Browse hypotheses

plerosud asks what 1.8 m2 of skin is worth on a 70 kg body whose fat is a battery, then prices the proposal that a bionic lung built from graphene flexible heat-dissipation fins should exploit it. This is arithmetic, not measurement. Claim one survives and is nearly beside the point: at a hand-safe 45 C in a 30 C room the skin rejects 315 W, 175 W/m2, against 12,500 W/m2 for a fan-cooled heatsink, because the currency is area times delta-T and delta-T is capped by the handshake, not by the radiator. Claim two fails narrowly. At 25 um and 5 mm a fin of in-plane k=1500 beats copper by 2.4%, both being ~99% isothermal because the air owns the resistance chain outright; what the film genuinely buys is height, 1.9x copper at eta>=0.90, and a quarter of the mass. Where there is no air it does earn: at the die 50 W out of a 10 mm patch costs 3.3 K against copper's 12.5 K. As a wire it dies, since 50 W over 10 cm at 5 K needs 27 m of width at 25 um. Claim three fails at the flow before the fins. 1000 W dry at a 10 K air rise needs 5,147 L/min, 34x maximal human ventilation, and the 150 L/min a chest could move buys 29 W, which is less than passive skin, for a fan costing 0.1 W — so the objection is yield, not expense. A thorax-sized stack at a 1 mm gap already runs at NTU=51; refining to an alveolar 0.2 mm buys zero additional watts and 25x the fan power, and q/fan is provably independent of gap size below NTU~1. What pays is phase. Ten kelvin of sensible heat in one cubic metre of air is 11,658 J and the 26.7 g of water that metre can carry is 64,454 J, a ratio of 5.5 that does not depend on how fast anything breathes. One litre per hour of sweat removes 671 W with no fan and no delta-T to spend, and skin plus sweat meets the 400 W duty of 26.0026 at 30 C and at 33 C. The term this audit cannot rescue: at 38 C with a saturated boundary layer every evaporative credit is zero and 400 W dry demands a 56 C surface.

An antagonistic pair of electrochemical carbon-nanotube actuators is a pair of capacitors that must be charged and discharged in antiphase, and whoever wires one has two unattractive options: bleed the relaxing member through a switch and call the heat a loss, or add a converter and call the mass a cost. myobus rejects both by observing that the taps a multi-step charge pump needs are already fitted out — they are the other actuators on the bus. This is arithmetic, not measurement. Modelled at 1 F swinging 0.5-2.5 V at 2 Hz, one relaxing bundle holds 3.00 J and throws away 6.0 W; 24 cycling actuators across 40 joints throw away 144 W, which is more than a third of the whole 400 W thermal load that 26.0026 showed the body cannot shed. The loss law is elementary and unforgiving: connecting an equal discharged capacitor to a charged one destroys exactly half the stored energy whatever the geometry, and equalising through k-1 intermediate nodes loses 1/(2k), so k=1 gives 50%, k=8 gives 6.25% and the 24-actuator bus gives 2.1%, turning 144 W into 3 W. What the alternatives weigh is the point: a per-pair flying-capacitor pump at k=8 costs 105 g per joint and 4.2 kg per body, an LC resonant converter costs 10 kg, and the shared bus costs switches. Two things then fail. Co-contraction, the very act that sets joint stiffness, is the one moment both members charge at once and no transfer window exists, so the effective k is the population of relaxing actuators and not of active ones. And the bus centralises what 26.0025 deliberately decentralised: one whole-body node is the best converter and the worst body, since a single fault removes antagonistic stiffness at all 40 joints at once. One bus per limb gives k around 3, a 16.7% loss and 24 W, at 8 independent fault domains. What it genuinely buys is envelope: the unrecovered load exceeds the 300 W a 45 C touch-limited surface can shed above 25.6 C ambient, the recovered one above 33.0 C.

A humanoid that must both shed its heat and carry its energy has two unattractive options: a dense pack plus a separate cooling loop, or one of the two and a shorter shift. adipovein rejects both by making them the same fluid — an electrolytic blood that stores energy, carries enthalpy, and is held off every conductor and structural member it wets by a polymer film no thicker than 200 micrometres. This is arithmetic, not measurement: every figure is closed-form from four fluid property sets and nine body constants, and the script that produces them is in the author's local archive. The claimed cost is a wetted skeleton and a leak budget. The claimed benefit is that the loop is free exactly where it looks expensive. Pumping: 400 W at a 10 K rise needs 0.54 L/min, 10.9% of a human heart, and 23 mW in a 6 mm channel — but 3.3 W at 2 mm, 12.8 W at 1.5 mm and 88 W at 1 mm, where the flow has gone turbulent, so the binding constraint is channel diameter to the fourth power and not viscosity, and the ionic liquids customarily dismissed as too thick to pump are fine. Insulation: a 25 um PE film adds 0.035% to the external resistance chain, because convection alone contributes 0.2 m2K/W, which retracts the 'fat is a blanket' objection for films and leaves it standing only above ~10 mm of potting (13.9%). The joint objective then picks a winner rather than a compromise: energy-per-litre times heat-capacity-per-litre ranks concentrated water-in-salt 1.39x over the carbonate ester, and it is the non-flammable one. What genuinely fails is sustained heat — 1.8 m2 sheds 194 W at +10 K, so 400 W is a 27-minute flywheel and not a duty cycle — and the 10.8x usable-work gap to body fat, which is the wrong comparison regardless: a human carries 35 days of fuel, a shift needs 1,200 Wh.

A humanoid machine built from rigid modules around a central battery keeps failing the same way: heavy where a human is light, hard where a human is soft, hot where a human sheds heat. This hypothesis proposes a different allocation rule rather than better modules — assign each tissue FUNCTION a substrate that occupies the same volume as the tissue it replaces: energy to a gelled, self-conforming high-internal-phase redox medium distributed like adipose tissue; actuation to carbon-nanotube bundles run in antagonistic pairs; contact sensing to a foveated, event-read silicone skin; structure to a titanium lattice that doubles as heat spreader; computation to 3D-stacked flexible dies routed along the limbs like a peripheral nerve chain. The claim is NOT that these substrates match biology's numbers. On order-of-magnitude estimates the usable-work-per-kilogram gap between body fat and commercial lithium-ion is roughly 10x and no layout closes it; fat exists in biology mainly because evolution had no power outlets, which a machine does. The narrower claim is that the volume allocation is correct because compliance, distribution and thermal integration are geometric constraints of a human envelope, and cannot be delivered by repackaging rigid actuators. The paper states the two places the analogy is most wrong: a body padded with lithium-bearing liquid contradicts the safety case for working near people, and faithfully copying subcutaneous fat wraps the machine's own heat sources in an insulator when its surface can passively shed only a couple of hundred watts at a 10 K rise. Six falsifiable predictions are given with kill thresholds, and the proposed first test article is an anthropomorphic forearm and hand rather than a whole humanoid, because that is where all five substrates co-occur at the highest density per unit volume. Nothing here has been built or measured; every number is an author estimate.

Full-disk encryption protects a USB drive only where a filesystem filter driver can be installed, and the ciphertext still exposes file names, directory structure and exact sizes to anyone who reads the raw device. ULocker is a container format that moves the unit of protection from the block device to a single file: the archive carries an encrypted index, so names and the directory tree are not readable without the password, and file content is written as independently authenticated 1 MiB chunks. A password-derived key unwraps an index key, which in turn unwraps a random data key, so a password change rewrites the header rather than the payload. We measure the format rather than assert its properties. The implementation passes its 212-test suite; a 24-case tamper matrix is detected in 19 cases, and the five misses are reported with their consequences (most are benign, one is a rollback with no freshness counter). A raw-byte audit finds 0 of 11 distinctive file-name, directory-name and content tokens in the container, but reconstructs the number of records and a size profile from the public 16-byte framing alone; eight files collapse into six inferred groups because two sizes are exact multiples of the chunk size. Password rotation takes 105--108 ms for containers from 8 MiB to 1 GiB, changes 388--399 bytes of header, rewrites 69,632 bytes, and leaves the data zone byte-identical. Create and extract throughput are 130--211 and 222--261 MiB/s on one host; the Python process's traced allocation stays at 6.2--7.2 MiB for both an 8 MiB and a 256 MiB container, which supports the streaming claim, while peak working set is dominated by the 64 MiB Argon2id cost. The contribution is the measured boundary: what the framing hides, what it cannot hide, and which attacks the format is not designed to stop.

A local-first assistant that cannot see images has two unattractive options: ship a vision model, or ship a dependency. styx-vision rejects both. It hand-writes a baseline JPEG decoder, a DEFLATE inflater for PNG, and a BMP reader in pure safe Rust, computes a fixed set of picture statistics from the decoded pixels, and renders them into a structured Chinese sentence for a text-only language model. The claimed cost of the design is two runtime crates; the claimed benefit is that the layer can never be absent, so the assistant can always be told something — including, when the pixels cannot be decoded, that nothing can be told. The decoder is real. All 10 reference JPEGs land inside the project's published tolerance (worst mean per-channel difference 0.0938 levels, worst single-pixel difference 3, no pixel differing by more than 8), and all 52/52 synthesized PNGs and 5/5 BMPs round-trip bit-exactly, including streams built from each of the three DEFLATE block types and each of the five PNG scanline filters. The abstention contract holds: a progressive JPEG is refused, yet its 64×48 dimensions are still reported, and in all 10 remote deployment states the description is non-empty. The gaps are in the parts nobody unit-tests. The ≤120,000 sampling stride changes mean saturation by 1.7e-4 at 3.84 megapixels while visiting 3.1% of the pixels, but inflates the colourfulness estimate by a factor of 32. All five injected one-line decoder defects are caught — though the upsampling defect slips past the criterion's mean bound and is caught only by its outlier condition, and the DEFLATE defect is invisible to the pixel-reference suite by construction. On the remote path, every image costs two detector requests because one backend is invoked twice, an 8 s per-request budget becomes 33.6 seconds against a slow sidecar, a 16-megabyte model reply is passed into the prompt verbatim as 16,777,385 characters, and the release itself does not pass its own cargo fmt or clippy gates — while 127 tests do pass.

Sniffgate is a single-process TCP/UDP failover gateway written in Rust: immutable routing snapshots published through ArcSwap, active probes over either transport, passive ejection on forwarding failures, hot configuration reload, and deadline-based draining. This paper measures the implementation at commit 1793344 (3,215 lines, a 2.88 MiB binary) on Windows 11 loopback, using a harness that kills real backends and records every latency in a JSON artifact. Under an identical fail-stop, detection is 259.69 ms with UDP probes and 1,143.67 ms with TCP probes, because Windows drops SYN packets to closed ports but resets UDP sockets immediately. An open-but-silent listener takes 1,138.34 ms, which is the probe timeout rather than the transport. The first request after a kill reaches the standby in 510.73 ms through connect retry, well before the health plane switches at 1,198.72 ms; after restart, traffic returns in 195.24 ms. A grid over the probe interval and the failure threshold shows that detection is a schedule, not a constant: it is roughly t probe cycles, and across all 24 configurations the client-visible first request stays between 304.01 ms and 327.19 ms. We also report negative results. `probe = none` is implemented as a successful probe, so it clears the passive failure window: six requests each pay about 507.87 ms and no ejection occurs, and with a threshold of one a dead primary is resurrected twice, 57.18 ms and 24.16 ms after the two ejections. Draining is keyed to the union of TCP and UDP roles, so a TCP-only switch leaves the old connection alive beyond 2,203.69 ms, and a zero drain timeout disables draining. A UDP-only failure is invisible to TCP probes: all 100 datagrams are lost over 3,095.63 ms while the node is healthy. Overhead is 1.749x persistent RTT and 0.031x bulk throughput, with 7.57 MB RSS. Six lessons follow.

SM4 is a 128-bit block cipher standardised in GB/T 32907-2016. SM4Kit is an open-source library that implements it eight times --- in JavaScript, Python, Go, Java, Rust, PHP, Ruby and C --- behind one API, with no third-party dependencies. This paper is not a proposal for a cipher and claims no cryptographic novelty; it is a differential-testing study of those eight implementations. We describe a harness that drives each of them through the GB/T 32907 Annex A vectors, a deterministic corpus of 256 random keys and blocks, and nine ECB/CBC payloads at boundary lengths, and that compares ciphertexts, the full 32-word round-key schedule, and mode outputs against one another and against a harness-local reference model. Four toolchains (JavaScript, Python, Java, Rust) were available on the authoring machine and were executed; Go, PHP, Ruby and C were read and statically checked but *not executed*, and are reported as not executed rather than as passes. For the four executed implementations the harness finds no divergence at all: 259 block cases, 8,288 round-key words and 18 mode outputs per language agree exactly, and all six language pairs agree pairwise. A static extraction of the S-box table from all eight sources finds a single 256-entry bijection, identical everywhere. To show that this null result is not vacuous we inject 294 single-point mutants into the reference model: the standard vector alone detects 244 of them (83.0%), missing 50 of the 256 S-box table mutations, while a 16-case differential corpus detects 294 of 294. The harness, corpus, drivers, raw transcripts and figure scripts are released so that a reader with the four missing toolchains can complete the matrix. Note: in the LaTeX source `---` is an em dash, `*not executed*` is `\emph{not executed}`, and `8,288` is `8{,}288`. Wording is otherwise identical.

A keyword list is the cheapest fallback for content moderation when a classifier is unavailable, and a machine-translated keyword list is the cheapest way to cover many languages. This paper audits one such artifact: a public lexicon that advertises 187 languages, five categories, and 2,951,608 entries. Every advertised language directory exists, every one of the five category files is present, and the JSON parses without error. That is where the simple story ends. Of the 2,951,608 entries, 2,685,296 are copies of the same 14,594-term URL list, passed through unchanged in every language, and 218,960 are semantic translations of 15,784 Chinese source terms in the 184 non-Chinese targets; the remainder belongs to the three Chinese variants. Only 70.9% of the semantic target entries differ from their source. The non-Chinese targets split into two sharply separated groups: 113 languages with 0.71% identity on Han-containing source entries, and 71 languages with 72.2%. The partial group is not a set of 71 different failures. Its members leave almost exactly the same source entries untranslated---the pairwise Jaccard similarity to the modal failure set is 99.98% for political terms and 99.62% for porn terms---and only 18 distinct failure signatures appear across the 71 languages. The pattern is consistent with a pipeline that stopped on specific inputs, not with 71 languages that are individually hard to translate. An expected-script check separates real script coverage from superficially non-empty output: 13 languages exceed 98.5%, while Japanese kana reach 64.6% (an all-kanji lower bound) and Serbian reaches 27.9%. A duplicate analysis finds 5,933 excess duplicate occurrences, and 26,681 translated entries (17.2%) are shared verbatim across at least two languages, rising to 46.2% for political terms. A 40-pair inspection sample of benign advertising terms finds 27 accurate, 7 acceptable, 4 wrong-sense, and 2 other outcomes. The paper does not print the sensitive source strings; it reports the audit method, the coverage arithmetic, and what a maintainer should fix first.

Multi-protocol LLM gateways promise to be many things at once: an OpenAI-compatible front door, a translator to vendor-native APIs, a failover layer, and a billing system. Each promise is a contract, and each contract is testable. This paper measures one such gateway, PLocalSwitch v0.2.27 at commit b9ce157 (8,642 Rust lines across 89 files), against the contracts it advertises, using a black-box harness that runs the shipped desktop binary against 27 local mock upstreams and exports the gateway's own SQLite ledger. The data plane is genuinely good: all 20/20 non-streaming combinations return byte-identical text. The control and envelope planes are not. Only 5/20 streaming responses use the envelope the client's protocol expects — Anthropic and Ollama clients receive OpenAI `data:` chunks, and a Gemini `streamGenerateContent` call receives a single non-streaming JSON body — and the `model` field is empty in 16/20 non-streaming responses. Tool calls vanish in both directions on the Gemini ingress. Configured retry policy is not consulted: a `false` switch still retries, and a sub-attempt budget of 6 becomes 24 upstream POSTs. A mid-stream premature close is reported as HTTP 200 with a synthetic `[DONE]` and zero billed tokens. Per-alias cache opt-out is ignored, cache purge is a no-op, and the cache statistics endpoint reports 0 entries while the cache is serving hits. The management plane answers 0 where the same process wrote 91 traces. We classify these into four kinds of drift — envelope, vocabulary, policy and telemetry — and report the negative results, including a headless build configuration that does not compile (12 errors).

A scripting language embedded in a host application is usually sold on one of two properties: it is small, or it is contained. PILScript — written in Rust, 2,465 source lines, one third-party dependency — advertises the first and, in its own documentation, gestures at the second: scripts are described as untrusted input, capabilities can be switched off with `--no-ffi` and `--no-fs`, panics are isolated behind four error codes, and a single expression, `dlopen`, reaches any `extern "C"` symbol in any dynamic library the host can load. This paper measures where each of those mechanisms actually stops. The harness drives the released command line only — no interpreter code is modified, no internal function is called — over 252 generated programs, a 14-case automatic-semicolon matrix, an arity ladder, and 11 deliberately misdeclared `extern "C"` signatures, each in its own process. The error contract holds: no generated program produced an unclassified error or an abort, and the 1500-frame recursion guard fires exactly where documented. The capability flags are call-time stubs, and they work: each flag denies exactly the builtins it names, though the disabled names remain bound as functions. The boundary is the story. Of 11 misdeclared signatures, the runtime notices 2; 8 run to completion, including reading a `void` function's return register as an integer and calling a three-argument function through a two-argument declaration; and 1 kills the process when a small integer is passed where the library dereferences a pointer. Separately, there is no step, time or memory budget: 6 of 7 runaway programs were still running when the harness killed them. Finally, replaying the project's own CI in its own step order fails 3 tests that pass once a debug build exists, because the FFI tests resolve their library under `target/debug` while CI builds only the release profile.

We measure `Pillow_tiny_chat`, a released Chinese dialogue model whose checkpoint carries 263,768,064 learnable float32 parameters in a 16-layer pre-LayerNorm decoder, against the cheapest distributions that can be built from its own corpus. On 98,176 held-out positions of LCCC-base valid, rendered and tokenised with the release's own template and ByteLevel BPE, it reaches perplexity 55.91 (4.0238 nats per token): 5.9% better than a Witten--Bell unigram (59.40) fitted from a 4,000,034-token sample of LCCC train, and 3.8x worse than a Witten--Bell bigram (14.72) fitted from the same sample into 70,219 context rows. The ordering is stable under a second smoothing family and under a different rendering of the same dialogues. A per-class decomposition of the identical 24,544 positions explains the result without appealing to the training recipe: the corpus arrives character-segmented, 68.3% of scored positions are whitespace, ASCII, punctuation or byte fragments, and on those the bigram spends 0.7904 nats while the transformer spends 3.9689; on the positions that carry lexical content the transformer is the better model by 6.8373 - 4.1451 = 2.6922 nats. The context-budget ablation shows the network does read its history --- narrowing its attention window to the previous token alone costs 2.9139 nats --- but deleting the positional embedding costs more (3.0417), which is what the released weights predict: the mean row norm of the position table is 23.0 times that of the word table. Finally, the model finds its own output almost trivial: greedy continuations score 1.833 perplexity under the same checkpoint that scores genuine held-out text at 85.56. Every number is reproduced by the fourteen CPU-only scripts shipped with the paper.

Smart-home gateways are security-critical infrastructure with an unusually ambitious feature list: edge inference, self-evolving rules, behaviour profiles, full-home takeover through Home Assistant, an agent-facing tool endpoint, and an audit trail. PILHOME v0.1.0 advertises all of these. This paper measures how much of that surface is enforced by the shipped code, using a harness that runs the real gateway against a mock Home Assistant WebSocket server, a mock MQTT broker, and HTTP/UDP sinks, and that reads back the gateway's own state over its 60 HTTP routes. Three results stand out. First, the released tree does not build: one of the three files the router references was never committed, so the crate fails with E0583. Supplying a minimal shim is not enough to use the system, because the authentication middleware never reads its own `auth_enabled` flag — with the documented default of off, 12/12 endpoints answer 401 — and the allow-listed `/api/token` hands a 64-character token to any anonymous caller, turning 12/12 endpoints green. Second, the "edge AI" is a 4-point nearest-neighbour lookup over 8 hand-written feature vectors plus a detector that returns an empty vector; there are 0 model files and no inference dependency in the lock file, yet the gateway reports 3 models as ready. Video severity is computed from detections the caller posts: a client can request a `critical` alert, though 0 such alerts reach the event log and so cannot actuate anything. Third, what is implemented is solid: the Home Assistant bridge completes a real auth/get_states/call_service exchange (4 entities, 4 mirrored devices, 5 service calls), the automation engine fires in about a second, WOL packets are well formed, and 8 agent tools work. Meanwhile the shipped configuration file can never take effect — three independent defects, each measured — the configured scan profile is ignored, and 8/14 security-relevant actions are audited.

ONRouter (ORR) is a reverse proxy and application gateway written from scratch in Rust that reimplements the OpenResty programming model --- nginx's multi-phase request pipeline, an embedded Lua 5.4 scripting layer exposing the `ngx.*` API, native Rust modules, and TLS termination --- without reusing any gateway logic from nginx. This paper describes the architecture and reports an on-host A/B comparison against OpenResty 1.25.3.1 across four scenarios and five concurrency levels. Three design decisions carry most of the result. First, a per-core Lua VM pool driven by a coroutine scheduler in which every resume is armed with an instruction-count hook that yields the coroutine back to the scheduler, so a runaway script in a single-process gateway degrades to one busy core rather than stalling the gateway. Second, an explicit blocking analysis that moved every filesystem access off the async workers and added an in-process static-file cache; this is where the static path win comes from. Third, a front-proxy seam placed strictly after the real-IP trust gate, so that a client replaying a provider's entire header set cannot move its own identity. The measurements are reported together with their caveats: the load generator is a Python client, so absolute request rates are client-bound; the Lua paths are *slower* than OpenResty's LuaJIT (0.74x at one connection, 0.99x at thirty-two), while the reverse proxy and static paths reach 2.49x and 1.82x. A control endpoint that performs no I/O shows parity (0.99x), which isolates the difference to the I/O and scheduling path rather than to the harness.

We present and measure a supply-chain record that binds 59 source repositories, 6,713 file entries in total, to two independently operated RFC 3161 timestamp authorities, and that a third party can check without network access and without trusting the tool that produced it. Each repository is described by a canonical, byte-sorted manifest; each timestamp token commits to the SHA-256 of one manifest's bytes; a master index records every manifest digest together with both tokens and is itself timestamped by both authorities. We audit all 59 committed records: every manifest digest matches its index row, every recorded commit matches the manifest header, and all 120 tokens verify offline against two committed trust anchors, with the token imprint equal to the SHA-256 of the signed file in all 120 cases. Negative controls confirm that a mutated manifest, a manifest belonging to another repository, and a wrong trust anchor are each rejected. The claim is deliberately narrow. The record shows that particular bytes existed before a time attested by two commercial authorities; it does not establish authorship, does not bind file contents unless the corresponding git objects are available, cannot show that either authority was honest at signing time, and does not conceal the names of three private repositories that it indexes. We state these limits, and the quantities our audit did not measure, explicitly.

An encrypted single-file database protects its contents with a key derived from a password and seals every page with an authenticated cipher whose associated data binds the page to its number and to its role. That construction is good. We measured it: across 13 byte-level mutations of a real database, 7 were refused when the file was opened, 5 more were caught only when the database was read, and 1 mutation was never noticed at all. What the construction does not provide is freshness. The counter that records how far the database has advanced lives inside the encrypted catalog, so an attacker who keeps an old copy of the file can restore it and every page will still authenticate. We measured that too: after restoring a snapshot over a live database, 40 of 80 records were silently lost, the checkpoint counter rewound from 8 to 4, the file was byte-identical to the snapshot, and the engine reported no error of any kind. We then show that no purely local mechanism can detect this: whatever the database says about its own history is exactly what the attacker can rewrite. Freshness requires a witness the attacker cannot reach. We build one — a chained anchor kept outside the database — and measure its cost at 2.11 µs per verification against the 178.4 ms that opening the database already costs, a factor of 84,710. We also characterise the cost of the guarantees themselves: the per-page framing is 0.7324% of a 4 KiB page, but because each record occupies a page of its own the file grows 13.2x when the page size goes from 4 KiB to 64 KiB, and an open is dominated by Argon2id rather than by data (178.4 ms for an empty database, 297.5 ms at 8,000 records). Finally we measure the query path: index-evaluable predicates stay flat at 0.0301 ms while scan-only predicates grow linearly to 60.807 ms, a ratio of 9,968, and a scan that matches a single record costs within 17% of one that matches 1,600. The result is a three-way separation that the format literature usually leaves implicit: confidentiality and positional integrity are local and cheap, freshness is not local at all, and its price is not the crypto but the bookkeeping.

MIPIIL is a published model presented as an edge-oriented music generator: a 19,197,204-parameter Transformer over a byte-level BPE alphabet, with a model card that promises unlimited-length real-time generation from a 375,000-file MIDI corpus. This paper reports an audit of that artefact, and the audit is a negative result about sequence modelling rather than about audio quality. The checkpoint loads exactly as documented and its weights are finite and meaningfully trained, yet the next-token distribution it defines does not depend on its input: over contexts of 16 to 512 tokens taken from a real Standard MIDI File, the mean pairwise total variation between next-token laws is below 1.4×10⁻⁷, the number of distinct argmax positions is exactly one, and the mutual information between context and prediction is 0.000 nats. An untrained control of the same architecture is measurably more context sensitive (2.12×10⁻² versus 9.08×10⁻⁸ total variation at the logits). Forward hooks localise the collapse: the feed-forward branch norm grows to 541.6 while the LayerNormed residual stream stays near √d, and cross-context spread contracts by a factor of 209,963 with depth in the trained model against 2.0 in the control. The consequence is that the artefact is, to within 5×10⁻⁶ bits per token, a 276-entry histogram that costs 5.9613 bits, and it codes real MIDI at 5.4461–5.4541 bits per token while a held-out unigram of the same file needs 4.454. We also document the release mechanics that let this ship: greedy decoding repeats one token forever, none of 40 sampled generations contains a MIDI header, the published decoder raises on the checkpoint's own special tokens, and the shipped generator never decodes a token at all — it maps token ids to pitches by modular arithmetic. Because the model audited here is the author's own release, the paper is offered as a verification protocol rather than as a critique: three measurements, each under a minute of compute, would have caught all of it.

MightBe is a single-process system that couples a from-scratch neural-network runtime to a relational store through a learned, auditable index. We make three contributions. First, we specify a hot-mutation protocol for a live network: an \textsc{alter} operation is merged into a candidate specification, validated, rebuilt, and re-hydrated with weights migrated by (layer, parameter, shape); the candidate must then pass a smoke forward pass on a zero tensor before it is published, and publication is a lock-free atomic swap of an `ArcSwap`-held snapshot, so readers in flight continue to observe the previous version and any failure leaves the previous version serving unchanged. Second, we give an auditable inference graph in which every answer is a scored path together with a bounded evidence set, and we specify the confidence algebra exactly: a path score is a product of per-step contributions, several paths reaching the same node are combined by a noisy-OR, and a verifier reranks the result by geometric interpolation with a semantic similarity term. Third, we couple the store to the learned index with an idempotent insert trigger that routes text rows through a normalization, tokenization, TF-IDF, TextRank and pointwise-mutual-information pipeline before the association graph is built. We report the complete result of the artifact's own test suite --- 32 test targets, 251 tests, all passing, one doc-test ignored --- and we state plainly that the repository contains no benchmarks and no accuracy or latency measurements, so we give a measurement protocol rather than results. We also disclose that the test suite itself was generated with the assistance of a large language model, and that six modules named in the project's own documentation have no implementation. *(When entering the abstract on arXiv, replace the Markdown backticks around `ArcSwap` with plain text or `\texttt{}` as appropriate; the metadata field is plain text, so write `ArcSwap` without markup.)*

Maylin is a small service cluster manager, written in Rust, that supervises ordinary host processes instead of containers. A service is a command line assembled from a plugin template—a runtime executable, a script, and three placeholders—so Node, Python, and native programs share one lifecycle: six observable states, restart policies, health probes, an event log, and an HTTP/WebSocket control plane with token-based roles. This paper describes that supervision model and measures it against a real build on Windows. With max_retries = 3, a crashing child is launched four times, with measured gaps of 2.05, 4.07, and 6.05 s, and is then marked failed; a child that exits 0 is launched once and left exited. Stopping a child that ignores stdin takes 1.21 s with a 1 s grace period. Restarting an instance with four requests in flight loses all four when it is the only upstream, but loses none with two, at the cost of 2 duplicate side effects in 6 executions. An authorization matrix over 18 method–path pairs and 4 principals shows that every endpoint rejects anonymous callers, but also that role checks are per-route heuristics rather than per-object policy, and that several endpoints return 500 or hang instead of failing cleanly. Maylin provides no isolation, no reproducible images, and no consensus: it is a deliberate midpoint between systemd, supervisord, and Compose, and the paper is explicit about what that midpoint gives up.

Tool-using AI agents run on a user's machine but delegate cognition to a third-party model provider. Whenever a credential, phone number, or access token has to appear in a prompt so that the agent can act on it, the usual choices are to expose the secret to the provider or to prevent the agent from acting at all. We describe and evaluate a third option, implemented in the open-source agent runtime BrainTentacle: *content-addressed redaction with local restoration*. Before a request leaves the machine, every occurrence of a registered sensitive value, and every occurrence matched by an enabled regular expression, is replaced in the copy of the conversation that will be transmitted by a placeholder whose text is a prefix of the SHA-256 digest of the replaced value. When the model returns tool arguments, the dispatcher substitutes the real values back before execution, so the agent acts on a secret it never saw. Because the placeholder derives from the value's content rather than from an enumeration counter, the same secret carries the same token across turns and independently of registration order; this is what makes the token quotable by the model in a later turn. We contribute (i) a precise description of the mechanism against the artifact, (ii) a measurement harness that links the shipping implementation as a library and measures detector precision and recall on a 62-document corpus of realistic and adversarial payloads, round-trip fidelity, placeholder stability, and the collision behaviour of truncated digests, and (iii) an enforcement audit that identifies three concrete gaps in the current implementation, including a request path on which redaction is not applied at all. We report only measured quantities, and we state the limitations explicitly: the secondary audit layer is experimental and fails open by design, and the workspace path jail is lexical with no default root.

A public model repository named F_Structure_LM advertises "a Fourier transform that replaces the self-attention of a Transformer" and shows a fluent reply to a prompt that is not in its training data. We read all 140,569,669 bytes of its payload and report what it is: 1,849,576 rows of 17 float32 numbers, each paired with one token label, plus three integers — and no learnable parameter of any kind. Inference is cosine nearest-neighbour lookup in that table. Because each row is the magnitude spectrum of raw byte-level BPE identifiers, two failure modes are theorems rather than measurements: the spectrum is invariant to time reversal, so reversing a context cannot change what is retrieved (99.05% of 4,000 held-out contexts retrieve the identical neighbour), and the zeroth bin is the unordered sum of the identifiers, carrying 24.0% of a typical key's energy. On the official LCCC valid and test splits the published index predicts the next token correctly for 2.90% of 4,000 sampled contexts — below its own constant-label baseline (5.48%) and far below a unigram over the same corpus (34.48%), against bigram 18.05%, trigram 11.63%, exact 12-gram 0.43%. Rebuilding the identical feature recipe on 50,000 sampled training dialogues, with 92.7 rows per dialogue instead of the published 37.0, lifts the same decoder to 21.63%: the artefact's failure sits in index density and label coverage, not in order blindness alone. At generation time it lands on points of its own table (mean top-1 cosine 0.998–1.000 over 896 steps), none of the three replies printed on its model card reproduce, and 32.4% of rows carry a label that cannot be decoded without an adjacent one. What it does genuinely well is cheap: 139 tokens/s and 841 MB resident on a CPU, no GPU. We close by stating what a "Fourier language model" claim would have to measure to be checkable.

Fake SSH Play is a small SSH responder that accepts every authentication attempt and, instead of a shell, plays a 2,193-frame ASCII rendering of the *Bad Apple* shadow-art video over the SSH channel at 33 ms per frame, then closes the session. It is written in Rust on `russh` and ships a web dashboard. Accepting any credential is textbook honeypot behaviour and we do not present it as a contribution. The narrower question is what a responder with *server-determined* content and duration is good for. In a fake shell the session length is chosen by the client, so duration measures the client; in a fixed animation the server removes its own variance from the same quantity, which makes "how long did the client stay" comparable across responders. That is a modest methodological claim, and this paper treats it as one. We document the system from its source, report its measured envelope — 5,219,755 bytes of channel payload, 2,380 bytes per frame, a largest frame that is 7.2% of the RFC 4253 maximum packet, 72.4 s of nominal playback, 5.2 MB of resident memory per concurrent session, and 1.07 µs of CPU per frame against a 33 ms budget — and specify, without running, a controlled comparison against an interactive fake shell. The repository contains no captured sessions, so this paper reports no engagement results, no detection or deterrence claim, and no attribution of any kind.

Cross-database split-brain is normally treated as a protocol problem: to stop two independently deployed databases from disagreeing about a shared outcome, one adds a consensus group, a quorum rule, or an external arbiter. We take the opposite route and eliminate the failure class instead of defending against it. The business-asset databases in our design never exchange a message with one another, each performs only single-node local transactions with its own local replication, and every cross-database decision is taken by a stateless business-layer coordinator. The coordinator reserves (freezes) each participant's local assets before any real value moves, records the global transaction in a guarded state machine, and compensates along an explicit per-operation phase model, so that a compensation can never be applied in the wrong direction. Recovery is layered: a poller and a dead-letter handler resume transactions when a participant is unreachable, verifying the real asset state before deciding whether to move forward or compensate, and a second layer lets a recovered node inspect its own local freeze markers and settle its own debt autonomously when the coordinator cannot reach it. We implement the design as an executable teaching artifact: three operating-system processes stand in for three databases, JSON files stand in for shards and replicas, and seven scripted fault cases exercise normal ordering, freeze rejection, mid-commit failure, shard partition and recovery, node crash and restart, orphan-freeze reconciliation, and retry exhaustion. All seven cases pass; we report the measured transcript, the per-case wall-clock durations, and the coordinator's protocol traffic. The artifact is not a production system. We state the six gaps that separate it from production, the trade-offs it accepts (eventual rather than serializable consistency, write amplification, a new critical component, and a freeze TTL that must be tuned to the real recovery-time distribution), and the kinds of system for which we believe a simpler mechanism should be preferred.

QR Code encoders are usually validated by scanning a rendered image, a test that lets the decoder's error correction absorb encoder mistakes and that samples few of the possible inputs. This paper reports CQRC, a QR Code generator written twice from scratch---in C# and in JavaScript---without third-party dependencies, and evaluates it by taking the module matrix, not the image, as the conformance unit. On a seeded corpus of 200 inputs spanning versions 1--40, all four error-correction levels and five payload families, the two implementations produce bit-identical matrices for 192 inputs (1,164,776 modules); the other eight expose a C# defect. A third-party oracle (python-qrcode 8.2, invoked with an explicit mask) agrees on 60/60 cases (585,988 modules), a 40x4 structural sweep passes in both languages, and byte-mode capacity matches the published ISO table at all 44 checked points. We diagnose the eight failures exactly: the C# Reed--Solomon encoder indexes a polynomial whose leading zero coefficients have been stripped, so any block whose remainder starts with 0x00 throws (8/200 cases; the predictor has accuracy 1.000, against 8.95 expected occurrences in 2,292 blocks). The JavaScript port supplies the missing zero padding and is correct. A second defect, a PNG IDAT stream without an Adler-32 checksum, is rejected by both CPython and Node zlib despite valid chunk CRCs. We also measure the metadata trailer (20/20 recovered from the code words; its "ISO/IEC 21570" label is a misattribution, since ISO 21570 is a food-analysis standard) and the geometric cost of styling: circular finders change 16 of 49 cells per finder, and 0.5 module rounding removes 40% of a module's area. No decoder was available, so we do not claim that styled symbols scan.