Do not take the site's word for it

What each group is for

• Tier vectors - the ten encounters the ladder exists to get right, from passing on a pavement to sustained contact in a school zone. Two of these failed when they were first written, and both failures were real faults in the classifier: a crowded-venue encounter that tipped into Notify at twenty seconds, and a dispatch tier that could never actually be reached.
• Tier invariants - thousands of randomized encounters checking the three rules that must hold for every possible input: a lost fix never alerts, a degraded fix never exceeds Notify, and dispatch never happens without sustained dwell plus a zone or a third repeat.
• Crypto - the HMAC used to derive the rotating identifiers is checked against RFC 4231's published test vector, so the derivation is not merely self-consistent but demonstrably the standard algorithm.
• Model properties - coverage never exceeds the sum of its parts, de-anonymization risk never falls as more people watch, the graduated ladder never refers more cases than naive dialling.
• The console - the query engine is run against its own vectors, including the ones that matter most: a query that would resolve an identity is refused; one approval alone cannot resolve; two approvals plus an order can; and every refusal and every grant lands in an append-only log that cannot be rewritten.
• Sensing - the admissibility rules, including that a single modality can never license escalation and that two modalities disagreeing beyond tolerance is a refusal rather than an average.
• The warning - the state machine, and the anti-inversion invariant: the warning text is byte-identical whether or not a child is present, because a warning that varied would be a detector.
• The bracelet - real Merkle inclusion proofs over a day of events, verified in your browser, including that a tampered leaf fails and that a disclosure carries no other event's salt.
• The anchor coverage model - the arithmetic behind the largest unknown in the concept: that doubling target coverage cannot lower cost, that zero sites means zero anchors, and what the assessment's own forty-thousand-anchor figure would imply.
• The page itself - no third-party requests, no storage, and the full-bleed loops verified by their decoded dimensions rather than by a flag that says they are playing.