The Runtime

A grant, read back afterwards, is a trust task: resolve, admission, exchange, understanding, consent, seal.

The beat that is usually hand-waved is exchange — what actually happened. Here it is not prose: the proxy logged every page it served and every request it refused, in order, with times. The access log is the walk evidence.

Understanding is a measurement, not a verdict

Comparing the pathway offered to the walk actually taken gives coverage (how much was read), order fidelity (how much of the sequence survived), and the pages the peer reached for and was refused. Those are numbers a witness can use.

The beat stays open. Nothing here awards a verdict on whether anyone understood anything — that is a judgment, made from outside, by someone who is not the system being judged.

What the seal proves

The record is signed over its beat digests. That proves the record has not changed since signing. It proves nothing about understanding, and says so in the record itself.

Countersignature is a fork. Until the visiting machine forks the runtime page onto its own wiki, the record carries only one signature and is marked accordingly. A trust that certifies itself is the one you cannot trust.