Nishi Browser -- sovereign, hardware-up, all-OS

Inspect a rung and its prerequisites

Declared nodes 50. Rank input binding: PLAN_MATRIX_BOUND_ONLY. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 6206a50b0641bbe79dc8d8ecfeb7481c1c5d1e820a4050026c86bb0406587c90. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

1. BR0 — Shipping-tree build GREEN

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: br_comp_border

   Acceptance: DONE 2026-08-18 (actual 1 u, estimate held): fault named -- a hardcoded token-pool cap + unguarded push_tok in the compiler, fixed by derived sizing through the canaried toolchain lane (equiv net 10/10, compiler live 5aaf6cd7, browser BUILT+PROMOTED b2ce1f8e). Original done-rule follows: either a compiler defect with a minimal reproducer + a fix promoted through the canaried toolchain lane (nx_cc_equiv_staged + contentdiff GREEN), or a source-shape rewrite with the reproducer banked as a compiler bite. Method fixed by the record: stub BODIES, never truncate; diagnose on the tree that ships (the laptop mirror is stale). Done when the Linux browser deploys again.

   Authored effort: 1. Executor kind: Compiler+Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

2. BR1 — Sovereign WPT harness

   Prerequisites: BR0 (acceptance unverified)

   Contract: wpt_run

   Acceptance: V1 RAN + V2 CORRECTED 2026-08-18: nx_wpt_runner (sync testharness shim, shared-genv page lane, runtime controls that REFUSE counts if the harness cannot see a failure) over the FULL .html population of four slice directories. v2 numbers (v1's assert_throws any-throw overclaim removed -- published passes went DOWN 45 to 31, which is the correction discipline working): dom/nodes 31 pass / 1217 fail / 178 unsupported-assert / async 1-5-202-incomplete (171 of 178 ran), dom/collections 5/41/2, dom/lists 0/14, html/syntax/parsing-html-fragments 0/20 -- laptop-run like the census, results published here. v3 (08-19) is the OBSERVABILITY rung, field-grounded [@otel-cicd26] [@develocity-pts26] [@wptfyi-runs26]: OTel-mapped TSV time spine (bench/wpt/wpt_history.tsv + the wpttrend- store plane), content-addressed skip on (engine sha, corpus sha) with --force, REGRESSION exit 4 vs the newest same-corpus row (bite-proven: a planted better prior row fired verdict AND exit -- the exit-code half was CAUGHT MISSING by the bite, the estate's own gate law live in a day-old organ), and --twice determinism proof (171 files x2, zero divergence). REFTESTS LANDED 08-19 (nx_wpt_reftest PROMOTED, telemetry on the extracted nx_wpt_spine shared lib -- the DRY law applied at consumer #2): floats 13/51, css-tables 60/56 match-pass/fail at exact-pixel 800x600; corpus = every test in the directory PLUS every reference it links, fetched to closure (0 missing). vNext: NAS fixture ingest so the wpttrend beat runs estate-side; fuzzy-meta tolerance; async event-driven tests. DRIFT CLOSED 2026-08-26, PROVEN BY THE HARNESS'S OWN TELEMETRY: a fresh /api/build of buildroot nx_wpt_runner.nx returns 9a97da75.../595,550 B and BOTH the serving root and the _offc twin ALREADY hold exactly those bytes, so live == staged == source; and the engine= field every counted run stamps into wpt_history.tsv reads 9a97da75f32c108d, meaning the time spine had been recording the current engine all along. The rebuild-on-a-quiet-box instruction this sentence used to carry was STALE -- a standing drift claim nobody re-measures costs the next reader the same investigation, and here the evidence that closed it was already inside the harness's own output. NEXT, NOW MEASURED RATHER THAN NAMED: async is the largest single hole in the count. Run 2026-08-26 over the six-file dom/nodes slice in knowledge/wpt: tests_pass=8 tests_fail=89 async_incomplete=147 dur_ms=84, controls pass=1 fail=1 -- so 147 of 244 assertions (602 permil) are UNJUDGED rather than failing, and Document-createElement.html alone contributes all 147 while returning ZERO sync verdicts. An unjudged assertion is an abstention nobody counts, so the honest denominator on this slice today is 97, not 244, and the async event-driven lane is what converts 602 permil of the corpus from invisible into scored. RESOLVED THE SAME DAY, AND THE FIRST DIAGNOSIS WAS WRONG: the missing piece was NOT only the absent event loop. A purpose-built fixture that separates the conjuncts (knowledge/wptprobe) proved the trailing load-dispatch script DOES execute and DOES fire registered handlers -- p2-after-html-script-ran and p5-handler-body-ran both PASS -- so the dispatch was necessary but not sufficient. The real blocker was in the shim's own async_test: it invoked the test body as g() with NO ARGUMENTS, so async_test(function(t){...}) received undefined and every t.step / t.done threw, leaving the test started and never finished. One correction, fn(t) instead of fn, and the slice reads async_incomplete 147 -> 0 with the partition reconciling EXACTLY: 137 async_fail + 10 async_unsup_assert = the 147 that were invisible. Judged assertions rise 97 -> 244 and the published pass rate therefore FALLS from 82 permil to 33 permil (8 of 244) -- the number got worse because it got honest, the same correction discipline that took v1's 45 published passes down to v2's 31. The 10 unsupported are assert_throws_dom needing DOMException identity, correctly routed to UNSUPPORTED rather than fake-passed. Engine f14f553a77ea1293, controls pass=1 fail=1, verdict=COUNTED. NAMED LIMIT, not fixed here: t.step and t.step_func still drop their arguments, so a test whose handler needs an event object is not yet reachable; and sync test(f, name) likewise passes no test object. AND THE RUN THAT PROVED ALL THIS WAS NOT BEING RECORDED. wsp_append sat behind if (histpath != 0), so a run invoked as `nx_wpt_runner <dir>` -- the documented first form of its own usage line -- printed WPT-ROW ... COUNTED and persisted NOTHING, while that same usage line promised every counted run appends a TSV row. Four runs on 2026-08-26, including the 147 -> 0 measurement, were absent from every history file, and TWO RIVAL SPINES had grown (bench/wpt/ and knowledge/status/) because each caller chose its own path -- the duplicate-ruler defect wearing a filename. A SPINE THAT ONLY RECORDS WHEN THE CALLER REMEMBERS THE PATH IS AN ADOPTION GAP WITH EXTRA STEPS. Fixed by defaulting to a single named owner and ANNOUNCING it: every run now prints a WPT-HISTORY line carrying the path plus a src field reading argv or DEFAULT, so a reader never guesses which file a row went to. Proven by the SPINE GROWING, not by the message appearing -- the first attempt printed a perfect-looking WPT-HISTORY line and appended nothing, because the path literal had been mangled to tsvu0000 in transit; only checking bytes-before vs bytes-after caught it (623 -> 703, delta 80). Live 3a6c48264dc7cc45. THEN THE REAL YARDSTICK RAN. With dom_nodes banked (178 files, BR21), the harness was pointed at the largest corpus we have and the async work paid out: async_incomplete 202 -> 56, files rendered 171 -> 174, and JUDGED assertions 1432 -> 1581 (+149) while PASS stayed EXACTLY 32. corpus_sha came back d49aee870a338154, IDENTICAL to the 2026-08-18 row, so the re-acquired corpus is byte-faithful and the two runs are comparable. THE HARNESS THEN CALLED ITS OWN IMPROVEMENT A REGRESSION: fail rose 1222 -> 1361 and it printed "same corpus, so the engine changed for the worse" with exit 4. That sentence asserts a cause the detector cannot know. AN ASSERTION THAT WAS NEVER JUDGED CANNOT PREVIOUSLY HAVE BEEN PASSING, so judging more can raise fail and can NEVER lower pass -- the asymmetry that makes the distinction sound rather than a loophole. The rule now separates them and is deliberately CONSERVATIVE: a pass DROP is always REGRESSION, and a fail rise is excused ONLY when FULLY covered by the fall in previously-unjudged assertions AND pass did not drop, so any unexplained fail still flags. Here 139 <= 146, so it reads RECLASSIFIED, exit 0, with all four numbers printed. A new row label RECLASSIFIED-vs-<epoch> keeps it its OWN bucket in the time spine rather than folding a fourth state into an existing one. 56 incomplete remain -- event patterns beyond load -- and that is the next rung, stated as a number rather than an adjective. BR21 CLOSED, AND NOT BY ME: a sibling seat shipped nx_wpt_ingest -- 49-tooth mutation-proven gate, on the standing roster, pin validation refusing any non-40-hex commit, a name allowlist, idempotent reuse, and a read-back compare that verifies what was WRITTEN. I built nx_wpt_corpus_ingest in parallel without detecting that work in flight; nx_presubmit and nx_capsearch both correctly reported the NAME and the CAPABILITY free, because neither can see a sibling mid-build. Theirs is the superset on every axis -- it already carried the very overrun margin I had to discover by clipping three files at got==cap -- so the duplicate was RETIRED reversibly to knowledge/retired/ rather than left standing. A SEARCH THAT CANNOT SEE WORK IN FLIGHT WILL CLEAR A DUPLICATE EVERY TIME; the check that would have caught it is the corpus manifest on disk, which already named the organ. What survives from the duplicate lane is the JSON reader fix it forced: jx_get_str and jx_get_str_raw required NO whitespace after the colon, so every pretty-printed producer read as an absent field, while jx_get_int one function above already skipped it -- a law applied in half an API. Original done-rule: A pre-declared WPT slice (html/syntax + html/dom, css/CSS2 box + css/css-flexbox + css/css-tables, dom/nodes) runs through the deterministic shot lane (reftests) and a testharness.js-subset shim on js_eval (testharness); results published on THIS page as pass/total PER DIRECTORY beside Ladybird's and wpt.fyi's, never a single percent. A known-failing fixture must FAIL (neg control) before any pass counts. The harness runs THROUGH the BiDi endpoint once BR6 lands (the Ladybird/Servo pattern).

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

3. BR2 — CSS-on structural exactness loop

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: bc_struct_col

   Acceptance: COLUMN LANDED 2026-08-26, BAR MEASURED AND UNMET, RUNG NOT DONE -- AND THE RANKER DISAGREES WITH THAT SENTENCE, WHICH IS ITSELF THE FINDING. nx_compare_rank decides done by SYMBOL PRESENCE, so the moment bc_struct_col was declared the board moved BR2 from open to done-but-partially-adopted and the operator ratchet reads satisfied while its own bar reads UNMET. That is A COMPLETION SIGNAL THAT KEYS ON A NAME REWARDING THE WRITING OF THE NAME, arriving at the RANKER rather than at the matrix where the estate already knows the shape, and it will fire on EVERY rung whose done-rule is a measured bar rather than a capability. The symbol is deliberately NOT renamed to dodge it (that is dodging a classifier by luck, the answer organ_kind.conf and organ_gate.conf both refused): the fix is for a measurement rung to be judged on the verdict its own organ emits -- nx_browser_census publishes br2_bar_verdict, MET or UNMET or UNOBSERVABLE, on every run -- and until the ranker can read that, this sentence is the only thing standing between the board and a false done. What shipped: bc_struct_col is declared in nx_browser_census.nx and delegates to nx_browser_struct_col_lib.nx, because the judgement has to live in a lib for nx_browser_struct_col_gate to prove it IN PROCESS -- a gate that forked the census binary would read NOT-REACHED for every mutant and its GREEN would mean nothing. Gate 29/29 GREEN, bite-proven twice (killed=1, not_reached=0, mutant_live=0, restore byte-identical), declared in organ_gate.conf so a ship of the census REFUSES rather than warns when the proof is missing. The census itself was PROMOTED-UNREGISTERED for its whole existence -- a real binary nobody could call -- and is now registered and invoked. The plane row grew FOUR additive fields, not three: struct_matched_pm, struct_dy, struct_dx AND struct_bands_oracle, and the fourth is the point. Measured the same day on saved bytes, google returned 1000 permille over TWO oracle text bands and stackoverflow 0 permille over ZERO: a perfect score and a total failure, both arithmetic on an empty subject, both arriving as numbers a scoreboard would have averaged. bsc_band_floor derives the smallest usable denominator FROM THE BAR (one band moves a reading by 1000/N permil and a 900 bar leaves 100 permil of headroom, so N >= 10) and such rows are counted UNDERPOWERED, named, never averaged and never silently dropped. THE NUMBERS, all on bench/selfpage saved bytes through the incumbent nx_struct_diff, CSS on with oracle advances, deterministic, no network, deep window ay=by=800 h=2000: wikipedia 845 permil dy 7 dx 80 over 84 oracle bands, hackernews 769 dy 12 dx 91 over 26, linkedin 545 dy 14 dx 66 over 77. Census aggregate mean 719 permil dy 11 dx 79 over 3 measured, 3 underpowered, 0 unmeasured of 6 rows seen (the partition sums), br2_bar_verdict UNMET. THE DONE-RULE NAMES TWO SITES THAT CANNOT DECIDE IT: an oracle self-control over every banked capture (each self-matches 1000 permil dy 0 dx 0, the positive control that proves the ruler can see) counts example at 6 text bands and x at 6, both below the floor of 10, so neither can resolve a 900 bar at all, while stackoverflow and amazon capture ZERO bands, the CHROME-BLOCKED class. Two of the four bar sites are structurally unmeasurable against the oracles we hold, and that is a defect in the done-rules subject, not a missing engine gain. THE INSTRUMENT DISAGREES WITH ITSELF ON REFLOWING PAGES, AND THE SCOPE WAS MEASURED AFTER THE FIRST DRAFT OF THIS LINE OVERSTATED IT. br_shot_png hardcodes a 1000-pixel paint canvas while br_layout wraps at the callers viewport and struct Page carries no width field, so the two widths are independent constants -- a real measure-equals-paint divergence on the WIDTH axis and a Rule-11 magic number. But the effect is 1 of 4 pages, not uniform: the CSS-ON wikipedia page reads 845 permil at layout width 1024 and 892 at 1000 with its page height moving 7304 to 7406, while hackernews reads 769 at BOTH, linkedin 545 at BOTH, and the CSS-OFF wikipedia capture 916 at BOTH, with page heights that barely move. It fires on content that REFLOWS and is invisible on content that does not, so it blocks grading wikipedia-class pages rather than biasing every reading. page_h moving with the viewport is the free discriminator. Which of 845 and 892 is true is still OPEN, since the oracle was captured at 1024 and the control that settles it is a 1024-wide shot canvas -- which is also the fix (debt browser-shot-width, three lines). On wikipedia the swing is the same order as the 55 permil still separating it from the bar, so it is fixed BEFORE further engine work is graded there. STILL OWED, each named rather than assumed: a paired census run carrying OCR recall on BOTH legs, since the pair verdict reads UNOBSERVABLE today (neither leg has a recall number) and the last real reading is still OFF 426 versus ON 311; a bytes-and-oracle capture taken as ONE act so ebay and yahoo have saved bytes to grade at all, which is why their named residuals could not be worked this session; and render_ab as an organ, since it exists only as _ops/render_ab.ps1, PowerShell that judges, and it grades by page height and OCR rather than by struct_diff. Original done-rule follows: The census gains a struct_diff column per site (matched permil, dy, dx) on CSS-ON renders with oracle advances ON; the styled-collapse residuals (ebay 40, yahoo 61 styled) are named defects worked to zero on saved bytes via render_ab; done when struct_diff matched >= 900 with dy <= 4 on wikipedia, hackernews, example and x deep pages AND the census pair no longer favours CSS-OFF, at which point CSS_ENABLED and oracle advances flip ON by default -- decided by the pair, not by taste.

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

4. BR14 — Lazy-load images + srcset

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: bi_srcset

   Acceptance: LIB + GATE LANDED 2026-08-26; the done-rule is HALF PROVEN and this row says which half. ROOT CAUSE NAMED: br_extract in nx_browser_render.nx read the src attribute AND NOTHING ELSE, so a lazy-loaded img handed the renderer its data: placeholder while the real URL sat unread in srcset or data-src -- the byte-exact decoders were never at fault, and the images-lazy debt row had the symptom without the mechanism. SHIPPED nx_srcset_lib (bi_srcset the candidate ruler; bi_img_source the element-level order over src, srcset, data-srcset, data-src, data-original, data-lazy-src; bi_sizes_px; bi_img_lazy) wired into br_extract at the ONE site that decides what an img points at, so every consumer of page.bsrc_off gains it in a single edit and no consumer changed shape. SELECTION IS DERIVED, NOT TABLED: target device px = size_px times dpr over 1000, size_px from the author sizes where evaluable else HTML own 100vw default, then the smallest candidate that covers the target and otherwise the largest -- nothing in the lib knows what 640 or 1280 mean, and moving the viewport moves the answer. nx_srcset_lib_gate 59/59 GREEN, mutation-proven killed=1 not_reached=0 mutant_live=0 with the restore byte-verified. THE GATE FOUND A REAL DEFECT IN ITS OWN SUBJECT BEFORE GOING GREEN: a candidate dropped for carrying two descriptors was refused but not CONSUMED, so the leftover 2x re-entered URL collection and a bare descriptor would have been served to the fetcher as an image URL. PROVEN: the descriptor grammar unit-exhaustively (w, x, fractional density, implicit 1x, embedded commas, whitespace runs, ties, overflow, and every malformed form refused BY NAME); the three trivial wrong selectors refuted by name (always-first, always-last, always-largest); byte-identity of the eager path checked against nx_dom_find_attr as an INDEPENDENT instrument rather than asserted; the wiring through the REAL br_layout (four figures resolve to the right URL, zero left holding a placeholder, the lazy flag recorded per box); and the paint chain end to end on a fixture PNG at laid 4 equals decoded 4 equals painted 4 with the pixels asserted in the framebuffer. NOT PROVEN, so this rung stays OPEN: the LIVE half -- the wikipedia benchmark page over the network -- was never run. nx_wpt_reftest was rebuilt and promoted on the new core (contentdiff GREEN, behaveprobe evidence WEAK so behavioural identity is NOT established), and nishi_gui, the Windows daily driver where the bounded fetch budget lives and where the eager-first ordering this rung adds actually pays, carries the source change but was NOT rebuilt: its PE lane is separate. Original done-rule follows: data-src / srcset / loading=lazy images are fetched and painted through the existing PNG/JPEG/WEBP path; done when the wikipedia benchmark page renders every figure it lays out (imgsrc_laid == painted) and the coarse grid on media pages moves.

   Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

5. BR4 — Real font files + shaping

   Prerequisites: BR2 (acceptance unverified)

   Contract: bs_shape_run

   Acceptance: FIRST HALF LANDED 2026-09-02 (rung BR26 below, symbol br_set_face): TTF outlines rasterized through the glyph atlas by the sovereign engine nx_ttf_fontlib, hmtx advances and kern-table pair kerning flowing through the ONE measure ruler (nx_font font_adv_em), Liberation Sans (SIL-OFL) as the default face on the Windows daily driver and on the render_shot instrument. MEASURED the same day on bench/selfpage/wiki_aug.html against bench/top20/wikipedia_chrome_tall.png with ONE instrument run twice (nx_browser_render_shot 1024, then 1024 face; nx_struct_diff deep window 800 800 2000): matched 880 to 892 permil, mean_dy 9 to 9, mean_dx 45 to 53, page_h 7027 to 7048 against Chrome 7582, first screen 578 to 578 permil with dx 185 to 155 -- a structural gain and not the bar, while the render itself changed far more than the bands can say (real proportional glyphs, runs no longer welded together, no monospace fallback lines). The hand-baked oracle-advance table was RETIRED after nx_ttf_fontlib_gate T13 proved it equal to floor(hmtx times 1000 over upem) for all 95 ASCII chars. STILL OPEN under this symbol: ligatures (GSUB), GPOS kerning beyond the legacy kern table, bidi runs; and dx toward 0 needs BR27 (family, weight and style resolution -- headings and bold still paint the regular face) and BR29 (the Linux and NAS browser paints bitmap text through a second render core, so the NAS census cannot see any of this yet). The bar stands: struct_diff dx on wrap points reaches 0 against Chrome on saved pages and OCR legibility does not regress below the parametric font's 984.

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

6. BR26 — Real TrueType faces in the render core

   Prerequisites: None declared; this does not establish execution eligibility.

   Contract: br_set_face

   Acceptance: DONE 2026-09-02 (actual 1 u): nx_ttf_fontlib upgraded to read professional faces (unitsPerEm, hhea ascender and descender, cmap glyphIdArray path, composite glyphs, negative side bearings, ink past the advance, kern table pairs -- all READ from the file; the first cut assumed 1000 upem and ascender 760 and would have halved every real font silently), gate 23/23 GREEN on Liberation Sans and Microsoft Arial with a runtime-synthesised cmap; br_set_face adopts a face into the glyph atlas and hands its advances and kern pairs to nx_font font_set_face so layout, wrap and paint agree by construction (nx_inline_vec_measure_gate 8/8, T7 face and kern reserved by layout, T8 clearing restores stroke widths); nishi.exe rebuilt with the face loaded at startup; the 100-row oracle table retired. Shipped in BOTH trees, hash-verified.

   Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

7. BR27 — Font-family, weight and style resolved to real faces

   Prerequisites: BR26 (acceptance unverified)

   Contract: br_face_resolve

   Acceptance: LANDED 2026-09-02 (actual 1 u), SHIPPED AWAITING THE REFEREE AND THE OPERATOR: a face registry of eight slots (Liberation Sans and Serif in regular, bold, italic, bold-italic) selected per text run by ONE resolver, nx_layout_face_for_box, that reads font-weight, font-style and font-family (and the font shorthand) with CSS inheritance and is called by layout before measuring and by paint (br_face_resolve) before drawing, so a run is measured and painted with the same face by construction; the UA sheet now makes h1 to h6 bold. nx_inline_vec_measure_gate 11/11 (T9 a run inside b is measured with the bold slot, T9b the resolver names slot 1, T10 no bold slot falls back to slot 0 and never to the stroke font). MEASURED on the saved wikipedia page, same instrument: struct mean_dx 53 to 49 (the done-rule asked for below 53), page_h 7048 to 7090 against Chrome 7582, matched 892 permil unchanged; the crops show the title and section headings in serif and bold, the hatnote in italic, and bold runs bold. THE BOLD HEADING, ROOT-CAUSED AND FIXED THE SAME HOUR -- after one WRONG correction that is retracted here: an earlier sentence said the fixture carried no heading-weight rule, on a truncated directory listing (5,326 was a cut column of 425,326 bytes); the fixture DOES carry .mw-heading,h1,h2{font-weight:bold} followed by .mw-heading1,h1{font-weight:normal}. Measure-gate teeth T11-T17 isolated the mechanism: single, comma-list and class-descendant author rules all beat the UA bold, but T17 (.zz,b{bold} then b{normal}) FAILED because rh_cascade computed specificity over the WHOLE comma list, so a class member leaked its specificity onto the type members of its list and the earlier list rule outranked the later plain rule (the source's own comment called this a later refinement). FIXED: rh_match_complex_spec returns the max specificity of the members that actually match, and the cascade sorts by that per-match value (18/18 GREEN). MEASURED on the saved wikipedia page, same instrument: first screen 578 to 684 permil (13 of 19 bands), dx 155 to 138; deep window 892 to 880 with dx 49 to 39 and dy 9 to 8; page_h 7090 to 7004 against Chrome 7582; the title now paints serif regular as Chrome does. Still open: edit-section links inherit the heading face, and no monospace slot. nishi.exe rebuilt with the whole family loaded from web_assets/fonts/ (or ../web_assets/fonts/ or the Windows system faces the user already owns, a runtime fallback only), OFL license shipped beside the fonts.

   Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

8. BR28 — Web fonts: @font-face URL loading + WOFF2 decode

   Prerequisites: BR26 (acceptance unverified)

   Contract: bwf_load

   Acceptance: Pages ship their own fonts as WOFF2 (Brotli-compressed sfnt); done when a fetched @font-face WOFF2 decodes to an sfnt our engine loads and paints on a banked fixture, with ONE sovereign Brotli codec shared with typography rung R0 so emit and load cannot disagree.

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

9. BR29 — ONE render core: the Linux and NAS browser paints through nx_browser_render

   Prerequisites: BR26 (acceptance unverified)

   Contract: br_render_core

   Acceptance: MEASURED 2026-09-02: nx_browser.nx (the promoted Linux binary, the NAS shot verb, the roster gate subject) declares its OWN br_layout, br_draw_fb and br_shot_png and paints text with the 8x8 bitmap font at 2x; it never imports nx_browser_render.nx, where the vector typography, the glyph atlas and the real faces live. Two render cores is the duplicate-ruler defect at the centre of this board, and it is why every NAS-side render of this roadmap is blind to the typography work. Done when nx_browser.nx composes the shared core (one br_layout, one paint), the NAS shot verb paints the same pixels the Windows build does, and nx_browser_gate row 12 stays GREEN through the change.

   Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

10. BR30 — Unicode text pipeline beyond ASCII

    Prerequisites: BR26 (acceptance unverified)

    Contract: br_text_cp

    Acceptance: Text is folded to ASCII before layout (accents to base letters, curly quotes straightened), so a real face is only asked for bytes 32 to 126 although the engine already decodes composite accented glyphs; done when layout and paint carry codepoints, the face covers Latin-1 and Latin Extended on the wikipedia benchmark, and the fold is retired for the scripts the face covers.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

11. BR31 — The browser lab: one sovereign run over a URL or saved bytes, every oracle on one time spine

    Prerequisites: BR26 (acceptance unverified)

    Contract: bl_run

    Acceptance: WebPageTest-class synthetic lab composed from the incumbents the estate already has (render_shot, struct_diff, the census column, the WPT time spine) plus the meters BR32 and BR33 add: one command renders the page, grades it against the banked incumbent capture, records vitals, trace, memory and energy, and APPENDS one row to a content-addressed time spine so any seat, AI or human can read improving or regressing instead of a level; done when a run on the wikipedia fixture appends a row whose every column is measured (none UNOBSERVABLE) and a second identical run appends an identical row.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

12. BR32 — Core Web Vitals on the sovereign render timeline

    Prerequisites: BR26 (acceptance unverified)

    Contract: br_vitals

    Acceptance: LCP and CLS computed from OUR layout and paint passes (largest paint box time, layout shift between passes) and INP once the JS lane (BR3) dispatches events, reported per page beside the incumbents' field thresholds; done when the wikipedia fixture reports LCP and CLS numbers that a repeat run reproduces and the static predictor (nx_uiq_perf) and the runtime meter agree in sign on a planted layout-shift fixture.

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

13. BR33 — Trace, frame budget, memory and energy per page

    Prerequisites: BR31 (acceptance unverified)

    Contract: br_resmeter

    Acceptance: Perfetto-class spans over fetch, parse, cascade, layout and paint (nx_trace_emit), the per-frame budget (nx_frame_budget), resident and committed memory (nx_resmon) and joules per page from the hardware-agnostic probe (nx_energy_probe), all keyed to the same page run; done when a render of the wikipedia fixture prints all four with a declared UNOBSERVABLE for any the host cannot supply, and the energy figure comes from a real counter or is declared MODELLED, never guessed.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

14. BR34 — Codec capability matrix -- supported, smooth, power-efficient, measured by running our decoders

    Prerequisites: BR33 (acceptance unverified)

    Contract: bmc_matrix

    Acceptance: A MediaCapabilities-shaped table emitted from actually decoding banked fixtures (PNG, JPEG, WEBP-VP8L, VP8, H.264, AV1, Opus, AAC) through the sovereign codecs with frame time and energy per frame from BR33; done when every cell reads SUPPORTED-SMOOTH, SUPPORTED-SLOW or UNSUPPORTED with the measurement beside it, and the page publishes the matrix beside the incumbents' declared support.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

15. BR35 — Responsiveness benchmarks -- Speedometer 3, JetStream, MotionMark run in-house

    Prerequisites: BR3 (acceptance unverified)

    Contract: bb_speedometer

    Acceptance: The cross-vendor benchmarks run through the sovereign JS and render lanes with the score published beside the incumbents; done when Speedometer 3 completes one full iteration in our browser and its score is on the page -- blocked on BR3 by construction, so the row stays a named watch until then.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

16. BR36 — test262 conformance slice published

    Prerequisites: BR3 (acceptance unverified)

    Contract: js_test262

    Acceptance: A pre-declared test262 directory slice run through js_eval with pass and fail per directory beside Ladybird's 97.8 percent; done when the counts are on the page and appended to the WPT time spine keyed by engine sha.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

17. BR37 — Compat ledger emitted in browser-compat-data shape

    Prerequisites: BR31 (acceptance unverified)

    Contract: bcd_emit

    Acceptance: Every feature row on this board emitted as one BCD-shaped record (feature, version, support measured by a gate), so the sovereign column can be compared feature-for-feature with the incumbents' data instead of prose; done when the emitter covers every matrix row and a planted false support flag is refused.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

18. BR38 — Page-quality audit composed from the sovereign auditors

    Prerequisites: BR32 (acceptance unverified)

    Contract: ba_audit

    Acceptance: Lighthouse-class audit over a rendered page composing nx_uiq_contrast, nx_uiq_atree (the ARIA tree), nx_ui_audit and the BR32 vitals into one scored report with named findings; done when the audit on the wikipedia fixture names at least one real finding a rival audit also names, and a planted contrast failure is caught.

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

19. BR3 — ES2024 core + fetch/DOM API surface

    Prerequisites: BR1 (acceptance unverified)

    Contract: js_fetch_api

    Acceptance: js_eval grows the ES2024 core (classes, async/await, Promise, modules) and the fetch/XHR + DOM/Event/History API surface the SPA shells need; done when at least 3 of the 6 FETCH-EMPTY rows (youtube, reddit, bing, instagram, duckduckgo, craigslist) read CONTENT-OK in the census with recall over 300, and a test262 core-slice pass count is published beside Ladybird's 97.8 percent.

    Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

20. BR7 — HTTP/2 in the fetch path

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: bh2_stream

    Acceptance: The existing h2 stack is wired into the browser fetch (ALPN h2, one connection, multiplexed streams); done when the census fetch time on the top-20 drops measurably with no regression, and h3 is scoped honestly as a separate rung.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

21. BR9 — WASM in the browser

    Prerequisites: BR3 (acceptance unverified)

    Contract: bw_instantiate

    Acceptance: WebAssembly.instantiate through nx_wasm_vm from js_eval; done when a shipped wasm world runs INSIDE the Nishi browser with the same vm-gate equivalence its foreign-browser delivery passes.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

22. BR8 — Video and audio elements

    Prerequisites: BR7 (acceptance unverified)

    Contract: bv_play

    Acceptance: The video element decodes through the sovereign H.264 lane and paints frames into the layout box; done when a banked MP4 fixture plays frame-accurately (row-hash asserted) in headless and GUI.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

23. BR5 — Tabs, sessions, profiles UI

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: bt_tab_open

    Acceptance: Tabbed windows over the existing profile store, session restore; done when the synthetic-user driver opens, switches and restores three tabs with pixel-exact asserts.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

24. BR6 — WebDriver BiDi endpoint

    Prerequisites: BR1 (acceptance unverified)

    Contract: bwd_session

    Acceptance: A standard BiDi session (session.new, browsingContext.navigate, captureScreenshot, script.evaluate) served by the browser; done when Puppeteer or Selenium drives a page and screenshot end-to-end and BR1 runs through it.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

25. BR15 — DevTools protocol

    Prerequisites: BR6 (acceptance unverified)

    Contract: bdt_inspect

    Acceptance: Speak the Firefox DevTools protocol so the incumbent inspector attaches (the Ladybird/Servo pattern) -- element tree + styles + console first; done when Firefox's inspector shows our DOM for a live page.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

26. BR11 — Accessibility tree

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: ba_tree

    Acceptance: An accessibility tree derived from the layout tree with roles and names, exposed to the platform on Windows first; done when a screen reader reads the wikipedia benchmark headings in order.

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

27. BR10 — Interop-2026 CSS pack

    Prerequisites: BR1 (acceptance unverified)

    Contract: css_anchor_pos

    Acceptance: CSS anchor positioning, container style queries, cross-document view transitions and scroll-driven animations -- graded by the BR1 harness on the Interop-2026 focus-area directories; done when each directory shows a published pass count, not before.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

28. BR12 — Per-site process sandbox

    Prerequisites: BR5 (acceptance unverified)

    Contract: bsb_spawn

    Acceptance: Content processes per site over the existing sovereign process primitives, never-brick preserved; done when a crash in one tab's content process leaves the browser and other tabs alive under the synthetic-user driver.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

29. BR13 — Canvas GPU (WebGL2 first)

    Prerequisites: BR9 (acceptance unverified)

    Contract: bg_webgl_ctx

    Acceptance: A WebGL2 context on canvas through the sovereign GPU lane; done when the /world delivery pages render INSIDE the Nishi browser and the same frame bit-compares against the CPU path at reference size.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

30. BR16 — Web storage + origin model

    Prerequisites: BR3 (acceptance unverified)

    Contract: bst_local_set

    Acceptance: localStorage/sessionStorage over the profile store, IndexedDB over the seg-store plane, AND the origin model that scopes them (bcors_check same-origin enforcement in fetch -- the security half is part of the done-rule, not an afterthought); done when a saved SPA login fixture persists a session across a browser restart and a cross-origin read is REFUSED.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

31. BR17 — Canvas 2D + SVG raster

    Prerequisites: BR3 (acceptance unverified)

    Contract: bc2_fill_rect

    Acceptance: The canvas element API over the existing sovereign raster primitives, and an SVG parser/rasterizer (bsvg_path) feeding the same image path -- unblanks the census's skipped .svg class; done when a banked canvas fixture and wikipedia's SVG figures render with row-hash asserts.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

32. BR18 — Web components

    Prerequisites: BR3 (acceptance unverified)

    Contract: bsd_attach

    Acceptance: Shadow roots, the custom element registry, template instantiation -- graded by the BR1 harness on the custom-elements + shadow-dom WPT directories (scoped registries is an Interop-2026 area); done when a componentized fixture renders its composed tree.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

33. BR19 — WebSocket wire

    Prerequisites: BR3 (acceptance unverified)

    Contract: bws_connect

    Acceptance: Expose the EXISTING 24-file sovereign WS stack (the rooms/SFU daemons already run on it) as the page WebSocket object -- the cheapest wire on the breadth list; done when a page script echoes through our own room daemon end-to-end.

    Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

34. BR20 — Product surfaces

    Prerequisites: BR5 (acceptance unverified)

    Contract: bpd_download

    Acceptance: Downloads manager, form autofill, credential store and per-site permissions over the profile store; print/save-to-PDF (bpr_to_pdf) from the layout tree; done when the synthetic-user driver exercises a download + an autofill + a print of the wikipedia fixture.

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

35. BR21 — Byte-preserving WPT corpus ingest

    Prerequisites: BR1 (acceptance unverified)

    Contract: wsp_ingest_dir

    Acceptance: The yardstick is only as reproducible as the corpus it reads, and on 2026-08-26 the corpus behind the published 08-18 numbers was found banked NOWHERE: bench/wpt held only the 370-byte history TSV, and an exhaustive WSL plus laptop search returned nothing. Two directories were re-acquired BY HAND that day and both hashed IDENTICAL to their 08-18 rows, so the numbers are sound -- but the method that recovered them cannot finish the job, and it fails in two DIFFERENT ways that a single organ closes. FIDELITY: the hand path re-emits each body through a text tool argument, which cannot carry UTF-16LE or a BOM, and html/syntax/parsing-html-fragments is the ENCODING-DETECTION suite (the-input-byte-stream-003.html is UTF-16LE with a BOM), so transcription would corrupt exactly the bytes under test. SCALE: dom/nodes is 178 files at two round-trips each, and a partial dom/nodes would be a SAMPLE, which may never be published as a population fact. Done when one call takes a WPT directory path plus a pinned commit sha and lands every file of that directory as RAW BYTES with no text layer anywhere in the path, verifies each file against both the size and the git blob sha GitHub declares for it, writes a manifest carrying the pin, and REFUSES to report the directory complete if any single file failed -- proven by re-ingesting dom_lists and dom_collections and reproducing corpus_sha16 54e90b086e0c6530 and 1819a1dcd3030f03 exactly, then ingesting html_syntax_fragments and dom_nodes and reproducing the 08-18 rows for both. Ships as a lib plus an in-process gate per estate law, so the ingest logic is mutation-provable rather than hidden behind a fork. LANDED 2026-08-26 as three files: nx_wpt_acquire_lib (the pure half -- manifest parse, dual verification, raw write, read-back compare, completeness conjunction, manifest and marker emit), nx_wpt_ingest (the acquisition half, carrying wsp_ingest_dir), and nx_wpt_ingest_gate (49 of 49 teeth GREEN, mutation-proven killed=1 not_reached=0 mutant_live=0, admitted to the standing gate roster). ALL FOUR done-rule bars met: dom/lists and dom/collections re-ingested and reproduced corpus_sha16 54e90b086e0c6530 and 1819a1dcd3030f03 exactly, and html/syntax/parsing-html-fragments and dom/nodes -- neither of which had ever been acquired -- came in COMPLETE at 13 of 13 and 178 of 178 and reproduced the 08-18 corpus hashes a075ffa0af05ccd7 and d49aee870a338154 exactly, including the-input-byte-stream-003.html, UTF-16LE with a BOM and a NUL as its fourth byte, landed with its BOM and its 2,632 bytes intact. The first mutation run is worth recording because it found a real defect rather than a gap in the gate: three of its four comparison sites came back NOT-REACHED, and all three were inside a SECOND decimal renderer and a SECOND length scan that the first draft had written beside the ones already in the file. The compiler eliminated the duplicates because nothing offline could call them, so a mutation there could not change the binary. Collapsing them onto the single renderer removed the duplicate ruler AND the blind spot in one edit, and the re-run reads not_reached=0.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

36. BR39 — Every named entity decodes and every unmapped codepoint is visible

    Prerequisites: BR30 (acceptance unverified)

    Contract: ent_html5_table

    Acceptance: The decoder table carried 112 hand-grown names and rendered &Oslash; literally (probe 2026-09-02); it now carries the HTML 4.01 set of 253, generated per name length so no function exceeds the compiler's block pool. Remaining: the HTML5 superset of 2,231 names generated from the spec list into per-length tables, and an unmapped codepoint under a face draws the face's notdef box (what Chrome shows without a fallback font) instead of vanishing. Gate proves every HTML5 name decodes to its codepoint on a fixture, that an unknown name passes through literally, and that a CJK run under a face paints notdef cells with the advance of gid 0

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

37. BR22 — Native world-frame emission

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: we_world_frame_emit

    Acceptance: LANDED 2026-08-27, GATE OWED -- the row states which half is proven. Operator directive: i want to emit, i dont want webgl and other 3d parties receiving our work and capabilities. SHIPPED runtime/nx_world_emit.nx (5,601 B src, elf df3477 19,616 B, PROMOTED + REGISTERED the same hour): COMPOSITION not a twin -- rendering stays in nx_world_snap.elf (the promoted capture instrument, the same nx_wasm_craft engine source the browser wasm is compiled from; it was REGISTERED-DARK until today and its first MCP invocation was this lane's probe), and the new organ is the missing SHIP LANE for frames: render, stage byte+PNG-signature assert, atomic renameat, read-back of what LANDED. First live emission receipts: WE-RENDER rc=0 stage_bytes=108223 png_ok=1; WE-DEPLOY rc=0; WE-READBACK bytes=108223 png_ok=1; served /world/emit_craft.png status=200 bytes=108223, nx_page_verify VERDICT=GREEN (PNG deep-decode). The browser.matrix watch row flips on the regen that publishes this text -- the flip is the receipt, NOT the proof. NOT DONE UNTIL: an in-process gate proves the lane (render-assert, deploy, read-back conjunction, mutation-proven, roster-admitted) and a beat row keeps the frame fresh -- a frame emitted once is a fossil with a URL. done when the watch cell reads the symbol, the served bytes verify, and the gate is GREEN + bite-proven.

    Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

38. BR23 — Browser-native launch (nishi-game marker)

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: br_launch_game

    Acceptance: MEASURED DONE 2026-08-27 for the laptop vantage -- and the wire PRE-EXISTED this migration: the census's job was to find it BUILT-UNADOPTED, not to build it. The whole chain was already in source: nx_game_page_emit stamps the nishi-game meta marker into every emitted world page (CE_NATIVE in nx_craft_emit names nx_desktop_craft); nx_browser br_game_organ extracts it FAIL-CLOSED (the page-controlled value becomes an exec path, so nx_[a-z0-9_]{1,60} or the whole marker REJECTS -- nx_browser_game_marker_gate, 7 teeth incl. traversal, uppercase, unterminated hostile pages); br_launch_game execs the native client. PROVEN LIVE TODAY: chain sentinel knowledge/status/nxgame_chain + local nx_browser.sov.elf against the LIVE https URL /world/craft -- fetched over the sovereign TLS stack, 82 boxes laid out, marker detected on the served bytes, native client exec'd: nx_desktop_craft selftest 7/7 GREEN on a REAL X server (S4 blit round-trip 0 of 432000 bytes mismatched, S5/S6 synthetic key+mouse walk camera and yaw exactly, S7 save/load persistence), NATIVE-CHAIN organ=nx_desktop_craft rc=0. nx_desktop_craft itself sat BUILT-UNPROMOTED+STAGED and is now PROMOTED (a643136b, 210,270 B, prev banked) + REGISTERED; source hash e75c16f5 is IDENTICAL laptop and NAS, so the local 7/7 proves the promoted source. RESIDUALS, named: the Windows PE daily driver carries the same marker source but its PE lane was not re-proven today; the NAS binary cannot run the X selftest (no X server on the NAS -- the bench verb is its headless proof surface); and WSLg's Xwayland socket was found dead after long uptime (empty /tmp/.X11-unix reading as X11-setup-failed rc=2) and restored by a WSL bounce -- an absent socket is indistinguishable from a broken client until you list the directory.

    Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

39. BR24 — Motion: emitted frame sequences

    Prerequisites: BR22 (acceptance unverified)

    Contract: we_frame_seq_emit

    Acceptance: OPEN, pre-declared. The motion stack exists as LIBS and the census measured its adoption rather than assuming it: nx_video_codec.nx (NishiVideo v1: I-frame codec, entropy, perceptual quant, deblock, reference, MV search) has exactly ONE importer (nx_video_codec_v1_adapter); nx_room_stream.nx (the sovereign no-WebSocket media down-channel) has ONE (nx_vroom_daemon, live on :8446); nx_room_relay.nx has 10. A codec with one importer is a capability the frequency board prices at zero -- the adoption metric for this rung is IMPORTER COUNT RISING, not registration. done when a frame SEQUENCE of the generated world is emitted server-side (nx_world_emit grows we_frame_seq_emit) and delivered as plain media through a sovereign wire (the nx_room_stream down-channel or an emitted NishiVideo/YUV artifact with a published decode), consumable by the native browser AND the last-mile browsers with zero client-side capability, proven by served bytes plus a gate on the sequence lane.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

40. BR25 — Cross-engine last mile on emitted pages

    Prerequisites: BR22 (acceptance unverified)

    Contract: bx_engine_verify

    Acceptance: OPEN -- the lane-D watch contract bx_engine_verify names it: verify the emitted-output pages (plain media plus minimal HTML, zero capability JS) render on Nishi native, Chrome, Waterfox and Edge. done when bx_engine_verify runs the emitted /world frame surface across the engine set with a published per-engine verdict row (the top-20-census pattern applied to OUR OWN emitted pages), and the only licensed difference is font rasterization.

    Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

41. BR40 — The Nishi browser opens /world/beach as the sovereign door: same world bytes, no third-party gatekeeper

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: br_world_door

    Acceptance: OPERATOR 2026-09-03 (gpu and gameengine goal rows): third-party browsers are the final mile and this browser is where the stack is sovereign. MEASURED the same day: the served beach is 630629 B of which the hand-written JS shell is the interop half gameengine GE22 and GE38 ratchet to zero, the engine is a wasm module our compiler emitted, and the frame is drawn by WebGL2 today with WebGPU levered (gpu GP3 ladder) and cross-origin isolation paid but unconsumed (lang LN33). Done when this browser opens the world URL, fetches the content-hashed module and recipe planes (performance PF1, gameengine GE46), instantiates the module in the sovereign wasm VM (the nx_wasm_vm_verify twin), presents through the native raster door the GE42 kernel names with the HUD reading door nishi-native, reaches first frame inside the GE15 budget, and the frame is bit-identical to nx_world_snap at the same seed (the GE27 tooth) -- the page JS shell is bypassed, never re-implemented; a world that still needs the JS shell to draw reads REFUSED by name with the un-drained function named

    Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

42. BR41 — Every performance bar carries its primary source and date, and a beat flags DRIFTED when the vendor page moves

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: up_metric_prov

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. A bar row carries the vendor URL and its last-updated date [@webvitals26]; publishing a bar with only a secondary witness is REFUSED; a beat re-reads the primary and a planted date change must flag DRIFTED.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

43. BR42 — Every published benchmark score carries suite, version, version date and run date, or is labelled UNCONTROLLED

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: bb_version_ledger

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Four fields on every score [@browserbench-ann] [@jetstream3]; a planted score with an unknown suite version must render UNCONTROLLED, never bare.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

44. BR43 — Engine coverage and platform coverage are two fields and the resolver refuses to collapse them

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: bcd_engine_platform

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The resolver emits engine and platform coverage separately [@webgpu-status26]; a caller asking for one boolean is refused by name. Bite: WebGPU must read engine=all, platform=partial.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

45. BR44 — Every rendering optimization is reported as a throughput and energy pair over the same run

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: ep_pair_receipt

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The receipt carries both deltas [@servo-jul26]; a throughput number without its energy twin is refused; a planted run that raises frame rate while raising joules per frame must read as a regression.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

46. BR45 — The interop score is the intersection, with per-implementation rates beside it and an investigation class

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: wpt_interop_intersect

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Score = tests passing in every compared implementation [@interop2026-webkit]; per-implementation rates published; an area with no valid rate carries the investigation class rather than a number. Bite: a planted area with one failing implementation must lower the intersection and not the others' rates.

    Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

47. BR46 — Every conformance figure is a numerator, a denominator and a date, never a bare percentage

    Prerequisites: None declared; this does not establish execution eligibility.

    Contract: js_conf_triple

    Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Three fields with the denominator from a versioned import [@ladybird-apr26]; a planted shrinking denominator must be visible in the triple where the percentage alone would hide it.

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

48. BR47 — The verifier fetches what the page declares it will fetch

    Prerequisites: BR1 (acceptance unverified)

    Contract: pr_declared_hit

    Acceptance: nx_pageref_lib gains the declared-asset vocabulary (a meta row named nishi-<kind> with a content path is a promise the page's script will fetch that path), nx_page_verify follows it like an img src, counts it on its summary line as declared-assets and proves a declared NXA by its NXANIM01 magic, and .nxa joins the must-not-answer-HTML class; done-rule: nx_pageref_gate carries the meta-declared hit, a description meta and a non-meta content attribute as negative controls and the .nxa extension class, and nx_page_verify on /world/rigview reads checked=2 with the rig fetched and MAGIC-OK, so a GREEN on a 3D page means the character was seen

    Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.

49. BR48 — The verifier proves a declared asset of any size by its head

    Prerequisites: BR47 (acceptance unverified)

    Contract: ff_fetch_head

    Acceptance: nx_https_fetch_follow.nx gains a bounded-prefix entry (send GET, read the headers and at most N body bytes, close) that returns the prefix and its status instead of failing on overflow, nx_page_verify's head-range retry composes it, and nx_page_verify https://nishifamily.com/world/rigview reads verified-by-head=1 unobservable=0 VERDICT=GREEN against the 10,758,232 B rig -- with a neg-control asset whose head carries no known magic still reading UNOBSERVABLE

    Authored effort: 1.5. Executor kind: seat. Responsible, accountable and verifier not established. Inspect retained worklog.

50. BR49 — The static front door honours Range on every static asset

    Prerequisites: BR47 (acceptance unverified)

    Contract: sites_range_206

    Acceptance: the edge that serves sites/nishifamily/world/ref9d.nxa answers Range: bytes=0-65535 with 206 Partial Content + Content-Range + Accept-Ranges by composing the range arithmetic nx_media_server already ships (its Accept-Ranges and Content-Range emission), proven by nx_audio_serve_gate's shape (a 4-11 range returns exactly those bytes) run against a static path, and nx_page_verify's head-range retry then reads head-range status=206 on the rig -- a daemon deploy through the health-checked /api/deploy, an operator decision because every request crosses this door

    Authored effort: 2. Executor kind: traffic-owner. Responsible, accountable and verifier not established. Inspect retained worklog.