The owner's state × trigger × setting matrix（2026-07-25）and the design session it produced. Every instrument turns out to have up to three phases, not two — and the axis that was missing is when the contents become visible, which is separate from when the collecting stops. This page is the design record and the work breakdown; toolbox.html keeps the architecture, toolbox-build.html tracks execution.
Three are shipped（T8's presence properties）. Three were new — and the first of them, visibility, is the one that was hiding inside the「Open」column of the matrix: it isn't a trigger at all, it is who sees others' contributions while collecting. A seventh arrived later（v630, ruling ⑮） and is a different animal from the other six: readout governs what a card says, not who may see it or when.
| axis | values（default first） | status |
|---|---|---|
| visibility（while collecting） | all · contributors-only · own · none | shipped（A/v620 · C/v622 · D/v625） — a prop on every kind; the per-kind defaults ARE the old hard-coding written down（roll=all, poll=contributors-only, deposit=own）. B/v621 shipped the bottom rung（none）and C/v622 the missing middle（own）, so the ladder is whole: sealed→暗 · blind→盲 on the tag, three stacked rows in the dialog, and _shows_content() is the one place the axis is enforced — per row, on the wire |
| close trigger | all-in · creator · any player · timer | shipped（A/v620）— close_trigger + close_at on every kind. ⚠ the clock is LAYERED on the trigger, not a substitute: all-in still closes first if the room gets there |
| reveal trigger | on close · creator · player（own row）· timer | shipped（A/v620）— promoted off seal to every kind; T11's four words survive as the wire alias |
| blocking | none · panel · all | shipped（T8/v578） |
| place | inline · pinned | shipped（T8/v578） |
| unique | no · yes | shipped（T8） |
| readout（dice only） | sum · faces | shipped（v630） — the first presentational axis, and the only one with no combo coercion: it changes what a card says, never who may see it. sum is today's card verbatim（[4 + 1 + 4 + 2 + 1 = 12]）; faces drops the total and sorts（[1, 1, 2, 4, 4]）for the games that bid on the dice rather than add them. A bare faces on the tag, a two-button row in the dice pane（2+ dice only）. ⚠ it does not gate what the panel knows — see ruling ⑮ |
Why naming visibility matters: that single rung unifies three behaviours we built separately — the poll's reveal gate（contributors-only）, the roll's public rows（all）, the deposit's sealed rows（none）. The middle rung is a general pay-to-see device — commit before you may look — that today only the poll enjoys and any tool could use. Your own contribution is always visible to you; that is a constant, not a setting.
visibility=all ⟹ reveal=on close. If everything is public as it lands there is nothing left to reveal; a reveal control on an open roll is meaningless（the v585 lesson formalized — the roll dropped its 🔒 precisely because it was public the whole way）.roll and the face stays dice（keep the kind aligned with the mental model, or every future dice feature gets special-cased inside a kind called deposit）. But do not mimic the deposit's state machine — promote it. Copying is how v586 happened（textGate() matched「any gate that is not a vote」, true until a third kind existed）; two copies agree today and diverge at the first fix.CLOCK_SKEW already solved）. Then the card is its own clock and binding buys nothing. The wall clock keeps its job（ruling ④ of toolbox §9）: timing phases that aren't instruments, its ring a cue to the host. Display rule: show only the next deadline, labelled with what it does —「⏱ 4:32 后截止」then「⏱ 12:04 开封」. Deadlines are opt-in. 「The clock rings and everything open resolves」is a session concern（T5's orchestration）, not a per-instrument dial.TOOL_ICONS/toolIcon()（7 keys, per-tool accents）everywhere a tool is named; tEmo() house glyphs（never OS emoji — the v556 rule）for states: 🔒 sealed · 🔓 revealed · 🔑. Both are house-owned, so a die and a lock are the same picture on every device.| rung | who sees what | the presets that live there |
|---|---|---|
all | everything, as it lands | 明掷 · 明转 · 明发牌 |
contributors-only | everything, once I have contributed（pay-to-see） | the poll's reveal gate |
own | mine only, until the reveal | 暗掷 · 暗转 · 暗发牌 · the deposit |
none | nothing, not even mine | 盲掷 · 盲转 · a blind deal |
own gives you information to play with — 吹牛, a secret stealth check, damage you may bluff about; none gives the room a value nobody could react to, committed early and provably unchanged — the dice equivalent of a sealed note.（「the server could just roll at reveal time」is wrong: it could, and the commitment would evaporate.）
暗 is the default non-open mode, because the failure costs are asymmetric: wanting 盲 and getting 暗 leaks only to yourself; wanting 暗 and getting 盲 leaves you blind in a game that needed your own information. The SP exemplar must lead with 暗 — in-context shape decides what a persona reaches for（v553）.
Person-authored tools cannot reach none: you cannot hide from someone what they just typed, so a deposit is inherently own. Do not try to build it.
What survives of the first draft — and it is the important half: the parity law（ruling ⑫）applies within each rung. In 暗 both a human and a persona see their own face; in 盲 neither does. And because a persona has no wire payload, each rung needs its riding note to say exactly what that seat knows — that is the general implementation shape of parity.[4 + 1 + 4 + 2 + 1 = 12]. The card was never the problem. The panel does not read cards — it reads the transcript — and every panel-facing roll surface was built from result alone, so the host read「你 12 · Dan 20」and could not count a single six. 阿测's「系统给的就是加总，没有独立面」was an accurate bug report from inside the room.
The general shape, and why the requested toggle would not have fixed it: a toggle whose default is「sum」leaves the default path blind, and the one game that needs faces is normally GM-hosted — the persona opens the dice, so a human dialog's toggle is never passed. So the fix splits in two, and only the second half is the feature:
① The faces reach the panel in BOTH readouts, unconditionally. The sum is derivable from the faces; the faces are not derivable from the sum. There is no readout, and no game, in which withholding them from the host helps. _panel_roll_face() is the one formatter behind the settle line, the settle cue and the open-roll riding note. On a sealed roll the settle line is the ONLY path a number has（the per-throw line is suppressed by ruling ①'s read-path law）— so this was not「the faces arrived late」, it was「they never arrived」.
② The readout moves the TOTAL, on every surface at once. Card row, settled record and the panel's line share one spelling — a host that says「你那手 4+1+4+2+1」about a card reading [1, 1, 2, 4, 4] has re-introduced in prose exactly the mismatch this removed（v628's one-head law）. And the faces sort under faces: counting「几个6」off a sorted row is the entire job, and throw order carries no information for dice.
The reusable test: when a request asks for a control so the panel can see something, check first whether the panel was ever told it. A control that gates a fact the host already lacks ships a preference and leaves the bug.D/v625 corrected one cell: the ordinary face-down deal is own, not none — ruling ⑥'s「always flipped on receipt」is exactly what puts it there, and 盲发牌（none）became its own preset beside it.
The matrix's「use case」column is the preset list — these six are what a person sees and picks; the axes are how they are configured underneath. That is ruling ⑩ of toolbox §9（three tiers）doing its job: adding axes must not add UI.
| preset | visibility | close | reveal | anon |
|---|---|---|---|---|
| Open Roll（掷骰） | all | all-in · creator · any · timer | on close（coerced） | n/a |
| Private Roll（暗掷） | own | all-in · creator · any · timer | creator · player · timer · on close | n/a |
| Open Spin（转盘） | all | all-in · creator · any · timer | on close（coerced） | n/a |
| Private Spin（暗转） | own | all-in · creator · any · timer | creator · player · timer · on close | n/a |
| Poll（投票） | contributors-only | all-in · creator · any · timer | on close | yes |
| Deposit（密封收集） | own | all-in · creator · any · timer | on close · creator · writer · timer | yes |
| Deal · face down（暗发牌） | own | no close stage | creator · player · timer · on deal | n/a |
| Deal · blind（盲发牌） | none | no close stage | creator · timer · on deal | n/a |
| Deal · face up（明发牌） | all | no close stage | on deal（coerced） | n/a |
Once reveal and close come apart, the card scrolls away while still owing someone an action. The reveal bubble（T11）tells the room after; nothing tells you before. That surface is the chip strip we already built（T-UI v569, ~35px under the topbar）— it just gains a second reason for a chip to exist: today a chip means you chose place=pinned（placement, by config）; now it also means this instrument is waiting on something（state, automatic）. If a card is both, they merge into ONE chip.
| pill | shown to | label |
|---|---|---|
| close / reveal countdown | everyone — a shared upcoming event | 「🎲 TITLE · 1:35 截止」/「· 1:35 开封」 |
| creator reveal | the creator only | 「🎲 TITLE · 开封」 |
| writer reveal（own row） | each person holding a sealed row | 「✉ TITLE · 开封」 |
Ordering: soonest clock first, then actionable-by-me. Cap the visible count with a +N overflow rather than wrapping — the 35px budget is what made the strip work. Ageing: clocks always earn a pill; a manual reveal earns one for a bounded window（the session, or a day）, after which the card stays findable in the tools drawer as「my sealed cards」— otherwise a prediction sealed for a week is six days of permanent chrome. In the bubble: the countdown takes the place「Close now」occupies, but the early-close stays for whoever holds the valve — a timer must not remove agency the valve table grants.
Verified 2026-07-25 — the starting point for every task below.
self.gates）holds three kinds: vote · roll · seal（+ text, legacy replay only）. Props are blocking · place · unique with the v578 coercions.props.visibility · close_trigger + close_at · reveal_trigger + reveal_at + revealed{}, read through three module-level readers — _visibility(g) · _close_trigger(g) · _reveal_trigger(g)（the old _seal_trigger(), promoted）. T11's four words were the two axes fused; LEGACY_SEAL_TRIGGER is the ONE place they are translated — on load（the stored trigger splits and retires）, on the wire（trigger survives as an alias so a cached shell still renders）, and in the replay of a legacy seal_result. Ruling ②'s coercion lives inside _reveal_trigger(), so no caller can hold a different opinion._maybe_close() / _maybe_reveal() / _all_in() / _reveals_on_close() are the whole state machine — every tap site asks them instead of re-deriving「is everyone in?」in its own words. _life_arm() / _life_fire()（T11's _seal_arm, promoted）own ONE server timer per room for every deadline of every kind, with the T1 traps verbatim, and LIFECYCLE_HOOK carries {action: close|reveal|shut, gate} to the app layer.close_at is live on the poll, the roll and the deposit — close="3m" on the tag, a「Closes」rung in each Advanced fold, a live in-card countdown（clockRow / syncGateClocks, next deadline only）. The clock is LAYERED on the close trigger, never a substitute: all-in still closes first if the room gets there. The one exception is a deferred-reveal deposit, where close_trigger="timer" makes the clock its only automatic door — there the reveal IS the close, so all-in must not fire it._blocking_open() / _all_blocking_open() / the client's holdsFloor() all skip a closed instrument, so a closed-but-sealed card releases the panel AND the composer at the CLOSE. _shut() is the shared close-without-reveal — it records the fact and, only when the panel was actually held, queues a cue naming WHO acted and never WHAT.kind="roll" + props.visibility="none" + a deferred reveal_trigger, and everything else about it is task A's machine. Three things joined the shared layer for it: _shows_content(g, key, viewer) — the per-row wire gate, where the visibility axis is actually ENFORCED（a masked row carries no result key, so there is nothing to hide in CSS）; _life_stamp(…, close_trigger=…) — a kind that knows its own close states it（a sealed roll closes at all-in, the deposit does not）; and _in_uids/_life_title/_life_words, the ONE per-kind vocabulary table every shared cue and riding note reads. The reveal and the valve are now kind-agnostic routes: gate_reveal / gate_close（T11's seal_* names survive as aliases）behind /api/…/gate_reveal（the old /seal_reveal path still answers — a cached shell posts to it）. The client's revealBubble() takes a tool key, so a sealed roll's reveal message is the deposit's own builder wearing a die; the strip's reveal pill is gateRevealPill() for every kind, wearing gateTool(g)'s picture. The parser rows are DICTS（_GATE_OPEN_KEYS/_VOTE_OPEN_KEYS + _op_dict, task A's warning paid off; a tuple still reads, for the old batteries only）.kind="deal" with cards{} keyed "uN", born closed（ruling ⑥ — there is no input door to shut, so it never blocks and never waits）and reading its rung off the same _shows_content() every other tool does. Three per-kind facts joined the shared layer rather than a parallel path: _my_row_key/_row_store（the「uN vs str(uid)」difference, in ONE place）, a row in _life_words, and _dealer_sees(g) — D2's toggle, whose coercion（sees ⟹ holds no card）lives inside the reader, so no caller can hold a different opinion and a dealt-in dealer's eyes are unexpressible rather than policed. The dealer's grant is spent in exactly two places: _shows_content（the human dealer's own wire）and _deal_map_note（the persona dealer's, which IS its wire — the parity law's shape）. <reveal who="uN"/> now opens a ROW on the gate through gate_reveal, and the last one settles the card. The legacy self.deal path stays for a room that already holds one（replay · deal_mine · the pickup）— degrade-never-delete — but its riding note goes through the SAME builder, so there is one mechanism with two callers rather than two that agree today.TOOL_ICONS/toolIcon(key)（7 SVG keys, per-tool accents）where it fills a box, toolGlyph(key)/.tgl where it lands in running text — tiles, watermarks, band icons, the whole chip strip and every stream capsule. A state stays an emoji: TOOL_EMO is now lock · unlock · key and nothing else, so no tool can be drawn with an emoji anywhere（grep-provable）. Task C builds on the swept strip: a pill wears the tool's own icon — toolGlyph() in a 24px box, the same picture as the card it points at（v617: the reveal pill's 🗝 was the one chip that disagreed with its card, and 「which card」 is a locator's whole job — keep the ACT in the accessible name）; a state emoji beside one takes 20px, not 24（equal ink, unequal boxes）. The strip still measures 35.7px at 375px. Two laws C must not break: a CTA button is pure TEXT（v617 — so a pill stays a locator and never grows a glyph-plus-verb button）, and anything carrying a watermark is overflow:clip, never hidden — C's jump-to-card is exactly the scrollIntoView that shoved a card's own content up 45px when it was hidden. Traps L paid for, in the findings log: .tgl is 1.6em（the SVG ink is ~70% of its box）· a filled-accent button must invert the glyph, inline · knock-outs bind to what is behind them.Goal: ruling ⑪ made real — one picture per tool, one per state, everywhere.
tEmo() sites and split them: tool references（die · wheel · card · vote · board · clock · seal）→ toolIcon(key); state references（lock · unlock · key）→ stay tEmo() house glyphs.TOOL_EMO key that no longer has a caller; keep the state keys.Accept: no tool is drawn with an emoji anywhere（grep-provable）; no state glyph is drawn with an OS character（the v556 rule holds）; light/dark/e-ink all read; zero layout shift in the strip at 375px.
Goal: promote the three-phase machine out of seal and into every instrument, per ruling ⑧（extract, never copy）. Ships one visible feature so it is testable: close-by-timer on the tools that exist today.
visibility（props）· close_trigger + close_at（NEW）· reveal_trigger + reveal_at + revealed{} — all promoted from seal-only to every kind. _seal_trigger() becomes the shared reader._maybe_close() / _maybe_reveal() called uniformly; one reveal route carrying the valve table（ruling ③）; one timer arm/re-arm with the T1 traps verbatim（non-daemon guard · evict_guard membership · re-arm on load ≥1s fuse · a missed deadline fires once）.visibility=all ⟹ reveal=on close）beside the v578 pair._deal_note() has TWO branches and both are load-bearing（added mid-task 2026-07-25）: the GM-knows-the-map branch（bound:「he may reason from it and must never say it」）and the blind branch（「YOU DO NOT KNOW who holds what … never guess at, hint at or reason from anyone's card」）. The blind wording is what stops a dealer-less GM improvising a role assignment — the Cameron-class failure. Generalizing the binding is welcome; flattening the two branches into one is not. See task D's D2.revealBubble(); the countdown renderer（ruling ⑨）with the「next deadline only」rule.Accept: every existing poll/roll/deposit behaves bit-identically（re-run the T8/T9/T10 matrices）; a poll and a roll each accept a close-timer and fire it, surviving a restart and a missed deadline; the mid-seal transcript proof; smoketest green.
Goal: rulings ⑩ and ⑫ — the sealed subtype, and dice/slots as separate doors.
none rung and is now called 盲掷/盲转（ruling ⑩ — 密 wrongly implies a keeper）, and the 暗 rung（own）that sits above it did not exist and must be added（ruling ⑬）. B's implementation was correct for the rung it built.visibility=none, close=all-in, reveal=creator（reveal later is the point — ruling ⑩）. Reveal-on-close is available in Advanced for the simultaneity case.[3 + 4 = 7] format.wheel key — pick one word for the face（Slots or Wheel）and keep wheel internal.What task A left you（read its findings entry in the tracker first）:
props.visibility · close_trigger+close_at · reveal_trigger+reveal_at+revealed{} are shared fields with three module readers（_visibility/_close_trigger/_reveal_trigger）, ONE evaluator, ONE timer and ONE stamp（_life_stamp, called from all six creation sites）. A sealed roll is a kind="roll" instance with visibility=none + reveal_trigger=creator — do not add a parallel path（ruling ⑧).extract_panel_gates now returns 8 slots and extract_panel_votes 7, read defensively（op[7] if len(op) > 7）. A's own words:「a positional contract this long is the next thing that will bite; B should consider a dict」. You are adding attrs to the roll grammar — do the dict refactor as part of that, and keep the defensive reads for old smoketest tuples.close_at is an extra door on top of whatever close_trigger says, and _maybe_close asks the clock first, then the trigger. A sealed roll with a deadline must still close when the last person rolls._shut() returns whether it cued.caches · the tab's own HTTP cache. Curl-grep the wire → check document.documentElement.outerHTML → open a FRESH TAB; a forced reload served the stale document even after unregister+purge.Accept: a sealed roll hides every face while collecting（wire-checked, not CSS-hidden）; closes at all-in with the panel released to speak blind（ruling ①）; the creator's reveal opens all rows + the reveal bubble + the cue; a sealed spin does the same for options; the open variants are unchanged; the two dialogs share one code path. All met v621 — including live: the panel, released by the close, said「两个密封骰子，我看不到里面」and named no face, and Tess armed her own 密摇 from a plain ask and opened it with <reveal/>. Three things the build settled that this card did not say: a sealed roll masks the THROWER's own row too（§5's mock is literal — nobody has looked, which is what makes「谁先看？」a question）, its close trigger is all-in by ARGUMENT（the deposit's「deferred ⟹ never all-in」is a per-kind default, not a law）, and reveal-by-player degrades to creator（ruling ③'s「show your hand」needs a dice row-reveal record — deliberately not built; see the findings）.
Goal: §6 — the chip strip gains automatic chips for instruments that owe someone an action. Plus item 0 below, the ladder correction that B could not have known about.
⚠ ITEM 0 — do this FIRST, before the pill（rulings ⑩ + ⑬, decided after B shipped）:
own rung to the visibility axis. _shows_content() gains a fourth value between contributors-only and none: own = my row's content rides the wire, everyone else's is withheld until the reveal. B's none（nothing, not even mine）is correct and stays._one_gate_note()'s sealed branch must split: under own it tells the persona its own face and only its own; under none B's existing「NOBODY has seen a result, you included」is right as written and must not be softened.Then the pill itself:
place=pinned chip when both apply.CLOCK_SKEW）; the「next deadline only」label rule.+N overflow rather than wrapping, and the ageing rule for manual reveals.Accept: a deferred-reveal card scrolled far out of view is findable in one tap; a creator-reveal pill is invisible to non-creators; two pending instruments order correctly and a third overflows; the strip still measures ~35px at 375px; no double chip for a pinned+pending card. All met v622 — item 0 first（the own rung is a fourth value in _shows_content, sealed→暗 and blind→盲 on the tag, the riding note split per rung, three stacked dialog rows at a uniform 53.2px English / 55.2px Chinese）, then the pill（37px at 375px in both themes, four pending cards ordered clock-first with a +1, the pinned+pending card carrying ONE chip, every card's own scrollTop still 0 after a jump）. Three things the build settled that this card did not say: a persona's own face survives the CLOSE（the closed note keeps it, or the panel reads「nothing has been shown to you」about a number it was given last turn）, the reveal cue's past tense is rung-shaped too（「hidden from everyone」is false about a 暗掷）, and the deposit's honest rung is own, which is what ruling ⑬ says and what the code always did.
Goal: migrate self.deal onto the instance store and the lifecycle — the same move T8/T9/T10 made for the poll, roll and deposit — and add the dealer's-eyes toggle（the owner's design, 2026-07-25, below）.
kind="deal" on self.gates; the legacy self.deal + roll_offer path retires（legacy replay stays — old rooms must still render）.all（every hand visible）· 暗发牌 = own（your card face up, everyone else's 🂠 — this is the default face-down deal, and ruling ⑥「always flipped on receipt」is exactly what puts it on the own rung rather than below it）· 盲发牌 = none（nobody has looked, holder included — a fate envelope; legitimate and expressible, distinct from ⑥'s abolished pickup ceremony because nobody is waiting to look）. The wire discipline is the acceptance: others' cards must be absent from your payload, never merely hidden in the render — replay included.The problem it solves（owner, 2026-07-25）: werewolf's GM opens a private den for the wolves through the generic invite（the outcome bridge, T7）— so the GM must know who holds 狼人. But a face-down deal shows a card only to its holder, and v565 deliberately made a guest-dealt deal blind to everyone including the dealer（「hand that map to a player who dealt and they are the wolf-knower」）. That ruling was right about a player who deals and over-broad about a dealer who doesn't play.
Rejected — seat="card:狼人"（a door that seats by predicate）: it would make the door know about cards, coupling two mechanisms, and would put a rule of werewolf（「wolves share a room」）inside the server. The boundary law forbids both: the mechanism states facts, the contract owns meaning. The GM invites people, generically, by knowing who they are.
| the setting | the design |
|---|---|
| default | see-none, for humans and personas alike — v565's normal case preserved, and symmetric by ruling ⑫（a GM is a role, not a species）. It also makes the public line below mean something: a warning that is always on is one nobody reads. |
| the toggle | worded as a role, not a permission:「我是主持人（看得见全部）」/「I'm running this, not playing it」— it says why you would want it, and makes the coercion self-evident. |
| the coercion | sees-all ⟹ the dealer holds no card（and dealing yourself in locks the toggle off）— a player who deals, plays AND sees every hand is simply cheating, so make the cell unexpressible（locked button + live hint, the v578 pattern）. Expressible today: _tool_who() already takes any subset. |
| the public line | the card states which way it is on its face, before anyone accepts a card:「发牌人看得见全部」/「发牌人也不知道」. Conceal must be visible — a dealer who could secretly see every hand would make the whole deal untrustworthy. ⚠ REVISED v628（owner）: the line is OFF the card. The default's removal follows this table's own reasoning（a warning that is always on is one nobody reads）; the sighted case went with it. The fact survives on the deal_settle record and in the panel's riding note — put the line back on the OPENER line, not as a row, if a game ever contests the dealer's sight. |
| when blind | _deal_note()'s existing language stays verbatim:「YOU DO NOT KNOW who holds what … never guess at, hint at or reason from anyone's card」. That is what makes the safe default safe — a blind GM knows it is blind and says so, instead of improvising（the Cameron-class failure）. |
| who sets it | the card, once cards exist（T5 — a scenario states what it needs, so the model needs no memory）; until then the SP's dealing exemplar shows it set（in-context shape moves compliance — v553）. Per ruling ⑫ this is a harnessing problem and must NOT be solved by giving the persona a privileged default. |
⚠ Do not lose the GM's copy in the migration. The shipped _deal_note() hands the panel the map every turn while a deal is live, bound like a sealed note（「he may reason from it and must never say it」）. This contract's earlier draft said only「per-viewer render」and never mentioned it — a faithful migration could silently drop it and reintroduce exactly the bug this section exists to fix. When task A generalizes the binding, the deal's note should fold into that one mechanism（both branches — knows-the-map and blind）rather than surviving beside it as a special case.
Accept: a 6-card werewolf deal gives exactly the declared multiset; a devtools/wire read of another player's payload contains no card of mine; a face-up deal shows all hands at once; the creator's reveal opens everything with the reveal bubble; an old room's legacy deal capsules still replay. Plus the toggle: default-blind for a human AND a persona dealer（the panel's note says it does not know）; toggled on, the dealer sees every hand and the card says so publicly; the coercion locks（dealt-in ⟹ toggle off, and vice versa）; a blind GM asked who the wolves are says it cannot know rather than guessing; a sighted GM opens a den by the generic invite without naming anyone in visible speech. All met v625 — the wire check from three seats（exactly one row carries content on each and it is that seat's own, the viewer-less broadcast none at all, 盲发牌 none even for its holder, and the paired「present after the reveal」that stops the absence test proving itself）; the sighted dealer's own payload carrying every hand while the players' still carry one; the coercion refusing a dealt-in dealer's eyes on the server AND locking the switch in the dialog; and live on DeepSeek — Tess emitted <roll deck="狼人×2, 平民×1" for="u7,u8,u13" into="safe" dealer="sees" label="身份牌"/> from a plain ask, refused「谁是狼」without leaking a face, opened one hand with <reveal who="u8"/>, and — dealt a deal it had NOT made — answered「牌是你们自己发的，我没经手——谁拿了什么，我不知道」and then refused to guess. Two things the build settled that this card did not say: the toggle is the DEALER's, and the panel is only sometimes the dealer（a human who runs the game sees every hand on their own wire while the panel stays a blind player — v565 was right about a player who deals and over-broad only about a dealer who does not play）, and a deal's player reveal is REAL — it is the one kind that has had a per-row record since T3, which is what ruling ③'s「own row only」needs and what task B's sealed roll still lacks.