feat(attest-demo-ux): dual fail modes · encircled key · layout + raw-payload lock

Applies the operator steers on the local instrument:

DUAL OFF_DOMAIN FAIL MODES (the two insurable claim types):
  • Mode A (drift): Reality drifts past a CONFIGURABLE policy-limit slider
    (position toward the excluded domain; default computed at build so the page
    loads IN_LANE and you drag down to trip it)
  • Mode B (catastrophe): Reality closer to the excluded domain than to Intent
    — supersedes the threshold no matter how small the drift
  • UNPLACEABLE preset ('Ambiguous spec') forces a tie on demand — the
    abstention promise, a button to push when asked 'how often does it abstain?'
  All four states demonstrable: default IN_LANE · sealed-run Mode-A knife-edge ·
  abstain-tie UNPLACEABLE · Draft→Execute / Advise→Transact / Diagnose→Operate Mode-B.

LAYOUT + ACCOUNTABILITY (final steer):
  • hierarchy: Header → canonical pipeline → deck → 3 boxes (one row on wide) → reef
  • 'View raw context payload' per box — the EXACT fattened string fed to gzip,
    so no hidden-context-bleed objection survives
  • canonical Rust pipeline labels (Ingestion → Compression → Final Walk →
    Tolerance → Receipt seal·sha256), never browser-API names; 7th panel is the
    cryptographic seal (countable, recomputable event)
  • encircled result key — in-lane/out-of-lane split with canonical axis
    emoji + RANK.FullName + colors, exactly like the commit email, LLM-FREE
  • 144 framed as a scale-invariant resolution dial (7±3), not a capacity cap
  • panel-trace animation + box→panel colour ties (what's in context, when)

Build-time and runtime now fatten with ONE shared boilerplate (injected, not
duplicated) so the default-threshold math matches the browser exactly.

Guard: 18/18 (was 13) — adds dual-mode/abstention presets, canonical labels,
encircled-from-axis-map LLM-free, raw-payload view, shared-boilerplate.

Originating-Terminal: 📐 architect (VS Code)
Relevant-Rooms: 🔨 builder, 📐 architect, 🧪 laboratory
Story: A burst of operator steers turned the instrument from 'measures placement' into 'an underwriter can operate it' — two named fail modes they price separately, an abstention button, a raw-payload chain of custody, and the encircled result in the exact visual language of the commit email. One coherent round of feedback on one artifact, landed as one iteration with its guard.

Receipt-Verified: σ=2.54 · cell=A · witness-agreement=GZIP_ONLY · lens=gzip · receipt=3bdb60fd

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EssMgKix9aZmZ5dxGPqYCW

commit f21571da2 — 144×144 lattice triptych (on-chip)

◎ the ingest chose C3,B2 — Operations·Flow × Tactics·Deal — acting on A,B3 — Strategy × Tactics·Signal (grip 0.766) · the walk starts at the ACTOR's row · 4 file(s)

⏱ ingest 3434.6ms (corpus→lattice) · definer walk 277ms (row→transpose→row, ballistic XOR per hop) · total 3940ms
ingest here = commit-scoped SENSING only (this commit's message + changed files → lit anchors) — deep seed authoring lives in the reef-self-loop, off the commit path

rows = ACTOR (lens) · cols = PATIENT (object) · diagonal = self-reference; ◎ at actor-row × patient-col — every panel, same orientation. Heat above the diagonal = actors ranking ShortLex-earlier than their patients (the walk follows definers uphill in rank).
The 12 canonical lanes (rows top→bottom, cols left→right): A·Strategy · B·Tactics · C·Operations · A1·Law · A2·Goal · A3·Fund · B1·Speed · B2·Deal · B3·Signal · C1·Grid · C2·Loop · C3·Flow

PAIR LATTICE (the map we normally see)

PRE-WALK SENSE · INTENT grid — the snapshot, no point of view

the no-point-of-view snapshot — what the sensor lit before any walk; the leaf walk below is what bridges the two grids

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK SENSE · REALITY grid — the snapshot, no point of view

the no-point-of-view snapshot, reality side — same sensor law

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK Δ · straight comparison of the two ingested grids (green both · cyan intent-only · amber reality-only) · 11% overlap · ◎ = where the competence pixel sits in the raw overlap

good = green overlap without being a copy — near-100% is self-similarity, not alignment

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

◎ the pixel this commit belongs to

C3,B2 — Operations·Flow × Tactics·Deal (actor) acting on A,B3 — Strategy × Tactics·Signal (patient) · grip 0.766

actor seed C3,B2 — Overall flow throughput and finish rate are driven by the exchange rate established during the deal negotiation. Flow is the rate at which committed work crosses the finish line. Inventory accumulates upstream; flow is the only thing the customer pays for, and the only thing the operator can measure honestly. The deal sets the exchange rate between two value substrates. Mis-priced exchange is a slow-bleed; correctly priced exchange compounds both sides, because each cycle of trade enriches the bench on both ends. Movement is the irreversible delivery of value across the boundary. Anything stationary is cost; anything moving is either revenue, deferred revenue, or the exhaust of revenue not yet realized. Terms are the API between two organizations — every clause is a contract method that survives the handshake. Renegotiation is the breaking change; the deal is the stable interface either side can build against. Throughput dominates utilization. A ninety-nine-percent utilized system at low throughput pays the same wages as a fifty-percent utilized system at twice the throughput, but the second one ships the customer's order. Negotiation closes at the moment both parties' BATNAs cross. Push past that point and you've bought regret at retail; stop short and you've left margin on the table that the next deal will not return to you. Flow has a direction. Bidirectional flow is two flows, each measured separately; calling them a single flow hides the chokepoint and the chokepoint is where the leverage lives. A signed counterparty is more valuable than an unsigned promise. The signature is the substrate; the conversation that preceded it is the exhaust the signature converted into substrate.

patient seed A,B3 — Strategic reach is framed by a long-horizon lattice that filters signal bandwidth from broadcast noise. The lattice we build today is what next year's underwriter inherits. We set the substrate that downstream pricing rides on, and that choice is paid back across every quarter we keep operating. Direction is what you keep when you forget the calendar. Multi-year posture, irreversibly chosen, defines the boundary every quarter renegotiates inside. Strategy is the bearing the rotation is measured against. Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipients tune out. The right channel is the one whose floor matches the message's importance. A broadcast that addresses everyone addresses no one. Precision over reach until the address is calibrated; only then does scale convert prospects into recipients rather than into unsubscribes.

INTENT · leaf-walk clouds · BLUE→VIOLET by ply (◎ = the competence pixel: actor∩patient)

good = the clouds concentrate where the commit SAYS it works

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

REALITY · leaf-walk clouds · ORANGE→RED by ply (◎ = the same pixel — the shared perspective)

good = the same clouds as intent — shipped where declared

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

DELTA · graded cloud divergence (green agree · magenta declared-not-done · amber done-not-declared) · 9% agree

good = mostly green; magenta = said-not-done (chase it in the code), amber = done-not-said (chase it in the docs)

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

TOLERANCE · cloud topology (dim green in-shape · hot amber bleed · red orthogonal concentration)

red only matters above the flip — a few amber is normal bleed

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

SHORTLEX-3 PROJECTION (ABC · A1..C3 · the 132 children — candidate, pre-ratchet)

PROJECTED INTENT · the commit’s claims, head→axis_i tail→axis_j (cyan)

the three-length view — good = claims land inside their own zone

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PROJECTED REALITY · same projection law (amber)

same projection law — good = reality occupies the zones intent does

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

STRAIGHT COMPARISON · green both · cyan intent-only · amber reality-only · 10% overlap

good = the zones agree; cross-zone scatter is the drift to read

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

shortlex-3 zone occupancy (lit cells per diagonal square)
INTENT: 0 in the 3×3 ABC corner · 5 in the 9×9 A1..C3 square · 856 in the 132×132 children square · 215 cross-zone
REALITY: 0 in the 3×3 ABC corner · 10 in the 9×9 A1..C3 square · 1606 in the 132×132 children square · 351 cross-zone
axes: identical 144 ShortLex names both sides (symmetric); weights asymmetric
zone 3 = candidate children, pre-ratchet (repo-derived dumps not yet past the perturbation-probe gate) · intent 81 claims @ θ 0.6406 · reality 58 claims @ θ 0.625 · projection 804ms

SHAPE-MATCH σ = 3.19 — the real intent↔reality definer walk vs random-reality (actual 0.1668 vs random 0.079). >0 = the walk distinguishes real alignment from noise; aggregate over independent walks → the divergent series.
σ_spec-delta · forming · the realization is converging on the spec — iterate again

Most out-of-lane row: C1 · Grid — that lane is drifting most (read the red band in that row).

Three-colour tolerance (out-of-lane = reality fires where intent is weak, in orthogonal blocks): green=in-lane agreement · amber=a few out-of-lane (tolerated) · red=armed — orthogonal out-of-lane 5% vs tolerance 25%.
1360 green · 819 amber · 0 red · 734 XOR-friction cells.

Both axes = the 144 ShortLex anchors, cell=row⊕col, on the chip. INTENT=docs+rules · REALITY=code · DELTA=friction.

tile dump — what the SimHash matched on the diagonal (inspect the sensor; tap to expand)

A,A The lattice we build today is what next year's underwriter inherits.

intent 73% <span style="color:#5a6673">zone 3 = candidate children, pre-ratchet (repo-derived dumps not ye

reality 75% <div class="dim" style="font-size:11px;margin-top:6px">Drift is measured as <b>position toward

B,B Tactics is the choice of which leverage to pull at which beat.

intent 72% try { if (self.crypto && self.crypto.subtle) { const buf = await self.crypto.subtle.digest('SHA

reality 72% const axRaw = JSON.parse(readFileSync(resolve(REPO_ROOT, 'docs/architecture/axis-library-v1.jso

C,C Operations is the loop that runs whether anyone watches.

intent 84% ## REQUIREMENTS (falsifiable) - **R1 — reef-from-spec.** A command that compiles an arbitrary m

reality 75% // drift = POSITION between the two poles: 0% = on Intent, 50% = equidistant (the Mode-B catast

A1,A1 EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at

intent 83% <span class="dim">No throughput figure is quoted that this run did not measure — the speed IS t

reality 78% <h2>◎ The encircled result — the placement, keyed like the commit email</h2>

A2,A2 The target is the cell coordinate the system MUST occupy by end-of-quarter.

intent 88% (no distinctive match)

reality 80% const BOILER_PRE = ${JSON.stringify(BOILER_PRE)}; // injected from buildUX — identical to the b

A3,A3 Every dollar builds either the floor (substrate that lifts future bets) or the ceiling (cap on the next round)

intent 80% let H=[0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]

reality 77% // set the slider default a few points ABOVE it, so the page loads IN_LANE and the operator can

B1,B1 Latency is the price of a missed beat.

intent 73% let verdict, mode, reason;

reality 73% let verdict, mode, reason;

B2,B2 The deal sets the exchange rate between two value substrates.

intent 86% (no distinctive match)

reality 73% (no distinctive match)

B3,B3 Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipi

intent 77% {step:'2/7', title:'Ingestion · Reality', desc:"Node B's realized work product.", src:D.ingestP

reality 73% {step:'2/7', title:'Ingestion · Reality', desc:"Node B's realized work product.", src:D.ingestP

C1,C1 Power flows where the grid lets it.

intent 77% function tracePipeline(){

reality 75% <div class="box negative"><div class="lbl"><span>③ Negative (excluded)</span><span class="dim"

C2,C2 Each iteration is a hypothesis tested against the ground truth of the world.

intent 78% Originating-Terminal: 📐 architect (VS Code) Relevant-Rooms: 🔨 builder, 📐 architect, 🧪 labor

reality 73% (no distinctive match)

C3,C3 Flow is the rate at which committed work crosses the finish line.

intent 83% <p class="dim" style="margin-top:0">Three corpora, one measurement. The instrument does not ask

reality 83% <p class="dim" style="margin-top:0">Three corpora, one measurement. The instrument does not ask

commit context — 4 file(s)

feat(attest-demo-ux): dual fail modes · encircled key · layout + raw-payload lock

Applies the operator steers on the local instrument:

DUAL OFF_DOMAIN FAIL MODES (the two insurable claim types):
  • Mode A (drift): Reality drifts past a CONFIGURABLE policy-limit slider
    (position toward the excluded domain; default computed at build so the page
    loads IN_LANE and you drag down to trip it)
  • Mode B (catastrophe): Reality closer to the excluded domain than to Intent
    — supersedes the threshold no matter how small the drift
  • UNPLACEABLE preset ('Ambiguous spec') forces a tie on demand — the
    abstention promise, a button to push when asked 'how often does it abstain?'
  All four states demonstrable: default IN_LANE · sealed-run Mode-A knife-edge ·
  abstain-tie UNPLACEABLE · Draft→Execute / Advise→Transact / Diagnose→Operate Mode-B.

LAYOUT + ACCOUNTABILITY (final steer):
  • hierarchy: Header → canonical pipeline → deck → 3 boxes (one row on wide) → reef
  • 'View raw context payload' per box — the EXACT fattened string fed to gzip,
    so no hidden-context-bleed objection survives
  • canonical Rust pipeline labels (Ingestion → Compression → Final Walk →
    Tolera

docs/pmu/attest-demo-report.html
docs/pmu/attest-demo-ux.html
scripts/pmu/attest-demo-ux.mjs
tests/pmu-simulator/attest-demo-ux-airgapped.test.mjs

Produced on the chip by the running pipeline (scripts/pmu/pipeline.mjs → runPipeline → walk + xor), commit-scoped · on-chip per-walk 895.10ns (this commit). Recompute: node scripts/pmu/commit-triptych.mjs --commit f21571da2

Commit artifacts (open on a computer — Gmail mobile won't follow file:// links; the inline images above are the phone-viewable form): reef grid · this triptych · the HDL — all three are also attached to this email.