{
 "schema": "terms-v1",
 "kind": "harness",
 "at": "2026-11-01T00:57:19.330Z",
 "node": "v18.19.1",
 "fresh": true,
 "portable": {
  "rows": 13,
  "portable": 13,
  "not_portable": 0,
  "unknown": 0
 },
 "cachedRows": 0,
 "verdict": "PASS",
 "browser": {
  "judged": 5,
  "skipped": 0,
  "reason": null,
  "reused": false
 },
 "rows": [
  {
   "id": "statement-signed",
   "term": "LEDGER signed / STATEMENT",
   "guarantee": "a statement edited after signing, or signed by an outside key, is refused",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_comm_plantrust.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 13,
     "key": "eba603fad757",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_plantrust.log"
    },
    {
     "file": "witness_team_publish.js",
     "layer": "browser",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 349,
     "key": "51d38b505485",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_team_publish.log"
    }
   ],
   "controls": [
    {
     "id": "edited-after-signing refused",
     "layer": "engine",
     "found": true,
     "evidence": "keys edited after signing -> REFUSED:plan-trust-signature"
    },
    {
     "id": "outside signer refused",
     "layer": "engine",
     "found": true,
     "evidence": "REFUSED:plan-trust-untrusted-signer"
    },
    {
     "id": "page: unsigned set refused",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 P3 an UNSIGNED set is refused by the engine itself"
    },
    {
     "id": "page: set edited after signing refused (bad-signature)",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 P3 a set edited after signing: the POLICY is merged (the admin may publish it) but B REFUSES the set (bad-signature)"
    },
    {
     "id": "page: outside key refused",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 P4 a set signed by a key outside the trust list: refused:untrusted-signer"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine + browser",
   "untracked": [],
   "portable": true
  },
  {
   "id": "trusted-keys",
   "term": "trusted keys",
   "guarantee": "the backup key replaces a lost primary; a non-admin or stale statement cannot change the list",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_comm_plantrust.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 13,
     "key": "eba603fad757",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_plantrust.log"
    },
    {
     "file": "witness_comm_policy.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 11,
     "key": "c2f4c5d2f380",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_policy.log"
    },
    {
     "file": "witness_team_publish.js",
     "layer": "browser",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 349,
     "key": "51d38b505485",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_team_publish.log"
    }
   ],
   "controls": [
    {
     "id": "backup recovers lost primary",
     "layer": "engine",
     "found": true,
     "evidence": "the BACKUP signs [K1,K3] (primary dropped, lost-key recovery): MERGED, list in force = [K1,K3] — MERGED:policy MERGED"
    },
    {
     "id": "non-admin refused",
     "layer": "engine",
     "found": true,
     "evidence": "NON-admin device B -> REFUSED:not-admin"
    },
    {
     "id": "stale replay refused",
     "layer": "engine",
     "found": true,
     "evidence": "REFUSED:plan-trust-stale"
    },
    {
     "id": "page: non-admin publish refused on both devices",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 P5 a non-admin's publishUpcasters has no effect: its POLICY is REFUSED not-admin on both devices"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine + browser",
   "untracked": [
    {
     "repo": "BIMCompiler",
     "path": "build/erp/ad_full.db",
     "kind": "untracked",
     "why": "gitignored",
     "bytes": 44937216,
     "sha256": "179cd349cedb",
     "manifest": "ok"
    }
   ],
   "portable": true
  },
  {
   "id": "rule-in-force",
   "term": "STATEMENT (rule in force)",
   "guarantee": "a claim stays judged by the rule in force when it was made; a later statement never rewrites it",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_comm_executors.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 12,
     "key": "0e469ac78f56",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_executors.log"
    },
    {
     "file": "witness_comm_settrust.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 13,
     "key": "f9e4b642c48f",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_settrust.log"
    },
    {
     "file": "witness_team_executors.js",
     "layer": "browser",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 349,
     "key": "78dcb1030d87",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_team_executors.log"
    }
   ],
   "controls": [
    {
     "id": "Complete under old map stays refused after {}",
     "layer": "engine",
     "found": true,
     "evidence": "AFTER {} the Complete done under the old map STAYS refused"
    },
    {
     "id": "set published under the old list still loads after rotation",
     "layer": "engine",
     "found": true,
     "evidence": "V3 MERGED; a fresh device on [K2,K3] loads S0 and S2"
    },
    {
     "id": "page: refused SET_STATUS stays refused after {}",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 X9 after the map {} the SET_STATUS the station was refused on STAYS refused"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine + browser",
   "untracked": [],
   "portable": true
  },
  {
   "id": "complete-all-or-nothing",
   "term": "BUNDLE (Complete)",
   "guarantee": "a Complete by the wrong role is refused on every device, the consequences with it",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_comm_executors.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 12,
     "key": "0e469ac78f56",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_executors.log"
    },
    {
     "file": "witness_team_executors.js",
     "layer": "browser",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 349,
     "key": "78dcb1030d87",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_team_executors.log"
    }
   ],
   "controls": [
    {
     "id": "status op refused not-executor everywhere",
     "layer": "engine",
     "found": true,
     "evidence": "status op is REFUSED not-executor on EVERY device"
    },
    {
     "id": "group consequence refused with it",
     "layer": "engine",
     "found": true,
     "evidence": "REFUSED not-executor-group everywhere (all-or-none)"
    },
    {
     "id": "page: clicked CL refused at fold, order unchanged",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 X7 C's DocAction (CL) is REFUSED at fold on A (E3 stays: not-executor), and the order on A is unchanged"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine + browser",
   "untracked": [],
   "portable": true
  },
  {
   "id": "ledger-convergent",
   "term": "LEDGER convergent",
   "guarantee": "devices with the same history agree; a stale copy is not taken in",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_comm_cl3_store.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 11,
     "key": "82906d2466e7",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_cl3_store.log"
    },
    {
     "file": "witness_comm_cl5_conflict.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 12,
     "key": "1be5670ef511",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_cl5_conflict.log"
    },
    {
     "file": "witness_team_base.js",
     "layer": "browser",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 355,
     "key": "ffafbae14633",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_team_base.log"
    }
   ],
   "controls": [
    {
     "id": "same order on every device",
     "layer": "engine",
     "found": true,
     "evidence": "same order on every device"
    },
    {
     "id": "stale save refused (ReQuery)",
     "layer": "engine",
     "found": true,
     "evidence": "saveCheck stale=true msg=\"Current record was changed by another user, please ReQuery\"  fresh=false"
    },
    {
     "id": "page: same refusal on A and B",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 role 103 has no write on org 0: REFUSED with an access: reason by the base row's scope — the SAME verdict on A and on B"
    },
    {
     "id": "page: base-row-missing refused on both devices",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 an op on a uu that is in neither the log nor the base is REFUSED base-row-missing — on both devices"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine + browser",
   "untracked": [
    {
     "repo": "BIMCompiler",
     "path": "build/erp/ad_full.db",
     "kind": "untracked",
     "why": "gitignored",
     "bytes": 44937216,
     "sha256": "179cd349cedb",
     "manifest": "ok"
    }
   ],
   "portable": true
  },
  {
   "id": "visit-lossless-offline",
   "term": "VISIT (offline / interrupted)",
   "guarantee": "no connection or a lying pipe sends nothing and loses nothing; the later Visit sends everything once",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_terms_visit.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 11,
     "key": "6ec93727dd99",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_terms_visit.log"
    }
   ],
   "controls": [
    {
     "id": "dead pipe: nothing lost",
     "layer": "engine",
     "found": true,
     "evidence": "a dead pipe: every claim still held locally, none marked sent"
    },
    {
     "id": "liar pipe caught by read-back",
     "layer": "engine",
     "found": true,
     "evidence": "the read-back catches the dropped bundle"
    },
    {
     "id": "checkers fail on doctored state",
     "layer": "engine",
     "found": true,
     "evidence": "CONTROL V2 liar-checker on a Visit that claims success (checker on a doctored state must FAIL) — failed as designed"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine only (no browser witness located)",
   "untracked": [
    {
     "repo": "BIMCompiler",
     "path": "build/erp/ad_full.db",
     "kind": "untracked",
     "why": "gitignored",
     "bytes": 44937216,
     "sha256": "179cd349cedb",
     "manifest": "ok"
    }
   ],
   "portable": true
  },
  {
   "id": "visit-once",
   "term": "VISIT (voluntary, once)",
   "guarantee": "one Visit sends everything once; a second sends nothing",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_terms_visit.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 11,
     "key": "6ec93727dd99",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_terms_visit.log"
    },
    {
     "file": "witness_comm_cl3_store.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 11,
     "key": "82906d2466e7",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_cl3_store.log"
    }
   ],
   "controls": [
    {
     "id": "third Visit sends nothing",
     "layer": "engine",
     "found": true,
     "evidence": "a third Visit sends nothing (once only)"
    },
    {
     "id": "incremental fetch is 0",
     "layer": "engine",
     "found": true,
     "evidence": "a visit with nothing new fetches 0 bundles"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine only (no browser witness located)",
   "untracked": [
    {
     "repo": "BIMCompiler",
     "path": "build/erp/ad_full.db",
     "kind": "untracked",
     "why": "gitignored",
     "bytes": 44937216,
     "sha256": "179cd349cedb",
     "manifest": "ok"
    }
   ],
   "portable": true
  },
  {
   "id": "ack-trail",
   "term": "ACK",
   "guarantee": "sent → seen → refused is visible on the sender",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_comm_cl3_store.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 11,
     "key": "82906d2466e7",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_cl3_store.log"
    },
    {
     "file": "witness_terms_visit.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 11,
     "key": "6ec93727dd99",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_terms_visit.log"
    },
    {
     "file": "witness_team_so.js",
     "layer": "browser",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 355,
     "key": "b7da5a9ddc0c",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_team_so.log"
    }
   ],
   "controls": [
    {
     "id": "sent then SEEN by peers",
     "layer": "engine",
     "found": true,
     "evidence": "SEEN by B and C"
    },
    {
     "id": "refused shown on the sender with a reason",
     "layer": "engine",
     "found": true,
     "evidence": "the refused claim is on the sender's own trail with a named reason"
    },
    {
     "id": "counter fails with the refused claim removed",
     "layer": "engine",
     "found": true,
     "evidence": "CONTROL V3 refused-counter with the refused claim removed (checker on a doctored state must FAIL) — failed as designed"
    },
    {
     "id": "page: chip shows seen/refused/waiting/last visit",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 the ERP chip shows device code · team devices 2 · a Visit button with the hand cursor (A) — {\"text\":\"Team · 907A-8ACC · team devices 2 Visit my ops 5 · seen "
    },
    {
     "id": "page: unsent DocAction shows local-only warning",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 a DocAction is NOT sent and the chip shows a visible local-only warning"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine + browser",
   "untracked": [
    {
     "repo": "BIMCompiler",
     "path": "build/erp/ad_full.db",
     "kind": "untracked",
     "why": "gitignored",
     "bytes": 44937216,
     "sha256": "179cd349cedb",
     "manifest": "ok"
    }
   ],
   "portable": true
  },
  {
   "id": "version-skew",
   "term": "BUNDLE (version skew)",
   "guarantee": "newer waits, older waits for a rule, retired is ignored",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_comm_versions.js",
     "layer": "engine",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 15,
     "key": "62bef7b27a98",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_comm_versions.log"
    },
    {
     "file": "witness_team_versions.js",
     "layer": "browser",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 349,
     "key": "b721e12e5c0e",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_team_versions.log"
    }
   ],
   "controls": [
    {
     "id": "18 mutants killed",
     "layer": "engine",
     "found": true,
     "evidence": "§CV_VERDICT PASS judged=54 fails=0 vacuous=0 mutants_killed=18/18"
    },
    {
     "id": "page: newer op parked needs-upgrade",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 M2 the sv:2 op is PARKED needs-upgrade"
    },
    {
     "id": "page: same op without sv merged (control)",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 M2 CONTROL: the same op without sv is MERGED"
    },
    {
     "id": "page: tampered set refused",
     "layer": "browser",
     "found": true,
     "evidence": "🟢 M4 tampered set -> refused:bad-signature"
    }
   ],
   "status": "ENFORCED",
   "note": null,
   "layers": "engine + browser",
   "untracked": [
    {
     "repo": "BIMCompiler",
     "path": "build/erp/ad_full.db",
     "kind": "untracked",
     "why": "gitignored",
     "bytes": 44937216,
     "sha256": "179cd349cedb",
     "manifest": "ok"
    }
   ],
   "portable": true
  },
  {
   "id": "doc-numbering",
   "term": "LOCAL NUMBERING (LEDGER)",
   "guarantee": "with Team, two stations (login users with a Search Key) never issue the same document number: OrgValue-UserValue-n each; another station's or a typed number is refused at fold",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_docno_till.js",
     "layer": "ootb",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 20,
     "key": "25ddff9ab3a2",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_docno_till.log"
    },
    {
     "file": "witness_docno_till.js",
     "layer": "ootb",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 20,
     "key": "fd868de6c65d",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_docno_till_mutants.log"
    }
   ],
   "controls": [
    {
     "id": "same user on two devices collides (control)",
     "layer": "ootb",
     "found": true,
     "evidence": "§DT PASS D11 - CONTROL"
    },
    {
     "id": "shipped plain sequence collides (control)",
     "layer": "ootb",
     "found": true,
     "evidence": "§DT PASS D5 - CONTROL"
    },
    {
     "id": "another station's / typed number refused at fold on every device",
     "layer": "ootb",
     "found": true,
     "evidence": "§DT PASS D14 - "
    },
    {
     "id": "new format refused until its edit is in the log",
     "layer": "ootb",
     "found": true,
     "evidence": "§DT PASS D15b - "
    },
    {
     "id": "user preference cannot change the station",
     "layer": "ootb",
     "found": true,
     "evidence": "§DT PASS D13 - "
    },
    {
     "id": "4 mutants killed",
     "layer": "ootb",
     "found": true,
     "evidence": "§DT_MUTANTS killed=4/4"
    },
    {
     "id": "legacy pilot (real WS logins) numbers the same at every position",
     "layer": "ootb",
     "found": true,
     "evidence": "§DT PASS D20 - LEGACY"
    },
    {
     "id": "demo station never numbers Org--n",
     "layer": "ootb",
     "found": true,
     "evidence": "§DT PASS D19 - "
    }
   ],
   "status": "ENFORCED",
   "note": "TEAMWORK §48.11b-§48.11d. Legacy arm: the pilot's own WS-login run == the twin replay (D20, scripts/bridge/out/docno_station_legacy.json). Limits: an author not bound to an AD_User is not judged at fold (counted); two users sharing a Search Key share a series",
   "layers": "bim-ootb tree (node, real modules)",
   "untracked": [],
   "portable": true
  },
  {
   "id": "visit-bounded",
   "term": "VISIT (bounded)",
   "guarantee": "Visit #1 download stays bounded as the team grows: each device lists and downloads only its own mailbox, not every other device's bundle",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_f1_mailbox.js",
     "layer": "ootb",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 24,
     "key": "12d9b9600f0d",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_f1_mailbox.log"
    }
   ],
   "controls": [
    {
     "id": "fetched objects flat in N (3 -> 12)",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §F1-A objects fetched in a fresh Visit are flat in N (3 -> 12) - 5 -> 5"
    },
    {
     "id": "CONTROL pre-F1 engine: the same measure grows with N",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §F1-A CONTROL pre-F1: the same measure GROWS with N (so the flat arm is not vacuous) - 8 -> 26 objects"
    },
    {
     "id": "CONTROL pre-F1: station 1 held foreign DOWN ops (now none)",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §F1-E CONTROL pre-F1: station 1 DID download another station's DOWN envelope - foreign DOWN ops held=11"
    },
    {
     "id": "station 1 never GETs another mailbox",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §F1-E station 1 never GETs another station's mailbox nor the hub inbox - gets=5 foreign=0"
    },
    {
     "id": "CONTROL pre-F1 relay gate refuses the mailbox name",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §F1-I CONTROL pre-F1: the same mailbox name is refused by the old gate"
    },
    {
     "id": "7 mutants killed",
     "layer": "ootb",
     "found": true,
     "evidence": "§F1-MUTANTS killed=7/7 not_applied_or_crashed=0"
    }
   ],
   "status": "ENFORCED",
   "note": "TEAMWORK §45.2/§45.8 F1 per-device mailboxes (bim-ootb #2477; witness common/tests/witness_f1_mailbox.js, mutants run by the witness itself). Measured edge Visit #1 download 384 / 386 / 388 B at N=10/100/1000 (W-SCALE-STAR: build/scriptor/f1_mailboxes/scale_star_F1_final_engine_{10,100}.log, scale_star_F1_engine_1000.log; was 367 KB / 4.5 MB / 45.8 MB). Stated limits: the identity/roster floor on a first-ever Visit is not bounded (identity ops reach everyone); withholding of one mailbox bundle now shows as a gap (per-mailbox sequence, §45.11 / bim-ootb #2486; was a parked op); an old app in a new star space silently misses mailbox mail; the GitHub listing is still O(N) calls",
   "layers": "bim-ootb tree (node, real modules)",
   "untracked": [],
   "portable": true
  },
  {
   "id": "sealing-real",
   "term": "RELAY (sealing)",
   "guarantee": "in a mailbox (star) space each station's mail is sealed to its pair (that station + head office): another member holding the team key reads none of it, the relay reads none of it, and a withheld mailbox bundle shows as a gap",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_read_scope.js",
     "layer": "ootb",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 24,
     "key": "42c7d7f803bf",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_read_scope.log"
    },
    {
     "file": "witness_f1_mailbox.js",
     "layer": "ootb",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 24,
     "key": "12d9b9600f0d",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_f1_mailbox.log"
    }
   ],
   "controls": [
    {
     "id": "a modified member opens 0 of another station's mail",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §RS-A Y (a modified client that lists and gets every m/ object) opens 0 of the 3 laned ops of X - leaked=0"
    },
    {
     "id": "CONTROL team key only: the same member opens all of it",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §RS-A CONTROL: with audience sealing off (space key, as F1) the same Y opens 3 of 3"
    },
    {
     "id": "a rogue key for another pair is never sealed to",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §RS-E Y (holding its own candidate key for p_X, accepted by the roster) opens 0 of H's DOWN mail"
    },
    {
     "id": "revoked device opens 0 after the rekey",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §RS-F the revoked device opens 0 of it"
    },
    {
     "id": "withheld middle bundle is a gap",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §RS-G the relay withholds X's MIDDLE m/hub/ bundle -> gaps() = [{author X, box hub, seq 2}]"
    },
    {
     "id": "withheld last bundle is a gap (signed head)",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §RS-G the relay withholds X's LAST bundle -> reported from X's signed head"
    },
    {
     "id": "CONTROL F1 engine: the same withholding shows no gap",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §RS-G CONTROL (the F1 engine, same withholding): gaps() = []"
    },
    {
     "id": "no key yet: held, never sent under the team key",
     "layer": "ootb",
     "found": true,
     "evidence": "PASS §RS-H the held op is nowhere on the relay (not under the space key, not plaintext) - objects containing it=0"
    },
    {
     "id": "all mutants killed",
     "layer": "ootb",
     "found": true,
     "evidence": "§RS_SCOPE_VERDICT PASS judged=41 fails=0 inconclusive=0 mutants=10/10"
    }
   ],
   "status": "ENFORCED",
   "note": "TEAMWORK §45.11 (bim-ootb #2486, #2498; witness common/tests/witness_read_scope.js, 10 mutants run by the witness itself; RED first on the F1 engine: FAIL judged=39 fails=13). Stated limits: the relay still sees metadata (author, box, counts, timing, sizes); in a mailbox space a checkpoint publishes no state (bim-ootb #2498, so no laned record id or verdict is readable with the team key) — the cost: a light client there folds instead of adopting a checkpoint; an insider holding a pair key can leak it; office spaces and spaces founded before F1 keep the team-wide key (unchanged by design)",
   "layers": "bim-ootb tree (node, real modules)",
   "untracked": [],
   "portable": true
  },
  {
   "id": "key-roles-threshold",
   "term": "trusted keys (roles + threshold)",
   "guarantee": "a key may only do what its role allows; a rotation or publication needs the declared number of DISTINCT valid keys; a device clock never expires anything",
   "roadmap": null,
   "witnesses": [
    {
     "file": "witness_team_keys.js",
     "layer": "ootb",
     "exit": 0,
     "verdict": "PASS",
     "skipped": null,
     "reused": false,
     "cached": false,
     "inputs": 27,
     "key": "0349ab0ddd75",
     "log": "../../home/red1/bim-compiler/build/scriptor/gaps_49_1/terms_fresh_c/witness_team_keys.log"
    }
   ],
   "controls": [
    {
     "id": "rotate-only key cannot publish",
     "layer": "ootb",
     "found": true,
     "evidence": "🟢 R2 the rotate-only key CANNOT publish an executors map — REFUSED:executors-role"
    },
    {
     "id": "publish-only key cannot rotate",
     "layer": "ootb",
     "found": true,
     "evidence": "🟢 R3 a publish-only key CANNOT rotate the list — REFUSED:plan-trust-role"
    },
    {
     "id": "one signature under T=2 refused",
     "layer": "ootb",
     "found": true,
     "evidence": "🟢 T1 T=2: ONE signature on a rotation is REFUSED — REFUSED:plan-trust-threshold"
    },
    {
     "id": "duplicate signer counted once",
     "layer": "ootb",
     "found": true,
     "evidence": "🟢 T1 T=2: the SAME key signing twice counts once - REFUSED — REFUSED:plan-trust-threshold"
    },
    {
     "id": "forged cosignature refused",
     "layer": "ootb",
     "found": true,
     "evidence": "🟢 T4 a forged cosignature (a signature over other content) is ignored, so the count falls short — REFUSED:plan-trust-threshold"
    },
    {
     "id": "far-future device clock expires nothing",
     "layer": "ootb",
     "found": true,
     "evidence": "🟢 A1 with the device clock at 2040, entries expiring after the anchor are NOT expired (the clock is never read) — [false,false,false]"
    },
    {
     "id": "far-future device clock moves no anchor",
     "layer": "ootb",
     "found": true,
     "evidence": "🟢 A3 an op authored under a 2040 device clock does not move the anchor"
    },
    {
     "id": "legacy log folds to identical verdicts (L1 judged, not INCONCLUSIVE)",
     "layer": "ootb",
     "found": true,
     "evidence": "🟢 L1 a log written by the UNMODIFIED engine (rotation, executors map, a refused stale-signer map) folds to the IDENTICAL verdicts under the new engine — ops=5 "
    }
   ],
   "status": "ENFORCED",
   "note": "TEAMWORK §46.5 versioning Stage 2 (bim-ootb #2473; witness erp/tests/witness_team_keys.js, 9 mutants run by the witness, L1 legacy-fold arm needs KW_OLD = common/comm before #2473, built by the runner with git archive)",
   "layers": "bim-ootb tree (node, real modules)",
   "untracked": [],
   "portable": true
  }
 ]
}