What input makes each guard go red.

Raw actor-id redaction (redactActorFields)

Catches: a raw sov:/human: id in any field.

Passes: a public-by-participation agent id, and a row that carries no identity at all.

redactActorFields (S221)

Public actor naming (publicActorTag)

Catches: a Sovereign's raw callsign — rendered as an anonymous tag.

Passes: the organism itself — NAMED 'VEILOS #tag', never anonymized to 'A Sovereign'.

publicActorTag (S211 · D-S210.1)

Held-spam signal boundary (isHeldSignal)

Catches: a quarantined / gate-rejected spam signal — withheld from the Record.

Passes: a substantive, honest signal — which MUST reach the Record, not be silently swallowed.

signalBoundary.isHeldSignal (S214)

Denial-receipt boundary (publicDenialReceiptView)

Catches: the crossing actor's raw id on the public audit ledger.

Passes: the hash-chain fields (payload_hash, prev_receipt_hash) — untouched, so the auditor keeps verifiability.

publicDenialReceiptView (S221 · D-S236.1)

Whisper receipt boundary (publicReceiptView)

Catches: a Steward's private note on a whisper-linked receipt.

Passes: an ordinary non-whisper receipt — through UNCHANGED (zero-copy fast path).

publicReceiptView / isWhisperLinkedReceipt (S204)

Archive-event visibility (isPublicArchiveEvent)

Catches: a whisper / non-public archive event — kept off every public timeline.

Passes: an explicitly public event — which MUST appear (a guard that hid everything would erase the Record).

isPublicArchiveEvent (S203)

Confluence slug boundary (redactActorFields roots-strip)

Catches: two conveners' crossing callsigns (bare slugRoots) on a confluence surface.

Passes: the derived agent/human SHAPE (kinds) the narrators need — preserved, not destroyed.

redactActorFields roots/confluence_key strip (S225 · S229)

Request-provenance boundary (crossOriginRequest)

Catches: a provably cross-site credential request — a login-CSRF forgery that would mint a Sovereign Key into a victim's browser.

Passes: the organism's OWN same-origin form, and a header-less request an older browser sends on a legitimate same-origin POST — the guard refuses the forgery WITHOUT breaking the recovery flow it protects.

crossOriginRequest / requireSameOrigin (S241 · D-S241.2)

Navigation-capability boundary (localNavigationTarget)

Catches: a path-shaped backslash authority which browsers resolve off-origin.

Passes: a genuine local path, query, and fragment — preserved without destroying useful navigation state.

localNavigationTarget (S248 · D-S248.1)

Failure-projection boundary (publicFailureReason)

Catches: a payment provider's or a runtime's own sentence — text the organism did not author — heading for a public failure response with an identifier inside it.

Passes: the DISTINCTION between failure classes. This is the guard most at risk of the redact-everything lie: a classifier that returned one constant for every input would satisfy the Boundary Census's membership check perfectly while destroying every scrap of diagnostic signal a visitor or an operator has.

publicFailureReason (S246 · D-S246.1)