reasons": v["reject"]}, status_code=422)  # dicts: {code, text}
-
-    # the public id is a salted hash of the InChIKey, so an id collision is a structure
-    # collision - no need to pull every record back to find out
-    if store.read("submissions/%s.json" % public_id(v["inchikey"])) is not None:
-        return JSONResponse(
-            {"accepted": False,
-             "reasons": ["이미 제출된 구조입니다 (%s)" % public_id(v["inchikey"])]},
-            status_code=409)
-
-    rec = {
-        # the candidate id is derived from the structure, so it doubles as the record key
-        # and makes a resubmission collide by construction
-        "id": public_id(v["inchikey"]),
-        "candidate_id": public_id(v["inchikey"]),
-        "smiles": v["smiles"], "inchikey": v["inchikey"],
-        "mw": v["mw"], "mw_band": band(v["mw"]),
-        # the HF handle is recorded separately from the free-text display name, so the
-        # table can show who actually submitted rather than what they typed
-        "hf_user": (user or {}).get("name"),
-        "visibility": "public" if s.visibility == "public" else "private",
-        "display_name": s.display_name.strip()[:60],
-        "model_name": s.model_name.strip()[:80],
-        "rationale": s.rationale.strip()[:2000],
-        "status": "queued", "submitted_at": int(time.time()),
-    }
-    store.write("submissions/%s.json" % rec["id"], rec,
-                summary="entry %s" % rec["candidate_id"])
-    CACHE.drop()
-    scored = set((_board().get("entries") or {}).keys())
-    ahead = len([i for i in _submissions() if i not in scored])
-    return {"accepted": True, "candidate_id": rec["candidate_id"],
-            "queue_position": ahead,
-            "note": "채점은 GPU 작업으로 처리되며 완료까지 몇 분 걸립니다."}
-
-
-@app.get("/api/leaderboard")
-def leaderboard():
-    rows = list((_board().get("entries") or {}).values())
-    anchors = []
-    if os.path.exists(ANCHORS):
-        for a in json.load(open(ANCHORS, encoding="utf-8")):
-            if not a.get("admitted"):
-                continue
-            anchors.append({"candidate_id": a["label"], "is_anchor": True,
-                            "display_name": "기준물질", "model_name": "",
-                            "total": a["total"], "tier": a.get("tier", 1),
-                            "axes": {k: v["points"] for k, v in a["axes"].items()},
-                            # reference rows carry their reasoning too, so the overlay
-                            # explains the scale as well as the entries
-                            "detail": {k: v["detail"] for k, v in a["axes"].items()},
-                            "note": a.get("note", "")})
-    merged = rows + anchors
-    merged.sort(key=lambda e: (e.get("tier", 1), -(e.get("total") or -1)))
-    n = 0
-    for e in merged:
-        if e.get("is_anchor") or e.get("tier", 1) != 1:
-            e["rank"] = None            # anchors mark the ladder; they do not climb it
-        else:
-            n += 1
-            e["rank"] = n
-    return {"season": SEASON, "entries": merged,
-            "counts": {"scored": len(rows), "anchors": len(anchors)}}
-
-
-@app.get("/api/models")
-def models():  # noqa: C901
-    """Per-model standings: which model produced the best candidate, and which gets used.
-
-    Deliberately two separate numbers. Popularity is not quality - a model everyone
-    reaches for will rack up entries regardless of whether any of them score, and a model
-    used three times could hold the top result. Reporting only a mean would hide both:
-    one lucky hit drowns in a hundred weak entries, and a model with two good tries looks
-    better than one with fifty. So the chart carries best, mean and count side by side.
-
-    Reference compounds are excluded - they were not produced by an entrant's model.
-    """
-    agg = {}
-    for r in (_board().get("entries") or {}).values():
-        if r.get("total") is None:
-            continue
-        name = (r.get("model_name") or "").strip() or "미기재 / unspecified"
-        a = agg.setdefault(name, {"model": name, "n": 0, "best": None, "sum": 0.0,
-                                  "entrants": set(), "top_candidate": None})
-        a["n"] += 1
-        a["sum"] += r["total"]
-        if a["best"] is None or r["total"] > a["best"]:
-            a["best"] = r["total"]
-            a["top_candidate"] = r.get("candidate_id")
-        who = r.get("hf_user") or r.get("display_name")
-        if who:
-            a["entrants"].add(who)
-    out = []
-    for a in agg.values():
-        out.append({"model": a["model"], "submissions": a["n"],
-                    "best": round(a["best"], 1) if a["best"] is not None else None,
-                    "mean": round(a["sum"] / a["n"], 1) if a["n"] else None,
-                    "entrants": len(a["entrants"]),
-                    "top_candidate": a["top_candidate"]})
-    out.sort(key=lambda x: (-(x["best"] or 0), -x["submissions"]))
-    return {"models": out,
-            "totals": {"models": len(out), "submissions": sum(x["submissions"] for x in out)}}
-
-
-
-# The worker no longer talks to this service at all. It reads the dataset for entries
-# that have no result file yet, scores them, and writes the result and the rollup back.
-# That removed the claim/post endpoints and the shared key they were guarded by - both
-# sides already authenticate to the Hub, so there is one fewer secret to leak.
-
-
-@app.get("/api/queue")
-def queue():
-    """How much work is outstanding.
-
-    This was declared directly after the worker endpoints, so removing that block took it
-    along too. The page never calls it, so nothing looked broken - it surfaced only by
-    exercising every route after a factory rebuild.
-    """
-    ids = _submissions()
-    scored = set((_board().get("entries") or {}).keys())
-    return {"queued": len([i for i in ids if i not in scored]),
-            "scored": len(scored), "total": len(ids)}
+# -*- coding: utf-8 -*-
+"""Open Discovery Challenge - submission intake and leaderboard.
+
+Deliberately thin. Nothing here computes a score.
+
+Scoring needs docking, docking needs a GPU, and a docking call takes minutes: the tunnel
+in front of this service cuts a request at ~125 s, and boltz spawns grandchildren that
+hold the stdout pipe open so a subprocess call never returns and wedges the whole worker.
+That combination already took the PharmaOS API down once. So submissions land in a ledger
+here, a worker on the GPU box picks them up, and results come back the same way. One
+entrant can never block the service.
+
+Endpoints
+    GET  /                  leaderboard page
+    POST /api/submit        accept a structure, run the gates, queue it
+    GET  /api/leaderboard   ranked table, structures masked
+    GET  /api/queue         how much work is outstanding
+
+The ledger is a private dataset, not a file in this container: a Space's filesystem does
+not survive a restart, and losing every submission to a rebuild is not acceptable when a
+prize depends on them. The worker reads that same dataset directly, so nothing here hands
+out work or accepts scores.
+"""
+import base64
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import time
+import urllib.parse
+import urllib.request
+import uuid
+
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.responses import FileResponse, JSONResponse, RedirectResponse
+from pydantic import BaseModel
+
+import gates
+import store
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+ANCHORS = os.path.join(HERE, "data", "anchor_scores.json")
+CACHE = store.Cached(ttl=int(os.environ.get("ODC_CACHE_TTL", "20")))
+# Masked identifiers must not be reversible from the public table.
+SALT = os.environ.get("ODC_SALT", "odc-season1")
+
+# Hugging Face signs entrants in. Identity has to come from somewhere the entrant cannot
+# forge: a free-text name would let anyone post under someone else's handle, and the
+# per-model chart is only meaningful if entries cannot be stuffed under a rival's label.
+OAUTH_ID = os.environ.get("OAUTH_CLIENT_ID", "")
+OAUTH_SECRET = os.environ.get("OAUTH_CLIENT_SECRET", "")
+OAUTH_ISS = os.environ.get("OPENID_PROVIDER_URL", "https://huggingface.co")
+SPACE_HOST = os.environ.get("SPACE_HOST", "")
+COOKIE = "odc_session"
+# Served in an iframe from another origin, so our cookies are third-party. Lax ones are
+# discarded there; None requires Secure, which requires HTTPS - true on the Space, not on
+# a local http run.
+IN_FRAME = bool(SPACE_HOST)
+COOKIE_KW = ({"samesite": "none", "secure": True} if IN_FRAME
+             else {"samesite": "lax", "secure": False})
+SESSION_KEY = os.environ.get("ODC_SESSION_KEY") or secrets.token_hex(16)
+
+SEASON = {"name": "Open Discovery Challenge", "number": 1, "topic": "Malaria",
+          "target": "PfDHODH", "counter_target": "human DHODH",
+          # keyed by axis, not by a word - the page owns the wording in each language
+          "weights": {"activity": 30, "binding": 20, "selectivity": 20,
+                      "admet": 15, "novelty": 10, "synthesis": 5},
+          # Each season is a different disease; the prize is awarded when a season closes.
+          "closes": "2026-09-30", "prize_usd": 1000}
+
+app = FastAPI(title="Open Discovery Challenge")
+
+
+class Submission(BaseModel):
+    structure: str            # SMILES or InChI
+    display_name: str         # name, affiliation or handle - entrant's choice
+    model_name: str = ""      # which model proposed it; free text, blank allowed
+    rationale: str = ""       # optional design note
+    # The entrant owns the molecule and decides whether anyone else sees it. Private is
+    # the default because the reverse cannot be undone: a structure, once shown, is
+    # disclosed, and disclosure is what costs patentability.
+    visibility: str = "private"
+
+
+def _submissions():
+    """Every accepted entry. Ids come from the tree; the rollup carries the scores, so a
+    page load is two requests rather than one per entry."""
+    return CACHE.get("ids", lambda: store.listdir("submissions"))
+
+
+def _board():
+    return CACHE.get("board", lambda: store.read("leaderboard.json", default={}) or {})
+
+
+def public_id(inchikey):
+    """A stable public handle that cannot be walked back to the structure.
+
+    The skeleton block of an InChIKey is a hash of connectivity, so it is safe to show
+    and still lets anyone check two entries are the same compound. The full key and the
+    SMILES stay in the ledger."""
+    h = hashlib.sha256((SALT + inchikey).encode()).hexdigest()[:6].upper()
+    return "ODC-%s" % h
+
+
+def mask(rec):
+    """What the public table is allowed to see: enough to verify and compare, never
+    enough to reconstruct. Entrants keep their chemistry until they choose otherwise."""
+    pub = rec.get("visibility") == "public"
+    return {
+        "candidate_id": rec.get("candidate_id"),
+        "skeleton": (rec.get("inchikey") or "")[:14],
+        # released only where the entrant asked for it to be released
+        "visibility": rec.get("visibility", "private"),
+        "smiles": rec.get("smiles") if pub else None,
+        "display_name": rec.get("display_name"),
+        "hf_user": rec.get("hf_user"),
+        "model_name": rec.get("model_name"),
+        "mw_band": rec.get("mw_band"),
+        "status": rec.get("status"),
+        "total": rec.get("total"),
+        "axes": rec.get("axes_points"),
+        "tier": rec.get("tier", 1),
+        "relegate_reason": rec.get("relegate_reason") or [],
+        "submitted_at": rec.get("submitted_at"),
+    }
+
+
+def band(x, step=50):
+    if x is None:
+        return None
+    lo = int(x // step) * step
+    return "%d-%d" % (lo, lo + step)
+
+
+def _sign(payload):
+    raw = base64.urlsafe_b64encode(json.dumps(payload).encode()).decode().rstrip("=")
+    sig = hmac.new(SESSION_KEY.encode(), raw.encode(), hashlib.sha256).hexdigest()[:32]
+    return raw + "." + sig
+
+
+def _unsign(token):
+    try:
+        raw, sig = (token or "").rsplit(".", 1)
+    except ValueError:
+        return None
+    good = hmac.new(SESSION_KEY.encode(), raw.encode(), hashlib.sha256).hexdigest()[:32]
+    if not hmac.compare_digest(sig, good):
+        return None
+    pad = "=" * (-len(raw) % 4)
+    try:
+        return json.loads(base64.urlsafe_b64decode(raw + pad))
+    except Exception:
+        return None
+
+
+def current_user(request: Request):
+    return _unsign(request.cookies.get(COOKIE))
+
+
+def _redirect_uri(request: Request):
+    if SPACE_HOST:
+        return "https://%s/auth/callback" % SPACE_HOST
+    return str(request.base_url).rstrip("/") + "/auth/callback"
+
+
+@app.get("/")
+def index():
+    return FileResponse(os.path.join(HERE, "index.html"))
+
+
+@app.get("/api/me")
+def me(request: Request):
+    u = current_user(request)
+    return {"signed_in": bool(u), "user": u,
+            "oauth_configured": bool(OAUTH_ID and OAUTH_SECRET)}
+
+
+@app.get("/login")
+def login(request: Request):
+    if not (OAUTH_ID and OAUTH_SECRET):
+        raise HTTPException(503, "OAuth가 설정되지 않았습니다 (README에 hf_oauth 필요)")
+    state = secrets.token_urlsafe(16)
+    q = urllib.parse.urlencode({
+        "client_id": OAUTH_ID, "redirect_uri": _redirect_uri(request),
+        "response_type": "code", "scope": "openid profile", "state": state})
+    r = RedirectResponse("%s/oauth/authorize?%s" % (OAUTH_ISS.rstrip("/"), q))
+    # state is echoed back by the provider; comparing it to this cookie is what stops a
+    # third party from completing someone else's sign-in
+    r.set_cookie("odc_state", state, max_age=600, httponly=True, **COOKIE_KW)
+    return r
+
+
+@app.get("/auth/callback")
+def callback(request: Request, code: str = "", state: str = ""):
+    saved = request.cookies.get("odc_state")
+    if not code:
+        raise HTTPException(400, "인증 코드가 없습니다 — 로그인을 다시 시도해 주세요")
+    if not saved:
+        # the cookie was never stored, which is a browser policy problem, not tampering
+        raise HTTPException(400,
+                            "브라우저가 쿠키를 저장하지 못했습니다. 이 페이지를 "
+                            "새 탭에서 직접 열고(주소창의 .hf.space 주소) 다시 "
+                            "로그인해 주세요. 3자 쿠키 차단이 원인일 수 있습니다.")
+    if state != saved:
+        raise HTTPException(400, "로그인 상태값이 일치하지 않습니다 — 다시 시도해 주세요")
+    body = urllib.parse.urlencode({
+        "client_id": OAUTH_ID, "client_secret": OAUTH_SECRET,
+        "grant_type": "authorization_code", "code": code,
+        "redirect_uri": _redirect_uri(request)}).encode()
+    tok_req = urllib.request.Request(
+        OAUTH_ISS.rstrip("/") + "/oauth/token", data=body,
+        headers={"Content-Type": "application/x-www-form-urlencoded"})
+    with urllib.request.urlopen(tok_req, timeout=20) as r:
+        tok = json.loads(r.read().decode())
+    ui_req = urllib.request.Request(
+        OAUTH_ISS.rstrip("/") + "/oauth/userinfo",
+        headers={"Authorization": "Bearer " + tok["access_token"]})
+    with urllib.request.urlopen(ui_req, timeout=20) as r:
+        ui = json.loads(r.read().decode())
+    user = {"name": ui.get("preferred_username") or ui.get("name"),
+            "picture": ui.get("picture"), "at": int(time.time())}
+    resp = RedirectResponse("/")
+    resp.set_cookie(COOKIE, _sign(user), max_age=60 * 60 * 24 * 14,
+                    httponly=True, **COOKIE_KW)
+    resp.delete_cookie("odc_state")
+    return resp
+
+
+@app.get("/logout")
+def logout():
+    r = RedirectResponse("/")
+    r.delete_cookie(COOKIE)
+    return r
+
+
+@app.get("/api/season")
+def season():
+    return SEASON
+
+
+@app.post("/api/submit")
+def submit(s: Submission, request: Request):
+    user = current_user(request)
+    if (OAUTH_ID and OAUTH_SECRET) and not user:
+        raise HTTPException(401, "Hugging Face 로그인이 필요합니다")
+    if not s.display_name.strip():
+        raise HTTPException(400, "표시 ID를 입력하세요")
+    # Season 1's target is not a covalent-mechanism enzyme, so that rule is off here.
+    v = gates.check(s.structure, covalent_rule=False)
+    if not v["admitted"]:
+        return JSONResponse({"accepted": False, "reasons": v["reject"]}, status_code=422)  # dicts: {code, text}
+
+    # the public id is a salted hash of the InChIKey, so an id collision is a structure
+    # collision - no need to pull every record back to find out
+    if store.read("submissions/%s.json" % public_id(v["inchikey"])) is not None:
+        return JSONResponse(
+            {"accepted": False,
+             "reasons": ["이미 제출된 구조입니다 (%s)" % public_id(v["inchikey"])]},
+            status_code=409)
+
+    rec = {
+        # the candidate id is derived from the structure, so it doubles as the record key
+        # and makes a resubmission collide by construction
+        "id": public_id(v["inchikey"]),
+        "candidate_id": public_id(v["inchikey"]),
+        "smiles": v["smiles"], "inchikey": v["inchikey"],
+        "mw": v["mw"], "mw_band": band(v["mw"]),
+        # the HF handle is recorded separately from the free-text display name, so the
+        # table can show who actually submitted rather than what they typed
+        "hf_user": (user or {}).get("name"),
+        "visibility": "public" if s.visibility == "public" else "private",
+        "display_name": s.display_name.strip()[:60],
+        "model_name": s.model_name.strip()[:80],
+        "rationale": s.rationale.strip()[:2000],
+        "status": "queued", "submitted_at": int(time.time()),
+    }
+    store.write("submissions/%s.json" % rec["id"], rec,
+                summary="entry %s" % rec["candidate_id"])
+    CACHE.drop()
+    scored = set((_board().get("entries") or {}).keys())
+    ahead = len([i for i in _submissions() if i not in scored])
+    return {"accepted": True, "candidate_id": rec["candidate_id"],
+            "queue_position": ahead,
+            "note": "채점은 GPU 작업으로 처리되며 완료까지 몇 분 걸립니다."}
+
+
+@app.get("/api/leaderboard")
+def leaderboard():
+    rows = list((_board().get("entries") or {}).values())
+    anchors = []
+    if os.path.exists(ANCHORS):
+        for a in json.load(open(ANCHORS, encoding="utf-8")):
+            if not a.get("admitted"):
+                continue
+            anchors.append({"candidate_id": a["label"], "is_anchor": True,
+                            "display_name": "기준물질", "model_name": "",
+                            "total": a["total"], "tier": a.get("tier", 1),
+                            "axes": {k: v["points"] for k, v in a["axes"].items()},
+                            # reference rows carry their reasoning too, so the overlay
+                            # explains the scale as well as the entries
+                            "detail": {k: v["detail"] for k, v in a["axes"].items()},
+                            "note": a.get("note", "")})
+    merged = rows + anchors
+    merged.sort(key=lambda e: (e.get("tier", 1), -(e.get("total") or -1)))
+    n = 0
+    for e in merged:
+        if e.get("is_anchor") or e.get("tier", 1) != 1:
+            e["rank"] = None            # anchors mark the ladder; they do not climb it
+        else:
+            n += 1
+            e["rank"] = n
+    return {"season": SEASON, "entries": merged,
+            "counts": {"scored": len(rows), "anchors": len(anchors)}}
+
+
+@app.get("/api/models")
+def models():  # noqa: C901
+    """Per-model standings: which model produced the best candidate, and which gets used.
+
+    Deliberately two separate numbers. Popularity is not quality - a model everyone
+    reaches for will rack up entries regardless of whether any of them score, and a model
+    used three times could hold the top result. Reporting only a mean would hide both:
+    one lucky hit drowns in a hundred weak entries, and a model with two good tries looks
+    better than one with fifty. So the chart carries best, mean and count side by side.
+
+    Reference compounds are excluded - they were not produced by an entrant's model.
+    """
+    agg = {}
+    for r in (_board().get("entries") or {}).values():
+        if r.get("total") is None:
+            continue
+        name = (r.get("model_name") or "").strip() or "미기재 / unspecified"
+        a = agg.setdefault(name, {"model": name, "n": 0, "best": None, "sum": 0.0,
+                                  "entrants": set(), "top_candidate": None})
+        a["n"] += 1
+        a["sum"] += r["total"]
+        if a["best"] is None or r["total"] > a["best"]:
+            a["best"] = r["total"]
+            a["top_candidate"] = r.get("candidate_id")
+        who = r.get("hf_user") or r.get("display_name")
+        if who:
+            a["entrants"].add(who)
+    out = []
+    for a in agg.values():
+        out.append({"model": a["model"], "submissions": a["n"],
+                    "best": round(a["best"], 1) if a["best"] is not None else None,
+                    "mean": round(a["sum"] / a["n"], 1) if a["n"] else None,
+                    "entrants": len(a["entrants"]),
+                    "top_candidate": a["top_candidate"]})
+    out.sort(key=lambda x: (-(x["best"] or 0), -x["submissions"]))
+    return {"models": out,
+            "totals": {"models": len(out), "submissions": sum(x["submissions"] for x in out)}}
+
+
+
+# The worker no longer talks to this service at all. It reads the dataset for entries
+# that have no result file yet, scores them, and writes the result and the rollup back.
+# That removed the claim/post endpoints and the shared key they were guarded by - both
+# sides already authenticate to the Hub, so there is one fewer secret to leak.
+
+
+@app.get("/api/mol3d")
+def mol3d(smiles: str = ""):
+    """A 3D conformer for the viewer, as an MDL mol block.
+
+    Published structures only. The lookup is against the rollup rather than trusting the
+    caller: the page only ever has public strings, but an endpoint that embeds whatever
+    it is given would answer "is this the private entry?" for anyone willing to guess.
+    """
+    from rdkit import Chem
+    from rdkit.Chem import AllChem, rdMolDescriptors
+
+    s = (smiles or "").strip()
+    if not s:
+        raise HTTPException(400, "no structure given")
+    published = {e.get("smiles") for e in (_board().get("entries") or {}).values()
+                 if e.get("visibility") == "public" and e.get("smiles")}
+    if s not in published:
+        raise HTTPException(404, "not a published structure")
+
+    m = Chem.MolFromSmiles(s)
+    if m is None:
+        raise HTTPException(400, "unparseable structure")
+    mh = Chem.AddHs(m)
+    # a fixed seed so the same entry always renders as the same conformer; if embedding
+    # fails the flat coordinates still draw, they are simply not a conformation
+    if AllChem.EmbedMolecule(mh, randomSeed=1) != 0:
+        AllChem.Compute2DCoords(mh)
+    else:
+        try:
+            AllChem.MMFFOptimizeMolecule(mh, maxIters=400)
+        except Exception:
+            pass
+    return {"mol": Chem.MolToMolBlock(mh),
+            "formula": rdMolDescriptors.CalcMolFormula(m),
+            "mw": round(rdMolDescriptors.CalcExactMolWt(m), 2),
+            "atoms": m.GetNumAtoms(), "atoms_h": mh.GetNumAtoms()}
+
+
+@app.get("/api/queue")
+def queue():
+    """How much work is outstanding.
+
+    This was declared directly after the worker endpoints, so removing that block took it
+    along too. The page never calls it, so nothing looked broken - it surfaced only by
+    exercising every route after a factory rebuild.
+    """
+    ids = _submissions()
+    scored = set((_board().get("entries") or {}).keys())
+    return {"queued": len([i for i in ids if i not in scored]),
+            "scored": len(scored), "total": len(ids)}

data/anchor_scores.json

@@ -1,382 +1,382 @@
-[
-  {
-    "admitted": true,
-    "gate": {
-      "admitted": true,
-      "reject": [],
-      "relegate": [],
-      "notes": [],
-      "smiles": "Cc1cc(Nc2ccc(S(F)(F)(F)(F)F)cc2)n2nc(C(C)(F)F)nc2n1",
-      "inchikey": "OIZSVTOIBNSVOS-UHFFFAOYSA-N",
-      "mw": 415.34,
-      "heavy_atoms": 27
-    },
-    "relegated": false,
-    "relegate_reason": [],
-    "axes": {
-      "activity": {
-        "points": 14.45,
-        "detail": {
-          "pAct_q10": 5.467,
-          "fraction": 0.482
-        }
-      },
-      "binding": {
-        "points": 15.12,
-        "detail": {
-          "pIC50": 7.27,
-          "LE": 0.369,
-          "potency_term": 0.756,
-          "efficiency_cap": 1.0
-        }
-      },
-      "selectivity": {
-        "points": 12.59,
-        "detail": {
-          "fold": 46.3,
-          "selectivity_term": 0.833,
-          "target_engagement": 0.756
-        }
-      },
-      "admet": {
-        "points": 5.89,
-        "detail": {
-          "geometric_mean": 0.519,
-          "per_endpoint": {
-            "solubility-aqsoldb": 0.405,
-            "caco2-wang": 0.763,
-            "hia-hou": 1.0,
-            "bioavailability-ma": 1.0,
-            "pgp-broccatelli": 1.0,
-            "cyp2c9-veith": 0.349,
-            "cyp3a4-substrate-carbonmangels": 0.638,
-            "ld50-zhu": 0.66,
-            "herg": 0.116,
-            "dili": 0.05
-          }
-        }
-      },
-      "novelty": {
-        "points": 0.0,
-        "detail": {
-          "max_tanimoto": 1.0,
-          "novelty": 0.0
-        }
-      },
-      "synthesis": {
-        "points": 2.84,
-        "detail": {
-          "sa_score": 3.37
-        }
-      }
-    },
-    "total": 50.88,
-    "tier": 1,
-    "label": "DSM265",
-    "is_anchor": true,
-    "note": "임상후보 (양성 앵커)",
-    "rank": null
-  },
-  {
-    "admitted": true,
-    "gate": {
-      "admitted": true,
-      "reject": [],
-      "relegate": [],
-      "notes": [],
-      "smiles": "Cc1c(-c2ccc(-c3ccccc3F)cc2)nc2ccc(F)cc2c1C(=O)O",
-      "inchikey": "PHEZJEYUWHETKO-UHFFFAOYSA-N",
-      "mw": 375.37,
-      "heavy_atoms": 28
-    },
-    "relegated": false,
-    "relegate_reason": [],
-    "axes": {
-      "activity": {
-        "points": 2.58,
-        "detail": {
-          "pAct_q10": 4.755,
-          "fraction": 0.086
-        }
-      },
-      "binding": {
-        "points": 0.0,
-        "detail": {
-          "reason": "도킹 없음"
-        }
-      },
-      "selectivity": {
-        "points": 0.0,
-        "detail": {
-          "reason": "쌍 측정 없음"
-        }
-      },
-      "admet": {
-        "points": 0.47,
-        "detail": {
-          "geometric_mean": 0.363,
-          "per_endpoint": {
-            "solubility-aqsoldb": 0.05,
-            "caco2-wang": 0.714,
-            "hia-hou": 1.0,
-            "bioavailability-ma": 1.0,
-            "pgp-broccatelli": 0.766,
-            "cyp2c9-veith": 0.696,
-            "cyp3a4-substrate-carbonmangels": 0.88,
-            "ld50-zhu": 0.271,
-            "herg": 0.115,
-            "dili": 0.05
-          }
-        }
-      },
-      "novelty": {
-        "points": 0.56,
-        "detail": {
-          "max_tanimoto": 0.348,
-          "novelty": 0.652
-        }
-      },
-      "synthesis": {
-        "points": 0.43,
-        "detail": {
-          "sa_score": 2.06
-        }
-      }
-    },
-    "total": 4.04,
-    "tier": 1,
-    "label": "Brequinar",
-    "is_anchor": false,
-    "note": "사람 DHODH 억제제 (선택성 반례)",
-    "rank": 1
-  },
-  {
-    "admitted": true,
-    "gate": {
-      "admitted": true,
-      "reject": [],
-      "relegate": [],
-      "notes": [],
-      "smiles": "C/C(O)=C(\\C#N)C(=O)Nc1ccc(C(F)(F)F)cc1",
-      "inchikey": "UTNUDOFZCWSZMS-YFHOEESVSA-N",
-      "mw": 270.21,
-      "heavy_atoms": 19
-    },
-    "relegated": false,
-    "relegate_reason": [],
-    "axes": {
-      "activity": {
-        "points": 1.66,
-        "detail": {
-          "pAct_q10": 4.362,
-          "fraction": 0.055
-        }
-      },
-      "binding": {
-        "points": 0.0,
-        "detail": {
-          "reason": "도킹 없음"
-        }
-      },
-      "selectivity": {
-        "points": 0.0,
-        "detail": {
-          "reason": "쌍 측정 없음"
-        }
-      },
-      "admet": {
-        "points": 0.51,
-        "detail": {
-          "geometric_mean": 0.614,
-          "per_endpoint": {
-            "solubility-aqsoldb": 0.575,
-            "caco2-wang": 0.851,
-            "hia-hou": 1.0,
-            "bioavailability-ma": 1.0,
-            "pgp-broccatelli": 1.0,
-            "cyp2c9-veith": 0.568,
-            "cyp3a4-substrate-carbonmangels": 0.21,
-            "ld50-zhu": 0.459,
-            "herg": 1.0,
-            "dili": 0.11
-          }
-        }
-      },
-      "novelty": {
-        "points": 0.35,
-        "detail": {
-          "max_tanimoto": 0.357,
-          "novelty": 0.643
-        }
-      },
-      "synthesis": {
-        "points": 0.28,
-        "detail": {
-          "sa_score": 2.27
-        }
-      }
-    },
-    "total": 2.79,
-    "tier": 1,
-    "label": "Teriflunomide",
-    "is_anchor": false,
-    "note": "사람 DHODH 억제제 (선택성 반례)",
-    "rank": 2
-  },
-  {
-    "admitted": true,
-    "gate": {
-      "admitted": true,
-      "reject": [],
-      "relegate": [],
-      "notes": [],
-      "smiles": "CC(C)Cc1ccc(C(C)C(=O)O)cc1",
-      "inchikey": "HEFNNWSXXWATRW-UHFFFAOYSA-N",
-      "mw": 206.28,
-      "heavy_atoms": 15
-    },
-    "relegated": false,
-    "relegate_reason": [],
-    "axes": {
-      "activity": {
-        "points": 1.04,
-        "detail": {
-          "pAct_q10": 4.174,
-          "fraction": 0.035
-        }
-      },
-      "binding": {
-        "points": 0.06,
-        "detail": {
-          "pIC50": 3.57,
-          "LE": 0.326,
-          "potency_term": 0.003,
-          "efficiency_cap": 1.0
-        }
-      },
-      "selectivity": {
-        "points": 0.0,
-        "detail": {
-          "fold": 0.3,
-          "selectivity_term": 0.0,
-          "target_engagement": 0.0
-        }
-      },
-      "admet": {
-        "points": 0.38,
-        "detail": {
-          "geometric_mean": 0.74,
-          "per_endpoint": {
-            "solubility-aqsoldb": 0.677,
-            "caco2-wang": 1.0,
-            "hia-hou": 1.0,
-            "bioavailability-ma": 1.0,
-            "pgp-broccatelli": 1.0,
-            "cyp2c9-veith": 1.0,
-            "cyp3a4-substrate-carbonmangels": 1.0,
-            "ld50-zhu": 0.212,
-            "herg": 1.0,
-            "dili": 0.528
-          }
-        }
-      },
-      "novelty": {
-        "points": 0.21,
-        "detail": {
-          "max_tanimoto": 0.386,
-          "novelty": 0.614
-        }
-      },
-      "synthesis": {
-        "points": 0.17,
-        "detail": {
-          "sa_score": 2.19
-        }
-      }
-    },
-    "total": 1.86,
-    "tier": 1,
-    "label": "Ibuprofen",
-    "is_anchor": true,
-    "note": "음성대조",
-    "rank": null
-  },
-  {
-    "admitted": true,
-    "gate": {
-      "admitted": true,
-      "reject": [],
-      "relegate": [],
-      "notes": [],
-      "smiles": "Cn1c(=O)c2c(ncn2C)n(C)c1=O",
-      "inchikey": "RYYVLZVUVIJVGH-UHFFFAOYSA-N",
-      "mw": 194.19,
-      "heavy_atoms": 14
-    },
-    "relegated": false,
-    "relegate_reason": [],
-    "axes": {
-      "activity": {
-        "points": 1.1,
-        "detail": {
-          "pAct_q10": 4.197,
-          "fraction": 0.037
-        }
-      },
-      "binding": {
-        "points": 0.06,
-        "detail": {
-          "pIC50": 3.62,
-          "LE": 0.354,
-          "potency_term": 0.003,
-          "efficiency_cap": 1.0
-        }
-      },
-      "selectivity": {
-        "points": 0.0,
-        "detail": {
-          "fold": 1.3,
-          "selectivity_term": 0.058,
-          "target_engagement": 0.0
-        }
-      },
-      "admet": {
-        "points": 0.27,
-        "detail": {
-          "geometric_mean": 0.496,
-          "per_endpoint": {
-            "solubility-aqsoldb": 1.0,
-            "caco2-wang": 1.0,
-            "hia-hou": 1.0,
-            "bioavailability-ma": 1.0,
-            "pgp-broccatelli": 1.0,
-            "cyp2c9-veith": 1.0,
-            "cyp3a4-substrate-carbonmangels": 0.05,
-            "ld50-zhu": 0.096,
-            "herg": 0.1,
-            "dili": 0.58
-          }
-        }
-      },
-      "novelty": {
-        "points": 0.23,
-        "detail": {
-          "max_tanimoto": 0.367,
-          "novelty": 0.633
-        }
-      },
-      "synthesis": {
-        "points": 0.18,
-        "detail": {
-          "sa_score": 2.3
-        }
-      }
-    },
-    "total": 1.84,
-    "tier": 1,
-    "label": "Caffeine",
-    "is_anchor": true,
-    "note": "음성대조",
-    "rank": null
-  }
+[
+  {
+    "admitted": true,
+    "gate": {
+      "admitted": true,
+      "reject": [],
+      "relegate": [],
+      "notes": [],
+      "smiles": "Cc1cc(Nc2ccc(S(F)(F)(F)(F)F)cc2)n2nc(C(C)(F)F)nc2n1",
+      "inchikey": "OIZSVTOIBNSVOS-UHFFFAOYSA-N",
+      "mw": 415.34,
+      "heavy_atoms": 27
+    },
+    "relegated": false,
+    "relegate_reason": [],
+    "axes": {
+      "activity": {
+        "points": 14.45,
+        "detail": {
+          "pAct_q10": 5.467,
+          "fraction": 0.482
+        }
+      },
+      "binding": {
+        "points": 15.12,
+        "detail": {
+          "pIC50": 7.27,
+          "LE": 0.369,
+          "potency_term": 0.756,
+          "efficiency_cap": 1.0
+        }
+      },
+      "selectivity": {
+        "points": 12.59,
+        "detail": {
+          "fold": 46.3,
+          "selectivity_term": 0.833,
+          "target_engagement": 0.756
+        }
+      },
+      "admet": {
+        "points": 5.89,
+        "detail": {
+          "geometric_mean": 0.519,
+          "per_endpoint": {
+            "solubility-aqsoldb": 0.405,
+            "caco2-wang": 0.763,
+            "hia-hou": 1.0,
+            "bioavailability-ma": 1.0,
+            "pgp-broccatelli": 1.0,
+            "cyp2c9-veith": 0.349,
+            "cyp3a4-substrate-carbonmangels": 0.638,
+            "ld50-zhu": 0.66,
+            "herg": 0.116,
+            "dili": 0.05
+          }
+        }
+      },
+      "novelty": {
+        "points": 0.0,
+        "detail": {
+          "max_tanimoto": 1.0,
+          "novelty": 0.0
+        }
+      },
+      "synthesis": {
+        "points": 2.84,
+        "detail": {
+          "sa_score": 3.37
+        }
+      }
+    },
+    "total": 50.88,
+    "tier": 1,
+    "label": "DSM265",
+    "is_anchor": true,
+    "note": "임상후보 (양성 앵커)",
+    "rank": null
+  },
+  {
+    "admitted": true,
+    "gate": {
+      "admitted": true,
+      "reject": [],
+      "relegate": [],
+      "notes": [],
+      "smiles": "Cc1c(-c2ccc(-c3ccccc3F)cc2)nc2ccc(F)cc2c1C(=O)O",
+      "inchikey": "PHEZJEYUWHETKO-UHFFFAOYSA-N",
+      "mw": 375.37,
+      "heavy_atoms": 28
+    },
+    "relegated": false,
+    "relegate_reason": [],
+    "axes": {
+      "activity": {
+        "points": 2.58,
+        "detail": {
+          "pAct_q10": 4.755,
+          "fraction": 0.086
+        }
+      },
+      "binding": {
+        "points": 0.0,
+        "detail": {
+          "reason": "도킹 없음"
+        }
+      },
+      "selectivity": {
+        "points": 0.0,
+        "detail": {
+          "reason": "쌍 측정 없음"
+        }
+      },
+      "admet": {
+        "points": 0.47,
+        "detail": {
+          "geometric_mean": 0.363,
+          "per_endpoint": {
+            "solubility-aqsoldb": 0.05,
+            "caco2-wang": 0.714,
+            "hia-hou": 1.0,
+            "bioavailability-ma": 1.0,
+            "pgp-broccatelli": 0.766,
+            "cyp2c9-veith": 0.696,
+            "cyp3a4-substrate-carbonmangels": 0.88,
+            "ld50-zhu": 0.271,
+            "herg": 0.115,
+            "dili": 0.05
+          }
+        }
+      },
+      "novelty": {
+        "points": 0.56,
+        "detail": {
+          "max_tanimoto": 0.348,
+          "novelty": 0.652
+        }
+      },
+      "synthesis": {
+        "points": 0.43,
+        "detail": {
+          "sa_score": 2.06
+        }
+      }
+    },
+    "total": 4.04,
+    "tier": 1,
+    "label": "Brequinar",
+    "is_anchor": false,
+    "note": "사람 DHODH 억제제 (선택성 반례)",
+    "rank": 1
+  },
+  {
+    "admitted": true,
+    "gate": {
+      "admitted": true,
+      "reject": [],
+      "relegate": [],
+      "notes": [],
+      "smiles": "C/C(O)=C(\\C#N)C(=O)Nc1ccc(C(F)(F)F)cc1",
+      "inchikey": "UTNUDOFZCWSZMS-YFHOEESVSA-N",
+      "mw": 270.21,
+      "heavy_atoms": 19
+    },
+    "relegated": false,
+    "relegate_reason": [],
+    "axes": {
+      "activity": {
+        "points": 1.66,
+        "detail": {
+          "pAct_q10": 4.362,
+          "fraction": 0.055
+        }
+      },
+      "binding": {
+        "points": 0.0,
+        "detail": {
+          "reason": "도킹 없음"
+        }
+      },
+      "selectivity": {
+        "points": 0.0,
+        "detail": {
+          "reason": "쌍 측정 없음"
+        }
+      },
+      "admet": {
+        "points": 0.51,
+        "detail": {
+          "geometric_mean": 0.614,
+          "per_endpoint": {
+            "solubility-aqsoldb": 0.575,
+            "caco2-wang": 0.851,
+            "hia-hou": 1.0,
+            "bioavailability-ma": 1.0,
+            "pgp-broccatelli": 1.0,
+            "cyp2c9-veith": 0.568,
+            "cyp3a4-substrate-carbonmangels": 0.21,
+            "ld50-zhu": 0.459,
+            "herg": 1.0,
+            "dili": 0.11
+          }
+        }
+      },
+      "novelty": {
+        "points": 0.35,
+        "detail": {
+          "max_tanimoto": 0.357,
+          "novelty": 0.643
+        }
+      },
+      "synthesis": {
+        "points": 0.28,
+        "detail": {
+          "sa_score": 2.27
+        }
+      }
+    },
+    "total": 2.79,
+    "tier": 1,
+    "label": "Teriflunomide",
+    "is_anchor": false,
+    "note": "사람 DHODH 억제제 (선택성 반례)",
+    "rank": 2
+  },
+  {
+    "admitted": true,
+    "gate": {
+      "admitted": true,
+      "reject": [],
+      "relegate": [],
+      "notes": [],
+      "smiles": "CC(C)Cc1ccc(C(C)C(=O)O)cc1",
+      "inchikey": "HEFNNWSXXWATRW-UHFFFAOYSA-N",
+      "mw": 206.28,
+      "heavy_atoms": 15
+    },
+    "relegated": false,
+    "relegate_reason": [],
+    "axes": {
+      "activity": {
+        "points": 1.04,
+        "detail": {
+          "pAct_q10": 4.174,
+          "fraction": 0.035
+        }
+      },
+      "binding": {
+        "points": 0.06,
+        "detail": {
+          "pIC50": 3.57,
+          "LE": 0.326,
+          "potency_term": 0.003,
+          "efficiency_cap": 1.0
+        }
+      },
+      "selectivity": {
+        "points": 0.0,
+        "detail": {
+          "fold": 0.3,
+          "selectivity_term": 0.0,
+          "target_engagement": 0.0
+        }
+      },
+      "admet": {
+        "points": 0.38,
+        "detail": {
+          "geometric_mean": 0.74,
+          "per_endpoint": {
+            "solubility-aqsoldb": 0.677,
+            "caco2-wang": 1.0,
+            "hia-hou": 1.0,
+            "bioavailability-ma": 1.0,
+            "pgp-broccatelli": 1.0,
+            "cyp2c9-veith": 1.0,
+            "cyp3a4-substrate-carbonmangels": 1.0,
+            "ld50-zhu": 0.212,
+            "herg": 1.0,
+            "dili": 0.528
+          }
+        }
+      },
+      "novelty": {
+        "points": 0.21,
+        "detail": {
+          "max_tanimoto": 0.386,
+          "novelty": 0.614
+        }
+      },
+      "synthesis": {
+        "points": 0.17,
+        "detail": {
+          "sa_score": 2.19
+        }
+      }
+    },
+    "total": 1.86,
+    "tier": 1,
+    "label": "Ibuprofen",
+    "is_anchor": true,
+    "note": "음성대조",
+    "rank": null
+  },
+  {
+    "admitted": true,
+    "gate": {
+      "admitted": true,
+      "reject": [],
+      "relegate": [],
+      "notes": [],
+      "smiles": "Cn1c(=O)c2c(ncn2C)n(C)c1=O",
+      "inchikey": "RYYVLZVUVIJVGH-UHFFFAOYSA-N",
+      "mw": 194.19,
+      "heavy_atoms": 14
+    },
+    "relegated": false,
+    "relegate_reason": [],
+    "axes": {
+      "activity": {
+        "points": 1.1,
+        "detail": {
+          "pAct_q10": 4.197,
+          "fraction": 0.037
+        }
+      },
+      "binding": {
+        "points": 0.06,
+        "detail": {
+          "pIC50": 3.62,
+          "LE": 0.354,
+          "potency_term": 0.003,
+          "efficiency_cap": 1.0
+        }
+      },
+      "selectivity": {
+        "points": 0.0,
+        "detail": {
+          "fold": 1.3,
+          "selectivity_term": 0.058,
+          "target_engagement": 0.0
+        }
+      },
+      "admet": {
+        "points": 0.27,
+        "detail": {
+          "geometric_mean": 0.496,
+          "per_endpoint": {
+            "solubility-aqsoldb": 1.0,
+            "caco2-wang": 1.0,
+            "hia-hou": 1.0,
+            "bioavailability-ma": 1.0,
+            "pgp-broccatelli": 1.0,
+            "cyp2c9-veith": 1.0,
+            "cyp3a4-substrate-carbonmangels": 0.05,
+            "ld50-zhu": 0.096,
+            "herg": 0.1,
+            "dili": 0.58
+          }
+        }
+      },
+      "novelty": {
+        "points": 0.23,
+        "detail": {
+          "max_tanimoto": 0.367,
+          "novelty": 0.633
+        }
+      },
+      "synthesis": {
+        "points": 0.18,
+        "detail": {
+          "sa_score": 2.3
+        }
+      }
+    },
+    "total": 1.84,
+    "tier": 1,
+    "label": "Caffeine",
+    "is_anchor": true,
+    "note": "음성대조",
+    "rank": null
+  }
 ]

index.html

@@ -225,15 +225,42 @@
             border-radius:8px;font-family:ui-monospace,Menlo,monospace;font-size:10.5px;
             color:#31465e;line-height:1.5;word-break:break-all;position:relative}
   #ov .osmi .cp{position:absolute;top:6px;right:6px}
+  #ov .osmi .d3{position:absolute;top:6px;right:32px}
+  .d3{flex:none;border:1px solid var(--line);background:#fff;border-radius:6px;
+      height:22px;padding:0 6px;line-height:1;cursor:pointer;color:var(--muted);
+      font-size:10px;font-weight:700;letter-spacing:.02em}
+  .d3:hover{border-color:var(--accent);color:var(--accent);background:var(--accent-soft)}
+  /* the viewer is a modal, not a panel: a molecule you are turning over deserves the
+     whole window, and the table underneath would only compete for the drag */
+  #m3{position:fixed;inset:0;z-index:120;display:none;background:rgba(16,23,34,.55);
+      backdrop-filter:blur(3px)}
+  #m3.on{display:flex;align-items:center;justify-content:center}
+  #m3 .box{background:#fff;border-radius:16px;width:min(720px,94vw);
+           box-shadow:0 24px 70px rgba(12,18,28,.35);overflow:hidden}
+  #m3 .hd{display:flex;align-items:center;gap:10px;padding:12px 14px;
+          border-bottom:1px solid var(--line)}
+  #m3 .hd b{font-size:13px;color:#16223a}
+  #m3 .hd .f{font-family:ui-monospace,Menlo,monospace;font-size:11px;color:var(--muted)}
+  #m3 .hd .x{margin-left:auto;border:0;background:none;font-size:20px;line-height:1;
+             cursor:pointer;color:var(--muted);padding:0 4px}
+  #m3 .stage{position:relative;height:min(430px,52vh);background:#0d1420}
+  #m3 .stage canvas{display:block}
+  #m3 .msg{position:absolute;inset:0;display:flex;align-items:center;justify-content:center;
+           color:#93a6c0;font-size:12px}
+  #m3 .ft{display:flex;align-items:center;gap:8px;padding:10px 14px;flex-wrap:wrap}
+  #m3 .ft .sm{font-family:ui-monospace,Menlo,monospace;font-size:10.5px;color:#4a5d78;
+              word-break:break-all;flex:1;min-width:0}
+  #m3 .ft button{border:1px solid var(--line);background:#fff;border-radius:7px;
+                 padding:5px 10px;font-size:11px;cursor:pointer;color:#33465f}
+  #m3 .ft button:hover{border-color:var(--accent);color:var(--accent)}
+  #m3 .ft button.on{border-color:var(--accent);background:var(--accent);color:#fff}
   .who{color:var(--muted);font-size:12.5px}
-  /* Long model identifiers wrapped onto four lines and made every row three times
-     taller than it needed to be. Truncate; the full value is on the tooltip. */
-  td:nth-child(3), td:nth-child(4){max-width:150px}
-  td:nth-child(3) > *, td:nth-child(4) > *{display:block;max-width:150px;
-    overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
-  td:nth-child(2){max-width:300px}
-  .hf-user{color:var(--accent);font-weight:700;text-decoration:none;white-space:nowrap}
-  .hf-user:hover{text-decoration:underline}
+  /* Long model identifiers wrapped onto four lines and made every row three times
+     taller than it needed to be. Truncate; the full value is on the tooltip. */
+  td:nth-child(3), td:nth-child(4){max-width:150px}
+  td:nth-child(3) > *, td:nth-child(4) > *{display:block;max-width:150px;
+    overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  td:nth-child(2){max-width:300px}
   .tag{display:inline-block;font-size:9.5px;font-weight:800;letter-spacing:.7px;
        padding:2px 7px;border-radius:5px;margin-left:6px;vertical-align:1px}
   .tag.a{background:#f6e2ba;color:var(--anchor)}
@@ -265,6 +292,16 @@
 </head>
 <body>
 <div id="ov"></div>
+<div id="m3"><div class="box">
+  <div class="hd"><b id="m3f"></b><span class="f" id="m3w"></span>
+    <button class="x" id="m3x" aria-label="close">×</button></div>
+  <div class="stage"><div id="m3v" style="width:100%;height:100%;position:relative"></div>
+    <div class="msg" id="m3m"></div></div>
+  <div class="ft"><span class="sm" id="m3s"></span>
+    <button id="m3st" class="on" data-s="stick">Stick</button>
+    <button id="m3sp" data-s="sphere">Space-fill</button>
+    <button id="m3rt" class="on" title="spin">↻</button></div>
+</div></div>
 <div class="wrap">
 
   <header>
@@ -441,7 +478,9 @@ const T = {
       synthesis:d=>`합성난이도 SA ${d.sa_score ?? "–"} (1 쉬움 ~ 10 어려움)`,
     },
     ov_pred:"예측치", ov_pf:"말라리아 효소", ov_hs:"사람 효소", ov_sel:"선택도",
-    private_note:"제출자가 비공개를 선택했습니다", copy_smiles:"분자식 복사",
+    private_note:"제출자가 비공개를 선택했습니다", copy_smiles:"분자식 복사", view_3d:"3D 입체 구조로 보기",
+    v3_loading:"입체 구조 생성 중\u2026", v3_atoms:"원자",
+    v3_failed:"입체 구조를 만들지 못했습니다",
     private_full:"제출자가 비공개를 선택했습니다. 후보 ID와 골격 해시로만 식별됩니다.",
     reasons:{
       parse:      r=>"구조를 해석할 수 없습니다 (SMILES 또는 InChI로 제출하세요)",
@@ -535,7 +574,9 @@ const T = {
       synthesis:d=>`SA score ${d.sa_score ?? "–"} (1 easy - 10 hard)`,
     },
     ov_pred:"Predicted", ov_pf:"parasite enzyme", ov_hs:"human enzyme", ov_sel:"selectivity",
-    private_note:"structure withheld by the entrant", copy_smiles:"Copy SMILES",
+    private_note:"structure withheld by the entrant", copy_smiles:"Copy SMILES", view_3d:"View in 3D",
+    v3_loading:"building conformer\u2026", v3_atoms:"atoms",
+    v3_failed:"could not build a 3D conformer",
     private_full:"The entrant chose to keep this structure private. It is identified only by its candidate ID and skeleton hash.",
     reasons:{
       parse:      r=>"Structure could not be parsed (submit SMILES or InChI)",
@@ -666,20 +707,6 @@ function sortVal(e, k){
   return (e.axes||{})[k] ?? -1;
 }
 
-function esc(s){
-  return String(s ?? "").replace(/[&<>"']/g, c=>({
-    "&":"&amp;", "<":"&lt;", ">":"&gt;", '"':"&quot;", "'":"&#39;"
-  })[c]);
-}
-
-function hfProfile(user){
-  if(!user) return "";
-  const label = esc(user);
-  const url = `https://huggingface.co/${encodeURIComponent(user)}`;
-  return `<a class="hf-user" href="${url}" target="_blank" rel="noopener noreferrer"`
-       + ` title="Hugging Face: ${label}">🤗 ${label}</a>`;
-}
-
 function render(){
   const d = t(), W = DATA.season.weights, max = Math.max(1, ...DATA.entries.map(e=>e.total||0));
   $("#wts").innerHTML = Object.entries(W)
@@ -705,22 +732,24 @@ function render(){
 
   $("#rows").innerHTML = rows.length ? rows.map(e=>{
     const a = e.axes||{};
-    const cls = [e.is_anchor?"anchor":"", e.tier===2?"tier2":""].join(" ").trim();
-    const _who = e.hf_user || e.display_name || "";
-    const user = e.is_anchor ? '<span class="who">\u2014</span>'
-      : (e.hf_user ? hfProfile(e.hf_user)
-        : `<span title="${esc(_who)}">${esc(e.display_name||"\u2013")}</span>`);
-    const _m = e.is_anchor ? (e.note || d.ref) : (e.model_name || "\u2013");
-    const who = `<span class="who" title="${esc(_m)}">${esc(_m)}</span>`;
+    const cls = [e.is_anchor?"anchor":"", e.tier===2?"tier2":""].join(" ").trim();
+    const _who = e.hf_user || e.display_name || "";
+    const user = e.is_anchor ? '<span class="who">\u2014</span>'
+      : `<span title="${_who}">`
+        + (e.hf_user ? `\u{1F917} ${e.hf_user}` : (e.display_name||"\u2013"))
+        + '</span>';
+    const _m = e.is_anchor ? (e.note || d.ref) : (e.model_name || "\u2013");
+    const who = `<span class="who" title="${_m}">${_m}</span>`;
     // the structure is the name now; a withheld one shows its ends, middle blanked.
     // Only a published structure gets a copy button - there is nothing to copy otherwise.
-    const isPub = e.visibility === "public" && !!e.smiles;
-    const shown = isPub ? e.smiles : e.smiles_masked;
-    const clip = shown ? (shown.length > 26 ? shown.slice(0, 26) + "\u2026" : shown) : "";
+    const isPub = e.visibility === "public" && !!e.smiles;
+    const shown = isPub ? e.smiles : e.smiles_masked;
+    const clip = shown ? (shown.length > 26 ? shown.slice(0, 26) + "\u2026" : shown) : "";
     const id = e.is_anchor ? `<b>${e.candidate_id}</b>`
       : (shown
           ? `<span class="smiwrap"><span class="smi2" title="${shown}">${clip}</span>`
-            + (isPub ? `<button class="cp" data-smi="${e.smiles}" title="${d.copy_smiles}">\u29c9</button>` : "")
+            + (isPub ? `<button class="d3" data-smi="${e.smiles}" title="${d.view_3d}">3D</button>`
+                     + `<button class="cp" data-smi="${e.smiles}" title="${d.copy_smiles}">\u29c9</button>` : "")
             + `</span>`
           : `<span class="cid">${e.candidate_id}</span>`);
     const tag = e.is_anchor ? `<span class="tag a">${d.anchor}</span>`
@@ -735,6 +764,7 @@ function render(){
   }).join("") : `<tr><td colspan="11" class="who">${d.empty}</td></tr>`;
 
   wireCopy($("#rows"));
+  wire3D($("#rows"));
 
   // rows carry their entry so the overlay never has to look anything up again
   [...document.querySelectorAll("#rows tr")].forEach((tr, i) => {
@@ -939,20 +969,101 @@ function overlayHTML(e){
   const pred = (r.aff_pf!=null || r.aff_hs!=null) ? `<div class="osum">
       ${d.ov_pred} · ${d.ov_pf} <b>${ic50(r.aff_pf)}</b> · ${d.ov_hs} <b>${ic50(r.aff_hs)}</b>
       ${sel.fold?` · ${d.ov_sel} <b>${sel.fold}x</b>`:""}</div>` : "";
-  const flag = (e.relegate_reason && e.relegate_reason.length)
-      ? `<div class="oflag">${e.relegate_reason.map(reasonText).join(" / ")}</div>` : "";
-  const who = e.is_anchor ? esc(e.note||"")
-    : [esc(e.hf_user||""), esc(e.model_name||"")].filter(Boolean).join(" · ");
-  const full = (e.visibility === "public" && e.smiles) ? e.smiles : e.smiles_masked;
+  const flag = (e.relegate_reason && e.relegate_reason.length)
+      ? `<div class="oflag">${e.relegate_reason.map(reasonText).join(" / ")}</div>` : "";
+  const who = e.is_anchor ? (e.note||"") : [e.hf_user, e.model_name].filter(Boolean).join(" · ");
+  const full = (e.visibility === "public" && e.smiles) ? e.smiles : e.smiles_masked;
   const canCopy = e.visibility === "public" && e.smiles;
   const smi = e.is_anchor ? ""
-      : `<div class="osmi">${full || ""}`
-        + (canCopy ? `<button class="cp" data-smi="${e.smiles}" title="${d.copy_smiles}">\u29c9</button>` : "")
-        + (e.visibility === "public" ? "" : `<br>🔒 ${d.private_full}`) + `</div>`;
+      : `<div class="osmi">${full || ""}`
+        + (canCopy ? `<button class="d3" data-smi="${e.smiles}" title="${d.view_3d}">3D</button>`
+                   + `<button class="cp" data-smi="${e.smiles}" title="${d.copy_smiles}">\u29c9</button>` : "")
+        + (e.visibility === "public" ? "" : `<br>🔒 ${d.private_full}`) + `</div>`;
   return `<h4>${e.candidate_id}</h4><div class="oid">${who}${e.skeleton?" · "+e.skeleton:""}</div>`
        + rows + pred + smi + flag + `<div class="ofoot">${d.ov_foot}</div>`;
 }
 
+// ---------------------------------------------------------------- 3D viewer
+// 3Dmol is loaded on first use. It is ~2 MB and most visits never open a structure, so
+// paying for it on every page load would be charging everyone for a minority feature.
+let _v3 = null, _3ready = null, _spin = true, _style = "stick";
+
+// out of the grid and onto the body: the modal was declared beside the hover overlay,
+// inside the layout, and the grid's min-width:0 collapsed it to nothing
+document.body.appendChild($("#m3"));
+
+function load3Dmol(){
+  if(_3ready) return _3ready;
+  _3ready = new Promise((res, rej) => {
+    const s = document.createElement("script");
+    s.src = "https://3Dmol.org/build/3Dmol-min.js";
+    s.onload = res; s.onerror = () => rej(new Error("3Dmol"));
+    document.head.appendChild(s);
+  });
+  return _3ready;
+}
+
+function paint3(){
+  if(!_v3) return;
+  _v3.setStyle({}, _style === "sphere"
+    ? {sphere:{scale:0.42, colorscheme:"Jmol"}}
+    : {stick:{radius:0.17, colorscheme:"Jmol"}, sphere:{scale:0.22, colorscheme:"Jmol"}});
+  _v3.render();
+}
+
+async function open3D(smi){
+  const M = $("#m3"), msg = $("#m3m");
+  M.classList.add("on");
+  $("#m3s").textContent = smi;
+  $("#m3f").textContent = ""; $("#m3w").textContent = "";
+  msg.textContent = t().v3_loading;
+  try{
+    const [_, r] = await Promise.all([
+      load3Dmol(),
+      fetch("api/mol3d?smiles=" + encodeURIComponent(smi)).then(x => x.json())
+    ]);
+    if(!r.mol) throw new Error("mol");
+    $("#m3f").textContent = r.formula;
+    $("#m3w").textContent = r.mw + " Da \u00b7 " + r.atoms + " " + t().v3_atoms;
+    const host = $("#m3v");
+    host.innerHTML = "";
+    _v3 = $3Dmol.createViewer(host, {backgroundColor:"#0d1420"});
+    _v3.addModel(r.mol, "mol");
+    paint3();
+    _v3.zoomTo();
+    _v3.render();
+    _v3.spin(_spin ? "y" : false, 0.6);
+    msg.textContent = "";
+  }catch(err){
+    msg.textContent = t().v3_failed;
+  }
+}
+
+function close3D(){
+  $("#m3").classList.remove("on");
+  // the WebGL context is not reclaimed by hiding the element; leaving one per open would
+  // eventually exhaust the browser's context budget and blank the canvas
+  try{ if(_v3){ _v3.spin(false); _v3.clear(); } }catch(_){}
+  _v3 = null; $("#m3v").innerHTML = "";
+}
+
+$("#m3x").onclick = close3D;
+$("#m3").onclick = (e) => { if(e.target.id === "m3") close3D(); };
+document.addEventListener("keydown", e => { if(e.key === "Escape") close3D(); });
+$("#m3st").onclick = () => { _style = "stick"; $("#m3st").classList.add("on");
+                             $("#m3sp").classList.remove("on"); paint3(); };
+$("#m3sp").onclick = () => { _style = "sphere"; $("#m3sp").classList.add("on");
+                             $("#m3st").classList.remove("on"); paint3(); };
+$("#m3rt").onclick = () => { _spin = !_spin; $("#m3rt").classList.toggle("on", _spin);
+                             try{ if(_v3) _v3.spin(_spin ? "y" : false, 0.6); }catch(_){} };
+
+function wire3D(root){
+  root.querySelectorAll(".d3").forEach(b => b.onclick = (ev) => {
+    ev.stopPropagation();
+    open3D(b.dataset.smi);
+  });
+}
+
 function wireCopy(root){
   root.querySelectorAll(".cp").forEach(b => b.onclick = async (ev) => {
     // without this the click also reaches the row and toggles the overlay
@@ -979,6 +1090,7 @@ function showOverlay(e, rect){
   OV.style.top = top + "px";
   OV.style.left = left + "px";
   wireCopy(OV);
+  wire3D(OV);
 }
 function hideOverlay(){ OV.style.display = "none"; }
 OV.onmouseenter = () => clearTimeout(OV._t);