[Flotapponnier]

A new quote-only harness. No key, no wallet, no signing path — every endpoint answered keyless when measured on 2026-10-25, and a credential demand becomes a visible probe failure rather than a silent key lookup. Deliberately not grafted into bridge-monitor, which is 10,377 lines and executes real transactions with a funded wallet.

What it measures, each verified against a manual probe before shipping

metric	reading
privacy_round_trip_bps	325.009 for ZEC at 0.1 BTC on Maya, against 325.1 measured by hand over five samples
privacy_round_trip_seconds	759, matching exactly
privacy_exit_cost_bps	size impact at 0.01 and 0.1 BTC
privacy_shielded_payout_accepted	near-intents 1, maya 0 with reason memo_too_long
privacy_xmr_*	7 to 9 makers, 1.75 % dispersion

The size selector, and a reading that looks like a bug

The round trip is not monotonic in size: ZEC came back at 77.5 bps for 0.001 BTC, 40.7 for 0.01 and 325 for 0.1. The fixed outbound fee dominates the small end and depth dominates the large end, so the cheapest size is in the middle. A board showing one size would miss that entirely.

The guard this is built around

The shielded question was attempted three times before this code and voided three times, always identically: an address remembered or reconstructed rather than read, whose checksum failed, so the rail refused the shielded and the transparent probe. Two identical refusals say nothing about a rail.

So both destinations are checksum-verified at startup, a failure disables the delivery probe instead of publishing a verdict, the transparent probe runs first as the control, and a shielded refusal is recorded only when the control passed. addresses_test.go pins the exact strings that fooled the earlier attempts, including one built by hand from a truncated error message.

Two bugs the live run caught, both mine, neither visible from the code

1Click answers 201 Created, not 200, and the probe tested code == 200. Python's urlopen treats every 2xx as success, so the manual measurement passed while the harness read the same answer as a refusal. Left alone this would have published "NEAR Intents cannot pay a shielded address" — the exact opposite of what five manual probes established.

The exit-cost reference was the same quote at 1/1000 of the size, which falls below Maya's own minimum on the small rungs: 4 of 6 probes refused and the two that answered produced 2062 bps. It now measures against the smallest rung that actually quotes, at no extra call. And the reference rung is not published at all — measured against itself it is 0 by construction, and a row reading 0 bps would be read as a frictionless exit.

Also found while smoke-testing: the metrics port was hardcoded, so the probe could not start on a host already running another. METRICS_ADDR now.

The cohort is small on purpose

Asset lists read off each venue rather than taken from its framing. Maya carries ZEC and DASH, and its ZEC pool was 47.8 % of all Maya volume that day. NEAR Intents carries ZEC and no XMR in 205 tokens. Chainflip carries no privacy asset at all, confirmed with two controls that pass while ZEC, XMR and DASH refuse. THORChain was unreachable on twelve hosts, one with a certificate that expired on 7 February 2024, so it is absent rather than assumed.

No spec ships here

A metric_panel with no value deletes its row, so a board published before this accumulates would be an empty table under a confident title. Specs follow once the harness has a day of data.

Gates: gofmt -l . clean, go build ./..., go vet ./..., go test ./... pass.