The Receipts

Every dish-level dietary claim theBEAT publishes is either traced to a first-party source — the venue's own material or a named certifying authority, with the exact page and the date we read it on file, re-verified on a clock — or an explicit question. Where we hold the venue's own sentence, we print it verbatim; where we hold the document but not a quotable sentence, we name the document and the date rather than paraphrase it into quotation marks. This document is the corpus, the rules that govern it, and the defect record, rendered entirely from the repository's own data. Nothing here is hand-typed.

§0 · Provenance of this document

§1 · Acute receipt coverage — weakest rows included

A coverage table that only carried its good rows would be marketing. The low rows are printed because they are true.

$ python3 scripts/receipt_coverage.py --json  ·  unsourced queue: 338 (drains via the sourcing desk)

§2 · The corpus — every receipt, one row each

221 receipts on 156 dishes. Confidence: reported 29 · verified 192. Tier: C1 29 · C2 163 · C3 29 · none 0. Each receipt expires 90 days after its read date (ProvenanceSLA.reverifyDays, read from Provenance.swift at generation) and enters Discovery/reverify-calendar.md.

$ python3 scripts/export_provenance.py

§3 · The rules that run — each citing its enforcement

• Fail-closed two-shelf model — a tag with a dated receipt renders as a green claim; a tag without one renders amber as a question to relay to the kitchen, never as a claim. (TheBEAT/TheBEAT/Models/DietaryConfidence.swift, chip door.)
• Re-verification SLA — every receipt expires after 90 days (ProvenanceSLA, Provenance.swift) and lands on the expiry calendar.
• Contradiction deletes — a dish whose composition contradicts a tag loses the tag at decode (DietaryTagGuard) and at scan (scripts/dietary_contradiction_scan.py).
• The seed door refuses unsourced acute tags — ACUTE_HARM_TAGS (shared lexicon, imported not copied — scripts/census_register_gate.py) cannot be seeded without a receipt.
• Orphan control — a receipt whose (dish,tag) leaves the census is caught by scripts/receipt_orphan_gate.py on every push.
• OTA overlays are strips and suppressions only — the remote path can remove or hide a claim, and is structurally refused the power to add one (Discovery/provenance/changes.jsonl is the log).
• The gate suite — 82 distinct gate/tool invocations wired into the pre-push preflight, and every testable gate carries a self-test the meta-gate enforces on each push. Live status is one command (python3 scripts/gate_selftest_runner.py) — deliberately not embedded here: the suite's own probes mutate a shipping file while running (B-439), so this document cites the instrument rather than firing it.

$ grep -oE '(python3|bash|node) scripts/[A-Za-z0-9_./-]+' scripts/preflight.sh | sort -u | wc -l  ·  $ python3 scripts/gate_selftest_runner.py

§4 · The defect record — kept in public, on an SLA

A trust system that cannot show you its failures is asking to be believed. Ours are ledgered, dated, SLA'd, and three of the ugliest are quoted below on purpose.

• F-0813-02 — Shipped live (isActive:true) with .kosher + .dairyFree for 12 weeks after the venue permanently closed. Closure: yeahthatskosher.com/2026/05/oronami-has-permanently-closed-in-washington-dc/ (fetched live 2026-08-13; article:published_time 2026-05-21T00:27:01Z, author Dani Klein): "OroNami, the kosher sushi lounge and bar that brought late-night dining to Washington DC's Foggy Bottom neighborhood, has permanently clos…
• F-0812-02 — We hid a real restaurant on a closure report about a different address. The record read .closed citing "PoPville closure report + closed-listing — The Little Beet DC (1212 18th St NW) closed", asOf 2026-07-24, and the dish was flipped isActive:false. The 18th St store did close. Mount Vernon Triangle did not. The venue's own locations page lists 495 K Street NW, Washington DC 20001, (202) 800-8100, Mon–Fri 10 AM–8 PM…
• F-0817-05 — Carrier still holds .glutenFree while a sibling L.P. Steamers crab literal at :7494 had .glutenFree stripped 2026-07-15 (F-0715-06) on venue-level evidence: the crabs are "steamed in Old Bay, BEER, and vinegar — beer is barley." One steam pot, one method; this carrier's prose omits the steam liquid so the keyword scan never fired (§7.4 / PART-D limit — fatal ones live where the script can't see). The 07-15 strip neve…

source: Discovery/integrity-findings-ledger.md (appended by the daily tag-safety desk)

§5 · The vote-weight ladder — earned, never bought

No tier changes a vote's weight. Track record does, on one published ladder, parsed from the shipping model at generation time.

source: TheBEAT/TheBEAT/Models/Vote.swift (RaterLevel.voteWeight)

§6 · The change log — what the remote path actually did

source: Discovery/provenance/changes.jsonl (append-only)

§7 · Honest gaps, stated before anyone asks

• The unsourced-acute drain queue holds 132 dishes (scripts/acute_tag_provenance_baseline.json) — frozen, ratcheting down via the sourcing desk, and every one renders amber-ask until sourced, never as a claim.
• The weakest receipt-bearing shelf is dairyFree at 20% of census-effective dishes — printed here because a corpus is judged by its thinnest shelf.
• Geographic concentration: 219 of 221 receipts are DMV venues — depth-first by design, and a real limit on national claims today.
• The community score blend is live code but inert data — at launch every score is the editorial baseline and the board's own label says so; the blend activates as votes arrive. (Stated on the site's engine page in the same words.)

Generated 2026-08-27 · every section regenerable by its printed command · this file: python3 scripts/export_receipts_exhibit.py