Initial commit — Silent Mode baseline (2026-07-29)

Snapshot of the decentralized-web stack at the point of the resolver+Theseus rebuild deploy. Includes: - Argus (BNS engine + resolver daemon + Sia gateway) - AriadneResolver (Windows Inno installer bundle + Android APK sources + Firefox extension) - TheseusNavigator (Electron browser) - site/ (silentmode.st content, deployed to Sia at bns/silentmode/) - design docs, roadmap, protocol spec Secrets excluded via .gitignore: Argus/sia-s3.json, Argus/wallets.json, Argus/ca/*.key,*.crt. Build outputs, node_modules, and bundled runtimes also excluded. Shipped hashes on dl.silentmode.st at this commit: AriadneResolver-Setup-0.1.0.exe 5bcb216eef31ea28ed767e4134ab74bd5ac69dfbd365fd249e9e6938e55c986a TheseusNavigator-Setup-0.0.1.exe 7c735e88bad2da3347145adba3016c8f626a18b8422289c8c6ba471972e2952b TheseusNavigator-0.0.1-portable.exe 008fd84445babeabb401b2bca40ea9466b24b0e6d6c85104da7640c5c5c84521 ariadne-v0.2.apk 635c8f04d44ef855a8390b9eeddb8cd2d50622e81cc4e5004e8daffc1bb0425c
2026-07-29 13:54:34 +02:00 · 2026-07-29 13:54:34 +02:00 · 7898e78ff4
commit 7898e78ff4
19 changed files with 7023 additions and 0 deletions
--- a/BROWSER-PROMPT.md
+++ b/BROWSER-PROMPT.md
@ -0,0 +1,76 @@
+# Prompt for a new session: build Theseus, the browser
+
+Copy everything below the line into a fresh Claude Code session (suggested
+working directory: `D:\Dev\BnsBrowser`).
+
+---
+
+Build **Theseus Navigator** ("Theseus" for short) — a standalone desktop web
+browser with native support for decentralized `.bch` domain names, resolved
+from the Bitcoin Cash blockchain. Windows 10 first; Electron is the expected
+shell (Chromium engine, no forking).
+
+Branding: *Theseus Navigator, by Silent Mode — a Deviant project*. The name refers to the
+thread through the labyrinth: the blockchain is the thread. Read
+`D:\Dev\SilentMode\README.md` first for the whole picture. `theseus.bch` is
+already registered on chipnet and can serve the browser's own homepage.
+
+## Context — a working stack already exists
+
+`D:\Dev\NameCoin` contains a complete, tested prototype (read its README.md,
+PROTOCOL.md, and ROADMAP.md first):
+
+- `src/lib/bns.js` — the resolver core: reads the "BNS1" protocol from BCH
+  chipnet via electrum (mainnet-js). Names are CashTokens NFTs; records are
+  JSON in OP_RETURN (`ip`, `u`, `p`, `h`, `s3`, `tls` types); discovery via a
+  beacon address. Subdomains map through the parent name (see bnsd.js).
+- `src/daemon/bnsd.js` — reference gateway: serves `h` (on-chain HTML), `p`
+  (reverse proxy), `s3` (Sia storage via an S3 endpoint configured in
+  `sia-s3.json`), redirects `u`, and resolves `ip` records at DNS level.
+- `ca/` — a local root CA ("BNS Local Root CA") that signs per-name certs;
+  fingerprints can be pinned via on-chain `tls` records.
+- Live test names on chipnet right now: `hello.bch` (on-chain HTML),
+  `coinspectrum.bch` (ip → real nginx server), `siatest.bch` and
+  `coinspectrum.deviant.bch` (Sia-backed, subdomain namespace),
+  `theseus.bch` and `silentmode.bch` (on-chain HTML, brand pages).
+
+Reuse `bns.js` as a library (npm file: dependency or copied module) — do not
+reimplement the protocol. The browser must NOT require the system daemon,
+NRPT rules, or the OS trust store: everything in-process.
+
+## Requirements
+
+1. **Chrome-like shell**: tabs, address bar, back/forward/reload, history.
+   Electron BrowserViews/WebContentsViews per tab.
+2. **Native .bch resolution**: typing `hello.bch` or `x.deviant.bch` resolves
+   via the BNS core inside the app (no OS DNS involvement). Everything else
+   browses the normal web unchanged.
+3. **Record handling**: `h` render directly; `ip` connect to the host (http);
+   `p`/`s3` fetch via an in-app gateway on a loopback port; `u` redirect.
+4. **TLS for .bch without touching the OS store**: intercept at the session
+   level (Electron `setCertificateVerifyProc`) — accept certs for .bch hosts
+   when they chain to the BNS root or match the name's on-chain `tls`
+   fingerprint; normal CA validation for everything else.
+5. **UI truthfulness**: a visible indicator when a page came from the chain /
+   Sia / a direct ip record, showing the NFT category and record type — the
+   "padlock" for decentralized provenance.
+6. **Fallback honesty**: unregistered .bch → a clean NXDOMAIN page naming the
+   chain; electrum outages → readable error, not a hang.
+7. Package with electron-builder into a Windows installer (unsigned is fine).
+
+## Definition of done
+
+All four live names above load correctly in tabs alongside normal websites
+(e.g. wikipedia.org), with provenance indicators, from a packaged .exe on
+Windows 10 — no admin rights, no system daemon, no OS DNS or cert changes.
+
+## Constraints & notes
+
+- BCH chipnet; electrum servers as in mainnet-js defaults (see bns.js usage).
+- `sia-s3.json` in D:\Dev\NameCoin holds the S3 endpoint + keys for `s3`
+  records (server-side s3d at https://coinspectrum.duckdns.org:8600) — copy
+  it into the browser's config directory; do not commit it.
+- Wallet/registration UI is OUT of scope (exists in the NameCoin repo's
+  wallet app); this session is the *viewing* side only.
+- Test names may be unconfirmed on chipnet — the resolver handles mempool
+  entries; height -1 is normal.
--- a/PACKAGING-PROMPT.md
+++ b/PACKAGING-PROMPT.md
@ -0,0 +1,91 @@
+# Theseus Navigator — packaging session brief
+
+Goal of this session: turn Theseus from "runs via `npm start`" into a
+**downloadable, secret-free Windows installer** hosted at `dl.silentmode.st`,
+with its SHA-256 published on-chain. Do it in the three phases below, in order.
+
+Working dir: `D:\Dev\SilentMode\TheseusNavigator`. Prefix shell commands with
+`rtk`. Windows + PowerShell primary; Bash tool available.
+
+**Read first:** `..\README.md` (hub), `..\BUILD-ROADMAP.md` (this is Stage 5),
+`..\SECURITY.md` (Rules 0/2/3 govern this session), `..\_coordination\INTERFACES.md`
+(the resolver contract), and this file. Theseus already works for `.bch`; the
+engine (`..\Argus\src\lib\resolver-web.js`) is already multi-TLD and zero-dep.
+
+---
+
+## Current state (verified 2026-07-25)
+- Theseus **runs** (`npm start`): Electron, tabs, back/fwd/reload/home, address
+  bar, DuckDuckGo search box, home page, **Tor toggle** (bundled `tor/tor.exe`,
+  routes web session + resolver WS + content fetch via SOCKS).
+- Resolution reuses `..\Argus\src\lib\resolver-web.js` (import in `main.js`).
+- `bns://` custom protocol serves content; provenance strip shows chain/Sia/server.
+- **NOT** packaged: no `electron-builder`, no installer.
+- **Two blockers for a public build (must fix):**
+  1. `main.js` `resolveHost()` is still `.bch`-only
+     (`host.replace(/\.bch$/,"").split(".").pop()`), and `navigate()` /
+     `serveBns()` / `subFolder()` assume `.bch`. The engine is multi-TLD; the
+     browser must catch up.
+  2. `serveBns()` fetches `s3` content with **your Sia credentials**
+     (`getAws()` reads `..\Argus\sia-s3.json`). **A public build MUST NOT ship
+     credentials** (SECURITY.md Rule 0). Switch `s3` to the public gateway.
+
+## Phase 1 — Multi-TLD + registry badge (browser catches up to engine)
+- `resolveHost(host)`: stop stripping `.bch`/`.pop()`. Pass the **full host** to
+  `resolveName(host, { WebSocket: currentWS() })` — it already normalizes any
+  `<sub>.<label>.<tld>` to the canonical key. Cache/serve by full host.
+- `navigate()`: replace `host.endsWith(".bch")` checks with "is this a BNS name?"
+  = has a dot and the rightmost label is a known BNS TLD (`bch`, `p2p`, `deviant`,
+  `bit`, …) — everything else is normal web. Keep a small TLD allowlist constant.
+- `serveBns()` + `subFolder()`: generalize off `.bch` (drop tld + label to get
+  the subfolder — mirror `resolver-web.js`/the gateway).
+- **Registry badge (trusted chrome — the security invariant):** in the toolbar
+  provenance strip (chrome, NOT page content), show the **registry / TLD** the
+  name resolved under (e.g. "BitcoinCash · .bch"). This is where the future
+  multi-registry `.bit` (BCH vs Namecoin) switch will surface. Unspoofable
+  because it's painted by the browser, not the page.
+- Verify: `hello.bch`, `demo.p2p`, `coinspectrum.deviant.bch` all load in tabs;
+  badge shows the right TLD; normal web (wikipedia.org) still works.
+
+## Phase 2 — Secret-free content (SECURITY.md Rule 0)
+- Replace the `getAws()` signed-S3 path in `serveBns()` with a plain fetch from
+  the **public gateway**: `https://navigate.st/bns/<name>/<path>` (or the
+  subdomain form). The gateway already serves `s3`/`ip`/`h`/`u` and injects no
+  secrets. Remove the `aws4fetch` dependency and any read of `sia-s3.json`.
+- Net effect: a shipped Theseus contains **no credentials**. `s3` sites render by
+  asking the public relay for the bytes; resolution stays local/trustless.
+- Grep the repo + built output for `sia-s3`, `accessKey`, `secretKey`,
+  `C:\\Users\\`, the OS username — must be clean before packaging.
+
+## Phase 3 — Package, scrub, publish
+- Add `electron-builder`; target Windows **NSIS installer** + a **portable .exe**.
+  Bundle `tor/`, `chrome.html`, `home.html`, `preload.js`, and the resolver it
+  imports (either vendor `resolver-web.js` into the app or include `../Argus`
+  path in `files`). Confirm `tor.exe` and geoip files are packaged.
+- **Unsigned by choice** (SECURITY.md Rule 2). Document the SmartScreen warning.
+- **Scrub fingerprints** (Rule 3): build in a neutral path or strip absolute
+  paths/source maps; no real name/email/username in metadata; set the app
+  `author` to "Silent Mode". Normalize timestamps where feasible.
+- Compute **SHA-256** of the installer. Publish the hash **on-chain** — a BNS
+  record (e.g. a `releases` name) or note the mechanism in `..\SECURITY.md`.
+- Deploy the installer to **`dl.silentmode.st`** (nginx already serves
+  `/opt/silent-mode/dl/` on the VPS via the `silentmode-st` / `dl` vhost). Update
+  the download page (`..\site\index.html`) — swap the "packaging in progress"
+  chip for a real link + the SHA-256 + "unsigned, verify the hash" note.
+- Verify end to end: download the installer on a clean path, install, launch,
+  load `hello.bch` + a Sia site + normal web, confirm no secrets in the install
+  dir, confirm the published hash matches.
+
+## Guardrails
+- Do NOT touch `D:\Dev\NameCoin` (live/canonical) or register/spend on-chain
+  beyond (optionally) one release-hash record. Reads are fine.
+- Do NOT ship `sia-s3.json`, `ca/root-ca.key`, `wallets.json`, any keystore/
+  password. Follow the SECURITY.md pre-release checklist.
+- Elevated installs, code-signing, and AMO steps are the user's to run — don't
+  attempt them; hand off exact commands.
+
+## Definition of done
+A downloadable **`dl.silentmode.st`** Windows installer that: contains no
+secrets, resolves `.bch`/`.p2p`/etc. with a trusted-chrome registry badge,
+renders Sia sites via the public gateway, browses the normal web, and whose
+SHA-256 is published on-chain and shown on the download page.
--- a/README.md
+++ b/README.md
@ -0,0 +1,27 @@
+# Theseus Navigator
+
+The browser — the consumer face of the stack. Native `.bch` support with the
+resolver built in, so a user installs **one app** instead of modifying their
+operating system. Named for the thread through the labyrinth: the chain is the
+thread.
+
+## Scope
+- Electron shell (Chromium engine, no forking): tabs, address bar, history.
+- **In-process `.bch` resolution** — no system daemon, no NRPT, no OS
+  trust-store changes; reuses `bns.js` from the BNS repo as a library.
+- Record handling: `h` render, `ip` connect, `p`/`s3` via in-app gateway,
+  `u` redirect.
+- **TLS via cert-verify hook** (Electron `setCertificateVerifyProc`) against the
+  BNS root / on-chain `tls` fingerprints — no OS store touched.
+- **Provenance indicator**: shows whether a page came from the chain / Sia / a
+  direct server, with NFT category and record type — the decentralized padlock.
+
+## Status: not started
+Build it in its own session/repo. The ready-to-paste brief is
+**`BROWSER-PROMPT.md`** (a reference copy in this folder; canonical source is
+`D:\Dev\NameCoin\BROWSER-PROMPT.md` — if they diverge, NameCoin wins). It points
+here and reuses the resolver core. `theseus.bch` is registered and should
+eventually serve the browser's own homepage over the protocol it implements.
+
+## Roadmap
+[BUILD-ROADMAP.md](../BUILD-ROADMAP.md) Stage 5.
--- a/RELEASE-HANDOFF.md
+++ b/RELEASE-HANDOFF.md
@ -0,0 +1,93 @@
+# Theseus Navigator v0.0.1 — release handoff
+
+Built 2026-07-25 from `D:\Dev\SilentMode\TheseusNavigator`. The code changes
+(multi-TLD, registry badge, secret-free Sia-via-gateway) and packaging are done.
+The steps below are the ones this session must NOT do for you — they spend
+on-chain and touch the VPS. Run them yourself; exact commands are given.
+
+## Artifacts (in `dist-public/`)
+
+| File | Size | SHA-256 |
+|---|---|---|
+| `TheseusNavigator-Setup-0.0.1.exe` (NSIS installer) | ~92 MB | `55d6d23d950952e5dae22474e1abd4420e8d4081a17ee7be21fbcffc2141189c` |
+| `TheseusNavigator-0.0.1-portable.exe` (portable) | ~92 MB | `9832d8cef5c1c1b8d7025cbdf4a70ef82e1e10255f83bc700da2014f9849330f` |
+
+> **The binaries have been rebuilt more than once and the hashes changed each
+> time** (`41df5809…` → `77e836ac…` → `f39132bc…`). The values above were
+> re-computed from `dist-public/` on 2026-07-26 and match what `site/` and
+> `site/releases-manifest.json` publish. **Always re-hash immediately before the
+> Step 2 on-chain publish** — a rebuild between writing a doc and spending the
+> transaction silently invalidates it, and that step cannot be undone.
+
+Verified clean: no `sia-s3`/`accessKey`/`secretKey`/`aws4fetch` and no
+`C:\Users\valer` / username strings in `app.asar` or bundled resources.
+
+Re-verify the hashes any time:
+
+```bash
+cd D:\Dev\SilentMode\TheseusNavigator\dist-public && sha256sum *.exe
+```
+
+## Step 1 — Deploy to `dl.silentmode.st` (your VPS)
+
+nginx already serves `/opt/silent-mode/dl/` on the `dl` / `silentmode-st` vhost.
+Upload both installers + the manifest (run over the anonymous VPN/Tor per
+SECURITY.md §4):
+
+```bash
+scp dist-public/TheseusNavigator-Setup-0.0.1.exe dist-public/TheseusNavigator-0.0.1-portable.exe site/releases-manifest.json <vps>:/opt/silent-mode/dl/
+```
+
+**Manifest moved (2026-07-26).** `releases-manifest.json` is now multi-product
+(Theseus + Ariadne Android) and lives at `site/releases-manifest.json` — note
+the `scp` line above copies it from `site/`, not from `dist-public/`. The old
+Theseus-only copy in `dist-public/` was deleted the same day: uploading it would
+have wiped the Android APK's checksum off the live manifest. Do not re-create
+one there — that is electron-builder's output directory, and hand-placed files
+are lost on the next `npm run dist`.
+
+The download page (`site/index.html`) already links these exact filenames at
+`https://dl.silentmode.st/…`, so no page edit is needed once they land.
+
+## Step 2 — Publish the hash on-chain (`releases.silentmode.bch`)
+
+This spends chipnet funds and uses the wallet seed — your action, not the
+session's. The engine tool is `Argus/src/update.js`. Publish the manifest as an
+inline `h` record so `releases.silentmode.bch` itself serves the hash list
+(same mechanism as `hello.bch`):
+
+```bash
+cd D:\Dev\SilentMode\Argus
+node src/update.js releases.silentmode "{\"h\":\"<html><body><pre>Theseus 0.0.1\nSetup    55d6d23d950952e5dae22474e1abd4420e8d4081a17ee7be21fbcffc2141189c\nPortable 9832d8cef5c1c1b8d7025cbdf4a70ef82e1e10255f83bc700da2014f9849330f\nAriadne Android 0.2\nAPK      635c8f04d44ef855a8390b9eeddb8cd2d50622e81cc4e5004e8daffc1bb0425c</pre></body></html>\"}"
+```
+
+- If `releases.silentmode` is not yet registered, register it first with
+  `node src/register.js releases.silentmode "{...}"`.
+- If the full HTML exceeds the OP_RETURN size your relay policy accepts, store a
+  compact record instead — e.g. `{"u":"https://dl.silentmode.st/releases-manifest.json"}`
+  — but the trustless ideal is the hashes themselves on-chain.
+- **Do this from `D:\Dev\SilentMode\Argus`, never `D:\Dev\NameCoin` (live).**
+
+## Step 3 — Optional per SECURITY.md §5 (multi-channel)
+
+- Create a torrent/magnet of each installer; add the magnet to the manifest +
+  download page.
+- Mirror to IPFS (`ipfs add`) and Sia; list all mirrors, all verified against
+  the on-chain hash.
+- Sign `releases-manifest.json` with your pseudonymous minisign key.
+
+## Build reproducibility note (for whoever rebuilds)
+
+`npm run dist` fetches electron-builder's `winCodeSign` package, whose macOS
+symlinks fail to extract on Windows without admin/Developer Mode. Since builds
+are **unsigned by choice** (SECURITY.md §2), pre-extract it once without the
+`darwin` folder, then the build runs clean:
+
+```bash
+CACHE="$LOCALAPPDATA/electron-builder/Cache/winCodeSign"
+node_modules/7zip-bin/win/x64/7za.exe x "$CACHE"/<downloaded>.7z -o"$CACHE/winCodeSign-2.6.0" -xr!darwin -y
+```
+
+Build with a fixed `SOURCE_DATE_EPOCH` (set to 2026-07-25 for this release) and
+`CSC_IDENTITY_AUTO_DISCOVERY=false` so timestamps don't fingerprint the build
+and no signing identity is sought.
--- a/chrome.html
+++ b/chrome.html
@ -0,0 +1,222 @@
+<!doctype html>
+<html>
+<head><meta charset="utf-8">
+<style>
+  :root { color-scheme: dark; font-family: system-ui, sans-serif; }
+  body { margin: 0; height: 100vh; background: #0f1420; color: #e7eaf1; user-select: none; overflow: hidden; }
+  /* tab strip */
+  .tabs { display: flex; align-items: flex-end; gap: 4px; padding: 6px 8px 0; height: 34px; }
+  .tab { display: flex; align-items: center; gap: 8px; max-width: 200px; min-width: 90px; padding: 6px 10px;
+         background: #1b2330; border: 1px solid #ffffff14; border-bottom: none; border-radius: 8px 8px 0 0;
+         font-size: 12.5px; cursor: default; color: #b9c2d0; }
+  .tab.active { background: #26304180; color: #fff; }
+  .tab .t { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; flex: 1; }
+  .tab .x { opacity: .5; cursor: pointer; padding: 0 2px; border-radius: 4px; }
+  .tab .x:hover { opacity: 1; background: #ffffff1a; }
+  .newtab { padding: 4px 10px; cursor: pointer; color: #8b98a9; border-radius: 6px; font-size: 16px; }
+  .newtab:hover { background: #ffffff12; color: #fff; }
+  /* toolbar */
+  .bar { display: flex; gap: 6px; align-items: center; padding: 6px 10px; }
+  .nav { display: flex; gap: 1px; }
+  /* Firefox-style round-rect icon buttons: 16px stroke glyph in a 34x32 hit target */
+  .ic { width: 34px; height: 32px; display: grid; place-items: center; border-radius: 8px; cursor: pointer;
+        color: #c5cdda; background: transparent; border: none; padding: 0; }
+  .ic svg { width: 16px; height: 16px; fill: none; stroke: currentColor; stroke-width: 1.7;
+            stroke-linecap: round; stroke-linejoin: round; }
+  .ic:hover { background: #ffffff14; color: #fff; }
+  .ic:active { background: #ffffff22; }
+  .ic:disabled { opacity: .28; cursor: default; background: transparent; }
+  /* clickable Theseus logo = site-info button */
+  .logo { display: flex; align-items: center; gap: 6px; font-weight: 700; color: #d6ff3d; white-space: nowrap;
+          padding: 5px 10px; margin: 0 2px; border: 1px solid transparent; border-radius: 8px; cursor: pointer;
+          background: transparent; font-size: 13px; }
+  .logo:hover { background: rgba(214,255,61,.10); border-color: #d6ff3d33; }
+  .logo.open { background: rgba(214,255,61,.14); border-color: #d6ff3d55; }
+  .logo .chev { color: #9fb04e; font-size: 9px; }
+  input { padding: 8px 13px; border-radius: 999px; border: 1px solid #ffffff22; background: #1b2330; color: inherit; font-size: 13.5px; outline: none; }
+  input:focus { border-color: #4b7bec; }
+  .urlwrap { flex: 1; display: flex; align-items: center; gap: 6px; background: #1b2330; border: 1px solid #ffffff22;
+             border-radius: 999px; padding-right: 8px; }
+  .urlwrap:focus-within { border-color: #4b7bec; }
+  #url { flex: 1; border: none; background: transparent; border-radius: 999px; }
+  #url:focus { border: none; }
+  #search { width: 180px; }
+  .tor { padding: 7px 10px; border-radius: 8px; border: 1px solid #ffffff22; background: #2b2f3a; color: #fff; cursor: pointer; white-space: nowrap; font-size: 12.5px; }
+  .tor.connecting { background: #7a5c14; } .tor.on { background: #6b3fa0; }
+  .sep { width: 1px; height: 22px; background: #ffffff1a; margin: 0 4px; }
+  .searchbox { display: flex; align-items: center; gap: 4px; }
+  .searchbox .mag { color: #8b98a9; font-size: 13px; }
+  /* registry/TLD badge — trusted chrome, painted by the browser not the page */
+  .reg { font-size: 10.5px; letter-spacing: .03em; padding: 2px 9px; border-radius: 999px;
+         background: rgba(214,255,61,.13); color: #d6ff3d; border: 1px solid #d6ff3d33; white-space: nowrap; }
+  /* site-info dropdown panel (opened by the logo) */
+  .siteinfo { font-size: 12px; color: #dbe3ef; background: #141b28; border-top: 1px solid #ffffff12;
+              padding: 10px 16px; display: grid; grid-template-columns: auto 1fr; gap: 5px 14px; }
+  .siteinfo .k { color: #7f8aa0; }
+  .siteinfo .v { color: #e7eaf1; }
+  .siteinfo .v code { font-family: ui-monospace, monospace; color: #bfeae4; }
+  .siteinfo .dotv { display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: #5e6678; margin-right: 6px; vertical-align: middle; }
+  .siteinfo .dotv.chain { background: #d6ff3d; } .siteinfo .dotv.sia { background: #b39ddb; }
+  .siteinfo .dotv.server { background: #4fd1a5; } .siteinfo .dotv.web { background: #8b93a7; } .siteinfo .dotv.err { background: #f6768a; }
+  .tordisc { font-size: 11.5px; color: #d9c7f2; background: #2a1c40; border-top: 1px solid #6b3fa055; padding: 5px 14px; }
+  .tordisc a { color: #d6ff3d; }
+  /* passive "also on BCNR" bar — dual-use TLD switch (never hijacks the web) */
+  .bcnrbar { display: flex; align-items: center; gap: 10px; font-size: 11.5px; color: #dbead0;
+             background: #1a2417; border-top: 1px solid #d6ff3d33; padding: 6px 14px; }
+  .bcnrbar .breg { font-size: 10px; letter-spacing: .03em; padding: 1px 7px; border-radius: 999px;
+                   background: rgba(214,255,61,.14); color: #d6ff3d; border: 1px solid #d6ff3d33; }
+  .bcnrbar b { color: #fff; }
+  .bcnrbar .bopen { margin-left: auto; padding: 4px 11px; border-radius: 7px; border: 1px solid #d6ff3d55;
+                    background: rgba(214,255,61,.12); color: #eaffb0; cursor: pointer; font-size: 11.5px; }
+  .bcnrbar .bopen:hover { background: rgba(214,255,61,.22); }
+  .bcnrbar .bdismiss { color: #8b98a9; text-decoration: none; }
+  .bcnrbar .bdismiss:hover { color: #fff; }
+</style></head>
+<body>
+  <div class="tabs" id="tabs"></div>
+  <div class="bar">
+    <div class="nav">
+      <button class="ic" id="back" title="Back">
+        <svg viewBox="0 0 16 16"><path d="M10 3 L5 8 L10 13"/></svg></button>
+      <button class="ic" id="fwd" title="Forward">
+        <svg viewBox="0 0 16 16"><path d="M6 3 L11 8 L6 13"/></svg></button>
+      <button class="ic" id="reload" title="Reload">
+        <svg viewBox="0 0 16 16"><path d="M13 8 a5 5 0 1 1 -1.5 -3.6"/><path d="M13 2.5 L13 5 L10.5 5"/></svg></button>
+      <button class="ic" id="home" title="Home">
+        <svg viewBox="0 0 16 16"><path d="M2.5 7.5 L8 3 L13.5 7.5"/><path d="M4 6.7 L4 13 L12 13 L12 6.7"/></svg></button>
+    </div>
+    <button class="logo" id="logo" title="Site information">
+      <span>⛓ Theseus</span><span class="chev">▼</span></button>
+    <div class="urlwrap">
+      <input id="url" placeholder="Search or enter a .bch / .p2p name or web address" spellcheck="false">
+      <span class="reg" id="reg" hidden></span>
+    </div>
+    <span class="sep"></span>
+    <div class="searchbox">
+      <span class="mag">🔍</span>
+      <input id="search" placeholder="Search the web" spellcheck="false">
+    </div>
+    <button class="tor" id="tor" title="Route traffic through Tor">🧅 Tor: Off</button>
+    <button class="ic" id="settings" title="Settings">
+      <svg viewBox="0 0 16 16"><circle cx="8" cy="8" r="2.2"/><path d="M8 1.5 L8 3 M8 13 L8 14.5 M1.5 8 L3 8 M13 8 L14.5 8 M3.3 3.3 L4.3 4.3 M11.7 11.7 L12.7 12.7 M12.7 3.3 L11.7 4.3 M4.3 11.7 L3.3 12.7"/></svg></button>
+  </div>
+  <div id="siteinfo" class="siteinfo" hidden></div>
+  <div id="tordisc" class="tordisc" hidden>
+    Onion mode hides your IP from sites and your ISP (including .bch lookups).
+    It is <b>not full anonymity</b> — this browser can still be fingerprinted; for that use the Tor Browser.
+    <a href="#" id="tordismiss">got it</a>
+  </div>
+  <div id="bcnrbar" class="bcnrbar" hidden>
+    <span class="breg" id="bcnrreg">BCNR</span>
+    <span><b id="bcnrhost"></b> also exists on the <b>BCNR</b> decentralized registry.</span>
+    <button id="bcnropen" class="bopen">Open on BCNR</button>
+    <a href="#" id="bcnrdismiss" class="bdismiss">dismiss</a>
+  </div>
+<script>
+  const $ = (id) => document.getElementById(id);
+  const T = window.theseus;
+  // Keep the chrome view tall enough for whatever bars are visible (site info / Tor / BCNR).
+  function syncHeight() { requestAnimationFrame(() => T.setChromeHeight(document.body.scrollHeight)); }
+  function goURL() { const v = $("url").value.trim(); if (v) T.navigate(v); }
+  $("url").addEventListener("keydown", (e) => { if (e.key === "Enter") goURL(); });
+  $("search").addEventListener("keydown", (e) => { if (e.key === "Enter") { const q = $("search").value.trim(); if (q) { T.search(q); $("search").value = ""; } } });
+  $("back").onclick = () => T.back();
+  $("fwd").onclick = () => T.forward();
+  $("reload").onclick = () => T.reload();
+  $("home").onclick = () => T.goHome();
+  $("settings").onclick = () => T.openSettings();
+
+  // ---- site-info panel (toggled by the Theseus logo) ----
+  let lastNav = null, infoOpen = false;
+  function renderInfo() {
+    const d = lastNav, box = $("siteinfo");
+    const row = (k, v) => `<span class="k">${k}</span><span class="v">${v}</span>`;
+    let html = "";
+    if (!d || d.kind === "home") {
+      html = row("Page", "Theseus home") +
+             row("About", "Theseus is a decentralized-web navigator. It resolves BCNR names (.bch, .p2p, .nav…) straight from the Bitcoin&nbsp;Cash chain — no ICANN, no DNS middleman.");
+    } else if (d.kind === "web") {
+      html = row("Site", `<span class="dotv web"></span><code>${(d.host||"").replace(/</g,"&lt;")}</code>`) +
+             row("Resolved via", "ICANN DNS (ordinary web)") +
+             row("Registry", "ICANN — not a BCNR name");
+    } else if (d.kind === "resolving") {
+      html = row("Site", `<code>${(d.host||"").replace(/</g,"&lt;")}</code>`) + row("Status", "resolving on the BCH chain…");
+    } else if (d.kind === "nxdomain") {
+      html = row("Name", `<span class="dotv err"></span><code>${(d.host||"").replace(/</g,"&lt;")}</code>`) +
+             row("Status", "not registered on the BCNR chain (NXDOMAIN)");
+    } else if (d.kind === "error") {
+      html = row("Status", `<span class="dotv err"></span>${(d.error||"resolution failed").replace(/</g,"&lt;")}`);
+    } else { // ok
+      const cls = (d.source||"").includes("chain") ? "chain" : (d.source||"").includes("Sia") ? "sia" : (d.source||"").includes("server") ? "server" : "web";
+      html = row("Site", `<span class="dotv ${cls}"></span><code>${(d.host||"").replace(/</g,"&lt;")}</code>`) +
+             row("Served from", d.source || "chain") +
+             row("Registry", (d.registry || "BCNR") + (d.tld ? " · ." + d.tld : "")) +
+             (d.records && d.records.length ? row("Records", `<code>${d.records.join(", ")}</code>`) : "") +
+             (d.category ? row("Certificate", `<code>${String(d.category).slice(0,24)}…</code>`) : "");
+    }
+    box.innerHTML = html;
+  }
+  function toggleInfo(force) {
+    infoOpen = force !== undefined ? force : !infoOpen;
+    $("siteinfo").hidden = !infoOpen;
+    $("logo").classList.toggle("open", infoOpen);
+    if (infoOpen) renderInfo();
+    syncHeight();
+  }
+  $("logo").onclick = () => toggleInfo();
+
+  let torShown = false;
+  $("tor").onclick = () => { T.toggleTor(); if (!torShown) { $("tordisc").hidden = false; torShown = true; syncHeight(); } };
+  $("tordismiss").onclick = (e) => { e.preventDefault(); $("tordisc").hidden = true; syncHeight(); };
+
+  // Passive "also on BCNR" bar for dual-use ICANN TLDs (.de/.dev/.ltd).
+  T.onBcnrOffer((d) => {
+    const bar = $("bcnrbar");
+    if (d && d.host) {
+      $("bcnrhost").textContent = d.host;
+      $("bcnrreg").textContent = d.registry || "BCNR";
+      bar.hidden = false;
+    } else { bar.hidden = true; }
+    syncHeight();
+  });
+  $("bcnropen").onclick = () => { $("bcnrbar").hidden = true; syncHeight(); T.switchToBcnr(); };
+  $("bcnrdismiss").onclick = (e) => { e.preventDefault(); $("bcnrbar").hidden = true; syncHeight(); };
+  T.onTor((d) => {
+    const b = $("tor"); b.className = "tor " + (d.state === "on" ? "on" : d.state === "connecting" ? "connecting" : "");
+    b.textContent = d.state === "on" ? "🧅 Tor: On" : d.state === "connecting" ? "🧅 connecting…" : "🧅 Tor: Off";
+  });
+
+  T.onTabs((d) => {
+    $("back").disabled = !d.canBack; $("fwd").disabled = !d.canForward;
+    if (document.activeElement !== $("url")) $("url").value = d.url || "";
+    const box = $("tabs");
+    box.innerHTML = d.tabs.map((t) =>
+      `<div class="tab ${t.active ? "active" : ""}" data-id="${t.id}">
+         <span class="t">${(t.title || "New Tab").replace(/</g, "&lt;")}</span>
+         <span class="x" data-close="${t.id}">✕</span></div>`).join("") +
+      `<span class="newtab" id="newtab">+</span>`;
+    box.querySelectorAll(".tab").forEach((el) => el.onclick = (e) => {
+      if (e.target.dataset.close) T.closeTab(Number(e.target.dataset.close));
+      else T.switchTab(Number(el.dataset.id));
+    });
+    $("newtab").onclick = () => T.newTab();
+  });
+
+  T.onNav((d) => {
+    lastNav = d;
+    // Registry/TLD badge: shown for any BNS name, painted here (trusted chrome).
+    const reg = $("reg");
+    if (d.tld) { reg.hidden = false; reg.textContent = (d.registry || "BCNR") + " · ." + d.tld; }
+    else reg.hidden = true;
+    // Keep the address bar in sync (unless the user is typing).
+    if (document.activeElement !== $("url")) {
+      if (d.kind === "home") $("url").value = "";
+      else if (d.host && !$("url").value) $("url").value = d.host;
+    }
+    if (infoOpen) renderInfo();
+  });
+
+  syncHeight();
+</script>
+</body>
+</html>
--- a/dev/README.md
+++ b/dev/README.md
@ -0,0 +1,44 @@
+# Theseus dev/test harness
+
+Two ways to drive Theseus's resolution + content path headlessly, for testing
+and debugging without clicking through the GUI. Both use the **real** resolver
+(`Argus/src/lib/resolver-web.js`) and gateway path the shipped app uses.
+
+## `selftest.js` — full render (Electron)
+
+Runs the actual `serveBns` protocol handler (imported from `main.js`) in a
+hidden offscreen Electron window, loads a `bns://` name, lets its JavaScript
+execute, then reports what really rendered and writes a screenshot.
+
+```bash
+npx electron dev/selftest.js hello.bch
+npx electron dev/selftest.js coinspectrum.deviant.bch     # JS-driven Sia site
+THESEUS_SETTLE=8000 npx electron dev/selftest.js <name>   # wait longer for data
+```
+
+Output: a JSON report (title, badge, stylesheet/script counts, local vs external
+broken-image counts, visible-text length, failed loads, `verdict`) plus
+`dev-out/render.png` and `dev-out/render.html`. Exit 0 = PASS. The verdict counts
+only the site's own `bns://` assets — external CDN images are informational.
+
+This is the faithful version of manual tests #2 (Sia-via-gateway rendering) and
+#3 (multi-TLD badge). `main.js` exports its handler and skips auto-launch when
+`THESEUS_NO_AUTOSTART=1`, which the harness sets.
+
+## `probe-site.mjs` — content path only (Node, no Electron)
+
+Fast check with no display or Electron: resolves a name, fetches the index
+through the gateway exactly as `serveBns` does (with the `<base>` strip), and
+fetches each **static** same-origin asset, reporting status/content-type.
+
+```bash
+node dev/probe-site.mjs coinspectrum.deviant.bch
+```
+
+Limitation: static-HTML only. It cannot see assets a page builds at runtime in
+JavaScript — use `selftest.js` for JS-driven sites.
+
+## `dev-out/`
+
+Generated render artifacts (screenshot + HTML dump). Safe to delete; regenerated
+on each `selftest.js` run.
--- a/dev/probe-site.mjs
+++ b/dev/probe-site.mjs
@ -0,0 +1,65 @@
+// Dev harness — exercise Theseus's `s3` content path (serveBns) WITHOUT Electron.
+// Faithfully replicates what the browser triggers for a Sia site: resolve the
+// name, fetch the index through the public gateway exactly as serveBns does,
+// strip the gateway's <base>, then fetch every referenced same-origin asset the
+// same way and report which load. This is the headless version of manual test
+// #2 (Sia-via-gateway rendering).
+//
+// Usage:  node dev/probe-site.mjs <name>        e.g. coinspectrum.deviant.bch
+import WebSocket from "ws";
+import { resolveName } from "../../Argus/src/lib/resolver-web.js";
+
+const GATEWAY = "https://navigate.st";                 // must match main.js
+const host = (process.argv[2] || "coinspectrum.deviant.bch").toLowerCase();
+
+// mirror of serveBns's s3 fetch for one request path
+async function gw(reqPath) {
+  const r = await fetch(`${GATEWAY}/bns/${host}${reqPath}`);
+  const ct = r.headers.get("content-type") || "";
+  const buf = Buffer.from(await r.arrayBuffer());
+  return { status: r.status, ct, buf };
+}
+const stripBase = (html) => html.replace(/<base\s+href="\/bns\/[^"]*">/i, "");
+
+// same-origin STATIC asset refs a browser would request from bns://host/.
+// Strip <script>/<style> bodies first so we don't match template literals or
+// URLs built at runtime (those need a real render to verify — see selftest.js).
+function assetPaths(html) {
+  const stripped = html
+    .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "")
+    .replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, "");
+  const out = new Set();
+  const re = /(?:href|src)\s*=\s*["']([^"']+)["']/gi;
+  let m;
+  while ((m = re.exec(stripped))) {
+    const u = m[1].trim();
+    if (!u || u.startsWith("#") || u.startsWith("data:") || u.startsWith("mailto:")) continue;
+    if (/^[a-z]+:\/\//i.test(u) || u.startsWith("//")) continue;   // external
+    if (u.includes("${") || u.includes("{{")) continue;            // runtime-built
+    out.add(u.startsWith("/") ? u : "/" + u.replace(/^\.?\//, ""));
+  }
+  return [...out];
+}
+
+console.log(`\n=== probe ${host} ===`);
+const entry = await resolveName(host, { WebSocket });
+if (!entry) { console.log("NXDOMAIN — not registered"); process.exit(1); }
+console.log("records:", JSON.stringify(entry.records));
+if (!entry.records.s3) { console.log("(not an s3 site — this harness targets s3)"); process.exit(0); }
+
+const idx = await gw("/");
+const wasBase = /<base\s+href="\/bns\//i.test(idx.buf.toString("utf8"));
+const html = stripBase(idx.buf.toString("utf8"));
+console.log(`index: HTTP ${idx.status}  ${idx.ct}  base-injected-by-gateway=${wasBase} (stripped)`);
+
+const assets = assetPaths(html);
+console.log(`\nassets referenced: ${assets.length}`);
+let fail = 0;
+for (const p of assets) {
+  const a = await gw(p);
+  const ok = a.status >= 200 && a.status < 300;
+  if (!ok) fail++;
+  console.log(`  ${ok ? "OK " : "FAIL"} ${String(a.status).padEnd(3)} ${a.ct.split(";")[0].padEnd(24)} ${p}`);
+}
+console.log(`\nresult: ${assets.length - fail}/${assets.length} assets loaded, ${fail} failed`);
+process.exit(fail ? 2 : 0);
--- a/dev/registry-decide.mjs
+++ b/dev/registry-decide.mjs
@ -0,0 +1,21 @@
+// Daemon decision logic (favor-BCNR, detect ICANN conflict), tested against the
+// real chain + real ICANN DNS. This is what bnsd.js would run per query.
+import WebSocket from "ws";
+import { resolveName } from "../../Argus/src/lib/resolver-web.js";
+import { Resolver } from "node:dns/promises";
+const icann = new Resolver(); icann.setServers(["1.1.1.1"]); // bypass local NRPT
+async function decide(name) {
+  const [bcnr, ip] = await Promise.all([
+    resolveName(name, { WebSocket }).catch(() => null),
+    icann.resolve4(name).then(a => a[0]).catch(() => null),
+  ]);
+  let d;
+  if (bcnr && ip) d = "CONFLICT  → ask user (BCNR vs ICANN)";
+  else if (bcnr)  d = "serve BCNR  (favored; no ICANN entry)";
+  else if (ip)    d = `forward ICANN (${ip})`;
+  else            d = "NXDOMAIN  (neither root has it)";
+  console.log(`${name.padEnd(16)} BCNR=${bcnr ? "yes[" + Object.keys(bcnr.records) + "]" : "no ".padEnd(3)}  ICANN=${(ip||"no").padEnd(15)} -> ${d}`);
+}
+const names = process.argv.slice(2).length ? process.argv.slice(2) : ["syskypo.de","google.de","go.dev","nothing-xyz.de"];
+for (const n of names) await decide(n);
+process.exit(0);
--- a/dev/rescheck.mjs
+++ b/dev/rescheck.mjs
@ -0,0 +1,9 @@
+import WebSocket from "ws";
+import { resolveName, CHIPNET_ELECTRUM } from "../../Argus/src/lib/resolver-web.js";
+console.log("electrum pool:", CHIPNET_ELECTRUM.map((s) => (typeof s === "string" ? s : s.url)).join(", "));
+for (const n of ["hello.bch","coinspectrum.bch","siatest.bch"]) {
+  const t=Date.now();
+  try { const e=await resolveName(n,{WebSocket}); console.log(`  ${n}: ${e?("OK ["+Object.keys(e.records)+"] "+(Date.now()-t)+"ms"):"NXDOMAIN"}`); }
+  catch(err){ console.log(`  ${n}: ERROR ${err.message} (${Date.now()-t}ms)`); }
+}
+process.exit(0);
--- a/dev/selftest.js
+++ b/dev/selftest.js
@ -0,0 +1,82 @@
+// Electron render harness — loads a bns:// name through the REAL serveBns handler
+// (imported from main.js), lets its JS execute, then reports what actually
+// rendered: title, image load status, stylesheet/script counts, visible text
+// length, and any failed resource loads. Also writes render.html + render.png.
+// This is the full-fidelity version of manual test #2/#3 — it runs the same
+// resolver + gateway path the shipped app uses.
+//
+// Usage:  npx electron dev/selftest.js <name>     e.g. hello.bch / coinspectrum.deviant.bch
+process.env.THESEUS_NO_AUTOSTART = "1";
+const { app, BrowserWindow, protocol } = require("electron");
+const { serveBns, nativeTld, registryOf } = require("../main.js");
+const fs = require("fs");
+const path = require("path");
+
+app.disableHardwareAcceleration();
+app.commandLine.appendSwitch("disable-gpu");
+app.commandLine.appendSwitch("no-sandbox");
+
+const name = (process.argv[2] || "coinspectrum.deviant.bch").toLowerCase();
+const settleMs = Number(process.env.THESEUS_SETTLE || 5000);
+const outDir = path.join(__dirname, "..", "dev-out");
+
+// hard watchdog so the harness can never hang a CI/agent run
+const watchdog = setTimeout(() => { console.log("WATCHDOG: timed out"); try { app.exit(3); } catch {} }, 45000);
+
+app.whenReady().then(async () => {
+  protocol.handle("bns", serveBns);
+  const win = new BrowserWindow({ width: 1200, height: 900, show: false, webPreferences: { offscreen: true } });
+  const wc = win.webContents;
+  const failed = [];
+  wc.on("did-fail-load", (_e, code, desc, url, isMainFrame) => { if (code !== -3) failed.push({ code, desc, url, isMainFrame }); });
+
+  const tld = nativeTld(name);
+  const report = { name, url: `bns://${name}/`, badge: tld ? `${registryOf(tld)} · .${tld}` : null };
+  try {
+    await wc.loadURL(`bns://${name}/`);
+  } catch (e) { report.loadError = e.message; }
+
+  await new Promise((r) => setTimeout(r, settleMs)); // let JS build the DOM + fetch data
+
+  try {
+    Object.assign(report, await wc.executeJavaScript(`(() => {
+      const imgs = [...document.images].map(i => {
+        const src = i.currentSrc || i.src || '';
+        return { src: src.slice(0, 90), ok: i.complete && i.naturalWidth > 0, local: src.startsWith('bns:') };
+      });
+      const brokenLocal = imgs.filter(i => !i.ok && i.local);
+      return {
+        title: document.title,
+        stylesheets: document.styleSheets.length,
+        scripts: document.scripts.length,
+        imgTotal: imgs.length,
+        imgBrokenLocal: brokenLocal.length,      // served by us (bns://) — a real failure
+        imgBrokenExternal: imgs.filter(i => !i.ok && !i.local).length, // 3rd-party CDN — informational
+        brokenLocalImgs: brokenLocal.map(i => i.src),
+        textLen: (document.body ? document.body.innerText : '').trim().length,
+        h1: (document.querySelector('h1,h2') || {}).innerText || null,
+      };
+    })()`));
+  } catch (e) { report.evalError = e.message; }
+
+  report.failedLoads = failed;
+
+  fs.mkdirSync(outDir, { recursive: true });
+  try {
+    const html = await wc.executeJavaScript("document.documentElement.outerHTML");
+    fs.writeFileSync(path.join(outDir, "render.html"), html);
+  } catch {}
+  try {
+    const img = await wc.capturePage();
+    const png = img.toPNG();
+    if (png && png.length > 0) { fs.writeFileSync(path.join(outDir, "render.png"), png); report.screenshot = `dev-out/render.png (${png.length} bytes)`; }
+    else report.screenshot = "empty (offscreen not compositing)";
+  } catch (e) { report.screenshot = "error: " + e.message; }
+
+  console.log("\n===== SELFTEST REPORT =====");
+  console.log(JSON.stringify(report, null, 2));
+  // Verdict ignores external CDN images — only our own (bns://) assets + page loads count.
+  report.verdict = (!report.loadError && !report.imgBrokenLocal && report.textLen > 0) ? "PASS" : "FAIL";
+  clearTimeout(watchdog);
+  app.exit(report.verdict === "PASS" ? 0 : 2);
+});
--- a/dev/test-directip.mjs
+++ b/dev/test-directip.mjs
@ -0,0 +1,32 @@
+// Prove the DNS-independent path: a WS wrapper that FAILS for any hostname URL,
+// so a successful .bch resolution can only have come from the pinned IP + SNI.
+import WebSocket from "ws";
+import { resolveName } from "../../Argus/src/lib/resolver-web.js";
+
+const isIpUrl = (u) => /\/\/\d{1,3}(\.\d{1,3}){3}:/.test(u);
+
+class DnsDeadWS extends WebSocket {
+  constructor(url, opts) {
+    if (isIpUrl(url)) {
+      console.log("  → connecting by IP:", url, "SNI:", opts?.servername);
+      super(url, opts);
+    } else {
+      console.log("  ✗ hostname blocked (simulated dead DNS):", url);
+      super("wss://127.0.0.1:1"); // unreachable → error → triggers IP fallback
+    }
+  }
+}
+
+console.log("resolving hello.bch with system DNS 'dead' (hostnames blocked)…");
+try {
+  const entry = await resolveName("hello.bch", { WebSocket: DnsDeadWS, directIP: true });
+  if (entry) {
+    console.log("\n✅ RESOLVED via pinned IP — DNS-independent path works.");
+    console.log("   records:", Object.keys(entry.records).join(", "));
+  } else {
+    console.log("\n⚠️  connected but hello.bch not found (name may be unregistered) — IP path still worked.");
+  }
+} catch (e) {
+  console.log("\n❌ FAILED:", e.message);
+}
+process.exit(0);
--- a/home.html
+++ b/home.html
@ -0,0 +1,59 @@
+<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>Theseus</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  body { margin: 0; min-height: 100vh; font-family: system-ui, sans-serif;
+         background: radial-gradient(1000px 500px at 50% -10%, #16202e, #0b0e14);
+         color: #e7eaf1; display: flex; flex-direction: column; align-items: center; }
+  .hero { text-align: center; margin-top: 14vh; padding: 0 1rem; }
+  .mark { font-size: 64px; line-height: 1; }
+  h1 { font-size: 2.4rem; margin: .4rem 0 .2rem; letter-spacing: .5px; }
+  h1 .g { color: #d6ff3d; }
+  .tag { color: #8b98a9; margin: 0 0 1.6rem; }
+  form { display: flex; gap: 8px; justify-content: center; max-width: 560px; margin: 0 auto; }
+  input { flex: 1; padding: 13px 18px; border-radius: 999px; border: 1px solid #ffffff22;
+          background: #141a24; color: #e7eaf1; font-size: 15px; outline: none; }
+  input:focus { border-color: #4b7bec; }
+  button { padding: 13px 20px; border-radius: 999px; border: none; background: #4b7bec; color: #fff; font-size: 15px; cursor: pointer; }
+  .hint { color: #5e6678; font-size: 12.5px; margin-top: .8rem; }
+  .grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px;
+          max-width: 720px; width: 100%; margin: 3rem auto 4rem; padding: 0 1.2rem; }
+  .card { display: block; text-decoration: none; color: inherit; background: #141a24; border: 1px solid #ffffff12;
+          border-radius: 12px; padding: 14px 16px; transition: .15s; }
+  .card:hover { border-color: #4b7bec66; background: #18202c; transform: translateY(-1px); }
+  .card .n { font-weight: 600; color: #e7eaf1; }
+  .card .d { color: #8b98a9; font-size: 12.5px; margin-top: 3px; }
+  .badge { display: inline-block; font-size: 10.5px; padding: 1px 7px; border-radius: 999px; margin-top: 8px; }
+  .b-chain { background: #d6ff3d22; color: #d6ff3d; } .b-sia { background: #b39ddb22; color: #b39ddb; }
+  .b-srv { background: #4fd1a522; color: #4fd1a5; }
+  footer { color: #47505f; font-size: 12px; padding-bottom: 2rem; text-align: center; }
+  footer b { color: #6b7688; }
+</style></head>
+<body>
+  <div class="hero">
+    <div class="mark">⛓️</div>
+    <h1>Theseus <span class="g">Navigator</span></h1>
+    <p class="tag">A browser that follows the thread. Names that live on the Bitcoin Cash chain.</p>
+    <form action="https://duckduckgo.com/" method="GET">
+      <input name="q" placeholder="Search the web (DuckDuckGo)" autofocus spellcheck="false">
+      <button type="submit">Search</button>
+    </form>
+    <p class="hint">Tip: type a <b>.bch</b> name in the address bar above to open a decentralized site.</p>
+  </div>
+
+  <div class="grid">
+    <a class="card" href="https://hello.bch/"><div class="n">hello.bch</div><div class="d">The page hosted on the blockchain itself.</div><span class="badge b-chain">on-chain</span></a>
+    <a class="card" href="https://theseus.bch/"><div class="n">theseus.bch</div><div class="d">This browser's own name, on-chain.</div><span class="badge b-chain">on-chain</span></a>
+    <a class="card" href="https://silentmode.bch/"><div class="n">silentmode.bch</div><div class="d">The division building this stack.</div><span class="badge b-chain">on-chain</span></a>
+    <a class="card" href="https://argo.bch/"><div class="n">argo.bch</div><div class="d">The host network, crewed by Argonauts.</div><span class="badge b-chain">on-chain</span></a>
+    <a class="card" href="https://coinspectrum.deviant.bch/"><div class="n">coinspectrum.deviant.bch</div><div class="d">A full site served from the Sia network.</div><span class="badge b-sia">Sia</span></a>
+    <a class="card" href="https://coinspectrum.bch/"><div class="n">coinspectrum.bch</div><div class="d">The same site, from a direct server.</div><span class="badge b-srv">server</span></a>
+    <a class="card" href="https://faucet.deviant.bch/"><div class="n">faucet.deviant.bch</div><div class="d">A testnet faucet hub, on Sia.</div><span class="badge b-sia">Sia</span></a>
+    <a class="card" href="https://siatest.bch/"><div class="n">siatest.bch</div><div class="d">A page with no server at all.</div><span class="badge b-sia">Sia</span></a>
+  </div>
+
+  <footer>Names resolved from the <b>Bitcoin Cash</b> blockchain — no registrar, no DNS.<br>Theseus, by Silent Mode — a Deviant project.</footer>
+</body>
+</html>
--- a/main.js
+++ b/main.js
@ -0,0 +1,586 @@
+// Theseus Navigator — Electron main process.
+// Native .bch via a custom `bns://` protocol: resolves names with the shared
+// portable resolver (Argus/resolver-web.js) and serves content itself (on-chain
+// h, Sia s3, direct ip, redirect u). Tabs, nav controls, a search box, a home
+// page, and optional Tor onion routing. No system daemon; the app is the trust
+// boundary.
+const { app, BrowserWindow, WebContentsView, ipcMain, protocol, session, Menu, clipboard } = require("electron");
+const path = require("path");
+const http = require("http");
+const https = require("https");
+const { spawn } = require("child_process");
+const fs = require("fs");
+const WebSocket = require("ws");
+
+// Packaged builds ship the resolver and tor/ as unpacked resources (they can't
+// run from inside app.asar); dev runs read them from the repo.
+const RES_DIR = app.isPackaged ? process.resourcesPath : __dirname;
+// Bundled as .mjs so it loads as ES module in the packaged app (no package.json
+// sits next to it in resources/, so a bare .js would be treated as CommonJS and
+// fail on `export`). Dev reads the engine copy directly (Argus is type:module).
+const RESOLVER = app.isPackaged
+  ? path.join(RES_DIR, "resolver-web.mjs")
+  : path.join(__dirname, "..", "Argus", "src", "lib", "resolver-web.js");
+const SEARCH = (q) => "https://duckduckgo.com/?q=" + encodeURIComponent(q);
+// Public content relay (secret-free): serves s3/ip/h/u without shipping keys.
+const GATEWAY = "https://navigate.st";
+
+// ---- BNS name detection (multi-TLD) --------------------------------------
+// The engine (resolver-web.js) resolves any <label>.<tld> from the BCNR beacon.
+// Two client-side sets decide how Theseus treats a name:
+//   NATIVE  — not in the ICANN root, so we own them outright (go straight to BCNR).
+//   DUAL    — real ICANN TLDs we ALSO offer on BCNR. These never hijack the real
+//             web: the ICANN site loads normally, and if a BCNR name also exists
+//             we surface a passive "also on BCNR" switch (see navigateTab).
+const BNS_NATIVE_TLDS = new Set(["bch", "p2p", "bit", "nav"]);
+const BNS_DUAL_TLDS = new Set(["de", "dev", "ltd"]);
+const REGISTRY = "BCNR"; // user-facing registry label (Bitcoin Cash Name Registry)
+const tldOf = (host) => {
+  const h = String(host).toLowerCase().replace(/\.$/, "");
+  const dot = h.lastIndexOf(".");
+  return dot < 0 ? null : h.slice(dot + 1);
+};
+const nativeTld = (host) => { const t = tldOf(host); return t && BNS_NATIVE_TLDS.has(t) ? t : null; };
+const dualTld = (host) => { const t = tldOf(host); return t && BNS_DUAL_TLDS.has(t) ? t : null; };
+// Kept for will-navigate: only native BNS hosts are intercepted as BCNR up front.
+const isBnsHost = (host) => nativeTld(host) !== null;
+const registryOf = (_tld) => REGISTRY;
+
+// Address-bar heuristic: is this input a URL/hostname, or a search query? Mirrors
+// what mainstream browsers do — anything with whitespace, or a bare word with no
+// dot, is a search; a scheme, an IP, localhost, or a dotted host is a URL.
+function looksLikeUrl(q) {
+  if (!q) return false;
+  if (/\s/.test(q)) return false;                          // has whitespace -> search
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(q)) return true;     // scheme://…
+  if (/^localhost(:\d+)?([/?#]|$)/i.test(q)) return true;  // localhost[:port]
+  if (/^\d{1,3}(\.\d{1,3}){3}(:\d+)?([/?#]|$)/.test(q)) return true; // IPv4[:port]
+  const host = q.split(/[/?#]/)[0];                        // strip path/query/frag
+  return host.includes(".") && !host.startsWith(".") && !host.endsWith("."); // dotted host
+}
+
+// ---- persistent user settings (userData/settings.json) ----
+const SETTINGS_DEFAULTS = {
+  webrtcProtect: true,       // reduce WebRTC IP leaks even without Tor (Tor strengthens it)
+  blockCamera: true,         // deny camera by default (also hides camera labels from fingerprinting)
+  blockMicrophone: true,     // deny microphone by default (also hides mic labels)
+  blockLocation: true,       // deny geolocation by default
+  restoreSession: true,      // reopen last session's tabs on launch
+  backgroundThrottle: true,  // throttle inactive tabs / the window when unfocused
+  timezoneMode: "show",      // show (real) | hide (UTC) | change (timezoneValue)
+  timezoneValue: "UTC",      // IANA zone used when timezoneMode === "change"
+  languageMode: "show",      // show (real) | hide (en-US) | change (languageValue)
+  languageValue: "en-US",    // locale used when languageMode === "change"
+};
+let settings = { ...SETTINGS_DEFAULTS };
+const settingsFile = () => path.join(app.getPath("userData"), "settings.json");
+function loadSettings() {
+  try { if (fs.existsSync(settingsFile())) settings = { ...SETTINGS_DEFAULTS, ...JSON.parse(fs.readFileSync(settingsFile(), "utf8")) }; }
+  catch (e) { console.error("settings load failed:", e.message); }
+}
+function saveSettings() {
+  try { fs.writeFileSync(settingsFile(), JSON.stringify(settings, null, 2)); } catch (e) { console.error("settings save failed:", e.message); }
+}
+// WebRTC IP-handling policy: protect by default (independent of Tor), strongest under Tor.
+function webrtcPolicy() {
+  if (!settings.webrtcProtect) return "default";
+  return torState === "on" ? "disable_non_proxied_udp" : "default_public_interface_only";
+}
+// ---- anti-fingerprinting: timezone + language (Show / Hide / Change) ----
+// Effective override, or null = "show" (report the real value).
+function effTimezone() {
+  if (settings.timezoneMode === "hide") return "UTC";
+  if (settings.timezoneMode === "change") return settings.timezoneValue || "UTC";
+  return null;
+}
+function effLocale() {
+  if (settings.languageMode === "hide") return "en-US";
+  if (settings.languageMode === "change") return settings.languageValue || "en-US";
+  return null;
+}
+// Applied per tab via CDP — the engine-level override the Tor/Mullvad browsers do:
+// timezone -> Intl/Date; locale -> Intl + navigator.language(s).
+async function applyFingerprint(wc) {
+  try {
+    if (!wc.debugger.isAttached()) wc.debugger.attach("1.3");
+    const tz = effTimezone();
+    await wc.debugger.sendCommand("Emulation.setTimezoneOverride", { timezoneId: tz || "" });
+    const loc = effLocale();
+    await wc.debugger.sendCommand("Emulation.setLocaleOverride", loc ? { locale: loc } : {});
+    // setLocaleOverride covers Intl but NOT navigator.language(s) — inject a getter.
+    await wc.debugger.sendCommand("Page.enable");
+    if (wc._langScript) {
+      try { await wc.debugger.sendCommand("Page.removeScriptToEvaluateOnNewDocument", { identifier: wc._langScript }); } catch {}
+      wc._langScript = null;
+    }
+    if (loc) {
+      const langs = JSON.stringify([loc, loc.split("-")[0]]);
+      const src = `Object.defineProperty(navigator,'language',{get:()=>${JSON.stringify(loc)},configurable:true});` +
+                  `Object.defineProperty(navigator,'languages',{get:()=>${langs},configurable:true});`;
+      const res = await wc.debugger.sendCommand("Page.addScriptToEvaluateOnNewDocument", { source: src });
+      wc._langScript = res.identifier;
+      try { await wc.executeJavaScript(src); } catch {} // apply to the current page too
+    }
+  } catch { /* debugger busy (e.g. devtools) — best effort */ }
+}
+function applyFingerprintAll() { for (const t of tabs) applyFingerprint(t.view.webContents); }
+// Accept-Language header follows the locale setting (session-wide, best effort).
+function applyAcceptLanguage() {
+  const loc = effLocale() || app.getLocale() || "en-US";
+  try {
+    const ua = session.defaultSession.getUserAgent();
+    session.defaultSession.setUserAgent(ua, `${loc},${loc.split("-")[0]};q=0.8`);
+  } catch {}
+}
+// ---- session restore + background throttling ----
+const sessionFile = () => path.join(app.getPath("userData"), "session.json");
+function saveSession() {
+  try { fs.writeFileSync(sessionFile(), JSON.stringify(tabs.filter((t) => !t.settings && t.url).map((t) => t.url))); }
+  catch (e) { console.error("session save failed:", e.message); }
+}
+function loadSession() {
+  try { if (fs.existsSync(sessionFile())) return JSON.parse(fs.readFileSync(sessionFile(), "utf8")); } catch {}
+  return [];
+}
+function applyThrottle() {
+  for (const t of tabs) { try { t.view.webContents.setBackgroundThrottling(settings.backgroundThrottle); } catch {} }
+}
+// Privacy-first permissions: Electron auto-grants everything by default. Deny the
+// sensitive ones (camera/mic/geolocation/device access) — this also hides real
+// media-device labels/ids from enumerateDevices. Handlers read settings live.
+// Device permissions with no legitimate need here — always denied.
+const SENSITIVE_DEVICE = new Set(["hid", "serial", "usb", "bluetooth", "midi", "midiSysex"]);
+// A "media" request may ask for audio, video, or both — allow only if none blocked.
+function mediaAllowed(kinds) {
+  if (kinds.includes("video") && settings.blockCamera) return false;
+  if (kinds.includes("audio") && settings.blockMicrophone) return false;
+  return true;
+}
+function applyPermissions() {
+  const ses = session.defaultSession;
+  ses.setPermissionRequestHandler((_wc, permission, callback, details) => {
+    if (permission === "media") return callback(mediaAllowed(details?.mediaTypes || []));
+    if (permission === "geolocation") return callback(!settings.blockLocation);
+    if (SENSITIVE_DEVICE.has(permission)) return callback(false);
+    callback(true); // benign UX permissions (fullscreen, pointerLock, …)
+  });
+  ses.setPermissionCheckHandler((_wc, permission, _origin, details) => {
+    if (permission === "media") {
+      if (details?.mediaType === "video") return !settings.blockCamera;
+      if (details?.mediaType === "audio") return !settings.blockMicrophone;
+      return !(settings.blockCamera && settings.blockMicrophone);
+    }
+    if (permission === "geolocation") return !settings.blockLocation;
+    if (SENSITIVE_DEVICE.has(permission)) return false;
+    return true;
+  });
+}
+
+protocol.registerSchemesAsPrivileged([
+  { scheme: "bns", privileges: { standard: true, secure: true, supportFetchAPI: true, stream: true } },
+]);
+
+let resolver;
+async function getResolver() {
+  if (!resolver) resolver = await import(`file://${RESOLVER.replace(/\\/g, "/")}`);
+  return resolver;
+}
+
+// ---- Tor (optional onion routing, toggled from the UI) ----
+// IP privacy, not full anonymity: this browser can still be fingerprinted.
+const TOR_PORT = 9152;
+const TOR_BIN = path.join(RES_DIR, "tor", "tor", "tor.exe");
+const TOR_GEOIP = path.join(RES_DIR, "tor", "data", "geoip");
+const TOR_GEOIP6 = path.join(RES_DIR, "tor", "data", "geoip6");
+let torProc = null, torState = "off";
+let torWsAgent = null;
+let SocksProxyAgent;
+async function loadSocks() { if (!SocksProxyAgent) ({ SocksProxyAgent } = await import("socks-proxy-agent")); }
+function sendTor() { try { chrome?.webContents.send("tor", { state: torState }); } catch {} }
+async function startTor() {
+  if (torProc) return;
+  torState = "connecting"; sendTor();
+  await loadSocks();
+  const dataDir = path.join(app.getPath("userData"), "tor-data");
+  torProc = spawn(TOR_BIN, ["--SocksPort", String(TOR_PORT), "--ControlPort", "0",
+    "--DataDirectory", dataDir, "--GeoIPFile", TOR_GEOIP, "--GeoIPv6File", TOR_GEOIP6], { windowsHide: true });
+  torProc.stdout.on("data", (d) => { if (/Bootstrapped 100%/.test(d.toString())) torReady(); });
+  torProc.stderr.on("data", () => {});
+  torProc.on("exit", () => { torProc = null; if (torState !== "off") torOff(); });
+}
+function torReady() {
+  torState = "on";
+  torWsAgent = new SocksProxyAgent(`socks5h://127.0.0.1:${TOR_PORT}`);
+  session.defaultSession.setProxy({ proxyRules: `socks5://127.0.0.1:${TOR_PORT}` });
+  applyWebRTCPolicy();
+  sendTor();
+}
+function torOff() {
+  torState = "off"; torWsAgent = null;
+  session.defaultSession.setProxy({ proxyRules: "" });
+  applyWebRTCPolicy();
+  sendTor();
+}
+function stopTor() { torOff(); if (torProc) { try { torProc.kill(); } catch {} torProc = null; } }
+// While Tor is on, stop WebRTC from leaking the real IP around the SOCKS proxy
+// (STUN/UDP bypasses an HTTP/SOCKS proxy — plain Electron doesn't block it the
+// way the Tor Browser does). This is the usual reason a site still sees your IP.
+function applyWebRTCPolicy() {
+  const policy = webrtcPolicy();
+  for (const t of tabs) { try { t.view.webContents.setWebRTCIPHandlingPolicy(policy); } catch {} }
+}
+class TorWebSocket extends WebSocket { constructor(url, opts) { super(url, { agent: torWsAgent, ...opts }); } }
+const currentWS = () => (torState === "on" ? TorWebSocket : WebSocket);
+
+function nodeRequest(urlStr, { method = "GET", headers = {}, agent } = {}) {
+  return new Promise((resolve, reject) => {
+    const u = new URL(urlStr);
+    const lib = u.protocol === "https:" ? https : http;
+    const req = lib.request(u, { method, headers, agent }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => resolve({ status: res.statusCode, contentType: res.headers["content-type"], buffer: Buffer.concat(chunks) }));
+    });
+    req.on("error", reject); req.end();
+  });
+}
+async function contentFetch(url, init = {}) {
+  if (torState === "on") { await loadSocks(); return nodeRequest(url, { ...init, agent: new SocksProxyAgent(`socks5h://127.0.0.1:${TOR_PORT}`) }); }
+  const r = await fetch(url, init);
+  return { status: r.status, contentType: r.headers.get("content-type"), buffer: Buffer.from(await r.arrayBuffer()) };
+}
+
+// ---- electrum server pool: hardcoded seed + on-chain discovery, persisted ----
+// Bootstrap from the baked-in seed (with pinned IPs), then refresh from the
+// on-chain ELECTRUM_LIST_NAME record so the pool can be rotated without a new
+// build. The last discovered list is cached to disk and tried first next launch.
+let electrumPool = null;
+let lastElectrumRefresh = 0;
+const electrumFile = () => path.join(app.getPath("userData"), "electrum-servers.json");
+const serverKey = (s) => (typeof s === "string" ? s : s && s.url);
+function mergeServers(preferred, rest) {
+  const seen = new Set(), out = [];
+  for (const s of [...(preferred || []), ...(rest || [])]) {
+    const k = serverKey(s);
+    if (k && !seen.has(k)) { seen.add(k); out.push(s); }
+  }
+  return out;
+}
+async function initElectrumPool() {
+  const { CHIPNET_ELECTRUM } = await getResolver();
+  let saved = [];
+  try { if (fs.existsSync(electrumFile())) saved = JSON.parse(fs.readFileSync(electrumFile(), "utf8")); } catch {}
+  electrumPool = mergeServers(saved, CHIPNET_ELECTRUM); // discovered first, seed always kept
+}
+async function refreshElectrumPool() {
+  try {
+    const { fetchElectrumServers } = await getResolver();
+    const found = await fetchElectrumServers({ WebSocket: currentWS(), directIP: true, electrum: electrumPool });
+    if (found && found.length) {
+      electrumPool = mergeServers(found, electrumPool);
+      try { fs.writeFileSync(electrumFile(), JSON.stringify(found, null, 2)); } catch {}
+    }
+  } catch { /* list unpublished or unreachable — keep the current pool */ }
+}
+function maybeRefreshElectrum() {
+  if (Date.now() - lastElectrumRefresh < 30 * 60 * 1000) return;
+  lastElectrumRefresh = Date.now();
+  refreshElectrumPool(); // fire-and-forget
+}
+
+const entries = new Map();
+async function resolveHost(host) {
+  const { resolveName } = await getResolver();
+  if (!electrumPool) await initElectrumPool();
+  // Pass the full host; the engine normalizes any <sub>.<label>.<tld> itself.
+  // directIP: dial pinned electrum IPs when system DNS is dead (desktop lifeboat).
+  const entry = await resolveName(host, { WebSocket: currentWS(), directIP: true, electrum: electrumPool });
+  if (entry) entries.set(host.toLowerCase(), { entry, host: host.toLowerCase() });
+  maybeRefreshElectrum();
+  return entry;
+}
+const MIME = { html: "text/html; charset=utf-8", htm: "text/html; charset=utf-8", css: "text/css", js: "text/javascript",
+  json: "application/json", png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", svg: "image/svg+xml",
+  ico: "image/x-icon", webp: "image/webp", woff2: "font/woff2", woff: "font/woff", txt: "text/plain", wasm: "application/wasm" };
+const guessType = (p) => MIME[p.split(".").pop()?.toLowerCase()] || "application/octet-stream";
+
+async function serveBns(request) {
+  const url = new URL(request.url);
+  const host = url.hostname.toLowerCase();
+  const reqPath = decodeURIComponent(url.pathname) || "/";
+  let rec = entries.get(host);
+  if (!rec) { try { await resolveHost(host); } catch {} rec = entries.get(host); }
+  if (!rec) return new Response("NXDOMAIN: " + host, { status: 404, headers: { "content-type": "text/plain" } });
+  const r = rec.entry.records;
+  try {
+    if (r.h) { if (reqPath === "/") return new Response(r.h, { headers: { "content-type": "text/html; charset=utf-8" } }); return new Response("not found", { status: 404 }); }
+    if (r.s3) {
+      // Secret-free: fetch Sia content from the public gateway (it holds the
+      // keys and owns the subfolder mapping) instead of signing S3 requests
+      // with credentials that must never ship in a public build.
+      const up = await contentFetch(`${GATEWAY}/bns/${host}${reqPath}${url.search}`, {});
+      const ct = up.contentType && up.contentType !== "application/octet-stream"
+        ? up.contentType : guessType(reqPath === "/" ? "index.html" : reqPath);
+      let body = up.buffer;
+      if (ct.includes("text/html")) {
+        // Strip the gateway's path-form <base href="/bns/<name>/"> so assets
+        // resolve against the bns:// origin, not back through the relay.
+        body = Buffer.from(body.toString("utf8").replace(/<base\s+href="\/bns\/[^"]*">/i, ""), "utf8");
+      }
+      return new Response(body, { status: up.status, headers: { "content-type": ct } });
+    }
+    if (r.ip) {
+      const up = await contentFetch(`http://${r.ip}${reqPath}${url.search}`, { headers: { host } });
+      return new Response(up.buffer, { status: up.status, headers: { "content-type": up.contentType || guessType(reqPath) } });
+    }
+    if (r.u) return Response.redirect(r.u, 302);
+    return new Response(JSON.stringify(rec.entry, null, 2), { headers: { "content-type": "application/json" } });
+  } catch (e) { return new Response("Theseus error: " + e.message, { status: 502 }); }
+}
+
+// ---- window + tabs ----
+let win, chrome, statusbar;
+let CHROME_H = 84;    // grows when an extra bar (Tor notice / BCNR offer / site info) is shown
+const STATUS_H = 24;  // fixed bottom resolver/provenance line
+const tabs = [];       // { id, view, title, url, prov }
+let activeId = null, tabSeq = 0;
+const tabById = (id) => tabs.find((t) => t.id === id);
+const activeTab = () => tabById(activeId);
+
+// Provenance goes to BOTH the top chrome (registry badge + site-info panel) and
+// the bottom status line, so the resolver detail lives on the bottom bar.
+function pushNav(prov) {
+  chrome?.webContents.send("nav", prov);
+  statusbar?.webContents.send("nav", prov);
+}
+
+function layout() {
+  if (!win) return;
+  const { width, height } = win.getContentBounds();
+  chrome.setBounds({ x: 0, y: 0, width, height: CHROME_H });
+  const bodyH = Math.max(0, height - CHROME_H - STATUS_H);
+  for (const t of tabs) t.view.setBounds({ x: 0, y: CHROME_H, width, height: bodyH });
+  statusbar?.setBounds({ x: 0, y: height - STATUS_H, width, height: STATUS_H });
+}
+function setActive(id) {
+  activeId = id;
+  for (const t of tabs) t.view.setVisible(t.id === id);
+  const t = activeTab();
+  if (t?.prov) pushNav(t.prov);
+  chrome.webContents.send("bcnr-offer", t?.bcnrOffer ? { host: t.bcnrOffer.host, tld: t.bcnrOffer.tld, registry: REGISTRY } : null);
+  emitTabs();
+}
+function emitTabs() {
+  const t = activeTab();
+  const wc = t?.view.webContents;
+  chrome?.webContents.send("tabs", {
+    tabs: tabs.map((x) => ({ id: x.id, title: x.title || "New Tab", active: x.id === activeId })),
+    url: t?.url || "",
+    canBack: wc ? wc.navigationHistory.canGoBack() : false,
+    canForward: wc ? wc.navigationHistory.canGoForward() : false,
+  });
+}
+function loadHome(id) {
+  const t = tabById(id); if (!t) return;
+  t.url = ""; t.title = "Theseus"; t.prov = { host: "", kind: "home" };
+  t.view.webContents.loadFile("home.html");
+  if (id === activeId) pushNav(t.prov);
+  emitTabs();
+}
+function createTab(initial, opts = {}) {
+  const id = ++tabSeq;
+  const view = new WebContentsView(opts.settings ? { webPreferences: { preload: path.join(__dirname, "settings-preload.js") } } : {});
+  const wc = view.webContents;
+  try { wc.setWebRTCIPHandlingPolicy(webrtcPolicy()); } catch {}
+  try { wc.setBackgroundThrottling(settings.backgroundThrottle); } catch {}
+  applyFingerprint(wc);
+  const tab = { id, view, title: opts.settings ? "Settings" : "New Tab", url: "", prov: null, settings: !!opts.settings };
+  tabs.push(tab);
+  win.contentView.addChildView(view);
+  wc.on("page-title-updated", (_e, title) => { tab.title = title; emitTabs(); });
+  wc.on("did-navigate", () => emitTabs());
+  wc.on("did-navigate-in-page", () => emitTabs());
+  wc.on("will-navigate", (e, u) => {
+    try {
+      const parsed = new URL(u);
+      if (parsed.protocol === "bns:") return;
+      if (isBnsHost(parsed.hostname)) { e.preventDefault(); navigateTab(id, parsed.hostname + parsed.pathname); }
+    } catch {}
+  });
+  // Links that open a new tab: target="_blank", window.open, Ctrl/middle-click.
+  wc.setWindowOpenHandler(({ url, disposition }) => {
+    if (url && url !== "about:blank") createTab(url, { background: disposition === "background-tab" });
+    return { action: "deny" };
+  });
+  // Right-click context menu.
+  wc.on("context-menu", (_e, p) => {
+    const items = [];
+    if (p.linkURL) {
+      items.push(
+        { label: "Open link in new tab", click: () => createTab(p.linkURL) },
+        { label: "Open link in new background tab", click: () => createTab(p.linkURL, { background: true }) },
+        { label: "Copy link address", click: () => clipboard.writeText(p.linkURL) },
+        { type: "separator" },
+      );
+    }
+    if (p.isEditable) items.push({ role: "cut" }, { role: "copy" }, { role: "paste" }, { type: "separator" });
+    else if (p.selectionText) items.push({ role: "copy" }, { type: "separator" });
+    items.push(
+      { label: "Back", enabled: wc.navigationHistory.canGoBack(), click: () => wc.navigationHistory.goBack() },
+      { label: "Forward", enabled: wc.navigationHistory.canGoForward(), click: () => wc.navigationHistory.goForward() },
+      { label: "Reload", click: () => wc.reload() },
+    );
+    Menu.buildFromTemplate(items).popup();
+  });
+  layout();
+  if (opts.background) { view.setVisible(false); emitTabs(); }
+  else setActive(id);
+  if (opts.settings) {
+    tab.prov = { host: "", kind: "home" };
+    wc.loadFile("settings.html");
+    if (id === activeId) pushNav(tab.prov);
+    emitTabs();
+  } else if (initial) navigateTab(id, initial);
+  else loadHome(id);
+  return id;
+}
+function closeTab(id) {
+  const i = tabs.findIndex((t) => t.id === id);
+  if (i < 0) return;
+  const [t] = tabs.splice(i, 1);
+  win.contentView.removeChildView(t.view);
+  t.view.webContents.destroy?.();
+  if (tabs.length === 0) { createTab(); return; }
+  if (activeId === id) setActive(tabs[Math.max(0, i - 1)].id);
+  else emitTabs();
+}
+
+function createWindow() {
+  win = new BrowserWindow({ width: 1220, height: 840, title: "Theseus Navigator", backgroundColor: "#0f1420" });
+  chrome = new WebContentsView({ webPreferences: { preload: path.join(__dirname, "preload.js") } });
+  win.contentView.addChildView(chrome);
+  chrome.webContents.loadFile("chrome.html");
+  // Bottom resolver/provenance line (trusted chrome, painted by the browser).
+  statusbar = new WebContentsView({ webPreferences: { preload: path.join(__dirname, "preload.js") } });
+  win.contentView.addChildView(statusbar);
+  statusbar.webContents.loadFile("statusbar.html");
+  // The bottom bar loads async; once ready, paint it with the active tab's state.
+  statusbar.webContents.once("did-finish-load", () => { const t = activeTab(); if (t?.prov) statusbar.webContents.send("nav", t.prov); });
+  chrome.webContents.once("did-finish-load", () => {
+    const saved = settings.restoreSession ? loadSession() : [];
+    if (saved.length) saved.forEach((u) => createTab(u)); else createTab();
+  });
+  win.on("resize", layout);
+  layout();
+}
+
+async function navigateTab(id, input) {
+  const t = tabById(id); if (!t) return;
+  let q = String(input).trim();
+  if (!q) return;
+  // Address bar doubles as a search box: anything that isn't a URL/hostname
+  // (a bare word, or a phrase with spaces) becomes a web search.
+  if (!looksLikeUrl(q)) q = SEARCH(q);
+  const raw = q.replace(/^[a-z]+:\/\//i, "");
+  const host = raw.split("/")[0].toLowerCase();
+  const rest = raw.slice(host.length) || "/";
+  const native = nativeTld(host);
+  const dual = dualTld(host);
+
+  // Every fresh navigation clears any stale "also on BCNR" offer for this tab.
+  t.nav = (t.nav || 0) + 1;
+  const navId = t.nav;
+  t.bcnrOffer = null;
+  if (id === activeId) chrome.webContents.send("bcnr-offer", null);
+
+  // Native BCNR TLD (.bch/.p2p/.nav): resolve from the registry outright.
+  if (native) return loadBns(t, id, host, rest, native);
+
+  // Ordinary web — and dual-use ICANN TLDs (.de/.dev/.ltd) — load the REAL site
+  // immediately. We never hijack or delay the clearnet web.
+  t.url = q.includes("://") ? q : "https://" + q;
+  await t.view.webContents.loadURL(t.url);
+  t.prov = { host, kind: "web" };
+  if (id === activeId) pushNav(t.prov);
+  emitTabs();
+
+  // Dual-use: in parallel, check whether the name also exists on BCNR. If it
+  // does, offer a passive switch — the user opts in; nothing is forced.
+  if (dual) {
+    resolveHost(host).then((entry) => {
+      if (entry && tabById(id) === t && t.nav === navId) {
+        t.bcnrOffer = { host, rest, tld: dual };
+        if (id === activeId) chrome.webContents.send("bcnr-offer", { host, tld: dual, registry: REGISTRY });
+      }
+    }).catch(() => {});
+  }
+}
+
+// Load a name from BCNR into a tab — used by native TLDs and by an accepted
+// dual-use switch from the "also on BCNR" bar.
+async function loadBns(t, id, host, rest, tld) {
+  const registry = registryOf(tld);
+  if (id === activeId) pushNav({ host, kind: "resolving", tld, registry });
+  let entry;
+  try { entry = await resolveHost(host); }
+  catch (e) { t.prov = { host, kind: "error", error: e.message, tld, registry }; if (id === activeId) pushNav(t.prov); return; }
+  t.url = host + (rest === "/" ? "" : rest);
+  if (!entry) {
+    t.prov = { host, kind: "nxdomain", tld, registry };
+    await t.view.webContents.loadURL(`bns://${host}/`);
+    if (id === activeId) pushNav(t.prov); emitTabs(); return;
+  }
+  await t.view.webContents.loadURL(`bns://${host}${rest}`);
+  const src = entry.records.h ? "on-chain (chain)" : entry.records.s3 ? "Sia network" : entry.records.ip ? "direct server" : entry.records.u ? "redirect" : "record";
+  t.prov = { host, kind: "ok", source: src, category: entry.category, records: Object.keys(entry.records), tld, registry };
+  if (id === activeId) pushNav(t.prov);
+  emitTabs();
+}
+
+ipcMain.handle("navigate", (_e, input) => navigateTab(activeId, input));
+ipcMain.handle("search", (_e, q) => navigateTab(activeId, SEARCH(q)));
+ipcMain.handle("new-tab", () => createTab());
+ipcMain.handle("close-tab", (_e, id) => closeTab(id));
+ipcMain.handle("switch-tab", (_e, id) => setActive(id));
+ipcMain.handle("go-home", () => loadHome(activeId));
+ipcMain.handle("go-back", () => { const wc = activeTab()?.view.webContents; if (wc?.navigationHistory.canGoBack()) wc.navigationHistory.goBack(); });
+ipcMain.handle("go-forward", () => { const wc = activeTab()?.view.webContents; if (wc?.navigationHistory.canGoForward()) wc.navigationHistory.goForward(); });
+ipcMain.handle("reload", () => activeTab()?.view.webContents.reload());
+ipcMain.handle("toggle-tor", () => { torState === "off" ? startTor() : stopTor(); });
+ipcMain.handle("open-settings", () => { const ex = tabs.find((t) => t.settings); if (ex) return setActive(ex.id); createTab(null, { settings: true }); });
+ipcMain.handle("settings-get", () => settings);
+ipcMain.handle("settings-set", (_e, key, val) => {
+  if (key in SETTINGS_DEFAULTS) { settings[key] = val; saveSettings(); }
+  if (key === "webrtcProtect") applyWebRTCPolicy();
+  if (key === "backgroundThrottle") applyThrottle();
+  if (["timezoneMode", "timezoneValue", "languageMode", "languageValue"].includes(key)) { applyFingerprintAll(); applyAcceptLanguage(); }
+  return settings;
+});
+ipcMain.handle("set-chrome-height", (_e, h) => {
+  const next = Math.max(74, Math.min(260, Math.round(h) || 84));
+  if (next !== CHROME_H) { CHROME_H = next; layout(); }
+});
+ipcMain.handle("switch-to-bcnr", () => {
+  const t = activeTab(); if (!t || !t.bcnrOffer) return;
+  const { host, rest, tld } = t.bcnrOffer;
+  t.bcnrOffer = null;
+  chrome.webContents.send("bcnr-offer", null);
+  return loadBns(t, activeId, host, rest || "/", tld);
+});
+
+// THESEUS_NO_AUTOSTART lets a test harness reuse serveBns/resolveHost without
+// launching the full UI (see dev/selftest.js). Normal `npm start` is unchanged.
+if (!process.env.THESEUS_NO_AUTOSTART) {
+  app.whenReady().then(() => {
+    loadSettings();
+    applyPermissions();
+    applyAcceptLanguage();
+    protocol.handle("bns", serveBns);
+    createWindow();
+    app.on("activate", () => { if (BrowserWindow.getAllWindows().length === 0) createWindow(); });
+  });
+  app.on("before-quit", () => { saveSession(); stopTor(); });
+  app.on("window-all-closed", () => { stopTor(); if (process.platform !== "darwin") app.quit(); });
+}
+
+module.exports = { serveBns, resolveHost, isBnsHost, nativeTld, dualTld, registryOf };
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@ -0,0 +1,57 @@
+{
+  "name": "theseus-navigator",
+  "version": "0.0.1",
+  "description": "Theseus Navigator — a browser that follows the thread. By Silent Mode, a Deviant project.",
+  "author": "Silent Mode",
+  "main": "main.js",
+  "type": "commonjs",
+  "scripts": {
+    "start": "electron .",
+    "resolve-test": "node resolve-test.mjs",
+    "dist": "electron-builder --win nsis portable"
+  },
+  "dependencies": {
+    "fetch-socks": "^1.3.3",
+    "socks-proxy-agent": "^10.1.0",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "electron": "^33.0.0",
+    "electron-builder": "^25.1.8"
+  },
+  "build": {
+    "appId": "st.silentmode.theseus",
+    "productName": "Theseus Navigator",
+    "artifactName": "TheseusNavigator-${version}-${arch}.${ext}",
+    "directories": { "output": "dist-public" },
+    "asar": true,
+    "files": [
+      "main.js",
+      "preload.js",
+      "chrome.html",
+      "home.html",
+      "settings.html",
+      "settings-preload.js",
+      "package.json",
+      "node_modules/**/*",
+      "!**/*.md",
+      "!**/*.map",
+      "!tor${/*}",
+      "!dist-public${/*}",
+      "!resolve-test.mjs",
+      "!*PROMPT.md"
+    ],
+    "extraResources": [
+      { "from": "tor", "to": "tor" },
+      { "from": "../Argus/src/lib/resolver-web.js", "to": "resolver-web.mjs" }
+    ],
+    "win": { "target": ["nsis", "portable"] },
+    "nsis": {
+      "oneClick": false,
+      "perMachine": false,
+      "allowToChangeInstallationDirectory": true,
+      "artifactName": "TheseusNavigator-Setup-${version}.${ext}"
+    },
+    "portable": { "artifactName": "TheseusNavigator-${version}-portable.${ext}" }
+  }
+}
--- a/preload.js
+++ b/preload.js
@ -0,0 +1,20 @@
+const { contextBridge, ipcRenderer } = require("electron");
+contextBridge.exposeInMainWorld("theseus", {
+  navigate: (input) => ipcRenderer.invoke("navigate", input),
+  search: (q) => ipcRenderer.invoke("search", q),
+  newTab: () => ipcRenderer.invoke("new-tab"),
+  closeTab: (id) => ipcRenderer.invoke("close-tab", id),
+  switchTab: (id) => ipcRenderer.invoke("switch-tab", id),
+  goHome: () => ipcRenderer.invoke("go-home"),
+  back: () => ipcRenderer.invoke("go-back"),
+  forward: () => ipcRenderer.invoke("go-forward"),
+  reload: () => ipcRenderer.invoke("reload"),
+  toggleTor: () => ipcRenderer.invoke("toggle-tor"),
+  openSettings: () => ipcRenderer.invoke("open-settings"),
+  switchToBcnr: () => ipcRenderer.invoke("switch-to-bcnr"),
+  setChromeHeight: (h) => ipcRenderer.invoke("set-chrome-height", h),
+  onNav: (cb) => ipcRenderer.on("nav", (_e, d) => cb(d)),
+  onTor: (cb) => ipcRenderer.on("tor", (_e, d) => cb(d)),
+  onTabs: (cb) => ipcRenderer.on("tabs", (_e, d) => cb(d)),
+  onBcnrOffer: (cb) => ipcRenderer.on("bcnr-offer", (_e, d) => cb(d)),
+});
--- a/settings-preload.js
+++ b/settings-preload.js
@ -0,0 +1,5 @@
+const { contextBridge, ipcRenderer } = require("electron");
+contextBridge.exposeInMainWorld("cfg", {
+  get: () => ipcRenderer.invoke("settings-get"),
+  set: (key, value) => ipcRenderer.invoke("settings-set", key, value),
+});
--- a/settings.html
+++ b/settings.html
@ -0,0 +1,130 @@
+<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>Theseus — Settings</title>
+<style>
+  :root{ color-scheme: dark; --bg:#0b0e14; --panel:#141a24; --panel2:#18202c; --line:rgba(255,255,255,.09);
+         --ink:#e7eaf1; --mut:#8b98a9; --dim:#5e6678; --acid:#d6ff3d; }
+  *{box-sizing:border-box}
+  body{margin:0;min-height:100vh;background:radial-gradient(900px 480px at 50% -10%,#16202e,var(--bg));
+       color:var(--ink);font:15px/1.6 system-ui,-apple-system,Segoe UI,Roboto,sans-serif}
+  .wrap{max-width:720px;margin:0 auto;padding:2.6rem 1.4rem 4rem}
+  h1{font-size:1.6rem;margin:0 0 .2rem;letter-spacing:.3px}
+  h1 .g{color:var(--acid)}
+  .lede{color:var(--mut);margin:0 0 2rem;font-size:14px}
+  .group{margin:0 0 1.8rem}
+  .group h2{font-size:11.5px;letter-spacing:.16em;text-transform:uppercase;color:var(--dim);margin:0 0 .7rem;padding-left:2px}
+  .row{display:flex;align-items:center;gap:16px;background:var(--panel);border:1px solid var(--line);
+       border-radius:12px;padding:15px 18px;margin-bottom:10px}
+  .row .txt{flex:1}
+  .row .t{font-weight:600;color:var(--ink)}
+  .row .d{color:var(--mut);font-size:13px;margin-top:2px}
+  .row.soon{opacity:.55}
+  /* toggle */
+  .sw{position:relative;width:46px;height:26px;flex:none;cursor:pointer}
+  .sw input{opacity:0;width:0;height:0}
+  .track{position:absolute;inset:0;background:#2b3444;border:1px solid var(--line);border-radius:999px;transition:.15s}
+  .knob{position:absolute;top:3px;left:3px;width:18px;height:18px;border-radius:50%;background:#8b98a9;transition:.15s}
+  .sw input:checked + .track{background:rgba(214,255,61,.25);border-color:#d6ff3d55}
+  .sw input:checked + .track .knob{transform:translateX(20px);background:var(--acid)}
+  .ctl{display:flex;flex-direction:column;gap:6px;align-items:flex-end;flex:none}
+  select,.ctl input{background:#1b2330;color:var(--ink);border:1px solid var(--line);border-radius:8px;
+                    padding:7px 10px;font-size:13px;outline:none}
+  select:focus,.ctl input:focus{border-color:#4b7bec}
+  .ctl input{width:160px}
+  .note{color:var(--dim);font-size:12.5px;margin-top:1.4rem;border-top:1px solid var(--line);padding-top:1rem}
+  .badge{display:inline-block;font-size:10px;letter-spacing:.05em;text-transform:uppercase;color:var(--dim);
+         border:1px solid var(--line);border-radius:999px;padding:1px 8px;margin-left:8px}
+</style></head>
+<body>
+<div class="wrap">
+  <h1>⚙ Theseus <span class="g">Settings</span></h1>
+  <p class="lede">Changes apply immediately and are saved for next time.</p>
+
+  <div class="group">
+    <h2>Privacy</h2>
+    <div class="row">
+      <div class="txt"><div class="t">WebRTC leak protection</div>
+        <div class="d">Stops sites from discovering your real IP through WebRTC. Strongest with Tor on. On by default.</div></div>
+      <label class="sw"><input type="checkbox" id="webrtcProtect"><span class="track"><span class="knob"></span></span></label>
+    </div>
+    <div class="row">
+      <div class="txt"><div class="t">Block camera</div>
+        <div class="d">Deny camera access by default — also hides your camera's name from fingerprinting.</div></div>
+      <label class="sw"><input type="checkbox" id="blockCamera"><span class="track"><span class="knob"></span></span></label>
+    </div>
+    <div class="row">
+      <div class="txt"><div class="t">Block microphone</div>
+        <div class="d">Deny microphone access by default — also hides your mic's name from fingerprinting.</div></div>
+      <label class="sw"><input type="checkbox" id="blockMicrophone"><span class="track"><span class="knob"></span></span></label>
+    </div>
+    <div class="row">
+      <div class="txt"><div class="t">Block location</div>
+        <div class="d">Deny geolocation requests by default.</div></div>
+      <label class="sw"><input type="checkbox" id="blockLocation"><span class="track"><span class="knob"></span></span></label>
+    </div>
+  </div>
+
+  <div class="group">
+    <h2>General</h2>
+    <div class="row">
+      <div class="txt"><div class="t">Reopen tabs on launch</div>
+        <div class="d">Restore the tabs from your last session when Theseus starts.</div></div>
+      <label class="sw"><input type="checkbox" id="restoreSession"><span class="track"><span class="knob"></span></span></label>
+    </div>
+  </div>
+
+  <div class="group">
+    <h2>Performance</h2>
+    <div class="row">
+      <div class="txt"><div class="t">Throttle inactive tabs</div>
+        <div class="d">Background and inactive tabs use far less CPU. Recommended.</div></div>
+      <label class="sw"><input type="checkbox" id="backgroundThrottle"><span class="track"><span class="knob"></span></span></label>
+    </div>
+  </div>
+
+  <div class="group">
+    <h2>Anti-fingerprinting</h2>
+    <div class="row">
+      <div class="txt"><div class="t">Timezone</div>
+        <div class="d">What sites read via JavaScript (Intl / Date). <b>Hide</b> reports UTC; <b>Change</b> lets you set your own.</div></div>
+      <div class="ctl">
+        <select id="timezoneMode"><option value="show">Show real</option><option value="hide">Hide (UTC)</option><option value="change">Change…</option></select>
+        <input id="timezoneValue" placeholder="e.g. Europe/Berlin" hidden>
+      </div>
+    </div>
+    <div class="row">
+      <div class="txt"><div class="t">Language</div>
+        <div class="d">navigator.language and the Accept-Language header. <b>Hide</b> reports en-US; <b>Change</b> lets you set your own.</div></div>
+      <div class="ctl">
+        <select id="languageMode"><option value="show">Show real</option><option value="hide">Hide (en-US)</option><option value="change">Change…</option></select>
+        <input id="languageValue" placeholder="e.g. de-DE" hidden>
+      </div>
+    </div>
+  </div>
+
+  <div class="note">Theseus is honest about its limits: these reduce tracking and hide your IP, but a custom
+    browser can still be fingerprinted. For maximum anonymity, use the Tor Browser.</div>
+</div>
+<script>
+  const C = window.cfg;
+  const KEYS = ["webrtcProtect", "blockCamera", "blockMicrophone", "blockLocation", "restoreSession", "backgroundThrottle"];
+  C.get().then((s) => {
+    for (const k of KEYS) {
+      const el = document.getElementById(k);
+      if (!el) continue;
+      el.checked = !!s[k];
+      el.addEventListener("change", () => C.set(k, el.checked));
+    }
+    // Show/Hide/Change selectors with a value field revealed on "change"
+    for (const [mode, val] of [["timezoneMode", "timezoneValue"], ["languageMode", "languageValue"]]) {
+      const m = document.getElementById(mode), v = document.getElementById(val);
+      m.value = s[mode] || "show";
+      v.value = s[val] || "";
+      v.hidden = m.value !== "change";
+      m.addEventListener("change", () => { C.set(mode, m.value); v.hidden = m.value !== "change"; });
+      v.addEventListener("change", () => C.set(val, v.value.trim()));
+    }
+  });
+</script>
+</body>
+</html>
--- a/statusbar.html
+++ b/statusbar.html
@ -0,0 +1,57 @@
+<!doctype html>
+<html>
+<head><meta charset="utf-8">
+<style>
+  :root { color-scheme: dark; font-family: system-ui, sans-serif; }
+  html, body { margin: 0; height: 100%; }
+  body { display: flex; align-items: center; gap: 8px; padding: 0 12px;
+         background: #0b0f18; color: #8b93a7; font-size: 11.5px; white-space: nowrap;
+         overflow: hidden; border-top: 1px solid #ffffff10; user-select: none; }
+  .dot { width: 8px; height: 8px; border-radius: 50%; background: #5e6678; flex: none; }
+  .dot.chain { background: #d6ff3d; } .dot.sia { background: #b39ddb; }
+  .dot.server { background: #4fd1a5; } .dot.web { background: #8b93a7; } .dot.err { background: #f6768a; }
+  #host { color: #e7eaf1; }
+  #src { color: #bfeae4; }
+  .reg { color: #d6ff3d; }
+  .sep { color: #3a4152; }
+  #records { color: #6f7789; font-family: ui-monospace, monospace; }
+  #cert { color: #6f7789; margin-left: auto; font-family: ui-monospace, monospace;
+          overflow: hidden; text-overflow: ellipsis; }
+</style></head>
+<body>
+  <span class="dot" id="dot"></span>
+  <span id="host"></span>
+  <span id="sep1" class="sep" hidden>·</span>
+  <span id="src"></span>
+  <span id="sep2" class="sep" hidden>·</span>
+  <span class="reg" id="reg"></span>
+  <span id="records"></span>
+  <span id="cert"></span>
+<script>
+  const $ = (id) => document.getElementById(id);
+  function clear() { for (const id of ["host","src","reg","records","cert"]) $(id).textContent = ""; $("sep1").hidden = $("sep2").hidden = true; }
+  window.theseus.onNav((d) => {
+    const dot = $("dot"); dot.className = "dot";
+    clear();
+    if (!d || d.kind === "home") { $("host").textContent = "Theseus — decentralized web navigator"; return; }
+    if (d.kind === "resolving") { $("host").textContent = "resolving " + d.host + " on the BCH chain…"; return; }
+    if (d.kind === "nxdomain") { dot.classList.add("err"); $("host").textContent = d.host + " → not registered on chain (NXDOMAIN)"; return; }
+    if (d.kind === "error") { dot.classList.add("err"); $("host").textContent = "error: " + (d.error || "resolution failed"); return; }
+    if (d.kind === "web") {
+      dot.classList.add("web");
+      $("host").textContent = d.host || "";
+      $("sep1").hidden = false; $("src").textContent = "web (ICANN DNS)";
+      return;
+    }
+    // kind === "ok": a resolved BNS name
+    const cls = (d.source || "").includes("chain") ? "chain" : (d.source || "").includes("Sia") ? "sia" : (d.source || "").includes("server") ? "server" : "web";
+    dot.classList.add(cls);
+    $("host").textContent = d.host || "";
+    $("sep1").hidden = false; $("src").textContent = "served from " + (d.source || "chain");
+    if (d.registry || d.tld) { $("sep2").hidden = false; $("reg").textContent = (d.registry || "BCNR") + (d.tld ? " ·." + d.tld : ""); }
+    if (d.records && d.records.length) $("records").textContent = "  [" + d.records.join(",") + "]";
+    if (d.category) $("cert").textContent = "cert " + String(d.category).slice(0, 16) + "…";
+  });
+</script>
+</body>
+</html>