Researcher IDE Test Plan

Affine IDE in the browser — test plan

Status: EXECUTED — sealed evidence/researcher-ide-falcon-loop-20260824T121306Z/VERDICT.json. Proven RESEARCHER_IDE_FALCON_LOOP. codegen DARK.
Prove: bash scripts/prove-researcher-ide-loop.sh

RENAMED 2026-10-14 — this page was titled "Researcher IDE + court loop — measured test plan". It is Affine IDE in the browser — test plan. The counts below are the measurements of the day each names.

Scope: how a researcher USES the existing IDE, how work is ASSOCIATED, how they SHARE it, and how we TEST coding + IDE updates. Falcon / Starship / Starlink atmospheric shear is the first study through this loop.
Not this file: a second Math Court, a Node harness, a hologram API, a login system, a Gamma/Glama update, or a public code-gen tool. Those stay dark until the prove loop is green.

Sibling worker (Falcon study and Affine IDE in the browser; its session 41479a74-c6ef-4afc-8547-fbe916cae917) owns the Falcon damage UI implementation. This page is the prove plan. If that worker lands files, cite those paths — do not fork a second UI.

Measured 2026-08-24 against files in this tree and the live membrane named below.

---

Surfaces that already exist (do not invent)

Kind	Live URL / route	File
Look (no identity)	https://affine.earth/language-game/#researcher	cells/xcode/Resources/language-game/researcher-learn.js
Court catalog GET	GET /language-invariant/games	same; paints lattice_courts
MCP names GET	GET /language-game/mcp-tools.json	cells/xcode/Resources/language-game/mcp-tools.json
MCP POST	https://affine.earth/language-invariant/mcp	49 tools, measured live 2026-09-02 per cell on all nine A records (48 on 2026-08-30; the 49th is execute_artifact_crucible, the Coding Court). Count from tools/list, never from docs/mcp/server.json — that file is the Glama registry manifest and declares remotes, not a tool list.
Court ingest	POST /language-invariant/game/{domain}/ingest	LanguageInvariantServeCommand.handleGameIngest + LatticeDomainIntegration.integrate
Sovereign Code IDE	https://affine.earth/language-game/ide.html	ide.html + ide-controller.js
Affine IDE in the browser	https://affine.earth/language-game/ide.html	an old #gym link lands here (2026-10-14: the Gym view is retired; its alive and A2A probes are read values in the status bar)
Compile	POST /ide-compile-wasm {code}	LanguageInvariantServeCommand ~889; IDEWasmCompiler
Rebuild mesh	POST /ide-rebuild-mesh + MCP ide_rebuild_mesh	founder cell C-1 only
Seal work	POST /language-invariant/work/seal	handleWorkSeal; client identity-spine.js
Grant / list / fetch	POST …/work/grant · GET …/work/list · GET …/work/fetch?work_id=	visibility ledger
Identity	wallet ⊕ location → user_vqbit_hash	identity-spine.js, wallet-login.js
Hologram landing	https://affine.earth/language-game/	wiki/Affine-Earth-Hologram-User-Guide.md
Projection room	/language-game/projection-room.html	look-walk in researcher-learn.js
3D twin	/language-game/openusd/	same
Watch	/language-game/watch.html	hologram guide
Falcon charter	Study 02	press/wiki/Study-02-Launch-Ionospheric-Holes.md
Convective charter	Study 09	press/wiki/Study-09-Global-Convective-Bond.md
Agent ingest prove	bash scripts/prove-math-court-agent-ingest.sh	three arms already green 2026-08-23
Look privacy prove	evidence/researcher-look-20260823/VERDICT.json	RESEARCHER_LOOK_ZERO_VISITOR_DATA
Identity prove	bash cells/xcode/scripts/prove-identity-spine.sh	W1/W2 + gym G1–G3

Registry: earth.affine/math-court 2026.8.24. Public clients: https://github.com/gaiaftcl-sudo/uum8dSolarResearch/tree/main/clients/math-court-mcp. Glama connector approved.

---

1. How a researcher USES the IDE + code-gen

Four paths, each with its own job.

LOOK — #researcher (anonymous, GET only)

1. Open https://affine.earth/language-game/#researcher or click Researchers (#researcherToggle).
2. researcher-learn.js GETs two catalogs with credentials: "omit", referrerPolicy: "no-referrer", no localStorage, no geolocation, no wallet, no source string, no MCP POST.
3. Walks already painted (same file): OpenUSD, projection-room, twin, lattice, GOP meta.
4. Court POSTs are not on this tab. The page says so: “Court POSTs are a different, explicit act — they live on the wiki, not here.”

Look does not generate files. Look does not bind a user.

CLAIM — court POST (attributed)

POST https://affine.earth/language-invariant/game/{domain}/ingest
{"source":"<who>","role":"<role>", …integers…}

source required. role required. Integers only. Measured refusals in LatticeDomainIntegration.integrate:

Missing / bad	Status
empty source	HTTP 400 REFUSED_UNATTRIBUTED — “absence is recorded, not defaulted”
1.5 anywhere	HTTP 400 REFUSED_FLOAT
no ingest key for that role	HTTP 400 REFUSED_EMPTY_PAYLOAD
unknown domain / role	HTTP 404

Nine courts (docs/mcp/server.json): geometry · chance · algebra · physics · qcd · health · finance · cs · fluids.

Optional wallet_hash on the same ingest triggers a QFOT debit (handleGameIngest). Absence of wallet_hash is legal; absence of source is not.

BUILD — existing IDE (writes / compiles / seals)

Open https://affine.earth/language-game/ide.html (an old #gym link lands on the same page).

Control	id	What it actually does
Compile WASM	#btn-compile	POST /ide-compile-wasm {code: editor}. Real artifact or honest fail.
Rebuild Mesh (C-1)	#btn-rebuild	POST /ide-rebuild-mesh. 403 on every apex cell. Only GAIAFTCL_CELL_ID == founder C-1.
Seal to mesh	#btn-seal-work / #btn-seal-confirm	Requires a compile artifact and IdentitySpine.resolve(). Missing identity → local refuse, nothing sent.
Download .wasm / project	#btn-download-wasm / #btn-download-project	Browser-local bytes only.
Franklin	#btn-send-ai	POST /language-invariant/franklin-speak {query}. Not code-gen.
Gym probes	#btn-gym-alive · #btn-gym-mcp-bonds · …	Live gym / corpus_bonds.
Stage hologram capture	#btn-gym-stage-capture	/language-game/#capture — existing hash, not a new API.
DEV / TEST / PROD	#env-selector	DEV edit · TEST zero-float audit · PROD read-only. No visitor deploy.
Wallet badge	#btn-wallet	WALLET NOT CONNECTED until a real bind. No fabricated balance.

Workspace files live in a browser VFS (ide-controller.js WORKSPACE_TEMPLATES). They enter git when someone exports or a TEST-ONLY generator writes a bound file.

ide_rebuild_mesh (MCP) is the same founder-only gate as the REST button. On the 9-cell apex it returns BLOCKED. That is the measured contract, not a defect to “fix” by opening rebuild to the world.

Compile on an apex cell without the wasm toolchain answers HOST CANNOT COMPILE. Compiles that succeed do so on founder C-1. The probe (POST /ide-compile-wasm {}) is 400 = route present, 405 = stale binary.

CODE-GEN — NEW, TEST-ONLY, currently dark

There is no MCP tool that generates a study UI. The 15 names in mcp-tools.json do not include a generate/codegen verb.

Do not confuse these with researcher code-gen:

Existing thing	What it is
POST /ide-compile-wasm	Compiles Swift the researcher already typed.
umc_direct domain=coding	UMC GAV controller.
/codegen · /emit	EdgeCodegenSpatialRoutes — LLVM token → ARM64 words. Edge protocol, not a Falcon UI.
Marketplace “Swift 6.4 code generation” card	ide.html banner: PREVIEW — SIMULATED.

A Falcon-scoped generate that writes a file the IDE can open is the new path. It stays off tools/list and off the public #researcher catalog until the prove loop in §4 is green. If the first generate fails, the endpoint stays dark.

Falcon as the first study through this loop

Study 02 is the charter: Falcon 9 / Falcon-class F-region holes, Vandenberg 2023-07-19 founding event, Gannon / Hunga Tonga / Falcon deorbit-burn adversaries. Ozone is named in the accountability paragraph (Maloney et al. black-carbon / DU scenarios) as the debate the per-launch TEC ledger must inform — Study 02 ingests TEC integers.

What already binds (use these, do not invent names):

Tool / court	Falcon use
physics ingest · role experimentalist / detector	Appointment integers: clock, track, table_counts (launch net, corridor cells, TEC table). Court returns CONTRACT — “table is the court”.
weather.convective_containment	Integer track vs declared convective cells (micro-deg, feet). REST /language-invariant/weather/convective-containment.
noaa_goes_r_weather	Live SIGMET / GOES-R / K / OVATION. Optional wallet_hash. Empty = empty, fail = CURE.
execute_transition	Signed membrane turn (entity_id + intent + client_signature). Identity bind / ingest.
ide_rebuild_mesh	C-1 rebuild only. Researchers observe the mesh.
critique_frame	Integer frame grade (kind enum is atc | proteins | materials today ).
verify_jordan_bond	Bond table over source_creator_hash / target_creator_hash.
corpus_bonds	Sealed corpus rows. Gym already calls this.
umc_direct / umc_resume / umc_status	domain=coding for the IDE session, not a damage law.
membrane_health	Bind check. Stateless.
feeds_catalog · game_frame_meta	Catalog / frame meta.

Wanted, beside what exists (the health court grades PK dose):

Wanted	What exists	Gap
Human health / UV-B / ozone DU	health court is dose as mill-units: mass_milli / vol_milli PK concentration	No ozone, UV-B, or skin-dose keys
Jet stream / crops	No court keys	Study 02 names GNSS-guided planting as a downstream of TEC holes, not a crop court
Phytoplankton	No court keys	Not in Study 02 ingest table
Full-spectrum damage UI	No file in this tree as of this plan (sibling owns the first UI)	TEST-ONLY generate writes one bound file; IDE opens it

Falcon loop the researcher actually runs:

1. LOOK #researcher — read the live tool list (48 as of 2026-08-30) + 9 courts. No identity.
2. CLAIM — POST physics (clock,track,table_counts) and, when a track vs cells is declared, weather.convective_containment. Integers only. source = researcher handle (not guessed). Optional wallet_hash if they already have a wallet bind.
3. NOAA look-up — noaa_goes_r_weather lane=weather|space for the live sky the track sits in. This is a feed, not a damage verdict.
4. BUILD — open IDE, put the receipt integers in the editor (or open the sibling Falcon UI file once it exists). Compile on C-1 if wasm is required. Seal with identity.
5. CODE-GEN (TEST-ONLY) — one Falcon-scoped generate → one file bound to source + user_vqbit_hash. IDE opens that file. If it fails, stop. Endpoint stays dark.
6. HOLOGRAM — project through existing surfaces only: landing /language-game/, projection-room.html, openusd/. Do not add a hologram route. Do not touch hologram CSS/filter.
7. REPORT — see §3. A “new report” in this tree is a sealed work row + the court receipt JSON + (later) a Study-02 results page.

---

2. How work is ASSOCIATED TO THE USER

No new login. Measure what already binds.

Identity that already exists

Layer	What it is	Where it lives
Look visitor	Does not exist. Proven RESEARCHER_LOOK_ZERO_VISITOR_DATA.	Nothing stored. credentials:omit. No localStorage.
Court source + role	Required prose/handle attribution. Echoed on the CALORIE receipt.	Cell response body.
Court wallet_hash	Optional. If present, QFOT debit.	Ingest body + economics KV balances.[wallet_hash].
user_vqbit_hash	32 lowercase hex. SHA256(entityID|entityID)[0:32] where entityID is wallet ⊕ location SCF.	Browser localStorage key affine.identity.v1 (identity-spine.js). Hash only — no address, no lat/lon on the wire.
Wallet / Keychain	Private keys stay in the browser (SovereignLinguisticMembrane copy). Mac Keychain is the GaiaFTCL app wallet, not the researcher look tab.	Browser IndexedDB / Keychain — never the look path.
Work creator	creator_vqbit_hash on work/seal. Presented hash wins; else server derives from entity_id + scf_hex.	NATS visibility ledger.
Work bearer	Seal return persisted per work_id in the same affine.identity.v1 store.	Browser only.
V251 gaiaftcl_language_game_turns	Franklin heal / language-game turns (proposal_id, cell_id, tau).	Cell ledger. Not the researcher look path. A look tab never writes a turn.

Three identity-spine states (identity-spine.js header): PRESENT · MISSING · BEARER. MISSING is null. Callers must not fabricate a stable hash.

Association model (the one we test)

Path	Attribution	If identity is missing
LOOK	Anonymous. Keep it.	N/A — there is no identity to miss.
CLAIM	source + role required. wallet_hash optional.	REFUSED_UNATTRIBUTED. Do not default source to "researcher" or "anon".
BUILD compile	Session-local VFS.	Allowed. Compile does not need a wallet.
BUILD seal	user_vqbit_hash required by ide-controller.js before POST.	Local refuse: “no identity established in this browser — sign in first.”
BUILD grant	Bearer for that work_id or current identity.	REFUSED_IDENTITY_MISSING in grantWork — nothing rides the wire.
CODE-GEN (TEST-ONLY)	source + role + presented user_vqbit_hash. All three.	Refuse. Do not guess. Do not derive from IP.

What is stored where

Store	What
Cell / NATS visibility ledger	work_id, creator_vqbit_hash, bytes, content_fnv, title, laws_exercised, grants/revokes.
Court receipt (response)	source, role, domain, integers, verdict. Optional qfot if wallet_hash was sent.
Browser	user_vqbit_hash + per-work bearers. Private keys. VFS editor buffers.
Git	Only what a researcher (or steward) commits. A generate must not silently write over another researcher’s path.
Look path	Never: location, wallet, name, source, cookies, credentials.

Two researchers must not silently overwrite each other

Measured collision today: handleWorkSeal sets

work_id = caller work_id  OR  "w" + contentFNV(bytes)

Identical bytes → identical default work_id. That is content-addressing, not researcher-addressing.

Rule for generate + seal (do not implement a second ledger):

• Caller must send work_id = "w" + creator16 + "_" + study_slug + "_" + contentFNV.
• File path on disk (TEST-ONLY generate) must include the same triple, e.g.
  language-game/studies/study-02/<creator16>/falcon-damage.html
• A second source / second user_vqbit_hash produces a second path and a second work_id.
• Same creator + same bytes is a dedup (same work_id), not an overwrite of someone else.
• Missing source or missing hash → refuse. No anon default on the generate path.

IDE compile-without-identity remains legal (browser-local). Seal and generate do not.

---

3. How they SHARE it

Surfaces that already share

Share	What the other person gets	Identity leak?
#researcher URL	Public catalogs.	No. Look sends none.
Court receipt JSON	source, role, integers, verdict.	Names the claim source, not a cookie. Safe to paste.
GET /language-invariant/work/fetch?work_id= after public grant	Bytes + creator_vqbit_hash + content_fnv.	Hash, not the private key. Fetch without user_vqbit_hash works only if audience is public. Ungranted → same body as “no such work”.
GET /language-invariant/work/list	Public listings only. Empty shelf = creator-only default.	No requester identity required.
Wiki / press pages	Study-02 charter, lattice endpoints, this plan.	Public prose.
Hologram / Gym / Watch / OpenUSD	GET views.	Landing and look walks use credentials:omit on catalog fetches.
IDE	The status bar reads the alive and A2A surfaces.	The IDE page carries no wallet: identity and Work grants are the front door's Profile (2026-10-14).

What a researcher can share

1. A sealed report URL: https://affine.earth/language-invariant/work/fetch?work_id=w… after they grant audience=public.
2. A generated UI GET route (once the sibling UI or TEST-ONLY generate lands): a path that paints integers and names source on the page, fetched with credentials:omit.
3. The court receipt (copy the JSON). It already echoes source.
4. A hologram view that already exists (/language-game/, openusd/, projection-room.html).

What stays private

• Private keys / WIF / Keychain material (#exportKeyBtn is the holder’s export, not a share link).
• An ungranted work row. Fetch returns not-served. Do not invent a “preview token”.

Attribution on the shared artifact

Minimum fields on every public GET view and every work row:

• source (claim handle)
• role
• creator_vqbit_hash (if sealed)
• wallet_hash only if they put it on the claim (optional; do not scrape it from the look tab)
• work_id / content_fnv
• court receipt hash / ingest status
• commit SHA if the file is in git

The generation act is a claim (POST, attributed). The shared view is a GET that does not send credentials. Two different HTTP verbs, one receipt.

Gamma / marketing

After — and only after — §4 is green, Gamma may consume the proven share link (public work/fetch or the GET UI). Gamma updates in a later pass.

---

4. How we TEST coding + IDE updates

Affine-stack only: Swift membrane, wasm the browser already loads, browser JS that draws. No Node harness that re-implements a law. scripts/prove-math-court-agent-ingest.sh already uses python3 to parse JSON — that is existing debt, not permission to add a .mjs court.

Named prove (to write when executing, not in this plan pass):

bash scripts/prove-researcher-ide-loop.sh

Evidence dir:

evidence/researcher-ide-falcon-loop-YYYYMMDDTHHMMSSZ/VERDICT.json

Step A — live MCP bind (already partly proven)

1. tools/list on https://affine.earth/language-invariant/mcp → 15 names including membrane_health, ide_rebuild_mesh.
2. Call membrane_health → cell identity, no args.
3. Call ide_rebuild_mesh from a laptop against the apex → BLOCKED / HTTP 403. That is green for the public surface.
4. Geometry float probe: dilation: 1.5 → HTTP 400 REFUSED_FLOAT (already prove-math-court-agent-ingest.sh ARM2).
5. Geometry integers: dilation: 12 → WIN count 169 (ARM3).

Step B — IDE rebuild / compile (browser + founder)

1. Open https://affine.earth/language-game/ide.html. Record compile-backend badge (READY / BACKEND OFFLINE / UNREACHABLE).
2. Click Rebuild Mesh (C-1) on the apex → terminal must show refuse, not a fake rebuild.
3. On founder C-1 only: same button → affine.earth.ide_rebuild.v1 “initiated”. Read /tmp/ide-rebuild.log. Do not treat C-1 success as apex success.
4. Compile: #btn-compile with a workspace file. Success → artifact bytes measured from wasm_base64. Fail → compiler tail, no fabricated wasm.

Step C — code-gen TEST-ONLY (Falcon-scoped, one shot)

1. Endpoint is not in tools/list. Call it only from the founder / test client.
2. Body must include source, role, user_vqbit_hash, and Falcon integers (no floats).
3. Missing source → refuse (same family as REFUSED_UNATTRIBUTED).
4. Float → REFUSED_FLOAT.
5. Success → one file under studies/study-02/<creator16>/ that #btn-compile / the editor can open.
6. Fail → endpoint stays dark. No public catalog line. No Gamma.

Until that endpoint exists, Step C is SKIP with reason in VERDICT.json (codegen: DARK). That is an honest skip, not a pass.

Step D — holographic projection (existing routes only)

1. Landing https://affine.earth/language-game/ — wait for AFFINE · I64 … chip (Affine-Earth-Hologram-User-Guide.md).
2. Retired 2026-10-14: the Gym view and its stage-capture button (ide.html#gym lands on the IDE; /language-game/#capture answered nothing).
3. Optional walks: projection-room.html, openusd/.
4. Do not add routes. Do not change hologram CSS/filter. If the Falcon UI is not on these surfaces yet, record hologram: EXISTING_SURFACE_ONLY and which URL was opened.

Step E — “new report” in this tree

A report is all three:

1. Court receipt JSON (claim; names source).
2. work/seal row (work_id, creator_vqbit_hash, content_fnv) if an artifact was compiled.
3. Optional wiki/results page later (Study-02 style). Not required for the first green.

It is the sealed row the cell holds.

Step F — user association

Arm	Action	Green
F1	Court POST with no source	REFUSED_UNATTRIBUTED
F2	Court POST source=alpha vs source=beta, same integers	Two receipts, two source values
F3	IDE seal with no IdentitySpine / no hash	Local refuse; no work/seal row
F4	Two presented hashes, two generate/seal	Two work_ids, two paths. Neither overwrites the other
F5	Look tab	prove privacy: zero POSTs, credentials:omit (repeat researcher-look measurement)

Step G — share

1. Grant audience=public on one sealed work.
2. GET the fetch URL with credentials omitted (curl -H none, or browser fetch credentials:"omit").
3. Body names creator_vqbit_hash / source on the receipt. Body does not contain a private key, cookie, or look-tab identity.
4. Second GET from a clean profile opens the same view.
5. Revoke → fetch returns not-served (same bytes as missing).

What green looks like

VERDICT.json fields (all measured, no narrative pass):

{
  "schema": "affine.earth.researcher_ide_loop.v1",
  "proven": "RESEARCHER_IDE_FALCON_LOOP",
  "mcp_tools": 15,
  "membrane_health": "…",
  "ide_rebuild_apex": "BLOCKED",
  "court_float": "REFUSED_FLOAT",
  "court_integer_source": "<source>",
  "look_privacy": "RESEARCHER_LOOK_ZERO_VISITOR_DATA",
  "codegen": "DARK|PROVEN",
  "work_id_alpha": "w…",
  "work_id_beta": "w…",
  "share_get_credentials": "omit",
  "identity_leak": 0
}

proven is written only when F1–F5 and G pass and codegen is either DARK (honest skip) or PROVEN. A DARK codegen is allowed for the first green of look/claim/build/share. Public codegen is not.

What stays dark until green

• Public code-gen MCP tool / tools/list entry / #researcher card
• Gamma / marketing consume
• Glama “tested”
• Opening ide_rebuild_mesh on the 9 apex cells
• A hologram route that does not already exist
• Treating health court PK keys as ozone / UV-B / phytoplankton
• Hardcoded mainnet values, mocks, or a Node second court

---

5. Falcon first, then each study

Falcon / Starship / Starlink files that already exist

File	What it is
press/wiki/Study-02-Launch-Ionospheric-Holes.md	Falcon 9 F-region hole charter (Vandenberg 2023-07-19; FORMOSAT-5; deorbit-burn adversary)
wiki/Study-02-Launch-Ionospheric-Holes.md	Same charter in the repo wiki tree
press/wiki/Shear-Studies-Index.md	Study 02 status: OPEN — charter sealed
press/images/study-02-shear.svg · study-02-forcing.svg	Forcing / adversary diagrams
press/wiki/Shear-Studies-White-Paper.md	Falcon deorbit burns in the adversary roster
ide.html orbital template	“GPS/Starlink ephemeris” template card — preview, not a live Starlink feed (globe.js refuses invented Starlinks)
press/wiki/Study-09-Global-Convective-Bond.md	Traffic + atmosphere + solar; live weather.convective_containment / Study 09 thresholds
Sibling Falcon UI	Not in this tree at plan stamp. When it lands, cite that path here; do not fork.

No *damage* file existed at plan stamp. Ozone / UV-B / phytoplankton UI is the sibling’s first full-spectrum surface, not a second copy.

Same loop LATER (do not implement now)

Order is the program’s own clock + whether a court already binds.

Order	Study	Why it waits
0	Study 02 Falcon / launch holes	This plan. First generate + first share GET.
1	Study 09 convective bond	Tools already bind (weather.convective_containment, noaa_goes_r_weather, ATC). Second UI, same association/share.
2	Study 03 flare SIDs	GOES clock already on noaa_goes_r_weather lane=space.
3	Eclipse 2026 (Study 01)	Crossed; pinned-archive verdict ~2026-08-30. Report = ledger-regenerated wiki, not a new generate.
4	Study 04 tsunami vs surge	Fluids court (phi_in/phi_out) is the integer cousin; gauge archive is separate.
5	Study 05 Forbush	Neutron-monitor table → physics table_counts.
6	Study 06 explosion vs quake	Law already frozen; report is results pages, not codegen.
7	Study 07 / 11 / 08 / 10 / 12 / 13	Geometry / chance / algebra courts already exist. Same look → claim → seal → public GET. No new login.

Each later study reuses this file’s association and share rules. It uses this one identity system.

---

Execute checklist (founder)

1. Bind MCP: docs/mcp/host.mcp.json → https://affine.earth/language-invariant/mcp.
2. Look: open #researcher. Confirm meta line “this tab sent no identity”.
3. Claim: one physics or geometry POST with a real source. One float POST. Save both receipts.
4. IDE: open ide.html, click Rebuild on apex (expect refuse), Compile if C-1 is up.
5. Identity: sign in once (wallet-login → IdentitySpine.establish). Seal only after that.
6. Two-source arm: repeat claim as a second source. Two receipts.
7. Share: grant public, GET fetch with credentials omitted.
8. Code-gen: only if the sibling endpoint exists; otherwise codegen: DARK.
9. Write evidence/researcher-ide-falcon-loop-<UTC>/VERDICT.json.
10. Gamma / public codegen / Glama “tested” stay off this list.

HEL key ~/.ssh/qfot_unified. NBG key ~/.ssh/ftclstack-unified. Never cross.