Seven certified operators that compose into an algebra of evidence: compress with a bound, query without decompressing, search without missing, measure without being fooled, timestamp with proof, sign the ledger and prove the restore. The ε is already in your norm — we turn it into a guarantee.
The same error, measured three times
and none of the three breaks the per-sample margin.
48 years of mission in 5.9 hours of antenna time
at the instrument's own documented error — and the heliopause crossing becomes an auditable verdict.
"Pick ε, get privacy" — we measured. It is not so.
the promise dies on four channels; what survives is the report that settles the anonymization claim.
Certified detection and absence proof over a real IMS array.
open in new tab ↗Telemetry under bounded error — every sample inside the ε tube, proved.
CLAMPCertified queries on compressed data — the answer as a bracket that contains the truth.
SIEVEVector search with proven zero false negatives — certified completeness.
TRUSSSketches that don't bend — measure the stream even when manipulated.
PLUMBTime as a certified interval — conformance attestation (RTS 25).
GIRDERThe signed ledger — trust lives in the key, not the writer.
SHOREBackup that proves it restores — not the promise, the proof.
The queue that degrades certified instead of dropping: 100% delivered at 0.4× the bandwidth — where a normal queue loses 59% forever — with the widened ε declared in the record.
COFFERThe black box that blurs instead of forgetting: 24 KiB keep the mid-stream incident at nominal ε across 6 channels, crash-safe, with per-segment certified blur.
STRATAAge-tiered retention that doesn't lie: every query answers [lo, hi] guaranteed to contain the truth — 6,000/6,000 windows, by real timestamp, in ~20 µs.
SPLICECertified sensor joining: where nearest-timestamp silently mismatches 43.8% of pairs (real CAN), every pair comes out CERTAIN, AMBIGUOUS or IMPOSSIBLE — and the true one is never left out. The ruler: certified fusion up to f ≈ 1/(4·ε_t).
CAULKGaps filled by signed physics (the datasheet slew): a provable bracket where it pays, refuted with a number where it doesn't — and the unexpected gold: FALSIFIED detects dataset splices (39/39 on LeRobot, 0 false positives).
TRESTLEThe fleet without pulling the data: edges upload only certified indices (~1 B/sample, 12× less than raw) and the cloud answers with a guaranteed bracket — 2,000/2,000; adjusted-window mode answers EXACTLY with the shift declared.
TUBE2DPerception with a per-pixel guarantee: images and depth video with proved |error| ≤ ε and certified region queries — beat SZ3 in all 4 cases and SZ3-3D on video (1.24–1.33×, ceding it the temporal axis). The measured lesson: the axis that pays is the one the sensor correlates.
PILEThe point cloud that proves absence: "no obstacle inside the safety zone" as a guaranteed verdict, zero false negatives across 1,800/1,800 queries (real LiDAR) — at 0.8–2.8× of Draco's bytes, winning on dense fine clouds.
WEIRrefutedPer-subscriber layered streaming — REFUTED: simulcast won on every metric. Frozen with the tombstone in the README; the same ruler that approves the ones above.
Built on TUBE and measured on real data (203 Hz IMU, ALOHA joints, car CAN, an AMI fleet, TUM depth video, KITTI LiDAR): 23 committed steps with the measurements next to the code — the refuted ones included. See the technical section → · plain-language version →
Over 40 interactive demos on real public data: earthquakes, emissions, glucose, nuclear-treaty monitoring, gravitational waves, markets, flight, battery. Each with the bound verified and the query certified.
Open the demo gallery