The Air-Gap Decoder listens across the open air and recovers a crossing's gate and direction by ear — and it is honest that it can never recover the witness from sound, because the witness doesn't ride the audio. It rides here. This is that other channel: sealed, wired, lossless — it carries the exact part the air drops, and proves it arrived byte-for-byte with a live SHA-256 seal. Where the ear can mis-hear, the seal cannot.
Pick the gate and direction (the envelope the air can also carry), then write the witness — the part only this channel holds.
Seal the crossing and the witness is fixed to a hash. Change one character and Verify rejects it — the lossless inverse of a mis-heard tone.
Each sealed crossing links the one before it — seal = SHA-256(prev · canonical). Tamper with any past witness and that row and every row after it breaks. This is the witnessed hash-chain the air gap can't form.
A LIMEN crossing renders across four registers. Only two can carry the witness across a gap — and the air-gap decoder rides the one that can't.
What it guarantees. The witness is recovered byte-for-byte or not at all. The seal is a real crypto.subtle SHA-256 over direction · gate · witness; the chain links each seal to the previous one, so any edit is detectable and propagates forward. There is no "mis-hearing" — a tampered glyph fails verification deterministically.
The cost — the honest inverse. This buys exactness by giving up the air gap. The decoder is wireless and covert but witness-blind; the glyph channel is witness-bearing and exact but needs a real link — you must actually carry the bytes. You can't have both at once: that's the trade the pair makes visible.
Faithful to the spec. Per LIMEN, the witness travels only on the glyph channel — never on the audio. So the decoder showing «» (a blank witness slot) isn't a bug; it's the truth. This page is where that slot gets filled, sealed, and proven. (SHA-256 needs a secure context — it runs on the live https:// page and on localhost; opened as a bare local file it may fall back to a non-cryptographic digest, flagged at runtime.)
The decoder is honest about the half it cannot hear. This is that half — carried on the wire, sealed against the world, the witness the air was never going to bring you. Neither channel is the message alone. Two halves, one crossing.