The map · Part Two · The machine · Chapter 17 of 18

What it does not do

The claimThe tool cannot tell you a business is good, cannot make you patient and cannot stop you overriding it, and the last of those is on purpose.

About 5 minutes · the builder's route.

This chapter is a list, and the list is not softened. Every item below is written in the project's own records, most of them under a heading that reads "What this does NOT protect against".

The boundary: one file served, every other path refused

Chapter 15 got a page to the phone. This section is about the two words "a page", because the server that hands it over sits in a folder full of things that must not travel.

The server has one rule with two halves. A request for the root address is answered with the overview page. A request for any other path, anything at all, is answered with "not found" and zero bytes. That is the entire published surface: one address.11Verified 2026-09-13 after the last fix: a request for the root returned the page; a request for one of the other files in the folder returned 404 with 0 bytes; the only listening address on the machine was the loopback one; a request to the public name without a login was redirected to the front door.

Security

• The relay operator can read the page.Nothing. The ruling calls it not mitigable within this architecture and accepts it as the price of reading the book on a phone from an arbitrary network.
• The front door is single-factor. Whoever controls the mailbox controls the page.Nothing beyond the mailbox's own security. Stated in the ruling.
• A 24-hour session on an unlocked phone stays open until it expires.Nothing. The phone's lock is the control.
• One bypass rule at the gate provider makes the page public instantly and silently.Prohibited by ruling, in bold. No mechanism prevents it.
• The page's public name appears in certificate logs, so it is discoverable.Nothing. "Obscurity is not the control; Access is."
• The account that controls the domain, the tunnel and the gate is secured by the same mailbox as the front door.Nothing yet. Recorded.
• If the tunnel dies, the phone is not told.Nothing. The tunnel runs as a system service that cannot use the failure notifier. The nightly run and its alerting do not depend on it.
• The page cannot mark itself stale.It prints its generation time twice. The requirement to mark itself was withdrawn as unbuildable.
• The boundary is one configuration block whose removal is silent.Named as the boundary; any change is a ruling. A test asks the server for a file it must refuse.

Every line above is taken from the deployment notes and the two rulings on the page.22deploy/TUNNEL-NOTES.md, 'What this does NOT protect against'; ruling F1; ruling F2.

Monitoring

• The weekly screen has no outside signal.The morning check-in is the only cover.
• A machine that is up and wrong pings as if it were right.Nothing. The observer proves a run finished, not that it was correct.
• The outside observer can itself be down.Nothing.

The method

• It cannot tell you a business is good.It can tell you a business was not faulted on a fixed set of coarse tests, and what growth its price assumes. Whether the business is good is a reading, and the reading is the owner's.
• One of its five gates has never run.Recorded as DATA MISSING for every name, kept, and waiting for the peer figures it needs.
• Its estimate of value rests on a growth view that will never be verified, and a discount rate that is a preference.Both are written down before the price is seen, and the sensitivity to the rate is printed beside every buy price. The ruling says both things in those words.
• It cannot make you patient.It can make the waiting a written number rather than a mood, and report the distance every night. Whether the owner buys at 93 anyway is not the tool's to prevent.
• It cannot stop you overriding it.The owner's file is the owner's. Every status, tier and value in it can be edited by hand, and the tool will faithfully report whatever it finds there. What it will not do is compute a buy price from a value that has no record, or accept one typed in.
• The scheduled machine refuses to decide anything for you.This one is deliberate, and it is the design. The decisions are made by the owner or, at his instruction, by the Claude Code session (E141). See below.

Why the last one is on purpose

Everything in this list except the last item is a limit the project would remove if it could. The last is the reason the project exists. A tool that decided would be trusted, and a trusted tool stops being checked, and a tool that is not checked is wrong in ways nobody notices until the money is gone. The tool's refusal to decide is what forces the owner to keep reading, every night, with the unfinished parts of the job named on the page. It is slower than being told. It is the only version of this that can be audited afterwards, by the owner, against a record the owner wrote before the outcome was known.

.venv/bin/python -m vss doctor

The slow way, made survivable. Built 2026-11-09 from the repository as it stood that day. NAME A and NAME B are fictional. One real company, CENTA, is followed through the book, with figures from its own filings and the owner's own trades. Not financial advice: one private investor's method, shared as it is.