Do not take the site’s word for it

What each group is for

• Tier vectors — the ten encounters the ladder exists to get right, from passing on a pavement to sustained contact in a school zone. Two of these failed when they were first written, and both failures were real faults in the classifier: a crowded-venue encounter that tipped into Notify at twenty seconds, and a dispatch tier that could never actually be reached.
• Tier invariants — thousands of randomised encounters checking the three rules that must hold for every possible input: a lost fix never alerts, a degraded fix never exceeds Notify, and dispatch never happens without sustained dwell plus a zone or a third repeat.
• Crypto — the HMAC used to derive the rotating identifiers is checked against RFC 4231’s published test vector, so the derivation is not merely self-consistent but demonstrably the standard algorithm.
• Model properties — coverage never exceeds the sum of its parts, de-anonymisation risk never falls as more people watch, the graduated ladder never refers more cases than naive dialling.
• The page itself — no third-party requests, no storage, and the full-bleed loops verified by their decoded dimensions rather than by a flag that says they are playing.