Identifiers built for a strange transport: large language models. Fabrication is detectable, one slip repairs itself, anything worse fails loudly instead of misrouting silently.
10 symbols from a 29-character alphabet, grouped in pairs. Tap a part to see why it exists.
Models emit tokens of a few characters, so one slip corrupts a short contiguous run — never a single random character. Four event kinds, replaying below.
Almost everything arrives pristine. A little arrives with exactly one slip. A tiny fraction arrives mangled. Almost nothing in between — which is what makes a strict single-event repair budget safe: past one slip, you're almost certainly in the untrustworthy regime.
Every button below hands a real candidate to the same resolve() an application would call, against a registry this page minted when it loaded. The narration is read back from what it returned and from the error it left behind.
Delimiters cost nothing: layer 1 strips everything outside the alphabet, so K7—M3 XR_9D Q2 and K7-M3-XR-9D-Q2 normalize identically. Length off by ±2 skips the checksum — a positional code is meaningless once symbols shift — and goes straight to repair.
29⁸ ≈ 500 billion possible payloads; a deployment issues thousands to millions. Minting redraws any identifier within edit distance 4 of an existing one — so no single damage event can ever land a candidate ambiguously between two identifiers.
One damage event costs at most 2 edit operations (a token slip touches ≤2 symbols; a transposition costs 1). That constant is the contract's entire tunable surface.
A model occasionally substitutes one genuine identifier for another it saw elsewhere in context. The string is well-formed, registered, checksum-clean — per-identifier robustness can't catch it. The fix: derive the checksum's two required sums from the identifier's context (its slot, role, or parent). The two identifiers below were minted here, under the two slot names, and the verdicts are what resolve() says about them.
Each identifier's check symbols were minted against its own slot's context. Right now both resolve.
The specification ships an answer key, and an implementation conforms when it passes every case in it. The engine driving this page carries that answer key and was graded against it before a single demo above was wired up — here, in your browser, a moment ago.
The count is read off the vector files themselves rather than written into the page. If any case had failed, a red banner would be sitting at the top of this document naming it, and none of the panels above would have been wired up at all — because a page that kept rendering confident verdicts under a broken engine would be committing exactly the silent misrouting this scheme exists to prevent.