A platform that plugs into the customer's infrastructure and turns a regulated telemetry stream into four things at once — signed, error-bounded, queryable without decompression and complete. Each piece of the toolkit is one plane; the product is what stitches them together.
Today a customer gets, at most, one or two of these properties — never all four, and almost never with a certificate a regulator can run on its own.
Taps the stream from Kafka / broker / historian / ROS2 — it doesn't sit in the critical path. Their normal storage stays; the plane emits the signed archive alongside it.
TVE ≤ 1% in IEEE C37.118, half a cent in freight, sensor tolerance in the datasheet, recall floor in the SLA. We don't argue the number — it's already law or contract. Bring-your-own-ε.
The guarantee can't be "trust us" — that would betray the very thesis: proof, not confidence. An open-source binary the regulator, the auditor or the counterparty runs on its own to check signatures and bounds.
One stream in; five guarantees out. What's measured against an installed incumbent comes with a number; the rest is a built primitive.
Compresses with |error| ≤ ε guaranteed per sample, verified on decode. Circular channels (angle, heading); GOP index.
Every block stamped with Ed25519 and committed to a Merkle tree. Tampering breaks the signature — it's the "tamper-evident archive" the rule requires, verifiable by a third party.
Certified aggregates ±ε over the compressed data, without decompressing. An interval that contains the truth: VWAP, compliance, climate envelope.
Completeness: finds every occurrence of a pattern, zero false negatives. Certified range and k-NN, out-of-core.
Counting and heavy-hitters robust under an adaptive adversary. Surprise as a byproduct of compression detects staleness and anomalies for free.
On the same error contract, the pieces missing between the sensor and the audit — queue, black box, archive, joining, gaps, fleet, 2D perception and 3D space — twenty-three measured steps on real data (203 Hz IMU, ALOHA joints, car CAN, an AMI fleet, TUM depth video, KITTI LiDAR) with the experiment committed next to the code.
Under backpressure a normal queue can only drop — holes with undefined error. SLUICE widens the ε of the next blocks until the flow fits the link, then tightens back; the larger error travels declared in the record and is proved per record.
Fixed flash that never forgets, only blurs: the past is re-compressed at larger ε with the blur on the label, the last seconds are untouchable, and incidents detected by multi-sensor voting stay pinned at full sharpness. On disk, crash-safe: a power cut doesn't lose the pinned incident.
Age-tiered retention without the downsampling lie: every query answers [lo, hi] guaranteed to contain the truth, by real timestamp (the nominal clock is off by dozens of periods — we measured), decoding only the window's boundary blocks.
Matching two sensors by nominal clock is a guess: on real CAN, nearest-timestamp gets 43.8% of pairs wrong in silence. SPLICE treats every timestamp as an interval and classifies each pair — CERTAIN, AMBIGUOUS or IMPOSSIBLE — never excluding the true one. The ruler from the measurement: certified fusion up to f ≈ 1/(4·ε_t).
Signed physics (the datasheet slew) turns a data hole into a provable bracket — refuted with a number where it doesn't pay, and with unexpected gold: when physics says IMPOSSIBLE, the data contains a teleport. Dataset provenance auditing: the 39 violations in a public imitation-learning dataset were exactly its 39 episode splices.
N edges upload only certified indices (~1 B/sample, 12× less than raw; the data never leaves the edge) and the cloud answers fleet aggregates with a guaranteed bracket. The step-1 lesson: changing the answer's contract (the EXACT total of a shifted, declared window) beat buying precision with bytes.
Images and depth video with per-pixel |error| ≤ ε, proved, plus certified region queries ("did the gripper zone stay within ±5 mm?") without decompressing. Beat SZ3 in all 4 cases — on video, ceding SZ3-3D the temporal axis and winning 1.24–1.33×. The measured lesson from the internal refutations: the axis that pays is the one the sensor correlates.
LiDAR compressed with a per-coordinate bound and spatial absence proof: "no obstacle inside the safety zone" as a guaranteed verdict (EMPTY-PROVED / OCCUPIED-PROVED / UNDECIDABLE), zero false negatives by construction — the evidence ISO 26262/UL 4600 ask for, signable. On bytes, 0.8–2.8× of Draco, winning on dense fine clouds.
Per-subscriber layered streaming: built, measured — and plain simulcast won on every metric. The tombstone is the first line of the README. The method on display: the same ruler that approves the three above rejects what doesn't pay.
Bound never violated in any cell of any experiment. The technical section → · the plain-language version →
The ε already lives in a document
Buyer is compliance, not performance
Incumbent gives confidence, not proof
High-volume data, retained for years
A third party must verify
When 4–5 of these hold, the platform is an obligation, not a convenience.
| Vertical | ε comes from | Planes that light up | Status |
|---|---|---|---|
| AI platform metering · RAG · training-data audit |
SLA / quota / recall floor | Watch · Search · Seal | measured |
| Market surveillance CAT · MiFID II / MAR |
Rule 613, best-execution | all five | thesis · strong map |
| Games / replay-telemetry | tick / perceptual | Ingest · Answer | measured |
| Synchrophasor / PMU power grid |
TVE ≤ 1% (IEEE C37.118) | Ingest · Answer · Seal | thesis |
| Robotics / ROS2 active lead (Instor) |
sensor tolerance | Ingest · Search · Seal | stepwise plan |
| Cold chain · AMI · dams · EV battery | health / safety / reg standard | Ingest · Seal · Answer | thesis |
| Freight gwtFrete · 2B quotes |
half a cent (step price) | Ingest · Answer | thesis |
| Meteorology / certified geo | field tolerance | Search · Answer | measuredSZ3/ZFP home turf |
The only tier already measured against an installed incumbent (Redis 8.8, hnswlib). Acute, current pain; validates three planes without leaning on the "in-RAM loses" caveat.
The only place where the entire platform becomes a legal mandate. Use it as the top story — but treat it as thesis until a pilot with real tick data.
The two cheapest Ingest/Answer proofs to close next — one already measured (CS2 GOTV), the other with the ε written into the standard (TVE).
Without completeness, without years of retention, without an adversary, without a third party verifying — an argsort or an in-RAM FAISS wins, and we've measured that (the imgemb lesson). The plane only pays off where the certificate is the deliverable. That's focus, not a bug: it turns down the wrong verticals.
Bring the ε that's already in your document — the standard, the contract, the SLA. We'll show which of the five planes lights up first and set up a pilot in your VPC.