The product page for T&R, the operating system. A FreeBSD 15 distribution assembled from pkgbase, downloadable, shipping its own verifier.
Not a fork of it — literally it. Until 2026-08-25 the ComputeDriven root was this page: measured by section, ~79 KB of the root's ~99 KB of body copy was about the operating system, 8 KB about Cloud, and 11.8 KB about the studio itself, on a domain with three products. The hero made a studio-level claim and then handed you a FreeBSD image.
So the split was done the way it actually happened rather than the way it would look tidiest: this repository carries the original history — 24 commits, including the 13 that touch this page — and c-u-l8er/computedriven.com is the one that got a new page. git log here goes back through Drop "no telemetry" — it was a claim about a file, printed on a website and everything before it, because those commits are about this HTML.
What changed in the move: the title, rel="canonical", og:url, og:image, and property="computedriven" → property="tr" on the nav. Five lines. Nothing about the operating system was rewritten.
Where the text below says "this page" it means this one — the claims about fonts, images, the beacon and the form all travelled with the HTML they describe. The root's own version of those concerns now lives in the computedriven.com repository, and the two must be kept honest separately; neither one's README is evidence about the other's page.
One static page, no build step, no npm. index.html carries its own CSS and a little vanilla JavaScript; img/ holds the screenshots. amp-nav.js, fonts/ and 404.html are here so this repository deploys standalone with no reference back to the root.
`amp-nav.js` here is v0.11.0, taken from ampersand-nav/src/amp-nav.js, the canonical source. The version this repository's own history carried was v0.8.3 — stale by three minor versions, because the committed copy had drifted from the source that sync-nav.sh deploys. If you ever find yourself reading the nav out of git log rather than out of ampersand-nav/src/, that is the drift happening again. Do not edit the nav here.
`property="tr"` has no `PLACEMENT` entry in `amp-nav.js` yet, so this page renders the portfolio bar with no placement band above it. That is the documented graceful-degradation path, not a bug — but it does mean the band saying where T&R sits in the ComputeDriven world is absent until a tr entry is added to both LINKS and PLACEMENT.
It has exactly one third-party runtime dependency, and it is worth naming rather than burying: the contact form posts to Formspree. Nothing else on the page calls out at load, and the page still renders and downloads work with formspree.io blocked — only the form stops.
That sentence was false until 2026-08-16 and had been for as long as it existed. The head carried a fonts.googleapis.com stylesheet, so every visitor made a request to Google that logged their IP before a single word rendered — on a page whose headline product feature is no first-boot download. The fonts are self-hosted now: fonts/space-grotesk.woff2 and fonts/jetbrains-mono.woff2, latin subset, 53,720 bytes for both. Verified with performance.getEntriesByType('resource') — zero entries outside the origin.
One thing to know before touching them: each file is a variable font covering the whole 400–700 range. Google served byte-identical woff2 for every weight requested (checked with sha256 across 400/500/600/700), so there is one file per family and the @font-face declares font-weight: 400 700. Declaring a single weight there would silently flatten every bold on the page. Measured after the change: at 64px, weight 700 renders 1.50× the ink of weight 400 in Space Grotesk and 1.31× in JetBrains Mono, so the axis is genuinely live.
Data driven keeps the result. Compute driven ships the derivation.
A claim is compute driven when the artifact carries enough — canonical input, executable semantics, a derived identity and its provenance — for an independent machine to derive the claim again.
Re-derivation proves fidelity, not correctness. A wrong computation re-runs perfectly and is still wrong.
The first proof object is T&R, a FreeBSD 15 distribution assembled from pkgbase. Images are published as GitHub releases on that repo; this page links to them directly and quotes their sha256 sums.
The #join section exists because the portfolio nav's CTA reads "Join ComputeDriven" and there was nothing here to join. What it offers is not a mailing list. The page's last admitted gap — every measurement was taken on our machines — is the one gap we cannot close ourselves, so joining is defined as supplying the missing thing: a second machine.
Reports arrive as GitHub issues on travel-and-rrabbit, filed through .github/ISSUE_TEMPLATE/boot-report.yml in that repo.
The two counts in `.jn-count` are hand-maintained. Nothing on this page fetches at runtime, so Reports received and From real hardware are stale by construction. Change them in the same commit that changes the date beneath them, and count only what is actually filed — a page that inflates its own evidence count has lost the whole argument. When the first report from real hardware lands, the "Never booted on real hardware" gap card must change too.
Under the boot-report grid, posting to https://formspree.io/f/xaewoadr. No email address appears anywhere on this page — that is the point of using an endpoint, so do not reintroduce a mailto: as a "fallback".
It is a real <form> with action and method, so it works with scripting off; the script only upgrades it to an inline reply instead of a redirect to Formspree's own thank-you page. _gotcha is Formspree's honeypot and is positioned off-screen rather than display: none.
"Sent" is printed only on an actual 2xx from the endpoint. A form that thanks you on submit and drops the message is precisely the failure this site is about. Failures print the reason the endpoint gave, and the typed message survives so it can be retried. If you touch that handler, keep the three paths honest: server error, network failure, success.
Removed 2026-08-16, the day it was found false. A real browser loading computedriven.com fetches static.cloudflareinsights.com/beacon.min.js. It is not in `index.html` and not in the HTML the server returns to `curl` — the host injects it at the edge, so neither reading the repository nor curling the site reveals it. It took driving the live domain in a real browser and listing performance.getEntriesByType('resource').
Travis's call, and the right one: remove the claim rather than defend it. Any host can do this, the switch is not in this repository, and a promise you cannot audit from your own source is not a promise. The download line under the hero now reads free · no account · nothing to sign up for — that describes the file, which can keep its promises.
The contact section names both third parties in full: the form's formspree.io POST and the injected beacon. Do not re-add "no telemetry" anywhere without first re-running the check below and confirming the beacon is gone.
agent-browser open https://tr.computedriven.com/
agent-browser eval "performance.getEntriesByType('resource').map(r=>new URL(r.name).host).filter(h=>h!=='tr.computedriven.com')"The host changed on 2026-08-25 and the beacon question reopens with it. The finding above was measured against computedriven.com. This page now answers on a different hostname, possibly from a different Pages project — so whether the edge injects a beacon here is unmeasured, not inherited. Run the check against this host before saying anything either way.
The general lesson, worth more than the fix: this page verifies itself by reading its own tree, and a hosted site is not its tree. Anything the platform injects is invisible to every check that runs locally.
Measured 2026-08-16: `img/` was 11.43 MB, and 8.08 MB of it was the greeter alone — a 5120×2880 PNG of stylised artwork, which is the wrong codec for that content by an order of magnitude. The head was advertising 53,720 bytes of self-hosted fonts on a page shipping eleven megabytes of screenshots.
Everything is WebP q90 now. 1.13 MB, down 90.1%, and the conversion was checked rather than assumed: RMSE against the PNGs is 0.4–0.6%, and the greeter's darkest gradient — where banding would show first on a page this dark — was compared crop-to-crop at 1:1. Lossless WebP was measured too and only reaches ~55–63% of PNG, so the saving is genuinely in the lossy step.
`img/og-card.jpg` is the exception and must stay a JPEG. Link-preview crawlers are the one client that cannot be assumed to decode WebP, and a card that fails to render is the entire reason og:image exists. It is the hero frame at 59 KB. Regenerate it whenever the hero image changes — nothing checks that it matches.
If you drop a new screenshot in, convert it:
magick img/whatever.png -quality 90 -define webp:method=6 img/whatever.webpimg/ holds only figures that show the current shell. The 2026-08-09 batch — m2-flat, m3-tubes, m4-overview, m8-native-flat, tandr-rrabbit-boot — was deleted on 2026-08-16, not merely unlinked. Four were already off the page; m3-tubes.png was still the third figure in #aboard and showed the concentric rainbow test pattern in windows with none of the instrument styling the shell now has. A figure that makes the software look more experimental than it is costs the same credibility as one that flatters it.
Every figure states its date, machine and rendering path in its caption. The one exception is tandr-greeter.jpg, whose background art has no recorded provenance, and the caption now says so rather than leaving it to be asked.
The gate pair (tandr-gate-enter.png / tandr-gate-exit.png) is meant to be read side by side — blue panels are what you can do on arriving, green are ways out, and the counter moves 1:0-2 → 1:2-2 between them. Keep them the same crop size or the comparison stops working.
The hero changed on 2026-08-16 from tandr-three-apps.png (three native GTK applications on the road) to tandr-runefort.png (a RuneFort layout as a pane), with tandr-bendscript.png replacing the foot terminal close-up. The two protocols now render inside the shell and that is the newer claim.
`tandr-three-apps.png` was NOT deleted — it moved into `#vehicle`. Three paragraphs there are evidence-free without it, and "unmodified native GTK applications, on the road, with no /dev/dri" is the hardest thing on this page to fake. If you are tempted to remove it, read the section first: it is the photograph that argument is about, and the og:image used to point at it.
The trade is worth stating because it is a real loss: the three-apps frame is the better "what the hell is this" image, and the hero now leads with a claim that reads as a normal UI until you notice it is standing on a road. That was Travis's call, 2026-08-16.
tandr-three-apps.png was retired, not re-shot — 2026-08-16Its right mirror read "C · CAMERA and R · REEL are not built". The reel shipped, so the page was publishing a frame that contradicted the ladder two sections above it. It was deleted rather than annotated, and #vehicle now carries tandr-papers.png — the same shell on the day the page was edited, carrying two .bend documents where the applications stood.
The native-application claim survives as a dated sentence with no photograph, which is how this page treats every other claim it cannot currently show. Do not quietly restore a picture for it; either re-shoot one or leave the date.
tandr-reel.png was added to #tracks for the same reason: the ladder marks TRACK and REPLAY live_local and there was no picture of the instrument that proves it. It shows one track. A busier reel is a better picture and exactly the same claim — if you replace it, keep the caption's "this shell has one track on it" honest to whatever the new frame shows.
A current native-application photograph is still wanted, and is blocked by two separate faults found on 2026-08-16:
**RRABBIT/proxy/applications.json points /tandr-tr4-foot at ssh port
2223. The running tr4 guest forwards 2224.** Nothing listens on 2223 — ssh -p 2223 is refused, ssh -p 2224 -i PARKVPS/var/parkvps_ed25519 [email protected] answers tr4 and has both foot and /usr/local/bin/waypipe-tandr. So the entry cannot launch as written. That file belongs to the shell lane, not to this site, so it was not edited.
The proxy accepts the launch and spawns nothing. __launch(...) returns
without error, no waypipe process appears, and the console shows only Session created. This matches the documented stale-session trap in RRABBIT/docs/RUNBOOK.md — a proxy session outlives the page, and the fix is to restart the proxy AND reload. The proxy on 8912 belongs to another session and was left alone.
Also seen while trying: the shell took a shader compile error → WebGL context lost on one load (An error occurred compiling the shaders), which is a third distinct fault from the two __whyNoContext() names. A clean browser cleared it.
To finish this: restart npm run proxy, fix the port in applications.json, __launch('/tandr-tr4-foot') two or three times, and shoot at 1920×1080 with the idle brake fed. Then delete this section.
Taking new ones: drive the shell from source (npm run m0, port 8911) with window.__op({op:'park', road:'<lane>', z:<n>}) — entrance gantries sit at z=-180, exits at z=-2140, and __gantry() reports both. Feed the idle brake while you shoot (setInterval(()=>window.__fed(), 120)): without it the FRAME gauge reads ~100 ms/frame, which is the brake and not the shell, and publishing it would be a false claim in the unflattering direction. Awake, it reads 16.7.
Every status on the page is measured, sourced, or marked not built. If you change a number, change the measurement record under it in the same commit — including the date and the machine. If a claim gets weaker, say so; the "Untested & unfinished" section is a feature, not a backlog.
Its own repository — c-u-l8er/tr.computedriven.com — deployed by push to Cloudflare Pages, same as every other property. The directory is the site root: no build step, no output directory to configure, index.html is what serves.
As of 2026-08-25 `tr.computedriven.com` has no DNS record, so pushing this repository does not by itself make the page answer. It needs a Pages project with tr.computedriven.com attached as a custom domain. Until that exists:
every https://tr.computedriven.com/… link on the ComputeDriven root page is
dead — and it is the root's only live door, the one product of three that is actually shippable today;
rel="canonical" in index.html names a host that does not resolve, which is
worse than naming none, because crawlers act on it.
Both were written for the destination rather than the interim, deliberately. Set up the Pages project before pushing `computedriven.com`, or the root ships with its working door pointed at nothing.
Check it with DNS rather than a browser — a 404 from a parked host and a missing record look identical in a tab:
getent hosts tr.computedriven.com