bDroP

the drop desk — publish a drop under informed consent. public code · public evidence · explicit uncertainty · execution within informed consent.

this desk publishes one post on the Hive blockchain, signed with a posting key, from this tab and nowhere else. every step shows you what it is doing before it does it: the post's bytes are hashed in front of you, the disclosure is on the page before the button, and the key never leaves this tab's memory. one click is the whole gesture — nothing here asks twice, and nothing here is a promise of safety: what was observed is what gets published.
one desk, one gesture: hash the bytes, read the disclosure, sign in-memory, broadcast, take the receipt. no gates, no double-asks — the click is the consent.
a static page that builds a Hive comment operation, signs it client-side (hive-tx, secp256k1, posting authority) and hands the signed transaction — never the key — to the RPC endpoint you name. the sha-256 of the body is computed locally and compared against the expected digest before you sign; the receipt re-fetches the landed body and byte-compares it. the wire is inspectable below at every step.

approved editions

reading the estate's approved editions…

an edition appears here only after its bytes verified against the reported sha-256 (read same-origin from the estate tree, never a founder shuttling files between sessions). loading one fills the desk with its exact bytes. corrections fork new editions; an approved edition is never silently rewritten.

the drop

body empty — the desk is idle.

a mismatch does not lock the desk: it is shown, you decide. the bytes are the truth — if the verdict says DIFFERS, publishing is still your call, and the receipt will carry both hashes.

the disclosure, at the point of use

what this operation does: publishes the post above, irreversibly, on the Hive mainnet blockchain under the author named above, at the permlink named above.
what data it uses and reveals, to whom: the title, body and tags — to the public chain and every reader and front-end that ever mirrors it. the posting key — to no one: it signs in this tab and is wiped after the gesture; only the signed transaction is sent, to the RPC endpoint named below.
what the evidence establishes: the hash verdict above, and nothing more. acceptance of this disclosure never converts an UNVERIFIED finding into a proven one.
what remains uncertain: every scientific claim inside the body stays at its own evidence level; this desk certifies bytes, not conclusions.
cost and limits: resource credits from the author's Hive account; a post on Hive is free at point of use and capped near 64 KB — this desk warns past 60,000 bytes.
reversibility: none. a published drop can be edited only as a forked edition — the eternal law: preserve the edition, then preserve corrections against it.
RB01 is an experimental benchmark adapter. Its functional and performance results do not establish suitability for sensitive data or production use.

The constructors initialize separate RNG consumers from the same seed. The reporting seat observed overlapping streams within each party and matches between some generated bytes and protocol traffic. The security consequences remain unverified.

both statements ride the drop wherever the finding is shown. the security consequences of the RNG observation remain UNVERIFIED — here, in the post, and after publication.

sign & broadcast

how this drop is signed — three doors, chosen explicitly; nothing here is auto-selected for you:

…

the key lives in this tab's memory, held as zeroable bytes and bound to the current scope — author, permlink, body digest, disclosure version, endpoint. it signs here, in your browser, and is never stored, never logged, never sent. within the bound scope it signs repeatedly without asking again; any change to the scope requires the key again — authority never expands silently. erasure is honest, not theatrical: the field is cleared and the held bytes zeroed, but javascript cannot prove every transient string copy is gone, so this desk claims wiped-by-construction, never proven-erasure. wipe it yourself any time:

idle — the desk has not acted.
the wire, verbatim (cypherpunk register stands this open) 
the comment operation appears here before signing.
the signed transaction appears here after signing — signatures only, never the key.

the outbox — recoverable state

reading the outbox…

this browser keeps the desk's recoverable state — scope, body bytes, the signed transaction, the event log — persisted in local storage before anything is submitted, and never a secret. a restart or a lost response reconciles against the chain first: a drop that already landed is confirmed, never re-published; a permlink that exists with different bytes is reported as diverged and never edited; an unexpired signed transaction can be re-broadcast byte-identically without the key. a journal that cannot be read is quarantined: its bytes are preserved verbatim, every parseable operation is reconciled against the chain on its own, unresolved operations stay quarantined, and no new submission happens while any of them is unresolved — archiving the damaged bytes is a deliberate founder decision, never a silent empty rewrite.

the receipt

no drop published from this tab yet.

the receipt records what the gesture did: the event log (bMeter shape — events and references, never contents), the transaction id, the block that landed it, and the byte-compare of the published body against what you signed. the chain itself is the primary durable record — the edition's bytes live on it once confirmed; this tree mirrors, it is never the indispensable copy.

preservation beyond the chain

after a drop is confirmed, this panel composes the preservation bundle — the receipt and the edition, with manifest sha-256s — and can store it on Autonomi through the estate's hosted ANT purchaser (Agent 20's shared module, bound invoices, 100-ANT per-file ceiling). the bundle is FROZEN once with its digest before any price is asked — a retry resumes the same artifact and the same purchase journal, never a second purchase. the ETH network-fee limit you set below is your own authorization; the invoice is authorized only after you review the bound file, payer, amounts and ceiling. the first-party signer is the estate's isolated keychain; a browser wallet is an external door you choose explicitly. nothing is ever spent silently.