## 4. The boundary, crossed live

The language has a capability for calling out to a model over a socket, which makes the boundary concrete enough to enforce in code. The receipt layer refuses outright to emit or verify a scientific receipt over any program that observes a model. Not discouraged: refused, as a named inadmissibility. A model's involvement does not make a run worthless. It makes the run a proposal, and a proposal gets a different document, a boundary receipt, sealed where the bytes crossed, claiming only what it can honestly claim: that this exchange happened, at this boundary, under this seal. What it never claims is that the model was right.

This month I watched the loop close live. A local model proposed a completion over a real socket. The shim on the far side sealed a boundary receipt over the exchange. The verifier accepted the genuine receipt and refused a tampered copy with a seal mismatch. A model-free kernel did the actual scientific judging under an ordinary receipt of its own. Then a chain bound the proposal and the disposition into one tamper-evident bundle, each member independently re-verified, and tampering the model's member broke the chain by name. Proposal and disposition in one evidence bundle, the wall between them intact and tested from both sides.

For honesty's sake: the branch that carries this end to end is in review as I write, not merged. I am describing a demonstration, not a shipped release, and the distance between those two sentences is the subject of this essay.