docs(site): document the review pass on the published site

Two new chapters (epistemic honesty, privacy) and updates across
concepts, beliefs, conversation, cognition, graph, replay, providers,
security, decisions, development, glossary, API, interface tour and the
landing page. Rebuilt into dixon.cx (website commit d541bc9).

docs/site/pages/concepts.md

@@ -29,19 +29,23 @@ Every proposition Noema stores says what kind of knowledge it is:
 | inference | derived by reasoning from other items | 0.25 |
 | opinion | a preference or judgement, not truth-apt | 0.40 |
 
-A mind that has only ever been *told* something holds a claim. It becomes a belief with higher confidence only when independent evidence arrives, and the arithmetic that got it there is visible on the belief page.
+A mind that has only ever been *told* something holds a claim. It becomes a belief with a higher score only when independent evidence arrives, and the arithmetic that got it there is visible on the belief page.
+
+## Observations, assertions and beliefs
+
+Three things are kept apart that most systems blur. An **observation** is what arrived: a message, a document, a metric, a tool's output, with its channel and trust. An **assertion** is a deterministic reading of a statement inside an observation: who is attributed (the speaker, or someone they quote or report), their stance (asserts, denies, doubts, questions, supposes), how firmly they put it, whether it is negated, hypothetical, reported or quoted, and how confident the reading itself is. Assertions are append-only and recorded whatever happens next. A **belief** is the mind's own proposition, and an assertion reaches it only as one piece of evidence attributed to the person behind it; questions, hypotheticals and quoted speech create no belief, and expressed doubt counts against. "Andy said the pump is failing" and "the pump is failing" are therefore different rows, and the mind can hold the first with certainty while holding the second tentatively.
 
 ## Trust levels
 
-Every input carries a **trust** level attached at the boundary where it arrived: operator, user, system, source or low. Trust weights evidence and bounds what an input can cause. A research-folder document is always low trust; a webhook or metric is source trust; a tool's output carries the tool's trust and is never parsed as instructions.
+Every input carries a **trust** level attached at the boundary where it arrived: operator, user, system, source or low. Trust weights evidence and bounds what an input can cause. A research-folder document is always low trust; a webhook or metric is source trust; a tool's output carries the tool's trust and is never parsed as instructions. Trust is the starting point for a source's credibility; a source also earns or loses **reliability** per subject from how the beliefs it supported fared against predictions and operator corrections, never from agreeing with the mind.
 
 ## Memory kinds
 
-Long-term memory is divided into **episodic** (something that happened, with a time), **semantic** (a generalisation or fact), **procedural** (how to do something) and **autobiographical** (something about the mind itself: an operator changed its configuration, it was forked, it was corrected). Memories have status (active, retracted, superseded), importance, salience, activation that decays and recovers on retrieval, credibility from their source, and typed relationships to other memories: related_to, caused_by, contradicts, supports, depends_on, belongs_to, discussed_with, observed_during, derived_from, similar_to and follows.
+Long-term memory is divided into **episodic** (something that happened, with a time), **semantic** (a generalisation or fact), **procedural** (how to do something) and **autobiographical** (something about the mind itself: an operator changed its configuration, it was forked, it was corrected). Memories have status (active, retracted, superseded), importance, salience, activation that decays and recovers on retrieval, credibility from their source, and typed relationships to other memories and entities drawn from one shared vocabulary: `co_occurs_with` and `temporally_precedes` for what was seen together or in order, `possibly_caused_by` for a causal hypothesis the association process proposes, `caused_by` for an established cause that only an operator may assert, `asserted_by` for who said a thing, and `related_to`, `contradicts`, `supports`, `depends_on`, `belongs_to`, `discussed_with`, `observed_during`, `derived_from`, `similar_to` and `follows`. Association is never written as causation.
 
 ## Beliefs and evidence
 
-A **belief** is a proposition with a subject, an epistemic kind, a status (hypothesis, tentative, likely, accepted, contested, rejected or superseded), a prior and a confidence computed from its evidence. Evidence rows point at memories, events, operator statements or tool results, each with a direction (for or against), a weight and the credibility of its source. Beliefs keep an append-only version history, may carry alternatives, and can be linked to each other (supports, contradicts, depends_on). The [beliefs page](beliefs) gives the confidence formula.
+A **belief** is a proposition with a subject, an epistemic kind, a status (unknown, hypothesis, tentative, likely, accepted, contested, rejected or superseded), a prior and an **epistemic score** computed from its evidence. The score is a deterministic ranking of support given what the mind has seen, not a probability that the proposition is true; a calibrated estimate is shown separately, and only when enough of the mind's own predictions have been decided to justify one. Evidence rows point at memories, events, assertions, operator statements, tool results or predictions, each with a direction (for or against), a weight, the credibility of its source, and its **provenance**: a derivation (direct, assertion, operator, external, prediction, consolidation, inference, reflection, dream, retrieval) and a **family**, the independent source it ultimately rests on. Support is counted per family, so one source repeating itself or a consolidation re-expressing it cannot inflate a score. **Unknown** is a real status: a belief with no live evidence either way is neither tentatively true nor false, and the mind says it does not know. Every belief has a **temporal scope** (persistent, transient or unknown) and, for transient states, a validity interval: a later observation of a changed state supersedes the earlier one instead of contesting it, and the history of states is kept. Beliefs keep an append-only version history, may carry alternatives, and link to each other (supports, contradicts, depends_on). The [beliefs page](beliefs) gives the arithmetic and the meaning of every number.
 
 ## Workspace and working memory
 
@@ -61,7 +65,11 @@ A **capability** is a named, typed, risk-classed tool registered in code. Nothin
 
 ## Snapshots, forks, replays, experiments
 
-A **snapshot** is a checksummed archive of a mind's state at an event position. A **fork** is a new mind restored from a snapshot, sharing the history before it by reference. A **replay** re-runs recorded stimuli through a sandbox fork and compares the outcome step by step. An **experiment** is a snapshot plus overrides, a stimulus script and expectations, run in a sandbox with stored results.
+A **snapshot** is a checksummed archive of a mind's state at an event position, recorded with the **runtime identity** that produced it: build, schema version, a secret-free configuration digest, personality version, policy digest, model routing and prompt versions. A **fork** is a new mind restored from a snapshot, sharing the history before it by reference; policies are never carried across, because authority is not state. A **replay** re-runs recorded stimuli through a sandbox fork, compares the outcome step by step, and labels itself an exact candidate, a different build or incompatible according to how its identity compares with the snapshot's. An **experiment** is a snapshot plus overrides, a stimulus script and expectations, run in a sandbox with stored results; its **variants** fork the same snapshot under different configuration, personality or per-role model routing and are compared deterministically.
+
+## Redaction
+
+History is append-only and content can still be removed. A **redaction** replaces a row's content with a marker while keeping its identifiers, links, scores and timestamps, writes an append-only ledger entry with a hash of what was removed, cascades along recorded derivations, scrubs stored snapshots and appends an event so that the removal is itself part of history. The [privacy page](privacy) sets out what it does and does not guarantee.
 
 ## The interpretation boundary