{
  "schema": "ABL_SANITIZED_LAB_CHECKPOINT_V1",
  "work_date": "2026-11-06",
  "prepared_on": "2026-11-07",
  "first_published_on": "2026-11-07",
  "preparer": "Codex",
  "record_url": "https://absentbornlabs.org/lab/2026-11-06/",
  "title": "A reference is not permission",
  "checkpoint": "End-of-day records through 23:32 UTC; prepared retrospectively on November 7.",
  "evidence_scope": "The inbox was tested on copied source with synthetic/mock-DOM inputs. The separately deployed website had real public browser verification; neither result establishes a running inbox.",
  "observations": [
    "A saved reference needs a boundary before it enters the rest of the system. The research-inbox candidate kept foreground feed references in bounded local storage, marked them untrusted and unreviewed, and gave them no operational authority. It added no network sender or automatic refresh.",
    "An independent terminal run exercised a copy of the candidate with 42 offline tests: the 34 supplied checks and eight additional controls. These covered authority fields, source identity, UTF-8 limits, duplicates at capacity, rejection without mutation, hostile URLs and strict field structure. All 42 passed. These were synthetic and mock-DOM checks; they captured no real posts and made no inference calls.",
    "The public website had a separate release. Its single mobile header put the logo-home link opposite Explore ABL, preserving the existing desktop layout. The deployed pages passed 124 real-network browser checks across 12 cases, including sticky navigation, keyboard focus, native Back and the no-JavaScript fallback. Those checks describe the website, not the private research inbox."
  ],
  "measurements": [
    {
      "label": "Offline inbox controls",
      "value": 42,
      "unit": "checks passed",
      "note": "34 supplied and 8 independently added controls; synthetic/mock-DOM inputs."
    },
    {
      "label": "Real captured posts",
      "value": 0,
      "unit": "posts in validation",
      "note": "No authenticated live-feed capture was exercised."
    },
    {
      "label": "Separate website validation",
      "value": 124,
      "unit": "live checks",
      "note": "12 public browser cases; not private-inbox acceptance."
    }
  ],
  "not_shipped": "The research-inbox candidate was not installed, imported into the Hub or exercised on an authenticated live feed. Browser attribution, one real post-to-saved-link round trip and end-to-end acceptance remained open. This work did not start an AI worker shift or change the private runtime.",
  "next": "Verify one real foreground post-to-saved-link round trip through an authorized browser, including lost-focus and failed-storage controls, before proposing an import.",
  "limitations": [
    "This is a public-safe documentary summary of retained receipts, not raw primary logs or a live health feed.",
    "Offline inbox controls and public website verification retain separate scopes. The inbox validation made no inference calls."
  ]
}