EMEM receiver demo: text version (deterministic; written by tools/site/build.mjs from committed data with the page's own receiver code)
Observation: NDVI 0.4708994708994709 at cell defi.zb572.xoso.zb1ec (near Keylong, Lahaul, India), Sentinel-2A L2A B08/B04, captured 2026-09-25T05:42:51.024000Z, signed 2026-09-28T09:06:56Z.
Agent A hands over: emem:fact:defi.zb572.xoso.zb1ec:oj5ceccile62uvm6hedpuk67cjt2pqc7z33mtsyuffgakxbxmyaa
It names 1115 bytes of CBOR by their BLAKE3-256 hash. Receiver: Agent B, using BLAKE3, Ed25519 and CBOR only; pinned key 777er3yihgifqmv5hmc2wwmyszgddzderzhsx6rex4yoakwomvka.
Ladder: L0 record integrity (hash, attestation signature, log), L1 observation identity, L2 derivation, L3 source re-read, L4 entity, L5 truth and decision.

12-second guided handoff (saved evidence; no network required):
1. Observe: Keylong NDVI 0.4708994708994709; Sentinel-2 L2A, 25 Sep 2026. One saved observation.
2. Construct the reference: emem:fact:defi.zb572.xoso.zb1ec:oj5ceccile62uvm6hedpuk67cjt2pqc7z33mtsyuffgakxbxmyaa
3. Mutate the value: 0.4708994708994709 → 0.47089947089947093. Change byte 82; keep the original token.
4. Resolve and re-hash: Expected record: oj5ceccile62uvm6hedpuk67cjt2pqc7z33mtsyuffgakxbxmyaa
Received bytes: 47o5vzsvu2krdvijfvtpj2awxdacgwijjkha3tfhlixujqmo7jlq
The content identifiers differ.
5. Refuse the changed record: L0 refused: the bytes do not hash to the name
6. Resolve the genuine reference: ACCEPTED, checked at L0, L1, L2: hash, attestation signature, log inclusion and recompute all check
Exact value: 0.4708994708994709. Record integrity, declared identity and derivation checked; source accuracy is inherited.

prose. A paraphrase
   B receives: "NDVI is about 0.47 at the Keylong field, late September."
   [ -- ]    a sentence carries no name to resolve, no bytes to re-hash, no signature to check
   => ACCEPTED, unchecked: no layer can be checked, so nothing is refused

M3. One byte changed in transit (value +1 ULP, token kept)
   B receives: byte 82: 0x33 -> 0x34 (value 0.4708994708994709 -> 0.47089947089947093)
   [FAIL] L0 the bytes hash to 47o5vzsv…, not to oj5cecci… named in the token
   => L0 refused: the bytes do not hash to the name

M4. The right record, cited for another place
   B receives: emem:fact:defi.zb493.xuqA.zcb5f:oj5ceccile62uvm6hedpuk67cjt2pqc7z33mtsyuffgakxbxmyaa
   [pass] L0 the 1,115 bytes hash to the name in the token (oj5cecci…)
   [FAIL] L1 the token says defi.zb493.xuqA.zcb5f; the record says defi.zb572.xoso.zb1ec
   => L1 refused: the record is about another cell than the token names

M8. Value forged to 0.45 and re-hashed
   B receives: emem:fact:defi.zb572.xoso.zb1ec:ylcx42oiamnly5e2dmqry2lfj2de2wgj5aalgpd5bgb5mr6nh52a
   [pass] L0 the 1,115 bytes hash to the name in the token (ylcx42oi…)
   [pass] L1 the record's own cell is the token's cell (defi.zb572.xoso.zb1ec)
   [FAIL] L0 no batch signed by key 777er3yi… contains these bytes; the signed batch for this observation holds the genuine ones
   => L0 refused: no batch signed by the pinned key contains these bytes

G0. The genuine handoff
   B receives: emem:fact:defi.zb572.xoso.zb1ec:oj5ceccile62uvm6hedpuk67cjt2pqc7z33mtsyuffgakxbxmyaa
   [pass] L0 the 1,115 bytes hash to the name in the token (oj5cecci…)
   [pass] L1 the record's own cell is the token's cell (defi.zb572.xoso.zb1ec)
   [pass] L0 the bytes sit in a batch of 1; its Merkle root recomputes; Ed25519 accepts the signature of key 777er3yi…
   [pass] L0 the batch is log entry 2,457,078 under a signed head of 2,556,451 entries; a second key (quunzdv5…) co-signed head 2,541,495, a prefix of it
   [pass] L2 NDVI recomputes from the signed inputs: B08 3502, B04 1900, offset -1000 → 0.4708994708994709
   => ACCEPTED, checked at L0, L1, L2: hash, attestation signature, log inclusion and recompute all check

L3. Re-read the named pixel (live in the browser; the committed copy is below)
   files: T43SFS_20260925T054251_B08_10m.tif, T43SFS_20260925T054251_B04_10m.tif; pixel col 9098, row 9443
   the record names these files by URL and carries no hash of them, so L3 is a re-read, not a hash check
   named pixel: B08 3502, B04 1900, offset -1000 -> NDVI 0.4708994708994709 (signed value 0.4708994708994709; equal bit for bit)
   pixel 10 m south: B08 2720, B04 1923 -> NDVI 0.3015512674990541. Before 28 Sep 2026 emem's reader took this pixel; 162 of 200 sampled earlier records carried such values. Signatures cannot see it; only the re-read can.

Not checkable here: L4 whether this cell is the field Agent A meant (out of scope); L5 whether the sensor and a decision taken on the value are right (inherited from product validation, or out of scope).
A signature fixes the bytes. It does not make the measurement true.

Embedded data: research/repro/v8/proof_bundle_ndvi.cbor (4906 B, sha256 8335118655b3334ca34381cf716b16b642e83989f77dd07965011c0cd4e26d11); research/repro/data/v8/pixel_windows.json ["oj5cecci S2A 2026-09-25 (signed 2026-09-28T09:06Z, post-fix) offset -1000"].