GeoMetals / treasuremap.ch — Content Removal Record

What this is

On 19 August 2026 we audited every page and every backend module behind treasuremap.ch against the code that actually runs. A substantial part of the site's marketing and "intelligence" layer was fabricated: invented quotes and metrics attributed to real, named third parties; invented citations; product capabilities with no implementation anywhere in the codebase; and displayed figures generated at page load by Math.random() or derived from an MD5 hash of a record's coordinates, printed to three decimal places as if measured.

We found it ourselves, before pointing any investor, partner or customer at the domain. We are removing it and writing it down rather than quietly deleting it. This record lists every item, what it claimed, why it was wrong, and where it lived.

One item is more serious than the rest and is named first below: a public API endpoint that served four real, living geoscientists — with their real institutions and real LinkedIn slugs — attached to an invented h-index, an invented "recent finding" and a prediction written in their voice. None of the four said any of it. As of this writing that endpoint still answers HTTP 200; see Status at the end.

Items removed

Roughly 500 further Math.random() calls in the map application were deliberately left alone: particle systems, canvas jitter, animation timing and flight-path rendering. Only calls whose output was presented to a reader as a measurement, a grade, a probability or a citation were removed.

How this happened, and what that is worth

The excavation supports a specific reading, and we state it because it affects how the product should be described, not because it is a defence. This looks like a fast demo whose marketing layer was written separately from the engine and never reconciled with it. The tell is that the codebase repeatedly discloses its own limits, in places nobody was meant to look:

• amrt.py describes itself in its own docstring as a deterministic geological prior rather than a live satellite feed, and says so in its output.
• The verifier encodes the company's own non-compliance as verifiable-false: the rule ni 43-101 compliant resolves to -1 with the reason "Tool not QP-reviewed", and real-time price/data/spot resolves to -1 with "Cached not real-time". It was built to fail us on our own marketing copy.
• The terms and conditions already disclosed that the social feed is simulated and does not represent real posts — while the page above them presented the same feed as live.
• The public /api/halluc endpoint publishes our own error rate, at 33.33% on the day of the audit, while the page header claimed sub-3%.

A system built to deceive does not ship a verifier that marks its own claims false. What we had was two layers that were never reconciled, and nobody stopped to run one against the other.

That distinction is worth stating and worth nothing. It reduces the exposure by zero. A diligence reviewer, a journalist or Professor Wall's institution sees the output, not the intent — an endpoint that put invented words in four named scientists' mouths, a page inviting customers to book fictional reductions into a regulatory disclosure, and a testimonial from a real ASX issuer that never said it. The only thing intent changes is whether the fix is a process fix or a people fix. Here it is a process fix: nothing ships a claim again without a check against the endpoint that would contradict it.

What still stands

The removal was surgical, not a demolition. Nothing honest was stripped, and several disclosures were strengthened. What survives is genuine and defensible:

• The deposit register. 135 curated records — 120 sourced, 15 model-predicted and counted separately — each carrying grade, tonnage, deposit type, status and an explicit citation to USGS MRDS, BGS World Mineral Statistics, Geoscience Australia, the Chinese Society of Rare Earths or peer-reviewed literature. Separately, 5,190 seeded records sourced from USGS (5,013) and ICMM (177).
• The 21-isotope NMR table behind /api/amrt/health (48 REE systems, 21 isotopes). Correct, checked, unchanged.
• The ternary verifier. Genuinely implemented, returns UNKNOWN rather than guessing, and — as above — encodes our own non-compliance as false. It stays exactly as written.
• The terrain service: a real caching proxy over public Mapzen/AWS Terrarium elevation tiles, with rate limiting and backoff.
• The LiDAR catalogue: 68 real public repositories (OpenTopography, USGS 3DEP, NOAA bathymetry, ESA), each with a real URL, resolution and format. We checked this expecting it to be invented; it is not.
• The 128-dimension client-side embedding encoder and the RAG search endpoint, both real and both doing what the page says.
• Genuine literature citations throughout — 67 unique DOIs, all resolving, all correctly attributed (Sanematsu & Watanabe 2016, Bao & Zhao 2008, Kato et al. 2011, German et al. 1994, and others). Only the generated ones were removed.
• The existing honest disclosures, kept verbatim and in some cases extended: the JORC / NI 43-101 "screening tool, not a Competent Person sign-off" footer; the AI-prediction uncertainty notice; the simulated-social-feed clause; the "Nothing In This Deck Is Built Yet / 0 UNITS BUILT / 0 FIELD TRIALS RUN" header on the swarm concept deck.

Status as of 19 August 2026

Changed on the live site

Nothing. All work described above exists in a staging tree at /home/ubuntu/geometals-clean/ and has not been deployed. No live file was written, no service restarted, no database modified. Live file timestamps are unchanged (June and earlier). At 22:32 UTC on 19 August 2026, https://treasuremap.ch/api/geologists still returned HTTP 200 with the fabricated geologist records, and the live pages still carry the claims listed above.

Pending — required to make the removal real

1. Deploy the 12 cleaned pages and the cleaned backend modules (osint_engine.py, main.py, mega_deposits.py, core.py, geometals_backend.py, and the newly staged investor_marketplace.py, which must ship with invest.html or the page will still pull the fabricated projects).
2. Restart geometals-api.service. This is the single action that takes /api/geologists and /api/social-feed off the fabricated data. No nginx change is needed; the routes remain and return an explicitly empty, labelled payload.
3. Delete /home/ubuntu/geometals-clean/_render/ and the other render-verification artefacts. That directory holds byte-identical pre-clean copies of all 12 dirty pages; if the staging tree is copied wholesale to the web root they would ship intact and be publicly servable.
4. Delete /home/ubuntu/geometals-backend/mega_deposits.py.bak.pre_kenya.20260617_094952, the last remaining on-disk copy of the 18 fabricated social posts.

Still outstanding — found by verification, not yet fixed

The review pass over the cleaned tree found four fabrications that survived because they are worded differently from anything the audit script searched for. They are listed here rather than left to be discovered:

• The share-price/valuation dataset in index.html — 48 invented fields plus eight valuation triplets for real listed issuers, each footnoted to a real analyst house, filing or paper that never published it. The identical block was correctly removed from index_default.html. This is the highest-consequence survivor.
• xRef — 86 invented X/Twitter posts per index file, with fabricated handles and verbatim quotes carrying specific assay figures, rendered in Twitter brand styling under "X / GEOLOGIST INTELLIGENCE" with no inline simulation label. Several impersonate real public institutions, including the British Geological Survey and the Geological Survey of Bangladesh. Functionally the same fabrication as the REAL_SOCIAL_POSTS block that was removed.
• personOfInterest — 86 real, named, identifiable geoscientists per index file with their real affiliations, rendered on deposit popups under a "PERSON OF INTEREST" header. Includes Kathryn Goodenough and Frances Wall, two of the four people named in the item at the top of this record. Unlike that item these carry no invented quotes or bibliometrics and the descriptions track the subjects' real published work — but naming 86 people that way on a commercial product, without consent, is not defensible on scale grounds alone. It needs at minimum to be reframed as a citation list.
• The contractor directory — 65 entries per index file asserting certification status ("verified SEC", "verified SASAC", ISO 9001, MSHA, AusIMM CP) for named entities including real companies, with fictional 555-exchange telephone numbers, under a "VERIFIED CONTRACTORS" heading.
• The hallucination badge in index.html still ships hard-coded at 2.1% with a "SCIENCE-BACKED" label, alongside an always-true "NO HALLUCINATION" check and a "DOI references valid — pass, count 47" line. The correct fix — a live read of the self-check, showing "--" until it returns — was applied to index_default.html and missed on the page actually served. Our own verifier returned 33.33% the same day. This is the removed "sub-3%" claim in different words and must not ship.

Until those five are fixed, the staging tree is not approved for deploy. The record will be updated when they are, and this page will state the date the cleaned build went live.