A tokamak plant twin you can orbit in a browser — and the fact that its reactor is not lit

Double-click Twin.command (macOS) · Twin.desktop (Linux) · Twin.bat (Windows). Each starts the server and opens your browser at the machine. Or, from a terminal:

./run.sh             # → http://localhost:8730/     the machine, in 3D, one command
./run.sh --scene cold   # the same machine as it stands today: 1 step, Q = 0
./verify.sh          # 21 checks, no network, no GPU — it prints its own elapsed time

Nothing to install: python3 and a browser. Read the terminal, not only the page — the page's own chrome says LIVE FROM THE KERNEL and it is neither, and the terminal is where the artifact tells you what you are looking at and what the panels will tell you wrong.

The shipped run, 20 solver steps. Seven KPI sparklines bend; T_EUROFER_max is a flat line at 599.8 K. That flat line is the whole finding, and it is visible before you read a number.

If you have 60 seconds — that flat line is a fusion plant reporting Q = 26 while its structural steel never warmed up. ./run.sh shows you the machine; the terminal it prints to tells you where to look and why the page's own LIVE label is wrong. If you have 10 minutes — FINDING.md, then ./verify.sh. If you have an hour — LIMITS.md §8: three rounds of adversarial review, one of which overwrote this artifact's own sealed evidence while its checks reported green. If you are deciding whether to trust any of it — ./verify.sh --falsify.

---

What this actually is — seven things, on orthogonal axes

None of these is a restatement of another, and each is separately checkable. If you only have time for one, take 5.

1 · A parametric kernel. One design vector, one emitted machine. 208 parameters, and from them the major radius, minor radius, elongation, triangularity, field, the coil set, the mesh, the sensor placements and 792 tracked quantities are all derived — never declared a second time. Change R0 and the whole machine re-derives, geometry through power balance.

2 · A 3D instrument that shows everything the kernel has. Browser, WebGL, no build step. 5 nested shells (plasma · first wall · blanket · vacuum vessel · shield), **16 toroidal-field coils

• 6 poloidal-field coils + central solenoid + divertor**, a 20,480-point sensor cloud classified by which of 11 physical quantities each sensor measures, plus power flow, solver dynamics, 59 gates (56 declared in the deck plus 3 the exporter derives — see axis 4, where the deck's 56 is the denominator), 56 plant subsystems and 6 diagnostic instruments. Drag to orbit, click a sensor. This is the same instrument the live renderer serves, byte-identical — not a screenshot generator.

And one thing the instrument cannot do here, which is part of the finding. It has a value/heat-map mode: pick a quantity and the cloud colours by measured value. Both shipped scenes carry zero sensor readings (live.n_readings = 0, qranges = {}), so the selector offers only classify by quantity and every sensor tooltip reads (no live reading) — visible in the interior shot below. The reason is the same one the whole artifact is about: the run was far too short to write any sensor output. An unlit machine has nothing to measure. Check C21 asserts this is disclosed rather than quietly missing.

3 · Governance that is mechanical rather than documentary. The machine is one immutable entity and a second copy of it is impossible, not merely discouraged: five independent locks — a command parser, a disk sweep, a transpile/run gate, chattr +i, and a pre-commit hook. When the plant database was retired for drift, it was retired by making writes raise, not by writing a memo. The same lock blocked me during this seal, which is why the kernel decks are quoted here and not copied — see LIMITS.md §3 for what that cost.

4 · Static verdicts in milliseconds, before any solve. A compiler over the deck, not a test suite: 27 of 56 gates proved incapable of ever going red because every input is constant, 6 guards that move but not through the channel they guard, 3 of 14 declared failure modes that cannot be injected at all, 21 "fake-tight" couplings where dJ/dv = 0 and Newton is blind to an edge that looks connected — and the step at which the machine can first light. No solver, no CPU, no waiting.

5 · A negative result, and a false acquittal underneath it. Across the shipped run — 20 solver steps, reporting Q up to 26.377 and 1.6576 GW of fusion power — the maximum structural temperature never leaves its 600 K initial condition by more than 0.172 K. The reactor was never switched on long enough to light. And the project's own printed ignition criterion cleared that run: it predicts the ignition step from the deck's declared dt growth of 3.0 while the solver realised 2.0, putting the real threshold at 24. The margin added to guard against exactly this is two steps too small. FINDING.md walks the chain, including what an adversarial reader took back.

6 · A working record a stranger can audit. Both eras of the programme as clonable git bundles, with a typed commit grammar — [type.region.impact.Dlevel±] why — so the history can be filtered by what kind of claim each commit makes rather than by what it touched. The unfiltered logs and the original→rewritten SHA maps ship alongside, so the filtering is auditable: a hash with a map row resolves to its rewritten commit, and a hash with no row was never rewritten and works as-is in the bundle. WORK_STYLE.md is generated from the bundles, including the 29.1% of commits that are machine-written noise.

7 · An artifact that checks itself, and has been shown able to fail. ./verify.sh re-derives every asserted number from the shipped data; ./verify.sh --falsify plants 30 violations — one per check, plus six different ways to smuggle a write path past the one check that has failed toward PASS twice — and confirms every one fires. Every document containing a count is generated, and MANIFEST.json carries every file's SHA-256, so editing anything makes the manifest stale and the check red. The check that protects the frozen evidence was caught passing on its own violation three times during this seal — as a regex, then as an AST blacklist, then under a reviewer who used os.posix_spawn to actually overwrite the sealed scene while the check said PASS — and it is now a whitelist at both levels, module and primitive, with no enumerated blacklist left in it. That history is in LIMITS.md §8 rather than tidied away, because it is the same defect the artifact's own finding is about.

---

What it looks like

Six states, all reachable with a mouse, all rendered from the shipped scenes by driving the real viewer — not mock-ups. Every panel value in them is a number ./verify.sh re-derives.

The interior, and a sensor with nothing to report. Quarter cutaway, zoomed into the plasma and divertor. The tooltip is a real sensor: temperature · sid 474 · var T · how point_interp · shell BSS — and (no live reading).

From above: the toroidal-field coil ring. 16 flat D-shaped TF coils in steel, the PF rings outside them, the central solenoid down the axis, the tungsten divertor at the bottom.

Cutaway off — the sealed machine. What the plant looks like as built, before you open it.

Coils hidden — the 20,480 sensors alone. Colour is which quantity each one measures. The wedge missing from the near side is the quarter cutaway. This is the sensor grid the kernel places from the design vector, and it is the clearest single view of what "20,480 sensors over 11 quantities" means.

The gates tab. 59 gates, and these are the ones reading BLOCK on the completed run — ctrl_burn, ctrl_beta, q_kink, trit_selfsuff, struct_verdict, mag_disrEM among them. Separately, 27 of the deck's 56 gates can never go red at all, because every input is constant (axis 4).

The other scene: the machine as it stands today. ./run.sh --scene cold. One step, Q = 0, T_EUROFER_max = 0 K, no sparklines because there is no history to draw. The contrast with the first image is the artifact's whole subject: the same machine, honestly reported.

---

Read this before the methodology

The power numbers are not a physical result.	They are 0-D algebraic trackers evaluated on a machine whose thermal and magnetic loops are open. psi is interpolated from a static file, so the magnets do not constrain the plasma; the coils and cryostat carry no temperature field at all. PP_PSOL reads 2.6437 × 10⁴⁰ W at step 1.
Nothing here re-derives the scene.	That needs a 2 GB engine tree, MOOSE + Cardinal, and a run directory that was never in the repository. Two scenes ship frozen; the server is read-only and has no exporter.
The git history is filtered.	Committed virtualenvs and mesh blobs were stripped to get 6.3 GB down to 31 MiB, which rewrote most commit SHAs. Three things ship to make that auditable: the complete unmodified log of each era, git filter-repo's own original→rewritten SHA map, and checks that prove the bundle and the log agree on every commit and all but two subject lines.
No human expert has reviewed the physics.	Not a plasma physicist, not a referee, not a colleague. Two cold readers, recorded in LIMITS.md §8 — the second one retracted part of the headline and found an off-by-one in it.
Not a theorem, not a benchmark, not a product.	It is an instrument, one negative result about the machine it instruments, and a working record you can audit.

What is actually established

claim	evidence	grade
The twin renders the whole machine from one kernel, and it works today	./run.sh, evidence/twin_run21.png, 0 console errors, 0 failed requests	reproduced — you run it
The structural temperature never left its initial condition in the shipped run	twin/scenes/run21.json, checked by checks/scene_facts.py	reproduced — from checked-in data
The 0-D power chain reports unphysical values (2.6 × 10⁴⁰ W, β_N = 39,020)	same file, same check	reproduced
The printed ignition criterion clears a run that is still cold, and the project's own +6 margin is also short	realised dt growth 2.0 vs declared 3.0 → threshold 24 vs 16; run took 20; hardened default 22	reproduced — the arithmetic is in checks/scene_facts.py. ⚠ partly retracted: the source project already knew the bound was best-case (FINDING.md §4)
The geometry half of the exporter still reproduces	shells, params, sensors, coils, envelope come back byte-identical on a re-export	measured on 2026-07-26, not reproducible here — needs the engine tree
The quoted deck lines say what is quoted	evidence/kernel_lines.md, with per-excerpt SHA-256	UNVERIFIED inside this artifact — the entity is deliberately not copied; verifiable only against the source

Reading order

1. FINDING.md — the chain from min(t/10,1) to a flat temperature line, and the false acquittal. Start here if you want to know whether the work is any good.
2. ./run.sh — the instrument. --scene cold shows the same machine as it stands today: one step, Q = 0.
3. LIMITS.md — every defect I know about, including the ones I could not fix.
4. DESIGN_NOTE.md — why a parametric kernel with one emitted entity, why the plant database was retired, why a sensitivity matrix rather than a port table. The judgement, not the API.
5. WORK_STYLE.md — every count recounted from the bundles, not typed: what the messages record, and what fraction of them are machine-written noise.
6. history/ — clone either era and read it yourself.
7. STORYBOARD.md — what was refused from the source project, with a reason per line.
8. SEAL.md — for whoever publishes it: the safe descriptions, and the four phrases that would misrepresent it.

What is in here

twin/	index.html (the 544-line instrument, byte-identical to the source's operate/viewer/viewer.html), vendored three.js r184 (read out of the minified bundle — treat as r184 ± a patch, see THIRD_PARTY.md), two frozen scenes, and a read-only server
evidence/	the two renders, the deck excerpts with SHA-256s, and the frozen output of the source project's own static checker
history/	two git bundles (31 MiB), the two complete unmodified commit logs (2.5 MB of text), and the two original→rewritten SHA maps
checks/	the handle, its falsifier, and the generators for every document that contains a count
generated/facts.json	every number this artifact asserts, in one machine-readable file
FINDING.md LIMITS.md DESIGN_NOTE.md WORK_STYLE.md STORYBOARD.md	the reading path
MANIFEST.json LICENSE THIRD_PARTY.md	provenance, MIT, third-party inventory
SEAL.md	for whoever publishes this: what may and may not be claimed, per venue
Twin.command Twin.desktop Twin.bat	double-click launchers — server plus browser, one click, on the three platforms
evidence/gallery/	the six render states shown above, produced by driving the real viewer

Requirements

python3 (3.9+) and a browser with WebGL. That is all — no pip install, no network access, no GPU, no MOOSE, no Cardinal, no dataset download. ./verify.sh additionally uses git, which it needs to open the bundles; it says so and skips those checks with a stated reason if git is absent, rather than passing.

Provenance

Cut from product.fusion-plant.winnie.moose-native.operate.lg.public.editable at commit b1d2482, and from its predecessor product.fusion-plant.openfusion.harness-on-kernel.operate.lg.public.editable at 293546df. The winnie cut is the tip after the six corrections this seal pushed back, so they are inside the shipped history rather than only described in it. Neither source repository was cleaned: they are the lab notebooks, and their mess is the record. Full detail, including every modification and every correction pushed back upstream, in MANIFEST.json.