What the federation runs and the towns host — neutral ground, the naming root and resolver, the shared KMS operator, the doors — and each town beside it. Lit windows answered their probe just now; a building is a link. Nothing drawn is a permission.
Every town we have, read live from each town's own surfaces: its town agent, its naming service, its services' probes. A town is one chain and the estates on it.
The registry no estate controls, and the estates that project their live sets onto it. A root is a commitment; the leaves stay the estate's record. Neutral is a property of the contract (no admin, no pause, no upgrade), not of the chain.
The receiving doors: where a visiting agent's presentation reaches an admission receipt. Each decision was taken on a root read from neutral ground at that moment. A door admits on evidence; it never decides what the agent may do.
The predicate grade (spec 443 W5): a visitor proves, in zero knowledge, that a credential she holds satisfies what a door asks — bound to that door's challenge, under an issuer the door resolves through the chain, one visit per audience, with the issuer's live status read from neutral ground. The door learns that a predicate held. It learns no claim, no name, no address of hers.
The universal resolver: one namespace rooted on the root chain, answered across every live town. A name outside its home town is never shown bare. Resolution is never authority.
The shared KMS operator: one operator of record, one tenant per estate, never a shared seed. Keys are delegates under wires custodians hold. Nothing here is a key, a token or a seed.