The deck operating system grew a real auth surface tonight — chroma installed end-to-end from scratch; the shell + the convention now extend to every future client deck

DidiDecks has shipped two client engagements so far (calmstorm-decks, chroma-decks) and a third is in flight. Both production sites carry sensitive fundraise materials: portfolio company graphs, named advisors, deal flow that's not for the open web. Calmstorm had an owned-auth gate from day one. Chroma did not — `output: 'static'`, no DB, no middleware, no /access. Tonight that changed: chroma got the full calmstorm pattern installed greenfield (with four exploration-named additions baked in), the shell picked up two latent prerender-bypass fixes that benefit every consumer, and the deck-level organization-naming convention got locked into the parent ai-labs exploration. The pattern is now ready to install into every future client engagement with one well-shaped plan file.