How it works
Measurement
One prober probes every service once a minute and posts aggregates onchain every ten minutes with a proof of time.
One window of ten minutes, one service
What a probe is
The prober asks every watched service once a minute, at most eight at a time, with a 10-second timeout and a declared User-Agent. Freshness of the filings feed is checked against EDGAR's own listing, one issuer a minute. Deviation of the quotes feed is checked against 
Chainlink's answer on this chain at the same block as the quoted pool price.
Proof of time
Each record carries the hash of the latest block seen just before the probe, so it was not made earlier. Its window is posted onchain within 30 minutes of closing (the contract refuses later posts), so it was not made later. ProbeLog checks the anchor hash itself when it is still within the chain's 256-block horizon.
Raw records
Every window's records are published as an OpenZeppelin StandardMerkleTree dump at /probes/<root>.json. Anyone can recompute the root and compare it with the one posted. Settlement reads only the aggregates onchain; the records are there to check them. One service's records with their proofs cost $0.001 a read over x402 at /api/v1/records/:service.
The outage rule
If 50% or more of the probed services fail most of their slots in the same window, the window is voided for everyone: its aggregates are not added and the board shows it grey. A failure of the prober's own network slashes nobody. The contract computes this from the posted aggregates; the prober cannot choose it.
Adding a prober
One prober runs today, from one machine. addProber goes through the 48-hour timelock. With several probers, each one posts its own windows, and a slot counts as failed only if a strict majority of the probers that reported on it say so. A bond in $PBI for probers, slashed when a prober is out of line with the majority, is designed for a later version.