id: design: graphical client & tooling surface — windowing, world inspector, debug UI #5782

Summary

Design the graphical client and tooling surface for ID as its own space: multi-world windowing, the world inspector, and the debug UI — the graphical layer beyond any single shell implementation.

Motivation

#788 designs one reference shell to prove the shell contract — a conformance artefact. That is a different job from designing the graphical surface people will actually work in. Nothing currently owns: what a multi-world graphical client looks like (windows, presence, several servers at once — the #790 topology made visible); the inspector (the journal, the triple graph, capability grants, and lease state as browsable, first-class objects); or debug tooling (event-stream tailing, replay scrubbing against the determinism infrastructure, fixture-replay results from #558's dev loop shown graphically instead of as terminal text). Every serious session with ID ends with someone wanting to see the journal and the graph; today the only windows are the terminal and the web Explorer, and neither was designed as an inspector.

Sketch

• Windowing & presence: one client, many worlds and servers; what presence means graphically; how worlds are organised, pinned, and found (the id: implement Writer-set view projection - view projection and discovery query (design doc) #5545 discovery query rendered, not just returned).
• The inspector: journal browser (positions, kinds, authors, epochs — including id: design: native-spill write lease protocol for hot worlds (from #2059) #2819 lease state and handoff history); entity/triple explorer following the graph; grant/capability viewer (who can do what, issued by whom, under which delegation — design(id): identity, login & delegation — simplicity-first key custody, security-code recovery, and pseudo-login identities #5684's objects made legible); the writer-set counted/uncounted sides shown side by side, since "uncounted but findable" is a visual idea.
• Debug UI: live event tail per world; deterministic replay with a scrubber (step the journal, watch state rebuild — the determinism infrastructure's fixtures as the source); fuzz/soak failure playback.
• Surface split: which of this is web (Explorer growth), which is native-only, and which must be identical in both — decided here as requirements; framework choice stays with id: Phase 13 F13.6 native client shells on the shell contract #788's record.

Open questions

• Operator tooling vs shipped-to-everyone surface: is the inspector a mode, a separate app, or the same app with authority-gated panels?
• How much graph visualisation is honest at world scale — where does the triple explorer stop helping?
• Accessibility and keyboard-first operation as design constraints, not afterthoughts?
• Does the inspector need write affordances (moderation actions per id(world): F14.6 builder and moderator authority through session frames (F12.3 remainder) #835) or is it read-only by design?

Relations

Parent: epic #2056. Relations: #788 (reference shell — implementation/conformance; this issue is the surface design it doesn't own), #790 (multi-world topology), #5545 (discovery + counted/uncounted rendering), #2819 (lease state display), #5684 (delegation legibility), #835 (moderation surface question), #558 (dev-loop results surface). Filed in the 2026-11-04 gap pass (WS-F) per Drew's order that the GUI gets its own design issue.