v0.1.17016 Aug 2026·Rendering, Web APIs & DOM, Networking, Privacy & Shields, Tabs & interface

Render Receipts: seal a page into proof the reference browser structurally cannot offer

A page you save stops being a screenshot someone has to take your word for. Seal it from the new Render Receipts page (or the page menu) and Floati captures the page and everything it loaded into one Web Capsule file, then binds the exact bytes the site served to the exact pixels the engine painted with a SHA-256 receipt id you can publish anywhere. Because Floati's from-scratch engine is deterministic - the same bytes paint the same pixels on any machine - anyone you hand the capsule to can open it, fully offline, and their own copy of Floati re-derives the same id or shows the seal is broken. Change a single served byte, even one that leaves the picture looking identical, and the seal breaks; it cannot be forged back. The reference browser cannot do this: its GPU raster is not reproducible, so what was shown is not re-derivable. Each seal also locks in the time (from the device clock, unchangeable after sealing, honestly labelled self-reported) and links to the previous seal made on the device - a local chain proving the order of your seals with zero network, because privacy stays absolute: nothing about a capsule ever leaves your machine. The page itself explains what a receipt proves and, just as honestly, what it does not. Security moves 40 to 41; overall holds at 57.

Parity with the reference browser

74overall, as of v0.1.343

Web APIs / DOM surface42

Security architecture66

GPU / graphics acceleration68

DevTools / extensions72

Networking85

Media85

Accessibility85

Real-world site compatibility99

HTML parsing100

CSS parsing + selectors100

Layout: block / flex / grid / tables / writing-modes100

Paint + visual100

JavaScript language100

JavaScript performance (JIT)100

HTML parsing100

What changed 4 changes

Web APIs & DOM	Render Receipt attestation (engine-shot receipt.rs): SHA-256 over canonical, domain-separated, length-prefixed preimages binds the URL + every served byte (status, headers and body of the page and each subresource) to the painted RGBA, into one 64-hex receipt id. Deterministic, input/raster/time/chain tamper-evidence, unambiguous canonicalisation and a pinned known-answer are all unit-tested; the text and binary forms reject any blob whose id no longer binds its fields.
Networking	Web Capsules are sealed and replay-verified: capture seals the receipt into the .flcap container, and offline replay re-renders the page purely from the capsule (a miss is an error, never a network fall-through), reporting both the pixel fingerprint and the receipt check - a flipped stored byte with identical pixels breaks the seal, proven end to end against a live server that is then shut down.
Privacy & Shields	Local seal chain with a locked-in timestamp, no network ever: each seal binds its device-clock time plus the id of the previous seal (linked timestamping), so seals have a provable order and cannot be quietly backdated once a later capsule is shared - and it works with zero network, because verifiable evidence must not cost privacy. No timestamp authority, no blockchain, no NTP; the limits are stated plainly in the UI.
Tabs & interface	The floati://receipt page makes it usable: Seal a page (URL + width, live engine render preview, copyable receipt id, save as .flcap) and Verify a capsule (pick a file, offline replay, VERIFIED / SEAL BROKEN / NO SEAL verdict with the sealed time and chain position), with an info sidebar explaining what it is, why it is trustworthy, why other browsers cannot do it, and its honest limits. Reachable from the page menu (Seal this page) and the command palette.