Rick App: Fail-Closed Context Governance in the Browser

Version 3 — corrects two statements of fact about the repository that version 2 carried. No claim, finding, measurement or reference changes; the file is the same report with those two passages repaired. Freeze tag and confronted commit are two objects, not one. Version 2 wrote “the freeze of 8 September 2026 remains at b1df8bb / tag freeze-v9-2026-09-08”, joining them with a slash. Verified against the repository on 10 September 2026: the tag names 151d7f4, “Freeze v9 · 2026-09-08”, 05:37:13Z; the snapshot the freeze report confronts is b1df8bb, 06:08:33Z — thirty-one minutes later, and not the tagged commit. Both are now named separately, in the header and in the footer. The build marker belongs to the confronted commit, not to the live instance. Version 2 stated that a served build identifies itself with the word actualizada and the short git object name. That holds at edf34e5. It does not hold at the current head: 053116e removes both lines that rendered the marker, so its absence no longer means a tab is stale. The report now says this where it makes the statement, and Part I §9 carries it as a declared limit. Both were found by confronting the document against the repository after version 2 was deposited. Version 2 remains in the record. Version 2 — Rick App technical report confronting live commit edf34e5 (10 September 2026). Freeze snapshot b1df8bb / tag freeze-v9-2026-09-08 is not rewritten. Correction Contributions §3 / Part IV §4: erratum against the freeze report. The published v1 stated that the summary gate compared the extractive candidate to the previous summary. The freeze code and this revision compare it to canon (CANON_WARN = 0.4). This version follows the code. Claim wording updated to “deterministic validation gate over the compaction step” so it no longer echoes the old target. Instance physics declared (not re-claimed against a new prior-art search) Stream admission: only provider termination end_turn plus enforcer ≠ BLOCK admits a reply; abort, empty body, length/max_tokens, and transport cuts are evidence of an attempt, not conversation (freeze defect acknowledged in Part III). Writer lock: Web Locks rick-app-v3-writer; second tab is reader; older persist revision cannot overwrite a newer one. Drift persistence: CRITICAL sets driftBlocked across reload until explicit /drift ack; reload is not acknowledgment. Document identity: SHA-256 of the original body; lexical nodeHash remains for selection only. /olvidar backs up thread and that axis’s summary/cursor; /restaurar restores both. Canon integrity: documents over 20 000 UTF-8 bytes refused; packing that would omit a block sets canonIntegral = false and the call is not made. Capsule export/import without API keys; fingerprint SHA-256 of payload. Build stamp: /api/version no-store; served object name + “actualizada” marker; reload does not wipe the axis. Transport contract: system ≤ 32 000 UTF-8 bytes; each message ≤ 2 500 UTF-16 code units; at most 16 history turns; the relay does not silently re-slice what it accepted. Per-axis retention: messages kept per axis (160 in memory, 80 on persist), not as a global tail that can erase another axis. Replay: a fully recorded turn can be replayed locally without calling the model; partial records are labelled partial. Motor capabilities: chat and voice are separate; capabilities the chosen engine lacks or does not declare are absent or unknown, never pretended. Dictation fills the draft; it does not send. Also aligned to edf34e5 in this revision: drift abstention token floor (4), chrome wording for home axis mesa, and the exact scope of orderOk (ABSTENCION and REFERENTES assembled when present but outside the orderOk index list). Rick App: Fail-Closed Context Governance in the Browser RICK Runtime is a deterministic context-governance layer for a language model, in production on an Android phone. This report documents Rick App: an instance of the same physics on a browser substrate, with no account and no server-side user state, where every governance decision is local and deterministic and no decision is delegated to a model. The person who opens it chooses the engine and supplies their own key, which stays in their browser; the server holds no provider key. The machine assembles a thirteen-section system context each turn in a declared canonical order, each section carrying its epistemic status on its first line. A contract is verified before the model is called: ten sections must be present with more than zero bytes and in the declared order. If the contract fails, the call is not made and the turn is cut. Two further deterministic gates guard the turn: a drift break that halts until the operator acknowledges it, and a post-stream enforcer that discards the generated response so it never enters the thread. A grammatical trigger, not a confidence score, switches the machine between generative and factual mode; in factual mode with no canon in the axis, the absence is declared in a fixed sentence rather than filled. An adversarial prior-art search attacked seven mechanisms and found named antecedents for the generic component of every one. What it did not find is the same thing: a system that fails closed and requires an explicit operator acknowledgment to continue. The field detects, measures and logs. This machine stops, and says which contract was violated. That pattern, a declared contract, a deterministic gate, and a halt with acknowledgment, is what this report claims, and the report states for each mechanism what the search found against it. The code is public at github.com/yunusdim/rick-app and the instance runs at rick-app-three.vercel.app. This report confronts commit b1df8bb. No operator data is published: the engine key is supplied by whoever opens the instance and never leaves their browser.