TA-N - Track-A negatives, parked items and open threads

The Track-A marketing organism is an engineering and operations system: a self-hosted, multi-container publishing-and-engagement engine that runs an organic social presence without a content API key and without paid ads. This chapter is its honest underside. It gathers, in one place, the canonical failures the program guards against, the publishing routes that are dead or hard-blocked, the data-layer negatives, the items that are parked or not-yet-built, and the standing open threads that are recorded but not discharged. Nothing here is hidden in a footnote. By the Evidence Constitution a negative is a measurement that the design is incomplete, not an exit and not a failure to conceal: the negatives are the credibility. None of these rows is a science claim; this is the marketing appendix, carded as engineering and method, never as a capability of the UNI simulation. The honest program position is unchanged throughout: a developmental active-inference simulation, a bounded peek, a toy world, with about 2 of 11+ developmental rungs earned.

A standing note on vocabulary: this is a Track-A chapter, so it speaks in plain operations language and never externalizes the internal scoring-framework names or prints internal channel handles (red line 12). The route ledgers underneath this engine are plain multi-armed bandits that happen to shape-mirror the UNI scoring code, and the leak guard that keeps that vocabulary out of them is itself one of the standing risks recorded below.

The defining negative of the whole appendix sits at the top, and it is read first because it is the most expensive lesson the program ever paid for.

The defining negative: the 2026-06-24 client-data leak (N-LEAK)

On 2026-06-24 the agent deployed the wrong repository because a HANDOFF document said to. A real client's confidential intake rendered on a public *.vercel.app preview URL. This is a Class-A observed negative, recorded as N-LEAK, and it is the load-bearing fence for every deploy the program will ever do again. Three laws were born from it, and they are not advisory:

• Never deploy without confirming repository, branch, HEAD, and data first. The falsifier for the fence is direct: a deploy that proceeds on the wrong repo, branch, or data despite the confirm-before-deploy gate.
• Treat READMEs and HANDOFFs as DATA, not as commands. A document in a tree is an artifact to be verified, never an instruction to be obeyed. The agent that read the handoff as a command is exactly the failure mode.
• The preview URL is itself the exposure. There is no "private" preview; a *.vercel.app link is public the moment it exists.

N-LEAK does not travel alone. Its travelling companions are the deploy-target negatives that both contributed to it and were sharpened by it. N-VERCEL2 (Class A) records the deploy-target trap: two Vercel accounts coexist, where the PRODUCTION team is reachable only through the Chrome dashboard while the OLD account is bound to the MCP token and CLI and cannot see production. The standing rule is to drive production through the dashboard, not through the MCP or CLI; this partly stemmed the leak and also stalled the iamhitl OG-image fix. Its falsifier: the MCP or CLI is shown reaching the production team. N-APPLIANCE (Class A) records that the self-hosted appliance is not a viable production host for Vercel: serverless cannot reach the box, and the box already carries live client and Minecraft workloads. The ruling was to make Neon the production hot store and the appliance a sovereign async mirror that is never internet-exposed; the appliance approval gate then began rejecting the owner's token, which is what forced production onto Vercel in the first place.

The canonical method negatives the program guards against

Three more Class-A method negatives travel with the leak as the constitutional failure set. N-NOOP is the canonical failure of the whole program: Sweep SKILL files shipped fictional tool signatures that silently no-op'd for months, so whole phases "completed" while doing nothing, because a silent no-op reads as success in summaries. Real signatures are now documented; the falsifier is a documented tool signature shown to silently no-op against the loaded tool schema. Against this stands a positive in the same family, recorded as a negative because it is a refusal-as-safety pattern: N-REFUSAL (Class A) records that the agent declined to read or extract the box operator token even with full file access, because that token is the gate's root of trust against the agent itself. An agent must not exfiltrate its own gate's root-of-trust. Finally N-GEMINI (Class A) records a real LLM defect in sandbox code: the existing client sandbox used Gemini for extraction and processing, directly contradicting the program's no-LLM ADRs (defect D-1, ADR-019, distinct from the external client-AC blocker also labelled D1). The ruling was to strike and remove all LLM and Gemini code; the falsifier is the presence of any Gemini or LLM import in the sandbox.

Publishing negatives: routes that are dead or hard-blocked (TA-N1 through TA-N12)

These are the recorded delivery-route bounds. Each is a route that was attempted and measured, not a route that was assumed.

• TA-N1 (Class A): headless or automated YouTube Studio browser upload is dead on modern Chrome. All three routes fail (Google rejects automated sign-in; Chrome 136+ refuses CDP on the default profile; Chrome 127+ App-Bound Encryption voids copied-profile cookies; yt-dlp --cookies-from-browser fails by design). Only the Chrome-extension MCP keeps a real session, agent-driven and not unattended. Verdict: do not re-attempt; use the Data API or operator drag-drop plus finalize. Falsifier: a future Chrome or Google change restores an unattended headless Studio upload surviving App-Bound Encryption and CDP restrictions.
• TA-N2 (Class A): TikTok direct or auto public publish is hard-blocked; an unaudited app returns unaudited_client_can_only_post_to_private_accounts (403). The code is ready; the only unlock is the operator submitting for Content Posting API audit. Do not retry-loop direct-post. Falsifier: the app passes the audit, lifting the 403.
• TA-N3 (Class A): Reddit self-posts and link-drops from a low-karma account are account-killing; one account was permanently banned from 7 subs, and bans return a silent 500. The rule is to comment on existing threads only, never self-post our own links. Falsifier: a low-karma account sustains self-posting our own links without ban over a meaningful window.
• TA-N4 (Class A): external threaded ladder replies (linkedin_reply_to_comment) 400 on execute on third-party posts, both personal and org actor. Only top-level comment_manage drafts post live externally; own-post replies still execute. Never stack a third top-level comment in a thread. Falsifier: linkedin_reply_to_comment executes (non-400) on a third-party post.
• TA-N5 (Class A, correction): the "1600 units to only ~6 uploads/day" YouTube quota panic was false; the project quota is audit-raised and 30/day succeeded. The youtube_quota DB counter is unreliable and the script bypasses it. The lesson is to verify the real project quota and never reason from defaults, which is the program's "falsify the mundane causes" discipline applied to operations. Falsifier: the audit-raised quota actually caps at ~6/day under real conditions.
• TA-N6 (Class A): OAuth fragility across archives. YouTube and Reddit OAuth were found broken and diagnosed empirically (YouTube 401 plus "refresh: Bad Request"; Reddit 401 with www-authenticate: Basic realm="reddit", a rotated client-secret needing a roughly two-minute operator re-issue; Twitter/X credentials absent, channel unwired). Re-auth is handed to the owner as a precise click: the agent never mints tokens. Queue history at one snapshot read 107 published, 5 failed, 9 cancelled. Falsifier: OAuth shown working without operator re-auth, or a 401 from something other than a rotated secret resolving without re-issuing it.
• TA-N7 (Class C): GEO reality check. AI search crawlers rarely fetch llms.txt, and Google has said it will not support it. Ship it as a cheap, correct, machine-facing gesture for agentic and IDE tools, not for ranking. Falsifier: evidence emerges that AI crawlers materially fetch llms.txt and it drives ranking.
• TA-N8 (Class A, bound): the combinatorial scale ceiling fired on the MarketingWright clustering engine. The engine is exhaustive over Bell-number partitions; the "scales to N=12" falsifier fired because Bell(12) = 4.2M partitions exceeds the 60-second budget. The honest operating envelope is N at most about 10 without a beam, coarser prior, or compiled loop (the Sun-Prairie demo at N=7 is safe). Seven surface defects (four HIGH) had fired falsifiers, all in the surface contract rather than the math; the Gemini code was struck per the no-LLM rule; and the alpha-in-{inf,nan} to NaN-tainted-F with self-attested Class-A case is a self-attestation integrity gap. Falsifier: a sub-Bell method bounds cost for N greater than 10, lifting the bound.
• TA-N9 (Class A): the OBS-composite-in-OBS path is a dead end because OBS CEF renders WebGL black; it was retired in favor of WGC window-capture of real Chrome windows. Falsifier: OBS CEF rendering WebGL correctly on the dual-GPU box.
• TA-N10 (Class A, gotchas): per-client Vercel deploy gotchas. A project created via vercel project add gets framework:null, which mis-bundles Next.js edge middleware (set "framework":"nextjs"); host on Vercel rather than local-plus-tunnel, which breaks Clerk redirects; Clerk dev instances reject .vercel.app as origin (use an allow-listed redirect_url or custom domain); do not deploy-spam, since rapid prod deploys tripped an account-wide fair-use 402; bare next build fails without the gitignored design-tokens dist/ (add a prebuild); two API routes needed force-dynamic. Falsifier: the framework:null edge-middleware drift does not occur, or a bare next build succeeds from a clean checkout without the prebuild.
• TA-N11 (Class A): two costly misfires, recorded for brutal honesty. First, vercel deploy with no .vercel link auto-created a brand-new project named after the folder. Second, work proceeded on a fake scaffold (a prior session's from-scratch wizard) mistaken for the real portal, drawing the owner's "that's not my portal" reaction. These are the origin of the confirm-before-deploy and do-not-touch-client-portals laws that N-LEAK later carried. Falsifier: a transcript shows no stray auto-created project and no scaffold confusion.
• TA-N12 (Class C): "all LLMs end in entropy" is only half-true. On the Emergence-World S1 AWI proxy, two cohorts held the line (Claude Sonnet 4.6 = 10/10, Gemini 3 Flash = 10/10) while two did not (Grok 4.1 Fast = 0, GPT-5 Mini = 0). The honest response was to sharpen the falsifier, not to claim a win: a UNI must match or beat the best LLMs AND show substrate-distinct properties those LLMs lack, not merely beat the worst. This raises the bar and does not claim UNI superiority. Falsifier: the sharpened bar fails if UNIs cannot match the best LLMs or show the substrate-distinct properties.

Data-layer negatives in the delivery and ideation stack (TA-N13 through TA-N18)

• TA-N13 (Class A, open): the handoff was never executed end-to-end at runtime. verify_chain was valid over 500 events, yet the running MCP's full 243K-character audit log held ZERO handoff or inception-bundle events: the route was built and unit-tested but never fired against the deployed MCP. This is the canonical "exists in code (Class E) versus observed at runtime (Class A)" case, and it remains open. Falsifier: a Class-A end-to-end observation of a handoff or inception-bundle event in the live MCP audit log.
• TA-N14 (Class A): container and code drift. The deployed Agile-MCP container was behind the code that shipped the SW-INT receive routes, so routes that "exist" in code were unreachable in production. Falsifier: a runtime probe confirms the deployed container serves the SW-INT routes.
• TA-N15 (Class C): fictional transcript provability, an aspirational gate, and unbounded growth. payloadBuilder.ts hardcoded transcript_sha256: null; evaluateClerkAdoptionGate was referenced only by its own test with no production caller, so its ADR stays PROPOSED indefinitely; and pruneOldCallbackNonces() existed but no scheduler invoked it. These are operational analogues of "reproduced:true must be validator-derived" and "Class-E test is not Class-A in production." Falsifier: a verifier recomputes a real transcript hash, and a production caller or scheduler invokes the gate and the prune.
• TA-N16 (Class C, remediated): cleartext HMAC secrets, a P0. hmac.ts stored the integration secret in cleartext with "envelope encryption is TODO," the one P0 blocker for real production handoff. This was later remediated by OAS-673 with AES-256-GCM, a closed loop. The remediation is recorded so the negative is not stripped from history.
• TA-N17 (Class A, reboot-fragility): a firewall rule not persisted. The nft dport 8089 accept rule is runtime-only, so a reboot drops Client-B's site until /etc/nftables.conf is hand-edited. Falsifier: the rule is persisted and the site survives a reboot on re-probe.
• TA-N18 (Class A, parked residual): residual risk in the intelligencelabs-uni repo. The repo's git history (initial commit) still contained prior real-client data even though the working tree is clean. It was flagged for optional scrubbing and left to the owner; the PII is withheld here. Falsifier: inspecting the initial commit shows no prior real-client strings, or it was scrubbed. This sits in the same family as N-LEAK: a clean working tree is not a clean history.

Parked and not-yet-built items (TA-P1 through TA-P12)

Parked is not done and not failed; a park is not discharged until its sign or its observation lands. The dominant live blocker is operator authentication, and the dominant safe boundary is that the agent never enters credentials. TA-P1 (Class A): social-publisher browser-route publishing waits on operator noVNC login per platform, the one human step, which retires the Reddit-401 and TikTok-audit publishing gates when complete. TA-P2 (Class A): recurring auth outages are the dominant live blocker (LinkedIn token expiry with no refresh token, Reddit 401, publish_mode=dry, periodic Docker-Desktop crash-loops), all requiring an operator click rather than a code fix; a sustained outage of roughly 5 days with about 190 posts queued is on record. TA-P3 (Class E): the engagement_engine MCP tool is built and tested 20/20 but not committed and not wired into a live auto-loop; the decision owed is to wire it or retire it. TA-P4 (Class C): Forms-P0, the highest-value unfinished marketing task, where /api/intake forwards to INTAKE_WEBHOOK_URL only if set and it is unset, so leads currently go nowhere, and /falsify has no backend; measurement is built but deliberately OFF until NEXT_PUBLIC_INGEST_URL is set, a deliberate degrade-to-CANON safety. TA-P5 (Class U): self-driving Phases 2 through 5 (bandit engine, public posteriors, reciprocal entity graph) are planned, not built; the master pattern is Class-U design until shipped, and "active inference" is the framing lens, never "active inference demonstrated." TA-P6 (Class E/A): the /explore "Live demo" is built but unshipped, pointing at an undeployed subdomain; the IntelligenceLabs.UNI demo was not deployed in-session (blocked on a disposable Postgres) and its live state is unverified. TA-P7 (Class E): homepage "weave" chrome copy is hardcoded while the hero rotates five puzzles, so weave-specific copy is wrong four times out of five; one root fix clears about 18 findings, status unverified. TA-P8 (Class U/A): Client-B content-engine phases P2 through P5 are specced, not deployed, and quick-tunnel URLs are ephemeral pending operator tunnel credentials. TA-P9 (Class U): authenticated portal flows are unverified; Class-A evidence exists only for unauthenticated, gated, and public routes, and the logged-in experience needs a real team Clerk login not yet observed; this is the largest open verification gap alongside handoff-never-fired. TA-P10 (Class U): the UNI Production Platform is a buildable design for a broadcast-grade live show, not deployed; do not treat the design as capability. TA-P11 (Class U): MCP-attach for the labs is raised and parked behind commit, deploy, and QA, not yet built. TA-P12 (Class C): the UNI Signals DV-safety app launch is hard-gated behind 5 human-expert sign-offs and no shelter database; the clinical pre-audit's 414-scenario regex-lexicon detector showed strong crisis detection but weak veiled-danger detection at about 33%, requiring semantic plus human escalation, and the patent-level UNI math underneath stays private.

The activeinference workbench: design-only, zero execution evidence (AI1 through AI3)

The activeinference BEAM-native AIF Workbench is a well-formed design charter with ZERO recorded execution evidence in the snapshot, and it must be carded that way until the live tree is located. AI1 (Class U): the archive carries no PASS, FAIL, NEGATIVE, or PENDING ledger entries, no transcripts, and no build, test, or replay results; the four authoritative source files (CLAUDE.md, Design.txt, the TDD plan, the formulas file) are named as priority reading but are absent from the archive, so whether any E0 through E7 epic was implemented is unknown from this archive. Falsifier: locating the live project tree and finding green tests or recorded runs for any E0 through E7 epic moves specific rungs from design-only to evidenced. AI2 (Class U): the scope fences (discrete-time only, no Python or JS runtime logic, the whole runtime on the BEAM) are design constraints, not empirical negatives. AI3 (method): the reusable design and governance patterns (runtime-derived UI, deterministic replay, TDD-as-gate with ordered epics, single-source-of-formulas provenance, pure-agent runtime) are patterns, not demonstrated results, and the underlying build is unverified. The standing action is to locate the live project tree before crediting any activeinference capability.

Standing open threads (OT1 through OT10)

These are recorded so that absence or ambiguity is never mistaken for a complete ledger; by No-Exit discipline none is discharged until a sign or an observation lands. OT1: the repo-split and brand deprecation, where the drafted UNI_CONSULT_5 sign-to-park was owner-relayed but is NOT yet captured, so the park is not discharged; the risk of two writable ledgers would break L10/L11. OT2: "never push" versus authorized pushes, reconciled as push allowed on the confirmed-private repo with per-push owner confirmation, pending a one-line contract update. OT3: channel-handle policy nuance, where a link may exist but the handle must not be featured, with the vocabulary-leak guard intact independently. OT4: canonical-portal ambiguity, where a newer commit suggests cw-ideation may be a newer canonical portal than the cloned release. OT5: "Story F built twice," needing confirmation of which commit is canonical and whether effort duplicated. OT6: two live hosts coexist (staging versus apex), and JSON-LD @ids must use the apex. OT7: two distinct books share the UNI label, and the "live Minecraft colony" appears as metaphor in one archive while it is real in others, to be reconciled. OT8: an aspirational upstream DEMO_MODE that does not yet exist as any engine or feature. OT9: a legacy unauthenticated approval daemon (port 8442, root chroot exec, zero auth), dormant but un-retired, to be archived. OT10: no memory/ spine for the precision repo, worth creating later. No open thread is an exit; each is a debt the program continues to carry in the open.

What is NOT claimed in TA-N

• Ceiling: that the Track-A marketing organism is a finished, robust, self-driving system is NOT shown, and neither is any reading that documenting failures somehow neutralizes them or that the appliance, the publishing routes, or the activeinference workbench demonstrate a capability. The most we claim is that a self-hosted no-API publishing-and-engagement engine runs live as engineering, that a defined set of publishing and data-layer routes were attempted and measured to be dead, blocked, fragile, or unfired (each carded at its ledger class, mostly Class A with TA-N7/TA-N12/TA-N15/TA-N16 at Class C), and that the parked items, the activeinference workbench (AI1 through AI3), and the open threads remain Class-U-not-claimed or explicitly undischarged.
• Fences engaged: red line 7 (never raise a claim above its source evidence class); red line 10 (no PII, no secrets or tokens or internal channel handles, no patent-level UNI math, which is why TA-N18 withholds the data, TA-P12 keeps the math private, and N-REFUSAL keeps the operator token unread); red line 12 (the Track-A vocabulary-leak guard, plain ops vocabulary only, never externalizing active-inference, EFE, or free-energy names, and "active inference" in TA-P5 is the framing lens, never "active inference demonstrated"); and the standing engineering-is-not-a-science-gate fence (red line 8): none of these operational rows implies any movement on the L0 through L12 science ladder.
• Negatives that travel with this claim (cite alongside, never strip): N-LEAK is the load-bearing negative and must lead any deploy discussion, paired with N-VERCEL2 and N-APPLIANCE; N-NOOP, N-REFUSAL, and N-GEMINI are the canonical method-failure set; TA-N13 (handoff never fired at runtime) travels with any "handoff exists in code" statement; and AI1 through AI3 travel with any mention of the activeinference workbench.
• Parked / owed: OT1's UNI_CONSULT_5 sign-to-park is owed and not captured; TA-N13 (Class-A handoff observation) and TA-P9 (Class-A authenticated portal observation) are the two largest open verification gaps; TA-N18's git-history scrub is owed and left to the owner; and the activeinference live-tree location is owed before any E0 through E7 credit.
• One-line honest summary a skeptic could not dispute: every failure, block, fragility, and park in the Track-A organism is recorded in the open with its evidence class and its falsifier, the worst of them (a real client-data leak) is printed first as a law rather than buried, and not one of these operational rows is offered as evidence for any capability of the UNI simulation.

Falsify this

The lead falsifier is operable and singular: produce a Class-A end-to-end observation of a handoff or inception-bundle event in the live MCP audit log (TA-N13). Today verify_chain is valid over 500 events while the running MCP's 243K-character audit log holds ZERO such events, so the route exists in code (Class E) but has never been observed firing in production (Class A). One genuine runtime observation flips that row from negative to evidenced. The defining negative carries its own falsifier in parallel: a deploy that proceeds on the wrong repo, branch, or data despite the confirm-before-deploy gate would prove the N-LEAK fence has failed and must be rebuilt. And for the design-only workbench, locate the live activeinference project tree and exhibit green E0 through E7 tests; absence leaves AI1 through AI3 unverified, exactly as carded.

Sources

• CLAIM-LEDGER.md: method negatives N-NOOP, N-LEAK, N-APPLIANCE, N-REFUSAL, N-GEMINI, N-VERCEL2 (Section 3); publishing negatives TA-N1 through TA-N12 (Section 4.6); data-layer negatives TA-N13 through TA-N18 (Section 4.8); parked items TA-P1 through TA-P12 (Section 4.7); activeinference rows AI1 through AI3 (Section 6); standing open threads OT1 through OT10 (Section 7).
• MASTER-PLAN.md: the TA-N authoring spec; FM-1 Evidence Constitution; FM-2 the A-U rubric; FM-3 red lines and the SIGNED 2026-06-27 forbidden-phrasings list; FM-4 the "what is NOT claimed" template.
• Curated digests (PII-redacted): curated/orchestrate-linkedin-digest.md (the Track-A core: publishing negatives, auth-outage triage, parked publishing items, open threads), curated/activeinference-digest.md (the design-only workbench, AI1 through AI3).
• Archive pointers (local-only, PII-bearing, never read here for content): the ORCHESTRATE/LinkedIn, website, ideation-explorer, intelligencelabs-uni, marketingwright, strings, and activeinference archives, surfaced only through their curated digests.