Architecture

Components

Component	Owner	Runs on	Port
Quest app	Stephen	Quest 3S
Pre-op service and Scalpal	Matthew	Mac or hosted	8787
Gateway	Nathan	Mac or hosted	8788
Body registration	Stephen	Mac, USB to the headset	8790
Vitals (Presage)	Silas	Mac	8791
Vision	Matthew	Mac	8792
Realtime (SpacetimeDB)	Nathan	local or Maincloud	3000
Dashboard	Nathan, styled by Silas	browser	5173
Motion pipeline	Silas	Mac

Shared session state lives in SpacetimeDB. The headset publishes its exercise state and events. The dashboard and Scalpal read them. All tables are private, and clients only see sessions they belong to.
Big files, like video clips, never go through the database. The gateway hands out short-lived signed URLs for uploads and downloads.
Provider keys stay on the services. The gateway issues ElevenLabs and TURN credentials as grants, so keys never reach a client.
Local services on the Mac reach the headset over USB with adb reverse. On the headset, localhost is the headset, so this is how it reaches the Mac.

A few rules hold across every component:

Camera image coordinates, Unity world coordinates and robot coordinates are always kept separate and named.
When registration is invalid, scoring pauses and misleading anatomy is hidden.
Missing hand landmarks in a clip are reported as gaps, never filled in.
Synthetic and demo data is always labeled.