Read-only surfaces. Data comes from Supabase (or the local dev server) and every seal is re-verified in your browser with Web Crypto — no server trusted. Authoring · offer→accept · sealing arrive with the write path (M3).