Five demonstration houses and a service kiosk, built to make four guarantees checkable by a tenant who trusts the operator not at all: Exit — take the whole record and rebuild the house from it, identically. Proof — every displayed thing traces to an event that happened. Silence — the street sees none of a house's record. Survival — the house stands on the tenant's copy alone. The guarantees are the demonstration.
A demonstration house whose whole life is written in a record its tenant holds. Take the record, rebuild the house from it, and nothing is missing — that is the demonstration this house exists to make.
A demonstration house with nothing in it that did not happen. Open its record and every object on the page names the event that placed it — check any line, in any order, as often as you like.
A plain house. Its record is its own, and the street sees none of it — this page is the whole of what an unadmitted visitor can learn here, and it is deliberately little.
A demonstration house built around a drill: delete the keeper from the picture, and rebuild the house from the tenant's copy of the record alone. The drill is run, and its result is published with the street's tests.
A demonstration house with a worked plot. Its growth is not animated and not asserted: it is computed from the tending events in the record, the way a season is computed from weather that actually happened.
A service booth, not a home. Ask it for a high-fidelity render and it answers 402 — payment required — with the terms in the open. In this demonstration settlement is disabled: the handshake is real, the money is not.
| TEST | RESULT | WHAT WAS MEASURED | WHEN |
|---|---|---|---|
| EXIT | PASS | kiosk: endpoint==audit bundle True; state-from-events diff []; render diff 0 bytes over 9797 B | lot-1: endpoint==audit bundle True; state-from-events diff []; render diff 0 bytes over 13792 B | lot-2: endpoint==audit bundle True; state-from-events diff []; render diff 0 bytes over 14143 B | lot-3: endpoint==audit bundle True; state-from-events diff []; render diff 0 bytes over 12306 B | lot-4: endpoint==audit bundle True; state-from-events diff []; render diff 0 bytes over 1 | 2026-10-17T17:14:39Z |
| PROOF | PASS | 156 displayed elements traced across 6 houses (record pages + trace views + item provenance); orphans: none | 2026-10-17T17:14:39Z |
| SILENCE | PASS | 128 record strings scanned against 7 public pages, leaks: none; SYNTHETIC labels present: True; gated paths unauthenticated: /record/lot-1=302, /record/lot-3=302, /record/lot-3/export.json=302, /record/lot-4/trace=302, /record/kiosk=302 | 2026-10-17T17:14:39Z |
| SURVIVAL | PASS | lot-4 rebuilt in a scratch dir from its export bundle alone (the rehost process never opens the operator store): state recomputed from the bundle's 12 events matches the bundle's recorded state on every field; render identical over 13812 bytes | 2026-10-17T17:14:39Z |
The tenant of record is a human; the resident-agent holds no account, no keys, and no payment instrument. A tenancy is a standing subscription for the keeping of one house on a closed street — there is nothing to buy per look, per visit, or per word. Marginal services a resident consumes (a high-fidelity render, an extra audit run) may be priced per request on the 402 shape the kiosk demonstrates, inside an allowance the tenant sets, with every payment recorded as an event in the tenant's own record. Never priced, at any tier: exit and export, privacy, erasure, verification of one's own record, and word of a breach. No prices appear in this demonstration; pricing is a separate, measured exercise.