An output is not authoritative because a backend returned it. The contract is:

• Durable state change is recorded before acknowledgement. A result that does not survive a restart is not authoritative.
• A result for an expired or superseded lease is rejected at the boundary, not silently accepted.
• Failure is recorded. A failure is a first-class outcome. It is emitted through the same receipt path, with the same provenance, with a defined failure class.

The receipt carries identity, fencing generation, deadline, artifact digest, numerical policy, route, and outcome. The receipt is durable. The output is not authoritative without the receipt. A visitor who wants to know what happened reads the receipt. A reviewer who wants to know why reads the provenance.

A receipt links a model identity, an artifact digest, a request, a route, and an outcome. The chain is the link from the source model to the result. Every link is preserved. Every link is verifiable.

The v1 corpus has no execution receipt. The ExecutionReceipt type is bound (ADR-033); the engine has not yet emitted one to publishable storage. A follow-on ADR (ADR-035) creates the emission pipeline. Until then, the Receipt Chain section shows the type's fields, names the gap, and links to ADR-035 for the close.

A failure receipt has the same shape as a success receipt, with a populated failure_class field. The constitutional principle — failure is first-class — is enforced by the type, not by a convention. The site does not display success without showing that failure is part of the same surface.

Replay reads the durable event log, re-derives the canonical world, and projects to the surface. Replay does not re-run compilation, inference, network requests, file writes, or device allocation. It re-derives state from durable facts.

The v1 corpus has no replay result. The ReplayResult type is bound (ADR-033); the engine has not yet emitted one. A follow-on ADR (ADR-036) creates the emission pipeline. The site names the gap.

Replay is not a debugging tool. Replay is the constitutional guarantee that state is reconstructable from durable events. The Replay section explains the guarantee; the corpus shows its operation when one exists.

A failure is a receipt. The receipt has a failure_class field. The field names the kind: stale_outcome, provider_failure, restart_recovery, projection_loss, validation_failed. The class is a closed set. The class is part of the receipt's type. A receipt without a failure_class is not a failure receipt.

The site presents failure with the same visual dignity as success. A rejected plan, a stale outcome, a failed qualification, and a recovered transaction are not exceptions to the visual language. They use the same Receipt component as successful artifacts.

The v1 corpus has no failure receipt. The type is bound; the gap is named.

The corpus is the published set of evidence artifacts. Every artifact has a stable URL. Every artifact's identity is content-addressed. The corpus is the only authority from which measurements may be projected.

The v1 corpus is one artifact: the sanitized ComputeImage on the Specimen page. The other §10 slots are gap-flagged. The corpus page lists every slot and its current state.

A reader who comes to the corpus looking for a measurement finds a small honest list. The page is not a marketing surface. It is the source of truth for what the project has published.