Change one field. The receiver refuses.

Your browser is the receiver. Watch a real observation become a reference, a changed value get refused, and the genuine record pass its checks. No account or API key.

One observation. Two outcomes.

Preparing the saved record

Runs locally from the saved record and proofs.

Exact steps and outputs

Read the text version · Also try a live source re-read

This scripted receiver re-hashes the record, checks its attestation and log proofs, binds its declared identity and recomputes its value. It uses BLAKE3, Ed25519 and CBOR, and no emem code. The following cases expose the exact evidence and each check.

Sentinel-2 true colour, 1.92 km across, centred on the cell; the ring marks the 10 m cell and is about 200 m wide

NDVI of the 10 m cell at the ring's centre

0.4709

Sentinel-2A L2A, B08 and B04
2026-09-25 05:42:51Z
cell defi.zb572.xoso.zb1ec

Agent A hands over one reference, not a sentence:
emem:fact:defi.zb572.xoso.zb1ec:oj5ceccile62uvm6hedpuk67cjt2pqc7z33mtsyuffgakxbxmyaa
It names 1,115 bytes of CBOR by their BLAKE3-256 hash.

JavaScript is off, so this browser checks nothing. Here is the same run, computed by the same receiver code when this page was built. The full text is in transcript.txt.

prose A paraphrase: ACCEPTED, unchecked: no layer can be checked, so nothing is refused
M3 One byte changed in transit (value +1 ULP, token kept): L0 refused: the bytes do not hash to the name
M4 The right record, cited for another place: L1 refused: the record is about another cell than the token names
M8 Value forged to 0.45 and re-hashed: L0 refused: no batch signed by the pinned key contains these bytes
G0 The genuine handoff: ACCEPTED, checked at L0, L1, L2: hash, attestation signature, log inclusion and recompute all check
L3 the committed 5 × 5 window gives B08 3502, B04 1900 at the named pixel, NDVI 0.4708994708994709, equal to the signed value; the pixel 10 m south gives 0.3016. A browser with JavaScript can optionally re-read it live.

L4 (is this the field A meant) and L5 (is the sensor right, is the decision right) are not checkable from the record.

Five handoffs, one receiver

L3 · Re-read the named pixel

The record names its source files and its pixel. It carries no hash of those files. The default demonstration shows the saved source window. Choose the live source option to fetch the two 512 × 512 tiles from Planetary Computer and decode them here.

·L3waiting

. Solid blue: the pixel the record names. Dashed red: the pixel 10 m south, NDVI 0.3016.

The right record, the wrong pixel. Before 28 Sep 2026 emem's reader rounded the pixel index; for this cell that is the dashed pixel. In a sample of 200 earlier records, 162 carried the rounded pixel's values: signed faithfully, and wrong. Every check above accepts such a record. Only this re-read catches it.

What no check here can tell you

L4Whether this cell is the field Agent A meant. Out of scope.

L5Whether the sensor was right, and whether a decision taken on 0.4709 is right. Inherited from product validation, or out of scope.

A signature fixes the bytes. It does not make the measurement true.

Exact input: the 1,115 record bytes (hex)

The record, decoded