TURING_SURFACE_CACHE_KEY=... npx https://.../fill.tgz npm installs a tarball from a URL as happily as from a package name, so nothing goes to the registry: the deploy workflow builds the bundle and packs it beside the page, which keeps the command line at the same commit as the app it fills the cache for. The published manifest depends on neither numbl nor a checkout -- the compiler is bundled in, as it is for the page -- and its only real dependency is h5wasm, whose node build reads its wasm off disk. The walk, the runs and the uploads are the page's, unchanged. What node lacks is WebGPU, so the command brings its own: the optional `webgpu` package of prebuilt Dawn binaries, installed under the globals the transform code expects, as turing-surface's command-line scripts already do. Dawn reaches the GPU through Vulkan or Metal, so a machine without one falls back to a software rasterizer that is fast enough to look like it is working and slow enough to be worth nothing; the adapter and the steps/s are printed, and both a software adapter and a rate below 20 steps/s are called out. It still runs -- that judgment belongs to whoever started it. The key comes from --key, the environment, or a file `login` writes; the environment is what the page will hand out, since argv is visible to every user on the machine through `ps`. --dry-run lists what a machine would take on, --limit and --model narrow it, and ctrl-C stops after the current run. Two things move so that the two front ends cannot drift: the target-to-spec rule (the pinned seed, the longest end time) now lives with the walk, and the page sets its dropdowns from it; and asking whether a key may upload at all is one request in the client, which `login` uses to reject a typo on the spot.