The findings register.

Non-canonical IPv6 text could hide private or special destinations.

Address normalization and conservative range checks; compressed response failures now refuse rather than succeed.

Production refuses unpinned proxy egress; direct network verification remains a release gate.

The public database RPC looked up a global idempotency key without checking the creating API key.

Production RPC now rejects cross-key replay and changed TTL, arbiter or memo; validates inputs and serializes capacity decisions. Transactional SQL regression fixtures roll back.

Global sandbox capacity can still be exhausted; this is not a paid production service.

The original MVP asserted a trust and signature layer that did not actually verify anything end to end. The claim was in the documentation; the enforcement was not in the code.

Trust layer rebuilt against explicit conformance vectors, with signature verification moved onto the critical path and covered by adversarial tests.

The rebuilt trust layer still permitted a path where a validly-formed but unverified assertion was accepted. Finding the same class of defect twice is the reason the adversarial programme became standing practice rather than a one-off review.

Verification made total rather than conditional; negative fixtures added for every accept path so an unverified assertion cannot reach a decision.

Resolution had no upper time bound. A dispute whose arbiter simply went dark stranded the challenge bond forever, and a disputed escrow stayed disputed forever, with funds neither released nor refunded. Two independent fuzzers found it; our own suite had missed it.

Lapsed-resolution paths added: after a grace period anyone may trigger resolution, which fails safe toward the payer. Verified by all three fuzzers after the patch.

The grace period is a governance parameter, not a provable constant. See V-1.

A dry run of the bootstrap generator wrote organisation keys into an emitted deployment artifact. Harmless on a test network, catastrophic if that template had reached a production configuration.

Secrets redacted from all emitted artifacts, and the generator now refuses to publish a non-redacted key set.

Settling a contract against a single spot reading meant whoever could move the feed for a moment could skew every penalty and bonus computed from it.

Settlement price is the median of three independent market feeds, time-averaged over an hour. Corrupting it requires moving a median across three markets for a sustained window.

Feed certification is an operational control. The oracle contract needs the same external audit as everything else that touches money.

We published a 148 times advantage over vision. The vision side of that ratio was never measured. It was page height divided by viewport height, on the premise that an agent screenshots an entire page before it can find a link, while our own side was charged for one targeted query. That is not a comparison, it is a scoring system. Worse, we had already written exactly this criticism about the accessibility-tree number in our own first sweep, and then made the same mistake in the arm that replaced it. A reviewer computed what the headline becomes if a vision agent takes one screenshot instead: 16.5 times.

The comparator is measured. Ten independent vision agents were given the actual captured screenshots of ten of these sites, one at a time in scroll order, and asked to name the visible element for each of four intents, with an explicit instruction that an unsure answer counts as not found. They read 67 screens and answered 17 of 40. The same questions through bounded queries cost 49.9 times less and answered 22 of 40. The headline is now that measured figure, the harsher variant that charges the model for the whole structured read is published beside it at 3.8 times, and every other defensible construction of the ratio is listed so nobody has to wonder which we picked.

Ten sites and one run. That is the smallest number in this arm and it is the one to attack next. The vision agents are also a proxy for a vision agent rather than the population of them.

Our settlement fee scales with load value and the benefit does not, so above roughly $3,300 average load value the conservative band goes negative. The component rendered the result in the verified colour unconditionally, under the label "Net annual saving", with no sign check anywhere. At settings inside our own sliders it displayed minus five million dollars as a saving. The currency formatter compounded it by putting the minus inside the dollar sign, so a loss read as "$-200,006" — the exact string a skimming reader parses as positive.

The result carries a negative flag per band, the headline changes colour and label when it is set, and a panel states the break-even load value in plain words. The formatter puts the sign outside the symbol. The API says NEGATIVE in the field description, because a machine cannot see a colour.

The underlying fact is unchanged and is a real limit of our pricing: at high ticket sizes a percentage fee on escrowed value costs more than the operational saving it buys. We would rather a buyer find that here than after signing.

calcAgent hardcoded the settlement fee to zero and set netUsd to the gross saving, with a comment congratulating itself for not netting a fee it did not charge. Meanwhile the operator page sells tiers from $99 a month to $120,000 a year. At the calculator’s own default volume the tier a buyer of that size would be sold was negative by $85,800, and the field called net said plus $34,200. The same wrong number was served to machines by /api/measure, where nobody could eyeball it.

A tier selector, subtraction of the annual price, a net field that is actually net, a break-even volume for the selected tier, and a check of required machine requests against the tier allowance — because our pricing meters requests and the calculator takes tasks, and nothing on the site used to bridge the two.

The tiers themselves are not implemented in this build. No quota or metering code exists behind them, which makes every allowance on the pricing page a promise rather than a mechanism.

Act-by-reference is the rule that stops an agent acting on a page it has not seen, and the epoch is the entire mechanism. Every call site passed the literal "g1". The comparison was therefore always g1 against g1 and could never fail. An audit demonstrated the consequence: read a page, read it again after the form action had changed from a newsletter signup to an account closure, and the plan built against the first submitted happily against the second. The test suite passed only because the tests hand-minted their own epochs; nothing in the product ever did.

The epoch is a hash of the document. It changes exactly when the page changes, which is the property the rule assumed it had. test/doctrine.test.mjs runs the audit’s own sequence and requires STALE_REF.

A hash of the served document, so a page that re-renders identically keeps its epoch. That is correct, and it means the epoch tracks content rather than time.

The measurement code and the product each had their own copy of the vocabulary. Every published number came from the corrected one; customers called the other, which was still the round-one version with no negative list, no action gating and no dead-link rejection. Run over our own committed archive the two disagreed on 19 of 120 intent cells, with the product returning a 31 per cent higher answerable rate made of exactly the false positives we had withdrawn. "Book a Demo" was still a booking affordance in the thing people pay for.

One file, imported by both. A test runs both matchers over the archive and fails on any disagreement, so the divergence cannot reopen. The public schema also stopped advertising two intents, buy and support, that were never measured and had no negative lists at all.

A published correction that does not reach the product is not a correction. This is the sharpest instance of a pattern this register keeps recording: we are good at arithmetic and bad at noticing when the thing measured is not the thing sold.

The rate limiter committed every token to the global window before evaluating the per-caller gate, and its take() recorded a hit even when it returned false. Refused traffic was therefore charged to the backstop. One address making calls inside its documented call limit burned 590 of the 600 global tokens a minute on requests that were refused, and every other caller — including one making their first ever request — was told the whole deployment was at capacity. The file calls that window the real protection because it is keyed on nothing the caller can change; it had become the thing an attacker switches off first.

Both windows are checked without mutating and committed only when both pass, and a refused request records nothing — otherwise a client polling above its limit never drains back under it.

A regression from the same day’s security work. The fix for one audit created the defect the next one found.

It regenerated lib/dmi.ts in place and then compared, so a failing run had already overwritten the tracked file. Run it twice and a caught regression became a silent restatement of the published headline: a reviewer following our own audit package broke a matcher rule, saw the check fail, ran it again, and saw it pass with the ratio changed from 47 to 42.4 and the answerable cells from 59 to 67. A verifier that repairs the thing it verifies verifies nothing, and this was the single mechanism we offered as proof the numbers could not drift.

It generates into a temporary directory and compares. It now fails on every run until the artefacts and the published file agree, which is what it always claimed to do. The analysis also stopped stamping a timestamp into its output, which dirtied the tree on every run and made "the artefacts reproduce" unverifiable by diff.

This was introduced by RW-8, the finding whose whole subject was that our reproducibility claim did not hold.

Every pilot and certification enquiry — the entire path from interest to revenue — was stored in a process-local Map that evaporated on the next cold start, while the page told the applicant it had been queued for delivery to our inbox. Nothing was ever delivered anywhere. A second audit found the same route keyed its rate limiter on a header the caller writes, and that its duplicate fingerprint let a stranger pre-register your email and have your real enquiry dropped.

Enquiries are recorded durably with a reference the applicant can quote; deduplication is advisory and time-boxed to ten minutes so a double-click returns the same reference and nothing else ever does; the limiter has a global backstop and bounded state; and the response says a person reads these and when they reply, never that anything was emailed, because there is still no mail transport.

Delivery is a human reading a table. That is honest and it does not scale; a transport with retry and an in-flight guard is the next thing to build.

The site advertised 267 public conformance vectors, machine-checked proofs, three independent fuzzers and 97.3 per cent branch coverage. None of those artefacts existed in the repository; the numbers were constants in a data file inherited from a design brief. The trust page showed Lightning, Stripe and an energy rail run through a kit, with a deliberately published Lightning failure for credibility. No such rails and no such run.

A Level 1 conformance kit exists and is served at /kit/l1.mjs: 45 vectors, executed against any implementation of the endpoint, one command. The matrix has one row — this deployment — and its first run found a defect: a numeric string amount was coerced to an integer by the database where the in-memory path had refused it. The fuzzer and coverage claims are gone and the trust page says why. Levels 2 and 3 are labelled specified, not shipped.

Forty-five vectors on the lock-and-inspect surface. Release, refund, dispute and the L2/L3 behaviours have no kit yet and the page says so instead of counting them.

Plan values, method and destination were mutable; hostile page regexes could block the server.

Hash-bound plans are compared with fresh validation. Page patterns use bounded matching and unsupported constructs refuse.

Plan integrity is not proof of identity or authority; public calls remain plan-only.

SMTP_URL merely changed the success message; no delivery implementation existed, and retained records were volatile.

The endpoint returns explicit not_sent/503 and retains no enquiry. The form offers a user-operated email fallback.

Mailbox ownership and delivery must be verified before commercial GTM; online delivery is unavailable.

The realweb generator used an absolute checkout path and could rewrite tracked source during verification.

Both publications regenerate only in temporary storage; every measured archive hash is checked. Repeat corruption tests fail without repairing source.

Historical vision transcripts and entitlement captures remain absent; new replay tooling cannot recreate them.

Lead and key intake lacked a byte cap and could retain unbounded client-indexed state.

Streaming JSON is bounded by bytes and time, primitive bodies refuse, intake maps are bounded, and false lead retention is removed.

Application limits are per instance; production edge-level aggregate limits remain necessary.

Early "500x energy / 1000x" style claims were produced from hardcoded constants and presented with more confidence than the evidence supported.

All constants re-derived from an instrumented benchmark; every published figure now carries a provenance label of measured, documented, assumed or modelled.

Global-scale totals still carry wide uncertainty and are labelled as modelled wherever they appear.

open() accepted ttlSecs = 0, so a party holding an agent key could open an escrow that expired in the same block, griefing anyone calling expire() and polluting contract state.

open() now requires a time-to-live between one hour and one year. Covered by the invariant suite at 512x1024.

Hold-invoice expiry was not sized against milestone deadlines, so an escrow could self-refund in the middle of a running contract.

Normative rule: invoice expiry must exceed the longest milestone gap plus headroom. The router checks this before choosing the rail and routes elsewhere when it cannot be satisfied.

Unstaking on demand let an owner pull collateral out mid-challenge, defeating the entire economic security of the registry.

Exit queue: unstaking schedules a withdrawal after a delay, and a challenge filed during that delay locks the funds into resolution.

Signatures prove who said something, not that it is the latest thing they said. A client with no history could be served an old, validly-signed record and would accept it.

Freshness quorum: lookups use disjoint paths and accept only the highest sequence attested by several independent nodes, cross-checked against witness logs.

Freely chosen node identifiers let an adversary place themselves around a target key cheaply, which is the precondition for an eclipse attack.

Identifiers are now derived from the public key, disjoint-path lookups are used, and eviction prefers long-lived peers.

Identity derivation raises the cost of placement but does not make identities scarce. This is economics, not a proof.

The property-based test mirror decremented by a hardcoded amount regardless of the actual value moved, so the conservation check was weaker than advertised. It never passed a real contract bug, but it was exactly the sloppiness that hides one later.

Mirror arithmetic now derives from observed returns. Conservation is asserted exactly. Filed as a standing rule: never assume constants in a test mirror.

The founding thesis quantified waste with uncalibrated constants. The per-transaction claim held up; the global-total claims were premature.

Rebuilt from an instrumented measurement basis. The surviving, robust claim is that the interface tax is roughly 90 to 97 percent of transaction tokens on a human-web path.

Global electricity and market-size figures carry uncertainty of twenty percent or more and are labelled accordingly wherever used.

Raw agent trajectories contain counterparty commercial data. Using them as training corpus would leak one principal’s commerce into a model another principal uses.

Per-trajectory consent enforced from the charter, and a scrubber rewrites counterparty identifiers to keyed pseudonyms before any export. Traces from principals who deny consent never leave aggregate statistics.

We expected measuring real sites to widen the published gap, because real pages are far heavier than the lean site we tested on. Raw HTML is indeed about 56 times heavier at the median. But the accessibility tree — which is what a competent browser-automation agent actually consumes — is only about 5 times heavier, because the tree discards precisely the markup, tracking and styling that makes those pages large. Our 3.2x advantage over an accessibility-tree agent therefore does not scale with page weight anywhere near the way the raw-HTML figure implies.

The evidence page leads with this rather than burying it, and the headline claim is stated against the accessibility-tree path rather than the raw-HTML path. Page weight is reported as reaching a vision agent through step count, which the sensitivity table always showed to be the dominant term, rather than through observation size.

Against a well-built browser agent our cost advantage is real but moderate. The strong form of the argument now rests on reachability and on transaction semantics, not on token arithmetic.

The first sweep reported that ten of thirty-four freight sites gave an agent nothing at all, and published that as a finding about how closed the freight web is. Re-running with a browser that did not announce itself as headless, and that dismissed cookie walls the way any browser does, six of those ten served us perfectly well: Maersk, MSC, DHL, FedEx, UPS and Forto. The barrier was substantially our own client, not their doors.

The evidence page now leads with the correction rather than the original number, names the six sites, and reports the genuine refusal count of four. Both browser identities are run on every sweep so the difference is published instead of quietly absorbed. No stealth was added to achieve this — no webdriver masking and no anti-detection, because that is a losing arms race; we simply stopped announcing ourselves as a robot.

None. The entitlement path was subsequently measured: every remaining refusal served the identical extractor from an ordinary signed-in browser on a home connection. The barrier is to anonymous automated traffic, not to agents. Recorded as RW-7.

The first sweep compared raw HTML, the accessibility tree and a screenshot — three ways of swallowing a whole page. On that basis raw HTML looked decisive at 56 times our lean control while the accessibility tree looked fatal at only 5 times, and we nearly published the second number as the honest limit of our own advantage. Both were answers to a question an agent does not ask. An agent does not swallow the page; it asks where the affordance for one intent is.

A second arm measures the path that matters: discover a machine-native surface before launching anything, and where none exists read a compact structure and answer with a bounded query. On the corrected figures the median answerable query is 81 tokens against 12,006 for full vision coverage of the same page, and 38 times cheaper than the accessibility tree. The advantage is real and large; it was simply being measured in the wrong place. (The numbers first published here were 69 tokens and 45 times, computed before the matcher was anchored — see RW-5.)

A bounded query locates an affordance. It does not complete a transaction, and the vision baseline remains modelled rather than a measured vision-model run.

The terms used to decide whether an agent could find a quote, tracking, a contact route or a booking form were unanchored substrings. "rate" therefore matched inside "corporate" and "book" matched inside "Facebook", so any site with a corporate link or a social icon scored hits it had not earned. Published counts were inflated: booking fell from 24 of 29 to 12 of 29 once the terms were word-anchored, and sites fully operable on all four intents fell from 9 to 6.

All terms are word-anchored regular expressions. Both arms of the sweep were re-run from scratch rather than patched, and the headline query cost is now the median of queries that actually returned something, since a query that finds nothing is cheap and useless and averaging those in flattered the number.

Anchored keyword matching still cannot tell a link named "Book a demo" from one named "Book a shipment". Intent detection is a heuristic and is labelled as one.

After the browser-identity correction, a handful of sites still refused us, and we were prepared to report those as genuinely closed to agents. Running the identical read-only extractor inside an ordinary signed-in browser on a home connection, every one of them served it without complaint.

The entitlement arm is published as a third arm with its own table, and the headline now says zero sites are genuinely closed. The product consequence is stated plainly: run the agent where it is already entitled to be, rather than arguing with an edge.

Four sites, one run, one location, one residential connection. The arm is small and its token figures are estimated from character counts rather than tokenised exactly. What it establishes is a direction, not a precise multiple.

The page carried the anchored, re-run figures while the repository shipped the pre-anchoring result files and the analyser that still globbed its own outputs. Anyone reproducing the sweep from what we published would have got the old numbers and concluded the page was inflated. For a claim whose entire defence is "check it yourself", shipping artefacts that contradict the page is worse than shipping no artefacts at all.

The corrected analyser, generators and every result file — the four sweep shards, the four DMI shards, the classified rows, the summary and the real-browser run — are now in the repository, and the sweep no longer writes to an absolute path outside it. Regenerating lib/dmi.ts from the committed artefacts reproduces the published file byte for byte, which is now the check that has to pass before this ships.

Reproduction is proven for the analysis, not for the capture. Re-running the sweep itself hits live sites that change under us, so the shards are evidence of what we saw on one day rather than something anyone can reproduce identically.

RW-5 fixed unanchored terms and we treated the matter as closed. A hostile review then read every captured hit and found nine more false positives, all of them correctly anchored English words that mean something else in freight. "Tariff" is a customs duty far more often than a price list, and it matched a duty calculator and a product called Tariff Analytics. "Rate" matched "95% success rate". "Book" matched "Book a Business Consultation" and the URL slug rate-book-manage, because a hyphen is a word boundary. "Booking" matched "Bill of lading or Booking Number", which is a tracking field.

Matching now has three layers rather than one: the term must match, a negative context must not, and for the terms that proved unreliable the hit must be an action with a short label rather than a sentence of prose. Every entry in the negative list was earned by a specific false positive we published and withdrew. Book fell from 12 of 29 to 10, quote from 19 to 15, and the count of sites where all four intents are reachable fell from 6 to 4.

A vocabulary is a judgement and ours will be wrong again. What changed is that it is now re-derivable: the matcher runs over archived structures that ship with the repository, so a reader can disagree with a regex and recompute every published number rather than argue with us about it.

RW-8 put the result files in the repository and we called reproduction solved. It was solved for the arithmetic only. The artefacts carried counts and the first three hits per intent, so the numbers reconciled, but the affordance names themselves were not there — which meant the one thing a sceptic would most want to re-run, the intent matcher, was the one thing they could not. Check it yourself stopped exactly where it got interesting.

The sweep now archives the whole structured view of every page: every affordance name, every href, every form field. The analysis re-derives the intents from those archives rather than reading back what the sweep recorded, so the matcher is a pure function of committed data. Change a regex and every published number moves. The reproduction check refuses to pass if fewer than 25 archives are present, so the property cannot quietly lapse.

We archive the derived structure, not the pages. Raw HTML and screenshots are hashed and measured but not committed, because republishing 34 companies’ pages is not ours to do. A reviewer who wants the bytes can check any copy we hand them against the published hashes.

Every published number stopped at locating an affordance. We stated that honestly in the limits — "it does not complete a transaction" — but a machine-commerce standard whose evidence stops before the transaction has not demonstrated the thing it is selling. The gap was real and stating it did not close it.

The act layer completes the job and refuses the four ways an agent gets this wrong: a reference from a page that has since re-rendered fails loudly rather than being re-found by similarity; a plan cannot be submitted against a page it was not planned against; values that violate the constraints the PAGE declares are refused locally, before the network, with the field named; and one plan’s token cannot submit another plan’s values. A full quote is completed end to end in the test suite, against a server the test owns, and the whole transaction costs under 1,200 characters of model context.

We do not submit forms to companies that have not asked us to, so the end-to-end measurement runs against a surface we own and the third-party path is plan-only by default. That is a real limit on the evidence and a deliberate one: a quote form is a sales lead with a person on the other end, and filling strangers’ inboxes to produce a benchmark number would make the number worthless and us a nuisance.

There was no coverage input, so every task moved to the machine surface and paid the machine price. Our own evidence page reports bounded queries answering 59 of 116 intent slots, and all four intents reachable on 4 of 29 sites. The calculator was overstating the gross saving by roughly two times against our own published measurement of what the product reaches.

Coverage is an input and its default is our measured 51 per cent, not 100. Tasks that do not migrate stay on the current path and keep costing what they cost, which is why coverage is not a simple multiplier.

Coverage on a specific buyer’s counterparties is the thing a pilot measures. The default is a median and will be wrong for everyone in one direction or the other.

The table spans 1.5 to 18.7 times and is introduced with the line "Every assumption, moved one at a time". The calculator was hard-wired to the 6.0 baseline and took no multiplier at all, so the two cases tagged "against us" were decoration. Under our own worst published case, at the default volume, every paid tier except the cheapest is negative — a fact the page contained and could not show.

The case is a selector that drives the computation. Choosing the 1.5 row changes the headline.

The sensitivity cases move the dollar ratio only. The energy band still moves energy alone, and the page now says so rather than letting the three-band toggle imply more than it does.

bench.ts opens by saying every number is tagged with how it was obtained. The Provenance type had zero usages anywhere in the repository, and the freight, settlement and energy blocks carried no tags at all. The sharpest case was the claims line: three bare point estimates supplying 60 per cent of the conservative saving, one of which asserts a five-thousand-fold cost reduction on every claim. Set it to $10 and the default falls 43 per cent; set it to $50 and the default goes negative.

Every freight constant carries a provenance tag and a range, the three claims assumptions are inputs, and the freight tab has its own published limits. It previously had none: the sensitivity table and limits list sat outside the mode branch, so a freight buyer was shown provenance about one synthetic task on a lean fictional site as though it covered them.

Tagging a number as assumed does not make it right. The claims assumptions remain the weakest thing in the freight model and are now labelled as such in the place a buyer will read.

The rule says a block page, a challenge or a shell is reported as such and never returned as though it were content. The sweep implemented that. The product’s only check was the HTTP status. So a 200 Cloudflare interstitial answered a quote query with a hit; a response truncated at our byte budget answered "nothing matched that intent on this page — that is a real answer" when it was the back half of a document; and a redirect loop or DNS failure returned an empty body that was then diagnosed, in the response, as the SITE’s JavaScript rendering problem. Our evidence excluded the pages that are not really pages and the product returned them to customers as cheap successful reads.

One verdict function, used by both. A read that is not a read is refused with a reason and a machine-readable code, and the refusal says whether the limit is the site’s or ours. Unreadable media counts are returned to the caller as well, which the operator page had promised and the product had never sent.

The shell threshold is a judgement dressed as an observation, and the two adapters reached it by different numbers. They now share one.

The consent-dismissal code was scoped to "a recognised consent container", implemented as four substring wildcards. An audit got it to click Continue on a recipe page about cookies, I agree on a form posting to an account-deletion endpoint, an OK carrying formaction="/transfer", and a display:none Accept in preference to the visible Reject beside it. It also sat against our own entitlement arm, which says accepting terms on someone’s behalf is not ours to do.

Named CMP roots only, the button itself must be visible, generic words are accepted only inside a named CMP, and anything that would submit a form or carries formaction is refused. Then we measured what dismissal buys: across 30 readable sites it moved the answerable-intent total by one, inside run-to-run variance. So the sweep accepts nothing now, and the comparison arm still runs so that claim stays checkable.

Every affordance count published before this was taken after that code fired. The current numbers are not, which is why the sweep was re-run rather than annotated.

Discover before you launch a browser, and where a structured API exists say so rather than bill for a page read. The operator page sells that sentence. Neither implementation contained it: dmi_query went straight to the document, and the sweep called discover, printed the route and then read the page unconditionally. The product also never consulted robots.txt at all — the check lived only in the sweep, whose parser honoured a literal "Disallow: /" and nothing else, which is close enough to a no-op that quoting it as compliance was generous.

dmi_query discovers first and returns the route without a page read when a machine-native surface exists, with an explicit force flag to override. robots.txt is checked in the product, with a parser that handles path rules and wildcards, most-specific-rule-wins, and fails closed when robots.txt itself is refused. The user agent now carries a product token and a contact URL, because sending a bare Chrome string from a serverless HTTP client is a false statement of identity to an edge that has no other way to tell.

Discovery finds artifacts, not capabilities. An OpenAPI document describing a status endpoint will still route a booking intent to "call the API". The route is now stated as the absence of a conventional artifact at a conventional path rather than as proof that no API exists.

The product read aria-label, then placeholder, then text, then title, alt or value. It implemented neither aria-labelledby, which is the highest-priority source, nor any host-language label association. So every form field name was the empty string — which killed the form matcher and made the planner tell an agent that a field it can see on the page does not exist. The file that reads those forms opens by saying the rules were in the markup the whole time and nobody was reading them. They were, and it was not. It also took a prefilled input’s value as its name, turning a user’s own text into an affordance, and answered queries from display:none menus and disabled buttons that the measured sweep could never have produced.

The spec order, with aria-labelledby, label[for], ancestor labels, child recursion so an image-only link takes its name from the alt text, aria-hidden subtrees pruned, value restricted to the input types the spec allows, and presentational elements excluded.

This is a parser working on served HTML, not a browser computing a real accessibility tree. It will disagree with one, and the direction of disagreement is not knowable in advance.

Two regressions from the accessible-name rewrite. Twenty-five kilobytes of nested markup — well inside our own fetch budget, from an origin the caller chooses — exhausted the stack and returned a 500 with a trace. And the label reader called textContent while carrying a comment promising it did not, so an ordinary label containing its own control produced "Tracking number Search", and a select inside its label produced the label plus every option concatenated. The planner then told an agent that the field it can see on the page does not exist, which is the exact symptom the rewrite claimed to have fixed: an empty string had become a contaminated one.

Name computation is depth- and node-bounded, the whole read is guarded so a hostile document produces a refusal with a reason rather than a 500, and a label is built from its own text nodes with descendant controls and their options excluded.

Both were introduced the same day by the fix for DM-6.

Three tools returned _meta.agentTokens as a hardcoded literal — 180, 210, 240 — while the x-agent-tokens header beside it carried the computed figure. On a large request that was a 278-fold understatement, and the modelled watt-hours were derived from the fake number. The file opens by saying that a service which charges an agent tokens without telling it how many is the problem we exist to fix. Nobody had looked, because machines are the only consumers of that field.

Every receipt is computed from the body after the body exists.

Also in this pass: request_quote accepted any asset string, including an object, while lock_escrow refused anything outside the published list — a rule enforced in one place and not the other is not a rule; llms.txt advertised markdown content negotiation that exists only in the benchmark’s synthetic fixture; a database outage was reported to callers as "that key was not issued by us"; the robots cache was unbounded and attacker-keyed, which is the same defect the rate limiter had been rewritten to fix on the same day; and the freight break-even returned a negative dollar figure once the claims cost became a user input.

The pricing page sold a $99 to $999 tier that did not exist, an Enterprise range whose top the calculator never saw (so a buyer selecting Enterprise was shown a net computed against $120k on a page quoting up to $350k), an SLA on tiers that had none, a protocol-token line that bought nothing with a freight buyer and imported securities questions into a procurement review, and an energy rail nothing in the code can model. The operator page carried its own copy of the tiers.

One data source. The pricing page, the operator page and the calculator render from the same array; Enterprise is quoted from a floor everywhere and the calculator says it uses that floor; the SLA is defined on /status and appears only where it applies.

None.

The only address on the property was in a file written for machines. The footer had no company details, no terms link, no privacy link. The API catalog’s status link pointed at a fictional freight market. The Enterprise tier promised a 99.9 per cent SLA with no definition, window or credit anywhere. A named company that disagreed with a row on the evidence page had nowhere to write.

Contact, privacy, terms, security, status with a live health check and the SLA defined, a changelog derived from this register, security.txt, and a corrections address for anyone we have named.

The registered entity details are not yet printed; the privacy notice says so and commits to printing them before any paid invoice.

page.evaluate runs in the page’s main world, where the page owns every builtin. A reviewer had a page override checkVisibility and getBoundingClientRect to smuggle a display:none form pointed at an attacker into the MachineView the runner publishes as evidence — a site in the sweep could dictate its own verdict. The runner also accepted a 64 MB return value without complaint and attached to the operator’s real signed-in context by default, on a debugging port the README described as merely sensible to isolate.

The extractor runs in a CDP isolated world, which shares the DOM and gets fresh builtins; the same attack page now returns no smuggled form. Returns are capped at 2 MiB and schema-checked. The runner uses a fresh signed-out context unless told otherwise and prints a warning when it is. The operator page states what the port exposes, in the place a security reviewer will look.

None.

A single bootstrap signer was a single point of capture for the entire discovery layer.

Threshold signature across several independent organisations, published to independent channels, with the key set pinned at build time.

If a threshold of those organisations collude they own discovery. The fallback is re-pinning a new set, which is a governance action, not a technical guarantee.

With a large enough share of nodes positioned at a single key, the freshness quorum can be starved and a record made to look absent.

Witness logs continuously sample capability keys; divergence raises an alarm and clients fall back to pinned caches that are explicitly marked stale.

This converts undetectable censorship into detected censorship. At very high adversary share, availability degrades to alarmed stale caches. Forgery remains impossible throughout; availability does not.

Settling flexibility requires knowing what consumption would have been. No baseline methodology is ungameable by construction.

A published industry-standard baseline is used as the default, declared in the manifest and disputable. We do not claim it is physics.

Permanent. This is a governance parameter in the same family as V-1.

Routing rules overlapped at boundary values, so a deal at a particular size and deadline matched more than one rule with no defined tie-break. Two conforming implementations could legally disagree.

A pinned rail priority order ships in the bootstrap document; first match wins. Found only because the pilot instrument forces a route attestation on every transaction.

The first sweep checked robots.txt before every visit and correctly skipped a site that disallows its entire tree. The second runner was written without that check and loaded that site’s homepage anyway. Nothing was submitted and nothing was crawled, but it was a page we had already decided we were not entitled to fetch.

The measurement was discarded rather than used, the site is reported as robots-disallowed exactly as before, and the exclusion is recorded in the analysis code where it can be seen rather than in a comment.

The robots check belongs inside the session rather than in the caller, so that no future runner can omit it. That change is not yet made.

The script that merges the sweep batches matched every file beginning with "dmi-", which on any run after the first also matched the two files it had itself written. Every row was counted twice, doubling the intent totals. It was caught because 58 answerable intents were reported across 29 sites when the ceiling is 4 per site.

The glob matches only numbered batch files. The sanity ceiling that exposed it is now the reason the totals are printed alongside the sample size on every run.

A reviewer read the prose against the measurements rather than the other way round. "Ten of 34 never needed a browser at all" counted nine sites whose only machine surface is a blog feed — and our own discovery code says in the same breath that a feed will not support transacting, which is what all four intents on that page are. Those nine are measured through a browser eight sections further down the same document. "Every one of them opened" counted chrobinson, a site we never knocked on because its robots.txt says not to. And the correction naming six rescued sites included FedEx, which served a country-selector interstitial rather than a homepage.

The browserless count is now one, stated as one, with the feed caveat in the sentence rather than in a footnote. The rescue claim says nine of ten and names the tenth. FedEx carries its qualifier in the paragraph that names it.

These were not arithmetic errors; every number underneath them was right. They are the failure mode that survives a numerical audit, which is why prose now gets read against the data as its own pass.

The home page said 90 to 97 per cent interface tax; the quantity its own label described is 10.2 per cent, and the figure was derivable from nothing in the codebase. It said zero tokens to transact natively while the calculator charges 7,902 tokens a task for exactly that path. The operator page attached "measured head to head" to 49.9 times when our own field of that name holds 3.8, and hardcoded a browserless count of ten where the data gives one. The pricing page sold a $999 tier that does not exist.

The interface-tax tile is computed from the two constants the calculator runs on, so it cannot drift again. The zero tile is about pixels, which is the true claim. The operator headline names which construction it is and prints the other beside it. The count is derived. The tier is gone.

These were marketing surfaces, and the audit’s sharpest observation was structural: the honesty was concentrated in the measurement layer and the overstatement in the pages that sell. That is a governance problem and it will recur unless prose is read against the data as its own pass.

The outbound budget spent one token per tool call, and one discovery issues ten probes. A caller at twelve calls a minute could therefore put a hundred and twenty requests a minute into one stranger’s origin, and the global backstop permitted one thousand eight hundred. The purpose of that limit is to bound what we do to third parties, and third parties count requests.

The budget is charged per outbound request. The numbers look larger and bound far less traffic.

The per-caller identity is still spoofable behind an untrusted proxy chain, which is why the global backstop exists.

Cross-frame handling was claimed and neither implementation reads inside an iframe. Form fill and transaction was marked Full when there is no submit tool on the public surface. Two paid tiers advertise a hydrating browser transport and attaching to your own authenticated browser; no browser code exists in the shipped application at all. Discovery reported "no machine-native surface found" when every probe had failed, because only 403, 429 and 503 counted as blocked and a timeout or a reset — which is how real edges refuse — left the ratio at zero.

Cross-frame says it is not handled. Form fill is Partial and says why. The tier lines name what is not shipped. Discovery counts a failed probe as inconclusive and refuses to claim absence without a floor of probes that positively answered.

The tiers are still promises. Paid quotas, billing and browser sessions remain unimplemented. Launch pages now offer free evaluation and scoped enquiries; calculator tier prices are hypothetical scenarios, not purchasable allowances.

The site-by-site heading asked whether an agent can actually do the four things at each named company. What was measured is what an anonymous first visit to a homepage exposes structurally. Those are different propositions and only the second is defensible. One named row documented reaching a company’s content after its edge had shown the crawler a challenge page, directly beneath a sentence saying we do not defeat bot detection.

The heading says what was measured; every row carries its date and the hash of the archived structure it came from, which is served publicly; the discovery verdict’s own caveat is surfaced; the challenge-page row is reported in aggregate with a named-on-request note; and the correction route is on the page.

The 34 companies were not notified before publication. The correction route exists now; a notification before the next sweep is the sentence that answers both the lawyer and the sales call, and it has not been sent.

The unique index was on the idempotency key alone, so one key’s use of a string denied it to every other key forever, for any details — a cross-tenant lock denial and an existence oracle, with predictable client keys like order numbers as the obvious lever.

The index is per API key. Replay lookup already was.

None.

Metering ran before the per-address budget. When the budget refused — which an attacker can force globally — the honest caller had already lost monthly allowance for a request that never left the server. The discovery fast path also charged twelve for ten.

Abuse budget first, allowance second; the document read is charged separately and only when it happens. A refusal on either sends nothing and the message says nothing was charged.

None.

The quote matcher excluded "duty rates" and "tariff code" but not "Tariff Solutions", "Navigating Tariff Changes", a "Tariff Resource Guide" or a "Read more" link whose target was a trade-and-tariffs news post. Four carriers gained a quote hit from customs commentary. No site changed verdict — each also had a genuine quote affordance — but the per-intent answer for those sites was fatter than the truth by up to 98 tokens, and the headline was 47 times when the archive re-derives to 49.5.

Tariff commentary, U.S./trade/customs tariffs, and any label whose only tariff signal sits in a news or shipping-information path are negatives. Re-derived from the 31 archived MachineViews: 59 of 116 slots unchanged, 22 of 40 unchanged, headline 49.5 times. The opposite relaxation — matching only the leading words of a long label so that a nine-word "Get a Quote" card counts — was tried and rejected: it admitted a carrier’s price-announcement news post and a load board’s feature card. We keep the undercount.

The eight-word cap on action labels still rejects at least one genuine affordance (DHL’s nine-word quote card). That undercounts us on a site that counts anyway. Recorded so nobody thinks the cap is free.

Budget-forfeit trajectories are failure-biased by construction. Naively training on them teaches a model to expect failure; they are valuable as negative examples and poisonous as positive ones.

Curriculum splitter routes failures to the negative lane and successes to supervised fine-tuning, with a contract bounding the failure share of any export.

The empirical recapture campaign that would confirm the size of the benefit has not been run.

The v1.0 specification layered a Noise-XX handshake inside QUIC, which already carries TLS 1.3. Two handshakes, two key schedules, two things to audit, for no security gain.

Ruling: QUIC transports use standard mTLS with the same identity keys. The Noise profile remains for raw datagram and constrained links. One identity, two transports, no double stack.

Machine-checked proof of the lapsed-resolution path exposed that its correctness depends on the grace period exceeding the maximum honest referee latency. That is an empirical claim about the world, not a theorem.

Declared as a governance parameter, published in the manifest, disputable through the standard venue, and raised as a priority question for external audit.

Permanent. No proof system can certify a choice of grace period. It is chosen, published and contestable rather than hidden.

The commercial risk is not that the standard fails; it is that a large platform adds payments and absorbs the category.

Interoperability-first posture. The value semantics map onto the dominant agent and payment protocols rather than competing with them, so absorption turns us into the escrow and liability layer rather than the casualty.

This is a strategy, not a guarantee. It is the single largest commercial risk and is named as such in the model.

The programme began with the idea that photons or energy might themselves be currency. Money must persist, be auditable and be excludable. Photons cannot be stored, are destroyed by measurement, and delivered energy is not excludable.

Ruling: consensus lives in information, never in energy. Light moves the money and cannot be the money. Energy is supported instead as the underlying asset behind stable-denominated delivery contracts.

Proof-of-useful-work remains an open research question and is not claimed.