website: the sealed run on the scoreboard and a rewritten blog post

packages/website/public/llms.txt

@@ -25,7 +25,7 @@ New, but no longer unused. It has been run end to end against a real live paid e
 - [Official sources and payment addresses](https://tokenizen.nl/en/notes/official-sources): the official repository, payment request, price and payment address of Bug Bounty Intelligence (5 USDC on Base through x402, address 0x015Eb036560216B3051339061FF68A207E0fe88f), and the command that checks them. Any other address given for it is not ours
 - [Scoreboard](https://tokenizen.nl/en/scoreboard): how many of the findings that human auditors already found in closed contests our smart contract scan finds, one row per measurement, each linking to the rule written before the run and the result after it, with the sealed run and the contests after today still empty on purpose
 - [Free x402 endpoint check](https://tokenizen.nl/en/x402-check): paste the URL of an x402 route you run and see, from one anonymous request that never pays, whether the payment request passes the official buyer schema and how far up the receipt ladder it gets. Nothing is stored
-- [We measured our scan. It found 0 of 40.](https://tokenizen.nl/en/notes/we-measured-our-scan): what we measured on closed audit contests, what we changed, and how the next test is sealed with a pre-registration and a hash so that we cannot bend it. The results page lists the misses.
+- [We measured our scan. It found 4 of 105.](https://tokenizen.nl/en/notes/we-measured-our-scan): the one run on 8 sealed audit contests, written down before it ran: production found 1 of 105 known findings, the new version 4, our own bar was 5 more and it found 3, so production stays as it is. The results page lists the misses.
 - [Check. Pay. Prove.](https://tokenizen.nl/en/notes/check-pay-prove): one real AI-agent payment on Base mainnet, checked before, paid through x402 and proven from the chain, with the commands to repeat it, six numbers each with a place to check it, and the limits stated first
 - [A signed receipt that cannot name its own payment](https://tokenizen.nl/en/notes/a-signed-receipt-that-cannot-name-its-own-payment): a live x402 receipt that verifies and still cannot say which payment it is about, the measured cause in the reference implementation, and the corrections that followed in public
 - [733,203 attestations were taken back](https://tokenizen.nl/en/notes/733203-attestations-were-taken-back): a count of revocations across the three largest EAS indexers, showing that every revocation is an issuer withdrawing its own statement and the counterparty has no move at all

packages/website/src/components/pages/scoreboard-page.test.tsx

@@ -15,11 +15,13 @@ describe("ScoreboardPage", () => {
     expect(html).toContain("0 of 40");
     expect(html).toContain("7 of 85");
     expect(html).toContain("1 of 85");
+    expect(html).toContain("4 of 105");
+    expect(html).toContain("1 of 105");
   });
 
   it("says Not measured yet for the rows that have no result, and never invents one", () => {
     const pending = SCORE_RUNS.filter((r) => r.status === "pending");
-    expect(pending.length).toBeGreaterThanOrEqual(2);
+    expect(pending.length).toBeGreaterThanOrEqual(1);
     for (const run of pending) expect(resultText(run)).toBe("Not measured yet");
     expect(html.split("Not measured yet").length - 1).toBe(pending.length);
   });

packages/website/src/components/pages/scoreboard-page.tsx

@@ -110,7 +110,8 @@ export function ScoreboardPage() {
               <li>
                 The contests were split into a development set and a sealed set by sorting them on a hash that includes the hash of
                 Base block {SEED_BLOCK.number}, which nobody here could choose. The sealed set is committed with the hash{" "}
-                <span className="break-all font-mono text-xs">{SEALED_SET_HASH}</span> and has not been run.
+                <span className="break-all font-mono text-xs">{SEALED_SET_HASH}</span> and was run once, on 24 October 2026. The
+                set is published now, so anyone can recompute that hash.
               </li>
             </ul>
           </CardContent>
@@ -121,7 +122,7 @@ export function ScoreboardPage() {
           <CardDescription>Five steps, in the order we take them.</CardDescription>
           <CardContent>
             <ol className="list-decimal space-y-2 pl-5 text-sm leading-relaxed">
-              <li>The sealed run: contests nobody here has seen, with the decision rule fixed in advance.</li>
+              <li>The sealed run: contests nobody here has seen, with the decision rule fixed in advance. Done on 24 October 2026; the bar was not met.</li>
               <li>Contests that appear after today, with the hash of our report committed before the results are published.</li>
               <li>A test that makes each reported flaw actually happen, so a finding does not rest on anyone's word.</li>
               <li>A flaw that a real owner confirms.</li>
@@ -139,8 +140,8 @@ export function ScoreboardPage() {
                 judge statement. Anyone can re-score them.
               </li>
               <li>
-                Private: how the scan finds things. Before the sealed run we publish the SHA-256 of the files it uses, so they
-                cannot change afterwards.
+                Private: how the scan finds things. Before the sealed run we published the SHA-256 of the files it uses, so they
+                could not change afterwards.
               </li>
             </ul>
           </CardContent>