# INC-05 recapture · 2026-09-11T23:25Z

RECORD on a11oy.net. Not DNS control. Not a Cloudflare API. Not product runtime. Not a fourth origin.

## Verdict

**INC-05 www-404 is CLOSED-as-MEASURED.** Hugging Face custom-domain PENDING is CLOSED-as-MEASURED (now READY).

This does **not** stamp production LIVE. Named frontiers N1–N27 stay holograms. `production_ready` stays false. Licensed AIS stays CLOSED. VESSELS-E03 stays OUTSTANDING. Λ stays Conjecture 1.

## MEASURED this session

| Host / path | Observation | Class |
| --- | --- | --- |
| `https://www.a-11-oy.com/` | HTTP/2 301 `Location: https://a-11-oy.com/`. HSTS present. | MEASURED |
| `www.a-11-oy.com` TLS | Handshake OK. CN=`a-11-oy.com`. Issuer Google Trust Services WE1. NotBefore 2026-08-25. NotAfter 2026-11-23. | MEASURED |
| `https://a-11-oy.com/` | HTTP/2 200. `server=szl`. `x-szl-space: a11oy`. `x-szl-wire-d: LIVE` (provenance hop, not domain LIVE). | MEASURED |
| `https://a-11-oy.com/api/a11oy/v1/honest` | 200. Doctrine v11 LOCKED 749/14/163. Kernel `c7c0ba17`. `git_sha` `7253ccb1f6ef888f87fcd9299baabde239a0ced0`. Λ = Conjecture 1. | MEASURED |
| Hugging Face `SZLHOLDINGS/a11oy` runtime | `stage=RUNNING`. domains `szlholdings-a11oy.hf.space` READY and `a-11-oy.com` READY. Provider runtime SHA `3899a2ea…` is not the same object as product `git_sha`. | MEASURED |
| `POST /api/a11oy/v1/decision/vessels/evaluate` | Frozen cases 3/3 MATCH. ABSTAINED / AWAITING_APPROVAL / DENIED. AIS admitted false. queries=0. E03 OUTSTANDING. | MEASURED |
| Product signer | Not re-stamped. Last contract: signer ABSENT / scheme UNAVAILABLE. Do not copy LIVE from `x-szl-wire-d`. | REPORTED (prior MEASURED) |

Prior origin.json bake (`observed_at_utc` 2026-08-29T18:53:21Z) recorded `www` as Cloudflare HTTP 404. Prior note `INC05_RECAPTURE_2026-09-11.md` recorded `tlsv1 alert access denied`. Those rows are superseded by this probe, not deleted.

## What this session cannot do

- Change Cloudflare DNS, SSL mode, or certificates (the 301 is already live).
- Inject a persistent DSSE / P-256 signer into Space `SZLHOLDINGS/a11oy`.
- Open a licensed AIS key or claim VESSELS-E03.
- Stamp `production_ready=true` or domain LIVE.

Those remain owner-metal or evaluation-blocking.

## Promotion lock that remains

- Do not relabel N1–N27 OPERATIONAL from a www 301.
- Do not mint a third public origin.
- Never `a11oy.com`.
- Do not treat evaluate 3/3 MATCH as entity-resolution precision.

Λ remains Conjecture 1. Unhackable is not claimed. SLSA L3 is not claimed.