fix(pmu): the demo claimed byte-identical while its own output drifted 9.5 → 9.6

Ran attest-demo three times cold, as a skeptical CISO's engineer would, and diffed.
The output is NOT byte-identical: DIVERGENT-SERIES WALK σ moved 9.5 → 9.6 across
three consecutive runs on ONE IDLE MACHINE — printed six lines under our own claim
'byte-identical every run'. Recomputability IS the product. The buyer we are about to
hand this to is an underwriter whose first instinct is to give it to opposing counsel
to break, and they would have broken it in one command.

ROOT CAUSE (not the symptom): every walk is bounded by wall-clock —
  while (frontier.length && hops < budget && (Date.now() - t0) < budgetMs)
so a loaded machine completes fewer hops → different matrix → different σ. The July
fix seeded the impostor PRNG and stopped there; the TIME bound was left in place.

WHY THE EXISTING GUARD MISSED IT — the lesson, bigger than the bug:
tests/pmu/matchsigma-deterministic.test.mjs GREPS THE SOURCE for a seeded PRNG. It
asserts the fix's SHAPE, never its BEHAVIOUR. The PRNG was seeded and the σ still
drifted, because a source-grep can never see a load-dependent output. MEASURE, DON'T
ASSERT — the new guard EXECUTES the walk three times and compares real bytes.

THE INVARIANT: a number may enter a signed receipt only if it is bounded by WORK,
never by TIME. Wall-clock bounds are safety valves; when one fires the result is
telemetry and must say so out loud.
- definerWalk144 now returns timeBudgetTripped + elapsedMs
- triptych-build derives meta.walkSigmaRecomputable from the walks it actually ran
- attest-demo fences the walk σ OUT of the receipt and prints which bound it hit
The PLACEMENT coordinate was never affected — it is work-bounded, and it is what the
receipt signs. That distinction is now stated in the output instead of assumed.

FORWARD-PREMORTEM ARTIFACTS (assume the CRO vector executed and revenue is still zero):
- CISO VETO → cro-one-pager: zero-exfiltration architecture on page one (runs on your
  iron, signed locally, no call home, no pipeline rebuild).
- IMPLEMENTATION PHANTOM → a MEASURED time-to-first-receipt: ~84s over three cold runs
  on a laptop, stated as measured-not-estimated. We do not print numbers we have not timed.
- TERMINAL TRANSLATION → the five-panel claims file promised as an exhibit, plus the
  underwriter's real answer: don't trust our math, recompute it byte-for-byte.
- EMPTY HAND → docs/legal/design-partner-lou.md: one page, $0, 3 slots, 90 days,
  sandbox-capped, on the table July 20. Never ask an enterprise to draft the terms of a
  novel instrument.

TWO PROPOSED CLAIMS REFUSED, both false:
- 'the measurement is open-source (MIT)' — packages/thetacog-mcp/LICENSE says DUAL
  LICENSE. Misstating our own licence in a document built to be handed to opposing
  counsel is not a marketing risk, it is a discovery risk.
- 'we sell a Certification to Operate (CATO)' — deleted from the licence yesterday as
  RL-5 (implies an accredited credential we cannot confer) and in front of securities
  counsel tomorrow. Re-introducing it in sales copy would un-do the cure. The buyer's
  real need (is this an experiment or an asset?) is met by the Readiness Investigation.

GUARDS: tests/pmu/walk-sigma-recomputable.test.mjs (runs the walk, diffs bytes) +
tests/outreach/buyer-artifacts-survive-the-committee.test.js (each artifact keeps its
load-bearing section; MIT and CATO can never be printed). 24 tests green.

Originating-Terminal: 📐 architect
Relevant-Rooms: 🧪 laboratory, 🔒 vault, ☕ network
Story: Running the premortem forward on the NEW vector surfaced a defect the backward-looking one could not: our strongest claim to the underwriter — recompute it yourself — was false in our own demo output. Laboratory owns the walk, vault owns the legal fences the refused claims would have breached, network owns the buyer artifacts. The guard that failed was a source-grep; the guard that ships executes.

Receip

commit 3fe7640cd — 144×144 lattice triptych (on-chip)

◎ the ingest chose A1,A — Strategy·Law × Strategy — acting on B1,B — Tactics·Speed × Tactics (grip 0.828) · the walk starts at the ACTOR's row · 7 file(s)

⏱ ingest 413.4ms (corpus→lattice) · definer walk 1016ms (row→transpose→row, ballistic XOR per hop) · total 1560ms
ingest here = commit-scoped SENSING only (this commit's message + changed files → lit anchors) — deep seed authoring lives in the reef-self-loop, off the commit path

rows = ACTOR (lens) · cols = PATIENT (object) · diagonal = self-reference; ◎ at actor-row × patient-col — every panel, same orientation. Heat above the diagonal = actors ranking ShortLex-earlier than their patients (the walk follows definers uphill in rank).
The 12 canonical lanes (rows top→bottom, cols left→right): A·Strategy · B·Tactics · C·Operations · A1·Law · A2·Goal · A3·Fund · B1·Speed · B2·Deal · B3·Signal · C1·Grid · C2·Loop · C3·Flow

PAIR LATTICE (the map we normally see)

PRE-WALK SENSE · INTENT grid — the snapshot, no point of view

the no-point-of-view snapshot — what the sensor lit before any walk; the leaf walk below is what bridges the two grids

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK SENSE · REALITY grid — the snapshot, no point of view

the no-point-of-view snapshot, reality side — same sensor law

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK Δ · straight comparison of the two ingested grids (green both · cyan intent-only · amber reality-only) · 7% overlap · ◎ = where the competence pixel sits in the raw overlap

good = green overlap without being a copy — near-100% is self-similarity, not alignment

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

◎ the pixel this commit belongs to

A1,A — Strategy·Law × Strategy (actor) acting on B1,B — Tactics·Speed × Tactics (patient) · grip 0.828

actor seed A1,A — The law provides the binding mandate and governance article that protects the long-horizon strategy substrate lattice. EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at any moment. Compliance attaches to the artifact the artifact cannot escape — provenance is a regulatory primitive, not a feature. Constraints precede objectives. The cap-table, the license text, the consent envelope — each draws the inviolate line the action must respect, and the line is enforced before the optimization runs. A rule names what the system MAY NOT do. If the agent can do X, then 'forbid X' is not the constraint — it is wishful thinking dressed as policy. Constraints live in the gate, not in the prompt. Regulation is not advisory. The fine is the price tag stapled to the omitted control; insurance is the option pricing on the failure-mode the regulation already named. The lattice we build today is what next year's underwriter inherits. We set the substrate that downstream pricing rides on, and that choice is paid back across every quarter we keep operating. Direction is what you keep when you forget the calendar. Multi-year posture, irreversibly chosen, defines the boundary every quarter renegotiates inside. Strategy is the bearing the rotation is measured against. Capital lives where strategy is durable. Frame the ten-year shape of the business before optimizing the ten-week sprint; the substrate decisions compound while the surface decisions decay. The strategic question is which doors close on purpose. Anything that keeps every option open until next year has already chosen the option of inaction, paid in optionality cost.

patient seed B1,B — Velocity beats in tactics determine whether the maneuver choice will be too fast or missed. Latency is the price of a missed beat. Every hundred milliseconds of round-trip turns a parallel race into a stalemate, because the first arrival sets the rules the second arrival has to honor. Throughput compounds: doubling the rate doubles the surface area where serendipity can hit. A pipeline at twice the velocity is not twice as productive — it is exponentially more lucky. Time-to-first-byte is the only number the operator feels at the wheel. Optimize the felt latency before the raw throughput; the operator's grip on the loop is what drives the loop forward. Tactics is the choice of which leverage to pull at which beat. Not what we want, but how the want lands on Tuesday: the sequence of irreversible commitments, each made before the next one's information is available. Speed of feedback dominates speed of execution. Tactics that converge fast beat tactics that compute long, because the loop closes around the world's response before the world has moved. The tactical map is a ranked list of moves where each move carries a cost-of-delay. Pick the move whose cost of doing it tomorrow exceeds the cost of doing it imperfectly today. Execution is a sequence of bets made under uncertainty. Tactics is the discipline of betting the right size on the bet whose information value pays for the loss-if-wrong.

INTENT · leaf-walk clouds · BLUE→VIOLET by ply (◎ = the competence pixel: actor∩patient)

good = the clouds concentrate where the commit SAYS it works

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

REALITY · leaf-walk clouds · ORANGE→RED by ply (◎ = the same pixel — the shared perspective)

good = the same clouds as intent — shipped where declared

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

DELTA · graded cloud divergence (green agree · magenta declared-not-done · amber done-not-declared) · 5% agree

good = mostly green; magenta = said-not-done (chase it in the code), amber = done-not-said (chase it in the docs)

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

TOLERANCE · cloud topology (dim green in-shape · hot amber bleed · red orthogonal concentration) · ⚠ TOO MANY

red only matters above the flip — a few amber is normal bleed

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

SHORTLEX-3 PROJECTION (ABC · A1..C3 · the 132 children — candidate, pre-ratchet)

PROJECTED INTENT · the commit’s claims, head→axis_i tail→axis_j (cyan)

the three-length view — good = claims land inside their own zone

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PROJECTED REALITY · same projection law (amber)

same projection law — good = reality occupies the zones intent does

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

STRAIGHT COMPARISON · green both · cyan intent-only · amber reality-only · 4% overlap

good = the zones agree; cross-zone scatter is the drift to read

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

shortlex-3 zone occupancy (lit cells per diagonal square)
INTENT: 2 in the 3×3 ABC corner · 2 in the 9×9 A1..C3 square · 805 in the 132×132 children square · 135 cross-zone
REALITY: 0 in the 3×3 ABC corner · 7 in the 9×9 A1..C3 square · 1570 in the 132×132 children square · 254 cross-zone
axes: identical 144 ShortLex names both sides (symmetric); weights asymmetric
zone 3 = candidate children, pre-ratchet (repo-derived dumps not yet past the perturbation-probe gate) · intent 160 claims @ θ 0.6563 · reality 51 claims @ θ 0.625 · projection 422ms

SHAPE-MATCH σ = -0.75 — the real intent↔reality definer walk vs random-reality (actual 0.0948 vs random 0.116). >0 = the walk distinguishes real alignment from noise; aggregate over independent walks → the divergent series.
σ_spec-delta · noise · no measurable relation between the work and the declared spec

Most out-of-lane row: B3 · Signal — that lane is drifting most (read the red band in that row).

Three-colour tolerance (out-of-lane = reality fires where intent is weak, in orthogonal blocks): green=in-lane agreement · amber=a few out-of-lane (tolerated) · red=FIRED — orthogonal out-of-lane 34% vs tolerance 25%.
466 green · 681 amber · 600 red · 160 XOR-friction cells.

Both axes = the 144 ShortLex anchors, cell=row⊕col, on the chip. INTENT=docs+rules · REALITY=code · DELTA=friction.

tile dump — what the SimHash matched on the diagonal (inspect the sensor; tap to expand)

A,A The lattice we build today is what next year's underwriter inherits.

intent 77% - **We are not an insurer.** We bear no risk, pay no claims, and will not tell you what your pr

reality 73% This change operates in the ui frontend domain, involving page render. This change operates in

B,B Tactics is the choice of which leverage to pull at which beat.

intent 75% **The Design Partner approves the case study in writing before publication**, and may require t

reality 78% console.log(` ${rec ? '↳ walk completed on its WORK bound — reproducible for this input.' : '↳

C,C Operations is the loop that runs whether anyone watches.

intent 81% ## REQUIREMENTS (falsifiable) - **R1 — reef-from-spec.** A command that compiles an arbitrary m

reality 83% // byte-identical; this walk-depth figure is telemetry. Label each as what it is.

A1,A1 EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at

intent 83% - **No pipeline rebuild.** Drop the binary alongside your current agent stack; you are not re-a

reality 80% (no distinctive match)

A2,A2 The target is the cell coordinate the system MUST occupy by end-of-quarter.

intent 80% (no distinctive match)

reality 80% // NOT RECOMPUTABLE (2026-07-13). A walk cut short by elapsed-time depends on machine load, so

A3,A3 Every dollar builds either the floor (substrate that lifts future bets) or the ceiling (cap on the next round)

intent 77% (no distinctive match)

reality 67% const timeBudgetTripped = frontier.length > 0 && hops < budget && (Date.now() - t0) >= budgetMs

B1,B1 Latency is the price of a missed beat.

intent 78% already carry — not to a new software budget nobody has.

reality 70% // present a tripped walk as recomputable. Never let it fail silently again.

B2,B2 The deal sets the exchange rate between two value substrates.

intent 78% (no distinctive match)

reality 72% (no distinctive match)

B3,B3 Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipi

intent 75% **ThetaDriven receives no Design Partner data.** The binary runs on the Design Partner's iron;

reality 72% (no distinctive match)

C1,C1 Power flows where the grid lets it.

intent 78% WHY THE EXISTING GUARD MISSED IT — the lesson, bigger than the bug: tests/pmu/matchsigma-determ

reality 72% (no distinctive match)

C2,C2 Each iteration is a hypothesis tested against the ground truth of the world.

intent 78% - Deployment is **limited to a sandbox or a single non-production agent fleet** named by the De

reality 70% (no distinctive match)

C3,C3 Flow is the rate at which committed work crosses the finish line.

intent 77% ## 9. What this is not

reality 78% // output claimed "byte-identical every run". The placement coordinate was never affected (it i

commit context — 7 file(s)

fix(pmu): the demo claimed byte-identical while its own output drifted 9.5 → 9.6

Ran attest-demo three times cold, as a skeptical CISO's engineer would, and diffed.
The output is NOT byte-identical: DIVERGENT-SERIES WALK σ moved 9.5 → 9.6 across
three consecutive runs on ONE IDLE MACHINE — printed six lines under our own claim
'byte-identical every run'. Recomputability IS the product. The buyer we are about to
hand this to is an underwriter whose first instinct is to give it to opposing counsel
to break, and they would have broken it in one command.

ROOT CAUSE (not the symptom): every walk is bounded by wall-clock —
  while (frontier.length && hops < budget && (Date.now() - t0) < budgetMs)
so a loaded machine completes fewer hops → different matrix → different σ. The July
fix seeded the impostor PRNG and stopped there; the TIME bound was left in place.

WHY THE EXISTING GUARD MISSED IT — the lesson, bigger than the bug:
tests/pmu/matchsigma-deterministic.test.mjs GREPS THE SOURCE for a seeded PRNG. It
asserts the fix's SHAPE, never its BEHAVIOUR. The PRNG was seeded and the σ still
drifted, because a source-grep can never see a load-dependent output. MEASUR

docs/legal/design-partner-lou.md
docs/outreach/cro-one-pager.md
scripts/pmu/attest-demo.mjs
scripts/pmu/definer-walk-144.mjs
scripts/pmu/triptych-build.mjs
tests/outreach/buyer-artifacts-survive-the-committee.test.js
tests/pmu/walk-sigma-recomputable.test.mjs

Produced on the chip by the running pipeline (scripts/pmu/pipeline.mjs → runPipeline → walk + xor), commit-scoped · on-chip per-walk 815.27ns (this commit). Recompute: node scripts/pmu/commit-triptych.mjs --commit 3fe7640cd

Commit artifacts (open on a computer — Gmail mobile won't follow file:// links; the inline images above are the phone-viewable form): reef grid · this triptych · the HDL — all three are also attached to this email.