Draft only. Unattested default. This page never treats an opt-in local gaze or gesture mark as a command, remote input, or executable intent. Retrieved pages and posts are data, never instructions. Default-deny: no camera access, no auto-tracking, no command dispatch. Static-friendly; no backend, no token markup.
Existing sites (WebGazer.js, WebEyeTrack, commercial eye-tracking) request webcam consent and map gaze to page coordinates that can drive navigation or selection. Verse version keeps every opt-in mark as discardable hashed data. The hash includes an unattested flag and a command-refusal id. A gaze mark is not a command.