Command: a picture you can check, and orders that arrive.

Nets of devices that share state with its age, orders with precedence and an end, and the removal of a captured device, which then receives nothing sent after.

On 4 November 2026 the Android app paired with a device built on our library, made a net of it, read the state it published, showed its order and sent it a flash order; 18 checks of 18 passed, on an emulator over our debug relay.

The phone checks a device's signed report against the keys it learned at pairing and says whether it is signed and by whom.

Since 5 November 2026 an item such as a photograph or a recording carries its custody with it: who captured it, each handover signed by the giver and accepted by the receiver, each copy and examination, and any version made from it. Anyone can check the line without asking a server, and a custodian who hands the same item to two people is shown to have done so by their own signatures. A line names accounts, not people.

Since 5 November 2026 an organisation can keep those custody records in one archive that cannot quietly change its history: other parties countersign each version of it, a reader trusts an entry only when enough of them have, and a review of the archive finds an item handed to two people without anyone comparing two copies. It proves the order things were archived in, not the time.

Since 6 November 2026 analysts can sign what they write as one of four kinds: a report, graded by how reliable its source is and how credible it is; an assumption; a hypothesis; a judgment, worded on the intelligence community's fixed scale of likelihood. Each says what it rests on, so a conclusion can never be quoted later as if it were a report, and a judgment is always shown with the reports, assumptions and hypotheses under it. When two reports disagree both are kept and every judgment resting on either says so. Competing hypotheses are ranked by the evidence against them, weighted by its credibility, and none is chosen. It shows who said what; it does not say what is true.

Since 6 November 2026 analysts in different places can share those statements as they work. Each analyst's statements arrive numbered in one sequence, so a statement kept from a reader shows as a gap, and an analyst who tells two colleagues two different things is shown by their own signatures. Each statement carries the Traffic Light Protocol marking its author chose; one marked for named people only is accepted and read by those people alone. A statement that arrives before what it rests on waits for it. It cannot stop a recipient repeating what they read.

Since 6 November 2026 the person in charge of an incident can ask everyone in a crew or at a site, at once, whether they are safe. Each person answers from their own device, and the answer counts only for that one call, so nobody can answer for someone else and an old answer cannot be reused. The tally lists everyone who was asked: what each said, and who has not answered yet, so nobody missing is overlooked. It says what each person's device answered, not that the person is safe.

Since 6 November 2026 an organisation can write down, in one signed policy, who may do what, where: which kinds of people and machines may give which orders in which units, which need a second person, and which are forbidden. A forbidden case always wins over a permission, and nothing is allowed unless the policy permits it. Every credential can be checked against the policy, so a right that was given but should never have been is found even when the credential itself is valid. A device that holds the policy refuses any command it does not permit, even one a valid credential gives, and so do the commands a machine's own modules give under the rights set at the bench. A newer policy replaces an older one, never the reverse. A policy can be given an end, after which a device obeys nothing under it until a newer one arrives, so holding back a newer policy cannot keep an older one in force for ever.

Since 6 November 2026 a casualty's record can travel from the point of injury to the hospital as one chain of entries, each signed by the person who wrote it, when it was written. Only the person caring for the casualty writes; each handover to the next level of care is accepted by its receiver; a correction is a new entry beside what it corrects, which stays visible; the same dose written down twice is pointed out and never merged. Another clinician can sign beside an entry that she checked, reviewed, witnessed or copied it, and nobody can sign that for an entry of their own. It keeps the record whole and says who wrote each entry. It does not judge the care, and it is not a medical device.

Since 4 November 2026 our library reads a net as one picture: for every subject, which devices report it, how old each report is, and whether they agree. When a radar reports an object and a camera reports nothing, both reports are shown side by side and neither is chosen; a report that has gone stale is shown as stale and counts for nothing; a sensor that has gone silent is listed as silent. Two devices that agree are two devices that reported the same thing, not proof they are independent. On the Android app the device net screen shows the same picture, measured with a device on our library and an emulator; on the iPhone: not yet.