Every number, and the query that made it

Each figure on the home page links here. What follows is the constant this build handed to the driver — not a description of it — and, under each, the one way the number could be over-read.

The substantive refusal rate on the bench

The mirror visits a public repository once, replays its recent commits through the gate and appends one row. Both boxes' rows are concatenated into one file by the sync:

ls /root/fiend/fiend.w*.jsonl /root/fiend/peer/fiend.w*.jsonl   # this box's rows, and the peer's

The site reads that file and takes six numbers out of each benched row. Nothing else in the row — the repository's name, its hash, its languages, the sentence explaining a decline — is read at all:

cat /root/fiend/fiend.w*.jsonl /root/fiend/peer/fiend.w*.jsonl \
  | jq -s '[.[] | select(.kind=="repo" and .schema==2 and .outcome=="benched")]
     | {repositories: length,
        commits: (map(.aggregates.commits) | add),
        refused: (map(.aggregates.refused_counted) | add)}'

answer: 45.2% · 19781 of 43773 replayed commits across 2388 public repositories · excludes prereg_parser and no_stamps, which refused 68748 more · 95% CI 44.7–45.7%

what it does not say: that the launch bench is boring. Plan §3 gate 4 asks for twenty public repositories, each R1=R2 with a green or honestly-labelled verify — a different list, chosen by shape, none of it boring yet. It also does not say that prereg_parser and no_stamps never fired: they fired on 68748 commits and are excluded on purpose, because neither is about the change. They measure when the gate arrived.

Errors hidden silently — scanner hits of one rule

The same rows the rate comes from, one field further in. The scanner counts its own rule hits on the staged bytes of each replayed commit, and the mirror sums them per repository:

cat /root/fiend/fiend.w*.jsonl /root/fiend/peer/fiend.w*.jsonl \
  | jq -s '[.[] | select(.kind=="repo" and .schema==2 and .outcome=="benched")]
     | map(.aggregates.by_class["silent-catch"] // 0) | add'

answer: 214,724 hits · scanner hits of the silent-catch rule, across 43,773 replayed commits in 2,388 public repositories — hits, not defects · precision UNMEASURED — no hit has been hand-checked, so how many are real is unknown

what it does not say: that this many errors are being hidden. A hit is a place a rule fired, and the share of hits that are real is the rule's precision — which means reading hits by hand and ruling each one. Nobody has done that for this class, so the figure says UNMEASURED on its own interval line rather than under it. A high hit count with an unmeasured precision is a question, not a finding.

Escapes per landed commit, after the gate

The numerator — defects found only after they were deployed, excluding the rows backfilled from before the gate existed:

SELECT COUNT(*) AS escapes,
        SUM(CASE WHEN backfill = 0 THEN 1 ELSE 0 END) AS after_gate,
        SUM(CASE WHEN backfill = 1 THEN 1 ELSE 0 END) AS before_gate,
        MAX(occurred_on) AS last_day
   FROM defects WHERE caught_when = 'after-deploy' AND prevented = 0

The denominator — commits that actually landed through the wrap, counted from this repository's own ledger:

jq -r 'select(.verdict) | .verdict' .harness/ledger.jsonl | sort | uniq -c

answer: 0.23 escapes per landed commit · 32 escapes over 142 commits that landed through the wrap; the pre-gate rate has no denominator on the record · 95% CI 0.15–0.32 per commit (Byar)

what it does not say: what the rate was before the gate. That arm is UNMEASURED and cannot be faked by replaying this repository's recent history, because the gate already decided those commits — it would be measuring the gate against itself. A real counterfactual needs commits from before it existed, and no such replay is on the record.

The model bill

Find the last billed call rather than assuming the date — an empty table and a broken writer both return zero to a query that assumes it:

SELECT MAX(createdAt) AS last, COUNT(*) AS n FROM vendor_usage

Then sum everything after it:

SELECT COUNT(*) AS n, COALESCE(SUM(costMicros), 0) AS micros FROM vendor_usage WHERE createdAt > ?

answer: $0.00 · 0 billed calls in the 47 days since 2026-08-05 (EDT); 14,239 rows before it · exact — a sum over every row in the table, not a sample

what it does not say: that no model ran. Models run here every day; they run on hardware we own, and what is zero is the invoice. The table meters paid vendor calls, so a paid call made by something that does not write to this table would not appear — the counter-check is that the row count has not moved at all since the date above.

The refused release

The release table travels inside an accepted bundle; the site reads the refusals out of it field by field:

SELECT bundle_hash, bundle, received_at, repo_hash FROM claims
      WHERE accepted = 1 AND bundle IS NOT NULL ORDER BY id DESC

answer: tag=v0.2.0 · commit=d04cd86ce2eb · npm_ci_exit=0 · typecheck_exit=2 · suite_exit=1 · dry_verdict=refused · received=2026-09-18 (EDT)

what it does not say: that the tag was never released. A refusal is about a tree at an instant: the driver refused this one off-box on its own exit codes, the tag stayed on the record as the one that failed, and the work continued. What matters is that the refusal is still here to be read.

The Windows card

The platform card arrives inside the same bundle shape and is projected to its named fields:

SELECT bundle_hash, bundle, received_at, repo_hash FROM claims
      WHERE accepted = 1 AND bundle IS NOT NULL ORDER BY id DESC

answer: platform=win32 · link_mode=junction · probes=spawn=ok · wrapper=0.3.3 · received=2026-09-20 (EDT)

what it does not say: that the suite is green on Windows. That run happened in the package's own repository and belongs to that lane's record, not this one. This row says a Windows desk installed, probed itself, and reported home — nothing more.

The first customer-side loss row

The oldest escaped defect carrying a loss kind. The cure commit is deliberately not selected: it is an identifier inside somebody else's tree.

SELECT id, repo, `class`, loss_kind, time_to_cure_min, blast, occurred_on, caught_by, source
       FROM defects
      WHERE caught_when = 'after-deploy' AND prevented = 0 AND loss_kind IS NOT NULL
      ORDER BY occurred_on ASC, id ASC LIMIT 1

answer: id=3911 · repo=a customer repository · class=wrong-scope · loss_kind=outage · time_to_cure_min=60 · blast=1 customer, deploy pipeline · occurred_on=2026-09-19 · caught_by=human

what it does not say: how much it cost. Time-to-cure is sixty minutes because that is what was filed; severity, blast radius in dollars and the cure's own hash are not columns anybody has filled, and deriving a severity from a defect class would be an opinion filed as a fact.

What leaves a machine

Print the exact bytes before any of them move:

gro-nass report --show

answer: the bundle a reader can read in full before it is sent, and turn off with `gro-nass report --off`.

what it does not say: that this site can prove what your copy sends. It can only show you the command that does, on your own machine, against your own bytes.