`GET /ingest` (`src/routes/ingest.ts`)

The ingest codex — the upstream sources SZL deliberately studied. Wave 1 (2026-07-12): kvcache-ai/ktransformers, zml/zml, GitHub profiles glesmyno + yunawyner. Wave 2 (2026-07-12, org Lean/proof estate — first-party repos, study notes still DECLARED): szl-holdings/lutar-lean, lean-kernel, szl-formula-ledger, szl-lake (the szl-lake entry explicitly resolves the name collision with Lean's `lake` build tool). Wave 3 (2026-07-12, first `article` kind): the NVIDIA Vera "max single-threaded CPU at scale" blog post (© NVIDIA, principles studied, no content re-used) — its agent-loop thesis is APPLIED as the MEASURED loop-tax split on every run (see "Per-run loop tax" below); every Vera perf number in the takeaways stays NVIDIA-REPORTED/partner-REPORTED, never adopted as an SZL measurement. Wave 4 (2026-07-12): lyogavin/airllm (Apache-2.0), applied as the Layer-Fit Codex + loop peak-vs-sum fields. Wave 5 (2026-07-12, two `article` kinds — commercial defense-AI product sites, principles studied, NO assets/content/fonts/copy re-used): **palantir-security-forge** (© Palantir — Security Forge product page) and **lumbra** (© Lumbra — lumbra.ai/mission/technology). Both are studied like the NVIDIA article: every capability/customer/deployment/market claim on those pages is Palantir/Lumbra/press-REPORTED and NEVER restated as SZL fact (Accenture 700k-person, "closes in a single automated loop", Lumbra's IC/DoD production deployments, the Bloomberg $338B figure). Several of their stated convictions are recorded as CONVERGENCE, not adoption — model-family-agnostic pipelines and receipt-backed provenance were already load-bearing in Alloy (multi-provider failover; the ed25519 receipt chain) before the study, so they corroborate rather than seed. The Lumbra entry additionally carries the "fashion thinking" takeaway (`appliesTo: frontend`): Lumbra's visual language (dark canvas, geometric-sans + monospace, 0px corners, oversized headlines, receipts/pass-fail as first-class motifs) is studied as INSPIRATION only — Alloy keeps its own #3af4c8 identity and re-uses no Lumbra amber (#F5C94A), fonts, logo, or copy; the honest lesson is to make Alloy's EXISTING truth-surfaces (receipt chain, honesty labels, pass/fail verdicts) more prominent, not to repaint. The wave also anchors the REAL, checkable field leaders SZL tracks with evidence — arXiv CVE-Bench (2503.17332), SEC-bench (2506.11791, NeurIPS 2025), PatchEval (2511.11019), ExploitBench (2605.14153), and open repos usestrix/strix, vxcontrol/pentagi, SEC-bench/SEC-bench — as the publications/leaders a MEASURED/REPORTED surface may cite instead of marketing. Wave 6 (2026-07-12, `article` kind — **seed-iq**, © AIX Global Innovations, Inc., a quantum concept): the honesty doctrine forces THREE labels never blended. (a) The physics PRIMITIVES the source cites are REAL peer-reviewed literature, verified with DOIs (no-cloning Wootters & Zurek Nature 299:802 1982; teleportation Bennett et al. PRL 70:1895 1993; GKLS/Lindblad Commun.Math.Phys. 48:119 1976; dissipative stabilization Mirrahimi et al. arXiv:1312.2017 2014; + Shor/Steane/Gottesman/Knill QEC). (b) The Seed IQ™ SYNTHESIS that fuses them into a governed teleportation-assisted "restoration" runtime — plus AIX's broader claims (adaptive multiagent control layer, Active Inference, the patented ΑΩ FoB HMC engine, quantum/data-center deployments) — is AIX-DECLARED: SZL audited no code, reproduced no result, measured nothing; the Zenodo report (zenodo.org/records/20585365) is AIX-authored and unaudited by SZL, never restated as SZL fact. (c) **Alloy is a CLASSICAL orchestrator with NO quantum hardware and claims none** — every mapping is an explicit ANALOGY / design inspiration held on the SZL side of the line, sharpening only how Alloy talks about and renders its OWN classical provenance (the (output, receipt) pair mirrors Seed IQ's (ρᴸ, Mₜ); recompute-per-request receipts mirror "restore, don't copy"; UNAVAILABLE/self-verify damping mirrors dissipation-as-restoring-force; chainStatus VERIFIED/PARTIAL/BROKEN/EMPTY mirrors Mₜ admissibility) and changing NONE of its actual mechanism. The `frontend` "fashion thinking" takeaway takes the governed-value/restore/commit/admissibility VOCABULARY as inspiration only — no AIX asset/logo/colour/trademark treatment re-used, Alloy keeps #3af4c8. Wave 7 (2026-07-12, `repo` kind — **omnigent** = omnigent-ai/omnigent, Apache-2.0, alpha): an open-source meta-harness orchestrating Claude Code/Codex/Cursor/OpenCode/Hermes/Pi + custom YAML agents with policy governance, OS (bwrap/seatbelt + L7 egress) and cloud (Modal/Daytona/E2B/CoreWeave/K8s/Databricks) sandboxing, session portability and live collaboration. Studied honestly: SZL has NOT run it, audited no code, reproduced no benchmark, re-uses no code/logo/asset — only its live GitHub meta (stars/pushedAt/SPDX) is REPORTED. Convergences recorded as CONVERGENCE not adoption (Alloy's multi-provider router + failover already generalize the meta-harness idea one level down; the ed25519 receipt chain already embodies governed accountability). The one genuinely-new idea — a first-class policy engine (per-action approval gates, enforced spend caps, tool allow-lists) — was recorded as a DECLARED gap at study time, then closed for real in two same-day steps (2026-07-12): spend cap + provider allow-list first, per-action approval gates after — the registry entry now records the gap as FULLY CLOSED with the E2E evidence, and the `GET /policy` section above documents all three gates. OS-sandboxing is noted as LIMITED-applicability (Alloy orchestrates bounded model calls, not arbitrary shell). Wave 8 (2026-07-12, `repo` kind — **neuro-jepa** = NYUMedML/Neuro-JEPA, arXiv 2606.14957, built on V-JEPA 2): a 3D ViT + MoE (2 shared + 16 experts, 6 active) foundation model self-supervised over 1,551,862 brain scans with the JEPA latent-predictive objective (predict the latent representations of masked regions from visible context — online encoder + EMA target, never voxel reconstruction). **Split license, recorded verbatim and never blended**: code MIT (© 2026 The NeuroJEPA Authors), weights CC-BY-NC-ND-4.0 (gated, HF card 401), GitHub SPDX NOASSERTION, paper CC BY 4.0. EVERY performance/accuracy/dataset number stays paper-REPORTED — SZL ran nothing, downloaded no gated weights, reproduced no benchmark, re-uses no code/weights/figure/asset; only the live GitHub meta (stars/pushedAt/SPDX) is REPORTED. The defining JEPA move — verify/predict in a compact DERIVED latent space rather than the raw object — is OPERATIONALIZED as the `latentVerification` MEASURED coverage block on `GET /invariants` (see that section): honest ANALOGY only, Alloy's "latent space" is a cryptographic digest+signature, NOT a learned embedding, nothing trained or predictive, changes no mechanism and does not upgrade Λ. Wave 9 (2026-07-12, `article` kind — **compute-pillars**, an OWNER-SUPPLIED UNATTRIBUTED PASTE): a CPU/GPU/LPU/NPU "4 pillars of modern computing" cheat sheet pasted with NO author, byline, publication, date, or URL — so authorship and license are UNKNOWN, recorded verbatim, and the entry renders with NO source link (`url: ""` — `IngestCodex.tsx` renders an honest non-link span, never a fabricated href; its GitHub meta is `NOT_APPLICABLE` like every article). The honesty split: the four silicon CLASSES are real checkable product categories (CPUs/GPUs universally; "LPU" is Groq's marketing name for its inference ASIC; NPUs ship in phone/laptop SoCs), but ALL of the piece's framing — the analogies, the CPU→GPU→NPU→LPU "evolution" arrow, "one-size-fits-all is officially dead", "burning your budget", the un-benchmarked LPU speed claims — is the anonymous author's editorial viewpoint, author-REPORTED at best, never SZL fact. APPLIED exactly as far as evidence reaches: the **fleet substrate ledger** on `GET /backbone/status` (see "Other windows") — own metal is the only claimable substrate ("GPU", DERIVED from the szl-meter's NVML evidence; class only, never a die/SKU claim); every cloud provider is honestly UNKNOWN (silicon unobservable through an OpenAI-compatible API — Google's TPU marketing stays Google-REPORTED, OpenRouter is doubly unobservable); LPU/NPU are honestly ABSENT from the fleet and never claimed. The "ecosystem of specialists" conclusion is CONVERGENCE with Alloy's pre-existing multi-provider router (one layer up the stack), not adoption. Two labels, split explicitly:


`GET /ingest` (`src/routes/ingest.ts`)

Wave 10 (2026-07-12, agent-memory study — one `article` + three Apache-2.0 `repo` kinds): **perplexity-brain** (© Perplexity, "Self-improving Memory for Agents" blog, Jun 18 2026 — Brain is a CLOSED product SZL cannot inspect; its load-bearing reframe is the work-memory axis: remember what the AGENT did, what worked/failed/got corrected, not user-profile memory; every headline figure (+25% correctness on seen-before tasks, +16% recall, −13% cost on historical-context tasks) stays Perplexity-REPORTED "early measurement", methodology undisclosed, NEVER an SZL number), **zep-graphiti** (getzep/graphiti — bi-temporal never-overwrite invalidation with valid-time + provenance; structural cousin of the append-only receipt ledger, CONVERGENCE), **mem0** (mem0ai/mem0 — consolidation write-path add/update/merge/noop; SZL's doctrine forbids the silent delete/overwrite branch — any future synthesis pass PROPOSES with provenance, never rewrites; LOCOMO benchmark wins stay Mem0-REPORTED and publicly contested), and **letta-memgpt** (letta-ai/letta — LLM-as-OS tiered context paging; "self-improving" honestly read as memory-EDITING, not weight training). Key honesty findings recorded in the entries: Alloy's run ledger + receipts ALREADY constitute a provenance-linked work-memory store (CONVERGENCE, not adoption — Brain names the axis Alloy was on); the genuine gap is a scheduled synthesis pass, and the shipped `GET /memory` organ (see its section below) does the honest request-time version. Full leader survey (10 systems incl. MemOS, A-MEM, Reflexion, Voyager) + the SZL Brain design brief live in `.local/reports/brain-push/memory-leaders.md`.


`GET /ingest` (`src/routes/ingest.ts`)

Wave 11 (2026-07-12, hallucination/decay study — two `article` + four `repo` kinds): **ferguson-decay-ledger** (© John Ferguson, "The Hallucination Was Peer-Reviewed" — his "Decay Ledger" coinage is credited wherever the term is used; his hop-decay node model is studied as HIS thesis and applied only as a labeled ANALOGY in `/decay`'s anti-decay map), **topaz-fabricated-citations** (© the authors — the Lancet fabricated-citation audit, PRIMARY; its figures carried with primary-vs-press status preserved, including the Retraction Watch 4,406-vs-4,046 transposition recorded VERBATIM as a demonstration of the thesis inside its own coverage), **semantic-uncertainty** (Farquhar et al. semantic-entropy repo — studied; `/decay`'s probe is ANALOGY ONLY to it: no NLI clustering, no sequence probabilities), **selfcheckgpt** (Manakul et al. — the sampling-consistency family the probe actually belongs to), **hallucination-tooling-survey** (Vectara leaderboard et al. — tooling landscape, scores stay THEIR scores), and **provenance-frontiers** (Sigstore/Rekor transparency-log lineage — CONVERGENCE with the receipt chain, not adoption). Applied surface: `GET /decay` + `DecayLedger.tsx` (see its section below).


`GET /ingest` (`src/routes/ingest.ts`)

Wave 13 (2026-07-14, frontier-retrieval study — one `article` + five `repo` kinds, `appliesTo: second-brain`/`honesty-doctrine`): **rrf-cormack2009** (© ACM 2009, Cormack/Clarke/Büttcher SIGIR 2009, DOI 10.1145/1571941.1572114 — the ONE technique ADOPTED in code: `/brain/ask` display order is now the RRF fusion, k=60 DECLARED from the paper, of BM25 + distinct-term coverage; equation re-implemented from the text, no code re-used; the paper's effectiveness wins stay the paper's — fixture tests pin implementation exactness, never quality), **graphrag** (microsoft/graphrag MIT — retrieval-through-relations thesis; convergence with the Brain Atlas is labeled ANALOGY: SZL edges are shared-rare-words, theirs are LLM-extracted; LLM community summaries baked into the index = generated prose in a MEASURED lane → DECLARED roadmap gap, blocker named), **splade** (naver/splade, license VERBATIM CC BY-NC-SA 4.0 © NAVER Corp. — NON-COMMERCIAL: study ONLY, no code touched; learned sparse expansion names the vocabulary-mismatch ceiling of the lexical lane, and needs a trained expander SZL does not have — un-adopted on both legal and evidentiary grounds), **raptor-rag** (parthsarthi03/raptor MIT — recursive-summary tree; its internal nodes are generated prose that gets CITED = worst-case taint under the citation gate; DECLARED gap, not adopted; SZL's honest abstraction layer is its hand-authored doc chunks), **colbert** (stanford-futuredata/ColBERT MIT — late-interaction MaxSim; per-query-term-evidence shape is ANALOGY to the coverage ranker, token identity not token meaning; neural encoder = the dependency wall the lane is DEFINED by staying behind — verifiability over ceiling, now a DECLARED design position), **bm25s** (xhluca/bm25s MIT — eager sparse scoring = the named MIT-licensed optimization path if the corpus ever grows; adopt-when-measured, not adopt-because-frontier; their 500x figures stay THEIR benchmarks). Corpus stays 269; nothing trains/evaluates/upgrades Λ.


`GET /ingest` (`src/routes/ingest.ts`)

Wave 14 (2026-07-14, open-weights-frontier — six `article` kinds, HF model cards where each vendor declares its own license, `appliesTo: frontier`/`honesty-doctrine`): **glm-5-2** (zai-org/GLM-5.2, MIT — card tag license:mit verbatim), **kimi-k2-6** (moonshotai/Kimi-K2.6, Modified-MIT — the lane-truth study: Alloy's moonshot lane pins `kimi-k2.6`, and wave 14 verifies that id EXISTS with this identity and license on the primary source; "verified" is precisely bounded — the model exists, Alloy has never served it, the lane stays honestly offline until MOONSHOT_API_KEY lands, and no capability claim transfers from card to app), **deepseek-v4** (deepseek-ai/DeepSeek-V4-Pro + DeepSeek-V4-Flash as ONE family entry, MIT — the alias lesson: the deepseek lane pins the `deepseek-chat` serving alias, so the served model is UNKNOWN until the provider response names it; the run receipt reports the SERVED id verbatim and the UI never captions the lane "DeepSeek V4" — an alias pin buys currency at the price of not knowing the model until the response arrives), **minimax-m3** (MiniMaxAI/MiniMax-M3, license recorded VERBATIM as HF license:other + license_name minimax-community + LICENSE link — no "effectively Apache" paraphrase; the wave-13 SPLADE precedent stands: license TEXT, not license vibe, gates any step beyond study), **mistral-large-3** (mistralai/Mistral-Large-3-675B-Instruct-2512, Apache-2.0), **qwen3-235b-a22b** (Qwen/Qwen3-235B-A22B, Apache-2.0 + on-repo LICENSE link). ZERO adoptions — every benchmark/price/positioning figure (e.g. DeepSeek's SWE-bench Verified 80.6% Pro number) stays the vendor's/reviewers' REPORTED claim, never SZL fact. Corpus stays 269; nothing trains/evaluates/upgrades Λ.


`GET /ingest` (`src/routes/ingest.ts`)

- **DECLARED** — the registry itself (`src/data/ingestRegistry.ts`, generated from the ingest-wave clone packets): SZL's OWN authored distillations of each upstream's techniques. Each source carries its upstream `license` and `attribution` VERBATIM ("Apache-2.0", "MIT"; profile study notes marked as observational; first-party org repos say so outright). The takeaway notes are our own writing ABOUT the upstream — NEVER a claim of authorship over upstream code, nothing re-badged; `evidence` points at the upstream's own files, or — when the lesson came from a probe rather than a file (e.g. the Lumbra branding extract) — states that probe basis verbatim (null when the packet recorded none); `appliesTo` names the SZL surface each lesson targets (szl-nemo / sovereign-serving / forge-training / frontier / lean-ledger / backbone-loop / honesty-doctrine / frontend — the client `IngestCodex.tsx` has a per-value chip color and a neutral fallback, so a new value never breaks rendering). The profile entries honestly record the negative finding (synthetic template-repo farms) — an honest negative is a finding, not a smear: stated as observation with the enumeration basis.
- **REPORTED** — live GitHub metadata fetched per request-cycle: repos get `stargazers_count`/`pushed_at`/`license.spdx_id` from `GET /repos/{id}`, profiles get `public_repos` from `GET /users/{id}` (Bearer `GITHUB_TOKEN` when present — same egress note as frontier — keyless fallback preserved; 8s timeout). Per-source honest `UNAVAILABLE` with the real failure reason and null numbers — one dead lookup never poisons the others and numbers are never invented. Sources of kind `article` have NO GitHub identity: their meta block is `NOT_APPLICABLE` (reason "web article — no GitHub identity to fetch") — no fetch is EVER attempted, it is a healthy terminal state distinct from `UNAVAILABLE`, and it never shortens the cache window.


`GET /ingest` (`src/routes/ingest.ts`)

10-min cache only when NO source's GitHub meta is `UNAVAILABLE` (`NOT_APPLICABLE` counts as healthy), else 30s negative window; in-flight dedup; 30/min rate limit. Payload validated through `GetIngestResponse` (Zod) before serving. Rendered by `IngestCodex.tsx` (full-width band below FormulaCodex|ThesisCorpus, above the footer — never in a narrow column): per-source header (link, license chip, REPORTED meta line or amber UNAVAILABLE), attribution verbatim in italics, collapsible DECLARED takeaway list with appliesTo chips + evidence links, and the doctrine note rendered verbatim.


`GET /velocity` (`src/routes/velocity.ts` + `src/data/velocitySnapshot.ts`) — Terminal Velocity tracker

The agentic-frontier tracker answering "who leads *terminal velocity*". Doctrine split, three labels never blended:

- **DECLARED** — the snapshot itself (`src/data/velocitySnapshot.ts`): hand-captured on the stated `capturedAt` dates, NOT live-fetched (tbench.ai is JS-rendered, Artificial Analysis is gated), so there is **no upstream call and no cache** — the source URLs are the live truth and the block says so. Edit deliberately and bump the `capturedAt` fields on refresh.
- **REPORTED** — every leaderboard SCORE is the upstream board's OWN published number, copied verbatim (`basis: "REPORTED"` on each board). A blank upstream cell is `null` (rendered "no number"), **NEVER a fabricated figure** — e.g. Claude Fable 5 and GPT-5.6 Terra carry `score: null` on the TB 2.1 board because the captured table published no number for them.
- **MEASURED / NOT_EVALUATED honesty** — the two Terminal-Bench harnesses are **SEPARATE boards** (`tb-2-1-official` self-reported vs `tb-hard-artificialanalysis` independent, ~26 pts apart) and are **never merged, averaged, or unified** into one ranking; each caveat states what THAT board measures and why its scale differs. Inference-speed leaders (Cerebras/SambaNova/Groq, tokens/sec) are a DISTINCT axis from capability scores and captioned as such. Alloy's sovereign model is `NOT_EVALUATED` — no Terminal-Bench run exists, it is never assigned a score, and the note states Alloy **TRACKS** the frontier and routes toward it, it does not beat it. `sovereign.eval` carries the **reproducible path to a real score**: the OFFICIAL Terminal-Bench harness shipped at `docs/forge/eval-terminalbench.ps1` (Harbor / terminus-2 agent), run on owner metal (Docker + a reachable sovereign endpoint — the Alloy container has no Docker, so it cannot run here); `runStatus` is `RUN_PENDING` and `result` stays `null` until a REAL signed run lands, at which point it renders as its OWN board (never merged with the two upstream boards — a low score is honest, never faked). `gapNote` records the MEASURED reality that the frontier moved to the GPT-5.6 family while the Replit AI gateway measured those ids UNSUPPORTED (2026-07-12), so Alloy pins GPT-5.5 + Gemini 3.5 Flash.


No live fetch, so no cache/dedup; 60/min rate limit; static `no-store`. Payload validated through `GetVelocityResponse` (Zod) before serving. Rendered by `TerminalVelocity.tsx` (full-width band immediately below `FrontierRadar`, never a narrow column): two-column masonry of the SEPARATE boards, each row rank/model/provider + REPORTED score (or "no number"); a **live pin-join** overlays an "Alloy pin" badge on rows whose model matches Alloy's currently-pinned provider models (read live from `GET /backbone/status` `providers[].model`, normalized lowercase / spaces-hyphens-underscores-stripped so "GPT-5.5"↔"gpt-5.5" — dots kept; empty when the status is unavailable, an honest absence never a fabricated pin); then the tokens/sec speed leaders, the NOT_EVALUATED sovereign callout, the "Make the run" eval-harness panel (`block-velocity-sovereign-eval`) — RUN_PENDING with the runnerPath while `result` is null, upgrading to a MEASURED result board once a real signed run lands — the MEASURED `gapNote`, and the doctrine note verbatim.


`GET /leaders` (`src/routes/fieldLeaders.ts` + `src/data/fieldLeadersRegistry.ts`) — Field Leaders radar

The per-field leader radar — the generalization of the one-off Terminal Velocity wall. Three honesty grades, never blended:

- **REPORTED rows** — per field, the current leading repos on the Hugging Face Hub, fetched LIVE keyless and passed through verbatim (`/api/models?search=…|pipeline_tag=…&sort=downloads&direction=-1&limit=5`; the datasets field uses `/api/datasets?sort=downloads`). `downloads`/`likes` are the Hub's OWN counters (missing → `null`, never invented). **Caption doctrine (binding)**: each field's caption states EXACTLY what its ordering means — a `search=` query is a **NAME-MATCH** ("popularity of repos whose name matches the term — never capability, never field leadership"); `pipeline_tag=` is the Hub's own task taxonomy; the datasets field is "most-downloaded, all domains". Fields: agentic (search=agent, links `/velocity` for the real benchmark picture instead of duplicating scores) · reasoning (search=math) · quantization (search=gguf) · retrieval (pipeline_tag=sentence-similarity) · multimodal (pipeline_tag=image-text-to-text) · biomed (search=medical) · security (search=security) · datasets (Hub downloads).
- **DECLARED `szl` stance** — per field, SZL's OWN position (`stance: LEADS | TRACKS | ATTEMPTED | NOT_EVALUATED`, `label` always DECLARED, falsifiable `basis`, live `evidenceUrls`). **SZL is NEVER inserted into anyone else's ranking** — the UI renders the stance in a visually separate band captioned "DECLARED stance — not a row in this list". LEADS is claimed on exactly TWO fields where receipt-backed evidence exists (sovereign-serving: own-metal default routing + MEASURED NVML energy + full-ledger; verifiable orchestration: Ed25519 hash-chained receipts + browser-verified Living Paper claims + trustless offline verifier), each basis scoped "among our studied set" and naming what would falsify it. Everywhere else: TRACKS / ATTEMPTED / plain NOT_EVALUATED (agentic stays NOT_EVALUATED — no Terminal-Bench run; reasoning ATTEMPTED never upgrades Λ).


- **NOT_TRACKED ≠ UNAVAILABLE** — the two differentiator fields (sovereign-serving, verifiable) have `query: null` because no meaningful public query exists: honest `NOT_TRACKED` with an intentionally EMPTY leaders list (the DECLARED basis carries the weight). A failed upstream fetch is `UNAVAILABLE` with empty rows — never invented ones.

Cache: whole window 10 min when every fetchable field is OK, 5 min when some degraded, 30 s only when ALL fetchable fields failed (negative window); in-flight dedup; bounded fan-out ≤6 (~8 Hub calls/refresh); 60/min limiter. Payload validated through `GetFieldLeadersResponse` (Zod). Rendered by `FieldLeaders.tsx` — full-width wall directly after TerminalVelocity: 2/3-column masonry of field cards (leader rows with Hub numbers verbatim + ordering caption + separate stance band + Hub source link), doctrine footer verbatim from the payload.


`GET /forge/family` (`src/routes/forgeFamily.ts` + `src/data/szlModelFamily.ts`) — SZL Forge Family

The DECLARED model-family roadmap for the owner's Codex-designed sovereign agent family, joined against the live Hugging Face Hub. Never-blended bands (DECLARED registry · REPORTED Hub · DERIVED model-join · ReceiptAgent + Khipu release-contract/forge-evidence · DERIVED Second-Brain DATASET):

- **DECLARED `declared.models`** (static registry, `src/data/szlModelFamily.ts` — fetches NOTHING) — 4 entries: two `WEIGHT_MODEL` (SZL-Forge-1.5B-ReceiptAgent, SZL-Khipu-1.5B — Hub repo renamed 2026-07 from SZL-Khipu-1.5B-BrainNavigator, old links redirect; the join matches the LIVE id) + two orchestration planes (Ayllu `COUNCIL_PLANE`, Yupaq `COMPUTE_PLANE`; `trainingStatus: DECLARED_PLAN` — a plan, NOT a weight artifact). The static registry keeps every weight model at the honest floor (`trainingStatus: UNTRAINED`, `evalStatus: NOT_EVALUATED`); at serve time the route's `reconcileDeclared()` upgrades a weight-model row to `TRAINED_RECEIPT_VERIFIED` / `EVAL_RECEIPT_VERIFIED` ONLY when that model's OWN fail-closed forge-evidence band (committed owner-signed receipts, ed25519-verified per request) reports it — planes pass through untouched, a model with no verified receipt stays UNTRAINED, and zero eval numbers are ever invented (eval figures live in the verified eval receipt, never typed into the registry). Per-entry `base`/`adapter`/`capabilityProfile`/flags (`proposalOnly`/`receiptBound`/`failClosed`) + `reportedClaims[]` are DECLARED design intent; owner-laptop figures are carried as REPORTED strings VERBATIM (the label lives in the string, never re-badged as fact). Only the two weight models carry an `expectedHfRepoId` (a reserved id — existence is DERIVED in the JOIN band, never asserted). **Ayllu (this DECLARED 11-persona model-routing council) is DISTINCT from the deployed Ayul 10-role research council in `/council` — different plane, different count, never conflated.**


- **REPORTED `hub`** — a LIVE keyless probe of the SZLHOLDINGS org's models (`huggingface.co/api/models?author=SZLHOLDINGS&limit=100`, UA-stamped, `AbortSignal.timeout`), passed through EXACTLY (per-repo id/pipelineTag/downloads/lastModified, the Hub's OWN counters — missing → null). `status: OK` with the enumerated repos, or honest `status: UNAVAILABLE` + `note` on any fetch failure (zero invented repos). The Hub claims no total so none is invented.
- **DERIVED `join`** — publish state for each weight model, DERIVED by matching its `expectedHfRepoId` against the live `hub` repos: `PUBLISHED` = a repo with that id EXISTS (repo existence ONLY — NEVER a trained/serving claim; `matchedRepoId` names it), `NOT_PUBLISHED` = Hub healthy + no match, `UNKNOWN` = the Hub probe failed (publish state cannot be determined — never fabricated). Planes are not joined (no reserved id).
- **DERIVED `brainDataset`** — the Second-Brain in-repo lane's public projection, published to the Hub as a **DATASET** (DATA, never a model — so it lives OUTSIDE the model `join` and has its OWN keyless probe: `huggingface.co/api/datasets?author=SZLHOLDINGS&limit=100`, own 10-min/30 s cache + in-flight dedup). `publishStatus` is DERIVED against that datasets probe (`PUBLISHED`/`NOT_PUBLISHED`/`UNKNOWN`, repo-existence ONLY, `matchedRepoId` names it; `datasetUrl` set ONLY when PUBLISHED). `corpusBinding` compares the COMMITTED dataset manifest's superset fingerprint (`BRAIN_DATASET_MANIFEST.supersetCorpusSha256`, from the fs-free `src/data/brainDataset.data.ts`) against the SERVED corpus fingerprint (`BRAIN_CORPUS_MANIFEST.corpusSha256`): `BOUND` when equal, `DRIFTED` when not (flagged LOUDLY — amber). **This is a committed-manifest ↔ served-corpus binding, NOT a Hub byte verification** — Hub bytes are never fetched, so PUBLISHED is repo-existence only, never a synced-bytes/serving/trained/eval claim. `projection` carries the MEASURED public counts (publicChunkCount = doc chunks + the 269-formula corpus + DECLARED ingest takeaways, MINUS the excluded owner-infra OWNER-SETUP.md chunks; supersetChunkCount / excludedChunkCount / projectionSha256 / a `secretScan` verdict are all DERIVED at gen time). **The exact figures live ONLY in the committed manifest, never transcribed into this prose** — this doc is itself ingested into the corpus, so hardcoding a corpus-derived count here would drift it the moment the doc changes. The committed `brainDataset.data.ts` is byte-parity-tested against the generator (`renderDatasetDataModule`) + the manifest is `toEqual`-tested vs `buildPublicDatasetProjection().manifest`, so it can never silently drift from the served corpus. A BM25 score over these chunks is lexical relevance, NEVER correctness; the two Brain lanes never blend; the owner's private Brain is never published.


Cache: 10-min positive / 30 s negative window (keyed on hub status), in-flight dedup; the datasets probe has its OWN identical cache. Both probes run in parallel (`Promise.all`). Payload validated through `GetForgeFamilyResponse` (Zod). Rendered by `SzlForgeFamily.tsx` — full-width wall directly after CouncilRegistry: verbatim doctrine, a DERIVED posture summary (`models.every(...)` — never asserted), the DECLARED model grid, the live Hub band, the publish-join table, the ReceiptAgent + Khipu release-contract/forge-evidence bands, and the Second-Brain DATASET band (BAND 8 — DERIVED publishStatus, DERIVED corpusBinding with DRIFT loud/amber, projection counts, Hub link only when PUBLISHED). Cross-referenced from `SecondBrain.tsx` via the SAME `useGetForgeFamily` hook (react-query dedupes by query key — no extra fetch, no `/brain` churn): a link surfaces ONLY when `publishStatus === PUBLISHED` && `matchedRepoId`. UNTRAINED/UNKNOWN/DRIFTED render amber (pending — never red as failure, never green as success); receipt-verified statuses render as good ONLY because the payload derived them from verified receipts; even the wall's footer prose is DERIVED (the blanket "weights UNTRAINED" clause renders only while no verified receipt has flipped any weight model); PUBLISHED never upgrades training; nothing here upgrades Λ.


`GET /quant` (`src/routes/quant.ts` + `src/lib/quantMath.ts` + `src/data/quantClaims.ts`) — Quant engine

Real quant-finance math run for real over the estate's OWN series — the honest answer to "find the top quant repos/arXiv and make it ours": study the leaders (REPORTED, cited), run their methods for real (DERIVED), claim no advantage not MEASURED (ROADMAP). Deterministic and DB-free (pure math + a seeded panel), so the whole window is stable per boot — nothing fetched, nothing persisted.

- **SIMULATED panel** — `simulatedPricePanel()` in `quantMath.ts` builds a deterministic price panel (mulberry32 PRNG, one latent market factor + idiosyncratic noise; 24 assets × 252 observations at a fixed seed). It is a **labeled simulation, disclosed everywhere** (provider.name/label/status/note, panel.label, doctrine, OpenAPI description, and a UI provider band + an `OVER SIMULATED PANEL` header chip) so DERIVED-over-SIMULATED can never be mistaken for DERIVED-over-live-market-data. Wiring a real market-data provider replaces ONLY the panel — the math below is unchanged and stays DERIVED.
- **DERIVED math** (all computed in-process from the panel's own returns, never a claimed benchmark):
  - **Ledoit-Wolf (2004) shrinkage** — `ledoitWolfShrinkage()` returns the data-estimated intensity δ ∈ [0,1] toward a scaled-identity target μI (analytic, no tuning parameter).
  - **RMT eigen-cleaning** — sample covariance → correlation (unit diagonal → σ²=1) → Jacobi eigenvalues (validated: trace preserved, known matrices exact) → Marchenko-Pastur edge λ± = (1±√q)² with q = assets/observations. Eigenvalues strictly above λ₊ are signal (kept verbatim); the sub-edge bulk is replaced by its average, **preserving total trace exactly** (Laloux/Bouchaud/Potters 1999 convention). `signalEigenvalues`, `bulkAverage`, `cleanedEigenvalues`, `varianceExplainedBySignal` all DERIVED.
  - **0-dim topological persistence** — `persistence0()` runs single-linkage (union-find) over the Mantegna metric √(2(1−ρ)); n points → **n−1 finite bars + 1 infinite bar** (death:null), the exact H₀ barcode. `longestFinite`, `finiteBars` DERIVED.


- **REPORTED claims** (`quantClaims.ts`, `QUANT_CLAIMS[7]`) — the leaders in the space carried verbatim WITH citations, never as SZL results: Ledoit-Wolf 2004, Marchenko-Pastur 1967, Laloux-Bouchaud 1999, Gidea-Katz 2018 (arXiv:1703.04385), Mantegna 1999, giotto-tda 2021 (arXiv:2004.02551), NVIDIA RAPIDS/cuML. **Every row has `szlMeasured: null` and `status: ROADMAP`** — SZL asserts NO measured advantage and NO GPU speedup (a GPU speedup cannot be MEASURED on this container — typing a number would be fabrication). Each carries an honest `szlPosture` (implemented-as-DERIVED / partially-implemented / reference-tool / not-measured).
- **Formula corpus tie-in** — `total` = `FORMULA_CORPUS.length` (MEASURED at runtime, 269), `lockedProven` = 8 (DECLARED — mirrored from the Lean no-axiom `locked_count_eight`, never re-derived here). The note explicitly rejects the "180 formulas" over-claim as having no verified source. Nothing here upgrades Λ (stays Conjecture-1).

`quantLimiter` 20/min; payload validated through `GetQuantResponse` (Zod). Rendered by `QuantEngine.tsx` — full-width wall directly after FieldLeaders (before the FormulaCodex|ThesisCorpus band): DERIVED + `OVER SIMULATED PANEL` header chips, SIMULATED provider/panel band, three DERIVED math cards (shrinkage δ bar, RMT eigenvalue spectrum with signal bars accented above the MP edge, H₀ persistence barcode), a MEASURED/DECLARED formula-corpus band, the REPORTED cited-leaders list (each with a `cite` link + `szlPosture`), a rendered provenance legend, and the doctrine footer verbatim.


`GET /lean` (`src/routes/lean.ts`)

The Lean proof ledger window for szl-holdings/lutar-lean — three honesty grades in one payload, never blended:

- **REPORTED `ci`** — the repo's OWN latest GitHub Actions verdict per workflow (`lake-build.yml`, `lean.yml`): `GET /repos/szl-holdings/lutar-lean/actions/workflows/{wf}/runs?per_page=1&branch=main` (Bearer `GITHUB_TOKEN` when present, same egress note as frontier; 8s timeout). Verdicts pass through EXACTLY as GitHub returns them — a `failure` conclusion renders red as-is (at capture 2026-07-12: lake-build #499 `failure` and lean #757 `success` on the SAME sha 85dee499 — both shown; cherry-picking the green one or re-polling an older sha until green would be fabrication by omission). Honest `UNAVAILABLE` with the real reason when the fetch fails.
- **REPORTED `numbers`** — the repo's own machine-generated corpus counts fetched from its committed `.github/data/lean_numbers.json` (raw.githubusercontent.com): declarations / axiomsUnique / sorriesRaw / sorriesNoncomment + the `ref` the counter ran at, all VERBATIM — the server never recounts, never rounds, never re-attributes them to a different ref. `lockedProven` = the frozen DECLARED set of 8 {F1,F4,F7,F11,F12,F18,F19,F22} (matches FormulaCodex's locked-proven chips; changes only by explicit re-lock — last re-lock 2026-06-10 when F4/F7 were upgraded from vacuous placeholders to genuine proofs, machine-enforced by the no-axiom theorem `Lutar.Wave8.AxiomDisclosure.locked_count_eight`).
- **MEASURED `localKernelCheck`** — the verdict of an actual `lake build` of the Λ-relevant targets (Lutar.Invariant, Lutar.Uniqueness, Lutar.Uniqueness.TheoremU, Lutar.Round13.Lambda_Uniqueness, Lutar.Puriq.Formulas.ProvedFormulas) run in THIS container by `.local/lean-lab/run-lean-lab.sh` (elan → clone → `lake exe cache get` → targeted build; Mathlib compiled from source is infeasible on 2 vCPU, hence the cache). The verdict lives in `src/data/leanKernelCheck.ts` as a committed constant transcribed VERBATIM from the lab's `kernel-check.json` — sha, toolchain, lean version, targets, build seconds, host, checkedAt. In dev, a guarded fs read prefers a fresher `.local/lean-lab/kernel-check.json` when present (lab output visible without redeploy); prod serves the committed constant only. A FAIL is transcribed as FAIL — never retried at an older sha until green. `UNAVAILABLE` (with note) until a run completes; PASS means exactly "these targets kernel-checked at this sha on this hardware", nothing more. First completed run 2026-07-12T06:01:08Z: **PASS** @ sha 85dee499, toolchain v4.18.0, 2761/2761 lake jobs, 15s targeted build after `lake exe cache get` (6471/6471 files), host replit-workspace-2vcpu — transcribed into `leanKernelCheck.ts`. Lab quirks: the platform strips nested `.git` dirs shortly after clone (sha pinned to `.local/lean-lab/pinned-sha` immediately), and long detached processes get reaped — the lab must run as a temporary managed workflow, not `nohup`.


`GET /lean` (`src/routes/lean.ts`)

- **`conjectures`** — doctrine locks rendered from the payload: Conjecture-1 (Λ uniqueness — unconditional uniqueness machine-checked FALSE via the maxAgg counterexample; only conditional Theorem U holds; NO ci pass or kernel-check PASS can upgrade it) and Conjecture-2 (Khipu BFT liveness, Wave23 conditional). Evidence links to the repo's own BOUNTY.md / khipu-consensus.

10-min cache when ci AND numbers are OK, else 30s negative window; in-flight dedup; 15/min (`leanLimiter`); payload validated through `GetLeanResponse` (Zod). Rendered by `LeanLedger.tsx` (full-width band between FormulaCodex|ThesisCorpus and IngestCodex): 3-column grid (CI verdicts / corpus counts + locked-proven chips / local kernel check with provenance lines), conjecture lock rows, doctrine footer verbatim.


`GET /lean/factory` (`src/routes/leanFactory.ts`) — Conjecture Factory

The Conjecture Factory batch ledger — 180 machine-generated Lean 4 candidates, every one judged by the real Lean kernel on THIS container. Despite the name, **the batch contains ZERO conjectures**: every candidate is an INTEGERIZED concrete instance of an already-SYMBOLIC corpus identity, with declared lineage per candidate; CONJECTURE-class corpus items (Conjecture-1 Λ-uniqueness, Conjecture-2 BFT) are DECLARED excluded with reasons and stay open.

- **Pipeline** (`.local/lean-lab/factory/`): `generate.py` — deterministic template generator (sha256 recorded in the payload; double-run diff clean), 160 candidates across 10 integer families (bft-quorum-overlap, rs-singleton-mds, kraft-integer, amgm-square, quadratic-completion, cauchy-schwarz-2d-int, euler-polyhedra, horus-geometric, additivity-linear, quantum-code-params) + 20 sovereign slots + 19 explicit exclusions. `sovereign.py` — drafts ONLY the tactic line for the 20 sovereign candidates via the sovereign chain (tower first, laptop next; one attempt per node, 60s; every attempt recorded honestly incl. HTTP 530s); the STATEMENT stays canonical from the manifest, so a kernel accept certifies exactly the requested statement — a model can never get credit for proving something else. `judge.py` — per-file core-Lean `lean` check from the lutar-lean lab cwd (Mathlib-import checks measured >115s/file → core-only batch; lakefile untouched), incremental `status.jsonl`, final `factory-run.json`.
- **Verdicts** (MEASURED): `KERNEL_ACCEPTED` / `KERNEL_REJECTED` (stderr excerpt verbatim) / `NO_OUTPUT` / `UNAVAILABLE` / `UNATTEMPTED` — failures and offline nodes shown as-is, never backfilled. Run of 2026-07-12T14:41:34Z: **180/180 KERNEL_ACCEPTED** (160 template + 20 sovereign, all 20 tactics drafted by laptop qwen2.5:3b — tower recorded HTTPError 530 per attempt), judge pass 29s, toolchain v4.18.0.


- **Serving**: committed constant `src/data/conjectureFactory.ts` transcribed VERBATIM from the lab's `factory-run.json` (same pattern as `leanKernelCheck.ts`); in dev a guarded fs read prefers a fresher lab file (shape-validated, malformed → warn + fall through), prod serves the committed constant ONLY. Honest `UNAVAILABLE` (run null) until a completed run is transcribed. Own limiter 15/min — deliberately NOT coupled to `/lean`'s GitHub-fetch caching. Payload validated through `GetLeanFactoryResponse` (Zod).
- **Doctrine**: accepts NEVER expand locked-proven (stays exactly 8), NEVER upgrade Conjecture-1/2, and are pipeline evidence, not new mathematics; counts are MEASURED tallies of real verdicts.

Rendered by `ConjectureFactory.tsx` — full-width wall between LeanLedger and OuroborosInvariants: verdict tally pills, provenance line (batch/judge seconds/toolchain/lab sha/generator sha256/host/checkedAt), template vs sovereign tier cards, 10-family grid, candidate rows (non-accepted + sovereign tier by default, all 180 on demand; sovereign rows state "tactic drafted by node · model — statement stayed canonical"), collapsible DECLARED exclusions, doctrine footer verbatim.


`GET /formulas/answers` (`src/routes/formulaAnswers.ts`) — Formula Answers

The combined estate formula corpus, answered by the estate's OWN sovereign model, each answer backed by a signed `/run` receipt. Directly serves the owner's directive: put the formulas up and have SZL-1 answer them, and that's the receipts.

- **Corpus** (`scripts/src/formula-corpus-build.ts` → `src/data/formulaAnswersCorpus.ts`): a DETERMINISTIC 269-entry corpus combining ALL formula sources the estate carries — szl-formula-ledger (30), szl-forge index (80), and the formal-block statements (160, deduped to 159) — each entry keyed by a stable id with `source`/`sourceId`/`statement`/`truncated`. Rebuilt by `pnpm --filter @workspace/scripts run formula-corpus-build`; `corpusSha256` is stable across runs (double-run diff clean). **Formal-block statements are TRUNCATED fragments** carried honestly as `truncated: true` — the UI badges them "fragment" so a partial statement is never shown as the whole formula.
- **Answering** (`scripts/src/formula-answers-run.ts`, `pnpm --filter @workspace/scripts run formula-answers-run`): each formula is posed to the backbone via `POST /run` with the prompt shape `Formula: <statement>\n\nExplain this formula… Answer directly.` (a bare "state X" makes the model punt — the explain-directly shape gets real answers). **Doctrine gate — ACCEPTED only when the run was sovereign-served**: `receipt.payload.ok`, `servedProvider === "sovereign"`, `servedNode` a non-empty string, `chosen` starts with `sovereign#`, and non-empty output. A cloud fallback is REJECTED → the formula stays UNANSWERED (a cloud model must never be recorded answering the estate's own corpus). Canary + 3-consecutive-failure abort; resume-safe incremental writes to `.local/formula-lab/answers-run.json`.
- **Answers are ANSWERS, not proofs**: an ANSWERED entry means the sovereign model produced verbatim text for that statement — it is NOT a correctness claim and NOT a proof. Punts/declines are shown VERBATIM (no decline-detector scrubbing). Recording an answer NEVER changes a FormulaCodex CHECKED status, NEVER expands locked-proven (stays exactly 8), and NEVER upgrades Λ (stays Conjecture-1). Counts are labelled PROVENANCE ("answered by sovereign"), never accuracy. "SZL-1" is displayed ONLY when the served model id is `szl1`; any other served id is shown verbatim.


- **Serving**: committed constant `src/data/formulaAnswers.ts` (`FORMULA_ANSWERS_RUN`) transcribed VERBATIM from the lab's `answers-run.json` (same pattern as `conjectureFactory.ts` / `leanKernelCheck.ts`); in dev a guarded fs read prefers a fresher lab file (shape-validated, malformed → warn + fall through), prod serves the committed constant ONLY. The route RECOMPUTES `counts`/`bySource`/`byModel` from the results (never trusts stored tallies) and re-applies the doctrine gate so a non-sovereign row can never surface as ANSWERED. Honest `UNAVAILABLE` (run null) until a completed run is transcribed. Own limiter 15/min. Payload validated through `GetFormulaAnswersResponse` (Zod). Each answer carries its `receiptId`/`receiptStatus` (SIGNED/UNSIGNED)/`servedProvider`/`servedNode`/`model`/`goalSha256`/`outputSha256`/`latencyMs` — the run receipt IS the provenance.

Rendered by `FormulaAnswers.tsx` — full-width wall between ConjectureFactory and OuroborosInvariants: MEASURED+DECLARED label chip, provenance count pills (answered by sovereign / unanswered / corpus total), corpus-sha/host/apiBase/attemptedAt line, by-source answered/total grid, by-model served-by line, and per-formula rows (unanswered-first, then first 12 answered, all 269 on demand) — each expandable to the verbatim answer text plus the receipt line (answered by <model> on <provider>#<node>, receipt <id>… signed, goal/output digests). Doctrine footer verbatim from the payload.


`GET /paper` (`src/routes/paper.ts` + `src/data/paperClaims.ts`) — Living Paper

The DECLARED spine of the unifying paper "Honesty by Construction" served as a claim-to-source MAP, not as computed data. **`/paper` computes NOTHING and fetches NOTHING** — it returns a static, Zod-validated document: `PAPER_TITLE` / `PAPER_SUBTITLE` / `PAPER_DOCTRINE` plus 8 sections (thesis, doctrine, formal-core, attestation, receipts, invariants, stress-test, limitations) carrying 13 claims. Each claim has `claimId`, DECLARED `text`, a `claimLabel` stating the PROVENANCE of the value it points at (MEASURED / DECLARED / CONJECTURE / ATTEMPTED / NOT_EVALUATED), and a `verify {source, metric, expected, kind, detail}` binding it to the LIVE endpoint that substantiates it. Own limiter; payload validated through the generated Zod schema. The route asserts nothing about correctness — the verdict is computed CLIENT-SIDE.

**The verdict is the reader's, not the server's.** `LivingPaper.tsx` (full-width wall after OuroborosInvariants, before IngestCodex) resolves each claim by reusing the EXISTING shared react-query keys for its source (`/lean`, `/invariants`, `/formulas/answers`, `/receipts/checkpoint`, `/backbone/status`) — NO per-chip fetch (rate-limit safe). `resolveVerdict()` passes each source's own honesty label through:
- **MATCHES** (teal `#3af4c8`): an `EQUALS`/`STATUS_OK`/`CHAIN_VERIFIED` check that holds — e.g. lean `lockedProven.length === 8`, `localKernelCheck.status === "PASS"`, invariants `summary.violated === 0`.
- **LIVE** (accent): a `LIVE_VALUE` surfaced verbatim (e.g. corpus `total`/`answered`, invariants `holds`, Λ conjecture id) — no assertion, just the measured number.
- **PARTIAL** (amber): the receipt `chainStatus === "PARTIAL"` — earliest rows predate the hash chain but NO link is broken; rendered "intact · PARTIAL", **never red**, because representing a non-failure as a failure would itself violate the doctrine. Only `BROKEN`/unknown reads as DIVERGES.


- **DIVERGES** (red, EQUAL visual weight to a pass): live value ≠ expected. A failure reads as a failure.
- **UNAVAILABLE** (amber): source `isError`/`status === "UNAVAILABLE"` — withheld, never invented.
- **DECLARED** (muted): `source: "none"` doctrine statements (honesty label lattice, ten-problems-ATTEMPTED, verification ceiling) — a statement, not a live number.

**Fourth-wall claim** (`receipt-browser`, kind `BROWSER_ED25519`): the flagship `BrowserVerifyChip` runs WebCrypto Ed25519 IN THE READER'S BROWSER over the exact `/receipts/checkpoint` `canonical` + `signature` against the SPKI key from `/receipts/pubkey` — the same verifier extracted to `alloy/src/lib/browserVerify.ts` and shared with `ReceiptChain.tsx`. Honest terminal states only: verified / signature-invalid (equal weight) / "this browser cannot run Ed25519" (never a fake pass) / pubkey-unavailable. The server is never asked to vouch for itself.

**Companion artifacts** (outside the API): `docs/paper/honesty-by-construction.tex` is the ~22pp arXiv-style LaTeX paper whose every quantitative claim is snapshot-dated (12 Jul 2026) and live-checkable against these same endpoints; DOI deposit is an owner action. `scripts/src/verify-checkpoint.ts` (`pnpm --filter @workspace/scripts run verify-checkpoint`) is a trustless OFFLINE verifier — node-stdlib ONLY, zero server/workspace imports — that verifies an archived `{canonical, signature}` against a pinned SPKI key (`--pubkey`/`--checkpoint` files, or `--url` convenience mode which prints a trust-note that the keyId must be pinned out-of-band via `--expect-keyid`). This is the first step of the stated frontier: moving verification OFF the issuing server.


`GET /decay` (`src/routes/decay.ts` + `src/data/decayLedger.ts` + `src/data/consistencyProbe.ts`) — Decay Ledger (ingest wave 11)

The truth-decay wall — Ferguson's "Decay Ledger" thesis (coinage credited), this estate's countermap, and a real self-consistency measurement. **Three bands, each self-labeled, NEVER blended**:

- **REPORTED `thesis`** (`decayLedger.ts` `DECAY_THESIS_CLAIMS`) — the studied decay literature, every claim staying its AUTHOR'S claim: Ferguson's essay (ESSAY), the Topaz et al. Lancet fabricated-citation audit (PRIMARY), Resnik & Hosseini (PRIMARY, normative), and the press layer. `sourceKind` (PRIMARY / ESSAY / PRESS) preserves the primary-vs-press distinction — that distinction IS the thesis. `numbersStatus` is `PRIMARY_CONFIRMED` only where figures were checked against the primary release; UNVERIFIED figures are flagged or omitted, never silently carried. The Retraction Watch **4,406-vs-4,046 transposition** is recorded verbatim (a two-digit press-hop error demonstrating the thesis inside its own coverage); the Nature ~110,000 figure and the GroundedAI count are kept SEPARATE claims, never conflated. `coinage` credits Ferguson explicitly.
- **DECLARED `antiDecayMap`** (`DECAY_ANTI_MAP_HOPS`, 6 hops) — where THIS estate places verification at each hop of its own pipeline (Zod validation at ingress, provenance labels, the Ed25519 receipt chain, in-browser verification, the offline verifier, the honesty audit). Each hop carries its real `mechanism` and a `falsifiableCheck` a reader can run RIGHT NOW. The node framing is a labeled ANALOGY to Ferguson's node model (`analogyNote`), credited — never an adoption of his claims as ours. A design claim, not a measurement.
- **MEASURED `consistencyProbe`** (`consistencyProbe.ts` `CONSISTENCY_PROBE_RUN`, committed-constant pattern like `leanKernelCheck.ts` / `conjectureFactory.ts`) — one completed self-consistency batch transcribed VERBATIM from the lab file (`.local/ingest-lab/wave11/consistency-run.json`; dev prefers a fresher shape-validated lab file, prod serves the constant ONLY; the server never recomputes or re-runs). Batch of 2026-07-12 via `scripts/src/consistency-probe-run.ts` (429-aware: a rate-limited api-server gets a 65s backoff ×5 — a 429 is NOT a node-down): 8 fixed short-answer probes × k=5 samples through `POST /run`, **40/40 sovereign-served** (node laptop, model `szl1:latest` — served ids verbatim). **Only sovereign-served samples count**: a cloud-served attempt is `excludedNotSovereign`, never a sample; errors are `failed`, recorded honestly. Aggregates only — plaintext answers reduced to lexically-normalized clusters (`normalizationSpec` verbatim in the payload — falsifiability requirement, as is each exact `prompt`). `agreementRatio` = top-cluster share (HEADLINE metric); `discreteEntropy` (bits) secondary — coarse at small k. `INSUFFICIENT` (<2 sovereign samples) means agreement is UNDEFINED, not zero. **Family honesty**: sampling-consistency family (SelfCheckGPT, Manakul et al.); ANALOGY ONLY to semantic entropy (Farquhar et al., Nature 2024) — no NLI clustering, no sequence probabilities. **Agreement is NEVER correctness** — probe p2 proves it in the shipped data: 4/5 samples agreed on a WRONG product (491 for 17×23), recorded verbatim as 0.8 agreement; a consistent model can be consistently wrong. `null` run = honest UNAVAILABLE band, never a fabricated batch.


`legend` names every label used (REPORTED / PRIMARY-ESSAY-PRESS / DECLARED / MEASURED / ANALOGY / UNAVAILABLE). Nothing here upgrades Λ (stays Conjecture-1) or expands locked-proven (stays 8). Static data + committed constant → no upstream fetch, no cache; own limiter 15/min; payload validated through `GetDecayResponse` (Zod). Rendered by `DecayLedger.tsx` — full-width wall directly after LivingPaper, before IngestCodex: three labeled band cards in doctrine order (thesis claims with sourceKind chips + numbersStatus flags + verbatim quotes, numbered hop map with mechanism/falsify lines, probe rows with cluster chips + headline agreement% + entropy/served-node metadata + collapsible normalization spec), the legend strip, and the doctrine + coinage-credit notes verbatim.


`GET /brain` + `POST /brain/ask` (`src/routes/brain.ts` + `src/lib/brainIndex.ts` + `src/data/brainCorpus.*` + `src/data/brainAskContract.ts` + `src/data/brainIndexEvidence.ts`) — Second Brain (grounded RAG)

The knowledge wall — grounded retrieval-augmented answering under the estate's honesty doctrine. **Two lanes that NEVER blend**: an in-repo lane that is MEASURED and actually served, and the owner's real private Brain that stays UNAVAILABLE (fail-closed) until a signed manifest verifies in-app. A BM25 score is MEASURED lexical relevance, **NEVER** correctness; the loop cites retrieved chunks or **abstains** — it never fabricates. Nothing here trains, evaluates, or upgrades Λ (stays Conjecture-1) / expands locked-proven (stays 8).

- **MEASURED `inRepo` lane** (`buildInRepoLane()` over `brainCorpus.data.ts` `BRAIN_CORPUS_MANIFEST` + `brainIndex.ts` `BRAIN_INDEX_STATS`) — the committed, deterministic corpus that is the ONLY lane that answers. Built-time generated (`brainCorpus.gen.ts`, mirroring `khipuCurriculum.gen.ts`), committed, **NO runtime fs read** (prod gates fs off); the corpus distils curated `docs/*.md` + the 269-formula corpus + ingest takeaways into chunks. `corpusSha256` is a real content fingerprint that changes iff the chunk set or any chunk text changes (determinism test enforces this). Reported counts are enumerated: `chunkCount`, `bySource` (doc / formula / ingest), `formulaCount`, `ingestTakeawayCount`, and per-`docFiles` `{name, sha256, chunks}`. Retrieval (wave-13 adoption, 2026-07-14): the candidate set is exactly the BM25 (k1=1.5, b=0.75) match set, display-ordered by **Reciprocal Rank Fusion** (`RRF_K=60`, a DECLARED constant from Cormack, Clarke & Büttcher SIGIR 2009 — studied in ingest wave 13) of two MEASURED lexical rankers: classic BM25 + distinct-term coverage. Fusion reorders which grounding surfaces first; it NEVER manufactures a hit BM25 did not find, never drops one, and the retrieval floor still gates on the best RAW BM25 score, so abstention behavior is unchanged — GUARANTEED, not assumed: `searchBrain` force-includes the global BM25 rank-1 chunk in the returned top-k (deterministic last-slot swap), so the gate basis is provably the global BM25 max, and a test pins this for every query/k. Each hit's `score` stays the raw BM25 number. Fixture tests pin IMPLEMENTATION exactness of the published equation — never a retrieval-quality claim (the paper's effectiveness wins stay the paper's). Still dependency-free, with MEASURED `vocabSize` / `avgDocLen` and a DECLARED `retrievalFloor`. The `/brain/graph` adjacency deliberately stays PURE BM25 (`rankBM25`) — the graph's doctrine promise is "top-k BM25 nearest neighbors"; fusion is an ask-ranking choice, not an adjacency re-definition. `served: true` — this lane is real.


- **Fail-closed `realBrain` lane** (`brainIndexEvidence.ts` `computeBrainIndexEvidence()`, a COPY of `khipuEvidence.ts` — not a refactor) — the owner's private knowledge graph whose content is NOT in this repo. Status is DERIVED from evidence, never asserted: `NO_OWNER_KEY` (no committed `owner_pubkey.json`), `INDEX_MANIFEST_UNAVAILABLE` (no signed manifest), `INDEX_MANIFEST_INVALID` / a divergence reason (any of the 5 checks fail — flagged LOUDLY), or `INDEX_MANIFEST_VERIFIED` (owner-signed, ed25519-verified against the committed key + pinned `A11OY_BRAININDEX_OWNER_KEYID`). The 5 checks: `payload-shape` (Zod `IndexManifestPayloadSchema`: kind `szl-brain-index-manifest`, v 1, int≥0 counts), `wrapper-keyid-matches-owner`, `embedded-key-matches-owner`, `canonical-matches-payload` (the Python signer's `canonical_json` byte-matches TS `canonicalJson` — strings+ints only, NO floats), `ed25519-signature`. **Even a VERIFIED manifest does not wire live serving** — `serving` stays `NOT_WIRED_IN_REPO` (`keyTrust: REPO_DECLARED`); node/edge/chunk counts are the manifest's REPORTED owner-metal figures, never invented here. Verified end-to-end 2026-07-13 in a throwaway dir (keygen → index → sign → verifier flips to `INDEX_MANIFEST_VERIFIED`, all 5 checks pass, serving unchanged); the committed kit ships with **no** `owner_pubkey.json` on purpose (honest `NO_OWNER_KEY`, not a placeholder that would trip the verifier). Kit: `docs/forge/brainindex/` (`index_brain.py`, `sign_manifest.py`, `RUNBOOK-BRAININDEX.md`, `.gitignore`).
- **`POST /brain/ask`** — a grounded, cited answer over the **in-repo lane only**, gated by the SAME policy path as `/run` BEFORE any provider call (run-key required via `requireRunKey`; the policy engine — spend cap + provider allow-list + approvals — refuses first; denied ≠ ledger row) — but a brain-ask is NOT a `/run`: it is never written to the run ledger, so its own cost is not self-billed against the rolling-24h spend cap. Loop: (1) retrieve top-k (`DEFAULT_K` 5, `MAX_K` 8) — BM25 candidate set, RRF-fused display order (see the inRepo lane above); **if the best raw BM25 score is below the DECLARED retrieval floor → `ABSTAINED` immediately**, the provider is never called and nothing is billed (fusion reorders grounding, never manufactures it). (2) Otherwise pose the question to `runBackbone` with ONLY those chunks as numbered `[S#]` sources, instructing cite-or-abstain. (3) Parse `[S#]` citations — the gate is **FAIL-CLOSED**: every cited source must be one of the retrieved chunks, so ANY cite to a non-retrieved chunk (a **hallucinated citation**) forces `ABSTAINED` on the whole answer rather than being silently dropped (a rendered dangling cite would be a fabrication). `ANSWERED` requires ≥1 valid citation AND zero out-of-range ones, else `ABSTAINED`. A demo run (no live provider) can't self-cite and thus honestly `ABSTAINS` rather than present ungrounded output. (4) The result is gated through `BrainAskResultSchema` (`brainAskContract.ts`) — a dishonest instance is unrepresentable (`groundedOnly` structural, `citedChunkIds ⊆ retrieved`, answer null unless ANSWERED) — and carries `corpusScope` (`BRAIN_CORPUS_SCOPE`), the MEASURED `retrieved` rows (chunkId / source / sha256 / BM25 `score` / `matchedTerms`), and the `retrievalFloor`.


- **`brain-ask` receipt** (`buildBrainAskReceipt()` in `lib/receipts.ts`) — a distinct receipt kind, ed25519-signed via the SAME HKDF-from-`SESSION_SECRET` key, over a canonical binding the corpus fingerprint, the retrieved chunk hashes, the cited subset, the decision, and the answer hash (plaintext never leaves the runner). **Does NOT mutate the run-receipt v1 canonical** — reuses `canonicalJson`/`sha256Hex` only; honestly `UNSIGNED` when `SESSION_SECRET` is unset. In-browser Ed25519 re-verify in the wall via `AskReceipt`.

`legend` names every label used (MEASURED / BM25 score / ANSWERED / ABSTAINED / UNAVAILABLE); the verbatim `doctrine` and `note` strings are served on `GET /brain`. Static corpus + committed constant → no upstream fetch, no cache; status limiter 30/min, ask limiter 15/min; payloads validated through `GetBrainResponse` / `AskBrainResponse` (Zod). Rendered by `SecondBrain.tsx` — full-width wall directly after DecayLedger, before IngestCodex: the two lanes side-by-side (in-repo MEASURED stats + per-source counts + docFiles fingerprints; real-Brain fail-closed status card, amber when UNAVAILABLE, with the derived reason and the 5-check breakdown), an ask box (run-key aware), and the `AskResult` (cited answer with `[S#]` chips linking to `RetrievedRow` BM25-score rows, abstain state with the honest reason, and the `AskReceipt` in-browser verify). Amber is SEMANTIC (UNAVAILABLE / ABSTAINED / pending) — never swept to teal.


Other windows

- **`GET /backbone/status` — fleet substrate ledger (ingest wave 9)** — every provider in the payload carries `substrate` / `substrateLabel` / `substrateBasis` (all required in the `Provider` schema; the hand-maintained SSE mirror `alloy/src/lib/backbone.ts` `BackboneProvider` changed in lockstep). Only two labels exist ON PURPOSE: `DERIVED` solely for the sovereign provider (`substrate: "GPU"` — the szl-meter exporters sample NVML energy counters on the serving nodes and NVML exists only on NVIDIA GPUs; class evidence derived from MEASURED samples, NEVER a die/SKU/model claim) and `UNKNOWN` for every cloud provider (serving silicon is unobservable through an OpenAI-compatible API and is never guessed — gemini's basis records that Google markets TPU serving as Google-REPORTED and unverifiable; openrouter's basis records the per-request vendor roulette as doubly unobservable; huggingface's the router fan-out). No LPU/NPU is claimed anywhere. `ProviderFleet.tsx` renders a Substrate row per provider (basis on hover/title, accent color only for DERIVED) plus a wave-9 caption stating the ledger's rules; the offline mock roster claims NO substrate at all.
- **`GET /grid`** (`src/routes/grid.ts`) — GB grid window, KEYLESS UK Carbon Intensity API (`intensity` + `generation`), server-side 5-min in-memory cache, 30/min limit; honest `UNAVAILABLE` when the upstream fetch fails.
- **`GET /orbital`** (`src/routes/orbital.ts`) — live ISS fix (`api.wheretheiss.at`, NORAD 25544) + NASA POWER daily surface solar irradiance (`ALLSKY_SFC_SW_DWN`, kWh/m²/day; `-999` fill → `null`, never faked). Anchor point env `ORBITAL_LAT`/`ORBITAL_LON` (default Killinchy NI 54.533/-5.664). 5-min cache only when ALL blocks OK — any failed block drops TTL to the 30s negative window. 30/min limit.
- **`GET /organism`** (`src/routes/organism.ts`) — live organ status for 11 curated SZL organs: brain = `khipu-consensus` GitHub repo `pushed_at` (uses `GITHUB_TOKEN` when present — anon GitHub API 403s from this egress — keyless fallback preserved), the rest = public HF Space `runtime.stage` (keyless). Per-organ honest `UNAVAILABLE`, 5-min all-OK / 30s negative cache, in-flight dedup, 20/min limit. Rendered by `OrganismPanel.tsx` (left column; brain + anatomy top-billed).


Other windows

- **`GET /backbone/mesh/probe`** (`src/routes/mesh.ts`) — MEASURED live reachability of all 5 own-metal hosts (gpu/gpu2/gateway/meter/meter2). Per-node verdicts: `LIVE` (2xx), `GATED` (401/403 — reachable but auth-walled, e.g. gpu2 behind CF Access), `NO_ROUTE` (404 — tunnel up but nothing serving that path, e.g. gateway), `TUNNEL_DOWN` (530), `SERVICE_DOWN` (≥500), `UNREACHABLE` (network error). 15s cache. Rendered by `EstateMesh.tsx`.
- **`GET /backbone/mesh/history`** (`src/routes/mesh.ts`, status-page pattern, MEASURED) — the last 24h of RECORDED probe rows (cap 2000), grouped per host, each row `{probedAt, httpStatus, status, latencyMs}` in chronological order. `count` = enumerated rows ONLY — no fabricated buckets; gaps in time are just gaps. **CRITICAL cache-honesty**: rows are written by `recordMeshProbes()` fire-and-forget (lazy guarded `import("@workspace/db")` exactly like `runLedger.ts`, so a missing `DATABASE_URL` logs "ledger disabled" and never crashes boot or breaks a probe) called ONLY from `runProbe()` — a real upstream probe. The 15s cache-hit path and in-flight-dedup awaiters NEVER record, so every row is a distinct real observation and `probedAt` is the real probe time (`checkedAt`), not insert time. Persisted in the Drizzle `meshProbesTable` (`mesh_probes`: id / probedAt / host / httpStatus / status / latencyMs). Honest empty state: a fresh DB returns `hosts: []`, `count: 0`. Honest `UNAVAILABLE` with a `reason` when the ledger DB cannot be read (no bars invented). Retention: rows older than 7 days are pruned fire-and-forget after each real probe record (storage hygiene only — the read window is 24h, so nothing servable is ever deleted; a prune failure is logged, never surfaced). `meshLimiter` = 15/min. Rendered by `EstateMesh.tsx` as a per-host uptime strip (one bar per enumerated row, same LIVE/GATED/… palette, `no probes recorded yet` when empty, caption "MEASURED · recorded real probes only · gaps are gaps").


Notarized receipts, flywheel, honesty audit (one-of-one surfaces)

- **Notarized run receipts** (`src/lib/receipts.ts`, `src/routes/receipts.ts`) — every `/run` + `/run/stream` result (success AND failure) carries a `receipt` block: ed25519 signature over a canonical JSON payload containing ONLY sha256 hashes of goal/output (plaintext never leaves the runner), the full routing-attempt trail (provider/model/node/ok/error/latency), servedNode, demo flag, and a hash-chain `prevHash` linking stored receipts (genesis for the first). Signing key derives deterministically from `SESSION_SECRET` (HKDF); when unset the receipt is honestly `UNSIGNED` with a note — never a fake signature. `GET /receipts/pubkey` (public verify key + keyId), `POST /receipts/verify` (verifies the EXACT canonical string + base64 signature — never re-canonicalizes; also `receiptId` lookup of stored receipts). Receipts persist in Postgres `receiptsTable`; storage failure never fails the run.
- **`GET /flywheel/status` + `GET /flywheel/export.jsonl`** (`src/routes/flywheel.ts`) — sovereign flywheel: MEASURED count of training samples captured from runs actually served by own metal (`servedNode != null`, non-demo, ok). Status public; `export.jsonl` is run-key gated (401 without key). Honest zero when nothing captured; `UNAVAILABLE` when the DB is unreadable. Rendered by `FlywheelPanel.tsx` (left column after Telemetry).
- **`GET /honesty`** (`src/routes/honesty.ts`) — live honesty audit: the server reports on its OWN caches via `honestyPeek()` exported from the 8 REPORTED windows (grid/frontier/verticals/organism/orbital/darpa/mesh/estate). Cache-only — the endpoint NEVER triggers upstream fetches (an audit that changed the system would be dishonest); per-block `OK` / `UNAVAILABLE` / `NOT_YET_FETCHED` + lastFetchedAt + sources + verbatim doctrine text + `signingConfigured`. Rendered by `HonestyAudit.tsx` (right column, top).


- **Public routing proof (UI)** — `RunConsole.tsx` renders the per-attempt routing trail from the `done` event (✓/✗, provider·node, model, latency, the REAL upstream error string) plus the receipt block (receiptId, keyId, copy canonical+signature bundle, verify endpoints). The routing pill shows `signed · ed25519` when the receipt is signed, `unsigned-honest` otherwise.
- **Routing waterfall (UI, observability pattern)** — `RoutingWaterfall.tsx` (imported by `RunConsole.tsx`) draws the SAME per-attempt trail as a horizontal latency waterfall: one row per attempt, bar length proportional to that attempt's MEASURED server-side `latency_ms`, scaled to the total run `latencyMs` (or, on the error path where no total exists, the slowest measured attempt — both derived only from measured numbers, never guessed). The served attempt (matching `decision.chosen`, or the last `ok` attempt) is highlighted (`bg-accent` + `served` badge); failed attempts keep the destructive/dim treatment with their honest `error` text. Client-only render of data already in the `done`/error payload — NO server change, NO new fetch. **No fabricated segments**: an attempt without a finite `latency_ms` renders `no timing` and an empty bar track, never a default width. Block header labelled `MEASURED server-side latencies`; demo runs pass their `demo` flag through to the caption. Empty attempt list → renders nothing.
- **Public receipt chain** (`GET /receipts/recent`, `runLedger.ts getReceiptChain`) — the last 20 run-ledger rows in chain order with the tamper-evident sha256 chain RECOMPUTED server-side over the returned window on EVERY request (MEASURED — the content hash re-derives from the stored signed receipt JSON, else the canonical core-facts rendering, exactly mirroring the insert path; link continuity checked newest-first against each older row's rowHash). Per-row `verified` is true/false/null — null means the row PREDATES the hash chain, stated never guessed. `chainStatus`: VERIFIED (every link recomputes) / PARTIAL (pre-chain rows present) / BROKEN (a link failed) / EMPTY. Entries carry hashes + routing facts only — goal/output/error plaintext NEVER leaves the ledger. Public, 60/min rate limit, honest UNAVAILABLE when the DB is unreadable. Rendered by `ReceiptChain.tsx` (left column, after FlywheelPanel).


- **Signed chain checkpoint** (`GET /receipts/checkpoint`, transparency-log pattern) — recomputes the receipt hash chain over the ledger window PER REQUEST via the existing `getReceiptChain(10000)` machinery (NEVER trusts a stored flag), then builds the canonical string `a11oy-checkpoint\ncount:<n>\nhead:<headHash|EMPTY>\nchain:<VERIFIED|PARTIAL|BROKEN|EMPTY>\nat:<iso>` and ed25519-signs it via `signCheckpoint()` (`lib/receipts.ts`), reusing the SAME HKDF-from-`SESSION_SECRET` key as run receipts. Response: `{label:"MEASURED", canonical, signature|null, signingConfigured, count, headHash, chainStatus, generatedAt, verifyHint}`. `count` = enumerated rows only; `headHash` = the chain tip (EMPTY when no rows). Honest **UNSIGNED** (signature null, stated in `verifyHint`) when `SESSION_SECRET` is unset; honest **UNAVAILABLE** (no canonical fabricated) when the ledger DB is unreachable. Anyone re-verifies by POSTing the EXACT `{canonical, signature}` to `POST /receipts/verify` — which for a non-JSON checkpoint canonical simply skips the receipt keyId cross-check and verifies ed25519 over the exact bytes (JSON receipts still get the keyId rotation hint). `receiptsLimiter` = 60/min. Rendered by `ReceiptChain.tsx` as a top "SIGNED CHECKPOINT" block: chainStatus badge, count, truncated head hash (full in title), honest signed/unsigned state, the server's own `verifyHint`, and the exact `canonical` in a collapsible monospace block for independent verification.


`GET /memory` (`src/routes/memory.ts`) — Memory organ (ingest wave 10)

Alloy's honest answer to the "self-improving agent memory" pattern (Perplexity Brain, wave 10): a WORK-memory window — what the agent DID — derived 100% from surfaces already measured, nothing invented. All MEASURED over the enumerated ledger window (window cap 250, reads via `runLedger.ts getMemoryRunRows` — bounded, invariants-style; plaintext goal/output/error NEVER selected, that surface stays key-gated). Blocks:

- **`episodic`** — last ≤30 runs summarized (endpoint/mode/requested→served provider/node/model/ok/demo/errorFamily/latency/costStatus), each carrying `provenance {receiptId, signed, keyId}` — the field's "every memory links back" pattern, ours cryptographic (ed25519 receipt), never a hyperlink-only claim. `errorFamily` is a keyword bucket (timeout/rate_limit/auth/quota/network/upstream_5xx/all_providers_failed/other), null on ok.
- **`lessons`** — per-provider AND per-node MEASURED tallies (served/failed counts, top error families, mean latency). These are COUNTS honestly labeled — never "insights" or fabricated learning claims. Attribution honesty: failed runs carry no servedProvider (ledger invariant), so provider failures are attributed only when a specific provider was requested; `auto` failures name no provider.
- **`corrections`** — persisted `requested≠served` failover events only (demo runs excluded). The per-run `routing_decision.attempts` chain is NOT persisted as a column, so intra-run upstream-failure counts are deliberately NOT claimed — the block's `note` states this ledger gap outright.
- **`selfReview`** — `{synthesizedAt, windowSize, basis, doctrine}`: synthesis is computed PER REQUEST over the enumerated rows — the doctrine line says plainly that Alloy does request-time synthesis, NOT an overnight "memory consolidation" pass, and `windowSize` is enumerated rows only, never a claimed lifetime total.


Honest top-level `UNAVAILABLE` + reason when the ledger DB is unreachable. `memoryLimiter` = 15/min; payload validated through `GetMemoryResponse` (Zod). Rendered by `MemoryPanel.tsx` (right column, first band, directly after HonestyAudit — full-width wall order untouched): per-block MEASURED/UNAVAILABLE chips, signed/unsigned provenance per episode, lessons as counts, corrections events or honest "no delta". No mechanism changed; `/run` shape and the hand-maintained SSE mirror untouched.


`GET /invariants` (`src/routes/invariants.ts`) — Ouroboros invariants

MEASURED runtime self-consistency invariants, recomputed per request over the enumerated ledger window (`INVARIANT_LIMIT = 10_000`; count = enumerated rows ONLY, never a claimed total). Public (hashes + row ids only — plaintext goal/output/error is NEVER selected; that surface stays key-gated on `/runs/recent`). `invariantsLimiter` = 15/min. Honest top-level `UNAVAILABLE` (with `reason`) when the run-ledger DB is unreachable; nothing fabricated.

**Doctrine (binding).** Every invariant here is FALSIFIABLE — it can be VIOLATED by real ledger corruption, receipt tamper, or a write-path regression. A check that is TRUE BY CONSTRUCTION (cannot fail) is verification THEATER and is deliberately EXCLUDED — this is why the loop-tax reconciliation identities (`overheadMs = max(0, wall−modelMs)`, `serializationTaxMs = max(0, modelMs−peak)`) are NOT surfaced here, and why the loop check asserts only the lower bound `loopSteps ≥ 1` (the per-run upper bound `targets.length` is not persisted, so any fixed ceiling would be an invented number). These are RUNTIME consistency checks and are DISTINCT from the Lean proof corpus (`/lean`, `LeanLedger.tsx`): NONE of them prove or upgrade Λ, which stays **Conjecture-1**. Each invariant is labelled with its own doctrine line only — NEVER paired with the LOCKED_PROVEN Lean set {F1,F4,F7,F11,F12,F18,F19,F22} (those are Λ-aggregator theorems with no relation to ledger predicates; pairing would imply "proven formulas running live", exactly the theater the doctrine forbids).


Per-invariant shape: `{id, title, predicate (verbatim), doctrineRef, basis:"MEASURED", status, checked, violations, worstRowId, detail}`. `status`: `HOLDS` (every checked row satisfies the predicate) / `VIOLATED` (≥1 does not; `worstRowId` = one offending row's serial id as a concrete example — no ordering/severity claim, `violations` carries the full count) / `KEY_ROTATED` (signed rows exist that were signed under a rotated key — honest, NOT a tamper verdict) / `NO_DATA` (no rows matched the predicate's precondition) / `UNAVAILABLE` (the check could not run, e.g. no signing key to verify). Window summary `{total, holds, violated, indeterminate}` (indeterminate = KEY_ROTATED + NO_DATA + UNAVAILABLE).

The eight invariants (all from persisted data in `runsTable` / `training_samples`; reads in `runLedger.ts` `getInvariantRunRows` + `getFlywheelLineage`, chain reused verbatim from `getReceiptChain`):

1. **receipt-chain-continuity** — REUSES `getReceiptChain(10000)` verbatim (no second implementation — a re-impl would be drift risk and near-theater): chain sha256 links RECOMPUTED; `chainStatus` VERIFIED→HOLDS, PARTIAL→HOLDS (pre-chain rows stated, not a failure), BROKEN→VIOLATED, EMPTY→NO_DATA. `worstRowId` null by design (chain entries carry hashes, not serial ids). The literal Ouroboros — the chain recomputing its own tail.
2. **ledger-failure-shape** — for `ok=false` rows: `servedProvider IS NULL AND latencyMs IS NULL`. Caption states it catches corruption / a write-path regression, NOT runtime correctness.
3. **served-run-has-model** — for `ok=true AND demo=false` rows: `model IS NOT NULL` (a real serve records what served it; demo excluded since demo runs legitimately have no served model).
4. **signed-columns-atomic** — for every row: `(receiptId, signature, keyId, receiptJson)` are ALL present or ALL absent (no half-signed row).


5. **loop-steps-positive** — for `ok=true AND demo=false` rows: `loopSteps ≥ 1` (LOOP_DOCTRINE lower bound only, upper bound deliberately not asserted — see doctrine above).
6. **receipt-ed25519-verify** — for every signed row: `verifyReceipt(receiptJson, signature)` valid under the current key. A row whose stored `keyId` differs from the current signing key and fails is counted `KEY_ROTATED`, never `VIOLATED`. `UNAVAILABLE` when `SESSION_SECRET` is unset (no key to verify — honest, not a judgment). `NO_DATA` when no signed rows.
7. **receipt-columns-consistent** — for every row with a stored receipt: `parse(receiptJson).{receiptId, goalSha256, outputSha256, keyId}` equals the indexed columns (catches canonical/column drift or tamper; a JSON parse failure counts as a violation).
8. **flywheel-lineage** (highest value) — every `training_samples` row that HAS a `receiptId` LEFT-JOINs to a `runs` row with `demo=false AND servedNode IS NOT NULL`. Samples with a null `receiptId` are excluded and the count stated (link honestly unavailable, per the table's own doctrine). The literal Ouroboros of the flywheel: the training loop eating ONLY its own verified own-metal tail.


**`latentVerification` — MEASURED coverage ratio (NOT an invariant), ingest wave 8 (Neuro-JEPA).** Alongside the eight invariants the payload carries a `latentVerification` block: `{status: MEASURED|UNAVAILABLE, reason?, enumerated, verified, verifiedRatio (nullable), rotated, unsigned, tamperFailed, note}`. It is the fraction of the enumerated ledger window whose trust is established purely in **hash/signature space** — `verified` = rows whose ed25519 signature validates over the sha256 canonical bytes under the current key (the ed25519 tally is computed ONCE in invariant #6 and reused; no second verification pass), `verifiedRatio = verified / enumerated`. Honest complements: `rotated` (signed under a rotated key), `unsigned` (rows predating signing / no receipt columns) — neither is a failure; `tamperFailed` (ed25519 hard-fail under the current key) genuinely lowers the ratio. **This is an explicit ANALOGY to the JEPA family's latent-space predictive objective** (Neuro-JEPA / V-JEPA 2 verify over a compact DERIVED space, not the raw object) — but Alloy's "latent space" is a CRYPTOGRAPHIC DIGEST + SIGNATURE, **NOT a learned embedding**: nothing here is trained, predicted, or a model, and it does not prove or upgrade Λ. It is deliberately a coverage metric, NOT a HOLDS/VIOLATED invariant, so it never claims to be a falsifiable predicate it is not. `UNAVAILABLE` when the signing key is unset (verification cannot run) or the ledger DB is unreachable. Live 2026-07-12: 22 enumerated / 20 verified (91%) / 2 unsigned (predate signing) / 0 rotated / 0 tamper.


Rendered by `OuroborosInvariants.tsx` (full-width band between `LeanLedger` and `IngestCodex`; ∞ icon, #3af4c8 accent): summary line (holds/violated/indeterminate + enumerated runs/samples + window cap), the `latentVerification` coverage strip (percentage + verified/enumerated + progress bar + tamper/rotated/unsigned counts + verbatim note), one row per invariant (title, verbatim predicate, status badge, checked/violations/first-offender-row, doctrineRef, detail), the doctrine footer verbatim, and the falsifiability note. Payload typed via generated `InvariantsWindow`/`InvariantCheck`/`InvariantsWindowLatentVerification`; hook `useGetInvariants` (60s stale, 5-min refetch). Live 2026-07-12: 22 runs / 7 samples enumerated, 7 HOLD, 0 VIOLATED, failure-shape NO_DATA (no failed rows in window) — every serving invariant green on the owner's real ledger.


`GET /fourthwall` (`src/routes/fourthwall.ts`) — Fourth Wall (the app observing itself)

The final full-width wall (after IngestCodex, before the footer; `FourthWall.tsx`) — the cockpit turning its labeling discipline on itself. It EXPANDS the small `EstateSelf` fourth-wall block on `/estate` (which stays authoritative in its estate context); this wall adds the process and route census, it does NOT restate the estate block's build-hash prose. Bands, never blended:

- **MEASURED `process`** — direct syscalls at request time: pid, `process.version`, `process.uptime()`, `process.memoryUsage()` rss/heapUsed/heapTotal bytes; `startedAt` is now − uptime at assembly. Nothing cached, nothing typed in — every request re-measures.
- **MEASURED `routes`** — a census enumerated by recursively WALKING the live Express router stack per request (`req.app.router.stack` with `_router` fallback; nested routers via `layer.handle.stack`), deduped `METHOD path` pairs, sorted; `total` and `byMethod` are counted from that same enumerated list, never typed in. The census IS the mounted surface — there is no maintained list to go stale. Express's internal `_all` method key surfaces verbatim as `_ALL` — honest, not renamed. Scope caveat (binding): Express does not store `router.use("/prefix", sub)` mount prefixes on `route.path`, so the census is complete only while every sub-router in `routes/index.ts` stays prefix-free (as today); a path-prefixed mount would render prefix-stripped paths — the walker must be extended to carry prefixes before one is ever added.
- **DECLARED `identity`** — authored sentences labeled as authored (product / org / repo / builtBy / doctrine); the repo is stated, never fetched. The builtBy line breaks the fourth wall honestly: built and maintained by an AI coding agent pair-working with the SZL Holdings owner — the same kind of agentic loop the cockpit orchestrates.


- **DECLARED `crossChecks`** — "identity here is asserted, not proven": links to `/api/build-info` (signed ed25519 build attestation) and `/api/honesty` (self-report). Links, NEVER duplicates — two sources of self-truth would eventually disagree. Client-side, `FourthWall.tsx` composes the cross-check chips from those endpoints' OWN responses (build hash + attestation status; honesty block count + signing flag) — rendered from the responses, never retyped.

NOT added to the `/honesty` WINDOWS list; `/build-info` remains the sole signed build-identity source. No upstream fetch, no cache, no persistence; payload validated through `GetFourthwallResponse` (Zod) before serving.


Cost accounting (gateway pattern, `src/lib/backbone.ts` + `src/lib/pricing.ts`)

`computeCost()` attaches a `cost` block to every `/run` + `/run/stream` result (they share the result builder, so the `done` SSE event mirrors it). The cost is NOT part of the signed receipt canonical — `receipts.ts` has no `cost` field, so this accounting never changes a receipt's shape or hash.

- **DECLARED price table** (`pricing.ts`, LLM-gateway pattern) — a per-model rate card with entries ONLY for models this backbone actually serves (keyed to the exact served model id from `registry.ts`): `gpt-5.5` (default pin since 2026-07-12), `gpt-5.4` (kept for env override), `gemini-3.5-flash`, `deepseek-chat`, `qwen-plus`, `kimi-k2.6`. The gpt-5.6 family (`gpt-5.6` alias → `-sol`, plus `-terra`/`-luna`) is priced on OpenAI's official page but deliberately absent: the Replit AI gateway 400s all four ids (MEASURED 2026-07-12, chat-completions AND responses endpoints), and the table only carries models the backbone can actually serve. Each entry carries `{usdPerMTokIn, usdPerMTokOut, source, asOf}` where `source` is the PROVIDER'S OWN official pricing page (never a blog/aggregator/guess) and `asOf` is the date it was confirmed. Rates are the standard pay-as-you-go per-1M-token cache-MISS in/out rates — no cache/batch/promo discount is assumed. **Omit-if-unverified doctrine**: if a provider's official price cannot be fetched/confirmed, the entry is OMITTED and that model stays `UNKNOWN` (a missing price is honest silence, never a fabricated number). `getPriceEntry(model)` is an exact-id lookup, so an env-overridden/unverified model returns `undefined` and stays UNKNOWN, never priced against a sibling.
- **CostStatus** `ZERO | UNKNOWN | ESTIMATED`. Precedence in `computeCost`: demo → `ZERO` (no provider call made); `openai` → `ZERO` (Replit-AI credit basis — usage consumes paid Replit workspace credits, $0.00 direct vendor charge); `sovereign` → `UNKNOWN` (own-metal, energy metered elsewhere). A keyed vendor with BOTH a DECLARED price for the EXACT served model AND numeric MEASURED usage tokens (`usage.prompt_tokens`/`usage.completion_tokens`, captured at the live call site) → `ESTIMATED`: `amountUsd = (in/1e6·rateIn)+(out/1e6·rateOut)` (rounded to 8dp), with `source`+`asOf` and the basis string EXACTLY `DECLARED <model> pricing (<source>, as of <asOf>) × MEASURED <in>+<out> tokens — estimate, not an invoice`. `vendorCharge` stays `null` on ESTIMATED — it is an estimate, not the vendor's actual bill. Anything without both a declared price and measured tokens stays `UNKNOWN`. `RunLedgerRow.costStatus` (string, nullable — no enum) already accepts `"ESTIMATED"` with no schema change.


- **UI** — `RunConsole.tsx` renders the cost line: `ESTIMATED` → `<$amount> · estimate` (via `formatEstimateUsd`: ≥1¢ → 2dp like `$0.02`, sub-cent → up to 8dp with trailing zeros trimmed, e.g. `$0.00042`) with the verbatim basis (carrying source + as-of); a number is NEVER formatted when `amountUsd` is absent. `ZERO` → `<currency> <vendorCharge>` (green); `UNKNOWN` → `UNKNOWN` (amber) — both unchanged from before. Spec: `CostBlock` schema in `openapi.yaml` has `status` enum `[ZERO, UNKNOWN, ESTIMATED]` + optional `amountUsd`/`source`/`asOf`.


`GET /policy` + run-path policy gate (`src/lib/policy.ts` + `src/routes/policy.ts`)

The omnigent-study (ingest wave 7) DECLARED gap, built for real 2026-07-12 and FULLY closed the same day: an **enforced spend cap**, a **provider allow-list**, and **per-action human-approval gates** over the run loop.

- **DECLARED policy (env, verbatim)** — `A11OY_SPEND_CAP_USD_DAY` (rolling-24h USD cap over ESTIMATED run costs; unset/invalid/≤0 = no cap) and `A11OY_PROVIDER_ALLOWLIST` (csv of provider ids, lowercased; unset/empty = no list). Unset env = the gate is honestly **OPEN**, exactly like `authMode` when `A11OY_RUN_KEY` is unset — never a silently invented default cap.
- **Gate (`gateRun()`)** — runs in both `POST /run` and `POST /run/stream` handlers BEFORE `runBackbone`: a policy rejection means nothing ran, nothing was billed, and **no run-ledger row is written** (denied requests are policy rejections, not runs — keeps `/invariants` predicates untouched). `/run` refuses with JSON `{error, policy:{code, detail}}`; `/run/stream` delivers the same as an SSE `error` event (headers already streaming). Codes: `403 POLICY_PROVIDER_DENIED` (explicit provider outside the list, or `auto` when the list excludes every configured provider), `429 POLICY_SPEND_CAPPED`.
- **Allow-list filters the WHOLE chain** — `RunOptions.allowedProviders` filters the failover chain in `runBackbone` before target expansion, and for `auto` the primary is re-picked to the first configured allowed provider (so neither live failover nor the demo fallback ever serves from outside the list). A list that only checked the requested head while `auto` routed anywhere would be theater.
- **Spend tally (MEASURED, of estimates)** — `runLedger.getSpendWindow(24)`: `SUM(cost_usd)` over the trailing window plus estimated/unknown/zero/total run counts. `cost_usd` (nullable double) is persisted per run ONLY when `costStatus === "ESTIMATED"` (the DECLARED-pricing × MEASURED-tokens amount); ZERO/UNKNOWN rows stay null. The tally is **a sum of estimates, never billing truth** — the basis string says so verbatim; UNKNOWN-cost runs add $0 and their count is surfaced, never hidden. Rows predating the column add $0 (honest: their estimates were never persisted).


- **Soft cap, stated not hidden** — the cap is checked PRE-run against already-persisted estimates (ledger inserts are fire-and-forget after the run), so N concurrent in-flight runs can each pass under the cap and briefly overshoot it (bounded by the 20/min run rate limit × per-run estimate). `POLICY_NOTE` says this verbatim; it is never presented as a hard guarantee.
- **`POST /trials` is policy-gated too** — each fleet trial is a REAL provider call (bounded to 512 tokens/provider). The allow-list applies per row: a disallowed provider is an honest `SKIPPED` with the policy named in `error`, no call attempted. A reached spend cap refuses the whole fan-out with the same 429 shape as `/run`. Caveat stated: trial spend itself is NOT ledgered (trials are not runs), so it never enters the tally — the cap gates trials, trials do not feed the cap.
- **Ledger-down honesty** — cap declared but DB unreachable → enforcement `SUSPENDED_UNMEASURABLE`: runs proceed and `/policy` surfaces the suspension (blocking every run on a DB blip would be enforcing a cap against a number the server does not have; the suspension is public, never silent).
- **Per-action approval gates** (`src/lib/approvals.ts` + `POST /policy/approvals`, built 2026-07-12) — env `A11OY_APPROVAL_MODE=required` turns on a human-in-the-loop gate: every `/run` and `/run/stream` call must present a **single-use approval ticket** in header `x-a11oy-approval`, minted by the run-key holder via `POST /policy/approvals` (key-gated exactly like `/run` — sha256 + timingSafeEqual; 401 on wrong/missing key). Tickets are `apv_`-prefixed random ids stored **hashed (sha256), in-memory only**: 10-min TTL, max 200 outstanding (mint refuses 503 when full — never over-issued), spent atomically check-and-delete BEFORE any provider call — one mint = one explicit human approval for one action; a restart clears them (stated in refusal text). Refusal is `403 POLICY_APPROVAL_REQUIRED` (JSON on `/run`, SSE `error` on `/run/stream`) with a detail that distinguishes "no ticket presented" from "unknown or already spent". Denied requests are never ledger rows (nothing ran). Env states, all stated never silent: unset → gates honestly **OPEN** (exactly like `authMode` without a run key; minting refuses 400 — a ticket for an unenforced gate would be theater); `required` with a run key → **ENFORCED**; `required` WITHOUT a run key → **MISCONFIGURED** (tickets unmintable → mint 503, ALL runs refused with that exact reason — fail closed, never silently open).


- **`GET /policy`** (public, 30/min) — `PolicyReport`: `declared` (env verbatim + source, incl. `approvalMode`), `enforcement` (`spendCap` ENFORCED/OPEN/SUSPENDED_UNMEASURABLE, `providerAllowlist` ENFORCED/OPEN, `approvalGates` ENFORCED/OPEN/MISCONFIGURED), `spend` (MEASURED window or honest UNAVAILABLE), `verdict` (OPEN/WITHIN_CAP/CAPPED/UNMEASURABLE + detail).
- **UI** — `PolicyPanel.tsx` (band 1 right column, under HonestyAudit): verdict dot, declared cap + tally + usage bar, allow-list, three enforcement chips (approval-gates chip live ENFORCED/OPEN/MISCONFIGURED), a MintApproval block when ENFORCED (mint with the run key, ticket shown once with TTL — never stored client-side), a MISCONFIGURED explainer when applicable, verbatim verdict detail, doctrine footer. `RunConsole.tsx` carries an approval-ticket input (sent as `x-a11oy-approval`, never persisted, cleared after the run that spends it).
- **Verified live 2026-07-12** — dev: `/policy` honest OPEN + mint 400 when mode unset; E2E on a second instance with test env: explicit `openai` vs allow-list `[gemini]` → 403 POLICY_PROVIDER_DENIED; tiny cap $0.000001 with a real $0.00168 ESTIMATED gemini run in the window → 429 POLICY_SPEND_CAPPED + verdict CAPPED. Approval gates same day: `A11OY_APPROVAL_MODE=required` → ENFORCED; run without ticket → 403; mint with wrong key → 401; mint → run spends the ticket (served by real provider); same ticket again → 403 "already spent"; `required` with empty run key → MISCONFIGURED, mint 503, run refused with the misconfiguration named.
- **Prod checklist** — republish picks up the code; the prod DB needs the `cost_usd` column on `runs` (dev pushed 2026-07-12); policy env vars are OPTIONAL (unset = honestly OPEN); approval gates activate only if the owner sets `A11OY_APPROVAL_MODE=required` in production.


`POST /arena/run` — Proving Ground (`src/routes/arena.ts`)

One goal fanned across **2–4 explicitly selected lanes**, each lane ONE pinned provider run through the FULL backbone — agent loop, MEASURED `loop` timing, honest `cost` block, its own run-ledger row, and its own notarized receipt (same `wireReceipt` shape as `/run`, exported from `routes/backbone.ts` so verification tooling never sees two formats). Run-key-gated like `/run`; own 6/min limiter (each click is 2–4 real runs).

- **No demo lanes** — every lane must name a CONFIGURED provider or the WHOLE request refuses 400 before anything runs (`validateLanes`, a pure exported function with its own vitest suite). If credentials vanish mid-flight and the backbone demo-falls-back anyway, the lane is returned FAILED with that stated reason and is NOT ledgered (nothing real ran) — a demo lane would be a fabricated comparison.
- **Failover DISABLED across lanes** — `runBackbone` is called with `allowedProviders` as the singleton of the lane's provider, so the failover chain IS that one provider. A failed lane reports `FAILED` with the real error (AllProvidersFailed → failure receipt + failure ledger row, exactly like `/run`); it is never rerouted.
- **Sovereign model pins need MEASURED evidence** — a lane may pin a model ONLY when the live per-node `/v1/models` probe (`lib/forgeProbe.ts`, extracted from `/forge/models`, 60 s cache + in-flight dedup) lists it on an OK node; the lane is then pinned to the EXACT served id on the EXACT evidencing node via `RunOptions.sovereignTarget` (expands to that single node/model target). Unproven ids refuse 400 ("never assumes one"); tag-prefix resolution (`szl1` → `szl1:latest`) never crosses model ids. Cloud model overrides are refused — the DECLARED price table is per registry-pinned model, so an override would break honest cost estimation.


- **Policy** — `gateRun("auto", ticket)` runs ONCE before any lane (one approval ticket approves the one fan-out; spend cap applies). The provider allow-list is enforced **all-or-nothing**: any lane outside it → 403 for the whole arena, nothing runs — silently running "just the permitted lanes" would change the comparison the caller asked for.
- **No winner, ever** — the response is `{label: MEASURED, goal, mode, ranAt, wallMs, doctrine, lanes[]}` with per-lane `{provider, model (the SERVED model from the ok attempt, never just the requested pin), node, status OK|FAILED, output, latencyMs, modelMs, tokensIn/Out, servedNode, cost, receipt, error}`. Quality is NOT scored, there is no ranking field, and the binding doctrine string rides in the payload verbatim. Server output is `ArenaRunResponse.parse(...)` — fail loud, never a silently off-contract payload.
- **UI** — `ProvingGround.tsx` (cockpit left column, under FleetTrials): lane picker offers ONLY configured providers (+ probe-evidenced sovereign served models, labelled with the evidencing node), 2-lane minimum stated ("one lane is a run, not a comparison"), per-lane cards render MEASURED wall/in-model ms, tokens, cost (`ZERO`/`ESTIMATED $`/`UNKNOWN`), receipt status, servedNode, and FAILED lanes red with the real error. Caption verbatim: speed and cost are MEASURED, quality is NOT scored, no automatic winner. 401 → "enter your key in the Run Console".
- **`POST /trials` run-key gate (2026-07-14)** — `/trials` now carries `requireRunKey` like `/run` (a fleet trial is real spend on EVERY configured provider at once); honestly OPEN when no key is set; spec documents the 401. `FleetTrials.tsx` states the gate and renders the 401 hint.
- **Verified live 2026-07-14 (dev)** — 2-lane openai+gemini arena: both lanes OK with SIGNED receipts, MEASURED timings (openai 1289 ms / gemini 45525 ms — a real spread, honestly reported), 2 ledger rows at `/api/arena/run`; 1-lane body → contract 400; unknown provider / cloud override / unproven sovereign pin → honest 400s; keyless arena + trials → 401.


Per-run MEASURED energy (`src/lib/energy.ts` + `src/lib/backbone.ts`)

Every `/run` + `/run/stream` result carries an `energy` block (the `done` SSE event mirrors it). Like `cost`, energy is NOT part of the signed receipt canonical — `receipts.ts` picks explicit fields, so adding energy never changed a receipt's shape, hash, or chain.

- **Source** — the SZL per-box szl-meter exporters (Prometheus text over HTTPS, keyless): `meter.a-11-oy.com` meters the tower's GPU (nodes `tower` + `tower·nemo`), `meter2.a-11-oy.com` meters the laptop's (RTX 5050 Laptop GPU). Per-node mapping lives on `SovereignNode.meterHost` in `registry.ts` (env overrides `A11OY_METER_HOST[_2/_3]`) and rides through `RunTarget.meterHost`; cloud targets carry `null`. Families read: `szl_meter_nvml` (must be `1` in BOTH samples) and `szl_gpu_energy_joules` (NVML total-energy counter, summed across GPUs; may reset on driver reload).
- **Window** — `sampleMeter()` (2.5 s hard timeout, failure never blocks or fails the run) is called immediately BEFORE the serving call on any metered target, and immediately AFTER only on the target that actually served. The window therefore spans the whole serving call including tunnel/network overhead (and excludes the optional self-verification second pass, which runs after the window closes). A failed pre-sample on a target that then serves = honest `UNAVAILABLE` ("no opening sample"), never a retro-guess. Per-run negative cache: a meter host that timed out once is not re-sampled by later failover targets in the SAME run (tower + tower·nemo share one meter) — a downed tunnel costs at most one 2.5 s timeout per host per run.
- **EnergyStatus** `MEASURED | UNAVAILABLE | UNKNOWN | ZERO`. `MEASURED` requires: both samples real + NVML present in both + counter delta ≥ 0. Negative delta (driver reload / counter reset) → `UNAVAILABLE` with that concrete reason — the delta is discarded, never clamped to 0. Cloud-served → `UNKNOWN` (no per-run energy telemetry exists; never estimated). Demo → `ZERO` (no model call was made; nothing metered).


- **WHOLE-GPU caveat (load-bearing)** — the NVML counter is per-GPU, not per-process: a MEASURED window includes ANY concurrent load on that GPU (e.g. a training job running on the laptop). The basis string states this verbatim and the number is never claimed as attributable solely to the run. `avgWatts` is DERIVED (`joules / window`), labelled as such.
- **UI** — `RunConsole.tsx` renders an Energy block between Cost and Observer frame: `MEASURED` → `<J> J · ~<W> W avg · <s>s window` (green) with the whole-GPU/concurrent-load caveat inline; `ZERO` green, `UNAVAILABLE`/`UNKNOWN` amber with the verbatim basis (+ reason). Full basis on hover (title attr). Spec: `EnergyBlock` schema in `openapi.yaml`, required on `RunResult` and `RunDoneEvent`.
- **Verified live 2026-07-12** — laptop-served run: MEASURED 106.935 J over 5600 ms (~19.1 W avg) from meter2; cloud (openai) run: UNKNOWN with honest basis.