# GLYPHDRIVE // PROOF DECK — Independent Verification

**Artifact:** `GLYPHDRIVE-PROOF-DECK.html`  
**Verified:** 2026-07-11  
**Size:** 58,590 bytes  
**SHA-256:** `f10b33f8961736bed2a5666046f86ceabb53441e3b317e558f4e4541286a81d7`

## Verdict

The artifact is genuinely self-contained, visually strong, and the shipped core reproduces the stated 12/12 result. Both raw inline script blocks are syntax-clean, all 52 controller element lookups resolve, the four benches execute, and the layout holds at desktop and 390 px mobile width.

The current build nevertheless has several proof gaps that conflict with its strongest public claims. Most importantly, Bench 01 labels arbitrary/tampered fold content as **VERIFIED** without comparing it to a pinned digest or ledger receipt, and the copy/restore path mints **same frame** even when the saved and restored fingerprints differ. Those two issues should be corrected before describing the interface as incapable of rendering an unproven byte as clean.

## Reproduced from the shipped bytes

| Check | Result |
|---|---:|
| Raw `<script>` blocks extracted | 2 |
| Core script bytes / SHA-256 | 21,492 / `9b157fee68c7cde53ce0e9b0217000017fcc2250f1e5cdb2842c794378b876c9` |
| Controller script bytes / SHA-256 | 20,996 / `4f95c0b0e0e091886e8d44506c8d645ad5ba9826639e22b3a081f858e43e4da0` |
| `node --check` | clean / clean |
| Extracted `PD.selfTest()` | **12/12** |
| Browser load-time badge | **12/12 proven** |
| Unique HTML IDs | 55 |
| Unique controller `$()` lookups | 52 |
| Missing controller targets | **0** |
| Duplicate IDs | **0** |
| External `src`, `href`, `poster`, `data`, or CSS `url()` resources | **0** |
| Browser page errors | **0** |
| Browser console errors/warnings | **0** |
| 390 px viewport horizontal overflow | **0 px** |

The remaining three IDs are section anchors: `b2`, `b3`, and `b4`.

## Runtime descent

### 01 — The Field

- Procedural field rendered continuously from `FIELD_SEED = 0xF0EA`.
- Live reticle addresses updated.
- The pinned `0213` FOVEA fold unfolded under an activated reticle.
- A pressed document was placed at its six-digit prefix and unfolded when located.
- Copy/restore generated chained `LOOK_COPY` and `LOOK_RESTORE` entries.

### 02 — Text as a Place

Default document measurements from this run:

- Raw text: **1,315 B**
- Fold: **1,069 B**
- Descent path: **4,276 digits**
- Deterministic second encode: **identical**
- NRC shelf saving: **79 B**

The gist verified at its layer boundary; an intermediate descent produced an amber speculative prefix; flipping one full-layer byte produced a full-layer refusal while the gist remained verified; Restore re-pressed the source.

### 03 — Video from a Recipe

- Pixel payload regenerated: **248,832 B**
- Recipe: **68 B**
- Displayed ratio: **3,659:1**
- Route R: regenerated digest matched the target digest.

Residual experiment measured in Chromium:

| Measurement | Encoded bytes |
|---|---:|
| Direct baseline | 138,533 B |
| Residual, pinned grain seed | 16,072 B |
| Residual, one-bit grain-seed drift | 102,164 B |

The pinned residual was **8.62× smaller** than the direct baseline. One-bit seed drift was **6.36× worse** than the pinned residual. Route G decoded and recomposed bit-exactly against the target digest.

### 04 — The Ledger

After the exercised path, the in-memory chain contained **13 links** and `Verify chain` reported the chain intact.

## Findings

### GD-01 — Critical: Field folds are self-hashed, not verified against a pinned value

**Source:** lines 927–937.

`renderUnfold()` computes `fnv64str(u.body)` from the body currently in memory and immediately presents that same body as `FOLD UNFOLDED — VERIFIED`. It does not retrieve an expected digest, compare against a placement receipt, or consult the ledger.

Controlled probe:

1. Mutate `folds["0213"].body` after load.
2. Navigate the reticle to `0213`.
3. The deck displays the mutated payload crisply with a fresh green verification tick.
4. The ledger still contains only `GENESIS`.

Observed output:

> FOLD UNFOLDED — VERIFIED …  
> TAMPERED PAYLOAD — no pinned digest comparison occurred.

**Impact:** This directly contradicts the central claim that unproven bytes cannot render as clean and that unfolding is checked against the ledger before rendering.

**Correction:** Store an expected digest with every fold and include it in a placement receipt. On unfold, retrieve the pinned digest, recompute the payload digest, compare them, and render a refusal plate on mismatch. For pressed documents, pin the actual gist-layer digest rather than hashing an extracted display string ad hoc.

### GD-02 — Critical: `LOOK RESTORED ✓ same frame` is minted without proving equality

**Source:** lines 859–862 and 955–970.

The copy handler saves a fingerprint, but the restore handler never compares the restored fingerprint with it. Success is issued solely when the address string ends with the same quadkey. The address contains only a discrete reticle cell, while the fingerprint also contains continuous viewport center and zoom.

Controlled probe using a valid non-canonical scroll-derived view:

- Address before copy: `glyph://F_proofdeck/02311`
- Saved fingerprint: `d9b1a75bd092511a`
- Restored address: `glyph://F_proofdeck/02311`
- Restored fingerprint: `19a84177b6745e90`
- Equality: **false**
- Green `LOOK RESTORED ✓` receipt: **minted**

**Impact:** The receipt proves same address text, not same frame.

**Correction:** Either rename the claim to **same cell restored**, or encode the complete canonical view state into the address and compare the saved and restored digest before issuing green. For a literal frame proof, digest `canvas.getImageData(...)` after settling and compare that digest.

### GD-03 — High: 48-digit document addresses exceed the 32-bit address implementation

**Source:** lines 306–320, 543–550, and 962–965.

Quadkey conversion and navigation use JavaScript bitwise shifts and `1 << D`, which are 32-bit operations. `foldAddress()` emits 48 digits. The default document address failed a 48-digit round-trip:

- Original: `233231331313221330003313123221020012221233012030`
- Round-tripped: `001222123301203030003313123221020012221233012030`

Pasting the full default address into Go produced:

- `vw.tcx = -28763.863975524902`
- `vw.tcy = -29318.883628845215`
- `vw.tz = 45.35`

The wheel path otherwise clamps zoom to 13.

**Impact:** The field cannot faithfully navigate the full addresses it mints.

**Correction:** Use `BigInt` for coordinate conversion and a scale representation that does not depend on 32-bit shifts, or explicitly define the field location as a bounded prefix and reject/strip deeper descent digits in the Go handler.

### GD-04 — High: Unescaped user input can execute markup/script handlers

**Source:** lines 795–813, 933–936, 955–960, and 1017–1020.

Receipts, ledger details, and live field-fold bodies are inserted with `innerHTML`. Two browser probes confirmed execution:

- A crafted address entered into the address bar executed an `onerror` handler when Copy created its receipt.
- A crafted document gist executed an `onerror` handler when the pressed fold unfolded on the field.

**Impact:** Arbitrary document/address text is treated as executable HTML in a local or served origin.

**Correction:** Build these views with DOM nodes and `textContent`, or apply a complete HTML escape to every untrusted interpolation. The existing `escapeHtml()` used by the depth decoder can be reused for text bodies, but DOM construction is safer.

### GD-05 — Medium: The ledger does not contain every verification described in the handoff

`renderUnfold()` creates a side-panel receipt but does not call `ledgerAdd()`. Gist/full verification during slider descent is not chained. `Verify chain` itself is not chained. The statement that every verification landed in the hash chain is therefore broader than the implementation.

**Correction:** Narrow the wording to **material state-changing operations are chained**, or add explicit verification receipts with clear scope.

### GD-06 — Medium: Clipboard success is reported even when copying fails

**Source:** lines 955–960.

The deck ignores an unavailable Clipboard API and catches/rejects write failures, but still emits `COPIED` and adds `LOOK_COPY`.

**Correction:** Await the write, emit green only on success, and render a refusal/warning plus a selection fallback on failure.

### GD-07 — Medium: Self-test failure is visible but not fail-closed

The benches remain active and can emit green verification states even when the load-time suite is not 12/12. The badge changes, but verified rendering is not gated by that state.

**Correction:** Gate proof-state actions behind a `suiteHealthy` flag; on any failed prerequisite, render refusal rather than green.

### GD-08 — Wording: the implemented field is large but finite

Wheel zoom is clamped to 13 and the displayed depth therefore tops out at 16 in the normal path. The coordinate domain is the unit square. “Infinite” is a conceptual description, not a property of this implementation.

### GD-09 — Low: unfold cache keys only by address

`lastUnf` stores only `u.qk`. If payload content changes while the same prefix remains under the reticle, the panel can remain stale. Include the expected payload digest or version in the cache key.

## Ship assessment

The arithmetic/text/video mechanisms are real demonstrations, not mockups, and the visual system communicates the intended truth states exceptionally well. The build is also genuinely dependency-free and responsive.

For a public **proof deck**, GD-01 and GD-02 are release blockers because they permit green proof states without the claimed comparison. GD-03 and GD-04 should be fixed in the same pass. After those corrections, the artifact will be much closer to the standard asserted by its own footer.