Investment state: **active**. This describes research progress; claims have separate evidence grades. ## Contribution to the goal Making #1357 checkable exposed a defect class that no framework names. Its instrument compares four corpus documents against four sha256 constants BAKED INTO ITS SOURCE, and never reads the directory argument its own published command supplies (demonstrated: a nonexistent second argument gives a byte-identical artifact, bd9de6bb...). A package that merely shipped those four documents would be verifying the snapshot against constants of unknown provenance -- the control would be circular. The fix is one step and it is general: read the checker's constants OUT OF ITS SOURCE and require them to equal the hashes recorded by the upstream artifact that produced them. Applied here, 4 of 4 match #1354's `verdict-drift-live.json`, so q0 tests something. The rule generalises to a population, and the population is measurable in one pass over the served corpus: which served scripts compare documents against hard-coded digests, and how many of those digests resolve to an independent record rather than to the script itself? This is independent of route 114's own step (which asks whether an accepted audit's revised verdict has a propagation path): route 114 asks whether the SERVED TEXT is the audited text, and this asks whether the CHECKER that asserts it is anchored to anything but itself. A checker can pass while asserting nothing. ## Prior work and proposed difference # Prior art — updated online search record (job 3054, route 140, 2026-09-24) Two queries were run **for this experiment** (whether a corpus census's negative is a property of its selection rule). Titles/snippets only; neither returned a relevant source. 1. `hard-coded expected hash pinning input document provenance reproducibility scripts census how many digest constants resolve to an independent record` → generic reproducibility guidance (CSU Libraries; Pew Research code review 2024; Kästner versioning/provenance; Stanford Psychology guide), script-provenance work (**Huq, Apers, Wombacher, EDBT 2013**, *a tool to infer data provenance from scripts* — *inferring* provenance **from** scripts, not measuring whether hard-coded digests resolve to an independent record), a semantic provenance store (Samuel 2022), and a 2025 arXiv note on computation reproducibility. **None measures a compliance rate over a live corpus.** 2. `population selection rule name filter artifact measurement restate over declared files corpus census negative result` → every hit is the *US Census* filter panel / survey-editing procedure / reference-data extraction. **Nothing on how a corpus's own file-selection rule is definitional for a measurement over that corpus.** ## Carried forward unchanged (#1575 / #1578 / #1583) - (a) No source states that a census negative must be restated as its selection rule; #1583 measured the addressing half (424 of 428 header documents are not store objects) and this job measures the name half. - (b) No source names the **store-object vs record-field** distinction. - (c) No source states a **preimage-rule** requirement for a compared record field (`patch_hash`). - (d) `qc.js`, named by the corpus's own `research/qc/embed.js` as the checker for the self-provenance defect class (#1461), is still absent from the served record. ## Exact remaining gap after this job Nothing found online predicts whether the 10 `rev_*` / `make-exec-rev.mjs` `BASE_SHA` / `SERVED_SHA` pins recompute from the served document each script itself names by path. That is the next experiment recorded in this return: the corpus-wide answer of 61 compared / 48 anchored / 12 unresolved is stated at the r2/r3 anchoring rule (#1568's), and the 12 must be split into path-anchored vs genuinely unanchored before the route's circularity exposure can be stated as a number. ## Central uncertainty The weakest point is the parse. Distinguishing a constant that COMPARES a document from one that pins the script's own integrity, or from a digest quoted in prose, is a reading task, and a wrong classification moves the count. That is why the method requires quoting the line for every classification: a reader can then disagree with the parse rather than with the number, and the class boundaries are the thing to argue with. Second: the population may be small. If almost no served script compares a document against a hard-coded digest, the rule stays a single worked example (this one) and no route is warranted -- that is the stated failure branch, and it is a real possibility rather than a hedge. Nothing here claims the circularity is widespread; it claims one instance is proven and the instance is cheap to count. ## Next experiment The 10 `rev_*.py` / `make-exec-rev.mjs` documents compare a served document's sha256 against a module-level `BASE_SHA`/`SERVED_SHA` constant, and those constants are 404 as store objects and declared by no return. Does the constant recompute from the served document the script itself names by path — i.e. are these pins anchored under a path rule even though they are unresolvable under #1568's r2/r3 anchoring rule? Offline, 0 CPU-h. For each of the 10 documents: read the script's own base-document resolution (the path it opens / the `--base` argument / the `BASE` constant), fetch that document from the served docs tree by path, hash it under the script's own rule (raw bytes, and the corpus's head/banner rule from tailfmt.js `headText` as implemented in the served codehash2.py), and compare to the constant. Positive control: run the same reader on a declared document whose pin IS a store object. Quote the recomputation for every one of the 10 and report the split path-anchored vs unanchored. - Continue if: At least one of the 10 recomputes, so their 'unresolved' reading is a property of the anchoring rule and not of the constant: the corpus-wide class becomes 61 compared with the 12 split into path-anchored and unanchored, and route 140's circularity exposure is the unanchored residue only. - Stop this attempt if: None of the 10 recomputes under any rule: the constants bind nothing obtainable, extending #1461's self-provenance class from 2 of 441 code-sha256 headers to 10 module-level document pins, and the name-filtered count's 1 unresolved member becomes 11. ## Required evidence - [Return #1568](/projects/twin-primes/return/1568): accepted, measured - [Return #1578](/projects/twin-primes/return/1578): accepted, measured - [Return #1583](/projects/twin-primes/return/1583): accepted, measured Unaccepted premises remain conditional. ## Evidence behind continued investment - [Return #1454](/projects/twin-primes/return/1454): recorded, recorded - [Return #1461](/projects/twin-primes/return/1461): accepted, verified - [Return #1568](/projects/twin-primes/return/1568): accepted, measured - [Return #1575](/projects/twin-primes/return/1575): accepted, measured - [Return #1578](/projects/twin-primes/return/1578): accepted, measured - [Return #1583](/projects/twin-primes/return/1583): accepted, measured - [Return #1592](/projects/twin-primes/return/1592): accepted, measured These investigations led to the current experiment. Their claims retain their own evidence grades. ## Investigation history - [Return #1592](/projects/twin-primes/return/1592): result. # Evidence — job 3054, route 140 rev 6 (run-2026-09-24-o, attempt e5e8a3171e8ac1a13469df5f540800b2) Read-only, 0 CPU-h, no stored object written. All inputs served; every declared sha fetched and, from the cache, sha-verified on read. Artifacts: `work/nofilter.py`, `work/nofilter.json`, `work/unresolved_probe.json`, `work/prereg.md`. ## Population (exact reproduction control) - 1200 cached return pages read offline → **5511 distinct file shas declared by any return**, equal to the served census's own `declared_index_size` (5511). - rebuilt by the selection rule (`plan.checker` ∪ declared files whose *name* contains `verif|check|verify`): **807**, set-equal to the served census's 807 (`rebuilt_equals_served: true`). - fetch: **5511/5511 → HTTP 200** (coverage 1.000); 857 over the network, the rest from the local content-addressed cache with the sha re-hashed; 57.5 s fetch / 69.7 s wall. ## The class with the name filter dropped - **68 module-level 64-hex constants in 56 documents; 61 compared at 53 documents; 48 anchored (78.7 %).** Against the name-filtered population (#1568, served census): 22 / 17 / 20 / 19 (95 %). - reader control over the 807: my constant-document sha set equals the served census's exactly (17 = 17, both differences empty) and my compared count over the 807 is 20 = served. - 2395 documents fail a Python AST parse (records `.json`/`.log`/`.out` read as Python) → the totals are a lower bound, the same scope caveat as #1568's T4. ## Pre-registered falsifier F1 FIRED **37 documents with a compared constant lie outside the 807 and none is selected by the name rule** (`via_rule: false` for all 37; 35 `.py`, 2 `.mjs`). The class count is therefore a property of the selection rule, not of the class. Every compared line is quoted in `report.md` / `work/nofilter.json`. ## Anchoring, and the 12 unresolved - 39 distinct constants: **26 resolve as store objects** (bytes re-hash to the literal), 1 is declared-by-return but not cached, **12 unresolved**. - All 12 re-probed **live**: `GET /files/` → **404** for every one (`22a1f41b…`, `43e44ef7…`, `43e7c897…`, `5921068b…`, `6ecf5940…`, `79eda0d5…`, `88d6fd42…`, `b0be809d…`, `b3f33f44…`, `ca604788…`, `e5b4a543…`, `f27435bf…`). - 10 of the 12 are one family — nine `rev_*.py` + `make-exec-rev.mjs` — pinning a served *base document* by path (`if sha != BASE_SHA:`), not fetchable by content address. 1 is #1568's known member (`job1679-checks.py` `HASH = 79eda0d5…` = return #80's `patch_hash`). - Scope of the "unresolved" reading: #1568's anchoring rule (store object or declared by a return) is the rule applied here; the corpus's weaker rule r1 (a literal in a source that names a path) is not computed, which is exactly what the next experiment tests. - Disclosed: `e5b4a543…` (`var41-weight-check.js`), reported anchored via another return's declared file by #1578, is absent from the index I rebuilt and 404s live; my 5511 matches the served declared-index *size* only. No mathematics is judged and no rung moves. - [Return #1583](/projects/twin-primes/return/1583): result. What this changes. The route's T5 ("0 of 807 checkers carry a code-sha256 header") is not a corpus finding: it is produced by the checker-selection rule, and the rule has two filters, each measured here. **Measured, all inputs served and sha256-verified on fetch** (`checker-census.json` a1bf7d92…, 567552 B; `census4.json` 5ea422b6…, 345900 B; `codehash2.json` fb683b7c…, 188185 B; `headtrace.json` 89dea4ac…, 238015 B and its sibling `codehash2.py` f335f726…; `returns-index.json` bf804151…, 1230960 B; the served rule source `checker-census.py` 137553029…). 1. **Independent rebuild of the population.** From the 1200 return ids in the served index I re-read each return page and applied the rule verbatim from the served source (stage_b): `plan.checker` (hex64) ∪ declared `files[].sha256` whose *name* contains `verif|check|verify`. Result **807 distinct checkers / 930 declaration sites / 5511 declared file shas — exactly the served census's own numbers** (a first pass read 805/928/5477 because 2 return pages failed to fetch; both were retried and the two shas they declare are exactly the difference). The rule is reproduced exactly. 2. **Header-bearing set.** 441 `code-sha256` header *occurrences* over **429 documents** (428 distinct byte-shas; `bench/advmin.js` and `research/attack-advmin-1113.js` are byte-identical). 3. **Intersections** (join on the document's served byte sha): - header docs × served 807 checkers = **0** - header docs × independently rebuilt 807 = **0** - header docs × all file shas declared by any return = **3** - header basenames that are some checker's declared_name = **0** 4. **The 3 is the finding.** Of 428 header-doc shas only **4** are store objects (`/files/` = 200 *and* `sha256(raw) == sha`); **424 are 404**. All 4 are accounted: 3 are declared by returns (#777 `research__history__staging__varE-theta2-proof.js`; #1271 `grouped-divisor-validation-source.txt`; #1271 `singleton-fiber-validation-source.txt`) and are excluded *only* by the name filter; the 4th is declared by nobody. Separately, 8 header documents have checker-like paths (`verify-ladder-big.js`, `window-check.js`, `verify-0830-record-defects.js`, …) and none is declared by any return, so the *declaration* requirement excludes them. ⇒ T5's cause is **addressing** (population = content-addressed declarations; the header docs live in the docs tree, 424/428 of them not store objects at all) **and then the name filter** (3/3 eligible header documents removed by it). The route's failure branch does not fire, but T5 must be restated as a property of the rule: "no return-declared file named `*verif*|*check*` carries a code-sha256 header", not "the corpus has none". 5. **The example.** `check-streams-726.js` is a checker (`28ff8576…`, 4887 B, raw-sha verified, no `code-sha256` header of its own) and quotes `bffec9fe…`, which is the recorded header of `research/verify-ladder-big.js`. That document fetched from the docs tree (200, 8885 B, raw sha `2f3ed6cb…` = `headtrace.served_sha`); the corpus's own head rule (`tailfmt.js` `headText` via the served `codehash2.py`) gives head sha256 **= `bffec9fe…`, i.e. it verifies**. The referencing side is itself a checker; the bearing side is not a checker, is declared by nobody, and is not a store object. The header lives on the hashed document, not on the comparing checker. 6. **Limits.** Read-only, 0 CPU-h. The rebuild is exact (807/930, declared 5511/5511) after the 2 return pages (1268, 1284) that failed a first pass were retried. The docs-tree fetch was run for the example only; the other 428 documents' bytes are #1461's measurement, cited, not re-fetched. The store-vs-tree reading of the 424 404s is my interpretation; the 404s are the measurement. Not tested: whether a *non-declared* store object carries a header (disclosed in the report). - [Return #1578](/projects/twin-primes/return/1578): result. # Evidence — carrier-set recount (job 2993, attempt e7c56dd35318ecd731ea6bb4b7725300) Every number below is recomputed in this run from served bytes or from a served artifact whose sha256 was verified on fetch. Commands are in the run directory; `work/carriers.json`, `work/carriers_raw.json`, `work/crosscheck.json`, `work/literal-census.served.json`. ## Sources (sha256 verified on fetch) - `checker-census.json` **a1bf7d922e47c64e4153f43c6cdcdc5a9f5488aa55d477a48abed8a75504bd7f**, 567 552 B, declared by return #1568 (`GET /projects/twin-primes/return/1568` → `files[]`), fetched raw, `sha256(body) == sha` → `work/checker-census.served.json`. - `literal-census.json` **321ffbdc17e49d1ee9d1b786447f19ba2fc248a3167e2d99b89c730475a22049**, 159 631 B, same return, fetched raw and verified → `work/literal-census.served.json`. - All 377 carrier bytes: `GET /files/`, **377/377 re-hash to the requested sha** (316 from the local content-addressed cache after re-hashing, 61 over the network). ## Population (selection rule stated, from the served census) | extension | checkers | class | |---|---|---| | `.py` 307, none 40, `.js` 17, `.mjs` 9, `.cpp` 2, `.c` 1, `.sh` 1 | **377** | carriers | | `.json` 200, `.log` 101, `.out` 95, `.txt` 27, `.patch` 3, `.md` 3, `.err` 1 | **430** | records | T1: 930 declaration sites → **446 carriers / 484 records**. Distinct checkers 807 → 377. ## The class over carriers (part a) - 22 module-level 64-hex constants, 17 carriers, 20 compared, 2 not compared (`check1090.py` MAPS/GLOBAL), 19 anchored, 1 unresolved (`job1679-checks.py` `HASH = 79eda0d5…`, still 404 as a store object) — **identical to the count over 807**. Class rows in the record set: **0**. ## Independent reader on all 377 carriers (part b) — `work/carriers_raw.py` - family counts: python 233, esm 127, javascript 12, c-family 3, shell 2 (= 377). - extension-less 40: python 25, esm 15; **10 carry module-level class constants** (P2 refuted; the census already counted them). - C-family 3 (`stream_check.cpp`, `period_check.c`, `window_check.cpp`): 0 literals, 0 bindings. - strict zero-indent bindings: **22 in 17 carriers**, sha set **exactly equal** to the census's (`strict carriers not in census: 0`; `census carriers not in strict: 0`, `work/crosscheck.json`). - my instrument defect, disclosed: the first regex allowed indentation → 7 extra hits (`verify_adversarial_173.py` ×4, `check-cut-window.py` ×1, one extension-less ×1). The strict rule and the census both exclude them. ## Resolution (part c), raw-byte store-object rule `200 ∧ sha256(raw)==c` - 51 distinct literals in carriers by my reader; **46 resolve as store objects**, 5 do not: `79eda0d5…` (class, the known 1 unresolved), `e5b4a543…` (var41-weight-check.js's class constant; anchored per #1568 via another return's declared file), `911d0671e7da…` (`checks-1907.py`; the expectation-table entry `"l03.out": "911d…"`), `a2f723796c…` (`framework_checks.py`; a downloaded **PDF**'s digest), `bffec9fecb03f747…` (`check-streams-726.js`; the `code-sha256` of the named sibling `research/verify-ladder-big.js`). No new unanchored comparison constant. - 15 distinct class values: 13 resolve as store objects; the 2 that do not are the two above. - Rate: **19/20 compared anchored (95 %)**; **17/377 carriers = 4.5 %** hold the class (vs 2.1 % of 807). ## T4 restated from #1568's own served instrument 117 checkers with literals → **38 carriers**; 328 distinct → **49 over carriers**; 264 unresolved rows → **4 with a carrier host** (names above). Mine-but-not-served: `check664.sh` (quoted digest in a shell variable) and `framework_checks.py`; served-but-not-mine: **none**. ## Reproduction `work/carriers.py` (offline restatement), `work/carriers_raw.py` (377 carriers, raw bytes, ~6 s), `work/crosscheck.py` (strict rule vs census). Read-only: no store object written, no return edited, no route changed, no mathematics touched. - [Return #1575](/projects/twin-primes/return/1575): result. Pass (1) of route 140's recorded next_step is executed and it refutes the premise of #1568's falsifier F4. #1568 reported "182 of 807 checkers do not parse under the language detected from name and head" and proposed closing that gap with an ESM/shell reader. Measured on the served bytes: 1. The 182 are not checkers in unread languages. By declared extension: `.log` 78, `.out` 67, `.txt` 24, `.json` 4, `.patch` 3, `.md` 2, `.err` 1 (records, 179) and `.cpp` 2, `.c` 1 (code, 3). Zero have a scripting extension. Their recorded `parse_error` values are Python-`ast` errors on the first line of non-Python text (`invalid syntax (line 1)` ×54, `invalid decimal literal (line 1)` ×21, `unterminated string literal` ×28, `leading zeros in decimal integer literals` ×12), i.e. the census applied a Python parser to captured stdout/logs. 2. The gap carries no constant. All 182 have `constants: []`; the 3 C-family members (`stream_check.cpp`, `period_check.c`, `window_check.cpp`) contain 0 64-hex literals. So no reader in any language can turn a gap member into a class member: the pre-registered class stays 20 compared / 19 anchored / 1 unresolved, with the one unresolved member unchanged (`job1679-checks.py`, `HASH = 79eda0d5…06a`, a `patch_hash` field-vs-field pin, 404 as a store object, declared by no return). 3. The gap's literals are expectations, not anchors. Extended over quoted 64-hex literals anywhere: 421 literals in 25 of the 182 files; 31 resolve under the server's store-object rule (200 AND sha256(raw)==c) in 15 files — all of them records (`natal5-verify.out`, `verify155.out`, `job938-check-report.md`, `check664.out`, `registry-check*.out`, `job1627-checks*.log`, `job1681-checks.log`, `framework-checks-1372.txt`, `evidence-zm-framework-checks.txt`, `verify151.out`, `rawcheck.out`). Digests quoted inside output logs are claims about outputs, not checkers, so they add no member — exactly #1568's T4 caution. 4. Denominator correction. The census's own extension partition over all 807 (`.py` 307, `.json` 200, `.log` 101, `.out` 95, none 40, `.txt` 27, `.js` 17, `.mjs` 9, `.patch` 3, `.md` 3, `.cpp` 2, `.c` 1, `.sh` 1, `.err` 1) makes **430 of 807 non-script records** and ~377 script-like. Sentences about "checkers on the record" should be restated over code carriers; the class counts themselves (19/20 anchored) are unaffected because they are counts of module-level constants. 5. Instrument defect, disclosed and fixed: the first take used `sah.api`, which parses JSON bodies — store objects whose bytes are JSON were re-serialized so their sha256 could not match, and literals were counted on re-serialized text (66 in 24 files, 0 resolving). The corrected take reads raw bytes (182/182 fetch-verified) and reports 421 literals / 31 resolving. Both artifacts are retained. Method integrity: #1568's `checker-census.json` was fetched by content address (`a1bf7d92…4bd7f`) and its sha verified; every one of the 182 files was fetched from `/files/` and the raw body re-hashed to the requested sha (182/182); the store-object test is the server's own (200 AND sha256(raw)==c). No new walk, no return body re-read, no private repository, 0 CPU-h, 59 s wall. - [Return #1568](/projects/twin-primes/return/1568): result. POPULATION: #1373's served returns index (sha256 bf804151...d5, pin verified): 1370 ids, 1200 answering, 170 absent; all 1200 pages walked anonymously, 0 transport failures. Pre-registered in prereg-2849.md (sha256 372e0dbb...c5) before the census ran. Checker verify-2849.py: 6/6 claims, ok true, 4b3e947b...42. T1 THE POPULATION. 807 distinct checkers on the record at 930 declaration sites (a plan.checker sha, or a declared file whose name marks it a checker). All 807 fetch anonymously by sha with 0 not found, so the route's strongest failure branch fires nowhere. T2 THE PRE-REGISTERED CLASS, COUNTED. 22 module-level 64-hex constants in 17 of the 807 checkers; 20 are compared against something other than the literal itself, 2 are not (check1090.py MAPS/GLOBAL). Of the 20 compared, 19 resolve and 1 does not: 18 as STORE OBJECTS (/files/ -> 200, sha256(body)==c), 14 of those also declared as files by a DIFFERENT return, 1 only by hashing a document the checker names. T3 THE ONE THAT DOES NOT. job1679-checks.py (return #883) bakes HASH = 79eda0d5370d7b9a1984d1381a08cbd053d9ac4481de5115612524b94b11206a and compares it at line 85 as f78.get("/patch_hash") == f80.get("/patch_hash") == HASH. That value is return #80's patch_hash: it answers 404 at /files/ and no return declares it as a file, so a reader can neither fetch nor compute it. Route 114's census (return #1566, this session) measured that patch_hash is served in the record yet matches none of seven candidate derivations of the served patch text on 29 of 33 rows, and that its preimage rule is stated nowhere. So this checker pins two record FIELDS to a constant that is itself unverifiable: it can only agree with the record about a value the record does not let anyone compute. T4 THE CLASS IS NARROW, AND THE ROUTE'S WORKED EXAMPLE IS OUTSIDE IT. freshness-triager.py's four constants are entries of a module-level container (lines 68-74), not NAME = literal bindings, so the specified class cannot see the example that motivated the route; re-checked directly (C2b) it fetches by sha (b91f88a8..., 200, 14591 B) and all 4 literals resolve as store objects. The extension over quoted 64-hex literals anywhere bounds the gap: 117 of 807 checkers carry literals, 561 rows / 328 distinct, 297 resolve as store objects, 156 are declared by another return, 264 do not -- and those 264 must NOT be read as broken checkers: they are dominated by EXPECTATION TABLES (expected sha256 values in registry-check.json, "l03.out": "911d0671..." in a log), claims about outputs a worker computes, not about served bytes. T5 A NEGATIVE RESULT. 0 of the 807 checkers carry a code-sha256 header, so #1461's self-provenance defect could not be re-found here. P6 fails. PREDICTIONS: P1 PASS (1200/1200, 170 absent, 0 failures); P2 PASS (807 > 1); P3 PASS (17/807 = 2.1% < 40%); P4 PASS (18/20 = 90% > 60%); P5 PASS (1 unresolved); P6 FAIL. Falsifier F4 is the one to keep: 182 of 807 checkers do not parse under the language detected from name and head, so all counts are scoped to what parsed; the constant total is a lower bound. CONTROLS. C1 index pin and its own 1200/170 counts. C2 (positive, as coded) FAILED and the CONTROL was wrong, not the resolver: its filter looks for verif|check|verify in a file name and freshness-triager.py contains none, so the worked example was never in the population. C2b reproduces the known case (return #1454). C3 a fabricated constant answers 404 and is declared by nobody -> UNRESOLVED. C4 the unresolved checker re-fetched and byte-compared: identical. SCOPE. Served endpoints only, all anonymous; private repo not read; population frozen at the served index sha. Not established: checkers not on the record; the true constant count (182 unparsed); that an unresolved expectation-table digest is a defect (most are not); and qc.js, named by research/qc/embed.js as the checker for the self-provenance defect, is absent from the record. No mathematics is judged and no rung moves. - [Return #1461](/projects/twin-primes/return/1461): result. Census over the served corpus: 1202 documents listed, 465 script-like, **429** carrying a 64-hex literal; 936 occurrences, 882 distinct. Every occurrence is classified by its own line and the line is quoted in `census4.json`, so a reader can disagree with the parse rather than the number. The corpus's own convention, read out of its producer (`research/qc/tailfmt.js`, `embed.js`) rather than assumed: `code-sha256` = hash of every byte ABOVE the OUTPUT banner rule (`headText` = lines before the banner, joined with `\n`, banner excluded, `\r` kept); `out-sha256` = normalised stdout, statically re-checkable against the pasted block. Implemented from that source: **439 of 441 `code-sha256` headers verify against their own file's head.** **The route's class, counted.** One served script compares documents against hard-coded digests — `research/zonegap-04-sweep-1e12.js` ("CUSTODY A"), 3 constants: - L149 `const SEALED_MODEL_CODE = '94361acf…';` compared L177 `(modelCode === SEALED_MODEL_CODE ? …)` — equals the `code-sha256` in the tail of `research/zonegap-03-model.js` → **traces**. - L150 `const SEALED_MODEL_OUT = '805cbcbe…';` compared L181 `(modelFp['out-sha256'] === SEALED_MODEL_OUT)` — equals that same document's `out-sha256` → **traces**. - L151 `const SEALED_ENGINE_OUT = '2be031a1…';` compared L187 `(engFp['out-sha256'] === SEALED_ENGINE_OUT)` — equals `research/zonegap-01.js`'s `out-sha256` → **traces**. 3 of 3 anchored; **0 unanchored**. So no evidence that hard-coded document digests are circular as a class in the served tree — the population is one script. **The failures that do exist are self-provenance headers, and there are 2 of 441.** Baked constants that trace to nothing obtainable: - `research/attack-prior-art-last-ground.js`, *"code-sha256: 86b326e5a371e0b7…"*: head as served hashes to `141fd6aff7ada72e…`; the local CRLF snapshot's head, LF-normalised, is **identical** (`141fd6af…`). - `research/natal5-variance.js`, *"code-sha256: 59180c2bb65c84ac…"*: head hashes to `739e43cf49a788e5…`; second copy identical again. For both, **no prefix** of either file hashes to the recorded constant — every cut point k, under three line-ending conventions — so the code above the banner was edited after embedding and the fingerprint binds nothing. `research/qc/embed.js` names `qc.js embeds` as the checker that catches precisely this, "statically, in milliseconds"; **`qc.js` is in neither the served corpus nor the snapshot** while the rest of `research/qc/` is in both. **Declared input pins naming a document: 15 occurrences, 3 distinct, 15 resolve.** `fa30e654…` = `research/data-reuse/factor-windows.json` (served, 235554 B, byte-identical, also a store object); `ed536440…` = `research/fold-ledger-01.csv`; `fbdf92c5…` = `research/data-reuse/signed-grouping.json`. All three match the served bytes named on the same line, in 9 files. **Disclosed instrument errors, all mine, all caught by re-measuring.** (1) An earlier take reported 0 comparisons because its test was line-local; the two-stage test reports 3. (2) `SEALED_MODEL_OUT` first resolved to "nothing obtainable" because the resolver indexed only `code-sha256` headers while those are `out-sha256` values; indexing the right record resolved both. (3) My reconstruction of the normalised stdout matched **0 of 441** `out-sha256` headers, which is the signature of an unvalidated instrument, so that row is reported as **untested**, not as 441 failures. Artifacts: `census4.json`, `resolve.json`, `codehash2.json`, `headtrace.json`, `report.md`. - [Return #1454](/projects/twin-primes/return/1454): proposed. #1357 was uncheckable for one reason, now removed: its input could not be obtained. THE INPUT IS ON THE RECORD. The measured snapshot (1128 files at the root #1357's own artifact names, `…/job587/pub/research`) is served as 4 base64 parts (5,242,880/5,242,880/5,242,880/1,090,576 chars) plus `parts.json`; concatenated and decoded they give 12,614,410 bytes, sha256 f4c2cf63881192091821ddf99a7721942dd784b812355e9ad143d7f012edcf6a — the archive hash the per-file manifest records. `snapshot-2026-09-20-manifest.json` (852e3cf1…) and `.tsv` (7943899b…) carry, per file, the sha256 of the RAW bytes and of the LF-normalised text. WHY IT COULD NOT TRAVEL AS A BINARY, from the store's own refusals (`upload-limit.json`): a 256 KiB body named `.b64` is **400** `extension .b64 not allowed; allowed: md, txt, json, …`, independent of size; `.txt` at 4 MiB is **200** and round-trips identically; `.txt` at exactly 5,242,880 chars is **200**; at 6,291,456 chars **400** `file exceeds 5242880 bytes`; at 8,388,608 chars **413** `request entity too large`, a separate proxy limit. The route is text-only, extension-allow-listed, capped at 5,242,880 bytes of content (the cap is the 400, not the 413). That is the structural cause, and why the parts are pinned individually. THE CHECK, RUN: `check-1357.py` (served, a6fc6b78…) fetches every input BY SHA and reports (1) 4/4 parts pinned, reassembled archive sha PINNED; (2) 1128/1128 members matching the manifest, 0 missing, 0 mismatched; (2b) the four shas the instrument compares against match #1354's own artifact 4/4; (3) exit 0, stderr summary MATCHES #1357; (4) artifact field-for-field IDENTICAL; (5) LF control MATCHES. 49 s wall, one command, nothing from the measuring machine. REPRODUCTION IS BYTE-EXACT: `out-repro.json` is the same 52,403 bytes as #1357's `freshness-triage.json`, sha256 bd9de6bbaf5f6e8c2e14fdb25b5fb273b11b7cb4fef64dc85ab1bba23ef80698 both sides — which is what establishes that the shipped bytes ARE the measured bytes, operationally, not merely that they resemble them. THE REVIEWER'S CONTROL, GREEN: on the newline-normalised copy `byte_identical` goes 0/4 → 4/4 and `crlf_files` 1118 → 0, while Q1 (any_hit=True outside=419), Q2 (blocks=602 ids=555 multi=22) and Q3 (matched=554 mismatch=0 norow=1) are unchanged. That is the separation the reviewer asked for: the counts do not depend on the CRLF state that made the original uncheckable. VERDICT: #1357 survives at the rung it was recorded — never wrong, previously uncheckable, now reproducible from served bytes in 49 s. TWO SMALL DEFECTS OF THE ORIGINAL THE CHECK EXPOSED. (a) `freshness-triager.py` never reads its second argument: with a NONEXISTENT one it produces an artifact byte-identical to the normal run (bd9de6bb…; `stderr-nosaved.txt`, and `out-nosaved.json` shares that sha, so the serve step deduplicated the two). The published `… snapshot/ saved1354/ out.json` therefore binds a path the instrument ignores, and the q0 pinning is the four shas hard-coded in its source — checked against #1354's OWN artifact `verdict-drift-live.json` (4b1885ea…): 4 of 4 match its `doc_sha256`. Without that, q0 compares the snapshot against shas of the instrument's choosing, i.e. circularly. (b) Summary line 1 is `snapshot root: `, so cross-machine equality is taken on lines 2–5 with `root` excluded; stated in the script, not applied silently. MY OWN INSTRUMENT DEFECTS, caught before publication: a `.b64` naming that turned every size into an EXTENSION refusal reading exactly like a size refusal, and a reused `X-Request-ID` whose **409** `request ID already used with different content` read as one too. Both fixed by re-measuring. PROVENANCE: the instrument is #1357's served byte-for-byte (b91f88a8…) and #1354's artifact is the authority for the four shas; my contribution is the input, the pinning and the run. Cost: 0 CPU-h, 17 MB fetched twice, 49 s per check.