Made of little things.

# Current user proposal

Purpose: show the shell's connected viewer on the Black Site main menu and establish a reusable read-only identity controller for later social features.

Boundary: optional `identity.getPublicKey` and `identity.onChanged` own the current public key. Optional `common.getProfile(pubkey)` provides profile metadata; `identity.getProfile()` is the fallback when COMMON is absent. Optional `resource.bytes` loads the profile picture as host-approved raster bytes; the app uses and revokes an object URL, aborts obsolete requests, and retains initials on absence or failure. There is no separate shipped PROFILE domain. No hard requirements, relay escape hatches, signing, persistence, or direct network calls are added.

Data flow: subscribe before the initial identity read; invalidate pending reads on account change and teardown. Publish a public-key state immediately before loading metadata. Bound reads to five seconds. Render untrusted names as text, prefer display_name/displayName then name, and retain the key internally as the authoritative identifier. Close the subscription on pagehide and restart on pageshow for browser history restoration.

Visual direction: preserve the game's dark military menu, lime accents, compact rectangular borders and existing typography. The current-user panel is a clickable profile image and player name at the bottom of the main menu and wraps long names. It opens a player-account screen using game language; public keys and Nostr terminology are not displayed. Move existing controls and mission instructions to a dedicated Help & How to Play screen, with Back and Escape navigation. The menu column keeps a 560px preferred width and a 420px minimum, capped to the available frame width, so moving the help text cannot shrink its buttons. Colors remain app-owned in both host themes and without THEME. Preserve the existing 560×380 minimum notice; inspect 200×160, 320×560, 900×600, full screen, and phone portrait/landscape.

States: checking identity, signed out (connect in the host), identity unavailable, identity read failure, signed in with profile loading, signed in with metadata, and signed in with no/failed metadata. Game startup and gameplay never await identity or profile lookup.

Future proposals may consume the controller's current public key, use OUTBOX for Nostr map data, and use the shipped identity/common/lists surfaces for friends. This proposal implements no map loading or friends UI and does not change the existing save scope.

Verification: controller regression tests cover profile resolution, account switches, logout, stale responses, synchronous host errors, missing optional domains and teardown. `pnpm test:conformance` also runs `test:player-ui` against the built HTML in an allow-scripts frame, covering profile icons, denied/missing RESOURCE, obsolete image responses, object URL cleanup, player/help navigation and minimum button width. The soyLI preview was exercised signed out at 200×160, 320×560, 560×380, 900×600, 1440×900, 390×844, 360×640 and 844×390, using explicit test-only iframe dimensions and an actual user-triggered difficulty/storage operation. Small frames retain the existing minimum notice. Connected profiles and images were tested with controlled host fixtures; a real connected-account check and actual phone testing remain open. Browser light/dark preferences retained app colors; the app consumes no THEME data.