feat(pmu): dual-witness on the receipt path — simhash_only retired from both critical sense calls

RPM 22 / task 6 executed under the operator's blanket "go as far as
you can" (2026-07-09). The two receipt-critical sense calls now run
the FULL dual-witness (SimHash + gzip-NCD inner loop):

  · scripts/pmu/pipeline.mjs senseCell — simhashOnly=false (was a
    hardcoded true with a "SimHash-only" comment)
  · scripts/pmu/sigma-onchip.mjs senseOnChip — simhash_only:false

A lone hash no longer masquerades as the pinned witness anywhere a
receipt is minted. The rust source's own comment (sense.rs) says the
dual-witness is affordable at 144 nodes; measured after the flip:
runPipeline completes all 9 stages in 413ms; the prompt lens is
UNAFFECTED (it does not import pipeline.mjs — asserted in the guard;
isolated receipts 111-167ms, within the 200ms gate). validate-dogfood:
10 passed / 1 failed BOTH before and after the flip (the leaf-walk
0-cells failure pre-exists — verified by stash-compare — and is not
touched by this change). Analysis-only simhash callers (book-heatmaps,
walk-contribution, …) keep the cheap witness by choice; this fences
the RECEIPT path only.

Guard: tests/pmu-simulator/receipt-dual-witness.test.mjs — pins
false at both call sites, forbids the true form returning, and pins
the lens/pipeline decoupling. 3/3 green.

Originating-Terminal: 🎤 voice
Relevant-Rooms: 🧪 laboratory, 🔨 builder, 🎩 operator
Story: The audit-trail claim ("dual-witness or honestly disagreeing")
was true in reef-sigma and false where it mattered most — the commit
receipt itself. Two one-word flips, measured safe, close the gap the
70-RPM mining found.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YQxP9rRho3RXPUBTtdvWgZ

commit 62011b988 — 144×144 lattice triptych (on-chip)

◎ the ingest chose C3,A — Operations·Flow × Strategy — acting on B,A1 — Tactics × Strategy·Law (grip 0.766) · the walk starts at the ACTOR's row · 3 file(s)

⏱ ingest 491.9ms (corpus→lattice) · definer walk 1648ms (row→transpose→row, ballistic XOR per hop) · total 2615ms
ingest here = commit-scoped SENSING only (this commit's message + changed files → lit anchors) — deep seed authoring lives in the reef-self-loop, off the commit path

rows = ACTOR (lens) · cols = PATIENT (object) · diagonal = self-reference; ◎ at actor-row × patient-col — every panel, same orientation. Heat above the diagonal = actors ranking ShortLex-earlier than their patients (the walk follows definers uphill in rank).
The 12 canonical lanes (rows top→bottom, cols left→right): A·Strategy · B·Tactics · C·Operations · A1·Law · A2·Goal · A3·Fund · B1·Speed · B2·Deal · B3·Signal · C1·Grid · C2·Loop · C3·Flow

PAIR LATTICE (the map we normally see)

PRE-WALK SENSE · INTENT grid — the snapshot, no point of view

the no-point-of-view snapshot — what the sensor lit before any walk; the leaf walk below is what bridges the two grids

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK SENSE · REALITY grid — the snapshot, no point of view

the no-point-of-view snapshot, reality side — same sensor law

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK Δ · straight comparison of the two ingested grids (green both · cyan intent-only · amber reality-only) · 4% overlap · ◎ = where the competence pixel sits in the raw overlap

good = green overlap without being a copy — near-100% is self-similarity, not alignment

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

◎ the pixel this commit belongs to

C3,A — Operations·Flow × Strategy (actor) acting on B,A1 — Tactics × Strategy·Law (patient) · grip 0.766

actor seed C3,A — Flow throughput and delivery rate measure how effectively the long-horizon strategy substrate crosses the finish line. Flow is the rate at which committed work crosses the finish line. Inventory accumulates upstream; flow is the only thing the customer pays for, and the only thing the operator can measure honestly. The lattice we build today is what next year's underwriter inherits. We set the substrate that downstream pricing rides on, and that choice is paid back across every quarter we keep operating. Movement is the irreversible delivery of value across the boundary. Anything stationary is cost; anything moving is either revenue, deferred revenue, or the exhaust of revenue not yet realized. Direction is what you keep when you forget the calendar. Multi-year posture, irreversibly chosen, defines the boundary every quarter renegotiates inside. Strategy is the bearing the rotation is measured against. Throughput dominates utilization. A ninety-nine-percent utilized system at low throughput pays the same wages as a fifty-percent utilized system at twice the throughput, but the second one ships the customer's order. Capital lives where strategy is durable. Frame the ten-year shape of the business before optimizing the ten-week sprint; the substrate decisions compound while the surface decisions decay. Flow has a direction. Bidirectional flow is two flows, each measured separately; calling them a single flow hides the chokepoint and the chokepoint is where the leverage lives. The strategic question is which doors close on purpose. Anything that keeps every option open until next year has already chosen the option of inaction, paid in optionality cost.

patient seed B,A1 — Maneuver choices in tactics must respect the binding mandate and governance rule of law within the beat. Tactics is the choice of which leverage to pull at which beat. Not what we want, but how the want lands on Tuesday: the sequence of irreversible commitments, each made before the next one's information is available. EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at any moment. Compliance attaches to the artifact the artifact cannot escape — provenance is a regulatory primitive, not a feature. Speed of feedback dominates speed of execution. Tactics that converge fast beat tactics that compute long, because the loop closes around the world's response before the world has moved. Constraints precede objectives. The cap-table, the license text, the consent envelope — each draws the inviolate line the action must respect, and the line is enforced before the optimization runs. The tactical map is a ranked list of moves where each move carries a cost-of-delay. Pick the move whose cost of doing it tomorrow exceeds the cost of doing it imperfectly today. A rule names what the system MAY NOT do. If the agent can do X, then 'forbid X' is not the constraint — it is wishful thinking dressed as policy. Constraints live in the gate, not in the prompt. Execution is a sequence of bets made under uncertainty. Tactics is the discipline of betting the right size on the bet whose information value pays for the loss-if-wrong. Regulation is not advisory. The fine is the price tag stapled to the omitted control; insurance is the option pricing on the failure-mode the regulation already named.

INTENT · leaf-walk clouds · BLUE→VIOLET by ply (◎ = the competence pixel: actor∩patient)

good = the clouds concentrate where the commit SAYS it works

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

REALITY · leaf-walk clouds · ORANGE→RED by ply (◎ = the same pixel — the shared perspective)

good = the same clouds as intent — shipped where declared

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

DELTA · graded cloud divergence (green agree · magenta declared-not-done · amber done-not-declared) · 3% agree

good = mostly green; magenta = said-not-done (chase it in the code), amber = done-not-said (chase it in the docs)

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

TOLERANCE · cloud topology (dim green in-shape · hot amber bleed · red orthogonal concentration)

red only matters above the flip — a few amber is normal bleed

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

SHORTLEX-3 PROJECTION (ABC · A1..C3 · the 132 children — candidate, pre-ratchet)

PROJECTED INTENT · the commit’s claims, head→axis_i tail→axis_j (cyan)

the three-length view — good = claims land inside their own zone

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PROJECTED REALITY · same projection law (amber)

same projection law — good = reality occupies the zones intent does

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

STRAIGHT COMPARISON · green both · cyan intent-only · amber reality-only · 5% overlap

good = the zones agree; cross-zone scatter is the drift to read

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

shortlex-3 zone occupancy (lit cells per diagonal square)
INTENT: 0 in the 3×3 ABC corner · 6 in the 9×9 A1..C3 square · 1858 in the 132×132 children square · 392 cross-zone
REALITY: 0 in the 3×3 ABC corner · 3 in the 9×9 A1..C3 square · 803 in the 132×132 children square · 105 cross-zone
axes: identical 144 ShortLex names both sides (symmetric); weights asymmetric
zone 3 = candidate children, pre-ratchet (repo-derived dumps not yet past the perturbation-probe gate) · intent 44 claims @ θ 0.625 · reality 22 claims @ θ 0.625 · projection 1135ms

SHAPE-MATCH σ = -0.08 — the real intent↔reality definer walk vs random-reality (actual 0.0899 vs random 0.092). >0 = the walk distinguishes real alignment from noise; aggregate over independent walks → the divergent series.
σ_drift · noise · below zero — this read is noise, not a measurement

Most out-of-lane row: B3 · Signal — that lane is drifting most (read the red band in that row).

Three-colour tolerance (out-of-lane = reality fires where intent is weak, in orthogonal blocks): green=in-lane agreement · amber=a few out-of-lane (tolerated) · red=armed — orthogonal out-of-lane 14% vs tolerance 25%.
557 green · 524 amber · 0 red · 236 XOR-friction cells.

Both axes = the 144 ShortLex anchors, cell=row⊕col, on the chip. INTENT=docs+rules · REALITY=code · DELTA=friction.

tile dump — what the SimHash matched on the diagonal (inspect the sensor; tap to expand)

A,A The lattice we build today is what next year's underwriter inherits.

intent 70% (no distinctive match)

reality 72% This change operates in the ui frontend domain, involving button nav render. This change operat

B,B Tactics is the choice of which leverage to pull at which beat.

intent 70% (no distinctive match)

reality 66% (no distinctive match)

C,C Operations is the loop that runs whether anyone watches.

intent 78% (no distinctive match)

reality 77% (no distinctive match)

A1,A1 EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at

intent 75% (no distinctive match)

reality 77% (no distinctive match)

A2,A2 The target is the cell coordinate the system MUST occupy by end-of-quarter.

intent 72% (no distinctive match)

reality 72% (no distinctive match)

A3,A3 Every dollar builds either the floor (substrate that lifts future bets) or the ceiling (cap on the next round)

intent 67% (no distinctive match)

reality 67% (no distinctive match)

B1,B1 Latency is the price of a missed beat.

intent 69% (no distinctive match)

reality 66% (no distinctive match)

B2,B2 The deal sets the exchange rate between two value substrates.

intent 70% (no distinctive match)

reality 70% (no distinctive match)

B3,B3 Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipi

intent 70% (no distinctive match)

reality 69% (no distinctive match)

C1,C1 Power flows where the grid lets it.

intent 73% Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/s

reality 67% (no distinctive match)

C2,C2 Each iteration is a hypothesis tested against the ground truth of the world.

intent 69% (no distinctive match)

reality 67% (no distinctive match)

C3,C3 Flow is the rate at which committed work crosses the finish line.

intent 77% (no distinctive match)

reality 78% (no distinctive match)

commit context — 3 file(s)

feat(pmu): dual-witness on the receipt path — simhash_only retired from both critical sense calls

RPM 22 / task 6 executed under the operator's blanket "go as far as
you can" (2026-07-09). The two receipt-critical sense calls now run
the FULL dual-witness (SimHash + gzip-NCD inner loop):

  · scripts/pmu/pipeline.mjs senseCell — simhashOnly=false (was a
    hardcoded true with a "SimHash-only" comment)
  · scripts/pmu/sigma-onchip.mjs senseOnChip — simhash_only:false

A lone hash no longer masquerades as the pinned witness anywhere a
receipt is minted. The rust source's own comment (sense.rs) says the
dual-witness is affordable at 144 nodes; measured after the flip:
runPipeline completes all 9 stages in 413ms; the prompt lens is
UNAFFECTED (it does not import pipeline.mjs — asserted in the guard;
isolated receipts 111-167ms, within the 200ms gate). validate-dogfood:
10 passed / 1 failed BOTH before and after the flip (the leaf-walk
0-cells failure pre-exists — verified by stash-compare — and is not
touched by this change). Analysis-only simhash callers (book-heatmaps,
walk-contribution, …) keep the cheap witness by choice; this fences
the RECEIPT path only.

Guard: tests/pmu-simul

scripts/pmu/pipeline.mjs
scripts/pmu/sigma-onchip.mjs
tests/pmu-simulator/receipt-dual-witness.test.mjs

Produced on the chip by the running pipeline (scripts/pmu/pipeline.mjs → runPipeline → walk + xor), commit-scoped · on-chip per-walk 516.14ns (this commit). Recompute: node scripts/pmu/commit-triptych.mjs --commit 62011b988

Commit artifacts (open on a computer — Gmail mobile won't follow file:// links; the inline images above are the phone-viewable form): reef grid · this triptych · the HDL — all three are also attached to this email.