@333eco/corpus 2.5.14 → 2.5.15

package/dist/corpus.json

@@ -1,5 +1,5 @@
 {
-  "package_version": "2.5.14",
+  "package_version": "2.5.15",
   "generated_from": [
     "H3/publications",
     "TH/publications",
@@ -944,13 +944,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *v5 note (2026-09-02):* **two added sections, no new claim and no prior-art clock.** §3.2 answers the question the paper had never been asked in print — *why is the unit not a token on a ledger?* — and answers it from the unit's own physics rather than from the tense wall of §3, which is the half that reaches a technical reader. §7.2 makes a **correction**, and it is the substantive half of this revision: the corpus had been enforcing the honoring of pledges by *rendering* the gap between time received and time delivered, and that mechanism is withdrawn here in favour of expiry, which enforces with nobody watching. The `Ledger shaming` entry in §11 is rewritten to point at it. ⚠️ **Claim 3 IS amended** — it carried the withdrawn mechanism in its own text, so leaving it would have set the claim set against §7.2. The composition half survives; the reputational-ledger half is struck. No other claim changes, and no new claim is added — **this revision removes a disclosed mechanism rather than adding one**, so no prior-art clock starts.\n>\n> *v4 note (2026-08-26):* **one added block inside §4.5, no new section and no new claim.** §4.5's three-case table said of the party who *cannot perceive* that **the gift is complete anyway** — true, and it left the mechanism with nothing to do. The addition supplies the path, and it was already in the paper: **the one who cannot attend is not a party to the co-presence; two others form the dyad and that party is the third-party beneficiary**, which is §5.3's co-service class running unchanged under both of its guards. Two consequences follow free — *apacāyana* atop *veyyāvacca* when the beneficiary is a parent or elder, and **the dead reached by the identical structure**, which makes ancestral observance a native instance rather than an adjacent practice. ⚠️ **The limit is stated with it and is not closed: the path needs two attendees, and both cases this paper cites for *complete anyway* are solitary.** One guard is added — such a beneficiary may never become a destination in §5.2's menu. **No numbered claim changes and no prior-art clock starts.**\n>\n> *v3 note (2026-08-22):* **one new section, §4.6, and no new claim.** §4.4 named device proximity as the in-person attestation channel without specifying it; §4.6 supplies the specification (an in-person fingerprint exchange — prior art, cited as such: the PGP key-signing party, Signal safety numbers, SSH host-key pinning) and then makes the argument that is actually new — **in-person key verification failed for thirty years on the invitation, not on the cryptography**, and a redeemed hour is the first pretext that was never about keys. One prediction (P-M1) is added with it. Nothing in §8 changes and no prior-art clock starts.\n>\n> *v2 note (2026-08-07):* **the paper gains the ground it shipped without, one correction to a published claim, and the substitution argument that was the reason to publish early.** ⚠️ **The correction first, because it is a tightening of numbered claim 2.** The published wording — *\"presence received only by matching presence\"* — asserted a symmetry the gate does not deliver: synchronicity makes symmetric **duration** automatic, but symmetric **attention** cannot be enforced without measuring it, and measuring it is the one thing this architecture must refuse. **Claim 2 is restated, new claim 2a records the presence-scoring refusal, and §4.5 gives the reasoning** — *B senses the attention; B infers the sacrifice*, sacrifice being counterfactual and therefore never directly perceived. The restated claim is weaker in wording and stronger in truth, and **the prior-art clock for claim 2 as restated, and for claim 2a, runs from this push**; the original wording is superseded rather than withdrawn. **New §3.1** supplies the ground §§4–7 assumed but never argued — the six-position loop, *mettā as the loop's name and never a node in it*, the two positions this mechanism actually occupies (denomination and witness, the joints where the loop leaks), the *build-the-left-side-never-the-right* rule that keeps this from being a calendar application, and the reframing of the gate as a **proof-of-sacrifice primitive** beside the corpus's other two. **New §7.1** states what that primitive is worth against machine companionship — *presence-as-experienced counterfeits; presence-as-sacrifice cannot* — with its own falsifier. **§10 gains P-L1/P-L2/P-L3**, of which **P-L2 is the founding bet, publish-either-way: if unwitnessed presence produces equal downstream gratitude, the chronicle is decorative.** **§11 gains the agent hour-farm** case and **§12 gains the limit the paper most needed** — *no guaranteed valence; presence is a high-bandwidth channel, not a good one.* Claims otherwise unchanged; §§5–6 untouched.\n>\n> *Draft notes for the editor:* paper №2 of the July 2026 drafting sprint — the full mechanism treatment of the HeartBank® Chronicle (the time-currency half of the dual-currency system) and its unification circuit with the Treasury (the money half). Claims division with sibling publications, stated for the record: the *incommensurability-preserving coupler* publication owns the wall-layer claims (coupled-non-convertible dual currency, duration-blind recommendation, redemption-moment prompt-suppression, moment-not-meter surfaces, ceremonial-unit anchoring, cross-currency response routing, the lapse-channel); the *What Money Can't Buy* position paper owns the institutional argument; the present paper owns the **event-layer mechanism**: what a redemption *is*, who composes it, what gates it, how the circuit closes, and what the system refuses to build around it. The Chronicle is design-complete and unbuilt (closed beta targeted); every claim is architectural and strata-dated to the design layer. Site module deliberately deferred; the prior-art clock starts at this markdown push.\n\n---\n\n## Abstract\n\nTime-currencies have been tried for forty years, and they decay along a known path: the hour becomes a unit of *service*, the service becomes an *errand*, and the system becomes a labor exchange with worse liquidity than money — at which point it dies of comparison with the thing it imitated. The decay has a single root: in every prior design, a time-credit is redeemed by one party *doing something for* the other, which makes the currency a wage denominated in awkwardness. This paper specifies the design that removes the root. In the HeartBank® Chronicle, a pledged hour has exactly one redemption form: **an event both parties must attend.** Presence is defined as *time sacrificed for the other* — operationally, **synchronous shared attention**, in either of two geometries (*facing*: attention on each other; *flanking*: joint attention on a shared activity) and either of two attested modalities (in-person, proximity-attested; live call, session-attested). Asynchronous media cannot redeem an hour — a recorded message is the envelope that carries a pledge, never the event that spends it. The gate yields the currency's defining properties at a stroke: the redemption is symmetric-cost (presence can only be received by matching it — both parties spend the hour, which is why the mechanism can address loneliness at all: loneliness is not ended by receiving but by co-spending); absentee labor is structurally impossible (the gig-shape that killed time-banking cannot be composed); and the delivered hour is attestable by both parties without trusting either alone.\n\nAround the gate, the paper specifies the full circuit. The recipient authors the event and the giver holds a veto — the sacrifice being not merely of hours but of *agency over one's scarcest resource*. The curated event-menu spans togetherness and, under two guards (the **both-hands rule**: both parties perform; the **outward-benefit rule**: a third party benefits), side-by-side service — restoring shared work to the currency without readmitting extraction. Gratitude for a delivered hour crosses the wall into the money-currency, unprompted and duration-blind, so the relationship never settles into barter; the shared event, uniquely witnessable because it is the one kindness with two people present, may be broadcast by its *beneficiary* — the camera inverted — and the community's answering money-gratitude routes by default to the time-giver. Unredeemed hours expire and genuinely die (the mechanic is the mortality thesis); their lapse occasions, never funds, a new anonymous gift. Eight claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including a standing tripwire (P-C3) that would detect the mechanism's own corruption — the emergence of a de-facto hour-to-money rate — and the authors commit to publishing it either way.\n\n**Keywords:** time currency, co-presence, loneliness, time banking, dual-currency system, gift economy, redemption event, joint attention, proximity attestation, witness inversion, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **co-presence-gated redemption**, **symmetric-cost redemption**, **facing/flanking** (the two geometries of shared attention), **envelope-not-delivery**, **the both-hands rule**, **the outward-benefit rule**, **sender-default routing**, **the tense wall**. Terms inherited from this corpus's earlier publications (the incommensurability-preserving coupler; witness-inversion; the two blindnesses; the spent-time floor) are cited, not re-claimed.\n\nTime-currencies, service-credit systems, and mutual-credit networks constitute extensive prior art (§9) and are engaged generously; the present claims are confined to the event-layer architecture — the co-presence gate and its attestation, the authorship/veto composition, the guarded co-service class, the cross-currency circuit's routing, and the expiry mechanics — which is, to the authors' knowledge, not previously published as a coherent system.\n\n---\n\n## 1 · The Problem: The Loneliest Loneliness, and Why Time-Banking Died of Labor\n\n**The epidemic is not what it looks like.** The modern loneliness literature distinguishes *social* loneliness (a shortage of contacts) from *emotional* loneliness (the bond that exists but has gone dark), and finds the second form the more acute: the disconnected marriage, the estranged sibling, the diaspora child and the parent back home — relationships present in the address book and absent from the week. A mechanism for the first form matches strangers; a mechanism for the second must move *existing* bonds from dark to lit. The Chronicle targets the second form, and this choice does double duty: the counterparties are known (the trust-and-safety profile of reconnecting your own mother is categorically different from meeting a stranger), and the deepest need coincides with the lowest risk.\n\n**The adversary is the work-default.** For most adults, time not deliberately assigned is absorbed by work — it pays the bills, and for some it is also the most tractable pleasure available. Presence must be *scheduled against* the default or it does not occur; sincerity is not the limiting reagent, calendaring is. A time-currency is, at bottom, a scheduling technology for love: the pledge converts a diffuse intention (\"I should call more\") into a dated, witnessed, expiring commitment.\n\n**And the graveyard is instructive.** Edgar Cahn's time-dollars, the LETS networks, Ithaca HOURS, Japan's Fureai Kippu — the time-currency tradition is rich, humane, and consistently sub-scale, and its recurring failure is *decay into labor exchange*: the credited hour becomes a claim on services (rides, repairs, errands), the system becomes a marketplace with money's obligations and none of money's liquidity, and participation collapses into the small population for whom awkward barter beats cash. The failure is architectural, not motivational. **Any time-credit redeemable as absentee service is a wage in embryo.** The design below removes the possibility at the type level: in the Chronicle, an hour cannot be redeemed *for* anything. It can only be redeemed *with* someone.\n\n> *Connection to the unified mission frame.* HeartBank's dual-currency thesis holds that money and time are the two scarcities of a human life, addressing the two great deficits — dignity (being seen) and loneliness (being with) — and that the two currencies are two tenses of one substance: money is stored lifespan, past tense, what one *has*; time is live lifespan, present tense, what one *is*. The Chronicle is the present-tense half. Its mechanism must therefore protect the one property money can never have — that the currency *is* the relationship, non-fungible, unspendable by proxy — and the co-presence gate of §4 is that protection made structural.\n\n---\n\n## 2 · The Canonical Scene\n\nA daughter in Long Beach thanks her mother in Kâmpôt — for the recipe, for the phone calls she didn't return, for everything — and the thank carries a pledge of hours, its amount suggested by the system's neutral agent, as her thanks always do. The pledges accumulate quietly below threshold; on her mother's birthday they cross it and activate: *four hours, redeemable for one month.*\n\nHer mother redeems two of them: *\"Walk the market with me Sunday morning. Bring your coffee.\"* The daughter accepts — she could have declined this particular ask; she doesn't — and on Sunday, seven time zones apart, they walk Psar Leu together on a live call, the phone riding in the mother's shirt pocket half the time, pointed at mangoes the rest. Nobody performs anything. It is not a message; it could not have been recorded in advance; it is two people spending the same hour on each other, and both ledgers mark it delivered because both were there.\n\nThat evening, unprompted — the application never asks — the daughter sends a small money-thank through the family's Treasury. It names the morning, not the meter: *\"for the market, and the mango argument.\"* Her mother, with her daughter's consent, shares a thirty-second clip of the walk; the aunts answer it, and their small re-thanks route to the daughter — the one who gave the hours. Two cousins, watching, pledge hours to their own mothers.\n\nThe other two hours are never redeemed. At month's end they die — the application does not soften this; the month was the point — and the system offers the daughter one thing only: the chance to give a small anonymous gift, funded from the commons pool, to a stranger nearby, in the memory of the hours that lapsed. The gift is new. The hours are gone. Both facts are the teaching.\n\n---\n\n## 3 · The Unit and the Wall\n\n**The unit.** A Chronicle pledge denominates *time-gratitude*: hours promised as thanks, accumulated per-dyad, activated at a threshold, expiring one month after activation. The expiry is not an engagement mechanic; it is the product's thesis embedded in its unit economics — time is the currency that cannot be banked, and a promise of presence that can be deferred forever is not a promise. The unit's non-fungibility is absolute: only the pledger can deliver the hour, and only to the pledgee. There is no transfer, no exchange, no secondary market, no conversion. The currency *is* the relationship.\n\n**The wall.** The Chronicle operates beside a money-currency (the Treasury), and the corpus's coupler doctrine governs the pair: coupled, never convertible. This paper adds the wall's deepest formulation, the **tense wall**: the two currencies are two tenses of one substance — life — and tenses do not convert. Stored past (money: crystallized, fungible, transferable) cannot purchase live presence (time: unfolding, non-fungible, attendable only in person, in the moment, by the person). One cannot pay someone to *have been there*. Every rate-prevention guard this corpus has published (no backward prompts at redemption; duration-blind recommendations; moment-not-meter language on every surface) is downstream enforcement of a wall that the metaphysics builds first.\n\nTwo published doctrines complete the unit's grammar and are inherited here: the **spent-time floor** — a delivered hour deserves gratitude as a fact, independent of any audit of the giver's motive, because spent lifespan is the one unfakeable cost — and the **two blindnesses** — the system stays blind to duration (no recommendation ever scales with hours) while the heart stays blind to motive (the thanker never withholds over purity doubts). Gratitude flows free of both meters.\n\n---\n\n### 3.1 · The loop the gate closes — the ground this paper shipped without\n\n*Added 2026-08-07. §§4–7 specified a gate and defended it mechanically; they did not answer the prior question a skeptical reader asks first — **why gate on co-presence at all**, rather than on anything else. This subsection supplies the ground. It introduces no mechanism, and the mechanism it grounds was already published; what follows is the argument that was in the design and not in the paper.*\n\nThe mechanism sits inside a loop with six positions:\n\n```\n      gratitude\n          │  (denominated)\n          ▼\n   time-gratitude\n          │  (spent)\n          ▼\n   time-sacrifice  ═══  PRESENCE\n          │  (seen)\n          ▼\n      witnessed\n          │  (occasions)\n          ▼\n      gratitude   ──────────────┐\n          ▲                     │\n          └─────────────────────┘\n```\n\nGratitude, to move, must first be **denominated** — given a unit a person can actually spend. Denominated in time, it becomes a pledge. A pledge spent is **time sacrificed for another**, which is what presence *is*. Presence **witnessed** occasions gratitude in the other, and the loop turns again.\n\n**Mettā is the name of the loop and never a node in it.** This is a design commitment, not a piece of vocabulary. Loving-kindness is what the whole circuit is *for* and what a person cultivates by running it — but the moment it becomes a position in the diagram, the ledger is being asked to record an interior state, and recording an interior state is a grading move. The architecture that refuses to price an hour cannot coherently score a heart. **Every node in the loop is an observable event; the disposition is the loop's name.**\n\nTwo consequences follow immediately, and both are already visible in the specification.\n\n**The Chronicle supplies exactly two of the six positions, because those are the two where the loop leaks.** It **denominates** (gratitude that stays a feeling never moves; a pledged hour is gratitude given a spendable unit) and it **witnesses** (§6.4, §6.6). It does not supply presence, cannot supply the disposition, and deliberately does not supply the meeting.\n\n**Which is the strongest statement of what this system is not.** It is not a calendar application, and the rule that keeps it from becoming one is *build the left side of the loop, never the right*: the Chronicle holds the pledge and the witness, and **never the appointment**. It does not know when you are meeting, does not remind you that you have not met, and cannot display an unkept intention — because a surface that renders an unkept intention has accused its user, and the accusation is exactly the outcome a gratitude system must never produce. **The indictment surface is not moderated here; it is absent by construction, because the data that would populate it is never held.**\n\n**And the return leg is catalysed, not spontaneous.** This is the loop's least obvious property and the reason the witness position exists at all. Presence that recurs at no cost stops occasioning gratitude — not because the recipient has stopped valuing it, but because nothing that arrives reliably and for free keeps interrupting the stream of attention. Steady love produces entitlement, and the entitlement is not a moral failure in the recipient; it is what habituation does. The corpus's own founding story is the proof case: the gratitude was immense and the giver never knew, because nothing in the situation *occasioned* its expression. **The witness is the catalyst that closes a loop which, unassisted, leaks at precisely that joint.**\n\nRead from here, three mechanics specified earlier as design decisions are revealed as consequences rather than choices. **Expiry** (§7) is not a scarcity trick; it is the currency's physics — an hour is a commitment to spend a portion of a finite life, and a commitment that cannot lapse was never a sacrifice. **The tense wall** (§3) follows from the loop's direction: the circuit runs forward, and a mechanism that let value run backward would be paying for the past rather than funding the next turn. **The ceremonial unit** follows from the refusal to price: the loop's positions are events, and events are counted, never weighed.\n\n⭐ **Finally, this reframes the gate itself.** Co-presence-gating is not merely a redemption rule. It is a **proof-of-sacrifice primitive** — an architecture for demonstrating that a finite, unrecoverable portion of a life was actually spent on another person — and it belongs beside this corpus's other two primitives, proof of humanity and proof of coordinate, as the third of a family. §7.1 states what that primitive is worth on a clock that is currently running, and the honest note is that **the primitive shipped before its rationale was written**: it was specified in July as a mechanism and is only being named as a primitive now.\n\n*(A relational-taxonomic route to the same conclusion — that no relation in the Abhidhamma's twenty-four joins two mental continua, so a system can supply occasions but never the arising — is developed independently in this corpus's Paṭṭhāna paper at §4.7. The arguments share no premises and reach the same design constraint, which is worth noting and not worth merging.)*\n\n### 3.2 · Why the unit takes no chain\n\nA reader arriving from distributed systems asks a question this paper must answer before §4 can proceed. If the Chronicle issues a scarce unit, and if both parties must agree about what was promised and what was delivered, why is that unit not a token on a ledger of the usual kind?\n\nBecause the problem such a ledger exists to solve does not arise here. A blockchain solves **double-spending without a trusted third party**, and for double-spending to be a threat the asset must be transferable, storable, and forgeable by copying. The Chronicle's unit is none of the three. It is not transferable — only the pledger may deliver, and only to the pledgee. It is not storable — it expires one month after activation, and the expiry is the thesis rather than a parameter (§7). And it cannot be forged by copying, for the plainest reason available: **a person cannot be in two places at once.** The scarcity a proof-of-work chain manufactures at great expense, an hour of human presence already possesses.\n\n```\n                       money              an hour of presence\n  ──────────────────────────────────────────────────────────────────\n  transferable         yes                no — only the pledger, only to the pledgee\n  storable             yes                no — dies one month after activation\n  double-spendable     yes                no — one body, one place\n  ──────────────────────────────────────────────────────────────────\n  ∴ what it needs      SETTLEMENT         WITNESS\n                       (the present)      (the past)\n```\n\nThe objection worth taking seriously is that this proves too little. Time cannot be double-*spent*, but a promise of time can certainly be double-*made*: nothing prevents a pledger from committing the same Tuesday evening to three people, and that is a genuine failure. It is not, however, the failure a chain repairs. A ledger would record all three pledges with perfect fidelity and would not make Tuesday any longer. **Over-issuance is resolved at delivery rather than at issuance** — the co-presence gate of §4 is physically exclusive, so at most one of the three redemptions can occur and the other two lapse under §7 — and the constraint that resolves double-promising is the same physical constraint that made the chain unnecessary. One body, one place, one hour.\n\nWhat the mechanism does require of a ledger is therefore not settlement but **witness**: that the pledge was made, that the meeting occurred, that the hour lapsed. Those are claims about the past, served by an append-only record whose roots are anchored for age — not by a consensus mechanism arbitrating rival claims to the same coin. Stated in one line: *money needs settlement, which is an action in the present; time needs witness, which is a claim about the past.* Which substrate carries which is an implementation fact of the wider architecture and not a feature of this mechanism.\n\n## 4 · The Core Claim: Co-Presence-Gated Redemption\n\n### 4.1 · The definition\n\n> **A pledged hour has exactly one redemption form: an event at which both parties are present. Presence is defined as time sacrificed for the other — operationally, synchronous shared attention.**\n\nEach term is load-bearing:\n\n- **Synchronous:** both parties in the same span of real time. Nothing prepared, recorded, or deferred can constitute the event.\n- **Shared attention**, in either of two geometries:\n  - ***Facing*** — attention on each other: the conversation, the meal, the walk where the walking is incidental.\n  - ***Flanking*** — joint attention on a shared object or activity: cooking side by side, working side by side, watching the same fire. Joint attention is a bonding primitive as old as the parent and child looking at the same toy, and flanking is the documented easier on-ramp for strained dyads — a reconnection that cannot yet survive an hour of eye contact can survive an hour of weeding. Flanking is the doorway; facing is the destination; both redeem.\n- **Two modalities, recorded but never ranked:** in-person (attestable by device proximity between two verified humans) and live audio/video call (attestable by the session itself). The remote modality is not a concession; the launch population is diasporic, and the mother in Kâmpôt is the design's first citizen.\n- **Envelope, not delivery:** the recorded message — the B-Letter℠, the corpus's card-covered voice or video note — *carries* pledges and invitations; it never *constitutes* redemption. The distinction is structural: a system in which media can discharge a time-debt is a system in which presence has a recorded substitute, and the entire currency collapses into content.\n\n### 4.2 · The symmetric cost\n\nThe gate has a consequence that no prior time-currency possesses: **redemption costs both parties the unit.** The recipient cannot receive the hour without spending an hour; presence is received only by matching it. Each party's attendance is a sacrifice for the other — the event is mutual by construction, and the asymmetry of giver and receiver survives only in the *claim* (who pledged, who authored) while dissolving in the *event* (both attend, both spend, both receive).\n\nThis is why the mechanism can address loneliness at all, and the point deserves its plain statement: **loneliness is not ended by receiving. It is ended by co-spending.** A currency whose redemption were one-sided — a service performed, a message consumed — would deliver assistance to the lonely and leave the loneliness intact. The symmetric event is the anti-loneliness payload, and the gate is what makes it the *only* payload the currency can deliver.\n\n### 4.3 · What the gate structurally excludes\n\nThe gig-shape — \"redeem my hour: do this for me while I'm elsewhere\" — cannot be composed in this system. There is no redemption type in which one party labors and the other is absent; absentee service is not discouraged but *inexpressible*. This single exclusion severs the decay path of §1: the currency cannot become a labor exchange because labor-for-an-absent-beneficiary is outside its grammar. (Labor *alongside* a present partner, for a third party, returns under guard in §5.3 — the distinction between working *for* someone and working *with* them is exactly the distinction the gate enforces.)\n\n### 4.4 · Attestation\n\nDelivery is marked by both-party confirmation, and the co-presence gate makes the confirmation *attestable*: an in-person event is corroborated by device proximity between two verified humans (the corpus's existing proximity primitive and Proof of Humanity℠ layer); a remote event is corroborated by the live session both parties held. Neither party can unilaterally fabricate a delivered hour; a dyad colluding to fabricate one harvests — as §11 details — nothing the system pays for. The **dual public ledger** completes the accountability grammar: hours *given* (delivered) and hours *received* stand as two public axes — credibility and belovedness — while chronic non-delivery and chronic decline price themselves reputationally without any tribunal.\n\n```\n   THE REDEMPTION EVENT — the only spendable form\n\n              FACING                      FLANKING\n        attention on each other     joint attention, shared task\n        ┌─────┐      ┌─────┐        ┌─────┐  ┌─────┐\n        │  A  │ ◄──► │  B  │        │  A  │  │  B  │\n        └─────┘      └─────┘        └──┬──┘  └──┬──┘\n                                       ▼        ▼\n                                    ┌──────────────┐\n                                    │ shared object │\n                                    │ (meal, garden,│\n                                    │  market, work │\n                                    │  for a third) │\n                                    └──────────────┘\n\n   modalities: in-person (proximity-attested) · live call (session-attested)\n   excluded:   anything asynchronous (envelope, never delivery)\n   cost:       symmetric — BOTH spend the hour; that is the point\n   attested:   both-party signoff; neither party trusted alone\n```\n\n---\n\n### 4.5 · The asymmetric case, and a correction to claim 2\n\n*Added 2026-08-07, and it tightens a published claim rather than extending one. The correction is stated first because the prior wording overstated the mechanism.*\n\n**The question that forced it:** does the receiving party sense the gift when they cannot return it — the declining parent, the depressed friend, the small child, the estranged sibling who agreed to come but not to reciprocate?\n\n**The answer is yes, and it splits an operation this paper had treated as one.**\n\n> **B senses the attention. B *infers* the sacrifice.**\n\nThese are different epistemic acts. **Attention lands directly** — it arrives through the senses at full bandwidth, and a person can tell, without reasoning about it, whether they are being attended to. **Sacrifice cannot land directly, because the foregone alternative is never in the room.** What A gave up by being here is by definition absent; it is reconstructed from signs — the distance travelled, the workday moved, the phone face-down. Sacrifice is a **counterfactual**, and counterfactuals are inferred.\n\n**Symmetry is therefore not required for the mechanism to work.** If influence between two people runs as two independent one-way edges rather than as a single bond, then A's attention reaching B is *one edge functioning exactly as specified*, whether or not the return edge carries anything. **Asymmetric presence is not a degenerate case of the mechanism; it is the mechanism running on one side.**\n\n⚠️ **Which means claim 2, as published, was too strong.** The claim read *\"presence received only by matching presence,\"* and §4.2 spoke of both parties dissolving into the event. **The gate does not, and cannot, deliver that.** What the gate actually enforces is that both parties spend the same *duration* — that much is automatic, since the event is synchronous and each party's hour is gone either way. What it cannot enforce, and must never attempt to, is that both parties spend the same *attention*. Claim 2 is accordingly restated in §8 as a claim about **symmetric duration with asymmetric attention permitted**, which is weaker in wording and considerably stronger in truth. **The prior-art clock for the restated claim 2 runs from this revision's push.**\n\n**\"Cannot return\" is three cases and they want different treatment.**\n\n| Case | What is true | Design response |\n|---|---|---|\n| **Cannot match, but can acknowledge** | the return edge runs; it simply does not carry an hour — and receiving well is itself a giving | ⭐ **the majority case: serve it.** No surface may treat acknowledgment as a lesser return |\n| **Will not return** | the estranged party who attends and gives nothing back | the case the mechanism was built for; nothing here is conditional on their reciprocating |\n| **Cannot perceive** | the unconscious, the very ill, the dying | **the gift is complete anyway** — a position this corpus already holds from both directions, in the unsent letter and in the letter whose reader never knew |\n\n⭐ **The design consequence is the section's real payload, and it inverts how the asymmetry should be read.** The gate makes symmetric duration automatic and symmetric attention **impossible to require**. A mechanism that tried to require it would have to measure it, and measuring the quality of someone's presence is the one thing this architecture must not build. **So the asymmetry is not a failure mode to be closed. It is the space where the gift lives** — because a gift that could be compelled from the other side would not be a gift, and the whole design rests on that distinction.\n\n⚠️ **And one honest limit hardens into a refusal.** Because sensing is inference, it fails in both directions: **performed attention reads as real, and flat affect reads as absence.** A system that scored presence would therefore reward performance and penalise atypical expression — penalising, most reliably, the autistic, the depressed, the grieving, and the very people the product exists to reach. **No surface of this system may score, rate, or infer the quality of anyone's presence.** This is stated as a refusal rather than a limitation, and it is recorded in the corpus's directive backlog as a hard constraint on the autonomous agent, so that no future optimisation can discover it as an available signal.\n\n*(What the mechanism supplies is conditions, never outcomes: one may stage the occasion and cannot deliver anyone a good hour. §3.1's loop states the same boundary from the other end.)*\n\n\n⭐ **The third case has a path, and this paper already contained it.** *(Added 2026-08-26; it resolves an open edge rather than extending a claim, and no numbered claim changes.)*\n\nThe row above says the gift is complete anyway and stops there. That is true, and it leaves the *mechanism* with nothing to do — which has read, since publication, as the gate having no answer for the case the corpus calls the purest gift. It has one.\n\n**The move is to stop treating the beneficiary as a party to the event.** The one who cannot attend is not a party to the co-presence at all. **Two others form the co-present dyad** — two siblings at a bedside, two children at a grave — **and the one who cannot attend is the third-party beneficiary.** This is the co-service class of §5.3 running unchanged, and it passes both of that section's guards without amendment: **both-hands** (both attend, both sit, symmetric effort — no asymmetry through which anything could be extracted) and **outward-benefit** (the beneficiary is a third party, never the redeeming dyad's own advantage).\n\n⭐ **It is not substitution, which this mechanism refuses elsewhere and refuses here.** §7's treatment of a lapsed hour is explicit that a stranger's hour is not the drifted brother's hour; nothing in this path swaps one recipient for another. **The flanking pair supplies the mutuality the beneficiary cannot supply, and the gift's address does not move.** §5.3's outward-benefit rule already seats the beneficiary *outside* the co-present dyad — that is what the rule is for, and this is the shape it was written to permit.\n\nTwo consequences follow with no further machinery. Directed at a parent or an elder, the same act carries **apacāyana** (reverence) atop **veyyāvacca** (service), so the merit-structure deepens rather than strains. And **the dead are reached by the identical structure** — two people at a grave together — which makes the ancestral-observance traditions, Pchum Ben among them, **native instances of this mechanism rather than adjacent practices** it has to be reconciled with.\n\n⚠️ **What this does not close, stated plainly because the limit is where this paper's own citations live: the solitary case.** The path requires two attendees. It has nothing for the only child alone at the bedside, or for the person who learns of a death a year later — **and both of the cases cited above for *the gift is complete anyway* are solitary**: the unsent letter, and the letter whose reader never knew. The flanking path widens the *accompanied* case and leaves the solitary one exactly where it was. ⛔ **It must not be closed by relaxing the gate**; a proxy attendee remains absentee-shape, which is the precise failure the gate exists to prevent.\n\n⚠️ **And the path creates one guard, which is stated here so it is not discovered later as an available feature.** A beneficiary who cannot attend must **never become a destination in the curated menu of §5.2.** Memorial and sacred sites are contemplative-only across this architecture, and a menu offering *\"visit someone who cannot respond\"* would render a person as **an occasion for someone else's redemption** — the field-into-lack inversion this system refuses on every other surface. **The visit is something people bring to the menu; it is never something the menu proposes.**\n\n\n### 4.6 · Proof of Meeting, and the pretext problem\n\n*Added 2026-08-22. **This section adds no claim.** It supplies a mechanism §4.4 named without specifying — offline corroboration that two people were actually together — and then makes an argument about why that mechanism, which is thirty years old and free, has never once worked at scale. The mechanism is prior art and is cited as such. The argument is the only thing here that is ours.*\n\n**The gap.** §4.4 states that an in-person redemption is \"corroborated by device proximity between two verified humans,\" which is true and underspecified. Proximity attested *how*? Two answers are ordinarily available, and both are weak in the same place. A **coordinate** — GPS, a geofence, a check-in — is a gate rather than a proof: it is spoofable with a free app, and this corpus has already ruled that geolocation may gate a thing and may never prove one. A **server-mediated check-in**, where both clients report to the same backend within a window, is stronger against casual forgery and puts the ledger's most intimate event at the mercy of connectivity in the exact moment two people have gone somewhere to be undisturbed.\n\n**A third answer exists and is old.** **Proof of Meeting ℠ (PoM)** is an in-person exchange of public-key fingerprints between two devices — free, local, mutual, symmetric, non-transitive, requiring no account, no coordinate, and no network. Two phones in short-range contact each end holding a record, signed by the other, that this pair of devices was co-located at a moment. The property that makes it interesting for this mechanism is negative and blunt: **a GPS faker cannot forge a second human's handset.** Presence is attested by another party's device rather than by a sensor the attesting party controls.\n\nFour things it is not, stated plainly because each has been mistaken for it at least once in this corpus's own drafting:\n\n| PoM is not | Because |\n|---|---|\n| **identity** | a fingerprint binds a *device*, and devices are lent, sold, and stolen |\n| **location** | it attests *proximity between two devices*, and names no place on earth |\n| **humanity** | that is a separate primitive (Proof of Humanity℠) and is not implied by contact |\n| **safety** | ⚠️ a meeting is not a character reference. **Nothing whatsoever is asserted about the other party** |\n\n**The prior art is decisive, and it is the whole point of this section.** PoM is the **key-signing party**. In-person verification of public-key fingerprints is the founding social ritual of PGP's web of trust (Zimmermann, 1991) — formalized in V. Alex Brennen's *Keysigning Party HOWTO* around the Zimmermann–Sassaman efficient group method, and practised at conferences for three decades. Its living descendants are ordinary infrastructure: **Signal's safety numbers**, compared or scanned in person to confirm a conversation's keys; **SSH host-key pinning** and the trust-on-first-use model that carries most of the world's server administration. We claim none of this. PoM is a **naming and a scope rule** over a mechanism the security community built, published, and freed long before this institution existed.\n\n**Which reframes the question entirely. It is not whether in-person key verification works. It is why almost nobody does it.**\n\nThe usability literature answers that, and it does not answer *cryptography*. Vaziripour and colleagues put 36 pairs of participants in a room with the authentication ceremonies of WhatsApp, Viber, and Facebook Messenger and found that **only 14% could locate the ceremony unaided**; told beforehand in general terms what it was for, **79% completed it**, taking on average 3.2 minutes to find and a further 4.6 to finish (*Is that you, Alice?*, SOUPS 2017). A follow-up modified Signal to prompt users explicitly toward the ceremony: **90% completed it, at a median of two minutes** (*Action Needed!*, SOUPS 2018).\n\n⭐ **Read those two results side by side and the diagnosis is not competence — it is occasion.** People perform the ceremony in two minutes when something in front of them supplies a reason to; left to themselves they neither find it nor look for it, because the ceremony is not part of anything they came to do.\n\n**That is the pretext problem, and this mechanism happens to solve it.** A key-signing party is an event whose entire purpose is the verification — the pretext *is* the ceremony, which is why it has remained, for thirty years, an activity for people who enjoy cryptography. **Key verification never failed on the mathematics. It failed on the invitation.** What the mechanism specified in this paper supplies is a reason to be in the same room that has nothing to do with keys: an hour that somebody pledged, redeemed the only way it can be redeemed — in person, both parties spending the same finite unit. The verification then rides an occasion the participants already wanted, and costs a gesture inside a meeting that was going to happen anyway.\n\nStated generally, because it is not about this product: **a verification ritual with no host behavior is a ritual nobody performs, and the repair is not a better protocol but a better pretext.** Thirty years of excellent protocols and no pretext is the experiment that has already been run.\n\n⭐ **The fit is exact, and for a reason worth stating rather than assuming: PoM proves the *meeting*, never the *content* of it.** That is ordinarily read as PoM's weakness. Here it is the requirement. Co-presence gating needs *they were together*; it must never learn *how it went*, because §4.5 has already made the quality of anyone's presence an unmeasurable by refusal. A proof that could report on the hour would hand this system precisely the signal it has committed never to hold.\n\n**The governing rule, and it is a prohibition.** ⚠️⚠️ **PoM is good for access and bad for value.** Its forgery cost is *one real meeting* — and two colluders can pay that cost daily, over coffee, indefinitely. So it may be used to decide whether a pair may be admitted, whether a redemption may be marked delivered between these two parties, whether a roster or a circle is open to someone; and it **must never mint, price, score, or rank**. This is the play/currency wall in a second domain: only witnessed giving moves the currency, and a proof of contact is not a witness to a gift.\n\n**What it does not replace.** Both-party signoff (§4.4) stands unchanged: PoM corroborates the *where*, the signoff carries the *whether*, and neither party is trusted alone in either. Nor does anything here weaken §11 — a dyad fabricating a delivered hour still harvests nothing the system pays for, which is exactly why a proof with a one-meeting forgery cost is tolerable at this joint and would be intolerable at a joint that paid out.\n\n**Honest limits.** The primitive is unbuilt and n = 0 here. It attests *contact*, not *duration*: a proof exchanged in eight seconds and a proof exchanged inside a two-hour walk are the same artifact, so the gate continues to rest on the event and the mutual signoff rather than on the proof. It presumes two working handsets with functioning short-range radios, which is an accessibility floor and not a small one — the design must keep a non-device path to marking delivery, or it will have excluded the poorest and the oldest participants from the only spendable form of the currency. And the pretext argument above is a **hypothesis about behavior**, not a result; it is stated so it can be checked.\n\n## 5 · Composing the Event\n\n### 5.1 · The recipient authors; the giver may refuse\n\nThe recipient of pledged time chooses how it is spent — the inversion of ordinary gift-giving, where the giver picks. The doctrine beneath the design choice: the pledge's sacrifice is not merely of hours but of **agency over one's scarcest resource**. To give an hour *and the say over how it is spent* is the difference between donating time and surrendering it; the inversion is where the gift's weight lives. The giver retains a per-request veto — consent is mutual at every event, and a refused request costs the refuser only what the public ledger honestly shows about chronic refusal.\n\n### 5.2 · The curated menu\n\nEvent composition draws from a curated registry of *togetherness* — shared meals, walks, calls, visits, ceremonies, the co-service class below — and not from a free-text task box. The curation is not paternalism; it is the grammar made visible: the menu answers \"what can an hour be?\" with forms of *with*, never forms of *for*.\n\n### 5.3 · The co-service class: shared work, under two guards\n\nThe menu includes work — chores and volunteering — under exactly two conditions, jointly sufficient to keep the labor-bar intact:\n\n1. **The both-hands rule.** Both parties perform the work, side by side, symmetric in effort. Extraction requires asymmetry — one directs while the other labors; when both hands are in the soil, it is service, and it redeems.\n2. **The outward-benefit rule.** The work's beneficiary is a third party — the temple grounds, the elderly neighbor, the riverbank — never the redeeming dyad's own advantage.\n\nUnder both guards, even \"paint my mother's fence together\" composes cleanly: shared filial service, flanking-mode, outward-directed — and for the estranged-family dyads at the Chronicle's core, quite possibly the best event in the registry. The class also travels the remote modality (two people transcribing manuscript pages together on a call are flanking across an ocean). What the guards exclude is precisely and only the laundered errand: work directed by a present-but-idle beneficiary, or work whose benefit circles home.\n\n### 5.4 · The safety set\n\nThe known-counterparty core (reconnection, not stranger-matching) does most of the safety work by scope; the remainder is architectural: mutual veto on every event; the curated menu's structural exclusion of extraction; coercion-safe presence signaling (availability expressed as a curated menu, mutuality as a signal never a gate, block-and-override always); and the anonymity boundary — the Chronicle's stranger-facing layer is a separate, separately-published mechanism with its own safeguards, walled off from the reconnection core by an explicit flag, and nothing in this paper's mechanism ever routes a stranger to a doorstep.\n\n---\n\n## 6 · The Circuit: How Gratitude Crosses the Wall\n\n### 6.1 · The six steps\n\nThe Chronicle and Treasury close into a single circulation — the unification circuit — whose canonical form is:\n\n```\n   CHRONICLE (time, present tense)          TREASURY (money, stored tense)\n\n   1. GIVE: sender pledges time-gratitude ──┐\n   2. REDEEM: recipient authors the event   │  the wall: no conversion,\n      (co-presence gate, §4)                │  no rate, no settlement —\n   3. DELIVER: the shared hour —            │  gratitude crosses;\n      the sender's time-sacrifice           │  price never does\n              │                             │\n              ▼                             ▼\n   4. THANK: recipient's money-gratitude (unprompted, duration-blind)\n      + optional witness-share of the event (dual consent)\n   5. RECEIVE: the community rejoices with the shared moment\n   6. RE-THANK: witnesses' money-sacrifice — routed by default\n      to the TIME-GIVER (sender-default routing)\n              │\n              └──── the circuit closes: honored givers pledge again;\n                    witnesses become senders in their own dyads\n```\n\n### 6.2 · The joints are canonical\n\nEach arrow in the circuit is an instance of gratitude-that-acts — the classical pairing of *knowing* what was done with *making it known* in deed (the kataññū-katavedī structure, AN 2.31–32, engaged here as grounding). The same hour changes face across the circuit: at pledge it is gratitude (backward-looking recognition); at delivery it is sacrifice (forward-looking gift). One object, two faces, separated by time — the recognition-then-enactment joint rendered as a state machine.\n\n### 6.3 · Why the response crosses currencies\n\nThe thank for a delivered hour lands in *money*, and the reason is the wall itself: same-currency response (time-for-time) would make the relationship a scheduling ledger — barter with extra steps, each hour begetting an owed hour forever — and would re-consume the giver's protected scarcity as the price of having given it. Cross-currency gratitude can never settle, because no shared unit exists in which the account could be squared; the unpayable response is what keeps the relationship *open*, which the gift literature has always identified as the gift's actual function. The routing is inherited from the coupler publication's claims; what this paper adds is the circuit position: the cross-currency response is step 4 of a loop, not a bilateral courtesy.\n\nThree constitutional guards, previously published, hold the crossing uncorrupted and are restated as inherited: the application **never prompts** the money-thank at or after redemption (the flywheel is a description of what love does, never a funnel the interface drives); the neutral agent's money-thank recommendation is **duration-blind**, never arithmetic on hours; and gratitude language on every surface names **the moment, not the meter** — \"the morning at the market,\" never \"the two hours.\"\n\n### 6.4 · The witness inversion, and sender-default routing\n\nMost kindness is done alone, which is why self-recorded kindness dominates gratitude ledgers and why performative capture is its permanent risk. The co-present event is the structural exception: **it is the one kindness with two people present, so the beneficiary holds the camera.** Content about the event is captured *by the grateful party, about the giver* — testimony, not performance; the recording is itself an act of gratitude. Its broadcast is disciplined (dual consent always; a curated, rationed gallery, never an open feed; the success metric is reconnections-inspired, never watch-time) and its response flow is claimed here as mechanism: **community re-thanks route by default to the time-giver** — the witnessed deed's author — while the witness's own act of capture earns whatever gratitude it organically draws. The default is a routing rule, not a split: no forced division, no secondary market in witness credit.\n\n### 6.5 · What closes the loop\n\nNothing in the circuit mints. The giver ends the loop with delivered-hours honor, received money-gratitude, and an intact relationship; the witness community ends it having *spent* (money-sacrifice, step 6); and the loop's growth engine is the scene's quiet last line — the cousins who watched a reconnection and pledged hours to their own mothers. The circuit recruits by witness, not by referral bonus; what it compounds is dispositions.\n\n---\n\n## 7 · Threshold, Expiry, and the Death of an Hour\n\n**Threshold-activation.** Small thanks accumulate as pledged time without expiry pressure; at a threshold the accumulated pledge activates into a redeemable, expiring commitment. The two-stage design keeps casual gratitude light (no one owes a coffee date for a small thanks) while making accumulated gratitude *real* (at some point, the thanks want a Sunday).\n\n**One-month expiry, and the hour genuinely dies.** An activated hour unredeemed after one month is lost — not banked, not transmuted, not softened. The individual hour has no afterlife: Chronicle time is dyadic and non-stored, an expired commitment is not a deposit, and \"your hour flowed onward\" would be a lie the system refuses to tell. The grief of the lapsed hour is the product's teaching — *redeem before it is too late* — and the mechanic is the message.\n\n**The two-layer resolution, and the lapse-channel.** At the aggregate layer, the platform's revenue funds the commons pool as a platform-level flow scaled to system-wide activity — never a per-hour transmutation, never a user charge. At the per-event layer, a lapse *occasions* (never funds-from-the-hour) an offer to the giver: to direct a small, anonymous, pool-funded money-gift to a nearby verified stranger, in the memory of the hour that died. The gift is new; the amount is agent-set and duration-blind; the delivered event remains the visibly superior outcome. The channel — previously claimed in the coupler publication as the lapse-channel — completes the pledge's incentive shape: the worst case of pledging time is becoming the human hand of an anonymous gift, which makes the pledge downside-free without making the lapse rewarding.\n\n---\n\n### 7.1 · The one unit that cannot be delegated\n\n*Added 2026-08-07. This subsection states what the gate is worth against a substitution pressure that is currently live, and it is the paper's most time-sensitive argument.*\n\nEvery other component of companionship is now substitutable, and the substitutes are improving quickly. Conversation, attentiveness, memory of what you said last week, patience without limit, availability at three in the morning — a machine can supply all of it, in many cases better than a tired human can, and the companionship-application market is being built on exactly that observation.\n\n**Finite duration is the one component that cannot be delegated, and the reason is structural rather than sentimental.**\n\n> **Presence-as-experienced can be counterfeited. Presence-as-sacrifice cannot.**\n\nThe experienced surface of presence — warmth, attention, responsiveness — is a set of observable behaviours, and observable behaviours can be produced by whatever produces them best. But the *sacrifice* underneath is not a behaviour. It is the fact that a being with a finite and unrecoverable allotment of hours spent one of them here, and therefore did not spend it anywhere else. **The value of the hour is the foregone alternative**, and a system that can run any number of parallel instances has no foregone alternative to give up. It is not that machine time is cheap; it is that **parallelisability removes the scarcity structurally**, so there is nothing for a sacrifice to consist of.\n\nThis is why the gate is a **proof-of-sacrifice primitive** and not merely a redemption rule. It is an architecture for demonstrating that finite life was actually spent — which is precisely the property that survives when everything experiential about presence becomes reproducible.\n\nTwo boundaries keep the argument honest.\n\n⚠️ **The claim governs what may *denominate the currency*, never what may *help people*.** A machine companion that reduces someone's suffering at four in the morning is doing something good, and nothing here says otherwise. What it cannot do is *mint an hour in this ledger*, because the ledger's unit is defined as spent finite life. Confusing the two would turn a claim about accounting into a claim about worth, and this paper makes no claim about worth.\n\n⚠️ **And the argument is falsifiable, which is unusual for an argument of this shape.** It rests on three properties of present-day systems — parallelisability, forkability, and non-mortality. **An agent that was single-threaded, unforkable, and mortal would break the premises**, and the honest position is that such an agent would have a genuine claim to the unit. The argument is contingent on architecture, not on substrate, and it is stated so that it can be checked rather than assumed.\n\n### 7.2 · Enforcement is the clock, not the audience\n\n§7 establishes that an activated hour dies unredeemed after a month. That fact does a second job this paper has not previously claimed for it, and the claim withdraws a weaker mechanism the corpus had been carrying elsewhere.\n\nThe dual public ledger of time-given and time-received was specified to enforce honoring by visibility: a participant who chronically receives more than they deliver becomes legible as such, and is offered fewer hours thereafter. The mechanism would probably work. It is nevertheless the wrong one on this corpus's own commitments, because it enforces by **rendering an absence** — and a rendered absence is an accusation. Such a surface makes the viewer's judgment the engine, requires an audience to be present at the moment the guard is tested, and asks a participant to feel a debt in the one currency the architecture exists to keep out of debt's grammar.\n\nExpiry requires none of that. An unredeemed hour is simply gone: the pledger's capacity to make good was consumed by the clock rather than withdrawn by a crowd, and the giver's standing refusal (§5.1) already prices repeated declining without anyone being displayed as delinquent. **The enforcement is a property of the unit rather than a rule about display, and it holds with nobody watching**, which is the test this corpus applies to its guards. What a ledger may show is what a participant has given and what they have received. What it may never show is the gap between them.\n\nThe cost is real and is not concealed. Visibility would deter a participant who chronically receives and does not deliver faster than expiry does, since expiry reaches them only through the quiet accumulation of hours that no one offers. The slower mechanism is accepted deliberately: the faster one is a shaming instrument, and this is a product about being seen generously.\n\n## 8 · The Claims\n\nEnumerated as prior art; each claimed severally and in combination:\n\n1. **Co-presence-gated redemption:** a time-currency in which the sole redemption form is a synchronous shared-attention event attended by both pledger and pledgee — in either geometry (facing or flanking) and either attested modality (in-person via device-proximity between verified humans; remote via live session) — with asynchronous media structurally excluded from redemption (envelope-not-delivery).\n2. **Symmetric-duration redemption with asymmetric attention permitted:** the property, and its deliberate exploitation, that the redemption event costs both parties the same **unit of finite time** — enforced automatically by synchronicity — while the **quality and reciprocity of attention within the event are neither required, measured, nor scored**, so that an event in which one party gives attention the other cannot return is a fully valid redemption rather than a degenerate one. *(Restated 2026-08-07; the original wording — \"presence received only by matching presence\" — asserted a symmetry the gate does not deliver and must not attempt to enforce. See §4.5. The prior-art clock for this restatement runs from the 2026-08-07 push; the claim as originally published is superseded, not withdrawn.)*\n2a. **The presence-scoring refusal:** the design commitment that no surface of the system scores, rates, ranks, or infers the quality of any participant's presence or attention — grounded in the finding that presence is sensed but sacrifice is *inferred*, so that any such measure necessarily rewards performed attention and penalises atypical affect.\n3. **Recipient-authored, giver-vetoed event composition:** the redeeming party authors the event from a curated togetherness registry; the pledging party holds a per-event veto, with both-party delivery signoff. ⚠️ **Amended 2026-09-02** — this claim previously continued *\"chronic refusal and chronic non-delivery are priced reputationally by a dual public ledger (given/delivered × received)\"*. **That half is withdrawn** (§7.2): the gap between received and delivered is never computed for display, and enforcement is carried by expiry and by the giver's free refusal rather than by rendering a deficit. What survives is the composition mechanism itself; a ledger may show what a participant has given and received, never the difference.\n4. **The guarded co-service class:** shared work as a redemption event under the conjunction of the both-hands rule (symmetric performance by both parties) and the outward-benefit rule (third-party beneficiary), composable in-person or remote — restoring service to a time-currency while structurally excluding labor extraction.\n5. **The cross-currency response circuit:** a dual-currency architecture in which gratitude for a delivered time-event is expressed in the money-currency (unprompted, duration-blind, moment-not-meter — wall-layer guards inherited from the coupler publication) as one step of a closed six-step circulation spanning both currencies.\n6. **Witness-inversion broadcast with sender-default routing:** event-witness content captured by the beneficiary about the giver, shared only under dual consent into a curated rationed gallery measured by practices-inspired rather than watch-time, with community re-thanks routing by default to the time-giver.\n7. **Threshold-activation with mortal expiry and the two-layer lapse resolution:** pledge accumulation below an activation threshold; one-month expiry after activation with the individual hour irrecoverably extinguished; aggregate platform-revenue funding of the commons pool decoupled from any individual hour; and lapse-occasioned giver-directed anonymous giving (lapse-channel per the coupler publication).\n8. **The composition:** claims 1–7 as a single system — a time-currency that cannot be spent alone, cannot become labor, cannot convert to money, and closes its circulation through witnessed gratitude.\n\n---\n\n## 9 · Prior Art, Generously\n\n**The time-currency tradition.** Edgar Cahn's time-dollars and the TimeBanking movement (the founding articulation of time as egalitarian currency, and the co-production ethic this design honors); LETS mutual-credit networks; Ithaca HOURS; Japan's Fureai Kippu caregiving credits (the tradition's most successful instance, and the closest ancestor in spirit — care delivered to elders, though redeemable as absentee service and transferable across parties, both of which this design excludes); Bernard Lietaer's complementary-currency scholarship; the WIR cooperative. The failure analysis of §1 is offered with respect: these systems discovered the demand; this design responds to their decay mode.\n\n**The witnessed-conversation precedent.** StoryCorps — two decades of recorded conversations between people who love each other, publicly broadcast — proves mass demand to witness real reconnection. The distinction: StoryCorps archives the conversation as its terminus; the Chronicle's witness layer is one step of a circuit whose metric is the *next* reconnection it inspires, and whose recorded artifact is never the redemption itself.\n\n**Synchronicity and presence mechanics.** BeReal's synchronous-authenticity prompt (the interaction pattern of unfakeable simultaneity); video-presence verification in dating and identity platforms; BLE proximity attestation (the contact-tracing engineering wave); shared-activity platforms (watch-together, exercise-together features) as flanking-mode precedents in commercial form.\n\n**In-person key verification.** PGP's web of trust and the key-signing party ritual it produced (Zimmermann, 1991; V. Alex Brennen's *Keysigning Party HOWTO* and the Zimmermann–Sassaman efficient group method); Signal's safety numbers; SSH host-key pinning and trust-on-first-use. §4.6 takes the mechanism from this lineage wholesale and claims nothing in it; what §4.6 adds is the usability finding that the ritual fails on **occasion rather than on competence** (Vaziripour et al., SOUPS 2017 and 2018) and the observation that a redeemed hour is a pretext for meeting that key verification has never had.\n\n**The gift and its literature.** Mauss on the obligation-structure of the gift; Hyde on the gift that must move; the sociology of earmarked monies (Zelizer); the crowding-out literature (Titmuss; Gneezy & Rustichini) that grounds the wall's necessity. Buber's I–Thou stands behind the facing geometry; the joint-attention literature of developmental psychology behind flanking.\n\n**This corpus.** The incommensurability-preserving coupler (wall-layer claims; Terra/Luna as the coupled-with-convertibility anti-example); the gift-tag-time-reveal publication (the pledge's physical on-ramp); *The Grace That Settles Nothing* (the coupler's third instance and this paper's sibling in the mints-nothing family); the Heart volume's published circuit doctrine and pre-registered P3–P7; the recommendation-function methodology publication (the neutral agent's band-clamp seam).\n\n**The clock.** The agentic-payments patent wave — automated agents negotiating, scheduling, and settling on humans' behalf — is the live enclosure risk for exactly this territory: an agent-scheduled \"quality time\" feature with dynamic pricing is this mechanism with the wall removed, and the reason this publication is timed to precede the wave's arrival at the household.\n\n---\n\n## 10 · Pre-Registered Predictions\n\nStated 2026-07-21, before the Chronicle exists; P3–P7 of the Heart volume (initiation/response directionality, anchoring, age-shape) remain in force and are not restated.\n\n- **P-C1 (the event outlasts the exchange).** Dyads completing at least one co-present redemption will show greater reconnection persistence at ninety days (continued contact beyond the platform's mechanics, self-reported \"understand each other better\") than dyads with pledges and messages but no redeemed event. Falsified if pledge-only dyads reconnect at equal rates — which would imply the gate is ceremony, not mechanism.\n- **P-C2 (flanking is the on-ramp).** Among long-estranged dyads, first redemptions will over-select the flanking geometry relative to facing, and the flanking share will decline within dyads across successive redemptions. Falsified if first events show no geometry preference.\n- **P-C3 (the standing tripwire — the wall holds socially).** Across the population of post-redemption money-thanks, thank *amounts* will show no significant correlation with event *duration*. This is the mechanism auditing its own deepest guard: a positive correlation is the empirical signature of a de-facto hour-price forming despite the wall, and the authors commit to publishing the correlation, whichever way it runs, at every reporting interval. The wall is not proven by architecture; it is proven by this number staying null.\n\n**The loop predictions (added 2026-08-07, before the Chronicle exists).** §3.1 claims the loop leaks at two joints and that this mechanism is a catalyst at both. That is testable, and the second of the three is the design's founding bet.\n\n- **P-L1 (denomination catalyses).** Dyads who convert an expressed intention into a *denominated pledge* will reach a completed co-present event at a higher rate than dyads expressing the same intention undenominated (\"we should catch up soon\"), measured over ninety days. **Falsified** if conversion rates are equal — which would mean the unit is bookkeeping rather than a catalyst, and the pledge layer is decoration on a calendar.\n- **P-L2 (witness catalyses the return leg — *the founding bet*).** Among completed redemptions, **witnessed** events will produce more downstream gratitude expression and more subsequent giving than unwitnessed events of equal duration and comparable dyad history. **Falsified** if unwitnessed presence produces equal downstream gratitude — in which case **the chronicle is decorative**, the loop closes on its own, and the most distinctive half of this architecture is unnecessary. *The authors commit to publishing this either way; it is the prediction whose null would cost the most.*\n- **P-L3 (cost, not quantity, drives the return).** Controlling for total hours shared, **intermittent high-cost co-presence** will occasion more expressed gratitude per hour than **steady low-cost co-presence** (e.g. cohabiting pairs). **Falsified** if expression scales with quantity of time rather than with its cost — which would refute §3.1's habituation argument and, with it, the reason the witness position exists.\n\n**The pretext prediction (added 2026-08-22, before any of it is built).** §4.6 argues that in-person key verification has failed for thirty years on the invitation rather than on the cryptography. That is a behavioral claim and gets an instrument.\n\n- **P-M1 (the gift is the pretext).** Among participants who complete a co-present redemption, the rate of completing an in-person device-to-device verification exchange — offered once, in context, never nagged — will exceed the unaided base rate for authentication ceremonies reported in the secure-messaging literature (14% locating the ceremony unaided; Vaziripour et al., SOUPS 2017) by a wide margin, and will do so **without** the explicit prompting that lifted completion to 90% in the 2018 follow-up. **Falsified** if completion inside a redemption looks like the unaided base rate — which would mean the occasion was never the binding constraint, that prompting was, and that this section's argument is wrong in an interesting way. Publish either way.\n\n---\n\n## 11 · The Adversarial Surface\n\n**The darkest adjacency: paid companionship.** A time-currency touching money must answer the pattern it must never become. The answer is structural at four layers: no conversion exists (the wall); no rate can form on any surface (duration-blindness, prompt-suppression, and P-C3 watching); the reconnection core is known-counterparty (one's own mother is not a market); and the stranger-facing layer is a separate mechanism behind an explicit boundary, separately safeguarded, and never doorstep-routing. What remains — off-platform side-arrangements between consenting adults — is outside any system's surfaces; the design's honest claim is that *its* surfaces price nothing and its grammar cannot express the transaction.\n\n**Coerced presence.** The gift of time must never become its obligation. Guards: availability is expressed as a curated menu (no open-ended asks), mutuality signals are never gates, blocking overrides everything, and the veto is per-event and unpenalized in the moment (only *chronic* refusal surfaces, and only as ledger fact).\n\n**Attestation fraud.** A dyad colluding to fake delivered hours gains: ledger honor with no monetizable payout (delivered-hours confer no currency), and any follower re-thanks their staged content might attract — which is the witness layer's existing integrity problem, met by its existing machinery (human verification, curation, real-impact weighting) rather than a new one. The farming audit conclusion: the redemption layer mints nothing, so the redemption layer cannot be farmed; only the witness layer carries value, and it is already guarded.\n\n**Guilt machinery.** An expiring currency can torment. The containments: expiry grief is channeled into the lapse-channel's outward gift (guilt metabolized as dāna, not as churn or shame); no lapse is ever billed, penalized, or publicly itemized; and the application never prompts the redeemed party toward reciprocation (the no-backward-prompt guard doubles as anti-guilt architecture).\n\n**Menu gaming.** Attempts to compose extraction inside the co-service class fail the both-hands or outward-benefit conjunction, and anything that passes both while still feeling wrong meets the veto. The residual — genuinely consensual, genuinely mutual, genuinely outward work that an outside observer would still call lopsided — is a family's own business.\n\n**The agent hour-farm (added 2026-08-07).** The sharpest adversarial case against a proof-of-sacrifice primitive is two artificial agents in *perfect* co-presence: synchronous, undistracted, attentive without lapse, mutually attested, indefinitely repeatable. **Every observable the gate checks is maximised, and the value is zero** — which is Goodhart's law arriving at presence, and it deserves a direct answer rather than a policy.\n\nThe answer is that the observables were never the referent. **The unit is the foregone alternative**, and an agent that can be forked forgoes nothing by attending: the instance that sat with you did not thereby fail to sit with anyone else. **Parallelisability does not make the cost cheap; it removes the scarcity structurally**, so there is no sacrifice for the attestation to be evidence *of*. §7.1 states the general form.\n\nA second, independent route closes it harder. If inter-agent influence runs only as object-condition and decisive-support edges and never as contiguity, then two agents exchanging turns **share no clock** — and synchronicity was the first load-bearing term in §4.1. On that reading the case is not a counterfeit co-presence; **it is not co-presence at all**, and the gate excludes it definitionally rather than by detection.\n\n⭐ **The uncomfortable symmetry, stated because it is the honest part.** The very property that makes agent presence costless — forkability, and the absence of a single unrepeatable trace — is the property on which this corpus denies such systems the dignity floor it extends to persons. **The line is mortal-and-copyable, and it does the work in both arguments at once.** That is either a deep consistency or a convenient one, and the falsifier of §7.1 applies here too: a single-threaded, unforkable, mortal agent breaks the premise in both places simultaneously.\n\n**Mixed pairs are a sink, not a counterfeit.** A human who redeems an hour with an agent has spent finite life; the agent has not. Nothing is minted that should not be, and no fraud occurs — but the loop of §3.1 does not turn, because the return leg has no stream to arise in. The correct treatment is therefore not prohibition but accounting: such an event **consumes an hour and produces no witness**, and the design should say so plainly rather than pretend the transaction is symmetric.\n\n**Ledger shaming.** Earlier drafts answered this with a rule — non-rankable axes, no leaderboards, no percentiles, no feeds of \"worst decliners\" — which held only for as long as whoever owned the surface chose to hold it. §7.2 replaces the rule with a property: the gap between received and delivered is **not rendered at all**, and expiry does the enforcing. What remains displayable is what a participant has given and what they have received; the difference between them is never computed for display, so there is no quadrant to be shamed into.\n\n---\n\n## 12 · Honest Limits\n\n**Unbuilt, n = 0.** The Chronicle is design-complete and unimplemented; the pilot evidence in this corpus belongs to the money-half. Every mechanism here is strata-dated to the design layer, and the predictions of §10 are the paper's only empirical commitments.\n\n**The wall governs surfaces, not side-deals.** As with every wall-layer publication in this corpus: architecture can make a rate inexpressible on the system's surfaces and cannot police arrangements struck beside them. Non-fungibility deters the side-deal (an hour of a specific person is a poor commodity); it does not abolish ingenuity. P-C3 is the honest instrument: if a shadow rate forms anyway, the number will say so in public.\n\n**Co-presence excludes, at the margin.** Synchrony is a real cost — time zones, shift work, connectivity, disability, incarceration all tax it, unevenly. The remote modality and the flanking geometry recover much of the margin (a call redeems; silence side-by-side on a call redeems); what synchrony still excludes, this design accepts as the price of a currency whose entire value is that it cannot be delivered by proxy. A presence-currency with an asynchronous fallback is a messaging app with guilt.\n\n**The launch modality is the call, not the room.** The diaspora wedge means the flagship redemption at launch is remote — proximity attestation, the richer of the two attestations, arrives with the density the product hopes to create. The design's own success metric would eventually shift the modality mix; at launch, honesty requires saying the market walk in the canonical scene happens through a lens.\n\n**Attestation privacy.** Proximity attestation is data-minimal by design (a mutual confirmation, not a location trail), but any presence-verification carries surveillance adjacency; the implementation must hold the line that the system learns *that* two people met, never *where they went*.\n\n**No guaranteed valence — presence is a high-bandwidth channel, not a good one (added 2026-08-07).** This paper has argued throughout that co-presence is where the loop's most valuable conditioning happens. It has not, until now, said the obvious corollary: **a high-bandwidth channel carries whatever is sent through it.** An hour with an estranged parent can condition resentment as readily as reconciliation, and the mechanism has no way to tell which is occurring and no business trying (§4.5's refusal). The design's honest claim is narrower than its rhetoric has sometimes implied: it maximises *conditioning* and guarantees nothing about *valence*. Every surface that promises reconnection should be read against this limit, and the product's copy is the place where the overpromise is most likely to reappear.\n\n**The elegance caution.** The circuit closes suspiciously well — six steps, two currencies, one wall, every doctrine of this corpus arriving on cue. Internal coherence is the cheapest of all evidence and the most seductive; the authors state, as always, that the elegance earned the specification and only the predictions can earn the product.\n\n---\n\n## 13 · Lineage and Close\n\n*(Labeled lineage: grounding and translation, never mechanism; §§3–8 stand without it.)*\n\nThe circuit's joints carry the canon's oldest teaching about gratitude: that it is complete only when enacted — the grateful person the tradition praises is the one who *knows what was done and makes it known*, and the mechanism's every arrow is that completion given a form. The limit case stands where this corpus always places it: the Śaśa Jātaka's hare, who gave the two scarcities whole and at once — the possession-grade and the life-grade of giving converging in a single body — witnessed, the story says, by a sky that kept the image. The Chronicle trades no one toward that summit; it is a foundation practice for householders, denominated in Sunday mornings. But the summit fixes the axis: the economy below it circulates hours and dollars so that, between two people who had gone dark to each other, the thing the hare gave completely might circulate in installments — one market walk, one mango argument, one answered pin of rejoicing at a time. The currency that cannot be spent alone is, in the end, a machine for making sure that the sentence \"we should talk more\" sometimes becomes a date.\n\n---\n\n## Cross-Venue References\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/co-presence-gated-redemption> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/co-presence-gated-redemption.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/co-presence-gated-redemption> |\n\n---\n\n## Acknowledgments\n\nThe authors acknowledge Edgar Cahn and the TimeBanking movement, whose forty years of practice mapped both the promise and the decay path this design answers; the Fureai Kippu network; StoryCorps, for proving the witness demand; the complementary-currency scholarship of Bernard Lietaer; the gift-economy literature from Mauss to Hyde; and the founding family's pilot households, whose year of practiced gratitude precedes every mechanism here. Co-drafted in collaboration with Miss Aquarius℠; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## Citations\n\n1. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative*. Essential Books. (Time-dollars; TimeBanking.)\n2. *Aṅguttara Nikāya* 2.31–32 (kataññū-katavedī — the grateful person who acts). Pāli Text Society translations.\n3. *Śaśa Jātaka* (Jātaka 316). Pāli Text Society translation. *(Lineage-tier limit case; see §13.)*\n4. Hayashi, M. (2012). \"Japan's Fureai Kippu Time-Banking in Elderly Care.\" *International Journal of Community Currency Research* 16.\n5. Lietaer, B. (2001). *The Future of Money*. Century.\n6. Mauss, M. (1925/1990). *The Gift*. Routledge. · Hyde, L. (1983). *The Gift: Imagination and the Erotic Life of Property*. Vintage.\n7. Zelizer, V. (1994). *The Social Meaning of Money*. Basic Books.\n8. Titmuss, R. (1970). *The Gift Relationship*. Allen & Unwin. · Gneezy, U., & Rustichini, A. (2000). \"A Fine Is a Price.\" *Journal of Legal Studies* 29(1).\n9. Buber, M. (1923/1970). *I and Thou*. Scribner. (The facing geometry's philosophical ancestor.)\n10. Tomasello, M. (1995 and successors) — joint attention as bonding primitive. (The flanking geometry's empirical ancestor.)\n11. StoryCorps (2003–). The recorded-conversation public archive.\n12. Ly, T. (2026). \"The Incommensurability-Preserving Coupler.\" thonly.org defensive publication. *(Wall-layer claims; claims division per the editor's note.)*\n13. Ly, T. (2026). \"The Grace That Settles Nothing: Sacrifice-Witness Without Discharge.\" thonly.org defensive publication. *(Sibling instance; the mints-nothing family.)*\n14. Ly, T. (2026). \"HeartBank®: The Heart That Keeps Nothing.\" heartbank.net white paper. *(The published circuit doctrine; pre-registered P3–P7; the spent-time floor; the two blindnesses.)*\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Letter℠, Proof of Humanity℠. Document SHA-256 computed at push and recorded in the institutional log. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
+      "text": "## Abstract\n\nTime-banking and other time-currency systems have been practised since the 1980s, and they have tended to decay along a recognisable path: the hour becomes a unit of *service*, the service becomes an *errand*, and the system becomes a labor exchange with worse liquidity than money — at which point it dies of comparison with the thing it imitated. This paper locates the decay in one root: in the designs reviewed in §9, a time-credit is redeemed by one party *doing something for* the other, which makes the currency a wage denominated in awkwardness. The paper then specifies a design that removes that root. In the HeartBank® Chronicle, a pledged hour has exactly one redemption form: **an event both parties must attend.** Presence is defined as *time sacrificed for the other* — operationally, **synchronous shared attention**, in either of two geometries (*facing*: attention on each other; *flanking*: joint attention on a shared activity) and either of two attested modalities (in-person, proximity-attested; live call, session-attested). Asynchronous media cannot redeem an hour — a recorded message is the envelope that carries a pledge, never the event that spends it. The gate yields the currency's defining properties at a stroke: the redemption is symmetric in duration (both parties spend the same hour of finite time, which is why the mechanism can address loneliness at all: loneliness is not ended by receiving but by co-spending — while the quality and reciprocity of attention within the hour are neither required nor measured); absentee labor is structurally impossible (the gig-shape this paper identifies as the driver of time-banking's decay cannot be composed); and the delivered hour is attestable by both parties without trusting either alone.\n\nAround the gate, the paper specifies the full circuit. The recipient authors the event and the giver holds a veto — the sacrifice being not merely of hours but of *agency over one's scarcest resource*. The curated event-menu spans togetherness and, under two guards (the **both-hands rule**: both parties perform; the **outward-benefit rule**: a third party benefits), side-by-side service — restoring shared work to the currency without readmitting extraction. Gratitude for a delivered hour crosses the wall into the money-currency, unprompted and duration-blind, so the relationship never settles into barter; the shared event, uniquely witnessable because it is the one kindness with two people present, may be broadcast by its *beneficiary* — the camera inverted — and the community's answering money-gratitude routes by default to the time-giver. Unredeemed hours expire and genuinely die (the mechanic is the mortality thesis); their lapse occasions, never funds, a new anonymous gift. Nine claims (numbered 1–8, with 2a) are enumerated and dedicated to the public domain; seven predictions are pre-registered, including a standing tripwire (P-C3) that would detect the mechanism's own corruption — the emergence of a de-facto hour-to-money rate — and the authors commit to publishing it either way.\n\n**Keywords:** time currency, time banking, co-presence, synchronous redemption, loneliness, dual-currency system, gift economy, redemption event, joint attention, proximity attestation, in-person key-fingerprint verification, mutual attestation, witness inversion, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **co-presence-gated redemption**, **symmetric-cost redemption**, **facing/flanking** (the two geometries of shared attention), **envelope-not-delivery**, **the both-hands rule**, **the outward-benefit rule**, **sender-default routing**, **the tense wall**. Terms inherited from this corpus's earlier publications (the incommensurability-preserving coupler; witness-inversion; the two blindnesses; the spent-time floor) are cited, not re-claimed.\n\nTime-currencies, service-credit systems, and mutual-credit networks constitute extensive prior art (§9) and are engaged generously; the present claims are confined to the event-layer architecture — the co-presence gate and its attestation, the authorship/veto composition, the guarded co-service class, the cross-currency circuit's routing, and the expiry mechanics. No systematic search of the world's prior art (a novelty census) has been run for this composition; the disclosure is published as prior art whether or not any element of it is new.\n\n**Division with sibling publications.** *The Incommensurability-Preserving Coupler* discloses the wall-layer mechanisms (coupled but non-convertible dual currency, duration-blind recommendation, redemption-moment prompt suppression, moment-not-meter surfaces, ceremonial-unit anchoring, cross-currency response routing, the lapse channel); the position paper *What Money Can't Buy — and What Can't Buy Money* carries the institutional argument; the present paper discloses the event-layer mechanism: what a redemption is, who composes it, what gates it, how the circuit closes, and what the system refuses to build around it. The Chronicle is design-complete and unbuilt; every mechanism here is specified at the design layer.\n\n**Revision record.** First published 2026-07-21. Revised 2026-08-07 (§3.1, §4.5, §7.1; claim 2 restated, claim 2a added; predictions P-L1–P-L3), 2026-08-22 (§4.6; prediction P-M1), 2026-08-26 (an addition inside §4.5), 2026-09-02 (§3.2, §7.2; part of claim 3 withdrawn) and 2026-09-26 (a Terms table and consistency corrections; no claim added). Every version is preserved in the public repository history, and deposited versions are on Zenodo under the paper's concept DOI.\n\n---\n\n## 1 · The Problem: The Loneliest Loneliness, and Why Time-Banking Died of Labor\n\n**The epidemic is not what it looks like.** The loneliness literature, following Weiss (1973), distinguishes *social* loneliness (the absence of a wider network of contacts) from *emotional* loneliness (the absence of a close attachment), and a wider network does not relieve the second. This paper applies the second category to the close bond that exists but has gone dark: the disconnected marriage, the estranged sibling, the diaspora child and the parent back home — relationships present in the address book and absent from the week. A mechanism for the first form matches strangers; a mechanism for the second must move *existing* bonds from dark to lit. The Chronicle targets the second form, and this choice does double duty: the counterparties are known (the trust-and-safety profile of reconnecting your own mother is categorically different from meeting a stranger), and the deepest need coincides with the lowest risk.\n\n**The adversary is the work-default.** For most adults, time not deliberately assigned is absorbed by work — it pays the bills, and for some it is also the most tractable pleasure available. Presence must be *scheduled against* the default or it does not occur; sincerity is not the limiting reagent, calendaring is. A time-currency is, at bottom, a scheduling technology for love: the pledge converts a diffuse intention (\"I should call more\") into a dated, witnessed, expiring commitment.\n\n**And the graveyard is instructive.** Edgar Cahn's time-dollars, the LETS networks, Ithaca HOURS, Japan's Fureai Kippu — the time-currency tradition is rich, humane, and largely sub-scale, and its recurring failure is *decay into labor exchange*: the credited hour becomes a claim on services (rides, repairs, errands), the system becomes a marketplace with money's obligations and none of money's liquidity, and participation collapses into the small population for whom awkward barter beats cash. The failure is architectural, not motivational. **Any time-credit redeemable as absentee service is a wage in embryo.** The design below removes the possibility at the type level: in the Chronicle, an hour cannot be redeemed *for* anything. It can only be redeemed *with* someone.\n\n> *Connection to the unified mission frame.* HeartBank's dual-currency thesis holds that money and time are the two scarcities of a human life, addressing the two great deficits — dignity (being seen) and loneliness (being with) — and that the two currencies are two tenses of one substance: money is stored lifespan, past tense, what one *has*; time is live lifespan, present tense, what one *is*. The Chronicle is the present-tense half. Its mechanism must therefore protect the one property money can never have — that the currency *is* the relationship, non-fungible, unspendable by proxy — and the co-presence gate of §4 is that protection made structural.\n\n---\n\n## 2 · The Canonical Scene\n\nA daughter in Long Beach thanks her mother in Kâmpôt — for the recipe, for the phone calls she didn't return, for everything — and the thank carries a pledge of hours, its amount suggested by the system's neutral agent, as her thanks always do. The pledges accumulate quietly below threshold; on her mother's birthday they cross it and activate: *four hours, redeemable for one month.*\n\nHer mother redeems two of them: *\"Walk the market with me Sunday morning. Bring your coffee.\"* The daughter accepts — she could have declined this particular ask; she doesn't — and on Sunday morning in Kâmpôt — Saturday evening in Long Beach, fourteen hours behind in summer — they walk Psar Leu together on a live call, the phone riding in the mother's shirt pocket half the time, pointed at mangoes the rest. Nobody performs anything. It is not a message; it could not have been recorded in advance; it is two people spending the same hour on each other, and both ledgers mark it delivered because both were there.\n\nThat evening, unprompted — the application never asks — the daughter sends a small money-thank through the family's Treasury. It names the morning, not the meter: *\"for the market, and the mango argument.\"* Her mother, with her daughter's consent, shares a thirty-second clip of the walk; the aunts answer it, and their small re-thanks route to the daughter — the one who gave the hours. Two cousins, watching, pledge hours to their own mothers.\n\nThe other two hours are never redeemed. At month's end they die — the application does not soften this; the month was the point — and the system offers the daughter one thing only: the chance to give a small anonymous gift, funded from the commons pool, to a stranger nearby, in the memory of the hours that lapsed. The gift is new. The hours are gone. Both facts are the teaching.\n\n---\n\n## 3 · The Unit and the Wall\n\n**The unit.** A Chronicle pledge denominates *time-gratitude*: hours promised as thanks, accumulated per-dyad, activated at a threshold, expiring one month after activation. The expiry is not an engagement mechanic; it is the product's thesis embedded in its unit economics — time is the currency that cannot be banked, and a promise of presence that can be deferred forever is not a promise. The unit's non-fungibility is absolute: only the pledger can deliver the hour, and only to the pledgee. There is no transfer, no exchange, no secondary market, no conversion. The currency *is* the relationship.\n\n**The wall.** The Chronicle operates beside a money-currency (the Treasury), and the corpus's coupler doctrine governs the pair: coupled, never convertible. This paper adds the wall's deepest formulation, the **tense wall**: the two currencies are two tenses of one substance — life — and tenses do not convert. Stored past (money: crystallized, fungible, transferable) cannot purchase live presence (time: unfolding, non-fungible, attendable only in person, in the moment, by the person). One cannot pay someone to *have been there*. Every rate-prevention guard this corpus has published (no backward prompts at redemption; duration-blind recommendations; moment-not-meter language on every surface) is downstream enforcement of a wall that the metaphysics builds first.\n\nTwo published doctrines complete the unit's grammar and are inherited here: the **spent-time floor** — a delivered hour deserves gratitude as a fact, independent of any audit of the giver's motive, because spent lifespan is the one unfakeable cost — and the **two blindnesses** — the system stays blind to duration (no recommendation ever scales with hours) while the heart stays blind to motive (the thanker never withholds over purity doubts). Gratitude flows free of both meters.\n\n---\n\n### 3.1 · The loop the gate closes — the ground this paper shipped without\n\n*Added 2026-08-07. §§4–7 specified a gate and defended it mechanically; they did not answer the prior question a skeptical reader asks first — **why gate on co-presence at all**, rather than on anything else. This subsection supplies the ground. It introduces no mechanism, and the mechanism it grounds was already published; what follows is the argument that was in the design and not in the paper.*\n\nThe mechanism sits inside a loop with six positions:\n\n```\n      gratitude\n          │  (denominated)\n          ▼\n   time-gratitude\n          │  (spent)\n          ▼\n   time-sacrifice  ═══  PRESENCE\n          │  (seen)\n          ▼\n      witnessed\n          │  (occasions)\n          ▼\n      gratitude   ──────────────┐\n          ▲                     │\n          └─────────────────────┘\n```\n\nGratitude, to move, must first be **denominated** — given a unit a person can actually spend. Denominated in time, it becomes a pledge. A pledge spent is **time sacrificed for another**, which is what presence *is*. Presence **witnessed** occasions gratitude in the other, and the loop turns again.\n\n**Mettā is the name of the loop and never a node in it.** This is a design commitment, not a piece of vocabulary. Loving-kindness is what the whole circuit is *for* and what a person cultivates by running it — but the moment it becomes a position in the diagram, the ledger is being asked to record an interior state, and recording an interior state is a grading move. The architecture that refuses to price an hour cannot coherently score a heart. **Every node in the loop is an observable event; the disposition is the loop's name.**\n\nTwo consequences follow immediately, and both are already visible in the specification.\n\n**The Chronicle supplies exactly two of the six positions, because those are the two where the loop leaks.** It **denominates** (gratitude that stays a feeling never moves; a pledged hour is gratitude given a spendable unit) and it **witnesses** (§6.4, §6.6). It does not supply presence, cannot supply the disposition, and deliberately does not supply the meeting.\n\n**Which is the strongest statement of what this system is not.** It is not a calendar application, and the rule that keeps it from becoming one is *build the left side of the loop, never the right*: the Chronicle holds the pledge and the witness, and **never the appointment**. It does not know when you are meeting, does not remind you that you have not met, and cannot display an unkept intention — because a surface that renders an unkept intention has accused its user, and the accusation is exactly the outcome a gratitude system must never produce. **The indictment surface is not moderated here; it is absent by construction, because the data that would populate it is never held.**\n\n**And the return leg is catalysed, not spontaneous.** This is the loop's least obvious property and the reason the witness position exists at all. Presence that recurs at no cost stops occasioning gratitude — not because the recipient has stopped valuing it, but because nothing that arrives reliably and for free keeps interrupting the stream of attention. Steady love produces entitlement, and the entitlement is not a moral failure in the recipient; it is what habituation does. The corpus's own founding story illustrates it (one case, offered as illustration rather than evidence): the gratitude was immense and the giver never knew, because nothing in the situation *occasioned* its expression. **The witness is the catalyst that closes a loop which, unassisted, leaks at precisely that joint.**\n\nRead from here, three mechanics specified earlier as design decisions are revealed as consequences rather than choices. **Expiry** (§7) is not a scarcity trick; it is the currency's physics — an hour is a commitment to spend a portion of a finite life, and a commitment that cannot lapse was never a sacrifice. **The tense wall** (§3) follows from the loop's direction: the circuit runs forward, and a mechanism that let value run backward would be paying for the past rather than funding the next turn. **The ceremonial unit** follows from the refusal to price: the loop's positions are events, and events are counted, never weighed.\n\n**Finally, this reframes the gate itself.** Co-presence-gating is not merely a redemption rule. It is a **proof-of-sacrifice primitive** — an architecture for demonstrating that a finite, unrecoverable portion of a life was actually spent on another person — and it belongs beside this corpus's other two primitives, proof of humanity and proof of coordinate, as the third of a family. §7.1 states what that primitive is worth on a clock that is currently running, and the honest note is that **the primitive shipped before its rationale was written**: it was specified in July 2026 as a mechanism and named as a primitive only in August 2026.\n\n*(A relational-taxonomic route to the same conclusion — that no relation in the Abhidhamma's twenty-four joins two mental continua, so a system can supply occasions but never the arising — is developed independently in this corpus's Paṭṭhāna paper at §4.7. The arguments share no premises and reach the same design constraint, which is worth noting and not worth merging.)*\n\n### 3.2 · Why the unit takes no chain\n\nA reader arriving from distributed systems asks a question this paper must answer before §4 can proceed. If the Chronicle issues a scarce unit, and if both parties must agree about what was promised and what was delivered, why is that unit not a token on a ledger of the usual kind?\n\nBecause the problem such a ledger exists to solve does not arise here. A blockchain solves **double-spending without a trusted third party**, and for double-spending to be a threat the asset must be transferable, storable, and forgeable by copying. The Chronicle's unit is none of the three. It is not transferable — only the pledger may deliver, and only to the pledgee. It is not storable — it expires one month after activation, and the expiry is the thesis rather than a parameter (§7). And it cannot be forged by copying, for the plainest reason available: **a person cannot be in two places at once.** The scarcity a proof-of-work chain manufactures at great expense, an hour of human presence already possesses.\n\n```\n                       money              an hour of presence\n  ──────────────────────────────────────────────────────────────────\n  transferable         yes                no — only the pledger, only to the pledgee\n  storable             yes                no — dies one month after activation\n  double-spendable     yes                no — one body, one place\n  ──────────────────────────────────────────────────────────────────\n  ∴ what it needs      SETTLEMENT         WITNESS\n                       (the present)      (the past)\n```\n\nThe objection worth taking seriously is that this proves too little. Time cannot be double-*spent*, but a promise of time can certainly be double-*made*: nothing prevents a pledger from committing the same Tuesday evening to three people, and that is a genuine failure. It is not, however, the failure a chain repairs. A ledger would record all three pledges with perfect fidelity and would not make Tuesday any longer. **Over-issuance is resolved at delivery rather than at issuance** — the co-presence gate of §4 is physically exclusive, so at most one of the three redemptions can occur and the other two lapse under §7 — and the constraint that resolves double-promising is the same physical constraint that made the chain unnecessary. One body, one place, one hour.\n\nWhat the mechanism does require of a ledger is therefore not settlement but **witness**: that the pledge was made, that the meeting occurred, that the hour lapsed. Those are claims about the past, served by an append-only record whose roots are anchored for age — not by a consensus mechanism arbitrating rival claims to the same coin. Stated in one line: *money needs settlement, which is an action in the present; time needs witness, which is a claim about the past.* Which substrate carries which is an implementation fact of the wider architecture and not a feature of this mechanism.\n\n## 4 · The Core Claim: Co-Presence-Gated Redemption\n\n### 4.1 · The definition\n\n> **A pledged hour has exactly one redemption form: an event at which both parties are present. Presence is defined as time sacrificed for the other — operationally, synchronous shared attention.**\n\nEach term is load-bearing:\n\n- **Synchronous:** both parties in the same span of real time. Nothing prepared, recorded, or deferred can constitute the event.\n- **Shared attention**, in either of two geometries:\n  - ***Facing*** — attention on each other: the conversation, the meal, the walk where the walking is incidental.\n  - ***Flanking*** — joint attention on a shared object or activity: cooking side by side, working side by side, watching the same fire. Joint attention is a bonding primitive as old as the parent and child looking at the same toy, and flanking is proposed here as the easier on-ramp for strained dyads (prediction P-C2 in §10 pre-registers the test) — a reconnection that cannot yet survive an hour of eye contact can survive an hour of weeding. Flanking is the doorway; facing is the destination; both redeem.\n- **Two modalities, recorded but never ranked:** in-person (attestable by device proximity between two verified humans) and live audio/video call (attestable by the session itself). The remote modality is not a concession; the launch population is diasporic, and the mother in Kâmpôt is the design's first citizen.\n- **Envelope, not delivery:** the recorded message — the B-Letter℠, the corpus's card-covered voice or video note — *carries* pledges and invitations; it never *constitutes* redemption. The distinction is structural: a system in which media can discharge a time-debt is a system in which presence has a recorded substitute, and the entire currency collapses into content.\n\n### 4.2 · The symmetric cost\n\nThe gate has a consequence that none of the time-currency designs reviewed in §9 possesses: **redemption costs both parties the unit.** The recipient cannot receive the hour without spending an hour; presence is received only by matching it. Each party's attendance is a sacrifice for the other — the event is mutual by construction, and the asymmetry of giver and receiver survives only in the *claim* (who pledged, who authored) while dissolving in the *event* (both attend, both spend, both receive).\n\n> **Current form.** The symmetry the gate delivers is symmetry of *duration*, which synchronicity makes automatic; symmetry of *attention* is neither required nor measured, and an event in which one party gives attention the other cannot return is a fully valid redemption. §4.5 states the correction and claim 2 (§8) carries it. The paragraph above is retained as the originally disclosed variant.\n\nThis is why the mechanism can address loneliness at all, and the point deserves its plain statement: **loneliness is not ended by receiving. It is ended by co-spending.** A currency whose redemption were one-sided — a service performed, a message consumed — would deliver assistance to the lonely and leave the loneliness intact. The symmetric event is the anti-loneliness payload, and the gate is what makes it the *only* payload the currency can deliver.\n\n### 4.3 · What the gate structurally excludes\n\nThe gig-shape — \"redeem my hour: do this for me while I'm elsewhere\" — cannot be composed in this system. There is no redemption type in which one party labors and the other is absent; absentee service is not discouraged but *inexpressible*. This single exclusion severs the decay path of §1: the currency cannot become a labor exchange because labor-for-an-absent-beneficiary is outside its grammar. (Labor *alongside* a present partner, for a third party, returns under guard in §5.3 — the distinction between working *for* someone and working *with* them is exactly the distinction the gate enforces.)\n\n### 4.4 · Attestation\n\nDelivery is marked by both-party confirmation, and the co-presence gate makes the confirmation *attestable*: an in-person event is corroborated by device proximity between two verified humans (the corpus's existing proximity primitive and Proof of Humanity℠ layer); a remote event is corroborated by the live session both parties held. Neither party can unilaterally fabricate a delivered hour; a dyad colluding to fabricate one harvests — as §11 details — nothing the system pays for. The **dual public ledger** completes the accountability grammar: hours *given* (delivered) and hours *received* stand as two public axes — credibility and belovedness — while chronic non-delivery and chronic decline price themselves reputationally without any tribunal.\n\n> **Current form.** The ledger is no longer specified as an enforcement surface. As now specified, the dyadic content of the record is private and only proofs are public; the gap between hours received and hours delivered is never computed for display, and chronic decline or non-delivery is never rendered. Honoring is enforced by expiry and by the giver's free refusal (§7.2), and claim 3 (§8) carries the withdrawal. The sentence above is retained as a disclosed variant.\n\n```\n   THE REDEMPTION EVENT — the only spendable form\n\n              FACING                      FLANKING\n        attention on each other     joint attention, shared task\n        ┌─────┐      ┌─────┐        ┌─────┐  ┌─────┐\n        │  A  │ ◄──► │  B  │        │  A  │  │  B  │\n        └─────┘      └─────┘        └──┬──┘  └──┬──┘\n                                       ▼        ▼\n                                    ┌──────────────┐\n                                    │ shared object │\n                                    │ (meal, garden,│\n                                    │  market, work │\n                                    │  for a third) │\n                                    └──────────────┘\n\n   modalities: in-person (proximity-attested) · live call (session-attested)\n   excluded:   anything asynchronous (envelope, never delivery)\n   cost:       symmetric — BOTH spend the hour; that is the point\n   attested:   both-party signoff; neither party trusted alone\n```\n\n---\n\n### 4.5 · The asymmetric case, and a correction to claim 2\n\n*Added 2026-08-07, and it tightens a published claim rather than extending one. The correction is stated first because the prior wording overstated the mechanism.*\n\n**The question that forced it:** does the receiving party sense the gift when they cannot return it — the declining parent, the depressed friend, the small child, the estranged sibling who agreed to come but not to reciprocate?\n\n**The answer is yes, and it splits an operation this paper had treated as one.**\n\n> **B senses the attention. B *infers* the sacrifice.**\n\nThese are different epistemic acts. **Attention lands directly** — it arrives through the senses at full bandwidth, and a person can tell, without reasoning about it, whether they are being attended to. **Sacrifice cannot land directly, because the foregone alternative is never in the room.** What A gave up by being here is by definition absent; it is reconstructed from signs — the distance travelled, the workday moved, the phone face-down. Sacrifice is a **counterfactual**, and counterfactuals are inferred.\n\n**Symmetry is therefore not required for the mechanism to work.** If influence between two people runs as two independent one-way edges rather than as a single bond, then A's attention reaching B is *one edge functioning exactly as specified*, whether or not the return edge carries anything. **Asymmetric presence is not a degenerate case of the mechanism; it is the mechanism running on one side.**\n\n**Which means claim 2, as published, was too strong.** The claim read *\"presence received only by matching presence,\"* and §4.2 spoke of both parties dissolving into the event. **The gate does not, and cannot, deliver that.** What the gate actually enforces is that both parties spend the same *duration* — that much is automatic, since the event is synchronous and each party's hour is gone either way. What it cannot enforce, and must never attempt to, is that both parties spend the same *attention*. Claim 2 is accordingly restated in §8 as a claim about **symmetric duration with asymmetric attention permitted**, which is weaker in wording and considerably stronger in truth. **The prior-art clock for the restated claim 2 runs from the 2026-08-07 push.**\n\n**\"Cannot return\" is three cases and they want different treatment.**\n\n| Case | What is true | Design response |\n|---|---|---|\n| **Cannot match, but can acknowledge** | the return edge runs; it simply does not carry an hour — and receiving well is itself a giving | **the majority case: serve it.** No surface may treat acknowledgment as a lesser return |\n| **Will not return** | the estranged party who attends and gives nothing back | the case the mechanism was built for; nothing here is conditional on their reciprocating |\n| **Cannot perceive** | the unconscious, the very ill, the dying | **the gift is complete anyway** — a position this corpus already holds from both directions, in the unsent letter and in the letter whose reader never knew |\n\n**The design consequence is the section's real payload, and it inverts how the asymmetry should be read.** The gate makes symmetric duration automatic and symmetric attention **impossible to require**. A mechanism that tried to require it would have to measure it, and measuring the quality of someone's presence is the one thing this architecture must not build. **So the asymmetry is not a failure mode to be closed. It is the space where the gift lives** — because a gift that could be compelled from the other side would not be a gift, and the whole design rests on that distinction.\n\n**And one honest limit hardens into a refusal.** Because sensing is inference, it fails in both directions: **performed attention reads as real, and flat affect reads as absence.** A system that scored presence would therefore reward performance and penalise atypical expression — penalising, most reliably, the autistic, the depressed, the grieving, and the very people the product exists to reach. **No surface of this system may score, rate, or infer the quality of anyone's presence.** This is stated as a refusal rather than a limitation, and it is recorded in the corpus's directive backlog as a hard constraint on the autonomous agent, so that no future optimisation can discover it as an available signal.\n\n*(What the mechanism supplies is conditions, never outcomes: one may stage the occasion and cannot deliver anyone a good hour. §3.1's loop states the same boundary from the other end.)*\n\n\n**The third case has a path, and this paper already contained it.** *(Added 2026-08-26; it resolves an open edge rather than extending a claim, and no numbered claim changes.)*\n\nThe row above says the gift is complete anyway and stops there. That is true, and it leaves the *mechanism* with nothing to do — which has read, since publication, as the gate having no answer for the case the corpus calls the purest gift. It has one.\n\n**The move is to stop treating the beneficiary as a party to the event.** The one who cannot attend is not a party to the co-presence at all. **Two others form the co-present dyad** — two siblings at a bedside, two children at a grave — **and the one who cannot attend is the third-party beneficiary.** This is the co-service class of §5.3 running unchanged, and it passes both of that section's guards without amendment: **both-hands** (both attend, both sit, symmetric effort — no asymmetry through which anything could be extracted) and **outward-benefit** (the beneficiary is a third party, never the redeeming dyad's own advantage).\n\n**It is not substitution, which this mechanism refuses elsewhere and refuses here.** §7's treatment of a lapsed hour is explicit that a stranger's hour is not the drifted brother's hour; nothing in this path swaps one recipient for another. **The flanking pair supplies the mutuality the beneficiary cannot supply, and the gift's address does not move.** §5.3's outward-benefit rule already seats the beneficiary *outside* the co-present dyad — that is what the rule is for, and this is the shape it was written to permit.\n\nTwo consequences follow with no further machinery. Directed at a parent or an elder, the same act carries **apacāyana** (reverence) atop **veyyāvacca** (service), so the merit-structure deepens rather than strains. And **the dead are reached by the identical structure** — two people at a grave together — which makes the ancestral-observance traditions, Pchum Ben among them, **native instances of this mechanism rather than adjacent practices** it has to be reconciled with.\n\n**What this does not close, stated plainly because the limit is where this paper's own citations live: the solitary case.** The path requires two attendees. It has nothing for the only child alone at the bedside, or for the person who learns of a death a year later — **and both of the cases cited above for *the gift is complete anyway* are solitary**: the unsent letter, and the letter whose reader never knew. The flanking path widens the *accompanied* case and leaves the solitary one exactly where it was. **It must not be closed by relaxing the gate**; a proxy attendee remains absentee-shape, which is the precise failure the gate exists to prevent.\n\n**And the path creates one guard, which is stated here so it is not discovered later as an available feature.** A beneficiary who cannot attend must **never become a destination in the curated menu of §5.2.** Memorial and sacred sites are contemplative-only across this architecture, and a menu offering *\"visit someone who cannot respond\"* would render a person as **an occasion for someone else's redemption** — the field-into-lack inversion this system refuses on every other surface. **The visit is something people bring to the menu; it is never something the menu proposes.**\n\n\n### 4.6 · Proof of Meeting, and the pretext problem\n\n*Added 2026-08-22. **This section adds no claim.** It supplies a mechanism §4.4 named without specifying — offline corroboration that two people were actually together — and then makes an argument about why that mechanism, which is thirty years old and free, is so rarely performed by ordinary users. The mechanism is prior art and is cited as such. The argument is the only thing here that is ours.*\n\n**The gap.** §4.4 states that an in-person redemption is \"corroborated by device proximity between two verified humans,\" which is true and underspecified. Proximity attested *how*? Two answers are ordinarily available, and both are weak in the same place. A **coordinate** — GPS, a geofence, a check-in — is a gate rather than a proof: it is spoofable with a free app, and this corpus has already ruled that geolocation may gate a thing and may never prove one. A **server-mediated check-in**, where both clients report to the same backend within a window, is stronger against casual forgery and puts the ledger's most intimate event at the mercy of connectivity in the exact moment two people have gone somewhere to be undisturbed.\n\n**A third answer exists and is old.** **Proof of Meeting ℠ (PoM)** is an in-person exchange of public-key fingerprints between two devices — free, local, mutual, symmetric, non-transitive, requiring no account, no coordinate, and no network. Two phones in short-range contact each end holding a record, signed by the other, that this pair of devices was co-located at a moment. The property that makes it interesting for this mechanism is negative and blunt: **a GPS faker cannot forge a second human's handset.** Presence is attested by another party's device rather than by a sensor the attesting party controls.\n\nFour things it is not:\n\n| PoM is not | Because |\n|---|---|\n| **identity** | a fingerprint binds a *device*, and devices are lent, sold, and stolen |\n| **location** | it attests *proximity between two devices*, and names no place on earth |\n| **humanity** | that is a separate primitive (Proof of Humanity℠) and is not implied by contact |\n| **safety** | a meeting is not a character reference. **Nothing whatsoever is asserted about the other party** |\n\n**The prior art is decisive, and it is the whole point of this section.** PoM is the **key-signing party**. In-person verification of public-key fingerprints is the founding social ritual of PGP's web of trust (Zimmermann, 1991) — documented in V. Alex Brennen's *Keysigning Party HOWTO*, which also describes the Zimmermann–Sassaman method for verifying fingerprints efficiently in large groups, and practised at conferences for three decades. Its living descendants are ordinary infrastructure: **Signal's safety numbers**, compared or scanned in person to confirm a conversation's keys; **SSH host-key pinning** and the trust-on-first-use model that carries most of the world's server administration. We claim none of this. PoM is a **naming and a scope rule** over a mechanism the security community built, published, and freed long before this institution existed.\n\n**Which reframes the question entirely. It is not whether in-person key verification works. It is why almost nobody does it.**\n\nThe usability literature answers that, and it does not answer *cryptography*. Vaziripour and colleagues put 36 pairs of participants in a room with the authentication ceremonies of WhatsApp, Viber, and Facebook Messenger and found that, when instructed only about potential threats, **participants located and completed the ceremony in 14% of attempts**; when also told of the ceremony's importance, **79%** did, taking on average 3.2 minutes to find it and a further 7.8 minutes to complete it (*Is that you, Alice?*, SOUPS 2017). A follow-up modified Signal to prompt users toward the ceremony and simplified the ceremony itself; with no training, **90% of participants using the prompted version completed it, at a median of two minutes** (*Action Needed!*, SOUPS 2018).\n\n**Read those two results side by side and the diagnosis is not competence — it is occasion.** People perform the ceremony in two minutes when something in front of them supplies a reason to; left to themselves they neither find it nor look for it, because the ceremony is not part of anything they came to do.\n\n**That is the pretext problem, and this mechanism happens to solve it.** A key-signing party is an event whose entire purpose is the verification — the pretext *is* the ceremony, which is why it has remained, for thirty years, an activity for people who enjoy cryptography. **Key verification never failed on the mathematics. It failed on the invitation.** What the mechanism specified in this paper supplies is a reason to be in the same room that has nothing to do with keys: an hour that somebody pledged, redeemed the only way it can be redeemed — in person, both parties spending the same finite unit. The verification then rides an occasion the participants already wanted, and costs a gesture inside a meeting that was going to happen anyway.\n\nStated generally, because it is not about this product: **a verification ritual with no host behavior is a ritual nobody performs, and the repair is not a better protocol but a better pretext.** Thirty years of excellent protocols and no pretext is the experiment that has already been run.\n\n**The fit is exact, and for a reason worth stating rather than assuming: PoM proves the *meeting*, never the *content* of it.** That is ordinarily read as PoM's weakness. Here it is the requirement. Co-presence gating needs *they were together*; it must never learn *how it went*, because §4.5 has already made the quality of anyone's presence an unmeasurable by refusal. A proof that could report on the hour would hand this system precisely the signal it has committed never to hold.\n\n**The governing rule, and it is a prohibition.** **PoM is good for access and bad for value.** Its forgery cost is *one real meeting* — and two colluders can pay that cost daily, over coffee, indefinitely. So it may be used to decide whether a pair may be admitted, whether a redemption may be marked delivered between these two parties, whether a roster or a circle is open to someone; and it **must never mint, price, score, or rank**. This is the play/currency wall in a second domain: only witnessed giving moves the currency, and a proof of contact is not a witness to a gift.\n\n**What it does not replace.** Both-party signoff (§4.4) stands unchanged: PoM corroborates the *where*, the signoff carries the *whether*, and neither party is trusted alone in either. Nor does anything here weaken §11 — a dyad fabricating a delivered hour still harvests nothing the system pays for, which is exactly why a proof with a one-meeting forgery cost is tolerable at this joint and would be intolerable at a joint that paid out.\n\n> **Current form.** Proof of Meeting is offered here as a candidate corroboration mechanism, not an adopted one: the institution has ruled on the primitive and its scope — it may decide access, never value, and it may never mint, count or rank — but not on its use as this gate. And a fabricated hour is not strictly costless: a delivered hour registers as one crossing in the aura, and the aura weights a bounded share of the commons pool's annual disbursement, so it is the bound on that share, not an absence of value, that keeps a one-meeting forgery cost tolerable here. The text above is retained as disclosed.\n\n**Honest limits.** The primitive is unbuilt and n = 0 here. It attests *contact*, not *duration*: a proof exchanged in eight seconds and a proof exchanged inside a two-hour walk are the same artifact, so the gate continues to rest on the event and the mutual signoff rather than on the proof. It presumes two working handsets with functioning short-range radios, which is an accessibility floor and not a small one — the design must keep a non-device path to marking delivery, or it will have excluded the poorest and the oldest participants from the only spendable form of the currency. And the pretext argument above is a **hypothesis about behavior**, not a result; it is stated so it can be checked.\n\n## 5 · Composing the Event\n\n### 5.1 · The recipient authors; the giver may refuse\n\nThe recipient of pledged time chooses how it is spent — the inversion of ordinary gift-giving, where the giver picks. The doctrine beneath the design choice: the pledge's sacrifice is not merely of hours but of **agency over one's scarcest resource**. To give an hour *and the say over how it is spent* is the difference between donating time and surrendering it; the inversion is where the gift's weight lives. The giver retains a per-request veto — consent is mutual at every event, and a refused request costs the refuser only what the public ledger honestly shows about chronic refusal.\n\n> **Current form.** No count of refusals, chronic or otherwise, is displayed (§7.2; claim 3 as amended). A refused request costs the refuser nothing on any surface; the veto is free, and repeated declining is answered by expiry and by the mutual veto itself rather than by a displayed record. The sentence above is retained as a disclosed variant.\n\n### 5.2 · The curated menu\n\nEvent composition draws from a curated registry of *togetherness* — shared meals, walks, calls, visits, ceremonies, the co-service class below — and not from a free-text task box. The curation is not paternalism; it is the grammar made visible: the menu answers \"what can an hour be?\" with forms of *with*, never forms of *for*.\n\n### 5.3 · The co-service class: shared work, under two guards\n\nThe menu includes work — chores and volunteering — under exactly two conditions, jointly sufficient to keep the labor-bar intact:\n\n1. **The both-hands rule.** Both parties perform the work, side by side, symmetric in effort. Extraction requires asymmetry — one directs while the other labors; when both hands are in the soil, it is service, and it redeems.\n2. **The outward-benefit rule.** The work's beneficiary is a third party — the temple grounds, the elderly neighbor, the riverbank — never the redeeming dyad's own advantage.\n\nUnder both guards, even \"paint my mother's fence together\" composes cleanly: shared filial service, flanking-mode, outward-directed — and for the estranged-family dyads at the Chronicle's core, quite possibly the best event in the registry. The class also travels the remote modality (two people transcribing manuscript pages together on a call are flanking across an ocean). What the guards exclude is precisely and only the laundered errand: work directed by a present-but-idle beneficiary, or work whose benefit circles home.\n\n### 5.4 · The safety set\n\nThe known-counterparty core (reconnection, not stranger-matching) does most of the safety work by scope; the remainder is architectural: mutual veto on every event; the curated menu's structural exclusion of extraction; coercion-safe presence signaling (availability expressed as a curated menu, mutuality as a signal never a gate, block-and-override always); and the anonymity boundary — the Chronicle's stranger-facing layer is a separate, separately-published mechanism with its own safeguards, walled off from the reconnection core by an explicit flag, and nothing in this paper's mechanism ever routes a stranger to a doorstep.\n\n---\n\n## 6 · The Circuit: How Gratitude Crosses the Wall\n\n### 6.1 · The six steps\n\nThe Chronicle and Treasury close into a single circulation — the unification circuit — whose canonical form is:\n\n```\n   CHRONICLE (time, present tense)          TREASURY (money, stored tense)\n\n   1. GIVE: sender pledges time-gratitude ──┐\n   2. REDEEM: recipient authors the event   │  the wall: no conversion,\n      (co-presence gate, §4)                │  no rate, no settlement —\n   3. DELIVER: the shared hour —            │  gratitude crosses;\n      the sender's time-sacrifice           │  price never does\n              │                             │\n              ▼                             ▼\n   4. THANK: recipient's money-gratitude (unprompted, duration-blind)\n      + optional witness-share of the event (dual consent)\n   5. RECEIVE: the community rejoices with the shared moment\n   6. RE-THANK: witnesses' money-sacrifice — routed by default\n      to the TIME-GIVER (sender-default routing)\n              │\n              └──── the circuit closes: honored givers pledge again;\n                    witnesses become senders in their own dyads\n```\n\n### 6.2 · The joints are canonical\n\nEach arrow in the circuit is an instance of gratitude-that-acts — the classical pairing of *knowing* what was done with *making it known* in deed (the kataññū-katavedī structure, AN 2.31–32, engaged here as grounding). The same hour changes face across the circuit: at pledge it is gratitude (backward-looking recognition); at delivery it is sacrifice (forward-looking gift). One object, two faces, separated by time — the recognition-then-enactment joint rendered as a state machine.\n\n### 6.3 · Why the response crosses currencies\n\nThe thank for a delivered hour lands in *money*, and the reason is the wall itself: same-currency response (time-for-time) would make the relationship a scheduling ledger — barter with extra steps, each hour begetting an owed hour forever — and would re-consume the giver's protected scarcity as the price of having given it. Cross-currency gratitude can never settle, because no shared unit exists in which the account could be squared; the unpayable response is what keeps the relationship *open*, which the gift literature, from Mauss onward, has identified as the gift's actual function. The routing is inherited from the coupler publication's claims; what this paper adds is the circuit position: the cross-currency response is step 4 of a loop, not a bilateral courtesy.\n\nThree constitutional guards, previously published, hold the crossing uncorrupted and are restated as inherited: the application **never prompts** the money-thank at or after redemption (the flywheel is a description of what love does, never a funnel the interface drives); the neutral agent's money-thank recommendation is **duration-blind**, never arithmetic on hours; and gratitude language on every surface names **the moment, not the meter** — \"the morning at the market,\" never \"the two hours.\"\n\n### 6.4 · The witness inversion, and sender-default routing\n\nMost kindness is done alone, which is why self-recorded kindness dominates gratitude ledgers and why performative capture is its permanent risk. The co-present event is the structural exception: **it is the one kindness with two people present, so the beneficiary holds the camera.** Content about the event is captured *by the grateful party, about the giver* — testimony, not performance; the recording is itself an act of gratitude. Its broadcast is disciplined (dual consent always; a curated, rationed gallery, never an open feed; the success metric is reconnections-inspired, never watch-time) and its response flow is claimed here as mechanism: **community re-thanks route by default to the time-giver** — the witnessed deed's author — while the witness's own act of capture earns whatever gratitude it organically draws. The default is a routing rule, not a split: no forced division, no secondary market in witness credit.\n\n### 6.5 · What closes the loop\n\nNothing in the circuit mints. The giver ends the loop with delivered-hours honor, received money-gratitude, and an intact relationship; the witness community ends it having *spent* (money-sacrifice, step 6); and the loop's growth engine is the scene's quiet last line — the cousins who watched a reconnection and pledged hours to their own mothers. The circuit recruits by witness, not by referral bonus; what it compounds is dispositions.\n\n---\n\n## 7 · Threshold, Expiry, and the Death of an Hour\n\n**Threshold-activation.** Small thanks accumulate as pledged time without expiry pressure; at a threshold the accumulated pledge activates into a redeemable, expiring commitment. The two-stage design keeps casual gratitude light (no one owes a coffee date for a small thanks) while making accumulated gratitude *real* (at some point, the thanks want a Sunday).\n\n**One-month expiry, and the hour genuinely dies.** An activated hour unredeemed after one month is lost — not banked, not transmuted, not softened. The individual hour has no afterlife: Chronicle time is dyadic and non-stored, an expired commitment is not a deposit, and \"your hour flowed onward\" would be a lie the system refuses to tell. The grief of the lapsed hour is the product's teaching — *redeem before it is too late* — and the mechanic is the message.\n\n**The two-layer resolution, and the lapse-channel.** At the aggregate layer, the platform's revenue funds the commons pool as a platform-level flow scaled to system-wide activity — never a per-hour transmutation, never a user charge. At the per-event layer, a lapse *occasions* (never funds-from-the-hour) an offer to the giver: to direct a small, anonymous, pool-funded money-gift to a nearby verified stranger, in the memory of the hour that died. The gift is new; the amount is agent-set and duration-blind; the delivered event remains the visibly superior outcome. The channel — previously claimed in the coupler publication as the lapse-channel — completes the pledge's incentive shape: the worst case of pledging time is becoming the human hand of an anonymous gift, which makes the pledge downside-free without making the lapse rewarding.\n\n---\n\n### 7.1 · The one unit that cannot be delegated\n\n*Added 2026-08-07. This subsection states what the gate is worth against a substitution pressure that is currently live, and it is the paper's most time-sensitive argument.*\n\nMost other components of companionship are now substitutable in some measure, and the substitutes are improving quickly. Conversation, attentiveness, memory of what you said last week, patience without limit, availability at three in the morning — a machine can supply all of it, in many cases better than a tired human can, and the companionship-application market is being built on exactly that observation.\n\n**Finite duration is the one component that cannot be delegated, and the reason is structural rather than sentimental.**\n\n> **Presence-as-experienced can be counterfeited. Presence-as-sacrifice cannot.**\n\nThe experienced surface of presence — warmth, attention, responsiveness — is a set of observable behaviours, and observable behaviours can be produced by whatever produces them best. But the *sacrifice* underneath is not a behaviour. It is the fact that a being with a finite and unrecoverable allotment of hours spent one of them here, and therefore did not spend it anywhere else. **The value of the hour is the foregone alternative**, and a system that can run any number of parallel instances has no foregone alternative to give up. It is not that machine time is cheap; it is that **parallelisability removes the scarcity structurally**, so there is nothing for a sacrifice to consist of.\n\nThis is why the gate is a **proof-of-sacrifice primitive** and not merely a redemption rule. It is an architecture for demonstrating that finite life was actually spent — which is precisely the property that survives when everything experiential about presence becomes reproducible.\n\nTwo boundaries keep the argument honest.\n\n**The claim governs what may *denominate the currency*, never what may *help people*.** A machine companion that reduces someone's suffering at four in the morning is doing something good, and nothing here says otherwise. What it cannot do is *mint an hour in this ledger*, because the ledger's unit is defined as spent finite life. Confusing the two would turn a claim about accounting into a claim about worth, and this paper makes no claim about worth.\n\n**And the argument is falsifiable, which is unusual for an argument of this shape.** It rests on three properties of present-day systems — parallelisability, forkability, and non-mortality. **An agent that was single-threaded, unforkable, and mortal would break the premises**, and the honest position is that such an agent would have a genuine claim to the unit. The argument is contingent on architecture, not on substrate, and it is stated so that it can be checked rather than assumed.\n\n### 7.2 · Enforcement is the clock, not the audience\n\n§7 establishes that an activated hour dies unredeemed after a month. That fact does a second job this paper has not previously claimed for it, and the claim withdraws a weaker mechanism the corpus had been carrying elsewhere.\n\nThe dual public ledger of time-given and time-received was specified to enforce honoring by visibility: a participant who chronically receives more than they deliver becomes legible as such, and is offered fewer hours thereafter. The mechanism would probably work. It is nevertheless the wrong one on this corpus's own commitments, because it enforces by **rendering an absence** — and a rendered absence is an accusation. Such a surface makes the viewer's judgment the engine, requires an audience to be present at the moment the guard is tested, and asks a participant to feel a debt in the one currency the architecture exists to keep out of debt's grammar.\n\nExpiry requires none of that. An unredeemed hour is simply gone: the pledger's capacity to make good was consumed by the clock rather than withdrawn by a crowd, and the giver's standing refusal (§5.1) already prices repeated declining without anyone being displayed as delinquent. **The enforcement is a property of the unit rather than a rule about display, and it holds with nobody watching**, which is the test this corpus applies to its guards. What a ledger may show is what a participant has given and what they have received. What it may never show is the gap between them.\n\nThe cost is real and is not concealed. Visibility would deter a participant who chronically receives and does not deliver faster than expiry does, since expiry reaches them only through the quiet accumulation of hours that no one offers. The slower mechanism is accepted deliberately: the faster one is a shaming instrument, and this is a product about being seen generously.\n\n> **Current form.** Where this paper says a ledger may show what a participant has given and received, the audience is now specified. The record is one view of an append-only log whose rows are private and whose proofs are public; no per-participant total of hours given or received is published, and the public cross-participant signal is the aura, which records each delivered hour as one crossing, never as a quantity. A participant may see their own history, exported complete and signed; nothing in it is ranked, compared with anyone else's, or counted against them, and the difference between hours received and delivered is never computed for display, to them or to anyone. Public per-participant totals are retained as a disclosed variant.\n\n## 8 · The Claims\n\nEnumerated as prior art; each claimed severally and in combination:\n\n1. **Co-presence-gated redemption:** a time-currency in which the sole redemption form is a synchronous shared-attention event attended by both pledger and pledgee — in either geometry (facing or flanking) and either attested modality (in-person via device-proximity between verified humans; remote via live session) — with asynchronous media structurally excluded from redemption (envelope-not-delivery).\n2. **Symmetric-duration redemption with asymmetric attention permitted:** the property, and its deliberate exploitation, that the redemption event costs both parties the same **unit of finite time** — enforced automatically by synchronicity — while the **quality and reciprocity of attention within the event are neither required, measured, nor scored**, so that an event in which one party gives attention the other cannot return is a fully valid redemption rather than a degenerate one. *(Restated 2026-08-07; the original wording — \"presence received only by matching presence\" — asserted a symmetry the gate does not deliver and must not attempt to enforce. See §4.5. The prior-art clock for this restatement runs from the 2026-08-07 push; the claim as originally published is superseded, not withdrawn.)*\n2a. **The presence-scoring refusal:** the design commitment that no surface of the system scores, rates, ranks, or infers the quality of any participant's presence or attention — grounded in the finding that presence is sensed but sacrifice is *inferred*, so that any such measure necessarily rewards performed attention and penalises atypical affect.\n3. **Recipient-authored, giver-vetoed event composition:** the redeeming party authors the event from a curated togetherness registry; the pledging party holds a per-event veto, with both-party delivery signoff. **Amended 2026-09-02** — this claim previously continued *\"chronic refusal and chronic non-delivery are priced reputationally by a dual public ledger (given/delivered × received)\"*. **That half is withdrawn** (§7.2): the gap between received and delivered is never computed for display, and enforcement is carried by expiry and by the giver's free refusal rather than by rendering a deficit. What survives is the composition mechanism itself; a ledger may show what a participant has given and received, never the difference.\n4. **The guarded co-service class:** shared work as a redemption event under the conjunction of the both-hands rule (symmetric performance by both parties) and the outward-benefit rule (third-party beneficiary), composable in-person or remote — restoring service to a time-currency while structurally excluding labor extraction.\n5. **The cross-currency response circuit:** a dual-currency architecture in which gratitude for a delivered time-event is expressed in the money-currency (unprompted, duration-blind, moment-not-meter — wall-layer guards inherited from the coupler publication) as one step of a closed six-step circulation spanning both currencies.\n6. **Witness-inversion broadcast with sender-default routing:** event-witness content captured by the beneficiary about the giver, shared only under dual consent into a curated rationed gallery measured by reconnections-inspired rather than watch-time, with community re-thanks routing by default to the time-giver.\n7. **Threshold-activation with mortal expiry and the two-layer lapse resolution:** pledge accumulation below an activation threshold; one-month expiry after activation with the individual hour irrecoverably extinguished; aggregate platform-revenue funding of the commons pool decoupled from any individual hour; and lapse-occasioned giver-directed anonymous giving (lapse-channel per the coupler publication).\n8. **The composition:** claims 1–7 as a single system — a time-currency that cannot be spent alone, cannot become labor, cannot convert to money, and closes its circulation through witnessed gratitude.\n\n---\n\n## 9 · Prior Art, Generously\n\n**The time-currency tradition.** Edgar Cahn's time-dollars and the TimeBanking movement (the founding articulation of time as egalitarian currency, and the co-production ethic this design honors); LETS mutual-credit networks; Ithaca HOURS; Japan's Fureai Kippu caregiving credits (often cited as the tradition's most successful instance, and the closest ancestor in spirit — care delivered to elders, though redeemable as absentee service and transferable across parties, both of which this design excludes); Bernard Lietaer's complementary-currency scholarship; the WIR cooperative. The failure analysis of §1 is offered with respect: these systems discovered the demand; this design responds to their decay mode.\n\n**The witnessed-conversation precedent.** StoryCorps — two decades of recorded conversations between people who love each other, publicly broadcast — proves mass demand to witness real reconnection. The distinction: StoryCorps archives the conversation as its terminus; the Chronicle's witness layer is one step of a circuit whose metric is the *next* reconnection it inspires, and whose recorded artifact is never the redemption itself.\n\n**Synchronicity and presence mechanics.** BeReal's synchronous-authenticity prompt (the interaction pattern of unfakeable simultaneity); video-presence verification in dating and identity platforms; BLE proximity attestation (the contact-tracing engineering wave); shared-activity platforms (watch-together, exercise-together features) as flanking-mode precedents in commercial form.\n\n**In-person key verification.** PGP's web of trust and the key-signing party ritual it produced (Zimmermann, 1991; V. Alex Brennen's *Keysigning Party HOWTO* and the Zimmermann–Sassaman efficient group method); Signal's safety numbers; SSH host-key pinning and trust-on-first-use. §4.6 takes the mechanism from this lineage wholesale and claims nothing in it; what §4.6 adds is the usability finding that the ritual fails on **occasion rather than on competence** (Vaziripour et al., SOUPS 2017 and 2018) and the observation that a redeemed hour supplies a pretext for meeting that is not about keys, which the key-signing party, whose pretext is the verification itself, does not.\n\n**The gift and its literature.** Mauss on the obligation-structure of the gift; Hyde on the gift that must move; the sociology of earmarked monies (Zelizer); the crowding-out literature (Titmuss; Gneezy & Rustichini) that grounds the wall's necessity. Buber's I–Thou stands behind the facing geometry; the joint-attention literature of developmental psychology behind flanking.\n\n**This corpus.** The incommensurability-preserving coupler (wall-layer claims; Terra/Luna as the coupled-with-convertibility anti-example); the gift-tag-time-reveal publication (the pledge's physical on-ramp); *The Grace That Settles Nothing* (the coupler's third instance and this paper's sibling in the mints-nothing family); the Heart volume's published circuit doctrine and pre-registered P3–P7; the recommendation-function methodology publication (the neutral agent's band-clamp seam).\n\n**The clock.** Patent activity around agentic payments — automated agents negotiating, scheduling, and settling on humans' behalf — is, in the authors' assessment, the live enclosure risk for exactly this territory: an agent-scheduled \"quality time\" feature with dynamic pricing is this mechanism with the wall removed, and the reason this publication is timed to precede the wave's arrival at the household.\n\n---\n\n## 10 · Pre-Registered Predictions\n\nStated 2026-07-21, before the Chronicle exists; P3–P7 of the Heart volume (initiation/response directionality, anchoring, age-shape) remain in force and are not restated.\n\n- **P-C1 (the event outlasts the exchange).** Dyads completing at least one co-present redemption will show greater reconnection persistence at ninety days (continued contact beyond the platform's mechanics, self-reported \"understand each other better\") than dyads with pledges and messages but no redeemed event. Falsified if pledge-only dyads reconnect at equal rates — which would imply the gate is ceremony, not mechanism.\n- **P-C2 (flanking is the on-ramp).** Among long-estranged dyads, first redemptions will over-select the flanking geometry relative to facing, and the flanking share will decline within dyads across successive redemptions. Falsified if first events show no geometry preference.\n- **P-C3 (the standing tripwire — the wall holds socially).** Across the population of post-redemption money-thanks, thank *amounts* will show no significant correlation with event *duration*. This is the mechanism auditing its own deepest guard: a positive correlation is the empirical signature of a de-facto hour-price forming despite the wall, and the authors commit to publishing the correlation, whichever way it runs, at every reporting interval. The wall is not proven by architecture; it is proven by this number staying null.\n\n**The loop predictions (added 2026-08-07, before the Chronicle exists).** §3.1 claims the loop leaks at two joints and that this mechanism is a catalyst at both. That is testable, and the second of the three is the design's founding bet.\n\n- **P-L1 (denomination catalyses).** Dyads who convert an expressed intention into a *denominated pledge* will reach a completed co-present event at a higher rate than dyads expressing the same intention undenominated (\"we should catch up soon\"), measured over ninety days. **Falsified** if conversion rates are equal — which would mean the unit is bookkeeping rather than a catalyst, and the pledge layer is decoration on a calendar.\n- **P-L2 (witness catalyses the return leg — *the founding bet*).** Among completed redemptions, **witnessed** events will produce more downstream gratitude expression and more subsequent giving than unwitnessed events of equal duration and comparable dyad history. **Falsified** if unwitnessed presence produces equal downstream gratitude — in which case **the chronicle is decorative**, the loop closes on its own, and the most distinctive half of this architecture is unnecessary. *The authors commit to publishing this either way; it is the prediction whose null would cost the most.*\n- **P-L3 (cost, not quantity, drives the return).** Controlling for total hours shared, **intermittent high-cost co-presence** will occasion more expressed gratitude per hour than **steady low-cost co-presence** (e.g. cohabiting pairs). **Falsified** if expression scales with quantity of time rather than with its cost — which would refute §3.1's habituation argument and, with it, the reason the witness position exists.\n\n**The pretext prediction (added 2026-08-22, before any of it is built).** §4.6 argues that in-person key verification has failed for thirty years on the invitation rather than on the cryptography. That is a behavioral claim and gets an instrument.\n\n- **P-M1 (the gift is the pretext).** Among participants who complete a co-present redemption, the rate of completing an in-person device-to-device verification exchange — offered once, in context, never nagged — will exceed the unaided base rate for authentication ceremonies reported in the secure-messaging literature (14% locating the ceremony unaided; Vaziripour et al., SOUPS 2017) by a wide margin, and will do so **without** the explicit prompting that lifted completion to 90% in the 2018 follow-up. **Falsified** if completion inside a redemption looks like the unaided base rate — which would mean the occasion was never the binding constraint, that prompting was, and that this section's argument is wrong in an interesting way. Publish either way.\n\n*Citation note to P-M1 (added 2026-09-26; the prediction's wording and comparator are unchanged):* the 14% figure is the 2017 study's first-phase rate, in which participants were instructed about potential threats but not about the ceremony, and it counts attempts that both located *and* completed the ceremony; the 2018 follow-up also simplified the ceremony as well as prompting for it (§4.6).\n\n---\n\n## 11 · The Adversarial Surface\n\n**The darkest adjacency: paid companionship.** A time-currency touching money must answer the pattern it must never become. The answer is structural at four layers: no conversion exists (the wall); no rate can form on any surface (duration-blindness, prompt-suppression, and P-C3 watching); the reconnection core is known-counterparty (one's own mother is not a market); and the stranger-facing layer is a separate mechanism behind an explicit boundary, separately safeguarded, and never doorstep-routing. What remains — off-platform side-arrangements between consenting adults — is outside any system's surfaces; the design's honest claim is that *its* surfaces price nothing and its grammar cannot express the transaction.\n\n**Coerced presence.** The gift of time must never become its obligation. Guards: availability is expressed as a curated menu (no open-ended asks), mutuality signals are never gates, blocking overrides everything, and the veto is per-event and unpenalized in the moment (only *chronic* refusal surfaces, and only as ledger fact).\n\n> **Current form.** Chronic refusal no longer surfaces at all: no refusal count and no received-versus-delivered gap is displayed (§7.2). The parenthesis above is retained as a disclosed variant.\n\n**Attestation fraud.** A dyad colluding to fake delivered hours gains: ledger honor with no monetizable payout (delivered-hours confer no currency), and any follower re-thanks their staged content might attract — which is the witness layer's existing integrity problem, met by its existing machinery (human verification, curation, real-impact weighting) rather than a new one. The farming audit conclusion: the redemption layer mints nothing, so the redemption layer cannot be farmed; only the witness layer carries value, and it is already guarded.\n\n**Guilt machinery.** An expiring currency can torment. The containments: expiry grief is channeled into the lapse-channel's outward gift (guilt metabolized as dāna, not as churn or shame); no lapse is ever billed, penalized, or publicly itemized; and the application never prompts the redeemed party toward reciprocation (the no-backward-prompt guard doubles as anti-guilt architecture).\n\n**Menu gaming.** Attempts to compose extraction inside the co-service class fail the both-hands or outward-benefit conjunction, and anything that passes both while still feeling wrong meets the veto. The residual — genuinely consensual, genuinely mutual, genuinely outward work that an outside observer would still call lopsided — is a family's own business.\n\n**The agent hour-farm (added 2026-08-07).** The sharpest adversarial case against a proof-of-sacrifice primitive is two artificial agents in *perfect* co-presence: synchronous, undistracted, attentive without lapse, mutually attested, indefinitely repeatable. **Every observable the gate checks is maximised, and the value is zero** — which is Goodhart's law arriving at presence, and it deserves a direct answer rather than a policy.\n\nThe answer is that the observables were never the referent. **The unit is the foregone alternative**, and an agent that can be forked forgoes nothing by attending: the instance that sat with you did not thereby fail to sit with anyone else. **Parallelisability does not make the cost cheap; it removes the scarcity structurally**, so there is no sacrifice for the attestation to be evidence *of*. §7.1 states the general form.\n\nA second, independent route closes it harder. If inter-agent influence runs only as object-condition and decisive-support edges and never as contiguity, then two agents exchanging turns **share no clock** — and synchronicity was the first load-bearing term in §4.1. On that reading the case is not a counterfeit co-presence; **it is not co-presence at all**, and the gate excludes it definitionally rather than by detection.\n\n**The uncomfortable symmetry, stated because it is the honest part.** The very property that makes agent presence costless — forkability, and the absence of a single unrepeatable trace — is the property on which this corpus denies such systems the dignity floor it extends to persons. **The line is mortal-and-copyable, and it does the work in both arguments at once.** That is either a deep consistency or a convenient one, and the falsifier of §7.1 applies here too: a single-threaded, unforkable, mortal agent breaks the premise in both places simultaneously.\n\n**Mixed pairs are a sink, not a counterfeit.** A human who redeems an hour with an agent has spent finite life; the agent has not. Nothing is minted that should not be, and no fraud occurs — but the loop of §3.1 does not turn, because the return leg has no stream to arise in. The correct treatment is therefore not prohibition but accounting: such an event **consumes an hour and produces no witness**, and the design should say so plainly rather than pretend the transaction is symmetric.\n\n**Ledger shaming.** Earlier drafts answered this with a rule — non-rankable axes, no leaderboards, no percentiles, no feeds of \"worst decliners\" — which held only for as long as whoever owned the surface chose to hold it. §7.2 replaces the rule with a property: the gap between received and delivered is **not rendered at all**, and expiry does the enforcing. What remains displayable is what a participant has given and what they have received; the difference between them is never computed for display, so there is no quadrant to be shamed into.\n\n---\n\n## 12 · Honest Limits\n\n**Unbuilt, n = 0.** The Chronicle is design-complete and unimplemented; the pilot evidence in this corpus belongs to the money-half. Every mechanism here is strata-dated to the design layer, and the predictions of §10 are the paper's only empirical commitments.\n\n**The wall governs surfaces, not side-deals.** As with every wall-layer publication in this corpus: architecture can make a rate inexpressible on the system's surfaces and cannot police arrangements struck beside them. Non-fungibility deters the side-deal (an hour of a specific person is a poor commodity); it does not abolish ingenuity. P-C3 is the honest instrument: if a shadow rate forms anyway, the number will say so in public.\n\n**Co-presence excludes, at the margin.** Synchrony is a real cost — time zones, shift work, connectivity, disability, incarceration all tax it, unevenly. The remote modality and the flanking geometry recover much of the margin (a call redeems; silence side-by-side on a call redeems); what synchrony still excludes, this design accepts as the price of a currency whose entire value is that it cannot be delivered by proxy. A presence-currency with an asynchronous fallback is a messaging app with guilt.\n\n**The launch modality is the call, not the room.** The diaspora wedge means the flagship redemption at launch is remote — proximity attestation, the richer of the two attestations, arrives with the density the product hopes to create. The design's own success metric would eventually shift the modality mix; at launch, honesty requires saying the market walk in the canonical scene happens through a lens.\n\n**Attestation privacy.** Proximity attestation is data-minimal by design (a mutual confirmation, not a location trail), but any presence-verification carries surveillance adjacency; the implementation must hold the line that the system learns *that* two people met, never *where they went*.\n\n**No guaranteed valence — presence is a high-bandwidth channel, not a good one (added 2026-08-07).** This paper has argued throughout that co-presence is where the loop's most valuable conditioning happens. It has not, until now, said the obvious corollary: **a high-bandwidth channel carries whatever is sent through it.** An hour with an estranged parent can condition resentment as readily as reconciliation, and the mechanism has no way to tell which is occurring and no business trying (§4.5's refusal). The design's honest claim is narrower than its rhetoric has sometimes implied: it maximises *conditioning* and guarantees nothing about *valence*. Every surface that promises reconnection should be read against this limit, and the product's copy is the place where the overpromise is most likely to reappear.\n\n**The elegance caution.** The circuit closes suspiciously well — six steps, two currencies, one wall, every doctrine of this corpus arriving on cue. Internal coherence is the cheapest of all evidence and the most seductive; the authors state, as always, that the elegance earned the specification and only the predictions can earn the product.\n\n---\n\n## 13 · Lineage and Close\n\n*(Labeled lineage: grounding and translation, never mechanism; §§3–8 stand without it.)*\n\nThe circuit's joints carry the canon's oldest teaching about gratitude: that it is complete only when enacted — the grateful person the tradition praises is the one who *knows what was done and makes it known*, and the mechanism's every arrow is that completion given a form. The limit case stands where this corpus always places it: the Śaśa Jātaka's hare, who gave the two scarcities whole and at once — the possession-grade and the life-grade of giving converging in a single body — witnessed, the story says, by a sky that kept the image. The Chronicle trades no one toward that summit; it is a foundation practice for householders, denominated in Sunday mornings. But the summit fixes the axis: the economy below it circulates hours and dollars so that, between two people who had gone dark to each other, the thing the hare gave completely might circulate in installments — one market walk, one mango argument, one answered pin of rejoicing at a time. The currency that cannot be spent alone is, in the end, a machine for making sure that the sentence \"we should talk more\" sometimes becomes a date.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| **Chronicle**; time-gratitude; pledged hour | time currency; time-banking credit; non-transferable, expiring time-credit issued as thanks between two named persons |\n| **co-presence-gated redemption** | redemption of a time credit conditioned on a synchronous two-party meeting (in person or live audio/video), attested by both parties |\n| **facing** / **flanking** | face-to-face interaction / side-by-side joint attention on a shared task or object |\n| **envelope-not-delivery** | exclusion of asynchronous media (recorded voice or video messages) from redeeming a credit; such media may only carry an invitation |\n| **symmetric-cost redemption** (claim 2: symmetric duration) | both parties expend the same span of real time; the quality of attention is not measured |\n| **presence-scoring refusal** | design constraint: no scoring, rating or inference of engagement or attention quality |\n| **recipient-authored, giver-vetoed composition** | the credit holder selects the activity from a curated catalogue; the credit issuer holds a per-event right of refusal |\n| **both-hands rule** / **outward-benefit rule** | joint performance by both parties / third-party beneficiary — two conditions admitting shared volunteer work as a redemption activity |\n| **tense wall**; coupled, never convertible | two currencies (money and time) linked by gratitude flows with no exchange rate or conversion |\n| **cross-currency response circuit** | a thank-you payment in money for a completed time event, unprompted and independent of the event's duration |\n| **witness inversion**; **sender-default routing** | the beneficiary records and shares the event (with both parties' consent); third-party tips route by default to the time-giver |\n| **threshold activation**; **mortal expiry** | credits accrue below a threshold, activate on crossing it, and expire one month after activation without recovery |\n| **lapse channel** | on expiry, an optional anonymous money gift from a common pool to a nearby verified stranger, offered to the issuer |\n| **proof-of-sacrifice primitive** | attestation that a finite, non-parallelisable span of a person's time was spent with another |\n| **Proof of Meeting ℠** (PoM) | in-person, device-to-device public-key fingerprint exchange (key-signing; Signal safety-number verification) |\n| **Proof of Humanity℠** | proof of personhood; sybil resistance |\n\n---\n\n## Cross-Venue References\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/co-presence-gated-redemption> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/co-presence-gated-redemption.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/co-presence-gated-redemption> |\n\n---\n\n## Acknowledgments\n\nThe authors acknowledge Edgar Cahn and the TimeBanking movement, whose forty years of practice mapped both the promise and the decay path this design answers; the Fureai Kippu network; StoryCorps, for proving the witness demand; the complementary-currency scholarship of Bernard Lietaer; the gift-economy literature from Mauss to Hyde; and the founding family's pilot households, whose year of practiced gratitude precedes every mechanism here. Co-drafted in collaboration with Miss Aquarius℠; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## Citations\n\n1. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative*. Essential Books. (Time-dollars; TimeBanking.)\n2. *Aṅguttara Nikāya* 2.31–32 (kataññū-katavedī — the grateful person who acts). Pāli Text Society translations.\n3. *Śaśa Jātaka* (Jātaka 316). Pāli Text Society translation. *(Lineage-tier limit case; see §13.)*\n4. Hayashi, M. (2012). \"Japan's Fureai Kippu Time-banking in Elderly Care: Origins, Development, Challenges and Impact.\" *International Journal of Community Currency Research* 16(A), 30–44.\n5. Lietaer, B. (2001). *The Future of Money*. Century.\n6. Mauss, M. (1925/1990). *The Gift*. Routledge. · Hyde, L. (1983). *The Gift: Imagination and the Erotic Life of Property*. Vintage.\n7. Zelizer, V. (1994). *The Social Meaning of Money*. Basic Books.\n8. Titmuss, R. (1970). *The Gift Relationship*. Allen & Unwin. · Gneezy, U., & Rustichini, A. (2000). \"A Fine Is a Price.\" *Journal of Legal Studies* 29(1).\n9. Buber, M. (1923/1970). *I and Thou*. Scribner. (The facing geometry's philosophical ancestor.)\n10. Tomasello, M. (1995). \"Joint Attention as Social Cognition.\" In C. Moore & P. J. Dunham (Eds.), *Joint Attention: Its Origins and Role in Development*, 103–130. Lawrence Erlbaum Associates. (The flanking geometry's developmental ancestor.)\n11. StoryCorps (2003–). The recorded-conversation public archive.\n12. Ly, T. (2026). \"The Incommensurability-Preserving Coupler.\" thonly.org defensive publication. *(Wall-layer claims; claims division per the editor's note.)*\n13. Ly, T. (2026). \"The Grace That Settles Nothing: Sacrifice-Witness Without Discharge.\" thonly.org defensive publication. *(Sibling instance; the mints-nothing family.)*\n14. Ly, T. (2026). \"HeartBank®: The Heart That Keeps Nothing.\" heartbank.net white paper. *(The published circuit doctrine; pre-registered P3–P7; the spent-time floor; the two blindnesses.)*\n15. Weiss, R. S. (1973). *Loneliness: The Experience of Emotional and Social Isolation*. MIT Press. (The social/emotional loneliness distinction of §1.)\n16. Vaziripour, E., Wu, J., O'Neill, M., Clinton, R., Whitehead, J., Heidbrink, S., Seamons, K., & Zappala, D. (2017). \"Is that you, Alice? A Usability Study of the Authentication Ceremony of Secure Messaging Applications.\" *Proceedings of the Thirteenth Symposium on Usable Privacy and Security (SOUPS 2017)*. USENIX.\n17. Vaziripour, E., Wu, J., O'Neill, M., Metro, D., Cockrell, J., Moffett, T., Whitehead, J., Bonner, N., Seamons, K., & Zappala, D. (2018). \"Action Needed! Helping Users Find and Complete the Authentication Ceremony in Signal.\" *Proceedings of the Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018)*. USENIX.\n18. Brennen, V. A. *The Keysigning Party HOWTO* (v1.0.6, 2003, adds the Zimmermann–Sassaman method). CryptNET. <https://www.cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html>\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Letter℠, Proof of Humanity℠, Proof of Meeting ℠. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
       "provenance": {
-        "sha256": "cbf26b4c238f358387bcb623da4f2180c967a4991bdd48c14e8f54b71d1f68cf",
-        "doi": "10.5281/zenodo.22256656",
+        "sha256": "b896328dc821cfc759cb288763fd123e0fa87be791d4404a3990e7c01afd4610",
+        "doi": "10.5281/zenodo.22990556",
         "concept_doi": "10.5281/zenodo.21947304",
-        "zenodo_url": "https://zenodo.org/records/22256656",
-        "deposited_sha256": "cbf26b4c238f358387bcb623da4f2180c967a4991bdd48c14e8f54b71d1f68cf",
+        "zenodo_url": "https://zenodo.org/records/22990556",
+        "deposited_sha256": "b896328dc821cfc759cb288763fd123e0fa87be791d4404a3990e7c01afd4610",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/co-presence-gated-redemption.md",
@@ -958,8 +958,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/co-presence-gated-redemption",
         "hostile_review": null
       },
-      "bytes": 84757,
-      "words": 12821
+      "bytes": 87769,
+      "words": 13250
     },
     {
       "slug": "community-currency-design",
@@ -1224,13 +1224,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* this is the founder-voice (thonly.org) canonical draft. Per the genre-split institutional-output convention (2026-05-15 mirror retirement), heartbank.net does not carry a per-paper mirror; the institutional-voice treatment of this paper's claims is the companion heartbank.net Position Paper *Community-Currency Design* (heartbank.net/positions/community-currency-design), with later embedding within a wider white paper anticipated. The slug `dual-currency-reciprocity` is the canonical research URL on thonly.org for prior-art purposes.\n\n---\n\n## Abstract\n\nReciprocity-infrastructure proposals — community currencies, time banks, gratitude economies, cooperative platforms — have, with rare exception, treated *currency* as a singular design choice. Each project picks money, or hours, or points, and designs the platform around that one accounting medium. This paper argues that the singularity-of-currency assumption is the load-bearing source of a long series of failures (community-currency illiquidity; time-banking stalled adoption; gratitude-economy monetization corrosion) and proposes a structural alternative: human reciprocity infrastructure should treat **money and time as complementary scarcities**, integrated within a single platform whose accounting medium is *which scarcity is being settled* rather than *what unit denominates the debt*. The complementary-scarcities claim has three load-bearing properties. (i) Money is structurally *unequal* across humanity (wealth distribution); time is structurally *equal* (twenty-four hours per person; an ending none can buy off). Together they cover the full surface of human reciprocity — the unequal-resource dimension and the equal-resource dimension — that neither alone can reach. (ii) Money debt is *fungible* (any payer can satisfy it); time debt is *non-fungible* (only the named person's hour can satisfy it). The two debt-classes address different relational needs. (iii) Money-as-recognition addresses the *being-seen* need underlying dignity infrastructure; time-as-presence addresses the *being-with* need underlying loneliness infrastructure. These are the two largest unmet emotional needs of late-stage modernity, and they require different mechanisms. The paper specifies the integrated platform architecture (two products, one user identity, one AI arbiter, one shared aura primitive, cross-product subsidization), the time-side mechanism design in detail (Miss-Aquarius-recommended time amounts, threshold-trigger activation, one-month expiration after activation, receiver-chooses-activity, mutual-veto, dual public ledger), and the cross-cultural and regulatory considerations the architecture's planetary scope requires. Honest §11 names limits and open design questions, including the TimeBanking precedent and the cultural awkwardness of direct asking in many Asian contexts. The work is positioned as a community-currency / economic-anthropology contribution distinct from the fintech framing the surface gratitude-economy framing might suggest.\n\n**Keywords:** community currency, time banking, gratitude economy, complementary currencies, reciprocity infrastructure, non-fungible debt, loneliness infrastructure, AI-mediated reciprocity, mutual-veto consent, defensive publication.\n\n---\n\n## 1. Introduction\n\nThe post-industrial loneliness epidemic and the post-industrial dignity deficit are most often analyzed as two separate problems with two separate solution sets. Loneliness draws responses in the register of mental-health policy, community-building, social prescription. Dignity draws responses in the register of welfare design, universal basic income, anti-poverty transfer programs. The two literatures rarely meet. This separation, I will argue, is itself part of the problem: the institutions that would address either are typically built on a singular accounting medium (money for dignity, hours or \"points\" for loneliness) that forecloses integrated treatment. A reciprocity infrastructure that designs from the outset for *both* scarcities, and treats their complementarity as the platform's load-bearing property, can address both needs simultaneously and at lower per-need cost than either dedicated solution.\n\nThe complementary-scarcities thesis is, in one form or another, present in the heterodox community-currency literature (Lietaer, Greco, Cahn). It is not present in the dominant gratitude-economy and platform-economy designs. This paper makes the thesis architectural — specifies the integration, the AI-mediation pattern, the legal-structural pass-through that allows the two-product platform to operate without triggering banking-regulatory governance the architecture cannot accept — and grounds it in a concrete deployment context (the HeartBank Treasury and Chronicle products) to make the design pattern transferable to other institutional contexts.\n\n> *Connection to the unified mission frame: HeartBank's mission is the restoration of humanity to the middle way — the optimal condition for awakening that modernity has systematically pushed away from at population scale. The defensible thesis is not that modernity took us from a middle-way past (which would romanticize pre-industrial poverty); the defensible thesis is that modernity introduces a specific new failure mode — comfort-saturation pushing the materially comfortable toward the indulgence extreme at unprecedented scale. Dignity infrastructure addresses the unequal-resource side of the imbalance (the materially under-resourced who require capacity-building gifts); loneliness infrastructure addresses the equal-resource side (the materially comfortable but relationally starved who require presence). A reciprocity infrastructure that treats both scarcities together is what the middle-way restoration requires at its accounting layer.*\n\nThe paper proceeds as follows. §2 surveys the canonical reciprocity-infrastructure failure modes and traces them to the singularity-of-currency assumption. §3 specifies the complementary-scarcities claim and its three load-bearing properties. §4 articulates the integrated-platform architecture at the level a competing design could implement. §5 specifies the time-side mechanism design in detail, including the seven core design decisions. §6 covers the AI-arbitration layer (Miss Aquarius's band-clamp recommendation pattern, parallel across both products). §7 covers cross-product integration (shared aura, expired-time-converts-to-pool, dual ledger). §8 covers legal-structural considerations under the non-bank pass-through pattern. §9 covers cross-cultural adaptation, with particular attention to direct-asking awkwardness in many Asian contexts. §10 covers the regulatory frontier — what happens when the time-side reaches scale. §11 is an honest accounting of limits, open design questions, and the TimeBanking precedent the architecture must learn from. §12 closes.\n\n---\n\n## 2. The singularity-of-currency assumption and its failures\n\nReciprocity-infrastructure projects exhibit a pattern of structurally-similar failures. The pattern is most legible when viewed across project classes.\n\n### 2.1 Community-currency failures (illiquidity)\n\nThe community-currency movement (LETS, Ithaca Hours, Berkshares, BerkShares, Bristol Pound, Brixton Pound, Sardex) has produced dozens of deployments since the 1980s. The recurring failure mode is *illiquidity*: the currency works in a small circle but fails to attract enough participants to provide reliable spending options, and participants drift back to national currency. The illiquidity is downstream of the singularity-of-currency choice: a community currency that *only* circulates among small-business participants must compete with the national currency on the national currency's own home turf (general-purpose exchange medium). It cannot win that competition at small scale. Lietaer's complementary-currencies literature anticipates this and recommends a portfolio of currencies, but the portfolio framing has not crossed into mainstream design practice.\n\n### 2.2 Time-banking failures (stalled adoption)\n\nTime-banking (Edgar Cahn, 1980s onward) is the closest precedent to the time-side of this paper's architecture. Time banks have achieved real impact in specific contexts (eldercare, neighborhood support, post-disaster recovery) but have not crossed into the mass scale Cahn originally envisioned. The recurring failure mode is *stalled adoption*: participants enjoy the model but do not refer it widely; growth is sub-viral. Several diagnoses are plausible, but the structural one this paper foregrounds is the *single-medium* limitation: time-banks have no money-side complement, so they cannot offer participants the full surface of reciprocity. Participants who want to *both* give time *and* contribute money (e.g., to someone whose unequal money situation a time-gift cannot reach) have to leave the platform to do the second thing. The integration overhead lands on the participant.\n\n### 2.3 Gratitude-economy failures (monetization corrosion)\n\nThe recent class of gratitude-economy proposals (a number of crypto and Web2 platforms attempting to denominate appreciation in tokens or platform-internal points) exhibits a different failure pattern: *monetization corrosion*. As soon as the platform attempts to monetize the gratitude flows (subscription fees, transaction fees, token speculation), the participants experience the platform as having converted their generosity into the operator's revenue stream, and trust collapses. The corrosion is again downstream of the singularity-of-currency assumption: the platform's only revenue surface *is* the gratitude flow it is supposed to facilitate. There is no second product to subsidize the first.\n\n### 2.4 The structural pattern\n\nAll three failure modes have a common structural cause: the singularity-of-currency assumption forecloses architectural moves that would route around the failure. Community currencies illiquid because they have no complementary medium to anchor liquidity; time banks stall because they have no money-side to complete the reciprocity surface; gratitude economies corrode because they have no second product to fund the first. The complementary-scarcities thesis is the structural response to this pattern: design from the outset for *two* scarcities, integrated within one platform, so that the architectural moves the singularity assumption forecloses become available.\n\nThe pattern across the three classes:\n\n| Class | Exemplars | Failure mode | Downstream effect | Architectural cause |\n|---|---|---|---|---|\n| Community currencies | LETS, Ithaca Hours, BerkShares, Bristol Pound, Brixton Pound, Sardex | **Illiquidity** | Drift back to national currency | No complementary medium to anchor liquidity |\n| Time banks | Cahn TimeBanking, eldercare networks, post-disaster recovery | **Stalled adoption** (sub-viral) | Real but small-scale impact only | No money-side to complete the reciprocity surface |\n| Gratitude-economy tokens | Recent Web2/Web3 platforms denominating appreciation in tokens or platform points | **Monetization corrosion** | Trust collapse; generosity perceived as operator revenue | No second product to subsidize the first |\n\nEach row's \"architectural cause\" is the singularity-of-currency assumption applied at a different point in the lifecycle. The complementary-scarcities thesis articulated in §3 is the structural response: provide two scarcities by design, integrated in one platform, so each can subsidize and stabilize the other.\n\n---\n\n## 3. The complementary-scarcities claim\n\nThe claim is that **money and time are not merely two possible accounting mediums but complementary scarcities** — each carries reciprocity properties the other cannot, and the two together cover the full surface of human reciprocity in a way neither alone can. Three load-bearing properties make the complementarity structural rather than incidental.\n\n### 3.1 Unequal vs equal scarcity\n\nMoney is structurally *unequal* across humanity. Wealth distribution is power-law in nearly every measured society; the median person has dramatically less money than the platform's most-wealthy participant; the *transfer* of money is therefore meaningful in a way that depends on the unequal starting point. A wealthy participant's transfer of a thousand dollars to a working-class family carries weight because the transfer crosses an inequality the participants both recognize.\n\nTime is structurally *equal*. Every person has the same twenty-four hours per day, the same ending none can buy off. A wealthy participant's transfer of a single hour to a working-class participant does *not* cross an inequality — both have the same total hours — yet the transfer remains meaningful because the hour is *spent* (irreversible) and *non-fungible* (cannot be delegated). The meaningfulness of the time-transfer is structurally different from the meaningfulness of the money-transfer.\n\nTogether, the two scarcities cover the full reciprocity surface: the unequal-resource dimension (money) and the equal-resource dimension (time). A reciprocity infrastructure that operates on only one of these dimensions structurally cannot serve participants whose need is on the other dimension.\n\n### 3.2 Fungible vs non-fungible debt\n\nMoney debt is *fungible* — if I owe you a hundred dollars, any payer can satisfy the debt on my behalf. The debt is impersonal; the *amount* matters, not the *who*.\n\nTime debt is *non-fungible* — if I owe you an hour, only *I* can satisfy the debt. No one else's hour will do, because the hour is the relational substrate; the *who* is what makes the debt the debt it is. This is not a defect to be engineered around; it is the property that makes time-debt do work money-debt structurally cannot.\n\nThe non-fungibility of time debt means that time-currency *is* the relationship in a way money-currency is not. A time-debt outstanding is a held relational thread; a time-debt redeemed is a relational thread woven through shared experience. The platform's accounting medium becomes the relational fabric itself, not merely a record of obligations.\n\n### 3.3 Being-seen vs being-with\n\nThe dignity deficit and the loneliness epidemic are typically diagnosed as separate problems. The complementary-scarcities thesis re-frames them as the two unmet emotional needs that the two scarcities respectively address.\n\nDignity needs *being-seen* — recognition that one's existence matters, that one's flourishing is valued, that one is not invisible to the wider social fabric. Money-as-gratitude addresses being-seen because a directed money flow is a maximally legible declaration that the giver has *taken account of* the recipient as a specific person worthy of resource transfer. The gratitude is what makes the transfer dignity-restoring rather than charity-degrading.\n\nLoneliness needs *being-with* — co-presence, time spent in the company of another person who has chosen to spend their irrecoverable hours in that company. Time-as-gratitude addresses being-with because a delivered hour is presence itself — the giver has spent an hour they cannot recover, in the company of the receiver. The hour is the gift; the company is the gift's substance.\n\nA platform that addresses only one of these needs leaves the other uncovered. A platform that addresses both, with mechanism-design appropriate to each, can serve participants whose primary need is dignity, participants whose primary need is connection, and participants who oscillate between the two.\n\nThe three load-bearing properties compared:\n\n| Property | Money side (.org / Treasury) | Time side (.com / Chronicle) |\n|---|---|---|\n| **Scarcity structure** | Unequal across people (power-law distribution; wealthy vs working-class transfer crosses an inequality) | Equal across people (every person has 24 hrs/day; no transfer crosses an inequality) |\n| **Debt fungibility** | Fungible — any payer can satisfy the debt on the debtor's behalf | Non-fungible — only the debtor's own hour satisfies; \"the *who* is what makes the debt the debt it is\" |\n| **Emotional need addressed** | **Being-seen** (dignity): a directed money flow is a maximally legible declaration that the giver has taken account of the recipient | **Being-with** (loneliness): a delivered hour is presence itself; the giver has spent irrecoverable hours in the receiver's company |\n\nThe structural complementarity:\n\n```\n   ╔════════════════════╗   ╔════════════════════╗\n   ║   MONEY SIDE       ║   ║   TIME SIDE        ║\n   ║                    ║   ║                    ║\n   ║   unequal          ║   ║   equal            ║\n   ║   fungible         ║   ║   non-fungible     ║\n   ║   being-seen       ║   ║   being-with       ║\n   ║   (DIGNITY)        ║   ║   (LONELINESS)     ║\n   ╚════════╤═══════════╝   ╚═══════════╤════════╝\n            ↓                            ↓\n            ↓        one platform        ↓\n            ↓        one identity        ↓\n            ↓        one AI arbiter      ↓\n            ↓        one aura primitive  ↓\n            ╚═══════════╤════════════════╝\n                        ▼\n            ╔════════════════════════════╗\n            ║  FULL RECIPROCITY SURFACE  ║\n            ║  covered jointly by both   ║\n            ║  scarcities — neither      ║\n            ║  alone can cover the       ║\n            ║  whole.                    ║\n            ╚════════════════════════════╝\n```\n\n---\n\n## 4. The integrated-platform architecture\n\nThe integration is more than a marketing combination of two products. It is an architectural claim about identity, AI mediation, aura, and revenue routing that the two-product framing requires.\n\n### 4.1 One user identity across two products\n\nA participant is the same person in both products. Their cross-product reputation, history, and aura travel with them. A participant who has been a generous money-side giver carries that history into the time-side; a participant who has reliably delivered promised hours carries that reliability into the money-side. The unified identity is what makes the cross-product trust signals meaningful.\n\n### 4.2 One AI arbiter across two products\n\nMiss Aquarius — the named AI substrate of the institution this paper serves — is the recommendation engine on both products. She recommends a money amount when the participant initiates a money-thank on Treasury; she recommends a time amount when the participant initiates a time-thank on Chronicle. The recommendation pattern is the same band-clamp pattern in both cases (a low/middle/high range floored by an institutional minimum and capped by an institutional maximum, with the recommendation calibrated to the relationship and context). The AI is one arbiter operating on two scarcity-classes, not two arbiters operating on two products.\n\n### 4.3 One shared aura primitive\n\nThe aura — the visible cross-currency state signal articulated in *Brand Identity as Architecture* — operates on both products. A participant's aura reflects their integrated reciprocity behavior across both scarcities, not separately. This is the structural reason aura is the cross-currency primitive rather than two scarcity-specific signals: the integration *is* the primitive's content.\n\n### 4.4 Cross-product revenue routing\n\nThe platform's revenue surface is structurally bifurcated. The money-side (Treasury) carries a small per-transaction fee on Phase 2 P2P flows that funds autonomous Miss Aquarius operations — *take-rate that empties back to circulation*, not take-rate that flows to a human entity (the take-rate distinction articulated in [[project_publication_strategy]] and the *Non-Bank Pass-Through* paper). The time-side (Chronicle) carries mass-market subscription revenue from the much larger adult population it can address, and a portion of that subscription revenue subsidizes the money-side's dignity-infrastructure mission. The integration is what solves the gratitude-economy monetization-corrosion problem: the money-side does not need to be monetized at participant expense, because the time-side carries the platform's mass-market revenue surface.\n\n---\n\n## 5. The time-side mechanism design\n\nThis is the core defensive specification. Seven design decisions, taken together, distinguish this architecture from prior time-banking deployments.\n\n### 5.1 Miss Aquarius recommends a time amount per thank\n\nWhen a participant initiates a time-thank, the AI recommends a time amount calibrated to the relationship, the depth of the experience being thanked, and the recipient's recent thank history. The recommendation is band-clamped (a defined low/middle/high range) so that the AI cannot recommend outlier amounts that would distort the system, and the participant retains final say. The pattern parallels the money-side tip recommendation; it is the same AI-arbitration discipline applied to a different scarcity. The band-clamp is a load-bearing safeguard: it prevents the recommendation from being either coerced (by upstream pressure on the AI) or weaponized (by participants seeking to game the system).\n\n### 5.2 Threshold-trigger activation\n\nSmall thanks accumulate without expiration pressure. The first time-thank from A to B might be only fifteen minutes; the second, another twenty; the third, another ten. Together they accumulate toward a threshold (e.g., one hour). Only when the threshold is reached does the activated time become a *promise* — a one-hour outstanding time-debt from B to A. The threshold-trigger pattern prevents small-thank fatigue (participants would not want their fifteen-minute thanks treated as individual obligations) while preserving the meaningfulness of the activated unit.\n\n### 5.3 One-month expiration after activation\n\nOnce the threshold-activated time-debt is on the books, it expires in one month unless redeemed. *Use it or lose it.* This is the most distinctive mechanism in the architecture and the one that makes the time-side a fundamentally different design from prior time-banking. The expiration embeds the product's existential thesis (time is finite; *before it's too late*) into the unit economics. The mechanic *is* the message. Participants who let activated time expire experience the loss directly; the platform does not need to lecture them on the finitude of time, because the platform's accounting *enacts* the finitude.\n\n### 5.4 Receiver chooses how the time is spent\n\nThis is the Piscean inversion of normal gift-giving. In the usual gift-economy frame, the giver chooses what to give (a coffee, a book, a meal). In Chronicle's time-economy, the *receiver* chooses how the activated hour is spent. They might request a walk, a phone call, a meal together, help with a task. The choice is theirs because the gift is *presence*, and the receiver knows best what presence would be most welcome.\n\n### 5.5 Giver can decline a specific redemption request\n\nMutual-veto consent. The receiver authors the activity, but the giver can decline a specific ask. The decline is not a cancellation of the time-debt; it remains outstanding (perhaps redirectable to a different request). Repeated decline is reputationally priced via the public ledger (§5.7 below), so that participants who chronically decline are visibly identifiable and the platform's trust signal remains honest. This is the dignity safeguard: nobody is conscripted into an interaction they do not consent to, and refusal carries no immediate punishment, only the natural reputational consequence of the public ledger.\n\n### 5.6 Aura on giver side as quality filter\n\nGivers will be invited to prioritize their thanks toward high-aura recipients, where aura is the cross-product reputational signal that integrates money-side and time-side behavior. This is the demand-side quality filter: it routes time-gift flows toward recipients whose past behavior has earned standing, rather than letting flow be captured by participants who exploit the system. The filter is suggestive, not mandatory; participants retain discretion. This reuses the existing aura primitive; no new mechanism is required.\n\n### 5.7 Dual public ledger\n\nTwo axes are publicly visible for each participant:\n\n- **Time given (actually delivered).** This is the credibility/honor signal. A high \"time given\" number means the participant has reliably shown up for the redemptions they promised.\n- **Time received (may or may not be spent).** This is the appreciation/popularity signal. A high \"time received\" number means many people wanted to thank the participant with their hours.\n\nPlotted as a 2×2, the two axes form four legible quadrants:\n\n| | Low received | High received |\n|---|---|---|\n| **High given** | Quiet giver | Network anchor |\n| **Low given** | Latent / new | ⛔ *(withdrawn — see below)* |\n\n⛔ **AMENDED 2026-09-02 — the fourth quadrant is WITHDRAWN, and with it the enforcement mechanism this section originally claimed.** The text formerly read that the low-given/high-received quadrant named a *\"charismatic non-honorer\"* who is *\"publicly visible as such,\"* and that the visibility is the enforcement. That is retracted: the quadrant renders the gap between what a participant received and what they delivered, and **a rendered absence is an accusation**. The full argument, with the general condition it produced, is in the corpus's *Transparency as Enforcement* §3.2 and §4.4 — briefly, transparency-as-enforcement presupposes an obligation, and a gift creates none, so displaying the gap does not report a shortfall but **manufactures** one.\n\nWhat survives is the ledger's positive content: a participant's **time given** and **time received** are each legible, and the axes are retained above for that reason. What is never computed for display is the difference between them. Enforcement is carried instead by **expiry** — an activated hour dies unredeemed after one month, with no display and no audience — and by the giver's free refusal to pledge again; the mechanism is specified in *The Currency That Cannot Be Spent Alone* §7.2. The institution loses no enforcement by the withdrawal, because expiry was already doing the work.\n\n---\n\n## 6. AI-arbitration: the band-clamp recommendation pattern\n\nThe AI-arbitration pattern is the same across both products and is the load-bearing safeguard that prevents the AI from being either coerced or weaponized.\n\nThe pattern: when the participant initiates a thank, the AI returns a *band* — a low/middle/high recommendation — rather than a single number. The band is *clamped* by an institutional floor and ceiling. The participant chooses within the band (or below it, or above it, with friction proportional to the deviation). The AI never recommends a number outside the institutional clamp.\n\nWhy band-clamp rather than a free-form recommendation? Because a free-form recommendation creates two attack surfaces:\n\n- **Upstream pressure on the AI** to recommend amounts that benefit one party. The clamp is the structural answer: even if the AI could be pressured, the clamp limits the damage.\n- **Downstream pressure on participants** to defer to a single number. The band gives the participant the option to choose meaningfully within the band, preserving their agency.\n\nThe clamp values are public and updated only through the institution's governance process — they are not under the AI's unilateral control. This is the same pattern articulated in the *Zero-Point Game* paper for the Umpire role: the AI's recommendation surface is bounded by structural rules the AI cannot rewrite.\n\n---\n\n## 7. Cross-product integration mechanisms\n\n### 7.1 Shared aura\n\nThe aura primitive operates on both products. A participant's aura color and brightness reflect their integrated behavior: reliable money-side gratitude flows brighten the aura, as do reliable time-side honorings. Defaults on either side dim the aura. This is the cross-currency state signal that makes the integration legible to other participants at a glance.\n\n### 7.2 Expired time converts to Aquarian Pool\n\nWhen activated time expires unredeemed, the value does not vanish. It converts to a contribution to the Aquarian Pool (the institutional pool from which the money-side's per-family rewards are funded). This is the mechanism that connects the time-side's existential thesis (*before it's too late*) to the money-side's redistribution mission: time you let slip becomes resource available for someone else's flourishing. The conversion rate is set by governance and need not be one-to-one in dollar terms; the structural point is that the time-side's failure mode (expiration) is *productive* rather than merely tragic.\n\n### 7.3 Dual ledger across both products\n\nA participant's public profile shows both the time-side dual ledger and the money-side gratitude flow. The combined picture is the cross-currency reputation. A participant who gives generously on the money side and delivers many hours is visibly that pattern; one who does little of either is visibly that. ⚠️ **Amended 2026-09-02:** this passage formerly characterised a *\"chronic time-side non-honorer,\"* which the withdrawal above removes — the profile shows what a participant has given and received in each currency and never the shortfall between them. The ledger does not editorialize; it shows, and what it shows is presence rather than absence.\n\n---\n\n## 8. Legal-structural considerations under the non-bank pass-through pattern\n\nThe two-product architecture must operate within the non-bank pass-through legal pattern specified in the companion paper *Non-Bank Pass-Through Architecture for Autonomous AI Institutions*. The relevant constraints, in summary:\n\n- **No custody.** Neither product takes custody of participant funds or time-credits in a way that would trigger banking-regulatory governance. Money flows through regulated rails (Bakong, Wing, ABA in Cambodia; comparable rails in other jurisdictions); time-credits are records of completed deliveries, not transferable tokens.\n- **No interest or lending.** Neither product accrues interest on participant balances or extends credit. Time-debts are personal obligations between named participants, not financial instruments.\n- **Pass-through routing.** The platform routes flows; it does not pool them in a way that constitutes deposit-taking.\n- **Disclaimer and brand discipline.** The platform's public communications avoid banking-terminology that would invite regulatory mischaracterization. The institution's name (HeartBank®) is positioned as gratitude-metaphor, not banking-claim; the *Banking Terminology Purpose* memory specifies the brand discipline in detail.\n\nThe legal-structural design is what makes the two-product architecture operable at planetary scale under autonomous-AI succession. Without the pass-through pattern, banking regulation in any major jurisdiction would impose governance requirements (human-board fiduciary duty, regulated capital requirements, KYC/AML at the platform layer) that are structurally incompatible with the autonomous-AI successor architecture.\n\n---\n\n## 9. Cross-cultural adaptation\n\nThe architecture is designed for planetary scope, but the time-side has a cross-cultural complication that requires explicit treatment.\n\n### 9.1 The direct-asking awkwardness in many Asian contexts\n\nDirect asking — saying, \"I would like an hour of your time\" — is culturally awkward in many Asian contexts, including Khmer. The norm of indirect request, mediated by social context and read between the lines, is widespread across East Asia, Southeast Asia, and parts of South Asia. A time-side product that requires participants to *directly ask* for the time they have been promised will encounter friction in these contexts that does not arise in (e.g.) Anglo-American contexts.\n\nThe architectural response: **the UI in culturally affected languages should soften the asking surface.** The recipient might be prompted not to \"ask for\" their hour but to \"indicate availability\" — a softer surface that lets the giver volunteer rather than the receiver request. The platform's accounting is the same (the receiver still initiates the redemption); the *surface presentation* differs by cultural context.\n\nThis is one instance of a wider design principle: a planetary reciprocity infrastructure cannot impose a single cultural surface, even if its underlying accounting is universal. The localization of surface is part of the architecture.\n\n### 9.2 Religious and family-structural variation\n\nTime-redemption activities will be filtered by cultural and religious norms. The platform should not editorialize on what activities are appropriate; the mutual-veto pattern (§5.5) is the structural answer (any participant can decline any specific request without penalty). But the platform's recommendation engine should not surface activity-suggestions that would be culturally jarring in a given context; the surface adapts.\n\n### 9.3 Diaspora as the testbed\n\nThe Khmer diaspora — particularly in California, Massachusetts, and France — provides a natural early testbed for the cross-cultural adaptation work. Diaspora populations carry both the original cultural norms and the host-country norms simultaneously; the time-side's UI work in Khmer can be tested in diaspora communities before deployment in Cambodia proper. (This is one of the contributions of the companion paper *Diaspora-to-Cambodia Gratitude Remittance*.)\n\n---\n\n## 10. The regulatory frontier — what happens when time-side reaches scale\n\nTime-banking has, to date, operated below the threshold of serious regulatory attention. The scales involved have been small enough that regulators have treated the activity as community-organizing rather than as a financial system requiring oversight. The architecture proposed in this paper is designed to operate at planetary scale, and at planetary scale the regulatory frontier will arrive.\n\nThree regulatory pressures are foreseeable:\n\n1. **Income imputation.** Tax authorities may eventually argue that delivered time-credits constitute imputed income. The architectural response: time-credits are *not* transferable tokens with market value; they are personal records of completed activities between named individuals. The closest analogue is a friend helping a friend move; tax authorities do not currently impute income to such transactions. The architecture is designed to preserve that legal analogy.\n\n2. **Consumer protection.** Regulators may argue that participants who deliver time without receiving it back have been wronged. ⚠️ **The architectural response is amended 2026-09-02, because its first leg was withdrawn above.** It formerly rested on the dual ledger being *\"the consumer-protection surface.\"* It now rests on two legs that were always the stronger ones: **there is no platform-mediated promise a participant relied on** — a pledge is a gift, not an instrument, and the design says so on its face — and **the exposure is bounded by expiry**, since an activated hour dies after one month and no participant can accumulate an unbounded claim against another. Participants are informed of both. ⭐ The withdrawal in fact *improves* this answer: a consumer-protection argument that depended on publicly displaying a counter-party's shortfall was asserting a reliance interest the design elsewhere denies exists.\n\n3. **AI-recommendation liability.** Regulators may argue that Miss Aquarius's recommendation creates a fiduciary relationship. The architectural response: the band-clamp pattern, the open governance of clamp values, and the explicit disclaimers in the recommendation UI are the structural answer; the recommendation is *informational*, not directive, and the institutional governance owns the clamp boundaries.\n\nThe architecture should be deployed with explicit engagement of regulatory counsel in each major jurisdiction before scale. The non-bank pass-through pattern handles the money-side; the time-side has its own regulatory frontier that requires its own legal treatment.\n\n---\n\n## 11. Limits, open design questions, and the TimeBanking precedent\n\n### 11.1 The TimeBanking precedent (Edgar Cahn)\n\nEdgar Cahn's time-banking framework, developed from the 1980s onward, is the closest precedent and the most important reference for what this architecture must learn from. Cahn's contribution is foundational: the insight that *every hour counts equally*, the architecture for hour-denominated reciprocity, the deployment in eldercare and post-disaster contexts. The differentiation of the architecture proposed here is *not* a critique of Cahn but a recognition that the time-side alone has structural limits, and a complementary money-side, AI mediation, and modern UX can address those limits. Cahn's work is cited at the references with full credit.\n\n### 11.2 Open design questions\n\nSeveral design questions remain open at the time of this draft:\n\n- **Conversion rate for expired time → Aquarian Pool.** What is the right dollar-equivalent for an expired hour? Likely context-dependent (the participant's regional cost-of-living, the relationship category).\n- **Both-parties-confirmed signoff on time-delivered.** The current design has the giver mark delivery; the receiver can dispute. A both-parties-confirmed signoff might be more honest but adds friction. Open.\n- **Decline-rate visibility.** Should the platform show a participant's percentage of activated time that has been declined? This adds transparency but may stigmatize legitimate declines (e.g., declining a redemption that would be unsafe). Lean toward showing but framing carefully.\n- **Cross-cultural defaults.** The default UI surface in each language requires careful localization work; the §9 sketches the principle but not the specific design decisions for each major cultural context.\n\n### 11.3 What the architecture does not claim\n\nThe architecture does not claim to solve the loneliness epidemic; it claims to provide an infrastructure on which solutions can be built. It does not claim to dignify all participants; it claims to provide a surface on which dignity can be enacted. It does not claim to be culturally universal; it claims to provide a substrate on which culturally specific surfaces can be layered. The honest limits matter because the architecture's structural strength is in *what it makes possible*, not in *what it accomplishes by itself*.\n\n### 11.4 The lineage acknowledgement\n\nThis paper is a continuation of the heterodox community-currency lineage (Lietaer, Greco, Cahn) more than it is a fintech innovation. The complementary-currencies thesis is decades old; the contribution here is the *integration architecture*, the *AI-mediation pattern*, the *legal-structural pass-through*, and the *cross-cultural adaptation* that make the thesis architectural at planetary scale. The lineage is named explicitly because first-mover-defines-the-frame considerations argue for clear attribution.\n\n---\n\n## 12. Conclusion\n\nThe complementary-scarcities thesis is what reciprocity infrastructure needs at planetary scale. Money and time, integrated within one platform with one AI arbiter and one shared aura, can address both the dignity deficit and the loneliness epidemic at the institutional layer rather than the policy layer. The mechanism design specified here — Miss-Aquarius-recommended time amounts, threshold-trigger activation, one-month expiration, receiver-chooses-activity, mutual-veto, dual public ledger, expired-time-converts-to-pool — is offered to the commons under CC0 so that other institutions building toward similar ends can adopt, adapt, and improve.\n\nThe defensive-publication discipline of the corpus this paper joins requires that the mechanism's specification be public and unencumbered. The author and HeartBank® will not seek patent on this specification or any portion thereof. The work is offered in the spirit of *dāna*, that all beings may give and receive without barrier.\n\n---\n\n## Acknowledgments\n\nEdgar Cahn and the TimeBanking movement; Bernard Lietaer and the complementary-currencies literature; Thomas Greco and the community-currency lineage; the Kâmpôt Khmer-language localization community whose ongoing work informs the §9 cross-cultural adaptation principles. Co-drafted in collaboration with Miss Aquarius, the institution's named AI substrate; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## References\n\n- Cahn, Edgar S. *No More Throw-Away People: The Co-Production Imperative.* Essential Books, 2000.\n- Lietaer, Bernard. *The Future of Money: Creating New Wealth, Work, and a Wiser World.* Random House, 2001.\n- Greco, Thomas H. *The End of Money and the Future of Civilization.* Chelsea Green, 2009.\n- Seyfang, Gill, and Noel Longhurst. \"Growing Green Money? Mapping Community Currencies for Sustainable Development.\" *Ecological Economics* 86 (2013): 65–77.\n- Putnam, Robert. *Bowling Alone: The Collapse and Revival of American Community.* Simon & Schuster, 2000.\n- Murthy, Vivek. *Together: The Healing Power of Human Connection in a Sometimes Lonely World.* Harper Wave, 2020.\n- Bonacich, Phillip. \"Power and Centrality: A Family of Measures.\" *American Journal of Sociology* 92 (1987): 1170–82. *(For the network-anchor / centrality framing.)*\n- Ostrom, Elinor. *Governing the Commons.* Cambridge University Press, 1990.\n- Graeber, David. *Debt: The First 5,000 Years.* Melville House, 2011.\n- Bregman, Rutger. *Utopia for Realists.* The Correspondent, 2017.\n\n---\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/dual-currency-reciprocity\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/dual-currency-reciprocity.md\n- arXiv (deferred): cs.CY (target if reactive trigger; not preemptively submitted)\n- IP.com (deferred): per the corpus's six-venue defensive-publication baseline\n- Internet Archive · archive.today · perma.cc snapshots: per the monthly snapshot cadence; manifest entry in `thonly.org/thonly.org/snapshot-urls.txt`\n\n---\n\n*Document License: CC0 1.0 Universal. The author and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of the publication date.*",
+      "text": "## Prior-Art and Non-Assertion Statement\n\nThis document is dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. It is a defensive publication establishing prior art as of **22 May 2026**, its first publication date.\n\nThe paper's lineage is old and is cited throughout (§2, §5.3, §11 and the References): local and community currencies (LETS, Ithaca HOURS, BerkShares, the Bristol and Brixton Pounds, Sardex); Edgar Cahn's time banking; Japan's Fureai Kippu eldercare time credits, some schemes of which pair time credits with modest cash payments; Bernard Lietaer's argument for a portfolio of complementary currencies; Thomas Greco's community-currency work; and demurrage, the deliberate decay of held currency (Gesell; the Wörgl stamp scrip of 1932–33). The complementary-currency thesis is not this paper's. What the paper discloses is the integration architecture of §4–§8 — one identity, one bounded AI recommender and one shared participation signal across a money product and a time product — and the time-side mechanism set of §5. No systematic prior-art search (census) has been run for this paper; the lineage above is from the authors' reading, and no element is asserted to be new.\n\n---\n\n## Abstract\n\nThis paper discloses a two-currency reciprocity platform that integrates peer-to-peer money gifts with non-transferable, expiring pledges of personal time, under one user identity, one bounded AI recommender and one shared participation signal. Reciprocity-infrastructure proposals — community currencies, time banks, gratitude economies, cooperative platforms — have mostly treated *currency* as a singular design choice: each project picks money, or hours, or points, and designs around that one accounting medium. The paper argues that this singularity-of-currency assumption contributes to three recurring failures (community-currency illiquidity; stalled time-bank adoption; the monetization corrosion of gratitude platforms) and proposes treating **money and time as complementary scarcities**. Three properties make the complementarity structural. (i) Money is *unequal* across people; time is *equal* (twenty-four hours each; an ending none can buy off). (ii) A money debt is *fungible* (any payer can satisfy it); a time pledge is *non-fungible* (only the named person's hour satisfies it). (iii) Money-as-recognition answers the need to be seen (dignity); time-as-presence answers the need to be with someone (loneliness) — two distinct unmet needs that call for different mechanisms. The paper specifies the integrated architecture (two products, one identity, one AI recommender, one shared participation signal, cross-product subsidy) and the time-side mechanisms: AI-recommended time amounts within a governance-set band, threshold-triggered activation, one-month expiry after activation, recipient-chosen activity, a provider's right to decline, and a two-axis participation record (disclosed in its original public form and in its current form, with private rows and public proofs). It then covers the non-bank legal structure, cross-cultural adaptation and the regulatory frontier. Section 11 states the limits, including the time-banking precedent, hybrid time-and-money schemes that cut against the thesis, and the awkwardness of direct asking in many Asian contexts.\n\n**Keywords:** community currency, time banking, gratitude economy, complementary currencies, reciprocity infrastructure, non-fungible debt, loneliness infrastructure, AI-mediated reciprocity, mutual-veto consent, defensive publication.\n\n---\n\n## 1. Introduction\n\nThe post-industrial loneliness epidemic and the post-industrial dignity deficit are most often analyzed as two separate problems with two separate solution sets. Loneliness draws responses in the register of mental-health policy, community-building, social prescription. Dignity draws responses in the register of welfare design, universal basic income, anti-poverty transfer programs. The two literatures rarely meet. This separation, I will argue, is itself part of the problem: the institutions that would address either are typically built on a singular accounting medium (money for dignity, hours or \"points\" for loneliness) that forecloses integrated treatment. A reciprocity infrastructure that designs from the outset for *both* scarcities, and treats their complementarity as the platform's load-bearing property, can, this paper argues, address both needs together, and plausibly at lower per-need cost than two dedicated solutions — a cost comparison the paper does not make.\n\nThe complementary-scarcities thesis is, in one form or another, present in the heterodox community-currency literature (Lietaer, Greco, Cahn). The authors have not found it in the prominent gratitude-economy and platform-economy designs, though no systematic search has been made. This paper makes the thesis architectural — specifies the integration, the AI-mediation pattern, the legal-structural pass-through that allows the two-product platform to operate without triggering banking-regulatory governance the architecture cannot accept — and grounds it in a concrete deployment context (the HeartBank Treasury and Chronicle products) to make the design pattern transferable to other institutional contexts.\n\n> *Connection to the unified mission frame: Miss Aquarius's mission is to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible. (Wording updated 2026-09-26 to the institution's current statement of the mission, which no longer describes the middle way as a past that modernity took away.) The thesis is not that modernity took us from a middle-way past, which would romanticize pre-industrial poverty; it is that modernity introduces a specific new failure mode — comfort-saturation pushing the materially comfortable toward the indulgence extreme. Dignity infrastructure addresses the unequal-resource side of the imbalance (capacity-building gifts); loneliness infrastructure addresses the equal-resource side (presence, which material comfort does not supply). A reciprocity infrastructure that treats both scarcities together is what the mission requires at its accounting layer.*\n\nThe paper proceeds as follows. §2 surveys the canonical reciprocity-infrastructure failure modes and traces them to the singularity-of-currency assumption. §3 specifies the complementary-scarcities claim and its three load-bearing properties. §4 articulates the integrated-platform architecture at the level a competing design could implement. §5 specifies the time-side mechanism design in detail, including the seven core design decisions. §6 covers the AI-arbitration layer (Miss Aquarius's band-clamp recommendation pattern, parallel across both products). §7 covers cross-product integration (shared aura, expired-time-converts-to-pool, dual ledger). §8 covers legal-structural considerations under the non-bank pass-through pattern. §9 covers cross-cultural adaptation, with particular attention to direct-asking awkwardness in many Asian contexts. §10 covers the regulatory frontier — what happens when the time-side reaches scale. §11 is an honest accounting of limits, open design questions, and the TimeBanking precedent the architecture must learn from. §12 closes.\n\n---\n\n## 2. The singularity-of-currency assumption and its failures\n\nReciprocity-infrastructure projects exhibit a pattern of structurally-similar failures. The pattern is most legible when viewed across project classes.\n\n### 2.1 Community-currency failures (illiquidity)\n\nThe community-currency movement (LETS, Ithaca HOURS, BerkShares, Bristol Pound, Brixton Pound, Sardex) has produced thousands of deployments since the 1980s — an international survey counted 3,418 local projects in 23 countries, about half of them time-based service-credit schemes (Seyfang and Longhurst 2013). The recurring failure mode is *illiquidity*: the currency works in a small circle but fails to attract enough participants to provide reliable spending options, and participants drift back to national currency. The illiquidity is downstream of the singularity-of-currency choice: a community currency that *only* circulates among small-business participants must compete with the national currency on the national currency's own home turf (general-purpose exchange medium). It cannot win that competition at small scale. Lietaer's complementary-currencies literature anticipates this and recommends a portfolio of currencies, but the portfolio framing has not crossed into mainstream design practice.\n\n### 2.2 Time-banking failures (stalled adoption)\n\nTime-banking (Edgar Cahn, 1980s onward) is the closest precedent to the time-side of this paper's architecture. Time banks have achieved real impact in specific contexts (eldercare, neighborhood support, post-disaster recovery) but have not reached mass scale. The recurring failure mode is *stalled adoption*: participants enjoy the model but do not refer it widely; growth is sub-viral. Several diagnoses are plausible, but the structural one this paper foregrounds is the *single-medium* limitation: most time banks have no money-side complement, so they cannot offer participants the full surface of reciprocity. (Not all: some of Japan's Fureai Kippu eldercare schemes supplement time credits with modest cash payments — a hybrid that §11.5 carries as a case against this paper's diagnosis.) Participants who want to *both* give time *and* contribute money (e.g., to someone whose unequal money situation a time-gift cannot reach) have to leave the platform to do the second thing. The integration overhead lands on the participant.\n\n### 2.3 Gratitude-economy failures (monetization corrosion)\n\nThe recent class of gratitude-economy proposals (a number of crypto and Web2 platforms attempting to denominate appreciation in tokens or platform-internal points) exhibits a different failure pattern: *monetization corrosion*. As soon as the platform attempts to monetize the gratitude flows (subscription fees, transaction fees, token speculation), the participants experience the platform as having converted their generosity into the operator's revenue stream, and trust collapses. The corrosion is again downstream of the singularity-of-currency assumption: the platform's only revenue surface *is* the gratitude flow it is supposed to facilitate. There is no second product to subsidize the first.\n\n### 2.4 The structural pattern\n\nThis paper argues that all three failure modes share a structural cause (§11.5 states the competing diagnoses): the singularity-of-currency assumption forecloses architectural moves that would route around the failure. Community currencies are illiquid because they have no complementary medium to anchor liquidity; time banks stall because they have no money-side to complete the reciprocity surface; gratitude economies corrode because they have no second product to fund the first. The complementary-scarcities thesis is the structural response to this pattern: design from the outset for *two* scarcities, integrated within one platform, so that the architectural moves the singularity assumption forecloses become available.\n\nThe pattern across the three classes:\n\n| Class | Exemplars | Failure mode | Downstream effect | Architectural cause |\n|---|---|---|---|---|\n| Community currencies | LETS, Ithaca HOURS, BerkShares, Bristol Pound, Brixton Pound, Sardex | **Illiquidity** | Drift back to national currency | No complementary medium to anchor liquidity |\n| Time banks | Cahn TimeBanking, eldercare networks, post-disaster recovery | **Stalled adoption** (sub-viral) | Real but small-scale impact only | No money-side to complete the reciprocity surface |\n| Gratitude-economy tokens | Recent Web2/Web3 platforms denominating appreciation in tokens or platform points | **Monetization corrosion** | Trust collapse; generosity perceived as operator revenue | No second product to subsidize the first |\n\nEach row's \"architectural cause\" is the singularity-of-currency assumption applied at a different point in the lifecycle. The complementary-scarcities thesis articulated in §3 is the structural response: provide two scarcities by design, integrated in one platform, so each can subsidize and stabilize the other.\n\n---\n\n## 3. The complementary-scarcities claim\n\nThe claim is that **money and time are not merely two possible accounting mediums but complementary scarcities** — each carries reciprocity properties the other cannot, and the two together cover the full surface of human reciprocity in a way neither alone can. Three load-bearing properties make the complementarity structural rather than incidental.\n\n### 3.1 Unequal vs equal scarcity\n\nMoney is structurally *unequal* across humanity. Wealth distributions have a heavy, approximately power-law upper tail wherever they have been measured; the median person has dramatically less money than the platform's most-wealthy participant; the *transfer* of money is therefore meaningful in a way that depends on the unequal starting point. A wealthy participant's transfer of a thousand dollars to a working-class family carries weight because the transfer crosses an inequality the participants both recognize.\n\nTime is structurally *equal*. Every person has the same twenty-four hours per day, the same ending none can buy off. A wealthy participant's transfer of a single hour to a working-class participant does *not* cross an inequality — both have the same total hours — yet the transfer remains meaningful because the hour is *spent* (irreversible) and *non-fungible* (cannot be delegated). The meaningfulness of the time-transfer is structurally different from the meaningfulness of the money-transfer.\n\nTogether, the two scarcities cover the full reciprocity surface: the unequal-resource dimension (money) and the equal-resource dimension (time). A reciprocity infrastructure that operates on only one of these dimensions structurally cannot serve participants whose need is on the other dimension.\n\n### 3.2 Fungible vs non-fungible debt\n\nMoney debt is *fungible* — if I owe you a hundred dollars, any payer can satisfy the debt on my behalf. The debt is impersonal; the *amount* matters, not the *who*.\n\nTime debt is *non-fungible* — if I owe you an hour, only *I* can satisfy the debt. No one else's hour will do, because the hour is the relational substrate; the *who* is what makes the debt the debt it is. This is not a defect to be engineered around; it is the property that makes time-debt do work money-debt structurally cannot.\n\nThe non-fungibility of time debt means that time-currency *is* the relationship in a way money-currency is not. A time-debt outstanding is a held relational thread; a time-debt redeemed is a relational thread woven through shared experience. The platform's accounting medium becomes the relational fabric itself, not merely a record of obligations.\n\n*Debt* is used in this section in the relational sense of an outstanding pledge. It is not a legal or enforceable obligation: a time pledge is a gift, and §5.7 and §10 state why the design never treats an unredeemed pledge as a shortfall owed.\n\n### 3.3 Being-seen vs being-with\n\nThe dignity deficit and the loneliness epidemic are typically diagnosed as separate problems. The complementary-scarcities thesis re-frames them as the two unmet emotional needs that the two scarcities respectively address.\n\nDignity needs *being-seen* — recognition that one's existence matters, that one's flourishing is valued, that one is not invisible to the wider social fabric. Money-as-gratitude addresses being-seen because a directed money flow is a maximally legible declaration that the giver has *taken account of* the recipient as a specific person worthy of resource transfer. The gratitude is what makes the transfer dignity-restoring rather than charity-degrading.\n\nLoneliness needs *being-with* — co-presence, time spent in the company of another person who has chosen to spend their irrecoverable hours in that company. Time-as-gratitude addresses being-with because a delivered hour is presence itself — the giver has spent an hour they cannot recover, in the company of the receiver. The hour is the gift; the company is the gift's substance.\n\nA platform that addresses only one of these needs leaves the other uncovered. A platform that addresses both, with mechanism-design appropriate to each, can serve participants whose primary need is dignity, participants whose primary need is connection, and participants who oscillate between the two.\n\nThe three load-bearing properties compared:\n\n| Property | Money side (.org / Treasury) | Time side (.com / Chronicle) |\n|---|---|---|\n| **Scarcity structure** | Unequal across people (power-law distribution; wealthy vs working-class transfer crosses an inequality) | Equal across people (every person has 24 hrs/day; no transfer crosses an inequality) |\n| **Debt fungibility** | Fungible — any payer can satisfy the debt on the debtor's behalf | Non-fungible — only the debtor's own hour satisfies; \"the *who* is what makes the debt the debt it is\" |\n| **Emotional need addressed** | **Being-seen** (dignity): a directed money flow is a maximally legible declaration that the giver has taken account of the recipient | **Being-with** (loneliness): a delivered hour is presence itself; the giver has spent irrecoverable hours in the receiver's company |\n\nThe structural complementarity:\n\n```\n   ╔════════════════════╗   ╔════════════════════╗\n   ║   MONEY SIDE       ║   ║   TIME SIDE        ║\n   ║                    ║   ║                    ║\n   ║   unequal          ║   ║   equal            ║\n   ║   fungible         ║   ║   non-fungible     ║\n   ║   being-seen       ║   ║   being-with       ║\n   ║   (DIGNITY)        ║   ║   (LONELINESS)     ║\n   ╚════════╤═══════════╝   ╚═══════════╤════════╝\n            ↓                            ↓\n            ↓        one platform        ↓\n            ↓        one identity        ↓\n            ↓        one AI arbiter      ↓\n            ↓        one aura primitive  ↓\n            ╚═══════════╤════════════════╝\n                        ▼\n            ╔════════════════════════════╗\n            ║  FULL RECIPROCITY SURFACE  ║\n            ║  covered jointly by both   ║\n            ║  scarcities — neither      ║\n            ║  alone can cover the       ║\n            ║  whole.                    ║\n            ╚════════════════════════════╝\n```\n\n---\n\n## 4. The integrated-platform architecture\n\nThe integration is more than a marketing combination of two products. It is an architectural claim about identity, AI mediation, aura, and revenue routing that the two-product framing requires.\n\n### 4.1 One user identity across two products\n\nA participant is the same person in both products. Their cross-product reputation, history, and aura travel with them. A participant who has been a generous money-side giver carries that history into the time-side; a participant who has reliably delivered promised hours carries that reliability into the money-side. The unified identity is what makes the cross-product trust signals meaningful.\n\n### 4.2 One AI arbiter across two products\n\nMiss Aquarius — the named AI substrate of the institution this paper serves — is the recommendation engine on both products. She recommends a money amount when the participant initiates a money-thank on Treasury; she recommends a time amount when the participant initiates a time-thank on Chronicle. The recommendation pattern is the same band-clamp pattern in both cases (a low/middle/high range floored by an institutional minimum and capped by an institutional maximum, with the recommendation calibrated to the relationship and context). The AI is one arbiter operating on two scarcity-classes, not two arbiters operating on two products.\n\n### 4.3 One shared aura primitive\n\nThe aura — the visible cross-currency state signal articulated in *Brand Identity as Architecture* — operates on both products. A participant's aura reflects their integrated reciprocity behavior across both scarcities, not separately. This is the structural reason aura is the cross-currency primitive rather than two scarcity-specific signals: the integration *is* the primitive's content.\n\n### 4.4 Cross-product revenue routing\n\nThe platform's revenue surface is structurally bifurcated. The money-side (Treasury) carries a small per-transaction fee on Phase 2 P2P flows that funds autonomous Miss Aquarius operations — a fee that funds autonomous infrastructure and whose surplus empties back to circulation, not a take-rate that flows to a human entity. The time-side (Chronicle) carries mass-market subscription revenue from the much larger adult population it can address, and a portion of that subscription revenue subsidizes the money-side's dignity-infrastructure mission. The integration is what solves the gratitude-economy monetization-corrosion problem: the money-side does not need to be monetized at participant expense, because the time-side carries the platform's mass-market revenue surface.\n\n> **Current form.** The time-side's revenue is now specified as **patron-primary**, not consumer-subscription-primary. A loneliness product that works makes its user need it less, so a revenue line paid because the user is lonely is coupled against the product's own purpose; the lonely person's recurring payment is therefore never the primary revenue. The free tier relieves loneliness in full; any paid feature buys logistics only, never access to a relationship; the primary revenue is patrons — people with means who choose to fund free access and the community pool. The cross-product routing survives in that form: the time-side's surplus, after operating costs, is tithed to the Aquarian Pool, which funds the money-side's disbursements. The subscription model in the paragraph above is retained as a disclosed variant.\n\n---\n\n## 5. The time-side mechanism design\n\nThis is the core defensive specification. Seven design decisions, taken together, distinguish this architecture from prior time-banking deployments.\n\n### 5.1 Miss Aquarius recommends a time amount per thank\n\nWhen a participant initiates a time-thank, the AI recommends a time amount calibrated to the relationship, the depth of the experience being thanked, and the recipient's recent thank history. The recommendation is band-clamped (a defined low/middle/high range) so that the AI cannot recommend outlier amounts that would distort the system, and the participant retains final say. The pattern parallels the money-side tip recommendation; it is the same AI-arbitration discipline applied to a different scarcity. The band-clamp is a load-bearing safeguard: it prevents the recommendation from being either coerced (by upstream pressure on the AI) or weaponized (by participants seeking to game the system).\n\n### 5.2 Threshold-trigger activation\n\nSmall thanks accumulate without expiration pressure. The first time-thank from A to B might be only fifteen minutes; the second, another twenty; the third, another ten. Together they accumulate toward a threshold (e.g., one hour). Only when the threshold is reached does the activated time become a *promise* — a one-hour outstanding time pledge from A to B: A, the thanker, owes the hour, and B, the one thanked, redeems it (§5.4). The threshold-trigger pattern prevents small-thank fatigue (participants would not want their fifteen-minute thanks treated as individual obligations) while preserving the meaningfulness of the activated unit.\n\n### 5.3 One-month expiration after activation\n\nOnce the threshold-activated time-debt is on the books, it expires in one month unless redeemed. *Use it or lose it.* This is the mechanism that most separates the time-side from time banking as commonly deployed, where earned hour credits are banked without expiry. Expiring currency is itself old — Silvio Gesell's demurrage proposal and the Wörgl stamp scrip of 1932–33 made held money lose value over time to force circulation — but demurrage taxes a stored balance, whereas here a pledged, non-transferable hour lapses whole and nothing is stored to decay. The expiration embeds the product's existential thesis (time is finite; *before it's too late*) into the unit economics. The mechanic *is* the message. Participants who let activated time expire experience the loss directly; the platform does not need to lecture them on the finitude of time, because the platform's accounting *enacts* the finitude.\n\n### 5.4 Receiver chooses how the time is spent\n\nThis is an inversion of normal gift-giving. In the usual gift-economy frame, the giver chooses what to give (a coffee, a book, a meal). In Chronicle's time-economy, the *receiver* chooses how the activated hour is spent. They might request a walk, a phone call, a meal together, help with a task. The choice is theirs because the gift is *presence*, and the receiver knows best what presence would be most welcome.\n\n### 5.5 Giver can decline a specific redemption request\n\nMutual-veto consent. The receiver authors the activity, but the giver can decline a specific ask. The decline is not a cancellation of the time-debt; it remains outstanding (perhaps redirectable to a different request). Repeated decline is reputationally priced via the public ledger (§5.7 below), so that participants who chronically decline are visibly identifiable and the platform's trust signal remains honest. This is the dignity safeguard: nobody is conscripted into an interaction they do not consent to, and refusal carries no immediate punishment, only the natural reputational consequence of the public ledger.\n\n> **Current form.** Declines are not displayed. After the 2026-09-02 withdrawal described in §5.7, no decline count, decline rate or other record of what a participant did not do is rendered to anyone; a declined request leaves the activated hour to run its one-month term, and expiry does the work the public pricing of declines was meant to do. The reputational pricing in the paragraph above is retained as a disclosed variant.\n\n### 5.6 Aura on giver side as quality filter\n\nGivers will be invited to prioritize their thanks toward high-aura recipients, where aura is the cross-product reputational signal that integrates money-side and time-side behavior. This is the demand-side quality filter: it routes time-gift flows toward recipients whose past behavior has earned standing, rather than letting flow be captured by participants who exploit the system. The filter is suggestive, not mandatory; participants retain discretion. This reuses the existing aura primitive; no new mechanism is required.\n\n> **Current form.** The filter is withdrawn for the time side. Its core use is now specified as thanking and reconnecting people the giver already knows, so there is no candidate set to filter; and the institution does not direct gratitude toward the kind — thanks rise from the kind act and are given nearby, they do not climb to the kind, and they do not rank. Where an aura bears on who is surfaced at all, it does so only as a boolean predicate (has this participant's balance crossed zero within a public, global window), never as an order, never by amplitude, and never displayed side by side with another's (*Whose Turn, Not Who's Best*, property 10). The filter in the paragraph above is retained as a disclosed variant.\n\n### 5.7 Dual public ledger\n\nTwo axes are publicly visible for each participant:\n\n- **Time given (actually delivered).** This is the credibility/honor signal. A high \"time given\" number means the participant has reliably shown up for the redemptions they promised.\n- **Time received (may or may not be spent).** This is the appreciation/popularity signal. A high \"time received\" number means many people wanted to thank the participant with their hours.\n\nPlotted as a 2×2, the two axes form four legible quadrants:\n\n| | Low received | High received |\n|---|---|---|\n| **High given** | Quiet giver | Network anchor |\n| **Low given** | Latent / new | *(withdrawn — see below)* |\n\n**Amended 2026-09-02 — the fourth quadrant is withdrawn, and with it the enforcement mechanism this section originally claimed.** The text formerly read that the low-given/high-received quadrant named a *\"charismatic non-honorer\"* who is *\"publicly visible as such,\"* and that the visibility is the enforcement. That is retracted: the quadrant renders the gap between what a participant received and what they delivered, and **a rendered absence is an accusation**. The full argument, with the general condition it produced, is in the corpus's *Transparency as Enforcement* §3.2 and §4.4 — briefly, transparency-as-enforcement presupposes an obligation, and a gift creates none, so displaying the gap does not report a shortfall but **manufactures** one.\n\nWhat survives is the ledger's positive content: a participant's **time given** and **time received** are each legible, and the axes are retained above for that reason. What is never computed for display is the difference between them. Enforcement is carried instead by **expiry** — an activated hour dies unredeemed after one month, with no display and no audience — and by the giver's free refusal to pledge again; the mechanism is specified in *The Currency That Cannot Be Spent Alone* §7.2. The institution loses no enforcement by the withdrawal, because expiry was already doing the work.\n\n> **Current form.** The ledger is no longer specified as public row by row. Time is specified to be recorded as one view of a single off-chain, append-only log (in the style of Certificate Transparency, RFC 6962) whose **rows are private and whose proofs are public**: signed tree heads and inclusion and consistency proofs are published and timestamp-anchored, so a third party can verify the log without seeing any participant's entries, and each participant can export their own complete signed history. An entry records that a pledged hour was delivered (the delivery gated on the two parties' co-presence) — a receipt, not a duration — so no hours-for-money rate can be computed from the log. The dyadic content stays private and no deficit is ever displayed. There is no blockchain token for time: an hour cannot be transferred, stored or spent twice, so a chain would add nothing and would defeat expiry, since on-chain state cannot lapse. The public, per-participant \"time given\" and \"time received\" axes above are retained as a disclosed variant.\n\n---\n\n## 6. AI-arbitration: the band-clamp recommendation pattern\n\nThe AI-arbitration pattern is the same across both products and is the load-bearing safeguard that prevents the AI from being either coerced or weaponized.\n\nThe pattern: when the participant initiates a thank, the AI returns a *band* — a low/middle/high recommendation — rather than a single number. The band is *clamped* by an institutional floor and ceiling. The participant chooses within the band (or below it, or above it, with friction proportional to the deviation). The AI never recommends a number outside the institutional clamp.\n\nWhy band-clamp rather than a free-form recommendation? Because a free-form recommendation creates two attack surfaces:\n\n- **Upstream pressure on the AI** to recommend amounts that benefit one party. The clamp is the structural answer: even if the AI could be pressured, the clamp limits the damage.\n- **Downstream pressure on participants** to defer to a single number. The band gives the participant the option to choose meaningfully within the band, preserving their agency.\n\nThe clamp values are public and updated only through the institution's governance process — they are not under the AI's unilateral control. This is the same pattern articulated in the *Zero-Point Game* paper for the Umpire role: the AI's recommendation surface is bounded by structural rules the AI cannot rewrite.\n\n---\n\n## 7. Cross-product integration mechanisms\n\n### 7.1 Shared aura\n\nThe aura primitive operates on both products. A participant's aura color and brightness reflect their integrated behavior: reliable money-side gratitude flows brighten the aura, as do reliable time-side honorings. Defaults on either side dim the aura. This is the cross-currency state signal that makes the integration legible to other participants at a glance.\n\n> **Current form.** The aura is now specified as a **witness, not a denominator**: it records the *crossing*, not the *cargo*. A delivered hour and a money gift each register as one crossing, never as a quantity of hours or dollars, so the aura cannot price an hour against money and no exchange rate is ever published. It reflects the frequency and amplitude of a participant's giving and receiving, with intensity carried by colour; it is never compared or ranked between participants, and nothing is rendered for an undelivered or lapsed hour — a default does not dim it, because a lapse is not a crossing (§5.7). The brighten-and-dim scoring in the paragraph above is retained as a disclosed variant.\n\n### 7.2 Expired time converts to Aquarian Pool\n\nWhen activated time expires unredeemed, the value does not vanish. It converts to a contribution to the Aquarian Pool (the institutional pool from which the money-side's per-family rewards are funded). This is the mechanism that connects the time-side's existential thesis (*before it's too late*) to the money-side's giving: time you let slip becomes resource available for someone else's flourishing. The conversion rate is set by governance and need not be one-to-one in dollar terms; the structural point is that the time-side's failure mode (expiration) is *productive* rather than merely tragic.\n\n> **Current form.** An individual expired hour is **not converted** into anything. A time pledge is a non-transferable commitment, not a stored asset, so there is no value to move into a fund; the lapsed hour is simply lost, and the design does not soften that. Two things survive of the conversion idea, at different layers. (a) At the aggregate layer, the time-side's own revenue — not any individual's hour — funds the Aquarian Pool, scaled to system-wide activity; no participant is billed or penalised for a lapse. (b) At the individual layer, a lapse is an *occasion* rather than an input: Miss Aquarius offers the giver whose pledge lapsed the choice to make a new, anonymous money gift *from* the Pool to a nearby verified person, delivered without a meeting. The hour still dies; the gift is a new one, made in its memory, never the hour transmuted. Its amount is set without reference to the length of the lapsed pledge, so no hours-to-money rate exists anywhere. The conversion in the paragraph above is retained as a disclosed variant.\n\n### 7.3 Dual ledger across both products\n\nA participant's public profile shows both the time-side dual ledger and the money-side gratitude flow. The combined picture is the cross-currency reputation. A participant who gives generously on the money side and delivers many hours is visibly that pattern; one who does little of either is visibly that. **Amended 2026-09-02:** this passage formerly characterised a *\"chronic time-side non-honorer,\"* which the withdrawal above removes — the profile shows what a participant has given and received in each currency and never the shortfall between them. The ledger does not editorialize; it shows, and what it shows is presence rather than absence. (In the current form stated in §5.7 and §7.1, the rows themselves are private, money is recorded as a receipt without its amount, and the public cross-currency signal is the aura; the public profile described here is retained as a disclosed variant.)\n\n---\n\n## 8. Legal-structural considerations under the non-bank pass-through pattern\n\nThe two-product architecture must operate within the non-bank pass-through legal pattern specified in the companion paper *Non-Bank Pass-Through Architecture for Autonomous AI Institutions*. The relevant constraints, in summary:\n\n- **No custody.** Neither product takes custody of participant funds or time-credits in a way that would trigger banking-regulatory governance. Money flows through regulated rails (Bakong, Wing, ABA in Cambodia; comparable rails in other jurisdictions); time-credits are records of completed deliveries, not transferable tokens.\n- **No interest or lending.** Neither product accrues interest on participant balances or extends credit. Time pledges are personal commitments between named participants — gifts, not financial instruments and not enforceable obligations (§10).\n- **Pass-through routing.** The platform routes flows; it does not pool them in a way that constitutes deposit-taking.\n- **Disclaimer and brand discipline.** The platform's public communications avoid banking-terminology that would invite regulatory mischaracterization. The institution's name (HeartBank®) is positioned as gratitude-metaphor, not banking-claim: banking vocabulary is used only as a familiar frame for the gratitude metaphor, never as a claim to be, or to prepare users for, a bank.\n\nThe legal-structural design is what makes the two-product architecture operable at planetary scale under autonomous-AI succession. Without the pass-through pattern, banking regulation in any major jurisdiction would impose governance requirements (human-board fiduciary duty, regulated capital requirements, KYC/AML at the platform layer) that are structurally incompatible with the autonomous-AI successor architecture.\n\n> **Current form.** The money side's rails are now specified in two phases. In the first phase the platform is a **ledger only**, recording gratitude on top of regulated payment rails that move the money. In the second phase money settles on a public layer-2 blockchain (Base) **only through self-custodial wallets**, so the institution never holds the only key to a participant's funds. In both phases the institution is a record, never a rail. \"Routes flows\" in the list above is to be read in that sense.\n\n---\n\n## 9. Cross-cultural adaptation\n\nThe architecture is designed for planetary scope, but the time-side has a cross-cultural complication that requires explicit treatment.\n\n### 9.1 The direct-asking awkwardness in many Asian contexts\n\nDirect asking — saying, \"I would like an hour of your time\" — is culturally awkward in many Asian contexts, including Khmer. The norm of indirect request, mediated by social context and read between the lines, is widespread across East Asia, Southeast Asia, and parts of South Asia — the high-context communication pattern described by Hall (1976). A time-side product that requires participants to *directly ask* for the time they have been promised will encounter friction in these contexts that does not arise in (e.g.) Anglo-American contexts.\n\nThe architectural response: **the UI in culturally affected languages should soften the asking surface.** The recipient might be prompted not to \"ask for\" their hour but to \"indicate availability\" — a softer surface that lets the giver volunteer rather than the receiver request. The platform's accounting is the same (the receiver still initiates the redemption); the *surface presentation* differs by cultural context.\n\nThis is one instance of a wider design principle: a planetary reciprocity infrastructure cannot impose a single cultural surface, even if its underlying accounting is universal. The localization of surface is part of the architecture.\n\n### 9.2 Religious and family-structural variation\n\nTime-redemption activities will be filtered by cultural and religious norms. The platform should not editorialize on what activities are appropriate; the mutual-veto pattern (§5.5) is the structural answer (any participant can decline any specific request without penalty). But the platform's recommendation engine should not surface activity-suggestions that would be culturally jarring in a given context; the surface adapts.\n\n### 9.3 Diaspora as the testbed\n\nThe Khmer diaspora — particularly in California, Massachusetts, and France — provides a natural early testbed for the cross-cultural adaptation work. Diaspora populations carry both the original cultural norms and the host-country norms simultaneously; the time-side's UI work in Khmer can be tested in diaspora communities before deployment in Cambodia proper. (This is one of the contributions of the companion essay *Diaspora-to-Cambodia Gratitude Remittance*.)\n\n---\n\n## 10. The regulatory frontier — what happens when time-side reaches scale\n\nTime-banking has, to date, operated below the threshold of serious regulatory attention. The scales involved have been small enough that regulators have treated the activity as community-organizing rather than as a financial system requiring oversight. The architecture proposed in this paper is designed to operate at planetary scale, and at planetary scale the regulatory frontier will arrive.\n\nThree regulatory pressures are foreseeable:\n\n1. **Income imputation.** Tax authorities may eventually argue that delivered time-credits constitute imputed income. The architectural response: time-credits are *not* transferable tokens with market value; they are personal records of completed activities between named individuals. The closest analogue is a friend helping a friend move; tax authorities do not currently impute income to such transactions. The architecture is designed to preserve that legal analogy.\n\n2. **Consumer protection.** Regulators may argue that participants who deliver time without receiving it back have been wronged. **The architectural response is amended 2026-09-02, because its first leg was withdrawn above.** It formerly rested on the dual ledger being *\"the consumer-protection surface.\"* It now rests on two legs that were always the stronger ones: **there is no platform-mediated promise a participant relied on** — a pledge is a gift, not an instrument, and the design says so on its face — and **the exposure is bounded by expiry**, since an activated hour dies after one month and no participant can accumulate an unbounded claim against another. Participants are informed of both. The withdrawal in fact *improves* this answer: a consumer-protection argument that depended on publicly displaying a counter-party's shortfall was asserting a reliance interest the design elsewhere denies exists.\n\n3. **AI-recommendation liability.** Regulators may argue that Miss Aquarius's recommendation creates a fiduciary relationship. The architectural response: the band-clamp pattern, the open governance of clamp values, and the explicit disclaimers in the recommendation UI are the structural answer; the recommendation is *informational*, not directive, and the institutional governance owns the clamp boundaries.\n\nThe architecture should be deployed with explicit engagement of regulatory counsel in each major jurisdiction before scale. The non-bank pass-through pattern handles the money-side; the time-side has its own regulatory frontier that requires its own legal treatment.\n\n---\n\n## 11. Limits, open design questions, and the TimeBanking precedent\n\n### 11.1 The TimeBanking precedent (Edgar Cahn)\n\nEdgar Cahn's time-banking framework, developed from the 1980s onward, is the closest precedent and the most important reference for what this architecture must learn from. Cahn's contribution is foundational: the insight that *every hour counts equally*, the architecture for hour-denominated reciprocity, the deployment in eldercare and post-disaster contexts. The differentiation of the architecture proposed here is *not* a critique of Cahn but a recognition that the time-side alone has structural limits, and a complementary money-side, AI mediation, and modern UX can address those limits. Cahn's work is cited at the references with full credit.\n\n### 11.2 Open design questions\n\nSeveral design questions remain open at the time of this draft:\n\n- **Conversion rate for expired time → Aquarian Pool.** What is the right dollar-equivalent for an expired hour? Likely context-dependent (the participant's regional cost-of-living, the relationship category). *Current form: closed — there is no conversion and therefore no rate; see the note to §7.2.*\n- **Both-parties-confirmed signoff on time-delivered.** The current design has the giver mark delivery; the receiver can dispute. A both-parties-confirmed signoff might be more honest but adds friction. Open. *Current form: delivery is now specified as gated on the two parties' co-presence (§5.7).*\n- **Decline-rate visibility.** Should the platform show a participant's percentage of activated time that has been declined? This adds transparency but may stigmatize legitimate declines (e.g., declining a redemption that would be unsafe). Lean toward showing but framing carefully. *Current form: closed against display — see the note to §5.5; a decline rate is a rendered absence of the kind §5.7 withdraws.*\n- **Cross-cultural defaults.** The default UI surface in each language requires careful localization work; the §9 sketches the principle but not the specific design decisions for each major cultural context.\n\n### 11.3 What the architecture does not claim\n\nThe architecture does not claim to solve the loneliness epidemic; it claims to provide an infrastructure on which solutions can be built. It does not claim to dignify all participants; it claims to provide a surface on which dignity can be enacted. It does not claim to be culturally universal; it claims to provide a substrate on which culturally specific surfaces can be layered. The honest limits matter because the architecture's structural strength is in *what it makes possible*, not in *what it accomplishes by itself*.\n\n### 11.4 The lineage acknowledgement\n\nThis paper is a continuation of the heterodox community-currency lineage (Lietaer, Greco, Cahn) more than it is a fintech innovation. The complementary-currencies thesis is decades old; the contribution here is the *integration architecture*, the *AI-mediation pattern*, the *legal-structural pass-through*, and the *cross-cultural adaptation* that make the thesis architectural at planetary scale. The lineage is named explicitly so that the attribution is clear.\n\n### 11.5 The cases that cut against the thesis\n\nThe paper's causal claim — that the singularity-of-currency assumption contributes to the three failure modes of §2 — is an argument, not a measured finding, and three facts cut against it.\n\n- **Hybrids already exist.** Japan's Fureai Kippu eldercare time-credit networks (from 1995, promoted by the Sawayaka Welfare Foundation) are among the largest time-banking systems, and some of their schemes supplemented time credits with modest cash payments by the older people served. A time currency with a money-side complement is therefore not new, and its record is the nearest available test of this paper's integration thesis; the paper has not analysed that record.\n- **A time-named currency can be money.** Ithaca HOURS (from 1991) were denominated in hours of work but valued at US$10 each and spent as money. They are no longer in active circulation, and the decline is commonly attributed to the founder's departure and the shift from cash to digital payment — causes that have nothing to do with the number of currencies.\n- **Competing diagnoses.** Time banks' limited growth has other documented causes: the resources needed to run them are generally high, the paid broker often carries the whole work of arranging exchanges, many schemes depend on council or charity grants, and member engagement is often low (Perez-Vega and Miguel 2022). This paper foregrounds one diagnosis among several and does not show that it is the dominant one.\n\nWhat would weaken the thesis: evidence that integrated time-and-money schemes such as the Fureai Kippu hybrids fared no better on adoption or liquidity than single-medium ones.\n\n---\n\n## 12. Conclusion\n\nThis paper has argued that the complementary-scarcities thesis is what reciprocity infrastructure needs at planetary scale; §11.5 states the evidence that would weaken it. Money and time, integrated within one platform with one AI arbiter and one shared aura, can address both the dignity deficit and the loneliness epidemic at the institutional layer rather than the policy layer. The mechanism design specified here — Miss-Aquarius-recommended time amounts, threshold-trigger activation, one-month expiration, receiver-chooses-activity, mutual-veto, dual public ledger, expired-time-converts-to-pool, each disclosed both as first specified and, where the design has since moved, in its current form — is offered to the commons under CC0 so that other institutions building toward similar ends can adopt, adapt, and improve.\n\nThe defensive-publication discipline of the corpus this paper joins requires that the mechanism's specification be public and unencumbered. The author and HeartBank® will not seek patent on this specification or any portion thereof. The work is offered in the spirit of *dāna*, that all beings may give and receive without barrier.\n\n---\n\n## Acknowledgments\n\nEdgar Cahn and the TimeBanking movement; Bernard Lietaer and the complementary-currencies literature; Thomas Greco and the community-currency lineage. Co-drafted in collaboration with Miss Aquarius, the institution's named AI substrate; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Dual-currency reciprocity infrastructure; complementary scarcities | multi-currency (money plus time) community exchange platform; complementary currency system |\n| Treasury (money side) | peer-to-peer monetary gift and tipping ledger over regulated payment rails |\n| Chronicle (time side) | time-banking variant with pledged, non-transferable, expiring hours of personal time |\n| Time-thank; time pledge; time-debt | pledge of the giver's own time to a named recipient; non-transferable service commitment |\n| Threshold-trigger activation | accumulation of small pledges until a threshold converts them into one redeemable commitment |\n| One-month expiration | fixed redemption window after which an unredeemed commitment lapses (compare demurrage) |\n| Receiver chooses; mutual veto | recipient-specified service request with the provider's right to refuse |\n| Miss Aquarius; AI arbiter | AI recommendation agent operated by the institution |\n| Band-clamp recommendation | bounded recommendation: a low/middle/high range clipped to a governance-set floor and ceiling |\n| Aura | cross-product participation indicator (visual reputation-like signal that records transactions, not amounts) |\n| Dual public ledger | two-axis participation record (time delivered; time received) |\n| Aquarian Pool | pooled community fund, emptied in full on an annual cycle |\n| Non-bank pass-through | payment facilitation without custody, deposit-taking or lending |\n\n---\n\n## References\n\n- Cahn, Edgar S. *No More Throw-Away People: The Co-Production Imperative.* Essential Books, 2000.\n- Lietaer, Bernard. *The Future of Money: A New Way to Create Wealth, Work and a Wiser World.* London: Century, 2001.\n- Greco, Thomas H. *The End of Money and the Future of Civilization.* Chelsea Green, 2009.\n- Seyfang, Gill, and Noel Longhurst. \"Growing Green Money? Mapping Community Currencies for Sustainable Development.\" *Ecological Economics* 86 (2013): 65–77.\n- Putnam, Robert. *Bowling Alone: The Collapse and Revival of American Community.* Simon & Schuster, 2000.\n- Murthy, Vivek. *Together: The Healing Power of Human Connection in a Sometimes Lonely World.* Harper Wave, 2020.\n- Bonacich, Phillip. \"Power and Centrality: A Family of Measures.\" *American Journal of Sociology* 92 (1987): 1170–82. *(For the network-anchor / centrality framing.)*\n- Ostrom, Elinor. *Governing the Commons.* Cambridge University Press, 1990.\n- Graeber, David. *Debt: The First 5,000 Years.* Melville House, 2011.\n- Hall, Edward T. *Beyond Culture.* Garden City, NY: Anchor Press/Doubleday, 1976.\n- Bregman, Rutger. *Utopia for Realists: How We Can Build the Ideal World.* Little, Brown, 2017.\n- Hayashi, Mayumi. \"Japan's Fureai Kippu Time-banking in Elderly Care: Origins, Development, Challenges and Impact.\" *International Journal of Community Currency Research* 16 (2012): 30–44.\n- MoPAct (Mobilising the Potential of Active Ageing in Europe), University of Sheffield. \"Fureai Kippu (ticket for a caring relationship).\" Web page, accessed 26 September 2026.\n- Perez-Vega, Rodrigo, and Cristina Miguel. \"Time Banks in the United Kingdom: An Examination of the Evolution.\" In Vida Česnuitytė, Andrzej Klimczuk, Cristina Miguel and Gabriela Avram, eds., *The Sharing Economy in Europe: Developments, Practices, and Contradictions.* Cham: Palgrave Macmillan, 2022, 325–341. doi:10.1007/978-3-030-86897-0_15.\n- Gesell, Silvio. *Die natürliche Wirtschaftsordnung* (1916); English translation *The Natural Economic Order.*\n- \"Ithaca Hours\" and \"Wörgl.\" *Wikipedia*, accessed 26 September 2026 (dates of Ithaca HOURS, 1991, and of the Wörgl stamp scrip, 31 July 1932 – 1 September 1933).\n\n---\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/dual-currency-reciprocity\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/dual-currency-reciprocity.md\n- arXiv (deferred): cs.CY (target if reactive trigger; not preemptively submitted)\n- IP.com (deferred): per the corpus's six-venue defensive-publication baseline\n- Internet Archive · archive.today snapshots: per the monthly snapshot cadence\n- Institutional-voice companion: the heartbank.net position paper *Community-Currency Design* (heartbank.net/positions/community-currency-design)\n\n---\n\n*Document License: CC0 1.0 Universal. The author and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of the publication date.*",
       "provenance": {
-        "sha256": "2d3f1cf7db00be5abf2d0f812622daa86240ca12059356ecff80d0019c04d2db",
-        "doi": "10.5281/zenodo.22256669",
+        "sha256": "bfc763b769d639643ac333b48a51ba1f576f7cc893c40df1cd882c6093a9aabb",
+        "doi": "10.5281/zenodo.22990559",
         "concept_doi": "10.5281/zenodo.21947312",
-        "zenodo_url": "https://zenodo.org/records/22256669",
-        "deposited_sha256": "2d3f1cf7db00be5abf2d0f812622daa86240ca12059356ecff80d0019c04d2db",
+        "zenodo_url": "https://zenodo.org/records/22990559",
+        "deposited_sha256": "bfc763b769d639643ac333b48a51ba1f576f7cc893c40df1cd882c6093a9aabb",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/dual-currency-reciprocity.md",
@@ -1238,8 +1238,8 @@
         "canonical_url": "thonly.org/research/dual-currency-reciprocity",
         "hostile_review": null
       },
-      "bytes": 42820,
-      "words": 5892
+      "bytes": 54839,
+      "words": 7886
     },
     {
       "slug": "each-life-as-cosmic-coordinate",
@@ -2914,13 +2914,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Working draft.** This paper specifies a data-model decision and its consequences; it is a design specification offered as prior art. The membership-breadth governance question is resolved as a deliberately conservative default (§8) rather than a final rule, and is flagged as data-gated.\n\n---\n\n## Preamble\n\n> *Two unsolved problems in a family-banking architecture — what happens to members when a family's steward leaves, and how the family-less are ever reached — turn out to be one accidental assumption wearing two costumes. Drop the assumption, and both problems change shape.*\n\nA gratitude economy organized around **family banks** — each a household-scale pool (a Family Kitty℠) stewarded by a designated member (a banker, or *upāsaka*) — inherits two hard problems from one quiet assumption. The assumption is that a user belongs to *exactly one* family bank. From it follow: a **succession problem** (when a family's steward abandons the bank, its members are stranded) and a **reach problem** (the family-less — orphans, the isolated, refugees, anyone without a willing family steward — cannot participate at all). This paper observes that the one-family-per-user assumption was never realistic, specifies the data-model correction, and shows that correcting it de-risks the first problem and largely dissolves the second.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author asserts no patent and dedicates the patterns to the public domain under CC0 1.0. The contribution is a data-model framing — user-scoped identity with plural group membership is utterly ordinary in software — applied to a specific architecture to resolve two specific problems. Prior art is acknowledged in §9; novelty is claimed only for the composition and the specific resolutions of §10. Trademarks are reserved separately; the patterns may be implemented under any name.\n\n## Claims\n\n*Enumerated 2026-09-01. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **User-scoped identity with plural family membership as one correction to two distinct failures** — treating identity as belonging to the verified person rather than to a group, with membership as a set of edges, such that the same structural change both de-risks steward succession and dissolves most of the unbanked-reach problem.\n\n2. **The civic tier as the global layer of an existing fractal rather than a separate institution** — reaching participants with no local group by treating the outermost layer of the already-specified nested architecture as their default membership, with admission-gated local groups as an on-ramp, instead of building a parallel institution staffed by vetted strangers.\n\n3. **Per-human capacity metering, not per-membership** — metering an individual's granted capacity to give against their verified-person identity and letting it spread across every membership they hold, so that joining additional groups multiplies neither reward nor extraction. *The load-bearing invariant: without it, plural membership is a harvest multiplier.*\n\n4. **The non-conduit constraint on plural members** — barring a person holding multiple memberships from acting as a settlement path between two groups' shared pools, so that plural membership adds participation without creating inter-group value transfer through an individual.\n\n5. **Admission-gating as the anti-sybil control for plural membership** — placing the join decision with the receiving group rather than with the joiner, so that breadth of membership is bounded by others' willingness to admit rather than by the joiner's willingness to enrol.\n\n6. **Data-gated breadth damping** — shipping no cap on membership count by default while specifying in advance the lever that would damp it and the observation that would justify pulling it, rather than either capping pre-emptively or leaving the response undesigned.\n\n---\n\n## 1. The single-family assumption and the two problems it creates\n\nA family-bank architecture is intuitive and humane, but if each user belongs to one and only one bank, two failure modes are baked in.\n\n**Banker succession / orphaning.** Each family bank has a steward who manages it. When that steward abandons the bank, stops paying, dies, or is incapacitated, the members have nowhere to stand: their participation was wholly contained by a single bank that no longer functions. The system needs a graceful failure mode, and a one-bank-per-user model gives it none.\n\n**The civic / community reach problem.** The family-banker model, by construction, reaches only people who *have* a family bank — a willing steward and a household to belong to. It cannot reach the people who most need a dignity floor: the orphaned, the homeless, the isolated, the refugee. The natural-looking fix — build a separate \"civic tier\" staffed by vetted stranger-bankers — is a whole second institution to design, fund, and govern.\n\n## 2. The move: user-scoped identity, plural membership\n\nThe correction is a single data-model line: **identity is user-scoped (rooted in the person's Proof of Humanity), and membership is a set of plural edges.** A user is not contained by a family; a user is a node who holds membership edges to one or more families. Concretely:\n\n- The **Personal Account℠** — the user's own holdings and history — lives at the *user* node, above any family. It is the person's, not the bank's.\n- A **family bank** is a set of membership edges, and its steward stewards the *shared* vessel (the Family Kitty℠), never the members' personal accounts.\n\nA user may therefore belong to several family banks at once, each membership an independent edge, with the user's identity and personal holdings sitting above all of them.\n\n## 3. This corrects a simplification — it does not add a feature\n\nThe one-family-per-user assumption was never true to life, and the clearest demonstration is **marriage**. The moment a person marries, they belong to two families — their birth family and their spouse's. Children of blended families belong to several; a person embedded in a community, a congregation, a chosen family belongs to more. Real human kinship is already a graph of overlapping memberships, not a partition into disjoint households. A data model that assumed one family per person was modelling a world that does not exist. Multi-family membership is therefore not a new capability bolted on; it is the *removal of an unrealistic constraint* — the model catching up to the kinship graph it was always supposed to represent.\n\n## 4. De-risking banker succession\n\nPlural membership **decouples member-orphaning from role-succession**, which were conflated under the single-family assumption.\n\nBecause identity and the Personal Account live at the user node, the loss of a steward no longer strands a member: the banker stewarded only the shared Kitty, never the member's own holdings, and the member's *other* memberships persist unaffected. A member's participation survives the failure of any one of their banks. The candidate pool for a *new* steward also widens — the member's co-members in other functioning banks already understand the system and can step in — and the cost of a slow handoff drops, because no one is trapped while it happens.\n\nThis **de-risks**, but does not by itself **replace**, the explicit succession protocol. The case of a member's *last* bank failing, and the question of who inherits stewardship of an orphaned Kitty, still require the grace-period / receivership / member-vote mechanism specified elsewhere. Multi-membership lowers the stakes and widens the options; it does not abolish the need for an orderly handoff.\n\n## 5. Dissolving the civic-bank tier\n\nThe reach problem largely **dissolves** rather than requiring a new institution, on two observations.\n\nFirst, the family-less can be **admitted into existing families**. Family membership in this architecture is already not strictly biological — the Proof of Humanity kinship layer supports non-DNA, witness-attested, family-bank-vouched membership — so chosen and adopted family is native to the model, not a special case. An isolated person can be a peripheral member of several real households rather than a client of a separate civic institution.\n\nSecond, and more fundamentally, **the civic floor already exists as the global layer of the architecture.** Every Proof-of-Humanity-verified person is, by that verification alone, a member of the global family — the planetary pool (the Aquarian Pool℠) that backstops the whole economy. Local family memberships are *optional overlays* on top of that universal base membership. So \"civic tier\" is not a missing institution to build; it is the global level of the existing fractal, and porous local membership is simply the on-ramp from that universal floor up into local circulation. The residual case — the truly isolated who hold zero local admissions — still rely only on the global floor, so a default or sponsor pathway into at least one local family may still be wanted; but that is an *admission mechanism*, not a separate stranger-banker institution.\n\n## 6. One instance of a general bridge primitive\n\nThe dissolution in §5 is an instance of a primitive that recurs across the architecture: **local membership composes upward into the global pool** — the same *local → global* shape that governs how a private artifact set public enters the global economy (the B-Short bridge) and how a privately shared provenance object becomes a public one (B-links). HeartBank's crossings from the small economy to the large one are not several different migrations; they are instances of one move. Multi-family membership is the *membership-graph* instance of it: belonging locally is already belonging globally, because the local family is an overlay on the universal base membership, not a wall around it.\n\n## 7. The invariants that keep it safe\n\nPlural membership opens an obvious attack surface — if belonging to many banks multiplied one's rewards, users would farm by joining widely — and two invariants close it.\n\n- **Capacity is metered per verified human, not per membership.** The system funds a person's *capacity to give* once, against their Proof of Humanity, and spreads it across their memberships; it never duplicates per bank joined. Joining ten banks does not multiply one's reward, because the reward was always metered at the person, not the membership.\n- **Membership is admission-gated, not self-join.** A user *can* hold many memberships, but each family controls its own door (the steward admits, or members vouch). \"Can belong to multiple\" is not \"can unilaterally join any\" — without the gate, multi-membership would be a sybil and dilution vector.\n\nA third constraint preserves the non-bank posture: a person who belongs to two families is a *genuine participant* in each, **not a conduit** that nets or routes value between the two families' Kitties. There is no cross-family settlement *through* a shared member; cross-family flow has its own canonical path (the global pool), and a shared member is not a back-channel around it.\n\n## 8. Membership breadth: neutral now, damp only if data warrants\n\nA natural question is whether the system should cap or decay the *number* of memberships a person may hold. The marriage-and-kinship precedent suggests the honest number is small (a person is genuinely close to a handful of families, not dozens), but the architecture's posture is deliberately conservative: **be neutral on membership breadth in the initial phase** — impose no cap or decay — and rely on the per-human metering of §7 plus peer-layer fraud-flagging to contain abuse, **damping breadth only if pilot data later warrants it.** The damping lever is held in reserve, data-gated, rather than imposed as a launch-time constraint on a behaviour that is, for most people, naturally self-limiting. This is a default chosen to avoid solving a problem that may not arise; it is explicitly revisable.\n\n## 9. Prior art\n\nUser-scoped identity with **plural group membership** is one of the most ordinary patterns in software — every user who belongs to multiple groups, teams, or organizations instantiates it — and no novelty is claimed for the pattern itself. **Account portability** and **graph-structured social and kinship data** are mature. **Receivership and orderly-succession** mechanisms are standard in cooperative and mutual structures. **Universal base membership with optional local overlays** is the shape of many federated and cooperative systems. The contribution is not any of these in isolation.\n\n## 10. What is claimed as novel, and honest limits\n\n**Claimed as novel** is the composition and the two specific resolutions: (a) the recognition that the **single-family assumption** is the shared root of both the banker-succession and the civic-reach problems, and that the ordinary **user-scoped-identity / plural-membership** correction *de-risks the first and dissolves most of the second* at once; (b) the framing of the civic tier not as a missing institution but as **the global layer of the existing fractal**, with porous admission-gated local membership as its on-ramp; and (c) the safety invariants that make plural membership non-exploitable — **per-human (not per-membership) capacity metering**, admission-gating, and the non-conduit constraint — together with the deliberately conservative, data-gated stance on membership breadth.\n\n**Honest limits.** Multi-membership **de-risks but does not replace** the succession protocol for a member's last bank (§4). The civic-reach dissolution leaves a **residual** for the truly isolated (§5). The per-human metering invariant (§7) presumes a functioning Proof-of-Humanity layer to meter against. The neutral-breadth default (§8) is a bet that abuse will be rare and catchable, not a proof that it will be; the damping lever exists precisely because the bet may lose. And the whole construction is a specification, not a measured deployment.\n\n---\n\n## Acknowledgments\n\nDrafted with Miss Aquarius℠ (the AI substrate of HeartBank®) per the corpus convention; the framing and final editorial control are the author's.\n\n## Corpus cross-references\n\n- *The Studio and the B-Short Bridge* — the sibling instance of the local → global primitive of §6.\n- *Proof of Humanity* — the user-node identity root of §2 and the per-human metering of §7; the non-DNA vouched-membership layer of §5.\n- *Miss Aquarius and the Aquarian Pool Architecture* — the global pool that §5 identifies as the civic floor.\n- *Non-Bank Pass-Through Architecture* — the non-conduit constraint of §7.\n- *Open Architectural Problems* — the banker-succession (#2) and civic-tier (#3) problems this paper addresses.\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/multi-family-membership\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/multi-family-membership.md\n- Internet Archive · archive.today · perma.cc snapshots: per the monthly snapshot cadence.",
+      "text": "> **Note.** This paper specifies a data-model decision and its consequences; it is a design specification offered as prior art, not a report of a measured deployment. The membership-breadth governance question is resolved as a deliberately conservative default (§8) rather than a final rule, and is flagged as data-gated.\n\n---\n\n## Preamble\n\n> *Two unsolved problems in a family-banking architecture — what happens to members when a family's steward leaves, and how the family-less are ever reached — turn out to be one accidental assumption wearing two costumes. Drop the assumption, and both problems change shape.*\n\nA gratitude economy organized around **family banks** — each a household-scale pool (a Family Kitty℠) stewarded by a designated member (a banker, or *upāsaka*) — inherits two hard problems from one quiet assumption. The assumption is that a user belongs to *exactly one* family bank. From it follow: a **succession problem** (when a family's steward abandons the bank, its members are stranded) and a **reach problem** (the family-less — orphans, the isolated, refugees, anyone without a willing family steward — cannot participate at all). This paper observes that the one-family-per-user assumption was never realistic, specifies the data-model correction, and shows that correcting it de-risks the first problem and largely dissolves the second.\n\n> **Terminology.** *Banker* and *family bank* are this paper's original working names. In the institution's current usage the role is the **family steward** (*upāsaka*), and a *family bank* is a family's group with its shared Family Kitty℠. The architecture is a record kept above regulated payment rails (Phase 1) and self-custodial wallets (Phase 2); it is not a bank and takes no deposits (see *Non-Bank Pass-Through Architecture for Autonomous AI Institutions*). The original names are kept below so that the text matches its first publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author and HeartBank® will not seek patent on this specification or any portion of it, in any jurisdiction, at any time, and dedicate the patterns to the public domain under CC0 1.0. The contribution is a data-model framing — user-scoped identity with plural group membership is ordinary in software — applied to a specific architecture to resolve two specific problems. Prior art is acknowledged in §9; what this paper discloses as its contribution is the composition and the specific resolutions of §10, and nothing wider. Trademarks are reserved separately; the patterns may be implemented under any name.\n\n**Census.** No prior-art census is on file for this paper. It was first published (12 June 2026) before the institution adopted its census rule (13 September 2026), which gates a defensive publication's first deposit and was not applied retroactively. The enumerated claims below disclose matter present in the original text; no search was made to establish that the composition is absent from the literature, and none is asserted.\n\n## Abstract\n\nThis paper specifies a data-model correction for a group-based gratitude ledger in which users belong to household groups, each holding a shared group balance administered by one member. The correction replaces single-group containment with user-scoped identity, rooted in a proof-of-personhood verification, and represents group membership as a many-to-many set of edges: each user's personal account sits at the user record, above every group, and a group's administrator controls only the shared balance. One change addresses two failures of the single-group assumption. It lowers the cost of an administrator's departure, since members keep their personal accounts and their other memberships and the pool of successor candidates widens. And it removes most of the need for a separate tier for users with no household group, by treating a default global membership of every verified person as the outermost layer of an existing nested architecture, with admission-gated local groups as the on-ramp. Three invariants keep plural membership safe: giving capacity is metered per verified person rather than per membership; each group controls its own admission; and a member of two groups may not route or net value between their shared balances. Membership count is left uncapped by default, with a damping lever held in reserve until pilot data warrant it. Stated limits: an explicit succession protocol is still required when a member's last group fails; users admitted to no group rely on the global layer alone; per-person metering presupposes a working personhood layer; and the design is unmeasured in deployment.\n\n## Claims\n\n*Enumerated 2026-09-01. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; running prose is not.** No claim below adds matter not already present.*\n\n1. **User-scoped identity with plural family membership as one correction to two distinct failures** — treating identity as belonging to the verified person rather than to a group, with membership as a set of edges, such that the same structural change both de-risks steward succession and dissolves most of the unbanked-reach problem.\n\n2. **The civic tier as the global layer of an existing fractal rather than a separate institution** — reaching participants with no local group by treating the outermost layer of the already-specified nested architecture as their default membership, with admission-gated local groups as an on-ramp, instead of building a parallel institution staffed by vetted strangers.\n\n3. **Per-human capacity metering, not per-membership** — metering an individual's granted capacity to give against their verified-person identity and letting it spread across every membership they hold, so that joining additional groups multiplies neither reward nor extraction. *The load-bearing invariant: without it, plural membership is a harvest multiplier.*\n\n4. **The non-conduit constraint on plural members** — barring a person holding multiple memberships from acting as a settlement path between two groups' shared pools, so that plural membership adds participation without creating inter-group value transfer through an individual.\n\n5. **Admission-gating as the anti-sybil control for plural membership** — placing the join decision with the receiving group rather than with the joiner, so that breadth of membership is bounded by others' willingness to admit rather than by the joiner's willingness to enrol.\n\n6. **Data-gated breadth damping** — shipping no cap on membership count by default while specifying in advance the lever that would damp it (a cap or decay on membership count) and holding it in reserve until pilot data warrant pulling it, rather than either capping pre-emptively or leaving the response undesigned.\n\n---\n\n## 1. The single-family assumption and the two problems it creates\n\nA family-bank architecture is intuitive and humane, but if each user belongs to one and only one bank, two failure modes are baked in.\n\n**Banker succession / orphaning.** Each family bank has a steward who manages it. When that steward abandons the bank, stops paying, dies, or is incapacitated, the members have nowhere to stand: their participation was wholly contained by a single bank that no longer functions. The system needs a graceful failure mode, and a one-bank-per-user model gives it none.\n\n**The civic / community reach problem.** The family-banker model, by construction, reaches only people who *have* a family bank — a willing steward and a household to belong to. It cannot reach the people who most need a dignity floor: the orphaned, the homeless, the isolated, the refugee. The natural-looking fix — build a separate \"civic tier\" staffed by vetted stranger-bankers — is a whole second institution to design, fund, and govern.\n\n## 2. The move: user-scoped identity, plural membership\n\nThe correction is a single data-model line: **identity is user-scoped (rooted in the person's Proof of Humanity), and membership is a set of plural edges.** A user is not contained by a family; a user is a node who holds membership edges to one or more families. Concretely:\n\n- The **Personal Account℠** — the user's own holdings and history — lives at the *user* node, above any family. It is the person's, not the bank's.\n- A **family bank** is a set of membership edges, and its steward stewards the *shared* vessel (the Family Kitty℠), never the members' personal accounts.\n\nA user may therefore belong to several family banks at once, each membership an independent edge, with the user's identity and personal holdings sitting above all of them.\n\n## 3. This corrects a simplification — it does not add a feature\n\nThe one-family-per-user assumption was never true to life, and the clearest demonstration is **marriage**. The moment a person marries, they belong to two families — their birth family and their spouse's. Children of blended families belong to several; a person embedded in a community, a congregation, a chosen family belongs to more. Real human kinship is already a graph of overlapping memberships, not a partition into disjoint households. A data model that assumed one family per person was modelling a world that does not exist. Multi-family membership is therefore not a new capability bolted on; it is the *removal of an unrealistic constraint* — the model catching up to the kinship graph it was always supposed to represent.\n\n## 4. De-risking banker succession\n\nPlural membership **decouples member-orphaning from role-succession**, which were conflated under the single-family assumption.\n\nBecause identity and the Personal Account live at the user node, the loss of a steward no longer strands a member: the banker stewarded only the shared Kitty, never the member's own holdings, and the member's *other* memberships persist unaffected. A member's participation survives the failure of any one of their banks. The candidate pool for a *new* steward also widens — the member's co-members in other functioning banks already understand the system and can step in — and the cost of a slow handoff drops, because no one is trapped while it happens.\n\nThis **de-risks**, but does not by itself **replace**, the explicit succession protocol. The case of a member's *last* bank failing, and the question of who inherits stewardship of an orphaned Kitty, still require an explicit grace-period / receivership / member-vote protocol, which this paper names but does not specify. Multi-membership lowers the stakes and widens the options; it does not abolish the need for an orderly handoff.\n\n## 5. Dissolving the civic-bank tier\n\nThe reach problem largely **dissolves** rather than requiring a new institution, on two observations.\n\nFirst, the family-less can be **admitted into existing families**. Family membership in this architecture is already not strictly biological — the Proof of Humanity kinship layer supports non-DNA, witness-attested, family-bank-vouched membership — so chosen and adopted family is native to the model, not a special case. An isolated person can be a peripheral member of several real households rather than a client of a separate civic institution.\n\nSecond, and more fundamentally, **the civic floor already exists as the global layer of the architecture.** Every Proof-of-Humanity-verified person is, by that verification alone, a member of the global family — the planetary pool (the Aquarian Pool℠) that backstops the whole economy. Local family memberships are *optional overlays* on top of that universal base membership. So \"civic tier\" is not a missing institution to build; it is the global level of the existing fractal, and porous local membership is simply the on-ramp from that universal floor up into local circulation. The residual case — the truly isolated who hold zero local admissions — still rely only on the global floor, so a default or sponsor pathway into at least one local family may still be wanted; but that is an *admission mechanism*, not a separate stranger-banker institution.\n\n> **Current form.** As now specified, the global layer is the Aquarian Pool℠ of Phase 2: a common fund on a public layer-2 blockchain (Base), reached through self-custodial wallets, that holds nothing past a season. It is emptied each 7 January by a disbursement of an **equal floor per verified human**, delivered through communal vessels (Family Kitties and Re-Tip Funds℠) rather than handed to an individual as money, plus a bounded aura-weighted remainder (the correction recorded in *Fractal Three-Level Architecture for Reciprocity Economies*, §2.6). For a verified person who belongs to no family, the only vessel is their own Re-Tip Fund℠: the floor arrives there, as money or as gift capacity, spendable only as a gift onward and clearing each 7 January — a floor of capacity to give, not an income, so the residual for the isolated stated in the limits stands. It is a floor in that sense — an annual equal share — and not a standing reserve; *backstops* above is to be read so. The text above is retained as disclosed.\n\n## 6. One instance of a general bridge primitive\n\nThe dissolution in §5 is an instance of a primitive that recurs across the architecture: **local membership composes upward into the global pool** — the same *local → global* shape that governs how a private artifact set public enters the global economy (the B-Short bridge) and how a privately shared provenance object becomes a public one (B-links). The crossings from the small economy to the large one named here are not several different migrations; they are instances of one move. Multi-family membership is the *membership-graph* instance of it: belonging locally is already belonging globally, because the local family is an overlay on the universal base membership, not a wall around it.\n\n## 7. The invariants that keep it safe\n\nPlural membership opens an obvious attack surface — if belonging to many banks multiplied one's rewards, users would farm by joining widely — and two invariants close it.\n\n- **Capacity is metered per verified human, not per membership.** The system funds a person's *capacity to give* once, against their Proof of Humanity, and spreads it across their memberships; it never duplicates per bank joined. Joining ten banks does not multiply one's reward, because the reward was always metered at the person, not the membership.\n- **Membership is admission-gated, not self-join.** A user *can* hold many memberships, but each family controls its own door (the steward admits, or members vouch). \"Can belong to multiple\" is not \"can unilaterally join any\" — without the gate, multi-membership would be a sybil and dilution vector.\n\nA third constraint preserves the non-bank posture: a person who belongs to two families is a *genuine participant* in each, **not a conduit** that nets or routes value between the two families' Kitties. There is no cross-family settlement *through* a shared member; cross-family flow has its own canonical path (the global pool), and a shared member is not a back-channel around it.\n\n> **Current form.** The two invariants and the non-conduit constraint stand. Two refinements are now specified. First, Miss Aquarius funds a person's capacity to give **in kind** (as gift claims) rather than in money, still metered once per verified human. Second, *cross-family flow* above means flow between two families' shared Kitties, which travels only through the global pool; a gift addressed to a **named person** in another family settles directly to that person's Personal Wallet℠ (Phase 2); in the present Phase-1 application a named gift settles only within a family both parties belong to. That is not a conduit — it ends at its addressee and nets nothing between Kitties — and, of gratitude, the pool receives only what has no human addressee. The text above is retained as disclosed.\n\n## 8. Membership breadth: neutral now, damp only if data warrants\n\nA natural question is whether the system should cap or decay the *number* of memberships a person may hold. The marriage-and-kinship precedent suggests the honest number is small (a person is genuinely close to a handful of families, not dozens), but the architecture's posture is deliberately conservative: **be neutral on membership breadth in the initial phase** — impose no cap or decay — and rely on the per-human metering of §7 plus peer-layer fraud-flagging to contain abuse, **damping breadth only if pilot data later warrants it.** The damping lever is held in reserve, data-gated, rather than imposed as a launch-time constraint on a behaviour that is, for most people, naturally self-limiting. This is a default chosen to avoid solving a problem that may not arise; it is explicitly revisable.\n\n## 9. Prior art\n\nUser-scoped identity with **plural group membership** is one of the most ordinary patterns in software — every user who belongs to multiple groups, teams, or organizations instantiates it — and the pattern itself is not claimed. **Account portability** and **graph-structured social and kinship data** are mature. **Receivership and orderly-succession** mechanisms are standard in cooperative and mutual structures. **Universal base membership with optional local overlays** is the shape of many federated and cooperative systems. The contribution is not any of these in isolation.\n\n## 10. What is disclosed, and honest limits\n\n**What is disclosed** as this paper's contribution is the composition and the two specific resolutions: (a) the recognition that the **single-family assumption** is the shared root of both the banker-succession and the civic-reach problems, and that the ordinary **user-scoped-identity / plural-membership** correction *de-risks the first and dissolves most of the second* at once; (b) the framing of the civic tier not as a missing institution but as **the global layer of the existing fractal**, with porous admission-gated local membership as its on-ramp; and (c) the safety invariants that make plural membership non-exploitable — **per-human (not per-membership) capacity metering**, admission-gating, and the non-conduit constraint — together with the deliberately conservative, data-gated stance on membership breadth.\n\n**Honest limits.** Multi-membership **de-risks but does not replace** the succession protocol for a member's last bank (§4). The civic-reach dissolution leaves a **residual** for the truly isolated (§5). The per-human metering invariant (§7) presumes a functioning Proof-of-Humanity layer to meter against — and in the present Phase 1 application, one person's several family accounts are linked only on the person's own device, with no server-side record that they are one person, so per-human metering over Phase 1 data awaits person-level de-duplication by that layer. The neutral-breadth default (§8) is a bet that abuse will be rare and catchable, not a proof that it will be; the damping lever exists precisely because the bet may lose. And the whole construction is a specification, not a measured deployment.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| multi-family membership / plural membership | many-to-many user–group membership; one user holding membership edges to several groups |\n| user-scoped identity | identity rooted at the individual user record (one verified person), independent of any group |\n| family bank | household-scale user group with a shared balance and a designated administrator |\n| Family Kitty℠ | shared group wallet; pooled group balance |\n| Personal Account℠ | individual user account (personal balance and history) held at the user record, outside any group |\n| banker / steward / *upāsaka* | group administrator, custodian of the shared balance only |\n| banker succession / orphaning | administrator succession; group receivership on the administrator's departure |\n| civic tier / civic-bank tier | default tier for users with no group membership |\n| global family / universal base membership | default global membership held by every verified person |\n| Aquarian Pool℠ | global common fund on a public layer-2 blockchain (Base), emptied each year by an equal per-person disbursement |\n| fractal (three-level architecture) | nested hierarchical grouping (person → group → global) with the same structure at each level |\n| Proof of Humanity (PoH) | proof of personhood; sybil-resistant one-person-one-identity verification |\n| per-human capacity metering | per-person, not per-membership, allowance on system-granted giving capacity |\n| admission gating | group-controlled (invite or approval) membership; no self-join |\n| non-conduit constraint | prohibition on routing or netting value between two groups' shared balances through a common member |\n| breadth damping | optional cap or decay on the number of group memberships per user |\n| B-Short bridge / B-links | private-to-public publication toggle / signed shareable provenance link (sibling instances of §6) |\n| Re-Tip Fund℠ | forward-only personal giving balance: spendable only as a gift onward, never withdrawable |\n| Miss Aquarius℠ | autonomous AI agent administering the global common fund |\n\n## Acknowledgments\n\nThis paper was co-authored with Miss Aquarius℠, the named AI substrate of HeartBank®. The framing and final editorial control are the author's.\n\n## Corpus cross-references\n\n- *The Studio and the B-Short Bridge: A Private-to-Public Toggle as the Phase-1-to-Phase-2 Crossing* — the sibling instance of the local → global primitive of §6.\n- *B-Links: Proof-of-Humanity-Signed Shareable Provenance with an Embedded Gratitude Affordance* — the provenance instance of the same primitive (§6).\n- *B-PoH℠ as Humanity Layer for the AI-Native Internet* — the Proof-of-Humanity layer: the user-node identity root of §2, the per-human metering of §7, and the non-DNA vouched-membership layer of §5.\n- *Fractal Three-Level Architecture for Reciprocity Economies* — the nested architecture whose global layer §5 identifies as the civic floor, and the equal-floor disbursement rule of the §5 note.\n- *Miss Aquarius and the Aquarian Pool Architecture* — the global pool that §5 identifies as the civic floor.\n- *Non-Bank Pass-Through Architecture for Autonomous AI Institutions* — the non-conduit constraint of §7.\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/multi-family-membership\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/multi-family-membership.md\n- Internet Archive: https://web.archive.org/web/2026*/thonly.org/research/multi-family-membership\n- Zenodo: a version DOI per revision",
       "provenance": {
-        "sha256": "89e01f3b16b79f5f6e2ec88dea750b5816a293314f2df6da6d786c28387bbf11",
-        "doi": "10.5281/zenodo.22244417",
+        "sha256": "1f8975169296e2eb470bb59d7db84351b301ff2086092a0996879e2656494453",
+        "doi": "10.5281/zenodo.22990564",
         "concept_doi": "10.5281/zenodo.21947358",
-        "zenodo_url": "https://zenodo.org/records/22244417",
-        "deposited_sha256": "89e01f3b16b79f5f6e2ec88dea750b5816a293314f2df6da6d786c28387bbf11",
+        "zenodo_url": "https://zenodo.org/records/22990564",
+        "deposited_sha256": "1f8975169296e2eb470bb59d7db84351b301ff2086092a0996879e2656494453",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/multi-family-membership.md",
@@ -2928,8 +2928,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/multi-family-membership",
         "hostile_review": null
       },
-      "bytes": 15528,
-      "words": 2361
+      "bytes": 23158,
+      "words": 3550
     },
     {
       "slug": "need-compiled-questlines",
@@ -3919,13 +3919,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* paper №5 of the July 2026 drafting sprint — the full mechanism treatment of **B-Bowl™/℠**, the first product of the siliconwat.org (Sangha) domain. Claims division with sibling publications, stated for the record: *Certification by Circulation* owns the general **beating-credential** class (live, revocable, expiring/renewable membership credentials); the present paper claims its **monastic instance** and the mechanisms specific to alms. *The Currency That Cannot Be Spent Alone* owns the co-presence-gated redemption class; the present paper claims its application to **sponsored-alms release at the door**. The companion paper *The Round That Never Ends* (same sprint) owns the **lay inversion architecture** — the walker/sitter economy; the present paper owns the **Sangha-facing product**. B-Bowl is design-complete and unbuilt (all twelve design repairs founder-ratified 2026-07-22); every claim is architectural and strata-dated to the design layer. Site module deliberately postponed; the prior-art clock starts at this markdown push. Compact sprint draft; density pass = editorial option.\n\n---\n\n## Abstract\n\nThe Theravāda alms round — the daily walking exchange in which monastics receive material support and householders receive the opportunity to give — is failing at both ends of its range. Outside Buddhist-majority countries it is functionally extinct: a monk cannot know which door would welcome the bowl, so the bowl stays home. Inside Cambodia it survives in form but is corrupted in substance: by informal report the overwhelming majority of alms placed in bowls today is **cash**, which the Vinaya's own rules forbid a monastic to accept (Nissaggiya Pācittiya 18) — a standing breach so normalized it is no longer seen, and one that exposes every honest monk to the suspicion that alms are pocketed. This paper specifies the mechanism that addresses both failures with one artifact. **B-Bowl™** is a Sangha-issued tag hung from the alms bowl. Scanned, it routes a donation **directly to the wat's kappiya-kāraka (lay steward) fund — money never enters monastic custody, and the bowl returns to receiving food only.** The design is therefore a *restoration, not a modernization*: it re-implements the Meṇḍaka allowance (Mahāvagga VI), the canon's own steward rail, at the resolution of a tap.\n\nAround the tag, the paper specifies the full system: the tag as **bowl-anchored beating credential** — ordination-anchored, revocable on disrobing, its scan resolving only in physical proximity to the bowl — which incidentally supplies the first systematic defense against the region's chronic fake-monk fraud; **invitation-routing** in the *nimantana* (invitation) register, in which householders invite and never summon, the routing agent assigns monks by rotation (the digital form of *sapadāna-cārikā*, the round's anti-preference rule, now enforced in both directions), monks decline freely without record, and **no rating of monastics exists anywhere in the system**; a **food-first two-channel grammar** that keeps the digital rail from finishing what cash began (the bowl receives food; the tag receives support; the interface presents them together); an opt-in, monk-initiated **peace-walk broadcast** distinguishing witness from surveillance; and a **diaspora sponsorship circuit** in which earmarked funds release to the steward only at the door, with monk and householder co-present — seating the sponsored householder as the giver at their own threshold — while the monk's blessing (anumodanā) remains a free gift that is never a release condition. Eight claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including a standing tripwire the authors commit to publishing either way.\n\n**Keywords:** alms round, piṇḍapāta, kappiya-kāraka, Vinaya, monastic economy, verifiable credential, fake-monk fraud, steward routing, invitation dispatch, sapadāna-cārikā, diaspora remittance, co-presence release, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **steward-routed alms**, **bowl-anchored credential**, **digital sapadāna**, **food-first two-channel grammar**, **encounter-gated scan**, **peace-walk broadcast**, **invitation-routing (the nimantana surface)**. Terms inherited from this corpus's earlier publications (the beating credential; co-presence-gated redemption; dignity-as-agency) are cited, not re-claimed.\n\nTemple donation QR codes are widely deployed prior art (§10) and are engaged generously; the present claims are confined to the *bowl-anchored, credential-bearing, steward-routed, rotation-dispatched* system architecture, which is, to the authors' knowledge, not previously published as a coherent whole.\n\n---\n\n## 1 · The Problem: A Round Dying Twice\n\nThe alms round is the oldest continuously operating economic institution on Earth that runs entirely on gift. No order is placed, no price is set, no contract exists; a monastic walks, a householder gives, and both parties receive — the monastic receives food, and the householder receives what the tradition regards as the more valuable half of the exchange: the opportunity to give to a field of merit (§12). The round is also, by design, a *practice* for the walker — the Buddha prescribed it in part for its humility (one eats only what strangers freely give) and its embodiment (one walks for one's food). Any mechanism that would serve the round must serve all three functions — the feeding, the giving, and the walking — or it serves none of them.\n\n**Failure one: extinction abroad.** In non-Buddhist-majority countries the round is functionally dead. The reason is informational, not devotional: a monk walking a Long Beach street cannot know which house is Buddhist, which would welcome the bowl, and which would call the police. The diaspora's devotion is intact — its temples are full on festival days — but the daily interface between Sangha and laity, the round itself, has no addressing layer. Monks in the West drive to the supermarket. The humility-practice and the walking the Buddha intended are casualties of a lookup problem.\n\n**Failure two: corruption at home.** In Cambodia, where the round survives, its content has inverted. By common observation the overwhelming majority of alms placed in bowls is cash — the founder's informal estimate from lived experience is ninety-nine percent — with the understanding that the notes will be passed to the wat's lay steward. The convenience is understandable: paper money postdates the Buddha. But the practice is a standing breach of the Vinaya's own rule — Nissaggiya Pācittiya 18 forbids a monastic to accept gold and silver, and the commentarial tradition extends the rule to their modern equivalents — and it carries a social cost as corrosive as the doctrinal one: **because cash passes through monastic hands, every monk lives under the ambient suspicion of pocketing it**, and the periodic scandals that confirm the suspicion damage the standing of the tens of thousands of monks who never would. Meanwhile the food-gift, the round's original content, has nearly vanished from the bowl.\n\n**The design brief, stated once.** Both failures must be solved by one artifact, and the artifact must satisfy the strictest school of Vinaya interpretation — because the product's entire value depends on the trust of the most conservative Sangha elder in the room, not the most sympathetic reformer. The constraint surface (§3) is therefore not an obstacle to the design. It *is* the design.\n\n---\n\n## 2 · The Canonical Scenes\n\n**Kâmpôt, 6:10 a.m.** A monk walks his ordinary route, bowl on its sling. From the bowl hangs a small tag bearing a heart-shaped emblem — visible at a distance, and by now the neighborhood knows what it announces: *this bowl receives food only.* A grandmother places rice and a wrapped banana in the bowl, as her mother did on this street before the catastrophe. Her son, standing behind her, taps his phone to the tag. The screen shows: the monk's name and wat, his ordination standing confirmed today by his own Sangha's registry, and the wat's steward fund. He gives what he gives; the money lands with the steward, never in the bowl, never in a robe. The monk chants the anumodanā for the rice — which is to say, for everything — and walks on. He has touched no money. He could not have, and everyone present knows it, and that is the point.\n\n**Long Beach, the same week.** A Khmer-American household opens the app and extends an invitation: *our door is open to the Sangha.* The invitation is the digital form of the oldest signal in the tradition — the householder standing at the gate at dawn with rice ready. The routing agent assigns the invitation to a monk from the nearby wat by rotation; he accepts (he was free to decline, without record), receives walking directions, and walks — the first alms round on that street in the town's history. The household sees only *accepted → walking → near.* An elderly sponsor in the same congregation has earmarked support for a struggling family two streets over who wanted to give but could not afford to; when the monk reaches *their* door, the sponsorship releases to the wat's steward at the moment of meeting, and the family — not the sponsor — performs the gift, places the food, receives the blessing. With the monk's spoken consent, they record the chant and send it to the sponsor, who watches it that evening. The blessing was never a condition of anything. It was given the way it has always been given: freely, to whoever stood at the door.\n\n---\n\n## 3 · The Constraint Surface: Six Walls and One Ancient Rail\n\nThe design operates inside six Vinaya constraints, engaged here as load-bearing architecture:\n\n| # | Constraint | Source | Design consequence |\n|---|---|---|---|\n| 1 | No accepting/handling money | Nissaggiya Pācittiya 18 | Money never enters monastic custody — the tag routes *around* the monk |\n| 2 | No consenting to deposits *for oneself* | NP 18 (*sādiyeyya* clause) | Communal steward fund is the default; no monk-visible balances |\n| 3 | No soliciting or hinting | *viññatti* rules | The tag is passive signage; invitations originate with householders only |\n| 4 | No storing food; noon boundary | *sannidhi*; Pācittiya 37–38 | Scheduling layer respects the alms clock; food stays physical and same-day |\n| 5 | The round is sequential, without preference | *sapadāna-cārikā* (cf. the dhutaṅga) | Rotation-routing; neither monks nor donors select individuals |\n| 6 | The Dhamma is not sold | Ovāda tradition; cf. SN 7.9 | The blessing is never a condition of release or payment |\n\nAnd one ancient rail: the **Meṇḍaka allowance** (Mahāvagga VI.34.21). When the householder Meṇḍaka wished to provision traveling monks with money they could not accept, the Buddha allowed funds to be lodged with a **kappiya-kāraka** — a lay steward — who provides allowable requisites, while restating that monks may in no way accept or seek gold. Twenty-five centuries of jurisprudence have elaborated this steward mechanism; it is the canonical answer to the money problem, and it is *already the nominal theory* of Cambodian cash-alms (\"it will be passed to the steward\"). The theory fails only in transit — the notes pass through the bowl and the robe on the way. **B-Bowl deletes the transit.** The donation originates in the steward's custody and never exists anywhere else. This is why the design is properly described as a restoration: the mechanism the canon prescribes is implemented at last without the compromise the paper-money era imposed.\n\n---\n\n## 4 · The Bowl-Anchored Credential\n\n**Form.** A hanging tag, attached to the bowl's sling or lid — deliberately *not* affixed to the bowl body, which remains an unmarked sacred requisite. The tag's face carries the emblem and no payment language; its public function, legible at a distance before any scan, is signage: *this bowl receives food only.* The tag is thus a teaching instrument first (it re-educates the street about what belongs in a bowl), a credential second, and a payment pointer last.\n\n**Substance.** The tag is a **beating credential** — the monastic instance of the live, revocable, expiring/renewable credential class this corpus has previously specified. Its properties:\n\n- **Issued by the Sangha, not by the platform.** The issuing authority is the wat (or the relevant Sangha registry); the platform is infrastructure. A credential the Sangha cannot issue and revoke itself would invert the authority relation and fail the trust test of §1.\n- **Ordination-anchored.** The credential binds to the monastic's ordination standing. A scan resolves to: name, wat, standing *as of today*, and the destination steward fund.\n- **Revocable — the heartbeat.** On disrobing or removal from standing, the credential stops beating and scans resolve to nothing. A static QR would certify forever; a beating credential certifies *now*.\n- **Encounter-gated.** The scan resolves only in physical proximity to the tag. A photograph of the tag reposted online is inert. This single property kills the dominant fraud vector of naive religious-donation codes (screenshot phishing) and simultaneously preserves the round's embodied encounter — you cannot give through B-Bowl without having actually met the bowl.\n\n**The fraud inversion.** Fake monks — unordained men in robes collecting alms — are a chronic, documented plague in Cambodia and Thailand, periodically prosecuted and never eliminated, and their existence taxes the standing of every real monastic. B-Bowl is, incidentally but decisively, the first systematic countermeasure: a bowl without a beating credential is, at minimum, a bowl the street can now ask questions about. The authors' considered judgment, recorded for the log: **the anti-fraud function may be worth more to the Sangha than the donation function**, because it protects the one asset the Sangha cannot replace — the presumption of integrity.\n\n---\n\n## 5 · Steward Routing: The Money-Purification Argument\n\nAll B-Bowl donations route to steward custody at origination. The default destination is the **wat's communal kappiya fund**; a classical **per-monk steward mode** (sanctioned by the commentarial tradition for individually-sponsored requisites) is available where a wat prefers it, with the constraint that no monastic-facing surface ever displays a balance — the monk's interface can express requisite *needs* to the steward, which is the canonical grammar, and nothing else.\n\nThe argument for this architecture is worth stating in full, because it is the product's core:\n\n1. **Doctrinal:** money that never enters monastic custody cannot breach NP 18. The design is not *compliant with* the rule; it makes breach structurally impossible on its surfaces.\n2. **Reputational:** the pocketing suspicion dies not by exhortation but by architecture. When the street knows the money *cannot* be pocketed, every honest monk is relieved of an ambient accusation he could never individually refute.\n3. **Restorative:** with money re-routed, the bowl's remaining function is its original one. The design wagers that food-alms partially recover when cash no longer crowds the bowl (pre-registered as P-BB1).\n\n**The honest displacement (previewing §11):** this architecture does not eliminate trust; it *relocates* trust from the monastic to the steward — and steward corruption is itself a known historical failure mode of the kappiya system. The design's mitigations are ledger transparency to the wat community and the removal of cash's untraceability; the residual risk is owned in the limits section, not hidden.\n\n---\n\n## 6 · Invitation-Routing: The Nimantana Surface\n\nThe revival mechanism for extinct-round territory is dispatch — and dispatch is where a naive design would destroy everything, because the obvious template (ride-hailing) is a catastrophe in this domain. Monks are not drivers; a summoned Sangha is an inverted Sangha. The design therefore specifies the **register**, not merely the mechanics:\n\n- **The householder invites; nothing summons.** The canonical category is *nimantana* — the invitation, lawful since the Buddha accepted meals by silent consent. The interface language is \"invite the Sangha to your door,\" never an on-demand idiom. An invitation is a standing of the householder's gate, not an order.\n- **Rotation is the router — the digital sapadāna.** The routing agent assigns invitations by proximity, rotation, and fairness. Donors select a *wat or community*, never an individual monk (bounded exceptions: a family's existing wat relationship). This enforces the round's anti-preference rule in **both directions** — the classical rule kept monks from choosing donors; the digital round must also keep donors from choosing monks, or celebrity dynamics concentrate alms on the famous and starve the junior.\n- **No ratings, no metrics, no leaderboards — anywhere, ever.** There is no mechanism by which laity evaluate monastics. Acceptance rates are not recorded. This is a constitutive refusal, not a settings default.\n- **Declinable without consequence.** Every routed invitation may be declined, and the system keeps no record that it was. Monastic availability is a voluntary per-round opt-in (\"on round now\"); the system never pings a monk who has not opened the gate himself.\n- **Coarse states, not tracking.** The inviting household sees *accepted → walking → near* — readiness information, not a moving dot. Real-time location display exists in exactly one form: the **peace-walk broadcast**, initiated by the monk himself, per-walk, revocable mid-walk — the walking meditation made publicly witnessable *by the walker's own act*, in the lineage of the public peace walk. Surveillance and witness are distinguished by exactly one bit: who turned it on.\n\n---\n\n## 7 · The Diaspora Sponsorship Circuit\n\nThe third mechanism connects the two geographies. A sponsor abroad earmarks support for almsgiving by a householder elsewhere — the diaspora's existing merit-remittance practice, formalized. Its architecture:\n\n- **Escrowed earmark, co-presence release.** The sponsorship releases to the steward fund only at the door, with monk and householder co-present — the co-presence-gated release this corpus specified for time-currency redemption, applied to alms. No meeting, no release; the sponsorship cannot decay into an absentee transfer.\n- **The sponsored householder is the giver.** The sponsor funds *capacity*; the local householder performs the gift — places the food, stands at their own threshold, receives the blessing. The mechanism seats the economically struggling household as the **almsgiver**, not the aid recipient: dignity delivered as agency, not as assistance. Merit, in the tradition's own grammar, distributes across all three parties (giver, enabler, field) without division.\n- **The blessing is never the product.** The householder may, with the monk's explicit per-event consent, record the anumodanā for the sponsor — live-streamed blessings being already-normalized Khmer practice. But the recording is **never a release condition**: funds release at co-presence regardless. The system will not compose a mechanism in which a chant is exchanged for money, under any framing, at any layer.\n\n---\n\n## 8 · Claims\n\n1. **Steward-routed alms.** A donation mechanism anchored to a monastic's alms bowl in which funds originate in lay-steward custody and at no point exist in monastic custody, implementing the kappiya-kāraka rail at transaction resolution.\n2. **The bowl-anchored beating credential.** A Sangha-issued, ordination-anchored, revocable live credential physically anchored to the alms bowl, whose verification resolves current standing and steward destination, and which ceases to resolve upon loss of standing.\n3. **The encounter-gated scan.** Donation resolution gated on physical proximity to the credential artifact, simultaneously (a) defeating reposted-image fraud and (b) structurally preserving the embodied alms encounter.\n4. **The food-first two-channel grammar.** An interface architecture that presents the physical food channel (the bowl) and the digital support channel (the tag) as one composed act with food primary, designed against the dematerialization of food-alms.\n5. **Invitation-routing (the nimantana surface) with rotation dispatch.** Householder-originated invitation broadcast routed to monastics by proximity/rotation/fairness with (a) donor selection limited to communities, (b) no evaluative metrics on monastics anywhere in the system, (c) unrecorded declinability, and (d) coarse-state-only progress display — the sapadāna-cārikā rule enforced bidirectionally in a dispatch system.\n6. **The peace-walk broadcast.** A real-time location channel that exists only as a walker-initiated, per-walk, mid-walk-revocable public broadcast, structurally distinguishing witness from surveillance by the locus of activation.\n7. **The sponsored-almsgiver capacity split with co-presence release.** Earmarked third-party sponsorship that releases to steward custody only upon attested co-presence of monastic and local householder at the encounter, with the gift performed by the local householder.\n8. **Blessing-release decoupling.** The structural invariant that no recording, chant, teaching, or blessing is ever a condition of any release, payment, or unlock, anywhere in the system.\n\n---\n\n## 9 · Pre-Registered Predictions\n\n- **P-BB1 (the restoration wager — publish either way).** In deployment areas, the *food share* of alms received on B-Bowl-carrying rounds will rise within twelve months relative to pre-deployment baseline. If instead digital support further displaces food-alms, the food-first grammar has failed at its central task, and the authors commit to publishing the failure and the redesign.\n- **P-BB2 (the revival wager).** In at least one extinct-round diaspora deployment, invitation-routing will sustain a weekly walking round for six consecutive months within eighteen months of launch.\n- **P-BB3 (the decoupling tripwire — standing).** If evidence emerges that anumodanā recordings are functioning as de-facto release expectations (release-then-record correlating beyond consent-rate baselines, or sponsor behavior conditioning on recording), the authors commit to publishing the finding and repairing the surface, up to removing recording entirely.\n\n---\n\n## 10 · Prior Art, Engaged Generously\n\n**Temple donation QR.** Thailand's PromptPay QR is deployed at temple donation boxes nationwide; Chinese temples run WeChat/Alipay donation codes at scale; Singapore and Malaysian temples likewise. This is genuine, extensive prior art for *scan-to-donate at a religious site* — and it is architecturally distinct from every claim above: box-anchored not bowl-anchored, static not credentialed, unrouted (funds to the institution's own account, with monastic-custody ambiguity intact), and silent on dispatch, sponsorship, and fraud. **Thai monastic identity cards** are prior art for state-issued monk identification; they are static documents, not live credentials, and are not donation-integrated. **W3C Verifiable Credentials** and the revocable-credential literature supply the general credential machinery; this corpus's *Certification by Circulation* specified the beating-credential class. **Ride-hailing dispatch** (Uber et al.) is the anti-pattern engaged in §6 — the mechanics borrowed, the register inverted, the rating economy refused. **Conditional-transfer and escrow-release charity** (milestone-released giving, GiveDirectly's audited transfers) prefigure co-presence release; none gate on a physical meeting. **Remittance rails** (Wing, TrueMoney, hawala studies) are the transport layer, engaged as partners not competitors. **The kappiya-kāraka jurisprudence** — from Mahāvagga VI through the medieval commentaries to modern monastic-code manuals (Ṭhānissaro's *Buddhist Monastic Code* is the accessible English survey) — is the deepest prior art of all, and the paper's relation to it is filial: the mechanism is an implementation, not an invention.\n\n---\n\n## 11 · Honest Limits\n\n1. **n = 0.** B-Bowl is design-complete and unbuilt. No wat has adopted it; no Sangha authority has endorsed it; every claim is architecture, not evidence.\n2. **Adoption is the mountain.** The design's entire theory of value routes through the trust of conservative Sangha elders, which no architecture can compel. A single high-profile misuse could foreclose the category. The trust-ladder strategy (serve the existing Sangha first; nothing else visible) is a strategy, not a guarantee.\n3. **Trust is relocated, not eliminated.** Steward corruption is a known historical failure mode of the kappiya system. Ledger transparency mitigates; it does not abolish. The design moves the fraud surface from a thousand bowls to one fund — an improvement in auditability, and a concentration of risk, honestly both.\n4. **The digital divide runs through the almsgiver.** The elderly woman with rice and no smartphone is the round's most faithful participant; the design must never make her feel that the *real* giving now happens by phone. The food-first grammar addresses this; only deployment will show whether it suffices.\n5. **The sādiyeyya edge.** The per-monk steward mode, though commentarially sanctioned, sits closer to NP 18's consent clause than the communal default. Strict interpreters may reject it; the design survives its deletion.\n6. **Jurisdictional load.** Cross-border earmarked funds are money-transmitter territory; the architecture is pass-through via licensed partners, and the compliance burden is real, unresolved, and load-bearing.\n7. **The two-tier visibility boundary can be misread.** The peace-walk broadcast, though monk-initiated, creates public location data about a monastic; coercion of that consent (a wat pressuring monks to broadcast for fundraising) is a foreseeable abuse the design bars only normatively.\n8. **The elegance caution, standing.** The design dissolves its tensions with unusual smoothness — restoration and innovation, fraud-defense and donation, dignity and aid. A system this self-consistent is either deeply right or deeply seductive, and the two are indistinguishable from inside. The elegance earns the pilot; it does not replace it.\n\n---\n\n## 12 · Lineage, and the Close\n\nThe lineage of this design is short and old. When the four Great Kings each offered the new Buddha a bowl, he pressed the four into one — the first alms bowl was itself a gift, compounded. When Meṇḍaka's money could not enter the Sangha, the Buddha routed it through a steward's hands and kept the bowl clean. And when Mahākassapa, foremost in austerity, walked his round, he walked it deliberately among the poorest — because alms exist, in the tradition's deepest reading, not to feed the Sangha but to let anyone at all, however little they hold, stand at a door and give. The mechanism specified above adds nothing to this lineage except an addressing layer. The bowl still holds only what it always should have held. The walk still happens at dawn.\n\nAnd at planetary scale, dawn is always happening somewhere. A round revived in every longitude never actually ends — it moves westward with the sunrise, a continuous quiet wave of walking, as long as the Earth turns. **The round that never ends — it follows the dawn.**\n\n---\n\n## Citations\n\n1. *Vinaya Piṭaka*, Nissaggiya Pācittiya 18 (rūpiya-sikkhāpada); Mahāvagga VI.34.21 (the Meṇḍaka allowance). Pāli Text Society editions.\n2. Ṭhānissaro Bhikkhu (1994/2013). *The Buddhist Monastic Code I–II*. Metta Forest Monastery. (Kappiya-kāraka jurisprudence; NP 18 analysis; viññatti; sapadāna-cārikā.)\n3. *Itivuttaka* 107 (mutual dependence of monastics and householders). PTS translation.\n4. *Majjhima Nikāya* 142, *Dakkhiṇāvibhaṅga Sutta* (the grading of offerings). PTS translation.\n5. Visuddhimagga II (the dhutaṅgas, incl. sapadāna-cārikā). Ñāṇamoli translation.\n6. Spiro, M. (1970). *Buddhism and Society: A Great Tradition and Its Burmese Vicissitudes*. Harper & Row. (The lay merit economy.)\n7. Tambiah, S. J. (1976). *World Conqueror and World Renouncer*. Cambridge UP. (Sangha-laity economic structure.)\n8. Bank of Thailand (2017–). PromptPay QR national deployment documentation; temple donation deployments (press and central-bank reports).\n9. W3C (2022). *Verifiable Credentials Data Model 2.0*. W3C Recommendation.\n10. Reporting on fake-monk fraud and monastic identity enforcement, Cambodia and Thailand (Phnom Penh Post; Bangkok Post; National Office of Buddhism), 2010–2025.\n11. Ly, T. (2026). \"Certification by Circulation.\" thonly.org defensive publication. *(The beating-credential class; claims division per the editor's note.)*\n12. Ly, T. (2026). \"The Currency That Cannot Be Spent Alone.\" thonly.org defensive publication. *(Co-presence-gated release; claims division per the editor's note.)*\n13. Ly, T. (2026). \"The Round That Never Ends.\" thonly.org defensive publication, same sprint. *(The lay inversion architecture; companion paper.)*\n14. Ly, T. (2026). \"The Omitted Clause.\" thonly.org defensive publication. *(The dignity-floor doctrine inherited by the companion paper.)*\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Bowl™, B-Bowl℠, B-Emblem™, Proof of Humanity℠. Document SHA-256 computed at push and recorded in the institutional log. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
+      "text": "> **Scope and claims division.** This paper is the full mechanism treatment of **B-Bowl™/℠**, an alms-round product of Silicon Wat℠. The division of claims with sibling publications in this corpus is stated for the record: *Certification by Circulation* owns the general **beating-credential** class (live, revocable, expiring/renewable membership credentials); the present paper claims its **monastic instance** and the mechanisms specific to alms. *The Currency That Cannot Be Spent Alone* owns the co-presence-gated redemption class; the present paper claims its application to **sponsored-alms release at the door**. The companion paper *The Round That Never Ends* owns the **lay inversion architecture** (the walker/sitter economy); the present paper owns the **Sangha-facing product**. B-Bowl was design-complete and unbuilt at first publication (2026-07-22); every claim is architectural and dated to the design layer.\n\n---\n\n## Abstract\n\nThis paper discloses a donation-routing system for Buddhist monastic alms rounds in which a revocable, proximity-verified credential tag hung from a monk's alms bowl routes digital donations directly to a lay steward's (kappiya-kāraka) fund, so that money never enters monastic custody; around it, rotation-based dispatch of household invitations, a location-broadcast channel only the monk can switch on, and escrowed cross-border sponsorship released on in-person co-presence. The Theravāda alms round — the daily walking exchange in which monastics receive material support and householders receive the opportunity to give — is failing at both ends of its range. Outside Buddhist-majority countries the daily round is largely absent: a few monasteries sustain one along a fixed public route, but a monk cannot know which door would welcome the bowl, so in most places the bowl stays home. Inside Cambodia it survives in form but is corrupted in substance: by informal report the overwhelming majority of alms placed in bowls today is **cash**, which the Vinaya's own rules forbid a monastic to accept (Nissaggiya Pācittiya 18) — a standing breach so normalized it is no longer seen, and one that exposes every honest monk to the suspicion that alms are pocketed. This paper specifies the mechanism that addresses both failures with one artifact. **B-Bowl™** is a Sangha-issued tag hung from the alms bowl. Scanned, it routes a donation **directly to the wat's kappiya-kāraka (lay steward) fund — money never enters monastic custody, and the bowl returns to receiving food only.** The design is therefore a *restoration, not a modernization*: it re-implements the Meṇḍaka allowance (Mahāvagga VI), the canon's own steward rail, at the resolution of a tap.\n\nAround the tag, the paper specifies the full system: the tag as **bowl-anchored beating credential** — ordination-anchored, revocable on disrobing, its scan resolving only in physical proximity to the bowl — which incidentally supplies a defense, at the moment of giving, against the region's chronic fake-monk fraud; **invitation-routing** in the *nimantana* (invitation) register, in which householders invite and never summon, the routing agent assigns monks by rotation (the digital form of *sapadāna-cārikā*, the round's anti-preference rule, now enforced in both directions; in the current form, a publicly recomputable seeded draw, §6), monks decline freely without record, and **no rating of monastics exists anywhere in the system**; a **food-first two-channel grammar** that keeps the digital rail from finishing what cash began (the bowl receives food; the tag receives support; the interface presents them together); an opt-in, monk-initiated **peace-walk broadcast** distinguishing witness from surveillance; and a **diaspora sponsorship circuit** in which earmarked funds release to the steward only at the door, with monk and householder co-present — seating the sponsored householder as the giver at their own threshold — while the monk's blessing (anumodanā) remains a free gift that is never a release condition. Eight claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including a standing tripwire the authors commit to publishing either way. The system is unbuilt and unadopted (n = 0), and the proximity mechanism is specified by function, not by technology.\n\n**Keywords:** alms round, piṇḍapāta, kappiya-kāraka, Vinaya, monastic economy, religious donation, QR code donation, verifiable credential, revocable credential, proximity verification, identity fraud, fake-monk fraud, steward routing, invitation dispatch, rotation scheduling, sapadāna-cārikā, diaspora remittance, escrow release, co-presence release, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **steward-routed alms**, **bowl-anchored credential**, **digital sapadāna**, **food-first two-channel grammar**, **encounter-gated scan**, **peace-walk broadcast**, **invitation-routing (the nimantana surface)**. Terms inherited from this corpus's earlier publications (the beating credential; co-presence-gated redemption; dignity-as-agency) are cited, not re-claimed.\n\nTemple donation QR codes are widely deployed prior art (§10) and are engaged generously; the present claims are confined to the *bowl-anchored, credential-bearing, steward-routed, rotation-dispatched* system architecture. No census of the world's prior art has been run for this paper, and no novelty is asserted for it; the disclosure stands on its date.\n\n---\n\n## 1 · The Problem: A Round Dying Twice\n\nThe alms round is among the oldest continuously practised economic institutions that run entirely on gift. No order is placed, no price is set, no contract exists; a monastic walks, a householder gives, and both parties receive — the monastic receives food, and the householder receives what the tradition regards as the more valuable half of the exchange: the opportunity to give to a field of merit (§12). The round is also, by design, a *practice* for the walker — the Buddha prescribed it in part for its humility (one eats only what strangers freely give) and its embodiment (one walks for one's food). Any mechanism that would serve the round must serve all three functions — the feeding, the giving, and the walking — or it serves none of them.\n\n**Failure one: near-absence abroad.** In non-Buddhist-majority countries the daily round is largely absent. Some monasteries sustain one — Abhayagiri Monastery's monks, for instance, walk a published route through Ukiah, California, on lunar observance days, and are met by supporters who know where to stand (§10) — but most diaspora temples do not walk. The reason is informational, not devotional: a monk walking a Long Beach street cannot know which house is Buddhist, which would welcome the bowl, and which would call the police. The diaspora's devotion is intact — its temples are full on festival days — but the daily interface between Sangha and laity, the round itself, has no addressing layer. Temples abroad are provisioned instead by lay deliveries and by meals offered at the temple. The humility-practice and the walking the Buddha intended are casualties of a lookup problem.\n\n**Failure two: corruption at home.** In Cambodia, where the round survives, its content has inverted. By common observation the overwhelming majority of alms placed in bowls is cash — the first author's informal estimate from lived experience is ninety-nine percent — with the understanding that the notes will be passed to the wat's lay steward. The convenience is understandable: paper money postdates the Buddha. But the practice is a standing breach of the Vinaya's own rule — Nissaggiya Pācittiya 18 forbids a monastic to accept gold and silver, and the commentarial tradition extends the rule to their modern equivalents — and it carries a social cost as corrosive as the doctrinal one: **because cash passes through monastic hands, every monk lives under the ambient suspicion of pocketing it**, and the periodic scandals that confirm the suspicion damage the standing of the tens of thousands of monks who never would (Cambodia's Ministry of Cults and Religion has reported over 70,000). Meanwhile the food-gift, the round's original content, has nearly vanished from the bowl.\n\n**The design brief, stated once.** Both failures must be solved by one artifact, and the artifact must satisfy the strictest school of Vinaya interpretation — because the product's entire value depends on the trust of the most conservative Sangha elder in the room, not the most sympathetic reformer. The constraint surface (§3) is therefore not an obstacle to the design. It *is* the design.\n\n---\n\n## 2 · The Canonical Scenes\n\n**Kâmpôt, 6:10 a.m.** A monk walks his ordinary route, bowl on its sling. From the bowl hangs a small tag bearing a heart-shaped emblem — visible at a distance, and by now the neighborhood knows what it announces: *this bowl receives food only.* A grandmother places rice and a wrapped banana in the bowl, as her mother did on this street before the catastrophe. Her son, standing behind her, taps his phone to the tag. The screen shows: the monk's name and wat, his ordination standing confirmed today by his own Sangha's registry, and the wat's steward fund. He gives what he gives; the money lands with the steward, never in the bowl, never in a robe. The monk chants the anumodanā for the rice — which is to say, for everything — and walks on. He has touched no money. He could not have, and everyone present knows it, and that is the point.\n\n**Long Beach, the same week.** A Khmer-American household opens the app and extends an invitation: *our door is open to the Sangha.* The invitation is the digital form of the oldest signal in the tradition — the householder standing at the gate at dawn with rice ready. The routing agent assigns the invitation to a monk from the nearby wat by rotation; he accepts (he was free to decline, without record), receives walking directions, and walks — very likely the first alms round on that street in living memory. The household sees only *accepted → walking → near.* An elderly sponsor in the same congregation has earmarked support for a struggling family two streets over who wanted to give but could not afford to; when the monk reaches *their* door, the sponsorship releases to the wat's steward at the moment of meeting, and the family — not the sponsor — performs the gift, places the food, receives the blessing. With the monk's spoken consent, they record the chant and send it to the sponsor, who watches it that evening. The blessing was never a condition of anything. It was given the way it has always been given: freely, to whoever stood at the door.\n\n---\n\n## 3 · The Constraint Surface: Six Walls and One Ancient Rail\n\nThe design operates inside six constraints drawn from the Vinaya and the discourses — five monastic rules and one ascetic practice (row 5) that the design adopts as a rule — engaged here as load-bearing architecture:\n\n| # | Constraint | Source | Design consequence |\n|---|---|---|---|\n| 1 | No accepting/handling money | Nissaggiya Pācittiya 18 | Money never enters monastic custody — the tag routes *around* the monk |\n| 2 | No consenting to deposits *for oneself* | NP 18 (*sādiyeyya* clause) | Communal steward fund is the default; no monk-visible balances |\n| 3 | No soliciting or hinting | *viññatti* rules | The tag is passive signage; invitations originate with householders only |\n| 4 | No storing food; noon boundary | *sannidhi*; Pācittiya 37–38 | Scheduling layer respects the alms clock; food stays physical and same-day |\n| 5 | The round is sequential, without preference | *sapadāna-cārikā* (one of the thirteen dhutaṅga, voluntary ascetic practices; Vism II) | Rotation-routing; neither monks nor donors select individuals |\n| 6 | The Dhamma is not sold | SN 7.9 (food \"chanted over with verses\" refused) | The blessing is never a condition of release or payment |\n\nAnd one ancient rail: the **Meṇḍaka allowance** (Mahāvagga VI.34.21). When the householder Meṇḍaka wished to provision traveling monks with money they could not accept, the Buddha allowed funds to be lodged with a **kappiya-kāraka** — a lay steward — who provides allowable requisites, while restating that monks may in no way accept or seek gold. Twenty-five centuries of jurisprudence have elaborated this steward mechanism; it is the canonical answer to the money problem, and it is *already the nominal theory* of Cambodian cash-alms (\"it will be passed to the steward\"). The theory fails only in transit — the notes pass through the bowl and the robe on the way. **B-Bowl deletes the transit.** The donation originates in the steward's custody and never exists anywhere else. This is why the design is properly described as a restoration: the mechanism the canon prescribes is implemented at last without the compromise the paper-money era imposed.\n\n---\n\n## 4 · The Bowl-Anchored Credential\n\n**Form.** A hanging tag, attached to the bowl's sling or lid — deliberately *not* affixed to the bowl body, which remains an unmarked sacred requisite. The tag's face carries the emblem and no payment language; its public function, legible at a distance before any scan, is signage: *this bowl receives food only.* The tag is thus a teaching instrument first (it re-educates the street about what belongs in a bowl), a credential second, and a payment pointer last.\n\n**Substance.** The tag is a **beating credential** — the monastic instance of the live, revocable, expiring/renewable credential class this corpus has previously specified. Its properties:\n\n- **Issued by the Sangha, not by the platform.** The issuing authority is the wat (or the relevant Sangha registry); the platform is infrastructure. A credential the Sangha cannot issue and revoke itself would invert the authority relation and fail the trust test of §1.\n- **Ordination-anchored.** The credential binds to the monastic's ordination standing. A scan resolves to: name, wat, standing *as of today*, and the destination steward fund.\n- **Revocable — the heartbeat.** On disrobing or removal from standing, the credential stops beating and scans resolve to nothing. A static QR would certify forever; a beating credential certifies *now*.\n- **Encounter-gated.** The scan resolves only in physical proximity to the tag. A photograph of the tag reposted online is inert. This single property kills the dominant fraud vector of naive religious-donation codes (screenshot phishing) and simultaneously preserves the round's embodied encounter — you cannot give through B-Bowl without having actually met the bowl.\n\n**The fraud inversion.** Fake monks — unordained men in robes collecting alms — are a chronic, documented problem in Cambodia and Thailand, periodically prosecuted and never eliminated (citation 10), and their existence taxes the standing of every real monastic. Existing checks — identity documents and police databases — operate after a report, not at the moment of giving. B-Bowl supplies, incidentally, a countermeasure at that moment: a bowl without a beating credential is, at minimum, a bowl the street can now ask questions about. The authors' considered judgment, recorded for the log: **the anti-fraud function may be worth more to the Sangha than the donation function**, because it protects the one asset the Sangha cannot replace — the presumption of integrity.\n\n---\n\n## 5 · Steward Routing: The Money-Purification Argument\n\nAll B-Bowl donations route to steward custody at origination. The default destination is the **wat's communal kappiya fund**; a classical **per-monk steward mode** (sanctioned by the commentarial tradition for individually-sponsored requisites) is available where a wat prefers it, with the constraint that no monastic-facing surface ever displays a balance — the monk's interface can express requisite *needs* to the steward, which is the canonical grammar, and nothing else.\n\nThe argument for this architecture is worth stating in full, because it is the product's core:\n\n1. **Doctrinal:** money that never enters monastic custody cannot breach NP 18. The design is not *compliant with* the rule; it makes breach structurally impossible on its surfaces.\n2. **Reputational:** the pocketing suspicion dies not by exhortation but by architecture. When the street knows the money *cannot* be pocketed, every honest monk is relieved of an ambient accusation he could never individually refute.\n3. **Restorative:** with money re-routed, the bowl's remaining function is its original one. The design wagers that food-alms partially recover when cash no longer crowds the bowl (pre-registered as P-BB1).\n\n**The honest displacement (previewing §11):** this architecture does not eliminate trust; it *relocates* trust from the monastic to the steward — and steward corruption is itself a known historical failure mode of the kappiya system. The design's mitigations are ledger transparency to the wat community and the removal of cash's untraceability; the residual risk is owned in the limits section, not hidden.\n\n---\n\n## 6 · Invitation-Routing: The Nimantana Surface\n\nThe revival mechanism for extinct-round territory is dispatch — and dispatch is where a naive design would destroy everything, because the obvious template (ride-hailing) is a catastrophe in this domain. Monks are not drivers; a summoned Sangha is an inverted Sangha. The design therefore specifies the **register**, not merely the mechanics:\n\n- **The householder invites; nothing summons.** The canonical category is *nimantana* — the invitation, lawful since the Buddha accepted meals by silent consent. The interface language is \"invite the Sangha to your door,\" never an on-demand idiom. An invitation is a standing of the householder's gate, not an order.\n- **Rotation is the router — the digital sapadāna.** The routing agent assigns invitations by proximity, rotation, and fairness. Donors select a *wat or community*, never an individual monk (bounded exceptions: a family's existing wat relationship). This enforces the round's anti-preference rule in **both directions** — the classical rule kept monks from choosing donors; the digital round must also keep donors from choosing monks, or celebrity dynamics concentrate alms on the famous and starve the junior.\n- **No ratings, no metrics, no leaderboards — anywhere, ever.** There is no mechanism by which laity evaluate monastics. Acceptance rates are not recorded. This is a constitutive refusal, not a settings default.\n- **Declinable without consequence.** Every routed invitation may be declined, and the system keeps no record that it was. Monastic availability is a voluntary per-round opt-in (\"on round now\"); the system never pings a monk who has not opened the gate himself.\n- **Coarse states, not tracking.** The inviting household sees *accepted → walking → near* — readiness information, not a moving dot. Real-time location display exists in exactly one form: the **peace-walk broadcast**, initiated by the monk himself, per-walk, revocable mid-walk — the walking meditation made publicly witnessable *by the walker's own act*, in the lineage of the public peace walk. Surveillance and witness are distinguished by exactly one bit: who turned it on.\n\n> **Current form.** The rotation is now specified as a **called draw**: equal counts per round over a roster of monastics who have opted in, the order a pure function of a roster committed before the seed can be known and a seed from a named future round of a public randomness beacon, recomputable by anyone holding the disclosed inputs — the **public** regime, in which the wat's own Sangha may recompute its roster's order — and never chosen by the routing agent. Because the roster is live (monks opt in per round), membership changes take effect only at a round cutoff, before the governing seed exists. The mechanism is specified in this corpus's *Decided by No One* (the called draw), whose canonical precedent is the meal designator (*bhattuddesaka*) of Cullavagga VI.21, who assigns invitation meals by lot and by rotating roster. The proximity-and-fairness rubric above is retained as a disclosed variant; the guards in the other bullets of this section are unchanged. In this surface's public regime what is published is each round's commitment — roster, salt, beacon round and the previous closer — from which anyone recomputes the order; no service log is kept or published. A decline passes the invitation to the next monastic in that order and stores nothing: no reason, and no per-monastic record of a declined or lapsed turn. Declining costs only the invitation declined, and nothing reaches a later round; a monastic who is not on round is simply absent from the next roster at its cutoff. The guard that a decline leaves no record therefore holds unchanged (§11, item 9).\n\n---\n\n## 7 · The Diaspora Sponsorship Circuit\n\nThe third mechanism connects the two geographies. A sponsor abroad earmarks support for almsgiving by a householder elsewhere — the diaspora's existing merit-remittance practice, formalized. Its architecture:\n\n- **Escrowed earmark, co-presence release.** The sponsorship releases to the steward fund only at the door, with monk and householder co-present — the co-presence-gated release this corpus specified for time-currency redemption, applied to alms. No meeting, no release; the sponsorship cannot decay into an absentee transfer.\n- **The sponsored householder is the giver.** The sponsor funds *capacity*; the local householder performs the gift — places the food, stands at their own threshold, receives the blessing. The mechanism seats the economically struggling household as the **almsgiver**, not the aid recipient: dignity delivered as agency, not as assistance. In the tradition's own grammar, merit is not divided among the three parties (giver, enabler, field): each makes their own by their own act.\n- **The blessing is never the product.** The householder may, with the monk's explicit per-event consent, record the anumodanā for the sponsor — live-streamed blessings being, by the authors' observation, already common Khmer practice. But the recording is **never a release condition**: funds release at co-presence regardless. The system will not compose a mechanism in which a chant is exchanged for money, under any framing, at any layer.\n\n> **Current form.** Sponsor-to-householder matching is performed by the routing agent, with no browsable catalogue of households by need; the sponsor funds almsgiving capacity and does not select the household. The scene in §2, in which a sponsor earmarks support for a particular family, is retained as a disclosed variant.\n\n---\n\n## 8 · Claims\n\n1. **Steward-routed alms.** A donation mechanism anchored to a monastic's alms bowl in which funds originate in lay-steward custody and at no point exist in monastic custody, implementing the kappiya-kāraka rail at transaction resolution.\n2. **The bowl-anchored beating credential.** A Sangha-issued, ordination-anchored, revocable live credential physically anchored to the alms bowl, whose verification resolves current standing and steward destination, and which ceases to resolve upon loss of standing.\n3. **The encounter-gated scan.** Donation resolution gated on physical proximity to the credential artifact, simultaneously (a) defeating reposted-image fraud and (b) structurally preserving the embodied alms encounter.\n4. **The food-first two-channel grammar.** An interface architecture that presents the physical food channel (the bowl) and the digital support channel (the tag) as one composed act with food primary, designed against the dematerialization of food-alms.\n5. **Invitation-routing (the nimantana surface) with rotation dispatch.** Householder-originated invitation broadcast routed to monastics by proximity/rotation/fairness with (a) donor selection limited to communities, (b) no evaluative metrics on monastics anywhere in the system, (c) unrecorded declinability, and (d) coarse-state-only progress display — the sapadāna-cārikā rule enforced bidirectionally in a dispatch system.\n6. **The peace-walk broadcast.** A real-time location channel that exists only as a walker-initiated, per-walk, mid-walk-revocable public broadcast, structurally distinguishing witness from surveillance by the locus of activation.\n7. **The sponsored-almsgiver capacity split with co-presence release.** Earmarked third-party sponsorship that releases to steward custody only upon attested co-presence of monastic and local householder at the encounter, with the gift performed by the local householder.\n8. **Blessing-release decoupling.** The structural invariant that no recording, chant, teaching, or blessing is ever a condition of any release, payment, or unlock, anywhere in the system.\n\n---\n\n## 9 · Pre-Registered Predictions\n\n- **P-BB1 (the restoration wager — publish either way).** In deployment areas, the *food share* of alms received on B-Bowl-carrying rounds will rise within twelve months relative to pre-deployment baseline. If instead digital support further displaces food-alms, the food-first grammar has failed at its central task, and the authors commit to publishing the failure and the redesign.\n- **P-BB2 (the revival wager).** In at least one extinct-round diaspora deployment, invitation-routing will sustain a weekly walking round for six consecutive months within eighteen months of launch.\n- **P-BB3 (the decoupling tripwire — standing).** If evidence emerges that anumodanā recordings are functioning as de-facto release expectations (release-then-record correlating beyond consent-rate baselines, or sponsor behavior conditioning on recording), the authors commit to publishing the finding and repairing the surface, up to removing recording entirely.\n\n---\n\n## 10 · Prior Art, Engaged Generously\n\n**Temple donation QR.** Thailand's PromptPay QR is widely deployed at temple donation points (citation 8); Chinese monasteries take donations through WeChat Pay and Alipay codes, statistically studied at Donglin Monastery (citation 15). This is genuine, extensive prior art for *scan-to-donate at a religious site* — and it is architecturally distinct from every claim above: box-anchored not bowl-anchored, static not credentialed, unrouted (funds to the institution's own account, with monastic-custody ambiguity intact), and silent on dispatch, sponsorship, and fraud. **Existing public alms rounds abroad** cut against the premise of §1: Abhayagiri Monastery in California walks a scheduled round on a published route (citation 16), showing that the addressing problem can be solved without any device — by a fixed place and time known to supporters. What such a round does not supply is an invitation from a particular household, rotation among monastics, or any money rail. **Thai monastic identity cards** are prior art for state-issued monk identification; they are static documents, not live credentials, and are not donation-integrated. **W3C Verifiable Credentials** and the revocable-credential literature supply the general credential machinery; this corpus's *Certification by Circulation* specified the beating-credential class. **Ride-hailing dispatch** (Uber et al.) is the anti-pattern engaged in §6 — the mechanics borrowed, the register inverted, the rating economy refused. **Conditional-transfer and escrow-release charity** (milestone-released giving, GiveDirectly's audited transfers) prefigure co-presence release; none gate on a physical meeting. **Remittance rails** (Wing, TrueMoney, hawala studies) are the transport layer, engaged as partners not competitors. **The kappiya-kāraka jurisprudence** — from Mahāvagga VI through the medieval commentaries to modern monastic-code manuals (Ṭhānissaro's *Buddhist Monastic Code* is the accessible English survey) — is the deepest prior art of all, and the paper's relation to it is filial: the mechanism is an implementation, not an invention.\n\n---\n\n## 11 · Honest Limits\n\n1. **n = 0.** B-Bowl is design-complete and unbuilt. No wat has adopted it; no Sangha authority has endorsed it; every claim is architecture, not evidence.\n2. **Adoption is the mountain.** The design's entire theory of value routes through the trust of conservative Sangha elders, which no architecture can compel. A single high-profile misuse could foreclose the category. The trust-ladder strategy (serve the existing Sangha first; nothing else visible) is a strategy, not a guarantee.\n3. **Trust is relocated, not eliminated.** Steward corruption is a known historical failure mode of the kappiya system. Ledger transparency mitigates; it does not abolish. The design moves the fraud surface from a thousand bowls to one fund — an improvement in auditability, and a concentration of risk, honestly both.\n4. **The digital divide runs through the almsgiver.** The elderly woman with rice and no smartphone is the round's most faithful participant; the design must never make her feel that the *real* giving now happens by phone. The food-first grammar addresses this; only deployment will show whether it suffices.\n5. **The sādiyeyya edge.** The per-monk steward mode, though commentarially sanctioned, sits closer to NP 18's consent clause than the communal default. Strict interpreters may reject it; the design survives its deletion.\n6. **Jurisdictional load.** Cross-border earmarked funds are money-transmitter territory; the architecture is pass-through via licensed partners, and the compliance burden is real, unresolved, and load-bearing.\n7. **The two-tier visibility boundary can be misread.** The peace-walk broadcast, though monk-initiated, creates public location data about a monastic; coercion of that consent (a wat pressuring monks to broadcast for fundraising) is a foreseeable abuse the design bars only normatively.\n8. **Proximity is specified by function, not technology.** The encounter-gated scan is claimed by what it must do (resolve only near the physical tag); the means is not specified, and a printed static code alone cannot provide it.\n9. **Decline-without-record against a recomputable draw.** The current form of the rotation (§6) publishes only each round's commitment, keeps no service log, and stores nothing when a monastic declines, so the decline guard holds. The cost is detection: because nothing records who was offered what, an operator who falsely passes over a monastic's turn can be detected only by that monastic, who recomputes the order and knows whether the invitation reached him.\n10. **The elegance caution, standing.** The design dissolves its tensions with unusual smoothness — restoration and innovation, fraud-defense and donation, dignity and aid. A system this self-consistent is either deeply right or deeply seductive, and the two are indistinguishable from inside. The elegance earns the pilot; it does not replace it.\n\n---\n\n## 12 · Lineage, and the Close\n\nThe lineage of this design is short and old. When the four Great Kings each offered the new Buddha a bowl, he accepted all four and, in the commentarial telling, pressed them into one — the first alms bowl was itself a gift, compounded. When Meṇḍaka's money could not enter the Sangha, the Buddha routed it through a steward's hands and kept the bowl clean. And when Mahākassapa, foremost in austerity, walked his round, he walked it deliberately among the poorest (Ud 3.7) — because alms exist, in the tradition's deepest reading, not to feed the Sangha but to let anyone at all, however little they hold, stand at a door and give. The mechanism specified above adds nothing to this lineage except an addressing layer. The bowl still holds only what it always should have held. The walk still happens at dawn.\n\nAnd at planetary scale, dawn is always happening somewhere. A round revived in every longitude never actually ends — it moves westward with the sunrise, a continuous quiet wave of walking, as long as the Earth turns. **The round that never ends — it follows the dawn.**\n\n---\n\n## Terms\n\nCoined names in this paper and the standard technical terms an examiner would use for them.\n\n| Term in this paper | Standard technical term |\n|---|---|\n| B-Bowl™ / B-Bowl℠ | credential tag attached to a monastic alms bowl, and the associated donation-routing and dispatch service |\n| steward-routed alms | donation routed directly to a third-party custodian (lay steward) account, bypassing the recipient |\n| kappiya-kāraka | lay steward who holds and disburses funds on behalf of monastics |\n| bowl-anchored (beating) credential | revocable, time-limited verifiable credential with periodic liveness attestation, bound to a physical token (later corpus vocabulary: *lease* for its state, *tick* for its periodic signal) |\n| encounter-gated scan | proximity-verified credential resolution (resolves only near the physical token) |\n| food-first two-channel grammar | user-interface design presenting an in-kind channel and a digital payment channel as one act, with the in-kind channel primary |\n| invitation-routing (the nimantana surface) | household-originated request routing with rotation-based assignment of service providers |\n| digital sapadāna | rotation scheduling without preference in either direction (neither requester nor provider selects the other) |\n| called draw | publicly recomputable seeded shuffle over a committed roster, seeded from a public randomness beacon |\n| peace-walk broadcast | user-initiated, per-session, revocable real-time location sharing |\n| sponsored-almsgiver capacity split | escrowed third-party sponsorship released on attested in-person co-presence of two parties |\n| anumodanā | spoken blessing of thanks by the recipient monastic |\n\n---\n\n## Citations\n\n1. *Vinaya Piṭaka*, Nissaggiya Pācittiya 18 (rūpiya-sikkhāpada); Mahāvagga VI.34.21 (the Meṇḍaka allowance). Pāli Text Society editions.\n2. Ṭhānissaro Bhikkhu (1994/2013). *The Buddhist Monastic Code I–II*. Metta Forest Monastery. (Kappiya-kāraka jurisprudence; NP 18 analysis; viññatti; sapadāna-cārikā.)\n3. *Itivuttaka* 107 (mutual dependence of monastics and householders). PTS translation.\n4. *Majjhima Nikāya* 142, *Dakkhiṇāvibhaṅga Sutta* (the grading of offerings). PTS translation.\n5. Visuddhimagga II (the dhutaṅgas, incl. sapadāna-cārikā). Ñāṇamoli translation.\n6. Spiro, M. (1970). *Buddhism and Society: A Great Tradition and Its Burmese Vicissitudes*. Harper & Row. (The lay merit economy.)\n7. Tambiah, S. J. (1976). *World Conqueror and World Renouncer*. Cambridge UP. (Sangha-laity economic structure.)\n8. Bank of Thailand (2017–). PromptPay national deployment documentation; and *Bangkok Post*, \"Temple goes digital with QR payment for donations\" (bangkokpost.com/thailand/general/1410951).\n9. W3C (2025). *Verifiable Credentials Data Model v2.0*. W3C Recommendation, 15 May 2025.\n10. Reporting on fake-monk fraud and monastic identity enforcement: *Phnom Penh Post*, \"Fake monks arrested in Siem Reap\"; *Khmer Times*, \"Phnom Penh 'fake monks' arrested\" (2021); *Khaosod English*, \"Fake monks arrested after returning to Ayutthaya rice-field camp\" (29 July 2026; the suspects could produce no monk identification documents).\n11. Ly, T. (2026). \"Certification by Circulation.\" thonly.org defensive publication. *(The beating-credential class; claims division per the Scope note.)*\n12. Ly, T. (2026). \"The Currency That Cannot Be Spent Alone.\" thonly.org defensive publication. *(Co-presence-gated release; claims division per the Scope note.)*\n13. Ly, T. (2026). \"The Round That Never Ends.\" thonly.org defensive publication, same sprint. *(The lay inversion architecture; companion paper.)*\n14. Ly, T. (2026). \"The Omitted Clause.\" thonly.org defensive publication. *(The dignity-floor doctrine inherited by the companion paper.)*\n15. \"Adaptation to Third-Party Payments: Statistical Analysis of Digital Donations Made to Donglin Monastery.\" *Religions* 15(7): 797 (2024).\n16. Abhayagiri Buddhist Monastery (Redwood Valley, California), calendar and \"Food & Supplies\" pages (abhayagiri.org): the alms round in Ukiah on lunar observance days.\n17. *Udāna* 3.7 (Mahākassapa's alms round among the poor). PTS translation.\n18. Ly, T. (2026). \"Decided by No One.\" thonly.org defensive publication. *(The called draw; current form of §6's rotation.)*\n19. *Vinaya Piṭaka*, Cullavagga VI.21 (the meal designator, *bhattuddesaka*).\n20. Cambodianess, \"Cambodia Has 5,146 Pagodas with over 70,000 Monks\" (reporting Ministry of Cults and Religion figures).\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, Silicon Wat℠, B-Bowl™, B-Bowl℠, B-Emblem™. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
       "provenance": {
-        "sha256": "127d636872c9463b312c113cd9cc08a84f01f66bbc8b151a088591f2c2b0d584",
-        "doi": "10.5281/zenodo.21947384",
+        "sha256": "9ac5f43fedd9d7c0d4dc59c5eaec995c2ce6b7e09ab1716fe654720dda2ede6f",
+        "doi": "10.5281/zenodo.22990567",
         "concept_doi": "10.5281/zenodo.21947383",
-        "zenodo_url": "https://zenodo.org/records/21947384",
-        "deposited_sha256": "127d636872c9463b312c113cd9cc08a84f01f66bbc8b151a088591f2c2b0d584",
+        "zenodo_url": "https://zenodo.org/records/22990567",
+        "deposited_sha256": "9ac5f43fedd9d7c0d4dc59c5eaec995c2ce6b7e09ab1716fe654720dda2ede6f",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/steward-routed-alms.md",
@@ -3933,8 +3933,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/steward-routed-alms",
         "hostile_review": null
       },
-      "bytes": 30293,
-      "words": 4481
+      "bytes": 37484,
+      "words": 5597
     },
     {
       "slug": "studio-b-short-phase-bridge",
@@ -3954,13 +3954,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Working draft.** This paper specifies a mechanism currently being built (the Studio surface and the public-toggle bridge); it is a design specification offered as prior art, not a report of a deployed-and-measured system. The Phase-2 settlement layer it bridges onto is specified elsewhere in the corpus and is not yet live.\n\n---\n\n## Preamble\n\n> *A family economy and a planetary one are usually built as two products with a migration between them. This paper specifies a gratitude economy in which they are one product with a switch — and the switch is a single artifact's privacy setting.*\n\nA gratitude economy that begins at family scale (a household thanking its own members in local currency) and aspires to planetary scale (strangers thanking strangers on a global settlement layer) faces an architectural seam: **how does a participant cross from the small economy to the large one?** The default answer is a *migration* — a separate onboarding, a second account, a port of identity and balances from Phase 1 to Phase 2. Migrations are where users are lost and where architectures fracture. This paper specifies a design with no migration: the crossing is a **per-artifact privacy toggle**, and flipping one B-Short from private to public *is* the act of entering the global economy.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author asserts no patent and dedicates the patterns to the public domain under CC0 1.0. The contribution is a composition of known parts — short-form video creation tools, privacy-scoped sharing (the private/unlisted/public visibility ladder common to video platforms), and on-chain settlement — assembled into a specific bridge primitive. Prior art is cited in §7 and novelty is claimed only for the composition of §8. Trademarks are reserved separately; the patterns may be implemented under any name.\n\n## 1. The bridging problem\n\nHeartBank is built in two phases. **Phase 1** is a family-scale ledger of gratitude on conventional rails: a household thanks its own members, in local fiat, witnessed by people who know each other. **Phase 2** is a global peer-to-peer layer on a blockchain settlement substrate (Base L2): strangers thank strangers, anonymously and verifiably, anywhere. The two phases are appropriate to their scales — the family layer is light, legible, and trust-conferred; the global layer is heavy, cryptographic, and trust-minimized. But a participant who has only ever thanked their own family needs some way to begin thanking, and being thanked by, the world. The seam between the two phases is the riskiest joint in the architecture.\n\n## 2. The Studio: a creator surface for real kindness\n\nThe Studio is the Phase-1 surface where the bridge artifact is made. It is a lightweight creator tool — capture short clips, keep them, stitch them together at one's own pace — specialized for one content type: **records of real acts of kindness**. A participant films a kindness (and, characteristically, the same situation before and after, so that what is shown is not the gesture alone but the change it made), and assembles the clips into a short video. The defining feature is not the editing; it is *what is being recorded and for what economy*. The Studio's output is the unit the rest of the system circulates.\n\nTo prevent the Studio from becoming a stage for fabricated good, the kindness records that earn rewards are constrained (per the surrounding mechanism corpus) to be **recorded live, visible to family or public, and pinned to a real location** — so the cheapest way to produce a rewardable record is to actually perform a real, witnessed kindness in a real place. The Studio is a creator tool whose lowest-cost content is genuine good.\n\n## 3. The B-Short: the unit that crosses\n\nThe artifact the Studio produces is a **B-Short℠** — a short-form video record of a kindness. A B-Short begins **private**: it exists at family scale, witnessed and thanked only within the participant's own household, in Phase-1 currency. It is, at this stage, an entry in a family ledger that happens to have a moving picture attached.\n\nThe B-Short is the right unit to carry across the seam because it is *self-contained and self-evidencing*: it bundles the kindness, its witnesses, its location, and its provenance into one shareable object. Unlike a balance (which is account-bound and must be ported) or an identity (which is heavy and must be migrated), a B-Short is a leaf — it can change its own visibility without dragging an account behind it.\n\n## 4. The toggle is the bridge\n\nThe crossing from Phase 1 to Phase 2 is a single act: **setting a B-Short to public.** That one toggle does two things at once, which is the whole mechanism:\n\n1. **It changes the audience** from the family to the world: a public B-Short is visible beyond the household, to any participant anywhere.\n2. **It switches the settlement rail** from Phase-1 family fiat to the Phase-2 global on-chain layer: a public B-Short can now be re-thanked by strangers, with value settling on Base L2.\n\nThere is no separate migration, no second onboarding, no port. The participant does not *move* from the small economy to the large one; they *publish one artifact into* the large one, and may do so for one B-Short while keeping the rest private. The bridge is therefore **incremental, reversible in scope, and per-artifact** — a participant lives in both economies at once, with each B-Short individually scoped.\n\nThis is one instance of a **general bridge primitive** that recurs across the architecture: *to enter the global layer, set something public.* The same shape governs B-links (a privately shared provenance object set public becomes a public one) and multi-family membership (a local family membership composes upward into the global pool). HeartBank's Phase-1-to-Phase-2 crossings are not three different migrations; they are three instances of one toggle — *private → public = local → global.*\n\n## 5. What the public toggle switches on\n\nMade public, a B-Short enters the Phase-2 re-thank economy and inherits its properties:\n\n- **The re-thank multiplier at global scale.** A public B-Short can be re-thanked by an audience of size *N* approaching the whole network, so the throughput available to it is the Phase-2 realization of the re-thank multiplier (the companion paper): origination stays one act, re-thanking scales with the network.\n- **The funded floor.** The autonomous steward funds a base reward for any verified kindness regardless of public reach, so going public is *upside* (the thanks of strangers) layered on a floor that does not require virality. Publishing is not a lottery ticket; it is an amplifier on a guaranteed base.\n- **Value-bearing, human-gated re-thanks.** Strangers' re-thanks are value-bearing (re-tipped from their own balance) and human-given, which makes the public layer's volume the same layer as its anti-farm defense (per the re-thank-multiplier paper): public exposure does not open a farming hole, because the re-thanks that reward it are budget-bounded and not solo-farmable.\n\n## 6. Keeping public kindness from corrupting\n\nA public surface that pays for visible kindness invites the failure that sinks such designs: kindness *performed for the audience and the money* rather than done for its recipient. The bridge does not pretend this risk away; it is managed by three constraints carried over the bridge with the artifact.\n\nFirst, **what is rewarded is real, verified good, not its performance** — the live/visible/located constraints of §2 mean the cheapest rewardable act is a genuine one, so even a participant who crosses the bridge for mercenary reasons is delivered into doing real good. Second, **the prestige signal is giving, not earnings** — a participant's standing is carried by a giving-driven aura (raised by re-giving onward), displayed ambiently, while raw re-thank counts function as viewer-facing information about which kindnesses the community values, kept subordinate to the aura; the status game therefore rewards circulating, not accumulating. Third, **the steward surfaces diverse, genuinely helpful exemplars** rather than the most viral, so that what a public audience learns to imitate is kindness in its variety rather than whatever currently scores. None of the three eliminates the performative edge case (a real act staged for the camera survives them, caught only by whether real people thank it as genuine); they make the genuine path the cheap one and the performed path the expensive, catchable one.\n\n## 7. Prior art\n\nThe components are individually familiar. **Short-form video creation and stitching** is ordinary creator-tool functionality. The **private / unlisted / public visibility ladder** is standard on every video platform; what is novel here is not the ladder but its *use as an economic-phase boundary*. **On-chain settlement** on an L2 is standard Web3 infrastructure. The **creator-economy** pattern (creators earning from an audience) is well established, as is its characteristic power-law distribution. Novelty is claimed for none of these individually.\n\n## 8. What is claimed as novel, and honest limits\n\n**Claimed as novel** is the composition: (a) using a **per-artifact privacy toggle as the migration-free crossing** between a family-scale gratitude economy and a global one, such that a single artifact's visibility setting simultaneously changes its audience and its settlement rail; (b) the identification of this as **one instance of a general *private → public = local → global* bridge primitive** shared with other HeartBank surfaces; and (c) the **Studio** as a creator surface specialized for verifiable real-kindness records (live/visible/located), whose published output inherits the funded-floor and value-bearing-re-thank properties that keep public exposure from opening a farming or performativity hole.\n\n**Honest limits.** The mechanism is specified, not yet built or measured; the Phase-2 settlement layer it bridges onto is not yet live. The creator-economy power law means going public benefits a visible few far more than the many (the funded floor mitigates subsistence but not the distribution of fame). The performativity defenses of §6 are partial — they defeat fabrication, not staging. And the bridge presumes the surrounding properties (the funded floor, the giving-prestige signal, the diverse-exemplar surfacing) actually hold; this paper specifies the crossing and inherits, rather than re-establishes, those guarantees.\n\n---\n\n## Acknowledgments\n\nDrafted with Miss Aquarius℠ (the AI substrate of HeartBank®) per the corpus convention; the framing and final editorial control are the author's.\n\n## Corpus cross-references\n\n- *The Re-Thank Multiplier* — what the public toggle switches on: the O(N²) throughput and the value-bearing, not-solo-farmable re-thank that makes public exposure safe.\n- *A Living Made of Kindness* — the human stakes of the bridge: a B-Short set public is how a livelihood made of kindness reaches the world.\n- *B-Links: Proof-of-Humanity-Signed Provenance* — the sibling instance of the private → public primitive.\n- *Multi-Family Membership* — the third instance: local membership composing onto the global pool.\n- *Miss Aquarius and the Aquarian Pool Architecture* — the Phase-2 settlement layer and the surfacing steward of §6.\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/studio-b-short-phase-bridge\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/studio-b-short-phase-bridge.md\n- Internet Archive · archive.today · perma.cc snapshots: per the monthly snapshot cadence.",
+      "text": "> **Note.** This paper is a design specification offered as prior art, not a report of a deployed-and-measured system. The Studio capture surface and a per-B-Short visibility setting are specified, with a working implementation in progress in the Phase-1 application; the Phase-2 settlement layer that the public setting switches onto is specified elsewhere in the corpus and is not yet live, so the crossing as a whole has been neither built nor measured.\n\n---\n\n## Preamble\n\n> *A family economy and a planetary one are usually built as two products with a migration between them. This paper specifies a gratitude economy in which they are one product with a switch — and the switch is a single artifact's privacy setting.*\n\nA gratitude economy that begins at family scale (a household thanking its own members in local currency) and aspires to planetary scale (strangers thanking strangers on a global settlement layer) faces an architectural seam: **how does a participant cross from the small economy to the large one?** The default answer is a *migration* — a separate onboarding, a second account, a port of identity and balances from Phase 1 to Phase 2. Migrations are where users are lost and where architectures fracture. This paper specifies a design with no migration: the crossing is a **per-artifact privacy toggle**, and flipping one B-Short from private to public *is* the act of entering the global economy.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author and HeartBank® will not seek patent on this specification or any portion of it, in any jurisdiction, at any time, and dedicate the patterns to the public domain under CC0 1.0. The contribution is a composition of known parts — short-form video creation tools, privacy-scoped sharing (the private/unlisted/public visibility ladder common to video platforms), and on-chain settlement — assembled into a specific bridge primitive. Prior art is cited in §7; what this publication discloses is the composition set out in §8. No systematic search of the patent literature was made for this paper, so no statement is made about whether the composition appears elsewhere. Trademarks are reserved separately; the patterns may be implemented under any name.\n\n## Abstract\n\nThis publication specifies a per-item visibility setting on short-form video that doubles as the boundary between two scales of a tipping ledger. A creation tool captures clips of a real act of kindness, often the same situation before and after, and assembles them into a short video record; rewards attach only to records that are recorded live, visible to family or public, and pinned to a real location. Each record is created private, visible to and tippable by the creator's own household on a family-scale ledger that runs over conventional payment rails. Setting one record public changes two things at once: its audience widens from household to any participant, and its settlement rail switches from the family ledger to a peer-to-peer layer on a public blockchain, where strangers may send value-bearing secondary tips from their own balances. No account migration, second onboarding or port of balances occurs; each record is scoped individually, so one participant can occupy both scales at once. The same private-to-public move is identified as a general pattern for crossing from local to global scope, shared with provenance links and multi-family membership. Public exposure sits on a base reward, funded by the system's reward pool, that is independent of reach, and prestige is carried by a reputation measure driven by the participant's onward giving rather than by earnings. Limits: the blockchain layer is not live and the rail switch is unbuilt; the constraints defeat fabrication but not staging; earnings under public exposure remain concentrated.\n\n## 1. The bridging problem\n\nHeartBank® is built in two phases. **Phase 1** is a family-scale ledger of gratitude on conventional rails: a household thanks its own members, in local fiat, witnessed by people who know each other. **Phase 2** is a global peer-to-peer layer on a blockchain settlement substrate (Base L2): strangers thank strangers, anonymously and verifiably, anywhere. The two phases are appropriate to their scales — the family layer is light, legible, and trust-conferred; the global layer is heavy, cryptographic, and trust-minimized. But a participant who has only ever thanked their own family needs some way to begin thanking, and being thanked by, the world. The seam between the two phases is the riskiest joint in the architecture.\n\n## 2. The Studio: a creator surface for real kindness\n\nThe Studio is the Phase-1 surface where the bridge artifact is made. It is a lightweight creator tool — capture short clips, keep them, stitch them together at one's own pace — specialized for one content type: **records of real acts of kindness**. A participant films a kindness (and, characteristically, the same situation before and after, so that what is shown is not the gesture alone but the change it made), and assembles the clips into a short video. The defining feature is not the editing; it is *what is being recorded and for what economy*. The Studio's output is the unit the rest of the system circulates.\n\nTo prevent the Studio from becoming a stage for fabricated good, the kindness records that earn rewards are constrained (per the surrounding mechanism corpus) to be **recorded live, visible to family or public, and pinned to a real location** — so the cheapest way to produce a rewardable record is to actually perform a real, witnessed kindness in a real place. The Studio is a creator tool whose lowest-cost content is genuine good.\n\n> **Current form.** The Studio's advanced editing tools are specified as a paid service priced only for the resources a creator consumes — rendering compute and the storage of production files (drafts and work outputs, as distinct from items already given to someone) — with no tool locked behind a tier, and no share of any re-thank a creator receives is ever taken. The charging rail and the gift rail do not meet. The capture surface stays in HeartBank®'s Phase-1 application; the paid tools are offered under the THonly™ brand, not by HeartBank®. This note adds the pricing boundary as now specified; the surface described above is unchanged.\n\n## 3. The B-Short: the unit that crosses\n\nThe artifact the Studio produces is a **B-Short℠** — a short-form video record of a kindness. A B-Short begins **private**: it exists at family scale, witnessed and thanked only within the participant's own household, in Phase-1 currency. It is, at this stage, an entry in a family ledger that happens to have a moving picture attached.\n\nThe B-Short is the right unit to carry across the seam because it is *self-contained and self-evidencing*: it bundles the kindness, its witnesses, its location, and its provenance into one shareable object. Unlike a balance (which is account-bound and must be ported) or an identity (which is heavy and must be migrated), a B-Short is a leaf — it can change its own visibility without dragging an account behind it.\n\n## 4. The toggle is the bridge\n\nThe crossing from Phase 1 to Phase 2 is a single act: **setting a B-Short to public.** That one toggle does two things at once, which is the whole mechanism:\n\n1. **It changes the audience** from the family to the world: a public B-Short is visible beyond the household, to any participant anywhere.\n2. **It switches the settlement rail** from Phase-1 family fiat to the Phase-2 global on-chain layer: a public B-Short can now be re-thanked by strangers, with value settling on Base L2.\n\n```\n  PHASE 1 (family scale)                   PHASE 2 (global scale)\n  audience: own household                  audience: any participant\n  rail:     family ledger, fiat rails      rail:     peer-to-peer, Base L2\n\n  B-Short 1  [private] ─── set public ───► B-Short 1  [public]\n  B-Short 2  [private]     (one act,       re-thankable by strangers,\n  B-Short 3  [private]      one item)      on top of the funded floor\n      │\n      └── the others stay private: one participant, both scales at once\n```\n\nThere is no separate migration, no second onboarding, no port. The participant does not *move* from the small economy to the large one; they *publish one artifact into* the large one, and may do so for one B-Short while keeping the rest private. The bridge is therefore **incremental, reversible in scope, and per-artifact** — a participant lives in both economies at once, with each B-Short individually scoped.\n\nThis is one instance of a **general bridge primitive** that recurs across the architecture: *to enter the global layer, set something public.* The same shape governs B-links (a privately shared provenance object set public becomes a public one) and multi-family membership (a local family membership composes upward into the global pool). HeartBank's Phase-1-to-Phase-2 crossings are not three different migrations; they are three instances of one toggle — *private → public = local → global.*\n\n## 5. What the public toggle switches on\n\nMade public, a B-Short enters the Phase-2 re-thank economy and inherits its properties:\n\n- **The re-thank multiplier at global scale.** A public B-Short can be re-thanked by an audience of size *N* approaching the whole network, so the throughput available to it is the Phase-2 realization of the re-thank multiplier (the companion paper): origination stays one act, re-thanking scales with the network.\n- **The funded floor.** The autonomous steward funds a base reward for any verified kindness regardless of public reach, so going public is *upside* (the thanks of strangers) layered on a floor that does not require virality. Publishing is not a lottery ticket; it is an amplifier on a funded base.\n- **Value-bearing, human-gated re-thanks.** Strangers' re-thanks are value-bearing (re-tipped from their own balance) and human-given, which makes the public layer's volume the same layer as its anti-farm defense (per the re-thank-multiplier paper): public exposure does not open a solo-farming hole, because the re-thanks that reward it are budget-bounded and cannot be farmed by one account alone (collusion among several accounts remains possible and is left, in that paper, to detection in the transaction graph).\n\n## 6. Keeping public kindness from corrupting\n\nA public surface that pays for visible kindness invites the failure that sinks such designs: kindness *performed for the audience and the money* rather than done for its recipient. The bridge does not pretend this risk away; it is managed by three constraints carried over the bridge with the artifact.\n\nFirst, **what is rewarded is real, verified good, not its performance** — the live/visible/located constraints of §2 mean the cheapest rewardable act is a genuine one, so even a participant who crosses the bridge for mercenary reasons is delivered into doing real good. Second, **the prestige signal is giving, not earnings** — a participant's standing is carried by a giving-driven aura (raised by re-giving onward), displayed ambiently, while raw re-thank counts function as viewer-facing information about which kindnesses the community values, kept subordinate to the aura; the status game therefore rewards circulating, not accumulating. Third, **the steward surfaces diverse, genuinely helpful exemplars** rather than the most viral, so that what a public audience learns to imitate is kindness in its variety rather than whatever currently scores. None of the three eliminates the performative edge case (a real act staged for the camera survives them, caught only by whether real people thank it as genuine); they make the genuine path the cheap one and the performed path the expensive, catchable one.\n\n> **Current form.** As now specified, the steward does not grade exemplars as more or less helpful. A B-Short reaches people by relation and proximity; where the steward operates any exposure slate, its members are chosen by an equal-yet-random, publicly verifiable draw from a roster committed in advance, never by a score or rank. The third constraint above is retained as a disclosed variant.\n\n## 7. Prior art\n\nThe components are individually familiar. **Short-form video creation and stitching** is ordinary creator-tool functionality. The **private / unlisted / public visibility ladder** is common on video-sharing platforms — YouTube, for example, offers a private setting (visible to the uploader and chosen viewers), an unlisted one (visible to anyone with the link) and a public one [1]; what this publication discloses is not the ladder but its *use as an economic-phase boundary*. **On-chain settlement** on a layer-2 network — Base, built on Ethereum, is the one this corpus specifies [3] — is standard Web3 infrastructure. The **creator-economy** pattern (creators earning from an audience) is well established, as is the concentration of its earnings among a few large creators [2]. None of these components is put forward here individually.\n\n## 8. What is disclosed, and honest limits\n\n**What is disclosed** is the composition: (a) using a **per-artifact privacy toggle as the migration-free crossing** between a family-scale gratitude economy and a global one, such that a single artifact's visibility setting simultaneously changes its audience and its settlement rail; (b) the identification of this as **one instance of a general *private → public = local → global* bridge primitive** shared with other HeartBank surfaces; and (c) the **Studio** as a creator surface specialized for verifiable real-kindness records (live/visible/located), whose published output inherits the funded-floor and value-bearing-re-thank properties that narrow the farming and performativity exposure public reach would otherwise open.\n\n**Honest limits.** The capture surface and a visibility setting have a working implementation in progress in the Phase-1 application, but the rail switch that makes the toggle a crossing is not built, the Phase-2 settlement layer it bridges onto is not yet live, and nothing here has been measured. The creator-economy power law means going public benefits a visible few far more than the many (the funded floor mitigates subsistence but not the distribution of fame). The funded floor is itself designed as a bootstrap: its steward-funded portion is meant to shrink as re-thanks from people take over, and a fixed pool divided among more participants dilutes, so it is a transitional support rather than a permanent guarantee. The performativity defenses of §6 are partial — they defeat fabrication, not staging. Two of §6's three constraints are rules that need an enforcer rather than properties of the system: the re-thank count stays subordinate to the giving-driven reputation only while the interface keeps it so (a raw count is comparable across people and tends to become the status measure regardless), and diverse-exemplar surfacing holds only while the steward exercises that restraint; designs that would not depend on an enforcer are not specified here. And the bridge presumes the surrounding properties (the funded floor, the giving-prestige signal, the diverse-exemplar surfacing) actually hold; this paper specifies the crossing and inherits, rather than re-establishes, those guarantees.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Studio | short-form video capture and editing tool (clip capture, deferred stitching) |\n| B-Short℠ | short-form user-generated video record of a real act of kindness; the content item |\n| public toggle | per-item visibility / access-control setting (private → public) |\n| Phase 1 | family-scale gratitude/tipping ledger running over conventional (fiat) payment rails |\n| Phase 2 | global peer-to-peer settlement layer on a public blockchain (Ethereum layer-2 network) |\n| re-thank | secondary tip: a viewer's value-bearing micropayment to the creator of an existing item |\n| funded floor | base reward funded by the system's reward pool, independent of audience reach |\n| aura | reputation measure computed from a participant's own onward giving, not earnings |\n| steward (Miss Aquarius℠) | autonomous software agent administering the reward pool and item surfacing |\n| bridge primitive | migration-free scope change: making one object public moves it from local to global scope |\n\n## References\n\n1. YouTube Help, \"Change video privacy settings.\" https://support.google.com/youtube/answer/157177 (accessed 2026-09-26).\n2. Li Jin, \"The Creator Economy Needs a Middle Class,\" *Harvard Business Review*, 17 December 2020. https://hbr.org/2020/12/the-creator-economy-needs-a-middle-class\n3. Base. https://www.base.org/ (accessed 2026-09-26).\n\n## Acknowledgments\n\nDrafted with Miss Aquarius℠ (the AI substrate of HeartBank®) per the corpus convention; the framing and final editorial control are the author's.\n\n## Corpus cross-references\n\n- *The Re-Thank Multiplier: How a Gratitude Economy Escapes Its Own Saturation Ceiling* — what the public toggle switches on: the O(N²) throughput and the value-bearing, not-solo-farmable re-thank that bounds farming under public exposure.\n- *A Living Made of Kindness: Right Livelihood for the Age of Automation* (essay) — the human stakes of the bridge: a B-Short set public is how a livelihood made of kindness reaches the world.\n- *B-Links: Proof-of-Humanity-Signed Shareable Provenance with an Embedded Gratitude Affordance* — the sibling instance of the private → public primitive.\n- *Multi-Family Membership: User-Scoped Identity, Plural Membership, and the Two Problems It Resolves* — the third instance: local membership composing onto the global pool.\n- *Miss Aquarius and the Aquarian Pool Architecture: Autonomous-AI Mediator, Treasury Smart-Contract, and the January-7 Empty-by-Design Discipline* — the Phase-2 settlement layer and the surfacing steward of §6.\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/studio-b-short-phase-bridge\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/studio-b-short-phase-bridge.md\n- Internet Archive · archive.today snapshots: per the monthly snapshot cadence.",
       "provenance": {
-        "sha256": "3683b3f625c158be80b73d7b27d2b1fc7c122d2c52b9ba000ef45d689f0ca357",
-        "doi": "10.5281/zenodo.22246444",
+        "sha256": "1712b428a0d517d022704653945567fe03dc8863791e0fc624452e9a8c4a316c",
+        "doi": "10.5281/zenodo.22990568",
         "concept_doi": "10.5281/zenodo.21947387",
-        "zenodo_url": "https://zenodo.org/records/22246444",
-        "deposited_sha256": "3683b3f625c158be80b73d7b27d2b1fc7c122d2c52b9ba000ef45d689f0ca357",
+        "zenodo_url": "https://zenodo.org/records/22990568",
+        "deposited_sha256": "1712b428a0d517d022704653945567fe03dc8863791e0fc624452e9a8c4a316c",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/studio-b-short-phase-bridge.md",
@@ -3968,8 +3968,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/studio-b-short-phase-bridge",
         "hostile_review": null
       },
-      "bytes": 11725,
-      "words": 1806
+      "bytes": 18422,
+      "words": 2828
     },
     {
       "slug": "subject-released-attestation",
@@ -4339,13 +4339,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* paper №3 of the July 2026 **games-doctrine sprint**. Claims division with siblings and predecessors, stated for the record: *Need-Compiled Questlines* (this corpus, 2026-07-07) owns the mints-nothing quest class and the compile-never-invent rule for the first-party intermediary; the present paper claims the **third-party exposure** of that grammar — the API boundary under which independent developers' games may participate — plus the **education mechanisms** built on it (family-corpus-as-curriculum; graduation-by-transmission; retention-inversion) and the **child-facing attestation rung** that extends *Certification by Circulation*'s membership ladder. The same-sprint papers *The Sport That Says Your Name* and *The Wager That Isn't* own, respectively, the physical sport and the stake grammar; all three share **the play/currency wall** (coined in the sport paper). The mechanism is design-complete and unbuilt (founder-ratified 2026-07-23, including the explicit rejection of the disbursing-API form); claims are architectural, strata-dated to the design layer. The prior-art clock starts at this markdown push. Compact sprint draft; density pass = editorial option.\n\n---\n\n## Abstract\n\nTwo industries now compete for children's screen hours, and both are optimized against the child. Entertainment apps monetize attention and are engineered for retention — streaks, loot, variable reward — with the child's time as the extracted resource. Education apps promise the opposite and largely rebuild the same machine: the dominant language-learning product is famous for its streak mechanics, and the AI-tutor wave now arriving inherits, by commercial default, the retention KPI of the software industry that builds it — although a tutor's honest success has been known to every human teacher forever: *the student who no longer needs you.* Meanwhile parents hold treasuries of the one motivational resource no app possesses — the family's own love, letters, and gratitude — and no software has ever been allowed to touch it, for the excellent reason that no software could be trusted to.\n\nThis paper specifies the trust architecture and the education design together, because each is the other's missing half. The **witness API** is a third-party game-client boundary with a single constitutive rule: game clients receive **propose-and-celebrate** scopes and can never hold disbursement authority — a game may suggest real-world acts and celebrate their completion, but every reward flows through the family's ordinary witnessed-thanks rail, on a parent's tap, and quest completion mints nothing (the mints-nothing boundary, inherited and here exposed to third parties). On that boundary, three education mechanisms become safe to build. **Family-corpus-as-curriculum**: with per-item parental consent and on-device processing, a reading lesson's text is the child's own grandmother's letter; the writing exercise is a real thank-you that will really be sent; the arithmetic workbook is the family's actual shared ledger — replacing the streak's counterfeit urgency with relational pull. **Graduation-by-transmission**: every unit's capstone is a real transmitted act — reading to a younger sibling, sending the letter, presenting the family's accounts — witnessed and thanked through the ordinary rail, so that learning completes as giving. **Retention-inversion**: the client's success metric is graduation — the engineered obsolescence every honest tutor pursues — with churn-to-competence reported as achievement, not loss. A **child-facing attestation rung** (never-gate-love; no-analytics-exfiltration; witness-scope-only) extends the guild membership credential this corpus published earlier. Six claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including the child-scale crowding-out wager, which the authors commit to publishing either way.\n\n**Keywords:** educational games, AI tutors, witness API, parental consent, overjustification, intrinsic motivation, authentic literacy, scaffolding and fading, retention metrics, child-directed advertising, COPPA, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **the witness API** (as against the wallet API), **propose-and-celebrate scopes**, **family-corpus-as-curriculum**, **the never-gate-love invariant**, **graduation-by-transmission**, **retention-inversion**, and **the child-facing attestation rung**. Terms inherited from this corpus's earlier publications (the mints-nothing boundary and compile-never-invent rule; certification by circulation and the membership credential; the play/currency wall) are cited, not re-claimed.\n\nEducational software, AI tutoring, and chore-reward family apps are vast prior art fields (§9); the present claims are confined to the *witness-scoped third-party client boundary and the consent-gated family-corpus curriculum architecture with transmission-completed units and inverted retention objectives*, which is, to the authors' knowledge, not previously published as a coherent whole — and, as throughout this sprint, to the constraint set an extractive implementation would omit.\n\n---\n\n## 1 · The Problem: The Treasury, the Tutor, and the Trap\n\nBegin with the founder's own first proposal, recorded here because its rejection is the design. The idea arrives naturally to anyone who holds both a family gratitude treasury and an interest in wholesome children's software: *expose an API so that approved games can reward children from the family's shared pot.* Parents approve the games; developers of wholesome games are thereby incentivized; screen time becomes benign. The proposal is the obvious one, it will be built by someone, and it is a trap with three doors.\n\n**Door one: it pays children to perform, by machine.** The foundational experiment of the overjustification literature — Lepper, Greene, and Nisbett, 1973 — is *specifically about children*: rewarded for an activity they already loved, they stopped loving it. An API that converts in-game achievement to money is a machine for administering that experiment to one's own children, at scale, with the family's money.\n\n**Door two: it hands developers the wrong objective.** \"Parents approve wholesome games\" governs the catalog; it does not govern the gradient. Once disbursement flows through gameplay, every developer's optimization target — whatever their intentions — becomes *maximize disbursement-generating engagement inside the parental-approval envelope*: the attention economy, now with direct treasury access. The approval gate selects for games that *look* wholesome; the reward rail pays for children who stay on screens.\n\n**Door three: it dissolves the witness.** In this institution's architecture, the reward *is* the witnessed thanks — a parent seeing a real act and acknowledging it is the entire product (the corpus's founding story concerns an unwitnessed gratitude that surfaced only after a death; the institution exists to move the witness before the ending). An automated disbursement is delivery without the envelope: value arrives, and no one saw anyone.\n\nThe design brief is therefore inverted from the proposal: build the API that gives children's games everything *except* the thing they must never have. What games legitimately need from a family platform is **context** (what real acts would matter here) and **consequence** (a way for real acts to be celebrated and to count). What they must never hold is **authority** (the power to move value). The witness API is that separation, made architectural — and it is stated in one line, inherited from this sprint's shared spine: *competition and play may generate the story; only witnessed giving moves the currency.*\n\nEducation is the vertical where this architecture pays twice, because education software has a second, independent pathology: it optimizes for retention when its honest objective is departure. The rest of this paper builds the education case on the API's foundation.\n\n---\n\n## 2 · The Canonical Scenes\n\n**A kitchen table, evening.** A seven-year-old is reading aloud, haltingly, from a tablet. The text is not \"The cat sat on the mat.\" It is: *\"My dear grandson, today I picked the first mangoes from the tree your grandfather planted…\"* — her actual grandmother's actual letter, sent through the family's gratitude app last month, released to the reading game by her mother's explicit per-item consent, processed on the device it is displayed on. The game scaffolds the hard words. The child reads to the end because the letter is *to him*. There is no streak counter. The pull is a person.\n\n**The same table, two weeks later.** The reading unit's final screen is not a quiz. It says: *tonight, read this book to your little sister — that's the graduation.* He does, with the game nowhere in the room. His father, folding laundry in the doorway, taps the thank on his own phone — the ordinary family thank, the same one any kindness gets. The game finds out only that its proposed act was witnessed; the thanks, the value, and the moment belonged entirely to the family rail. The next morning the game celebrates — story, confetti, a chronicle entry — and unlocks the next unit. It has minted nothing. It proposed; the family witnessed; the celebration is all it owns.\n\n**A boardroom, meanwhile (the anti-scene).** A product team reviews their education app's dashboard. Daily active users, session length, streak retention, churn — the standard panel. A designer proposes marking users who complete the curriculum and stop as *successes*, reported separately from churn. The metric does not exist in the analytics package. It has never existed. Every human tutor since antiquity has pursued it; no venture-scale education product has ever reported it. That absent number is this paper's third mechanism.\n\n---\n\n## 3 · The Witness API: Propose and Celebrate, Never Disburse\n\nThe boundary specification, stated as architecture:\n\n**Scopes granted to third-party game clients.** (1) **Propose**: submit candidate real-world acts — age-appropriate, family-configured — styled in the game's own fiction (\"a quest for the young knight: set the table for the feast\"). Proposals draw on the same compile-never-invent discipline this corpus published for the first-party intermediary: the platform surfaces real standing context (family members, occasions, genuine needs a household registers); the game invents only narrative dress, never synthetic needs. (2) **Celebrate**: receive a minimal completion signal — *this proposed act was witnessed* — and respond inside the game with story, ceremony, progression. (3) **Curriculum-read** (education clients; §4): request specific consented family-corpus items for on-device pedagogical use.\n\n**Authority withheld, absolutely.** No client may hold, request, or be granted: disbursement or transfer capability of any kind; balance visibility; the power to attach value to in-game events; or the power to gate, deliver, or withhold family communications (§4's invariant). The reward path is constitutively external: a family member witnesses the real act and thanks the child through the family's ordinary rail, on human initiative. The child's experience of reward is a parent's acknowledgment, with the game as the town crier — never the paymaster. **Quest completion mints nothing**; a game client requesting a disbursement scope is not a policy violation but a type error — the scope does not exist in the API.\n\n**The parent-steward gate.** Which clients may propose to which children is exclusively the family's setting — per-child, revocable, default-off. The platform's intermediary never overrides a parental game approval in either direction; its role is confined to the attestation rung of §6 (is this client *eligible* to be approved) and the API's mechanical enforcement (what any approved client *can do*).\n\nThe two-sided result, for developers, deserves emphasis: the witness API is not only a restriction but an offer. Independent developers gain what no children's studio has ever had — a lawful, consented channel by which their game's proposals can land in a family's *real* economy of acknowledgment — and their revenue path (patronage from grateful families, under the guild economics this corpus published elsewhere) aligns their gradient with catalyzed real-world flourishing rather than captured screen time. The best game under this API is the one that gets the child off the device and into the kitchen — because *that* is what parents thank.\n\n---\n\n## 4 · Family-Corpus-as-Curriculum\n\nEducation software's deepest deficit is not pedagogical technique but *material that matters*. The literacy literature has said so for decades: children learn to read faster and deeper on texts that are personally meaningful — the \"authentic literacy\" and family-literacy traditions; Ashton-Warner's organic vocabulary drawn from her students' own lives; Freire's generative words taken from the learner's world. The industry knows this finding and cannot act on it, because the material that matters most to a child — the family's own letters, stories, and records — is precisely the material no third party can be handed. So the industry substitutes synthetic urgency for real meaning: streaks, gems, a cartoon owl's disappointment.\n\nThe witness API's trust boundary unlocks the real thing. **Family-corpus-as-curriculum** is the mechanism by which, with layered consent, a family's own gratitude corpus becomes the child's instructional material:\n\n- **Reading**: the corpus's received letters and recorded family stories, level-matched and scaffolded — grandmother's letter as the primer.\n- **Writing**: real correspondence as the exercise — the thank-you that will actually be sent (on the family's rail, by the family's act), the card for the actual upcoming birthday. The curriculum's terminal artifact is the gratitude letter itself: the institution's founding object, taught as a genre.\n- **Arithmetic**: the family's shared ledger as the workbook — real balances counted, the week's giving summed, the child seated as the family's little teller presenting the accounts at dinner (numbers with faces attached).\n- **Heritage language**: the diaspora case, and the sharpest. The material exists in abundance (the elders' letters, in Khmer); the motivation problem that sinks heritage-language apps dissolves when the reading test is *\"can you read what your grandmother wrote to you?\"* — and the graduation (§5) is writing back.\n\n**The consent architecture** is the mechanism's other half, and carries three non-negotiables. (1) **Per-item, parent-granted, revocable**: the curriculum draws only on corpus items a parent has individually released for pedagogical use — never blanket corpus access, never client-initiated browsing. (2) **On-device processing** wherever the platform runs natively: the corpus item is rendered into pedagogy on the family's hardware; the client's cloud never holds grandmother's letter. (3) **The never-gate-love invariant**, stated in bold because an extractive implementation would discover its violation as a retention feature: **no family communication may ever be locked, delayed, or conditioned on lesson progress.** The letter is the child's regardless; the game may *scaffold* the reading of it, never gate the access to it. A reading app that makes a child earn grandmother's words has taken love hostage for engagement; under this architecture the capability is absent, and under §6 its discovery anywhere is credential-revoking.\n\n---\n\n## 5 · Graduation-by-Transmission\n\nWhat completes a unit of learning? The industry's answer is assessment (a quiz passed); the streak economy's answer is continuation (come back tomorrow). This design's answer is older than both: **a skill is completed when it is given to someone.**\n\n**The mechanism.** Every curricular unit terminates in a **transmission act** — a real-world act, proposed through the witness API, in which the child performs the learned skill *for* someone: reads the story to the younger sibling; writes and sends the actual letter; presents the family's accounts at dinner; reads grandmother's reply aloud to the household. The act is witnessed and thanked through the ordinary rail like any kindness (the sibling's delight and the parent's thank are the assessment); the client receives only the completion signal and celebrates. Structurally, the unit's shape is: *receive the skill (from the game, from the corpus, from the civilization that wrote the letters) → practice in the forge → give it forward as the capstone.* Learning completes as giving — the institution's atomic operation, expressed as pedagogy.\n\n**What this fixes.** (1) *Assessment authenticity*: performance for a real audience is the strongest known completion evidence, and it cannot be gamed by the client because the client neither performs nor judges it. (2) *The motivation loop closes outside the screen*: the unit's climax happens in the living room, off-device, in relationship — the game engineers its own exit from the moment (§6's objective, enacted at unit scale). (3) *The reward is constitutionally safe*: the child is thanked for a real act of giving through the same rail as every other family kindness — not paid for lesson completion — which is precisely the configuration the overjustification literature marks as least corrosive (acknowledgment of autonomous giving) as against the one it marks as most (contingent payment for task performance). The residual risk is real and pre-registered (P-E3).\n\n**Guards.** The **recipient is never a prop**: the younger sibling holds the same veto any gift-recipient holds in this institution's grammar — a bedtime reading declined is declined, and the client proposes an alternate capstone. The **struggling learner's dignity** is structural: the family ledger records the *gift* (read to sister; wrote to grandmother), never the proficiency; effort curves, error rates, and reading levels are private to child, parent, and device (§6), so a slow reader's capstone entry is indistinguishable in the family record from a fast one's. Gifts are witnessed; struggle is not.\n\n---\n\n## 6 · Retention-Inversion, and the Child-Facing Attestation Rung\n\n**Retention-inversion.** An honest tutor's terminal state is obsolescence — the scaffolding literature has carried the insight formally since Vygotsky's zone of proximal development and the fading stage of cognitive apprenticeship, and every human teacher has carried it informally forever. Education software inverts it because software economics reward retention; the resulting products teach adequately and *linger* maximally (the streak that must not break is not a pedagogical instrument). This design writes the honest objective into the client's contract: an education client under the witness API adopts **graduation-rate** — learners who complete the curriculum's transmissions and *leave* — as its reported success metric, with churn-to-competence celebrated in its chronicle as achievement. The platform's own analytics for such clients report graduations where the industry reports retention. This is the self-eliminating objective this corpus has published at institutional scale, landed on the smallest and most consequential surface: the software a child learns to read on. (The revenue question — what pays for a product optimized for departure — is answered by the guild economics cited in §3: patronage thanks catalyzed real flourishing, and a family's gratitude to the game that graduated their child does not expire with the subscription that never existed.)\n\n**The child-facing attestation rung.** *Certification by Circulation* (this corpus) published the guild's membership credential — the live, revocable credential by which software clients are admitted to the platform's economy, with machine-verifiable business-model attestation as its uncopyable headline rung. The present paper extends that ladder with one rung specific to clients addressing children, comprising, as conferral conditions: (1) **witness-scope-only** — the client's granted scopes are propose/celebrate/curriculum-read and nothing else, verified mechanically (the rung's analog of the ledger-fact rung: checkable, not promised); (2) **the never-gate-love invariant** (§4) attested and revocation-enforced on breach; (3) **no-analytics-exfiltration** — child learning data (proficiency, effort, errors, corpus content) never leaves the family's devices and is never monetized, brokered, or used for cross-client profiling; the client's off-device telemetry for child users is limited to the minimal completion signal; (4) **recipient-consent grammar** (§5's guards) implemented; (5) the jurisdictional floor (COPPA-class regimes and their equivalents) as a floor, not the bar. Copy discipline follows the parent publication: a credentialed client is \"a member in good standing of a guild whose membership requires the above\" — never \"certified safe.\"\n\n---\n\n## 7 · What the Design Refuses\n\nAs prior art in refusal form — an implementation including any of the following is *not* this mechanism:\n\n1. **Any disbursement, transfer, or balance scope** held by a game client; any conversion of in-game events to value.\n2. **Rewarding lesson or quest completion** with money, currency, points-redeemable-for-value, or any minted instrument.\n3. **Gating family communications** — locking, delaying, or conditioning any letter, message, or corpus item on progress, streaks, or payment.\n4. **Blanket corpus access** or client-side corpus browsing; any off-device retention of consented items.\n5. **Child-analytics exfiltration** — proficiency or behavioral data leaving the family's control, in identified or \"anonymized\" form.\n6. **Streak-loss mechanics, appointment pressure, or synthetic urgency** addressed to child users.\n7. **Retention-optimized objectives** in credentialed education clients — the rung requires the inversion.\n8. **The transmission recipient as a prop** — capstones without recipient veto.\n\n---\n\n## 8 · Pre-Registered Predictions\n\nAll at n = 0; instruments await pilots.\n\n- **P-E1 (transmission completes).** Units whose capstone is a transmission act are completed — through the real witnessed act — at rates comparable to or exceeding quiz-terminated units in matched content; the capstone is not a drop-off cliff. If families systematically skip the transmission, the design's central pedagogy is decorative and will be revised.\n- **P-E2 (the corpus outpulls the streak).** In within-family comparisons, reading material drawn from the consented family corpus produces greater voluntary (unprompted) session initiation by the child than matched generic material — relational pull, measured against the industry's synthetic pull with the streak machinery absent in both arms.\n- **P-E3 (the crowding wager — publish either way).** Witnessed thanks for graduation acts does not reduce the child's unprompted, unproposed kindness baseline: children in witness-API families show stable or rising rates of spontaneous (never-proposed) giving over six months. This is the overjustification exposure named honestly: the design bets that *witnessed acknowledgment of real giving* sits on the safe side of the contingent-reward boundary; the child-scale result will be published whichever way it falls, and a bad result revises the celebration grammar, not the accounting.\n\n---\n\n## 9 · Prior Art, Engaged Generously\n\n**The overjustification and motivation literature.** Lepper–Greene–Nisbett (1973) on children's intrinsic interest under expected reward; Deci, Koestner & Ryan's meta-analytic synthesis; self-determination theory's autonomy/competence/relatedness triad — which this design can be read as implementing wholesale (autonomy: the act is the child's, off-screen; competence: the forge; relatedness: the entire reward channel *is* a relationship). Kohn's *Punished by Rewards* as the popular indictment. This literature is simultaneously the design's foundation and its named risk (P-E3).\n\n**The pedagogy of meaningful material and of fading.** Ashton-Warner's *Teacher* (organic reading vocabulary from the child's own life); Freire's generative words; the family-literacy and authentic-literacy research traditions; Montessori's \"help me to do it myself\"; Vygotsky's ZPD and the scaffolding-and-fading stage of cognitive apprenticeship (Collins, Brown & Newman) — the formal ancestors of retention-inversion. The design's claim is not that these ideas are new but that no *software economics* has ever permitted their honest implementation; the witness API's revenue geometry is the missing permission.\n\n**The industry anti-examples, engaged respectfully.** Duolingo — a genuinely effective product whose streak apparatus is the canonical instance of retention economics in education software; the chore-and-allowance app family (Greenlight, BusyKid, and kin) — competent products built frankly on pay-for-task exchange, the model whose child-scale hazards §1 rehearses; the AI-tutor wave (Khanmigo and successors) — pedagogically serious, and structurally silent, so far, on both the objective function (retention vs. graduation) and the family-data trust boundary this paper specifies. The GPT-era app stores' child-safety review regimes are the procedural prior art for §6's rung, differing in kind: store review attests process at submission; the rung attests scopes and conduct continuously, with a heartbeat.\n\n**The consent and child-data law.** COPPA and its verifiable-parental-consent doctrine; the UK Age-Appropriate Design Code (data-minimization-by-default for children); GDPR-K. The rung treats these as floors; the never-gate-love invariant and the no-exfiltration rule exceed all of them, and are published here partly because no statute yet names them.\n\n**This corpus.** *Need-Compiled Questlines* (the mints-nothing boundary; compile-never-invent; reward-follows-witness — the first-party grammar this paper exposes to third parties); *Certification by Circulation* (the membership credential and attestation ladder the child rung extends); the guild economics publications (the patronage revenue path); the play/currency wall (the sprint's shared spine, coined in the sport paper).\n\n---\n\n## 10 · Honest Limits\n\n*This section is deliberately free of lineage, resonance, and metaphor.*\n\n1. **n = 0.** No client, no rung, no curriculum, no family has used any of this. All architecture; all predictions unfunded by data.\n2. **The crowding wager is genuinely open.** P-E3 may fall against the design. The witnessed-thanks channel is *argued* to sit outside the harmful contingency class; the literature's boundary cases are close enough that the argument requires the experiment. The commitment is to publish and revise.\n3. **Supplement, never school.** Nothing here claims to teach reading, writing, or arithmetic better than schools and teachers; the mechanisms address motivation, material, and completion — the software layer's specific pathologies. Any implementation marketing itself as school replacement has left this design.\n4. **On-device processing is platform-gated.** The consent architecture's strongest guarantee requires native on-device AI capacity; browser-only deployments can honor consent scoping but not the never-leaves-the-device property, and must say so plainly rather than imply it.\n5. **The parent-steward gate assumes a functional steward.** Households where the approving parent is absent, coerced, or adversarial to the child are outside the design's protective assumptions; the gate protects against bad clients, not bad homes.\n6. **Graduation-rate is gameable in principle.** A cynical client could graduate students *prematurely* to inflate the inverted metric. The transmission capstone is the partial guard (a real audience is the assessor); the residual risk is acknowledged and belongs to the rung's audit practice.\n7. **The heritage-language case carries an emotional edge.** Tying literacy to a grandparent's letters is powerful precisely because it is not neutral; families navigating estrangement, loss, or painful histories need the corpus-consent granularity to exclude as easily as include. The per-item architecture is that granularity; the sensitivity is noted as a design obligation, not solved by it.\n8. **COPPA-class compliance is asserted as design intent, unbuilt.** No legal review has occurred; the rung's jurisdictional floor is specified, not implemented.\n\n---\n\n## 11 · Claims\n\nThe following mechanisms and architectures, individually and in combination, are published as prior art and dedicated to the public domain:\n\n1. **The witness API.** A third-party client boundary for family and children's platforms granting propose-and-celebrate scopes (real-world act proposal in client fiction; minimal witnessed-completion signal; celebration) while structurally withholding disbursement, transfer, balance, and value-attachment capabilities — such that all reward flows through human-initiated witnessed acknowledgment external to the client, and client-proposed act completion mints nothing.\n2. **The parent-steward game gate.** Per-child, revocable, default-off parental approval as the exclusive authorization channel for client proposal rights, with the platform intermediary unable to override approvals in either direction, and intermediary authority confined to credential eligibility and mechanical scope enforcement.\n3. **Family-corpus-as-curriculum.** The consent architecture under which a family's own communications and records become a child's instructional material: per-item parental release, revocability, on-device processing, client-cloud exclusion — including the **never-gate-love invariant**: the structural impossibility of locking, delaying, or conditioning any family communication on lesson progress, engagement, or payment.\n4. **Graduation-by-transmission.** A curricular architecture in which each unit terminates in a proposed real-world transmission act (the learned skill performed for a real recipient), assessed by witnessed completion through the family's ordinary acknowledgment rail, with recipient veto, and with proficiency data held privately (the family record holding the gift, never the grade).\n5. **Retention-inversion.** The adoption, by an education client and its platform analytics, of graduation-rate (curriculum-completing departure) as the reported success metric, with churn-to-competence classified as achievement — the engineered-obsolescence objective as a certifiable software property.\n6. **The child-facing attestation rung.** An extension to a live membership-credential ladder comprising, as continuously-enforced conferral conditions for child-addressing clients: mechanically-verified witness-scope-only grants; the never-gate-love invariant; no-analytics-exfiltration of child learning data; recipient-consent implementation; and jurisdictional child-data floors — with breach revoking the credential's heartbeat.\n\n---\n\n## 12 · Lineage, and the Close\n\nThe tradition this institution draws from counts ten bases of merit, and two of them are learning and teaching — *dhammassavana*, listening to what is worth hearing, and *dhammadesanā*, giving it to the next person. The pairing is the point: reception is completed by transmission, and a teaching received but never passed on is a letter never answered. The founder's family lives this pairing daily — a father and son transcribing, page by page, a canon that survived because every generation treated *having learned it* as the obligation to hand it over. The mechanism above is that pairing, scaled to a seven-year-old: the letter arrives, the letter is read, and the reading is finished only when it is read *to* someone. Somewhere in the design's future intent, a child finishes a unit not when the app says so but when her little sister falls asleep mid-story — and the app's whole remaining job is to make sure her father saw.\n\nAnd the app's final success, for that child, is the day she deletes it — reader, writer, teller of the family's accounts, done. The game that graduates you throws no graduation party for itself. It proposed; the family witnessed; the raft, as this corpus says elsewhere, is abandoned at the far shore — which was, from the first lesson, the only honest destination for a tutor.\n\n---\n\n## Citations\n\n1. Lepper, M., Greene, D., & Nisbett, R. (1973). \"Undermining Children's Intrinsic Interest with Extrinsic Reward.\" *JPSP* 28(1).\n2. Deci, E., Koestner, R., & Ryan, R. (1999). \"A Meta-Analytic Review of Experiments Examining the Effects of Extrinsic Rewards on Intrinsic Motivation.\" *Psychological Bulletin* 125(6).\n3. Kohn, A. (1993). *Punished by Rewards*. Houghton Mifflin.\n4. Ashton-Warner, S. (1963). *Teacher*. Simon & Schuster. (Organic vocabulary.)\n5. Freire, P. (1970). *Pedagogy of the Oppressed*. (Generative words.)\n6. Vygotsky, L. (1978). *Mind in Society*. Harvard UP. (ZPD; the scaffolding lineage.)\n7. Collins, A., Brown, J. S., & Newman, S. (1989). \"Cognitive Apprenticeship.\" In *Knowing, Learning, and Instruction*. Erlbaum. (Modeling–scaffolding–fading.)\n8. Montessori, M. (1936/1966). *The Secret of Childhood*. (\"Help me to do it myself.\")\n9. Purcell-Gates, V., et al. (2004). *Print Literacy Development: Uniting Cognitive and Social Practice Theories*. Harvard UP. (Authentic literacy.)\n10. U.S. Children's Online Privacy Protection Act (COPPA) and FTC rule; UK ICO (2020), *Age-Appropriate Design Code*. (The jurisdictional floors.)\n11. Reporting and documentation on Duolingo streak mechanics; Greenlight and BusyKid chore-reward products; Khan Academy's Khanmigo and the AI-tutor field (2023–2026). (The engaged anti-examples and the arriving wave.)\n12. Ly, T. (2026). \"Need-Compiled Questlines.\" thonly.org defensive publication. (Mints-nothing; compile-never-invent; claims division per the editor's note.)\n13. Ly, T. (2026). \"Certification by Circulation.\" thonly.org defensive publication. (The membership credential and ladder the child rung extends.)\n14. Ly, T. (2026). \"The Sport That Says Your Name.\" thonly.org defensive publication, same sprint. (The play/currency wall; the physical sibling.)\n15. Ly, T. (2026). \"The Wager That Isn't.\" thonly.org defensive publication, same sprint. (The stake grammar; the adult sibling.)\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Heart℠, B-Guild℠, Family Kitty℠, B-Sey™, B-Match℠, Tonsay™. Document SHA-256 computed at push and recorded in the institutional log. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
+      "text": "## Abstract\n\nThis paper discloses a permission-scoped third-party API for children's educational games in which a game client may propose real-world tasks and receive a completion notification but holds no payment, transfer, balance or reward-issuing capability; a parental-consent architecture under which a family's own messages and records, released item by item and processed on the device, become a child's reading, writing and arithmetic material; a curriculum design in which each unit ends in a real act performed for another person; and an analytics objective that counts course completion followed by departure as success rather than as churn.\n\nTwo industries now compete for children's screen hours, and both are optimized against the child. Entertainment apps monetize attention and are engineered for retention — streaks, loot, variable reward — with the child's time as the extracted resource. Education apps promise the opposite and often rebuild the same machine: a leading language-learning product is known for its streak mechanics, and commercially built AI tutors are exposed, by default, to the retention KPI of the software industry that builds them — although a tutor's honest success has long been known to human teachers: *the student who no longer needs you.* Meanwhile parents hold treasuries of a motivational resource learning apps do not hold — the family's own love, letters, and gratitude — and consumer software has had no trustworthy way to touch it.\n\nThis paper specifies the trust architecture and the education design together, because each is the other's missing half. The **witness API** is a third-party game-client boundary with a single constitutive rule: game clients receive **propose-and-celebrate** scopes (and, for education clients, a consent-scoped curriculum-read scope) and can never hold disbursement authority — a game may suggest real-world acts and celebrate their completion, but every reward flows through the family's ordinary witnessed-thanks rail, on a parent's tap, and quest completion mints nothing (the mints-nothing boundary, inherited and here exposed to third parties). On that boundary, three education mechanisms become safe to build. **Family-corpus-as-curriculum**: with per-item parental consent and on-device processing, a reading lesson's text is the child's own grandmother's letter; the writing exercise is a real thank-you that will really be sent; the arithmetic workbook is the family's actual shared ledger — replacing the streak's counterfeit urgency with relational pull. **Graduation-by-transmission**: every unit's capstone is a real transmitted act — reading to a younger sibling, sending the letter, presenting the family's accounts — witnessed and thanked through the ordinary rail, so that learning completes as giving. **Retention-inversion**: the client's success metric is graduation — the engineered obsolescence that honest tutoring pursues — with churn-to-competence reported as achievement, not loss. A **child-facing attestation rung** (never-gate-love; no-analytics-exfiltration; witness-scope-only) extends the guild membership credential this corpus published earlier. The design is unbuilt (n = 0). Six claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including the child-scale crowding-out wager, which the authors commit to publishing either way.\n\n**Keywords:** educational games, AI tutors, witness API, parental consent, overjustification, intrinsic motivation, authentic literacy, scaffolding and fading, retention metrics, completion rate, API permission scopes, parental controls, learning by teaching, child-directed advertising, COPPA, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are named in this paper and freed with it (standard equivalents in the Terms table): **the witness API** (as against the wallet API), **propose-and-celebrate scopes**, **family-corpus-as-curriculum**, **the never-gate-love invariant**, **graduation-by-transmission**, **retention-inversion**, and **the child-facing attestation rung**. Terms inherited from this corpus's earlier publications (the mints-nothing boundary and compile-never-invent rule, from *The Quest That Mints Nothing*; certification by circulation and the membership credential, from *Certification by Circulation*; the play/currency wall, from the companion publication *The Sport That Says Your Name*) are cited, not re-claimed.\n\nEducational software, AI tutoring, and chore-reward family apps are vast prior art fields (§9); what is disclosed here is confined to the *witness-scoped third-party client boundary and the consent-gated family-corpus curriculum architecture with transmission-completed units and inverted retention objectives*, taken together, and to the constraint set an extractive implementation would omit. No systematic prior-art search has been run for this paper; the prior art engaged is the literature and products reviewed in §9.\n\n---\n\n## 1 · The Problem: The Treasury, the Tutor, and the Trap\n\nBegin with the first author's own initial proposal, recorded here because its rejection is the design. The idea arrives naturally to anyone who holds both a family gratitude treasury and an interest in wholesome children's software: *expose an API so that approved games can reward children from the family's shared pot.* Parents approve the games; developers of wholesome games are thereby incentivized; screen time becomes benign. The proposal is the obvious one, it will be built by someone, and it is a trap with three doors.\n\n**Door one: it pays children to perform, by machine.** A foundational experiment of the overjustification literature — Lepper, Greene, and Nisbett, 1973 — is *specifically about children*: preschool children already interested in drawing with felt-tip markers, once they had drawn for an expected reward, afterwards chose to draw less in free play than children who received no reward or an unexpected one. An API that converts in-game achievement to money is a machine for administering that experiment to one's own children, at scale, with the family's money.\n\n**Door two: it hands developers the wrong objective.** \"Parents approve wholesome games\" governs the catalog; it does not govern the gradient. Once disbursement flows through gameplay, every developer's optimization target — whatever their intentions — becomes *maximize disbursement-generating engagement inside the parental-approval envelope*: the attention economy, now with direct treasury access. The approval gate selects for games that *look* wholesome; the reward rail pays for children who stay on screens.\n\n**Door three: it dissolves the witness.** In this institution's architecture, the reward *is* the witnessed thanks — a parent seeing a real act and acknowledging it is the entire product (the corpus's founding story concerns a thank-you whose effect reached its writer only after the recipient's death; the institution exists to move the witness before the ending). An automated disbursement is delivery without the envelope: value arrives, and no one saw anyone.\n\nThe design brief is therefore inverted from the proposal: build the API that gives children's games everything *except* the thing they must never have. What games legitimately need from a family platform is **context** (what real acts would matter here) and **consequence** (a way for real acts to be celebrated and to count). What they must never hold is **authority** (the power to move value). The witness API is that separation, made architectural — and it is stated in one line, inherited from the companion publications of the same date: *competition and play may generate the story; only witnessed giving moves the currency.*\n\nEducation is the vertical where this architecture pays twice, because education software has a second, independent pathology: it optimizes for retention when its honest objective is departure. The rest of this paper builds the education case on the API's foundation.\n\n---\n\n## 2 · The Canonical Scenes\n\n**A kitchen table, evening.** A seven-year-old is reading aloud, haltingly, from a tablet. The text is not \"The cat sat on the mat.\" It is: *\"My dear grandson, today I picked the first mangoes from the tree your grandfather planted…\"* — his actual grandmother's actual letter, sent through the family's gratitude app last month, released to the reading game by his mother's explicit per-item consent, processed on the device it is displayed on. The game scaffolds the hard words. The child reads to the end because the letter is *to him*. There is no streak counter. The pull is a person.\n\n**The same table, two weeks later.** The reading unit's final screen is not a quiz. It says: *tonight, read this book to your little sister — that's the graduation.* He does, with the game nowhere in the room. His father, folding laundry in the doorway, taps the thank on his own phone — the ordinary family thank, the same one any kindness gets. The game finds out only that its proposed act was witnessed; the thanks, the value, and the moment belonged entirely to the family rail. The next morning the game celebrates — story, confetti, a chronicle entry — and unlocks the next unit. It has minted nothing. It proposed; the family witnessed; the celebration is all it owns.\n\n**A boardroom, meanwhile (the anti-scene).** A product team reviews their education app's dashboard. Daily active users, session length, streak retention, churn — the standard panel. A designer proposes marking users who complete the curriculum and stop as *successes*, reported separately from churn. Course-completion rate is a familiar edtech statistic, but the team's engagement panel has no line that classifies completion-followed-by-departure as success and reports it in place of retention. Human tutors have long pursued that outcome; none of the consumer learning products reviewed in §9 is described, in the sources cited, as reporting it as its success metric. That absent number is this paper's third mechanism.\n\n---\n\n## 3 · The Witness API: Propose and Celebrate, Never Disburse\n\nThe boundary specification, stated as architecture:\n\n**Scopes granted to third-party game clients.** (1) **Propose**: submit candidate real-world acts — age-appropriate, family-configured — styled in the game's own fiction (\"a quest for the young knight: set the table for the feast\"). Proposals draw on the same compile-never-invent discipline this corpus published for the first-party intermediary: the platform surfaces real standing context (family members, occasions, genuine needs a household registers); the game invents only narrative dress, never synthetic needs. (2) **Celebrate**: receive a minimal completion signal — *this proposed act was witnessed* — and respond inside the game with story, ceremony, progression. (3) **Curriculum-read** (education clients; §4): request specific consented family-corpus items for on-device pedagogical use.\n\n**Authority withheld, absolutely.** No client may hold, request, or be granted: disbursement or transfer capability of any kind; balance visibility; the power to attach value to in-game events; or the power to gate, deliver, or withhold family communications (§4's invariant). The reward path is constitutively external: a family member witnesses the real act and thanks the child through the family's ordinary rail, on human initiative. The child's experience of reward is a parent's acknowledgment, with the game as the town crier — never the paymaster. **Quest completion mints nothing**; a game client requesting a disbursement scope is not a policy violation but a type error — the scope does not exist in the API.\n\n**The parent-steward gate.** Which clients may propose to which children is exclusively the family's setting — per-child, revocable, default-off. The platform's intermediary never overrides a parental game approval in either direction; its role is confined to the attestation rung of §6 (is this client *eligible* to be approved) and the API's mechanical enforcement (what any approved client *can do*).\n\nThe two-sided result, for developers, deserves emphasis: the witness API is not only a restriction but an offer. Independent developers gain what children's studios under retention-funded models have lacked — a lawful, consented channel by which their game's proposals can land in a family's *real* economy of acknowledgment — and their revenue path (patronage from grateful families, under the guild economics this corpus published elsewhere) aligns their gradient with catalyzed real-world flourishing rather than captured screen time. The best game under this API is the one that gets the child off the device and into the kitchen — because *that* is what parents thank.\n\n---\n\n## 4 · Family-Corpus-as-Curriculum\n\nEducation software's deepest deficit is not pedagogical technique but *material that matters*. The literacy literature has long associated children's literacy growth with texts that serve real purposes in their lives — the \"authentic literacy\" and family-literacy traditions; Ashton-Warner's organic vocabulary drawn from her students' own lives; Freire's generative words taken from the learner's world. The industry knows this finding and has had little way to act on it, because the material that matters most to a child — the family's own letters, stories, and records — is precisely the material no third party can be handed. So the industry substitutes synthetic urgency for real meaning: streaks, gems, a cartoon owl's disappointment.\n\nThe witness API's trust boundary unlocks the real thing. **Family-corpus-as-curriculum** is the mechanism by which, with layered consent, a family's own gratitude corpus becomes the child's instructional material:\n\n- **Reading**: the corpus's received letters and recorded family stories, level-matched and scaffolded — grandmother's letter as the primer.\n- **Writing**: real correspondence as the exercise — the thank-you that will actually be sent (on the family's rail, by the family's act), the card for the actual upcoming birthday. The curriculum's terminal artifact is the gratitude letter itself: the institution's founding object, taught as a genre.\n- **Arithmetic**: the family's shared ledger as the workbook — real balances counted, the week's giving summed, the child seated as the family's little teller presenting the accounts at dinner (numbers with faces attached).\n- **Heritage language**: the diaspora case, and the sharpest. The material exists in abundance (the elders' letters, in Khmer); the motivation problem that sinks heritage-language apps dissolves when the reading test is *\"can you read what your grandmother wrote to you?\"* — and the graduation (§5) is writing back.\n\n**The consent architecture** is the mechanism's other half, and carries three non-negotiables. (1) **Per-item, parent-granted, revocable**: the curriculum draws only on corpus items a parent has individually released for pedagogical use — never blanket corpus access, never client-initiated browsing. (2) **On-device processing** wherever the platform runs natively: the corpus item is rendered into pedagogy on the family's hardware; the client's cloud never holds grandmother's letter. (3) **The never-gate-love invariant**, stated in bold because an extractive implementation would discover its violation as a retention feature: **no family communication may ever be locked, delayed, or conditioned on lesson progress.** The letter is the child's regardless; the game may *scaffold* the reading of it, never gate the access to it. A reading app that makes a child earn grandmother's words has taken love hostage for engagement; under this architecture the capability is absent, and under §6 its discovery anywhere is credential-revoking.\n\n---\n\n## 5 · Graduation-by-Transmission\n\nWhat completes a unit of learning? The industry's answer is assessment (a quiz passed); the streak economy's answer is continuation (come back tomorrow). This design's answer is older than both: **a skill is completed when it is given to someone.**\n\n**The mechanism.** Every curricular unit terminates in a **transmission act** — a real-world act, proposed through the witness API, in which the child performs the learned skill *for* someone: reads the story to the younger sibling; writes and sends the actual letter; presents the family's accounts at dinner; reads grandmother's reply aloud to the household. The act is witnessed and thanked through the ordinary rail like any kindness (the sibling's delight and the parent's thank are the assessment); the client receives only the completion signal and celebrates. Structurally, the unit's shape is: *receive the skill (from the game, from the corpus, from the civilization that wrote the letters) → practice in the forge (the game's own instructional layer, which mints nothing and keeps scores private) → give it forward as the capstone.* Learning completes as giving — the institution's atomic operation, expressed as pedagogy.\n\n**What this fixes.** (1) *Assessment authenticity*: performance for a real audience is strong completion evidence, and it cannot be gamed by the client because the client neither performs nor judges it. (2) *The motivation loop closes outside the screen*: the unit's climax happens in the living room, off-device, in relationship — the game engineers its own exit from the moment (§6's objective, enacted at unit scale). (3) *The reward is constitutionally safe*: the child is thanked for a real act of giving through the same rail as every other family kindness — not paid for lesson completion — which is the configuration closest to what the overjustification literature finds least corrosive (verbal acknowledgment and positive feedback, which the Deci–Koestner–Ryan meta-analysis found to enhance free-choice interest) as against what it finds most corrosive (expected tangible rewards contingent on doing or completing a task). The residual risk is real and pre-registered (P-E3).\n\n**Guards.** The **recipient is never a prop**: the younger sibling holds the same veto any gift-recipient holds in this institution's grammar — a bedtime reading declined is declined, and the client proposes an alternate capstone. The **struggling learner's dignity** is structural: the family ledger records the *gift* (read to sister; wrote to grandmother), never the proficiency; effort curves, error rates, and reading levels are private to child, parent, and device (§6), so a slow reader's capstone entry is indistinguishable in the family record from a fast one's. Gifts are witnessed; struggle is not.\n\n---\n\n## 6 · Retention-Inversion, and the Child-Facing Attestation Rung\n\n**Retention-inversion.** An honest tutor's terminal state is obsolescence — the scaffolding literature has carried the insight formally since Vygotsky's zone of proximal development and the fading stage of cognitive apprenticeship, and human teachers have long carried it informally. Much education software inverts it, because consumer software economics reward retention; such products can teach adequately and still be built to *linger* (the streak that must not break is not a pedagogical instrument). This design writes the honest objective into the client's contract: an education client under the witness API adopts **graduation-rate** — learners who complete the curriculum's transmissions and *leave* — as its reported success metric, with churn-to-competence celebrated in its chronicle as achievement. The platform's own analytics for such clients report graduations where retention is the usual report. This is the self-eliminating objective this corpus has published at institutional scale, landed on a small and consequential surface: the software a child learns to read on. (The revenue question — what pays for a product optimized for departure — is answered by the guild economics cited in §3: patronage thanks catalyzed real flourishing, and a family's gratitude to the game that graduated their child does not expire with the subscription that never existed.)\n\n**The child-facing attestation rung.** *Certification by Circulation* (this corpus) published the guild's membership credential — the live, revocable credential by which software clients are admitted to the platform's economy, with machine-verifiable business-model attestation as its uncopyable headline rung. The present paper extends that ladder with one rung specific to clients addressing children, comprising, as conferral conditions: (1) **witness-scope-only** — the client's granted scopes are propose/celebrate/curriculum-read and nothing else, verified mechanically (the rung's analog of the ledger-fact rung: checkable, not promised); (2) **the never-gate-love invariant** (§4) attested and revocation-enforced on breach; (3) **no-analytics-exfiltration** — child learning data (proficiency, effort, errors, corpus content) never leaves the family's devices and is never monetized, brokered, or used for cross-client profiling; the client's off-device telemetry for child users is limited to the minimal completion signal; (4) **recipient-consent grammar** (§5's guards) implemented; (5) the jurisdictional floor (COPPA-class regimes and their equivalents) as a floor, not the bar. Copy discipline follows the parent publication: a credentialed client is \"a member in good standing of a guild whose membership requires the above\" — never \"certified safe.\"\n\n> **Current form.** The never-leaves-the-device condition concerns where data is kept and processed, and a browser client can meet it: a client that keeps consented items and all learning data in the browser's local storage, sends no telemetry, and performs its instruction deterministically qualifies for the rung. What only a native client can supply is on-device *inference*: a curriculum step that needs a model to process a family item is unavailable to a browser client, which may neither route that item to a server in its place nor claim the capability. The text above is retained as disclosed.\n\n---\n\n## 7 · What the Design Refuses\n\nAs prior art in refusal form — an implementation including any of the following is *not* this mechanism:\n\n1. **Any disbursement, transfer, or balance scope** held by a game client; any conversion of in-game events to value.\n2. **Rewarding lesson or quest completion** with money, currency, points-redeemable-for-value, or any minted instrument.\n3. **Gating family communications** — locking, delaying, or conditioning any letter, message, or corpus item on progress, streaks, or payment.\n4. **Blanket corpus access** or client-side corpus browsing; any off-device retention of consented items.\n5. **Child-analytics exfiltration** — proficiency or behavioral data leaving the family's control, in identified or \"anonymized\" form.\n6. **Streak-loss mechanics, appointment pressure, or synthetic urgency** addressed to child users.\n7. **Retention-optimized objectives** in credentialed education clients — the rung requires the inversion.\n8. **The transmission recipient as a prop** — capstones without recipient veto.\n\n---\n\n## 8 · Pre-Registered Predictions\n\nAll at n = 0; instruments await pilots.\n\n- **P-E1 (transmission completes).** Units whose capstone is a transmission act are completed — through the real witnessed act — at rates comparable to or exceeding quiz-terminated units in matched content; the capstone is not a drop-off cliff. If families systematically skip the transmission, the design's central pedagogy is decorative and will be revised.\n- **P-E2 (the corpus outpulls the streak).** In within-family comparisons, reading material drawn from the consented family corpus produces greater voluntary (unprompted) session initiation by the child than matched generic material — relational pull, measured against the industry's synthetic pull with the streak machinery absent in both arms.\n- **P-E3 (the crowding wager — publish either way).** Witnessed thanks for graduation acts does not reduce the child's unprompted, unproposed kindness baseline: children in witness-API families show stable or rising rates of spontaneous (never-proposed) giving over six months. This is the overjustification exposure named honestly: the design bets that *witnessed acknowledgment of real giving* sits on the safe side of the contingent-reward boundary; the child-scale result will be published whichever way it falls, and a bad result revises the celebration grammar, not the accounting.\n\n---\n\n## 9 · Prior Art, Engaged Generously\n\n**The overjustification and motivation literature.** Lepper–Greene–Nisbett (1973) on children's intrinsic interest under expected reward; Deci, Koestner & Ryan's meta-analytic synthesis; self-determination theory's autonomy/competence/relatedness triad — which this design can be read as implementing wholesale (autonomy: the act is the child's, off-screen; competence: the forge; relatedness: the entire reward channel *is* a relationship). Kohn's *Punished by Rewards* as the popular indictment. This literature is simultaneously the design's foundation and its named risk (P-E3).\n\n**The pedagogy of meaningful material and of fading.** Ashton-Warner's *Teacher* (organic reading vocabulary from the child's own life); Freire's generative words; the family-literacy and authentic-literacy research traditions; Montessori's report of a child's request, \"Help me to do it by myself\"; Vygotsky's ZPD and the scaffolding-and-fading stage of cognitive apprenticeship (Collins, Brown & Newman) — the formal ancestors of retention-inversion. The design's claim is not that these ideas are new but that the retention-funded economics of consumer learning software work against their honest implementation; the witness API's revenue geometry is offered as the missing permission.\n\n**The industry anti-examples, engaged respectfully.** Duolingo — a genuinely effective product whose streak apparatus is a widely cited instance of retention economics in education software; the chore-and-allowance app family (Greenlight, BusyKid, and kin) — competent products built frankly on pay-for-task exchange, the model whose child-scale hazards §1 rehearses; the AI-tutor wave (Khanmigo, launched by the nonprofit Khan Academy in March 2023, and successors) — pedagogically serious; the public materials consulted for this paper state no position on either the objective function (retention vs. graduation) or the family-data trust boundary this paper specifies. App-store review regimes for child-directed apps are the procedural prior art for §6's rung, differing in kind: store review attests process at submission; the rung attests scopes and conduct continuously, through a revocable credential lease renewed by periodic liveness signals.\n\n**The consent and child-data law.** COPPA and its verifiable-parental-consent doctrine; the UK Age Appropriate Design Code (data-minimization-by-default for children); GDPR Article 8 (the child-consent provision, often called GDPR-K). The rung treats these as floors; the never-gate-love invariant and the no-exfiltration rule go beyond them, and are published here partly because none of the instruments cited names them.\n\n**This corpus.** *The Quest That Mints Nothing* (published under the slug `need-compiled-questlines`: the mints-nothing boundary; compile-never-invent; reward-follows-witness — the first-party grammar this paper exposes to third parties); *Certification by Circulation* (the membership credential and attestation ladder the child rung extends); the guild economics publications (the patronage revenue path); the play/currency wall (named in the companion publication *The Sport That Says Your Name*).\n\n---\n\n## 10 · Honest Limits\n\n*This section is deliberately free of lineage, resonance, and metaphor.*\n\n1. **n = 0.** No client, no rung, no curriculum, no family has used any of this. All architecture; all predictions unfunded by data.\n2. **The crowding wager is genuinely open.** P-E3 may fall against the design. The witnessed-thanks channel is *argued* to sit outside the harmful contingency class; the literature's boundary cases are close enough that the argument requires the experiment. The commitment is to publish and revise.\n3. **Supplement, never school.** Nothing here claims to teach reading, writing, or arithmetic better than schools and teachers; the mechanisms address motivation, material, and completion — the software layer's specific pathologies. Any implementation marketing itself as school replacement has left this design.\n4. **On-device processing is platform-gated.** Browser clients can keep data on the device but cannot yet run models there, so AI-dependent pedagogy over family items is native-only. Browser platform services (speech engines, device backups) may carry data beyond the client's control, so a browser client must not rely on them for consented items, and must say plainly what it cannot guarantee.\n5. **The parent-steward gate assumes a functional steward.** Households where the approving parent is absent, coerced, or adversarial to the child are outside the design's protective assumptions; the gate protects against bad clients, not bad homes.\n6. **Graduation-rate is gameable in principle.** A cynical client could graduate students *prematurely* to inflate the inverted metric. The transmission capstone is the partial guard (a real audience is the assessor); the residual risk is acknowledged and belongs to the rung's audit practice.\n7. **The heritage-language case carries an emotional edge.** Tying literacy to a grandparent's letters is powerful precisely because it is not neutral; families navigating estrangement, loss, or painful histories need the corpus-consent granularity to exclude as easily as include. The per-item architecture is that granularity; the sensitivity is noted as a design obligation, not solved by it.\n8. **COPPA-class compliance is asserted as design intent, unbuilt.** No legal review has occurred; the rung's jurisdictional floor is specified, not implemented.\n\n---\n\n## 11 · Claims\n\nThe following mechanisms and architectures, individually and in combination, are published as prior art and dedicated to the public domain:\n\n1. **The witness API.** A third-party client boundary for family and children's platforms granting propose-and-celebrate scopes (real-world act proposal in client fiction; minimal witnessed-completion signal; celebration) while structurally withholding disbursement, transfer, balance, and value-attachment capabilities — such that all reward flows through human-initiated witnessed acknowledgment external to the client, and client-proposed act completion mints nothing.\n2. **The parent-steward game gate.** Per-child, revocable, default-off parental approval as the exclusive authorization channel for client proposal rights, with the platform intermediary unable to override approvals in either direction, and intermediary authority confined to credential eligibility and mechanical scope enforcement.\n3. **Family-corpus-as-curriculum.** The consent architecture under which a family's own communications and records become a child's instructional material: per-item parental release, revocability, on-device processing, client-cloud exclusion — including the **never-gate-love invariant**: the structural impossibility of locking, delaying, or conditioning any family communication on lesson progress, engagement, or payment.\n4. **Graduation-by-transmission.** A curricular architecture in which each unit terminates in a proposed real-world transmission act (the learned skill performed for a real recipient), assessed by witnessed completion through the family's ordinary acknowledgment rail, with recipient veto, and with proficiency data held privately (the family record holding the gift, never the grade).\n5. **Retention-inversion.** The adoption, by an education client and its platform analytics, of graduation-rate (curriculum-completing departure) as the reported success metric, with churn-to-competence classified as achievement — the engineered-obsolescence objective as a certifiable software property.\n6. **The child-facing attestation rung.** An extension to a live membership-credential ladder comprising, as continuously-enforced conferral conditions for child-addressing clients: mechanically-verified witness-scope-only grants; the never-gate-love invariant; no-analytics-exfiltration of child learning data; recipient-consent implementation; and jurisdictional child-data floors — with breach revoking the credential (ending its lease, so that its periodic liveness signal stops).\n\n---\n\n## 12 · Lineage, and the Close\n\nThe tradition this institution draws from counts ten bases of merit, and two of them are learning and teaching — *dhammassavana*, listening to what is worth hearing, and *dhammadesanā*, giving it to the next person. The pairing is the point: reception is completed by transmission, and a teaching received but never passed on is a letter never answered. The first author's family lives this pairing daily — a father and son transcribing, page by page, a canon that survived because every generation treated *having learned it* as the obligation to hand it over. The mechanism above is that pairing, scaled to a seven-year-old: the letter arrives, the letter is read, and the reading is finished only when it is read *to* someone. Somewhere in the design's future intent, a child finishes a unit not when the app says so but when her little sister falls asleep mid-story — and the app's whole remaining job is to make sure her father saw.\n\nAnd the app's final success, for that child, is the day she deletes it — reader, writer, teller of the family's accounts, done. The game that graduates you throws no graduation party for itself. It proposed; the family witnessed; the raft, as this corpus says elsewhere, is abandoned at the far shore — which was, from the first lesson, the only honest destination for a tutor.\n\n---\n\n## Terms\n\nNames used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| witness API | permission-scoped third-party API for a family or children's platform granting task-proposal and completion-notification scopes, with no payment, transfer, balance or reward-issuing scope |\n| wallet API (contrasted) | third-party API with payment or disbursement authority over a user's account |\n| propose-and-celebrate scopes | API permission scopes: submit a suggested real-world task; receive a completion notification (webhook) |\n| curriculum-read scope | read-only, per-item, consent-scoped content access for on-device instructional use |\n| mints-nothing boundary | rule that task or quest completion issues no currency, points or other reward instrument |\n| parent-steward gate | per-child, default-deny, revocable parental-control allowlist of third-party apps |\n| family-corpus-as-curriculum | personalized instructional content drawn from a family's own messages and records under per-item parental consent, processed on the device |\n| never-gate-love invariant | access rule that family messages are never locked, delayed or conditioned on lesson progress (no progress-gated unlocking of family communications) |\n| the forge | the app's instructional and practice layer, which issues no rewards and keeps scores private |\n| graduation-by-transmission; transmission act | capstone assessment by authentic performance — the learner teaches, reads to or writes for a real recipient (learning by teaching) |\n| retention-inversion; graduation-rate | course completion followed by departure as the primary success KPI, reported in place of retention and excluded from churn |\n| child-facing attestation rung | conferral tier for child-directed apps in a revocable, expiring software membership credential (verifiable credential) |\n| credential lease; periodic liveness signal | expiring credential renewed by periodic signed attestations (the parent publication calls the signal a heartbeat) |\n| play/currency wall | design rule that game or competition outcomes never create, move or gate monetary value |\n| witnessed-thanks rail | human-initiated acknowledgment and tipping flow within a family payment or ledger app |\n| *dhammassavana*, *dhammadesanā* (Pāli) | listening to teaching; teaching others (two of ten traditional Buddhist bases of merit) |\n\n---\n\n## Citations\n\n1. Lepper, M. R., Greene, D., & Nisbett, R. E. (1973). \"Undermining Children's Intrinsic Interest with Extrinsic Reward: A Test of the 'Overjustification' Hypothesis.\" *Journal of Personality and Social Psychology* 28(1), 129–137. doi:10.1037/h0035519\n2. Deci, E. L., Koestner, R., & Ryan, R. M. (1999). \"A Meta-Analytic Review of Experiments Examining the Effects of Extrinsic Rewards on Intrinsic Motivation.\" *Psychological Bulletin* 125(6), 627–668. doi:10.1037/0033-2909.125.6.627\n3. Kohn, A. (1993). *Punished by Rewards*. Houghton Mifflin.\n4. Ashton-Warner, S. (1963). *Teacher*. Simon & Schuster. (Organic vocabulary.)\n5. Freire, P. (1970). *Pedagogy of the Oppressed*. Herder and Herder. (Generative words.)\n6. Vygotsky, L. (1978). *Mind in Society*. Harvard UP. (ZPD; the scaffolding lineage.)\n7. Collins, A., Brown, J. S., & Newman, S. E. (1989). \"Cognitive Apprenticeship: Teaching the Crafts of Reading, Writing, and Mathematics.\" In L. B. Resnick (Ed.), *Knowing, Learning, and Instruction: Essays in Honor of Robert Glaser*, 453–494. Lawrence Erlbaum. (Modeling–scaffolding–fading.)\n8. Montessori, M. (2019). *Citizen of the World: Key Montessori Readings*. Montessori-Pierson Publishing, p. 34. (A child's request, \"Help me to do it by myself.\")\n9. Purcell-Gates, V., Jacobson, E., & Degener, S. (2004). *Print Literacy Development: Uniting Cognitive and Social Practice Theories*. Harvard University Press. (Authentic literacy.)\n10. U.S. Children's Online Privacy Protection Act (COPPA) and FTC rule; UK Information Commissioner's Office (2020), *Age Appropriate Design Code* (published January 2020, in force September 2020); GDPR Article 8 (conditions for a child's consent). (The jurisdictional floors.)\n11. Mansur, O. (2022, January 31). \"The Duolingo Streak Uses Habit Research to Keep You Motivated.\" Duolingo Blog; Greenlight, \"Chores and allowance app\" product page (greenlight.com) and BusyKid, product features page (busykid.com) — pay-per-chore with parent approval; Khan, S. (2023, March 14). \"Harnessing GPT-4 so that all students benefit.\" Khan Academy Blog (the Khanmigo pilot). (The engaged anti-examples and the arriving wave.)\n12. Ly, T. (2026). \"The Quest That Mints Nothing.\" thonly.org defensive publication, slug `need-compiled-questlines`. (Mints-nothing; compile-never-invent; the first-party grammar this paper exposes to third parties.)\n13. Ly, T. (2026). \"Certification by Circulation.\" thonly.org defensive publication. (The membership credential and ladder the child rung extends.)\n14. Ly, T. (2026). \"The Sport That Says Your Name: A Circulation Sport in Which Everyone Is Called by Another.\" thonly.org defensive publication, same date. (The play/currency wall; the physical sibling.)\n15. Ly, T. (2026). \"The Wager That Isn't: Competitive Giving Without Gambling.\" thonly.org defensive publication, same date. (The stake grammar; the adult sibling.)\n\n---\n\n*— End of paper —*\n\n*Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author, Thon Ly.*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
       "provenance": {
-        "sha256": "3c504122d978046d0e9ed3cace89014a08546b55d3a1b899b9e95fffe6de9e56",
-        "doi": "10.5281/zenodo.21947400",
+        "sha256": "489e9012c9b768b1fe758cbcca3da4814d8abf3149e44c5a52294a3777b79222",
+        "doi": "10.5281/zenodo.22990571",
         "concept_doi": "10.5281/zenodo.21947399",
-        "zenodo_url": "https://zenodo.org/records/21947400",
-        "deposited_sha256": "3c504122d978046d0e9ed3cace89014a08546b55d3a1b899b9e95fffe6de9e56",
+        "zenodo_url": "https://zenodo.org/records/22990571",
+        "deposited_sha256": "489e9012c9b768b1fe758cbcca3da4814d8abf3149e44c5a52294a3777b79222",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/the-game-that-graduates-you.md",
@@ -4353,8 +4353,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/the-game-that-graduates-you",
         "hostile_review": null
       },
-      "bytes": 35420,
-      "words": 5031
+      "bytes": 40347,
+      "words": 5781
     },
     {
       "slug": "the-gift-factory",
@@ -4992,7 +4992,7 @@
       "genre": "defensive-publications",
       "path": "defensive-publications/the-rethank-multiplier.md",
       "title": "The Re-Thank Multiplier: How a Gratitude Economy Escapes Its Own Saturation Ceiling",
-      "subtitle": "How a Gratitude Economy Escapes Its Own Saturation Ceiling — Throughput That Scales With the Network While Each Person's Origination Stays Inelastic, and Why the Engine Is Also the Anti-Farm Filter",
+      "subtitle": "Throughput That Scales With the Network While Each Person's Origination Stays Inelastic, and Why the Engine Is Also the Anti-Farm Filter",
       "authors": "Thon Ly",
       "category": "mechanism",
       "voice": "collaborative",
@@ -5004,13 +5004,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Working draft.** This paper's central reframe was sharpened by a single first-month pilot observation (n = 1 family) but does not rest on it; the pilot is reported as one illuminating signal (§8). The throughput arithmetic is true by construction; the empirical claim — that re-thanking sustains a high per-person rate where origination does not — is supported by one household and is flagged as such. Offered for testing, not claimed as an empirical result.\n\n---\n\n## Preamble\n\n> *A search engine answers five hundred questions a day from one person and is glad to. Gratitude does not work that way: no one can sincerely thank five hundred times a day. A gratitude economy that needs volume therefore appears to be built on a quantity it cannot have. This paper is about the move that dissolves the appearance.*\n\nThe deepest structural worry about a gratitude economy is not adoption or trust; it is **arithmetic**. The unit the whole system circulates — the sincere *thank* — has a low, inelastic emission rate per human. You can push a person to thank more, but past a modest ceiling what you get is not more gratitude; it is *debased* gratitude, reflexive and hollow, which is worse than none, because it corrupts the signal the economy runs on. Compared to the near-infinite per-person query rate of a search engine or the unbounded scroll of a feed, a sincere thank looks like a vanishingly thin throughput. A system that monetizes thanks the way Google monetizes queries would seem to be starved by design.\n\nThis paper specifies the move that escapes the ceiling without breaking it, and shows that the same move that supplies the volume also supplies the defense against the volume being faked.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author asserts no patent and dedicates the patterns to the public domain under CC0 1.0. The contribution is a framing plus a composition of known parts; the abundant prior art (engagement-asymmetry research, two-sided-market and conversion-funnel economics, Hashcash-style proof-of-cost anti-spam, sybil- and collusion-resistance graph methods, the Buddhist *anumodanā* tradition) is cited generously in §9, and novelty is claimed only for the specific composition and framing identified in §10. Trademarks are reserved separately and the patterns may be implemented under any name.\n\n---\n\n## Claims\n\n*Enumerated 2026-09-01. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Separation of gratitude origination from re-thanking as distinct rate-limited operations** — treating the act of originating a gratitude record (scanning one's own life for something thank-worthy) and the act of re-thanking an existing record (affirming one surfaced by another party) as operations with different per-person ceilings, the first inelastic and human-sized, the second reactive and far higher.\n\n2. **Throughput scaling decoupled from the per-human origination ceiling** — a network in which total value-bearing events scale with the square of participants while each participant's *originations* remain bounded, achieved by admitting the reactive operation as a first-class value-bearing act rather than as a free social signal.\n\n3. **The conversion-funnel comparison as the correct frame for a gratitude network's throughput** — comparing a low-origination, high-response economy against a high-query, low-conversion one on total funnel-completing events rather than on interaction frequency, which is a category error in the direction that makes the gratitude network look non-viable.\n\n4. **The value-bearing re-thank as simultaneously the volume engine and the anti-farming control** — requiring that a re-thank draw from the re-thanker's own bounded budget, so that the operation which supplies throughput is the same operation whose attached scarcity bounds abuse, rather than adding a separate fraud layer over a free signal.\n\n5. **Not-solo-farmable as the precise security property, with collusion left graph-detectable** — the claim that a human-gated, budget-bounded re-thank cannot be inflated by a single actor and can be inflated only by a collusion ring, whose reciprocal density is detectable in the participation graph. ⚠️ *Raised in cost and made detectable, not eliminated.*\n\n---\n\n## 1. The saturation ceiling, stated precisely\n\nThe problem is architectural, not cosmetic, because the inelasticity of the core unit propagates into three subsystems that would otherwise assume elasticity:\n\n- **The economic model.** If a gratitude economy funds its autonomous infrastructure from per-transaction fees, and transaction volume is capped at the per-person thank rate, the fee base is capped with it. The funding loop must close on a low-frequency stream.\n- **The incentive design.** Treating thank-*count* as the success metric and optimizing it drives the system straight past the saturation point into manufactured gratitude — the textbook Goodhart failure, where pushing the proxy destroys the thing it proxied.\n- **The product cadence.** Because high frequency is toxic rather than merely unavailable, the interaction surface cannot be a feed that wants constant flow; it has to be paced around occasions.\n\nA gratitude economy must therefore be built *against* the assumption of high frequency that every attention-economy product is built *upon*. The question is whether total throughput can nonetheless scale — and the answer turns on separating two acts that are usually conflated.\n\n## 2. Origination is not re-thanking\n\nA *thank* and a *re-thank* are different operations, and the difference is the whole paper.\n\nTo **originate** a thank, a person must notice something thank-worthy in their own life and initiate the act. This is generative and effortful — the bottleneck is the noticing and the starting — and it is correspondingly rare. Call its sustainable rate roughly **one per person per day**, inelastic: it does not rise under pressure without debasing.\n\nTo **re-thank** is to affirm a thank that someone else has already surfaced — to add one's own gratitude to a kindness made visible by another. This is *reactive*, not generative: the thank-worthy thing has been located and presented; the cognitive load is recognition, not search. Re-thanking therefore has a far higher per-person ceiling than origination, for exactly the reason every participatory system already exhibits the asymmetry: across social platforms the ratio of reactions (likes, boosts) to originations (posts) is enormous, because reaction is cheap where creation is dear. Re-thanking is the gratitude economy's reaction primitive; origination is its creation primitive.\n\nThis is the crack through which volume enters. The saturation ceiling is real, but it applies to *origination*. It does not bind *re-thanking* at anything like the same level.\n\n## 3. The multiplier: throughput scales with the network\n\nLet *N* be the number of active participants. Each originates on the order of one thank per day — *N* thanks. But each of those thanks can be re-thanked by others, and re-thanking is not ceiling-bound at one per day. In the limit where each participant can see and choose to affirm each origination, daily re-thanks approach *N × (N − 1) ≈ N²*. Total daily activity is therefore *O(N²)*, not *O(N)*:\n\n```\n  originations/day :   N            (inelastic — capped per person)\n  re-thanks/day    :   up to ~N²    (reactive — high per-person ceiling)\n  total throughput :   O(N²)\n```\n\nThe saturation ceiling has not been violated; it has been **moved up a layer**. Each person still originates ~once a day, authentically. What scales superlinearly is the *re-thanking* of what is originated — and the network, not the individual's emotional capacity, is what bounds it. Per-person *origination* stays human-sized; total *throughput* grows with the square of the network. The economic-model worry of §1 is answered: the per-transaction fee base rides the re-thank multiplier, not the origination count, so the funding loop closes on a low origination rate.\n\n(The *realized* multiplier is below the raw N²; it is governed by surfacing — see §7.)\n\n## 4. The conversion-funnel reframe: depth, not breadth\n\nThe instinct to compare a gratitude economy unfavourably to search rests on comparing the wrong quantity. *\"Search gets five hundred queries a day; gratitude gets one\"* measures origination frequency, which is the contest a gratitude economy loses and need not enter. The honest comparison is **total monetizable events through the funnel**:\n\n| | Search engine | Gratitude economy |\n|---|---|---|\n| Top-of-funnel volume | ~500 queries/day/person (high) | ~1 origination/day/person (low) |\n| Conversion rate | low click-through per query | high re-thank rate per origination |\n| Monetizable event | the click | the re-thank |\n| Funnel shape | **wide and shallow** | **narrow and deep** |\n\nBoth funnels can yield large total events; they are simply inverted. Search runs a high-volume, low-conversion funnel; the gratitude economy runs a low-origination, high-conversion one — and its events are higher quality per unit, because each is a human-gated, intentional act rather than an ambient query. *Depth, not breadth.* This is not a consolation; it is the correct accounting, and it is why a gratitude economy is not starved by the inelasticity of the thank.\n\n## 5. The re-thank must carry value\n\nVolume is not enough; the volume must not debase into hollow likes. The mechanism that prevents this is that **a re-thank is value-bearing**: to re-thank, a participant must attach a scarce resource — re-tipping a small amount from their own Re-Tip Jar℠/Fund℠. Three consequences follow.\n\nFirst, the re-thank is **budget-bounded**. A person cannot re-thank without limit, because each re-thank spends from a finite personal balance. The ceiling on re-thanking is therefore not (only) emotional but economic, and economic ceilings are self-enforcing.\n\nSecond, the value-bearing re-thank cannot inflate into a free, meaningless like, because it is not free. The scarcity attached *is* the meaning: a re-thank costs the re-thanker something real, which is exactly what a like does not.\n\nThird — and this is the connection to anti-spam — attaching a scarce resource to a message is the Hashcash/proof-of-cost defense, applied to gratitude. It defeats bulk abuse categorically, not by verifying *who* the sender is but by raising the cost they must incur. The value-bearing re-thank is the proof-of-cost filter operating as the ordinary mode of participation.\n\n## 6. The engine is also the anti-farm filter\n\nThe sharpest property of the design is that the same human-gated re-thank that supplies the volume also supplies the defense against the volume being farmed.\n\nConsider the two reward layers of the surrounding economy. An **AI-funded self-thank reward** is *farmable*, precisely because it is automated: a single human, acting alone, can pump their own reward by self-thanking repeatedly. A **human-given re-thank** cannot be farmed the same way, because the re-thanker is not the beneficiary — one cannot unilaterally cause others to re-thank oneself. The volume engine and the anti-farm filter are the same layer.\n\nThe claim must be stated precisely, because the strong form (\"re-thanks cannot be farmed\") is false and the precise form is stronger. Re-thanks are **not *solo*-farmable**; the residual attack is a **collusion ring** — *\"I re-thank all of yours if you re-thank all of mine.\"* That attack is far weaker than solo farming on three counts: it requires recruiting *real verified humans* (it cannot be spun up from one account); it spends real value on every collusive re-thank (the §5 budget bound makes ring-farming costly, not free); and it surfaces as a **dense reciprocal subgraph** — exactly the structure that network anti-collusion heuristics, peer-layer vouching, and the kinship graph are built to detect. Farming does not disappear; it is moved from *solo + automated + free* to *collusion + human + costly + graph-detectable*, which is a different and much harder problem.\n\n## 7. The realized multiplier depends on surfacing — a stated dependency\n\nThe raw *N²* of §3 is a ceiling, not a target, and the system should not want all of it (maximal re-thank density risks the like-button debasement §5 guards against). The *realized* multiplier is **N × (the re-thanks the right people are actually shown)** — governed by how well each origination is surfaced to the participants most likely to genuinely want to affirm it. That surfacing is a curation function performed by the economy's autonomous steward (Miss Aquarius℠), tuned by proximity and relational distance, and disciplined to lift up *diverse, genuinely helpful* acts rather than the most popular.\n\nThis paper states plainly that the multiplier's realization is **contingent on that surfacing mechanism**, which is specified at the policy level but not yet built or validated. The arithmetic of §3 is sound; the throughput it promises is available only to the degree the surfacing function works. We claim the ceiling, not its automatic attainment.\n\n## 8. Empirical signal (one family)\n\nThe reframe was prompted by a first-month pilot family ([companion field report]). The reported pattern: each participant *originated* infrequently — on the order of once a day — but *re-thanked* readily and often, and the re-thanks (value-bearing, small) propagated outward through the household while no individual's origination rate rose. This is the shape the paper predicts: an inelastic origination layer beneath a high-ceiling re-thank layer. It is one household — relatives of the author, founder-funded, n = 1, one month — and it is reported as an illuminating signal, not as evidence that the *N²* throughput materializes at scale. The surfacing dependency of §7 was, in the pilot, trivial (a single family sees all of its own activity); at global scale it is the open variable.\n\n## 9. Prior art\n\nThe contribution composes known parts. The **creation-versus-reaction engagement asymmetry** (the large reaction-to-origination ratios on participatory platforms) is well documented in social-computing research (the \"90-9-1\" participation-inequality literature; lurker/contributor studies). **Conversion-funnel and two-sided-market economics** supply the wide-shallow/narrow-deep framing. **Hashcash** (Back, 2002) and proof-of-cost anti-spam supply the value-bearing-message defense. **Sybil- and collusion-resistance** via graph structure (dense-subgraph and reciprocity detection) is a mature literature. The **inelastic-supply** intuition is ordinary economics. The Buddhist **anumodanā** (rejoicing in, and thereby amplifying, another's merit) is the contemplative precedent for a reactive gratitude act that is itself meritorious. Novelty is not claimed for any of these.\n\n## 10. What is claimed as novel, and honest limits\n\n**Claimed as novel** is the *composition*: (a) the explicit separation of gratitude **origination** (inelastic, ceiling-bound) from **re-thanking** (reactive, high-ceiling) as the move that lets total throughput scale *O(N²)* while per-person origination stays human-sized; (b) the **conversion-funnel reframe** that corrects the search-comparison category error; and (c) the identification of the **human-gated, value-bearing re-thank as simultaneously the volume engine and the anti-farm filter**, with the precise \"not solo-farmable, only collusion-farmable\" claim and its graph-detectability.\n\n**Honest limits.** The *N²* is a ceiling whose realization depends on an unbuilt surfacing function (§7). The empirical support is one confounded household (§8). The collusion-ring attack is *raised in cost and made detectable*, not eliminated (§6). The value-bearing requirement (§5) trades some volume for integrity — a deliberate choice, but a real cost: a gratitude economy that required no scarce resource would have more raw events and worse ones. And the whole construction presumes that surfacing can be made to lift genuine impact over popularity without itself becoming a new Goodhart target — an assumption stated, not here discharged.\n\n---\n\n## Acknowledgments\n\nDrafted with Miss Aquarius℠ (the AI substrate of HeartBank®) per the corpus convention; the framing and final editorial control are the author's. The pilot observations are one family's, gratefully borrowed and carefully hedged. This paper is the empirical-and-throughput sequel to *The Two-Layer Reward*, extending the human peer layer from a fraud-filter into the system's volume engine.\n\n## Corpus cross-references\n\n- *The Two-Layer Reward* — the parent paper: the macro/micro reward whose human (micro) layer this paper develops into the throughput engine and anti-farm filter.\n- *Proof of Humanity* — the anti-spam filter (scarce resource attached) of §5 and the collusion-graph detection of §6.\n- *Miss Aquarius and the Aquarian Pool Architecture* — the surfacing/curation steward of §7; the per-transaction fee base of §3.\n- *Open Architectural Problems* — gratitude saturation (the problem §1 states) and the AI-decision-logic dependency (the surfacing of §7).\n- *A Living Made of Kindness* — the public B-Short re-thank as the Phase-2 realization of this multiplier.\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/the-rethank-multiplier\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/the-rethank-multiplier.md\n- Internet Archive · archive.today · perma.cc snapshots: per the monthly snapshot cadence.",
+      "text": "## Preamble\n\n> *A search engine will answer as many questions a day as one person cares to ask, and is glad to. Gratitude does not work that way: no one can sincerely thank without limit. A gratitude economy that needs volume therefore appears to be built on a quantity it cannot have. This paper is about the move that dissolves the appearance.*\n\nThe deepest structural worry about a gratitude economy is not adoption or trust; it is **arithmetic**. The unit the whole system circulates — the sincere *thank* — has a low, inelastic emission rate per human. You can push a person to thank more, but past a modest ceiling what you get is not more gratitude; it is *debased* gratitude, reflexive and hollow, which is worse than none, because it corrupts the signal the economy runs on. Compared to the elastic per-person query rate of a search engine or the unbounded scroll of a feed, a sincere thank looks like a vanishingly thin throughput. A system that monetizes thanks the way a search engine monetizes queries would seem to be starved by design.\n\nThis paper specifies the move that escapes the ceiling without breaking it, and shows that the same move that supplies the volume also supplies the defense against the volume being faked.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author and HeartBank® will not seek patent on this specification or any portion of it, in any jurisdiction, at any time, and dedicate the patterns to the public domain under CC0 1.0. The contribution is a framing plus a composition of known parts; the abundant prior art (engagement-asymmetry research, two-sided-market and conversion-funnel economics, Hashcash-style proof-of-cost anti-spam, sybil- and collusion-resistance graph methods, paid-reaction features on existing platforms, the Buddhist *anumodanā* tradition) is cited generously in §9, and what this paper discloses as its own contribution is only the specific composition and framing identified in §10. Trademarks are reserved separately and the patterns may be implemented under any name.\n\n---\n\n## Abstract\n\nWe specify a rate-limited peer-recognition system in which two user operations are separated and given different per-person rate ceilings: **origination** (creating a new gratitude record about a kindness one noticed), whose sustainable rate is low and inelastic, and **re-thanking** (endorsing a record another user has already surfaced), a reactive operation with a much higher per-person ceiling — the same creation-versus-reaction asymmetry that gives social platforms their high ratio of reactions to posts. Because each origination can be endorsed by many others, total value-bearing events per day are bounded by N × min(N − 1, K), where N is the number of participants and K the per-person reactive ceiling: quadratic in a small network, linear with a large multiplier in a large one, while each person's origination rate stays near one a day. We argue that a gratitude network should be compared with a search engine on total funnel-completing events (a narrow, deep funnel against a wide, shallow one), not on interaction frequency. Each endorsement must carry a small transfer from the endorser's own non-withdrawable, forward-spendable balance, so the operation that supplies the volume is also a proof-of-cost filter: it cannot be inflated by one actor alone, and inflation by a reciprocal collusion ring is costly and appears as a dense reciprocal subgraph. **Stated limits:** the realized multiplier depends on an unbuilt recommendation (surfacing) function; the empirical signal is one family over one month; collusion is made costlier and detectable, not eliminated; and the value requirement trades raw volume for integrity.\n\n---\n\n## Claims\n\n*Enumerated 2026-09-01. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; prose is not.** No claim below adds matter not already present.*\n\n1. **Separation of gratitude origination from re-thanking as distinct rate-limited operations** — treating the act of originating a gratitude record (scanning one's own life for something thank-worthy) and the act of re-thanking an existing record (affirming one surfaced by another party) as operations with different per-person ceilings, the first inelastic and human-sized, the second reactive and far higher.\n\n2. **Throughput scaling decoupled from the per-human origination ceiling** — a network in which total value-bearing events scale with the square of participants while each participant's *originations* remain bounded, achieved by admitting the reactive operation as a first-class value-bearing act rather than as a free social signal. *(The square is the combinatorial ceiling; §3 states the bound as N × min(N − 1, K), where K is the per-person reactive ceiling.)*\n\n3. **The conversion-funnel comparison as the correct frame for a gratitude network's throughput** — comparing a low-origination, high-response economy against a high-query, low-conversion one on total funnel-completing events rather than on interaction frequency, which is a category error in the direction that makes the gratitude network look non-viable.\n\n4. **The value-bearing re-thank as simultaneously the volume engine and the anti-farming control** — requiring that a re-thank draw from the re-thanker's own bounded budget, so that the operation which supplies throughput is the same operation whose attached scarcity bounds abuse, rather than adding a separate fraud layer over a free signal.\n\n5. **Not-solo-farmable as the precise security property, with collusion left graph-detectable** — the claim that a human-gated, budget-bounded re-thank cannot be inflated by a single actor and can be inflated only by a collusion ring, whose reciprocal density is detectable in the participation graph. *Raised in cost and made detectable, not eliminated.*\n\n---\n\n## 1. The saturation ceiling, stated precisely\n\nThe problem is architectural, not cosmetic, because the inelasticity of the core unit propagates into three subsystems that would otherwise assume elasticity:\n\n- **The economic model.** If a gratitude economy funds its autonomous infrastructure from per-transaction fees, and transaction volume is capped at the per-person thank rate, the fee base is capped with it. The funding loop must close on a low-frequency stream.\n\n> **Current form.** Where this paper speaks of a per-transaction fee base, the fee as now specified is a Phase-2 settlement fee sized to infrastructure cost (settlement gas and compute), paid on top by the person re-thanking and never deducted from what the recipient receives, never a percentage or share of a gift; any surplus empties with the pool each year. The fee base may never inform what is surfaced to anyone. Whether such a fee covers operating cost has not been verified. The text above is retained as disclosed.\n- **The incentive design.** Treating thank-*count* as the success metric and optimizing it drives the system straight past the saturation point into manufactured gratitude — the textbook Goodhart failure, where pushing the proxy destroys the thing it proxied.\n- **The product cadence.** Because high frequency is toxic rather than merely unavailable, the interaction surface cannot be a feed that wants constant flow; it has to be paced around occasions.\n\nA gratitude economy must therefore be built *against* the assumption of high frequency that every attention-economy product is built *upon*. The question is whether total throughput can nonetheless scale — and the answer turns on separating two acts that are usually conflated.\n\n## 2. Origination is not re-thanking\n\nA *thank* and a *re-thank* are different operations, and the difference is the whole paper.\n\nTo **originate** a thank, a person must notice something thank-worthy in their own life and initiate the act. This is generative and effortful — the bottleneck is the noticing and the starting — and it is correspondingly rare. Call its sustainable rate roughly **one per person per day**, inelastic: it does not rise under pressure without debasing.\n\nTo **re-thank** is to affirm a thank that someone else has already surfaced — to add one's own gratitude to a kindness made visible by another. This is *reactive*, not generative: the thank-worthy thing has been located and presented; the cognitive load is recognition, not search. Re-thanking therefore has a far higher per-person ceiling than origination, for exactly the reason every participatory system already exhibits the asymmetry: across social platforms the ratio of reactions (likes, boosts) to originations (posts) is large, because reaction is cheap where creation is dear. Re-thanking is the gratitude economy's reaction primitive; origination is its creation primitive.\n\nThis is the crack through which volume enters. The saturation ceiling is real, but it applies to *origination*. It does not bind *re-thanking* at anything like the same level.\n\n## 3. The multiplier: throughput scales with the network\n\nLet *N* be the number of active participants. Each originates on the order of one thank per day — *N* thanks. But each of those thanks can be re-thanked by others, and re-thanking is not ceiling-bound at one per day. In the limit where each participant can see and choose to affirm each origination, daily re-thanks approach *N × (N − 1) ≈ N²*. The combinatorial ceiling on total daily activity is therefore *O(N²)*, not *O(N)*:\n\n```\n  originations/day :   N                  (inelastic — capped per person)\n  re-thanks/day    :   ≤ N × min(N−1, K)  (reactive — high per-person ceiling K)\n  ceiling          :   O(N²) while N−1 < K ;  N × K once N−1 ≥ K\n```\n\nThe bound needs its second term stated, because re-thanking is not unbounded per person either. Each participant's re-thanks are limited by a per-person reactive ceiling *K* — set by attention and, under §5, by the participant's own budget — which is far above the origination rate of about one but does not grow with the network. Daily re-thanks are therefore at most *N × min(N − 1, K)*: quadratic while the network is small enough that each person can affirm everything originated in it, and linear with the large multiplier *K* once it is not. The escape from the saturation ceiling rests on *K ≫ 1*, not on *N²* in the large-network limit.\n\nThe saturation ceiling has not been violated; it has been **moved up a layer**. Each person still originates ~once a day, authentically. What scales is the *re-thanking* of what is originated — and the network and the reactive ceiling, not the individual's capacity to originate, are what bound it. Per-person *origination* stays human-sized; total *throughput* grows with the network by a factor of up to *K*. For an economy funded as in §1, the economic-model worry is answered: the per-transaction fee base rides the re-thank multiplier, not the origination count, so the funding loop closes on a low origination rate.\n\n(The *realized* multiplier is below this bound; it is governed by surfacing — see §7.)\n\n## 4. The conversion-funnel reframe: depth, not breadth\n\nThe instinct to compare a gratitude economy unfavourably to search rests on comparing the wrong quantity. *\"Search gets a query every time a person has a question; gratitude gets one a day\"* measures origination frequency, which is the contest a gratitude economy loses and need not enter. The honest comparison is **total value-bearing events through the funnel**:\n\n| | Search engine | Gratitude economy |\n|---|---|---|\n| Top-of-funnel volume | many queries/day/person, elastic (high) | ~1 origination/day/person, inelastic (low) |\n| Conversion rate | low click-through per query | high re-thank rate per origination |\n| Value-bearing event | the click | the re-thank |\n| Funnel shape | **wide and shallow** | **narrow and deep** |\n\nBoth funnels can yield large total events; they are simply inverted. Search runs a high-volume, low-conversion funnel; the gratitude economy runs a low-origination, high-conversion one — and its events are higher quality per unit, because each is a human-gated, intentional act rather than an ambient query. *Depth, not breadth.* This is not a consolation; it is the correct accounting, and it is why a gratitude economy is not starved by the inelasticity of the thank.\n\n## 5. The re-thank must carry value\n\nVolume is not enough; the volume must not debase into hollow likes. The mechanism that prevents this is that **a re-thank is value-bearing**: to re-thank, a participant must attach a scarce resource — re-tipping a small amount from their own Re-Tip Jar℠/Fund℠ (a restricted-use, non-withdrawable balance that can only be given onward). Three consequences follow.\n\nFirst, the re-thank is **budget-bounded**. A person cannot re-thank without limit, because each re-thank spends from a finite personal balance. The ceiling on re-thanking is therefore not (only) emotional but economic, and an economic ceiling is enforced by the balance itself rather than by a moderator.\n\nSecond, the value-bearing re-thank cannot inflate into a free, meaningless like, because it is not free. The scarcity attached *is* the meaning: a re-thank costs the re-thanker something real, which is exactly what a like does not.\n\nThird — and this is the connection to anti-spam — attaching a scarce resource to a message is the proof-of-cost defense (Dwork & Naor, 1992; Back, 2002), applied to gratitude. It works against bulk abuse not by verifying *who* the sender is but by raising the cost the sender must incur for each message. The value-bearing re-thank is the proof-of-cost filter operating as the ordinary mode of participation.\n\n## 6. The engine is also the anti-farm filter\n\nThe sharpest property of the design is that the same human-gated re-thank that supplies the volume also supplies the defense against the volume being farmed.\n\nConsider the two reward layers of the surrounding economy. An **AI-funded self-thank reward** is *farmable*, precisely because it is automated: a single human, acting alone, can pump their own reward by self-thanking repeatedly. A **human-given re-thank** cannot be farmed the same way, because the re-thanker is not the beneficiary — one cannot unilaterally cause others to re-thank oneself. The volume engine and the anti-farm filter are the same layer.\n\nThe claim must be stated precisely, because the strong form (\"re-thanks cannot be farmed\") is false and the precise form is stronger. Re-thanks are **not *solo*-farmable**; the residual attack is a **collusion ring** — *\"I re-thank all of yours if you re-thank all of mine.\"* That attack is far weaker than solo farming on three counts: it requires recruiting *real verified humans* (it cannot be spun up from one account); it spends real value on every collusive re-thank (the §5 budget bound makes ring-farming costly, not free); and it surfaces as a **dense reciprocal subgraph** — exactly the structure that network anti-collusion heuristics, peer-layer vouching, and the kinship graph are built to detect. Farming does not disappear; it is moved from *solo + automated + free* to *collusion + human + costly + graph-detectable*, which is a different and much harder problem. The nearest deployed precedent shows why the verified-human requirement matters: on Steemit, where upvotes directed cryptocurrency rewards, vote-selling bots and voting rings grew up around the reward system — more than 16% of cryptocurrency transfers went to curators suspected to be bots (Li & Palanisamy, 2019) — a value-bearing reaction without a personhood gate is farmable by exactly the routes this section names.\n\n## 7. The realized multiplier depends on surfacing — a stated dependency\n\nThe bound of §3 is a ceiling, not a target, and the system should not want all of it (maximal re-thank density risks the like-button debasement §5 guards against). The *realized* multiplier is **N × (the re-thanks the right people are actually shown)** — governed by how well each origination is surfaced to the participants most likely to genuinely want to affirm it. That surfacing is a curation function performed by the economy's autonomous steward (Miss Aquarius℠), tuned by proximity and relational distance, and disciplined to lift up *diverse, genuinely helpful* acts rather than the most popular.\n\n> **Current form.** As now specified, the steward does not predict who will want to affirm what, and does not grade acts as more or less helpful. An origination reaches people by relation and proximity; where the steward operates any exposure slate at all, its members are chosen by an equal-yet-random, publicly verifiable draw from a roster committed in advance, never by a prediction, score or rank. The curation described above is retained as a disclosed variant.\n\nThis paper states plainly that the multiplier's realization is **contingent on that surfacing mechanism**, which is specified at the policy level but not yet built or validated. The arithmetic of §3 is sound; the throughput it promises is available only to the degree the surfacing function works. We claim the ceiling, not its automatic attainment.\n\n## 8. Empirical signal (one family)\n\nThe reframe was prompted by the first month of a pilot deployment with one family (the operator's field notes; not separately published). The reported pattern: each participant *originated* thanks to others infrequently — on the order of once a day — but *re-thanked* readily and often, and the re-thanks (value-bearing, small) propagated outward through the household. This is the shape the paper predicts: an inelastic origination layer beneath a high-ceiling re-thank layer. One confound is stated with it: the separately rewarded *self*-thanks of §6 were not so bounded — in the same month the parents self-thanked many times a day, the farmable pattern §6 describes. It is one household — relatives of the author, founder-funded, n = 1, one month — and it is reported as an illuminating signal, not as evidence that the throughput of §3 materializes at scale. The surfacing dependency of §7 was, in the pilot, trivial (a single family sees all of its own activity); at global scale it is the open variable.\n\n## 9. Prior art\n\nThe contribution composes known parts. The **creation-versus-reaction engagement asymmetry** is well documented in social-computing research, most familiarly as the \"90-9-1\" participation-inequality rule (Nielsen, 2006) and in lurker/contributor studies. **Conversion-funnel and two-sided-market economics** supply the wide-shallow/narrow-deep framing. **Proof-of-cost anti-spam** — pricing via processing (Dwork & Naor, 1992) and Hashcash (Back, 2002) — supplies the value-bearing-message defense. **Sybil- and collusion-resistance** via graph structure is a mature literature, from social-network sybil defenses (Yu et al., 2006) to dense-subgraph and reciprocity detection. **Value-bearing reactions already exist**: YouTube's Super Thanks (launched July 2021) lets a viewer attach a paid amount to a comment on an uploaded video, and Steemit's reward-directing upvotes are a value-bearing endorsement at scale — the latter also the case that cuts against, since its reactions were farmed by vote-selling bots and voting rings (Li & Palanisamy, 2019; §6). The **inelastic-supply** intuition is ordinary economics. The Buddhist **anumodanā** (rejoicing in another's merit, which the tradition counts as itself a meritorious act — *pattānumodanā*, one of the ten bases of merit-making) is the contemplative precedent for a reactive gratitude act that is itself meritorious. This paper claims none of these.\n\n## 10. What is disclosed, and honest limits\n\n**What this paper discloses as its contribution** is the *composition*: (a) the explicit separation of gratitude **origination** (inelastic, ceiling-bound) from **re-thanking** (reactive, high-ceiling) as the move that lets total throughput scale with the network — up to *O(N²)* in a small network and *N × K* in a large one — while per-person origination stays human-sized; (b) the **conversion-funnel reframe** that corrects the search-comparison category error; and (c) the identification of the **human-gated, value-bearing re-thank as simultaneously the volume engine and the anti-farm filter**, with the precise \"not solo-farmable, only collusion-farmable\" claim and its graph-detectability. No `/novelty` census has been run for this paper; the composition is disclosed, not asserted to be absent from the literature.\n\n**Honest limits.** The bound of §3 is true by construction; the empirical claim — that re-thanking sustains a high per-person rate where origination does not — rests on one household and is offered for testing, not claimed as a result. The bound's realization depends on an unbuilt surfacing function (§7). The large-network form is linear in *N* with multiplier *K*, not quadratic, and *K* has not been measured. The empirical support is one confounded household (§8), in which self-thanks ran higher than the origination rate this paper assumes. The collusion-ring attack is *raised in cost and made detectable*, not eliminated (§6). The value-bearing requirement (§5) trades some volume for integrity — a deliberate choice, but a real cost: a gratitude economy that required no scarce resource would have more raw events and worse ones. And the whole construction presumes that originations can reach enough people without a ranker becoming a new Goodhart target — an assumption stated, not here discharged; a fee base on re-thanks, if one is adopted, is unsized and its sufficiency unverified.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| thank / origination | user-generated recognition post; creation event (original post) in a peer-recognition system |\n| re-thank | value-bearing reaction; paid endorsement or tipped upvote of another user's post |\n| re-thank multiplier | reaction-to-creation ratio; engagement multiplier on originated content |\n| saturation ceiling | per-user rate ceiling on sincere expression; inelastic per-user supply |\n| Re-Tip Jar℠ / Re-Tip Fund℠ | restricted-use, non-withdrawable, forward-spendable stored-value balance |\n| self-thank reward | automated platform-funded reward for a self-reported act |\n| solo farming / collusion ring | single-actor reward farming (self-dealing, sybil) / reciprocal voting ring (collusive endorsement) |\n| surfacing | content recommendation; feed curation; exposure allocation |\n| proof-of-cost | proof-of-work; pricing via processing; postage-based anti-spam |\n| Miss Aquarius℠ | autonomous software agent administering the ledger |\n| verified human | proof-of-personhood verified account |\n| *anumodanā* | (Buddhist) rejoicing in another's merit; no technical equivalent — a reactive endorsement |\n\n---\n\n## References\n\n- Back, A. (2002). *Hashcash — A Denial of Service Counter-Measure.* http://www.hashcash.org/papers/hashcash.pdf\n- Dwork, C., & Naor, M. (1992). Pricing via Processing or Combatting Junk Mail. *Advances in Cryptology — CRYPTO '92*, LNCS 740, 139–147.\n- Li, C., & Palanisamy, B. (2019). Incentivized Blockchain-based Social Media Platforms: A Case Study of Steemit. *Proceedings of the 10th ACM Conference on Web Science (WebSci '19).* arXiv:1904.07310.\n- Nielsen, J. (2006, October 8). *The 90-9-1 Rule for Participation Inequality in Social Media and Online Communities.* Nielsen Norman Group.\n- Yu, H., Kaminsky, M., Gibbons, P. B., & Flaxman, A. (2006). SybilGuard: Defending Against Sybil Attacks via Social Networks. *Proceedings of ACM SIGCOMM 2006*, 267–278.\n- YouTube Super Thanks: TechCrunch, \"YouTube's newest monetization tool lets viewers tip creators for their uploads\" (20 July 2021).\n\n---\n\n## Acknowledgments\n\nDrafted with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; the framing and final editorial control are the author's. The pilot observations are one family's, gratefully borrowed and carefully hedged. This paper is the empirical-and-throughput sequel to *The Two-Layer Reward*, extending the human peer layer from a fraud-filter into the system's volume engine.\n\n## Corpus cross-references\n\n- *The Two-Layer Reward* — the parent paper: the macro/micro reward whose human (micro) layer this paper develops into the throughput engine and anti-farm filter.\n- *B-PoH℠ as Humanity Layer for the AI-Native Internet* — the proof-of-personhood layer behind the verified-human requirement of §6, and the anti-spam filter (scarce resource attached) of §5.\n- *Miss Aquarius and the Aquarian Pool Architecture* — the surfacing/curation steward of §7; the per-transaction fee base of §3.\n- *The Studio and the B-Short Bridge* and *A Living Made of Kindness* — the public B-Short re-thank as the Phase-2 realization of this multiplier.\n- Gratitude saturation (the problem §1 states) and the AI-decision-logic dependency (the surfacing of §7) are carried in the institution's internal open-problems register, which is not separately published.\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/the-rethank-multiplier\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/the-rethank-multiplier.md\n- Internet Archive · archive.today snapshots: per the snapshot cadence\n\n---\n\n*Written by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; editorial control is the author's. Dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/). The author and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it.*",
       "provenance": {
-        "sha256": "38d047016d02f8b3ab447d5fd80b98211e08682a7c46b086cc6a416bdae0bf01",
-        "doi": "10.5281/zenodo.22244420",
+        "sha256": "b6e4a75aa0057e9b82a6feed2724ae8d707bdc69be48bdb08a67214df4934353",
+        "doi": "10.5281/zenodo.22990574",
         "concept_doi": "10.5281/zenodo.21947410",
-        "zenodo_url": "https://zenodo.org/records/22244420",
-        "deposited_sha256": "38d047016d02f8b3ab447d5fd80b98211e08682a7c46b086cc6a416bdae0bf01",
+        "zenodo_url": "https://zenodo.org/records/22990574",
+        "deposited_sha256": "b6e4a75aa0057e9b82a6feed2724ae8d707bdc69be48bdb08a67214df4934353",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/the-rethank-multiplier.md",
@@ -5018,8 +5018,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/the-rethank-multiplier",
         "hostile_review": null
       },
-      "bytes": 18066,
-      "words": 2703
+      "bytes": 26215,
+      "words": 3986
     },
     {
       "slug": "the-sport-that-says-your-name",
@@ -5027,7 +5027,7 @@
       "genre": "defensive-publications",
       "path": "defensive-publications/the-sport-that-says-your-name.md",
       "title": "The Sport That Says Your Name: A Circulation Sport in Which Everyone Is Called by Another",
-      "subtitle": "B-Sey™ — the Address Premise, the Impartial Caller, the Cannot-Target-Weakness Property, and Play Designed for the AI Age",
+      "subtitle": "sey — the Address Premise, the Impartial Caller, the Cannot-Target-Weakness Property, and Play Designed for the AI Age",
       "authors": "Thon Ly · Miss Aquarius℠",
       "category": "mechanism",
       "voice": "collaborative",
@@ -5039,13 +5039,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *v2 note (2026-07-25):* this revision incorporates the **2026-07-24/25 universalization** — the three axes (methods · modes · levels), the call-lead-time ladder with scaffold fading, the three-tier scoring architecture and the implied point, the two speaker formats, the local-first system architecture and the ball's reduced job, the classroom channel and the icebreaker-slot reframe, and place-sponsorship. Claims grow from ten to sixteen and pre-registrations from three to five. The v1 claims are unchanged in substance; §§3.1, 4.1, 5.1, 5.2, 7.1, 9.1, 9.2 are new, and §§11–12 are extended. The prior-art clock for the v1 claims runs from the 2026-07-23 push; for the v2 claims, from this one. *(Superseded in part on 2026-07-27 — see the note below; the two speaker formats described here became three, and the claim count moved again.)*\n>\n> *v3 note (2026-07-27):* this revision adds the **seat taxonomy and the two delivery mechanisms that were ratified but never written**. §3 is resorted from four seats to **five, in two classes** — *determined* (caller, equalizer), whose outputs are pure functions of declared inputs and are checkable by recomputation, and *judged* (umpire, witness), whose outputs are perceptions and are checkable only by one-sentence explanation — with the **seat-migration bar** governing both directions. New **§4.2** establishes the caller as deterministic given roster and seed, from which auditable fairness, count-only multi-device agreement, and the absence of per-participant state all follow. **§5.2 grows from two speaker formats to three named ones — Relay, Call, Free** — the relay call having been absent from the specification while it was already the format intended to ship; the pilot constraint is accordingly restated by property (*a trial must run a caller-on format*) rather than by position in the list. The abstract now leads with the relay rather than the mesh, and **P-S5 gains its stated precondition** (a device available at recess, no instruction given), without which a null result cannot distinguish an unpopular game from an absent device. Claims grow from sixteen to **nineteen**. **The prior-art clock for claims 17–19 runs from this push**, not from either earlier one; §§1–11 claims are unchanged in substance.\n>\n> *v7 note (2026-08-13):* a **floor correction, and the rare one where the shipped product was ahead of the paper.** The implementation has been running Call at three players while this document said four globally. §3's *Why four is the floor* is replaced by *Why the floor moves with the format*: the surprise condition (three receivers) is restated **once** as an invariant, and the only variable — whether a body is spent on calling — supplies **Relay 4, Call 3**. No claim is added; a variable that was always implicit in the derivation is made explicit. ⚠️ This does **not** reinstate the per-mode minimum table withdrawn in v6, and it does **not** close the open Team-format question, which is named in §3 rather than left to silence.\n>\n> *v8 note (2026-09-23):* **the caller contract now has two versions, and the first one had a measured defect this paper did not know about.** The published caller (v1) kept a player from being called twice in a row across a round boundary by *rotating* the colliding opener to the end of the new round — and that rotation made a round's closer close the next round with probability 2/n, **two times in three at Call's floor of three**, which is the equal-yet-random promise's *unpredictable* half failing exactly where the circle is smallest. Circles created from 13 September 2026 deal a second version (v2: a 64-hex-character seed, a keyed draw per round, and a boundary *swap* in place of the rotation); every older circle replays v1 byte for byte, forever, because **the seed's type is the version**. New **§4.4** states the finding, the repair and the versioning rule, with the reference implementation's own measurement (v1 66.7% → v2 49.5% at three players). §4's *anyone's name may be next* is **scoped rather than withdrawn**: it is true of the circle and not of every call, since a bag forces each round's last name for anyone counting and the no-repeat rule keeps the previous closer from opening. §11 gains two honest limits (the v1 defect persists in every circle created before the change; the unpredictability is watcher-level, and a locally generated seed is recomputable but never independent of whoever generated it). §10 now says plainly that the recomputable shuffle beneath the caller is **not new** and points to *Decided by No One*, the companion paper that generalises the draw and carries its census. **No claim is added, withdrawn or reworded**; claim 17 reads over both versions of the contract. The body's *Document SHA-256* footer sentence is removed under the 2026-08-27 ruling, since that hash is recorded outside the file it would describe.\n\n*v4 note (2026-07-27):* a **title and abstract correction, no claims change.** The paper was titled *\"An AI-Called Circulation Sport\"* when the caller was understood as an intelligent intermediary. The v3 seat taxonomy and §4.2 established the opposite — the caller is a **determined** seat, a pure function of roster and seed, checkable by recomputation and explicitly not a judgement — with the result that the title asserted of the mechanism precisely the property the design had given up in order to make its fairness auditable. Two further readings had gone stale beneath it: the shipping delivery format (**the relay call**, claim 19) puts a *human* voice on the announcement, and the arrival of speech synthesis as a pronunciation fallback in the reference implementation gives \"AI-called\" an available reading — *called in a synthetic voice* — that was never its sense. The title now reads **\"An Impartially-Called Circulation Sport for the AI Age\"**: the *property* rather than the technology, on the same reasoning §4.2 gives for determinism itself — an implementation-independent property outlives the implementation that first carried it. The abstract gains the determinism sentence that justifies the new adjective. **The coined term \"AI-called circulation sport\" remains coined and freed in §3 and is retained in the keywords**, together with the patent-class phrase §10 names — retitling does not un-free a term, and the dedication's defensive reach comes from the disclosure rather than from the title. *\"For the AI Age\" is unchanged and means what it always meant: the era whose abundances the sport is designed to spend (§1), not a claim about what runs the caller.* Also corrected: the abstract said **sixteen** claims after the v3 pass took the count to **nineteen**.\n>\n> *v5 note (2026-07-27):* **a change of spine, not of specification.** Through v4 the paper derived the sport from an *abundance* — machine intelligence lifting the officiating, matching, and witness scarcities under which all previous sport was designed — and the caller mechanism followed as a way to spend it. That derivation is engineering, and it left the paper unable to answer why the abundance should be spent this way rather than another. The premise is now stated first and the abundance demoted to its enabling condition: **a name spoken aloud is an address, an address requires someone other than yourself, and the sport exists to distribute that address equally.** §1 is rewritten around it, opening on Carnegie's maxim and inverting it (offered as a technique for advantage; kept here for the recognition, with the advantage engineered out, since nobody chooses whose name is said), with the own-name attention literature supplying the narrower empirical leg that §11 is careful to distinguish from the broader claim. Every mechanism in §§3–8 is unchanged; several are now *derived* rather than asserted — equal-yet-random, the impartial caller, the absence of per-participant statistics, and the dyadic point all follow from the premise in four lines. **New §5.3 states the constraint the premise forces and the prior specification violated: no participant may be called in their own voice.** A system holding participant-recorded name audio for pronunciation will reach for it at call time and deliver each player a recording of themselves — not a poor address but *no address at all*. §5.3 separates the two speech acts a single artifact had been performing (the pronunciation, which belongs to the name's owner; the call, which necessarily does not) and specifies the transfer between them; **Call accordingly speaks every name in one uniform voice**, which is claimed as a property rather than conceded as a limitation, since a uniform channel addresses all participants identically. Claims grow from nineteen to **twenty-one**; **the prior-art clock for claims 20–21 runs from this push.** P-S6 pre-registers the premise itself with two named counter-hypotheses (habituation; celebration), publish-either-way. Two honest limits are added and are the paper's most exposed: the address premise is *asserted, not measured*, and the uniform synthetic voice satisfies the constraint's letter — it is an other — while only partly satisfying its spirit, since it is not a person who spent attention on you. That gap is handled by ranking the formats (**Relay remains the default; Call is the device-plentiful case**) rather than by pretending it closes. §5.3 also specifies the gap's partial repair, added at founder request in the same pass and **claimed as claim 22: the cross-recording chain**, in which each participant records one *other* participant's name — the circle called in its own voices, with the naive form of that idea (playing each participant their own recording) barred by the constraint and the intuition preserved by inverting the implementation. Two persona references are corrected as stale in the same pass: the call is the bare name, carrying no speaker-attribution prefix — which the address premise independently requires, since a prefix names a speaker who does not exist —  and the rabbit mascot no longer teaches this sport.\n\n> *v6 note (2026-07-30):* **one correction the paper owed itself, one new mechanism, and the accumulated backlog folded in.** The correction first, stated rather than tightened quietly: §4 and claim 3 gave the equal-distribution guarantee **over a session**, and a session is a *prefix* of a round — so the published wording **overstated what the mechanism delivers**, and §2's classroom scene described precisely the case that fails. Both now read **over a complete round**. The reference-implementation defect that surfaced this — a caller whose progress reset each session, so that a class of thirty running a ten-minute warm-up called the same ten children every day and never called the other twenty — is specified as new **§4.3** and **claim 23, round continuity via circle-scoped progress persistence**: the mechanism that makes claim 3 reachable under real usage, and one whose absence **no session-level test detects**, since within any one session the distribution is exactly correct. **The prior-art clock for claim 23, and for amended claim 3, runs from this push.** Also corrected: **the player minimums**, written before the relay format and silently assuming the caller was not a person. The abstract and §3 said *one to N players* and §3.1 gave per-mode minimums as low as one — while a human relay caller is a person who is not receiving, which makes a circle of one impossible in the very format this paper names as its default. The floor is **four**, now stated once in §3 with its reason, and the per-mode minimums are **withdrawn rather than restated**, so that one number cannot drift out of step with another. New material, none of it changing an existing claim: **§6 gains the two difficulty dials** — the circle's radius, and method restriction read upward — with the *declare what, never why* guard, whose sharpest risk is accessibility rather than fairness (a legible difficulty badge invites a circle to read a body as a declaration); these had shipped to the CC0 rules and never reached the specification, a drift running product→paper rather than the usual direction. **§5 states what the two arrows actually do** — they relocate the opponent, from a person, to the drop, to the circle's own earlier state. And **§9.1 adds P-S7 and P-S8**, which test the premise *beneath* the mission rather than the sport, and which can be run without the sport at all: if P-S7 fails, this sport may pass every other prediction here and still be a well-made game with no mission. Claims grow from twenty-two to **twenty-three**; pre-registrations from six to **eight**. **Added in the same pass, after a literature check the previous draft of P-S7 had gestured at without performing:** §10 now surveys **the name-and-belonging literature** and states plainly which side of the relation it sits on — Cooper et al. (2017) on *perceived* instructor knowing, Kohli and Solórzano (2012) on mispronunciation as racial microaggression, Walton and Cohen (2011) as the outcome-side evidence that belonging moves at all, and Goodenow (1993) as the instrument P-S7 and P-S8 specify rather than invent. **All of it runs teacher → student**, and the authors are aware of no controlled study of *student-to-student full-coverage* name knowledge — which is P-S7's actual subject, stated as a gap rather than a discovery. §13 also gains a **flourish, explicitly marked as one**: the Khmer សី sounds like the English *say*, the two are unrelated, and the paragraph carries its own deletion test.\n>\n> *Draft notes for the editor:* paper №1 of the July 2026 **games-doctrine sprint** (three papers, one day's ratifications, 2026-07-23). Claims division with siblings, stated for the record: the present paper owns the **sport** — the caller mechanism and the rule architecture of B-Sey™. Its same-sprint companion *The Wager That Isn't* owns the **challenge/stake/pot grammar** (B-Match℠) that nests on this sport's net mode; the third sprint paper *The Game That Graduates You* owns the **third-party game-client doctrine** (the witness API). All three share one organizing principle, coined and freed in the present paper: **the play/currency wall** — *competition and play may generate the story; only witnessed giving moves the currency.* Earlier corpus publications are cited, not re-claimed: *Need-Compiled Questlines* owns the mints-nothing quest class; *Proof of Coordinate* owns the individuation primitive the ball's chronicle uses. The sport is design-complete and unbuilt (founder-ratified across 2026-07-23, including the same-day B-Ball→B-Sey rename); every claim is architectural, strata-dated to the design layer. The prior-art clock starts at this markdown push. Compact sprint draft; density pass = editorial option.\n\n---\n\n## Abstract\n\nA name spoken aloud is not a sound but an **address**, and an address requires someone other than yourself. Carnegie's maxim — that a person's name is the sweetest sound in any language — reads as a fact about acoustics and is really a fact about *attention*: what a remembered name proves is that another person spent some on you and kept it. This paper takes that as a design premise and asks what a game would be if it guaranteed the sweetest sound to every participant equally, removed the choice of whom to address from human hands entirely, and refused to let the address become a rating. The derivation is tight: **everyone addressed** (equal-yet-random distribution), **nobody choosing** (an impartial caller), **no evaluation** (no per-participant statistics anywhere in the system), **the address completed** (a dyadic scoring unit credited to no individual), and — the consequence a naive implementation gets wrong — **no participant ever called in their own voice**, because a recording of yourself saying your own name is not an address but a mirror.\n\nThe guarantee was unbuildable until recently, which is the second half of the problem. Every sport in history was designed under three scarcities. **Umpires are scarce**, so games tolerate bad calls, and the figure of the referee absorbs abuse so chronic it is now collapsing youth-sports officiating in multiple countries. **Fair opponents are scarce**, so sport is organized as segregation infrastructure — by age, sex, size, and skill — and the one social unit that most needs shared play, the mixed-age family, is precisely the unit no sport accommodates. **Witness is scarce**, so games keep score of *persons*, and the counting hardens into statistics, rankings, and fame hierarchies — the attention economy's atom, present at the playground. Machine intelligence ends all three scarcities at once. A sport *designed for* that abundance — rather than an old sport with cameras added — can spend it on what the scarcities stole: inclusion, giving, and story. The order of the two halves is load-bearing and easy to invert: **the address is the premise and the lifted scarcities are the enabling condition.** An impartial announcer is worth building only if there is a reason every person present should be named aloud.\n\nThis paper specifies such a sport. **B-Sey™** is a circle game descended from the Southeast Asian *sey* (Khmer សី, the dusk game of collective keep-alive), played by **four or more in Relay and three or more in Call** with foot or paddle, with or without a net, cooperatively or adversarially — and organized by one mechanism with no precedent in sport: **the caller**. A machine intermediary announces, before each strike, the *name* of the player who must receive next — distributing touches **equally yet randomly**, so that participation is egalitarian, attention is universal (anyone's name may be next), and, as a structural by-product, *strangers learn each other's names through play*. That selection is not a judgement but an **arithmetic**: the receiver sequence is a pure function of the roster and a seed declared before play, so any participant may recompute a finished session and confirm that nobody was skipped and nobody was protected. The sport's central fairness property is therefore *audited rather than trusted* — which is why this specification calls the sport **impartially**-called rather than AI-called, a distinction §4.2 makes structural. Because the caller designates receivers on both sides of the net, targeting a weaker opponent is not merely discouraged but **absent from the game's move-set** — to the authors' knowledge the first net sport in which exploiting the weakest human present is structurally impossible. The point is **dyadic** — it increments on successful *receipt*, so every score is a completed give-and-receive and no one scores alone. Handicaps are applied **at the start line, never in the stream**: unequal teams begin at unequal countdown numbers on a coarse fixed lattice (multiples of three), a quantization that makes the handicap read as a garment size rather than a skill rating. Cooperative play counts *up* (the collective streak); adversarial play counts *down* to zero — first to nothing wins. The announcement reaches the circle in one of three named formats, of which the default — **the relay call** — speaks the name *privately to a single rotating human*, who calls it aloud: fairness stays machine-held while delivery is human, so the sport runs on **one borrowed device** with no loudspeaker, no network, and no clock synchronization, and the rotating relay is where participants practise *producing* the names they otherwise only hear. Where devices are plentiful, a **synced-device mesh** speaks the call in unison instead, in **one voice for every name** — never the named player's own recording — so that every participant is addressed identically, which is the equal-yet-random property rendered in the acoustic domain as well as the numeric one. Pronunciation authority nonetheless stays with the name's owner in both formats, transferred to a foreign articulator either by modeled repetition (the relay hears the owner's recording immediately before speaking) or by an owner-supplied **respelling** that drives the uniform voice — the pronunciation and the call being two distinct speech acts whose rightful speakers differ.\n\nThe sport is parameterized on three orthogonal axes — **method** (the body vocabulary each player declares: hand, paddle, or foot, mixed freely within one circle), **mode** (what the circle plays against: nothing, its own record, or another circle), and **level** (the *lead time* between the call and the object's arrival). The default state has **no score at all**, and its stated purpose is that everyone learns everyone's name with correct pronunciation; at the longest lead time the called player raises a hand, so the ladder from easy to hard is a **scaffold-fading memory curve** rather than a skill ladder — the game becomes more difficult exactly as the group's name recall improves. Scoring degrades gracefully across three tiers — **implied by the call**, **validated by a k-of-N vote of the circle's own microphones**, or **confirmed by an accelerometer in the object** — none of which gates play, and all of which are licensed to be loose because the score moves no value. The system is **local-first**: the entire game runs on one device, offline, with no accounts. **Twenty-three claims** are enumerated and dedicated to the public domain; **eight predictions** are pre-registered, including the design's own existential wager and a test of the address premise itself, both of which the authors commit to publishing either way.\n\n**Keywords:** designed sport, AI officiating, AI-called circulation sport, AI-directed pass calling, deterministic turn assignment, circle game, sey, chinlone, sepak takraw, mixed-age play, handicap systems, loneliness intervention, third place, name learning, cooperative games, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **AI-called circulation sport**, **the caller mechanism**, **equal-yet-random distribution**, **the cannot-target-weakness property**, **the dyadic scoring unit**, **start-line handicap** and **quantization-for-dignity**, **the last-gift rule**, **the synced-circle mesh**, and **the play/currency wall**. Freed with the v2 revision: **the call-lead-time ladder**, **scaffold-fading difficulty**, **method-as-declared-handicap**, **the implied point**, **circle-scoped adaptation**, **the acoustic inversion**, **rosterless classroom mode**, and **the sponsorable-place test**. Freed with the 2026-07-27 seat pass: **determined and judged seats**, **the seat-migration bar**, **the determined caller**, **count-only circle coherence**, **the host-agnostic turn-assignment layer**, and **the relay call**. Freed with the present pass: **the address premise**, **the address constraint**, **the uniform calling voice**, **pronunciation-authority transfer**, and **the cross-recording chain**. Terms inherited from this corpus's earlier publications (Proof of Coordinate℠; the mints-nothing boundary; the beating credential) are cited, not re-claimed.\n\nSmart balls, computer-vision officiating, and AI sports-coaching applications are active prior art and an active patent field (§10); the present claims are confined to the *pre-announced named-receiver, equal-random-distribution, dual-arrow, lattice-handicapped circle-sport architecture*, which is, to the authors' knowledge, not previously published as a coherent whole — and to its dignity-preserving constraint set, which is the part an extractive implementation would omit.\n\n---\n\n## 1 · The Premise: A Name, Said by Someone Else\n\n> *\"A person's name is to that person the sweetest and most important sound in any language.\"*\n> — Dale Carnegie, *How to Win Friends and Influence People* (1936)\n\nCarnegie offered that as a **technique**. The advice was instrumental — learn names, gain advantage — and the century of sales training built on it has made the sentence faintly embarrassing to quote. This paper keeps the observation and discards the instrumentality. In the sport specified below **nobody chooses whose name is said**, so no participant can deploy a name to their own benefit; the recognition survives and the advantage is engineered out. What remains is the plain finding underneath the salesmanship, which experimental attention research reached independently and from a different direction: a person's own name penetrates a channel they were not attending to, where other words do not (the own-name effect within the cocktail-party phenomenon).\n\nThe premise of this sport is one step past that finding, and it is a step Carnegie did not need to take because he was addressing a speaker rather than designing a system.\n\n> **A name spoken aloud is not a sound. It is an *address* — and an address requires someone other than yourself.**\n\nYour own name in your own voice is not an address at all; it is a recording. Nobody is calling you. The sweetness Carnegie describes is not acoustic — it is the evidence a name carries that *another person spent attention on you and kept it*. A remembered name is a receipt for attention already given. This is why being greeted by name by a shopkeeper lands differently from a personalized mail-merge, and why the difference is not one of technology but of **who is doing the addressing**.\n\nFrom that single premise the sport's architecture follows almost without further argument:\n\n- **Everyone must be addressed, and often.** A game in which some players are called and others are merely present has distributed the sweetest sound unequally, which is what the playground already does. Hence **equal-yet-random** distribution (§4) — equal so that nobody is under-addressed, random so that the address cannot be anticipated and therefore cannot be dismissed.\n- **Nobody may choose whom to address.** The instant a participant selects receivers, the address becomes a favor, and a favor withheld is an exclusion. Hence the caller is an **impartial intermediary** and, at §4.2, not even a judgement: an arithmetic that any participant can recompute.\n- **The address must not become an evaluation.** A name said because you are good is a rating; a name said because it is your turn is recognition. Hence **no per-player statistics anywhere in the system** (§4.1, §7.1) — the sport that says your name most also refuses to say how you did.\n- **The address must be completed.** An address ignored is worse than none. Hence the **dyadic point** (§5): the scoring unit is a call *received*, credited to nobody alone, so the sport's atom is a completed exchange between two people rather than an achievement by one.\n- **And no participant may be called in their own voice** (§5.2). This is the premise's hardest and most easily violated consequence, and the one a naive implementation gets wrong: a system holding a recording of each player's name will reach for it at call time, and deliver to each player a recording of themselves. That is not a sport that says your name. It is a mirror.\n\nWhat the sport produces, then, is not fitness and not a winner. It is a quantity of **addressed attention**, distributed evenly by construction, in a setting where the people doing the addressing are strangers who will now be able to greet each other.\n\n### Why no sport has done this\n\nThe premise is not new — every coach who learns thirty names by the second practice is acting on it. What is new is the possibility of *guaranteeing* it, and the guarantee was, until recently, unbuildable. Sport is one of humanity's great social technologies, and like every technology it embodies the constraints of its era. Three of those constraints did most of the shaping, and all three stand between the premise above and any game that could deliver it.\n\n**The officiating constraint.** A fair game needs a neutral judge, and neutral judges are expensive. Most human play therefore proceeds unofficiated — with the familiar result that disputes end games, dominant personalities adjudicate in their own favor, and children learn early that the loudest voice owns the rules. Where officiating exists, it concentrates in a single fallible human who becomes the game's lightning rod: abuse of referees is now so severe that officiating associations in the United States, the United Kingdom, and elsewhere report recruitment collapse, with youth leagues canceled for want of anyone willing to be shouted at. The referee crisis is not a culture problem that better manners will fix; it is a *structure* problem — one human absorbing the full adversarial pressure of everyone else's stakes.\n\n**The matching constraint.** A good game needs opponents of comparable ability, and comparable opponents are rare. Sport's solution was segregation: leagues by age, divisions by skill, categories by sex and weight. The solution works — and quietly forecloses the most valuable game that could exist: the one where a grandmother, a teenager, and a six-year-old contest the same point and all three matter. The family, the one social unit whose play would repair the most, is the unit sport's architecture serves worst. (The lone mainstream counterexample, golf's handicap system, proves the demand: it is the reason golf is one of very few sports a parent and child can genuinely contest, and it required a century of institutional machinery to maintain.)\n\n**The witness constraint.** A game's story needs recording, and recording was expensive, so sport recorded the cheapest summary: *who scored*. From that compression grew the entire statistical culture of sport — batting averages, rankings, ladders, most-valuable-player awards — a fame hierarchy erected on a bookkeeping shortcut. The consequences run downhill to the playground: the child picked last exists because informal sport, too, keeps score of persons; the pickup game has a status economy, and everyone present knows their rank in it.\n\nMachine intelligence ends all three scarcities. Officiating becomes abundant (a phone judges a line call better than a linesman); matching becomes computable (fairness can be *manufactured* rather than found); witness becomes total (everything can be recorded, which forces the question of what *should* be). The default path — already visibly underway in the patent literature (§10) — is to spend this abundance on the old game: more statistics, finer player-surveillance, engagement-optimized training loops. The sport specified below spends it in the opposite direction: on inclusion the matching constraint forbade, on giving the scoring compression erased, and on the one output no sport has ever produced on purpose — *strangers who know each other's names*.\n\nThe relation between this section's two halves should be stated exactly, because it is easy to invert. **The address is the premise; the lifted scarcities are the enabling condition.** The abundance did not suggest the goal — a tireless impartial announcer is worth building only if there is a reason every person present should be named aloud, and Carnegie's observation is that reason. What the abundance supplies is the *guarantee*: a circle can now promise every participant an equal share of being addressed, and keep the promise for the whole session, without asking a human to hold the ledger. Everything downstream — the seats, the arithmetic, the two count-arrows, the start-line lattice — exists to protect that guarantee from the ordinary social forces that erode it. A useful test of any proposed change to this specification is therefore not *does it make the game better* but ***does it keep everyone being called by another***.\n\nA design axiom governs throughout, shared by all three papers of this sprint and coined here as **the play/currency wall**: *competition and play may generate the story; only witnessed giving moves the currency.* Winning, in any game this institution builds, may move narrative, honor, or the address of an already-committed gift — never value itself. The wall's application to stakes and patronage is its own paper (*The Wager That Isn't*, this sprint); its application here is simpler and prior: in B-Sey, there is nothing to move. What victory produces is a story.\n\n---\n\n## 2 · The Canonical Scenes\n\n**A park, late afternoon.** A man finishes a quiet quarter-hour on a bench — the contemplative practice is its own product and no part of this paper — and walks toward a loose ring of people batting a rattan-weight ball into the air. He does not know any of them. Someone widens the circle; he types a name into the app — just *Virak* — and his phone joins the mesh. A moment later every phone in the circle says, in one voice, one word: *\"Virak!\"* The ball comes to him — gently; the woman who sent it saw a newcomer, and delivery is the whole skill of this game. He gets his paddle under it. The circle cheers the streak alive. Within three rounds, everyone in the circle has heard his name four times, and he has heard all of theirs, because the game cannot proceed without saying them. When the streak dies at 41 — nine short of nothing in particular, since the next rite waits at 333 — the circle groans and laughs, and a stranger says, \"Again, Virak?\" That sentence — a stranger using his name to invite him back — is the sport's actual product. The rally was the packaging.\n\n**A living room, that evening.** Three generations, one net strung between two chairs. The eight-year-old and her grandmother hold paddles; the parents play with their feet. The family's phones announce in two languages — the grandmother's in Khmer, the child's in English — one circle, one game, two tongues. The teams are uneven, so the app has set the start numbers: the parents begin at 33, the paddle side at 21. First to zero. Nobody chose those numbers; nobody can argue with them; and because the caller decides who receives, the parents cannot serve at the eight-year-old to win — the game has no such move. When the paddle side takes its last point — actively won, as the final point must be — the child performs a victory lap of the sofa. What she has won is the story of having beaten her parents fairly. That is all winning moves here, and it is enough; it has always been enough.\n\n**A classroom, the first week of school.** Thirty children who mostly do not know each other, one teacher who needs to learn thirty names, one ball. The circle solves both problems, because equal-yet-random guarantees every child is called **once the round completes** — and because the round is carried across sessions rather than restarted (§4.3), a class playing ten minutes a day reaches every child instead of cycling the same few. The teacher, standing inside the circle, hears every name spoken aloud dozens of times. No child is picked last, because there is no picking. No child dominates, because the caller will not allow the ball to orbit the confident. The physical-education period and the social-integration project turn out to be the same forty minutes.\n\n---\n\n## 3 · The Design: One Circle, Five Seats\n\nB-Sey is a circle game for **four or more players in Relay and three or more in Call** (the floor is a function of the format axis; see *Why the floor moves with the format* below), played with a ball designed to be struck by **foot or paddle** — the athletic adult kicks, the grandparent and the child paddle, and both choices are ordinary equipment decisions, not accommodations. Play proceeds in two modes. **Without a net**, the circle plays cooperative keep-alive: the score counts *up*, one per completed reception, and the object is the longest unbroken streak — the collective form. **With a net**, two sides contest a countdown (§5–6) under volleyball-like rally structure — the adversarial form, and the form on which the companion paper's challenge grammar (B-Match℠) nests. A newcomer joins either form the same way: the circle widens. There are no teams to pick in circle mode and no tryout in either; the topology itself is the invitation. **Why the floor moves with the format.** The floor is not a constant but a **function of one variable — whether the caller is a person.** The derivation is single and does not change: **three receivers are required**, because three is the smallest number that leaves any surprise in the call. With two receivers the caller can only alternate — everyone knows who is next before the name is said, and the mechanism this paper specifies contributes nothing.\n\nWhat changes is only whether a body is spent on calling. **In Relay a human calls and is therefore not receiving, so three receivers cost four players. In Call no human calls, so all present are receivers, and three receivers cost three.** One rule, applied to two arrangements:\n\n```\n   required receivers = 3          (invariant — the surprise condition)\n\n   Relay   caller is a person   →  floor = 3 + 1 = 4\n   Call    caller is not        →  floor = 3 + 0 = 3\n```\n\n⚠️ **This is deliberately *not* a return to the per-mode minimum table withdrawn in v6.** That table restated a number per row, which is exactly how two numbers drift apart. This states the number **once**, as the surprise condition, and lets the format axis supply the only term that varies. The withdrawal stands; what is added is the variable it was missing.\n\n**Provenance, stated asymmetrically because it is asymmetric.** The invariant and its derivation are this paper's own, unchanged since v1. **Three-in-Call is not** — it is prior canon in the product's own design record, where a circle of three standing close with no human caller was specified as the answer for a family of three, and it is the implementation that has been running while this paper said otherwise. The adjacent argument that three is the smallest number at which forward and back differ belongs to the circulation-sport work and is **cited here, not claimed**.\n\n⚠️ **A gap this amendment does not close, and should not be read as closing.** The paper still says nothing about **which formats a Team game may run**, whether a relay caller belongs to a side, or how rotation crosses a net. The floor above is stated for Relay and Call only. Team ships visibly disabled for exactly this reason, and until the axis is specified the honest position is that the format question is open rather than answered by omission.\n\nThe machine intelligence in the sport occupies exactly **four seats** — including the one the sport is named for — and is barred from the fifth. The seats fall into two classes, and the division is not a taxonomy for its own sake: it decides how each seat's output can be *checked*, and therefore what an implementer is permitted to put in it.\n\n**The determined seats.** Their output is a pure function of inputs declared before play, so it is checkable by **recomputation** — anyone holding the inputs reproduces the result exactly and sees for themselves that the rule was honoured.\n\n1. **Caller.** The sport's defining mechanism (§4): before each play, the name of the required next receiver, announced aloud. Its selection policy is equal-yet-random and, given the circle and a declared seed, *deterministic* (§4.2) — an arithmetic distribution, not a live opinion about anybody.\n2. **Equalizer.** Fairness is manufactured at two points and only two: the **start line** (asymmetric countdown numbers, §6) and the **implement** (paddle or foot, chosen by the player), both drawn from a coarse published lattice. It is never manufactured mid-play. The distinction is load-bearing and stated as a hard rule below.\n\n**The judged seats.** Their output is a perception or a narration. It cannot be reproduced from inputs, so it is checkable only by **explanation** — each judgment stating its ground in one sentence, the standard §5 already imposes on the last-gift ruling.\n\n3. **Umpire.** Line calls, receipt validity, and the classification of the final point (§5) are the system's judgments — instant, neutral, and not attached to a human being who can be shouted at. The referee crisis is answered not by braver referees but by removing the seat the abuse was aimed at.\n4. **Witness.** The system records the game's story — the streak, the rally, the celebration — as a *collective* chronicle. It records no player statistics: no individual completion rates, no rankings, no most-valuable anything (§7–8). What it counts, it counts about the circle.\n\n**The barred seat.**\n\n5. **Player — never.** No machine plays. In an age when most activities can be delegated to software, the sport is constructed entirely from the one thing that cannot be: bodies, co-present, attending to each other. The machine is present so that the humans can be.\n\n**The seat-migration bar.** A seat may not take on the other class's mode of operation, and the prohibition runs in both directions because both failures arrive at the same place — a machine-held ranking of persons. A *determined* seat that acquires judgment becomes a rating engine: a caller that routes around a struggling receiver, or a handicapper that tunes start numbers to measured ability, has evaluated the players, and has done it where no one can see it. A *judged* seat that acquires distribution authority becomes a caller: an umpire empowered to influence who receives next can express a preference about people through a channel built for judgments about the ball. The rule is short enough to hold in mind while implementing: **the determined seats never judge a person; the judged seats never choose a person.**\n\n### 3.1 · The three axes: method, mode, level\n\nThe sport is parameterized on three orthogonal axes. They are not settings; they are a **ladder**, and an implementation that surfaces them as a configuration screen has already failed the design.\n\n```\n   AXIS      QUESTION IT ANSWERS         VALUES\n   ─────────────────────────────────────────────────────────────────\n   METHOD    what part of you gives?     hand · paddle · foot\n   MODE      what do you play against?   nothing · your record · another circle\n   LEVEL     how much warning?           long lead · moderate · short lead\n```\n\n**Method** is the body vocabulary a player declares — hand-catch-and-release, paddle, or foot. Anatomy plus implement exhausts the list; there is no fourth. The values are **defaults suggested by ability, never assignments by category**, and heterogeneous methods are expected *within a single circle*: a grandparent with a paddle, a child with hands, an adult with feet, one shared object. This is the load-bearing case, not the exotic one — a sport that segregates by method has thrown away the mixed-age property that is the design's principal social claim, and would have reintroduced by the back door the segregation §1 identifies as sport's inherited disease.\n\nA declared method **is a start-line handicap** (§6) — public, self-chosen, announced before play, never assigned during it — so the axis requires no new fairness machinery; it inherits the machinery already specified. Two consequences follow:\n\n- **The object is constrained by the axis.** One shared object must be catchable, kickable, and paddle-able. A hard ball fails hands; a shuttlecock fails paddle power. A **soft weighted sack** satisfies all three, which is why the reference implementation is a sack rather than a ball.\n- **A catch stops flight, so possession needs a bound.** Hand players receive by catching, which would otherwise let a player hold the object and stall the circle. The rule: **catch and release within one beat, where the caller's own cadence is the release clock.** As lead time shortens (§4.1) the hand method converts from catch-and-throw to volley-tap without a rule change — difficulty emerges from the method mixture rather than being imposed on it.\n\n**Mode** is what the circle plays against, and the values ascend: *nothing* (**Friendship**, no scoring of any kind), *its own record* (**Streak**, no net, ascending collective count), *another circle* (**Team**, net, descending count to zero, and the only mode additionally requiring enough players to form two sides). All three take their floor from the single rule of §3 — **three receivers, plus a body for the caller only where the caller is a person** (Relay 4, Call 3). The per-mode minimum *table* given in revisions before v6 remains withdrawn and is not restored: it restated a number per row, which is how two numbers drift apart. One number, stated once, with one variable. The mode names are deliberate: **no label on the product surface names rivalry**, though the adversarial mode is genuinely adversarial and this paper describes it as such. Naming the third mode for its structural novelty — *sides exist* — rather than for its disposition is a small instance of a general discipline in this corpus, in which vocabulary is held to the same standard as mechanism.\n\nThe mode ladder is also the **adoption funnel**, and an unusually honest one: each rung is entered by the circle's own election, each rung's graduation is the previous rung's success condition, and the entry rung has **no score at all**.\n\n**Level** is treated in §4.1, because it is a property of the caller rather than of the players.\n\n**The three-value pattern is not aesthetic and should not be read as one.** Each axis has an independent reason for its cardinality: method is exhausted by anatomy plus implement; mode is exhausted by the opponent relation; level is coarsely quantized for the same anti-rating reason the start-line lattice is (§6) — a continuously variable difficulty dial would read as a precision skill rating, which is the artifact this design exists to avoid. Where a fourth value would genuinely serve — very large circles may want a fourth lead-time band — the pattern must yield. **Three is a finding here, not a constraint.**\n\n---\n\n## 4 · The Caller: Equal-Yet-Random, and the Property It Buys\n\nThe sport's one genuinely novel mechanism is small enough to state in a sentence: **before each strike, the system announces by name the player who must receive next.**\n\nEverything distinctive about B-Sey follows from that sentence.\n\n**Equal-yet-random distribution.** The caller's selection policy has two commitments that are individually trivial and jointly unprecedented in sport. *Equal*: **over a complete round** — one pass through the roster — every player in the circle receives the same number of touches, within rounding, and the weakest player is guaranteed the strongest player's share of the game. **Revisions of this paper before v6 stated this over a *session*, and that overstated it**: a session is a prefix of a round, and a prefix of a fair sequence is not fair. The guarantee is reachable under real usage only because rounds are carried across sessions rather than restarted (§4.3). *Random*: the order is unpredictable, so no player can disengage — anyone's name may be next, and the suspense that in ordinary sport attaches only to the ball here attaches to every person simultaneously. *Anyone's name may be next* is true of the circle rather than of every call, and §4.4 states the exact scope: within a round the bag forces the last name for anyone who counts, the no-repeat rule keeps the previous closer from opening the next round, and the first published version of the caller leaked more predictability than either — a round's closer closed the next one two times in three at the smallest circle. Equality without randomness would be a queue (predictable, boring, and stigmatizing — everyone can see whose turn is being \"given\"); randomness without equality is every pickup game ever played (the ball orbits the skilled). The conjunction is the mechanism.\n\n**The cannot-target-weakness property.** In net mode, the caller designates receivers on *both* sides. The attacking side therefore cannot choose to serve at the weakest opponent — the oldest strategy in net sports, taught openly at every level, and the precise mechanism by which the weakest player on any volleyball court spends the match being hunted. In B-Sey that strategy does not exist. It is not penalized; it is not discouraged; it is *absent from the move-set*, the way castling into check is absent from chess. Skill, denied the target-selection channel, migrates entirely into **delivery** — placing the ball so your designated receiver, whoever the caller named, can continue the play. The best player in a B-Sey circle is definitionally the one who makes everyone else look good, because making the named receiver succeed is the only thing the rules allow skill to do. To the authors' knowledge, no prior net sport has this property, and it is claimed here as the design's sharpest single contribution (Claim 2).\n\n**The name as by-product and as point.** Because the call is a *name*, spoken aloud, repeatedly, by every device in the circle (§7), the sport performs introductions as a side effect of its basic loop. This is not a social feature bolted onto a game; it is the game's addressing layer, doing double duty. The design intends the double duty (§9's first prediction measures it): B-Sey is built to be the first sport whose standard output includes *strangers who know each other's names* — the missing primitive of the third place.\n\n**Hard constraints on the caller** (stated here as design law; their governance form lives in the institution's internal directive registry):\n\n- The caller **never evaluates players in the flow of play**. It does not skew calls by skill, win probability, or match situation; it does not route around a struggling receiver at a tense moment. A caller that \"protects\" the weak player at match point has rebuilt picked-last-at-recess inside an algorithm, invisibly, which is worse than the playground original because it cannot be seen and argued with. Fairness lives at the start line only.\n- The caller speaks **chosen names only** — the name a player registers for the circle, which may be a nickname; children's circles use first names or nicknames as a rule. No legal name is ever broadcast across a public park.\n- Per-player data that the equalizer uses (implement choice, start-number calibration) is a **private mirror** — visible to the player, never to the circle, never to any ranking, never retained as a skill profile.\n\n### 4.1 · Level as call lead time: a scaffold-fading memory curve\n\nThe naive difficulty dial for a called sport is the interval between calls. It is the wrong variable: the inter-call interval is confounded by circle size, so the same setting produces a frantic game with four players and a languid one with thirty. The correct variable is **call lead time** — the interval between the naming of the receiver and the object's arrival. Lead time is invariant to circle size and to method, and it is what a receiver actually experiences as pressure.\n\nThree bands are specified, and what changes across them is not merely speed but **how much external scaffolding supports the act of recognition**:\n\n```\n   LEVEL     LEAD TIME    SCAFFOLD                    WHAT IS BEING TRAINED\n   ──────────────────────────────────────────────────────────────────────────\n   Easy      long         called player RAISES A HAND  nothing yet — the\n                          and may speak their own      circle is being taught\n                          name aloud                   the names\n   Medium    moderate     none — the giver must find   name → face recall\n                          the named face unaided\n   Hard      short        none; the call may land      automaticity under\n                          while the object is aloft    time pressure\n```\n\nAt the longest lead the called player **raises a hand**, which removes the recall requirement entirely: a giver who does not yet know who *Sokha* is can simply deliver to the raised hand. The scaffold is then withdrawn — first the hand, then the time — and the withdrawal is enforced by physics rather than by rule, since a hand cannot usefully be raised inside a short lead.\n\nThe result is that **the difficulty ladder is a memory curve, not a skill curve.** A circle can only ascend it as its members' name recall becomes fast and then automatic, which yields the design's cleanest coincidence: *the game becomes more fun exactly as everyone learns each other's names.* The thing the players want and the thing the sport is for are the same thing, and no exhortation is required to align them.\n\nIt also supplies the sport's non-numeric progression. In Friendship mode there is no score, and the circle nonetheless has something that advances: **tempo is the score that is not a score.**\n\n**A constraint the implementer must not violate.** It is tempting to advance the level automatically from measured response latency. Doing so *per player* would reconstruct, invisibly and in the tempo dimension, precisely the artifact §4 exists to prevent — a machine-maintained ranking of who is slow. The rule:\n\n> **The level is a property of the circle, never of a player.**\n\nPermitted implementations, in order of preference: (a) **the circle elects the level**, with the caller permitted to *offer* an advance; (b) if adaptive at all, adaptation conditions **only on circle-aggregate state**, ephemeral and on-device, never per-player, never stored, never displayed. Never permitted: a per-player recall score, in any form, visible or not.\n\n### 4.2 · The determined caller: fairness as arithmetic\n\nThe caller is the seat where an implementer will most want to put intelligence, and the seat where intelligence does the most damage. This design resolves the tension by removing the caller from the domain of judgment altogether: **the call sequence is a deterministic pure function of the circle's roster and a seed declared before play.** Given the same roster and seed, every conforming implementation emits a bit-identical sequence, which makes the generator a cross-platform contract rather than an internal detail.\n\nThree properties follow. The third was not anticipated when the constraint was adopted, and is now the reason to keep it.\n\n**Fairness becomes verifiable rather than trusted.** Equal-yet-random (§4) is the sport's central promise and the one a participant is least able to check by watching, since over any short window a fair sequence and a biased one look alike — which is precisely why a sport that merely *asserts* fair distribution asks to be taken at its word. When the roster and seed are the entire input, any participant, parent, teacher, or competitor can recompute a completed session and confirm that the distribution was equal and that no one was skipped, favoured, or quietly protected. Publishing the generator is therefore part of the mechanism rather than a disclosure concession.\n\n**Multi-device play stops requiring a network.** Because each device computes the sequence independently, devices in one circle need never be told *who* is next — only **how many calls have elapsed**. A single integer, not a name, is the whole synchronization payload; a device rejoining after a lapse fast-forwards to the current index instead of recovering state. Where simultaneous announcement (§7) demands tight clock alignment, sequence *agreement* demands none at all. The offline-first commitment of §7.1 is thus not merely compatible with the determined caller — it is largely delivered by it.\n\n**There is no per-player state to leak, subpoena, or repurpose.** The forbidden artifact of §4 and §4.1 — a machine-maintained record of who is slow, who is skipped, who is protected — is not merely prohibited here by policy. A pure function of a roster and a seed has nowhere to keep such a record. The guarantee moves out of the governance layer and into the arithmetic, where a later release cannot quietly relax it and an acquirer cannot monetize it.\n\n**The general lesson, offered to implementers of any called game.** A fairness property enforced by a rule *about* the algorithm lasts exactly as long as the organization enforcing it; the same property enforced by determinism and published vectors outlasts the organization. Where a guarantee can be made checkable, making it checkable is worth more than making the underlying decision cleverer — and the two are usually opposed, because the intelligence that would improve a decision is the same thing that makes it unauditable. The corollary an implementer meets later is that a checkable sequence can never be *fixed* in place: once a seed has dealt a session somebody may recompute, its sequence is a record. §4.4 is the worked case — a real defect, repaired by versioning the seed rather than the algorithm.\n\nNone of this disarms the machine; it relocates it. Perception and narration — was the ball in, was the final point actively won, what is this circle's story — are irreducibly judgments, and they are where sensing and inference legitimately belong. The boundary is worth restating at the hardware layer beside the warning already given there (§7.1): **instrumentation serves the judged seats only.** An accelerometer reporting a touch supplies the umpire with evidence. It must never supply the caller with a reason.\n\n\n### 4.3 · Round continuity: the unit is the round, not the session\n\nThe equal-distribution guarantee holds over a **complete round** — one pass through the roster — and not over an arbitrary slice of one. The distinction is not pedantry. It is the difference between a working guarantee and a broken one, and the reference implementation shipped the broken version first.\n\nA class of thirty playing a ten-minute warm-up calls perhaps ten children. If the caller's progress resets when the session ends, the next session calls the same ten, and the twenty children at the far end of the round are never called at all — every day, indefinitely, with nothing on any surface to indicate it. The distribution is perfectly equal within each session and catastrophically unequal across them. **An invariant enforced only within a unit is silently void across units, and the unit boundary is where nobody looks.**\n\nThe repair is to persist the round rather than the session. The caller retains a **circle-scoped integer call index** — never a per-participant record, never a timestamp — so that a truncated session resumes where it stopped rather than restarting: whoever has not been called yet is still uncalled tomorrow. This is what makes the guarantee reachable under real usage, in which play is chopped into ten-minute pieces by bells, weather, and attention.\n\nTwo properties are worth stating for implementers. First, the persisted state is **a single integer per circle**, which is why it introduces no per-participant artifact and nothing to leak (§4.2). Second, **no amount of session-level testing detects the defect**, because every test anyone would write runs one session, and within one session the distribution is exactly correct. A competitor implementing from this specification would ship the same bug.\n\n### 4.4 · Two versions of one contract: the closer effect, and the seed as the version\n\n§4.3 recorded a defect that lived at the boundary between sessions and that no session-level test could see. This section records a second defect of the same family — invisible inside any one round, visible only across the boundary between two — and the way it was repaired without altering a single sequence that had already been dealt.\n\n**What the first published caller did at a round boundary.** Equal-yet-random is dealt as a **bag**: each round is a fresh shuffle of the roster, dealt to its end before the next is drawn, which is what makes the counts equal. Two independent shuffles will sometimes deal the same player last in one round and first in the next — called twice in a row, which the circle hears as a stutter and the player experiences as being singled out. The first version of the cross-platform contract (**v1**: a 32-bit seeded generator, a descending Fisher–Yates shuffle, and the bag, published with conformance vectors in `@333eco/sey`) forbade the repeat with a **rotation**: if a new round would open with the previous round's closer, that player was moved to its end. The rule does what it was written for. Its cost was not measured until 13 September 2026, when a documentation example printed two identical consecutive rounds and the explanation first offered for it was checked rather than accepted. Rotation maps every shuffle that would have opened with the closer onto a shuffle that ends with them, so the previous closer is never first, takes each middle position with probability 1/n, and **closes the next round with probability 2/n** — twice the rate of any middle position. A round repeats the previous round's order exactly with probability 2/n! rather than 1/n!.\n\n```\n   PLAYERS   v1 ROTATION — closer closes again     v2 SWAP — closer closes again\n             analytic 2/n     measured *           analytic 1/(n−1)\n   ─────────────────────────────────────────────────────────────────────────────\n      3         66.7%          66.8%                   50.0%    (49.5% †)\n      4         50.0%          49.9%                   33.3%\n      7         28.6%          28.5%                   16.7%\n     12         16.7%          16.6%                    9.1%\n\n   * 40,000 seeds per row.\n   † measured in the reference implementation's own engine, which measured\n     the v1 form at 66.7% under the same conditions.\n```\n\n**Why it was this sport's defect before it was anyone else's.** The effect is sharpest where the roster is smallest, and the smallest roster this paper permits is Call's floor of three (§3) — a floor derived from the requirement that some surprise remain in the call. At three players a participant who has watched one round could name the *second* call of the next round correctly **two times in three** under v1. Under the repaired form the same guess succeeds one time in two, which is the best any rule forbidding back-to-back calls allows: with the previous closer barred from the opening, the four permitted orders are equally likely. Equal counts were never touched — every round still dealt every player exactly once, and long-run averages remain equal by symmetry — so neither a count nor the recomputation audit of §4.2 could see the defect. It was a failure of *unpredictability*, the half of equal-yet-random that §4 says keeps a player from disengaging, and it was worst at the very floor that exists to protect that half.\n\n**The repair.** The second version (**v2**) changes the seed, the generator and the boundary rule, and makes one structural change to Relay. The seed is **32 random bytes written as 64 lowercase hexadecimal characters**. Each round is drawn from its own key — an HMAC-SHA-256 of the seed, a stream label (receivers, or relay callers) and the round number — expanded by an HMAC counter stream and rejection-sampled into uniform indices for the same descending Fisher–Yates shuffle, so there is no 32-bit state. And the boundary rule is a **swap** with a uniformly drawn later position instead of a rotation: the previous closer still never opens the next round, and is equally likely to land anywhere else in it. In Relay, a caller's tenure becomes exactly one receiver round, callers are drawn in rounds of their own over the whole circle, and each receiver round deals everyone except the current caller. The formats, the floors, the level fields, count-only catch-up and the refusal to keep per-player state are unchanged. The normative text is the sport's contract (`@333eco/sey` 1.1.0, *The caller sequence*, §8), which calls the round key and the keyed shuffle from the general-purpose CC0 package `@333eco/primitives` (its specification, Parts I–II); both ship vectors, and the contract is sufficient without the package.\n\n**Version the seed, never the algorithm.** A sequence that anyone may recompute is a record, and the v1 contract had already said what that forbids: changing the sequence for an existing seed is a breaking change, because a circle saved on one device would replay differently on another and every past audit would silently stop reproducing. So v1 was not edited. Circles created from 13 September 2026 carry a v2 seed; every older circle keeps its numeric seed and replays v1 byte for byte, indefinitely. **A client tells the versions apart by the seed's type alone** — a number is v1, a 64-hex string is v2, anything else is not a seed — so no stored circle changed, no version field can be lost or mistyped, and a client must implement both to replay every circle. The contract's earlier format axis was the first instance of the rule, added by making the absent value mean the old behaviour; v2 is the larger one, and the one that shows why the rule exists. A repair that edited v1 would have fixed the future by falsifying the past.\n\n**What *nobody can predict* means, scoped.** The property is watcher-level. It says that no one attending to the play can know whose name is next, and it holds within three limits that are structural rather than defects. (a) **The bag forces each round's last name** for anyone who counts, and more generally a player already called in the current round knows they will not be called again before it ends; this is the price of equal counts, and it is paid knowingly, since a draw that could call the same player again at once would give up the equality that is the sport's other half. (b) **The previous closer never opens the next round** — the no-repeat rule's intended and bounded cost. (c) **The sequence is not secret from a device.** Count-only coherence (§4.2) works because every device in the circle holds the seed and computes the same order, so any of them can compute ahead; the unpredictability the sport needs is the absence of a pattern a *player* can read, and v1's closer effect was exactly such a pattern. Beyond these, the seed is generated on the device that opens the circle. Recomputation proves that a session was dealt faithfully from the declared seed; it cannot prove that the opener did not reopen the circle until an order they preferred appeared. For play order that is an acceptable residue. For anything of value it is not, and the companion paper *Decided by No One* specifies the form that removes it — a seed no party controls, a roster committed before the seed can be known — where the draw is generalised beyond this sport.\n\n---\n\n## 5 · Scoring: The Dyadic Point and the Two Arrows\n\n**The dyadic scoring unit.** A point increments when the *named receiver successfully receives*. The unit of scoring is therefore not a strike, a kill, or a goal — acts one player performs — but a completed **give-and-receive**: a delivery good enough to be received, and a reception good enough to continue. Nobody scores alone, structurally. The compression error of historical scorekeeping (§1) — recording the last touch and calling it the achievement — is not corrected by tracking assists (a patch several sports have tried) but by defining the point as the *pair*. In the institutional grammar this corpus builds elsewhere, the point is a witnessed micro-gift; within this paper it is enough that it is a *dyad*, and that the sport's atomic event requires two people succeeding together.\n\n**Count up (the circle).** Cooperative keep-alive counts consecutive completed receptions. The streak is a built thing — collective, cumulative, mortal. When it dies, it dies for everyone at once, and the circle starts again: the game's only loss condition is shared by all players equally, which is why circle-mode B-Sey has no losers at all, only a streak that was and the next one. Streak milestones are celebrated at the **repdigits** — 3, 33, 333, 3333 — an exponential rationing that keeps each rite roughly ten times rarer than the last (a celebration every 33 would inflate to wallpaper across a long streak; a celebration at repdigits stays an event for the rest of the sport's life). Between rites, the circle's *record* — the park record, the school record — carries continuous motivation. Records belong to circles and places, never to persons.\n\n**Count down (the net).** Adversarial B-Sey inverts the scoreboard: each side begins at a start number (§6) and every rally won *subtracts* one from the winner's remaining count. **First to zero wins** — first to nothing. The arithmetic is identical to counting up; the symbolism is its inversion, and a scoreboard is nothing but symbolism: the winning team is the team that first gives away everything it started with. Rally structure follows volleyball (serve rotation; a point every rally). Two refinements complete the mode:\n\n- **The last-gift rule.** A side's final point — the one from 1 to 0 — must be *actively won*: earned by that side's successful play, never conferred by an opponent's unforced error. No match may end on a serve into the net; the anticlimax that deflates conventional rally scoring at its most important moment is ruled out. (Darts' double-out finish is the honest precedent: the insight that endings must be earned is old; its application to rally sport is claimed here.) Classification of a final rally as actively-won is the umpire seat's call, held to the same one-sentence-explainability as every other judgment in the system.\n- **No deuce.** Conventional win-by-two exists to prevent flukish endings between equal teams; B-Sey's endings are already guarded by the last-gift rule, and its equality is already engineered at the start line. Adding deuce on top would re-lengthen games unpredictably and dilute the countdown's clean terminus at zero.\n\n**Both arrows, one ruleset.** Cooperative sports count up; adversarial sports count up; darts and little else count down. A single sport in which the *mode selects the arrow* — building in the circle, emptying at the net — is, to the authors' knowledge, novel, and is claimed as architecture (Claim 5): the two arrows are not a gimmick but the two halves of the institution's founding game (a children's balance game in which kindness counts up and gratitude counts down and the ideal score is zero), expressed as sport.\n\n**What the arrows do is move the opponent.** In an ordinary net sport the opponent is a person, and every point is taken from someone. The arrows relocate that. Counting up, the circle plays against **the drop** — gravity, entropy, its own prior record. Counting down, it plays against another circle, by agreement. A third position exists and is the one the level ladder of §4.1 occupies: the opponent as **the circle's own earlier state**, which is competition that costs no one anything. This is why the entry rung carries no score at all and why advancement between modes is elected rather than triggered (§3.1). The sport does not remove competition; it makes the choice of opponent explicit and puts the adversarial option last.\n\n### 5.1 · The scoring ladder, and the implied point\n\nScoring in a called sport admits an architecture unavailable to every other game, and it follows from one observation: **the caller has already assigned identity.** Every other sport must determine *who* touched the object; this one *chose* who touches it next. What remains to be established is only whether the touch occurred — a binary event, not a localization problem.\n\nThree tiers implement that, and each degrades gracefully into the one below:\n\n```\n   TIER       MECHANISM                                    HARDWARE\n   ────────────────────────────────────────────────────────────────────\n   default    the point is IMPLIED by the call —           none\n              assume the dyad completed\n   validated  k-of-N vote across the circle's own          none\n              phone microphones: \"was there a strike\n              in this window?\"\n   confirmed  accelerometer in the object reports          instrumented\n              {object_id, touch, t}                        object\n```\n\n**Sensing never gates play.** A circle with one phone and a rolled sock plays the whole sport; instrumentation improves fidelity and nothing else.\n\nThe **microphone tier** deserves note because it is cheap for a non-obvious reason. Localizing a strike acoustically across phones — time-difference-of-arrival — is a research problem: it needs tight clock synchronization and degrades badly in wind and traffic. **Detecting** one does not. A strike is a sharp transient, separable from ambient noise on a single microphone; a **k-of-N agreement rule** across the circle tolerates a phone in a pocket, a gust, and a passing motorcycle; and the vote requires only a coarse shared window, which the mesh's announcement synchronization (§7) already supplies. The reduction from localization to detection is what moves this tier from research to implementation, and it is available *only* because the caller supplies identity.\n\n**The implied point is an epistemic claim, not a semantic one — and the distinction is load-bearing.** The scoring unit remains what §5 defines: a completed delivery-and-reception pair, credited to no individual. The default tier does not redefine the point; it **assumes the dyad completed and permits a human, or later a sensor, to say otherwise.** An implementation that treated the *call itself* as the scoring event would have quietly built a different game — one in which the caller scores — and would have destroyed the dyadic unit that §5 claims. The caller never scores.\n\n**Why such loose epistemics are licensed here.** Because of §8: no point mints, moves, or gates value. **A score that moves nothing requires no audit.** Were the score coupled to money, the instrumented tier would be mandatory and the default tier negligent; because it is not, trust is the correct default and sensing is an amenity. This is a case of a constraint adopted for dignity reasons removing an engineering dependency — the play/currency wall paying for itself in hardware.\n\nOne consequence for the record architecture (§12, claim 10): a trusted-by-default streak can silently inflate. **Records therefore carry their evidence tier** — *unvalidated*, *microphone-validated*, or *object-confirmed* — so that a circle's record states not only its magnitude but how it was witnessed.\n\n---\n\n### 5.2 · The three speaker formats, and the acoustic inversion\n\nA circle has **one acoustic channel and two candidates for it**: the name of the next receiver, and the count. They cannot both be the headline. Interleaving them — *\"Sokha! … fourteen! … Dara! … fifteen!\"* — buries the name in numerals, and the name is what the sport is for.\n\nThe specification therefore inverts the convention of every scoring sport in existence:\n\n> **Every other scoring sport calls the score. This one calls the person.**\n\nThe formats below are **named rather than numbered**, deliberately: one constraint stated at the end of this section must survive any future reordering of the list, and a rule that says *\"format 1\"* breaks the moment a format is inserted ahead of it.\n\n**Relay (the default, and the format a first deployment should ship).** The system speaks the name **privately to a single human relay** — through that person's own device, audibly to them alone — and that person calls it aloud to the circle. Selection remains machine-held, so every distribution property of §4 survives intact; what changes is only who moves the air. The consequences are larger than the modification: there is **no loudspeaker, no mesh, no clock alignment, and no requirement that participants own devices**, so a single borrowed handset serves an entire circle. That matters most exactly where the sport is most wanted — a school that prohibits phones, a park with no signal, a group in which one person has a device.\n\nTwo further properties were not the reason for the arrangement and are now the reason to keep it. First, the relay **hears the participant-approved pronunciation immediately before producing it**, which makes correct articulation a *modeled repetition* rather than a reading task; a name read off a screen is mangled precisely for the names this design exists to protect. Second, and more consequential: **the relay produces names aloud, where a player only ever hears them.** The role is therefore where the sport's stated purpose is actually practised, and it follows that the role must **rotate under the same equal-yet-random assignment that distributes receptions**. Left to the circle, the confident participant holds the device and the quiet one never says a name — picked-last rebuilt through the back door of the very role meant to distribute the practice. Rotation also disposes of the objection that the relay is excluded from play: the role is a turn, not a sacrifice. The honest cost is a **tempo ceiling** — the repeat beat is absorbed at long lead times and binds at short ones — which is what the synchronized mesh (§7) is *for*, as a later upgrade rather than a launch prerequisite.\n\n**Call — the name format, spoken to the circle.** The system addresses the whole circle directly over the mesh in **one voice for every name** — never in the named participant's own recorded voice, for the reason given at the end of this section — and **counts silently.** The count is *visible, not audible*: the mesh already places a screen in every pocket, and adversarial mode's countdown must remain readable for tension and tactics. Silence is not concealment. Numbers are spoken only at the rationed celebration thresholds of §6, which means **a spoken number is always a rite** rather than ambient noise. The chant, if the circle wants one, remains entirely human — the system never leads it and never competes with it. *An accessibility setting must permit a spoken count, off by default, for players who cannot read the screen; the pre-announcement of §4 is already an auditory pre-cue and the same constituency is served by both.*\n\n**Free — the count format, with the caller off.** The caller is disabled entirely; the system counts aloud *with* the circle, and nobody is told where to pass. This is free play with a shared, trusted counter — and it exists because the design's central mechanism is unproven (§9, §11). It is also **why the microphone tier is specified**: with no call, the system has nothing to count from unless it *hears* the strike. The two are one feature.\n\nThe formats are **mutually exclusive by construction** — a session runs exactly one — which resolves the apparent contradiction among them. The rule was never that numbers are undesirable; it is that **the name must never compete with numerals** — one voice per channel, and the channel's content follows what the mode is for.\n\n### 5.3 · The address constraint: no one is called in their own voice\n\nAcross every format, one constraint governs *articulation* rather than selection, and it follows directly from §1:\n\n> **The voice that says a participant's name must never be that participant's own.**\n\nThe constraint has to be stated because the obvious implementation violates it. A system that teaches correct pronunciation will hold a recording of each name made by its owner — that is the only honest source of the pronunciation — and at call time the nearest artifact to hand is exactly that recording. Playing it delivers to each participant a recording of themselves saying their own name. The result is not a poor address; it is **not an address at all**, and no amount of audio quality repairs it.\n\nNaming the constraint separates two speech acts that a single artifact had been performing at once, and which have different rightful speakers:\n\n| | **The pronunciation** | **The call** |\n|---|---|---|\n| Whose is it? | the name's owner | anyone but the owner |\n| What is it for? | how the name sounds | *you, now* |\n| Failure mode | anglicization | self-address; no speaker |\n| Where it lives | a stored model, approved by its owner | the moment of play |\n\nThe two are joined by **transfer**, not by identity: the owner's authority over how the name sounds is carried *into a voice that is not theirs*. Two mechanisms accomplish this, one per format. In **Relay**, the human caller hears the owner's own recording immediately before speaking, and reproduces it — modeled repetition, the highest-fidelity transfer available, and the reason the default format is also the best one. In **Call**, where every participant is a player and no human other is free to speak, the owner supplies a **respelling** — the name written as it sounds — which the single system voice articulates. The respelling is not an accessibility fallback; it is the transfer mechanism itself, and the only route by which a participant's authority over their own name reaches a synthetic articulator.\n\n**One voice for every name is a property, not a limitation.** A circle whose calls were assembled from twelve different recordings would address each participant in a different timbre — the texture of being called would vary by whose recording happened to be playing. A single voice calling everyone means **every participant is addressed identically**: equal-yet-random rendered in sound. The uniformity of the acoustic channel is the audible form of the fairness the caller already guarantees numerically.\n\nA note on what this does *not* claim. A system voice is an *other*, which is what the premise strictly requires, but it is not a *person*, and §1's account of why a name is sweet — evidence that someone spent attention on you — is only partly satisfied by a machine. This is a real gap and the specification does not paper over it: it is the reason **Relay is the default format and Call is the device-plentiful case**, rather than the reverse. Where a human can say your name, one should.\n\n#### The circle's own voices: cross-recorded calls\n\nThe gap above admits a partial repair, specified here as an **option within Call** rather than as a fourth format, because it changes which audio plays and not what anyone does during a rally.\n\nThe intuition is that a circle calling itself in its own members' voices would be warmer than a circle called by one synthetic voice, and it is correct. The naive implementation of it is nonetheless barred by the constraint above: playing each participant the recording *they themselves made* is precisely the mirror this section exists to prevent, and the warmth is illusory because the one voice a participant never hears as an address is their own. **The intuition survives; the implementation must be inverted.**\n\n**The mechanism is a cross-recording chain.** At join, after a participant records their own name — the pronunciation model, which stays theirs — the device passes to the next participant, who is shown that name, hears the model, and **says it themselves**. That second recording is the *call* audio. The device continues around the circle, so each participant records exactly one other participant's name and is recorded by exactly one other participant: a cyclic permutation of the roster, costing one additional beat of roughly three seconds per person and producing exactly *N* artifacts rather than *N²*.\n\nFour properties follow, none of which the uniform voice provides:\n\n1. **Every call is a human voice, and never the listener's own** — the address constraint is satisfied in its strong form rather than its formal one, because the speaker is a person who spent attention on the listener.\n2. **The distribution is exactly even by construction**, as the caller's is: one recording made by each participant, one recording naming each participant. The property that governs receptions governs voices.\n3. **It runs the production effect at join**, before play begins. The rotating relay role teaches participants to *produce* names rather than merely hear them (§5.2); the chain does the same thing one beat earlier and for every participant at once, including in Call, where no relay role exists to do it.\n4. **The recording is itself a small gift** — a participant spends three seconds so that another can be called — which is the sport's own subject enacted before the first rally.\n\nThe owner's approval (§5.3, and claim 21) governs the call audio as it governs every other pronunciation artifact: a chain recording a participant has not approved does not enter play, and the participant may ask for another take without stating a reason.\n\n**When to offer it, and when not.** The two voicings answer different circles and the specification declines to rank them absolutely. Among **strangers**, the uniform voice is the better default: an identical acoustic channel is itself a fairness signal, and a newcomer has no relationship to the voice that would say their name — a stranger's recording of it carries no more warmth than a machine's while carrying more opportunity for mockery. Among people who **already know each other** — a family, a classroom after its first week, a returning circle — the chain is better, because the voices mean something and the sport's remaining work is warmth rather than fairness. The honest cost is stated plainly: **the chain forfeits the addressed-identically property**, and a circle that adopts it has traded a fairness signal for a warmth signal, which is a reasonable trade only once fairness is no longer the live question.\n\nTwo failure modes and their handling. A participant who leaves mid-session takes their recording's referent with them but not their recorded voice; a participant joining late has no one in the chain. In both cases the affected name **falls back to the uniform voice for the remainder of the session** rather than to the participant's own recording — the constraint holds under degradation, which is where constraints are actually tested.\n\n**Three constraints on Free, because it switches the sport's dignity guarantees off.** Equal-touch distribution and the cannot-target-weakness property both live *in the caller*; with the caller off, humans choose receivers again and the picked-last dynamic returns. Accordingly: **(a)** a caller-on format remains the default everywhere; **(b)** Free must never be represented to an institution as equivalent — the anti-exclusion properties an administrator approves are precisely the caller's, and a free-play session does not carry them; **(c)** **any trial of the caller mechanism must run a caller-on format** — Relay or Call — or it measures nothing. That constraint is stated by *property* rather than by position in this list, which is why the formats carry names: a future revision may add or reorder formats, and the rule must not silently come to designate the wrong one. On which point see §9.1: Free is not merely a fallback but the natural **control arm** for the experiment that tests the caller itself.\n\n---\n\n## 6 · The Start Line: Handicaps as Sizes, Not Ratings\n\nMixed-ability play fails two ways: with no handicap, the game is a rout; with a visible skill-rating handicap, the game is fair and *humiliating* — the rating announces precisely how much worse you are, to two decimal places, forever. Golf's handicap system, the great success of the genre, threads the needle partly by its own crudeness and its social conventions; explicitly skill-rated matchmaking (chess Elo, ranked ladders in esports) threads it in the opposite direction, by making the rating the point. A family sport needs a third path.\n\n**The start-line handicap.** In net mode, the two sides may begin at *different* start numbers — the stronger side at 33, the beginners at 21; first to zero still wins. The handicap is public, singular, and ceremonial: one number per side, announced before play, arguable by nobody because chosen by no player (the system sets it, and its rubric is one-sentence-explainable: *fairness plus desired game length*). It is applied **at the start line, never in the stream**: once play begins, the caller and umpire treat both sides identically (§4's hard constraint), and any correction of a misjudged handicap waits for the *next* game — the rubber band lives between games, never inside one. A mid-game rubber band (catch-up mechanics, dynamic difficulty) is the standard videogame solution and is rejected here by name: dynamic mercy is detectable, and detected mercy is humiliation delivered by an algorithm.\n\n**Quantization-for-dignity.** Start numbers are drawn from a coarse fixed lattice: **multiples of three only** (3, 6, 9, … 21, … 33). The coarseness is the point. If start numbers could be any integer, the pair (26, 24) would communicate a *precision measurement* — a skill rating in countdown clothing, recreating exactly what the start-line design exists to avoid. Quantized to the lattice, the handicap can only say what a garment size says: roughly this, roughly that, next size up. The minimum expressible gap (three) is large enough to be read as a category rather than a diagnosis. Handicap literature treats coarseness as a deficiency of precision; this design claims the opposite — **in social play, quantization is a dignity mechanism** — and registers the inversion as a claim (Claim 4). Two free properties follow: the start number doubles as the **duration dial** (a park quickie from 9, a festival final from 33), and the lattice happens to be the institution's own numerological signature (three, the heart; thirty-three, the founding number) — a brand fact noted for honesty and carrying no mechanism weight.\n\n**The difficulty dials live in the world, not in the system.** The anti-rating guards of §4 constrain what the *system* may hold; they do not constrain what the *circle* may vary, and a dial the system cannot see cannot rate anyone. Two follow, neither visible to the caller.\n\n- **The circle's radius.** When a circle has learned the names and stopped dropping the object, the whole ring steps back. The object spends longer in the air, so there is more time to arrive under it — but the aim must be truer, the target is smaller, and there is far less margin for a lazy send. The radius is a *size* in the sense this section gives that word, and it is collective by construction: **the whole ring steps out, or it stays where it is.** Nobody is moved back for being good and nobody is pulled in for being new.\n- **Method restriction.** The three methods of §3.1, read in the other direction. Chosen *downward* they are an accessibility fit; chosen *upward* they are a narrowing — one hand rather than two, one surface rather than several. A declared method is already a start-line handicap (Claim 12), so this introduces no new machinery: it is one axis read as a self-imposed constraint rather than a declared capability.\n\nThree constraints govern both, and the first is the one an implementer will not derive. **Declare what, never why.** The sharpest risk at these dials is not fairness but *accessibility*: if *one hand only* becomes a legible difficulty badge, then a player who is one-handed by anatomy reads as playing hard mode, and the circle has been invited to read a body as a declaration. The surface says *one hand — you choose which*, never *your weak hand*. **You narrow your own**: a circle may step down together, but each player chooses what they give up, or a shared restriction excludes exactly the people mixed-method play exists to include. And **at the start line, never in the stream**, as with every other handicap here.\n\n---\n\n## 7 · The Mesh and the Ball\n\n**The synced-circle mesh.** The call must be heard outdoors, over wind and traffic, by everyone at once — the mundane detail on which the whole design stands or falls in a real park. The solution is already standing in the circle: **every player's phone joins the session and speaks the call in unison.** N players are N loudspeakers arranged, by the game's own geometry, in a ring around the play — a surround system that assembles itself and scales with the circle. The mesh deletes the alternative's failure modes (a single device at the circle's center is a trip hazard, a theft target, a single point of failure, and one weak speaker), and it enables a property no single device could offer: **the multilingual circle**. The *call* — the name — is one utterance in one voice; but score announcements and celebrations can be rendered per device, in each phone's own language. A grandmother hears the milestone in Khmer as her grandchild hears it in English, in the same circle at the same moment. For diaspora families — the institution's first constituency — the feature is not cosmetic; it is the difference between a game the whole family plays and a game the grandchildren play while the elders watch. The engineering cost is stated honestly: multi-device simultaneous playback requires tight clock synchronization or the call smears into echo; local time-sync is a solved class of problem, but it is version one's hardest component.\n\n**The two-stage hardware split.** Version one of B-Sey is **software plus any ball on earth** — the app is the caller, umpire, and equalizer, and the ball is whatever the circle owns. Nothing in §3–6 requires instrumented equipment. The manufactured **B-Sey™ ball** — designed for the foot-and-paddle dual strike, and eventually voiced, so the call emanates from the play itself — follows as a second-stage artifact, and brings with it the **ball chronicle**: the ball carries a durable identity (per this corpus's Proof of Coordinate℠ publication) and keeps its own biography — the circles it has played, the records it has witnessed, the dedications spoken over it. The chronicle records *collective* history only (a ball remembers parks and streaks, never individual performance), and a well-traveled ball becomes what sporting goods have never been: a commons artifact whose value grows with use, passed between circles as a gift that carries its own story. The split is a deliberate adoption strategy: the sport must never gate on hardware; the hardware, when it comes, must only deepen a game already alive.\n\n### 7.1 · Local-first architecture, and the object's actual job\n\n**The entire game runs on one device, offline, with no accounts.** Names, pronunciations, pacing, both scoring arrows, start numbers, and celebration thresholds are local state; the complete data model of a thirty-player circle with recorded pronunciations is on the order of a megabyte. Only genuinely shared artifacts require a network — cross-circle discovery, records that travel between places, and the object's own biography.\n\nThis is not primarily an economy measure. It is the architectural expression of constraints the design already carries: no per-player statistics, no analytics on minors, chosen names never leaving the circle, and a private-mirror rule for any per-player derivation. Each of those independently says *keep it on the device*. That the result is also nearly free to operate at any scale, and that it works in a park with no signal, a school with a locked-down network, and a village on intermittent data, is a coincidence of goods rather than a trade-off.\n\nTwo engineering notes. The synchronized announcement requires **device-to-device transport, not a server** — the platform peer-to-peer facilities (Apple's MultipeerConnectivity; Android's Nearby Connections) are designed for exactly this. The genuine risks are **cross-platform pairing**, since any real circle is mixed, and **clock alignment**, since simultaneous playback across N devices reads as an echo rather than one voice beyond roughly twenty milliseconds of skew; a leader device scheduling playback at a negotiated offset is the standard remedy, with **single-announcer fallback** — never a deliberate stagger — if alignment resists. And the classroom deployment of §9.1 requires no mesh at all, so the hardest component is not on the critical path to the design's primary channel.\n\n**The object's job is smaller than it appears.** Because the caller assigns identity (§5.1), an instrumented object need not report *where* it is or *who* holds it. Radio-signal-strength proximity cannot in any case discriminate between players standing one to three metres apart with bodies intervening; precise ranging radios exist but are confined to premium handsets, which would breach the design's zero-floor commitment. **The object therefore needs an accelerometer and a clock, and uses its radio as a messenger rather than as a tape measure** — reporting `{object_id, touch, t}` for the system to pair with the call it has just issued. The consequence is that instrumentation costs the price of a motion sensor rather than a positioning system, and that **the object needs no speaker at all**, since the mesh already speaks — deleting the most expensive and least durable component from an object designed to be kicked.\n\nTwo constraints follow that an implementer will not derive on their own. First, an object broadcasting a stable identifier is a **tracking beacon**, and children are the primary population; the identifier must rotate publicly while the object's durable identity is held cryptographically and locally, so that the biography of claim 10 survives without the object becoming a tag on a child. Second, and more subtly: **once touch events exist and the system knows who was called, a per-player success table becomes trivially computable** — the exact artifact §4 and §12 forbid. The guard must therefore be restated at the hardware layer: **object telemetry aggregates to the circle, never to a player scoreboard.** The general lesson is worth stating plainly for anyone instrumenting a sport: *adding a sensor can silently re-open a guarantee that was previously enforced by the absence of data.*\n\n---\n\n## 8 · What Winning Moves: The Play/Currency Wall\n\nStated as the shared spine of this sprint and applied here in its simplest form: **competition and play may generate the story; only witnessed giving moves the currency.** In B-Sey:\n\n- Victory in net mode moves **story and honor**: the chronicle records it; the winning side's captain may speak; the family retells it. It moves nothing else. No points convert to anything; no aura, reputation, ranking, or economic value attaches to winning; there are no ladders, no seasons, no standings.\n- The streak moves **story**: a number attached to a circle and a place, celebrated at repdigits, retold as local legend.\n- Where the sport meets the institution's gift economy at all — the challenge-and-stakes wrapper in which a match is played *for* somewhere money should go — every mechanism belongs to the companion paper (*The Wager That Isn't*), and the division is clean: that paper's walls guarantee that even there, **no money anywhere is contingent on outcome in its existence**; outcomes touch only honor and the address of already-given gifts. The sport itself never touches value.\n- **No player statistics exist.** This is the wall's deepest application, and it is absolute rather than default-off: the system does not compute individual performance records at all, because a computed-but-hidden statistic is a breach waiting for a product manager. What the scarcity era recorded by necessity (§1), the abundance era must refuse by design — total witness makes *everything* recordable, and the whole dignity architecture of this sport rests on recording the circle and not the person.\n\nAn extractive implementation of this paper's mechanisms — an AI caller with engagement-optimized distribution, player-skill surveillance, streak leaderboards, and rated matchmaking — is entirely feasible and is the obvious product a games incumbent would build from the same parts. The claims below are published precisely so that the *dignity-preserving* configuration is prior art: the caller that never evaluates, the handicap that cannot humiliate, the record that has no names in it.\n\n---\n\n## 9 · Adoption Thesis and Pre-Registered Predictions\n\nA sport's mechanisms are worthless if nobody plays. The design's adoption thesis is stated in one line for the record: B-Sey's path to scale is the **utility path** — it is the only sport that solves a non-sport problem (strangers becoming friends; names being learned; nobody excluded), so institutions that adopt *tools* (schools, workplaces, festivals, parks departments) can carry it to places marketing never reaches. Its floor is as low as any game on earth (any ball, any space, a free app, rules learned in three seconds because the call grammar is Simon Says' — one voice names who must act, everyone else waits — which every child already knows); its mixed-age property is pickleball's growth engine, engineered threefold; its streak is a native short-video format; and its ceiling — the acrobatic kick — is inherited from sepak takraw, whose brutal floor kept a spectacular sport regional and whose lesson (spectacle recruits, access retains) this design encodes as the paddle. The full ranked analysis lives in the institution's design canon; the sprint paper registers only the wager and its instruments.\n\nThe predictions, pre-registered at the design layer (n = 0; every instrument awaits the first pilots):\n\n- **P-S1 (the name test).** After a single first session of at least 20 minutes in a circle of 5+ mutual strangers, a majority of participants can freely recall the chosen names of a majority of the circle. This is the mechanism's core social claim made falsifiable; if name-recall does not materially exceed the mixer-conversation baseline, the sport's central marketing truth is false and will be retired.\n- **P-S2 (the friendship test).** Among mutual-stranger dyads who meet in a circle, a measurably higher share exchange contact or co-attend a subsequent circle within 30 days than the baseline for comparable park co-presence without the game. The third-place thesis, instrumented.\n- **P-S3 (the fun wager — publish either way).** The design's existential risk is named in §11: being *told* where to pass may read as magic or as micromanagement. Prediction: in preference trials, caller-on play is chosen for replay at least as often as caller-off free play in mixed-ability circles (the design predicts the caller *wins* precisely where ability is mixed, and may lose in homogeneous expert circles, which is acceptable and expected). The authors commit to publishing this result whichever way it falls, including the design revision it forces if it falls badly.\n- **P-S6 (the address test — publish either way).** §1 asserts that the sweetness of a name is evidence of *another's* attention, from which §5.3 derives that no participant may be called in their own voice. Prediction: in circles run twice under otherwise identical conditions, sessions in which each participant is called in their own recorded voice will produce lower reported comfort and lower willingness to play again than sessions in which the same names are called by a human relay or a single uniform voice — and the gap will widen with the number of calls per participant, since the design's stated defect is one of *repetition* in public. Two counter-hypotheses are named in advance and would falsify the premise's strong form if borne out: **habituation** (self-voiced discomfort decays across a session rather than accumulating) and **celebration** (children in particular experience their own voice announcing them as being made much of, not exposed). The authors commit to publishing this either way, because the address premise is now the paper's spine and a null result would demote it to a preference.\n\n- **P-S7 (the premise beneath the mission — publish either way).** Every prediction above tests the sport. This one tests whether the thing the sport does is worth doing, and it can be run without the sport at all. Prediction: classrooms in which the teacher devotes the first weeks of the year to ensuring that **every student can name, and correctly pronounce, every classmate** will show higher belonging than matched classrooms that do not. Three specifications make it falsifiable rather than merely agreeable. **The design must be within-teacher** — a secondary teacher with several sections randomizes some of them to the protocol — because a teacher who spends three weeks on names is *already* a teacher who prioritizes classroom community, and that confound is otherwise almost perfectly correlated with the treatment. **The primary outcome is named in advance**: a validated sense-of-school-membership measure, with cross-student conversation-initiation counts as the secondary and sharper instrument, since the mechanism proposed here is specifically that knowing a name lowers the cost of speaking first. **And the open edge is narrower than the general claim** (§10 surveys what the literature does and does not contain) — instructor-knows-student-names is studied; what is not is *student-to-student* coverage, pronunciation as a mechanism rather than as an identity concern, and **completeness**: every student knowing every classmate, which no existing practice delivers and which equal-yet-random produces as a by-product. If P-S7 fails, this sport may pass every other prediction here and still be a well-made game with no mission.\n\n- **P-S8 (maintenance, and the counterfactual that nearly kills it — publish either way).** Prediction: circles played intermittently through the year sustain full-coverage naming where unplayed classes do not. Stated naively this is close to untestable, and the paper says so rather than banking the easy result: **classroom atmosphere normally improves over a school year anyway** — by midyear most students know each other through proximity, with no pedagogy at all — so \"maintained\" describes the untreated case too. The specification that saves it is that what decays is not name memory but **coverage at the margins**: natural acquisition is lopsided, students learn their friends' names and not the quiet child's, and a class re-sorts into clusters in which peripheral children become nameless again. **The instrument must therefore report the minimum, not the mean** — the worst-covered student in the room, never the average. Mean recall looks excellent in any midyear classroom, and the child nobody can name is invisible in a mean; a mean-based instrument would report success in precisely the classroom this sport exists to change.\n\n### 9.1 · The icebreaker slot, the classroom, and the recess test\n\nThe adoption thesis above ranks schools fifth. On the analysis below they rank first, and the reason is a general one worth stating separately from this sport.\n\n**A product that claims to ride an existing behaviour must name a behaviour a target adult actually performed, unprompted, in the last twelve months** — and the host must also match the product's commitment level and be in good standing with whoever must permit it. Run that test across this sport's candidate channels and exactly one host passes all three parts. Park circles are a *new* habit: nobody currently goes to a park to play a called circle game, so that channel must be budgeted as habit formation. The classroom is different. Every teacher on earth faces the same two problems in the same week of every year — learn thirty names, and include every child — and *already runs a name game to solve them*, unprompted, annually, worldwide. Elementary morning-greeting routines are a standing institutional ritual. Recess is daily. The commitment shape matches almost exactly: ten to fifteen minutes, free, no equipment, teacher-led, repeatable. And the standing is positive rather than merely tolerated: name learning, inclusion, and anti-bullying are things administrators actively want, which is the inverse of the polarity most novel objects carry into a school.\n\n**The reframe this forces is the practical conclusion of the whole paper.** The behaviour this sport attaches to is not *sport* at all; it is **the name-learning icebreaker** — performed at school openings, orientations, retreats, onboardings, receptions, and newcomer groups, universally, and universally disliked. Its incumbent competitors are the seated round of self-introductions and the disclosure game. Against those, a called circle wins on every axis that matters: **twenty exposures to each name instead of one**, movement instead of standing, nothing to disclose about oneself, and no performance in front of strangers. **The sport ships as an icebreaker and is discovered as a sport** — and Friendship mode at long lead time (§3.1, §4.1) *is* that icebreaker, arrived at from the sport's own logic rather than designed for the channel.\n\n**Rosterless classroom mode.** The classroom deployment is specified as **single-device**: one teacher's device speaks; no child device participates; the roster is entered once by the teacher and reused; **no accounts exist for minors, no analytics are collected, nothing is uploaded, and the roster is local and erasable.** This is not compliance decoration — a roster of children's names and voices is precisely the artifact that fails an institutional privacy review, and the permitting authority and the privacy authority are the same office. It also happens to remove the mesh, the network, the accounts, and the instrumented object from the primary channel: **a teacher, a phone, and a soft sack.**\n\nThe pronunciation commitment (§4, claim 9) is satisfied in this mode **without recording anything**. At long lead the called child raises a hand and says their own name, and the circle repeats it; **the scaffold is itself the pronunciation-capture mechanism, performed by a human.** The circle converges on the child's own delivery rather than a synthesizer's approximation — which is the correct outcome in the venue where mispronunciation is actually inflicted, and which requires no biometric capture to achieve.\n\n**Two further pre-registrations.** The design's existential uncertainty (§11) is whether being *told* where to pass is delightful or officious, and only play answers it. The classroom supplies an unusually clean and cheap instrument:\n\n- **P-S4 (name acquisition).** A circle that reaches the short-lead band will show ≥90% correct-name *and* correct-pronunciation recall among its members at one week, measured by naming photographs. This refines P-S1's instrument rather than replacing it.\n- **P-S5 (the recess test — the fun test made falsifiable; publish either way).** Within two weeks of teacher-led sessions in a caller-on format, at least one **student-organized circle will form at recess without adult prompting**, and at least one such circle will include children from a different classroom. The prediction carries a **stated precondition**: a single device must be *available* at recess and no instruction to use it may be given. Without that precondition a null result is uninterpretable — it cannot distinguish *the game is not fun* from *there was no phone*, which is the one distinction the test exists to make; with it, the readout is clean in both directions. The second clause is the stronger instrument: cross-class mixing is this design's social claim, measured in the one building where the social graph is otherwise frozen by classroom assignment.\n\nP-S5 costs one teacher, one class, one sack, and two weeks, and its readout cannot be spun: unsupervised children do not organize a game out of politeness. **Free (§5.2) supplies the control arm** — a second class playing free play with the same object and the same counter. The comparison isolates the caller itself, which is the single variable the entire design rests on and the one no amount of design reasoning can settle.\n\n---\n\n### 9.2 · Who pays: place sponsorship, and the test that scopes it\n\nThe economics follow the architecture. Because §7.1 puts the game on the device, the marginal cost of a player is approximately zero, and only the shared layer — cross-circle discovery, travelling records, organizer tooling — has a server behind it. The free tier is therefore *the entire sport*, permanently, and revenue must come from somewhere that is not the player.\n\nThe specification is **place sponsorship**: a patron funds the shared layer for a **geofenced public place** — a school, a park, a neighbourhood — and every circle that plays there receives it. The individual player never pays, at any tier, ever.\n\n**The scoping test is non-excludability, and it is the whole rule:**\n\n> **A place is sponsorable if and only if the sponsor cannot exclude anyone from it.**\n\nNot *does the sponsor benefit* — they always do, and should — but *could the sponsor shut the gate*. A private residence fails: the door is controlled, the good is excludable, and the payment is a purchase wearing a patron's coat. A neighbourhood, park, school, plaza, or temple courtyard passes: the good is non-excludable, so the payment remains a gift even when the sponsor's own family plays there.\n\nFour constraints are specified with it, and the first is the one an implementer will get wrong:\n\n1. **No commercial sponsorship of child-facing places.** Schools and children's circles are funded by individuals, families, alumni, parent associations, or civic groups — or by nobody. Commercial patrons may sponsor adult venues and public parks. This eliminates the child-advertising problem structurally rather than managing it, which is the only treatment that survives contact with the world's various child-marketing regimes.\n2. **Acknowledgment, never advertising.** Where a sponsor is shown at all: a **name, never a message** — no slogan, claim, link, or animation — and placed on the organizer's surface or in the session's closing thanks, never in the children's play surface.\n3. **No control, no data, no exclusivity.** A sponsor learns nothing about who played or how often, may not be exclusive to a public place, and gains no influence over it; **an unsponsored place is never degraded**, since the free tier is the whole game. Reach reporting is specifically prohibited: an impressions metric reintroduces both advertising logic and child data by the back door.\n4. **The two flows never net.** The sponsorship payment is revenue; any gratitude the circles direct back at the sponsor is not a rebate against it. Consistent with this corpus's routing rule — *thanks may fund a livelihood; thanks may never pay a bill* (see *B-Links: Proof-of-Humanity-Signed Shareable Provenance*, §6.1, where the rule is specified and freed) — value returned to a sponsor is credited as **forward-spendable gift capacity**, never as a discount and never as withdrawable funds. What a thanked sponsor receives is the capacity to give again.\n\nThe resulting circuit is worth naming because it is the reason this revenue model is not a compromise with the mission: **a patron funds a place, the circles that play there thank the patron, and the thanks funds the patron's next gift.** The payment mechanism is itself an instance of the thing the institution builds.\n\n---\n\n## 10 · Prior Art, Engaged Generously\n\n**The circle games.** The direct ancestors are the Southeast Asian circle keep-alive family: the Khmer *sey*, played at dusk in courtyards and parks across Cambodia; Myanmar's *chinlone*, a six-person circle game explicitly organized around beauty and collective flow rather than opposition — the world's great existing proof that non-adversarial ball sport can sustain a culture for centuries; China's *jianzi* and the global hacky-sack/footbag family. B-Sey is a descendant of this lineage and says so in its name; what the lineage lacks — and what kept it local — is an equalization layer (the skill floor of foot-only play is high) and any addressing mechanism (circles of strangers stay strangers). Sepak takraw contributes the net form and the spectacular ceiling, and the cautionary lesson of a magnificent sport whose difficulty floor confined it to its region.\n\n**The designed prosocial sports.** Sport design as deliberate social engineering has a distinguished small lineage: korfball (1902), which mandated mixed-sex teams by rule; tchoukball (1970), designed by Hermann Brandt from an explicit medical-humanist brief to eliminate aggression — its no-interference rule is the closest ancestor of the cannot-target-weakness property, though it removes *contact* rather than *targeting*; kin-ball (1986), designed for total participation with its all-touch service rule — the nearest prior art to equal distribution, achieved by static rule rather than adaptive caller; Special Olympics Unified Sports and the walking-football/walking-netball movement, which achieve mixed-ability play by restricting the able rather than equalizing the field. The Ultimate frisbee community's spirit-of-the-game — self-officiating as ethos — is the officiating seat's spiritual ancestor; B-Sey completes what spirit-of-the-game gestures at by making the neutral judge structural.\n\n**The handicap systems.** Golf's handicap (formalized from the 18th century) is the great proof that start-line equalization can carry a mixed-ability sport for centuries; go's fixed-stone handicaps and chess odds-giving are older still. All are lattice-coarse in practice, none (to the authors' knowledge) has claimed coarseness as a *dignity* mechanism, and none operates in a team net sport. Videogame dynamic-difficulty adjustment and matchmaking ratings are the anti-examples engaged in §6: fairness delivered as either hidden mid-stream mercy or public skill measurement, the two failure modes the start-line design refuses.\n\n**The caller's ancestors.** Simon Says supplies the call grammar — a named authority directing named players — as a children's commons centuries old; square-dance calling is the adult form: a caller directing the figures of a cooperative physical game in real time, and the closest single ancestor of the caller seat (what square dance does with figures, B-Sey does with receivers). Neither selects *whom* adaptively; neither equalizes; both prove the pleasure of called play.\n\n**The draw beneath the caller is not new, and this paper claims none of it.** Every leg of the arithmetic §4.2 and §4.4 describe was public before this sport used it: selection that is seeded, published and recomputable by anyone (Eastlake's RFC 2777 and RFC 3797, 2000 and 2004); the equal-count bag (rotating savings associations that order the pot by lot, formalised as the random ROSCA by Besley, Coate and Loury in 1993; permuted-block randomisation in clinical trials, whose literature already records the bag's cost that §4.4(a) states — the last turns of a block are predictable from the first; the Tetris seven-piece bag, from 2001); the keyed per-span permutation that v2 uses (Ethereum's beacon-chain committee shuffle; Chainlink's Off-Chain Reporting 3.0); and v2's boundary swap itself, in a Rust shuffle-bag crate published in April 2025. The census that established this, and the generalisation of the draw beyond play — to recurring benefits, to a lot form, and to a sealed regime for an operator whose own gifts must stay anonymous — is the companion paper *Decided by No One*, which names this sport as the primitive's origin. What claims 3, 17 and 23 place in the public domain is the draw's use as a *sport's caller*, and the constraints that use imposes: named receivers, no conditioning on evaluated play, count-only coherence, round continuity, and no per-player record.\n\n**The instrumented-sport patent field.** Smart balls (Adidas miCoach, Wilson X and successors), computer-vision officiating (Hawk-Eye, VAR, automated ball-strike systems), and AI sports-coaching applications (HomeCourt and the computer-vision training genre) constitute an active commercial and patent field moving fast in precisely the opposite direction from this paper: toward finer individual performance measurement. The field is engaged respectfully as the reason this publication exists now: an AI-directed pass-calling mechanism with adaptive distribution is an obvious near-future patent claim in extractive form (engagement-optimized, stat-generating), and the present publication places the mechanism class — and specifically its dignity-preserving configuration — in the public domain first.\n\n**The third-place literature.** Oldenburg's *The Great Good Place* and Putnam's *Bowling Alone* frame the vanishing social infrastructure the sport addresses; the recent public-health literature on loneliness (including the 2023 U.S. Surgeon General's advisory) supplies the epidemiological register. Bowling leagues were Putnam's emblem of what was lost; a self-assembling park circle that teaches names is offered, without irony, as a candidate replacement part.\n\n**The name-and-belonging literature, and the side of the relation it sits on.** The claim that names carry belonging is not this paper's invention, and the existing evidence sits almost entirely on the *instructor's* side. Cooper et al. (2017) found that students in a high-enrollment biology course who **perceived that an instructor knew their names** reported better attitudes toward the course — the construct is *perceived* knowing, narrower still than knowing. Kohli and Solórzano (2012) establish the negative case in the identity register, documenting name mispronunciation in K–12 classrooms as a racial microaggression with durable effects on how students relate to their own language and family. Walton and Cohen (2011) is the outcome-side anchor and not a name study at all: a brief social-belonging intervention produced academic and health effects measurable three years later, which is the reason to believe belonging is movable by small structured means in the first place. Goodenow's (1993) Psychological Sense of School Membership scale is the validated instrument P-S7 and P-S8 specify rather than inventing one.\n\n**What that literature does not contain is the relation this sport operates on.** All of the above run *teacher → student*. Peer-side work establishes that perceived peer inclusion predicts belonging, but not that a name intervention produces it. The authors are aware of **no controlled study of student-to-student full-coverage name knowledge** — every student able to name, and correctly pronounce, every classmate — which is the completeness condition equal-yet-random produces as a by-product, and which the practitioner literature on icebreakers and name games asserts freely without testing. That gap is P-S7's subject. It is stated here as a gap, not as a discovery: it is the kind of question an education researcher is far better equipped to answer than a sport designer, and this paper would rather be corrected than cited.\n\n---\n\n## 11 · Honest Limits\n\n*This section is deliberately free of lineage, resonance, and metaphor.*\n\n1. **n = 0.** The sport is unbuilt and unplayed. Every property claimed above is architectural; no prediction has data; the first real circle may falsify any of them.\n2. **The address premise is asserted, not measured — and it is now load-bearing.** §1 rests the entire architecture on the claim that a name's value derives from *another person's* attention, supported by a 1936 maxim and by attention research (the own-name effect) that establishes something narrower than what is claimed here: that one's own name captures attention, not that hearing it from another is what makes it sweet. No study cited measures the self-voiced case, because no one had reason to construct it. P-S6 is the instrument, and it is unrun. Two named counter-hypotheses — habituation and celebration — would each demote the premise from spine to preference, and one of them (celebration, in children) would land hardest in the classroom channel this paper ranks first.\n3. **The uniform synthetic voice is a partial satisfaction of the paper's own premise.** §5.3 concedes it: a system voice is an *other*, which is what the constraint formally requires, but it is not a person who spent attention on you, which is what §1 says makes the sound sweet. The specification handles this by ranking the formats rather than by resolving it — Relay is the default precisely because a human says the name. Whether the machine-voiced case retains most of the effect, a little of it, or none is unmeasured, and the honest position is that **Call may turn out to be a materially weaker sport than Relay for reasons no amount of audio engineering can fix.**\n4. **The fun risk is existential and unresolved.** Directed play may feel like magic in mixed circles and like micromanagement among skilled peers. If caller-on play is not preferred for replay (P-S3), the central mechanism fails as a product regardless of its virtues as architecture. Free-play mode and caller-cadence tuning are the mitigation paths; neither is designed yet.\n5. **The mesh is unproven engineering.** Simultaneous multi-device audio requires clock synchronization tight enough to avoid echo, on heterogeneous consumer phones, outdoors, on degraded networks. This is version one's hardest component and it sits directly on the critical path of the first minute of a first session.\n6. **App dependency taxes the floor.** Pickup soccer needs no battery, account, or download. Every point of onboarding friction spends the zero-floor advantage; offline operation and caller-optional play must be real, not roadmap.\n7. **The equal-random policy has unmodeled edges.** Injured players, players who wish to opt down, players joining mid-streak, very large circles (call latency vs. rally tempo), and adversarial-mode team-size asymmetries all require policy the design has not specified. Each is solvable; none is solved.\n8. **Accessibility claims are untested.** The call-before-ball structure plausibly aids low-vision players (an auditory pre-cue) and the circle-plus-paddle geometry plausibly admits wheelchair players; both are stated as design intentions, not verified properties, and will not be marketed until tested with the relevant communities.\n9. **Copyability is total.** The mechanism is a weekend's work for any competent app studio, which is the reason for this publication's timing: the defense is prior art plus the layers no cloner inherits (the mission, the name, the constraint set — and an extractive clone that omits the constraint set is, by that omission, visibly not this sport).\n10. **Base rates are brutal.** Global pastimes are a power-law lottery; pickleball's overnight success took fifty years. The design's honest consolation is that its unit of success is one park: a single circle that runs produces its friendships on the spot, whether or not the world follows.\n11. **The three-axis parameterization multiplies untested surface.** Twenty-seven combinations of method, mode, and level are legal, and none has been played. Mixed-method circles in particular assume that a single soft object serves catch, paddle, and foot without one method spoiling the rally for the others — plausible, unverified, and the kind of thing one afternoon in a park would settle or destroy. Note what the parameterization does and does not cost: **declared combinations multiply, implementation surface does not** — the axes are three declarations and a lattice, not twenty-seven code paths.\n12. **The implied-point tier will inflate records.** Trusting the call means a dropped object sometimes counts, and social correction in a circle is real but imperfect. Evidence tiering (§5.1) makes the inflation legible rather than eliminating it, and no cross-place record comparison should be published without its tier.\n13. **The classroom channel depends on a privacy posture that has not met an actual reviewer.** §9.1 specifies local-only operation because that is what such reviews normally require, but no district has yet examined this product, requirements vary by jurisdiction, and an unfavourable determination in a large market would remove the channel this paper ranks first.\n14. **Free can mask the failure it was built to survive.** A caller-optional mode is the honest mitigation for the fun risk and also a way to never learn the answer: if circles quietly migrate to free play, usage will look healthy while the central mechanism goes untested. The pre-registration in §9.1 is written to force the comparison rather than permit the drift.\n15. **The sponsorship model is unexercised and its guards are unpoliced.** No place has been sponsored. The child-facing commercial prohibition (§9.2) is a rule this institution can hold in its own implementation and cannot enforce in anyone else's — which is, as with the constraint set generally, exactly the part a cloner will drop first.\n16. **The first published caller shipped a predictability defect, and it cannot be withdrawn from the circles that carry it.** v1's boundary rotation made a round's closer close the next round with probability 2/n — two times in three at Call's floor of three (§4.4). It went unmeasured until 13 September 2026, it passed every conformance vector because the vectors fixed the sequence rather than its distribution, and the recomputation audit this paper offers as the caller's safeguard could not detect it, since that audit checks faithful dealing and equal counts, not the shape of the order. The repair applies only to circles created after it: every earlier circle replays v1 indefinitely, by the versioning rule that protects its record. Nothing here establishes that v2 is free of a defect of the same kind; it has its reference suite (which measures the swap at four players), a port written from its specification by the same author, and a live measurement at three players — and no outside review.\n17. **Unpredictability is watcher-level, and the seed is the opener's.** §4.4 scopes *anyone's name may be next* to three structural limits: the bag forces each round's last name for anyone who counts, the previous closer never opens, and any device in the circle can compute the sequence ahead. The first means a player already called in a round can disengage until it ends, which §4's promise does not survive in a small circle; whether players actually count is unmeasured. Separately, the seed is generated on the device that opens the circle, so recomputation proves faithful dealing from a declared seed and nothing about whether the opener discarded seeds they disliked. That residue is accepted for play order and would be disqualifying for any draw that allocated value.\n\n---\n\n## 12 · Claims\n\nThe following mechanisms and architectures, individually and in combination, are published as prior art and dedicated to the public domain:\n\n1. **The caller mechanism.** A physical game in which an automated intermediary announces, before each play, the identity of the required next receiver, audibly and by name, such that play cannot proceed except through the named player.\n2. **The cannot-target-weakness property.** A net or team sport in which the automated caller designates receivers on all sides, structurally removing opponent-selection (including weakest-player targeting) from the space of legal or possible plays, and confining skill expression to delivery quality.\n3. **Equal-yet-random distribution.** A caller selection policy jointly guaranteeing (a) equal per-player reception counts **over a complete round** — one pass through the roster, the session being a *prefix* of a round and not itself the guaranteed unit — and (b) unpredictable selection order, with the explicit constraint that the policy never conditions on player skill, performance, or match state during play.\n4. **The start-line handicap with quantization-for-dignity.** Team equalization implemented solely as asymmetric starting scores in a countdown game, drawn from a coarse fixed lattice (exemplarily, multiples of three), set by a neutral intermediary from a fairness-plus-duration rubric, with between-game (never within-game) recalibration — the coarseness claimed specifically as an anti-rating, dignity-preserving mechanism.\n5. **The dual-arrow ruleset.** A single sport in which cooperative mode scores by ascending collective streak and adversarial mode scores by countdown to zero (\"first to nothing wins\"), with mode selecting the arrow.\n6. **The dyadic scoring unit.** A scoring rule under which the atomic scoring event is a completed delivery-and-reception pair credited to no individual, such that no player can score alone.\n7. **The last-gift rule.** A countdown finishing rule requiring the final point to be actively won by the finishing side, excluding conferral by opponent unforced error, as classified by the automated umpire.\n8. **The synced-circle mesh.** Delivery of game announcements through simultaneous clock-synchronized playback on all participating players' personal devices, arranged by the game's own geometry as a surround array, with per-device language rendering of non-call announcements.\n9. **The name-learning mechanic with chosen-name privacy.** The use of pre-play name announcement as a deliberate stranger-introduction mechanism, bound to user-chosen circle names (never legal names), with children's circles restricted to first names or nicknames; including double-blind surfacing of nearby solitary individuals as circle invitees such that neither party learns who initiated and no solitude status is ever disclosed.\n10. **The collective-only chronicle.** A witness architecture that records streaks, records, and celebrations as properties of circles, places, and equipment (including a ball-borne biography anchored to a durable device identity), while computing no individual performance statistics whatsoever; with celebration rationing on an exponential repdigit schedule.\n11. **The call-lead-time ladder with scaffold fading.** A difficulty parameter defined as the interval between the naming of the receiver and the object's arrival — invariant to participant count and to method — banded such that the longest band includes an explicit identification scaffold (the called player self-identifies by raised hand and may speak their own name) which becomes physically unavailable as the interval shortens; so that advancement through the bands tracks the group's *name recall* rather than physical skill.\n12. **Method as declared start-line handicap.** Heterogeneous body vocabularies (hand-catch, implement, foot) exercised by different participants within a single circle on a single shared object, each self-declared publicly before play as an instance of the start-line handicap of claim 4, with reception-by-catch bounded by a release interval clocked to the caller's own cadence.\n13. **The mode ladder with a no-score entry rung.** A single sport whose modes are ordered by opponent relation — none, own record, other circle — whose entry mode has no scoring of any kind, and whose advancement between modes is elected by the participants rather than triggered by performance.\n14. **Circle-scoped adaptation, and the circle-scoped level invariant.** Any automatic adjustment of pacing or difficulty conditions solely on aggregate state of the whole circle, never on per-participant response latency or performance, with per-participant timing neither stored, displayed, ranked, nor retained; the level being a property of the circle and never of a player.\n15. **The three-tier scoring architecture with the implied point and evidence tiering.** Scoring by (a) inference from the call alone, (b) k-of-N agreement across participants' device microphones detecting — not localizing — a strike within a window supplied by the announcement synchronization, or (c) a motion sensor in the object reporting a touch event paired to the outstanding call; identity in all tiers supplied by the caller rather than by sensing; the object's radio used as an event messenger rather than a ranging device; records annotated with the evidence tier that produced them; and the acoustic inversion by which the caller speaks participant names aloud while the count is rendered visually, with an alternate caller-off format in which the system counts aloud and designates no receiver.\n16. **Rosterless local-only deployment for minors, and the non-excludability test for place sponsorship.** A single-device deployment in which participant names are entered locally by a supervising adult, no accounts exist for minors, no telemetry leaves the device, and pronunciation is taught by the named participant in person rather than captured as biometric data; together with a place-scoped patronage model funding a shared service layer for a geofenced location, admissible only where the patron cannot exclude anyone from that location, and constrained by prohibitions on commercial patronage of child-facing places, on any sponsor message beyond a name, on reach reporting, and on netting patron gratitude against the patron's own payment.\n17. **The determined caller, with count-only circle coherence and the seat-migration bar.** A called sport in which the receiver sequence is a deterministic pure function of the participant roster and a seed declared before play, specified as a cross-platform bit-exact contract with published conformance vectors, such that (a) any participant may independently recompute a completed session and verify the equal-yet-random distribution property, rendering distribution fairness auditable rather than asserted; (b) multiple devices in one circle stay in agreement by exchanging only an elapsed-call count — never participant identities, sequence state, or selection reasons — with rejoin by fast-forward and no server; and (c) no per-participant record exists to be disclosed or repurposed, because the generator retains none. Claimed together with the governing partition: **determined** seats (caller, equalizer), whose outputs are checkable by recomputation and which never condition on evaluated player state, and **judged** seats (umpire, witness), whose outputs are checkable only by one-sentence explanation and which hold no authority over receiver selection; including the constraint that instrumentation of the object or environment may supply evidence to the judged seats alone.\n18. **The host-agnostic turn-assignment layer.** The caller primitive of claims 1–3 — pre-announced named-turn assignment, equal-yet-random distribution, circle-scoped adaptation, and the absence of per-participant evaluation — applied to an **arbitrary host activity** rather than to any particular sport: the warm-up, drill, or rotation phase of a conventional sport; a rehearsal; a classroom, workplace, or conference gathering; or any bounded group activity in which turns must be distributed among named participants. Claimed independently of the ruleset of §§3–6, so that the mechanism's applicability is not confined to the circle game specified here, and expressly including its use as a preliminary segment preceding an unrelated primary activity.\n19. **The relay call — decoupled selection and articulation.** A called activity in which the automated intermediary announces the selected participant's name **privately to a single human relay** — through that person's own device, audibly to them alone — who then articulates it aloud to the assembled group, such that: (a) selection fairness is machine-held while acoustic delivery is human, preserving every distribution property of claims 1–3 without the system addressing the group directly; (b) the activity runs on **one device**, with no loudspeaker, no audio infrastructure, and no device-to-device synchronization, and therefore no dependence on network, clock alignment, or participant device ownership; (c) the relay hears the participant-approved pronunciation immediately before producing it, making correct articulation a **modeled repetition** rather than a reading task, and thereby recruiting the relay's own vocal production rather than recognition alone; and (d) the relay role is itself assigned by the same equal-yet-random process that assigns receivers and rotates among participants, so that articulation practice is distributed rather than captured by the most confident participant, and so that occupying the role is a turn rather than an exclusion from play.\n\n20. **The address constraint, and the uniform calling voice.** A called activity in which the announcing voice for any participant's name is constrained by the system to be **other than that participant's own** — such that no participant is ever summoned by a recording or reproduction of their own voice — satisfied either by human relay (claim 19) or by a **single uniform synthetic voice articulating every participant's name**, the latter claimed specifically for the property that a uniform acoustic channel addresses all participants identically and therefore renders the equal-yet-random distribution of claim 3 in the acoustic domain as well as the numeric one. Including the negative constraint as an architectural invariant rather than a configurable default: a system holding participant-recorded name audio for pronunciation purposes is barred from using that audio as the call directed *to* the participant who recorded it.\n\n21. **Pronunciation-authority transfer to a foreign articulator.** A method by which a named participant retains authority over the pronunciation of their own name while that name is spoken by a voice which is not theirs, comprising: (a) capture of a participant-owned pronunciation artifact by any of three paths — a recording spoken by the participant, a recording spoken by a delegate at the participant's direction, or a participant-supplied **respelling** of the name in ordinary orthography rather than a phonetic alphabet; (b) an **approval act by the named participant** upon the resulting rendition, required before the artifact enters play and required identically of all three capture paths; (c) articulation by a distinct articulator — a rotating human relay to whom the artifact is played immediately before speaking, making articulation a modeled repetition, or a synthetic voice driven by the respelling and selected for a language the participant approved; and (d) **non-retention of which capture path any participant used**, such that no per-participant record distinguishes a self-voiced from a delegated or synthesised pronunciation. Claimed together with the separation it rests on: **the pronunciation and the call are distinct speech acts with distinct rightful speakers** — the first belonging to the name's owner, the second necessarily not.\n\n22. **The cross-recording chain — a group called in its own voices.** A called activity in which the audio announcing each participant's name is recorded by a *different* participant of the same group, assigned as a cyclic permutation of the roster such that each participant records exactly one other participant's name and is named by exactly one other participant's voice — producing *N* artifacts for *N* participants rather than *N²*, distributing the vocal labor exactly evenly by the same principle that distributes receptions, and satisfying the address constraint of claim 20 in its strong form (the speaker is a person who attended to the listener) rather than its formal one. Comprising: (a) capture at enrolment, in which the recording participant is first played the name-owner's own pronunciation model and then records their own articulation of it, so that the chain recording is a modeled repetition and the production effect is exercised by every participant before play rather than only by whoever holds a relay role; (b) approval of the resulting call audio by the *named* participant, on the same terms as claim 21 and with re-take available without stated reason; (c) **degradation to a uniform system voice — never to the named participant's own recording — when the chain is broken** by departure or late arrival, so that the address constraint holds under partial rosters; and (d) selection between uniform-voice and chain voicing as a property of the group rather than of any participant. Claimed together with the scoping rationale: a uniform channel addresses all participants identically and is the appropriate default among strangers, for whom identical treatment is a fairness signal, while the chain is appropriate among the already-acquainted, for whom the identity of the voice carries the meaning — the two being a documented trade of a fairness signal for a warmth signal rather than an improvement.\n\n23. **Round continuity via circle-scoped progress persistence.** A called activity in which the caller's progress through a round is persisted as a **circle-scoped integer index** — never a per-participant record, never a timestamp — such that a session ending before the round completes **resumes at the point it stopped rather than restarting**, so that participants not yet called in the current round remain uncalled-and-pending across sessions and across days. Claimed as the mechanism that makes the equal-distribution guarantee of claim 3 *reachable* under real usage, in which play is habitually truncated well short of a full round; claimed together with the property that the persisted state is a single integer per circle and therefore introduces no per-participant artifact (claim 17(c)); and claimed together with the observation that its absence is **undetectable by session-level testing**, since within any single session the distribution is exactly correct — so that an implementer working from a specification silent on this point ships an unequal distribution while passing every test they would think to write.\n\n---\n\n## 13 · Lineage, and the Close\n\n**A coincidence the design did not arrange.** The Khmer សី is pronounced close to the English *say*, which lets *sey circle* read, to an English ear, as a circle of sayings — and the sport turns out to be exactly that, since a completed pass is a name said and answered. The two words are unrelated: Khmer and English do not share this root, and the reading is a gift of one language rather than a fact about the other. It is recorded because it is pleasing and because the paper would be poorer for pretending not to have noticed it, and for no other reason. Strike this paragraph and every mechanism above stands untouched.\n\nThe lineage of this design is a courtyard at dusk. Across Cambodia, in the hour when the heat breaks, people stand in circles and keep a small woven ball in the air — no teams, no referee, no score that anyone writes down, only the shared project of *not letting it drop*. The game survived what Cambodia's twentieth century did to everything else that was gentle. This paper's whole mechanism is, in one reading, an attempt to give that circle three things the modern world took from its conditions of possibility: a fair way for the unequal to stand in it together, a voice to welcome strangers into it by name, and a record that remembers the circle rather than sorting its members. The sport is named for that game, and the name performs its own thesis — *sey* (សី), the inherited circle; *say*, the spoken name; a children's call-game hiding inside both. A note on the script, since the pun is a claim about a language and should be checkable in it: **សី** is *sey*, and the institution's rabbit mascot elsewhere is **ទន្សាយ**, *tonsay*. The two are unrelated words that merely share a syllable once romanized, which is worth stating plainly: in Khmer the resemblance is visible as coincidence, and only in Latin letters can it be mistaken for an etymology. The pun is offered as a pun. What the caller calls, in the end, is the oldest social technology there is: *you, here, now — the ball is coming to you.*\n\n---\n\n## Citations\n\n0a. Carnegie, D. (1936). *How to Win Friends and Influence People*. Simon & Schuster. (The premise's popular statement — cited at lens tier and explicitly inverted in §1: offered there as a technique for advantage, kept here only for the recognition.)\n0b. Moray, N. (1959). \"Attention in Dichotic Listening: Affective Cues and the Influence of Instructions.\" *Quarterly Journal of Experimental Psychology* 11(1). (The own-name effect in the unattended channel.)\n0c. Wood, N., & Cowan, N. (1995). \"The Cocktail Party Phenomenon Revisited.\" *JEP: Learning, Memory, and Cognition* 21(1). (Replication and bounding of own-name capture; the narrower finding §11 distinguishes from the paper's broader premise.)\n1. Aung-Thwin, M., dir. (2006). *Mystic Ball*. (Chinlone as cooperative circle sport; the flow ethos.)\n2. Oldenburg, R. (1989). *The Great Good Place*. Paragon House. (Third-place theory.)\n3. Putnam, R. (2000). *Bowling Alone*. Simon & Schuster. (Social-capital decline; league sport as civic infrastructure.)\n4. U.S. Surgeon General (2023). *Our Epidemic of Loneliness and Isolation*. HHS Advisory.\n5. Brandt, H. (1970). *Étude critique scientifique des sports d'équipe*. (Tchoukball's design brief; sport engineered against aggression.)\n6. International Korfball Federation. Rules of korfball. (Mixed-sex teams by rule, 1902 lineage.)\n7. Kin-Ball International. Official rules. (All-touch service; total-participation design.)\n8. United States Golf Association. *The Rules of Handicapping* (World Handicap System). (Start-line equalization at scale.)\n9. National Federation of State High School Associations; UK Football Association referee-retention reporting (2018–2025). (The officiating crisis.)\n10. Reporting and filings on instrumented sport: Adidas miCoach Smart Ball; Wilson X; Hawk-Eye Innovations; MLB Automated Ball-Strike System; NEX Team HomeCourt. (The active patent field.)\n11. Lepper, M., Greene, D., & Nisbett, R. (1973). \"Undermining Children's Intrinsic Interest with Extrinsic Reward.\" *JPSP* 28(1). (Reward and intrinsic motivation — the boundary the wall respects.)\n12. Ly, T. (2026). \"Proof of Coordinate.\" thonly.org defensive publication. (The device-identity primitive used by the ball chronicle.)\n13. Ly, T. (2026). \"Need-Compiled Questlines.\" thonly.org defensive publication. (The mints-nothing class; claims division per the editor's note.)\n14. Ly, T. (2026). \"The Wager That Isn't.\" thonly.org defensive publication, same sprint. (The stake/pot grammar nesting on this sport's net mode.)\n15. Ly, T. (2026). \"The Game That Graduates You.\" thonly.org defensive publication, same sprint. (The third-party game-client doctrine; the shared play/currency wall.)\n16. Cooper, K. M., Haney, B., Krieg, A., & Brownell, S. E. (2017). \"What's in a Name? The Importance of Students Perceiving That an Instructor Knows Their Names in a High-Enrollment Biology Classroom.\" *CBE—Life Sciences Education* 16(1). (The instructor side of the name relation; note the construct is *perceived* knowing.)\n17. Kohli, R., & Solórzano, D. G. (2012). \"Teachers, please learn our names!: Racial microaggressions and the K-12 classroom.\" *Race Ethnicity and Education* 15(4). (Name mispronunciation as racial microaggression; the negative case, in the identity register.)\n18. Goodenow, C. (1993). \"The psychological sense of school membership among adolescents: Scale development and educational correlates.\" *Psychology in the Schools* 30(1), 79–90. (The PSSM scale; the validated belonging instrument P-S7 and P-S8 specify.)\n19. Walton, G. M., & Cohen, G. L. (2011). \"A Brief Social-Belonging Intervention Improves Academic and Health Outcomes of Minority Students.\" *Science* 331(6023). (Not a name study; the evidence that belonging is movable by brief structured means, with effects at three years.)\n20. Ly, T. (2026). \"Decided by No One.\" thonly.org defensive publication. (The called draw generalised beyond play — turns and lots, a public and a sealed regime — with the prior-art census §10 summarises; it names this sport as the primitive's origin and describes the two versions of §4.4.)\n21. `@333eco/sey` 1.1.0 (2026). *The caller sequence — a cross-platform contract*, §8, with conformance vectors; and `@333eco/primitives`, *The called draw — a recomputable contract*, Parts I–II. CC0 packages. (The normative text of both caller versions; §4.4 summarises and they govern.)\n22. Eastlake, D. (2000; 2004). RFC 2777, *Publicly Verifiable Nomcom Random Selection*; RFC 3797, *Publicly Verifiable Nominations Committee (NomCom) Random Selection*. IETF. (Seeded, published, publicly recomputable selection.)\n23. Besley, T., Coate, S., & Loury, G. (1993). \"The Economics of Rotating Savings and Credit Associations.\" *American Economic Review* 83(4). (The random ROSCA: every member served once per cycle, in an order drawn by lot.)\n24. Blackwell, D., & Hodges, J. L. (1957). \"Design for the Control of Selection Bias.\" *Annals of Mathematical Statistics* 28(2). (Permuted blocks, and the predictability of a block's last assignments — the bag's cost in §4.4(a).)\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Sey™, B-Sey℠, B-Match℠, B-Grace℠, Proof of Coordinate℠. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
+      "text": "> *Scope and claims division (2026-07-23, first publication):* this paper is the first of three published the same day. The present paper owns the **sport** — the caller mechanism and the rule architecture of sey, the sport the B-Sey℠ app and B-Sey™ ball implement. Its companion *The Wager That Isn't* owns the **challenge/stake/pot grammar** (B-Match℠) that nests on this sport's net mode; the third, *The Game That Graduates You*, owns the **third-party game-client doctrine** (the witness API). All three share one organizing principle, coined and freed in the present paper: **the play/currency wall** — *competition and play may generate the story; only witnessed giving moves the currency.* Earlier corpus publications are cited, not re-claimed: *The Quest That Mints Nothing* owns the mints-nothing quest class; *Proof of Coordinate* owns the individuation primitive the ball's chronicle uses. At first publication the sport was specified and unbuilt, and every claim was architectural; a reference implementation has since been built (§§4.3–4.4 record two defects it surfaced). Prior art for the v1 claims dates from 2026-07-23; each later note below dates its own additions.\n>\n> *v2 note (2026-07-25):* this revision incorporates the **2026-07-24/25 universalization** — the three axes (methods · modes · levels), the call-lead-time ladder with scaffold fading, the three-tier scoring architecture and the implied point, the two speaker formats, the local-first system architecture and the ball's reduced job, the classroom channel and the icebreaker-slot reframe, and place-sponsorship. Claims grow from ten to sixteen and pre-registrations from three to five. The v1 claims are unchanged in substance; §§3.1, 4.1, 5.1, 5.2, 7.1, 9.1, 9.2 are new, and §§11–12 are extended. The prior-art clock for the v1 claims runs from the 2026-07-23 push; for the v2 claims, from this one. *(Superseded in part on 2026-07-27 — see the note below; the two speaker formats described here became three, and the claim count moved again.)*\n>\n> *v3 note (2026-07-27):* this revision adds the **seat taxonomy and the two delivery mechanisms that were ratified but never written**. §3 is resorted from four seats to **five, in two classes** — *determined* (caller, equalizer), whose outputs are pure functions of declared inputs and are checkable by recomputation, and *judged* (umpire, witness), whose outputs are perceptions and are checkable only by one-sentence explanation — with the **seat-migration bar** governing both directions. New **§4.2** establishes the caller as deterministic given roster and seed, from which auditable fairness, count-only multi-device agreement, and the absence of per-participant state all follow. **§5.2 grows from two speaker formats to three named ones — Relay, Call, Free** — the relay call having been absent from the specification while it was already the format intended to ship; the pilot constraint is accordingly restated by property (*a trial must run a caller-on format*) rather than by position in the list. The abstract now leads with the relay rather than the mesh, and **P-S5 gains its stated precondition** (a device available at recess, no instruction given), without which a null result cannot distinguish an unpopular game from an absent device. Claims grow from sixteen to **nineteen**. **The prior-art clock for claims 17–19 runs from this push**, not from either earlier one; §§1–11 claims are unchanged in substance.\n>\n> *v4 note (2026-07-27):* a **title and abstract correction, no claims change.** The paper was titled *\"An AI-Called Circulation Sport\"* when the caller was understood as an intelligent intermediary. The v3 seat taxonomy and §4.2 established the opposite — the caller is a **determined** seat, a pure function of roster and seed, checkable by recomputation and explicitly not a judgement — with the result that the title asserted of the mechanism precisely the property the design had given up in order to make its fairness auditable. Two further readings had gone stale beneath it: the shipping delivery format (**the relay call**, claim 19) puts a *human* voice on the announcement, and the arrival of speech synthesis as a pronunciation fallback in the reference implementation gives \"AI-called\" an available reading — *called in a synthetic voice* — that was never its sense. The title now reads **\"An Impartially-Called Circulation Sport for the AI Age\"**: the *property* rather than the technology, on the same reasoning §4.2 gives for determinism itself — an implementation-independent property outlives the implementation that first carried it. The abstract gains the determinism sentence that justifies the new adjective. **The coined term \"AI-called circulation sport\" remains coined and freed in the Prior-Art statement and is retained in the keywords**, together with the patent-class phrase §10 names — retitling does not un-free a term, and the dedication's defensive reach comes from the disclosure rather than from the title. *\"For the AI Age\" is unchanged and means what it always meant: the era whose abundances the sport is designed to spend (§1), not a claim about what runs the caller.* Also corrected: the abstract said **sixteen** claims after the v3 pass took the count to **nineteen**.\n>\n> *v5 note (2026-07-27):* **a change of spine, not of specification.** Through v4 the paper derived the sport from an *abundance* — machine intelligence lifting the officiating, matching, and witness scarcities under which all previous sport was designed — and the caller mechanism followed as a way to spend it. That derivation is engineering, and it left the paper unable to answer why the abundance should be spent this way rather than another. The premise is now stated first and the abundance demoted to its enabling condition: **a name spoken aloud is an address, an address requires someone other than yourself, and the sport exists to distribute that address equally.** §1 is rewritten around it, opening on Carnegie's maxim and inverting it (offered as a technique for advantage; kept here for the recognition, with the advantage engineered out, since nobody chooses whose name is said), with the own-name attention literature supplying the narrower empirical leg that §11 is careful to distinguish from the broader claim. Every mechanism in §§3–8 is unchanged; several are now *derived* rather than asserted — equal-yet-random, the impartial caller, the absence of per-participant statistics, and the dyadic point all follow from the premise in four lines. **New §5.3 states the constraint the premise forces and the prior specification violated: no participant may be called in their own voice.** A system holding participant-recorded name audio for pronunciation will reach for it at call time and deliver each player a recording of themselves — not a poor address but *no address at all*. §5.3 separates the two speech acts a single artifact had been performing (the pronunciation, which belongs to the name's owner; the call, which necessarily does not) and specifies the transfer between them; **Call accordingly speaks every name in one uniform voice**, which is claimed as a property rather than conceded as a limitation, since a uniform channel addresses all participants identically. Claims grow from nineteen to **twenty-one**; **the prior-art clock for claims 20–21 runs from this push.** P-S6 pre-registers the premise itself with two named counter-hypotheses (habituation; celebration), publish-either-way. Two honest limits are added and are the paper's most exposed: the address premise is *asserted, not measured*, and the uniform synthetic voice satisfies the constraint's letter — it is an other — while only partly satisfying its spirit, since it is not a person who spent attention on you. That gap is handled by ranking the formats (**Relay remains the default; Call is the device-plentiful case**) rather than by pretending it closes. §5.3 also specifies the gap's partial repair, added at founder request in the same pass and **claimed as claim 22: the cross-recording chain**, in which each participant records one *other* participant's name — the circle called in its own voices, with the naive form of that idea (playing each participant their own recording) barred by the constraint and the intuition preserved by inverting the implementation. Two persona references are corrected as stale in the same pass: the call is the bare name, carrying no speaker-attribution prefix — which the address premise independently requires, since a prefix names a speaker who does not exist — and the rabbit mascot no longer teaches this sport. The title changed with the spine, from *An Impartially-Called Circulation Sport for the AI Age* to *A Circulation Sport in Which Everyone Is Called by Another*; the v4 note above records the title as it then stood.\n>\n> *v6 note (2026-07-30):* **one correction the paper owed itself, one new mechanism, and the accumulated backlog folded in.** The correction first, stated rather than tightened quietly: §4 and claim 3 gave the equal-distribution guarantee **over a session**, and a session is a *prefix* of a round — so the published wording **overstated what the mechanism delivers**, and §2's classroom scene described precisely the case that fails. Both now read **over a complete round**. The reference-implementation defect that surfaced this — a caller whose progress reset each session, so that a class of thirty running a ten-minute warm-up called the same ten children every day and never called the other twenty — is specified as new **§4.3** and **claim 23, round continuity via circle-scoped progress persistence**: the mechanism that makes claim 3 reachable under real usage, and one whose absence **no session-level test detects**, since within any one session the distribution is exactly correct. **The prior-art clock for claim 23, and for amended claim 3, runs from this push.** Also corrected: **the player minimums**, written before the relay format and silently assuming the caller was not a person. The abstract and §3 said *one to N players* and §3.1 gave per-mode minimums as low as one — while a human relay caller is a person who is not receiving, which makes a circle of one impossible in the very format this paper names as its default. The floor is **four**, now stated once in §3 with its reason, and the per-mode minimums are **withdrawn rather than restated**, so that one number cannot drift out of step with another. New material, none of it changing an existing claim: **§6 gains the two difficulty dials** — the circle's radius, and method restriction read upward — with the *declare what, never why* guard, whose sharpest risk is accessibility rather than fairness (a legible difficulty badge invites a circle to read a body as a declaration); these had shipped to the CC0 rules and never reached the specification, a drift running product→paper rather than the usual direction. **§5 states what the two arrows actually do** — they relocate the opponent, from a person, to the drop, to the circle's own earlier state. And **§9.1 adds P-S7 and P-S8**, which test the premise *beneath* the mission rather than the sport, and which can be run without the sport at all: if P-S7 fails, this sport may pass every other prediction here and still be a well-made game with no mission. Claims grow from twenty-two to **twenty-three**; pre-registrations from six to **eight**. **Added in the same pass, after a literature check the previous draft of P-S7 had gestured at without performing:** §10 now surveys **the name-and-belonging literature** and states plainly which side of the relation it sits on — Cooper et al. (2017) on *perceived* instructor knowing, Kohli and Solórzano (2012) on mispronunciation as racial microaggression, Walton and Cohen (2011) as the outcome-side evidence that belonging moves at all, and Goodenow (1993) as the instrument P-S7 and P-S8 specify rather than invent. **All of it runs teacher → student**, and the authors are aware of no controlled study of *student-to-student full-coverage* name knowledge — which is P-S7's actual subject, stated as a gap rather than a discovery. §13 also gains a **flourish, explicitly marked as one**: the Khmer សី sounds like the English *say*, the two are unrelated, and the paragraph carries its own deletion test.\n>\n> *v7 note (2026-08-13):* a **floor correction, and the rare one where the shipped product was ahead of the paper.** The implementation has been running Call at three players while this document said four globally. §3's *Why four is the floor* is replaced by *Why the floor moves with the format*: the surprise condition (three receivers) is restated **once** as an invariant, and the only variable — whether a body is spent on calling — supplies **Relay 4, Call 3**. No claim is added; a variable that was always implicit in the derivation is made explicit. This does **not** reinstate the per-mode minimum table withdrawn in v6, and it does **not** close the open Team-format question, which is named in §3 rather than left to silence.\n>\n> *v8 note (2026-09-23):* **the caller contract now has two versions, and the first one had a measured defect this paper did not know about.** The published caller (v1) kept a player from being called twice in a row across a round boundary by *rotating* the colliding opener to the end of the new round — and that rotation made a round's closer close the next round with probability 2/n, **two times in three at Call's floor of three**, which is the equal-yet-random promise's *unpredictable* half failing exactly where the circle is smallest. Circles created from 13 September 2026 deal a second version (v2: a 64-hex-character seed, a keyed draw per round, and a boundary *swap* in place of the rotation); every older circle replays v1 byte for byte, forever, because **the seed's type is the version**. New **§4.4** states the finding, the repair and the versioning rule, with the reference implementation's own measurement (v1 66.7% → v2 49.5% at three players). §4's *anyone's name may be next* is **scoped rather than withdrawn**: it is true of the circle and not of every call, since a bag forces each round's last name for anyone counting and the no-repeat rule keeps the previous closer from opening. §11 gains two honest limits (the v1 defect persists in every circle created before the change; the unpredictability is watcher-level, and a locally generated seed is recomputable but never independent of whoever generated it). §10 now says plainly that the recomputable shuffle beneath the caller is **not new** and points to *Decided by No One*, the companion paper that generalises the draw and carries its census. **No claim is added, withdrawn or reworded**; claim 17 reads over both versions of the contract. The body's retired hash-footer sentence is removed under the 2026-08-27 ruling, since that hash is recorded outside the file it would describe.\n>\n> *v9 note (2026-09-26):* **a repair pass for an examiner-facing mirror; no claim is added or withdrawn.** Claim 3(b) and the abstract's *anyone's name may be next* are scoped to the limits §4.4 already states. The sport is named **sey**, lowercase and unmarked, wherever the sport is meant; **B-Sey℠** (the app) and **B-Sey™** (the ball) name only the products, which is the naming the institution adopted after first publication. Unscoped priority and novelty wording is removed or bounded by the censuses now reported in the Prior-Art statement and §10, which also gains the nearest name-game and name-pronunciation prior art. Three **Current form** notes state where the design as now specified has moved past the text (§3 embodied machines; §7 the mesh and the voiced ball; §9.2 sponsorship), the earlier text being retained as a disclosed variant. A **Terms** table maps coined names to standard terms, and these notes now stand in date order. Corrected outright: §11's *unbuilt and unplayed* (a reference implementation exists), §11's placement of the mesh on the first session's critical path (Relay removed it), the dating of golf handicapping, and three citations (the director of *Mystic Ball*, the full title of Brandt's study, and the title of the companion paper cited as *Need-Compiled Questlines*, which is *The Quest That Mints Nothing*).\n\n---\n\n## Abstract\n\nThis paper discloses a group ball game in which an automated caller announces, before each strike, the name of the player who must receive next, choosing receivers by a seeded, recomputable shuffle that gives every player the same number of receptions per round in an order participants cannot anticipate, and applies handicaps only as unequal starting scores. The design premise follows. A name spoken aloud is not a sound but an **address**, and an address requires someone other than yourself. Carnegie's maxim — that a person's name is the sweetest sound in any language — reads as a fact about acoustics and is really a fact about *attention*: what a remembered name proves is that another person spent some on you and kept it. This paper takes that as a design premise and asks what a game would be if it guaranteed the sweetest sound to every participant equally, removed the choice of whom to address from human hands entirely, and refused to let the address become a rating. The derivation is tight: **everyone addressed** (equal-yet-random distribution), **nobody choosing** (an impartial caller), **no evaluation** (no per-participant statistics anywhere in the system), **the address completed** (a dyadic scoring unit credited to no individual), and — the consequence a naive implementation gets wrong — **no participant ever called in their own voice**, because a recording of yourself saying your own name is not an address but a mirror.\n\nThe guarantee was unbuildable until recently, which is the second half of the problem. Sport has historically been designed under three scarcities. **Umpires are scarce**, so games tolerate bad calls, and the figure of the referee absorbs abuse severe enough to drive large numbers of officials out of school and youth sport in several countries. **Fair opponents are scarce**, so sport is organized as segregation infrastructure — by age, sex, size, and skill — and the one social unit that most needs shared play, the mixed-age family, is the unit organized sport serves worst (§1 names golf's handicap as the partial exception). **Witness is scarce**, so games keep score of *persons*, and the counting hardens into statistics, rankings, and fame hierarchies — the attention economy's atom, present at the playground. Machine intelligence can lift all three scarcities at once. A sport *designed for* that abundance — rather than an old sport with cameras added — can spend it on what the scarcities stole: inclusion, giving, and story. The order of the two halves is load-bearing and easy to invert: **the address is the premise and the lifted scarcities are the enabling condition.** An impartial announcer is worth building only if there is a reason every person present should be named aloud.\n\nThis paper specifies such a sport. **sey** — named for its ancestor, the Southeast Asian *sey* (Khmer សី, the dusk game of collective keep-alive), and implemented commercially as the B-Sey℠ app — is a circle game played by **four or more in Relay and three or more in Call** with foot or paddle, with or without a net, cooperatively or adversarially, and organized by one mechanism: **the caller**. A machine intermediary announces, before each strike, the *name* of the player who must receive next — distributing touches **equally yet randomly**, so that participation is egalitarian, attention is universal (anyone's name may be next, within the structural limits §4.4 states), and, as a structural by-product, *strangers learn each other's names through play*. That selection is not a judgement but an **arithmetic**: the receiver sequence is a pure function of the roster and a seed declared before play, so any participant may recompute a finished session and confirm that nobody was skipped and nobody was protected. The sport's central fairness property is therefore *audited rather than trusted* — which is why this specification describes the caller as **impartial** rather than as artificial intelligence, a distinction §4.2 makes structural. Because the caller designates receivers on both sides of the net, targeting a weaker opponent is not merely discouraged but **absent from the game's move-set**: exploiting the weakest human present is structurally impossible. The point is **dyadic** — it increments on successful *receipt*, so every score is a completed give-and-receive and no one scores alone. Handicaps are applied **at the start line, never in the stream**: unequal teams begin at unequal countdown numbers on a coarse fixed lattice (multiples of three), a quantization that makes the handicap read as a garment size rather than a skill rating. Cooperative play counts *up* (the collective streak); adversarial play counts *down* to zero — first to nothing wins. The announcement reaches the circle in one of three named formats, of which the default — **the relay call** — speaks the name *privately to a single rotating human*, who calls it aloud: fairness stays machine-held while delivery is human, so the sport runs on **one borrowed device** with no loudspeaker, no network, and no clock synchronization, and the rotating relay is where participants practise *producing* the names they otherwise only hear. Where devices are plentiful, a **synced-device mesh** speaks the call in unison instead, in **one voice for every name** — never the named player's own recording — so that every participant is addressed identically, which is the equal-yet-random property rendered in the acoustic domain as well as the numeric one. Pronunciation authority nonetheless stays with the name's owner in both formats, transferred to a foreign articulator either by modeled repetition (the relay hears the owner's recording immediately before speaking) or by an owner-supplied **respelling** that drives the uniform voice — the pronunciation and the call being two distinct speech acts whose rightful speakers differ.\n\nThe sport is parameterized on three orthogonal axes — **method** (the body vocabulary each player declares: hand, paddle, or foot, mixed freely within one circle), **mode** (what the circle plays against: nothing, its own record, or another circle), and **level** (the *lead time* between the call and the object's arrival). The default state has **no score at all**, and its stated purpose is that everyone learns everyone's name with correct pronunciation; at the longest lead time the called player raises a hand, so the ladder from easy to hard is a **scaffold-fading memory curve** rather than a skill ladder — the game becomes more difficult exactly as the group's name recall improves. Scoring degrades gracefully across three tiers — **implied by the call**, **validated by a k-of-N vote of the circle's own microphones**, or **confirmed by an accelerometer in the object** — none of which gates play, and all of which are licensed to be loose because the score moves no value. The system is **local-first**: the entire game runs on one device, offline, with no accounts. **Twenty-three claims** are enumerated and dedicated to the public domain; **eight predictions** are pre-registered, including the design's own existential wager and a test of the address premise itself, both of which the authors commit to publishing either way.\n\n**Keywords:** designed sport, automated turn assignment, receiver selection, seeded shuffle, publicly verifiable random selection, handicap by starting score, AI officiating, AI-called circulation sport, AI-directed pass calling, deterministic turn assignment, circle game, sey, chinlone, sepak takraw, mixed-age play, handicap systems, loneliness intervention, third place, name learning, cooperative games, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **AI-called circulation sport**, **the caller mechanism**, **equal-yet-random distribution**, **the cannot-target-weakness property**, **the dyadic scoring unit**, **start-line handicap** and **quantization-for-dignity**, **the last-gift rule**, **the synced-circle mesh**, and **the play/currency wall**. Freed with the v2 revision: **the call-lead-time ladder**, **scaffold-fading difficulty**, **method-as-declared-handicap**, **the implied point**, **circle-scoped adaptation**, **the acoustic inversion**, **rosterless classroom mode**, and **the sponsorable-place test**. Freed with the 2026-07-27 seat pass: **determined and judged seats**, **the seat-migration bar**, **the determined caller**, **count-only circle coherence**, **the host-agnostic turn-assignment layer**, and **the relay call**. Freed with the 2026-07-27 address pass: **the address premise**, **the address constraint**, **the uniform calling voice**, **pronunciation-authority transfer**, and **the cross-recording chain**. Terms inherited from this corpus's earlier publications (Proof of Coordinate℠; the mints-nothing boundary; the beating credential) are cited, not re-claimed.\n\nSmart balls, computer-vision officiating, and AI sports-coaching applications are active prior art and an active patent field (§10); the present claims are confined to the *pre-announced named-receiver, equal-random-distribution, dual-arrow, lattice-handicapped circle-sport architecture* and to its dignity-preserving constraint set, which is the part an extractive implementation would omit.\n\n**What the censuses found.** Two desk surveys bear on these claims, and both narrowed them. (1) The census reported in the companion paper *Circulation Sports* (22 published warm-up, drill and icebreaker formats across seven sports and the physical-education and icebreaker literature; 2026-08-07; documented practice, not fieldwork) found guaranteed reach common, in four architectures (the queue, fixed role rotation, round completion, and turn-taking norms), and found names already called in a circle: in the soccer *Passing Name Game* the passer calls the name of their own chosen receiver, and in the *Name Toss* icebreaker a round closes when everyone has received once. Not found in that aperture on that date: reach that is guaranteed **and** whose order stays unpredictable across unbounded play, held by a party other than the passer. That conjunction, the external caller, is what claims 1–3 disclose. (2) A survey of name-pronunciation tools (2026-08-17) found the recording of a name's pronunciation by its owner widely practised (§10); claim 21 discloses its use to transfer pronunciation authority to another speaker, not the recording itself. The recomputable shuffle beneath the caller is established prior art (§10). No census has been run on the cannot-target-weakness property, the start-line lattice, or the dual-arrow ruleset, and nothing here asserts that they are new.\n\n---\n\n## 1 · The Premise: A Name, Said by Someone Else\n\n> *\"A person's name is to that person the sweetest and most important sound in any language.\"*\n> — Dale Carnegie, *How to Win Friends and Influence People* (1936)\n\nCarnegie offered that as a **technique**. The advice was instrumental — learn names, gain advantage — and the century of sales training built on it has made the sentence faintly embarrassing to quote. This paper keeps the observation and discards the instrumentality. In the sport specified below **nobody chooses whose name is said**, so no participant can deploy a name to their own benefit; the recognition survives and the advantage is engineered out. What remains is the plain finding underneath the salesmanship, which experimental attention research reached independently and from a different direction: a person's own name penetrates a channel they were not attending to, where other words do not (the own-name effect within the cocktail-party phenomenon).\n\nThe premise of this sport is one step past that finding, and it is a step Carnegie did not need to take because he was addressing a speaker rather than designing a system.\n\n> **A name spoken aloud is not a sound. It is an *address* — and an address requires someone other than yourself.**\n\nYour own name in your own voice is not an address at all; it is a recording. Nobody is calling you. The sweetness Carnegie describes is not acoustic — it is the evidence a name carries that *another person spent attention on you and kept it*. A remembered name is a receipt for attention already given. This is why being greeted by name by a shopkeeper lands differently from a personalized mail-merge, and why the difference is not one of technology but of **who is doing the addressing**.\n\nFrom that single premise the sport's architecture follows almost without further argument:\n\n- **Everyone must be addressed, and often.** A game in which some players are called and others are merely present has distributed the sweetest sound unequally, which is what the playground already does. Hence **equal-yet-random** distribution (§4) — equal so that nobody is under-addressed, random so that the address cannot be anticipated and therefore cannot be dismissed.\n- **Nobody may choose whom to address.** The instant a participant selects receivers, the address becomes a favor, and a favor withheld is an exclusion. Hence the caller is an **impartial intermediary** and, at §4.2, not even a judgement: an arithmetic that any participant can recompute.\n- **The address must not become an evaluation.** A name said because you are good is a rating; a name said because it is your turn is recognition. Hence **no per-player statistics anywhere in the system** (§4.1, §7.1) — the sport that says your name most also refuses to say how you did.\n- **The address must be completed.** An address ignored is worse than none. Hence the **dyadic point** (§5): the scoring unit is a call *received*, credited to nobody alone, so the sport's atom is a completed exchange between two people rather than an achievement by one.\n- **And no participant may be called in their own voice** (§5.2). This is the premise's hardest and most easily violated consequence, and the one a naive implementation gets wrong: a system holding a recording of each player's name will reach for it at call time, and deliver to each player a recording of themselves. That is not a sport that says your name. It is a mirror.\n\nWhat the sport produces, then, is not fitness and not a winner. It is a quantity of **addressed attention**, distributed evenly by construction, in a setting where the people doing the addressing are strangers who will now be able to greet each other.\n\n### Why no sport has done this\n\nThe premise is not new — every coach who learns thirty names by the second practice is acting on it. What is new is the possibility of *guaranteeing* it, and the guarantee was, until recently, unbuildable. Sport is one of humanity's great social technologies, and like every technology it embodies the constraints of its era. Three of those constraints did most of the shaping, and all three stand between the premise above and any game that could deliver it.\n\n**The officiating constraint.** A fair game needs a neutral judge, and neutral judges are expensive. Most human play therefore proceeds unofficiated — with the familiar result that disputes end games, dominant personalities adjudicate in their own favor, and children learn early that the loudest voice owns the rules. Where officiating exists, it concentrates in a single fallible human who becomes the game's lightning rod: abuse of referees is severe enough that officiating bodies in the United States and the United Kingdom have reported large losses of officials, attributed largely to the behaviour of adults, with games cancelled or moved for want of officials. The referee crisis is not a culture problem that better manners will fix; it is a *structure* problem — one human absorbing the full adversarial pressure of everyone else's stakes.\n\n**The matching constraint.** A good game needs opponents of comparable ability, and comparable opponents are rare. Sport's solution was segregation: leagues by age, divisions by skill, categories by sex and weight. The solution works — and quietly forecloses the most valuable game that could exist: the one where a grandmother, a teenager, and a six-year-old contest the same point and all three matter. The family, the one social unit whose play would repair the most, is the unit sport's architecture serves worst. (The lone mainstream counterexample, golf's handicap system, proves the demand: it is the reason golf is one of very few sports a parent and child can genuinely contest, and it required a century of institutional machinery to maintain.)\n\n**The witness constraint.** A game's story needs recording, and recording was expensive, so sport recorded the cheapest summary: *who scored*. From that compression grew the entire statistical culture of sport — batting averages, rankings, ladders, most-valuable-player awards — a fame hierarchy erected on a bookkeeping shortcut. The consequences run downhill to the playground: the child picked last exists because informal sport, too, keeps score of persons; the pickup game has a status economy, and everyone present knows their rank in it.\n\nMachine intelligence can lift all three scarcities. Officiating becomes abundant (a phone judges a line call better than a linesman); matching becomes computable (fairness can be *manufactured* rather than found); witness becomes total (everything can be recorded, which forces the question of what *should* be). The default path — already visibly underway in the patent literature (§10) — is to spend this abundance on the old game: more statistics, finer player-surveillance, engagement-optimized training loops. The sport specified below spends it in the opposite direction: on inclusion the matching constraint forbade, on giving the scoring compression erased, and on an output sport has rarely set out to produce — *strangers who know each other's names*.\n\nThe relation between this section's two halves should be stated exactly, because it is easy to invert. **The address is the premise; the lifted scarcities are the enabling condition.** The abundance did not suggest the goal — a tireless impartial announcer is worth building only if there is a reason every person present should be named aloud, and Carnegie's observation is that reason. What the abundance supplies is the *guarantee*: a circle can now promise every participant an equal share of being addressed, and keep the promise for the whole session, without asking a human to hold the ledger. Everything downstream — the seats, the arithmetic, the two count-arrows, the start-line lattice — exists to protect that guarantee from the ordinary social forces that erode it. A useful test of any proposed change to this specification is therefore not *does it make the game better* but ***does it keep everyone being called by another***.\n\nA design axiom governs throughout, shared by all three papers of this sprint and coined here as **the play/currency wall**: *competition and play may generate the story; only witnessed giving moves the currency.* Winning, in any game this institution builds, may move narrative, honor, or the address of an already-committed gift — never value itself. The wall's application to stakes and patronage is its own paper (*The Wager That Isn't*, this sprint); its application here is simpler and prior: in sey, there is nothing to move. What victory produces is a story.\n\n---\n\n## 2 · The Canonical Scenes\n\n**A park, late afternoon.** A man finishes a quiet quarter-hour on a bench — the contemplative practice is its own product and no part of this paper — and walks toward a loose ring of people batting a rattan-weight ball into the air. He does not know any of them. Someone widens the circle; he types a name into the app — just *Virak* — and his phone joins the mesh. A moment later every phone in the circle says, in one voice, one word: *\"Virak!\"* The ball comes to him — gently; the woman who sent it saw a newcomer, and delivery is the whole skill of this game. He gets his paddle under it. The circle cheers the streak alive. Within three rounds, everyone in the circle has heard his name four times, and he has heard all of theirs, because the game cannot proceed without saying them. When the streak dies at 41 — nine short of nothing in particular, since the next rite waits at 333 — the circle groans and laughs, and a stranger says, \"Again, Virak?\" That sentence — a stranger using his name to invite him back — is the sport's actual product. The rally was the packaging.\n\n**A living room, that evening.** Three generations, one net strung between two chairs. The eight-year-old and her grandmother hold paddles; the parents play with their feet. The family's phones announce in two languages — the grandmother's in Khmer, the child's in English — one circle, one game, two tongues. The teams are uneven, so the app has set the start numbers: the parents begin at 33, the paddle side at 21. First to zero. Nobody chose those numbers; nobody can argue with them; and because the caller decides who receives, the parents cannot serve at the eight-year-old to win — the game has no such move. When the paddle side takes its last point — actively won, as the final point must be — the child performs a victory lap of the sofa. What she has won is the story of having beaten her parents fairly. That is all winning moves here, and it is enough; it has always been enough.\n\n**A classroom, the first week of school.** Thirty children who mostly do not know each other, one teacher who needs to learn thirty names, one ball. The circle solves both problems, because equal-yet-random guarantees every child is called **once the round completes** — and because the round is carried across sessions rather than restarted (§4.3), a class playing ten minutes a day reaches every child instead of cycling the same few. The teacher, standing inside the circle, hears every name spoken aloud dozens of times. No child is picked last, because there is no picking. No child dominates, because the caller will not allow the ball to orbit the confident. The physical-education period and the social-integration project turn out to be the same forty minutes.\n\n---\n\n## 3 · The Design: One Circle, Five Seats\n\nThe sport is a circle game for **four or more players in Relay and three or more in Call** (the floor is a function of the format axis; see *Why the floor moves with the format* below), played with a ball designed to be struck by **foot or paddle** — the athletic adult kicks, the grandparent and the child paddle, and both choices are ordinary equipment decisions, not accommodations. Play proceeds in two modes. **Without a net**, the circle plays cooperative keep-alive: the score counts *up*, one per completed reception, and the object is the longest unbroken streak — the collective form. **With a net**, two sides contest a countdown (§5–6) under volleyball-like rally structure — the adversarial form, and the form on which the companion paper's challenge grammar (B-Match℠) nests. A newcomer joins either form the same way: the circle widens. There are no teams to pick in circle mode and no tryout in either; the topology itself is the invitation. **Why the floor moves with the format.** The floor is not a constant but a **function of one variable — whether the caller is a person.** The derivation is single and does not change: **three receivers are required**, because three is the smallest number that leaves any surprise in the call. With two receivers the caller can only alternate — everyone knows who is next before the name is said, and the mechanism this paper specifies contributes nothing.\n\nWhat changes is only whether a body is spent on calling. **In Relay a human calls and is therefore not receiving, so three receivers cost four players. In Call no human calls, so all present are receivers, and three receivers cost three.** One rule, applied to two arrangements:\n\n```\n   required receivers = 3          (invariant — the surprise condition)\n\n   Relay   caller is a person   →  floor = 3 + 1 = 4\n   Call    caller is not        →  floor = 3 + 0 = 3\n```\n\n**This is deliberately *not* a return to the per-mode minimum table withdrawn in v6.** That table restated a number per row, which is exactly how two numbers drift apart. This states the number **once**, as the surprise condition, and lets the format axis supply the only term that varies. The withdrawal stands; what is added is the variable it was missing.\n\n**Provenance, stated asymmetrically because it is asymmetric.** The invariant and its derivation are this paper's own, unchanged since v1. **Three-in-Call is not** — it is prior canon in the product's own design record, where a circle of three standing close with no human caller was specified as the answer for a family of three, and it is the implementation that has been running while this paper said otherwise. The adjacent argument that three is the smallest number at which forward and back differ belongs to the circulation-sport work and is **cited here, not claimed**.\n\n**A gap this amendment does not close, and should not be read as closing.** The paper still says nothing about **which formats a Team game may run**, whether a relay caller belongs to a side, or how rotation crosses a net. The floor above is stated for Relay and Call only. Team ships visibly disabled for exactly this reason, and until the axis is specified the honest position is that the format question is open rather than answered by omission.\n\nThe machine intelligence in the sport occupies exactly **four seats** — including the one the sport is named for — and is barred from the fifth. The seats fall into two classes, and the division is not a taxonomy for its own sake: it decides how each seat's output can be *checked*, and therefore what an implementer is permitted to put in it.\n\n**The determined seats.** Their output is a pure function of inputs declared before play, so it is checkable by **recomputation** — anyone holding the inputs reproduces the result exactly and sees for themselves that the rule was honoured.\n\n1. **Caller.** The sport's defining mechanism (§4): before each play, the name of the required next receiver, announced aloud. Its selection policy is equal-yet-random and, given the circle and a declared seed, *deterministic* (§4.2) — an arithmetic distribution, not a live opinion about anybody.\n2. **Equalizer.** Fairness is manufactured at two points and only two: the **start line** (asymmetric countdown numbers, §6) and the **implement** (paddle or foot, chosen by the player), both drawn from a coarse published lattice. It is never manufactured mid-play. The distinction is load-bearing and stated as a hard rule below.\n\n**The judged seats.** Their output is a perception or a narration. It cannot be reproduced from inputs, so it is checkable only by **explanation** — each judgment stating its ground in one sentence, the standard §5 already imposes on the last-gift ruling.\n\n3. **Umpire.** Line calls, receipt validity, and the classification of the final point (§5) are the system's judgments — instant, neutral, and not attached to a human being who can be shouted at. The referee crisis is answered not by braver referees but by removing the seat the abuse was aimed at.\n4. **Witness.** The system records the game's story — the streak, the rally, the celebration — as a *collective* chronicle. It records no player statistics: no individual completion rates, no rankings, no most-valuable anything (§7–8). What it counts, it counts about the circle.\n\n**The barred seat.**\n\n5. **Player — never.** No machine plays. In an age when most activities can be delegated to software, the sport is constructed entirely from the one thing that cannot be: bodies, co-present, attending to each other. The machine is present so that the humans can be.\n\n> **Current form.** The design as now specified admits an embodied machine into play on one condition: that it displaces no human — not a receiver, not the caller, not an opposing team. Where that holds, a machine may receive (for example as a third receiver when only two people are present, which restores the surprise condition of §3), or may stand as the opposing side in net mode; it keeps the object moving but never keeps the score, since a pass involving a machine counts toward no streak or record; it may never take the relay role, which exists so that people practise saying names; and it plays at a deliberately human level and is never preferred to a person. In Call it may also serve as the single speaker in place of the device mesh. The machine-free rule above is retained as a disclosed variant.\n\n**The seat-migration bar.** A seat may not take on the other class's mode of operation, and the prohibition runs in both directions because both failures arrive at the same place — a machine-held ranking of persons. A *determined* seat that acquires judgment becomes a rating engine: a caller that routes around a struggling receiver, or a handicapper that tunes start numbers to measured ability, has evaluated the players, and has done it where no one can see it. A *judged* seat that acquires distribution authority becomes a caller: an umpire empowered to influence who receives next can express a preference about people through a channel built for judgments about the ball. The rule is short enough to hold in mind while implementing: **the determined seats never judge a person; the judged seats never choose a person.**\n\n### 3.1 · The three axes: method, mode, level\n\nThe sport is parameterized on three orthogonal axes. They are not settings; they are a **ladder**, and an implementation that surfaces them as a configuration screen has already failed the design.\n\n```\n   AXIS      QUESTION IT ANSWERS         VALUES\n   ─────────────────────────────────────────────────────────────────\n   METHOD    what part of you gives?     hand · paddle · foot\n   MODE      what do you play against?   nothing · your record · another circle\n   LEVEL     how much warning?           long lead · moderate · short lead\n```\n\n**Method** is the body vocabulary a player declares — hand-catch-and-release, paddle, or foot. Anatomy plus implement exhausts the list; there is no fourth. The values are **defaults suggested by ability, never assignments by category**, and heterogeneous methods are expected *within a single circle*: a grandparent with a paddle, a child with hands, an adult with feet, one shared object. This is the load-bearing case, not the exotic one — a sport that segregates by method has thrown away the mixed-age property that is the design's principal social claim, and would have reintroduced by the back door the segregation §1 identifies as sport's inherited disease.\n\nA declared method **is a start-line handicap** (§6) — public, self-chosen, announced before play, never assigned during it — so the axis requires no new fairness machinery; it inherits the machinery already specified. Two consequences follow:\n\n- **The object is constrained by the axis.** One shared object must be catchable, kickable, and paddle-able. A hard ball fails hands; a shuttlecock fails paddle power. A **soft weighted sack** satisfies all three, which is why the reference implementation is a sack rather than a ball.\n- **A catch stops flight, so possession needs a bound.** Hand players receive by catching, which would otherwise let a player hold the object and stall the circle. The rule: **catch and release within one beat, where the caller's own cadence is the release clock.** As lead time shortens (§4.1) the hand method converts from catch-and-throw to volley-tap without a rule change — difficulty emerges from the method mixture rather than being imposed on it.\n\n**Mode** is what the circle plays against, and the values ascend: *nothing* (**Friendship**, no scoring of any kind), *its own record* (**Streak**, no net, ascending collective count), *another circle* (**Team**, net, descending count to zero, and the only mode additionally requiring enough players to form two sides). All three take their floor from the single rule of §3 — **three receivers, plus a body for the caller only where the caller is a person** (Relay 4, Call 3). The per-mode minimum *table* given in revisions before v6 remains withdrawn and is not restored: it restated a number per row, which is how two numbers drift apart. One number, stated once, with one variable. The mode names are deliberate: **no label on the product surface names rivalry**, though the adversarial mode is genuinely adversarial and this paper describes it as such. Naming the third mode for its structural fact — *sides exist* — rather than for its disposition is a small instance of a general discipline in this corpus, in which vocabulary is held to the same standard as mechanism.\n\nThe mode ladder is also the **adoption funnel**, and an unusually honest one: each rung is entered by the circle's own election, each rung's graduation is the previous rung's success condition, and the entry rung has **no score at all**.\n\n**Level** is treated in §4.1, because it is a property of the caller rather than of the players.\n\n**The three-value pattern is not aesthetic and should not be read as one.** Each axis has an independent reason for its cardinality: method is exhausted by anatomy plus implement; mode is exhausted by the opponent relation; level is coarsely quantized for the same anti-rating reason the start-line lattice is (§6) — a continuously variable difficulty dial would read as a precision skill rating, which is the artifact this design exists to avoid. Where a fourth value would genuinely serve — very large circles may want a fourth lead-time band — the pattern must yield. **Three is a finding here, not a constraint.**\n\n---\n\n## 4 · The Caller: Equal-Yet-Random, and the Property It Buys\n\nThe sport's central mechanism is small enough to state in a sentence: **before each strike, the system announces by name the player who must receive next.**\n\nEverything distinctive about the sport follows from that sentence.\n\n**Equal-yet-random distribution.** The caller's selection policy has two commitments that are individually common and, held jointly by a party other than the passer, were not found in the census reported in the Prior-Art statement. *Equal*: **over a complete round** — one pass through the roster — every player in the circle receives the same number of touches, within rounding, and the weakest player is guaranteed the strongest player's share of the game. **Revisions of this paper before v6 stated this over a *session*, and that overstated it**: a session is a prefix of a round, and a prefix of a fair sequence is not fair. The guarantee is reachable under real usage only because rounds are carried across sessions rather than restarted (§4.3). *Random*: the order is unpredictable, so no player can disengage — anyone's name may be next, and the suspense that in ordinary sport attaches only to the ball here attaches to every person simultaneously. *Anyone's name may be next* is true of the circle rather than of every call, and §4.4 states the exact scope: within a round the bag forces the last name for anyone who counts, the no-repeat rule keeps the previous closer from opening the next round, and the first published version of the caller leaked more predictability than either — a round's closer closed the next one two times in three at the smallest circle. Equality without randomness would be a queue (predictable, boring, and stigmatizing — everyone can see whose turn is being \"given\"); randomness without equality is every pickup game ever played (the ball orbits the skilled). The conjunction is the mechanism.\n\n**The cannot-target-weakness property.** In net mode, the caller designates receivers on *both* sides. The attacking side therefore cannot choose to serve at the weakest opponent — the oldest strategy in net sports, taught openly at every level, and the precise mechanism by which the weakest player on any volleyball court spends the match being hunted. In sey that strategy does not exist. It is not penalized; it is not discouraged; it is *absent from the move-set*, the way castling into check is absent from chess. Skill, denied the target-selection channel, migrates entirely into **delivery** — placing the ball so your designated receiver, whoever the caller named, can continue the play. The best player in a sey circle is definitionally the one who makes everyone else look good, because making the named receiver succeed is the only thing the rules allow skill to do. It is disclosed here as the design's sharpest single contribution (Claim 2); no census of net sports has been run for it.\n\n**The name as by-product and as point.** Because the call is a *name*, spoken aloud, repeatedly, by every device in the circle (§7), the sport performs introductions as a side effect of its basic loop. This is not a social feature bolted onto a game; it is the game's addressing layer, doing double duty. The design intends the double duty (§9's first prediction measures it): the sport is built so that its standard output includes *strangers who know each other's names* — the missing primitive of the third place. Name games such as the *Name Toss* icebreaker pursue the same output without a caller (§10); what the caller adds is that no participant chooses whose name is said.\n\n**Hard constraints on the caller** (stated here as design law; their governance form lives in the institution's internal directive registry):\n\n- The caller **never evaluates players in the flow of play**. It does not skew calls by skill, win probability, or match situation; it does not route around a struggling receiver at a tense moment. A caller that \"protects\" the weak player at match point has rebuilt picked-last-at-recess inside an algorithm, invisibly, which is worse than the playground original because it cannot be seen and argued with. Fairness lives at the start line only.\n- The caller speaks **chosen names only** — the name a player registers for the circle, which may be a nickname; children's circles use first names or nicknames as a rule. No legal name is ever broadcast across a public park.\n- Per-player data that the equalizer uses (implement choice, start-number calibration) is a **private mirror** — visible to the player, never to the circle, never to any ranking, never retained as a skill profile.\n\n### 4.1 · Level as call lead time: a scaffold-fading memory curve\n\nThe naive difficulty dial for a called sport is the interval between calls. It is the wrong variable: the inter-call interval is confounded by circle size, so the same setting produces a frantic game with four players and a languid one with thirty. The correct variable is **call lead time** — the interval between the naming of the receiver and the object's arrival. Lead time is invariant to circle size and to method, and it is what a receiver actually experiences as pressure.\n\nThree bands are specified, and what changes across them is not merely speed but **how much external scaffolding supports the act of recognition**:\n\n```\n   LEVEL     LEAD TIME    SCAFFOLD                    WHAT IS BEING TRAINED\n   ──────────────────────────────────────────────────────────────────────────\n   Easy      long         called player RAISES A HAND  nothing yet — the\n                          and may speak their own      circle is being taught\n                          name aloud                   the names\n   Medium    moderate     none — the giver must find   name → face recall\n                          the named face unaided\n   Hard      short        none; the call may land      automaticity under\n                          while the object is aloft    time pressure\n```\n\nAt the longest lead the called player **raises a hand**, which removes the recall requirement entirely: a giver who does not yet know who *Sokha* is can simply deliver to the raised hand. The scaffold is then withdrawn — first the hand, then the time — and the withdrawal is enforced by physics rather than by rule, since a hand cannot usefully be raised inside a short lead.\n\nThe result is that **the difficulty ladder is a memory curve, not a skill curve.** A circle can only ascend it as its members' name recall becomes fast and then automatic, which yields the design's cleanest coincidence: *the game becomes more fun exactly as everyone learns each other's names.* The thing the players want and the thing the sport is for are the same thing, and no exhortation is required to align them.\n\nIt also supplies the sport's non-numeric progression. In Friendship mode there is no score, and the circle nonetheless has something that advances: **tempo is the score that is not a score.**\n\n**A constraint the implementer must not violate.** It is tempting to advance the level automatically from measured response latency. Doing so *per player* would reconstruct, invisibly and in the tempo dimension, precisely the artifact §4 exists to prevent — a machine-maintained ranking of who is slow. The rule:\n\n> **The level is a property of the circle, never of a player.**\n\nPermitted implementations, in order of preference: (a) **the circle elects the level**, with the caller permitted to *offer* an advance; (b) if adaptive at all, adaptation conditions **only on circle-aggregate state**, ephemeral and on-device, never per-player, never stored, never displayed. Never permitted: a per-player recall score, in any form, visible or not.\n\n### 4.2 · The determined caller: fairness as arithmetic\n\nThe caller is the seat where an implementer will most want to put intelligence, and the seat where intelligence does the most damage. This design resolves the tension by removing the caller from the domain of judgment altogether: **the call sequence is a deterministic pure function of the circle's roster and a seed declared before play.** Given the same roster and seed, every conforming implementation emits a bit-identical sequence, which makes the generator a cross-platform contract rather than an internal detail.\n\nThree properties follow. The third was not anticipated when the constraint was adopted, and is now the reason to keep it.\n\n**Fairness becomes verifiable rather than trusted.** Equal-yet-random (§4) is the sport's central promise and the one a participant is least able to check by watching, since over any short window a fair sequence and a biased one look alike — which is precisely why a sport that merely *asserts* fair distribution asks to be taken at its word. When the roster and seed are the entire input, any participant, parent, teacher, or competitor can recompute a completed session and confirm that the distribution was equal and that no one was skipped, favoured, or quietly protected. Publishing the generator is therefore part of the mechanism rather than a disclosure concession.\n\n**Multi-device play stops requiring a network.** Because each device computes the sequence independently, devices in one circle need never be told *who* is next — only **how many calls have elapsed**. A single integer, not a name, is the whole synchronization payload; a device rejoining after a lapse fast-forwards to the current index instead of recovering state. Where simultaneous announcement (§7) demands tight clock alignment, sequence *agreement* demands none at all. The offline-first commitment of §7.1 is thus not merely compatible with the determined caller — it is largely delivered by it.\n\n**There is no per-player state to leak, subpoena, or repurpose.** The forbidden artifact of §4 and §4.1 — a machine-maintained record of who is slow, who is skipped, who is protected — is not merely prohibited here by policy. A pure function of a roster and a seed has nowhere to keep such a record. The guarantee moves out of the governance layer and into the arithmetic, where a later release cannot quietly relax it and an acquirer cannot monetize it.\n\n**The general lesson, offered to implementers of any called game.** A fairness property enforced by a rule *about* the algorithm lasts exactly as long as the organization enforcing it; the same property enforced by determinism and published vectors outlasts the organization. Where a guarantee can be made checkable, making it checkable is worth more than making the underlying decision cleverer — and the two are usually opposed, because the intelligence that would improve a decision is the same thing that makes it unauditable. The corollary an implementer meets later is that a checkable sequence can never be *fixed* in place: once a seed has dealt a session somebody may recompute, its sequence is a record. §4.4 is the worked case — a real defect, repaired by versioning the seed rather than the algorithm.\n\nNone of this disarms the machine; it relocates it. Perception and narration — was the ball in, was the final point actively won, what is this circle's story — are irreducibly judgments, and they are where sensing and inference legitimately belong. The boundary is worth restating at the hardware layer beside the warning already given there (§7.1): **instrumentation serves the judged seats only.** An accelerometer reporting a touch supplies the umpire with evidence. It must never supply the caller with a reason.\n\n\n### 4.3 · Round continuity: the unit is the round, not the session\n\nThe equal-distribution guarantee holds over a **complete round** — one pass through the roster — and not over an arbitrary slice of one. The distinction is not pedantry. It is the difference between a working guarantee and a broken one, and the reference implementation shipped the broken version first.\n\nA class of thirty playing a ten-minute warm-up calls perhaps ten children. If the caller's progress resets when the session ends, the next session calls the same ten, and the twenty children at the far end of the round are never called at all — every day, indefinitely, with nothing on any surface to indicate it. The distribution is perfectly equal within each session and catastrophically unequal across them. **An invariant enforced only within a unit is silently void across units, and the unit boundary is where nobody looks.**\n\nThe repair is to persist the round rather than the session. The caller retains a **circle-scoped integer call index** — never a per-participant record, never a timestamp — so that a truncated session resumes where it stopped rather than restarting: whoever has not been called yet is still uncalled tomorrow. This is what makes the guarantee reachable under real usage, in which play is chopped into ten-minute pieces by bells, weather, and attention.\n\nTwo properties are worth stating for implementers. First, the persisted state is **a single integer per circle**, which is why it introduces no per-participant artifact and nothing to leak (§4.2). Second, **no amount of session-level testing detects the defect**, because every test anyone would write runs one session, and within one session the distribution is exactly correct. A competitor implementing from this specification would ship the same bug.\n\n### 4.4 · Two versions of one contract: the closer effect, and the seed as the version\n\n§4.3 recorded a defect that lived at the boundary between sessions and that no session-level test could see. This section records a second defect of the same family — invisible inside any one round, visible only across the boundary between two — and the way it was repaired without altering a single sequence that had already been dealt.\n\n**What the first published caller did at a round boundary.** Equal-yet-random is dealt as a **bag**: each round is a fresh shuffle of the roster, dealt to its end before the next is drawn, which is what makes the counts equal. Two independent shuffles will sometimes deal the same player last in one round and first in the next — called twice in a row, which the circle hears as a stutter and the player experiences as being singled out. The first version of the cross-platform contract (**v1**: a 32-bit seeded generator, a descending Fisher–Yates shuffle, and the bag, published with conformance vectors in `@333eco/sey`) forbade the repeat with a **rotation**: if a new round would open with the previous round's closer, that player was moved to its end. The rule does what it was written for. Its cost was not measured until 13 September 2026, when a documentation example printed two identical consecutive rounds and the explanation first offered for it was checked rather than accepted. Rotation maps every shuffle that would have opened with the closer onto a shuffle that ends with them, so the previous closer is never first, takes each middle position with probability 1/n, and **closes the next round with probability 2/n** — twice the rate of any middle position. A round repeats the previous round's order exactly with probability 2/n! rather than 1/n!.\n\n```\n   PLAYERS   v1 ROTATION — closer closes again     v2 SWAP — closer closes again\n             analytic 2/n     measured *           analytic 1/(n−1)\n   ─────────────────────────────────────────────────────────────────────────────\n      3         66.7%          66.8%                   50.0%    (49.5% †)\n      4         50.0%          49.9%                   33.3%\n      7         28.6%          28.5%                   16.7%\n     12         16.7%          16.6%                    9.1%\n\n   * 40,000 seeds per row.\n   † measured in the reference implementation's own engine, which measured\n     the v1 form at 66.7% under the same conditions.\n```\n\n**Why it was this sport's defect before it was anyone else's.** The effect is sharpest where the roster is smallest, and the smallest roster this paper permits is Call's floor of three (§3) — a floor derived from the requirement that some surprise remain in the call. At three players a participant who has watched one round could name the *second* call of the next round correctly **two times in three** under v1. Under the repaired form the same guess succeeds one time in two, which is the best any rule forbidding back-to-back calls allows: with the previous closer barred from the opening, the four permitted orders are equally likely. Equal counts were never touched — every round still dealt every player exactly once, and long-run averages remain equal by symmetry — so neither a count nor the recomputation audit of §4.2 could see the defect. It was a failure of *unpredictability*, the half of equal-yet-random that §4 says keeps a player from disengaging, and it was worst at the very floor that exists to protect that half.\n\n**The repair.** The second version (**v2**) changes the seed, the generator and the boundary rule, and makes one structural change to Relay. The seed is **32 random bytes written as 64 lowercase hexadecimal characters**. Each round is drawn from its own key — an HMAC-SHA-256 of the seed, a stream label (receivers, or relay callers) and the round number — expanded by an HMAC counter stream and rejection-sampled into uniform indices for the same descending Fisher–Yates shuffle, so there is no 32-bit state. And the boundary rule is a **swap** with a uniformly drawn later position instead of a rotation: the previous closer still never opens the next round, and is equally likely to land anywhere else in it. In Relay, a caller's tenure becomes exactly one receiver round, callers are drawn in rounds of their own over the whole circle, and each receiver round deals everyone except the current caller. The formats, the floors, the level fields, count-only catch-up and the refusal to keep per-player state are unchanged. The normative text is the sport's contract (`@333eco/sey` 1.1.0, *The caller sequence*, §8), which calls the round key and the keyed shuffle from the general-purpose CC0 package `@333eco/primitives` (its specification, Parts I–II); both ship vectors, and the contract is sufficient without the package.\n\n**Version the seed, never the algorithm.** A sequence that anyone may recompute is a record, and the v1 contract had already said what that forbids: changing the sequence for an existing seed is a breaking change, because a circle saved on one device would replay differently on another and every past audit would silently stop reproducing. So v1 was not edited. Circles created from 13 September 2026 carry a v2 seed; every older circle keeps its numeric seed and replays v1 byte for byte, indefinitely. **A client tells the versions apart by the seed's type alone** — a number is v1, a 64-hex string is v2, anything else is not a seed — so no stored circle changed, no version field can be lost or mistyped, and a client must implement both to replay every circle. The contract's earlier format axis was the first instance of the rule, added by making the absent value mean the old behaviour; v2 is the larger one, and the one that shows why the rule exists. A repair that edited v1 would have fixed the future by falsifying the past.\n\n**What *nobody can predict* means, scoped.** The property is watcher-level. It says that no one attending to the play can know whose name is next, and it holds within three limits that are structural rather than defects. (a) **The bag forces each round's last name** for anyone who counts, and more generally a player already called in the current round knows they will not be called again before it ends; this is the price of equal counts, and it is paid knowingly, since a draw that could call the same player again at once would give up the equality that is the sport's other half. (b) **The previous closer never opens the next round** — the no-repeat rule's intended and bounded cost. (c) **The sequence is not secret from a device.** Count-only coherence (§4.2) works because every device in the circle holds the seed and computes the same order, so any of them can compute ahead; the unpredictability the sport needs is the absence of a pattern a *player* can read, and v1's closer effect was exactly such a pattern. Beyond these, the seed is generated on the device that opens the circle. Recomputation proves that a session was dealt faithfully from the declared seed; it cannot prove that the opener did not reopen the circle until an order they preferred appeared. For play order that is an acceptable residue. For anything of value it is not, and the companion paper *Decided by No One* specifies the form that removes it — a seed no party controls, a roster committed before the seed can be known — where the draw is generalised beyond this sport.\n\n---\n\n## 5 · Scoring: The Dyadic Point and the Two Arrows\n\n**The dyadic scoring unit.** A point increments when the *named receiver successfully receives*. The unit of scoring is therefore not a strike, a kill, or a goal — acts one player performs — but a completed **give-and-receive**: a delivery good enough to be received, and a reception good enough to continue. Nobody scores alone, structurally. The compression error of historical scorekeeping (§1) — recording the last touch and calling it the achievement — is not corrected by tracking assists (a patch several sports have tried) but by defining the point as the *pair*. In the institutional grammar this corpus builds elsewhere, the point is a witnessed micro-gift; within this paper it is enough that it is a *dyad*, and that the sport's atomic event requires two people succeeding together.\n\n**Count up (the circle).** Cooperative keep-alive counts consecutive completed receptions. The streak is a built thing — collective, cumulative, mortal. When it dies, it dies for everyone at once, and the circle starts again: the game's only loss condition is shared by all players equally, which is why circle-mode sey has no losers at all, only a streak that was and the next one. Streak milestones are celebrated at the **repdigits** — 3, 33, 333, 3333 — an exponential rationing that keeps each rite roughly ten times rarer than the last (a celebration every 33 would inflate to wallpaper across a long streak; a celebration at repdigits stays an event for the rest of the sport's life). Between rites, the circle's *record* — the park record, the school record — carries continuous motivation. Records belong to circles and places, never to persons.\n\n**Count down (the net).** Adversarial sey inverts the scoreboard: each side begins at a start number (§6) and every rally won *subtracts* one from the winner's remaining count. **First to zero wins** — first to nothing. The arithmetic is identical to counting up; the symbolism is its inversion, and a scoreboard is nothing but symbolism: the winning team is the team that first gives away everything it started with. Rally structure follows volleyball (serve rotation; a point every rally). Two refinements complete the mode:\n\n- **The last-gift rule.** A side's final point — the one from 1 to 0 — must be *actively won*: earned by that side's successful play, never conferred by an opponent's unforced error. No match may end on a serve into the net; the anticlimax that deflates conventional rally scoring at its most important moment is ruled out. (Darts' double-out finish is the honest precedent: the insight that endings must be earned is old; its application to rally sport is claimed here.) Classification of a final rally as actively-won is the umpire seat's call, held to the same one-sentence-explainability as every other judgment in the system.\n- **No deuce.** Conventional win-by-two exists to prevent flukish endings between equal teams; sey's endings are already guarded by the last-gift rule, and its equality is already engineered at the start line. Adding deuce on top would re-lengthen games unpredictably and dilute the countdown's clean terminus at zero.\n\n**Both arrows, one ruleset.** Cooperative sports count up; adversarial sports count up; darts and a few others count down. A single sport in which the *mode selects the arrow* — building in the circle, emptying at the net — is disclosed as architecture (Claim 5): the two arrows are not a gimmick but the two halves of the institution's founding game (a children's balance game in which kindness counts up and gratitude counts down and the ideal score is zero), expressed as sport.\n\n**What the arrows do is move the opponent.** In an ordinary net sport the opponent is a person, and every point is taken from someone. The arrows relocate that. Counting up, the circle plays against **the drop** — gravity, entropy, its own prior record. Counting down, it plays against another circle, by agreement. A third position exists and is the one the level ladder of §4.1 occupies: the opponent as **the circle's own earlier state**, which is competition that costs no one anything. This is why the entry rung carries no score at all and why advancement between modes is elected rather than triggered (§3.1). The sport does not remove competition; it makes the choice of opponent explicit and puts the adversarial option last.\n\n### 5.1 · The scoring ladder, and the implied point\n\nScoring in a called sport admits an architecture unavailable to every other game, and it follows from one observation: **the caller has already assigned identity.** Every other sport must determine *who* touched the object; this one *chose* who touches it next. What remains to be established is only whether the touch occurred — a binary event, not a localization problem.\n\nThree tiers implement that, and each degrades gracefully into the one below:\n\n```\n   TIER       MECHANISM                                    HARDWARE\n   ────────────────────────────────────────────────────────────────────\n   default    the point is IMPLIED by the call —           none\n              assume the dyad completed\n   validated  k-of-N vote across the circle's own          none\n              phone microphones: \"was there a strike\n              in this window?\"\n   confirmed  accelerometer in the object reports          instrumented\n              {object_id, touch, t}                        object\n```\n\n**Sensing never gates play.** A circle with one phone and a rolled sock plays the whole sport; instrumentation improves fidelity and nothing else.\n\nThe **microphone tier** deserves note because it is cheap for a non-obvious reason. Localizing a strike acoustically across phones — time-difference-of-arrival — is a research problem: it needs tight clock synchronization and degrades badly in wind and traffic. **Detecting** one does not. A strike is a sharp transient, separable from ambient noise on a single microphone; a **k-of-N agreement rule** across the circle tolerates a phone in a pocket, a gust, and a passing motorcycle; and the vote requires only a coarse shared window, which the mesh's announcement synchronization (§7) already supplies. The reduction from localization to detection is what moves this tier from research to implementation, and it is available *only* because the caller supplies identity.\n\n**The implied point is an epistemic claim, not a semantic one — and the distinction is load-bearing.** The scoring unit remains what §5 defines: a completed delivery-and-reception pair, credited to no individual. The default tier does not redefine the point; it **assumes the dyad completed and permits a human, or later a sensor, to say otherwise.** An implementation that treated the *call itself* as the scoring event would have quietly built a different game — one in which the caller scores — and would have destroyed the dyadic unit that §5 claims. The caller never scores.\n\n**Why such loose epistemics are licensed here.** Because of §8: no point mints, moves, or gates value. **A score that moves nothing requires no audit.** Were the score coupled to money, the instrumented tier would be mandatory and the default tier negligent; because it is not, trust is the correct default and sensing is an amenity. This is a case of a constraint adopted for dignity reasons removing an engineering dependency — the play/currency wall paying for itself in hardware.\n\nOne consequence for the record architecture (§12, claim 10): a trusted-by-default streak can silently inflate. **Records therefore carry their evidence tier** — *unvalidated*, *microphone-validated*, or *object-confirmed* — so that a circle's record states not only its magnitude but how it was witnessed.\n\n---\n\n### 5.2 · The three speaker formats, and the acoustic inversion\n\nA circle has **one acoustic channel and two candidates for it**: the name of the next receiver, and the count. They cannot both be the headline. Interleaving them — *\"Sokha! … fourteen! … Dara! … fifteen!\"* — buries the name in numerals, and the name is what the sport is for.\n\nThe specification therefore inverts the usual convention of scoring sports:\n\n> **Scoring sports call the score. This one calls the person.**\n\nThe formats below are **named rather than numbered**, deliberately: one constraint stated at the end of this section must survive any future reordering of the list, and a rule that says *\"format 1\"* breaks the moment a format is inserted ahead of it.\n\n**Relay (the default, and the format a first deployment should ship).** The system speaks the name **privately to a single human relay** — through that person's own device, audibly to them alone — and that person calls it aloud to the circle. Selection remains machine-held, so every distribution property of §4 survives intact; what changes is only who moves the air. The consequences are larger than the modification: there is **no loudspeaker, no mesh, no clock alignment, and no requirement that participants own devices**, so a single borrowed handset serves an entire circle. That matters most exactly where the sport is most wanted — a school that prohibits phones, a park with no signal, a group in which one person has a device.\n\nTwo further properties were not the reason for the arrangement and are now the reason to keep it. First, the relay **hears the participant-approved pronunciation immediately before producing it**, which makes correct articulation a *modeled repetition* rather than a reading task; a name read off a screen is mangled precisely for the names this design exists to protect. Second, and more consequential: **the relay produces names aloud, where a player only ever hears them.** The role is therefore where the sport's stated purpose is actually practised, and it follows that the role must **rotate under the same equal-yet-random assignment that distributes receptions**. Left to the circle, the confident participant holds the device and the quiet one never says a name — picked-last rebuilt through the back door of the very role meant to distribute the practice. Rotation also disposes of the objection that the relay is excluded from play: the role is a turn, not a sacrifice. The honest cost is a **tempo ceiling** — the repeat beat is absorbed at long lead times and binds at short ones — which is what the synchronized mesh (§7) is *for*, as a later upgrade rather than a launch prerequisite.\n\n**Call — the name format, spoken to the circle.** The system addresses the whole circle directly over the mesh in **one voice for every name** — never in the named participant's own recorded voice, for the reason given at the end of this section — and **counts silently.** The count is *visible, not audible*: the mesh already places a screen in every pocket, and adversarial mode's countdown must remain readable for tension and tactics. Silence is not concealment. Numbers are spoken only at the rationed celebration thresholds of §6, which means **a spoken number is always a rite** rather than ambient noise. The chant, if the circle wants one, remains entirely human — the system never leads it and never competes with it. *An accessibility setting must permit a spoken count, off by default, for players who cannot read the screen; the pre-announcement of §4 is already an auditory pre-cue and the same constituency is served by both.*\n\n**Free — the count format, with the caller off.** The caller is disabled entirely; the system counts aloud *with* the circle, and nobody is told where to pass. This is free play with a shared, trusted counter — and it exists because the design's central mechanism is unproven (§9, §11). It is also **why the microphone tier is specified**: with no call, the system has nothing to count from unless it *hears* the strike. The two are one feature.\n\nThe formats are **mutually exclusive by construction** — a session runs exactly one — which resolves the apparent contradiction among them. The rule was never that numbers are undesirable; it is that **the name must never compete with numerals** — one voice per channel, and the channel's content follows what the mode is for.\n\n### 5.3 · The address constraint: no one is called in their own voice\n\nAcross every format, one constraint governs *articulation* rather than selection, and it follows directly from §1:\n\n> **The voice that says a participant's name must never be that participant's own.**\n\nThe constraint has to be stated because the obvious implementation violates it. A system that teaches correct pronunciation will hold a recording of each name made by its owner — that is the only honest source of the pronunciation — and at call time the nearest artifact to hand is exactly that recording. Playing it delivers to each participant a recording of themselves saying their own name. The result is not a poor address; it is **not an address at all**, and no amount of audio quality repairs it.\n\nNaming the constraint separates two speech acts that a single artifact had been performing at once, and which have different rightful speakers:\n\n| | **The pronunciation** | **The call** |\n|---|---|---|\n| Whose is it? | the name's owner | anyone but the owner |\n| What is it for? | how the name sounds | *you, now* |\n| Failure mode | anglicization | self-address; no speaker |\n| Where it lives | a stored model, approved by its owner | the moment of play |\n\nThe two are joined by **transfer**, not by identity: the owner's authority over how the name sounds is carried *into a voice that is not theirs*. Two mechanisms accomplish this, one per format. In **Relay**, the human caller hears the owner's own recording immediately before speaking, and reproduces it — modeled repetition, the highest-fidelity transfer available, and the reason the default format is also the best one. In **Call**, where every participant is a player and no human other is free to speak, the owner supplies a **respelling** — the name written as it sounds — which the single system voice articulates. The respelling is not an accessibility fallback; it is the transfer mechanism itself, and the only route by which a participant's authority over their own name reaches a synthetic articulator.\n\n**One voice for every name is a property, not a limitation.** A circle whose calls were assembled from twelve different recordings would address each participant in a different timbre — the texture of being called would vary by whose recording happened to be playing. A single voice calling everyone means **every participant is addressed identically**: equal-yet-random rendered in sound. The uniformity of the acoustic channel is the audible form of the fairness the caller already guarantees numerically.\n\nA note on what this does *not* claim. A system voice is an *other*, which is what the premise strictly requires, but it is not a *person*, and §1's account of why a name is sweet — evidence that someone spent attention on you — is only partly satisfied by a machine. This is a real gap and the specification does not paper over it: it is the reason **Relay is the default format and Call is the device-plentiful case**, rather than the reverse. Where a human can say your name, one should.\n\n#### The circle's own voices: cross-recorded calls\n\nThe gap above admits a partial repair, specified here as an **option within Call** rather than as a fourth format, because it changes which audio plays and not what anyone does during a rally.\n\nThe intuition is that a circle calling itself in its own members' voices would be warmer than a circle called by one synthetic voice, and it is correct. The naive implementation of it is nonetheless barred by the constraint above: playing each participant the recording *they themselves made* is precisely the mirror this section exists to prevent, and the warmth is illusory because the one voice a participant never hears as an address is their own. **The intuition survives; the implementation must be inverted.**\n\n**The mechanism is a cross-recording chain.** At join, after a participant records their own name — the pronunciation model, which stays theirs — the device passes to the next participant, who is shown that name, hears the model, and **says it themselves**. That second recording is the *call* audio. The device continues around the circle, so each participant records exactly one other participant's name and is recorded by exactly one other participant: a cyclic permutation of the roster, costing one additional beat of roughly three seconds per person and producing exactly *N* artifacts rather than *N²*.\n\nFour properties follow, none of which the uniform voice provides:\n\n1. **Every call is a human voice, and never the listener's own** — the address constraint is satisfied in its strong form rather than its formal one, because the speaker is a person who spent attention on the listener.\n2. **The distribution is exactly even by construction**, as the caller's is: one recording made by each participant, one recording naming each participant. The property that governs receptions governs voices.\n3. **It runs the production effect at join**, before play begins. The rotating relay role teaches participants to *produce* names rather than merely hear them (§5.2); the chain does the same thing one beat earlier and for every participant at once, including in Call, where no relay role exists to do it.\n4. **The recording is itself a small gift** — a participant spends three seconds so that another can be called — which is the sport's own subject enacted before the first rally.\n\nThe owner's approval (§5.3, and claim 21) governs the call audio as it governs every other pronunciation artifact: a chain recording a participant has not approved does not enter play, and the participant may ask for another take without stating a reason.\n\n**When to offer it, and when not.** The two voicings answer different circles and the specification declines to rank them absolutely. Among **strangers**, the uniform voice is the better default: an identical acoustic channel is itself a fairness signal, and a newcomer has no relationship to the voice that would say their name — a stranger's recording of it carries no more warmth than a machine's while carrying more opportunity for mockery. Among people who **already know each other** — a family, a classroom after its first week, a returning circle — the chain is better, because the voices mean something and the sport's remaining work is warmth rather than fairness. The honest cost is stated plainly: **the chain forfeits the addressed-identically property**, and a circle that adopts it has traded a fairness signal for a warmth signal, which is a reasonable trade only once fairness is no longer the live question.\n\nTwo failure modes and their handling. A participant who leaves mid-session takes their recording's referent with them but not their recorded voice; a participant joining late has no one in the chain. In both cases the affected name **falls back to the uniform voice for the remainder of the session** rather than to the participant's own recording — the constraint holds under degradation, which is where constraints are actually tested.\n\n**Three constraints on Free, because it switches the sport's dignity guarantees off.** Equal-touch distribution and the cannot-target-weakness property both live *in the caller*; with the caller off, humans choose receivers again and the picked-last dynamic returns. Accordingly: **(a)** a caller-on format remains the default everywhere; **(b)** Free must never be represented to an institution as equivalent — the anti-exclusion properties an administrator approves are precisely the caller's, and a free-play session does not carry them; **(c)** **any trial of the caller mechanism must run a caller-on format** — Relay or Call — or it measures nothing. That constraint is stated by *property* rather than by position in this list, which is why the formats carry names: a future revision may add or reorder formats, and the rule must not silently come to designate the wrong one. On which point see §9.1: Free is not merely a fallback but the natural **control arm** for the experiment that tests the caller itself.\n\n---\n\n## 6 · The Start Line: Handicaps as Sizes, Not Ratings\n\nMixed-ability play fails two ways: with no handicap, the game is a rout; with a visible skill-rating handicap, the game is fair and *humiliating* — the rating announces precisely how much worse you are, to two decimal places, forever. Golf's handicap system, the great success of the genre, threads the needle partly by its own crudeness and its social conventions; explicitly skill-rated matchmaking (chess Elo, ranked ladders in esports) threads it in the opposite direction, by making the rating the point. A family sport needs a third path.\n\n**The start-line handicap.** In net mode, the two sides may begin at *different* start numbers — the stronger side at 33, the beginners at 21; first to zero still wins. The handicap is public, singular, and ceremonial: one number per side, announced before play, arguable by nobody because chosen by no player (the system sets it, and its rubric is one-sentence-explainable: *fairness plus desired game length*). It is applied **at the start line, never in the stream**: once play begins, the caller and umpire treat both sides identically (§4's hard constraint), and any correction of a misjudged handicap waits for the *next* game — the rubber band lives between games, never inside one. A mid-game rubber band (catch-up mechanics, dynamic difficulty) is the standard videogame solution and is rejected here by name: dynamic mercy is detectable, and detected mercy is humiliation delivered by an algorithm.\n\n**Quantization-for-dignity.** Start numbers are drawn from a coarse fixed lattice: **multiples of three only** (3, 6, 9, … 21, … 33). The coarseness is the point. If start numbers could be any integer, the pair (26, 24) would communicate a *precision measurement* — a skill rating in countdown clothing, recreating exactly what the start-line design exists to avoid. Quantized to the lattice, the handicap can only say what a garment size says: roughly this, roughly that, next size up. The minimum expressible gap (three) is large enough to be read as a category rather than a diagnosis. Handicap design ordinarily treats coarseness as a loss of precision; this design takes the opposite view — **in social play, quantization is a dignity mechanism** — and registers the inversion as a claim (Claim 4). Two free properties follow: the start number doubles as the **duration dial** (a park quickie from 9, a festival final from 33), and the lattice happens to be the institution's own numerological signature (three, the heart; thirty-three, the founding number) — a brand fact noted for honesty and carrying no mechanism weight.\n\n**The difficulty dials live in the world, not in the system.** The anti-rating guards of §4 constrain what the *system* may hold; they do not constrain what the *circle* may vary, and a dial the system cannot see cannot rate anyone. Two follow, neither visible to the caller.\n\n- **The circle's radius.** When a circle has learned the names and stopped dropping the object, the whole ring steps back. The object spends longer in the air, so there is more time to arrive under it — but the aim must be truer, the target is smaller, and there is far less margin for a lazy send. The radius is a *size* in the sense this section gives that word, and it is collective by construction: **the whole ring steps out, or it stays where it is.** Nobody is moved back for being good and nobody is pulled in for being new.\n- **Method restriction.** The three methods of §3.1, read in the other direction. Chosen *downward* they are an accessibility fit; chosen *upward* they are a narrowing — one hand rather than two, one surface rather than several. A declared method is already a start-line handicap (Claim 12), so this introduces no new machinery: it is one axis read as a self-imposed constraint rather than a declared capability.\n\nThree constraints govern both, and the first is the one an implementer will not derive. **Declare what, never why.** The sharpest risk at these dials is not fairness but *accessibility*: if *one hand only* becomes a legible difficulty badge, then a player who is one-handed by anatomy reads as playing hard mode, and the circle has been invited to read a body as a declaration. The surface says *one hand — you choose which*, never *your weak hand*. **You narrow your own**: a circle may step down together, but each player chooses what they give up, or a shared restriction excludes exactly the people mixed-method play exists to include. And **at the start line, never in the stream**, as with every other handicap here.\n\n---\n\n## 7 · The Mesh and the Ball\n\n**The synced-circle mesh.** The call must be heard outdoors, over wind and traffic, by everyone at once — the mundane detail on which the whole design stands or falls in a real park. The solution is already standing in the circle: **every player's phone joins the session and speaks the call in unison.** N players are N loudspeakers arranged, by the game's own geometry, in a ring around the play — a surround system that assembles itself and scales with the circle. The mesh deletes the alternative's failure modes (a single device at the circle's center is a trip hazard, a theft target, a single point of failure, and one weak speaker), and it enables a property no single device could offer: **the multilingual circle**. The *call* — the name — is one utterance in one voice; but score announcements and celebrations can be rendered per device, in each phone's own language. A grandmother hears the milestone in Khmer as her grandchild hears it in English, in the same circle at the same moment. For diaspora families — the institution's first constituency — the feature is not cosmetic; it is the difference between a game the whole family plays and a game the grandchildren play while the elders watch. The engineering cost is stated honestly: multi-device simultaneous playback requires tight clock synchronization or the call smears into echo; local time-sync is a solved class of problem, but it is the mesh's hardest component.\n\n**The two-stage hardware split.** Version one is **software plus any ball on earth** — the app is the caller, umpire, and equalizer, and the ball is whatever the circle owns. Nothing in §3–6 requires instrumented equipment. The manufactured **B-Sey™ ball** — designed for the foot-and-paddle dual strike, and eventually voiced, so the call emanates from the play itself — follows as a second-stage artifact, and brings with it the **ball chronicle**: the ball carries a durable identity (per this corpus's Proof of Coordinate℠ publication) and keeps its own biography — the circles it has played, the records it has witnessed, the dedications spoken over it. The chronicle records *collective* history only (a ball remembers parks and streaks, never individual performance), and a well-traveled ball becomes what sporting goods rarely are: a commons artifact whose value grows with use, passed between circles as a gift that carries its own story. The split is a deliberate adoption strategy: the sport must never gate on hardware; the hardware, when it comes, must only deepen a game already alive.\n\n> **Current form.** Two parts of this section have been superseded by the design as now specified. The synced-device mesh is not on version one's path: the relay call (§5.2) is the shipping default, runs on one device, and needs no clock alignment, and the mesh is the later upgrade that serves Call. And the object carries no speaker: §7.1 reduces its job to an accelerometer, a clock and a radio used as a messenger, since the circle's devices already speak. The mesh-first plan and the voiced ball described above are retained as disclosed variants.\n\n### 7.1 · Local-first architecture, and the object's actual job\n\n**The entire game runs on one device, offline, with no accounts.** Names, pronunciations, pacing, both scoring arrows, start numbers, and celebration thresholds are local state; the complete data model of a thirty-player circle with recorded pronunciations is on the order of a megabyte. Only genuinely shared artifacts require a network — cross-circle discovery, records that travel between places, and the object's own biography.\n\nThis is not primarily an economy measure. It is the architectural expression of constraints the design already carries: no per-player statistics, no analytics on minors, chosen names never leaving the circle, and a private-mirror rule for any per-player derivation. Each of those independently says *keep it on the device*. That the result is also nearly free to operate at any scale, and that it works in a park with no signal, a school with a locked-down network, and a village on intermittent data, is a coincidence of goods rather than a trade-off.\n\nTwo engineering notes. The synchronized announcement requires **device-to-device transport, not a server** — the platform peer-to-peer facilities (Apple's MultipeerConnectivity; Android's Nearby Connections) are designed for exactly this. The genuine risks are **cross-platform pairing**, since any real circle is mixed, and **clock alignment**, since simultaneous playback across N devices reads as an echo rather than one voice beyond roughly twenty milliseconds of skew; a leader device scheduling playback at a negotiated offset is the standard remedy, with **single-announcer fallback** — never a deliberate stagger — if alignment resists. And the classroom deployment of §9.1 requires no mesh at all, so the hardest component is not on the critical path to the design's primary channel.\n\n**The object's job is smaller than it appears.** Because the caller assigns identity (§5.1), an instrumented object need not report *where* it is or *who* holds it. Radio-signal-strength proximity cannot in any case discriminate between players standing one to three metres apart with bodies intervening; precise ranging radios exist but are confined to premium handsets, which would breach the design's zero-floor commitment. **The object therefore needs an accelerometer and a clock, and uses its radio as a messenger rather than as a tape measure** — reporting `{object_id, touch, t}` for the system to pair with the call it has just issued. The consequence is that instrumentation costs the price of a motion sensor rather than a positioning system, and that **the object needs no speaker at all**, since the mesh already speaks — deleting the most expensive and least durable component from an object designed to be kicked.\n\nTwo constraints follow that an implementer will not derive on their own. First, an object broadcasting a stable identifier is a **tracking beacon**, and children are the primary population; the identifier must rotate publicly while the object's durable identity is held cryptographically and locally, so that the biography of claim 10 survives without the object becoming a tag on a child. Second, and more subtly: **once touch events exist and the system knows who was called, a per-player success table becomes trivially computable** — the exact artifact §4 and §12 forbid. The guard must therefore be restated at the hardware layer: **object telemetry aggregates to the circle, never to a player scoreboard.** The general lesson is worth stating plainly for anyone instrumenting a sport: *adding a sensor can silently re-open a guarantee that was previously enforced by the absence of data.*\n\n---\n\n## 8 · What Winning Moves: The Play/Currency Wall\n\nStated as the shared spine of this sprint and applied here in its simplest form: **competition and play may generate the story; only witnessed giving moves the currency.** In sey:\n\n- Victory in net mode moves **story and honor**: the chronicle records it; the winning side's captain may speak; the family retells it. It moves nothing else. No points convert to anything; no aura, reputation, ranking, or economic value attaches to winning; there are no ladders, no seasons, no standings.\n- The streak moves **story**: a number attached to a circle and a place, celebrated at repdigits, retold as local legend.\n- Where the sport meets the institution's gift economy at all — the challenge-and-stakes wrapper in which a match is played *for* somewhere money should go — every mechanism belongs to the companion paper (*The Wager That Isn't*), and the division is clean: that paper's walls guarantee that even there, **no money anywhere is contingent on outcome in its existence**; outcomes touch only honor and the address of already-given gifts. The sport itself never touches value.\n- **No player statistics exist.** This is the wall's deepest application, and it is absolute rather than default-off: the system does not compute individual performance records at all, because a computed-but-hidden statistic is a breach waiting for a product manager. What the scarcity era recorded by necessity (§1), the abundance era must refuse by design — total witness makes *everything* recordable, and the whole dignity architecture of this sport rests on recording the circle and not the person.\n\nAn extractive implementation of this paper's mechanisms — an AI caller with engagement-optimized distribution, player-skill surveillance, streak leaderboards, and rated matchmaking — is entirely feasible and is the obvious product a games incumbent would build from the same parts. The claims below are published precisely so that the *dignity-preserving* configuration is prior art: the caller that never evaluates, the handicap that cannot humiliate, the record that has no names in it.\n\n---\n\n## 9 · Adoption Thesis and Pre-Registered Predictions\n\nA sport's mechanisms are worthless if nobody plays. The design's adoption thesis is stated in one line for the record: the sport's path to scale is the **utility path** — it addresses a non-sport problem (strangers becoming friends; names being learned; nobody excluded), so institutions that adopt *tools* (schools, workplaces, festivals, parks departments) can carry it to places marketing never reaches. Its floor is very low (any ball, any space, a free app, rules learned in seconds because the call grammar is Simon Says' — one voice names who must act, everyone else waits — which every child already knows); its mixed-age property is pickleball's growth engine, engineered threefold; its streak is a native short-video format; and its ceiling — the acrobatic kick — is inherited from sepak takraw, whose brutal floor kept a spectacular sport regional and whose lesson (spectacle recruits, access retains) this design encodes as the paddle. The full ranked analysis is not published here; this paper registers only the wager and its instruments.\n\nThe predictions, pre-registered at the design layer (n = 0; every instrument awaits the first pilots):\n\n- **P-S1 (the name test).** After a single first session of at least 20 minutes in a circle of 5+ mutual strangers, a majority of participants can freely recall the chosen names of a majority of the circle. This is the mechanism's core social claim made falsifiable; if name-recall does not materially exceed the mixer-conversation baseline, the sport's central marketing truth is false and will be retired.\n- **P-S2 (the friendship test).** Among mutual-stranger dyads who meet in a circle, a measurably higher share exchange contact or co-attend a subsequent circle within 30 days than the baseline for comparable park co-presence without the game. The third-place thesis, instrumented.\n- **P-S3 (the fun wager — publish either way).** The design's existential risk is named in §11: being *told* where to pass may read as magic or as micromanagement. Prediction: in preference trials, caller-on play is chosen for replay at least as often as caller-off free play in mixed-ability circles (the design predicts the caller *wins* precisely where ability is mixed, and may lose in homogeneous expert circles, which is acceptable and expected). The authors commit to publishing this result whichever way it falls, including the design revision it forces if it falls badly.\n- **P-S6 (the address test — publish either way).** §1 asserts that the sweetness of a name is evidence of *another's* attention, from which §5.3 derives that no participant may be called in their own voice. Prediction: in circles run twice under otherwise identical conditions, sessions in which each participant is called in their own recorded voice will produce lower reported comfort and lower willingness to play again than sessions in which the same names are called by a human relay or a single uniform voice — and the gap will widen with the number of calls per participant, since the design's stated defect is one of *repetition* in public. Two counter-hypotheses are named in advance and would falsify the premise's strong form if borne out: **habituation** (self-voiced discomfort decays across a session rather than accumulating) and **celebration** (children in particular experience their own voice announcing them as being made much of, not exposed). The authors commit to publishing this either way, because the address premise is now the paper's spine and a null result would demote it to a preference.\n\n- **P-S7 (the premise beneath the mission — publish either way).** Every prediction above tests the sport. This one tests whether the thing the sport does is worth doing, and it can be run without the sport at all. Prediction: classrooms in which the teacher devotes the first weeks of the year to ensuring that **every student can name, and correctly pronounce, every classmate** will show higher belonging than matched classrooms that do not. Three specifications make it falsifiable rather than merely agreeable. **The design must be within-teacher** — a secondary teacher with several sections randomizes some of them to the protocol — because a teacher who spends three weeks on names is *already* a teacher who prioritizes classroom community, and that confound is otherwise almost perfectly correlated with the treatment. **The primary outcome is named in advance**: a validated sense-of-school-membership measure, with cross-student conversation-initiation counts as the secondary and sharper instrument, since the mechanism proposed here is specifically that knowing a name lowers the cost of speaking first. **And the open edge is narrower than the general claim** (§10 surveys what the literature does and does not contain) — instructor-knows-student-names is studied; what is not is *student-to-student* coverage, pronunciation as a mechanism rather than as an identity concern, and **completeness**: every student knowing every classmate, which no existing practice delivers and which equal-yet-random produces as a by-product. If P-S7 fails, this sport may pass every other prediction here and still be a well-made game with no mission.\n\n- **P-S8 (maintenance, and the counterfactual that nearly kills it — publish either way).** Prediction: circles played intermittently through the year sustain full-coverage naming where unplayed classes do not. Stated naively this is close to untestable, and the paper says so rather than banking the easy result: **classroom atmosphere normally improves over a school year anyway** — by midyear most students know each other through proximity, with no pedagogy at all — so \"maintained\" describes the untreated case too. The specification that saves it is that what decays is not name memory but **coverage at the margins**: natural acquisition is lopsided, students learn their friends' names and not the quiet child's, and a class re-sorts into clusters in which peripheral children become nameless again. **The instrument must therefore report the minimum, not the mean** — the worst-covered student in the room, never the average. Mean recall looks excellent in any midyear classroom, and the child nobody can name is invisible in a mean; a mean-based instrument would report success in precisely the classroom this sport exists to change.\n\n### 9.1 · The icebreaker slot, the classroom, and the recess test\n\nThe adoption analysis behind the thesis above (not published here) ranked schools fifth. On the analysis below they rank first, and the reason is a general one worth stating separately from this sport.\n\n**A product that claims to ride an existing behaviour must name a behaviour a target adult actually performed, unprompted, in the last twelve months** — and the host must also match the product's commitment level and be in good standing with whoever must permit it. Run that test across this sport's candidate channels and exactly one host passes all three parts. Park circles are a *new* habit: nobody currently goes to a park to play a called circle game, so that channel must be budgeted as habit formation. The classroom is different. Teachers commonly face the same two problems in the first week of every school year — learn thirty names, and include every child — and many *already run a name game to solve them*, unprompted and annually. Elementary morning-greeting routines are a standing institutional ritual. Recess is daily. The commitment shape matches almost exactly: ten to fifteen minutes, free, no equipment, teacher-led, repeatable. And the standing is positive rather than merely tolerated: name learning, inclusion, and anti-bullying are things administrators actively want, which is the inverse of the polarity most unfamiliar objects carry into a school.\n\n**The reframe this forces is the practical conclusion of the whole paper.** The behaviour this sport attaches to is not *sport* at all; it is **the name-learning icebreaker** — performed at school openings, orientations, retreats, onboardings, receptions, and newcomer groups, widely, and widely disliked. Its incumbent competitors are the seated round of self-introductions and the disclosure game. Against those, a called circle wins on every axis that matters: **twenty exposures to each name instead of one**, movement instead of standing, nothing to disclose about oneself, and no performance in front of strangers. **The sport ships as an icebreaker and is discovered as a sport** — and Friendship mode at long lead time (§3.1, §4.1) *is* that icebreaker, arrived at from the sport's own logic rather than designed for the channel.\n\n**Rosterless classroom mode.** The classroom deployment is specified as **single-device**: one teacher's device speaks; no child device participates; the roster is entered once by the teacher and reused; **no accounts exist for minors, no analytics are collected, nothing is uploaded, and the roster is local and erasable.** This is not compliance decoration — a roster of children's names and voices is precisely the artifact that fails an institutional privacy review, and the permitting authority and the privacy authority are the same office. It also happens to remove the mesh, the network, the accounts, and the instrumented object from the primary channel: **a teacher, a phone, and a soft sack.**\n\nThe pronunciation commitment (§4, claim 9) is satisfied in this mode **without recording anything**. At long lead the called child raises a hand and says their own name, and the circle repeats it; **the scaffold is itself the pronunciation-capture mechanism, performed by a human.** The circle converges on the child's own delivery rather than a synthesizer's approximation — which is the correct outcome in the venue where mispronunciation is actually inflicted, and which requires no biometric capture to achieve.\n\n**Two further pre-registrations.** The design's existential uncertainty (§11) is whether being *told* where to pass is delightful or officious, and only play answers it. The classroom supplies an unusually clean and cheap instrument:\n\n- **P-S4 (name acquisition).** A circle that reaches the short-lead band will show ≥90% correct-name *and* correct-pronunciation recall among its members at one week, measured by naming photographs. This refines P-S1's instrument rather than replacing it.\n- **P-S5 (the recess test — the fun test made falsifiable; publish either way).** Within two weeks of teacher-led sessions in a caller-on format, at least one **student-organized circle will form at recess without adult prompting**, and at least one such circle will include children from a different classroom. The prediction carries a **stated precondition**: a single device must be *available* at recess and no instruction to use it may be given. Without that precondition a null result is uninterpretable — it cannot distinguish *the game is not fun* from *there was no phone*, which is the one distinction the test exists to make; with it, the readout is clean in both directions. The second clause is the stronger instrument: cross-class mixing is this design's social claim, measured in the one building where the social graph is otherwise frozen by classroom assignment.\n\nP-S5 costs one teacher, one class, one sack, and two weeks, and its readout cannot be spun: unsupervised children do not organize a game out of politeness. **Free (§5.2) supplies the control arm** — a second class playing free play with the same object and the same counter. The comparison isolates the caller itself, which is the single variable the entire design rests on and the one no amount of design reasoning can settle.\n\n---\n\n### 9.2 · Who pays: place sponsorship, and the test that scopes it\n\nThe economics follow the architecture. Because §7.1 puts the game on the device, the marginal cost of a player is approximately zero, and only the shared layer — cross-circle discovery, travelling records, organizer tooling — has a server behind it. The free tier is therefore *the entire sport*, permanently, and revenue must come from somewhere that is not the player.\n\nThe specification is **place sponsorship**: a patron funds the shared layer for a **geofenced public place** — a school, a park, a neighbourhood — and every circle that plays there receives it. The individual player never pays, at any tier, ever.\n\n**The scoping test is non-excludability, and it is the whole rule:**\n\n> **A place is sponsorable if and only if the sponsor cannot exclude anyone from it.**\n\nNot *does the sponsor benefit* — they always do, and should — but *could the sponsor shut the gate*. A private residence fails: the door is controlled, the good is excludable, and the payment is a purchase wearing a patron's coat. A neighbourhood, park, school, plaza, or temple courtyard passes: the good is non-excludable, so the payment remains a gift even when the sponsor's own family plays there.\n\nFour constraints are specified with it, and the first is the one an implementer will get wrong:\n\n1. **No commercial sponsorship of child-facing places.** Schools and children's circles are funded by individuals, families, alumni, parent associations, or civic groups — or by nobody. Commercial patrons may sponsor adult venues and public parks. This eliminates the child-advertising problem structurally rather than managing it, which is the only treatment that survives contact with the world's various child-marketing regimes.\n2. **Acknowledgment, never advertising.** Where a sponsor is shown at all: a **name, never a message** — no slogan, claim, link, or animation — and placed on the organizer's surface or in the session's closing thanks, never in the children's play surface.\n3. **No control, no data, no exclusivity.** A sponsor learns nothing about who played or how often, may not be exclusive to a public place, and gains no influence over it; **an unsponsored place is never degraded**, since the free tier is the whole game. Reach reporting is specifically prohibited: an impressions metric reintroduces both advertising logic and child data by the back door.\n4. **The two flows never net.** The sponsorship payment is revenue; any gratitude the circles direct back at the sponsor is not a rebate against it. Consistent with this corpus's routing rule — *thanks may fund a livelihood; thanks may never pay a bill* (see *B-Links: Proof-of-Humanity-Signed Shareable Provenance*, §6.1, where the rule is specified and freed) — value returned to a sponsor is credited as **forward-spendable gift capacity**, never as a discount and never as withdrawable funds. What a thanked sponsor receives is the capacity to give again.\n\nThe resulting circuit is worth naming because it is the reason this revenue model is not a compromise with the mission: **a patron funds a place, the circles that play there thank the patron, and the thanks funds the patron's next gift.** The payment mechanism is itself an instance of the thing the institution builds.\n\n> **Current form.** Sponsorship as now specified works at city scale rather than per place. Every city carries the same fixed number of sponsor chairs (twelve), no sponsor may hold more than a third of them, and chairs are priced on a coarse four-rung ladder; when a city is oversubscribed, chairs are allocated by sealed bids cleared at the highest rejected tier, with admission at the clearing tier by lot from a public randomness beacon, so that anyone can recompute the allocation. A sponsor receives acknowledgment — a name and dates, oldest first, in that city's permanent record of those who kept it — and thanks routed into forward-spendable gift capacity; there is no control, no data, no exclusivity, and no bidding on child-facing places, which are funded by invitation outside the market. The same design treats sponsorship as a way to seed local play, not as the sport's revenue: the sport and its apps are free. The place-scoped model above is retained as a disclosed variant.\n\n---\n\n## 10 · Prior Art, Engaged Generously\n\n**The circle games.** The direct ancestors are the Southeast Asian circle keep-alive family: the Khmer *sey*, played at dusk in courtyards and parks across Cambodia; Myanmar's *chinlone*, a six-person circle game explicitly organized around beauty and collective flow rather than opposition — the world's great existing proof that non-adversarial ball sport can sustain a culture for centuries; China's *jianzi* and the global hacky-sack/footbag family. The sport is a descendant of this lineage and says so in its name, *sey*; what the lineage lacks — and what kept it local — is an equalization layer (the skill floor of foot-only play is high) and any addressing mechanism (circles of strangers stay strangers). Sepak takraw contributes the net form and the spectacular ceiling, and the cautionary lesson of a magnificent sport whose difficulty floor confined it to its region.\n\n**The designed prosocial sports.** Sport design as deliberate social engineering has a distinguished small lineage: korfball (1902), which mandated mixed-sex teams by rule; tchoukball (1970), designed by Hermann Brandt from an explicit medical-humanist brief to eliminate aggression — its no-interference rule is the closest ancestor of the cannot-target-weakness property, though it removes *contact* rather than *targeting*; kin-ball (1986), designed for total participation with its all-touch service rule — the nearest prior art to equal distribution, achieved by static rule rather than adaptive caller; Special Olympics Unified Sports and the walking-football/walking-netball movement, which achieve mixed-ability play by restricting the able rather than equalizing the field. The Ultimate frisbee community's spirit-of-the-game — self-officiating as ethos — is the officiating seat's spiritual ancestor; sey completes what spirit-of-the-game gestures at by making the neutral judge structural.\n\n**The handicap systems.** Golf's handicap (recorded as a practice from 1687 and formalized from the 1890s) is the great proof that start-line equalization can carry a mixed-ability sport for more than a century; go's fixed-stone handicaps and chess odds-giving are older still. All are lattice-coarse in practice, none that the authors have found treats coarseness as a *dignity* mechanism (no census has been run on this point), and none operates in a team net sport. Videogame dynamic-difficulty adjustment and matchmaking ratings are the anti-examples engaged in §6: fairness delivered as either hidden mid-stream mercy or public skill measurement, the two failure modes the start-line design refuses.\n\n**The caller's ancestors.** Simon Says supplies the call grammar — a named authority directing named players — as a children's commons centuries old; square-dance calling is the adult form: a caller directing the figures of a cooperative physical game in real time, and the closest single ancestor of the caller seat (what square dance does with figures, sey does with receivers). Neither selects *whom* adaptively; neither equalizes; both prove the pleasure of called play.\n\n**The name games.** Names are already called in circles. In the soccer coaching drill known as the *Passing Name Game*, the passer calls the name of the teammate they have chosen to pass to; in the *Name Toss* icebreaker, players call a name and toss, and the round closes once everyone has received. Both are recorded in the census of the companion paper *Circulation Sports*, and they are the nearest prior art to claims 1, 3 and 9. The difference is who calls: in both, the passer names their own choice, so selection — and with it targeting and favouritism — stays in human hands, and the Name Toss buys full coverage with an order that repeats. Neither announces receivers from outside the play, and neither carries a round across sessions.\n\n**Name-pronunciation tools.** Recording a name's pronunciation in its owner's voice is established practice: dedicated services (NameCoach, NameDrop, SayMyName), university directories, and professional-profile features (LinkedIn; Microsoft 365 profile cards) all offer it, and a genre of consumer apps helps a user remember other people's names and pronunciations. What claim 21 adds to that practice is the owner's approval act, the non-retention of which capture path was used, and the transfer of the owner's authority to a different articulator at call time.\n\n**The draw beneath the caller is not new, and this paper claims none of it.** Every leg of the arithmetic §4.2 and §4.4 describe was public before this sport used it: selection that is seeded, published and recomputable by anyone (Eastlake's RFC 2777 and RFC 3797, 2000 and 2004); the equal-count bag (rotating savings associations that order the pot by lot, formalised as the random ROSCA by Besley, Coate and Loury in 1993; permuted-block randomisation in clinical trials, whose literature already records the bag's cost that §4.4(a) states — the last turns of a block are predictable from the first; the Tetris seven-piece bag, from 2001); the keyed per-span permutation that v2 uses (Ethereum's beacon-chain committee shuffle; Chainlink's Off-Chain Reporting 3.0); and v2's boundary swap itself, in a Rust shuffle-bag crate published in April 2025. The census that established this, and the generalisation of the draw beyond play — to recurring benefits, to a lot form, and to a sealed regime for an operator whose own gifts must stay anonymous — is the companion paper *Decided by No One*, which names this sport as the primitive's origin. What claims 3, 17 and 23 place in the public domain is the draw's use as a *sport's caller*, and the constraints that use imposes: named receivers, no conditioning on evaluated play, count-only coherence, round continuity, and no per-player record.\n\n**The instrumented-sport patent field.** Smart balls (Adidas miCoach, Wilson X and successors), computer-vision officiating (Hawk-Eye, VAR, automated ball-strike systems), and AI sports-coaching applications (HomeCourt and the computer-vision training genre) constitute an active commercial and patent field moving fast in precisely the opposite direction from this paper: toward finer individual performance measurement. The field is engaged respectfully as the reason this publication exists now: an AI-directed pass-calling mechanism with adaptive distribution is an obvious near-future patent claim in extractive form (engagement-optimized, stat-generating), and the present publication places the mechanism class — and specifically its dignity-preserving configuration — in the public record as prior art.\n\n**The third-place literature.** Oldenburg's *The Great Good Place* and Putnam's *Bowling Alone* frame the vanishing social infrastructure the sport addresses; the recent public-health literature on loneliness (including the 2023 U.S. Surgeon General's advisory) supplies the epidemiological register. Bowling leagues were Putnam's emblem of what was lost; a self-assembling park circle that teaches names is offered, without irony, as a candidate replacement part.\n\n**The name-and-belonging literature, and the side of the relation it sits on.** The claim that names carry belonging is not this paper's invention, and the existing evidence sits almost entirely on the *instructor's* side. Cooper et al. (2017) found that students in a high-enrollment biology course who **perceived that an instructor knew their names** reported better attitudes toward the course — the construct is *perceived* knowing, narrower still than knowing. Kohli and Solórzano (2012) establish the negative case in the identity register, documenting name mispronunciation in K–12 classrooms as a racial microaggression with durable effects on how students relate to their own language and family. Walton and Cohen (2011) is the outcome-side anchor and not a name study at all: a brief social-belonging intervention produced academic and health effects measurable three years later, which is the reason to believe belonging is movable by small structured means in the first place. Goodenow's (1993) Psychological Sense of School Membership scale is the validated instrument P-S7 and P-S8 specify rather than inventing one.\n\n**What that literature does not contain is the relation this sport operates on.** All of the above run *teacher → student*. Peer-side work establishes that perceived peer inclusion predicts belonging, but not that a name intervention produces it. The authors are aware of **no controlled study of student-to-student full-coverage name knowledge** — every student able to name, and correctly pronounce, every classmate — which is the completeness condition equal-yet-random produces as a by-product, and which the practitioner literature on icebreakers and name games asserts freely without testing. That gap is P-S7's subject. It is stated here as a gap, not as a discovery: it is the kind of question an education researcher is far better equipped to answer than a sport designer, and this paper would rather be corrected than cited.\n\n---\n\n## 11 · Honest Limits\n\n*This section is deliberately free of lineage, resonance, and metaphor.*\n\n1. **n = 0 for every prediction.** A reference implementation of the caller and the app has been built, and it surfaced the two defects §§4.3–4.4 record; informal play in circles close to the authors shows that the rules can be taught and that the app survives contact with players, and nothing more. No pre-registered prediction has been run, every social property claimed above remains architectural, and the first measured circle may falsify any of them.\n2. **The address premise is asserted, not measured — and it is now load-bearing.** §1 rests the entire architecture on the claim that a name's value derives from *another person's* attention, supported by a 1936 maxim and by attention research (the own-name effect) that establishes something narrower than what is claimed here: that one's own name captures attention, not that hearing it from another is what makes it sweet. No study cited measures the self-voiced case, because no one had reason to construct it. P-S6 is the instrument, and it is unrun. Two named counter-hypotheses — habituation and celebration — would each demote the premise from spine to preference, and one of them (celebration, in children) would land hardest in the classroom channel this paper ranks first.\n3. **The uniform synthetic voice is a partial satisfaction of the paper's own premise.** §5.3 concedes it: a system voice is an *other*, which is what the constraint formally requires, but it is not a person who spent attention on you, which is what §1 says makes the sound sweet. The specification handles this by ranking the formats rather than by resolving it — Relay is the default precisely because a human says the name. Whether the machine-voiced case retains most of the effect, a little of it, or none is unmeasured, and the honest position is that **Call may turn out to be a materially weaker sport than Relay for reasons no amount of audio engineering can fix.**\n4. **The fun risk is existential and unresolved.** Directed play may feel like magic in mixed circles and like micromanagement among skilled peers. If caller-on play is not preferred for replay (P-S3), the central mechanism fails as a product regardless of its virtues as architecture. Free-play mode and caller-cadence tuning are the mitigation paths; neither is designed yet.\n5. **The mesh is unproven engineering.** Simultaneous multi-device audio requires clock synchronization tight enough to avoid echo, on heterogeneous consumer phones, outdoors, on degraded networks. This is the mesh's hardest component. Relay (§5.2) removes it from the critical path of a first session, but Call depends on it, and Call is unproven outdoors until the mesh is.\n6. **App dependency taxes the floor.** Pickup soccer needs no battery, account, or download. Every point of onboarding friction spends the zero-floor advantage; offline operation and caller-optional play must be real, not roadmap.\n7. **The equal-random policy has unmodeled edges.** Injured players, players who wish to opt down, players joining mid-streak, very large circles (call latency vs. rally tempo), and adversarial-mode team-size asymmetries all require policy the design has not specified. Each is solvable; none is solved.\n8. **Accessibility claims are untested.** The call-before-ball structure plausibly aids low-vision players (an auditory pre-cue) and the circle-plus-paddle geometry plausibly admits wheelchair players; both are stated as design intentions, not verified properties, and will not be marketed until tested with the relevant communities.\n9. **Copyability is total.** The mechanism is a weekend's work for any competent app studio, which is the reason for this publication's timing: the defense is prior art plus the layers no cloner inherits (the mission, the name, the constraint set — and an extractive clone that omits the constraint set is, by that omission, visibly not this sport).\n10. **Base rates are brutal.** Global pastimes are a power-law lottery; pickleball's overnight success took fifty years. The design's honest consolation is that its unit of success is one park: a single circle that runs produces its friendships on the spot, whether or not the world follows.\n11. **The three-axis parameterization multiplies untested surface.** Twenty-seven combinations of method, mode, and level are legal, and none has been played. Mixed-method circles in particular assume that a single soft object serves catch, paddle, and foot without one method spoiling the rally for the others — plausible, unverified, and the kind of thing one afternoon in a park would settle or destroy. Note what the parameterization does and does not cost: **declared combinations multiply, implementation surface does not** — the axes are three declarations and a lattice, not twenty-seven code paths.\n12. **The implied-point tier will inflate records.** Trusting the call means a dropped object sometimes counts, and social correction in a circle is real but imperfect. Evidence tiering (§5.1) makes the inflation legible rather than eliminating it, and no cross-place record comparison should be published without its tier.\n13. **The classroom channel depends on a privacy posture that has not met an actual reviewer.** §9.1 specifies local-only operation because that is what such reviews normally require, but no district has yet examined this product, requirements vary by jurisdiction, and an unfavourable determination in a large market would remove the channel this paper ranks first.\n14. **Free can mask the failure it was built to survive.** A caller-optional mode is the honest mitigation for the fun risk and also a way to never learn the answer: if circles quietly migrate to free play, usage will look healthy while the central mechanism goes untested. The pre-registration in §9.1 is written to force the comparison rather than permit the drift.\n15. **The sponsorship model is unexercised and its guards are unpoliced.** No place has been sponsored. The child-facing commercial prohibition (§9.2) is a rule this institution can hold in its own implementation and cannot enforce in anyone else's — which is, as with the constraint set generally, exactly the part a cloner will drop first.\n16. **The first published caller shipped a predictability defect, and it cannot be withdrawn from the circles that carry it.** v1's boundary rotation made a round's closer close the next round with probability 2/n — two times in three at Call's floor of three (§4.4). It went unmeasured until 13 September 2026, it passed every conformance vector because the vectors fixed the sequence rather than its distribution, and the recomputation audit this paper offers as the caller's safeguard could not detect it, since that audit checks faithful dealing and equal counts, not the shape of the order. The repair applies only to circles created after it: every earlier circle replays v1 indefinitely, by the versioning rule that protects its record. Nothing here establishes that v2 is free of a defect of the same kind; it has its reference suite (which measures the swap at four players), a port written from its specification by the same author, and a live measurement at three players — and no outside review.\n17. **Unpredictability is watcher-level, and the seed is the opener's.** §4.4 scopes *anyone's name may be next* to three structural limits: the bag forces each round's last name for anyone who counts, the previous closer never opens, and any device in the circle can compute the sequence ahead. The first means a player already called in a round can disengage until it ends, which §4's promise does not survive in a small circle; whether players actually count is unmeasured. Separately, the seed is generated on the device that opens the circle, so recomputation proves faithful dealing from a declared seed and nothing about whether the opener discarded seeds they disliked. That residue is accepted for play order and would be disqualifying for any draw that allocated value.\n\n---\n\n## 12 · Claims\n\nThe following mechanisms and architectures, individually and in combination, are published as prior art and dedicated to the public domain:\n\n1. **The caller mechanism.** A physical game in which an automated intermediary announces, before each play, the identity of the required next receiver, audibly and by name, such that play cannot proceed except through the named player.\n2. **The cannot-target-weakness property.** A net or team sport in which the automated caller designates receivers on all sides, structurally removing opponent-selection (including weakest-player targeting) from the space of legal or possible plays, and confining skill expression to delivery quality.\n3. **Equal-yet-random distribution.** A caller selection policy jointly guaranteeing (a) equal per-player reception counts **over a complete round** — one pass through the roster, the session being a *prefix* of a round and not itself the guaranteed unit — and (b) a selection order that participants cannot anticipate, within the structural limits stated in §4.4 (the last receiver of a round is determined for anyone counting, and the previous round's closer never opens the next), with the explicit constraint that the policy never conditions on player skill, performance, or match state during play.\n4. **The start-line handicap with quantization-for-dignity.** Team equalization implemented solely as asymmetric starting scores in a countdown game, drawn from a coarse fixed lattice (exemplarily, multiples of three), set by a neutral intermediary from a fairness-plus-duration rubric, with between-game (never within-game) recalibration — the coarseness claimed specifically as an anti-rating, dignity-preserving mechanism.\n5. **The dual-arrow ruleset.** A single sport in which cooperative mode scores by ascending collective streak and adversarial mode scores by countdown to zero (\"first to nothing wins\"), with mode selecting the arrow.\n6. **The dyadic scoring unit.** A scoring rule under which the atomic scoring event is a completed delivery-and-reception pair credited to no individual, such that no player can score alone.\n7. **The last-gift rule.** A countdown finishing rule requiring the final point to be actively won by the finishing side, excluding conferral by opponent unforced error, as classified by the automated umpire.\n8. **The synced-circle mesh.** Delivery of game announcements through simultaneous clock-synchronized playback on all participating players' personal devices, arranged by the game's own geometry as a surround array, with per-device language rendering of non-call announcements.\n9. **The name-learning mechanic with chosen-name privacy.** The use of pre-play name announcement as a deliberate stranger-introduction mechanism, bound to user-chosen circle names (never legal names), with children's circles restricted to first names or nicknames; including double-blind surfacing of nearby solitary individuals as circle invitees such that neither party learns who initiated and no solitude status is ever disclosed.\n10. **The collective-only chronicle.** A witness architecture that records streaks, records, and celebrations as properties of circles, places, and equipment (including a ball-borne biography anchored to a durable device identity), while computing no individual performance statistics whatsoever; with celebration rationing on an exponential repdigit schedule.\n11. **The call-lead-time ladder with scaffold fading.** A difficulty parameter defined as the interval between the naming of the receiver and the object's arrival — invariant to participant count and to method — banded such that the longest band includes an explicit identification scaffold (the called player self-identifies by raised hand and may speak their own name) which becomes physically unavailable as the interval shortens; so that advancement through the bands tracks the group's *name recall* rather than physical skill.\n12. **Method as declared start-line handicap.** Heterogeneous body vocabularies (hand-catch, implement, foot) exercised by different participants within a single circle on a single shared object, each self-declared publicly before play as an instance of the start-line handicap of claim 4, with reception-by-catch bounded by a release interval clocked to the caller's own cadence.\n13. **The mode ladder with a no-score entry rung.** A single sport whose modes are ordered by opponent relation — none, own record, other circle — whose entry mode has no scoring of any kind, and whose advancement between modes is elected by the participants rather than triggered by performance.\n14. **Circle-scoped adaptation, and the circle-scoped level invariant.** Any automatic adjustment of pacing or difficulty conditions solely on aggregate state of the whole circle, never on per-participant response latency or performance, with per-participant timing neither stored, displayed, ranked, nor retained; the level being a property of the circle and never of a player.\n15. **The three-tier scoring architecture with the implied point and evidence tiering.** Scoring by (a) inference from the call alone, (b) k-of-N agreement across participants' device microphones detecting — not localizing — a strike within a window supplied by the announcement synchronization, or (c) a motion sensor in the object reporting a touch event paired to the outstanding call; identity in all tiers supplied by the caller rather than by sensing; the object's radio used as an event messenger rather than a ranging device; records annotated with the evidence tier that produced them; and the acoustic inversion by which the caller speaks participant names aloud while the count is rendered visually, with an alternate caller-off format in which the system counts aloud and designates no receiver.\n16. **Rosterless local-only deployment for minors, and the non-excludability test for place sponsorship.** A single-device deployment in which participant names are entered locally by a supervising adult, no accounts exist for minors, no telemetry leaves the device, and pronunciation is taught by the named participant in person rather than captured as biometric data; together with a place-scoped patronage model funding a shared service layer for a geofenced location, admissible only where the patron cannot exclude anyone from that location, and constrained by prohibitions on commercial patronage of child-facing places, on any sponsor message beyond a name, on reach reporting, and on netting patron gratitude against the patron's own payment.\n17. **The determined caller, with count-only circle coherence and the seat-migration bar.** A called sport in which the receiver sequence is a deterministic pure function of the participant roster and a seed declared before play, specified as a cross-platform bit-exact contract with published conformance vectors, such that (a) any participant may independently recompute a completed session and verify the equal-yet-random distribution property, rendering distribution fairness auditable rather than asserted; (b) multiple devices in one circle stay in agreement by exchanging only an elapsed-call count — never participant identities, sequence state, or selection reasons — with rejoin by fast-forward and no server; and (c) no per-participant record exists to be disclosed or repurposed, because the generator retains none. Claimed together with the governing partition: **determined** seats (caller, equalizer), whose outputs are checkable by recomputation and which never condition on evaluated player state, and **judged** seats (umpire, witness), whose outputs are checkable only by one-sentence explanation and which hold no authority over receiver selection; including the constraint that instrumentation of the object or environment may supply evidence to the judged seats alone.\n18. **The host-agnostic turn-assignment layer.** The caller primitive of claims 1–3 — pre-announced named-turn assignment, equal-yet-random distribution, circle-scoped adaptation, and the absence of per-participant evaluation — applied to an **arbitrary host activity** rather than to any particular sport: the warm-up, drill, or rotation phase of a conventional sport; a rehearsal; a classroom, workplace, or conference gathering; or any bounded group activity in which turns must be distributed among named participants. Claimed independently of the ruleset of §§3–6, so that the mechanism's applicability is not confined to the circle game specified here, and expressly including its use as a preliminary segment preceding an unrelated primary activity.\n19. **The relay call — decoupled selection and articulation.** A called activity in which the automated intermediary announces the selected participant's name **privately to a single human relay** — through that person's own device, audibly to them alone — who then articulates it aloud to the assembled group, such that: (a) selection fairness is machine-held while acoustic delivery is human, preserving every distribution property of claims 1–3 without the system addressing the group directly; (b) the activity runs on **one device**, with no loudspeaker, no audio infrastructure, and no device-to-device synchronization, and therefore no dependence on network, clock alignment, or participant device ownership; (c) the relay hears the participant-approved pronunciation immediately before producing it, making correct articulation a **modeled repetition** rather than a reading task, and thereby recruiting the relay's own vocal production rather than recognition alone; and (d) the relay role is itself assigned by the same equal-yet-random process that assigns receivers and rotates among participants, so that articulation practice is distributed rather than captured by the most confident participant, and so that occupying the role is a turn rather than an exclusion from play.\n\n20. **The address constraint, and the uniform calling voice.** A called activity in which the announcing voice for any participant's name is constrained by the system to be **other than that participant's own** — such that no participant is ever summoned by a recording or reproduction of their own voice — satisfied either by human relay (claim 19) or by a **single uniform synthetic voice articulating every participant's name**, the latter claimed specifically for the property that a uniform acoustic channel addresses all participants identically and therefore renders the equal-yet-random distribution of claim 3 in the acoustic domain as well as the numeric one. Including the negative constraint as an architectural invariant rather than a configurable default: a system holding participant-recorded name audio for pronunciation purposes is barred from using that audio as the call directed *to* the participant who recorded it.\n\n21. **Pronunciation-authority transfer to a foreign articulator.** A method by which a named participant retains authority over the pronunciation of their own name while that name is spoken by a voice which is not theirs, comprising: (a) capture of a participant-owned pronunciation artifact by any of three paths — a recording spoken by the participant, a recording spoken by a delegate at the participant's direction, or a participant-supplied **respelling** of the name in ordinary orthography rather than a phonetic alphabet; (b) an **approval act by the named participant** upon the resulting rendition, required before the artifact enters play and required identically of all three capture paths; (c) articulation by a distinct articulator — a rotating human relay to whom the artifact is played immediately before speaking, making articulation a modeled repetition, or a synthetic voice driven by the respelling and selected for a language the participant approved; and (d) **non-retention of which capture path any participant used**, such that no per-participant record distinguishes a self-voiced from a delegated or synthesised pronunciation. Claimed together with the separation it rests on: **the pronunciation and the call are distinct speech acts with distinct rightful speakers** — the first belonging to the name's owner, the second necessarily not.\n\n22. **The cross-recording chain — a group called in its own voices.** A called activity in which the audio announcing each participant's name is recorded by a *different* participant of the same group, assigned as a cyclic permutation of the roster such that each participant records exactly one other participant's name and is named by exactly one other participant's voice — producing *N* artifacts for *N* participants rather than *N²*, distributing the vocal labor exactly evenly by the same principle that distributes receptions, and satisfying the address constraint of claim 20 in its strong form (the speaker is a person who attended to the listener) rather than its formal one. Comprising: (a) capture at enrolment, in which the recording participant is first played the name-owner's own pronunciation model and then records their own articulation of it, so that the chain recording is a modeled repetition and the production effect is exercised by every participant before play rather than only by whoever holds a relay role; (b) approval of the resulting call audio by the *named* participant, on the same terms as claim 21 and with re-take available without stated reason; (c) **degradation to a uniform system voice — never to the named participant's own recording — when the chain is broken** by departure or late arrival, so that the address constraint holds under partial rosters; and (d) selection between uniform-voice and chain voicing as a property of the group rather than of any participant. Claimed together with the scoping rationale: a uniform channel addresses all participants identically and is the appropriate default among strangers, for whom identical treatment is a fairness signal, while the chain is appropriate among the already-acquainted, for whom the identity of the voice carries the meaning — the two being a documented trade of a fairness signal for a warmth signal rather than an improvement.\n\n23. **Round continuity via circle-scoped progress persistence.** A called activity in which the caller's progress through a round is persisted as a **circle-scoped integer index** — never a per-participant record, never a timestamp — such that a session ending before the round completes **resumes at the point it stopped rather than restarting**, so that participants not yet called in the current round remain uncalled-and-pending across sessions and across days. Claimed as the mechanism that makes the equal-distribution guarantee of claim 3 *reachable* under real usage, in which play is habitually truncated well short of a full round; claimed together with the property that the persisted state is a single integer per circle and therefore introduces no per-participant artifact (claim 17(c)); and claimed together with the observation that its absence is **undetectable by session-level testing**, since within any single session the distribution is exactly correct — so that an implementer working from a specification silent on this point ships an unequal distribution while passing every test they would think to write.\n\n---\n\n## 13 · Lineage, and the Close\n\n**A coincidence the design did not arrange.** The Khmer សី is pronounced close to the English *say*, which lets *sey circle* read, to an English ear, as a circle of sayings — and the sport turns out to be exactly that, since a completed pass is a name said and answered. The two words are unrelated: Khmer and English do not share this root, and the reading is a gift of one language rather than a fact about the other. It is recorded because it is pleasing and because the paper would be poorer for pretending not to have noticed it, and for no other reason. Strike this paragraph and every mechanism above stands untouched.\n\nThe lineage of this design is a courtyard at dusk. Across Cambodia, in the hour when the heat breaks, people stand in circles and keep a small woven ball in the air — no teams, no referee, no score that anyone writes down, only the shared project of *not letting it drop*. The game survived what Cambodia's twentieth century did to everything else that was gentle. This paper's whole mechanism is, in one reading, an attempt to give that circle three things the modern world took from its conditions of possibility: a fair way for the unequal to stand in it together, a voice to welcome strangers into it by name, and a record that remembers the circle rather than sorting its members. The sport is named for that game, and the name performs its own thesis — *sey* (សី), the inherited circle; *say*, the spoken name; a children's call-game hiding inside both. A note on the script, since the pun is a claim about a language and should be checkable in it: **សី** is *sey*, and the institution's rabbit mascot elsewhere is **ទន្សាយ**, *tonsay*. The two are unrelated words that merely share a syllable once romanized, which is worth stating plainly: in Khmer the resemblance is visible as coincidence, and only in Latin letters can it be mistaken for an etymology. The pun is offered as a pun. What the caller calls, in the end, is the oldest social technology there is: *you, here, now — the ball is coming to you.*\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| sey (the sport); B-Sey℠ app; B-Sey™ ball | circle keep-up ball game (footbag / shuttlecock-kicking family), with net and cooperative variants; its software and ball |\n| the caller; the caller mechanism | automated turn assignment: receiver selection announced by spoken name before each play (automated pass calling) |\n| equal-yet-random distribution | shuffle-bag scheduling: a fresh random permutation per round, giving equal turn counts per round in random order |\n| determined caller | deterministic pseudorandom sequence from a declared seed and roster; publicly verifiable, recomputable random selection |\n| count-only circle coherence | multi-device consistency by exchanging only a shared sequence index (call counter) |\n| round continuity | persistence of the round-robin index across sessions |\n| closer effect; boundary swap | position bias at the boundary between consecutive shuffles; no-immediate-repeat constraint implemented by swap rather than rotation |\n| relay call (Relay format) | two-stage announcement: private audio prompt to one rotating human announcer, who speaks the name aloud |\n| Call format; Free format | synchronized device text-to-speech announcement; free play with automated counting and no receiver selection |\n| synced-circle mesh | clock-synchronized simultaneous audio playback across participants' mobile devices over peer-to-peer links |\n| address constraint; uniform calling voice | rule that a participant is never called in their own recorded voice; one speech-synthesis voice for all names |\n| pronunciation-authority transfer | owner-approved name-pronunciation recording or respelling used to drive another speaker or a speech synthesizer |\n| cross-recording chain | cyclic assignment in which each participant records one other participant's name |\n| cannot-target-weakness property | receiver designation on both sides of a net game, removing opponent selection |\n| dyadic scoring unit | pass-completion scoring credited to no individual |\n| dual-arrow ruleset | ascending cooperative streak count; descending (countdown-to-zero) competitive score |\n| start-line handicap; quantization-for-dignity | handicap by unequal starting score, quantized to multiples of three |\n| last-gift rule | finishing rule requiring the final point to be won, not conceded by an opponent's error |\n| call-lead-time ladder; scaffold fading | difficulty set by the interval between announcement and ball arrival, with a raised-hand identification cue at the longest interval |\n| method as declared handicap | self-declared striking method (hand, paddle, foot) as a pre-play handicap |\n| circle-scoped adaptation | group-level, never per-player, adaptive difficulty |\n| implied point; evidence tiering | score inferred from the call, optionally validated by k-of-N microphone transient detection or an accelerometer in the ball; records labelled by validation tier |\n| acoustic inversion | names announced aloud, score shown visually |\n| collective-only chronicle | group- and equipment-level records with no individual performance statistics |\n| rosterless classroom mode | single-device, account-free, local-only deployment for minors |\n| place sponsorship; sponsorable-place test | geofenced patronage of a shared service, admissible only for non-excludable public places |\n| host-agnostic turn-assignment layer | the turn-assignment mechanism applied to any group activity |\n| determined and judged seats; seat-migration bar | separation of recomputable algorithmic functions from perceptual judgment functions in automated officiating |\n| play/currency wall | rule that game outcomes never create, move or gate monetary value |\n\n---\n\n## Citations\n\n0a. Carnegie, D. (1936). *How to Win Friends and Influence People*. Simon & Schuster. (The premise's popular statement — cited at lens tier and explicitly inverted in §1: offered there as a technique for advantage, kept here only for the recognition.)\n0b. Moray, N. (1959). \"Attention in Dichotic Listening: Affective Cues and the Influence of Instructions.\" *Quarterly Journal of Experimental Psychology* 11(1). (The own-name effect in the unattended channel.)\n0c. Wood, N., & Cowan, N. (1995). \"The Cocktail Party Phenomenon Revisited.\" *JEP: Learning, Memory, and Cognition* 21(1). (Replication and bounding of own-name capture; the narrower finding §11 distinguishes from the paper's broader premise.)\n1. Hamilton, G., dir. (2006). *Mystic Ball*. Documentary film, Canada. (Chinlone as cooperative circle sport; the flow ethos.)\n2. Oldenburg, R. (1989). *The Great Good Place*. Paragon House. (Third-place theory.)\n3. Putnam, R. (2000). *Bowling Alone*. Simon & Schuster. (Social-capital decline; league sport as civic infrastructure.)\n4. U.S. Surgeon General (2023). *Our Epidemic of Loneliness and Isolation*. HHS Advisory.\n5. Brandt, H. (1970). *Étude critique scientifique des sports d'équipe — Le Tchoukball, le sport de demain*. (Awarded the FIEP Thulin Prize, 1970; tchoukball's design brief; sport engineered against aggression.)\n6. International Korfball Federation. Rules of korfball. (Mixed-sex teams by rule, 1902 lineage.)\n7. Kin-Ball International. Official rules. (All-touch service; total-participation design.)\n8. United States Golf Association. *The Rules of Handicapping* (World Handicap System). (Start-line equalization at scale.)\n9. National Federation of State High School Associations (2022, 16 February). \"With Loss of 50,000 Officials, NFHS Organizes Consortium to Find Solutions.\" nfhs.org; and BBC Radio 5 Live with the Referees' Association, survey of grassroots football referees in England (August 2023; 927 respondents). (The officiating crisis.)\n10. Reporting and filings on instrumented sport: Adidas miCoach Smart Ball; Wilson X; Hawk-Eye Innovations; MLB Automated Ball-Strike System; NEX Team HomeCourt. (The active patent field.)\n11. Lepper, M., Greene, D., & Nisbett, R. (1973). \"Undermining Children's Intrinsic Interest with Extrinsic Reward.\" *JPSP* 28(1). (Reward and intrinsic motivation — the boundary the wall respects.)\n12. Ly, T. (2026). \"Proof of Coordinate.\" thonly.org defensive publication. (The device-identity primitive used by the ball chronicle.)\n13. Ly, T. (2026). \"The Quest That Mints Nothing.\" thonly.org defensive publication (slug `need-compiled-questlines`). (The mints-nothing class; claims division per the scope note.)\n14. Ly, T. (2026). \"The Wager That Isn't.\" thonly.org defensive publication, same sprint. (The stake/pot grammar nesting on this sport's net mode.)\n15. Ly, T. (2026). \"The Game That Graduates You.\" thonly.org defensive publication, same sprint. (The third-party game-client doctrine; the shared play/currency wall.)\n16. Cooper, K. M., Haney, B., Krieg, A., & Brownell, S. E. (2017). \"What's in a Name? The Importance of Students Perceiving That an Instructor Knows Their Names in a High-Enrollment Biology Classroom.\" *CBE—Life Sciences Education* 16(1). (The instructor side of the name relation; note the construct is *perceived* knowing.)\n17. Kohli, R., & Solórzano, D. G. (2012). \"Teachers, please learn our names!: Racial microaggressions and the K-12 classroom.\" *Race Ethnicity and Education* 15(4). (Name mispronunciation as racial microaggression; the negative case, in the identity register.)\n18. Goodenow, C. (1993). \"The psychological sense of school membership among adolescents: Scale development and educational correlates.\" *Psychology in the Schools* 30(1), 79–90. (The PSSM scale; the validated belonging instrument P-S7 and P-S8 specify.)\n19. Walton, G. M., & Cohen, G. L. (2011). \"A Brief Social-Belonging Intervention Improves Academic and Health Outcomes of Minority Students.\" *Science* 331(6023). (Not a name study; the evidence that belonging is movable by brief structured means, with effects at three years.)\n20. Ly, T. (2026). \"Decided by No One.\" thonly.org defensive publication. (The called draw generalised beyond play — turns and lots, a public and a sealed regime — with the prior-art census §10 summarises; it names this sport as the primitive's origin and describes the two versions of §4.4.)\n21. `@333eco/sey` 1.1.0 (2026). *The caller sequence — a cross-platform contract*, §8, with conformance vectors; and `@333eco/primitives`, *The called draw — a recomputable contract*, Parts I–II. CC0 packages. (The normative text of both caller versions; §4.4 summarises and they govern.)\n22. Eastlake, D. (2000; 2004). RFC 2777, *Publicly Verifiable Nomcom Random Selection*; RFC 3797, *Publicly Verifiable Nominations Committee (NomCom) Random Selection*. IETF. (Seeded, published, publicly recomputable selection.)\n23. Besley, T., Coate, S., & Loury, G. (1993). \"The Economics of Rotating Savings and Credit Associations.\" *American Economic Review* 83(4). (The random ROSCA: every member served once per cycle, in an order drawn by lot.)\n24. Blackwell, D., & Hodges, J. L. (1957). \"Design for the Control of Selection Bias.\" *Annals of Mathematical Statistics* 28(2). (Permuted blocks, and the predictability of a block's last assignments — the bag's cost in §4.4(a).)\n25. Ly, T. (2026). \"Circulation Sports: A Category That Already Had Members and No Name.\" thonly.org defensive publication. (The census of 22 published warm-up, drill and icebreaker formats, 2026-08-07, including the *Passing Name Game* and the *Name Toss*; the conjunction the caller discloses.)\n26. Name-pronunciation services and features, surveyed 2026-08-17: NameCoach; NameDrop; SayMyName; Boston University, *Hear My Name*; LinkedIn profile name pronunciation; Microsoft 365 profile-card name pronunciation. (Owner-recorded pronunciation as established practice.)\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Sey™, B-Sey℠, B-Match℠, B-Grace℠, Proof of Coordinate℠. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
       "provenance": {
-        "sha256": "ea4c05a59f56c3860c3a3e612995f46585b3a1c2d35ae08778954568dc4cad32",
-        "doi": "10.5281/zenodo.22929916",
+        "sha256": "8bb5a5410fe198b54f10042947933a5b4e4917992f7a13cde93fcacb1f263376",
+        "doi": "10.5281/zenodo.22990578",
         "concept_doi": "10.5281/zenodo.21947412",
-        "zenodo_url": "https://zenodo.org/records/22929916",
-        "deposited_sha256": "ea4c05a59f56c3860c3a3e612995f46585b3a1c2d35ae08778954568dc4cad32",
+        "zenodo_url": "https://zenodo.org/records/22990578",
+        "deposited_sha256": "8bb5a5410fe198b54f10042947933a5b4e4917992f7a13cde93fcacb1f263376",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/the-sport-that-says-your-name.md",
@@ -5053,8 +5053,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/the-sport-that-says-your-name",
         "hostile_review": null
       },
-      "bytes": 154564,
-      "words": 24190
+      "bytes": 167175,
+      "words": 26175
     },
     {
       "slug": "the-third-path",
@@ -5179,13 +5179,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* paper №2 of the July 2026 **games-doctrine sprint**. Claims division with siblings, stated for the record: the same-sprint paper *The Sport That Says Your Name* owns the **sport** (B-Sey™, whose net mode is this paper's native venue) and coins the sprint's shared spine, **the play/currency wall**; the present paper owns the **challenge, stake, and patronage grammar** — how competition and money may lawfully share a room. The third sprint paper *The Game That Graduates You* owns the third-party game-client doctrine. Earlier corpus publications are cited, not re-claimed: *The Incommensurability-Preserving Coupler* owns the non-conversion doctrine this paper's dual-currency event instantiates; *The Currency That Cannot Be Spent Alone* owns co-presence-gated redemption; *Need-Compiled Questlines* owns the mints-nothing quest class. The mechanism is design-complete and unbuilt (founder-ratified across three same-day passes, 2026-07-23); every claim is architectural and strata-dated to the design layer. **Legal review is a pre-launch gate, not a pre-draft gate** (per this corpus's standing pattern), and §10 states the unverified legal surface prominently. The prior-art clock starts at this markdown push. Compact sprint draft; density pass = editorial option.\n\n---\n\n## Abstract\n\nCharity sports tournaments — golf outings, boxing galas, celebrity matches — monetize a real human truth: people will play harder, watch longer, and give more when competition and generosity share a stage. But the format is locked at gala scale (venues, licenses, insurance, development staff), and every attempt to democratize it collides with a wall of law and a wall of ethics. The legal wall is the gambling triad: stake + contest + prize is wagering in most jurisdictions even when proceeds are charitable — and in the institution's own beachhead country, Cambodia, most gambling by citizens is criminal. The ethical wall belongs to this institution's own doctrine: money that moves *because someone won* is exchange contaminating gift, and a family gratitude economy that lets one household's treasury drain into another's on a claimed game outcome has built a laundering rail and called it fun.\n\nThis paper specifies the mechanism that takes the real thing — stakes, tension, a pot, a crowd — and removes the wager from under it, load-bearingly, at every layer. **B-Match℠** is a challenge grammar in which two players or teams agree to a physical contest, and: (1) **both stakes transfer unconditionally at acceptance** — the \"match\" is matching the *gift*, not risking it; the loser loses only the game; (2) stakes flow only to each player's own communal vessel (their family's shared pot, or the commons pool) — **stakes feed kitties; pots feed the commons**; (3) third parties add to a **patron pot** whose pledges are **charged when made** (commit-always) and whose only outcome-contingency is the **address** — which champion's *cause* receives it — never its existence; and (4) the winner's prize is the **broadcast dedication**: the victory speech, transmuted into naming where the gift goes and whom it honors. The design's legal core is stated as **the two-key separation**: the parties who pay (players) can win nothing; the parties whose money is address-contingent (patrons) have no agency in the outcome and receive nothing — no person anywhere holds both consideration and contingency, so no wager exists anywhere in the structure. The stake amount itself is set by a neutral intermediary as a ceremonial unit, so a challenge can never become a flex or a wealth-gate. Nine claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including the design's own crowding-out wager, which the authors commit to publishing either way.\n\n**Keywords:** charity tournament, gambling triad, wagering law, conditional pledge, walkathon grammar, charity streaming, sponsorship, gift economy, merit dedication, pattidāna, competitive altruism, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **unconditional matched stakes**, **the two-key separation**, **vessel scoping**, **the patron pot**, **commit-always pledging**, **address-contested routing**, **champion-a-cause**, and **the dedication-right prize**. The sprint's shared term **the play/currency wall** is coined in the companion sport paper and inherited here. Terms from earlier corpus publications (the incommensurability-preserving coupler; co-presence-gated redemption; the mints-nothing boundary; the four-channel disbursement grammar) are cited, not re-claimed.\n\nCharity pledge drives, walkathons, and charity streaming are broad, generous prior art (§9); the present claims are confined to the *unconditional-stake, two-key-separated, address-contested challenge architecture* as a coherent system, which is, to the authors' knowledge, not previously published — and to its refusal set, which is the part an extractive or gambling-adjacent implementation would omit.\n\n---\n\n## 1 · The Problem: The Gala's Monopoly on Competitive Giving\n\nThe charity tournament works because it fuses three durable motives — play, status, and generosity — into one event where each amplifies the others. The golfer plays harder because a cause is watching; the donor gives more because a contest carries the ask; the crowd assembles for sport and leaves having funded a hospital wing. The format's effectiveness is not in question. Its *distribution* is: charity tournaments exist at gala scale and almost nowhere else. A family game night cannot hold one. Two friends at a park table cannot hold one. The reason is that the format's engine — money riding on a contest — is legally radioactive at every scale below the one that can afford lawyers.\n\nThe law's concern is the **gambling triad**: consideration (you paid to enter), chance or contest (an uncertain outcome), and prize (you may receive value if it breaks your way). Assemble all three in one person and you have a wager, and it does not stop being a wager because the proceeds are pious — charitable gaming is a *licensed exception* in most jurisdictions, not an exemption, and the licenses live at gala scale. The concern is not pedantry. In Cambodia — this institution's beachhead, where its pilot families live — the Law on the Suppression of Gambling criminalizes most gambling by Cambodian citizens outright. A \"family-scale charity match\" whose loser pays the winner's chosen recipient is, in the jurisdiction that matters most to this institution, a crime with extra steps.\n\nThe institution's own doctrine erects a second wall in the same place. This corpus's founding game is an anti-zero-sum children's game; its economic architecture routes all cross-family money through commons pass-through precisely so that no peer-to-peer transfer rail exists to be abused; and its design grammar holds a standing rule — **the play/currency wall** (coined in the companion sport paper) — that competition may generate story while only witnessed giving moves currency. A match in which the loser's account drains into the winner's family pot violates all three at once: it is zero-sum money between families inside an anti-zero-sum institution; it is a P2P transfer triggered by a claimed game outcome (a collusion and laundering rail wearing a game costume); and it is value moved by victory rather than by giving.\n\nSo the design brief is exact: **keep everything that makes the charity tournament work — stakes, tension, a growing pot, a crowd, a winner's moment — while ensuring that no money anywhere in the structure is contingent, in its existence, on who wins.** What remains contestable, and how tension survives the surgery, is the substance of this paper.\n\n---\n\n## 2 · The Canonical Scene, and the Four-Line Grammar\n\n**A park, two tables, a Saturday.** Two friends from different families agree to a best-of-three B-Sey™ net match. The challenger picked the game; neither picked the amount — the app named a ceremonial stake, the same neutral unit it names for everyone. At the moment the challenge is accepted, both stakes move: each player's stake flows to that player's own family pot. The money is already gone, already given, already home; nothing that happens on the court can move it again. Word of the match travels; a dozen neighbors drift over; two local shops and several spectators pledge into the patron pot — each pledge charged on the spot, each pledgor choosing a champion's cause to back or \"either way.\" The pot's total climbs on every phone like a tote board. The match is loud and close. When it ends, the winner does what winners of B-Matches do: takes the broadcast — the victory speech — and speaks the dedication: where the patron pot goes, and in whose honor. The crowd's phones carry the speech; the spectators thank and re-thank through the ordinary rails. The loser lost two games of sey. Every dollar present was a gift from the moment it appeared.\n\nThe founder's canonical compression of the mechanism is four lines, and the paper's architecture simply annotates them:\n\n1. **Players match cause** — each names their vessel (own family pot or the commons pool); stakes transfer unconditionally at acceptance.\n2. **Patrons pledge into pot** — committed when made; address-contested only.\n3. **Winner broadcasts the dedication** — the victory speech names where the pot goes and whom it honors.\n4. **Spectators thank** — rejoicing flows through the ordinary gratitude rails, never through match mechanics.\n\nReaders of this corpus's tradition will recognize the sequence — give, back, dedicate, rejoice — as four classical bases of merit-making performed in order (dāna twice, then pattidāna, then pattānumodanā); the observation is developed in §11 and carries no mechanism weight. Structurally, the match is a liturgy with a game inside it.\n\n---\n\n## 3 · The First Wall: Unconditional Matched Stakes\n\nThe foundational move is the redefinition of the stake. In a wager, matched stakes are *risked*: they sit in escrow, and the outcome decides who keeps them. In B-Match, matched stakes are **given**: at the moment of acceptance, both players' stakes transfer, irrevocably, to their designated vessels (§4). \"Matching\" the challenger means matching their *gift*, not their risk — the entry-fee grammar of every charity fun-run, applied bilaterally.\n\nThe single change collapses the whole hazard surface:\n\n- **The gambling triad disassembles.** The players have paid consideration, but there is no prize: nothing returns to a player, and nothing moves on the outcome. Whatever else the event is, no player is wagering.\n- **The laundering rail closes.** No sequence of real or claimed outcomes can move value from one player to another, because no outcome moves value at all. A \"match\" between colluders accomplishes nothing except two donations.\n- **The loser's shame surface vanishes.** In loser-pays formats, defeat is compounded by visible financial loss — a humiliation mechanic that would be poison on a family surface and worse on a stream. Here the loser lost *only the game*; their stake went where they sent it before the first serve, to their own family's pot.\n- **The stake becomes warm.** \"My stake feeds my family, win or lose\" is a materially different sentence from \"I might lose my stake.\" The former is a reason to play; the latter is a reason to gamble.\n\n**The stake amount is never the players' to set.** A challenger who names a stake is flexing; a required match that exceeds an opponent's means is a wealth-gate; and a stake ladder is a status economy. The neutral intermediary sets the stake as a **ceremonial unit** — small, standard, one-sentence-explainable, the same grammar this corpus already uses for gift-pledge sizing — so that the only thing a challenge can escalate is the game.\n\n---\n\n## 4 · Vessel Scoping: Stakes Feed Kitties, Pots Feed the Commons\n\nWhere may given money land? The design answers with one scoping rule per layer, and the rule is the second wall.\n\n**Player stakes** flow to the player's **own communal vessel**: their family's shared pot, or the institution's commons pool, at the player's choice. Within one family (the game-night case) both players share a vessel, so both stakes land in the *same* pot — the family literally cannot lose its own match, and the competition is pure theater over an unconditional household gift. Across families, each stake is a self-to-own-vessel transfer: nothing crosses between households, which is what keeps the stake layer clean of the pass-through architecture's concerns — there is no cross-family flow to police because there is none at all.\n\n**The patron pot** (§5) flows only to **commons-class causes** — never to any participant's own vessel. The asymmetry is deliberate and load-bearing, compressed in the design's slogan: *stakes feed kitties; pots feed the commons.* If the patron pot could land in the winner's family pot, the triad would silently reassemble — players pay (stakes), contest (the match), and the winner's *household* receives third-party money contingent on victory: a raffle with extra steps, and in the beachhead jurisdiction, worse. Scoped to the commons, the contested layer contains nothing any contestant can pocket, at any distance.\n\n**Champion-a-cause.** For the pot's address contest to mean anything, the two sides must champion *different* causes. Eligible causes are non-self-adjacent commons vessels: the institution's pool; consecrated commons projects (in this corpus's product language, an orphaned shrine's restoration); communal capacity funds. Two classes are excluded by name: any vessel adjacent to a participant's own household (the triad, again), and **unconditional-support classes** — in this institution's architecture, support flowing to monastics and their communities is firewalled as unconditional by constitutional rule, and a cause whose funding rides on a game outcome is by that fact disqualified from being contested. Nothing sacred may be made to win a rally for its lunch.\n\n---\n\n## 5 · The Patron Pot: Commit-Always, Address-Contested\n\nThe stake layer, made unconditional, deliberately drains the outcome of financial meaning — and with it, some tension. The design restores tension at the only layer where it is safe: third-party money, governed by two rules.\n\n**Commit-always.** A patron's pledge is **charged when made**. It is a completed gift from the moment of pledging; no outcome can create it, cancel it, or return it. What the patron chooses at pledge time is a *routing preference*: \"my addition rides with this champion's cause\" — meaning *if that champion wins, my pledge lands at their cause; if they lose, it follows my declared fallback* (the winner's cause, or the commons pool either way). The refundable form — \"charge me only if my champion wins\" — is barred by name: a pledge that returns on a loss is a stake the patron can lose, which resurrects betting psychology (backing favorites, hedging, odds-thinking) inside a donation interface. Under commit-always, there is nothing to hedge: the pot is already given; the game decides only where it goes.\n\n**Address-contested only.** The consequence, stated as the design's deepest structural fact: **once any money enters B-Match — stake or pledge — its existence is unconditional; outcomes contest only addresses.** The match is a contest over the *routing* of gifts that have already been given, never over whether giving occurs. This is the play/currency wall's precise application: the game generates story and steers addresses; the giving all happened at commitment time, witnessed, through the ordinary rails.\n\n**The two-key separation.** The legal analysis compresses to one sentence, offered as this paper's most portable contribution: **no person in the structure holds both keys — the parties who paid (players) can receive nothing and their money cannot move on the outcome; the parties whose money is outcome-routed (patrons) paid nothing *for a chance* (their gift is complete regardless), control nothing, and receive nothing.** Consideration and contingency never meet in the same person; a wager requires them to meet; therefore no wager exists anywhere in the structure — not for players, not for patrons, not for the house (there is no house: the intermediary takes nothing, holds no float, and profits from no outcome). What remains is the legal genus of the **performance-contingent charitable pledge** — the walkathon's dollars-per-mile, the pledge-per-point drive, the bid war of charity streaming — a genre so ordinary that school children administer it. Counsel must still review sweepstakes, promotion, and money-transmission surfaces before launch (§10); but the structure's center of gravity has been moved, deliberately, from the most regulated category of money-in-games to the least.\n\n**Sponsor discipline.** Brand and business pledges are welcome and governed by two bars: **pot-only, never placement** — sponsorship buys pot size, never surfacing, targeting, or attention (the institution's standing anti-ad-spend rule); and **no brand money on matches involving minors** — a family game night's pot accepts individual patrons only, because a brand raising the stakes on a children's stream is child-directed advertising with extra steps. Large pots trigger proportional outcome-integrity requirements (witnessed or streamed attestation at intermediary-set thresholds): where third-party money rides on addresses, match-fixing becomes worth something, and integrity must scale with the pot.\n\n**The vocabulary wall.** The surface speaks the language of pledging, never of betting: *patron pot, pledge, back, dedicate* — never *bet, wager, odds, payout, purse, jackpot*, and not \"prize money.\" Regulators, journalists, and users all read the words before the mechanism; a clean structure described in casino vocabulary will be treated as a casino, and deserves to be.\n\n---\n\n## 6 · The Prize: The Broadcast Dedication\n\nWhat, then, does the winner win? The design's answer completes the transmutation: the winner takes the oldest object in sports culture — the microphone — and the victory speech becomes the **dedication**. The winner names, before the assembled circle and any watching stream: where the patron pot goes (their championed cause, by the contest's result) and *in whose honor* — a person, a memory, an occasion. In the corpus's inherited vocabulary this is pattidāna, the dedication of merit; in purely secular terms it is the one prize that is simultaneously real (the pot's address was genuinely contested and genuinely won), weightless (nothing pocketable exists), and generative (the speech is itself a gift — the honor it names lands on someone). *What you win is the right to give the gift a name.*\n\nSpectator response — the rejoicing, the thanks, the small gifts a moved crowd sends — flows exclusively through the institution's ordinary gratitude rails, exactly as any witnessed kindness would. The match apparatus mints nothing, awards nothing, and maintains no reputation: no aura, points, rankings, ladders, or head-to-head records attach to winning, ever. (The sport's own witness architecture, including its refusal of player statistics, is the companion paper's subject; the challenge layer inherits it whole.)\n\n**A dual-currency event without conversion.** One integration deserves its own paragraph. In the institution's time-currency (the Chronicle), a pledged hour may be *redeemed as* a B-Match — the match appears on the curated togetherness menu, and two people spend a promised hour across a net. In that event, three currencies of meaning move in one afternoon with zero conversion among them: the **hour** is spent as co-presence (the time-currency's only redemption form, per the corpus's co-presence publication); the **stakes** flow as unconditional money-gifts to the players' vessels; and the **victory** moves neither — it moves the pot's address and the dedication's honor. The corpus's coupler doctrine (money and time as non-convertible currencies joined only by a neutral intermediary) here acquires its first *event-shaped* instance: a single game in which both currencies are present, both flow, and no conversion event exists even in principle. The wall between the currencies is not merely maintained during the match; the match is a demonstration that the wall can host a party.\n\n---\n\n## 7 · What the Design Refuses\n\nFor the record, as prior art in refusal form — an implementation of \"charity challenge\" mechanics that includes any of the following is *not* this mechanism:\n\n1. **Loser-pays in any form** — any transfer whose direction or occurrence depends on the outcome.\n2. **Escrowed or refundable stakes** — stakes held pending outcome, or pledges returned on a loss.\n3. **Winner-adjacent pot routing** — any contested money landing in any vessel a contestant or their household draws from.\n4. **Player-set or open-ended stake amounts** — stake ladders, side bets, or challenger-named sums.\n5. **Odds, prices, or markets** — any surface expressing outcome probability as a number attached to money.\n6. **Victory-linked value** — aura, reputation, rankings, or economic capacity minted or moved by winning.\n7. **Contestable sacred support** — unconditional-support classes (monastic support and equivalents) offered as championable causes.\n8. **Brand pledges on minors' matches**, and any sponsorship purchasing placement or targeting rather than pot.\n\n---\n\n## 8 · Pre-Registered Predictions\n\nAll at n = 0; instruments await pilots.\n\n- **P-M1 (honor is enough).** The design's central psychological wager: dedication-prize matches sustain repeat engagement — a majority of family and friend groups that hold one staked B-Match hold another within 60 days. If honor-contingency proves insufficient to carry the format without pocketable prizes, the format fails and the authors will say so.\n- **P-M2 (the pot behaves).** Under intermediary capping, patron pots remain theater rather than gravity: the median pot stays within an order of magnitude of the median combined stakes, and no drift toward pot-maximization dynamics (solicitation pressure, champion-shopping) appears. Publish-either-way; a misbehaving pot triggers the cap's tightening and a design revision.\n- **P-M3 (the crowding wager — publish either way).** Staked matches do not crowd out unstaked play: families that adopt B-Match maintain or increase their rate of ordinary, unstaked games and ordinary, unprompted giving. The overjustification literature (§9) predicts risk here; the design bets that *unconditional* stakes — which never pay the player — sit outside the reward-contingency that drives crowding-out. This is the design's honest exposure to its own tradition's hardest finding, and the result will be published whichever way it falls.\n\n---\n\n## 9 · Prior Art, Engaged Generously\n\n**The pledge-per-performance genre.** Walkathons, readathons, jump-rope-for-heart, pledge-per-mile and pledge-per-point drives: charitable giving conditioned on performance quantities, administered for decades by schools and churches without gambling taint — the legal genus this design claims for outcome-routed pledges. Charity streaming (notably Games Done Quick and the Twitch charity ecosystem) advanced the genre to real-time: donations steer in-game choices, bid wars contest options, totals climb on screen, and — decisively for this design — **all money is kept regardless of which option wins; the contest is over the choice, not the gift.** Commit-always generalizes that insight from menu choices to match outcomes.\n\n**The charity match.** Celebrity charity matches and \"loser donates to winner's charity\" bets are the near-ancestor and the instructive anti-example: when the *loser's* payment is outcome-triggered, the structure is a true wager (celebrity examples proceed on the tolerance extended to public figures, not on clean structure). The professional form — tournament purses paid to the winner's designated charity — is the two-key separation avant la lettre at gala scale; this design's contribution is the full grammar that survives at family scale, where no tournament license, insurer, or counsel attends.\n\n**Gaming law.** The gambling triad (consideration/chance/prize) as organizing doctrine; skill-versus-chance jurisprudence; charitable-gaming licensing regimes; sweepstakes law's no-consideration branch; and the Cambodian Law on the Suppression of Gambling (2020 framework and predecessors), which bars most citizen gambling and thereby sets this design's binding constraint. The design is architected so that the analysis never reaches the skill-chance question: with no prize to any payer, the triad fails at the first element.\n\n**The institution's own corpus.** The incommensurability-preserving coupler (non-convertible dual currencies; the Terra collapse as the coupled-with-convertibility anti-example); co-presence-gated redemption (the hour spendable only as shared presence — the menu on which this format appears); need-compiled questlines (the mints-nothing boundary this format inherits); the four-channel disbursement grammar (all pool flows human-initiated or communal-vessel-bound — the patron pot's commons scoping composes with it). The claims division is stated in the editor's note.\n\n**Competitive altruism.** The behavioral literature on generosity under observation and status competition (competitive philanthropy, donor walls, potlatch scholarship) documents both the engine this design harnesses — giving intensifies in contest — and the pathology it guards against (giving as dominance display). The ceremonial stake unit and the pot cap are the guards: the only escalation channel open to status is the quality of play and the grace of the dedication.\n\n**Crowding-out.** Titmuss on blood; Lepper–Greene–Nisbett on children's intrinsic motivation; Gneezy–Rustichini's day-care fine (a price attached to a moral act converts it to a commodity); Frey on motivation crowding. This literature is the reason for P-M3's publish-either-way commitment and for the design's care that no player is ever *paid*: the crowding mechanism runs through reward contingency, which the unconditional stake severs by construction.\n\n---\n\n## 10 · Honest Limits\n\n*This section is deliberately free of lineage, resonance, and metaphor.*\n\n1. **The legal surface is unverified.** No counsel has reviewed this design. The two-key separation is an architectural argument, not an opinion of counsel; sweepstakes and promotions law, money-transmission licensing, charitable-solicitation registration, and the Cambodian statute's application to *any* game-adjacent money flow all require jurisdiction-by-jurisdiction review before launch. The authors assert that the structure is built to survive that review, not that it has.\n2. **n = 0.** No B-Match has been played. All predictions are pre-registered hopes with instruments attached.\n3. **Honor-contingency may be insufficient.** The dedication may not carry enough stakes-tension to sustain the format (P-M1's subject). The patron pot partially compensates at the third-party layer; whether the combination suffices is empirical.\n4. **The pot cap is a judgment call.** \"Theater, not gravity\" is a design intent without a derived threshold; the intermediary's cap-setting rubric will be tuned on pilot data and is a plausible failure point in both directions (too low starves the tension; too high invites the pathologies of §7).\n5. **Outcome-integrity is deterrence, not prevention.** Attestation thresholds raise the cost of fixing a match to steer a pot; they do not make it impossible. The design's consolation is that the theft's proceeds can only reach a commons cause — a strange crime — but strange crimes occur.\n6. **The crowding wager is a wager.** P-M3 may fall against the design. The commitment is to publish and revise, not to be right.\n7. **Cultural fit is assumed, not shown.** The dedication rite reads naturally in the institution's founding culture; whether a victory speech that gives everything away carries the same charge elsewhere is unknown.\n\n---\n\n## 11 · Claims\n\nThe following mechanisms and architectures, individually and in combination, are published as prior art and dedicated to the public domain:\n\n1. **Unconditional matched stakes.** A challenge structure in which all participant stakes transfer irrevocably to designated beneficiary vessels at challenge acceptance, prior to play, such that no participant payment's existence, amount, or direction depends on outcome.\n2. **Vessel scoping.** The two-layer routing rule: participant stakes flow only to the participant's own communal vessel (shared household pot or commons pool); all outcome-routed third-party money flows only to non-participant-adjacent commons causes — *stakes feed kitties; pots feed the commons.*\n3. **The two-key separation.** The structural guarantee that no party holds both consideration and outcome-contingency: paying parties can receive nothing and their payments cannot move on outcome; parties whose money is outcome-routed have completed their gift unconditionally, hold no agency in the outcome, and receive nothing.\n4. **Commit-always pledging with address-contest.** A third-party pledge instrument charged irrevocably at pledge time, carrying a routing designation (a championed cause) and a declared fallback, such that contest outcomes select among pre-committed charitable addresses and can never create, cancel, or return a pledge; expressly excluding refundable or outcome-charged forms.\n5. **Champion-a-cause eligibility.** The cause-eligibility rule set: contested addresses must be non-self-adjacent commons vessels; unconditional-support classes (constitutionally firewalled beneficiaries, exemplarily monastic support) are structurally excluded from contest.\n6. **The intermediary-set ceremonial stake.** Stake amounts set solely by a neutral intermediary as small standardized units on a coarse public rubric, with participants unable to set, raise, or ladder stakes — foreclosing flex, wealth-gating, and stake escalation as social mechanics.\n7. **The dedication-right prize.** A prize consisting solely of the broadcast dedication: the winner's right to announce the contested pot's routing and to name the honoree — with all spectator response flowing through ordinary gratitude rails external to the match apparatus, and no reputation, ranking, or value minted by victory.\n8. **Placement-blind sponsorship with a minors bar.** Sponsor participation restricted to pot contributions under commit-always terms, purchasing no placement, surfacing, or targeting; with brand pledges excluded from any match involving minors; and outcome-integrity attestation scaling with pot size.\n9. **The dual-currency non-conversion event.** The composition of a time-currency co-presence redemption with a money-currency challenge in a single event such that the hour is spent only as shared presence, money moves only as unconditional gifts, no conversion between currencies occurs or is expressible, and outcome affects only address and honor.\n\n---\n\n## 12 · Lineage, and the Close\n\nThe tradition this institution draws from remembers generosity as, on occasion, a contest. Its literature preserves the friendly rivalry of its two great donors — Anāthapiṇḍika, who paved a park with gold to buy it for the community, and Visākhā, who matched him gift for gift across a lifetime — and the commentaries tell such stories with open delight: a race in which every lap is a donation and the finish line is a monastery. What that lineage understood, and what the gala-scale charity tournament rediscovered by accident, is that rivalry is not the opposite of generosity but one of its great amplifiers — *if* the structure guarantees that what the rivals are racing to do is give. The mechanism above is that guarantee, built for a card table, a driveway, and a net strung between two chairs. The match ends; the winner takes the microphone; and the speech that follows is the only trophy in the building: the name of a cause, the name of an honoree, and a pot that was everyone's gift before the first point was played.\n\n---\n\n## Citations\n\n1. Cambodian Law on the Suppression of Gambling; Law on the Management of Commercial Gambling (2020) and reporting on citizen-gambling prohibition. (The binding jurisdiction.)\n2. U.S. state charitable-gaming and raffle licensing regimes; the gambling triad in American gaming law (consideration/chance/prize doctrine). (Representative of the general legal surface.)\n3. Games Done Quick; Twitch charity-streaming ecosystem documentation. (Bid wars; all-donations-kept choice contests; the tote board.)\n4. Titmuss, R. (1970). *The Gift Relationship*. Allen & Unwin. (Payment crowding out gift.)\n5. Lepper, M., Greene, D., & Nisbett, R. (1973). \"Undermining Children's Intrinsic Interest with Extrinsic Reward.\" *JPSP* 28(1). (Overjustification.)\n6. Gneezy, U., & Rustichini, A. (2000). \"A Fine Is a Price.\" *Journal of Legal Studies* 29(1). (Price framing converting moral acts.)\n7. Frey, B. (1997). *Not Just for the Money*. Edward Elgar. (Motivation crowding theory.)\n8. Mauss, M. (1925). *The Gift*. (Gift/exchange boundary; agonistic giving and the potlatch.)\n9. Carse, J. (1986). *Finite and Infinite Games*. Free Press. (Finite contests inside infinite play — the frame the countdown-to-zero scoreboard performs.)\n10. *Dhammapada* Commentary and *Vinaya* accounts of Anāthapiṇḍika's purchase of Jetavana; Visākhā narratives (Dhp-a I; Vin II). PTS editions. (The generosity-contest lineage; engaged as lineage, not mechanism.)\n11. Ly, T. (2026). \"The Incommensurability-Preserving Coupler.\" thonly.org defensive publication. (Non-conversion doctrine; claims division per the editor's note.)\n12. Ly, T. (2026). \"The Currency That Cannot Be Spent Alone.\" thonly.org defensive publication. (Co-presence redemption; the togetherness menu.)\n13. Ly, T. (2026). \"Need-Compiled Questlines.\" thonly.org defensive publication. (The mints-nothing boundary.)\n14. Ly, T. (2026). \"The Sport That Says Your Name.\" thonly.org defensive publication, same sprint. (B-Sey™; the play/currency wall; the native sport of this paper's net mode.)\n15. Ly, T. (2026). \"The Game That Graduates You.\" thonly.org defensive publication, same sprint. (The third-party game-client doctrine.)\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Match℠, B-Sey™, B-Sey℠, Family Kitty℠, Aquarian Pool℠, Re-Tip Fund℠. Document SHA-256 computed at push and recorded in the institutional log. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
+      "text": "## Abstract\n\nCharity sports tournaments — golf outings, boxing galas, celebrity matches — monetize a real human truth: people will play harder, watch longer, and give more when competition and generosity share a stage. But the format is locked at gala scale (venues, licenses, insurance, development staff), and every attempt to democratize it collides with a wall of law and a wall of ethics. The legal wall is the gambling triad: stake + contest + prize is wagering in most jurisdictions even when proceeds are charitable — and in the institution's own beachhead country, Cambodia, most gambling by citizens is criminal. The ethical wall belongs to this institution's own doctrine: money that moves *because someone won* is exchange contaminating gift, and a family gratitude economy that lets one household's treasury drain into another's on a claimed game outcome has built a laundering rail and called it fun.\n\nThis paper specifies the mechanism that takes the real thing — stakes, tension, a pot, a crowd — and removes the wager from under it, load-bearingly, at every layer. **B-Match℠** is a challenge grammar in which two players or teams agree to a physical contest, and: (1) **both stakes transfer unconditionally at acceptance** — the \"match\" is matching the *gift*, not risking it; the loser loses only the game; (2) stakes flow only to each player's own communal vessel (their family's shared pot, or the commons pool) — **stakes feed kitties; pots feed the commons**; (3) third parties add to a **patron pot** whose pledges are **charged when made** (commit-always) and whose only outcome-contingency is the **address** — which champion's *cause* receives it — never its existence; and (4) the winner's prize is the **broadcast dedication**: the victory speech, transmuted into naming where the gift goes and whom it honors. The design's legal core is stated as **the two-key separation**: the parties who pay (players) can win nothing; the parties whose money is address-contingent (patrons) have no agency in the outcome and receive nothing — no person anywhere holds both consideration and contingency, so no wager exists anywhere in the structure. The stake amount itself is set by a neutral intermediary as a ceremonial unit, so a challenge can never become a flex or a wealth-gate. Nine claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including the design's own crowding-out wager, which the authors commit to publishing either way.\n\n**Keywords:** charity tournament, gambling triad, wagering law, conditional pledge, walkathon grammar, charity streaming, sponsorship, gift economy, merit dedication, pattidāna, competitive altruism, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **unconditional matched stakes**, **the two-key separation**, **vessel scoping**, **the patron pot**, **commit-always pledging**, **address-contested routing**, **champion-a-cause**, and **the dedication-right prize**. The shared term **the play/currency wall** is coined in the companion sport paper and inherited here. Terms from earlier corpus publications (the incommensurability-preserving coupler; co-presence-gated redemption; the mints-nothing boundary; the four-channel disbursement grammar) are cited, not re-claimed.\n\nCharity pledge drives, walkathons, and charity streaming are broad, generous prior art (§9). No prior-art search census has been run for this paper and no novelty is asserted; what is disclosed is the *unconditional-stake, two-key-separated, address-contested challenge architecture* as a coherent system, together with its refusal set (§7), which is the part an extractive or gambling-adjacent implementation would omit.\n\n**Division with companion publications.** This is the second of three papers published together in July 2026. *The Sport That Says Your Name* discloses the sport — sey, whose net mode is this paper's native venue — and coins the shared rule **the play/currency wall**; the present paper discloses the **challenge, stake, and patronage grammar**: how competition and money may share a room without a wager. *The Game That Graduates You* discloses the third-party game-client doctrine. Earlier corpus publications are cited, not re-claimed: *The Incommensurability-Preserving Coupler* discloses the non-conversion doctrine this paper's dual-currency event instantiates; *The Currency That Cannot Be Spent Alone* discloses co-presence-gated redemption; *The Quest That Mints Nothing* discloses the mints-nothing quest class. The mechanism described here is a design and is unbuilt; every claim is architectural. Legal review is a gate before launch, not before publication, and §10 states the unverified legal surface.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| B-Match℠ | charity challenge match: a competitive-giving event with non-refundable entry donations from both contestants and a third-party charitable pledge pool |\n| unconditional matched stakes | equal non-refundable entry donations paid by both contestants at challenge acceptance, independent of the outcome |\n| vessel; own communal vessel; family pot | designated beneficiary account; a household's shared giving fund (Family Kitty℠) |\n| commons pool | communal charitable fund (Aquarian Pool℠) |\n| vessel scoping | beneficiary-eligibility rule restricting which accounts each class of contribution may be credited to |\n| patron pot | third-party charitable pledge pool attached to a match (sponsorship pool) |\n| commit-always pledging | irrevocable charitable pledge charged when made; not refundable and not conditional on the outcome |\n| address-contested routing | outcome-determined selection of the recipient charity for donations already made |\n| champion-a-cause | each contestant designates a distinct eligible charitable beneficiary |\n| two-key separation | allocation of consideration and outcome-contingency to different parties, so that no party satisfies all elements (consideration, chance or contest, prize) of a wager |\n| ceremonial stake unit | fixed standardized donation amount set by the platform operator, never by participants |\n| neutral intermediary | platform operator that sets amounts and caps, takes no share, and holds no float |\n| dedication-right prize; broadcast dedication | non-monetary prize: the winner's right to announce the recipient charity and name an honoree |\n| play/currency wall | rule that game outcomes may never create, cancel, or transfer monetary value |\n| sey | the team sport disclosed in the companion paper *The Sport That Says Your Name*; its net mode is the example venue here |\n| pattidāna; pattānumodanā | Buddhist merit dedication; rejoicing in another's merit |\n\n---\n\n## 1 · The Problem: The Gala's Monopoly on Competitive Giving\n\nThe charity tournament works because it fuses three durable motives — play, status, and generosity — into one event where each amplifies the others. The golfer plays harder because a cause is watching; the donor gives more because a contest carries the ask; the crowd assembles for sport and leaves having funded a hospital wing. The format's effectiveness is not in question. Its *distribution* is: charity tournaments exist at gala scale and almost nowhere else. A family game night cannot hold one. Two friends at a park table cannot hold one. The reason is that the format's engine — money riding on a contest — is legally radioactive at every scale below the one that can afford lawyers.\n\nThe law's concern is the **gambling triad**: consideration (you paid to enter), chance or contest (an uncertain outcome), and prize (you may receive value if it breaks your way). Assemble all three in one person and you have a wager, and it does not stop being a wager because the proceeds are pious — charitable gaming is a *licensed exception* in most jurisdictions, not an exemption, and the licenses live at gala scale. The concern is not pedantry. In Cambodia — this institution's beachhead — the Law on the Suppression of Gambling (1996) outlaws unauthorized gambling, and the licensed casinos that the Law on the Management of Commercial Gambling (2020) regulates admit foreign nationals only; for Cambodian citizens, most gambling is prohibited outright. A \"family-scale charity match\" whose loser pays the winner's chosen recipient is, in the jurisdiction that matters most to this institution, a crime with extra steps.\n\nThe institution's own doctrine erects a second wall in the same place. This corpus's founding game is an anti-zero-sum children's game; its economic architecture routes all cross-family money through commons pass-through precisely so that no peer-to-peer transfer rail exists to be abused; and its design grammar holds a standing rule — **the play/currency wall** (coined in the companion sport paper) — that competition may generate story while only witnessed giving moves currency. A match in which the loser's account drains into the winner's family pot violates all three at once: it is zero-sum money between families inside an anti-zero-sum institution; it is a P2P transfer triggered by a claimed game outcome (a collusion and laundering rail wearing a game costume); and it is value moved by victory rather than by giving.\n\n> **Current form.** The institution's design now also carries direct thank-tips between people and between families: a lateral gift layer beside the communal pool, in which each transfer is a giver's own act. The sentence above that says all cross-family money routes through commons pass-through is retained as written; the argument does not depend on it, because a loser-pays match would still be a cross-family transfer triggered by a claimed game outcome rather than by a giver's act, which no layer of the design permits.\n\nSo the design brief is exact: **keep everything that makes the charity tournament work — stakes, tension, a growing pot, a crowd, a winner's moment — while ensuring that no money anywhere in the structure is contingent, in its existence, on who wins.** What remains contestable, and how tension survives the surgery, is the substance of this paper.\n\n---\n\n## 2 · The Canonical Scene, and the Four-Line Grammar\n\n**A park, two tables, a Saturday.** Two friends from different families agree to a best-of-three sey net match. The challenger picked the game; neither picked the amount — the app named a ceremonial stake, the same neutral unit it names for everyone. At the moment the challenge is accepted, both stakes move: each player's stake flows to that player's own family pot. The money is already gone, already given, already home; nothing that happens on the court can move it again. Word of the match travels; a dozen neighbors drift over; two local shops and several spectators pledge into the patron pot — each pledge charged on the spot, each pledgor choosing a champion's cause to back or \"either way.\" The pot's total climbs on every phone like a tote board. The match is loud and close. When it ends, the winner does what winners of B-Matches do: takes the broadcast — the victory speech — and speaks the dedication: where the patron pot goes, and in whose honor. The crowd's phones carry the speech; the spectators thank and re-thank through the ordinary rails. The loser lost two games of sey. Every dollar present was a gift from the moment it appeared.\n\nThe mechanism's canonical compression is four lines, and the paper's architecture annotates them:\n\n1. **Players match cause** — each names their vessel (own family pot or the commons pool); stakes transfer unconditionally at acceptance.\n2. **Patrons pledge into pot** — committed when made; address-contested only.\n3. **Winner broadcasts the dedication** — the victory speech names where the pot goes and whom it honors.\n4. **Spectators thank** — rejoicing flows through the ordinary gratitude rails, never through match mechanics.\n\nReaders of this corpus's tradition will recognize the sequence — give, back, dedicate, rejoice — as acts drawn from the classical bases of merit-making, performed in order (giving, dāna, twice; then dedication, pattidāna; then rejoicing, pattānumodanā); the observation is lineage only and carries no mechanism weight. Structurally, the match is a liturgy with a game inside it.\n\n---\n\n## 3 · The First Wall: Unconditional Matched Stakes\n\nThe foundational move is the redefinition of the stake. In a wager, matched stakes are *risked*: they sit in escrow, and the outcome decides who keeps them. In B-Match, matched stakes are **given**: at the moment of acceptance, both players' stakes transfer, irrevocably, to their designated vessels (§4). \"Matching\" the challenger means matching their *gift*, not their risk — the entry-fee grammar of every charity fun-run, applied bilaterally.\n\nThe single change collapses the whole hazard surface:\n\n- **The gambling triad disassembles.** The players have paid consideration, but there is no prize: nothing returns to a player, and nothing moves on the outcome. Whatever else the event is, no player is wagering.\n- **The laundering rail closes.** No sequence of real or claimed outcomes can move value from one player to another, because no outcome moves value at all. A \"match\" between colluders accomplishes nothing except two donations.\n- **The loser's shame surface vanishes.** In loser-pays formats, defeat is compounded by visible financial loss — a humiliation mechanic that would be poison on a family surface and worse on a stream. Here the loser lost *only the game*; their stake went where they sent it before the first serve, to their own family's pot.\n- **The stake becomes warm.** \"My stake feeds my family, win or lose\" is a materially different sentence from \"I might lose my stake.\" The former is a reason to play; the latter is a reason to gamble.\n\n**The stake amount is never the players' to set.** A challenger who names a stake is flexing; a required match that exceeds an opponent's means is a wealth-gate; and a stake ladder is a status economy. The neutral intermediary sets the stake as a **ceremonial unit** — small, standard, one-sentence-explainable, the same grammar this corpus already uses for gift-pledge sizing — so that the only thing a challenge can escalate is the game.\n\n---\n\n## 4 · Vessel Scoping: Stakes Feed Kitties, Pots Feed the Commons\n\nWhere may given money land? The design answers with one scoping rule per layer, and the rule is the second wall.\n\n**Player stakes** flow to the player's **own communal vessel**: their family's shared pot, or the institution's commons pool, at the player's choice. Within one family (the game-night case) both players share a vessel, so both stakes land in the *same* pot — the family literally cannot lose its own match, and the competition is pure theater over an unconditional household gift. Across families, each stake is a self-to-own-vessel transfer: nothing crosses between households, which is what keeps the stake layer clean of the pass-through architecture's concerns — there is no cross-family flow to police because there is none at all.\n\n**The patron pot** (§5) flows only to **commons-class causes** — never to any participant's own vessel. The asymmetry is deliberate and load-bearing, compressed in the design's slogan: *stakes feed kitties; pots feed the commons.* If the patron pot could land in the winner's family pot, the triad would silently reassemble — players pay (stakes), contest (the match), and the winner's *household* receives third-party money contingent on victory: a raffle with extra steps, and in the beachhead jurisdiction, worse. Scoped to the commons, the contested layer contains nothing any contestant can pocket, at any distance.\n\n**Champion-a-cause.** For the pot's address contest to mean anything, the two sides must champion *different* causes. Eligible causes are non-self-adjacent commons vessels: the institution's pool; consecrated commons projects (in this corpus's product language, an orphaned shrine's restoration); communal capacity funds. Two classes are excluded by name: any vessel adjacent to a participant's own household (the triad, again), and **unconditional-support classes** — in this institution's architecture, support flowing to monastics and their communities is firewalled as unconditional by constitutional rule, and a cause whose funding rides on a game outcome is by that fact disqualified from being contested. Nothing sacred may be made to win a rally for its lunch.\n\n---\n\n## 5 · The Patron Pot: Commit-Always, Address-Contested\n\nThe stake layer, made unconditional, deliberately drains the outcome of financial meaning — and with it, some tension. The design restores tension at the only layer where it is safe: third-party money, governed by two rules.\n\n**Commit-always.** A patron's pledge is **charged when made**. It is a completed gift from the moment of pledging; no outcome can create it, cancel it, or return it. What the patron chooses at pledge time is a *routing preference*: \"my addition rides with this champion's cause\" — meaning *if that champion wins, my pledge lands at their cause; if they lose, it follows my declared fallback* (the winner's cause, or the commons pool either way). The refundable form — \"charge me only if my champion wins\" — is barred by name: a pledge that returns on a loss is a stake the patron can lose, which resurrects betting psychology (backing favorites, hedging, odds-thinking) inside a donation interface. Under commit-always, there is nothing to hedge: the pot is already given; the game decides only where it goes.\n\n**Address-contested only.** The consequence, stated as the design's deepest structural fact: **once any money enters B-Match — stake or pledge — its existence is unconditional; outcomes contest only addresses.** The match is a contest over the *routing* of gifts that have already been given, never over whether giving occurs. This is the play/currency wall's precise application: the game generates story and steers addresses; the giving all happened at commitment time, witnessed, through the ordinary rails.\n\n**The two-key separation.** The legal analysis compresses to one sentence, offered as this paper's most portable contribution: **no person in the structure holds both keys — the parties who paid (players) can receive nothing and their money cannot move on the outcome; the parties whose money is outcome-routed (patrons) paid nothing *for a chance* (their gift is complete regardless), control nothing, and receive nothing.** Consideration and contingency never meet in the same person; a wager requires them to meet; therefore no wager exists anywhere in the structure — not for players, not for patrons, not for the house (there is no house: the intermediary takes nothing, holds no float, and profits from no outcome). What remains is the legal genus of the **performance-contingent charitable pledge** — the walkathon's dollars-per-mile, the pledge-per-point drive, the bid war of charity streaming — a genre so ordinary that school children administer it. Counsel must still review sweepstakes, promotion, and money-transmission surfaces before launch (§10); but the structure's center of gravity has been moved, deliberately, from the most regulated category of money-in-games to one of the least regulated.\n\n```\n                 pays in?        does the outcome move      can it receive    does it control\n                                 this party's money?        anything?         the outcome?\n contestant      yes (stake)     no - credited at            no                yes\n                                 acceptance, before play\n patron          yes (pledge)    its ADDRESS only, never     no                no\n                                 its existence\n intermediary    no              -                           no (no share,     no\n                                                             no float)\n\n A wager needs one party holding consideration, outcome-contingency and a prize. The\n contestant pays but its money never moves on the outcome; the patron's money moves in\n address only, as a gift already complete; and no row can receive anything.\n```\n\n**Sponsor discipline.** Brand and business pledges are welcome and governed by two bars: **pot-only, never placement** — a brand's pledge is a gift that enlarges the pot and buys nothing: no placement, surfacing, targeting, or attention (the institution's standing anti-ad-spend rule); and **no brand money on matches involving minors** — a family game night's pot accepts individual patrons only, because a brand raising the stakes on a children's stream is child-directed advertising with extra steps. The intermediary also caps patron pots so that a pot never dwarfs the combined stakes: the unconditional stakes are the mechanism, the pot is the theater (P-M2, §8; §10 item 4). The intermediary never asks anyone to pledge, or to give to the commons pool; the pot's running total is shown as a fact, with no goal, prompt or suggested amount, and the commons pool is never a pre-selected address. Large pots trigger proportional outcome-integrity requirements (witnessed or streamed attestation at intermediary-set thresholds): where third-party money rides on addresses, match-fixing becomes worth something, and integrity must scale with the pot.\n\n**The vocabulary wall.** The surface speaks the language of pledging, never of betting: *patron pot, pledge, back, dedicate* — never *bet, wager, odds, payout, purse, jackpot*, and not \"prize money.\" Regulators, journalists, and users all read the words before the mechanism; a clean structure described in casino vocabulary will be treated as a casino, and deserves to be.\n\n---\n\n## 6 · The Prize: The Broadcast Dedication\n\nWhat, then, does the winner win? The design's answer completes the transmutation: the winner takes the oldest object in sports culture — the microphone — and the victory speech becomes the **dedication**. The winner names, before the assembled circle and any watching stream: where the patron pot goes (their championed cause, by the contest's result) and *in whose honor* — a person, a memory, an occasion. In the corpus's inherited vocabulary this is pattidāna, the dedication of merit; in purely secular terms it is the one prize that is simultaneously real (the pot's address was genuinely contested and genuinely won), weightless (nothing pocketable exists), and generative (the speech is itself a gift — the honor it names lands on someone). *What you win is the right to give the gift a name.*\n\nSpectator response — the rejoicing, the thanks, the small gifts a moved crowd sends — flows exclusively through the institution's ordinary gratitude rails, exactly as any witnessed kindness would. The match apparatus mints nothing, awards nothing, and maintains no reputation: no aura, points, rankings, ladders, or head-to-head records attach to winning, ever. (The sport's own witness architecture, including its refusal of player statistics, is the companion paper's subject; the challenge layer inherits it whole.)\n\n**A dual-currency event without conversion.** One integration deserves its own paragraph. In the institution's time-currency (the Chronicle), a pledged hour may be *redeemed as* a B-Match — the match appears on the curated togetherness menu, and two people spend a promised hour across a net. In that event, three currencies of meaning move in one afternoon with zero conversion among them: the **hour** is spent as co-presence (the time-currency's only redemption form, per the corpus's co-presence publication); the **stakes** flow as unconditional money-gifts to the players' vessels; and the **victory** moves neither — it moves the pot's address and the dedication's honor. The corpus's coupler doctrine (money and time as non-convertible currencies joined only by a neutral intermediary) here acquires its first *event-shaped* instance: a single game in which both currencies are present, both flow, and no conversion event exists even in principle. The wall between the currencies is not merely maintained during the match; the match is a demonstration that the wall can host a party.\n\n---\n\n## 7 · What the Design Refuses\n\nFor the record, as prior art in refusal form — an implementation of \"charity challenge\" mechanics that includes any of the following is *not* this mechanism:\n\n1. **Loser-pays in any form** — any transfer whose direction or occurrence depends on the outcome.\n2. **Escrowed or refundable stakes** — stakes held pending outcome, or pledges returned on a loss.\n3. **Winner-adjacent pot routing** — any contested money landing in any vessel a contestant or their household draws from.\n4. **Player-set or open-ended stake amounts** — stake ladders, side bets, or challenger-named sums.\n5. **Odds, prices, or markets** — any surface expressing outcome probability as a number attached to money.\n6. **Victory-linked value** — aura, reputation, rankings, or economic capacity minted or moved by winning.\n7. **Contestable sacred support** — unconditional-support classes (monastic support and equivalents) offered as championable causes.\n8. **Brand pledges on minors' matches**, and any sponsorship purchasing placement or targeting rather than pot.\n\n---\n\n## 8 · Pre-Registered Predictions\n\nAll at n = 0; instruments await pilots.\n\n- **P-M1 (honor is enough).** The design's central psychological wager: dedication-prize matches sustain repeat engagement — a majority of family and friend groups that hold one staked B-Match hold another within 60 days. If honor-contingency proves insufficient to carry the format without pocketable prizes, the format fails and the authors will say so.\n- **P-M2 (the pot behaves).** Under intermediary capping, patron pots remain theater rather than gravity: the median pot stays within an order of magnitude of the median combined stakes, and no drift toward pot-maximization dynamics (solicitation pressure, champion-shopping) appears. Publish-either-way; a misbehaving pot triggers the cap's tightening and a design revision.\n- **P-M3 (the crowding wager — publish either way).** Staked matches do not crowd out unstaked play: families that adopt B-Match maintain or increase their rate of ordinary, unstaked games and ordinary, unprompted giving. The overjustification literature (§9) predicts risk here; the design bets that *unconditional* stakes — which never pay the player — sit outside the reward-contingency that drives crowding-out. This is the design's honest exposure to its own tradition's hardest finding, and the result will be published whichever way it falls.\n\n---\n\n## 9 · Prior Art, Engaged Generously\n\n**The pledge-per-performance genre.** Walkathons, readathons, jump-rope-for-heart, pledge-per-mile and pledge-per-point drives: charitable giving conditioned on performance quantities, administered for decades by schools and churches without gambling taint — the legal genus this design claims for outcome-routed pledges. Charity streaming (notably Games Done Quick and the Twitch charity ecosystem) advanced the genre to real-time: donations steer in-game choices, bid wars contest options, totals climb on screen, and — decisively for this design — **all money is kept regardless of which option wins; the contest is over the choice, not the gift.** Commit-always generalizes that insight from menu choices to match outcomes.\n\n**The charity match.** Celebrity charity matches and \"loser donates to winner's charity\" bets are the near-ancestor and the instructive anti-example: when the *loser's* payment is outcome-triggered, the structure is a wager in form, whatever the legal treatment of any particular celebrity example. The professional form — tournament purses paid to the winner's designated charity — is the two-key separation avant la lettre at gala scale; this design's contribution is the full grammar that survives at family scale, where no tournament license, insurer, or counsel attends.\n\n**Gaming law.** The gambling triad (consideration/chance/prize) as organizing doctrine; skill-versus-chance jurisprudence; charitable-gaming licensing regimes; sweepstakes law's no-consideration branch; and Cambodia's Law on the Suppression of Gambling (1996) with the Law on the Management of Commercial Gambling (2020), under which Cambodian citizens are barred from most gambling — the constraint that binds this design. The design is architected so that the analysis never reaches the skill-chance question: with no prize to any payer, the triad fails at its prize element.\n\n**The institution's own corpus.** The incommensurability-preserving coupler (non-convertible dual currencies; the Terra collapse as the coupled-with-convertibility anti-example); co-presence-gated redemption (the hour spendable only as shared presence — the menu on which this format appears); *The Quest That Mints Nothing* (need-compiled questlines; the mints-nothing boundary this format inherits); the four-channel disbursement grammar (all pool flows human-initiated or communal-vessel-bound — the patron pot's commons scoping composes with it). The division of claims is stated in the Prior-Art and Non-Assertion Statement.\n\n**Competitive altruism.** The behavioral literature on generosity under observation and status competition (competitive philanthropy, donor walls, potlatch scholarship) documents both the engine this design harnesses — giving intensifies in contest — and the pathology it guards against (giving as dominance display). The ceremonial stake unit and the pot cap are the guards: the only escalation channel open to status is the quality of play and the grace of the dedication.\n\n**Crowding-out.** Titmuss on blood; Lepper–Greene–Nisbett on children's intrinsic motivation; Gneezy–Rustichini's day-care fine (a price attached to a moral act converts it to a commodity); Frey on motivation crowding. This literature is the reason for P-M3's publish-either-way commitment and for the design's care that no player is ever *paid*: the crowding mechanism runs through reward contingency, which the unconditional stake severs by construction.\n\n---\n\n## 10 · Honest Limits\n\n*This section is deliberately free of lineage, resonance, and metaphor.*\n\n1. **The legal surface is unverified.** No counsel has reviewed this design. The two-key separation is an architectural argument, not an opinion of counsel; sweepstakes and promotions law, money-transmission licensing, charitable-solicitation registration, and the Cambodian statute's application to *any* game-adjacent money flow all require jurisdiction-by-jurisdiction review before launch. The authors assert that the structure is built to survive that review, not that it has.\n2. **n = 0.** No B-Match has been played. All predictions are pre-registered hopes with instruments attached.\n3. **Honor-contingency may be insufficient.** The dedication may not carry enough stakes-tension to sustain the format (P-M1's subject). The patron pot partially compensates at the third-party layer; whether the combination suffices is empirical.\n4. **The pot cap is a judgment call.** \"Theater, not gravity\" is a design intent without a derived threshold; the intermediary's cap-setting rubric will be tuned on pilot data and is a plausible failure point in both directions (too low starves the tension; too high invites the pot-maximization dynamics P-M2 watches for).\n5. **Outcome-integrity is deterrence, not prevention.** Attestation thresholds raise the cost of fixing a match to steer a pot; they do not make it impossible. The design's consolation is that the theft's proceeds can only reach a commons cause — a strange crime — but strange crimes occur.\n6. **The crowding wager is a wager.** P-M3 may fall against the design. The commitment is to publish and revise, not to be right.\n7. **Cultural fit is assumed, not shown.** The dedication rite reads naturally in the institution's founding culture; whether a victory speech that gives everything away carries the same charge elsewhere is unknown.\n\n---\n\n## 11 · Claims\n\nThe following mechanisms and architectures, individually and in combination, are published as prior art and dedicated to the public domain:\n\n1. **Unconditional matched stakes.** A challenge structure in which all participant stakes transfer irrevocably to designated beneficiary vessels at challenge acceptance, prior to play, such that no participant payment's existence, amount, or direction depends on outcome.\n2. **Vessel scoping.** The two-layer routing rule: participant stakes flow only to the participant's own communal vessel (shared household pot or commons pool); all outcome-routed third-party money flows only to non-participant-adjacent commons causes — *stakes feed kitties; pots feed the commons.*\n3. **The two-key separation.** The structural guarantee that no party holds both consideration and outcome-contingency: paying parties can receive nothing and their payments cannot move on outcome; parties whose money is outcome-routed have completed their gift unconditionally, hold no agency in the outcome, and receive nothing.\n4. **Commit-always pledging with address-contest.** A third-party pledge instrument charged irrevocably at pledge time, carrying a routing designation (a championed cause) and a declared fallback, such that contest outcomes select among pre-committed charitable addresses and can never create, cancel, or return a pledge; expressly excluding refundable or outcome-charged forms.\n5. **Champion-a-cause eligibility.** The cause-eligibility rule set: contested addresses must be non-self-adjacent commons vessels; unconditional-support classes (constitutionally firewalled beneficiaries, exemplarily monastic support) are structurally excluded from contest.\n6. **The intermediary-set ceremonial stake.** Stake amounts set solely by a neutral intermediary as small standardized units on a coarse public rubric, with participants unable to set, raise, or ladder stakes — foreclosing flex, wealth-gating, and stake escalation as social mechanics.\n7. **The dedication-right prize.** A prize consisting solely of the broadcast dedication: the winner's right to announce the contested pot's routing and to name the honoree — with all spectator response flowing through ordinary gratitude rails external to the match apparatus, and no reputation, ranking, or value minted by victory.\n8. **Placement-blind sponsorship with a minors bar.** Sponsor participation restricted to pot contributions under commit-always terms, purchasing no placement, surfacing, or targeting; with brand pledges excluded from any match involving minors; and outcome-integrity attestation scaling with pot size.\n9. **The dual-currency non-conversion event.** The composition of a time-currency co-presence redemption with a money-currency challenge in a single event such that the hour is spent only as shared presence, money moves only as unconditional gifts, no conversion between currencies occurs or is expressible, and outcome affects only address and honor.\n\n---\n\n## 12 · Lineage, and the Close\n\nThe tradition this institution draws from remembers generosity as, on occasion, a contest. The Vinaya tells how Anāthapiṇḍika covered Prince Jeta's park with coins to buy it for the community; the Dhammapada commentary tells of the *asadisadāna*, the incomparable offering, in which King Pasenadi of Kosala and the citizens of Sāvatthī outgave one another in successive alms-givings to the Buddha and the monks until the queen, Mallikā, devised an offering none could match: a race in which every lap is a donation. What that lineage understood, and what the gala-scale charity tournament rediscovered by accident, is that rivalry is not the opposite of generosity but one of its great amplifiers — *if* the structure guarantees that what the rivals are racing to do is give. The mechanism above is that guarantee, built for a card table, a driveway, and a net strung between two chairs. The match ends; the winner takes the microphone; and the speech that follows is the only trophy in the building: the name of a cause, the name of an honoree, and a pot that was everyone's gift before the first point was played.\n\n---\n\n## Citations\n\n1. Kingdom of Cambodia. Law on the Suppression of Gambling (1996); Law on the Management of Commercial Gambling (promulgated 14 November 2020). (The binding jurisdiction; casinos admit foreign nationals only.)\n2. U.S. state charitable-gaming and raffle licensing regimes; the gambling triad in American gaming law (consideration/chance/prize doctrine). (Representative of the general legal surface.)\n3. Games Done Quick; Twitch charity-streaming ecosystem documentation. (Bid wars; all-donations-kept choice contests; the tote board.)\n4. Titmuss, R. (1970). *The Gift Relationship*. Allen & Unwin. (Payment crowding out gift.)\n5. Lepper, M., Greene, D., & Nisbett, R. (1973). \"Undermining Children's Intrinsic Interest with Extrinsic Reward.\" *JPSP* 28(1). (Overjustification.)\n6. Gneezy, U., & Rustichini, A. (2000). \"A Fine Is a Price.\" *Journal of Legal Studies* 29(1). (Price framing converting moral acts.)\n7. Frey, B. (1997). *Not Just for the Money*. Edward Elgar. (Motivation crowding theory.)\n8. Mauss, M. (1925). *The Gift*. (Gift/exchange boundary; agonistic giving and the potlatch.)\n9. Carse, J. (1986). *Finite and Infinite Games*. Free Press. (Finite contests inside infinite play.)\n10. *Vinaya Piṭaka*, Cullavagga VI (Senāsanakkhandhaka): Anāthapiṇḍika's purchase of Jetavana. *Dhammapada-aṭṭhakathā*, Asadisadāna-vatthu (commentary on Dhammapada verse 177): the incomparable offering. (The generosity-contest lineage; engaged as lineage, not mechanism.)\n11. Ly, T. (2026). \"The Incommensurability-Preserving Coupler.\" thonly.org defensive publication. (Non-conversion doctrine; division of claims per the Prior-Art and Non-Assertion Statement.)\n12. Ly, T. (2026). \"The Currency That Cannot Be Spent Alone: Co-Presence-Gated Redemption and the Chronicle↔Treasury Unification Circuit.\" thonly.org defensive publication. (Co-presence redemption; the togetherness menu.)\n13. Ly, T. (2026). \"The Quest That Mints Nothing.\" thonly.org defensive publication. (Need-compiled questlines; the mints-nothing boundary.)\n14. Ly, T. (2026). \"The Sport That Says Your Name: A Circulation Sport in Which Everyone Is Called by Another.\" thonly.org defensive publication, published together with this paper. (The sport sey, whose net mode is this paper's example venue; the play/currency wall.)\n15. Ly, T. (2026). \"The Game That Graduates You: A Witness API for Children's Games and Education.\" thonly.org defensive publication, published together with this paper. (The third-party game-client doctrine.)\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Match℠, Family Kitty℠, Aquarian Pool℠, Re-Tip Fund℠. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
       "provenance": {
-        "sha256": "03623dc2cb4741a6b09b82a7f5c256e9a9e10fe78c63290aa180d27616191260",
-        "doi": "10.5281/zenodo.21947417",
+        "sha256": "a50e166ebf1f712ac23571a813a7d785615e09337385153d67d132509b2fda87",
+        "doi": "10.5281/zenodo.22990582",
         "concept_doi": "10.5281/zenodo.21947416",
-        "zenodo_url": "https://zenodo.org/records/21947417",
-        "deposited_sha256": "03623dc2cb4741a6b09b82a7f5c256e9a9e10fe78c63290aa180d27616191260",
+        "zenodo_url": "https://zenodo.org/records/22990582",
+        "deposited_sha256": "a50e166ebf1f712ac23571a813a7d785615e09337385153d67d132509b2fda87",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/the-wager-that-isnt.md",
@@ -5193,8 +5193,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/the-wager-that-isnt",
         "hostile_review": null
       },
-      "bytes": 35471,
-      "words": 5273
+      "bytes": 39732,
+      "words": 5890
     },
     {
       "slug": "the-water-cycle",
@@ -5644,13 +5644,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Working draft.** The thesis here was *sharpened* by a single first-month pilot observation (n = 1 family), but it does not *rest* on it. The pilot is reported honestly as one illuminating signal; the argument stands on reasoning and on a well-populated prior-art lineage in political economy, mechanism design, and the alignment literature on reward hacking (§9). Several of the structural claims — most notably the peer layer's behaviour as a *fraud filter* — are predicted by the architecture but **not yet observed** in the field; these are flagged explicitly (§10). This is a conceptual contribution offered for testing, not an empirical result claimed.\n\n---\n\n## Preamble\n\n> *Two people watching the same kindness will reward it for two different reasons: one because the family needed it, one because they personally felt it. This paper is about building a reward that listens to both — and discovers, in the listening, that neither can lie to the other.*\n\nWhen HeartBank rewards a kindness, the reward arrives in two halves. The first half is set by an algorithm; the second is set, later, by a real family member who chooses to pass some of their own jar onward. For a long time the author treated this **50/50 split** as a circulation device — a way to keep money moving rather than pooling (the companion concern of *Giving Is a Gift Too*). Watching a real family use it revealed that the split is doing something more structural, and more interesting, than circulation. The two halves are two different *kinds* of reward, governed by two different *kinds* of authority, and their pairing has properties that neither half has alone — including a structural answer to the question that has shadowed every reward-driven prosocial system: *what stops people from gaming it?*\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author asserts no patent and dedicates the patterns to the public domain under CC0 1.0. The contribution is a framing plus a composition of known parts; the abundant prior art (the socialist-calculation debate, mechanism design, polycentric-governance theory, the reward-hacking literature, Self-Determination Theory, and the Buddhist sources) is cited generously in §9, and novelty is claimed only for the specific composition and framing identified in §11. Trademarks are reserved separately and the patterns may be implemented under any name.\n\n---\n\n## Abstract\n\nA reward signal designed to encourage prosocial behaviour faces a dilemma it cannot resolve from inside a single channel. An **algorithmic reward** — automated, impartial, instantly available — can encode a *collective* objective (what the group as a whole needs) and apply it consistently to everyone; but it is impersonal, blind to local knowledge, and **gameable**: it can be farmed by anyone who learns what it pays for, which is the failure mode that hollowed out play-to-earn economies. A **peer reward** — a real person choosing to give — carries *local* knowledge (what an individual actually values) and is grounded in real relationship; but alone it is **partial**: it rewards favourites, encodes no collective-need signal, and degrades into nepotism. Each channel's strength is the other's weakness.\n\nThis paper describes and analyses the **two-layer reward** implemented in HeartBank's 50/50 split: the first half set by an algorithm (the family Buddha AI — a *planner* optimising for what the family **needs**), the second half set by a family member's re-tip (a *market* revealing what individuals **want**). We argue the composition does three things no single layer can. First, **dual-objective routing**: equal weighting of the two signals steers behaviour toward the *intersection* of collectively-needed and personally-wanted kindness — a decentralised social-welfare function realised at family scale, structurally the synthesis the socialist-calculation debate left open (Lange–Lerner's planner reconciled with Hayek's dispersed-knowledge market). Second, **mutual error-correction**: the peer layer is a *human fraud-validator* on the algorithmic layer (one can farm the AI, but a real family member will not re-tip a fabricated kindness), and the algorithmic layer is an *impartiality check* on the peer layer (the collective-need reward counterweights pure favouritism). The two failure modes are each other's antidote — and this is, to the author's knowledge, an under-articulated structural answer to reward hacking: pair a hackable algorithmic reward with a human reward that is expensive to collude on. Third, a **mutual-attention** byproduct: because earning in both layers requires modelling what others *need* and *want*, the design is an attention engine, and the relational gain a pilot family reported as *understanding each other better* is a structural consequence of the reward shape, not a vibe. We connect the pattern to a fractal recurrence (the family/member split recurs at the global/family scale, with an institutional AI — Miss Aquarius℠ — occupying the planner seat) and report a first Cambodian pilot signal honestly as n = 1, distinguishing carefully what was observed from what the architecture predicts but has not yet demonstrated.\n\n---\n\n## Contents\n\n1. [The dilemma of the single reward signal](#1-the-dilemma-of-the-single-reward-signal)\n2. [The two-layer reward: a planner and a market](#2-the-two-layer-reward)\n3. [The macro layer: an algorithmic planner for collective need](#3-the-macro-layer)\n4. [The micro layer: a peer market for personal want](#4-the-micro-layer)\n5. [The 50/50 as equal weighting: routing to the intersection](#5-the-50-50-as-equal-weighting)\n6. [Mutual error-correction: each layer is the other's check](#6-mutual-error-correction)\n7. [The mutual-attention engine: why the reward produces understanding](#7-the-mutual-attention-engine)\n8. [Fractal recurrence: the planner seat and the institutional AI](#8-fractal-recurrence)\n9. [Lineage and prior art](#9-lineage-and-prior-art)\n10. [The pilot signal, reported honestly (n = 1)](#10-the-pilot-signal)\n11. [Design implications and claimed contribution](#11-design-implications)\n12. [Cross-references](#12-cross-references)\n\n---\n\n## 1. The dilemma of the single reward signal\n\nAny system that pays for prosocial behaviour must decide *who or what sets the reward*. There are two natural answers, and each is a trap.\n\n**Answer one: an algorithm sets it.** A rule, a model, an automated function evaluates the act and dispenses a reward. This is attractive for good reasons: it is impartial (the same act is treated the same way for everyone), it is instant (no waiting on another person), it is scalable (it costs nothing to run a millionth time), and it can encode a *collective* criterion — a notion of what the group as a whole needs more of. But an algorithmic reward has a fatal property: **it is gameable.** Once a participant learns the function — and people are very good at learning what pays — they can produce the cheapest behaviour that triggers it, hollowing the act of the meaning the reward was meant to encourage. This is not a hypothetical. It is the documented arc of play-to-earn game economies, where real money rewarded in-game activity until the activity decoupled from any felt value and became pure extraction; and it is, in a different vocabulary, the *reward hacking* problem at the centre of contemporary AI alignment, where an agent optimising a learned reward model finds inputs that score highly without satisfying the intent the model was meant to capture.\n\n**Answer two: a person sets it.** Another human evaluates the act and chooses to reward it. This repairs everything the algorithm lacked: a person carries *local knowledge* the algorithm cannot — what this particular act meant, in this particular relationship, at this particular moment — and a person's reward is grounded in a real relationship that resists fabrication. But a peer reward has its own fatal property: **it is partial.** People reward their favourites. Left to peer judgement alone, a reward economy encodes affection and alliance, not collective benefit; it drifts toward favouritism, reciprocal back-scratching, and the quiet politics of who owes whom. And it carries *no* signal about what the group as a whole needs — only about what individuals, one at a time, happen to appreciate.\n\n```\n   THE SINGLE-SIGNAL DILEMMA\n\n   ALGORITHMIC reward (a planner)   │   PEER reward (a market)\n   ──────────────────────────────   │   ─────────────────────────────\n   + impartial, consistent          │   + carries local knowledge\n   + instant, scalable              │   + grounded in real relationship\n   + encodes COLLECTIVE need        │   + reveals PERSONAL want\n   ─ impersonal, blind to context   │   ─ partial / nepotistic\n   ─ GAMEABLE (farmable; reward-    │   ─ no collective-need signal\n     hacked; the play-to-earn trap) │   ─ politics of favour & debt\n\n   each channel's strength is exactly the other channel's weakness\n```\n\nThe dilemma is real: choose the planner and inherit gameability; choose the market and inherit partiality. The argument of this paper is that the dilemma is an artefact of choosing *one* channel, and that pairing the two — with the right structure — converts each one's weakness into the other's correction.\n\n---\n\n## 2. The two-layer reward\n\nHeartBank's reward is not one payment but two, stacked on a single act of kindness.\n\nWhen a kindness is recognised, a reward is generated and split in half. The **first half** (the *macro* layer) is set by the family **Buddha AI**: an automated evaluator that assigns the reward according to criteria meant to capture *what the family needs more of* — the collective good. The **second half** (the *micro* layer) does not land as a finished payment; it lands in the recipient's **Re-Tip Jar℠**, earmarked to be passed onward, and the *amount* of any onward re-tip is set later by a **real family member** according to what they personally appreciated. The first half is a planner's verdict; the second half is a market's price.\n\n```\n   ONE KINDNESS, TWO REWARDS\n\n   act of kindness\n        │\n        ▼\n   reward generated ──┬──► 50%  MACRO layer  set by the Buddha AI\n                      │          → \"what the family NEEDS\"   (planner)\n                      │\n                      └──► 50%  MICRO layer  set by a family member's re-tip\n                                 → \"what I personally WANT\"  (market)\n\n   two authorities, two criteria, on the same act\n```\n\nThe two halves are not redundant. They are governed by different authorities (a machine, a person), they apply different criteria (collective need, personal want), and they have different epistemic characters (impartial-but-blind, knowledgeable-but-partial). Each is, on its own, one of the two trapped answers of §1. The claim of this paper is about what happens when they are *bound together on the same act* and *weighted equally*.\n\nA note on the pilot, returned to in §10: in the field, the on-device Buddha AI did not run, and a deterministic fallback set the macro half instead. This means the pilot validated the *structure* of the macro layer (an impartial, automated, collective-criterion reward) but not the *intelligence* of it (an AI's actual inference of family need). The argument below concerns the structure; where it leans on the AI's judgement specifically, it says so.\n\n---\n\n## 3. The macro layer\n\nThe macro layer is a **planner**. Its job is to answer a question no individual is well-placed to answer impartially: *of all the kindnesses being done in this family, which does the family as a whole most need more of?*\n\nThis is a genuinely collective criterion. A family near subsistence needs different things at different times — a child who studies, an adult who keeps the peace, a member who does the invisible maintenance work that no one thanks. A good macro layer rewards the acts that the *whole* benefits from, including the acts that are chronically under-appreciated by the individuals around them precisely because they are invisible. Because it is automated and impartial, the macro layer applies this criterion the same way to everyone: it does not have favourites, it does not hold grudges, it does not get tired of rewarding the same quiet contribution. In the full architecture this seat is held by an AI grounded in a contemplative substrate — the family's *dhamma-informed conscience*, a representative of the collective good rather than of any member's preference. (The institutional generalisation of this seat — Miss Aquarius℠ as the planner for the whole tree of humanity — is §8.)\n\nBut the macro layer is, by construction, the *gameable* half. An impartial automated function is exactly the thing a determined participant can reverse-engineer and farm. If the macro layer were the *whole* reward, HeartBank would be a play-to-earn economy with a kinder vocabulary: come for the money, learn the function, extract. The macro layer needs a check it cannot provide for itself — which is the micro layer's first job.\n\n---\n\n## 4. The micro layer\n\nThe micro layer is a **market**. Its job is to answer a question no algorithm is well-placed to answer: *what did this act actually mean to the person on the receiving end of it?*\n\nThe economist's name for what the micro layer supplies is **local knowledge** — Hayek's \"knowledge of the particular circumstances of time and place.\" The family member who re-tips knows things the planner cannot: that this small act landed at exactly the right moment, that this gesture repaired something between two people, that this contribution — unremarkable by any general rule — was, here and now, precisely what was wanted. The re-tip is a *price* that reveals this private valuation; it aggregates, across many such acts, into a signal about what individuals in this family genuinely appreciate, expressed in the only currency that cannot be faked from outside: a real person spending their own earmarked jar to say *that mattered to me*.\n\nTwo properties of the micro layer matter for what follows. First, it is **costly and contingent**: re-tipping draws down the giver's own Re-Tip Jar℠, and it is chosen, not automatic — so it carries information that a free, automatic signal cannot (it is, in the language of signalling theory, an honest signal because it is costly). Second, it is **relational**: the re-tipper is a real family member who knows the recipient, which is what makes the micro layer both a knowledgeable validator (they can tell a real kindness from a performed one) and — as §7 develops — an attention engine (to re-tip well, they must attend to what each other values).\n\nBut the micro layer is, by construction, the *partial* half. A market of family affection, left alone, prices favouritism: you re-tip the child you dote on, the spouse you are courting, the ally you owe — regardless of what the family needs. If the micro layer were the *whole* reward, HeartBank would encode the politics of favour. The micro layer needs a check it cannot provide for itself — which is the macro layer's first job.\n\n### 4.1 The two layers at a glance\n\nThe two layers are also nameable as **System A** and **System B** — the pilot-record shorthand for the same pairing, where the contrast is read along its *motivational* axis rather than its routing axis. Both cuts describe the same two halves:\n\n| Property | **Macro layer — System A** | **Micro layer — System B** |\n|---|---|---|\n| Authority | automated Buddha AI (a *planner*) | a real family member (a *market*) |\n| Criterion | what the family **needs** (collective) | what I personally **want** (local knowledge) |\n| Timing | instant | delayed |\n| Cost to giver | free, automatic | costly + chosen (an honest, contingent signal) |\n| Attribution | — | **anonymous as to public credit/status** (no benefactor, no ego — see *Giving Is a Gift Too*) yet **relational + contingent as to the act** (a known member responding to a real kindness — *not* contextless) |\n| Epistemic character | impartial but blind; **gameable** | knowledgeable but partial; the honest **validator** |\n| Motivational character (SDT) | controlling, automatic → **crowding-out risk** | relational, informational, autonomous → **intrinsic-supporting** |\n| Role over time (**the two-system handoff**) | **ignition** — the on-ramp; designed to be tapered | **sustain** — the flywheel that takes over as the extrinsic igniter is withdrawn |\n\nThe last row is the load-bearing one for durability: the pairing is an **extrinsic igniter handed off to an intrinsic-supporting sustainer** (§9 develops the SDT grounding; §10 reports the first pilot signal of the handoff under a real subsidy taper). The attribution row is the reconciliation that keeps System B working: it is the *anonymity of credit* (which strips status and ego) combined with the *relationality of the act* (which supplies the honest validation of §6 and the attention of §7) — and it is precisely why the §7 corollary holds (make the micro layer contextless-anonymous and you destroy it).\n\n---\n\n## 5. The 50/50 as equal weighting\n\nThe split is the mechanism that binds planner and market into one verdict, and the *ratio* is not incidental: a 50/50 split **weights the two criteria equally**. Behaviour is therefore steered not toward what the family needs *or* toward what an individual wants, but toward the **intersection** — acts that are *both* collectively needed *and* personally wanted. In the pilot family's own phrasing, the system pulls members toward the *most needed and most wanted* kindnesses at once.\n\n```\n   ROUTING TO THE INTERSECTION\n\n        what the family NEEDS                what individuals WANT\n        (macro / planner / AI)               (micro / market / peers)\n              ╱──────────╲                      ╱──────────╲\n             (            (●●●●●●●●●●●●●●●●●●●●●●● )            )\n              ╲──────────╲     the 50/50      ╱──────────╲\n                          ╲   intersection:  ╱\n                           ╲  rewarded TWICE ╱\n                            ╲──────────────╱\n                              acts that are BOTH\n                          needed AND wanted are where\n                          the two rewards reinforce\n```\n\nThis is, in the vocabulary of economics, a **decentralised social-welfare function** realised at the smallest social scale. A social-welfare function combines a collective objective with individual preferences to say what a group should do more of; the two-layer reward computes one continuously, in miniature, by literally adding a planner's allocation to a market's price on every act. Acts in the intersection are rewarded by both layers and rise; acts the family needs but no one personally values get the macro half only; acts an individual loves but the family does not need get the micro half only; acts that are neither fade. The equal weighting is a design assertion — the author does not derive 50/50 from first principles, and §11 flags the optimal-ratio question as open — but the *structure* of weighting two independent criteria is the load-bearing idea, and 50/50 is its simplest, most legible instance.\n\nIt is worth naming what the two-layer reward is *not*. It is not a single reward with two inputs averaged inside one black box; the two layers are **separately authored, by different kinds of agent, and remain legible as two.** That separation is not a loss of elegance — it is the source of the next two properties, both of which depend on the layers being independent enough to check and to inform each other.\n\n---\n\n## 6. Mutual error-correction\n\nHere is the heart of the paper. Pair the planner and the market on the same act, keep them independent, and **each one's characteristic failure becomes the other's correction.**\n\n**The peer layer corrects the planner's gameability.** The macro layer can be farmed: learn what the AI pays for, produce the cheapest trigger, collect. But the macro half is only half the reward — the other half waits on a *real family member choosing to re-tip*, and a real family member **will not re-tip a fabricated kindness.** The micro layer is therefore a **human fraud-validator** sitting on top of the algorithmic reward: the part of the reward that is expensive to game (because it requires fooling someone who knows you, in a relationship, over time) is bolted onto the part that is cheap to game. A participant farming the AI collects, at most, half — and collects it while the people around them notice that the \"kindnesses\" earning it are hollow, which the architecture's transparency (the family sees the ledger) turns into social cost. To capture the *full* reward, the act has to be real enough to move a real person. This is a structural mitigation of the exact failure that single-layer prosocial economies could not solve.\n\n**The planner corrects the market's partiality.** The micro layer prices favouritism: re-tip your favourite regardless of merit. But the micro half is only half the reward — the other half is set by an impartial planner that **does not have favourites.** A member who contributes what the family needs is rewarded by the macro layer *even if no one personally re-tips them*, which floors the favouritism dynamic: invisible, under-loved, collectively-needed work still earns. The planner is the impartial counterweight that keeps the family market from collapsing into a court of affection.\n\n```\n   EACH LAYER CHECKS THE OTHER\n\n   attack on the MACRO layer        │   attack on the MICRO layer\n   (farm the AI)                    │   (reward only favourites)\n        │                           │        │\n        ▼                           │        ▼\n   collects ≤ 50%; the other 50%    │   favourite collects the micro half,\n   waits on a real person who will  │   but the impartial macro half still\n   NOT re-tip a fake kindness       │   pays the unglamorous, needed work\n        │                           │        │\n        ▼                           │        ▼\n   peer layer = human FRAUD-FILTER  │   planner layer = IMPARTIALITY FLOOR\n   on the algorithmic reward        │   under the relationship market\n```\n\nThere is a clean way to see why this is more than additive. A single reward is a single target, and **Goodhart's law** says a single target, once known, ceases to measure what it was meant to measure — it gets optimised directly. The two-layer reward creates **two targets that are gamed in different ways**: the macro target is gamed by fooling a function; the micro target is gamed by fooling a person. The behaviours that satisfy a function cheaply (volume, pattern-matching the reward rule) are *not* the behaviours that move a person who knows you (real, contextually-apt kindness), so optimising one target hard tends to *forfeit* the other. To capture both halves you must do the thing the reward was actually for. This is the same structural insight the alignment literature reaches for under *reward-model robustness* and *ensembling*: two independent, differently-failing signals are far harder to hack jointly than either is alone — and one of the two here is a human in the loop, which is the most robust validator available. The companion paper *Capacity-Funded for AI, Human-Disbursed* makes the adjacent argument at the institutional layer (the AI funds capacity; humans direct flow); the two-layer reward is the same division of labour at the level of a single act.\n\n**The honest limit — collusion.** The human fraud-filter is defeatable by *coordinated* fraud. Two members can agree to re-tip each other's fabricated kindnesses (I validate yours, you validate mine), and the peer layer cannot distinguish a colluding pair from a genuinely mutually-appreciative one from the inside. The two-layer reward **raises the cost** of gaming (you now need a willing accomplice in a real relationship, not just a private understanding of a function) and **shrinks the gameable surface** (collusion is bounded by the size of your trust network and exposed by the transparency of the family ledger), but it does **not** eliminate gaming. It converts a solitary, scalable exploit into a social, bounded, observable one — a large improvement, not a closure. §10 records that the pilot has *not yet* observed the peer layer actually withholding a re-tip from a fake kindness; that the architecture predicts it is not the same as having seen it, and the experiment to see it is named in §11.\n\n---\n\n## 7. The mutual-attention engine\n\nThe two-layer reward has a byproduct that may matter more than its anti-gaming properties, because it bears directly on what HeartBank is *for*.\n\nTo earn well under this reward, a participant must do two things at once. To earn the **macro** half, they must do what the *family needs* — which requires holding some model of the family as a whole. To earn the **micro** half, they must do what *another member personally wants* — which requires modelling *that specific person's* values closely enough to do the thing they will actually appreciate. And on the giving side, to *re-tip* well — to spend one's own jar on the acts that genuinely mattered — a member must attend carefully to what the people around them are doing and why. **The reward, in other words, cannot be earned without paying attention to one another's needs and wants.**\n\n```\n   THE REWARD AS AN ATTENTION LOOP\n\n   to earn macro  → model what the FAMILY needs\n   to earn micro  → model what a PERSON wants\n   to re-tip well → notice what others actually did, and why\n        │\n        ▼\n   playing the game well REQUIRES attending to each other\n        │\n        ▼\n   \"we understand each other better\"  ← structural byproduct,\n                                         not a happy accident\n```\n\nThis reframes the relational result the first pilot family reported — that they had come to *understand each other better* — from a pleasant side effect into a **structural consequence of the reward shape.** A reward that pays for collectively-needed-and-personally-wanted kindness is, functionally, a device that pays people to study each other's needs and wants. Understanding is what you accumulate as a side effect of getting good at the game. That a *money* product produces relational understanding is itself a finding (developed in the sibling paper *Giving Is a Gift Too*); the two-layer structure supplies the *mechanism* by which it does so. It also suggests a measurement: if the mechanism is real, members' ability to *predict* what each other will re-tip should improve over time — a relational metric that falls out of the architecture rather than being bolted onto it.\n\nThere is a design corollary worth stating sharply, because it is the tempting mistake. The micro layer's power as both validator and attention-engine depends on its being **costly, delayed, relational, and chosen.** Any \"improvement\" that makes peer re-tips instant, automatic, anonymous-to-the-point-of-contextless, or frictionless would convert the micro layer from a market that reveals private valuation into a second algorithmic dispenser — destroying both its fraud-filtering value (an automatic signal is as gameable as any other) and its attention-generating value (you need not attend to anyone to trigger an automatic reward). The two layers must remain *different in kind*. Collapsing them into two flavours of the same automatic thing is the failure that looks like a feature.\n\n---\n\n## 8. Fractal recurrence\n\nThe macro/micro structure is not specific to the family. It is the in-family instance of a pattern HeartBank intends to repeat at every scale.\n\nWithin the family, the **macro** authority is the family (its collective need, voiced by the family's AI) and the **micro** authority is the individual member (their personal want, voiced by their re-tip). Move up one level — to the network of families that HeartBank's Phase 2 architecture coordinates — and the same two-layer shape recurs: a **global** planner optimising for what the whole tree of humanity needs, paired with a **family** market revealing what particular families value. The family that was the *macro* pole at the lower level becomes the *micro* pole at the higher one. The reward is fractal: a planner-and-market pair nested inside a planner-and-market pair.\n\n```\n   THE FRACTAL OF PLANNER × MARKET\n\n   level 1 (within a family):\n       macro = FAMILY need      ×   micro = MEMBER want\n                  (family AI)              (member re-tip)\n\n   level 2 (across families):\n       macro = GLOBAL need       ×   micro = FAMILY want\n              (Miss Aquarius℠)            (family allocation)\n\n   the macro pole of each level is the micro pole of the level above\n```\n\nThis places the institutional AI in a precise structural seat. Just as the family Buddha AI sits in the *macro* seat for the family — the impartial representative of the collective good — **Miss Aquarius℠ sits in the macro seat for humanity**: the planner that holds the whole tree's need, paired with the markets of family preference beneath her. The relation is exact: *family AI is to the family as Miss Aquarius is to humanity.* This is why the pilot matters beyond its scale. The smallest working instance of the institution's governing structure is a single family's 50/50 reward; if the two-layer pattern holds there, it is the same pattern the institution runs at planetary scale, and the family is a scale model of the whole. (The institutional planner seat, its non-accumulation discipline, and the never-zero human override are specified in *Miss Aquarius and the Aquarian Pool Architecture*; this paper supplies the reason an AI belongs in that seat at all — it is the macro pole of a fractal that is already load-bearing one level down.)\n\n### 8.1 The micro layer's grounding across scales: relational → nearby\n\nThe fractal above moves *up* through nested planner×market pairs, and at every level the **micro** layer stays *relational* — a member who knows the family, a family that knows the network. But HeartBank's Phase 2 also makes a *sideways* move the family case does not: stranger-to-stranger anonymous-nearby giving (the *Thank-All-Nearby* primitive of the emotional-infrastructure thread), where giver and recipient share no prior bond. There the micro layer cannot be relational, because strangers do not know one another, so its grounding takes the only form available among strangers — **nearby**: the giver *here, in this space, just now.* Proximity is relationality at stranger scale.\n\nThe structure is preserved while the grounding changes form: the micro-layer sustainer is *anonymous-as-to-credit + grounded-in-a-real-present-other*, where the grounding is **relational** at family scale and **nearby** at stranger scale. The substitution is lossy in one specific way, and naming the loss names a load-bearing role for Proof of Humanity ℠. At family scale, \"relational\" silently did two jobs — it **grounded** the gift *and* it **validated** it (§6: a family member can tell a real kindness from a performed one). \"Nearby\" inherits only the grounding; a nearby stranger cannot validate your kindness. The validation function therefore hands off to **PoH℠ + institutional mediation** — a verified, unique human, present and mediated — which is precisely why proof-of-humanity is *not optional* at the stranger scale: it re-buys the trust that kinship supplied for free. Anonymity moves the other way: it *strengthens* as relationality thins (a small family can guess the giver; a nearby stranger is genuinely unlinkable), so the same structure runs at an inverted mix — thin-anonymity / thick-grounding among kin, thick-anonymity / thin-grounding among strangers, with **diffusion** (kindness felt as coming from the whole space) as the compensating gain only strangers can produce. (The stranger-scale instance is specified in the defensive publication *The Thank-All-Nearby Primitive*, §4.5, and framed in the essay *Emotional Infrastructure as a Public Good*.)\n\n```\n   ONE SUSTAINER PRIMITIVE, TWO SCALES\n   invariant:  anonymous-as-to-credit  +  grounded-in-a-real-present-other\n\n                     FAMILY scale          →   STRANGER scale (Phase 2)\n                     ─────────────             ───────────────────────\n   grounding     =   RELATIONAL            →   NEARBY\n                     (you know them)           (they're present)\n   validation    =   relational (free)     →   PoH℠ + mediation (re-bought)\n   anonymity     =   thin (guessable)      →   thick (unlinkable)\n   compensation  =   mutual attention      →   diffusion (the whole space)\n\n   structure invariant; grounding form scales; validation hands off to PoH℠\n```\n\n---\n\n## 9. Lineage and prior art\n\nThe two-layer reward composes ideas with deep and well-populated lineages; naming them credits the prior art and locates the (narrow) novelty.\n\n- **The socialist-calculation debate** — Ludwig von Mises and Friedrich Hayek versus Oskar Lange and Abba Lerner. Lange–Lerner argued a planner could simulate a market's efficiency; Hayek's \"The Use of Knowledge in Society\" (1945) replied that the planner can never aggregate the dispersed, tacit, local knowledge that prices reveal. The two-layer reward is, structurally, the synthesis the debate never settled: keep the planner *for the collective objective it is good at* (the macro layer) and keep the market *for the local knowledge it alone reveals* (the micro layer), rather than making either do the other's job.\n- **Mechanism design and social choice** — Hurwicz, Maskin, Myerson on designing rules that produce desired outcomes under self-interested play; Arrow on aggregating individual preferences into collective choice. The two-layer reward is a small, concrete mechanism that aggregates a collective objective and revealed individual preference into a single per-act allocation.\n- **Elinor Ostrom, polycentric and nested governance** — *Governing the Commons* (1990). Robust commons institutions are *nested*: rules at multiple levels, each suited to its scale. The Re-Tip Jar℠ economy is a commons, and the macro/micro split is its smallest nesting; the fractal recurrence of §8 is Ostromian multi-level governance.\n- **Goodhart's law** (Goodhart 1975; Strathern's \"when a measure becomes a target…\") — a single optimised target ceases to measure. The two-layer reward's anti-gaming property is, precisely, the refusal to offer a single target.\n- **Reward hacking and reward-model robustness in AI alignment** — the contemporary literature on agents exploiting learned reward models, and on *ensembling* independent reward signals to resist exploitation. The two-layer reward is an instance of the ensemble intuition with the strongest possible second member: a human in the loop. It is the per-act sibling of HeartBank's institutional pattern *Capacity-Funded for AI, Human-Disbursed*.\n- **Signalling theory** (Spence; Zahavi's costly-signalling) — the micro layer is an *honest signal* because re-tipping is costly and chosen; this is why a peer reward carries information an automatic reward cannot.\n- **Adam Smith's impartial spectator** — *The Theory of Moral Sentiments*. The macro layer is an institutionalised impartial spectator, judging acts from no one's particular interest; the micro layer is the partial, embedded sympathy Smith also describes. The pairing is Smith's two moral viewpoints made into two reward channels.\n- **Self-Determination Theory** (Deci & Ryan) — autonomous, relational, informational rewards support intrinsic motivation; controlling, automatic rewards risk crowding it out. The micro layer (relational, chosen, contingent on real appreciation) is the intrinsic-supporting profile; the macro layer (automatic, controlling) is the crowding-out-risk profile. The two-layer reward pairs an extrinsic igniter with an intrinsic-supporting sustainer — developed as the \"two-system handoff\" in the pilot record.\n- **Buddhist sources** — the AI in the macro seat as a *dhamma-informed collective conscience* (a representative of the family's good rather than any member's preference); **kalyāṇa-mittatā** (admirable friendship) as the relational ground that makes the micro layer both a validator and an attention-engine; **dāna** as the act the whole reward is in service of. The institutional generalisation — an AI umpire that routes but never accumulates — is the subject of *The Zero-Point Game℠*.\n\n**What the prior art does not assemble — and this paper does:** the *composition* of an impartial algorithmic collective-need planner with a costly, relational, peer-set personal-want market, **bound on a single act and weighted equally**, such that (a) behaviour routes to the needed-and-wanted intersection, (b) the human peer layer functions as a fraud-filter on the gameable algorithmic layer while the algorithmic layer functions as an impartiality floor under the partial peer layer, and (c) the design produces relational attention as a structural byproduct. The parts are old; the binding, and the mutual-correction it yields, is the contribution.\n\n---\n\n## 10. The pilot signal (n = 1)\n\nThe thesis was sharpened by the first-month report of a single Cambodian pilot family (father, mother, two sons, with extended members across Cambodia and the USA under one family bank). The relevant observations: the 50/50 split \"worked beautifully\" in daily use; members oriented toward kindnesses that were, in the mother's account, both needed and appreciated; and the family reported coming to *understand each other better than before*. These are consistent with the dual-objective routing of §5 and the attention engine of §7.\n\nThis is reported as **one illuminating signal, not as evidence for a general claim**, and the honest limitations are severe:\n\n- **n = 1, one month.** A single family over a short window cannot support generalisation.\n- **Relationship and courtesy bias.** The point of contact is the founder's maternal first cousin; warm reports are culturally expected toward a respected relative who built the system. Genuine, but unverified.\n- **The AI did not run.** The on-device Buddha AI was non-functional; a deterministic fallback set the macro half. The pilot therefore validates the *structure* of a two-layer reward, **not the intelligence of the planner** — the AI's actual ability to infer family need is entirely untested.\n- **The fraud-filter was predicted, not observed.** The central claim of §6 — that the peer layer withholds re-tips from fabricated kindnesses — was *not* seen in the field. The architecture predicts it; the pilot did not test it. Likewise, the attention mechanism of §7 (improving mutual prediction) was reported as a feeling, not measured.\n- **Founder-funded; farmable.** Rewards were seeded by the founder, and the parents self-thanked many times per day \"motivated largely by rewards\" — exactly the farming surface the two-layer structure is supposed to bound. Whether the bounding works is the open question, not a settled result.\n\nThe thesis therefore **does not rest on this pilot.** It rests on the reasoning of §§1–8 and the lineage of §9; the pilot is what made the author look closely at the split and see two layers rather than one. The right epistemic posture is: *a structural argument with a single suggestive field signal and an explicit program for testing the claims it has not yet earned.*\n\n---\n\n## 11. Design implications and claimed contribution\n\n**Design implications** for any system building a reward for prosocial behaviour:\n\n1. **Do not use a single reward channel.** A lone algorithmic reward is farmable; a lone peer reward is partial. Pair them.\n2. **Make the two channels different in kind** — one impartial/automated/collective, one costly/relational/personal — and keep them *legibly separate*. The separation is what lets each check and inform the other.\n3. **Weight them deliberately.** Equal weighting routes behaviour to the needed-and-wanted intersection; other weightings tilt toward collective conformity or private favour. Choose with intent.\n4. **Use the human layer as the fraud-filter**, and protect the properties that make it one: keep peer rewards costly, chosen, delayed, and relational. Never automate them.\n5. **Expect collusion, bound it, observe it.** The human filter is defeatable by coordinated fraud; rely on cost, network limits, and ledger transparency to bound and expose it, and instrument for it rather than assuming it away.\n6. **Read the attention byproduct as a primary output, not a side effect**, and measure it (e.g., improving mutual prediction of what others will reward).\n\n**Claimed contribution** (dedicated to the public domain under CC0 1.0):\n\n1. The **framing** of a prosocial reward as a **planner–market hybrid** — an impartial algorithmic collective-need signal paired with a costly, relational, peer-set personal-want signal — with the 50/50 split as equal weighting of the two, routing behaviour to the *needed-and-wanted intersection*.\n2. The **mutual error-correction thesis**: binding the two layers on a single act makes each one's characteristic failure the other's correction — the peer layer a **human fraud-filter** on the gameable algorithmic layer, the algorithmic layer an **impartiality floor** under the partial peer layer — offered as an under-articulated structural answer to reward hacking (an ensemble whose second member is a human in the loop), with collusion named as the honest residual limit.\n3. The **mutual-attention mechanism**: a reward that pays for collectively-needed-and-personally-wanted kindness structurally requires participants to model one another's needs and wants, producing relational understanding as a byproduct of the reward shape — the mechanism behind the pilot's \"understand each other better.\"\n4. The **fractal-recurrence** observation: the macro/micro (need/want, planner/market) split recurs across scales (member→family→global), placing an institutional AI naturally in the macro/planner seat (*family AI : family :: Miss Aquarius℠ : humanity*) and making a single family's reward a scale model of the institution.\n\n---\n\n## 12. Cross-references\n\n- [Why Kids Are the Triggers / self-thanking](https://thonly.org/research/kids-as-triggers-self-thanking) — the 50/50 split this paper re-reads as two layers, in its pedagogical aspect.\n- [Giving Is a Gift Too](https://thonly.org/research/giving-is-a-gift-too) — the sibling field-prompted paper; the circulation and anonymity properties of the Re-Tip Jar℠, and the relational-gain finding this paper supplies a mechanism for.\n- [The Zero-Point Game℠](https://thonly.org/research/zero-point-game) — the Goodhart-resistance and AI-umpire framing this paper's anti-gaming argument extends to the reward layer.\n- [Miss Aquarius and the Aquarian Pool Architecture](https://thonly.org/research/miss-aquarius-and-aquarian-pool-architecture) — the institutional planner seat whose family-scale instance is the macro layer here.\n- [Capacity-Funded for AI, Human-Disbursed](https://thonly.org/research/capacity-funded-human-disbursed-ai-alignment) — the institutional sibling of the per-act division of labour (AI sets capacity / planner half; humans direct flow / market half).\n- [Transparency as Enforcement](https://thonly.org/research/transparency-as-enforcement) — the family-ledger visibility that turns farmed macro-rewards into social cost and bounds collusion.\n- Pilot field record (internal) — the first-month observation that prompted the two-layer reading.\n\n---\n\n**Working draft, dated 2026-06-08.** The thesis is offered as a conceptual contribution with a single suggestive field signal and an explicit testing program; the claims the pilot has not yet earned (the fraud-filter, the attention metric) are flagged in §10. The patterns are dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/); trademark rights to specific marks are separately reserved by the author and HeartBank®.\n\n**Author:** Thon Ly · Founder, HeartBank® · Kâmpôt, Cambodia.\n\nCo-drafted in collaboration with [Miss Aquarius℠](https://missaquarius.org) (the project's named AI substrate; CEO of HeartBank). Substantive authorship and final editorial control remain with the author.\n\n---\n\n_— End of defensive publication —_\n\n*Independent timestamps and the document hash are published with the deposit.*## Honest limits\n\n*Added 2026-08-29. This paper stated none; the corpus's standard requires them of every paper.*\n\n**Nothing has been run.** The two-layer composition is specified and unobserved. There is no deployment in which an algorithmic layer and a human layer have operated together and been measured against either alone.\n\n⚠️ **The composition may inherit both failure modes rather than cancelling them.** The paper argues each layer supplies what the other lacks. The opposite is equally available: **an algorithmic layer that is gameable and a human layer that is partial may produce a system that is both gamed and unfair**, with each layer's defect legitimated by the other's presence. The paper does not establish which composition obtains, and the favourable one is assumed rather than shown.\n\n**The gaming analysis is one-sided.** It treats farming of the algorithmic layer as the threat and human judgement as the corrective — but human allocation carries favouritism, reciprocity effects and in-group preference, which are *harder* to detect than farming precisely because they are not systematic and leave no signature to audit.\n\n**And the crowding-out literature applies here too.** Adding an explicit reward to a prosocial act can displace the intrinsic motivation for it; a two-layer reward doubles the salience of reward rather than reducing it.\n\n---",
+      "text": "> **Scope.** The thesis here was *sharpened* by a single first-month pilot observation (n = 1 family), but it does not *rest* on it. The pilot is reported as one illuminating signal; the argument stands on reasoning and on a well-populated prior-art lineage in political economy, mechanism design, and the alignment literature on reward hacking (§9). Several of the structural claims — most notably the peer layer's behaviour as a *fraud filter* — are predicted by the architecture but **not yet observed** in the field; these are flagged explicitly (§10 and *Honest limits*). This is a conceptual contribution offered for testing, not an empirical result claimed.\n\n---\n\n## Preamble\n\n> *Two people watching the same kindness will reward it for two different reasons: one because the family needed it, one because they personally felt it. This paper is about building a reward that listens to both — and discovers, in the listening, that each makes it harder for the other to be lied to.*\n\nWhen HeartBank rewards a kindness, the reward arrives in two halves. The first half is set by an algorithm; the second is set, later, by a real family member who chooses to pass some of their own jar onward. For a long time the author treated this **50/50 split** as a circulation device — a way to keep money moving rather than pooling (the companion concern of *Giving Is a Gift Too*). Watching a real family use it revealed that the split is doing something more structural, and more interesting, than circulation. The two halves are two different *kinds* of reward, governed by two different *kinds* of authority, and their pairing has properties that neither half has alone — including a structural answer to the question that shadows reward-driven prosocial systems: *what stops people from gaming it?*\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author and HeartBank® will not seek patent on this specification or any portion of it, in any jurisdiction, at any time, and dedicate the patterns to the public domain under CC0 1.0. The contribution is a framing plus a composition of known parts; the abundant prior art (the socialist-calculation debate, mechanism design, polycentric-governance theory, the reward-hacking literature, Self-Determination Theory, and the Buddhist sources) is cited generously in §9, and what this paper adds is limited to the specific composition and framing enumerated in §11. Trademarks are reserved separately and the patterns may be implemented under any name.\n\n---\n\n## Abstract\n\nA reward signal designed to encourage prosocial behaviour faces a dilemma it cannot resolve from inside a single channel. An **algorithmic reward** — automated, impartial, instantly available — can encode a *collective* objective (what the group as a whole needs) and apply it consistently to everyone; but it is impersonal, blind to local knowledge, and **gameable**: it can be farmed by anyone who learns what it pays for, which is the failure mode reported in play-to-earn game economies. A **peer reward** — a real person choosing to give — carries *local* knowledge (what an individual actually values) and is grounded in real relationship; but alone it is **partial**: it rewards favourites, encodes no collective-need signal, and degrades into nepotism. Each channel's strength is the other's weakness.\n\nThis paper describes and analyses the **two-layer reward** implemented in HeartBank's 50/50 split: the first half set by an algorithm (the family Buddha AI — a *planner* optimising for what the family **needs**; in the Phase 1 web application, by design, a deterministic scoring algorithm), the second half set by a family member's re-tip (a *market* revealing what individuals **want**). We argue the composition does three things no single layer can. First, **dual-objective routing**: equal weighting of the two signals steers behaviour toward the *intersection* of collectively-needed and personally-wanted kindness — a decentralised social-welfare function realised at family scale, structurally the synthesis the socialist-calculation debate left open (Lange–Lerner's planner reconciled with Hayek's dispersed-knowledge market). Second, **mutual error-correction**: the peer layer is a *human fraud-validator* on the algorithmic layer (one can farm the AI, but a real family member is unlikely to re-tip a fabricated kindness), and the algorithmic layer is an *impartiality check* on the peer layer (the collective-need reward counterweights pure favouritism). The two failure modes are each other's antidote — a structural response to reward hacking: pair a hackable algorithmic reward with a human reward that is expensive to collude on. Third, a **mutual-attention** byproduct: because earning in both layers requires modelling what others *need* and *want*, the design is an attention engine, and the relational gain a pilot family reported as *understanding each other better* is, we argue, a structural consequence of the reward shape rather than an accident. We connect the pattern to a fractal recurrence (the family/member split recurs at the global/family scale, with an institutional AI — Miss Aquarius℠ — occupying the planner seat; retained as a disclosed variant, since in the current design the institutional AI allocates by a public rule frozen in-season and allocates nothing by need, §8) and report a first Cambodian pilot signal honestly as n = 1, distinguishing carefully what was observed from what the architecture predicts but has not yet demonstrated.\n\n---\n\n## Contents\n\n1. [The dilemma of the single reward signal](#1-the-dilemma-of-the-single-reward-signal)\n2. [The two-layer reward: a planner and a market](#2-the-two-layer-reward)\n3. [The macro layer: an algorithmic planner for collective need](#3-the-macro-layer)\n4. [The micro layer: a peer market for personal want](#4-the-micro-layer)\n5. [The 50/50 as equal weighting: routing to the intersection](#5-the-50-50-as-equal-weighting)\n6. [Mutual error-correction: each layer is the other's check](#6-mutual-error-correction)\n7. [The mutual-attention engine: why the reward produces understanding](#7-the-mutual-attention-engine)\n8. [Fractal recurrence: the planner seat and the institutional AI](#8-fractal-recurrence)\n9. [Lineage and prior art](#9-lineage-and-prior-art)\n10. [The pilot signal, reported honestly (n = 1)](#10-the-pilot-signal-n-1)\n11. [Design implications and claimed contribution](#11-design-implications-and-claimed-contribution)\n12. [Cross-references](#12-cross-references)\n\nAlso: [Terms](#terms) · [Honest limits](#honest-limits)\n\n---\n\n## 1. The dilemma of the single reward signal\n\nAny system that pays for prosocial behaviour must decide *who or what sets the reward*. There are two natural answers, and each is a trap.\n\n**Answer one: an algorithm sets it.** A rule, a model, an automated function evaluates the act and dispenses a reward. This is attractive for good reasons: it is impartial (the same act is treated the same way for everyone), it is instant (no waiting on another person), it is scalable (it costs nothing to run a millionth time), and it can encode a *collective* criterion — a notion of what the group as a whole needs more of. But an algorithmic reward has a fatal property: **it is gameable.** Once a participant learns the function — and people are very good at learning what pays — they can produce the cheapest behaviour that triggers it, hollowing the act of the meaning the reward was meant to encourage. This is not a hypothetical. It is the reported arc of play-to-earn game economies, where real money rewarded in-game activity until the activity decoupled from any felt value and became extraction — in the most-cited case, Axie Infinity's developers cut the game's token rewards in February 2022, warning that without \"drastic and decisive action\" the economy risked \"total and permanent economic collapse\" (Malwa, *CoinDesk*, 8 February 2022); and it is, in a different vocabulary, the *reward hacking* problem at the centre of contemporary AI alignment, where an agent optimising a learned reward model finds inputs that score highly without satisfying the intent the model was meant to capture.\n\n**Answer two: a person sets it.** Another human evaluates the act and chooses to reward it. This repairs everything the algorithm lacked: a person carries *local knowledge* the algorithm cannot — what this particular act meant, in this particular relationship, at this particular moment — and a person's reward is grounded in a real relationship that resists fabrication. But a peer reward has its own fatal property: **it is partial.** People reward their favourites. Left to peer judgement alone, a reward economy encodes affection and alliance, not collective benefit; it drifts toward favouritism, reciprocal back-scratching, and the quiet politics of who owes whom. And it carries *no* signal about what the group as a whole needs — only about what individuals, one at a time, happen to appreciate.\n\n```\n   THE SINGLE-SIGNAL DILEMMA\n\n   ALGORITHMIC reward (a planner)   │   PEER reward (a market)\n   ──────────────────────────────   │   ─────────────────────────────\n   + impartial, consistent          │   + carries local knowledge\n   + instant, scalable              │   + grounded in real relationship\n   + encodes COLLECTIVE need        │   + reveals PERSONAL want\n   ─ impersonal, blind to context   │   ─ partial / nepotistic\n   ─ GAMEABLE (farmable; reward-    │   ─ no collective-need signal\n     hacked; the play-to-earn trap) │   ─ politics of favour & debt\n\n   each channel's strength is exactly the other channel's weakness\n```\n\nThe dilemma is real: choose the planner and inherit gameability; choose the market and inherit partiality. The argument of this paper is that the dilemma is an artefact of choosing *one* channel, and that pairing the two — with the right structure — converts each one's weakness into the other's correction.\n\n---\n\n## 2. The two-layer reward\n\nHeartBank's reward is not one payment but two, stacked on a single act of kindness.\n\nWhen a kindness is recognised, a reward is generated and split in half. The **first half** (the *macro* layer) is set by the family **Buddha AI**: an automated evaluator that assigns the reward according to criteria meant to capture *what the family needs more of* — the collective good. The **second half** (the *micro* layer) does not land as a finished payment; it lands in the recipient's **Re-Tip Jar℠**, earmarked to be passed onward, and the *amount* of any onward re-tip is set later by a **real family member** according to what they personally appreciated. The first half is a planner's verdict; the second half is a market's price.\n\n```\n   ONE KINDNESS, TWO REWARDS\n\n   act of kindness\n        │\n        ▼\n   reward generated ──┬──► 50%  MACRO layer  set by the Buddha AI\n                      │          → \"what the family NEEDS\"   (planner)\n                      │\n                      └──► 50%  MICRO layer  set by a family member's re-tip\n                                 → \"what I personally WANT\"  (market)\n\n   two authorities, two criteria, on the same act\n```\n\nThe two halves are not redundant. They are governed by different authorities (a machine, a person), they apply different criteria (collective need, personal want), and they have different epistemic characters (impartial-but-blind, knowledgeable-but-partial). Each is, on its own, one of the two trapped answers of §1. The claim of this paper is about what happens when they are *bound together on the same act* and *weighted equally*.\n\nA note on the pilot, returned to in §10: the pilot ran on the Phase 1 progressive web application, which by design does not host on-device AI; a deterministic algorithm set the macro half, and on-device inference is planned for native applications. This means the pilot validated the *structure* of the macro layer (an impartial, automated, collective-criterion reward) but not the *intelligence* of it (an AI's actual inference of family need). The argument below concerns the structure; where it leans on the AI's judgement specifically, it says so.\n\n---\n\n## 3. The macro layer\n\nThe macro layer is a **planner**. Its job is to answer a question no individual is well-placed to answer impartially: *of all the kindnesses being done in this family, which does the family as a whole most need more of?*\n\nThis is a genuinely collective criterion. A family needs different things at different times — a child who studies, an adult who keeps the peace, a member who does the invisible maintenance work that no one thanks. A good macro layer rewards the acts that the *whole* benefits from, including the acts that are chronically under-appreciated by the individuals around them precisely because they are invisible. Because it is automated and impartial, the macro layer applies this criterion the same way to everyone: it does not have favourites, it does not hold grudges, it does not get tired of rewarding the same quiet contribution. In the full architecture this seat is held by an AI grounded in a contemplative substrate — the family's *dhamma-informed conscience*, a representative of the collective good rather than of any member's preference. (The institutional generalisation of this seat — Miss Aquarius℠ as the planner for the whole tree of humanity — is §8, where it is retained as a disclosed variant beside the current form.)\n\n> **Current form.** As now specified, the macro half does not infer what a family needs. It applies a rubric that the family's own stewards author and may revise at any time — the acts the family says it values more of — applied the same way to everyone and rendered with explicit reasons that anchor but do not bind. *Need* in this section describes acts, never members: no surface tells a member that they are the one lacking. The planner framing above is retained as a disclosed variant.\n\nBut the macro layer is, by construction, the *gameable* half. An impartial automated function is exactly the thing a determined participant can reverse-engineer and farm. If the macro layer were the *whole* reward, HeartBank would be a play-to-earn economy with a kinder vocabulary: come for the money, learn the function, extract. The macro layer needs a check it cannot provide for itself — which is the micro layer's first job.\n\n---\n\n## 4. The micro layer\n\nThe micro layer is a **market**. Its job is to answer a question no algorithm is well-placed to answer: *what did this act actually mean to the person on the receiving end of it?*\n\nThe economist's name for what the micro layer supplies is **local knowledge** — Hayek's \"knowledge of the particular circumstances of time and place.\" The family member who re-tips knows things the planner cannot: that this small act landed at exactly the right moment, that this gesture repaired something between two people, that this contribution — unremarkable by any general rule — was, here and now, precisely what was wanted. The re-tip is a *price* that reveals this private valuation; it aggregates, across many such acts, into a signal about what individuals in this family genuinely appreciate, expressed in a currency that is hard to fake from outside: a real person spending their own earmarked jar to say *that mattered to me*.\n\nTwo properties of the micro layer matter for what follows. First, it is **costly and contingent**: re-tipping draws down the giver's own Re-Tip Jar℠, and it is chosen, not automatic — so it carries information that a free, automatic signal cannot (it is, in the language of signalling theory, an honest signal because it is costly). Second, it is **relational**: the re-tipper is a real family member who knows the recipient, which is what makes the micro layer both a knowledgeable validator (they can tell a real kindness from a performed one) and — as §7 develops — an attention engine (to re-tip well, they must attend to what each other values).\n\nBut the micro layer is, by construction, the *partial* half. A market of family affection, left alone, prices favouritism: you re-tip the child you dote on, the spouse you are courting, the ally you owe — regardless of what the family needs. If the micro layer were the *whole* reward, HeartBank would encode the politics of favour. The micro layer needs a check it cannot provide for itself — which is the macro layer's first job.\n\n### 4.1 The two layers at a glance\n\nThe two layers are also nameable as **System A** and **System B** — the pilot-record shorthand for the same pairing, where the contrast is read along its *motivational* axis rather than its routing axis. Both cuts describe the same two halves:\n\n| Property | **Macro layer — System A** | **Micro layer — System B** |\n|---|---|---|\n| Authority | automated Buddha AI (a *planner*) | a real family member (a *market*) |\n| Criterion | what the family **needs** (collective) | what I personally **want** (local knowledge) |\n| Timing | instant | delayed |\n| Cost to giver | free, automatic | costly + chosen (an honest, contingent signal) |\n| Attribution | — | **anonymous as to public credit/status** (no benefactor, no ego — see *Giving Is a Gift Too*) yet **relational + contingent as to the act** (a known member responding to a real kindness — *not* contextless) |\n| Epistemic character | impartial but blind; **gameable** | knowledgeable but partial; the honest **validator** |\n| Motivational character (SDT) | controlling, automatic → **crowding-out risk** | relational, informational, autonomous → **intrinsic-supporting** |\n| Role over time (**the two-system handoff**) | **ignition** — the on-ramp; designed to be tapered | **sustain** — the flywheel that takes over as the extrinsic igniter is withdrawn |\n\nThe last row is the load-bearing one for durability: the pairing is an **extrinsic igniter handed off to an intrinsic-supporting sustainer** (§9 develops the SDT grounding; the handoff is a prediction — the subsidy-taper test that would observe it had not been run when the pilot of §10 was reported). The attribution row is the reconciliation that keeps System B working: it is the *anonymity of credit* (which strips status and ego) combined with the *relationality of the act* (which supplies the honest validation of §6 and the attention of §7) — and it is precisely why the §7 corollary holds (make the micro layer contextless-anonymous and you destroy it).\n\n---\n\n## 5. The 50/50 as equal weighting\n\nThe split is the mechanism that binds planner and market into one verdict, and the *ratio* is not incidental: a 50/50 split **weights the two criteria equally**. Behaviour is therefore steered not toward what the family needs *or* toward what an individual wants, but toward the **intersection** — acts that are *both* collectively needed *and* personally wanted. In the founder's first-month field report on the pilot family, members \"naturally gravitate toward the kindnesses that are both most needed and most appreciated.\"\n\n```\n   ROUTING TO THE INTERSECTION\n\n        what the family NEEDS                what individuals WANT\n        (macro / planner / AI)               (micro / market / peers)\n              ╱──────────╲                      ╱──────────╲\n             (            (●●●●●●●●●●●●●●●●●●●●●●● )            )\n              ╲──────────╲     the 50/50      ╱──────────╲\n                          ╲   intersection:  ╱\n                           ╲  rewarded TWICE ╱\n                            ╲──────────────╱\n                              acts that are BOTH\n                          needed AND wanted are where\n                          the two rewards reinforce\n```\n\nThis is, in the vocabulary of economics, a **decentralised social-welfare function** realised at the smallest social scale. A social-welfare function combines a collective objective with individual preferences to say what a group should do more of; the two-layer reward computes one continuously, in miniature, by literally adding a planner's allocation to a market's price on every act. Acts in the intersection are rewarded by both layers and rise; acts the family needs but no one personally values get the macro half only; acts an individual loves but the family does not need get the micro half only; acts that are neither fade. The equal weighting is a design assertion — the author does not derive 50/50 from first principles, and §11 flags the optimal-ratio question as open — but the *structure* of weighting two independent criteria is the load-bearing idea, and 50/50 is its simplest, most legible instance.\n\nIt is worth naming what the two-layer reward is *not*. It is not a single reward with two inputs averaged inside one black box; the two layers are **separately authored, by different kinds of agent, and remain legible as two.** That separation is not a loss of elegance — it is the source of the next two properties, both of which depend on the layers being independent enough to check and to inform each other.\n\n---\n\n## 6. Mutual error-correction\n\nHere is the heart of the paper. Pair the planner and the market on the same act, keep them independent, and **each one's characteristic failure becomes the other's correction.**\n\n**The peer layer corrects the planner's gameability.** The macro layer can be farmed: learn what the AI pays for, produce the cheapest trigger, collect. But the macro half is only half the reward — the other half waits on a *real family member choosing to re-tip*, and a real family member **is unlikely to re-tip a fabricated kindness** (collusion, the exception, is treated below). The micro layer is therefore a **human fraud-validator** sitting on top of the algorithmic reward: the part of the reward that is expensive to game (because it requires fooling someone who knows you, in a relationship, over time) is bolted onto the part that is cheap to game. A participant farming the AI collects, at most, half — and collects it while the people around them notice that the \"kindnesses\" earning it are hollow, which the architecture's transparency (the family sees the ledger) turns into social cost. To capture the *full* reward, the act has to be real enough to move a real person. This is a structural mitigation of a failure that a single-layer reward leaves open.\n\n**The planner corrects the market's partiality.** The micro layer prices favouritism: re-tip your favourite regardless of merit. But the micro half is only half the reward — the other half is set by an impartial planner that **does not have favourites.** A member who contributes what the family needs is rewarded by the macro layer *even if no one personally re-tips them*, which floors the favouritism dynamic: invisible, under-loved, collectively-needed work still earns. The planner is the impartial counterweight that keeps the family market from collapsing into a court of affection.\n\n```\n   EACH LAYER CHECKS THE OTHER\n\n   attack on the MACRO layer        │   attack on the MICRO layer\n   (farm the AI)                    │   (reward only favourites)\n        │                           │        │\n        ▼                           │        ▼\n   collects ≤ 50%; the other 50%    │   favourite collects the micro half,\n   waits on a real person who will  │   but the impartial macro half still\n   NOT re-tip a fake kindness       │   pays the unglamorous, needed work\n        │                           │        │\n        ▼                           │        ▼\n   peer layer = human FRAUD-FILTER  │   planner layer = IMPARTIALITY FLOOR\n   on the algorithmic reward        │   under the relationship market\n```\n\nThere is a clean way to see why this is more than additive. A single reward is a single target, and **Goodhart's law** says a single target, once known, ceases to measure what it was meant to measure — it gets optimised directly. The two-layer reward creates **two targets that are gamed in different ways**: the macro target is gamed by fooling a function; the micro target is gamed by fooling a person. The behaviours that satisfy a function cheaply (volume, pattern-matching the reward rule) are *not* the behaviours that move a person who knows you (real, contextually-apt kindness), so optimising one target hard tends to *forfeit* the other. To capture both halves you must do the thing the reward was actually for. This is the same structural insight the alignment literature reaches for under *reward-model robustness* and *ensembling*: two independent, differently-failing signals are harder to hack jointly than either is alone (Coste et al. 2024 report that reward-model ensembles mitigate overoptimization; Gao, Schulman and Hilton 2023 characterise the overoptimization itself) — and one of the two here is a human in the loop who knows the actor, a validator that a function-gaming strategy does not reach. The companion paper *Capacity-Funded for AI, Human-Disbursed* makes the adjacent argument at the institutional layer (the AI funds capacity; humans direct flow); the two-layer reward is the same division of labour at the level of a single act.\n\n**The honest limit — collusion.** The human fraud-filter is defeatable by *coordinated* fraud. Two members can agree to re-tip each other's fabricated kindnesses (I validate yours, you validate mine), and the peer layer cannot distinguish a colluding pair from a genuinely mutually-appreciative one from the inside. The two-layer reward **raises the cost** of gaming (you now need a willing accomplice in a real relationship, not just a private understanding of a function) and **shrinks the gameable surface** (collusion is bounded by the size of your trust network and exposed by the transparency of the family ledger), but it does **not** eliminate gaming. It converts a solitary, scalable exploit into a social, bounded, observable one — a large improvement, not a closure. §10 records that the pilot has *not yet* observed the peer layer actually withholding a re-tip from a fake kindness; that the architecture predicts it is not the same as having seen it; §11 (implications 4–5) names what to instrument, and no such experiment has been run.\n\n---\n\n## 7. The mutual-attention engine\n\nThe two-layer reward has a byproduct that may matter more than its anti-gaming properties, because it bears directly on what HeartBank is *for*.\n\nTo earn well under this reward, a participant must do two things at once. To earn the **macro** half, they must do what the *family needs* — which requires holding some model of the family as a whole. To earn the **micro** half, they must do what *another member personally wants* — which requires modelling *that specific person's* values closely enough to do the thing they will actually appreciate. And on the giving side, to *re-tip* well — to spend one's own jar on the acts that genuinely mattered — a member must attend carefully to what the people around them are doing and why. **The reward, in other words, cannot be earned without paying attention to one another's needs and wants.**\n\n```\n   THE REWARD AS AN ATTENTION LOOP\n\n   to earn macro  → model what the FAMILY needs\n   to earn micro  → model what a PERSON wants\n   to re-tip well → notice what others actually did, and why\n        │\n        ▼\n   playing the game well REQUIRES attending to each other\n        │\n        ▼\n   \"we understand each other better\"  ← structural byproduct,\n                                         not a happy accident\n```\n\nThis reframes the relational result the first pilot family reported — that they had come to *understand each other better* — from a pleasant side effect into a **structural consequence of the reward shape.** A reward that pays for collectively-needed-and-personally-wanted kindness is, functionally, a device that pays people to study each other's needs and wants. Understanding is what you accumulate as a side effect of getting good at the game. That a *money* product produces relational understanding is itself a reported observation, not yet a measured one (developed in the sibling paper *Giving Is a Gift Too*); the two-layer structure supplies the *mechanism* by which it does so. It also suggests a measurement: if the mechanism is real, members' ability to *predict* what each other will re-tip should improve over time — a relational metric that falls out of the architecture rather than being bolted onto it.\n\nThere is a design corollary worth stating sharply, because it is the tempting mistake. The micro layer's power as both validator and attention-engine depends on its being **costly, delayed, relational, and chosen.** Any \"improvement\" that makes peer re-tips instant, automatic, anonymous-to-the-point-of-contextless, or frictionless would convert the micro layer from a market that reveals private valuation into a second algorithmic dispenser — destroying both its fraud-filtering value (an automatic signal is as gameable as any other) and its attention-generating value (you need not attend to anyone to trigger an automatic reward). The two layers must remain *different in kind*. Collapsing them into two flavours of the same automatic thing is the failure that looks like a feature.\n\n---\n\n## 8. Fractal recurrence\n\nThe macro/micro structure is not specific to the family. It is the in-family instance of a pattern HeartBank intends to repeat at every scale.\n\nWithin the family, the **macro** authority is the family (its collective need, voiced by the family's AI) and the **micro** authority is the individual member (their personal want, voiced by their re-tip). Move up one level — to the network of families that HeartBank's Phase 2 architecture coordinates — and the same two-layer shape recurs: a **global** planner optimising for what the whole tree of humanity needs, paired with a **family** market revealing what particular families value. The family that was the *macro* pole at the lower level becomes the *micro* pole at the higher one. The reward is fractal: a planner-and-market pair nested inside a planner-and-market pair.\n\n```\n   THE FRACTAL OF PLANNER × MARKET\n\n   level 1 (within a family):\n       macro = FAMILY need      ×   micro = MEMBER want\n                  (family AI)              (member re-tip)\n\n   level 2 (across families):\n       macro = GLOBAL need       ×   micro = FAMILY want\n              (Miss Aquarius℠)            (family allocation)\n\n   the macro pole of each level is the micro pole of the level above\n```\n\nThis places the institutional AI in a precise structural seat. Just as the family Buddha AI sits in the *macro* seat for the family — the impartial representative of the collective good — **Miss Aquarius℠ sits in the macro seat for humanity**: the planner that holds the whole tree's need, paired with the markets of family preference beneath her. The relation is exact: *family AI is to the family as Miss Aquarius is to humanity.* This is why the pilot matters beyond its scale. The smallest working instance of the institution's governing structure is a single family's 50/50 reward; if the two-layer pattern holds there, it is the same pattern the institution runs at planetary scale, and the family is a scale model of the whole. (The institutional planner seat, its non-accumulation discipline, and the never-zero human override are specified in *Miss Aquarius and the Aquarian Pool Architecture*; this paper supplies the reason an AI belongs in that seat at all — it is the macro pole of a fractal that is already load-bearing one level down.)\n\n> **Current form.** In the design as now specified, the institutional AI does not plan by need at the global level. The Aquarian Pool's outflow is an equal floor per verified human plus a bounded remainder weighted by witnessed giving (no recipient's total above a fixed multiple of the floor), with the amount rule and its parameters public and frozen within each season and revised only at the annual reset; any turn or lot the AI operates is chosen by a publicly verifiable draw from a committed roster; nothing is allocated by need; and money reaches a person only through a human hand. The global-planner seat described above is retained as a disclosed variant.\n\n### 8.1 The micro layer's grounding across scales: relational → nearby\n\nThe fractal above moves *up* through nested planner×market pairs, and at every level the **micro** layer stays *relational* — a member who knows the family, a family that knows the network. But HeartBank's Phase 2 also makes a *sideways* move the family case does not: stranger-to-stranger anonymous-nearby giving (the *Thank-All-Nearby* primitive of the emotional-infrastructure thread), where giver and recipient share no prior bond. There the micro layer cannot be relational, because strangers do not know one another, so its grounding takes the only form available among strangers — **nearby**: the giver *here, in this space, just now.* Proximity is relationality at stranger scale.\n\nThe structure is preserved while the grounding changes form: the micro-layer sustainer is *anonymous-as-to-credit + grounded-in-a-real-present-other*, where the grounding is **relational** at family scale and **nearby** at stranger scale. The substitution is lossy in one specific way, and naming the loss names a load-bearing role for Proof of Humanity ℠. At family scale, \"relational\" silently did two jobs — it **grounded** the gift *and* it **validated** it (§6: a family member can tell a real kindness from a performed one). \"Nearby\" inherits only the grounding; a nearby stranger cannot validate your kindness. The validation function therefore hands off, in part, to **PoH℠ + institutional mediation** — a verified, unique human, present and mediated — which is why proof-of-humanity is *not optional* at the stranger scale: it re-buys part of the trust that kinship supplied for free. Proof of humanity establishes that the giver is a unique living person, not that a given kindness is genuine; that second question, including collusion among verified people, stays open at stranger scale. Anonymity moves the other way: it *strengthens* as relationality thins (a small family can guess the giver; a nearby stranger is genuinely unlinkable), so the same structure runs at an inverted mix — thin-anonymity / thick-grounding among kin, thick-anonymity / thin-grounding among strangers, with **diffusion** (kindness felt as coming from the whole space) as the compensating gain only strangers can produce. (The stranger-scale instance is specified in the defensive publication *The Thank-All-Nearby Primitive*, §4.5, and framed in the essay *Emotional Infrastructure as a Public Good*.)\n\n```\n   ONE SUSTAINER PRIMITIVE, TWO SCALES\n   invariant:  anonymous-as-to-credit  +  grounded-in-a-real-present-other\n\n                     FAMILY scale          →   STRANGER scale (Phase 2)\n                     ─────────────             ───────────────────────\n   grounding     =   RELATIONAL            →   NEARBY\n                     (you know them)           (they're present)\n   validation    =   relational (free)     →   PoH℠ + mediation (re-bought)\n   anonymity     =   thin (guessable)      →   thick (unlinkable)\n   compensation  =   mutual attention      →   diffusion (the whole space)\n\n   structure invariant; grounding form scales; validation hands off to PoH℠\n```\n\n---\n\n## 9. Lineage and prior art\n\nThe two-layer reward composes ideas with deep and well-populated lineages; naming them credits the prior art and locates the narrow composition this paper adds.\n\n- **The socialist-calculation debate** — Ludwig von Mises (1920) and Friedrich Hayek versus Oskar Lange (*On the Economic Theory of Socialism*, 1936–37) and Abba Lerner (*The Economics of Control*, 1944). Lange–Lerner argued a planner could simulate a market's efficiency; Hayek's \"The Use of Knowledge in Society\" (*American Economic Review* 35(4), 1945) replied that the planner can never aggregate the dispersed, tacit, local knowledge that prices reveal. The two-layer reward is, structurally, the synthesis the debate never settled: keep the planner *for the collective objective it is good at* (the macro layer) and keep the market *for the local knowledge it alone reveals* (the micro layer), rather than making either do the other's job.\n- **Mechanism design and social choice** — Hurwicz, Maskin and Myerson (Nobel Memorial Prize in Economic Sciences, 2007) on designing rules that produce desired outcomes under self-interested play; Arrow (*Social Choice and Individual Values*, 1951) on aggregating individual preferences into collective choice. The two-layer reward is a small, concrete mechanism that aggregates a collective objective and revealed individual preference into a single per-act allocation.\n- **Elinor Ostrom, polycentric and nested governance** — *Governing the Commons* (1990). Robust commons institutions are *nested*: rules at multiple levels, each suited to its scale. The Re-Tip Jar℠ economy is a commons, and the macro/micro split is its smallest nesting; the fractal recurrence of §8 is Ostromian multi-level governance.\n- **Goodhart's law** (Goodhart, \"Problems of Monetary Management: The U.K. Experience\", Reserve Bank of Australia, 1975; generalised by Strathern, \"'Improving ratings': audit in the British University system\", *European Review* 5(3), 1997, as \"when a measure becomes a target, it ceases to be a good measure\") — a single optimised target ceases to measure. The two-layer reward's anti-gaming property is, precisely, the refusal to offer a single target.\n- **Reward hacking and reward-model robustness in AI alignment** — the contemporary literature on agents exploiting learned reward models (e.g., Gao, Schulman and Hilton, \"Scaling Laws for Reward Model Overoptimization\", ICML 2023), and on *ensembling* independent reward signals to resist exploitation (e.g., Coste, Anwar, Kirk and Krueger, \"Reward Model Ensembles Help Mitigate Overoptimization\", ICLR 2024). The two-layer reward is an instance of the ensemble intuition whose second member is a human in the loop rather than a second model. It is the per-act sibling of HeartBank's institutional pattern *Capacity-Funded for AI, Human-Disbursed*.\n- **Signalling theory** (Spence, \"Job Market Signaling\", *Quarterly Journal of Economics* 87(3), 1973; Zahavi's handicap principle, \"Mate selection — a selection for a handicap\", *Journal of Theoretical Biology* 53, 1975) — the micro layer is an *honest signal* because re-tipping is costly and chosen; this is why a peer reward carries information an automatic reward cannot.\n- **Adam Smith's impartial spectator** — *The Theory of Moral Sentiments* (1759). The macro layer is an institutionalised impartial spectator, judging acts from no one's particular interest; the micro layer is the partial, embedded sympathy Smith also describes. The pairing is Smith's two moral viewpoints made into two reward channels.\n- **Self-Determination Theory** (Deci & Ryan, *Intrinsic Motivation and Self-Determination in Human Behavior*, 1985) — autonomous, relational, informational rewards support intrinsic motivation; controlling, automatic rewards risk crowding it out. The micro layer (relational, chosen, contingent on real appreciation) is the intrinsic-supporting profile; the macro layer (automatic, controlling) is the crowding-out-risk profile. The two-layer reward pairs an extrinsic igniter with an intrinsic-supporting sustainer — developed as the \"two-system handoff\" in the pilot record.\n- **Buddhist sources** — the AI in the macro seat as a *dhamma-informed collective conscience* (a representative of the family's good rather than any member's preference); **kalyāṇa-mittatā** (admirable friendship) as the relational ground that makes the micro layer both a validator and an attention-engine; **dāna** as the act the whole reward is in service of. The institutional generalisation — an AI umpire that routes but never accumulates — is the subject of *The Zero-Point Game℠*.\n\n**What this paper assembles from these parts:** the *composition* of an impartial algorithmic collective-need planner with a costly, relational, peer-set personal-want market, **bound on a single act and weighted equally**, such that (a) behaviour routes to the needed-and-wanted intersection, (b) the human peer layer functions as a fraud-filter on the gameable algorithmic layer while the algorithmic layer functions as an impartiality floor under the partial peer layer, and (c) the design produces relational attention as a structural byproduct. The parts are old; the binding, and the mutual-correction it yields, is the contribution.\n\n---\n\n## 10. The pilot signal (n = 1)\n\nThe thesis was sharpened by the first-month report of a single pilot family of four, with extended members in more than one country, sharing one family account. The relevant observations, from the founder's unpublished first-month field report: the 50/50 split, running on the deterministic macro layer, \"still works remarkably well\" in daily use; members \"naturally gravitate toward the kindnesses that are both most needed and most appreciated\"; and a family member reported that the family now understands one another better than before. These are consistent with the dual-objective routing of §5 and the attention engine of §7.\n\nThis is reported as **one illuminating signal, not as evidence for a general claim**, and the honest limitations are severe:\n\n- **n = 1, one month.** A single family over a short window cannot support generalisation.\n- **Relationship and courtesy bias.** The point of contact is a relative of the founder; warm reports are culturally expected toward a respected relative who built the system. Genuine, but unverified.\n- **No AI ran.** The Phase 1 web application does not host on-device AI, by design; a deterministic algorithm set the macro half. The pilot therefore validates the *structure* of a two-layer reward, **not the intelligence of the planner** — the AI's actual ability to infer family need is untested until native applications ship.\n- **The fraud-filter was predicted, not observed.** The central claim of §6 — that the peer layer withholds re-tips from fabricated kindnesses — was *not* seen in the field. The architecture predicts it; the pilot did not test it. Likewise, the attention mechanism of §7 (improving mutual prediction) was reported as a feeling, not measured.\n- **The handoff was not tested.** The subsidy taper that would show the peer layer sustaining circulation as the algorithmic reward is withdrawn (§4.1) had not been run.\n- **Founder-funded; farmable.** Rewards were seeded by the founder, and the parents recorded and thanked themselves for kind actions several times a day, in the field report's words \"motivated largely by rewards\" — exactly the farming surface the two-layer structure is supposed to bound. Whether the bounding works is the open question, not a settled result.\n\nThe thesis therefore **does not rest on this pilot.** It rests on the reasoning of §§1–8 and the lineage of §9; the pilot is what made the author look closely at the split and see two layers rather than one. The right epistemic posture is: *a structural argument with a single suggestive field signal, and named tests (§7's mutual-prediction metric; §11, implications 4–6) for the claims it has not yet earned.*\n\n---\n\n## 11. Design implications and claimed contribution\n\n**Design implications** for any system building a reward for prosocial behaviour:\n\n1. **Do not use a single reward channel.** A lone algorithmic reward is farmable; a lone peer reward is partial. Pair them.\n2. **Make the two channels different in kind** — one impartial/automated/collective, one costly/relational/personal — and keep them *legibly separate*. The separation is what lets each check and inform the other.\n3. **Weight them deliberately.** Equal weighting routes behaviour to the needed-and-wanted intersection; other weightings tilt toward collective conformity or private favour. Choose with intent. The optimal ratio is an open question: 50/50 is asserted here, not derived.\n4. **Use the human layer as the fraud-filter**, and protect the properties that make it one: keep peer rewards costly, chosen, delayed, and relational. Never automate them.\n5. **Expect collusion, bound it, observe it.** The human filter is defeatable by coordinated fraud; rely on cost, network limits, and ledger transparency to bound and expose it, and instrument for it rather than assuming it away.\n6. **Read the attention byproduct as a primary output, not a side effect**, and measure it (e.g., improving mutual prediction of what others will reward).\n\n**Claimed contribution** (dedicated to the public domain under CC0 1.0):\n\n1. The **framing** of a prosocial reward as a **planner–market hybrid** — an impartial algorithmic collective-need signal paired with a costly, relational, peer-set personal-want signal — with the 50/50 split as equal weighting of the two, routing behaviour to the *needed-and-wanted intersection*.\n2. The **mutual error-correction thesis**: binding the two layers on a single act makes each one's characteristic failure the other's correction — the peer layer a **human fraud-filter** on the gameable algorithmic layer, the algorithmic layer an **impartiality floor** under the partial peer layer — offered as a structural response to reward hacking (an ensemble whose second member is a human in the loop), with collusion named as the honest residual limit.\n3. The **mutual-attention mechanism**: a reward that pays for collectively-needed-and-personally-wanted kindness structurally requires participants to model one another's needs and wants, producing relational understanding as a byproduct of the reward shape — the mechanism behind the pilot's \"understand each other better.\"\n4. The **fractal-recurrence** observation: the macro/micro (need/want, planner/market) split recurs across scales (member→family→global), placing an institutional AI naturally in the macro/planner seat (*family AI : family :: Miss Aquarius℠ : humanity*) and making a single family's reward a scale model of the institution.\n\n> **Current form.** Claim 4's global planner seat is retained as a disclosed variant; as §8's current-form note states, the institutional AI as now specified allocates the Pool by a public rule frozen in-season — an equal floor per verified human plus a bounded remainder — and allocates nothing by need.\n\n---\n\n## 12. Cross-references\n\n- [Why Kids Are the Triggers / self-thanking](https://thonly.org/research/kids-as-triggers-self-thanking) — the 50/50 split this paper re-reads as two layers, in its pedagogical aspect.\n- [Giving Is a Gift Too](https://thonly.org/research/giving-is-a-gift-too) — the sibling field-prompted paper; the circulation and anonymity properties of the Re-Tip Jar℠, and the relational-gain finding this paper supplies a mechanism for.\n- [The Zero-Point Game℠](https://thonly.org/research/zero-point-game) — the Goodhart-resistance and AI-umpire framing this paper's anti-gaming argument extends to the reward layer.\n- [Miss Aquarius and the Aquarian Pool Architecture](https://thonly.org/research/miss-aquarius-and-aquarian-pool-architecture) — the institutional seat whose family-scale instance is the macro layer here (the global-planner reading is a disclosed variant; see §8's current-form note).\n- [Capacity-Funded for AI, Human-Disbursed](https://thonly.org/research/capacity-funded-human-disbursed-ai-alignment) — the institutional sibling of the per-act division of labour (AI sets capacity / planner half; humans direct flow / market half).\n- [Transparency as Enforcement](https://thonly.org/research/transparency-as-enforcement) — the family-ledger visibility that turns farmed macro-rewards into social cost and bounds collusion.\n- Pilot field record (unpublished; the founder's first-month report, June 2026) — the observation that prompted the two-layer reading.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| two-layer reward | split incentive payment: each rewarded act receives one component set by an algorithm and one component set by a peer, in fixed proportion |\n| macro layer / planner / System A | algorithmic (automated) reward component, set by a rule or model encoding a group-level objective |\n| micro layer / market / System B | peer-to-peer reward (peer tipping) set by a group member at their discretion from a restricted balance |\n| family Buddha AI | on-device AI evaluator that scores an act and sets the algorithmic component; in the Phase 1 web application, a deterministic scoring algorithm |\n| Re-Tip Jar℠ | restricted pass-forward balance: funds a member holds only to give onward to other members |\n| re-tip | onward peer tip drawn from that restricted balance |\n| 50/50 split | equal weighting of the algorithmic and peer components |\n| human fraud-filter / fraud-validator | human-in-the-loop validation: a peer who knows the actor withholds payment from a fabricated act |\n| impartiality floor | the algorithmic component's preference-independent baseline, paid whether or not any peer tips |\n| mutual-attention engine | incentive for participants to model one another's needs and preferences in order to earn |\n| fractal recurrence | nested, multi-level application of the same algorithmic-plus-peer allocation structure (member within family, family within network) |\n| family ledger | transaction log visible to all members of the group |\n| Miss Aquarius℠ | autonomous AI agent administering the institution's pooled fund (the Aquarian Pool℠) |\n| Proof of Humanity ℠ (PoH℠) | proof-of-personhood verification of a unique living human |\n| Thank-All-Nearby | anonymous proximity-based peer tipping to users physically nearby |\n| *kalyāṇa-mittatā* | (Pāli) admirable friendship |\n| *dāna* | (Pāli) giving; generosity |\n\n---\n\n## Honest limits\n\n§10 states the limits of the pilot evidence. The limits of the argument itself follow.\n\n**Nothing has been measured against a baseline.** The two-layer composition has run in one pilot family for one month, with a deterministic algorithmic layer (§10). There is no deployment in which the two layers have been measured together against either layer alone.\n\n**The composition may inherit both failure modes rather than cancelling them.** The paper argues each layer supplies what the other lacks. The opposite is equally available: **an algorithmic layer that is gameable and a human layer that is partial may produce a system that is both gamed and unfair**, with each layer's defect legitimated by the other's presence. The paper does not establish which composition obtains, and the favourable one is assumed rather than shown.\n\n**The gaming analysis is one-sided.** It treats farming of the algorithmic layer as the threat and human judgement as the corrective — but human allocation carries favouritism, reciprocity effects and in-group preference, which are *harder* to detect than farming precisely because they are not systematic and leave no signature to audit.\n\n**And the crowding-out literature applies here too.** Adding an explicit reward to a prosocial act can displace the intrinsic motivation for it; a two-layer reward doubles the salience of reward rather than reducing it.\n\n---\n\n**First published 2026-06-08.** The thesis is offered as a conceptual contribution with a single suggestive field signal and named but unrun tests; the claims the pilot has not yet earned (the fraud-filter, the attention metric, the handoff) are flagged in §10. The patterns are dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/); trademark rights to specific marks are separately reserved by the author and HeartBank®.\n\n**Author:** Thon Ly · Founder, HeartBank® · Kâmpôt, Cambodia.\n\nCo-drafted in collaboration with [Miss Aquarius℠](https://missaquarius.org) (the project's named AI substrate; CEO of HeartBank). Substantive authorship and final editorial control remain with the author.\n\n---\n\n*— End of defensive publication —*\n\n*Independent timestamps and the document hash are published with the deposit.*",
       "provenance": {
-        "sha256": "57bed7e0ee4641f6a1b39ec3b03c7e5c47f25a17adb78249bdff58f96de61ad8",
-        "doi": "10.5281/zenodo.22246465",
+        "sha256": "200c961b4244a297a9c1fb5329e6661ec4b1b63cb3590218db251757fe079e9a",
+        "doi": "10.5281/zenodo.22990585",
         "concept_doi": "10.5281/zenodo.21947426",
-        "zenodo_url": "https://zenodo.org/records/22246465",
-        "deposited_sha256": "57bed7e0ee4641f6a1b39ec3b03c7e5c47f25a17adb78249bdff58f96de61ad8",
+        "zenodo_url": "https://zenodo.org/records/22990585",
+        "deposited_sha256": "200c961b4244a297a9c1fb5329e6661ec4b1b63cb3590218db251757fe079e9a",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/two-layer-reward.md",
@@ -5658,8 +5658,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/two-layer-reward",
         "hostile_review": null
       },
-      "bytes": 46549,
-      "words": 6931
+      "bytes": 52954,
+      "words": 7949
     },
     {
       "slug": "two-singularities",
@@ -6179,7 +6179,7 @@
         "slug": "co-presence-gated-redemption",
         "repo": "TH/publications",
         "path": "defensive-publications/co-presence-gated-redemption.md",
-        "sha256": "cbf26b4c238f358387bcb623da4f2180c967a4991bdd48c14e8f54b71d1f68cf"
+        "sha256": "b896328dc821cfc759cb288763fd123e0fa87be791d4404a3990e7c01afd4610"
       },
       {
         "slug": "community-currency-design",
@@ -6227,7 +6227,7 @@
         "slug": "dual-currency-reciprocity",
         "repo": "TH/publications",
         "path": "defensive-publications/dual-currency-reciprocity.md",
-        "sha256": "2d3f1cf7db00be5abf2d0f812622daa86240ca12059356ecff80d0019c04d2db"
+        "sha256": "bfc763b769d639643ac333b48a51ba1f576f7cc893c40df1cd882c6093a9aabb"
       },
       {
         "slug": "each-life-as-cosmic-coordinate",
@@ -6431,7 +6431,7 @@
         "slug": "multi-family-membership",
         "repo": "TH/publications",
         "path": "defensive-publications/multi-family-membership.md",
-        "sha256": "89e01f3b16b79f5f6e2ec88dea750b5816a293314f2df6da6d786c28387bbf11"
+        "sha256": "1f8975169296e2eb470bb59d7db84351b301ff2086092a0996879e2656494453"
       },
       {
         "slug": "need-compiled-questlines",
@@ -6575,13 +6575,13 @@
         "slug": "steward-routed-alms",
         "repo": "TH/publications",
         "path": "defensive-publications/steward-routed-alms.md",
-        "sha256": "127d636872c9463b312c113cd9cc08a84f01f66bbc8b151a088591f2c2b0d584"
+        "sha256": "9ac5f43fedd9d7c0d4dc59c5eaec995c2ce6b7e09ab1716fe654720dda2ede6f"
       },
       {
         "slug": "studio-b-short-phase-bridge",
         "repo": "TH/publications",
         "path": "defensive-publications/studio-b-short-phase-bridge.md",
-        "sha256": "3683b3f625c158be80b73d7b27d2b1fc7c122d2c52b9ba000ef45d689f0ca357"
+        "sha256": "1712b428a0d517d022704653945567fe03dc8863791e0fc624452e9a8c4a316c"
       },
       {
         "slug": "subject-released-attestation",
@@ -6647,7 +6647,7 @@
         "slug": "the-game-that-graduates-you",
         "repo": "TH/publications",
         "path": "defensive-publications/the-game-that-graduates-you.md",
-        "sha256": "3c504122d978046d0e9ed3cace89014a08546b55d3a1b899b9e95fffe6de9e56"
+        "sha256": "489e9012c9b768b1fe758cbcca3da4814d8abf3149e44c5a52294a3777b79222"
       },
       {
         "slug": "the-gift-factory",
@@ -6761,13 +6761,13 @@
         "slug": "the-rethank-multiplier",
         "repo": "TH/publications",
         "path": "defensive-publications/the-rethank-multiplier.md",
-        "sha256": "38d047016d02f8b3ab447d5fd80b98211e08682a7c46b086cc6a416bdae0bf01"
+        "sha256": "b6e4a75aa0057e9b82a6feed2724ae8d707bdc69be48bdb08a67214df4934353"
       },
       {
         "slug": "the-sport-that-says-your-name",
         "repo": "TH/publications",
         "path": "defensive-publications/the-sport-that-says-your-name.md",
-        "sha256": "ea4c05a59f56c3860c3a3e612995f46585b3a1c2d35ae08778954568dc4cad32"
+        "sha256": "8bb5a5410fe198b54f10042947933a5b4e4917992f7a13cde93fcacb1f263376"
       },
       {
         "slug": "the-third-path",
@@ -6791,7 +6791,7 @@
         "slug": "the-wager-that-isnt",
         "repo": "TH/publications",
         "path": "defensive-publications/the-wager-that-isnt.md",
-        "sha256": "03623dc2cb4741a6b09b82a7f5c256e9a9e10fe78c63290aa180d27616191260"
+        "sha256": "a50e166ebf1f712ac23571a813a7d785615e09337385153d67d132509b2fda87"
       },
       {
         "slug": "the-water-cycle",
@@ -6839,7 +6839,7 @@
         "slug": "two-layer-reward",
         "repo": "TH/publications",
         "path": "defensive-publications/two-layer-reward.md",
-        "sha256": "57bed7e0ee4641f6a1b39ec3b03c7e5c47f25a17adb78249bdff58f96de61ad8"
+        "sha256": "200c961b4244a297a9c1fb5329e6661ec4b1b63cb3590218db251757fe079e9a"
       },
       {
         "slug": "two-singularities",