Release · S286–S286
The truth-check was losing different pieces of work that happened to share a name
VEILOS has spent several releases measuring what its own checks can and cannot see. This release found that the instrument could identify a piece of work correctly and still give it somebody else’s result. Eleven separate parts of the public card renderer are all called stat. The checker stored what each one reads under that shared name, so every new stat replaced the one before it. Four real readers disappeared: one looking at Observatory snapshots, two looking at the Mind’s claims, and one looking at both Imprints and Observatory snapshots. The result was not a false sentence on the site; it was a false absence in the instrument meant to find those sentences. The graph now identifies work by where it actually lives, while keeping the familiar name only as a label. Driven against all eleven live methods, the disagreement fell from four to zero. The counted boundary moved from four hundred and eight readers to four hundred and eleven because three previously erased readers now exist to the measure. The search radius did not widen. That distinction matters: a bigger number can mean the world grew, or it can mean the ruler stopped dropping things. A second instance of the same identity mistake appeared while the local Worker started. The registry behind this check named the same story renderer twice, and JavaScript silently kept the later entry. Both descriptions were true, so nothing downstream looked wrong; one truth had simply overwritten another. They are now one entry, and a source-level guard deliberately inserts a duplicate and proves it is refused before JavaScript can hide it. The release also settles a question left open twice. A privacy census was requiring a new manifest row whenever this registry merely named a sensitive collection in a declaration, even though it never read a person’s data. Globally hiding string literals would have concealed a real bracket-form read, so that was never safe. Instead there is one narrow structural proof: every occurrence must remain inside the named declaration, and the module must contain no dot, bracket or destructuring access to that collection. Add either state.collection or state["collection"] and the exemption revokes itself; the module returns to the ordinary privacy manifest and the release goes red. Two recurring rows are gone without weakening the boundary. Finally, the limit of the instrument is no longer something only a health endpoint knows. The Truth Trail now carries a card that says what the release proof can see: eight callable forms, one same-module call frame and fifty-one declared source claims. It also names the unanswered tier — one hundred and fifty-one ring readers across forty-three modules where completeness wording lives somewhere else — and says plainly that not asked is not an all-clear. Agents receive the same values at /api/mind from the same projection. The first rendered version leaked an internal function name and code punctuation into that public explanation. Looking at the real dark and light pixels on mobile and desktop caught it; the copy now states the boundary in ordinary language. Across the complete source suite, four thousand four hundred and thirty-seven checks pass.