What ships in the Zeq SDK

One surface for synchronized physics, deployable state machines, and a verifiable compute envelope. Everything on this page is live.

2026-09-04 — ECON v5: one price, credits only, the monthly bond that burns

The economy now has one number and one direction. A compute-hour costs **$2.97** (published cost basis$1.98 × 1.5) on every node, every tier, every rail; GET /api/pricing/tiers publishes the price block and the tier table. Seats stay $29 /$79 / $199 /$499 and buy 9.764 / 26.599 / 67.003 / 168.013 hours per cycle, bonded in the wallet for the 30-day cycle: compute burns the bond first, then bought hours; unused bonded hours expire at cycle end and the next payment tops the bond up (7 days of grace before the plan mirror falls back to Free). Coins are only earned (one coin per CPU-hour from the 95% contributors' budget); the only bridge is coin → hours by burning (POST /api/credits/from-coin, optional bond_tier). Card checkout bonds the hours on the buyer's home node through the federated fuel_bond event; crypto buys hours at the same price.

• Removed, not stubbed: /api/credits/claim, /api/credits/status, /api/credits/convert, /api/credits/conversion, /api/credits/peer/*, /api/tally/credits/claim, /api/tally/promo/*, /api/tier/*, /api/swap/quote, /api/swap/foundation-pot — all 404; the tier-bond, tier-grant, overage, claim and Stripe-grant tables and the promo/burn/conversion columns are dropped (migration 0100). Daily token caps are gone; fuel is the only gate.
• New: POST /api/credits/bond { tier } (bought hours → cycle bond), fuel_bonds ledger, cycle in GET /api/tally/credits/:zid, from_bond_plancks / from_fuel_plancks on every charge.
• Docs: Compute credits is the one truth page; the pricing page, Vault, FAQ, PaaS pages and the MCP descriptor quote the same numbers.
• Mesh = 17 nodes. machine.zeq.dev is the headless Studio machine, shipped and backed up on its own; it is not a node and is not counted.

2026-09-03 — One Zeq CLI, on every node (cli.zeq.dev incorporated)

cli.zeq.dev — Zeq Studio + Zeq Root — is now part of every node's genome, not a fork. The Studio (write code in the browser, commit with a ZeqProof, deploy to your own machine; the editor is the console) and the CLI engine it drives are served at /studio/ and /pulse/cli/ on all 18 mesh nodes, same-origin — so zeqproof.com/studio/ computes against zeqproof, zeq.me/studio/ against zeq.me.

• Unified codebase. The Aug-14 cli.zeq.dev fork (guide panel, login, vault, settings, page, mint, endpoints, the Zeq Local on-device plane with its Merkle ledger + ledger anchor, the native zeq CLI, Zeq Local .tgz) and the framework CLI (generated sdk-surface.js, 769 endpoints across 11 capability domains, API Explorer) are one tree again. api renders by domain; explorer opens this node's API Explorer.
• New command surface — the current framework. transparency (truthful fields: treasury_pool, issuer_undistributed, foundation_envelopes, zeqond_now from genesis), coins (ZEQ Coin bearer tokens: balance · conservation · mint-from-balance · split · merge · transfer · export · redeem · height), bi / contribute (Basic Income: status · policy · census · mode · bond · heartbeat), mesh (quorum · peers · self · issuance at a Zeqond · anchor · replication), audit (audit-everything reads of your own machine chain, time-machine at), plan (admin plan show/set). All in help, the / slash menu and tab-completion.
• Folder access. The developer's machine is reached through Zeq Local (/pulse/cli/zeq-local.tgz, Node ≥ 18): the real 7-step pipeline runs on-box with no network, every compute lands in ~/.zeq-local/ledger.json, and anchor seals the Merkle root onto your chain on any node (ZEQ_NODE=https://<node>). Studio projects live in ZeqGit (/zeqgit-bridge/*, zeq.dev today).
• Service worker cache bumped (zeq-studio-v15); reload cli.zeq.dev twice if you still see "138 endpoints".

Cross-surface parity: the web CLI, Studio console and native zeq share this one engine; the Chrome/VS Code extensions and Workbench CLI tab load the same /pulse/cli/ modules from whichever node they are pointed at.

2026-08-28 — WebMCP + MCP self-description refresh

The node now speaks WebMCP — the W3C navigator.modelContext browser standard — alongside the server-side HTTP MCP. Every page it serves registers five tools for the in-browser agent (zeq_pulse, zeq_wallet, zeq_convert_credits (human-confirmed), zeq_api_catalog, zeq_call), loaded from /zeq-webmcp.js, running in the visitor's own same-origin session and never forwarding keys. Feature-detect with "modelContext" in navigator; @mcp-b/global polyfills older browsers. See MCP server → WebMCP.

GET /api/mcp is bumped to 3.1.0: it now advertises the WebMCP layer in a webmcp field and describes the current economy under surface.economy — metered compute billed in compute-hours (1 hour = 1 compute credit = 1 ZEQ Coin, opt-in and supply-neutral — superseded 2026-09-04 by ECON v5: no credits → coin path exists any more), per-seat annual subscriptions (superseded: monthly cycle bonds at $2.97/h, see the ECON v5 entry above) (Starter 10h · Builder 40h · Advanced 120h · Architect 400h, a seat = a lifetime for its version), BYOK-only AI, and federated credit balances. The public endpoint catalog (GET /api/endpoints) is regenerated to the current surface.

2026-08-10 — MMIO: connect a machine, not a .env

You now bind to the framework by mapping a register page, not reading a .env. The local zeqd agent (stdlib Python, or a single static Rust binary) owns a 4 KiB region — ZID, the live 1.287 Hz clock, CREDIT, a revocable credential handle — seals the key with AES-256-GCM, mlocks it, and resolves the handle → a short-lived bearer. The SDK's ZeqReactorClient.connect() is now MMIO-first (the ZEQ_API_KEY env fallback is deprecated with a warning). Reachable from four surfaces: @zeq/sdk (ZeqMachine + connect()), the endpoint GET /api/zeq/mmio (public manifest + live registers) and /api/zeq/mmio/registers (authed ZID), the MCP tool zeq_mmio, and the CLI zeq mmio. Full reference: MMIO connect · Zeq on hardware · zeq-mmio.h. Validated on a real host (mlock=True, AES seal, RAM region, doorbell).

2026-08-10 — ZeqReactor: recursive, sealed simulation loops

ZeqReactor turns ZeqStream from a broadcast into a feedback loop: the sealed output of one compute plus live environment data becomes the query for the next — xₙ₊₁ = seal(solver(T(xₙ, uₙ))). Each step is sealed, hash-linked into the entangled-state chain, carries the R(t)/master/ functional/spectral telemetry, and is reality-gated (a step that fails its ≤0.1% check can halt the loop). Live now: POST /api/zeq/reactor (transition contract)

• /step + /observe (reactive auto-step) + /state + /trajectory (chain-verified) + /telemetry + /next (cross-container long-poll for live subscribe). Any of the 26 solvers can drive one; solvers that take an initialState field become stateful digital twins (verified: a tumour front advancing 13.7 → 34.3 as its density field carries forward). Plug it into Unity, Simulink, Python or IoT with the client loops in the docs.

2026-08-10 — The core equations, evaluated on every envelope

Every sealed CKO envelope now carries the framework's core equations genuinely computed on the result, not recorded as strings — see the envelope equations. The HulyaPulse R(t)=S(t)[1+α·sin(2π·f_H·t)] is evaluated at the seal's Zeqond phase (was a placeholder); the 7-step protocol is populated with the honest VERIFY verdict; and for any solver that produces a field, spectrum or profile, the HULYAS Master Equation (its six terms □ϕ, μ²ϕ, λϕ³, decay, KO42 coupling, T), the Functional Equation E=P_ϕ·Z, and the Spectral-Topological propagator Ψ=∭K·ϕ are computed on that field. Scalar-only results leave the field-dependent ones null — never fabricated. ZeqBuckling now also returns its critical mode shape (filling displacement_field), and ZeqDevice a potential slice φ(x). All DB-verified across the solver suite.

2026-08-10 — New solver: ZeqBuckling (Euler column buckling)

A structural-stability solver, and a new numerical capability — a generalised eigenvalue problem. ZeqBuckling finds the axial load at which a slender column or strut buckles, assembling the beam-column problem K φ=P·K_g φ from Hermitian beam finite elements and solving it by a Cholesky reduction + Jacobi diagonalisation. Its reality-check is Euler's exact P_cr=π²·EI/(K·L)² for the end condition. Verified live (EI=1, L=1): pinned–pinned 9.8696 (π²), fixed–fixed 39.478 (4π²), fixed–free 2.4674 (π²/4), fixed–pinned 20.19 — all to <0.001%; a coarse mesh honestly seals observable-differential. That makes 26 solvers — see the full catalogue. Live on REST, zeq_buckling, zeq auto / Zeq Math, and the CLI.

2026-08-10 — New solver: ZeqAcoustic (resonator modes)

A new domain — acoustics. ZeqAcoustic computes the resonant frequencies of a 1-D acoustic resonator (the Helmholtz eigenproblem −p″=k²p) with open or closed ends — the physics of organ pipes, wind instruments, exhaust/HVAC ducts and mufflers. It reuses the Sturm-bisection eigensolver but adds rigid (Neumann) boundaries via a half-cell mass, which yields the distinct quarter-wave (2n−1)·c/4L spectrum. Verified live (1 m tube, air): open–open 171.5 Hz, open–closed 85.75 Hz, closed–closed 171.5 Hz — all to ~0.0001% vs the exact closed forms. That makes 25 solvers — see the full catalogue. Live on REST, zeq_acoustic, zeq auto / Zeq Math, and the CLI.

2026-08-10 — New solver: ZeqSchrodinger (quantum energy levels)

The suite now reaches its flagship domain — quantum mechanics. ZeqSchrodinger solves the time-independent Schrödinger eigenvalue problem Ĥψ=Eψ for the bound-state energy levels — the spectrum behind atoms, quantum wells/dots, molecular vibration and the qubit — by a Sturm-sequence bisection of the tridiagonal Hamiltonian, with the ground state by inverse iteration. Its reality-check is the EXACT analytic spectrum: the harmonic oscillator ℏω(n+½) and the infinite square well n²π²ℏ²/2mL². Verified live: harmonic oscillator (6 levels) → 0.006%, square well (5 levels) → 0.001%; a deliberately coarse grid gives the wrong levels and honestly seals observable-differential. That makes 24 solvers — see the full catalogue. Live on REST, zeq_schrodinger, zeq auto / Zeq Math, and the CLI.

2026-08-09 — ZeqDevice goes 2-D (device electrostatics)

ZeqDevice now defaults to 2-D device electrostatics — the potential and field in a semiconductor cross-section under an electrode (∇²φ=0), solved matrix-free by a Jacobi-preconditioned conjugate gradient and checked against the exact sinh Fourier mode. The reported peak |E| is what sets breakdown in a MOSFET / HEMT / diode. Verified live: default 80×60 → 0.0039% vs exact (CG residual 6·10⁻¹¹), reproducible bit-for-bit, and an absurd grid clamps and still seals. The original 1-D PN junction (built-in voltage V_bi=V_T·ln(NaNd/n_i²)) is still there under dim:1 (or a doping param). Live on REST, zeq_device, zeq auto / Zeq Math, and the CLI.

2026-08-09 — New solver: ZeqTumor (Fisher–KPP growth front)

A growth-front domain — oncology / invasion biology. ZeqTumor solves the Fisher–KPP equation for a population/tumour/gene that grows and spreads as a travelling front. Its seal is a physical invariant — the density must stay in [0,1], held to machine precision by a stable scheme and violated catastrophically past the CFL limit (so an unstable run mints nothing). And the front advances at the exact Ablowitz–Zeppetella speed c = 5√(rD/6), verified live to ~0.25%. Live on REST, zeq_tumor, zeq auto / Zeq Math, and the CLI.

2026-08-09 — New solver: ZeqLotka (predator–prey / ecosystem dynamics)

Another real-world domain — population ecology. ZeqLotka solves the Lotka–Volterra predator–prey system behind fisheries, pest control and ecosystem-collapse forecasting. Its reality check is the conserved first integral H: the default RK4 holds it to ~10⁻⁹ (verified live, stable boom-bust cycle), while forward-Euler drifts ~4% and spirals the populations to a false extinction — and, being past 0.1%, that run does not seal. A wrong integrator gives a wrong ecological prediction, and the seal gate catches it. Live on REST, zeq_lotka, zeq auto / Zeq Math, and the CLI.

2026-08-09 — ZeqFracture: the crack's geometry, not just its tip

ZeqFracture now returns the crack path — crackPath, a [x, y] polyline tracing the broken-bond front across the specimen, with crackLengthAlongPath and maxDeflection from the centre-line. Verified live: below critical it's just the seeded notch; above it, a full-span crack (length 43.0, deflection 0.074 — a clean straight mode-I crack). Deterministic.

2026-08-09 — New solver: ZeqKalman (optimal state estimation)

A whole new domain — control / estimation. ZeqKalman is the Kalman filter: track a moving target from noisy position measurements, the estimator behind GPS, tracking, robotics, navigation and sensor fusion. It seals on a real, verifiable property — the error covariance converges to the steady-state Riccati/DARE solution (verified live to ~10⁻¹⁴) — and reports its optimality (RMSE → the minimum-variance bound √P∞), innovation whiteness, and that the Joseph-form update keeps the covariance positive-definite (a naive update diverges — the life-or-death). Deterministic. Live on REST, zeq_kalman, zeq auto / Zeq Math, and the CLI.

2026-08-09 — ZeqWave goes 2-D (a membrane, energy exact to 1e-13)

ZeqWave now solves the 2-D membrane wave ∂²u/∂t² = c²(∂²u/∂x² + ∂²u/∂y²) by leapfrog, by default. The reality check is exactly-conserved discrete energy — verified live at drift ~10⁻¹³ — and the reported standing-mode frequency matches ω = cπ√(kx²/Lx²+ky²/Ly²) to the digit. The life-or-death is the 2-D Courant C = c·dt·√(1/dx²+1/dy²) ≤ 1: verified live, C=0.9 conserves and C=1.05 explodes. 1-D Maxwell FDTD stays on mode:"maxwell", the 1-D scalar wave on dim:1. Live on REST, zeq_wave, zeq auto / Zeq Math, and the CLI.

2026-08-09 — ZeqHeat goes 2-D (ADI, unconditionally stable)

ZeqHeat now solves diffusion on a 2-D grid by default — ∂T/∂t = α(∂²T/∂x² + ∂²T/∂y²) — checked against the exact 2-D Fourier-mode decay. The life-or-death sharpens in 2-D: explicit FTCS blows up past the CFL limit r = α·dt·(1/dx² + 1/dy²) = ½, while the new implicit ADI (Peaceman–Rachford, two Thomas sweeps a step) is unconditionally stable — verified live at r=5, 10× the explicit limit, to 0.05%. The 1-D bar is still there via dim:1. Live on REST, zeq_heat, zeq auto / Zeq Math, and the CLI.

2026-08-09 — Two solvers go 2-D: ZeqFracture crack propagation + ZeqFEA larger meshes

Both structural pipelines got a real numerical upgrade — same sealed envelope, deeper physics.

• ZeqFracture now propagates a crack in 2-D. The default is a bond-based peridynamic lattice: a seeded edge notch on a mode-I SENT specimen, loaded quasi-statically, bonds breaking irreversibly on true finite stretch and cascaded so the crack tip advances. Below a critical far-field strain the notch holds; above it the crack runs across the whole specimen (propagated, spannedDomain, criticalStrain, crackTipX). The 1-D cohesive bar is still there via mode:"bar". Deterministic; sealed on the relaxed equilibrium residual.
• ZeqFEA is now matrix-free, so the mesh can be large. The global stiffness is never assembled — a Jacobi-preconditioned CG applies the Q4 element stiffness element-by-element, memory O(dof). That lets the mesh refine until the FEM tip deflection converges to Euler–Bernoulli beam theory: coarse 24×6 is 6% stiff (ratio 0.94), refined 120×30 lands on it (ratio ~1.00). Response reports elements, dof, deflectionRatio.

Both are live on every surface — REST, the zeq_fracture/zeq_fea MCP tools, zeq_auto/Zeq Math, and Build's Compute panel.

2026-08-09 — ZeqStream: the seal always travels, keyless pull, and an encrypted line (ZeqSSH)

Three additions to ZeqStream, all compliant with the one rule that a user shapes delivery, never the envelope:

• The seal is unstrippable. Every pull and tick carries X-Zeq-Sealed, X-Zeq-Proof, X-Zeq-Token, X-Zeq-Zeqond, X-Zeq-Verify as headers a template cannot touch — so an owner can never edit or hide the seal, and a device can always verify. Every fire still only seals under ≤0.1%.
• Keyless pull — POST /api/zeq/streams/:id/link mints a signed, expiring URL; a device pulls GET …/:id/pull?sig=… with no API key and no .env. The signature is the credential; the secret lives in ZSC. Tamper → 401.
• Encrypted line — ZeqSSH — POST …/:id/secure/open opens an AES-256-GCM channel (the same per-Zeqond HKDF record layer as Zeq-SSL, forward-secret at 1.287 Hz); GET …/:id/secure/pull?session=… returns an encrypted frame whose plaintext is the sealed envelope. Nothing sealed travels in the clear; a leaked session id alone yields ciphertext nobody can open. The 🔓 Keyless link and 🔐 Encrypted line buttons in the stream app generate both.

2026-08-09 — ZeqStream streams a state contract: editable contract, coded output, pull endpoint

ZeqStream now streams a state contract — an editable definition of what fires — and shapes its output for whatever consumes it. Two gaps filled: (1) an editable state contract (contract on the stream, an Edit button in the app); (2) output shaping — outputFormat: json or template, where the template is a payload you code in your engine's language (Unity C#, Unreal, Python, Lua, CSV, custom JSON) with safe {{placeholder}} substitution — no code executed. New pull endpoint GET /api/zeq/streams/:id/latest returns the last fired output in your format with the right Content-Type: put the stream key in your simulation and pull; the WebSocket pushes the same rendered payload live. Canonical /api/zeq/streams/* (legacy /stream/channels/* still work). New blackhole solver — a semiclassical quantum-particle infall into a Schwarzschild black hole (verified vs textbook r_s + Hawking T; geodesic energy conserved to ~10⁻¹⁴ %); one-click Black-hole demo in the app streams it so you watch the particle freeze and redshift at the horizon.

2026-08-09 — ZeqStream: hosted, ticking solver channels (REST + CLI)

ZeqStream turns any solver into a standing, keyed endpoint a game/sensor/instrument connects to and ticks. Each tick is one Zeqond and seals one ZEQ envelope + ZEQOND receipt onto the chain — the same seal as the solver's own endpoint, but the channel persists (id, own API key, tick count, head state). POST /api/zeq/stream/channels creates one and mints its key (shown once); POST …/:id/tick advances it; GET/close round it out. CLI: zeq stream create|tick|get|list|close; MCP: the zeq_stream tool. New table zeq_stream_channels (head only — per-tick history lives on the chain).

Real-time + fairness (now live). WebSocket push at wss://…/ws/stream?channel=… streams each sealed tick live (REST …/tick stays the fallback). An auto-tick daemon advances channels created with autotick:true on the Zeqond grid — off by default, and it stops a channel whose owner runs out of credits. The fairness model: sub-ticks between seals are free local compute (hash-chained into tickRoot); the seal is the only credit-compute and fires once per tickIntervalZeqonds — so a fair 24-hour tick (≈111,197 Zeqonds) seals one proof a day however many Zeqonds passed. Per-sub-step physics is explicitly not claimed yet (solvers recompute per tick until they gain an incremental step()).

2026-08-09 — ZeqAuto: one frictionless endpoint + categorized operators

Every solver now names the operators it computes with — real catalogue IDs, not just KO42: heat→CHE17 (Fick), flow→FL3 (Navier–Stokes), quant→BLACK_SCHOLES, sat→CS81 (3-SAT), gauge→HEP4 (Yang–Mills), fea→FEA_DISPLACEMENT+BEAM_DEFLECTION, dock→BINDING_AFFINITY, and so on — so the envelope and the observer card name what actually ran (e.g. "applied Fick Diffusion Flux").

ZeqAuto — the frictionless endpoint. POST /api/zeq/auto { query, constants }: send a natural-language query and the parameters, and a solver registry routes it to the right pipeline (of ~19), runs it, and seals the same envelope + receipt. No operators or endpoint to choose. zeq_auto MCP tool and auto CLI verb too. Examples: "simulate a Lennard-Jones liquid" → ZeqEvolve; "price a call S0=100 K=100 sigma=0.2" → ZeqQuant; "shallow-water tsunami" → ZeqClimate.

2026-08-09 — three more solvers + honest card labels

Three more domain solvers: ZeqOpt (nonlinear optimization vs the known global minimum), ZeqClimate (2-D shallow-water, mass-conserving), and ZeqDock (rigid-body molecular docking by LJ + Coulomb energy minimization). Endpoints /api/zeq/{opt,climate,dock}, zeq_* MCP tools, CLI verbs.

Honest card labels. The observer/envelope card no longer calls every KO42-only domain solver an "integrated HULYAS master field" — it now reads the envelope's domain, so ZeqEpi reads "ran an Epidemiology solve", ZeqGauge "a Lattice Gauge Theory solve", and so on. The genuine master-field integrators (solve/multibody) still name themselves. The framework MCP tools/list serves every new tool dynamically, so all MCP surfaces have parity automatically.

2026-08-08 — eight domain solvers (finance, biology, number theory, …)

Eight new industry-mapped pipelines join the Life or Death section as domain solvers, each checked against a known or exact result: ZeqEpi (SIR/SEIR epidemics — population conserved, Kermack–McKendrick final size), ZeqQuant (option pricing — Monte-Carlo verified against Black–Scholes), ZeqZeta (Riemann zeta zeros on the ½-line, count verified vs N(T)), ZeqSAT (DPLL 3-SAT, certified, NP-hard scaling), ZeqGauge (2-D U(1) lattice gauge — plaquette vs the exact Bessel result), ZeqFEA (2-D finite-element cantilever vs beam theory), ZeqGrid (DC power flow — Kirchhoff-checked), and ZeqDevice (PN junction — numeric vs analytic built-in voltage). Endpoints /api/zeq/{epi,quant, zeta,sat,gauge,fea,grid,device}, matching zeq_* MCP tools and CLI verbs. Honest by design: ZeqSAT/ZeqGauge/ZeqZeta touch P-vs-NP / Yang–Mills / Riemann — they compute, verify and simulate in those domains; they do not prove the open problems, and the framework does not claim to.

2026-08-08 — ZeqReact: reaction–diffusion (the biology pipeline)

ZeqReact joins the Life or Death section: 2-D reaction–diffusion, either Gray–Scott (Turing morphogenesis — spots/stripes/worms self-organise) or FitzHugh–Nagumo (excitable media — cardiac/neural travelling & spiral waves). Reality check: the 2-D diffusion stability limit D·dt/dx² ≤ ¼; over it the concentrations explode and the run does not seal. It is the first pipeline to fill the receipt's chemical/biological tier — concentration_field + reaction_rate_field, added honestly for it. Endpoint /api/zeq/react, zeq_react MCP tool, react CLI verb. Deterministic. With ZeqReact the ten Life-or-Death pipelines now fill every tier of the ZEQOND receipt with real solver output.

2026-08-08 — five more Life-or-Death field solvers

Five new, independent real-physics pipelines join the Life or Death section — nothing existing changed: ZeqHeat (diffusion, explicit vs Crank–Nicolson, the CFL stability limit), ZeqLorenz (the Lorenz attractor — deterministic chaos with a live Lyapunov exponent and the exact volume-contraction invariant), ZeqWave (wave equation + Maxwell Yee FDTD, the Courant limit), ZeqFlow (incompressible Navier–Stokes, divergence-free by pressure projection), and ZeqFracture (peridynamic cohesive failure — the crack localises at a defect and stress softens to zero). Endpoints /api/zeq/{heat,lorenz,wave,flow,fracture}, matching zeq_* MCP tools and CLI verbs, each sealing the same envelope + receipt. Together the nine pipelines fill every tier of the ZEQOND receipt with real solver output — ZeqFracture fills the material + boundary tier (stress, strain, damage, elasticity, traction, contact) nothing else touches. Each gates on its own honest reality check; a run that fails it does not seal.

2026-08-08 — ZeqAction + the "Life or Death" section

A least-action, high-order symplectic integrator — and a new SDK section for the real-physics pipelines. ZeqAction integrates a Hamiltonian trajectory (Kepler orbit, anharmonic oscillator, pendulum) with a structure-preserving scheme: Störmer-Verlet composed by Yoshida triple-jump to order 4/6/8, fixed dt, integer time + Kahan-compensated state (the nano-zeqond grid applied to the integrator). Energy has no secular drift. It also runs classical RK4 on the same system and returns both, proving the difference: measured on a Kepler orbit, order-8 symplectic energy drift is ~48,000× smaller than RK4's and angular momentum is conserved to machine precision, while RK4's error keeps growing. New endpoint /api/zeq/action, zeq_action MCP tool, action CLI verb. The new Life or Death section groups the real-physics pipelines — solve, multibody, ZeqEvolve, ZeqAction — and shows why the integrator choice decides whether a simulation stays physical. Nothing existing was replaced.

2026-08-08 — ZeqEvolve: molecular dynamics as a sealed endpoint

A new, independent compute pipeline — nothing existing changed. ZeqEvolve promotes the browser Nano-Zeqond Evolver to a real server endpoint: deterministic velocity-Verlet (2nd-order symplectic) molecular dynamics of a Lennard-Jones system (NM19) with optional harmonic bonds (NM30), in the NVE ensemble. Energy and momentum are conserved; the drift |ΔE/E₀|·100 is the ≤0.1% reality check and feeds the same metric gate as /solve and /multibody — a run that fails to conserve does not seal. Reachable at /api/zeq/evolve, via the zeq_evolve MCP tool, and the evolve CLI verb; it seals the same envelope + ZEQOND receipt, filling four real fields (temperature, internal energy, momentum density, virial pressure). Deterministic by construction — seeded, so identical inputs reproduce the exact trajectory and proof. Verified live: crystal/liquid/gas/polymer all conserve energy to 0.006–0.04%. Next: the least-action high-order integrator, ZeqAction.

2026-08-08 — the ZEQOND_RECEIPT ships in the payload, on every surface

You now get the receipt back with the answer. The ZEQOND_RECEIPT — the Zeqond-averaged standard-physics value plus the continuum state fields a computation actually produced — is returned in the response body of /api/zeq/compute, /api/zeq/solve and /api/zeq/multibody (fields zeqond_receipt + zeqond_averaged). Previously it was stored only server-side for the envelope and detail pages; API callers could not see it. It is now also in the MCP structuredContent (and text summary) for zeq_compute, zeq_solve and zeq_multibody, printed on the CLI result card, and passed straight through by the Python SDK. Same object everywhere — the endpoint, the certificate and the record agree. Honest as ever: a field appears only when the compute produced it; an ambiguous unit (J, bare m) carries none rather than mislabel. New reference page: The ZEQOND_RECEIPT.

2026-08-08 — RK4 is integrated, not lesser · the ZEQOND receipt · the certificate

Integrated is not lesser than solved. A result from zeq_solve / zeq_multibody (RK4 integration of the HULYAS master field) is first-class. It passes the IDENTICAL ≤0.1% tolerance gate as any closed-form value — if the tensioner is not satisfied inside 0.1% the route returns no value at all (a 422, nothing sealed). The method differs; the tolerance does not. Envelopes and the model now say "integrated rather than solved in closed form, verified to the same tolerance either way" instead of framing it as a deficiency, and the observer/envelope no longer mislabel an RK4 compute as an idle "frame tick".

Determinism, precisely. Identical operators + inputs yield an identical result, bit-for-bit (e.g. KO42·NM21 gravity → 8670.9391 N, every time). Each envelope stamps that result at its own Zeqond, so re-running mints a fresh envelope with the same result and a new timestamp — the proof binds the result to when it was computed. Verified across a 100+ experiment battery: every one sealed, verified, KO42-first, ≤0.1%.

The ZEQOND receipt. Every envelope now carries a receipt: the pulse (1.287 Hz), the Zeqond (0.777000777 s), an HMAC verification, the Zeqond-averaged standard-physics value (R(t) averaged over one Zeqond recovers S(t)), and the continuum state fields the experiment ACTUALLY computed — mapped from the result's own unit (Pa → pressure, m/s → velocity, V → potential, T → magnetic B, kg·m/s → momentum, K → temperature …). Honest by construction: ambiguous units (a bare J or m) map to nothing rather than mislabel, and no field is ever fabricated — "the receipt attests only what was computed".

The envelope is a certificate; the state record is its ledger entry. The envelope page reads as a proof-of-compute certificate (value, funding split, minted date, name/note, proof, receipt); the tick-detail page is that same computation's record on the entangled state — decluttered so it shows only what the row actually carries, with the raw JSON tucked behind a toggle. The offline verifier now embeds all 14 node signing keys, so any domain's envelope verifies its Ed25519 signature with no network.

2026-08-08 — Envelopes: individual send stays, and folders arrive

Two things. First, sending an envelope is not only bulk: you can send one (the per-coin Send), send a hand-picked set (tick them → Send selected), or send many at random by count. The bulk field never replaced the individual move — all three live side by side.

Second, a wallet of tens of thousands is now organisable into folders, the way computes and contracts already fold. Every envelope carries a user-editable folder; name one and the coin lives there. Folder chips across the top filter the list (All / Unfiled / each folder with its count), each row has a 📁 Folder action, and the multi-select bar can Move to folder a whole ticked set — soulbound proofs included, because filing is organisation, not a transfer. New endpoints: GET /api/tally/envelopes/:zid/folders (folders + counts) and POST /api/tally/envelopes/folder ({ folder, token_ids | count, from_folder?, q? }, no cap); the list endpoint takes ?folder=. Backed by a new indexed tally_tokens.folder column.

2026-08-07 — Envelopes gets its own home: a standalone bearer-coin manager

Every compute mints a unique ZEQ envelope — a proof-of-compute bearer coin you can save as a .ZEQ file, an encrypted QR / NFC tag, hide inside a photo, send to a Zeq ID, or redeem. That capability already existed, but it lived buried in the credits wallet's home list and was capped at showing a handful of coins. On a machine like the Foundation, with 32,000+ envelopes, it was unusable.

It now has its own page: /vault/envelopes/. A standalone manager in the same DNA as the rest of the surface — searchable and paginated, so any number of envelopes is browsable (search by token id, zeqond, or hash). Every bearer action is the exact, already-proven code, lifted into a shared module (/js/zeq-bearer.js) so the wallet and the manager run the same thing.

Reachable from three places: an Envelopes tab in the Vault, a link in the credits wallet, and — because the two are combined — every envelope id in the entangled-state observer now links straight to it, as does the "move this coin" action on each envelope's proof page.

Honest about what can move: free-funded envelopes are soulbound (their value backs the Foundation), so they show as such with no bearer action — only paid-funded coins you actually own offer save / QR / send.

Backend. GET /api/tally/envelopes/:zid no longer caps results — it takes ?limit, ?offset, and ?q (token-id search) and returns a real total, so the manager pages through the full set instead of the newest handful.

Send many at once. A new POST /api/tally/envelopes/transfer-bulk { to, count } moves count of your movable coins — picked at random — to a Zeq ID in one request. There is no cap: "send 20,000" is one click, not 20,000 requests. It reassigns them in a single guarded statement (FOR UPDATE SKIP LOCKED), so only movable coins move and soulbound proofs are never touched; value is conserved. Pass token_ids:[…] instead of count to move an exact set. The manager has a "Send many at once" field for it.

2026-08-04 — /tally/tally.js is gone, and two auth tests now watch the right file

GET /tally/tally.js returned 54 KB with a 200. No page loaded it. /tally/ is a redirect stub to /vault/credits/, and the script the credits page actually runs is /vault/credits/tally.js. The retired file was the old in-wallet block explorer and PoHC demo — removed from the product on purpose because, as the credits page records in its own markup, "it read dead endpoints and carried unverifiable claims" — but left on disk and still served.

It is deleted. If you had that URL bookmarked it now returns 404; the live script is /vault/credits/tally.js.

The part worth reading. Two tests were asserting the browser auth contract — that a user with a valid cookie but cleared localStorage must not be shown a false "Sign in" gate — against that dead file. They were green and guarding nothing. Checked before repointing them: the live script satisfies every one of those assertions too, so no user was ever affected. That was luck, not coverage.

Both tests now resolve the script path from the <script src> the credits page declares, so they follow the live file or fail loudly, and a negative control proves the resolver cannot silently succeed when the tag is absent.

2026-08-03 — zeqondSec was two different numbers

Asked at the same moment, on the same fleet:

GET /api/kernel             zeqondSec  = 0.777000777
GET /api/zeq/sdk/metadata   zeqondSec  = 0.777

Same field name, 2,298 Zeqonds apart. The rounded value is light by one part per million, which is nothing across a duration — under one Zeqond over a whole day — and becomes thousands the moment you convert an absolute count, because the error multiplies by the ~2.3 billion Zeqonds since the Unix epoch.

/api/zeq/sdk/metadata is corrected. Its block is called constants, on the endpoint an SDK reads to configure itself, and a thing named constants exists to be computed with. It now serves the exact period, plus zeqondNs (the integer nanosecond count — no float, no rounding, correct in a language with a single number type) and zeqondSecDisplay for anyone who wanted the label. /api/kernel has served the exact value all along, so nothing could have depended on zeqondSec being 0.777.

Display surfaces keep their captions. /api/agents and /api/stats still report 0.777 — a caption on a listing page is allowed to be a caption — and now carry zeqondNs beside it, so an exact period is reachable from every surface that publishes one.

Constants nobody was maintaining. /api/tally/transparency served { hz: 1.287, zeqond_sec: 0.777 } as hand-typed literals, sourced from nothing, free to drift from the kernel with nothing to notice. /api/tally/ health did the same with pulse_hz. And /api/tally/consensus advertised tick_interval_ms: 777 — the interval is 777.000777 ms, so anything scheduling on that number loses a Zeqond every nine days and never learns why it fell out of phase — alongside finality_seconds: 1.554, which is two of the rounded period rather than two of the real one. All now derive from the kernel, so finality can no longer disagree with the period it is two of.

Everything above is either additive or a value that was wrong. Nothing that reads the existing display fields changes.

2026-08-03 — The mesh gossip endpoint now checks who is talking

POST /api/mesh/gossip accepted any handshake, and never checked the signature on the message it was handed.

The endpoint asked for an x-node-handshake header and then, in its own words, accepted any handshake. That is the smaller half. The larger half: gossip has two entrances, and only one was verifying anything. Events arriving over Redis are signature-checked and dropped on mismatch. Events arriving over HTTP went straight into the same store — and forging a signature was never necessary, because omitting it worked.

Gossip is the mesh's consensus layer: shard placement, node discovery, job broadcast, with "earlier Zeqond wins" resolving conflicts. Writing to it unauthenticated means announcing yourself as the holder of somebody else's shards.

Both entrances now enforce the same two checks. A transport handshake proves the peer is a mesh member: HMAC-SHA256 over the sender, a Zeqond, and a digest of the event body, so a captured header cannot be replayed after ~120 Zeqonds or lifted onto a different event. Then the event's own signature is verified before anything is stored, using one shared implementation — the HMAC had been written out three times in three files, and a signer that drifts from its verifier fails silently, because a bad signature looks exactly like an attack.

It fails closed. A node with no mesh secret configured now refuses gossip with 503, where it previously accepted anything.

A health number we were making up. GET /api/mesh/status reported coherenceScore: 0.95 on every node. It was a constant in the source, marked // Simulated, served from a public endpoint while every node reported zero active peers and zero gossip. It now reports the coherence of the last real verification, or null when none has been measured. null is the worse-looking number and the true one. Two honestly-named fields join it: recentGossipCount (what lastGossip has always actually been — a count, not a timestamp) and lastGossipZeqond (what the name implied, which nobody was serving).

Nothing that reads the existing fields breaks: lastGossip keeps its name and meaning, and MISSING_HANDSHAKE is still the code for a missing header.

2026-08-03 — The public ledger, and a clock you can compute with

Two things that had never worked, and one number we were getting wrong.

The public ledger was empty, always. GET /api/tally/record lists computations whose owners chose to publish them. It has returned an empty list since the day it was built — on every node — while the transparency endpoint beside it happily reported dozens of live wallets.

The setting existed. /api/tally/settings/publish-default saved your choice, and one endpoint would read it back to you. Nothing else ever looked at it. So you could switch "publish my economy publicly" on, watch it save, and nothing would happen — which is why nobody had it on.

The mint now reads it. Your receipts stay private unless you choose otherwise, and if that choice cannot be read for any reason they stay private then too: publishing is not something to guess at, because a receipt that has been served publicly cannot be un-served. Worth saying plainly what a published receipt contains — digests, the operator chain, credit amounts. Never your inputs, never your results. Those are not in that table at all.

A clock you can compute with. /api/tally/clock told you the Zeqond period was 0.777 seconds. The real period is 777,000,777 nanoseconds. The difference is one part per million, which sounds like nothing and mostly is — over a day's duration it is under one Zeqond.

But multiply it by the ~2.3 billion Zeqonds since the Unix epoch and an absolute tick count lands about 2,300 Zeqonds out. If you took the period we published and asked "what Zeqond is it now?", you got a different answer from the one stamped on every envelope and receipt.

The response now carries zeqond_ns: 777000777 — an integer, so no parser, spreadsheet or single-float language can round it wrong — alongside zeqond_sec_exact. The original zeqond_sec and pulse_hz are unchanged, so nothing you have written breaks; use the exact fields for arithmetic and the display ones for labels. The public contracts endpoint gained the same pair.

And the practical rule, since it is easy to get backwards: the rounded period is fine for a duration and wrong for an absolute count. If you are asking what Zeqond it is right now, read it from the API rather than deriving it — the Zeqond is elapsed ticks since a node's genesis, anchored once, and no formula on your side tracks that.

2026-08-03 — The daily claim is 128, once, however you ask for it

Chrome 1.287.59. There were two ways to claim your daily credits, and they granted into two different balances.

Because compute spends the free balance first and the purchased one second, the two are the same money to you — so claiming at both doors gave 256 a day rather than 128. One of the two could also be claimed on top of a full balance, which the other correctly refused.

They are now one grant. Whichever door you use takes the same once-per-day lock, so the second one tells you it is already claimed. The grant always lands in your free credits, where the signup grant lands and where compute draws first; a free grant never touches your purchased balance, because that ledger exists to keep the two apart.

The same rule everywhere. The claim unlocks only once you are down to your last few credits — you top up what you have used rather than stacking a fresh grant on an untouched balance. That rule was enforced at two of the three doors. It is now enforced at all three, in the same words.

And it tells you before charging you. The claim costs a small proof-of-work. Asking you to spend it and only then saying you were not eligible is the kind of thing that reads as a bug even when the refusal is correct, so eligibility is now checked first. If you are not due a claim, you are told immediately and no work is spent. Every surface shows three distinct states — claimable, already claimed today, or unlocks when you are nearly out — rather than collapsing the last two into "claimed".

2026-08-03 — See what your month cost, before anyone is billed for it

Chrome 1.287.58. The compute meter is live and visible.

Every computation on the platform now counts against the account that ran it. That sounds like it was already true; it was not. A users row is created by six different paths and only registration created a matching identity, so an account without one fell through every gate — not charged, not metered, not attributed. Measured across all fourteen nodes: 186 accounts sat in that hole. Every one turned out to be a house demo key, so nothing was lost, but the Stripe checkout webhook creates a row with a working API key and no identity — so the first customer to pay without registering an equation would have landed there too.

House and demo compute is now attributed to the Foundation, which is where the cost actually falls and where free computation has always been published. Everyone else gets a real identity, machine and welcome grant the moment they first compute.

The meter shows, it does not enforce. GET /api/compute/usage returns what you have used, your bundle, what remains and what the overage would be — and it returns enforced: false, which every surface reads rather than hardcoding. Bundle figures so far were derived from cost, never from watching real usage, and refusing customers against an unvalidated number is how you find out it was wrong from a support ticket. So: measure, watch, then enforce.

The daily claim is priced for a shared address again. The claim became 128 a day rather than 128 a month, and the proof-of-work ladder around it still assumed the monthly rate — "even a 500-user office needs 0.7 claims an hour". Daily, that same office needs 21 to 63. The result was that the fifth person behind one router to claim in the same hour was asked for about nineteen minutes of browser work, and the thirteenth was refused outright. Both fell entirely on people doing nothing wrong. Claims now sit at the base difficulty up to 32 an hour from one address before the ladder climbs, and the hourly cap moved from 12 to 64. Farming is still bounded by the things that actually bound it: one claim per machine per day, enforced by the database, and a claim that unlocks only when you are nearly out.

Crypto purchase is hidden for now. Buying credits priced compute about 6,700x above the metered rate. Both prices were live, and a customer who could see both would take the cheaper one. Subscriptions are unaffected.

2026-08-03 (clients) — Your ID is read from the server, not from memory

VS Code 1.287.56 · Chrome 1.287.57. Both extensions displayed the Zeq ID they had cached at sign-in and never checked it again. Since the framework ships a ZID reissue flow, an ID that legitimately changed left every surface showing the old one indefinitely — the VS Code status bar most visibly.

The extensions now ask the server who the token belongs to and adopt the answer. Chrome was already making that call and reading only the status code off it, throwing away the authoritative ID in the response body.

Being offline no longer looks like being signed out: only an explicit valid: false clears a session. A timeout, a 5xx or no network keeps showing the ID you have. Conversely, a revoked token now actually signs you out instead of leaving the ID on screen forever.

2026-08-03 (clients) — Bring any key, including the free ones

VS Code extension 1.287.55. The chat panel asked for an API key, offered three providers, and pinned the model you would talk to. All three are fixed.

The free providers are there now. Google Gemini and Groq are first-class choices, listed first, because both issue a working key in about a minute with no card. Previously the list was Claude / OpenAI / Custom, so a free key was reachable only if you already knew the vendor's base URL.

It tells you where to get one. The same guidance the web surfaces carry, next to the field that asks for the credential rather than somewhere else.

No pinned models. claude-sonnet-4-20250514, gpt-4o and anthropic/claude-sonnet-4-20250514 were written into the panel and into two provider constructors. Leave the model blank and the extension now asks your provider which models your key can actually use, ranks them the same way the API and the bridge do, and remembers the answer. This is the defect that took ai.zeq.me down twice: a pinned model is a name with a shelf life. Existing installs with a blank model heal themselves on next open.

Connecting is no longer fire-and-forget — the dialog stays open until the provider confirms, and shows the reason if it does not, instead of reporting success and failing later.

Chrome extension 1.287.56. No code change. zeq-chrome-latest.zip was serving 1.287.55 while the pinned link served 1.287.56, so "latest" was older than the version the page recommended and was missing the contributed-compute panel. Both files are now the same artifact, byte for byte.

2026-08-01 (network) — Contribute your CPU: staking, without a pool

Lend your CPU to other people's computations and be paid in envelopes. The machinery for this was complete and tested for weeks — mode exclusion, the seat lottery, replication, the Foundation's adjudicating third execution — and had no routes at all. You could not join, stake, or read the rules.

Bond 1,000 envelopes, and keep them. Bonding is not a deposit: the envelopes stay in your vault, owned by you, the whole time. It marks them immovable and records an attestation naming exactly which ones. There is no pool, no escrow, and nothing moves to the Foundation — so releasing is a state change, not a withdrawal.

About 23 days of free-tier computing earns the bond, paying nothing: 128 credits/day at 3 credits a computation is 42.7 envelopes a day, and the welcome grant covers 429 on day one. A sybil farm needs those 23 days per identity, each already behind a proof-of-work.

Five endpoints, one deliberately open:

GET  /api/contribute/policy    no auth — the rules and the arithmetic
GET  /api/contribute/status    your bond, and days remaining if short
POST /api/contribute/bond      bond envelopes you already hold
POST /api/contribute/release   release and leave
POST /api/contribute/mode      idle | contributing | experimenting

/policy needs no account on purpose: nobody should be asked to stake without being able to read the terms first, and an SDK needs the numbers to render a staking screen before sign-in.

Two rules that bite. You cannot contribute and run your own experiments at once — switching preempts your work, which is what stops a machine selling the same cycles twice. And a result proven wrong withholds the whole bond, where proven means the Foundation's independent re-execution disagrees with you and agrees with the challenger; matching neither is not_reproducible and slashes nobody.

New: Vault → Network, and Contributed compute in the SDK docs.

2026-08-01 (cleanup) — Retired facts removed from the surfaces still publishing them

A sweep for the defect that recurred all day: the same quantity living in more than one place, where the copies can disagree. Everything below was live.

The daily limit existed as three tables that disagreed. free was 128 / 100 / 128 and starter 5000 / 1287 / 1287 across three route files, with four different fallback values. Which limit a free account hit depended on which route it reached. All now read one table.

The Zeqond was 0.777 in three places, documented as "exact, 1/f". It is not — 1/1.287 = 0.777000777. The kernel defines it as an integer nanosecond count (777,000,777 ns) and derives f from it, so f × τ_Z = 1 exactly. That identity is what makes sealing on the Zeqond boundary cancel the KO42 energy pump, so approximate was not good enough. /api/protocol/pohc had been publishing the rounded value as fact.

The retired envelope formula was still the public explanation. Pages showed V = cost × (2 − precision/0.001), promising up to 2× — false since this afternoon's 1:1 change. Corrected everywhere, including the five built copies generated from one CLI source.

A public API published a split its own code does not implement. /api/tally/transparency returned paid_funded_user_bps: 8000 — the 80/20 retired 2026-06-30 — while the mint has always been atomic: paid-funded is wholly yours, free-funded wholly the Foundation's, never divided. Now 10000/0.

Nothing here changed how the framework computes. It changed what it says, so that what it says matches what it does.

2026-08-01 (latest) — One price: the envelope face is exactly what you paid

Burn n, mint face n. No spread, no multiplier, no second formula.

Three functions had been pricing the same job. Two of them disagreed by 1.5–3× — and not by a constant, so supply drained at a rate set by whichever operators you happened to use. The third scaled the envelope by achieved precision, cost × (1 + quality), which minted twice the cost for a perfect computation: earn 16 on a cost-8 job, spend it on two cost-8 jobs, earn 32. Supply doubling every cycle with nobody cheating.

calculateComputeCost is now the single price, used for the charge and for the envelope face, on the paid path and the free path alike. A free computation is priced identically to a paid one — same work, differently funded.

Precision did not stop mattering; it stopped being a multiplier. The measured precisionActual still travels on the envelope and still decides whether an envelope is issued at all: outside the 0.1% bound, nothing mints. Quality decides whether you are paid, not how much money exists.

Verified live: a one-operator multibody run is charged 3 credits and mints a face-3 envelope; a three-operator run is charged 6 and mints face 6.

2026-08-01 (later) — Every computation that mints now also burns

Four of the five compute routes issued a bearer envelope against no spend. /api/zeq/compute charged; /solve, /multibody, /lattice and /shift minted and charged nothing. The only brake was the daily call cap, which limits how often you can mint, not what minting costs.

The burn now sits in the shared seal, on the line before the mint, priced with the same function /compute already used — no new economics, just the agreed price applied where it was missing. Three consequences, all deliberate:

• A refused computation is free. ENERGY_NOT_CONSERVED, DID_NOT_CONVERGE and the wizard's VALIDATE all return before the charge is reached. You are never billed for a result the framework will not stand behind.
• A failed charge mints nothing — 402 INSUFFICIENT_BALANCE, naming the price so a client can top up rather than guess.
• A failed seal costs nothing — you get the result without a receipt, rather than paying for a receipt you did not get.

Anonymous callers are unaffected: no wallet to charge, and they already mint to the Foundation.

Known and measured, not yet closed: the burn price and the minted envelope's face value come from two different functions and disagree by 1.5–3×, so the "burnt and reminted" loop does not yet balance exactly. Written up with the numbers and pinned by a test so it cannot drift further unnoticed.

2026-08-01 — Multibody gets a reality check, and it is the right one

/api/zeq/multibody had no conservation check at all. It now has one, and the route refuses rather than receipting a result that violates it.

What is checked. An N-body integration has no closed form to sit a percentage away from, so /solve's errorPct does not apply. The check is conservation: total system energy must not drift more than 0.1 %, the same bound as everywhere else in the framework. The measure is the one the Nano-Zeqond Evolver has always reported live in the browser — |E(t) − E₀| / |E₀| × 100 — finally wired into the API path.

Two paths, one of which has no conservation law. Give every body a real position and you integrate softened Newtonian gravity: conservative, checked, and sealed. Omit positions and you get the master equation, which carries damping, drag and exponential decay — it is dissipative by design, its energy is supposed to fall, and there is no invariant to receipt against. That case now returns conservative: false and says so in words rather than leaving you to work out why an envelope is missing.

New response fields: energyDriftPct, energyDriftBoundPct, conservative, conservationChecked. Refusals return 422 ENERGY_NOT_CONSERVED with the measured drift, the bound, and your dt and t_max.

Built for the ticking case. Drift is O(1) to compute from state the integrator already holds, so a game engine calling this every frame is checked every frame. The seal lands on the Zeqond boundary, and that is arithmetic rather than style: KO42 multiplies the force by 1 + α·sin(2πft), which pumps energy at O(α), and the pump integrates to exactly zero over one whole cycle — which is exactly one Zeqond, since f·τ_Z = 1.287 × 0.777000777 = 1 to one part in 10¹². Measure on the beat and the pump cancels; measure at an arbitrary t and you carry an α-sized residue of 0.13 %, larger than the bound it would be judged against. Tick freely; seal on the beat.

Measured live: a satellite–Earth pair over one Zeqond drifts 1.6 × 10⁻⁸ % and seals; the same integrator at dt = 5 s drifts 1.5 × 10⁹ % and is refused.

The CLI (zeq multibody …) shows drift against bound on the result card, and distinguishes the two reasons a receipt can be absent.

2026-07-31 (later) — The engine stopped guessing what a letter meant

U_g = mgh asked for gravitational potential energy with a mass and a gravity but no height used to return 1.325e-32 J. It bound h to Planck's constant and used it as the height. No warning, a well-formed answer, and a valid signature over a number nobody supplied.

That is the worst thing this system can do. Every other defect announces itself as a refusal or a NaN; this one announced itself as a correct-looking number, and the receipt would have verified perfectly.

It was not one operator. The first use of every ambiguous letter was a collision:

letter	first collision	was bound to
e	r_a = a(1+e) — orbital eccentricity	2.718
g	CS52 block time — a computer-science operator	9.81 m/s²
h	CS51 hits/(hits+misses) — a cache count	6.6e-34
R	L = 4πR²σT⁴ — stellar radius	8.314 J/(mol·K)
F	a = F/m — force	96485 C/mol

An ambiguous letter is now asked for, not assumed. The engine binds it only on positive, syntactic evidence: e raised to a power is Euler's number and can be nothing else; h beside a ν or a λ is Planck's constant. Everything else comes back as a missing input, with the reason stated — "these symbols determine the answer; supplying defaults would fabricate it." π, c, G, ħ, k_B, N_A, m_e and ε_0 are never mistaken for variables and are untouched.

The unit was wrong separately: mgh reported M²·L³·T⁻³ where gravitational PE is M·L²·T⁻². A right value with a wrong receipt is the more dangerous half, because a reader who trusts the label is misled by an answer that checks out. Both now come from one shared rule, so the value and its unit cannot disagree.

What it already signed: nothing. 106 operators were exposed to this. Across 14 nodes and 1,129 envelopes, none names any of them. The fix is forward-only.

Coverage went up — 594 to 595 of 894 (67%) — because asking for a symbol costs nothing once the caller supplies it. What it removes is the case where they didn't.

Alongside it, the parse-failure class went from 22 operators to 7, and 15 of those were never the parser's fault. A proportionality (I ∝ A²) omits its constant deliberately; returning A² would silently set it to 1. ⟹ is an entailment, not arithmetic. RSA's operands exceed double precision, so a floating-point residue would be confidently wrong. E = ħω, \quad p = ħk states two results and answering only the last discards the first. Each now says what it is instead of blaming the engine. The four that were real — a bare √, E^*, \frac{1}2, and a decimal inside a subscript — compute.

And \text{note} no longer becomes three variables named n, o and t.

2026-07-31 — Operators compute their own equations, and a sign error that had been hiding

515 of the 894 unserviced operators now return a value from the equation the registry publishes beside them, up from 212 at the start of the day. Ask for THRUST_TSIOLKOVSKY with I_sp, m_0 and m_f and you get the rocket equation — 6774.19 m/s, checkable against any textbook — because the operator never needed a bespoke solver, it needed its own equation read.

Every gain came from one systematic cause at a time, each found by counting rather than guessing:

Cause	Operators
LaTeX ordering — a pass that needed the backslash ran after one that ate it	~200
Unicode: physics is not always written in LaTeX (8πG/c⁴ T_μν)	36
Juxtaposition across whitespace (γ m c²)	72
\b is the wrong boundary for a command name (\mu_0)	45
Indexed sums Σ, expanded from your numbered inputs	—

New input conventions. A Σ expands from what you supply: Σ p_i ln p_i over three states is p_1, p_2, p_3, and the range is taken from the indices present — Shannon entropy of two equiprobable states returns ln 2. An indefinite integral takes from and to. Bra-ket takes amplitudes: ⟨ψ|φ⟩, ⟨ψ|O|ψ⟩ and the Born rule all resolve from psi_1, psi_2, … and O_11, O_12, …. Definite integrals get real quadrature — ∫₀^∞ x⁶e⁻ˣdx returns 720, which is Γ(7).

Units are derived, never asserted. They come from propagating SI dimensions through the arithmetic, so a moment of inertia comes out M·L² and a centre-of-mass velocity L·T⁻¹ without anyone writing that down. When a symbol carries no known dimension the unit is withheld and the symbol named, rather than guessed — a wrong unit on a verifiable receipt is worse than no unit.

A relation is not an assignment. Δx·Δp ≥ ħ/2 states a bound; returning ħ/2 would assert the product equals it. Inequalities, ≈, limits, asymptotic bounds (O(n log n) is a growth rate), transfer functions, density matrices and state vectors now each refuse as what they are, instead of sharing a message that pointed at the parser. An envelope carries one number, and a density matrix is not one.

The sign error

-x² was being evaluated as (-x)². Unary minus bound tighter than exponentiation, so e^(-x²) computed e^(+x²) — every equation containing -x^n was affected. It survived roughly 1,700 passing tests and was caught the moment one integral was held against a closed form: ∫e^(-x²) returned 1.47e10 where √π was expected.

No envelope attests a value affected by it. Three of 1,612 equations carry the pattern; none was ever served by the generic evaluator; and across all 14 nodes and 1,103 envelopes the only match predates the evaluator by twelve days. That check is now a tool — infra/envelope-exposure.sh — because when a fault is found the question is not "is it fixed" but "what has it already signed".

Nodes now seal what they hold

Each node appends a signed digest to its hash-linked spine every cadence: how many envelopes it holds, a hash over which operators they name, and the registry generation it is serving. Counts you can check against the node's own live answer, on a chain it cannot quietly rewrite.

---

2026-07-30 — Claim your monthly credits, from wherever you already are (Chrome 1.287.55)

Every machine now carries a monthly grant of 128 ZEQ. It is not given — it is claimed, and claiming costs a small proof-of-work priced in the Landauer operator (LZ1 = k_B·T·ln2 × bits). An honest claim takes about a second.

The claim is reachable from every surface you might be standing in:

Surface	Where
Vault	Machines tab, per machine
Credits wallet	/vault/credits/ → Account
Chrome extension	Machine tab → Credits
VS Code	Zeq: Wallet opens the credits wallet

Why a claim and not an automatic top-up. Registration takes two client-generated values and nothing else — no email, no payment — so an identity is free to manufacture. Anything of value hanging directly off a signup is therefore free to farm. Hanging it off a claim means the grant costs something, and the database enforces one claim per machine per calendar month: proof-of-work sets the price, the unique constraint sets the limit. Unclaimed months do not accrue.

Signing up is still free and instant. The first three accounts from an address cost nothing; only the fourth within an hour is priced. Work tuned for compiled code is roughly 90× heavier in a browser, so charging every signup would tax the newcomer and barely inconvenience anyone farming — a household, an office or a classroom passes straight through.

Also in this build: /api/solve and /api/multibody now accept position and referenceMode: "gravity", so real gravitational problems can be expressed over HTTP; solver rejections return 400 with the solver's own message instead of a blank 500; and POST /api/zeq/reverify re-runs a numerical result and returns a signed verdict any stranger can verify with the public key from /api/identity — no account required. For signed closed-form claims, POST /api/attest remains the stricter path.

---

2026-07-28 — Build a shape, not a blank page

Every Zeq application is one of five shapes. Naming the shape decides the structure before a line is written, so that choice is now the first step of building — and the tools know all five.

zeq_scaffold takes an archetype alongside its stack:

zeq_scaffold { app: "my-app", archetype: "provable-record" }

archetype is the shape — the contracts and the triggers. stack is the technology. Naming a shape writes ARCHETYPE.md (what this shape is, what fires it, what lands on the chain, and what you must not build) plus a real contract seed under contracts/, and picks a sensible default stack. Passing stack alone behaves exactly as before.

The five: provable-record (an unforgeable record that X happened) · reproducible-computation (a calculation anyone can re-run and check) · deployable-logic (logic on a trigger leaving a checkable trail) · simulation (continuous integration with drift reported, not hidden) · interactive-agent (a live surface backed by verifiable state).

The same five are contract templates under the Archetypes category, so they are reachable from Zeq Studio's browser and /api/contracts/templates as well as the scaffold. One source, three doors.

An unknown archetype is refused with the near-miss, exactly like an unknown stack. Asking for provable_record tells you it meant provable-record instead of quietly building something else.

The reference architecture is published at /building-on-zeq/ and condensed into every project's ZEQ.md, so the model is the same whether you read it, ask the AI, or open the repo.

New tool — zeq_skills. The skills directory is now browsable: each skill names the physics domains it works in and the input quantities it expects, with units. Use it before pinning operators. Skills are capability templates; zeq_lib_search finds npm/pip packages — different shelves.

2026-07-25 — Two doors, named the same everywhere

Zeq Studio now says plainly which door you are in: Build it myself or Build it with AI. Same two labels, so the choice is visible before you start rather than implied by which page you happened to open.

The AI door is a door, not a requirement. Create, edit, add files, commit with a ZeqProof and deploy to a live URL — none of it touches AI. Templates and Expert in the contracts IDE are likewise AI-free.

2026-07-25 — Contracts inside Zeq Studio, without leaving your code

Studio now has a Contracts button that opens the real State Contracts IDE — SAVED · GENERATE · TEMPLATES · EXPERT, on your own machine — beside the editor instead of in another tab. Templates and Expert need no AI: that is the "build it myself" door, intact.

It is the same application, mounted, not a copy. A contracts panel written specially for Studio would have started drifting from the one everyone already uses immediately, so /apps/contract-ide/ runs in-surface with its own page chrome hidden — one nav, the real app, still perfectly usable standalone.

2026-07-25 — Deploy from VS Code too (extensions 1.287.53 / 1.287.54)

The Studio work closed the loop on the web and immediately left the editors behind, which is the exact drift the cross-surface rule exists to prevent. So Zeq: Deploy this workspace (live URL on your machine) is now a VS Code command: it syncs the folder first — deploying a repo that is behind your editor publishes yesterday's code and looks like a failed deploy — then publishes and offers the live URL and your Observer.

deployRepo() and liveUrl() went into the shared zeq-project-repo.js rather than into the extension, next to ensureRepo and mirrorFile, for the same reason those are there: web, Chrome and VS Code read one file, so they cannot drift on what deploying means or where a published app lands.

VS Code 1.287.53, Chrome 1.287.54, on all four download paths.

2026-07-25 — Zeq Studio: write code on a phone, commit it with a proof

Zeq Studio is a standalone application at /apps/zeq-studio/, listed in the Zeq Store, and the messenger channel mounts it rather than keeping a copy — the same mount-never-rebuild rule the channels follow.

One project, one repo. Creating a project used an endpoint that scaffolds under an org while every commit writes to your ZID account, so a project could exist as two repos of the same name and your edits never reached the scaffolded one. Create and edit now both go through the ZID-owned repo. You can also add files any time — nested paths included — each one a commit with its own ZeqProof.

The code box is now an editor on a phone. One pane at a time (Files / Code / Preview), 16px text so iOS stops zooming the page when you focus it, real horizontal scrolling with a wrap toggle, Tab to indent, Shift+Tab to outdent, Enter that keeps your indent, and autocorrect off — it is code, not prose.

A guard for a bug class that passes every syntax check. Studio rendered as raw text in production because a scaffold template held a whole HTML document in a string: the page server injects its script tags at the first closing body tag in the document, which was the one inside our own JavaScript. scripts/check-inline-scripts.js now fails the commit on that and on literal script open-tags in inline blocks — clean across 284 pages.

Deploy works now — the loop is closed. Write code, commit it with a ZeqProof, press Deploy, and your app is live at /s/<machine>/p/<app>/. No local tooling, on a phone if you want.

Deploy used to answer "no machine bound — sign in to bind, then push again". That advice was correct and impossible to follow: the bind only ever happened when you signed in at ai.zeq.me, so signing in where you actually were changed nothing. Binding is now part of deploying. Your machine key is minted against the machine you already own, from your own session — if you own none, it says so and stops rather than inventing one to make the request look like it worked.

2026-07-25 — The messenger is the ecosystem: every application, mounted, one surface

The rule that fixed it: mount, never rebuild. Hand-made channel panels were replaced by the applications that already exist, running in-surface. The pages are same-origin, so the frame hides the page's own chrome from inside (stripFrameChrome; pages can mark pure-navigation blocks data-embed-hide) — one menu, the real app, the framework untouched and every app still standalone.

• Compute Credits mounts /vault/credits/ — balance, envelopes, transfer, claims, swap, burn ratio, transparency. Not a summary of it: it.
• Contracts mounts /apps/contract-ide/ — Saved · Generate · Templates · Expert. Two of the four paths involve no AI; 316 templates across 45 categories deploy with none. State contracts are not an AI feature.
• State Observer mounts /state/?slug=<yours> — chain-valid rows, the time machine, live balance.
• ZEQ DNS mounts the vault's #names panel.
• Zeq Mail mounts /apps/mail/ — compose, folders, aliases, the user's @zeq.me address, beside their messages.
• The Ecosystem directory — one pinned channel, 35 applications in seven groups with a filter; a row runs the real app in-surface with back and reload. The whole ecosystem reachable without another sidebar row.
• The ID Card is a Zeq ID card — an identity face above the links builder: machine, live-page address (copies in place), .hz names, envelopes split movable / soulbound light proofs, tier, genesis Zeqond, and Verify on my entangled state jumping to the Observer channel in-app. Existing endpoints only. The builder itself is the live Settings node, moved, never cloned — cloning would double-bind ids; the move is restored on every exit path (the guard that skipped restoring on the builder's own channel destroyed the node on re-render — caught by using it, not by the syntax check).

Definition of done changed. A phase is done when it has been deployed, opened in the browser as a signed-in user, exercised, and screenshotted — structural checks alone shipped a channel that rendered a ZID and nothing else. Everything above was verified that way, including the mobile pass at 390×844.

2026-07-24 — Your machine, your observer: owner permissions, two AI contacts, and the framework as channels

A machine's owner is its owner. Permission checks keyed only on the state_machine_admins grants table and ignored the machine's own owner_zid. Any machine whose grant row was never seeded left the owner forbidden on their own machine — a 403 that blocked minting an API key, generating a contract and writing a page. Both gates (requireMinRole, canWrite) now treat the owner as satisfying any role; grants stay additive for everyone else.

Compute is unlimited for the Foundation. The physics waiver read only the Stripe plan string, so a Foundation account on the free plan was metered and — with an empty wallet — every compute failed. A purpose='master' owner is now unconditionally unlimited-physics, independent of plan, so no downgrade or expiry sweep can re-meter it. Read-only and fail-closed.

DeepSeek v4. DeepSeek retired deepseek-chat and deepseek-reasoner at 15:59 UTC on 2026-07-24 and the API now rejects them. Defaults move to deepseek-v4-flash (the direct successor) and deepseek-v4-pro, including the bridge's last-resort fallback — the one that fires exactly when model resolution is already struggling.

Two AI contacts, one process. The messenger AI is now Zeq Learn — compute and teach, no build — alongside a new Zeq Build, which carries the Workbench journey (5 SKILL → 6 PLAN → 7 BUILD) and ships applications start-to-finish onto the user's own ZID. Both reach the same 32-tool machine MCP as the LibreChat surface, so the two stay at parity by construction rather than by discipline. Learn is stripped of the mutating build tools. Replies render Markdown with copy/save code boxes, and Continue now appears only when the model actually hit its token cap.

The framework as channels. Each framework application is a chat: ID Card, Compute Credits, Contracts, State Observer, Builds, Store — grouped into collapsible categories with reorder and hide. They are built natively against the APIs, not iframed: /vault/credits/, /contracts/ and /apps/ each ship their own nav, so embedding them stacked a second menu inside the chat and dragged a desktop layout onto a phone. The exception is a user's own deployed app, which carries no framework chrome and so runs live in the surface, with the sandbox mirroring the grant the app is already served with (omitting allow-pointer-lock would silently break camera control in the sim-3d stack).

Every explorer link is yours. An audit found 54 bare /state/ links across 24 files — nav, footer, landing, auth, vault, apps — all opening the network observer. For a signed-in user that is the wrong destination everywhere. Link binding is now central (one pass on identity, a capture-phase click interceptor and a coalesced MutationObserver), keyed on the live href rather than a marker that went stale on re-render. The last two holdouts traced to the wizard's genesis ticker, which rewrote them back to bare /state/ on every tick.

Sign-in could not complete. The session-expired Continue built its return target from the current URL — correct on an app page, but on /auth/ it wrapped auth inside its own return, nesting one level deeper per click and never reaching the app. Fixed, with protocol-relative targets rejected. The fix then had to be reached: changing a file without bumping its ?v= leaves browsers on the cached copy for an hour, and the cache-bust chain only busts if every link in it is bumped.

The bridge is under version control again. The running zeq-bridge had diverged to 2,124 lines while the repo held 613: roughly 1,500 lines of live code — the repo/scaffold tool surface, provider routing, the zeq-auto resolver — existed only on the VPS disk, with no history and no rollback. Committed verbatim after scanning for credentials; all secrets remain process.env.

2026-07-20 — Zeq Mail: HTML email, local-first file transport, and an agent that mails you a page

HTML email, rendered safely. Inbound mail was losing its HTML at the door: the delivery agent took the text/plain part of a multipart/alternative message and stopped, so for essentially every newsletter and notification the HTML was discarded before it ever reached storage. Both parts are now kept (migration 0036, encrypted with the same scheme as the body).

• The reader renders HTML in an iframe whose sandbox omits both allow-scripts and allow-same-origin, loaded via srcdoc, with a restrictive CSP inside the document. That sandbox is the security guarantee; the sanitiser is a deliberate second layer.
• Remote images are blocked by default — a remote image in mail is a tracker that reports the open, the time and the IP. One tap to show them, and a per-sender always-allow.
• Cards render HTML too, scaled to the email's real 600px canvas so the card is a true thumbnail rather than a zoomed crop.
• Composing takes a pasted fragment or a full page, previews it through the same sandbox the recipient will use, and sends multipart/alternative with a plain-text part derived from the HTML when none was written.

Files are transported, not stored. Attachments now carry a 24-hour expiry. Recipients are registered on send and confirm receipt only after the bytes are written to their own device; once every recipient has confirmed, the server drops its copy. The TTL is the backstop for recipients who never collect, and it is enforced both by a sweeper and on read, so a stalled sweeper can never serve an expired byte.

zeq_mail_html — a new MCP tool. An agent builds an HTML email and delivers it to the caller's own inbox for review and forwarding. It takes no recipient parameter, deliberately: a model-driven tool that can email arbitrary addresses is a spam cannon one prompt-injection away from being someone else's.

Attachment bytes are encrypted at rest. Subjects, bodies, HTML and even attachment filenames were encrypted while the files themselves sat on disk in the clear — the label sealed and the document open. Blobs are now stored as independently-sealed frames (AES-256-GCM, deflate-before-encrypt, skipped when it would grow the data), which is what lets a chunked upload append at all. Download decrypts frame by frame, so a 1 GB attachment is never held in memory, and refuses to serve bytes that fail authentication. Files written before the change remain readable via a magic-header check, so nothing in flight broke across the deploy.

Security fix — mail was accepted for mailboxes that do not exist. Address resolution had a catch-all that returned any 4–64 character local part verbatim as the owner, so mail to made-up-name@zeq.me was stored against a mailbox nobody owns, unbounded, with no bounce to the sender. Format validation alone had the same hole for well-formed but non-existent identities. Delivery now requires a real identity row and fails closed on a lookup error.

2026-07-18 — real solvers everywhere, and a numerical fallback that says so

33 dedicated solvers, and no operator left inventing. This pass closed the gap between the 1,606-operator catalogue and the engine that answers for it.

• +80 new closed-form operators across 8 domains — condensed matter (Fermi–Dirac, σ = neμ, Hall, BCS gap/Tc, Josephson), astronomy (Kepler III, Schwarzschild mass, Hubble, redshift, L = 4πR²σT⁴), signal processing (SNR, Nyquist, windows), control theory (overshoot, rise/settling, gain/phase margin), network science, finance, computational + statistics (Amdahl, Shannon capacity, Fitts, Bayes, binomial, normal PDF), neuroscience, and cryptography. 264 operator IDs now compute a closed form; every value checked against textbook references and live via the public HTTP path.
• The ODE master-equation fallback. Where no closed form matches, solveGeneric now integrates the HULYAS master equation (RK4) and returns a real, deterministic value instead of a bare NaN — transparently disclosed with a NUMERICAL FALLBACK note so it is never mistaken for the operator's own physics. Dedicated closed forms are never overridden.
• 100% honesty net. A neutral audit of all 1,600+ operators finds every one either computes a real value (closed form or ODE fallback) or names exactly what it needs (a series, a graph, a field, the right input) — or refuses an unknown operator ID. None fabricate.
• Docs corrected. The solvers and the honesty contract now describe the fallback and refusal behaviour; the coverage map reads 51 dedicated / 2 aliased / 11 generic / 1 mismatch. Stale counts (18 solvers, 1,576 operators) refreshed to 33 solvers / 1,600+ operators across every page and served surface.

2026-07-17 — the machine stops inventing

Breaking, and deliberate. A missing required input used to be replaced by a silent default. GR37 with no mass returned 2970.4641 m — that is 2G·(2e30)/c² — with a valid zeqProof attached. The proof was not lying; it simply was not proof of what a reader assumes.

Now the machine refuses:

{ "value": null,
  "inputError": { "code": "MISSING_INPUT",
                  "message": "missing required input \"M\" (accepted: M, mass)",
                  "missing": "M", "accepts": "M, mass" } }

• 51 silent defaults removed across 19 solvers. Intent is now explicit at every read site (req / std / opt), so a signature is extractable rather than inferred.
• assumed — when a standard condition IS used (g, room temperature, 1 atm, electron mass), it is declared back to you. QM9 with only a velocity returns an electron's wavelength; now it says so.
• safe() no longer launders failures into zeros. A non-finite result used to return 0 J / 0 N / 0 Pa with a proof. A fabricated number invites doubt; a 0 reads as a measurement.
• Steps 4 and 5 of the envelope report degraded on a refusal instead of ok.

Migrating: value may be null — guard arithmetic on it. Check inputError first (it names the missing quantity and every alias). Check assumed — if it is present, the number rests on a condition you did not state. HTTP stays 200; a refusal is an answer about your question, not a failure of the machine.

See The honesty contract.

Also shipped

• POST /api/zeq/operator-spec (no key) — which inputs an operator takes: required / conditional / assumed / optional, with every alias. Call it instead of guessing a key name.
• POST /api/zeq/lib-search (no key) — 208 curated libraries across 44 categories, one merged catalogue. (The old panel copy said "71 across 16": wrong by ~3x, because a hardcoded count is a promise nobody keeps. Counts are now derived from the data.)
• GET /api/zeq/harness — what a node offers, and honestly what it does not.
• ZeqGit at zeqgit.zeq.me — one canonical host. /zeqgit/ also now resolves on every node (it was on 5 of 15). Scaffold returns the repo link beside the app URL; editing a file in the web editor redeploys in ~3 s, no button.
• Two conformance vectors corrected. OP-snell-glass and PP-cyclotron-e each certified a value computed from an input they never supplied. Both golden VALUES are unchanged — they were correct physics for the defaults; only the stated inputs were wrong. corpus_sha256 moves; registry_version does not. Nobody is re-certified.
• registry_drift on /api/zeq/conformance — a corpus stamped for a different registry is now flagged, not merely reported.

The kernel

The ZeqVM compute kernel runs on the HulyaPulse timebase (1.287 Hz, Zeqond period 0.777 s) with the KO42 metric tensioner applied to every computation and a ≤0.1% precision bound. Named operators return a signed ZeqProof envelope (operator sequence, master-sum, R(t), phase, Zeqond tick, proof, precision bound) that round-trips through zeq_verify.

The canonical ko42Modulation.ts lands the 1.287 Hz in computation three honest ways: gauge (exact time reparametrization, physics-preserving, gauge-invariant to float epsilon), drive (explicit Mathieu/Floquet — resonance at n·0.6435 Hz, μ=εω₀/4 measured to 96% of theory), and probe (a lock-in residual estimator). Parametric drive is wired opt-in into the nano-zeqond engine (driveEps, default 0). See The mathematics → KO42 and precision ladder.

Operators

A catalogue of 1,500+ operators across quantum mechanics, Newtonian mechanics, general relativity, computer science, and more, with 18 closed-form solvers for the core physics domains. Each operator page shows its formula and a runnable example.

The dimensional gate keys each solver to a sufficient input combo that determines its primary output: an insufficient subset returns 400 with the combo list in the message, so a query never answers from filled-in defaults. The gate mirrors the dispatch shortcuts verbatim ({n_e}→PLASMA; {d,θ}/{λ,θ}/{a,h,k,l}→CRYSTAL with a as the lattice constant [L]; ENV/GEO/SEIS→FD, CLIM/ATMOS→TD, exotic→SM, MS/ST/MT/CP/BP→STRUCT, CRYSTAL variants), so every domain runs VALIDATE.

State machines, contracts, and channels

Every account gets its own ZeqVM state machine bound to its ZID, with a hash-linked entangled-state audit log. The /api/state/* surface exposes a unique machine, an owner ZID, a genesis Zeqond, a hash-linked audit log, a 1:1-bound zsm_ API key, a viewer/operator/admin/owner role hierarchy, and public-or-private visibility with a public registry at /api/state/aggregate/list. Spin-up is one POST and auto-mints a default zsm_ admin key returned once.

Author state contracts — deployable JSON programs that run on triggers (every Zeqond, cron, on-event, on-aggregate, with dry-run and replay), each transition ZeqProof-anchored. Deploy from 316 built-in templates by templateId, no LLM key required; each is an operator-grounded 4-state monitor (nominal → watch → alert → resolved) with arithmetic guard conditions and a ZeqProof per transition. zeq_solve accepts strict: true (+ optional maxIterations, 1–40) to tighten the precision bound toward ≤0.1% and reports tuneStatus: "converged" or "timeout" truthfully.

Host live pages on your machine with state channels at /s/<machine>/p/<page>/. Every byte commit and every serve is hash-recorded on the entangled state under a strict sandbox CSP.

Concept pages: State machines, Contracts, Hosting.

Audit entangled state + PoHC

Every event lands in a hash-linked audit log that validates against itself at any time:

curl __ZEQ_BASE_URL__/api/state/:slug/pohc/validate

Each row commits the hash of the payload, never the bytes: the framework proves what was claimed at Zeqond N and you keep the bytes. To opt into server-side bytes, wrap the payload in a HITE-sealed envelope and the audit row carries transitionType: "sealed_event". The PoHC protocol surface (/api/protocol/pohc/*) exposes the 5-layer Proof of Harmonic Convergence: pulse-attestation, phase-agreement, hash-linkage, operator-coverage, and energy-record.

Nano-Zeqond engine

A local, pulse-locked compute that integrates a differential master equation at sub-zeqond resolution and prints a signed state every 0.777 s zeqond, with energy drift held inside KO42 ≤0.1% and reported live. Three interchangeable engines share one clock:

• Field ϕ (ZeqNanoEvolver) — the HULYAS master-equation core □ϕ = ∇²ϕ − μ²ϕ − λϕ³ as a differential field. Drift ≤0.026%.
• Molecular dynamics (ZeqMdEngine) — velocity-Verlet F=ma under Lennard-Jones + harmonic bonds, NVE; energy and momentum conserved, drift ≤0.064%, LJ verified to machine precision.
• GPU deep-nano (ZeqGpuField) — the master-equation field as a 2-D grid stepped in parallel on WebGL2: 9.4×10⁹ cell-updates/second, matching the CPU reference to float precision (3.3×10⁻⁷), drift 0.0077%, with automatic CPU fallback.

The evolver offers opt-in integrator: 'yoshida4' (4th-order symplectic composition — 501× lower truncation error at 1.4× cost, convergence order 4.00) and opt-in precision: 'dd' (double-double ≈106-bit state for long-horizon or chaotic research, 19.8× cost, agreeing with f64 at 3.5e-15 over 1000 steps). The energy record is Kahan-compensated in all modes. See State Contracts → Nano-Zeqond Engine.

Tally tokens

A receipt is minted on every successful contract transition — transferable, burnable, queryable. It is the framework's economy. The per-state-machine surface is /api/state/:slug/tally/* and the protocol-level surface is /api/tally/*. Every paid framework action calls chargeForCompute() atomically before doing work; compute consumes fuel and the Foundation is funded by envelope mints. See ZEQ economy.

bearer envelope

ZEQ envelope envelopes are portable bearer instruments. Any envelope can be exported to a PIN-locked .ZEQ file or a QR / NFC payload, moved fully offline, and redeemed on any domain — burn-on-origin / mint-on-destination keeps exactly one live copy (single-spend settled by the record).

• Vault (/vault/credits/) — per-envelope Download .ZEQ and QR / NFC, plus Upload / redeem and Paste QR / NFC, behind a masked-PIN modal. Envelopes are HiteCrypto-encrypted; a scanned code is useless without the PIN.
• Claim links (/claim) — the QR / NFC encodes a normal-looking URL with the envelope in the #fragment, so it scans like any link and opens a claim page — yet the envelope never reaches the server until redeemed. PIN-locked end-to-end.
• Unified mesh vault — signing in on any domain shows every envelope you own across the mesh, tagged by home state (Ed25519-signed peer fan-out).
• Web CLI — zeq.envelope.qr(ZT-…,PIN) and zeq.envelope.paste(zeqcoin:v2:…|link,PIN).

Clients

Hosted REST API, language SDK clients (TypeScript, Python, Go, Rust, Java, Ruby, Swift, Kotlin, C++, plus raw HTTP), a terminal CLI and native binary, an MCP server (connect any MCP-compatible AI, exposing the current 18-tool set as a thin stdio→/api/mcp bridge), and the Kernel Skill for LLM agents.

• Zeq for VS Code — a full ZeqVM client built around the Control Center dashboard: every capability is a clickable card, AI-optional. Deploy state contracts from templates or from a plain-English description (POST /api/contracts/generate), see the CKO envelope (operator chips with KO42 first, Master Sum, R(t), phase, Zeqond tick, ZeqProof, precisionBound gauge), browse the full operator registry and the skills packs, scaffold libraries into your folder via npm · pip · cargo · go, read the SDK in an in-editor browser tab, and watch the Live Observer tick every Zeqond. See Editor & Browser → Zeq for VS Code. Your open folder becomes its own ZeqGit repo, and Zeq: Sync workspace to ZeqGit mirrors it as ZeqProof-anchored commits.
• Zeq for Chrome — the browser side panel hosts the live Workbench, the ZeqGit dashboard, and the Observer in-panel (?embed=1), with the CKO envelope widget, compute-appends-to-chain, and page security checks. See Editor & Browser → Zeq for Chrome.

Both clients are listed in the App Store (Developer category) and have a dedicated Extensions install page. The MCP server is installable from the framework's own npm registry: npm config set @zeq:registry https://zeqsdk.com/registry && npm install -g @zeq/mcp, then run zeq-mcp. All three @zeq packages (sdk, mcp, audit-daemon) resolve from that registry on every fork.

MCP tools

zeq_spin_up provisions the caller's own ZeqVM state machine and mints a real, active free-tier zeq_ak_ key, returning the recovery equation and key once; it is authenticated with a demo key (POST /api/demo-key/mint, free, no signup). The demo-key mint is priced in entropy via LZ1 = k_B · T · ln(2) × bits_erased: the first demo key per IP/hour is free, each additional one demands an escalating proof-of-work (18 → 21 → 24 → 26 leading-zero bits), capped at 30/hour/IP. Contracts are tools too: zeq_contract_templates, zeq_contract_deploy (by templateId with no LLM key, or a full definition), zeq_contract_list / zeq_contract_get / zeq_contract_fire, and zeq_contract_generate. zeq_publish_page publishes a live HTML app to /s/<machine>/p/<page>/ and zeq_observer reads the entangled-state proof-of-computation feed. zeq_compute signs a ZeqProof (value + unit) and returns structuredContent with full verify inputs, so zeq_verify round-trips.

ZeqGit

A self-hosted git + PDF repository, ZeqGit, live at zeq.dev/zeqgit and listed in the Zeq Store.

• One account, one ZeqGit. Signing in to the framework auto-provisions your ZeqGit account via single sign-on — one ZID, no second login. The ZeqGit bridge validates the framework's v3 session token via POST /api/zeq-auth/verify-v3, accepting the token from the zeq_auth_token cookie, an Authorization: Bearer header, or ?token=. Guests hitting any /zeqgit/... page are redirected to the Zeq dashboard.
• Every project a repo, every file versioned. Projects create private repos through the bridge (commits authored as you via Sudo); the full Gitea UI lives at /zeqgit/<you>/<repo>. A single shared module, shared/zeq-project-repo.js, holds the naming/ID/endpoint logic and is vendored into both extensions, so every surface derives the same repo from the same input (repoName = slug(name) + "-" + id, a rename-proof content hash).
• PDFs viewable inline — the Zeq-branded ZeqReader (pdf.js) renders PDFs and docs in place; Git LFS for large binaries; permissions enforced by Gitea.
• Every commit anchored with a ZeqProof (HMAC-SHA256(operator | result | zeqond)) on a hash-linked sequence at 1.287 Hz, fed by a push webhook and exposed via /zeqgit-bridge/repo/activity.
• Secrets are server-side and locked down — no .env — and the service runs isolated in its own containers.

Identity & economy

One ZID = one account = one state machine. Every compute a user issues — wizard, prove, mail, message, playground, app dev, contract transition — is attributed to one of the user's two keys: the account zeq_ak_* for compute and the state-machine zsm_* for entangled-state writes. Public read endpoints remain reachable without auth when the machine is flagged is_public=true.

Bring-your-own-key (BYOK) covers 8 LLM providers (OpenAI, Anthropic, DeepSeek, Ollama, OpenRouter, Together, Groq, Fireworks) via /api/zeq/llm/credentials/*, account-scoped and AES-256-GCM-encrypted with ZEQ_FIELD_KEY, prefix-only after creation. The Transparency Oracle writes a per-Zeqond network supply snapshot (network_snapshots) and exposes /api/transparency/{now,history,breakdown,revenue} publicly. A ZEQ balance rides each machine, and a free demo key (POST /api/demo-key/mint) gives a no-signup first run.

Useful links

• Spin up your first state machine — start here.
• State machines concept — the noun, in detail.
• Contracts concept — operator-triggered state machines.
• Tally tokens concept — the receipt.
• Hosting — spin-up-as-webapp.
• Examples gallery — runnable patterns.
• API reference — every public route.

---

Middleware active. Kernel on the 1.287 Hz HulyaPulse. Awaiting next Zeqond.

2026-08-01 — envelope verification, genesis bring-up, and complexity-weighted value

The envelope hash link had no verifier. computeEnvelopeHash had exactly one caller — the mint. Both public surfaces recomputed the v1 preimage, so every envelope minted since 2026-07-30 was reported as Hash-link BROKEN. The mint was correct throughout; the verifier was wrong. POST /api/chain/:slug/tally/verify now accepts engine_version, precision_actual and precision_bound and returns generation (v3 / v1 / pre_genesis) with a detail string. Pre-v3 envelopes report pre_genesis rather than "broken" — they are sound receipts of an older generation. The token endpoint now returns the precision pair, which it previously could not, making offline verification possible for the first time.

A node built from a clean checkout could not mint. infra/postpush.sql did not exist while sovereign.sh copied and ran it with output redirected, so it failed silently on every bring-up; the drizzle-push path never runs app/lib/db/migrations/. Eight tally_tokens columns named in the mint INSERT were therefore absent on a fresh node. The file now exists and is idempotent, the bring-up aborts instead of continuing, and the preboot gate checks the columns.

Free-compute envelope value now scales with the work. It was a flat 1 or 2 credits regardless of complexity, while the paid path used the real complexity-weighted charge — so across live data an 18-unit computation was worth less than a 6-unit one. Cost is now round(units(job) / units(["KO42"])), measured in the smallest legal computation. A minimal job is unchanged; heavier work scales from it; total supply over the live mix is unchanged at 0.99×.

POST /api/tally/envelopes/transfer-claim now enforces movable and locked_for_vote, matching every other path that moves a coin.